From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1J4br1-0008NK-SN
	for qemu-devel@nongnu.org; Tue, 18 Dec 2007 07:47:23 -0500
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1J4bqy-0008GJ-1b
	for qemu-devel@nongnu.org; Tue, 18 Dec 2007 07:47:23 -0500
Received: from [199.232.76.173] (helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1J4bqx-0008G4-Tg
	for qemu-devel@nongnu.org; Tue, 18 Dec 2007 07:47:19 -0500
Received: from os.inf.tu-dresden.de ([141.76.48.99])
	by monty-python.gnu.org with esmtps
	(TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60)
	(envelope-from <kauer@os.inf.tu-dresden.de>) id 1J4bqx-0003I9-Jw
	for qemu-devel@nongnu.org; Tue, 18 Dec 2007 07:47:19 -0500
Received: from erwin.inf.tu-dresden.de ([141.76.48.80]
	helo=chrom.inf.tu-dresden.de)
	by os.inf.tu-dresden.de with esmtps (TLSv1:AES256-SHA:256) (Exim 4.68)
	id 1J4bqu-00052M-Ni
	for qemu-devel@nongnu.org; Tue, 18 Dec 2007 13:47:16 +0100
Received: from kauer by chrom.inf.tu-dresden.de with local (Exim 4.68)
	(envelope-from <kauer@chrom.inf.tu-dresden.de>) id 1J4bXc-0002oe-Oi
	for qemu-devel@nongnu.org; Tue, 18 Dec 2007 13:27:20 +0100
Date: Tue, 18 Dec 2007 13:27:20 +0100
From: Bernhard Kauer <kauer@os.inf.tu-dresden.de>
Message-ID: <20071218122720.GA3301@chrom.inf.tu-dresden.de>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="TB36FDmn/VVEgNH/"
Content-Disposition: inline
Subject: [Qemu-devel] [PATCH] fix cmpxchg8b translation
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org


--TB36FDmn/VVEgNH/
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

The cmpxchg8b opcode is only valid if the nnn bits
in the mod/rm byte are 001, otherwise an #UD should
be generated. The attached patch fixes this.


	Bernhard Kauer

--TB36FDmn/VVEgNH/
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename="qemu_vmptrld.diff"

Index: target-i386/translate.c
--- target-i386/translate.c	8 Nov 2007 14:25:03 -0000	1.74
+++ target-i386/translate.c	18 Dec 2007 12:14:08 -0000
@@ -3887,7 +3887,7 @@
     case 0x1c7: /* cmpxchg8b */
         modrm = ldub_code(s->pc++);
         mod = (modrm >> 6) & 3;
-        if (mod == 3)
+        if ((mod == 3) || ((modrm & 0x38) != 0x8))
             goto illegal_op;
         gen_jmp_im(pc_start - s->cs_base);
         if (s->cc_op != CC_OP_DYNAMIC)

--TB36FDmn/VVEgNH/--