[Qemu-devel] [kqemu] gpf in memory access

[Qemu-devel] [kqemu] gpf in memory access

[andrzej zaborowski]

[-- Attachment #1: Type: text/plain, Size: 530 bytes --]

I was playing with gpm (mouse daemon) in Linux guest and apparently my
gpm binary is broken and with the "ps2" plugin it segfaults because of
a general protection fault when trying to load a quadword from the
address 0xff00000000000000. Under qemu as well as on the my physical
amd64 it just segfaults, but under kqemu if makes kqemu panic and qemu
aborts. Attached is a patch to make kqemu pass the gpf to qemu. It's
probably wrong but it gives identical behaviour as with -no-kqemu or
as on physical cpu, in this case.

Regards

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: kqemu-mem-gpf.patch --]
[-- Type: text/x-patch; name=kqemu-mem-gpf.patch, Size: 667 bytes --]

diff --git a/common/kqemu_int.h b/common/kqemu_int.h
index d881d85..cdb3a73 100644
--- a/common/kqemu_int.h
+++ b/common/kqemu_int.h
@@ -1065,11 +1065,17 @@ static inline void stq_fast(struct kqemu_state *s, unsigned long addr,
 #define MMU_EXCEPTION(label) \
     ".section \"mmu_ex_table\", \"a\"\n"\
     ".quad " #label "\n"\
+    ".previous\n"\
+    ".section \"seg_ex_table\", \"a\"\n"\
+    ".quad " #label "\n"\
     ".previous\n"
 #else
 #define MMU_EXCEPTION(label) \
     ".section \"mmu_ex_table\", \"a\"\n"\
     ".long " #label "\n"\
+    ".previous\n"\
+    ".section \"seg_ex_table\", \"a\"\n"\
+    ".long " #label "\n"\
     ".previous\n"
 #endif
 

[Qemu-devel] Re: [kqemu] gpf in memory access

[andrzej zaborowski]

[-- Attachment #1: Type: text/plain, Size: 624 bytes --]

Ok, here's a patch that also makes -kernel-kqemu behave (with the
previous patch it would abort with a "triple fault").

Due to the way kqemu sets up the mmu there should never be a GP fault
in the mem access operations, so it would normally indicate some
breakage and kqemu correctly aborts. However I looked it up in the
amd64 specs and there can be a GP fault in a memory access when the
sign extend bits ([63:52]) of the address are not in "canonical form"
(for instance 0xff00000000000000 is not in canonical form). This patch
will make such a GPF be reported to qemu. The patch only affects the
x86-64 on x86-64 case.

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: kqemu-mem-gpf-amd64.patch --]
[-- Type: text/x-patch; name=kqemu-mem-gpf-amd64.patch, Size: 1508 bytes --]

diff --git a/common/common.c b/common/common.c
index 285b072..29443ce 100644
--- a/common/common.c
+++ b/common/common.c
@@ -242,7 +242,7 @@ static inline uint64_t *mon_get_ptep_l3(struct kqemu_state *s,
     if (!(pml4e & PG_PRESENT_MASK))  {
         if (!alloc)
             return NULL;
-        /* allocage a new page */
+        /* allocate a new page */
         ptr = mon_alloc_page(s, &pdp_page_index);
         if (!ptr)
             return NULL;
diff --git a/common/kqemu_int.h b/common/kqemu_int.h
index d881d85..b2f0b6e 100644
--- a/common/kqemu_int.h
+++ b/common/kqemu_int.h
@@ -1065,6 +1065,9 @@ static inline void stq_fast(struct kqemu_state *s, unsigned long addr,
 #define MMU_EXCEPTION(label) \
     ".section \"mmu_ex_table\", \"a\"\n"\
     ".quad " #label "\n"\
+    ".previous\n"\
+    ".section \"seg_ex_table\", \"a\"\n"\
+    ".quad " #label "\n"\
     ".previous\n"
 #else
 #define MMU_EXCEPTION(label) \
diff --git a/common/monitor.c b/common/monitor.c
index ed46845..b3b72dc 100644
--- a/common/monitor.c
+++ b/common/monitor.c
@@ -1515,6 +1515,10 @@ static void handle_mon_exception(struct kqemu_state *s,
         /* division exception from interp */
         /* XXX: verify for fxsave/fxrstor */
         s->regs = &s->regs1;
+#ifdef __x86_64__
+    } else if (intno == 0x0d && expected_monitor_exception(pc)) {
+        raise_exception(s, KQEMU_RET_SOFTMMU);
+#endif
     } else {
         /* Note: the exception state is reliable only for goto_user
            handling */