From patchwork Mon Jan 1 23:06:17 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Richard Henderson X-Patchwork-Id: 759229 Delivered-To: patch@linaro.org Received: by 2002:a5d:67c6:0:b0:336:6142:bf13 with SMTP id n6csp5815423wrw; Mon, 1 Jan 2024 15:07:15 -0800 (PST) X-Google-Smtp-Source: AGHT+IHeVjsISClkK3eWgbNrIrhQa9kKt/OzDdDJQ3tGf5vX3Y5AnBsCpY0Z5X+rIoyTOJ95Vbhu X-Received: by 2002:a05:620a:2727:b0:781:c8a0:8639 with SMTP id b39-20020a05620a272700b00781c8a08639mr2241541qkp.119.1704150434969; Mon, 01 Jan 2024 15:07:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1704150434; cv=none; d=google.com; s=arc-20160816; b=KidaG8jhmd/+2lK3m+D9Bv1bAoIg68zG+hTFRquc6aXQ/VfRqDF0uQktasDoBGWfTL UUUzYuLSmcMpDrljYO061TRd3JK0oYTcLGs0rHDeaHtBqJPOc4QwSe8LNbQ4iQQ/kFoi +G3XW+sQ0qc/u+wFN8J+8j1MlyPpE8dhi4HRv/AM+Ytqagt/YYkiw5nkq6Drrwm5/l5k pIorX8EuNN7mr3f1QX1JtrxPS7Hgm1S20XZPGn8T4UzBLWnmLITdo1WVrlLryMwB5A1h QcTd+tXyJixIPmUaU+H2plwG+d9r3GUF/BR+dMybbtT2yWcSRlejA6IqxxkkqNH4k2gH vHCw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature; bh=Fc7w6qm1lcKkOSX/aWlQDZG20+2gOdT5iAy2c8bZOd8=; fh=8Cq8cA+VsbxpciW+3gd9DyjqsBD/Mhpsmww+rOVlris=; b=X/265BdHC83sb48RUc7LgzsP2kudvlVGHY8oGyT2jD1Mg3UhKqF+YFKnzFoqxDb/kD +K2oBTPAgRnkS9DMEw2BznliFcxITHpAj/c5cgkp0XsY1el4bAn7BG/kfbmSeT4GeXjD ewhDhClXLVtuqIuCRlR1tfjmtfo3tf2kctBe9s4EDcmnDDJBsgvXArObqmUm5P49ujlI Cm1XX0qg+xMiwBgaZBJ1sA1Sc5miPIXUYoKnYuGltNX/hH0XUOn1Xf1TNz6+kVAapMN3 BKgfHjo3BFqJtw5PPWrTuwh2yB7yWpjwr+hXfnlyLFtwt9XG7ywdxF5IgdC+v64BPKq1 OCYg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=dNkcO41+; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id oo15-20020a05620a530f00b0078159c856c6si13563846qkn.181.2024.01.01.15.07.14 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 01 Jan 2024 15:07:14 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=dNkcO41+; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1rKRMd-0001OI-9C; Mon, 01 Jan 2024 18:06:31 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rKRMa-0001NR-Rr for qemu-devel@nongnu.org; Mon, 01 Jan 2024 18:06:28 -0500 Received: from mail-pg1-x52f.google.com ([2607:f8b0:4864:20::52f]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1rKRMZ-0000Uc-9F for qemu-devel@nongnu.org; Mon, 01 Jan 2024 18:06:28 -0500 Received: by mail-pg1-x52f.google.com with SMTP id 41be03b00d2f7-53fbf2c42bfso6436343a12.3 for ; Mon, 01 Jan 2024 15:06:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1704150385; x=1704755185; darn=nongnu.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Fc7w6qm1lcKkOSX/aWlQDZG20+2gOdT5iAy2c8bZOd8=; b=dNkcO41+f8tEqtfO4CNEK3dzzuYmU72bWdyd57epmAhewzLeLt7RHz7f8a67QcEMtj ogk6TnzY9C5YB3hC95BjYoWhfUSIRC+4LS6Z0RwjdR/VKwliPovopIgOnnCJgr11M6gq x0Oo7AV6+ydX2/CJ/vi7CdysfcZZNdnlX5DkwVtTI296PMIfJhRN/SIHiqDfABCFrw8B Nf+VpbYc91syKadTGBPzmOtamcAqx3MD7ndkVEI1eFkiejeGu9jawdqrAxz+jrFJJMby 3/j4e+hqiQjlRVHVrpiQEM6ip7BsHqaMXlc6glQyIRph/u6yRDewnRTojoIGcUN84nFm mbCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1704150385; x=1704755185; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Fc7w6qm1lcKkOSX/aWlQDZG20+2gOdT5iAy2c8bZOd8=; b=hZafAFg/VkyIycwdF4otV76XBU2LSrOJf6IQXXrHMfYC6VpDcmh6U6unnnNrhV1rJc Frk0If2lK+nqHlo6ygJZVRdtRCln267V28VDpSD/lTZPO9vgZZYtmILeAjt4/L6mtPUf 43iW7kR8zjBT8Uf80ld5qRodyuJS5bo86Asuzg/WgRfMGqBs9Im+w+MqwqKrTxSjPAvs Psix/WKTNvKR6XHuyVDA17fTVJiGIsDUQp1InHF1ExsF2gG4wPI3hVMjTj+F2hs0SeY6 Ivqs1RMAKbe9i581Wo6tIM2Jw/MHxL8fKN1SVC7klk4HpF516HBS8u/gQQE9vunYup05 ccyQ== X-Gm-Message-State: AOJu0Yy5sdlKUW0PNOmXX9aF7N5+gfVMCk21pUVv8dRCuvQamjzIYvYj bSbNjV179B0oOyVl1t2lm1MwjDSpugfXsoz2rrpo8m8NOcc= X-Received: by 2002:a05:6a20:111f:b0:194:9578:9ba8 with SMTP id x31-20020a056a20111f00b0019495789ba8mr14471419pze.16.1704150384447; Mon, 01 Jan 2024 15:06:24 -0800 (PST) Received: from stoup.. (124-149-254-207.tpgi.com.au. [124.149.254.207]) by smtp.gmail.com with ESMTPSA id h12-20020a63df4c000000b005bd2b3a03eesm19672386pgj.6.2024.01.01.15.06.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jan 2024 15:06:24 -0800 (PST) From: Richard Henderson To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, qemu-stable@nongnu.org, Michael Tokarev Subject: [PATCH] target/i386: Do not re-compute new pc with CF_PCREL Date: Tue, 2 Jan 2024 10:06:17 +1100 Message-Id: <20240101230617.129349-1-richard.henderson@linaro.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::52f; envelope-from=richard.henderson@linaro.org; helo=mail-pg1-x52f.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org With PCREL, we have a page-relative view of EIP, and an approximation of PC = EIP+CSBASE that is good enough to detect page crossings. If we try to recompute PC after masking EIP, we will mess up that approximation and write a corrupt value to EIP. We already handled masking properly for PCREL, so the fix in b5e0d5d2 was only needed for the !PCREL path. Cc: qemu-stable@nongnu.org Fixes: b5e0d5d22fbf ("target/i386: Fix 32-bit wrapping of pc/eip computation") Reported-by: Michael Tokarev Signed-off-by: Richard Henderson --- target/i386/tcg/translate.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c index 037bc47e7c..e68375b19d 100644 --- a/target/i386/tcg/translate.c +++ b/target/i386/tcg/translate.c @@ -2845,10 +2845,6 @@ static void gen_jmp_rel(DisasContext *s, MemOp ot, int diff, int tb_num) } } new_eip &= mask; - new_pc = new_eip + s->cs_base; - if (!CODE64(s)) { - new_pc = (uint32_t)new_pc; - } gen_update_cc_op(s); set_cc_op(s, CC_OP_DYNAMIC); @@ -2864,6 +2860,8 @@ static void gen_jmp_rel(DisasContext *s, MemOp ot, int diff, int tb_num) tcg_gen_andi_tl(cpu_eip, cpu_eip, mask); use_goto_tb = false; } + } else if (!CODE64(s)) { + new_pc = (uint32_t)(new_eip + s->cs_base); } if (use_goto_tb && translator_use_goto_tb(&s->base, new_pc)) {