in x86/x86asm/decode.go [238:1537]
func decode1(src []byte, mode int, gnuCompat bool) (Inst, error) {
switch mode {
case 16, 32, 64:
// ok
// TODO(rsc): 64-bit mode not tested, probably not working.
default:
return Inst{}, ErrInvalidMode
}
// Maximum instruction size is 15 bytes.
// If we need to read more, return 'truncated instruction.
if len(src) > 15 {
src = src[:15]
}
var (
// prefix decoding information
pos = 0 // position reading src
nprefix = 0 // number of prefixes
lockIndex = -1 // index of LOCK prefix in src and inst.Prefix
repIndex = -1 // index of REP/REPN prefix in src and inst.Prefix
segIndex = -1 // index of Group 2 prefix in src and inst.Prefix
dataSizeIndex = -1 // index of Group 3 prefix in src and inst.Prefix
addrSizeIndex = -1 // index of Group 4 prefix in src and inst.Prefix
rex Prefix // rex byte if present (or 0)
rexUsed Prefix // bits used in rex byte
rexIndex = -1 // index of rex byte
vex Prefix // use vex encoding
vexIndex = -1 // index of vex prefix
addrMode = mode // address mode (width in bits)
dataMode = mode // operand mode (width in bits)
// decoded ModR/M fields
haveModrm bool
modrm int
mod int
regop int
rm int
// if ModR/M is memory reference, Mem form
mem Mem
haveMem bool
// decoded SIB fields
haveSIB bool
sib int
scale int
index int
base int
displen int
dispoff int
// decoded immediate values
imm int64
imm8 int8
immc int64
immcpos int
// output
opshift int
inst Inst
narg int // number of arguments written to inst
)
if mode == 64 {
dataMode = 32
}
// Prefixes are certainly the most complex and underspecified part of
// decoding x86 instructions. Although the manuals say things like
// up to four prefixes, one from each group, nearly everyone seems to
// agree that in practice as many prefixes as possible, including multiple
// from a particular group or repetitions of a given prefix, can be used on
// an instruction, provided the total instruction length including prefixes
// does not exceed the agreed-upon maximum of 15 bytes.
// Everyone also agrees that if one of these prefixes is the LOCK prefix
// and the instruction is not one of the instructions that can be used with
// the LOCK prefix or if the destination is not a memory operand,
// then the instruction is invalid and produces the #UD exception.
// However, that is the end of any semblance of agreement.
//
// What happens if prefixes are given that conflict with other prefixes?
// For example, the memory segment overrides CS, DS, ES, FS, GS, SS
// conflict with each other: only one segment can be in effect.
// Disassemblers seem to agree that later prefixes take priority over
// earlier ones. I have not taken the time to write assembly programs
// to check to see if the hardware agrees.
//
// What happens if prefixes are given that have no meaning for the
// specific instruction to which they are attached? It depends.
// If they really have no meaning, they are ignored. However, a future
// processor may assign a different meaning. As a disassembler, we
// don't really know whether we're seeing a meaningless prefix or one
// whose meaning we simply haven't been told yet.
//
// Combining the two questions, what happens when conflicting
// extension prefixes are given? No one seems to know for sure.
// For example, MOVQ is 66 0F D6 /r, MOVDQ2Q is F2 0F D6 /r,
// and MOVQ2DQ is F3 0F D6 /r. What is '66 F2 F3 0F D6 /r'?
// Which prefix wins? See the xCondPrefix prefix for more.
//
// Writing assembly test cases to divine which interpretation the
// CPU uses might clarify the situation, but more likely it would
// make the situation even less clear.
// Read non-REX prefixes.
ReadPrefixes:
for ; pos < len(src); pos++ {
p := Prefix(src[pos])
switch p {
default:
nprefix = pos
break ReadPrefixes
// Group 1 - lock and repeat prefixes
// According to Intel, there should only be one from this set,
// but according to AMD both can be present.
case 0xF0:
if lockIndex >= 0 {
inst.Prefix[lockIndex] |= PrefixIgnored
}
lockIndex = pos
case 0xF2, 0xF3:
if repIndex >= 0 {
inst.Prefix[repIndex] |= PrefixIgnored
}
repIndex = pos
// Group 2 - segment override / branch hints
case 0x26, 0x2E, 0x36, 0x3E:
if mode == 64 {
p |= PrefixIgnored
break
}
fallthrough
case 0x64, 0x65:
if segIndex >= 0 {
inst.Prefix[segIndex] |= PrefixIgnored
}
segIndex = pos
// Group 3 - operand size override
case 0x66:
if mode == 16 {
dataMode = 32
p = PrefixData32
} else {
dataMode = 16
p = PrefixData16
}
if dataSizeIndex >= 0 {
inst.Prefix[dataSizeIndex] |= PrefixIgnored
}
dataSizeIndex = pos
// Group 4 - address size override
case 0x67:
if mode == 32 {
addrMode = 16
p = PrefixAddr16
} else {
addrMode = 32
p = PrefixAddr32
}
if addrSizeIndex >= 0 {
inst.Prefix[addrSizeIndex] |= PrefixIgnored
}
addrSizeIndex = pos
//Group 5 - Vex encoding
case 0xC5:
if pos == 0 && pos+1 < len(src) && (mode == 64 || (mode == 32 && src[pos+1]&0xc0 == 0xc0)) {
vex = p
vexIndex = pos
inst.Prefix[pos] = p
inst.Prefix[pos+1] = Prefix(src[pos+1])
pos += 1
continue
} else {
nprefix = pos
break ReadPrefixes
}
case 0xC4:
if pos == 0 && pos+2 < len(src) && (mode == 64 || (mode == 32 && src[pos+1]&0xc0 == 0xc0)) {
vex = p
vexIndex = pos
inst.Prefix[pos] = p
inst.Prefix[pos+1] = Prefix(src[pos+1])
inst.Prefix[pos+2] = Prefix(src[pos+2])
pos += 2
continue
} else {
nprefix = pos
break ReadPrefixes
}
}
if pos >= len(inst.Prefix) {
return instPrefix(src[0], mode) // too long
}
inst.Prefix[pos] = p
}
// Read REX prefix.
if pos < len(src) && mode == 64 && Prefix(src[pos]).IsREX() && vex == 0 {
rex = Prefix(src[pos])
rexIndex = pos
if pos >= len(inst.Prefix) {
return instPrefix(src[0], mode) // too long
}
inst.Prefix[pos] = rex
pos++
if rex&PrefixREXW != 0 {
dataMode = 64
if dataSizeIndex >= 0 {
inst.Prefix[dataSizeIndex] |= PrefixIgnored
}
}
}
// Decode instruction stream, interpreting decoding instructions.
// opshift gives the shift to use when saving the next
// opcode byte into inst.Opcode.
opshift = 24
// Decode loop, executing decoder program.
var oldPC, prevPC int
Decode:
for pc := 1; ; { // TODO uint
oldPC = prevPC
prevPC = pc
if trace {
println("run", pc)
}
x := decoder[pc]
if decoderCover != nil {
decoderCover[pc] = true
}
pc++
// Read and decode ModR/M if needed by opcode.
switch decodeOp(x) {
case xCondSlashR, xReadSlashR:
if haveModrm {
return Inst{Len: pos}, errInternal
}
haveModrm = true
if pos >= len(src) {
return truncated(src, mode)
}
modrm = int(src[pos])
pos++
if opshift >= 0 {
inst.Opcode |= uint32(modrm) << uint(opshift)
opshift -= 8
}
mod = modrm >> 6
regop = (modrm >> 3) & 07
rm = modrm & 07
if rex&PrefixREXR != 0 {
rexUsed |= PrefixREXR
regop |= 8
}
if addrMode == 16 {
// 16-bit modrm form
if mod != 3 {
haveMem = true
mem = addr16[rm]
if rm == 6 && mod == 0 {
mem.Base = 0
}
// Consume disp16 if present.
if mod == 0 && rm == 6 || mod == 2 {
if pos+2 > len(src) {
return truncated(src, mode)
}
mem.Disp = int64(binary.LittleEndian.Uint16(src[pos:]))
pos += 2
}
// Consume disp8 if present.
if mod == 1 {
if pos >= len(src) {
return truncated(src, mode)
}
mem.Disp = int64(int8(src[pos]))
pos++
}
}
} else {
haveMem = mod != 3
// 32-bit or 64-bit form
// Consume SIB encoding if present.
if rm == 4 && mod != 3 {
haveSIB = true
if pos >= len(src) {
return truncated(src, mode)
}
sib = int(src[pos])
pos++
if opshift >= 0 {
inst.Opcode |= uint32(sib) << uint(opshift)
opshift -= 8
}
scale = sib >> 6
index = (sib >> 3) & 07
base = sib & 07
if rex&PrefixREXB != 0 || vex == 0xC4 && inst.Prefix[vexIndex+1]&0x20 == 0 {
rexUsed |= PrefixREXB
base |= 8
}
if rex&PrefixREXX != 0 || vex == 0xC4 && inst.Prefix[vexIndex+1]&0x40 == 0 {
rexUsed |= PrefixREXX
index |= 8
}
mem.Scale = 1 << uint(scale)
if index == 4 {
// no mem.Index
} else {
mem.Index = baseRegForBits(addrMode) + Reg(index)
}
if base&7 == 5 && mod == 0 {
// no mem.Base
} else {
mem.Base = baseRegForBits(addrMode) + Reg(base)
}
} else {
if rex&PrefixREXB != 0 {
rexUsed |= PrefixREXB
rm |= 8
}
if mod == 0 && rm&7 == 5 || rm&7 == 4 {
// base omitted
} else if mod != 3 {
mem.Base = baseRegForBits(addrMode) + Reg(rm)
}
}
// Consume disp32 if present.
if mod == 0 && (rm&7 == 5 || haveSIB && base&7 == 5) || mod == 2 {
if pos+4 > len(src) {
return truncated(src, mode)
}
dispoff = pos
displen = 4
mem.Disp = int64(binary.LittleEndian.Uint32(src[pos:]))
pos += 4
}
// Consume disp8 if present.
if mod == 1 {
if pos >= len(src) {
return truncated(src, mode)
}
dispoff = pos
displen = 1
mem.Disp = int64(int8(src[pos]))
pos++
}
// In 64-bit, mod=0 rm=5 is PC-relative instead of just disp.
// See Vol 2A. Table 2-7.
if mode == 64 && mod == 0 && rm&7 == 5 {
if addrMode == 32 {
mem.Base = EIP
} else {
mem.Base = RIP
}
}
}
if segIndex >= 0 {
mem.Segment = prefixToSegment(inst.Prefix[segIndex])
}
}
// Execute single opcode.
switch decodeOp(x) {
default:
println("bad op", x, "at", pc-1, "from", oldPC)
return Inst{Len: pos}, errInternal
case xFail:
inst.Op = 0
break Decode
case xMatch:
break Decode
case xJump:
pc = int(decoder[pc])
// Conditional branches.
case xCondByte:
if pos >= len(src) {
return truncated(src, mode)
}
b := src[pos]
n := int(decoder[pc])
pc++
for i := 0; i < n; i++ {
xb, xpc := decoder[pc], int(decoder[pc+1])
pc += 2
if b == byte(xb) {
pc = xpc
pos++
if opshift >= 0 {
inst.Opcode |= uint32(b) << uint(opshift)
opshift -= 8
}
continue Decode
}
}
// xCondByte is the only conditional with a fall through,
// so that it can be used to pick off special cases before
// an xCondSlash. If the fallthrough instruction is xFail,
// advance the position so that the decoded instruction
// size includes the byte we just compared against.
if decodeOp(decoder[pc]) == xJump {
pc = int(decoder[pc+1])
}
if decodeOp(decoder[pc]) == xFail {
pos++
}
case xCondIs64:
if mode == 64 {
pc = int(decoder[pc+1])
} else {
pc = int(decoder[pc])
}
case xCondIsMem:
mem := haveMem
if !haveModrm {
if pos >= len(src) {
return instPrefix(src[0], mode) // too long
}
mem = src[pos]>>6 != 3
}
if mem {
pc = int(decoder[pc+1])
} else {
pc = int(decoder[pc])
}
case xCondDataSize:
switch dataMode {
case 16:
if dataSizeIndex >= 0 {
inst.Prefix[dataSizeIndex] |= PrefixImplicit
}
pc = int(decoder[pc])
case 32:
if dataSizeIndex >= 0 {
inst.Prefix[dataSizeIndex] |= PrefixImplicit
}
pc = int(decoder[pc+1])
case 64:
rexUsed |= PrefixREXW
pc = int(decoder[pc+2])
}
case xCondAddrSize:
switch addrMode {
case 16:
if addrSizeIndex >= 0 {
inst.Prefix[addrSizeIndex] |= PrefixImplicit
}
pc = int(decoder[pc])
case 32:
if addrSizeIndex >= 0 {
inst.Prefix[addrSizeIndex] |= PrefixImplicit
}
pc = int(decoder[pc+1])
case 64:
pc = int(decoder[pc+2])
}
case xCondPrefix:
// Conditional branch based on presence or absence of prefixes.
// The conflict cases here are completely undocumented and
// differ significantly between GNU libopcodes and Intel xed.
// I have not written assembly code to divine what various CPUs
// do, but it wouldn't surprise me if they are not consistent either.
//
// The basic idea is to switch on the presence of a prefix, so that
// for example:
//
// xCondPrefix, 4
// 0xF3, 123,
// 0xF2, 234,
// 0x66, 345,
// 0, 456
//
// branch to 123 if the F3 prefix is present, 234 if the F2 prefix
// is present, 66 if the 345 prefix is present, and 456 otherwise.
// The prefixes are given in descending order so that the 0 will be last.
//
// It is unclear what should happen if multiple conditions are
// satisfied: what if F2 and F3 are both present, or if 66 and F2
// are present, or if all three are present? The one chosen becomes
// part of the opcode and the others do not. Perhaps the answer
// depends on the specific opcodes in question.
//
// The only clear example is that CRC32 is F2 0F 38 F1 /r, and
// it comes in 16-bit and 32-bit forms based on the 66 prefix,
// so 66 F2 0F 38 F1 /r should be treated as F2 taking priority,
// with the 66 being only an operand size override, and probably
// F2 66 0F 38 F1 /r should be treated the same.
// Perhaps that rule is specific to the case of CRC32, since no
// 66 0F 38 F1 instruction is defined (today) (that we know of).
// However, both libopcodes and xed seem to generalize this
// example and choose F2/F3 in preference to 66, and we
// do the same.
//
// Next, what if both F2 and F3 are present? Which wins?
// The Intel xed rule, and ours, is that the one that occurs last wins.
// The GNU libopcodes rule, which we implement only in gnuCompat mode,
// is that F3 beats F2 unless F3 has no special meaning, in which
// case F3 can be a modified on an F2 special meaning.
//
// Concretely,
// 66 0F D6 /r is MOVQ
// F2 0F D6 /r is MOVDQ2Q
// F3 0F D6 /r is MOVQ2DQ.
//
// F2 66 0F D6 /r is 66 + MOVDQ2Q always.
// 66 F2 0F D6 /r is 66 + MOVDQ2Q always.
// F3 66 0F D6 /r is 66 + MOVQ2DQ always.
// 66 F3 0F D6 /r is 66 + MOVQ2DQ always.
// F2 F3 0F D6 /r is F2 + MOVQ2DQ always.
// F3 F2 0F D6 /r is F3 + MOVQ2DQ in Intel xed, but F2 + MOVQ2DQ in GNU libopcodes.
// Adding 66 anywhere in the prefix section of the
// last two cases does not change the outcome.
//
// Finally, what if there is a variant in which 66 is a mandatory
// prefix rather than an operand size override, but we know of
// no corresponding F2/F3 form, and we see both F2/F3 and 66.
// Does F2/F3 still take priority, so that the result is an unknown
// instruction, or does the 66 take priority, so that the extended
// 66 instruction should be interpreted as having a REP/REPN prefix?
// Intel xed does the former and GNU libopcodes does the latter.
// We side with Intel xed, unless we are trying to match libopcodes
// more closely during the comparison-based test suite.
//
// In 64-bit mode REX.W is another valid prefix to test for, but
// there is less ambiguity about that. When present, REX.W is
// always the first entry in the table.
n := int(decoder[pc])
pc++
sawF3 := false
for j := 0; j < n; j++ {
prefix := Prefix(decoder[pc+2*j])
if prefix.IsREX() {
rexUsed |= prefix
if rex&prefix == prefix {
pc = int(decoder[pc+2*j+1])
continue Decode
}
continue
}
ok := false
if prefix == 0 {
ok = true
} else if prefix.IsREX() {
rexUsed |= prefix
if rex&prefix == prefix {
ok = true
}
} else if prefix == 0xC5 || prefix == 0xC4 {
if vex == prefix {
ok = true
}
} else if vex != 0 && (prefix == 0x0F || prefix == 0x0F38 || prefix == 0x0F3A ||
prefix == 0x66 || prefix == 0xF2 || prefix == 0xF3) {
var vexM, vexP Prefix
if vex == 0xC5 {
vexM = 1 // 2 byte vex always implies 0F
vexP = inst.Prefix[vexIndex+1]
} else {
vexM = inst.Prefix[vexIndex+1]
vexP = inst.Prefix[vexIndex+2]
}
switch prefix {
case 0x66:
ok = vexP&3 == 1
case 0xF3:
ok = vexP&3 == 2
case 0xF2:
ok = vexP&3 == 3
case 0x0F:
ok = vexM&3 == 1
case 0x0F38:
ok = vexM&3 == 2
case 0x0F3A:
ok = vexM&3 == 3
}
} else {
if prefix == 0xF3 {
sawF3 = true
}
switch prefix {
case PrefixLOCK:
if lockIndex >= 0 {
inst.Prefix[lockIndex] |= PrefixImplicit
ok = true
}
case PrefixREP, PrefixREPN:
if repIndex >= 0 && inst.Prefix[repIndex]&0xFF == prefix {
inst.Prefix[repIndex] |= PrefixImplicit
ok = true
}
if gnuCompat && !ok && prefix == 0xF3 && repIndex >= 0 && (j+1 >= n || decoder[pc+2*(j+1)] != 0xF2) {
// Check to see if earlier prefix F3 is present.
for i := repIndex - 1; i >= 0; i-- {
if inst.Prefix[i]&0xFF == prefix {
inst.Prefix[i] |= PrefixImplicit
ok = true
}
}
}
if gnuCompat && !ok && prefix == 0xF2 && repIndex >= 0 && !sawF3 && inst.Prefix[repIndex]&0xFF == 0xF3 {
// Check to see if earlier prefix F2 is present.
for i := repIndex - 1; i >= 0; i-- {
if inst.Prefix[i]&0xFF == prefix {
inst.Prefix[i] |= PrefixImplicit
ok = true
}
}
}
case PrefixCS, PrefixDS, PrefixES, PrefixFS, PrefixGS, PrefixSS:
if segIndex >= 0 && inst.Prefix[segIndex]&0xFF == prefix {
inst.Prefix[segIndex] |= PrefixImplicit
ok = true
}
case PrefixDataSize:
// Looking for 66 mandatory prefix.
// The F2/F3 mandatory prefixes take priority when both are present.
// If we got this far in the xCondPrefix table and an F2/F3 is present,
// it means the table didn't have any entry for that prefix. But if 66 has
// special meaning, perhaps F2/F3 have special meaning that we don't know.
// Intel xed works this way, treating the F2/F3 as inhibiting the 66.
// GNU libopcodes allows the 66 to match. We do what Intel xed does
// except in gnuCompat mode.
if repIndex >= 0 && !gnuCompat {
inst.Op = 0
break Decode
}
if dataSizeIndex >= 0 {
inst.Prefix[dataSizeIndex] |= PrefixImplicit
ok = true
}
case PrefixAddrSize:
if addrSizeIndex >= 0 {
inst.Prefix[addrSizeIndex] |= PrefixImplicit
ok = true
}
}
}
if ok {
pc = int(decoder[pc+2*j+1])
continue Decode
}
}
inst.Op = 0
break Decode
case xCondSlashR:
pc = int(decoder[pc+regop&7])
// Input.
case xReadSlashR:
// done above
case xReadIb:
if pos >= len(src) {
return truncated(src, mode)
}
imm8 = int8(src[pos])
pos++
case xReadIw:
if pos+2 > len(src) {
return truncated(src, mode)
}
imm = int64(binary.LittleEndian.Uint16(src[pos:]))
pos += 2
case xReadId:
if pos+4 > len(src) {
return truncated(src, mode)
}
imm = int64(binary.LittleEndian.Uint32(src[pos:]))
pos += 4
case xReadIo:
if pos+8 > len(src) {
return truncated(src, mode)
}
imm = int64(binary.LittleEndian.Uint64(src[pos:]))
pos += 8
case xReadCb:
if pos >= len(src) {
return truncated(src, mode)
}
immcpos = pos
immc = int64(src[pos])
pos++
case xReadCw:
if pos+2 > len(src) {
return truncated(src, mode)
}
immcpos = pos
immc = int64(binary.LittleEndian.Uint16(src[pos:]))
pos += 2
case xReadCm:
immcpos = pos
if addrMode == 16 {
if pos+2 > len(src) {
return truncated(src, mode)
}
immc = int64(binary.LittleEndian.Uint16(src[pos:]))
pos += 2
} else if addrMode == 32 {
if pos+4 > len(src) {
return truncated(src, mode)
}
immc = int64(binary.LittleEndian.Uint32(src[pos:]))
pos += 4
} else {
if pos+8 > len(src) {
return truncated(src, mode)
}
immc = int64(binary.LittleEndian.Uint64(src[pos:]))
pos += 8
}
case xReadCd:
immcpos = pos
if pos+4 > len(src) {
return truncated(src, mode)
}
immc = int64(binary.LittleEndian.Uint32(src[pos:]))
pos += 4
case xReadCp:
immcpos = pos
if pos+6 > len(src) {
return truncated(src, mode)
}
w := binary.LittleEndian.Uint32(src[pos:])
w2 := binary.LittleEndian.Uint16(src[pos+4:])
immc = int64(w2)<<32 | int64(w)
pos += 6
// Output.
case xSetOp:
inst.Op = Op(decoder[pc])
pc++
case xArg1,
xArg3,
xArgAL,
xArgAX,
xArgCL,
xArgCS,
xArgDS,
xArgDX,
xArgEAX,
xArgEDX,
xArgES,
xArgFS,
xArgGS,
xArgRAX,
xArgRDX,
xArgSS,
xArgST,
xArgXMM0:
inst.Args[narg] = fixedArg[x]
narg++
case xArgImm8:
inst.Args[narg] = Imm(imm8)
narg++
case xArgImm8u:
inst.Args[narg] = Imm(uint8(imm8))
narg++
case xArgImm16:
inst.Args[narg] = Imm(int16(imm))
narg++
case xArgImm16u:
inst.Args[narg] = Imm(uint16(imm))
narg++
case xArgImm32:
inst.Args[narg] = Imm(int32(imm))
narg++
case xArgImm64:
inst.Args[narg] = Imm(imm)
narg++
case xArgM,
xArgM128,
xArgM256,
xArgM1428byte,
xArgM16,
xArgM16and16,
xArgM16and32,
xArgM16and64,
xArgM16colon16,
xArgM16colon32,
xArgM16colon64,
xArgM16int,
xArgM2byte,
xArgM32,
xArgM32and32,
xArgM32fp,
xArgM32int,
xArgM512byte,
xArgM64,
xArgM64fp,
xArgM64int,
xArgM8,
xArgM80bcd,
xArgM80dec,
xArgM80fp,
xArgM94108byte,
xArgMem:
if !haveMem {
inst.Op = 0
break Decode
}
inst.Args[narg] = mem
inst.MemBytes = int(memBytes[decodeOp(x)])
if mem.Base == RIP {
inst.PCRel = displen
inst.PCRelOff = dispoff
}
narg++
case xArgPtr16colon16:
inst.Args[narg] = Imm(immc >> 16)
inst.Args[narg+1] = Imm(immc & (1<<16 - 1))
narg += 2
case xArgPtr16colon32:
inst.Args[narg] = Imm(immc >> 32)
inst.Args[narg+1] = Imm(immc & (1<<32 - 1))
narg += 2
case xArgMoffs8, xArgMoffs16, xArgMoffs32, xArgMoffs64:
// TODO(rsc): Can address be 64 bits?
mem = Mem{Disp: int64(immc)}
if segIndex >= 0 {
mem.Segment = prefixToSegment(inst.Prefix[segIndex])
inst.Prefix[segIndex] |= PrefixImplicit
}
inst.Args[narg] = mem
inst.MemBytes = int(memBytes[decodeOp(x)])
if mem.Base == RIP {
inst.PCRel = displen
inst.PCRelOff = dispoff
}
narg++
case xArgYmm1:
base := baseReg[x]
index := Reg(regop)
if inst.Prefix[vexIndex+1]&0x80 == 0 {
index += 8
}
inst.Args[narg] = base + index
narg++
case xArgR8, xArgR16, xArgR32, xArgR64, xArgXmm, xArgXmm1, xArgDR0dashDR7:
base := baseReg[x]
index := Reg(regop)
if rex != 0 && base == AL && index >= 4 {
rexUsed |= PrefixREX
index -= 4
base = SPB
}
inst.Args[narg] = base + index
narg++
case xArgMm, xArgMm1, xArgTR0dashTR7:
inst.Args[narg] = baseReg[x] + Reg(regop&7)
narg++
case xArgCR0dashCR7:
// AMD documents an extension that the LOCK prefix
// can be used in place of a REX prefix in order to access
// CR8 from 32-bit mode. The LOCK prefix is allowed in
// all modes, provided the corresponding CPUID bit is set.
if lockIndex >= 0 {
inst.Prefix[lockIndex] |= PrefixImplicit
regop += 8
}
inst.Args[narg] = CR0 + Reg(regop)
narg++
case xArgSreg:
regop &= 7
if regop >= 6 {
inst.Op = 0
break Decode
}
inst.Args[narg] = ES + Reg(regop)
narg++
case xArgRmf16, xArgRmf32, xArgRmf64:
base := baseReg[x]
index := Reg(modrm & 07)
if rex&PrefixREXB != 0 {
rexUsed |= PrefixREXB
index += 8
}
inst.Args[narg] = base + index
narg++
case xArgR8op, xArgR16op, xArgR32op, xArgR64op, xArgSTi:
n := inst.Opcode >> uint(opshift+8) & 07
base := baseReg[x]
index := Reg(n)
if rex&PrefixREXB != 0 && decodeOp(x) != xArgSTi {
rexUsed |= PrefixREXB
index += 8
}
if rex != 0 && base == AL && index >= 4 {
rexUsed |= PrefixREX
index -= 4
base = SPB
}
inst.Args[narg] = base + index
narg++
case xArgRM8, xArgRM16, xArgRM32, xArgRM64, xArgR32M16, xArgR32M8, xArgR64M16,
xArgMmM32, xArgMmM64, xArgMm2M64,
xArgXmm2M16, xArgXmm2M32, xArgXmm2M64, xArgXmmM64, xArgXmmM128, xArgXmmM32, xArgXmm2M128,
xArgYmm2M256:
if haveMem {
inst.Args[narg] = mem
inst.MemBytes = int(memBytes[decodeOp(x)])
if mem.Base == RIP {
inst.PCRel = displen
inst.PCRelOff = dispoff
}
} else {
base := baseReg[x]
index := Reg(rm)
switch decodeOp(x) {
case xArgMmM32, xArgMmM64, xArgMm2M64:
// There are only 8 MMX registers, so these ignore the REX.X bit.
index &= 7
case xArgRM8:
if rex != 0 && index >= 4 {
rexUsed |= PrefixREX
index -= 4
base = SPB
}
case xArgYmm2M256:
if vex == 0xC4 && inst.Prefix[vexIndex+1]&0x40 == 0x40 {
index += 8
}
}
inst.Args[narg] = base + index
}
narg++
case xArgMm2: // register only; TODO(rsc): Handle with tag modrm_regonly tag
if haveMem {
inst.Op = 0
break Decode
}
inst.Args[narg] = baseReg[x] + Reg(rm&7)
narg++
case xArgXmm2: // register only; TODO(rsc): Handle with tag modrm_regonly tag
if haveMem {
inst.Op = 0
break Decode
}
inst.Args[narg] = baseReg[x] + Reg(rm)
narg++
case xArgRel8:
inst.PCRelOff = immcpos
inst.PCRel = 1
inst.Args[narg] = Rel(int8(immc))
narg++
case xArgRel16:
inst.PCRelOff = immcpos
inst.PCRel = 2
inst.Args[narg] = Rel(int16(immc))
narg++
case xArgRel32:
inst.PCRelOff = immcpos
inst.PCRel = 4
inst.Args[narg] = Rel(int32(immc))
narg++
}
}
if inst.Op == 0 {
// Invalid instruction.
if nprefix > 0 {
return instPrefix(src[0], mode) // invalid instruction
}
return Inst{Len: pos}, ErrUnrecognized
}
// Matched! Hooray!
// 90 decodes as XCHG EAX, EAX but is NOP.
// 66 90 decodes as XCHG AX, AX and is NOP too.
// 48 90 decodes as XCHG RAX, RAX and is NOP too.
// 43 90 decodes as XCHG R8D, EAX and is *not* NOP.
// F3 90 decodes as REP XCHG EAX, EAX but is PAUSE.
// It's all too special to handle in the decoding tables, at least for now.
if inst.Op == XCHG && inst.Opcode>>24 == 0x90 {
if inst.Args[0] == RAX || inst.Args[0] == EAX || inst.Args[0] == AX {
inst.Op = NOP
if dataSizeIndex >= 0 {
inst.Prefix[dataSizeIndex] &^= PrefixImplicit
}
inst.Args[0] = nil
inst.Args[1] = nil
}
if repIndex >= 0 && inst.Prefix[repIndex] == 0xF3 {
inst.Prefix[repIndex] |= PrefixImplicit
inst.Op = PAUSE
inst.Args[0] = nil
inst.Args[1] = nil
} else if gnuCompat {
for i := nprefix - 1; i >= 0; i-- {
if inst.Prefix[i]&0xFF == 0xF3 {
inst.Prefix[i] |= PrefixImplicit
inst.Op = PAUSE
inst.Args[0] = nil
inst.Args[1] = nil
break
}
}
}
}
// defaultSeg returns the default segment for an implicit
// memory reference: the final override if present, or else DS.
defaultSeg := func() Reg {
if segIndex >= 0 {
inst.Prefix[segIndex] |= PrefixImplicit
return prefixToSegment(inst.Prefix[segIndex])
}
return DS
}
// Add implicit arguments not present in the tables.
// Normally we shy away from making implicit arguments explicit,
// following the Intel manuals, but adding the arguments seems
// the best way to express the effect of the segment override prefixes.
// TODO(rsc): Perhaps add these to the tables and
// create bytecode instructions for them.
usedAddrSize := false
switch inst.Op {
case INSB, INSW, INSD:
inst.Args[0] = Mem{Segment: ES, Base: baseRegForBits(addrMode) + DI - AX}
inst.Args[1] = DX
usedAddrSize = true
case OUTSB, OUTSW, OUTSD:
inst.Args[0] = DX
inst.Args[1] = Mem{Segment: defaultSeg(), Base: baseRegForBits(addrMode) + SI - AX}
usedAddrSize = true
case MOVSB, MOVSW, MOVSD, MOVSQ:
inst.Args[0] = Mem{Segment: ES, Base: baseRegForBits(addrMode) + DI - AX}
inst.Args[1] = Mem{Segment: defaultSeg(), Base: baseRegForBits(addrMode) + SI - AX}
usedAddrSize = true
case CMPSB, CMPSW, CMPSD, CMPSQ:
inst.Args[0] = Mem{Segment: defaultSeg(), Base: baseRegForBits(addrMode) + SI - AX}
inst.Args[1] = Mem{Segment: ES, Base: baseRegForBits(addrMode) + DI - AX}
usedAddrSize = true
case LODSB, LODSW, LODSD, LODSQ:
switch inst.Op {
case LODSB:
inst.Args[0] = AL
case LODSW:
inst.Args[0] = AX
case LODSD:
inst.Args[0] = EAX
case LODSQ:
inst.Args[0] = RAX
}
inst.Args[1] = Mem{Segment: defaultSeg(), Base: baseRegForBits(addrMode) + SI - AX}
usedAddrSize = true
case STOSB, STOSW, STOSD, STOSQ:
inst.Args[0] = Mem{Segment: ES, Base: baseRegForBits(addrMode) + DI - AX}
switch inst.Op {
case STOSB:
inst.Args[1] = AL
case STOSW:
inst.Args[1] = AX
case STOSD:
inst.Args[1] = EAX
case STOSQ:
inst.Args[1] = RAX
}
usedAddrSize = true
case SCASB, SCASW, SCASD, SCASQ:
inst.Args[1] = Mem{Segment: ES, Base: baseRegForBits(addrMode) + DI - AX}
switch inst.Op {
case SCASB:
inst.Args[0] = AL
case SCASW:
inst.Args[0] = AX
case SCASD:
inst.Args[0] = EAX
case SCASQ:
inst.Args[0] = RAX
}
usedAddrSize = true
case XLATB:
inst.Args[0] = Mem{Segment: defaultSeg(), Base: baseRegForBits(addrMode) + BX - AX}
usedAddrSize = true
}
// If we used the address size annotation to construct the
// argument list, mark that prefix as implicit: it doesn't need
// to be shown when printing the instruction.
if haveMem || usedAddrSize {
if addrSizeIndex >= 0 {
inst.Prefix[addrSizeIndex] |= PrefixImplicit
}
}
// Similarly, if there's some memory operand, the segment
// will be shown there and doesn't need to be shown as an
// explicit prefix.
if haveMem {
if segIndex >= 0 {
inst.Prefix[segIndex] |= PrefixImplicit
}
}
// Branch predict prefixes are overloaded segment prefixes,
// since segment prefixes don't make sense on conditional jumps.
// Rewrite final instance to prediction prefix.
// The set of instructions to which the prefixes apply (other then the
// Jcc conditional jumps) is not 100% clear from the manuals, but
// the disassemblers seem to agree about the LOOP and JCXZ instructions,
// so we'll follow along.
// TODO(rsc): Perhaps this instruction class should be derived from the CSV.
if isCondJmp[inst.Op] || isLoop[inst.Op] || inst.Op == JCXZ || inst.Op == JECXZ || inst.Op == JRCXZ {
PredictLoop:
for i := nprefix - 1; i >= 0; i-- {
p := inst.Prefix[i]
switch p & 0xFF {
case PrefixCS:
inst.Prefix[i] = PrefixPN
break PredictLoop
case PrefixDS:
inst.Prefix[i] = PrefixPT
break PredictLoop
}
}
}
// The BND prefix is part of the Intel Memory Protection Extensions (MPX).
// A REPN applied to certain control transfers is a BND prefix to bound
// the range of possible destinations. There's surprisingly little documentation
// about this, so we just do what libopcodes and xed agree on.
// In particular, it's unclear why a REPN applied to LOOP or JCXZ instructions
// does not turn into a BND.
// TODO(rsc): Perhaps this instruction class should be derived from the CSV.
if isCondJmp[inst.Op] || inst.Op == JMP || inst.Op == CALL || inst.Op == RET {
for i := nprefix - 1; i >= 0; i-- {
p := inst.Prefix[i]
if p&^PrefixIgnored == PrefixREPN {
inst.Prefix[i] = PrefixBND
break
}
}
}
// The LOCK prefix only applies to certain instructions, and then only
// to instances of the instruction with a memory destination.
// Other uses of LOCK are invalid and cause a processor exception,
// in contrast to the "just ignore it" spirit applied to all other prefixes.
// Mark invalid lock prefixes.
hasLock := false
if lockIndex >= 0 && inst.Prefix[lockIndex]&PrefixImplicit == 0 {
switch inst.Op {
// TODO(rsc): Perhaps this instruction class should be derived from the CSV.
case ADD, ADC, AND, BTC, BTR, BTS, CMPXCHG, CMPXCHG8B, CMPXCHG16B, DEC, INC, NEG, NOT, OR, SBB, SUB, XOR, XADD, XCHG:
if isMem(inst.Args[0]) {
hasLock = true
break
}
fallthrough
default:
inst.Prefix[lockIndex] |= PrefixInvalid
}
}
// In certain cases, all of which require a memory destination,
// the REPN and REP prefixes are interpreted as XACQUIRE and XRELEASE
// from the Intel Transactional Synchroniation Extensions (TSX).
//
// The specific rules are:
// (1) Any instruction with a valid LOCK prefix can have XACQUIRE or XRELEASE.
// (2) Any XCHG, which always has an implicit LOCK, can have XACQUIRE or XRELEASE.
// (3) Any 0x88-, 0x89-, 0xC6-, or 0xC7-opcode MOV can have XRELEASE.
if isMem(inst.Args[0]) {
if inst.Op == XCHG {
hasLock = true
}
for i := len(inst.Prefix) - 1; i >= 0; i-- {
p := inst.Prefix[i] &^ PrefixIgnored
switch p {
case PrefixREPN:
if hasLock {
inst.Prefix[i] = inst.Prefix[i]&PrefixIgnored | PrefixXACQUIRE
}
case PrefixREP:
if hasLock {
inst.Prefix[i] = inst.Prefix[i]&PrefixIgnored | PrefixXRELEASE
}
if inst.Op == MOV {
op := (inst.Opcode >> 24) &^ 1
if op == 0x88 || op == 0xC6 {
inst.Prefix[i] = inst.Prefix[i]&PrefixIgnored | PrefixXRELEASE
}
}
}
}
}
// If REP is used on a non-REP-able instruction, mark the prefix as ignored.
if repIndex >= 0 {
switch inst.Prefix[repIndex] {
case PrefixREP, PrefixREPN:
switch inst.Op {
// According to the manuals, the REP/REPE prefix applies to all of these,
// while the REPN applies only to some of them. However, both libopcodes
// and xed show both prefixes explicitly for all instructions, so we do the same.
// TODO(rsc): Perhaps this instruction class should be derived from the CSV.
case INSB, INSW, INSD,
MOVSB, MOVSW, MOVSD, MOVSQ,
OUTSB, OUTSW, OUTSD,
LODSB, LODSW, LODSD, LODSQ,
CMPSB, CMPSW, CMPSD, CMPSQ,
SCASB, SCASW, SCASD, SCASQ,
STOSB, STOSW, STOSD, STOSQ:
// ok
default:
inst.Prefix[repIndex] |= PrefixIgnored
}
}
}
// If REX was present, mark implicit if all the 1 bits were consumed.
if rexIndex >= 0 {
if rexUsed != 0 {
rexUsed |= PrefixREX
}
if rex&^rexUsed == 0 {
inst.Prefix[rexIndex] |= PrefixImplicit
}
}
inst.DataSize = dataMode
inst.AddrSize = addrMode
inst.Mode = mode
inst.Len = pos
return inst, nil
}