Re: Kernel Oops with kvm 66 running WinXP

[Avi Kivity <avi@qumranet.com>]

[-- Attachment #1: Type: text/plain, Size: 3649 bytes --]

Avi Kivity wrote:
> Michal Ludvig wrote:
>> Hi,
>>
>> I've experienced a kernel Oops on 2.6.24 with kvm 66 on AMD in 64bit 
>> mode while starting up WinXP:
>>
>> kvm: emulating exchange as write
>> Unable to handle kernel NULL pointer dereference at 0000000000000000 
>> RIP:
>>   [<ffffffff883a7a5a>] :kvm:x86_emulate_insn+0x3fa/0x4240
>> PGD 7658d067 PUD 242a6067 PMD 0
>> Oops: 0002 [1] SMP
>> CPU 0
>> Modules linked in: bridge llc reiserfs tun kvm_amd kvm nfs nfsd lockd 
>> nfs_acl auth_rpcgss sunrpc exportfs w83627ehf hwmon_vid autofs4 
>> snd_pcm_oss snd_mixer_oss snd_seq snd_seq_device iptable_filter 
>> ip_tables ip6table_filter ip6_tables x_tables af_packet ipv6 fuse 
>> ext2 loop snd_hda_intel snd_pcm snd_timer k8temp i2c_nforce2 i2c_core 
>> hwmon sr_mod button cdrom snd soundcore snd_page_alloc forcedeth sg 
>> floppy linear sd_mod ehci_hcd ohci_hcd usbcore dm_snapshot edd dm_mod 
>> fan sata_nv pata_amd libata scsi_mod thermal processor
>> Pid: 3139, comm: qemu-system-x86 Not tainted 2.6.24-mludvig #1
>> RIP: 0010:[<ffffffff883a7a5a>]  [<ffffffff883a7a5a>] 
>> :kvm:x86_emulate_insn+0x3fa/0x4240
>> RSP: 0018:ffff8100609fdc18  EFLAGS: 00010246
>> RAX: 000000008001003b RBX: 0000000000000000 RCX: 0000000000000000
>> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8100609fe000
>> RBP: ffff8100609ff320 R08: ffff8100609ff3c0 R09: 0000000000000006
>> R10: 0000000000000002 R11: 0000000000000000 R12: ffff8100609ff368
>> R13: ffff8100609ff3c0 R14: ffffffff883be600 R15: 0000000001971353
>> FS:  0000000040804950(0063) GS:ffffffff8053e000(0000) 
>> knlGS:0000000000000000
>> CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
>> CR2: 0000000000000000 CR3: 000000006bb74000 CR4: 00000000000006e0
>> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
>> Process qemu-system-x86 (pid: 3139, threadinfo ffff8100609fc000, task 
>> ffff8100794d5680)
>> Stack:  00000000609fdc74 0000000012187318 000000000ea5f068 
>> ffff8100609ff3c0
>>   ffff8100609fdc94 ffffffff8839c9e0 0000000000000000 ffff8100609fe000
>>   ffff8100609ff320 0000000000000000 0000000000000000 0000000000000000
>> Call Trace:
>>   [<ffffffff8839c9e0>] :kvm:kvm_get_cs_db_l_bits+0x20/0x40
>>   [<ffffffff8839dd2f>] :kvm:emulate_instruction+0x1bf/0x340
>>   [<ffffffff883c1a22>] :kvm_amd:emulate_on_interception+0x12/0x60
>>   [<ffffffff883a11d9>] :kvm:kvm_arch_vcpu_ioctl_run+0x169/0x6d0
>>   [<ffffffff8839c14c>] :kvm:kvm_vcpu_ioctl+0x41c/0x440
>>   [<ffffffff802305f3>] __wake_up+0x43/0x70
>>   [<ffffffff803374c1>] __up_read+0x21/0xb0
>>   [<ffffffff802586ec>] futex_wake+0xcc/0xf0
>>   [<ffffffff80259559>] do_futex+0x129/0xbb0
>>   [<ffffffff8022e7bd>] __dequeue_entity+0x3d/0x50
>>   [<ffffffff8839b925>] :kvm:kvm_vm_ioctl+0x85/0x200
>>   [<ffffffff802ab10f>] do_ioctl+0x2f/0xa0
>>   [<ffffffff802ab3a0>] vfs_ioctl+0x220/0x2d0
>>   [<ffffffff802ab4e1>] sys_ioctl+0x91/0xb0
>>   [<ffffffff8020bcae>] system_call+0x7e/0x83
>>
>>
>> Code: 66 89 02 e9 ee fc ff ff 48 8b 95 88 00 00 00 48 8b 45 78 88
>> RIP  [<ffffffff883a7a5a>] :kvm:x86_emulate_insn+0x3fa/0x4240
>>   RSP <ffff8100609fdc18>
>> CR2: 0000000000000000
>> ---[ end trace d358bab3f035112e ]---
>>
>> The host is still alive but the XP guest is locked up in a boot screen.
>>
>>   
>
> Please mail me (privately) an 'objdump -Sr x86_emulate.o' from the 
> kernel directory, so we can see where this happened.
>

Ok.  Please try with the attached patch and let us know.  Also repeat 
without the patch, so we can be sure it is easily reproducible.

-- 
error compiling committee.c: too many arguments to function


[-- Attachment #2: revert-smsw-fix.patch --]
[-- Type: text/x-patch, Size: 2116 bytes --]

diff --git a/kernel/x86_emulate.c b/kernel/x86_emulate.c
index 46ef78f..8e1b32f 100644
--- a/kernel/x86_emulate.c
+++ b/kernel/x86_emulate.c
@@ -275,15 +275,12 @@ static u16 group_table[] = {
 	SrcMem | ModRM, 0, SrcMem | ModRM | Stack, 0,
 	[Group7*8] =
 	0, 0, ModRM | SrcMem, ModRM | SrcMem,
-	SrcNone | ModRM | DstMem | Mov, 0,
-	SrcMem16 | ModRM | Mov, SrcMem | ModRM | ByteOp,
+	SrcNone | ModRM | DstMem, 0, SrcMem | ModRM, SrcMem | ModRM | ByteOp,
 };
 
 static u16 group2_table[] = {
 	[Group7*8] =
-	SrcNone | ModRM, 0, 0, 0,
-	SrcNone | ModRM | DstMem | Mov, 0,
-	SrcMem16 | ModRM | Mov, 0,
+	SrcNone | ModRM, 0, 0, 0, SrcNone | ModRM | DstMem, 0, SrcMem | ModRM, 0,
 };
 
 /* EFLAGS bit definitions. */
@@ -1725,8 +1722,6 @@ twobyte_insn:
 				goto done;
 
 			kvm_emulate_hypercall(ctxt->vcpu);
-			/* Disable writeback. */
-			c->dst.type = OP_NONE;
 			break;
 		case 2: /* lgdt */
 			rc = read_descriptor(ctxt, ops, c->src.ptr,
@@ -1734,8 +1729,6 @@ twobyte_insn:
 			if (rc)
 				goto done;
 			realmode_lgdt(ctxt->vcpu, size, address);
-			/* Disable writeback. */
-			c->dst.type = OP_NONE;
 			break;
 		case 3: /* lidt/vmmcall */
 			if (c->modrm_mod == 3 && c->modrm_rm == 1) {
@@ -1751,25 +1744,27 @@ twobyte_insn:
 					goto done;
 				realmode_lidt(ctxt->vcpu, size, address);
 			}
-			/* Disable writeback. */
-			c->dst.type = OP_NONE;
 			break;
 		case 4: /* smsw */
-			c->dst.bytes = 2;
-			c->dst.val = realmode_get_cr(ctxt->vcpu, 0);
+			if (c->modrm_mod != 3)
+				goto cannot_emulate;
+			*(u16 *)&c->regs[c->modrm_rm]
+				= realmode_get_cr(ctxt->vcpu, 0);
 			break;
 		case 6: /* lmsw */
-			realmode_lmsw(ctxt->vcpu, (u16)c->src.val,
-				      &ctxt->eflags);
+			if (c->modrm_mod != 3)
+				goto cannot_emulate;
+			realmode_lmsw(ctxt->vcpu, (u16)c->modrm_val,
+						  &ctxt->eflags);
 			break;
 		case 7: /* invlpg*/
 			emulate_invlpg(ctxt->vcpu, memop);
-			/* Disable writeback. */
-			c->dst.type = OP_NONE;
 			break;
 		default:
 			goto cannot_emulate;
 		}
+		/* Disable writeback. */
+		c->dst.type = OP_NONE;
 		break;
 	case 0x06:
 		emulate_clts(ctxt->vcpu);

[-- Attachment #3: Type: text/plain, Size: 320 bytes --]

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone

[-- Attachment #4: Type: text/plain, Size: 158 bytes --]

_______________________________________________
kvm-devel mailing list
kvm-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/kvm-devel