Re: [PATCH 10/20] target/i386/tcg: implement JMPABS instruction

[Zhao Liu <zhao1.liu@intel.com>]

On Tue, Aug 25, 2026 at 02:29:11PM +0200, Paolo Bonzini wrote:
> Date: Tue, 25 Aug 2026 14:29:11 +0200
> From: Paolo Bonzini <pbonzini@redhat.com>
> Subject: [PATCH 10/20] target/i386/tcg: implement JMPABS instruction
> X-Mailer: git-send-email 2.55.0
> 
> This is the same as an indirect jump, just with immediate operand.
> The requirement of W=0 and 0x67 are already available in the decoder.
> 
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  target/i386/tcg/decode-new.h     | 3 +++
>  target/i386/tcg/decode-new.c.inc | 4 ++++
>  2 files changed, 7 insertions(+)
> 
> diff --git a/target/i386/tcg/decode-new.h b/target/i386/tcg/decode-new.h
> index c974ca9d7c5..4998712e86d 100644
> --- a/target/i386/tcg/decode-new.h
> +++ b/target/i386/tcg/decode-new.h
> @@ -184,6 +184,9 @@ typedef enum X86InsnCheck {
>  
>      /* No REX2 prefix allowed */
>      X86_CHECK_no_rex2 = 8192,
> +
> +    /* No 0x67 prefix allowed */
> +    X86_CHECK_no_adr = 16384,
>  } X86InsnCheck;
>  
>  typedef enum X86InsnSpecial {
> diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
> index 1f59fd665f7..d215d28cec5 100644
> --- a/target/i386/tcg/decode-new.c.inc
> +++ b/target/i386/tcg/decode-new.c.inc
> @@ -1991,6 +1991,7 @@ static const X86OpEntry opcodes_root[256] = {
>  
>  #ifdef TARGET_X86_64
>  static const X86OpEntry opcodes_rex2_map0_A0toAF[16] = {
> +    [1] = X86_OP_ENTRY1(JMP_m,   I,q, p_00 chk2(W0, no_adr)),
>  };

Maybe it should use X86_OP_ENTRYr? since JMPABS doesn't need to write
back.

Just a simple test:

#include <stdio.h>

int main(void)
{
    __asm__ volatile (
        /* JMPABS: REX2(M0=0,W=0) = D5 00, opcode A1, then imm64 target */
        ".byte 0xd5, 0x00, 0xa1\n\t"
        ".quad  1f\n\t"
        "ud2\n\t"          /* this should be skipped */
        "1:\n\t");
    puts("JMPABS -- OK");
    return 0;
}

And this hits an abort():

$ ./build/qemu-x86_64 /tmp/jmpabs
**
ERROR:../target/i386/tcg/emit.c.inc:380:gen_writeback: code should not be reached
Bail out! ERROR:../target/i386/tcg/emit.c.inc:380:gen_writeback: code should not be reached
Aborted (core dumped)

more GDB backtrace:

Thread 1 "qemu-x86_64" received signal SIGABRT, Aborted.
__pthread_kill_implementation (no_tid=0, signo=6, threadid=140737352460800) at ./nptl/pthread_kill.c:44
44      ./nptl/pthread_kill.c: No such file or directory.
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737352460800) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=140737352460800) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=140737352460800, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff7242476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff72287f3 in __GI_abort () at ./stdlib/abort.c:79
#5  0x00007ffff76e3b57 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#6  0x00007ffff773d70f in g_assertion_message_expr () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#7  0x0000555555664f37 in gen_writeback (s=s@entry=0x7fffffffd240, decode=decode@entry=0x7fffffffd0b0, opn=opn@entry=0, v=<optimized out>) at ../target/i386/tcg/emit.c.inc:380
#8  0x0000555555677778 in disas_insn (cpu=0x55555593e780, s=0x7fffffffd240) at ../target/i386/tcg/decode-new.c.inc:3682
#9  i386_tr_translate_insn (dcbase=0x7fffffffd240, cpu=0x55555593e780) at ../target/i386/tcg/translate.c:3608
#10 0x00005555555d7962 in translator_loop (cpu=0x55555593e780, tb=0x7fffe80d0700 <code_gen_buffer+853715>, max_insns=0x7fffffffd4cc, pc=<optimized out>, host_pc=<optimized out>, ops=ops@entry=0x5555557dc5a0 <i386_tr_ops>, db=0x7fffffffd240, addr_type=TCG_TYPE_I64) at ../accel/tcg/translator.c:178
#11 0x000055555567b212 in x86_translate_code (cpu=<optimized out>, tb=<optimized out>, max_insns=<optimized out>, pc=<optimized out>, host_pc=<optimized out>) at ../target/i386/tcg/translate.c:3699
#12 0x00005555555d6644 in setjmp_gen_code (env=env@entry=0x5555559427f0, tb=tb@entry=0x7fffe80d0700 <code_gen_buffer+853715>, pc=pc@entry=4198710, host_pc=0x401136, max_insns=max_insns@entry=0x7fffffffd4cc, ti=<optimized out>) at ../accel/tcg/translate-all.c:251
#13 0x00005555555d6b0e in tb_gen_code (cpu=cpu@entry=0x55555593e780, s=...) at ../accel/tcg/translate-all.c:324
#14 0x00005555555cec1a in cpu_exec_loop (cpu=cpu@entry=0x55555593e780, sc=<optimized out>) at ../accel/tcg/cpu-exec.c:973
#15 0x00005555555ced99 in cpu_exec_setjmp (cpu=cpu@entry=0x55555593e780, sc=<optimized out>) at ../accel/tcg/cpu-exec.c:1019
#16 0x00005555555cf381 in cpu_exec (cpu=cpu@entry=0x55555593e780) at ../accel/tcg/cpu-exec.c:1045
#17 0x0000555555622c80 in cpu_loop (env=env@entry=0x5555559427f0) at ../linux-user/x86_64/../i386/cpu_loop.c:217
#18 0x00005555555a1d17 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at ../linux-user/main.c:1010

Regards,
Zhao