Re: Bug with Windows tap network when running qemu-system-ppc with Mac OS 9 guest

[BALATON Zoltan <balaton@eik.bme.hu>]

[-- Attachment #1: Type: text/plain, Size: 5919 bytes --]

On Fri, 26 Mar 2021, Howard Spoelstra wrote:
> On Fri, Mar 26, 2021 at 10:00 AM Bin Meng <bmeng.cn@gmail.com> wrote:
>>
>> On Fri, Mar 26, 2021 at 4:49 PM Jason Wang <jasowang@redhat.com> wrote:
>>>
>>>
>>> 在 2021/3/26 下午4:21, BALATON Zoltan 写道:
>>>> On Fri, 26 Mar 2021, Howard Spoelstra wrote:
>>>>> On Fri, Mar 26, 2021 at 2:50 AM Bin Meng <bmeng.cn@gmail.com> wrote:
>>>>>>
>>>>>> Hi Howard,
>>>>>>
>>>>>> On Fri, Mar 26, 2021 at 1:35 AM Peter Maydell
>>>>>> <peter.maydell@linaro.org> wrote:
>>>>>>>
>>>>>>> (adding the relevant people to the cc list)
>>>>>>>
>>>>>>> On Thu, 25 Mar 2021 at 17:26, Howard Spoelstra <hsp.cat7@gmail.com>
>>>>>>> wrote:
>>>>>>>>
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> When running qemu-system-ppc with Mac OS guest, the guest crashes
>>>>>>>> when
>>>>>>>> using a tap network connection. Openvpn 2.4.9-I601-win10 is installed
>>>>>>>> with TAP-Windows 9.24.2. A tap connection called TapQemu is bridged
>>>>>>>> with the default ethernet connection. It gets activated when I start
>>>>>>>> qemu.
>>>>>>>>
>>>>>>>> To reproduce, compile qemu-system-ppc from current source and run:
>>>>>>>>
>>>>>>>> qemu-system-ppc.exe ^
>>>>>>>> -L pc-bios ^
>>>>>>>> -M mac99 ^
>>>>>>>> -m 128 ^
>>>>>>>> -sdl -serial stdio ^
>>>>>>>> -boot c ^
>>>>>>>> -drive file=C:\Mac-disks\9.2.img,format=raw,media=disk ^
>>>>>>>> -device sungem,netdev=network01 -netdev
>>>>>>>> tap,ifname=TapQemu,id=network01
>>>>>>>>
>>>>>>>> I bisected to the commit below. Thanks for looking into this.
>>>>>>
>>>>>> Thanks for reporting.
>>>>>>
>>>>>> Can you please provide some further information:
>>>>>>
>>>>>> 1. Does "-net user" work on Windows?
>>>>>> 2. If running QEMU under Linux, does "-net tap" or "-net user" work?
>>>>>>
>>>>>> Regards,
>>>>>> Bin
>>>>>
>>>>> Hello Bin,
>>>>>
>>>>> Thanks for getting back to me. I forgot to mention that reverting the
>>>>> above patch restores functionality. And that other applications using
>>>>> the same tap device work correctly.
>>>>> In answer to your questions:
>>>>>
>>>>> 1. Yes, slirp works on Windows 10 with this setup.
>>>>> 2. Yes, in Linux both tap and slirp work.
>>>>>
>>>>> My Windows build is done with a fully up to date msys2 installation.
>>>>>
>>>>> I tried to debug in Windows:
>>>>> (gdb) run
>>>>> Starting program: c:\qemu-master-msys2\qemu-system-ppc.exe -L pc-bios
>>>>> -M mac99 -m 128 -sdl -serial stdio -boot c -drive
>>>>> "file=C:\Mac-disks\9.2-usb-pci-ddk.img,format=raw,media=disk" -device
>>>>> "sungem,netdev=network01" -netdev "tap,ifname=TapQemu,id=network01" -S
>>>>> [New Thread 13304.0x1f00]
>>>>> [New Thread 13304.0x2f84]
>>>>> [New Thread 13304.0x3524]
>>>>> [New Thread 13304.0x2b8c]
>>>>> [New Thread 13304.0x368c]
>>>>> [New Thread 13304.0x3668]
>>>>> [New Thread 13304.0xf4c]
>>>>> [New Thread 13304.0x49c]
>>>>> [New Thread 13304.0x1d4c]
>>>>> [New Thread 13304.0x7fc]
>>>>> [Thread 13304.0x7fc exited with code 0]
>>>>> [New Thread 13304.0x357c]
>>>>> [New Thread 13304.0x7c0]
>>>>> [New Thread 13304.0x3564]
>>>>> [New Thread 13304.0x26f4]
>>>>> [New Thread 13304.0x2f68]
>>>>>
>>>>> Program received signal SIGSEGV, Segmentation fault.
>>>>> 0x00007ffb9edea991 in ?? () from c:\qemu-master-msys2\libglib-2.0-0.dll
>>>>> (gdb) bt
>>>>> #0  0x00007ffb9edea991 in ?? () from
>>>>> c:\qemu-master-msys2\libglib-2.0-0.dll
>>>>> #1  0x000800000480bf50 in ?? ()
>>>>> Backtrace stopped: previous frame inner to this frame (corrupt stack?)
>>>>> (gdb)
>>>>>
>>>>> Even before I could attach to the process.
>>>>
>>>> If you run QEMU under gdb you don't have to attach to it but to get a
>>>> meaningful backtrace you should configure and compile QEMU with
>>>> --enable-debug (this will make it run slower so not recommended
>>>> normally but for debugging that would be needed). If the stack is
>>>> really corrupted then you may not get a useful backtrace or it may be
>>>> a problem with gdb on Windows. I've found that gdb on Windows works
>>>> for simple things but could give bad results for more complex stuff.
>>>> WinDbg may be better but it's harder to use (needs some registry
>>>> change I think to enable core dumps then you could open and analyze
>>>> core dumps with it or it should be able to run command directly but I
>>>> don't know how that works).
>>>>
>>>> Another idea: maybe you could check other threads in gdb. Not sure if
>>>> that would reveal anything but may worth a try. I think the commands
>>>> you need are "info threads" and "apply all bt" or something similar.
>>>>
>>>> Regards,
>>>> BALATON Zoltan
>>>>
>>>
>>> It looks to me the patch tires to recycle a temporary buffer to tap thread.
>>>
>>> Please try to attached fix to see it if works.
>>
>> Yep, good catch, thanks! This patch looks correct to me.
>>
>> Regards,
>> Bin
>
> Hi,
>
> While the patch applies, it will not compile:
>
> ../net/tap-win32.c: In function 'tap_win32_send':
> ../net/tap-win32.c:697:18: error: assignment to 'uint8_t' {aka
> 'unsigned char'} from 'uint8_t *' {aka 'unsigned char *'} makes
> integer from pointer without a cast [-Werror=int-conversion]
>  697 |         orig_buf = buf;
>      |                  ^
> ../net/tap-win32.c:707:42: error: passing argument 2 of
> 'tap_win32_free_buffer' makes pointer from integer without a cast
> [-Werror=int-conversion]
>  707 |         tap_win32_free_buffer(s->handle, orig_buf);
>      |                                          ^~~~~~~~
>      |                                          |
>      |                                          uint8_t {aka unsigned char}
> ../net/tap-win32.c:590:44: note: expected 'uint8_t *' {aka 'unsigned
> char *'} but argument is of type 'uint8_t' {aka 'unsigned char'}
>  590 |                                   uint8_t *pbuf)
>      |                                   ~~~~~~~~~^~~~

Patch missing a * from this line:

+    uint8_t *buf, orig_buf;

should be

+    uint8_t *buf, *orig_buf;

Regards,
BALATON Zoltan