[Qemu-devel] Crash on Windows XP startup

[Qemu-devel] Crash on Windows XP startup

[Gerhard Wiesinger]

Hello,

I bisected down a Windows XP startup crash to the following commit:

0b57e287138728f72d88b06e69b970c5d745c44a is the first bad commit
commit 0b57e287138728f72d88b06e69b970c5d745c44a
Author: David Gibson <david@gibson.dropbear.id.au>
Date:   Mon Sep 10 12:30:57 2012 +1000

Reproduceable on qemu HEAD and by commenting out the refactored patch 
into a function.

How to proceed?

Ciao,
Gerhard

diff --git a/exec.c b/exec.c
index af94f9c..a937882 100644
--- a/exec.c
+++ b/exec.c
@@ -3501,7 +3501,7 @@ void cpu_physical_memory_write_rom(hwaddr addr,
              /* ROM/RAM case */
              ptr = qemu_get_ram_ptr(addr1);
              memcpy(ptr, buf, l);
-            invalidate_and_set_dirty(addr1, l);
+            //invalidate_and_set_dirty(addr1, l);
              qemu_put_ram_ptr(ptr);
          }
          len -= l;

Re: [Qemu-devel] Crash on Windows XP startup

[Catalin Patulea]

SIGSEGV is in target code:

(gdb) bt
#0  0x00000000402fd349 in code_gen_buffer ()
#1  0x000000000056113b in cpu_x86_exec (env=0x19489f0)
    at /usr/local/google/home/catalinp/src/qemu/cpu-exec.c:599
#2  0x00000000005625f9 in tcg_cpu_exec (env=0x19489f0)
    at /usr/local/google/home/catalinp/src/qemu/cpus.c:1115
#3  tcg_exec_all () at /usr/local/google/home/catalinp/src/qemu/cpus.c:1148
#4  qemu_tcg_cpu_thread_fn (arg=<optimized out>)
    at /usr/local/google/home/catalinp/src/qemu/cpus.c:841
#5  0x00007ffff6315e9a in start_thread (arg=0x7fffee690700) at
pthread_create.c:308
#6  0x00007ffff6042cbd in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#7  0x0000000000000000 in ?? ()

The patch (disabling the invalidate_and_set_dirty) does fix it for me as well.

On Thu, Nov 8, 2012 at 1:53 PM, Gerhard Wiesinger <lists@wiesinger.com> wrote:
> Hello,
>
> I bisected down a Windows XP startup crash to the following commit:
>
> 0b57e287138728f72d88b06e69b970c5d745c44a is the first bad commit
> commit 0b57e287138728f72d88b06e69b970c5d745c44a
> Author: David Gibson <david@gibson.dropbear.id.au>
> Date:   Mon Sep 10 12:30:57 2012 +1000
>
> Reproduceable on qemu HEAD and by commenting out the refactored patch into a
> function.
>
> How to proceed?
>
> Ciao,
> Gerhard
>
> diff --git a/exec.c b/exec.c
> index af94f9c..a937882 100644
> --- a/exec.c
> +++ b/exec.c
> @@ -3501,7 +3501,7 @@ void cpu_physical_memory_write_rom(hwaddr addr,
>              /* ROM/RAM case */
>              ptr = qemu_get_ram_ptr(addr1);
>              memcpy(ptr, buf, l);
> -            invalidate_and_set_dirty(addr1, l);
> +            //invalidate_and_set_dirty(addr1, l);
>              qemu_put_ram_ptr(ptr);
>          }
>          len -= l;
>
>

Re: [Qemu-devel] Crash on Windows XP startup

[Catalin Patulea]

I can post the target code and the code generated by TCG - not sure
how helpful that would be. There also seems to be a diff between what
is logged by "-d out_asm" and what I see in gdb with disass, and the
segv occurs in one of the diff blocks.

On Fri, Nov 9, 2012 at 1:42 PM, Catalin Patulea <catalinp@google.com> wrote:
> SIGSEGV is in target code:
>
> (gdb) bt
> #0  0x00000000402fd349 in code_gen_buffer ()
> #1  0x000000000056113b in cpu_x86_exec (env=0x19489f0)
>     at /usr/local/google/home/catalinp/src/qemu/cpu-exec.c:599
> #2  0x00000000005625f9 in tcg_cpu_exec (env=0x19489f0)
>     at /usr/local/google/home/catalinp/src/qemu/cpus.c:1115
> #3  tcg_exec_all () at /usr/local/google/home/catalinp/src/qemu/cpus.c:1148
> #4  qemu_tcg_cpu_thread_fn (arg=<optimized out>)
>     at /usr/local/google/home/catalinp/src/qemu/cpus.c:841
> #5  0x00007ffff6315e9a in start_thread (arg=0x7fffee690700) at
> pthread_create.c:308
> #6  0x00007ffff6042cbd in clone () at
> ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
> #7  0x0000000000000000 in ?? ()
>
> The patch (disabling the invalidate_and_set_dirty) does fix it for me as well.
>
> On Thu, Nov 8, 2012 at 1:53 PM, Gerhard Wiesinger <lists@wiesinger.com> wrote:
>> Hello,
>>
>> I bisected down a Windows XP startup crash to the following commit:
>>
>> 0b57e287138728f72d88b06e69b970c5d745c44a is the first bad commit
>> commit 0b57e287138728f72d88b06e69b970c5d745c44a
>> Author: David Gibson <david@gibson.dropbear.id.au>
>> Date:   Mon Sep 10 12:30:57 2012 +1000
>>
>> Reproduceable on qemu HEAD and by commenting out the refactored patch into a
>> function.
>>
>> How to proceed?
>>
>> Ciao,
>> Gerhard
>>
>> diff --git a/exec.c b/exec.c
>> index af94f9c..a937882 100644
>> --- a/exec.c
>> +++ b/exec.c
>> @@ -3501,7 +3501,7 @@ void cpu_physical_memory_write_rom(hwaddr addr,
>>              /* ROM/RAM case */
>>              ptr = qemu_get_ram_ptr(addr1);
>>              memcpy(ptr, buf, l);
>> -            invalidate_and_set_dirty(addr1, l);
>> +            //invalidate_and_set_dirty(addr1, l);
>>              qemu_put_ram_ptr(ptr);
>>          }
>>          len -= l;
>>
>>