qemu-discuss
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-discuss] Segmentation fault on target tricore


From: Konopik, Andreas
Subject: Re: [Qemu-discuss] Segmentation fault on target tricore
Date: Tue, 17 Sep 2019 15:06:16 +0200
User-agent: Roundcube Webmail/1.2.9

Using gdb and valgrind I found out that:
- 'gen_mtcr()' and 'gen_mfcr()' access uninitialized values, i.e. CSFRs,
which leads to the Segfault
- The uninitialised values were created by stack allocation of
DisasContext in 'gen_intermediate_code()'

This definitely sounds like a bug: do you have a stack
backtrace from valgrind or gdb of the bad access and the
segfault?


GDB:

[...]
Thread 3 "qemu-system-tri" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff10a4700 (LWP 146730)]
0x00005555556edb67 in gen_mfcr (ret=0xab0, offset=<optimized out>,
   ctx=<optimized out>)
   at /home/akonopik/qemu_src/target/tricore/cpu.h:274
274         return (env->features & (1ULL << feature)) != 0;
(gdb) bt
#0  0x00005555556edb67 in gen_mfcr
   (ret=0xab0, offset=<optimized out>, ctx=<optimized out>)
   at /home/akonopik/qemu_src/target/tricore/cpu.h:274
#1 0x000055555570bc30 in decode_rlc_opc (op1=<optimized out>, ctx=0x7ffff10a3540)
   at /home/akonopik/qemu_src/target/tricore/translate.c:6020
#2 0x000055555570bc30 in decode_32Bit_opc (ctx=ctx@entry=0x7ffff10a3540)
   at /home/akonopik/qemu_src/target/tricore/translate.c:8680
#3  0x000055555570bf77 in tricore_tr_translate_insn
   (dcbase=0x7ffff10a3540, cpu=<optimized out>)
   at /home/akonopik/qemu_src/target/tricore/translate.c:8856
#4  0x00005555556e15c9 in translator_loop (ops=
0x555555c2b340 <tricore_tr_ops>, db=0x7ffff10a3540, cpu=0x555555dc0480, tb=<optimized out>, max_insns=<optimized out>)
   at /home/akonopik/qemu_src/accel/tcg/translator.c:94
#5  0x000055555570d96c in gen_intermediate_code
(cs=cs@entry=0x555555dc0480, tb=tb@entry=0x7fffea000280 <code_gen_buffer+595>, max_insns=max_insns@entry=512)
   at /home/akonopik/qemu_src/target/tricore/translate.c:8907
#6  0x00005555556e01f4 in tb_gen_code
(cpu=cpu@entry=0x555555dc0480, pc=pc@entry=2147485022, cs_base=cs_base@entry=0, flags=flags@entry=0, cflags=-16777216, cflags@entry=0)
   at /home/akonopik/qemu_src/accel/tcg/translate-all.c:1738
#7  0x00005555556de474 in tb_find
(cf_mask=0, tb_exit=0, last_tb=0x7fffea000140 <code_gen_buffer+275>, cpu=0x555555dc0758) at /home/akonopik/qemu_src/accel/tcg/cpu-exec.c:408
#8  0x00005555556de474 in cpu_exec (cpu=cpu@entry=0x555555dc0480)
   at /home/akonopik/qemu_src/accel/tcg/cpu-exec.c:730
#9  0x00005555556a59c0 in tcg_cpu_exec (cpu=0x555555dc0480)
   at /home/akonopik/qemu_src/cpus.c:1445
#10 0x00005555556a7831 in qemu_tcg_rr_cpu_thread_fn (arg=arg@entry=0x555555dc0480)
   at /home/akonopik/qemu_src/cpus.c:1547
#11 0x00005555558d540b in qemu_thread_start (args=<optimized out>)
   at /home/akonopik/qemu_src/util/qemu-thread-posix.c:502
#12 0x00007ffff5a1657f in start_thread () at /usr/lib/libpthread.so.0
#13 0x00007ffff59460e3 in clone () at /usr/lib/libc.so.6

VALGRIND:

==146846== Memcheck, a memory error detector
==146846== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==146846== Using Valgrind-3.14.0 and LibVEX; rerun with -h for copyright info
==146846== Command:
/home/akonopik/qemu_src/build/tricore-softmmu/qemu-system-tricore -nographic -M
tricore_testboard -cpu tc1796 -kernel /home/akonopik/hello.elf
==146846==
--146846-- WARNING: unhandled amd64-linux syscall: 317
--146846-- You may be able to write your own handler.
--146846-- Read the file README_MISSING_SYSCALL_OR_IOCTL.
--146846-- Nevertheless we consider this a bug.  Please report
--146846-- it at http://valgrind.org/support/bug_reports.html.
==146846== Conditional jump or move depends on uninitialised value(s)
==146846==    at 0x223D94: tcg_target_init (tcg-target.inc.c:3776)
==146846==    by 0x223D94: tcg_context_init (tcg.c:961)
==146846==    by 0x293E29: cpu_gen_init (translate-all.c:240)
==146846==    by 0x293E29: tcg_exec_init (translate-all.c:1148)
==146846==    by 0x275333: tcg_init (tcg-all.c:63)
==146846==    by 0x274DE3: accel_init_machine (accel.c:63)
==146846==    by 0x274DE3: configure_accelerator (accel.c:110)
==146846==    by 0x210236: main (vl.c:4185)
==146846==  Uninitialised value was created by a stack allocation
==146846==    at 0x5E3E117: ??? (in /usr/lib/libglib-2.0.so.0.6200.0)
==146846==
QEMU 4.1.50 monitor - type 'help' for more information
(qemu) ==146846== Thread 3:
==146846== Use of uninitialised value of size 8
==146846==    at 0x2A1B67: gen_mfcr.isra.0 (csfr.def:9)
==146846==    by 0x2BFC2F: decode_rlc_opc (translate.c:6020)
==146846==    by 0x2BFC2F: decode_32Bit_opc (translate.c:8680)
==146846==    by 0x2BFF76: tricore_tr_translate_insn (translate.c:8856)
==146846==    by 0x2955C8: translator_loop (translator.c:94)
==146846==    by 0x2C196B: gen_intermediate_code (translate.c:8907)
==146846==    by 0x2941F3: tb_gen_code (translate-all.c:1738)
==146846==    by 0x292473: tb_find (cpu-exec.c:408)
==146846==    by 0x292473: cpu_exec (cpu-exec.c:730)
==146846==    by 0x2599BF: tcg_cpu_exec (cpus.c:1445)
==146846==    by 0x25B830: qemu_tcg_rr_cpu_thread_fn (cpus.c:1547)
==146846==    by 0x48940A: qemu_thread_start (qemu-thread-posix.c:502)
==146846== by 0x6DEE57E: start_thread (in /usr/lib/libpthread-2.29.so)
==146846==    by 0x6F040E2: clone (in /usr/lib/libc-2.29.so)
==146846==  Uninitialised value was created by a stack allocation
==146846==    at 0x2C1940: gen_intermediate_code (translate.c:8905)
==146846==
==146846== Use of uninitialised value of size 8
==146846==    at 0x2A302C: gen_mtcr.isra.0 (csfr.def:9)
==146846==    by 0x2BFC9C: decode_rlc_opc (translate.c:6046)
==146846==    by 0x2BFC9C: decode_32Bit_opc (translate.c:8680)
==146846==    by 0x2BFF76: tricore_tr_translate_insn (translate.c:8856)
==146846==    by 0x2955C8: translator_loop (translator.c:94)
==146846==    by 0x2C196B: gen_intermediate_code (translate.c:8907)
==146846==    by 0x2941F3: tb_gen_code (translate-all.c:1738)
==146846==    by 0x292473: tb_find (cpu-exec.c:408)
==146846==    by 0x292473: cpu_exec (cpu-exec.c:730)
==146846==    by 0x2599BF: tcg_cpu_exec (cpus.c:1445)
==146846==    by 0x25B830: qemu_tcg_rr_cpu_thread_fn (cpus.c:1547)
==146846==    by 0x48940A: qemu_thread_start (qemu-thread-posix.c:502)
==146846== by 0x6DEE57E: start_thread (in /usr/lib/libpthread-2.29.so)
==146846==    by 0x6F040E2: clone (in /usr/lib/libc-2.29.so)
==146846==  Uninitialised value was created by a stack allocation
==146846==    at 0x2C1940: gen_intermediate_code (translate.c:8905)
[...]


Regards,

Andreas



reply via email to

[Prev in Thread] Current Thread [Next in Thread]