From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48281) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZYqhA-0005Ib-TQ for qemu-devel@nongnu.org; Mon, 07 Sep 2015 03:18:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZYqh5-0004Yg-QN for qemu-devel@nongnu.org; Mon, 07 Sep 2015 03:18:28 -0400 Received: from 5751f4a1.skybroadband.com ([87.81.244.161]:56296 helo=dan.rpsys.net) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZYqh5-0004Xo-Fo for qemu-devel@nongnu.org; Mon, 07 Sep 2015 03:18:23 -0400 Message-ID: <1441610285.24871.241.camel@linuxfoundation.org> From: Richard Purdie Date: Mon, 07 Sep 2015 08:18:05 +0100 In-Reply-To: References: <1441362357.24871.155.camel@linuxfoundation.org> <1441365880.24871.164.camel@linuxfoundation.org> <1441370585.24871.166.camel@linuxfoundation.org> <1441387258.24871.197.camel@linuxfoundation.org> <1441549313.24871.218.camel@linuxfoundation.org> <1441581997.24871.227.camel@linuxfoundation.org> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] Segfault using qemu-system-arm in smc91c111 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Crosthwaite Cc: Peter Maydell , qemu-devel On Sun, 2015-09-06 at 17:48 -0700, Peter Crosthwaite wrote: > On Sun, Sep 6, 2015 at 4:26 PM, Richard Purdie > wrote: > > On Sun, 2015-09-06 at 11:37 -0700, Peter Crosthwaite wrote: > > I tested an assert in _recieve() which confirms it can be called when > > can_receive() says it isn't ready. > > > > A backtrace of this would be handy. This is the trace with my assert against smc91c111_can_receive(nc) being false when we're in receive(), before we allocate_packet: #0 0x00007f355f276267 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 #1 0x00007f355f277eca in __GI_abort () at abort.c:89 #2 0x00007f355f26f03d in __assert_fail_base (fmt=0x7f355f3d1028 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x7f3562158ed7 "smc91c111_can_receive(nc)", file=file@entry=0x7f3562158dc8 "/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/hw/net/smc91c111.c", line=line@entry=680, function=function@entry=0x7f35621591b0 <__PRETTY_FUNCTION__.26130> "smc91c111_receive") at assert.c:92 #3 0x00007f355f26f0f2 in __GI___assert_fail (assertion=assertion@entry=0x7f3562158ed7 "smc91c111_can_receive(nc)", file=file@entry=0x7f3562158dc8 "/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/hw/net/smc91c111.c", line=line@entry=680, function=function@entry=0x7f35621591b0 <__PRETTY_FUNCTION__.26130> "smc91c111_receive") at assert.c:101 #4 0x00007f3561fca4d0 in smc91c111_receive (nc=0x7f3563604d10, buf=0x7f353c09d028 "RT", size=1514) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/hw/net/smc91c111.c:680 #5 0x00007f356203058b in qemu_deliver_packet (sender=, flags=, data=data@entry=0x7f353c09d028 "RT", size=, opaque=0x7f3563604d10) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/net/net.c:577 #6 0x00007f3562031eaa in qemu_net_queue_deliver (size=, data=, flags=, sender=, queue=0x7f3563604e70) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/net/queue.c:157 #7 qemu_net_queue_flush (queue=0x7f3563604e70) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/net/queue.c:254 #8 0x00007f356202fc7c in qemu_flush_or_purge_queued_packets (nc=0x7f3563604d10, purge=) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/net/net.c:606 #9 0x00007f3561fcacec in smc91c111_writeb (opaque=0x7f35635178f0, offset=, value=128) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/hw/net/smc91c111.c:382 #10 0x00007f3561fcaf84 in smc91c111_writew (opaque=0x7f35635178f0, offset=0, value=128) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/hw/net/smc91c111.c:612 #11 0x00007f3561e52cc5 in memory_region_oldmmio_write_accessor (mr=, addr=, value=, size=, shift=, mask=, attrs=...) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:434 #12 0x00007f3561e5227d in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7f35572d93f8, size=size@entry=2, access_size_min=, access_size_max=, access=0x7f3561e52c90 , mr=0x7f356351bc80, attrs=...) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:506 #13 0x00007f3561e53d5b in memory_region_dispatch_write (mr=mr@entry=0x7f356351bc80, addr=0, data=128, size=size@entry=2, attrs=attrs@entry=...) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:1171 #14 0x00007f3561e1fc51 in address_space_rw (as=, addr=268500992, attrs=..., buf=buf@entry=0x7f35572d94c0 "\200", len=2, is_write=is_write@entry=true) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/exec.c:2445 #15 0x00007f3561e1fda0 in address_space_write (len=, buf=0x7f35572d94c0 "\200", attrs=..., addr=, as=) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/exec.c:2521 #16 subpage_write (opaque=, addr=, value=, len=, attrs=...) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/exec.c:2081 #17 0x00007f3561e5227d in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7f35572d9568, size=size@entry=2, access_size_min=, access_size_max=, access=0x7f3561e521a0 , mr=0x7f356375e360, attrs=...) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:506 #18 0x00007f3561e53d5b in memory_region_dispatch_write (mr=0x7f356375e360, addr=0, data=128, size=2, attrs=...) at /media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:1171 #19 0x00007f3559342734 in ?? () the rest of the stack is just ??. So some write into the smc91c111 memory triggers qemu_flush_or_purge_queued_packets() which then keeps delivering packets as far as I can tell. Do we need to check can_receive() before triggering the qemu_flush_or_purge_queued_packets() call? The code is clearly calling this in places where the driver simply isn't ready. (qemu_flush_queued_packets() == qemu_flush_or_purge_queued_packets()) Cheers, Richard