From owner-freebsd-ports@freebsd.org Thu Aug 31 19:40:58 2017 Return-Path: Delivered-To: freebsd-ports@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 89EE7E048B7 for ; Thu, 31 Aug 2017 19:40:58 +0000 (UTC) (envelope-from markmi@dsl-only.net) Received: from asp.reflexion.net (outbound-mail-210-93.reflexion.net [208.70.210.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4DC6364CA3 for ; Thu, 31 Aug 2017 19:40:57 +0000 (UTC) (envelope-from markmi@dsl-only.net) Received: (qmail 13294 invoked from network); 31 Aug 2017 19:40:56 -0000 Received: from unknown (HELO mail-cs-01.app.dca.reflexion.local) (10.81.19.1) by 0 (rfx-qmail) with SMTP; 31 Aug 2017 19:40:56 -0000 Received: by mail-cs-01.app.dca.reflexion.local (Reflexion email security v8.40.2) with SMTP; Thu, 31 Aug 2017 15:40:56 -0400 (EDT) Received: (qmail 4786 invoked from network); 31 Aug 2017 19:40:56 -0000 Received: from unknown (HELO iron2.pdx.net) (69.64.224.71) by 0 (rfx-qmail) with (AES256-SHA encrypted) SMTP; 31 Aug 2017 19:40:56 -0000 Received: from [192.168.1.109] (c-67-170-167-181.hsd1.or.comcast.net [67.170.167.181]) by iron2.pdx.net (Postfix) with ESMTPSA id 79869EC7ED7; Thu, 31 Aug 2017 12:40:55 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Subject: Re: FYI: qemu-ppc64-static and qemu-ppc-static "live-hang" when I attempt use with poudriere; qemu-arm-static and qemu-aarch64-static work From: Mark Millard In-Reply-To: <85B5ADE0-5573-4E04-8EC3-CB5751C035FF@dsl-only.net> Date: Thu, 31 Aug 2017 12:40:54 -0700 Cc: Don Lewis , Mark Linimon , FreeBSD Toolchain , FreeBSD Ports , freebsd-ppc@freebsd.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <201708302332.v7UNWSVY073465@gw.catspoiler.org> <9B916738-394B-48B7-AA2E-6193F54760B3@dsl-only.net> <85B5ADE0-5573-4E04-8EC3-CB5751C035FF@dsl-only.net> To: Sean Bruno X-Mailer: Apple Mail (2.3273) X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Aug 2017 19:40:58 -0000 [Just adding Sean Bruno in case the information is new to him. I top post a note for that.] Sean: The below reports on what I've found for what is happening for qemu-ppc64-static (and possibly others) when it gets stuck eating CPU time (and leaking memory), at least for the example I ran into (that basically blocks all use of qemu-ppc64-static it happens very early in all(?) attempted uses that load. The content reflects my exploration order. The summary is: A) I've found an example context where the emulated pc does not progress and it ends up looping repeating a syscall. B) Given that is involved: I've found that env->gpr[3] handling for failed syscall attempts contributes to the detailed failure behaviors. (This part is, of course, likely very powerpc specific.) But I found (B) before finding (A) as its context and (A) might be the only problem for all I know: having the emulated program counter progress correctly might end up dealing with env->gpr[3] correctly in the newly executed code. At this point I've no clue where the emulated PC should be adjusted in the code or what the detailed adjustment rules should be for the context, only that the PC is not being adjusted now but needs to be adjusted. =3D=3D=3D Mark Millard markmi at dsl-only.net On 2017-Aug-31, at 12:13 PM, Mark Millard = wrote: [Turns out that the emulated program counter is not progressing for syscall emulation, at least for [some] syscall [failure] cases.] On 2017-Aug-30, at 8:43 PM, Mark Millard wrote: > On 2017-Aug-30, at 4:32 PM, Don Lewis wrote: >=20 >> On 30 Aug, Mark Millard wrote: >>> On 2017-Aug-30, at 4:00 AM, Mark Linimon = wrote: >>>=20 >>>> On Wed, Aug 30, 2017 at 03:09:40AM -0700, Mark Millard wrote: >>>>> It appears that qemu-ppc64-static and qemu-ppc-static from >>>>> emulators/qemu-user-static are broken. >>>>=20 >>>> Correct, and known for some time. (fwiw sparc64 hangs as well.) >>>=20 >>> Looks like qemu-ppc64-static is stuck in a loop, calling >>> repeatedly: >>>=20 >>> do_freebsd_syscall (cpu_env=3D0x860ea3ac0, num=3D58, arg1=3D14, = arg2=3D35995509911, arg3=3D1024, arg4=3D268435904, arg5=3D281494784, = arg6=3D35985701568, arg7=3D515, arg8=3D35985668288) >>> at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/syscall.c:210 >>> 210 = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/syscall.c: No such file or directory. >>>=20 >>> Which is for: >>>=20 >>> 58 AUE_READLINK STD { ssize_t readlink(char *path, char = *buf, \ >>> size_t count); } >>>=20 >>> As confirmed by (note the "callq 0x60207360 " ): >>>=20 >>> (gdb)=20 >>> lock_user_string (guest_addr=3D14) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/qemu.h:508 >>> 508 = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/qemu.h: No such file or directory. >>>=20 >>> (gdb) x/64i 0x0000000060045d3e >>> =3D> 0x60045d3e : callq 0x6004fd20 = >>> 0x60045d43 : test %rax,%rax >>> 0x60045d46 : js 0x6004b99c = >>> 0x60045d4c : inc %rax >>> 0x60045d4f : mov $0x1,%edx >>> 0x60045d54 : mov %rbx,%rdi >>> 0x60045d57 : mov %rax,%rsi >>> 0x60045d5a : callq 0x6003c430 = >>> 0x60045d5f : test %eax,%eax >>> 0x60045d61 : jne 0x6004bce4 = >>> 0x60045d67 : add = 0x26d91b2(%rip),%rbx # 0x6271ef20 >>> 0x60045d6e : je 0x6004bce4 = >>> 0x60045d74 : mov $0x3,%edx >>> 0x60045d79 : mov -0x2a8(%rbp),%r14 >>> 0x60045d80 : mov %r14,%rdi >>> 0x60045d83 : mov %r12,%rsi >>> 0x60045d86 : callq 0x6003c430 = >>> 0x60045d8b : test %eax,%eax >>> 0x60045d8d : jne 0x6004bce4 = >>> 0x60045d93 : add = 0x26d9186(%rip),%r14 # 0x6271ef20 >>> 0x60045d9a : mov = -0x294(%rbp),%r10d >>> 0x60045da1 : mov = $0xfffffffffffffff2,%r13 >>> 0x60045da8 : je 0x6004bcf2 = >>> 0x60045dae : mov $0x602b93da,%esi >>> 0x60045db3 : mov %rbx,%rdi >>> 0x60045db6 : callq 0x60230af0 = >>> 0x60045dbb : test %eax,%eax >>> 0x60045dbd : je 0x6004c566 = >>> 0x60045dc3 : mov %rbx,%rdi >>> 0x60045dc6 : callq 0x60158660 >>> 0x60045dcb : mov %rax,%rdi >>> 0x60045dce : mov %r14,%rsi >>> 0x60045dd1 : mov %r12,%rdx >>> 0x60045dd4 : callq 0x60207360 = >>>=20 >>> But note that the "lock_user_string (guest_addr=3D14)" and >>> "do_freebsd_syscall (cpu_env=3D0x860ea3ac0, num=3D58, arg1=3D14," >>> indicate that the "readlink(char *path," is using a really >>> small address for the path string. >>>=20 >>>=20 >>> I've not figured a way for poudriere bulk builds to leave >>> behind the source code automatically. So far I've not >>> looked at the qemu-bsd-user source code. I do build with >>> both debug and optimization turned on via bsd.port.mk >>> having: >>=20 >> The -w option will create a tarball of the work directory if the >> package build fails. I also often use the testport -i option I want = to >> poke around in the WRKDIR after a build. >=20 > I've been using -w right along. But I'd not used testport at all. >=20 > It looks to me like the syscall errno handling is messed > up. The details that I've observed follow. It follows > a simplified sequence of discovery as far a presentation > order goes. >=20 > The looping code is: >=20 > static inline void target_cpu_loop(CPUPPCState *env) > { > CPUState *cs =3D CPU(ppc_env_get_cpu(env)); > target_siginfo_t info; > int trapnr; > target_ulong ret; >=20 > for(;;) { > cpu_exec_start(cs); > trapnr =3D cpu_exec(cs); > cpu_exec_end(cs); > process_queued_cpu_work(cs); >=20 > switch(trapnr) { > . . . > case POWERPC_EXCP_SYSCALL_USER: > /* system call in user-mode emulation */ > /* WARNING: > * PPC ABI uses overflow flag in cr0 to signal an error > * in syscalls. > */ > env->crf[0] &=3D ~0x1; > ret =3D do_freebsd_syscall(env, env->gpr[0], env->gpr[3], = env->gpr[4], > env->gpr[5], env->gpr[6], env->gpr[7], > env->gpr[8], env->gpr[9], env->gpr[10]); > if (ret =3D=3D (target_ulong)(-TARGET_QEMU_ESIGRETURN)) { > /* Returning from a successful sigreturn syscall. > Avoid corrupting register state. */ > break; > } > if (ret > (target_ulong)(-515)) { > env->crf[0] |=3D 0x1; > ret =3D -ret; > } > env->gpr[3] =3D ret; > break; > . . . > } > process_pending_signals(env); > } > } >=20 > The observed env->gpr[3] =3D=3D 14 is from a prior loop > iteration having ret =3D=3D 14 in the: >=20 > env->gpr[3] =3D ret; >=20 > Prior to this were the values (as seen via > lock_user_string): >=20 > guest_addr=3D278408977 > guest_addr=3D2 >=20 > That 2 also came from the prior ret =3D=3D 2 in the: >=20 > env->gpr[3] =3D ret; >=20 > from when the 278408977 was in being attempted. >=20 > For both the ret =3D=3D 2 and ret =3D=3D 14 were from: >=20 > ret =3D -ret; >=20 > so the return values from do_freebsd_syscall were > -2 and -14 (interpreted as signed). >=20 > The return values trace back to the following code, > where TARGET_EFAULT =3D=3D 14 : >=20 > static inline abi_long do_bsd_readlink(CPUArchState *env, abi_long = arg1, > abi_long arg2, abi_long arg3) > { > abi_long ret; > void *p1, *p2; >=20 > LOCK_PATH(p1, arg1); > p2 =3D lock_user(VERIFY_WRITE, arg2, arg3, 0); > if (p2 =3D=3D NULL) { > UNLOCK_PATH(p1, arg1); > return -TARGET_EFAULT; > } > #ifdef __FreeBSD__ > if (strcmp(p1, "/proc/curproc/file") =3D=3D 0) { > CPUState *cpu =3D ENV_GET_CPU(env); > TaskState *ts =3D (TaskState *)cpu->opaque; > strncpy(p2, ts->bprm->fullpath, arg3); > ret =3D MIN((abi_long)strlen(ts->bprm->fullpath), arg3); > } else > #endif > ret =3D get_errno(readlink(path(p1), p2, arg3)); > unlock_user(p2, arg2, ret); > UNLOCK_PATH(p1, arg1); >=20 > return ret; > } >=20 > The 2 is from: >=20 > ret =3D get_errno(readlink(path(p1), p2, arg3)); >=20 > At the time the p1 points to "/etc/malloc.conf": >=20 > (gdb) step=20 > path (name=3D0x10982f11 "/etc/malloc.conf") at util/path.c:173 >=20 > 169 const char *path(const char *name) > 170 { > 171 /* Only do absolute paths: quick and dirty, but should = mostly be OK. > 172 Could do relative by tracking cwd. */ > (gdb)=20 > 173 if (!base || !name || name[0] !=3D '/') > 174 return name; > 175=09 > 176 return follow_path(base, name) ?: name; > 177 } >=20 > (gdb) print base > $8 =3D (struct pathelem *) 0x0 >=20 > So name is returned unchanged. >=20 >=20 > The 2 is in turn from: >=20 > #define __ENOENT 2 /* No such file or = directory */ >=20 >=20 > Overall one oddity is that this code structure > seems to use -ret from: >=20 > ret =3D do_freebsd_syscall(env, env->gpr[0], env->gpr[3], = env->gpr[4], > env->gpr[5], env->gpr[6], env->gpr[7], > env->gpr[8], env->gpr[9], env->gpr[10]); >=20 > to retry the same operation again the next iteration, > but with env->gpr[3] =3D=3D -ret (as ret was on the return > of do_freebsd_syscall ). >=20 > Once abs(ret) =3D=3D 14 it is fully stuck repeating itself. >=20 > I've no clue if: >=20 > env->gpr[3] =3D ret; >=20 > even makes sense here. >=20 > I've not tried to track down the memory leak activity > that is associated. >=20 > Nor have I checked anything for the: >=20 > cpu_exec_start(cs); > trapnr =3D cpu_exec(cs); > cpu_exec_end(cs); > process_queued_cpu_work(cs); >=20 > activity. It likely contributes to why the loop > retries the readlink again (with a junk address > for the path). I do not see activity advancing the emulated program counter as this looping/retrying happens. Nor anything that is adjusting the problematical re-used env->gpr[3] other than the: 516 env->gpr[3] =3D ret; after the negation of ret for the syscall failure handling. This is confirmed by the following: (gdb) bt #0 cpu_tb_exec (cpu=3D0x860e9b8c0, itb=3D0x60723340 = ) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:141 #1 0x0000000060039cb5 in cpu_loop_exec_tb (cpu=3D, = tb=3D, last_tb=3D, tb_exit=3D) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:574 #2 cpu_exec (cpu=3D) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:672 #3 0x000000006003c988 in target_cpu_loop (env=3D0x860ea3ac0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/ppc/target_arch_cpu.h:139 #4 cpu_loop (env=3D0x860ea3ac0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/main.c:121 #5 0x000000006003e003 in main (argc=3D, argv=3D) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/main.c:516 . . . (gdb) list 569 { 570 uintptr_t ret; 571 int32_t insns_left; 572=09 573 trace_exec_tb(tb, tb->pc); 574 ret =3D cpu_tb_exec(cpu, tb); 575 tb =3D (TranslationBlock *)(ret & ~TB_EXIT_MASK); 576 *tb_exit =3D ret & TB_EXIT_MASK; 577 if (*tb_exit !=3D TB_EXIT_REQUESTED) { 578 *last_tb =3D tb; . . . cpu_tb_exec (cpu=3D0x860e9b8c0, itb=3D0x60723340 = ) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:141 141 CPUArchState *env =3D cpu->env_ptr; (gdb) print/x itb->pc $16 =3D 0x1074d784 (gdb) c Continuing. Thread 1 hit Breakpoint 9, cpu_tb_exec (cpu=3D0x860e9b8c0, = itb=3D0x60723340 ) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:141 141 CPUArchState *env =3D cpu->env_ptr; . . . (gdb) print/x itb->pc $18 =3D 0x1074d784 (gdb) c Continuing. Thread 1 hit Breakpoint 9, cpu_tb_exec (cpu=3D0x860e9b8c0, = itb=3D0x60723340 ) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:141 141 CPUArchState *env =3D cpu->env_ptr; (gdb) print/x itb->pc $19 =3D 0x1074d784 (gdb) c Continuing. Thread 1 hit Breakpoint 9, cpu_tb_exec (cpu=3D0x860e9b8c0, = itb=3D0x60723340 ) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:141 141 CPUArchState *env =3D cpu->env_ptr; (gdb) print/x itb->pc $20 =3D 0x1074d784 and so on. So it appears that syscall emulation does not progress the emulated instruction pointer and so the syscall repeats over and over. (I've still not tracked down what is leaking memory during this looping. But that is probably a secodnary concern at this point.) So how does the code get from: 139 trapnr =3D cpu_exec(cs); to (re-)trying the failed syscall (readlink) attempt? (gdb) bt #0 0x00000000601e25c0 in siglongjmp () #1 0x000000006003a1aa in cpu_loop_exit_restore (cpu=3D, = pc=3D) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec-common.c:77 #2 0x00000000600e0eeb in raise_exception_err_ra (env=3D, = exception=3D, error_code=3D0, raddr=3D0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/t= arget/ppc/excp_helper.c:905 #3 helper_raise_exception_err (env=3D, = exception=3D, error_code=3D0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/t= arget/ppc/excp_helper.c:928 #4 0x00000000607233e6 in static_code_gen_buffer () #5 0x0000000060039ffa in cpu_tb_exec (cpu=3D0x860e9b8c0, itb=3D0x60723340= ) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:166 #6 0x0000000060039cb5 in cpu_loop_exec_tb (cpu=3D, = tb=3D, last_tb=3D, tb_exit=3D) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:574 #7 cpu_exec (cpu=3D) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:672 #8 0x000000006003c988 in target_cpu_loop (env=3D0x860ea3ac0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/ppc/target_arch_cpu.h:139 #9 cpu_loop (env=3D0x860ea3ac0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/main.c:121 #10 0x000000006003e003 in main (argc=3D, argv=3D) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/main.c:516 It does a siglongjmp via helper_raise_execption_err : (gdb) up #1 0x0000000060039ffa in cpu_tb_exec (cpu=3D0x860e9b8c0, itb=3D0x60723340= ) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:166 166 ret =3D tcg_qemu_tb_exec(env, tb_ptr); (gdb) list 161 qemu_log_unlock(); 162 } 163 #endif /* DEBUG_DISAS */ 164=09 165 cpu->can_do_io =3D !use_icount; 166 ret =3D tcg_qemu_tb_exec(env, tb_ptr); 167 cpu->can_do_io =3D 1; 168 last_tb =3D (TranslationBlock *)(ret & ~TB_EXIT_MASK); 169 tb_exit =3D ret & TB_EXIT_MASK; 170 trace_exec_tb_exit(last_tb, tb_exit); (gdb) print tb_ptr $11 =3D (uint8_t *) 0x607233c0 = "A\213n\354\205\355\017\214\037" 0x607233c0 : mov -0x14(%r14),%ebp 0x607233c4 : test %ebp,%ebp 0x607233c6 : jl 0x607233eb = 0x607233cc : movq = $0x1074d784,0x3c8(%r14) 0x607233d7 : mov %r14,%rdi 0x607233da : mov $0x203,%esi 0x607233df : xor %edx,%edx 0x607233e1 : callq 0x600e0ed0 = =3D> 0x607233e6 : jmpq 0x6071ef06 = 0x607233eb : mov $0x60723343,%eax 0x607233f0 : jmpq 0x6071ef08 = The exception is exception=3D=3D515 . 515 is the figure matching up with POWERPC_EXCP_SYSCALL_USER . (gdb) stepi helper_raise_exception_err (env=3D0x860ea3ac0, exception=3D515, = error_code=3D0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/t= arget/ppc/excp_helper.c:927 927 { (gdb) bt #0 helper_raise_exception_err (env=3D0x860ea3ac0, exception=3D515, = error_code=3D0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/t= arget/ppc/excp_helper.c:927 #1 0x00000000607233e6 in static_code_gen_buffer () #2 0x0000000060039ffa in cpu_tb_exec (cpu=3D0x860e9b8c0, itb=3D0x60723340= ) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:166 #3 0x0000000060039cb5 in cpu_loop_exec_tb (cpu=3D, = tb=3D, last_tb=3D, tb_exit=3D) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:574 #4 cpu_exec (cpu=3D) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:672 #5 0x000000006003c988 in target_cpu_loop (env=3D0x860ea3ac0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/ppc/target_arch_cpu.h:139 #6 cpu_loop (env=3D0x860ea3ac0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/main.c:121 #7 0x000000006003e003 in main (argc=3D, argv=3D) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/main.c:516 Later there is: raise_exception_err_ra (env=3D0x860ea3ac0, exception=3D515, = error_code=3D0, raddr=3D0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/t= arget/ppc/excp_helper.c:903 903 cs->exception_index =3D exception; and then: (gdb) s cpu_loop_exit_restore (cpu=3D0x860e9b8c0, pc=3D0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec-common.c:74 74 if (pc) { (gdb) n 77 siglongjmp(cpu->jmp_env, 1); (gdb) n 0x00000000600398e9 in cpu_exec (cpu=3D0x860e9b8c0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:645 645 if (sigsetjmp(cpu->jmp_env, 0) !=3D 0) { (gdb) bt #0 0x00000000600398e9 in cpu_exec (cpu=3D0x860e9b8c0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/a= ccel/tcg/cpu-exec.c:645 #1 0x000000006003c988 in target_cpu_loop (env=3D0x860ea3ac0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/ppc/target_arch_cpu.h:139 #2 cpu_loop (env=3D0x860ea3ac0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/main.c:121 #3 0x000000006003e003 in main (argc=3D, argv=3D) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/main.c:516 (gdb) n 651 cpu =3D current_cpu; (gdb)=20 652 cc =3D CPU_GET_CLASS(cpu); (gdb)=20 658 cpu->can_do_io =3D 1; (gdb)=20 659 tb_lock_reset(); (gdb)=20 660 if (qemu_mutex_iothread_locked()) { (gdb)=20 661 qemu_mutex_unlock_iothread(); (gdb)=20 666 while (!cpu_handle_exception(cpu, &ret)) { (gdb)=20 679 cc->cpu_exec_exit(cpu); (gdb) n 680 rcu_read_unlock(); (gdb) n 683 } (gdb) n target_cpu_loop (env=3D0x860ea3ac0) at = /wrkdirs/usr/ports/emulators/qemu-user-static/work/qemu-bsd-user-17977d0/b= sd-user/ppc/target_arch_cpu.h:140 140 cpu_exec_end(cs); And it sends up back in: 141 process_queued_cpu_work(cs); 142=09 143 switch(trapnr) { . . . 497 case POWERPC_EXCP_SYSCALL_USER: 498 /* system call in user-mode emulation */ 499 /* WARNING: 500 * PPC ABI uses overflow flag in cr0 to signal an = error 501 * in syscalls. 502 */ (gdb)=20 503 env->crf[0] &=3D ~0x1; 504 ret =3D do_freebsd_syscall(env, env->gpr[0], = env->gpr[3], env->gpr[4], 505 env->gpr[5], env->gpr[6], = env->gpr[7], 506 env->gpr[8], env->gpr[9], = env->gpr[10]); 507 if (ret =3D=3D = (target_ulong)(-TARGET_QEMU_ESIGRETURN)) { 508 /* Returning from a successful sigreturn = syscall. 509 Avoid corrupting register state. */ 510 break; 511 } 512 if (ret > (target_ulong)(-515)) { (gdb)=20 513 env->crf[0] |=3D 0x1; 514 ret =3D -ret; 515 } 516 env->gpr[3] =3D ret; 517 break; =3D=3D=3D Mark Millard markmi at dsl-only.net