Re: [Qemu-devel] [Bug 818647] [NEW] Getting segmentation fault when trying to boot FreeBSD

[Blue Swirl]

On Sat, Jul 30, 2011 at 9:13 PM, Wojciech Koszek
<address@hidden> wrote:
> Public bug reported:
>
> address@hidden:~/bin/qemu/qemu$ git log | head -1
> commit c886edfb851c0c590d4e77f058f2ec8ed95ad1b5
>
> address@hidden:~/o/freebsd/sys/boot/i386$ qemu-system-sparc64 --version
> QEMU emulator version 0.15.50, Copyright (c) 2003-2008 Fabrice Bellard
>
> address@hidden:~/o/freebsd/sys/boot/i386$ uname -a
> Linux wkoszek 2.6.38-10-generic #46-Ubuntu SMP Tue Jun 28 15:05:41 UTC 2011 
> i686 i686 i386 GNU/Linux
>
> Qemu built with default settings (./configure --prefix=<path> && make &&
> make install)
>
> I run FreeBSD ISO image:
> /home/wkoszek/bin/qemu-dynamic/bin/qemu-system-sparc64 -m 1024 -cdrom 
> ~/Pulpit/iso/FreeBSD-7.4-RELEASE-sparc64-bootonly.iso -hda 
> ~/Pulpit/iso/freebsd_sparc64.qcow2 -nographic -boot d
>
> Configuration device id QEMU version 1 machine id 0
> kernel cmdline
> CPUs: 1 x SUNW,UltraSPARC-IIi
> UUID: 00000000-0000-0000-0000-000000000000
> Welcome to OpenBIOS v1.0 built on Jul 20 2011 21:17
>  Type 'help' for detailed information
> Trying cdrom:f...
> Not a bootable ELF image
> Loading a.out image...
> Loaded 7680 bytes
> entry point is 0x4000
>
> Jumping to entry point 0000000000004000 for type 0000000000000005...
> switching to new context: entry point 0x4000 stack 0x00000000ffe86b49
>
>>> FreeBSD/sparc64 boot block
>   Boot path:   cdrom:f
>   Boot loader: /boot/loader
> Consoles: Open Firmware console
>
> Booting with sun4u support.
> Boot path set to cdrom:a
>
> FreeBSD/sparc64 bootstrap loader, Revision 1.0
> (address@hidden, Fri Feb 18 05:38:31 UTC 2011)
> bootpath="cdrom:a"
> Loading /boot/defaults/loader.conf
> /boot/kernel/kernel data=0x8d1f48+0x82f88 syms=[0x8+0x88ec0+0x8+0x76966]
> |
> Unimplemented service milliseconds ([0] -- [1])
> Hit [Enter] to boot immediately, or any other key for command prompt.
> Unimplemented service milliseconds ([0] -- [1])
> Unimplemented service milliseconds ([0] -- [1])
> Unimplemented service milliseconds ([0] -- [1])
> Unimplemented service milliseconds ([0] -- [1])
> Unimplemented service milliseconds ([0] -- [1])
> Unimplemented service milliseconds ([0] -- [1])
>
> I press CTRL + C and I get out of the looped warning about
> "unimplemented service". Then I see:
>
> Type '?' for a list of commands, 'help' for more detailed help.
> OK boot
> jumping to kernel entry at 0xc0078000.
> BOOTUnhandled Exception 0x0000000000000034
> PC = 0x00000000c0637454 NPC = 0x00000000c0637458
>
> I wanted to start FreeBSD debugging here - I pressed 'CTRL+A c', I was
> dropped to the monitor.
>
> FRom the monitor I typed:
>
> Stopping execution
> QEMU 0.15.50 monitor - type 'help' for more information
> (qemu) x 0xc0078000
> 00000000c0078000: Cannot access memory
> (qemu) x 0x00000000c0637454
> 00000000c0637454: Cannot access memory
> (qemu) x 0x00000000c0637458
> 00000000c0637458: Cannot access memory
> (qemu) xp 0xc0078000
> Segmentation fault
>
> IMO it shouldn't have crashed.

Right.

FYI: the virtual to physical translations can be examined (before the
exception printout) with 'info tlb':
jumping to kernel entry at 0xc0078000.
QEMU 0.15.50 monitor - type 'help' for more information
(qemu) info tlb
MMU contexts: Primary: 0, Secondary: 0
DMMU dump
[00] VA: ffe00000, PA: 7e80000, 512k, priv, RW, locked, ctx 0 local
[01] VA: ffe80000, PA: 7f00000, 512k, priv, RW, locked, ctx 0 local
[02] VA: fff00000, PA: 7f80000, 512k, priv, RW, locked, ctx 0 local
[03] VA: ffd00000, PA: 1fff0000000, 512k, priv, RO, locked, ctx 0 local
[04] VA: ffd80000, PA: 1fff0080000, 512k, priv, RO, locked, ctx 0 local
[05] VA: c864e000, PA: 580c000,   8k, priv, RW, unlocked, ctx 0 local
[06] VA: fe000000, PA: 1ff00800000,   4M, priv, RW, locked, ctx 0 local
[07] VA: fe400000, PA: 1ff00c00000,   4M, priv, RW, locked, ctx 0 local
[08] VA: bfc00000, PA: 0,   4M, priv, RW, locked, ctx 0 local
[09] VA: c8658000, PA: 5814000,   8k, priv, RW, unlocked, ctx 0 local
[10] VA: c4080000, PA: 5480000,   8k, priv, RW, unlocked, ctx 0 local
[11] VA: c4082000, PA: 5482000,   8k, priv, RW, unlocked, ctx 0 local
[12] VA: c4084000, PA: 5484000,   8k, priv, RW, unlocked, ctx 0 local
[13] VA: c4086000, PA: 5486000,   8k, priv, RW, unlocked, ctx 0 local
[14] VA: c4088000, PA: 5488000,   8k, priv, RW, unlocked, ctx 0 local
[15] VA: fffff80005a52000, PA: 5800000,   4M, user, RW, unlocked, ctx 0 local
[16] VA: c3fc8000, PA: 53c8000,   8k, priv, RW, unlocked, ctx 0 local
[17] VA: c3fca000, PA: 53ca000,   8k, priv, RW, unlocked, ctx 0 local
[18] VA: c3fcc000, PA: 53cc000,   8k, priv, RW, unlocked, ctx 0 local
[19] VA: c3fce000, PA: 53ce000,   8k, priv, RW, unlocked, ctx 0 local
[20] VA: c3fd0000, PA: 53d0000,   8k, priv, RW, unlocked, ctx 0 local
[21] VA: c3fd2000, PA: 53d2000,   8k, priv, RW, unlocked, ctx 0 local
[22] VA: c3fd4000, PA: 53d4000,   8k, priv, RW, unlocked, ctx 0 local
[23] VA: c3fd6000, PA: 53d6000,   8k, priv, RW, unlocked, ctx 0 local
[24] VA: c3fd8000, PA: 53d8000,   8k, priv, RW, unlocked, ctx 0 local
[25] VA: c3fda000, PA: 53da000,   8k, priv, RW, unlocked, ctx 0 local
[26] VA: c3fdc000, PA: 53dc000,   8k, priv, RW, unlocked, ctx 0 local
[27] VA: c3fde000, PA: 53de000,   8k, priv, RW, unlocked, ctx 0 local
[28] VA: c3fe0000, PA: 53e0000,   8k, priv, RW, unlocked, ctx 0 local
[29] VA: c3fe2000, PA: 53e2000,   8k, priv, RW, unlocked, ctx 0 local
[30] VA: c3fe4000, PA: 53e4000,   8k, priv, RW, unlocked, ctx 0 local
[31] VA: c3fe6000, PA: 53e6000,   8k, priv, RW, unlocked, ctx 0 local
[32] VA: c3fe8000, PA: 53e8000,   8k, priv, RW, unlocked, ctx 0 local
[33] VA: fffff8000106a000, PA: 1000000,   4M, user, RW, unlocked, ctx 0 local
[34] VA: c1016000, PA: 416000,   8k, priv, RW, unlocked, ctx 0 local
[35] VA: fffff8000040e000, PA: 400000,   4M, user, RW, unlocked, ctx 0 local
[36] VA: c7bae000, PA: 6e78000,   8k, priv, RW, unlocked, ctx 0 local
[37] VA: c7bb8000, PA: 5a14000,   8k, priv, RW, unlocked, ctx 0 local
[38] VA: fffff80006e70000, PA: 6c00000,   4M, user, RW, unlocked, ctx 0 local
[39] VA: c7be2000, PA: 6e6c000,   8k, priv, RW, unlocked, ctx 0 local
[40] VA: fffff8000201a000, PA: 2000000,   4M, user, RW, unlocked, ctx 0 local
[41] VA: c101a000, PA: 201a000,   8k, priv, RW, unlocked, ctx 0 local
[42] VA: c101c000, PA: 201c000,   8k, priv, RW, unlocked, ctx 0 local
[43] VA: c101e000, PA: 201e000,   8k, priv, RW, unlocked, ctx 0 local
[44] VA: c1020000, PA: 2020000,   8k, priv, RW, unlocked, ctx 0 local
[45] VA: c85cc000, PA: 6e44000,   8k, priv, RW, unlocked, ctx 0 local
[46] VA: c85d6000, PA: 6e4c000,   8k, priv, RW, unlocked, ctx 0 local
[47] VA: c85e0000, PA: 6e54000,   8k, priv, RW, unlocked, ctx 0 local
[48] VA: c85ea000, PA: 6e5c000,   8k, priv, RW, unlocked, ctx 0 local
[49] VA: c85f4000, PA: 6e04000,   8k, priv, RW, unlocked, ctx 0 local
[50] VA: c85fe000, PA: 6e0c000,   8k, priv, RW, unlocked, ctx 0 local
[51] VA: c8608000, PA: 6e14000,   8k, priv, RW, unlocked, ctx 0 local
[52] VA: c3fb8000, PA: 53b8000,   8k, priv, RW, unlocked, ctx 0 local
[53] VA: c8612000, PA: 6e1c000,   8k, priv, RW, unlocked, ctx 0 local
[54] VA: c3fbc000, PA: 53bc000,   8k, priv, RW, unlocked, ctx 0 local
[55] VA: c861c000, PA: 6e24000,   8k, priv, RW, unlocked, ctx 0 local
[56] VA: c8626000, PA: 6e2c000,   8k, priv, RW, unlocked, ctx 0 local
[57] VA: c8630000, PA: 6e34000,   8k, priv, RW, unlocked, ctx 0 local
[58] VA: c863a000, PA: 6e3c000,   8k, priv, RW, unlocked, ctx 0 local
[59] VA: c8644000, PA: 5804000,   8k, priv, RW, unlocked, ctx 0 local
[60] VA: c0c00000, PA: 5c00000,   4M, priv, RW, locked, ctx 0 local
[61] VA: c0800000, PA: 6000000,   4M, priv, RW, locked, ctx 0 local
[62] VA: c0400000, PA: 6400000,   4M, priv, RW, locked, ctx 0 local
[63] VA: c0000000, PA: 6800000,   4M, priv, RW, locked, ctx 0 local
IMMU dump
[00] VA: ffd00000, PA: 1fff0000000, 512k, priv, locked, ctx 0 local
[01] VA: fe000000, PA: 1ff00800000,   4M, priv, locked, ctx 0 local
[02] VA: fe400000, PA: 1ff00c00000,   4M, priv, locked, ctx 0 local
[60] VA: c0c00000, PA: 5c00000,   4M, priv, locked, ctx 0 local
[61] VA: c0800000, PA: 6000000,   4M, priv, locked, ctx 0 local
[62] VA: c0400000, PA: 6400000,   4M, priv, locked, ctx 0 local
[63] VA: c0000000, PA: 6800000,   4M, priv, locked, ctx 0 local
(qemu) BOOTUnhandled Exception 0x0000000000000034
PC = 0x00000000c0637454 NPC = 0x00000000c0637458
Stopping execution

(qemu) xp/i 0x6637454
0x0000000006637454:  ld  [ %i1 + 4 ], %g1

But it's easier to use GDB for debugging (add -s -S switches, attach
with Sparc GDB):
$ sparc64-linux-gdb
GNU gdb 6.8
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=x86_64-unknown-linux-gnu
--target=sparc64-linux".
(gdb) set architecture sparc:v9
The target architecture is assumed to be sparc:v9
(gdb) b *0x00000000c0637454
Breakpoint 1 at 0xc0637454
(gdb) target remote :1234
[New Thread 1]
0x000001fff0000020 in ?? ()
(gdb) c
Breakpoint 1, 0x00000000c0637454 in ?? ()
(gdb) info registers
g0             0x0      0x0
g1             0xc08eb730       0xc08eb730
g2             0xc08ee910       0xc08ee910
g3             0xc08eb730       0xc08eb730
g4             0x186a1  0x186a1
g5             0xfffff8000040fff8       0xfffff8000040fff8
g6             0xc1017980       0xc1017980
g7             0xc093ad68       0xc093ad68
o0             0xc08ee8f0       0xc08ee8f0
o1             0xc08eb730       0xc08eb730
o2             0x0      0x0
o3             0x0      0x0
o4             0x0      0x0
o5             0x0      0x0
sp             0xc0940299       0xc0940299
o7             0xc063744c       0xc063744c
l0             0xc08eb730       0xc08eb730
l1             0x0      0x0
l2             0x0      0x0
l3             0xffffffffffffffff       0xffffffffffffffff
l4             0xfffff80001078c70       0xfffff80001078c70
l5             0xc080b908       0xc080b908
l6             0xfffff80001084c60       0xfffff80001084c60
l7             0xc0898320       0xc0898320
i0             0x0      0x0
i1             0xffffffffffffffff       0xffffffffffffffff
i2             0x0      0x0
i3             0x88ca6c00       0x88ca6c00
i4             0x0      0x0
i5             0x57e    0x57e
fp             0xc0940399       0xc0940399
i7             0xc06373e0       0xc06373e0
pc             0xc0637454       0xc0637454
npc            0xc0637458       0xc0637458
state          0x4415001407     0x4415001407
fsr            0x0      [ ]
fprs           0x0      [ ]
y              0x0      0x0
cwp            0x7      0x7
pstate         0x14     [ PRIV PEF ]
asi            0x15     0x15
ccr            0x44     0x44
(gdb) disassemble $pc $pc+4
Dump of assembler code from 0xc0637454 to 0xc0637458:
0x00000000c0637454:     ld  [ %i1 + 4 ], %g1
End of assembler dump.