; Copyright (c) 2014-2021, Intel Corporation
;
; Redistribution and use in source and binary forms, with or without
; modification, are permitted provided that the following conditions are met:
;
;  * Redistributions of source code must retain the above copyright notice,
;    this list of conditions and the following disclaimer.
;  * Redistributions in binary form must reproduce the above copyright notice,
;    this list of conditions and the following disclaimer in the documentation
;    and/or other materials provided with the distribution.
;  * Neither the name of Intel Corporation nor the names of its contributors
;    may be used to endorse or promote products derived from this software
;    without specific prior written permission.
;
; THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
; IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
; ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
; LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
; CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
; SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
; INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
; CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
; ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
; POSSIBILITY OF SUCH DAMAGE.

; BDM64: An Incorrect LBR or Intel(R) Processor Trace Packet May Be
;        Recorded Following a Transactional Abort.
;
;        Use of Intel(R) Transactional Synchronization Extensions (Intel(R) TSX)
;        may result in a transactional abort.  If an abort occurs immediately
;        following a branch instruction, an incorrect branch target may be
;        logged in an LBR (Last Branch Record) or in an Intel(R) Processor Trace
;        (Intel(R) PT) packet before the LBR or Intel PT packet produced by the
;        abort.
;
;   cpu 6/61
;   cpu 6/71
;   cpu 6/79
;   cpu 6/86
;
; Variant: conditional branch followed by an indirect call to tell us that
;          we're on the wrong track.
;

org 0x100000
bits 64

; @pt p1: psb()
; @pt p2: mode.exec(64bit)
; @pt p3: mode.tsx(begin)
; @pt p4: fup(3: %l1)
; @pt p5: psbend()

l1:     test [rax], rbx
l2:     je l5

; @pt p6: tnt(n)
;
; The branch destination is bad.
;
; There is no way for us to know this as long as we can reach the bad
; branch destination without further Intel PT support.
;
; If we cannot reach it, however, we know that the branch was bad.
;
l3:     nop
l4:     call rax

l5:     hlt
l6:     hlt

; We immediately take an xabort from there
;
; @pt p7: mode.tsx(abort)
; @pt p8: fup(1: %l5)
; @pt p9: tip(1: %l7)

l7:     nop

; @pt p10: fup(1: %l8)
; @pt p11: tip.pgd(0: %l9)
l8:     nop
l9:     hlt


; @pt .exp(ptdump)
;%0p1   psb
;%0p2   mode.exec  cs.l
;%0p3   mode.tsx   intx
;%0p4   fup        3: %0l1
;%0p5   psbend
;%0p6   tnt.8      .
;%0p7   mode.tsx   abrt
;%0p8   fup        1: %?l5.2
;%0p9   tip        1: %?l7.2
;%0p10  fup        1: %?l8.2
;%0p11  tip.pgd    0: %?l9.0


; @pt .exp(ptxed)
;? %0l1 # test [rax], rbx
;? %0l2 # je l5
;[aborted]
;[interrupt]
;%0l7 # nop
;[disabled]