diff options
| author | Christian Krinitsin <mail@krinitsin.com> | 2025-07-03 19:39:53 +0200 |
|---|---|---|
| committer | Christian Krinitsin <mail@krinitsin.com> | 2025-07-03 19:39:53 +0200 |
| commit | dee4dcba78baf712cab403d47d9db319ab7f95d6 (patch) | |
| tree | 418478faf06786701a56268672f73d6b0b4eb239 /results/classifier/108/debug/2495 | |
| parent | 4d9e26c0333abd39bdbd039dcdb30ed429c475ba (diff) | |
| download | emulator-bug-study-dee4dcba78baf712cab403d47d9db319ab7f95d6.tar.gz emulator-bug-study-dee4dcba78baf712cab403d47d9db319ab7f95d6.zip | |
restructure results
Diffstat (limited to 'results/classifier/108/debug/2495')
| -rw-r--r-- | results/classifier/108/debug/2495 | 87 |
1 files changed, 0 insertions, 87 deletions
diff --git a/results/classifier/108/debug/2495 b/results/classifier/108/debug/2495 deleted file mode 100644 index 7ce508a0..00000000 --- a/results/classifier/108/debug/2495 +++ /dev/null @@ -1,87 +0,0 @@ -debug: 0.948 -graphic: 0.934 -PID: 0.928 -other: 0.924 -files: 0.918 -device: 0.916 -performance: 0.890 -socket: 0.881 -vnc: 0.880 -network: 0.858 -boot: 0.856 -KVM: 0.817 -permissions: 0.815 -semantic: 0.809 - -A bug in x86-64 MMX instructions -Description of problem: -It seems QEMU emits invalid TCG when lifting MMX instructions with redundant REX prefixes. For example, when lifting `490f7ec0 (movq r8, mm0)`, QEMU generates the following valid TCG. - -``` - ---- 00000000004011f2 0000000000000000 - call enter_mmx,$0x0,$0,env - ld_i64 loc0,env,$0x270 - mov_i64 r8,loc0 - mov_i64 rip,$0x4011f6 - exit_tb $0x0 - set_label $L0 - exit_tb $0x7f84f82ec143 -``` - -However, after changing the value of the rex prefix to `4f` , so the instruction becomes `4f0f7ec0 (rex.WRXB movq r8, mm0)`, the lifted TCG is changed to: - -``` - ---- 00000000004011f2 0000000000000000 - call enter_mmx,$0x0,$0,env - ld_i64 loc0,env,$0x2f0 // The offset to MM0 is changed - mov_i64 r8,loc0 - mov_i64 rip,$0x4011f6 - exit_tb $0x0 - set_label $L0 - exit_tb $0x7f98e82ec143 -``` - -I have observed this bug in numerous MMX instructions. For example, `410fdaff (rex.B pminub mm7, mm7)` is lifted to the wrong TCGs. - -It seems this bug looks similar to #2474. -Steps to reproduce: -1. Write `test.c` -``` -#include <stdint.h> -#include <stdio.h> -#include <string.h> - -uint8_t i_R8[8] = { 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 }; -uint8_t i_MM0[8] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; -uint8_t o_R8[8]; - -void __attribute__ ((noinline)) show_state() { - printf("R8: "); - for (int i = 0; i < 8; i++) { - printf("%02x ", o_R8[i]); - } - printf("\n"); -} - -void __attribute__ ((noinline)) run() { - __asm__ ( - ".intel_syntax noprefix\n" - "mov r8, qword ptr [rip + i_R8]\n" - "movq mm0, qword ptr [rip + i_MM0]\n" - ".byte 0x4f, 0x0f, 0x7e, 0xc0\n" - "mov qword ptr [rip + o_R8], r8\n" - ".att_syntax\n" - ); -} - -int main(int argc, char **argv) { - run(); - show_state(); - return 0; -} -``` -2. Compile `test.bin` using this command: `gcc-12 -O2 -no-pie ./test.c -o ./test.bin` -3. Run QEMU using this command: `qemu-x86_64 ./test.bin` -4. The program, runs on top of the buggy QEMU, prints the value of R8 as `00 00 00 00 00 00 00 00`. It should print `ff ff ff ff ff ff ff ff` after the bug is fixed. -Additional information: - |