disappointed with xor eax,eax \ cmovnz eax,[eax]

Index > Main > disappointed with xor eax,eax \ cmovnz eax,[eax]

Author

Thread

edemko

Joined: 18 Jul 2009
Posts: 549

edemko 21 Jun 2010, 22:22

good night(it's 1:07 due Kiev here now)
the way CPU processes a cmovCC instruction shocked me: following sequence rises memory access violation:

Code:

xor      eax,eax
cmovnz   eax,[eax]

so i got a bug which says our AMD Sempron 1400(2500++) fetches memory contents and only then solves whether it is needed or not; the pitty is it was intended to remove unwanted jumps; do you get same deal state too?; eh, my proc crashed; well, be aware optimizing, contact Fog Agner :); you know Tomasz, \ would be good instros/per line separator:

Code:

hlt \ hlt ; :(

1:21 - 8 minutes

edit: http://board.flatassembler.net/topic.php?t=1938

21 Jun 2010, 22:22

edemko

Joined: 18 Jul 2009
Posts: 549

edemko 21 Jun 2010, 22:25

Quote:

; you know Tomasz, \ would be good instros/per line separator:
hlt \ hlt ;

please

21 Jun 2010, 22:25

ouadji

Joined: 24 Dec 2008
Posts: 1081
Location: Belgium

ouadji 21 Jun 2010, 23:14

Code:

var dd 0
...
xor eax,eax
cmovnz eax,[eax] ;<------ page fault ! (cmovnz or cmovz ...same problem)
...
xor eax,eax
cmovnz eax,[var] ; <------ no problem !
...

CMOVcc—Conditional Move - Protected Mode Exceptions (Intel Vol. 2A 3-139)

#GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0) If a memory operand effective address is outside the SS
segment limit.

#PF(fault-code) If a page fault occurs. Razz

the transfer does not occur,
but the address memory is still referenced by the processor ... page fault !

#AC(0) If alignment checking is enabled and an unaligned memory
reference is made while the current privilege level is 3.

#UD If the LOCK prefix is used.

_________________
I am not young enough to know everything (Oscar Wilde)-

21 Jun 2010, 23:14

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20343
Location: In your JS exploiting you and your system

revolution 22 Jun 2010, 06:13

This is a consequence of the pipelining in the x86 architecture. The cmovcc instruction is only evaluated at the end of the pipeline, long after the operands have been fetched. So all register values and memory values much be fetched and available before the condition flags are known or tested.

IMO cmovcc in x86 is seriously broken. Most other CPU architectures with similar instructions can be used with faulting addresses when the condition fails by using deferrable memory fault generation.

22 Jun 2010, 06:13

sinsi

Joined: 10 Aug 2007
Posts: 790
Location: Adelaide

sinsi 22 Jun 2010, 06:49

Looking in the Intel docs for cmov, in the pseudo-code the first thing is

Quote:

temp ← SRC

So the first thing that happens is a memory access in your case.
Where would your code be used?

22 Jun 2010, 06:49

edemko

Joined: 18 Jul 2009
Posts: 549

edemko 22 Jun 2010, 07:27

Quote:

Where would your code be used?

Oh, i was playing with borland styled dynamic strings(re_working for ansi version again) as not satisfied with standard c-styled. I was going to make a Tool submenu(test version) in fasmw.exe and found tool absense for myself. BTW a year ago i was so naive treating them perfect that was sending them to TG and MartinMocko with the purpose those would be useful <- hahahahahahah ah. This time those are really rapid.
Real code i'll publish today later was:

Code:

;it was wariable into register pulling
test     ecx,ecx    
cmovz    ebp,ecx    
cmovnz   ebp,[ecx-4]

22 Jun 2010, 07:27

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum