diff options
| author | Paolo Bonzini | 2022-11-30 15:16:57 +0100 |
|---|---|---|
| committer | Paolo Bonzini | 2022-12-01 09:05:05 +0100 |
| commit | 38e65936a8df1c9e7f5d19eae38a42133fab844b (patch) | |
| tree | ad40919079514fdb618aefdb08bb0a03da0bf8cf | |
| parent | Update VERSION for v7.2.0-rc2 (diff) | |
| download | qemu-38e65936a8df1c9e7f5d19eae38a42133fab844b.tar.gz qemu-38e65936a8df1c9e7f5d19eae38a42133fab844b.tar.xz qemu-38e65936a8df1c9e7f5d19eae38a42133fab844b.zip | |
target/i386: allow MMX instructions with CR4.OSFXSR=0
MMX state is saved/restored by FSAVE/FRSTOR so the instructions are
not illegal opcodes even if CR4.OSFXSR=0. Make sure that validate_vex
takes into account the prefix and only checks HF_OSFXSR_MASK in the
presence of an SSE instruction.
Fixes: 20581aadec5e ("target/i386: validate VEX prefixes via the instructions' exception classes", 2022-10-18)
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1350
Reported-by: Helge Konetzka (@hejko on gitlab.com)
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| -rw-r--r-- | target/i386/tcg/decode-new.c.inc | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc index e4878b967f..80c579164f 100644 --- a/target/i386/tcg/decode-new.c.inc +++ b/target/i386/tcg/decode-new.c.inc @@ -1488,7 +1488,8 @@ static bool validate_vex(DisasContext *s, X86DecodedInsn *decode) if (!(s->flags & HF_AVX_EN_MASK)) { goto illegal; } - } else { + } else if (e->special != X86_SPECIAL_MMX || + (s->prefix & (PREFIX_REPZ | PREFIX_REPNZ | PREFIX_DATA))) { if (!(s->flags & HF_OSFXSR_MASK)) { goto illegal; } |