Skip to content

[bug] Fixed EVEX encoder accepting {k1} on unsupported insns#520

Open
es3n1n wants to merge 3 commits into
asmjit:masterfrom
es3n1n:es3n1n/evex-mask-gate
Open

[bug] Fixed EVEX encoder accepting {k1} on unsupported insns#520
es3n1n wants to merge 3 commits into
asmjit:masterfrom
es3n1n:es3n1n/evex-mask-gate

Conversation

@es3n1n

@es3n1n es3n1n commented Apr 20, 2026

Copy link
Copy Markdown

based on #513

  1. the validator at x86instapi.cpp:721 already rejects extra_reg=kN on instructions without has_avx512_k(), but the encoder's EmitVexEvexR/EmitVexEvexM path just ORs _extra_reg.id() << 16 into the EVEX aaa field and emits. so in the default path (kValidateAssembler off), setExtraReg(k1); emit(vpextrb, ...) produces EVEX bytes with aaa != 0 on an instruction where aaa must be 000 - #UD at runtime

  2. isa_x86.json had wrong {kz} markers on vpinsrb/vpinsrw/vpinsrd/vpinsrq EVEX rows and on the vmovw W:xmm {kz}, r32/m16 row. intel sdm shows these with plain operand syntax - no {k1}{z} in the instruction reference. so infoById().hasAvx512K() returned a lie and the encoder gate would fall through for those mnemonics even after fix 1

https://revers.engineering/x86/pextrb.pdf
https://revers.engineering/x86/pinsrb.pdf
https://revers.engineering/x86/movw.pdf

es3n1n added 3 commits April 20, 2026 14:14
The x86 test file already defines this macro for the
commented-out failure block; mirror it on the x64 side so future
PRs can add FAIL_INSTRUCTION(...) cases inline without
reintroducing the macro each time.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant