Re: [Qemu-devel] [BUG] qemu crash when using "lsilogic"

[Avi Kivity <avi@redhat.com>]

On 11/20/2012 11:01 AM, Wanlong Gao wrote:

>> $ git bisect good
>> d22b096ef6e0b20810193b68a1d472f3fb8a4f9e is the first bad commit
>> commit d22b096ef6e0b20810193b68a1d472f3fb8a4f9e
>> Author: Avi Kivity <avi@redhat.com>
>> Date:   Sun Sep 30 22:21:11 2012 +0200
>> 
>>     kvm: use separate MemoryListeners for memory and I/O
>>     
>>     The construct
>>     
>>        if (address_space == get_system_memory()) {
>>            // memory thing
>>        } else {
>>            // io thing
>>        }
>>     
>>     fails if we have more than two address spaces.  Use a separate listener
>>     for memory and I/O, and utilize MemoryListener's address space filtering to
>>     fix this.
>>     
>>     Signed-off-by: Avi Kivity <avi@redhat.com>
>> 
>> :100644 100644 92a71374ed1e040cef5ad70a6cb00adabf671dd4 c69e01200461c7a87440f7a915bd171a9fc8f318 M	kvm-all.c
>> 
>> 
>> Ooooops, I didn't find any error in above patch, can you guys help to investigate this bug?
> 
> I confirmed again and found that "lsi" can't work on the upstream qemu.
> Any thoughts?
> 

I appears to be a bug in Seabios:

(gdb) thread 3
[Switching to thread 3 (Thread 0x7fffebfff700 (LWP 19032))]
#0  0x000055555586df2c in access_with_adjusted_size (addr=29563620,
value=0x7fffebffe5f0, size=4, access_size_min=0, access_size_max=0, access=
    0x55555586ddbb <memory_region_read_accessor>, opaque=0x55555655dd00)
at /home/tlv/akivity/qemu/memory.c:349
349	{
(gdb) bt
#0  0x000055555586df2c in access_with_adjusted_size (addr=29563620,
value=0x7fffebffe5f0, size=4, access_size_min=0, access_size_max=0, access=
    0x55555586ddbb <memory_region_read_accessor>, opaque=0x55555655dd00)
at /home/tlv/akivity/qemu/memory.c:349
#1  0x0000555555870a4e in memory_region_dispatch_read1
(mr=0x55555655dd00, addr=29563620, size=4) at
/home/tlv/akivity/qemu/memory.c:862
#2  0x0000555555870b3e in memory_region_dispatch_read
(mr=0x55555655dd00, addr=29563620, size=4) at
/home/tlv/akivity/qemu/memory.c:894
#3  0x0000555555873c2d in io_mem_read (mr=0x55555655dd00, addr=29563620,
size=4) at /home/tlv/akivity/qemu/memory.c:1575
#4  0x00005555558054ed in address_space_rw (as=0x555556629d78,
addr=29563620, buf=0x7fffebffe874 "", len=4, is_write=false) at
/home/tlv/akivity/qemu/exec.c:3428
#5  0x00005555556bf4c3 in dma_memory_rw_relaxed (dma=0x555556603cf0,
addr=29563620, buf=0x7fffebffe874, len=4, dir=DMA_DIRECTION_TO_DEVICE)
at /home/tlv/akivity/qemu/dma.h:130
#6  0x00005555556bf558 in dma_memory_rw (dma=0x555556603cf0,
addr=29563620, buf=0x7fffebffe874, len=4, dir=DMA_DIRECTION_TO_DEVICE)
at /home/tlv/akivity/qemu/dma.h:156
#7  0x00005555556bf5fb in pci_dma_rw (dev=0x555556629b60, addr=29563620,
buf=0x7fffebffe874, len=4, dir=DMA_DIRECTION_TO_DEVICE) at
/home/tlv/akivity/qemu/hw/pci.h:607
#8  0x00005555556bf65b in pci_dma_read (dev=0x555556629b60,
addr=29563620, buf=0x7fffebffe874, len=4) at
/home/tlv/akivity/qemu/hw/pci.h:614
#9  0x00005555556bfc08 in read_dword (s=0x555556629b60, addr=29563620)
at /home/tlv/akivity/qemu/hw/lsi53c895a.c:385
#10 0x00005555556c1937 in lsi_execute_script (s=0x555556629b60) at
/home/tlv/akivity/qemu/hw/lsi53c895a.c:1040
#11 0x00005555556c3c82 in lsi_reg_writeb (s=0x555556629b60, offset=47,
val=0 '\000') at /home/tlv/akivity/qemu/hw/lsi53c895a.c:1781
#12 0x00005555556c513c in lsi_io_write (opaque=0x555556629b60, addr=47,
val=0, size=1) at /home/tlv/akivity/qemu/hw/lsi53c895a.c:1953
#13 0x000055555586def2 in memory_region_write_accessor
(opaque=0x55555662a340, addr=47, value=0x7fffebffeab0, size=1, shift=0,
mask=255) at /home/tlv/akivity/qemu/memory.c:334
#14 0x000055555586dfd4 in access_with_adjusted_size (addr=47,
value=0x7fffebffeab0, size=1, access_size_min=1, access_size_max=1,
access=0x55555586de6d <memory_region_write_accessor>,
    opaque=0x55555662a340) at /home/tlv/akivity/qemu/memory.c:364
#15 0x000055555586e43c in memory_region_iorange_write
(iorange=0x7fffe4000ed0, offset=47, width=1, data=0) at
/home/tlv/akivity/qemu/memory.c:439
#16 0x0000555555866acc in ioport_writeb_thunk (opaque=0x7fffe4000ed0,
addr=49199, data=0) at /home/tlv/akivity/qemu/ioport.c:212
#17 0x00005555558664a6 in ioport_write (index=0, address=49199, data=0)
at /home/tlv/akivity/qemu/ioport.c:83
#18 0x0000555555867046 in cpu_outb (addr=49199, val=0 '\000') at
/home/tlv/akivity/qemu/ioport.c:289
#19 0x000055555586a958 in kvm_handle_io (port=49199,
data=0x7ffff7ff3000, direction=1, size=1, count=1) at
/home/tlv/akivity/qemu/kvm-all.c:1423
#20 0x000055555586af5e in kvm_cpu_exec (env=0x55555659b0b0) at
/home/tlv/akivity/qemu/kvm-all.c:1571
#21 0x00005555557f74e4 in qemu_kvm_cpu_thread_fn (arg=0x55555659b0b0) at
/home/tlv/akivity/qemu/cpus.c:757
#22 0x00007ffff6727d14 in start_thread () from /lib64/libpthread.so.0
#23 0x00007ffff533667d in clone () from /lib64/libc.so.6
(gdb) fr 4
#4  0x00005555558054ed in address_space_rw (as=0x555556629d78,
addr=29563620, buf=0x7fffebffe874 "", len=4, is_write=false) at
/home/tlv/akivity/qemu/exec.c:3428
3428	                    val = io_mem_read(section->mr, addr1, 4);
(gdb) p as.root.name
$1 = 0x55555662cc80 "bus master"
(gdb) p as.root.enabled
$2 = false

We're executing a scsi script without enabling the lsi bus master bit.

There is also a bug in the lsi code:


1038	again:
1039	    insn_processed++;
1040	    insn = read_dword(s, s->dsp);
1041	    if (!insn) {
1042	        /* If we receive an empty opcode increment the DSP by 4 bytes
1043	           instead of 8 and execute the next opcode at that location */
1044	        s->dsp += 4;
1045	        goto again;

Which causes the script interpreter to go into an infinite loop.  This
should be moved to a bottom half or thread.


-- 
error compiling committee.c: too many arguments to function