Skip to content

Gather/Scatter instructions can set RF #7897

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
khuey wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Gather/Scatter instructions can set RF #7897

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 24 additions & 24 deletions core/ir/x86/decode_table.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8034,17 +8034,17 @@ const instr_info_t vex_W_extensions[][2] = {
/* XXX: OP_v*gather* raise #UD if any pair of the index, mask, or destination
* registers are identical. We don't bother trying to detect that.
*/
{OP_vpgatherdd,0x66389018, catSIMD, "vpgatherdd",Vx,Hx,MVd,Hx,xx, mrm|vex|reqp,x,tevexwb[189][0]},
{OP_vpgatherdq,0x66389058, catSIMD, "vpgatherdq",Vx,Hx,MVq,Hx,xx, mrm|vex|reqp,x,tevexwb[189][2]},
{OP_vpgatherdd,0x66389018, catSIMD, "vpgatherdd",Vx,Hx,MVd,Hx,xx, mrm|vex|reqp,fWR,tevexwb[189][0]},

@derekbruening derekbruening May 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Question: Is RF written with 0 all the other times, or it's only written at all in this exception case and otherwise is not touched? If the latter: how do we represent that? I recall pretending it does a read in some such cases but am not remembering exactly when we did that; also not remembering all the details of things like instr_predicate_writes_eflags().

@khuey khuey May 13, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The processor sets RF to 0 after every successful instruction execution, so yes, 0 is written all other times.

I'm not entirely sure we want this the more I think about it. What's unique about this instruction is not that it sets RF (anything that triggers a page fault can do that), it's that it can "partially complete" and be interrupted. The repeating string instructions can do that too (and they also don't have fWR).

@derekbruening derekbruening May 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For the partially complete attribute: tools that themselves take action for each subpart of these instructions will be using drx_expand_scatter_gather() (just like they'd expand rep string instructions into explicit loops), so interruption in the middle will also interrupt the instrumentation in the middle.

For the flags: drreg and tools in general don't touch RF for normal instrumentation.

If setting RF seems more of a general mechanism with pending faults maybe like you said it's not worth marking here? OTOH it may not cause any harm to put it here since as noted most flag analyzers only look at the arithmetic flags or maybe DF.

I would be ok either way.

@derekbruening derekbruening May 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do these instructions need to set RF while rep string instructions don't?

@derekbruening derekbruening May 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do these instructions need to set RF while rep string instructions don't?

I.e., wouldn't a rep string fault where a pending trap/interrupt exists also want to deliver the trap/interrupt first and set RF?

@edeiana edeiana May 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I checked, and repeated string instructions do set RF.
From the Intel manual, Vol 3 (https://cdrdv2.intel.com/v1/dl/getContent/671447):

  • For any interrupt arriving after any iteration of a repeated string instruction but the last iteration, the value pushed for RF is 1.
  • For any trap-class exception generated by any iteration of a repeated string instruction but the last iteration, the value pushed for RF is 1.

So we should probably add fWR to OP_rep_ as well in decode_table.c?

@khuey khuey May 15, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, if I land this it should change the repeating string instructions too.

{OP_vpgatherdq,0x66389058, catSIMD, "vpgatherdq",Vx,Hx,MVq,Hx,xx, mrm|vex|reqp,fWR,tevexwb[189][2]},
}, { /* vex_W_ext 67 */
{OP_vpgatherqd,0x66389118, catSIMD, "vpgatherqd",Vx,Hx,MVd,Hx,xx, mrm|vex|reqp,x,tevexwb[190][0]},
{OP_vpgatherqq,0x66389158, catSIMD, "vpgatherqq",Vx,Hx,MVq,Hx,xx, mrm|vex|reqp,x,tevexwb[190][2]},
{OP_vpgatherqd,0x66389118, catSIMD, "vpgatherqd",Vx,Hx,MVd,Hx,xx, mrm|vex|reqp,fWR,tevexwb[190][0]},
{OP_vpgatherqq,0x66389158, catSIMD, "vpgatherqq",Vx,Hx,MVq,Hx,xx, mrm|vex|reqp,fWR,tevexwb[190][2]},
}, { /* vex_W_ext 68 */
{OP_vgatherdps,0x66389218, catSIMD, "vgatherdps",Vvs,Hx,MVd,Hx,xx, mrm|vex|reqp,x,tevexwb[191][0]},
{OP_vgatherdpd,0x66389258, catSIMD, "vgatherdpd",Vvd,Hx,MVq,Hx,xx, mrm|vex|reqp,x,tevexwb[191][2]},
{OP_vgatherdps,0x66389218, catSIMD, "vgatherdps",Vvs,Hx,MVd,Hx,xx, mrm|vex|reqp,fWR,tevexwb[191][0]},
{OP_vgatherdpd,0x66389258, catSIMD, "vgatherdpd",Vvd,Hx,MVq,Hx,xx, mrm|vex|reqp,fWR,tevexwb[191][2]},
}, { /* vex_W_ext 69 */
{OP_vgatherqps,0x66389318, catSIMD, "vgatherqps",Vvs,Hx,MVd,Hx,xx, mrm|vex|reqp,x,tevexwb[192][0]},
{OP_vgatherqpd,0x66389358, catSIMD, "vgatherqpd",Vvd,Hx,MVq,Hx,xx, mrm|vex|reqp,x,tevexwb[192][2]},
{OP_vgatherqps,0x66389318, catSIMD, "vgatherqps",Vvs,Hx,MVd,Hx,xx, mrm|vex|reqp,fWR,tevexwb[192][0]},
{OP_vgatherqpd,0x66389358, catSIMD, "vgatherqpd",Vvd,Hx,MVq,Hx,xx, mrm|vex|reqp,fWR,tevexwb[192][2]},
}, { /* vex_W_ext 70 */
{OP_vpmaskmovd,0x66388c18, catSIMD, "vpmaskmovd",Vx,xx,Hx,Mx,xx, mrm|vex|reqp|predcx,x,tvexw[71][0]},
{OP_vpmaskmovq,0x66388c58, catSIMD, "vpmaskmovq",Vx,xx,Hx,Mx,xx, mrm|vex|reqp|predcx,x,tvexw[71][1]},
Expand Down Expand Up @@ -9165,47 +9165,47 @@ const instr_info_t evex_Wb_extensions[][4] = {
/* XXX: OP_v*gather* raise #UD if any pair of the index, mask, or destination
* registers are identical. We don't bother trying to detect that.
*/
{OP_vpgatherdd, 0x66389008, catSIMD, "vpgatherdd", Ve, KEw, KEw, MVd, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vpgatherdd, 0x66389008, catSIMD, "vpgatherdd", Ve, KEw, KEw, MVd, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x66389018, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
{OP_vpgatherdq, 0x66389048, catSIMD, "vpgatherdq", Ve, KEb, KEb, MVq, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vpgatherdq, 0x66389048, catSIMD, "vpgatherdq", Ve, KEb, KEb, MVq, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x66389058, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
}, { /* evex_Wb_ext 190 */
{OP_vpgatherqd, 0x66389108, catSIMD, "vpgatherqd", Ve, KEb, KEb, MVd, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vpgatherqd, 0x66389108, catSIMD, "vpgatherqd", Ve, KEb, KEb, MVd, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x66389118, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
{OP_vpgatherqq, 0x66389148, catSIMD, "vpgatherqq", Ve, KEb, KEb, MVq, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vpgatherqq, 0x66389148, catSIMD, "vpgatherqq", Ve, KEb, KEb, MVq, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x66389158, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
}, { /* evex_Wb_ext 191 */
{OP_vgatherdps, 0x66389208, catSIMD, "vgatherdps", Ve, KEw, KEw, MVd, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vgatherdps, 0x66389208, catSIMD, "vgatherdps", Ve, KEw, KEw, MVd, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x66389218, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
{OP_vgatherdpd, 0x66389248, catSIMD, "vgatherdpd", Ve, KEb, KEb, MVq, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vgatherdpd, 0x66389248, catSIMD, "vgatherdpd", Ve, KEb, KEb, MVq, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x66389258, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
}, { /* evex_Wb_ext 192 */
{OP_vgatherqps, 0x66389308, catSIMD, "vgatherqps", Ve, KEb, KEb, MVd, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vgatherqps, 0x66389308, catSIMD, "vgatherqps", Ve, KEb, KEb, MVd, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x66389318, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
{OP_vgatherqpd, 0x66389348, catSIMD, "vgatherqpd", Ve, KEb, KEb, MVq, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vgatherqpd, 0x66389348, catSIMD, "vgatherqpd", Ve, KEb, KEb, MVq, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x66389358, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
}, { /* evex_Wb_ext 193 */
/* XXX: OP_v*scatter* raise #UD if any pair of the index, mask, or destination
* registers are identical. We don't bother trying to detect that.
*/
{OP_vpscatterdd, 0x6638a008, catSIMD, "vpscatterdd", MVd, KEw, KEw, Ve, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vpscatterdd, 0x6638a008, catSIMD, "vpscatterdd", MVd, KEw, KEw, Ve, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x6638a018, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
{OP_vpscatterdq, 0x6638a048, catSIMD, "vpscatterdq", MVq, KEb, KEb, Ve, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vpscatterdq, 0x6638a048, catSIMD, "vpscatterdq", MVq, KEb, KEb, Ve, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x6638a058, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
}, { /* evex_Wb_ext 194 */
{OP_vpscatterqd, 0x6638a108, catSIMD, "vpscatterqd", MVd, KEb, KEb, Ve, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vpscatterqd, 0x6638a108, catSIMD, "vpscatterqd", MVd, KEb, KEb, Ve, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x6638a118, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
{OP_vpscatterqq, 0x6638a148, catSIMD, "vpscatterqq", MVq, KEb, KEb, Ve, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vpscatterqq, 0x6638a148, catSIMD, "vpscatterqq", MVq, KEb, KEb, Ve, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x6638a158, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
}, { /* evex_Wb_ext 195 */
{OP_vscatterdps, 0x6638a208, catSIMD, "vscatterdps", MVd, KEw, KEw, Ve, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vscatterdps, 0x6638a208, catSIMD, "vscatterdps", MVd, KEw, KEw, Ve, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x6638a218, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
{OP_vscatterdpd, 0x6638a248, catSIMD, "vscatterdpd", MVq, KEb, KEb, Ve, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vscatterdpd, 0x6638a248, catSIMD, "vscatterdpd", MVq, KEb, KEb, Ve, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x6638a258, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
}, { /* evex_Wb_ext 196 */
{OP_vscatterqps, 0x6638a308, catSIMD, "vscatterqps", MVd, KEb, KEb, Ve, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vscatterqps, 0x6638a308, catSIMD, "vscatterqps", MVd, KEb, KEb, Ve, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x6638a318, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
{OP_vscatterqpd, 0x6638a348, catSIMD, "vscatterqpd", MVq, KEb, KEb, Ve, xx, mrm|evex|reqp|ttt1s|nok0, x, END_LIST},
{OP_vscatterqpd, 0x6638a348, catSIMD, "vscatterqpd", MVq, KEb, KEb, Ve, xx, mrm|evex|reqp|ttt1s|nok0, fWR, END_LIST},
{INVALID, 0x6638a358, catUncategorized, "(bad)", xx,xx,xx,xx,xx,no,x,NA},
}, { /* evex_Wb_ext 197 */
/* XXX i#1312: The encoding of this and the following gather prefetch instructions
Expand Down
Loading