Il sab 5 set 2026, 03:46 Andrey Polivoda <[email protected]> ha
scritto:
> According to both Volume 2 of Intel 64 and IA-32 Architectures Software
> Developer's Manual and Volume 4 of AMD64 Architecture Programmer's Manual,
> VEX.L is a "don't care" bit for `VROUNDSS` and `VROUNDSD`.
>
> Currently, QEMU has an assertion in `gen_VROUNDSS()` and `gen_VROUNDSD()`,
> which checks that `s->vex_l` is not set. When either instruction is
> encountered
> with VEX.L bit set, the QEMU process crashes with an assertion failure.
>
> Not only does this behavior deviate from real hardware, but it also
> allows unprivileged guest userspace to crash the QEMU process itself.
>
Good catch - though, note that TCG is not considered a security boundary.
> case X86_SIZE_ps: /* SSE/AVX packed single precision */
> - case X86_SIZE_pd: /* SSE/AVX packed double precision */
> - *ot = s->vex_l ? MO_256 : MO_128;
> + case X86_SIZE_pd: { /* SSE/AVX packed double precision */
> + bool is_scalar = (e->s0 == X86_SIZE_ss || e->s0 ==
> X86_SIZE_sd ||
> + e->s1 == X86_SIZE_ss || e->s1 ==
> X86_SIZE_sd ||
> + e->s2 == X86_SIZE_ss || e->s2 ==
> X86_SIZE_sd);
> + *ot = (s->vex_l && !is_scalar) ? MO_256 : MO_128;
> + }
>
Oh, this also applies to VMOVSS, VSQRTSS, etc. but that's actually correct
- they're all VEX.LIG. It's worth listing these instructions above the
declaration of is_scalar.
Paolo
return true;
>
> case X86_SIZE_xh: /* SSE/AVX packed half register */
> diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc
> index c83ab80940..7e0d439f6d 100644
> --- a/target/i386/tcg/emit.c.inc
> +++ b/target/i386/tcg/emit.c.inc
> @@ -4642,14 +4642,12 @@ static void gen_VPHMINPOSUW(DisasContext *s,
> X86DecodedInsn *decode)
> static void gen_VROUNDSD(DisasContext *s, X86DecodedInsn *decode)
> {
> TCGv_i32 imm = tcg_constant8u_i32(decode->immediate);
> - assert(!s->vex_l);
> gen_helper_roundsd_xmm(tcg_env, OP_PTR0, OP_PTR1, OP_PTR2, imm);
> }
>
> static void gen_VROUNDSS(DisasContext *s, X86DecodedInsn *decode)
> {
> TCGv_i32 imm = tcg_constant8u_i32(decode->immediate);
> - assert(!s->vex_l);
> gen_helper_roundss_xmm(tcg_env, OP_PTR0, OP_PTR1, OP_PTR2, imm);
> }
>
> --
> 2.53.0
>
>
