[Bug 1776096] Re: qemu 2.12.0 qemu-system-ppc illegal instruction on ppc64le, crashes emulator

[Thomas Huth]

The QEMU project is currently considering to move its bug tracking to another 
system. For this we need to know which bugs are still valid and which could be 
closed already. Thus we are setting older bugs to "Incomplete" now.
If you still think this bug report here is valid, then please switch the state 
back to "New" within the next 60 days, otherwise this report will be marked as 
"Expired". Or mark it as "Fix Released" if the problem has been solved with a 
newer version of QEMU already. Thank you and sorry for the inconvenience.

** Changed in: qemu
       Status: New => Incomplete

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1776096

Title:
  qemu 2.12.0 qemu-system-ppc illegal instruction on ppc64le, crashes
  emulator

Status in QEMU:
  Incomplete

Bug description:
  % uname -a
  Linux tim.floodgap.com 4.16.14-300.fc28.ppc64le #1 SMP Tue Jun 5 15:59:48 UTC 
2018 ppc64le ppc64le ppc64le GNU/Linux

  STR:
  Start QEMU and boot Mac OS X 10.4.11.
  Download the current version of TenFourFox (I used G3 so that AltiVec was not 
a confounder).
  Try to start TenFourFox in safe mode (hold down Option as you double-click 
while the icon bounces in the Dock).

  Expected:
  TenFourFox starts.

  Actual:
  The entire emulator exits with an illegal instruction error.

  Trace of session (including some disassembly so you can see where TCG
  went wrong):

  tim:/home/spectre/src/qemu-2.12.0/ppc-softmmu/% gdb --args ./qemu-
  system-ppc -M mac99,accel=tcg -m 2048 -prom-env boot-args=-v -boot c
  -drive file=tigerhd.img,format=raw,cache=none -netdev user,id=mynet0
  -device usb-net,netdev=mynet0 -usb -device usb-tablet

  GNU gdb (GDB) Fedora 8.1-15.fc28
  [...]
  Reading symbols from ./qemu-system-ppc...done.
  (gdb) run
  [...]

  Thread 6 "qemu-system-ppc" received signal SIGSEGV, Segmentation fault.
  [Switching to Thread 0x7ffff242ea30 (LWP 7017)]
  0xfffffffffffffffc in ?? ()
  #0  0xfffffffffffffffc in  ()
  #1  0x00007fffd4edec00 in code_gen_buffer ()
  #2  0x00000000100c9e20 in cpu_tb_exec (itb=<optimized out>, cpu=<optimized 
out>) at /home/spectre/src/qemu-2.12.0/accel/tcg/cpu-exec.c:169
  #3  0x00000000100c9e20 in cpu_loop_exec_tb (tb_exit=<synthetic pointer>, 
last_tb=<synthetic pointer>, tb=<optimized out>, cpu=<optimized out>)
      at /home/spectre/src/qemu-2.12.0/accel/tcg/cpu-exec.c:626
  #4  0x00000000100c9e20 in cpu_exec (cpu=<optimized out>)
      at /home/spectre/src/qemu-2.12.0/accel/tcg/cpu-exec.c:734
  #5  0x000000001007decc in tcg_cpu_exec (cpu=0x11774e10)
      at /home/spectre/src/qemu-2.12.0/cpus.c:1362
  (gdb) disas 0x00007fffd4edebf0, 0x00007fffd4edec10
  Dump of assembler code from 0x7fffd4edebf0 to 0x7fffd4edec10:
     0x00007fffd4edebf0 <code_gen_buffer+284027700>:    addi    r0,r4,3
     0x00007fffd4edebf4 <code_gen_buffer+284027704>:    rlwinm  r0,r0,0,0,19
     0x00007fffd4edebf8 <code_gen_buffer+284027708>:    cmplw   cr7,r0,r12
     0x00007fffd4edebfc <code_gen_buffer+284027712>:    bnel    
cr7,0x7fffd4ed8b64 <code_gen_buffer+284002984>
     0x00007fffd4edec00 <code_gen_buffer+284027716>:    lwbrx   r14,r3,r4
     0x00007fffd4edec04 <code_gen_buffer+284027720>:    stw     r14,40(r27)
     0x00007fffd4edec08 <code_gen_buffer+284027724>:    clrldi  r4,r14,32
     0x00007fffd4edec0c <code_gen_buffer+284027728>:    rlwinm  r3,r4,25,19,26
  End of assembler dump.
  (gdb) disas 0x7fffd4ed8b60, 0x7fffd4ed8b70
  Dump of assembler code from 0x7fffd4ed8b60 to 0x7fffd4ed8b70:
     0x00007fffd4ed8b60 <code_gen_buffer+284002980>:    bctrl
     0x00007fffd4ed8b64 <code_gen_buffer+284002984>:    mtctr   r3
     0x00007fffd4ed8b68 <code_gen_buffer+284002988>:    mr      r31,r3
     0x00007fffd4ed8b6c <code_gen_buffer+284002992>:    li      r3,0
  End of assembler dump.
  (gdb) i reg ctr
  ctr            0xffffffffffffffff     18446744073709551615

  It appears that the branch at 0x00007fffd4edebfc caused a jump back (a
  return?) through CTR, but CTR has -1 in it, hence setting PC to
  0xfffffffffffffffc. I am not sure how to debug this further.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1776096/+subscriptions