qemu 1.0-rc4 no longer able to boot NetBSD-current/i386

[Andreas Gustafsson]

Booting a NetBSD-current/i386 install CD using qemu 1.0-rc4 fails. The same CD does boot in earlier versions of qemu, for example, 0.11.0.

To reproduce, download the

  http://www.gson.org/netbsd/bugs/qemu/boot-com-201111270050Z.iso

and attempt to boot it with:

  qemu -nographic -cdrom boot-com-201111270050Z.iso

This fails with a guest kernel panic:

  NetBSD 5.99.57 (GENERIC) #0: Sun Nov 27 07:41:56 UTC 2011
          <email address hidden>:/home/builds/ab/HEAD/i386/201111270050Z-obj/home/builds/ab/HEAD/src/sys/arch/i386/compile/GENERIC
  total memory = 127 MB
  avail memory = 112 MB
  cprng kernel: WARNING insufficient entropy at creation.
  mainbus0 (root)
  cpu0 at mainbus0 apid 0: QEMU Virtual CPU version 0.15.93, id 0x633
  ioapic0 at mainbus0 apid 1
  acpi0 at mainbus0: Intel ACPICA 20110623
  panic: pci_make_tag: bad request
  fatal breakpoint trap in supervisor mode
  trap type 1 code 0 eip c0269b04 cs 8 eflags 282 cr2 0 ilevel 8
  Stopped in pid 0.1 (system) at netbsd:breakpoint+0x4: popl %ebp
  db{0}> t
  breakpoint(c0c04c75,c0cc2f80,c0bc91a4,c0e358e4,2,c11b70d6,c0e35908,c053999d,c0cdef20,0) at netbsd:breakpoint+0x4
  vpanic(c0bc91a4,c0e358e4,c117d068,f,c11e6fcc,0,c0e35918,c0665969,c0bc91a4,c0b1bf4c) at netbsd:vpanic+0x1e2
  printf_nolog(c0bc91a4,c0b1bf4c,c0e35908,c010d957,8,c0c1f2c0,0,0,c0d08e20,0) at netbsd:printf_nolog
  pci_decompose_tag(c0e3599c,0,0,10,0,ca675898,c0e35988,c0d08e20,c11b9200,0) at netbsd:pci_decompose_tag
  acpi_pci_link_add_reference(c12011c0,0,0,10,0,ca41eb90,0,3,0,4) at netbsd:acpi_pci_link_add_reference+0xb2
  mpacpi_find_interrupts(ca41eb90,c0116a4a,c0116a5e,0,ca41eb90,c0e35b50,c0e35aa8,c01180c7,c,c0116a4a) at netbsd:mpacpi_find_interrupts+0x5ea
  acpi_md_callback(c,c0116a4a,c0116a5e,0,1,ca3fd7cc,1,c078e2e4,c0cb6ce0,ca435ea0) at netbsd:acpi_md_callback+0x1c
  acpi_attach(ca660500,ca660d00,c0e35b50,0,c0e35b50,80,f,10,c0b5dcd9,c0e35b42) at netbsd:acpi_attach+0x14a
  config_attach_loc(ca660500,c0c1d7a0,0,c0e35b50,0,0,2589,58421301,4350,53445842) at netbsd:config_attach_loc+0x176
  config_found_ia(ca660500,c0b59f3c,c0e35b50,0,4f424101,20534843,80,f,c0c2bbe0,c0c2bc00) at netbsd:config_found_ia+0x36
  mainbus_rescan(ca660500,c0b59f3c,0,ca660500,c0cb6ce0,c0bd71ce,c0e35bd8,c093575c,ca437f28,c0b8e0a1) at netbsd:mainbus_rescan+0x1c2
  mainbus_attach(0,ca660500,0,c078f4b7,c0b59187,c0b59187,636f4200,7368,3001403,101) at netbsd:mainbus_attach+0xb4
  config_attach_loc(0,c0c1bbb0,0,0,0,7368,f10,0,c0b59187,e3b000) at netbsd:config_attach_loc+0x176
  config_attach(0,c0c1bbb0,0,0,1984,c0cc5680,c0e35cd8,c01f224e,c0b59187,0) at netbsd:config_attach+0x2e
  config_rootfound(c0b59187,0,0,8,1984,1984,c0e35d40,c04b78d8,c0ba59a1,6) at netbsd:config_rootfound+0x42
  cpu_configure(c0ba59a1,6,3,0,ffff,f9b00,ffff,f9300,0,0) at netbsd:cpu_configure+0x2a
  main(0,0,0,0,0,0,0,0,0,0) at netbsd:main+0x2ba
  db{0}>

[Avi Kivity (avi-redhat)]

On 11/29/2011 06:46 PM, Andreas Gustafsson wrote:
> Public bug reported:
>
> Booting a NetBSD-current/i386 install CD using qemu 1.0-rc4 fails. The
> same CD does boot in earlier versions of qemu, for example, 0.11.0.
>

Please try to find what is the last major release of qemu that did boot
this correctly.

--
error compiling committee.c: too many arguments to function

[Stefan Weil (ubuntu-weilnetz)]

Bisecting shows this commit caused the problem:

d0ed8076cbdc26138a7e33fed5e45a35d019a103 is the first bad commit
commit d0ed8076cbdc26138a7e33fed5e45a35d019a103
Author: Avi Kivity <email address hidden>
Date: Sun Jul 24 17:47:18 2011 +0300

    pci_host: convert conf index and data ports to memory API

    Reviewed-by: Richard Henderson <email address hidden>
    Signed-off-by: Avi Kivity <email address hidden>

[Andreas Gustafsson (gson)]

> Please try to find what is the last major release of qemu that did boot this correctly.

I assume this is unecessary because Stefan Weil already identified the excact commit where the problem appeared.

[Andreas Gustafsson (gson)]

I found the cause of the regression. As as Stefan Weil already figured,
it was caused by the following commit:

    commit d0ed8076cbdc26138a7e33fed5e45a35d019a103
    Author: Avi Kivity <email address hidden>
    Date: Sun Jul 24 17:47:18 2011 +0300

        pci_host: convert conf index and data ports to memory API

        Reviewed-by: Richard Henderson <email address hidden>
        Signed-off-by: Avi Kivity <email address hidden>

This commit incorrectly changed the emulation of the PCI configuration
register at I/O port 0xCF8. Before the commit, an outb to port 0xCFB
or an outw to port 0xCFA had no effect, but after the commit, they
change the value of the CONFIG_ADDRESS DWORD register at 0xCF8. This
is contrary to the behavior of real PC hardware, and contrary to the
PCI standard which clearly states that the only I/O space consumed by
the CONFIG_ADDRESS register is the DWORD at address 0xCF8.

Changing pci_host_config_write() to ignore writes with addr != 0 is
sufficient for qemu to again be able to boot NetBSD. For full
compliance with the PCI standard, it should also ignore writes with
size != 4, and a similar change should probably also be made to
pci_host_config_read().

[Michael Tokarev (mjt+launchpad-tls)]

I verified the fix posted by Avi to qemu-devel:

 http://thread.gmane.org/gmane.comp.emulators.qemu/130695

fixes the boot crash of the mentioned image (note that the provided command-line is not sufficent, since the image directs all its output to the serial port (serial console), so you have to configure a serial port to see the messages). It also does not affect - seemingly - any other functionality so far, this and a few other guests continues to work as before. It does not fix all the issues with *BSD reported for 1.0 but it is already a good start.

Thanks!

[Andreas Gustafsson (gson)]

> note that the provided command-line is not sufficent, since the image directs all its output to the serial port (serial console), so you have to configure a serial port to see the messages

That command line works as-is for me, and it's what I was told to use back when "-serial stdio -nographic" stopped working some time around qemu version 0.12.

[Andreas Gustafsson (gson)]

Fixed in cdde6ffc27517bdf069734fbc5693ce2b14edc75.