Quake 3 Virtual Machine (Q3VM) Specifications

Synopsis

A description of the Q3VM architecture and operations.

Introduction

The Q3VM is a virtual machine used by Quake III to run the game module. The VM is a sort of sandbox to limit the damage a rogue or malicious QVM program can wreak. Though not perfect, it certainly is much safer than full access to native machine language, which could otherwise more easily allow the spread of viruses or the corruption of system resources. In addition, Q3VM programs, similar to JVM's, are write-once run-on-many-platforms (at least for which a Q3VM interpreter or compiler exists).

The instruction set for the Q3VM is derived from the bytecode interpreter target of LCC, with minor differences. The VM heavily relies on stack operations (stack-based machine).

Memory

Memory bus of little-endian, unsigned 32 bits, flat memory space, zero-based addressing, octet-accessible.

Memory is accessible in words of 4 octets (32 bits), 2 octets (16 bits), and single octect (8 bits).

Code and data occupy distinct address spaces. Thus code address 0 is not the same as data address 0. This separation also precludes self-modifying code.

Code segment

Q3VM is CISC-like in the sense that opcodes do not occupy equal amounts of space. Some opcodes take a parameter embedded in the code segment. As a result, the length of the code segment has no bearing on the number of instructions in the code segment. The QVM file format header manifests this distinction.

Jump addresses are specified in terms of instructions, rather than bytes. Thus, the VM code memory requires special processing when loading the code segment to identify instruction offsets.

Processor/CPU

While the Q3VM is currently implemented only in emulation, the concept of a VM's CPU is a convenient notion.

Registers

Theses are guesses derived from modern machines, other fictional machines, and Forth.

• Program Counter (PC)
• Stack Pointer (SP) ("the stack")
• Local Pointer (LP) ("start of local variable space")
• Frame Pointer (FP) ("start of subroutine stack space")

Opcodes

List of opcodes recognized by the Q3VM. All opcodes occupy one octet, and take 1 or 4 additional octets as parameters. All multi-octet values are treated as little-endian (a legacy of Id's MS-DOS days).

Opcode mnemonics ("names") follow a pattern (intriguingly, the opcode values don't, as they do on other architectures). Up to four letters for the operation name, then a letter indicating a data type, then a digit indicating data size (usually the number of required octets).

Data type and size codes:

B

block (sequence of octets, of arbitrary length (e.g. character strings or structs))

F4

little-endian IEEE-754 32-bit single-precision floating point value.

P4

Four-octet pointer (memory address) value.

I4

Four-octet signed integer. Corresponds to Q3VM's C data type "signed int".

I2

Two-octet signed integer. Corresponds to Q3VM's C data type "signed short".

I1

One-octet signed integer. Corresponds to Q3VM's C data type "signed char".

U4

Four-octet unsigned integer. Corresponds to Q3VM's C data type "unsigned int".

U2

Two-octet unsigned integer. Corresponds to Q3VM's C data type "unsigned short".

U1

One-octet unsigned integer. Corresponds to Q3VM's C data type "unsigned char".

Generalized opcodes list (lcc bytecode):

CNSTt v

CONSTANT. Reads v as a value of type t. For floats, v is the bit pattern of the float value.

ASGNt

ASSIGN. Pops a value from stack, interpreted according to t, to use as the assignment value. Pops another value from stack, interpreted as a pointer value (memory address) to use as the assignment destination.

INDIRt

INDIRECTION. Pops a value from stack, interpreted as a pointer value (memory address). Retrieves the 32-bit value from the indicated memory location, and interprets the 32-bit value according to t, then pushes to stack. (think of it as pointer dereferencing)

CVFt

CONVERT TO FLOAT. Pops a value from stack, interpreted according to t, converted to its equivalent float (F4) form, then pushed to stack.

CVIt

CONVERT TO (signed) INTEGER. Pops a value from stack, interpreted according to t, converted to its equivalent signed integer (I4) form, then pushed to stack.

CVUt

CONVERT TO UNSIGNED INTEGER. Pops a value from stack, interpreted according to t, converted to its equivalent unsigned integer (U4) form, then pushed to stack.

CVPt

CONVERT TO UNSIGNED INTEGER. Pops a value from stack, interpreted according to t, converted to its equivalent pointer (P4) form, then pushed to stack.

NEGt

ARITHMETIC NEGATE. Pops a value from stack, interpreted according to t, negated arithmeticaly (multiplied by -1 or -1.0), then pushed to stack.

ADDRGP4 v

ADDRESS OF GLOBAL (pointer). Takes v as a memory address, takes the 32-bit value at the address, pushes the 32-bit value to stack (i.e. get value of a global variable/function/symbol).

ADDRLP4 v

ADDRESS OF (from?) LOCAL (pointer). Address of a local variable. Local Pointer(?) plus v. First local variable is at 0.

ADDRFP4 v

ADDRESS (from?) FRAME (pointer). Address of an argument (with repect to the frame pointer). Frame Pointer plus (minus?) v. First argument is at 0, second argument at 4, etc (XXX: verify).

ADDt

ADD. Pops a value from stack, interpreted according to t, as second operand. Pops another value from stack, interpreted t, as first operand. The two values are arithmeticaly added, pushes sum to stack.

SUBt

SUBTRACT. Pops a value from stack, interpreted t, as second operand. Pops another value from stack, interpreted t, as first operand. Subtracts second operand from first operand, pushes difference to stack.

MULt

MULTIPLY. Pops a value from stack, interpreted t, as second operand. Pops another value from stack, interpreted t, as first operand. Multiplies the values together, pushes product to stack.

DIVt

DIVIDE. Pops a value from stack, interpreted t, as second operand. Pops another value from stack, interpreted t, as first operand. Second operand divides into first operand, pushes quotient to stack (XXX: integer division C style?).

MODt

MODULUS. Pops a value from stack, as t, as second operand. Pops another value from stack, as t, as first operand. The second operand divides into the first operand, pushes remainder to stack.

LSHt

LEFT SHIFT. Pops a value from stack, as t, as second operand. Pops another value from stack, as t, as first operand. First operand bit-wise shifts left by number of bits specified by second operand, pushes result to stack.

RSHt

RIGHT SHIFT. Pops a value from stack, as t, as second operand. Pops another value from stack, as t, as first operand. First operand bit-wise shifts right by number of bits specified by second operand, pushes result to stack. Sign-extension depends on t.

BANDt

BINARY/BITWISE AND. Pops a value from stack (t) as second operand. Pops another value from stack (t) as first operand. The two operands combine by bitwise AND, pushes result to stack.

BCOMt

BINARY/BITWISE COMPLEMENT. Pops a value from stack (t). Flips (almost-)every bit to its opposite value. Changing the high bit (bit 31) depends on t.

BORt

BINARY/BITWISE OR. Pops a value from stack (t) as second operand. Pops another value from stack (t) as first operand. Combines the two operands by bitwise OR, pushes result to stack.

BXORt

BINARY/BITWISE XOR. Pops two values, XORs, pushes result to stack.

EQt v

EQUAL-TO. Pops two values from stack (as type t), compares the two values. Jumps to address v if true.

GEt v

GREATER-THAN OR EQUAL-TO. Pops a value from stack (type t) as second operand. Pops another value from stack (type t) as first operand. Compares if first operand is equal to the second operand. Jumps to address v if true.

GTt v

GREATER-THAN. Pops a second operand (type t) then a first operand (type t). Compares if first operand is greater than the second operand. Jumps to address v if true.

LEt v

LESS-THAN OR EQUAL-TO. Pops a second operand (type t) then a first operand (type t). Compares if first operand is less than or equal to the second operand. Jumps to address v if true.

LTt v

LESS-THAN. Pops a second operand (t) then a first operand (t). Compares if first operand is less than the second operand. Jumps to address v if true.

NEt v

NOT-EQUAL. Pops two values (t), compares the two values. Compares if first operand is not equal to the second operand. Jumps to address v if true.

JUMPV

Pops a pointer value from stack, sets PC to the value (jump).

RETt

Pop value from stack, shrink stack to eliminate local frame, push value back to stack. Or copy top of stack to bottom of frame and shrink stack size/pointer?

ARGt

Pop value from stack as type t, store into arguments-marshalling space.

CALLt

Pops value from stack as address of a function. Makes a procedure call to the function, which is expected to return a value of type t.

pop

Pop stack (discard top of stack). (functions of void type still return a (nonsense) 32-bit value)

List of assembly directives:

equ s v

Assign integer value v to symbol s.

data

Assemble to DATA segment (initialized 32-bit variables).

code

Assemble to CODE segment (instructions).

lit

Assemble to LIT segment (initialized 8-bit variables).

bss

Assemble to BSS segment (uninitialized block storage segment).

LABELV symbol

Assigns the value of the currently computed Program Counter to the symbol named symbol. (i.e. the current assembled address value is assigned to symbol).

byte l v

Write initialized value v of l octets. 1-octet values go into LIT segment. 2-octet values are invalid (fatal error). 4-octet values go into DATA segment.

skip v

Skip v octets in the segment, leaving the octets uninitialized.

export s

Export symbol s for external linkage.

import s

Import symbol s.

align v

Ensure memory alignment at a multiple of v, skipping octets if needed.

address x

??? (evaluates expression x and append result to DATA segment)

file filename

Set filename to filename for status and error reporting.

line lineno

Indicates current source line of lineno.

proc locals args

Start of procedure (function) body. Set aside locals octets for local variables, and args octets for arguments marshalling (for all possible subcalls within this procedure).

endproc locals args

End of procedure body. Clean up args bytes (for arguments marshalling) and locals bytes (for local variables).

Q3VM Bytecodes

Specific opcodes (Q3VM bytecode): (TOS = Top Of Stack; NIS = Next In Stack (next value after TOS)) (Hack syntax: $PARM = code parameter)

QVM File Format

QVM file format. Multi-octet words are little-endian (LE).

Following the header is the code segment, aligned on a 4-byte boundary. The code segment can be processed octet-by-octet to identify instructions. For bytecodes that take a multi-octet parameter, the parameter is stored in LE order. Big-endian machines may want to byte-swap the parameter for native-arithmetic purposes. The instruction count field in the header identifies when the sequence of instructions end. Comparisons of code length, instruction counts, and file positions can be used to verify proper processing.

The data segment follows the code segment. The assembler (qvm generator) needs to ensure the data segment begins on a 4-octet boundary (by padding with zeroes). The data segment consists of a series of 4-octet LE values that are copied into VM memory. For big-endian machines, each word may be optionally byte-swapped (for native arithmetic) on copy.

The lit segment immediately follows the data segment. This segment should already be aligned on a 4-octet boundary. The lit segment consists of a series of 1-octet values, copied verbatim to VM memory. No byte-swapping is needed.

The bss segment is not stored in the qvm file, since this segment consists of unitialized values (i.e. values that don't need to be stored). The VM must ensure there is still sufficient memory to accomodate the bss segment. The QVM header specifies the size of the bss segment. The VM may optionally initialize the bss portion of memory with zeroes.

Updated 2003.02.23
Updated 2011.07.11 - change of contact e-mail