[PATCH 12/30] x86emul: switch to EVEX.B{3,4} nomenclature

[Jan Beulich <jbeulich@xxxxxxxx>]

The APX spec renames the B field and adds a new one for the 5th base
address register bit; it can be expected for the SDM to follow once APX
stuff is folded in. The new naming is also better to reflect in our
structure field identifiers.

Like we represent VEX.B and EVEX.B3 in rex_prefix, also represent
EVEX.B4 in rex2_prefix, allowing to leave various decode_reg()
invocations untouched.

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
---
Raising of #UD on an unduly set EVEX.B4 follows what the spec says: It's
ignored. While that matches EVEX.B3 (and VEX.B) treatment, what the spec
says is apparently wrong for EVEX.R{3,4}, which aren't ignored as per
what the SDM specifies. Hence the overall situation isn't really clear.

--- a/tools/tests/x86_emulator/evex-disp8.c
+++ b/tools/tests/x86_emulator/evex-disp8.c
@@ -938,9 +938,9 @@ static void test_one(const struct test *
         uint8_t raw[3];
         struct {
             uint8_t opcx:3;
-            uint8_t mbz:1;
+            uint8_t b4:1;
             uint8_t r4:1;
-            uint8_t b:1;
+            uint8_t b3:1;
             uint8_t x:1;
             uint8_t r3:1;
             uint8_t pfx:2;
@@ -955,7 +955,7 @@ static void test_one(const struct test *
         };
     } evex = {
         .opcx = test->spc, .pfx = test->pfx, .lr = vl,
-        .r4 = 1, .b = 1, .x = 1, .r3 = 1, .mbs = 1,
+        .r4 = 1, .b3 = 1, .x = 1, .r3 = 1, .mbs = 1,
         .reg = 0xf, .RX = 1, .opmsk = sg,
     };
 
--- a/xen/arch/x86/x86_emulate/decode.c
+++ b/xen/arch/x86/x86_emulate/decode.c
@@ -1276,15 +1276,23 @@ int x86emul_decode(struct x86_emulate_st
                         s->evex.raw[1] = s->vex.raw[1];
                         s->evex.raw[2] = insn_fetch_type(uint8_t);
 
-                        generate_exception_if(!s->evex.mbs || s->evex.mbz, 
X86_EXC_UD);
+                        generate_exception_if(!s->evex.mbs, X86_EXC_UD);
+                        generate_exception_if((!(s->xcr0 & X86_XCR0_APX) &&
+                                               s->evex.b4),
+                                              X86_EXC_UD);
                         generate_exception_if(!s->evex.opmsk && s->evex.z, 
X86_EXC_UD);
 
                         if ( !mode_64bit() )
+                        {
                             s->evex.r4 = 1;
+                            s->evex.b4 = 0;
+                        }
                         else if ( s->xcr0 & X86_XCR0_APX )
                         {
                             if ( !s->evex.r4 )
                                 s->rex2_prefix |= REX_R;
+                            if ( s->evex.b4 )
+                                s->rex2_prefix |= REX_B;
                         }
 
                         s->vex.opcx = s->evex.opcx;
@@ -1320,6 +1328,16 @@ int x86emul_decode(struct x86_emulate_st
                         d = twobyte_table[0x3a].desc;
                         break;
 
+                    case evex_map4:
+                        if ( !mode_64bit() || !evex_encoded() )
+                        {
+                            rc = X86EMUL_UNRECOGNIZED;
+                            goto done;
+                        }
+
+                        s->promoted_evex = true;
+                        break;
+
                     case evex_map5:
                         if ( !evex_encoded() )
                         {
@@ -1832,10 +1850,56 @@ int x86emul_decode(struct x86_emulate_st
 
         if ( s->modrm_mod == 3 )
         {
+            bool rm_is_gpr = s->promoted_evex;
+
+            /* Originally VEX- (now EVEX-)encoded GPR insns. */
+            if ( (s->evex.opcx == vex_0f38 || s->evex.opcx == vex_0f3a ||
+                  s->evex.opcx == vex_map7) &&
+                 b >= 0xf0 )
+                rm_is_gpr = true;
+
+            /* A few other insns also encode a GPR in ModR/M.rm. */
+            switch ( opcode )
+            {
+            case X86EMUL_OPC_EVEX(0x0f, 0x92):      /* kmovw r,k */
+            case X86EMUL_OPC_EVEX_66(0x0f, 0x92):   /* kmovb r,k */
+            case X86EMUL_OPC_EVEX_F2(0x0f, 0x92):   /* kmov{d,q} r,k */
+
+            case X86EMUL_OPC_EVEX_F3(0x0f, 0x2a):   /* vcvtsi2ss */
+            case X86EMUL_OPC_EVEX_F2(0x0f, 0x2a):   /* vcvtsi2sd */
+            case X86EMUL_OPC_EVEX_F3(5, 0x2a):      /* vcvtsi2sh */
+
+            case X86EMUL_OPC_EVEX_F3(0x0f, 0x7b):   /* vcvtusi2ss */
+            case X86EMUL_OPC_EVEX_F2(0x0f, 0x7b):   /* vcvtusi2sd */
+            case X86EMUL_OPC_EVEX_F3(5, 0x7b):      /* vcvtusi2sh */
+
+            case X86EMUL_OPC_EVEX_66(0x0f, 0x6e):   /* vmov{d,q} r/m,xmm */
+            case X86EMUL_OPC_EVEX_66(5, 0x6e):      /* vmovw r/m16,xmm */
+
+            case X86EMUL_OPC_EVEX_66(0x0f, 0x7e):   /* vmov{d,q} xmm,r/m */
+            case X86EMUL_OPC_EVEX_66(5, 0x7e):      /* vmovw xmm,r/m16 */
+
+            case X86EMUL_OPC_EVEX_66(0x0f38, 0x7a): /* vpbroadcastb */
+            case X86EMUL_OPC_EVEX_66(0x0f38, 0x7b): /* vpbroadcastw */
+            case X86EMUL_OPC_EVEX_66(0x0f38, 0x7c): /* vpbroadcast{d,q} */
+
+            case X86EMUL_OPC_EVEX_66(0x0f3a, 0x14): /* vpextrb */
+            case X86EMUL_OPC_EVEX_66(0x0f3a, 0x15): /* vpextrw */
+            case X86EMUL_OPC_EVEX_66(0x0f3a, 0x16): /* vpextr{d,q} */
+            case X86EMUL_OPC_EVEX_66(0x0f3a, 0x17): /* vextractps */
+
+            case X86EMUL_OPC_EVEX_66(0x0f, 0xc4):   /* vpinsrw */
+            case X86EMUL_OPC_EVEX_66(0x0f3a, 0x20): /* vpinsrb */
+            case X86EMUL_OPC_EVEX_66(0x0f3a, 0x22): /* vpinsr{d,q} */
+                rm_is_gpr = true;
+                break;
+            }
+
             generate_exception_if(d & vSIB, X86_EXC_UD);
             s->modrm_rm |= ((s->rex_prefix & 1) << 3) |
-                           ((evex_encoded() ? !s->evex.x
-                                            : !!(s->rex2_prefix & REX_B)) << 
4);
+                           ((evex_encoded() && !rm_is_gpr
+                             ? !s->evex.x
+                             : !!(s->rex2_prefix & REX_B)) << 4);
             s->ea.type = OP_REG;
         }
         else if ( ad_bytes == 2 )
--- a/xen/arch/x86/x86_emulate/private.h
+++ b/xen/arch/x86/x86_emulate/private.h
@@ -202,7 +202,8 @@ enum vex_opcx {
     vex_0f,
     vex_0f38,
     vex_0f3a,
-    evex_map5 = 5,
+    evex_map4,
+    evex_map5,
     evex_map6,
     vex_map7,
 };
@@ -235,9 +236,9 @@ union evex {
     uint8_t raw[3];
     struct {             /* SDM names */
         uint8_t opcx:3;  /* mmm */
-        uint8_t mbz:1;
+        uint8_t b4:1;    /* B4 */
         uint8_t r4:1;    /* R4 (aka R') */
-        uint8_t b:1;     /* B */
+        uint8_t b3:1;    /* B3 (aka B) */
         uint8_t x:1;     /* X */
         uint8_t r3:1;    /* R3 (aka R) */
         uint8_t pfx:2;   /* pp */
@@ -260,6 +261,7 @@ struct x86_emulate_state {
         ext_0f   = vex_0f,
         ext_0f38 = vex_0f38,
         ext_0f3a = vex_0f3a,
+        ext_map4 = evex_map4,
         ext_map5 = evex_map5,
         ext_map6 = evex_map6,
         ext_map7 = vex_map7,
@@ -322,6 +324,7 @@ struct x86_emulate_state {
     bool not_64bit; /* Instruction not available in 64bit. */
     bool fpu_ctrl;  /* Instruction is an FPU control one. */
     bool fp16;      /* Instruction has half-precision FP or BF16 source. */
+    bool promoted_evex; /* From legacy/VEX, i.e. ND / NF / SCC capable. */
     opcode_desc_t desc;
     union vex vex;
     union evex evex;
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -3511,7 +3511,8 @@ x86_emulate(
         if ( ea.type == OP_MEM )
         {
             /* convert memory operand to (%rAX) */
-            evex.b = 1;
+            evex.b3 = 1;
+            evex.b4 = 0;
             opc[1] &= 0x38;
         }
         insn_bytes = EVEX_PFX_BYTES + 2;
@@ -3724,7 +3725,8 @@ x86_emulate(
         opc = init_evex(stub);
         opc[0] = b;
         /* Convert memory/GPR source to %rAX. */
-        evex.b = 1;
+        evex.b3 = 1;
+        evex.b4 = 0;
         if ( !mode_64bit() )
             evex.w = 0;
         /*
@@ -3780,7 +3782,8 @@ x86_emulate(
         {
             rex_prefix &= ~REX_B;
             vex.b = 1;
-            evex.b = 1;
+            evex.b3 = 1;
+            evex.b4 = 0;
             opc[1] = 0x01;
 
             rc = ops->read(ea.mem.seg, ea.mem.off, mmvalp,
@@ -3869,7 +3872,8 @@ x86_emulate(
             /* Convert memory operand to (%rAX). */
             rex_prefix &= ~REX_B;
             vex.b = 1;
-            evex.b = 1;
+            evex.b3 = 1;
+            evex.b4 = 0;
             opc[1] &= 0x38;
         }
         if ( evex_encoded() )
@@ -4560,7 +4564,8 @@ x86_emulate(
         opc = init_evex(stub);
         opc[0] = b;
         /* Convert memory/GPR operand to (%rAX). */
-        evex.b = 1;
+        evex.b3 = 1;
+        evex.b4 = 0;
         if ( !mode_64bit() )
             evex.w = 0;
         opc[1] = modrm & 0x38;
@@ -5464,7 +5469,8 @@ x86_emulate(
         if ( ea.type == OP_MEM )
         {
             /* convert memory operand to (%rAX) */
-            evex.b = 1;
+            evex.b3 = 1;
+            evex.b4 = 0;
             opc[1] &= 0x38;
         }
         opc[2] = imm1;
@@ -6410,7 +6416,8 @@ x86_emulate(
         opc = init_evex(stub);
         opc[0] = b;
         /* Convert GPR source to %rAX. */
-        evex.b = 1;
+        evex.b3 = 1;
+        evex.b4 = 0;
         if ( !mode_64bit() )
             evex.w = 0;
         opc[1] = modrm & 0xf8;
@@ -6647,7 +6654,8 @@ x86_emulate(
          */
         pevex->opmsk = 0;
         /* Use (%rax) as destination and modrm_reg as source. */
-        pevex->b = 1;
+        pevex->b3 = 1;
+        pevex->b4 = 0;
         opc[1] = (modrm_reg & 7) << 3;
         pevex->RX = 1;
         place_ret(&opc[2]);
@@ -6712,7 +6720,8 @@ x86_emulate(
         opc[0] = 0x6f; /* vmovdqa{32,64} */
         pevex->opmsk = 0;
         /* Use modrm_reg as destination and (%rax) as source. */
-        pevex->b = 1;
+        pevex->b3 = 1;
+        pevex->b4 = 0;
         opc[1] = (modrm_reg & 7) << 3;
         pevex->RX = 1;
         place_ret(&opc[2]);
@@ -6802,7 +6811,8 @@ x86_emulate(
         pevex->opcx = vex_0f;
         opc[0] = 0x7f; /* vmovdqa{32,64} */
         /* Use (%rax) as destination and modrm_reg as source. */
-        pevex->b = 1;
+        pevex->b3 = 1;
+        pevex->b4 = 0;
         opc[1] = (modrm_reg & 7) << 3;
         pevex->RX = 1;
         place_ret(&opc[2]);
@@ -7468,7 +7478,9 @@ x86_emulate(
         opc[0] = b;
         /* Convert memory/GPR operand to (%rAX). */
         rex_prefix &= ~REX_B;
-        evex.b = vex.b = 1;
+        vex.b = 1;
+        evex.b3 = 1;
+        evex.b4 = 0;
         if ( !mode_64bit() )
             evex.w = vex.w = 0;
         opc[1] = modrm & 0x38;
@@ -7516,7 +7528,7 @@ x86_emulate(
         evex.opcx = ext_0f3a;
         b = 0x15;
         modrm <<= 3;
-        evex.r3 = evex.b;
+        evex.r3 = evex.b3;
         evex.r4 = evex.x;
         /* fall through */
     case X86EMUL_OPC_EVEX_66(0x0f3a, 0x14): /* vpextrb $imm8,xmm,r/m */
@@ -7600,7 +7612,8 @@ x86_emulate(
         {
             /* Convert memory operand to (%rAX). */
             vex.b = 1;
-            evex.b = 1;
+            evex.b3 = 1;
+            evex.b4 = 0;
             opc[1] &= 0x38;
         }
         opc[2] = imm1;