Re: [PULL 00/31] testing/next and other misc fixes

[Alex Bennée]

Alex Bennée <alex.bennee@linaro.org> writes:

> Peter Maydell <peter.maydell@linaro.org> writes:
>
> (adding the s390x people to the CC if they have any clues)
>
>> On Wed, 12 Jan 2022 at 11:27, Alex Bennée <alex.bennee@linaro.org> wrote:
>>>
>>> The following changes since commit bf99e0ec9a51976868d7a8334620716df15fe7fe:
>>>
>>>   Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging 
>>> (2022-01-11 10:12:29 +0000)
>>>
>>> are available in the Git repository at:
>>>
>>>   https://github.com/stsquad/qemu.git tags/pull-for-7.0-110122-1
>>>
>>> for you to fetch changes up to dbd30b7abee963f4fb08892a7d7f920bb76ece58:
>>>
>>>   linux-user: Remove the deprecated ppc64abi32 target (2022-01-11 13:00:53 
>>> +0000)
>>>
> <snip>
>> This seems to fail the ubuntu-18.04-s390x-all-linux-static job
>> with segfaults running linux-user binaries (not always the same
>> binary), eg:
>> https://gitlab.com/qemu-project/qemu/-/jobs/1968789446
>> https://gitlab.com/qemu-project/qemu/-/jobs/1968080419
>
> *sigh*
>
> So the regression is caused by:
>
>   linux-user: don't adjust base of found hole
>
> However it only occurs when pgb_static starts base at a low address. For
> example:
>
>   pgb_find_hole: base @ 13dd000 for 17432080 bytes
>   pgb_static: base @ 13dd000 for 17432080 bytes
>   Locating guest address space @ 0x13dd000
>
> fails whereas:
>
>   pgb_find_hole: base @ 41f97000 for 17432080 bytes      
>   pgb_static: base @ 41f97000 for 17432080 bytes        
>   Locating guest address space @ 0x41f97000      
>
> works.
>
> What I find confusing is why we end up with different addresses when
> both QEMU and the test binary are static allocations. However the
> varying allocation occurs before the change but without triggering the
> crash:

Continuing with debug dumps:

  read_self_maps: heap at 2445000->24ab000
  pgb_find_hole: brk @ 24ab000
  pgb_find_hole: start:24ab000 align_start:24ab000 end:3ffa0000000
  pgb_find_hole: after brk tweak align_start:424ab000
  Created 10 threads
  Done
  3, 0, PASS, 0.251649, 2, 3, -
  read_self_maps: heap at 2d14000->2d7a000
  pgb_find_hole: brk @ 2d7a000
  pgb_find_hole: start:13dd000 align_start:13dd000 end:2d14000
  4, -11, FALSE, 0.251602, 2, 4, -
  read_self_maps: heap at 1e6c000->1ed2000
  pgb_find_hole: brk @ 1ed2000
  pgb_find_hole: start:1ed2000 align_start:1ed2000 end:3ff90000000
  pgb_find_hole: after brk tweak align_start:41ed2000
  Created 10 threads
  Done
  5, 0, PASS, 0.253451, 3, 5, -
  read_self_maps: heap at 2c32000->2c98000
  pgb_find_hole: brk @ 2c98000
  pgb_find_hole: start:13dd000 align_start:13dd000 end:2c32000
  6, -11, FALSE, 0.251998, 3, 6, -
  read_self_maps: heap at 29f2000->2a58000
  pgb_find_hole: brk @ 2a58000
  pgb_find_hole: start:13dd000 align_start:13dd000 end:29f2000
  7, -11, FALSE, 0.251922, 3, 7, -
  read_self_maps: heap at 1b1f000->1b85000
  pgb_find_hole: brk @ 1b85000
  pgb_find_hole: start:1b85000 align_start:1b85000 end:3ff78000000
  pgb_find_hole: after brk tweak align_start:41b85000
  Created 10 threads
  Done
  8, 0, PASS, 0.251691, 4, 8, -

It looks like that we occasionally fit in bellow the heap and location
of brk but we aren't asking for enough space. I would like to get a core
dump of the failure because of course using gdb moves the maps around
enough that everything always works.

-- 
Alex Bennée