target/i386: Fix decoding of 0xC6/0xC7 (group 11) instructions - #2361
Open
unknown-1-0 wants to merge 1 commit into
Open
target/i386: Fix decoding of 0xC6/0xC7 (group 11) instructions#2361unknown-1-0 wants to merge 1 commit into
unknown-1-0 wants to merge 1 commit into
Conversation
unknown-1-0
force-pushed
the
i386-fix-group-11-decoding
branch
2 times, most recently
from
July 7, 2026 13:21
9ba7ee0 to
7314158
Compare
unknown-1-0
force-pushed
the
i386-fix-group-11-decoding
branch
2 times, most recently
from
July 17, 2026 13:39
e3973bc to
1493f07
Compare
Author
|
Updated the tests and the commit message, fixed a typo in one of test names |
According to both table A-6 in Volume 2 of Intel 64 and IA-32 Architectures Software Developer's Manual and table A-6 in Volume 3 of AMD64 Architecture Programmer's Manual, group 11 instructions are decoded as MOV only if ModRM.reg == 0. Although Unicorn checks for that, it handles some things incorrectly: - In register-only operand form (ModRM.mod == 3), decoding of MOV instruction also succeeds if ModRM.reg == 7. However, according to table A-6 in Volume 2 of Intel SDM, this should encode XBEGIN/XABORT, not MOV! - Before the check, ModRM.reg field is ORed with the value of REX.R << 3, leading to an invalid opcode (#UD) exception if REX.R bit is actually set. Real Intel hardware seems to ignore the REX.R bit with group 11 instructions. This commit fixes both issues. Signed-off-by: Andrey Polivoda <apolivodaa433@gmail.com>
unknown-1-0
force-pushed
the
i386-fix-group-11-decoding
branch
from
July 22, 2026 16:21
1493f07 to
07c5a7f
Compare
Author
|
Force-pushed to sign the commit |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
According to both table A-6 in Volume 2 of Intel 64 and IA-32 Architectures Software Developer's Manual and table A-6 in Volume 3 of AMD64 Architecture Programmer's Manual, group 11 instructions are decoded as MOV only if ModRM.reg == 0.
Although Unicorn checks for that, it handles some things incorrectly:
This commit fixes both issues.