[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 11/16] target/i386: Do not re-compute new pc with CF_PCREL
From: |
Paolo Bonzini |
Subject: |
[PULL 11/16] target/i386: Do not re-compute new pc with CF_PCREL |
Date: |
Thu, 18 Jan 2024 13:24:11 +0100 |
From: Richard Henderson <richard.henderson@linaro.org>
With PCREL, we have a page-relative view of EIP, and an
approximation of PC = EIP+CSBASE that is good enough to
detect page crossings. If we try to recompute PC after
masking EIP, we will mess up that approximation and write
a corrupt value to EIP.
We already handled masking properly for PCREL, so the
fix in b5e0d5d2 was only needed for the !PCREL path.
Cc: qemu-stable@nongnu.org
Fixes: b5e0d5d22fbf ("target/i386: Fix 32-bit wrapping of pc/eip computation")
Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240101230617.129349-1-richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
target/i386/tcg/translate.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index e1eb82a5c68..d4d7e904adb 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -2866,10 +2866,6 @@ static void gen_jmp_rel(DisasContext *s, MemOp ot, int
diff, int tb_num)
}
}
new_eip &= mask;
- new_pc = new_eip + s->cs_base;
- if (!CODE64(s)) {
- new_pc = (uint32_t)new_pc;
- }
gen_update_cc_op(s);
set_cc_op(s, CC_OP_DYNAMIC);
@@ -2885,6 +2881,8 @@ static void gen_jmp_rel(DisasContext *s, MemOp ot, int
diff, int tb_num)
tcg_gen_andi_tl(cpu_eip, cpu_eip, mask);
use_goto_tb = false;
}
+ } else if (!CODE64(s)) {
+ new_pc = (uint32_t)(new_eip + s->cs_base);
}
if (use_goto_tb && translator_use_goto_tb(&s->base, new_pc)) {
--
2.43.0
- [PULL 00/16] VGA, x86 TCG, misc changes for 2024-01-18, Paolo Bonzini, 2024/01/18
- [PULL 01/16] vga: use common endian swap macros, Paolo Bonzini, 2024/01/18
- [PULL 02/16] vga: introduce VGADisplayParams, Paolo Bonzini, 2024/01/18
- [PULL 03/16] vga: mask addresses in non-VESA modes to 256k, Paolo Bonzini, 2024/01/18
- [PULL 06/16] vga: reindent memory access code, Paolo Bonzini, 2024/01/18
- [PULL 07/16] vga: use latches in odd/even mode too, Paolo Bonzini, 2024/01/18
- [PULL 05/16] vga: optimize horizontal pel panning in 256-color modes, Paolo Bonzini, 2024/01/18
- [PULL 09/16] Add class property to configure KVM device node to use, Paolo Bonzini, 2024/01/18
- [PULL 10/16] io_uring: move LuringState typedef to block/aio.h, Paolo Bonzini, 2024/01/18
- [PULL 13/16] target/i386: pcrel: store low bits of physical address in data[0], Paolo Bonzini, 2024/01/18
- [PULL 11/16] target/i386: Do not re-compute new pc with CF_PCREL,
Paolo Bonzini <=
- [PULL 15/16] qemu/osdep: Add huge page aligned support on LoongArch platform, Paolo Bonzini, 2024/01/18
- [PULL 16/16] tests/tcg: Don't #include <inttypes.h> in aarch64/system/vtimer.c, Paolo Bonzini, 2024/01/18
- [PULL 12/16] target/i386: fix incorrect EIP in PC-relative translation blocks, Paolo Bonzini, 2024/01/18
- [PULL 08/16] vga: sort-of implement word and double-word access modes, Paolo Bonzini, 2024/01/18
- [PULL 14/16] remove unnecessary casts from uintptr_t, Paolo Bonzini, 2024/01/18
- [PULL 04/16] vga: implement horizontal pel panning in graphics modes, Paolo Bonzini, 2024/01/18
- Re: [PULL 00/16] VGA, x86 TCG, misc changes for 2024-01-18, Peter Maydell, 2024/01/19