Summary

is_privileged moves from ZydisInstructionDefinitionLEGACY into the non-minimal part of ZYDIS_INSTRUCTION_DEFINITION_BASE, and ZydisSetAttributes reads it before the per-encoding switch, so 3DNow!, EVEX, MVEX, VEX and XOP definitions can carry ZYDIS_ATTRIB_IS_PRIVILEGED. With the regenerated tables, ten definitions that lacked the attribute decode with it: the APX EVEX map 4 forms of ENQCMDS, INVEPT, INVPCID, INVVPID, WRUSSD and WRUSSQ, the legacy ENQCMDS form, both legacy LGDT forms and VMCALL. The definition structs are internal, so the public ABI stays the same. With the GCC and Clang bitfield layout only the 48 3DNow! table entries grow, by one byte each, and with the MSVC layout no entry grows. Twelve regression cases pin the attribute: the six EVEX forms, the four legacy definitions (LGDT in 64-bit and in 32-bit mode), CLTS as a legacy control and the EVEX form of ENQCMD as a CPL 3 control.

Intention

The flag lived in the legacy definition struct, so CPL 0 instructions in other encodings decoded without ZYDIS_ATTRIB_IS_PRIVILEGED, among them the six APX EVEX forms, whose instructions the Intel SDM (325462-093) restricts to CPL 0. The four legacy definitions gain the attribute because the companion zydis-db PR adds cpl: 0 to them: the SDM lists #GP(0) for LGDT when CPL is not 0 and states that ENQCMDS may be executed only if CPL is 0. For VMCALL the SDM lists #GP(0) when CPL is not 0 in VMX root operation, which is the case the definition records.