failed to install ca-certificates-java in ppc64le systems: fatal: Tried to call a TRAP

Bug #1980896 reported by You-Sheng Yang
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
qemu (Ubuntu)
Fix Released
Undecided
Unassigned
Bionic
Won't Fix
Undecided
Unassigned
Focal
Confirmed
Undecided
Unassigned
Impish
Won't Fix
Undecided
Unassigned
Jammy
Fix Released
Undecided
Unassigned
Kinetic
Fix Released
Undecided
Unassigned

Bug Description

[SRU Justification]

[Impact]

Failed to install ca-certificates-java in qemu emulated ppc64el guest environment.

[Fix]

Upstream commit 083fe9a12d20 ("linux-user/ppc: deliver SIGTRAP on POWERPC_EXCP_TRAP") along with the corresponding fix for tests in commit 62089c849d49 ("tests/tcg/ppc64le: change signal_save_restore_xer to use SIGTRAP") have been accepted in upstream version v7.0.0-rc0.

The first patch depends on commit d30e60e7b4c3 ("linux-user/ppc: Use force_sig_fault").

[Test Case]

apt-get install -y qemu qemu-user-static
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
docker run -it ppc64le/ubuntu:20.04 bash
apt-get update && apt-get install -y openjdk-11-jdk

[Where problems could occur]

SIGTRAP will then be handled properly inside the emulated environment, so if some tool in the host side is expecting for such failure, it will no longer be valid.

[Other Info]

While Debian already packaged qemu 1:7.0+dfsg-7 in https://packages.debian.org/source/sid/qemu, it would be better to upgrade qemu/kinetic to that instead, but I'll left that for the maintainers.

For Impish and older, it takes more prerequisite commits yet to be found and back ported.

There is another bug 1981339 waiting to enter -proposed.
Please consider picking it up once you have moved this one to -updates.

========== original bug report ==========

Upstream bug: https://gitlab.com/qemu-project/qemu/-/issues/588

[Host environmen]

Operating system: Ubuntu Bionic/Focal/Kinetic
OS/kernel version:
Architecture: ppc64le
QEMU flavor: qemu-system-x86_64
QEMU version: 1:2.11+dfsg-1ubuntu7.40 (bionic), 1:4.2-3ubuntu6.23 (focal), 1:6.2+dfsg-2ubuntu6.2 (jammy)

[QEMU command line]

apt-get install -y qemu qemu-user-static
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
docker run -it ppc64le/ubuntu:20.04 bash
apt-get update && apt-get install -y openjdk-11-jdk

[Emulated/Virtualized environment]

Operating system: Ubuntu Bionic/Focal/Impish/Kinetic
OS/kernel version:
Architecture: ppc64le

[Description of problem]

qemu: fatal: Tried to call a TRAP occurs while running the:
/etc/ca-certificates/update.d/jks-keystore script which is part of the package ca-certificates-java that is installed as a dependency of openjdk-11-jdk

Unknown privilege violation (03)
NIP 0000004012db12b0 LR 0000004002a4335c CTR 0000004012db1280 XER 0000000000000000 CPU#1
MSR 9000000102806901 HID0 0000000000000000 HF 9000000002806001 iidx 6 didx 6
TB 00000538 2314542730558
GPR00 ffffffbffcc22660 00000040033dd940 0000004002d92f00 00000040033de9a0
GPR04 0000000000000000 0000000000002000 0000000000000000 0000000000000000
GPR08 0000004002df2f00 0000004002df3460 0000000000000001 0000000000000000
GPR12 0000004012db1280 00000040033e88f0 0000004001b87410 0000000000000000
GPR16 0000004001872000 0000004012db12a4 0000004012db12ac 0000004012db12d0
GPR20 0000004012db12d8 00000000000003d8 0000004004014e20 00000040040151f8
GPR24 0000004002dc39f8 00000040033df9a0 0000004004014e10 0000004004014dd0
GPR28 0000004002df3470 0000004012db1280 0000004002df4600 00000040033dd940
CR 24884400 [ E G L L G G - - ] RES 00000040033de9a0
qemu: fatal: Tried to call a TRAP

NIP 0000004013342588 LR 0000004013340d84 CTR 0000004013340c8c XER 0000000000000000 CPU#1
MSR 9000000102806901 HID0 0000000000000000 HF 9000000002806001 iidx 6 didx 6
TB 00000539 2317026761994
GPR00 0000000000000001 00000040033df9d0 0000004013340c00 00000000fff7ad68
GPR04 00000000fff7ad68 000000404d235860 0000000000000105 0000000000000000
GPR08 0000000100013f10 0000000000000000 0000000000000008 00000040033cfa60
GPR12 000000010003cd10 00000040033e88f0 000000404d204303 00000040033dfac0
GPR16 0000004004016000 00000000fff7ad68 00000040033dfb88 0000000100001808
GPR20 0000004012db8b90 00000040033dfa50 0000004012db8b90 0000000044000000
GPR24 0000004012dd9000 0000004002dd6aa0 00000040033dfad8 000000404d204b08
GPR28 0000000000000000 0000004012db1000 0000000000000010 000000404d2047a8
CR 48884424 [ G L L L G G E G ] RES ffffffffffffffff
FPR00 0000000100016f00 3ff000853ce957eb 0000000000000000 0000000000000000
FPR04 000000000000000a 0000000000000006 000000000000000e 0000000000000000
FPR08 0000000000000042 403a000000000000 0000000000000064 0000000000000064
FPR12 4060000000000000 0000003000000000 0000000000000000 0000000000000060
FPR16 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR20 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR24 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPR28 0000000000000000 0000000000000000 0000000000000000 0000000000000000
FPSCR 000000008a008000
Aborted (core dumped)

[Steps to reproduce]

apt-get install -y qemu qemu-user-static
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
docker run -it ppc64le/ubuntu:20.04 bash
apt-get update && apt-get install -y openjdk-11-jdk

Related branches

CVE References

Revision history for this message
You-Sheng Yang (vicamo) wrote :
Revision history for this message
You-Sheng Yang (vicamo) wrote :

This is supposed to be fixed in upstream version v7.0.0-rc0 or newer. Debian bookworm has 1:7.0+dfsg-7.

Revision history for this message
You-Sheng Yang (vicamo) wrote :

Test builds available for jammy and kinetic in https://launchpad.net/~vicamo/+archive/ubuntu/ppa-1980896

Revision history for this message
You-Sheng Yang (vicamo) wrote : Re: [Bug 1980896] Re: failed to install ca-certificates-java in ppc64le systems: fatal: Tried to call a TRAP

Attach proposed debdiff for jammy (6.2+dfsg-2ubuntu6.4) and kinetic
(6.2+dfsg-2ubuntu9). Need sponsor for uploading.

Changed in qemu (Ubuntu Jammy):
status: New → In Progress
Changed in qemu (Ubuntu Kinetic):
status: New → In Progress
Changed in qemu (Ubuntu Impish):
status: New → Confirmed
Changed in qemu (Ubuntu Focal):
status: New → Confirmed
Changed in qemu (Ubuntu Bionic):
status: New → Confirmed
Revision history for this message
You-Sheng Yang (vicamo) wrote :

For Impish and older, it takes more prerequisite commits yet to be found and back ported.

You-Sheng Yang (vicamo)
description: updated
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

FYI - I'm working on qemu 7.0 for Kinetic - consider this soon to be fixed there.
I'll add a bug reference to this bug to the changelog.

Changed in qemu (Ubuntu Kinetic):
assignee: nobody → Christian Ehrhardt  (paelzer)
Revision history for this message
You-Sheng Yang (vicamo) wrote :

Thanks for the update.

Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (9.1 KiB)

This bug was fixed in the package qemu - 1:7.0+dfsg-7ubuntu1

---------------
qemu (1:7.0+dfsg-7ubuntu1) kinetic; urgency=medium

  * Merge with Debian unstable (LP: #1971315)(LP: #1980896), remaining changes:
    - qemu-kvm to systemd unit
      - d/qemu-kvm-init: script for QEMU KVM preparation modules, ksm,
        hugepages and architecture specifics
      - d/qemu-system-common.qemu-kvm.service: systemd unit to call
        qemu-kvm-init
      - d/qemu-system-common.install: install helper script
      - d/qemu-system-common.qemu-kvm.default: defaults for
        /etc/default/qemu-kvm
      - d/rules: call dh_installinit and dh_installsystemd for qemu-kvm
    - Distribution specific machine type
      (LP: 1304107 1621042 1776189 1761372 1761372 1776189)
      - d/p/ubuntu/define-ubuntu-machine-types.patch: define distro machine
        types containing release versioned machine attributes
      - d/qemu-system-x86.NEWS Info on fixed machine type defintions
        for host-phys-bits=true
      - Add an info about -hpb machine type in debian/qemu-system-x86.NEWS
      - ubuntu-q35 alias added to auto-select the most recent q35 ubuntu type
    - Enable nesting by default
      - d/p/ubuntu/enable-svm-by-default.patch: Enable nested svm by default
        in qemu64 on amd
        [ No more strictly needed, but required for backward compatibility ]
    - tolerate ipxe size change on migrations to >=18.04 (LP: 1713490)
      - d/p/ubuntu/pre-bionic-256k-ipxe-efi-roms.patch: old machine types
        reference 256k path
      - d/control-in: depend on ipxe-qemu-256k-compat-efi-roms to be able to
        handle incoming migrations from former releases.
    - d/qemu-system-x86.README.Debian: add info about updated nesting changes
    - Ease the use of module retention on upgrades (LP 1913421)
      - debian/qemu-block-extra.postinst: enable mount unit on install/upgrade
    - Fix I/O stalls when using NVMe storage (LP 1970737).
      - d/p/lp1970737-linux-aio-*.patch: Fix unbalanced plugged counter
        in laio_io_unplug.
    - SECURITY UPDATE: heap overflow in floppy disk emulator
      - debian/patches/CVE-2021-3507.patch: prevent end-of-track overrun in
        hw/block/fdc.c.
      - CVE-2021-3507
  * Dropped Changes [now part of 1:7.0+dfsg-7]:
    - d/rules: xen libexec dir is no more versioned
    - d/rules: ensure xen is built on x86
    - d/kvm-spice: fix when acceleration is already defined on the commandline
    - debian/control[-in]: no more disable glusterfs in Ubuntu (LP 1246924)
  * Dropped Changes [now part of upstream v7.0.0]
    - d/p/u/lp-1959984-s390x-ipl-support-extended-kernel-command-line-size.patch
      Allow long kernel command lines for QEMU (LP 1959984)
    - d/p/u/fix-virtiofsd-for-glibc2.35.patch: add rseq to seccomp allow list
    - d/p/u/tcg-Remove-dh_alias-indirection-for-dh_typecode.patch: fix 32bit
      tcg on s390x.
    - Fix diff handling on ceph that can cause data corruption (LP 1968258)
      - d/p/u/lp-1968258-block-rbd-fix-handling-of-holes-in-.bdrv_co.patch
      - d/p/u/lp-1968258-block-rbd-workaround-for-ceph-issue-53784.patch
    - d/p/u/lp-1970563-ui-vnc.c-Fixed-a-deadlock-bug.patch: avoid deadl...

Read more...

Changed in qemu (Ubuntu Kinetic):
status: In Progress → Fix Released
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Now that this completed in Kinetic, the PPA build being fine, and the patches & changelog being ok I think we can kick this off in Jammy.

Note: You do not need to list yourself twice in the changelog, that is only needed if multiple contributors added content - I fixed this up and sponsored that.

Note: especially with code that is architecture sensitive - like qemu - I recommend next time to enable more than just amd64 in the test PPA.

=> Reviewed and Sponsored to Jammy.
Please help with the verification once accepted by the SRU team.

Changed in qemu (Ubuntu Kinetic):
assignee: Christian Ehrhardt  (paelzer) → nobody
Revision history for this message
Chris Halse Rogers (raof) wrote : Please test proposed package

Hello You-Sheng, or anyone else affected,

Accepted qemu into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/qemu/1:6.2+dfsg-2ubuntu6.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in qemu (Ubuntu Jammy):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-jammy
Revision history for this message
Ubuntu SRU Bot (ubuntu-sru-bot) wrote : Autopkgtest regression report (qemu/1:6.2+dfsg-2ubuntu6.4)

All autopkgtests for the newly accepted qemu (1:6.2+dfsg-2ubuntu6.4) for jammy have finished running.
The following regressions have been reported in tests triggered by the package:

systemd/unknown (s390x)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/jammy/update_excuses.html#qemu

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

FYI: the autopkgtests have been flaky and are good now.

@You-Sheng Yang - will you please do the verification so that this can move to Jammy?
I'd have another SRU in the queue which is waiting for this one to complete.

description: updated
Revision history for this message
You-Sheng Yang (vicamo) wrote :

With qemu-user-static/jammy-proposed version 1:6.2+dfsg-2ubuntu6.4:

```
root@f84c7d239ca2:/# apt-get update && apt-get install -y openjdk-11-jdk
...
Running hooks in /etc/ca-certificates/update.d...

Unknown privilege violation (03)
NIP 000000401a7513b0 LR 0000004002a549bc CTR 000000401a751380 XER 0000000000000000 CPU#1
MSR 9000000102806901 HID0 0000000000000000 HF 02806105 iidx 0 didx 0
TB 00000242 1042010576274
GPR00 ffffffbffcc11660 00000040033ee940 0000004002da3f00 00000040033ef9a0
GPR04 0000000000000000 0000000000002000 0000000000000000 0000000000000000
GPR08 0000004002e03f00 0000004002dc6f54 0000000000000001 0000000000000000
GPR12 000000401a751380 00000040033f98f0 0000004001b88410 0000000000000000
GPR16 0000004001872000 000000401a7513a4 000000401a7513ac 000000401a7513d0
GPR20 000000401a7513d8 00000000000003d8 0000004004014620 00000040040149f8
GPR24 0000004002dd4db8 00000040033f09a0 0000004004014610 00000040040145d0
GPR28 0000004002dc6f60 000000401a751380 0000004002e05a70 00000040033ee940
CR 28884400 [ E L L L G G - - ] RES 00000040033ef9a0
done.
done.
root@f84c7d239ca2:/# echo $?
0
```

That Unknown privilege violation still exists, but no longer a fatal failure to qemu. Verified.

tags: added: verification-done verification-done-jammy
removed: verification-needed verification-needed-jammy
Revision history for this message
Chris Halse Rogers (raof) wrote : Update Released

The verification of the Stable Release Update for qemu has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package qemu - 1:6.2+dfsg-2ubuntu6.4

---------------
qemu (1:6.2+dfsg-2ubuntu6.4) jammy; urgency=medium

  * Fix ppc64le: fatal: Tried to call a TRAP (LP: #1980896)
    - linux-user/ppc: Use force_sig_fault
    - linux-user/ppc: deliver SIGTRAP on POWERPC_EXCP_TRAP
    - tests/tcg/ppc64le: change signal_save_restore_xer to use SIGTRAP

 -- You-Sheng Yang <email address hidden> Thu, 07 Jul 2022 02:52:56 +0000

Changed in qemu (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
Steve Langasek (vorlon) wrote :

bionic has reached the end of standard support and is now supported only for security fixes via Ubuntu ESM (Extended Security Maintenance). I'm therefore closing the bionic task as wontfix.

Changed in qemu (Ubuntu Impish):
status: Confirmed → Won't Fix
Changed in qemu (Ubuntu Bionic):
status: Confirmed → Won't Fix
Revision history for this message
Steve Langasek (vorlon) wrote :

ubuntu-sponsors is subscribed to this bug report, and there is an open task on focal which is a potential candidate for SRUing, but there is no patch against qemu 4.2-3 attached to this bug. I am unsubscribing ubuntu-sponsors. If you want this SRUed to focal and prepare a corresponding patch, please subscribe ubuntu-sponsors again.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.