From: Andrey Polivoda <[email protected]> According to both table A-3 in Volume 2 of Intel 64 and IA-32 Architectures Software Developer's Manual and table A-3 in Volume 3 of AMD64 Architecture Programmer's Manual, 0F C3 is decoded as MOVNTI only if the instruction is not preceded by prefixes 0x66, 0xF2, or 0xF3.
Currently, QEMU does not check the presence of these prefixes when decoding 0F C3, which leads to QEMU happily executing 0F C3 as MOVNTI instead of raising an expected #UD when any of these prefixes are present, which does not match the behavior of the real hardware. This patch fixes this bug by correcting the decode table for MOVNTI so that it requires that none of the 0x66, 0xF2, and 0xF3 prefixes is present. Cc: Paolo Bonzini <[email protected]> Cc: Richard Henderson <[email protected]> Fixes: 3519b813e1f1 ("target/i386: port extensions of one-byte opcodes to new decoder") Signed-off-by: Andrey Polivoda <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Paolo Bonzini <[email protected]> --- target/i386/tcg/decode-new.c.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc index 1f071f0a5f0..459452b04e3 100644 --- a/target/i386/tcg/decode-new.c.inc +++ b/target/i386/tcg/decode-new.c.inc @@ -1374,7 +1374,7 @@ static const X86OpEntry opcodes_0F[256] = { [0xc0] = X86_OP_ENTRY2(XADD, E,b, G,b, lock), [0xc1] = X86_OP_ENTRY2(XADD, E,v, G,v, lock), [0xc2] = X86_OP_ENTRY4(VCMP, V,x, H,x, W,x, vex2_rep3 p_00_66_f3_f2), - [0xc3] = X86_OP_ENTRY3(MOV, EM,y,G,y, None,None, cpuid(SSE2)), /* MOVNTI */ + [0xc3] = X86_OP_ENTRY3(MOV, EM,y,G,y, None,None, cpuid(SSE2) p_00), /* MOVNTI */ [0xc4] = X86_OP_ENTRY4(PINSRW, V,dq,H,dq,E,w, vex5 mmx p_00_66), [0xc5] = X86_OP_ENTRY3(PEXTRW, G,d, U,dq,I,b, vex5 mmx p_00_66), [0xc6] = X86_OP_ENTRY4(VSHUF, V,x, H,x, W,x, vex4 p_00_66), -- 2.55.0
