* [Bug 1860920] Re: qemu-s390x-softmmu: crash
[not found] <158005183659.18916.14986952783973408797.malonedeb@gac.canonical.com>
@ 2020-01-30 8:18 ` Thomas Huth
2020-01-30 8:30 ` Thomas Huth
` (4 subsequent siblings)
5 siblings, 0 replies; 6+ messages in thread
From: Thomas Huth @ 2020-01-30 8:18 UTC (permalink / raw)
To: qemu-devel
** Information type changed from Private Security to Public Security
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1860920
Title:
qemu-s390x-softmmu: crash
Status in QEMU:
New
Bug description:
Trying to compile and use rust programs on an s390x emulated machine,
crash in qemu/target/s390x/translate.c line 3894
Steps to reproduce:
on a amd64 PC, installed debian on s390x emulated by qemu, seems to work fine (installed some packages, etc.)
installed rust cargo (either from rustup or from debian)
cargo install anything makes *qemu* crash when beginning to compile
Technical details:
* host: amd64 Linux
* qemu v4.2.0 (recompiled from git with debug options using configure --target-list=s390x-softmmu --enable-debug) (problem appears also with older versions of qemu from git, with default compilation options, with qemu from debian, etc.)
* compiled with gcc 9.2
* command line, relevant part: qemu-system-s390x -snapshot -machine s390-ccw-virtio -cpu max,zpci=on -serial mon:stdio -display none -m 512
(tested with -smp 4 -m 4096 as well and without snapshotting)
* command line, less relevant part: -drive file=./debian.qcow2,if=none,id=drive-virtio-disk0,format=qcow2,cache=none -device virtio-blk-ccw,devno=fe.0.0001,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1,scsi=off -netdev user,id=mynet0,hostfwd=tcp::2223-:22 -device virtio-net-pci,netdev=mynet0
* core dump: abort in qemu/target/s390x/translate.c line 3894 ; s->field: op has value 0xEC and op2 has value 0x54
(more info available if needed)
Tried to patch source to add 0x54 case to no avail.
Tried other cpu variants to no avail as well.
Reporting this in security as well since it also looks very much like
a DoS (albeit somewhat minor), feel free to tell me to report the bug
somewhere else.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1860920/+subscriptions
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug 1860920] Re: qemu-s390x-softmmu: crash
[not found] <158005183659.18916.14986952783973408797.malonedeb@gac.canonical.com>
2020-01-30 8:18 ` [Bug 1860920] Re: qemu-s390x-softmmu: crash Thomas Huth
@ 2020-01-30 8:30 ` Thomas Huth
2020-01-31 9:40 ` Thomas Huth
` (3 subsequent siblings)
5 siblings, 0 replies; 6+ messages in thread
From: Thomas Huth @ 2020-01-30 8:30 UTC (permalink / raw)
To: qemu-devel
There is definitely something wrong here ;-) According to the
"Principles of Operations" ISA document, opcode 0xEC54 is the RNSBG
instruction (ROTATE THEN AND SELECTED BITS). But op_rosbg() apparently
currently handles 0xEC55, 0xEC56 and 0xEC57. 0xEC55 seems wrong there,
since this opcode should be handled by op_risbg() instead (according to
target/s390x/insn-data.def). So the "case 0x55" seems to be a typo. Does
it work if you replace "case 0x55" with "case 0x54" ?
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1860920
Title:
qemu-s390x-softmmu: crash
Status in QEMU:
New
Bug description:
Trying to compile and use rust programs on an s390x emulated machine,
crash in qemu/target/s390x/translate.c line 3894
Steps to reproduce:
on a amd64 PC, installed debian on s390x emulated by qemu, seems to work fine (installed some packages, etc.)
installed rust cargo (either from rustup or from debian)
cargo install anything makes *qemu* crash when beginning to compile
Technical details:
* host: amd64 Linux
* qemu v4.2.0 (recompiled from git with debug options using configure --target-list=s390x-softmmu --enable-debug) (problem appears also with older versions of qemu from git, with default compilation options, with qemu from debian, etc.)
* compiled with gcc 9.2
* command line, relevant part: qemu-system-s390x -snapshot -machine s390-ccw-virtio -cpu max,zpci=on -serial mon:stdio -display none -m 512
(tested with -smp 4 -m 4096 as well and without snapshotting)
* command line, less relevant part: -drive file=./debian.qcow2,if=none,id=drive-virtio-disk0,format=qcow2,cache=none -device virtio-blk-ccw,devno=fe.0.0001,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1,scsi=off -netdev user,id=mynet0,hostfwd=tcp::2223-:22 -device virtio-net-pci,netdev=mynet0
* core dump: abort in qemu/target/s390x/translate.c line 3894 ; s->field: op has value 0xEC and op2 has value 0x54
(more info available if needed)
Tried to patch source to add 0x54 case to no avail.
Tried other cpu variants to no avail as well.
Reporting this in security as well since it also looks very much like
a DoS (albeit somewhat minor), feel free to tell me to report the bug
somewhere else.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1860920/+subscriptions
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug 1860920] Re: qemu-s390x-softmmu: crash
[not found] <158005183659.18916.14986952783973408797.malonedeb@gac.canonical.com>
2020-01-30 8:18 ` [Bug 1860920] Re: qemu-s390x-softmmu: crash Thomas Huth
2020-01-30 8:30 ` Thomas Huth
@ 2020-01-31 9:40 ` Thomas Huth
2020-01-31 10:00 ` Jean-Gabriel Kammerer
` (2 subsequent siblings)
5 siblings, 0 replies; 6+ messages in thread
From: Thomas Huth @ 2020-01-31 9:40 UTC (permalink / raw)
To: qemu-devel
Suggested patch:
https://lists.gnu.org/archive/html/qemu-devel/2020-01/msg07514.html
"target/s390x/translate: Fix RNSBG instruction"
** Changed in: qemu
Assignee: (unassigned) => Thomas Huth (th-huth)
** Changed in: qemu
Status: New => Confirmed
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1860920
Title:
qemu-s390x-softmmu: crash
Status in QEMU:
Confirmed
Bug description:
Trying to compile and use rust programs on an s390x emulated machine,
crash in qemu/target/s390x/translate.c line 3894
Steps to reproduce:
on a amd64 PC, installed debian on s390x emulated by qemu, seems to work fine (installed some packages, etc.)
installed rust cargo (either from rustup or from debian)
cargo install anything makes *qemu* crash when beginning to compile
Technical details:
* host: amd64 Linux
* qemu v4.2.0 (recompiled from git with debug options using configure --target-list=s390x-softmmu --enable-debug) (problem appears also with older versions of qemu from git, with default compilation options, with qemu from debian, etc.)
* compiled with gcc 9.2
* command line, relevant part: qemu-system-s390x -snapshot -machine s390-ccw-virtio -cpu max,zpci=on -serial mon:stdio -display none -m 512
(tested with -smp 4 -m 4096 as well and without snapshotting)
* command line, less relevant part: -drive file=./debian.qcow2,if=none,id=drive-virtio-disk0,format=qcow2,cache=none -device virtio-blk-ccw,devno=fe.0.0001,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1,scsi=off -netdev user,id=mynet0,hostfwd=tcp::2223-:22 -device virtio-net-pci,netdev=mynet0
* core dump: abort in qemu/target/s390x/translate.c line 3894 ; s->field: op has value 0xEC and op2 has value 0x54
(more info available if needed)
Tried to patch source to add 0x54 case to no avail.
Tried other cpu variants to no avail as well.
Reporting this in security as well since it also looks very much like
a DoS (albeit somewhat minor), feel free to tell me to report the bug
somewhere else.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1860920/+subscriptions
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug 1860920] Re: qemu-s390x-softmmu: crash
[not found] <158005183659.18916.14986952783973408797.malonedeb@gac.canonical.com>
` (2 preceding siblings ...)
2020-01-31 9:40 ` Thomas Huth
@ 2020-01-31 10:00 ` Jean-Gabriel Kammerer
2020-03-10 9:13 ` Laurent Vivier
2020-04-30 13:42 ` Laurent Vivier
5 siblings, 0 replies; 6+ messages in thread
From: Jean-Gabriel Kammerer @ 2020-01-31 10:00 UTC (permalink / raw)
To: qemu-devel
Sorry for delay in answering, replacing 0x55 by 0x54 works fine for me.
Thanks.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1860920
Title:
qemu-s390x-softmmu: crash
Status in QEMU:
Confirmed
Bug description:
Trying to compile and use rust programs on an s390x emulated machine,
crash in qemu/target/s390x/translate.c line 3894
Steps to reproduce:
on a amd64 PC, installed debian on s390x emulated by qemu, seems to work fine (installed some packages, etc.)
installed rust cargo (either from rustup or from debian)
cargo install anything makes *qemu* crash when beginning to compile
Technical details:
* host: amd64 Linux
* qemu v4.2.0 (recompiled from git with debug options using configure --target-list=s390x-softmmu --enable-debug) (problem appears also with older versions of qemu from git, with default compilation options, with qemu from debian, etc.)
* compiled with gcc 9.2
* command line, relevant part: qemu-system-s390x -snapshot -machine s390-ccw-virtio -cpu max,zpci=on -serial mon:stdio -display none -m 512
(tested with -smp 4 -m 4096 as well and without snapshotting)
* command line, less relevant part: -drive file=./debian.qcow2,if=none,id=drive-virtio-disk0,format=qcow2,cache=none -device virtio-blk-ccw,devno=fe.0.0001,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1,scsi=off -netdev user,id=mynet0,hostfwd=tcp::2223-:22 -device virtio-net-pci,netdev=mynet0
* core dump: abort in qemu/target/s390x/translate.c line 3894 ; s->field: op has value 0xEC and op2 has value 0x54
(more info available if needed)
Tried to patch source to add 0x54 case to no avail.
Tried other cpu variants to no avail as well.
Reporting this in security as well since it also looks very much like
a DoS (albeit somewhat minor), feel free to tell me to report the bug
somewhere else.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1860920/+subscriptions
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug 1860920] Re: qemu-s390x-softmmu: crash
[not found] <158005183659.18916.14986952783973408797.malonedeb@gac.canonical.com>
` (3 preceding siblings ...)
2020-01-31 10:00 ` Jean-Gabriel Kammerer
@ 2020-03-10 9:13 ` Laurent Vivier
2020-04-30 13:42 ` Laurent Vivier
5 siblings, 0 replies; 6+ messages in thread
From: Laurent Vivier @ 2020-03-10 9:13 UTC (permalink / raw)
To: qemu-devel
Fixed here:
https://git.qemu.org/?p=qemu.git;a=commitdiff;h=0bab189c96c7
** Changed in: qemu
Status: Confirmed => Fix Committed
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1860920
Title:
qemu-s390x-softmmu: crash
Status in QEMU:
Fix Committed
Bug description:
Trying to compile and use rust programs on an s390x emulated machine,
crash in qemu/target/s390x/translate.c line 3894
Steps to reproduce:
on a amd64 PC, installed debian on s390x emulated by qemu, seems to work fine (installed some packages, etc.)
installed rust cargo (either from rustup or from debian)
cargo install anything makes *qemu* crash when beginning to compile
Technical details:
* host: amd64 Linux
* qemu v4.2.0 (recompiled from git with debug options using configure --target-list=s390x-softmmu --enable-debug) (problem appears also with older versions of qemu from git, with default compilation options, with qemu from debian, etc.)
* compiled with gcc 9.2
* command line, relevant part: qemu-system-s390x -snapshot -machine s390-ccw-virtio -cpu max,zpci=on -serial mon:stdio -display none -m 512
(tested with -smp 4 -m 4096 as well and without snapshotting)
* command line, less relevant part: -drive file=./debian.qcow2,if=none,id=drive-virtio-disk0,format=qcow2,cache=none -device virtio-blk-ccw,devno=fe.0.0001,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1,scsi=off -netdev user,id=mynet0,hostfwd=tcp::2223-:22 -device virtio-net-pci,netdev=mynet0
* core dump: abort in qemu/target/s390x/translate.c line 3894 ; s->field: op has value 0xEC and op2 has value 0x54
(more info available if needed)
Tried to patch source to add 0x54 case to no avail.
Tried other cpu variants to no avail as well.
Reporting this in security as well since it also looks very much like
a DoS (albeit somewhat minor), feel free to tell me to report the bug
somewhere else.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1860920/+subscriptions
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug 1860920] Re: qemu-s390x-softmmu: crash
[not found] <158005183659.18916.14986952783973408797.malonedeb@gac.canonical.com>
` (4 preceding siblings ...)
2020-03-10 9:13 ` Laurent Vivier
@ 2020-04-30 13:42 ` Laurent Vivier
5 siblings, 0 replies; 6+ messages in thread
From: Laurent Vivier @ 2020-04-30 13:42 UTC (permalink / raw)
To: qemu-devel
** Changed in: qemu
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1860920
Title:
qemu-s390x-softmmu: crash
Status in QEMU:
Fix Released
Bug description:
Trying to compile and use rust programs on an s390x emulated machine,
crash in qemu/target/s390x/translate.c line 3894
Steps to reproduce:
on a amd64 PC, installed debian on s390x emulated by qemu, seems to work fine (installed some packages, etc.)
installed rust cargo (either from rustup or from debian)
cargo install anything makes *qemu* crash when beginning to compile
Technical details:
* host: amd64 Linux
* qemu v4.2.0 (recompiled from git with debug options using configure --target-list=s390x-softmmu --enable-debug) (problem appears also with older versions of qemu from git, with default compilation options, with qemu from debian, etc.)
* compiled with gcc 9.2
* command line, relevant part: qemu-system-s390x -snapshot -machine s390-ccw-virtio -cpu max,zpci=on -serial mon:stdio -display none -m 512
(tested with -smp 4 -m 4096 as well and without snapshotting)
* command line, less relevant part: -drive file=./debian.qcow2,if=none,id=drive-virtio-disk0,format=qcow2,cache=none -device virtio-blk-ccw,devno=fe.0.0001,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1,scsi=off -netdev user,id=mynet0,hostfwd=tcp::2223-:22 -device virtio-net-pci,netdev=mynet0
* core dump: abort in qemu/target/s390x/translate.c line 3894 ; s->field: op has value 0xEC and op2 has value 0x54
(more info available if needed)
Tried to patch source to add 0x54 case to no avail.
Tried other cpu variants to no avail as well.
Reporting this in security as well since it also looks very much like
a DoS (albeit somewhat minor), feel free to tell me to report the bug
somewhere else.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1860920/+subscriptions
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-04-30 14:07 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <158005183659.18916.14986952783973408797.malonedeb@gac.canonical.com>
2020-01-30 8:18 ` [Bug 1860920] Re: qemu-s390x-softmmu: crash Thomas Huth
2020-01-30 8:30 ` Thomas Huth
2020-01-31 9:40 ` Thomas Huth
2020-01-31 10:00 ` Jean-Gabriel Kammerer
2020-03-10 9:13 ` Laurent Vivier
2020-04-30 13:42 ` Laurent Vivier
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.