1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
qemu-x86_64: qemu/tcg/ppc/tcg-target.c.inc:1777:tcg_out_test: code should not be reached
Description of problem:
Using this basic test file:
```c
int
main (void)
{
return 0;
}
```
compiled into a static executable using an x86_64 toolchain (glibc or musl both tested),
```
gwyn ~/qemu-bug # file test1
test1: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, with debug_info, not stripped
gwyn ~/qemu-bug # file test2
test2: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=276dc49ee7cbd3b760e24761bf9fb9e1cc4b4349, for GNU/Linux 3.2.0, not stripped
```
Using QEMU from 15957eb9efe2da67c796612cead95cba28ba9bda or newer:
```
gwyn ~/qemu-bug # ../emus-ppc64/bin/qemu-x86_64 --version
qemu-x86_64 version 9.0.50 (v9.0.0-521-g15957eb9ef-dirty)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
```
QEMU crashes:
```
gwyn ~/qemu-bug # ../emus-ppc64/bin/qemu-x86_64 ./test2
**
ERROR:/root/qemu/tcg/ppc/tcg-target.c.inc:1777:tcg_out_test: code should not be reached
Bail out! ERROR:/root/qemu/tcg/ppc/tcg-target.c.inc:1777:tcg_out_test: code should not be reached
Aborted
```
Steps to reproduce:
1. Build QEMU user for ppc64 (may affect other hosts) using commit 15957eb9efe2da67c796612cead95cba28ba9bda or newer.
2. Run any simple x86_64 executable.
3. Observe the crash.
Additional information:
Bisected to here:
```
commit 15957eb9efe2da67c796612cead95cba28ba9bda
Author: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri Oct 27 05:57:31 2023 +0200
target/i386: use TSTEQ/TSTNE to test low bits
When testing the sign bit or equality to zero of a partial register, it
is useful to use a single TSTEQ or TSTNE operation. It can also be used
to test the parity flag, using bit 0 of the population count.
Do not do this for target_ulong-sized values however; the optimizer would
produce a comparison against zero anyway, and it avoids shifts by 64
which are undefined behavior.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
target/i386/tcg/emit.c.inc | 5 ++---
target/i386/tcg/translate.c | 28 ++++++++++++++++++++--------
2 files changed, 22 insertions(+), 11 deletions(-)
```
|