Re: [Qemu-devel] [PATCH 49/65] tcg/i386: Rely on undefined/undocumented behaviour of BSF/BSR

[Eduardo Habkost <ehabkost@redhat.com>]

On Mon, Jan 16, 2017 at 05:19:39PM -0200, Eduardo Habkost wrote:
> On Fri, Dec 23, 2016 at 08:00:26PM -0800, Richard Henderson wrote:
> > The ISA manual documents the output is undefined if the input was zero.
> > 
> > However, we document in target-i386 that the behavior of real silicon
> > is to preserve the contents of the output register.  We also mention
> > that there are real applications that depend on this.  That this is
> > baked into silicon is mentioned as a potential cause for some false
> > sharing behaviour wrt lzcnt/tzcnt.
> > 
> > Taking advantage of this allows us to save 2 insns in the normal case,
> > and 4 insns for i686 emulating a 64-bit clz.
> > 
> > Signed-off-by: Richard Henderson <rth@twiddle.net>
> 
> I am unable to boot a Fedora image[1] with TCG using latest master,
> and I have bisected the problem to this patch.
> 
> [1] http://download.fedoraproject.org/pub/fedora/linux/releases/25/CloudImages/x86_64/images/Fedora-Cloud-Base-25-1.3.x86_64.qcow2
> 
> $ qemu-system-x86_64 -machine accel=tcg -drive file=~/system/vmachines/Fedora-Cloud-Base-25-1.3.x86_64.qcow2,format=qcow2 -nographic
> [    0.000000] BUG: unable to handle kernel NULL pointer dereference at           (null)
[...]

With TCG debug enabled:

$ qemu-system-x86_64 -machine accel=tcg -drive file=~/system/vmachines/Fedora-Cloud-Base-25-1.3.x86_64.qcow2,format=qcow2 -nographic
qemu-system-x86_64: /home/ehabkost/rh/proj/virt/qemu/tcg/i386/tcg-target.inc.c:1153: tcg_out_ctz: Assertion `dest == arg2' failed.
Aborted (core dumped)

(gdb) bt
#0  0x00007f3332c50765 in raise () at /lib64/libc.so.6
#1  0x00007f3332c5236a in abort () at /lib64/libc.so.6
#2  0x00007f3332c48f97 in __assert_fail_base () at /lib64/libc.so.6
#3  0x00007f3332c49042 in  () at /lib64/libc.so.6
#4  0x000055dbccbd04e8 in tcg_gen_code (const_a2=false, arg2=3, arg1=TCG_REG_EBP, dest=TCG_REG_R12, rexw=<optimized out>, s=0x55dbcd5792c0 <tcg_ctx>) at /home/ehabkost/rh/proj/virt/qemu/tcg/i386/tcg-target.inc.c:1153
#5  0x000055dbccbd04e8 in tcg_gen_code (const_args=0x7f3327ecd6d0, args=0x7f3327ecd710, opc=<optimized out>, s=0x55dbcd5792c0 <tcg_ctx>) at /home/ehabkost/rh/proj/virt/qemu/tcg/i386/tcg-target.inc.c:2081
#6  0x000055dbccbd04e8 in tcg_gen_code (arg_life=<optimized out>, args=<optimized out>, opc=<optimized out>, def=<optimized out>, s=0x55dbcd5792c0 <tcg_ctx>) at /home/ehabkost/rh/proj/virt/qemu/tcg/tcg.c:2335
#7  0x000055dbccbd04e8 in tcg_gen_code (s=s@entry=0x55dbcd5792c0 <tcg_ctx>, tb=tb@entry=0x7f3328ee3748) at /home/ehabkost/rh/proj/virt/qemu/tcg/tcg.c:2654
#8  0x000055dbccbc6836 in tb_gen_code (cpu=cpu@entry=0x55dbcf482dc0, pc=pc@entry=18446744072199146483, cs_base=cs_base@entry=0, flags=flags@entry=4244144, cflags=<optimized out>, cflags@entry=0)
    at /home/ehabkost/rh/proj/virt/qemu/translate-all.c:1339
#9  0x000055dbccbc8b2c in cpu_exec (tb_exit=0, last_tb=<optimized out>, cpu=0x0) at /home/ehabkost/rh/proj/virt/qemu/cpu-exec.c:346
#10 0x000055dbccbc8b2c in cpu_exec (cpu=cpu@entry=0x55dbcf482dc0) at /home/ehabkost/rh/proj/virt/qemu/cpu-exec.c:637
#11 0x000055dbccbed8a1 in qemu_tcg_cpu_thread_fn (cpu=0x55dbcf482dc0) at /home/ehabkost/rh/proj/virt/qemu/cpus.c:1117
#12 0x000055dbccbed8a1 in qemu_tcg_cpu_thread_fn (arg=<optimized out>) at /home/ehabkost/rh/proj/virt/qemu/cpus.c:1197
#13 0x00007f33364ae5ca in start_thread () at /lib64/libpthread.so.0
#14 0x00007f3332d1f0ed in clone () at /lib64/libc.so.6
(gdb) up
#1  0x00007f3332c5236a in abort () from /lib64/libc.so.6
(gdb) 
#2  0x00007f3332c48f97 in __assert_fail_base () from /lib64/libc.so.6
(gdb) 
#3  0x00007f3332c49042 in __assert_fail () from /lib64/libc.so.6
(gdb) 
#4  0x000055dbccbd04e8 in tcg_out_ctz (const_a2=false, arg2=3, arg1=TCG_REG_EBP, dest=TCG_REG_R12, rexw=<optimized out>, s=0x55dbcd5792c0 <tcg_ctx>) at /home/ehabkost/rh/proj/virt/qemu/tcg/i386/tcg-target.inc.c:1153
1153            tcg_debug_assert(dest == arg2);
(gdb) 
#5  tcg_out_op (const_args=0x7f3327ecd6d0, args=0x7f3327ecd710, opc=<optimized out>, s=0x55dbcd5792c0 <tcg_ctx>) at /home/ehabkost/rh/proj/virt/qemu/tcg/i386/tcg-target.inc.c:2081
2081            tcg_out_ctz(s, rexw, args[0], args[1], args[2], const_args[2]);
(gdb) 
#6  tcg_reg_alloc_op (arg_life=<optimized out>, args=<optimized out>, opc=<optimized out>, def=<optimized out>, s=0x55dbcd5792c0 <tcg_ctx>) at /home/ehabkost/rh/proj/virt/qemu/tcg/tcg.c:2335
2335        tcg_out_op(s, opc, new_args, const_args);
(gdb) 
#7  tcg_gen_code (s=s@entry=0x55dbcd5792c0 <tcg_ctx>, tb=tb@entry=0x7f3328ee3748) at /home/ehabkost/rh/proj/virt/qemu/tcg/tcg.c:2654
2654                tcg_reg_alloc_op(s, def, opc, args, arg_life);
(gdb) 
#8  0x000055dbccbc6836 in tb_gen_code (cpu=cpu@entry=0x55dbcf482dc0, pc=pc@entry=18446744072199146483, cs_base=cs_base@entry=0, flags=flags@entry=4244144, cflags=<optimized out>, cflags@entry=0)
    at /home/ehabkost/rh/proj/virt/qemu/translate-all.c:1339
1339        gen_code_size = tcg_gen_code(&tcg_ctx, tb);
(gdb) 
#9  0x000055dbccbc8b2c in tb_find (tb_exit=0, last_tb=<optimized out>, cpu=0x0) at /home/ehabkost/rh/proj/virt/qemu/cpu-exec.c:346
346                     tb = tb_gen_code(cpu, pc, cs_base, flags, 0);
(gdb) 
#10 cpu_exec (cpu=cpu@entry=0x55dbcf482dc0) at /home/ehabkost/rh/proj/virt/qemu/cpu-exec.c:637
637                     tb = tb_find(cpu, last_tb, tb_exit);

-- 
Eduardo