From: Ziqiao Kong <ziqiaokong@gmail.com>
target/i386: As specified by Intel Manual Vol2 3-180, cmp instructions
are not allowed to have lock prefix and a `UD` should be raised. Without
this patch, s1->T0 will be uninitialized and used in the case OP_CMPL.
Signed-off-by: Ziqiao Kong <ziqiaokong@gmail.com>
Message-ID: <20240215095015.570748-2-ziqiaokong@gmail.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 99d0dcd7f102c07a510200d768cae65e5db25d23)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 68c42fd9ff..abacb91ddf 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -1501,12 +1501,13 @@ static bool check_iopl(DisasContext *s)
/* if d == OR_TMP0, it means memory operand (address in A0) */
static void gen_op(DisasContext *s1, int op, MemOp ot, int d)
{
+ /* Invalid lock prefix when destination is not memory or OP_CMPL. */
+ if ((d != OR_TMP0 || op == OP_CMPL) && s1->prefix & PREFIX_LOCK) {
+ gen_illegal_opcode(s1);
+ return;
+ }
+
if (d != OR_TMP0) {
- if (s1->prefix & PREFIX_LOCK) {
- /* Lock prefix when destination is not memory. */
- gen_illegal_opcode(s1);
- return;
- }
gen_op_mov_v_reg(s1, ot, s1->T0, d);
} else if (!(s1->prefix & PREFIX_LOCK)) {
gen_op_ld_v(s1, ot, s1->T0, s1->A0);
--
2.39.2