Avi Kivity wrote:
Michal Ludvig wrote:
Hi,
I've experienced a kernel Oops on 2.6.24 with kvm 66 on AMD in 64bit
mode while starting up WinXP:
kvm: emulating exchange as write
Unable to handle kernel NULL pointer dereference at 0000000000000000
RIP:
[<ffffffff883a7a5a>] :kvm:x86_emulate_insn+0x3fa/0x4240
PGD 7658d067 PUD 242a6067 PMD 0
Oops: 0002 [1] SMP
CPU 0
Modules linked in: bridge llc reiserfs tun kvm_amd kvm nfs nfsd lockd
nfs_acl auth_rpcgss sunrpc exportfs w83627ehf hwmon_vid autofs4
snd_pcm_oss snd_mixer_oss snd_seq snd_seq_device iptable_filter
ip_tables ip6table_filter ip6_tables x_tables af_packet ipv6 fuse
ext2 loop snd_hda_intel snd_pcm snd_timer k8temp i2c_nforce2 i2c_core
hwmon sr_mod button cdrom snd soundcore snd_page_alloc forcedeth sg
floppy linear sd_mod ehci_hcd ohci_hcd usbcore dm_snapshot edd dm_mod
fan sata_nv pata_amd libata scsi_mod thermal processor
Pid: 3139, comm: qemu-system-x86 Not tainted 2.6.24-mludvig #1
RIP: 0010:[<ffffffff883a7a5a>] [<ffffffff883a7a5a>]
:kvm:x86_emulate_insn+0x3fa/0x4240
RSP: 0018:ffff8100609fdc18 EFLAGS: 00010246
RAX: 000000008001003b RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8100609fe000
RBP: ffff8100609ff320 R08: ffff8100609ff3c0 R09: 0000000000000006
R10: 0000000000000002 R11: 0000000000000000 R12: ffff8100609ff368
R13: ffff8100609ff3c0 R14: ffffffff883be600 R15: 0000000001971353
FS: 0000000040804950(0063) GS:ffffffff8053e000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000000 CR3: 000000006bb74000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process qemu-system-x86 (pid: 3139, threadinfo ffff8100609fc000, task
ffff8100794d5680)
Stack: 00000000609fdc74 0000000012187318 000000000ea5f068
ffff8100609ff3c0
ffff8100609fdc94 ffffffff8839c9e0 0000000000000000 ffff8100609fe000
ffff8100609ff320 0000000000000000 0000000000000000 0000000000000000
Call Trace:
[<ffffffff8839c9e0>] :kvm:kvm_get_cs_db_l_bits+0x20/0x40
[<ffffffff8839dd2f>] :kvm:emulate_instruction+0x1bf/0x340
[<ffffffff883c1a22>] :kvm_amd:emulate_on_interception+0x12/0x60
[<ffffffff883a11d9>] :kvm:kvm_arch_vcpu_ioctl_run+0x169/0x6d0
[<ffffffff8839c14c>] :kvm:kvm_vcpu_ioctl+0x41c/0x440
[<ffffffff802305f3>] __wake_up+0x43/0x70
[<ffffffff803374c1>] __up_read+0x21/0xb0
[<ffffffff802586ec>] futex_wake+0xcc/0xf0
[<ffffffff80259559>] do_futex+0x129/0xbb0
[<ffffffff8022e7bd>] __dequeue_entity+0x3d/0x50
[<ffffffff8839b925>] :kvm:kvm_vm_ioctl+0x85/0x200
[<ffffffff802ab10f>] do_ioctl+0x2f/0xa0
[<ffffffff802ab3a0>] vfs_ioctl+0x220/0x2d0
[<ffffffff802ab4e1>] sys_ioctl+0x91/0xb0
[<ffffffff8020bcae>] system_call+0x7e/0x83
Code: 66 89 02 e9 ee fc ff ff 48 8b 95 88 00 00 00 48 8b 45 78 88
RIP [<ffffffff883a7a5a>] :kvm:x86_emulate_insn+0x3fa/0x4240
RSP <ffff8100609fdc18>
CR2: 0000000000000000
---[ end trace d358bab3f035112e ]---
The host is still alive but the XP guest is locked up in a boot screen.
Please mail me (privately) an 'objdump -Sr x86_emulate.o' from the
kernel directory, so we can see where this happened.
Ok. Please try with the attached patch and let us know. Also repeat
without the patch, so we can be sure it is easily reproducible.
--
error compiling committee.c: too many arguments to function
diff --git a/kernel/x86_emulate.c b/kernel/x86_emulate.c
index 46ef78f..8e1b32f 100644
--- a/kernel/x86_emulate.c
+++ b/kernel/x86_emulate.c
@@ -275,15 +275,12 @@ static u16 group_table[] = {
SrcMem | ModRM, 0, SrcMem | ModRM | Stack, 0,
[Group7*8] =
0, 0, ModRM | SrcMem, ModRM | SrcMem,
- SrcNone | ModRM | DstMem | Mov, 0,
- SrcMem16 | ModRM | Mov, SrcMem | ModRM | ByteOp,
+ SrcNone | ModRM | DstMem, 0, SrcMem | ModRM, SrcMem | ModRM | ByteOp,
};
static u16 group2_table[] = {
[Group7*8] =
- SrcNone | ModRM, 0, 0, 0,
- SrcNone | ModRM | DstMem | Mov, 0,
- SrcMem16 | ModRM | Mov, 0,
+ SrcNone | ModRM, 0, 0, 0, SrcNone | ModRM | DstMem, 0, SrcMem | ModRM, 0,
};
/* EFLAGS bit definitions. */
@@ -1725,8 +1722,6 @@ twobyte_insn:
goto done;
kvm_emulate_hypercall(ctxt->vcpu);
- /* Disable writeback. */
- c->dst.type = OP_NONE;
break;
case 2: /* lgdt */
rc = read_descriptor(ctxt, ops, c->src.ptr,
@@ -1734,8 +1729,6 @@ twobyte_insn:
if (rc)
goto done;
realmode_lgdt(ctxt->vcpu, size, address);
- /* Disable writeback. */
- c->dst.type = OP_NONE;
break;
case 3: /* lidt/vmmcall */
if (c->modrm_mod == 3 && c->modrm_rm == 1) {
@@ -1751,25 +1744,27 @@ twobyte_insn:
goto done;
realmode_lidt(ctxt->vcpu, size, address);
}
- /* Disable writeback. */
- c->dst.type = OP_NONE;
break;
case 4: /* smsw */
- c->dst.bytes = 2;
- c->dst.val = realmode_get_cr(ctxt->vcpu, 0);
+ if (c->modrm_mod != 3)
+ goto cannot_emulate;
+ *(u16 *)&c->regs[c->modrm_rm]
+ = realmode_get_cr(ctxt->vcpu, 0);
break;
case 6: /* lmsw */
- realmode_lmsw(ctxt->vcpu, (u16)c->src.val,
- &ctxt->eflags);
+ if (c->modrm_mod != 3)
+ goto cannot_emulate;
+ realmode_lmsw(ctxt->vcpu, (u16)c->modrm_val,
+ &ctxt->eflags);
break;
case 7: /* invlpg*/
emulate_invlpg(ctxt->vcpu, memop);
- /* Disable writeback. */
- c->dst.type = OP_NONE;
break;
default:
goto cannot_emulate;
}
+ /* Disable writeback. */
+ c->dst.type = OP_NONE;
break;
case 0x06:
emulate_clts(ctxt->vcpu);
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
kvm-devel mailing list
kvm-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/kvm-devel
