3

There are some x86 instructions which containing a low-level** control flow in its semantics, for example div because its semantics is roughly as:

if (source == 0)
   throw exception...
else
   return rdx:rax / source

or instructions with rep prefix, etc. While a mov or a xor doesn't contain any control flow.

I am trying to classify instructions of x86 ISA depending on this criteria, my starting point now is looking into Xed's API to know if there exists some function which can give such an information, but it doesn't seem having any.

Concretely for div, I've checked xed_decoded_inst_conditionally_writes_registers, xed_operand_conditional_read/write, but all of them return false.

** I'm sorry for this word, I don't know the precise terminology for this case.

Edit: many thanks for comments but I've badly expressed my question. I update in the following some discussion to make the context more clear.

Xed's API would not give full instruction semantics, but some. For example, with some xed API (which I described above) we can get:

mov rax, r8

operands:                       2
uses rflag:                     no
has conditional read operand:   no
has conditional write operand:  no
conditionally write register:   no

and

cmovb rax, r8

operands:                       3
uses rflag:                     yes
has conditional read operand:   no
has conditional write operand:  yes
conditionally write register:   yes

so at least I know that cmovb should have some conditional control flow in its semantics, while mov has not.

I tried to apply this logic for other instructions: it works for some (e.g. rep movsb, etc.), but not all:

  • for div*** (or mov), it would be "acceptable"* to say that there is no conditional control flow, IMHO. We consider that an exception is side effect: the instruction is not executed (or only partially executed) if the exception is thrown
  • for other cases of, e.g. minps, this logic simply doesn't work

*** I have initially thought that div contains conditional data-flow, but changed later :)

  • 2
    Not automated, but in the Intel manual for instructions there is information about when exceptions happen. See for example c9x.me/x86/html/file_module_x86_id_176.html – mrexodia Sep 15 '18 at 17:27
  • 2
    A mov or xor may alter control flow in the same way by triggering a page fault eception with invalid memory access. – Abigail Sep 16 '18 at 2:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.