Re: [PATCH] KVM: x86: Swap the dst and src operand for MOVNTDQA

[Sean Christopherson]

On Wed, May 06, 2026, Sean Christopherson wrote:
> Swap the MOVNTDQA operands, as MOVNTDQA does NOT in fact have "the same
> characteristics as 0F E7 (MOVNTDQ)"; MOVNTDQA loads from memory and stores
> to registers, while MOVNTDQ loads from registers and stores to memory.
> 
> Per the SDM:
> 
>  MOVNTDQ - Move packed integer values in xmm1 to m128 using non-temporal
>            hint.
> 
>  MOVNTDQA - Move double quadword from m128 to xmm1 using non-temporal hint
>             if WC memory type.
> 
> Reported-by: Josh Eads <josheads@xxxxxxxxxx>
> Fixes: c57d9bafbd0b ("KVM: x86: Add support for emulating MOVNTDQA")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
> ---
> 
> I have updates to the xsave KUT test to verify the bug and the fix.
> 
>  arch/x86/kvm/emulate.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> index c8c6cc0406d6..0bb832a76868 100644
> --- a/arch/x86/kvm/emulate.c
> +++ b/arch/x86/kvm/emulate.c
> @@ -4450,7 +4450,7 @@ static const struct opcode twobyte_table[256] = {
>  	/* 0xD0 - 0xDF */
>  	N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
>  	/* 0xE0 - 0xEF */
> -	N, N, N, N, N, N, N, GP(SrcReg | DstMem | ModRM | Mov, &pfx_0f_e7_0f_38_2a),
> +	N, N, N, N, N, N, N, GP(SrcMem | DstReg | ModRM | Mov, &pfx_0f_e7_0f_38_2a),

Aaaaand Josh pointed out that I wasn't paying attention and stomped all over MOVNTDQ.
I'll figure out why my KUT changes didn't detect this, and send a v2.

>  	N, N, N, N, N, N, N, N,
>  	/* 0xF0 - 0xFF */
>  	N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N
> @@ -4481,7 +4481,7 @@ static const struct opcode opcode_map_0f_38[256] = {
>  	X16(N), X16(N),
>  	/* 0x20 - 0x2f */
>  	X8(N),
> -	X2(N), GP(SrcReg | DstMem | ModRM | Mov | Aligned, &pfx_0f_e7_0f_38_2a), N, N, N, N, N,
> +	X2(N), GP(SrcMem | DstReg | ModRM | Mov | Aligned, &pfx_0f_e7_0f_38_2a), N, N, N, N, N,
>  	/* 0x30 - 0x7f */
>  	X16(N), X16(N), X16(N), X16(N), X16(N),
>  	/* 0x80 - 0xef */
> 
> base-commit: 6d35786de28116ecf78797a62b84e6bf3c45aa5a
> -- 
> 2.54.0.545.g6539524ca2-goog
>