target-i386: fix handling of ZF in btx instructions

Eflags for bt/bts/btr/btc instructions compute as for shift(SAR) instructions. According to Intel A2 manual, for btx instructions zf is unaffected under any condition, but for SAR group, when evaluate eflags, we compute zf.

So I suggest add another group, specifically for computing eflags after btx instructions.

Signed-off-by Dmitry Poletaev <[email protected]>

target-i386/cc_helper.c +12 -0

index 05dd12b..272e2f1 100644
@@ -168,6 +168,12 @@ target_ulong helper_cc_compute_all(target_ulong dst, target_ulong src1,
     case CC_OP_SHLL:
         return compute_all_shll(dst, src1);
 
+    case CC_OP_BTXB:
+        return compute_all_btxb(dst, src1);
+    case CC_OP_BTXW:
+        return compute_all_btxw(dst, src1);
+    case CC_OP_BTXL:
+        return compute_all_btxl(dst, src1);
     case CC_OP_SARB:
         return compute_all_sarb(dst, src1);
     case CC_OP_SARW:

@@ -208,6 +214,8 @@ target_ulong helper_cc_compute_all(target_ulong dst, target_ulong src1,
         return compute_all_decq(dst, src1);
     case CC_OP_SHLQ:
         return compute_all_shlq(dst, src1);
+    case CC_OP_BTXQ:
+        return compute_all_btxq(dst, src1);
     case CC_OP_SARQ:
         return compute_all_sarq(dst, src1);
     case CC_OP_BMILGQ:

@@ -234,6 +242,10 @@ target_ulong helper_cc_compute_c(target_ulong dst, target_ulong src1,
         return 0;
 
     case CC_OP_EFLAGS:
+    case CC_OP_BTXB:
+    case CC_OP_BTXW:
+    case CC_OP_BTXL:
+    case CC_OP_BTXQ:
     case CC_OP_SARB:
     case CC_OP_SARW:
     case CC_OP_SARL:

target-i386/cc_helper_template.h +13 -0

index 607311f..04375f1 100644
@@ -187,6 +187,19 @@ static int glue(compute_c_shl, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1)
     return (src1 >> (DATA_BITS - 1)) & CC_C;
 }
 
+static int glue(compute_all_btx, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1)
+{
+    int cf, pf, af, sf, of;
+
+    cf = src1 & CC_C;
+    pf = 0; /* undefined */
+    af = 0; /* undefined */
+    /* zf unaffected */
+    sf = 0;  /* undefined */
+    of = 0; /* undefined */
+    return cf | pf | af | sf | of;
+}
+
 static int glue(compute_all_sar, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1)
 {
     int cf, pf, af, zf, sf, of;

target-i386/cpu.h +4 -0

index 2a22a7d..506037d 100644
@@ -660,6 +660,10 @@ typedef enum {
     CC_OP_SHLL,
     CC_OP_SHLQ,
 
+    CC_OP_BTXB, /* modify only C, CC_SRC.msb = C */
+    CC_OP_BTXW,
+    CC_OP_BTXL,
+    CC_OP_BTXQ,
     CC_OP_SARB, /* modify all flags, CC_DST = res, CC_SRC.lsb = C */
     CC_OP_SARW,
     CC_OP_SARL,

target-i386/translate.c +2 -1

index 02625e3..e77ba0b 100644
@@ -200,6 +200,7 @@ static const uint8_t cc_op_live[CC_OP_NB] = {
     [CC_OP_INCB ... CC_OP_INCQ] = USES_CC_DST | USES_CC_SRC,
     [CC_OP_DECB ... CC_OP_DECQ] = USES_CC_DST | USES_CC_SRC,
     [CC_OP_SHLB ... CC_OP_SHLQ] = USES_CC_DST | USES_CC_SRC,
+    [CC_OP_BTXB ... CC_OP_BTXQ] = USES_CC_DST | USES_CC_SRC,
     [CC_OP_SARB ... CC_OP_SARQ] = USES_CC_DST | USES_CC_SRC,
     [CC_OP_BMILGB ... CC_OP_BMILGQ] = USES_CC_DST | USES_CC_SRC,
     [CC_OP_ADCX] = USES_CC_DST | USES_CC_SRC,

@@ -6734,7 +6735,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
             tcg_gen_xor_tl(cpu_T[0], cpu_T[0], cpu_tmp0);
             break;
         }
-        set_cc_op(s, CC_OP_SARB + ot);
+        set_cc_op(s, CC_OP_BTXB + ot);
         if (op != 0) {
             if (mod != 3) {
                 gen_op_st_v(s, ot, cpu_T[0], cpu_A0);

Eflags for bt/bts/btr/btc instructions compute as for shift(SAR) instructions. According to Intel A2 manual, for btx instructions zf is unaffected under any condition, but for SAR group, when evaluate eflags, we compute zf.

Quoted 1 line · Dmitry Poletaev

Eflags for bt/bts/btr/btc instructions compute as for shift(SAR) instructions. According to Intel A2 manual, for btx instructions zf is unaffected under any condition, but for SAR group, when evaluate eflags, we compute zf.

Isn't this the same bug that's fixed by Richard Henderson's patch from last month?

http://patchwork.ozlabs.org/patch/337929/