On 11/15/2010 06:09 PM, Avi Kivity wrote:
On 11/15/2010 05:49 PM, Avi Kivity wrote:
On 11/15/2010 05:41 PM, Avi Kivity wrote:
I think it's a miscompile.
out/code16.o: 1a4: 3e ds 1a5: 6c insb (%dx),%es:(%edi)
Note no 66 prefix.
It isn't, that was random crap. All the insb() code is 32-bit.
Rewriting it to use inb / stos works (jecxz ; insb; loop doesn't) so it looks like a kernel bug in insb emulation.
Turns out is was a subtle bug in the tpr optimization we do for Windows XP. The problem happens when we load the vapic option rom from the firmware config interface. With inb / movb, writing the vapic area happens in guest context, which the kernel is prepared to handle. With insb, the write happens from kvm, which is then undone on the next entry, leading to the tpr being set to a high value.
I'll fix it temporarily by clearing the vapic area from the option rom. Later I'd like to add a proper reset to kvm tpr optimization within qemu-kvm (helps when we dual boot Windows XP and some other OS).