Validator_ragel: disallow 16-bit form for SSE4 instructions (popcnt, lzcnt, tzcnt)

src/trusted/validator_ragel/unreviewed/general_purpose_instructions.def

 # Copyright (c) 2012 The Native Client Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 ################################################################################
 # This file describes instructions from AMD64 Architecture Programmer’s Manual
 #                               Volume 3: General-Purpose and System Instruction
 #                               Chapter 3: General-Purpose Instruction Reference
 ################################################################################
 # File format:
 #     three columns separated by commas.  Each line describes one instruction.
@@ skipping 630 matching lines @@
 loop Jb, 0xe2, branch_hint nacl-forbidden
 loope Jb, 0xe1, nacl-ia32-forbidden
 loope Jb, 0xe1, branch_hint nacl-forbidden
 loopne Jb, 0xe0, nacl-ia32-forbidden
 loopne Jb, 0xe0, branch_hint nacl-forbidden
 ######## LWPINS ################################################################
 lwpins Id Ed =By, 0x8f RXB.0A W.src1.0.00 0x12 /0, CPUFeature_LWP
 ######## LWPVAL ################################################################
 lwpval Id Ed =By, 0x8f RXB.0A W.src1.0.00 0x12 /1, CPUFeature_LWP
 ######## LZCNT #################################################################
+# Textbook definition of “lzcnt” as per AMD/Intel manuals looks like this:
+#   lzcnt Ev Gv, 0xf3 0x0f 0xbd, CPUFeature_LZCNT nacl-amd64-zero-extends
 # “lzcnt” is not marked as nacl-amd64-zero-extends because it is unlikely to be
 # useful for computing an address based on the number of leading zeros of a
 # value.
-lzcnt Ev Gv, 0xf3 0x0f 0xbd, CPUFeature_LZCNT
+# Also, since f3 opcode extension is counted as rep prefix, it is not allowed
+# together with data16 prefix.
+# See http://code.google.com/p/nativeclient/issues/detail?id=3076
+lzcnt Ew Gw, data16 0xf3 0x0f 0xbd, norexw CPUFeature_LZCNT nacl-forbidden
+lzcnt Ed Gd, 0xf3 0x0f 0xbd, norexw CPUFeature_LZCNT
+lzcnt Eq Gq, rexw 0xf3 0x0f 0xbd, amd64 CPUFeature_LZCNT
+lzcnt Eq Gq, data16 rexw 0xf3 0x0f 0xbd, amd64 CPUFeature_LZCNT nacl-forbidden
 ######## MFENCE ################################################################
 mfence, 0x0f 0xae 0xf0, CPUFeature_SSE2
 ######## MOV ###################################################################
 mov G E, 0x88, nacl-amd64-modifiable nacl-amd64-zero-extends
 mov E G, 0x8a, nacl-amd64-modifiable nacl-amd64-zero-extends
 mov Sw Mw, 0x8c /s, nacl-forbidden
 mov Sw Rv, 0x8c /s, nacl-forbidden
 mov Ew Sw, 0x8e /s, nacl-forbidden
 mov Ib rb, 0xb0, nacl-amd64-modifiable nacl-amd64-zero-extends
 mov Iv rv, 0xb8, nacl-amd64-modifiable nacl-amd64-zero-extends
@@ skipping 142 matching lines @@
 pop Ew, data16 0x8f /0, att-show-memory-suffix-w
 pop Er, 0x8f /0, ia32 att-show-memory-suffix-l
 pop Er, 0x8f /0, amd64 att-show-memory-suffix-q
 pop rw, data16 0x58
 pop rr, 0x58
 "pop    %fs", 0x0f 0xa1, ia32 nacl-forbidden
 "pop    %gs", 0x0f 0xa9, ia32 nacl-forbidden
 "popq   %fs", 0x0f 0xa1, amd64 nacl-forbidden
 "popq   %gs", 0x0f 0xa9, amd64 nacl-forbidden
 ######## POPCNT ################################################################
+# Textbook definition of “popcnt” as per AMD/Intel manuals looks like this:
+#   popcnt Ev Gv, 0xf3 0x0f 0xb8, CPUFeature_POPCNT nacl-amd64-zero-extends
 # “popcnt” is not marked as nacl-amd64-zero-extends because it is unlikely to be
 # useful for computing an address based on the number of ones in a value.
-popcnt Ev Gv, 0xf3 0x0f 0xb8, CPUFeature_POPCNT
+# Also, since f3 opcode extension is counted as rep prefix, it is not allowed
+# together with data16 prefix.
+# See http://code.google.com/p/nativeclient/issues/detail?id=3076
+popcnt Ew Gw, data16 0xf3 0x0f 0xb8, norexw CPUFeature_POPCNT nacl-forbidden
+popcnt Ed Gd, 0xf3 0x0f 0xb8, norexw CPUFeature_POPCNT
+popcnt Eq Gq, rexw 0xf3 0x0f 0xb8, amd64 CPUFeature_POPCNT
+popcnt Eq Gq, data16 rexw 0xf3 0x0f 0xb8, amd64 CPUFeature_POPCNT nacl-forbidden
 ######## POPF/POPFD/POPFQ ######################################################
 popf, data16 0x9d, norexw att-show-name-suffix-w nacl-forbidden
 popf, 0x9d, ia32 nacl-forbidden
 popf, 0x9d, norexw amd64 att-show-name-suffix-q nacl-forbidden
 popf, data16 rexw 0x9d, amd64 att-show-name-suffix-q nacl-forbidden
 ######## PREFETCH/PREFETCHW ####################################################
 prefetch Mb, 0x0f 0x0d /0, CPUFeature_3DPRFTCH no_memory_access
 prefetchw Mb, 0x0f 0x0d /1, CPUFeature_3DPRFTCH no_memory_access
 prefetch Mb, 0x0f 0x0d /2, CPUFeature_3DPRFTCH no_memory_access nacl-forbidden
 # AMD manual desribes this opcode as “reserved” in one place (and clarifies that
@@ skipping 200 matching lines @@
 ######## T1MSKC ################################################################
 t1mskc Ey By, 0x8f RXB.09 W.dest.0.00 0x01 /7, CPUFeature_TBM
 ######## TEST ##################################################################
 test I =a, 0xa8
 test I =E, 0xf6 /0
 # AMD manual claims this opcode works identically to “/0”.  Intel manual
 # says it's reserved.  Objdump does not like it.
 # test I =E, 0xf6 /1
 test G =E, 0x84
 ######## TZCNT #################################################################
+# Textbook definition of “tzcnt” as per AMD/Intel manuals looks like this:
+#   tzcnt Ev Gv, 0xf3 0x0f 0xbc, CPUFeature_TZCNT nacl-amd64-zero-extends
 # “tzcnt” is not marked as nacl-amd64-zero-extends because it is unlikely to be
 # useful for computing an address based on the number of trailing zeros of a
 # value.
 # We mark tzcnt specially to allow it independently from CPUID
-# See: http://code.google.com/p/nativeclient/issues/detail?id=2869
-tzcnt Ev Gv, 0xf3 0x0f 0xbc, CPUFeature_TZCNT
+# See http://code.google.com/p/nativeclient/issues/detail?id=2869
+# Also, since f3 opcode extension is counted as rep prefix, it is not allowed
+# together with data16 prefix.
+# See http://code.google.com/p/nativeclient/issues/detail?id=3076
+tzcnt Ew Gw, data16 0xf3 0x0f 0xbc, norexw CPUFeature_TZCNT nacl-forbidden
+tzcnt Ed Gd, 0xf3 0x0f 0xbc, norexw CPUFeature_TZCNT
+tzcnt Eq Gq, rexw 0xf3 0x0f 0xbc, amd64 CPUFeature_TZCNT
+tzcnt Eq Gq, data16 rexw 0xf3 0x0f 0xbc, amd64 CPUFeature_TZCNT nacl-forbidden
 ######## TZMSK #################################################################
 tzmsk Ey By, 0x8f RXB.09 W.dest.0.00 0x01 /4, CPUFeature_TBM
 ######## XADD ##################################################################
 # Textbook definition of “xadd” as per AMD/Intel manuals looks like this:
 #  xadd &G E, 0x0f 0xc0, lock nacl-amd64-zero-extends
 # For consistency with the production validators, drop support for the 16-bit
 #  version of “xadd” in ia32 mode.
 # Also, don't consider xadd with memory zero-extending.
 #  See http://code.google.com/p/nativeclient/issues/detail?id=3077
 # Note that the former 32- and 64-bit validators treat “xadd” inconsistently:
@@ skipping 13 matching lines @@
 xchg &G M, 0x86, lock
 ######## XLAT ##################################################################
 xlat xb, 0xd7, nacl-forbidden
 ######## XOR ###################################################################
 xor I a, 0x34, nacl-amd64-zero-extends
 xor I E, 0x80 /6, lock nacl-amd64-zero-extends
 xor Ib Ev, 0x83 /6, lock nacl-amd64-zero-extends
 xor G E, 0x30, lock nacl-amd64-zero-extends
 xor E G, 0x32, nacl-amd64-zero-extends
 ################################################################################