[Qemu-devel] qemu-ppc fails to run clone with CLONE_VM, threaded programs, non-static programs

[Qemu-devel] qemu-ppc fails to run clone with CLONE_VM, threaded programs, non-static programs

[Josh Triplett]

[-- Attachment #1.1: Type: text/plain, Size: 1817 bytes --]

Hello,

I'm attempting to run cross-compiled programs with qemu-ppc.  Basic
statically-linked programs work perfectly.  However, if I attempt to run
non-static programs or threaded programs, or if I attempt to call
clone() with the CLONE_VM flag set, I get an invalid data memory access.

Threaded programs get an error when calling pthread_create, with an
invalid data memory access at 0x00000018.  A simple test program using
clone with CLONE_VM gets an invalid data memory access at 0x00000008.
Non-static programs get an invalid data memory access at various
addresses around 0x0de00000, before ever reaching main().

I've attached the test program I used to test clone(), as it seems to be
the simplest test case which fails.  I'd be happy to help with debugging
this problem; if you need any more information or you'd like me to run
additional tests, please let me know.

I've tested both the Debian-packaged qemu-7.0 and an unmodified
qemu-0.7.2 from qemu.org ; with the latter, all of the above tests still
fail, but I get a few more error messages along the lines of "Invalid
segfault errno (a000000)" and "qemu: uncaught target signal 11
(Segmentation fault) - exiting".  In addition, when I run the
hello-clone program under qemu-7.2, the parent also experiences an
"invalid data memory access" error and segfaults, whereas with 7.0 the
parent ran fine and only the child had an "invalid data memory access"
error and segfault.

Some background: I'm a member of the Portland State Aerospace Society,
and we're in the process of switching our rocket's flight computer
(which runs Debian GNU/Linux) over to PowerPC. I'm attempting to get our
flight-control software to run under qemu-ppc so that I can test it
under simulation; the flight-control software currently makes use of
pthreads.

- Josh Triplett



[-- Attachment #1.2: hello-clone.c --]
[-- Type: text/x-csrc, Size: 706 bytes --]

#include <sched.h>
#include <signal.h>
#include <stdio.h>
#include <sys/types.h>

/* int i = 0; */

int thread_main(void *arg)
{
    printf("child: Hello world!\n");
    while(1) /* i++ */;
    return 0;
}

unsigned long stack[8192];

int main()
{
    int pid;

    printf("About to clone: thread_main=%p\n", thread_main);

    pid = clone(thread_main, stack+4096, CLONE_VM, NULL);

    if(pid == -1)
    {
        perror("clone");
        return 1;
    }

    printf("parent: clone successful; child pid is %d\n", pid);
    printf("parent: sleeping a bit\n");

    sleep(2);

/*    printf("parent: value is %d\n", i); */
    printf("parent: killing process\n");

    kill(pid, SIGTERM);

    return 0;
}


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 251 bytes --]

[Qemu-devel] Re: qemu-ppc fails to run clone with CLONE_VM, threaded programs, non-static programs

[Josh Triplett]

[-- Attachment #1.1: Type: text/plain, Size: 1096 bytes --]

Josh Triplett wrote:
> I'm attempting to run cross-compiled programs with qemu-ppc.  Basic
> statically-linked programs work perfectly.  However, if I attempt to run
> non-static programs or threaded programs, or if I attempt to call
> clone() with the CLONE_VM flag set, I get an invalid data memory access.
> 
> Threaded programs get an error when calling pthread_create, with an
> invalid data memory access at 0x00000018.  A simple test program using
> clone with CLONE_VM gets an invalid data memory access at 0x00000008.
> Non-static programs get an invalid data memory access at various
> addresses around 0x0de00000, before ever reaching main().

I worked with pbrook on #qemu to debug this issue.  The problem turns
out to be that qemu's do_fork function on PowerPC zeroes out r7-r31 in
the new CPU state structure after a clone, which it should not do, as
the child's registers should match the parent; it also does not zero
register r3, which holds the return value and should be zero in the
child.  I've prepared and attached a patch which should solve this problem.

- Josh Triplett

[-- Attachment #1.2: qemu-powerpc-clone.patch --]
[-- Type: text/x-patch, Size: 536 bytes --]

diff -Naur qemu-0.7.0.orig/linux-user/syscall.c qemu-0.7.0/linux-user/syscall.c
--- qemu-0.7.0.orig/linux-user/syscall.c	2005-10-21 19:56:04.000000000 -0700
+++ qemu-0.7.0/linux-user/syscall.c	2005-10-21 20:02:20.000000000 -0700
@@ -1560,11 +1560,7 @@
         if (!newsp)
             newsp = env->gpr[1];
         new_env->gpr[1] = newsp;
-        { 
-            int i;
-            for (i = 7; i < 32; i++)
-                new_env->gpr[i] = 0;
-        }
+        new_env->gpr[3] = 0;
 #else
 #error unsupported target CPU
 #endif

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 251 bytes --]

Re: [Qemu-devel] Re: qemu-ppc fails to run clone with CLONE_VM, threaded programs, non-static programs

[Mulyadi Santosa]

Hello...

> I worked with pbrook on #qemu to debug this issue.  The problem turns
> out to be that qemu's do_fork function on PowerPC zeroes out r7-r31
> in the new CPU state structure after a clone, which it should not do,

Josh....at least it proves (to me) that the parameters passed to the 
clone() is correct. About the registers....well, this is completely new 
for me.

I wonder, what is the function of those registers (r7-r31)? Something 
related with the segments?

> as the child's registers should match the parent; it also does not
> zero register r3, which holds the return value and should be zero in
> the child.  I've prepared and attached a patch which should solve
> this problem.

Nice...this is something we surely forgot from out last attempt to debug 
the problem....return value. I was too focused on checking every memory 
accesses were done inside process address space and function address 
translation were done correctly :)

Anyway, just a personal suggestion. You can put that patch to 
qemu.dad-answers.com along with the description on how you found the 
bug and what this patch does.

regards

Mulyadi

Re: [Qemu-devel] Re: qemu-ppc fails to run clone with CLONE_VM, threaded programs, non-static programs

[Josh Triplett]

[-- Attachment #1: Type: text/plain, Size: 1589 bytes --]

Mulyadi Santosa wrote:
> Hello...

Hi.

>>I worked with pbrook on #qemu to debug this issue.  The problem turns
>>out to be that qemu's do_fork function on PowerPC zeroes out r7-r31
>>in the new CPU state structure after a clone, which it should not do,
> 
> Josh....at least it proves (to me) that the parameters passed to the 
> clone() is correct. About the registers....well, this is completely new 
> for me.
> 
> I wonder, what is the function of those registers (r7-r31)? Something 
> related with the segments?

They are general-purpose registers, mostly used for whatever the process
wants to use them for.  Zeroing them out from under the child process is
a Bad Thing, and is the reason for the bad memory access at a near-zero
address.

>>as the child's registers should match the parent; it also does not
>>zero register r3, which holds the return value and should be zero in
>>the child.  I've prepared and attached a patch which should solve
>>this problem.
> 
> Nice...this is something we surely forgot from out last attempt to debug 
> the problem....return value. I was too focused on checking every memory 
> accesses were done inside process address space and function address 
> translation were done correctly :)

Well, there were actually two problems here: the return value and the
bad memory access.

> Anyway, just a personal suggestion. You can put that patch to 
> qemu.dad-answers.com along with the description on how you found the 
> bug and what this patch does.

I could post on that forum a link to my previous mail, if that would help.

- Josh Triplett


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 251 bytes --]