QEMUにパッチを投げた話

$ ./configure --target-list=x86_64-softmmu
$ make -j4

...

Exception Type:        EXC_BAD_INSTRUCTION (SIGILL)
Exception Codes:       0x0000000000000001, 0x0000000013948294
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Illegal instruction: 4
Termination Reason:    Namespace SIGNAL, Code 0x4
Terminating Process:   exc handler [3788]

...

Thread 5 Crashed:
0   ???                           	0x00000002b529139c 0 + 11629302684
1   qemu-system-x86_64            	0x0000000105188fc0 cpu_tb_exec + 472 (cpu-exec.c:189)
2   qemu-system-x86_64            	0x0000000105189ae0 cpu_loop_exec_tb + 52 (cpu-exec.c:672) [inlined]
3   qemu-system-x86_64            	0x0000000105189ae0 cpu_exec + 1648 (cpu-exec.c:797)
4   qemu-system-x86_64            	0x0000000105188954 tcg_cpus_exec + 48 (tcg-accel-ops.c:67)
5   qemu-system-x86_64            	0x00000001051faa08 rr_cpu_thread_fn + 464 (tcg-accel-ops-rr.c:216)
6   qemu-system-x86_64            	0x00000001053c5fd4 qemu_thread_start + 128 (qemu-thread-posix.c:521)
7   libsystem_pthread.dylib       	0x00000001861dafd4 _pthread_start + 320
8   libsystem_pthread.dylib       	0x00000001861d5d3c thread_start + 8

...

$ ./configure --target-list=x86_64-softmmu --enable-debug
$ make -j4

process launch -s -- -cpu max -m 1024 /path/to/diskimage.qcow2
process handle -p true -s false -n false SIGUSR2

$ lldb -s cmd build/qemu-system-x86_64

...

(lldb) c
Process 12881 resuming
Process 12881 stopped
* thread #6, stop reason = EXC_BAD_INSTRUCTION (code=1, subcode=0x13948294)
    frame #0: 0x000000029500b41c
->  0x29500b41c: .long  0x13948294                ; unknown opcode
    0x29500b420: mov    w20, w20
    0x29500b424: str    x20, [x19]
    0x29500b428: mov    w21, #0x44
Target 0: (qemu-system-x86_64) stopped.
(lldb)  

(lldb) br s -f tcg.c -l 247 -c v==0x13948294
Breakpoint 1: where = qemu-system-x86_64`tcg_out32 + 12 at tcg.c:248:26, address = 0x0000000100419764
(lldb) c

    if (v == 0x13948294) {
        static int c;
        c++;
    }

(lldb) br s -f tcg.c -l 249
Breakpoint 1: where = qemu-system-x86_64`tcg_out32 + 40 at tcg.c:249:4, address = 0x00000001004974f8
(lldb) c
Process 12849 resuming
Process 12849 stopped
* thread #6, stop reason = breakpoint 1.1
    frame #0: 0x00000001004974f8 qemu-system-x86_64`tcg_out32(s=0x0000000108358000, v=328499860) at tcg.c:249:4
   246 	{
   247 		if (v == 0x13948294) {
   248 			static int c;
-> 249 			c++;
   250 		}
   251 		if (TCG_TARGET_INSN_UNIT_SIZE == 4) {
   252 	        *s->code_ptr++ = v;
Target 0: (qemu-system-x86_64) stopped.
(lldb) bt
* thread #6, stop reason = breakpoint 1.1
  * frame #0: 0x00000001004974f8 qemu-system-x86_64`tcg_out32(s=0x0000000108358000,
              v=328499860) at tcg.c:249:4
    frame #1: 0x00000001004a0c1c qemu-system-x86_64`tcg_out_insn_3403(s=0x0000000108358000,
              insn=I3403_EXTR, ext=TCG_TYPE_I32, rd=TCG_REG_X20, rn=TCG_REG_X20, rm=TCG_REG_X20, imms=32) at tcg-target.c.inc:694:5
    frame #2: 0x000000010049fce4 qemu-system-x86_64`tcg_out_extr(s=0x0000000108358000,
              ext=TCG_TYPE_I32, rd=TCG_REG_X20, rn=TCG_REG_X20, rm=TCG_REG_X20, a=32) at tcg-target.c.inc:1259:5
    frame #3: 0x000000010049f318 qemu-system-x86_64`tcg_out_rotl(s=0x0000000108358000,
              ext=TCG_TYPE_I32, rd=TCG_REG_X20, rn=TCG_REG_X20, m=0) at tcg-target.c.inc:1296:5
    frame #4: 0x000000010049de4c qemu-system-x86_64`tcg_out_op(s=0x0000000108358000,
              opc=INDEX_op_rotl_i32, args=0x00000001700b6a88, const_args=0x00000001700b6a48) at tcg-target.c.inc:2140:13
    frame #5: 0x0000000100496338 qemu-system-x86_64`tcg_reg_alloc_op(s=0x0000000108358000, op=0x0000000118ef0b38) at tcg.c:4217:9
    frame #6: 0x00000001004920a8 qemu-system-x86_64`tcg_gen_code(s=0x0000000108358000, tb=0x0000000134f63800) at tcg.c:4755:13
    frame #7: 0x000000010050ea94 qemu-system-x86_64`tb_gen_code(cpu=0x0000000108338000,
              pc=139793480488555, cs_base=0, flags=12632755, cflags=-16777216) at translate-all.c:1940:21
    frame #8: 0x0000000100467c1c qemu-system-x86_64`tb_find(cpu=0x0000000108338000,
              last_tb=0x0000000134f63600, tb_exit=0, cflags=4278190080) at cpu-exec.c:428:14
    frame #9: 0x00000001004672d8 qemu-system-x86_64`cpu_exec(cpu=0x0000000108338000) at cpu-exec.c:796:18
    frame #10: 0x00000001004c9428 qemu-system-x86_64`tcg_cpus_exec(cpu=0x0000000108338000) at tcg-accel-ops.c:67:11
    frame #11: 0x0000000100469750 qemu-system-x86_64`rr_cpu_thread_fn(arg=0x0000000108338000) at tcg-accel-ops-rr.c:216:21
    frame #12: 0x00000001007a3d30 qemu-system-x86_64`qemu_thread_start(args=".PingFangTC-Semibold") at qemu-thread-posix.c:521:9
    frame #13: 0x00000001861dafd4 libsystem_pthread.dylib`_pthread_start + 320

static void tcg_out_insn_3403(TCGContext *s, AArch64Insn insn, TCGType ext,
                              TCGReg rd, TCGReg rn, TCGReg rm, int imms)
{
    tcg_out32(s, insn | ext << 31 | ext << 22 | rm << 16 | imms << 10
              | rn << 5 | rd);
}

static inline void tcg_out_extr(TCGContext *s, TCGType ext, TCGReg rd,
                                TCGReg rn, TCGReg rm, unsigned int a)
{
    tcg_out_insn(s, 3403, EXTR, ext, rd, rn, rm, a);
}

static inline void tcg_out_rotl(TCGContext *s, TCGType ext,
                                TCGReg rd, TCGReg rn, unsigned int m)
{
    int bits = ext ? 64 : 32;
    int max = bits - 1;
    tcg_out_extr(s, ext, rd, rn, rn, bits - (m & max));
}

static inline void tcg_out_rotl(TCGContext *s, TCGType ext,
                                TCGReg rd, TCGReg rn, unsigned int m)
{
    int max = ext ? 63 : 31;
    tcg_out_extr(s, ext, rd, rn, rn, -m & max);
}

$ git format-patch HEAD^

$ scripts/get_maintainer.pl -f 修正したファイルのpath

パッチの作成から提出まで