* [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64
@ 2017-02-09 15:49 Brian Campbell
2017-02-13 15:02 ` [Qemu-devel] [Bug 1663287] " Brian Campbell
` (15 more replies)
0 siblings, 16 replies; 17+ messages in thread
From: Brian Campbell @ 2017-02-09 15:49 UTC (permalink / raw)
To: qemu-devel
Public bug reported:
During some randomised testing of an experimental MIPS implementation I
found an instruction sequence that also causes aborts on mainline qemu's
MIPS support. The problem is triggered by an MSA branch instruction
appearing in a delay slot when emulating a processor without MSA
support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
** Affects: qemu
Importance: Undecided
Status: New
** Attachment added: "Binary instruction sequence that causes the abort"
https://bugs.launchpad.net/bugs/1663287/+attachment/4815912/+files/abort2.bin
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
New
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Qemu-devel] [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
@ 2017-02-13 15:02 ` Brian Campbell
2017-03-20 22:14 ` Yongbok Kim
` (14 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Brian Campbell @ 2017-02-13 15:02 UTC (permalink / raw)
To: qemu-devel
I've just found the same problem with gen_compute_branch1,
00200008 jr at
4540563a bc1any4f $fcc0,0xffffffffbfc158ec
The cause is the same - if the instruction set is wrong then the delay
slot check is skipped.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
New
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Qemu-devel] [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
2017-02-13 15:02 ` [Qemu-devel] [Bug 1663287] " Brian Campbell
@ 2017-03-20 22:14 ` Yongbok Kim
2017-03-20 22:37 ` Yongbok Kim
` (13 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Yongbok Kim @ 2017-03-20 22:14 UTC (permalink / raw)
To: qemu-devel
** Changed in: qemu
Status: New => Fix Committed
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
Fix Committed
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Qemu-devel] [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
2017-02-13 15:02 ` [Qemu-devel] [Bug 1663287] " Brian Campbell
2017-03-20 22:14 ` Yongbok Kim
@ 2017-03-20 22:37 ` Yongbok Kim
2017-04-24 7:42 ` Thomas Huth
` (12 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Yongbok Kim @ 2017-03-20 22:37 UTC (permalink / raw)
To: qemu-devel
Thanks for reporting this issue.
In fact, branches in a delay slot is "undefined" in the pre-Release 6 architecture.
MIPS architectre release 6 defines to signal Reserved Instruction exceptions for such cases.
However as it was undefined, it is better to signal RI and carry on rather than stopping simulation.
Hence I've made a patch for the msa case.
I will have a look into the other case. (sorry I've missed in the first place.)
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
Fix Committed
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Qemu-devel] [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
` (2 preceding siblings ...)
2017-03-20 22:37 ` Yongbok Kim
@ 2017-04-24 7:42 ` Thomas Huth
2017-08-22 10:49 ` Brian Campbell
` (11 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Thomas Huth @ 2017-04-24 7:42 UTC (permalink / raw)
To: qemu-devel
http://git.qemu.org/?p=qemu.git;a=commitdiff;h=075a1fe788d36b271ec2
** Changed in: qemu
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
Fix Released
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Qemu-devel] [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
` (3 preceding siblings ...)
2017-04-24 7:42 ` Thomas Huth
@ 2017-08-22 10:49 ` Brian Campbell
2018-02-08 12:11 ` Brian Campbell
` (10 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Brian Campbell @ 2017-08-22 10:49 UTC (permalink / raw)
To: qemu-devel
Thanks for that fix. I've just noticed that the second part, in
gen_compute_branch1, wasn't included, though. Could you take a look at
it?
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
Fix Released
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Qemu-devel] [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
` (4 preceding siblings ...)
2017-08-22 10:49 ` Brian Campbell
@ 2018-02-08 12:11 ` Brian Campbell
2018-03-23 20:59 ` philmd
` (9 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Brian Campbell @ 2018-02-08 12:11 UTC (permalink / raw)
To: qemu-devel
** Changed in: qemu
Status: Fix Released => New
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
New
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Qemu-devel] [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
` (5 preceding siblings ...)
2018-02-08 12:11 ` Brian Campbell
@ 2018-03-23 20:59 ` philmd
2020-04-06 21:07 ` martin short
` (8 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: philmd @ 2018-03-23 20:59 UTC (permalink / raw)
To: qemu-devel
** Tags added: mips
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
New
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
` (6 preceding siblings ...)
2018-03-23 20:59 ` philmd
@ 2020-04-06 21:07 ` martin short
2020-04-06 23:17 ` Philippe Mathieu-Daudé
` (7 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: martin short @ 2020-04-06 21:07 UTC (permalink / raw)
To: qemu-devel
I found the exact same bug. Tested on several hosts and qemu releases.
The newest one I tested was on FreeBSD 12.1 host and qemu-4.1.1_1 built
from ports.
Instructions:
4000d0: 0320f809 jalr t9
4000d4: 45454545 0x45454545 # bc1any4t $fcc1,0x800101f8
I was running qemu-mips as:
qemu-system-mipsel -s -m 1024 -M malta \
-kernel vmlinux-3.16.0-6-4kc-malta -initrd initrd.img-3.16.0-6-4kc-malta \
-device virtio-blk-pci,drive=hd0 -drive if=none,id=hd0,format=qcow2,file=debian_wheezy_mipsel_standard.qcow2 \
-append "root=/dev/vda1" \
-device virtio-net-pci,netdev=net0 \
-netdev user,id=net0,hostfwd=tcp::1666-:22,ipv6=off \
-curses
abort() was in target/mips/translate.c:12945, in gen_branch().
Doesn't really matter if the instruction is supported on given CPU, user
can crash the qemu within guest.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
New
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
` (7 preceding siblings ...)
2020-04-06 21:07 ` martin short
@ 2020-04-06 23:17 ` Philippe Mathieu-Daudé
2020-04-07 10:46 ` martin short
` (6 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Philippe Mathieu-Daudé @ 2020-04-06 23:17 UTC (permalink / raw)
To: qemu-devel
Hi Brian,
You try to execute a CP1 instruction in a delay slot,
which triggers a Reserved Instruction exception.
Per the ISA the processor operation is UNPREDICTABLE in such case.
What is the behavior on real hardware?
An assertion() seems appropriate.
Your compiler might be buggy, or you are not compiling for the correct CPU
(or you are not using the correct QEMU cpu).
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
New
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
` (8 preceding siblings ...)
2020-04-06 23:17 ` Philippe Mathieu-Daudé
@ 2020-04-07 10:46 ` martin short
2020-04-07 11:16 ` Peter Maydell
` (5 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: martin short @ 2020-04-07 10:46 UTC (permalink / raw)
To: qemu-devel
I don't know how Brian go to his state.
I should've mentioned though I was using custom binary (shellcode) that
triggered this behavior. This code was not generated by compiler.
However, I wanted to point out that user can crash the qemu host by
running custom code from userspace.
Unfortunately I can't test this behavior on real HW right now.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
New
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
` (9 preceding siblings ...)
2020-04-07 10:46 ` martin short
@ 2020-04-07 11:16 ` Peter Maydell
2020-04-07 18:56 ` martin short
` (4 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Peter Maydell @ 2020-04-07 11:16 UTC (permalink / raw)
To: qemu-devel
Yeah, QEMU crashing is definitely a bug that we should fix. (NB that
it's not a 'security' bug, though -- we make no guarantee that malicious
code run under QEMU with TCG emulation is unable to escape from it:
there's too much unaudited and old code for us to be able to safely make
that guarantee.)
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
New
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
` (10 preceding siblings ...)
2020-04-07 11:16 ` Peter Maydell
@ 2020-04-07 18:56 ` martin short
2020-04-07 20:05 ` Brian Campbell
` (3 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: martin short @ 2020-04-07 18:56 UTC (permalink / raw)
To: qemu-devel
When I reread the thread I see Brian was doing some testing/fuzzing,
that's why he found that out.
I managed to get my old router running. It's BCM5354 (BCM3302 v2.9) running on Linux 2.4.35.
I used the following code (gnu as compiled but replaced the nop after branch with the branch instruction above):
4000d0: 10000003 b 4000e0 <__start+0x10>
4000d4: 45454545 0x45454545
...
4000e0: 2404002a li a0,42
4000e4: 24020fa1 li v0,4001
4000e8: 0000000c syscall
4000ec: 00000000 nop
Program was terminated with the trap Illegal instruction.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
New
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
` (11 preceding siblings ...)
2020-04-07 18:56 ` martin short
@ 2020-04-07 20:05 ` Brian Campbell
2020-11-08 9:12 ` Thomas Huth
` (2 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Brian Campbell @ 2020-04-07 20:05 UTC (permalink / raw)
To: qemu-devel
If my memory is correct, this problem doesn't need qemu to execute the
code, it only needs it to translate the code. In the original test case
the invalid instructions were actually dead code but still managed to
crash qemu.
I suggest following Yongbok Kim's approach and signalling Reserved
Instruction in the same way R6 does. I think that's architecturally
allowed, although I admit that it's ages since I looked at this.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
New
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
` (12 preceding siblings ...)
2020-04-07 20:05 ` Brian Campbell
@ 2020-11-08 9:12 ` Thomas Huth
2020-11-08 23:17 ` Philippe Mathieu-Daudé
2021-05-01 5:53 ` Thomas Huth
15 siblings, 0 replies; 17+ messages in thread
From: Thomas Huth @ 2020-11-08 9:12 UTC (permalink / raw)
To: qemu-devel
** Changed in: qemu
Assignee: (unassigned) => Philippe Mathieu-Daudé (philmd)
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
New
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
` (13 preceding siblings ...)
2020-11-08 9:12 ` Thomas Huth
@ 2020-11-08 23:17 ` Philippe Mathieu-Daudé
2021-05-01 5:53 ` Thomas Huth
15 siblings, 0 replies; 17+ messages in thread
From: Philippe Mathieu-Daudé @ 2020-11-08 23:17 UTC (permalink / raw)
To: qemu-devel
** Changed in: qemu
Status: New => Confirmed
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
Confirmed
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
* [Bug 1663287] Re: Illegal delay slot code causes abort on mips64
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
` (14 preceding siblings ...)
2020-11-08 23:17 ` Philippe Mathieu-Daudé
@ 2021-05-01 5:53 ` Thomas Huth
15 siblings, 0 replies; 17+ messages in thread
From: Thomas Huth @ 2021-05-01 5:53 UTC (permalink / raw)
To: qemu-devel
This is an automated cleanup. This bug report has been moved
to QEMU's new bug tracker on gitlab.com and thus gets marked
as 'expired' now. Please continue with the discussion here:
https://gitlab.com/qemu-project/qemu/-/issues/63
** Changed in: qemu
Status: Confirmed => Expired
** Changed in: qemu
Assignee: Philippe Mathieu-Daudé (philmd) => (unassigned)
** Bug watch added: gitlab.com/qemu-project/qemu/-/issues #63
https://gitlab.com/qemu-project/qemu/-/issues/63
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1663287
Title:
Illegal delay slot code causes abort on mips64
Status in QEMU:
Expired
Bug description:
During some randomised testing of an experimental MIPS implementation
I found an instruction sequence that also causes aborts on mainline
qemu's MIPS support. The problem is triggered by an MSA branch
instruction appearing in a delay slot when emulating a processor
without MSA support.
For example, with the current repository HEAD
(f073cd3a2bf1054135271b837c58a7da650dd84b) configured for
mips64-softmmu, if I run the attached binary using
mips64-softmmu/qemu-system-mips64 -bios ../abort2.bin -machine
mipssim -nographic
it will report
unknown branch 0x13000
Aborted (core dumped)
The binary contains the following two instructions:
00200008 jr at
47081e61 bz.b w8,0xffffffffbfc0798c
The jr sets up a jump, and hflags is set accordingly in
gen_compute_branch (in target/mips/translate.c). When processing the
bz.b, check_insn generates an exception because the instruction isn't
support, but gen_msa_branch skips the usual delay slot check for the
same reason, and sets more bits in hflags, leading to an abort in
gen_branch because the hflags are now invalid.
I suspect the best fix is to remove the instruction set condition from
the delay slot check in gen_msa_branch.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1663287/+subscriptions
^ permalink raw reply [flat|nested] 17+ messages in thread
end of thread, other threads:[~2021-05-01 6:01 UTC | newest]
Thread overview: 17+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-02-09 15:49 [Qemu-devel] [Bug 1663287] [NEW] Illegal delay slot code causes abort on mips64 Brian Campbell
2017-02-13 15:02 ` [Qemu-devel] [Bug 1663287] " Brian Campbell
2017-03-20 22:14 ` Yongbok Kim
2017-03-20 22:37 ` Yongbok Kim
2017-04-24 7:42 ` Thomas Huth
2017-08-22 10:49 ` Brian Campbell
2018-02-08 12:11 ` Brian Campbell
2018-03-23 20:59 ` philmd
2020-04-06 21:07 ` martin short
2020-04-06 23:17 ` Philippe Mathieu-Daudé
2020-04-07 10:46 ` martin short
2020-04-07 11:16 ` Peter Maydell
2020-04-07 18:56 ` martin short
2020-04-07 20:05 ` Brian Campbell
2020-11-08 9:12 ` Thomas Huth
2020-11-08 23:17 ` Philippe Mathieu-Daudé
2021-05-01 5:53 ` Thomas Huth
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.