1 /*
2  * Copyright (C) 2012 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "disassembler_x86.h"
18 
19 #include <inttypes.h>
20 
21 #include <ostream>
22 #include <sstream>
23 
24 #include "android-base/logging.h"
25 #include "android-base/stringprintf.h"
26 
27 using android::base::StringPrintf;
28 
29 namespace art {
30 namespace x86 {
31 
Dump(std::ostream & os,const uint8_t * begin)32 size_t DisassemblerX86::Dump(std::ostream& os, const uint8_t* begin) {
33   return DumpInstruction(os, begin);
34 }
35 
Dump(std::ostream & os,const uint8_t * begin,const uint8_t * end)36 void DisassemblerX86::Dump(std::ostream& os, const uint8_t* begin, const uint8_t* end) {
37   size_t length = 0;
38   for (const uint8_t* cur = begin; cur < end; cur += length) {
39     length = DumpInstruction(os, cur);
40   }
41 }
42 
43 static const char* gReg8Names[]  = {
44   "al", "cl", "dl", "bl", "ah", "ch", "dh", "bh"
45 };
46 static const char* gExtReg8Names[] = {
47   "al", "cl", "dl", "bl", "spl", "bpl", "sil", "dil",
48   "r8l", "r9l", "r10l", "r11l", "r12l", "r13l", "r14l", "r15l"
49 };
50 static const char* gReg16Names[] = {
51   "ax", "cx", "dx", "bx", "sp", "bp", "si", "di",
52   "r8w", "r9w", "r10w", "r11w", "r12w", "r13w", "r14w", "r15w"
53 };
54 static const char* gReg32Names[] = {
55   "eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi",
56   "r8d", "r9d", "r10d", "r11d", "r12d", "r13d", "r14d", "r15d"
57 };
58 static const char* gReg64Names[] = {
59   "rax", "rcx", "rdx", "rbx", "rsp", "rbp", "rsi", "rdi",
60   "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
61 };
62 
63 // 64-bit opcode REX modifier.
64 constexpr uint8_t REX_W = 8U /* 0b1000 */;
65 constexpr uint8_t REX_R = 4U /* 0b0100 */;
66 constexpr uint8_t REX_X = 2U /* 0b0010 */;
67 constexpr uint8_t REX_B = 1U /* 0b0001 */;
68 
DumpReg0(std::ostream & os,uint8_t rex,size_t reg,bool byte_operand,uint8_t size_override)69 static void DumpReg0(std::ostream& os, uint8_t rex, size_t reg,
70                      bool byte_operand, uint8_t size_override) {
71   DCHECK_LT(reg, (rex == 0) ? 8u : 16u);
72   bool rex_w = (rex & REX_W) != 0;
73   if (byte_operand) {
74     os << ((rex == 0) ? gReg8Names[reg] : gExtReg8Names[reg]);
75   } else if (rex_w) {
76     os << gReg64Names[reg];
77   } else if (size_override == 0x66) {
78     os << gReg16Names[reg];
79   } else {
80     os << gReg32Names[reg];
81   }
82 }
83 
DumpAnyReg(std::ostream & os,uint8_t rex,size_t reg,bool byte_operand,uint8_t size_override,RegFile reg_file)84 static void DumpAnyReg(std::ostream& os, uint8_t rex, size_t reg,
85                        bool byte_operand, uint8_t size_override, RegFile reg_file) {
86   if (reg_file == GPR) {
87     DumpReg0(os, rex, reg, byte_operand, size_override);
88   } else if (reg_file == SSE) {
89     os << "xmm" << reg;
90   } else {
91     os << "mm" << reg;
92   }
93 }
94 
DumpReg(std::ostream & os,uint8_t rex,uint8_t reg,bool byte_operand,uint8_t size_override,RegFile reg_file)95 static void DumpReg(std::ostream& os, uint8_t rex, uint8_t reg,
96                     bool byte_operand, uint8_t size_override, RegFile reg_file) {
97   bool rex_r = (rex & REX_R) != 0;
98   size_t reg_num = rex_r ? (reg + 8) : reg;
99   DumpAnyReg(os, rex, reg_num, byte_operand, size_override, reg_file);
100 }
101 
DumpRmReg(std::ostream & os,uint8_t rex,uint8_t reg,bool byte_operand,uint8_t size_override,RegFile reg_file)102 static void DumpRmReg(std::ostream& os, uint8_t rex, uint8_t reg,
103                       bool byte_operand, uint8_t size_override, RegFile reg_file) {
104   bool rex_b = (rex & REX_B) != 0;
105   size_t reg_num = rex_b ? (reg + 8) : reg;
106   DumpAnyReg(os, rex, reg_num, byte_operand, size_override, reg_file);
107 }
108 
DumpAddrReg(std::ostream & os,uint8_t rex,uint8_t reg)109 static void DumpAddrReg(std::ostream& os, uint8_t rex, uint8_t reg) {
110   if (rex != 0) {
111     os << gReg64Names[reg];
112   } else {
113     os << gReg32Names[reg];
114   }
115 }
116 
DumpBaseReg(std::ostream & os,uint8_t rex,uint8_t reg)117 static void DumpBaseReg(std::ostream& os, uint8_t rex, uint8_t reg) {
118   bool rex_b = (rex & REX_B) != 0;
119   size_t reg_num = rex_b ? (reg + 8) : reg;
120   DumpAddrReg(os, rex, reg_num);
121 }
122 
DumpOpcodeReg(std::ostream & os,uint8_t rex,uint8_t reg,bool byte_operand,uint8_t size_override)123 static void DumpOpcodeReg(std::ostream& os, uint8_t rex, uint8_t reg,
124                           bool byte_operand, uint8_t size_override) {
125   bool rex_b = (rex & REX_B) != 0;
126   size_t reg_num = rex_b ? (reg + 8) : reg;
127   DumpReg0(os, rex, reg_num, byte_operand, size_override);
128 }
129 
130 enum SegmentPrefix {
131   kCs = 0x2e,
132   kSs = 0x36,
133   kDs = 0x3e,
134   kEs = 0x26,
135   kFs = 0x64,
136   kGs = 0x65,
137 };
138 
DumpSegmentOverride(std::ostream & os,uint8_t segment_prefix)139 static void DumpSegmentOverride(std::ostream& os, uint8_t segment_prefix) {
140   switch (segment_prefix) {
141     case kCs: os << "cs:"; break;
142     case kSs: os << "ss:"; break;
143     case kDs: os << "ds:"; break;
144     case kEs: os << "es:"; break;
145     case kFs: os << "fs:"; break;
146     case kGs: os << "gs:"; break;
147     default: break;
148   }
149 }
150 
151 // Do not inline to avoid Clang stack frame problems. b/18733806
152 NO_INLINE
DumpCodeHex(const uint8_t * begin,const uint8_t * end)153 static std::string DumpCodeHex(const uint8_t* begin, const uint8_t* end) {
154   std::stringstream hex;
155   for (size_t i = 0; begin + i < end; ++i) {
156     hex << StringPrintf("%02X", begin[i]);
157   }
158   return hex.str();
159 }
160 
DumpAddress(uint8_t mod,uint8_t rm,uint8_t rex64,uint8_t rex_w,bool no_ops,bool byte_operand,bool byte_second_operand,uint8_t * prefix,bool load,RegFile src_reg_file,RegFile dst_reg_file,const uint8_t ** instr,uint32_t * address_bits)161 std::string DisassemblerX86::DumpAddress(uint8_t mod, uint8_t rm, uint8_t rex64, uint8_t rex_w,
162                                          bool no_ops, bool byte_operand, bool byte_second_operand,
163                                          uint8_t* prefix, bool load, RegFile src_reg_file,
164                                          RegFile dst_reg_file, const uint8_t** instr,
165                                          uint32_t* address_bits) {
166   std::ostringstream address;
167   if (mod == 0 && rm == 5) {
168     if (!supports_rex_) {  // Absolute address.
169       *address_bits = *reinterpret_cast<const uint32_t*>(*instr);
170       address << StringPrintf("[0x%x]", *address_bits);
171     } else {  // 64-bit RIP relative addressing.
172       address << StringPrintf("[RIP + 0x%x]",  *reinterpret_cast<const uint32_t*>(*instr));
173     }
174     (*instr) += 4;
175   } else if (rm == 4 && mod != 3) {  // SIB
176     uint8_t sib = **instr;
177     (*instr)++;
178     uint8_t scale = (sib >> 6) & 3;
179     uint8_t index = (sib >> 3) & 7;
180     uint8_t base = sib & 7;
181     address << "[";
182 
183     // REX.x is bit 3 of index.
184     if ((rex64 & REX_X) != 0) {
185       index += 8;
186     }
187 
188     // Mod = 0 && base = 5 (ebp): no base (ignores REX.b).
189     bool has_base = false;
190     if (base != 5 || mod != 0) {
191       has_base = true;
192       DumpBaseReg(address, rex64, base);
193     }
194 
195     // Index = 4 (esp/rsp) is disallowed.
196     if (index != 4) {
197       if (has_base) {
198         address << " + ";
199       }
200       DumpAddrReg(address, rex64, index);
201       if (scale != 0) {
202         address << StringPrintf(" * %d", 1 << scale);
203       }
204     }
205 
206     if (mod == 0) {
207       if (base == 5) {
208         if (index != 4) {
209           address << StringPrintf(" + %d", *reinterpret_cast<const int32_t*>(*instr));
210         } else {
211           // 64-bit low 32-bit absolute address, redundant absolute address encoding on 32-bit.
212           *address_bits = *reinterpret_cast<const uint32_t*>(*instr);
213           address << StringPrintf("%d", *address_bits);
214         }
215         (*instr) += 4;
216       }
217     } else if (mod == 1) {
218       address << StringPrintf(" + %d", *reinterpret_cast<const int8_t*>(*instr));
219       (*instr)++;
220     } else if (mod == 2) {
221       address << StringPrintf(" + %d", *reinterpret_cast<const int32_t*>(*instr));
222       (*instr) += 4;
223     }
224     address << "]";
225   } else {
226     if (mod == 3) {
227       if (!no_ops) {
228         DumpRmReg(address, rex_w, rm, byte_operand || byte_second_operand,
229                   prefix[2], load ? src_reg_file : dst_reg_file);
230       }
231     } else {
232       address << "[";
233       DumpBaseReg(address, rex64, rm);
234       if (mod == 1) {
235         address << StringPrintf(" + %d", *reinterpret_cast<const int8_t*>(*instr));
236         (*instr)++;
237       } else if (mod == 2) {
238         address << StringPrintf(" + %d", *reinterpret_cast<const int32_t*>(*instr));
239         (*instr) += 4;
240       }
241       address << "]";
242     }
243   }
244   return address.str();
245 }
246 
DumpNops(std::ostream & os,const uint8_t * instr)247 size_t DisassemblerX86::DumpNops(std::ostream& os, const uint8_t* instr) {
248 static constexpr uint8_t kNops[][10] = {
249       { },
250       { 0x90 },
251       { 0x66, 0x90 },
252       { 0x0f, 0x1f, 0x00 },
253       { 0x0f, 0x1f, 0x40, 0x00 },
254       { 0x0f, 0x1f, 0x44, 0x00, 0x00 },
255       { 0x66, 0x0f, 0x1f, 0x44, 0x00, 0x00 },
256       { 0x0f, 0x1f, 0x80, 0x00, 0x00, 0x00, 0x00 },
257       { 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 },
258       { 0x66, 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 },
259       { 0x66, 0x2e, 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 }
260   };
261 
262   for (size_t i = 1; i < arraysize(kNops); ++i) {
263     if (memcmp(instr, kNops[i], i) == 0) {
264       os << FormatInstructionPointer(instr)
265          << StringPrintf(": %22s    \t       nop \n", DumpCodeHex(instr, instr + i).c_str());
266       return i;
267     }
268   }
269 
270   return 0;
271 }
272 
DumpInstruction(std::ostream & os,const uint8_t * instr)273 size_t DisassemblerX86::DumpInstruction(std::ostream& os, const uint8_t* instr) {
274   size_t nop_size = DumpNops(os, instr);
275   if (nop_size != 0u) {
276     return nop_size;
277   }
278 
279   const uint8_t* begin_instr = instr;
280   bool have_prefixes = true;
281   uint8_t prefix[4] = {0, 0, 0, 0};
282   do {
283     switch (*instr) {
284         // Group 1 - lock and repeat prefixes:
285       case 0xF0:
286       case 0xF2:
287       case 0xF3:
288         prefix[0] = *instr;
289         break;
290         // Group 2 - segment override prefixes:
291       case kCs:
292       case kSs:
293       case kDs:
294       case kEs:
295       case kFs:
296       case kGs:
297         prefix[1] = *instr;
298         break;
299         // Group 3 - operand size override:
300       case 0x66:
301         prefix[2] = *instr;
302         break;
303         // Group 4 - address size override:
304       case 0x67:
305         prefix[3] = *instr;
306         break;
307       default:
308         have_prefixes = false;
309         break;
310     }
311     if (have_prefixes) {
312       instr++;
313     }
314   } while (have_prefixes);
315   uint8_t rex = (supports_rex_ && (*instr >= 0x40) && (*instr <= 0x4F)) ? *instr : 0;
316   if (rex != 0) {
317     instr++;
318   }
319   const char** modrm_opcodes = nullptr;
320   bool has_modrm = false;
321   bool reg_is_opcode = false;
322   size_t immediate_bytes = 0;
323   size_t branch_bytes = 0;
324   std::string opcode_tmp;    // Storage to keep StringPrintf result alive.
325   const char* opcode0 = "";  // Prefix part.
326   const char* opcode1 = "";  // Main opcode.
327   const char* opcode2 = "";  // Sub-opcode. E.g., jump type.
328   const char* opcode3 = "";  // Mod-rm part.
329   const char* opcode4 = "";  // Suffix part.
330   bool store = false;  // stores to memory (ie rm is on the left)
331   bool load = false;  // loads from memory (ie rm is on the right)
332   bool byte_operand = false;  // true when the opcode is dealing with byte operands
333   // true when the source operand is a byte register but the target register isn't
334   // (ie movsxb/movzxb).
335   bool byte_second_operand = false;
336   bool target_specific = false;  // register name depends on target (64 vs 32 bits).
337   bool ax = false;  // implicit use of ax
338   bool cx = false;  // implicit use of cx
339   bool reg_in_opcode = false;  // low 3-bits of opcode encode register parameter
340   bool no_ops = false;
341   RegFile src_reg_file = GPR;
342   RegFile dst_reg_file = GPR;
343   switch (*instr) {
344 #define DISASSEMBLER_ENTRY(opname, \
345                      rm8_r8, rm32_r32, \
346                      r8_rm8, r32_rm32, \
347                      ax8_i8, ax32_i32) \
348   case rm8_r8:   opcode1 = #opname; store = true; has_modrm = true; byte_operand = true; break; \
349   case rm32_r32: opcode1 = #opname; store = true; has_modrm = true; break; \
350   case r8_rm8:   opcode1 = #opname; load = true; has_modrm = true; byte_operand = true; break; \
351   case r32_rm32: opcode1 = #opname; load = true; has_modrm = true; break; \
352   case ax8_i8:   opcode1 = #opname; ax = true; immediate_bytes = 1; byte_operand = true; break; \
353   case ax32_i32: opcode1 = #opname; ax = true; immediate_bytes = 4; break;
354 
355 DISASSEMBLER_ENTRY(add,
356   0x00 /* RegMem8/Reg8 */,     0x01 /* RegMem32/Reg32 */,
357   0x02 /* Reg8/RegMem8 */,     0x03 /* Reg32/RegMem32 */,
358   0x04 /* Rax8/imm8 opcode */, 0x05 /* Rax32/imm32 */)
359 DISASSEMBLER_ENTRY(or,
360   0x08 /* RegMem8/Reg8 */,     0x09 /* RegMem32/Reg32 */,
361   0x0A /* Reg8/RegMem8 */,     0x0B /* Reg32/RegMem32 */,
362   0x0C /* Rax8/imm8 opcode */, 0x0D /* Rax32/imm32 */)
363 DISASSEMBLER_ENTRY(adc,
364   0x10 /* RegMem8/Reg8 */,     0x11 /* RegMem32/Reg32 */,
365   0x12 /* Reg8/RegMem8 */,     0x13 /* Reg32/RegMem32 */,
366   0x14 /* Rax8/imm8 opcode */, 0x15 /* Rax32/imm32 */)
367 DISASSEMBLER_ENTRY(sbb,
368   0x18 /* RegMem8/Reg8 */,     0x19 /* RegMem32/Reg32 */,
369   0x1A /* Reg8/RegMem8 */,     0x1B /* Reg32/RegMem32 */,
370   0x1C /* Rax8/imm8 opcode */, 0x1D /* Rax32/imm32 */)
371 DISASSEMBLER_ENTRY(and,
372   0x20 /* RegMem8/Reg8 */,     0x21 /* RegMem32/Reg32 */,
373   0x22 /* Reg8/RegMem8 */,     0x23 /* Reg32/RegMem32 */,
374   0x24 /* Rax8/imm8 opcode */, 0x25 /* Rax32/imm32 */)
375 DISASSEMBLER_ENTRY(sub,
376   0x28 /* RegMem8/Reg8 */,     0x29 /* RegMem32/Reg32 */,
377   0x2A /* Reg8/RegMem8 */,     0x2B /* Reg32/RegMem32 */,
378   0x2C /* Rax8/imm8 opcode */, 0x2D /* Rax32/imm32 */)
379 DISASSEMBLER_ENTRY(xor,
380   0x30 /* RegMem8/Reg8 */,     0x31 /* RegMem32/Reg32 */,
381   0x32 /* Reg8/RegMem8 */,     0x33 /* Reg32/RegMem32 */,
382   0x34 /* Rax8/imm8 opcode */, 0x35 /* Rax32/imm32 */)
383 DISASSEMBLER_ENTRY(cmp,
384   0x38 /* RegMem8/Reg8 */,     0x39 /* RegMem32/Reg32 */,
385   0x3A /* Reg8/RegMem8 */,     0x3B /* Reg32/RegMem32 */,
386   0x3C /* Rax8/imm8 opcode */, 0x3D /* Rax32/imm32 */)
387 
388 #undef DISASSEMBLER_ENTRY
389   case 0x50: case 0x51: case 0x52: case 0x53: case 0x54: case 0x55: case 0x56: case 0x57:
390     opcode1 = "push";
391     reg_in_opcode = true;
392     target_specific = true;
393     break;
394   case 0x58: case 0x59: case 0x5A: case 0x5B: case 0x5C: case 0x5D: case 0x5E: case 0x5F:
395     opcode1 = "pop";
396     reg_in_opcode = true;
397     target_specific = true;
398     break;
399   case 0x63:
400     if ((rex & REX_W) != 0) {
401       opcode1 = "movsxd";
402       has_modrm = true;
403       load = true;
404     } else {
405       // In 32-bit mode (!supports_rex_) this is ARPL, with no REX prefix the functionality is the
406       // same as 'mov' but the use of the instruction is discouraged.
407       opcode_tmp = StringPrintf("unknown opcode '%02X'", *instr);
408       opcode1 = opcode_tmp.c_str();
409     }
410     break;
411   case 0x68: opcode1 = "push"; immediate_bytes = 4; break;
412   case 0x69: opcode1 = "imul"; load = true; has_modrm = true; immediate_bytes = 4; break;
413   case 0x6A: opcode1 = "push"; immediate_bytes = 1; break;
414   case 0x6B: opcode1 = "imul"; load = true; has_modrm = true; immediate_bytes = 1; break;
415   case 0x70: case 0x71: case 0x72: case 0x73: case 0x74: case 0x75: case 0x76: case 0x77:
416   case 0x78: case 0x79: case 0x7A: case 0x7B: case 0x7C: case 0x7D: case 0x7E: case 0x7F:
417     static const char* condition_codes[] =
418     {"o", "no", "b/nae/c", "nb/ae/nc", "z/eq",  "nz/ne", "be/na", "nbe/a",
419      "s", "ns", "p/pe",    "np/po",    "l/nge", "nl/ge", "le/ng", "nle/g"
420     };
421     opcode1 = "j";
422     opcode2 = condition_codes[*instr & 0xF];
423     branch_bytes = 1;
424     break;
425   case 0x86: case 0x87:
426     opcode1 = "xchg";
427     store = true;
428     has_modrm = true;
429     byte_operand = (*instr == 0x86);
430     break;
431   case 0x88: opcode1 = "mov"; store = true; has_modrm = true; byte_operand = true; break;
432   case 0x89: opcode1 = "mov"; store = true; has_modrm = true; break;
433   case 0x8A: opcode1 = "mov"; load = true; has_modrm = true; byte_operand = true; break;
434   case 0x8B: opcode1 = "mov"; load = true; has_modrm = true; break;
435   case 0x9D: opcode1 = "popf"; break;
436 
437   case 0x0F:  // 2 byte extended opcode
438     instr++;
439     switch (*instr) {
440       case 0x10: case 0x11:
441         if (prefix[0] == 0xF2) {
442           opcode1 = "movsd";
443           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
444         } else if (prefix[0] == 0xF3) {
445           opcode1 = "movss";
446           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
447         } else if (prefix[2] == 0x66) {
448           opcode1 = "movupd";
449           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
450         } else {
451           opcode1 = "movups";
452         }
453         has_modrm = true;
454         src_reg_file = dst_reg_file = SSE;
455         load = *instr == 0x10;
456         store = !load;
457         break;
458       case 0x12: case 0x13:
459         if (prefix[2] == 0x66) {
460           opcode1 = "movlpd";
461           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
462         } else if (prefix[0] == 0) {
463           opcode1 = "movlps";
464         }
465         has_modrm = true;
466         src_reg_file = dst_reg_file = SSE;
467         load = *instr == 0x12;
468         store = !load;
469         break;
470       case 0x16: case 0x17:
471         if (prefix[2] == 0x66) {
472           opcode1 = "movhpd";
473           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
474         } else if (prefix[0] == 0) {
475           opcode1 = "movhps";
476         }
477         has_modrm = true;
478         src_reg_file = dst_reg_file = SSE;
479         load = *instr == 0x16;
480         store = !load;
481         break;
482       case 0x28: case 0x29:
483         if (prefix[2] == 0x66) {
484           opcode1 = "movapd";
485           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
486         } else if (prefix[0] == 0) {
487           opcode1 = "movaps";
488         }
489         has_modrm = true;
490         src_reg_file = dst_reg_file = SSE;
491         load = *instr == 0x28;
492         store = !load;
493         break;
494       case 0x2A:
495         if (prefix[2] == 0x66) {
496           opcode1 = "cvtpi2pd";
497           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
498         } else if (prefix[0] == 0xF2) {
499           opcode1 = "cvtsi2sd";
500           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
501         } else if (prefix[0] == 0xF3) {
502           opcode1 = "cvtsi2ss";
503           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
504         } else {
505           opcode1 = "cvtpi2ps";
506         }
507         load = true;
508         has_modrm = true;
509         dst_reg_file = SSE;
510         break;
511       case 0x2C:
512         if (prefix[2] == 0x66) {
513           opcode1 = "cvttpd2pi";
514           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
515         } else if (prefix[0] == 0xF2) {
516           opcode1 = "cvttsd2si";
517           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
518         } else if (prefix[0] == 0xF3) {
519           opcode1 = "cvttss2si";
520           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
521         } else {
522           opcode1 = "cvttps2pi";
523         }
524         load = true;
525         has_modrm = true;
526         src_reg_file = SSE;
527         break;
528       case 0x2D:
529         if (prefix[2] == 0x66) {
530           opcode1 = "cvtpd2pi";
531           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
532         } else if (prefix[0] == 0xF2) {
533           opcode1 = "cvtsd2si";
534           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
535         } else if (prefix[0] == 0xF3) {
536           opcode1 = "cvtss2si";
537           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
538         } else {
539           opcode1 = "cvtps2pi";
540         }
541         load = true;
542         has_modrm = true;
543         src_reg_file = SSE;
544         break;
545       case 0x2E:
546         opcode0 = "u";
547         FALLTHROUGH_INTENDED;
548       case 0x2F:
549         if (prefix[2] == 0x66) {
550           opcode1 = "comisd";
551           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
552         } else {
553           opcode1 = "comiss";
554         }
555         has_modrm = true;
556         load = true;
557         src_reg_file = dst_reg_file = SSE;
558         break;
559       case 0x38:  // 3 byte extended opcode
560         instr++;
561         if (prefix[2] == 0x66) {
562           switch (*instr) {
563             case 0x01:
564               opcode1 = "phaddw";
565               prefix[2] = 0;
566               has_modrm = true;
567               load = true;
568               src_reg_file = dst_reg_file = SSE;
569               break;
570             case 0x02:
571               opcode1 = "phaddd";
572               prefix[2] = 0;
573               has_modrm = true;
574               load = true;
575               src_reg_file = dst_reg_file = SSE;
576               break;
577             case 0x29:
578               opcode1 = "pcmpeqq";
579               prefix[2] = 0;
580               has_modrm = true;
581               load = true;
582               src_reg_file = dst_reg_file = SSE;
583               break;
584             case 0x39:
585               opcode1 = "pcmpgtq";
586               prefix[2] = 0;
587               has_modrm = true;
588               load = true;
589               src_reg_file = dst_reg_file = SSE;
590               break;
591             case 0x40:
592               opcode1 = "pmulld";
593               prefix[2] = 0;
594               has_modrm = true;
595               load = true;
596               src_reg_file = dst_reg_file = SSE;
597               break;
598             default:
599               opcode_tmp = StringPrintf("unknown opcode '0F 38 %02X'", *instr);
600               opcode1 = opcode_tmp.c_str();
601           }
602         } else {
603           opcode_tmp = StringPrintf("unknown opcode '0F 38 %02X'", *instr);
604           opcode1 = opcode_tmp.c_str();
605         }
606         break;
607       case 0x3A:  // 3 byte extended opcode
608         instr++;
609         if (prefix[2] == 0x66) {
610           switch (*instr) {
611             case 0x0A:
612               opcode1 = "roundss";
613               prefix[2] = 0;
614               has_modrm = true;
615               load = true;
616               src_reg_file = SSE;
617               dst_reg_file = SSE;
618               immediate_bytes = 1;
619               break;
620             case 0x0B:
621               opcode1 = "roundsd";
622               prefix[2] = 0;
623               has_modrm = true;
624               load = true;
625               src_reg_file = SSE;
626               dst_reg_file = SSE;
627               immediate_bytes = 1;
628               break;
629             case 0x14:
630               opcode1 = "pextrb";
631               prefix[2] = 0;
632               has_modrm = true;
633               store = true;
634               src_reg_file = SSE;
635               immediate_bytes = 1;
636               break;
637           case 0x15:
638               opcode1 = "pextrw";
639               prefix[2] = 0;
640               has_modrm = true;
641               store = true;
642               src_reg_file = SSE;
643               immediate_bytes = 1;
644               break;
645             case 0x16:
646               opcode1 = "pextrd";
647               prefix[2] = 0;
648               has_modrm = true;
649               store = true;
650               src_reg_file = SSE;
651               immediate_bytes = 1;
652               break;
653             default:
654               opcode_tmp = StringPrintf("unknown opcode '0F 3A %02X'", *instr);
655               opcode1 = opcode_tmp.c_str();
656           }
657         } else {
658           opcode_tmp = StringPrintf("unknown opcode '0F 3A %02X'", *instr);
659           opcode1 = opcode_tmp.c_str();
660         }
661         break;
662       case 0x40: case 0x41: case 0x42: case 0x43: case 0x44: case 0x45: case 0x46: case 0x47:
663       case 0x48: case 0x49: case 0x4A: case 0x4B: case 0x4C: case 0x4D: case 0x4E: case 0x4F:
664         opcode1 = "cmov";
665         opcode2 = condition_codes[*instr & 0xF];
666         has_modrm = true;
667         load = true;
668         break;
669       case 0x50: case 0x51: case 0x52: case 0x53: case 0x54: case 0x55: case 0x56: case 0x57:
670       case 0x58: case 0x59: case 0x5C: case 0x5D: case 0x5E: case 0x5F: {
671         switch (*instr) {
672           case 0x50: opcode1 = "movmsk"; break;
673           case 0x51: opcode1 = "sqrt"; break;
674           case 0x52: opcode1 = "rsqrt"; break;
675           case 0x53: opcode1 = "rcp"; break;
676           case 0x54: opcode1 = "and"; break;
677           case 0x55: opcode1 = "andn"; break;
678           case 0x56: opcode1 = "or"; break;
679           case 0x57: opcode1 = "xor"; break;
680           case 0x58: opcode1 = "add"; break;
681           case 0x59: opcode1 = "mul"; break;
682           case 0x5C: opcode1 = "sub"; break;
683           case 0x5D: opcode1 = "min"; break;
684           case 0x5E: opcode1 = "div"; break;
685           case 0x5F: opcode1 = "max"; break;
686           default: LOG(FATAL) << "Unreachable"; UNREACHABLE();
687         }
688         if (prefix[2] == 0x66) {
689           opcode2 = "pd";
690           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
691         } else if (prefix[0] == 0xF2) {
692           opcode2 = "sd";
693           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
694         } else if (prefix[0] == 0xF3) {
695           opcode2 = "ss";
696           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
697         } else {
698           opcode2 = "ps";
699         }
700         load = true;
701         has_modrm = true;
702         src_reg_file = dst_reg_file = SSE;
703         break;
704       }
705       case 0x5A:
706         if (prefix[2] == 0x66) {
707           opcode1 = "cvtpd2ps";
708           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
709         } else if (prefix[0] == 0xF2) {
710           opcode1 = "cvtsd2ss";
711           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
712         } else if (prefix[0] == 0xF3) {
713           opcode1 = "cvtss2sd";
714           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
715         } else {
716           opcode1 = "cvtps2pd";
717         }
718         load = true;
719         has_modrm = true;
720         src_reg_file = dst_reg_file = SSE;
721         break;
722       case 0x5B:
723         if (prefix[2] == 0x66) {
724           opcode1 = "cvtps2dq";
725           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
726         } else if (prefix[0] == 0xF2) {
727           opcode1 = "bad opcode F2 0F 5B";
728         } else if (prefix[0] == 0xF3) {
729           opcode1 = "cvttps2dq";
730           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
731         } else {
732           opcode1 = "cvtdq2ps";
733         }
734         load = true;
735         has_modrm = true;
736         src_reg_file = dst_reg_file = SSE;
737         break;
738       case 0x60: case 0x61: case 0x62: case 0x6C:
739         if (prefix[2] == 0x66) {
740           src_reg_file = dst_reg_file = SSE;
741           prefix[2] = 0;  // Clear prefix now. It has served its purpose as part of the opcode.
742         } else {
743           src_reg_file = dst_reg_file = MMX;
744         }
745         switch (*instr) {
746           case 0x60: opcode1 = "punpcklbw"; break;
747           case 0x61: opcode1 = "punpcklwd"; break;
748           case 0x62: opcode1 = "punpckldq"; break;
749           case 0x6c: opcode1 = "punpcklqdq"; break;
750         }
751         load = true;
752         has_modrm = true;
753         break;
754       case 0x64:
755       case 0x65:
756       case 0x66:
757         if (prefix[2] == 0x66) {
758           src_reg_file = dst_reg_file = SSE;
759           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
760         } else {
761           src_reg_file = dst_reg_file = MMX;
762         }
763         switch (*instr) {
764           case 0x64: opcode1 = "pcmpgtb"; break;
765           case 0x65: opcode1 = "pcmpgtw"; break;
766           case 0x66: opcode1 = "pcmpgtd"; break;
767         }
768         prefix[2] = 0;
769         has_modrm = true;
770         load = true;
771         break;
772       case 0x6E:
773         if (prefix[2] == 0x66) {
774           dst_reg_file = SSE;
775           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
776         } else {
777           dst_reg_file = MMX;
778         }
779         opcode1 = "movd";
780         load = true;
781         has_modrm = true;
782         break;
783       case 0x6F:
784         if (prefix[2] == 0x66) {
785           src_reg_file = dst_reg_file = SSE;
786           opcode1 = "movdqa";
787           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
788         } else if (prefix[0] == 0xF3) {
789           src_reg_file = dst_reg_file = SSE;
790           opcode1 = "movdqu";
791           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
792         } else {
793           dst_reg_file = MMX;
794           opcode1 = "movq";
795         }
796         load = true;
797         has_modrm = true;
798         break;
799       case 0x70:
800         if (prefix[2] == 0x66) {
801           opcode1 = "pshufd";
802           prefix[2] = 0;
803           has_modrm = true;
804           store = true;
805           src_reg_file = dst_reg_file = SSE;
806           immediate_bytes = 1;
807         } else if (prefix[0] == 0xF2) {
808           opcode1 = "pshuflw";
809           prefix[0] = 0;
810           has_modrm = true;
811           store = true;
812           src_reg_file = dst_reg_file = SSE;
813           immediate_bytes = 1;
814         } else {
815           opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
816           opcode1 = opcode_tmp.c_str();
817         }
818         break;
819       case 0x71:
820         if (prefix[2] == 0x66) {
821           dst_reg_file = SSE;
822           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
823         } else {
824           dst_reg_file = MMX;
825         }
826         static const char* x71_opcodes[] = {
827             "unknown-71", "unknown-71", "psrlw", "unknown-71",
828             "psraw",      "unknown-71", "psllw", "unknown-71"};
829         modrm_opcodes = x71_opcodes;
830         reg_is_opcode = true;
831         has_modrm = true;
832         store = true;
833         immediate_bytes = 1;
834         break;
835       case 0x72:
836         if (prefix[2] == 0x66) {
837           dst_reg_file = SSE;
838           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
839         } else {
840           dst_reg_file = MMX;
841         }
842         static const char* x72_opcodes[] = {
843             "unknown-72", "unknown-72", "psrld", "unknown-72",
844             "psrad",      "unknown-72", "pslld", "unknown-72"};
845         modrm_opcodes = x72_opcodes;
846         reg_is_opcode = true;
847         has_modrm = true;
848         store = true;
849         immediate_bytes = 1;
850         break;
851       case 0x73:
852         if (prefix[2] == 0x66) {
853           dst_reg_file = SSE;
854           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
855         } else {
856           dst_reg_file = MMX;
857         }
858         static const char* x73_opcodes[] = {
859             "unknown-73", "unknown-73", "psrlq", "psrldq",
860             "unknown-73", "unknown-73", "psllq", "unknown-73"};
861         modrm_opcodes = x73_opcodes;
862         reg_is_opcode = true;
863         has_modrm = true;
864         store = true;
865         immediate_bytes = 1;
866         break;
867       case 0x74:
868       case 0x75:
869       case 0x76:
870         if (prefix[2] == 0x66) {
871           src_reg_file = dst_reg_file = SSE;
872           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
873         } else {
874           src_reg_file = dst_reg_file = MMX;
875         }
876         switch (*instr) {
877           case 0x74: opcode1 = "pcmpeqb"; break;
878           case 0x75: opcode1 = "pcmpeqw"; break;
879           case 0x76: opcode1 = "pcmpeqd"; break;
880         }
881         prefix[2] = 0;
882         has_modrm = true;
883         load = true;
884         break;
885       case 0x7C:
886         if (prefix[0] == 0xF2) {
887           opcode1 = "haddps";
888           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
889         } else if (prefix[2] == 0x66) {
890           opcode1 = "haddpd";
891           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
892         } else {
893           opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
894           opcode1 = opcode_tmp.c_str();
895           break;
896         }
897         src_reg_file = dst_reg_file = SSE;
898         has_modrm = true;
899         load = true;
900         break;
901       case 0x7E:
902         if (prefix[2] == 0x66) {
903           src_reg_file = SSE;
904           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
905         } else {
906           src_reg_file = MMX;
907         }
908         opcode1 = "movd";
909         has_modrm = true;
910         store = true;
911         break;
912       case 0x7F:
913         if (prefix[2] == 0x66) {
914           src_reg_file = dst_reg_file = SSE;
915           opcode1 = "movdqa";
916           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
917         } else if (prefix[0] == 0xF3) {
918           src_reg_file = dst_reg_file = SSE;
919           opcode1 = "movdqu";
920           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
921         } else {
922           dst_reg_file = MMX;
923           opcode1 = "movq";
924         }
925         store = true;
926         has_modrm = true;
927         break;
928       case 0x80: case 0x81: case 0x82: case 0x83: case 0x84: case 0x85: case 0x86: case 0x87:
929       case 0x88: case 0x89: case 0x8A: case 0x8B: case 0x8C: case 0x8D: case 0x8E: case 0x8F:
930         opcode1 = "j";
931         opcode2 = condition_codes[*instr & 0xF];
932         branch_bytes = 4;
933         break;
934       case 0x90: case 0x91: case 0x92: case 0x93: case 0x94: case 0x95: case 0x96: case 0x97:
935       case 0x98: case 0x99: case 0x9A: case 0x9B: case 0x9C: case 0x9D: case 0x9E: case 0x9F:
936         opcode1 = "set";
937         opcode2 = condition_codes[*instr & 0xF];
938         modrm_opcodes = nullptr;
939         reg_is_opcode = true;
940         has_modrm = true;
941         store = true;
942         break;
943       case 0xA4:
944         opcode1 = "shld";
945         has_modrm = true;
946         load = true;
947         immediate_bytes = 1;
948         break;
949       case 0xA5:
950         opcode1 = "shld";
951         has_modrm = true;
952         load = true;
953         cx = true;
954         break;
955       case 0xAC:
956         opcode1 = "shrd";
957         has_modrm = true;
958         load = true;
959         immediate_bytes = 1;
960         break;
961       case 0xAD:
962         opcode1 = "shrd";
963         has_modrm = true;
964         load = true;
965         cx = true;
966         break;
967       case 0xAE:
968         if (prefix[0] == 0xF3) {
969           prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
970           static const char* xAE_opcodes[] = {
971               "rdfsbase",   "rdgsbase",   "wrfsbase",   "wrgsbase",
972               "unknown-AE", "unknown-AE", "unknown-AE", "unknown-AE"};
973           modrm_opcodes = xAE_opcodes;
974           reg_is_opcode = true;
975           has_modrm = true;
976           uint8_t reg_or_opcode = (instr[1] >> 3) & 7;
977           switch (reg_or_opcode) {
978             case 0:
979               prefix[1] = kFs;
980               load = true;
981               break;
982             case 1:
983               prefix[1] = kGs;
984               load = true;
985               break;
986             case 2:
987               prefix[1] = kFs;
988               store = true;
989               break;
990             case 3:
991               prefix[1] = kGs;
992               store = true;
993               break;
994             default:
995               load = true;
996               break;
997           }
998         } else {
999           static const char* xAE_opcodes[] = {
1000               "unknown-AE", "unknown-AE", "unknown-AE", "unknown-AE",
1001               "unknown-AE", "lfence",     "mfence",     "sfence"};
1002           modrm_opcodes = xAE_opcodes;
1003           reg_is_opcode = true;
1004           has_modrm = true;
1005           load = true;
1006           no_ops = true;
1007         }
1008         break;
1009       case 0xAF:
1010         opcode1 = "imul";
1011         has_modrm = true;
1012         load = true;
1013         break;
1014       case 0xB1:
1015         opcode1 = "cmpxchg";
1016         has_modrm = true;
1017         store = true;
1018         break;
1019       case 0xB6:
1020         opcode1 = "movzxb";
1021         has_modrm = true;
1022         load = true;
1023         byte_second_operand = true;
1024         break;
1025       case 0xB7:
1026         opcode1 = "movzxw";
1027         has_modrm = true;
1028         load = true;
1029         break;
1030       case 0xBC:
1031         opcode1 = "bsf";
1032         has_modrm = true;
1033         load = true;
1034         break;
1035       case 0xBD:
1036         opcode1 = "bsr";
1037         has_modrm = true;
1038         load = true;
1039         break;
1040       case 0xB8:
1041         opcode1 = "popcnt";
1042         has_modrm = true;
1043         load = true;
1044         break;
1045       case 0xBE:
1046         opcode1 = "movsxb";
1047         has_modrm = true;
1048         load = true;
1049         byte_second_operand = true;
1050         rex |= (rex == 0 ? 0 : REX_W);
1051         break;
1052       case 0xBF:
1053         opcode1 = "movsxw";
1054         has_modrm = true;
1055         load = true;
1056         break;
1057       case 0xC3:
1058         opcode1 = "movnti";
1059         store = true;
1060         has_modrm = true;
1061         break;
1062       case 0xC5:
1063         if (prefix[2] == 0x66) {
1064           opcode1 = "pextrw";
1065           prefix[2] = 0;
1066           has_modrm = true;
1067           load = true;
1068           src_reg_file = SSE;
1069           immediate_bytes = 1;
1070         } else {
1071           opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
1072           opcode1 = opcode_tmp.c_str();
1073         }
1074         break;
1075       case 0xC6:
1076         if (prefix[2] == 0x66) {
1077           opcode1 = "shufpd";
1078           prefix[2] = 0;
1079         } else {
1080           opcode1 = "shufps";
1081         }
1082         has_modrm = true;
1083         store = true;
1084         src_reg_file = dst_reg_file = SSE;
1085         immediate_bytes = 1;
1086         break;
1087       case 0xC7:
1088         static const char* x0FxC7_opcodes[] = {
1089             "unknown-0f-c7", "cmpxchg8b",     "unknown-0f-c7", "unknown-0f-c7",
1090             "unknown-0f-c7", "unknown-0f-c7", "unknown-0f-c7", "unknown-0f-c7"};
1091         modrm_opcodes = x0FxC7_opcodes;
1092         has_modrm = true;
1093         reg_is_opcode = true;
1094         store = true;
1095         break;
1096       case 0xC8: case 0xC9: case 0xCA: case 0xCB: case 0xCC: case 0xCD: case 0xCE: case 0xCF:
1097         opcode1 = "bswap";
1098         reg_in_opcode = true;
1099         break;
1100       case 0xD4:
1101         if (prefix[2] == 0x66) {
1102           src_reg_file = dst_reg_file = SSE;
1103           prefix[2] = 0;
1104         } else {
1105           src_reg_file = dst_reg_file = MMX;
1106         }
1107         opcode1 = "paddq";
1108         prefix[2] = 0;
1109         has_modrm = true;
1110         load = true;
1111         break;
1112       case 0xDB:
1113         if (prefix[2] == 0x66) {
1114           src_reg_file = dst_reg_file = SSE;
1115           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1116         } else {
1117           src_reg_file = dst_reg_file = MMX;
1118         }
1119         opcode1 = "pand";
1120         prefix[2] = 0;
1121         has_modrm = true;
1122         load = true;
1123         break;
1124       case 0xD5:
1125         if (prefix[2] == 0x66) {
1126           opcode1 = "pmullw";
1127           prefix[2] = 0;
1128           has_modrm = true;
1129           load = true;
1130           src_reg_file = dst_reg_file = SSE;
1131         } else {
1132           opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
1133           opcode1 = opcode_tmp.c_str();
1134         }
1135         break;
1136       case 0xE0:
1137       case 0xE3:
1138         if (prefix[2] == 0x66) {
1139           src_reg_file = dst_reg_file = SSE;
1140           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1141         } else {
1142           src_reg_file = dst_reg_file = MMX;
1143         }
1144         switch (*instr) {
1145           case 0xE0: opcode1 = "pavgb"; break;
1146           case 0xE3: opcode1 = "pavgw"; break;
1147         }
1148         prefix[2] = 0;
1149         has_modrm = true;
1150         load = true;
1151         break;
1152       case 0xEB:
1153         if (prefix[2] == 0x66) {
1154           src_reg_file = dst_reg_file = SSE;
1155           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1156         } else {
1157           src_reg_file = dst_reg_file = MMX;
1158         }
1159         opcode1 = "por";
1160         prefix[2] = 0;
1161         has_modrm = true;
1162         load = true;
1163         break;
1164       case 0xEF:
1165         if (prefix[2] == 0x66) {
1166           src_reg_file = dst_reg_file = SSE;
1167           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1168         } else {
1169           src_reg_file = dst_reg_file = MMX;
1170         }
1171         opcode1 = "pxor";
1172         prefix[2] = 0;
1173         has_modrm = true;
1174         load = true;
1175         break;
1176       case 0xF4:
1177       case 0xF6:
1178       case 0xF8:
1179       case 0xF9:
1180       case 0xFA:
1181       case 0xFB:
1182       case 0xFC:
1183       case 0xFD:
1184       case 0xFE:
1185         if (prefix[2] == 0x66) {
1186           src_reg_file = dst_reg_file = SSE;
1187           prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
1188         } else {
1189           src_reg_file = dst_reg_file = MMX;
1190         }
1191         switch (*instr) {
1192           case 0xF4: opcode1 = "pmuludq"; break;
1193           case 0xF6: opcode1 = "psadbw"; break;
1194           case 0xF8: opcode1 = "psubb"; break;
1195           case 0xF9: opcode1 = "psubw"; break;
1196           case 0xFA: opcode1 = "psubd"; break;
1197           case 0xFB: opcode1 = "psubq"; break;
1198           case 0xFC: opcode1 = "paddb"; break;
1199           case 0xFD: opcode1 = "paddw"; break;
1200           case 0xFE: opcode1 = "paddd"; break;
1201         }
1202         prefix[2] = 0;
1203         has_modrm = true;
1204         load = true;
1205         break;
1206       default:
1207         opcode_tmp = StringPrintf("unknown opcode '0F %02X'", *instr);
1208         opcode1 = opcode_tmp.c_str();
1209         break;
1210     }
1211     break;
1212   case 0x80: case 0x81: case 0x82: case 0x83:
1213     static const char* x80_opcodes[] = {"add", "or", "adc", "sbb", "and", "sub", "xor", "cmp"};
1214     modrm_opcodes = x80_opcodes;
1215     has_modrm = true;
1216     reg_is_opcode = true;
1217     store = true;
1218     byte_operand = (*instr & 1) == 0;
1219     immediate_bytes = *instr == 0x81 ? 4 : 1;
1220     break;
1221   case 0x84: case 0x85:
1222     opcode1 = "test";
1223     has_modrm = true;
1224     load = true;
1225     byte_operand = (*instr & 1) == 0;
1226     break;
1227   case 0x8D:
1228     opcode1 = "lea";
1229     has_modrm = true;
1230     load = true;
1231     break;
1232   case 0x8F:
1233     opcode1 = "pop";
1234     has_modrm = true;
1235     reg_is_opcode = true;
1236     store = true;
1237     break;
1238   case 0x99:
1239     opcode1 = "cdq";
1240     break;
1241   case 0x9B:
1242     if (instr[1] == 0xDF && instr[2] == 0xE0) {
1243       opcode1 = "fstsw\tax";
1244       instr += 2;
1245     } else {
1246       opcode_tmp = StringPrintf("unknown opcode '%02X'", *instr);
1247       opcode1 = opcode_tmp.c_str();
1248     }
1249     break;
1250   case 0xA5:
1251     opcode1 = (prefix[2] == 0x66 ? "movsw" : "movsl");
1252     break;
1253   case 0xA7:
1254     opcode1 = (prefix[2] == 0x66 ? "cmpsw" : "cmpsl");
1255     break;
1256   case 0xAF:
1257     opcode1 = (prefix[2] == 0x66 ? "scasw" : "scasl");
1258     break;
1259   case 0xB0: case 0xB1: case 0xB2: case 0xB3: case 0xB4: case 0xB5: case 0xB6: case 0xB7:
1260     opcode1 = "mov";
1261     immediate_bytes = 1;
1262     byte_operand = true;
1263     reg_in_opcode = true;
1264     byte_operand = true;
1265     break;
1266   case 0xB8: case 0xB9: case 0xBA: case 0xBB: case 0xBC: case 0xBD: case 0xBE: case 0xBF:
1267     if ((rex & REX_W) != 0) {
1268       opcode1 = "movabsq";
1269       immediate_bytes = 8;
1270       reg_in_opcode = true;
1271       break;
1272     }
1273     opcode1 = "mov";
1274     immediate_bytes = 4;
1275     reg_in_opcode = true;
1276     break;
1277   case 0xC0: case 0xC1:
1278   case 0xD0: case 0xD1: case 0xD2: case 0xD3:
1279     static const char* shift_opcodes[] =
1280         {"rol", "ror", "rcl", "rcr", "shl", "shr", "unknown-shift", "sar"};
1281     modrm_opcodes = shift_opcodes;
1282     has_modrm = true;
1283     reg_is_opcode = true;
1284     store = true;
1285     immediate_bytes = ((*instr & 0xf0) == 0xc0) ? 1 : 0;
1286     cx = (*instr == 0xD2) || (*instr == 0xD3);
1287     byte_operand = (*instr == 0xC0);
1288     break;
1289   case 0xC3: opcode1 = "ret"; break;
1290   case 0xC6:
1291     static const char* c6_opcodes[] = {"mov",        "unknown-c6", "unknown-c6",
1292                                        "unknown-c6", "unknown-c6", "unknown-c6",
1293                                        "unknown-c6", "unknown-c6"};
1294     modrm_opcodes = c6_opcodes;
1295     store = true;
1296     immediate_bytes = 1;
1297     has_modrm = true;
1298     reg_is_opcode = true;
1299     byte_operand = true;
1300     break;
1301   case 0xC7:
1302     static const char* c7_opcodes[] = {"mov",        "unknown-c7", "unknown-c7",
1303                                        "unknown-c7", "unknown-c7", "unknown-c7",
1304                                        "unknown-c7", "unknown-c7"};
1305     modrm_opcodes = c7_opcodes;
1306     store = true;
1307     immediate_bytes = 4;
1308     has_modrm = true;
1309     reg_is_opcode = true;
1310     break;
1311   case 0xCC: opcode1 = "int 3"; break;
1312   case 0xD9:
1313     if (instr[1] == 0xF8) {
1314       opcode1 = "fprem";
1315       instr++;
1316     } else {
1317       static const char* d9_opcodes[] = {"flds", "unknown-d9", "fsts", "fstps", "fldenv", "fldcw",
1318                                          "fnstenv", "fnstcw"};
1319       modrm_opcodes = d9_opcodes;
1320       store = true;
1321       has_modrm = true;
1322       reg_is_opcode = true;
1323     }
1324     break;
1325   case 0xDA:
1326     if (instr[1] == 0xE9) {
1327       opcode1 = "fucompp";
1328       instr++;
1329     } else {
1330       opcode_tmp = StringPrintf("unknown opcode '%02X'", *instr);
1331       opcode1 = opcode_tmp.c_str();
1332     }
1333     break;
1334   case 0xDB:
1335     static const char* db_opcodes[] = {"fildl",      "unknown-db", "unknown-db",
1336                                        "unknown-db", "unknown-db", "unknown-db",
1337                                        "unknown-db", "unknown-db"};
1338     modrm_opcodes = db_opcodes;
1339     load = true;
1340     has_modrm = true;
1341     reg_is_opcode = true;
1342     break;
1343   case 0xDD:
1344     static const char* dd_opcodes[] = {"fldl",   "fisttp", "fstl",
1345                                        "fstpl",  "frstor", "unknown-dd",
1346                                        "fnsave", "fnstsw"};
1347     modrm_opcodes = dd_opcodes;
1348     store = true;
1349     has_modrm = true;
1350     reg_is_opcode = true;
1351     break;
1352   case 0xDF:
1353     static const char* df_opcodes[] = {"fild",       "unknown-df", "unknown-df",
1354                                        "unknown-df", "unknown-df", "fildll",
1355                                        "unknown-df", "unknown-df"};
1356     modrm_opcodes = df_opcodes;
1357     load = true;
1358     has_modrm = true;
1359     reg_is_opcode = true;
1360     break;
1361   case 0xE3: opcode1 = "jecxz"; branch_bytes = 1; break;
1362   case 0xE8: opcode1 = "call"; branch_bytes = 4; break;
1363   case 0xE9: opcode1 = "jmp"; branch_bytes = 4; break;
1364   case 0xEB: opcode1 = "jmp"; branch_bytes = 1; break;
1365   case 0xF5: opcode1 = "cmc"; break;
1366   case 0xF6: case 0xF7:
1367     static const char* f7_opcodes[] = {
1368         "test", "unknown-f7", "not", "neg", "mul edx:eax, eax *",
1369         "imul edx:eax, eax *", "div edx:eax, edx:eax /",
1370         "idiv edx:eax, edx:eax /"};
1371     modrm_opcodes = f7_opcodes;
1372     has_modrm = true;
1373     reg_is_opcode = true;
1374     store = true;
1375     immediate_bytes = ((instr[1] & 0x38) == 0) ? (instr[0] == 0xF7 ? 4 : 1) : 0;
1376     break;
1377   case 0xFF:
1378     {
1379       static const char* ff_opcodes[] = {
1380           "inc", "dec", "call", "call",
1381           "jmp", "jmp", "push", "unknown-ff"};
1382       modrm_opcodes = ff_opcodes;
1383       has_modrm = true;
1384       reg_is_opcode = true;
1385       load = true;
1386       const uint8_t opcode_digit = (instr[1] >> 3) & 7;
1387       // 'call', 'jmp' and 'push' are target specific instructions
1388       if (opcode_digit == 2 || opcode_digit == 4 || opcode_digit == 6) {
1389         target_specific = true;
1390       }
1391     }
1392     break;
1393   default:
1394     opcode_tmp = StringPrintf("unknown opcode '%02X'", *instr);
1395     opcode1 = opcode_tmp.c_str();
1396     break;
1397   }
1398   std::ostringstream args;
1399   // We force the REX prefix to be available for 64-bit target
1400   // in order to dump addr (base/index) registers correctly.
1401   uint8_t rex64 = supports_rex_ ? (rex | 0x40) : rex;
1402   // REX.W should be forced for 64-target and target-specific instructions (i.e., push or pop).
1403   uint8_t rex_w = (supports_rex_ && target_specific) ? (rex | 0x48) : rex;
1404   if (reg_in_opcode) {
1405     DCHECK(!has_modrm);
1406     DumpOpcodeReg(args, rex_w, *instr & 0x7, byte_operand, prefix[2]);
1407   }
1408   instr++;
1409   uint32_t address_bits = 0;
1410   if (has_modrm) {
1411     uint8_t modrm = *instr;
1412     instr++;
1413     uint8_t mod = modrm >> 6;
1414     uint8_t reg_or_opcode = (modrm >> 3) & 7;
1415     uint8_t rm = modrm & 7;
1416     std::string address = DumpAddress(mod, rm, rex64, rex_w, no_ops, byte_operand,
1417                                       byte_second_operand, prefix, load, src_reg_file, dst_reg_file,
1418                                       &instr, &address_bits);
1419 
1420     if (reg_is_opcode && modrm_opcodes != nullptr) {
1421       opcode3 = modrm_opcodes[reg_or_opcode];
1422     }
1423 
1424     // Add opcode suffixes to indicate size.
1425     if (byte_operand) {
1426       opcode4 = "b";
1427     } else if ((rex & REX_W) != 0) {
1428       opcode4 = "q";
1429     } else if (prefix[2] == 0x66) {
1430       opcode4 = "w";
1431     }
1432 
1433     if (load) {
1434       if (!reg_is_opcode) {
1435         DumpReg(args, rex, reg_or_opcode, byte_operand, prefix[2], dst_reg_file);
1436         args << ", ";
1437       }
1438       DumpSegmentOverride(args, prefix[1]);
1439       args << address;
1440     } else {
1441       DCHECK(store);
1442       DumpSegmentOverride(args, prefix[1]);
1443       args << address;
1444       if (!reg_is_opcode) {
1445         args << ", ";
1446         DumpReg(args, rex, reg_or_opcode, byte_operand, prefix[2], src_reg_file);
1447       }
1448     }
1449   }
1450   if (ax) {
1451     // If this opcode implicitly uses ax, ax is always the first arg.
1452     DumpReg(args, rex, 0 /* EAX */, byte_operand, prefix[2], GPR);
1453   }
1454   if (cx) {
1455     args << ", ";
1456     DumpReg(args, rex, 1 /* ECX */, true, prefix[2], GPR);
1457   }
1458   if (immediate_bytes > 0) {
1459     if (has_modrm || reg_in_opcode || ax || cx) {
1460       args << ", ";
1461     }
1462     if (immediate_bytes == 1) {
1463       args << StringPrintf("%d", *reinterpret_cast<const int8_t*>(instr));
1464       instr++;
1465     } else if (immediate_bytes == 4) {
1466       if (prefix[2] == 0x66) {  // Operand size override from 32-bit to 16-bit.
1467         args << StringPrintf("%d", *reinterpret_cast<const int16_t*>(instr));
1468         instr += 2;
1469       } else {
1470         args << StringPrintf("%d", *reinterpret_cast<const int32_t*>(instr));
1471         instr += 4;
1472       }
1473     } else {
1474       CHECK_EQ(immediate_bytes, 8u);
1475       args << StringPrintf("%" PRId64, *reinterpret_cast<const int64_t*>(instr));
1476       instr += 8;
1477     }
1478   } else if (branch_bytes > 0) {
1479     DCHECK(!has_modrm);
1480     int32_t displacement;
1481     if (branch_bytes == 1) {
1482       displacement = *reinterpret_cast<const int8_t*>(instr);
1483       instr++;
1484     } else {
1485       CHECK_EQ(branch_bytes, 4u);
1486       displacement = *reinterpret_cast<const int32_t*>(instr);
1487       instr += 4;
1488     }
1489     args << StringPrintf("%+d (", displacement)
1490          << FormatInstructionPointer(instr + displacement)
1491          << ")";
1492   }
1493   if (prefix[1] == kFs && !supports_rex_) {
1494     args << "  ; ";
1495     GetDisassemblerOptions()->thread_offset_name_function_(args, address_bits);
1496   }
1497   if (prefix[1] == kGs && supports_rex_) {
1498     args << "  ; ";
1499     GetDisassemblerOptions()->thread_offset_name_function_(args, address_bits);
1500   }
1501   const char* prefix_str;
1502   switch (prefix[0]) {
1503     case 0xF0: prefix_str = "lock "; break;
1504     case 0xF2: prefix_str = "repne "; break;
1505     case 0xF3: prefix_str = "repe "; break;
1506     case 0: prefix_str = ""; break;
1507     default: LOG(FATAL) << "Unreachable"; UNREACHABLE();
1508   }
1509   os << FormatInstructionPointer(begin_instr)
1510      << StringPrintf(": %22s    \t%-7s%s%s%s%s%s ", DumpCodeHex(begin_instr, instr).c_str(),
1511                      prefix_str, opcode0, opcode1, opcode2, opcode3, opcode4)
1512      << args.str() << '\n';
1513   return instr - begin_instr;
1514 }  // NOLINT(readability/fn_size)
1515 
1516 }  // namespace x86
1517 }  // namespace art
1518