LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-09-20 17:58:18 +03:00
Code Issues Packages Projects Releases Wiki Activity
4c343c5f26
ladybird/Libraries/LibX86/Instruction.h

1081 lines
28 KiB
C
Raw Normal View History

LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
/*
* Copyright (c) 2018-2020, Andreas Kling <kling@serenityos.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#pragma once
LibX86: Store Instruction's segment prefix as Optional<SegmentRegister> Instead of having a dedicated enum value for the empty state.
2020-07-10 15:38:30 +03:00
#include <AK/Optional.h>
LibX86: Use MakeUnsigned<T> from AK instead of making a custom one
2020-04-15 17:52:43 +03:00
#include <AK/StdLibExtras.h>
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
#include <AK/String.h>
#include <AK/Types.h>
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
#include <stdio.h>
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
namespace X86 {
class Instruction;
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
class Interpreter;
typedef void (Interpreter::*InstructionHandler)(const Instruction&);
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
LibX86: Add a way for Instruction::to_string() to symbolicate addresses This patch adds a pure virtual X86::SymbolProvider that can be passed to Instruction::to_string(). If the instruction contains what appears to be a program address, stringification will try to symbolicate that address via the SymbolProvider. This makes it possible (and very flexible) to add symbolication to clients of the disassembler. :^)
2020-04-12 14:57:44 +03:00
class SymbolProvider {
public:
virtual String symbolicate(FlatPtr, u32* offset = nullptr) const = 0;
};
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
template<typename T>
struct TypeTrivia {
static const size_t bits = sizeof(T) * 8;
static const T sign_bit = 1 << (bits - 1);
AK: Rename MakeUnsigned::type to MakeUnsigned::Type. Also renames MakeSigned::type to MakeSigned::Type.
2020-08-03 21:35:25 +03:00
static const T mask = typename MakeUnsigned<T>::Type(-1);
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
};
template<typename T, typename U>
Everywhere: Redundant inline specifier on constexpr functions (#3807) Problem: - `constexpr` functions are decorated with the `inline` specifier keyword. This is redundant because `constexpr` functions are implicitly `inline`. - [dcl.constexpr], §7.1.5/2 in the C++11 standard): "constexpr functions and constexpr constructors are implicitly inline (7.1.2)". Solution: - Remove the redundant `inline` keyword.
2020-10-20 19:08:13 +03:00
constexpr T sign_extended_to(U value)
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
{
if (!(value & TypeTrivia<U>::sign_bit))
return value;
return (TypeTrivia<T>::mask & ~TypeTrivia<U>::mask) | value;
}
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
enum IsLockPrefixAllowed {
LockPrefixNotAllowed = 0,
LockPrefixAllowed
};
enum InstructionFormat {
InvalidFormat,
MultibyteWithSlash,
InstructionPrefix,
__BeginFormatsWithRMByte,
OP_RM16_reg16,
OP_reg8_RM8,
OP_reg16_RM16,
OP_RM16_seg,
OP_RM32_seg,
OP_RM8_imm8,
OP_RM16_imm16,
OP_RM16_imm8,
OP_RM32_imm8,
OP_RM8,
OP_RM16,
OP_RM32,
LibX86: Disassemble most FPU instructions starting with D9 Some of these don't just use the REG bits of the mod/rm byte as slashes, but also the R/M bits to have up to 9 different instructions per opcode/slash combination (1 opcode requires that MOD is != 11, the other 8 have MODE == 11). This is done by making the slashes table two levels deep for these cases. Some of this is cosmetic (e.g "FST st0" has no effect already, but its bit pattern gets disassembled as "FNOP"), but for most uses it isn't. FSTENV and FSTCW have an extraordinary 0x9b prefix. This is not yet handled in this patch.
2020-07-28 18:09:54 +03:00
OP_FPU,
OP_FPU_reg,
LibX86: Disassemble most remaining FPU instructions Some of the remaining instructions have different behavior for register and non-register ops. Since we already have the two-level flags tables, model this by setting all handlers in the two-level table to the register op handler, while the first-level flags table stores the action for the non-reg handler.
2020-07-29 00:05:57 +03:00
OP_FPU_mem,
OP_FPU_AX16,
OP_FPU_RM16,
LibX86: Support disassembling a few FPU opcodes better
2020-07-26 02:31:58 +03:00
OP_FPU_RM32,
OP_FPU_RM64,
LibX86: Disassemble most remaining FPU instructions Some of the remaining instructions have different behavior for register and non-register ops. Since we already have the two-level flags tables, model this by setting all handlers in the two-level table to the register op handler, while the first-level flags table stores the action for the non-reg handler.
2020-07-29 00:05:57 +03:00
OP_FPU_M80,
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
OP_RM8_reg8,
OP_RM32_reg32,
OP_reg32_RM32,
OP_RM32_imm32,
OP_reg16_RM16_imm8,
OP_reg32_RM32_imm8,
OP_reg16_RM16_imm16,
OP_reg32_RM32_imm32,
OP_reg16_mem16,
OP_reg32_mem32,
OP_seg_RM16,
OP_seg_RM32,
OP_RM8_1,
OP_RM16_1,
OP_RM32_1,
OP_FAR_mem16,
OP_FAR_mem32,
OP_RM8_CL,
OP_RM16_CL,
OP_RM32_CL,
OP_reg32_CR,
OP_CR_reg32,
OP_reg32_DR,
OP_DR_reg32,
OP_reg16_RM8,
OP_reg32_RM8,
OP_reg32_RM16,
OP_RM16_reg16_imm8,
OP_RM32_reg32_imm8,
OP_RM16_reg16_CL,
OP_RM32_reg32_CL,
OP_mm1_mm2m64,
OP_mm1m64_mm2,
__EndFormatsWithRMByte,
OP_reg32_imm32,
OP_AL_imm8,
OP_AX_imm16,
OP_EAX_imm32,
OP_CS,
OP_DS,
OP_ES,
OP_SS,
OP_FS,
OP_GS,
OP,
OP_reg16,
OP_imm16,
OP_relimm16,
OP_relimm32,
OP_imm8,
OP_imm16_imm16,
OP_imm16_imm32,
OP_AX_reg16,
OP_EAX_reg32,
OP_AL_moff8,
OP_AX_moff16,
OP_EAX_moff32,
OP_moff8_AL,
OP_moff16_AX,
OP_moff32_EAX,
OP_reg8_imm8,
OP_reg16_imm16,
OP_3,
OP_AX_imm8,
OP_EAX_imm8,
OP_short_imm8,
OP_AL_DX,
OP_AX_DX,
OP_EAX_DX,
OP_DX_AL,
OP_DX_AX,
OP_DX_EAX,
OP_imm8_AL,
OP_imm8_AX,
OP_imm8_EAX,
OP_reg8_CL,
OP_reg32,
OP_imm32,
OP_imm16_imm8,
OP_NEAR_imm,
};
static const unsigned CurrentAddressSize = 0xB33FBABE;
struct InstructionDescriptor {
InstructionHandler handler { nullptr };
bool opcode_has_register_index { false };
const char* mnemonic { nullptr };
InstructionFormat format { InvalidFormat };
bool has_rm { false };
unsigned imm1_bytes { 0 };
unsigned imm2_bytes { 0 };
LibX86: Disassemble most FPU instructions starting with D9 Some of these don't just use the REG bits of the mod/rm byte as slashes, but also the R/M bits to have up to 9 different instructions per opcode/slash combination (1 opcode requires that MOD is != 11, the other 8 have MODE == 11). This is done by making the slashes table two levels deep for these cases. Some of this is cosmetic (e.g "FST st0" has no effect already, but its bit pattern gets disassembled as "FNOP"), but for most uses it isn't. FSTENV and FSTCW have an extraordinary 0x9b prefix. This is not yet handled in this patch.
2020-07-28 18:09:54 +03:00
// Addressed by the 3 REG bits in the MOD-REG-R/M byte.
// Some slash instructions have further subgroups when MOD is 11,
// in that case the InstructionDescriptors in slashes have themselves
// a non-null slashes member that's indexed by the three R/M bits.
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
InstructionDescriptor* slashes { nullptr };
unsigned imm1_bytes_for_address_size(bool a32)
{
if (imm1_bytes == CurrentAddressSize)
return a32 ? 4 : 2;
return imm1_bytes;
}
unsigned imm2_bytes_for_address_size(bool a32)
{
if (imm2_bytes == CurrentAddressSize)
return a32 ? 4 : 2;
return imm2_bytes;
}
IsLockPrefixAllowed lock_prefix_allowed { LockPrefixNotAllowed };
};
extern InstructionDescriptor s_table16[256];
extern InstructionDescriptor s_table32[256];
extern InstructionDescriptor s_0f_table16[256];
extern InstructionDescriptor s_0f_table32[256];
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
struct Prefix {
enum Op {
OperandSizeOverride = 0x66,
AddressSizeOverride = 0x67,
REP = 0xf3,
REPZ = 0xf3,
REPNZ = 0xf2,
LOCK = 0xf0,
};
};
enum class SegmentRegister {
ES = 0,
CS,
SS,
DS,
FS,
GS,
LibX86: Tolerate invalid segment register indices when disassembling While #6 and #7 are not valid segment register, they can still be encoded in otherwise-valid instructions, so let's tolerate it.
2020-04-11 15:00:20 +03:00
SegR6,
SegR7,
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
};
enum RegisterIndex8 {
RegisterAL = 0,
RegisterCL,
RegisterDL,
RegisterBL,
RegisterAH,
RegisterCH,
RegisterDH,
RegisterBH
};
enum RegisterIndex16 {
RegisterAX = 0,
RegisterCX,
RegisterDX,
RegisterBX,
RegisterSP,
RegisterBP,
RegisterSI,
RegisterDI
};
enum RegisterIndex32 {
RegisterEAX = 0,
RegisterECX,
RegisterEDX,
RegisterEBX,
RegisterESP,
RegisterEBP,
RegisterESI,
RegisterEDI
};
LibX86: Support disassembling a few FPU opcodes better
2020-07-26 02:31:58 +03:00
enum FpuRegisterIndex {
ST0 = 0,
ST1,
ST2,
ST3,
ST4,
ST5,
ST6,
ST7
};
LibX86: Support decoding basic MMX instructions like MOVQ
2020-04-11 14:41:51 +03:00
enum MMXRegisterIndex {
RegisterMM0 = 0,
RegisterMM1,
RegisterMM2,
RegisterMM3,
RegisterMM4,
RegisterMM5,
RegisterMM6,
RegisterMM7
};
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
class LogicalAddress {
public:
UserspaceEmulator: Tidy up SoftCPU's general purpose registers This patch adds a PartAddressableRegister type, which divides a 32-bit value into separate parts needed for the EAX/AX/AL/AH register splits. Clean up the code around register access to make it a little less cumbersome to use.
2020-07-10 00:22:19 +03:00
LogicalAddress() { }
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
LogicalAddress(u16 selector, u32 offset)
: m_selector(selector)
, m_offset(offset)
{
}
u16 selector() const { return m_selector; }
u32 offset() const { return m_offset; }
void set_selector(u16 selector) { m_selector = selector; }
void set_offset(u32 offset) { m_offset = offset; }
private:
u16 m_selector { 0 };
u32 m_offset { 0 };
};
class InstructionStream {
public:
virtual bool can_read() = 0;
virtual u8 read8() = 0;
virtual u16 read16() = 0;
virtual u32 read32() = 0;
UserspaceEmulator+LibX86: Add support for 64-bit memory reads and writes (#3584) This is useful for reading and writing doubles for #3329. It is also useful for emulating 64-bit binaries. MemoryOrRegisterReference assumes that 64-bit values are always memory references since that's enough for fpu support. If we ever want to emulate 64-bit binaries, that part will need minor updating.
2020-09-23 21:45:43 +03:00
virtual u64 read64() = 0;
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
};
class SimpleInstructionStream final : public InstructionStream {
public:
SimpleInstructionStream(const u8* data, size_t size)
: m_data(data)
, m_size(size)
{
}
virtual bool can_read() override { return m_offset < m_size; }
virtual u8 read8() override
{
if (!can_read())
return 0;
return m_data[m_offset++];
}
virtual u16 read16() override
{
u8 lsb = read8();
u8 msb = read8();
return ((u16)msb << 8) | (u16)lsb;
}
virtual u32 read32() override
{
u16 lsw = read16();
u16 msw = read16();
return ((u32)msw << 16) | (u32)lsw;
}
UserspaceEmulator+LibX86: Add support for 64-bit memory reads and writes (#3584) This is useful for reading and writing doubles for #3329. It is also useful for emulating 64-bit binaries. MemoryOrRegisterReference assumes that 64-bit values are always memory references since that's enough for fpu support. If we ever want to emulate 64-bit binaries, that part will need minor updating.
2020-09-23 21:45:43 +03:00
virtual u64 read64() override
{
u32 lsw = read32();
u32 msw = read32();
return ((u64)msw << 32) | (u64)lsw;
}
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
size_t offset() const { return m_offset; }
private:
const u8* m_data { nullptr };
size_t m_offset { 0 };
size_t m_size { 0 };
};
class MemoryOrRegisterReference {
friend class Instruction;
public:
LibX86+UserspaceEmulator: Don't store a32 in MemoryOrRegisterReference The a32 bit tells us whether a memory address is 32-bit or not. We already have this information in Instruction, so just plumb that around instead of double-caching the bit.
2020-07-14 20:07:32 +03:00
String to_string_o8(const Instruction&) const;
String to_string_o16(const Instruction&) const;
String to_string_o32(const Instruction&) const;
LibX86: Disassemble most FPU instructions starting with D9 Some of these don't just use the REG bits of the mod/rm byte as slashes, but also the R/M bits to have up to 9 different instructions per opcode/slash combination (1 opcode requires that MOD is != 11, the other 8 have MODE == 11). This is done by making the slashes table two levels deep for these cases. Some of this is cosmetic (e.g "FST st0" has no effect already, but its bit pattern gets disassembled as "FNOP"), but for most uses it isn't. FSTENV and FSTCW have an extraordinary 0x9b prefix. This is not yet handled in this patch.
2020-07-28 18:09:54 +03:00
String to_string_fpu_reg() const;
LibX86: Disassemble most remaining FPU instructions Some of the remaining instructions have different behavior for register and non-register ops. Since we already have the two-level flags tables, model this by setting all handlers in the two-level table to the register op handler, while the first-level flags table stores the action for the non-reg handler.
2020-07-29 00:05:57 +03:00
String to_string_fpu_mem(const Instruction&) const;
String to_string_fpu_ax16() const;
String to_string_fpu16(const Instruction&) const;
LibX86: Support disassembling a few FPU opcodes better
2020-07-26 02:31:58 +03:00
String to_string_fpu32(const Instruction&) const;
String to_string_fpu64(const Instruction&) const;
LibX86: Disassemble most remaining FPU instructions Some of the remaining instructions have different behavior for register and non-register ops. Since we already have the two-level flags tables, model this by setting all handlers in the two-level table to the register op handler, while the first-level flags table stores the action for the non-reg handler.
2020-07-29 00:05:57 +03:00
String to_string_fpu80(const Instruction&) const;
LibX86+UserspaceEmulator: Don't store a32 in MemoryOrRegisterReference The a32 bit tells us whether a memory address is 32-bit or not. We already have this information in Instruction, so just plumb that around instead of double-caching the bit.
2020-07-14 20:07:32 +03:00
String to_string_mm(const Instruction&) const;
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
bool is_register() const { return m_register_index != 0xffffffff; }
LibX86: Expose some more things on X86::Instruction
2020-07-07 22:12:40 +03:00
unsigned register_index() const { return m_register_index; }
UserspaceEmulator: Tidy up SoftCPU's general purpose registers This patch adds a PartAddressableRegister type, which divides a 32-bit value into separate parts needed for the EAX/AX/AL/AH register splits. Clean up the code around register access to make it a little less cumbersome to use.
2020-07-10 00:22:19 +03:00
RegisterIndex32 reg32() const { return static_cast<RegisterIndex32>(register_index()); }
RegisterIndex16 reg16() const { return static_cast<RegisterIndex16>(register_index()); }
RegisterIndex8 reg8() const { return static_cast<RegisterIndex8>(register_index()); }
LibX86: Support disassembling a few FPU opcodes better
2020-07-26 02:31:58 +03:00
FpuRegisterIndex reg_fpu() const { return static_cast<FpuRegisterIndex>(register_index()); }
UserspaceEmulator: Tidy up SoftCPU's general purpose registers This patch adds a PartAddressableRegister type, which divides a 32-bit value into separate parts needed for the EAX/AX/AL/AH register splits. Clean up the code around register access to make it a little less cumbersome to use.
2020-07-10 00:22:19 +03:00
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
template<typename CPU, typename T>
void write8(CPU&, const Instruction&, T);
template<typename CPU, typename T>
void write16(CPU&, const Instruction&, T);
template<typename CPU, typename T>
void write32(CPU&, const Instruction&, T);
UserspaceEmulator+LibX86: Add support for 64-bit memory reads and writes (#3584) This is useful for reading and writing doubles for #3329. It is also useful for emulating 64-bit binaries. MemoryOrRegisterReference assumes that 64-bit values are always memory references since that's enough for fpu support. If we ever want to emulate 64-bit binaries, that part will need minor updating.
2020-09-23 21:45:43 +03:00
template<typename CPU, typename T>
void write64(CPU&, const Instruction&, T);
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
UserspaceEmulator+LibX86: Clean up some obnoxious template spam Don't require clients to templatize modrm().read{8,16,32,64}() with the ValueWithShadow type when we can figure it out automatically. The main complication here is that ValueWithShadow is a UE concept while the MemoryOrRegisterReference inlines exist at the lower LibX86 layer and so doesn't have direct access to those types. But that's nothing we can't solve with some simple template trickery. :^)
2020-09-23 22:12:14 +03:00
template<typename CPU>
typename CPU::ValueWithShadowType8 read8(CPU&, const Instruction&);
template<typename CPU>
typename CPU::ValueWithShadowType16 read16(CPU&, const Instruction&);
template<typename CPU>
typename CPU::ValueWithShadowType32 read32(CPU&, const Instruction&);
template<typename CPU>
typename CPU::ValueWithShadowType64 read64(CPU&, const Instruction&);
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
UserspaceEmulator+LibX86: Implement the LEA instruction This piggybacks nicely on Instruction's ModR/M resolution code. :^)
2020-07-11 22:36:25 +03:00
template<typename CPU>
LibX86+UserspaceEmulator: Don't store a32 in MemoryOrRegisterReference The a32 bit tells us whether a memory address is 32-bit or not. We already have this information in Instruction, so just plumb that around instead of double-caching the bit.
2020-07-14 20:07:32 +03:00
LogicalAddress resolve(const CPU&, const Instruction&);
UserspaceEmulator+LibX86: Implement the LEA instruction This piggybacks nicely on Instruction's ModR/M resolution code. :^)
2020-07-11 22:36:25 +03:00
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
private:
UserspaceEmulator: Tidy up SoftCPU's general purpose registers This patch adds a PartAddressableRegister type, which divides a 32-bit value into separate parts needed for the EAX/AX/AL/AH register splits. Clean up the code around register access to make it a little less cumbersome to use.
2020-07-10 00:22:19 +03:00
MemoryOrRegisterReference() { }
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
LibX86+UserspaceEmulator: Don't store a32 in MemoryOrRegisterReference The a32 bit tells us whether a memory address is 32-bit or not. We already have this information in Instruction, so just plumb that around instead of double-caching the bit.
2020-07-14 20:07:32 +03:00
String to_string(const Instruction&) const;
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
String to_string_a16() const;
String to_string_a32() const;
LibX86+UserspaceEmulator: Devirtualize and inline more instruction code Use some template hacks to force GCC to inline more of the instruction decoding stuff into the UserspaceEmulator main execution loop. This is my last optimization for today, and we've gone from ~60 seconds when running "UserspaceEmulator UserspaceEmulator id" to ~8 seconds :^)
2020-07-13 22:00:51 +03:00
template<typename InstructionStreamType>
void decode(InstructionStreamType&, bool a32);
template<typename InstructionStreamType>
void decode16(InstructionStreamType&);
template<typename InstructionStreamType>
void decode32(InstructionStreamType&);
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
template<typename CPU>
LogicalAddress resolve16(const CPU&, Optional<SegmentRegister>);
template<typename CPU>
LogicalAddress resolve32(const CPU&, Optional<SegmentRegister>);
template<typename CPU>
u32 evaluate_sib(const CPU&, SegmentRegister& default_segment) const;
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
unsigned m_register_index { 0xffffffff };
union {
u32 m_offset32 { 0 };
u16 m_offset16;
};
u8 m_rm { 0 };
u8 m_sib { 0 };
u8 m_displacement_bytes { 0 };
union {
u32 m_displacement32 { 0 };
u16 m_displacement16;
};
bool m_has_sib { false };
};
class Instruction {
public:
LibX86+UserspaceEmulator: Devirtualize and inline more instruction code Use some template hacks to force GCC to inline more of the instruction decoding stuff into the UserspaceEmulator main execution loop. This is my last optimization for today, and we've gone from ~60 seconds when running "UserspaceEmulator UserspaceEmulator id" to ~8 seconds :^)
2020-07-13 22:00:51 +03:00
template<typename InstructionStreamType>
static Instruction from_stream(InstructionStreamType&, bool o32, bool a32);
UserspaceEmulator: Tidy up SoftCPU's general purpose registers This patch adds a PartAddressableRegister type, which divides a 32-bit value into separate parts needed for the EAX/AX/AL/AH register splits. Clean up the code around register access to make it a little less cumbersome to use.
2020-07-10 00:22:19 +03:00
~Instruction() { }
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
LibX86: ALWAYS_INLINE some Instruction members
2020-07-13 14:46:22 +03:00
ALWAYS_INLINE MemoryOrRegisterReference& modrm() const
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
{
ASSERT(has_rm());
return m_modrm;
}
LibX86: Remove Instruction::m_handler We can fetch the handler via Instruction::m_descriptor.
2020-07-14 18:41:20 +03:00
ALWAYS_INLINE InstructionHandler handler() const { return m_descriptor->handler; }
LibX86: Expose some more things on X86::Instruction
2020-07-07 22:12:40 +03:00
LibX86: Store Instruction's segment prefix as Optional<SegmentRegister> Instead of having a dedicated enum value for the empty state.
2020-07-10 15:38:30 +03:00
bool has_segment_prefix() const { return m_segment_prefix.has_value(); }
Optional<SegmentRegister> segment_prefix() const { return m_segment_prefix; }
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
bool has_address_size_override_prefix() const { return m_has_address_size_override_prefix; }
bool has_operand_size_override_prefix() const { return m_has_operand_size_override_prefix; }
bool has_lock_prefix() const { return m_has_lock_prefix; }
bool has_rep_prefix() const { return m_rep_prefix; }
u8 rep_prefix() const { return m_rep_prefix; }
bool is_valid() const { return m_descriptor; }
unsigned length() const;
String mnemonic() const;
u8 op() const { return m_op; }
u8 sub_op() const { return m_sub_op; }
u8 rm() const { return m_modrm.m_rm; }
u8 slash() const
{
ASSERT(has_rm());
return (rm() >> 3) & 7;
}
LibX86: Don't store the prefix/imm1/imm2 byte counts individually We can shrink and simplify Instruction a bit by combining these into a single "extra bytes" count.
2020-07-14 19:12:44 +03:00
u8 imm8() const { return m_imm1; }
u16 imm16() const { return m_imm1; }
u32 imm32() const { return m_imm1; }
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
u8 imm8_1() const { return imm8(); }
LibX86: Don't store the prefix/imm1/imm2 byte counts individually We can shrink and simplify Instruction a bit by combining these into a single "extra bytes" count.
2020-07-14 19:12:44 +03:00
u8 imm8_2() const { return m_imm2; }
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
u16 imm16_1() const { return imm16(); }
LibX86: Don't store the prefix/imm1/imm2 byte counts individually We can shrink and simplify Instruction a bit by combining these into a single "extra bytes" count.
2020-07-14 19:12:44 +03:00
u16 imm16_2() const { return m_imm2; }
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
u32 imm32_1() const { return imm32(); }
LibX86: Don't store the prefix/imm1/imm2 byte counts individually We can shrink and simplify Instruction a bit by combining these into a single "extra bytes" count.
2020-07-14 19:12:44 +03:00
u32 imm32_2() const { return m_imm2; }
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
u32 imm_address() const { return m_a32 ? imm32() : imm16(); }
LogicalAddress imm_address16_16() const { return LogicalAddress(imm16_1(), imm16_2()); }
LogicalAddress imm_address16_32() const { return LogicalAddress(imm16_1(), imm32_2()); }
bool has_rm() const { return m_has_rm; }
LibX86: Don't cache whether instruction have a sub-opcode We can just check if the first opcode byte is 0x0f to know this.
2020-07-14 20:16:33 +03:00
bool has_sub_op() const
{
return m_op == 0x0f;
}
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
unsigned register_index() const { return m_register_index; }
UserspaceEmulator: Tidy up SoftCPU's general purpose registers This patch adds a PartAddressableRegister type, which divides a 32-bit value into separate parts needed for the EAX/AX/AL/AH register splits. Clean up the code around register access to make it a little less cumbersome to use.
2020-07-10 00:22:19 +03:00
RegisterIndex32 reg32() const { return static_cast<RegisterIndex32>(register_index()); }
RegisterIndex16 reg16() const { return static_cast<RegisterIndex16>(register_index()); }
RegisterIndex8 reg8() const { return static_cast<RegisterIndex8>(register_index()); }
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
SegmentRegister segment_register() const { return static_cast<SegmentRegister>(register_index()); }
LibX86: Don't cache whether instruction have a sub-opcode We can just check if the first opcode byte is 0x0f to know this.
2020-07-14 20:16:33 +03:00
u8 cc() const { return has_sub_op() ? m_sub_op & 0xf : m_op & 0xf; }
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
LibX86+UserspaceEmulator: Don't store a32 in MemoryOrRegisterReference The a32 bit tells us whether a memory address is 32-bit or not. We already have this information in Instruction, so just plumb that around instead of double-caching the bit.
2020-07-14 20:07:32 +03:00
bool a32() const { return m_a32; }
LibX86: Add a way for Instruction::to_string() to symbolicate addresses This patch adds a pure virtual X86::SymbolProvider that can be passed to Instruction::to_string(). If the instruction contains what appears to be a program address, stringification will try to symbolicate that address via the SymbolProvider. This makes it possible (and very flexible) to add symbolication to clients of the disassembler. :^)
2020-04-12 14:57:44 +03:00
String to_string(u32 origin, const SymbolProvider* = nullptr, bool x32 = true) const;
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
private:
LibX86+UserspaceEmulator: Devirtualize and inline more instruction code Use some template hacks to force GCC to inline more of the instruction decoding stuff into the UserspaceEmulator main execution loop. This is my last optimization for today, and we've gone from ~60 seconds when running "UserspaceEmulator UserspaceEmulator id" to ~8 seconds :^)
2020-07-13 22:00:51 +03:00
template<typename InstructionStreamType>
Instruction(InstructionStreamType&, bool o32, bool a32);
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
LibX86: malloc a bit less This reduces malloc()/free() calls in `disasm /bin/id` by 30% according to LIBC_DUMP_MALLOC_STATS. No measurable performance change (the number of empty block hits remains unchanged, and that's what's slow), but maybe a nice change regardless?
2020-08-13 20:53:06 +03:00
void to_string_internal(StringBuilder&, u32 origin, const SymbolProvider*, bool x32) const;
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
const char* reg8_name() const;
const char* reg16_name() const;
const char* reg32_name() const;
u8 m_op { 0 };
u8 m_sub_op { 0 };
u32 m_imm1 { 0 };
u32 m_imm2 { 0 };
u8 m_register_index { 0 };
bool m_a32 { false };
bool m_o32 { false };
bool m_has_lock_prefix { false };
bool m_has_rm { false };
LibX86: Don't store the prefix/imm1/imm2 byte counts individually We can shrink and simplify Instruction a bit by combining these into a single "extra bytes" count.
2020-07-14 19:12:44 +03:00
u8 m_extra_bytes { 0 };
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
LibX86: Store Instruction's segment prefix as Optional<SegmentRegister> Instead of having a dedicated enum value for the empty state.
2020-07-10 15:38:30 +03:00
Optional<SegmentRegister> m_segment_prefix;
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
bool m_has_operand_size_override_prefix { false };
bool m_has_address_size_override_prefix { false };
u8 m_rep_prefix { 0 };
LibX86: Expose some more things on X86::Instruction
2020-07-07 22:12:40 +03:00
mutable MemoryOrRegisterReference m_modrm;
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
InstructionDescriptor* m_descriptor { nullptr };
};
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
template<typename CPU>
LibX86: ALWAYS_INLINE some Instruction members
2020-07-13 14:46:22 +03:00
ALWAYS_INLINE LogicalAddress MemoryOrRegisterReference::resolve16(const CPU& cpu, Optional<SegmentRegister> segment_prefix)
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
{
auto default_segment = SegmentRegister::DS;
u16 offset = 0;
switch (m_rm & 7) {
case 0:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.bx().value() + cpu.si().value() + m_displacement16;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 1:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.bx().value() + cpu.di().value() + m_displacement16;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 2:
default_segment = SegmentRegister::SS;
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.bp().value() + cpu.si().value() + m_displacement16;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 3:
default_segment = SegmentRegister::SS;
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.bp().value() + cpu.di().value() + m_displacement16;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 4:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.si().value() + m_displacement16;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 5:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.di().value() + m_displacement16;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 6:
if ((m_rm & 0xc0) == 0)
offset = m_displacement16;
else {
default_segment = SegmentRegister::SS;
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.bp().value() + m_displacement16;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
}
break;
default:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.bx().value() + m_displacement16;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
}
u16 segment = cpu.segment(segment_prefix.value_or(default_segment));
return { segment, offset };
}
template<typename CPU>
LibX86: ALWAYS_INLINE some Instruction members
2020-07-13 14:46:22 +03:00
ALWAYS_INLINE LogicalAddress MemoryOrRegisterReference::resolve32(const CPU& cpu, Optional<SegmentRegister> segment_prefix)
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
{
auto default_segment = SegmentRegister::DS;
u32 offset = 0;
switch (m_rm & 0x07) {
case 0:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.eax().value() + m_displacement32;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 1:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.ecx().value() + m_displacement32;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 2:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.edx().value() + m_displacement32;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 3:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.ebx().value() + m_displacement32;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 4:
offset = evaluate_sib(cpu, default_segment);
break;
case 6:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.esi().value() + m_displacement32;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 7:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.edi().value() + m_displacement32;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
default: // 5
if ((m_rm & 0xc0) == 0x00) {
offset = m_displacement32;
break;
} else {
default_segment = SegmentRegister::SS;
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
offset = cpu.ebp().value() + m_displacement32;
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
}
break;
}
u16 segment = cpu.segment(segment_prefix.value_or(default_segment));
return { segment, offset };
}
template<typename CPU>
LibX86: ALWAYS_INLINE some Instruction members
2020-07-13 14:46:22 +03:00
ALWAYS_INLINE u32 MemoryOrRegisterReference::evaluate_sib(const CPU& cpu, SegmentRegister& default_segment) const
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
{
u32 scale = 0;
switch (m_sib & 0xc0) {
case 0x00:
scale = 1;
break;
case 0x40:
scale = 2;
break;
case 0x80:
scale = 4;
break;
case 0xc0:
scale = 8;
break;
}
u32 index = 0;
switch ((m_sib >> 3) & 0x07) {
case 0:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
index = cpu.eax().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 1:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
index = cpu.ecx().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 2:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
index = cpu.edx().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 3:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
index = cpu.ebx().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 4:
index = 0;
break;
case 5:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
index = cpu.ebp().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 6:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
index = cpu.esi().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 7:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
index = cpu.edi().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
}
u32 base = m_displacement32;
switch (m_sib & 0x07) {
case 0:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
base += cpu.eax().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 1:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
base += cpu.ecx().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 2:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
base += cpu.edx().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 3:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
base += cpu.ebx().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 4:
default_segment = SegmentRegister::SS;
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
base += cpu.esp().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 6:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
base += cpu.esi().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
case 7:
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
base += cpu.edi().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
default: // 5
switch ((m_rm >> 6) & 3) {
case 0:
break;
case 1:
case 2:
default_segment = SegmentRegister::SS;
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
base += cpu.ebp().value();
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
break;
default:
ASSERT_NOT_REACHED();
break;
}
break;
}
return (scale * index) + base;
}
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
template<typename CPU, typename T>
ALWAYS_INLINE void MemoryOrRegisterReference::write8(CPU& cpu, const Instruction& insn, T value)
UserspaceEmulator+LibX86: Implement all the forms of XOR And they're all generic, which will make it easy to support more ops.
2020-07-10 18:18:49 +03:00
{
if (is_register()) {
cpu.gpr8(reg8()) = value;
return;
}
LibX86+UserspaceEmulator: Don't store a32 in MemoryOrRegisterReference The a32 bit tells us whether a memory address is 32-bit or not. We already have this information in Instruction, so just plumb that around instead of double-caching the bit.
2020-07-14 20:07:32 +03:00
auto address = resolve(cpu, insn);
UserspaceEmulator+LibX86: Implement all the forms of XOR And they're all generic, which will make it easy to support more ops.
2020-07-10 18:18:49 +03:00
cpu.write_memory8(address, value);
}
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
template<typename CPU, typename T>
ALWAYS_INLINE void MemoryOrRegisterReference::write16(CPU& cpu, const Instruction& insn, T value)
UserspaceEmulator+LibX86: Implement all the forms of XOR And they're all generic, which will make it easy to support more ops.
2020-07-10 18:18:49 +03:00
{
if (is_register()) {
cpu.gpr16(reg16()) = value;
return;
}
LibX86+UserspaceEmulator: Don't store a32 in MemoryOrRegisterReference The a32 bit tells us whether a memory address is 32-bit or not. We already have this information in Instruction, so just plumb that around instead of double-caching the bit.
2020-07-14 20:07:32 +03:00
auto address = resolve(cpu, insn);
UserspaceEmulator+LibX86: Implement all the forms of XOR And they're all generic, which will make it easy to support more ops.
2020-07-10 18:18:49 +03:00
cpu.write_memory16(address, value);
}
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
template<typename CPU, typename T>
ALWAYS_INLINE void MemoryOrRegisterReference::write32(CPU& cpu, const Instruction& insn, T value)
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
{
if (is_register()) {
cpu.gpr32(reg32()) = value;
return;
}
LibX86+UserspaceEmulator: Don't store a32 in MemoryOrRegisterReference The a32 bit tells us whether a memory address is 32-bit or not. We already have this information in Instruction, so just plumb that around instead of double-caching the bit.
2020-07-14 20:07:32 +03:00
auto address = resolve(cpu, insn);
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
cpu.write_memory32(address, value);
}
UserspaceEmulator+LibX86: Add support for 64-bit memory reads and writes (#3584) This is useful for reading and writing doubles for #3329. It is also useful for emulating 64-bit binaries. MemoryOrRegisterReference assumes that 64-bit values are always memory references since that's enough for fpu support. If we ever want to emulate 64-bit binaries, that part will need minor updating.
2020-09-23 21:45:43 +03:00
template<typename CPU, typename T>
ALWAYS_INLINE void MemoryOrRegisterReference::write64(CPU& cpu, const Instruction& insn, T value)
{
ASSERT(!is_register());
auto address = resolve(cpu, insn);
cpu.write_memory64(address, value);
}
UserspaceEmulator+LibX86: Clean up some obnoxious template spam Don't require clients to templatize modrm().read{8,16,32,64}() with the ValueWithShadow type when we can figure it out automatically. The main complication here is that ValueWithShadow is a UE concept while the MemoryOrRegisterReference inlines exist at the lower LibX86 layer and so doesn't have direct access to those types. But that's nothing we can't solve with some simple template trickery. :^)
2020-09-23 22:12:14 +03:00
template<typename CPU>
ALWAYS_INLINE typename CPU::ValueWithShadowType8 MemoryOrRegisterReference::read8(CPU& cpu, const Instruction& insn)
UserspaceEmulator+LibX86: Implement all the forms of XOR And they're all generic, which will make it easy to support more ops.
2020-07-10 18:18:49 +03:00
{
if (is_register())
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
return cpu.const_gpr8(reg8());
UserspaceEmulator+LibX86: Implement all the forms of XOR And they're all generic, which will make it easy to support more ops.
2020-07-10 18:18:49 +03:00
LibX86+UserspaceEmulator: Don't store a32 in MemoryOrRegisterReference The a32 bit tells us whether a memory address is 32-bit or not. We already have this information in Instruction, so just plumb that around instead of double-caching the bit.
2020-07-14 20:07:32 +03:00
auto address = resolve(cpu, insn);
UserspaceEmulator+LibX86: Implement all the forms of XOR And they're all generic, which will make it easy to support more ops.
2020-07-10 18:18:49 +03:00
return cpu.read_memory8(address);
}
UserspaceEmulator+LibX86: Clean up some obnoxious template spam Don't require clients to templatize modrm().read{8,16,32,64}() with the ValueWithShadow type when we can figure it out automatically. The main complication here is that ValueWithShadow is a UE concept while the MemoryOrRegisterReference inlines exist at the lower LibX86 layer and so doesn't have direct access to those types. But that's nothing we can't solve with some simple template trickery. :^)
2020-09-23 22:12:14 +03:00
template<typename CPU>
ALWAYS_INLINE typename CPU::ValueWithShadowType16 MemoryOrRegisterReference::read16(CPU& cpu, const Instruction& insn)
UserspaceEmulator+LibX86: Implement all the forms of XOR And they're all generic, which will make it easy to support more ops.
2020-07-10 18:18:49 +03:00
{
if (is_register())
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
return cpu.const_gpr16(reg16());
UserspaceEmulator+LibX86: Implement all the forms of XOR And they're all generic, which will make it easy to support more ops.
2020-07-10 18:18:49 +03:00
LibX86+UserspaceEmulator: Don't store a32 in MemoryOrRegisterReference The a32 bit tells us whether a memory address is 32-bit or not. We already have this information in Instruction, so just plumb that around instead of double-caching the bit.
2020-07-14 20:07:32 +03:00
auto address = resolve(cpu, insn);
UserspaceEmulator+LibX86: Implement all the forms of XOR And they're all generic, which will make it easy to support more ops.
2020-07-10 18:18:49 +03:00
return cpu.read_memory16(address);
}
UserspaceEmulator+LibX86: Clean up some obnoxious template spam Don't require clients to templatize modrm().read{8,16,32,64}() with the ValueWithShadow type when we can figure it out automatically. The main complication here is that ValueWithShadow is a UE concept while the MemoryOrRegisterReference inlines exist at the lower LibX86 layer and so doesn't have direct access to those types. But that's nothing we can't solve with some simple template trickery. :^)
2020-09-23 22:12:14 +03:00
template<typename CPU>
ALWAYS_INLINE typename CPU::ValueWithShadowType32 MemoryOrRegisterReference::read32(CPU& cpu, const Instruction& insn)
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
{
if (is_register())
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-21 03:29:59 +03:00
return cpu.const_gpr32(reg32());
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
LibX86+UserspaceEmulator: Don't store a32 in MemoryOrRegisterReference The a32 bit tells us whether a memory address is 32-bit or not. We already have this information in Instruction, so just plumb that around instead of double-caching the bit.
2020-07-14 20:07:32 +03:00
auto address = resolve(cpu, insn);
LibX86: Add a templatized way to resolve ModR/M memory references Hopefully this will be flexible enough for our SoftCPU. :^)
2020-07-10 17:23:07 +03:00
return cpu.read_memory32(address);
}
UserspaceEmulator+LibX86: Clean up some obnoxious template spam Don't require clients to templatize modrm().read{8,16,32,64}() with the ValueWithShadow type when we can figure it out automatically. The main complication here is that ValueWithShadow is a UE concept while the MemoryOrRegisterReference inlines exist at the lower LibX86 layer and so doesn't have direct access to those types. But that's nothing we can't solve with some simple template trickery. :^)
2020-09-23 22:12:14 +03:00
template<typename CPU>
ALWAYS_INLINE typename CPU::ValueWithShadowType64 MemoryOrRegisterReference::read64(CPU& cpu, const Instruction& insn)
UserspaceEmulator+LibX86: Add support for 64-bit memory reads and writes (#3584) This is useful for reading and writing doubles for #3329. It is also useful for emulating 64-bit binaries. MemoryOrRegisterReference assumes that 64-bit values are always memory references since that's enough for fpu support. If we ever want to emulate 64-bit binaries, that part will need minor updating.
2020-09-23 21:45:43 +03:00
{
ASSERT(!is_register());
auto address = resolve(cpu, insn);
return cpu.read_memory64(address);
}
LibX86+UserspaceEmulator: Devirtualize and inline more instruction code Use some template hacks to force GCC to inline more of the instruction decoding stuff into the UserspaceEmulator main execution loop. This is my last optimization for today, and we've gone from ~60 seconds when running "UserspaceEmulator UserspaceEmulator id" to ~8 seconds :^)
2020-07-13 22:00:51 +03:00
template<typename InstructionStreamType>
ALWAYS_INLINE Instruction Instruction::from_stream(InstructionStreamType& stream, bool o32, bool a32)
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
{
return Instruction(stream, o32, a32);
}
ALWAYS_INLINE unsigned Instruction::length() const
{
unsigned len = 1;
LibX86: Don't cache whether instruction have a sub-opcode We can just check if the first opcode byte is 0x0f to know this.
2020-07-14 20:16:33 +03:00
if (has_sub_op())
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
++len;
if (m_has_rm) {
++len;
if (m_modrm.m_has_sib)
++len;
len += m_modrm.m_displacement_bytes;
}
LibX86: Don't store the prefix/imm1/imm2 byte counts individually We can shrink and simplify Instruction a bit by combining these into a single "extra bytes" count.
2020-07-14 19:12:44 +03:00
len += m_extra_bytes;
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
return len;
}
LibX86: Remove Instruction::m_handler We can fetch the handler via Instruction::m_descriptor.
2020-07-14 18:41:20 +03:00
ALWAYS_INLINE Optional<SegmentRegister> to_segment_prefix(u8 op)
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
{
switch (op) {
case 0x26:
return SegmentRegister::ES;
case 0x2e:
return SegmentRegister::CS;
case 0x36:
return SegmentRegister::SS;
case 0x3e:
return SegmentRegister::DS;
case 0x64:
return SegmentRegister::FS;
case 0x65:
return SegmentRegister::GS;
default:
return {};
}
}
LibX86+UserspaceEmulator: Devirtualize and inline more instruction code Use some template hacks to force GCC to inline more of the instruction decoding stuff into the UserspaceEmulator main execution loop. This is my last optimization for today, and we've gone from ~60 seconds when running "UserspaceEmulator UserspaceEmulator id" to ~8 seconds :^)
2020-07-13 22:00:51 +03:00
template<typename InstructionStreamType>
ALWAYS_INLINE Instruction::Instruction(InstructionStreamType& stream, bool o32, bool a32)
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
: m_a32(a32)
, m_o32(o32)
{
LibX86: Don't store the prefix/imm1/imm2 byte counts individually We can shrink and simplify Instruction a bit by combining these into a single "extra bytes" count.
2020-07-14 19:12:44 +03:00
u8 prefix_bytes = 0;
for (;; ++prefix_bytes) {
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
u8 opbyte = stream.read8();
if (opbyte == Prefix::OperandSizeOverride) {
m_o32 = !o32;
m_has_operand_size_override_prefix = true;
continue;
}
if (opbyte == Prefix::AddressSizeOverride) {
m_a32 = !a32;
m_has_address_size_override_prefix = true;
continue;
}
if (opbyte == Prefix::REPZ || opbyte == Prefix::REPNZ) {
m_rep_prefix = opbyte;
continue;
}
if (opbyte == Prefix::LOCK) {
m_has_lock_prefix = true;
continue;
}
auto segment_prefix = to_segment_prefix(opbyte);
if (segment_prefix.has_value()) {
m_segment_prefix = segment_prefix;
continue;
}
m_op = opbyte;
break;
}
LibX86: Don't cache whether instruction have a sub-opcode We can just check if the first opcode byte is 0x0f to know this.
2020-07-14 20:16:33 +03:00
if (m_op == 0x0f) {
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
m_sub_op = stream.read8();
m_descriptor = m_o32 ? &s_0f_table32[m_sub_op] : &s_0f_table16[m_sub_op];
} else {
m_descriptor = m_o32 ? &s_table32[m_op] : &s_table16[m_op];
}
m_has_rm = m_descriptor->has_rm;
if (m_has_rm) {
// Consume ModR/M (may include SIB and displacement.)
m_modrm.decode(stream, m_a32);
m_register_index = (m_modrm.m_rm >> 3) & 7;
} else {
LibX86: Don't cache whether instruction have a sub-opcode We can just check if the first opcode byte is 0x0f to know this.
2020-07-14 20:16:33 +03:00
if (has_sub_op())
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
m_register_index = m_sub_op & 7;
else
m_register_index = m_op & 7;
}
LibX86: Disassemble most FPU instructions starting with D9 Some of these don't just use the REG bits of the mod/rm byte as slashes, but also the R/M bits to have up to 9 different instructions per opcode/slash combination (1 opcode requires that MOD is != 11, the other 8 have MODE == 11). This is done by making the slashes table two levels deep for these cases. Some of this is cosmetic (e.g "FST st0" has no effect already, but its bit pattern gets disassembled as "FNOP"), but for most uses it isn't. FSTENV and FSTCW have an extraordinary 0x9b prefix. This is not yet handled in this patch.
2020-07-28 18:09:54 +03:00
bool has_slash = m_descriptor->format == MultibyteWithSlash;
if (has_slash) {
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
m_descriptor = &m_descriptor->slashes[slash()];
LibX86: Disassemble most FPU instructions starting with D9 Some of these don't just use the REG bits of the mod/rm byte as slashes, but also the R/M bits to have up to 9 different instructions per opcode/slash combination (1 opcode requires that MOD is != 11, the other 8 have MODE == 11). This is done by making the slashes table two levels deep for these cases. Some of this is cosmetic (e.g "FST st0" has no effect already, but its bit pattern gets disassembled as "FNOP"), but for most uses it isn't. FSTENV and FSTCW have an extraordinary 0x9b prefix. This is not yet handled in this patch.
2020-07-28 18:09:54 +03:00
if ((rm() & 0xc0) == 0xc0 && m_descriptor->slashes)
m_descriptor = &m_descriptor->slashes[rm() & 7];
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
}
if (!m_descriptor->mnemonic) {
LibX86: Don't cache whether instruction have a sub-opcode We can just check if the first opcode byte is 0x0f to know this.
2020-07-14 20:16:33 +03:00
if (has_sub_op()) {
LibX86: Disassemble most FPU instructions starting with D9 Some of these don't just use the REG bits of the mod/rm byte as slashes, but also the R/M bits to have up to 9 different instructions per opcode/slash combination (1 opcode requires that MOD is != 11, the other 8 have MODE == 11). This is done by making the slashes table two levels deep for these cases. Some of this is cosmetic (e.g "FST st0" has no effect already, but its bit pattern gets disassembled as "FNOP"), but for most uses it isn't. FSTENV and FSTCW have an extraordinary 0x9b prefix. This is not yet handled in this patch.
2020-07-28 18:09:54 +03:00
if (has_slash)
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
fprintf(stderr, "Instruction %02X %02X /%u not understood\n", m_op, m_sub_op, slash());
else
fprintf(stderr, "Instruction %02X %02X not understood\n", m_op, m_sub_op);
} else {
LibX86: Disassemble most FPU instructions starting with D9 Some of these don't just use the REG bits of the mod/rm byte as slashes, but also the R/M bits to have up to 9 different instructions per opcode/slash combination (1 opcode requires that MOD is != 11, the other 8 have MODE == 11). This is done by making the slashes table two levels deep for these cases. Some of this is cosmetic (e.g "FST st0" has no effect already, but its bit pattern gets disassembled as "FNOP"), but for most uses it isn't. FSTENV and FSTCW have an extraordinary 0x9b prefix. This is not yet handled in this patch.
2020-07-28 18:09:54 +03:00
if (has_slash)
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
fprintf(stderr, "Instruction %02X /%u not understood\n", m_op, slash());
else
fprintf(stderr, "Instruction %02X not understood\n", m_op);
}
m_descriptor = nullptr;
return;
}
LibX86: Don't store the prefix/imm1/imm2 byte counts individually We can shrink and simplify Instruction a bit by combining these into a single "extra bytes" count.
2020-07-14 19:12:44 +03:00
auto imm1_bytes = m_descriptor->imm1_bytes_for_address_size(m_a32);
auto imm2_bytes = m_descriptor->imm2_bytes_for_address_size(m_a32);
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
// Consume immediates if present.
LibX86: Don't store the prefix/imm1/imm2 byte counts individually We can shrink and simplify Instruction a bit by combining these into a single "extra bytes" count.
2020-07-14 19:12:44 +03:00
switch (imm2_bytes) {
LibX86+UserspaceEmulator: Devirtualize and inline more instruction code Use some template hacks to force GCC to inline more of the instruction decoding stuff into the UserspaceEmulator main execution loop. This is my last optimization for today, and we've gone from ~60 seconds when running "UserspaceEmulator UserspaceEmulator id" to ~8 seconds :^)
2020-07-13 22:00:51 +03:00
case 1:
m_imm2 = stream.read8();
break;
case 2:
m_imm2 = stream.read16();
break;
case 4:
m_imm2 = stream.read32();
break;
}
LibX86: Don't store the prefix/imm1/imm2 byte counts individually We can shrink and simplify Instruction a bit by combining these into a single "extra bytes" count.
2020-07-14 19:12:44 +03:00
switch (imm1_bytes) {
LibX86+UserspaceEmulator: Devirtualize and inline more instruction code Use some template hacks to force GCC to inline more of the instruction decoding stuff into the UserspaceEmulator main execution loop. This is my last optimization for today, and we've gone from ~60 seconds when running "UserspaceEmulator UserspaceEmulator id" to ~8 seconds :^)
2020-07-13 22:00:51 +03:00
case 1:
m_imm1 = stream.read8();
break;
case 2:
m_imm1 = stream.read16();
break;
case 4:
m_imm1 = stream.read32();
break;
}
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
LibX86: Don't store the prefix/imm1/imm2 byte counts individually We can shrink and simplify Instruction a bit by combining these into a single "extra bytes" count.
2020-07-14 19:12:44 +03:00
m_extra_bytes = prefix_bytes + imm1_bytes + imm2_bytes;
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
#ifdef DISALLOW_INVALID_LOCK_PREFIX
if (m_has_lock_prefix && !m_descriptor->lock_prefix_allowed) {
fprintf(stderr, "Instruction not allowed with LOCK prefix, this will raise #UD\n");
m_descriptor = nullptr;
}
#endif
}
LibX86+UserspaceEmulator: Devirtualize and inline more instruction code Use some template hacks to force GCC to inline more of the instruction decoding stuff into the UserspaceEmulator main execution loop. This is my last optimization for today, and we've gone from ~60 seconds when running "UserspaceEmulator UserspaceEmulator id" to ~8 seconds :^)
2020-07-13 22:00:51 +03:00
template<typename InstructionStreamType>
ALWAYS_INLINE void MemoryOrRegisterReference::decode(InstructionStreamType& stream, bool a32)
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
{
m_rm = stream.read8();
LibX86+UserspaceEmulator: Don't store a32 in MemoryOrRegisterReference The a32 bit tells us whether a memory address is 32-bit or not. We already have this information in Instruction, so just plumb that around instead of double-caching the bit.
2020-07-14 20:07:32 +03:00
if (a32) {
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
decode32(stream);
switch (m_displacement_bytes) {
case 0:
break;
case 1:
m_displacement32 = sign_extended_to<u32>(stream.read8());
break;
case 4:
m_displacement32 = stream.read32();
break;
default:
ASSERT_NOT_REACHED();
break;
}
} else {
decode16(stream);
switch (m_displacement_bytes) {
case 0:
break;
case 1:
m_displacement16 = sign_extended_to<u16>(stream.read8());
break;
case 2:
m_displacement16 = stream.read16();
break;
default:
ASSERT_NOT_REACHED();
break;
}
}
}
LibX86+UserspaceEmulator: Devirtualize and inline more instruction code Use some template hacks to force GCC to inline more of the instruction decoding stuff into the UserspaceEmulator main execution loop. This is my last optimization for today, and we've gone from ~60 seconds when running "UserspaceEmulator UserspaceEmulator id" to ~8 seconds :^)
2020-07-13 22:00:51 +03:00
template<typename InstructionStreamType>
ALWAYS_INLINE void MemoryOrRegisterReference::decode16(InstructionStreamType&)
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
{
switch (m_rm & 0xc0) {
case 0:
if ((m_rm & 0x07) == 6)
m_displacement_bytes = 2;
else
ASSERT(m_displacement_bytes == 0);
break;
case 0x40:
m_displacement_bytes = 1;
break;
case 0x80:
m_displacement_bytes = 2;
break;
case 0xc0:
m_register_index = m_rm & 7;
break;
}
}
LibX86+UserspaceEmulator: Devirtualize and inline more instruction code Use some template hacks to force GCC to inline more of the instruction decoding stuff into the UserspaceEmulator main execution loop. This is my last optimization for today, and we've gone from ~60 seconds when running "UserspaceEmulator UserspaceEmulator id" to ~8 seconds :^)
2020-07-13 22:00:51 +03:00
template<typename InstructionStreamType>
ALWAYS_INLINE void MemoryOrRegisterReference::decode32(InstructionStreamType& stream)
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
{
switch (m_rm & 0xc0) {
case 0:
if ((m_rm & 0x07) == 5)
m_displacement_bytes = 4;
break;
case 0x40:
m_displacement_bytes = 1;
break;
case 0x80:
m_displacement_bytes = 4;
break;
case 0xc0:
m_register_index = m_rm & 7;
return;
}
m_has_sib = (m_rm & 0x07) == 4;
if (m_has_sib) {
m_sib = stream.read8();
if ((m_sib & 0x07) == 5) {
switch ((m_rm >> 6) & 0x03) {
case 0:
ASSERT(!m_displacement_bytes || m_displacement_bytes == 4);
m_displacement_bytes = 4;
break;
case 1:
ASSERT(!m_displacement_bytes || m_displacement_bytes == 1);
m_displacement_bytes = 1;
break;
case 2:
ASSERT(!m_displacement_bytes || m_displacement_bytes == 4);
m_displacement_bytes = 4;
break;
default:
ASSERT_NOT_REACHED();
break;
}
}
}
}
LibX86+UserspaceEmulator: Don't store a32 in MemoryOrRegisterReference The a32 bit tells us whether a memory address is 32-bit or not. We already have this information in Instruction, so just plumb that around instead of double-caching the bit.
2020-07-14 20:07:32 +03:00
template<typename CPU>
ALWAYS_INLINE LogicalAddress MemoryOrRegisterReference::resolve(const CPU& cpu, const Instruction& insn)
{
if (insn.a32())
return resolve32(cpu, insn.segment_prefix());
return resolve16(cpu, insn.segment_prefix());
}
LibX86: Apply aggressive inlining to Instruction decoding functions These functions really benefit from being inlined together instead of being separated. This yields roughly a ~2x speedup.
2020-07-13 21:34:54 +03:00
LibX86: Add an X86 instruction decoder library + basic disassembler This will be very useful for developer tools like ProfileView, and also for future tools like debuggers and such. :^)
2020-04-11 14:16:17 +03:00
}
Reference in New Issue Copy Permalink