1 /*
2  * Copyright (C) 2012 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "disassembler_x86.h"
18 
19 #include <inttypes.h>
20 
21 #include <ostream>
22 #include <sstream>
23 
24 #include "android-base/logging.h"
25 #include "android-base/stringprintf.h"
26 
27 using android::base::StringPrintf;
28 
29 namespace art {
30 namespace x86 {
31 
Dump(std::ostream & os,const uint8_t * begin)32 size_t DisassemblerX86::Dump(std::ostream& os, const uint8_t* begin) {
33   return DumpInstruction(os, begin);
34 }
35 
Dump(std::ostream & os,const uint8_t * begin,const uint8_t * end)36 void DisassemblerX86::Dump(std::ostream& os, const uint8_t* begin, const uint8_t* end) {
37   size_t length = 0;
38   for (const uint8_t* cur = begin; cur < end; cur += length) {
39     length = DumpInstruction(os, cur);
40   }
41 }
42 
43 static const char* gReg8Names[]  = {
44   "al", "cl", "dl", "bl", "ah", "ch", "dh", "bh"
45 };
46 static const char* gExtReg8Names[] = {
47   "al", "cl", "dl", "bl", "spl", "bpl", "sil", "dil",
48   "r8l", "r9l", "r10l", "r11l", "r12l", "r13l", "r14l", "r15l"
49 };
50 static const char* gReg16Names[] = {
51   "ax", "cx", "dx", "bx", "sp", "bp", "si", "di",
52   "r8w", "r9w", "r10w", "r11w", "r12w", "r13w", "r14w", "r15w"
53 };
54 static const char* gReg32Names[] = {
55   "eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi",
56   "r8d", "r9d", "r10d", "r11d", "r12d", "r13d", "r14d", "r15d"
57 };
58 static const char* gReg64Names[] = {
59   "rax", "rcx", "rdx", "rbx", "rsp", "rbp", "rsi", "rdi",
60   "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
61 };
62 
63 // 64-bit opcode REX modifier.
64 constexpr uint8_t REX_W = 8U /* 0b1000 */;
65 constexpr uint8_t REX_R = 4U /* 0b0100 */;
66 constexpr uint8_t REX_X = 2U /* 0b0010 */;
67 constexpr uint8_t REX_B = 1U /* 0b0001 */;
68 
DumpReg0(std::ostream & os,uint8_t rex,size_t reg,bool byte_operand,uint8_t size_override)69 static void DumpReg0(std::ostream& os, uint8_t rex, size_t reg,
70                      bool byte_operand, uint8_t size_override) {
71   DCHECK_LT(reg, (rex == 0) ? 8u : 16u);
72   bool rex_w = (rex & REX_W) != 0;
73   if (byte_operand) {
74     os << ((rex == 0) ? gReg8Names[reg] : gExtReg8Names[reg]);
75   } else if (rex_w) {
76     os << gReg64Names[reg];
77   } else if (size_override == 0x66) {
78     os << gReg16Names[reg];
79   } else {
80     os << gReg32Names[reg];
81   }
82 }
83 
DumpAnyReg(std::ostream & os,uint8_t rex,size_t reg,bool byte_operand,uint8_t size_override,RegFile reg_file)84 static void DumpAnyReg(std::ostream& os, uint8_t rex, size_t reg,
85                        bool byte_operand, uint8_t size_override, RegFile reg_file) {
86   if (reg_file == GPR) {
87     DumpReg0(os, rex, reg, byte_operand, size_override);
88   } else if (reg_file == SSE) {
89     os << "xmm" << reg;
90   } else {
91     os << "mm" << reg;
92   }
93 }
94 
DumpReg(std::ostream & os,uint8_t rex,uint8_t reg,bool byte_operand,uint8_t size_override,RegFile reg_file)95 static void DumpReg(std::ostream& os, uint8_t rex, uint8_t reg,
96                     bool byte_operand, uint8_t size_override, RegFile reg_file) {
97   bool rex_r = (rex & REX_R) != 0;
98   size_t reg_num = rex_r ? (reg + 8) : reg;
99   DumpAnyReg(os, rex, reg_num, byte_operand, size_override, reg_file);
100 }
101 
DumpRmReg(std::ostream & os,uint8_t rex,uint8_t reg,bool byte_operand,uint8_t size_override,RegFile reg_file)102 static void DumpRmReg(std::ostream& os, uint8_t rex, uint8_t reg,
103                       bool byte_operand, uint8_t size_override, RegFile reg_file) {
104   bool rex_b = (rex & REX_B) != 0;
105   size_t reg_num = rex_b ? (reg + 8) : reg;
106   DumpAnyReg(os, rex, reg_num, byte_operand, size_override, reg_file);
107 }
108 
DumpAddrReg(std::ostream & os,uint8_t rex,uint8_t reg)109 static void DumpAddrReg(std::ostream& os, uint8_t rex, uint8_t reg) {
110   if (rex != 0) {
111     os << gReg64Names[reg];
112   } else {
113     os << gReg32Names[reg];
114   }
115 }
116 
DumpBaseReg(std::ostream & os,uint8_t rex,uint8_t reg)117 static void DumpBaseReg(std::ostream& os, uint8_t rex, uint8_t reg) {
118   bool rex_b = (rex & REX_B) != 0;
119   size_t reg_num = rex_b ? (reg + 8) : reg;
120   DumpAddrReg(os, rex, reg_num);
121 }
122 
DumpOpcodeReg(std::ostream & os,uint8_t rex,uint8_t reg,bool byte_operand,uint8_t size_override)123 static void DumpOpcodeReg(std::ostream& os, uint8_t rex, uint8_t reg,
124                           bool byte_operand, uint8_t size_override) {
125   bool rex_b = (rex & REX_B) != 0;
126   size_t reg_num = rex_b ? (reg + 8) : reg;
127   DumpReg0(os, rex, reg_num, byte_operand, size_override);
128 }
129 
130 enum SegmentPrefix {
131   kCs = 0x2e,
132   kSs = 0x36,
133   kDs = 0x3e,
134   kEs = 0x26,
135   kFs = 0x64,
136   kGs = 0x65,
137 };
138 
DumpSegmentOverride(std::ostream & os,uint8_t segment_prefix)139 static void DumpSegmentOverride(std::ostream& os, uint8_t segment_prefix) {
140   switch (segment_prefix) {
141     case kCs: os << "cs:"; break;
142     case kSs: os << "ss:"; break;
143     case kDs: os << "ds:"; break;
144     case kEs: os << "es:"; break;
145     case kFs: os << "fs:"; break;
146     case kGs: os << "gs:"; break;
147     default: break;
148   }
149 }
150 
151 // Do not inline to avoid Clang stack frame problems. b/18733806
152 NO_INLINE
DumpCodeHex(const uint8_t * begin,const uint8_t * end)153 static std::string DumpCodeHex(const uint8_t* begin, const uint8_t* end) {
154   std::stringstream hex;
155   for (size_t i = 0; begin + i < end; ++i) {
156     hex << StringPrintf("%02X", begin[i]);
157   }
158   return hex.str();
159 }
160 
DumpAddress(uint8_t mod,uint8_t rm,uint8_t rex64,uint8_t rex_w,bool no_ops,bool byte_operand,bool byte_second_operand,uint8_t * prefix,bool load,RegFile src_reg_file,RegFile dst_reg_file,const uint8_t ** instr,uint32_t * address_bits)161 std::string DisassemblerX86::DumpAddress(uint8_t mod, uint8_t rm, uint8_t rex64, uint8_t rex_w,
162                                          bool no_ops, bool byte_operand, bool byte_second_operand,
163                                          uint8_t* prefix, bool load, RegFile src_reg_file,
164                                          RegFile dst_reg_file, const uint8_t** instr,
165                                          uint32_t* address_bits) {
166   std::ostringstream address;
167   if (mod == 0 && rm == 5) {
168     if (!supports_rex_) {  // Absolute address.
169       *address_bits = *reinterpret_cast<const uint32_t*>(*instr);
170       address << StringPrintf("[0x%x]", *address_bits);
171     } else {  // 64-bit RIP relative addressing.
172       address << StringPrintf("[RIP + 0x%x]",  *reinterpret_cast<const uint32_t*>(*instr));
173     }
174     (*instr) += 4;
175   } else if (rm == 4 && mod != 3) {  // SIB
176     uint8_t sib = **instr;
177     (*instr)++;
178     uint8_t scale = (sib >> 6) & 3;
179     uint8_t index = (sib >> 3) & 7;
180     uint8_t base = sib & 7;
181     address << "[";
182 
183     // REX.x is bit 3 of index.
184     if ((rex64 & REX_X) != 0) {
185       index += 8;
186     }
187 
188     // Mod = 0 && base = 5 (ebp): no base (ignores REX.b).
189     bool has_base = false;
190     if (base != 5 || mod != 0) {
191       has_base = true;
192       DumpBaseReg(address, rex64, base);
193     }
194 
195     // Index = 4 (esp/rsp) is disallowed.
196     if (index != 4) {
197       if (has_base) {
198         address << " + ";
199       }
200       DumpAddrReg(address, rex64, index);
201       if (scale != 0) {
202         address << StringPrintf(" * %d", 1 << scale);
203       }
204     }
205 
206     if (mod == 0) {
207       if (base == 5) {
208         if (index != 4) {
209           address << StringPrintf(" + %d", *reinterpret_cast<const int32_t*>(*instr));
210         } else {
211           // 64-bit low 32-bit absolute address, redundant absolute address encoding on 32-bit.
212           *address_bits = *reinterpret_cast<const uint32_t*>(*instr);
213           address << StringPrintf("%d", *address_bits);
214         }
215         (*instr) += 4;
216       }
217     } else if (mod == 1) {
218       address << StringPrintf(" + %d", *reinterpret_cast<const int8_t*>(*instr));
219       (*instr)++;
220     } else if (mod == 2) {
221       address << StringPrintf(" + %d", *reinterpret_cast<const int32_t*>(*instr));
222       (*instr) += 4;
223     }
224     address << "]";
225   } else {
226     if (mod == 3) {
227       if (!no_ops) {
228         DumpRmReg(address, rex_w, rm, byte_operand || byte_second_operand,
229                   prefix[2], load ? src_reg_file : dst_reg_file);
230       }
231     } else {
232       address << "[";
233       DumpBaseReg(address, rex64, rm);
234       if (mod == 1) {
235         address << StringPrintf(" + %d", *reinterpret_cast<const int8_t*>(*instr));
236         (*instr)++;
237       } else if (mod == 2) {
238         address << StringPrintf(" + %d", *reinterpret_cast<const int32_t*>(*instr));
239         (*instr) += 4;
240       }
241       address << "]";
242     }
243   }
244   return address.str();
245 }
246 
DumpNops(std::ostream & os,const uint8_t * instr)247 size_t DisassemblerX86::DumpNops(std::ostream& os, const uint8_t* instr) {
248 static constexpr uint8_t kNops[][10] = {
249       { },
250       { 0x90 },
251       { 0x66, 0x90 },
252       { 0x0f, 0x1f, 0x00 },
253       { 0x0f, 0x1f, 0x40, 0x00 },
254       { 0x0f, 0x1f, 0x44, 0x00, 0x00 },
255       { 0x66, 0x0f, 0x1f, 0x44, 0x00, 0x00 },
256       { 0x0f, 0x1f, 0x80, 0x00, 0x00, 0x00, 0x00 },
257       { 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 },
258       { 0x66, 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 },
259       { 0x66, 0x2e, 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 }
260   };
261 
262   for (size_t i = 1; i < arraysize(kNops); ++i) {
263     if (memcmp(instr, kNops[i], i) == 0) {
264       os << FormatInstructionPointer(instr)
265          << StringPrintf(": %22s    \t       nop \n", DumpCodeHex(instr, instr + i).c_str());
266       return i;
267     }
268   }
269 
270   return 0;
271 }
272 
DumpInstruction(std::ostream & os,const uint8_t * instr)273 size_t DisassemblerX86::DumpInstruction(std::ostream& os, const uint8_t* instr) {
274   size_t nop_size = DumpNops(os, instr);
275   if (nop_size != 0u) {
276     return nop_size;
277   }
278 
279   const uint8_t* begin_instr = instr;
280   bool have_prefixes = true;
281   uint8_t prefix[4] = {0, 0, 0, 0};
282   do {
283     switch (*instr) {
284         // Group 1 - lock and repeat prefixes:
285       case 0xF0:
286       case 0xF2:
287       case 0xF3:
288         prefix[0] = *instr;
289         break;
290         // Group 2 - segment override prefixes:
291       case kCs:
292       case kSs:
293       case kDs:
294       case kEs:
295       case kFs:
296       case kGs:
297         prefix[1] = *instr;
298         break;
299         // Group 3 - operand size override:
300       case 0x66:
301         prefix[2] = *instr;
302         break;
303         // Group 4 - address size override:
304       case 0x67:
305         prefix[3] = *instr;
306         break;
307       default:
308         have_prefixes = false;
309         break;
310     }
311     if (have_prefixes) {
312       instr++;
313     }
314   } while (have_prefixes);
315   uint8_t rex = (supports_rex_ && (*instr >= 0x40) && (*instr <= 0x4F)) ? *instr : 0;
316   if (rex != 0) {
317     instr++;
318   }
319   const char** modrm_opcodes = nullptr;
320   bool has_modrm = false;
321   bool reg_is_opcode = false;
322   size_t immediate_bytes = 0;
323   size_t branch_bytes = 0;
324   std::string opcode_tmp;    // Storage to keep StringPrintf result alive.
325   const char* opcode0 = "";  // Prefix part.
326   const char* opcode1 = "";  // Main opcode.
327   const char* opcode2 = "";  // Sub-opcode. E.g., jump type.
328   const char* opcode3 = "";  // Mod-rm part.
329   const char* opcode4 = "";  // Suffix part.
330   bool store = false;  // stores to memory (ie rm is on the left)
331   bool load = false;  // loads from memory (ie rm is on the right)
332   bool byte_operand = false;  // true when the opcode is dealing with byte operands
333   // true when the source operand is a byte register but the target register isn't
334   // (ie movsxb/movzxb).
335   bool byte_second_operand = false;
336   bool target_specific = false;  // register name depends on target (64 vs 32 bits).
337   bool ax = false;  // implicit use of ax
338   bool cx = false;  // implicit use of cx
339   bool reg_in_opcode = false;  // low 3-bits of opcode encode register parameter
340   bool no_ops = false;
341   RegFile src_reg_file = GPR;
342   RegFile dst_reg_file = GPR;
343   switch (*instr) {
344 #define DISASSEMBLER_ENTRY(opname, \
345                      rm8_r8, rm32_r32, \
346                      r8_rm8, r32_rm32, \
347                      ax8_i8, ax32_i32) \
348   case rm8_r8:   opcode1 = #opname; store = true; has_modrm = true; byte_operand = true; break; \
349   case rm32_r32: opcode1 = #opname; store = true; has_modrm = true; break; \
350   case r8_rm8:   opcode1 = #opname; load = true; has_modrm = true; byte_operand = true; break; \
351   case r32_rm32: opcode1 = #opname; load = true; has_modrm = true; break; \
352   case ax8_i8:   opcode1 = #opname; ax = true; immediate_bytes = 1; byte_operand = true; break; \
353   case ax32_i32: opcode1 = #opname; ax = true; immediate_bytes = 4; break;
354 
355 DISASSEMBLER_ENTRY(add,
356   0x00 /* RegMem8/Reg8 */,     0x01 /* RegMem32/Reg32 */,
357   0x02 /* Reg8/RegMem8 */,     0x03 /* Reg32/RegMem32 */,
358   0x04 /* Rax8/imm8 opcode */, 0x05 /* Rax32/imm32 */)
359 DISASSEMBLER_ENTRY(or,
360   0x08 /* RegMem8/Reg8 */,     0x09 /* RegMem32/Reg32 */,
361   0x0A /* Reg8/RegMem8 */,     0x0B /* Reg32/RegMem32 */,
362   0x0C /* Rax8/imm8 opcode */, 0x0D /* Rax32/imm32 */)
363 DISASSEMBLER_ENTRY(adc,
364   0x10 /* RegMem8/Reg8 */,     0x11 /* RegMem32/Reg32 */,
365   0x12 /* Reg8/RegMem8 */,     0x13 /* Reg32/RegMem32 */,
366   0x14 /* Rax8/imm8 opcode */, 0x15 /* Rax32/imm32 */)
367 DISASSEMBLER_ENTRY(sbb,
368   0x18 /* RegMem8/Reg8 */,     0x19 /* RegMem32/Reg32 */,
369   0x1A /* Reg8/RegMem8 */,     0x1B /* Reg32/RegMem32 */,
370   0x1C /* Rax8/imm8 opcode */, 0x1D /* Rax32/imm32 */)
371 DISASSEMBLER_ENTRY(and,
372   0x20 /* RegMem8/Reg8 */,     0x21 /* RegMem32/Reg32 */,
373   0x22 /* Reg8/RegMem8 */,     0x23 /* Reg32/RegMem32 */,
374   0x24 /* Rax8/imm8 opcode */, 0x25 /* Rax32/imm32 */)
375 DISASSEMBLER_ENTRY(sub,
376   0x28 /* RegMem8/Reg8 */,     0x29 /* RegMem32/Reg32 */,
377   0x2A /* Reg8/RegMem8 */,     0x2B /* Reg32/RegMem32 */,
378   0x2C /* Rax8/imm8 opcode */, 0x2D /* Rax32/imm32 */)
379 DISASSEMBLER_ENTRY(xor,
380   0x30 /* RegMem8/Reg8 */,     0x31 /* RegMem32/Reg32 */,
381   0x32 /* Reg8/RegMem8 */,     0x33 /* Reg32/RegMem32 */,
382   0x34 /* Rax8/imm8 opcode */, 0x35 /* Rax32/imm32 */)
383 DISASSEMBLER_ENTRY(cmp,
384   0x38 /* RegMem8/Reg8 */,     0x39 /* RegMem32/Reg32 */,
385   0x3A /* Reg8/RegMem8 */,     0x3B /* Reg32/RegMem32 */,
386   0x3C /* Rax8/imm8 opcode */, 0x3D /* Rax32/imm32 */)
387 
388 #undef DISASSEMBLER_ENTRY
389   case 0x50: case 0x51: case 0x52: case 0x53: case 0x54: case 0x55: case 0x56: case 0x57:
390     opcode1 = "push";
391     reg_in_opcode = true;
392     target_specific = true;
393     break;
394   case 0x58: case 0x59: case 0x5A: case 0x5B: case 0x5C: case 0x5D: case 0x5E: case 0x5F:
395     opcode1 = "pop";
396     reg_in_opcode = true;
397     target_specific = true;
398     break;
399   case 0x63:
400     if ((rex & REX_W) != 0) {
401       opcode1 = "movsxd";
402       has_modrm = true;
403       load = true;
404     } else {
405       // In 32-bit mode (!supports_rex_) this is ARPL, with no REX prefix the functionality is the
406       // same as 'mov' but the use of the instruction is discouraged.
407       opcode_tmp = StringPrintf("unknown opcode '%02X'", *instr);
408       opcode1 = opcode_tmp.c_str();
409     }
410     break;
411   case 0x68: opcode1 = "push"; immediate_bytes = 4; break;
412   case 0x69: opcode1 = "imul"; load = true; has_modrm = true; immediate_bytes = 4; break;
413   case 0x6A: opcode1 = "push"; immediate_bytes = 1; break;
414   case 0x6B: opcode1 = "imul"; load = true; has_modrm = true; immediate_bytes = 1; break;
415   case 0x70: case 0x71: case 0x72: case 0x73: case 0x74: case 0x75: case 0x76: case 0x77:
416   case 0x78: case 0x79: case 0x7A: case 0x7B: case 0x7C: case 0x7D: case 0x7E: case 0x7F:
417     static const char* condition_codes[] =
418     {"o", "no", "b/nae/c", "nb/ae/nc", "z/eq",  "nz/ne", "be/na", "nbe/a",
419      "s", "ns", "p/pe",    "np/po",    "l/nge", "nl/ge", "le/ng", "nle/g"
420     };
421     opcode1 = "j";
422     opcode2 = condition_codes[*instr & 0xF];
423     branch_bytes = 1;
424     break;
425   case 0x86: case 0x87:
426     opcode1 = "xchg";
427     store = true;
428     has_modrm = true;
429     byte_operand = (*instr == 0x86);
430     break;
431   case 0x88: opcode1 = "mov"; store = true; has_modrm = true; byte_operand = true; break;
432   case 0x89: opcode1 = "mov"; store = true; has_modrm = true; break;
433   case 0x8A: opcode1 = "mov"; load = true; has_modrm = true; byte_operand = true; break;
434   case 0x8B: opcode1 = "mov"; load = true; has_modrm = true; break;
435   case 0x9D: opcode1 = "popf"; break;
436 
437   case 0x0F:  // 2 byte extended opcode
438     instr++;
439     switch (*instr) {
440       case 0x10: case 0x11:
441         if (prefix[0] == 0xF2) {
442           opcode1 = "movsd";
443           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
444         } else if (prefix[0] == 0xF3) {
445           opcode1 = "movss";
446           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
447         } else if (prefix[2] == 0x66) {
448           opcode1 = "movupd";
449           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
450         } else {
451           opcode1 = "movups";
452         }
453         has_modrm = true;
454         src_reg_file = dst_reg_file = SSE;
455         load = *instr == 0x10;
456         store = !load;
457         break;
458       case 0x12: case 0x13:
459         if (prefix[2] == 0x66) {
460           opcode1 = "movlpd";
461           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
462         } else if (prefix[0] == 0) {
463           opcode1 = "movlps";
464         }
465         has_modrm = true;
466         src_reg_file = dst_reg_file = SSE;
467         load = *instr == 0x12;
468         store = !load;
469         break;
470       case 0x16: case 0x17:
471         if (prefix[2] == 0x66) {
472           opcode1 = "movhpd";
473           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
474         } else if (prefix[0] == 0) {
475           opcode1 = "movhps";
476         }
477         has_modrm = true;
478         src_reg_file = dst_reg_file = SSE;
479         load = *instr == 0x16;
480         store = !load;
481         break;
482       case 0x28: case 0x29:
483         if (prefix[2] == 0x66) {
484           opcode1 = "movapd";
485           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
486         } else if (prefix[0] == 0) {
487           opcode1 = "movaps";
488         }
489         has_modrm = true;
490         src_reg_file = dst_reg_file = SSE;
491         load = *instr == 0x28;
492         store = !load;
493         break;
494       case 0x2A:
495         if (prefix[2] == 0x66) {
496           opcode1 = "cvtpi2pd";
497           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
498         } else if (prefix[0] == 0xF2) {
499           opcode1 = "cvtsi2sd";
500           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
501         } else if (prefix[0] == 0xF3) {
502           opcode1 = "cvtsi2ss";
503           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
504         } else {
505           opcode1 = "cvtpi2ps";
506         }
507         load = true;
508         has_modrm = true;
509         dst_reg_file = SSE;
510         break;
511       case 0x2C:
512         if (prefix[2] == 0x66) {
513           opcode1 = "cvttpd2pi";
514           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
515         } else if (prefix[0] == 0xF2) {
516           opcode1 = "cvttsd2si";
517           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
518         } else if (prefix[0] == 0xF3) {
519           opcode1 = "cvttss2si";
520           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
521         } else {
522           opcode1 = "cvttps2pi";
523         }
524         load = true;
525         has_modrm = true;
526         src_reg_file = SSE;
527         break;
528       case 0x2D:
529         if (prefix[2] == 0x66) {
530           opcode1 = "cvtpd2pi";
531           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
532         } else if (prefix[0] == 0xF2) {
533           opcode1 = "cvtsd2si";
534           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
535         } else if (prefix[0] == 0xF3) {
536           opcode1 = "cvtss2si";
537           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
538         } else {
539           opcode1 = "cvtps2pi";
540         }
541         load = true;
542         has_modrm = true;
543         src_reg_file = SSE;
544         break;
545       case 0x2E:
546         opcode0 = "u";
547         FALLTHROUGH_INTENDED;
548       case 0x2F:
549         if (prefix[2] == 0x66) {
550           opcode1 = "comisd";
551           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
552         } else {
553           opcode1 = "comiss";
554         }
555         has_modrm = true;
556         load = true;
557         src_reg_file = dst_reg_file = SSE;
558         break;
559       case 0x38:  // 3 byte extended opcode
560         instr++;
561         if (prefix[2] == 0x66) {
562           switch (*instr) {
563             case 0x01:
564               opcode1 = "phaddw";
565               prefix[2] = 0;
566               has_modrm = true;
567               load = true;
568               src_reg_file = dst_reg_file = SSE;
569               break;
570             case 0x02:
571               opcode1 = "phaddd";
572               prefix[2] = 0;
573               has_modrm = true;
574               load = true;
575               src_reg_file = dst_reg_file = SSE;
576               break;
577             case 0x29:
578               opcode1 = "pcmpeqq";
579               prefix[2] = 0;
580               has_modrm = true;
581               load = true;
582               src_reg_file = dst_reg_file = SSE;
583               break;
584             case 0x37:
585               opcode1 = "pcmpgtq";
586               prefix[2] = 0;
587               has_modrm = true;
588               load = true;
589               src_reg_file = dst_reg_file = SSE;
590               break;
591             case 0x38:
592               opcode1 = "pminsb";
593               prefix[2] = 0;
594               has_modrm = true;
595               load = true;
596               src_reg_file = dst_reg_file = SSE;
597               break;
598             case 0x39:
599               opcode1 = "pminsd";
600               prefix[2] = 0;
601               has_modrm = true;
602               load = true;
603               src_reg_file = dst_reg_file = SSE;
604               break;
605             case 0x3A:
606               opcode1 = "pminuw";
607               prefix[2] = 0;
608               has_modrm = true;
609               load = true;
610               src_reg_file = dst_reg_file = SSE;
611               break;
612             case 0x3B:
613               opcode1 = "pminud";
614               prefix[2] = 0;
615               has_modrm = true;
616               load = true;
617               src_reg_file = dst_reg_file = SSE;
618               break;
619             case 0x3C:
620               opcode1 = "pmaxsb";
621               prefix[2] = 0;
622               has_modrm = true;
623               load = true;
624               src_reg_file = dst_reg_file = SSE;
625               break;
626             case 0x3D:
627               opcode1 = "pmaxsd";
628               prefix[2] = 0;
629               has_modrm = true;
630               load = true;
631               src_reg_file = dst_reg_file = SSE;
632               break;
633             case 0x3E:
634               opcode1 = "pmaxuw";
635               prefix[2] = 0;
636               has_modrm = true;
637               load = true;
638               src_reg_file = dst_reg_file = SSE;
639               break;
640             case 0x3F:
641               opcode1 = "pmaxud";
642               prefix[2] = 0;
643               has_modrm = true;
644               load = true;
645               src_reg_file = dst_reg_file = SSE;
646               break;
647             case 0x40:
648               opcode1 = "pmulld";
649               prefix[2] = 0;
650               has_modrm = true;
651               load = true;
652               src_reg_file = dst_reg_file = SSE;
653               break;
654             default:
655               opcode_tmp = StringPrintf("unknown opcode '0F 38 %02X'", *instr);
656               opcode1 = opcode_tmp.c_str();
657           }
658         } else {
659           opcode_tmp = StringPrintf("unknown opcode '0F 38 %02X'", *instr);
660           opcode1 = opcode_tmp.c_str();
661         }
662         break;
663       case 0x3A:  // 3 byte extended opcode
664         instr++;
665         if (prefix[2] == 0x66) {
666           switch (*instr) {
667             case 0x0A:
668               opcode1 = "roundss";
669               prefix[2] = 0;
670               has_modrm = true;
671               load = true;
672               src_reg_file = SSE;
673               dst_reg_file = SSE;
674               immediate_bytes = 1;
675               break;
676             case 0x0B:
677               opcode1 = "roundsd";
678               prefix[2] = 0;
679               has_modrm = true;
680               load = true;
681               src_reg_file = SSE;
682               dst_reg_file = SSE;
683               immediate_bytes = 1;
684               break;
685             case 0x14:
686               opcode1 = "pextrb";
687               prefix[2] = 0;
688               has_modrm = true;
689               store = true;
690               src_reg_file = SSE;
691               immediate_bytes = 1;
692               break;
693           case 0x15:
694               opcode1 = "pextrw";
695               prefix[2] = 0;
696               has_modrm = true;
697               store = true;
698               src_reg_file = SSE;
699               immediate_bytes = 1;
700               break;
701             case 0x16:
702               opcode1 = "pextrd";
703               prefix[2] = 0;
704               has_modrm = true;
705               store = true;
706               src_reg_file = SSE;
707               immediate_bytes = 1;
708               break;
709             default:
710               opcode_tmp = StringPrintf("unknown opcode '0F 3A %02X'", *instr);
711               opcode1 = opcode_tmp.c_str();
712           }
713         } else {
714           opcode_tmp = StringPrintf("unknown opcode '0F 3A %02X'", *instr);
715           opcode1 = opcode_tmp.c_str();
716         }
717         break;
718       case 0x40: case 0x41: case 0x42: case 0x43: case 0x44: case 0x45: case 0x46: case 0x47:
719       case 0x48: case 0x49: case 0x4A: case 0x4B: case 0x4C: case 0x4D: case 0x4E: case 0x4F:
720         opcode1 = "cmov";
721         opcode2 = condition_codes[*instr & 0xF];
722         has_modrm = true;
723         load = true;
724         break;
725       case 0x50: case 0x51: case 0x52: case 0x53: case 0x54: case 0x55: case 0x56: case 0x57:
726       case 0x58: case 0x59: case 0x5C: case 0x5D: case 0x5E: case 0x5F: {
727         switch (*instr) {
728           case 0x50: opcode1 = "movmsk"; break;
729           case 0x51: opcode1 = "sqrt"; break;
730           case 0x52: opcode1 = "rsqrt"; break;
731           case 0x53: opcode1 = "rcp"; break;
732           case 0x54: opcode1 = "and"; break;
733           case 0x55: opcode1 = "andn"; break;
734           case 0x56: opcode1 = "or"; break;
735           case 0x57: opcode1 = "xor"; break;
736           case 0x58: opcode1 = "add"; break;
737           case 0x59: opcode1 = "mul"; break;
738           case 0x5C: opcode1 = "sub"; break;
739           case 0x5D: opcode1 = "min"; break;
740           case 0x5E: opcode1 = "div"; break;
741           case 0x5F: opcode1 = "max"; break;
742           default: LOG(FATAL) << "Unreachable"; UNREACHABLE();
743         }
744         if (prefix[2] == 0x66) {
745           opcode2 = "pd";
746           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
747         } else if (prefix[0] == 0xF2) {
748           opcode2 = "sd";
749           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
750         } else if (prefix[0] == 0xF3) {
751           opcode2 = "ss";
752           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
753         } else {
754           opcode2 = "ps";
755         }
756         load = true;
757         has_modrm = true;
758         src_reg_file = dst_reg_file = SSE;
759         break;
760       }
761       case 0x5A:
762         if (prefix[2] == 0x66) {
763           opcode1 = "cvtpd2ps";
764           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
765         } else if (prefix[0] == 0xF2) {
766           opcode1 = "cvtsd2ss";
767           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
768         } else if (prefix[0] == 0xF3) {
769           opcode1 = "cvtss2sd";
770           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
771         } else {
772           opcode1 = "cvtps2pd";
773         }
774         load = true;
775         has_modrm = true;
776         src_reg_file = dst_reg_file = SSE;
777         break;
778       case 0x5B:
779         if (prefix[2] == 0x66) {
780           opcode1 = "cvtps2dq";
781           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
782         } else if (prefix[0] == 0xF2) {
783           opcode1 = "bad opcode F2 0F 5B";
784         } else if (prefix[0] == 0xF3) {
785           opcode1 = "cvttps2dq";
786           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
787         } else {
788           opcode1 = "cvtdq2ps";
789         }
790         load = true;
791         has_modrm = true;
792         src_reg_file = dst_reg_file = SSE;
793         break;
794       case 0x60: case 0x61: case 0x62: case 0x6C:
795       case 0x68: case 0x69: case 0x6A: case 0x6D:
796         if (prefix[2] == 0x66) {
797           src_reg_file = dst_reg_file = SSE;
798           prefix[2] = 0;  // Clear prefix now. It has served its purpose as part of the opcode.
799         } else {
800           src_reg_file = dst_reg_file = MMX;
801         }
802         switch (*instr) {
803           case 0x60: opcode1 = "punpcklbw"; break;
804           case 0x61: opcode1 = "punpcklwd"; break;
805           case 0x62: opcode1 = "punpckldq"; break;
806           case 0x6c: opcode1 = "punpcklqdq"; break;
807           case 0x68: opcode1 = "punpckhbw"; break;
808           case 0x69: opcode1 = "punpckhwd"; break;
809           case 0x6A: opcode1 = "punpckhdq"; break;
810           case 0x6D: opcode1 = "punpckhqdq"; break;
811         }
812         load = true;
813         has_modrm = true;
814         break;
815       case 0x64:
816       case 0x65:
817       case 0x66:
818         if (prefix[2] == 0x66) {
819           src_reg_file = dst_reg_file = SSE;
820           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
821         } else {
822           src_reg_file = dst_reg_file = MMX;
823         }
824         switch (*instr) {
825           case 0x64: opcode1 = "pcmpgtb"; break;
826           case 0x65: opcode1 = "pcmpgtw"; break;
827           case 0x66: opcode1 = "pcmpgtd"; break;
828         }
829         prefix[2] = 0;
830         has_modrm = true;
831         load = true;
832         break;
833       case 0x6E:
834         if (prefix[2] == 0x66) {
835           dst_reg_file = SSE;
836           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
837         } else {
838           dst_reg_file = MMX;
839         }
840         opcode1 = "movd";
841         load = true;
842         has_modrm = true;
843         break;
844       case 0x6F:
845         if (prefix[2] == 0x66) {
846           src_reg_file = dst_reg_file = SSE;
847           opcode1 = "movdqa";
848           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
849         } else if (prefix[0] == 0xF3) {
850           src_reg_file = dst_reg_file = SSE;
851           opcode1 = "movdqu";
852           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
853         } else {
854           dst_reg_file = MMX;
855           opcode1 = "movq";
856         }
857         load = true;
858         has_modrm = true;
859         break;
860       case 0x70:
861         if (prefix[2] == 0x66) {
862           opcode1 = "pshufd";
863           prefix[2] = 0;
864           has_modrm = true;
865           store = true;
866           src_reg_file = dst_reg_file = SSE;
867           immediate_bytes = 1;
868         } else if (prefix[0] == 0xF2) {
869           opcode1 = "pshuflw";
870           prefix[0] = 0;
871           has_modrm = true;
872           store = true;
873           src_reg_file = dst_reg_file = SSE;
874           immediate_bytes = 1;
875         } else {
876           opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
877           opcode1 = opcode_tmp.c_str();
878         }
879         break;
880       case 0x71:
881         if (prefix[2] == 0x66) {
882           dst_reg_file = SSE;
883           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
884         } else {
885           dst_reg_file = MMX;
886         }
887         static const char* x71_opcodes[] = {
888             "unknown-71", "unknown-71", "psrlw", "unknown-71",
889             "psraw",      "unknown-71", "psllw", "unknown-71"};
890         modrm_opcodes = x71_opcodes;
891         reg_is_opcode = true;
892         has_modrm = true;
893         store = true;
894         immediate_bytes = 1;
895         break;
896       case 0x72:
897         if (prefix[2] == 0x66) {
898           dst_reg_file = SSE;
899           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
900         } else {
901           dst_reg_file = MMX;
902         }
903         static const char* x72_opcodes[] = {
904             "unknown-72", "unknown-72", "psrld", "unknown-72",
905             "psrad",      "unknown-72", "pslld", "unknown-72"};
906         modrm_opcodes = x72_opcodes;
907         reg_is_opcode = true;
908         has_modrm = true;
909         store = true;
910         immediate_bytes = 1;
911         break;
912       case 0x73:
913         if (prefix[2] == 0x66) {
914           dst_reg_file = SSE;
915           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
916         } else {
917           dst_reg_file = MMX;
918         }
919         static const char* x73_opcodes[] = {
920             "unknown-73", "unknown-73", "psrlq", "psrldq",
921             "unknown-73", "unknown-73", "psllq", "unknown-73"};
922         modrm_opcodes = x73_opcodes;
923         reg_is_opcode = true;
924         has_modrm = true;
925         store = true;
926         immediate_bytes = 1;
927         break;
928       case 0x74:
929       case 0x75:
930       case 0x76:
931         if (prefix[2] == 0x66) {
932           src_reg_file = dst_reg_file = SSE;
933           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
934         } else {
935           src_reg_file = dst_reg_file = MMX;
936         }
937         switch (*instr) {
938           case 0x74: opcode1 = "pcmpeqb"; break;
939           case 0x75: opcode1 = "pcmpeqw"; break;
940           case 0x76: opcode1 = "pcmpeqd"; break;
941         }
942         prefix[2] = 0;
943         has_modrm = true;
944         load = true;
945         break;
946       case 0x7C:
947         if (prefix[0] == 0xF2) {
948           opcode1 = "haddps";
949           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
950         } else if (prefix[2] == 0x66) {
951           opcode1 = "haddpd";
952           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
953         } else {
954           opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
955           opcode1 = opcode_tmp.c_str();
956           break;
957         }
958         src_reg_file = dst_reg_file = SSE;
959         has_modrm = true;
960         load = true;
961         break;
962       case 0x7E:
963         if (prefix[2] == 0x66) {
964           src_reg_file = SSE;
965           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
966         } else {
967           src_reg_file = MMX;
968         }
969         opcode1 = "movd";
970         has_modrm = true;
971         store = true;
972         break;
973       case 0x7F:
974         if (prefix[2] == 0x66) {
975           src_reg_file = dst_reg_file = SSE;
976           opcode1 = "movdqa";
977           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
978         } else if (prefix[0] == 0xF3) {
979           src_reg_file = dst_reg_file = SSE;
980           opcode1 = "movdqu";
981           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
982         } else {
983           dst_reg_file = MMX;
984           opcode1 = "movq";
985         }
986         store = true;
987         has_modrm = true;
988         break;
989       case 0x80: case 0x81: case 0x82: case 0x83: case 0x84: case 0x85: case 0x86: case 0x87:
990       case 0x88: case 0x89: case 0x8A: case 0x8B: case 0x8C: case 0x8D: case 0x8E: case 0x8F:
991         opcode1 = "j";
992         opcode2 = condition_codes[*instr & 0xF];
993         branch_bytes = 4;
994         break;
995       case 0x90: case 0x91: case 0x92: case 0x93: case 0x94: case 0x95: case 0x96: case 0x97:
996       case 0x98: case 0x99: case 0x9A: case 0x9B: case 0x9C: case 0x9D: case 0x9E: case 0x9F:
997         opcode1 = "set";
998         opcode2 = condition_codes[*instr & 0xF];
999         modrm_opcodes = nullptr;
1000         reg_is_opcode = true;
1001         has_modrm = true;
1002         store = true;
1003         break;
1004       case 0xA4:
1005         opcode1 = "shld";
1006         has_modrm = true;
1007         load = true;
1008         immediate_bytes = 1;
1009         break;
1010       case 0xA5:
1011         opcode1 = "shld";
1012         has_modrm = true;
1013         load = true;
1014         cx = true;
1015         break;
1016       case 0xAC:
1017         opcode1 = "shrd";
1018         has_modrm = true;
1019         load = true;
1020         immediate_bytes = 1;
1021         break;
1022       case 0xAD:
1023         opcode1 = "shrd";
1024         has_modrm = true;
1025         load = true;
1026         cx = true;
1027         break;
1028       case 0xAE:
1029         if (prefix[0] == 0xF3) {
1030           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
1031           static const char* xAE_opcodes[] = {
1032               "rdfsbase",   "rdgsbase",   "wrfsbase",   "wrgsbase",
1033               "unknown-AE", "unknown-AE", "unknown-AE", "unknown-AE"};
1034           modrm_opcodes = xAE_opcodes;
1035           reg_is_opcode = true;
1036           has_modrm = true;
1037           uint8_t reg_or_opcode = (instr[1] >> 3) & 7;
1038           switch (reg_or_opcode) {
1039             case 0:
1040               prefix[1] = kFs;
1041               load = true;
1042               break;
1043             case 1:
1044               prefix[1] = kGs;
1045               load = true;
1046               break;
1047             case 2:
1048               prefix[1] = kFs;
1049               store = true;
1050               break;
1051             case 3:
1052               prefix[1] = kGs;
1053               store = true;
1054               break;
1055             default:
1056               load = true;
1057               break;
1058           }
1059         } else {
1060           static const char* xAE_opcodes[] = {
1061               "unknown-AE", "unknown-AE", "unknown-AE", "unknown-AE",
1062               "unknown-AE", "lfence",     "mfence",     "sfence"};
1063           modrm_opcodes = xAE_opcodes;
1064           reg_is_opcode = true;
1065           has_modrm = true;
1066           load = true;
1067           no_ops = true;
1068         }
1069         break;
1070       case 0xAF:
1071         opcode1 = "imul";
1072         has_modrm = true;
1073         load = true;
1074         break;
1075       case 0xB1:
1076         opcode1 = "cmpxchg";
1077         has_modrm = true;
1078         store = true;
1079         break;
1080       case 0xB6:
1081         opcode1 = "movzxb";
1082         has_modrm = true;
1083         load = true;
1084         byte_second_operand = true;
1085         break;
1086       case 0xB7:
1087         opcode1 = "movzxw";
1088         has_modrm = true;
1089         load = true;
1090         break;
1091       case 0xBC:
1092         opcode1 = "bsf";
1093         has_modrm = true;
1094         load = true;
1095         break;
1096       case 0xBD:
1097         opcode1 = "bsr";
1098         has_modrm = true;
1099         load = true;
1100         break;
1101       case 0xB8:
1102         opcode1 = "popcnt";
1103         has_modrm = true;
1104         load = true;
1105         break;
1106       case 0xBE:
1107         opcode1 = "movsxb";
1108         has_modrm = true;
1109         load = true;
1110         byte_second_operand = true;
1111         rex |= (rex == 0 ? 0 : REX_W);
1112         break;
1113       case 0xBF:
1114         opcode1 = "movsxw";
1115         has_modrm = true;
1116         load = true;
1117         break;
1118       case 0xC3:
1119         opcode1 = "movnti";
1120         store = true;
1121         has_modrm = true;
1122         break;
1123       case 0xC5:
1124         if (prefix[2] == 0x66) {
1125           opcode1 = "pextrw";
1126           prefix[2] = 0;
1127           has_modrm = true;
1128           load = true;
1129           src_reg_file = SSE;
1130           immediate_bytes = 1;
1131         } else {
1132           opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
1133           opcode1 = opcode_tmp.c_str();
1134         }
1135         break;
1136       case 0xC6:
1137         if (prefix[2] == 0x66) {
1138           opcode1 = "shufpd";
1139           prefix[2] = 0;
1140         } else {
1141           opcode1 = "shufps";
1142         }
1143         has_modrm = true;
1144         store = true;
1145         src_reg_file = dst_reg_file = SSE;
1146         immediate_bytes = 1;
1147         break;
1148       case 0xC7:
1149         static const char* x0FxC7_opcodes[] = {
1150             "unknown-0f-c7", "cmpxchg8b",     "unknown-0f-c7", "unknown-0f-c7",
1151             "unknown-0f-c7", "unknown-0f-c7", "unknown-0f-c7", "unknown-0f-c7"};
1152         modrm_opcodes = x0FxC7_opcodes;
1153         has_modrm = true;
1154         reg_is_opcode = true;
1155         store = true;
1156         break;
1157       case 0xC8: case 0xC9: case 0xCA: case 0xCB: case 0xCC: case 0xCD: case 0xCE: case 0xCF:
1158         opcode1 = "bswap";
1159         reg_in_opcode = true;
1160         break;
1161       case 0xD4:
1162         if (prefix[2] == 0x66) {
1163           src_reg_file = dst_reg_file = SSE;
1164           prefix[2] = 0;
1165         } else {
1166           src_reg_file = dst_reg_file = MMX;
1167         }
1168         opcode1 = "paddq";
1169         prefix[2] = 0;
1170         has_modrm = true;
1171         load = true;
1172         break;
1173       case 0xDB:
1174         if (prefix[2] == 0x66) {
1175           src_reg_file = dst_reg_file = SSE;
1176           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1177         } else {
1178           src_reg_file = dst_reg_file = MMX;
1179         }
1180         opcode1 = "pand";
1181         prefix[2] = 0;
1182         has_modrm = true;
1183         load = true;
1184         break;
1185       case 0xD5:
1186         if (prefix[2] == 0x66) {
1187           opcode1 = "pmullw";
1188           prefix[2] = 0;
1189           has_modrm = true;
1190           load = true;
1191           src_reg_file = dst_reg_file = SSE;
1192         } else {
1193           opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
1194           opcode1 = opcode_tmp.c_str();
1195         }
1196         break;
1197       case 0xD8:
1198       case 0xD9:
1199       case 0xDA:
1200       case 0xDC:
1201       case 0xDD:
1202       case 0xDE:
1203       case 0xE0:
1204       case 0xE3:
1205       case 0xE8:
1206       case 0xE9:
1207       case 0xEA:
1208       case 0xEC:
1209       case 0xED:
1210       case 0xEE:
1211         if (prefix[2] == 0x66) {
1212           src_reg_file = dst_reg_file = SSE;
1213           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1214         } else {
1215           src_reg_file = dst_reg_file = MMX;
1216         }
1217         switch (*instr) {
1218           case 0xD8: opcode1 = "psubusb"; break;
1219           case 0xD9: opcode1 = "psubusw"; break;
1220           case 0xDA: opcode1 = "pminub"; break;
1221           case 0xDC: opcode1 = "paddusb"; break;
1222           case 0xDD: opcode1 = "paddusw"; break;
1223           case 0xDE: opcode1 = "pmaxub"; break;
1224           case 0xE0: opcode1 = "pavgb"; break;
1225           case 0xE3: opcode1 = "pavgw"; break;
1226           case 0xE8: opcode1 = "psubsb"; break;
1227           case 0xE9: opcode1 = "psubsw"; break;
1228           case 0xEA: opcode1 = "pminsw"; break;
1229           case 0xEC: opcode1 = "paddsb"; break;
1230           case 0xED: opcode1 = "paddsw"; break;
1231           case 0xEE: opcode1 = "pmaxsw"; break;
1232         }
1233         prefix[2] = 0;
1234         has_modrm = true;
1235         load = true;
1236         break;
1237       case 0xEB:
1238         if (prefix[2] == 0x66) {
1239           src_reg_file = dst_reg_file = SSE;
1240           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1241         } else {
1242           src_reg_file = dst_reg_file = MMX;
1243         }
1244         opcode1 = "por";
1245         prefix[2] = 0;
1246         has_modrm = true;
1247         load = true;
1248         break;
1249       case 0xEF:
1250         if (prefix[2] == 0x66) {
1251           src_reg_file = dst_reg_file = SSE;
1252           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1253         } else {
1254           src_reg_file = dst_reg_file = MMX;
1255         }
1256         opcode1 = "pxor";
1257         prefix[2] = 0;
1258         has_modrm = true;
1259         load = true;
1260         break;
1261       case 0xF4:
1262       case 0xF6:
1263       case 0xF8:
1264       case 0xF9:
1265       case 0xFA:
1266       case 0xFB:
1267       case 0xFC:
1268       case 0xFD:
1269       case 0xFE:
1270         if (prefix[2] == 0x66) {
1271           src_reg_file = dst_reg_file = SSE;
1272           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1273         } else {
1274           src_reg_file = dst_reg_file = MMX;
1275         }
1276         switch (*instr) {
1277           case 0xF4: opcode1 = "pmuludq"; break;
1278           case 0xF6: opcode1 = "psadbw"; break;
1279           case 0xF8: opcode1 = "psubb"; break;
1280           case 0xF9: opcode1 = "psubw"; break;
1281           case 0xFA: opcode1 = "psubd"; break;
1282           case 0xFB: opcode1 = "psubq"; break;
1283           case 0xFC: opcode1 = "paddb"; break;
1284           case 0xFD: opcode1 = "paddw"; break;
1285           case 0xFE: opcode1 = "paddd"; break;
1286         }
1287         prefix[2] = 0;
1288         has_modrm = true;
1289         load = true;
1290         break;
1291       default:
1292         opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
1293         opcode1 = opcode_tmp.c_str();
1294         break;
1295     }
1296     break;
1297   case 0x80: case 0x81: case 0x82: case 0x83:
1298     static const char* x80_opcodes[] = {"add", "or", "adc", "sbb", "and", "sub", "xor", "cmp"};
1299     modrm_opcodes = x80_opcodes;
1300     has_modrm = true;
1301     reg_is_opcode = true;
1302     store = true;
1303     byte_operand = (*instr & 1) == 0;
1304     immediate_bytes = *instr == 0x81 ? 4 : 1;
1305     break;
1306   case 0x84: case 0x85:
1307     opcode1 = "test";
1308     has_modrm = true;
1309     load = true;
1310     byte_operand = (*instr & 1) == 0;
1311     break;
1312   case 0x8D:
1313     opcode1 = "lea";
1314     has_modrm = true;
1315     load = true;
1316     break;
1317   case 0x8F:
1318     opcode1 = "pop";
1319     has_modrm = true;
1320     reg_is_opcode = true;
1321     store = true;
1322     break;
1323   case 0x99:
1324     opcode1 = "cdq";
1325     break;
1326   case 0x9B:
1327     if (instr[1] == 0xDF && instr[2] == 0xE0) {
1328       opcode1 = "fstsw\tax";
1329       instr += 2;
1330     } else {
1331       opcode_tmp = StringPrintf("unknown opcode '%02X'", *instr);
1332       opcode1 = opcode_tmp.c_str();
1333     }
1334     break;
1335   case 0xA5:
1336     opcode1 = (prefix[2] == 0x66 ? "movsw" : "movsl");
1337     break;
1338   case 0xA7:
1339     opcode1 = (prefix[2] == 0x66 ? "cmpsw" : "cmpsl");
1340     break;
1341   case 0xAF:
1342     opcode1 = (prefix[2] == 0x66 ? "scasw" : "scasl");
1343     break;
1344   case 0xB0: case 0xB1: case 0xB2: case 0xB3: case 0xB4: case 0xB5: case 0xB6: case 0xB7:
1345     opcode1 = "mov";
1346     immediate_bytes = 1;
1347     byte_operand = true;
1348     reg_in_opcode = true;
1349     byte_operand = true;
1350     break;
1351   case 0xB8: case 0xB9: case 0xBA: case 0xBB: case 0xBC: case 0xBD: case 0xBE: case 0xBF:
1352     if ((rex & REX_W) != 0) {
1353       opcode1 = "movabsq";
1354       immediate_bytes = 8;
1355       reg_in_opcode = true;
1356       break;
1357     }
1358     opcode1 = "mov";
1359     immediate_bytes = 4;
1360     reg_in_opcode = true;
1361     break;
1362   case 0xC0: case 0xC1:
1363   case 0xD0: case 0xD1: case 0xD2: case 0xD3:
1364     static const char* shift_opcodes[] =
1365         {"rol", "ror", "rcl", "rcr", "shl", "shr", "unknown-shift", "sar"};
1366     modrm_opcodes = shift_opcodes;
1367     has_modrm = true;
1368     reg_is_opcode = true;
1369     store = true;
1370     immediate_bytes = ((*instr & 0xf0) == 0xc0) ? 1 : 0;
1371     cx = (*instr == 0xD2) || (*instr == 0xD3);
1372     byte_operand = (*instr == 0xC0);
1373     break;
1374   case 0xC3: opcode1 = "ret"; break;
1375   case 0xC6:
1376     static const char* c6_opcodes[] = {"mov",        "unknown-c6", "unknown-c6",
1377                                        "unknown-c6", "unknown-c6", "unknown-c6",
1378                                        "unknown-c6", "unknown-c6"};
1379     modrm_opcodes = c6_opcodes;
1380     store = true;
1381     immediate_bytes = 1;
1382     has_modrm = true;
1383     reg_is_opcode = true;
1384     byte_operand = true;
1385     break;
1386   case 0xC7:
1387     static const char* c7_opcodes[] = {"mov",        "unknown-c7", "unknown-c7",
1388                                        "unknown-c7", "unknown-c7", "unknown-c7",
1389                                        "unknown-c7", "unknown-c7"};
1390     modrm_opcodes = c7_opcodes;
1391     store = true;
1392     immediate_bytes = 4;
1393     has_modrm = true;
1394     reg_is_opcode = true;
1395     break;
1396   case 0xCC: opcode1 = "int 3"; break;
1397   case 0xD9:
1398     if (instr[1] == 0xF8) {
1399       opcode1 = "fprem";
1400       instr++;
1401     } else {
1402       static const char* d9_opcodes[] = {"flds", "unknown-d9", "fsts", "fstps", "fldenv", "fldcw",
1403                                          "fnstenv", "fnstcw"};
1404       modrm_opcodes = d9_opcodes;
1405       store = true;
1406       has_modrm = true;
1407       reg_is_opcode = true;
1408     }
1409     break;
1410   case 0xDA:
1411     if (instr[1] == 0xE9) {
1412       opcode1 = "fucompp";
1413       instr++;
1414     } else {
1415       opcode_tmp = StringPrintf("unknown opcode '%02X'", *instr);
1416       opcode1 = opcode_tmp.c_str();
1417     }
1418     break;
1419   case 0xDB:
1420     static const char* db_opcodes[] = {"fildl",      "unknown-db", "unknown-db",
1421                                        "unknown-db", "unknown-db", "unknown-db",
1422                                        "unknown-db", "unknown-db"};
1423     modrm_opcodes = db_opcodes;
1424     load = true;
1425     has_modrm = true;
1426     reg_is_opcode = true;
1427     break;
1428   case 0xDD:
1429     static const char* dd_opcodes[] = {"fldl",   "fisttp", "fstl",
1430                                        "fstpl",  "frstor", "unknown-dd",
1431                                        "fnsave", "fnstsw"};
1432     modrm_opcodes = dd_opcodes;
1433     store = true;
1434     has_modrm = true;
1435     reg_is_opcode = true;
1436     break;
1437   case 0xDF:
1438     static const char* df_opcodes[] = {"fild",       "unknown-df", "unknown-df",
1439                                        "unknown-df", "unknown-df", "fildll",
1440                                        "unknown-df", "unknown-df"};
1441     modrm_opcodes = df_opcodes;
1442     load = true;
1443     has_modrm = true;
1444     reg_is_opcode = true;
1445     break;
1446   case 0xE3: opcode1 = "jecxz"; branch_bytes = 1; break;
1447   case 0xE8: opcode1 = "call"; branch_bytes = 4; break;
1448   case 0xE9: opcode1 = "jmp"; branch_bytes = 4; break;
1449   case 0xEB: opcode1 = "jmp"; branch_bytes = 1; break;
1450   case 0xF5: opcode1 = "cmc"; break;
1451   case 0xF6: case 0xF7:
1452     static const char* f7_opcodes[] = {
1453         "test", "unknown-f7", "not", "neg", "mul edx:eax, eax *",
1454         "imul edx:eax, eax *", "div edx:eax, edx:eax /",
1455         "idiv edx:eax, edx:eax /"};
1456     modrm_opcodes = f7_opcodes;
1457     has_modrm = true;
1458     reg_is_opcode = true;
1459     store = true;
1460     immediate_bytes = ((instr[1] & 0x38) == 0) ? (instr[0] == 0xF7 ? 4 : 1) : 0;
1461     break;
1462   case 0xFF:
1463     {
1464       static const char* ff_opcodes[] = {
1465           "inc", "dec", "call", "call",
1466           "jmp", "jmp", "push", "unknown-ff"};
1467       modrm_opcodes = ff_opcodes;
1468       has_modrm = true;
1469       reg_is_opcode = true;
1470       load = true;
1471       const uint8_t opcode_digit = (instr[1] >> 3) & 7;
1472       // 'call', 'jmp' and 'push' are target specific instructions
1473       if (opcode_digit == 2 || opcode_digit == 4 || opcode_digit == 6) {
1474         target_specific = true;
1475       }
1476     }
1477     break;
1478   default:
1479     opcode_tmp = StringPrintf("unknown opcode '%02X'", *instr);
1480     opcode1 = opcode_tmp.c_str();
1481     break;
1482   }
1483   std::ostringstream args;
1484   // We force the REX prefix to be available for 64-bit target
1485   // in order to dump addr (base/index) registers correctly.
1486   uint8_t rex64 = supports_rex_ ? (rex | 0x40) : rex;
1487   // REX.W should be forced for 64-target and target-specific instructions (i.e., push or pop).
1488   uint8_t rex_w = (supports_rex_ && target_specific) ? (rex | 0x48) : rex;
1489   if (reg_in_opcode) {
1490     DCHECK(!has_modrm);
1491     DumpOpcodeReg(args, rex_w, *instr & 0x7, byte_operand, prefix[2]);
1492   }
1493   instr++;
1494   uint32_t address_bits = 0;
1495   if (has_modrm) {
1496     uint8_t modrm = *instr;
1497     instr++;
1498     uint8_t mod = modrm >> 6;
1499     uint8_t reg_or_opcode = (modrm >> 3) & 7;
1500     uint8_t rm = modrm & 7;
1501     std::string address = DumpAddress(mod, rm, rex64, rex_w, no_ops, byte_operand,
1502                                       byte_second_operand, prefix, load, src_reg_file, dst_reg_file,
1503                                       &instr, &address_bits);
1504 
1505     if (reg_is_opcode && modrm_opcodes != nullptr) {
1506       opcode3 = modrm_opcodes[reg_or_opcode];
1507     }
1508 
1509     // Add opcode suffixes to indicate size.
1510     if (byte_operand) {
1511       opcode4 = "b";
1512     } else if ((rex & REX_W) != 0) {
1513       opcode4 = "q";
1514     } else if (prefix[2] == 0x66) {
1515       opcode4 = "w";
1516     }
1517 
1518     if (load) {
1519       if (!reg_is_opcode) {
1520         DumpReg(args, rex, reg_or_opcode, byte_operand, prefix[2], dst_reg_file);
1521         args << ", ";
1522       }
1523       DumpSegmentOverride(args, prefix[1]);
1524       args << address;
1525     } else {
1526       DCHECK(store);
1527       DumpSegmentOverride(args, prefix[1]);
1528       args << address;
1529       if (!reg_is_opcode) {
1530         args << ", ";
1531         DumpReg(args, rex, reg_or_opcode, byte_operand, prefix[2], src_reg_file);
1532       }
1533     }
1534   }
1535   if (ax) {
1536     // If this opcode implicitly uses ax, ax is always the first arg.
1537     DumpReg(args, rex, 0 /* EAX */, byte_operand, prefix[2], GPR);
1538   }
1539   if (cx) {
1540     args << ", ";
1541     DumpReg(args, rex, 1 /* ECX */, true, prefix[2], GPR);
1542   }
1543   if (immediate_bytes > 0) {
1544     if (has_modrm || reg_in_opcode || ax || cx) {
1545       args << ", ";
1546     }
1547     if (immediate_bytes == 1) {
1548       args << StringPrintf("%d", *reinterpret_cast<const int8_t*>(instr));
1549       instr++;
1550     } else if (immediate_bytes == 4) {
1551       if (prefix[2] == 0x66) {  // Operand size override from 32-bit to 16-bit.
1552         args << StringPrintf("%d", *reinterpret_cast<const int16_t*>(instr));
1553         instr += 2;
1554       } else {
1555         args << StringPrintf("%d", *reinterpret_cast<const int32_t*>(instr));
1556         instr += 4;
1557       }
1558     } else {
1559       CHECK_EQ(immediate_bytes, 8u);
1560       args << StringPrintf("%" PRId64, *reinterpret_cast<const int64_t*>(instr));
1561       instr += 8;
1562     }
1563   } else if (branch_bytes > 0) {
1564     DCHECK(!has_modrm);
1565     int32_t displacement;
1566     if (branch_bytes == 1) {
1567       displacement = *reinterpret_cast<const int8_t*>(instr);
1568       instr++;
1569     } else {
1570       CHECK_EQ(branch_bytes, 4u);
1571       displacement = *reinterpret_cast<const int32_t*>(instr);
1572       instr += 4;
1573     }
1574     args << StringPrintf("%+d (", displacement)
1575          << FormatInstructionPointer(instr + displacement)
1576          << ")";
1577   }
1578   if (prefix[1] == kFs && !supports_rex_) {
1579     args << "  ; ";
1580     GetDisassemblerOptions()->thread_offset_name_function_(args, address_bits);
1581   }
1582   if (prefix[1] == kGs && supports_rex_) {
1583     args << "  ; ";
1584     GetDisassemblerOptions()->thread_offset_name_function_(args, address_bits);
1585   }
1586   const char* prefix_str;
1587   switch (prefix[0]) {
1588     case 0xF0: prefix_str = "lock "; break;
1589     case 0xF2: prefix_str = "repne "; break;
1590     case 0xF3: prefix_str = "repe "; break;
1591     case 0: prefix_str = ""; break;
1592     default: LOG(FATAL) << "Unreachable"; UNREACHABLE();
1593   }
1594   os << FormatInstructionPointer(begin_instr)
1595      << StringPrintf(": %22s    \t%-7s%s%s%s%s%s ", DumpCodeHex(begin_instr, instr).c_str(),
1596                      prefix_str, opcode0, opcode1, opcode2, opcode3, opcode4)
1597      << args.str() << '\n';
1598   return instr - begin_instr;
1599 }  // NOLINT(readability/fn_size)
1600 
1601 }  // namespace x86
1602 }  // namespace art
1603