diff options
| author | Richard Henderson <richard.henderson@linaro.org> | 2024-01-02 10:06:17 +1100 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2024-01-20 17:41:47 +0300 |
| commit | 6abbb26bbc8a7779876b70e184a2123f34531f0b (patch) | |
| tree | a1dc9f000fe2ece1d33dcbb5b032699066cc7f89 /target | |
| parent | 15e207b9ed89c843639f8674f318b50569869de7 (diff) | |
target/i386: Do not re-compute new pc with CF_PCREL
With PCREL, we have a page-relative view of EIP, and an
approximation of PC = EIP+CSBASE that is good enough to
detect page crossings. If we try to recompute PC after
masking EIP, we will mess up that approximation and write
a corrupt value to EIP.
We already handled masking properly for PCREL, so the
fix in b5e0d5d2 was only needed for the !PCREL path.
Cc: qemu-stable@nongnu.org
Fixes: b5e0d5d22fbf ("target/i386: Fix 32-bit wrapping of pc/eip computation")
Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240101230617.129349-1-richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit a58506b748b8988a95f4fa1a2420ac5c17038b30)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Diffstat (limited to 'target')
| -rw-r--r-- | target/i386/tcg/translate.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c index 15b030d84b..fa2e1dc3b3 100644 --- a/target/i386/tcg/translate.c +++ b/target/i386/tcg/translate.c @@ -2883,10 +2883,6 @@ static void gen_jmp_rel(DisasContext *s, MemOp ot, int diff, int tb_num) } } new_eip &= mask; - new_pc = new_eip + s->cs_base; - if (!CODE64(s)) { - new_pc = (uint32_t)new_pc; - } gen_update_cc_op(s); set_cc_op(s, CC_OP_DYNAMIC); @@ -2902,6 +2898,8 @@ static void gen_jmp_rel(DisasContext *s, MemOp ot, int diff, int tb_num) tcg_gen_andi_tl(cpu_eip, cpu_eip, mask); use_goto_tb = false; } + } else if (!CODE64(s)) { + new_pc = (uint32_t)(new_eip + s->cs_base); } if (use_goto_tb && translator_use_goto_tb(&s->base, new_pc)) { |