qemu-s390x-softmmu: crash
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Thomas Huth |
Bug Description
Trying to compile and use rust programs on an s390x emulated machine, crash in qemu/target/
Steps to reproduce:
on a amd64 PC, installed debian on s390x emulated by qemu, seems to work fine (installed some packages, etc.)
installed rust cargo (either from rustup or from debian)
cargo install anything makes *qemu* crash when beginning to compile
Technical details:
* host: amd64 Linux
* qemu v4.2.0 (recompiled from git with debug options using configure --target-
* compiled with gcc 9.2
* command line, relevant part: qemu-system-s390x -snapshot -machine s390-ccw-virtio -cpu max,zpci=on -serial mon:stdio -display none -m 512
(tested with -smp 4 -m 4096 as well and without snapshotting)
* command line, less relevant part: -drive file=./
* core dump: abort in qemu/target/
(more info available if needed)
Tried to patch source to add 0x54 case to no avail.
Tried other cpu variants to no avail as well.
Reporting this in security as well since it also looks very much like a DoS (albeit somewhat minor), feel free to tell me to report the bug somewhere else.
description: | updated |
information type: | Private Security → Public Security |
Changed in qemu: | |
status: | Fix Committed → Fix Released |
There is definitely something wrong here ;-) According to the "Principles of Operations" ISA document, opcode 0xEC54 is the RNSBG instruction (ROTATE THEN AND SELECTED BITS). But op_rosbg() apparently currently handles 0xEC55, 0xEC56 and 0xEC57. 0xEC55 seems wrong there, since this opcode should be handled by op_risbg() instead (according to target/ s390x/insn- data.def) . So the "case 0x55" seems to be a typo. Does it work if you replace "case 0x55" with "case 0x54" ?