dis_tables.c revision d267098be0828035f8b0f6b5e3d62423fa139ed0
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2006 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
/* Copyright (c) 1988 AT&T */
/* All Rights Reserved */
#pragma ident "%Z%%M% %I% %E% SMI"
#include "dis_tables.h"
/* BEGIN CSTYLED */
/*
* Disassembly begins in dis_distable, which is equivalent to the One-byte
* Opcode Map in the Intel IA32 ISA Reference (page A-6 in my copy). The
* decoding loops then traverse out through the other tables as necessary to
* decode a given instruction.
*
* The behavior of this file can be controlled by one of the following flags:
*
* DIS_TEXT Include text for disassembly
* DIS_MEM Include memory-size calculations
*
* Either or both of these can be defined.
*
* This file is not, and will never be, cstyled. If anything, the tables should
* be taken out another tab stop or two so nothing overlaps.
*/
/*
* These functions must be provided for the consumer to do disassembly.
*/
#ifdef DIS_TEXT
extern int strcmp(const char *, const char *);
#endif
#define TERM 0 /* used to indicate that the 'indirect' */
/* field terminates - no pointer. */
/* Used to decode instructions. */
typedef struct instable {
#ifdef DIS_TEXT
#endif
#ifdef DIS_MEM
#endif
} instable_t;
/*
* Instruction formats.
*/
enum {
MRw,
IMlw,
IMw,
IR,
OA,
AO,
MS,
SM,
Mv,
Mw,
M, /* register or memory */
Mb, /* register or memory, always byte sized */
MO, /* memory only (no registers) */
PREF,
R,
RA,
SEG,
MR,
RM,
IA,
MA,
SD,
AD,
SA,
D,
INM,
SO,
BD,
I,
P,
V,
DSHIFT, /* for double shift that has an 8-bit immediate */
U,
NORM, /* instructions w/o ModR/M byte, no memory access */
IMPLMEM, /* instructions w/o ModR/M byte, implicit mem access */
O, /* for call */
JTAB, /* jump table */
IMUL, /* for 186 iimul instr */
CBW, /* so data16 can be evaluated for cbw and variants */
MvI, /* for 186 logicals */
ENTER, /* for 186 enter instr */
RMw, /* for 286 arpl instr */
Ib, /* for push immediate byte */
F, /* for 287 instructions */
FF, /* for 287 instructions */
FFC, /* for 287 instructions */
DM, /* 16-bit data */
AM, /* 16-bit addr */
LSEG, /* for 3-bit seg reg encoding */
MIb, /* for 386 logicals */
SREG, /* for 386 special registers */
PREFIX, /* a REP instruction prefix */
LOCK, /* a LOCK instruction prefix */
INT3, /* The int 3 instruction, which has a fake operand */
INTx, /* The normal int instruction, with explicit int num */
DSHIFTcl, /* for double shift that implicitly uses %cl */
CWD, /* so data16 can be evaluated for cwd and variants */
RET, /* single immediate 16-bit operand */
MOVZ, /* for movs and movz, with different size operands */
XADDB, /* for xaddb */
MOVSXZ, /* AMD64 mov sign extend 32 to 64 bit instruction */
/*
*/
MMOSH, /* Prefixable MMX mm,imm8 */
MMSH, /* MMX mm,imm8 */
XMMOX3, /* Prefixable SIMD xmm -> r32 */
XMMOM, /* Prefixable SIMD xmm -> mem */
XMMOMS, /* Prefixable SIMD mem -> xmm */
XMMXIMPL, /* SIMD xmm -> xmm (mem) */
XMM3P, /* SIMD xmm -> r32,imm8 */
XMMM, /* SIMD mem -> xmm */
XMMMS, /* SIMD xmm -> mem */
XMMSH, /* SIMD xmm,imm8 */
XMMX3, /* SIMD xmm -> r32 */
XMMMX, /* SIMD mm -> xmm */
XMMXM, /* SIMD xmm -> mm */
XMMFENCE, /* SIMD lfence or mfence */
XMMSFNC /* SIMD sfence (none or mem) */
};
/*
** Register numbers for the i386
*/
#define EAX_REGNO 0
#define ECX_REGNO 1
#define EDX_REGNO 2
#define EBX_REGNO 3
#define ESP_REGNO 4
#define EBP_REGNO 5
#define ESI_REGNO 6
#define EDI_REGNO 7
/*
* modes for immediate values
*/
#define MODE_NONE 0
/*
* The letters used in these macros are:
* IND - indirect to another to another table
* "T" - means to Terminate indirections (this is the final opcode)
* "S" - means "operand length suffix required"
* "NS" - means "no suffix" which is the operand length suffix of the opcode
* "Z" - means instruction size arg required
* "u" - means the opcode is invalid in IA32 but valid in amd64
* "x" - means the opcode is invalid in amd64, but not IA32
* "y" - means the operand size is always 64 bits in 64 bit mode
*/
#else
#endif
#ifdef DIS_TEXT
/*
* this decodes the r_m field for mode's 0, 1, 2 in 16 bit mode
*/
"(%bx,%si)", "(%bx,%di)", "(%bp,%si)", "(%bp,%di)", "(%si)", "(%di)", "",
"(%bx)",
"(%bx,%si)", "(%bx,%di)", "(%bp,%si)", "(%bp,%di)", "(%si)", "(%di", "(%bp)",
"(%bx)",
"(%bx,%si)", "(%bx,%di)", "(%bp,%si)", "(%bp,%di)", "(%si)", "(%di)", "(%bp)",
"(%bx)",
};
/*
* This decodes 32 bit addressing mode r_m field for modes 0, 1, 2
*/
const char *const dis_addr32_mode0[16] = {
"(%eax)", "(%ecx)", "(%edx)", "(%ebx)", "", "", "(%esi)", "(%edi)",
"(%r8d)", "(%r9d)", "(%r10d)", "(%r11d)", "", "", "(%r14d)", "(%r15d)"
};
const char *const dis_addr32_mode12[16] = {
"(%eax)", "(%ecx)", "(%edx)", "(%ebx)", "", "(%ebp)", "(%esi)", "(%edi)",
"(%r8d)", "(%r9d)", "(%r10d)", "(%r11d)", "", "(%r13d)", "(%r14d)", "(%r15d)"
};
/*
* This decodes 64 bit addressing mode r_m field for modes 0, 1, 2
*/
const char *const dis_addr64_mode0[16] = {
"(%rax)", "(%rcx)", "(%rdx)", "(%rbx)", "", "(%rip)", "(%rsi)", "(%rdi)",
"(%r8)", "(%r9)", "(%r10)", "(%r11)", "(%r12)", "(%rip)", "(%r14)", "(%r15)"
};
const char *const dis_addr64_mode12[16] = {
"(%rax)", "(%rcx)", "(%rdx)", "(%rbx)", "", "(%rbp)", "(%rsi)", "(%rdi)",
"(%r8)", "(%r9)", "(%r10)", "(%r11)", "(%r12)", "(%r13)", "(%r14)", "(%r15)"
};
/*
* decode for scale from SIB byte
*/
/*
* register decoding for normal references to registers (ie. not addressing)
*/
const char *const dis_REG8[16] = {
"%al", "%cl", "%dl", "%bl", "%ah", "%ch", "%dh", "%bh",
"%r8b", "%r9b", "%r10b", "%r11b", "%r12b", "%r13b", "%r14b", "%r15b"
};
const char *const dis_REG8_REX[16] = {
"%al", "%cl", "%dl", "%bl", "%spl", "%bpl", "%sil", "%dil",
"%r8b", "%r9b", "%r10b", "%r11b", "%r12b", "%r13b", "%r14b", "%r15b"
};
const char *const dis_REG16[16] = {
"%ax", "%cx", "%dx", "%bx", "%sp", "%bp", "%si", "%di",
"%r8w", "%r9w", "%r10w", "%r11w", "%r12w", "%r13w", "%r14w", "%r15w"
};
const char *const dis_REG32[16] = {
"%eax", "%ecx", "%edx", "%ebx", "%esp", "%ebp", "%esi", "%edi",
"%r8d", "%r9d", "%r10d", "%r11d", "%r12d", "%r13d", "%r14d", "%r15d"
};
const char *const dis_REG64[16] = {
"%rax", "%rcx", "%rdx", "%rbx", "%rsp", "%rbp", "%rsi", "%rdi",
"%r8", "%r9", "%r10", "%r11", "%r12", "%r13", "%r14", "%r15"
};
const char *const dis_DEBUGREG[16] = {
"%db0", "%db1", "%db2", "%db3", "%db4", "%db5", "%db6", "%db7",
"%db8", "%db9", "%db10", "%db11", "%db12", "%db13", "%db14", "%db15"
};
const char *const dis_CONTROLREG[16] = {
"%cr0", "%cr1", "%cr2", "%cr3", "%cr4", "%cr5?", "%cr6?", "%cr7?",
"%cr8", "%cr9?", "%cr10?", "%cr11?", "%cr12?", "%cr13?", "%cr14?", "%cr15?"
};
const char *const dis_TESTREG[16] = {
"%tr0?", "%tr1?", "%tr2?", "%tr3", "%tr4", "%tr5", "%tr6", "%tr7",
"%tr0?", "%tr1?", "%tr2?", "%tr3", "%tr4", "%tr5", "%tr6", "%tr7"
};
const char *const dis_MMREG[16] = {
"%mm0", "%mm1", "%mm2", "%mm3", "%mm4", "%mm5", "%mm6", "%mm7",
"%mm0", "%mm1", "%mm2", "%mm3", "%mm4", "%mm5", "%mm6", "%mm7"
};
const char *const dis_XMMREG[16] = {
"%xmm0", "%xmm1", "%xmm2", "%xmm3", "%xmm4", "%xmm5", "%xmm6", "%xmm7",
"%xmm8", "%xmm9", "%xmm10", "%xmm11", "%xmm12", "%xmm13", "%xmm14", "%xmm15"
};
const char *const dis_SEGREG[16] = {
"%es", "%cs", "%ss", "%ds", "%fs", "%gs", "<reserved>", "<reserved>",
"%es", "%cs", "%ss", "%ds", "%fs", "%gs", "<reserved>", "<reserved>"
};
/*
* SIMD predicate suffixes
*/
const char *const dis_PREDSUFFIX[8] = {
"eq", "lt", "le", "unord", "neq", "nlt", "nle", "ord"
};
#endif /* DIS_TEXT */
/*
* "decode table" for 64 bit mode MOVSXD instruction (opcode 0x63)
*/
/*
* "decode table" for pause and clflush instructions
*/
/*
* Decode table for 0x0F00 opcodes
*/
};
/*
* Decode table for 0x0F01 opcodes
*/
};
/*
* Decode table for 0x0F18 opcodes -- SIMD prefetch
*/
/* [0] */ TNS("prefetchnta",PREF),TNS("prefetcht0",PREF), TNS("prefetcht1",PREF), TNS("prefetcht2",PREF),
};
/*
*/
};
/*
* Decode table for 0x0FBA opcodes
*/
};
/*
* Decode table for 0x0FC7 opcode
*/
};
/*
* Decode table for 0x0FC8 opcode -- 486 bswap instruction
*
*bit pattern: 0000 1111 1100 1reg
*/
};
/*
* Decode table for 0x0F71, 0x0F72, and 0x0F73 opcodes -- MMX instructions
*/
{
}, {
}, {
}, {
} };
/*
* Decode table for SIMD extensions to above 0x0F71-0x0F73 opcodes.
*/
};
/*
* SIMD instructions have been wedged into the existing IA32 instruction
* set through the use of prefixes. That is, while 0xf0 0x58 may be
* addps, 0xf3 0xf0 0x58 (literally, repz addps) is a completely different
* instruction - addss. At present, three prefixes have been coopted in
* this manner - address size (0x66), repnz (0xf2) and repz (0xf3). The
* following tables are used to provide the prefixed instruction names.
* The arrays are sparse, but they're fast.
*/
/*
* Decode table for SIMD instructions with the address size (0x66) prefix.
*/
/* [10] */ TNSZ("movupd",XMM,16), TNSZ("movupd",XMMS,16), TNSZ("movlpd",XMMM,8), TNSZ("movlpd",XMMMS,8),
/* [14] */ TNSZ("unpcklpd",XMM,16),TNSZ("unpckhpd",XMM,16),TNSZ("movhpd",XMMM,8), TNSZ("movhpd",XMMMS,8),
/* [28] */ TNSZ("movapd",XMM,16), TNSZ("movapd",XMMS,16), TNSZ("cvtpi2pd",XMMOMX,8),TNSZ("movntpd",XMMOMS,16),
/* [2C] */ TNSZ("cvttpd2pi",XMMXMM,16),TNSZ("cvtpd2pi",XMMXMM,16),TNSZ("ucomisd",XMM,8),TNSZ("comisd",XMM,8),
/* [58] */ TNSZ("addpd",XMM,16), TNSZ("mulpd",XMM,16), TNSZ("cvtpd2ps",XMM,16),TNSZ("cvtps2dq",XMM,16),
/* [60] */ TNSZ("punpcklbw",XMM,16),TNSZ("punpcklwd",XMM,16),TNSZ("punpckldq",XMM,16),TNSZ("packsswb",XMM,16),
/* [64] */ TNSZ("pcmpgtb",XMM,16), TNSZ("pcmpgtw",XMM,16), TNSZ("pcmpgtd",XMM,16), TNSZ("packuswb",XMM,16),
/* [68] */ TNSZ("punpckhbw",XMM,16),TNSZ("punpckhwd",XMM,16),TNSZ("punpckhdq",XMM,16),TNSZ("packssdw",XMM,16),
/* [6C] */ TNSZ("punpcklqdq",XMM,16),TNSZ("punpckhqdq",XMM,16),TNSZ("movd",XMM3MX,4),TNSZ("movdqa",XMM,16),
/* [D8] */ TNSZ("psubusb",XMM,16), TNSZ("psubusw",XMM,16), TNSZ("pminub",XMM,16), TNSZ("pand",XMM,16),
/* [DC] */ TNSZ("paddusb",XMM,16), TNSZ("paddusw",XMM,16), TNSZ("pmaxub",XMM,16), TNSZ("pandn",XMM,16),
/* [E4] */ TNSZ("pmulhuw",XMM,16), TNSZ("pmulhw",XMM,16), TNSZ("cvttpd2dq",XMM,16),TNSZ("movntdq",XMMS,16),
/* [EC] */ TNSZ("paddsb",XMM,16), TNSZ("paddsw",XMM,16), TNSZ("pmaxsw",XMM,16), TNSZ("pxor",XMM,16),
/* [F4] */ TNSZ("pmuludq",XMM,16), TNSZ("pmaddwd",XMM,16), TNSZ("psadbw",XMM,16), TNSZ("maskmovdqu", XMMXIMPL,16),
};
/*
* Decode table for SIMD instructions with the repnz (0xf2) prefix.
*/
};
/*
* Decode table for SIMD instructions with the repz (0xf3) prefix.
*/
/* [58] */ TNSZ("addss",XMM,4), TNSZ("mulss",XMM,4), TNSZ("cvtss2sd",XMM,4), TNSZ("cvttps2dq",XMM,16),
};
/*
* Decode table for 0x0F opcodes
*/
{
}, {
/* [10] */ TNSZ("movups",XMMO,16), TNSZ("movups",XMMOS,16),TNSZ("movlps",XMMO,8), TNSZ("movlps",XMMOS,8),
/* [14] */ TNSZ("unpcklps",XMMO,16),TNSZ("unpckhps",XMMO,16),TNSZ("movhps",XMMOM,8),TNSZ("movhps",XMMOMS,8),
}, {
/* [28] */ TNSZ("movaps",XMMO,16), TNSZ("movaps",XMMOS,16),TNSZ("cvtpi2ps",XMMOMX,8),TNSZ("movntps",XMMOS,16),
/* [2C] */ TNSZ("cvttps2pi",XMMOXMM,8),TNSZ("cvtps2pi",XMMOXMM,8),TNSZ("ucomiss",XMMO,4),TNSZ("comiss",XMMO,4),
}, {
}, {
}, {
/* [50] */ TNS("movmskps",XMMOX3), TNSZ("sqrtps",XMMO,16), TNSZ("rsqrtps",XMMO,16),TNSZ("rcpps",XMMO,16),
/* [54] */ TNSZ("andps",XMMO,16), TNSZ("andnps",XMMO,16), TNSZ("orps",XMMO,16), TNSZ("xorps",XMMO,16),
/* [58] */ TNSZ("addps",XMMO,16), TNSZ("mulps",XMMO,16), TNSZ("cvtps2pd",XMMO,8),TNSZ("cvtdq2ps",XMMO,16),
/* [5C] */ TNSZ("subps",XMMO,16), TNSZ("minps",XMMO,16), TNSZ("divps",XMMO,16), TNSZ("maxps",XMMO,16),
}, {
/* [60] */ TNSZ("punpcklbw",MMO,4),TNSZ("punpcklwd",MMO,4),TNSZ("punpckldq",MMO,4),TNSZ("packsswb",MMO,8),
/* [64] */ TNSZ("pcmpgtb",MMO,8), TNSZ("pcmpgtw",MMO,8), TNSZ("pcmpgtd",MMO,8), TNSZ("packuswb",MMO,8),
/* [68] */ TNSZ("punpckhbw",MMO,8),TNSZ("punpckhwd",MMO,8),TNSZ("punpckhdq",MMO,8),TNSZ("packssdw",MMO,8),
}, {
}, {
}, {
}, {
}, {
}, {
}, {
}, {
/* [E4] */ TNSZ("pmulhuw",MMO,8), TNSZ("pmulhw",MMO,8), TNS("INVALID",XMMO), TNSZ("movntq",MMOMS,8),
}, {
/* [F4] */ TNSZ("pmuludq",MMO,8), TNSZ("pmaddwd",MMO,8), TNSZ("psadbw",MMO,8), TNSZ("maskmovq",MMOIMPL,8),
} };
/*
* Decode table for 0x80 opcodes
*/
};
/*
* Decode table for 0x81 opcodes.
*/
};
/*
* Decode table for 0x82 opcodes.
*/
};
/*
* Decode table for 0x83 opcodes.
*/
};
/*
* Decode table for 0xC0 opcodes.
*/
};
/*
* Decode table for 0xD0 opcodes.
*/
};
/*
* Decode table for 0xC1 opcodes.
* 186 instruction set
*/
};
/*
* Decode table for 0xD1 opcodes.
*/
};
/*
* Decode table for 0xD2 opcodes.
*/
};
/*
* Decode table for 0xD3 opcodes.
*/
};
/*
* Decode table for 0xF6 opcodes.
*/
};
/*
* Decode table for 0xF7 opcodes.
*/
};
/*
* Decode table for 0xFE opcodes.
*/
};
/*
* Decode table for 0xFF opcodes.
*/
};
/* for 287 instructions, which are a mess to decode */
{
/* bit pattern: 1101 1xxx MODxx xR/M */
}, {
}, {
}, {
}, {
}, {
}, {
}, {
} };
{
/* bit pattern: 1101 1xxx 11xx xREG */
}, {
}, {
}, {
}, {
}, {
}, {
}, {
} };
{
/* bit pattern: 1101 1001 111x xxxx */
}, {
}, {
}, {
} };
/* bit pattern: 1101 1011 111x xxxx */
};
/* bit pattern: 1101 1011 11yy yxxx */
};
/* bit pattern: 1101 1010 11yy yxxx */
};
/*
* Main decode table for the op codes. The first two nibbles
* will be used as an index into the table. If there is a
* a need to further decode an instruction, the array to be
* referenced is indicated with the other two entries being
* empty.
*/
{
}, {
}, {
}, {
}, {
}, {
}, {
/* [6,C] */ TNSZ("insb",IMPLMEM,1), TSZ("ins",IMPLMEM,4), TNSZ("outsb",IMPLMEM,1),TSZ("outs",IMPLMEM,4),
}, {
}, {
}, {
}, {
}, {
}, {
}, {
/* 287 instructions. Note that although the indirect field */
/* indicates opFP1n2 for further decoding, this is not necessarily */
/* the case since the opFP arrays are not partitioned according to key1 */
/* and key2. opFP1n2 is given only to indicate that we haven't */
/* finished decoding the instruction. */
}, {
}, {
} };
/* END CSTYLED */
/*
* common functions to decode and disassemble an x86 or amd64 instruction
*/
/*
* These are the individual fields of a REX prefix. Note that a REX
* prefix with none of these set is still needed to:
* - use the MOVSXD (sign extend 32 to 64 bits) instruction
* - access the %sil, %dil, %bpl, %spl registers
*/
/*
* Even in 64 bit mode, usually only 4 byte immediate operands are supported.
*/
/*
* Just a bunch of useful macros.
*/
#define BYTE_OPND 0 /* w-bit value indicating byte register */
/*
* Get the next byte and separate the op code into the high and low nibbles.
*/
static int
{
int byte;
/*
* x86 instructions have a maximum length of 15 bytes. Bail out if
* we try to read more.
*/
if (x->d86_len >= 15)
return (x->d86_error = 1);
if (x->d86_error)
return (1);
if (byte < 0)
return (x->d86_error = 1);
return (0);
}
/*
* Get and decode an SIB (scaled index base) byte
*/
static void
{
int byte;
if (x->d86_error)
return;
if (byte < 0) {
x->d86_error = 1;
return;
}
}
/*
* Get the byte following the op code and separate it into the
* mode, register, and r/m fields.
*/
static void
{
if (x->d86_got_modrm == 0) {
if (x->d86_rmindex == -1)
x->d86_rmindex = x->d86_len;
x->d86_got_modrm = 1;
}
}
/*
* Adjust register selection based on any REX prefix bits present.
*/
/*ARGSUSED*/
static void
{
if (rex_prefix & REX_B)
*reg += 8;
} else {
*reg += 8;
*r_m += 8;
}
}
/*
* Get an immediate operand of the given size, with sign extension.
*/
static void
{
int i;
int byte;
int valsize;
switch (wbit) {
case BYTE_OPND:
valsize = 1;
break;
case LONG_OPND:
if (x->d86_opnd_size == SIZE16)
valsize = 2;
else if (x->d86_opnd_size == SIZE32)
valsize = 4;
else
valsize = 8;
break;
case MM_OPND:
case XMM_OPND:
case SEG_OPND:
case CONTROL_OPND:
case DEBUG_OPND:
case TEST_OPND:
break;
case WORD_OPND:
valsize = 2;
break;
}
if (x->d86_error)
return;
for (i = 0; i < size; ++i) {
if (byte < 0) {
x->d86_error = 1;
return;
}
}
/* Do sign extension */
for (; i < sizeof (uint64_t); i++)
}
#ifdef DIS_TEXT
x->d86_imm_bytes += size;
#endif
}
/*
* Get an ip relative operand of the given size, with sign extension.
*/
static void
{
#ifdef DIS_TEXT
#endif
}
/*
* Check to see if there is a segment override prefix pending.
* If so, print it in the current 'operand' location and set
* the override flag back to false.
*/
/*ARGSUSED*/
static void
{
#ifdef DIS_TEXT
if (x->d86_seg_prefix) {
x->d86_seg_prefix, PFIXLEN);
}
#endif
x->d86_seg_prefix = NULL;
}
/*
* Process a single instruction Register or Memory operand.
*
* mode = addressing mode from ModRM byte
* r_m = r_m (or reg if mode == 3) field from ModRM byte
* wbit = indicates which register (8bit, 16bit, ... MMX, etc.) set to use.
* o = index of operand that we are processing (0, 1 or 2)
*
* the value of reg or r_m must have already been adjusted for any REX prefix.
*/
/*ARGSUSED*/
static void
{
int have_SIB = 0; /* flag presence of scale-index-byte */
int dispsize; /* size of displacement in bytes */
#ifdef DIS_TEXT
#endif
if (x->d86_error)
return;
/*
* first handle a simple register
*/
#ifdef DIS_TEXT
switch (wbit) {
case MM_OPND:
break;
case XMM_OPND:
break;
case SEG_OPND:
break;
case CONTROL_OPND:
break;
case DEBUG_OPND:
break;
case TEST_OPND:
break;
case BYTE_OPND:
if (x->d86_rex_prefix == 0)
else
break;
case WORD_OPND:
break;
case LONG_OPND:
if (x->d86_opnd_size == SIZE16)
else if (x->d86_opnd_size == SIZE32)
else
break;
}
#endif /* DIS_TEXT */
return;
}
/*
* if symbolic representation, skip override prefix, if any
*/
/*
* Handle 16 bit memory references first, since they decode
* the mode values more simply.
* mode 1 is r_m + 8 bit displacement
* mode 2 is r_m + 16 bit displacement
* mode 0 is just r_m, unless r_m is 6 which is 16 bit disp
*/
if (x->d86_addr_size == SIZE16) {
else if (mode == 1)
#ifdef DIS_TEXT
else if (mode == 0)
else
#endif
return;
}
/*
* 32 and 64 bit addressing modes are more complex since they
* can involve an SIB (scaled index and base) byte to decode.
*/
have_SIB = 1;
if (x->d86_error)
return;
if (x->d86_rex_prefix & REX_B)
base += 8;
if (x->d86_rex_prefix & REX_X)
index += 8;
} else {
}
/*
* Compute the displacement size and get its bytes
*/
dispsize = 0;
if (mode == 1)
dispsize = 1;
else if (mode == 2)
dispsize = 4;
dispsize = 4;
if (dispsize > 0) {
if (x->d86_error)
return;
}
#ifdef DIS_TEXT
if (dispsize > 0)
if (have_SIB == 0) {
if (mode == 0)
OPLEN);
else
OPLEN);
} else {
if (mode == 0) {
OPLEN);
if (r_m == 5) {
}
} else {
OPLEN);
}
}
} else {
uint_t need_paren = 0;
char **regs;
else
/*
* print the base (if any)
*/
need_paren = 1;
}
} else {
need_paren = 1;
}
/*
* print the index (if any)
*/
} else
if (need_paren)
}
#endif
}
/*
* Operand sequence for standard instruction involving one register
* wbit indicates a byte(0) or opnd_size(1) operation
* vbit indicates direction (0 for "opcode r,r_m") or (1 for "opcode r_m, r")
*/
}
/*
* Similar to above, but allows for the two operands to be of different
* classes (ie. wbit).
* wbit is for the r_m operand
* w2 is for the reg operand
*/
}
/*
* Similar, but for 2 operands plus an immediate.
*/
}
/*
* Dissassemble a single x86 or amd64 instruction.
*
* Mode determines the default operating mode (SIZE16, SIZE32 or SIZE64)
* for interpreting instructions.
*
* returns non-zero for bad opcode
*/
int
{
#ifdef DIS_TEXT
uint_t i;
#endif
#ifdef DIS_MEM
#else
#define NOMEM /* nothing */
#endif
/*
* legacy prefixes come in 5 flavors, you should have only one of each
*/
uint_t opnd_size_prefix = 0;
uint_t addr_size_prefix = 0;
uint_t segment_prefix = 0;
uint_t lock_prefix = 0;
uint_t rep_prefix = 0;
x->d86_len = 0;
x->d86_rmindex = -1;
x->d86_error = 0;
#ifdef DIS_TEXT
x->d86_numopnds = 0;
x->d86_seg_prefix = NULL;
x->d86_mnem[0] = 0;
for (i = 0; i < 3; ++i) {
x->d86_opnd[i].d86_prefix[0] = 0;
x->d86_opnd[i].d86_value_size = 0;
}
#endif
x->d86_error = 0;
x->d86_memsize = 0;
} else {
}
/*
* Get one opcode byte and check for zero padding that follows
* jump tables.
*/
goto error;
#ifdef DIS_TEXT
#endif
goto done;
}
/*
* Gather up legacy x86 prefix bytes.
*/
for (;;) {
switch (dp->it_adrmode) {
case PREFIX:
break;
case LOCK:
break;
case OVERRIDE:
#ifdef DIS_TEXT
#endif
goto error;
break;
case AM:
break;
case DM:
break;
}
if (which_prefix == NULL)
break;
goto error;
}
/*
* Handle amd64 mode PREFIX values.
* We might have a REX prefix (opcodes 0x40-0x4f)
*/
segment_prefix = 0;
if (opcode1 == 0x4) {
goto error;
}
}
/*
* Deal with selection of operand and address size now.
* Note that the REX.W bit being set causes opnd_size_prefix to be
* ignored.
*/
if (rex_prefix & REX_W)
else if (opnd_size_prefix)
if (addr_size_prefix)
if (opnd_size_prefix)
if (addr_size_prefix)
} else {
if (opnd_size_prefix)
if (addr_size_prefix)
}
/*
* The pause instruction - a repz'd nop. This doesn't fit
* with any of the other prefix goop added for SSE, so we'll
* special-case it here.
*/
rep_prefix = 0;
}
/*
* Some 386 instructions have 2 bytes of opcode before the mod_r/m
* byte so we may need to perform a table indirection.
*/
goto error;
opcode_bytes = 2;
goto error;
opcode_bytes = 3;
} else {
}
}
/*
* If still not at a TERM decode entry, then a ModRM byte
* exists and its fields further decode the instruction.
*/
x->d86_got_modrm = 0;
if (x->d86_error)
goto error;
/*
* decode 287 instructions (D8-DF) from opcodeN
*/
else if (mode == 0x3)
dp = (instable_t *)
else
dp = (instable_t *)
} else {
}
}
/*
* In amd64 bit mode, ARPL opcode is changed to MOVSXD
* (sign extend 32bit to 64 bit)
*/
/*
* at this point we should have a correct (or invalid) opcode
*/
goto error;
goto error;
/*
*/
switch (dp->it_adrmode) {
case MMO:
case MMOIMPL:
case MMO3P:
case MMOM3:
case MMOMS:
case MMOPM:
case MMOPRM:
case MMOS:
case XMMO:
case XMMOM:
case XMMOMS:
case XMMOPM:
case XMMOS:
case XMMOMX:
case XMMOX3:
case XMMOXMM:
/*
* This is horrible. Some SIMD instructions take the
* form 0x0F 0x?? ..., which is easily decoded using the
* existing tables. Other SIMD instructions use various
* prefix bytes to overload existing instructions. For
* Example, addps is F0, 58, whereas addss is F3 (repz),
* F0, 58. Presumably someone got a raise for this.
*
* If we see one of the instructions which can be
* modified in this way (if we've got one of the SIMDO*
* address modes), we'll check to see if the last prefix
* was a repz. If it was, we strip the prefix from the
* mnemonic, and we indirect using the dis_opSIMDrepz
* table.
*/
/*
* Calculate our offset in dis_op0F
*/
goto error;
sizeof (instable_t);
/*
* Rewrite if this instruction used one of the magic prefixes.
*/
if (rep_prefix) {
if (rep_prefix == 0xf2)
else
rep_prefix = 0;
} else if (opnd_size_prefix) {
opnd_size_prefix = 0;
}
break;
case MMOSH:
/*
* As with the "normal" SIMD instructions, the MMX
* shuffle instructions are overloaded. These
* instructions, however, are special in that they use
* an extra byte, and thus an extra table. As of this
* writing, they only use the opnd_size prefix.
*/
/*
* Calculate our offset in dis_op0F7123
*/
sizeof (dis_op0F7123))
goto error;
if (opnd_size_prefix) {
sizeof (instable_t);
opnd_size_prefix = 0;
}
break;
}
/*
* In 64 bit mode, some opcodes automatically use opnd_size == SIZE64.
*/
#ifdef DIS_TEXT
/*
* At this point most instructions can format the opcode mnemonic
* including the prefixes.
*/
if (lock_prefix)
if (rep_prefix == 0xf2)
else if (rep_prefix == 0xf3)
goto error;
/* It's a cmovx.yy. Replace the suffix x */
for (i = 5; i < OPLEN; i++) {
if (x->d86_mnem[i] == '.')
break;
}
} else {
OPLEN);
}
}
}
#endif
/*
* Process operands based on the addressing modes.
*/
x->d86_rex_prefix = rex_prefix;
x->d86_opnd_size = opnd_size;
x->d86_addr_size = addr_size;
switch (dp->it_adrmode) {
/*
* into 64 bit register values
*/
case MOVSXZ:
#ifdef DIS_TEXT
if (rex_prefix == 0)
#endif
x->d86_opnd_size = SIZE64;
break;
/*
* movsbl movsbw movsbq (0x0FBE) or movswl movswq (0x0FBF)
* movzbl movzbw movzbq (0x0FB6) or movzwl movzwq (0x0FB7)
* wbit lives in 2nd byte, note that operands
* are different sized
*/
case MOVZ:
if (rex_prefix & REX_W) {
/* target register size = 64 bit */
}
break;
/*
* imul instruction, with either 8-bit or longer immediate
* opcode 0x6B for byte, sign-extended displacement, 0x69 for word(s)
*/
case IMUL:
break;
/* memory or register operand to register, with 'w' bit */
case MRw:
break;
/* register to memory or register operand, with 'w' bit */
/* arpl happens to fit here also because it is odd */
case RMw:
if (opcode_bytes == 2)
else
break;
/* xaddb instruction */
case XADDB:
wbit = 0;
break;
/* MMX register to memory or register operand */
case MMS:
case MMOS:
#ifdef DIS_TEXT
#else
#endif
break;
/* MMX register to memory */
case MMOMS:
goto error;
break;
/* Double shift. Has immediate operand specifying the shift. */
case DSHIFT:
break;
/*
* Double shift. With no immediate operand, specifies using %cl.
*/
case DSHIFTcl:
break;
/* immediate to memory or register operand */
case IMlw:
/*
* Have long immediate for opcode 0x81, but not 0x80 nor 0x83
*/
break;
/* immediate to memory or register operand with the */
/* 'w' bit present */
case IMw:
break;
/* immediate to register with register in low 3 bits */
/* of op code */
case IR:
/* w-bit here (with regs) is bit 3 */
break;
/* MMX immediate shift of register */
case MMSH:
case MMOSH:
goto mm_shift; /* in next case */
/* SIMD immediate shift of register */
case XMMSH:
break;
/* accumulator to memory operand */
case AO:
vbit = 1;
/*FALLTHROUGH*/
/* memory operand to accumulator */
case OA:
#ifdef DIS_TEXT
#endif
break;
/* segment register to memory or register operand */
case SM:
vbit = 1;
/*FALLTHROUGH*/
/* memory or register operand to segment register */
case MS:
break;
/*
* rotate or shift instructions, which may shift by 1 or
* consult the cl register, depending on the 'v' bit
*/
case Mv:
#ifdef DIS_TEXT
if (vbit) {
} else {
}
#endif
break;
/*
* immediate rotate or shift instructions
*/
case MvI:
break;
/* bit test instructions */
case MIb:
goto normal_imm_mem;
/* single memory or register operand with 'w' bit present */
case Mw:
break;
case SWAPGS:
#ifdef DIS_TEXT
#endif
break;
}
/*FALLTHROUGH*/
/* prefetch instruction - memory operand, but no memory acess */
case PREF:
/*FALLTHROUGH*/
/* single memory or register operand */
case M:
goto just_mem;
/* single memory or register byte operand */
case Mb:
goto just_mem;
case MO:
/* Similar to M, but only memory (no direct registers) */
if (mode == 3)
goto error;
break;
/* move special register to register or reverse if vbit */
case SREG:
switch (opcode5) {
case 2:
vbit = 1;
/*FALLTHROUGH*/
case 0:
wbit = CONTROL_OPND;
break;
case 3:
vbit = 1;
/*FALLTHROUGH*/
case 1:
wbit = DEBUG_OPND;
break;
case 6:
vbit = 1;
/*FALLTHROUGH*/
case 4:
break;
}
break;
/*
* single register operand with register in the low 3
* bits of op code
*/
case R:
if (opcode_bytes == 2)
else
break;
/*
* register to accumulator with register in the low 3
* bits of op code, xchg instructions
*/
case RA:
break;
/*
* single segment register operand, with register in
* bits 3-4 of op code byte
*/
case SEG:
break;
/*
* single segment register operand, with register in
* bits 3-5 of op code
*/
case LSEG:
/* long seg reg from opcode */
break;
/* memory or register operand to register */
case MR:
break;
case RM:
break;
case MM:
case MMO:
#ifdef DIS_TEXT
#else
#endif
break;
case MMOIMPL:
#ifdef DIS_TEXT
#else
#endif
goto error;
mode = 0; /* change for memory access size... */
break;
case MMO3P:
goto xmm3p;
case XMM3P:
goto error;
break;
case MMOPRM:
goto xmmprm;
case XMMPRM:
break;
case MMOPM:
goto xmmprm;
case MMOM3:
goto error;
break;
/* SIMD memory or xmm reg operand to xmm reg */
case XMM:
case XMMO:
case XMMXIMPL:
goto error;
#ifdef DIS_TEXT
/*
* movlps and movhlps share opcodes. They differ in the
* addressing modes allowed for their operands.
* movhps and movlhps behave similarly.
*/
}
#endif
mode = 0; /* change for memory access size... */
break;
/* SIMD xmm reg to memory or xmm reg */
case XMMS:
case XMMOS:
case XMMMS:
case XMMOMS:
#ifdef DIS_TEXT
goto error;
#endif
break;
/* SIMD memory to xmm reg */
case XMMM:
case XMMOM:
#ifdef DIS_TEXT
else
goto error;
}
#endif
break;
/* SIMD memory or r32 to xmm reg */
case XMM3MX:
break;
case XMM3MXS:
break;
/* SIMD memory or mm reg to xmm reg */
case XMMOMX:
/* SIMD mm to xmm */
case XMMMX:
break;
/* SIMD memory or xmm reg to mm reg */
case XMMXMM:
case XMMOXMM:
case XMMXM:
break;
/* SIMD memory or xmm reg to r32 */
case XMMXM3:
break;
/* SIMD xmm to r32 */
case XMMX3:
case XMMOX3:
goto error;
break;
case XMMP:
case XMMOPM:
#ifdef DIS_TEXT
/*
* cmpps and cmpss vary their instruction name based
* on the value of imm8. Other XMMP instructions,
* such as shufps, require explicit specification of
* the predicate.
*/
if (pred >= (sizeof (dis_PREDSUFFIX) / sizeof (char *)))
goto error;
OPLEN);
OPLEN);
x->d86_numopnds = 2;
}
#endif
break;
/* immediate operand to accumulator */
case IA:
break;
/* memory or register operand to accumulator */
case MA:
break;
/* si register to di register used to reference memory */
case SD:
#ifdef DIS_TEXT
dtrace_check_override(x, 0);
x->d86_numopnds = 2;
OPLEN);
OPLEN);
OPLEN);
OPLEN);
} else {
OPLEN);
OPLEN);
}
#endif
break;
/* accumulator to di register */
case AD:
#ifdef DIS_TEXT
dtrace_check_override(x, 1);
x->d86_numopnds = 2;
OPLEN);
OPLEN);
else
OPLEN);
#endif
break;
/* si register to accumulator */
case SA:
#ifdef DIS_TEXT
dtrace_check_override(x, 0);
x->d86_numopnds = 2;
OPLEN);
OPLEN);
else
OPLEN);
#endif
break;
/*
* single operand, a 16/32 bit displacement
*/
case D:
break;
case INM:
#ifdef DIS_TEXT
#endif
break;
/*
* for long jumps and long calls -- a new code segment
* register and an offset in IP -- stored in object
* code in reverse order. Note - not valid in amd64
*/
case SO:
dtrace_check_override(x, 1);
#ifdef DIS_TEXT
#endif
/* will now get segment operand */
break;
/*
* added to current EIP in 'compofff'
*/
case BD:
break;
/* single 32/16 bit immediate operand */
case I:
break;
/* single 8 bit immediate operand */
case Ib:
break;
case ENTER:
switch (opnd_size) {
case SIZE64:
break;
case SIZE32:
break;
case SIZE16:
break;
}
break;
/* 16-bit immediate operand */
case RET:
break;
/* single 8 bit port operand */
case P:
dtrace_check_override(x, 0);
break;
/* single operand, dx register (variable port instruction) */
case V:
x->d86_numopnds = 1;
dtrace_check_override(x, 0);
#ifdef DIS_TEXT
#endif
break;
/*
* The int instruction, which has two forms:
* int 3 (breakpoint) or
* int n, where n is indicated in the subsequent
* byte (format Ib). The int 3 instruction (opcode 0xCC),
* where, although the 3 looks like an operand,
* it is implied by the opcode. It must be converted
* to the correct base and output.
*/
case INT3:
#ifdef DIS_TEXT
x->d86_numopnds = 1;
#endif
break;
/* single 8 bit immediate operand */
case INTx:
break;
/* an unused byte must be discarded */
case U:
if (x->d86_get_byte(x->d86_data) < 0)
goto error;
x->d86_len++;
break;
case CBW:
#ifdef DIS_TEXT
else
#endif
break;
case CWD:
#ifdef DIS_TEXT
else
#endif
break;
case XMMSFNC:
/*
* sfence is sfence if mode is REG_ONLY. If mode isn't
* REG_ONLY, mnemonic should be 'clflush'.
*/
/* sfence doesn't take operands */
#ifdef DIS_TEXT
} else {
}
#else
}
#endif
break;
/*
* no disassembly, the mnemonic was all there was so go on
*/
case NORM:
goto error;
/*FALLTHROUGH*/
case IMPLMEM:
break;
case XMMFENCE:
/*
* Only the following exact byte sequences are allowed:
*
* 0f ae e8 lfence
* 0f ae f0 mfence
*/
goto error;
break;
/* float reg */
case F:
#ifdef DIS_TEXT
x->d86_numopnds = 1;
#endif
break;
/* float reg to float reg, with ret bit present */
case FF:
/*FALLTHROUGH*/
case FFC: /* case for vbit always = 0 */
#ifdef DIS_TEXT
x->d86_numopnds = 2;
#endif
break;
/* an invalid op code */
case AM:
case DM:
case OVERRIDE:
case PREFIX:
case UNKNOWN:
default:
goto error;
} /* end switch */
if (x->d86_error)
goto error;
done:
#ifdef DIS_MEM
/*
* compute the size of any memory accessed by the instruction
*/
if (x->d86_memsize != 0) {
return (0);
} else if (dp->it_stackop) {
switch (opnd_size) {
case SIZE16:
x->d86_memsize = 2;
break;
case SIZE32:
x->d86_memsize = 4;
break;
case SIZE64:
x->d86_memsize = 8;
break;
}
x->d86_memsize = 0;
/*
* In 64 bit mode descriptor table entries
*/
x->d86_memsize = 10;
x->d86_memsize = 8;
else
} else if (wbit == 0) {
x->d86_memsize = 1;
x->d86_memsize = 8;
x->d86_memsize = 4;
else
x->d86_memsize = 2;
x->d86_memsize = 4;
} else {
x->d86_memsize = 8;
}
#endif
return (0);
#ifdef DIS_TEXT
#endif
return (1);
}
#ifdef DIS_TEXT
/*
* Some instructions should have immediate operands printed
* as unsigned integers. We compare against this table.
*/
static char *unsigned_ops[] = {
"or", "and", "xor", "test", "in", "out", "lcall", "ljmp",
"rcr", "rcl", "ror", "rol", "shl", "shr", "sal", "psr", "psl",
0
};
static int
isunsigned_op(char *opcode)
{
char *where;
int i;
int is_unsigned = 0;
/*
* Work back to start of last mnemonic, since we may have
* prefixes on some opcodes.
*/
--where;
if (*where == ' ')
++where;
for (i = 0; unsigned_ops[i]; ++i) {
strlen(unsigned_ops[i])))
continue;
is_unsigned = 1;
break;
}
return (is_unsigned);
}
/*
* Print a numeric immediate into end of buf, maximum length buflen.
* The immediate may be an address or a displacement. Mask is set
* for address size. If the immediate is a "small negative", or
* if it's a negative displacement of any magnitude, print as -<absval>.
* Respect the "octal" flag. "Small negative" is defined as "in the
* interval [NEG_LIMIT, 0)".
*
* Also, "isunsigned_op()" instructions never print negatives.
*
* Return whether we decided to print a negative value or not.
*/
#define NEG_LIMIT -255
static int
{
int curlen;
return (1);
} else {
else
return (0);
}
}
static int
{
switch (size) {
case 1: return (0);
case 2: return (1);
case 4: return (2);
case 8: return (3);
}
return (0);
}
/* ARGSUSED */
void
{
int curlen;
int i;
{0xffU, 0xffffU, 0xffffffffU, 0xffffffffffffffffULL};
save_usv = 0;
/*
* For PC-relative jumps, the pc is really the next pc after executing
* this instruction, so increment it appropriately.
*/
for (i = 0; i < dis->d86_numopnds; i++) {
if (i != 0)
/*
* sv is for the signed, possibly-truncated immediate or
* displacement; usv retains the original size and
* unsignedness for symbol lookup.
*/
/*
* About masks: for immediates that represent
* addresses, the appropriate display size is
* the effective address size of the instruction.
* This includes MODE_OFFSET, MODE_IPREL, and
* MODE_RIPREL. Immediates that are simply
* immediate values should display in the operand's
* size, however, since they don't represent addresses.
*/
/* d86_addr_size is SIZEnn, which is log2(real size) */
/* d86_value_size and d86_imm_bytes are in bytes */
case MODE_NONE:
break;
case MODE_SIGNED:
case MODE_IMPLIED:
case MODE_OFFSET:
if (dis->d86_seg_prefix)
buflen);
}
/*
* We printed a negative value for an
* immediate that wasn't a
* displacement. Note that fact so we can
* print the positive value as an
* annotation.
*/
}
break;
case MODE_IPREL:
case MODE_RIPREL:
switch (mode) {
case SIZE16:
break;
case SIZE32:
break;
}
break;
}
}
/*
* The symbol lookups may result in false positives,
* particularly on object files, where small numbers may match
* the 0-relative non-relocated addresses of symbols.
*/
if (tgt != 0) {
/* Print symbol, if found, for tgt */
}
/*
* If we printed a negative immediate above, print the
* positive in case our heuristic was unhelpful
*/
if (save_usv) {
}
}
if (reltgt != 0) {
/* Print symbol or effective address for reltgt */
}
}
#endif /* DIS_TEXT */