[xen staging] x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion

[patchbot@xxxxxxx]

commit cf90c8a48af2694d0653f754996a41672a153de4
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Jul 20 09:50:00 2026 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Jul 20 09:50:00 2026 +0200

    x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion
    
    AFL has pointed out that the op_bytes-is-not-0 assertion in common SIMD
    handling can trigger for these insns. Indeed when the (relevant part of)
    the controlling mask register is 0, no memory is accessed at all. Leave
    op_bytes unaltered in this case, to engage the short-circuiting in common
    SIMD handling when fault_suppression is true and op_bytes is 0.
    
    While there also correct a related typo in the test harness.
    
    Fixes: 65f82d4ce1ea ("x86emul: support AVX512{F,_VBMI2} compress/expand 
insns")
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
 tools/tests/x86_emulator/predicates.c  | 2 +-
 xen/arch/x86/x86_emulate/x86_emulate.c | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/tools/tests/x86_emulator/predicates.c 
b/tools/tests/x86_emulator/predicates.c
index 8ff2653895..84717d3ebe 100644
--- a/tools/tests/x86_emulator/predicates.c
+++ b/tools/tests/x86_emulator/predicates.c
@@ -1946,7 +1946,7 @@ static const struct evex {
     { { 0x83 }, 2, T, R, pfx_66, W1, Ln }, /* vpmultishiftqb */
     { { 0x88 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpandp{s,d} */
     { { 0x89 }, 2, T, R, pfx_66, Wn, Ln }, /* vpexpand{d,q} */
-    { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompressp{s,d} */
+    { { 0x8a }, 2, T, W, pfx_66, Wn, Ln }, /* vcompressp{s,d} */
     { { 0x8b }, 2, T, W, pfx_66, Wn, Ln }, /* vpcompress{d,q} */
     { { 0x8d }, 2, F, R, pfx_66, Wn, Ln }, /* vperm{b,w} */
     { { 0x8f }, 2, F, R, pfx_66, W0, Ln }, /* vpshufbitqmb */
diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index 71546095d4..38e5c349f5 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -6236,9 +6236,11 @@ x86_emulate(
             ASSERT(op_bytes == n * elem_bytes);
             op_mask &= ~0ULL >> (64 - n);
             n = hweight64(op_mask);
-            op_bytes = n * elem_bytes;
             if ( n )
+            {
+                op_bytes = n * elem_bytes;
                 op_mask = ~0ULL >> (64 - n);
+            }
         }
         goto simd_zmm;
 
--
generated by git-patchbot for /home/xen/git/xen.git#staging