Re: Bug in x86 instruction emulator?

[wogiz@openmailbox.org]

[-- Attachment #1: Type: text/plain, Size: 1510 bytes --]

On 2016-04-06 10:55, Andrew Cooper wrote:
> On 06/04/16 00:57, Mihai Donțu wrote:
>> On Wed, 06 Apr 2016 01:38:32 +0200 wogiz@openmailbox.org wrote:
>>> I'm running Xen 4.6.1 with Alpine Linux 3.3.3 in dom0. In a HVM domU
>>> with vga="qxl", Xorg will segfault instantly if tried started. 
>>> Multiple
>>> Linux distros have been tested and Xorg segfaults in all.
>>> 
>>> Attached are a full backtrace from domU generated by Xorg, and a
>>> assembler dump of function 'sse2_blt'.
>>> 
>>> According to Xen IRC channel, the cause could be a bug in the x86
>>> instruction emulator related to SSE.
>> I don't believe the x86 emulator is complete wrt the SSE instruction
>> set. But I do wonder why, in your case, these instructions need
>> emulation at all. Unless touching the video RAM requires emulation. 
>> Can
>> you try using a different video driver? I see xorg picked up qxl, 
>> maybe
>> try vesa?
>> 
> 
> Now I think about it, even dirty VRAM tracking shouldn't actually
> emulate the instructions.
> 
> Can you grab the full register state at the point of Xorgs crash?  
> `info
> regs` in gdb?
> 
> The instruction in use, `movaps` is specified to fault if the memory
> operand isn't aligned on a 16byte boundary.  Therefore, if %rax in this
> case isn't a multiple of 16, this is a code generation bug, rather than
> an emulation bug.
> 
> ~Andrew

Attached is the full register state.

I'm very interested in getting to the bottom of this, so please let me 
know if I can do anything to help.

[-- Attachment #2: register-state.txt --]
[-- Type: text/plain, Size: 800 bytes --]

(gdb) info registers 
rax            0xf1fe000001e000	68114745340846080
rbx            0x9	9
rcx            0xfffffc00	4294966272
rdx            0x222222	2236962
rsi            0x7fc650541000	140489727938560
rdi            0x7fc65b3ee420	140489911100448
rbp            0x16	0x16
rsp            0x7ffcad040b58	0x7ffcad040b58
r8             0x400	1024
r9             0x20	32
r10            0x20	32
r11            0x9	9
r12            0x4	4
r13            0xffffffff	4294967295
r14            0x55dff82d8820	94420429801504
r15            0x55dff82d80c0	94420429799616
rip            0x7fc65c3d5626	0x7fc65c3d5626 <sse2_blt+1159>
eflags         0x13206	[ PF IF #12 #13 RF ]
cs             0x33	51
ss             0x2b	43
ds             0x0	0
es             0x0	0
fs             0x0	0
gs             0x0	0

[-- Attachment #3: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel