From mboxrd@z Thu Jan 1 00:00:00 1970 From: Chris Clayton Subject: Re: qemu-kvm-1.1.0 crashing with kernel 3.5.0-rc6 Date: Fri, 27 Jul 2012 00:22:11 +0100 Message-ID: <5011D123.4060101@googlemail.com> References: <4FFAB92C.4030001@googlemail.com> <4FFD26B6.8000802@googlemail.com> <20120711071200.GG23898@redhat.com> <4FFD28B9.9040604@googlemail.com> <20120711072255.GH23898@redhat.com> <50031F85.6020908@googlemail.com> <5007FA1C.5080606@googlemail.com> <5007FAD6.2010407@redhat.com> <500850AD.8080504@googlemail.com> <50111369.6020209@googlemail.com> <50111566.5070202@redhat.com> <501130CF.5050207@googlemail.com> <501132EB.6060705@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: Gleb Natapov , kvm@vger.kernel.org, Jan Kiszka To: Avi Kivity Return-path: Received: from mail-wg0-f44.google.com ([74.125.82.44]:53021 "EHLO mail-wg0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753148Ab2GZXWN (ORCPT ); Thu, 26 Jul 2012 19:22:13 -0400 Received: by wgbdr13 with SMTP id dr13so2246693wgb.1 for ; Thu, 26 Jul 2012 16:22:11 -0700 (PDT) In-Reply-To: <501132EB.6060705@redhat.com> Sender: kvm-owner@vger.kernel.org List-ID: On 07/26/12 13:07, Avi Kivity wrote: > On 07/26/2012 02:58 PM, Chris Clayton wrote: > >>> It looks like general memory corruption. Is this repeatable? What's >>> the guest uptime when it happens (i.e. is it immediate?) >> >> I've just done 10 runs of WinXP SP3 and 5 of them crashed. Three crashed >> early as XP was starting up - well before the desktop would have >> appeared. The other two crashed as XP was closing down, having been >> running for a few minutes (but not doing much). >> >> The error messages seen through dmesg are: >> >> qemu-kvm[12778] general protection ip:b6c43d77 sp:b5e800fc error:0 in >> libc-2.16.so[b6b06000+1b4000] >> qemu-kvm[12813] general protection ip:b6bf6d77 sp:b54ff0fc error:0 in >> libc-2.16.so[b6ab9000+1b4000] >> qemu-kvm[12986] general protection ip:b6cd3d77 sp:b55ff0fc error:0 in >> libc-2.16.so[b6b96000+1b4000] >> qemu-kvm[13045] general protection ip:b6c91d77 sp:b54ff0fc error:0 in >> libc-2.16.so[b6b54000+1b4000] >> qemu-kvm[13225] general protection ip:b6c5bd77 sp:b54ff0fc error:0 in >> libc-2.16.so[b6b1e000+1b4000] >> >> The other 5 were OK, although I only did a bit of web browsing for few >> minutes with IE. > > Failures always in the same place (I'm guess the variations are due to > PIE -- please configure with --disable-pie for future tests). > > Please generate a core and look around, esp. in frame 3 > (type_table_lookup). Also try to dissect type_table (you may need to > install the glib debug symbols for this). > > > Mmm, I'm sailing out of my comfort zone here, but I've built a debug version of glib and trapped another crash. The backtrace is: (gdb) bt #0 0xb7822d77 in __strcmp_sse4_2 () from /lib/libc.so.6 #1 0xb7e82cb4 in g_str_equal (v1=0x8a0cd58, v2=0x8319b82) at ghash.c:1704 #2 0xb7e8137a in g_hash_table_lookup_node (hash_table=0x89fe800, key=0x8319b82, hash_return=0xb60ff178) at ghash.c:422 #3 0xb7e821e5 in g_hash_table_lookup (hash_table=0x89fe800, key=key@entry=0x8319b82) at ghash.c:1074 #4 0x0815c9cb in type_table_lookup (name=0x8319b82 "apic-common") at qom/object.c:94 #5 type_get_by_name (name=name@entry=0x8319b82 "apic-common") at qom/object.c:149 #6 0x0815cf93 in object_dynamic_cast (obj=obj@entry=0x8a44818, typename=typename@entry=0x8319b82 "apic-common") at qom/object.c:416 #7 0x0815cf2d in object_dynamic_cast_assert (obj=obj@entry=0x8a44818, typename=typename@entry=0x8319b82 "apic-common") at qom/object.c:478 #8 0x08192c1b in cpu_set_apic_tpr (d=0x8a44818, val=8 '\b') at /home/chris/rpm/BUILD/qemu-kvm-1.1.1/hw/apic_common.c:60 #9 0x081cb86c in kvm_arch_post_run (env=env@entry=0x8a3ca60, run=run@entry=0xb6258000) at /home/chris/rpm/BUILD/qemu-kvm-1.1.1/target-i386/kvm.c:1695 #10 0x081c686f in kvm_cpu_exec (env=env@entry=0x8a3ca60) at /home/chris/rpm/BUILD/qemu-kvm-1.1.1/kvm-all.c:1269 #11 0x08198c72 in qemu_kvm_cpu_thread_fn (arg=0x8a3ca60) at /home/chris/rpm/BUILD/qemu-kvm-1.1.1/cpus.c:752 #12 0xb7a3ed9e in start_thread () from /lib/libpthread.so.0 #13 0xb77dabbe in clone () from /lib/libc.so.6 Inspecting the args passed into g_str_equal shows: (gdb) print (gchar *) 0x8a0cd58 $12 = (gchar *) 0x8a0cd58 "apic-common" (gdb) print (gchar *) 0x8319b82 $13 = (gchar *) 0x8319b82 "apic-common" So it seems odd that glibc's implementation of strcmp should crash with two equal strings. As I say, however, I'm a bit out of my comfort zone here, so I may be missing something. I wouldn't know how to go about disecting type_table, which I assume is the hash_table arg passed into g_hash_table_lookup, so advice on how to do that and what I am looking for (NULL pointer?) would be helpful.