qemu-system-arm Crashes on startup on OS X 10.8.2

[Oliver]

On startup qemu-system-arm crashes on this line 9373 of target-arm

        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
                if (bp->pc == dc->pc) { // <-- CRASH !!!!
                    gen_exception_insn(dc, 0, EXCP_DEBUG);
                    /* Advance PC so that clearing the breakpoint will
                       invalidate this TB. */
                    dc->pc += 2;
                    goto done_generating;
                    break;
                }
            }

What appears to be happening is env is
(gdb) print env->breakpoints
$4 = {
  tqh_first = 0x1f001f001f001f,
  tqh_last = 0x1f001f001f001f
}

which leads to bp being set to
(gdb) print bp
$1 = (CPUBreakpoint *) 0x1f001f001f001f

This looks like a bad address and causes the following statement

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: 13 at address: 0x0000000000000000

I am wondering if the env structure is not getting setup correctly?

I am running the 1.2.0 version of qemu on
Darwin localhost 12.2.0 Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64 x86_64

[Oliver (oliverks1)]

It appears that the problem might be the value of env has changed.

All the values in env look bad and when I run

(gdb) print env
$12 = (CPUARMState *) 0x102064680

It appears env has moved. If I dump the memory at the old env location

(gdb) print *(CPUARMState *) 0x102064038

stuff looks pretty reasonable. Not sure why env would be moving?

Oliver

[Oliver (oliverks1)]

One more comment, the env address looks wrong going all the way up the stack

#0 0x0000000100436b71 in gen_intermediate_code_internal (env=0x102064680, tb=0x108e5b070, search_pc=1) at translate.c:9793
#1 0x0000000100437776 in gen_intermediate_code_pc (env=0x102064680, tb=0x108e5b070) at translate.c:9961
#2 0x000000010044539f in cpu_restore_state (tb=0x108e5b070, env=0x102064680, searched_pc=4410683708) at translate-all.c:126
#3 0x00000001003ed7b3 in tlb_fill (env1=0x102064680, addr=17328, is_write=0, mmu_idx=0, retaddr=4410683708) at op_helper.c:93
#4 0x00000001003ec14d in __ldl_mmu (addr=17328, mmu_idx=0) at softmmu_template.h:159
#5 0x0000000106e5b13d in ?? ()

Olvier

[Oliver (oliverks1)]

OK one more comment. When I look at register r14, where the env valuable should be stored, I see the "correct" value

(gdb) info register r14
r14 0x102064038 4328931384

Oliver

[Peter Maydell (pmaydell)]

Thanks for this bug report; it would be helpful if you could let us know the following info:

(1) Are you running qemu built directly from the upstream sources, or have you built this from the versions shipped by fink or similar package management system?
(2) can you give the full configure line you used to build this?
(3) which compiler (including which version) did you use?

[Oliver (oliverks1)]

Peter,

I built in from the zipped tar ball for qemu-1.2.0 I did not get it from the repository, although I am happy to do this for you.

I used

./configure

This what configure said
Silently falling back into gthread backend under darwin
....
C compiler gcc
Host C compiler gcc
Objective-C compiler clang
CFLAGS -O2 -D_FORTIFY_SOURCE=2 -g
QEMU_CFLAGS -m64 -DOS_OBJECT_USE_OBJC=0 -arch x86_64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fstack-protector-all -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wold-style-definition -I/opt/local/include/libpng15
LDFLAGS -m64 -framework CoreFoundation -framework IOKit -arch x86_64

My gcc appears to be

localhost:qemu-1.2.0 oliverks$ gcc -v
Using built-in specs.
Target: i686-apple-darwin11
Configured with: /private/var/tmp/llvmgcc42/llvmgcc42-2336.11~28/src/configure --disable-checking --enable-werror --prefix=/Applications/Xcode.app/Contents/Developer/usr/llvm-gcc-4.2 --mandir=/share/man --enable-languages=c,objc,c++,obj-c++ --program-prefix=llvm- --program-transform-name=/^[cg][^.-]*$/s/$/-4.2/ --with-slibdir=/usr/lib --build=i686-apple-darwin11 --enable-llvm=/private/var/tmp/llvmgcc42/llvmgcc42-2336.11~28/dst-llvmCore/Developer/usr/local --program-prefix=i686-apple-darwin11- --host=x86_64-apple-darwin11 --target=i686-apple-darwin11 --with-gxx-include-dir=/usr/include/c++/4.2.1
Thread model: posix
gcc version 4.2.1 (Based on Apple Inc. build 5658) (LLVM build 2336.11.00)

[Peter Maydell (pmaydell)]

Thanks. QEMU 1.2 (or earlier) won't work when built with a gcc which is really an llvm-gcc, because llvm-gcc doesn't support the "tie this variable to a specific native register" which QEMU requires. (I had hoped it would give a compile failure, but it seems to just generate wrong code.) We've actually been able to remove the fixed-register requirement in QEMU's master git tree, but those changes have not yet made it into a released version. So for now, I'm afraid you have three choices:

 (1) compile with a real gcc (not llvm-gcc or clang)
 (2) build QEMU from git master (this is living on the "bleeding edge" but it generally works OK)
 (3) wait for 1.3

[Oliver (oliverks1)]

All right that makes sense. I pulled the latest version from git, but I get a build error, so I will post a new bug.

I will let you decided how you want to mark this bug.