From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([140.186.70.92]:34915)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <av1474@comtv.ru>) id 1QvS2L-0007rZ-3n
	for qemu-devel@nongnu.org; Mon, 22 Aug 2011 06:47:21 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <av1474@comtv.ru>) id 1QvS2J-0004tB-Mh
	for qemu-devel@nongnu.org; Mon, 22 Aug 2011 06:47:21 -0400
Received: from fe02x03-cgp.akado.ru ([77.232.31.165]:51838 helo=akado.ru)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <av1474@comtv.ru>) id 1QvS2J-0004ss-Gw
	for qemu-devel@nongnu.org; Mon, 22 Aug 2011 06:47:19 -0400
Date: Mon, 22 Aug 2011 14:47:09 +0400 (MSD)
From: malc <av1474@comtv.ru>
Message-ID: <alpine.LNX.2.00.1108221441400.4946@linmac>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Subject: [Qemu-devel] TCG sar UB
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org
Cc: Richard Henderson <rth@twiddle.net>

While booting linux-test 0.2 following sequence of instructions is seen:

IN: 
0xc03227aa:  mov    %esi,%edx
0xc03227ac:  xor    %ecx,%ecx
0xc03227ae:  movzwl 0x12(%esp),%ebp
0xc03227b3:  mov    %edi,%eax
0xc03227b5:  sar    %cl,%eax
0xc03227b7:  and    $0x1,%eax
0xc03227ba:  je     0xc0322802

OP after liveness analysis:
 mov_i32 tmp0,esi
 mov_i32 edx,tmp0
 nopn $0x2,$0x2
 movi_i32 ecx,$0x0
 discard cc_src
 movi_i32 cc_dst,$0x0
 mov_i32 tmp2,esp
 movi_i32 tmp13,$0x12
 add_i32 tmp2,tmp2,tmp13
 qemu_ld16u tmp0,tmp2,$0x0
 mov_i32 ebp,tmp0
 mov_i32 tmp0,edi
 mov_i32 eax,tmp0
 nopn $0x2,$0x2
 mov_i32 tmp0,eax
 nopn $0x2,$0x2
 movi_i32 tmp1,$0x0
 nopn $0x2,$0x2
 movi_i32 tmp10,$0xffffffff
 sar_i32 tmp3,tmp0,tmp10

Doesn't make much sense to me, guest clearly asked for 0 and not -1,
besides -1 violates TCG's sar constraints and PPC obliges by emiting
illegal instruction in this case.

-- 
mailto:av1474@comtv.ru