qemu 2.12.0 qemu-system-ppc illegal instruction on ppc64le, crashes emulator
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Expired
|
Undecided
|
Unassigned |
Bug Description
% uname -a
Linux tim.floodgap.com 4.16.14-
STR:
Start QEMU and boot Mac OS X 10.4.11.
Download the current version of TenFourFox (I used G3 so that AltiVec was not a confounder).
Try to start TenFourFox in safe mode (hold down Option as you double-click while the icon bounces in the Dock).
Expected:
TenFourFox starts.
Actual:
The entire emulator exits with an illegal instruction error.
Trace of session (including some disassembly so you can see where TCG went wrong):
tim:/home/
GNU gdb (GDB) Fedora 8.1-15.fc28
[...]
Reading symbols from ./qemu-
(gdb) run
[...]
Thread 6 "qemu-system-ppc" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff242ea30 (LWP 7017)]
0xfffffffffffffffc in ?? ()
#0 0xfffffffffffffffc in ()
#1 0x00007fffd4edec00 in code_gen_buffer ()
#2 0x00000000100c9e20 in cpu_tb_exec (itb=<optimized out>, cpu=<optimized out>) at /home/spectre/
#3 0x00000000100c9e20 in cpu_loop_exec_tb (tb_exit=<synthetic pointer>, last_tb=<synthetic pointer>, tb=<optimized out>, cpu=<optimized out>)
at /home/spectre/
#4 0x00000000100c9e20 in cpu_exec (cpu=<optimized out>)
at /home/spectre/
#5 0x000000001007decc in tcg_cpu_exec (cpu=0x11774e10)
at /home/spectre/
(gdb) disas 0x00007fffd4edebf0, 0x00007fffd4edec10
Dump of assembler code from 0x7fffd4edebf0 to 0x7fffd4edec10:
0x00007fffd4
0x00007fffd4
0x00007fffd4
0x00007fffd4
0x00007fffd4
0x00007fffd4
0x00007fffd4
0x00007fffd4
End of assembler dump.
(gdb) disas 0x7fffd4ed8b60, 0x7fffd4ed8b70
Dump of assembler code from 0x7fffd4ed8b60 to 0x7fffd4ed8b70:
0x00007fffd4
0x00007fffd4
0x00007fffd4
0x00007fffd4
End of assembler dump.
(gdb) i reg ctr
ctr 0xffffffffffffffff 184467440737095
It appears that the branch at 0x00007fffd4edebfc caused a jump back (a return?) through CTR, but CTR has -1 in it, hence setting PC to 0xfffffffffffffffc. I am not sure how to debug this further.
Sorry, more complete disassembly of the apparent actual fault:
0x00007fffd4 ed8b64 <code_gen_ buffer+ 284002984> : mtctr r3 ed8b68 <code_gen_ buffer+ 284002988> : mr r31,r3 ed8b6c <code_gen_ buffer+ 284002992> : li r3,0 ed8b70 <code_gen_ buffer+ 284002996> : bctr
0x00007fffd4
0x00007fffd4
0x00007fffd4