1 //===-- X86Disassembler.cpp - Disassembler for x86 and x86_64 -------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file is part of the X86 Disassembler. 10 // It contains code to translate the data produced by the decoder into 11 // MCInsts. 12 // 13 // 14 // The X86 disassembler is a table-driven disassembler for the 16-, 32-, and 15 // 64-bit X86 instruction sets. The main decode sequence for an assembly 16 // instruction in this disassembler is: 17 // 18 // 1. Read the prefix bytes and determine the attributes of the instruction. 19 // These attributes, recorded in enum attributeBits 20 // (X86DisassemblerDecoderCommon.h), form a bitmask. The table CONTEXTS_SYM 21 // provides a mapping from bitmasks to contexts, which are represented by 22 // enum InstructionContext (ibid.). 23 // 24 // 2. Read the opcode, and determine what kind of opcode it is. The 25 // disassembler distinguishes four kinds of opcodes, which are enumerated in 26 // OpcodeType (X86DisassemblerDecoderCommon.h): one-byte (0xnn), two-byte 27 // (0x0f 0xnn), three-byte-38 (0x0f 0x38 0xnn), or three-byte-3a 28 // (0x0f 0x3a 0xnn). Mandatory prefixes are treated as part of the context. 29 // 30 // 3. Depending on the opcode type, look in one of four ClassDecision structures 31 // (X86DisassemblerDecoderCommon.h). Use the opcode class to determine which 32 // OpcodeDecision (ibid.) to look the opcode in. Look up the opcode, to get 33 // a ModRMDecision (ibid.). 34 // 35 // 4. Some instructions, such as escape opcodes or extended opcodes, or even 36 // instructions that have ModRM*Reg / ModRM*Mem forms in LLVM, need the 37 // ModR/M byte to complete decode. The ModRMDecision's type is an entry from 38 // ModRMDecisionType (X86DisassemblerDecoderCommon.h) that indicates if the 39 // ModR/M byte is required and how to interpret it. 40 // 41 // 5. After resolving the ModRMDecision, the disassembler has a unique ID 42 // of type InstrUID (X86DisassemblerDecoderCommon.h). Looking this ID up in 43 // INSTRUCTIONS_SYM yields the name of the instruction and the encodings and 44 // meanings of its operands. 45 // 46 // 6. For each operand, its encoding is an entry from OperandEncoding 47 // (X86DisassemblerDecoderCommon.h) and its type is an entry from 48 // OperandType (ibid.). The encoding indicates how to read it from the 49 // instruction; the type indicates how to interpret the value once it has 50 // been read. For example, a register operand could be stored in the R/M 51 // field of the ModR/M byte, the REG field of the ModR/M byte, or added to 52 // the main opcode. This is orthogonal from its meaning (an GPR or an XMM 53 // register, for instance). Given this information, the operands can be 54 // extracted and interpreted. 55 // 56 // 7. As the last step, the disassembler translates the instruction information 57 // and operands into a format understandable by the client - in this case, an 58 // MCInst for use by the MC infrastructure. 59 // 60 // The disassembler is broken broadly into two parts: the table emitter that 61 // emits the instruction decode tables discussed above during compilation, and 62 // the disassembler itself. The table emitter is documented in more detail in 63 // utils/TableGen/X86DisassemblerEmitter.h. 64 // 65 // X86Disassembler.cpp contains the code responsible for step 7, and for 66 // invoking the decoder to execute steps 1-6. 67 // X86DisassemblerDecoderCommon.h contains the definitions needed by both the 68 // table emitter and the disassembler. 69 // X86DisassemblerDecoder.h contains the public interface of the decoder, 70 // factored out into C for possible use by other projects. 71 // X86DisassemblerDecoder.c contains the source code of the decoder, which is 72 // responsible for steps 1-6. 73 // 74 //===----------------------------------------------------------------------===// 75 76 #include "MCTargetDesc/X86BaseInfo.h" 77 #include "MCTargetDesc/X86MCTargetDesc.h" 78 #include "TargetInfo/X86TargetInfo.h" 79 #include "X86DisassemblerDecoder.h" 80 #include "llvm/MC/MCContext.h" 81 #include "llvm/MC/MCDisassembler/MCDisassembler.h" 82 #include "llvm/MC/MCExpr.h" 83 #include "llvm/MC/MCInst.h" 84 #include "llvm/MC/MCInstrInfo.h" 85 #include "llvm/MC/MCSubtargetInfo.h" 86 #include "llvm/MC/TargetRegistry.h" 87 #include "llvm/Support/Debug.h" 88 #include "llvm/Support/Format.h" 89 #include "llvm/Support/raw_ostream.h" 90 91 using namespace llvm; 92 using namespace llvm::X86Disassembler; 93 94 #define DEBUG_TYPE "x86-disassembler" 95 96 #define debug(s) LLVM_DEBUG(dbgs() << __LINE__ << ": " << s); 97 98 // Specifies whether a ModR/M byte is needed and (if so) which 99 // instruction each possible value of the ModR/M byte corresponds to. Once 100 // this information is known, we have narrowed down to a single instruction. 101 struct ModRMDecision { 102 uint8_t modrm_type; 103 uint16_t instructionIDs; 104 }; 105 106 // Specifies which set of ModR/M->instruction tables to look at 107 // given a particular opcode. 108 struct OpcodeDecision { 109 ModRMDecision modRMDecisions[256]; 110 }; 111 112 // Specifies which opcode->instruction tables to look at given 113 // a particular context (set of attributes). Since there are many possible 114 // contexts, the decoder first uses CONTEXTS_SYM to determine which context 115 // applies given a specific set of attributes. Hence there are only IC_max 116 // entries in this table, rather than 2^(ATTR_max). 117 struct ContextDecision { 118 OpcodeDecision opcodeDecisions[IC_max]; 119 }; 120 121 #include "X86GenDisassemblerTables.inc" 122 123 static InstrUID decode(OpcodeType type, InstructionContext insnContext, 124 uint8_t opcode, uint8_t modRM) { 125 const struct ModRMDecision *dec; 126 127 switch (type) { 128 case ONEBYTE: 129 dec = &ONEBYTE_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 130 break; 131 case TWOBYTE: 132 dec = &TWOBYTE_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 133 break; 134 case THREEBYTE_38: 135 dec = &THREEBYTE38_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 136 break; 137 case THREEBYTE_3A: 138 dec = &THREEBYTE3A_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 139 break; 140 case XOP8_MAP: 141 dec = &XOP8_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 142 break; 143 case XOP9_MAP: 144 dec = &XOP9_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 145 break; 146 case XOPA_MAP: 147 dec = &XOPA_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 148 break; 149 case THREEDNOW_MAP: 150 dec = 151 &THREEDNOW_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 152 break; 153 case MAP5: 154 dec = &MAP5_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 155 break; 156 case MAP6: 157 dec = &MAP6_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 158 break; 159 case MAP7: 160 dec = &MAP7_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 161 break; 162 } 163 164 switch (dec->modrm_type) { 165 default: 166 llvm_unreachable("Corrupt table! Unknown modrm_type"); 167 return 0; 168 case MODRM_ONEENTRY: 169 return modRMTable[dec->instructionIDs]; 170 case MODRM_SPLITRM: 171 if (modFromModRM(modRM) == 0x3) 172 return modRMTable[dec->instructionIDs + 1]; 173 return modRMTable[dec->instructionIDs]; 174 case MODRM_SPLITREG: 175 if (modFromModRM(modRM) == 0x3) 176 return modRMTable[dec->instructionIDs + ((modRM & 0x38) >> 3) + 8]; 177 return modRMTable[dec->instructionIDs + ((modRM & 0x38) >> 3)]; 178 case MODRM_SPLITMISC: 179 if (modFromModRM(modRM) == 0x3) 180 return modRMTable[dec->instructionIDs + (modRM & 0x3f) + 8]; 181 return modRMTable[dec->instructionIDs + ((modRM & 0x38) >> 3)]; 182 case MODRM_FULL: 183 return modRMTable[dec->instructionIDs + modRM]; 184 } 185 } 186 187 static bool peek(struct InternalInstruction *insn, uint8_t &byte) { 188 uint64_t offset = insn->readerCursor - insn->startLocation; 189 if (offset >= insn->bytes.size()) 190 return true; 191 byte = insn->bytes[offset]; 192 return false; 193 } 194 195 template <typename T> static bool consume(InternalInstruction *insn, T &ptr) { 196 auto r = insn->bytes; 197 uint64_t offset = insn->readerCursor - insn->startLocation; 198 if (offset + sizeof(T) > r.size()) 199 return true; 200 ptr = support::endian::read<T>(&r[offset], llvm::endianness::little); 201 insn->readerCursor += sizeof(T); 202 return false; 203 } 204 205 static bool isREX(struct InternalInstruction *insn, uint8_t prefix) { 206 return insn->mode == MODE_64BIT && prefix >= 0x40 && prefix <= 0x4f; 207 } 208 209 // Consumes all of an instruction's prefix bytes, and marks the 210 // instruction as having them. Also sets the instruction's default operand, 211 // address, and other relevant data sizes to report operands correctly. 212 // 213 // insn must not be empty. 214 static int readPrefixes(struct InternalInstruction *insn) { 215 bool isPrefix = true; 216 uint8_t byte = 0; 217 uint8_t nextByte; 218 219 LLVM_DEBUG(dbgs() << "readPrefixes()"); 220 221 while (isPrefix) { 222 // If we fail reading prefixes, just stop here and let the opcode reader 223 // deal with it. 224 if (consume(insn, byte)) 225 break; 226 227 // If the byte is a LOCK/REP/REPNE prefix and not a part of the opcode, then 228 // break and let it be disassembled as a normal "instruction". 229 if (insn->readerCursor - 1 == insn->startLocation && byte == 0xf0) // LOCK 230 break; 231 232 if ((byte == 0xf2 || byte == 0xf3) && !peek(insn, nextByte)) { 233 // If the byte is 0xf2 or 0xf3, and any of the following conditions are 234 // met: 235 // - it is followed by a LOCK (0xf0) prefix 236 // - it is followed by an xchg instruction 237 // then it should be disassembled as a xacquire/xrelease not repne/rep. 238 if (((nextByte == 0xf0) || 239 ((nextByte & 0xfe) == 0x86 || (nextByte & 0xf8) == 0x90))) { 240 insn->xAcquireRelease = true; 241 if (!(byte == 0xf3 && nextByte == 0x90)) // PAUSE instruction support 242 break; 243 } 244 // Also if the byte is 0xf3, and the following condition is met: 245 // - it is followed by a "mov mem, reg" (opcode 0x88/0x89) or 246 // "mov mem, imm" (opcode 0xc6/0xc7) instructions. 247 // then it should be disassembled as an xrelease not rep. 248 if (byte == 0xf3 && (nextByte == 0x88 || nextByte == 0x89 || 249 nextByte == 0xc6 || nextByte == 0xc7)) { 250 insn->xAcquireRelease = true; 251 break; 252 } 253 if (isREX(insn, nextByte)) { 254 uint8_t nnextByte; 255 // Go to REX prefix after the current one 256 if (consume(insn, nnextByte)) 257 return -1; 258 // We should be able to read next byte after REX prefix 259 if (peek(insn, nnextByte)) 260 return -1; 261 --insn->readerCursor; 262 } 263 } 264 265 switch (byte) { 266 case 0xf0: // LOCK 267 insn->hasLockPrefix = true; 268 break; 269 case 0xf2: // REPNE/REPNZ 270 case 0xf3: { // REP or REPE/REPZ 271 uint8_t nextByte; 272 if (peek(insn, nextByte)) 273 break; 274 // TODO: 275 // 1. There could be several 0x66 276 // 2. if (nextByte == 0x66) and nextNextByte != 0x0f then 277 // it's not mandatory prefix 278 // 3. if (nextByte >= 0x40 && nextByte <= 0x4f) it's REX and we need 279 // 0x0f exactly after it to be mandatory prefix 280 if (isREX(insn, nextByte) || nextByte == 0x0f || nextByte == 0x66) 281 // The last of 0xf2 /0xf3 is mandatory prefix 282 insn->mandatoryPrefix = byte; 283 insn->repeatPrefix = byte; 284 break; 285 } 286 case 0x2e: // CS segment override -OR- Branch not taken 287 insn->segmentOverride = SEG_OVERRIDE_CS; 288 break; 289 case 0x36: // SS segment override -OR- Branch taken 290 insn->segmentOverride = SEG_OVERRIDE_SS; 291 break; 292 case 0x3e: // DS segment override 293 insn->segmentOverride = SEG_OVERRIDE_DS; 294 break; 295 case 0x26: // ES segment override 296 insn->segmentOverride = SEG_OVERRIDE_ES; 297 break; 298 case 0x64: // FS segment override 299 insn->segmentOverride = SEG_OVERRIDE_FS; 300 break; 301 case 0x65: // GS segment override 302 insn->segmentOverride = SEG_OVERRIDE_GS; 303 break; 304 case 0x66: { // Operand-size override { 305 uint8_t nextByte; 306 insn->hasOpSize = true; 307 if (peek(insn, nextByte)) 308 break; 309 // 0x66 can't overwrite existing mandatory prefix and should be ignored 310 if (!insn->mandatoryPrefix && (nextByte == 0x0f || isREX(insn, nextByte))) 311 insn->mandatoryPrefix = byte; 312 break; 313 } 314 case 0x67: // Address-size override 315 insn->hasAdSize = true; 316 break; 317 default: // Not a prefix byte 318 isPrefix = false; 319 break; 320 } 321 322 if (isPrefix) 323 LLVM_DEBUG(dbgs() << format("Found prefix 0x%hhx", byte)); 324 } 325 326 insn->vectorExtensionType = TYPE_NO_VEX_XOP; 327 328 if (byte == 0x62) { 329 uint8_t byte1, byte2; 330 if (consume(insn, byte1)) { 331 LLVM_DEBUG(dbgs() << "Couldn't read second byte of EVEX prefix"); 332 return -1; 333 } 334 335 if (peek(insn, byte2)) { 336 LLVM_DEBUG(dbgs() << "Couldn't read third byte of EVEX prefix"); 337 return -1; 338 } 339 340 if ((insn->mode == MODE_64BIT || (byte1 & 0xc0) == 0xc0) && 341 ((~byte1 & 0x8) == 0x8) && ((byte2 & 0x4) == 0x4)) { 342 insn->vectorExtensionType = TYPE_EVEX; 343 } else { 344 --insn->readerCursor; // unconsume byte1 345 --insn->readerCursor; // unconsume byte 346 } 347 348 if (insn->vectorExtensionType == TYPE_EVEX) { 349 insn->vectorExtensionPrefix[0] = byte; 350 insn->vectorExtensionPrefix[1] = byte1; 351 if (consume(insn, insn->vectorExtensionPrefix[2])) { 352 LLVM_DEBUG(dbgs() << "Couldn't read third byte of EVEX prefix"); 353 return -1; 354 } 355 if (consume(insn, insn->vectorExtensionPrefix[3])) { 356 LLVM_DEBUG(dbgs() << "Couldn't read fourth byte of EVEX prefix"); 357 return -1; 358 } 359 360 // We simulate the REX prefix for simplicity's sake 361 if (insn->mode == MODE_64BIT) { 362 insn->rexPrefix = 0x40 | 363 (wFromEVEX3of4(insn->vectorExtensionPrefix[2]) << 3) | 364 (rFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 2) | 365 (xFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 1) | 366 (bFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 0); 367 } 368 369 LLVM_DEBUG( 370 dbgs() << format( 371 "Found EVEX prefix 0x%hhx 0x%hhx 0x%hhx 0x%hhx", 372 insn->vectorExtensionPrefix[0], insn->vectorExtensionPrefix[1], 373 insn->vectorExtensionPrefix[2], insn->vectorExtensionPrefix[3])); 374 } 375 } else if (byte == 0xc4) { 376 uint8_t byte1; 377 if (peek(insn, byte1)) { 378 LLVM_DEBUG(dbgs() << "Couldn't read second byte of VEX"); 379 return -1; 380 } 381 382 if (insn->mode == MODE_64BIT || (byte1 & 0xc0) == 0xc0) 383 insn->vectorExtensionType = TYPE_VEX_3B; 384 else 385 --insn->readerCursor; 386 387 if (insn->vectorExtensionType == TYPE_VEX_3B) { 388 insn->vectorExtensionPrefix[0] = byte; 389 consume(insn, insn->vectorExtensionPrefix[1]); 390 consume(insn, insn->vectorExtensionPrefix[2]); 391 392 // We simulate the REX prefix for simplicity's sake 393 394 if (insn->mode == MODE_64BIT) 395 insn->rexPrefix = 0x40 | 396 (wFromVEX3of3(insn->vectorExtensionPrefix[2]) << 3) | 397 (rFromVEX2of3(insn->vectorExtensionPrefix[1]) << 2) | 398 (xFromVEX2of3(insn->vectorExtensionPrefix[1]) << 1) | 399 (bFromVEX2of3(insn->vectorExtensionPrefix[1]) << 0); 400 401 LLVM_DEBUG(dbgs() << format("Found VEX prefix 0x%hhx 0x%hhx 0x%hhx", 402 insn->vectorExtensionPrefix[0], 403 insn->vectorExtensionPrefix[1], 404 insn->vectorExtensionPrefix[2])); 405 } 406 } else if (byte == 0xc5) { 407 uint8_t byte1; 408 if (peek(insn, byte1)) { 409 LLVM_DEBUG(dbgs() << "Couldn't read second byte of VEX"); 410 return -1; 411 } 412 413 if (insn->mode == MODE_64BIT || (byte1 & 0xc0) == 0xc0) 414 insn->vectorExtensionType = TYPE_VEX_2B; 415 else 416 --insn->readerCursor; 417 418 if (insn->vectorExtensionType == TYPE_VEX_2B) { 419 insn->vectorExtensionPrefix[0] = byte; 420 consume(insn, insn->vectorExtensionPrefix[1]); 421 422 if (insn->mode == MODE_64BIT) 423 insn->rexPrefix = 424 0x40 | (rFromVEX2of2(insn->vectorExtensionPrefix[1]) << 2); 425 426 switch (ppFromVEX2of2(insn->vectorExtensionPrefix[1])) { 427 default: 428 break; 429 case VEX_PREFIX_66: 430 insn->hasOpSize = true; 431 break; 432 } 433 434 LLVM_DEBUG(dbgs() << format("Found VEX prefix 0x%hhx 0x%hhx", 435 insn->vectorExtensionPrefix[0], 436 insn->vectorExtensionPrefix[1])); 437 } 438 } else if (byte == 0x8f) { 439 uint8_t byte1; 440 if (peek(insn, byte1)) { 441 LLVM_DEBUG(dbgs() << "Couldn't read second byte of XOP"); 442 return -1; 443 } 444 445 if ((byte1 & 0x38) != 0x0) // 0 in these 3 bits is a POP instruction. 446 insn->vectorExtensionType = TYPE_XOP; 447 else 448 --insn->readerCursor; 449 450 if (insn->vectorExtensionType == TYPE_XOP) { 451 insn->vectorExtensionPrefix[0] = byte; 452 consume(insn, insn->vectorExtensionPrefix[1]); 453 consume(insn, insn->vectorExtensionPrefix[2]); 454 455 // We simulate the REX prefix for simplicity's sake 456 457 if (insn->mode == MODE_64BIT) 458 insn->rexPrefix = 0x40 | 459 (wFromXOP3of3(insn->vectorExtensionPrefix[2]) << 3) | 460 (rFromXOP2of3(insn->vectorExtensionPrefix[1]) << 2) | 461 (xFromXOP2of3(insn->vectorExtensionPrefix[1]) << 1) | 462 (bFromXOP2of3(insn->vectorExtensionPrefix[1]) << 0); 463 464 switch (ppFromXOP3of3(insn->vectorExtensionPrefix[2])) { 465 default: 466 break; 467 case VEX_PREFIX_66: 468 insn->hasOpSize = true; 469 break; 470 } 471 472 LLVM_DEBUG(dbgs() << format("Found XOP prefix 0x%hhx 0x%hhx 0x%hhx", 473 insn->vectorExtensionPrefix[0], 474 insn->vectorExtensionPrefix[1], 475 insn->vectorExtensionPrefix[2])); 476 } 477 } else if (isREX(insn, byte)) { 478 if (peek(insn, nextByte)) 479 return -1; 480 insn->rexPrefix = byte; 481 LLVM_DEBUG(dbgs() << format("Found REX prefix 0x%hhx", byte)); 482 } else 483 --insn->readerCursor; 484 485 if (insn->mode == MODE_16BIT) { 486 insn->registerSize = (insn->hasOpSize ? 4 : 2); 487 insn->addressSize = (insn->hasAdSize ? 4 : 2); 488 insn->displacementSize = (insn->hasAdSize ? 4 : 2); 489 insn->immediateSize = (insn->hasOpSize ? 4 : 2); 490 } else if (insn->mode == MODE_32BIT) { 491 insn->registerSize = (insn->hasOpSize ? 2 : 4); 492 insn->addressSize = (insn->hasAdSize ? 2 : 4); 493 insn->displacementSize = (insn->hasAdSize ? 2 : 4); 494 insn->immediateSize = (insn->hasOpSize ? 2 : 4); 495 } else if (insn->mode == MODE_64BIT) { 496 insn->displacementSize = 4; 497 if (insn->rexPrefix && wFromREX(insn->rexPrefix)) { 498 insn->registerSize = 8; 499 insn->addressSize = (insn->hasAdSize ? 4 : 8); 500 insn->immediateSize = 4; 501 insn->hasOpSize = false; 502 } else { 503 insn->registerSize = (insn->hasOpSize ? 2 : 4); 504 insn->addressSize = (insn->hasAdSize ? 4 : 8); 505 insn->immediateSize = (insn->hasOpSize ? 2 : 4); 506 } 507 } 508 509 return 0; 510 } 511 512 // Consumes the SIB byte to determine addressing information. 513 static int readSIB(struct InternalInstruction *insn) { 514 SIBBase sibBaseBase = SIB_BASE_NONE; 515 uint8_t index, base; 516 517 LLVM_DEBUG(dbgs() << "readSIB()"); 518 switch (insn->addressSize) { 519 case 2: 520 default: 521 llvm_unreachable("SIB-based addressing doesn't work in 16-bit mode"); 522 case 4: 523 insn->sibIndexBase = SIB_INDEX_EAX; 524 sibBaseBase = SIB_BASE_EAX; 525 break; 526 case 8: 527 insn->sibIndexBase = SIB_INDEX_RAX; 528 sibBaseBase = SIB_BASE_RAX; 529 break; 530 } 531 532 if (consume(insn, insn->sib)) 533 return -1; 534 535 index = indexFromSIB(insn->sib) | (xFromREX(insn->rexPrefix) << 3); 536 537 if (index == 0x4) { 538 insn->sibIndex = SIB_INDEX_NONE; 539 } else { 540 insn->sibIndex = (SIBIndex)(insn->sibIndexBase + index); 541 } 542 543 insn->sibScale = 1 << scaleFromSIB(insn->sib); 544 545 base = baseFromSIB(insn->sib) | (bFromREX(insn->rexPrefix) << 3); 546 547 switch (base) { 548 case 0x5: 549 case 0xd: 550 switch (modFromModRM(insn->modRM)) { 551 case 0x0: 552 insn->eaDisplacement = EA_DISP_32; 553 insn->sibBase = SIB_BASE_NONE; 554 break; 555 case 0x1: 556 insn->eaDisplacement = EA_DISP_8; 557 insn->sibBase = (SIBBase)(sibBaseBase + base); 558 break; 559 case 0x2: 560 insn->eaDisplacement = EA_DISP_32; 561 insn->sibBase = (SIBBase)(sibBaseBase + base); 562 break; 563 default: 564 llvm_unreachable("Cannot have Mod = 0b11 and a SIB byte"); 565 } 566 break; 567 default: 568 insn->sibBase = (SIBBase)(sibBaseBase + base); 569 break; 570 } 571 572 return 0; 573 } 574 575 static int readDisplacement(struct InternalInstruction *insn) { 576 int8_t d8; 577 int16_t d16; 578 int32_t d32; 579 LLVM_DEBUG(dbgs() << "readDisplacement()"); 580 581 insn->displacementOffset = insn->readerCursor - insn->startLocation; 582 switch (insn->eaDisplacement) { 583 case EA_DISP_NONE: 584 break; 585 case EA_DISP_8: 586 if (consume(insn, d8)) 587 return -1; 588 insn->displacement = d8; 589 break; 590 case EA_DISP_16: 591 if (consume(insn, d16)) 592 return -1; 593 insn->displacement = d16; 594 break; 595 case EA_DISP_32: 596 if (consume(insn, d32)) 597 return -1; 598 insn->displacement = d32; 599 break; 600 } 601 602 return 0; 603 } 604 605 // Consumes all addressing information (ModR/M byte, SIB byte, and displacement. 606 static int readModRM(struct InternalInstruction *insn) { 607 uint8_t mod, rm, reg, evexrm; 608 LLVM_DEBUG(dbgs() << "readModRM()"); 609 610 if (insn->consumedModRM) 611 return 0; 612 613 if (consume(insn, insn->modRM)) 614 return -1; 615 insn->consumedModRM = true; 616 617 mod = modFromModRM(insn->modRM); 618 rm = rmFromModRM(insn->modRM); 619 reg = regFromModRM(insn->modRM); 620 621 // This goes by insn->registerSize to pick the correct register, which messes 622 // up if we're using (say) XMM or 8-bit register operands. That gets fixed in 623 // fixupReg(). 624 switch (insn->registerSize) { 625 case 2: 626 insn->regBase = MODRM_REG_AX; 627 insn->eaRegBase = EA_REG_AX; 628 break; 629 case 4: 630 insn->regBase = MODRM_REG_EAX; 631 insn->eaRegBase = EA_REG_EAX; 632 break; 633 case 8: 634 insn->regBase = MODRM_REG_RAX; 635 insn->eaRegBase = EA_REG_RAX; 636 break; 637 } 638 639 reg |= rFromREX(insn->rexPrefix) << 3; 640 rm |= bFromREX(insn->rexPrefix) << 3; 641 642 evexrm = 0; 643 if (insn->vectorExtensionType == TYPE_EVEX && insn->mode == MODE_64BIT) { 644 reg |= r2FromEVEX2of4(insn->vectorExtensionPrefix[1]) << 4; 645 evexrm = xFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 4; 646 } 647 648 insn->reg = (Reg)(insn->regBase + reg); 649 650 switch (insn->addressSize) { 651 case 2: { 652 EABase eaBaseBase = EA_BASE_BX_SI; 653 654 switch (mod) { 655 case 0x0: 656 if (rm == 0x6) { 657 insn->eaBase = EA_BASE_NONE; 658 insn->eaDisplacement = EA_DISP_16; 659 if (readDisplacement(insn)) 660 return -1; 661 } else { 662 insn->eaBase = (EABase)(eaBaseBase + rm); 663 insn->eaDisplacement = EA_DISP_NONE; 664 } 665 break; 666 case 0x1: 667 insn->eaBase = (EABase)(eaBaseBase + rm); 668 insn->eaDisplacement = EA_DISP_8; 669 insn->displacementSize = 1; 670 if (readDisplacement(insn)) 671 return -1; 672 break; 673 case 0x2: 674 insn->eaBase = (EABase)(eaBaseBase + rm); 675 insn->eaDisplacement = EA_DISP_16; 676 if (readDisplacement(insn)) 677 return -1; 678 break; 679 case 0x3: 680 insn->eaBase = (EABase)(insn->eaRegBase + rm); 681 if (readDisplacement(insn)) 682 return -1; 683 break; 684 } 685 break; 686 } 687 case 4: 688 case 8: { 689 EABase eaBaseBase = (insn->addressSize == 4 ? EA_BASE_EAX : EA_BASE_RAX); 690 691 switch (mod) { 692 case 0x0: 693 insn->eaDisplacement = EA_DISP_NONE; // readSIB may override this 694 // In determining whether RIP-relative mode is used (rm=5), 695 // or whether a SIB byte is present (rm=4), 696 // the extension bits (REX.b and EVEX.x) are ignored. 697 switch (rm & 7) { 698 case 0x4: // SIB byte is present 699 insn->eaBase = (insn->addressSize == 4 ? EA_BASE_sib : EA_BASE_sib64); 700 if (readSIB(insn) || readDisplacement(insn)) 701 return -1; 702 break; 703 case 0x5: // RIP-relative 704 insn->eaBase = EA_BASE_NONE; 705 insn->eaDisplacement = EA_DISP_32; 706 if (readDisplacement(insn)) 707 return -1; 708 break; 709 default: 710 insn->eaBase = (EABase)(eaBaseBase + rm); 711 break; 712 } 713 break; 714 case 0x1: 715 insn->displacementSize = 1; 716 [[fallthrough]]; 717 case 0x2: 718 insn->eaDisplacement = (mod == 0x1 ? EA_DISP_8 : EA_DISP_32); 719 switch (rm & 7) { 720 case 0x4: // SIB byte is present 721 insn->eaBase = EA_BASE_sib; 722 if (readSIB(insn) || readDisplacement(insn)) 723 return -1; 724 break; 725 default: 726 insn->eaBase = (EABase)(eaBaseBase + rm); 727 if (readDisplacement(insn)) 728 return -1; 729 break; 730 } 731 break; 732 case 0x3: 733 insn->eaDisplacement = EA_DISP_NONE; 734 insn->eaBase = (EABase)(insn->eaRegBase + rm + evexrm); 735 break; 736 } 737 break; 738 } 739 } // switch (insn->addressSize) 740 741 return 0; 742 } 743 744 #define GENERIC_FIXUP_FUNC(name, base, prefix, mask) \ 745 static uint16_t name(struct InternalInstruction *insn, OperandType type, \ 746 uint8_t index, uint8_t *valid) { \ 747 *valid = 1; \ 748 switch (type) { \ 749 default: \ 750 debug("Unhandled register type"); \ 751 *valid = 0; \ 752 return 0; \ 753 case TYPE_Rv: \ 754 return base + index; \ 755 case TYPE_R8: \ 756 index &= mask; \ 757 if (index > 0xf) \ 758 *valid = 0; \ 759 if (insn->rexPrefix && index >= 4 && index <= 7) { \ 760 return prefix##_SPL + (index - 4); \ 761 } else { \ 762 return prefix##_AL + index; \ 763 } \ 764 case TYPE_R16: \ 765 index &= mask; \ 766 if (index > 0xf) \ 767 *valid = 0; \ 768 return prefix##_AX + index; \ 769 case TYPE_R32: \ 770 index &= mask; \ 771 if (index > 0xf) \ 772 *valid = 0; \ 773 return prefix##_EAX + index; \ 774 case TYPE_R64: \ 775 index &= mask; \ 776 if (index > 0xf) \ 777 *valid = 0; \ 778 return prefix##_RAX + index; \ 779 case TYPE_ZMM: \ 780 return prefix##_ZMM0 + index; \ 781 case TYPE_YMM: \ 782 return prefix##_YMM0 + index; \ 783 case TYPE_XMM: \ 784 return prefix##_XMM0 + index; \ 785 case TYPE_TMM: \ 786 if (index > 7) \ 787 *valid = 0; \ 788 return prefix##_TMM0 + index; \ 789 case TYPE_VK: \ 790 index &= 0xf; \ 791 if (index > 7) \ 792 *valid = 0; \ 793 return prefix##_K0 + index; \ 794 case TYPE_VK_PAIR: \ 795 if (index > 7) \ 796 *valid = 0; \ 797 return prefix##_K0_K1 + (index / 2); \ 798 case TYPE_MM64: \ 799 return prefix##_MM0 + (index & 0x7); \ 800 case TYPE_SEGMENTREG: \ 801 if ((index & 7) > 5) \ 802 *valid = 0; \ 803 return prefix##_ES + (index & 7); \ 804 case TYPE_DEBUGREG: \ 805 return prefix##_DR0 + index; \ 806 case TYPE_CONTROLREG: \ 807 return prefix##_CR0 + index; \ 808 case TYPE_MVSIBX: \ 809 return prefix##_XMM0 + index; \ 810 case TYPE_MVSIBY: \ 811 return prefix##_YMM0 + index; \ 812 case TYPE_MVSIBZ: \ 813 return prefix##_ZMM0 + index; \ 814 } \ 815 } 816 817 // Consult an operand type to determine the meaning of the reg or R/M field. If 818 // the operand is an XMM operand, for example, an operand would be XMM0 instead 819 // of AX, which readModRM() would otherwise misinterpret it as. 820 // 821 // @param insn - The instruction containing the operand. 822 // @param type - The operand type. 823 // @param index - The existing value of the field as reported by readModRM(). 824 // @param valid - The address of a uint8_t. The target is set to 1 if the 825 // field is valid for the register class; 0 if not. 826 // @return - The proper value. 827 GENERIC_FIXUP_FUNC(fixupRegValue, insn->regBase, MODRM_REG, 0x1f) 828 GENERIC_FIXUP_FUNC(fixupRMValue, insn->eaRegBase, EA_REG, 0xf) 829 830 // Consult an operand specifier to determine which of the fixup*Value functions 831 // to use in correcting readModRM()'ss interpretation. 832 // 833 // @param insn - See fixup*Value(). 834 // @param op - The operand specifier. 835 // @return - 0 if fixup was successful; -1 if the register returned was 836 // invalid for its class. 837 static int fixupReg(struct InternalInstruction *insn, 838 const struct OperandSpecifier *op) { 839 uint8_t valid; 840 LLVM_DEBUG(dbgs() << "fixupReg()"); 841 842 switch ((OperandEncoding)op->encoding) { 843 default: 844 debug("Expected a REG or R/M encoding in fixupReg"); 845 return -1; 846 case ENCODING_VVVV: 847 insn->vvvv = 848 (Reg)fixupRegValue(insn, (OperandType)op->type, insn->vvvv, &valid); 849 if (!valid) 850 return -1; 851 break; 852 case ENCODING_REG: 853 insn->reg = (Reg)fixupRegValue(insn, (OperandType)op->type, 854 insn->reg - insn->regBase, &valid); 855 if (!valid) 856 return -1; 857 break; 858 case ENCODING_SIB: 859 CASE_ENCODING_RM: 860 if (insn->eaBase >= insn->eaRegBase) { 861 insn->eaBase = (EABase)fixupRMValue( 862 insn, (OperandType)op->type, insn->eaBase - insn->eaRegBase, &valid); 863 if (!valid) 864 return -1; 865 } 866 break; 867 } 868 869 return 0; 870 } 871 872 // Read the opcode (except the ModR/M byte in the case of extended or escape 873 // opcodes). 874 static bool readOpcode(struct InternalInstruction *insn) { 875 uint8_t current; 876 LLVM_DEBUG(dbgs() << "readOpcode()"); 877 878 insn->opcodeType = ONEBYTE; 879 if (insn->vectorExtensionType == TYPE_EVEX) { 880 switch (mmmFromEVEX2of4(insn->vectorExtensionPrefix[1])) { 881 default: 882 LLVM_DEBUG( 883 dbgs() << format("Unhandled mmm field for instruction (0x%hhx)", 884 mmmFromEVEX2of4(insn->vectorExtensionPrefix[1]))); 885 return true; 886 case VEX_LOB_0F: 887 insn->opcodeType = TWOBYTE; 888 return consume(insn, insn->opcode); 889 case VEX_LOB_0F38: 890 insn->opcodeType = THREEBYTE_38; 891 return consume(insn, insn->opcode); 892 case VEX_LOB_0F3A: 893 insn->opcodeType = THREEBYTE_3A; 894 return consume(insn, insn->opcode); 895 case VEX_LOB_MAP5: 896 insn->opcodeType = MAP5; 897 return consume(insn, insn->opcode); 898 case VEX_LOB_MAP6: 899 insn->opcodeType = MAP6; 900 return consume(insn, insn->opcode); 901 } 902 } else if (insn->vectorExtensionType == TYPE_VEX_3B) { 903 switch (mmmmmFromVEX2of3(insn->vectorExtensionPrefix[1])) { 904 default: 905 LLVM_DEBUG( 906 dbgs() << format("Unhandled m-mmmm field for instruction (0x%hhx)", 907 mmmmmFromVEX2of3(insn->vectorExtensionPrefix[1]))); 908 return true; 909 case VEX_LOB_0F: 910 insn->opcodeType = TWOBYTE; 911 return consume(insn, insn->opcode); 912 case VEX_LOB_0F38: 913 insn->opcodeType = THREEBYTE_38; 914 return consume(insn, insn->opcode); 915 case VEX_LOB_0F3A: 916 insn->opcodeType = THREEBYTE_3A; 917 return consume(insn, insn->opcode); 918 case VEX_LOB_MAP5: 919 insn->opcodeType = MAP5; 920 return consume(insn, insn->opcode); 921 case VEX_LOB_MAP6: 922 insn->opcodeType = MAP6; 923 return consume(insn, insn->opcode); 924 case VEX_LOB_MAP7: 925 insn->opcodeType = MAP7; 926 return consume(insn, insn->opcode); 927 } 928 } else if (insn->vectorExtensionType == TYPE_VEX_2B) { 929 insn->opcodeType = TWOBYTE; 930 return consume(insn, insn->opcode); 931 } else if (insn->vectorExtensionType == TYPE_XOP) { 932 switch (mmmmmFromXOP2of3(insn->vectorExtensionPrefix[1])) { 933 default: 934 LLVM_DEBUG( 935 dbgs() << format("Unhandled m-mmmm field for instruction (0x%hhx)", 936 mmmmmFromVEX2of3(insn->vectorExtensionPrefix[1]))); 937 return true; 938 case XOP_MAP_SELECT_8: 939 insn->opcodeType = XOP8_MAP; 940 return consume(insn, insn->opcode); 941 case XOP_MAP_SELECT_9: 942 insn->opcodeType = XOP9_MAP; 943 return consume(insn, insn->opcode); 944 case XOP_MAP_SELECT_A: 945 insn->opcodeType = XOPA_MAP; 946 return consume(insn, insn->opcode); 947 } 948 } 949 950 if (consume(insn, current)) 951 return true; 952 953 if (current == 0x0f) { 954 LLVM_DEBUG( 955 dbgs() << format("Found a two-byte escape prefix (0x%hhx)", current)); 956 if (consume(insn, current)) 957 return true; 958 959 if (current == 0x38) { 960 LLVM_DEBUG(dbgs() << format("Found a three-byte escape prefix (0x%hhx)", 961 current)); 962 if (consume(insn, current)) 963 return true; 964 965 insn->opcodeType = THREEBYTE_38; 966 } else if (current == 0x3a) { 967 LLVM_DEBUG(dbgs() << format("Found a three-byte escape prefix (0x%hhx)", 968 current)); 969 if (consume(insn, current)) 970 return true; 971 972 insn->opcodeType = THREEBYTE_3A; 973 } else if (current == 0x0f) { 974 LLVM_DEBUG( 975 dbgs() << format("Found a 3dnow escape prefix (0x%hhx)", current)); 976 977 // Consume operands before the opcode to comply with the 3DNow encoding 978 if (readModRM(insn)) 979 return true; 980 981 if (consume(insn, current)) 982 return true; 983 984 insn->opcodeType = THREEDNOW_MAP; 985 } else { 986 LLVM_DEBUG(dbgs() << "Didn't find a three-byte escape prefix"); 987 insn->opcodeType = TWOBYTE; 988 } 989 } else if (insn->mandatoryPrefix) 990 // The opcode with mandatory prefix must start with opcode escape. 991 // If not it's legacy repeat prefix 992 insn->mandatoryPrefix = 0; 993 994 // At this point we have consumed the full opcode. 995 // Anything we consume from here on must be unconsumed. 996 insn->opcode = current; 997 998 return false; 999 } 1000 1001 // Determine whether equiv is the 16-bit equivalent of orig (32-bit or 64-bit). 1002 static bool is16BitEquivalent(const char *orig, const char *equiv) { 1003 for (int i = 0;; i++) { 1004 if (orig[i] == '\0' && equiv[i] == '\0') 1005 return true; 1006 if (orig[i] == '\0' || equiv[i] == '\0') 1007 return false; 1008 if (orig[i] != equiv[i]) { 1009 if ((orig[i] == 'Q' || orig[i] == 'L') && equiv[i] == 'W') 1010 continue; 1011 if ((orig[i] == '6' || orig[i] == '3') && equiv[i] == '1') 1012 continue; 1013 if ((orig[i] == '4' || orig[i] == '2') && equiv[i] == '6') 1014 continue; 1015 return false; 1016 } 1017 } 1018 } 1019 1020 // Determine whether this instruction is a 64-bit instruction. 1021 static bool is64Bit(const char *name) { 1022 for (int i = 0;; ++i) { 1023 if (name[i] == '\0') 1024 return false; 1025 if (name[i] == '6' && name[i + 1] == '4') 1026 return true; 1027 } 1028 } 1029 1030 // Determine the ID of an instruction, consuming the ModR/M byte as appropriate 1031 // for extended and escape opcodes, and using a supplied attribute mask. 1032 static int getInstructionIDWithAttrMask(uint16_t *instructionID, 1033 struct InternalInstruction *insn, 1034 uint16_t attrMask) { 1035 auto insnCtx = InstructionContext(x86DisassemblerContexts[attrMask]); 1036 const ContextDecision *decision; 1037 switch (insn->opcodeType) { 1038 case ONEBYTE: 1039 decision = &ONEBYTE_SYM; 1040 break; 1041 case TWOBYTE: 1042 decision = &TWOBYTE_SYM; 1043 break; 1044 case THREEBYTE_38: 1045 decision = &THREEBYTE38_SYM; 1046 break; 1047 case THREEBYTE_3A: 1048 decision = &THREEBYTE3A_SYM; 1049 break; 1050 case XOP8_MAP: 1051 decision = &XOP8_MAP_SYM; 1052 break; 1053 case XOP9_MAP: 1054 decision = &XOP9_MAP_SYM; 1055 break; 1056 case XOPA_MAP: 1057 decision = &XOPA_MAP_SYM; 1058 break; 1059 case THREEDNOW_MAP: 1060 decision = &THREEDNOW_MAP_SYM; 1061 break; 1062 case MAP5: 1063 decision = &MAP5_SYM; 1064 break; 1065 case MAP6: 1066 decision = &MAP6_SYM; 1067 break; 1068 case MAP7: 1069 decision = &MAP7_SYM; 1070 break; 1071 } 1072 1073 if (decision->opcodeDecisions[insnCtx] 1074 .modRMDecisions[insn->opcode] 1075 .modrm_type != MODRM_ONEENTRY) { 1076 if (readModRM(insn)) 1077 return -1; 1078 *instructionID = 1079 decode(insn->opcodeType, insnCtx, insn->opcode, insn->modRM); 1080 } else { 1081 *instructionID = decode(insn->opcodeType, insnCtx, insn->opcode, 0); 1082 } 1083 1084 return 0; 1085 } 1086 1087 // Determine the ID of an instruction, consuming the ModR/M byte as appropriate 1088 // for extended and escape opcodes. Determines the attributes and context for 1089 // the instruction before doing so. 1090 static int getInstructionID(struct InternalInstruction *insn, 1091 const MCInstrInfo *mii) { 1092 uint16_t attrMask; 1093 uint16_t instructionID; 1094 1095 LLVM_DEBUG(dbgs() << "getID()"); 1096 1097 attrMask = ATTR_NONE; 1098 1099 if (insn->mode == MODE_64BIT) 1100 attrMask |= ATTR_64BIT; 1101 1102 if (insn->vectorExtensionType != TYPE_NO_VEX_XOP) { 1103 attrMask |= (insn->vectorExtensionType == TYPE_EVEX) ? ATTR_EVEX : ATTR_VEX; 1104 1105 if (insn->vectorExtensionType == TYPE_EVEX) { 1106 switch (ppFromEVEX3of4(insn->vectorExtensionPrefix[2])) { 1107 case VEX_PREFIX_66: 1108 attrMask |= ATTR_OPSIZE; 1109 break; 1110 case VEX_PREFIX_F3: 1111 attrMask |= ATTR_XS; 1112 break; 1113 case VEX_PREFIX_F2: 1114 attrMask |= ATTR_XD; 1115 break; 1116 } 1117 1118 if (zFromEVEX4of4(insn->vectorExtensionPrefix[3])) 1119 attrMask |= ATTR_EVEXKZ; 1120 if (bFromEVEX4of4(insn->vectorExtensionPrefix[3])) 1121 attrMask |= ATTR_EVEXB; 1122 if (aaaFromEVEX4of4(insn->vectorExtensionPrefix[3])) 1123 attrMask |= ATTR_EVEXK; 1124 if (lFromEVEX4of4(insn->vectorExtensionPrefix[3])) 1125 attrMask |= ATTR_VEXL; 1126 if (l2FromEVEX4of4(insn->vectorExtensionPrefix[3])) 1127 attrMask |= ATTR_EVEXL2; 1128 } else if (insn->vectorExtensionType == TYPE_VEX_3B) { 1129 switch (ppFromVEX3of3(insn->vectorExtensionPrefix[2])) { 1130 case VEX_PREFIX_66: 1131 attrMask |= ATTR_OPSIZE; 1132 break; 1133 case VEX_PREFIX_F3: 1134 attrMask |= ATTR_XS; 1135 break; 1136 case VEX_PREFIX_F2: 1137 attrMask |= ATTR_XD; 1138 break; 1139 } 1140 1141 if (lFromVEX3of3(insn->vectorExtensionPrefix[2])) 1142 attrMask |= ATTR_VEXL; 1143 } else if (insn->vectorExtensionType == TYPE_VEX_2B) { 1144 switch (ppFromVEX2of2(insn->vectorExtensionPrefix[1])) { 1145 case VEX_PREFIX_66: 1146 attrMask |= ATTR_OPSIZE; 1147 if (insn->hasAdSize) 1148 attrMask |= ATTR_ADSIZE; 1149 break; 1150 case VEX_PREFIX_F3: 1151 attrMask |= ATTR_XS; 1152 break; 1153 case VEX_PREFIX_F2: 1154 attrMask |= ATTR_XD; 1155 break; 1156 } 1157 1158 if (lFromVEX2of2(insn->vectorExtensionPrefix[1])) 1159 attrMask |= ATTR_VEXL; 1160 } else if (insn->vectorExtensionType == TYPE_XOP) { 1161 switch (ppFromXOP3of3(insn->vectorExtensionPrefix[2])) { 1162 case VEX_PREFIX_66: 1163 attrMask |= ATTR_OPSIZE; 1164 break; 1165 case VEX_PREFIX_F3: 1166 attrMask |= ATTR_XS; 1167 break; 1168 case VEX_PREFIX_F2: 1169 attrMask |= ATTR_XD; 1170 break; 1171 } 1172 1173 if (lFromXOP3of3(insn->vectorExtensionPrefix[2])) 1174 attrMask |= ATTR_VEXL; 1175 } else { 1176 return -1; 1177 } 1178 } else if (!insn->mandatoryPrefix) { 1179 // If we don't have mandatory prefix we should use legacy prefixes here 1180 if (insn->hasOpSize && (insn->mode != MODE_16BIT)) 1181 attrMask |= ATTR_OPSIZE; 1182 if (insn->hasAdSize) 1183 attrMask |= ATTR_ADSIZE; 1184 if (insn->opcodeType == ONEBYTE) { 1185 if (insn->repeatPrefix == 0xf3 && (insn->opcode == 0x90)) 1186 // Special support for PAUSE 1187 attrMask |= ATTR_XS; 1188 } else { 1189 if (insn->repeatPrefix == 0xf2) 1190 attrMask |= ATTR_XD; 1191 else if (insn->repeatPrefix == 0xf3) 1192 attrMask |= ATTR_XS; 1193 } 1194 } else { 1195 switch (insn->mandatoryPrefix) { 1196 case 0xf2: 1197 attrMask |= ATTR_XD; 1198 break; 1199 case 0xf3: 1200 attrMask |= ATTR_XS; 1201 break; 1202 case 0x66: 1203 if (insn->mode != MODE_16BIT) 1204 attrMask |= ATTR_OPSIZE; 1205 if (insn->hasAdSize) 1206 attrMask |= ATTR_ADSIZE; 1207 break; 1208 case 0x67: 1209 attrMask |= ATTR_ADSIZE; 1210 break; 1211 } 1212 } 1213 1214 if (insn->rexPrefix & 0x08) { 1215 attrMask |= ATTR_REXW; 1216 attrMask &= ~ATTR_ADSIZE; 1217 } 1218 1219 if (insn->mode == MODE_16BIT) { 1220 // JCXZ/JECXZ need special handling for 16-bit mode because the meaning 1221 // of the AdSize prefix is inverted w.r.t. 32-bit mode. 1222 if (insn->opcodeType == ONEBYTE && insn->opcode == 0xE3) 1223 attrMask ^= ATTR_ADSIZE; 1224 // If we're in 16-bit mode and this is one of the relative jumps and opsize 1225 // prefix isn't present, we need to force the opsize attribute since the 1226 // prefix is inverted relative to 32-bit mode. 1227 if (!insn->hasOpSize && insn->opcodeType == ONEBYTE && 1228 (insn->opcode == 0xE8 || insn->opcode == 0xE9)) 1229 attrMask |= ATTR_OPSIZE; 1230 1231 if (!insn->hasOpSize && insn->opcodeType == TWOBYTE && 1232 insn->opcode >= 0x80 && insn->opcode <= 0x8F) 1233 attrMask |= ATTR_OPSIZE; 1234 } 1235 1236 1237 if (getInstructionIDWithAttrMask(&instructionID, insn, attrMask)) 1238 return -1; 1239 1240 // The following clauses compensate for limitations of the tables. 1241 1242 if (insn->mode != MODE_64BIT && 1243 insn->vectorExtensionType != TYPE_NO_VEX_XOP) { 1244 // The tables can't distinquish between cases where the W-bit is used to 1245 // select register size and cases where its a required part of the opcode. 1246 if ((insn->vectorExtensionType == TYPE_EVEX && 1247 wFromEVEX3of4(insn->vectorExtensionPrefix[2])) || 1248 (insn->vectorExtensionType == TYPE_VEX_3B && 1249 wFromVEX3of3(insn->vectorExtensionPrefix[2])) || 1250 (insn->vectorExtensionType == TYPE_XOP && 1251 wFromXOP3of3(insn->vectorExtensionPrefix[2]))) { 1252 1253 uint16_t instructionIDWithREXW; 1254 if (getInstructionIDWithAttrMask(&instructionIDWithREXW, insn, 1255 attrMask | ATTR_REXW)) { 1256 insn->instructionID = instructionID; 1257 insn->spec = &INSTRUCTIONS_SYM[instructionID]; 1258 return 0; 1259 } 1260 1261 auto SpecName = mii->getName(instructionIDWithREXW); 1262 // If not a 64-bit instruction. Switch the opcode. 1263 if (!is64Bit(SpecName.data())) { 1264 insn->instructionID = instructionIDWithREXW; 1265 insn->spec = &INSTRUCTIONS_SYM[instructionIDWithREXW]; 1266 return 0; 1267 } 1268 } 1269 } 1270 1271 // Absolute moves, umonitor, and movdir64b need special handling. 1272 // -For 16-bit mode because the meaning of the AdSize and OpSize prefixes are 1273 // inverted w.r.t. 1274 // -For 32-bit mode we need to ensure the ADSIZE prefix is observed in 1275 // any position. 1276 if ((insn->opcodeType == ONEBYTE && ((insn->opcode & 0xFC) == 0xA0)) || 1277 (insn->opcodeType == TWOBYTE && (insn->opcode == 0xAE)) || 1278 (insn->opcodeType == THREEBYTE_38 && insn->opcode == 0xF8)) { 1279 // Make sure we observed the prefixes in any position. 1280 if (insn->hasAdSize) 1281 attrMask |= ATTR_ADSIZE; 1282 if (insn->hasOpSize) 1283 attrMask |= ATTR_OPSIZE; 1284 1285 // In 16-bit, invert the attributes. 1286 if (insn->mode == MODE_16BIT) { 1287 attrMask ^= ATTR_ADSIZE; 1288 1289 // The OpSize attribute is only valid with the absolute moves. 1290 if (insn->opcodeType == ONEBYTE && ((insn->opcode & 0xFC) == 0xA0)) 1291 attrMask ^= ATTR_OPSIZE; 1292 } 1293 1294 if (getInstructionIDWithAttrMask(&instructionID, insn, attrMask)) 1295 return -1; 1296 1297 insn->instructionID = instructionID; 1298 insn->spec = &INSTRUCTIONS_SYM[instructionID]; 1299 return 0; 1300 } 1301 1302 if ((insn->mode == MODE_16BIT || insn->hasOpSize) && 1303 !(attrMask & ATTR_OPSIZE)) { 1304 // The instruction tables make no distinction between instructions that 1305 // allow OpSize anywhere (i.e., 16-bit operations) and that need it in a 1306 // particular spot (i.e., many MMX operations). In general we're 1307 // conservative, but in the specific case where OpSize is present but not in 1308 // the right place we check if there's a 16-bit operation. 1309 const struct InstructionSpecifier *spec; 1310 uint16_t instructionIDWithOpsize; 1311 llvm::StringRef specName, specWithOpSizeName; 1312 1313 spec = &INSTRUCTIONS_SYM[instructionID]; 1314 1315 if (getInstructionIDWithAttrMask(&instructionIDWithOpsize, insn, 1316 attrMask | ATTR_OPSIZE)) { 1317 // ModRM required with OpSize but not present. Give up and return the 1318 // version without OpSize set. 1319 insn->instructionID = instructionID; 1320 insn->spec = spec; 1321 return 0; 1322 } 1323 1324 specName = mii->getName(instructionID); 1325 specWithOpSizeName = mii->getName(instructionIDWithOpsize); 1326 1327 if (is16BitEquivalent(specName.data(), specWithOpSizeName.data()) && 1328 (insn->mode == MODE_16BIT) ^ insn->hasOpSize) { 1329 insn->instructionID = instructionIDWithOpsize; 1330 insn->spec = &INSTRUCTIONS_SYM[instructionIDWithOpsize]; 1331 } else { 1332 insn->instructionID = instructionID; 1333 insn->spec = spec; 1334 } 1335 return 0; 1336 } 1337 1338 if (insn->opcodeType == ONEBYTE && insn->opcode == 0x90 && 1339 insn->rexPrefix & 0x01) { 1340 // NOOP shouldn't decode as NOOP if REX.b is set. Instead it should decode 1341 // as XCHG %r8, %eax. 1342 const struct InstructionSpecifier *spec; 1343 uint16_t instructionIDWithNewOpcode; 1344 const struct InstructionSpecifier *specWithNewOpcode; 1345 1346 spec = &INSTRUCTIONS_SYM[instructionID]; 1347 1348 // Borrow opcode from one of the other XCHGar opcodes 1349 insn->opcode = 0x91; 1350 1351 if (getInstructionIDWithAttrMask(&instructionIDWithNewOpcode, insn, 1352 attrMask)) { 1353 insn->opcode = 0x90; 1354 1355 insn->instructionID = instructionID; 1356 insn->spec = spec; 1357 return 0; 1358 } 1359 1360 specWithNewOpcode = &INSTRUCTIONS_SYM[instructionIDWithNewOpcode]; 1361 1362 // Change back 1363 insn->opcode = 0x90; 1364 1365 insn->instructionID = instructionIDWithNewOpcode; 1366 insn->spec = specWithNewOpcode; 1367 1368 return 0; 1369 } 1370 1371 insn->instructionID = instructionID; 1372 insn->spec = &INSTRUCTIONS_SYM[insn->instructionID]; 1373 1374 return 0; 1375 } 1376 1377 // Read an operand from the opcode field of an instruction and interprets it 1378 // appropriately given the operand width. Handles AddRegFrm instructions. 1379 // 1380 // @param insn - the instruction whose opcode field is to be read. 1381 // @param size - The width (in bytes) of the register being specified. 1382 // 1 means AL and friends, 2 means AX, 4 means EAX, and 8 means 1383 // RAX. 1384 // @return - 0 on success; nonzero otherwise. 1385 static int readOpcodeRegister(struct InternalInstruction *insn, uint8_t size) { 1386 LLVM_DEBUG(dbgs() << "readOpcodeRegister()"); 1387 1388 if (size == 0) 1389 size = insn->registerSize; 1390 1391 switch (size) { 1392 case 1: 1393 insn->opcodeRegister = (Reg)( 1394 MODRM_REG_AL + ((bFromREX(insn->rexPrefix) << 3) | (insn->opcode & 7))); 1395 if (insn->rexPrefix && insn->opcodeRegister >= MODRM_REG_AL + 0x4 && 1396 insn->opcodeRegister < MODRM_REG_AL + 0x8) { 1397 insn->opcodeRegister = 1398 (Reg)(MODRM_REG_SPL + (insn->opcodeRegister - MODRM_REG_AL - 4)); 1399 } 1400 1401 break; 1402 case 2: 1403 insn->opcodeRegister = (Reg)( 1404 MODRM_REG_AX + ((bFromREX(insn->rexPrefix) << 3) | (insn->opcode & 7))); 1405 break; 1406 case 4: 1407 insn->opcodeRegister = 1408 (Reg)(MODRM_REG_EAX + 1409 ((bFromREX(insn->rexPrefix) << 3) | (insn->opcode & 7))); 1410 break; 1411 case 8: 1412 insn->opcodeRegister = 1413 (Reg)(MODRM_REG_RAX + 1414 ((bFromREX(insn->rexPrefix) << 3) | (insn->opcode & 7))); 1415 break; 1416 } 1417 1418 return 0; 1419 } 1420 1421 // Consume an immediate operand from an instruction, given the desired operand 1422 // size. 1423 // 1424 // @param insn - The instruction whose operand is to be read. 1425 // @param size - The width (in bytes) of the operand. 1426 // @return - 0 if the immediate was successfully consumed; nonzero 1427 // otherwise. 1428 static int readImmediate(struct InternalInstruction *insn, uint8_t size) { 1429 uint8_t imm8; 1430 uint16_t imm16; 1431 uint32_t imm32; 1432 uint64_t imm64; 1433 1434 LLVM_DEBUG(dbgs() << "readImmediate()"); 1435 1436 assert(insn->numImmediatesConsumed < 2 && "Already consumed two immediates"); 1437 1438 insn->immediateSize = size; 1439 insn->immediateOffset = insn->readerCursor - insn->startLocation; 1440 1441 switch (size) { 1442 case 1: 1443 if (consume(insn, imm8)) 1444 return -1; 1445 insn->immediates[insn->numImmediatesConsumed] = imm8; 1446 break; 1447 case 2: 1448 if (consume(insn, imm16)) 1449 return -1; 1450 insn->immediates[insn->numImmediatesConsumed] = imm16; 1451 break; 1452 case 4: 1453 if (consume(insn, imm32)) 1454 return -1; 1455 insn->immediates[insn->numImmediatesConsumed] = imm32; 1456 break; 1457 case 8: 1458 if (consume(insn, imm64)) 1459 return -1; 1460 insn->immediates[insn->numImmediatesConsumed] = imm64; 1461 break; 1462 default: 1463 llvm_unreachable("invalid size"); 1464 } 1465 1466 insn->numImmediatesConsumed++; 1467 1468 return 0; 1469 } 1470 1471 // Consume vvvv from an instruction if it has a VEX prefix. 1472 static int readVVVV(struct InternalInstruction *insn) { 1473 LLVM_DEBUG(dbgs() << "readVVVV()"); 1474 1475 int vvvv; 1476 if (insn->vectorExtensionType == TYPE_EVEX) 1477 vvvv = (v2FromEVEX4of4(insn->vectorExtensionPrefix[3]) << 4 | 1478 vvvvFromEVEX3of4(insn->vectorExtensionPrefix[2])); 1479 else if (insn->vectorExtensionType == TYPE_VEX_3B) 1480 vvvv = vvvvFromVEX3of3(insn->vectorExtensionPrefix[2]); 1481 else if (insn->vectorExtensionType == TYPE_VEX_2B) 1482 vvvv = vvvvFromVEX2of2(insn->vectorExtensionPrefix[1]); 1483 else if (insn->vectorExtensionType == TYPE_XOP) 1484 vvvv = vvvvFromXOP3of3(insn->vectorExtensionPrefix[2]); 1485 else 1486 return -1; 1487 1488 if (insn->mode != MODE_64BIT) 1489 vvvv &= 0xf; // Can only clear bit 4. Bit 3 must be cleared later. 1490 1491 insn->vvvv = static_cast<Reg>(vvvv); 1492 return 0; 1493 } 1494 1495 // Read an mask register from the opcode field of an instruction. 1496 // 1497 // @param insn - The instruction whose opcode field is to be read. 1498 // @return - 0 on success; nonzero otherwise. 1499 static int readMaskRegister(struct InternalInstruction *insn) { 1500 LLVM_DEBUG(dbgs() << "readMaskRegister()"); 1501 1502 if (insn->vectorExtensionType != TYPE_EVEX) 1503 return -1; 1504 1505 insn->writemask = 1506 static_cast<Reg>(aaaFromEVEX4of4(insn->vectorExtensionPrefix[3])); 1507 return 0; 1508 } 1509 1510 // Consults the specifier for an instruction and consumes all 1511 // operands for that instruction, interpreting them as it goes. 1512 static int readOperands(struct InternalInstruction *insn) { 1513 int hasVVVV, needVVVV; 1514 int sawRegImm = 0; 1515 1516 LLVM_DEBUG(dbgs() << "readOperands()"); 1517 1518 // If non-zero vvvv specified, make sure one of the operands uses it. 1519 hasVVVV = !readVVVV(insn); 1520 needVVVV = hasVVVV && (insn->vvvv != 0); 1521 1522 for (const auto &Op : x86OperandSets[insn->spec->operands]) { 1523 switch (Op.encoding) { 1524 case ENCODING_NONE: 1525 case ENCODING_SI: 1526 case ENCODING_DI: 1527 break; 1528 CASE_ENCODING_VSIB: 1529 // VSIB can use the V2 bit so check only the other bits. 1530 if (needVVVV) 1531 needVVVV = hasVVVV & ((insn->vvvv & 0xf) != 0); 1532 if (readModRM(insn)) 1533 return -1; 1534 1535 // Reject if SIB wasn't used. 1536 if (insn->eaBase != EA_BASE_sib && insn->eaBase != EA_BASE_sib64) 1537 return -1; 1538 1539 // If sibIndex was set to SIB_INDEX_NONE, index offset is 4. 1540 if (insn->sibIndex == SIB_INDEX_NONE) 1541 insn->sibIndex = (SIBIndex)(insn->sibIndexBase + 4); 1542 1543 // If EVEX.v2 is set this is one of the 16-31 registers. 1544 if (insn->vectorExtensionType == TYPE_EVEX && insn->mode == MODE_64BIT && 1545 v2FromEVEX4of4(insn->vectorExtensionPrefix[3])) 1546 insn->sibIndex = (SIBIndex)(insn->sibIndex + 16); 1547 1548 // Adjust the index register to the correct size. 1549 switch ((OperandType)Op.type) { 1550 default: 1551 debug("Unhandled VSIB index type"); 1552 return -1; 1553 case TYPE_MVSIBX: 1554 insn->sibIndex = 1555 (SIBIndex)(SIB_INDEX_XMM0 + (insn->sibIndex - insn->sibIndexBase)); 1556 break; 1557 case TYPE_MVSIBY: 1558 insn->sibIndex = 1559 (SIBIndex)(SIB_INDEX_YMM0 + (insn->sibIndex - insn->sibIndexBase)); 1560 break; 1561 case TYPE_MVSIBZ: 1562 insn->sibIndex = 1563 (SIBIndex)(SIB_INDEX_ZMM0 + (insn->sibIndex - insn->sibIndexBase)); 1564 break; 1565 } 1566 1567 // Apply the AVX512 compressed displacement scaling factor. 1568 if (Op.encoding != ENCODING_REG && insn->eaDisplacement == EA_DISP_8) 1569 insn->displacement *= 1 << (Op.encoding - ENCODING_VSIB); 1570 break; 1571 case ENCODING_SIB: 1572 // Reject if SIB wasn't used. 1573 if (insn->eaBase != EA_BASE_sib && insn->eaBase != EA_BASE_sib64) 1574 return -1; 1575 if (readModRM(insn)) 1576 return -1; 1577 if (fixupReg(insn, &Op)) 1578 return -1; 1579 break; 1580 case ENCODING_REG: 1581 CASE_ENCODING_RM: 1582 if (readModRM(insn)) 1583 return -1; 1584 if (fixupReg(insn, &Op)) 1585 return -1; 1586 // Apply the AVX512 compressed displacement scaling factor. 1587 if (Op.encoding != ENCODING_REG && insn->eaDisplacement == EA_DISP_8) 1588 insn->displacement *= 1 << (Op.encoding - ENCODING_RM); 1589 break; 1590 case ENCODING_IB: 1591 if (sawRegImm) { 1592 // Saw a register immediate so don't read again and instead split the 1593 // previous immediate. FIXME: This is a hack. 1594 insn->immediates[insn->numImmediatesConsumed] = 1595 insn->immediates[insn->numImmediatesConsumed - 1] & 0xf; 1596 ++insn->numImmediatesConsumed; 1597 break; 1598 } 1599 if (readImmediate(insn, 1)) 1600 return -1; 1601 if (Op.type == TYPE_XMM || Op.type == TYPE_YMM) 1602 sawRegImm = 1; 1603 break; 1604 case ENCODING_IW: 1605 if (readImmediate(insn, 2)) 1606 return -1; 1607 break; 1608 case ENCODING_ID: 1609 if (readImmediate(insn, 4)) 1610 return -1; 1611 break; 1612 case ENCODING_IO: 1613 if (readImmediate(insn, 8)) 1614 return -1; 1615 break; 1616 case ENCODING_Iv: 1617 if (readImmediate(insn, insn->immediateSize)) 1618 return -1; 1619 break; 1620 case ENCODING_Ia: 1621 if (readImmediate(insn, insn->addressSize)) 1622 return -1; 1623 break; 1624 case ENCODING_IRC: 1625 insn->RC = (l2FromEVEX4of4(insn->vectorExtensionPrefix[3]) << 1) | 1626 lFromEVEX4of4(insn->vectorExtensionPrefix[3]); 1627 break; 1628 case ENCODING_RB: 1629 if (readOpcodeRegister(insn, 1)) 1630 return -1; 1631 break; 1632 case ENCODING_RW: 1633 if (readOpcodeRegister(insn, 2)) 1634 return -1; 1635 break; 1636 case ENCODING_RD: 1637 if (readOpcodeRegister(insn, 4)) 1638 return -1; 1639 break; 1640 case ENCODING_RO: 1641 if (readOpcodeRegister(insn, 8)) 1642 return -1; 1643 break; 1644 case ENCODING_Rv: 1645 if (readOpcodeRegister(insn, 0)) 1646 return -1; 1647 break; 1648 case ENCODING_CC: 1649 insn->immediates[1] = insn->opcode & 0xf; 1650 break; 1651 case ENCODING_FP: 1652 break; 1653 case ENCODING_VVVV: 1654 needVVVV = 0; // Mark that we have found a VVVV operand. 1655 if (!hasVVVV) 1656 return -1; 1657 if (insn->mode != MODE_64BIT) 1658 insn->vvvv = static_cast<Reg>(insn->vvvv & 0x7); 1659 if (fixupReg(insn, &Op)) 1660 return -1; 1661 break; 1662 case ENCODING_WRITEMASK: 1663 if (readMaskRegister(insn)) 1664 return -1; 1665 break; 1666 case ENCODING_DUP: 1667 break; 1668 default: 1669 LLVM_DEBUG(dbgs() << "Encountered an operand with an unknown encoding."); 1670 return -1; 1671 } 1672 } 1673 1674 // If we didn't find ENCODING_VVVV operand, but non-zero vvvv present, fail 1675 if (needVVVV) 1676 return -1; 1677 1678 return 0; 1679 } 1680 1681 namespace llvm { 1682 1683 // Fill-ins to make the compiler happy. These constants are never actually 1684 // assigned; they are just filler to make an automatically-generated switch 1685 // statement work. 1686 namespace X86 { 1687 enum { 1688 BX_SI = 500, 1689 BX_DI = 501, 1690 BP_SI = 502, 1691 BP_DI = 503, 1692 sib = 504, 1693 sib64 = 505 1694 }; 1695 } // namespace X86 1696 1697 } // namespace llvm 1698 1699 static bool translateInstruction(MCInst &target, 1700 InternalInstruction &source, 1701 const MCDisassembler *Dis); 1702 1703 namespace { 1704 1705 /// Generic disassembler for all X86 platforms. All each platform class should 1706 /// have to do is subclass the constructor, and provide a different 1707 /// disassemblerMode value. 1708 class X86GenericDisassembler : public MCDisassembler { 1709 std::unique_ptr<const MCInstrInfo> MII; 1710 public: 1711 X86GenericDisassembler(const MCSubtargetInfo &STI, MCContext &Ctx, 1712 std::unique_ptr<const MCInstrInfo> MII); 1713 public: 1714 DecodeStatus getInstruction(MCInst &instr, uint64_t &size, 1715 ArrayRef<uint8_t> Bytes, uint64_t Address, 1716 raw_ostream &cStream) const override; 1717 1718 private: 1719 DisassemblerMode fMode; 1720 }; 1721 1722 } // namespace 1723 1724 X86GenericDisassembler::X86GenericDisassembler( 1725 const MCSubtargetInfo &STI, 1726 MCContext &Ctx, 1727 std::unique_ptr<const MCInstrInfo> MII) 1728 : MCDisassembler(STI, Ctx), MII(std::move(MII)) { 1729 const FeatureBitset &FB = STI.getFeatureBits(); 1730 if (FB[X86::Is16Bit]) { 1731 fMode = MODE_16BIT; 1732 return; 1733 } else if (FB[X86::Is32Bit]) { 1734 fMode = MODE_32BIT; 1735 return; 1736 } else if (FB[X86::Is64Bit]) { 1737 fMode = MODE_64BIT; 1738 return; 1739 } 1740 1741 llvm_unreachable("Invalid CPU mode"); 1742 } 1743 1744 MCDisassembler::DecodeStatus X86GenericDisassembler::getInstruction( 1745 MCInst &Instr, uint64_t &Size, ArrayRef<uint8_t> Bytes, uint64_t Address, 1746 raw_ostream &CStream) const { 1747 CommentStream = &CStream; 1748 1749 InternalInstruction Insn; 1750 memset(&Insn, 0, sizeof(InternalInstruction)); 1751 Insn.bytes = Bytes; 1752 Insn.startLocation = Address; 1753 Insn.readerCursor = Address; 1754 Insn.mode = fMode; 1755 1756 if (Bytes.empty() || readPrefixes(&Insn) || readOpcode(&Insn) || 1757 getInstructionID(&Insn, MII.get()) || Insn.instructionID == 0 || 1758 readOperands(&Insn)) { 1759 Size = Insn.readerCursor - Address; 1760 return Fail; 1761 } 1762 1763 Insn.operands = x86OperandSets[Insn.spec->operands]; 1764 Insn.length = Insn.readerCursor - Insn.startLocation; 1765 Size = Insn.length; 1766 if (Size > 15) 1767 LLVM_DEBUG(dbgs() << "Instruction exceeds 15-byte limit"); 1768 1769 bool Ret = translateInstruction(Instr, Insn, this); 1770 if (!Ret) { 1771 unsigned Flags = X86::IP_NO_PREFIX; 1772 if (Insn.hasAdSize) 1773 Flags |= X86::IP_HAS_AD_SIZE; 1774 if (!Insn.mandatoryPrefix) { 1775 if (Insn.hasOpSize) 1776 Flags |= X86::IP_HAS_OP_SIZE; 1777 if (Insn.repeatPrefix == 0xf2) 1778 Flags |= X86::IP_HAS_REPEAT_NE; 1779 else if (Insn.repeatPrefix == 0xf3 && 1780 // It should not be 'pause' f3 90 1781 Insn.opcode != 0x90) 1782 Flags |= X86::IP_HAS_REPEAT; 1783 if (Insn.hasLockPrefix) 1784 Flags |= X86::IP_HAS_LOCK; 1785 } 1786 Instr.setFlags(Flags); 1787 } 1788 return (!Ret) ? Success : Fail; 1789 } 1790 1791 // 1792 // Private code that translates from struct InternalInstructions to MCInsts. 1793 // 1794 1795 /// translateRegister - Translates an internal register to the appropriate LLVM 1796 /// register, and appends it as an operand to an MCInst. 1797 /// 1798 /// @param mcInst - The MCInst to append to. 1799 /// @param reg - The Reg to append. 1800 static void translateRegister(MCInst &mcInst, Reg reg) { 1801 #define ENTRY(x) X86::x, 1802 static constexpr MCPhysReg llvmRegnums[] = {ALL_REGS}; 1803 #undef ENTRY 1804 1805 MCPhysReg llvmRegnum = llvmRegnums[reg]; 1806 mcInst.addOperand(MCOperand::createReg(llvmRegnum)); 1807 } 1808 1809 static const uint8_t segmentRegnums[SEG_OVERRIDE_max] = { 1810 0, // SEG_OVERRIDE_NONE 1811 X86::CS, 1812 X86::SS, 1813 X86::DS, 1814 X86::ES, 1815 X86::FS, 1816 X86::GS 1817 }; 1818 1819 /// translateSrcIndex - Appends a source index operand to an MCInst. 1820 /// 1821 /// @param mcInst - The MCInst to append to. 1822 /// @param insn - The internal instruction. 1823 static bool translateSrcIndex(MCInst &mcInst, InternalInstruction &insn) { 1824 unsigned baseRegNo; 1825 1826 if (insn.mode == MODE_64BIT) 1827 baseRegNo = insn.hasAdSize ? X86::ESI : X86::RSI; 1828 else if (insn.mode == MODE_32BIT) 1829 baseRegNo = insn.hasAdSize ? X86::SI : X86::ESI; 1830 else { 1831 assert(insn.mode == MODE_16BIT); 1832 baseRegNo = insn.hasAdSize ? X86::ESI : X86::SI; 1833 } 1834 MCOperand baseReg = MCOperand::createReg(baseRegNo); 1835 mcInst.addOperand(baseReg); 1836 1837 MCOperand segmentReg; 1838 segmentReg = MCOperand::createReg(segmentRegnums[insn.segmentOverride]); 1839 mcInst.addOperand(segmentReg); 1840 return false; 1841 } 1842 1843 /// translateDstIndex - Appends a destination index operand to an MCInst. 1844 /// 1845 /// @param mcInst - The MCInst to append to. 1846 /// @param insn - The internal instruction. 1847 1848 static bool translateDstIndex(MCInst &mcInst, InternalInstruction &insn) { 1849 unsigned baseRegNo; 1850 1851 if (insn.mode == MODE_64BIT) 1852 baseRegNo = insn.hasAdSize ? X86::EDI : X86::RDI; 1853 else if (insn.mode == MODE_32BIT) 1854 baseRegNo = insn.hasAdSize ? X86::DI : X86::EDI; 1855 else { 1856 assert(insn.mode == MODE_16BIT); 1857 baseRegNo = insn.hasAdSize ? X86::EDI : X86::DI; 1858 } 1859 MCOperand baseReg = MCOperand::createReg(baseRegNo); 1860 mcInst.addOperand(baseReg); 1861 return false; 1862 } 1863 1864 /// translateImmediate - Appends an immediate operand to an MCInst. 1865 /// 1866 /// @param mcInst - The MCInst to append to. 1867 /// @param immediate - The immediate value to append. 1868 /// @param operand - The operand, as stored in the descriptor table. 1869 /// @param insn - The internal instruction. 1870 static void translateImmediate(MCInst &mcInst, uint64_t immediate, 1871 const OperandSpecifier &operand, 1872 InternalInstruction &insn, 1873 const MCDisassembler *Dis) { 1874 // Sign-extend the immediate if necessary. 1875 1876 OperandType type = (OperandType)operand.type; 1877 1878 bool isBranch = false; 1879 uint64_t pcrel = 0; 1880 if (type == TYPE_REL) { 1881 isBranch = true; 1882 pcrel = insn.startLocation + insn.length; 1883 switch (operand.encoding) { 1884 default: 1885 break; 1886 case ENCODING_Iv: 1887 switch (insn.displacementSize) { 1888 default: 1889 break; 1890 case 1: 1891 if(immediate & 0x80) 1892 immediate |= ~(0xffull); 1893 break; 1894 case 2: 1895 if(immediate & 0x8000) 1896 immediate |= ~(0xffffull); 1897 break; 1898 case 4: 1899 if(immediate & 0x80000000) 1900 immediate |= ~(0xffffffffull); 1901 break; 1902 case 8: 1903 break; 1904 } 1905 break; 1906 case ENCODING_IB: 1907 if(immediate & 0x80) 1908 immediate |= ~(0xffull); 1909 break; 1910 case ENCODING_IW: 1911 if(immediate & 0x8000) 1912 immediate |= ~(0xffffull); 1913 break; 1914 case ENCODING_ID: 1915 if(immediate & 0x80000000) 1916 immediate |= ~(0xffffffffull); 1917 break; 1918 } 1919 } 1920 // By default sign-extend all X86 immediates based on their encoding. 1921 else if (type == TYPE_IMM) { 1922 switch (operand.encoding) { 1923 default: 1924 break; 1925 case ENCODING_IB: 1926 if(immediate & 0x80) 1927 immediate |= ~(0xffull); 1928 break; 1929 case ENCODING_IW: 1930 if(immediate & 0x8000) 1931 immediate |= ~(0xffffull); 1932 break; 1933 case ENCODING_ID: 1934 if(immediate & 0x80000000) 1935 immediate |= ~(0xffffffffull); 1936 break; 1937 case ENCODING_IO: 1938 break; 1939 } 1940 } 1941 1942 switch (type) { 1943 case TYPE_XMM: 1944 mcInst.addOperand(MCOperand::createReg(X86::XMM0 + (immediate >> 4))); 1945 return; 1946 case TYPE_YMM: 1947 mcInst.addOperand(MCOperand::createReg(X86::YMM0 + (immediate >> 4))); 1948 return; 1949 case TYPE_ZMM: 1950 mcInst.addOperand(MCOperand::createReg(X86::ZMM0 + (immediate >> 4))); 1951 return; 1952 default: 1953 // operand is 64 bits wide. Do nothing. 1954 break; 1955 } 1956 1957 if (!Dis->tryAddingSymbolicOperand( 1958 mcInst, immediate + pcrel, insn.startLocation, isBranch, 1959 insn.immediateOffset, insn.immediateSize, insn.length)) 1960 mcInst.addOperand(MCOperand::createImm(immediate)); 1961 1962 if (type == TYPE_MOFFS) { 1963 MCOperand segmentReg; 1964 segmentReg = MCOperand::createReg(segmentRegnums[insn.segmentOverride]); 1965 mcInst.addOperand(segmentReg); 1966 } 1967 } 1968 1969 /// translateRMRegister - Translates a register stored in the R/M field of the 1970 /// ModR/M byte to its LLVM equivalent and appends it to an MCInst. 1971 /// @param mcInst - The MCInst to append to. 1972 /// @param insn - The internal instruction to extract the R/M field 1973 /// from. 1974 /// @return - 0 on success; -1 otherwise 1975 static bool translateRMRegister(MCInst &mcInst, 1976 InternalInstruction &insn) { 1977 if (insn.eaBase == EA_BASE_sib || insn.eaBase == EA_BASE_sib64) { 1978 debug("A R/M register operand may not have a SIB byte"); 1979 return true; 1980 } 1981 1982 switch (insn.eaBase) { 1983 default: 1984 debug("Unexpected EA base register"); 1985 return true; 1986 case EA_BASE_NONE: 1987 debug("EA_BASE_NONE for ModR/M base"); 1988 return true; 1989 #define ENTRY(x) case EA_BASE_##x: 1990 ALL_EA_BASES 1991 #undef ENTRY 1992 debug("A R/M register operand may not have a base; " 1993 "the operand must be a register."); 1994 return true; 1995 #define ENTRY(x) \ 1996 case EA_REG_##x: \ 1997 mcInst.addOperand(MCOperand::createReg(X86::x)); break; 1998 ALL_REGS 1999 #undef ENTRY 2000 } 2001 2002 return false; 2003 } 2004 2005 /// translateRMMemory - Translates a memory operand stored in the Mod and R/M 2006 /// fields of an internal instruction (and possibly its SIB byte) to a memory 2007 /// operand in LLVM's format, and appends it to an MCInst. 2008 /// 2009 /// @param mcInst - The MCInst to append to. 2010 /// @param insn - The instruction to extract Mod, R/M, and SIB fields 2011 /// from. 2012 /// @param ForceSIB - The instruction must use SIB. 2013 /// @return - 0 on success; nonzero otherwise 2014 static bool translateRMMemory(MCInst &mcInst, InternalInstruction &insn, 2015 const MCDisassembler *Dis, 2016 bool ForceSIB = false) { 2017 // Addresses in an MCInst are represented as five operands: 2018 // 1. basereg (register) The R/M base, or (if there is a SIB) the 2019 // SIB base 2020 // 2. scaleamount (immediate) 1, or (if there is a SIB) the specified 2021 // scale amount 2022 // 3. indexreg (register) x86_registerNONE, or (if there is a SIB) 2023 // the index (which is multiplied by the 2024 // scale amount) 2025 // 4. displacement (immediate) 0, or the displacement if there is one 2026 // 5. segmentreg (register) x86_registerNONE for now, but could be set 2027 // if we have segment overrides 2028 2029 MCOperand baseReg; 2030 MCOperand scaleAmount; 2031 MCOperand indexReg; 2032 MCOperand displacement; 2033 MCOperand segmentReg; 2034 uint64_t pcrel = 0; 2035 2036 if (insn.eaBase == EA_BASE_sib || insn.eaBase == EA_BASE_sib64) { 2037 if (insn.sibBase != SIB_BASE_NONE) { 2038 switch (insn.sibBase) { 2039 default: 2040 debug("Unexpected sibBase"); 2041 return true; 2042 #define ENTRY(x) \ 2043 case SIB_BASE_##x: \ 2044 baseReg = MCOperand::createReg(X86::x); break; 2045 ALL_SIB_BASES 2046 #undef ENTRY 2047 } 2048 } else { 2049 baseReg = MCOperand::createReg(X86::NoRegister); 2050 } 2051 2052 if (insn.sibIndex != SIB_INDEX_NONE) { 2053 switch (insn.sibIndex) { 2054 default: 2055 debug("Unexpected sibIndex"); 2056 return true; 2057 #define ENTRY(x) \ 2058 case SIB_INDEX_##x: \ 2059 indexReg = MCOperand::createReg(X86::x); break; 2060 EA_BASES_32BIT 2061 EA_BASES_64BIT 2062 REGS_XMM 2063 REGS_YMM 2064 REGS_ZMM 2065 #undef ENTRY 2066 } 2067 } else { 2068 // Use EIZ/RIZ for a few ambiguous cases where the SIB byte is present, 2069 // but no index is used and modrm alone should have been enough. 2070 // -No base register in 32-bit mode. In 64-bit mode this is used to 2071 // avoid rip-relative addressing. 2072 // -Any base register used other than ESP/RSP/R12D/R12. Using these as a 2073 // base always requires a SIB byte. 2074 // -A scale other than 1 is used. 2075 if (!ForceSIB && 2076 (insn.sibScale != 1 || 2077 (insn.sibBase == SIB_BASE_NONE && insn.mode != MODE_64BIT) || 2078 (insn.sibBase != SIB_BASE_NONE && 2079 insn.sibBase != SIB_BASE_ESP && insn.sibBase != SIB_BASE_RSP && 2080 insn.sibBase != SIB_BASE_R12D && insn.sibBase != SIB_BASE_R12))) { 2081 indexReg = MCOperand::createReg(insn.addressSize == 4 ? X86::EIZ : 2082 X86::RIZ); 2083 } else 2084 indexReg = MCOperand::createReg(X86::NoRegister); 2085 } 2086 2087 scaleAmount = MCOperand::createImm(insn.sibScale); 2088 } else { 2089 switch (insn.eaBase) { 2090 case EA_BASE_NONE: 2091 if (insn.eaDisplacement == EA_DISP_NONE) { 2092 debug("EA_BASE_NONE and EA_DISP_NONE for ModR/M base"); 2093 return true; 2094 } 2095 if (insn.mode == MODE_64BIT){ 2096 pcrel = insn.startLocation + insn.length; 2097 Dis->tryAddingPcLoadReferenceComment(insn.displacement + pcrel, 2098 insn.startLocation + 2099 insn.displacementOffset); 2100 // Section 2.2.1.6 2101 baseReg = MCOperand::createReg(insn.addressSize == 4 ? X86::EIP : 2102 X86::RIP); 2103 } 2104 else 2105 baseReg = MCOperand::createReg(X86::NoRegister); 2106 2107 indexReg = MCOperand::createReg(X86::NoRegister); 2108 break; 2109 case EA_BASE_BX_SI: 2110 baseReg = MCOperand::createReg(X86::BX); 2111 indexReg = MCOperand::createReg(X86::SI); 2112 break; 2113 case EA_BASE_BX_DI: 2114 baseReg = MCOperand::createReg(X86::BX); 2115 indexReg = MCOperand::createReg(X86::DI); 2116 break; 2117 case EA_BASE_BP_SI: 2118 baseReg = MCOperand::createReg(X86::BP); 2119 indexReg = MCOperand::createReg(X86::SI); 2120 break; 2121 case EA_BASE_BP_DI: 2122 baseReg = MCOperand::createReg(X86::BP); 2123 indexReg = MCOperand::createReg(X86::DI); 2124 break; 2125 default: 2126 indexReg = MCOperand::createReg(X86::NoRegister); 2127 switch (insn.eaBase) { 2128 default: 2129 debug("Unexpected eaBase"); 2130 return true; 2131 // Here, we will use the fill-ins defined above. However, 2132 // BX_SI, BX_DI, BP_SI, and BP_DI are all handled above and 2133 // sib and sib64 were handled in the top-level if, so they're only 2134 // placeholders to keep the compiler happy. 2135 #define ENTRY(x) \ 2136 case EA_BASE_##x: \ 2137 baseReg = MCOperand::createReg(X86::x); break; 2138 ALL_EA_BASES 2139 #undef ENTRY 2140 #define ENTRY(x) case EA_REG_##x: 2141 ALL_REGS 2142 #undef ENTRY 2143 debug("A R/M memory operand may not be a register; " 2144 "the base field must be a base."); 2145 return true; 2146 } 2147 } 2148 2149 scaleAmount = MCOperand::createImm(1); 2150 } 2151 2152 displacement = MCOperand::createImm(insn.displacement); 2153 2154 segmentReg = MCOperand::createReg(segmentRegnums[insn.segmentOverride]); 2155 2156 mcInst.addOperand(baseReg); 2157 mcInst.addOperand(scaleAmount); 2158 mcInst.addOperand(indexReg); 2159 2160 const uint8_t dispSize = 2161 (insn.eaDisplacement == EA_DISP_NONE) ? 0 : insn.displacementSize; 2162 2163 if (!Dis->tryAddingSymbolicOperand( 2164 mcInst, insn.displacement + pcrel, insn.startLocation, false, 2165 insn.displacementOffset, dispSize, insn.length)) 2166 mcInst.addOperand(displacement); 2167 mcInst.addOperand(segmentReg); 2168 return false; 2169 } 2170 2171 /// translateRM - Translates an operand stored in the R/M (and possibly SIB) 2172 /// byte of an instruction to LLVM form, and appends it to an MCInst. 2173 /// 2174 /// @param mcInst - The MCInst to append to. 2175 /// @param operand - The operand, as stored in the descriptor table. 2176 /// @param insn - The instruction to extract Mod, R/M, and SIB fields 2177 /// from. 2178 /// @return - 0 on success; nonzero otherwise 2179 static bool translateRM(MCInst &mcInst, const OperandSpecifier &operand, 2180 InternalInstruction &insn, const MCDisassembler *Dis) { 2181 switch (operand.type) { 2182 default: 2183 debug("Unexpected type for a R/M operand"); 2184 return true; 2185 case TYPE_R8: 2186 case TYPE_R16: 2187 case TYPE_R32: 2188 case TYPE_R64: 2189 case TYPE_Rv: 2190 case TYPE_MM64: 2191 case TYPE_XMM: 2192 case TYPE_YMM: 2193 case TYPE_ZMM: 2194 case TYPE_TMM: 2195 case TYPE_VK_PAIR: 2196 case TYPE_VK: 2197 case TYPE_DEBUGREG: 2198 case TYPE_CONTROLREG: 2199 case TYPE_BNDR: 2200 return translateRMRegister(mcInst, insn); 2201 case TYPE_M: 2202 case TYPE_MVSIBX: 2203 case TYPE_MVSIBY: 2204 case TYPE_MVSIBZ: 2205 return translateRMMemory(mcInst, insn, Dis); 2206 case TYPE_MSIB: 2207 return translateRMMemory(mcInst, insn, Dis, true); 2208 } 2209 } 2210 2211 /// translateFPRegister - Translates a stack position on the FPU stack to its 2212 /// LLVM form, and appends it to an MCInst. 2213 /// 2214 /// @param mcInst - The MCInst to append to. 2215 /// @param stackPos - The stack position to translate. 2216 static void translateFPRegister(MCInst &mcInst, 2217 uint8_t stackPos) { 2218 mcInst.addOperand(MCOperand::createReg(X86::ST0 + stackPos)); 2219 } 2220 2221 /// translateMaskRegister - Translates a 3-bit mask register number to 2222 /// LLVM form, and appends it to an MCInst. 2223 /// 2224 /// @param mcInst - The MCInst to append to. 2225 /// @param maskRegNum - Number of mask register from 0 to 7. 2226 /// @return - false on success; true otherwise. 2227 static bool translateMaskRegister(MCInst &mcInst, 2228 uint8_t maskRegNum) { 2229 if (maskRegNum >= 8) { 2230 debug("Invalid mask register number"); 2231 return true; 2232 } 2233 2234 mcInst.addOperand(MCOperand::createReg(X86::K0 + maskRegNum)); 2235 return false; 2236 } 2237 2238 /// translateOperand - Translates an operand stored in an internal instruction 2239 /// to LLVM's format and appends it to an MCInst. 2240 /// 2241 /// @param mcInst - The MCInst to append to. 2242 /// @param operand - The operand, as stored in the descriptor table. 2243 /// @param insn - The internal instruction. 2244 /// @return - false on success; true otherwise. 2245 static bool translateOperand(MCInst &mcInst, const OperandSpecifier &operand, 2246 InternalInstruction &insn, 2247 const MCDisassembler *Dis) { 2248 switch (operand.encoding) { 2249 default: 2250 debug("Unhandled operand encoding during translation"); 2251 return true; 2252 case ENCODING_REG: 2253 translateRegister(mcInst, insn.reg); 2254 return false; 2255 case ENCODING_WRITEMASK: 2256 return translateMaskRegister(mcInst, insn.writemask); 2257 case ENCODING_SIB: 2258 CASE_ENCODING_RM: 2259 CASE_ENCODING_VSIB: 2260 return translateRM(mcInst, operand, insn, Dis); 2261 case ENCODING_IB: 2262 case ENCODING_IW: 2263 case ENCODING_ID: 2264 case ENCODING_IO: 2265 case ENCODING_Iv: 2266 case ENCODING_Ia: 2267 translateImmediate(mcInst, 2268 insn.immediates[insn.numImmediatesTranslated++], 2269 operand, 2270 insn, 2271 Dis); 2272 return false; 2273 case ENCODING_IRC: 2274 mcInst.addOperand(MCOperand::createImm(insn.RC)); 2275 return false; 2276 case ENCODING_SI: 2277 return translateSrcIndex(mcInst, insn); 2278 case ENCODING_DI: 2279 return translateDstIndex(mcInst, insn); 2280 case ENCODING_RB: 2281 case ENCODING_RW: 2282 case ENCODING_RD: 2283 case ENCODING_RO: 2284 case ENCODING_Rv: 2285 translateRegister(mcInst, insn.opcodeRegister); 2286 return false; 2287 case ENCODING_CC: 2288 mcInst.addOperand(MCOperand::createImm(insn.immediates[1])); 2289 return false; 2290 case ENCODING_FP: 2291 translateFPRegister(mcInst, insn.modRM & 7); 2292 return false; 2293 case ENCODING_VVVV: 2294 translateRegister(mcInst, insn.vvvv); 2295 return false; 2296 case ENCODING_DUP: 2297 return translateOperand(mcInst, insn.operands[operand.type - TYPE_DUP0], 2298 insn, Dis); 2299 } 2300 } 2301 2302 /// translateInstruction - Translates an internal instruction and all its 2303 /// operands to an MCInst. 2304 /// 2305 /// @param mcInst - The MCInst to populate with the instruction's data. 2306 /// @param insn - The internal instruction. 2307 /// @return - false on success; true otherwise. 2308 static bool translateInstruction(MCInst &mcInst, 2309 InternalInstruction &insn, 2310 const MCDisassembler *Dis) { 2311 if (!insn.spec) { 2312 debug("Instruction has no specification"); 2313 return true; 2314 } 2315 2316 mcInst.clear(); 2317 mcInst.setOpcode(insn.instructionID); 2318 // If when reading the prefix bytes we determined the overlapping 0xf2 or 0xf3 2319 // prefix bytes should be disassembled as xrelease and xacquire then set the 2320 // opcode to those instead of the rep and repne opcodes. 2321 if (insn.xAcquireRelease) { 2322 if(mcInst.getOpcode() == X86::REP_PREFIX) 2323 mcInst.setOpcode(X86::XRELEASE_PREFIX); 2324 else if(mcInst.getOpcode() == X86::REPNE_PREFIX) 2325 mcInst.setOpcode(X86::XACQUIRE_PREFIX); 2326 } 2327 2328 insn.numImmediatesTranslated = 0; 2329 2330 for (const auto &Op : insn.operands) { 2331 if (Op.encoding != ENCODING_NONE) { 2332 if (translateOperand(mcInst, Op, insn, Dis)) { 2333 return true; 2334 } 2335 } 2336 } 2337 2338 return false; 2339 } 2340 2341 static MCDisassembler *createX86Disassembler(const Target &T, 2342 const MCSubtargetInfo &STI, 2343 MCContext &Ctx) { 2344 std::unique_ptr<const MCInstrInfo> MII(T.createMCInstrInfo()); 2345 return new X86GenericDisassembler(STI, Ctx, std::move(MII)); 2346 } 2347 2348 extern "C" LLVM_EXTERNAL_VISIBILITY void LLVMInitializeX86Disassembler() { 2349 // Register the disassembler. 2350 TargetRegistry::RegisterMCDisassembler(getTheX86_32Target(), 2351 createX86Disassembler); 2352 TargetRegistry::RegisterMCDisassembler(getTheX86_64Target(), 2353 createX86Disassembler); 2354 } 2355