[llvm] Stop including llvm/ADT/DenseMap.h (NFC)
[llvm-project.git] / llvm / lib / Target / X86 / Disassembler / X86Disassembler.cpp
blob2ec7a57093f4ba3f81dfccef154e8b8f5463faab
1 //===-- X86Disassembler.cpp - Disassembler for x86 and x86_64 -------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file is part of the X86 Disassembler.
10 // It contains code to translate the data produced by the decoder into
11 // MCInsts.
14 // The X86 disassembler is a table-driven disassembler for the 16-, 32-, and
15 // 64-bit X86 instruction sets. The main decode sequence for an assembly
16 // instruction in this disassembler is:
18 // 1. Read the prefix bytes and determine the attributes of the instruction.
19 // These attributes, recorded in enum attributeBits
20 // (X86DisassemblerDecoderCommon.h), form a bitmask. The table CONTEXTS_SYM
21 // provides a mapping from bitmasks to contexts, which are represented by
22 // enum InstructionContext (ibid.).
24 // 2. Read the opcode, and determine what kind of opcode it is. The
25 // disassembler distinguishes four kinds of opcodes, which are enumerated in
26 // OpcodeType (X86DisassemblerDecoderCommon.h): one-byte (0xnn), two-byte
27 // (0x0f 0xnn), three-byte-38 (0x0f 0x38 0xnn), or three-byte-3a
28 // (0x0f 0x3a 0xnn). Mandatory prefixes are treated as part of the context.
30 // 3. Depending on the opcode type, look in one of four ClassDecision structures
31 // (X86DisassemblerDecoderCommon.h). Use the opcode class to determine which
32 // OpcodeDecision (ibid.) to look the opcode in. Look up the opcode, to get
33 // a ModRMDecision (ibid.).
35 // 4. Some instructions, such as escape opcodes or extended opcodes, or even
36 // instructions that have ModRM*Reg / ModRM*Mem forms in LLVM, need the
37 // ModR/M byte to complete decode. The ModRMDecision's type is an entry from
38 // ModRMDecisionType (X86DisassemblerDecoderCommon.h) that indicates if the
39 // ModR/M byte is required and how to interpret it.
41 // 5. After resolving the ModRMDecision, the disassembler has a unique ID
42 // of type InstrUID (X86DisassemblerDecoderCommon.h). Looking this ID up in
43 // INSTRUCTIONS_SYM yields the name of the instruction and the encodings and
44 // meanings of its operands.
46 // 6. For each operand, its encoding is an entry from OperandEncoding
47 // (X86DisassemblerDecoderCommon.h) and its type is an entry from
48 // OperandType (ibid.). The encoding indicates how to read it from the
49 // instruction; the type indicates how to interpret the value once it has
50 // been read. For example, a register operand could be stored in the R/M
51 // field of the ModR/M byte, the REG field of the ModR/M byte, or added to
52 // the main opcode. This is orthogonal from its meaning (an GPR or an XMM
53 // register, for instance). Given this information, the operands can be
54 // extracted and interpreted.
56 // 7. As the last step, the disassembler translates the instruction information
57 // and operands into a format understandable by the client - in this case, an
58 // MCInst for use by the MC infrastructure.
60 // The disassembler is broken broadly into two parts: the table emitter that
61 // emits the instruction decode tables discussed above during compilation, and
62 // the disassembler itself. The table emitter is documented in more detail in
63 // utils/TableGen/X86DisassemblerEmitter.h.
65 // X86Disassembler.cpp contains the code responsible for step 7, and for
66 // invoking the decoder to execute steps 1-6.
67 // X86DisassemblerDecoderCommon.h contains the definitions needed by both the
68 // table emitter and the disassembler.
69 // X86DisassemblerDecoder.h contains the public interface of the decoder,
70 // factored out into C for possible use by other projects.
71 // X86DisassemblerDecoder.c contains the source code of the decoder, which is
72 // responsible for steps 1-6.
74 //===----------------------------------------------------------------------===//
76 #include "MCTargetDesc/X86BaseInfo.h"
77 #include "MCTargetDesc/X86MCTargetDesc.h"
78 #include "TargetInfo/X86TargetInfo.h"
79 #include "X86DisassemblerDecoder.h"
80 #include "llvm/MC/MCContext.h"
81 #include "llvm/MC/MCDisassembler/MCDisassembler.h"
82 #include "llvm/MC/MCExpr.h"
83 #include "llvm/MC/MCInst.h"
84 #include "llvm/MC/MCInstrInfo.h"
85 #include "llvm/MC/MCSubtargetInfo.h"
86 #include "llvm/MC/TargetRegistry.h"
87 #include "llvm/Support/Debug.h"
88 #include "llvm/Support/Format.h"
89 #include "llvm/Support/raw_ostream.h"
91 using namespace llvm;
92 using namespace llvm::X86Disassembler;
94 #define DEBUG_TYPE "x86-disassembler"
96 #define debug(s) LLVM_DEBUG(dbgs() << __LINE__ << ": " << s);
98 // Specifies whether a ModR/M byte is needed and (if so) which
99 // instruction each possible value of the ModR/M byte corresponds to. Once
100 // this information is known, we have narrowed down to a single instruction.
101 struct ModRMDecision {
102 uint8_t modrm_type;
103 uint16_t instructionIDs;
106 // Specifies which set of ModR/M->instruction tables to look at
107 // given a particular opcode.
108 struct OpcodeDecision {
109 ModRMDecision modRMDecisions[256];
112 // Specifies which opcode->instruction tables to look at given
113 // a particular context (set of attributes). Since there are many possible
114 // contexts, the decoder first uses CONTEXTS_SYM to determine which context
115 // applies given a specific set of attributes. Hence there are only IC_max
116 // entries in this table, rather than 2^(ATTR_max).
117 struct ContextDecision {
118 OpcodeDecision opcodeDecisions[IC_max];
121 #include "X86GenDisassemblerTables.inc"
123 static InstrUID decode(OpcodeType type, InstructionContext insnContext,
124 uint8_t opcode, uint8_t modRM) {
125 const struct ModRMDecision *dec;
127 switch (type) {
128 case ONEBYTE:
129 dec = &ONEBYTE_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode];
130 break;
131 case TWOBYTE:
132 dec = &TWOBYTE_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode];
133 break;
134 case THREEBYTE_38:
135 dec = &THREEBYTE38_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode];
136 break;
137 case THREEBYTE_3A:
138 dec = &THREEBYTE3A_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode];
139 break;
140 case XOP8_MAP:
141 dec = &XOP8_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode];
142 break;
143 case XOP9_MAP:
144 dec = &XOP9_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode];
145 break;
146 case XOPA_MAP:
147 dec = &XOPA_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode];
148 break;
149 case THREEDNOW_MAP:
150 dec =
151 &THREEDNOW_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode];
152 break;
153 case MAP5:
154 dec = &MAP5_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode];
155 break;
156 case MAP6:
157 dec = &MAP6_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode];
158 break;
159 case MAP7:
160 dec = &MAP7_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode];
161 break;
164 switch (dec->modrm_type) {
165 default:
166 llvm_unreachable("Corrupt table! Unknown modrm_type");
167 return 0;
168 case MODRM_ONEENTRY:
169 return modRMTable[dec->instructionIDs];
170 case MODRM_SPLITRM:
171 if (modFromModRM(modRM) == 0x3)
172 return modRMTable[dec->instructionIDs + 1];
173 return modRMTable[dec->instructionIDs];
174 case MODRM_SPLITREG:
175 if (modFromModRM(modRM) == 0x3)
176 return modRMTable[dec->instructionIDs + ((modRM & 0x38) >> 3) + 8];
177 return modRMTable[dec->instructionIDs + ((modRM & 0x38) >> 3)];
178 case MODRM_SPLITMISC:
179 if (modFromModRM(modRM) == 0x3)
180 return modRMTable[dec->instructionIDs + (modRM & 0x3f) + 8];
181 return modRMTable[dec->instructionIDs + ((modRM & 0x38) >> 3)];
182 case MODRM_FULL:
183 return modRMTable[dec->instructionIDs + modRM];
187 static bool peek(struct InternalInstruction *insn, uint8_t &byte) {
188 uint64_t offset = insn->readerCursor - insn->startLocation;
189 if (offset >= insn->bytes.size())
190 return true;
191 byte = insn->bytes[offset];
192 return false;
195 template <typename T> static bool consume(InternalInstruction *insn, T &ptr) {
196 auto r = insn->bytes;
197 uint64_t offset = insn->readerCursor - insn->startLocation;
198 if (offset + sizeof(T) > r.size())
199 return true;
200 ptr = support::endian::read<T>(&r[offset], llvm::endianness::little);
201 insn->readerCursor += sizeof(T);
202 return false;
205 static bool isREX(struct InternalInstruction *insn, uint8_t prefix) {
206 return insn->mode == MODE_64BIT && prefix >= 0x40 && prefix <= 0x4f;
209 // Consumes all of an instruction's prefix bytes, and marks the
210 // instruction as having them. Also sets the instruction's default operand,
211 // address, and other relevant data sizes to report operands correctly.
213 // insn must not be empty.
214 static int readPrefixes(struct InternalInstruction *insn) {
215 bool isPrefix = true;
216 uint8_t byte = 0;
217 uint8_t nextByte;
219 LLVM_DEBUG(dbgs() << "readPrefixes()");
221 while (isPrefix) {
222 // If we fail reading prefixes, just stop here and let the opcode reader
223 // deal with it.
224 if (consume(insn, byte))
225 break;
227 // If the byte is a LOCK/REP/REPNE prefix and not a part of the opcode, then
228 // break and let it be disassembled as a normal "instruction".
229 if (insn->readerCursor - 1 == insn->startLocation && byte == 0xf0) // LOCK
230 break;
232 if ((byte == 0xf2 || byte == 0xf3) && !peek(insn, nextByte)) {
233 // If the byte is 0xf2 or 0xf3, and any of the following conditions are
234 // met:
235 // - it is followed by a LOCK (0xf0) prefix
236 // - it is followed by an xchg instruction
237 // then it should be disassembled as a xacquire/xrelease not repne/rep.
238 if (((nextByte == 0xf0) ||
239 ((nextByte & 0xfe) == 0x86 || (nextByte & 0xf8) == 0x90))) {
240 insn->xAcquireRelease = true;
241 if (!(byte == 0xf3 && nextByte == 0x90)) // PAUSE instruction support
242 break;
244 // Also if the byte is 0xf3, and the following condition is met:
245 // - it is followed by a "mov mem, reg" (opcode 0x88/0x89) or
246 // "mov mem, imm" (opcode 0xc6/0xc7) instructions.
247 // then it should be disassembled as an xrelease not rep.
248 if (byte == 0xf3 && (nextByte == 0x88 || nextByte == 0x89 ||
249 nextByte == 0xc6 || nextByte == 0xc7)) {
250 insn->xAcquireRelease = true;
251 break;
253 if (isREX(insn, nextByte)) {
254 uint8_t nnextByte;
255 // Go to REX prefix after the current one
256 if (consume(insn, nnextByte))
257 return -1;
258 // We should be able to read next byte after REX prefix
259 if (peek(insn, nnextByte))
260 return -1;
261 --insn->readerCursor;
265 switch (byte) {
266 case 0xf0: // LOCK
267 insn->hasLockPrefix = true;
268 break;
269 case 0xf2: // REPNE/REPNZ
270 case 0xf3: { // REP or REPE/REPZ
271 uint8_t nextByte;
272 if (peek(insn, nextByte))
273 break;
274 // TODO:
275 // 1. There could be several 0x66
276 // 2. if (nextByte == 0x66) and nextNextByte != 0x0f then
277 // it's not mandatory prefix
278 // 3. if (nextByte >= 0x40 && nextByte <= 0x4f) it's REX and we need
279 // 0x0f exactly after it to be mandatory prefix
280 if (isREX(insn, nextByte) || nextByte == 0x0f || nextByte == 0x66)
281 // The last of 0xf2 /0xf3 is mandatory prefix
282 insn->mandatoryPrefix = byte;
283 insn->repeatPrefix = byte;
284 break;
286 case 0x2e: // CS segment override -OR- Branch not taken
287 insn->segmentOverride = SEG_OVERRIDE_CS;
288 break;
289 case 0x36: // SS segment override -OR- Branch taken
290 insn->segmentOverride = SEG_OVERRIDE_SS;
291 break;
292 case 0x3e: // DS segment override
293 insn->segmentOverride = SEG_OVERRIDE_DS;
294 break;
295 case 0x26: // ES segment override
296 insn->segmentOverride = SEG_OVERRIDE_ES;
297 break;
298 case 0x64: // FS segment override
299 insn->segmentOverride = SEG_OVERRIDE_FS;
300 break;
301 case 0x65: // GS segment override
302 insn->segmentOverride = SEG_OVERRIDE_GS;
303 break;
304 case 0x66: { // Operand-size override {
305 uint8_t nextByte;
306 insn->hasOpSize = true;
307 if (peek(insn, nextByte))
308 break;
309 // 0x66 can't overwrite existing mandatory prefix and should be ignored
310 if (!insn->mandatoryPrefix && (nextByte == 0x0f || isREX(insn, nextByte)))
311 insn->mandatoryPrefix = byte;
312 break;
314 case 0x67: // Address-size override
315 insn->hasAdSize = true;
316 break;
317 default: // Not a prefix byte
318 isPrefix = false;
319 break;
322 if (isPrefix)
323 LLVM_DEBUG(dbgs() << format("Found prefix 0x%hhx", byte));
326 insn->vectorExtensionType = TYPE_NO_VEX_XOP;
328 if (byte == 0x62) {
329 uint8_t byte1, byte2;
330 if (consume(insn, byte1)) {
331 LLVM_DEBUG(dbgs() << "Couldn't read second byte of EVEX prefix");
332 return -1;
335 if (peek(insn, byte2)) {
336 LLVM_DEBUG(dbgs() << "Couldn't read third byte of EVEX prefix");
337 return -1;
340 if ((insn->mode == MODE_64BIT || (byte1 & 0xc0) == 0xc0) &&
341 ((~byte1 & 0x8) == 0x8) && ((byte2 & 0x4) == 0x4)) {
342 insn->vectorExtensionType = TYPE_EVEX;
343 } else {
344 --insn->readerCursor; // unconsume byte1
345 --insn->readerCursor; // unconsume byte
348 if (insn->vectorExtensionType == TYPE_EVEX) {
349 insn->vectorExtensionPrefix[0] = byte;
350 insn->vectorExtensionPrefix[1] = byte1;
351 if (consume(insn, insn->vectorExtensionPrefix[2])) {
352 LLVM_DEBUG(dbgs() << "Couldn't read third byte of EVEX prefix");
353 return -1;
355 if (consume(insn, insn->vectorExtensionPrefix[3])) {
356 LLVM_DEBUG(dbgs() << "Couldn't read fourth byte of EVEX prefix");
357 return -1;
360 // We simulate the REX prefix for simplicity's sake
361 if (insn->mode == MODE_64BIT) {
362 insn->rexPrefix = 0x40 |
363 (wFromEVEX3of4(insn->vectorExtensionPrefix[2]) << 3) |
364 (rFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 2) |
365 (xFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 1) |
366 (bFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 0);
369 LLVM_DEBUG(
370 dbgs() << format(
371 "Found EVEX prefix 0x%hhx 0x%hhx 0x%hhx 0x%hhx",
372 insn->vectorExtensionPrefix[0], insn->vectorExtensionPrefix[1],
373 insn->vectorExtensionPrefix[2], insn->vectorExtensionPrefix[3]));
375 } else if (byte == 0xc4) {
376 uint8_t byte1;
377 if (peek(insn, byte1)) {
378 LLVM_DEBUG(dbgs() << "Couldn't read second byte of VEX");
379 return -1;
382 if (insn->mode == MODE_64BIT || (byte1 & 0xc0) == 0xc0)
383 insn->vectorExtensionType = TYPE_VEX_3B;
384 else
385 --insn->readerCursor;
387 if (insn->vectorExtensionType == TYPE_VEX_3B) {
388 insn->vectorExtensionPrefix[0] = byte;
389 consume(insn, insn->vectorExtensionPrefix[1]);
390 consume(insn, insn->vectorExtensionPrefix[2]);
392 // We simulate the REX prefix for simplicity's sake
394 if (insn->mode == MODE_64BIT)
395 insn->rexPrefix = 0x40 |
396 (wFromVEX3of3(insn->vectorExtensionPrefix[2]) << 3) |
397 (rFromVEX2of3(insn->vectorExtensionPrefix[1]) << 2) |
398 (xFromVEX2of3(insn->vectorExtensionPrefix[1]) << 1) |
399 (bFromVEX2of3(insn->vectorExtensionPrefix[1]) << 0);
401 LLVM_DEBUG(dbgs() << format("Found VEX prefix 0x%hhx 0x%hhx 0x%hhx",
402 insn->vectorExtensionPrefix[0],
403 insn->vectorExtensionPrefix[1],
404 insn->vectorExtensionPrefix[2]));
406 } else if (byte == 0xc5) {
407 uint8_t byte1;
408 if (peek(insn, byte1)) {
409 LLVM_DEBUG(dbgs() << "Couldn't read second byte of VEX");
410 return -1;
413 if (insn->mode == MODE_64BIT || (byte1 & 0xc0) == 0xc0)
414 insn->vectorExtensionType = TYPE_VEX_2B;
415 else
416 --insn->readerCursor;
418 if (insn->vectorExtensionType == TYPE_VEX_2B) {
419 insn->vectorExtensionPrefix[0] = byte;
420 consume(insn, insn->vectorExtensionPrefix[1]);
422 if (insn->mode == MODE_64BIT)
423 insn->rexPrefix =
424 0x40 | (rFromVEX2of2(insn->vectorExtensionPrefix[1]) << 2);
426 switch (ppFromVEX2of2(insn->vectorExtensionPrefix[1])) {
427 default:
428 break;
429 case VEX_PREFIX_66:
430 insn->hasOpSize = true;
431 break;
434 LLVM_DEBUG(dbgs() << format("Found VEX prefix 0x%hhx 0x%hhx",
435 insn->vectorExtensionPrefix[0],
436 insn->vectorExtensionPrefix[1]));
438 } else if (byte == 0x8f) {
439 uint8_t byte1;
440 if (peek(insn, byte1)) {
441 LLVM_DEBUG(dbgs() << "Couldn't read second byte of XOP");
442 return -1;
445 if ((byte1 & 0x38) != 0x0) // 0 in these 3 bits is a POP instruction.
446 insn->vectorExtensionType = TYPE_XOP;
447 else
448 --insn->readerCursor;
450 if (insn->vectorExtensionType == TYPE_XOP) {
451 insn->vectorExtensionPrefix[0] = byte;
452 consume(insn, insn->vectorExtensionPrefix[1]);
453 consume(insn, insn->vectorExtensionPrefix[2]);
455 // We simulate the REX prefix for simplicity's sake
457 if (insn->mode == MODE_64BIT)
458 insn->rexPrefix = 0x40 |
459 (wFromXOP3of3(insn->vectorExtensionPrefix[2]) << 3) |
460 (rFromXOP2of3(insn->vectorExtensionPrefix[1]) << 2) |
461 (xFromXOP2of3(insn->vectorExtensionPrefix[1]) << 1) |
462 (bFromXOP2of3(insn->vectorExtensionPrefix[1]) << 0);
464 switch (ppFromXOP3of3(insn->vectorExtensionPrefix[2])) {
465 default:
466 break;
467 case VEX_PREFIX_66:
468 insn->hasOpSize = true;
469 break;
472 LLVM_DEBUG(dbgs() << format("Found XOP prefix 0x%hhx 0x%hhx 0x%hhx",
473 insn->vectorExtensionPrefix[0],
474 insn->vectorExtensionPrefix[1],
475 insn->vectorExtensionPrefix[2]));
477 } else if (isREX(insn, byte)) {
478 if (peek(insn, nextByte))
479 return -1;
480 insn->rexPrefix = byte;
481 LLVM_DEBUG(dbgs() << format("Found REX prefix 0x%hhx", byte));
482 } else
483 --insn->readerCursor;
485 if (insn->mode == MODE_16BIT) {
486 insn->registerSize = (insn->hasOpSize ? 4 : 2);
487 insn->addressSize = (insn->hasAdSize ? 4 : 2);
488 insn->displacementSize = (insn->hasAdSize ? 4 : 2);
489 insn->immediateSize = (insn->hasOpSize ? 4 : 2);
490 } else if (insn->mode == MODE_32BIT) {
491 insn->registerSize = (insn->hasOpSize ? 2 : 4);
492 insn->addressSize = (insn->hasAdSize ? 2 : 4);
493 insn->displacementSize = (insn->hasAdSize ? 2 : 4);
494 insn->immediateSize = (insn->hasOpSize ? 2 : 4);
495 } else if (insn->mode == MODE_64BIT) {
496 insn->displacementSize = 4;
497 if (insn->rexPrefix && wFromREX(insn->rexPrefix)) {
498 insn->registerSize = 8;
499 insn->addressSize = (insn->hasAdSize ? 4 : 8);
500 insn->immediateSize = 4;
501 insn->hasOpSize = false;
502 } else {
503 insn->registerSize = (insn->hasOpSize ? 2 : 4);
504 insn->addressSize = (insn->hasAdSize ? 4 : 8);
505 insn->immediateSize = (insn->hasOpSize ? 2 : 4);
509 return 0;
512 // Consumes the SIB byte to determine addressing information.
513 static int readSIB(struct InternalInstruction *insn) {
514 SIBBase sibBaseBase = SIB_BASE_NONE;
515 uint8_t index, base;
517 LLVM_DEBUG(dbgs() << "readSIB()");
518 switch (insn->addressSize) {
519 case 2:
520 default:
521 llvm_unreachable("SIB-based addressing doesn't work in 16-bit mode");
522 case 4:
523 insn->sibIndexBase = SIB_INDEX_EAX;
524 sibBaseBase = SIB_BASE_EAX;
525 break;
526 case 8:
527 insn->sibIndexBase = SIB_INDEX_RAX;
528 sibBaseBase = SIB_BASE_RAX;
529 break;
532 if (consume(insn, insn->sib))
533 return -1;
535 index = indexFromSIB(insn->sib) | (xFromREX(insn->rexPrefix) << 3);
537 if (index == 0x4) {
538 insn->sibIndex = SIB_INDEX_NONE;
539 } else {
540 insn->sibIndex = (SIBIndex)(insn->sibIndexBase + index);
543 insn->sibScale = 1 << scaleFromSIB(insn->sib);
545 base = baseFromSIB(insn->sib) | (bFromREX(insn->rexPrefix) << 3);
547 switch (base) {
548 case 0x5:
549 case 0xd:
550 switch (modFromModRM(insn->modRM)) {
551 case 0x0:
552 insn->eaDisplacement = EA_DISP_32;
553 insn->sibBase = SIB_BASE_NONE;
554 break;
555 case 0x1:
556 insn->eaDisplacement = EA_DISP_8;
557 insn->sibBase = (SIBBase)(sibBaseBase + base);
558 break;
559 case 0x2:
560 insn->eaDisplacement = EA_DISP_32;
561 insn->sibBase = (SIBBase)(sibBaseBase + base);
562 break;
563 default:
564 llvm_unreachable("Cannot have Mod = 0b11 and a SIB byte");
566 break;
567 default:
568 insn->sibBase = (SIBBase)(sibBaseBase + base);
569 break;
572 return 0;
575 static int readDisplacement(struct InternalInstruction *insn) {
576 int8_t d8;
577 int16_t d16;
578 int32_t d32;
579 LLVM_DEBUG(dbgs() << "readDisplacement()");
581 insn->displacementOffset = insn->readerCursor - insn->startLocation;
582 switch (insn->eaDisplacement) {
583 case EA_DISP_NONE:
584 break;
585 case EA_DISP_8:
586 if (consume(insn, d8))
587 return -1;
588 insn->displacement = d8;
589 break;
590 case EA_DISP_16:
591 if (consume(insn, d16))
592 return -1;
593 insn->displacement = d16;
594 break;
595 case EA_DISP_32:
596 if (consume(insn, d32))
597 return -1;
598 insn->displacement = d32;
599 break;
602 return 0;
605 // Consumes all addressing information (ModR/M byte, SIB byte, and displacement.
606 static int readModRM(struct InternalInstruction *insn) {
607 uint8_t mod, rm, reg, evexrm;
608 LLVM_DEBUG(dbgs() << "readModRM()");
610 if (insn->consumedModRM)
611 return 0;
613 if (consume(insn, insn->modRM))
614 return -1;
615 insn->consumedModRM = true;
617 mod = modFromModRM(insn->modRM);
618 rm = rmFromModRM(insn->modRM);
619 reg = regFromModRM(insn->modRM);
621 // This goes by insn->registerSize to pick the correct register, which messes
622 // up if we're using (say) XMM or 8-bit register operands. That gets fixed in
623 // fixupReg().
624 switch (insn->registerSize) {
625 case 2:
626 insn->regBase = MODRM_REG_AX;
627 insn->eaRegBase = EA_REG_AX;
628 break;
629 case 4:
630 insn->regBase = MODRM_REG_EAX;
631 insn->eaRegBase = EA_REG_EAX;
632 break;
633 case 8:
634 insn->regBase = MODRM_REG_RAX;
635 insn->eaRegBase = EA_REG_RAX;
636 break;
639 reg |= rFromREX(insn->rexPrefix) << 3;
640 rm |= bFromREX(insn->rexPrefix) << 3;
642 evexrm = 0;
643 if (insn->vectorExtensionType == TYPE_EVEX && insn->mode == MODE_64BIT) {
644 reg |= r2FromEVEX2of4(insn->vectorExtensionPrefix[1]) << 4;
645 evexrm = xFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 4;
648 insn->reg = (Reg)(insn->regBase + reg);
650 switch (insn->addressSize) {
651 case 2: {
652 EABase eaBaseBase = EA_BASE_BX_SI;
654 switch (mod) {
655 case 0x0:
656 if (rm == 0x6) {
657 insn->eaBase = EA_BASE_NONE;
658 insn->eaDisplacement = EA_DISP_16;
659 if (readDisplacement(insn))
660 return -1;
661 } else {
662 insn->eaBase = (EABase)(eaBaseBase + rm);
663 insn->eaDisplacement = EA_DISP_NONE;
665 break;
666 case 0x1:
667 insn->eaBase = (EABase)(eaBaseBase + rm);
668 insn->eaDisplacement = EA_DISP_8;
669 insn->displacementSize = 1;
670 if (readDisplacement(insn))
671 return -1;
672 break;
673 case 0x2:
674 insn->eaBase = (EABase)(eaBaseBase + rm);
675 insn->eaDisplacement = EA_DISP_16;
676 if (readDisplacement(insn))
677 return -1;
678 break;
679 case 0x3:
680 insn->eaBase = (EABase)(insn->eaRegBase + rm);
681 if (readDisplacement(insn))
682 return -1;
683 break;
685 break;
687 case 4:
688 case 8: {
689 EABase eaBaseBase = (insn->addressSize == 4 ? EA_BASE_EAX : EA_BASE_RAX);
691 switch (mod) {
692 case 0x0:
693 insn->eaDisplacement = EA_DISP_NONE; // readSIB may override this
694 // In determining whether RIP-relative mode is used (rm=5),
695 // or whether a SIB byte is present (rm=4),
696 // the extension bits (REX.b and EVEX.x) are ignored.
697 switch (rm & 7) {
698 case 0x4: // SIB byte is present
699 insn->eaBase = (insn->addressSize == 4 ? EA_BASE_sib : EA_BASE_sib64);
700 if (readSIB(insn) || readDisplacement(insn))
701 return -1;
702 break;
703 case 0x5: // RIP-relative
704 insn->eaBase = EA_BASE_NONE;
705 insn->eaDisplacement = EA_DISP_32;
706 if (readDisplacement(insn))
707 return -1;
708 break;
709 default:
710 insn->eaBase = (EABase)(eaBaseBase + rm);
711 break;
713 break;
714 case 0x1:
715 insn->displacementSize = 1;
716 [[fallthrough]];
717 case 0x2:
718 insn->eaDisplacement = (mod == 0x1 ? EA_DISP_8 : EA_DISP_32);
719 switch (rm & 7) {
720 case 0x4: // SIB byte is present
721 insn->eaBase = EA_BASE_sib;
722 if (readSIB(insn) || readDisplacement(insn))
723 return -1;
724 break;
725 default:
726 insn->eaBase = (EABase)(eaBaseBase + rm);
727 if (readDisplacement(insn))
728 return -1;
729 break;
731 break;
732 case 0x3:
733 insn->eaDisplacement = EA_DISP_NONE;
734 insn->eaBase = (EABase)(insn->eaRegBase + rm + evexrm);
735 break;
737 break;
739 } // switch (insn->addressSize)
741 return 0;
744 #define GENERIC_FIXUP_FUNC(name, base, prefix, mask) \
745 static uint16_t name(struct InternalInstruction *insn, OperandType type, \
746 uint8_t index, uint8_t *valid) { \
747 *valid = 1; \
748 switch (type) { \
749 default: \
750 debug("Unhandled register type"); \
751 *valid = 0; \
752 return 0; \
753 case TYPE_Rv: \
754 return base + index; \
755 case TYPE_R8: \
756 index &= mask; \
757 if (index > 0xf) \
758 *valid = 0; \
759 if (insn->rexPrefix && index >= 4 && index <= 7) { \
760 return prefix##_SPL + (index - 4); \
761 } else { \
762 return prefix##_AL + index; \
764 case TYPE_R16: \
765 index &= mask; \
766 if (index > 0xf) \
767 *valid = 0; \
768 return prefix##_AX + index; \
769 case TYPE_R32: \
770 index &= mask; \
771 if (index > 0xf) \
772 *valid = 0; \
773 return prefix##_EAX + index; \
774 case TYPE_R64: \
775 index &= mask; \
776 if (index > 0xf) \
777 *valid = 0; \
778 return prefix##_RAX + index; \
779 case TYPE_ZMM: \
780 return prefix##_ZMM0 + index; \
781 case TYPE_YMM: \
782 return prefix##_YMM0 + index; \
783 case TYPE_XMM: \
784 return prefix##_XMM0 + index; \
785 case TYPE_TMM: \
786 if (index > 7) \
787 *valid = 0; \
788 return prefix##_TMM0 + index; \
789 case TYPE_VK: \
790 index &= 0xf; \
791 if (index > 7) \
792 *valid = 0; \
793 return prefix##_K0 + index; \
794 case TYPE_VK_PAIR: \
795 if (index > 7) \
796 *valid = 0; \
797 return prefix##_K0_K1 + (index / 2); \
798 case TYPE_MM64: \
799 return prefix##_MM0 + (index & 0x7); \
800 case TYPE_SEGMENTREG: \
801 if ((index & 7) > 5) \
802 *valid = 0; \
803 return prefix##_ES + (index & 7); \
804 case TYPE_DEBUGREG: \
805 return prefix##_DR0 + index; \
806 case TYPE_CONTROLREG: \
807 return prefix##_CR0 + index; \
808 case TYPE_MVSIBX: \
809 return prefix##_XMM0 + index; \
810 case TYPE_MVSIBY: \
811 return prefix##_YMM0 + index; \
812 case TYPE_MVSIBZ: \
813 return prefix##_ZMM0 + index; \
817 // Consult an operand type to determine the meaning of the reg or R/M field. If
818 // the operand is an XMM operand, for example, an operand would be XMM0 instead
819 // of AX, which readModRM() would otherwise misinterpret it as.
821 // @param insn - The instruction containing the operand.
822 // @param type - The operand type.
823 // @param index - The existing value of the field as reported by readModRM().
824 // @param valid - The address of a uint8_t. The target is set to 1 if the
825 // field is valid for the register class; 0 if not.
826 // @return - The proper value.
827 GENERIC_FIXUP_FUNC(fixupRegValue, insn->regBase, MODRM_REG, 0x1f)
828 GENERIC_FIXUP_FUNC(fixupRMValue, insn->eaRegBase, EA_REG, 0xf)
830 // Consult an operand specifier to determine which of the fixup*Value functions
831 // to use in correcting readModRM()'ss interpretation.
833 // @param insn - See fixup*Value().
834 // @param op - The operand specifier.
835 // @return - 0 if fixup was successful; -1 if the register returned was
836 // invalid for its class.
837 static int fixupReg(struct InternalInstruction *insn,
838 const struct OperandSpecifier *op) {
839 uint8_t valid;
840 LLVM_DEBUG(dbgs() << "fixupReg()");
842 switch ((OperandEncoding)op->encoding) {
843 default:
844 debug("Expected a REG or R/M encoding in fixupReg");
845 return -1;
846 case ENCODING_VVVV:
847 insn->vvvv =
848 (Reg)fixupRegValue(insn, (OperandType)op->type, insn->vvvv, &valid);
849 if (!valid)
850 return -1;
851 break;
852 case ENCODING_REG:
853 insn->reg = (Reg)fixupRegValue(insn, (OperandType)op->type,
854 insn->reg - insn->regBase, &valid);
855 if (!valid)
856 return -1;
857 break;
858 case ENCODING_SIB:
859 CASE_ENCODING_RM:
860 if (insn->eaBase >= insn->eaRegBase) {
861 insn->eaBase = (EABase)fixupRMValue(
862 insn, (OperandType)op->type, insn->eaBase - insn->eaRegBase, &valid);
863 if (!valid)
864 return -1;
866 break;
869 return 0;
872 // Read the opcode (except the ModR/M byte in the case of extended or escape
873 // opcodes).
874 static bool readOpcode(struct InternalInstruction *insn) {
875 uint8_t current;
876 LLVM_DEBUG(dbgs() << "readOpcode()");
878 insn->opcodeType = ONEBYTE;
879 if (insn->vectorExtensionType == TYPE_EVEX) {
880 switch (mmmFromEVEX2of4(insn->vectorExtensionPrefix[1])) {
881 default:
882 LLVM_DEBUG(
883 dbgs() << format("Unhandled mmm field for instruction (0x%hhx)",
884 mmmFromEVEX2of4(insn->vectorExtensionPrefix[1])));
885 return true;
886 case VEX_LOB_0F:
887 insn->opcodeType = TWOBYTE;
888 return consume(insn, insn->opcode);
889 case VEX_LOB_0F38:
890 insn->opcodeType = THREEBYTE_38;
891 return consume(insn, insn->opcode);
892 case VEX_LOB_0F3A:
893 insn->opcodeType = THREEBYTE_3A;
894 return consume(insn, insn->opcode);
895 case VEX_LOB_MAP5:
896 insn->opcodeType = MAP5;
897 return consume(insn, insn->opcode);
898 case VEX_LOB_MAP6:
899 insn->opcodeType = MAP6;
900 return consume(insn, insn->opcode);
902 } else if (insn->vectorExtensionType == TYPE_VEX_3B) {
903 switch (mmmmmFromVEX2of3(insn->vectorExtensionPrefix[1])) {
904 default:
905 LLVM_DEBUG(
906 dbgs() << format("Unhandled m-mmmm field for instruction (0x%hhx)",
907 mmmmmFromVEX2of3(insn->vectorExtensionPrefix[1])));
908 return true;
909 case VEX_LOB_0F:
910 insn->opcodeType = TWOBYTE;
911 return consume(insn, insn->opcode);
912 case VEX_LOB_0F38:
913 insn->opcodeType = THREEBYTE_38;
914 return consume(insn, insn->opcode);
915 case VEX_LOB_0F3A:
916 insn->opcodeType = THREEBYTE_3A;
917 return consume(insn, insn->opcode);
918 case VEX_LOB_MAP5:
919 insn->opcodeType = MAP5;
920 return consume(insn, insn->opcode);
921 case VEX_LOB_MAP6:
922 insn->opcodeType = MAP6;
923 return consume(insn, insn->opcode);
924 case VEX_LOB_MAP7:
925 insn->opcodeType = MAP7;
926 return consume(insn, insn->opcode);
928 } else if (insn->vectorExtensionType == TYPE_VEX_2B) {
929 insn->opcodeType = TWOBYTE;
930 return consume(insn, insn->opcode);
931 } else if (insn->vectorExtensionType == TYPE_XOP) {
932 switch (mmmmmFromXOP2of3(insn->vectorExtensionPrefix[1])) {
933 default:
934 LLVM_DEBUG(
935 dbgs() << format("Unhandled m-mmmm field for instruction (0x%hhx)",
936 mmmmmFromVEX2of3(insn->vectorExtensionPrefix[1])));
937 return true;
938 case XOP_MAP_SELECT_8:
939 insn->opcodeType = XOP8_MAP;
940 return consume(insn, insn->opcode);
941 case XOP_MAP_SELECT_9:
942 insn->opcodeType = XOP9_MAP;
943 return consume(insn, insn->opcode);
944 case XOP_MAP_SELECT_A:
945 insn->opcodeType = XOPA_MAP;
946 return consume(insn, insn->opcode);
950 if (consume(insn, current))
951 return true;
953 if (current == 0x0f) {
954 LLVM_DEBUG(
955 dbgs() << format("Found a two-byte escape prefix (0x%hhx)", current));
956 if (consume(insn, current))
957 return true;
959 if (current == 0x38) {
960 LLVM_DEBUG(dbgs() << format("Found a three-byte escape prefix (0x%hhx)",
961 current));
962 if (consume(insn, current))
963 return true;
965 insn->opcodeType = THREEBYTE_38;
966 } else if (current == 0x3a) {
967 LLVM_DEBUG(dbgs() << format("Found a three-byte escape prefix (0x%hhx)",
968 current));
969 if (consume(insn, current))
970 return true;
972 insn->opcodeType = THREEBYTE_3A;
973 } else if (current == 0x0f) {
974 LLVM_DEBUG(
975 dbgs() << format("Found a 3dnow escape prefix (0x%hhx)", current));
977 // Consume operands before the opcode to comply with the 3DNow encoding
978 if (readModRM(insn))
979 return true;
981 if (consume(insn, current))
982 return true;
984 insn->opcodeType = THREEDNOW_MAP;
985 } else {
986 LLVM_DEBUG(dbgs() << "Didn't find a three-byte escape prefix");
987 insn->opcodeType = TWOBYTE;
989 } else if (insn->mandatoryPrefix)
990 // The opcode with mandatory prefix must start with opcode escape.
991 // If not it's legacy repeat prefix
992 insn->mandatoryPrefix = 0;
994 // At this point we have consumed the full opcode.
995 // Anything we consume from here on must be unconsumed.
996 insn->opcode = current;
998 return false;
1001 // Determine whether equiv is the 16-bit equivalent of orig (32-bit or 64-bit).
1002 static bool is16BitEquivalent(const char *orig, const char *equiv) {
1003 for (int i = 0;; i++) {
1004 if (orig[i] == '\0' && equiv[i] == '\0')
1005 return true;
1006 if (orig[i] == '\0' || equiv[i] == '\0')
1007 return false;
1008 if (orig[i] != equiv[i]) {
1009 if ((orig[i] == 'Q' || orig[i] == 'L') && equiv[i] == 'W')
1010 continue;
1011 if ((orig[i] == '6' || orig[i] == '3') && equiv[i] == '1')
1012 continue;
1013 if ((orig[i] == '4' || orig[i] == '2') && equiv[i] == '6')
1014 continue;
1015 return false;
1020 // Determine whether this instruction is a 64-bit instruction.
1021 static bool is64Bit(const char *name) {
1022 for (int i = 0;; ++i) {
1023 if (name[i] == '\0')
1024 return false;
1025 if (name[i] == '6' && name[i + 1] == '4')
1026 return true;
1030 // Determine the ID of an instruction, consuming the ModR/M byte as appropriate
1031 // for extended and escape opcodes, and using a supplied attribute mask.
1032 static int getInstructionIDWithAttrMask(uint16_t *instructionID,
1033 struct InternalInstruction *insn,
1034 uint16_t attrMask) {
1035 auto insnCtx = InstructionContext(x86DisassemblerContexts[attrMask]);
1036 const ContextDecision *decision;
1037 switch (insn->opcodeType) {
1038 case ONEBYTE:
1039 decision = &ONEBYTE_SYM;
1040 break;
1041 case TWOBYTE:
1042 decision = &TWOBYTE_SYM;
1043 break;
1044 case THREEBYTE_38:
1045 decision = &THREEBYTE38_SYM;
1046 break;
1047 case THREEBYTE_3A:
1048 decision = &THREEBYTE3A_SYM;
1049 break;
1050 case XOP8_MAP:
1051 decision = &XOP8_MAP_SYM;
1052 break;
1053 case XOP9_MAP:
1054 decision = &XOP9_MAP_SYM;
1055 break;
1056 case XOPA_MAP:
1057 decision = &XOPA_MAP_SYM;
1058 break;
1059 case THREEDNOW_MAP:
1060 decision = &THREEDNOW_MAP_SYM;
1061 break;
1062 case MAP5:
1063 decision = &MAP5_SYM;
1064 break;
1065 case MAP6:
1066 decision = &MAP6_SYM;
1067 break;
1068 case MAP7:
1069 decision = &MAP7_SYM;
1070 break;
1073 if (decision->opcodeDecisions[insnCtx]
1074 .modRMDecisions[insn->opcode]
1075 .modrm_type != MODRM_ONEENTRY) {
1076 if (readModRM(insn))
1077 return -1;
1078 *instructionID =
1079 decode(insn->opcodeType, insnCtx, insn->opcode, insn->modRM);
1080 } else {
1081 *instructionID = decode(insn->opcodeType, insnCtx, insn->opcode, 0);
1084 return 0;
1087 // Determine the ID of an instruction, consuming the ModR/M byte as appropriate
1088 // for extended and escape opcodes. Determines the attributes and context for
1089 // the instruction before doing so.
1090 static int getInstructionID(struct InternalInstruction *insn,
1091 const MCInstrInfo *mii) {
1092 uint16_t attrMask;
1093 uint16_t instructionID;
1095 LLVM_DEBUG(dbgs() << "getID()");
1097 attrMask = ATTR_NONE;
1099 if (insn->mode == MODE_64BIT)
1100 attrMask |= ATTR_64BIT;
1102 if (insn->vectorExtensionType != TYPE_NO_VEX_XOP) {
1103 attrMask |= (insn->vectorExtensionType == TYPE_EVEX) ? ATTR_EVEX : ATTR_VEX;
1105 if (insn->vectorExtensionType == TYPE_EVEX) {
1106 switch (ppFromEVEX3of4(insn->vectorExtensionPrefix[2])) {
1107 case VEX_PREFIX_66:
1108 attrMask |= ATTR_OPSIZE;
1109 break;
1110 case VEX_PREFIX_F3:
1111 attrMask |= ATTR_XS;
1112 break;
1113 case VEX_PREFIX_F2:
1114 attrMask |= ATTR_XD;
1115 break;
1118 if (zFromEVEX4of4(insn->vectorExtensionPrefix[3]))
1119 attrMask |= ATTR_EVEXKZ;
1120 if (bFromEVEX4of4(insn->vectorExtensionPrefix[3]))
1121 attrMask |= ATTR_EVEXB;
1122 if (aaaFromEVEX4of4(insn->vectorExtensionPrefix[3]))
1123 attrMask |= ATTR_EVEXK;
1124 if (lFromEVEX4of4(insn->vectorExtensionPrefix[3]))
1125 attrMask |= ATTR_VEXL;
1126 if (l2FromEVEX4of4(insn->vectorExtensionPrefix[3]))
1127 attrMask |= ATTR_EVEXL2;
1128 } else if (insn->vectorExtensionType == TYPE_VEX_3B) {
1129 switch (ppFromVEX3of3(insn->vectorExtensionPrefix[2])) {
1130 case VEX_PREFIX_66:
1131 attrMask |= ATTR_OPSIZE;
1132 break;
1133 case VEX_PREFIX_F3:
1134 attrMask |= ATTR_XS;
1135 break;
1136 case VEX_PREFIX_F2:
1137 attrMask |= ATTR_XD;
1138 break;
1141 if (lFromVEX3of3(insn->vectorExtensionPrefix[2]))
1142 attrMask |= ATTR_VEXL;
1143 } else if (insn->vectorExtensionType == TYPE_VEX_2B) {
1144 switch (ppFromVEX2of2(insn->vectorExtensionPrefix[1])) {
1145 case VEX_PREFIX_66:
1146 attrMask |= ATTR_OPSIZE;
1147 if (insn->hasAdSize)
1148 attrMask |= ATTR_ADSIZE;
1149 break;
1150 case VEX_PREFIX_F3:
1151 attrMask |= ATTR_XS;
1152 break;
1153 case VEX_PREFIX_F2:
1154 attrMask |= ATTR_XD;
1155 break;
1158 if (lFromVEX2of2(insn->vectorExtensionPrefix[1]))
1159 attrMask |= ATTR_VEXL;
1160 } else if (insn->vectorExtensionType == TYPE_XOP) {
1161 switch (ppFromXOP3of3(insn->vectorExtensionPrefix[2])) {
1162 case VEX_PREFIX_66:
1163 attrMask |= ATTR_OPSIZE;
1164 break;
1165 case VEX_PREFIX_F3:
1166 attrMask |= ATTR_XS;
1167 break;
1168 case VEX_PREFIX_F2:
1169 attrMask |= ATTR_XD;
1170 break;
1173 if (lFromXOP3of3(insn->vectorExtensionPrefix[2]))
1174 attrMask |= ATTR_VEXL;
1175 } else {
1176 return -1;
1178 } else if (!insn->mandatoryPrefix) {
1179 // If we don't have mandatory prefix we should use legacy prefixes here
1180 if (insn->hasOpSize && (insn->mode != MODE_16BIT))
1181 attrMask |= ATTR_OPSIZE;
1182 if (insn->hasAdSize)
1183 attrMask |= ATTR_ADSIZE;
1184 if (insn->opcodeType == ONEBYTE) {
1185 if (insn->repeatPrefix == 0xf3 && (insn->opcode == 0x90))
1186 // Special support for PAUSE
1187 attrMask |= ATTR_XS;
1188 } else {
1189 if (insn->repeatPrefix == 0xf2)
1190 attrMask |= ATTR_XD;
1191 else if (insn->repeatPrefix == 0xf3)
1192 attrMask |= ATTR_XS;
1194 } else {
1195 switch (insn->mandatoryPrefix) {
1196 case 0xf2:
1197 attrMask |= ATTR_XD;
1198 break;
1199 case 0xf3:
1200 attrMask |= ATTR_XS;
1201 break;
1202 case 0x66:
1203 if (insn->mode != MODE_16BIT)
1204 attrMask |= ATTR_OPSIZE;
1205 if (insn->hasAdSize)
1206 attrMask |= ATTR_ADSIZE;
1207 break;
1208 case 0x67:
1209 attrMask |= ATTR_ADSIZE;
1210 break;
1214 if (insn->rexPrefix & 0x08) {
1215 attrMask |= ATTR_REXW;
1216 attrMask &= ~ATTR_ADSIZE;
1219 if (insn->mode == MODE_16BIT) {
1220 // JCXZ/JECXZ need special handling for 16-bit mode because the meaning
1221 // of the AdSize prefix is inverted w.r.t. 32-bit mode.
1222 if (insn->opcodeType == ONEBYTE && insn->opcode == 0xE3)
1223 attrMask ^= ATTR_ADSIZE;
1224 // If we're in 16-bit mode and this is one of the relative jumps and opsize
1225 // prefix isn't present, we need to force the opsize attribute since the
1226 // prefix is inverted relative to 32-bit mode.
1227 if (!insn->hasOpSize && insn->opcodeType == ONEBYTE &&
1228 (insn->opcode == 0xE8 || insn->opcode == 0xE9))
1229 attrMask |= ATTR_OPSIZE;
1231 if (!insn->hasOpSize && insn->opcodeType == TWOBYTE &&
1232 insn->opcode >= 0x80 && insn->opcode <= 0x8F)
1233 attrMask |= ATTR_OPSIZE;
1237 if (getInstructionIDWithAttrMask(&instructionID, insn, attrMask))
1238 return -1;
1240 // The following clauses compensate for limitations of the tables.
1242 if (insn->mode != MODE_64BIT &&
1243 insn->vectorExtensionType != TYPE_NO_VEX_XOP) {
1244 // The tables can't distinquish between cases where the W-bit is used to
1245 // select register size and cases where its a required part of the opcode.
1246 if ((insn->vectorExtensionType == TYPE_EVEX &&
1247 wFromEVEX3of4(insn->vectorExtensionPrefix[2])) ||
1248 (insn->vectorExtensionType == TYPE_VEX_3B &&
1249 wFromVEX3of3(insn->vectorExtensionPrefix[2])) ||
1250 (insn->vectorExtensionType == TYPE_XOP &&
1251 wFromXOP3of3(insn->vectorExtensionPrefix[2]))) {
1253 uint16_t instructionIDWithREXW;
1254 if (getInstructionIDWithAttrMask(&instructionIDWithREXW, insn,
1255 attrMask | ATTR_REXW)) {
1256 insn->instructionID = instructionID;
1257 insn->spec = &INSTRUCTIONS_SYM[instructionID];
1258 return 0;
1261 auto SpecName = mii->getName(instructionIDWithREXW);
1262 // If not a 64-bit instruction. Switch the opcode.
1263 if (!is64Bit(SpecName.data())) {
1264 insn->instructionID = instructionIDWithREXW;
1265 insn->spec = &INSTRUCTIONS_SYM[instructionIDWithREXW];
1266 return 0;
1271 // Absolute moves, umonitor, and movdir64b need special handling.
1272 // -For 16-bit mode because the meaning of the AdSize and OpSize prefixes are
1273 // inverted w.r.t.
1274 // -For 32-bit mode we need to ensure the ADSIZE prefix is observed in
1275 // any position.
1276 if ((insn->opcodeType == ONEBYTE && ((insn->opcode & 0xFC) == 0xA0)) ||
1277 (insn->opcodeType == TWOBYTE && (insn->opcode == 0xAE)) ||
1278 (insn->opcodeType == THREEBYTE_38 && insn->opcode == 0xF8)) {
1279 // Make sure we observed the prefixes in any position.
1280 if (insn->hasAdSize)
1281 attrMask |= ATTR_ADSIZE;
1282 if (insn->hasOpSize)
1283 attrMask |= ATTR_OPSIZE;
1285 // In 16-bit, invert the attributes.
1286 if (insn->mode == MODE_16BIT) {
1287 attrMask ^= ATTR_ADSIZE;
1289 // The OpSize attribute is only valid with the absolute moves.
1290 if (insn->opcodeType == ONEBYTE && ((insn->opcode & 0xFC) == 0xA0))
1291 attrMask ^= ATTR_OPSIZE;
1294 if (getInstructionIDWithAttrMask(&instructionID, insn, attrMask))
1295 return -1;
1297 insn->instructionID = instructionID;
1298 insn->spec = &INSTRUCTIONS_SYM[instructionID];
1299 return 0;
1302 if ((insn->mode == MODE_16BIT || insn->hasOpSize) &&
1303 !(attrMask & ATTR_OPSIZE)) {
1304 // The instruction tables make no distinction between instructions that
1305 // allow OpSize anywhere (i.e., 16-bit operations) and that need it in a
1306 // particular spot (i.e., many MMX operations). In general we're
1307 // conservative, but in the specific case where OpSize is present but not in
1308 // the right place we check if there's a 16-bit operation.
1309 const struct InstructionSpecifier *spec;
1310 uint16_t instructionIDWithOpsize;
1311 llvm::StringRef specName, specWithOpSizeName;
1313 spec = &INSTRUCTIONS_SYM[instructionID];
1315 if (getInstructionIDWithAttrMask(&instructionIDWithOpsize, insn,
1316 attrMask | ATTR_OPSIZE)) {
1317 // ModRM required with OpSize but not present. Give up and return the
1318 // version without OpSize set.
1319 insn->instructionID = instructionID;
1320 insn->spec = spec;
1321 return 0;
1324 specName = mii->getName(instructionID);
1325 specWithOpSizeName = mii->getName(instructionIDWithOpsize);
1327 if (is16BitEquivalent(specName.data(), specWithOpSizeName.data()) &&
1328 (insn->mode == MODE_16BIT) ^ insn->hasOpSize) {
1329 insn->instructionID = instructionIDWithOpsize;
1330 insn->spec = &INSTRUCTIONS_SYM[instructionIDWithOpsize];
1331 } else {
1332 insn->instructionID = instructionID;
1333 insn->spec = spec;
1335 return 0;
1338 if (insn->opcodeType == ONEBYTE && insn->opcode == 0x90 &&
1339 insn->rexPrefix & 0x01) {
1340 // NOOP shouldn't decode as NOOP if REX.b is set. Instead it should decode
1341 // as XCHG %r8, %eax.
1342 const struct InstructionSpecifier *spec;
1343 uint16_t instructionIDWithNewOpcode;
1344 const struct InstructionSpecifier *specWithNewOpcode;
1346 spec = &INSTRUCTIONS_SYM[instructionID];
1348 // Borrow opcode from one of the other XCHGar opcodes
1349 insn->opcode = 0x91;
1351 if (getInstructionIDWithAttrMask(&instructionIDWithNewOpcode, insn,
1352 attrMask)) {
1353 insn->opcode = 0x90;
1355 insn->instructionID = instructionID;
1356 insn->spec = spec;
1357 return 0;
1360 specWithNewOpcode = &INSTRUCTIONS_SYM[instructionIDWithNewOpcode];
1362 // Change back
1363 insn->opcode = 0x90;
1365 insn->instructionID = instructionIDWithNewOpcode;
1366 insn->spec = specWithNewOpcode;
1368 return 0;
1371 insn->instructionID = instructionID;
1372 insn->spec = &INSTRUCTIONS_SYM[insn->instructionID];
1374 return 0;
1377 // Read an operand from the opcode field of an instruction and interprets it
1378 // appropriately given the operand width. Handles AddRegFrm instructions.
1380 // @param insn - the instruction whose opcode field is to be read.
1381 // @param size - The width (in bytes) of the register being specified.
1382 // 1 means AL and friends, 2 means AX, 4 means EAX, and 8 means
1383 // RAX.
1384 // @return - 0 on success; nonzero otherwise.
1385 static int readOpcodeRegister(struct InternalInstruction *insn, uint8_t size) {
1386 LLVM_DEBUG(dbgs() << "readOpcodeRegister()");
1388 if (size == 0)
1389 size = insn->registerSize;
1391 switch (size) {
1392 case 1:
1393 insn->opcodeRegister = (Reg)(
1394 MODRM_REG_AL + ((bFromREX(insn->rexPrefix) << 3) | (insn->opcode & 7)));
1395 if (insn->rexPrefix && insn->opcodeRegister >= MODRM_REG_AL + 0x4 &&
1396 insn->opcodeRegister < MODRM_REG_AL + 0x8) {
1397 insn->opcodeRegister =
1398 (Reg)(MODRM_REG_SPL + (insn->opcodeRegister - MODRM_REG_AL - 4));
1401 break;
1402 case 2:
1403 insn->opcodeRegister = (Reg)(
1404 MODRM_REG_AX + ((bFromREX(insn->rexPrefix) << 3) | (insn->opcode & 7)));
1405 break;
1406 case 4:
1407 insn->opcodeRegister =
1408 (Reg)(MODRM_REG_EAX +
1409 ((bFromREX(insn->rexPrefix) << 3) | (insn->opcode & 7)));
1410 break;
1411 case 8:
1412 insn->opcodeRegister =
1413 (Reg)(MODRM_REG_RAX +
1414 ((bFromREX(insn->rexPrefix) << 3) | (insn->opcode & 7)));
1415 break;
1418 return 0;
1421 // Consume an immediate operand from an instruction, given the desired operand
1422 // size.
1424 // @param insn - The instruction whose operand is to be read.
1425 // @param size - The width (in bytes) of the operand.
1426 // @return - 0 if the immediate was successfully consumed; nonzero
1427 // otherwise.
1428 static int readImmediate(struct InternalInstruction *insn, uint8_t size) {
1429 uint8_t imm8;
1430 uint16_t imm16;
1431 uint32_t imm32;
1432 uint64_t imm64;
1434 LLVM_DEBUG(dbgs() << "readImmediate()");
1436 assert(insn->numImmediatesConsumed < 2 && "Already consumed two immediates");
1438 insn->immediateSize = size;
1439 insn->immediateOffset = insn->readerCursor - insn->startLocation;
1441 switch (size) {
1442 case 1:
1443 if (consume(insn, imm8))
1444 return -1;
1445 insn->immediates[insn->numImmediatesConsumed] = imm8;
1446 break;
1447 case 2:
1448 if (consume(insn, imm16))
1449 return -1;
1450 insn->immediates[insn->numImmediatesConsumed] = imm16;
1451 break;
1452 case 4:
1453 if (consume(insn, imm32))
1454 return -1;
1455 insn->immediates[insn->numImmediatesConsumed] = imm32;
1456 break;
1457 case 8:
1458 if (consume(insn, imm64))
1459 return -1;
1460 insn->immediates[insn->numImmediatesConsumed] = imm64;
1461 break;
1462 default:
1463 llvm_unreachable("invalid size");
1466 insn->numImmediatesConsumed++;
1468 return 0;
1471 // Consume vvvv from an instruction if it has a VEX prefix.
1472 static int readVVVV(struct InternalInstruction *insn) {
1473 LLVM_DEBUG(dbgs() << "readVVVV()");
1475 int vvvv;
1476 if (insn->vectorExtensionType == TYPE_EVEX)
1477 vvvv = (v2FromEVEX4of4(insn->vectorExtensionPrefix[3]) << 4 |
1478 vvvvFromEVEX3of4(insn->vectorExtensionPrefix[2]));
1479 else if (insn->vectorExtensionType == TYPE_VEX_3B)
1480 vvvv = vvvvFromVEX3of3(insn->vectorExtensionPrefix[2]);
1481 else if (insn->vectorExtensionType == TYPE_VEX_2B)
1482 vvvv = vvvvFromVEX2of2(insn->vectorExtensionPrefix[1]);
1483 else if (insn->vectorExtensionType == TYPE_XOP)
1484 vvvv = vvvvFromXOP3of3(insn->vectorExtensionPrefix[2]);
1485 else
1486 return -1;
1488 if (insn->mode != MODE_64BIT)
1489 vvvv &= 0xf; // Can only clear bit 4. Bit 3 must be cleared later.
1491 insn->vvvv = static_cast<Reg>(vvvv);
1492 return 0;
1495 // Read an mask register from the opcode field of an instruction.
1497 // @param insn - The instruction whose opcode field is to be read.
1498 // @return - 0 on success; nonzero otherwise.
1499 static int readMaskRegister(struct InternalInstruction *insn) {
1500 LLVM_DEBUG(dbgs() << "readMaskRegister()");
1502 if (insn->vectorExtensionType != TYPE_EVEX)
1503 return -1;
1505 insn->writemask =
1506 static_cast<Reg>(aaaFromEVEX4of4(insn->vectorExtensionPrefix[3]));
1507 return 0;
1510 // Consults the specifier for an instruction and consumes all
1511 // operands for that instruction, interpreting them as it goes.
1512 static int readOperands(struct InternalInstruction *insn) {
1513 int hasVVVV, needVVVV;
1514 int sawRegImm = 0;
1516 LLVM_DEBUG(dbgs() << "readOperands()");
1518 // If non-zero vvvv specified, make sure one of the operands uses it.
1519 hasVVVV = !readVVVV(insn);
1520 needVVVV = hasVVVV && (insn->vvvv != 0);
1522 for (const auto &Op : x86OperandSets[insn->spec->operands]) {
1523 switch (Op.encoding) {
1524 case ENCODING_NONE:
1525 case ENCODING_SI:
1526 case ENCODING_DI:
1527 break;
1528 CASE_ENCODING_VSIB:
1529 // VSIB can use the V2 bit so check only the other bits.
1530 if (needVVVV)
1531 needVVVV = hasVVVV & ((insn->vvvv & 0xf) != 0);
1532 if (readModRM(insn))
1533 return -1;
1535 // Reject if SIB wasn't used.
1536 if (insn->eaBase != EA_BASE_sib && insn->eaBase != EA_BASE_sib64)
1537 return -1;
1539 // If sibIndex was set to SIB_INDEX_NONE, index offset is 4.
1540 if (insn->sibIndex == SIB_INDEX_NONE)
1541 insn->sibIndex = (SIBIndex)(insn->sibIndexBase + 4);
1543 // If EVEX.v2 is set this is one of the 16-31 registers.
1544 if (insn->vectorExtensionType == TYPE_EVEX && insn->mode == MODE_64BIT &&
1545 v2FromEVEX4of4(insn->vectorExtensionPrefix[3]))
1546 insn->sibIndex = (SIBIndex)(insn->sibIndex + 16);
1548 // Adjust the index register to the correct size.
1549 switch ((OperandType)Op.type) {
1550 default:
1551 debug("Unhandled VSIB index type");
1552 return -1;
1553 case TYPE_MVSIBX:
1554 insn->sibIndex =
1555 (SIBIndex)(SIB_INDEX_XMM0 + (insn->sibIndex - insn->sibIndexBase));
1556 break;
1557 case TYPE_MVSIBY:
1558 insn->sibIndex =
1559 (SIBIndex)(SIB_INDEX_YMM0 + (insn->sibIndex - insn->sibIndexBase));
1560 break;
1561 case TYPE_MVSIBZ:
1562 insn->sibIndex =
1563 (SIBIndex)(SIB_INDEX_ZMM0 + (insn->sibIndex - insn->sibIndexBase));
1564 break;
1567 // Apply the AVX512 compressed displacement scaling factor.
1568 if (Op.encoding != ENCODING_REG && insn->eaDisplacement == EA_DISP_8)
1569 insn->displacement *= 1 << (Op.encoding - ENCODING_VSIB);
1570 break;
1571 case ENCODING_SIB:
1572 // Reject if SIB wasn't used.
1573 if (insn->eaBase != EA_BASE_sib && insn->eaBase != EA_BASE_sib64)
1574 return -1;
1575 if (readModRM(insn))
1576 return -1;
1577 if (fixupReg(insn, &Op))
1578 return -1;
1579 break;
1580 case ENCODING_REG:
1581 CASE_ENCODING_RM:
1582 if (readModRM(insn))
1583 return -1;
1584 if (fixupReg(insn, &Op))
1585 return -1;
1586 // Apply the AVX512 compressed displacement scaling factor.
1587 if (Op.encoding != ENCODING_REG && insn->eaDisplacement == EA_DISP_8)
1588 insn->displacement *= 1 << (Op.encoding - ENCODING_RM);
1589 break;
1590 case ENCODING_IB:
1591 if (sawRegImm) {
1592 // Saw a register immediate so don't read again and instead split the
1593 // previous immediate. FIXME: This is a hack.
1594 insn->immediates[insn->numImmediatesConsumed] =
1595 insn->immediates[insn->numImmediatesConsumed - 1] & 0xf;
1596 ++insn->numImmediatesConsumed;
1597 break;
1599 if (readImmediate(insn, 1))
1600 return -1;
1601 if (Op.type == TYPE_XMM || Op.type == TYPE_YMM)
1602 sawRegImm = 1;
1603 break;
1604 case ENCODING_IW:
1605 if (readImmediate(insn, 2))
1606 return -1;
1607 break;
1608 case ENCODING_ID:
1609 if (readImmediate(insn, 4))
1610 return -1;
1611 break;
1612 case ENCODING_IO:
1613 if (readImmediate(insn, 8))
1614 return -1;
1615 break;
1616 case ENCODING_Iv:
1617 if (readImmediate(insn, insn->immediateSize))
1618 return -1;
1619 break;
1620 case ENCODING_Ia:
1621 if (readImmediate(insn, insn->addressSize))
1622 return -1;
1623 break;
1624 case ENCODING_IRC:
1625 insn->RC = (l2FromEVEX4of4(insn->vectorExtensionPrefix[3]) << 1) |
1626 lFromEVEX4of4(insn->vectorExtensionPrefix[3]);
1627 break;
1628 case ENCODING_RB:
1629 if (readOpcodeRegister(insn, 1))
1630 return -1;
1631 break;
1632 case ENCODING_RW:
1633 if (readOpcodeRegister(insn, 2))
1634 return -1;
1635 break;
1636 case ENCODING_RD:
1637 if (readOpcodeRegister(insn, 4))
1638 return -1;
1639 break;
1640 case ENCODING_RO:
1641 if (readOpcodeRegister(insn, 8))
1642 return -1;
1643 break;
1644 case ENCODING_Rv:
1645 if (readOpcodeRegister(insn, 0))
1646 return -1;
1647 break;
1648 case ENCODING_CC:
1649 insn->immediates[1] = insn->opcode & 0xf;
1650 break;
1651 case ENCODING_FP:
1652 break;
1653 case ENCODING_VVVV:
1654 needVVVV = 0; // Mark that we have found a VVVV operand.
1655 if (!hasVVVV)
1656 return -1;
1657 if (insn->mode != MODE_64BIT)
1658 insn->vvvv = static_cast<Reg>(insn->vvvv & 0x7);
1659 if (fixupReg(insn, &Op))
1660 return -1;
1661 break;
1662 case ENCODING_WRITEMASK:
1663 if (readMaskRegister(insn))
1664 return -1;
1665 break;
1666 case ENCODING_DUP:
1667 break;
1668 default:
1669 LLVM_DEBUG(dbgs() << "Encountered an operand with an unknown encoding.");
1670 return -1;
1674 // If we didn't find ENCODING_VVVV operand, but non-zero vvvv present, fail
1675 if (needVVVV)
1676 return -1;
1678 return 0;
1681 namespace llvm {
1683 // Fill-ins to make the compiler happy. These constants are never actually
1684 // assigned; they are just filler to make an automatically-generated switch
1685 // statement work.
1686 namespace X86 {
1687 enum {
1688 BX_SI = 500,
1689 BX_DI = 501,
1690 BP_SI = 502,
1691 BP_DI = 503,
1692 sib = 504,
1693 sib64 = 505
1695 } // namespace X86
1697 } // namespace llvm
1699 static bool translateInstruction(MCInst &target,
1700 InternalInstruction &source,
1701 const MCDisassembler *Dis);
1703 namespace {
1705 /// Generic disassembler for all X86 platforms. All each platform class should
1706 /// have to do is subclass the constructor, and provide a different
1707 /// disassemblerMode value.
1708 class X86GenericDisassembler : public MCDisassembler {
1709 std::unique_ptr<const MCInstrInfo> MII;
1710 public:
1711 X86GenericDisassembler(const MCSubtargetInfo &STI, MCContext &Ctx,
1712 std::unique_ptr<const MCInstrInfo> MII);
1713 public:
1714 DecodeStatus getInstruction(MCInst &instr, uint64_t &size,
1715 ArrayRef<uint8_t> Bytes, uint64_t Address,
1716 raw_ostream &cStream) const override;
1718 private:
1719 DisassemblerMode fMode;
1722 } // namespace
1724 X86GenericDisassembler::X86GenericDisassembler(
1725 const MCSubtargetInfo &STI,
1726 MCContext &Ctx,
1727 std::unique_ptr<const MCInstrInfo> MII)
1728 : MCDisassembler(STI, Ctx), MII(std::move(MII)) {
1729 const FeatureBitset &FB = STI.getFeatureBits();
1730 if (FB[X86::Is16Bit]) {
1731 fMode = MODE_16BIT;
1732 return;
1733 } else if (FB[X86::Is32Bit]) {
1734 fMode = MODE_32BIT;
1735 return;
1736 } else if (FB[X86::Is64Bit]) {
1737 fMode = MODE_64BIT;
1738 return;
1741 llvm_unreachable("Invalid CPU mode");
1744 MCDisassembler::DecodeStatus X86GenericDisassembler::getInstruction(
1745 MCInst &Instr, uint64_t &Size, ArrayRef<uint8_t> Bytes, uint64_t Address,
1746 raw_ostream &CStream) const {
1747 CommentStream = &CStream;
1749 InternalInstruction Insn;
1750 memset(&Insn, 0, sizeof(InternalInstruction));
1751 Insn.bytes = Bytes;
1752 Insn.startLocation = Address;
1753 Insn.readerCursor = Address;
1754 Insn.mode = fMode;
1756 if (Bytes.empty() || readPrefixes(&Insn) || readOpcode(&Insn) ||
1757 getInstructionID(&Insn, MII.get()) || Insn.instructionID == 0 ||
1758 readOperands(&Insn)) {
1759 Size = Insn.readerCursor - Address;
1760 return Fail;
1763 Insn.operands = x86OperandSets[Insn.spec->operands];
1764 Insn.length = Insn.readerCursor - Insn.startLocation;
1765 Size = Insn.length;
1766 if (Size > 15)
1767 LLVM_DEBUG(dbgs() << "Instruction exceeds 15-byte limit");
1769 bool Ret = translateInstruction(Instr, Insn, this);
1770 if (!Ret) {
1771 unsigned Flags = X86::IP_NO_PREFIX;
1772 if (Insn.hasAdSize)
1773 Flags |= X86::IP_HAS_AD_SIZE;
1774 if (!Insn.mandatoryPrefix) {
1775 if (Insn.hasOpSize)
1776 Flags |= X86::IP_HAS_OP_SIZE;
1777 if (Insn.repeatPrefix == 0xf2)
1778 Flags |= X86::IP_HAS_REPEAT_NE;
1779 else if (Insn.repeatPrefix == 0xf3 &&
1780 // It should not be 'pause' f3 90
1781 Insn.opcode != 0x90)
1782 Flags |= X86::IP_HAS_REPEAT;
1783 if (Insn.hasLockPrefix)
1784 Flags |= X86::IP_HAS_LOCK;
1786 Instr.setFlags(Flags);
1788 return (!Ret) ? Success : Fail;
1792 // Private code that translates from struct InternalInstructions to MCInsts.
1795 /// translateRegister - Translates an internal register to the appropriate LLVM
1796 /// register, and appends it as an operand to an MCInst.
1798 /// @param mcInst - The MCInst to append to.
1799 /// @param reg - The Reg to append.
1800 static void translateRegister(MCInst &mcInst, Reg reg) {
1801 #define ENTRY(x) X86::x,
1802 static constexpr MCPhysReg llvmRegnums[] = {ALL_REGS};
1803 #undef ENTRY
1805 MCPhysReg llvmRegnum = llvmRegnums[reg];
1806 mcInst.addOperand(MCOperand::createReg(llvmRegnum));
1809 static const uint8_t segmentRegnums[SEG_OVERRIDE_max] = {
1810 0, // SEG_OVERRIDE_NONE
1811 X86::CS,
1812 X86::SS,
1813 X86::DS,
1814 X86::ES,
1815 X86::FS,
1816 X86::GS
1819 /// translateSrcIndex - Appends a source index operand to an MCInst.
1821 /// @param mcInst - The MCInst to append to.
1822 /// @param insn - The internal instruction.
1823 static bool translateSrcIndex(MCInst &mcInst, InternalInstruction &insn) {
1824 unsigned baseRegNo;
1826 if (insn.mode == MODE_64BIT)
1827 baseRegNo = insn.hasAdSize ? X86::ESI : X86::RSI;
1828 else if (insn.mode == MODE_32BIT)
1829 baseRegNo = insn.hasAdSize ? X86::SI : X86::ESI;
1830 else {
1831 assert(insn.mode == MODE_16BIT);
1832 baseRegNo = insn.hasAdSize ? X86::ESI : X86::SI;
1834 MCOperand baseReg = MCOperand::createReg(baseRegNo);
1835 mcInst.addOperand(baseReg);
1837 MCOperand segmentReg;
1838 segmentReg = MCOperand::createReg(segmentRegnums[insn.segmentOverride]);
1839 mcInst.addOperand(segmentReg);
1840 return false;
1843 /// translateDstIndex - Appends a destination index operand to an MCInst.
1845 /// @param mcInst - The MCInst to append to.
1846 /// @param insn - The internal instruction.
1848 static bool translateDstIndex(MCInst &mcInst, InternalInstruction &insn) {
1849 unsigned baseRegNo;
1851 if (insn.mode == MODE_64BIT)
1852 baseRegNo = insn.hasAdSize ? X86::EDI : X86::RDI;
1853 else if (insn.mode == MODE_32BIT)
1854 baseRegNo = insn.hasAdSize ? X86::DI : X86::EDI;
1855 else {
1856 assert(insn.mode == MODE_16BIT);
1857 baseRegNo = insn.hasAdSize ? X86::EDI : X86::DI;
1859 MCOperand baseReg = MCOperand::createReg(baseRegNo);
1860 mcInst.addOperand(baseReg);
1861 return false;
1864 /// translateImmediate - Appends an immediate operand to an MCInst.
1866 /// @param mcInst - The MCInst to append to.
1867 /// @param immediate - The immediate value to append.
1868 /// @param operand - The operand, as stored in the descriptor table.
1869 /// @param insn - The internal instruction.
1870 static void translateImmediate(MCInst &mcInst, uint64_t immediate,
1871 const OperandSpecifier &operand,
1872 InternalInstruction &insn,
1873 const MCDisassembler *Dis) {
1874 // Sign-extend the immediate if necessary.
1876 OperandType type = (OperandType)operand.type;
1878 bool isBranch = false;
1879 uint64_t pcrel = 0;
1880 if (type == TYPE_REL) {
1881 isBranch = true;
1882 pcrel = insn.startLocation + insn.length;
1883 switch (operand.encoding) {
1884 default:
1885 break;
1886 case ENCODING_Iv:
1887 switch (insn.displacementSize) {
1888 default:
1889 break;
1890 case 1:
1891 if(immediate & 0x80)
1892 immediate |= ~(0xffull);
1893 break;
1894 case 2:
1895 if(immediate & 0x8000)
1896 immediate |= ~(0xffffull);
1897 break;
1898 case 4:
1899 if(immediate & 0x80000000)
1900 immediate |= ~(0xffffffffull);
1901 break;
1902 case 8:
1903 break;
1905 break;
1906 case ENCODING_IB:
1907 if(immediate & 0x80)
1908 immediate |= ~(0xffull);
1909 break;
1910 case ENCODING_IW:
1911 if(immediate & 0x8000)
1912 immediate |= ~(0xffffull);
1913 break;
1914 case ENCODING_ID:
1915 if(immediate & 0x80000000)
1916 immediate |= ~(0xffffffffull);
1917 break;
1920 // By default sign-extend all X86 immediates based on their encoding.
1921 else if (type == TYPE_IMM) {
1922 switch (operand.encoding) {
1923 default:
1924 break;
1925 case ENCODING_IB:
1926 if(immediate & 0x80)
1927 immediate |= ~(0xffull);
1928 break;
1929 case ENCODING_IW:
1930 if(immediate & 0x8000)
1931 immediate |= ~(0xffffull);
1932 break;
1933 case ENCODING_ID:
1934 if(immediate & 0x80000000)
1935 immediate |= ~(0xffffffffull);
1936 break;
1937 case ENCODING_IO:
1938 break;
1942 switch (type) {
1943 case TYPE_XMM:
1944 mcInst.addOperand(MCOperand::createReg(X86::XMM0 + (immediate >> 4)));
1945 return;
1946 case TYPE_YMM:
1947 mcInst.addOperand(MCOperand::createReg(X86::YMM0 + (immediate >> 4)));
1948 return;
1949 case TYPE_ZMM:
1950 mcInst.addOperand(MCOperand::createReg(X86::ZMM0 + (immediate >> 4)));
1951 return;
1952 default:
1953 // operand is 64 bits wide. Do nothing.
1954 break;
1957 if (!Dis->tryAddingSymbolicOperand(
1958 mcInst, immediate + pcrel, insn.startLocation, isBranch,
1959 insn.immediateOffset, insn.immediateSize, insn.length))
1960 mcInst.addOperand(MCOperand::createImm(immediate));
1962 if (type == TYPE_MOFFS) {
1963 MCOperand segmentReg;
1964 segmentReg = MCOperand::createReg(segmentRegnums[insn.segmentOverride]);
1965 mcInst.addOperand(segmentReg);
1969 /// translateRMRegister - Translates a register stored in the R/M field of the
1970 /// ModR/M byte to its LLVM equivalent and appends it to an MCInst.
1971 /// @param mcInst - The MCInst to append to.
1972 /// @param insn - The internal instruction to extract the R/M field
1973 /// from.
1974 /// @return - 0 on success; -1 otherwise
1975 static bool translateRMRegister(MCInst &mcInst,
1976 InternalInstruction &insn) {
1977 if (insn.eaBase == EA_BASE_sib || insn.eaBase == EA_BASE_sib64) {
1978 debug("A R/M register operand may not have a SIB byte");
1979 return true;
1982 switch (insn.eaBase) {
1983 default:
1984 debug("Unexpected EA base register");
1985 return true;
1986 case EA_BASE_NONE:
1987 debug("EA_BASE_NONE for ModR/M base");
1988 return true;
1989 #define ENTRY(x) case EA_BASE_##x:
1990 ALL_EA_BASES
1991 #undef ENTRY
1992 debug("A R/M register operand may not have a base; "
1993 "the operand must be a register.");
1994 return true;
1995 #define ENTRY(x) \
1996 case EA_REG_##x: \
1997 mcInst.addOperand(MCOperand::createReg(X86::x)); break;
1998 ALL_REGS
1999 #undef ENTRY
2002 return false;
2005 /// translateRMMemory - Translates a memory operand stored in the Mod and R/M
2006 /// fields of an internal instruction (and possibly its SIB byte) to a memory
2007 /// operand in LLVM's format, and appends it to an MCInst.
2009 /// @param mcInst - The MCInst to append to.
2010 /// @param insn - The instruction to extract Mod, R/M, and SIB fields
2011 /// from.
2012 /// @param ForceSIB - The instruction must use SIB.
2013 /// @return - 0 on success; nonzero otherwise
2014 static bool translateRMMemory(MCInst &mcInst, InternalInstruction &insn,
2015 const MCDisassembler *Dis,
2016 bool ForceSIB = false) {
2017 // Addresses in an MCInst are represented as five operands:
2018 // 1. basereg (register) The R/M base, or (if there is a SIB) the
2019 // SIB base
2020 // 2. scaleamount (immediate) 1, or (if there is a SIB) the specified
2021 // scale amount
2022 // 3. indexreg (register) x86_registerNONE, or (if there is a SIB)
2023 // the index (which is multiplied by the
2024 // scale amount)
2025 // 4. displacement (immediate) 0, or the displacement if there is one
2026 // 5. segmentreg (register) x86_registerNONE for now, but could be set
2027 // if we have segment overrides
2029 MCOperand baseReg;
2030 MCOperand scaleAmount;
2031 MCOperand indexReg;
2032 MCOperand displacement;
2033 MCOperand segmentReg;
2034 uint64_t pcrel = 0;
2036 if (insn.eaBase == EA_BASE_sib || insn.eaBase == EA_BASE_sib64) {
2037 if (insn.sibBase != SIB_BASE_NONE) {
2038 switch (insn.sibBase) {
2039 default:
2040 debug("Unexpected sibBase");
2041 return true;
2042 #define ENTRY(x) \
2043 case SIB_BASE_##x: \
2044 baseReg = MCOperand::createReg(X86::x); break;
2045 ALL_SIB_BASES
2046 #undef ENTRY
2048 } else {
2049 baseReg = MCOperand::createReg(X86::NoRegister);
2052 if (insn.sibIndex != SIB_INDEX_NONE) {
2053 switch (insn.sibIndex) {
2054 default:
2055 debug("Unexpected sibIndex");
2056 return true;
2057 #define ENTRY(x) \
2058 case SIB_INDEX_##x: \
2059 indexReg = MCOperand::createReg(X86::x); break;
2060 EA_BASES_32BIT
2061 EA_BASES_64BIT
2062 REGS_XMM
2063 REGS_YMM
2064 REGS_ZMM
2065 #undef ENTRY
2067 } else {
2068 // Use EIZ/RIZ for a few ambiguous cases where the SIB byte is present,
2069 // but no index is used and modrm alone should have been enough.
2070 // -No base register in 32-bit mode. In 64-bit mode this is used to
2071 // avoid rip-relative addressing.
2072 // -Any base register used other than ESP/RSP/R12D/R12. Using these as a
2073 // base always requires a SIB byte.
2074 // -A scale other than 1 is used.
2075 if (!ForceSIB &&
2076 (insn.sibScale != 1 ||
2077 (insn.sibBase == SIB_BASE_NONE && insn.mode != MODE_64BIT) ||
2078 (insn.sibBase != SIB_BASE_NONE &&
2079 insn.sibBase != SIB_BASE_ESP && insn.sibBase != SIB_BASE_RSP &&
2080 insn.sibBase != SIB_BASE_R12D && insn.sibBase != SIB_BASE_R12))) {
2081 indexReg = MCOperand::createReg(insn.addressSize == 4 ? X86::EIZ :
2082 X86::RIZ);
2083 } else
2084 indexReg = MCOperand::createReg(X86::NoRegister);
2087 scaleAmount = MCOperand::createImm(insn.sibScale);
2088 } else {
2089 switch (insn.eaBase) {
2090 case EA_BASE_NONE:
2091 if (insn.eaDisplacement == EA_DISP_NONE) {
2092 debug("EA_BASE_NONE and EA_DISP_NONE for ModR/M base");
2093 return true;
2095 if (insn.mode == MODE_64BIT){
2096 pcrel = insn.startLocation + insn.length;
2097 Dis->tryAddingPcLoadReferenceComment(insn.displacement + pcrel,
2098 insn.startLocation +
2099 insn.displacementOffset);
2100 // Section 2.2.1.6
2101 baseReg = MCOperand::createReg(insn.addressSize == 4 ? X86::EIP :
2102 X86::RIP);
2104 else
2105 baseReg = MCOperand::createReg(X86::NoRegister);
2107 indexReg = MCOperand::createReg(X86::NoRegister);
2108 break;
2109 case EA_BASE_BX_SI:
2110 baseReg = MCOperand::createReg(X86::BX);
2111 indexReg = MCOperand::createReg(X86::SI);
2112 break;
2113 case EA_BASE_BX_DI:
2114 baseReg = MCOperand::createReg(X86::BX);
2115 indexReg = MCOperand::createReg(X86::DI);
2116 break;
2117 case EA_BASE_BP_SI:
2118 baseReg = MCOperand::createReg(X86::BP);
2119 indexReg = MCOperand::createReg(X86::SI);
2120 break;
2121 case EA_BASE_BP_DI:
2122 baseReg = MCOperand::createReg(X86::BP);
2123 indexReg = MCOperand::createReg(X86::DI);
2124 break;
2125 default:
2126 indexReg = MCOperand::createReg(X86::NoRegister);
2127 switch (insn.eaBase) {
2128 default:
2129 debug("Unexpected eaBase");
2130 return true;
2131 // Here, we will use the fill-ins defined above. However,
2132 // BX_SI, BX_DI, BP_SI, and BP_DI are all handled above and
2133 // sib and sib64 were handled in the top-level if, so they're only
2134 // placeholders to keep the compiler happy.
2135 #define ENTRY(x) \
2136 case EA_BASE_##x: \
2137 baseReg = MCOperand::createReg(X86::x); break;
2138 ALL_EA_BASES
2139 #undef ENTRY
2140 #define ENTRY(x) case EA_REG_##x:
2141 ALL_REGS
2142 #undef ENTRY
2143 debug("A R/M memory operand may not be a register; "
2144 "the base field must be a base.");
2145 return true;
2149 scaleAmount = MCOperand::createImm(1);
2152 displacement = MCOperand::createImm(insn.displacement);
2154 segmentReg = MCOperand::createReg(segmentRegnums[insn.segmentOverride]);
2156 mcInst.addOperand(baseReg);
2157 mcInst.addOperand(scaleAmount);
2158 mcInst.addOperand(indexReg);
2160 const uint8_t dispSize =
2161 (insn.eaDisplacement == EA_DISP_NONE) ? 0 : insn.displacementSize;
2163 if (!Dis->tryAddingSymbolicOperand(
2164 mcInst, insn.displacement + pcrel, insn.startLocation, false,
2165 insn.displacementOffset, dispSize, insn.length))
2166 mcInst.addOperand(displacement);
2167 mcInst.addOperand(segmentReg);
2168 return false;
2171 /// translateRM - Translates an operand stored in the R/M (and possibly SIB)
2172 /// byte of an instruction to LLVM form, and appends it to an MCInst.
2174 /// @param mcInst - The MCInst to append to.
2175 /// @param operand - The operand, as stored in the descriptor table.
2176 /// @param insn - The instruction to extract Mod, R/M, and SIB fields
2177 /// from.
2178 /// @return - 0 on success; nonzero otherwise
2179 static bool translateRM(MCInst &mcInst, const OperandSpecifier &operand,
2180 InternalInstruction &insn, const MCDisassembler *Dis) {
2181 switch (operand.type) {
2182 default:
2183 debug("Unexpected type for a R/M operand");
2184 return true;
2185 case TYPE_R8:
2186 case TYPE_R16:
2187 case TYPE_R32:
2188 case TYPE_R64:
2189 case TYPE_Rv:
2190 case TYPE_MM64:
2191 case TYPE_XMM:
2192 case TYPE_YMM:
2193 case TYPE_ZMM:
2194 case TYPE_TMM:
2195 case TYPE_VK_PAIR:
2196 case TYPE_VK:
2197 case TYPE_DEBUGREG:
2198 case TYPE_CONTROLREG:
2199 case TYPE_BNDR:
2200 return translateRMRegister(mcInst, insn);
2201 case TYPE_M:
2202 case TYPE_MVSIBX:
2203 case TYPE_MVSIBY:
2204 case TYPE_MVSIBZ:
2205 return translateRMMemory(mcInst, insn, Dis);
2206 case TYPE_MSIB:
2207 return translateRMMemory(mcInst, insn, Dis, true);
2211 /// translateFPRegister - Translates a stack position on the FPU stack to its
2212 /// LLVM form, and appends it to an MCInst.
2214 /// @param mcInst - The MCInst to append to.
2215 /// @param stackPos - The stack position to translate.
2216 static void translateFPRegister(MCInst &mcInst,
2217 uint8_t stackPos) {
2218 mcInst.addOperand(MCOperand::createReg(X86::ST0 + stackPos));
2221 /// translateMaskRegister - Translates a 3-bit mask register number to
2222 /// LLVM form, and appends it to an MCInst.
2224 /// @param mcInst - The MCInst to append to.
2225 /// @param maskRegNum - Number of mask register from 0 to 7.
2226 /// @return - false on success; true otherwise.
2227 static bool translateMaskRegister(MCInst &mcInst,
2228 uint8_t maskRegNum) {
2229 if (maskRegNum >= 8) {
2230 debug("Invalid mask register number");
2231 return true;
2234 mcInst.addOperand(MCOperand::createReg(X86::K0 + maskRegNum));
2235 return false;
2238 /// translateOperand - Translates an operand stored in an internal instruction
2239 /// to LLVM's format and appends it to an MCInst.
2241 /// @param mcInst - The MCInst to append to.
2242 /// @param operand - The operand, as stored in the descriptor table.
2243 /// @param insn - The internal instruction.
2244 /// @return - false on success; true otherwise.
2245 static bool translateOperand(MCInst &mcInst, const OperandSpecifier &operand,
2246 InternalInstruction &insn,
2247 const MCDisassembler *Dis) {
2248 switch (operand.encoding) {
2249 default:
2250 debug("Unhandled operand encoding during translation");
2251 return true;
2252 case ENCODING_REG:
2253 translateRegister(mcInst, insn.reg);
2254 return false;
2255 case ENCODING_WRITEMASK:
2256 return translateMaskRegister(mcInst, insn.writemask);
2257 case ENCODING_SIB:
2258 CASE_ENCODING_RM:
2259 CASE_ENCODING_VSIB:
2260 return translateRM(mcInst, operand, insn, Dis);
2261 case ENCODING_IB:
2262 case ENCODING_IW:
2263 case ENCODING_ID:
2264 case ENCODING_IO:
2265 case ENCODING_Iv:
2266 case ENCODING_Ia:
2267 translateImmediate(mcInst,
2268 insn.immediates[insn.numImmediatesTranslated++],
2269 operand,
2270 insn,
2271 Dis);
2272 return false;
2273 case ENCODING_IRC:
2274 mcInst.addOperand(MCOperand::createImm(insn.RC));
2275 return false;
2276 case ENCODING_SI:
2277 return translateSrcIndex(mcInst, insn);
2278 case ENCODING_DI:
2279 return translateDstIndex(mcInst, insn);
2280 case ENCODING_RB:
2281 case ENCODING_RW:
2282 case ENCODING_RD:
2283 case ENCODING_RO:
2284 case ENCODING_Rv:
2285 translateRegister(mcInst, insn.opcodeRegister);
2286 return false;
2287 case ENCODING_CC:
2288 mcInst.addOperand(MCOperand::createImm(insn.immediates[1]));
2289 return false;
2290 case ENCODING_FP:
2291 translateFPRegister(mcInst, insn.modRM & 7);
2292 return false;
2293 case ENCODING_VVVV:
2294 translateRegister(mcInst, insn.vvvv);
2295 return false;
2296 case ENCODING_DUP:
2297 return translateOperand(mcInst, insn.operands[operand.type - TYPE_DUP0],
2298 insn, Dis);
2302 /// translateInstruction - Translates an internal instruction and all its
2303 /// operands to an MCInst.
2305 /// @param mcInst - The MCInst to populate with the instruction's data.
2306 /// @param insn - The internal instruction.
2307 /// @return - false on success; true otherwise.
2308 static bool translateInstruction(MCInst &mcInst,
2309 InternalInstruction &insn,
2310 const MCDisassembler *Dis) {
2311 if (!insn.spec) {
2312 debug("Instruction has no specification");
2313 return true;
2316 mcInst.clear();
2317 mcInst.setOpcode(insn.instructionID);
2318 // If when reading the prefix bytes we determined the overlapping 0xf2 or 0xf3
2319 // prefix bytes should be disassembled as xrelease and xacquire then set the
2320 // opcode to those instead of the rep and repne opcodes.
2321 if (insn.xAcquireRelease) {
2322 if(mcInst.getOpcode() == X86::REP_PREFIX)
2323 mcInst.setOpcode(X86::XRELEASE_PREFIX);
2324 else if(mcInst.getOpcode() == X86::REPNE_PREFIX)
2325 mcInst.setOpcode(X86::XACQUIRE_PREFIX);
2328 insn.numImmediatesTranslated = 0;
2330 for (const auto &Op : insn.operands) {
2331 if (Op.encoding != ENCODING_NONE) {
2332 if (translateOperand(mcInst, Op, insn, Dis)) {
2333 return true;
2338 return false;
2341 static MCDisassembler *createX86Disassembler(const Target &T,
2342 const MCSubtargetInfo &STI,
2343 MCContext &Ctx) {
2344 std::unique_ptr<const MCInstrInfo> MII(T.createMCInstrInfo());
2345 return new X86GenericDisassembler(STI, Ctx, std::move(MII));
2348 extern "C" LLVM_EXTERNAL_VISIBILITY void LLVMInitializeX86Disassembler() {
2349 // Register the disassembler.
2350 TargetRegistry::RegisterMCDisassembler(getTheX86_32Target(),
2351 createX86Disassembler);
2352 TargetRegistry::RegisterMCDisassembler(getTheX86_64Target(),
2353 createX86Disassembler);