diff options
Diffstat (limited to '')
| -rw-r--r-- | results/classifier/105/other/1680 | 115 | ||||
| -rw-r--r-- | results/classifier/105/other/1680991 | 175 |
2 files changed, 290 insertions, 0 deletions
diff --git a/results/classifier/105/other/1680 b/results/classifier/105/other/1680 new file mode 100644 index 000000000..0bea338dd --- /dev/null +++ b/results/classifier/105/other/1680 @@ -0,0 +1,115 @@ +other: 0.528 +KVM: 0.461 +graphic: 0.428 +device: 0.399 +instruction: 0.343 +boot: 0.328 +mistranslation: 0.327 +vnc: 0.310 +semantic: 0.299 +assembly: 0.292 +network: 0.266 +socket: 0.265 + +qemu-system-x86_64: ../softmmu/memory.c:1111: memory_region_transaction_commit: Assertion `qemu_mutex_iothread_locked()' failed. +Description of problem: +While testing master build, I have the following crash on shutdown of the VM: +qemu-system-x86_64: ../softmmu/memory.c:1111: memory_region_transaction_commit: Assertion `qemu_mutex_iothread_locked()' failed. +Steps to reproduce: +1. Run VM +2. Once booted, do poweroff inside the Linux VM +3. When poweroff completes, qemu crashes. +Additional information: +```(gdb) bt full +#0 0x00007ffff29edacf in raise () at /lib64/libc.so.6 +#1 0x00007ffff29c0ea5 in abort () at /lib64/libc.so.6 +#2 0x00007ffff29c0d79 in _nl_load_domain.cold.0 () at /lib64/libc.so.6 +#3 0x00007ffff29e6426 in () at /lib64/libc.so.6 +#4 0x0000555555bed6d3 in memory_region_transaction_commit () at ../softmmu/memory.c:1111 + as = <optimized out> + __PRETTY_FUNCTION__ = "memory_region_transaction_commit" +#5 0x0000555555bef2bf in memory_region_add_eventfd (mr=mr@entry=0x555557c318a0, addr=<optimized out>, size=size@entry=0, match_data=<optimized out>, data=<optimized out>, e=<optimized out>) at ../softmmu/memory.c:2583 + mrfd = {addr = {start = 0, size = 0}, match_data = false, data = 0, e = 0x555557c41aa4} + i = <optimized out> +#6 0x0000555555a2c85c in virtio_pci_ioeventfd_assign (d=0x555557c30a00, notifier=0x555557c41aa4, n=0, assign=<optimized out>) at ../hw/virtio/virtio-pci.c:347 + proxy = 0x555557c30a00 + vdev = <optimized out> + vq = <optimized out> + legacy = true + modern = <optimized out> + fast_mmio = true + modern_pio = false + modern_mr = <optimized out> + modern_notify_mr = 0x555557c319c0 + legacy_mr = 0x555557c31430 + modern_addr = <optimized out> +#7 0x0000555555a2be78 in virtio_bus_set_host_notifier (bus=0x555557c38d50, n=n@entry=0, assign=assign@entry=true) at ../hw/virtio/virtio-bus.c:296 + vdev = <optimized out> + k = 0x555556a7b620 + proxy = 0x555557c30a00 + vq = 0x555557c41a30 + notifier = 0x555557c41aa4 + r = <optimized out> + __func__ = "virtio_bus_set_host_notifier" +#8 0x0000555555ba1595 in virtio_scsi_set_host_notifier (s=s@entry=0x555557c38dd0, n=n@entry=0, vq=<optimized out>) at /root/qemu/include/hw/virtio/virtio-bus.h:35 + qbus = <optimized out> + rc = <optimized out> +#9 0x0000555555ba1860 in virtio_scsi_dataplane_start (vdev=<optimized out>) at ../hw/scsi/virtio-scsi-dataplane.c:130 + i = <optimized out> + rc = <optimized out> + vq_init_count = 0 + qbus = 0x555557c38d50 + k = 0x555556a7b620 + vs = 0x555557c38dd0 + s = 0x555557c38dd0 +#10 0x0000555555a2bbd2 in virtio_bus_start_ioeventfd (bus=0x555557c38d50) at ../hw/virtio/virtio-bus.c:236 + k = <optimized out> + proxy = 0x555557c30a00 + vdev = 0x555557c38dd0 + vdc = 0x555556a19cc0 + r = <optimized out> + __func__ = "virtio_bus_start_ioeventfd" +#11 0x0000555555bc0739 in virtio_device_start_ioeventfd (vdev=vdev@entry=0x555557c38dd0) at ../hw/virtio/virtio.c:3741 + qbus = <optimized out> + vbus = <optimized out> +#12 0x0000555555b9fc80 in virtio_scsi_defer_to_dataplane (s=0x555557c38dd0) at ../hw/scsi/virtio-scsi.c:614 + s = 0x555557c38dd0 +#13 0x0000555555b9fc80 in virtio_scsi_defer_to_dataplane (s=0x555557c38dd0) at ../hw/scsi/virtio-scsi.c:608 + s = 0x555557c38dd0 +#14 0x0000555555b9fc80 in virtio_scsi_handle_event (vdev=<optimized out>, vq=<optimized out>) at ../hw/scsi/virtio-scsi.c:1011 + s = 0x555557c38dd0 +#15 0x0000555555bba2af in virtio_queue_notify_vq (vq=0x555557c41ac8) at ../hw/virtio/virtio.c:2248 + vdev = 0x555557c38dd0 +#16 0x0000555555de7b08 in aio_dispatch_handler (ctx=ctx@entry=0x555556c2c130, node=0x555557ffbff0) at ../util/aio-posix.c:356 + progress = false + poll_ready = true + revents = <optimized out> +#17 0x0000555555de861c in aio_dispatch_ready_handlers (ready_list=0x7fffde952fe8, ctx=0x555556c2c130) at ../util/aio-posix.c:401 + progress = false + node = <optimized out> + ready_list = {lh_first = 0x0} + progress = true + use_notify_me = <optimized out> + timeout = <optimized out> + start = <optimized out> + __PRETTY_FUNCTION__ = "aio_poll" +#18 0x0000555555de861c in aio_poll (ctx=0x555556c2c130, blocking=blocking@entry=true) at ../util/aio-posix.c:723 + ready_list = {lh_first = 0x0} + progress = true + use_notify_me = <optimized out> + timeout = <optimized out> + start = <optimized out> + __PRETTY_FUNCTION__ = "aio_poll" +#19 0x0000555555ca9ae6 in iothread_run (opaque=opaque@entry=0x555556943200) at ../iothread.c:63 + iothread = 0x555556943200 +#20 0x0000555555deaf6a in qemu_thread_start (args=<optimized out>) at ../util/qemu-thread-posix.c:541 + __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {93825016192880, 1094026140696841148, 140737488341294, 140737488341295, 140737488341440, 140736927707584, 6520036150746942396, 1094028099712322492}, __mask_was_saved = 0}}, __pad = {0x7fffde953110, 0x0, 0x0, 0x0}} + __cancel_routine = 0x555555deafc0 <qemu_thread_atexit_notify> + __not_first_call = <optimized out> + qemu_thread_args = <optimized out> + start_routine = 0x555555ca9aa0 <iothread_run> + arg = 0x555556943200 + r = <optimized out> +#21 0x00007ffff2d6c1ca in start_thread () at /lib64/libpthread.so.0 +#22 0x00007ffff29d8e73 in clone () at /lib64/libc.so.6 +``` diff --git a/results/classifier/105/other/1680991 b/results/classifier/105/other/1680991 new file mode 100644 index 000000000..faf4d8741 --- /dev/null +++ b/results/classifier/105/other/1680991 @@ -0,0 +1,175 @@ +other: 0.923 +device: 0.896 +instruction: 0.892 +mistranslation: 0.890 +graphic: 0.887 +assembly: 0.878 +semantic: 0.834 +socket: 0.795 +vnc: 0.783 +network: 0.762 +boot: 0.752 +KVM: 0.748 + +raspi2: system timer device not implemented + +In a small hobby kernel for Raspberry Pi 2B, I am using the system timer to control wait durations. This timer is located at 0x3f003000 and the timer counts are located at 0x3f003004 (CLO) and 0x3f004008 (CHI). Reading these memory locations returns 0 for both. + +The basic code for this function is: +@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +@@ uint64_t ReadSysTimerCount() -- read the system time running count +@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ +ReadSysTimerCount: + ldr r0,=ST_CLO @ load the base address of the system timer + ldrd r0,r1,[r0] @ Get the 64-bit timer "count" into r1:r0 + mov pc,lr @ return + +Tracing back the definition of ST_CLO in my code: +#define ST_CLO (ST_BASE+4) // Counter Lower 32 bits +#define ST_BASE (HW_BASE+0x3000) // System Timer base address +#define HW_BASE (0x3f000000) // this is the base address for all hardware I/O addresses + +I have tested a similar program that I know to work on real hardware with qemu-system-arm reading the same mmio register and have the same issue, so I'm pretty sure the issue is not with my code. + +My Host PC is a VM on vmWare esxi running FC25 (8 cores, 8GB RAM): +[adam@os-dev ~]$ uname -a +Linux os-dev.jammin 4.10.8-200.fc25.x86_64 #1 SMP Fri Mar 31 13:20:22 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux + +I have confirmed this issue on QEMU 2.7.1 (fc25 Distro) and 2.9.0-rc3 (git). + +adam@os-dev ~]$ qemu-system-arm --version +QEMU emulator version 2.7.1(qemu-2.7.1-4.fc25), Copyright (c) 2003-2016 Fabrice Bellard and the QEMU Project developers + +[adam@os-dev ~]$ ./workspace/qemu/bin/debug/native/arm-softmmu/qemu-system-arm --version +QEMU emulator version 2.8.93 (v2.9.0-rc3-15-g5daf9b3) +Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers + +A remote debugger for my kernel shows the following: +(gdb) info reg +r0 0x0 0 +r1 0x0 0 +r2 0x96 150 +r3 0x0 0 +r4 0xa000 40960 +r5 0x0 0 +r6 0x0 0 +r7 0x0 0 +r8 0x0 0 +r9 0xa000 40960 +r10 0x0 0 +r11 0x7fdc 32732 +r12 0x0 0 +sp 0x7fc8 0x7fc8 +lr 0x8194 33172 +pc 0x80a4 0x80a4 +cpsr 0x800001d3 -2147483181 +(gdb) stepi +0x000080a8 in ?? () +(gdb) info reg +r0 0x3f003004 1056976900 +r1 0x0 0 +r2 0x96 150 +r3 0x0 0 +r4 0xa000 40960 +r5 0x0 0 +r6 0x0 0 +r7 0x0 0 +r8 0x0 0 +r9 0xa000 40960 +r10 0x0 0 +r11 0x7fdc 32732 +r12 0x0 0 +sp 0x7fc8 0x7fc8 +lr 0x8194 33172 +pc 0x80a8 0x80a8 +cpsr 0x800001d3 -2147483181 +(gdb) stepi +0x000080ac in ?? () +(gdb) info reg +r0 0x0 0 +r1 0x0 0 +r2 0x96 150 +r3 0x0 0 +r4 0xa000 40960 +r5 0x0 0 +r6 0x0 0 +r7 0x0 0 +r8 0x0 0 +r9 0xa000 40960 +r10 0x0 0 +r11 0x7fdc 32732 +r12 0x0 0 +sp 0x7fc8 0x7fc8 +lr 0x8194 33172 +pc 0x80ac 0x80ac +cpsr 0x800001d3 -2147483181 + +Notice r0 is loaded with the address for CLO and then cleared with 0 when read. + +I am writing my code against the documented specifications in "BCM2835 ARM Peripherals" (attached for convenience), section "12 System Timer". + + +Please let me know if you need anything else from me. + + + +The command lines are: + +[adam@os-dev ~]$ qemu-system-aarch64 -m 256 -M raspi2 -serial stdio -kernel bin/rpi2b/kernel.elf + +[adam@os-dev workspace]$ ./qemu/bin/debug/native/arm-softmmu/qemu-system-arm -m 256 -M raspi2 -serial stdio -kernel century/bin/rpi2b/kernel.elf + + +A sample kernel is also attached for your convenience. + +The raspi2 board model is only partial, and is missing various devices that weren't used by the test images that it was tested with (mostly Windows-for-Arm, I think). The "system timer" is one of the devices that hasn't been implemented, which is why the memory locations where it should be just read-as-zero. + + +Is anybody still working on the raspi2 model? If not, shall we close this as WontFix? + +The timer has been implemented, see commits: +d05be883fc9 ("hw/timer/bcm2835: Add the BCM2835 SYS_timer") +0e5bbd74064 ("hw/arm/bcm2835_peripherals: Use the SYS_timer") +722bde6789c ("hw/arm/bcm2835_peripherals: Correctly wire the SYS_timer IRQs") + +Running the attached test with "-trace bcm2835_systmr_read" produces: +1634226@1605697958.837194:bcm2835_systmr_read timer read: offset 0x4 data 0x7cfc +1634226@1605697958.837229:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837313:bcm2835_systmr_read timer read: offset 0x4 data 0x7d73 +1634226@1605697958.837323:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837439:bcm2835_systmr_read timer read: offset 0x4 data 0x7df1 +1634226@1605697958.837454:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837553:bcm2835_systmr_read timer read: offset 0x4 data 0x7e64 +1634226@1605697958.837561:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837568:bcm2835_systmr_read timer read: offset 0x4 data 0x7e73 +1634226@1605697958.837574:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837578:bcm2835_systmr_read timer read: offset 0x4 data 0x7e7d +1634226@1605697958.837582:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837586:bcm2835_systmr_read timer read: offset 0x4 data 0x7e85 +1634226@1605697958.837590:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837594:bcm2835_systmr_read timer read: offset 0x4 data 0x7e8d +1634226@1605697958.837598:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837602:bcm2835_systmr_read timer read: offset 0x4 data 0x7e95 +1634226@1605697958.837606:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837611:bcm2835_systmr_read timer read: offset 0x4 data 0x7e9e +1634226@1605697958.837616:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837621:bcm2835_systmr_read timer read: offset 0x4 data 0x7ea7 +1634226@1605697958.837625:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837629:bcm2835_systmr_read timer read: offset 0x4 data 0x7eaf +1634226@1605697958.837634:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837640:bcm2835_systmr_read timer read: offset 0x4 data 0x7ebb +1634226@1605697958.837646:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837653:bcm2835_systmr_read timer read: offset 0x4 data 0x7ec8 +1634226@1605697958.837666:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837673:bcm2835_systmr_read timer read: offset 0x4 data 0x7edc +1634226@1605697958.837679:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837685:bcm2835_systmr_read timer read: offset 0x4 data 0x7ee7 +1634226@1605697958.837690:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837696:bcm2835_systmr_read timer read: offset 0x4 data 0x7ef2 +1634226@1605697958.837707:bcm2835_systmr_read timer read: offset 0x8 data 0x0 +1634226@1605697958.837713:bcm2835_systmr_read timer read: offset 0x4 data 0x7f03 +1634226@1605697958.837717:bcm2835_systmr_read timer read: offset 0x8 data 0x0 + + +Released with QEMU v5.2.0. + |