x8664-encoding

the 8086

• 1979 Intel processor
• 4 general purpose 16-bit registers: AX, BX, CX, DX
• 4 special 16-bit registers: SI, DI, BP, SP

8086 instruction encoding: two-arg

• 1-byte opcode
• sometimes ModRM byte:
  • 2-bit ‘‘mod’’ and
  • 3-bit register number (source or dest, depends on opcode) and
  • 3-bit ‘‘r/m’’ (register or memory)
• ‘‘mod’’ + ‘‘r/m’’ specify one of:
  • %reg (mod = 11)
  • (%bx/%bp, %si/%di)
  • (%bx/%si/%di)
  • offset(%bx/%bp/,%si/%di) (8- or 16-byte offset)
• non-intuitive table

x86 modes

• x86 has multiple modes

• maintains compatiblity

• e.g.: modern x86 processor can work like 8086

  • called ‘‘real mode’’

• different mode for 32-bit/64-bit

• same basic encoding; some sizes change

32-bit addition: SIB bytes

• 8086 addressing modes made registers different

• 32-bit mode got rid of this (mostly)

• problem: not enough spare bits in ModRM byte

• solution: if ‘‘r/m’’ bits = 100 (4, normally ESP), extra ‘‘SIB’’ byte:

  • 2 bit scale: 00 is 1, 01 is 2, 10 is 4, 11 is 8
  • 3 bit index: index register number
  • 3 bit base: base register number

• (%baseReg,%indexReg,scale)

exercise 1 solution

• btsl $7, 4(%rax) / BTS DWORD PTR [RAX + 4], 7
• from ISA reference entry:
  • 0F BA /5 ib – BTS r/m32, imm8 — MI
  • 0F BA + ModRM byte with reg=5 + immediate byte
  • MI: operand 1 in ModRM byte r/m field; operand 2 in immediate byte
• from table:
  • [EAX]+disp8: mod 01, R/M 000; [EAX]+disp32: mod 10 R/M 000;
• 0F BA 0b01_101_000 04 07 = 0F BA 68 04 07
• 0F BA 0b10_101_000 04 00 00 00 07 = 0F BA A8 04 00 00 00 07

64-bit REX exercise (1)

• add %eax, %ecx (Intel: ADD ecx, eax)

  • 01 (opcode) c1 (MOD: 11 / REG: 000 (eax) / R/M: 001 (ecx))

• exercise 2a: add %eax, %r10d (Intel: ADD r10d, eax) = ???

  • REX prefix + 01 + MOD-REG-R/M byte

• REX prefix:

  • 0100
  • w (is 64-bit values?)
  • r (extra bit for Reg field)
  • s (extra bit for SIB index reg)
  • b (extra bit for R/M or SIB base field)

64-bit REX exercise (2)

• add %eax, %ecx (Intel: ADD ecx, eax)

  • 01 (opcode) c1 (MOD: 11 / REG: 000 (eax) / R/M: 001 (ecx))

• exercise 2b: add %rax, %rcx (Intel: ADD rcx, rax) = ???

  • REX prefix + 01 + MOD-REG-R/M byte

• REX prefix:

  • 0100
  • w (is 64-bit values?)
  • r (extra bit for Reg field)
  • s (extra bit for SIB index reg)
  • b (extra bit for R/M or SIB base field)

x86 encoding example (1)

• pushq %rax encoded as 50

  • 5-bit opcode 01010 plus 3-bit register number 000
    

• pushq %r13 encoded as 41 55

  • 41: REX prefix 0010 (constant), w:0, r:0, s:0, b:1
  • w = 0 because push is never 32-bit in 64-bit mode
  • 55: 5-bit opcode 01010; 3-bit reg # 101
  • 4-bit reg # 1101 = 13

x86 encoding example (2)

• addl 0x12345678(%rax,%rbx,2), %ecx
• 03: opcode — add r/m32 into r32
  
• 8c: ModRM: mod = 10; reg = 001, r/m: 100
  • reg = 001 = %ecx (table)
  • SIB byte + 32-bit displacement (table)
• 58: SIB: scale = 01, index = 011, base = 000
  • index 011 = %rbx; base 000 = %rax;
• 78 56 32 12: 32-bit constant 0x12345678

x86 encoding example (3)

• addq 0x12345678(%r10,%r11,2), %rax

• 4b: REX prefix 0100+w:1, r:0, s:1, b:1

• 03: opcode — add r/m64 to r64 (with REX.w)

• 84: ModRM: mod = 10; reg = 000, r/m: 100

  • reg = 0000 = %rax
  • SIB byte + 32-bit displacement (table)

• 5a: SIB: scale = 01, index = 011, base = 010

  • with REX: index = 1011 (11), base = 1010 (10)

• 78 56 32 12: 32-bit constant 0x12345678

x86 encoding example (4)

• movq %fs:0x10,%r13

• 64: FS segment override

• 48: REX: w: 1 (64-bit), r: 1, s: 0, b: 0

• 8b: opcode for MOV memory to register

• 2c: ModRM: mod = 00, reg = 101, r/m: 100

  • with REX: reg = 1101 [%r13]; r/m = 100 (SIB follows)

• 25: SIB: scale = 00; index = (0)100; base = (0)101

  • no register/no register in table

• 10 00 00 00: 4-byte constant 0x10

x86-64 impossibilities

• illegal: movq 0x12345678ab(%rax), %rax
  • maximum 32-bit displacement
  • movq 0x12345678ab, %rax okay
    • extra mov opcode for %rax only
• illegal: movq $0x12345678ab, %rbx
  • maximum 32-bit constant
  • movq $0x12345678ab, %rax okay
• illegal: pushl %eax
  • no 32-bit push/pop in 64-bit mode
  • but 16-bit allowed (operand size prefix byte 66)
• illegal: movq (%rax, %rsp), %rax
  • cannot use %rsp as index register
  • movq (%rsp, %rax), %rax okay

position dependence

• two ways of encoding addresses in x86-64 assembly:
  • address in little endian (typically 32-bits — limit on executable size)
  • (usually 32-bit) difference between address and %rip (next instruction address)