2 * Copyright (c) 2011 Google
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions are
7 * met: redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer;
9 * redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution;
12 * neither the name of the copyright holders nor the names of its
13 * contributors may be used to endorse or promote products derived from
14 * this software without specific prior written permission.
16 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
17 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
18 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
19 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
20 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
21 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
22 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
26 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 #include "arch/x86/decoder.hh"
31 #include "arch/x86/regs/misc.hh"
32 #include "base/logging.hh"
33 #include "base/trace.hh"
34 #include "base/types.hh"
35 #include "debug/Decoder.hh"
41 Decoder::doResetState()
43 origPC
= basePC
+ offset
;
44 DPRINTF(Decoder
, "Setting origPC to %#x\n", origPC
);
45 instBytes
= &decodePages
->lookup(origPC
);
52 emi
.opcode
.type
= BadOpcode
;
55 immediateCollected
= 0;
64 return FromCacheState
;
66 instBytes
->chunks
.clear();
74 // This function drives the decoder state machine.
76 // Some sanity checks. You shouldn't try to process more bytes if
77 // there aren't any, and you shouldn't overwrite an already decoded
82 if (state
== ResetState
)
83 state
= doResetState();
84 if (state
== FromCacheState
) {
85 state
= doFromCacheState();
87 instBytes
->chunks
.push_back(fetchChunk
);
90 // While there's still something to do...
91 while (!instDone
&& !outOfBytes
) {
92 uint8_t nextByte
= getNextByte();
95 state
= doPrefixState(nextByte
);
98 state
= doVex2Of2State(nextByte
);
101 state
= doVex2Of3State(nextByte
);
104 state
= doVex3Of3State(nextByte
);
107 state
= doVexOpcodeState(nextByte
);
109 case OneByteOpcodeState
:
110 state
= doOneByteOpcodeState(nextByte
);
112 case TwoByteOpcodeState
:
113 state
= doTwoByteOpcodeState(nextByte
);
115 case ThreeByte0F38OpcodeState
:
116 state
= doThreeByte0F38OpcodeState(nextByte
);
118 case ThreeByte0F3AOpcodeState
:
119 state
= doThreeByte0F3AOpcodeState(nextByte
);
122 state
= doModRMState(nextByte
);
125 state
= doSIBState(nextByte
);
127 case DisplacementState
:
128 state
= doDisplacementState();
131 state
= doImmediateState();
134 panic("Went to the error state in the decoder.\n");
136 panic("Unrecognized state! %d\n", state
);
142 Decoder::doFromCacheState()
144 DPRINTF(Decoder
, "Looking at cache state.\n");
145 if ((fetchChunk
& instBytes
->masks
[chunkIdx
]) !=
146 instBytes
->chunks
[chunkIdx
]) {
147 DPRINTF(Decoder
, "Decode cache miss.\n");
148 // The chached chunks didn't match what was fetched. Fall back to the
150 instBytes
->chunks
[chunkIdx
] = fetchChunk
;
151 instBytes
->chunks
.resize(chunkIdx
+ 1);
152 instBytes
->si
= NULL
;
154 fetchChunk
= instBytes
->chunks
[0];
155 offset
= origPC
% sizeof(MachInst
);
156 basePC
= origPC
- offset
;
158 } else if (chunkIdx
== instBytes
->chunks
.size() - 1) {
159 // We matched the cache, so use its value.
161 offset
= instBytes
->lastOffset
;
162 if (offset
== sizeof(MachInst
))
166 // We matched so far, but need to check more chunks.
169 return FromCacheState
;
173 // Either get a prefix and record it in the ExtMachInst, or send the
174 // state machine on to get the opcode(s).
176 Decoder::doPrefixState(uint8_t nextByte
)
178 uint8_t prefix
= Prefixes
[nextByte
];
179 State nextState
= PrefixState
;
180 // REX prefixes are only recognized in 64 bit mode.
181 if (prefix
== RexPrefix
&& emi
.mode
.submode
!= SixtyFourBitMode
)
186 // Operand size override prefixes
187 case OperandSizeOverride
:
188 DPRINTF(Decoder
, "Found operand size override prefix.\n");
189 emi
.legacy
.op
= true;
191 case AddressSizeOverride
:
192 DPRINTF(Decoder
, "Found address size override prefix.\n");
193 emi
.legacy
.addr
= true;
195 // Segment override prefixes
202 DPRINTF(Decoder
, "Found segment override.\n");
203 emi
.legacy
.seg
= prefix
;
206 DPRINTF(Decoder
, "Found lock prefix.\n");
207 emi
.legacy
.lock
= true;
210 DPRINTF(Decoder
, "Found rep prefix.\n");
211 emi
.legacy
.rep
= true;
214 DPRINTF(Decoder
, "Found repne prefix.\n");
215 emi
.legacy
.repne
= true;
218 DPRINTF(Decoder
, "Found Rex prefix %#x.\n", nextByte
);
222 DPRINTF(Decoder
, "Found VEX two-byte prefix %#x.\n", nextByte
);
224 nextState
= Vex2Of2State
;
227 DPRINTF(Decoder
, "Found VEX three-byte prefix %#x.\n", nextByte
);
229 nextState
= Vex2Of3State
;
232 nextState
= OneByteOpcodeState
;
236 panic("Unrecognized prefix %#x\n", nextByte
);
242 Decoder::doVex2Of2State(uint8_t nextByte
)
245 Vex2Of2 vex
= nextByte
;
262 emi
.legacy
.repne
= 1;
266 emi
.opcode
.type
= TwoByteOpcode
;
268 return VexOpcodeState
;
272 Decoder::doVex2Of3State(uint8_t nextByte
)
274 if (emi
.mode
.submode
!= SixtyFourBitMode
&& bits(nextByte
, 7, 6) == 0x3) {
275 // This was actually an LDS instruction. Reroute to that path.
277 emi
.opcode
.type
= OneByteOpcode
;
278 emi
.opcode
.op
= 0xC4;
279 return processOpcode(ImmediateTypeOneByte
, UsesModRMOneByte
,
280 nextByte
>= 0xA0 && nextByte
<= 0xA3);
284 Vex2Of3 vex
= nextByte
;
292 emi
.opcode
.type
= TwoByteOpcode
;
295 emi
.opcode
.type
= ThreeByte0F38Opcode
;
298 emi
.opcode
.type
= ThreeByte0F3AOpcode
;
301 // These encodings are reserved. Pretend this was an undefined
302 // instruction so the main decoder will behave correctly, and stop
303 // trying to interpret bytes.
304 emi
.opcode
.type
= TwoByteOpcode
;
305 emi
.opcode
.op
= 0x0B;
313 Decoder::doVex3Of3State(uint8_t nextByte
)
315 if (emi
.mode
.submode
!= SixtyFourBitMode
&& bits(nextByte
, 7, 6) == 0x3) {
316 // This was actually an LES instruction. Reroute to that path.
318 emi
.opcode
.type
= OneByteOpcode
;
319 emi
.opcode
.op
= 0xC5;
320 return processOpcode(ImmediateTypeOneByte
, UsesModRMOneByte
,
321 nextByte
>= 0xA0 && nextByte
<= 0xA3);
325 Vex3Of3 vex
= nextByte
;
342 emi
.legacy
.repne
= 1;
346 return VexOpcodeState
;
350 Decoder::doVexOpcodeState(uint8_t nextByte
)
352 DPRINTF(Decoder
, "Found VEX opcode %#x.\n", nextByte
);
354 emi
.opcode
.op
= nextByte
;
357 switch (emi
.opcode
.type
) {
359 return processOpcode(ImmediateTypeTwoByte
, UsesModRMTwoByte
);
360 case ThreeByte0F38Opcode
:
361 return processOpcode(ImmediateTypeThreeByte0F38
,
362 UsesModRMThreeByte0F38
);
363 case ThreeByte0F3AOpcode
:
364 return processOpcode(ImmediateTypeThreeByte0F3A
,
365 UsesModRMThreeByte0F3A
);
367 panic("Unrecognized opcode type %d.\n", emi
.opcode
.type
);
371 // Load the first opcode byte. Determine if there are more opcode bytes, and
372 // if not, what immediate and/or ModRM is needed.
374 Decoder::doOneByteOpcodeState(uint8_t nextByte
)
376 State nextState
= ErrorState
;
379 if (nextByte
== 0x0f) {
380 DPRINTF(Decoder
, "Found opcode escape byte %#x.\n", nextByte
);
381 nextState
= TwoByteOpcodeState
;
383 DPRINTF(Decoder
, "Found one byte opcode %#x.\n", nextByte
);
384 emi
.opcode
.type
= OneByteOpcode
;
385 emi
.opcode
.op
= nextByte
;
387 nextState
= processOpcode(ImmediateTypeOneByte
, UsesModRMOneByte
,
388 nextByte
>= 0xA0 && nextByte
<= 0xA3);
393 // Load the second opcode byte. Determine if there are more opcode bytes, and
394 // if not, what immediate and/or ModRM is needed.
396 Decoder::doTwoByteOpcodeState(uint8_t nextByte
)
398 State nextState
= ErrorState
;
400 if (nextByte
== 0x38) {
401 nextState
= ThreeByte0F38OpcodeState
;
402 DPRINTF(Decoder
, "Found opcode escape byte %#x.\n", nextByte
);
403 } else if (nextByte
== 0x3a) {
404 nextState
= ThreeByte0F3AOpcodeState
;
405 DPRINTF(Decoder
, "Found opcode escape byte %#x.\n", nextByte
);
407 DPRINTF(Decoder
, "Found two byte opcode %#x.\n", nextByte
);
408 emi
.opcode
.type
= TwoByteOpcode
;
409 emi
.opcode
.op
= nextByte
;
411 nextState
= processOpcode(ImmediateTypeTwoByte
, UsesModRMTwoByte
);
416 // Load the third opcode byte and determine what immediate and/or ModRM is
419 Decoder::doThreeByte0F38OpcodeState(uint8_t nextByte
)
423 DPRINTF(Decoder
, "Found three byte 0F38 opcode %#x.\n", nextByte
);
424 emi
.opcode
.type
= ThreeByte0F38Opcode
;
425 emi
.opcode
.op
= nextByte
;
427 return processOpcode(ImmediateTypeThreeByte0F38
, UsesModRMThreeByte0F38
);
430 // Load the third opcode byte and determine what immediate and/or ModRM is
433 Decoder::doThreeByte0F3AOpcodeState(uint8_t nextByte
)
437 DPRINTF(Decoder
, "Found three byte 0F3A opcode %#x.\n", nextByte
);
438 emi
.opcode
.type
= ThreeByte0F3AOpcode
;
439 emi
.opcode
.op
= nextByte
;
441 return processOpcode(ImmediateTypeThreeByte0F3A
, UsesModRMThreeByte0F3A
);
444 // Generic opcode processing which determines the immediate size, and whether
445 // or not there's a modrm byte.
447 Decoder::processOpcode(ByteTable
&immTable
, ByteTable
&modrmTable
,
450 State nextState
= ErrorState
;
451 const uint8_t opcode
= emi
.opcode
.op
;
453 // Figure out the effective operand size. This can be overriden to
454 // a fixed value at the decoder level.
457 logOpSize
= 3; // 64 bit operand size
458 else if (emi
.legacy
.op
)
463 // Set the actual op size.
464 emi
.opSize
= 1 << logOpSize
;
466 // Figure out the effective address size. This can be overriden to
467 // a fixed value at the decoder level.
470 logAddrSize
= altAddr
;
472 logAddrSize
= defAddr
;
474 // Set the actual address size.
475 emi
.addrSize
= 1 << logAddrSize
;
477 // Figure out the effective stack width. This can be overriden to
478 // a fixed value at the decoder level.
479 emi
.stackSize
= 1 << stack
;
481 // Figure out how big of an immediate we'll retreive based
483 int immType
= immTable
[opcode
];
485 immediateSize
= SizeTypeToSize
[logAddrSize
- 1][immType
];
487 immediateSize
= SizeTypeToSize
[logOpSize
- 1][immType
];
489 // Determine what to expect next.
490 if (modrmTable
[opcode
]) {
491 nextState
= ModRMState
;
494 nextState
= ImmediateState
;
497 nextState
= ResetState
;
503 // Get the ModRM byte and determine what displacement, if any, there is.
504 // Also determine whether or not to get the SIB byte, displacement, or
507 Decoder::doModRMState(uint8_t nextByte
)
509 State nextState
= ErrorState
;
510 ModRM modRM
= nextByte
;
511 DPRINTF(Decoder
, "Found modrm byte %#x.\n", nextByte
);
513 // Figure out 16 bit displacement size.
514 if ((modRM
.mod
== 0 && modRM
.rm
== 6) || modRM
.mod
== 2)
515 displacementSize
= 2;
516 else if (modRM
.mod
== 1)
517 displacementSize
= 1;
519 displacementSize
= 0;
521 // Figure out 32/64 bit displacement size.
522 if ((modRM
.mod
== 0 && modRM
.rm
== 5) || modRM
.mod
== 2)
523 displacementSize
= 4;
524 else if (modRM
.mod
== 1)
525 displacementSize
= 1;
527 displacementSize
= 0;
530 // The "test" instruction in group 3 needs an immediate, even though
531 // the other instructions with the same actual opcode don't.
532 if (emi
.opcode
.type
== OneByteOpcode
&& (modRM
.reg
& 0x6) == 0) {
533 if (emi
.opcode
.op
== 0xF6)
535 else if (emi
.opcode
.op
== 0xF7)
536 immediateSize
= (emi
.opSize
== 8) ? 4 : emi
.opSize
;
539 // If there's an SIB, get that next.
540 // There is no SIB in 16 bit mode.
541 if (modRM
.rm
== 4 && modRM
.mod
!= 3) {
542 // && in 32/64 bit mode)
543 nextState
= SIBState
;
544 } else if (displacementSize
) {
545 nextState
= DisplacementState
;
546 } else if (immediateSize
) {
547 nextState
= ImmediateState
;
550 nextState
= ResetState
;
552 // The ModRM byte is consumed no matter what.
558 // Get the SIB byte. We don't do anything with it at this point, other
559 // than storing it in the ExtMachInst. Determine if we need to get a
560 // displacement or immediate next.
562 Decoder::doSIBState(uint8_t nextByte
)
564 State nextState
= ErrorState
;
566 DPRINTF(Decoder
, "Found SIB byte %#x.\n", nextByte
);
568 if (emi
.modRM
.mod
== 0 && emi
.sib
.base
== 5)
569 displacementSize
= 4;
570 if (displacementSize
) {
571 nextState
= DisplacementState
;
572 } else if (immediateSize
) {
573 nextState
= ImmediateState
;
576 nextState
= ResetState
;
581 // Gather up the displacement, or at least as much of it as we can get.
583 Decoder::doDisplacementState()
585 State nextState
= ErrorState
;
587 getImmediate(immediateCollected
,
591 DPRINTF(Decoder
, "Collecting %d byte displacement, got %d bytes.\n",
592 displacementSize
, immediateCollected
);
594 if (displacementSize
== immediateCollected
) {
595 // Reset this for other immediates.
596 immediateCollected
= 0;
597 // Sign extend the displacement.
598 switch(displacementSize
)
601 emi
.displacement
= sext
<8>(emi
.displacement
);
604 emi
.displacement
= sext
<16>(emi
.displacement
);
607 emi
.displacement
= sext
<32>(emi
.displacement
);
610 panic("Undefined displacement size!\n");
612 DPRINTF(Decoder
, "Collected displacement %#x.\n",
615 nextState
= ImmediateState
;
618 nextState
= ResetState
;
621 emi
.dispSize
= displacementSize
;
624 nextState
= DisplacementState
;
628 // Gather up the immediate, or at least as much of it as we can get.
630 Decoder::doImmediateState()
632 State nextState
= ErrorState
;
634 getImmediate(immediateCollected
, emi
.immediate
, immediateSize
);
636 DPRINTF(Decoder
, "Collecting %d byte immediate, got %d bytes.\n",
637 immediateSize
, immediateCollected
);
639 if (immediateSize
== immediateCollected
) {
640 // Reset this for other immediates.
641 immediateCollected
= 0;
643 //XXX Warning! The following is an observed pattern and might
644 // not always be true!
646 // Instructions which use 64 bit operands but 32 bit immediates
647 // need to have the immediate sign extended to 64 bits.
648 // Instructions which use true 64 bit immediates won't be
649 // affected, and instructions that use true 32 bit immediates
651 switch(immediateSize
) {
653 emi
.immediate
= sext
<32>(emi
.immediate
);
656 emi
.immediate
= sext
<8>(emi
.immediate
);
659 DPRINTF(Decoder
, "Collected immediate %#x.\n",
662 nextState
= ResetState
;
664 nextState
= ImmediateState
;
669 Decoder::InstBytes
Decoder::dummy
;
670 Decoder::InstCacheMap
Decoder::instCacheMap
;
673 Decoder::decode(ExtMachInst mach_inst
, Addr addr
)
675 auto iter
= instMap
->find(mach_inst
);
676 if (iter
!= instMap
->end())
679 StaticInstPtr si
= decodeInst(mach_inst
);
680 (*instMap
)[mach_inst
] = si
;
685 Decoder::decode(PCState
&nextPC
)
692 StaticInstPtr
&si
= instBytes
->si
;
696 // We didn't match in the AddrMap, but we still populated an entry. Fix
697 // up its byte masks.
698 const int chunkSize
= sizeof(MachInst
);
700 instBytes
->lastOffset
= offset
;
702 Addr firstBasePC
= basePC
- (instBytes
->chunks
.size() - 1) * chunkSize
;
703 Addr firstOffset
= origPC
- firstBasePC
;
704 Addr totalSize
= instBytes
->lastOffset
- firstOffset
+
705 (instBytes
->chunks
.size() - 1) * chunkSize
;
706 int start
= firstOffset
;
707 instBytes
->masks
.clear();
710 int end
= start
+ totalSize
;
711 end
= (chunkSize
< end
) ? chunkSize
: end
;
712 int size
= end
- start
;
713 int idx
= instBytes
->masks
.size();
715 MachInst maskVal
= mask(size
* 8) << (start
* 8);
718 instBytes
->masks
.push_back(maskVal
);
719 instBytes
->chunks
[idx
] &= instBytes
->masks
[idx
];
724 si
= decode(emi
, origPC
);