target/i386/tcg: fix decoding of MOVBE and CRC32 in 16-bit mode

Table A-4 of the SDM shows F0 F1 -------------------------------------------------------- NP MOVBE Gy,My MOVBE My,Gy 66 MOVBE Gw,Mw MOVBW Mw,Gw F2 CRC32 Gd,Eb CRC32 Gd,Ey 66+F2 CRC32 Gd,Eb CRC32 Gd,Ew However, this is incorrect. Both MOVBE and (for 0xF1) CRC32 take Gv, Ev or Mv operands. In 16-bit mode therefore the operand is of 16-bit size without prefix and 32-bit mode with 0x66 (the data size override). For example, with NASM you get: bits 16 67 0F 38 F0 02 movbe ax, [edx] 66 67 0F 38 F0 02 movbe eax, [edx] 67 F2 0F 38 F1 02 crc32 ax, word [edx] 66 67 F2 0F 38 F1 02 crc32 eax, dword [edx] versus bits 32 66 0F 38 F0 02 movbe ax, [edx] 0F 38 F0 02 movbe eax, [edx] 66 F2 0F 38 F1 02 crc32 eax, word [edx] F2 0F 38 F1 02 crc32 eax, dword [edx] The instruction is listed correctly in the APX documentation as "SCALABLE" (which means it has v-size operands). Cc: qemu-stable@nongnu.org Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>