Re: Kernel Oops with kvm 66 running WinXP

Avi Kivity
2008-04-27T13:45:38Z

[-- Attachment #1: Type: text/plain, Size: 3649 bytes --]

Avi Kivity wrote:
> Michal Ludvig wrote:
>> Hi,
>>
>> I've experienced a kernel Oops on 2.6.24 with kvm 66 on AMD in 64bit
>> mode while starting up WinXP:
>>
>> kvm: emulating exchange as write
>> Unable to handle kernel NULL pointer dereference at 0000000000000000
>> RIP:
>> [<ffffffff883a7a5a>] :kvm:x86_emulate_insn+0x3fa/0x4240
>> PGD 7658d067 PUD 242a6067 PMD 0
>> Oops: 0002 [1] SMP
>> CPU 0
>> Modules linked in: bridge llc reiserfs tun kvm_amd kvm nfs nfsd lockd
>> nfs_acl auth_rpcgss sunrpc exportfs w83627ehf hwmon_vid autofs4
>> snd_pcm_oss snd_mixer_oss snd_seq snd_seq_device iptable_filter
>> ip_tables ip6table_filter ip6_tables x_tables af_packet ipv6 fuse
>> ext2 loop snd_hda_intel snd_pcm snd_timer k8temp i2c_nforce2 i2c_core
>> hwmon sr_mod button cdrom snd soundcore snd_page_alloc forcedeth sg
>> floppy linear sd_mod ehci_hcd ohci_hcd usbcore dm_snapshot edd dm_mod
>> fan sata_nv pata_amd libata scsi_mod thermal processor
>> Pid: 3139, comm: qemu-system-x86 Not tainted 2.6.24-mludvig #1
>> RIP: 0010:[<ffffffff883a7a5a>] [<ffffffff883a7a5a>]
>> :kvm:x86_emulate_insn+0x3fa/0x4240
>> RSP: 0018:ffff8100609fdc18 EFLAGS: 00010246
>> RAX: 000000008001003b RBX: 0000000000000000 RCX: 0000000000000000
>> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8100609fe000
>> RBP: ffff8100609ff320 R08: ffff8100609ff3c0 R09: 0000000000000006
>> R10: 0000000000000002 R11: 0000000000000000 R12: ffff8100609ff368
>> R13: ffff8100609ff3c0 R14: ffffffff883be600 R15: 0000000001971353
>> FS: 0000000040804950(0063) GS:ffffffff8053e000(0000)
>> knlGS:0000000000000000
>> CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
>> CR2: 0000000000000000 CR3: 000000006bb74000 CR4: 00000000000006e0
>> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
>> Process qemu-system-x86 (pid: 3139, threadinfo ffff8100609fc000, task
>> ffff8100794d5680)
>> Stack: 00000000609fdc74 0000000012187318 000000000ea5f068
>> ffff8100609ff3c0
>> ffff8100609fdc94 ffffffff8839c9e0 0000000000000000 ffff8100609fe000
>> ffff8100609ff320 0000000000000000 0000000000000000 0000000000000000
>> Call Trace:
>> [<ffffffff8839c9e0>] :kvm:kvm_get_cs_db_l_bits+0x20/0x40
>> [<ffffffff8839dd2f>] :kvm:emulate_instruction+0x1bf/0x340
>> [<ffffffff883c1a22>] :kvm_amd:emulate_on_interception+0x12/0x60
>> [<ffffffff883a11d9>] :kvm:kvm_arch_vcpu_ioctl_run+0x169/0x6d0
>> [<ffffffff8839c14c>] :kvm:kvm_vcpu_ioctl+0x41c/0x440
>> [<ffffffff802305f3>] __wake_up+0x43/0x70
>> [<ffffffff803374c1>] __up_read+0x21/0xb0
>> [<ffffffff802586ec>] futex_wake+0xcc/0xf0
>> [<ffffffff80259559>] do_futex+0x129/0xbb0
>> [<ffffffff8022e7bd>] __dequeue_entity+0x3d/0x50
>> [<ffffffff8839b925>] :kvm:kvm_vm_ioctl+0x85/0x200
>> [<ffffffff802ab10f>] do_ioctl+0x2f/0xa0
>> [<ffffffff802ab3a0>] vfs_ioctl+0x220/0x2d0
>> [<ffffffff802ab4e1>] sys_ioctl+0x91/0xb0
>> [<ffffffff8020bcae>] system_call+0x7e/0x83
>>
>>
>> Code: 66 89 02 e9 ee fc ff ff 48 8b 95 88 00 00 00 48 8b 45 78 88
>> RIP [<ffffffff883a7a5a>] :kvm:x86_emulate_insn+0x3fa/0x4240
>> RSP <ffff8100609fdc18>
>> CR2: 0000000000000000
>> ---[ end trace d358bab3f035112e ]---
>>
>> The host is still alive but the XP guest is locked up in a boot screen.
>>
>>
>
> Please mail me (privately) an 'objdump -Sr x86_emulate.o' from the
> kernel directory, so we can see where this happened.
>

Ok. Please try with the attached patch and let us know. Also repeat
without the patch, so we can be sure it is easily reproducible.

--
error compiling committee.c: too many arguments to function

[-- Attachment #2: revert-smsw-fix.patch --]
[-- Type: text/x-patch, Size: 2116 bytes --]

diff --git a/kernel/x86_emulate.c b/kernel/x86_emulate.c
index 46ef78f..8e1b32f 100644
--- a/kernel/x86_emulate.c
+++ b/kernel/x86_emulate.c
@@ -275,15 +275,12 @@ static u16 group_table[] = {
SrcMem | ModRM, 0, SrcMem | ModRM | Stack, 0,
[Group7*8] =
0, 0, ModRM | SrcMem, ModRM | SrcMem,
- SrcNone | ModRM | DstMem | Mov, 0,
- SrcMem16 | ModRM | Mov, SrcMem | ModRM | ByteOp,
+ SrcNone | ModRM | DstMem, 0, SrcMem | ModRM, SrcMem | ModRM | ByteOp,
};

static u16 group2_table[] = {
[Group7*8] =
- SrcNone | ModRM, 0, 0, 0,
- SrcNone | ModRM | DstMem | Mov, 0,
- SrcMem16 | ModRM | Mov, 0,
+ SrcNone | ModRM, 0, 0, 0, SrcNone | ModRM | DstMem, 0, SrcMem | ModRM, 0,
};

/* EFLAGS bit definitions. */
@@ -1725,8 +1722,6 @@ twobyte_insn:
goto done;

kvm_emulate_hypercall(ctxt->vcpu);
- /* Disable writeback. */
- c->dst.type = OP_NONE;
break;
case 2: /* lgdt */
rc = read_descriptor(ctxt, ops, c->src.ptr,
@@ -1734,8 +1729,6 @@ twobyte_insn:
if (rc)
goto done;
realmode_lgdt(ctxt->vcpu, size, address);
- /* Disable writeback. */
- c->dst.type = OP_NONE;
break;
case 3: /* lidt/vmmcall */
if (c->modrm_mod == 3 && c->modrm_rm == 1) {
@@ -1751,25 +1744,27 @@ twobyte_insn:
goto done;
realmode_lidt(ctxt->vcpu, size, address);
}
- /* Disable writeback. */
- c->dst.type = OP_NONE;
break;
case 4: /* smsw */
- c->dst.bytes = 2;
- c->dst.val = realmode_get_cr(ctxt->vcpu, 0);
+ if (c->modrm_mod != 3)
+ goto cannot_emulate;
+ *(u16 *)&c->regs[c->modrm_rm]
+ = realmode_get_cr(ctxt->vcpu, 0);
break;
case 6: /* lmsw */
- realmode_lmsw(ctxt->vcpu, (u16)c->src.val,
- &ctxt->eflags);
+ if (c->modrm_mod != 3)
+ goto cannot_emulate;
+ realmode_lmsw(ctxt->vcpu, (u16)c->modrm_val,
+ &ctxt->eflags);
break;
case 7: /* invlpg*/
emulate_invlpg(ctxt->vcpu, memop);
- /* Disable writeback. */
- c->dst.type = OP_NONE;
break;
default:
goto cannot_emulate;
}
+ /* Disable writeback. */
+ c->dst.type = OP_NONE;
break;
case 0x06:
emulate_clts(ctxt->vcpu);

[-- Attachment #3: Type: text/plain, Size: 320 bytes --]

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone

[-- Attachment #4: Type: text/plain, Size: 158 bytes --]

_______________________________________________
kvm-devel mailing list
kvm-devel@lists.sourceforge.net