From mboxrd@z Thu Jan  1 00:00:00 1970
From: Paolo Bonzini <pbonzini@redhat.com>
Subject: Re: [PATCH] KVM: x86 emulator: fix group 8 instruction decoding
Date: Wed, 04 Aug 2010 11:41:33 +0200
Message-ID: <4C5935CD.7010005@redhat.com>
References: <4C592470.1010608@cn.fujitsu.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=GB2312
Content-Transfer-Encoding: 7bit
Cc: Avi Kivity <avi@redhat.com>, kvm@vger.kernel.org
To: Wei Yongjun <yjwei@cn.fujitsu.com>
Return-path: <kvm-owner@vger.kernel.org>
Received: from mail-qy0-f174.google.com ([209.85.216.174]:43471 "EHLO
	mail-qy0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S932075Ab0HDJli (ORCPT <rfc822;kvm@vger.kernel.org>);
	Wed, 4 Aug 2010 05:41:38 -0400
Received: by qyk7 with SMTP id 7so999561qyk.19
        for <kvm@vger.kernel.org>; Wed, 04 Aug 2010 02:41:37 -0700 (PDT)
In-Reply-To: <4C592470.1010608@cn.fujitsu.com>
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

On 08/04/2010 10:27 AM, Wei Yongjun wrote:
> Group 8 instruction, BT[S|R|C] should be mask as BitOp.
> 
> Signed-off-by: Wei Yongjun<yjwei@cn.fujitsu.com>
> ---
>   arch/x86/kvm/emulate.c |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> index d197b46..eba5a67 100644
> --- a/arch/x86/kvm/emulate.c
> +++ b/arch/x86/kvm/emulate.c
> @@ -2261,7 +2261,7 @@ static struct opcode twobyte_table[256] = {
>   	    D(DstReg | SrcMem16 | ModRM | Mov),
>   	/* 0xB8 - 0xBF */
>   	N, N,
> -	G(0, group8), D(DstMem | SrcReg | ModRM | BitOp | Lock),
> +	G(BitOp, group8), D(DstMem | SrcReg | ModRM | BitOp | Lock),
>   	N, N, D(ByteOp | DstReg | SrcMem | ModRM | Mov),
>   	    D(DstReg | SrcMem16 | ModRM | Mov),
>   	/* 0xC0 - 0xCF */

This is correct with your 4/4 patch, but incorrect before it.  It will
incorrectly cause the emulator to adjust the address of the source
operand.  This is documented to happen with a register source but not
with an immediate source.  You can test it with this:

#include <stdio.h>
int main()
{
  int a[3] = {0, 0, 0};
  asm ("btcl $32, %0" :: "m" (a[0]) : "memory");
  asm ("btcl $1, %0" :: "m" (a[1]) : "memory");
  asm ("btcl %1, %0" :: "m" (a[0]), "r" (66) : "memory");
  printf ("%x %x %x\n", a[0], a[1], a[2]);
}

It prints "1 2 4".  I'm quite confident that instead it would print "0 3
4" with this patch, and "5 2 0" with this patch + 4/4.

Paolo