Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x86: Fix evaluation order of CMOV #6523

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

Sleigh-InSPECtor
Copy link

When the register holding the source address of a CMOV instruction is the 64-bit register that overlaps with the 32-bit destination (e.g., CMOV EAX, dword ptr [RAX]) then the wrong address will be loaded from if the upper bits are non-zero. (e.g. the previous example will load from RAX & 0xffff_ffff instead of RAX).

This is directly caused by the build check_Reg32_dest statement, but the actual issue is that the source address should be loaded into a temporary before before checking the condition. Notably, it is still correct to zero the upper 32-bit of the 64-bit register in x64 mode even if the condition is false, so this behavior has been kept.

e.g.,

0f4000 "CMOVO EAX, dword ptr [RAX]" with RAX=0x1_0000_0000, OF=1, mem[0x1_0000_0000]=aaaaaaaa, mem[0x0]=bbbbbbbb.

  • Hardware Reference (AMD CPU & Intel CPU): { RAX=0xaaaaaaaa }
  • x86:LE:64:default (Existing): "CMOV EAX, dword ptr [RAX]" { RAX=0xbbbbbbbb }
  • x86:LE:64:default (This patch): CMOV EAX, dword ptr [RAX]" { RAX=0xaaaaaaaa }

The other constructors have been adjusted even though this issue doesn't directly affect them, to more closely match the real semantics, i.e. the manual states: "CMOVcc loads data from its source operand into a temporary register unconditionally (regardless of the condition code and the status flags in the EFLAGS register)".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature: Processor/x86 Status: Triage Information is being gathered
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants