Re: NULL pointer dereference in kernel code, ignored parameters in libkvm

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Avi Kivity wrote:
> Gabe Black wrote:
>>     Hi. I'm a developer on the M5 simulator (m5sim.org) working on a CPU
>> model which uses kvm as its execution engine. 
>
> Neat stuff.  You're using kvm to run non-x86 code on x86?

Right now we're trying to run x86 on x86 but using our device models
instead of QEMUs. It would be interesting to use it for other ISAs, but
as far as I know we hadn't considered that.

>
>> I ran into a kernel "BUG"
>> where a NULL pointer is being dereferenced in gfn_to_rmap.
>>
>>     What's happening on the kernel side is that gfn_to_rmap is calling
>> gfn_to_memslot. That function looks for the gfn in the memory slots,
>> fails to find it, and returns a NULL pointer. gfn_to_rmap then tries to
>> dereference it, and the kernel kills itself. I believe the original
>> source of the call to gfn_to_memslot was mmu_alloc_roots (in 2.6.28.9,
>> it may have moved) which tries to get the page pointed to by CR3 using
>> kvm_mmu_get_page. That part may not be correct, so here's the log output
>> from the kernel.
>>   
>
> This was fixed by 89da4ff17 ("KVM: x86: check for cr3 validity in
> mmu_alloc_roots").  Did the code base you were testing contain that?7

It was the 2.6.28.9 kernel, and looking at the patch and lxr it appears not.

>
>> The second problem was the fact that CR3 didn't point to any memory even
>> though it had a valid value (0x7000). This was because our code relied
>> on kvm_create to set up physical memory, and while it takes parameters
>> for it and passes them around, it never actually seems to do anything
>> with them. This also seems to be the case in your most recent code.
>>
>>   
>
> You should set up the memory independently using the memory slot APIs,
> then load CR3.  kvm_create() has bitrotted a bit.

Will do.

>
>> I am a full time employee of VMware, and while I work on M5 on my own
>> time, that places certain limits on what I can do to help fix these
>> bugs. While I probably can't implement anything, I should be able to
>> provide more information about what we're doing with M5 or about the
>> crash if that would help.
>>   
>
> I appreciate the reports.  Please test latest kvm.git and let us know
> if the problems persist.

Will do.

>
> It would also be interesting to hear how you use kvm.
>

Ultimately, we'd like to use KVM for at least two things. The first is
as a way to fast forward simulations to the portion of interest before
switching into something slower that can collect interesting statistics
and accurately simulate performance. Our immediate goal on our way to
that is to get a CPU based around KVM to boot Linux while hooked into
our device models. We're very early in the process, but one challenge
I'm anticipating is being able to pull the local APIC out of the virtual
CPU and into M5 so that we can coordinate IPIs, etc., ourselves.

The other thing we'd like to do is to use KVM as a golden model to
verify our correctness against. To do that, we'll probably need to make
significant progress on the above, and then also find a mechanism to
make each CPU advance in very incremental and deterministic ways. Our
thought on that so far as been to set the TF bit in the guest and use
the #DB to exit back to the host. We expect there will be some gotchas
with this like hold off on mov to %ss, but if there would be any show
stopper problems please let us know.

Gabe
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux