From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LQqRp-0001Dp-JI for qemu-devel@nongnu.org; Sat, 24 Jan 2009 16:53:49 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LQqRo-0001DD-Gn for qemu-devel@nongnu.org; Sat, 24 Jan 2009 16:53:49 -0500 Received: from [199.232.76.173] (port=37530 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LQqRo-0001D0-92 for qemu-devel@nongnu.org; Sat, 24 Jan 2009 16:53:48 -0500 Received: from hall.aurel32.net ([88.191.82.174]:59047) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1LQqRn-0005qN-PH for qemu-devel@nongnu.org; Sat, 24 Jan 2009 16:53:48 -0500 Date: Sat, 24 Jan 2009 22:53:46 +0100 From: Aurelien Jarno Subject: Re: [Qemu-devel] [BUG] Regression in networking code (SIGSEGV) Message-ID: <20090124215346.GH19498@hall.aurel32.net> References: <497790E0.7050905@mail.berlios.de> <20090122073800.GK27675@redhat.com> <497B8171.5040409@mail.berlios.de> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-15 Content-Disposition: inline In-Reply-To: <497B8171.5040409@mail.berlios.de> Sender: Aurelien Jarno Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Weil Cc: qemu-devel@nongnu.org On Sat, Jan 24, 2009 at 10:00:33PM +0100, Stefan Weil wrote: > Gleb Natapov schrieb: > > On Wed, Jan 21, 2009 at 10:17:20PM +0100, Stefan Weil wrote: > > > >> Hi, > >> > >> the SIGSEGV crash below can be reproduced with Qemu r6391 and "high" net > >> load. > >> > >> I bootet a mips malta kernel from a debian nfs root. While this worked fine, > >> aptitude update hangs during downloads, nfs root is lost and after some time > >> Qemu gets a SIGSEGV. > >> > >> A similar crash occurs with a different mips machine (ar7) and different > >> network hardware (ar7 emac / cpmac), so it is not restricted to pcnet. > >> This second system does not survive the network boot. > >> > >> Up to now, I could not run tests with non-mips systems. > >> > >> I'm fairly sure that 2 weeks ago networking worked without problems in both > >> cases. > >> > >> > > What is your host CPU? How you run qemu (what is your command line)? > > > > Debian amd64 host. > > mipsel-softmmu/qemu-system-mipsel --kernel vmlinux \ > --append "debug nohz=off root=/dev/nfs rw ip=::::malta-le::dhcp" \ > -M malta --net nic --net user -m 256 The fact that your host system is 64-bit and you are using the user networking is interesting. You could try to look at revisions 6272 and 6288, they are probably the cause of your problem. > The target system is Debian mips. > > Regards > Stefan > > >> Program received signal SIGSEGV, Segmentation fault. > >> [Switching to Thread 0x7f3be89386e0 (LWP 14845)] > >> 0x00000000004d1a6f in ip_reass (ip=0xfe96e0, fp=0x1109050) at > >> ~/src/qemu/trunk/slirp/ip_input.c:408 > >> 408 ip->ip_len = next; > >> (gdb) i s > >> #0 0x00000000004d1a6f in ip_reass (ip=0xfe96e0, fp=0x1109050) at > >> ~/src/qemu/trunk/slirp/ip_input.c:408 > >> #1 0x00000000004d15ad in ip_input (m=0x110e010) at > >> ~/src/qemu/trunk/slirp/ip_input.c:228 > >> #2 0x00000000004b3d25 in slirp_input (pkt=0x12fcbd0 "RT", pkt_len=1294) > >> at ~/src/qemu/trunk/slirp/slirp.c:679 > >> #3 0x000000000049a07d in qemu_send_packet (vc1=0x10ff440, buf=0x12fcbd0 > >> "RT", size=1294) at ~/src/qemu/trunk/net.c:399 > >> #4 0x000000000042ea6a in pcnet_transmit (s=0x12fc810) at > >> ~/src/qemu/trunk/hw/pcnet.c:1300 > >> #5 0x000000000042ebd8 in pcnet_poll_timer (opaque= >> out>) at ~/src/qemu/trunk/hw/pcnet.c:1363 > >> #6 0x000000000042f270 in pcnet_ioport_writew (opaque=0x7f3be72a79e0, > >> addr=17884784, val=16684768) > >> at ~/src/qemu/trunk/hw/pcnet.c:1645 > >> #7 0x0000000000405eb8 in ioport_write (index=1, address=4146, data=0) > >> at ~/src/qemu/trunk/vl.c:302 > >> #8 0x00000000004062b5 in cpu_outw (env=0x0, addr=4146, val=0) at > >> ~/src/qemu/trunk/vl.c:432 > >> #9 0x00000000420ae755 in ?? () > >> #10 0x0000000000000000 in ?? () > >> (gdb) up > >> #1 0x00000000004d15ad in ip_input (m=0x110e010) at > >> ~/src/qemu/trunk/slirp/ip_input.c:228 > >> 228 ip = ip_reass(ip, fp); > >> (gdb) p ip > >> $1 = (struct ip *) 0x110e060 > >> (gdb) do > >> #0 0x00000000004d1a6f in ip_reass (ip=0xfe96e0, fp=0x1109050) at > >> ~/src/qemu/trunk/slirp/ip_input.c:408 > >> 408 ip->ip_len = next; > >> (gdb) p *ip > >> Cannot access memory at address 0xfe96e0 > >> > >> > >> > >> > > > > -- > > Gleb. > > > > > -- Aurelien Jarno GPG: 1024D/F1BCDB73 aurelien@aurel32.net http://www.aurel32.net