Re: [Qemu-devel] [PATCH] target/i386: Fixed CR0.TS check in gen_sse

[Peter Maydell <peter.maydell@linaro.org>]

Ccing the target/i386 maintainers...

thanks
-- PMM

On 26 June 2018 at 18:39, Alexandro Sanchez Bach <alexandro@phi.nz> wrote:
> Ping.
>
> -----Original Message-----
> From: Alexandro Sanchez Bach <alexandro@phi.nz>
> Sent: Tuesday, May 29, 2018 12:20
> To: 'qemu-devel@nongnu.org' <qemu-devel@nongnu.org>
> Subject: [PATCH] target/i386: Fixed CR0.TS check in gen_sse
>
> The function `gen_sse` assumes all of its instructions require CR0.TS=0.
> However, integer extensions at `0F 38 F[0-F]` and `0F 3A F[0-F]` such as
> CRC32, MOVBE, ADX, BMI1, BMI2 that are handled by `gen_sse` are not supposed
> to throw an exception in this scenario. This causes issues while booting
> some FreeBSD-based guests.
>
> Reported-by: Alexandro Sanchez Bach <alexandro@phi.nz>
> Signed-off-by: Alexandro Sanchez Bach <alexandro@phi.nz>
> Cc: qemu-stable@nongnu.org
> diff --git a/target/i386/translate.c b/target/i386/translate.c index
> 7c21814676..079ab7afef 100644
> --- a/target/i386/translate.c
> +++ b/target/i386/translate.c
> @@ -3049,8 +3049,16 @@ static void gen_sse(CPUX86State *env, DisasContext
> *s, int b,
>              is_xmm = 1;
>          }
>      }
> +
> +    modrm = x86_ldub_code(env, s);
> +    reg = ((modrm >> 3) & 7);
> +    if (is_xmm)
> +        reg |= rex_r;
> +    mod = (modrm >> 6) & 3;
> +
>      /* simple MMX/SSE operation */
> -    if (s->flags & HF_TS_MASK) {
> +    if (s->flags & HF_TS_MASK
> +        && ((b != 0x38 && b != 0x3A) || !(modrm & 0xF0))) {
>          gen_exception(s, EXCP07_PREX, pc_start - s->cs_base);
>          return;
>      }
> @@ -3084,11 +3092,6 @@ static void gen_sse(CPUX86State *env, DisasContext
> *s, int b,
>          gen_helper_enter_mmx(cpu_env);
>      }
>
> -    modrm = x86_ldub_code(env, s);
> -    reg = ((modrm >> 3) & 7);
> -    if (is_xmm)
> -        reg |= rex_r;
> -    mod = (modrm >> 6) & 3;
>      if (sse_fn_epp == SSE_SPECIAL) {
>          b |= (b1 << 8);
>          switch(b) {
>
>