qemu-system-ppc segfaults when booting from Debian lenny netinst image

[Ian Sealy]

I get a segfault from qemu-system-ppc when booting from the Debian lenny netinst image. I'm using QEMU 0.12.3. The host machine (on which QEMU was compiled) is:

[iansealy@zebra]~$ uname -a
Linux zebra 2.6.31-20-generic #57-Ubuntu SMP Mon Feb 8 09:02:26 UTC 2010 x86_64 GNU/Linux

A gdb trace is below. Any other info I can provide?

[iansealy@zebra]~$ gdb --args ~/packages/qemu/bin/qemu-system-ppc -hda debian-lenny-powerpc.img -cdrom debian-504-powerpc-netinst.iso -boot d
GNU gdb (GDB) 7.0-ubuntu
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/iansealy/packages/qemu-0.12.3/bin/qemu-system-ppc...done.
(gdb) run
Starting program: /home/iansealy/packages/qemu-0.12.3/bin/qemu-system-ppc -hda debian-lenny-powerpc.img -cdrom debian-504-powerpc-netinst.iso -boot d
[Thread debugging using libthread_db enabled]
[New Thread 0x7fffe77e2910 (LWP 9230)]

Program received signal SIGUSR2, User defined signal 2.
0x0000000000553c81 in check_regs (s=0xcb6f40) at /home/iansealy/src/qemu-0.12.3/tcg/tcg.c:1296
1296 if (ts->val_type == TEMP_VAL_REG &&
(gdb) bt
#0 0x0000000000553c81 in check_regs (s=0xcb6f40) at /home/iansealy/src/qemu-0.12.3/tcg/tcg.c:1296
#1 0x0000000000555aee in tcg_gen_code_common (s=0xcb6f40, gen_code_buf=0x417f4db0 "A\213ntH\213݁ü\005", search_pc=-1)
    at /home/iansealy/src/qemu-0.12.3/tcg/tcg.c:1994
#2 0x0000000000555b2a in tcg_gen_code (s=0xcb6f40, gen_code_buf=0x417f4db0 "A\213ntH\213݁ü\005") at /home/iansealy/src/qemu-0.12.3/tcg/tcg.c:2017
#3 0x0000000000513f09 in cpu_ppc_gen_code (env=0xcf81d0, tb=0x7ffff1afdd00, gen_code_size_ptr=0x7fffffffdd80)
    at /home/iansealy/src/qemu-0.12.3/translate-all.c:120
#4 0x000000000050e011 in tb_gen_code (env=0xcf81d0, pc=3223273620, cs_base=0, flags=0, cflags=0) at /home/iansealy/src/qemu-0.12.3/exec.c:899
#5 0x00000000005147c2 in tb_find_slow (pc=3223273620, cs_base=0, flags=0) at /home/iansealy/src/qemu-0.12.3/cpu-exec.c:164
#6 0x00000000005148c8 in tb_find_fast () at /home/iansealy/src/qemu-0.12.3/cpu-exec.c:185
#7 0x0000000000514c0f in cpu_ppc_exec (env1=0xcf81d0) at /home/iansealy/src/qemu-0.12.3/cpu-exec.c:582
#8 0x000000000040c7ce in qemu_cpu_exec (env=0xcf81d0) at /home/iansealy/src/qemu-0.12.3/vl.c:4021
#9 0x000000000040c8b3 in tcg_cpu_exec () at /home/iansealy/src/qemu-0.12.3/vl.c:4050
#10 0x000000000040cb81 in main_loop () at /home/iansealy/src/qemu-0.12.3/vl.c:4168
#11 0x00000000004107de in main (argc=7, argv=0x7fffffffe2c8, envp=0x7fffffffe308) at /home/iansealy/src/qemu-0.12.3/vl.c:6125
(gdb) c
Continuing.
[Thread 0x7fffe77e2910 (LWP 9230) exited]

Program received signal SIGSEGV, Segmentation fault.
0x0000000000442961 in bmdma_readb (opaque=0xd278c8, addr=1793) at /home/iansealy/src/qemu-0.12.3/hw/ide/cmd646.c:91
91 val = pci_dev->dev.config[MRDMODE];
(gdb) bt
#0 0x0000000000442961 in bmdma_readb (opaque=0xd278c8, addr=1793) at /home/iansealy/src/qemu-0.12.3/hw/ide/cmd646.c:91
#1 0x00000000004a87b4 in ioport_read (index=0, address=1793) at ioport.c:67
#2 0x00000000004a8c15 in cpu_inb (addr=1793) at ioport.c:216
#3 0x00000000004261b2 in isa_mmio_readb (opaque=0x0, addr=1793) at /home/iansealy/src/qemu-0.12.3/hw/isa_mmio.c:56
#4 0x00000000005728f8 in io_readb (physaddr=1793, addr=4276688641, retaddr=0x40ded3dd) at /home/iansealy/src/qemu-0.12.3/softmmu_template.h:68
#5 0x00000000005729b4 in __ldb_mmu (addr=4276688641, mmu_idx=1) at /home/iansealy/src/qemu-0.12.3/softmmu_template.h:103
#6 0x0000000040ded3de in ?? ()
#7 0x00007fffffffddf0 in ?? ()
#8 0x00000000005147d9 in tb_find_slow (pc=Cannot access memory at address 0xfee90fbd
) at /home/iansealy/src/qemu-0.12.3/cpu-exec.c:168
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb) c
Continuing.

Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.

[Natalia Portillo (claunia)]

I confirm this is happening in QEMU 0.12.4.

[Ian Sealy (iansealy)]

I just tried this again with the latest git master and it worked fine. Excellent.

[Aurelien Jarno (aurel32)]

It has been fixed by commit 90228ee395b71cdd64e6bc844e3d553eb9ef643f