I found the exact same bug. Tested on several hosts and qemu releases. The newest one I tested was on FreeBSD 12.1 host and qemu-4.1.1_1 built from ports.
Instructions: 4000d0: 0320f809 jalr t9 4000d4: 45454545 0x45454545 # bc1any4t $fcc1,0x800101f8
I was running qemu-mips as:
qemu-system-mipsel -s -m 1024 -M malta \ -kernel vmlinux-3.16.0-6-4kc-malta -initrd initrd.img-3.16.0-6-4kc-malta \ -device virtio-blk-pci,drive=hd0 -drive if=none,id=hd0,format=qcow2,file=debian_wheezy_mipsel_standard.qcow2 \ -append "root=/dev/vda1" \ -device virtio-net-pci,netdev=net0 \ -netdev user,id=net0,hostfwd=tcp::1666-:22,ipv6=off \ -curses
abort() was in target/mips/translate.c:12945, in gen_branch().
Doesn't really matter if the instruction is supported on given CPU, user can crash the qemu within guest.
I found the exact same bug. Tested on several hosts and qemu releases. The newest one I tested was on FreeBSD 12.1 host and qemu-4.1.1_1 built from ports.
Instructions:
4000d0: 0320f809 jalr t9
4000d4: 45454545 0x45454545 # bc1any4t $fcc1,0x800101f8
I was running qemu-mips as:
qemu-system-mipsel -s -m 1024 -M malta \ 3.16.0- 6-4kc-malta -initrd initrd. img-3.16. 0-6-4kc- malta \ blk-pci, drive=hd0 -drive if=none, id=hd0, format= qcow2,file= debian_ wheezy_ mipsel_ standard. qcow2 \ net-pci, netdev= net0 \ net0,hostfwd= tcp::1666- :22,ipv6= off \
-kernel vmlinux-
-device virtio-
-append "root=/dev/vda1" \
-device virtio-
-netdev user,id=
-curses
abort() was in target/ mips/translate. c:12945, in gen_branch().
Doesn't really matter if the instruction is supported on given CPU, user can crash the qemu within guest.