X86EMUL_PROPAGATE_FAULT

X86EMUL_PROPAGATE_FAULT

[Matteo]

Hello to everybody,

I am working on KVM version 2.6.38
and I'm facing a new problem on an emulated instruction
whose implementation is already in kvm.

The error shows up after the emulation of the "RET" opcode (C3 Byte 
Opcode).
When trying to emulate the instruction
at the address loaded after the pop instruction made by the RET
I get an X86EMUL_PROPAGATE_FAULT error due to a gpa == UNMAPPED_GVA
as you can see in the following debug trace:

---------------8<-------------------------------------------------
x86_decode_insn:2705 -> Starting New Instruction Decode

x86_decode_insn:2709 -> c->eip = ctxt->eip = 3226138255
x86_decode_insn:2759 -> Opcode -> c3
x86_decode_insn:2928 -> Decode and fetch the source operand
x86_decode_insn:2931 -> SrcNone
x86_decode_insn:3015 -> Decode and fetch the second source operand
x86_decode_insn:3018 -> Src2None
x86_decode_insn:3044 -> Decode and fetch the destination operand
x86_decode_insn:3089 -> ImplicitOps
x86_decode_insn:3092 -> No Destination Operand
x86_emulate_instruction:4458 -> Returned from x86_decode_insn with r = 0

x86_emulate_insn:3194 -> starting special_insn...
x86_emulate_insn:3196 -> c->eip = 3226138256
x86_emulate_insn:3565 -> starting writeback...
writeback:1178 -> c->eip = 2147483648
x86_emulate_instruction:4538 -> Return from x86_emulate_insn with code r 
= 0
---------------------------8<----------------------------------------------- 


So the next instruction will be emulated reading the opcode with 
eip=2147483648 as stated before
but the emulation fails with the following debug trace

---------------------------8<----------------------------------------------- 

x86_decode_insn:2705 -> Starting New Instruction Decode

x86_decode_insn:2709 -> c->eip = ctxt->eip = 2147483648
x86_decode_insn:2757 -> Read opcode from eip
kvm_read_guest_virt_helper:3724 -> gpa == UNMAPPED_GVA return 
X86EMUL_PROPAGATE_FAULT
do_fetch_insn_byte:573 -> ops->fetch returns an error
---------------------------8<------------------------------------------------ 


Any hints helping in addressing this error is highly welcome,

Thank you in advance,

Matteo

Re: X86EMUL_PROPAGATE_FAULT

[Avi Kivity]

On 05/05/2011 06:05 PM, Matteo wrote:
> Hello to everybody,
>
> I am working on KVM version 2.6.38
> and I'm facing a new problem on an emulated instruction
> whose implementation is already in kvm.
>
> The error shows up after the emulation of the "RET" opcode (C3 Byte 
> Opcode).
> When trying to emulate the instruction
> at the address loaded after the pop instruction made by the RET
> I get an X86EMUL_PROPAGATE_FAULT error due to a gpa == UNMAPPED_GVA
> as you can see in the following debug trace:
>
> ---------------8<-------------------------------------------------
> x86_decode_insn:2705 -> Starting New Instruction Decode
>
> x86_decode_insn:2709 -> c->eip = ctxt->eip = 3226138255
> x86_decode_insn:2759 -> Opcode -> c3
> x86_decode_insn:2928 -> Decode and fetch the source operand
> x86_decode_insn:2931 -> SrcNone
> x86_decode_insn:3015 -> Decode and fetch the second source operand
> x86_decode_insn:3018 -> Src2None
> x86_decode_insn:3044 -> Decode and fetch the destination operand
> x86_decode_insn:3089 -> ImplicitOps
> x86_decode_insn:3092 -> No Destination Operand
> x86_emulate_instruction:4458 -> Returned from x86_decode_insn with r = 0
>
> x86_emulate_insn:3194 -> starting special_insn...
> x86_emulate_insn:3196 -> c->eip = 3226138256
> x86_emulate_insn:3565 -> starting writeback...
> writeback:1178 -> c->eip = 2147483648
> x86_emulate_instruction:4538 -> Return from x86_emulate_insn with code 
> r = 0
> ---------------------------8<----------------------------------------------- 
>
>
> So the next instruction will be emulated reading the opcode with 
> eip=2147483648 as stated before
> but the emulation fails with the following debug trace
>
> ---------------------------8<----------------------------------------------- 
>
> x86_decode_insn:2705 -> Starting New Instruction Decode
>
> x86_decode_insn:2709 -> c->eip = ctxt->eip = 2147483648
> x86_decode_insn:2757 -> Read opcode from eip
> kvm_read_guest_virt_helper:3724 -> gpa == UNMAPPED_GVA return 
> X86EMUL_PROPAGATE_FAULT
> do_fetch_insn_byte:573 -> ops->fetch returns an error
> ---------------------------8<------------------------------------------------ 
>

The instruction has returned to an EIP that is outside RAM, so kvm is 
unable to fetch the next instruction.  This is likely due to a bug (in 
kvm or the guest) that has occurred much earlier.

-- 
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.

Re: X86EMUL_PROPAGATE_FAULT

[kvm]

As regards this issue,
I don't think it's a guest OS bug
since running the same OS without the "RET" emulation
I get no error.
If this bug is related to the ret emulation code,
could you please provide a fix?

thanks,

MS
> On 05/05/2011 06:05 PM, Matteo wrote:
>> Hello to everybody,
>>
>> I am working on KVM version 2.6.38
>> and I'm facing a new problem on an emulated instruction
>> whose implementation is already in kvm.
>>
>> The error shows up after the emulation of the "RET" opcode (C3 Byte 
>> Opcode).
>> When trying to emulate the instruction
>> at the address loaded after the pop instruction made by the RET
>> I get an X86EMUL_PROPAGATE_FAULT error due to a gpa == UNMAPPED_GVA
>> as you can see in the following debug trace:
>>
>> ---------------8<-------------------------------------------------
>> x86_decode_insn:2705 -> Starting New Instruction Decode
>>
>> x86_decode_insn:2709 -> c->eip = ctxt->eip = 3226138255
>> x86_decode_insn:2759 -> Opcode -> c3
>> x86_decode_insn:2928 -> Decode and fetch the source operand
>> x86_decode_insn:2931 -> SrcNone
>> x86_decode_insn:3015 -> Decode and fetch the second source operand
>> x86_decode_insn:3018 -> Src2None
>> x86_decode_insn:3044 -> Decode and fetch the destination operand
>> x86_decode_insn:3089 -> ImplicitOps
>> x86_decode_insn:3092 -> No Destination Operand
>> x86_emulate_instruction:4458 -> Returned from x86_decode_insn with r = 0
>>
>> x86_emulate_insn:3194 -> starting special_insn...
>> x86_emulate_insn:3196 -> c->eip = 3226138256
>> x86_emulate_insn:3565 -> starting writeback...
>> writeback:1178 -> c->eip = 2147483648
>> x86_emulate_instruction:4538 -> Return from x86_emulate_insn with 
>> code r = 0
>> ---------------------------8<----------------------------------------------- 
>>
>>
>> So the next instruction will be emulated reading the opcode with 
>> eip=2147483648 as stated before
>> but the emulation fails with the following debug trace
>>
>> ---------------------------8<----------------------------------------------- 
>>
>> x86_decode_insn:2705 -> Starting New Instruction Decode
>>
>> x86_decode_insn:2709 -> c->eip = ctxt->eip = 2147483648
>> x86_decode_insn:2757 -> Read opcode from eip
>> kvm_read_guest_virt_helper:3724 -> gpa == UNMAPPED_GVA return 
>> X86EMUL_PROPAGATE_FAULT
>> do_fetch_insn_byte:573 -> ops->fetch returns an error
>> ---------------------------8<------------------------------------------------ 
>>
>
> The instruction has returned to an EIP that is outside RAM, so kvm is 
> unable to fetch the next instruction.  This is likely due to a bug (in 
> kvm or the guest) that has occurred much earlier.
>