[Qemu-devel] Incorrect handling of more PPC64 insns

[Torbjorn Granlund <tg@gmplib.org>]

[-- Attachment #1: Type: text/plain, Size: 283 bytes --]

Alexander Graf <agraf@suse.de> writes:

  There's a certain chance that happens, yes. We don't have instruction
  test suites for the PPC target.
  
There certainly are more bugs.  GMP still crashes all over the place.
I have semi-isolated one more.

Extracted stand-alone sources:


[-- Attachment #2: bug-qemu-ppc-again.c --]
[-- Type: application/octet-stream, Size: 1141 bytes --]

#include <stdio.h>
#include <stdlib.h>

typedef unsigned long long mp_limb_t;

#define GMP_LIMB_BITS 64
#define GMP_NAIL_BITS 0

#define GMP_NUMB_MAX (~(mp_limb_t) 0)

#define CNST_LIMB(C) ((mp_limb_t) C##LL)

#define GMP_NUMB_CEIL_MAX_DIV3   (GMP_NUMB_MAX / 3 + 1)

#define SHIFTHIGH(x) ((x) << GMP_LIMB_BITS/2)
#define SHIFTLOW(x)  ((x) >> GMP_LIMB_BITS/2)

#define LOWMASK   (((mp_limb_t) 1 << GMP_LIMB_BITS/2)-1)
#define HIGHMASK  SHIFTHIGH(LOWMASK)

#define LOWPART(x)   ((x) & LOWMASK)
#define HIGHPART(x)  SHIFTLOW((x) & HIGHMASK)

mp_limb_t
foo (mp_limb_t *lo, mp_limb_t x, mp_limb_t y)
{
  mp_limb_t  hi, s;

  *lo = LOWPART(x) * LOWPART(y);
  hi = HIGHPART(x) * HIGHPART(y);

  s = LOWPART(x) * HIGHPART(y);
  hi += HIGHPART(s);
  s = SHIFTHIGH(LOWPART(s));
  *lo += s;
  hi += (*lo < s);

  s = HIGHPART(x) * LOWPART(y);
  hi += HIGHPART(s);
  s = SHIFTHIGH(LOWPART(s));
  *lo += s;
  hi += (*lo < s);

  return hi;
}

int
main (int argc, char *argv[])
{
  mp_limb_t  hi, lo;

  hi = foo (&lo, GMP_NUMB_CEIL_MAX_DIV3, CNST_LIMB(3) << GMP_NAIL_BITS);
  if (hi < 1)
    printf ("GMP_NUMB_CEIL_MAX_DIV3 too small\n");

  return 0;
}

[-- Attachment #3: Type: text/plain, Size: 53 bytes --]


Asm code generated on gcc110 from the source file:


[-- Attachment #4: bug-qemu-ppc-again.s --]
[-- Type: application/octet-stream, Size: 1039 bytes --]

	.file	"bug-qemu-ppc-again.c"
	.section	".text"
	.align 2
	.globl foo
	.type	foo, @function
foo:
	rldimi 6,5,32,0
	rldimi 8,7,32,0
	li 9,-1
	rldicl 9,9,0,32
	and 10,6,9
	and 9,8,9
	srdi 6,6,32
	srdi 8,8,32
	mulld 5,8,6
	mulld 8,8,10
	sldi 4,8,32
	mulld 10,9,10
	add 10,4,10
	mulld 9,9,6
	srdi 8,8,32
	srdi 7,9,32
	add 7,8,7
	add 7,7,5
	cmpld 7,4,10
	mfcr 4
	rlwinm 4,4,30,1
	add 8,7,4
	sldi 4,9,32
	add 10,10,4
	std 10,0(3)
	cmpld 7,4,10
	mfcr 4
	rlwinm 4,4,30,1
	add 4,8,4
	srdi 3,4,32
	blr
	.size	foo,.-foo
	.align 2
	.globl main
	.type	main, @function
main:
	stwu 1,-32(1)
	mflr 0
	stw 0,36(1)
	addi 3,1,8
	lis 5,0x5555
	ori 5,5,21845
	lis 6,0x5555
	ori 6,6,21846
	li 7,0
	li 8,3
	bl foo
	rldimi 4,3,32,0
	cmpdi 7,4,0
	bne 7,.L3
	lis 3,.LC0@ha
	la 3,.LC0@l(3)
	bl puts
.L3:
	li 3,0
	lwz 0,36(1)
	mtlr 0
	addi 1,1,32
	blr
	.size	main,.-main
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 3
.LC0:
	.string	"GMP_NUMB_CEIL_MAX_DIV3 too small"
	.ident	"GCC: (GNU) 4.7.2 20121109 (Red Hat 4.7.2-8)"
	.section	.note.GNU-stack,"",@progbits

[-- Attachment #5: Type: text/plain, Size: 541 bytes --]


Generate executable and execute:

gcc -m32 -mpowerpc64 bug-qemu-ppc-again.s && ./a.out

This runs silently as it should on real hardware.  Under qemu (from
2013-05-02 plus the rldcl patch) I incorrectly get the error message:

GMP_NUMB_CEIL_MAX_DIV3 too small

This seems reproducible every time, unlike most qemu bugs that hit GMP.
I haven't isolated this bug to a single instruction, but if rldcl was
untested, expecting all of there here used rldicl rldimi rlwinm to be
tested is perhaps over-optimistic?

-- 
Torbjörn