Bug#707257: linux-image-3.8-1-686-pae: KVM crashes with "entry failed, hardware error 0x80000021"

[Gleb Natapov <gleb@redhat.com>]

On Mon, Jun 24, 2013 at 01:59:34PM +0200, Stefan Pietsch wrote:
> On 24.06.2013 13:47, Gleb Natapov wrote:
> > On Mon, Jun 24, 2013 at 01:43:26PM +0200, Stefan Pietsch wrote:
> >> On 23.06.2013 19:36, Gleb Natapov wrote:
> >>> On Sun, Jun 23, 2013 at 06:51:30PM +0200, Stefan Pietsch wrote:
> >>>> On 23.06.2013 09:51, Gleb Natapov wrote:
> >>>>> On Thu, Jun 20, 2013 at 07:01:49PM +0200, Stefan Pietsch wrote:
> >>>>>>> Can you provide the output of 25391454e73e3156202264eb3c473825afe4bc94
> >>>>>>> and emulate_invalid_guest_state=0. Also run "x/20i $pc-20" in qemu
> >>>>>>> monitor after the hang.
> >>>>>>
> >>>>>>
> >>>>>> 25391454e73e3156202264eb3c473825afe4bc94
> >>>>>>  emulate_invalid_guest_state=0
> >>>>>>
> >>>>> Very interesting. Looks like somewhere during TPR access FS
> >>>>> register gets corrupted. Can you remove /usr/share/kvm/kvmvapic.bin
> >>>>> and try again? This will disable some code paths during TPR access and
> >>>>> will narrow down the issue.
> >>>>
> >>>>
> >>>> Doing this, qemu complains
> >>>> "Could not open option rom 'kvmvapic.bin': No such file or directory",
> >>>> but the virtual machine boots successful with
> >>>> emulate_invalid_guest_state=0 and emulate_invalid_guest_state=1.
> >>>>
> >>> Hmm, I think we ate close. Can you try with upstream qemu?
> >>>
> >>>> kvmvapic.bin comes with Debian package "seabios 1.7.2-3".
> >>
> >> I already tried this with the Debian package qemu-kvm 1.5.0+dfsg-4.
> > And it didn't work? Mind trying some debug kernel patches? I suspect
> > your CPU does something no CPU I have do, so I want to verify it.
> 
> 
> As soon as I remove "kvmvapic.bin" the virtual machine boots with
> qemu-kvm 1.5.0. I just verified this with Linux kernel 3.10.0-rc5.
> "emulate_invalid_guest_state=0" or "emulate_invalid_guest_state=1" make
> no difference.
> 
> Please send your patches.
Here it is, run with it and kvmvapic.bin present. See what is printed in
dmesg after the failure.


diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index f4a5b3f..65488a4 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3385,6 +3385,7 @@ static void vmx_get_segment(struct kvm_vcpu *vcpu,
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
 	u32 ar;
+	unsigned long rip;
 
 	if (vmx->rmode.vm86_active && seg != VCPU_SREG_LDTR) {
 		*var = vmx->rmode.segs[seg];
@@ -3408,6 +3409,9 @@ static void vmx_get_segment(struct kvm_vcpu *vcpu,
 	var->db = (ar >> 14) & 1;
 	var->g = (ar >> 15) & 1;
 	var->unusable = (ar >> 16) & 1;
+	rip = kvm_rip_read(vcpu);
+	if ((rip == 0xc101611c || rip == 0xc101611a) && seg == VCPU_SREG_FS)
+		printk("base=%p limit=%p selector=%x ar=%x\n", var->base, var->limit, var->selector, ar);
 }
 
 static u64 vmx_get_segment_base(struct kvm_vcpu *vcpu, int seg)
--
			Gleb.