From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1NKgy4-00062T-Be for qemu-devel@nongnu.org; Tue, 15 Dec 2009 18:38:12 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1NKgxy-0005vC-W1 for qemu-devel@nongnu.org; Tue, 15 Dec 2009 18:38:11 -0500 Received: from [199.232.76.173] (port=54903 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NKgxy-0005uu-OK for qemu-devel@nongnu.org; Tue, 15 Dec 2009 18:38:06 -0500 Received: from lo.gmane.org ([80.91.229.12]:37226) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1NKgxy-0004Zy-Av for qemu-devel@nongnu.org; Tue, 15 Dec 2009 18:38:06 -0500 Received: from list by lo.gmane.org with local (Exim 4.50) id 1NKgxv-0003gM-4F for qemu-devel@nongnu.org; Wed, 16 Dec 2009 00:38:03 +0100 Received: from 85.93.118.17 ([85.93.118.17]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Wed, 16 Dec 2009 00:38:03 +0100 Received: from pbonzini by 85.93.118.17 with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Wed, 16 Dec 2009 00:38:03 +0100 From: Paolo Bonzini Date: Wed, 16 Dec 2009 00:37:37 +0100 Message-ID: References: <200912151948.53307.ck@iseclab.org> <20091215212657.GC26319@shareable.org> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit In-Reply-To: <20091215212657.GC26319@shareable.org> Sender: news Subject: [Qemu-devel] Re: i386 emulation bug: mov reg, [addr] List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org On 12/15/2009 10:26 PM, Jamie Lokier wrote: > But that said, I'm not sure if this line from earlier breaks the test: > > index = ((code>> 3)& 7) | REX_X(s); > > When is REX_X(s) not zero, and does it break the index != 4 test? When %r12 (4+8=12) is used as an index. That's a valid statement, so it's okay to test index != 4 (when REX_X(s) is not zero it is always eight, and you'd get index == 12): 0: 8b 04 65 11 22 33 44 mov 0x44332211(,%riz,2),%eax 7: 42 8b 04 65 11 22 33 44 mov 0x44332211(,%r12,2),%eax (BTW %eiz/%riz are not accepted by my GAS, only produced by the disassembler). Paolo