VirtualBox

Changes between Initial Version and Version 1 of Ticket #2618


Ignore:
Timestamp:
Nov 14, 2008 4:54:13 PM (15 years ago)
Author:
Frank Mehnert
Comment:

Please use {{{ and }}} next time you quote code.

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #2618 – Description

    initial v1  
    66
    77Dump of Registers:
    8 
     8{{{
    99(gdb) info registers
    10 
    11 eax            0x0      0[[BR]]
    12 
    13 ecx            0xbff5237c       -1074453636[[BR]]
    14 
    15 edx            0x4      4[[BR]]
    16 
    17 ebx            0xbff5237c       -1074453636[[BR]]
    18 
    19 esp            0xbff52320       0xbff52320[[BR]]
    20 
    21 ebp            0xbff52320       0xbff52320[[BR]]
    22 
    23 esi            0x0      0[[BR]]
    24 
    25 edi            0x4      4[[BR]]
    26 
    27 eip            0x848397 0x848397       /*** Fault instruction right here !!!! ***/[[BR]]
    28 
    29 eflags         0x246    582[[BR]]
    30 
    31 cs             0x73     115[[BR]]
    32 
    33 ss             0x7b     123[[BR]]
    34 
    35 ds             0x7b     123[[BR]]
    36 
    37 es             0x7b     123[[BR]]
    38 
    39 fs             0x0      0[[BR]]
    40 
    41 gs             0x33     51[[BR]]
    42 
    43 
    44 
     10eax            0x0      0
     11ecx            0xbff5237c       -1074453636
     12edx            0x4      4
     13ebx            0xbff5237c       -1074453636
     14esp            0xbff52320       0xbff52320
     15ebp            0xbff52320       0xbff52320
     16esi            0x0      0
     17edi            0x4      4
     18eip            0x848397 0x848397       /*** Fault instruction right here !!!! ***/
     19eflags         0x246    582
     20cs             0x73     115
     21ss             0x7b     123
     22ds             0x7b     123
     23es             0x7b     123
     24fs             0x0      0
     25gs             0x33     51
     26}}}
    4527Here is the stack trace ...
    46 
    47 
    48 (gdb) disassemble 0xcc2397[[BR]]
    49 
    50 Dump of assembler code for function __pthread_disable_asynccancel:[[BR]]
    51 
    52 0x00cc2390 <__pthread_disable_asynccancel+0>: push %ebp[[BR]]
    53 
    54 0x00cc2391 <__pthread_disable_asynccancel+1>: test $0x2,%al[[BR]]
    55 
    56 0x00cc2393 <__pthread_disable_asynccancel+3>: mov %esp,%ebp[[BR]]
    57 
    58 0x00cc2395 <__pthread_disable_asynccancel+5>: jne 0xcc23b6[[BR]]
    59 
    60 <__pthread_disable_asynccancel+38>[[BR]]
    61 
    62 0x00cc2397 <__pthread_disable_asynccancel+7>: mov %gs:0x58,%edx /*** Same fault instruction ***/[[BR]]
    63 
    64 0x00cc239e <__pthread_disable_asynccancel+14>: mov %edx,%ecx[[BR]]
    65 
    66 0x00cc23a0 <__pthread_disable_asynccancel+16>: and $0xfffffffd,%ecx[[BR]]
    67 
    68 0x00cc23a3 <__pthread_disable_asynccancel+19>: cmp %edx,%ecx[[BR]]
    69 
    70 0x00cc23a5 <__pthread_disable_asynccancel+21>: je 0xcc23b6
    71 <__pthread_disable_asynccancel+38>[[BR]]
    72 
    73 0x00cc23a7 <__pthread_disable_asynccancel+23>: mov %edx,%eax[[BR]]
    74 
    75 0x00cc23a9 <__pthread_disable_asynccancel+25>: lock cmpxchg[[BR]]
    76 
    77 
     28{{{
     29(gdb) disassemble 0xcc2397
     30Dump of assembler code for function __pthread_disable_asynccancel:
     310x00cc2390 <__pthread_disable_asynccancel+0>: push %ebp
     320x00cc2391 <__pthread_disable_asynccancel+1>: test $0x2,%al
     330x00cc2393 <__pthread_disable_asynccancel+3>: mov %esp,%ebp
     340x00cc2395 <__pthread_disable_asynccancel+5>: jne 0xcc23b6 <__pthread_disable_asynccancel+38>
     350x00cc2397 <__pthread_disable_asynccancel+7>: mov %gs:0x58,%edx /*** Same fault instruction ***/
     360x00cc239e <__pthread_disable_asynccancel+14>: mov %edx,%ecx
     370x00cc23a0 <__pthread_disable_asynccancel+16>: and $0xfffffffd,%ecx
     380x00cc23a3 <__pthread_disable_asynccancel+19>: cmp %edx,%ecx
     390x00cc23a5 <__pthread_disable_asynccancel+21>: je 0xcc23b6 <__pthread_disable_asynccancel+38>
     400x00cc23a7 <__pthread_disable_asynccancel+23>: mov %edx,%eax
     410x00cc23a9 <__pthread_disable_asynccancel+25>: lock cmpxchg
     42}}}
    7843
    7944Here is the source of the code that caused the crash. It's the THREAD_GETMEM macro which is
    8045part of the libpthreads implementation under linux ...
     46{{{
     47/* Read member of the thread descriptor directly. */
    8148
    82 /* Read member of the thread descriptor directly. */[[BR]]
    83 
    84 # define THREAD_GETMEM(descr, member) \[[BR]]
    85 
    86 ({ __typeof (descr->member) __value; \[[BR]]
    87 
    88 if (sizeof (__value) == 1) \[[BR]]
    89 
    90 asm volatile ("movb %%gs:%P2,%b0" \[[BR]]
    91 
     49# define THREAD_GETMEM(descr, member) \
     50({ __typeof (descr->member) __value; \
     51if (sizeof (__value) == 1) \
     52asm volatile ("movb %%gs:%P2,%b0" \
    9253: "=q" (__value) \
    9354: "0" (0), "i" (offsetof (struct pthread, member))); \[[BR]]
    94 
    95 else if (sizeof (__value) == 4) \[[BR]]
    96 
    97 asm volatile ("movl %%gs:%P1,%0" \[[BR]]
    98 
     55else if (sizeof (__value) == 4) \
     56asm volatile ("movl %%gs:%P1,%0" \
    9957: "=r" (__value) \
    100 : "i" (offsetof (struct pthread, member))); \[[BR]]
    101 
    102 else \[[BR]]
    103 
     58: "i" (offsetof (struct pthread, member))); \
     59else \
    10460{ \
    105 if (sizeof (__value) != Cool \[[BR]]
    106 
    107 /* There should not be any value with a size other than 1, \[[BR]]
    108 
    109 4 or 8. */ \[[BR]]
    110 
     61if (sizeof (__value) != Cool \
     62/* There should not be any value with a size other than 1, \
     634 or 8. */ \
    11164abort (); \
    11265\
    113 asm volatile ("movl %%gs:%P1,%%eax\n    " \[[BR]]
    114 
    115 "movl %%gs:%P2,%%edx" \ /*** instruction that causes fault *****/[[BR]]
    116 
    117 : "=A" (__value) \[[BR]]
    118 
    119 : "i" (offsetof (struct pthread, member)), \[[BR]]
    120 
    121 "i" (offsetof (struct pthread, member) + 4)); \[[BR]]
    122 
    123 } \[[BR]]
    124 
    125 __value; })[[BR]]
    126 
    127 
     66asm volatile ("movl %%gs:%P1,%%eax\n    " \
     67"movl %%gs:%P2,%%edx" \ /*** instruction that causes fault *****/
     68: "=A" (__value) \
     69: "i" (offsetof (struct pthread, member)), \
     70"i" (offsetof (struct pthread, member) + 4)); \
     71} \
     72__value; })
     73}}}
    12874I'm taking a guess at this, but could the lock instruction emulation cause this?

© 2023 Oracle
Contact – Privacy policy – Terms of Use