[Qemu-devel] [Bug 1837049] Re: qemu-system-ppc segfaults with -display sdl

[Richard Henderson]

Works for me with a 32-bit install of fedora 30.
That's using gcc 9.1.1.

Is building with -Og required to reproduce this?
If so, I'm thinking compiler bug...

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1837049

Title:
  qemu-system-ppc segfaults with -display sdl

Status in QEMU:
  New

Bug description:
  Hello.

  I was trying to debug this segfault:
  https://lists.nongnu.org/archive/html/qemu-ppc/2019-07/msg00186.html

  I recompiled latest qemu from git (commit 
0b18cfb8f1828c905139b54c8644b0d8f4aad879 ), using this configure line:
  ./configure --target-list=i386-softmmu,x86_64-softmmu,ppc-softmmu 
--audio-drv-list=alsa --disable-werror --extra-cflags="-Og" --enable-debug-tcg

  after this I tried original line under gdb, it was still segfaulting:

  --------------copy-----------------
  gdb ./ppc-softmmu/qemu-system-ppc
  GNU gdb (GDB) 7.11.1
  Copyright (C) 2016 Free Software Foundation, Inc.
  License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
  This is free software: you are free to change and redistribute it.
  There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
  and "show warranty" for details.
  This GDB was configured as "i586-slackware-linux".
  Type "show configuration" for configuration details.
  For bug reporting instructions, please see:
  <http://www.gnu.org/software/gdb/bugs/>.
  Find the GDB manual and other documentation resources online at:
  <http://www.gnu.org/software/gdb/documentation/>.
  For help, type "help".
  Type "apropos word" to search for commands related to "word"...
  Reading symbols from ./ppc-softmmu/qemu-system-ppc...done.
  warning: File "/dev/shm/qemu/.gdbinit" auto-loading has been declined by your 
`auto-load safe-path' set to "$debugdir:$datadir/auto-load".
  To enable execution of this file add
          add-auto-load-safe-path /dev/shm/qemu/.gdbinit
  line to your configuration file "/home/guest/.gdbinit".
  To completely disable this security protection add
          set auto-load safe-path /
  line to your configuration file "/home/guest/.gdbinit".
  For more information about this security protection see the
  "Auto-loading safe path" section in the GDB manual.  E.g., run from the shell:
          info "(gdb)Auto-loading safe path"
  (gdb) run  -M mac99,via=pmu -L ../queue-vga/pc-bios -cdrom 
/mnt/sdb1/PPC-img/lubuntu-16.04-desktop-powerpc.iso -m 512 -display sdl,gl=on 
-vga std -d guest_errors,unimp -boot d -cpu G4 -g 1024x768x24 -device ES1370
  Starting program: /dev/shm/qemu/ppc-softmmu/qemu-system-ppc -M mac99,via=pmu 
-L ../queue-vga/pc-bios -cdrom 
/mnt/sdb1/PPC-img/lubuntu-16.04-desktop-powerpc.iso -m 512 -display sdl,gl=on 
-vga std -d guest_errors,unimp -boot d -cpu G4 -g 1024x768x24 -device ES1370
  [Thread debugging using libthread_db enabled]
  Using host libthread_db library "/lib/libthread_db.so.1".
  [New Thread 0xf560cb40 (LWP 8100)]
  [New Thread 0xf4c1ab40 (LWP 8101)]
  [New Thread 0xec1b7b40 (LWP 8102)]
  [New Thread 0xc5821b40 (LWP 8104)]
  [Thread 0xf4c1ab40 (LWP 8101) exited]
  [New Thread 0xf4c1ab40 (LWP 8119)]

  Thread 4 "qemu-system-ppc" received signal SIGSEGV, Segmentation fault.
  [Switching to Thread 0xec1b7b40 (LWP 8102)]
  0xf26c2e44 in code_gen_buffer ()
  (gdb) bt full
  #0  0xffffffff in code_gen_buffer ()
  #1  0x56710cf6 in cpu_exec (itb=<optimized out>, cpu=<optimized out>) at 
/dev/shm/qemu/accel/tcg/cpu-exec.c:173
          env = <optimized out>
          ret = <optimized out>
          last_tb = <optimized out>
          tb_exit = <optimized out>
          tb_ptr = 0xf26c2cc0 <code_gen_buffer+103976094> "‹]ш…Ы\017ЊБ\020"
          ret = 0
          insns_left = <optimized out>
          cflags = <optimized out>
          tb = 0x5722fe58
          last_tb = <optimized out>
          tb_exit = <optimized out>
          cc = <optimized out>
          __func__ = "cpu_exec"
          ret = <optimized out>
          sc = <optimized out>
  #2  0x56710cf6 in cpu_exec (tb_exit=<synthetic pointer>, last_tb=<synthetic 
pointer>, tb=<optimized out>, cpu=<optimized out>) at 
/dev/shm/qemu/accel/tcg/cpu-exec.c:621
          ret = 0
          insns_left = <optimized out>
          cflags = <optimized out>
          tb = 0x5722fe58
          last_tb = <optimized out>
          tb_exit = <optimized out>
          cc = <optimized out>
          __func__ = "cpu_exec"
          ret = <optimized out>
          sc = <optimized out>
  #3  0x56710cf6 in cpu_exec (cpu=0x573db8f8) at 
/dev/shm/qemu/accel/tcg/cpu-exec.c:732
          cflags = <optimized out>
          tb = 0x5722fe58
          last_tb = <optimized out>
          tb_exit = <optimized out>
          cc = <optimized out>
          __func__ = "cpu_exec"
          ret = <optimized out>
          sc = <optimized out>
  #4  0x566cfade in tcg_cpu_exec (cpu=0x573db8f8) at /dev/shm/qemu/cpus.c:1435
          ret = <optimized out>
  #5  0x566d1e6d in qemu_tcg_rr_cpu_thread_fn (arg=0x573db8f8) at 
/dev/shm/qemu/cpus.c:1537
          r = <optimized out>
          cpu = 0x573db8f8
          __PRETTY_FUNCTION__ = "qemu_tcg_rr_cpu_thread_fn"
  #6  0x56b56fe0 in qemu_thread_start (args=0x57400668) at 
util/qemu-thread-posix.c:502
          __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {1461911128, 
1463813736, 1461911128, -333745816, 247778263, 1392237730}, __mask_was_saved = 
0}}, __pad = {0xec1b70d0, 0x0, 0x0, 0x0}}
          __cancel_routine = 0x56b57040 <qemu_thread_atexit_notify>
          __not_first_call = <optimized out>
          qemu_thread_args = 0x57400668
          start_routine = 0x566d1a30 <qemu_tcg_rr_cpu_thread_fn>
          arg = 0x573db8f8
          r = <optimized out>
  #7  0xffffffff in start_thread () at /lib/libpthread.so.0
  #8  0xffffffff in clone () at /lib/libc.so.6
  (gdb) quit
  A debugging session is active.

          Inferior 1 [process 8096] will be killed.

  Quit anyway? (y or n) y
  --------------copy end----------

  But when I take away -display sdl, or replace it with -display gtk -
  same line was booting to desktop!

  Changing cpu to G3 also allowed boot:

  ./ppc-softmmu/qemu-system-ppc -M mac99,via=pmu -L ../queue-vga/pc-bios
  -cdrom /mnt/sdb1/PPC-img/lubuntu-16.04-desktop-powerpc.iso -m 512
  -display sdl -vga std -d guest_errors,unimp -boot d -cpu G3 -g
  1024x768x24 -device ES1370

  This is 32-bit qemu complied with Slackware's gcc 5.5.0. 
  64-bit qemu works fine.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1837049/+subscriptions