From mboxrd@z Thu Jan 1 00:00:00 1970 From: Avi Kivity Subject: Re: Kernel Oops with kvm 66 running WinXP Date: Sun, 27 Apr 2008 16:45:38 +0300 Message-ID: <48148382.4040403@qumranet.com> References: <48131C2A.20307@logix.net.nz> <4814772F.7030708@qumranet.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="------------020504000007070802000602" Cc: kvm-devel@lists.sourceforge.net To: Michal Ludvig Return-path: In-Reply-To: <4814772F.7030708@qumranet.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kvm-devel-bounces@lists.sourceforge.net Errors-To: kvm-devel-bounces@lists.sourceforge.net List-Id: kvm.vger.kernel.org This is a multi-part message in MIME format. --------------020504000007070802000602 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Avi Kivity wrote: > Michal Ludvig wrote: >> Hi, >> >> I've experienced a kernel Oops on 2.6.24 with kvm 66 on AMD in 64bit >> mode while starting up WinXP: >> >> kvm: emulating exchange as write >> Unable to handle kernel NULL pointer dereference at 0000000000000000 >> RIP: >> [] :kvm:x86_emulate_insn+0x3fa/0x4240 >> PGD 7658d067 PUD 242a6067 PMD 0 >> Oops: 0002 [1] SMP >> CPU 0 >> Modules linked in: bridge llc reiserfs tun kvm_amd kvm nfs nfsd lockd >> nfs_acl auth_rpcgss sunrpc exportfs w83627ehf hwmon_vid autofs4 >> snd_pcm_oss snd_mixer_oss snd_seq snd_seq_device iptable_filter >> ip_tables ip6table_filter ip6_tables x_tables af_packet ipv6 fuse >> ext2 loop snd_hda_intel snd_pcm snd_timer k8temp i2c_nforce2 i2c_core >> hwmon sr_mod button cdrom snd soundcore snd_page_alloc forcedeth sg >> floppy linear sd_mod ehci_hcd ohci_hcd usbcore dm_snapshot edd dm_mod >> fan sata_nv pata_amd libata scsi_mod thermal processor >> Pid: 3139, comm: qemu-system-x86 Not tainted 2.6.24-mludvig #1 >> RIP: 0010:[] [] >> :kvm:x86_emulate_insn+0x3fa/0x4240 >> RSP: 0018:ffff8100609fdc18 EFLAGS: 00010246 >> RAX: 000000008001003b RBX: 0000000000000000 RCX: 0000000000000000 >> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8100609fe000 >> RBP: ffff8100609ff320 R08: ffff8100609ff3c0 R09: 0000000000000006 >> R10: 0000000000000002 R11: 0000000000000000 R12: ffff8100609ff368 >> R13: ffff8100609ff3c0 R14: ffffffff883be600 R15: 0000000001971353 >> FS: 0000000040804950(0063) GS:ffffffff8053e000(0000) >> knlGS:0000000000000000 >> CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b >> CR2: 0000000000000000 CR3: 000000006bb74000 CR4: 00000000000006e0 >> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 >> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 >> Process qemu-system-x86 (pid: 3139, threadinfo ffff8100609fc000, task >> ffff8100794d5680) >> Stack: 00000000609fdc74 0000000012187318 000000000ea5f068 >> ffff8100609ff3c0 >> ffff8100609fdc94 ffffffff8839c9e0 0000000000000000 ffff8100609fe000 >> ffff8100609ff320 0000000000000000 0000000000000000 0000000000000000 >> Call Trace: >> [] :kvm:kvm_get_cs_db_l_bits+0x20/0x40 >> [] :kvm:emulate_instruction+0x1bf/0x340 >> [] :kvm_amd:emulate_on_interception+0x12/0x60 >> [] :kvm:kvm_arch_vcpu_ioctl_run+0x169/0x6d0 >> [] :kvm:kvm_vcpu_ioctl+0x41c/0x440 >> [] __wake_up+0x43/0x70 >> [] __up_read+0x21/0xb0 >> [] futex_wake+0xcc/0xf0 >> [] do_futex+0x129/0xbb0 >> [] __dequeue_entity+0x3d/0x50 >> [] :kvm:kvm_vm_ioctl+0x85/0x200 >> [] do_ioctl+0x2f/0xa0 >> [] vfs_ioctl+0x220/0x2d0 >> [] sys_ioctl+0x91/0xb0 >> [] system_call+0x7e/0x83 >> >> >> Code: 66 89 02 e9 ee fc ff ff 48 8b 95 88 00 00 00 48 8b 45 78 88 >> RIP [] :kvm:x86_emulate_insn+0x3fa/0x4240 >> RSP >> CR2: 0000000000000000 >> ---[ end trace d358bab3f035112e ]--- >> >> The host is still alive but the XP guest is locked up in a boot screen. >> >> > > Please mail me (privately) an 'objdump -Sr x86_emulate.o' from the > kernel directory, so we can see where this happened. > Ok. Please try with the attached patch and let us know. Also repeat without the patch, so we can be sure it is easily reproducible. -- error compiling committee.c: too many arguments to function --------------020504000007070802000602 Content-Type: text/x-patch; name="revert-smsw-fix.patch" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="revert-smsw-fix.patch" diff --git a/kernel/x86_emulate.c b/kernel/x86_emulate.c index 46ef78f..8e1b32f 100644 --- a/kernel/x86_emulate.c +++ b/kernel/x86_emulate.c @@ -275,15 +275,12 @@ static u16 group_table[] = { SrcMem | ModRM, 0, SrcMem | ModRM | Stack, 0, [Group7*8] = 0, 0, ModRM | SrcMem, ModRM | SrcMem, - SrcNone | ModRM | DstMem | Mov, 0, - SrcMem16 | ModRM | Mov, SrcMem | ModRM | ByteOp, + SrcNone | ModRM | DstMem, 0, SrcMem | ModRM, SrcMem | ModRM | ByteOp, }; static u16 group2_table[] = { [Group7*8] = - SrcNone | ModRM, 0, 0, 0, - SrcNone | ModRM | DstMem | Mov, 0, - SrcMem16 | ModRM | Mov, 0, + SrcNone | ModRM, 0, 0, 0, SrcNone | ModRM | DstMem, 0, SrcMem | ModRM, 0, }; /* EFLAGS bit definitions. */ @@ -1725,8 +1722,6 @@ twobyte_insn: goto done; kvm_emulate_hypercall(ctxt->vcpu); - /* Disable writeback. */ - c->dst.type = OP_NONE; break; case 2: /* lgdt */ rc = read_descriptor(ctxt, ops, c->src.ptr, @@ -1734,8 +1729,6 @@ twobyte_insn: if (rc) goto done; realmode_lgdt(ctxt->vcpu, size, address); - /* Disable writeback. */ - c->dst.type = OP_NONE; break; case 3: /* lidt/vmmcall */ if (c->modrm_mod == 3 && c->modrm_rm == 1) { @@ -1751,25 +1744,27 @@ twobyte_insn: goto done; realmode_lidt(ctxt->vcpu, size, address); } - /* Disable writeback. */ - c->dst.type = OP_NONE; break; case 4: /* smsw */ - c->dst.bytes = 2; - c->dst.val = realmode_get_cr(ctxt->vcpu, 0); + if (c->modrm_mod != 3) + goto cannot_emulate; + *(u16 *)&c->regs[c->modrm_rm] + = realmode_get_cr(ctxt->vcpu, 0); break; case 6: /* lmsw */ - realmode_lmsw(ctxt->vcpu, (u16)c->src.val, - &ctxt->eflags); + if (c->modrm_mod != 3) + goto cannot_emulate; + realmode_lmsw(ctxt->vcpu, (u16)c->modrm_val, + &ctxt->eflags); break; case 7: /* invlpg*/ emulate_invlpg(ctxt->vcpu, memop); - /* Disable writeback. */ - c->dst.type = OP_NONE; break; default: goto cannot_emulate; } + /* Disable writeback. */ + c->dst.type = OP_NONE; break; case 0x06: emulate_clts(ctxt->vcpu); --------------020504000007070802000602 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone --------------020504000007070802000602 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ kvm-devel mailing list kvm-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/kvm-devel --------------020504000007070802000602--