|
 |
ed5979 |
From a019c203f0148e5fbb20e102a17453806f5296b6 Mon Sep 17 00:00:00 2001
|
|
|
ed5979 |
From: Richard Henderson <richard.henderson@linaro.org>
|
|
|
ed5979 |
Date: Sat, 14 Jan 2023 13:05:42 -1000
|
|
|
ed5979 |
Subject: [PATCH 3/8] target/i386: Fix BEXTR instruction
|
|
|
ed5979 |
|
|
|
ed5979 |
RH-Author: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
ed5979 |
RH-MergeRequest: 154: target/i386: fix bugs in emulation of BMI instructions
|
|
|
ed5979 |
RH-Bugzilla: 2173590
|
|
|
ed5979 |
RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
|
|
|
ed5979 |
RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
|
ed5979 |
RH-Acked-by: Bandan Das <None>
|
|
|
ed5979 |
RH-Commit: [3/7] bd1e3b26c72d7152b44be2d34308fd40dc106424 (bonzini/rhel-qemu-kvm)
|
|
|
ed5979 |
|
|
|
ed5979 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2173590
|
|
|
ed5979 |
Upstream-Status: merged
|
|
|
ed5979 |
|
|
|
ed5979 |
There were two problems here: not limiting the input to operand bits,
|
|
|
ed5979 |
and not correctly handling large extraction length.
|
|
|
ed5979 |
|
|
|
ed5979 |
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1372
|
|
|
ed5979 |
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
|
|
|
ed5979 |
Message-Id: <20230114230542.3116013-3-richard.henderson@linaro.org>
|
|
|
ed5979 |
Cc: qemu-stable@nongnu.org
|
|
|
ed5979 |
Fixes: 1d0b926150e5 ("target/i386: move scalar 0F 38 and 0F 3A instruction to new decoder", 2022-10-18)
|
|
|
ed5979 |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
ed5979 |
(cherry picked from commit b14c0098975264ed03144f145bca0179a6763a07)
|
|
|
ed5979 |
---
|
|
|
ed5979 |
target/i386/tcg/emit.c.inc | 22 +++++++++++-----------
|
|
|
ed5979 |
tests/tcg/i386/test-i386-bmi2.c | 12 ++++++++++++
|
|
|
ed5979 |
2 files changed, 23 insertions(+), 11 deletions(-)
|
|
|
ed5979 |
|
|
|
ed5979 |
diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc
|
|
|
ed5979 |
index 7037ff91c6..99f6ba6e19 100644
|
|
|
ed5979 |
--- a/target/i386/tcg/emit.c.inc
|
|
|
ed5979 |
+++ b/target/i386/tcg/emit.c.inc
|
|
|
ed5979 |
@@ -1078,30 +1078,30 @@ static void gen_ANDN(DisasContext *s, CPUX86State *env, X86DecodedInsn *decode)
|
|
|
ed5979 |
static void gen_BEXTR(DisasContext *s, CPUX86State *env, X86DecodedInsn *decode)
|
|
|
ed5979 |
{
|
|
|
ed5979 |
MemOp ot = decode->op[0].ot;
|
|
|
ed5979 |
- TCGv bound, zero;
|
|
|
ed5979 |
+ TCGv bound = tcg_constant_tl(ot == MO_64 ? 63 : 31);
|
|
|
ed5979 |
+ TCGv zero = tcg_constant_tl(0);
|
|
|
ed5979 |
+ TCGv mone = tcg_constant_tl(-1);
|
|
|
ed5979 |
|
|
|
ed5979 |
/*
|
|
|
ed5979 |
* Extract START, and shift the operand.
|
|
|
ed5979 |
* Shifts larger than operand size get zeros.
|
|
|
ed5979 |
*/
|
|
|
ed5979 |
tcg_gen_ext8u_tl(s->A0, s->T1);
|
|
|
ed5979 |
+ if (TARGET_LONG_BITS == 64 && ot == MO_32) {
|
|
|
ed5979 |
+ tcg_gen_ext32u_tl(s->T0, s->T0);
|
|
|
ed5979 |
+ }
|
|
|
ed5979 |
tcg_gen_shr_tl(s->T0, s->T0, s->A0);
|
|
|
ed5979 |
|
|
|
ed5979 |
- bound = tcg_constant_tl(ot == MO_64 ? 63 : 31);
|
|
|
ed5979 |
- zero = tcg_constant_tl(0);
|
|
|
ed5979 |
tcg_gen_movcond_tl(TCG_COND_LEU, s->T0, s->A0, bound, s->T0, zero);
|
|
|
ed5979 |
|
|
|
ed5979 |
/*
|
|
|
ed5979 |
- * Extract the LEN into a mask. Lengths larger than
|
|
|
ed5979 |
- * operand size get all ones.
|
|
|
ed5979 |
+ * Extract the LEN into an inverse mask. Lengths larger than
|
|
|
ed5979 |
+ * operand size get all zeros, length 0 gets all ones.
|
|
|
ed5979 |
*/
|
|
|
ed5979 |
tcg_gen_extract_tl(s->A0, s->T1, 8, 8);
|
|
|
ed5979 |
- tcg_gen_movcond_tl(TCG_COND_LEU, s->A0, s->A0, bound, s->A0, bound);
|
|
|
ed5979 |
-
|
|
|
ed5979 |
- tcg_gen_movi_tl(s->T1, 1);
|
|
|
ed5979 |
- tcg_gen_shl_tl(s->T1, s->T1, s->A0);
|
|
|
ed5979 |
- tcg_gen_subi_tl(s->T1, s->T1, 1);
|
|
|
ed5979 |
- tcg_gen_and_tl(s->T0, s->T0, s->T1);
|
|
|
ed5979 |
+ tcg_gen_shl_tl(s->T1, mone, s->A0);
|
|
|
ed5979 |
+ tcg_gen_movcond_tl(TCG_COND_LEU, s->T1, s->A0, bound, s->T1, zero);
|
|
|
ed5979 |
+ tcg_gen_andc_tl(s->T0, s->T0, s->T1);
|
|
|
ed5979 |
|
|
|
ed5979 |
gen_op_update1_cc(s);
|
|
|
ed5979 |
set_cc_op(s, CC_OP_LOGICB + ot);
|
|
|
ed5979 |
diff --git a/tests/tcg/i386/test-i386-bmi2.c b/tests/tcg/i386/test-i386-bmi2.c
|
|
|
ed5979 |
index 3c3ef85513..982d4abda4 100644
|
|
|
ed5979 |
--- a/tests/tcg/i386/test-i386-bmi2.c
|
|
|
ed5979 |
+++ b/tests/tcg/i386/test-i386-bmi2.c
|
|
|
ed5979 |
@@ -99,6 +99,9 @@ int main(int argc, char *argv[]) {
|
|
|
ed5979 |
result = bextrq(mask, 0x10f8);
|
|
|
ed5979 |
assert(result == 0);
|
|
|
ed5979 |
|
|
|
ed5979 |
+ result = bextrq(0xfedcba9876543210ull, 0x7f00);
|
|
|
ed5979 |
+ assert(result == 0xfedcba9876543210ull);
|
|
|
ed5979 |
+
|
|
|
ed5979 |
result = blsiq(0x30);
|
|
|
ed5979 |
assert(result == 0x10);
|
|
|
ed5979 |
|
|
|
ed5979 |
@@ -164,6 +167,15 @@ int main(int argc, char *argv[]) {
|
|
|
ed5979 |
result = bextrl(mask, 0x1038);
|
|
|
ed5979 |
assert(result == 0);
|
|
|
ed5979 |
|
|
|
ed5979 |
+ result = bextrl((reg_t)0x8f635a775ad3b9b4ull, 0x3018);
|
|
|
ed5979 |
+ assert(result == 0x5a);
|
|
|
ed5979 |
+
|
|
|
ed5979 |
+ result = bextrl((reg_t)0xfedcba9876543210ull, 0x7f00);
|
|
|
ed5979 |
+ assert(result == 0x76543210u);
|
|
|
ed5979 |
+
|
|
|
ed5979 |
+ result = bextrl(-1, 0);
|
|
|
ed5979 |
+ assert(result == 0);
|
|
|
ed5979 |
+
|
|
|
ed5979 |
result = blsil(0xffff);
|
|
|
ed5979 |
assert(result == 1);
|
|
|
ed5979 |
|
|
|
ed5979 |
--
|
|
|
ed5979 |
2.39.1
|
|
|
ed5979 |
|