diff mbox

x86emul: CMOVcc always writes its destination

Message ID 58358A8602000078001213DD@prv-mh.provo.novell.com (mailing list archive)
State New, archived
Headers show

Commit Message

Jan Beulich Nov. 23, 2016, 11:24 a.m. UTC 
This would be benign if there wasn't the zero-extending side effect of
32-bit operations in 64-bit mode.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
x86emul: CMOVcc always writes its destination

This would be benign if there wasn't the zero-extending side effect of
32-bit operations in 64-bit mode.

Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/tools/tests/x86_emulator/test_x86_emulator.c
+++ b/tools/tests/x86_emulator/test_x86_emulator.c
@@ -653,6 +653,21 @@ int main(int argc, char **argv)
     printf("okay\n");
 #else
     printf("skipped\n");
+
+    printf("%-40s", "Testing cmovz %ecx,%eax...");
+    instr[0] = 0x0f; instr[1] = 0x44; instr[2] = 0xc1;
+    regs.eflags = 0x200;
+    regs.eip    = (unsigned long)&instr[0];
+    regs.rax    = 0x1111111122222222;
+    regs.rcx    = 0x3333333344444444;
+    rc = x86_emulate(&ctxt, &emulops);
+    if ( (rc != X86EMUL_OKAY) ||
+         (regs.rax != 0x0000000022222222) ||
+         (regs.rcx != 0x3333333344444444) ||
+         (regs.eflags != 0x200) ||
+         (regs.eip != (unsigned long)&instr[3]) )
+        goto fail;
+    printf("okay\n");
 #endif
 
     printf("%-40s", "Testing movbe (%%ecx),%%eax...");
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -4784,9 +4784,8 @@ x86_emulate(
 
     case X86EMUL_OPC(0x0f, 0x40) ... X86EMUL_OPC(0x0f, 0x4f): /* cmovcc */
         vcpu_must_have_cmov();
-        dst.val = src.val;
-        if ( !test_cc(b, _regs.eflags) )
-            dst.type = OP_NONE;
+        if ( test_cc(b, _regs.eflags) )
+            dst.val = src.val;
         break;
 
     case X86EMUL_OPC(0x0f, 0x34): /* sysenter */ {

Comments

Andrew Cooper Nov. 25, 2016, 10:31 a.m. UTC | #1 
On 23/11/16 11:24, Jan Beulich wrote:
> This would be benign if there wasn't the zero-extending side effect of
> 32-bit operations in 64-bit mode.
>
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Wei Liu Nov. 25, 2016, 1:08 p.m. UTC | #2 
On Fri, Nov 25, 2016 at 10:31:55AM +0000, Andrew Cooper wrote:
> On 23/11/16 11:24, Jan Beulich wrote:
> > This would be benign if there wasn't the zero-extending side effect of
> > 32-bit operations in 64-bit mode.
> >
> > Signed-off-by: Jan Beulich <jbeulich@suse.com>
> 
> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>


Release-acked-by: Wei Liu <wei.liu2@citrix.com>
diff mbox

Patch

--- a/tools/tests/x86_emulator/test_x86_emulator.c
+++ b/tools/tests/x86_emulator/test_x86_emulator.c
@@ -653,6 +653,21 @@  int main(int argc, char **argv)
     printf("okay\n");
 #else
     printf("skipped\n");
+
+    printf("%-40s", "Testing cmovz %ecx,%eax...");
+    instr[0] = 0x0f; instr[1] = 0x44; instr[2] = 0xc1;
+    regs.eflags = 0x200;
+    regs.eip    = (unsigned long)&instr[0];
+    regs.rax    = 0x1111111122222222;
+    regs.rcx    = 0x3333333344444444;
+    rc = x86_emulate(&ctxt, &emulops);
+    if ( (rc != X86EMUL_OKAY) ||
+         (regs.rax != 0x0000000022222222) ||
+         (regs.rcx != 0x3333333344444444) ||
+         (regs.eflags != 0x200) ||
+         (regs.eip != (unsigned long)&instr[3]) )
+        goto fail;
+    printf("okay\n");
 #endif
 
     printf("%-40s", "Testing movbe (%%ecx),%%eax...");
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -4784,9 +4784,8 @@  x86_emulate(
 
     case X86EMUL_OPC(0x0f, 0x40) ... X86EMUL_OPC(0x0f, 0x4f): /* cmovcc */
         vcpu_must_have_cmov();
-        dst.val = src.val;
-        if ( !test_cc(b, _regs.eflags) )
-            dst.type = OP_NONE;
+        if ( test_cc(b, _regs.eflags) )
+            dst.val = src.val;
         break;
 
     case X86EMUL_OPC(0x0f, 0x34): /* sysenter */ {