[Qemu-devel] [Bug 1035572] Re: Bug in Qemu User Mode

[Dietmar Stölting]

I did some more tests:
In the newest version of Qemu Linaro I put in folder Linux-User
in the file syscall.c the following

    target_ldt_info->base_addr = tswapal(base_addr);
    target_ldt_info->limit = tswap32(limit);
    target_ldt_info->flags = tswap32(flags);
    unlock_user_struct(target_ldt_info, ptr, 1);
    return 0;
}
static inline void cpu_set_tls(CPUX86State *env, target_ulong newtls)
{
    do_set_thread_area(env, newtls);
    cpu_x86_load_seg(env, R_GS, env->segs[R_GS].selector);
}
#endif /* TARGET_I386 && TARGET_ABI32 */

#ifndef TARGET_ABI32
static abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
{
    abi_long ret = 0;
        pthread_attr_t attr;
#endif
        ts = g_malloc0(sizeof(TaskState));
        init_task_state(ts);
        /* we create a new CPU instance. */
        new_env = cpu_copy(env);
#if defined(TARGET_I386)
        new_env->idt.base = target_mmap(0, sizeof(uint64_t) * (env->idt.limit + 
1),
                PROT_READ|PROT_WRITE,
                MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
        memcpy(g2h(new_env->idt.base), g2h(env->idt.base), sizeof(uint64_t) * 
(env->idt.limit + 1));
        new_env->gdt.base = target_mmap(0, sizeof(uint64_t) * 
TARGET_GDT_ENTRIES,
                PROT_READ|PROT_WRITE,
                MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
        memcpy(g2h(new_env->gdt.base), g2h(env->gdt.base), sizeof(uint64_t) * 
TARGET_GDT_ENTRIES);
#elif defined(TARGET_SPARC) || defined(TARGET_PPC)
        cpu_reset(ENV_GET_CPU(new_env));
#endif
        /* Init regs that differ from the parent.  */
        cpu_clone_regs(new_env, newsp);
        new_env->opaque = ts;
        ts->bprm = parent_ts->bprm;

It is just as if the missed function cpu_set_tls(CPUX86State *env,
target_ulong newtls) in folder cpu.h for i386 has moved to syscall.c:-).

Now I can play Quake2 with
qemu-i386 quake2

but the testclone program still not stops. May be, that there is something 
missed in #include<...>
in syscall.c, because now there is the function declaration for i386 for 
cpu_set_tls() there?
Or that simple a file is missed  that is needed for the function clone(), 
espacelly for i386?
May be some of the flags are set always wrong in clone()?
WHY are there wrong adresses for the child process?
Is the reserved space for the child zero? Why has the child and the parent 
identical adresses in 2 different threads? With a wrong adress for the child, 
no threads are posible at all.
May be it is not so difficult to make it work,
but I am not so good in this:-)

Dietmar

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1035572

Title:
  Bug in Qemu User Mode

Status in QEMU:
  New

Bug description:
  Hi,
  I make an interesting discovery.
  My aim is to have a working qemu-i386 on Raspberry Pi.
  After long searching in the dark what goes wrong with ANY Qemu version for 
User Mode until today,
  I find the following: The bug must be in at least one function, that the 
program testclone
  from the testpackage for i386 in linux-user-test-0.3 calls.
  The wrong function is in the part, which enables more than one thread at the 
same time, NPTL.
  Funny, how I find this out: All the programs from the tests in 
linux-user-test-0.3 I can now run succesfull with my new builded qemu-i386 for 
Raspi.
  But the program testclone does not stop after it gives out all the right 
messages.
  The program testclone stops on my Desktop computer with Debian Wheezy 
installed.
  So, the error is not in the program testclone.
  So I make a look, what is going on there with strace. With strace you get 
informations about all the values in the working program, here testclone.
  I see, that the reason, why testclone not stops is in an infinite loop 
because of 
  while (waitpid(pid1, &status1, 0) != pid1);
  while (waitpid(pid2, &status2, 0) != pid2);
  at its end is never fullfilled. 
  This is the reason for the famous error message from Qemu User Mode 

  qemu: uncaught target signal 11 (Segmentation fault) - core dumped 
  Segmentation fault 

  stack1 = malloc(STACK_SIZE);
  pid1 = clone(thread1_func, stack1 + STACK_SIZE,
  CLONE_VM | CLONE_FS | CLONE_FILES | SIGCHLD, "hello1");

  stack2 = malloc(STACK_SIZE);
  pid2 = clone(thread2_func, stack2 + STACK_SIZE, 
  CLONE_VM | CLONE_FS | CLONE_FILES | SIGCHLD, "hello2");

  The error happens early in the program testclone. Strace says, it is because 
no childprocess at all can be found. So, some basiccalculations in those four 
lines must be done wrong from Qemu.
  I think, that the adressspace for each thread is calculated wrong, or 
overlapps.
  Funny, it has nothing to do with the ARM processor. I get exact the same 
errormessages, when I run the program testclone on my desktopcompi i386 with a 
Wheezy in Qemu and then qemu-i386 testclone.
  This is a good message, because it means it is an error, that belongs at 
least to the i386 family but I think, every processor in Qemu User Mode is 
involved, so until now NPTL does not work.
  Today I make a hand by hand calculation with the source code from testclone 
and compare it with the values, that Qemu User Mode give. The handcalculated 
values should  be the same which my 
  Desktop computer with Wheezy with tesclone produces, but who knows,
  Dietmar

  PS: I hope, that this is the right source code for testclone. Any help
  is welcome:-)!

  
  Code: Select all
  #include <stdlib.h>
  #include <stdio.h>
  #include <string.h>
  #include <signal.h>
  #include <unistd.h>
  #include <inttypes.h>
  #include <pthread.h>
  #include <sys/wait.h>
  #include <sched.h>

  int thread1_func(void *arg)
  {
      int i;
      char buf[512];

      for(i=0;i<10;i++) {
          snprintf(buf, sizeof(buf), "thread1: %d %s\n", i, (char *)arg);
         write(1, buf, strlen(buf));
          usleep(100 * 1000);
      }
      return 0;
  }

  int thread2_func(void *arg)
  {
      int i;
      char buf[512];
      for(i=0;i<20;i++) {
          snprintf(buf, sizeof(buf), "thread2: %d %s\n", i, (char *)arg);
          write(1, buf, strlen(buf));
          usleep(120 * 1000);
      }
      return 0;
  }

  #define STACK_SIZE 16384

  void test_clone(void)
  {
      uint8_t *stack1, *stack2;
      int pid1, pid2, status1, status2;

      stack1 = malloc(STACK_SIZE);
      pid1 = clone(thread1_func, stack1 + STACK_SIZE, 
                   CLONE_VM | CLONE_FS | CLONE_FILES | SIGCHLD, "hello1");

      stack2 = malloc(STACK_SIZE);
      pid2 = clone(thread2_func, stack2 + STACK_SIZE, 
                  CLONE_VM | CLONE_FS | CLONE_FILES | SIGCHLD, "hello2");

      while (waitpid(pid1, &status1, 0) != pid1);
      while (waitpid(pid2, &status2, 0) != pid2);
      printf("status1=0x%x\n", status1);
      printf("status2=0x%x\n", status2);
      printf("End of clone test.\n");
  }

  int main(int argc, char **argv)
  {
      test_clone();
      return 0;
  }
  Posts: 210
  Joined: 04 Sep 2011 17:43

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1035572/+subscriptions