SVM VMRUN Weirdness

[email protected]
Newsgroups gmane.comp.emulators.bochs.devel
Message-ID <921287647.1344102.1361295892068.JavaMail.root@sz0046a.westchester.pa.mail.comcast.net> 
Hi, 

I have run into an issue with (I think) the bochs SVM functionality. In debugging some new code, I found that when I step through a VMRUN call (first guest instructions executed), everything functions as expected. (see VMRun-Step.txt attached) However if I turn trace on and don't step through, something odd happens. (see VMRun-Trace.txt also attached) 

Regarding this code in the attached files: 
0000:7C00 JMP +60 
... 
... 
0000:7C36 cli 

If I step through VMRUN, the first guest instruction executed is 0000:7C00, as it should be. Then the 2nd instruction executed is 0000:7C36, also as it should be. 

However, if I trace through VMRUN, the next instruction executed says it is at 0000:7C00 and is JMP +60, but then the next instruction executed is 0000:7C01. This is the problem. In my case 7C01 has an invalid opcode (0x3c90) so I can verify that tracing executes 7C01 while stepping doesn't. 

I tried to track down the problem but haven't yet fully come to understand the instruction execution functionality, especially the prefetching. However on a whim I did hack a fix in SVM.cc by setting async_event=1 unconditionally just before the call to handleCpuContextChange. Note that I didn't do so because I knew what async_event would do ... it was just a wild guess. 

After that change, when I run the modified bochs code, both stepping and tracing execute instruction #2 at 7C36. 

But there's more, and it could be related. With the "problem fixed" I then added code to my program to process intercepted interrupts from the guest. So when the guest calls, for example, Int 13, I intercept it, put the guest Flags:CS:IP on the stack, decrement the SP, and point the guest at the vector CS:IP via the VMCB. But when all my hypervisor work is done and VMRUN is called, the wrong guest code is executed. In this case the debugger *says* that f000:e3fe is being executed, but the logical addy to the left of the segmented address says: [0x000000000000e3fe] 

QUOTE: 
(0) [0x00000000000502da] 0008:00000000000002da (unk. ctxt): vmrun rax ; 0f01d8 
00016993704i[XGUI ] Mouse capture off 
<bochs:30> s 
Next at t=16993705 
(0) [0x000000000000e3fe] f000:e3fe (unk. ctxt): add byte ptr ds:[bx+si], al ; 0000 

I know for a fact that I populated the CS in the VMCB correctly, and it shows in the segmented address. 

I am not sure that there is any relation between the two issues. After all, the hack for the first issue doesn't fix the 2nd. And no, the hack didn't CAUSE the 2nd issue. I verified that by removing the hack and stepping through the code until I hit the line above. (f000:e3fe). It still says: 

(0) [0x000000000000e3fe] f000:e3fe (unk. ctxt): add byte ptr ds:[bx+si], al ; 0000 

If someone can point me in the right direction, I'd be glad to help track down the issue(s) ... if they are indeed issues and not some problems with my code. I've been looking at the bochs code quite a bit but it takes time to figure out how each element works. 

Thanks, 

Chris

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_feb

_______________________________________________
bochs-developers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bochs-developers
VMRun-Step.txt (text/plain, 3.1 KB) 
(0) [0x00000000000501cd] 0008:00000000000001cd (unk. ctxt): vmrun rax                 ; 0f01d8
00017091273i[XGUI ] Mouse capture off
<bochs:3> s
Next at t=17091274
(0) [0x0000000000007c00] 0000:7c00 (unk. ctxt): jmp .+60 (0x00007c3e)     ; eb3c
00017091274i[XGUI ] Mouse capture off
<bochs:4> s
Next at t=17091275
(0) [0x0000000000007c3e] 0000:7c3e (unk. ctxt): cli                       ; fa
00017091275i[XGUI ] Mouse capture off
<bochs:5> s
Next at t=17091276
(0) [0x0000000000007c3f] 0000:7c3f (unk. ctxt): xor ax, ax                ; 33c0
00017091276i[XGUI ] Mouse capture off
<bochs:6> s
Next at t=17091277
(0) [0x0000000000007c41] 0000:7c41 (unk. ctxt): mov ss, ax                ; 8ed0
00017091277i[XGUI ] Mouse capture off
<bochs:7> s
Next at t=17091278
(0) [0x0000000000007c43] 0000:7c43 (unk. ctxt): mov sp, 0x7c00            ; bc007c
00017091278i[XGUI ] Mouse capture off
<bochs:8> s
Next at t=17091279
(0) [0x0000000000007c46] 0000:7c46 (unk. ctxt): push ss                   ; 16
00017091279i[XGUI ] Mouse capture off
<bochs:9> s
Next at t=17091280
(0) [0x0000000000007c47] 0000:7c47 (unk. ctxt): pop es                    ; 07
00017091280i[XGUI ] Mouse capture off
<bochs:10> s
Next at t=17091281
(0) [0x0000000000007c48] 0000:7c48 (unk. ctxt): mov bx, 0x0078            ; bb7800
00017091281i[XGUI ] Mouse capture off

<bochs:11> sreg;creg;r
es:0x0000, dh=0x000f9300, dl=0x0000ffff, valid=1
	Data segment, base=0x00000000, limit=0x000fffff, Read/Write, Accessed
cs:0x0000, dh=0x000f9300, dl=0x0000ffff, valid=1
	Data segment, base=0x00000000, limit=0x000fffff, Read/Write, Accessed
ss:0x0000, dh=0x000f9300, dl=0x0000ffff, valid=7
	Data segment, base=0x00000000, limit=0x000fffff, Read/Write, Accessed
ds:0x0000, dh=0x000f9300, dl=0x0000ffff, valid=1
	Data segment, base=0x00000000, limit=0x000fffff, Read/Write, Accessed
fs:0x0010, dh=0x009f9300, dl=0x0000ffff, valid=1
	Data segment, base=0x00000000, limit=0xffffffff, Read/Write, Accessed
gs:0xb800, dh=0x0000930b, dl=0x8000ffff, valid=7
	Data segment, base=0x000b8000, limit=0x0000ffff, Read/Write, Accessed
ldtr:0x0000, dh=0x00008200, dl=0x0000ffff, valid=1
tr:0x0000, dh=0x00008b00, dl=0x0000ffff, valid=1
gdtr:base=0x00000000000fa1a7, limit=0x30
idtr:base=0x0000000000000000, limit=0x3ff
CR0=0x60000010: pg CD NW ac wp ne ET ts em mp pe
CR2=page fault laddr=0x0000000000000000
CR3=0x0000000000000000
    PCD=page-level cache disable=0
    PWT=page-level write-through=0
CR4=0x00000000: smep osxsave pcid fsgsbase smx vmx osxmmexcpt osfxsr pce pge mce pae pse de tsd pvi vme
CR8: 0x0
EFER=0x00001000: ffxsr nxe lma lme sce
rax: 0x00000000_00000000 rcx: 0x00000000_00000000
rdx: 0x00000000_00000000 rbx: 0x00000000_00000000
rsp: 0x00000000_00007c00 rbp: 0x00000000_00000000
rsi: 0x00000000_00000000 rdi: 0x00000000_00000000
r8 : 0x00000000_00000000 r9 : 0x00000000_00000000
r10: 0x00000000_00000000 r11: 0x00000000_00000000
r12: 0x00000000_00000000 r13: 0x00000000_00000000
r14: 0x00000000_00000000 r15: 0x00000000_00000000
rip: 0x00000000_00007c48
eflags 0x00002044: id vip vif ac vm rf nt IOPL=2 of df if tf sf ZF af PF cf
00017091281i[XGUI ] Mouse capture off
<bochs:12>
VMRun-Trace.txt (text/plain, 3.5 KB) 
(0) [0x00000000000501cd] 0008:00000000000001cd (unk. ctxt): vmrun rax                 ; 0f01d8
00017091273i[XGUI ] Mouse capture off
<bochs:2> trace on
Tracing enabled for CPU0
00017091273i[XGUI ] Mouse capture off
<bochs:3> c
(0).[17091273] [0x00000000000501cd] 0008:00000000000001cd (unk. ctxt): vmrun rax                 ; 0f01d8
(0).[17091274] [0x0000000000007c00] 0000:7c00 (unk. ctxt): jmp .+60 (0x00007c3e)     ; eb3c
(0).[17091275] [0x0000000000007c01] 0000:7c01 (unk. ctxt): cmp al, 0x90              ; 3c90
CPU 0: Exception 0x06 - (#UD) undefined opcode occured (error_code=0x0000)
CPU 0: Interrupt 0x06 occured (error_code=0x0000)
(0).[17091276] [0x00000000000fff53] f000:ff53 (unk. ctxt): iret                      ; cf
(0).[17091277] [0x0000000000007c01] 0000:7c01 (unk. ctxt): cmp al, 0x90              ; 3c90
(0).[17091278] [0x0000000000007c03] 0000:7c03 (unk. ctxt): sub word ptr ds:[si+78], dx ; 29544e
(0).[17091279] [0x0000000000007c06] 0000:7c06 (unk. ctxt): push cx                   ; 51
(0).[17091280] [0x0000000000007c07] 0000:7c07 (unk. ctxt): cmp word ptr ds:[bx+di+72], cx ; 394948
(0).[17091281] [0x0000000000007c0a] 0000:7c0a (unk. ctxt): inc bx                    ; 43
(0).[17091282] [0x0000000000007c0b] 0000:7c0b (unk. ctxt): add byte ptr ss:[bp+si], al ; 0002
(0).[17091283] [0x0000000000007c0d] 0000:7c0d (unk. ctxt): add word ptr ds:[bx+di], ax ; 0101
(0).[17091284] [0x0000000000007c0f] 0000:7c0f (unk. ctxt): add byte ptr ss:[bp+si], al ; 0002
(0).[17091285] [0x0000000000007c11] 0000:7c11 (unk. ctxt): loopne .+0 (0x00007c13)   ; e000
(0).[17091286] [0x0000000000007c13] 0000:7c13 (unk. ctxt): inc ax                    ; 40
(0).[17091287] [0x0000000000007c14] 0000:7c14 (unk. ctxt): or si, ax                 ; 0bf0


<cut for berevity>


<bochs:4> sreg;creg;r
es:0x0000, dh=0x000f9300, dl=0x0000ffff, valid=1
	Data segment, base=0x00000000, limit=0x000fffff, Read/Write, Accessed
cs:0x0000, dh=0x000f9300, dl=0x0000ffff, valid=1
	Data segment, base=0x00000000, limit=0x000fffff, Read/Write, Accessed
ss:0x0000, dh=0x000f9300, dl=0x0000ffff, valid=7
	Data segment, base=0x00000000, limit=0x000fffff, Read/Write, Accessed
ds:0x0000, dh=0x000f9300, dl=0x0000ffff, valid=7
	Data segment, base=0x00000000, limit=0x000fffff, Read/Write, Accessed
fs:0x0010, dh=0x009f9300, dl=0x0000ffff, valid=1
	Data segment, base=0x00000000, limit=0xffffffff, Read/Write, Accessed
gs:0xb800, dh=0x0000930b, dl=0x8000ffff, valid=7
	Data segment, base=0x000b8000, limit=0x0000ffff, Read/Write, Accessed
ldtr:0x0000, dh=0x00008200, dl=0x0000ffff, valid=1
tr:0x0000, dh=0x00008b00, dl=0x0000ffff, valid=1
gdtr:base=0x00000000000fa1a7, limit=0x30
idtr:base=0x0000000000000000, limit=0x3ff
CR0=0x60000010: pg CD NW ac wp ne ET ts em mp pe
CR2=page fault laddr=0x0000000000000000
CR3=0x0000000000000000
    PCD=page-level cache disable=0
    PWT=page-level write-through=0
CR4=0x00000000: smep osxsave pcid fsgsbase smx vmx osxmmexcpt osfxsr pce pge mce pae pse de tsd pvi vme
CR8: 0x0
EFER=0x00001000: ffxsr nxe lma lme sce
rax: 0x00000000_00000012 rcx: 0x00000000_00000b40
rdx: 0x00000000_00000000 rbx: 0x00000000_00000078
rsp: 0x00000000_00007bf8 rbp: 0x00000000_00000000
rsi: 0x00000000_0000efe9 rdi: 0x00000000_00007c49
r8 : 0x00000000_00000000 r9 : 0x00000000_00000000
r10: 0x00000000_00000000 r11: 0x00000000_00000000
r12: 0x00000000_00000000 r13: 0x00000000_00000000
r14: 0x00000000_00000000 r15: 0x00000000_00000000
rip: 0x00000000_00007c93
eflags 0x00002244: id vip vif ac vm rf nt IOPL=2 of df IF tf sf ZF af PF cf
00017091579i[XGUI ] Mouse capture off
<bochs:5>
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.