Problem in real mode test harness.

Mohammed Gamal
2008-08-26T15:54:02Z

When trying to run the real mode test harness with
emulate_invalid_guest_state=1. It crashes with a #GP exception, here
is the output:
---
exception 13 (0)
rax 00000000c03104d2 rbx 0000000000000000 rcx 0000000031664000 rdx
0000000000001000
rsi 0000000000000001 rdi 0000000000000000 rsp 0000000000020000 rbp
0000000000000000
r8 0000000000000000 r9 0000000000000000 r10 0000000000000000 r11
0000000000000000
r12 0000000000000000 r13 0000000000000000 r14 0000000000000000 r15
0000000000000000
rip 0000000000100010 rflags 00010006
cs 0008 (00000000/ffffffff p 1 dpl 0 db 1 s 1 type b l 0 g 1 avl 0)
ds 0010 (00000000/ffffffff p 1 dpl 0 db 1 s 1 type 3 l 0 g 1 avl 0)
es 0010 (00000000/ffffffff p 1 dpl 0 db 1 s 1 type 3 l 0 g 1 avl 0)
ss 0010 (00000000/ffffffff p 1 dpl 0 db 1 s 1 type 3 l 0 g 1 avl 0)
fs 0010 (00000000/ffffffff p 1 dpl 0 db 1 s 1 type 3 l 0 g 1 avl 0)
gs 0010 (00000000/ffffffff p 1 dpl 0 db 1 s 1 type 3 l 0 g 1 avl 0)
tr 0000 (00000000/0000ffff p 1 dpl 0 db 0 s 0 type b l 0 g 0 avl 0)
ldt 0000 (00000000/0000ffff p 1 dpl 0 db 0 s 0 type 2 l 0 g 0 avl 0)
gdt f0110/17
idt 0/7ff
cr0 60000011 cr2 0 cr3 0 cr4 0 cr8 0 efer 0
code: 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 -->
01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01
01 01 01 01 01 01 01
---

I wanted to take a look at the emulated instruction, so I added some
logging to the kvm-intel module, here is the dmesg output
[11343.221039] emulation failed (emulation success) rip f00de 66 b8 10 00
[11343.221039] emulation failed (emulation success) rip f00e2 8e d8 8e c0
[11343.222936] emulation failed (emulation success) rip f00e4 8e c0 8e e0
[11343.222936] emulation failed (emulation success) rip f00e6 8e e0 8e e8
[11343.222936] emulation failed (emulation success) rip f00e8 8e e8 8e d0
[11343.222936] emulation failed (emulation success) rip f00ea 8e d0 bc 00
[11343.222936] emulation failed (emulation success) rip f00ec bc 00 00 02
[11343.222936] emulation failed (emulation success) rip f00f1 ea 00 00 10
[11343.222936] emulation failed (emulation success) rip 100000 b8 d2 04 31
[11343.222936] emulation failed (emulation success) rip 100005 8e d8 8e c0
[11343.222936] emulation failed (emulation success) rip 100007 8e c0 8e d0
[11343.222936] emulation failed (emulation success) rip 100009 8e d0 b9 00
[11343.222936] emulation failed (emulation success) rip 10000b b9 00 40 66
[11343.222936] emulation failed (emulation success) rip 100010 f6 66 89 f7
[11343.222936] emulation failed (emulation failure) rip 100010 f6 66 89 f7
---
(Note: I am using kvm_report_emulation_failure() to report all
emulated instructions even those which succeeded)

Looking at the instruction sequence, it corresponds to the following
sequence in realmode.c
asm(
".data \n\t"
". = . + 4096 \n\t"
"stacktop: \n\t"
".text \n\t"
"init: \n\t"
"xor %ax, %ax \n\t"
"mov %ax, %ds \n\t"
"mov %ax, %es \n\t"
"mov %ax, %ss \n\t"
"mov $0x4000, %cx \n\t"
"xor %esi, %esi \n\t"

we fail at the xor %esi, %esi instruction. I thought at first it
might be an emulation problem with xor, so I changed the instruction
to mov $0, %esi and we still fail. Another strange thing is that the
emulator reads the opcode for xor and mov instructions, but fails when
reading the operands. I looked at the emulator code but it looks OK,
so why is the exception generated?