Re: [Qemu-devel] [PATCH 0/4] slirp: Fix for requeuing crash, cleanups

[Stefan Weil <sw@weilnetz.de>]

Am 29.02.2012 22:33, schrieb Jan Kiszka:
> On 2012-02-29 22:00, Stefan Weil wrote:
>> Am 29.02.2012 20:15, schrieb Jan Kiszka:
>>> This is an alternative, more complete approach to fix the requeuing-
>>> related crashes reported recently. See patch 2 for details. The rest are
>>> simple cleanups.
>>>
>>> Please check carefully if I messed something up.
>>>
>>
>> Hi Jan,
>>
>> here is the result of MIPS Malta with your patch series applied:
>>
>> Program received signal SIGSEGV, Segmentation fault.
>> 0x000055555577db5b in slirp_remque (a=0x555556cff360) at
>> /home/stefan/src/qemu/repo.or.cz/qemu/ar7/slirp/misc.c:39
>> 39 ((struct quehead *)(element->qh_rlink))->qh_link =
>> element->qh_link;
>> (gdb) i s
>> #0 0x000055555577db5b in slirp_remque (a=0x555556cff360) at
>> /home/stefan/src/qemu/repo.or.cz/qemu/ar7/slirp/misc.c:39
>> #1 0x000055555577b7a2 in if_start (slirp=0x5555564bfb80) at
>> /home/stefan/src/qemu/repo.or.cz/qemu/ar7/slirp/if.c:208
>> #2 0x000055555577b607 in if_output (so=0x555556ea0b70,
>> ifm=0x555556cff9e0) at
>> /home/stefan/src/qemu/repo.or.cz/qemu/ar7/slirp/if.c:139
>> #3 0x000055555577d040 in ip_output (so=0x555556ea0b70,
>> m0=0x555556cff9e0) at
>> /home/stefan/src/qemu/repo.or.cz/qemu/ar7/slirp/ip_output.c:84
>> #4 0x00005555557865d6 in tcp_output (tp=0x555556ea0c20) at
>> /home/stefan/src/qemu/repo.or.cz/qemu/ar7/slirp/tcp_output.c:456
>> #5 0x000055555577ff5a in slirp_select_poll (readfds=0x7fffffffda10,
>> writefds=0x7fffffffda90, xfds=0x7fffffffdb10, select_error=0)
>> at /home/stefan/src/qemu/repo.or.cz/qemu/ar7/slirp/slirp.c:480
>> #6 0x000055555572d8c0 in main_loop_wait (nonblocking=0) at
>> /home/stefan/src/qemu/repo.or.cz/qemu/ar7/main-loop.c:469
>> #7 0x0000555555721a61 in main_loop () at
>> /home/stefan/src/qemu/repo.or.cz/qemu/ar7/vl.c:1558
>> #8 0x00005555557284a2 in main (argc=25, argv=0x7fffffffdfe8,
>> envp=0x7fffffffe0b8) at 
>> /home/stefan/src/qemu/repo.or.cz/qemu/ar7/vl.c:3667
>> (gdb) p element
>> $1 = (struct quehead *) 0x555556cff360
>> (gdb) p *element
>> $2 = {qh_link = 0x555556cff360, qh_rlink = 0x0}
>> (gdb) p (struct quehead *)(element->qh_rlink)
>> $3 = (struct quehead *) 0x0
>
> Hmm. Two options:
>
> - you try to debug what happens to that mbuf, why its queue anchors
> get corrupted (maybe while in if_encap?)
> - you tell me how to reproduce it (image file, host characteristics)
>
> Jan

I'm afraid that the first variant won't happen this or next week
because lack of time.

This is my test environment:

Debian Squeeze x86_64 host, Debian Squeeze mips guest.

I use NFS root, and the latest crash happened during boot.
All other crashes happened after the guest had booted
when I startet apt-get update, so maybe booting from a
Debian CDROM might also reproduce the crash.

I compiled QEMU with a default configuration, but used
CFLAGS=-g (no optimization) and startet QEMU like this:

gdb --args 
/home/stefan/src/qemu/repo.or.cz/qemu/ar7/bin/debug/x86/mips-softmmu/qemu-system-mips 
--kernel /tftpboot/malta/boot/vmlinux-2.6.26-2-4kc-malta --initrd 
/tftpboot/malta/boot/initrd.img-2.6.26-2-4kc-malta --append "debug 
nohz=off root=/dev/nfs rw ip=::::malta::dhcp 
nfsroot=10.0.2.2:/tftpboot/malta -bootp abc -tftp /tftpboot/malta" -M 
malta --cpu 4KEc -m 256 --net nic,model=pcnet --net user,hostname=malta 
--redir tcp:5800::5800 --redir tcp:5900::5900 --redir tcp:10022::22 
--redir tcp:10080::80

Kernel and initrd are from Debian Squeeze (mips).

I had no slirp problems with that test environment during the last two 
years.

Regards,

Stefan W.