[Qemu-devel] [Bug 1094950] Re: crash at qemu_iohandler_poll (iohandler.c:124) on macos 10.8.2

[Peter Maydell]

Just a note that IME trying to debug QEMU under gdb on MacOS doesn't
work very well. In particular as far as I can tell gdb breaks sigwait()
such that the sigwait() in sigwait_compat() can return 0 without setting
the int* sig. This causes QEMU to write an uninitialized value into the
qemu_signalfd_siginfo struct it sends down the pipe, and then
sigfd_handler() calls sigaction() with this bogus data as the signal
number. Since sigfd_handler() doesn't check the return value from
sigaction() we then proceed to leap off into nowhere.

sigfd_handler() should probably be checking the return value from
sigaction() but the underlying problem is MacOS and/or its gdb breaking
sigwait() behaviour somehow.

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1094950

Title:
  crash at  qemu_iohandler_poll (iohandler.c:124) on macos 10.8.2

Status in QEMU:
  New

Bug description:
  I'm seeing consistent hangs / crashes on MacOS 10.8.2 with 1.3.0.
  I've tried both gcc-4.2 and clang.  I've tried a half a dozen
  different images/kernels.

  I configured qemu like this:

  ./configure --disable-sdl --disable-kvm --enable-cocoa --cc=gcc-4.2
  --host-cc=gcc-4.2 --enable-debug   --extra-cflags=-g   --extra-
  ldflags=-g

  And ran it like this:

  qemu-system-arm -nographic -M versatilepb -kernel
  vmlinuz-2.6.32-5-versatile -initrd initrd.img-2.6.32-5-versatile -hda
  debian_squeeze_armel_standard.qcow2 -append "root=/dev/sda1
  console=ttyAMA0"

  With images, kernel, and initrd described here:

  http://psellos.com/2012/08/2012.08.qemu-arm-osx.html

  And I get:

  Program received signal EXC_BAD_ACCESS, Could not access memory.
  Reason: KERN_PROTECTION_FAILURE at address: 0x000000010142f2d0
  0x000000010142f2d0 in ?? ()

  (gdb) bt
  #0  0x000000010142f2d0 in ?? ()
  #1  0x000000010016e209 in qemu_iohandler_poll (readfds=0x10097ca00, 
writefds=0x10097ca80, xfds=0x10097cb00, ret=4) at iohandler.c:124
  #2  0x0000000100172acf in main_loop_wait (nonblocking=0) at main-loop.c:418
  #3  0x0000000100207bbf in main_loop () at vl.c:1765
  #4  0x000000010020e7b0 in qemu_main (argc=12, argv=0x7fff5fbff360, 
envp=0x7fff5fbff3c8) at vl.c:3992
  #5  0x00000001001d6013 in main (argc=12, argv=0x7fff5fbff360) at 
ui/cocoa.m:884
  (gdb) frame 1
  #1  0x000000010016e209 in qemu_iohandler_poll (readfds=0x10097ca00, 
writefds=0x10097ca80, xfds=0x10097cb00, ret=4) at iohandler.c:124
  124                   ioh->fd_read(ioh->opaque);
  Current language:  auto; currently c
  (gdb) p ioh
  $1 = (IOHandlerRecord *) 0x10142f110
  (gdb) p *ioh
  $2 = {
    fd_read_poll = 0, 
    fd_read = 0x10017212b <sigfd_handler>, 
    fd_write = 0, 
    opaque = 0x3, 
    next = {
      le_next = 0x0, 
      le_prev = 0x105d00bc0
    }, 
    fd = 3, 
    deleted = false
  }

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1094950/+subscriptions