Re: NULL pointer dereference in kernel code, ignored parameters in libkvm

[Avi Kivity <avi@redhat.com>]

Gabe Black wrote:
>     Hi. I'm a developer on the M5 simulator (m5sim.org) working on a CPU
> model which uses kvm as its execution engine. 

Neat stuff.  You're using kvm to run non-x86 code on x86?

> I ran into a kernel "BUG"
> where a NULL pointer is being dereferenced in gfn_to_rmap.
>
>     What's happening on the kernel side is that gfn_to_rmap is calling
> gfn_to_memslot. That function looks for the gfn in the memory slots,
> fails to find it, and returns a NULL pointer. gfn_to_rmap then tries to
> dereference it, and the kernel kills itself. I believe the original
> source of the call to gfn_to_memslot was mmu_alloc_roots (in 2.6.28.9,
> it may have moved) which tries to get the page pointed to by CR3 using
> kvm_mmu_get_page. That part may not be correct, so here's the log output
> from the kernel.
>   

This was fixed by 89da4ff17 ("KVM: x86: check for cr3 validity in 
mmu_alloc_roots").  Did the code base you were testing contain that?7

> The second problem was the fact that CR3 didn't point to any memory even
> though it had a valid value (0x7000). This was because our code relied
> on kvm_create to set up physical memory, and while it takes parameters
> for it and passes them around, it never actually seems to do anything
> with them. This also seems to be the case in your most recent code.
>
>   

You should set up the memory independently using the memory slot APIs, 
then load CR3.  kvm_create() has bitrotted a bit.

> I am a full time employee of VMware, and while I work on M5 on my own
> time, that places certain limits on what I can do to help fix these
> bugs. While I probably can't implement anything, I should be able to
> provide more information about what we're doing with M5 or about the
> crash if that would help.
>   

I appreciate the reports.  Please test latest kvm.git and let us know if 
the problems persist.

It would also be interesting to hear how you use kvm.

-- 
error compiling committee.c: too many arguments to function