Re: [Qemu-devel] [Bug 1156313] [NEW] X86-64 flags handling broken

[Richard Henderson]

On 03/17/2013 12:34 PM, Torbjorn Granlund wrote:
> Public bug reported:
> 
> The current qemu sources cause improper handling of flags on x86-64.
> This bug seems to have shown up a few weeks ago.
> 
> A plain install of Debian GNU/Linux makes user processes catch
> spurious signals.  The kernel seems to run stably, though.
> 
> The ADX feature works very poorly.  It might be related; at least it
> allows for reproducibly provoking invalid behaviour.

Patch at http://patchwork.ozlabs.org/patch/229139/

Knowing what the problem is, I'm able to reliably trigger the problem
with the userland emulator.  It's simply a matter of understanding
how to force the right garbage values into the qemu state.  E.g.

        .globl  adx, main
        .type   adx, @function
        .type   main, @function

adx:    mov     $0xdeadbeef, %eax
        add     $0, %eax
        mov     $0, %eax
        jmp     1f
1:      adox    %rax, %rax
        adcx    %rax, %rax
        ret

main:   call    adx
        lea     string(%rip), %rdi
        mov     %rax, %rsi
        call    printf
        xor     %eax, %eax
        ret

.rodata:
string: .asciz  "result %lx\n"

will always print deadbeef before the fix.  Thus while having a context
switch inside the loop tended to cause unpredictable behaviour, I believe
it to be a red herring.


r~