diff options
| author | Ziqiao Kong <ziqiaokong@gmail.com> | 2024-02-15 17:50:17 +0800 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2024-02-16 13:56:09 +0100 |
| commit | 99d0dcd7f102c07a510200d768cae65e5db25d23 (patch) | |
| tree | 139f0acec6be20e604ed12b64a5c3474b7b6cba2 | |
| parent | d8c7f1334fa4cb3a99de7cb664095902c5fc6605 (diff) | |
| download | focaccia-qemu-99d0dcd7f102c07a510200d768cae65e5db25d23.tar.gz focaccia-qemu-99d0dcd7f102c07a510200d768cae65e5db25d23.zip | |
target/i386: Generate an illegal opcode exception on cmp instructions with lock prefix
target/i386: As specified by Intel Manual Vol2 3-180, cmp instructions are not allowed to have lock prefix and a `UD` should be raised. Without this patch, s1->T0 will be uninitialized and used in the case OP_CMPL. Signed-off-by: Ziqiao Kong <ziqiaokong@gmail.com> Message-ID: <20240215095015.570748-2-ziqiaokong@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| -rw-r--r-- | target/i386/tcg/translate.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c index 10cba16256..07f642dc9e 100644 --- a/target/i386/tcg/translate.c +++ b/target/i386/tcg/translate.c @@ -1507,12 +1507,13 @@ static bool check_iopl(DisasContext *s) /* if d == OR_TMP0, it means memory operand (address in A0) */ static void gen_op(DisasContext *s1, int op, MemOp ot, int d) { + /* Invalid lock prefix when destination is not memory or OP_CMPL. */ + if ((d != OR_TMP0 || op == OP_CMPL) && s1->prefix & PREFIX_LOCK) { + gen_illegal_opcode(s1); + return; + } + if (d != OR_TMP0) { - if (s1->prefix & PREFIX_LOCK) { - /* Lock prefix when destination is not memory. */ - gen_illegal_opcode(s1); - return; - } gen_op_mov_v_reg(s1, ot, s1->T0, d); } else if (!(s1->prefix & PREFIX_LOCK)) { gen_op_ld_v(s1, ot, s1->T0, s1->A0); |