[Bug 286875] emulators/qemu-user-static-devel: Switch to blitz, and sync to 11.0.50; restore build on 15+

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=286875

--- Comment #43 from Rick Richard <rick@sloservers.com> ---
The aarch64 failure in comment #40 is not caused by the pull request. blitz
reproduces it with only the two patches needed to execute a guest at all, and
it is the same failure Alexey reported in comment #32.

Two bugs, both now fixed in the pull request:

1. mmap_find_vma() converts the host address it receives with h2g(), which
   subtracts guest_base. The kernel may return an address below guest_base,
   and the subtraction wraps. h2g_valid() does not catch it: without
   reserved_va, guest_addr_max is ~0ul, so the comparison is always true. The
   wrapped value becomes the initial stack address, and libthr derives its red
   zone from _usrstack, so every threaded program dies at startup.

   riscv64 does not hit this because guest_base is 0 and the subtraction
   cannot wrap. armv7 does not because reserved_va gives guest_addr_max a real
   bound.

2. setup_arg_pages() places the stack with mmap() and keeps whatever address
   it gets back, but the KERN_USRSTACK sysctl answered with TARGET_USRSTACK,
   the address it had asked for. On aarch64 the two differ by orders of
   magnitude: 0x7fffdf000000 reported against a stack at 0x80b30bafc. Boehm GC
   scans conservatively from that base and faults, which is why www/w3m dies
   building its mktable helper.

The first needs no poudriere to reproduce. Any threaded program will do:

    #include <pthread.h>

    static void *
    w(void *a)
    {
            return (a);
    }

    int
    main(void)
    {
            pthread_t t;

            if (pthread_create(&t, NULL, w, NULL) != 0)
                    return (2);
            return (pthread_join(t, NULL));
    }

On blitz with only the two execute-a-guest patches:

    Fatal error 'Cannot allocate red zone for initial thread' at line 398 in
    file /usr/src/lib/libthr/thread/thr_init.c (errno = 1073737728)

With the pull request it exits 0.

Checked on a 15.1-RELEASE aarch64 jail created as in comment #40, with
poudriere jail -c -m http -v 15.1-RELEASE -a arm64.aarch64 -x: ports-mgmt/pkg
builds, and a 13-port request expanding to 91 packages builds in full, www/w3m
included. w3m needed the second fix; the rest needed only the first.

    https://github.com/qemu-bsd-user/qemu-bsd-user/pull/68

-- 
You are receiving this mail because:
You are the assignee for the bug.