Bug#707257: linux-image-3.8-1-686-pae: KVM crashes with "entry failed, hardware error 0x80000021"

[Gleb Natapov <gleb@redhat.com>]

On Mon, Jun 24, 2013 at 10:42:57PM +0200, Stefan Pietsch wrote:
> On 24.06.2013 14:30, Gleb Natapov wrote:
> > On Mon, Jun 24, 2013 at 01:59:34PM +0200, Stefan Pietsch wrote:
> >> As soon as I remove "kvmvapic.bin" the virtual machine boots with
> >> qemu-kvm 1.5.0. I just verified this with Linux kernel 3.10.0-rc5.
> >> "emulate_invalid_guest_state=0" or "emulate_invalid_guest_state=1" make
> >> no difference.
> >>
> >> Please send your patches.
> > Here it is, run with it and kvmvapic.bin present. See what is printed in
> > dmesg after the failure.
> > 
> > 
> > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> > index f4a5b3f..65488a4 100644
> > --- a/arch/x86/kvm/vmx.c
> > +++ b/arch/x86/kvm/vmx.c
> > @@ -3385,6 +3385,7 @@ static void vmx_get_segment(struct kvm_vcpu *vcpu,
> >  {
> >  	struct vcpu_vmx *vmx = to_vmx(vcpu);
> >  	u32 ar;
> > +	unsigned long rip;
> >  
> >  	if (vmx->rmode.vm86_active && seg != VCPU_SREG_LDTR) {
> >  		*var = vmx->rmode.segs[seg];
> > @@ -3408,6 +3409,9 @@ static void vmx_get_segment(struct kvm_vcpu *vcpu,
> >  	var->db = (ar >> 14) & 1;
> >  	var->g = (ar >> 15) & 1;
> >  	var->unusable = (ar >> 16) & 1;
> > +	rip = kvm_rip_read(vcpu);
> > +	if ((rip == 0xc101611c || rip == 0xc101611a) && seg == VCPU_SREG_FS)
> > +		printk("base=%p limit=%p selector=%x ar=%x\n", var->base, var->limit, var->selector, ar);
> >  }
> >  
> >  static u64 vmx_get_segment_base(struct kvm_vcpu *vcpu, int seg)
> 
> 
> Booting kernel Linux 3.10-rc5 with your patch applied produces these
> messages in dmesg when starting a virtual machine:
> 
> emulate_invalid_guest_state=0
> [  118.732151] base=ffff0000 limit=  (null) selector=f0000fff ar=0
> [  118.732341] base=ffff0000 limit=  (null) selector=f0000fff ar=0
> 
I've butchered printk format, but it gives me the idea of what is going
on anyway. Can you try the patch below with
emulate_invalid_guest_state=0|1?


diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index f4a5b3f..eb062ce 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3395,19 +3395,20 @@ static void vmx_get_segment(struct kvm_vcpu *vcpu,
 		var->selector = vmx_read_guest_seg_selector(vmx, seg);
 		return;
 	}
+
 	var->base = vmx_read_guest_seg_base(vmx, seg);
 	var->limit = vmx_read_guest_seg_limit(vmx, seg);
 	var->selector = vmx_read_guest_seg_selector(vmx, seg);
 	ar = vmx_read_guest_seg_ar(vmx, seg);
+	var->unusable = (ar >> 16) & 1;
 	var->type = ar & 15;
 	var->s = (ar >> 4) & 1;
 	var->dpl = (ar >> 5) & 3;
-	var->present = (ar >> 7) & 1;
+	var->present = !var->unusable;
 	var->avl = (ar >> 12) & 1;
 	var->l = (ar >> 13) & 1;
 	var->db = (ar >> 14) & 1;
 	var->g = (ar >> 15) & 1;
-	var->unusable = (ar >> 16) & 1;
 }
 
 static u64 vmx_get_segment_base(struct kvm_vcpu *vcpu, int seg)

--
			Gleb.