or1k tcg SIGILL

qemu master (v7.0.0-1429-g7077fcb9) running on a Linux v5.17 arm64 host (Apple M1). The issue does not happen when running on an amd64 host.

Running Linux under the or1ksim machine:

$ qemu-system-or1k -nographic -kernel vmlinux 

Thread 3 "qemu-system-or1" received signal SIGILL, Illegal instruction.
[Switching to Thread 0xfffff5b5c9d0 (LWP 3373353)]
0x0000ffffb01db228 in code_gen_buffer ()
(gdb) bt
#0  0x0000ffffb01db228 in code_gen_buffer ()
#1  0x0000aaaaaacf2e88 in cpu_tb_exec
    (cpu=cpu@entry=0xaaaaab1db410, itb=itb@entry=0xffffb01db100 <code_gen_buffer+1945780>, tb_exit=tb_exit@entry=0xfffff5b5bf20) at ../accel/tcg/cpu-exec.c:358
#2  0x0000aaaaaacf3e38 in cpu_loop_exec_tb
    (tb_exit=0xfffff5b5bf20, last_tb=<synthetic pointer>, tb=0xffffb01db100 <code_gen_buffer+1945780>, cpu=0xaaaaab1db410) at ../accel/tcg/cpu-exec.c:848
#3  cpu_exec (cpu=cpu@entry=0xaaaaab1db410) at ../accel/tcg/cpu-exec.c:1007
#4  0x0000aaaaaad0e090 in tcg_cpus_exec (cpu=cpu@entry=0xaaaaab1db410)
    at ../accel/tcg/tcg-accel-ops.c:67
#5  0x0000aaaaaad0e9f4 in rr_cpu_thread_fn (arg=arg@entry=0xaaaaab1db410)
    at ../accel/tcg/tcg-accel-ops-rr.c:223
#6  0x0000aaaaaae88be8 in qemu_thread_start (args=<optimized out>)
    at ../util/qemu-thread-posix.c:504
#7  0x0000fffff7267f3c in start_thread (arg=0x0) at pthread_create.c:481
#8  0x0000fffff6b57cdc in thread_start () at ../sysdeps/unix/sysv/linux/aarch64/clone.S:79

Running with debugging enabled:

$ qemu-system-or1k -nographic -kernel or1ksim/vmlinux -d exec,cpu,out_asm,in_asm

IN: clocks_calc_mult_shift
0xc0074ee8:  l.ori     r30, r0, 31
0xc0074eec:  l.srli    r25, r28, 1
0xc0074ef0:  l.ori     r16, r0, 32
0xc0074ef4:  l.srli    r23, r24, 1
0xc0074ef8:  l.addi    r26, r22, -32
0xc0074efc:  l.sub     r14, r30, r22
0xc0074f00:  l.addi    r19, r16, -32
0xc0074f04:  l.sub     r17, r30, r16
0xc0074f08:  l.sfgesi  r19, 0
0xc0074f0c:  l.sll     r21, r24, r19
0xc0074f10:  l.srl     r17, r23, r17
0xc0074f14:  l.bnf     52
0xc0074f18:  l.sll     r19, r24, r16

OUT: [size=168]
  -- guest addr 0xc0074ee8 + tb prologue
0xffff441db1c0:  b85f0274  ldur     w20, [x19, #-0x10]
0xffff441db1c4:  7100029f  cmp      w20, #0
0xffff441db1c8:  5400048b  b.lt     #0xffff441db258
0xffff441db1cc:  528003f4  movz     w20, #0x1f
0xffff441db1d0:  b9007a74  str      w20, [x19, #0x78]
  -- guest addr 0xc0074eec
0xffff441db1d4:  b9407274  ldr      w20, [x19, #0x70]
0xffff441db1d8:  53017e94  lsr      w20, w20, #1
0xffff441db1dc:  b9006674  str      w20, [x19, #0x64]
  -- guest addr 0xc0074ef0
0xffff441db1e0:  52800414  movz     w20, #0x20
0xffff441db1e4:  b9004274  str      w20, [x19, #0x40]
  -- guest addr 0xc0074ef4
0xffff441db1e8:  b9406274  ldr      w20, [x19, #0x60]
0xffff441db1ec:  53017e95  lsr      w21, w20, #1
0xffff441db1f0:  b9005e75  str      w21, [x19, #0x5c]
  -- guest addr 0xc0074ef8
0xffff441db1f4:  b9405a75  ldr      w21, [x19, #0x58]
0xffff441db1f8:  510082b6  sub      w22, w21, #0x20
0xffff441db1fc:  b9006a76  str      w22, [x19, #0x68]
  -- guest addr 0xc0074efc
0xffff441db200:  528003f6  movz     w22, #0x1f
0xffff441db204:  4b1502d5  sub      w21, w22, w21
0xffff441db208:  b9003a75  str      w21, [x19, #0x38]
  -- guest addr 0xc0074f04
0xffff441db20c:  b9082a76  str      w22, [x19, #0x828]
0xffff441db210:  52800035  movz     w21, #0x1
0xffff441db214:  b9082675  str      w21, [x19, #0x824]
  -- guest addr 0xc0074f08
0xffff441db218:  52800035  movz     w21, #0x1
0xffff441db21c:  b9082275  str      w21, [x19, #0x820]
  -- guest addr 0xc0074f0c
0xffff441db220:  b9005674  str      w20, [x19, #0x54]
  -- guest addr 0xc0074f10
0xffff441db224:  b900467f  str      wzr, [x19, #0x44]
  -- guest addr 0xc0074f18
0xffff441db228:  53207e94  .byte    0x94, 0x7e, 0x20, 0x53
0xffff441db22c:  b9004e74  str      w20, [x19, #0x4c]
0xffff441db230:  5289e314  movz     w20, #0x4f18
0xffff441db234:  72b800f4  movk     w20, #0xc007, lsl #16
0xffff441db238:  b9080674  str      w20, [x19, #0x804]
0xffff441db23c:  5289e394  movz     w20, #0x4f1c
0xffff441db240:  72b800f4  movk     w20, #0xc007, lsl #16
0xffff441db244:  b9080274  str      w20, [x19, #0x800]
0xffff441db248:  aa1303e0  mov      x0, x19
0xffff441db24c:  580000be  ldr      x30, #0xffff441db260
0xffff441db250:  d63f03c0  blr      x30
0xffff441db254:  d61f0000  br       x0
0xffff441db258:  70fff540  adr      x0, #0xffff441db103
0xffff441db25c:  17f89374  b        #0xffff4400002c
  data: [size=8]
0xffff441db260:  .quad  0x0000aaaae9be36c4

Linking TBs 0xffff441db080 [c0075014] index 0 -> 0xffff441db1c0 [c0074ee8]
Trace 0: 0xffff441db1c0 [00000000/c0074ee8/00000065/ff000000] clocks_calc_mult_shift
PC=c0074ee8
R00=00000000 R01=c046bf14 R02=c046bf50 R03=00000000
R04=00000000 R05=00000000 R06=00000000 R07=000000d6
R08=ffffffff R09=c0074eb8 R10=c046a000 R11=00000000
R12=ff1b9e00 R13=00000008 R14=00000000 R15=98968000
R16=00000001 R17=00000000 R18=c0474d90 R19=00000010
R20=c0474d8c R21=00000000 R22=00000020 R23=00000000
R24=3b9aca00 R25=00000131 R26=c04b74c4 R27=00000010
R28=01312d00 R29=00000000 R30=c0498880 R31=00000000
Illegal instruction (core dumped)

The crash happens on this generated instruction:

0xffff441db228:  53207e94  .byte    0x94, 0x7e, 0x20, 0x53