212 lines
8.2 KiB
Diff
212 lines
8.2 KiB
Diff
diff --git a/VEX/priv/guest_amd64_toIR.c b/VEX/priv/guest_amd64_toIR.c
|
|
index 40da6bf..fba7084 100644
|
|
--- a/VEX/priv/guest_amd64_toIR.c
|
|
+++ b/VEX/priv/guest_amd64_toIR.c
|
|
@@ -767,10 +767,10 @@ static Bool have66orF2orF3 ( Prefix pfx )
|
|
return toBool( ! haveNo66noF2noF3(pfx) );
|
|
}
|
|
|
|
-/* Return True iff pfx has 66 or F2 set */
|
|
-static Bool have66orF2 ( Prefix pfx )
|
|
+/* Return True iff pfx has 66 or F3 set */
|
|
+static Bool have66orF3 ( Prefix pfx )
|
|
{
|
|
- return toBool((pfx & (PFX_66|PFX_F2)) > 0);
|
|
+ return toBool((pfx & (PFX_66|PFX_F3)) > 0);
|
|
}
|
|
|
|
/* Clear all the segment-override bits in a prefix. */
|
|
@@ -4266,8 +4266,12 @@ ULong dis_Grp5 ( VexAbiInfo* vbi,
|
|
|
|
modrm = getUChar(delta);
|
|
if (epartIsReg(modrm)) {
|
|
- /* F2/XACQ and F3/XREL are always invalid in the non-mem case. */
|
|
- if (haveF2orF3(pfx)) goto unhandledR;
|
|
+ /* F2/XACQ and F3/XREL are always invalid in the non-mem case.
|
|
+ F2/CALL and F2/JMP may have bnd prefix. */
|
|
+ if (haveF2orF3(pfx)
|
|
+ && ! (haveF2(pfx)
|
|
+ && (gregLO3ofRM(modrm) == 2 || gregLO3ofRM(modrm) == 4)))
|
|
+ goto unhandledR;
|
|
assign(t1, getIRegE(sz,pfx,modrm));
|
|
switch (gregLO3ofRM(modrm)) {
|
|
case 0: /* INC */
|
|
@@ -4287,6 +4291,7 @@ ULong dis_Grp5 ( VexAbiInfo* vbi,
|
|
case 2: /* call Ev */
|
|
/* Ignore any sz value and operate as if sz==8. */
|
|
if (!(sz == 4 || sz == 8)) goto unhandledR;
|
|
+ if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */
|
|
sz = 8;
|
|
t3 = newTemp(Ity_I64);
|
|
assign(t3, getIRegE(sz,pfx,modrm));
|
|
@@ -4302,6 +4307,7 @@ ULong dis_Grp5 ( VexAbiInfo* vbi,
|
|
case 4: /* jmp Ev */
|
|
/* Ignore any sz value and operate as if sz==8. */
|
|
if (!(sz == 4 || sz == 8)) goto unhandledR;
|
|
+ if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */
|
|
sz = 8;
|
|
t3 = newTemp(Ity_I64);
|
|
assign(t3, getIRegE(sz,pfx,modrm));
|
|
@@ -4334,11 +4340,14 @@ ULong dis_Grp5 ( VexAbiInfo* vbi,
|
|
showSz ? nameISize(sz) : ' ',
|
|
nameIRegE(sz, pfx, modrm));
|
|
} else {
|
|
- /* Decide if F2/XACQ or F3/XREL might be valid. */
|
|
+ /* Decide if F2/XACQ, F3/XREL, F2/CALL or F2/JMP might be valid. */
|
|
Bool validF2orF3 = haveF2orF3(pfx) ? False : True;
|
|
if ((gregLO3ofRM(modrm) == 0/*INC*/ || gregLO3ofRM(modrm) == 1/*DEC*/)
|
|
&& haveF2orF3(pfx) && !haveF2andF3(pfx) && haveLOCK(pfx)) {
|
|
validF2orF3 = True;
|
|
+ } else if ((gregLO3ofRM(modrm) == 2 || gregLO3ofRM(modrm) == 4)
|
|
+ && (haveF2(pfx) && !haveF3(pfx))) {
|
|
+ validF2orF3 = True;
|
|
}
|
|
if (!validF2orF3) goto unhandledM;
|
|
/* */
|
|
@@ -4375,6 +4384,7 @@ ULong dis_Grp5 ( VexAbiInfo* vbi,
|
|
case 2: /* call Ev */
|
|
/* Ignore any sz value and operate as if sz==8. */
|
|
if (!(sz == 4 || sz == 8)) goto unhandledM;
|
|
+ if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */
|
|
sz = 8;
|
|
t3 = newTemp(Ity_I64);
|
|
assign(t3, loadLE(Ity_I64,mkexpr(addr)));
|
|
@@ -4390,6 +4400,7 @@ ULong dis_Grp5 ( VexAbiInfo* vbi,
|
|
case 4: /* JMP Ev */
|
|
/* Ignore any sz value and operate as if sz==8. */
|
|
if (!(sz == 4 || sz == 8)) goto unhandledM;
|
|
+ if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */
|
|
sz = 8;
|
|
t3 = newTemp(Ity_I64);
|
|
assign(t3, loadLE(Ity_I64,mkexpr(addr)));
|
|
@@ -19716,7 +19727,8 @@ Long dis_ESC_NONE (
|
|
case 0x7F: { /* JGb/JNLEb (jump greater) */
|
|
Long jmpDelta;
|
|
const HChar* comment = "";
|
|
- if (haveF2orF3(pfx)) goto decode_failure;
|
|
+ if (haveF3(pfx)) goto decode_failure;
|
|
+ if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */
|
|
jmpDelta = getSDisp8(delta);
|
|
vassert(-128 <= jmpDelta && jmpDelta < 128);
|
|
d64 = (guest_RIP_bbstart+delta+1) + jmpDelta;
|
|
@@ -20369,7 +20381,8 @@ Long dis_ESC_NONE (
|
|
}
|
|
|
|
case 0xC2: /* RET imm16 */
|
|
- if (have66orF2orF3(pfx)) goto decode_failure;
|
|
+ if (have66orF3(pfx)) goto decode_failure;
|
|
+ if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */
|
|
d64 = getUDisp16(delta);
|
|
delta += 2;
|
|
dis_ret(dres, vbi, d64);
|
|
@@ -20377,8 +20390,9 @@ Long dis_ESC_NONE (
|
|
return delta;
|
|
|
|
case 0xC3: /* RET */
|
|
- if (have66orF2(pfx)) goto decode_failure;
|
|
+ if (have66(pfx)) goto decode_failure;
|
|
/* F3 is acceptable on AMD. */
|
|
+ if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */
|
|
dis_ret(dres, vbi, 0);
|
|
DIP(haveF3(pfx) ? "rep ; ret\n" : "ret\n");
|
|
return delta;
|
|
@@ -20782,7 +20796,8 @@ Long dis_ESC_NONE (
|
|
}
|
|
|
|
case 0xE8: /* CALL J4 */
|
|
- if (haveF2orF3(pfx)) goto decode_failure;
|
|
+ if (haveF3(pfx)) goto decode_failure;
|
|
+ if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */
|
|
d64 = getSDisp32(delta); delta += 4;
|
|
d64 += (guest_RIP_bbstart+delta);
|
|
/* (guest_RIP_bbstart+delta) == return-to addr, d64 == call-to addr */
|
|
@@ -20805,9 +20820,10 @@ Long dis_ESC_NONE (
|
|
return delta;
|
|
|
|
case 0xE9: /* Jv (jump, 16/32 offset) */
|
|
- if (haveF2orF3(pfx)) goto decode_failure;
|
|
+ if (haveF3(pfx)) goto decode_failure;
|
|
if (sz != 4)
|
|
goto decode_failure; /* JRS added 2004 July 11 */
|
|
+ if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */
|
|
d64 = (guest_RIP_bbstart+delta+sz) + getSDisp(sz,delta);
|
|
delta += sz;
|
|
if (resteerOkFn(callback_opaque,d64)) {
|
|
@@ -21241,7 +21257,8 @@ Long dis_ESC_0F (
|
|
case 0x8F: { /* JGb/JNLEb (jump greater) */
|
|
Long jmpDelta;
|
|
const HChar* comment = "";
|
|
- if (haveF2orF3(pfx)) goto decode_failure;
|
|
+ if (haveF3(pfx)) goto decode_failure;
|
|
+ if (haveF2(pfx)) DIP("bnd ; "); /* MPX bnd prefix. */
|
|
jmpDelta = getSDisp32(delta);
|
|
d64 = (guest_RIP_bbstart+delta+4) + jmpDelta;
|
|
delta += 4;
|
|
@@ -21332,6 +21349,66 @@ Long dis_ESC_0F (
|
|
}
|
|
return delta;
|
|
|
|
+ case 0x1A:
|
|
+ case 0x1B: { /* Future MPX instructions, currently NOPs.
|
|
+ BNDMK b, m F3 0F 1B
|
|
+ BNDCL b, r/m F3 0F 1A
|
|
+ BNDCU b, r/m F2 0F 1A
|
|
+ BNDCN b, r/m F2 0F 1B
|
|
+ BNDMOV b, b/m 66 0F 1A
|
|
+ BNDMOV b/m, b 66 0F 1B
|
|
+ BNDLDX b, mib 0F 1A
|
|
+ BNDSTX mib, b 0F 1B */
|
|
+
|
|
+ /* All instructions have two operands. One operand is always the
|
|
+ bnd register number (bnd0-bnd3, other register numbers are
|
|
+ ignored when MPX isn't enabled, but should generate an
|
|
+ exeception if MPX is enabled) given by gregOfRexRM. The other
|
|
+ operand is either a ModRM:reg, ModRM:r/m or a SIB encoded
|
|
+ address, all of which can be decoded by using either
|
|
+ eregOfRexRM or disAMode. */
|
|
+
|
|
+ modrm = getUChar(delta);
|
|
+ int bnd = gregOfRexRM(pfx,modrm);
|
|
+ const HChar *oper;
|
|
+ if (epartIsReg(modrm)) {
|
|
+ oper = nameIReg64 (eregOfRexRM(pfx,modrm));
|
|
+ delta += 1;
|
|
+ } else {
|
|
+ addr = disAMode ( &alen, vbi, pfx, delta, dis_buf, 0 );
|
|
+ delta += alen;
|
|
+ oper = dis_buf;
|
|
+ }
|
|
+
|
|
+ if (haveF3no66noF2 (pfx)) {
|
|
+ if (opc == 0x1B) {
|
|
+ DIP ("bndmk %s, %%bnd%d\n", oper, bnd);
|
|
+ } else /* opc == 0x1A */ {
|
|
+ DIP ("bndcl %s, %%bnd%d\n", oper, bnd);
|
|
+ }
|
|
+ } else if (haveF2no66noF3 (pfx)) {
|
|
+ if (opc == 0x1A) {
|
|
+ DIP ("bndcu %s, %%bnd%d\n", oper, bnd);
|
|
+ } else /* opc == 0x1B */ {
|
|
+ DIP ("bndcn %s, %%bnd%d\n", oper, bnd);
|
|
+ }
|
|
+ } else if (have66noF2noF3 (pfx)) {
|
|
+ if (opc == 0x1A) {
|
|
+ DIP ("bndmov %s, %%bnd%d\n", oper, bnd);
|
|
+ } else /* opc == 0x1B */ {
|
|
+ DIP ("bndmov %%bnd%d, %s\n", bnd, oper);
|
|
+ }
|
|
+ } else if (haveNo66noF2noF3 (pfx)) {
|
|
+ if (opc == 0x1A) {
|
|
+ DIP ("bndldx %s, %%bnd%d\n", oper, bnd);
|
|
+ } else /* opc == 0x1B */ {
|
|
+ DIP ("bndstx %%bnd%d, %s\n", bnd, oper);
|
|
+ }
|
|
+ } else goto decode_failure;
|
|
+
|
|
+ return delta;
|
|
+ }
|
|
+
|
|
case 0xA2: { /* CPUID */
|
|
/* Uses dirty helper:
|
|
void amd64g_dirtyhelper_CPUID ( VexGuestAMD64State* )
|