Re: [Qemu-devel] [Bug 1156313] [NEW] X86-64 flags handling broken

[Richard Henderson <rth@twiddle.net>]

On 03/17/2013 12:34 PM, Torbjorn Granlund wrote:
> Public bug reported:
> 
> The current qemu sources cause improper handling of flags on x86-64.
> This bug seems to have shown up a few weeks ago.
> 
> A plain install of Debian GNU/Linux makes user processes catch
> spurious signals.  The kernel seems to run stably, though.
> 
> The ADX feature works very poorly.  It might be related; at least it
> allows for reproducibly provoking invalid behaviour.

Patch at http://patchwork.ozlabs.org/patch/229139/

Knowing what the problem is, I'm able to reliably trigger the problem
with the userland emulator.  It's simply a matter of understanding
how to force the right garbage values into the qemu state.  E.g.

	.globl	adx, main
	.type	adx, @function
	.type	main, @function

adx:	mov	$0xdeadbeef, %eax
	add	$0, %eax
	mov	$0, %eax
	jmp	1f
1:	adox	%rax, %rax
	adcx	%rax, %rax
	ret

main:	call	adx
	lea	string(%rip), %rdi
	mov	%rax, %rsi
	call	printf
	xor	%eax, %eax
	ret

.rodata:
string:	.asciz	"result %lx\n"

will always print deadbeef before the fix.  Thus while having a context
switch inside the loop tended to cause unpredictable behaviour, I believe
it to be a red herring.


r~