assemblyx86disassemblyprotected-mode

x86 long mode specific instructions available on protected mode?


Hey I'm wondering about some instructions that should only be valid in longmode.

For example 0f 20 55 - mov rbp, cr2.

I'm referencing ref.x86asm.net xml mapping.
According to the xml the mode of operation of this instruction is e which means:

e applies for 64-bit mode. SMM is not taken into account. 63 MOVSXD

Now if I look at disassemblers such as GCC or capstone, the byte stream 0f 20 55 is being decoded to mov ebp, cr2 on protected mode even tho the reference is saying it shouldn't be available on modes other than x64.

So I'm wondering if I'm not understanding something or these disassemblers are at fault?


Solution

  • Moves to and from control registers are available in protected mode and long mode, using the same encoding, but with a different meaning. mov rbp, cr2 is only available in long mode (obviously, it writes to a 64bit GPR which only exists in long mode) and mov ebp, cr2 is only available in protected mode (it is not inherently impossible in long mode, but its encoding was reused for mov rbp, cr2, just as the encoding of push eax was reused to mean push rax). The disassemblers correctly interpreted the same machine code differently depending on the mode.