[Qemu-devel] [Bug 1065232] [NEW] qemu-system-arm Crashes on startup on OS X 10.8.2

[Qemu-devel] [Bug 1065232] [NEW] qemu-system-arm Crashes on startup on OS X 10.8.2

[Oliver]

Public bug reported:

On startup qemu-system-arm crashes on this line 9373 of target-arm

        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
                if (bp->pc == dc->pc) {  // <-- CRASH !!!!
                    gen_exception_insn(dc, 0, EXCP_DEBUG);
                    /* Advance PC so that clearing the breakpoint will
                       invalidate this TB.  */
                    dc->pc += 2;
                    goto done_generating;
                    break;
                }
            }

What appears to be happening is env is 
(gdb) print env->breakpoints
$4 = {
  tqh_first = 0x1f001f001f001f, 
  tqh_last = 0x1f001f001f001f
}

which leads to bp being set to
(gdb) print bp
$1 = (CPUBreakpoint *) 0x1f001f001f001f

This looks like a bad address and causes the following statement

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: 13 at address: 0x0000000000000000

I am wondering if the env structure is not getting setup correctly?

I am running the 1.2.0 version of qemu on
Darwin localhost 12.2.0 Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64 x86_64

** Affects: qemu
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1065232

Title:
  qemu-system-arm Crashes on startup on OS X 10.8.2

Status in QEMU:
  New

Bug description:
  On startup qemu-system-arm crashes on this line 9373 of target-arm

          if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
              QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
                  if (bp->pc == dc->pc) {  // <-- CRASH !!!!
                      gen_exception_insn(dc, 0, EXCP_DEBUG);
                      /* Advance PC so that clearing the breakpoint will
                         invalidate this TB.  */
                      dc->pc += 2;
                      goto done_generating;
                      break;
                  }
              }

  What appears to be happening is env is 
  (gdb) print env->breakpoints
  $4 = {
    tqh_first = 0x1f001f001f001f, 
    tqh_last = 0x1f001f001f001f
  }

  which leads to bp being set to
  (gdb) print bp
  $1 = (CPUBreakpoint *) 0x1f001f001f001f

  This looks like a bad address and causes the following statement

  Program received signal EXC_BAD_ACCESS, Could not access memory.
  Reason: 13 at address: 0x0000000000000000

  I am wondering if the env structure is not getting setup correctly?

  I am running the 1.2.0 version of qemu on
  Darwin localhost 12.2.0 Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64 x86_64

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1065232/+subscriptions

[Qemu-devel] [Bug 1065232] Re: qemu-system-arm Crashes on startup on OS X 10.8.2

[Oliver]

It appears that the problem might be the value of env has changed.

All the values in env look bad and when I run

(gdb) print env
$12 = (CPUARMState *) 0x102064680

It appears env has moved.  If I dump the memory at the old env location

(gdb) print *(CPUARMState *) 0x102064038

stuff looks pretty reasonable.  Not sure why env would be moving?

Oliver

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1065232

Title:
  qemu-system-arm Crashes on startup on OS X 10.8.2

Status in QEMU:
  New

Bug description:
  On startup qemu-system-arm crashes on this line 9373 of target-arm

          if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
              QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
                  if (bp->pc == dc->pc) {  // <-- CRASH !!!!
                      gen_exception_insn(dc, 0, EXCP_DEBUG);
                      /* Advance PC so that clearing the breakpoint will
                         invalidate this TB.  */
                      dc->pc += 2;
                      goto done_generating;
                      break;
                  }
              }

  What appears to be happening is env is 
  (gdb) print env->breakpoints
  $4 = {
    tqh_first = 0x1f001f001f001f, 
    tqh_last = 0x1f001f001f001f
  }

  which leads to bp being set to
  (gdb) print bp
  $1 = (CPUBreakpoint *) 0x1f001f001f001f

  This looks like a bad address and causes the following statement

  Program received signal EXC_BAD_ACCESS, Could not access memory.
  Reason: 13 at address: 0x0000000000000000

  I am wondering if the env structure is not getting setup correctly?

  I am running the 1.2.0 version of qemu on
  Darwin localhost 12.2.0 Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64 x86_64

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1065232/+subscriptions

[Qemu-devel] [Bug 1065232] Re: qemu-system-arm Crashes on startup on OS X 10.8.2

[Oliver]

One more comment, the env address looks wrong going all the way up the
stack

#0  0x0000000100436b71 in gen_intermediate_code_internal (env=0x102064680, tb=0x108e5b070, search_pc=1) at translate.c:9793
#1  0x0000000100437776 in gen_intermediate_code_pc (env=0x102064680, tb=0x108e5b070) at translate.c:9961
#2  0x000000010044539f in cpu_restore_state (tb=0x108e5b070, env=0x102064680, searched_pc=4410683708) at translate-all.c:126
#3  0x00000001003ed7b3 in tlb_fill (env1=0x102064680, addr=17328, is_write=0, mmu_idx=0, retaddr=4410683708) at op_helper.c:93
#4  0x00000001003ec14d in __ldl_mmu (addr=17328, mmu_idx=0) at softmmu_template.h:159
#5  0x0000000106e5b13d in ?? ()

Olvier

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1065232

Title:
  qemu-system-arm Crashes on startup on OS X 10.8.2

Status in QEMU:
  New

Bug description:
  On startup qemu-system-arm crashes on this line 9373 of target-arm

          if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
              QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
                  if (bp->pc == dc->pc) {  // <-- CRASH !!!!
                      gen_exception_insn(dc, 0, EXCP_DEBUG);
                      /* Advance PC so that clearing the breakpoint will
                         invalidate this TB.  */
                      dc->pc += 2;
                      goto done_generating;
                      break;
                  }
              }

  What appears to be happening is env is 
  (gdb) print env->breakpoints
  $4 = {
    tqh_first = 0x1f001f001f001f, 
    tqh_last = 0x1f001f001f001f
  }

  which leads to bp being set to
  (gdb) print bp
  $1 = (CPUBreakpoint *) 0x1f001f001f001f

  This looks like a bad address and causes the following statement

  Program received signal EXC_BAD_ACCESS, Could not access memory.
  Reason: 13 at address: 0x0000000000000000

  I am wondering if the env structure is not getting setup correctly?

  I am running the 1.2.0 version of qemu on
  Darwin localhost 12.2.0 Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64 x86_64

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1065232/+subscriptions

[Qemu-devel] [Bug 1065232] Re: qemu-system-arm Crashes on startup on OS X 10.8.2

[Oliver]

OK one more comment.  When I look at register r14, where the env
valuable should be stored, I see the "correct" value

(gdb) info register r14
r14            0x102064038	4328931384

Oliver

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1065232

Title:
  qemu-system-arm Crashes on startup on OS X 10.8.2

Status in QEMU:
  New

Bug description:
  On startup qemu-system-arm crashes on this line 9373 of target-arm

          if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
              QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
                  if (bp->pc == dc->pc) {  // <-- CRASH !!!!
                      gen_exception_insn(dc, 0, EXCP_DEBUG);
                      /* Advance PC so that clearing the breakpoint will
                         invalidate this TB.  */
                      dc->pc += 2;
                      goto done_generating;
                      break;
                  }
              }

  What appears to be happening is env is 
  (gdb) print env->breakpoints
  $4 = {
    tqh_first = 0x1f001f001f001f, 
    tqh_last = 0x1f001f001f001f
  }

  which leads to bp being set to
  (gdb) print bp
  $1 = (CPUBreakpoint *) 0x1f001f001f001f

  This looks like a bad address and causes the following statement

  Program received signal EXC_BAD_ACCESS, Could not access memory.
  Reason: 13 at address: 0x0000000000000000

  I am wondering if the env structure is not getting setup correctly?

  I am running the 1.2.0 version of qemu on
  Darwin localhost 12.2.0 Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64 x86_64

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1065232/+subscriptions

[Qemu-devel] [Bug 1065232] Re: qemu-system-arm Crashes on startup on OS X 10.8.2

[Peter Maydell]

Thanks for this bug report; it would be helpful if you could let us know
the following info:

(1) Are you running qemu built directly from the upstream sources, or have you built this from the versions shipped by fink or similar package management system?
(2) can you give the full configure line you used to build this?
(3) which compiler (including which version) did you use?

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1065232

Title:
  qemu-system-arm Crashes on startup on OS X 10.8.2

Status in QEMU:
  New

Bug description:
  On startup qemu-system-arm crashes on this line 9373 of target-arm

          if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
              QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
                  if (bp->pc == dc->pc) {  // <-- CRASH !!!!
                      gen_exception_insn(dc, 0, EXCP_DEBUG);
                      /* Advance PC so that clearing the breakpoint will
                         invalidate this TB.  */
                      dc->pc += 2;
                      goto done_generating;
                      break;
                  }
              }

  What appears to be happening is env is 
  (gdb) print env->breakpoints
  $4 = {
    tqh_first = 0x1f001f001f001f, 
    tqh_last = 0x1f001f001f001f
  }

  which leads to bp being set to
  (gdb) print bp
  $1 = (CPUBreakpoint *) 0x1f001f001f001f

  This looks like a bad address and causes the following statement

  Program received signal EXC_BAD_ACCESS, Could not access memory.
  Reason: 13 at address: 0x0000000000000000

  I am wondering if the env structure is not getting setup correctly?

  I am running the 1.2.0 version of qemu on
  Darwin localhost 12.2.0 Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64 x86_64

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1065232/+subscriptions

[Qemu-devel] [Bug 1065232] Re: qemu-system-arm Crashes on startup on OS X 10.8.2

[Oliver]

Peter,

I built in from the zipped tar ball for qemu-1.2.0  I did not get it
from the repository, although I am happy to do this for you.

I used

./configure

This what configure said
Silently falling back into gthread backend under darwin
....
C compiler        gcc
Host C compiler   gcc
Objective-C compiler clang
CFLAGS            -O2 -D_FORTIFY_SOURCE=2 -g 
QEMU_CFLAGS       -m64 -DOS_OBJECT_USE_OBJC=0 -arch x86_64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing  -fstack-protector-all -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wold-style-definition -I/opt/local/include/libpng15  
LDFLAGS           -m64 -framework CoreFoundation -framework IOKit -arch x86_64 

My gcc appears to be

localhost:qemu-1.2.0 oliverks$ gcc -v
Using built-in specs.
Target: i686-apple-darwin11
Configured with: /private/var/tmp/llvmgcc42/llvmgcc42-2336.11~28/src/configure --disable-checking --enable-werror --prefix=/Applications/Xcode.app/Contents/Developer/usr/llvm-gcc-4.2 --mandir=/share/man --enable-languages=c,objc,c++,obj-c++ --program-prefix=llvm- --program-transform-name=/^[cg][^.-]*$/s/$/-4.2/ --with-slibdir=/usr/lib --build=i686-apple-darwin11 --enable-llvm=/private/var/tmp/llvmgcc42/llvmgcc42-2336.11~28/dst-llvmCore/Developer/usr/local --program-prefix=i686-apple-darwin11- --host=x86_64-apple-darwin11 --target=i686-apple-darwin11 --with-gxx-include-dir=/usr/include/c++/4.2.1
Thread model: posix
gcc version 4.2.1 (Based on Apple Inc. build 5658) (LLVM build 2336.11.00)

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1065232

Title:
  qemu-system-arm Crashes on startup on OS X 10.8.2

Status in QEMU:
  New

Bug description:
  On startup qemu-system-arm crashes on this line 9373 of target-arm

          if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
              QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
                  if (bp->pc == dc->pc) {  // <-- CRASH !!!!
                      gen_exception_insn(dc, 0, EXCP_DEBUG);
                      /* Advance PC so that clearing the breakpoint will
                         invalidate this TB.  */
                      dc->pc += 2;
                      goto done_generating;
                      break;
                  }
              }

  What appears to be happening is env is 
  (gdb) print env->breakpoints
  $4 = {
    tqh_first = 0x1f001f001f001f, 
    tqh_last = 0x1f001f001f001f
  }

  which leads to bp being set to
  (gdb) print bp
  $1 = (CPUBreakpoint *) 0x1f001f001f001f

  This looks like a bad address and causes the following statement

  Program received signal EXC_BAD_ACCESS, Could not access memory.
  Reason: 13 at address: 0x0000000000000000

  I am wondering if the env structure is not getting setup correctly?

  I am running the 1.2.0 version of qemu on
  Darwin localhost 12.2.0 Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64 x86_64

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1065232/+subscriptions

[Qemu-devel] [Bug 1065232] Re: qemu-system-arm Crashes on startup on OS X 10.8.2

[Peter Maydell]

Thanks. QEMU 1.2 (or earlier) won't work when built with a gcc which is
really an llvm-gcc, because llvm-gcc doesn't support the "tie this
variable to a specific native register" which QEMU requires. (I had
hoped it would give a compile failure, but it seems to just generate
wrong code.) We've actually been able to remove the fixed-register
requirement in QEMU's master git tree, but those changes have not yet
made it into a released version. So for now, I'm afraid you have three
choices:

 (1) compile with a real gcc (not llvm-gcc or clang)
 (2) build QEMU from git master (this is living on the "bleeding edge" but it generally works OK)
 (3) wait for 1.3

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1065232

Title:
  qemu-system-arm Crashes on startup on OS X 10.8.2

Status in QEMU:
  New

Bug description:
  On startup qemu-system-arm crashes on this line 9373 of target-arm

          if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
              QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
                  if (bp->pc == dc->pc) {  // <-- CRASH !!!!
                      gen_exception_insn(dc, 0, EXCP_DEBUG);
                      /* Advance PC so that clearing the breakpoint will
                         invalidate this TB.  */
                      dc->pc += 2;
                      goto done_generating;
                      break;
                  }
              }

  What appears to be happening is env is 
  (gdb) print env->breakpoints
  $4 = {
    tqh_first = 0x1f001f001f001f, 
    tqh_last = 0x1f001f001f001f
  }

  which leads to bp being set to
  (gdb) print bp
  $1 = (CPUBreakpoint *) 0x1f001f001f001f

  This looks like a bad address and causes the following statement

  Program received signal EXC_BAD_ACCESS, Could not access memory.
  Reason: 13 at address: 0x0000000000000000

  I am wondering if the env structure is not getting setup correctly?

  I am running the 1.2.0 version of qemu on
  Darwin localhost 12.2.0 Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64 x86_64

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1065232/+subscriptions

[Qemu-devel] [Bug 1065232] Re: qemu-system-arm Crashes on startup on OS X 10.8.2

[Oliver]

All right that makes sense.  I pulled the latest version from git, but I
get a build error, so I will post a new bug.

I will let you decided how you want to mark this bug.

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1065232

Title:
  qemu-system-arm Crashes on startup on OS X 10.8.2

Status in QEMU:
  New

Bug description:
  On startup qemu-system-arm crashes on this line 9373 of target-arm

          if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
              QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
                  if (bp->pc == dc->pc) {  // <-- CRASH !!!!
                      gen_exception_insn(dc, 0, EXCP_DEBUG);
                      /* Advance PC so that clearing the breakpoint will
                         invalidate this TB.  */
                      dc->pc += 2;
                      goto done_generating;
                      break;
                  }
              }

  What appears to be happening is env is 
  (gdb) print env->breakpoints
  $4 = {
    tqh_first = 0x1f001f001f001f, 
    tqh_last = 0x1f001f001f001f
  }

  which leads to bp being set to
  (gdb) print bp
  $1 = (CPUBreakpoint *) 0x1f001f001f001f

  This looks like a bad address and causes the following statement

  Program received signal EXC_BAD_ACCESS, Could not access memory.
  Reason: 13 at address: 0x0000000000000000

  I am wondering if the env structure is not getting setup correctly?

  I am running the 1.2.0 version of qemu on
  Darwin localhost 12.2.0 Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64 x86_64

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1065232/+subscriptions

[Qemu-devel] [Bug 1065232] Re: qemu-system-arm Crashes on startup on OS X 10.8.2

[Paolo Bonzini]

** Changed in: qemu
       Status: New => Invalid

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1065232

Title:
  qemu-system-arm Crashes on startup on OS X 10.8.2

Status in QEMU:
  Invalid

Bug description:
  On startup qemu-system-arm crashes on this line 9373 of target-arm

          if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
              QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
                  if (bp->pc == dc->pc) {  // <-- CRASH !!!!
                      gen_exception_insn(dc, 0, EXCP_DEBUG);
                      /* Advance PC so that clearing the breakpoint will
                         invalidate this TB.  */
                      dc->pc += 2;
                      goto done_generating;
                      break;
                  }
              }

  What appears to be happening is env is 
  (gdb) print env->breakpoints
  $4 = {
    tqh_first = 0x1f001f001f001f, 
    tqh_last = 0x1f001f001f001f
  }

  which leads to bp being set to
  (gdb) print bp
  $1 = (CPUBreakpoint *) 0x1f001f001f001f

  This looks like a bad address and causes the following statement

  Program received signal EXC_BAD_ACCESS, Could not access memory.
  Reason: 13 at address: 0x0000000000000000

  I am wondering if the env structure is not getting setup correctly?

  I am running the 1.2.0 version of qemu on
  Darwin localhost 12.2.0 Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64 x86_64

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1065232/+subscriptions