[Qemu-devel] [BUG] tci: Endless recursion in QEMU host while booting a Linux ISO image in the guest

[Stefan Weil]

Booting Tiny Core Linux with QEMU + TCI results in an endless recursion
at the end of the
guest's Linux boot process. The last kernel debug message (kernel
started with debug) was
"Write protecting the kernel read-only data: 980 k".

The ISO image is available from
http://tinycorelinux.net/5.x/x86/release/Core-5.1.iso.

Here is some debugger output (test was done with an older ISO image):

$ gdb --args bin/x86_64-linux-gnu,tci/x86_64-softmmu/qemu-system-x86_64
-cdrom ~/Core-5.0.2.iso -m 512M -L pc-bios

#0  0x000055555596b6b3 in cpu_x86_handle_mmu_fault (env=0x0, addr=0,
is_write1=0, mmu_idx=0)
    at /qemu/target-i386/helper.c:517

#1  0x000055555597ba0e in tlb_fill (env=0x55555631e430, addr=3226230739,
is_write=2, mmu_idx=1,
    retaddr=140736952611989) at /qemu/target-i386/mem_helper.c:140
#2  0x000055555589fe08 in helper_ret_ldb_cmmu (env=0x55555631e430,
addr=3226230739, mmu_idx=1,
    retaddr=140736952611989) at /qemu/include/exec/softmmu_template.h:156
#3  0x000055555589ff2e in helper_ldb_cmmu (env=0x55555631e430,
addr=3226230739, mmu_idx=1)
    at /qemu/include/exec/softmmu_template.h:298
#4  0x0000555555989aaf in cpu_ldub_code (env=0x55555631e430, ptr=3226230739)
    at /qemu/include/exec/softmmu_header.h:96
#5  0x00005555559ac466 in disas_insn (env=0x55555631e430,
s=0x7fffd740a380, pc_start=3226230739)
    at /qemu/target-i386/translate.c:4695
#6  0x00005555559b7eab in gen_intermediate_code_internal
(cpu=0x55555631e2f0, tb=0x7fffd86b6af0,
    search_pc=true) at /qemu/target-i386/translate.c:8397
#7  0x00005555559b823c in gen_intermediate_code_pc (env=0x55555631e430,
tb=0x7fffd86b6af0)
    at /qemu/target-i386/translate.c:8468
#8  0x00005555559c8fed in cpu_restore_state_from_tb (tb=0x7fffd86b6af0,
env=0x55555631e430,
    searched_pc=140736952611989) at /qemu/translate-all.c:211
#9  0x00005555559c9171 in cpu_restore_state (env=0x55555631e430,
retaddr=140736952611989)
    at /qemu/translate-all.c:257

# The last 9 stack frames are repeated starting from here.

#10 0x000055555597ba31 in tlb_fill (env=0x55555631e430, addr=3226230739,
is_write=2, mmu_idx=1,
    retaddr=140736952611989) at /qemu/target-i386/mem_helper.c:144
#11 0x000055555589fe08 in helper_ret_ldb_cmmu (env=0x55555631e430,
addr=3226230739, mmu_idx=1,
    retaddr=140736952611989) at /qemu/include/exec/softmmu_template.h:156
#12 0x000055555589ff2e in helper_ldb_cmmu (env=0x55555631e430,
addr=3226230739, mmu_idx=1)
    at /qemu/include/exec/softmmu_template.h:298
#13 0x0000555555989aaf in cpu_ldub_code (env=0x55555631e430, ptr=3226230739)
    at /qemu/include/exec/softmmu_header.h:96
#14 0x00005555559ac466 in disas_insn (env=0x55555631e430,
s=0x7fffd740a7f0, pc_start=3226230739)
...

Several thousands of stack frames follow, and QEMU terminates with a
SIGSEGV of course.
Without TCG interpreter, the guest works fine.

I'd be glad to get some help to solve this problem.

Regards,
Stefan Weil