2 # Copyright 2005-2022 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
10 # Ascetic x86_64 AT&T to MASM/NASM assembler translator by <appro>.
12 # Why AT&T to MASM and not vice versa? Several reasons. Because AT&T
13 # format is way easier to parse. Because it's simpler to "gear" from
14 # Unix ABI to Windows one [see cross-reference "card" at the end of
15 # file]. Because Linux targets were available first...
17 # In addition the script also "distills" code suitable for GNU
18 # assembler, so that it can be compiled with more rigid assemblers,
19 # such as Solaris /usr/ccs/bin/as.
21 # This translator is not designed to convert *arbitrary* assembler
22 # code from AT&T format to MASM one. It's designed to convert just
23 # enough to provide for dual-ABI OpenSSL modules development...
24 # There *are* limitations and you might have to modify your assembler
25 # code or this script to achieve the desired result...
27 # Currently recognized limitations:
29 # - can't use multiple ops per line;
31 # Dual-ABI styling rules.
33 # 1. Adhere to Unix register and stack layout [see cross-reference
34 # ABI "card" at the end for explanation].
35 # 2. Forget about "red zone," stick to more traditional blended
36 # stack frame allocation. If volatile storage is actually required
37 # that is. If not, just leave the stack as is.
38 # 3. Functions tagged with ".type name,@function" get crafted with
39 # unified Win64 prologue and epilogue automatically. If you want
40 # to take care of ABI differences yourself, tag functions as
41 # ".type name,@abi-omnipotent" instead.
42 # 4. To optimize the Win64 prologue you can specify number of input
43 # arguments as ".type name,@function,N." Keep in mind that if N is
44 # larger than 6, then you *have to* write "abi-omnipotent" code,
45 # because >6 cases can't be addressed with unified prologue.
46 # 5. Name local labels as .L*, do *not* use dynamic labels such as 1:
47 # (sorry about latter).
48 # 6. Don't use [or hand-code with .byte] "rep ret." "ret" mnemonic is
49 # required to identify the spots, where to inject Win64 epilogue!
50 # But on the pros, it's then prefixed with rep automatically:-)
51 # 7. Stick to explicit ip-relative addressing. If you have to use
52 # GOTPCREL addressing, stick to mov symbol@GOTPCREL(%rip),%r??.
53 # Both are recognized and translated to proper Win64 addressing
56 # 8. In order to provide for structured exception handling unified
57 # Win64 prologue copies %rsp value to %rax. For further details
58 # see SEH paragraph at the end.
59 # 9. .init segment is allowed to contain calls to functions only.
60 # a. If function accepts more than 4 arguments *and* >4th argument
61 # is declared as non 64-bit value, do clear its upper part.
68 if ($flavour =~ /\./) { $output = $flavour; undef $flavour; }
70 open STDOUT,">$output" || die "can't open $output: $!"
71 if (defined($output));
73 my $gas=1; $gas=0 if ($output =~ /\.asm$/);
74 my $elf=1; $elf=0 if (!$gas);
79 my $masmref=8 + 50727*2**-32; # 8.00.50727 shipped with VS2005
86 # GNU as indicator, as opposed to $gas, which indicates acceptable
90 if ($flavour eq "mingw64") { $gas=1; $elf=0; $win64=1;
91 $prefix=`echo __USER_LABEL_PREFIX__ | $ENV{CC} -E -P -`;
92 $prefix =~ s|\R$||; # Better chomp
94 elsif ($flavour eq "macosx") { $gas=1; $elf=0; $prefix="_"; $decor="L\$"; }
95 elsif ($flavour eq "masm") { $gas=0; $elf=0; $masm=$masmref; $win64=1; $decor="\$L\$"; }
96 elsif ($flavour eq "nasm") { $gas=0; $elf=0; $nasm=$nasmref; $win64=1; $decor="\$L\$"; $PTR=""; }
98 { if ($ENV{ASM} =~ m/nasm/ && `nasm -v` =~ m/version ([0-9]+)\.([0-9]+)/i)
99 { $nasm = $1 + $2*0.01; $PTR=""; }
100 elsif (`ml64 2>&1` =~ m/Version ([0-9]+)\.([0-9]+)(\.([0-9]+))?/)
101 { $masm = $1 + $2*2**-16 + $4*2**-32; }
102 die "no assembler found on %PATH%" if (!($nasm || $masm));
107 # Find out if we're using GNU as
108 elsif (`$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
109 =~ /GNU assembler version ([2-9]\.[0-9]+)/)
113 elsif (`$ENV{CC} --version 2>/dev/null`
114 =~ /(clang .*|Intel.*oneAPI .*)/)
118 elsif (`$ENV{CC} -V 2>/dev/null`
125 if ($flavour =~ /elf/) {
126 # Always generate .note.gnu.property section for ELF outputs to
127 # mark Intel CET support since all input files must be marked
128 # with Intel CET support in order for linker to mark output with
130 my $p2align=3; $p2align=2 if ($flavour eq "elf32");
131 my $section='.note.gnu.property, #alloc';
132 $section='".note.gnu.property", "a"' if $gnuas;
133 $cet_property = <<_____;
140 # "GNU" encoded with .byte, since .asciz isn't supported
159 my $current_function;
162 { package opcode; # pick up opcodes
164 my ($class, $line) = @_;
168 if ($$line =~ /^([a-z][a-z0-9]*)/i) {
172 $$line = substr($$line,@+[0]); $$line =~ s/^\s+//;
175 if ($self->{op} =~ /^(movz)x?([bw]).*/) { # movz is pain...
178 } elsif ($self->{op} =~ /call|jmp/) {
180 } elsif ($self->{op} =~ /^p/ && $' !~ /^(ush|op|insrw)/) { # SSEn
182 } elsif ($self->{op} =~ /^[vk]/) { # VEX or k* such as kmov
184 } elsif ($self->{op} =~ /mov[dq]/ && $$line =~ /%xmm/) {
186 } elsif ($self->{op} =~ /([a-z]{3,})([qlwb])$/) {
194 my ($self, $sz) = @_;
195 $self->{sz} = $sz if (defined($sz) && !defined($self->{sz}));
201 if ($self->{op} eq "movz") { # movz is pain...
202 sprintf "%s%s%s",$self->{op},$self->{sz},shift;
203 } elsif ($self->{op} =~ /^set/) {
205 } elsif ($self->{op} eq "ret") {
207 if ($win64 && $current_function->{abi} eq "svr4") {
208 $epilogue = "movq 8(%rsp),%rdi\n\t" .
209 "movq 16(%rsp),%rsi\n\t";
211 $epilogue . ".byte 0xf3,0xc3";
212 } elsif ($self->{op} eq "call" && !$elf && $current_segment eq ".init") {
213 ".p2align\t3\n\t.quad";
215 "$self->{op}$self->{sz}";
218 $self->{op} =~ s/^movz/movzx/;
219 if ($self->{op} eq "ret") {
221 if ($win64 && $current_function->{abi} eq "svr4") {
222 $self->{op} = "mov rdi,QWORD$PTR\[8+rsp\]\t;WIN64 epilogue\n\t".
223 "mov rsi,QWORD$PTR\[16+rsp\]\n\t";
225 $self->{op} .= "DB\t0F3h,0C3h\t\t;repret";
226 } elsif ($self->{op} =~ /^(pop|push)f/) {
227 $self->{op} .= $self->{sz};
228 } elsif ($self->{op} eq "call" && $current_segment eq ".CRT\$XCU") {
229 $self->{op} = "\tDQ";
235 my ($self, $op) = @_;
236 $self->{op}=$op if (defined($op));
240 { package const; # pick up constants, which start with $
242 my ($class, $line) = @_;
246 if ($$line =~ /^\$([^,]+)/) {
250 $$line = substr($$line,@+[0]); $$line =~ s/^\s+//;
257 $self->{value} =~ s/\b(0b[0-1]+)/oct($1)/eig;
259 # Solaris /usr/ccs/bin/as can't handle multiplications
261 my $value = $self->{value};
262 no warnings; # oct might complain about overflow, ignore here...
263 $value =~ s/(?<![\w\$\.])(0x?[0-9a-f]+)/oct($1)/egi;
264 if ($value =~ s/([0-9]+\s*[\*\/\%]\s*[0-9]+)/eval($1)/eg) {
265 $self->{value} = $value;
267 sprintf "\$%s",$self->{value};
269 my $value = $self->{value};
270 $value =~ s/0x([0-9a-f]+)/0$1h/ig if ($masm);
275 { package ea; # pick up effective addresses: expr(%reg,%reg,scale)
277 my %szmap = ( b=>"BYTE$PTR", w=>"WORD$PTR",
278 l=>"DWORD$PTR", d=>"DWORD$PTR",
279 q=>"QWORD$PTR", o=>"OWORD$PTR",
280 x=>"XMMWORD$PTR", y=>"YMMWORD$PTR",
281 z=>"ZMMWORD$PTR" ) if (!$gas);
284 my ($class, $line, $opcode) = @_;
288 # optional * ----vvv--- appears in indirect jmp/call
289 if ($$line =~ /^(\*?)([^\(,]*)\(([%\w,]+)\)((?:{[^}]+})*)/) {
291 $self->{asterisk} = $1;
293 ($self->{base},$self->{index},$self->{scale})=split(/,/,$3);
294 $self->{scale} = 1 if (!defined($self->{scale}));
295 $self->{opmask} = $4;
297 $$line = substr($$line,@+[0]); $$line =~ s/^\s+//;
299 if ($win64 && $self->{label} =~ s/\@GOTPCREL//) {
300 die if ($opcode->mnemonic() ne "mov");
301 $opcode->mnemonic("lea");
303 $self->{base} =~ s/^%//;
304 $self->{index} =~ s/^%// if (defined($self->{index}));
305 $self->{opcode} = $opcode;
311 my ($self, $sz) = @_;
313 $self->{label} =~ s/([_a-z][_a-z0-9]*)/$globals{$1} or $1/gei;
314 $self->{label} =~ s/\.L/$decor/g;
316 # Silently convert all EAs to 64-bit. This is required for
317 # elder GNU assembler and results in more compact code,
318 # *but* most importantly AES module depends on this feature!
319 $self->{index} =~ s/^[er](.?[0-9xpi])[d]?$/r\1/;
320 $self->{base} =~ s/^[er](.?[0-9xpi])[d]?$/r\1/;
322 # Solaris /usr/ccs/bin/as can't handle multiplications
323 # in $self->{label}...
325 $self->{label} =~ s/(?<![\w\$\.])(0x?[0-9a-f]+)/oct($1)/egi;
326 $self->{label} =~ s/\b([0-9]+\s*[\*\/\%]\s*[0-9]+)\b/eval($1)/eg;
328 # Some assemblers insist on signed presentation of 32-bit
329 # offsets, but sign extension is a tricky business in perl...
331 $self->{label} =~ s/\b([0-9]+)\b/$1<<32>>32/eg;
333 $self->{label} =~ s/\b([0-9]+)\b/$1>>0/eg;
336 # if base register is %rbp or %r13, see if it's possible to
337 # flip base and index registers [for better performance]
338 if (!$self->{label} && $self->{index} && $self->{scale}==1 &&
339 $self->{base} =~ /(rbp|r13)/) {
340 $self->{base} = $self->{index}; $self->{index} = $1;
344 $self->{label} =~ s/^___imp_/__imp__/ if ($flavour eq "mingw64");
346 if (defined($self->{index})) {
347 sprintf "%s%s(%s,%%%s,%d)%s",
348 $self->{asterisk},$self->{label},
349 $self->{base}?"%$self->{base}":"",
350 $self->{index},$self->{scale},
353 sprintf "%s%s(%%%s)%s", $self->{asterisk},$self->{label},
354 $self->{base},$self->{opmask};
357 $self->{label} =~ s/\./\$/g;
358 $self->{label} =~ s/(?<![\w\$\.])0x([0-9a-f]+)/0$1h/ig;
359 $self->{label} = "($self->{label})" if ($self->{label} =~ /[\*\+\-\/]/);
361 my $mnemonic = $self->{opcode}->mnemonic();
362 ($self->{asterisk}) && ($sz="q") ||
363 ($mnemonic =~ /^v?mov([qd])$/) && ($sz=$1) ||
364 ($mnemonic =~ /^v?pinsr([qdwb])$/) && ($sz=$1) ||
365 ($mnemonic =~ /^vpbroadcast([qdwb])$/) && ($sz=$1) ||
366 ($mnemonic =~ /^v(?!perm)[a-z]+[fi]128$/) && ($sz="x");
368 $self->{opmask} =~ s/%(k[0-7])/$1/;
370 if (defined($self->{index})) {
371 sprintf "%s[%s%s*%d%s]%s",$szmap{$sz},
372 $self->{label}?"$self->{label}+":"",
373 $self->{index},$self->{scale},
374 $self->{base}?"+$self->{base}":"",
376 } elsif ($self->{base} eq "rip") {
377 sprintf "%s[%s]",$szmap{$sz},$self->{label};
379 sprintf "%s[%s%s]%s", $szmap{$sz},
380 $self->{label}?"$self->{label}+":"",
381 $self->{base},$self->{opmask};
386 { package register; # pick up registers, which start with %.
388 my ($class, $line, $opcode) = @_;
392 # optional * ----vvv--- appears in indirect jmp/call
393 if ($$line =~ /^(\*?)%(\w+)((?:{[^}]+})*)/) {
395 $self->{asterisk} = $1;
397 $self->{opmask} = $3;
398 $opcode->size($self->size());
400 $$line = substr($$line,@+[0]); $$line =~ s/^\s+//;
408 if ($self->{value} =~ /^r[\d]+b$/i) { $ret="b"; }
409 elsif ($self->{value} =~ /^r[\d]+w$/i) { $ret="w"; }
410 elsif ($self->{value} =~ /^r[\d]+d$/i) { $ret="l"; }
411 elsif ($self->{value} =~ /^r[\w]+$/i) { $ret="q"; }
412 elsif ($self->{value} =~ /^[a-d][hl]$/i){ $ret="b"; }
413 elsif ($self->{value} =~ /^[\w]{2}l$/i) { $ret="b"; }
414 elsif ($self->{value} =~ /^[\w]{2}$/i) { $ret="w"; }
415 elsif ($self->{value} =~ /^e[a-z]{2}$/i){ $ret="l"; }
421 if ($gas) { sprintf "%s%%%s%s", $self->{asterisk},
424 else { $self->{opmask} =~ s/%(k[0-7])/$1/;
425 $self->{value}.$self->{opmask}; }
428 { package label; # pick up labels, which end with :
430 my ($class, $line) = @_;
434 if ($$line =~ /(^[\.\w]+)\:/) {
438 $$line = substr($$line,@+[0]); $$line =~ s/^\s+//;
440 $self->{value} =~ s/^\.L/$decor/;
448 my $func = ($globals{$self->{value}} or $self->{value}) . ":";
449 if ($win64 && $current_function->{name} eq $self->{value}
450 && $current_function->{abi} eq "svr4") {
452 $func .= " movq %rdi,8(%rsp)\n";
453 $func .= " movq %rsi,16(%rsp)\n";
454 $func .= " movq %rsp,%rax\n";
455 $func .= "${decor}SEH_begin_$current_function->{name}:\n";
456 my $narg = $current_function->{narg};
457 $narg=6 if (!defined($narg));
458 $func .= " movq %rcx,%rdi\n" if ($narg>0);
459 $func .= " movq %rdx,%rsi\n" if ($narg>1);
460 $func .= " movq %r8,%rdx\n" if ($narg>2);
461 $func .= " movq %r9,%rcx\n" if ($narg>3);
462 $func .= " movq 40(%rsp),%r8\n" if ($narg>4);
463 $func .= " movq 48(%rsp),%r9\n" if ($narg>5);
466 } elsif ($self->{value} ne "$current_function->{name}") {
467 # Make all labels in masm global.
468 $self->{value} .= ":" if ($masm);
469 $self->{value} . ":";
470 } elsif ($win64 && $current_function->{abi} eq "svr4") {
471 my $func = "$current_function->{name}" .
472 ($nasm ? ":" : "\tPROC $current_function->{scope}") .
474 $func .= " mov QWORD$PTR\[8+rsp\],rdi\t;WIN64 prologue\n";
475 $func .= " mov QWORD$PTR\[16+rsp\],rsi\n";
476 $func .= " mov rax,rsp\n";
477 $func .= "${decor}SEH_begin_$current_function->{name}:";
478 $func .= ":" if ($masm);
480 my $narg = $current_function->{narg};
481 $narg=6 if (!defined($narg));
482 $func .= " mov rdi,rcx\n" if ($narg>0);
483 $func .= " mov rsi,rdx\n" if ($narg>1);
484 $func .= " mov rdx,r8\n" if ($narg>2);
485 $func .= " mov rcx,r9\n" if ($narg>3);
486 $func .= " mov r8,QWORD$PTR\[40+rsp\]\n" if ($narg>4);
487 $func .= " mov r9,QWORD$PTR\[48+rsp\]\n" if ($narg>5);
490 "$current_function->{name}".
491 ($nasm ? ":" : "\tPROC $current_function->{scope}");
495 { package expr; # pick up expressions
497 my ($class, $line, $opcode) = @_;
501 if ($$line =~ /(^[^,]+)/) {
505 $$line = substr($$line,@+[0]); $$line =~ s/^\s+//;
507 $self->{value} =~ s/\@PLT// if (!$elf);
508 $self->{value} =~ s/([_a-z][_a-z0-9]*)/$globals{$1} or $1/gei;
509 $self->{value} =~ s/\.L/$decor/g;
510 $self->{opcode} = $opcode;
516 if ($nasm && $self->{opcode}->mnemonic()=~m/^j(?![re]cxz)/) {
517 "NEAR ".$self->{value};
523 { package cfi_directive;
524 # CFI directives annotate instructions that are significant for
525 # stack unwinding procedure compliant with DWARF specification,
526 # see http://dwarfstd.org/. Besides naturally expected for this
527 # script platform-specific filtering function, this module adds
528 # three auxiliary synthetic directives not recognized by [GNU]
531 # - .cfi_push to annotate push instructions in prologue, which
532 # translates to .cfi_adjust_cfa_offset (if needed) and
534 # - .cfi_pop to annotate pop instructions in epilogue, which
535 # translates to .cfi_adjust_cfa_offset (if needed) and
537 # - [and most notably] .cfi_cfa_expression which encodes
538 # DW_CFA_def_cfa_expression and passes it to .cfi_escape as
541 # CFA expressions were introduced in DWARF specification version
542 # 3 and describe how to deduce CFA, Canonical Frame Address. This
543 # becomes handy if your stack frame is variable and you can't
544 # spare register for [previous] frame pointer. Suggested directive
545 # syntax is made-up mix of DWARF operator suffixes [subset of]
546 # and references to registers with optional bias. Following example
547 # describes offloaded *original* stack pointer at specific offset
548 # from *current* stack pointer:
550 # .cfi_cfa_expression %rsp+40,deref,+8
552 # Final +8 has everything to do with the fact that CFA is defined
553 # as reference to top of caller's stack, and on x86_64 call to
554 # subroutine pushes 8-byte return address. In other words original
555 # stack pointer upon entry to a subroutine is 8 bytes off from CFA.
557 # Below constants are taken from "DWARF Expressions" section of the
558 # DWARF specification, section is numbered 7.7 in versions 3 and 4.
559 my %DW_OP_simple = ( # no-arg operators, mapped directly
560 deref => 0x06, dup => 0x12,
561 drop => 0x13, over => 0x14,
562 pick => 0x15, swap => 0x16,
563 rot => 0x17, xderef => 0x18,
565 abs => 0x19, and => 0x1a,
566 div => 0x1b, minus => 0x1c,
567 mod => 0x1d, mul => 0x1e,
568 neg => 0x1f, not => 0x20,
569 or => 0x21, plus => 0x22,
570 shl => 0x24, shr => 0x25,
571 shra => 0x26, xor => 0x27,
574 my %DW_OP_complex = ( # used in specific subroutines
575 constu => 0x10, # uleb128
576 consts => 0x11, # sleb128
577 plus_uconst => 0x23, # uleb128
578 lit0 => 0x30, # add 0-31 to opcode
579 reg0 => 0x50, # add 0-31 to opcode
580 breg0 => 0x70, # add 0-31 to opcole, sleb128
581 regx => 0x90, # uleb28
582 fbreg => 0x91, # sleb128
583 bregx => 0x92, # uleb128, sleb128
584 piece => 0x93, # uleb128
587 # Following constants are defined in x86_64 ABI supplement, for
588 # example available at https://www.uclibc.org/docs/psABI-x86_64.pdf,
589 # see section 3.7 "Stack Unwind Algorithm".
591 "%rax"=>0, "%rdx"=>1, "%rcx"=>2, "%rbx"=>3,
592 "%rsi"=>4, "%rdi"=>5, "%rbp"=>6, "%rsp"=>7,
593 "%r8" =>8, "%r9" =>9, "%r10"=>10, "%r11"=>11,
594 "%r12"=>12, "%r13"=>13, "%r14"=>14, "%r15"=>15
597 my ($cfa_reg, $cfa_rsp);
600 # [us]leb128 format is variable-length integer representation base
601 # 2^128, with most significant bit of each byte being 0 denoting
602 # *last* most significant digit. See "Variable Length Data" in the
603 # DWARF specification, numbered 7.6 at least in versions 3 and 4.
605 use integer; # get right shift extend sign
608 my $sign = ($val < 0) ? -1 : 0;
612 push @ret, $val&0x7f;
614 # see if remaining bits are same and equal to most
615 # significant bit of the current digit, if so, it's
617 last if (($val>>6) == $sign);
630 push @ret, $val&0x7f;
632 # see if it's last significant digit...
633 last if (($val >>= 7) == 0);
643 if ($val >= 0 && $val < 32) {
644 return ($DW_OP_complex{lit0}+$val);
646 return ($DW_OP_complex{consts}, sleb128($val));
651 return if ($val !~ m/^(%r\w+)(?:([\+\-])((?:0x)?[0-9a-f]+))?/);
653 my $reg = $DW_reg_idx{$1};
654 my $off = eval ("0 $2 $3");
656 return (($DW_OP_complex{breg0} + $reg), sleb128($off));
657 # Yes, we use DW_OP_bregX+0 to push register value and not
658 # DW_OP_regX, because latter would require even DW_OP_piece,
659 # which would be a waste under the circumstances. If you have
660 # to use DWP_OP_reg, use "regx:N"...
666 foreach my $token (split(/,\s*/,$line)) {
667 if ($token =~ /^%r/) {
668 push @ret,reg($token);
669 } elsif ($token =~ /((?:0x)?[0-9a-f]+)\((%r\w+)\)/) {
670 push @ret,reg("$2+$1");
671 } elsif ($token =~ /(\w+):(\-?(?:0x)?[0-9a-f]+)(U?)/i) {
673 push @ret,$DW_OP_complex{$1}, ($3 ? uleb128($i) : sleb128($i));
674 } elsif (my $i = 1*eval($token) or $token eq "0") {
675 if ($token =~ /^\+/) {
676 push @ret,$DW_OP_complex{plus_uconst},uleb128($i);
681 push @ret,$DW_OP_simple{$token};
685 # Finally we return DW_CFA_def_cfa_expression, 15, followed by
686 # length of the expression and of course the expression itself.
687 return (15,scalar(@ret),@ret);
690 my ($class, $line) = @_;
694 if ($$line =~ s/^\s*\.cfi_(\w+)\s*//) {
697 undef $self->{value};
701 # What is $cfa_rsp? Effectively it's difference between %rsp
702 # value and current CFA, Canonical Frame Address, which is
703 # why it starts with -8. Recall that CFA is top of caller's
705 /startproc/ && do { ($cfa_reg, $cfa_rsp) = ("%rsp", -8); last; };
706 /endproc/ && do { ($cfa_reg, $cfa_rsp) = ("%rsp", 0);
707 # .cfi_remember_state directives that are not
708 # matched with .cfi_restore_state are
710 die "unpaired .cfi_remember_state" if (@cfa_stack);
714 && do { $cfa_reg = $$line; last; };
716 && do { $cfa_rsp = -1*eval($$line) if ($cfa_reg eq "%rsp");
720 && do { $cfa_rsp -= 1*eval($$line) if ($cfa_reg eq "%rsp");
723 /def_cfa/ && do { if ($$line =~ /(%r\w+)\s*,\s*(.+)/) {
725 $cfa_rsp = -1*eval($2) if ($cfa_reg eq "%rsp");
729 /push/ && do { $dir = undef;
731 if ($cfa_reg eq "%rsp") {
732 $self->{value} = ".cfi_adjust_cfa_offset\t8\n";
734 $self->{value} .= ".cfi_offset\t$$line,$cfa_rsp";
737 /pop/ && do { $dir = undef;
739 if ($cfa_reg eq "%rsp") {
740 $self->{value} = ".cfi_adjust_cfa_offset\t-8\n";
742 $self->{value} .= ".cfi_restore\t$$line";
746 && do { $dir = undef;
747 $self->{value} = ".cfi_escape\t" .
748 join(",", map(sprintf("0x%02x", $_),
749 cfa_expression($$line)));
753 && do { push @cfa_stack, [$cfa_reg, $cfa_rsp];
757 && do { ($cfa_reg, $cfa_rsp) = @{pop @cfa_stack};
762 $self->{value} = ".cfi_$dir\t$$line" if ($dir);
771 return ($elf ? $self->{value} : undef);
774 { package directive; # pick up directives, which start with .
776 my ($class, $line) = @_;
781 # chain-call to cfi_directive
782 $ret = cfi_directive->re($line) and return $ret;
784 if ($$line =~ /^\s*(\.\w+)/) {
788 undef $self->{value};
789 $$line = substr($$line,@+[0]); $$line =~ s/^\s+//;
792 /\.global|\.globl|\.extern/
793 && do { $globals{$$line} = $prefix . $$line;
794 $$line = $globals{$$line} if ($prefix);
797 /\.type/ && do { my ($sym,$type,$narg) = split(',',$$line);
798 if ($type eq "\@function") {
799 undef $current_function;
800 $current_function->{name} = $sym;
801 $current_function->{abi} = "svr4";
802 $current_function->{narg} = $narg;
803 $current_function->{scope} = defined($globals{$sym})?"PUBLIC":"PRIVATE";
804 } elsif ($type eq "\@abi-omnipotent") {
805 undef $current_function;
806 $current_function->{name} = $sym;
807 $current_function->{scope} = defined($globals{$sym})?"PUBLIC":"PRIVATE";
809 $$line =~ s/\@abi\-omnipotent/\@function/;
810 $$line =~ s/\@function.*/\@function/;
813 /\.asciz/ && do { if ($$line =~ /^"(.*)"$/) {
815 $$line = join(",",unpack("C*",$1),0);
819 /\.rva|\.long|\.quad|\.byte/
820 && do { $$line =~ s/([_a-z][_a-z0-9]*)/$globals{$1} or $1/gei;
821 $$line =~ s/\.L/$decor/g;
827 $self->{value} = $dir . "\t" . $$line;
829 if ($dir =~ /\.extern/) {
830 $self->{value} = ""; # swallow extern
831 } elsif (!$elf && $dir =~ /\.type/) {
833 $self->{value} = ".def\t" . ($globals{$1} or $1) . ";\t" .
834 (defined($globals{$1})?".scl 2;":".scl 3;") .
835 "\t.type 32;\t.endef"
836 if ($win64 && $$line =~ /([^,]+),\@function/);
837 } elsif (!$elf && $dir =~ /\.size/) {
839 if (defined($current_function)) {
840 $self->{value} .= "${decor}SEH_end_$current_function->{name}:"
841 if ($win64 && $current_function->{abi} eq "svr4");
842 undef $current_function;
844 } elsif (!$elf && $dir =~ /\.align/) {
845 $self->{value} = ".p2align\t" . (log($$line)/log(2));
846 } elsif ($dir eq ".section") {
847 $current_segment=$$line;
848 if (!$elf && $current_segment eq ".init") {
849 if ($flavour eq "macosx") { $self->{value} = ".mod_init_func"; }
850 elsif ($flavour eq "mingw64") { $self->{value} = ".section\t.ctors"; }
852 } elsif ($dir =~ /\.(text|data)/) {
853 $current_segment=".$1";
854 } elsif ($dir =~ /\.hidden/) {
855 if ($flavour eq "macosx") { $self->{value} = ".private_extern\t$prefix$$line"; }
856 elsif ($flavour eq "mingw64") { $self->{value} = ""; }
857 } elsif ($dir =~ /\.comm/) {
858 $self->{value} = "$dir\t$prefix$$line";
859 $self->{value} =~ s|,([0-9]+),([0-9]+)$|",$1,".log($2)/log(2)|e if ($flavour eq "macosx");
865 # non-gas case or nasm/masm
867 /\.text/ && do { my $v=undef;
869 $v="section .text code align=64\n";
871 $v="$current_segment\tENDS\n" if ($current_segment);
872 $current_segment = ".text\$";
873 $v.="$current_segment\tSEGMENT ";
874 $v.=$masm>=$masmref ? "ALIGN(256)" : "PAGE";
880 /\.data/ && do { my $v=undef;
882 $v="section .data data align=8\n";
884 $v="$current_segment\tENDS\n" if ($current_segment);
885 $current_segment = "_DATA";
886 $v.="$current_segment\tSEGMENT";
891 /\.section/ && do { my $v=undef;
892 $$line =~ s/([^,]*).*/$1/;
893 $$line = ".CRT\$XCU" if ($$line eq ".init");
896 if ($$line=~/\.([px])data/) {
898 $v.=$1 eq "p"? 4 : 8;
899 } elsif ($$line=~/\.CRT\$/i) {
900 $v.=" rdata align=8";
903 $v="$current_segment\tENDS\n" if ($current_segment);
904 $v.="$$line\tSEGMENT";
905 if ($$line=~/\.([px])data/) {
907 $v.=" ALIGN(".($1 eq "p" ? 4 : 8).")" if ($masm>=$masmref);
908 } elsif ($$line=~/\.CRT\$/i) {
910 $v.=$masm>=$masmref ? "ALIGN(8)" : "DWORD";
913 $current_segment = $$line;
917 /\.extern/ && do { $self->{value} = "EXTERN\t".$$line;
918 $self->{value} .= ":NEAR" if ($masm);
922 && do { $self->{value} = $masm?"PUBLIC":"global";
923 $self->{value} .= "\t".$$line;
926 /\.size/ && do { if (defined($current_function)) {
927 undef $self->{value};
928 if ($current_function->{abi} eq "svr4") {
929 $self->{value}="${decor}SEH_end_$current_function->{name}:";
930 $self->{value}.=":\n" if($masm);
932 $self->{value}.="$current_function->{name}\tENDP" if($masm && $current_function->{name});
933 undef $current_function;
937 /\.align/ && do { my $max = ($masm && $masm>=$masmref) ? 256 : 4096;
938 $self->{value} = "ALIGN\t".($$line>$max?$max:$$line);
941 /\.(value|long|rva|quad)/
942 && do { my $sz = substr($1,0,1);
943 my @arr = split(/,\s*/,$$line);
944 my $last = pop(@arr);
945 my $conv = sub { my $var=shift;
946 $var=~s/^(0b[0-1]+)/oct($1)/eig;
947 $var=~s/^0x([0-9a-f]+)/0$1h/ig if ($masm);
948 if ($sz eq "D" && ($current_segment=~/.[px]data/ || $dir eq ".rva"))
949 { $var=~s/^([_a-z\$\@][_a-z0-9\$\@]*)/$nasm?"$1 wrt ..imagebase":"imagerel $1"/egi; }
953 $sz =~ tr/bvlrq/BWDDQ/;
954 $self->{value} = "\tD$sz\t";
955 for (@arr) { $self->{value} .= &$conv($_).","; }
956 $self->{value} .= &$conv($last);
959 /\.byte/ && do { my @str=split(/,\s*/,$$line);
960 map(s/(0b[0-1]+)/oct($1)/eig,@str);
961 map(s/0x([0-9a-f]+)/0$1h/ig,@str) if ($masm);
963 $self->{value}.="DB\t"
964 .join(",",@str[0..15])."\n";
965 foreach (0..15) { shift @str; }
967 $self->{value}.="DB\t"
968 .join(",",@str) if (@str);
971 /\.comm/ && do { my @str=split(/,\s*/,$$line);
974 $v.="common $prefix@str[0] @str[1]";
976 $v="$current_segment\tENDS\n" if ($current_segment);
977 $current_segment = "_DATA";
978 $v.="$current_segment\tSEGMENT\n";
979 $v.="COMM @str[0]:DWORD:".@str[1]/4;
996 # Upon initial x86_64 introduction SSE>2 extensions were not introduced
997 # yet. In order not to be bothered by tracing exact assembler versions,
998 # but at the same time to provide a bare security minimum of AES-NI, we
999 # hard-code some instructions. Extensions past AES-NI on the other hand
1000 # are traced by examining assembler version in individual perlasm
1003 my %regrm = ( "%eax"=>0, "%ecx"=>1, "%edx"=>2, "%ebx"=>3,
1004 "%esp"=>4, "%ebp"=>5, "%esi"=>6, "%edi"=>7 );
1008 my ($dst,$src,$rex)=@_;
1010 $rex|=0x04 if($dst>=8);
1011 $rex|=0x01 if($src>=8);
1012 push @$opcode,($rex|0x40) if ($rex);
1015 my $movq = sub { # elderly gas can't handle inter-register movq
1018 if ($arg =~ /%xmm([0-9]+),\s*%r(\w+)/) {
1019 my ($src,$dst)=($1,$2);
1020 if ($dst !~ /[0-9]+/) { $dst = $regrm{"%e$dst"}; }
1021 rex(\@opcode,$src,$dst,0x8);
1022 push @opcode,0x0f,0x7e;
1023 push @opcode,0xc0|(($src&7)<<3)|($dst&7); # ModR/M
1025 } elsif ($arg =~ /%r(\w+),\s*%xmm([0-9]+)/) {
1026 my ($src,$dst)=($2,$1);
1027 if ($dst !~ /[0-9]+/) { $dst = $regrm{"%e$dst"}; }
1028 rex(\@opcode,$src,$dst,0x8);
1029 push @opcode,0x0f,0x6e;
1030 push @opcode,0xc0|(($src&7)<<3)|($dst&7); # ModR/M
1038 if (shift =~ /\$([0-9]+),\s*%xmm([0-9]+),\s*(%\w+)/) {
1043 if ($dst =~ /%r([0-9]+)d/) { $dst = $1; }
1044 elsif ($dst =~ /%e/) { $dst = $regrm{$dst}; }
1045 rex(\@opcode,$src,$dst);
1046 push @opcode,0x0f,0x3a,0x16;
1047 push @opcode,0xc0|(($src&7)<<3)|($dst&7); # ModR/M
1056 if (shift =~ /\$([0-9]+),\s*(%\w+),\s*%xmm([0-9]+)/) {
1061 if ($src =~ /%r([0-9]+)/) { $src = $1; }
1062 elsif ($src =~ /%e/) { $src = $regrm{$src}; }
1063 rex(\@opcode,$dst,$src);
1064 push @opcode,0x0f,0x3a,0x22;
1065 push @opcode,0xc0|(($dst&7)<<3)|($src&7); # ModR/M
1074 if (shift =~ /%xmm([0-9]+),\s*%xmm([0-9]+)/) {
1076 rex(\@opcode,$2,$1);
1077 push @opcode,0x0f,0x38,0x00;
1078 push @opcode,0xc0|($1&7)|(($2&7)<<3); # ModR/M
1086 if (shift =~ /\$([0-9]+),\s*%xmm([0-9]+),\s*%xmm([0-9]+)/) {
1088 rex(\@opcode,$3,$2);
1089 push @opcode,0x0f,0x3a,0x0f;
1090 push @opcode,0xc0|($2&7)|(($3&7)<<3); # ModR/M
1098 my $pclmulqdq = sub {
1099 if (shift =~ /\$([x0-9a-f]+),\s*%xmm([0-9]+),\s*%xmm([0-9]+)/) {
1101 rex(\@opcode,$3,$2);
1102 push @opcode,0x0f,0x3a,0x44;
1103 push @opcode,0xc0|($2&7)|(($3&7)<<3); # ModR/M
1105 push @opcode,$c=~/^0/?oct($c):$c;
1113 if (shift =~ /%[er](\w+)/) {
1116 if ($dst !~ /[0-9]+/) { $dst = $regrm{"%e$dst"}; }
1117 rex(\@opcode,0,$dst,8);
1118 push @opcode,0x0f,0xc7,0xf0|($dst&7);
1126 if (shift =~ /%[er](\w+)/) {
1129 if ($dst !~ /[0-9]+/) { $dst = $regrm{"%e$dst"}; }
1130 rex(\@opcode,0,$dst,8);
1131 push @opcode,0x0f,0xc7,0xf8|($dst&7);
1138 # Not all AVX-capable assemblers recognize AMD XOP extension. Since we
1139 # are using only two instructions hand-code them in order to be excused
1140 # from chasing assembler versions...
1144 my ($dst,$src1,$src2,$rxb)=@_;
1147 $rxb&=~(0x04<<5) if($dst>=8);
1148 $rxb&=~(0x01<<5) if($src1>=8);
1149 $rxb&=~(0x02<<5) if($src2>=8);
1154 if (shift =~ /\$([x0-9a-f]+),\s*%xmm([0-9]+),\s*%xmm([0-9]+)/) {
1156 rxb(\@opcode,$3,$2,-1,0x08);
1157 push @opcode,0x78,0xc2;
1158 push @opcode,0xc0|($2&7)|(($3&7)<<3); # ModR/M
1160 push @opcode,$c=~/^0/?oct($c):$c;
1168 if (shift =~ /\$([x0-9a-f]+),\s*%xmm([0-9]+),\s*%xmm([0-9]+)/) {
1170 rxb(\@opcode,$3,$2,-1,0x08);
1171 push @opcode,0x78,0xc3;
1172 push @opcode,0xc0|($2&7)|(($3&7)<<3); # ModR/M
1174 push @opcode,$c=~/^0/?oct($c):$c;
1181 # Intel Control-flow Enforcement Technology extension. All functions and
1182 # indirect branch targets will have to start with this instruction...
1184 my $endbranch = sub {
1185 (0xf3,0x0f,0x1e,0xfa);
1188 ########################################################################
1202 while(defined(my $line=<>)) {
1204 $line =~ s|\R$||; # Better chomp
1206 $line =~ s|[#!].*$||; # get rid of asm-style comments...
1207 $line =~ s|/\*.*\*/||; # ... and C-style comments...
1208 $line =~ s|^\s+||; # ... and skip whitespaces in beginning
1209 $line =~ s|\s+$||; # ... and at the end
1211 if (my $label=label->re(\$line)) { print $label->out(); }
1213 if (my $directive=directive->re(\$line)) {
1214 printf "%s",$directive->out();
1215 } elsif (my $opcode=opcode->re(\$line)) {
1216 my $asm = eval("\$".$opcode->mnemonic());
1218 if ((ref($asm) eq 'CODE') && scalar(my @bytes=&$asm($line))) {
1219 print $gas?".byte\t":"DB\t",join(',',@bytes),"\n";
1224 ARGUMENT: while (1) {
1227 ($arg=register->re(\$line, $opcode))||
1228 ($arg=const->re(\$line)) ||
1229 ($arg=ea->re(\$line, $opcode)) ||
1230 ($arg=expr->re(\$line, $opcode)) ||
1235 last ARGUMENT if ($line !~ /^,/);
1242 my $sz=$opcode->size();
1245 $insn = $opcode->out($#args>=1?$args[$#args]->size():$sz);
1246 @args = map($_->out($sz),@args);
1247 printf "\t%s\t%s",$insn,join(",",@args);
1249 $insn = $opcode->out();
1251 my $arg = $_->out();
1252 # $insn.=$sz compensates for movq, pinsrw, ...
1253 if ($arg =~ /^xmm[0-9]+$/) { $insn.=$sz; $sz="x" if(!$sz); last; }
1254 if ($arg =~ /^ymm[0-9]+$/) { $insn.=$sz; $sz="y" if(!$sz); last; }
1255 if ($arg =~ /^zmm[0-9]+$/) { $insn.=$sz; $sz="z" if(!$sz); last; }
1256 if ($arg =~ /^mm[0-9]+$/) { $insn.=$sz; $sz="q" if(!$sz); last; }
1258 @args = reverse(@args);
1259 undef $sz if ($nasm && $opcode->mnemonic() eq "lea");
1260 printf "\t%s\t%s",$insn,join(",",map($_->out($sz),@args));
1263 printf "\t%s",$opcode->out();
1270 print "$cet_property" if ($cet_property);
1271 print "\n$current_segment\tENDS\n" if ($current_segment && $masm);
1272 print "END\n" if ($masm);
1274 close STDOUT or die "error closing STDOUT: $!;"
1276 \f#################################################
1277 # Cross-reference x86_64 ABI "card"
1297 # (*) volatile register
1298 # (-) preserved by callee
1299 # (#) Nth argument, volatile
1301 # In Unix terms top of stack is argument transfer area for arguments
1302 # which could not be accommodated in registers. Or in other words 7th
1303 # [integer] argument resides at 8(%rsp) upon function entry point.
1304 # 128 bytes above %rsp constitute a "red zone" which is not touched
1305 # by signal handlers and can be used as temporal storage without
1306 # allocating a frame.
1308 # In Win64 terms N*8 bytes on top of stack is argument transfer area,
1309 # which belongs to/can be overwritten by callee. N is the number of
1310 # arguments passed to callee, *but* not less than 4! This means that
1311 # upon function entry point 5th argument resides at 40(%rsp), as well
1312 # as that 32 bytes from 8(%rsp) can always be used as temporal
1313 # storage [without allocating a frame]. One can actually argue that
1314 # one can assume a "red zone" above stack pointer under Win64 as well.
1315 # Point is that at apparently no occasion Windows kernel would alter
1316 # the area above user stack pointer in true asynchronous manner...
1318 # All the above means that if assembler programmer adheres to Unix
1319 # register and stack layout, but disregards the "red zone" existence,
1320 # it's possible to use following prologue and epilogue to "gear" from
1321 # Unix to Win64 ABI in leaf functions with not more than 6 arguments.
1323 # omnipotent_function:
1326 # movq %rsi,16(%rsp)
1327 # movq %rcx,%rdi ; if 1st argument is actually present
1328 # movq %rdx,%rsi ; if 2nd argument is actually ...
1329 # movq %r8,%rdx ; if 3rd argument is ...
1330 # movq %r9,%rcx ; if 4th argument ...
1331 # movq 40(%rsp),%r8 ; if 5th ...
1332 # movq 48(%rsp),%r9 ; if 6th ...
1337 # movq 16(%rsp),%rsi
1341 \f#################################################
1342 # Win64 SEH, Structured Exception Handling.
1344 # Unlike on Unix systems(*) lack of Win64 stack unwinding information
1345 # has undesired side-effect at run-time: if an exception is raised in
1346 # assembler subroutine such as those in question (basically we're
1347 # referring to segmentation violations caused by malformed input
1348 # parameters), the application is briskly terminated without invoking
1349 # any exception handlers, most notably without generating memory dump
1350 # or any user notification whatsoever. This poses a problem. It's
1351 # possible to address it by registering custom language-specific
1352 # handler that would restore processor context to the state at
1353 # subroutine entry point and return "exception is not handled, keep
1354 # unwinding" code. Writing such handler can be a challenge... But it's
1355 # doable, though requires certain coding convention. Consider following
1358 # .type function,@function
1360 # movq %rsp,%rax # copy rsp to volatile register
1361 # pushq %r15 # save non-volatile registers
1365 # subq %rdi,%r11 # prepare [variable] stack frame
1367 # movq %rax,0(%r11) # check for exceptions
1368 # movq %r11,%rsp # allocate [variable] stack frame
1369 # movq %rax,0(%rsp) # save original rsp value
1372 # movq 0(%rsp),%rcx # pull original rsp value
1373 # movq -24(%rcx),%rbp # restore non-volatile registers
1374 # movq -16(%rcx),%rbx
1375 # movq -8(%rcx),%r15
1376 # movq %rcx,%rsp # restore original rsp
1379 # .size function,.-function
1381 # The key is that up to magic_point copy of original rsp value remains
1382 # in chosen volatile register and no non-volatile register, except for
1383 # rsp, is modified. While past magic_point rsp remains constant till
1384 # the very end of the function. In this case custom language-specific
1385 # exception handler would look like this:
1387 # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
1388 # CONTEXT *context,DISPATCHER_CONTEXT *disp)
1389 # { ULONG64 *rsp = (ULONG64 *)context->Rax;
1390 # ULONG64 rip = context->Rip;
1392 # if (rip >= magic_point)
1393 # { rsp = (ULONG64 *)context->Rsp;
1394 # if (rip < magic_epilogue)
1395 # { rsp = (ULONG64 *)rsp[0];
1396 # context->Rbp = rsp[-3];
1397 # context->Rbx = rsp[-2];
1398 # context->R15 = rsp[-1];
1401 # context->Rsp = (ULONG64)rsp;
1402 # context->Rdi = rsp[1];
1403 # context->Rsi = rsp[2];
1405 # memcpy (disp->ContextRecord,context,sizeof(CONTEXT));
1406 # RtlVirtualUnwind(UNW_FLAG_NHANDLER,disp->ImageBase,
1407 # dips->ControlPc,disp->FunctionEntry,disp->ContextRecord,
1408 # &disp->HandlerData,&disp->EstablisherFrame,NULL);
1409 # return ExceptionContinueSearch;
1412 # It's appropriate to implement this handler in assembler, directly in
1413 # function's module. In order to do that one has to know members'
1414 # offsets in CONTEXT and DISPATCHER_CONTEXT structures and some constant
1415 # values. Here they are:
1435 # sizeof(CONTEXT) 1232
1436 # DISPATCHER_CONTEXT.ControlPc 0
1437 # DISPATCHER_CONTEXT.ImageBase 8
1438 # DISPATCHER_CONTEXT.FunctionEntry 16
1439 # DISPATCHER_CONTEXT.EstablisherFrame 24
1440 # DISPATCHER_CONTEXT.TargetIp 32
1441 # DISPATCHER_CONTEXT.ContextRecord 40
1442 # DISPATCHER_CONTEXT.LanguageHandler 48
1443 # DISPATCHER_CONTEXT.HandlerData 56
1444 # UNW_FLAG_NHANDLER 0
1445 # ExceptionContinueSearch 1
1447 # In order to tie the handler to the function one has to compose
1448 # couple of structures: one for .xdata segment and one for .pdata.
1450 # UNWIND_INFO structure for .xdata segment would be
1452 # function_unwind_info:
1456 # This structure designates exception handler for a function with
1457 # zero-length prologue, no stack frame or frame register.
1459 # To facilitate composing of .pdata structures, auto-generated "gear"
1460 # prologue copies rsp value to rax and denotes next instruction with
1461 # .LSEH_begin_{function_name} label. This essentially defines the SEH
1462 # styling rule mentioned in the beginning. Position of this label is
1463 # chosen in such manner that possible exceptions raised in the "gear"
1464 # prologue would be accounted to caller and unwound from latter's frame.
1465 # End of function is marked with respective .LSEH_end_{function_name}
1466 # label. To summarize, .pdata segment would contain
1468 # .rva .LSEH_begin_function
1469 # .rva .LSEH_end_function
1470 # .rva function_unwind_info
1472 # Reference to function_unwind_info from .xdata segment is the anchor.
1473 # In case you wonder why references are 32-bit .rvas and not 64-bit
1474 # .quads. References put into these two segments are required to be
1475 # *relative* to the base address of the current binary module, a.k.a.
1476 # image base. No Win64 module, be it .exe or .dll, can be larger than
1477 # 2GB and thus such relative references can be and are accommodated in
1480 # Having reviewed the example function code, one can argue that "movq
1481 # %rsp,%rax" above is redundant. It is not! Keep in mind that on Unix
1482 # rax would contain an undefined value. If this "offends" you, use
1483 # another register and refrain from modifying rax till magic_point is
1484 # reached, i.e. as if it was a non-volatile register. If more registers
1485 # are required prior [variable] frame setup is completed, note that
1486 # nobody says that you can have only one "magic point." You can
1487 # "liberate" non-volatile registers by denoting last stack off-load
1488 # instruction and reflecting it in finer grade unwind logic in handler.
1489 # After all, isn't it why it's called *language-specific* handler...
1491 # SE handlers are also involved in unwinding stack when executable is
1492 # profiled or debugged. Profiling implies additional limitations that
1493 # are too subtle to discuss here. For now it's sufficient to say that
1494 # in order to simplify handlers one should either a) offload original
1495 # %rsp to stack (like discussed above); or b) if you have a register to
1496 # spare for frame pointer, choose volatile one.
1498 # (*) Note that we're talking about run-time, not debug-time. Lack of
1499 # unwind information makes debugging hard on both Windows and
1500 # Unix. "Unlike" refers to the fact that on Unix signal handler
1501 # will always be invoked, core dumped and appropriate exit code
1502 # returned to parent (for user notification).