Re: [Qemu-ppc] qemu-ppc crashing on x86

[Cedric Le Goater]

On 02/04/2014 03:16 PM, Alexey Kardashevskiy wrote:
> On 02/05/2014 12:33 AM, Cedric Le Goater wrote:
>> On 02/04/2014 12:08 AM, Cedric Le Goater wrote:
>>> On 02/03/2014 11:48 PM, Alexander Graf wrote:
>>>>
>>>> On 03.02.2014, at 23:31, Cedric Le Goater <address@hidden> wrote:
>>>>
>>>>> Hi,
>>>>>
>>>>> The "latest" qemu-ppc is crashing when running a ppc guest on x86. I was 
>>>>> using a 
>>>>> relatively old version until recently, when Tom Musta's patches were 
>>>>> merged a few 
>>>>> days ago. 
>>>>>
>>>>> Anyhow, here are some info on the crash. 
>>>>>
>>>>> qemu-system-ppc64: 
>>>>> /home/legoater/work/linux/qemu-agraf.git/tcg/tcg.c:515: 
>>>>> tcg_temp_new_internal: Assertion `ts->base_type == type' failed.
>>>>> Aborted (core dumped)
>>>>>
>>>>> and the core stack trace :
>>>>>
>>>>> #0  0xb7173424 in __kernel_vsyscall ()
>>>>> #1  0xb6d73941 in raise () from /lib/i386-linux-gnu/i686/cmov/libc.so.6
>>>>> #2  0xb6d76d72 in abort () from /lib/i386-linux-gnu/i686/cmov/libc.so.6
>>>>> #3  0xb6d6cb58 in __assert_fail () from 
>>>>> /lib/i386-linux-gnu/i686/cmov/libc.so.6
>>>>> #4  0xb75c4a4a in tcg_temp_new_internal (type=TCG_TYPE_I32, temp_local=0)
>>>>>    at /home/legoater/work/linux/qemu-agraf.git/tcg/tcg.c:515
>>>>> #5  0xb75c4c70 in tcg_temp_new_internal_i32 (temp_local=0)
>>>>>    at /home/legoater/work/linux/qemu-agraf.git/tcg/tcg.c:559
>>>>> #6  0xb75beb03 in tcg_temp_new_i32 () at 
>>>>> /home/legoater/work/linux/qemu-agraf.git/tcg/tcg.h:569
>>>>> #7  0xb75c4efb in tcg_const_i32 (val=25) at 
>>>>> /home/legoater/work/linux/qemu-agraf.git/tcg/tcg.c:606
>>>>> #8  0xb75bf0a4 in tcg_gen_shli_i32 (ret=..., arg1=..., arg2=25)
>>>>>    at /home/legoater/work/linux/qemu-agraf.git/tcg/tcg-op.h:612
>>>>> #9  0xb75c5517 in tcg_gen_shifti_i64 (ret=..., arg1=..., c=7, right=1, 
>>>>> arith=0)
>>>>>    at /home/legoater/work/linux/qemu-agraf.git/tcg/tcg.c:790
>>>>> #10 0xb7543d21 in tcg_gen_shri_i64 (ret=..., arg1=..., arg2=7)
>>>>>    at /home/legoater/work/linux/qemu-agraf.git/tcg/tcg-op.h:985
>>>>> #11 0xb755ff4f in gen_rlwinm (ctx=0x9c7c9e3c)
>>>>>    at /home/legoater/work/linux/qemu-agraf.git/target-ppc/translate.c:1636
>>>>> #12 0xb75ba884 in gen_intermediate_code_internal (cpu=0xb964e210, 
>>>>> tb=0x9d5065b4, search_pc=false)
>>>>>    at 
>>>>> /home/legoater/work/linux/qemu-agraf.git/target-ppc/translate.c:11001
>>>>> #13 0xb75bac50 in gen_intermediate_code (env=0xb964e2cc, tb=0x9d5065b4)
>>>>>    at 
>>>>> /home/legoater/work/linux/qemu-agraf.git/target-ppc/translate.c:11058
>>>>> #14 0xb75caec3 in cpu_ppc_gen_code (env=0xb964e2cc, tb=0x9d5065b4, 
>>>>> gen_code_size_ptr=0x9c7c9f7c)
>>>>>    at /home/legoater/work/linux/qemu-agraf.git/translate-all.c:159
>>>>> #15 0xb75cc28b in tb_gen_code (env=0xb964e2cc, pc=19524, cs_base=0, 
>>>>> flags=0, cflags=0)
>>>>>    at /home/legoater/work/linux/qemu-agraf.git/translate-all.c:967
>>>>> #16 0xb7431fa4 in tb_find_slow (env=0xb964e2cc, pc=19524, cs_base=0, 
>>>>> flags=0)
>>>>>    at /home/legoater/work/linux/qemu-agraf.git/cpu-exec.c:163
>>>>> #17 0xb743219d in tb_find_fast (env=0xb964e2cc) at 
>>>>> /home/legoater/work/linux/qemu-agraf.git/cpu-exec.c:190
>>>>> #18 0xb74325cf in cpu_ppc_exec (env=0xb964e2cc) at 
>>>>> /home/legoater/work/linux/qemu-agraf.git/cpu-exec.c:604
>>>>> #19 0xb7435bb8 in tcg_cpu_exec (env=0xb964e2cc) at 
>>>>> /home/legoater/work/linux/qemu-agraf.git/cpus.c:1255
>>>>> #20 0xb7435cfc in tcg_exec_all () at 
>>>>> /home/legoater/work/linux/qemu-agraf.git/cpus.c:1288
>>>>> #21 0xb7435061 in qemu_tcg_cpu_thread_fn (arg=0xb964e210) at 
>>>>> /home/legoater/work/linux/qemu-agraf.git/cpus.c:954
>>>>> #22 0xb6eb1c39 in start_thread () from 
>>>>> /lib/i386-linux-gnu/i686/cmov/libpthread.so.0
>>>>> #23 0xb6e1e78e in clone () from /lib/i386-linux-gnu/i686/cmov/libc.so.6
>>>>> (gdb) up
>>>>> #1  0xb6d73941 in raise () from /lib/i386-linux-gnu/i686/cmov/libc.so.6
>>>>> (gdb) up
>>>>> #2  0xb6d76d72 in abort () from /lib/i386-linux-gnu/i686/cmov/libc.so.6
>>>>> (gdb) up
>>>>> #3  0xb6d6cb58 in __assert_fail () from 
>>>>> /lib/i386-linux-gnu/i686/cmov/libc.so.6
>>>>> (gdb) up
>>>>> #4  0xb75c4a4a in tcg_temp_new_internal (type=TCG_TYPE_I32, temp_local=0)
>>>>>    at /home/legoater/work/linux/qemu-agraf.git/tcg/tcg.c:515
>>>>> 515               assert(ts->base_type == type);
>>>>> (gdb) p type
>>>>> $1 = TCG_TYPE_I32
>>>>> (gdb) p *ts
>>>>> $2 = {base_type = TCG_TYPE_I64, type = TCG_TYPE_I32, val_type = 0, reg = 
>>>>> 6, val = 0, mem_reg = 4, 
>>>>>  mem_offset = 128, fixed_reg = 0, mem_coherent = 0, mem_allocated = 0, 
>>>>> temp_local = 0, temp_allocated = 1, 
>>>>>  name = 0x0}
>>>>>
>>>>>
>>>>> It might be related to commit 0ec9eabc7f6020418e1f3b3273d1dd701f7f87f9
>>>>> (tcg: Use bitmaps for free temporaries). I tried a few possible fixes 
>>>>> but I did not have much success. Any idea ? 
>>>>
>>>> You're running on a 32bit host (which is a pretty bad idea when running  
>>>> qemu-system-ppc64 
>>>> since it'll split all 64bit registers into two 32bit ones) OS. 
>>>
>>> Yes. I need to reinstall. I have a few 32bit legacy applications ... 
>>>
>>>> There was a bug with TCG there which I fixed a while ago (TCG: Fix 
>>>> I64-on-32bit-host temporaries).
>>>>
>>>> I just rebased my tree against current upstream and checked - the fix is 
>>>> definitely in now. So 
>>>> you should be able to get a working system through a more recent checkout. 
>>>> Except for the VGA 
>>>> problem discussed earlier on this list of course.
>>>
>>> This is working much better ! 
>>
>> This is not true. I had to revert commit 
>> ccfb53ed6360cac0d5f6f7915ca9ae7eed866412 
>> (target-ppc: fix Authority Mask Register init value) to have a working qemu 
>> when
>> emulation is on. The symptom is the one described in the changelog : the 
>> guest is 
>> hanging right after switching from the real to protected mode. That is right 
>> after
>> early_setup()
>>
>> Reverting this patch does not seem to have any impact with kvm, but I did 
>> not dig
>> further for the moment.
> 
> 
> It does break KVM. The whole patch came up because KVM got broken once I
> enabled actual set/put of SPR registers.

OK. I guess we have some differences in the host kernel we are using. 

Anyhow, I think there is an issue with the storage key protection in 
qemu. The test on the protection bit from the AMR register is inverted 
in ppc_hash64_amr_prot(). I will send a patch.

Thanks,

C.