1 /*
2  * Copyright (C) 2012 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "disassembler_x86.h"
18 
19 #include <inttypes.h>
20 
21 #include <ostream>
22 #include <sstream>
23 
24 #include "android-base/logging.h"
25 #include "android-base/stringprintf.h"
26 
27 #define TWO_BYTE_VEX    0xC5
28 #define THREE_BYTE_VEX  0xC4
29 #define VEX_M_0F        0x01
30 #define VEX_M_0F_38     0x02
31 #define VEX_M_0F_3A     0x03
32 #define VEX_PP_NONE     0x00
33 #define VEX_PP_66       0x01
34 #define VEX_PP_F3       0x02
35 #define VEX_PP_F2       0x03
36 
37 using android::base::StringPrintf;
38 
39 namespace art {
40 namespace x86 {
41 
Dump(std::ostream & os,const uint8_t * begin)42 size_t DisassemblerX86::Dump(std::ostream& os, const uint8_t* begin) {
43   return DumpInstruction(os, begin);
44 }
45 
Dump(std::ostream & os,const uint8_t * begin,const uint8_t * end)46 void DisassemblerX86::Dump(std::ostream& os, const uint8_t* begin, const uint8_t* end) {
47   size_t length = 0;
48   for (const uint8_t* cur = begin; cur < end; cur += length) {
49     length = DumpInstruction(os, cur);
50   }
51 }
52 
53 static const char* gReg8Names[]  = {
54   "al", "cl", "dl", "bl", "ah", "ch", "dh", "bh"
55 };
56 static const char* gExtReg8Names[] = {
57   "al", "cl", "dl", "bl", "spl", "bpl", "sil", "dil",
58   "r8l", "r9l", "r10l", "r11l", "r12l", "r13l", "r14l", "r15l"
59 };
60 static const char* gReg16Names[] = {
61   "ax", "cx", "dx", "bx", "sp", "bp", "si", "di",
62   "r8w", "r9w", "r10w", "r11w", "r12w", "r13w", "r14w", "r15w"
63 };
64 static const char* gReg32Names[] = {
65   "eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi",
66   "r8d", "r9d", "r10d", "r11d", "r12d", "r13d", "r14d", "r15d"
67 };
68 static const char* gReg64Names[] = {
69   "rax", "rcx", "rdx", "rbx", "rsp", "rbp", "rsi", "rdi",
70   "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
71 };
72 
73 // 64-bit opcode REX modifier.
74 constexpr uint8_t REX_W = 8U /* 0b1000 */;
75 constexpr uint8_t REX_R = 4U /* 0b0100 */;
76 constexpr uint8_t REX_X = 2U /* 0b0010 */;
77 constexpr uint8_t REX_B = 1U /* 0b0001 */;
78 
DumpReg0(std::ostream & os,uint8_t rex,size_t reg,bool byte_operand,uint8_t size_override)79 static void DumpReg0(std::ostream& os, uint8_t rex, size_t reg,
80                      bool byte_operand, uint8_t size_override) {
81   DCHECK_LT(reg, (rex == 0) ? 8u : 16u);
82   bool rex_w = (rex & REX_W) != 0;
83   if (byte_operand) {
84     os << ((rex == 0) ? gReg8Names[reg] : gExtReg8Names[reg]);
85   } else if (rex_w) {
86     os << gReg64Names[reg];
87   } else if (size_override == 0x66) {
88     os << gReg16Names[reg];
89   } else {
90     os << gReg32Names[reg];
91   }
92 }
93 
DumpAnyReg(std::ostream & os,uint8_t rex,size_t reg,bool byte_operand,uint8_t size_override,RegFile reg_file)94 static void DumpAnyReg(std::ostream& os, uint8_t rex, size_t reg,
95                        bool byte_operand, uint8_t size_override, RegFile reg_file) {
96   if (reg_file == GPR) {
97     DumpReg0(os, rex, reg, byte_operand, size_override);
98   } else if (reg_file == SSE) {
99     os << "xmm" << reg;
100   } else {
101     os << "mm" << reg;
102   }
103 }
104 
DumpReg(std::ostream & os,uint8_t rex,uint8_t reg,bool byte_operand,uint8_t size_override,RegFile reg_file)105 static void DumpReg(std::ostream& os, uint8_t rex, uint8_t reg,
106                     bool byte_operand, uint8_t size_override, RegFile reg_file) {
107   bool rex_r = (rex & REX_R) != 0;
108   size_t reg_num = rex_r ? (reg + 8) : reg;
109   DumpAnyReg(os, rex, reg_num, byte_operand, size_override, reg_file);
110 }
111 
DumpRmReg(std::ostream & os,uint8_t rex,uint8_t reg,bool byte_operand,uint8_t size_override,RegFile reg_file)112 static void DumpRmReg(std::ostream& os, uint8_t rex, uint8_t reg,
113                       bool byte_operand, uint8_t size_override, RegFile reg_file) {
114   bool rex_b = (rex & REX_B) != 0;
115   size_t reg_num = rex_b ? (reg + 8) : reg;
116   DumpAnyReg(os, rex, reg_num, byte_operand, size_override, reg_file);
117 }
118 
DumpAddrReg(std::ostream & os,uint8_t rex,uint8_t reg)119 static void DumpAddrReg(std::ostream& os, uint8_t rex, uint8_t reg) {
120   if (rex != 0) {
121     os << gReg64Names[reg];
122   } else {
123     os << gReg32Names[reg];
124   }
125 }
126 
DumpBaseReg(std::ostream & os,uint8_t rex,uint8_t reg)127 static void DumpBaseReg(std::ostream& os, uint8_t rex, uint8_t reg) {
128   bool rex_b = (rex & REX_B) != 0;
129   size_t reg_num = rex_b ? (reg + 8) : reg;
130   DumpAddrReg(os, rex, reg_num);
131 }
132 
DumpOpcodeReg(std::ostream & os,uint8_t rex,uint8_t reg,bool byte_operand,uint8_t size_override)133 static void DumpOpcodeReg(std::ostream& os, uint8_t rex, uint8_t reg,
134                           bool byte_operand, uint8_t size_override) {
135   bool rex_b = (rex & REX_B) != 0;
136   size_t reg_num = rex_b ? (reg + 8) : reg;
137   DumpReg0(os, rex, reg_num, byte_operand, size_override);
138 }
139 
140 enum SegmentPrefix {
141   kCs = 0x2e,
142   kSs = 0x36,
143   kDs = 0x3e,
144   kEs = 0x26,
145   kFs = 0x64,
146   kGs = 0x65,
147 };
148 
DumpSegmentOverride(std::ostream & os,uint8_t segment_prefix)149 static void DumpSegmentOverride(std::ostream& os, uint8_t segment_prefix) {
150   switch (segment_prefix) {
151     case kCs: os << "cs:"; break;
152     case kSs: os << "ss:"; break;
153     case kDs: os << "ds:"; break;
154     case kEs: os << "es:"; break;
155     case kFs: os << "fs:"; break;
156     case kGs: os << "gs:"; break;
157     default: break;
158   }
159 }
160 
161 // Do not inline to avoid Clang stack frame problems. b/18733806
162 NO_INLINE
DumpCodeHex(const uint8_t * begin,const uint8_t * end)163 static std::string DumpCodeHex(const uint8_t* begin, const uint8_t* end) {
164   std::stringstream hex;
165   for (size_t i = 0; begin + i < end; ++i) {
166     hex << StringPrintf("%02X", begin[i]);
167   }
168   return hex.str();
169 }
170 
DumpAddress(uint8_t mod,uint8_t rm,uint8_t rex64,uint8_t rex_w,bool no_ops,bool byte_operand,bool byte_second_operand,uint8_t * prefix,bool load,RegFile src_reg_file,RegFile dst_reg_file,const uint8_t ** instr,uint32_t * address_bits)171 std::string DisassemblerX86::DumpAddress(uint8_t mod, uint8_t rm, uint8_t rex64, uint8_t rex_w,
172                                          bool no_ops, bool byte_operand, bool byte_second_operand,
173                                          uint8_t* prefix, bool load, RegFile src_reg_file,
174                                          RegFile dst_reg_file, const uint8_t** instr,
175                                          uint32_t* address_bits) {
176   std::ostringstream address;
177   if (mod == 0 && rm == 5) {
178     if (!supports_rex_) {  // Absolute address.
179       *address_bits = *reinterpret_cast<const uint32_t*>(*instr);
180       address << StringPrintf("[0x%x]", *address_bits);
181     } else {  // 64-bit RIP relative addressing.
182       address << StringPrintf("[RIP + 0x%x]",  *reinterpret_cast<const uint32_t*>(*instr));
183     }
184     (*instr) += 4;
185   } else if (rm == 4 && mod != 3) {  // SIB
186     uint8_t sib = **instr;
187     (*instr)++;
188     uint8_t scale = (sib >> 6) & 3;
189     uint8_t index = (sib >> 3) & 7;
190     uint8_t base = sib & 7;
191     address << "[";
192 
193     // REX.x is bit 3 of index.
194     if ((rex64 & REX_X) != 0) {
195       index += 8;
196     }
197 
198     // Mod = 0 && base = 5 (ebp): no base (ignores REX.b).
199     bool has_base = false;
200     if (base != 5 || mod != 0) {
201       has_base = true;
202       DumpBaseReg(address, rex64, base);
203     }
204 
205     // Index = 4 (esp/rsp) is disallowed.
206     if (index != 4) {
207       if (has_base) {
208         address << " + ";
209       }
210       DumpAddrReg(address, rex64, index);
211       if (scale != 0) {
212         address << StringPrintf(" * %d", 1 << scale);
213       }
214     }
215 
216     if (mod == 0) {
217       if (base == 5) {
218         if (index != 4) {
219           address << StringPrintf(" + %d", *reinterpret_cast<const int32_t*>(*instr));
220         } else {
221           // 64-bit low 32-bit absolute address, redundant absolute address encoding on 32-bit.
222           *address_bits = *reinterpret_cast<const uint32_t*>(*instr);
223           address << StringPrintf("%d", *address_bits);
224         }
225         (*instr) += 4;
226       }
227     } else if (mod == 1) {
228       address << StringPrintf(" + %d", *reinterpret_cast<const int8_t*>(*instr));
229       (*instr)++;
230     } else if (mod == 2) {
231       address << StringPrintf(" + %d", *reinterpret_cast<const int32_t*>(*instr));
232       (*instr) += 4;
233     }
234     address << "]";
235   } else {
236     if (mod == 3) {
237       if (!no_ops) {
238         DumpRmReg(address, rex_w, rm, byte_operand || byte_second_operand,
239                   prefix[2], load ? src_reg_file : dst_reg_file);
240       }
241     } else {
242       address << "[";
243       DumpBaseReg(address, rex64, rm);
244       if (mod == 1) {
245         address << StringPrintf(" + %d", *reinterpret_cast<const int8_t*>(*instr));
246         (*instr)++;
247       } else if (mod == 2) {
248         address << StringPrintf(" + %d", *reinterpret_cast<const int32_t*>(*instr));
249         (*instr) += 4;
250       }
251       address << "]";
252     }
253   }
254   return address.str();
255 }
256 
DumpNops(std::ostream & os,const uint8_t * instr)257 size_t DisassemblerX86::DumpNops(std::ostream& os, const uint8_t* instr) {
258 static constexpr uint8_t kNops[][10] = {
259       { },
260       { 0x90 },
261       { 0x66, 0x90 },
262       { 0x0f, 0x1f, 0x00 },
263       { 0x0f, 0x1f, 0x40, 0x00 },
264       { 0x0f, 0x1f, 0x44, 0x00, 0x00 },
265       { 0x66, 0x0f, 0x1f, 0x44, 0x00, 0x00 },
266       { 0x0f, 0x1f, 0x80, 0x00, 0x00, 0x00, 0x00 },
267       { 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 },
268       { 0x66, 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 },
269       { 0x66, 0x2e, 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 }
270   };
271 
272   for (size_t i = 1; i < arraysize(kNops); ++i) {
273     if (memcmp(instr, kNops[i], i) == 0) {
274       os << FormatInstructionPointer(instr)
275          << StringPrintf(": %22s    \t       nop \n", DumpCodeHex(instr, instr + i).c_str());
276       return i;
277     }
278   }
279 
280   return 0;
281 }
282 
DumpInstruction(std::ostream & os,const uint8_t * instr)283 size_t DisassemblerX86::DumpInstruction(std::ostream& os, const uint8_t* instr) {
284   size_t nop_size = DumpNops(os, instr);
285   if (nop_size != 0u) {
286     return nop_size;
287   }
288 
289   const uint8_t* begin_instr = instr;
290   bool have_prefixes = true;
291   uint8_t prefix[4] = {0, 0, 0, 0};
292   do {
293     switch (*instr) {
294         // Group 1 - lock and repeat prefixes:
295       case 0xF0:
296       case 0xF2:
297       case 0xF3:
298         prefix[0] = *instr;
299         break;
300         // Group 2 - segment override prefixes:
301       case kCs:
302       case kSs:
303       case kDs:
304       case kEs:
305       case kFs:
306       case kGs:
307         prefix[1] = *instr;
308         break;
309         // Group 3 - operand size override:
310       case 0x66:
311         prefix[2] = *instr;
312         break;
313         // Group 4 - address size override:
314       case 0x67:
315         prefix[3] = *instr;
316         break;
317       default:
318         have_prefixes = false;
319         break;
320     }
321     if (have_prefixes) {
322       instr++;
323     }
324   } while (have_prefixes);
325   uint8_t rex = (supports_rex_ && (*instr >= 0x40) && (*instr <= 0x4F)) ? *instr : 0;
326   if (rex != 0) {
327     instr++;
328   }
329 
330   const char** modrm_opcodes = nullptr;
331   bool has_modrm = false;
332   bool reg_is_opcode = false;
333 
334   size_t immediate_bytes = 0;
335   size_t branch_bytes = 0;
336   std::string opcode_tmp;    // Storage to keep StringPrintf result alive.
337   const char* opcode0 = "";  // Prefix part.
338   const char* opcode1 = "";  // Main opcode.
339   const char* opcode2 = "";  // Sub-opcode. E.g., jump type.
340   const char* opcode3 = "";  // Mod-rm part.
341   const char* opcode4 = "";  // Suffix part.
342   bool store = false;  // stores to memory (ie rm is on the left)
343   bool load = false;  // loads from memory (ie rm is on the right)
344   bool byte_operand = false;  // true when the opcode is dealing with byte operands
345   // true when the source operand is a byte register but the target register isn't
346   // (ie movsxb/movzxb).
347   bool byte_second_operand = false;
348   bool target_specific = false;  // register name depends on target (64 vs 32 bits).
349   bool ax = false;  // implicit use of ax
350   bool cx = false;  // implicit use of cx
351   bool reg_in_opcode = false;  // low 3-bits of opcode encode register parameter
352   bool no_ops = false;
353   RegFile src_reg_file = GPR;
354   RegFile dst_reg_file = GPR;
355 
356 
357   switch (*instr) {
358 #define DISASSEMBLER_ENTRY(opname, \
359                      rm8_r8, rm32_r32, \
360                      r8_rm8, r32_rm32, \
361                      ax8_i8, ax32_i32) \
362   case rm8_r8:   opcode1 = #opname; store = true; has_modrm = true; byte_operand = true; break; \
363   case rm32_r32: opcode1 = #opname; store = true; has_modrm = true; break; \
364   case r8_rm8:   opcode1 = #opname; load = true; has_modrm = true; byte_operand = true; break; \
365   case r32_rm32: opcode1 = #opname; load = true; has_modrm = true; break; \
366   case ax8_i8:   opcode1 = #opname; ax = true; immediate_bytes = 1; byte_operand = true; break; \
367   case ax32_i32: opcode1 = #opname; ax = true; immediate_bytes = 4; break;
368 
369 DISASSEMBLER_ENTRY(add,
370   0x00 /* RegMem8/Reg8 */,     0x01 /* RegMem32/Reg32 */,
371   0x02 /* Reg8/RegMem8 */,     0x03 /* Reg32/RegMem32 */,
372   0x04 /* Rax8/imm8 opcode */, 0x05 /* Rax32/imm32 */)
373 DISASSEMBLER_ENTRY(or,
374   0x08 /* RegMem8/Reg8 */,     0x09 /* RegMem32/Reg32 */,
375   0x0A /* Reg8/RegMem8 */,     0x0B /* Reg32/RegMem32 */,
376   0x0C /* Rax8/imm8 opcode */, 0x0D /* Rax32/imm32 */)
377 DISASSEMBLER_ENTRY(adc,
378   0x10 /* RegMem8/Reg8 */,     0x11 /* RegMem32/Reg32 */,
379   0x12 /* Reg8/RegMem8 */,     0x13 /* Reg32/RegMem32 */,
380   0x14 /* Rax8/imm8 opcode */, 0x15 /* Rax32/imm32 */)
381 DISASSEMBLER_ENTRY(sbb,
382   0x18 /* RegMem8/Reg8 */,     0x19 /* RegMem32/Reg32 */,
383   0x1A /* Reg8/RegMem8 */,     0x1B /* Reg32/RegMem32 */,
384   0x1C /* Rax8/imm8 opcode */, 0x1D /* Rax32/imm32 */)
385 DISASSEMBLER_ENTRY(and,
386   0x20 /* RegMem8/Reg8 */,     0x21 /* RegMem32/Reg32 */,
387   0x22 /* Reg8/RegMem8 */,     0x23 /* Reg32/RegMem32 */,
388   0x24 /* Rax8/imm8 opcode */, 0x25 /* Rax32/imm32 */)
389 DISASSEMBLER_ENTRY(sub,
390   0x28 /* RegMem8/Reg8 */,     0x29 /* RegMem32/Reg32 */,
391   0x2A /* Reg8/RegMem8 */,     0x2B /* Reg32/RegMem32 */,
392   0x2C /* Rax8/imm8 opcode */, 0x2D /* Rax32/imm32 */)
393 DISASSEMBLER_ENTRY(xor,
394   0x30 /* RegMem8/Reg8 */,     0x31 /* RegMem32/Reg32 */,
395   0x32 /* Reg8/RegMem8 */,     0x33 /* Reg32/RegMem32 */,
396   0x34 /* Rax8/imm8 opcode */, 0x35 /* Rax32/imm32 */)
397 DISASSEMBLER_ENTRY(cmp,
398   0x38 /* RegMem8/Reg8 */,     0x39 /* RegMem/Reg32 */,
399   0x3A /* Reg8/RegMem8 */,     0x3B /* Reg32/RegMem32 */,
400   0x3C /* Rax8/imm8 opcode */, 0x3D /* Rax32/imm32 */)
401 
402 #undef DISASSEMBLER_ENTRY
403 
404   case 0x50: case 0x51: case 0x52: case 0x53: case 0x54: case 0x55: case 0x56: case 0x57:
405     opcode1 = "push";
406     reg_in_opcode = true;
407     target_specific = true;
408     break;
409   case 0x58: case 0x59: case 0x5A: case 0x5B: case 0x5C: case 0x5D: case 0x5E: case 0x5F:
410     opcode1 = "pop";
411     reg_in_opcode = true;
412     target_specific = true;
413     break;
414   case 0x63:
415     if ((rex & REX_W) != 0) {
416       opcode1 = "movsxd";
417       has_modrm = true;
418       load = true;
419     } else {
420       // In 32-bit mode (!supports_rex_) this is ARPL, with no REX prefix the functionality is the
421       // same as 'mov' but the use of the instruction is discouraged.
422       opcode_tmp = StringPrintf("unknown opcode '%02X'", *instr);
423       opcode1 = opcode_tmp.c_str();
424     }
425     break;
426   case 0x68: opcode1 = "push"; immediate_bytes = 4; break;
427   case 0x69: opcode1 = "imul"; load = true; has_modrm = true; immediate_bytes = 4; break;
428   case 0x6A: opcode1 = "push"; immediate_bytes = 1; break;
429   case 0x6B: opcode1 = "imul"; load = true; has_modrm = true; immediate_bytes = 1; break;
430   case 0x70: case 0x71: case 0x72: case 0x73: case 0x74: case 0x75: case 0x76: case 0x77:
431   case 0x78: case 0x79: case 0x7A: case 0x7B: case 0x7C: case 0x7D: case 0x7E: case 0x7F:
432     static const char* condition_codes[] =
433     {"o", "no", "b/nae/c", "nb/ae/nc", "z/eq",  "nz/ne", "be/na", "nbe/a",
434      "s", "ns", "p/pe",    "np/po",    "l/nge", "nl/ge", "le/ng", "nle/g"
435     };
436     opcode1 = "j";
437     opcode2 = condition_codes[*instr & 0xF];
438     branch_bytes = 1;
439     break;
440   case 0x86: case 0x87:
441     opcode1 = "xchg";
442     store = true;
443     has_modrm = true;
444     byte_operand = (*instr == 0x86);
445     break;
446   case 0x88: opcode1 = "mov"; store = true; has_modrm = true; byte_operand = true; break;
447   case 0x89: opcode1 = "mov"; store = true; has_modrm = true; break;
448   case 0x8A: opcode1 = "mov"; load = true; has_modrm = true; byte_operand = true; break;
449   case 0x8B: opcode1 = "mov"; load = true; has_modrm = true; break;
450   case 0x9D: opcode1 = "popf"; break;
451 
452   case 0x0F:  // 2 byte extended opcode
453     instr++;
454     switch (*instr) {
455       case 0x10: case 0x11:
456         if (prefix[0] == 0xF2) {
457           opcode1 = "movsd";
458           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
459         } else if (prefix[0] == 0xF3) {
460           opcode1 = "movss";
461           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
462         } else if (prefix[2] == 0x66) {
463           opcode1 = "movupd";
464           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
465         } else {
466           opcode1 = "movups";
467         }
468         has_modrm = true;
469         src_reg_file = dst_reg_file = SSE;
470         load = *instr == 0x10;
471         store = !load;
472         break;
473       case 0x12: case 0x13:
474         if (prefix[2] == 0x66) {
475           opcode1 = "movlpd";
476           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
477         } else if (prefix[0] == 0) {
478           opcode1 = "movlps";
479         }
480         has_modrm = true;
481         src_reg_file = dst_reg_file = SSE;
482         load = *instr == 0x12;
483         store = !load;
484         break;
485       case 0x16: case 0x17:
486         if (prefix[2] == 0x66) {
487           opcode1 = "movhpd";
488           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
489         } else if (prefix[0] == 0) {
490           opcode1 = "movhps";
491         }
492         has_modrm = true;
493         src_reg_file = dst_reg_file = SSE;
494         load = *instr == 0x16;
495         store = !load;
496         break;
497       case 0x28: case 0x29:
498         if (prefix[2] == 0x66) {
499           opcode1 = "movapd";
500           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
501         } else if (prefix[0] == 0) {
502           opcode1 = "movaps";
503         }
504         has_modrm = true;
505         src_reg_file = dst_reg_file = SSE;
506         load = *instr == 0x28;
507         store = !load;
508         break;
509       case 0x2A:
510         if (prefix[2] == 0x66) {
511           opcode1 = "cvtpi2pd";
512           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
513         } else if (prefix[0] == 0xF2) {
514           opcode1 = "cvtsi2sd";
515           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
516         } else if (prefix[0] == 0xF3) {
517           opcode1 = "cvtsi2ss";
518           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
519         } else {
520           opcode1 = "cvtpi2ps";
521         }
522         load = true;
523         has_modrm = true;
524         dst_reg_file = SSE;
525         break;
526       case 0x2C:
527         if (prefix[2] == 0x66) {
528           opcode1 = "cvttpd2pi";
529           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
530         } else if (prefix[0] == 0xF2) {
531           opcode1 = "cvttsd2si";
532           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
533         } else if (prefix[0] == 0xF3) {
534           opcode1 = "cvttss2si";
535           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
536         } else {
537           opcode1 = "cvttps2pi";
538         }
539         load = true;
540         has_modrm = true;
541         src_reg_file = SSE;
542         break;
543       case 0x2D:
544         if (prefix[2] == 0x66) {
545           opcode1 = "cvtpd2pi";
546           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
547         } else if (prefix[0] == 0xF2) {
548           opcode1 = "cvtsd2si";
549           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
550         } else if (prefix[0] == 0xF3) {
551           opcode1 = "cvtss2si";
552           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
553         } else {
554           opcode1 = "cvtps2pi";
555         }
556         load = true;
557         has_modrm = true;
558         src_reg_file = SSE;
559         break;
560       case 0x2E:
561         opcode0 = "u";
562         FALLTHROUGH_INTENDED;
563       case 0x2F:
564         if (prefix[2] == 0x66) {
565           opcode1 = "comisd";
566           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
567         } else {
568           opcode1 = "comiss";
569         }
570         has_modrm = true;
571         load = true;
572         src_reg_file = dst_reg_file = SSE;
573         break;
574       case 0x38:  // 3 byte extended opcode
575         instr++;
576         if (prefix[2] == 0x66) {
577           switch (*instr) {
578             case 0x01:
579               opcode1 = "phaddw";
580               prefix[2] = 0;
581               has_modrm = true;
582               load = true;
583               src_reg_file = dst_reg_file = SSE;
584               break;
585             case 0x02:
586               opcode1 = "phaddd";
587               prefix[2] = 0;
588               has_modrm = true;
589               load = true;
590               src_reg_file = dst_reg_file = SSE;
591               break;
592             case 0x29:
593               opcode1 = "pcmpeqq";
594               prefix[2] = 0;
595               has_modrm = true;
596               load = true;
597               src_reg_file = dst_reg_file = SSE;
598               break;
599             case 0x37:
600               opcode1 = "pcmpgtq";
601               prefix[2] = 0;
602               has_modrm = true;
603               load = true;
604               src_reg_file = dst_reg_file = SSE;
605               break;
606             case 0x38:
607               opcode1 = "pminsb";
608               prefix[2] = 0;
609               has_modrm = true;
610               load = true;
611               src_reg_file = dst_reg_file = SSE;
612               break;
613             case 0x39:
614               opcode1 = "pminsd";
615               prefix[2] = 0;
616               has_modrm = true;
617               load = true;
618               src_reg_file = dst_reg_file = SSE;
619               break;
620             case 0x3A:
621               opcode1 = "pminuw";
622               prefix[2] = 0;
623               has_modrm = true;
624               load = true;
625               src_reg_file = dst_reg_file = SSE;
626               break;
627             case 0x3B:
628               opcode1 = "pminud";
629               prefix[2] = 0;
630               has_modrm = true;
631               load = true;
632               src_reg_file = dst_reg_file = SSE;
633               break;
634             case 0x3C:
635               opcode1 = "pmaxsb";
636               prefix[2] = 0;
637               has_modrm = true;
638               load = true;
639               src_reg_file = dst_reg_file = SSE;
640               break;
641             case 0x3D:
642               opcode1 = "pmaxsd";
643               prefix[2] = 0;
644               has_modrm = true;
645               load = true;
646               src_reg_file = dst_reg_file = SSE;
647               break;
648             case 0x3E:
649               opcode1 = "pmaxuw";
650               prefix[2] = 0;
651               has_modrm = true;
652               load = true;
653               src_reg_file = dst_reg_file = SSE;
654               break;
655             case 0x3F:
656               opcode1 = "pmaxud";
657               prefix[2] = 0;
658               has_modrm = true;
659               load = true;
660               src_reg_file = dst_reg_file = SSE;
661               break;
662             case 0x40:
663               opcode1 = "pmulld";
664               prefix[2] = 0;
665               has_modrm = true;
666               load = true;
667               src_reg_file = dst_reg_file = SSE;
668               break;
669             default:
670               opcode_tmp = StringPrintf("unknown opcode '0F 38 %02X'", *instr);
671               opcode1 = opcode_tmp.c_str();
672           }
673         } else {
674           opcode_tmp = StringPrintf("unknown opcode '0F 38 %02X'", *instr);
675           opcode1 = opcode_tmp.c_str();
676         }
677         break;
678       case 0x3A:  // 3 byte extended opcode
679         instr++;
680         if (prefix[2] == 0x66) {
681           switch (*instr) {
682             case 0x0A:
683               opcode1 = "roundss";
684               prefix[2] = 0;
685               has_modrm = true;
686               load = true;
687               src_reg_file = SSE;
688               dst_reg_file = SSE;
689               immediate_bytes = 1;
690               break;
691             case 0x0B:
692               opcode1 = "roundsd";
693               prefix[2] = 0;
694               has_modrm = true;
695               load = true;
696               src_reg_file = SSE;
697               dst_reg_file = SSE;
698               immediate_bytes = 1;
699               break;
700             case 0x14:
701               opcode1 = "pextrb";
702               prefix[2] = 0;
703               has_modrm = true;
704               store = true;
705               src_reg_file = SSE;
706               immediate_bytes = 1;
707               break;
708           case 0x15:
709               opcode1 = "pextrw";
710               prefix[2] = 0;
711               has_modrm = true;
712               store = true;
713               src_reg_file = SSE;
714               immediate_bytes = 1;
715               break;
716             case 0x16:
717               opcode1 = "pextrd";
718               prefix[2] = 0;
719               has_modrm = true;
720               store = true;
721               src_reg_file = SSE;
722               immediate_bytes = 1;
723               break;
724             default:
725               opcode_tmp = StringPrintf("unknown opcode '0F 3A %02X'", *instr);
726               opcode1 = opcode_tmp.c_str();
727           }
728         } else {
729           opcode_tmp = StringPrintf("unknown opcode '0F 3A %02X'", *instr);
730           opcode1 = opcode_tmp.c_str();
731         }
732         break;
733       case 0x40: case 0x41: case 0x42: case 0x43: case 0x44: case 0x45: case 0x46: case 0x47:
734       case 0x48: case 0x49: case 0x4A: case 0x4B: case 0x4C: case 0x4D: case 0x4E: case 0x4F:
735         opcode1 = "cmov";
736         opcode2 = condition_codes[*instr & 0xF];
737         has_modrm = true;
738         load = true;
739         break;
740       case 0x50: case 0x51: case 0x52: case 0x53: case 0x54: case 0x55: case 0x56: case 0x57:
741       case 0x58: case 0x59: case 0x5C: case 0x5D: case 0x5E: case 0x5F: {
742         switch (*instr) {
743           case 0x50: opcode1 = "movmsk"; break;
744           case 0x51: opcode1 = "sqrt"; break;
745           case 0x52: opcode1 = "rsqrt"; break;
746           case 0x53: opcode1 = "rcp"; break;
747           case 0x54: opcode1 = "and"; break;
748           case 0x55: opcode1 = "andn"; break;
749           case 0x56: opcode1 = "or"; break;
750           case 0x57: opcode1 = "xor"; break;
751           case 0x58: opcode1 = "add"; break;
752           case 0x59: opcode1 = "mul"; break;
753           case 0x5C: opcode1 = "sub"; break;
754           case 0x5D: opcode1 = "min"; break;
755           case 0x5E: opcode1 = "div"; break;
756           case 0x5F: opcode1 = "max"; break;
757           default: LOG(FATAL) << "Unreachable"; UNREACHABLE();
758         }
759         if (prefix[2] == 0x66) {
760           opcode2 = "pd";
761           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
762         } else if (prefix[0] == 0xF2) {
763           opcode2 = "sd";
764           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
765         } else if (prefix[0] == 0xF3) {
766           opcode2 = "ss";
767           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
768         } else {
769           opcode2 = "ps";
770         }
771         load = true;
772         has_modrm = true;
773         src_reg_file = dst_reg_file = SSE;
774         break;
775       }
776       case 0x5A:
777         if (prefix[2] == 0x66) {
778           opcode1 = "cvtpd2ps";
779           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
780         } else if (prefix[0] == 0xF2) {
781           opcode1 = "cvtsd2ss";
782           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
783         } else if (prefix[0] == 0xF3) {
784           opcode1 = "cvtss2sd";
785           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
786         } else {
787           opcode1 = "cvtps2pd";
788         }
789         load = true;
790         has_modrm = true;
791         src_reg_file = dst_reg_file = SSE;
792         break;
793       case 0x5B:
794         if (prefix[2] == 0x66) {
795           opcode1 = "cvtps2dq";
796           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
797         } else if (prefix[0] == 0xF2) {
798           opcode1 = "bad opcode F2 0F 5B";
799         } else if (prefix[0] == 0xF3) {
800           opcode1 = "cvttps2dq";
801           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
802         } else {
803           opcode1 = "cvtdq2ps";
804         }
805         load = true;
806         has_modrm = true;
807         src_reg_file = dst_reg_file = SSE;
808         break;
809       case 0x60: case 0x61: case 0x62: case 0x6C:
810       case 0x68: case 0x69: case 0x6A: case 0x6D:
811         if (prefix[2] == 0x66) {
812           src_reg_file = dst_reg_file = SSE;
813           prefix[2] = 0;  // Clear prefix now. It has served its purpose as part of the opcode.
814         } else {
815           src_reg_file = dst_reg_file = MMX;
816         }
817         switch (*instr) {
818           case 0x60: opcode1 = "punpcklbw"; break;
819           case 0x61: opcode1 = "punpcklwd"; break;
820           case 0x62: opcode1 = "punpckldq"; break;
821           case 0x6c: opcode1 = "punpcklqdq"; break;
822           case 0x68: opcode1 = "punpckhbw"; break;
823           case 0x69: opcode1 = "punpckhwd"; break;
824           case 0x6A: opcode1 = "punpckhdq"; break;
825           case 0x6D: opcode1 = "punpckhqdq"; break;
826         }
827         load = true;
828         has_modrm = true;
829         break;
830       case 0x64:
831       case 0x65:
832       case 0x66:
833         if (prefix[2] == 0x66) {
834           src_reg_file = dst_reg_file = SSE;
835           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
836         } else {
837           src_reg_file = dst_reg_file = MMX;
838         }
839         switch (*instr) {
840           case 0x64: opcode1 = "pcmpgtb"; break;
841           case 0x65: opcode1 = "pcmpgtw"; break;
842           case 0x66: opcode1 = "pcmpgtd"; break;
843         }
844         prefix[2] = 0;
845         has_modrm = true;
846         load = true;
847         break;
848       case 0x6E:
849         if (prefix[2] == 0x66) {
850           dst_reg_file = SSE;
851           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
852         } else {
853           dst_reg_file = MMX;
854         }
855         opcode1 = "movd";
856         load = true;
857         has_modrm = true;
858         break;
859       case 0x6F:
860         if (prefix[2] == 0x66) {
861           src_reg_file = dst_reg_file = SSE;
862           opcode1 = "movdqa";
863           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
864         } else if (prefix[0] == 0xF3) {
865           src_reg_file = dst_reg_file = SSE;
866           opcode1 = "movdqu";
867           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
868         } else {
869           dst_reg_file = MMX;
870           opcode1 = "movq";
871         }
872         load = true;
873         has_modrm = true;
874         break;
875       case 0x70:
876         if (prefix[2] == 0x66) {
877           opcode1 = "pshufd";
878           prefix[2] = 0;
879           has_modrm = true;
880           store = true;
881           src_reg_file = dst_reg_file = SSE;
882           immediate_bytes = 1;
883         } else if (prefix[0] == 0xF2) {
884           opcode1 = "pshuflw";
885           prefix[0] = 0;
886           has_modrm = true;
887           store = true;
888           src_reg_file = dst_reg_file = SSE;
889           immediate_bytes = 1;
890         } else {
891           opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
892           opcode1 = opcode_tmp.c_str();
893         }
894         break;
895       case 0x71:
896         if (prefix[2] == 0x66) {
897           dst_reg_file = SSE;
898           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
899         } else {
900           dst_reg_file = MMX;
901         }
902         static const char* x71_opcodes[] = {
903             "unknown-71", "unknown-71", "psrlw", "unknown-71",
904             "psraw",      "unknown-71", "psllw", "unknown-71"};
905         modrm_opcodes = x71_opcodes;
906         reg_is_opcode = true;
907         has_modrm = true;
908         store = true;
909         immediate_bytes = 1;
910         break;
911       case 0x72:
912         if (prefix[2] == 0x66) {
913           dst_reg_file = SSE;
914           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
915         } else {
916           dst_reg_file = MMX;
917         }
918         static const char* x72_opcodes[] = {
919             "unknown-72", "unknown-72", "psrld", "unknown-72",
920             "psrad",      "unknown-72", "pslld", "unknown-72"};
921         modrm_opcodes = x72_opcodes;
922         reg_is_opcode = true;
923         has_modrm = true;
924         store = true;
925         immediate_bytes = 1;
926         break;
927       case 0x73:
928         if (prefix[2] == 0x66) {
929           dst_reg_file = SSE;
930           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
931         } else {
932           dst_reg_file = MMX;
933         }
934         static const char* x73_opcodes[] = {
935             "unknown-73", "unknown-73", "psrlq", "psrldq",
936             "unknown-73", "unknown-73", "psllq", "unknown-73"};
937         modrm_opcodes = x73_opcodes;
938         reg_is_opcode = true;
939         has_modrm = true;
940         store = true;
941         immediate_bytes = 1;
942         break;
943       case 0x74:
944       case 0x75:
945       case 0x76:
946         if (prefix[2] == 0x66) {
947           src_reg_file = dst_reg_file = SSE;
948           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
949         } else {
950           src_reg_file = dst_reg_file = MMX;
951         }
952         switch (*instr) {
953           case 0x74: opcode1 = "pcmpeqb"; break;
954           case 0x75: opcode1 = "pcmpeqw"; break;
955           case 0x76: opcode1 = "pcmpeqd"; break;
956         }
957         prefix[2] = 0;
958         has_modrm = true;
959         load = true;
960         break;
961       case 0x7C:
962         if (prefix[0] == 0xF2) {
963           opcode1 = "haddps";
964           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
965         } else if (prefix[2] == 0x66) {
966           opcode1 = "haddpd";
967           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
968         } else {
969           opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
970           opcode1 = opcode_tmp.c_str();
971           break;
972         }
973         src_reg_file = dst_reg_file = SSE;
974         has_modrm = true;
975         load = true;
976         break;
977       case 0x7E:
978         if (prefix[2] == 0x66) {
979           src_reg_file = SSE;
980           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
981         } else {
982           src_reg_file = MMX;
983         }
984         opcode1 = "movd";
985         has_modrm = true;
986         store = true;
987         break;
988       case 0x7F:
989         if (prefix[2] == 0x66) {
990           src_reg_file = dst_reg_file = SSE;
991           opcode1 = "movdqa";
992           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
993         } else if (prefix[0] == 0xF3) {
994           src_reg_file = dst_reg_file = SSE;
995           opcode1 = "movdqu";
996           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
997         } else {
998           dst_reg_file = MMX;
999           opcode1 = "movq";
1000         }
1001         store = true;
1002         has_modrm = true;
1003         break;
1004       case 0x80: case 0x81: case 0x82: case 0x83: case 0x84: case 0x85: case 0x86: case 0x87:
1005       case 0x88: case 0x89: case 0x8A: case 0x8B: case 0x8C: case 0x8D: case 0x8E: case 0x8F:
1006         opcode1 = "j";
1007         opcode2 = condition_codes[*instr & 0xF];
1008         branch_bytes = 4;
1009         break;
1010       case 0x90: case 0x91: case 0x92: case 0x93: case 0x94: case 0x95: case 0x96: case 0x97:
1011       case 0x98: case 0x99: case 0x9A: case 0x9B: case 0x9C: case 0x9D: case 0x9E: case 0x9F:
1012         opcode1 = "set";
1013         opcode2 = condition_codes[*instr & 0xF];
1014         modrm_opcodes = nullptr;
1015         reg_is_opcode = true;
1016         has_modrm = true;
1017         store = true;
1018         break;
1019       case 0xA4:
1020         opcode1 = "shld";
1021         has_modrm = true;
1022         load = true;
1023         immediate_bytes = 1;
1024         break;
1025       case 0xA5:
1026         opcode1 = "shld";
1027         has_modrm = true;
1028         load = true;
1029         cx = true;
1030         break;
1031       case 0xAC:
1032         opcode1 = "shrd";
1033         has_modrm = true;
1034         load = true;
1035         immediate_bytes = 1;
1036         break;
1037       case 0xAD:
1038         opcode1 = "shrd";
1039         has_modrm = true;
1040         load = true;
1041         cx = true;
1042         break;
1043       case 0xAE:
1044         if (prefix[0] == 0xF3) {
1045           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
1046           static const char* xAE_opcodes[] = {
1047               "rdfsbase",   "rdgsbase",   "wrfsbase",   "wrgsbase",
1048               "unknown-AE", "unknown-AE", "unknown-AE", "unknown-AE"};
1049           modrm_opcodes = xAE_opcodes;
1050           reg_is_opcode = true;
1051           has_modrm = true;
1052           uint8_t reg_or_opcode = (instr[1] >> 3) & 7;
1053           switch (reg_or_opcode) {
1054             case 0:
1055               prefix[1] = kFs;
1056               load = true;
1057               break;
1058             case 1:
1059               prefix[1] = kGs;
1060               load = true;
1061               break;
1062             case 2:
1063               prefix[1] = kFs;
1064               store = true;
1065               break;
1066             case 3:
1067               prefix[1] = kGs;
1068               store = true;
1069               break;
1070             default:
1071               load = true;
1072               break;
1073           }
1074         } else {
1075           static const char* xAE_opcodes[] = {
1076               "unknown-AE", "unknown-AE", "unknown-AE", "unknown-AE",
1077               "unknown-AE", "lfence",     "mfence",     "sfence"};
1078           modrm_opcodes = xAE_opcodes;
1079           reg_is_opcode = true;
1080           has_modrm = true;
1081           load = true;
1082           no_ops = true;
1083         }
1084         break;
1085       case 0xAF:
1086         opcode1 = "imul";
1087         has_modrm = true;
1088         load = true;
1089         break;
1090       case 0xB1:
1091         opcode1 = "cmpxchg";
1092         has_modrm = true;
1093         store = true;
1094         break;
1095       case 0xB6:
1096         opcode1 = "movzxb";
1097         has_modrm = true;
1098         load = true;
1099         byte_second_operand = true;
1100         break;
1101       case 0xB7:
1102         opcode1 = "movzxw";
1103         has_modrm = true;
1104         load = true;
1105         break;
1106       case 0xBC:
1107         opcode1 = "bsf";
1108         has_modrm = true;
1109         load = true;
1110         break;
1111       case 0xBD:
1112         opcode1 = "bsr";
1113         has_modrm = true;
1114         load = true;
1115         break;
1116       case 0xB8:
1117         opcode1 = "popcnt";
1118         has_modrm = true;
1119         load = true;
1120         break;
1121       case 0xBE:
1122         opcode1 = "movsxb";
1123         has_modrm = true;
1124         load = true;
1125         byte_second_operand = true;
1126         rex |= (rex == 0 ? 0 : REX_W);
1127         break;
1128       case 0xBF:
1129         opcode1 = "movsxw";
1130         has_modrm = true;
1131         load = true;
1132         break;
1133       case 0xC3:
1134         opcode1 = "movnti";
1135         store = true;
1136         has_modrm = true;
1137         break;
1138       case 0xC5:
1139         if (prefix[2] == 0x66) {
1140           opcode1 = "pextrw";
1141           prefix[2] = 0;
1142           has_modrm = true;
1143           load = true;
1144           src_reg_file = SSE;
1145           immediate_bytes = 1;
1146         } else {
1147           opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
1148           opcode1 = opcode_tmp.c_str();
1149         }
1150         break;
1151       case 0xC6:
1152         if (prefix[2] == 0x66) {
1153           opcode1 = "shufpd";
1154           prefix[2] = 0;
1155         } else {
1156           opcode1 = "shufps";
1157         }
1158         has_modrm = true;
1159         store = true;
1160         src_reg_file = dst_reg_file = SSE;
1161         immediate_bytes = 1;
1162         break;
1163       case 0xC7:
1164         static const char* x0FxC7_opcodes[] = {
1165             "unknown-0f-c7", "cmpxchg8b",     "unknown-0f-c7", "unknown-0f-c7",
1166             "unknown-0f-c7", "unknown-0f-c7", "unknown-0f-c7", "unknown-0f-c7"};
1167         modrm_opcodes = x0FxC7_opcodes;
1168         has_modrm = true;
1169         reg_is_opcode = true;
1170         store = true;
1171         break;
1172       case 0xC8: case 0xC9: case 0xCA: case 0xCB: case 0xCC: case 0xCD: case 0xCE: case 0xCF:
1173         opcode1 = "bswap";
1174         reg_in_opcode = true;
1175         break;
1176       case 0xD4:
1177         if (prefix[2] == 0x66) {
1178           src_reg_file = dst_reg_file = SSE;
1179           prefix[2] = 0;
1180         } else {
1181           src_reg_file = dst_reg_file = MMX;
1182         }
1183         opcode1 = "paddq";
1184         prefix[2] = 0;
1185         has_modrm = true;
1186         load = true;
1187         break;
1188       case 0xDB:
1189         if (prefix[2] == 0x66) {
1190           src_reg_file = dst_reg_file = SSE;
1191           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1192         } else {
1193           src_reg_file = dst_reg_file = MMX;
1194         }
1195         opcode1 = "pand";
1196         prefix[2] = 0;
1197         has_modrm = true;
1198         load = true;
1199         break;
1200       case 0xD5:
1201         if (prefix[2] == 0x66) {
1202           opcode1 = "pmullw";
1203           prefix[2] = 0;
1204           has_modrm = true;
1205           load = true;
1206           src_reg_file = dst_reg_file = SSE;
1207         } else {
1208           opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
1209           opcode1 = opcode_tmp.c_str();
1210         }
1211         break;
1212       case 0xD8:
1213       case 0xD9:
1214       case 0xDA:
1215       case 0xDC:
1216       case 0xDD:
1217       case 0xDE:
1218       case 0xE0:
1219       case 0xE3:
1220       case 0xE8:
1221       case 0xE9:
1222       case 0xEA:
1223       case 0xEC:
1224       case 0xED:
1225       case 0xEE:
1226         if (prefix[2] == 0x66) {
1227           src_reg_file = dst_reg_file = SSE;
1228           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1229         } else {
1230           src_reg_file = dst_reg_file = MMX;
1231         }
1232         switch (*instr) {
1233           case 0xD8: opcode1 = "psubusb"; break;
1234           case 0xD9: opcode1 = "psubusw"; break;
1235           case 0xDA: opcode1 = "pminub"; break;
1236           case 0xDC: opcode1 = "paddusb"; break;
1237           case 0xDD: opcode1 = "paddusw"; break;
1238           case 0xDE: opcode1 = "pmaxub"; break;
1239           case 0xE0: opcode1 = "pavgb"; break;
1240           case 0xE3: opcode1 = "pavgw"; break;
1241           case 0xE8: opcode1 = "psubsb"; break;
1242           case 0xE9: opcode1 = "psubsw"; break;
1243           case 0xEA: opcode1 = "pminsw"; break;
1244           case 0xEC: opcode1 = "paddsb"; break;
1245           case 0xED: opcode1 = "paddsw"; break;
1246           case 0xEE: opcode1 = "pmaxsw"; break;
1247         }
1248         prefix[2] = 0;
1249         has_modrm = true;
1250         load = true;
1251         break;
1252       case 0xEB:
1253         if (prefix[2] == 0x66) {
1254           src_reg_file = dst_reg_file = SSE;
1255           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1256         } else {
1257           src_reg_file = dst_reg_file = MMX;
1258         }
1259         opcode1 = "por";
1260         prefix[2] = 0;
1261         has_modrm = true;
1262         load = true;
1263         break;
1264       case 0xEF:
1265         if (prefix[2] == 0x66) {
1266           src_reg_file = dst_reg_file = SSE;
1267           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1268         } else {
1269           src_reg_file = dst_reg_file = MMX;
1270         }
1271         opcode1 = "pxor";
1272         prefix[2] = 0;
1273         has_modrm = true;
1274         load = true;
1275         break;
1276       case 0xF4:
1277       case 0xF6:
1278       case 0xF8:
1279       case 0xF9:
1280       case 0xFA:
1281       case 0xFB:
1282       case 0xFC:
1283       case 0xFD:
1284       case 0xFE:
1285         if (prefix[2] == 0x66) {
1286           src_reg_file = dst_reg_file = SSE;
1287           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1288         } else {
1289           src_reg_file = dst_reg_file = MMX;
1290         }
1291         switch (*instr) {
1292           case 0xF4: opcode1 = "pmuludq"; break;
1293           case 0xF6: opcode1 = "psadbw"; break;
1294           case 0xF8: opcode1 = "psubb"; break;
1295           case 0xF9: opcode1 = "psubw"; break;
1296           case 0xFA: opcode1 = "psubd"; break;
1297           case 0xFB: opcode1 = "psubq"; break;
1298           case 0xFC: opcode1 = "paddb"; break;
1299           case 0xFD: opcode1 = "paddw"; break;
1300           case 0xFE: opcode1 = "paddd"; break;
1301         }
1302         prefix[2] = 0;
1303         has_modrm = true;
1304         load = true;
1305         break;
1306       default:
1307         opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
1308         opcode1 = opcode_tmp.c_str();
1309         break;
1310     }
1311     break;
1312   case 0x80: case 0x81: case 0x82: case 0x83:
1313     static const char* x80_opcodes[] = {"add", "or", "adc", "sbb", "and", "sub", "xor", "cmp"};
1314     modrm_opcodes = x80_opcodes;
1315     has_modrm = true;
1316     reg_is_opcode = true;
1317     store = true;
1318     byte_operand = (*instr & 1) == 0;
1319     immediate_bytes = *instr == 0x81 ? 4 : 1;
1320     break;
1321   case 0x84: case 0x85:
1322     opcode1 = "test";
1323     has_modrm = true;
1324     load = true;
1325     byte_operand = (*instr & 1) == 0;
1326     break;
1327   case 0x8D:
1328     opcode1 = "lea";
1329     has_modrm = true;
1330     load = true;
1331     break;
1332   case 0x8F:
1333     opcode1 = "pop";
1334     has_modrm = true;
1335     reg_is_opcode = true;
1336     store = true;
1337     break;
1338   case 0x99:
1339     opcode1 = "cdq";
1340     break;
1341   case 0x9B:
1342     if (instr[1] == 0xDF && instr[2] == 0xE0) {
1343       opcode1 = "fstsw\tax";
1344       instr += 2;
1345     } else {
1346       opcode_tmp = StringPrintf("unknown opcode '%02X'", *instr);
1347       opcode1 = opcode_tmp.c_str();
1348     }
1349     break;
1350   case 0xA5:
1351     opcode1 = (prefix[2] == 0x66 ? "movsw" : "movsl");
1352     break;
1353   case 0xA7:
1354     opcode1 = (prefix[2] == 0x66 ? "cmpsw" : "cmpsl");
1355     break;
1356   case 0xAF:
1357     opcode1 = (prefix[2] == 0x66 ? "scasw" : "scasl");
1358     break;
1359   case 0xB0: case 0xB1: case 0xB2: case 0xB3: case 0xB4: case 0xB5: case 0xB6: case 0xB7:
1360     opcode1 = "mov";
1361     immediate_bytes = 1;
1362     byte_operand = true;
1363     reg_in_opcode = true;
1364     byte_operand = true;
1365     break;
1366   case 0xB8: case 0xB9: case 0xBA: case 0xBB: case 0xBC: case 0xBD: case 0xBE: case 0xBF:
1367     if ((rex & REX_W) != 0) {
1368       opcode1 = "movabsq";
1369       immediate_bytes = 8;
1370       reg_in_opcode = true;
1371       break;
1372     }
1373     opcode1 = "mov";
1374     immediate_bytes = 4;
1375     reg_in_opcode = true;
1376     break;
1377   case 0xC0: case 0xC1:
1378   case 0xD0: case 0xD1: case 0xD2: case 0xD3:
1379     static const char* shift_opcodes[] =
1380         {"rol", "ror", "rcl", "rcr", "shl", "shr", "unknown-shift", "sar"};
1381     modrm_opcodes = shift_opcodes;
1382     has_modrm = true;
1383     reg_is_opcode = true;
1384     store = true;
1385     immediate_bytes = ((*instr & 0xf0) == 0xc0) ? 1 : 0;
1386     cx = (*instr == 0xD2) || (*instr == 0xD3);
1387     byte_operand = (*instr == 0xC0);
1388     break;
1389   case 0xC3: opcode1 = "ret"; break;
1390 
1391   case 0xC6:
1392     static const char* c6_opcodes[] = {"mov",        "unknown-c6", "unknown-c6",
1393                                        "unknown-c6", "unknown-c6", "unknown-c6",
1394                                        "unknown-c6", "unknown-c6"};
1395     modrm_opcodes = c6_opcodes;
1396     store = true;
1397     immediate_bytes = 1;
1398     has_modrm = true;
1399     reg_is_opcode = true;
1400     byte_operand = true;
1401     break;
1402   case 0xC7:
1403     static const char* c7_opcodes[] = {"mov",        "unknown-c7", "unknown-c7",
1404                                        "unknown-c7", "unknown-c7", "unknown-c7",
1405                                        "unknown-c7", "unknown-c7"};
1406     modrm_opcodes = c7_opcodes;
1407     store = true;
1408     immediate_bytes = 4;
1409     has_modrm = true;
1410     reg_is_opcode = true;
1411     break;
1412   case 0xCC: opcode1 = "int 3"; break;
1413   case 0xD9:
1414     if (instr[1] == 0xF8) {
1415       opcode1 = "fprem";
1416       instr++;
1417     } else {
1418       static const char* d9_opcodes[] = {"flds", "unknown-d9", "fsts", "fstps", "fldenv", "fldcw",
1419                                          "fnstenv", "fnstcw"};
1420       modrm_opcodes = d9_opcodes;
1421       store = true;
1422       has_modrm = true;
1423       reg_is_opcode = true;
1424     }
1425     break;
1426   case 0xDA:
1427     if (instr[1] == 0xE9) {
1428       opcode1 = "fucompp";
1429       instr++;
1430     } else {
1431       opcode_tmp = StringPrintf("unknown opcode '%02X'", *instr);
1432       opcode1 = opcode_tmp.c_str();
1433     }
1434     break;
1435   case 0xDB:
1436     static const char* db_opcodes[] = {"fildl",      "unknown-db", "unknown-db",
1437                                        "unknown-db", "unknown-db", "unknown-db",
1438                                        "unknown-db", "unknown-db"};
1439     modrm_opcodes = db_opcodes;
1440     load = true;
1441     has_modrm = true;
1442     reg_is_opcode = true;
1443     break;
1444   case 0xDD:
1445     static const char* dd_opcodes[] = {"fldl",   "fisttp", "fstl",
1446                                        "fstpl",  "frstor", "unknown-dd",
1447                                        "fnsave", "fnstsw"};
1448     modrm_opcodes = dd_opcodes;
1449     store = true;
1450     has_modrm = true;
1451     reg_is_opcode = true;
1452     break;
1453   case 0xDF:
1454     static const char* df_opcodes[] = {"fild",       "unknown-df", "unknown-df",
1455                                        "unknown-df", "unknown-df", "fildll",
1456                                        "unknown-df", "unknown-df"};
1457     modrm_opcodes = df_opcodes;
1458     load = true;
1459     has_modrm = true;
1460     reg_is_opcode = true;
1461     break;
1462   case 0xE3: opcode1 = "jecxz"; branch_bytes = 1; break;
1463   case 0xE8: opcode1 = "call"; branch_bytes = 4; break;
1464   case 0xE9: opcode1 = "jmp"; branch_bytes = 4; break;
1465   case 0xEB: opcode1 = "jmp"; branch_bytes = 1; break;
1466   case 0xF5: opcode1 = "cmc"; break;
1467   case 0xF6: case 0xF7:
1468     static const char* f7_opcodes[] = {
1469         "test", "unknown-f7", "not", "neg", "mul edx:eax, eax *",
1470         "imul edx:eax, eax *", "div edx:eax, edx:eax /",
1471         "idiv edx:eax, edx:eax /"};
1472     modrm_opcodes = f7_opcodes;
1473     has_modrm = true;
1474     reg_is_opcode = true;
1475     store = true;
1476     immediate_bytes = ((instr[1] & 0x38) == 0) ? (instr[0] == 0xF7 ? 4 : 1) : 0;
1477     break;
1478   case 0xFF:
1479     {
1480       static const char* ff_opcodes[] = {
1481           "inc", "dec", "call", "call",
1482           "jmp", "jmp", "push", "unknown-ff"};
1483       modrm_opcodes = ff_opcodes;
1484       has_modrm = true;
1485       reg_is_opcode = true;
1486       load = true;
1487       const uint8_t opcode_digit = (instr[1] >> 3) & 7;
1488       // 'call', 'jmp' and 'push' are target specific instructions
1489       if (opcode_digit == 2 || opcode_digit == 4 || opcode_digit == 6) {
1490         target_specific = true;
1491       }
1492     }
1493     break;
1494   default:
1495     opcode_tmp = StringPrintf("unknown opcode '%02X'", *instr);
1496     opcode1 = opcode_tmp.c_str();
1497     break;
1498   }
1499   std::ostringstream args;
1500   // We force the REX prefix to be available for 64-bit target
1501   // in order to dump addr (base/index) registers correctly.
1502   uint8_t rex64 = supports_rex_ ? (rex | 0x40) : rex;
1503   // REX.W should be forced for 64-target and target-specific instructions (i.e., push or pop).
1504   uint8_t rex_w = (supports_rex_ && target_specific) ? (rex | 0x48) : rex;
1505   if (reg_in_opcode) {
1506     DCHECK(!has_modrm);
1507     DumpOpcodeReg(args, rex_w, *instr & 0x7, byte_operand, prefix[2]);
1508   }
1509   instr++;
1510   uint32_t address_bits = 0;
1511   if (has_modrm) {
1512     uint8_t modrm = *instr;
1513     instr++;
1514     uint8_t mod = modrm >> 6;
1515     uint8_t reg_or_opcode = (modrm >> 3) & 7;
1516     uint8_t rm = modrm & 7;
1517     std::string address = DumpAddress(mod, rm, rex64, rex_w, no_ops, byte_operand,
1518                                       byte_second_operand, prefix, load, src_reg_file, dst_reg_file,
1519                                       &instr, &address_bits);
1520 
1521     if (reg_is_opcode && modrm_opcodes != nullptr) {
1522       opcode3 = modrm_opcodes[reg_or_opcode];
1523     }
1524 
1525     // Add opcode suffixes to indicate size.
1526     if (byte_operand) {
1527       opcode4 = "b";
1528     } else if ((rex & REX_W) != 0) {
1529       opcode4 = "q";
1530     } else if (prefix[2] == 0x66) {
1531       opcode4 = "w";
1532     }
1533 
1534     if (load) {
1535       if (!reg_is_opcode) {
1536         DumpReg(args, rex, reg_or_opcode, byte_operand, prefix[2], dst_reg_file);
1537         args << ", ";
1538       }
1539       DumpSegmentOverride(args, prefix[1]);
1540 
1541       args << address;
1542     } else {
1543       DCHECK(store);
1544       DumpSegmentOverride(args, prefix[1]);
1545       args << address;
1546       if (!reg_is_opcode) {
1547         args << ", ";
1548         DumpReg(args, rex, reg_or_opcode, byte_operand, prefix[2], src_reg_file);
1549       }
1550     }
1551   }
1552   if (ax) {
1553     // If this opcode implicitly uses ax, ax is always the first arg.
1554     DumpReg(args, rex, 0 /* EAX */, byte_operand, prefix[2], GPR);
1555   }
1556   if (cx) {
1557     args << ", ";
1558     DumpReg(args, rex, 1 /* ECX */, true, prefix[2], GPR);
1559   }
1560   if (immediate_bytes > 0) {
1561     if (has_modrm || reg_in_opcode || ax || cx) {
1562       args << ", ";
1563     }
1564     if (immediate_bytes == 1) {
1565       args << StringPrintf("%d", *reinterpret_cast<const int8_t*>(instr));
1566       instr++;
1567     } else if (immediate_bytes == 4) {
1568       if (prefix[2] == 0x66) {  // Operand size override from 32-bit to 16-bit.
1569         args << StringPrintf("%d", *reinterpret_cast<const int16_t*>(instr));
1570         instr += 2;
1571       } else {
1572         args << StringPrintf("%d", *reinterpret_cast<const int32_t*>(instr));
1573         instr += 4;
1574       }
1575     } else {
1576       CHECK_EQ(immediate_bytes, 8u);
1577       args << StringPrintf("%" PRId64, *reinterpret_cast<const int64_t*>(instr));
1578       instr += 8;
1579     }
1580   } else if (branch_bytes > 0) {
1581     DCHECK(!has_modrm);
1582     int32_t displacement;
1583     if (branch_bytes == 1) {
1584       displacement = *reinterpret_cast<const int8_t*>(instr);
1585       instr++;
1586     } else {
1587       CHECK_EQ(branch_bytes, 4u);
1588       displacement = *reinterpret_cast<const int32_t*>(instr);
1589       instr += 4;
1590     }
1591     args << StringPrintf("%+d (", displacement)
1592          << FormatInstructionPointer(instr + displacement)
1593          << ")";
1594   }
1595   if (prefix[1] == kFs && !supports_rex_) {
1596     args << "  ; ";
1597     GetDisassemblerOptions()->thread_offset_name_function_(args, address_bits);
1598   }
1599   if (prefix[1] == kGs && supports_rex_) {
1600     args << "  ; ";
1601     GetDisassemblerOptions()->thread_offset_name_function_(args, address_bits);
1602   }
1603   const char* prefix_str;
1604   switch (prefix[0]) {
1605     case 0xF0: prefix_str = "lock "; break;
1606     case 0xF2: prefix_str = "repne "; break;
1607     case 0xF3: prefix_str = "repe "; break;
1608     case 0: prefix_str = ""; break;
1609     default: LOG(FATAL) << "Unreachable"; UNREACHABLE();
1610   }
1611   os << FormatInstructionPointer(begin_instr)
1612      << StringPrintf(": %22s    \t%-7s%s%s%s%s%s ", DumpCodeHex(begin_instr, instr).c_str(),
1613                      prefix_str, opcode0, opcode1, opcode2, opcode3, opcode4)
1614      << args.str() << '\n';
1615     return instr - begin_instr;
1616 }  // NOLINT(readability/fn_size)
1617 
1618 }  // namespace x86
1619 }  // namespace art
1620