* [PULL 2/2] target/i386: Fix VSIB decode
2024-08-05 12:16 [PULL 0/2] target/i386 fixes for QEMU 9.1 Paolo Bonzini
2024-08-05 12:16 ` [PULL 1/2] target/i386: SEV: fix mismatch in vcek-disabled property name Paolo Bonzini
@ 2024-08-05 12:16 ` Paolo Bonzini
2024-08-05 23:55 ` [PULL 0/2] target/i386 fixes for QEMU 9.1 Richard Henderson
2 siblings, 0 replies; 4+ messages in thread
From: Paolo Bonzini @ 2024-08-05 12:16 UTC (permalink / raw)
To: qemu-devel; +Cc: Richard Henderson, qemu-stable
From: Richard Henderson <richard.henderson@linaro.org>
With normal SIB, index == 4 indicates no index.
With VSIB, there is no exception for VR4/VR12.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2474
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Link: https://lore.kernel.org/r/20240805003130.1421051-3-richard.henderson@linaro.org
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
target/i386/tcg/translate.c | 20 ++++++++++----------
target/i386/tcg/decode-new.c.inc | 3 ++-
2 files changed, 12 insertions(+), 11 deletions(-)
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 95bad55bf46..b72864bf014 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -1523,7 +1523,7 @@ typedef struct AddressParts {
} AddressParts;
static AddressParts gen_lea_modrm_0(CPUX86State *env, DisasContext *s,
- int modrm)
+ int modrm, bool is_vsib)
{
int def_seg, base, index, scale, mod, rm;
target_long disp;
@@ -1552,7 +1552,7 @@ static AddressParts gen_lea_modrm_0(CPUX86State *env, DisasContext *s,
int code = x86_ldub_code(env, s);
scale = (code >> 6) & 3;
index = ((code >> 3) & 7) | REX_X(s);
- if (index == 4) {
+ if (index == 4 && !is_vsib) {
index = -1; /* no index */
}
base = (code & 7) | REX_B(s);
@@ -1682,21 +1682,21 @@ static TCGv gen_lea_modrm_1(DisasContext *s, AddressParts a, bool is_vsib)
static void gen_lea_modrm(CPUX86State *env, DisasContext *s, int modrm)
{
- AddressParts a = gen_lea_modrm_0(env, s, modrm);
+ AddressParts a = gen_lea_modrm_0(env, s, modrm, false);
TCGv ea = gen_lea_modrm_1(s, a, false);
gen_lea_v_seg(s, ea, a.def_seg, s->override);
}
static void gen_nop_modrm(CPUX86State *env, DisasContext *s, int modrm)
{
- (void)gen_lea_modrm_0(env, s, modrm);
+ (void)gen_lea_modrm_0(env, s, modrm, false);
}
/* Used for BNDCL, BNDCU, BNDCN. */
static void gen_bndck(CPUX86State *env, DisasContext *s, int modrm,
TCGCond cond, TCGv_i64 bndv)
{
- AddressParts a = gen_lea_modrm_0(env, s, modrm);
+ AddressParts a = gen_lea_modrm_0(env, s, modrm, false);
TCGv ea = gen_lea_modrm_1(s, a, false);
tcg_gen_extu_tl_i64(s->tmp1_i64, ea);
@@ -2417,7 +2417,7 @@ static bool disas_insn_x87(DisasContext *s, CPUState *cpu, int b)
op = ((b & 7) << 3) | ((modrm >> 3) & 7);
if (mod != 3) {
/* memory op */
- AddressParts a = gen_lea_modrm_0(env, s, modrm);
+ AddressParts a = gen_lea_modrm_0(env, s, modrm, false);
TCGv ea = gen_lea_modrm_1(s, a, false);
TCGv last_addr = tcg_temp_new();
bool update_fdp = true;
@@ -3078,7 +3078,7 @@ static void disas_insn_old(DisasContext *s, CPUState *cpu, int b)
rm = (modrm & 7) | REX_B(s);
gen_op_mov_v_reg(s, MO_32, s->T1, reg);
if (mod != 3) {
- AddressParts a = gen_lea_modrm_0(env, s, modrm);
+ AddressParts a = gen_lea_modrm_0(env, s, modrm, false);
/* specific case: we need to add a displacement */
gen_exts(ot, s->T1);
tcg_gen_sari_tl(s->tmp0, s->T1, 3 + ot);
@@ -3635,7 +3635,7 @@ static void disas_insn_old(DisasContext *s, CPUState *cpu, int b)
}
} else if (mod != 3) {
/* bndldx */
- AddressParts a = gen_lea_modrm_0(env, s, modrm);
+ AddressParts a = gen_lea_modrm_0(env, s, modrm, false);
if (reg >= 4
|| (prefixes & PREFIX_LOCK)
|| s->aflag == MO_16
@@ -3679,7 +3679,7 @@ static void disas_insn_old(DisasContext *s, CPUState *cpu, int b)
|| s->aflag == MO_16) {
goto illegal_op;
}
- AddressParts a = gen_lea_modrm_0(env, s, modrm);
+ AddressParts a = gen_lea_modrm_0(env, s, modrm, false);
if (a.base >= 0) {
tcg_gen_extu_tl_i64(cpu_bndl[reg], cpu_regs[a.base]);
if (!CODE64(s)) {
@@ -3740,7 +3740,7 @@ static void disas_insn_old(DisasContext *s, CPUState *cpu, int b)
}
} else if (mod != 3) {
/* bndstx */
- AddressParts a = gen_lea_modrm_0(env, s, modrm);
+ AddressParts a = gen_lea_modrm_0(env, s, modrm, false);
if (reg >= 4
|| (prefixes & PREFIX_LOCK)
|| s->aflag == MO_16
diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index d2da1d396d5..b22210f45d9 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -1811,7 +1811,8 @@ static int decode_modrm(DisasContext *s, CPUX86State *env, X86DecodedInsn *decod
} else {
op->has_ea = true;
op->n = -1;
- decode->mem = gen_lea_modrm_0(env, s, get_modrm(s, env));
+ decode->mem = gen_lea_modrm_0(env, s, modrm,
+ decode->e.vex_class == 12);
}
return modrm;
}
--
2.45.2
^ permalink raw reply related [flat|nested] 4+ messages in thread