diff options
| author | Ziqiao Kong <ziqiaokong@gmail.com> | 2024-02-15 17:50:17 +0800 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2024-02-20 18:44:21 +0300 |
| commit | 0b30735d3807640587c2bc9b19ab274e0f8eef57 (patch) | |
| tree | 1c6ca25440fb4e07a94ac554b03ca81c76a918d1 | |
| parent | f5dddb856cccdc491547235aeafb451acd63c8b1 (diff) | |
| download | qemu-0b30735d3807640587c2bc9b19ab274e0f8eef57.zip qemu-0b30735d3807640587c2bc9b19ab274e0f8eef57.tar.gz qemu-0b30735d3807640587c2bc9b19ab274e0f8eef57.tar.bz2 | |
target/i386: Generate an illegal opcode exception on cmp instructions with lock prefix
target/i386: As specified by Intel Manual Vol2 3-180, cmp instructions
are not allowed to have lock prefix and a `UD` should be raised. Without
this patch, s1->T0 will be uninitialized and used in the case OP_CMPL.
Signed-off-by: Ziqiao Kong <ziqiaokong@gmail.com>
Message-ID: <20240215095015.570748-2-ziqiaokong@gmail.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 99d0dcd7f102c07a510200d768cae65e5db25d23)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | target/i386/tcg/translate.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c index 8fd49ff..83c2b40 100644 --- a/target/i386/tcg/translate.c +++ b/target/i386/tcg/translate.c @@ -1480,12 +1480,13 @@ static bool check_iopl(DisasContext *s) /* if d == OR_TMP0, it means memory operand (address in A0) */ static void gen_op(DisasContext *s1, int op, MemOp ot, int d) { + /* Invalid lock prefix when destination is not memory or OP_CMPL. */ + if ((d != OR_TMP0 || op == OP_CMPL) && s1->prefix & PREFIX_LOCK) { + gen_illegal_opcode(s1); + return; + } + if (d != OR_TMP0) { - if (s1->prefix & PREFIX_LOCK) { - /* Lock prefix when destination is not memory. */ - gen_illegal_opcode(s1); - return; - } gen_op_mov_v_reg(s1, ot, s1->T0, d); } else if (!(s1->prefix & PREFIX_LOCK)) { gen_op_ld_v(s1, ot, s1->T0, s1->A0); |