Kernel GPF in vmx_save_host_state()

Benjamin Gilbert
2009-03-18T00:06:49Z

I accidentally tried to run a 64-bit guest on a 32-bit host. Even
though this isn't supported, it shouldn't crash my kernel. :-)

CPU: Intel Core 2 Quad
KVM: kernel kvm-84-640-g967f619, userspace kvm-84-304-g2ced1d8. Also
occurs with vanilla kvm-84.
Host kernel: Vanilla 2.6.28
Host arch: i386
Guest: Debian Etch x86_64, distributor 2.6.18 kernel
Commandline: qemu-system-x86_64 -hda debian-etch-x86_64 -m 512
Occurs with: -no-kvm-irqchip, -no-kvm-pit
Does not occur with: -no-kvm

As soon as the guest kernel starts, the host produces:

general protection fault: 0000 [#1] PREEMPT SMP

last sysfs file: /sys/kernel/uevent_seqnum

Dumping ftrace buffer:

(ftrace buffer empty)

Modules linked in: kvm_intel kvm

Pid: 6570, comm: qemu-system-x86 Not tainted (2.6.28-686 #4) Precision
WorkStat
EIP: 0060:[<f8cf3d97>] EFLAGS: 00010246 CPU: 2

EIP is at vmx_save_host_state+0x193/0x1a6 [kvm_intel]

EAX: 00000100 EBX: 00000000 ECX: c0000080 EDX: 00000000

ESI: c0000080 EDI: 00000000 EBP: f462ae80 ESP: f462ae58

DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068

Process qemu-system-x86 (pid: 6570, ti=f462a000 task=f43fe460
task.ti=f462a000)
Stack:

c0406379 f7c5467d 00000100 00000000 ee020020 00000000 00000000
ee020020
00000001 00000000 f462aeb0 f7c58b4d f47b3000 ee020020 00000000
c0406469
c0403ede 7ffbfeff fffffffe 0000ae80 f43a8730 00000000 f462af18
f7c5467d
Call Trace:

[<c0406379>] ? _spin_unlock+0x2c/0x41

[<f7c5467d>] ? kvm_vcpu_ioctl+0xf4/0x40f [kvm]

[<f7c58b4d>] ? kvm_arch_vcpu_ioctl_run+0x444/0x918 [kvm]

[<c0406469>] ? _spin_unlock_irqrestore+0x59/0x5d

[<c0403ede>] ? preempt_schedule+0x30/0x3f

[<f7c5467d>] ? kvm_vcpu_ioctl+0xf4/0x40f [kvm]

[<c013ae80>] ? up_read+0x1b/0x2f

[<c0148144>] ? futex_wake+0xd0/0xdb

[<c0148e4c>] ? do_futex+0x81/0x6c9

[<f7c54589>] ? kvm_vcpu_ioctl+0x0/0x40f [kvm]

[<c018e345>] ? vfs_ioctl+0x27/0x6c

[<c018e7ec>] ? do_vfs_ioctl+0x394/0x3d8

[<c0184c88>] ? fget_light+0xc8/0xe4

[<c018e84c>] ? sys_ioctl+0x1c/0x5f

[<c011e06f>] ? sub_preempt_count+0x9d/0xab

[<c018e875>] ? sys_ioctl+0x45/0x5f

[<c0102e25>] ? sysenter_do_call+0x12/0x35

Code: ec 81 e1 01 08 00 00 31 db 89 f2 09 ca 89 55 e0 89 f8 09 d8 89 45
e4 be 8
EIP: [<f8cf3d97>] vmx_save_host_state+0x193/0x1a6 [kvm_intel] SS:ESP
0068:f462a8
---[ end trace b07f1e77e8b208d3 ]---

--Benjamin Gilbert