Bug 23418 - Incorrect xmmword is accepted
Summary: Incorrect xmmword is accepted
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: gas (show other bugs)
Version: 2.32
: P2 normal
Target Milestone: 2.32
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-07-16 20:33 UTC by H.J. Lu
Modified: 2018-07-18 19:37 UTC (History)
1 user (show)

See Also:
Host:
Target: x86
Build:
Last reconfirmed:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description H.J. Lu 2018-07-16 20:33:29 UTC
[hjl@gnu-cfl-1 fp16-1]$ cat z.s
        .intel_syntax noprefix
        vcvtps2qq xmm0, xmmword ptr [rax]
                        ^^^^^^^^ This is wrong.
[hjl@gnu-cfl-1 fp16-1]$ gcc -c z.s
[hjl@gnu-cfl-1 fp16-1]$ objdump -dW -Mintel z.o

z.o:     file format elf64-x86-64


Disassembly of section .text:

0000000000000000 <.text>:
   0:	62 f1 7d 08 7b 00    	vcvtps2qq xmm0,QWORD PTR [rax]
[hjl@gnu-cfl-1 fp16-1]$
Comment 1 H.J. Lu 2018-07-16 20:35:20 UTC
This looks odd:

/* Return 1 if there is no conflict in any size on operand J for
   instruction template T.  */

static INLINE int
match_mem_size (const insn_template *t, unsigned int wanted, unsigned int given){
  return (match_reg_size (t, wanted, given)
          && !((i.types[given].bitfield.unspecified
                && !i.broadcast
                && !t->operand_types[wanted].bitfield.unspecified)
               || (i.types[given].bitfield.fword
                   && !t->operand_types[wanted].bitfield.fword)
               /* For scalar opcode templates to allow register and memory
                  operands at the same time, some special casing is needed
                  here.  Also for v{,p}broadcast*, {,v}pmov{s,z}*, and
                  down-conversion vpmov*.  */
               || ((t->operand_types[wanted].bitfield.regsimd
                    && !t->opcode_modifier.broadcast
                    && (t->operand_types[wanted].bitfield.byte
                        || t->operand_types[wanted].bitfield.word
                        || t->operand_types[wanted].bitfield.dword
                        || t->operand_types[wanted].bitfield.qword))
                   ? (i.types[given].bitfield.xmmword
                      || i.types[given].bitfield.ymmword
                      || i.types[given].bitfield.zmmword)
                   : !match_simd_size(t, wanted, given))));
}
Comment 2 H.J. Lu 2018-07-16 20:45:43 UTC
vcvtps2uqq has the same issue.
Comment 3 bd170260 2018-07-17 14:47:32 UTC
After regxmm, regymm, regzmm were combined into regsimd it's impossible to distinguish if xmmword/ymmword/zmmword can represent a memory reference when operand specification contains SIMD register. For example for template operands specification like these

XMM|...|XMMword|...

and

XMM|...

xmmword bitfield is always set.
Comment 4 H.J. Lu 2018-07-17 20:01:01 UTC
A patch is posted at

https://sourceware.org/ml/binutils/2018-07/msg00273.html
Comment 5 Sourceware Commits 2018-07-18 12:34:41 UTC
The master branch has been updated by H.J. Lu <hjl@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=11a322db5c8bc23009e97af30180d6b14d86dbd3

commit 11a322db5c8bc23009e97af30180d6b14d86dbd3
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Wed Jul 18 05:33:36 2018 -0700

    x86: Split vcvtps2{,u}qq and vcvttps2{,u}qq
    
    After
    
    commit 1b54b8d7e4fc8055f9220a5287e8a94d8a65a88d
    Author: Jan Beulich <jbeulich@novell.com>
    Date:   Mon Dec 18 09:36:14 2017 +0100
    
        x86: fold RegXMM/RegYMM/RegZMM into RegSIMD
    
        ... qualified by their respective sizes, allowing to drop FirstXmm0 at
        the same time.
    
    folded RegXMM, RegYMM and RegZMM into RegSIMD, it's no longer impossible
    to distinguish if Xmmword can represent a memory reference when operand
    specification contains SIMD register. For example, template operands
    specification like these
    
    RegXMM|...|Xmmword|...
    
    and
    
    RegXMM|...
    
    The Xmmword bitfield is always set by RegXMM which is represented by
    "RegSIMD|Xmmword".  This patch splits each of vcvtps2qq, vcvtps2uqq,
    vcvttps2qq and vcvttps2uqq into 2 templates: one template only has
    RegXMM source operand and the other only has mempry source operand.
    
    gas/
    
    	PR gas/23418
    	* testsuite/gas/i386/xmmword.s: Add tests for vcvtps2qq,
    	vcvtps2uqq, vcvttps2qq and vcvttps2uqq.
    	* testsuite/gas/i386/xmmword.l: Updated.
    
    opcodes/
    
    	PR gas/23418
    	* i386-opc.h (Byte): Update comments.
    	(Word): Likewise.
    	(Dword): Likewise.
    	(Fword): Likewise.
    	(Qword): Likewise.
    	(Tbyte): Likewise.
    	(Xmmword): Likewise.
    	(Ymmword): Likewise.
    	(Zmmword): Likewise.
    	* i386-opc.tbl: Split vcvtps2qq, vcvtps2uqq, vcvttps2qq and
    	vcvttps2uqq.
    	* i386-tbl.h: Regenerated.
Comment 6 Sourceware Commits 2018-07-18 19:36:52 UTC
The binutils-2_31-branch branch has been updated by H.J. Lu <hjl@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=01683b308a016c49418aee27241389bd2560e0f1

commit 01683b308a016c49418aee27241389bd2560e0f1
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Wed Jul 18 12:34:44 2018 -0700

    x86: Split vcvtps2{,u}qq and vcvttps2{,u}qq
    
    After
    
    commit 1b54b8d7e4fc8055f9220a5287e8a94d8a65a88d
    Author: Jan Beulich <jbeulich@novell.com>
    Date:   Mon Dec 18 09:36:14 2017 +0100
    
        x86: fold RegXMM/RegYMM/RegZMM into RegSIMD
    
        ... qualified by their respective sizes, allowing to drop FirstXmm0 at
        the same time.
    
    folded RegXMM, RegYMM and RegZMM into RegSIMD, it's no longer impossible
    to distinguish if Xmmword can represent a memory reference when operand
    specification contains SIMD register. For example, template operands
    specification like these
    
    RegXMM|...|Xmmword|...
    
    and
    
    RegXMM|...
    
    The Xmmword bitfield is always set by RegXMM which is represented by
    "RegSIMD|Xmmword".  This patch splits each of vcvtps2qq, vcvtps2uqq,
    vcvttps2qq and vcvttps2uqq into 2 templates: one template only has
    RegXMM source operand and the other only has mempry source operand.
    
    gas/
    
    	PR gas/23418
    	* testsuite/gas/i386/xmmword.s: Add tests for vcvtps2qq,
    	vcvtps2uqq, vcvttps2qq and vcvttps2uqq.
    	* testsuite/gas/i386/xmmword.l: Updated.
    
    opcodes/
    
    	PR gas/23418
    	* i386-opc.h (Byte): Update comments.
    	(Word): Likewise.
    	(Dword): Likewise.
    	(Fword): Likewise.
    	(Qword): Likewise.
    	(Tbyte): Likewise.
    	(Xmmword): Likewise.
    	(Ymmword): Likewise.
    	(Zmmword): Likewise.
    	* i386-opc.tbl: Split vcvtps2qq, vcvtps2uqq, vcvttps2qq and
    	vcvttps2uqq.
    	* i386-tbl.h: Regenerated.
    
    (cherry picked from commit 11a322db5c8bc23009e97af30180d6b14d86dbd3)
Comment 7 H.J. Lu 2018-07-18 19:37:39 UTC
Fixed for 2.32 and 2.31 branch.