Re: KVM entry failed, hardware error

[Johannes Bauer <dfnsonfsduifb@gmx.de>]

On 07.06.2012 09:12, Avi Kivity wrote:

> add -monitor stdio to the command line and then:
> 
> (qemu) info registers
> (qemu) x/20i 0xcsbase + $eip
>
> Run info registers a few times and note whether eip changes or not.

It does not. Here's where it hangs:

(qemu) info registers
EAX=000023de EBX=00000b70 ECX=00000b90 EDX=00000002
ESI=002523de EDI=00000b84 EBP=0000146e ESP=0000146e
EIP=000008d7 EFL=00000202 [-------] CPL=3 II=0 A20=1 SMM=0 HLT=0
ES =23de 00023de0 0000ffff 0000f300
CS =2000 00020000 0000ffff 0000f300
SS =23de 00023de0 0000ffff 0000f300
DS =23de 00023de0 0000ffff 0000f300
FS =0060 00023de0 0000ffff 00009300
GS =0060 00023de0 0000ffff 00009300
LDT=0000 00000000 ffffffff 00c00000
TR =0040 feffd000 00002088 00008b00
GDT=     0001f000 0000007f
IDT=     00000000 0000ffff
CR0=00000010 CR2=00000000 CR3=00000000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000
DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000000
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000
XMM01=00000000000000000000000000000000
XMM02=00000000000000000000000000000000
XMM03=00000000000000000000000000000000
XMM04=00000000000000000000000000000000
XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000
XMM07=00000000000000000000000000000000

(qemu) x/20i 0x20000 + $eip
0x00000000000208d7:  leave
0x00000000000208d8:  ret
0x00000000000208d9:  enter  $0x0,$0x0
0x00000000000208dd:  push   %ebp
0x00000000000208df:  push   %ebx
0x00000000000208e1:  push   %esi
0x00000000000208e3:  push   %edi
0x00000000000208e5:  mov    %esp,%ebx
0x00000000000208e8:  mov    %ebx,%edi
0x00000000000208eb:  add    $0x14,%edi
0x00000000000208ef:  addr32 mov (%edi),%eax
0x00000000000208f3:  mov    $0x1480,%sp
0x00000000000208f6:  xor    %bp,%bp
0x00000000000208f8:  movzwl %bp,%ebp
0x00000000000208fc:  movzwl %sp,%esp
0x0000000000020900:  push   %ebx
0x0000000000020902:  push   %eax
0x0000000000020904:  call   0x20919
0x0000000000020907:  add    $0x4,%sp
0x000000000002090a:  pop    %ebx

And this is where it came from and tries to return to:

(qemu) x /8hx 0x23de0 + $esp
000000000002524e: 0x1474 0x092a 0x0001 0x0000 0x0907 0x4970 0x0002 0x0b70

(qemu) x/20i 0x20000 + 0x92a - 0x15
0x0000000000020915:  pop    %ebp
0x0000000000020917:  leave
0x0000000000020918:  ret
0x0000000000020919:  enter  $0x0,$0x0
0x000000000002091d:  mov    0x1510,%ax
0x0000000000020920:  push   %ax
0x0000000000020921:  and    %ax,%ax
0x0000000000020923:  je     0x2092a
0x0000000000020927:  call   0x20871
0x000000000002092a:  push   %bx
0x000000000002092b:  push   %di
0x000000000002092c:  push   %si
0x000000000002092d:  push   %ds
0x000000000002092e:  push   %es
0x000000000002092f:  push   %bp
0x0000000000020930:  mov    0x4(%bp),%eax
0x0000000000020934:  mov    %ax,%bp
0x0000000000020936:  and    $0xf,%bp
0x0000000000020939:  shr    $0x4,%eax
0x000000000002093d:  mov    %ax,%ds

Here's the whole function that causes the hangup:

(qemu) x/39i 0x20000 + 0x871
0x0000000000020871:  enter  $0x0,$0x0
0x0000000000020875:  push   %ebx
0x0000000000020877:  mov    0x1510,%ax
0x000000000002087a:  and    %ax,%ax
0x000000000002087c:  je     0x208d5
0x0000000000020880:  sgdtw  0x1500
0x0000000000020885:  sidtw  0x1508
0x000000000002088a:  movw   $0x0,0x1510
0x0000000000020890:  mov    %cr0,%eax
0x0000000000020893:  mov    %eax,0x1514
0x0000000000020897:  and    $0x7ffffffe,%eax
0x000000000002089d:  mov    %eax,%cr0
0x00000000000208a0:  jmp    0x208a5
0x00000000000208a2:  nop
0x00000000000208a3:  nop
0x00000000000208a4:  nop
0x00000000000208a5:  mov    %cr3,%eax
0x00000000000208a8:  nop
0x00000000000208a9:  nop
0x00000000000208aa:  nop
0x00000000000208ab:  nop
0x00000000000208ac:  mov    %eax,%cr3
0x00000000000208af:  pushw  0x1536
0x00000000000208b3:  pop    %es
0x00000000000208b4:  mov    $0x8c6,%bx
0x00000000000208b7:  mov    0x1536,%ax
0x00000000000208ba:  mov    %ax,%es:-0x2(%bx)
0x00000000000208be:  ljmp   *%es:-0x4(%bx)
0x00000000000208c2:  (bad)
0x00000000000208c3:  or     %al,(%bx,%si)
0x00000000000208c5:  and    %ah,0x1534(%bx,%di)
0x00000000000208c9:  mov    %ax,%ds
0x00000000000208cb:  mov    %ax,%ss
0x00000000000208cd:  mov    %ax,%es
0x00000000000208cf:  lidtw  0x14f8
0x00000000000208d4:  sti
0x00000000000208d5:  pop    %ebx
0x00000000000208d7:  leave
0x00000000000208d8:  ret

Best regards,
Joe