Bug in Qemu User Mode
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
New
|
Undecided
|
Unassigned |
Bug Description
Hi,
I make an interesting discovery.
My aim is to have a working qemu-i386 on Raspberry Pi.
After long searching in the dark what goes wrong with ANY Qemu version for User Mode until today,
I find the following: The bug must be in at least one function, that the program testclone
from the testpackage for i386 in linux-user-test-0.3 calls.
The wrong function is in the part, which enables more than one thread at the same time, NPTL.
Funny, how I find this out: All the programs from the tests in linux-user-test-0.3 I can now run succesfull with my new builded qemu-i386 for Raspi.
But the program testclone does not stop after it gives out all the right messages.
The program testclone stops on my Desktop computer with Debian Wheezy installed.
So, the error is not in the program testclone.
So I make a look, what is going on there with strace. With strace you get informations about all the values in the working program, here testclone.
I see, that the reason, why testclone not stops is in an infinite loop because of
while (waitpid(pid1, &status1, 0) != pid1);
while (waitpid(pid2, &status2, 0) != pid2);
at its end is never fullfilled.
This is the reason for the famous error message from Qemu User Mode
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Segmentation fault
stack1 = malloc(STACK_SIZE);
pid1 = clone(thread1_func, stack1 + STACK_SIZE,
CLONE_VM | CLONE_FS | CLONE_FILES | SIGCHLD, "hello1");
stack2 = malloc(STACK_SIZE);
pid2 = clone(thread2_func, stack2 + STACK_SIZE,
CLONE_VM | CLONE_FS | CLONE_FILES | SIGCHLD, "hello2");
The error happens early in the program testclone. Strace says, it is because no childprocess at all can be found. So, some basiccalculations in those four lines must be done wrong from Qemu.
I think, that the adressspace for each thread is calculated wrong, or overlapps.
Funny, it has nothing to do with the ARM processor. I get exact the same errormessages, when I run the program testclone on my desktopcompi i386 with a Wheezy in Qemu and then qemu-i386 testclone.
This is a good message, because it means it is an error, that belongs at least to the i386 family but I think, every processor in Qemu User Mode is involved, so until now NPTL does not work.
Today I make a hand by hand calculation with the source code from testclone and compare it with the values, that Qemu User Mode give. The handcalculated values should be the same which my
Desktop computer with Wheezy with tesclone produces, but who knows,
Dietmar
PS: I hope, that this is the right source code for testclone. Any help is welcome:-)!
Code: Select all
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <signal.h>
#include <unistd.h>
#include <inttypes.h>
#include <pthread.h>
#include <sys/wait.h>
#include <sched.h>
int thread1_func(void *arg)
{
int i;
char buf[512];
for(
write(1, buf, strlen(buf));
usleep(100 * 1000);
}
return 0;
}
int thread2_func(void *arg)
{
int i;
char buf[512];
for(
write(1, buf, strlen(buf));
usleep(120 * 1000);
}
return 0;
}
#define STACK_SIZE 16384
void test_clone(void)
{
uint8_t *stack1, *stack2;
int pid1, pid2, status1, status2;
stack1 = malloc(STACK_SIZE);
pid1 = clone(thread1_func, stack1 + STACK_SIZE,
stack2 = malloc(STACK_SIZE);
pid2 = clone(thread2_func, stack2 + STACK_SIZE,
while (waitpid(pid1, &status1, 0) != pid1);
while (waitpid(pid2, &status2, 0) != pid2);
printf(
printf(
printf("End of clone test.\n");
}
int main(int argc, char **argv)
{
test_clone();
return 0;
}
Posts: 210
Joined: 04 Sep 2011 17:43
I just compiled the testclone new on debian Wheezy,
for to understand what is going on and name it clonemi.
Before I have always an endless loop on Raspberry Pi
because waitpid was never fullfilled.
So I commened the two waitpid lines out.
Also I enlarged the STACK_SIZE to 262144.
Enlarging of the stack does not help. But now the Raspberry Pi with
qemu-1386 -strace clonemi
showed the following output:
root@raspberryp i:/home/ pi/raspidev# qemu-i386 clonemi
thread2: 0 hello2
thread1: 0 hello1
status1=0x80487ab
status2=0x42fd4788
End of clone test.
root@raspberryp i:/home/ pi/raspidev# qemu-i386 -strace clonemi "/etc/ld. so.nohwcap" ,F_OK) = -1 errno=2 (No such file or directory) 8192,PROT_ READ|PROT_ WRITE,MAP_ PRIVATE| MAP_ANONYMOUS, -1,0) = 0x43088000 "/etc/ld. so.preload" ,R_OK) = -1 errno=2 (No such file or directory) etc/ld. so.cache" ,O_RDONLY) = 3 3,0x42fcb184) = 0 7566,PROT_ READ,MAP_ PRIVATE, 3,0) = 0x4308a000 lib/libc. so.6",O_ RDONLY) = 3 0x42fcb2b8, 512) = 512 3,0x42fcb1d8) = 0 1345848, PROT_EXEC| PROT_READ, MAP_PRIVATE| MAP_DENYWRITE, 3,0) = 0x4308c000 0x431ce000, 4096,PROT_ NONE) = 0 0,12288, PROT_READ| PROT_WRITE, MAP_PRIVATE| MAP_DENYWRITE| MAP_FIXED, 3,0x142) = 0x431cf000 0,10552, PROT_READ| PROT_WRITE, MAP_PRIVATE| MAP_ANONYMOUS| MAP_FIXED, -1,0) = 0x431d2000 4096,PROT_ READ|PROT_ WRITE,MAP_ PRIVATE| MAP_ANONYMOUS, -1,0) = 0x431d5000 area(1123858048 ,1124618228, 1125996224, 1,0,1123858076) = 0 0x431cf000, 8192,PROT_ READ) = 0 0x43084000, 4096,PROT_ READ) = 0 0x4308a000, 7566) = 0 266240, PROT_READ| PROT_WRITE, MAP_PRIVATE| MAP_ANONYMOUS, -1,0) = 0x431d6000 VM|CLONE_ FS|CLONE_ FILES|0x11, child_stack= 0x43215fe4, parent_ tidptr= 0x43076590, tls=0x08049a34, child_tidptr= 0x42fcb788) = 1584 266240, PROT_READ| PROT_WRITE, MAP_PRIVATE| MAP_ANONYMOUS, -1,0) = 0x43303000 VM|CLONE_ FS|CLONE_ FILES|0x11, child_stack= 0x43342fe4, parent_ tidptr= 0x43076590, tls=0x08049a34, child_tidptr= 0x42fcb788) = 1585 1,0x42fcb09c) = 0 4096,PROT_ READ|PROT_ WRITE,MAP_ PRIVATE| MAP_ANONYMOUS, -1,0) = 0x43344000 0x43342ddc, 18)thread2: 0 hello2 0x43215ddc, 18)thread1: 0 hello1 1126260128, 0,134514044, 0,1809, 1126260136) 1583 nanosleep( 1127493024, 0,134514175, 0,1809, 1127493032) 1583 write(1, 0x43344000, 18)status1= 0x80487ab 0x43344000, 19)status2= 0x42fcb788 0x43344000, 19)End of clone test. i:/home/ pi/raspidev#
1583 brk(NULL) = 0x0804a000
1583 uname(0x42fcb4ca) = 0
1583 access(
1583 mmap2(NULL,
1583 access(
1583 open("/
1583 fstat64(
1583 mmap2(NULL,
1583 close(3) = 0
1583 open("/
1583 read(3,
1583 fstat64(
1583 mmap2(NULL,
1583 mprotect(
1583 mmap2(0x431cf00
1583 mmap2(0x431d200
1583 close(3) = 0
1583 mmap2(NULL,
1583 set_thread_
1583 mprotect(
1583 mprotect(
1583 munmap(
1583 mmap2(NULL,
1583 clone(CLONE_
1583 mmap2(NULL,
1583 clone(CLONE_
1583 fstat64(
1583 mmap2(NULL,
1583 write(1,
= 18
1583 write(1,
= 18
1583 nanosleep(
= 18
1583 write(1,
= 19
1583 write(1,
= 19
1583 exit_group(0)
root@raspberryp
You can see, that 0x43215fe4, parent_ tidptr= 0x43076590
child_stack=
is unequal.
Is this the mistake?
Nice to hear from you,
Dietmar