[Qemu-devel] Strange qdev related crash (m48t59 ISA qdev conversion)

[Qemu-devel] Strange qdev related crash (m48t59 ISA qdev conversion)

[Blue Swirl]

[-- Attachment #1: Type: text/plain, Size: 1569 bytes --]

Hi,

I get a strange crash when trying to add an ISA bus version of m48t59:
gdb --args ./obj-amd64/sparc-softmmu/qemu-system-sparc -L pc-bios
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu"...
(gdb) r
[Thread debugging using libthread_db enabled]
[New Thread 0x7fbc7a7b9700 (LWP 10616)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fbc7a7b9700 (LWP 10616)]
0x000000000047c1ac in qdev_create (bus=0xf3b770, name=0x578e80 "m48t59")
    at /src/qemu/hw/qdev.c:102
102         qdev_prop_set_defaults(dev, dev->parent_bus->info->props);
(gdb) p dev->parent_bus
$1 = (BusState *) 0xffffffff00000000
(gdb) p bus
$2 = (BusState *) 0x26da770
(gdb) l
97
98          dev = qemu_mallocz(info->size);
99          dev->info = info;
100         dev->parent_bus = bus;
101         qdev_prop_set_defaults(dev, dev->info->props);
102         qdev_prop_set_defaults(dev, dev->parent_bus->info->props);
103         qdev_prop_set_compat(dev);
104         QLIST_INSERT_HEAD(&bus->children, dev, sibling);
105         return dev;
106     }

Line 100 should make sure that dev->parent_bus is OK. Note that the
patch should not affect the SysBus version used by Sparc32 very much.
Recompiling qdev.c with CFLAGS=-g does not change anything.

[-- Attachment #2: 0001-Add-an-ISA-bus-version-of-m48t59.patch --]
[-- Type: application/mbox, Size: 5855 bytes --]

Re: [Qemu-devel] Strange qdev related crash (m48t59 ISA qdev conversion)

[Gerd Hoffmann]

[-- Attachment #1: Type: text/plain, Size: 167 bytes --]

   Hi,

> (gdb) p dev->parent_bus
> $1 = (BusState *) 0xffffffff00000000
> (gdb) p bus
> $2 = (BusState *) 0x26da770

Property definitions are wrong.

cheers,
   Gerd

[-- Attachment #2: 0001-fix.patch --]
[-- Type: text/plain, Size: 1637 bytes --]

From 87c75662fb5b07c9384662a360a4bc394f9da42d Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Mon, 14 Sep 2009 11:26:40 +0200
Subject: [PATCH] fix

---
 hw/m48t59.c |   12 ++++++------
 1 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/m48t59.c b/hw/m48t59.c
index a7cfb2f..b9892cc 100644
--- a/hw/m48t59.c
+++ b/hw/m48t59.c
@@ -719,9 +719,9 @@ static ISADeviceInfo m48t59_isa_info = {
     .qdev.size = sizeof(M48t59ISAState),
     .qdev.no_user = 1,
     .qdev.props = (Property[]) {
-        DEFINE_PROP_UINT32("size",    m48t59_t, size,    -1),
-        DEFINE_PROP_UINT32("type",    m48t59_t, type,    -1),
-        DEFINE_PROP_HEX32( "io_base", m48t59_t, io_base,  0),
+        DEFINE_PROP_UINT32("size",    M48t59ISAState, state.size,    -1),
+        DEFINE_PROP_UINT32("type",    M48t59ISAState, state.type,    -1),
+        DEFINE_PROP_HEX32( "io_base", M48t59ISAState, state.io_base,  0),
         DEFINE_PROP_END_OF_LIST(),
     }
 };
@@ -731,9 +731,9 @@ static SysBusDeviceInfo m48t59_info = {
     .qdev.name  = "m48t59",
     .qdev.size = sizeof(M48t59SysBusState),
     .qdev.props = (Property[]) {
-        DEFINE_PROP_UINT32("size",    m48t59_t, size,    -1),
-        DEFINE_PROP_UINT32("type",    m48t59_t, type,    -1),
-        DEFINE_PROP_HEX32( "io_base", m48t59_t, io_base,  0),
+        DEFINE_PROP_UINT32("size",    M48t59SysBusState, state.size,    -1),
+        DEFINE_PROP_UINT32("type",    M48t59SysBusState, state.type,    -1),
+        DEFINE_PROP_HEX32( "io_base", M48t59SysBusState, state.io_base,  0),
         DEFINE_PROP_END_OF_LIST(),
     }
 };
-- 
1.6.2.5

Re: [Qemu-devel] Strange qdev related crash (m48t59 ISA qdev conversion)

[Blue Swirl]

2009/9/14 Gerd Hoffmann <kraxel@redhat.com>:
>  Hi,
>
>> (gdb) p dev->parent_bus
>> $1 = (BusState *) 0xffffffff00000000
>> (gdb) p bus
>> $2 = (BusState *) 0x26da770
>
> Property definitions are wrong.

Thanks a lot, this fixes the crash!