Hi Richard
The simple example works as expected, but my big application
(gobject-introspection) still crashes with sigsegv :(.
it seems to be something related to the bmi and tbm instructions. If I
disable them in gcc ( -mno-bmi -mno-tbm), the application
runs ok.
A look at qemu's code does not show anything obvious, but I am not
that familiar with qemu source yet to find something like this through
static analysis.
My plan (as soon as I have some time) is to create a small set of apps
to validate bmi/tbm/ (Are you aware of something already existing for
this?)
My stupid guess is that maybe the ops are switched, or the flags are
not properly modified.
If you want, I can share the application that crashes with you, just
be aware that the number of dependencies is considerable.
BTW I can only run the gdb stub on version 2.8.0. On git HEAD I am getting only:
Quit
(gdb) c
Continuing.
warning: Remote failure reply: E22
Program stopped.
0x00000040017bac07 in ?? ()
(gdb) c
Continuing.
Thanks for your help, it is greatly appreciated!
On Wed, Jul 12, 2017 at 9:29 PM, Richard Henderson <r...@twiddle.net> wrote:
> The implementation of these two instructions was swapped.
> At the same time, unify the setup of eflags for the insn group.
>
> Reported-by: Ricardo Ribalda Delgado <ricardo.riba...@gmail.com>
> Signed-off-by: Richard Henderson <r...@twiddle.net>
> ---
> target/i386/translate.c | 26 +++++++++-----------------
> 1 file changed, 9 insertions(+), 17 deletions(-)
>
> diff --git a/target/i386/translate.c b/target/i386/translate.c
> index 9d5f1c3..69d3787 100644
> --- a/target/i386/translate.c
> +++ b/target/i386/translate.c
> @@ -4031,34 +4031,26 @@ static void gen_sse(CPUX86State *env, DisasContext
> *s, int b,
> ot = mo_64_32(s->dflag);
> gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
>
> + tcg_gen_mov_tl(cpu_cc_src, cpu_T0);
> switch (reg & 7) {
> case 1: /* blsr By,Ey */
> - tcg_gen_neg_tl(cpu_T1, cpu_T0);
> + tcg_gen_subi_tl(cpu_T1, cpu_T0, 1);
> tcg_gen_and_tl(cpu_T0, cpu_T0, cpu_T1);
> - gen_op_mov_reg_v(ot, s->vex_v, cpu_T0);
> - gen_op_update2_cc();
> - set_cc_op(s, CC_OP_BMILGB + ot);
> break;
> -
> case 2: /* blsmsk By,Ey */
> - tcg_gen_mov_tl(cpu_cc_src, cpu_T0);
> - tcg_gen_subi_tl(cpu_T0, cpu_T0, 1);
> - tcg_gen_xor_tl(cpu_T0, cpu_T0, cpu_cc_src);
> - tcg_gen_mov_tl(cpu_cc_dst, cpu_T0);
> - set_cc_op(s, CC_OP_BMILGB + ot);
> + tcg_gen_subi_tl(cpu_T1, cpu_T0, 1);
> + tcg_gen_xor_tl(cpu_T0, cpu_T0, cpu_T1);
> break;
> -
> case 3: /* blsi By, Ey */
> - tcg_gen_mov_tl(cpu_cc_src, cpu_T0);
> - tcg_gen_subi_tl(cpu_T0, cpu_T0, 1);
> - tcg_gen_and_tl(cpu_T0, cpu_T0, cpu_cc_src);
> - tcg_gen_mov_tl(cpu_cc_dst, cpu_T0);
> - set_cc_op(s, CC_OP_BMILGB + ot);
> + tcg_gen_neg_tl(cpu_T1, cpu_T0);
> + tcg_gen_and_tl(cpu_T0, cpu_T0, cpu_T1);
> break;
> -
> default:
> goto unknown_op;
> }
> + tcg_gen_mov_tl(cpu_cc_dst, cpu_T0);
> + gen_op_mov_reg_v(ot, s->vex_v, cpu_T0);
> + set_cc_op(s, CC_OP_BMILGB + ot);
> break;
>
> default:
> --
> 2.9.4
>
--
Ricardo Ribalda
