Re: [Qemu-devel] Segfault using qemu-system-arm in smc91c111

[Richard Purdie]

On Sun, 2015-09-06 at 17:48 -0700, Peter Crosthwaite wrote:
> On Sun, Sep 6, 2015 at 4:26 PM, Richard Purdie
> <address@hidden> wrote:
> > On Sun, 2015-09-06 at 11:37 -0700, Peter Crosthwaite wrote:
> > I tested an assert in _recieve() which confirms it can be called when
> > can_receive() says it isn't ready.
> >
> 
> A backtrace of this would be handy.

This is the trace with my assert against smc91c111_can_receive(nc) being
false when we're in receive(), before we allocate_packet:

#0  0x00007f355f276267 in __GI_raise (address@hidden) at 
../sysdeps/unix/sysv/linux/raise.c:55
#1  0x00007f355f277eca in __GI_abort () at abort.c:89
#2  0x00007f355f26f03d in __assert_fail_base (fmt=0x7f355f3d1028 "%s%s%s:%u: 
%s%sAssertion `%s' failed.\n%n", 
    address@hidden "smc91c111_can_receive(nc)", 
    address@hidden 
"/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/hw/net/smc91c111.c",
 address@hidden, address@hidden <__PRETTY_FUNCTION__.26130> 
"smc91c111_receive") at assert.c:92
#3  0x00007f355f26f0f2 in __GI___assert_fail (address@hidden 
"smc91c111_can_receive(nc)", 
    address@hidden 
"/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/hw/net/smc91c111.c",
 address@hidden, address@hidden <__PRETTY_FUNCTION__.26130> "smc91c111_receive")
    at assert.c:101
#4  0x00007f3561fca4d0 in smc91c111_receive (nc=0x7f3563604d10, 
buf=0x7f353c09d028 "RT", size=1514)
    at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/hw/net/smc91c111.c:680
#5  0x00007f356203058b in qemu_deliver_packet (sender=<optimised out>, 
flags=<optimised out>, address@hidden "RT", 
    size=<optimised out>, opaque=0x7f3563604d10)
    at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/net/net.c:577
#6  0x00007f3562031eaa in qemu_net_queue_deliver (size=<optimised out>, 
data=<optimised out>, flags=<optimised out>, 
    sender=<optimised out>, queue=0x7f3563604e70)
    at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/net/queue.c:157
#7  qemu_net_queue_flush (queue=0x7f3563604e70)
    at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/net/queue.c:254
#8  0x00007f356202fc7c in qemu_flush_or_purge_queued_packets 
(nc=0x7f3563604d10, purge=<optimised out>)
    at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/net/net.c:606
#9  0x00007f3561fcacec in smc91c111_writeb (opaque=0x7f35635178f0, 
offset=<optimised out>, value=128)
    at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/hw/net/smc91c111.c:382
#10 0x00007f3561fcaf84 in smc91c111_writew (opaque=0x7f35635178f0, offset=0, 
value=128)
    at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/hw/net/smc91c111.c:612
#11 0x00007f3561e52cc5 in memory_region_oldmmio_write_accessor (mr=<optimised 
out>, addr=<optimised out>, value=<optimised out>, 
    size=<optimised out>, shift=<optimised out>, mask=<optimised out>, 
attrs=...)
    at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:434
#12 0x00007f3561e5227d in access_with_adjusted_size (address@hidden, 
address@hidden, address@hidden, 
    access_size_min=<optimised out>, access_size_max=<optimised out>, 
    access=0x7f3561e52c90 <memory_region_oldmmio_write_accessor>, 
mr=0x7f356351bc80, attrs=...)
    at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:506
#13 0x00007f3561e53d5b in memory_region_dispatch_write (address@hidden, addr=0, 
data=128, address@hidden, 
    address@hidden) at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:1171
#14 0x00007f3561e1fc51 in address_space_rw (as=<optimised out>, addr=268500992, 
attrs=..., address@hidden "\200", 
    len=2, address@hidden)
    at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/exec.c:2445
#15 0x00007f3561e1fda0 in address_space_write (len=<optimised out>, 
buf=0x7f35572d94c0 "\200", attrs=..., addr=<optimised out>, 
    as=<optimised out>) at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/exec.c:2521
#16 subpage_write (opaque=<optimised out>, addr=<optimised out>, 
value=<optimised out>, len=<optimised out>, attrs=...)
    at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/exec.c:2081
#17 0x00007f3561e5227d in access_with_adjusted_size (address@hidden, 
address@hidden, address@hidden, 
    access_size_min=<optimised out>, access_size_max=<optimised out>, 
    access=0x7f3561e521a0 <memory_region_write_with_attrs_accessor>, 
mr=0x7f356375e360, attrs=...)
    at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:506
#18 0x00007f3561e53d5b in memory_region_dispatch_write (mr=0x7f356375e360, 
addr=0, data=128, size=2, attrs=...)
    at 
/media/build1/poky/build/tmp-lsb/work/x86_64-linux/qemu-native/2.4.0-r1/qemu-2.4.0/memory.c:1171
#19 0x00007f3559342734 in ?? ()

the rest of the stack is just ??. So some write into the smc91c111
memory triggers qemu_flush_or_purge_queued_packets() which then keeps
delivering packets as far as I can tell.

Do we need to check can_receive() before triggering the
qemu_flush_or_purge_queued_packets() call? The code is clearly calling
this in places where the driver simply isn't ready.

(qemu_flush_queued_packets() == qemu_flush_or_purge_queued_packets())

Cheers,

Richard