[AArch64] Fix problems in handling generic MSR/MRS instructions

[petpav01]

Summary

Decoding to MSRpstate should occur only if <op1><op2> represents a valid <pstatefield>, else the instruction should be decoded to a generic MSR.

[petpav01]

Any feedback on this patch? I realize it is an ugly one but I would appreciate any hints how it could be done in a cleaner way.

Thanks,
Petr Pavlu

[rengolin]

Adding Tim and James to review the patch.

lib/Target/AArch64/Disassembler/AArch64Disassembler.cpp

1506

This seems like a gross exaggeration. Is it possible that the name would come invalid for any other reason?

[petpav01]

Thank you Renato for having a look at this patch.

lib/Target/AArch64/Disassembler/AArch64Disassembler.cpp

1506

I am not sure if I am really answering your question but DecodeSystemPStateInstruction() is called only for MSRpstate and this instruction aliases with an extended MSR format (introduced in r218753). All cases not allowed by MSRpstate are valid MSR cases.

Some more background on this code:

MC instruction MSRpstate is defined to have:

Inst{31-19} = 0b1101010100000;
Inst{18-16} = pstatefield{5-3};
Inst{15-12} = 0b0100;
Inst{11-8} = imm;
Inst{7-5} = pstatefield{2-0};
Inst{4-0} = 0b11111

A problem here is that there does not seem to be a good way how to specify that only a subset of pstatefield is allowed.

Disassembling a bitpattern that should be handled as an extended MSR (but which aliases MSRpstate):

$ echo "0x1f 0x40 0x00 0xd5" | ./llvm-mc -triple=aarch64 -show-inst -show-encoding -disassemble -debug
Args: ./llvm-mc -triple=aarch64 -show-inst -show-encoding -disassemble -debug 
        .text
0: OPC_ExtractField(26, 3): 5
3: OPC_FilterValue(2, 1110): FAIL: continuing at 1117
1117: OPC_FilterValue(3, 28396): FAIL: continuing at 29517
29517: OPC_FilterValue(4, 447): FAIL: continuing at 29968
29968: OPC_FilterValue(5, 474): PASS: continuing at 29972
29972: OPC_ExtractField(29, 3): 6
29975: OPC_FilterValue(0, 4): FAIL: continuing at 29983
29983: OPC_FilterValue(1, 39): FAIL: continuing at 30026
30026: OPC_FilterValue(2, 17): FAIL: continuing at 30047
30047: OPC_FilterValue(4, 4): FAIL: continuing at 30055
30055: OPC_FilterValue(5, 39): FAIL: continuing at 30098
30098: OPC_FilterValue(6, 10539): PASS: continuing at 30102
30102: OPC_ExtractField(21, 5): 8
30105: OPC_FilterValue(0, 30): FAIL: continuing at 30139
30139: OPC_FilterValue(1, 10): FAIL: continuing at 30153
30153: OPC_FilterValue(2, 11): FAIL: continuing at 30168
30168: OPC_FilterValue(5, 30): FAIL: continuing at 30202
30202: OPC_FilterValue(8, 122): PASS: continuing at 30206
30206: OPC_ExtractField(0, 8): 31
30209: OPC_FilterValue(95, 11): FAIL: continuing at 30224
30224: OPC_FilterValue(159, 11): FAIL: continuing at 30240
30240: OPC_FilterValue(191, 11): FAIL: continuing at 30256
30256: OPC_FilterValue(223, 11): FAIL: continuing at 30272
30272: OPC_ExtractField(0, 5): 31
30275: OPC_FilterValue(31, 33): PASS: continuing at 30279
30279: OPC_ExtractField(12, 4): 4
30282: OPC_FilterValue(2, 11): FAIL: continuing at 30297
30297: OPC_FilterValue(4, 11): PASS: continuing at 30301
30301: OPC_CheckField(19, 1, 0, 5): FieldValue = 0, ExpectedValue = 0: PASS
30307: OPC_Decode: opcode 1124, using decoder 216
----- DECODE SUCCESSFUL -----
<stdin>:1:1: warning: invalid instruction encoding
0x1f 0x40 0x00 0xd5
^

My understanding of the generated disassembler is that it works in two phases. In the first phase (before "DECODE SUCCESSFUL") the disassembler matches all constant bits and determines an MC opcode. In the second phase it calls a decode method specific to the determined opcode. In this case it calls explicit decode method DecodeSystemPStateInstruction(), it sees that pstatefield is not one of SPSel, DAIFSet, DAIFClr and rejects the instruction. No programmatic limitation on field values (without changing the resulting opcode) in the first phase, or a jump from the second phase back to the first one to handle the instruction as an extended MSR (after it is rejected as MSRpstate) seems possible.

I also considered an option to instantiate only the allowed MSR (immed) instructions (e.g. to have MSRpstateSPSel, MSRpstateDAIFSet, MSRpstateDAIFClr) but that does not look right because it creates a new MC opcode for each allowed pstatefield value.

A similar problem exists in the ARM backend where the preload hints fit into holes in the encodings of the LDRH/STRH instructions. It seems to be handled similarly in the instruction decode method.

[rengolin]

@t.p.northover, @jmolloy, please have a look. I'm probably being overzealous, but I'd rather be safe than sorry.

lib/Target/AArch64/Disassembler/AArch64Disassembler.cpp

1506

I understand why it's safe to do that in your case, but I worry that there would be other cases where an invalid name won't match in your pattern. What I'm saying is that I'd like to see a way of that function return Invalid for all the cases where it IS invalid, even with your extension.

I don't know all the variations that function can cope with, but I'd be surprised if all validation on all fields was made before entering this function. You may get it right on your examples, but that doesn't mean there are other examples where that would get it wrong.

Basically, you need an active selection to make a conscious choice of acceptance and reject the unknown, instead of blindly convert whatever comes into an MSR, even if it was an MSR to begin with, it could have wrong operand values, etc.

Tim and James may have a better idea of how to do that.

[petpav01]

Updated patch adds a check that the instruction coming in DecodeSystemPStateInstruction() is really MSR (immediate) (MSRpstate in LLVM), which means it can be interpreted as the extended MSR if pstatefield is not allocated. I think it would be a logical error if the method was called for non-MSR (immediate) instructions so the code asserts this condition (instead of returning Fail).

The patch also simplifies adding of the general register operand, it is always XZR.

[jmolloy]

lib/Target/AArch64/Disassembler/AArch64Disassembler.cpp

1506

Hi Petr,

Renato, thanks for pointing me at this. Sorry it took so long.

I think this approach is fundamentally flawed, and isn't good enough as a workaround for tablegen. It assumes that this is the last operand to be decoded (implicit decoding order which the FixedLenDecoderEmitter doesn't provide), and it mutates already-decoded parts under the disassembler's feet. It's a hack, pure and simple.

I think the only reasonable way to do this is to enhance TableGen with your feature. I don't think it'll be horrendously hard, but it's something that needs to be done to avoid hacks in a nice clean backend.

Sorry.

James

[petpav01]

Hi James,

Thank you for the review. The rewrite happens in a DecoderMethod of the MSRpstate instrution, not in a DecoderMethod of an operand, so there should be no assumption it is the last operand to be decoded.

However, thanks for confirming there is currently not a good way how to implement this cleanly without modifying TableGen parts. I will have a look what could be done to support this case but it will probably take me some time to get to it.

Petr

[petpav01]

Improve decoding options for non-orthogonal instructions

When FixedLenDecoder matches an input bitpattern of form [01]+ with an
instruction bitpattern of form [01?]+ (where 0/1 are static bits and ? are
mixed/variable bits) it passes the input bitpattern to a specific instruction
decoder method which then makes a final decision whether the bitpattern is a
valid instruction or not. This means the decoder must handle all possible
values of the variable bits which sometimes leads to opcode rewrites in the
decoder method when the instructions are not fully orthogonal.

The patch provides a way for the decoder method to say that when it returns
Fail it does not necessarily mean the bitpattern is invalid, but rather that
the bitpattern is definitely not an instruction that is recognized by the
decoder method. The decoder can then try to match the input bitpattern with
other possible instruction bitpatterns.

This allows to solve a situation on AArch64 where the MSR (immediate)
instruction has form:
1101 0101 0000 0??? 0100 ???? ???1 1111
but not all values of the ? bits are allowed. The rejected values should be
handled by the extended MSR (register) instruction:
1101 0101 000? ???? ???? ???? ???? ????

The decoder will first try to decode an input bitpattern that matches both
bitpatterns as MSR (immediate) but currently this puts the decoder method of
MSR (immediate) into a situation when it must be able to decode all possible
values of the ? bits, i.e. it would need to rewrite the instruction to `MSR
(register) when it is not MSR (immediate)`.

The patch allows to specify that the decoder method cannot determine if the
instruction is valid for all variable values. The decoder method can simply
return Fail when it knows it is definitely not MSR (immediate). The decoder
will then backtrack the decoding and find that it can match the input
bitpattern with the more generic MSR (register) bitpattern too.

This behaviour could be enabled for all instruction decoders but new TryDecode
opcode is larger by 2B than the Decode opcode. Using TryDecode for all
instruction on AArch64 increased size of the decoder table from 44kB to
49kB. The expectation is that most encodings are orthogonal so this should be
enabled only in exceptional cases to prevent any slowdown with additional
matching+decoding and size bloat.

[jmolloy]

Hi Petr,

This generally looks good to me. Apart from the nits in the comments below, generally:

• The tablegen+tests changes need to be split from the ARM changes and applied in two separate patches.
• The spelling correction needs to be split out and committed as its own (trivial, needs no code review) patch.

Cheers,

James

utils/TableGen/FixedLenDecoderEmitter.cpp

1084 ↗

(On Diff #29065)

Merge lines 1084 and 1085 together.

1899 ↗

(On Diff #29065)

You can use dyn_cast_or_null here:

BitInit *BI = dyn_cast_or_null<BitInit>(TypeRecord->getValue("hasCompleteDecoder")); 
bool HasCompleteDecoder = BI ? BI->getValue() : true;

1976 ↗

(On Diff #29065)

Same comment as in line 1899.

2179 ↗

(On Diff #29065)

Why change SUCCESSFUL to COMPLETE here?

[petpav01]

Hi James,

Thank you for the review. I will split the changes into three separate patches as you suggested before committing (typo fix, TableGen, AArch64 part).
Other comments are inlined.

Thanks,
Petr

utils/TableGen/FixedLenDecoderEmitter.cpp

1899 ↗

(On Diff #29065)

This would need

BitInit *BI = dyn_cast_or_null<BitInit>(TypeRecord->getValue("hasCompleteDecoder")->getValue());

but TypeRecord->getValue("hasCompleteDecoder") can be nullptr so that cannot be used.

2179 ↗

(On Diff #29065)

I believe the original intention of this message was to give information that the "filter decoding" part in FixedLenDecoder was successful. This is ok but the bitpattern then gets passed by FixedLenDecoder to a specific decoder method, it can reject the bitpattern and so the decoding as a whole fails.

This created a bit confusing output from llvm-mc -disassemble -debug when the input bitpattern was invalid. It would contain 'DECODE SUCCESSFUL' followed by 'invalid instruction encoding':

$ echo "0x1f 0x40 0x00 0xd5" | llvm-mc -triple=aarch64 -show-inst -show-encoding -disassemble -debug
[...]
31211: OPC_CheckField(19, 1, 0, 5): FieldValue = 0, ExpectedValue = 0: PASS
31217: OPC_Decode: opcode 1283, using decoder 220
----- DECODE SUCCESSFUL -----
<stdin>:1:1: warning: invalid instruction encoding
0x1f 0x40 0x00 0xd5
^

The patch changed this to printing 'DECODE COMPLETE' when FixedLenDecoder fully finished the decoding (including running any decoding methods).

However, it might be better to simply remove this message because it does not provide much information (OPC_Decode implies end of decoding similarly to OPC_Fail) and additionally extend the OPC_Decode debug message with a result returned from the decoding method. I will update the patch.

[petpav01]

Updated patch fixes formatting problems and corrects the debugging output.

[jmolloy]

I think this is reasonable. Please go ahead and commit.

lib/Target/AArch64/AsmParser/AArch64AsmParser.cpp

private:
 
   bool parseDirectiveLOH(StringRef LOH, SMLoc L);
   bool parseDirectiveLtorg(SMLoc L);
 
   bool parseDirectiveReq(StringRef Name, SMLoc L);
   bool parseDirectiveUnreq(SMLoc L);
 
   bool validateInstruction(MCInst &Inst, SmallVectorImpl<SMLoc> &Loc);
+  void canonizeSystemInstruction(MCInst &Inst);
   bool MatchAndEmitInstruction(SMLoc IDLoc, unsigned &Opcode,
                                OperandVector &Operands, MCStreamer &Out,
                                uint64_t &ErrorInfo,
                                bool MatchingInlineAsm) override;
 /// @name Auto-generated Match Functions
 /// {
 
 #define GET_ASSEMBLER_HEADER
case AArch64::SUBXri: {
     }
     return false;
   }
   default:
     return false;
   }
 }
 
+void AArch64AsmParser::canonizeSystemInstruction(MCInst &Inst) {
+  // Assembler accepts extended MSR/MRS format with the <systemreg> having
+  // <op0> in <0,3>. However, such MCInst instructions can alias to other
+  // system instructions and so two different MCInsts could encode to a same
+  // bitpattern. This function fixes the problem by rewriting the problematic
+  // instructions to their canonical MCInst.
+
+  uint64_t Bits;
+  if (Inst.getOpcode() == AArch64::MSR)
+    Bits = Inst.getOperand(0).getImm();
+  else if (Inst.getOpcode() == AArch64::MRS)
+    Bits = Inst.getOperand(1).getImm();
+  else
+    return;
+
+  // Bits encodes <systemreg>.
+  uint64_t Op0 = (Bits >> 14) & 0x3;
+  uint64_t Op1 = (Bits >> 11) & 0x7;
+  uint64_t CRn = (Bits >> 7) & 0xF;
+  uint64_t CRm = (Bits >> 3) & 0xF;
+  uint64_t Op2 = (Bits >> 0) & 0x7;
+
+  switch (Inst.getOpcode()) {
+  case AArch64::MSR: {
+    // MSR can be rewritten to HINT, CLREX, DMB, DSB, ISB, MSRpstate, or
+    // SYSxt.
+
+    if (Op0 == 0x0 && Inst.getOperand(1).getReg() == AArch64::XZR) {
+      // If <op0> is 0b00 and <Rt> is 0b11111 then it can be HINT, CLREX, DMB,
+      // DSB, ISB, or MSRpstate.
+
+      if (CRn == 0x4) {
+        // If <CRn> is 0b0100 and <op1><op2> represent a valid <pstatefield>
+        // then it is MSRpstate.
+
+        uint64_t PStateField = (Op1 << 3) | Op2;
+        bool ValidNamed;
+        (void)AArch64PState::PStateMapper().toString(PStateField, ValidNamed);
+
+        if (ValidNamed) {
+          Inst.setOpcode(AArch64::MSRpstate);
+          Inst.clear();
+          Inst.addOperand(MCOperand::CreateImm(PStateField));
+          Inst.addOperand(MCOperand::CreateImm(CRm));
+        }
+      } else if (Op1 == 0x3) {
+        // If <op1> is 0b011 then it can be HINT, CLREX, DMB, DSB, or ISB.
+
+        if (CRn == 0x2) {
+          // If <CRn> is 0b0010 then it is HINT.
+          Inst.setOpcode(AArch64::HINT);
+          Inst.clear();
+          Inst.addOperand(MCOperand::CreateImm((CRm << 4 ) | Op2));
+        } else if (Op1 == 0x3 && CRn == 0x3) {
+          // If <Op1> is 0b011 and <CRn> is 0b0011 then it can be CLREX, DMB,
+          // DSB, or ISB.
+          if (Op2 == 0x2) {
+            // If <Op2> is 0b010 then it is CLREX.
+            Inst.setOpcode(AArch64::CLREX);
+            Inst.clear();
+            Inst.addOperand(MCOperand::CreateImm(CRm));
+          } else if (Op2 == 0x4) {
+            // If <Op2> is 0b100 then it is DMB.
+            Inst.setOpcode(AArch64::DMB);
+            Inst.clear();
+            Inst.addOperand(MCOperand::CreateImm(CRm));
+          } else if (Op2 == 0x5) {
+            // If <Op2> is 0b101 then it is DSB.
+            Inst.setOpcode(AArch64::DSB);
+            Inst.clear();
+            Inst.addOperand(MCOperand::CreateImm(CRm));
+          } else if (Op2 == 0x6) {
+            // If <Op2> is 0b110 then it is ISB.
+            Inst.setOpcode(AArch64::ISB);
+            Inst.clear();
+            Inst.addOperand(MCOperand::CreateImm(CRm));
+          }
+        }
+      }
+    } else if (Op0 == 0x1) {
+      // If <op0> is 0b01 then it is SYSxt.
+      Inst.setOpcode(AArch64::SYSxt);
+      unsigned Reg = Inst.getOperand(1).getReg();
+      Inst.clear();
+      Inst.addOperand(MCOperand::CreateImm(Op1));
+      Inst.addOperand(MCOperand::CreateImm(CRn));
+      Inst.addOperand(MCOperand::CreateImm(CRm));
+      Inst.addOperand(MCOperand::CreateImm(Op2));
+      Inst.addOperand(MCOperand::CreateReg(Reg));
+    }
+    break;
+  }
+  case AArch64::MRS:
+    // MRS can be rewritten to SYSLXt.
+
+    if (Op0 == 0x1) {
+      // If <op0> is 0b01 then it is SYSLxt.
+      Inst.setOpcode(AArch64::SYSLxt);
+      unsigned Reg = Inst.getOperand(0).getReg();
+      Inst.clear();
+      Inst.addOperand(MCOperand::CreateReg(Reg));
+      Inst.addOperand(MCOperand::CreateImm(Op1));
+      Inst.addOperand(MCOperand::CreateImm(CRn));
+      Inst.addOperand(MCOperand::CreateImm(CRm));
+      Inst.addOperand(MCOperand::CreateImm(Op2));
+    }
+    break;
+  }
+}
+
 bool AArch64AsmParser::showMatchError(SMLoc Loc, unsigned ErrCode) {
   switch (ErrCode) {
   case Match_MissingFeature:
     return Error(Loc,
                  "instruction requires a CPU feature not currently enabled");
   case Match_InvalidOperand:
     return Error(Loc, "invalid operand for instruction");
   case Match_InvalidSuffix:
case Match_Success: {
     // Perform range checking and other semantic validations
     SmallVector<SMLoc, 8> OperandLocs;
     NumOperands = Operands.size();
     for (unsigned i = 1; i < NumOperands; ++i)
       OperandLocs.push_back(Operands[i]->getStartLoc());
     if (validateInstruction(Inst, OperandLocs))
       return true;
 
+    // Rewrite any MSR/MRS to their canonical form.
+    canonizeSystemInstruction(Inst);
+
     Inst.setLoc(IDLoc);
     Out.EmitInstruction(Inst, STI);
     return false;
   }
   case Match_MissingFeature: {
     assert(ErrorInfo && "Unknown missing feature!");
     // Special case the error message for the very common case where only
     // a single subtarget feature is missing (neon, e.g.).

lib/Target/AArch64/Disassembler/AArch64Disassembler.cpp

static DecodeStatus DecodeUnconditionalBranch(llvm::MCInst &Inst, uint32_t insn,
   return Success;
 }
 
 static DecodeStatus DecodeSystemPStateInstruction(llvm::MCInst &Inst,
                                                   uint32_t insn, uint64_t Addr,
                                                   const void *Decoder) {
   uint64_t op1 = fieldFromInstruction(insn, 16, 3);
   uint64_t op2 = fieldFromInstruction(insn, 5, 3);
-  uint64_t crm = fieldFromInstruction(insn, 8, 4);
 
   uint64_t pstate_field = (op1 << 3) | op2;
 
-  Inst.addOperand(MCOperand::CreateImm(pstate_field));
-  Inst.addOperand(MCOperand::CreateImm(crm));
-
   bool ValidNamed;
   (void)AArch64PState::PStateMapper().toString(pstate_field, ValidNamed);
 
-  return ValidNamed ? Success : Fail;
+  // If the name is not valid then the instruction must be threated as the
+  // extended MSR.
+  // FIXME This should be specified in TableGen but it is not currently
+  // possible due to TableGen limitations.
+  if (!ValidNamed) {
+    uint64_t systemreg = fieldFromInstruction(insn, 5, 16);
+    uint64_t Rt = fieldFromInstruction(insn, 0, 5);
+    unsigned Register = GPR64DecoderTable[Rt];
+
+    Inst.setOpcode(AArch64::MSR);
+    Inst.addOperand(MCOperand::CreateImm(systemreg));
+    Inst.addOperand(MCOperand::CreateReg(Register));
+
+    return Success;
+  }
+
+  // Valid MSR <pstatefield>, #<imm>.
+  uint64_t crm = fieldFromInstruction(insn, 8, 4);
+
+  Inst.addOperand(MCOperand::CreateImm(pstate_field));
+  Inst.addOperand(MCOperand::CreateImm(crm));
+
+  return Success;
 }
 
 static DecodeStatus DecodeTestAndBranch(llvm::MCInst &Inst, uint32_t insn,
                                         uint64_t Addr, const void *Decoder) {
   uint64_t Rt = fieldFromInstruction(insn, 0, 5);
   uint64_t bit = fieldFromInstruction(insn, 31, 1) << 5;
   bit |= fieldFromInstruction(insn, 19, 5);
   int64_t dst = fieldFromInstruction(insn, 5, 14);

test/MC/AArch64/arm64-system-encoding.s

;-----------------------------------------------------------------------------
   msr VBAR_EL3, x3
   msr VMPIDR_EL2, x3
   msr VPIDR_EL2, x3
   msr VTCR_EL2, x3
   msr VTTBR_EL2, x3
   msr SPSel, x3
   msr S3_2_C11_C6_4, x1
   msr  S0_0_C0_C0_0, x0
-  msr  S1_2_C3_C4_5, x2
 ; CHECK: msr ACTLR_EL1, x3              ; encoding: [0x23,0x10,0x18,0xd5]
 ; CHECK: msr ACTLR_EL2, x3              ; encoding: [0x23,0x10,0x1c,0xd5]
 ; CHECK: msr ACTLR_EL3, x3              ; encoding: [0x23,0x10,0x1e,0xd5]
 ; CHECK: msr AFSR0_EL1, x3              ; encoding: [0x03,0x51,0x18,0xd5]
 ; CHECK: msr AFSR0_EL2, x3              ; encoding: [0x03,0x51,0x1c,0xd5]
 ; CHECK: msr AFSR0_EL3, x3              ; encoding: [0x03,0x51,0x1e,0xd5]
 ; CHECK: msr AFSR1_EL1, x3              ; encoding: [0x23,0x51,0x18,0xd5]
 ; CHECK: msr AFSR1_EL2, x3              ; encoding: [0x23,0x51,0x1c,0xd5]

 ; CHECK: msr VBAR_EL3, x3               ; encoding: [0x03,0xc0,0x1e,0xd5]
 ; CHECK: msr VMPIDR_EL2, x3             ; encoding: [0xa3,0x00,0x1c,0xd5]
 ; CHECK: msr VPIDR_EL2, x3              ; encoding: [0x03,0x00,0x1c,0xd5]
 ; CHECK: msr VTCR_EL2, x3               ; encoding: [0x43,0x21,0x1c,0xd5]
 ; CHECK: msr VTTBR_EL2, x3              ; encoding: [0x03,0x21,0x1c,0xd5]
 ; CHECK: msr  SPSEL, x3                 ; encoding: [0x03,0x42,0x18,0xd5]
 ; CHECK: msr  S3_2_C11_C6_4, x1         ; encoding: [0x81,0xb6,0x1a,0xd5]
 ; CHECK: msr  S0_0_C0_C0_0, x0          ; encoding: [0x00,0x00,0x00,0xd5]
-; CHECK: msr  S1_2_C3_C4_5, x2          ; encoding: [0xa2,0x34,0x0a,0xd5]
 
   mrs x3, ACTLR_EL1
   mrs x3, ACTLR_EL2
   mrs x3, ACTLR_EL3
   mrs x3, AFSR0_EL1
   mrs x3, AFSR0_EL2
   mrs x3, AFSR0_EL3
   mrs x3, AIDR_EL1

 ; CHECK: mrs  x0, ID_ISAR1_EL1        ; encoding: [0x20,0x02,0x38,0xd5]
 ; CHECK: mrs  x0, ID_ISAR2_EL1        ; encoding: [0x40,0x02,0x38,0xd5]
 ; CHECK: mrs  x0, ID_ISAR3_EL1        ; encoding: [0x60,0x02,0x38,0xd5]
 ; CHECK: mrs  x0, ID_ISAR4_EL1        ; encoding: [0x80,0x02,0x38,0xd5]
 ; CHECK: mrs  x0, ID_ISAR5_EL1        ; encoding: [0xa0,0x02,0x38,0xd5]
 ; CHECK: mrs  x0, AFSR1_EL1           ; encoding: [0x20,0x51,0x38,0xd5]
 ; CHECK: mrs  x0, AFSR0_EL1           ; encoding: [0x00,0x51,0x38,0xd5]
 ; CHECK: mrs  x0, REVIDR_EL1          ; encoding: [0xc0,0x00,0x38,0xd5]
+
+;-----------------------------------------------------------------------------
+; Generic MSR/MRS instructions that alias more specific system instructions
+;-----------------------------------------------------------------------------
+
+msr S0_3_C2_C0_0, xzr
+msr S0_3_C2_C0_1, xzr
+msr S0_3_C2_C0_2, xzr
+msr S0_3_C2_C0_3, xzr
+msr S0_3_C2_C0_4, xzr
+msr S0_3_C2_C0_5, xzr
+msr S0_3_C2_C1_0, xzr
+msr S0_3_C3_C0_2, xzr
+msr S0_3_C3_C0_4, xzr
+msr S0_3_C3_C0_5, xzr
+msr S0_3_C3_C0_6, xzr
+msr S0_0_C4_C1_5, xzr
+msr S0_3_C4_C2_6, xzr
+msr S0_3_C4_C3_7, xzr
+msr S1_2_C3_C4_5, x0
+msr S1_2_C3_C4_5, xzr
+mrs x0, S1_2_C3_C4_5
+
+; CHECK: nop                            ; encoding: [0x1f,0x20,0x03,0xd5]
+; CHECK: yield                          ; encoding: [0x3f,0x20,0x03,0xd5]
+; CHECK: wfe                            ; encoding: [0x5f,0x20,0x03,0xd5]
+; CHECK: wfi                            ; encoding: [0x7f,0x20,0x03,0xd5]
+; CHECK: sev                            ; encoding: [0x9f,0x20,0x03,0xd5]
+; CHECK: sevl                           ; encoding: [0xbf,0x20,0x03,0xd5]
+; CHECK: hint    #0x10                  ; encoding: [0x1f,0x22,0x03,0xd5]
+; CHECK: clrex   #0                     ; encoding: [0x5f,0x30,0x03,0xd5]
+; CHECK: dmb     #0                     ; encoding: [0xbf,0x30,0x03,0xd5]
+; CHECK: dsb     #0                     ; encoding: [0x9f,0x30,0x03,0xd5]
+; CHECK: isb     #0                     ; encoding: [0xdf,0x30,0x03,0xd5]
+; CHECK: msr     SPSEL, #1              ; encoding: [0xbf,0x41,0x00,0xd5]
+; CHECK: msr     DAIFSET, #2            ; encoding: [0xdf,0x42,0x03,0xd5]
+; CHECK: msr     DAIFCLR, #3            ; encoding: [0xff,0x43,0x03,0xd5]
+; CHECK: sys     #2, c3, c4, #5, x0     ; encoding: [0xa0,0x34,0x0a,0xd5]
+; CHECK: sys     #2, c3, c4, #5         ; encoding: [0xbf,0x34,0x0a,0xd5]
+; CHECK: sysl    x0, #2, c3, c4, #5     ; encoding: [0xa0,0x34,0x2a,0xd5]

test/MC/AArch64/basic-a64-instructions.s

 // CHECK: mrs      x9, {{pmevtyper26_el0|PMEVTYPER26_EL0}}        // encoding: [0x49,0xef,0x3b,0xd5]
 // CHECK: mrs      x9, {{pmevtyper27_el0|PMEVTYPER27_EL0}}        // encoding: [0x69,0xef,0x3b,0xd5]
 // CHECK: mrs      x9, {{pmevtyper28_el0|PMEVTYPER28_EL0}}        // encoding: [0x89,0xef,0x3b,0xd5]
 // CHECK: mrs      x9, {{pmevtyper29_el0|PMEVTYPER29_EL0}}        // encoding: [0xa9,0xef,0x3b,0xd5]
 // CHECK: mrs      x9, {{pmevtyper30_el0|PMEVTYPER30_EL0}}        // encoding: [0xc9,0xef,0x3b,0xd5]
 
         mrs x12, s3_7_c15_c1_5
         mrs x13, s3_2_c11_c15_7
-        mrs x14, s1_3_c9_c2_1
         msr s3_0_c15_c0_0, x12
         msr s3_7_c11_c13_7, x5
-        msr s1_3_c9_c2_1, x4
 // CHECK: mrs     x12, {{s3_7_c15_c1_5|S3_7_C15_C1_5}}      // encoding: [0xac,0xf1,0x3f,0xd5]
 // CHECK: mrs     x13, {{s3_2_c11_c15_7|S3_2_C11_C15_7}}    // encoding: [0xed,0xbf,0x3a,0xd5]
-// CHECK: mrs     x14, {{s1_3_c9_c2_1|S1_3_C9_C2_1}}        // encoding: [0x2e,0x92,0x2b,0xd5]
 // CHECK: msr     {{s3_0_c15_c0_0|S3_0_C15_C0_0}}, x12      // encoding: [0x0c,0xf0,0x18,0xd5]
 // CHECK: msr     {{s3_7_c11_c13_7|S3_7_C11_C13_7}}, x5     // encoding: [0xe5,0xbd,0x1f,0xd5]
-// CHECK: msr     {{s1_3_c9_c2_1|S1_3_C9_C2_1}}, x4         // encoding: [0x24,0x92,0x0b,0xd5]
 
 //------------------------------------------------------------------------------
 // Unconditional branch (immediate)
 //------------------------------------------------------------------------------
 
         tbz x5, #0, somewhere
         tbz xzr, #63, elsewhere
         tbnz x5, #45, nowhere

test/MC/Disassembler/AArch64/basic-a64-instructions.txt

 0x49 0xef 0x3b 0xd5
 0x69 0xef 0x3b 0xd5
 0x89 0xef 0x3b 0xd5
 0xa9 0xef 0x3b 0xd5
 0xc9 0xef 0x3b 0xd5
 
 # CHECK: mrs     x12, {{s3_7_c15_c1_5|S3_7_C15_C1_5}}
 # CHECK: mrs     x13, {{s3_2_c11_c15_7|S3_2_C11_C15_7}}
+# CHECK: mrs     xzr, {{s0_0_c4_c0_0|S0_0_C4_C0_0}}
 # CHECK: msr     {{s3_0_c15_c0_0|S3_0_C15_C0_0}}, x12
 # CHECK: msr     {{s3_7_c11_c13_7|S3_7_C11_C13_7}}, x5
+# CHECK: msr     {{s0_0_c4_c0_0|S0_0_C4_C0_0}}, xzr
 0xac 0xf1 0x3f 0xd5
 0xed 0xbf 0x3a 0xd5
+0x1f 0x40 0x20 0xd5
 0x0c 0xf0 0x18 0xd5
 0xe5 0xbd 0x1f 0xd5
+0x1f 0x40 0x00 0xd5
 
 #------------------------------------------------------------------------------
 # Test and branch (immediate)
 #------------------------------------------------------------------------------
 
 # CHECK: tbz     x12, #62, #0
 # CHECK: tbz     x12, #62, #4
 # CHECK: tbz     x12, #62, #-32768