1 //===-- X86Disassembler.cpp - Disassembler for x86 and x86_64 -------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file is part of the X86 Disassembler. 10 // It contains code to translate the data produced by the decoder into 11 // MCInsts. 12 // 13 // 14 // The X86 disassembler is a table-driven disassembler for the 16-, 32-, and 15 // 64-bit X86 instruction sets. The main decode sequence for an assembly 16 // instruction in this disassembler is: 17 // 18 // 1. Read the prefix bytes and determine the attributes of the instruction. 19 // These attributes, recorded in enum attributeBits 20 // (X86DisassemblerDecoderCommon.h), form a bitmask. The table CONTEXTS_SYM 21 // provides a mapping from bitmasks to contexts, which are represented by 22 // enum InstructionContext (ibid.). 23 // 24 // 2. Read the opcode, and determine what kind of opcode it is. The 25 // disassembler distinguishes four kinds of opcodes, which are enumerated in 26 // OpcodeType (X86DisassemblerDecoderCommon.h): one-byte (0xnn), two-byte 27 // (0x0f 0xnn), three-byte-38 (0x0f 0x38 0xnn), or three-byte-3a 28 // (0x0f 0x3a 0xnn). Mandatory prefixes are treated as part of the context. 29 // 30 // 3. Depending on the opcode type, look in one of four ClassDecision structures 31 // (X86DisassemblerDecoderCommon.h). Use the opcode class to determine which 32 // OpcodeDecision (ibid.) to look the opcode in. Look up the opcode, to get 33 // a ModRMDecision (ibid.). 34 // 35 // 4. Some instructions, such as escape opcodes or extended opcodes, or even 36 // instructions that have ModRM*Reg / ModRM*Mem forms in LLVM, need the 37 // ModR/M byte to complete decode. The ModRMDecision's type is an entry from 38 // ModRMDecisionType (X86DisassemblerDecoderCommon.h) that indicates if the 39 // ModR/M byte is required and how to interpret it. 40 // 41 // 5. After resolving the ModRMDecision, the disassembler has a unique ID 42 // of type InstrUID (X86DisassemblerDecoderCommon.h). Looking this ID up in 43 // INSTRUCTIONS_SYM yields the name of the instruction and the encodings and 44 // meanings of its operands. 45 // 46 // 6. For each operand, its encoding is an entry from OperandEncoding 47 // (X86DisassemblerDecoderCommon.h) and its type is an entry from 48 // OperandType (ibid.). The encoding indicates how to read it from the 49 // instruction; the type indicates how to interpret the value once it has 50 // been read. For example, a register operand could be stored in the R/M 51 // field of the ModR/M byte, the REG field of the ModR/M byte, or added to 52 // the main opcode. This is orthogonal from its meaning (an GPR or an XMM 53 // register, for instance). Given this information, the operands can be 54 // extracted and interpreted. 55 // 56 // 7. As the last step, the disassembler translates the instruction information 57 // and operands into a format understandable by the client - in this case, an 58 // MCInst for use by the MC infrastructure. 59 // 60 // The disassembler is broken broadly into two parts: the table emitter that 61 // emits the instruction decode tables discussed above during compilation, and 62 // the disassembler itself. The table emitter is documented in more detail in 63 // utils/TableGen/X86DisassemblerEmitter.h. 64 // 65 // X86Disassembler.cpp contains the code responsible for step 7, and for 66 // invoking the decoder to execute steps 1-6. 67 // X86DisassemblerDecoderCommon.h contains the definitions needed by both the 68 // table emitter and the disassembler. 69 // X86DisassemblerDecoder.h contains the public interface of the decoder, 70 // factored out into C for possible use by other projects. 71 // X86DisassemblerDecoder.c contains the source code of the decoder, which is 72 // responsible for steps 1-6. 73 // 74 //===----------------------------------------------------------------------===// 75 76 #include "MCTargetDesc/X86BaseInfo.h" 77 #include "MCTargetDesc/X86MCTargetDesc.h" 78 #include "TargetInfo/X86TargetInfo.h" 79 #include "X86DisassemblerDecoder.h" 80 #include "llvm/MC/MCContext.h" 81 #include "llvm/MC/MCDisassembler/MCDisassembler.h" 82 #include "llvm/MC/MCExpr.h" 83 #include "llvm/MC/MCInst.h" 84 #include "llvm/MC/MCInstrInfo.h" 85 #include "llvm/MC/MCSubtargetInfo.h" 86 #include "llvm/MC/TargetRegistry.h" 87 #include "llvm/Support/Debug.h" 88 #include "llvm/Support/Format.h" 89 #include "llvm/Support/raw_ostream.h" 90 91 using namespace llvm; 92 using namespace llvm::X86Disassembler; 93 94 #define DEBUG_TYPE "x86-disassembler" 95 96 #define debug(s) LLVM_DEBUG(dbgs() << __LINE__ << ": " << s); 97 98 // Specifies whether a ModR/M byte is needed and (if so) which 99 // instruction each possible value of the ModR/M byte corresponds to. Once 100 // this information is known, we have narrowed down to a single instruction. 101 struct ModRMDecision { 102 uint8_t modrm_type; 103 uint16_t instructionIDs; 104 }; 105 106 // Specifies which set of ModR/M->instruction tables to look at 107 // given a particular opcode. 108 struct OpcodeDecision { 109 ModRMDecision modRMDecisions[256]; 110 }; 111 112 // Specifies which opcode->instruction tables to look at given 113 // a particular context (set of attributes). Since there are many possible 114 // contexts, the decoder first uses CONTEXTS_SYM to determine which context 115 // applies given a specific set of attributes. Hence there are only IC_max 116 // entries in this table, rather than 2^(ATTR_max). 117 struct ContextDecision { 118 OpcodeDecision opcodeDecisions[IC_max]; 119 }; 120 121 #include "X86GenDisassemblerTables.inc" 122 123 static InstrUID decode(OpcodeType type, InstructionContext insnContext, 124 uint8_t opcode, uint8_t modRM) { 125 const struct ModRMDecision *dec; 126 127 switch (type) { 128 case ONEBYTE: 129 dec = &ONEBYTE_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 130 break; 131 case TWOBYTE: 132 dec = &TWOBYTE_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 133 break; 134 case THREEBYTE_38: 135 dec = &THREEBYTE38_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 136 break; 137 case THREEBYTE_3A: 138 dec = &THREEBYTE3A_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 139 break; 140 case XOP8_MAP: 141 dec = &XOP8_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 142 break; 143 case XOP9_MAP: 144 dec = &XOP9_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 145 break; 146 case XOPA_MAP: 147 dec = &XOPA_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 148 break; 149 case THREEDNOW_MAP: 150 dec = 151 &THREEDNOW_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 152 break; 153 case MAP5: 154 dec = &MAP5_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 155 break; 156 case MAP6: 157 dec = &MAP6_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; 158 break; 159 } 160 161 switch (dec->modrm_type) { 162 default: 163 llvm_unreachable("Corrupt table! Unknown modrm_type"); 164 return 0; 165 case MODRM_ONEENTRY: 166 return modRMTable[dec->instructionIDs]; 167 case MODRM_SPLITRM: 168 if (modFromModRM(modRM) == 0x3) 169 return modRMTable[dec->instructionIDs + 1]; 170 return modRMTable[dec->instructionIDs]; 171 case MODRM_SPLITREG: 172 if (modFromModRM(modRM) == 0x3) 173 return modRMTable[dec->instructionIDs + ((modRM & 0x38) >> 3) + 8]; 174 return modRMTable[dec->instructionIDs + ((modRM & 0x38) >> 3)]; 175 case MODRM_SPLITMISC: 176 if (modFromModRM(modRM) == 0x3) 177 return modRMTable[dec->instructionIDs + (modRM & 0x3f) + 8]; 178 return modRMTable[dec->instructionIDs + ((modRM & 0x38) >> 3)]; 179 case MODRM_FULL: 180 return modRMTable[dec->instructionIDs + modRM]; 181 } 182 } 183 184 static bool peek(struct InternalInstruction *insn, uint8_t &byte) { 185 uint64_t offset = insn->readerCursor - insn->startLocation; 186 if (offset >= insn->bytes.size()) 187 return true; 188 byte = insn->bytes[offset]; 189 return false; 190 } 191 192 template <typename T> static bool consume(InternalInstruction *insn, T &ptr) { 193 auto r = insn->bytes; 194 uint64_t offset = insn->readerCursor - insn->startLocation; 195 if (offset + sizeof(T) > r.size()) 196 return true; 197 T ret = 0; 198 for (unsigned i = 0; i < sizeof(T); ++i) 199 ret |= (uint64_t)r[offset + i] << (i * 8); 200 ptr = ret; 201 insn->readerCursor += sizeof(T); 202 return false; 203 } 204 205 static bool isREX(struct InternalInstruction *insn, uint8_t prefix) { 206 return insn->mode == MODE_64BIT && prefix >= 0x40 && prefix <= 0x4f; 207 } 208 209 // Consumes all of an instruction's prefix bytes, and marks the 210 // instruction as having them. Also sets the instruction's default operand, 211 // address, and other relevant data sizes to report operands correctly. 212 // 213 // insn must not be empty. 214 static int readPrefixes(struct InternalInstruction *insn) { 215 bool isPrefix = true; 216 uint8_t byte = 0; 217 uint8_t nextByte; 218 219 LLVM_DEBUG(dbgs() << "readPrefixes()"); 220 221 while (isPrefix) { 222 // If we fail reading prefixes, just stop here and let the opcode reader 223 // deal with it. 224 if (consume(insn, byte)) 225 break; 226 227 // If the byte is a LOCK/REP/REPNE prefix and not a part of the opcode, then 228 // break and let it be disassembled as a normal "instruction". 229 if (insn->readerCursor - 1 == insn->startLocation && byte == 0xf0) // LOCK 230 break; 231 232 if ((byte == 0xf2 || byte == 0xf3) && !peek(insn, nextByte)) { 233 // If the byte is 0xf2 or 0xf3, and any of the following conditions are 234 // met: 235 // - it is followed by a LOCK (0xf0) prefix 236 // - it is followed by an xchg instruction 237 // then it should be disassembled as a xacquire/xrelease not repne/rep. 238 if (((nextByte == 0xf0) || 239 ((nextByte & 0xfe) == 0x86 || (nextByte & 0xf8) == 0x90))) { 240 insn->xAcquireRelease = true; 241 if (!(byte == 0xf3 && nextByte == 0x90)) // PAUSE instruction support 242 break; 243 } 244 // Also if the byte is 0xf3, and the following condition is met: 245 // - it is followed by a "mov mem, reg" (opcode 0x88/0x89) or 246 // "mov mem, imm" (opcode 0xc6/0xc7) instructions. 247 // then it should be disassembled as an xrelease not rep. 248 if (byte == 0xf3 && (nextByte == 0x88 || nextByte == 0x89 || 249 nextByte == 0xc6 || nextByte == 0xc7)) { 250 insn->xAcquireRelease = true; 251 break; 252 } 253 if (isREX(insn, nextByte)) { 254 uint8_t nnextByte; 255 // Go to REX prefix after the current one 256 if (consume(insn, nnextByte)) 257 return -1; 258 // We should be able to read next byte after REX prefix 259 if (peek(insn, nnextByte)) 260 return -1; 261 --insn->readerCursor; 262 } 263 } 264 265 switch (byte) { 266 case 0xf0: // LOCK 267 insn->hasLockPrefix = true; 268 break; 269 case 0xf2: // REPNE/REPNZ 270 case 0xf3: { // REP or REPE/REPZ 271 uint8_t nextByte; 272 if (peek(insn, nextByte)) 273 break; 274 // TODO: 275 // 1. There could be several 0x66 276 // 2. if (nextByte == 0x66) and nextNextByte != 0x0f then 277 // it's not mandatory prefix 278 // 3. if (nextByte >= 0x40 && nextByte <= 0x4f) it's REX and we need 279 // 0x0f exactly after it to be mandatory prefix 280 if (isREX(insn, nextByte) || nextByte == 0x0f || nextByte == 0x66) 281 // The last of 0xf2 /0xf3 is mandatory prefix 282 insn->mandatoryPrefix = byte; 283 insn->repeatPrefix = byte; 284 break; 285 } 286 case 0x2e: // CS segment override -OR- Branch not taken 287 insn->segmentOverride = SEG_OVERRIDE_CS; 288 break; 289 case 0x36: // SS segment override -OR- Branch taken 290 insn->segmentOverride = SEG_OVERRIDE_SS; 291 break; 292 case 0x3e: // DS segment override 293 insn->segmentOverride = SEG_OVERRIDE_DS; 294 break; 295 case 0x26: // ES segment override 296 insn->segmentOverride = SEG_OVERRIDE_ES; 297 break; 298 case 0x64: // FS segment override 299 insn->segmentOverride = SEG_OVERRIDE_FS; 300 break; 301 case 0x65: // GS segment override 302 insn->segmentOverride = SEG_OVERRIDE_GS; 303 break; 304 case 0x66: { // Operand-size override { 305 uint8_t nextByte; 306 insn->hasOpSize = true; 307 if (peek(insn, nextByte)) 308 break; 309 // 0x66 can't overwrite existing mandatory prefix and should be ignored 310 if (!insn->mandatoryPrefix && (nextByte == 0x0f || isREX(insn, nextByte))) 311 insn->mandatoryPrefix = byte; 312 break; 313 } 314 case 0x67: // Address-size override 315 insn->hasAdSize = true; 316 break; 317 default: // Not a prefix byte 318 isPrefix = false; 319 break; 320 } 321 322 if (isPrefix) 323 LLVM_DEBUG(dbgs() << format("Found prefix 0x%hhx", byte)); 324 } 325 326 insn->vectorExtensionType = TYPE_NO_VEX_XOP; 327 328 if (byte == 0x62) { 329 uint8_t byte1, byte2; 330 if (consume(insn, byte1)) { 331 LLVM_DEBUG(dbgs() << "Couldn't read second byte of EVEX prefix"); 332 return -1; 333 } 334 335 if (peek(insn, byte2)) { 336 LLVM_DEBUG(dbgs() << "Couldn't read third byte of EVEX prefix"); 337 return -1; 338 } 339 340 if ((insn->mode == MODE_64BIT || (byte1 & 0xc0) == 0xc0) && 341 ((~byte1 & 0x8) == 0x8) && ((byte2 & 0x4) == 0x4)) { 342 insn->vectorExtensionType = TYPE_EVEX; 343 } else { 344 --insn->readerCursor; // unconsume byte1 345 --insn->readerCursor; // unconsume byte 346 } 347 348 if (insn->vectorExtensionType == TYPE_EVEX) { 349 insn->vectorExtensionPrefix[0] = byte; 350 insn->vectorExtensionPrefix[1] = byte1; 351 if (consume(insn, insn->vectorExtensionPrefix[2])) { 352 LLVM_DEBUG(dbgs() << "Couldn't read third byte of EVEX prefix"); 353 return -1; 354 } 355 if (consume(insn, insn->vectorExtensionPrefix[3])) { 356 LLVM_DEBUG(dbgs() << "Couldn't read fourth byte of EVEX prefix"); 357 return -1; 358 } 359 360 // We simulate the REX prefix for simplicity's sake 361 if (insn->mode == MODE_64BIT) { 362 insn->rexPrefix = 0x40 | 363 (wFromEVEX3of4(insn->vectorExtensionPrefix[2]) << 3) | 364 (rFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 2) | 365 (xFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 1) | 366 (bFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 0); 367 } 368 369 LLVM_DEBUG( 370 dbgs() << format( 371 "Found EVEX prefix 0x%hhx 0x%hhx 0x%hhx 0x%hhx", 372 insn->vectorExtensionPrefix[0], insn->vectorExtensionPrefix[1], 373 insn->vectorExtensionPrefix[2], insn->vectorExtensionPrefix[3])); 374 } 375 } else if (byte == 0xc4) { 376 uint8_t byte1; 377 if (peek(insn, byte1)) { 378 LLVM_DEBUG(dbgs() << "Couldn't read second byte of VEX"); 379 return -1; 380 } 381 382 if (insn->mode == MODE_64BIT || (byte1 & 0xc0) == 0xc0) 383 insn->vectorExtensionType = TYPE_VEX_3B; 384 else 385 --insn->readerCursor; 386 387 if (insn->vectorExtensionType == TYPE_VEX_3B) { 388 insn->vectorExtensionPrefix[0] = byte; 389 consume(insn, insn->vectorExtensionPrefix[1]); 390 consume(insn, insn->vectorExtensionPrefix[2]); 391 392 // We simulate the REX prefix for simplicity's sake 393 394 if (insn->mode == MODE_64BIT) 395 insn->rexPrefix = 0x40 | 396 (wFromVEX3of3(insn->vectorExtensionPrefix[2]) << 3) | 397 (rFromVEX2of3(insn->vectorExtensionPrefix[1]) << 2) | 398 (xFromVEX2of3(insn->vectorExtensionPrefix[1]) << 1) | 399 (bFromVEX2of3(insn->vectorExtensionPrefix[1]) << 0); 400 401 LLVM_DEBUG(dbgs() << format("Found VEX prefix 0x%hhx 0x%hhx 0x%hhx", 402 insn->vectorExtensionPrefix[0], 403 insn->vectorExtensionPrefix[1], 404 insn->vectorExtensionPrefix[2])); 405 } 406 } else if (byte == 0xc5) { 407 uint8_t byte1; 408 if (peek(insn, byte1)) { 409 LLVM_DEBUG(dbgs() << "Couldn't read second byte of VEX"); 410 return -1; 411 } 412 413 if (insn->mode == MODE_64BIT || (byte1 & 0xc0) == 0xc0) 414 insn->vectorExtensionType = TYPE_VEX_2B; 415 else 416 --insn->readerCursor; 417 418 if (insn->vectorExtensionType == TYPE_VEX_2B) { 419 insn->vectorExtensionPrefix[0] = byte; 420 consume(insn, insn->vectorExtensionPrefix[1]); 421 422 if (insn->mode == MODE_64BIT) 423 insn->rexPrefix = 424 0x40 | (rFromVEX2of2(insn->vectorExtensionPrefix[1]) << 2); 425 426 switch (ppFromVEX2of2(insn->vectorExtensionPrefix[1])) { 427 default: 428 break; 429 case VEX_PREFIX_66: 430 insn->hasOpSize = true; 431 break; 432 } 433 434 LLVM_DEBUG(dbgs() << format("Found VEX prefix 0x%hhx 0x%hhx", 435 insn->vectorExtensionPrefix[0], 436 insn->vectorExtensionPrefix[1])); 437 } 438 } else if (byte == 0x8f) { 439 uint8_t byte1; 440 if (peek(insn, byte1)) { 441 LLVM_DEBUG(dbgs() << "Couldn't read second byte of XOP"); 442 return -1; 443 } 444 445 if ((byte1 & 0x38) != 0x0) // 0 in these 3 bits is a POP instruction. 446 insn->vectorExtensionType = TYPE_XOP; 447 else 448 --insn->readerCursor; 449 450 if (insn->vectorExtensionType == TYPE_XOP) { 451 insn->vectorExtensionPrefix[0] = byte; 452 consume(insn, insn->vectorExtensionPrefix[1]); 453 consume(insn, insn->vectorExtensionPrefix[2]); 454 455 // We simulate the REX prefix for simplicity's sake 456 457 if (insn->mode == MODE_64BIT) 458 insn->rexPrefix = 0x40 | 459 (wFromXOP3of3(insn->vectorExtensionPrefix[2]) << 3) | 460 (rFromXOP2of3(insn->vectorExtensionPrefix[1]) << 2) | 461 (xFromXOP2of3(insn->vectorExtensionPrefix[1]) << 1) | 462 (bFromXOP2of3(insn->vectorExtensionPrefix[1]) << 0); 463 464 switch (ppFromXOP3of3(insn->vectorExtensionPrefix[2])) { 465 default: 466 break; 467 case VEX_PREFIX_66: 468 insn->hasOpSize = true; 469 break; 470 } 471 472 LLVM_DEBUG(dbgs() << format("Found XOP prefix 0x%hhx 0x%hhx 0x%hhx", 473 insn->vectorExtensionPrefix[0], 474 insn->vectorExtensionPrefix[1], 475 insn->vectorExtensionPrefix[2])); 476 } 477 } else if (isREX(insn, byte)) { 478 if (peek(insn, nextByte)) 479 return -1; 480 insn->rexPrefix = byte; 481 LLVM_DEBUG(dbgs() << format("Found REX prefix 0x%hhx", byte)); 482 } else 483 --insn->readerCursor; 484 485 if (insn->mode == MODE_16BIT) { 486 insn->registerSize = (insn->hasOpSize ? 4 : 2); 487 insn->addressSize = (insn->hasAdSize ? 4 : 2); 488 insn->displacementSize = (insn->hasAdSize ? 4 : 2); 489 insn->immediateSize = (insn->hasOpSize ? 4 : 2); 490 } else if (insn->mode == MODE_32BIT) { 491 insn->registerSize = (insn->hasOpSize ? 2 : 4); 492 insn->addressSize = (insn->hasAdSize ? 2 : 4); 493 insn->displacementSize = (insn->hasAdSize ? 2 : 4); 494 insn->immediateSize = (insn->hasOpSize ? 2 : 4); 495 } else if (insn->mode == MODE_64BIT) { 496 if (insn->rexPrefix && wFromREX(insn->rexPrefix)) { 497 insn->registerSize = 8; 498 insn->addressSize = (insn->hasAdSize ? 4 : 8); 499 insn->displacementSize = 4; 500 insn->immediateSize = 4; 501 insn->hasOpSize = false; 502 } else { 503 insn->registerSize = (insn->hasOpSize ? 2 : 4); 504 insn->addressSize = (insn->hasAdSize ? 4 : 8); 505 insn->displacementSize = (insn->hasOpSize ? 2 : 4); 506 insn->immediateSize = (insn->hasOpSize ? 2 : 4); 507 } 508 } 509 510 return 0; 511 } 512 513 // Consumes the SIB byte to determine addressing information. 514 static int readSIB(struct InternalInstruction *insn) { 515 SIBBase sibBaseBase = SIB_BASE_NONE; 516 uint8_t index, base; 517 518 LLVM_DEBUG(dbgs() << "readSIB()"); 519 switch (insn->addressSize) { 520 case 2: 521 default: 522 llvm_unreachable("SIB-based addressing doesn't work in 16-bit mode"); 523 case 4: 524 insn->sibIndexBase = SIB_INDEX_EAX; 525 sibBaseBase = SIB_BASE_EAX; 526 break; 527 case 8: 528 insn->sibIndexBase = SIB_INDEX_RAX; 529 sibBaseBase = SIB_BASE_RAX; 530 break; 531 } 532 533 if (consume(insn, insn->sib)) 534 return -1; 535 536 index = indexFromSIB(insn->sib) | (xFromREX(insn->rexPrefix) << 3); 537 538 if (index == 0x4) { 539 insn->sibIndex = SIB_INDEX_NONE; 540 } else { 541 insn->sibIndex = (SIBIndex)(insn->sibIndexBase + index); 542 } 543 544 insn->sibScale = 1 << scaleFromSIB(insn->sib); 545 546 base = baseFromSIB(insn->sib) | (bFromREX(insn->rexPrefix) << 3); 547 548 switch (base) { 549 case 0x5: 550 case 0xd: 551 switch (modFromModRM(insn->modRM)) { 552 case 0x0: 553 insn->eaDisplacement = EA_DISP_32; 554 insn->sibBase = SIB_BASE_NONE; 555 break; 556 case 0x1: 557 insn->eaDisplacement = EA_DISP_8; 558 insn->sibBase = (SIBBase)(sibBaseBase + base); 559 break; 560 case 0x2: 561 insn->eaDisplacement = EA_DISP_32; 562 insn->sibBase = (SIBBase)(sibBaseBase + base); 563 break; 564 default: 565 llvm_unreachable("Cannot have Mod = 0b11 and a SIB byte"); 566 } 567 break; 568 default: 569 insn->sibBase = (SIBBase)(sibBaseBase + base); 570 break; 571 } 572 573 return 0; 574 } 575 576 static int readDisplacement(struct InternalInstruction *insn) { 577 int8_t d8; 578 int16_t d16; 579 int32_t d32; 580 LLVM_DEBUG(dbgs() << "readDisplacement()"); 581 582 insn->displacementOffset = insn->readerCursor - insn->startLocation; 583 switch (insn->eaDisplacement) { 584 case EA_DISP_NONE: 585 break; 586 case EA_DISP_8: 587 if (consume(insn, d8)) 588 return -1; 589 insn->displacement = d8; 590 break; 591 case EA_DISP_16: 592 if (consume(insn, d16)) 593 return -1; 594 insn->displacement = d16; 595 break; 596 case EA_DISP_32: 597 if (consume(insn, d32)) 598 return -1; 599 insn->displacement = d32; 600 break; 601 } 602 603 return 0; 604 } 605 606 // Consumes all addressing information (ModR/M byte, SIB byte, and displacement. 607 static int readModRM(struct InternalInstruction *insn) { 608 uint8_t mod, rm, reg, evexrm; 609 LLVM_DEBUG(dbgs() << "readModRM()"); 610 611 if (insn->consumedModRM) 612 return 0; 613 614 if (consume(insn, insn->modRM)) 615 return -1; 616 insn->consumedModRM = true; 617 618 mod = modFromModRM(insn->modRM); 619 rm = rmFromModRM(insn->modRM); 620 reg = regFromModRM(insn->modRM); 621 622 // This goes by insn->registerSize to pick the correct register, which messes 623 // up if we're using (say) XMM or 8-bit register operands. That gets fixed in 624 // fixupReg(). 625 switch (insn->registerSize) { 626 case 2: 627 insn->regBase = MODRM_REG_AX; 628 insn->eaRegBase = EA_REG_AX; 629 break; 630 case 4: 631 insn->regBase = MODRM_REG_EAX; 632 insn->eaRegBase = EA_REG_EAX; 633 break; 634 case 8: 635 insn->regBase = MODRM_REG_RAX; 636 insn->eaRegBase = EA_REG_RAX; 637 break; 638 } 639 640 reg |= rFromREX(insn->rexPrefix) << 3; 641 rm |= bFromREX(insn->rexPrefix) << 3; 642 643 evexrm = 0; 644 if (insn->vectorExtensionType == TYPE_EVEX && insn->mode == MODE_64BIT) { 645 reg |= r2FromEVEX2of4(insn->vectorExtensionPrefix[1]) << 4; 646 evexrm = xFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 4; 647 } 648 649 insn->reg = (Reg)(insn->regBase + reg); 650 651 switch (insn->addressSize) { 652 case 2: { 653 EABase eaBaseBase = EA_BASE_BX_SI; 654 655 switch (mod) { 656 case 0x0: 657 if (rm == 0x6) { 658 insn->eaBase = EA_BASE_NONE; 659 insn->eaDisplacement = EA_DISP_16; 660 if (readDisplacement(insn)) 661 return -1; 662 } else { 663 insn->eaBase = (EABase)(eaBaseBase + rm); 664 insn->eaDisplacement = EA_DISP_NONE; 665 } 666 break; 667 case 0x1: 668 insn->eaBase = (EABase)(eaBaseBase + rm); 669 insn->eaDisplacement = EA_DISP_8; 670 insn->displacementSize = 1; 671 if (readDisplacement(insn)) 672 return -1; 673 break; 674 case 0x2: 675 insn->eaBase = (EABase)(eaBaseBase + rm); 676 insn->eaDisplacement = EA_DISP_16; 677 if (readDisplacement(insn)) 678 return -1; 679 break; 680 case 0x3: 681 insn->eaBase = (EABase)(insn->eaRegBase + rm); 682 if (readDisplacement(insn)) 683 return -1; 684 break; 685 } 686 break; 687 } 688 case 4: 689 case 8: { 690 EABase eaBaseBase = (insn->addressSize == 4 ? EA_BASE_EAX : EA_BASE_RAX); 691 692 switch (mod) { 693 case 0x0: 694 insn->eaDisplacement = EA_DISP_NONE; // readSIB may override this 695 // In determining whether RIP-relative mode is used (rm=5), 696 // or whether a SIB byte is present (rm=4), 697 // the extension bits (REX.b and EVEX.x) are ignored. 698 switch (rm & 7) { 699 case 0x4: // SIB byte is present 700 insn->eaBase = (insn->addressSize == 4 ? EA_BASE_sib : EA_BASE_sib64); 701 if (readSIB(insn) || readDisplacement(insn)) 702 return -1; 703 break; 704 case 0x5: // RIP-relative 705 insn->eaBase = EA_BASE_NONE; 706 insn->eaDisplacement = EA_DISP_32; 707 if (readDisplacement(insn)) 708 return -1; 709 break; 710 default: 711 insn->eaBase = (EABase)(eaBaseBase + rm); 712 break; 713 } 714 break; 715 case 0x1: 716 insn->displacementSize = 1; 717 LLVM_FALLTHROUGH; 718 case 0x2: 719 insn->eaDisplacement = (mod == 0x1 ? EA_DISP_8 : EA_DISP_32); 720 switch (rm & 7) { 721 case 0x4: // SIB byte is present 722 insn->eaBase = EA_BASE_sib; 723 if (readSIB(insn) || readDisplacement(insn)) 724 return -1; 725 break; 726 default: 727 insn->eaBase = (EABase)(eaBaseBase + rm); 728 if (readDisplacement(insn)) 729 return -1; 730 break; 731 } 732 break; 733 case 0x3: 734 insn->eaDisplacement = EA_DISP_NONE; 735 insn->eaBase = (EABase)(insn->eaRegBase + rm + evexrm); 736 break; 737 } 738 break; 739 } 740 } // switch (insn->addressSize) 741 742 return 0; 743 } 744 745 #define GENERIC_FIXUP_FUNC(name, base, prefix, mask) \ 746 static uint16_t name(struct InternalInstruction *insn, OperandType type, \ 747 uint8_t index, uint8_t *valid) { \ 748 *valid = 1; \ 749 switch (type) { \ 750 default: \ 751 debug("Unhandled register type"); \ 752 *valid = 0; \ 753 return 0; \ 754 case TYPE_Rv: \ 755 return base + index; \ 756 case TYPE_R8: \ 757 index &= mask; \ 758 if (index > 0xf) \ 759 *valid = 0; \ 760 if (insn->rexPrefix && index >= 4 && index <= 7) { \ 761 return prefix##_SPL + (index - 4); \ 762 } else { \ 763 return prefix##_AL + index; \ 764 } \ 765 case TYPE_R16: \ 766 index &= mask; \ 767 if (index > 0xf) \ 768 *valid = 0; \ 769 return prefix##_AX + index; \ 770 case TYPE_R32: \ 771 index &= mask; \ 772 if (index > 0xf) \ 773 *valid = 0; \ 774 return prefix##_EAX + index; \ 775 case TYPE_R64: \ 776 index &= mask; \ 777 if (index > 0xf) \ 778 *valid = 0; \ 779 return prefix##_RAX + index; \ 780 case TYPE_ZMM: \ 781 return prefix##_ZMM0 + index; \ 782 case TYPE_YMM: \ 783 return prefix##_YMM0 + index; \ 784 case TYPE_XMM: \ 785 return prefix##_XMM0 + index; \ 786 case TYPE_TMM: \ 787 if (index > 7) \ 788 *valid = 0; \ 789 return prefix##_TMM0 + index; \ 790 case TYPE_VK: \ 791 index &= 0xf; \ 792 if (index > 7) \ 793 *valid = 0; \ 794 return prefix##_K0 + index; \ 795 case TYPE_VK_PAIR: \ 796 if (index > 7) \ 797 *valid = 0; \ 798 return prefix##_K0_K1 + (index / 2); \ 799 case TYPE_MM64: \ 800 return prefix##_MM0 + (index & 0x7); \ 801 case TYPE_SEGMENTREG: \ 802 if ((index & 7) > 5) \ 803 *valid = 0; \ 804 return prefix##_ES + (index & 7); \ 805 case TYPE_DEBUGREG: \ 806 return prefix##_DR0 + index; \ 807 case TYPE_CONTROLREG: \ 808 return prefix##_CR0 + index; \ 809 case TYPE_MVSIBX: \ 810 return prefix##_XMM0 + index; \ 811 case TYPE_MVSIBY: \ 812 return prefix##_YMM0 + index; \ 813 case TYPE_MVSIBZ: \ 814 return prefix##_ZMM0 + index; \ 815 } \ 816 } 817 818 // Consult an operand type to determine the meaning of the reg or R/M field. If 819 // the operand is an XMM operand, for example, an operand would be XMM0 instead 820 // of AX, which readModRM() would otherwise misinterpret it as. 821 // 822 // @param insn - The instruction containing the operand. 823 // @param type - The operand type. 824 // @param index - The existing value of the field as reported by readModRM(). 825 // @param valid - The address of a uint8_t. The target is set to 1 if the 826 // field is valid for the register class; 0 if not. 827 // @return - The proper value. 828 GENERIC_FIXUP_FUNC(fixupRegValue, insn->regBase, MODRM_REG, 0x1f) 829 GENERIC_FIXUP_FUNC(fixupRMValue, insn->eaRegBase, EA_REG, 0xf) 830 831 // Consult an operand specifier to determine which of the fixup*Value functions 832 // to use in correcting readModRM()'ss interpretation. 833 // 834 // @param insn - See fixup*Value(). 835 // @param op - The operand specifier. 836 // @return - 0 if fixup was successful; -1 if the register returned was 837 // invalid for its class. 838 static int fixupReg(struct InternalInstruction *insn, 839 const struct OperandSpecifier *op) { 840 uint8_t valid; 841 LLVM_DEBUG(dbgs() << "fixupReg()"); 842 843 switch ((OperandEncoding)op->encoding) { 844 default: 845 debug("Expected a REG or R/M encoding in fixupReg"); 846 return -1; 847 case ENCODING_VVVV: 848 insn->vvvv = 849 (Reg)fixupRegValue(insn, (OperandType)op->type, insn->vvvv, &valid); 850 if (!valid) 851 return -1; 852 break; 853 case ENCODING_REG: 854 insn->reg = (Reg)fixupRegValue(insn, (OperandType)op->type, 855 insn->reg - insn->regBase, &valid); 856 if (!valid) 857 return -1; 858 break; 859 case ENCODING_SIB: 860 CASE_ENCODING_RM: 861 if (insn->eaBase >= insn->eaRegBase) { 862 insn->eaBase = (EABase)fixupRMValue( 863 insn, (OperandType)op->type, insn->eaBase - insn->eaRegBase, &valid); 864 if (!valid) 865 return -1; 866 } 867 break; 868 } 869 870 return 0; 871 } 872 873 // Read the opcode (except the ModR/M byte in the case of extended or escape 874 // opcodes). 875 static bool readOpcode(struct InternalInstruction *insn) { 876 uint8_t current; 877 LLVM_DEBUG(dbgs() << "readOpcode()"); 878 879 insn->opcodeType = ONEBYTE; 880 if (insn->vectorExtensionType == TYPE_EVEX) { 881 switch (mmmFromEVEX2of4(insn->vectorExtensionPrefix[1])) { 882 default: 883 LLVM_DEBUG( 884 dbgs() << format("Unhandled mmm field for instruction (0x%hhx)", 885 mmmFromEVEX2of4(insn->vectorExtensionPrefix[1]))); 886 return true; 887 case VEX_LOB_0F: 888 insn->opcodeType = TWOBYTE; 889 return consume(insn, insn->opcode); 890 case VEX_LOB_0F38: 891 insn->opcodeType = THREEBYTE_38; 892 return consume(insn, insn->opcode); 893 case VEX_LOB_0F3A: 894 insn->opcodeType = THREEBYTE_3A; 895 return consume(insn, insn->opcode); 896 case VEX_LOB_MAP5: 897 insn->opcodeType = MAP5; 898 return consume(insn, insn->opcode); 899 case VEX_LOB_MAP6: 900 insn->opcodeType = MAP6; 901 return consume(insn, insn->opcode); 902 } 903 } else if (insn->vectorExtensionType == TYPE_VEX_3B) { 904 switch (mmmmmFromVEX2of3(insn->vectorExtensionPrefix[1])) { 905 default: 906 LLVM_DEBUG( 907 dbgs() << format("Unhandled m-mmmm field for instruction (0x%hhx)", 908 mmmmmFromVEX2of3(insn->vectorExtensionPrefix[1]))); 909 return true; 910 case VEX_LOB_0F: 911 insn->opcodeType = TWOBYTE; 912 return consume(insn, insn->opcode); 913 case VEX_LOB_0F38: 914 insn->opcodeType = THREEBYTE_38; 915 return consume(insn, insn->opcode); 916 case VEX_LOB_0F3A: 917 insn->opcodeType = THREEBYTE_3A; 918 return consume(insn, insn->opcode); 919 case VEX_LOB_MAP5: 920 insn->opcodeType = MAP5; 921 return consume(insn, insn->opcode); 922 case VEX_LOB_MAP6: 923 insn->opcodeType = MAP6; 924 return consume(insn, insn->opcode); 925 } 926 } else if (insn->vectorExtensionType == TYPE_VEX_2B) { 927 insn->opcodeType = TWOBYTE; 928 return consume(insn, insn->opcode); 929 } else if (insn->vectorExtensionType == TYPE_XOP) { 930 switch (mmmmmFromXOP2of3(insn->vectorExtensionPrefix[1])) { 931 default: 932 LLVM_DEBUG( 933 dbgs() << format("Unhandled m-mmmm field for instruction (0x%hhx)", 934 mmmmmFromVEX2of3(insn->vectorExtensionPrefix[1]))); 935 return true; 936 case XOP_MAP_SELECT_8: 937 insn->opcodeType = XOP8_MAP; 938 return consume(insn, insn->opcode); 939 case XOP_MAP_SELECT_9: 940 insn->opcodeType = XOP9_MAP; 941 return consume(insn, insn->opcode); 942 case XOP_MAP_SELECT_A: 943 insn->opcodeType = XOPA_MAP; 944 return consume(insn, insn->opcode); 945 } 946 } 947 948 if (consume(insn, current)) 949 return true; 950 951 if (current == 0x0f) { 952 LLVM_DEBUG( 953 dbgs() << format("Found a two-byte escape prefix (0x%hhx)", current)); 954 if (consume(insn, current)) 955 return true; 956 957 if (current == 0x38) { 958 LLVM_DEBUG(dbgs() << format("Found a three-byte escape prefix (0x%hhx)", 959 current)); 960 if (consume(insn, current)) 961 return true; 962 963 insn->opcodeType = THREEBYTE_38; 964 } else if (current == 0x3a) { 965 LLVM_DEBUG(dbgs() << format("Found a three-byte escape prefix (0x%hhx)", 966 current)); 967 if (consume(insn, current)) 968 return true; 969 970 insn->opcodeType = THREEBYTE_3A; 971 } else if (current == 0x0f) { 972 LLVM_DEBUG( 973 dbgs() << format("Found a 3dnow escape prefix (0x%hhx)", current)); 974 975 // Consume operands before the opcode to comply with the 3DNow encoding 976 if (readModRM(insn)) 977 return true; 978 979 if (consume(insn, current)) 980 return true; 981 982 insn->opcodeType = THREEDNOW_MAP; 983 } else { 984 LLVM_DEBUG(dbgs() << "Didn't find a three-byte escape prefix"); 985 insn->opcodeType = TWOBYTE; 986 } 987 } else if (insn->mandatoryPrefix) 988 // The opcode with mandatory prefix must start with opcode escape. 989 // If not it's legacy repeat prefix 990 insn->mandatoryPrefix = 0; 991 992 // At this point we have consumed the full opcode. 993 // Anything we consume from here on must be unconsumed. 994 insn->opcode = current; 995 996 return false; 997 } 998 999 // Determine whether equiv is the 16-bit equivalent of orig (32-bit or 64-bit). 1000 static bool is16BitEquivalent(const char *orig, const char *equiv) { 1001 for (int i = 0;; i++) { 1002 if (orig[i] == '\0' && equiv[i] == '\0') 1003 return true; 1004 if (orig[i] == '\0' || equiv[i] == '\0') 1005 return false; 1006 if (orig[i] != equiv[i]) { 1007 if ((orig[i] == 'Q' || orig[i] == 'L') && equiv[i] == 'W') 1008 continue; 1009 if ((orig[i] == '6' || orig[i] == '3') && equiv[i] == '1') 1010 continue; 1011 if ((orig[i] == '4' || orig[i] == '2') && equiv[i] == '6') 1012 continue; 1013 return false; 1014 } 1015 } 1016 } 1017 1018 // Determine whether this instruction is a 64-bit instruction. 1019 static bool is64Bit(const char *name) { 1020 for (int i = 0;; ++i) { 1021 if (name[i] == '\0') 1022 return false; 1023 if (name[i] == '6' && name[i + 1] == '4') 1024 return true; 1025 } 1026 } 1027 1028 // Determine the ID of an instruction, consuming the ModR/M byte as appropriate 1029 // for extended and escape opcodes, and using a supplied attribute mask. 1030 static int getInstructionIDWithAttrMask(uint16_t *instructionID, 1031 struct InternalInstruction *insn, 1032 uint16_t attrMask) { 1033 auto insnCtx = InstructionContext(x86DisassemblerContexts[attrMask]); 1034 const ContextDecision *decision; 1035 switch (insn->opcodeType) { 1036 case ONEBYTE: 1037 decision = &ONEBYTE_SYM; 1038 break; 1039 case TWOBYTE: 1040 decision = &TWOBYTE_SYM; 1041 break; 1042 case THREEBYTE_38: 1043 decision = &THREEBYTE38_SYM; 1044 break; 1045 case THREEBYTE_3A: 1046 decision = &THREEBYTE3A_SYM; 1047 break; 1048 case XOP8_MAP: 1049 decision = &XOP8_MAP_SYM; 1050 break; 1051 case XOP9_MAP: 1052 decision = &XOP9_MAP_SYM; 1053 break; 1054 case XOPA_MAP: 1055 decision = &XOPA_MAP_SYM; 1056 break; 1057 case THREEDNOW_MAP: 1058 decision = &THREEDNOW_MAP_SYM; 1059 break; 1060 case MAP5: 1061 decision = &MAP5_SYM; 1062 break; 1063 case MAP6: 1064 decision = &MAP6_SYM; 1065 break; 1066 } 1067 1068 if (decision->opcodeDecisions[insnCtx] 1069 .modRMDecisions[insn->opcode] 1070 .modrm_type != MODRM_ONEENTRY) { 1071 if (readModRM(insn)) 1072 return -1; 1073 *instructionID = 1074 decode(insn->opcodeType, insnCtx, insn->opcode, insn->modRM); 1075 } else { 1076 *instructionID = decode(insn->opcodeType, insnCtx, insn->opcode, 0); 1077 } 1078 1079 return 0; 1080 } 1081 1082 // Determine the ID of an instruction, consuming the ModR/M byte as appropriate 1083 // for extended and escape opcodes. Determines the attributes and context for 1084 // the instruction before doing so. 1085 static int getInstructionID(struct InternalInstruction *insn, 1086 const MCInstrInfo *mii) { 1087 uint16_t attrMask; 1088 uint16_t instructionID; 1089 1090 LLVM_DEBUG(dbgs() << "getID()"); 1091 1092 attrMask = ATTR_NONE; 1093 1094 if (insn->mode == MODE_64BIT) 1095 attrMask |= ATTR_64BIT; 1096 1097 if (insn->vectorExtensionType != TYPE_NO_VEX_XOP) { 1098 attrMask |= (insn->vectorExtensionType == TYPE_EVEX) ? ATTR_EVEX : ATTR_VEX; 1099 1100 if (insn->vectorExtensionType == TYPE_EVEX) { 1101 switch (ppFromEVEX3of4(insn->vectorExtensionPrefix[2])) { 1102 case VEX_PREFIX_66: 1103 attrMask |= ATTR_OPSIZE; 1104 break; 1105 case VEX_PREFIX_F3: 1106 attrMask |= ATTR_XS; 1107 break; 1108 case VEX_PREFIX_F2: 1109 attrMask |= ATTR_XD; 1110 break; 1111 } 1112 1113 if (zFromEVEX4of4(insn->vectorExtensionPrefix[3])) 1114 attrMask |= ATTR_EVEXKZ; 1115 if (bFromEVEX4of4(insn->vectorExtensionPrefix[3])) 1116 attrMask |= ATTR_EVEXB; 1117 if (aaaFromEVEX4of4(insn->vectorExtensionPrefix[3])) 1118 attrMask |= ATTR_EVEXK; 1119 if (lFromEVEX4of4(insn->vectorExtensionPrefix[3])) 1120 attrMask |= ATTR_VEXL; 1121 if (l2FromEVEX4of4(insn->vectorExtensionPrefix[3])) 1122 attrMask |= ATTR_EVEXL2; 1123 } else if (insn->vectorExtensionType == TYPE_VEX_3B) { 1124 switch (ppFromVEX3of3(insn->vectorExtensionPrefix[2])) { 1125 case VEX_PREFIX_66: 1126 attrMask |= ATTR_OPSIZE; 1127 break; 1128 case VEX_PREFIX_F3: 1129 attrMask |= ATTR_XS; 1130 break; 1131 case VEX_PREFIX_F2: 1132 attrMask |= ATTR_XD; 1133 break; 1134 } 1135 1136 if (lFromVEX3of3(insn->vectorExtensionPrefix[2])) 1137 attrMask |= ATTR_VEXL; 1138 } else if (insn->vectorExtensionType == TYPE_VEX_2B) { 1139 switch (ppFromVEX2of2(insn->vectorExtensionPrefix[1])) { 1140 case VEX_PREFIX_66: 1141 attrMask |= ATTR_OPSIZE; 1142 if (insn->hasAdSize) 1143 attrMask |= ATTR_ADSIZE; 1144 break; 1145 case VEX_PREFIX_F3: 1146 attrMask |= ATTR_XS; 1147 break; 1148 case VEX_PREFIX_F2: 1149 attrMask |= ATTR_XD; 1150 break; 1151 } 1152 1153 if (lFromVEX2of2(insn->vectorExtensionPrefix[1])) 1154 attrMask |= ATTR_VEXL; 1155 } else if (insn->vectorExtensionType == TYPE_XOP) { 1156 switch (ppFromXOP3of3(insn->vectorExtensionPrefix[2])) { 1157 case VEX_PREFIX_66: 1158 attrMask |= ATTR_OPSIZE; 1159 break; 1160 case VEX_PREFIX_F3: 1161 attrMask |= ATTR_XS; 1162 break; 1163 case VEX_PREFIX_F2: 1164 attrMask |= ATTR_XD; 1165 break; 1166 } 1167 1168 if (lFromXOP3of3(insn->vectorExtensionPrefix[2])) 1169 attrMask |= ATTR_VEXL; 1170 } else { 1171 return -1; 1172 } 1173 } else if (!insn->mandatoryPrefix) { 1174 // If we don't have mandatory prefix we should use legacy prefixes here 1175 if (insn->hasOpSize && (insn->mode != MODE_16BIT)) 1176 attrMask |= ATTR_OPSIZE; 1177 if (insn->hasAdSize) 1178 attrMask |= ATTR_ADSIZE; 1179 if (insn->opcodeType == ONEBYTE) { 1180 if (insn->repeatPrefix == 0xf3 && (insn->opcode == 0x90)) 1181 // Special support for PAUSE 1182 attrMask |= ATTR_XS; 1183 } else { 1184 if (insn->repeatPrefix == 0xf2) 1185 attrMask |= ATTR_XD; 1186 else if (insn->repeatPrefix == 0xf3) 1187 attrMask |= ATTR_XS; 1188 } 1189 } else { 1190 switch (insn->mandatoryPrefix) { 1191 case 0xf2: 1192 attrMask |= ATTR_XD; 1193 break; 1194 case 0xf3: 1195 attrMask |= ATTR_XS; 1196 break; 1197 case 0x66: 1198 if (insn->mode != MODE_16BIT) 1199 attrMask |= ATTR_OPSIZE; 1200 if (insn->hasAdSize) 1201 attrMask |= ATTR_ADSIZE; 1202 break; 1203 case 0x67: 1204 attrMask |= ATTR_ADSIZE; 1205 break; 1206 } 1207 } 1208 1209 if (insn->rexPrefix & 0x08) { 1210 attrMask |= ATTR_REXW; 1211 attrMask &= ~ATTR_ADSIZE; 1212 } 1213 1214 if (insn->mode == MODE_16BIT) { 1215 // JCXZ/JECXZ need special handling for 16-bit mode because the meaning 1216 // of the AdSize prefix is inverted w.r.t. 32-bit mode. 1217 if (insn->opcodeType == ONEBYTE && insn->opcode == 0xE3) 1218 attrMask ^= ATTR_ADSIZE; 1219 // If we're in 16-bit mode and this is one of the relative jumps and opsize 1220 // prefix isn't present, we need to force the opsize attribute since the 1221 // prefix is inverted relative to 32-bit mode. 1222 if (!insn->hasOpSize && insn->opcodeType == ONEBYTE && 1223 (insn->opcode == 0xE8 || insn->opcode == 0xE9)) 1224 attrMask |= ATTR_OPSIZE; 1225 1226 if (!insn->hasOpSize && insn->opcodeType == TWOBYTE && 1227 insn->opcode >= 0x80 && insn->opcode <= 0x8F) 1228 attrMask |= ATTR_OPSIZE; 1229 } 1230 1231 1232 if (getInstructionIDWithAttrMask(&instructionID, insn, attrMask)) 1233 return -1; 1234 1235 // The following clauses compensate for limitations of the tables. 1236 1237 if (insn->mode != MODE_64BIT && 1238 insn->vectorExtensionType != TYPE_NO_VEX_XOP) { 1239 // The tables can't distinquish between cases where the W-bit is used to 1240 // select register size and cases where its a required part of the opcode. 1241 if ((insn->vectorExtensionType == TYPE_EVEX && 1242 wFromEVEX3of4(insn->vectorExtensionPrefix[2])) || 1243 (insn->vectorExtensionType == TYPE_VEX_3B && 1244 wFromVEX3of3(insn->vectorExtensionPrefix[2])) || 1245 (insn->vectorExtensionType == TYPE_XOP && 1246 wFromXOP3of3(insn->vectorExtensionPrefix[2]))) { 1247 1248 uint16_t instructionIDWithREXW; 1249 if (getInstructionIDWithAttrMask(&instructionIDWithREXW, insn, 1250 attrMask | ATTR_REXW)) { 1251 insn->instructionID = instructionID; 1252 insn->spec = &INSTRUCTIONS_SYM[instructionID]; 1253 return 0; 1254 } 1255 1256 auto SpecName = mii->getName(instructionIDWithREXW); 1257 // If not a 64-bit instruction. Switch the opcode. 1258 if (!is64Bit(SpecName.data())) { 1259 insn->instructionID = instructionIDWithREXW; 1260 insn->spec = &INSTRUCTIONS_SYM[instructionIDWithREXW]; 1261 return 0; 1262 } 1263 } 1264 } 1265 1266 // Absolute moves, umonitor, and movdir64b need special handling. 1267 // -For 16-bit mode because the meaning of the AdSize and OpSize prefixes are 1268 // inverted w.r.t. 1269 // -For 32-bit mode we need to ensure the ADSIZE prefix is observed in 1270 // any position. 1271 if ((insn->opcodeType == ONEBYTE && ((insn->opcode & 0xFC) == 0xA0)) || 1272 (insn->opcodeType == TWOBYTE && (insn->opcode == 0xAE)) || 1273 (insn->opcodeType == THREEBYTE_38 && insn->opcode == 0xF8)) { 1274 // Make sure we observed the prefixes in any position. 1275 if (insn->hasAdSize) 1276 attrMask |= ATTR_ADSIZE; 1277 if (insn->hasOpSize) 1278 attrMask |= ATTR_OPSIZE; 1279 1280 // In 16-bit, invert the attributes. 1281 if (insn->mode == MODE_16BIT) { 1282 attrMask ^= ATTR_ADSIZE; 1283 1284 // The OpSize attribute is only valid with the absolute moves. 1285 if (insn->opcodeType == ONEBYTE && ((insn->opcode & 0xFC) == 0xA0)) 1286 attrMask ^= ATTR_OPSIZE; 1287 } 1288 1289 if (getInstructionIDWithAttrMask(&instructionID, insn, attrMask)) 1290 return -1; 1291 1292 insn->instructionID = instructionID; 1293 insn->spec = &INSTRUCTIONS_SYM[instructionID]; 1294 return 0; 1295 } 1296 1297 if ((insn->mode == MODE_16BIT || insn->hasOpSize) && 1298 !(attrMask & ATTR_OPSIZE)) { 1299 // The instruction tables make no distinction between instructions that 1300 // allow OpSize anywhere (i.e., 16-bit operations) and that need it in a 1301 // particular spot (i.e., many MMX operations). In general we're 1302 // conservative, but in the specific case where OpSize is present but not in 1303 // the right place we check if there's a 16-bit operation. 1304 const struct InstructionSpecifier *spec; 1305 uint16_t instructionIDWithOpsize; 1306 llvm::StringRef specName, specWithOpSizeName; 1307 1308 spec = &INSTRUCTIONS_SYM[instructionID]; 1309 1310 if (getInstructionIDWithAttrMask(&instructionIDWithOpsize, insn, 1311 attrMask | ATTR_OPSIZE)) { 1312 // ModRM required with OpSize but not present. Give up and return the 1313 // version without OpSize set. 1314 insn->instructionID = instructionID; 1315 insn->spec = spec; 1316 return 0; 1317 } 1318 1319 specName = mii->getName(instructionID); 1320 specWithOpSizeName = mii->getName(instructionIDWithOpsize); 1321 1322 if (is16BitEquivalent(specName.data(), specWithOpSizeName.data()) && 1323 (insn->mode == MODE_16BIT) ^ insn->hasOpSize) { 1324 insn->instructionID = instructionIDWithOpsize; 1325 insn->spec = &INSTRUCTIONS_SYM[instructionIDWithOpsize]; 1326 } else { 1327 insn->instructionID = instructionID; 1328 insn->spec = spec; 1329 } 1330 return 0; 1331 } 1332 1333 if (insn->opcodeType == ONEBYTE && insn->opcode == 0x90 && 1334 insn->rexPrefix & 0x01) { 1335 // NOOP shouldn't decode as NOOP if REX.b is set. Instead it should decode 1336 // as XCHG %r8, %eax. 1337 const struct InstructionSpecifier *spec; 1338 uint16_t instructionIDWithNewOpcode; 1339 const struct InstructionSpecifier *specWithNewOpcode; 1340 1341 spec = &INSTRUCTIONS_SYM[instructionID]; 1342 1343 // Borrow opcode from one of the other XCHGar opcodes 1344 insn->opcode = 0x91; 1345 1346 if (getInstructionIDWithAttrMask(&instructionIDWithNewOpcode, insn, 1347 attrMask)) { 1348 insn->opcode = 0x90; 1349 1350 insn->instructionID = instructionID; 1351 insn->spec = spec; 1352 return 0; 1353 } 1354 1355 specWithNewOpcode = &INSTRUCTIONS_SYM[instructionIDWithNewOpcode]; 1356 1357 // Change back 1358 insn->opcode = 0x90; 1359 1360 insn->instructionID = instructionIDWithNewOpcode; 1361 insn->spec = specWithNewOpcode; 1362 1363 return 0; 1364 } 1365 1366 insn->instructionID = instructionID; 1367 insn->spec = &INSTRUCTIONS_SYM[insn->instructionID]; 1368 1369 return 0; 1370 } 1371 1372 // Read an operand from the opcode field of an instruction and interprets it 1373 // appropriately given the operand width. Handles AddRegFrm instructions. 1374 // 1375 // @param insn - the instruction whose opcode field is to be read. 1376 // @param size - The width (in bytes) of the register being specified. 1377 // 1 means AL and friends, 2 means AX, 4 means EAX, and 8 means 1378 // RAX. 1379 // @return - 0 on success; nonzero otherwise. 1380 static int readOpcodeRegister(struct InternalInstruction *insn, uint8_t size) { 1381 LLVM_DEBUG(dbgs() << "readOpcodeRegister()"); 1382 1383 if (size == 0) 1384 size = insn->registerSize; 1385 1386 switch (size) { 1387 case 1: 1388 insn->opcodeRegister = (Reg)( 1389 MODRM_REG_AL + ((bFromREX(insn->rexPrefix) << 3) | (insn->opcode & 7))); 1390 if (insn->rexPrefix && insn->opcodeRegister >= MODRM_REG_AL + 0x4 && 1391 insn->opcodeRegister < MODRM_REG_AL + 0x8) { 1392 insn->opcodeRegister = 1393 (Reg)(MODRM_REG_SPL + (insn->opcodeRegister - MODRM_REG_AL - 4)); 1394 } 1395 1396 break; 1397 case 2: 1398 insn->opcodeRegister = (Reg)( 1399 MODRM_REG_AX + ((bFromREX(insn->rexPrefix) << 3) | (insn->opcode & 7))); 1400 break; 1401 case 4: 1402 insn->opcodeRegister = 1403 (Reg)(MODRM_REG_EAX + 1404 ((bFromREX(insn->rexPrefix) << 3) | (insn->opcode & 7))); 1405 break; 1406 case 8: 1407 insn->opcodeRegister = 1408 (Reg)(MODRM_REG_RAX + 1409 ((bFromREX(insn->rexPrefix) << 3) | (insn->opcode & 7))); 1410 break; 1411 } 1412 1413 return 0; 1414 } 1415 1416 // Consume an immediate operand from an instruction, given the desired operand 1417 // size. 1418 // 1419 // @param insn - The instruction whose operand is to be read. 1420 // @param size - The width (in bytes) of the operand. 1421 // @return - 0 if the immediate was successfully consumed; nonzero 1422 // otherwise. 1423 static int readImmediate(struct InternalInstruction *insn, uint8_t size) { 1424 uint8_t imm8; 1425 uint16_t imm16; 1426 uint32_t imm32; 1427 uint64_t imm64; 1428 1429 LLVM_DEBUG(dbgs() << "readImmediate()"); 1430 1431 assert(insn->numImmediatesConsumed < 2 && "Already consumed two immediates"); 1432 1433 insn->immediateSize = size; 1434 insn->immediateOffset = insn->readerCursor - insn->startLocation; 1435 1436 switch (size) { 1437 case 1: 1438 if (consume(insn, imm8)) 1439 return -1; 1440 insn->immediates[insn->numImmediatesConsumed] = imm8; 1441 break; 1442 case 2: 1443 if (consume(insn, imm16)) 1444 return -1; 1445 insn->immediates[insn->numImmediatesConsumed] = imm16; 1446 break; 1447 case 4: 1448 if (consume(insn, imm32)) 1449 return -1; 1450 insn->immediates[insn->numImmediatesConsumed] = imm32; 1451 break; 1452 case 8: 1453 if (consume(insn, imm64)) 1454 return -1; 1455 insn->immediates[insn->numImmediatesConsumed] = imm64; 1456 break; 1457 default: 1458 llvm_unreachable("invalid size"); 1459 } 1460 1461 insn->numImmediatesConsumed++; 1462 1463 return 0; 1464 } 1465 1466 // Consume vvvv from an instruction if it has a VEX prefix. 1467 static int readVVVV(struct InternalInstruction *insn) { 1468 LLVM_DEBUG(dbgs() << "readVVVV()"); 1469 1470 int vvvv; 1471 if (insn->vectorExtensionType == TYPE_EVEX) 1472 vvvv = (v2FromEVEX4of4(insn->vectorExtensionPrefix[3]) << 4 | 1473 vvvvFromEVEX3of4(insn->vectorExtensionPrefix[2])); 1474 else if (insn->vectorExtensionType == TYPE_VEX_3B) 1475 vvvv = vvvvFromVEX3of3(insn->vectorExtensionPrefix[2]); 1476 else if (insn->vectorExtensionType == TYPE_VEX_2B) 1477 vvvv = vvvvFromVEX2of2(insn->vectorExtensionPrefix[1]); 1478 else if (insn->vectorExtensionType == TYPE_XOP) 1479 vvvv = vvvvFromXOP3of3(insn->vectorExtensionPrefix[2]); 1480 else 1481 return -1; 1482 1483 if (insn->mode != MODE_64BIT) 1484 vvvv &= 0xf; // Can only clear bit 4. Bit 3 must be cleared later. 1485 1486 insn->vvvv = static_cast<Reg>(vvvv); 1487 return 0; 1488 } 1489 1490 // Read an mask register from the opcode field of an instruction. 1491 // 1492 // @param insn - The instruction whose opcode field is to be read. 1493 // @return - 0 on success; nonzero otherwise. 1494 static int readMaskRegister(struct InternalInstruction *insn) { 1495 LLVM_DEBUG(dbgs() << "readMaskRegister()"); 1496 1497 if (insn->vectorExtensionType != TYPE_EVEX) 1498 return -1; 1499 1500 insn->writemask = 1501 static_cast<Reg>(aaaFromEVEX4of4(insn->vectorExtensionPrefix[3])); 1502 return 0; 1503 } 1504 1505 // Consults the specifier for an instruction and consumes all 1506 // operands for that instruction, interpreting them as it goes. 1507 static int readOperands(struct InternalInstruction *insn) { 1508 int hasVVVV, needVVVV; 1509 int sawRegImm = 0; 1510 1511 LLVM_DEBUG(dbgs() << "readOperands()"); 1512 1513 // If non-zero vvvv specified, make sure one of the operands uses it. 1514 hasVVVV = !readVVVV(insn); 1515 needVVVV = hasVVVV && (insn->vvvv != 0); 1516 1517 for (const auto &Op : x86OperandSets[insn->spec->operands]) { 1518 switch (Op.encoding) { 1519 case ENCODING_NONE: 1520 case ENCODING_SI: 1521 case ENCODING_DI: 1522 break; 1523 CASE_ENCODING_VSIB: 1524 // VSIB can use the V2 bit so check only the other bits. 1525 if (needVVVV) 1526 needVVVV = hasVVVV & ((insn->vvvv & 0xf) != 0); 1527 if (readModRM(insn)) 1528 return -1; 1529 1530 // Reject if SIB wasn't used. 1531 if (insn->eaBase != EA_BASE_sib && insn->eaBase != EA_BASE_sib64) 1532 return -1; 1533 1534 // If sibIndex was set to SIB_INDEX_NONE, index offset is 4. 1535 if (insn->sibIndex == SIB_INDEX_NONE) 1536 insn->sibIndex = (SIBIndex)(insn->sibIndexBase + 4); 1537 1538 // If EVEX.v2 is set this is one of the 16-31 registers. 1539 if (insn->vectorExtensionType == TYPE_EVEX && insn->mode == MODE_64BIT && 1540 v2FromEVEX4of4(insn->vectorExtensionPrefix[3])) 1541 insn->sibIndex = (SIBIndex)(insn->sibIndex + 16); 1542 1543 // Adjust the index register to the correct size. 1544 switch ((OperandType)Op.type) { 1545 default: 1546 debug("Unhandled VSIB index type"); 1547 return -1; 1548 case TYPE_MVSIBX: 1549 insn->sibIndex = 1550 (SIBIndex)(SIB_INDEX_XMM0 + (insn->sibIndex - insn->sibIndexBase)); 1551 break; 1552 case TYPE_MVSIBY: 1553 insn->sibIndex = 1554 (SIBIndex)(SIB_INDEX_YMM0 + (insn->sibIndex - insn->sibIndexBase)); 1555 break; 1556 case TYPE_MVSIBZ: 1557 insn->sibIndex = 1558 (SIBIndex)(SIB_INDEX_ZMM0 + (insn->sibIndex - insn->sibIndexBase)); 1559 break; 1560 } 1561 1562 // Apply the AVX512 compressed displacement scaling factor. 1563 if (Op.encoding != ENCODING_REG && insn->eaDisplacement == EA_DISP_8) 1564 insn->displacement *= 1 << (Op.encoding - ENCODING_VSIB); 1565 break; 1566 case ENCODING_SIB: 1567 // Reject if SIB wasn't used. 1568 if (insn->eaBase != EA_BASE_sib && insn->eaBase != EA_BASE_sib64) 1569 return -1; 1570 if (readModRM(insn)) 1571 return -1; 1572 if (fixupReg(insn, &Op)) 1573 return -1; 1574 break; 1575 case ENCODING_REG: 1576 CASE_ENCODING_RM: 1577 if (readModRM(insn)) 1578 return -1; 1579 if (fixupReg(insn, &Op)) 1580 return -1; 1581 // Apply the AVX512 compressed displacement scaling factor. 1582 if (Op.encoding != ENCODING_REG && insn->eaDisplacement == EA_DISP_8) 1583 insn->displacement *= 1 << (Op.encoding - ENCODING_RM); 1584 break; 1585 case ENCODING_IB: 1586 if (sawRegImm) { 1587 // Saw a register immediate so don't read again and instead split the 1588 // previous immediate. FIXME: This is a hack. 1589 insn->immediates[insn->numImmediatesConsumed] = 1590 insn->immediates[insn->numImmediatesConsumed - 1] & 0xf; 1591 ++insn->numImmediatesConsumed; 1592 break; 1593 } 1594 if (readImmediate(insn, 1)) 1595 return -1; 1596 if (Op.type == TYPE_XMM || Op.type == TYPE_YMM) 1597 sawRegImm = 1; 1598 break; 1599 case ENCODING_IW: 1600 if (readImmediate(insn, 2)) 1601 return -1; 1602 break; 1603 case ENCODING_ID: 1604 if (readImmediate(insn, 4)) 1605 return -1; 1606 break; 1607 case ENCODING_IO: 1608 if (readImmediate(insn, 8)) 1609 return -1; 1610 break; 1611 case ENCODING_Iv: 1612 if (readImmediate(insn, insn->immediateSize)) 1613 return -1; 1614 break; 1615 case ENCODING_Ia: 1616 if (readImmediate(insn, insn->addressSize)) 1617 return -1; 1618 break; 1619 case ENCODING_IRC: 1620 insn->RC = (l2FromEVEX4of4(insn->vectorExtensionPrefix[3]) << 1) | 1621 lFromEVEX4of4(insn->vectorExtensionPrefix[3]); 1622 break; 1623 case ENCODING_RB: 1624 if (readOpcodeRegister(insn, 1)) 1625 return -1; 1626 break; 1627 case ENCODING_RW: 1628 if (readOpcodeRegister(insn, 2)) 1629 return -1; 1630 break; 1631 case ENCODING_RD: 1632 if (readOpcodeRegister(insn, 4)) 1633 return -1; 1634 break; 1635 case ENCODING_RO: 1636 if (readOpcodeRegister(insn, 8)) 1637 return -1; 1638 break; 1639 case ENCODING_Rv: 1640 if (readOpcodeRegister(insn, 0)) 1641 return -1; 1642 break; 1643 case ENCODING_CC: 1644 insn->immediates[1] = insn->opcode & 0xf; 1645 break; 1646 case ENCODING_FP: 1647 break; 1648 case ENCODING_VVVV: 1649 needVVVV = 0; // Mark that we have found a VVVV operand. 1650 if (!hasVVVV) 1651 return -1; 1652 if (insn->mode != MODE_64BIT) 1653 insn->vvvv = static_cast<Reg>(insn->vvvv & 0x7); 1654 if (fixupReg(insn, &Op)) 1655 return -1; 1656 break; 1657 case ENCODING_WRITEMASK: 1658 if (readMaskRegister(insn)) 1659 return -1; 1660 break; 1661 case ENCODING_DUP: 1662 break; 1663 default: 1664 LLVM_DEBUG(dbgs() << "Encountered an operand with an unknown encoding."); 1665 return -1; 1666 } 1667 } 1668 1669 // If we didn't find ENCODING_VVVV operand, but non-zero vvvv present, fail 1670 if (needVVVV) 1671 return -1; 1672 1673 return 0; 1674 } 1675 1676 namespace llvm { 1677 1678 // Fill-ins to make the compiler happy. These constants are never actually 1679 // assigned; they are just filler to make an automatically-generated switch 1680 // statement work. 1681 namespace X86 { 1682 enum { 1683 BX_SI = 500, 1684 BX_DI = 501, 1685 BP_SI = 502, 1686 BP_DI = 503, 1687 sib = 504, 1688 sib64 = 505 1689 }; 1690 } // namespace X86 1691 1692 } // namespace llvm 1693 1694 static bool translateInstruction(MCInst &target, 1695 InternalInstruction &source, 1696 const MCDisassembler *Dis); 1697 1698 namespace { 1699 1700 /// Generic disassembler for all X86 platforms. All each platform class should 1701 /// have to do is subclass the constructor, and provide a different 1702 /// disassemblerMode value. 1703 class X86GenericDisassembler : public MCDisassembler { 1704 std::unique_ptr<const MCInstrInfo> MII; 1705 public: 1706 X86GenericDisassembler(const MCSubtargetInfo &STI, MCContext &Ctx, 1707 std::unique_ptr<const MCInstrInfo> MII); 1708 public: 1709 DecodeStatus getInstruction(MCInst &instr, uint64_t &size, 1710 ArrayRef<uint8_t> Bytes, uint64_t Address, 1711 raw_ostream &cStream) const override; 1712 1713 private: 1714 DisassemblerMode fMode; 1715 }; 1716 1717 } // namespace 1718 1719 X86GenericDisassembler::X86GenericDisassembler( 1720 const MCSubtargetInfo &STI, 1721 MCContext &Ctx, 1722 std::unique_ptr<const MCInstrInfo> MII) 1723 : MCDisassembler(STI, Ctx), MII(std::move(MII)) { 1724 const FeatureBitset &FB = STI.getFeatureBits(); 1725 if (FB[X86::Is16Bit]) { 1726 fMode = MODE_16BIT; 1727 return; 1728 } else if (FB[X86::Is32Bit]) { 1729 fMode = MODE_32BIT; 1730 return; 1731 } else if (FB[X86::Is64Bit]) { 1732 fMode = MODE_64BIT; 1733 return; 1734 } 1735 1736 llvm_unreachable("Invalid CPU mode"); 1737 } 1738 1739 MCDisassembler::DecodeStatus X86GenericDisassembler::getInstruction( 1740 MCInst &Instr, uint64_t &Size, ArrayRef<uint8_t> Bytes, uint64_t Address, 1741 raw_ostream &CStream) const { 1742 CommentStream = &CStream; 1743 1744 InternalInstruction Insn; 1745 memset(&Insn, 0, sizeof(InternalInstruction)); 1746 Insn.bytes = Bytes; 1747 Insn.startLocation = Address; 1748 Insn.readerCursor = Address; 1749 Insn.mode = fMode; 1750 1751 if (Bytes.empty() || readPrefixes(&Insn) || readOpcode(&Insn) || 1752 getInstructionID(&Insn, MII.get()) || Insn.instructionID == 0 || 1753 readOperands(&Insn)) { 1754 Size = Insn.readerCursor - Address; 1755 return Fail; 1756 } 1757 1758 Insn.operands = x86OperandSets[Insn.spec->operands]; 1759 Insn.length = Insn.readerCursor - Insn.startLocation; 1760 Size = Insn.length; 1761 if (Size > 15) 1762 LLVM_DEBUG(dbgs() << "Instruction exceeds 15-byte limit"); 1763 1764 bool Ret = translateInstruction(Instr, Insn, this); 1765 if (!Ret) { 1766 unsigned Flags = X86::IP_NO_PREFIX; 1767 if (Insn.hasAdSize) 1768 Flags |= X86::IP_HAS_AD_SIZE; 1769 if (!Insn.mandatoryPrefix) { 1770 if (Insn.hasOpSize) 1771 Flags |= X86::IP_HAS_OP_SIZE; 1772 if (Insn.repeatPrefix == 0xf2) 1773 Flags |= X86::IP_HAS_REPEAT_NE; 1774 else if (Insn.repeatPrefix == 0xf3 && 1775 // It should not be 'pause' f3 90 1776 Insn.opcode != 0x90) 1777 Flags |= X86::IP_HAS_REPEAT; 1778 if (Insn.hasLockPrefix) 1779 Flags |= X86::IP_HAS_LOCK; 1780 } 1781 Instr.setFlags(Flags); 1782 } 1783 return (!Ret) ? Success : Fail; 1784 } 1785 1786 // 1787 // Private code that translates from struct InternalInstructions to MCInsts. 1788 // 1789 1790 /// translateRegister - Translates an internal register to the appropriate LLVM 1791 /// register, and appends it as an operand to an MCInst. 1792 /// 1793 /// @param mcInst - The MCInst to append to. 1794 /// @param reg - The Reg to append. 1795 static void translateRegister(MCInst &mcInst, Reg reg) { 1796 #define ENTRY(x) X86::x, 1797 static constexpr MCPhysReg llvmRegnums[] = {ALL_REGS}; 1798 #undef ENTRY 1799 1800 MCPhysReg llvmRegnum = llvmRegnums[reg]; 1801 mcInst.addOperand(MCOperand::createReg(llvmRegnum)); 1802 } 1803 1804 static const uint8_t segmentRegnums[SEG_OVERRIDE_max] = { 1805 0, // SEG_OVERRIDE_NONE 1806 X86::CS, 1807 X86::SS, 1808 X86::DS, 1809 X86::ES, 1810 X86::FS, 1811 X86::GS 1812 }; 1813 1814 /// translateSrcIndex - Appends a source index operand to an MCInst. 1815 /// 1816 /// @param mcInst - The MCInst to append to. 1817 /// @param insn - The internal instruction. 1818 static bool translateSrcIndex(MCInst &mcInst, InternalInstruction &insn) { 1819 unsigned baseRegNo; 1820 1821 if (insn.mode == MODE_64BIT) 1822 baseRegNo = insn.hasAdSize ? X86::ESI : X86::RSI; 1823 else if (insn.mode == MODE_32BIT) 1824 baseRegNo = insn.hasAdSize ? X86::SI : X86::ESI; 1825 else { 1826 assert(insn.mode == MODE_16BIT); 1827 baseRegNo = insn.hasAdSize ? X86::ESI : X86::SI; 1828 } 1829 MCOperand baseReg = MCOperand::createReg(baseRegNo); 1830 mcInst.addOperand(baseReg); 1831 1832 MCOperand segmentReg; 1833 segmentReg = MCOperand::createReg(segmentRegnums[insn.segmentOverride]); 1834 mcInst.addOperand(segmentReg); 1835 return false; 1836 } 1837 1838 /// translateDstIndex - Appends a destination index operand to an MCInst. 1839 /// 1840 /// @param mcInst - The MCInst to append to. 1841 /// @param insn - The internal instruction. 1842 1843 static bool translateDstIndex(MCInst &mcInst, InternalInstruction &insn) { 1844 unsigned baseRegNo; 1845 1846 if (insn.mode == MODE_64BIT) 1847 baseRegNo = insn.hasAdSize ? X86::EDI : X86::RDI; 1848 else if (insn.mode == MODE_32BIT) 1849 baseRegNo = insn.hasAdSize ? X86::DI : X86::EDI; 1850 else { 1851 assert(insn.mode == MODE_16BIT); 1852 baseRegNo = insn.hasAdSize ? X86::EDI : X86::DI; 1853 } 1854 MCOperand baseReg = MCOperand::createReg(baseRegNo); 1855 mcInst.addOperand(baseReg); 1856 return false; 1857 } 1858 1859 /// translateImmediate - Appends an immediate operand to an MCInst. 1860 /// 1861 /// @param mcInst - The MCInst to append to. 1862 /// @param immediate - The immediate value to append. 1863 /// @param operand - The operand, as stored in the descriptor table. 1864 /// @param insn - The internal instruction. 1865 static void translateImmediate(MCInst &mcInst, uint64_t immediate, 1866 const OperandSpecifier &operand, 1867 InternalInstruction &insn, 1868 const MCDisassembler *Dis) { 1869 // Sign-extend the immediate if necessary. 1870 1871 OperandType type = (OperandType)operand.type; 1872 1873 bool isBranch = false; 1874 uint64_t pcrel = 0; 1875 if (type == TYPE_REL) { 1876 isBranch = true; 1877 pcrel = insn.startLocation + 1878 insn.immediateOffset + insn.immediateSize; 1879 switch (operand.encoding) { 1880 default: 1881 break; 1882 case ENCODING_Iv: 1883 switch (insn.displacementSize) { 1884 default: 1885 break; 1886 case 1: 1887 if(immediate & 0x80) 1888 immediate |= ~(0xffull); 1889 break; 1890 case 2: 1891 if(immediate & 0x8000) 1892 immediate |= ~(0xffffull); 1893 break; 1894 case 4: 1895 if(immediate & 0x80000000) 1896 immediate |= ~(0xffffffffull); 1897 break; 1898 case 8: 1899 break; 1900 } 1901 break; 1902 case ENCODING_IB: 1903 if(immediate & 0x80) 1904 immediate |= ~(0xffull); 1905 break; 1906 case ENCODING_IW: 1907 if(immediate & 0x8000) 1908 immediate |= ~(0xffffull); 1909 break; 1910 case ENCODING_ID: 1911 if(immediate & 0x80000000) 1912 immediate |= ~(0xffffffffull); 1913 break; 1914 } 1915 } 1916 // By default sign-extend all X86 immediates based on their encoding. 1917 else if (type == TYPE_IMM) { 1918 switch (operand.encoding) { 1919 default: 1920 break; 1921 case ENCODING_IB: 1922 if(immediate & 0x80) 1923 immediate |= ~(0xffull); 1924 break; 1925 case ENCODING_IW: 1926 if(immediate & 0x8000) 1927 immediate |= ~(0xffffull); 1928 break; 1929 case ENCODING_ID: 1930 if(immediate & 0x80000000) 1931 immediate |= ~(0xffffffffull); 1932 break; 1933 case ENCODING_IO: 1934 break; 1935 } 1936 } 1937 1938 switch (type) { 1939 case TYPE_XMM: 1940 mcInst.addOperand(MCOperand::createReg(X86::XMM0 + (immediate >> 4))); 1941 return; 1942 case TYPE_YMM: 1943 mcInst.addOperand(MCOperand::createReg(X86::YMM0 + (immediate >> 4))); 1944 return; 1945 case TYPE_ZMM: 1946 mcInst.addOperand(MCOperand::createReg(X86::ZMM0 + (immediate >> 4))); 1947 return; 1948 default: 1949 // operand is 64 bits wide. Do nothing. 1950 break; 1951 } 1952 1953 if (!Dis->tryAddingSymbolicOperand(mcInst, immediate + pcrel, 1954 insn.startLocation, isBranch, 1955 insn.immediateOffset, insn.immediateSize)) 1956 mcInst.addOperand(MCOperand::createImm(immediate)); 1957 1958 if (type == TYPE_MOFFS) { 1959 MCOperand segmentReg; 1960 segmentReg = MCOperand::createReg(segmentRegnums[insn.segmentOverride]); 1961 mcInst.addOperand(segmentReg); 1962 } 1963 } 1964 1965 /// translateRMRegister - Translates a register stored in the R/M field of the 1966 /// ModR/M byte to its LLVM equivalent and appends it to an MCInst. 1967 /// @param mcInst - The MCInst to append to. 1968 /// @param insn - The internal instruction to extract the R/M field 1969 /// from. 1970 /// @return - 0 on success; -1 otherwise 1971 static bool translateRMRegister(MCInst &mcInst, 1972 InternalInstruction &insn) { 1973 if (insn.eaBase == EA_BASE_sib || insn.eaBase == EA_BASE_sib64) { 1974 debug("A R/M register operand may not have a SIB byte"); 1975 return true; 1976 } 1977 1978 switch (insn.eaBase) { 1979 default: 1980 debug("Unexpected EA base register"); 1981 return true; 1982 case EA_BASE_NONE: 1983 debug("EA_BASE_NONE for ModR/M base"); 1984 return true; 1985 #define ENTRY(x) case EA_BASE_##x: 1986 ALL_EA_BASES 1987 #undef ENTRY 1988 debug("A R/M register operand may not have a base; " 1989 "the operand must be a register."); 1990 return true; 1991 #define ENTRY(x) \ 1992 case EA_REG_##x: \ 1993 mcInst.addOperand(MCOperand::createReg(X86::x)); break; 1994 ALL_REGS 1995 #undef ENTRY 1996 } 1997 1998 return false; 1999 } 2000 2001 /// translateRMMemory - Translates a memory operand stored in the Mod and R/M 2002 /// fields of an internal instruction (and possibly its SIB byte) to a memory 2003 /// operand in LLVM's format, and appends it to an MCInst. 2004 /// 2005 /// @param mcInst - The MCInst to append to. 2006 /// @param insn - The instruction to extract Mod, R/M, and SIB fields 2007 /// from. 2008 /// @param ForceSIB - The instruction must use SIB. 2009 /// @return - 0 on success; nonzero otherwise 2010 static bool translateRMMemory(MCInst &mcInst, InternalInstruction &insn, 2011 const MCDisassembler *Dis, 2012 bool ForceSIB = false) { 2013 // Addresses in an MCInst are represented as five operands: 2014 // 1. basereg (register) The R/M base, or (if there is a SIB) the 2015 // SIB base 2016 // 2. scaleamount (immediate) 1, or (if there is a SIB) the specified 2017 // scale amount 2018 // 3. indexreg (register) x86_registerNONE, or (if there is a SIB) 2019 // the index (which is multiplied by the 2020 // scale amount) 2021 // 4. displacement (immediate) 0, or the displacement if there is one 2022 // 5. segmentreg (register) x86_registerNONE for now, but could be set 2023 // if we have segment overrides 2024 2025 MCOperand baseReg; 2026 MCOperand scaleAmount; 2027 MCOperand indexReg; 2028 MCOperand displacement; 2029 MCOperand segmentReg; 2030 uint64_t pcrel = 0; 2031 2032 if (insn.eaBase == EA_BASE_sib || insn.eaBase == EA_BASE_sib64) { 2033 if (insn.sibBase != SIB_BASE_NONE) { 2034 switch (insn.sibBase) { 2035 default: 2036 debug("Unexpected sibBase"); 2037 return true; 2038 #define ENTRY(x) \ 2039 case SIB_BASE_##x: \ 2040 baseReg = MCOperand::createReg(X86::x); break; 2041 ALL_SIB_BASES 2042 #undef ENTRY 2043 } 2044 } else { 2045 baseReg = MCOperand::createReg(X86::NoRegister); 2046 } 2047 2048 if (insn.sibIndex != SIB_INDEX_NONE) { 2049 switch (insn.sibIndex) { 2050 default: 2051 debug("Unexpected sibIndex"); 2052 return true; 2053 #define ENTRY(x) \ 2054 case SIB_INDEX_##x: \ 2055 indexReg = MCOperand::createReg(X86::x); break; 2056 EA_BASES_32BIT 2057 EA_BASES_64BIT 2058 REGS_XMM 2059 REGS_YMM 2060 REGS_ZMM 2061 #undef ENTRY 2062 } 2063 } else { 2064 // Use EIZ/RIZ for a few ambiguous cases where the SIB byte is present, 2065 // but no index is used and modrm alone should have been enough. 2066 // -No base register in 32-bit mode. In 64-bit mode this is used to 2067 // avoid rip-relative addressing. 2068 // -Any base register used other than ESP/RSP/R12D/R12. Using these as a 2069 // base always requires a SIB byte. 2070 // -A scale other than 1 is used. 2071 if (!ForceSIB && 2072 (insn.sibScale != 1 || 2073 (insn.sibBase == SIB_BASE_NONE && insn.mode != MODE_64BIT) || 2074 (insn.sibBase != SIB_BASE_NONE && 2075 insn.sibBase != SIB_BASE_ESP && insn.sibBase != SIB_BASE_RSP && 2076 insn.sibBase != SIB_BASE_R12D && insn.sibBase != SIB_BASE_R12))) { 2077 indexReg = MCOperand::createReg(insn.addressSize == 4 ? X86::EIZ : 2078 X86::RIZ); 2079 } else 2080 indexReg = MCOperand::createReg(X86::NoRegister); 2081 } 2082 2083 scaleAmount = MCOperand::createImm(insn.sibScale); 2084 } else { 2085 switch (insn.eaBase) { 2086 case EA_BASE_NONE: 2087 if (insn.eaDisplacement == EA_DISP_NONE) { 2088 debug("EA_BASE_NONE and EA_DISP_NONE for ModR/M base"); 2089 return true; 2090 } 2091 if (insn.mode == MODE_64BIT){ 2092 pcrel = insn.startLocation + 2093 insn.displacementOffset + insn.displacementSize; 2094 Dis->tryAddingPcLoadReferenceComment(insn.displacement + pcrel, 2095 insn.startLocation + 2096 insn.displacementOffset); 2097 // Section 2.2.1.6 2098 baseReg = MCOperand::createReg(insn.addressSize == 4 ? X86::EIP : 2099 X86::RIP); 2100 } 2101 else 2102 baseReg = MCOperand::createReg(X86::NoRegister); 2103 2104 indexReg = MCOperand::createReg(X86::NoRegister); 2105 break; 2106 case EA_BASE_BX_SI: 2107 baseReg = MCOperand::createReg(X86::BX); 2108 indexReg = MCOperand::createReg(X86::SI); 2109 break; 2110 case EA_BASE_BX_DI: 2111 baseReg = MCOperand::createReg(X86::BX); 2112 indexReg = MCOperand::createReg(X86::DI); 2113 break; 2114 case EA_BASE_BP_SI: 2115 baseReg = MCOperand::createReg(X86::BP); 2116 indexReg = MCOperand::createReg(X86::SI); 2117 break; 2118 case EA_BASE_BP_DI: 2119 baseReg = MCOperand::createReg(X86::BP); 2120 indexReg = MCOperand::createReg(X86::DI); 2121 break; 2122 default: 2123 indexReg = MCOperand::createReg(X86::NoRegister); 2124 switch (insn.eaBase) { 2125 default: 2126 debug("Unexpected eaBase"); 2127 return true; 2128 // Here, we will use the fill-ins defined above. However, 2129 // BX_SI, BX_DI, BP_SI, and BP_DI are all handled above and 2130 // sib and sib64 were handled in the top-level if, so they're only 2131 // placeholders to keep the compiler happy. 2132 #define ENTRY(x) \ 2133 case EA_BASE_##x: \ 2134 baseReg = MCOperand::createReg(X86::x); break; 2135 ALL_EA_BASES 2136 #undef ENTRY 2137 #define ENTRY(x) case EA_REG_##x: 2138 ALL_REGS 2139 #undef ENTRY 2140 debug("A R/M memory operand may not be a register; " 2141 "the base field must be a base."); 2142 return true; 2143 } 2144 } 2145 2146 scaleAmount = MCOperand::createImm(1); 2147 } 2148 2149 displacement = MCOperand::createImm(insn.displacement); 2150 2151 segmentReg = MCOperand::createReg(segmentRegnums[insn.segmentOverride]); 2152 2153 mcInst.addOperand(baseReg); 2154 mcInst.addOperand(scaleAmount); 2155 mcInst.addOperand(indexReg); 2156 if (!Dis->tryAddingSymbolicOperand( 2157 mcInst, insn.displacement + pcrel, insn.startLocation, false, 2158 insn.displacementOffset, insn.displacementSize)) 2159 mcInst.addOperand(displacement); 2160 mcInst.addOperand(segmentReg); 2161 return false; 2162 } 2163 2164 /// translateRM - Translates an operand stored in the R/M (and possibly SIB) 2165 /// byte of an instruction to LLVM form, and appends it to an MCInst. 2166 /// 2167 /// @param mcInst - The MCInst to append to. 2168 /// @param operand - The operand, as stored in the descriptor table. 2169 /// @param insn - The instruction to extract Mod, R/M, and SIB fields 2170 /// from. 2171 /// @return - 0 on success; nonzero otherwise 2172 static bool translateRM(MCInst &mcInst, const OperandSpecifier &operand, 2173 InternalInstruction &insn, const MCDisassembler *Dis) { 2174 switch (operand.type) { 2175 default: 2176 debug("Unexpected type for a R/M operand"); 2177 return true; 2178 case TYPE_R8: 2179 case TYPE_R16: 2180 case TYPE_R32: 2181 case TYPE_R64: 2182 case TYPE_Rv: 2183 case TYPE_MM64: 2184 case TYPE_XMM: 2185 case TYPE_YMM: 2186 case TYPE_ZMM: 2187 case TYPE_TMM: 2188 case TYPE_VK_PAIR: 2189 case TYPE_VK: 2190 case TYPE_DEBUGREG: 2191 case TYPE_CONTROLREG: 2192 case TYPE_BNDR: 2193 return translateRMRegister(mcInst, insn); 2194 case TYPE_M: 2195 case TYPE_MVSIBX: 2196 case TYPE_MVSIBY: 2197 case TYPE_MVSIBZ: 2198 return translateRMMemory(mcInst, insn, Dis); 2199 case TYPE_MSIB: 2200 return translateRMMemory(mcInst, insn, Dis, true); 2201 } 2202 } 2203 2204 /// translateFPRegister - Translates a stack position on the FPU stack to its 2205 /// LLVM form, and appends it to an MCInst. 2206 /// 2207 /// @param mcInst - The MCInst to append to. 2208 /// @param stackPos - The stack position to translate. 2209 static void translateFPRegister(MCInst &mcInst, 2210 uint8_t stackPos) { 2211 mcInst.addOperand(MCOperand::createReg(X86::ST0 + stackPos)); 2212 } 2213 2214 /// translateMaskRegister - Translates a 3-bit mask register number to 2215 /// LLVM form, and appends it to an MCInst. 2216 /// 2217 /// @param mcInst - The MCInst to append to. 2218 /// @param maskRegNum - Number of mask register from 0 to 7. 2219 /// @return - false on success; true otherwise. 2220 static bool translateMaskRegister(MCInst &mcInst, 2221 uint8_t maskRegNum) { 2222 if (maskRegNum >= 8) { 2223 debug("Invalid mask register number"); 2224 return true; 2225 } 2226 2227 mcInst.addOperand(MCOperand::createReg(X86::K0 + maskRegNum)); 2228 return false; 2229 } 2230 2231 /// translateOperand - Translates an operand stored in an internal instruction 2232 /// to LLVM's format and appends it to an MCInst. 2233 /// 2234 /// @param mcInst - The MCInst to append to. 2235 /// @param operand - The operand, as stored in the descriptor table. 2236 /// @param insn - The internal instruction. 2237 /// @return - false on success; true otherwise. 2238 static bool translateOperand(MCInst &mcInst, const OperandSpecifier &operand, 2239 InternalInstruction &insn, 2240 const MCDisassembler *Dis) { 2241 switch (operand.encoding) { 2242 default: 2243 debug("Unhandled operand encoding during translation"); 2244 return true; 2245 case ENCODING_REG: 2246 translateRegister(mcInst, insn.reg); 2247 return false; 2248 case ENCODING_WRITEMASK: 2249 return translateMaskRegister(mcInst, insn.writemask); 2250 case ENCODING_SIB: 2251 CASE_ENCODING_RM: 2252 CASE_ENCODING_VSIB: 2253 return translateRM(mcInst, operand, insn, Dis); 2254 case ENCODING_IB: 2255 case ENCODING_IW: 2256 case ENCODING_ID: 2257 case ENCODING_IO: 2258 case ENCODING_Iv: 2259 case ENCODING_Ia: 2260 translateImmediate(mcInst, 2261 insn.immediates[insn.numImmediatesTranslated++], 2262 operand, 2263 insn, 2264 Dis); 2265 return false; 2266 case ENCODING_IRC: 2267 mcInst.addOperand(MCOperand::createImm(insn.RC)); 2268 return false; 2269 case ENCODING_SI: 2270 return translateSrcIndex(mcInst, insn); 2271 case ENCODING_DI: 2272 return translateDstIndex(mcInst, insn); 2273 case ENCODING_RB: 2274 case ENCODING_RW: 2275 case ENCODING_RD: 2276 case ENCODING_RO: 2277 case ENCODING_Rv: 2278 translateRegister(mcInst, insn.opcodeRegister); 2279 return false; 2280 case ENCODING_CC: 2281 mcInst.addOperand(MCOperand::createImm(insn.immediates[1])); 2282 return false; 2283 case ENCODING_FP: 2284 translateFPRegister(mcInst, insn.modRM & 7); 2285 return false; 2286 case ENCODING_VVVV: 2287 translateRegister(mcInst, insn.vvvv); 2288 return false; 2289 case ENCODING_DUP: 2290 return translateOperand(mcInst, insn.operands[operand.type - TYPE_DUP0], 2291 insn, Dis); 2292 } 2293 } 2294 2295 /// translateInstruction - Translates an internal instruction and all its 2296 /// operands to an MCInst. 2297 /// 2298 /// @param mcInst - The MCInst to populate with the instruction's data. 2299 /// @param insn - The internal instruction. 2300 /// @return - false on success; true otherwise. 2301 static bool translateInstruction(MCInst &mcInst, 2302 InternalInstruction &insn, 2303 const MCDisassembler *Dis) { 2304 if (!insn.spec) { 2305 debug("Instruction has no specification"); 2306 return true; 2307 } 2308 2309 mcInst.clear(); 2310 mcInst.setOpcode(insn.instructionID); 2311 // If when reading the prefix bytes we determined the overlapping 0xf2 or 0xf3 2312 // prefix bytes should be disassembled as xrelease and xacquire then set the 2313 // opcode to those instead of the rep and repne opcodes. 2314 if (insn.xAcquireRelease) { 2315 if(mcInst.getOpcode() == X86::REP_PREFIX) 2316 mcInst.setOpcode(X86::XRELEASE_PREFIX); 2317 else if(mcInst.getOpcode() == X86::REPNE_PREFIX) 2318 mcInst.setOpcode(X86::XACQUIRE_PREFIX); 2319 } 2320 2321 insn.numImmediatesTranslated = 0; 2322 2323 for (const auto &Op : insn.operands) { 2324 if (Op.encoding != ENCODING_NONE) { 2325 if (translateOperand(mcInst, Op, insn, Dis)) { 2326 return true; 2327 } 2328 } 2329 } 2330 2331 return false; 2332 } 2333 2334 static MCDisassembler *createX86Disassembler(const Target &T, 2335 const MCSubtargetInfo &STI, 2336 MCContext &Ctx) { 2337 std::unique_ptr<const MCInstrInfo> MII(T.createMCInstrInfo()); 2338 return new X86GenericDisassembler(STI, Ctx, std::move(MII)); 2339 } 2340 2341 extern "C" LLVM_EXTERNAL_VISIBILITY void LLVMInitializeX86Disassembler() { 2342 // Register the disassembler. 2343 TargetRegistry::RegisterMCDisassembler(getTheX86_32Target(), 2344 createX86Disassembler); 2345 TargetRegistry::RegisterMCDisassembler(getTheX86_64Target(), 2346 createX86Disassembler); 2347 } 2348