67 Commits
Author SHA1 Message Date
Bin Wang e9884061d0 i#1947: Add support for Intel CET instructions (#7916)
- Add decoding/encoding support for Intel CET instructions.
- Ignore endbr64/endbr32/rdssp in drcpusim, as they decode as nop on
older CPUs.
- Removed an outdated comment about how gdb handles lfence.
- Use ext # directly for existing group 18/19 since they don't match
Intel SDM.

Fixes #1947
Fixes #4040
Fixes #5109
2026-08-19 22:39:55 -07:00
Bin Wang 6242d1d825 i#8021: Relocate Kbuild output to binary directory (#8023)
The Kbuild support added in #8020 builds the kernel module and
intermediate output alongside the source files. As we have discussed,
this pollutes the project directory and differs how CMake normally
isolates build output. This PR relocates the output to the binary
directory (i.e., `build/core/kernel_linux`) by
- Generate the Kbuild file in the binary directory.
- Mirror required source files in the binary directory using symlink.

Issue: #8021
2026-07-24 15:14:57 -07:00
Bin Wang e44c791e50 i#8021: Bootstrap kernel module build support (#8020)
- Add a boilerplate kernel module as placeholder.
- Add CMake build support for building the kernel module. Note that
CMake still need to create a Makefile and run make, which is the only
supported way to drive Kbuild. However, all the configuration (source
file list, flags, and defines) are done in CMake.
- Added a CI workflow definition for building the kernel module.

By default, Kbuild places the final `.ko` and intermediate build
artifacts (`.o`, `.mod.c`, etc.) alongside the module's source files.
This pollutes the project directory and differs from how CMake normally
isolates build output. We might want the artifacts to land in the
`build/` directory instead in the future. However, Kbuild's
external-module support ties build output directly to the `M=` source
directory.
[`KBUILD_EXTMOD_OUTPUT`](https://docs.kernel.org/6.13/kbuild/kbuild.html#kbuild-extmod-output)
does what we want, but it's only available in kernel 6.13+. So we'd need
to copy the source files into build/ before invoking Kbuild. Leaving
this for a future PR.

Issue: #8021
2026-07-22 22:43:17 -07:00
Bin Wang 9631915acb i#7975: Enable -Wstrict-prorotypes when compiling C files (#7976)
As we are trying to build DR files with the Linux kernel build system
(Kbuild), which has `-Wstrict-prototypes` turned on by default, we are
turning it on in this project as well. Also, the [coding style
conventions](https://dynamorio.org/page_code_style.html#autotoc_md106)
of this project already requires that declarations of functions that
take no argument should have the explicit `void` keyword in their
signatures.

- Enable `-Wstrict-prototypes` when compiling C files.
- Add explicit `void` to the signatures of functions that take no
argument.

For global functions whose declarations already have `void` (or were
added `void` in this PR), this PR also adds `void` to their definitions.
This is an optional cosmetic match, not required by the style guide or
`-Wstrict-prototypes`.

Fixed #7975
2026-07-08 21:11:43 -07:00
cpprust 40cbf19c76 Bump elfutils to 0.195 (#7938)
Bumps elfutils submodule from 0.191 to 0.195.

## Why
- Fixes const-qualifier discard warning with gcc 16.1.1 (already fixed
in elfutils 0.195)
- Replaces PR #7935 

## Changes
- Update `third_party/elfutils` to 0.195
- Add `eu_pic` target in `ext/drsyms/CMakeLists.txt` for
`lib/eu-search.c` helpers

## Testing
```
$ cmake --build build
[993/993] Linking CXX executable clients/bin64/drmemtrace_launcher
```
2026-06-15 15:09:08 -04:00
Kyle Huey e9fbd81a26 i#7917 Add x86 decoder/encoder support for the WAITPKG extension. (#7917)
The WAITPKG extension adds 3 new instructions, UMONITOR, TPAUSE, and
UMWAIT. In DR, these have all been incorrectly decoded as useless
prefixes on MFENCE.

UMONITOR is a deeply weird instruction. In the style of MOVDIR64 and
friends, UMONITOR's sole operand is a register that contains an offset
to form an address, where the portion of the register used to construct
that offset is determined by the effective addressing width and the
address size prefix. Unlike MOVDIR64 and friends, UMONITOR does not act
on a fixed size range of memory starting at address. UMONITOR, like
MONITOR before it, instead acts on the "monitor line" (in practice the
cache line) containing address. Because of that complexity, no attempt
is made to translate the register to a memory operand like is done for
MOVDIR64 and friends. Additionally, UMONITOR defaults to DS and does
accept segment override prefixes, unlike MOVDIR64 and friends (which are
fixed to ES and do not accept segment override prefixes).

TPAUSE and UMWAIT have straightforward (and identical) decode and encode
mechanics. The only odd thing about them is their implicit source
operands.
2026-06-03 20:58:43 -07:00
Bin Wang a99abb3b98 i#7902: Add support for Intel FRED instructions (#7903)
Add support for Intel FRED instructions (`erets`, `eretu`, `lkgs`)

Fixes #7902
2026-05-27 17:02:11 -07:00
Lorién López VillellasandKyle Huey 810fcace36 Correct EVEX tuple type for AVX-512 gather/scatter (#7896)
All 16 EVEX AVX-512 gather and scatter data-move instructions were
marked with `ttnone` in the decode table so no EVEX compressed
displacement scaling is applied. However, these instructions use the
Tuple1 Scalar (T1S) memory format: the 8-bit `disp8` field must be
multiplied by the element size to obtain the actual byte displacement,
i.e., 4 for 32-bit (`MVd`) operands, 8 for 64-bit (`MVq`) operands.

The bug is silent when `disp=0` and it manifests when the compiler uses
base+displacement addressing, usually in a stack-allocated array, which
produces a non-zero `disp8`, for example:

```
vscatterdpd %zmm3, -0x140(%rbp,%ymm0,8){%k1}
```


Here `disp8 = -40` (0xd8), representing actual displacement `-40 x 8 =
-320 = -0x140`. With `ttnone`, DynamoRIO stores `-40` in
`sg_info->disp`. When `drx_expand_scatter_gather()` expands this into
scalar stores it emits `[rbp + index*8 - 40]` instead of `[rbp + index*8
- 320]`, writing to wrong addresses.

I experienced this bug executing the GROMACS molecular dynamics package
in which some of the data eventually got corrupted.

---------

Co-authored-by: Kyle Huey <[email protected]>
2026-05-12 16:41:57 -04:00
Derek Bruening 0948b912dd i#7657: Upgrade zlib to 1.3.1 (#7658)
Upgrades the zlib submodule from 1.2.12 to 1.3.1.
This resolves the CVE-2022-37434 vulnerability.

Fixes #7657
2025-10-01 10:39:23 -04:00
Felix Moessbauer f1b67a4b0c Update elfutils version to 0.191 release (#7414)
Update elfutils version to 0.191 release
    
We currently pin the elfutils project to a floating ref. To make DR
better packagable, we pin the elfutils commit to the next official
release that contains the current commit (which is 0.191). An update to
the latest release (0.192) has been considered, but requires rework of
the build infrastructure and in-depths testing.

**The 0.191 release also applied the elf_memory.c fix, so we drop it
here.
Note, that this is just preliminary as this patch needs to be
reintroduced when updating to elfutils-0.192.**

 `cc44ac67 libelf: Treat elf_memory as if using ELF_C_READ_MMAP`
    
The other changes between c1058da5 and elfutils-0.191 seem not be be
affecting DR.

Signed-off-by: Felix Moessbauer <[email protected]>
2025-04-01 13:00:14 -04:00
Derek Bruening 814070fb18 i#7410: Fix incorrect x86 ISA categories and movntdqa operands (#7411)
Adds a check that the load and store categories strictly match the
instr_{reads,writes}_memory() on every x86 opcode. This revealed a
number of incorrect catLoad and catStore labels which are now removed
from:
+ OP_lea (see also below)
+ OP_lahf (see also below)
+ OP_vbroadcastf32x2
+ OP_vbroadcasti32x2
+ OP_fld with only register operands
+ OP_fst{,p} with only register operands
+ OP_fld* which insert literals

Splits the ir_x86_{3,4}args_avx512_evex_mask files up further to avoid
OOM in 32-bit VS (xref #3992, #4610).

Fixes {v,}movntdqa which the above check detected had its operands in
the wrong order: it was listed as a store in the table when it is in
fact a load. Also adds catSIMD to some variants that were missing it.

Fixes the following x86 ISA category errors:
+ OP_lea is now catMath instead of catLoad
+ OP_nop_modrm is now catOther instead of catSIMD
+ OP_lahf is now catState instead of catLoad

Categorizes the following previously uncategorized opcodes:
+ OP_xchg and OP_fxchg are now catMove
+ OP_pushf is now catStore|catState
+ OP_popf is now catLoad|catState
+ OP_sahf is now catState
+ OP_cmov* is now catMove
+ OP_nop is now catOther

None of these changes affect other IR interfaces like
instr_{reads,write}_memory().
There is no compatibility issue with drmemtrace address traces: no raw
trace impact; the final trace is impacted for movntdqa and (for regdeps)
the categories but there's no compatibility change: just an increase in
accuracy from raw2trace or record_filter output.

Fixes #7410
2025-03-31 17:26:35 -04:00
Kyle Huey 94bf526c76 Properly test whether an operand is an EVEX mask to apply braces during disassembly (#7152)
Convention is that EVEX mask operands (but not other opmask register
operands) are disassembled in braces. The correct test here is to test
the optype, which avoids applying the braces to a number of other opmask
register operands (see the changes in the disassembly tests for
examples).
2024-12-18 16:26:48 -08:00
Kyle Huey 9481855cb3 Add support for EVEX-encoded vaes and vpclmulqdq (#7145)
Four of the VAES opcodes take EVEX prefixes, as does vpclmulqdq, for a
total of five decode table changes.

- vaesdec
- vaesdeclast
- vaesenc
- vaesenclast
- vpclmulqdq

These instructions do *not* take opmasks so there are no new macros,
only tests.
2024-12-17 19:30:11 -08:00
Kyle Huey a20a2b0962 Enable more binutils tests that pass but were disabled. (#7141)
This time it's the 32 bit AVX-512 VNNI tests.
2024-12-16 16:13:53 -08:00
Kyle Huey 8afe9a3466 Fix VEX-encoded AES instruction operand sizes. (#7135)
These instructions do accept VEX.L.
2024-12-16 08:02:10 -08:00
Kyle Huey 1f67ae1208 Enable more binutils tests. (#7134)
Pick up some gfni and vnni tests that pass but had not been enabled.
2024-12-13 17:10:01 -08:00
Kyle Huey 9d88d3cde6 Add support for AVX-512 VBMI2. (#7128)
This adds 16 new VBMI2 opcodes:
  - vpcompressb
  - vpcompressw
  - vpexpandb
  - vpexpandw
  - vpshldw
  - vpshldd
  - vpshldq
  - vpshldvw
  - vpshldvd
  - vpshldvq
  - vpshrdw
  - vpshrdd
  - vpshrdq
  - vpshrdvw
  - vpshrdvd
  - vpshrdvq

And one VBMI opcode that was missing.
  - vpmultishiftqb

The changes are generally what would be expected. The only quirk worth
mentioning is that vpshrdvw's decoder table entry does not take reqp
(unlike every other opcode added) because the path to get there goes
through a PREFIX_EXT to split off some AVX512_BF16 instructions.
2024-12-13 00:22:28 -08:00
Kyle Huey f893bd7bbf Fix operand order for vpexpandd/vpexpandq. (#7125)
These appear to have been backwards since they were originally
introduced in a9ddaf2dfb.
2024-12-12 14:36:13 -08:00
Kyle Huey d4bc67724f Enable a number of binutils tests that pass but are disabled. (#7122)
There are a few random pieces in here that have been missed previously.
2024-12-11 14:17:19 -08:00
Kyle Huey 64ac31b0fe Add support for the GFNI extension. (#7119)
Adds six new opcodes in SSE/VEX/EVEX forms with accompanying macros and
tests.
 - gf2p8mulb
 - gf2p8affineqb
 - gf2p8affineinvqb
 - vgf2p8mulb
 - vgf2p8affineqb
 - vgf2p8affineinvqb
2024-12-11 00:09:57 -08:00
Kyle Huey 5f034c306d Add support for the AVX512_BITALG extension. (#7115)
This adds three new instructions, vpopcntb, vpopcntw, and vpshufbitqmb.
None of these instructions have broadcast variants, so they're
straightforward additions.
2024-12-09 20:58:34 -08:00
Kyle Huey e24dbb0c21 Add decode/encode support for additional Intel cache management instructions. (#7109)
This covers the CLWB/CLDEMOTE extensions and the previously omitted
CLFLUSHOPT instruction.

Because these instructions explicitly forbid modrm.mod == 3 a sequence
from the binutils tests that previously decoded as a nop but now would
decode as a CLDEMOTE with modrm.mod == 3 is removed.
2024-12-09 16:22:10 -08:00
Kyle Huey 500483edcd Add decode/encode support for Intel's RDPID extension. (#7107)
Add the RDPID instruction, which is intended to be a faster replacement
for RDTSCP when the caller only cares about the processor ID and does
not need the timestamp.

Also mark RDSEED as catOther since we have to move its entry in the
decoder table anyways.
2024-12-06 23:45:39 -08:00
Kyle Huey 3207841e50 Add decode/encode support for Intel's ENQCMD extension. (#7105)
Add the ENQCMD/ENQCMDS instructions. Because they are patterned
identically to MOVDIR64B the changes are very straightforward. MOD_EXT
entries are added because the upcoming USER_MSR extension will use the
modrm.mod == 3 slots for these opcodes.
2024-12-06 17:54:51 -08:00
Kyle Huey b0237d2157 Add decode/encode support for Intel's direct store extensions. (#7097)
Two new instructions (MOVDIRI and MOVDIR64B) are added. PREFIX_EXT is used for MOVDIR64B because the enqueue stores will also go there later.

MOVDIR64B is a strange instruction because the encoded destination operand is a register but it's really an offset relative to the ES segment register. Furthermore, the address prefix controls the size of that register operand, not the data prefix. To handle this a new operand type TYPE_G_ES_VAR_REG_SIZE is introduced. In the DR IR this is translated to/from a far base disp operand with DR_SEG_ES set, a null index register, and zero fixed displacement.

For internal processing of the base register for the far base disp a new operand size OPSZ_addr is introduced. This operand size is the processor word size, or half that size if the address prefix is present. OPSZ_addr can be reused in a later commit to replace the users of resolve_addr_size().

There are some additional shenangians in the disassembler to suppress address size prefixes and suffixes to match the binutils assembly syntax for MOVDIR64B.
2024-12-05 18:32:49 -08:00
xdje42 6366e1e1c3 i#6524: Fix udivmoddi4.c 32-bit linux build fail and semantics (#6526)
For the targets we care about LIBGCC2_UNITS_PER_WORD == 4 (SImode in GCC
parlance).
Thus a double word is 8 bytes (DImode in GCC parlance).

Previously, __moddi3 was using a mix of word and double word widths,
causing a compilation failure on 32 bit linux with the Debian 13.2.0-4
compiler.
The semantics were also incorrect: inputs and outputs should be 64 bits
for the
hosts we care about (x86, aarch, 32 and 64 bit, and riscv64).

Fixes: #6524
2024-02-13 13:42:10 -08:00
Derek Bruening 0a6c0579d8 i#5926 libdw: Switch drsyms to use libdw from elfutils (#6534)
Switches from elftoolchain's libdwarf, which is no longer being
updated, to elfutil's libdw, only for Linux for now.  The interfaces
are slightly different but generally similar.  We also switch to the
libelf from elfutil to ensure its interactions with libdw work
properly.

Adds a new third_party/elfutils submodule.

Adds the LGPL3 elfutils license to our license docs, stressing that we
are providing drsyms as a library distinct from the rest of DR.

Adds build rules to build the 4 elfutils libraries we need (libdw,
libelf, plus helpers libdwelf and libebl) as static PIC libraries.
As elfutils uses autoconf, we check in a config.h file from a local
configure believed to be general enough for our supported toolchains
to feed to our CMake build.

Adds 4 patches needed for elfutils.  These are stored in the parent
dynamorio repository and applied at CMake configure time to create new
source files in the build directory.  This keeps the submodule
pristine.  The patches are:

  1) Fix a bug in elf_memory() where an ignored "command" enum was used.
2) Shrink the stack usage of read_srclines() called by
dwarf_getsrclines() to
     fit on DR's small stacks.
  3) Redirect zlib heap allocation.
  4) Pre-allocate a destination instead of realpath(xxx, NULL).

Adds a requirement that zlib be available on Linux to build drysms, as
elfutils requires zlib for compressed debug sections.

Adds -Dmalloc=__wrap_malloc, etc. to redirect heap usage by the
elfutils static libraries to DR.

Adds a new tool.drcacheoff.check-malloc test to better check for
malloc use in the drmemtrace client.  The new test explicitly invokes
drsyms via the drmemtrace function tracing feature, while disabling
lz4 compression (as it turns off the import check).  This test only
passes with the -Dmalloc=__wrap_malloc defines and the zlib heap
redirect patch.

Adds a new drsyms_dw.c file, partly mirroring drsyms_dwarf.c.  The
libdw and libdwarf interfaces are different enough it seemed best to
have a separate file, though the general code is similar.  The
drsyms_elf.c differences are in-file via ifdef.

Removes the -gdwarf-4 workaround from the docs.

Adds new -gdwarf-4 and -gdwarf-5 drsyms tests.

The libelftc demangler is kept via the checked-in static library,
since libdw does not have its own demangler.  We do not expect this
part of libelftc to need updates.

Fixes #5926
2024-01-05 16:09:17 -05:00
Abhinav Anil Sharma 1ce89b85c9 i#5505 kernel trace: Support privileged xsaves xrstors instrs (#6488)
Adds support for yet more privileged opcodes seen in system call traces
collected using Intel-PT.

Tested manually that decode_sizeof returns the correct lengths for the
various variations of these opcodes.

Also verified using gdb the new encodings added in the decenc tests.

Issue: #5505, #3578
2023-12-03 01:01:11 -05:00
Abhinav Anil Sharma 30031e0600 i#5505 kernel tracing: Support clac and stac in DR decoder (#6484)
Adds encoding-decoding support for clac and stac which are observed in
kernel traces.

decode_fast does not need any change and already should get the 3-byte
size correctly.

Adds EFLAGS_READ_AC and EFLAGS_WRITE_AC to track reads/writes to the
Alignment Check flag.
Currently we try to avoid a major binary compatibility break by adding
them to the end. This makes
some code more complicated. Added a TODO with #6485 to re-number when
we're about to do the
next major release.

Issue: #5505
Fixes: #2103
2023-11-30 11:44:48 -05:00
Kyle Huey 95b0aea443 i#6136: Add AVX-512 VPOPCNTDQ support. (#6156)
Adds the new AVX512_VPOPCNTDQ instructions, which were present on
certain Xeon Phis but broadly introduced in Ice Lake.

Fixes #6136
2023-06-20 21:36:26 -04:00
Kyle Huey 98dcf2aa02 i#5979 decode: Rename ud2a/ud2b to ud2/ud1 and decode ud1 operands (#6087)
The opcodes DR calls ud2a and ud2b are more commonly known (and
documented by Intel) as ud2 and ud1, respectively. Rename them,
preserving the old operand constants and instruction creation macros
through preprocessor defines. Additionally,
ud1 actually takes two operands. Fix the decode table for them.

Fixes #5979
2023-05-31 22:40:56 +00:00
Kyle Huey 554ea4fd7e i#6003: Only accept FS/GS segment prefixes on X64. (#6056)
On 64 bit the legacy CS/SS/DS/ES prefixes are ignored. Account for that
so instructions decode correctly.

Fixes #6003
2023-05-18 21:07:34 +00:00
Abhinav Anil Sharma b52650e8a0 Skip vera++ checks for build directory (#5932)
vera++ complains for various files in the build directory when it is a sub-directory of the source directory.

Our documentation suggests creating a build directory inside the source directory, so this flow must work.
2023-03-27 17:39:25 -04:00
Derek Bruening 0ed9f41b22 i#5520 memtrace encodings: Add AArch32 support (#5672)
Adds support for Thumb versus Arm modes in AArch32 with respect to
drmemtrace stored encodings by setting the LSB when storing in the
tracer and raw2trace, and by properly setting the base mode to Arm
when decoding.

Augments decode_from_copy() to switch locally to Thumb if either the
read or original PC has LSB=1 as that better fits most use cases
(including reading from a drmemtrace encoding buffer).

Adds AArch32 support to the burst_gencode test.

Fixes 3 outstanding AArch32 issues:

+ Removes a quote in a comment in third_party/libgcc/arm/lib1funcs.S
  code not handled by old toolchains.

+ Removes an ASSERT_NOT_TESTED path now hit.

+ Fixes an AArch32 tracer bug where a 2nd temp register is needed for a
  2nd conditional skip.

Tested by running the drcacheoff.gencode test on an AArch32 machine
which now passes.

Issue: #5520
2022-10-04 14:59:09 -04:00
Kyle Huey d959b156dc i#5645: Make the last rep/repne prefix "win" (#5648)
x86 allows multiple prefixes to be present on an instruction. Although not
documented in the Intel SDM, empirical testing shows that the last rep/repne
prefix "wins", since it makes no sense for both prefixes to be present.
Since these prefixes are used at times to select between instructions
(e.g. anything with PREFIX_EXT in the decoder table) faithfully replicating
this behavior is important to ensure that byte sequences with unnecessary
leading prefixes are correctly decoded.

Fixes #5645
Fixes #5447
2022-09-12 19:28:17 -07:00
Derek Bruening 6e69f2a90b i#5538 memtrace seek, part 1: Write in pieces to zipfiles (#5633)
Splits post-processed offline drmemtrace files into chunks of a fixed
instruction count.  These chunks are combined inside one zipfile per
thread, maintaining the current file-per-thread invariant.

The minizip library, a contributed part of the zlib sources, is added
as a submodule and used to write and read the zipfile (via new
zipfile_ostream_t and zipfile_file_reader_t classes, respectively).
If the submodule is not present, we fall back to a gzipped single file
(if we have a system zlib).

Adds a new marker type holding the chunk instr count.
Adds a new -chunk_instr_count option for specifying the count.
We pass a small value to the drcacheoff.simple and invariant
checker tests to test multiple chunks in one zip file.
Documents the change.
Refactors drmemtrace_get_timestamp_from_offline_trace to handle
new markers.
Updates tests to handle the new marker.

Adds a new marker type as a chunk footer, to identify truncation.

Re-emits the last timestamp+cpu at the top of each new chunk.
The reader skips them in linear walking.

Refactors delayed branch handling so we can identify instr entries.

Removes the histogram.gzip test as it is superfluous since we've been
gzipping files for a long time; plus, it blindly assumes it can gzip
any output, including a .zip.

Issue: #5538
2022-09-02 17:29:52 -04:00
qidongzhao bb803962a0 i#5505 kernel memtrace: Add submodule libipt & Initialize it all the time (#5518)
Adding libipt as a submodule and bringing up some bunch of additional support to ensure submodules can be initialized all the time:
- Tell GA CI to init submodules: submodules: true arg to checkout step
- Add submodule update to make/git/devsetup.sh
- Add submodule update to make/git/git_pullall.sh
- Update how-to-build docs
- Add a pre-commit hook to prevent the common mistake of accidentally rolling back a recent submodule update when switching branches

Issue: #5505
2022-06-08 15:19:31 -04:00
prasun3 adb1bd4906 i#5483 add support for avx512 bf16 instructions (#5489)
* i5483: Added support for AVX512 BF16 instructions

**AVX512 bfloat16 instructions**

These are the three bfloat16 instructions.

VCVTNE2PS2BF16—Convert Two Packed Single Data to One Packed BF16 Data
```
EVEX.128.F2.0F38.W0 72 /r VCVTNE2PS2BF16 xmm1{k1}{z}, xmm2, xmm3/m128/m32bcst
EVEX.256.F2.0F38.W0 72 /r VCVTNE2PS2BF16 ymm1{k1}{z}, ymm2, ymm3/m256/m32bcst
EVEX.512.F2.0F38.W0 72 /r VCVTNE2PS2BF16 zmm1{k1}{z}, zmm2, zmm3/m512/m32bcst

Op/En   Tuple   Operand 1       Operand 2       Operand 3
A       Full    ModRM:reg (w)   EVEX.vvvv (r)   ModRM:r/m (r)
```
VCVTNEPS2BF16—Convert Packed Single Data to Packed BF16 Data
```
EVEX.128.F3.0F38.W0 72 /r VCVTNEPS2BF16 xmm1{k1}{z}, xmm2/m128/m32bcst
EVEX.256.F3.0F38.W0 72 /r VCVTNEPS2BF16 xmm1{k1}{z}, ymm2/m256/m32bcst
EVEX.512.F3.0F38.W0 72 /r VCVTNEPS2BF16 ymm1{k1}{z}, zmm2/m512/m32bcst

Op/En   Tuple   Operand 1       Operand 2
A       Full    ModRM:reg (w)   ModRM:r/m (r)
```

VDPBF16PS—Dot Product of BF16 Pairs Accumulated into Packed Single Precision
```
EVEX.128.F3.0F38.W0 52 /r VDPBF16PS xmm1{k1}{z}, xmm2, xmm3/m128/m32bcst
EVEX.256.F3.0F38.W0 52 /r VDPBF16PS ymm1{k1}{z}, ymm2, ymm3/m256/m32bcst
EVEX.512.F3.0F38.W0 52 /r VDPBF16PS zmm1{k1}{z}, zmm2, zmm3/m512/m32bcst

Op/En   Tuple   Operand 1       Operand 2       Operand 3
A       Full    ModRM:reg (w)   EVEX.vvvv (r)   ModRM:r/m (r)
```

**List of places to update**

From https://github.com/DynamoRIO/dynamorio/blob/master/core/ir/x86/opcode_api.h#L53

```
 * When adding new instructions, be sure to update all of these places:
 *   1) decode_table op_instr array
 *   2) decode_table decoding table entries
 *   3) OP_ enum (here) via x86opnums.pl
 *   4) update OP_LAST at end of enum here
 *   5) decode_fast tables if necessary (they are conservative)
 *   6) instr_create macros
 *   7) suite/tests/api/ir* tests
 *   8) add binutils tests in third_party/binutils/test_decenc

```

**Step 1: update `op_instr` array**

Added entries to `op_instr`. These point directly to `evex_Wb_extensions` since these instructions only have `evex` encoding.

**Step 2: add decode_table entries**

   - updated `third_byte_38` table to point to `prefix_extensions` since these instructions have common opcodes and differ in prefix.
   - added entries in `prefix_extensions` to point to appropriate vex/evex entries
   - added entries in `evex_Wb_extensions`

The instructions `VCVTNEPS2BF16` and `VCVTNE2PS2BF16` have three byte opcodes starting with `0f 38` so the decoder looks at `third_byte_38[third_byte_38_index[opcode]]`. Since these instructions have the same opcode (`72`) and differ only in the prefix (`f2/f3`), we need to point the `third_byte_38` to `prefix_extensions` which in turn points to the appropriate `EVEX_Wb` entries.

The instruction `VDPBF16PS` has the same opcode (52) as the VNNI instruction `vpdpwsd` and they differ only in the prefix (`F3/66`). We need to update that entry to point to `prefix_extensions` instead of `e_vex_extensions`. This causes the `e_vex_extensions` entry ( `e_vex ext 151`) to be orphaned - do we remove this entry?

Updated opcodes for invalid entries in e_vex ext 151 and 152 for consistency.

**Step 3: add OP_ enums**

Done

**Step 4: update OP_LAST**

Not needed since OP_LAST already points to the last enum.

**Step 5: decode_fast tables if necessary**

Not done

**Step 6: instr_create macros**

Added `1dst_3src` macros for `VCVTNE2PS2BF16` and `VDPBF16PS` since they write to operand 1 and read from mask register, operand 2, and operand 3.

Added `1dst_2src` macro for `VCVTNEPS2BF16` since it writes to operand 1 and reads from mask register and operand 2.

**Step 7: suite/tests/api/ir tests**

Added tests in ir_x86_3args_avx512_evex_mask.h and ir_x86_4args_avx512_evex_mask_C.h.

Added manual tests in ir_x86.c (hard-coded zeroing prefix flag pending #5488)

**Step 8: binutils tests**

Added binutils tests. These represent the assembly instructions using DR API and match against the encoded bytes.
2022-05-17 11:07:59 +05:30
prasun3 c233329152 i#5440: Add AVX512 VNNI support (#5444)
Adds support for AVX512 VNNI instructions, including instr creation
macros, internal tests, and binutils tests, for vex- and evex-encoded
variants.

Fixes #5440
2022-04-25 15:39:35 +00:00
Kyle Huey 0014a2dc51 i#5442: Fix decoding of the compact (90) form of xchg %ax,%r8w (#5445)
xchg %ax,%r8w is separated from xchg %ax,%ax (aka OP_nop) only by REX.B.
The decoding table was not reaching the 90 OP_xchg when coming through
prefix_extensions.

Encoding of this short variant (and also e.g. xchg %eax, %r8d; xchg %eax, %r9d; etc)
is still not handled, but those will fall back to the longer 87 xchg opcode; fixing that
is #5446.

Co-authored-by: Derek Bruening <[email protected]>

Issue: #5442, #5446
Fixes #5442
2022-04-05 02:35:33 +00:00
Kyle Huey df18aa86c2 i#4550: Support EVEX encoded vsqrt instructions. (#4739)
Adds support for the EVEX encodings of vsqrtps, vsqrtpd, vsqrtss, and vsqrtsd. Also adds API tests and uncomments the relevant sections of the binutils decoder tests, with updated expectation files.

Fixes #4550
2021-02-17 12:53:08 -08:00
Kyle Huey d572bea7b8 i#1312: Enable binutils decenc tests for AVX-512 (#4648)
Fix a bug that can trigger a warning about invalid VSIB encodings, and then enable AVX-512 decenc tests for supported instructions.

Issue #1312
2021-01-02 17:02:07 -08:00
Derek Bruening 47ea6ac319 i#2861 cronbuilds: Build cronbuilds as official packages (#4089)
Switches to a separate invocation of package.cmake for cronbuilds, to
make them look like release packages.  Cronbuilds on Travis and Appveyor
no longer run the same jobs as a regular build but instead run one
package.cmake job.

Checks out Dr. Memory to include it in the package.
Does a shallow clone, assuming 250 is enough for the embedded DR.
Excludes drmemory/ from vera checks.

Removes the "package" parameter from non-cron builds which should make
them a little faster (xref i#4059).

There are still further decisions and actions but now the cronbuilds have the same
content as past manual builds.

Issue: #2861, #4059
2020-02-09 10:12:05 -05:00
kmar af21cdc04f i#3577 AMD opcodes: add support for AMD's monitorx and mwaitx opcodes (#4012)
Adds support for AMD's monitorx and mwaitx opcodes.
Adds the opcodes, the decode table entries, the INSTR_CREATE macros, api.ir tests, and enables the corresponding disabled binutils tests.

Issue: #3577
2020-01-13 17:41:37 -05:00
Derek Bruening 1914d2d662 i#2431: Fix decoding of crc32w (#3938)
Updates the prefix order to properly decode crc32w.

Fixes the destination size codes for OP_crc32: the destination can
never shrink to 16 bits.  Resolves an old comment expressing confusion
about this where the Intel manual had a separate entry for a data
prefix, resulting in different codes than we need in our table.

Enables all the crc32w test cases in the binutils decenc tests.
Updates the expected test patterns.

Fixes #2431
2019-11-14 18:29:43 -05:00
Hendrik Greving 099ba138c4 i#3581 SHA/MPX/PT support: Add support for Intel MPX instructions. (#3785)
Adds the Intel MPX opcodes bndmov, bndcl, bndcn, bndcu, bndmk, bndldx, bndstx.

Adds the new registers DR_REG_BND0 - DR_REG_BND3 and the new operand types
TYPE_T_REG and TYPE_T_MODRM.

Adds the size OPSZ_8x16. Both OPSZ_4x8 and the new size are used in order to avoid
a superfluous REX prefix when encoding the MPX instructions.

Adds the function reg_is_bnd().

Adds tests for above.

Removes an invalid encoding from decenc.drdecode_decenc_x86[_64]. The encoding
would decode to a bnd instruction with invalid register.

Opcodes have been checked against llvm-mc and binutils/gas/objdump.

In an unrelated change, the unnecessary reg_size_ok() checks from certain TYPE_K_
versions in the encoder have been removed and a TODO comment has been added.

Clients should not rely on binary compatibility of the added opcodes until both issues
#3581 and #1312 have been closed.

Issue: #3581
2019-08-18 12:37:25 -07:00
Hendrik Greving 683a884dcf i#1312 AVX-512 support: Revert accidental vera++ check suppression. (#3732)
Reverts suppressing vera++ checks incorrectly committed by e20fec8.

Adds the option VERA_ERROR that optionally can be set to OFF in order to turn vera++
errors into a warning. The default is ON.

Issue: #1312
2019-07-15 12:58:25 -07:00
John F.X. Galea 4a5ec65f58 i#3692: Fix pext encoding. (#3694)
Arranges pext's encoding fixing its prefix.

Fixes #3692
2019-06-21 16:08:17 +02:00
Hendrik Greving 6f2e536902 i#1312 AVX-512 support: Add remaining v(p)mov and vpshuf* opcodes. (#3684)
This patch contains a minor compatibility change that now splits the existing AVX general register
versions of vmovd/vmovq into the opcodes vmovd/vmovq.

Adds the evex-promoted opcodes vmovd, vmovq, vpshufhw, vpshufd, vpshuflw,
vpshufb, vpmovsxbw, vpmovsxbd, vpmovsxbq, vpmovsxwd, vpmovsxwq, vpmovsxdq,
vpmovzxbw, vpmovzxbd, vpmovzxbq, vpmovzxwd, vpmovzxwq, and vpmovzxdq.

Adds the new AVX-512 opcodes vpmovqb, vpmovsqb, vpmovusqb, vpmovqw, vpmovsqw,
vpmovusqw, vpmovqd, vpmovsqd, vpmovusqd, vpmovdb, vpmovsdb, vpmovusdb, vpmovdw,
vpmovsdw, vpmovusdw, vpmovwb, vpmovswb, vpmovuswb, vpmovm2b, vpmovm2w, vpmovm2d,
vpmovm2q, vpmovb2m, vpmovw2m, vpmovd2m, and vpmovq2m.

Adds new letter codes 'i' for quarter and 'j' for eighth.

Along with adding the AVX-512 evex-promoted opcodes, this patch fixes incorrect AVX
constraints of vpmovsxbw, vpmovsxbd, vpmovsxbq, vpmovsxwd, vpmovsxwq, vpmovsxdq,
vpmovzxbw, vpmovzxbd, vpmovzxbq, vpmovzxwd, vpmovzxwq, and vpmovzxdq.

Adds the internal opsizes OPSZ_quarter_16_vex32, OPSZ_quarter_16_vex32_evex64,
OPSZ_eighth_16_vex32, and OPSZ_eighth_16_vex32_evex64.

Adds tests for above.

Opcodes have been checked against llvm-mc, binutils/gas/objdump and capstone.

This patch does not include the AVX-512 vshuf* opcodes, which will be included in a
future patch.

Issue: #1312
2019-06-18 20:16:11 +02:00
Hendrik Greving f283a8765e i#1312 AVX-512 support: Add all remaining vinsert* and vextract* opcodes. (#3668)
Adds the evex-promoted opcodes vextractps, vinsertps.

Adds the new AVX-512 opcodes vextractf32x4, vextractf64x2, vextractf32x8, vextractf64x4,
vextracti32x4, vextracti64x2, vextracti32x8, vextracti64x4, vinsertf32x4, vinsertf64x2,
vinsertf32x8, vinsertf64x4, vinserti32x4, vinserti64x2, vinserti32x8, vinserti64x4.

Adds tests for above.

In order to support the new instructions, the following decoder and encoder modifications
are part of this patch:

Adds new AVX-512 sizes OPSZ_16_of_32_evex64 and OPSZ_32_of_64 and corresponding
operand types in the decode table.

Fixes VEX.L and EVEX.LL assignment in encoder. Instructions in AVX-512 appear to encode
the L-bits according to their largest operand size. This affects instructions with
different operand sizes, e.g. vextract*, vinsert*.

Adds support to the encoder for encoding extra operands.

Introduces a new letter code 'f' for 256 or 512. Corresponding existing or new codes Vf, Vdq_f,
Vqq_oq, Wf, Hf, Hdq_f have been added or fixed.

Fixes a few debug strings e_vex => evex_W in decode table.

Fixes a minor AVX-512 opcodes sort -n order error in opcodes.h.

Opcodes have been checked against llvm-mc, binutils/gas/objdump and capstone. A binutils
bug has been filed: https://sourceware.org/bugzilla/show_bug.cgi?id=24633.

Issue: #1312
2019-06-05 08:54:21 -07:00