Re: [PATCH v8 11/20] KVM: x86: Handle EGPR index and REX2-incompatible opcodes

["Chang S. Bae" <chang.seok.bae@intel.com>]

On 9/30/2026 2:47 PM, sashiko-bot@kernel.org wrote:
> 
> Should these string instructions (ins/outs) include the NoRex2 flag?
...
> Does pushf also need the NoRex2 flag ...
...
 > Since x87 FPU instructions do not support REX2 prefixes, should they
 > have the NoRex2 flag here to ensure they raise #UD?
...
 > Does hlt need the NoRex2 flag since it takes no operands?
...
>> @@ -5001,6 +5012,13 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len, int
>>   		opcode = opcode_table[ctxt->b];
>>   	}
>>   
>> +	/*
>> +	 * Instructions marked with NoRex2 ignore a legacy REX prefix, but #UD
>> +	 * should be raised when prefixed with REX2.
>> +	 */
>> +	if (opcode.flags & NoRex2 && ctxt->rex_prefix == REX2_PREFIX)
>> +		opcode.flags = Undefined;
>> +
> 
> [Severity: High]
> Does evaluating opcode.flags & NoRex2 here occur too early?
> 
> Since this check precedes the while (ctxt->d & GroupMask) loop that
> expands opcode groups, will nested group instructions (like monitor,
> mwait, or vmcall) bypass this check and fail to raise #UD when given
> a REX2 prefix?

The byte following a REX2 prefix is interpreted as the opcode. The 
emulator then handles it as a legacy instruction, including raising #UD 
where required, rather than suppressing #UD merely because of being 
REX2-prefixed.

The flag intentionally marks the reserved opcode ranges defined by the 
specification:

   * Legacy map 0: rows 0x4*, 0x7*, 0xA*, 0xE*
   * Legacy map 1: rows 0x3*, 0x8*

This was also pointed out in the previouss discussion:
https://lore.kernel.org/kvm/6bdc1a64-0304-4845-a36c-5f309b0b40e0@intel.com/

Thanks,
Chang