On Tue, Aug 25, 2026 at 02:29:11PM +0200, Paolo Bonzini wrote:
> Date: Tue, 25 Aug 2026 14:29:11 +0200
> From: Paolo Bonzini <[email protected]>
> Subject: [PATCH 10/20] target/i386/tcg: implement JMPABS instruction
> X-Mailer: git-send-email 2.55.0
>
> This is the same as an indirect jump, just with immediate operand.
> The requirement of W=0 and 0x67 are already available in the decoder.
>
> Signed-off-by: Paolo Bonzini <[email protected]>
> ---
> target/i386/tcg/decode-new.h | 3 +++
> target/i386/tcg/decode-new.c.inc | 4 ++++
> 2 files changed, 7 insertions(+)
>
> diff --git a/target/i386/tcg/decode-new.h b/target/i386/tcg/decode-new.h
> index c974ca9d7c5..4998712e86d 100644
> --- a/target/i386/tcg/decode-new.h
> +++ b/target/i386/tcg/decode-new.h
> @@ -184,6 +184,9 @@ typedef enum X86InsnCheck {
>
> /* No REX2 prefix allowed */
> X86_CHECK_no_rex2 = 8192,
> +
> + /* No 0x67 prefix allowed */
> + X86_CHECK_no_adr = 16384,
> } X86InsnCheck;
>
> typedef enum X86InsnSpecial {
> diff --git a/target/i386/tcg/decode-new.c.inc
> b/target/i386/tcg/decode-new.c.inc
> index 1f59fd665f7..d215d28cec5 100644
> --- a/target/i386/tcg/decode-new.c.inc
> +++ b/target/i386/tcg/decode-new.c.inc
> @@ -1991,6 +1991,7 @@ static const X86OpEntry opcodes_root[256] = {
>
> #ifdef TARGET_X86_64
> static const X86OpEntry opcodes_rex2_map0_A0toAF[16] = {
> + [1] = X86_OP_ENTRY1(JMP_m, I,q, p_00 chk2(W0, no_adr)),
> };
Maybe it should use X86_OP_ENTRYr? since JMPABS doesn't need to write
back.
Just a simple test:
#include <stdio.h>
int main(void)
{
__asm__ volatile (
/* JMPABS: REX2(M0=0,W=0) = D5 00, opcode A1, then imm64 target */
".byte 0xd5, 0x00, 0xa1\n\t"
".quad 1f\n\t"
"ud2\n\t" /* this should be skipped */
"1:\n\t");
puts("JMPABS -- OK");
return 0;
}
And this hits an abort():
$ ./build/qemu-x86_64 /tmp/jmpabs
**
ERROR:../target/i386/tcg/emit.c.inc:380:gen_writeback: code should not be
reached
Bail out! ERROR:../target/i386/tcg/emit.c.inc:380:gen_writeback: code should
not be reached
Aborted (core dumped)
more GDB backtrace:
Thread 1 "qemu-x86_64" received signal SIGABRT, Aborted.
__pthread_kill_implementation (no_tid=0, signo=6, threadid=140737352460800) at
./nptl/pthread_kill.c:44
44 ./nptl/pthread_kill.c: No such file or directory.
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737352460800)
at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=140737352460800) at
./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=140737352460800, signo=signo@entry=6) at
./nptl/pthread_kill.c:89
#3 0x00007ffff7242476 in __GI_raise (sig=sig@entry=6) at
../sysdeps/posix/raise.c:26
#4 0x00007ffff72287f3 in __GI_abort () at ./stdlib/abort.c:79
#5 0x00007ffff76e3b57 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#6 0x00007ffff773d70f in g_assertion_message_expr () from
/lib/x86_64-linux-gnu/libglib-2.0.so.0
#7 0x0000555555664f37 in gen_writeback (s=s@entry=0x7fffffffd240,
decode=decode@entry=0x7fffffffd0b0, opn=opn@entry=0, v=<optimized out>) at
../target/i386/tcg/emit.c.inc:380
#8 0x0000555555677778 in disas_insn (cpu=0x55555593e780, s=0x7fffffffd240) at
../target/i386/tcg/decode-new.c.inc:3682
#9 i386_tr_translate_insn (dcbase=0x7fffffffd240, cpu=0x55555593e780) at
../target/i386/tcg/translate.c:3608
#10 0x00005555555d7962 in translator_loop (cpu=0x55555593e780,
tb=0x7fffe80d0700 <code_gen_buffer+853715>, max_insns=0x7fffffffd4cc,
pc=<optimized out>, host_pc=<optimized out>, ops=ops@entry=0x5555557dc5a0
<i386_tr_ops>, db=0x7fffffffd240, addr_type=TCG_TYPE_I64) at
../accel/tcg/translator.c:178
#11 0x000055555567b212 in x86_translate_code (cpu=<optimized out>,
tb=<optimized out>, max_insns=<optimized out>, pc=<optimized out>,
host_pc=<optimized out>) at ../target/i386/tcg/translate.c:3699
#12 0x00005555555d6644 in setjmp_gen_code (env=env@entry=0x5555559427f0,
tb=tb@entry=0x7fffe80d0700 <code_gen_buffer+853715>, pc=pc@entry=4198710,
host_pc=0x401136, max_insns=max_insns@entry=0x7fffffffd4cc, ti=<optimized out>)
at ../accel/tcg/translate-all.c:251
#13 0x00005555555d6b0e in tb_gen_code (cpu=cpu@entry=0x55555593e780, s=...) at
../accel/tcg/translate-all.c:324
#14 0x00005555555cec1a in cpu_exec_loop (cpu=cpu@entry=0x55555593e780,
sc=<optimized out>) at ../accel/tcg/cpu-exec.c:973
#15 0x00005555555ced99 in cpu_exec_setjmp (cpu=cpu@entry=0x55555593e780,
sc=<optimized out>) at ../accel/tcg/cpu-exec.c:1019
#16 0x00005555555cf381 in cpu_exec (cpu=cpu@entry=0x55555593e780) at
../accel/tcg/cpu-exec.c:1045
#17 0x0000555555622c80 in cpu_loop (env=env@entry=0x5555559427f0) at
../linux-user/x86_64/../i386/cpu_loop.c:217
#18 0x00005555555a1d17 in main (argc=<optimized out>, argv=<optimized out>,
envp=<optimized out>) at ../linux-user/main.c:1010
Regards,
Zhao
