; Copyright (c) 2014-2017, Intel Corporation

;

; Redistribution and use in source and binary forms, with or without

; modification, are permitted provided that the following conditions are met:

;

;  * Redistributions of source code must retain the above copyright notice,

;    this list of conditions and the following disclaimer.

;  * Redistributions in binary form must reproduce the above copyright notice,

;    this list of conditions and the following disclaimer in the documentation

;    and/or other materials provided with the distribution.

;  * Neither the name of Intel Corporation nor the names of its contributors

;    may be used to endorse or promote products derived from this software

;    without specific prior written permission.

;

; THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"

; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

; IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

; ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE

; LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

; CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

; SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

; INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN

; CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

; ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

; POSSIBILITY OF SUCH DAMAGE.

; BDM64: An Incorrect LBR or Intel(R) Processor Trace Packet May Be

;        Recorded Following a Transactional Abort.

;

;        Use of Intel(R) Transactional Synchronization Extensions (Intel(R) TSX)

;        may result in a transactional abort.  If an abort occurs immediately

;        following a branch instruction, an incorrect branch target may be

;        logged in an LBR (Last Branch Record) or in an Intel(R) Processor Trace

;        (Intel(R) PT) packet before the LBR or Intel PT packet produced by the

;        abort.

;

;   cpu 6/61

;   cpu 6/71

;   cpu 6/79

;   cpu 6/86

;

; Variant: conditional branch followed by another conditional branch to

;          tell us that we're on the wrong track.

;

org 0x100000

bits 64

; @pt p1: psb()

; @pt p2: mode.exec(64bit)

; @pt p3: mode.tsx(begin)

; @pt p4: fup(3: %l1)

; @pt p5: psbend()

l1:     test [rax], rbx

l2:     je l5

; @pt p6: tnt(n)

;

; The branch destination is bad.

;

; There is no way for us to know this as long as we can reach the bad

; branch destination without further Intel PT support.

;

; If we cannot reach it, however, we know that the branch was bad.

;

l3:     nop

l4:     je l9

l5:     hlt

l6:     hlt

; We immediately take an xabort from there

;

; @pt p7: mode.tsx(abort)

; @pt p8: fup(1: %l5)

; @pt p9: tip(1: %l7)

l7:     nop

; @pt p10: fup(1: %l8)

; @pt p11: tip.pgd(0: %l9)

l8:     nop

l9:     hlt

; @pt .exp(ptdump)

;%0p1   psb

;%0p2   mode.exec  cs.l

;%0p3   mode.tsx   intx

;%0p4   fup        3: %0l1

;%0p5   psbend

;%0p6   tnt.8      .

;%0p7   mode.tsx   abrt

;%0p8   fup        1: %?l5.2

;%0p9   tip        1: %?l7.2

;%0p10  fup        1: %?l8.2

;%0p11  tip.pgd    0: %?l9.0

; @pt .exp(ptxed)

;? %0l1 # test [rax], rbx

;? %0l2 # je l5

;[interrupt]

;[aborted]

;%0l7 # nop

;[disabled]