1 //===-- X86DisassemblerDecoder.cpp - Disassembler decoder -----------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file is part of the X86 Disassembler.
11 // It contains the implementation of the instruction decoder.
12 // Documentation for the disassembler can be found in X86Disassembler.h.
14 //===----------------------------------------------------------------------===//
16 #include <cstdarg> /* for va_*() */
17 #include <cstdio> /* for vsnprintf() */
18 #include <cstdlib> /* for exit() */
19 #include <cstring> /* for memset() */
21 #include "X86DisassemblerDecoder.h"
23 using namespace llvm::X86Disassembler
;
25 /// Specifies whether a ModR/M byte is needed and (if so) which
26 /// instruction each possible value of the ModR/M byte corresponds to. Once
27 /// this information is known, we have narrowed down to a single instruction.
28 struct ModRMDecision
{
30 uint16_t instructionIDs
;
33 /// Specifies which set of ModR/M->instruction tables to look at
34 /// given a particular opcode.
35 struct OpcodeDecision
{
36 ModRMDecision modRMDecisions
[256];
39 /// Specifies which opcode->instruction tables to look at given
40 /// a particular context (set of attributes). Since there are many possible
41 /// contexts, the decoder first uses CONTEXTS_SYM to determine which context
42 /// applies given a specific set of attributes. Hence there are only IC_max
43 /// entries in this table, rather than 2^(ATTR_max).
44 struct ContextDecision
{
45 OpcodeDecision opcodeDecisions
[IC_max
];
48 #include "X86GenDisassemblerTables.inc"
51 #define debug(s) do { Debug(__FILE__, __LINE__, s); } while (0)
53 #define debug(s) do { } while (0)
58 * contextForAttrs - Client for the instruction context table. Takes a set of
59 * attributes and returns the appropriate decode context.
61 * @param attrMask - Attributes, from the enumeration attributeBits.
62 * @return - The InstructionContext to use when looking up an
63 * an instruction with these attributes.
65 static InstructionContext
contextForAttrs(uint16_t attrMask
) {
66 return static_cast<InstructionContext
>(CONTEXTS_SYM
[attrMask
]);
70 * modRMRequired - Reads the appropriate instruction table to determine whether
71 * the ModR/M byte is required to decode a particular instruction.
73 * @param type - The opcode type (i.e., how many bytes it has).
74 * @param insnContext - The context for the instruction, as returned by
76 * @param opcode - The last byte of the instruction's opcode, not counting
77 * ModR/M extensions and escapes.
78 * @return - true if the ModR/M byte is required, false otherwise.
80 static int modRMRequired(OpcodeType type
,
81 InstructionContext insnContext
,
83 const struct ContextDecision
* decision
= nullptr;
87 decision
= &ONEBYTE_SYM
;
90 decision
= &TWOBYTE_SYM
;
93 decision
= &THREEBYTE38_SYM
;
96 decision
= &THREEBYTE3A_SYM
;
99 decision
= &XOP8_MAP_SYM
;
102 decision
= &XOP9_MAP_SYM
;
105 decision
= &XOPA_MAP_SYM
;
109 return decision
->opcodeDecisions
[insnContext
].modRMDecisions
[opcode
].
110 modrm_type
!= MODRM_ONEENTRY
;
114 * decode - Reads the appropriate instruction table to obtain the unique ID of
117 * @param type - See modRMRequired().
118 * @param insnContext - See modRMRequired().
119 * @param opcode - See modRMRequired().
120 * @param modRM - The ModR/M byte if required, or any value if not.
121 * @return - The UID of the instruction, or 0 on failure.
123 static InstrUID
decode(OpcodeType type
,
124 InstructionContext insnContext
,
127 const struct ModRMDecision
* dec
= nullptr;
131 dec
= &ONEBYTE_SYM
.opcodeDecisions
[insnContext
].modRMDecisions
[opcode
];
134 dec
= &TWOBYTE_SYM
.opcodeDecisions
[insnContext
].modRMDecisions
[opcode
];
137 dec
= &THREEBYTE38_SYM
.opcodeDecisions
[insnContext
].modRMDecisions
[opcode
];
140 dec
= &THREEBYTE3A_SYM
.opcodeDecisions
[insnContext
].modRMDecisions
[opcode
];
143 dec
= &XOP8_MAP_SYM
.opcodeDecisions
[insnContext
].modRMDecisions
[opcode
];
146 dec
= &XOP9_MAP_SYM
.opcodeDecisions
[insnContext
].modRMDecisions
[opcode
];
149 dec
= &XOPA_MAP_SYM
.opcodeDecisions
[insnContext
].modRMDecisions
[opcode
];
153 switch (dec
->modrm_type
) {
155 debug("Corrupt table! Unknown modrm_type");
158 return modRMTable
[dec
->instructionIDs
];
160 if (modFromModRM(modRM
) == 0x3)
161 return modRMTable
[dec
->instructionIDs
+1];
162 return modRMTable
[dec
->instructionIDs
];
164 if (modFromModRM(modRM
) == 0x3)
165 return modRMTable
[dec
->instructionIDs
+((modRM
& 0x38) >> 3)+8];
166 return modRMTable
[dec
->instructionIDs
+((modRM
& 0x38) >> 3)];
167 case MODRM_SPLITMISC
:
168 if (modFromModRM(modRM
) == 0x3)
169 return modRMTable
[dec
->instructionIDs
+(modRM
& 0x3f)+8];
170 return modRMTable
[dec
->instructionIDs
+((modRM
& 0x38) >> 3)];
172 return modRMTable
[dec
->instructionIDs
+modRM
];
177 * specifierForUID - Given a UID, returns the name and operand specification for
180 * @param uid - The unique ID for the instruction. This should be returned by
181 * decode(); specifierForUID will not check bounds.
182 * @return - A pointer to the specification for that instruction.
184 static const struct InstructionSpecifier
*specifierForUID(InstrUID uid
) {
185 return &INSTRUCTIONS_SYM
[uid
];
189 * consumeByte - Uses the reader function provided by the user to consume one
190 * byte from the instruction's memory and advance the cursor.
192 * @param insn - The instruction with the reader function to use. The cursor
193 * for this instruction is advanced.
194 * @param byte - A pointer to a pre-allocated memory buffer to be populated
195 * with the data read.
196 * @return - 0 if the read was successful; nonzero otherwise.
198 static int consumeByte(struct InternalInstruction
* insn
, uint8_t* byte
) {
199 int ret
= insn
->reader(insn
->readerArg
, byte
, insn
->readerCursor
);
202 ++(insn
->readerCursor
);
208 * lookAtByte - Like consumeByte, but does not advance the cursor.
210 * @param insn - See consumeByte().
211 * @param byte - See consumeByte().
212 * @return - See consumeByte().
214 static int lookAtByte(struct InternalInstruction
* insn
, uint8_t* byte
) {
215 return insn
->reader(insn
->readerArg
, byte
, insn
->readerCursor
);
218 static void unconsumeByte(struct InternalInstruction
* insn
) {
219 insn
->readerCursor
--;
222 #define CONSUME_FUNC(name, type) \
223 static int name(struct InternalInstruction* insn, type* ptr) { \
226 for (offset = 0; offset < sizeof(type); ++offset) { \
228 int ret = insn->reader(insn->readerArg, \
230 insn->readerCursor + offset); \
233 combined = combined | ((uint64_t)byte << (offset * 8)); \
236 insn->readerCursor += sizeof(type); \
241 * consume* - Use the reader function provided by the user to consume data
242 * values of various sizes from the instruction's memory and advance the
243 * cursor appropriately. These readers perform endian conversion.
245 * @param insn - See consumeByte().
246 * @param ptr - A pointer to a pre-allocated memory of appropriate size to
247 * be populated with the data read.
248 * @return - See consumeByte().
250 CONSUME_FUNC(consumeInt8
, int8_t)
251 CONSUME_FUNC(consumeInt16
, int16_t)
252 CONSUME_FUNC(consumeInt32
, int32_t)
253 CONSUME_FUNC(consumeUInt16
, uint16_t)
254 CONSUME_FUNC(consumeUInt32
, uint32_t)
255 CONSUME_FUNC(consumeUInt64
, uint64_t)
258 * dbgprintf - Uses the logging function provided by the user to log a single
259 * message, typically without a carriage-return.
261 * @param insn - The instruction containing the logging function.
262 * @param format - See printf().
263 * @param ... - See printf().
265 static void dbgprintf(struct InternalInstruction
* insn
,
274 va_start(ap
, format
);
275 (void)vsnprintf(buffer
, sizeof(buffer
), format
, ap
);
278 insn
->dlog(insn
->dlogArg
, buffer
);
284 * setPrefixPresent - Marks that a particular prefix is present at a particular
287 * @param insn - The instruction to be marked as having the prefix.
288 * @param prefix - The prefix that is present.
289 * @param location - The location where the prefix is located (in the address
290 * space of the instruction's reader).
292 static void setPrefixPresent(struct InternalInstruction
* insn
,
296 insn
->prefixPresent
[prefix
] = 1;
297 insn
->prefixLocations
[prefix
] = location
;
301 * isPrefixAtLocation - Queries an instruction to determine whether a prefix is
302 * present at a given location.
304 * @param insn - The instruction to be queried.
305 * @param prefix - The prefix.
306 * @param location - The location to query.
307 * @return - Whether the prefix is at that location.
309 static bool isPrefixAtLocation(struct InternalInstruction
* insn
,
313 if (insn
->prefixPresent
[prefix
] == 1 &&
314 insn
->prefixLocations
[prefix
] == location
)
321 * readPrefixes - Consumes all of an instruction's prefix bytes, and marks the
322 * instruction as having them. Also sets the instruction's default operand,
323 * address, and other relevant data sizes to report operands correctly.
325 * @param insn - The instruction whose prefixes are to be read.
326 * @return - 0 if the instruction could be read until the end of the prefix
327 * bytes, and no prefixes conflicted; nonzero otherwise.
329 static int readPrefixes(struct InternalInstruction
* insn
) {
330 bool isPrefix
= true;
331 bool prefixGroups
[4] = { false };
332 uint64_t prefixLocation
;
336 bool hasAdSize
= false;
337 bool hasOpSize
= false;
339 dbgprintf(insn
, "readPrefixes()");
342 prefixLocation
= insn
->readerCursor
;
344 /* If we fail reading prefixes, just stop here and let the opcode reader deal with it */
345 if (consumeByte(insn
, &byte
))
349 * If the byte is a LOCK/REP/REPNE prefix and not a part of the opcode, then
350 * break and let it be disassembled as a normal "instruction".
352 if (insn
->readerCursor
- 1 == insn
->startLocation
&& byte
== 0xf0)
355 if (insn
->readerCursor
- 1 == insn
->startLocation
356 && (byte
== 0xf2 || byte
== 0xf3)
357 && !lookAtByte(insn
, &nextByte
))
360 * If the byte is 0xf2 or 0xf3, and any of the following conditions are
362 * - it is followed by a LOCK (0xf0) prefix
363 * - it is followed by an xchg instruction
364 * then it should be disassembled as a xacquire/xrelease not repne/rep.
366 if ((byte
== 0xf2 || byte
== 0xf3) &&
367 ((nextByte
== 0xf0) |
368 ((nextByte
& 0xfe) == 0x86 || (nextByte
& 0xf8) == 0x90)))
369 insn
->xAcquireRelease
= true;
371 * Also if the byte is 0xf3, and the following condition is met:
372 * - it is followed by a "mov mem, reg" (opcode 0x88/0x89) or
373 * "mov mem, imm" (opcode 0xc6/0xc7) instructions.
374 * then it should be disassembled as an xrelease not rep.
377 (nextByte
== 0x88 || nextByte
== 0x89 ||
378 nextByte
== 0xc6 || nextByte
== 0xc7))
379 insn
->xAcquireRelease
= true;
380 if (insn
->mode
== MODE_64BIT
&& (nextByte
& 0xf0) == 0x40) {
381 if (consumeByte(insn
, &nextByte
))
383 if (lookAtByte(insn
, &nextByte
))
387 if (nextByte
!= 0x0f && nextByte
!= 0x90)
392 case 0xf0: /* LOCK */
393 case 0xf2: /* REPNE/REPNZ */
394 case 0xf3: /* REP or REPE/REPZ */
396 dbgprintf(insn
, "Redundant Group 1 prefix");
397 prefixGroups
[0] = true;
398 setPrefixPresent(insn
, byte
, prefixLocation
);
400 case 0x2e: /* CS segment override -OR- Branch not taken */
401 case 0x36: /* SS segment override -OR- Branch taken */
402 case 0x3e: /* DS segment override */
403 case 0x26: /* ES segment override */
404 case 0x64: /* FS segment override */
405 case 0x65: /* GS segment override */
408 insn
->segmentOverride
= SEG_OVERRIDE_CS
;
411 insn
->segmentOverride
= SEG_OVERRIDE_SS
;
414 insn
->segmentOverride
= SEG_OVERRIDE_DS
;
417 insn
->segmentOverride
= SEG_OVERRIDE_ES
;
420 insn
->segmentOverride
= SEG_OVERRIDE_FS
;
423 insn
->segmentOverride
= SEG_OVERRIDE_GS
;
426 debug("Unhandled override");
430 dbgprintf(insn
, "Redundant Group 2 prefix");
431 prefixGroups
[1] = true;
432 setPrefixPresent(insn
, byte
, prefixLocation
);
434 case 0x66: /* Operand-size override */
436 dbgprintf(insn
, "Redundant Group 3 prefix");
437 prefixGroups
[2] = true;
439 setPrefixPresent(insn
, byte
, prefixLocation
);
441 case 0x67: /* Address-size override */
443 dbgprintf(insn
, "Redundant Group 4 prefix");
444 prefixGroups
[3] = true;
446 setPrefixPresent(insn
, byte
, prefixLocation
);
448 default: /* Not a prefix byte */
454 dbgprintf(insn
, "Found prefix 0x%hhx", byte
);
457 insn
->vectorExtensionType
= TYPE_NO_VEX_XOP
;
460 uint8_t byte1
, byte2
;
462 if (consumeByte(insn
, &byte1
)) {
463 dbgprintf(insn
, "Couldn't read second byte of EVEX prefix");
467 if (lookAtByte(insn
, &byte2
)) {
468 dbgprintf(insn
, "Couldn't read third byte of EVEX prefix");
472 if ((insn
->mode
== MODE_64BIT
|| (byte1
& 0xc0) == 0xc0) &&
473 ((~byte1
& 0xc) == 0xc) && ((byte2
& 0x4) == 0x4)) {
474 insn
->vectorExtensionType
= TYPE_EVEX
;
476 unconsumeByte(insn
); /* unconsume byte1 */
477 unconsumeByte(insn
); /* unconsume byte */
478 insn
->necessaryPrefixLocation
= insn
->readerCursor
- 2;
481 if (insn
->vectorExtensionType
== TYPE_EVEX
) {
482 insn
->vectorExtensionPrefix
[0] = byte
;
483 insn
->vectorExtensionPrefix
[1] = byte1
;
484 if (consumeByte(insn
, &insn
->vectorExtensionPrefix
[2])) {
485 dbgprintf(insn
, "Couldn't read third byte of EVEX prefix");
488 if (consumeByte(insn
, &insn
->vectorExtensionPrefix
[3])) {
489 dbgprintf(insn
, "Couldn't read fourth byte of EVEX prefix");
493 /* We simulate the REX prefix for simplicity's sake */
494 if (insn
->mode
== MODE_64BIT
) {
495 insn
->rexPrefix
= 0x40
496 | (wFromEVEX3of4(insn
->vectorExtensionPrefix
[2]) << 3)
497 | (rFromEVEX2of4(insn
->vectorExtensionPrefix
[1]) << 2)
498 | (xFromEVEX2of4(insn
->vectorExtensionPrefix
[1]) << 1)
499 | (bFromEVEX2of4(insn
->vectorExtensionPrefix
[1]) << 0);
502 dbgprintf(insn
, "Found EVEX prefix 0x%hhx 0x%hhx 0x%hhx 0x%hhx",
503 insn
->vectorExtensionPrefix
[0], insn
->vectorExtensionPrefix
[1],
504 insn
->vectorExtensionPrefix
[2], insn
->vectorExtensionPrefix
[3]);
506 } else if (byte
== 0xc4) {
509 if (lookAtByte(insn
, &byte1
)) {
510 dbgprintf(insn
, "Couldn't read second byte of VEX");
514 if (insn
->mode
== MODE_64BIT
|| (byte1
& 0xc0) == 0xc0) {
515 insn
->vectorExtensionType
= TYPE_VEX_3B
;
516 insn
->necessaryPrefixLocation
= insn
->readerCursor
- 1;
519 insn
->necessaryPrefixLocation
= insn
->readerCursor
- 1;
522 if (insn
->vectorExtensionType
== TYPE_VEX_3B
) {
523 insn
->vectorExtensionPrefix
[0] = byte
;
524 consumeByte(insn
, &insn
->vectorExtensionPrefix
[1]);
525 consumeByte(insn
, &insn
->vectorExtensionPrefix
[2]);
527 /* We simulate the REX prefix for simplicity's sake */
529 if (insn
->mode
== MODE_64BIT
) {
530 insn
->rexPrefix
= 0x40
531 | (wFromVEX3of3(insn
->vectorExtensionPrefix
[2]) << 3)
532 | (rFromVEX2of3(insn
->vectorExtensionPrefix
[1]) << 2)
533 | (xFromVEX2of3(insn
->vectorExtensionPrefix
[1]) << 1)
534 | (bFromVEX2of3(insn
->vectorExtensionPrefix
[1]) << 0);
537 dbgprintf(insn
, "Found VEX prefix 0x%hhx 0x%hhx 0x%hhx",
538 insn
->vectorExtensionPrefix
[0], insn
->vectorExtensionPrefix
[1],
539 insn
->vectorExtensionPrefix
[2]);
541 } else if (byte
== 0xc5) {
544 if (lookAtByte(insn
, &byte1
)) {
545 dbgprintf(insn
, "Couldn't read second byte of VEX");
549 if (insn
->mode
== MODE_64BIT
|| (byte1
& 0xc0) == 0xc0) {
550 insn
->vectorExtensionType
= TYPE_VEX_2B
;
555 if (insn
->vectorExtensionType
== TYPE_VEX_2B
) {
556 insn
->vectorExtensionPrefix
[0] = byte
;
557 consumeByte(insn
, &insn
->vectorExtensionPrefix
[1]);
559 if (insn
->mode
== MODE_64BIT
) {
560 insn
->rexPrefix
= 0x40
561 | (rFromVEX2of2(insn
->vectorExtensionPrefix
[1]) << 2);
564 switch (ppFromVEX2of2(insn
->vectorExtensionPrefix
[1])) {
572 dbgprintf(insn
, "Found VEX prefix 0x%hhx 0x%hhx",
573 insn
->vectorExtensionPrefix
[0],
574 insn
->vectorExtensionPrefix
[1]);
576 } else if (byte
== 0x8f) {
579 if (lookAtByte(insn
, &byte1
)) {
580 dbgprintf(insn
, "Couldn't read second byte of XOP");
584 if ((byte1
& 0x38) != 0x0) { /* 0 in these 3 bits is a POP instruction. */
585 insn
->vectorExtensionType
= TYPE_XOP
;
586 insn
->necessaryPrefixLocation
= insn
->readerCursor
- 1;
589 insn
->necessaryPrefixLocation
= insn
->readerCursor
- 1;
592 if (insn
->vectorExtensionType
== TYPE_XOP
) {
593 insn
->vectorExtensionPrefix
[0] = byte
;
594 consumeByte(insn
, &insn
->vectorExtensionPrefix
[1]);
595 consumeByte(insn
, &insn
->vectorExtensionPrefix
[2]);
597 /* We simulate the REX prefix for simplicity's sake */
599 if (insn
->mode
== MODE_64BIT
) {
600 insn
->rexPrefix
= 0x40
601 | (wFromXOP3of3(insn
->vectorExtensionPrefix
[2]) << 3)
602 | (rFromXOP2of3(insn
->vectorExtensionPrefix
[1]) << 2)
603 | (xFromXOP2of3(insn
->vectorExtensionPrefix
[1]) << 1)
604 | (bFromXOP2of3(insn
->vectorExtensionPrefix
[1]) << 0);
607 switch (ppFromXOP3of3(insn
->vectorExtensionPrefix
[2])) {
615 dbgprintf(insn
, "Found XOP prefix 0x%hhx 0x%hhx 0x%hhx",
616 insn
->vectorExtensionPrefix
[0], insn
->vectorExtensionPrefix
[1],
617 insn
->vectorExtensionPrefix
[2]);
620 if (insn
->mode
== MODE_64BIT
) {
621 if ((byte
& 0xf0) == 0x40) {
624 if (lookAtByte(insn
, &opcodeByte
) || ((opcodeByte
& 0xf0) == 0x40)) {
625 dbgprintf(insn
, "Redundant REX prefix");
629 insn
->rexPrefix
= byte
;
630 insn
->necessaryPrefixLocation
= insn
->readerCursor
- 2;
632 dbgprintf(insn
, "Found REX prefix 0x%hhx", byte
);
635 insn
->necessaryPrefixLocation
= insn
->readerCursor
- 1;
639 insn
->necessaryPrefixLocation
= insn
->readerCursor
- 1;
643 if (insn
->mode
== MODE_16BIT
) {
644 insn
->registerSize
= (hasOpSize
? 4 : 2);
645 insn
->addressSize
= (hasAdSize
? 4 : 2);
646 insn
->displacementSize
= (hasAdSize
? 4 : 2);
647 insn
->immediateSize
= (hasOpSize
? 4 : 2);
648 } else if (insn
->mode
== MODE_32BIT
) {
649 insn
->registerSize
= (hasOpSize
? 2 : 4);
650 insn
->addressSize
= (hasAdSize
? 2 : 4);
651 insn
->displacementSize
= (hasAdSize
? 2 : 4);
652 insn
->immediateSize
= (hasOpSize
? 2 : 4);
653 } else if (insn
->mode
== MODE_64BIT
) {
654 if (insn
->rexPrefix
&& wFromREX(insn
->rexPrefix
)) {
655 insn
->registerSize
= 8;
656 insn
->addressSize
= (hasAdSize
? 4 : 8);
657 insn
->displacementSize
= 4;
658 insn
->immediateSize
= 4;
659 } else if (insn
->rexPrefix
) {
660 insn
->registerSize
= (hasOpSize
? 2 : 4);
661 insn
->addressSize
= (hasAdSize
? 4 : 8);
662 insn
->displacementSize
= (hasOpSize
? 2 : 4);
663 insn
->immediateSize
= (hasOpSize
? 2 : 4);
665 insn
->registerSize
= (hasOpSize
? 2 : 4);
666 insn
->addressSize
= (hasAdSize
? 4 : 8);
667 insn
->displacementSize
= (hasOpSize
? 2 : 4);
668 insn
->immediateSize
= (hasOpSize
? 2 : 4);
676 * readOpcode - Reads the opcode (excepting the ModR/M byte in the case of
677 * extended or escape opcodes).
679 * @param insn - The instruction whose opcode is to be read.
680 * @return - 0 if the opcode could be read successfully; nonzero otherwise.
682 static int readOpcode(struct InternalInstruction
* insn
) {
683 /* Determine the length of the primary opcode */
687 dbgprintf(insn
, "readOpcode()");
689 insn
->opcodeType
= ONEBYTE
;
691 if (insn
->vectorExtensionType
== TYPE_EVEX
) {
692 switch (mmFromEVEX2of4(insn
->vectorExtensionPrefix
[1])) {
694 dbgprintf(insn
, "Unhandled mm field for instruction (0x%hhx)",
695 mmFromEVEX2of4(insn
->vectorExtensionPrefix
[1]));
698 insn
->opcodeType
= TWOBYTE
;
699 return consumeByte(insn
, &insn
->opcode
);
701 insn
->opcodeType
= THREEBYTE_38
;
702 return consumeByte(insn
, &insn
->opcode
);
704 insn
->opcodeType
= THREEBYTE_3A
;
705 return consumeByte(insn
, &insn
->opcode
);
707 } else if (insn
->vectorExtensionType
== TYPE_VEX_3B
) {
708 switch (mmmmmFromVEX2of3(insn
->vectorExtensionPrefix
[1])) {
710 dbgprintf(insn
, "Unhandled m-mmmm field for instruction (0x%hhx)",
711 mmmmmFromVEX2of3(insn
->vectorExtensionPrefix
[1]));
714 insn
->opcodeType
= TWOBYTE
;
715 return consumeByte(insn
, &insn
->opcode
);
717 insn
->opcodeType
= THREEBYTE_38
;
718 return consumeByte(insn
, &insn
->opcode
);
720 insn
->opcodeType
= THREEBYTE_3A
;
721 return consumeByte(insn
, &insn
->opcode
);
723 } else if (insn
->vectorExtensionType
== TYPE_VEX_2B
) {
724 insn
->opcodeType
= TWOBYTE
;
725 return consumeByte(insn
, &insn
->opcode
);
726 } else if (insn
->vectorExtensionType
== TYPE_XOP
) {
727 switch (mmmmmFromXOP2of3(insn
->vectorExtensionPrefix
[1])) {
729 dbgprintf(insn
, "Unhandled m-mmmm field for instruction (0x%hhx)",
730 mmmmmFromVEX2of3(insn
->vectorExtensionPrefix
[1]));
732 case XOP_MAP_SELECT_8
:
733 insn
->opcodeType
= XOP8_MAP
;
734 return consumeByte(insn
, &insn
->opcode
);
735 case XOP_MAP_SELECT_9
:
736 insn
->opcodeType
= XOP9_MAP
;
737 return consumeByte(insn
, &insn
->opcode
);
738 case XOP_MAP_SELECT_A
:
739 insn
->opcodeType
= XOPA_MAP
;
740 return consumeByte(insn
, &insn
->opcode
);
744 if (consumeByte(insn
, ¤t
))
747 if (current
== 0x0f) {
748 dbgprintf(insn
, "Found a two-byte escape prefix (0x%hhx)", current
);
750 if (consumeByte(insn
, ¤t
))
753 if (current
== 0x38) {
754 dbgprintf(insn
, "Found a three-byte escape prefix (0x%hhx)", current
);
756 if (consumeByte(insn
, ¤t
))
759 insn
->opcodeType
= THREEBYTE_38
;
760 } else if (current
== 0x3a) {
761 dbgprintf(insn
, "Found a three-byte escape prefix (0x%hhx)", current
);
763 if (consumeByte(insn
, ¤t
))
766 insn
->opcodeType
= THREEBYTE_3A
;
768 dbgprintf(insn
, "Didn't find a three-byte escape prefix");
770 insn
->opcodeType
= TWOBYTE
;
775 * At this point we have consumed the full opcode.
776 * Anything we consume from here on must be unconsumed.
779 insn
->opcode
= current
;
784 static int readModRM(struct InternalInstruction
* insn
);
787 * getIDWithAttrMask - Determines the ID of an instruction, consuming
788 * the ModR/M byte as appropriate for extended and escape opcodes,
789 * and using a supplied attribute mask.
791 * @param instructionID - A pointer whose target is filled in with the ID of the
793 * @param insn - The instruction whose ID is to be determined.
794 * @param attrMask - The attribute mask to search.
795 * @return - 0 if the ModR/M could be read when needed or was not
796 * needed; nonzero otherwise.
798 static int getIDWithAttrMask(uint16_t* instructionID
,
799 struct InternalInstruction
* insn
,
801 bool hasModRMExtension
;
803 InstructionContext instructionClass
= contextForAttrs(attrMask
);
805 hasModRMExtension
= modRMRequired(insn
->opcodeType
,
809 if (hasModRMExtension
) {
813 *instructionID
= decode(insn
->opcodeType
,
818 *instructionID
= decode(insn
->opcodeType
,
828 * is16BitEquivalent - Determines whether two instruction names refer to
829 * equivalent instructions but one is 16-bit whereas the other is not.
831 * @param orig - The instruction that is not 16-bit
832 * @param equiv - The instruction that is 16-bit
834 static bool is16BitEquivalent(const char* orig
, const char* equiv
) {
838 if (orig
[i
] == '\0' && equiv
[i
] == '\0')
840 if (orig
[i
] == '\0' || equiv
[i
] == '\0')
842 if (orig
[i
] != equiv
[i
]) {
843 if ((orig
[i
] == 'Q' || orig
[i
] == 'L') && equiv
[i
] == 'W')
845 if ((orig
[i
] == '6' || orig
[i
] == '3') && equiv
[i
] == '1')
847 if ((orig
[i
] == '4' || orig
[i
] == '2') && equiv
[i
] == '6')
855 * is64Bit - Determines whether this instruction is a 64-bit instruction.
857 * @param name - The instruction that is not 16-bit
859 static bool is64Bit(const char* name
) {
865 if (name
[i
] == '6' && name
[i
+1] == '4')
871 * getID - Determines the ID of an instruction, consuming the ModR/M byte as
872 * appropriate for extended and escape opcodes. Determines the attributes and
873 * context for the instruction before doing so.
875 * @param insn - The instruction whose ID is to be determined.
876 * @return - 0 if the ModR/M could be read when needed or was not needed;
879 static int getID(struct InternalInstruction
* insn
, const void *miiArg
) {
881 uint16_t instructionID
;
883 dbgprintf(insn
, "getID()");
885 attrMask
= ATTR_NONE
;
887 if (insn
->mode
== MODE_64BIT
)
888 attrMask
|= ATTR_64BIT
;
890 if (insn
->vectorExtensionType
!= TYPE_NO_VEX_XOP
) {
891 attrMask
|= (insn
->vectorExtensionType
== TYPE_EVEX
) ? ATTR_EVEX
: ATTR_VEX
;
893 if (insn
->vectorExtensionType
== TYPE_EVEX
) {
894 switch (ppFromEVEX3of4(insn
->vectorExtensionPrefix
[2])) {
896 attrMask
|= ATTR_OPSIZE
;
906 if (zFromEVEX4of4(insn
->vectorExtensionPrefix
[3]))
907 attrMask
|= ATTR_EVEXKZ
;
908 if (bFromEVEX4of4(insn
->vectorExtensionPrefix
[3]))
909 attrMask
|= ATTR_EVEXB
;
910 if (aaaFromEVEX4of4(insn
->vectorExtensionPrefix
[3]))
911 attrMask
|= ATTR_EVEXK
;
912 if (lFromEVEX4of4(insn
->vectorExtensionPrefix
[3]))
913 attrMask
|= ATTR_EVEXL
;
914 if (l2FromEVEX4of4(insn
->vectorExtensionPrefix
[3]))
915 attrMask
|= ATTR_EVEXL2
;
916 } else if (insn
->vectorExtensionType
== TYPE_VEX_3B
) {
917 switch (ppFromVEX3of3(insn
->vectorExtensionPrefix
[2])) {
919 attrMask
|= ATTR_OPSIZE
;
929 if (lFromVEX3of3(insn
->vectorExtensionPrefix
[2]))
930 attrMask
|= ATTR_VEXL
;
931 } else if (insn
->vectorExtensionType
== TYPE_VEX_2B
) {
932 switch (ppFromVEX2of2(insn
->vectorExtensionPrefix
[1])) {
934 attrMask
|= ATTR_OPSIZE
;
944 if (lFromVEX2of2(insn
->vectorExtensionPrefix
[1]))
945 attrMask
|= ATTR_VEXL
;
946 } else if (insn
->vectorExtensionType
== TYPE_XOP
) {
947 switch (ppFromXOP3of3(insn
->vectorExtensionPrefix
[2])) {
949 attrMask
|= ATTR_OPSIZE
;
959 if (lFromXOP3of3(insn
->vectorExtensionPrefix
[2]))
960 attrMask
|= ATTR_VEXL
;
965 if (insn
->mode
!= MODE_16BIT
&& isPrefixAtLocation(insn
, 0x66, insn
->necessaryPrefixLocation
))
966 attrMask
|= ATTR_OPSIZE
;
967 else if (isPrefixAtLocation(insn
, 0x67, insn
->necessaryPrefixLocation
))
968 attrMask
|= ATTR_ADSIZE
;
969 else if (isPrefixAtLocation(insn
, 0xf3, insn
->necessaryPrefixLocation
))
971 else if (isPrefixAtLocation(insn
, 0xf2, insn
->necessaryPrefixLocation
))
975 if (insn
->rexPrefix
& 0x08)
976 attrMask
|= ATTR_REXW
;
979 * JCXZ/JECXZ need special handling for 16-bit mode because the meaning
980 * of the AdSize prefix is inverted w.r.t. 32-bit mode.
982 if (insn
->mode
== MODE_16BIT
&& insn
->opcodeType
== ONEBYTE
&&
983 insn
->opcode
== 0xE3)
984 attrMask
^= ATTR_ADSIZE
;
986 if (getIDWithAttrMask(&instructionID
, insn
, attrMask
))
989 /* The following clauses compensate for limitations of the tables. */
991 if (insn
->mode
!= MODE_64BIT
&&
992 insn
->vectorExtensionType
!= TYPE_NO_VEX_XOP
) {
994 * The tables can't distinquish between cases where the W-bit is used to
995 * select register size and cases where its a required part of the opcode.
997 if ((insn
->vectorExtensionType
== TYPE_EVEX
&&
998 wFromEVEX3of4(insn
->vectorExtensionPrefix
[2])) ||
999 (insn
->vectorExtensionType
== TYPE_VEX_3B
&&
1000 wFromVEX3of3(insn
->vectorExtensionPrefix
[2])) ||
1001 (insn
->vectorExtensionType
== TYPE_XOP
&&
1002 wFromXOP3of3(insn
->vectorExtensionPrefix
[2]))) {
1004 uint16_t instructionIDWithREXW
;
1005 if (getIDWithAttrMask(&instructionIDWithREXW
,
1006 insn
, attrMask
| ATTR_REXW
)) {
1007 insn
->instructionID
= instructionID
;
1008 insn
->spec
= specifierForUID(instructionID
);
1012 const char *SpecName
= GetInstrName(instructionIDWithREXW
, miiArg
);
1013 // If not a 64-bit instruction. Switch the opcode.
1014 if (!is64Bit(SpecName
)) {
1015 insn
->instructionID
= instructionIDWithREXW
;
1016 insn
->spec
= specifierForUID(instructionIDWithREXW
);
1023 * Absolute moves need special handling.
1024 * -For 16-bit mode because the meaning of the AdSize and OpSize prefixes are
1026 * -For 32-bit mode we need to ensure the ADSIZE prefix is observed in
1029 if (insn
->opcodeType
== ONEBYTE
&& ((insn
->opcode
& 0xFC) == 0xA0)) {
1030 /* Make sure we observed the prefixes in any position. */
1031 if (insn
->prefixPresent
[0x67])
1032 attrMask
|= ATTR_ADSIZE
;
1033 if (insn
->prefixPresent
[0x66])
1034 attrMask
|= ATTR_OPSIZE
;
1036 /* In 16-bit, invert the attributes. */
1037 if (insn
->mode
== MODE_16BIT
)
1038 attrMask
^= ATTR_ADSIZE
| ATTR_OPSIZE
;
1040 if (getIDWithAttrMask(&instructionID
, insn
, attrMask
))
1043 insn
->instructionID
= instructionID
;
1044 insn
->spec
= specifierForUID(instructionID
);
1048 if ((insn
->mode
== MODE_16BIT
|| insn
->prefixPresent
[0x66]) &&
1049 !(attrMask
& ATTR_OPSIZE
)) {
1051 * The instruction tables make no distinction between instructions that
1052 * allow OpSize anywhere (i.e., 16-bit operations) and that need it in a
1053 * particular spot (i.e., many MMX operations). In general we're
1054 * conservative, but in the specific case where OpSize is present but not
1055 * in the right place we check if there's a 16-bit operation.
1058 const struct InstructionSpecifier
*spec
;
1059 uint16_t instructionIDWithOpsize
;
1060 const char *specName
, *specWithOpSizeName
;
1062 spec
= specifierForUID(instructionID
);
1064 if (getIDWithAttrMask(&instructionIDWithOpsize
,
1066 attrMask
| ATTR_OPSIZE
)) {
1068 * ModRM required with OpSize but not present; give up and return version
1069 * without OpSize set
1072 insn
->instructionID
= instructionID
;
1077 specName
= GetInstrName(instructionID
, miiArg
);
1078 specWithOpSizeName
= GetInstrName(instructionIDWithOpsize
, miiArg
);
1080 if (is16BitEquivalent(specName
, specWithOpSizeName
) &&
1081 (insn
->mode
== MODE_16BIT
) ^ insn
->prefixPresent
[0x66]) {
1082 insn
->instructionID
= instructionIDWithOpsize
;
1083 insn
->spec
= specifierForUID(instructionIDWithOpsize
);
1085 insn
->instructionID
= instructionID
;
1091 if (insn
->opcodeType
== ONEBYTE
&& insn
->opcode
== 0x90 &&
1092 insn
->rexPrefix
& 0x01) {
1094 * NOOP shouldn't decode as NOOP if REX.b is set. Instead
1095 * it should decode as XCHG %r8, %eax.
1098 const struct InstructionSpecifier
*spec
;
1099 uint16_t instructionIDWithNewOpcode
;
1100 const struct InstructionSpecifier
*specWithNewOpcode
;
1102 spec
= specifierForUID(instructionID
);
1104 /* Borrow opcode from one of the other XCHGar opcodes */
1105 insn
->opcode
= 0x91;
1107 if (getIDWithAttrMask(&instructionIDWithNewOpcode
,
1110 insn
->opcode
= 0x90;
1112 insn
->instructionID
= instructionID
;
1117 specWithNewOpcode
= specifierForUID(instructionIDWithNewOpcode
);
1120 insn
->opcode
= 0x90;
1122 insn
->instructionID
= instructionIDWithNewOpcode
;
1123 insn
->spec
= specWithNewOpcode
;
1128 insn
->instructionID
= instructionID
;
1129 insn
->spec
= specifierForUID(insn
->instructionID
);
1135 * readSIB - Consumes the SIB byte to determine addressing information for an
1138 * @param insn - The instruction whose SIB byte is to be read.
1139 * @return - 0 if the SIB byte was successfully read; nonzero otherwise.
1141 static int readSIB(struct InternalInstruction
* insn
) {
1142 SIBIndex sibIndexBase
= SIB_INDEX_NONE
;
1143 SIBBase sibBaseBase
= SIB_BASE_NONE
;
1144 uint8_t index
, base
;
1146 dbgprintf(insn
, "readSIB()");
1148 if (insn
->consumedSIB
)
1151 insn
->consumedSIB
= true;
1153 switch (insn
->addressSize
) {
1155 dbgprintf(insn
, "SIB-based addressing doesn't work in 16-bit mode");
1158 sibIndexBase
= SIB_INDEX_EAX
;
1159 sibBaseBase
= SIB_BASE_EAX
;
1162 sibIndexBase
= SIB_INDEX_RAX
;
1163 sibBaseBase
= SIB_BASE_RAX
;
1167 if (consumeByte(insn
, &insn
->sib
))
1170 index
= indexFromSIB(insn
->sib
) | (xFromREX(insn
->rexPrefix
) << 3);
1171 if (insn
->vectorExtensionType
== TYPE_EVEX
)
1172 index
|= v2FromEVEX4of4(insn
->vectorExtensionPrefix
[3]) << 4;
1176 insn
->sibIndex
= SIB_INDEX_NONE
;
1179 insn
->sibIndex
= (SIBIndex
)(sibIndexBase
+ index
);
1180 if (insn
->sibIndex
== SIB_INDEX_sib
||
1181 insn
->sibIndex
== SIB_INDEX_sib64
)
1182 insn
->sibIndex
= SIB_INDEX_NONE
;
1186 switch (scaleFromSIB(insn
->sib
)) {
1201 base
= baseFromSIB(insn
->sib
) | (bFromREX(insn
->rexPrefix
) << 3);
1206 switch (modFromModRM(insn
->modRM
)) {
1208 insn
->eaDisplacement
= EA_DISP_32
;
1209 insn
->sibBase
= SIB_BASE_NONE
;
1212 insn
->eaDisplacement
= EA_DISP_8
;
1213 insn
->sibBase
= (SIBBase
)(sibBaseBase
+ base
);
1216 insn
->eaDisplacement
= EA_DISP_32
;
1217 insn
->sibBase
= (SIBBase
)(sibBaseBase
+ base
);
1220 debug("Cannot have Mod = 0b11 and a SIB byte");
1225 insn
->sibBase
= (SIBBase
)(sibBaseBase
+ base
);
1233 * readDisplacement - Consumes the displacement of an instruction.
1235 * @param insn - The instruction whose displacement is to be read.
1236 * @return - 0 if the displacement byte was successfully read; nonzero
1239 static int readDisplacement(struct InternalInstruction
* insn
) {
1244 dbgprintf(insn
, "readDisplacement()");
1246 if (insn
->consumedDisplacement
)
1249 insn
->consumedDisplacement
= true;
1250 insn
->displacementOffset
= insn
->readerCursor
- insn
->startLocation
;
1252 switch (insn
->eaDisplacement
) {
1254 insn
->consumedDisplacement
= false;
1257 if (consumeInt8(insn
, &d8
))
1259 insn
->displacement
= d8
;
1262 if (consumeInt16(insn
, &d16
))
1264 insn
->displacement
= d16
;
1267 if (consumeInt32(insn
, &d32
))
1269 insn
->displacement
= d32
;
1273 insn
->consumedDisplacement
= true;
1278 * readModRM - Consumes all addressing information (ModR/M byte, SIB byte, and
1279 * displacement) for an instruction and interprets it.
1281 * @param insn - The instruction whose addressing information is to be read.
1282 * @return - 0 if the information was successfully read; nonzero otherwise.
1284 static int readModRM(struct InternalInstruction
* insn
) {
1285 uint8_t mod
, rm
, reg
;
1287 dbgprintf(insn
, "readModRM()");
1289 if (insn
->consumedModRM
)
1292 if (consumeByte(insn
, &insn
->modRM
))
1294 insn
->consumedModRM
= true;
1296 mod
= modFromModRM(insn
->modRM
);
1297 rm
= rmFromModRM(insn
->modRM
);
1298 reg
= regFromModRM(insn
->modRM
);
1301 * This goes by insn->registerSize to pick the correct register, which messes
1302 * up if we're using (say) XMM or 8-bit register operands. That gets fixed in
1305 switch (insn
->registerSize
) {
1307 insn
->regBase
= MODRM_REG_AX
;
1308 insn
->eaRegBase
= EA_REG_AX
;
1311 insn
->regBase
= MODRM_REG_EAX
;
1312 insn
->eaRegBase
= EA_REG_EAX
;
1315 insn
->regBase
= MODRM_REG_RAX
;
1316 insn
->eaRegBase
= EA_REG_RAX
;
1320 reg
|= rFromREX(insn
->rexPrefix
) << 3;
1321 rm
|= bFromREX(insn
->rexPrefix
) << 3;
1322 if (insn
->vectorExtensionType
== TYPE_EVEX
) {
1323 reg
|= r2FromEVEX2of4(insn
->vectorExtensionPrefix
[1]) << 4;
1324 rm
|= xFromEVEX2of4(insn
->vectorExtensionPrefix
[1]) << 4;
1327 insn
->reg
= (Reg
)(insn
->regBase
+ reg
);
1329 switch (insn
->addressSize
) {
1331 insn
->eaBaseBase
= EA_BASE_BX_SI
;
1336 insn
->eaBase
= EA_BASE_NONE
;
1337 insn
->eaDisplacement
= EA_DISP_16
;
1338 if (readDisplacement(insn
))
1341 insn
->eaBase
= (EABase
)(insn
->eaBaseBase
+ rm
);
1342 insn
->eaDisplacement
= EA_DISP_NONE
;
1346 insn
->eaBase
= (EABase
)(insn
->eaBaseBase
+ rm
);
1347 insn
->eaDisplacement
= EA_DISP_8
;
1348 insn
->displacementSize
= 1;
1349 if (readDisplacement(insn
))
1353 insn
->eaBase
= (EABase
)(insn
->eaBaseBase
+ rm
);
1354 insn
->eaDisplacement
= EA_DISP_16
;
1355 if (readDisplacement(insn
))
1359 insn
->eaBase
= (EABase
)(insn
->eaRegBase
+ rm
);
1360 if (readDisplacement(insn
))
1367 insn
->eaBaseBase
= (insn
->addressSize
== 4 ? EA_BASE_EAX
: EA_BASE_RAX
);
1371 insn
->eaDisplacement
= EA_DISP_NONE
; /* readSIB may override this */
1375 case 0xc: /* in case REXW.b is set */
1376 insn
->eaBase
= (insn
->addressSize
== 4 ?
1377 EA_BASE_sib
: EA_BASE_sib64
);
1378 if (readSIB(insn
) || readDisplacement(insn
))
1382 insn
->eaBase
= EA_BASE_NONE
;
1383 insn
->eaDisplacement
= EA_DISP_32
;
1384 if (readDisplacement(insn
))
1388 insn
->eaBase
= (EABase
)(insn
->eaBaseBase
+ rm
);
1393 insn
->displacementSize
= 1;
1396 insn
->eaDisplacement
= (mod
== 0x1 ? EA_DISP_8
: EA_DISP_32
);
1400 case 0xc: /* in case REXW.b is set */
1401 insn
->eaBase
= EA_BASE_sib
;
1402 if (readSIB(insn
) || readDisplacement(insn
))
1406 insn
->eaBase
= (EABase
)(insn
->eaBaseBase
+ rm
);
1407 if (readDisplacement(insn
))
1413 insn
->eaDisplacement
= EA_DISP_NONE
;
1414 insn
->eaBase
= (EABase
)(insn
->eaRegBase
+ rm
);
1418 } /* switch (insn->addressSize) */
1423 #define GENERIC_FIXUP_FUNC(name, base, prefix) \
1424 static uint8_t name(struct InternalInstruction *insn, \
1431 debug("Unhandled register type"); \
1435 return base + index; \
1437 if (insn->rexPrefix && \
1438 index >= 4 && index <= 7) { \
1439 return prefix##_SPL + (index - 4); \
1441 return prefix##_AL + index; \
1444 return prefix##_AX + index; \
1446 return prefix##_EAX + index; \
1448 return prefix##_RAX + index; \
1450 return prefix##_ZMM0 + index; \
1452 return prefix##_YMM0 + index; \
1457 return prefix##_XMM0 + index; \
1461 return prefix##_K0 + index; \
1463 return prefix##_MM0 + (index & 0x7); \
1464 case TYPE_SEGMENTREG: \
1467 return prefix##_ES + index; \
1468 case TYPE_DEBUGREG: \
1469 return prefix##_DR0 + index; \
1470 case TYPE_CONTROLREG: \
1471 return prefix##_CR0 + index; \
1476 * fixup*Value - Consults an operand type to determine the meaning of the
1477 * reg or R/M field. If the operand is an XMM operand, for example, an
1478 * operand would be XMM0 instead of AX, which readModRM() would otherwise
1479 * misinterpret it as.
1481 * @param insn - The instruction containing the operand.
1482 * @param type - The operand type.
1483 * @param index - The existing value of the field as reported by readModRM().
1484 * @param valid - The address of a uint8_t. The target is set to 1 if the
1485 * field is valid for the register class; 0 if not.
1486 * @return - The proper value.
1488 GENERIC_FIXUP_FUNC(fixupRegValue
, insn
->regBase
, MODRM_REG
)
1489 GENERIC_FIXUP_FUNC(fixupRMValue
, insn
->eaRegBase
, EA_REG
)
1492 * fixupReg - Consults an operand specifier to determine which of the
1493 * fixup*Value functions to use in correcting readModRM()'ss interpretation.
1495 * @param insn - See fixup*Value().
1496 * @param op - The operand specifier.
1497 * @return - 0 if fixup was successful; -1 if the register returned was
1498 * invalid for its class.
1500 static int fixupReg(struct InternalInstruction
*insn
,
1501 const struct OperandSpecifier
*op
) {
1504 dbgprintf(insn
, "fixupReg()");
1506 switch ((OperandEncoding
)op
->encoding
) {
1508 debug("Expected a REG or R/M encoding in fixupReg");
1511 insn
->vvvv
= (Reg
)fixupRegValue(insn
,
1512 (OperandType
)op
->type
,
1519 insn
->reg
= (Reg
)fixupRegValue(insn
,
1520 (OperandType
)op
->type
,
1521 insn
->reg
- insn
->regBase
,
1527 if (insn
->eaBase
>= insn
->eaRegBase
) {
1528 insn
->eaBase
= (EABase
)fixupRMValue(insn
,
1529 (OperandType
)op
->type
,
1530 insn
->eaBase
- insn
->eaRegBase
,
1542 * readOpcodeRegister - Reads an operand from the opcode field of an
1543 * instruction and interprets it appropriately given the operand width.
1544 * Handles AddRegFrm instructions.
1546 * @param insn - the instruction whose opcode field is to be read.
1547 * @param size - The width (in bytes) of the register being specified.
1548 * 1 means AL and friends, 2 means AX, 4 means EAX, and 8 means
1550 * @return - 0 on success; nonzero otherwise.
1552 static int readOpcodeRegister(struct InternalInstruction
* insn
, uint8_t size
) {
1553 dbgprintf(insn
, "readOpcodeRegister()");
1556 size
= insn
->registerSize
;
1560 insn
->opcodeRegister
= (Reg
)(MODRM_REG_AL
+ ((bFromREX(insn
->rexPrefix
) << 3)
1561 | (insn
->opcode
& 7)));
1562 if (insn
->rexPrefix
&&
1563 insn
->opcodeRegister
>= MODRM_REG_AL
+ 0x4 &&
1564 insn
->opcodeRegister
< MODRM_REG_AL
+ 0x8) {
1565 insn
->opcodeRegister
= (Reg
)(MODRM_REG_SPL
1566 + (insn
->opcodeRegister
- MODRM_REG_AL
- 4));
1571 insn
->opcodeRegister
= (Reg
)(MODRM_REG_AX
1572 + ((bFromREX(insn
->rexPrefix
) << 3)
1573 | (insn
->opcode
& 7)));
1576 insn
->opcodeRegister
= (Reg
)(MODRM_REG_EAX
1577 + ((bFromREX(insn
->rexPrefix
) << 3)
1578 | (insn
->opcode
& 7)));
1581 insn
->opcodeRegister
= (Reg
)(MODRM_REG_RAX
1582 + ((bFromREX(insn
->rexPrefix
) << 3)
1583 | (insn
->opcode
& 7)));
1591 * readImmediate - Consumes an immediate operand from an instruction, given the
1592 * desired operand size.
1594 * @param insn - The instruction whose operand is to be read.
1595 * @param size - The width (in bytes) of the operand.
1596 * @return - 0 if the immediate was successfully consumed; nonzero
1599 static int readImmediate(struct InternalInstruction
* insn
, uint8_t size
) {
1605 dbgprintf(insn
, "readImmediate()");
1607 if (insn
->numImmediatesConsumed
== 2) {
1608 debug("Already consumed two immediates");
1613 size
= insn
->immediateSize
;
1615 insn
->immediateSize
= size
;
1616 insn
->immediateOffset
= insn
->readerCursor
- insn
->startLocation
;
1620 if (consumeByte(insn
, &imm8
))
1622 insn
->immediates
[insn
->numImmediatesConsumed
] = imm8
;
1625 if (consumeUInt16(insn
, &imm16
))
1627 insn
->immediates
[insn
->numImmediatesConsumed
] = imm16
;
1630 if (consumeUInt32(insn
, &imm32
))
1632 insn
->immediates
[insn
->numImmediatesConsumed
] = imm32
;
1635 if (consumeUInt64(insn
, &imm64
))
1637 insn
->immediates
[insn
->numImmediatesConsumed
] = imm64
;
1641 insn
->numImmediatesConsumed
++;
1647 * readVVVV - Consumes vvvv from an instruction if it has a VEX prefix.
1649 * @param insn - The instruction whose operand is to be read.
1650 * @return - 0 if the vvvv was successfully consumed; nonzero
1653 static int readVVVV(struct InternalInstruction
* insn
) {
1654 dbgprintf(insn
, "readVVVV()");
1657 if (insn
->vectorExtensionType
== TYPE_EVEX
)
1658 vvvv
= (v2FromEVEX4of4(insn
->vectorExtensionPrefix
[3]) << 4 |
1659 vvvvFromEVEX3of4(insn
->vectorExtensionPrefix
[2]));
1660 else if (insn
->vectorExtensionType
== TYPE_VEX_3B
)
1661 vvvv
= vvvvFromVEX3of3(insn
->vectorExtensionPrefix
[2]);
1662 else if (insn
->vectorExtensionType
== TYPE_VEX_2B
)
1663 vvvv
= vvvvFromVEX2of2(insn
->vectorExtensionPrefix
[1]);
1664 else if (insn
->vectorExtensionType
== TYPE_XOP
)
1665 vvvv
= vvvvFromXOP3of3(insn
->vectorExtensionPrefix
[2]);
1669 if (insn
->mode
!= MODE_64BIT
)
1672 insn
->vvvv
= static_cast<Reg
>(vvvv
);
1677 * readMaskRegister - Reads an mask register from the opcode field of an
1680 * @param insn - The instruction whose opcode field is to be read.
1681 * @return - 0 on success; nonzero otherwise.
1683 static int readMaskRegister(struct InternalInstruction
* insn
) {
1684 dbgprintf(insn
, "readMaskRegister()");
1686 if (insn
->vectorExtensionType
!= TYPE_EVEX
)
1690 static_cast<Reg
>(aaaFromEVEX4of4(insn
->vectorExtensionPrefix
[3]));
1695 * readOperands - Consults the specifier for an instruction and consumes all
1696 * operands for that instruction, interpreting them as it goes.
1698 * @param insn - The instruction whose operands are to be read and interpreted.
1699 * @return - 0 if all operands could be read; nonzero otherwise.
1701 static int readOperands(struct InternalInstruction
* insn
) {
1702 int hasVVVV
, needVVVV
;
1705 dbgprintf(insn
, "readOperands()");
1707 /* If non-zero vvvv specified, need to make sure one of the operands
1709 hasVVVV
= !readVVVV(insn
);
1710 needVVVV
= hasVVVV
&& (insn
->vvvv
!= 0);
1712 for (const auto &Op
: x86OperandSets
[insn
->spec
->operands
]) {
1713 switch (Op
.encoding
) {
1720 if (readModRM(insn
))
1722 if (fixupReg(insn
, &Op
))
1724 // Apply the AVX512 compressed displacement scaling factor.
1725 if (Op
.encoding
!= ENCODING_REG
&& insn
->eaDisplacement
== EA_DISP_8
)
1726 insn
->displacement
*= 1 << (Op
.encoding
- ENCODING_RM
);
1734 dbgprintf(insn
, "We currently don't hande code-offset encodings");
1738 /* Saw a register immediate so don't read again and instead split the
1739 previous immediate. FIXME: This is a hack. */
1740 insn
->immediates
[insn
->numImmediatesConsumed
] =
1741 insn
->immediates
[insn
->numImmediatesConsumed
- 1] & 0xf;
1742 ++insn
->numImmediatesConsumed
;
1745 if (readImmediate(insn
, 1))
1747 if (Op
.type
== TYPE_XMM128
||
1748 Op
.type
== TYPE_XMM256
)
1752 if (readImmediate(insn
, 2))
1756 if (readImmediate(insn
, 4))
1760 if (readImmediate(insn
, 8))
1764 if (readImmediate(insn
, insn
->immediateSize
))
1768 if (readImmediate(insn
, insn
->addressSize
))
1772 if (readOpcodeRegister(insn
, 1))
1776 if (readOpcodeRegister(insn
, 2))
1780 if (readOpcodeRegister(insn
, 4))
1784 if (readOpcodeRegister(insn
, 8))
1788 if (readOpcodeRegister(insn
, 0))
1794 needVVVV
= 0; /* Mark that we have found a VVVV operand. */
1797 if (fixupReg(insn
, &Op
))
1800 case ENCODING_WRITEMASK
:
1801 if (readMaskRegister(insn
))
1807 dbgprintf(insn
, "Encountered an operand with an unknown encoding.");
1812 /* If we didn't find ENCODING_VVVV operand, but non-zero vvvv present, fail */
1813 if (needVVVV
) return -1;
1819 * decodeInstruction - Reads and interprets a full instruction provided by the
1822 * @param insn - A pointer to the instruction to be populated. Must be
1824 * @param reader - The function to be used to read the instruction's bytes.
1825 * @param readerArg - A generic argument to be passed to the reader to store
1826 * any internal state.
1827 * @param logger - If non-NULL, the function to be used to write log messages
1829 * @param loggerArg - A generic argument to be passed to the logger to store
1830 * any internal state.
1831 * @param startLoc - The address (in the reader's address space) of the first
1832 * byte in the instruction.
1833 * @param mode - The mode (real mode, IA-32e, or IA-32e in 64-bit mode) to
1834 * decode the instruction in.
1835 * @return - 0 if the instruction's memory could be read; nonzero if
1838 int llvm::X86Disassembler::decodeInstruction(
1839 struct InternalInstruction
*insn
, byteReader_t reader
,
1840 const void *readerArg
, dlog_t logger
, void *loggerArg
, const void *miiArg
,
1841 uint64_t startLoc
, DisassemblerMode mode
) {
1842 memset(insn
, 0, sizeof(struct InternalInstruction
));
1844 insn
->reader
= reader
;
1845 insn
->readerArg
= readerArg
;
1846 insn
->dlog
= logger
;
1847 insn
->dlogArg
= loggerArg
;
1848 insn
->startLocation
= startLoc
;
1849 insn
->readerCursor
= startLoc
;
1851 insn
->numImmediatesConsumed
= 0;
1853 if (readPrefixes(insn
) ||
1855 getID(insn
, miiArg
) ||
1856 insn
->instructionID
== 0 ||
1860 insn
->operands
= x86OperandSets
[insn
->spec
->operands
];
1862 insn
->length
= insn
->readerCursor
- insn
->startLocation
;
1864 dbgprintf(insn
, "Read from 0x%llx to 0x%llx: length %zu",
1865 startLoc
, insn
->readerCursor
, insn
->length
);
1867 if (insn
->length
> 15)
1868 dbgprintf(insn
, "Instruction exceeds 15-byte limit");