[xen stable-4.20] x86emul: adjust BSF/BSR/LZCNT/TZCNT behavior as to EFLAGS

[patchbot@xxxxxxx]

commit 758879c0193e3ae433ff9985e9c24cd8ee3a836e
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Jul 22 09:53:11 2025 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Jul 22 09:53:11 2025 +0200

    x86emul: adjust BSF/BSR/LZCNT/TZCNT behavior as to EFLAGS
    
    SDM revision 088 points out that apparently as of quite some time ago on
    Intel hardware BSF and BSR may alter all arithmetic flags, not just ZF.
    Because of the inconsistency (sometimes even errata, and because
    documentation doesn't look to be quite right about PF), best we can do
    is simply take the flag values from what the processor produces, just
    like we do for various other arithmetic insns. (Note also that AMD and
    Intel have always been disagreeing on arithmetic flags other than ZF.)
    To be both safe (against further anomalies) and consistent, extend this
    to {L,T}ZCNT as well. (Emulating the two insns correctly even when
    underlying hardware doesn't support it was perhaps nice, but yielded
    guest-observable inconsistencies.)
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: 37a55e69c7df0e62f9d2c4abc940212615a23598
    master date: 2025-07-16 12:51:26 +0200
---
 xen/arch/x86/x86_emulate/x86_emulate.c | 60 +++++++---------------------------
 1 file changed, 12 insertions(+), 48 deletions(-)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index a6a1c9937f..eafa4fa85a 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -5268,62 +5268,26 @@ x86_emulate(
         break;
 
     case X86EMUL_OPC(0x0f, 0xbc): /* bsf or tzcnt */
-    {
-        bool zf;
-
-        asm ( "bsf %2,%0" ASM_FLAG_OUT(, "; setz %1")
-              : "=r" (dst.val), ASM_FLAG_OUT("=@ccz", "=qm") (zf)
-              : "rm" (src.val) );
-        _regs.eflags &= ~X86_EFLAGS_ZF;
-        if ( (vex.pfx == vex_f3) && vcpu_has_bmi1() )
-        {
-            _regs.eflags &= ~X86_EFLAGS_CF;
-            if ( zf )
-            {
-                _regs.eflags |= X86_EFLAGS_CF;
-                dst.val = op_bytes * 8;
-            }
-            else if ( !dst.val )
-                _regs.eflags |= X86_EFLAGS_ZF;
-        }
-        else if ( zf )
+        if ( vex.pfx == vex_f3 )
+            emulate_2op_SrcV_srcmem("rep; bsf", src, dst, _regs.eflags);
+        else
         {
-            _regs.eflags |= X86_EFLAGS_ZF;
-            dst.type = OP_NONE;
+            emulate_2op_SrcV_srcmem("bsf", src, dst, _regs.eflags);
+            if ( _regs.eflags & X86_EFLAGS_ZF )
+                dst.type = OP_NONE;
         }
         break;
-    }
 
     case X86EMUL_OPC(0x0f, 0xbd): /* bsr or lzcnt */
-    {
-        bool zf;
-
-        asm ( "bsr %2,%0" ASM_FLAG_OUT(, "; setz %1")
-              : "=r" (dst.val), ASM_FLAG_OUT("=@ccz", "=qm") (zf)
-              : "rm" (src.val) );
-        _regs.eflags &= ~X86_EFLAGS_ZF;
-        if ( (vex.pfx == vex_f3) && vcpu_has_lzcnt() )
-        {
-            _regs.eflags &= ~X86_EFLAGS_CF;
-            if ( zf )
-            {
-                _regs.eflags |= X86_EFLAGS_CF;
-                dst.val = op_bytes * 8;
-            }
-            else
-            {
-                dst.val = op_bytes * 8 - 1 - dst.val;
-                if ( !dst.val )
-                    _regs.eflags |= X86_EFLAGS_ZF;
-            }
-        }
-        else if ( zf )
+        if ( vex.pfx == vex_f3 )
+            emulate_2op_SrcV_srcmem("rep; bsr", src, dst, _regs.eflags);
+        else
         {
-            _regs.eflags |= X86_EFLAGS_ZF;
-            dst.type = OP_NONE;
+            emulate_2op_SrcV_srcmem("bsr", src, dst, _regs.eflags);
+            if ( _regs.eflags & X86_EFLAGS_ZF )
+                dst.type = OP_NONE;
         }
         break;
-    }
 
     case X86EMUL_OPC(0x0f, 0xbe): /* movsx rm8,r{16,32,64} */
         /* Recompute DstReg as we may have decoded AH/BH/CH/DH. */
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.20