qemu-user can't run some ppc binaries

[Aaron Simmons]

qemu-user v6.0.0-rc5, built in static mode, will crash for certain ppc binaries. It seems to have something to do with glibc for some Centos versions. The problem is easiest to see with statically-linked binaries.

The attached Dockerfile shows how to produce a ppc binary that will crash qemu-user. Here is how to reproduce the problem:

$ uname -m
x86_64

$ docker run --rm --privileged multiarch/qemu-user-static --reset -p yes

$ docker build -t qemu-bug:centos -f Dockerfile.centos .

$ docker run --rm -it -v$PWD:$PWD -w$PWD qemu-bug:centos cp /helloworld-centos.static.ppc .

$ qemu-ppc-static --version
qemu-ppc version 5.2.95 (v6.0.0-rc5)
Copyright (c) 2003-2021 Fabrice Bellard and the QEMU Project developers

$ qemu-ppc-static ./helloworld-centos.static.ppc
emu: uncaught target signal 4 (Illegal instruction) - core dumped
[1] 16678 illegal hardware instruction (core dumped) qemu-ppc-static ./helloworld-centos.static.ppc

[Laurent Vivier (laurent-vivier)]

Could you provide directly the binary to test (helloworld-centos.static.ppc)?

[Aaron Simmons (paleozogt)]

helloworld-centos.static.ppc is attached as part of comment #2

[Laurent Vivier (laurent-vivier)]

Thank you. I can reproduce the problem.

[Laurent Vivier (laurent-vivier)]

This is not a regression (reproduced with 5.2 and 5.1)

  IN: strlen
  0x1000d780: 7d2a03f8 cmpb r10, r9, r0

  OP:
   ld_i32 tmp0,env,$0xfffffffffffffff0
   brcond_i32 tmp0,$0x0,lt,$L0

   ---- 1000d780
   mov_i32 nip,$0x1000d780
   mov_i32 tmp0,$0x60
   mov_i32 tmp4,$0x21
   call raise_exception_err,$0x2,$0,env,tmp0,tmp4
   exit_tb $0x0
   set_label $L0
   exit_tb $0x7efd50022283

"cmpb" is define in ISA 2.05, but qemu-ppc (32bit) defines by default a PowerPC 750 that is not ISA 2.05.

It doesn't seem QEMU supports ISA 2.05 for any 32bit PowerPC (only POWER7 and above, that are 64bit processors).

[Aaron Simmons (paleozogt)]

Thanks for looking into this. What reference did you use to check which ISA "cmpb" is in?

[Laurent Vivier (laurent-vivier)]

Le 29/04/2021 à 19:20, Aaron Simmons a écrit :
> Thanks for looking into this. What reference did you use to check which
> ISA "cmpb" is in?
>

It's in the QEMU source, but you can check the specs:

POWER ISA 2.04 -> no cmpb

https://wiki.raptorcs.com/w/images/6/65/PowerISA_V2.04-FINAL.Public.pdf

POWER ISA 2.05 -> cmpb

https://wiki.raptorcs.com/w/images/5/50/PowerISA_V2.05.pdf

[Thomas Huth (th-huth)]

The QEMU project is currently moving its bug tracking to another system.
For this we need to know which bugs are still valid and which could be
closed already. Thus we are setting the bug state to "Incomplete" now.

If the bug has already been fixed in the latest upstream version of QEMU,
then please close this ticket as "Fix released".

If it is not fixed yet and you think that this bug report here is still
valid, then you have two options:

1) If you already have an account on gitlab.com, please open a new ticket
for this problem in our new tracker here:

    https://gitlab.com/qemu-project/qemu/-/issues

and then close this ticket here on Launchpad (or let it expire auto-
matically after 60 days). Please mention the URL of this bug ticket on
Launchpad in the new ticket on GitLab.

2) If you don't have an account on gitlab.com and don't intend to get
one, but still would like to keep this ticket opened, then please switch
the state back to "New" or "Confirmed" within the next 60 days (other-
wise it will get closed as "Expired"). We will then eventually migrate
the ticket automatically to the new system (but you won't be the reporter
of the bug in the new system and thus you won't get notified on changes
anymore).

Thank you and sorry for the inconvenience.

[Launchpad Janitor (janitor)]

[Expired for QEMU because there has been no activity for 60 days.]