diff options
| author | Dave Hansen <dave.hansen@linux.intel.com> | 2016-07-23 09:50:25 +0200 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2016-08-05 16:56:11 -0500 |
| commit | 502c8e86ea07294067578292c6d402601c196019 (patch) | |
| tree | 1c7bf458d438492783b9f6a77a8e684660fed34d | |
| parent | a87cef825ac9422ba69d48e85571065074c8ccdf (diff) | |
target-i386: fix typo in xsetbv implementation
QEMU 2.6 added support for the XSAVE family of instructions, which
includes the XSETBV instruction which allows setting the XCR0
register.
But, when booting Linux kernels with XSAVE support enabled, I was
getting very early crashes where the instruction pointer was set
to 0x3. I tracked it down to a jump instruction generated by this:
gen_jmp_im(s->pc - pc_start);
where s->pc is pointing to the instruction after XSETBV and pc_start
is pointing _at_ XSETBV. Subtract the two and you get 0x3. Whoops.
The fix is to replace this typo with the pattern found everywhere
else in the file when folks want to end the translation buffer.
Richard Henderson confirmed that this is a bug and that this is the
correct fix.
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: qemu-stable@nongnu.org
Cc: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit ba03584f4f88082368b2562e515c3d60421b68ce)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | target-i386/translate.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/target-i386/translate.c b/target-i386/translate.c index 69760b4ffa..922347caf1 100644 --- a/target-i386/translate.c +++ b/target-i386/translate.c @@ -7170,7 +7170,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s, tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_regs[R_ECX]); gen_helper_xsetbv(cpu_env, cpu_tmp2_i32, cpu_tmp1_i64); /* End TB because translation flags may change. */ - gen_jmp_im(s->pc - pc_start); + gen_jmp_im(s->pc - s->cs_base); gen_eob(s); break; |