Deriving the operand types of instructions automatically?

[moste00]

Hello, I'm writing a generator that automatically generates a Capstone Framework disassembler from Sail. Right now the progress is promising!

One thing that stumped me is how to automatically know whether a literal is really a literal number or a memory address. The disassembler has to associate each ast case with metadata such as "this instruction has 3 operands: 2 registers and a memory operand".

Recognizing registers is easy enough because they have a dedicated regidx type synonym. But it looks impossible to easily distinguish between "real literals" and "some bits that will later become an address".

Is this an impossible problem? Is it really trivial for the particular case of RISC-V (e.g. "only LOADs and STOREs use addresses, everyone else use bits as literals" or something close to this) ? Is there another, hopefully "official" and regularly-maintained source of machine-readable information about this that I can use as an additional source? All answers are welcome!

[Timmmm]

You mean you want to somehow distinguish between the bits(12) in

union clause ast = STORE : (bits(12), regidx, regidx, word_width, bool, bool)

and

union clause ast = ADDIW : (bits(12), regidx, regidx)

?

Yeah I don't think that's possible from the Sail types. I'm not sure why you'd need that for a disassembler either? They're disassembled in the same way. Neither of those are a memory address anyway - the STORE immediate is an offset.

only LOADs and STOREs use addresses, everyone else use bits as literals

I think this is probably true; at least I can't think of any counter-examples.

If you wanted to get extremely fancy you could follow the flow of information in the execute clause to see if the value influences the address passed to translate(), but I think just making an exhaustive list manually is probably less work (or at least less difficult).