From: Richard Henderson <richard.hender...@linaro.org>
With PCREL, we have a page-relative view of EIP, and an
approximation of PC = EIP+CSBASE that is good enough to
detect page crossings. If we try to recompute PC after
masking EIP, we will mess up that approximation and write
a corrupt value to EIP.
We already handled masking properly for PCREL, so the
fix in b5e0d5d2 was only needed for the !PCREL path.
Cc: qemu-sta...@nongnu.org
Fixes: b5e0d5d22fbf ("target/i386: Fix 32-bit wrapping of pc/eip computation")
Fixes: 5b2fd6cf3735 (b5e0d5d22fbf in 8.1.4)
Reported-by: Michael Tokarev <m...@tls.msk.ru>
Signed-off-by: Richard Henderson <richard.hender...@linaro.org>
Message-ID: <20240101230617.129349-1-richard.hender...@linaro.org>
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com>
(cherry picked from commit a58506b748b8988a95f4fa1a2420ac5c17038b30)
Signed-off-by: Michael Tokarev <m...@tls.msk.ru>
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 93001fde7e..1d3c9a8be4 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -2867,10 +2867,6 @@ static void gen_jmp_rel(DisasContext *s, MemOp ot, int
diff, int tb_num)
}
}
new_eip &= mask;
- new_pc = new_eip + s->cs_base;
- if (!CODE64(s)) {
- new_pc = (uint32_t)new_pc;
- }
gen_update_cc_op(s);
set_cc_op(s, CC_OP_DYNAMIC);
@@ -2886,6 +2882,8 @@ static void gen_jmp_rel(DisasContext *s, MemOp ot, int
diff, int tb_num)
tcg_gen_andi_tl(cpu_eip, cpu_eip, mask);
use_goto_tb = false;
}
+ } else if (!CODE64(s)) {
+ new_pc = (uint32_t)(new_eip + s->cs_base);
}
if (use_goto_tb && translator_use_goto_tb(&s->base, new_pc)) {
--
2.39.2
