From cf90c8a48af2694d0653f754996a41672a153de4 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Mon, 20 Jul 2026 09:50:00 +0200 Subject: [PATCH] x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion AFL has pointed out that the op_bytes-is-not-0 assertion in common SIMD handling can trigger for these insns. Indeed when the (relevant part of) the controlling mask register is 0, no memory is accessed at all. Leave op_bytes unaltered in this case, to engage the short-circuiting in common SIMD handling when fault_suppression is true and op_bytes is 0. While there also correct a related typo in the test harness. Fixes: 65f82d4ce1ea ("x86emul: support AVX512{F,_VBMI2} compress/expand insns") Signed-off-by: Jan Beulich Acked-by: Andrew Cooper --- tools/tests/x86_emulator/predicates.c | 2 +- xen/arch/x86/x86_emulate/x86_emulate.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tools/tests/x86_emulator/predicates.c b/tools/tests/x86_emulator/predicates.c index 8ff2653895..84717d3ebe 100644 --- a/tools/tests/x86_emulator/predicates.c +++ b/tools/tests/x86_emulator/predicates.c @@ -1946,7 +1946,7 @@ static const struct evex { { { 0x83 }, 2, T, R, pfx_66, W1, Ln }, /* vpmultishiftqb */ { { 0x88 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpandp{s,d} */ { { 0x89 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpand{d,q} */ - { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompressp{s,d} */ + { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vcompressp{s,d} */ { { 0x8b }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompress{d,q} */ { { 0x8d }, 2, F, R, pfx_66, Wn, Ln }, /* vperm{b,w} */ { { 0x8f }, 2, F, R, pfx_66, W0, Ln }, /* vpshufbitqmb */ diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 71546095d4..38e5c349f5 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -6236,9 +6236,11 @@ x86_emulate( ASSERT(op_bytes == n * elem_bytes); op_mask &= ~0ULL >> (64 - n); n = hweight64(op_mask); - op_bytes = n * elem_bytes; if ( n ) + { + op_bytes = n * elem_bytes; op_mask = ~0ULL >> (64 - n); + } } goto simd_zmm;