* [PATCH] target/i386: allow MMX instructions with CR4.OSFXSR=0
@ 2022-11-30 14:19 Paolo Bonzini
2022-11-30 21:20 ` Richard Henderson
2022-12-01 6:43 ` Thomas Huth
0 siblings, 2 replies; 4+ messages in thread
From: Paolo Bonzini @ 2022-11-30 14:19 UTC (permalink / raw)
To: qemu-devel; +Cc: thuth
MMX state is saved/restored by FSAVE/FRSTOR so the instructions are
not illegal opcodes even if CR4.OSFXSR=0. Make sure that validate_vex
takes into account the prefix and only checks HF_OSFXSR_MASK in the
presence of an SSE instruction.
Fixes: 20581aadec5e ("target/i386: validate VEX prefixes via the instructions' exception classes", 2022-10-18)
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1350
Reported-by: Helge Konetzka (@hejko on gitlab.com)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
target/i386/tcg/decode-new.c.inc | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index e4878b967f0e..80c579164ff2 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -1488,7 +1488,8 @@ static bool validate_vex(DisasContext *s, X86DecodedInsn *decode)
if (!(s->flags & HF_AVX_EN_MASK)) {
goto illegal;
}
- } else {
+ } else if (e->special != X86_SPECIAL_MMX ||
+ (s->prefix & (PREFIX_REPZ | PREFIX_REPNZ | PREFIX_DATA))) {
if (!(s->flags & HF_OSFXSR_MASK)) {
goto illegal;
}
--
2.38.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] target/i386: allow MMX instructions with CR4.OSFXSR=0
2022-11-30 14:19 [PATCH] target/i386: allow MMX instructions with CR4.OSFXSR=0 Paolo Bonzini
@ 2022-11-30 21:20 ` Richard Henderson
2022-12-01 6:43 ` Thomas Huth
1 sibling, 0 replies; 4+ messages in thread
From: Richard Henderson @ 2022-11-30 21:20 UTC (permalink / raw)
To: Paolo Bonzini, qemu-devel; +Cc: thuth
On 11/30/22 06:19, Paolo Bonzini wrote:
> MMX state is saved/restored by FSAVE/FRSTOR so the instructions are
> not illegal opcodes even if CR4.OSFXSR=0. Make sure that validate_vex
> takes into account the prefix and only checks HF_OSFXSR_MASK in the
> presence of an SSE instruction.
>
> Fixes: 20581aadec5e ("target/i386: validate VEX prefixes via the instructions' exception classes", 2022-10-18)
> Resolves:https://gitlab.com/qemu-project/qemu/-/issues/1350
> Reported-by: Helge Konetzka (@hejko on gitlab.com)
> Signed-off-by: Paolo Bonzini<pbonzini@redhat.com>
> ---
> target/i386/tcg/decode-new.c.inc | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
r~
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] target/i386: allow MMX instructions with CR4.OSFXSR=0
2022-11-30 14:19 [PATCH] target/i386: allow MMX instructions with CR4.OSFXSR=0 Paolo Bonzini
2022-11-30 21:20 ` Richard Henderson
@ 2022-12-01 6:43 ` Thomas Huth
2022-12-01 7:22 ` Richard Henderson
1 sibling, 1 reply; 4+ messages in thread
From: Thomas Huth @ 2022-12-01 6:43 UTC (permalink / raw)
To: Paolo Bonzini, qemu-devel; +Cc: Stefan Hajnoczi
On 30/11/2022 15.19, Paolo Bonzini wrote:
> MMX state is saved/restored by FSAVE/FRSTOR so the instructions are
> not illegal opcodes even if CR4.OSFXSR=0. Make sure that validate_vex
> takes into account the prefix and only checks HF_OSFXSR_MASK in the
> presence of an SSE instruction.
>
> Fixes: 20581aadec5e ("target/i386: validate VEX prefixes via the instructions' exception classes", 2022-10-18)
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1350
> Reported-by: Helge Konetzka (@hejko on gitlab.com)
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
> target/i386/tcg/decode-new.c.inc | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
> index e4878b967f0e..80c579164ff2 100644
> --- a/target/i386/tcg/decode-new.c.inc
> +++ b/target/i386/tcg/decode-new.c.inc
> @@ -1488,7 +1488,8 @@ static bool validate_vex(DisasContext *s, X86DecodedInsn *decode)
> if (!(s->flags & HF_AVX_EN_MASK)) {
> goto illegal;
> }
> - } else {
> + } else if (e->special != X86_SPECIAL_MMX ||
> + (s->prefix & (PREFIX_REPZ | PREFIX_REPNZ | PREFIX_DATA))) {
> if (!(s->flags & HF_OSFXSR_MASK)) {
> goto illegal;
> }
This fixes the MicroSnow image, indeed, thus:
Tested-by: Thomas Huth <thuth@redhat.com>
Should this patch still be included in QEMU 7.2 ? ... since it fixes a
regression?
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] target/i386: allow MMX instructions with CR4.OSFXSR=0
2022-12-01 6:43 ` Thomas Huth
@ 2022-12-01 7:22 ` Richard Henderson
0 siblings, 0 replies; 4+ messages in thread
From: Richard Henderson @ 2022-12-01 7:22 UTC (permalink / raw)
To: Thomas Huth, Paolo Bonzini, qemu-devel; +Cc: Stefan Hajnoczi
On 11/30/22 22:43, Thomas Huth wrote:
> On 30/11/2022 15.19, Paolo Bonzini wrote:
>> MMX state is saved/restored by FSAVE/FRSTOR so the instructions are
>> not illegal opcodes even if CR4.OSFXSR=0. Make sure that validate_vex
>> takes into account the prefix and only checks HF_OSFXSR_MASK in the
>> presence of an SSE instruction.
>>
>> Fixes: 20581aadec5e ("target/i386: validate VEX prefixes via the instructions' exception
>> classes", 2022-10-18)
>> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1350
>> Reported-by: Helge Konetzka (@hejko on gitlab.com)
>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>> ---
>> target/i386/tcg/decode-new.c.inc | 3 ++-
>> 1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
>> index e4878b967f0e..80c579164ff2 100644
>> --- a/target/i386/tcg/decode-new.c.inc
>> +++ b/target/i386/tcg/decode-new.c.inc
>> @@ -1488,7 +1488,8 @@ static bool validate_vex(DisasContext *s, X86DecodedInsn *decode)
>> if (!(s->flags & HF_AVX_EN_MASK)) {
>> goto illegal;
>> }
>> - } else {
>> + } else if (e->special != X86_SPECIAL_MMX ||
>> + (s->prefix & (PREFIX_REPZ | PREFIX_REPNZ | PREFIX_DATA))) {
>> if (!(s->flags & HF_OSFXSR_MASK)) {
>> goto illegal;
>> }
>
> This fixes the MicroSnow image, indeed, thus:
>
> Tested-by: Thomas Huth <thuth@redhat.com>
>
> Should this patch still be included in QEMU 7.2 ? ... since it fixes a regression?
Yes.
r~
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-12-01 7:23 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-11-30 14:19 [PATCH] target/i386: allow MMX instructions with CR4.OSFXSR=0 Paolo Bonzini
2022-11-30 21:20 ` Richard Henderson
2022-12-01 6:43 ` Thomas Huth
2022-12-01 7:22 ` Richard Henderson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).