From: Avi Kivity <avi@redhat.com>
To: Markus Armbruster <armbru@redhat.com>
Cc: Blue Swirl <blauwirbel@gmail.com>,
jan.kiszka@siemens.com, qemu-devel@nongnu.org,
Anthony Liguori <anthony@codemonkey.ws>,
peter.maydell@linaro.org
Subject: Re: [Qemu-devel] Funny -m arguments can crash
Date: Tue, 14 Aug 2012 16:25:22 +0300 [thread overview]
Message-ID: <502A51C2.6060104@redhat.com> (raw)
In-Reply-To: <87txw520cn.fsf@blackfin.pond.sub.org>
On 08/14/2012 02:12 PM, Markus Armbruster wrote:
> Avi Kivity <avi@redhat.com> writes:
>
>> On 08/14/2012 11:44 AM, Markus Armbruster wrote:
> [...]
>>> And another one:
>>>
>>> $ qemu-system-x86_64 -nodefaults --enable-kvm -vnc :0 -monitor
>>> stdio -m 900k
>>> QEMU 1.1.50 monitor - type 'help' for more information
>>> (qemu) KVM internal error. Suberror: 1
>>> emulation failure
>>> EAX=000fdb78 EBX=00000000 ECX=00000000 EDX=000fdb64
>>> ESI=00000000 EDI=000fdb64 EBP=00000000 ESP=00006f98
>>> EIP=000e3492 EFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
>>> ES =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA]
>>> CS =0008 00000000 ffffffff 00c09b00 DPL=0 CS32 [-RA]
>>> SS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA]
>>> DS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA]
>>> FS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA]
>>> GS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA]
>>> LDT=0000 00000000 0000ffff 00008200 DPL=0 LDT
>>> TR =0000 00000000 0000ffff 00008b00 DPL=0 TSS32-busy
>>> GDT= 000fcd68 00000037
>>> IDT= 000fdb60 00000000
>>> CR0=00000011 CR2=00000000 CR3=00000000 CR4=00000000
>>> DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000
>>> DR3=0000000000000000
>>> DR6=00000000ffff0ff0 DR7=0000000000000400
>>> EFER=0000000000000000
>>> Code=00 00 b8 26 00 00 00 eb 95 83 c8 ff 83 c4 4c 5b 5e 5f 5d c3
>>> <57> 56 53 89 d6 39 c2 72 06 89 c7 f3 a4 eb 1b 8d 51 ff 01 d0 01 d6
>>> 89 cf 31 d2 eb 08 8a 1c
>>> q
>>>
>>
>> Not sure what's the problem. 57 is a push reg instruction which we
>> ought to emulate fine.
>>
>> 900k is 0xe1000, just below eip, but we ought to execute just fine from
>> unshadowed ROM.
>>
>>
>>> Breakpoint on kvm_handle_internal_error() yields backtrace:
>>>
>>> #0 kvm_handle_internal_error (env=0x1389b30, run=0x7ffff7ffa000)
>>> at /work/armbru/qemu/kvm-all.c:1424
>>> #1 0x0000000000674c5a in kvm_cpu_exec (env=0x1389b30)
>>> at /work/armbru/qemu/kvm-all.c:1586
>>> #2 0x000000000060e0b4 in qemu_kvm_cpu_thread_fn (arg=0x1389b30)
>>> at /work/armbru/qemu/cpus.c:757
>>> #3 0x0000003b0ea07d14 in start_thread () from /lib64/libpthread.so.0
>>> #4 0x0000003b0def197d in clone () from /lib64/libc.so.6
>>>
>>> Also seen with 904k, 908k, 964k, 968k, 972k 976k, and a whole lot more.
>>
>> Same EIP in the dump with those?
>
> Offenders within 1s in range 868k..1028k step 4:
>
> 900
> EIP=000e3492 EFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 904
> EIP=000e3492 EFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 908
> EIP=000e3492 EFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 916
> EIP=000e570e EFL=00000012 [----A--] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 964
> EIP=000f2b76 EFL=00000012 [----A--] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 968
> EIP=000f2b76 EFL=00000012 [----A--] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 972
> EIP=000fc6db EFL=00000087 [--S--PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 976
> EIP=000fc6db EFL=00000087 [--S--PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 980
> EIP=000fc6db EFL=00000087 [--S--PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 984
> EIP=000fc6db EFL=00000087 [--S--PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 988
> EIP=000fc6db EFL=00000087 [--S--PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 992
> EIP=000fc6db EFL=00000087 [--S--PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 996
> EIP=000fc6db EFL=00000087 [--S--PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 1000
> EIP=000fc6db EFL=00000087 [--S--PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 1004
> EIP=000fc6db EFL=00000087 [--S--PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 1008
> EIP=000fc6db EFL=00000087 [--S--PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 1012
> EIP=000fe69f EFL=00000087 [--S--PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 1016
> EIP=000fe69f EFL=00000083 [--S---C] CPL=0 II=0 A20=1 SMM=0 HLT=0
> 1020
> EIP=0000f000 EFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
>
Seems like crash eip always > end of memory.
It's the new flash firmware: it's set up as rom_device, and we can't
execute from that (yet). There's a patchset to allow that, but it's not
merged yet.
If you set pc-sysfw.rom_only, it should work.
--
error compiling committee.c: too many arguments to function
prev parent reply other threads:[~2012-08-14 13:25 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-07-25 11:49 [Qemu-devel] Funny -m arguments can crash Markus Armbruster
2012-07-27 19:00 ` Blue Swirl
2012-07-28 6:41 ` Markus Armbruster
2012-07-28 8:29 ` Blue Swirl
2012-07-30 12:56 ` Markus Armbruster
2012-07-30 15:05 ` Blue Swirl
2012-08-08 9:04 ` Markus Armbruster
2012-08-08 9:16 ` Peter Maydell
2012-08-08 10:02 ` Markus Armbruster
2012-08-08 9:48 ` Avi Kivity
2012-08-13 13:41 ` Markus Armbruster
2012-08-13 13:56 ` Avi Kivity
2012-08-13 14:02 ` Gleb Natapov
2012-08-13 14:04 ` Avi Kivity
2012-08-13 14:10 ` Gleb Natapov
2012-08-13 20:35 ` Blue Swirl
2012-08-19 19:26 ` Kevin O'Connor
2012-08-13 14:19 ` Anthony Liguori
2012-08-13 14:46 ` Markus Armbruster
2012-08-14 8:44 ` Markus Armbruster
2012-08-14 10:20 ` Avi Kivity
2012-08-14 10:44 ` Jan Kiszka
2012-08-14 10:51 ` Avi Kivity
2012-08-14 11:01 ` Jan Kiszka
2012-08-14 13:16 ` Avi Kivity
2012-08-14 13:25 ` Jan Kiszka
2012-08-14 13:42 ` Avi Kivity
2012-08-14 11:12 ` Markus Armbruster
2012-08-14 13:25 ` Avi Kivity [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=502A51C2.6060104@redhat.com \
--to=avi@redhat.com \
--cc=anthony@codemonkey.ws \
--cc=armbru@redhat.com \
--cc=blauwirbel@gmail.com \
--cc=jan.kiszka@siemens.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).