[PR #58] i386: fix 0x66 pfx in disassembler and translator #104

Open
opened 2026-01-31 21:29:47 +00:00 by claunia · 0 comments
Owner

Original Pull Request: https://github.com/qemu/qemu/pull/58

State: closed
Merged: No


The opcodes 0xe8 (call) and 0xe9 (jump), when prefixed by 0x66, do not
use a 16 bit offset, but still 32 bits, just like conditional relative
jumps. To distinguish between conditional jumps and the unconditional
call/jump add a new call_jump_mode and a call_jump_flag. This prerevents
data size changes for both, call_jump_mode and cond_jump_mode when using
the Intel syntax.

In the translator respect data size changes only, if the CPU is not
and Intel type. Otherwise the size of the call/jmp is always 32 bits.

See https://github.com/xoreaxeaxeax/sandsifter/blob/master/references/domas_breaking_the_x86_isa_wp.pdf
for the details and reasoning.

Signed-off-by: Jürgen Buchmüller pullmoll@t-online.de

**Original Pull Request:** https://github.com/qemu/qemu/pull/58 **State:** closed **Merged:** No --- The opcodes 0xe8 (call) and 0xe9 (jump), when prefixed by 0x66, do not use a 16 bit offset, but still 32 bits, just like conditional relative jumps. To distinguish between conditional jumps and the unconditional call/jump add a new call_jump_mode and a call_jump_flag. This prerevents data size changes for both, call_jump_mode and cond_jump_mode when using the Intel syntax. In the translator respect data size changes only, if the CPU is not and Intel type. Otherwise the size of the call/jmp is always 32 bits. See https://github.com/xoreaxeaxeax/sandsifter/blob/master/references/domas_breaking_the_x86_isa_wp.pdf for the details and reasoning. Signed-off-by: Jürgen Buchmüller <pullmoll@t-online.de>
claunia added the pull-request label 2026-01-31 21:29:47 +00:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/qemu#104