On 12/23/23 05:16, Paolo Bonzini wrote:
ALU instructions can write to both memory and flags. If the CC_SRC*
and CC_DST locations have been written already when a memory access
causes a fault, the value in CC_SRC* and CC_DST might be interpreted
with the wrong CC_OP (the one that is in effect before the instruction.
Besides just using the wrong result for the flags, something like
subtracting -1 can have disastrous effects if the current CC_OP is
CC_OP_EFLAGS: this is because QEMU does not expect bits outside the ALU
flags to be set in CC_SRC, and env->eflags can end up set to all-ones.
In the case of the attached testcase, this sets IOPL to 3 and would
cause an assertion failure if SUB is moved to the new decoder.
This mechanism is not really needed for BMI instructions, which can
only write to a register, but put it to use anyway for cleanliness.
In the case of BZHI, the code has to be modified slightly to ensure
that decode->cc_src is written, otherwise the new assertions trigger.
Signed-off-by: Paolo Bonzini<pbonz...@redhat.com>
---
target/i386/cpu.h | 1 +
target/i386/tcg/decode-new.c.inc | 34 +++++++++++++++++++++++++++++
target/i386/tcg/decode-new.h | 4 ++++
target/i386/tcg/emit.c.inc | 36 ++++++++++++++++++++-----------
tests/tcg/i386/Makefile.target | 2 +-
tests/tcg/i386/test-flags.c | 37 ++++++++++++++++++++++++++++++++
6 files changed, 101 insertions(+), 13 deletions(-)
create mode 100644 tests/tcg/i386/test-flags.c
Reviewed-by: Richard Henderson <richard.hender...@linaro.org>
r~
