Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at
Bug 1507938 - nss-softokn: Incorrect compiler flags enable SSE2 on i686
Summary: nss-softokn: Incorrect compiler flags enable SSE2 on i686
Status: CLOSED DUPLICATE of bug 1482798
Alias: None
Product: Fedora
Classification: Fedora
Component: nss-softokn
Version: 26
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Kai Engert (:kaie) (inactive account)
QA Contact: Fedora Extras Quality Assurance
Depends On:
Blocks: x86Tracker
TreeView+ depends on / blocked
Reported: 2017-10-31 14:05 UTC by Florian Weimer
Modified: 2017-10-31 14:30 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-10-31 14:30:40 UTC
Type: Bug

Attachments (Terms of Use)

Description Florian Weimer 2017-10-31 14:05:11 UTC
From the nss-softokn-3.33.0-1.1.fc26 build log:

cc -o Linux4.12_x86_cc_glibc_PTH_OPT.OBJ/Linux_SINGLE_SHLIB/sha_fast.o -c -O2 -fPIC -Di386  -pipe -ffunction-sections -fdata-sections -DHAVE_STRERROR -DLINUX -Dlinux -Wall -Werror -DXP_UNIX -DSHLIB_SUFFIX=\"so\" -DSHLIB_PREFIX=\"lib\" -DSHLIB_VERSION=\"3\" -DSOFTOKEN_SHLIB_VERSION=\"3\" -DRIJNDAEL_INCLUDE_TABLES -UDEBUG -DNDEBUG -D_REENTRANT -DNSS_NO_INIT_SUPPORT -DUSE_UTIL_DIRECTLY -DNO_NSPR_10_SUPPORT -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -DFREEBL_NO_DEPEND -DFREEBL_LOWHASH -DNSS_X86_OR_X64 -DNSS_X86 -DMP_ASSEMBLY_MULTIPLY -DMP_ASSEMBLY_SQUARE  -DMP_ASSEMBLY_DIV_2DX1D -DMP_USE_UINT_DIGIT -DMP_IS_LITTLE_ENDIAN -DMP_API_COMPATIBLE -I/usr/include/nspr4  -I/usr/include/nss3 -I/usr/include/nspr4  -iquote ../../../dist/Linux4.12_x86_cc_glibc_PTH_OPT.OBJ/../public/nss -iquote ../../../dist/Linux4.12_x86_cc_glibc_PTH_OPT.OBJ/../private/nss -I../../../dist/Linux4.12_x86_cc_glibc_PTH_OPT.OBJ/include -I../../../dist/public/nss -I../../../dist/private/nss -Impi -Iecl -Iverified -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m32 -march=i686 -fasynchronous-unwind-tables -mno-sse2 -std=gnu99 -mpclmul -maes sha_fast.c

-mpclmul and -maes necessarily require SSE2 support because they operate on XMM registers, so they override the previous -mno-sse2 flag:

Dump of assembler code for function SHA1_Update:
   0xb7445af0 <+0>:	sub    $0x2c,%esp
   0xb7445af3 <+3>:	mov    %ebx,0x1c(%esp)
   0xb7445af7 <+7>:	mov    0x38(%esp),%ebx
   0xb7445afb <+11>:	mov    %esi,0x20(%esp)
   0xb7445aff <+15>:	mov    0x34(%esp),%esi
   0xb7445b03 <+19>:	mov    %edi,0x24(%esp)
   0xb7445b07 <+23>:	mov    %ebp,0x28(%esp)
   0xb7445b0b <+27>:	test   %ebx,%ebx
   0xb7445b0d <+29>:	je     0xb7445b77 <SHA1_Update+135>
   0xb7445b0f <+31>:	mov    0x30(%esp),%eax
   0xb7445b13 <+35>:	xor    %edx,%edx
   0xb7445b15 <+37>:	movd   %ebx,%xmm0
   0xb7445b19 <+41>:	movd   %edx,%xmm1
   0xb7445b1d <+45>:	punpckldq %xmm1,%xmm0
   0xb7445b21 <+49>:	movq   0x40(%eax),%xmm2
   0xb7445b26 <+54>:	mov    0x30(%esp),%eax
   0xb7445b2a <+58>:	paddq  %xmm2,%xmm0
   0xb7445b2e <+62>:	movq   %xmm0,0x40(%eax)
   0xb7445b33 <+67>:	movd   %xmm2,%eax
   0xb7445b37 <+71>:	and    $0x3f,%eax

Furthermore, it is not possible to compile code with -m micro-architecture flags and assume that it will run just fine on CPUs which do not support the micro-architecture, as long as you do not use the intrinsics in the code.  This is not how these switches work; they also enable GCC to emit such instructions automatically (e.g., if it recognizes certain coding patterns which could benefit from the new instructions).

GCC versions prior to GCC 7 were less sensitive to that because they would rarely, if ever, emit SSE2 instructions for integer code, especially without -O3 and auto-optimization.

(Note that all present and future Fedora releases support i686 without SSE2.  This is completely different from downstream.)

Comment 1 Daiki Ueno 2017-10-31 14:26:27 UTC
Yes, it's known as bug 1482798, and will be fixed with the next rebase of nss-softokn to 3.34 (soon to be released).

Comment 2 Florian Weimer 2017-10-31 14:28:50 UTC
*** Bug 1482798 has been marked as a duplicate of this bug. ***

Comment 3 Florian Weimer 2017-10-31 14:30:40 UTC

*** This bug has been marked as a duplicate of bug 1482798 ***

Note You need to log in before you can comment on or make changes to this bug.