From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:56315)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <adam@os.inf.tu-dresden.de>) id 1Tr4Hn-0000Gb-Av
	for qemu-devel@nongnu.org; Fri, 04 Jan 2013 05:14:01 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <adam@os.inf.tu-dresden.de>) id 1Tr4Hj-0000eh-8w
	for qemu-devel@nongnu.org; Fri, 04 Jan 2013 05:13:59 -0500
Received: from os.inf.tu-dresden.de ([141.76.48.99]:35218)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <adam@os.inf.tu-dresden.de>) id 1Tr4Hj-0000eV-2C
	for qemu-devel@nongnu.org; Fri, 04 Jan 2013 05:13:55 -0500
Date: Fri, 4 Jan 2013 11:13:49 +0100
From: Adam Lackorzynski <adam@os.inf.tu-dresden.de>
Message-ID: <20130104101349.GD6916@os.inf.tu-dresden.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Subject: [Qemu-devel] Qemu x86 segfault
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org
Cc: Julien Grall <julien.grall@citrix.com>

Hi,

I'm seeing the following segfault of qemu-system-i386 and
qemu-system-x86_64 with master. git bisect points to
258711c6448c44b60b0fecef1d3b09c71e23e304.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xea930b70 (LWP 14297)]
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x567a1b48 in memory_region_read_accessor (opaque=opaque@entry=0x5704ab58, 
    addr=0, value=value@entry=0xea92fe10, size=size@entry=1, shift=0, mask=255)
    at qemu/memory.c:316
#2  0x567a1536 in access_with_adjusted_size (addr=<optimized out>, 
    value=value@entry=0xea92fe10, size=size@entry=1, 
    access_size_min=<optimized out>, access_size_max=<optimized out>, 
    access=access@entry=0x567a1ac0 <memory_region_read_accessor>, 
    opaque=opaque@entry=0x5704ab58) at qemu/memory.c:364
#3  0x567a288b in memory_region_iorange_read (iorange=0x57098fd0, offset=0, 
    width=1, data=0xea92fe10) at qemu/memory.c:409
#4  0x5679bc4f in ioport_readb_thunk (opaque=0x57098fd0, addr=128)
    at qemu/ioport.c:186
#5  0x5679c8a5 in ioport_read (address=128, index=0)
    at qemu/ioport.c:70
#6  cpu_inb (addr=addr@entry=128) at qemu/ioport.c:309
#7  0x567e0637 in helper_inb (port=128)
    at qemu/target-i386/misc_helper.c:77
#8  0xeee28e84 in code_gen_buffer ()
#9  0x5673e528 in cpu_x86_exec (env=env@entry=0x570077c8)
    at qemu/cpu-exec.c:599
#10 0x5674043b in tcg_cpu_exec (env=0x570077c8)
    at qemu/cpus.c:1115
#11 tcg_exec_all () at qemu/cpus.c:1148
#12 qemu_tcg_cpu_thread_fn (arg=0x57007788)
    at qemu/cpus.c:841
#13 0xf79d0c39 in start_thread (arg=0xea930b70) at pthread_create.c:304
#14 0xf793d78e in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:130
(gdb) 

With ioport logging enabled, the last few lines of qemu.log are:
inb : 03fd 60
outb: 03f9 00
inb : 03f9 00
outb: 03f9 00
inb : 03fd 60
outb: 03f8 34
inb : 03fd 60
outb: 03f9 00
inb : 03f9 00
outb: 03f9 00
inb : 03fd 60
outb: 03f8 0d
inb : 03fd 60
outb: 03f9 00
inb : 03f9 00
outb: 03f9 00
inb : 03fd 60
outb: 03f8 0a
inb : 03fd 60
outb: 03f9 00
inb : 03f9 00
outb: 03f9 00

In memory_region_read_accessor(), the function pointer mr->ops->read is
nil. Please let me know if any more info is required.


Adam
-- 
Adam                 adam@os.inf.tu-dresden.de
  Lackorzynski         http://os.inf.tu-dresden.de/~adam/