Re: Re: [PATCH][RFC] Emulating real mode with x86_emulate

[Anthony Liguori <aliguori@us.ibm.com>]

Ugh!  Sorry that got munged.  Let me try again:

(XEN) hvmop_emulate_realmode
(XEN) guest requests real mode emulation
(XEN) foo 221
(XEN) eip = 0xd338d
(XEN) eip = 0xd338e
(XEN) eip = 0xffbf0000
(XEN) failed to emulate instruction at %eip = 0xd338d
(XEN) domain_crash_sync called from vmcs.c:625
(XEN) Domain 1 (vcpu#0) crashed on cpu#0:
(XEN) ----[ Xen-3.0-unstable  x86_32  debug=n  Not tainted ]----
(XEN) CPU:    0
(XEN) EIP:    0010:[<000d338d>]
(XEN) EFLAGS: 00000002   CONTEXT: hvm
(XEN) eax: 00000076   ebx: 000d7324   ecx: 000d7324   edx: 000000e9
(XEN) esi: 000d4e54   edi: 000d3380   ebp: 000d72a8   esp: 000d72a8
(XEN) cr0: 00050032   cr4: 00000651   cr3: 00000000   cr2: 00000000
(XEN) ds: 0000   es: 0000   fs: 0000   gs: 0000   ss: 0018   cs: 0010  

Regards,

Anthony Liguori

Anthony Liguori wrote:
> Kamble, Nitin A wrote:
>> Hi Anthony,
>>   With the new revision I am able to get the -emulate-16bit command 
>> line switch working.
>>
>> (XEN) HVM2: Creating MP tables 
>> ...                                             (XEN) HVM2: Loading 
>> Cirrus VGABIOS ...                                         (XEN) 
>> HVM2: Loading ACPI 
>> ...                                                   (XEN) HVM2: 
>> Loading VMXAssist ... deadbeef                                     
>> (XEN) HVM2: 
>> foo                                                                
>> (XEN) 
>> hvmop_emulate_realmode                                                   
>> (XEN) guest requests real mode 
>> emulation                                       (XEN) foo 
>> 221                                                                  
>> (XEN) HVM2: Invoking ROMBIOS 
>> ...                                               (XEN) hvm.c:446:d2 
>> Triple fault on VCPU0 - invoking HVM system reset.
>
> The Triple fault you're seeing here is terribly curious.  Also the 
> "deadbeef" output.  Just to sanity check, I threw the following printk 
> in vmcs.c
>
>     while (!hypercall_preempt_check()) {
> +        printk("eip = 0x%x\n", regs->eip);
>         if (x86_emulate(&ctxt, &em_ops)) {
>
> And I get the following output with a FC5 guest:
>
> (XEN) 
> hvmop_emulate_realmode                                                   
> (XEN) guest requests real mode 
> emulation                                       (XEN) foo 
> 221                                                                  
> (XEN) eip = 
> 0xd338d                                                            
> (XEN) eip = 
> 0xd338e                                                            
> (XEN) eip = 
> 0xffbf0000                                                         
> (XEN) failed to emulate instruction at %eip = 
> 0xd338d                          (XEN) domain_crash_sync called from 
> vmcs.c:625                                 (XEN) Domain 1 (vcpu#0) 
> crashed on cpu#0:                                      (XEN) ----[ 
> Xen-3.0-unstable  x86_32  debug=n  Not tainted ]----               
> (XEN) CPU:    
> 0                                                                (XEN) 
> EIP:    
> 0010:[<000d338d>]                                                (XEN) 
> EFLAGS: 00000002   CONTEXT: 
> hvm                                          (XEN) eax: 00000076   
> ebx: 000d7324   ecx: 000d7324   edx: 000000e9            (XEN) esi: 
> 000d4e54   edi: 000d3380   ebp: 000d72a8   esp: 000d72a8            
> (XEN) cr0: 00050032   cr4: 00000651   cr3: 00000000   cr2: 
> 00000000            (XEN) ds: 0000   es: 0000   fs: 0000   gs: 0000   
> ss: 0018   cs: 0010  
> So, perhaps it's the guest you're using?  Clearly, we're running in 
> x86_emulate and hitting a 16 bit instruction we can't handle.  N.B. 
> the printk in the error path for x86_emulate is wrong.  I should be 
> looking at regs->eip, not GUEST_RIP since that wouldn't have been 
> updated again.
>
> Regards,
>
> Anthony Liguori
>
>> I have not added any debug lines in the code yet, and I don't know 
>> how far is the emulator going. I will check it tomorrow.
>>
>> Thanks & Regards,
>> Nitin
>> Open Source Technology Center, Intel Corporation.
>> ------------------------------------------------------------------------- 
>>
>> The mind is like a parachute; it works much better when it's open.
>>
>>
>> On Thu, 2007-03-29 at 17:59 -0700, Nitin A Kamble wrote:
>>> On Thu, 2007-03-29 at 19:11 -0500, Anthony Liguori wrote:
>>>
>>>> Okay, you'll need to make sure that hvmloader and qemu are both 
>>>> being rebuilt and reinstalled.
>>>>
>>>>       
>>> I am sure both are built with the patch and installed correctly.
>>>
>>>> The really curious thing is that eip from the VMCS is set to 0.  
>>>> eip should be address of the EIP of whatever movl cr0 instruction 
>>>> that occurs when returning from main() in hvmloader.
>>>>
>>>>       
>>> I also find that x86_emulate() is never called while 
>>> emulate_realmode is set in the hypervisor.
>>>
>>>> I guess it's possible that if you are using a version of unstable 
>>>> that predates Keir's recent hvmloader changes, you wouldn't have 
>>>> hvmloader switching to real mode.  That could explain some of the 
>>>> weirdness you're seeing.  What changeset are you on?
>>>>       
>>> So far I am using: r14560_20070326
>>>
>>> Now I am trying with: r14631_20070329
>>>
>>> Thanks & Regards,
>>> Nitin
>>> Open Source Technology Center, Intel Corporation.
>>> ------------------------------------------------------------------------- 
>>>
>>> The mind is like a parachute; it works much better when it's open.
>>>
>>
>
>
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xensource.com
> http://lists.xensource.com/xen-devel
>