| blob | 000cb020f328487ba8642ff62d4102e221468d89 |
1 /*
2 *
3 * CDDL HEADER START
4 *
5 * The contents of this file are subject to the terms of the
6 * Common Development and Distribution License (the "License").
7 * You may not use this file except in compliance with the License.
8 *
9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10 * or http://www.opensolaris.org/os/licensing.
11 * See the License for the specific language governing permissions
12 * and limitations under the License.
13 *
14 * When distributing Covered Code, include this CDDL HEADER in each
15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16 * If applicable, add the following below this CDDL HEADER, with the
17 * fields enclosed by brackets "[]" replaced with your own identifying
18 * information: Portions Copyright [yyyy] [name of copyright owner]
19 *
20 * CDDL HEADER END
21 */
22 /*
23 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2017 Joyent, Inc.
25 */
27 /*
28 * Copyright (c) 2010, Intel Corporation.
29 * All rights reserved.
30 */
32 /* Copyright (c) 1988 AT&T */
33 /* All Rights Reserved */
37 /* BEGIN CSTYLED */
39 /*
40 * Disassembly begins in dis_distable, which is equivalent to the One-byte
41 * Opcode Map in the Intel IA32 ISA Reference (page A-6 in my copy). The
42 * decoding loops then traverse out through the other tables as necessary to
43 * decode a given instruction.
44 *
45 * The behavior of this file can be controlled by one of the following flags:
46 *
47 * DIS_TEXT Include text for disassembly
48 * DIS_MEM Include memory-size calculations
49 *
50 * Either or both of these can be defined.
51 *
52 * This file is not, and will never be, cstyled. If anything, the tables should
53 * be taken out another tab stop or two so nothing overlaps.
54 */
56 /*
57 * These functions must be provided for the consumer to do disassembly.
58 */
59 #ifdef DIS_TEXT
65 #endif
69 /* field terminates - no pointer. */
71 /* Used to decode instructions. */
74 uchar_t it_adrmode;
75 #ifdef DIS_TEXT
78 #endif
79 #ifdef DIS_MEM
81 #endif
91 /*
92 * Instruction formats.
93 */
95 UNKNOWN,
96 MRw,
97 IMlw,
98 IMw,
99 IR,
100 OA,
101 AO,
102 MS,
103 SM,
104 Mv,
105 Mw,
110 PREF,
111 SWAPGS_RDTSCP,
112 MONITOR_MWAIT,
113 R,
114 RA,
115 SEG,
116 MR,
117 RM,
119 IA,
120 MA,
121 SD,
122 AD,
123 SA,
124 D,
125 INM,
126 SO,
127 BD,
128 I,
129 P,
130 V,
132 U,
133 OVERRIDE,
165 /*
166 * MMX/SIMD addressing modes.
167 */
217 XGETBV_XSETBV,
248 EVEX_RMrX /* EVEX EVEX.vvvv, mod_rm -> mod_reg */
249 };
251 /*
252 * VEX prefixes
253 */
259 /*
260 ** Register numbers for the i386
261 */
262 #define EAX_REGNO 0
263 #define ECX_REGNO 1
264 #define EDX_REGNO 2
265 #define EBX_REGNO 3
266 #define ESP_REGNO 4
267 #define EBP_REGNO 5
268 #define ESI_REGNO 6
269 #define EDI_REGNO 7
271 /*
272 * modes for immediate values
273 */
274 #define MODE_NONE 0
281 /*
282 * The letters used in these macros are:
283 * IND - indirect to another to another table
284 * "T" - means to Terminate indirections (this is the final opcode)
285 * "S" - means "operand length suffix required"
286 * "Sa" - means AVX2 suffix (d/q) required
287 * "NS" - means "no suffix" which is the operand length suffix of the opcode
288 * "Z" - means instruction size arg required
289 * "u" - means the opcode is invalid in IA32 but valid in amd64
290 * "x" - means the opcode is invalid in amd64, but not IA32
291 * "y" - means the operand size is always 64 bits in 64 bit mode
292 * "p" - means push/pop stack operation
293 * "vr" - means VEX instruction that operates on normal registers, not fpu
294 * "vo" - means VEX instruction that operates on opmask registers, not fpu
295 */
297 #if defined(DIS_TEXT) && defined(DIS_MEM)
300 #define TNS(name, amode) {TERM, amode, name, 0, 0, 0, 0, 0, 0}
301 #define TNSu(name, amode) {TERM, amode, name, 0, 0, 0, 0, 1, 0}
302 #define TNSx(name, amode) {TERM, amode, name, 0, 0, 1, 0, 0, 0}
303 #define TNSy(name, amode) {TERM, amode, name, 0, 0, 0, 1, 0, 0}
304 #define TNSyp(name, amode) {TERM, amode, name, 0, 0, 0, 1, 0, 1}
305 #define TNSZ(name, amode, sz) {TERM, amode, name, 0, sz, 0, 0, 0, 0}
306 #define TNSZy(name, amode, sz) {TERM, amode, name, 0, sz, 0, 1, 0, 0}
307 #define TNSZvr(name, amode, sz) {TERM, amode, name, 0, sz, 0, 0, 0, 0, 1}
308 #define TSavo(name, amode) {TERM, amode, name, 1, 0, 0, 0, 0, 0, 0, 1, 1}
309 #define TSvo(name, amode) {TERM, amode, name, 1, 0, 0, 0, 0, 0, 0, 0, 1}
310 #define TS(name, amode) {TERM, amode, name, 1, 0, 0, 0, 0, 0}
311 #define TSx(name, amode) {TERM, amode, name, 1, 0, 1, 0, 0, 0}
312 #define TSy(name, amode) {TERM, amode, name, 1, 0, 0, 1, 0, 0}
313 #define TSp(name, amode) {TERM, amode, name, 1, 0, 0, 0, 0, 1}
314 #define TSZ(name, amode, sz) {TERM, amode, name, 1, sz, 0, 0, 0, 0}
315 #define TSaZ(name, amode, sz) {TERM, amode, name, 1, sz, 0, 0, 0, 0, 0, 1}
316 #define TSZx(name, amode, sz) {TERM, amode, name, 1, sz, 1, 0, 0, 0}
317 #define TSZy(name, amode, sz) {TERM, amode, name, 1, sz, 0, 1, 0, 0}
319 #elif defined(DIS_TEXT)
322 #define TNS(name, amode) {TERM, amode, name, 0, 0, 0, 0, 0}
323 #define TNSu(name, amode) {TERM, amode, name, 0, 0, 0, 1, 0}
324 #define TNSx(name, amode) {TERM, amode, name, 0, 1, 0, 0, 0}
325 #define TNSy(name, amode) {TERM, amode, name, 0, 0, 1, 0, 0}
326 #define TNSyp(name, amode) {TERM, amode, name, 0, 0, 1, 0, 1}
327 #define TNSZ(name, amode, sz) {TERM, amode, name, 0, 0, 0, 0, 0}
328 #define TNSZy(name, amode, sz) {TERM, amode, name, 0, 0, 1, 0, 0}
329 #define TNSZvr(name, amode, sz) {TERM, amode, name, 0, 0, 0, 0, 0, 1}
330 #define TSvo(name, amode) {TERM, amode, name, 1, 0, 0, 0, 0, 0, 0, 1}
331 #define TS(name, amode) {TERM, amode, name, 1, 0, 0, 0, 0}
332 #define TSx(name, amode) {TERM, amode, name, 1, 1, 0, 0, 0}
333 #define TSy(name, amode) {TERM, amode, name, 1, 0, 1, 0, 0}
334 #define TSp(name, amode) {TERM, amode, name, 1, 0, 0, 0, 1}
335 #define TSZ(name, amode, sz) {TERM, amode, name, 1, 0, 0, 0, 0}
336 #define TSaZ(name, amode, sz) {TERM, amode, name, 1, 0, 0, 0, 0, 0, 1}
337 #define TSZx(name, amode, sz) {TERM, amode, name, 1, 1, 0, 0, 0}
338 #define TSZy(name, amode, sz) {TERM, amode, name, 1, 0, 1, 0, 0}
340 #elif defined(DIS_MEM)
341 #define IND(table) {(instable_t *)table, 0, 0, 0, 0, 0, 0}
342 #define INDx(table) {(instable_t *)table, 0, 0, 1, 0, 0, 0}
343 #define TNS(name, amode) {TERM, amode, 0, 0, 0, 0, 0}
344 #define TNSu(name, amode) {TERM, amode, 0, 0, 0, 1, 0}
345 #define TNSy(name, amode) {TERM, amode, 0, 0, 1, 0, 0}
346 #define TNSyp(name, amode) {TERM, amode, 0, 0, 1, 0, 1}
347 #define TNSx(name, amode) {TERM, amode, 0, 1, 0, 0, 0}
348 #define TNSZ(name, amode, sz) {TERM, amode, sz, 0, 0, 0, 0}
349 #define TNSZy(name, amode, sz) {TERM, amode, sz, 0, 1, 0, 0}
350 #define TNSZvr(name, amode, sz) {TERM, amode, sz, 0, 0, 0, 0, 1}
351 #define TSvo(name, amode) {TERM, amode, 0, 0, 0, 0, 0, 0, 0, 1}
352 #define TS(name, amode) {TERM, amode, 0, 0, 0, 0, 0}
353 #define TSx(name, amode) {TERM, amode, 0, 1, 0, 0, 0}
354 #define TSy(name, amode) {TERM, amode, 0, 0, 1, 0, 0}
355 #define TSp(name, amode) {TERM, amode, 0, 0, 0, 0, 1}
356 #define TSZ(name, amode, sz) {TERM, amode, sz, 0, 0, 0, 0}
357 #define TSaZ(name, amode, sz) {TERM, amode, sz, 0, 0, 0, 0, 0, 1}
358 #define TSZx(name, amode, sz) {TERM, amode, sz, 1, 0, 0, 0}
359 #define TSZy(name, amode, sz) {TERM, amode, sz, 0, 1, 0, 0}
360 #define INVALID {TERM, UNKNOWN, 0, 0, 0, 0, 0}
361 #else
362 #define IND(table) {(instable_t *)table, 0, 0, 0, 0, 0}
363 #define INDx(table) {(instable_t *)table, 0, 1, 0, 0, 0}
364 #define TNS(name, amode) {TERM, amode, 0, 0, 0, 0}
365 #define TNSu(name, amode) {TERM, amode, 0, 0, 1, 0}
366 #define TNSy(name, amode) {TERM, amode, 0, 1, 0, 0}
367 #define TNSyp(name, amode) {TERM, amode, 0, 1, 0, 1}
368 #define TNSx(name, amode) {TERM, amode, 1, 0, 0, 0}
369 #define TNSZ(name, amode, sz) {TERM, amode, 0, 0, 0, 0}
370 #define TNSZy(name, amode, sz) {TERM, amode, 0, 1, 0, 0}
371 #define TNSZvr(name, amode, sz) {TERM, amode, 0, 0, 0, 0, 1}
372 #define TSvo(name, amode) {TERM, amode, 0, 0, 0, 0, 0, 0, 1}
373 #define TS(name, amode) {TERM, amode, 0, 0, 0, 0}
374 #define TSx(name, amode) {TERM, amode, 1, 0, 0, 0}
375 #define TSy(name, amode) {TERM, amode, 0, 1, 0, 0}
376 #define TSp(name, amode) {TERM, amode, 0, 0, 0, 1}
377 #define TSZ(name, amode, sz) {TERM, amode, 0, 0, 0, 0}
378 #define TSaZ(name, amode, sz) {TERM, amode, 0, 0, 0, 0, 0, 1}
379 #define TSZx(name, amode, sz) {TERM, amode, 1, 0, 0, 0}
380 #define TSZy(name, amode, sz) {TERM, amode, 0, 1, 0, 0}
381 #define INVALID {TERM, UNKNOWN, 0, 0, 0, 0}
382 #endif
384 #ifdef DIS_TEXT
385 /*
386 * this decodes the r_m field for mode's 0, 1, 2 in 16 bit mode
387 */
395 };
398 /*
399 * This decodes 32 bit addressing mode r_m field for modes 0, 1, 2
400 */
404 };
409 };
411 /*
412 * This decodes 64 bit addressing mode r_m field for modes 0, 1, 2
413 */
417 };
421 };
423 /*
424 * decode for scale from SIB byte
425 */
428 /*
429 * decode for scale from VSIB byte, note that we always include the scale factor
430 * to match gas.
431 */
434 /*
435 * register decoding for normal references to registers (ie. not addressing)
436 */
440 };
445 };
450 };
455 };
460 };
465 };
470 };
475 };
480 };
491 };
502 };
513 };
517 };
522 };
524 /*
525 * SIMD predicate suffixes
526 */
529 };
532 /*0 1 2 3 4 5 6 7*/
536 };
540 /*
541 * "decode table" for 64 bit mode MOVSXD instruction (opcode 0x63)
542 */
545 /*
546 * "decode table" for pause and clflush instructions
547 */
550 /*
551 * Decode table for 0x0F00 opcodes
552 */
557 };
560 /*
561 * Decode table for 0x0F01 opcodes
562 */
565 /* [0] */ TNSZ("sgdt",VMx,6), TNSZ("sidt",MONITOR_MWAIT,6), TNSZ("lgdt",XGETBV_XSETBV,6), TNSZ("lidt",SVM,6),
567 };
569 /*
570 * Decode table for 0x0F18 opcodes -- SIMD prefetch
571 */
574 /* [0] */ TNS("prefetchnta",PREF),TNS("prefetcht0",PREF), TNS("prefetcht1",PREF), TNS("prefetcht2",PREF),
576 };
578 /*
579 * Decode table for 0x0FAE opcodes -- SIMD state save/restore
580 */
583 /* [4] */ TNSZ("xsave",M,512), TNS("lfence",XMMFENCE), TNS("mfence",XMMFENCE), TNS("sfence",XMMSFNC),
584 };
586 /*
587 * Decode table for 0x0FBA opcodes
588 */
594 };
596 /*
597 * Decode table for 0x0FC7 opcode (group 9)
598 */
604 };
606 /*
607 * Decode table for 0x0FC7 opcode (group 9) mode 3
608 */
614 };
616 /*
617 * Decode table for 0x0FC7 opcode with 0x66 prefix
618 */
624 };
626 /*
627 * Decode table for 0x0FC7 opcode with 0xF3 prefix
628 */
634 };
636 /*
637 * Decode table for 0x0FC8 opcode -- 486 bswap instruction
638 *
639 *bit pattern: 0000 1111 1100 1reg
640 */
643 };
645 /*
646 * Decode table for 0x0F71, 0x0F72, and 0x0F73 opcodes -- MMX instructions
647 */
649 {
652 }, {
655 }, {
658 }, {
661 } };
663 /*
664 * Decode table for SIMD extensions to above 0x0F71-0x0F73 opcodes.
665 */
678 };
680 /*
681 * SIMD instructions have been wedged into the existing IA32 instruction
682 * set through the use of prefixes. That is, while 0xf0 0x58 may be
683 * addps, 0xf3 0xf0 0x58 (literally, repz addps) is a completely different
684 * instruction - addss. At present, three prefixes have been coopted in
685 * this manner - address size (0x66), repnz (0xf2) and repz (0xf3). The
686 * following tables are used to provide the prefixed instruction names.
687 * The arrays are sparse, but they're fast.
688 */
690 /*
691 * Decode table for SIMD instructions with the address size (0x66) prefix.
692 */
699 /* [10] */ TNSZ("movupd",XMM,16), TNSZ("movupd",XMMS,16), TNSZ("movlpd",XMMM,8), TNSZ("movlpd",XMMMS,8),
700 /* [14] */ TNSZ("unpcklpd",XMM,16),TNSZ("unpckhpd",XMM,16),TNSZ("movhpd",XMMM,8), TNSZ("movhpd",XMMMS,8),
706 /* [28] */ TNSZ("movapd",XMM,16), TNSZ("movapd",XMMS,16), TNSZ("cvtpi2pd",XMMOMX,8),TNSZ("movntpd",XMMOMS,16),
707 /* [2C] */ TNSZ("cvttpd2pi",XMMXMM,16),TNSZ("cvtpd2pi",XMMXMM,16),TNSZ("ucomisd",XMM,8),TNSZ("comisd",XMM,8),
720 /* [54] */ TNSZ("andpd",XMM,16), TNSZ("andnpd",XMM,16), TNSZ("orpd",XMM,16), TNSZ("xorpd",XMM,16),
721 /* [58] */ TNSZ("addpd",XMM,16), TNSZ("mulpd",XMM,16), TNSZ("cvtpd2ps",XMM,16),TNSZ("cvtps2dq",XMM,16),
722 /* [5C] */ TNSZ("subpd",XMM,16), TNSZ("minpd",XMM,16), TNSZ("divpd",XMM,16), TNSZ("maxpd",XMM,16),
724 /* [60] */ TNSZ("punpcklbw",XMM,16),TNSZ("punpcklwd",XMM,16),TNSZ("punpckldq",XMM,16),TNSZ("packsswb",XMM,16),
725 /* [64] */ TNSZ("pcmpgtb",XMM,16), TNSZ("pcmpgtw",XMM,16), TNSZ("pcmpgtd",XMM,16), TNSZ("packuswb",XMM,16),
726 /* [68] */ TNSZ("punpckhbw",XMM,16),TNSZ("punpckhwd",XMM,16),TNSZ("punpckhdq",XMM,16),TNSZ("packssdw",XMM,16),
727 /* [6C] */ TNSZ("punpcklqdq",XMM,16),TNSZ("punpckhqdq",XMM,16),TNSZ("movd",XMM3MX,4),TNSZ("movdqa",XMM,16),
732 /* [7C] */ TNSZ("haddpd",XMM,16), TNSZ("hsubpd",XMM,16), TNSZ("movd",XMM3MXS,4), TNSZ("movdqa",XMMS,16),
759 /* [D0] */ TNSZ("addsubpd",XMM,16),TNSZ("psrlw",XMM,16), TNSZ("psrld",XMM,16), TNSZ("psrlq",XMM,16),
760 /* [D4] */ TNSZ("paddq",XMM,16), TNSZ("pmullw",XMM,16), TNSZ("movq",XMMS,8), TNS("pmovmskb",XMMX3),
761 /* [D8] */ TNSZ("psubusb",XMM,16), TNSZ("psubusw",XMM,16), TNSZ("pminub",XMM,16), TNSZ("pand",XMM,16),
762 /* [DC] */ TNSZ("paddusb",XMM,16), TNSZ("paddusw",XMM,16), TNSZ("pmaxub",XMM,16), TNSZ("pandn",XMM,16),
764 /* [E0] */ TNSZ("pavgb",XMM,16), TNSZ("psraw",XMM,16), TNSZ("psrad",XMM,16), TNSZ("pavgw",XMM,16),
765 /* [E4] */ TNSZ("pmulhuw",XMM,16), TNSZ("pmulhw",XMM,16), TNSZ("cvttpd2dq",XMM,16),TNSZ("movntdq",XMMS,16),
766 /* [E8] */ TNSZ("psubsb",XMM,16), TNSZ("psubsw",XMM,16), TNSZ("pminsw",XMM,16), TNSZ("por",XMM,16),
767 /* [EC] */ TNSZ("paddsb",XMM,16), TNSZ("paddsw",XMM,16), TNSZ("pmaxsw",XMM,16), TNSZ("pxor",XMM,16),
770 /* [F4] */ TNSZ("pmuludq",XMM,16), TNSZ("pmaddwd",XMM,16), TNSZ("psadbw",XMM,16), TNSZ("maskmovdqu", XMMXIMPL,16),
771 /* [F8] */ TNSZ("psubb",XMM,16), TNSZ("psubw",XMM,16), TNSZ("psubd",XMM,16), TNSZ("psubq",XMM,16),
773 };
781 /* [10] */ TNSZ("vmovupd",VEX_MX,16), TNSZ("vmovupd",VEX_RX,16), TNSZ("vmovlpd",VEX_RMrX,8), TNSZ("vmovlpd",VEX_RM,8),
782 /* [14] */ TNSZ("vunpcklpd",VEX_RMrX,16),TNSZ("vunpckhpd",VEX_RMrX,16),TNSZ("vmovhpd",VEX_RMrX,8), TNSZ("vmovhpd",VEX_RM,8),
788 /* [28] */ TNSZ("vmovapd",VEX_MX,16), TNSZ("vmovapd",VEX_RX,16), INVALID, TNSZ("vmovntpd",VEX_RM,16),
797 /* [44] */ TSvo("knot",VEX_MX), TSvo("kor",VEX_RMX), TSvo("kxnor",VEX_RMX), TSvo("kxor",VEX_RMX),
802 /* [54] */ TNSZ("vandpd",VEX_RMrX,16), TNSZ("vandnpd",VEX_RMrX,16), TNSZ("vorpd",VEX_RMrX,16), TNSZ("vxorpd",VEX_RMrX,16),
803 /* [58] */ TNSZ("vaddpd",VEX_RMrX,16), TNSZ("vmulpd",VEX_RMrX,16), TNSZ("vcvtpd2ps",VEX_MX,16),TNSZ("vcvtps2dq",VEX_MX,16),
804 /* [5C] */ TNSZ("vsubpd",VEX_RMrX,16), TNSZ("vminpd",VEX_RMrX,16), TNSZ("vdivpd",VEX_RMrX,16), TNSZ("vmaxpd",VEX_RMrX,16),
806 /* [60] */ TNSZ("vpunpcklbw",VEX_RMrX,16),TNSZ("vpunpcklwd",VEX_RMrX,16),TNSZ("vpunpckldq",VEX_RMrX,16),TNSZ("vpacksswb",VEX_RMrX,16),
807 /* [64] */ TNSZ("vpcmpgtb",VEX_RMrX,16), TNSZ("vpcmpgtw",VEX_RMrX,16), TNSZ("vpcmpgtd",VEX_RMrX,16), TNSZ("vpackuswb",VEX_RMrX,16),
808 /* [68] */ TNSZ("vpunpckhbw",VEX_RMrX,16),TNSZ("vpunpckhwd",VEX_RMrX,16),TNSZ("vpunpckhdq",VEX_RMrX,16),TNSZ("vpackssdw",VEX_RMrX,16),
809 /* [6C] */ TNSZ("vpunpcklqdq",VEX_RMrX,16),TNSZ("vpunpckhqdq",VEX_RMrX,16),TNSZ("vmovd",VEX_MX,4),TNSZ("vmovdqa",VEX_MX,16),
811 /* [70] */ TNSZ("vpshufd",VEX_MXI,16), TNSZ("vgrp71",VEX_XXI,16), TNSZ("vgrp72",VEX_XXI,16), TNSZ("vgrp73",VEX_XXI,16),
812 /* [74] */ TNSZ("vpcmpeqb",VEX_RMrX,16), TNSZ("vpcmpeqw",VEX_RMrX,16), TNSZ("vpcmpeqd",VEX_RMrX,16), INVALID,
814 /* [7C] */ TNSZ("vhaddpd",VEX_RMrX,16), TNSZ("vhsubpd",VEX_RMrX,16), TNSZ("vmovd",VEX_RR,4), TNSZ("vmovdqa",VEX_RX,16),
821 /* [90] */ TSvo("kmov",VEX_KRM), TSvo("kmov",VEX_KMR), TSvo("kmov",VEX_KRR), TSvo("kmov",VEX_MR),
837 /* [C4] */ TNSZ("vpinsrw",VEX_RMRX,2),TNS("vpextrw",VEX_MR), TNSZ("vshufpd",VEX_RMRX,16), INVALID,
841 /* [D0] */ TNSZ("vaddsubpd",VEX_RMrX,16),TNSZ("vpsrlw",VEX_RMrX,16), TNSZ("vpsrld",VEX_RMrX,16), TNSZ("vpsrlq",VEX_RMrX,16),
842 /* [D4] */ TNSZ("vpaddq",VEX_RMrX,16), TNSZ("vpmullw",VEX_RMrX,16), TNSZ("vmovq",VEX_RX,8), TNS("vpmovmskb",VEX_MR),
843 /* [D8] */ TNSZ("vpsubusb",VEX_RMrX,16), TNSZ("vpsubusw",VEX_RMrX,16), TNSZ("vpminub",VEX_RMrX,16), TNSZ("vpand",VEX_RMrX,16),
844 /* [DC] */ TNSZ("vpaddusb",VEX_RMrX,16), TNSZ("vpaddusw",VEX_RMrX,16), TNSZ("vpmaxub",VEX_RMrX,16), TNSZ("vpandn",VEX_RMrX,16),
846 /* [E0] */ TNSZ("vpavgb",VEX_RMrX,16), TNSZ("vpsraw",VEX_RMrX,16), TNSZ("vpsrad",VEX_RMrX,16), TNSZ("vpavgw",VEX_RMrX,16),
847 /* [E4] */ TNSZ("vpmulhuw",VEX_RMrX,16), TNSZ("vpmulhw",VEX_RMrX,16), TNSZ("vcvttpd2dq",VEX_MX,16),TNSZ("vmovntdq",VEX_RM,16),
848 /* [E8] */ TNSZ("vpsubsb",VEX_RMrX,16), TNSZ("vpsubsw",VEX_RMrX,16), TNSZ("vpminsw",VEX_RMrX,16), TNSZ("vpor",VEX_RMrX,16),
849 /* [EC] */ TNSZ("vpaddsb",VEX_RMrX,16), TNSZ("vpaddsw",VEX_RMrX,16), TNSZ("vpmaxsw",VEX_RMrX,16), TNSZ("vpxor",VEX_RMrX,16),
851 /* [F0] */ INVALID, TNSZ("vpsllw",VEX_RMrX,16), TNSZ("vpslld",VEX_RMrX,16), TNSZ("vpsllq",VEX_RMrX,16),
852 /* [F4] */ TNSZ("vpmuludq",VEX_RMrX,16), TNSZ("vpmaddwd",VEX_RMrX,16), TNSZ("vpsadbw",VEX_RMrX,16), TNS("vmaskmovdqu",VEX_MX),
853 /* [F8] */ TNSZ("vpsubb",VEX_RMrX,16), TNSZ("vpsubw",VEX_RMrX,16), TNSZ("vpsubd",VEX_RMrX,16), TNSZ("vpsubq",VEX_RMrX,16),
854 /* [FC] */ TNSZ("vpaddb",VEX_RMrX,16), TNSZ("vpaddw",VEX_RMrX,16), TNSZ("vpaddd",VEX_RMrX,16), INVALID,
855 };
857 /*
858 * Decode table for SIMD instructions with the repnz (0xf2) prefix.
859 */
940 };
948 /* [10] */ TNSZ("vmovsd",VEX_RMrX,8), TNSZ("vmovsd",VEX_RRX,8), TNSZ("vmovddup",VEX_MX,8), INVALID,
970 /* [58] */ TNSZ("vaddsd",VEX_RMrX,8), TNSZ("vmulsd",VEX_RMrX,8), TNSZ("vcvtsd2ss",VEX_RMrX,8), INVALID,
971 /* [5C] */ TNSZ("vsubsd",VEX_RMrX,8), TNSZ("vminsd",VEX_RMrX,8), TNSZ("vdivsd",VEX_RMrX,8), TNSZ("vmaxsd",VEX_RMrX,8),
1022 };
1104 };
1183 /* [F4] */ INVALID, TNSZvr("pdep",VEX_RMrX,5),TNSZvr("mulx",VEX_RMrX,5),TNSZvr("shrx",VEX_VRMrX,5),
1186 };
1268 };
1269 /*
1270 * Decode table for SIMD instructions with the repz (0xf3) prefix.
1271 */
1300 /* [58] */ TNSZ("addss",XMM,4), TNSZ("mulss",XMM,4), TNSZ("cvtss2sd",XMM,4), TNSZ("cvttps2dq",XMM,16),
1352 };
1360 /* [10] */ TNSZ("vmovss",VEX_RMrX,4), TNSZ("vmovss",VEX_RRX,4), TNSZ("vmovsldup",VEX_MX,4), INVALID,
1380 /* [50] */ INVALID, TNSZ("vsqrtss",VEX_RMrX,4), TNSZ("vrsqrtss",VEX_RMrX,4), TNSZ("vrcpss",VEX_RMrX,4),
1382 /* [58] */ TNSZ("vaddss",VEX_RMrX,4), TNSZ("vmulss",VEX_RMrX,4), TNSZ("vcvtss2sd",VEX_RMrX,4), TNSZ("vcvttps2dq",VEX_MX,16),
1383 /* [5C] */ TNSZ("vsubss",VEX_RMrX,4), TNSZ("vminss",VEX_RMrX,4), TNSZ("vdivss",VEX_RMrX,4), TNSZ("vmaxss",VEX_RMrX,4),
1434 };
1436 /*
1437 * Table for instructions with an EVEX prefix.
1438 */
1519 };
1521 /*
1522 * The following two tables are used to encode crc32 and movbe
1523 * since they share the same opcodes.
1524 */
1528 };
1533 };
1535 /*
1536 * The following table is used to distinguish between adox and adcx which share
1537 * the same opcodes.
1538 */
1542 };
1545 /* [00] */ TNSZ("pshufb",XMM_66o,16),TNSZ("phaddw",XMM_66o,16),TNSZ("phaddd",XMM_66o,16),TNSZ("phaddsw",XMM_66o,16),
1546 /* [04] */ TNSZ("pmaddubsw",XMM_66o,16),TNSZ("phsubw",XMM_66o,16), TNSZ("phsubd",XMM_66o,16),TNSZ("phsubsw",XMM_66o,16),
1547 /* [08] */ TNSZ("psignb",XMM_66o,16),TNSZ("psignw",XMM_66o,16),TNSZ("psignd",XMM_66o,16),TNSZ("pmulhrsw",XMM_66o,16),
1551 /* [14] */ TNSZ("blendvps",XMM_66r,16),TNSZ("blendvpd",XMM_66r,16),INVALID, TNSZ("ptest",XMM_66r,16),
1555 /* [20] */ TNSZ("pmovsxbw",XMM_66r,16),TNSZ("pmovsxbd",XMM_66r,16),TNSZ("pmovsxbq",XMM_66r,16),TNSZ("pmovsxwd",XMM_66r,16),
1557 /* [28] */ TNSZ("pmuldq",XMM_66r,16),TNSZ("pcmpeqq",XMM_66r,16),TNSZ("movntdqa",XMMM_66r,16),TNSZ("packusdw",XMM_66r,16),
1560 /* [30] */ TNSZ("pmovzxbw",XMM_66r,16),TNSZ("pmovzxbd",XMM_66r,16),TNSZ("pmovzxbq",XMM_66r,16),TNSZ("pmovzxwd",XMM_66r,16),
1561 /* [34] */ TNSZ("pmovzxwq",XMM_66r,16),TNSZ("pmovzxdq",XMM_66r,16),INVALID, TNSZ("pcmpgtq",XMM_66r,16),
1562 /* [38] */ TNSZ("pminsb",XMM_66r,16),TNSZ("pminsd",XMM_66r,16),TNSZ("pminuw",XMM_66r,16),TNSZ("pminud",XMM_66r,16),
1563 /* [3C] */ TNSZ("pmaxsb",XMM_66r,16),TNSZ("pmaxsd",XMM_66r,16),TNSZ("pmaxuw",XMM_66r,16),TNSZ("pmaxud",XMM_66r,16),
1607 /* [C8] */ TNSZ("sha1nexte",XMM,16),TNSZ("sha1msg1",XMM,16),TNSZ("sha1msg2",XMM,16),TNSZ("sha256rnds2",XMM,16),
1613 /* [DC] */ TNSZ("aesenc",XMM_66r,16),TNSZ("aesenclast",XMM_66r,16),TNSZ("aesdec",XMM_66r,16),TNSZ("aesdeclast",XMM_66r,16),
1623 };
1626 /* [00] */ TNSZ("vpshufb",VEX_RMrX,16),TNSZ("vphaddw",VEX_RMrX,16),TNSZ("vphaddd",VEX_RMrX,16),TNSZ("vphaddsw",VEX_RMrX,16),
1627 /* [04] */ TNSZ("vpmaddubsw",VEX_RMrX,16),TNSZ("vphsubw",VEX_RMrX,16), TNSZ("vphsubd",VEX_RMrX,16),TNSZ("vphsubsw",VEX_RMrX,16),
1628 /* [08] */ TNSZ("vpsignb",VEX_RMrX,16),TNSZ("vpsignw",VEX_RMrX,16),TNSZ("vpsignd",VEX_RMrX,16),TNSZ("vpmulhrsw",VEX_RMrX,16),
1629 /* [0C] */ TNSZ("vpermilps",VEX_RMrX,8),TNSZ("vpermilpd",VEX_RMrX,16),TNSZ("vtestps",VEX_RRI,8), TNSZ("vtestpd",VEX_RRI,16),
1633 /* [18] */ TNSZ("vbroadcastss",VEX_MX,4),TNSZ("vbroadcastsd",VEX_MX,8),TNSZ("vbroadcastf128",VEX_MX,16),INVALID,
1636 /* [20] */ TNSZ("vpmovsxbw",VEX_MX,16),TNSZ("vpmovsxbd",VEX_MX,16),TNSZ("vpmovsxbq",VEX_MX,16),TNSZ("vpmovsxwd",VEX_MX,16),
1638 /* [28] */ TNSZ("vpmuldq",VEX_RMrX,16),TNSZ("vpcmpeqq",VEX_RMrX,16),TNSZ("vmovntdqa",VEX_MX,16),TNSZ("vpackusdw",VEX_RMrX,16),
1639 /* [2C] */ TNSZ("vmaskmovps",VEX_RMrX,8),TNSZ("vmaskmovpd",VEX_RMrX,16),TNSZ("vmaskmovps",VEX_RRM,8),TNSZ("vmaskmovpd",VEX_RRM,16),
1641 /* [30] */ TNSZ("vpmovzxbw",VEX_MX,16),TNSZ("vpmovzxbd",VEX_MX,16),TNSZ("vpmovzxbq",VEX_MX,16),TNSZ("vpmovzxwd",VEX_MX,16),
1642 /* [34] */ TNSZ("vpmovzxwq",VEX_MX,16),TNSZ("vpmovzxdq",VEX_MX,16),TNSZ("vpermd",VEX_RMrX,16),TNSZ("vpcmpgtq",VEX_RMrX,16),
1643 /* [38] */ TNSZ("vpminsb",VEX_RMrX,16),TNSZ("vpminsd",VEX_RMrX,16),TNSZ("vpminuw",VEX_RMrX,16),TNSZ("vpminud",VEX_RMrX,16),
1644 /* [3C] */ TNSZ("vpmaxsb",VEX_RMrX,16),TNSZ("vpmaxsd",VEX_RMrX,16),TNSZ("vpmaxuw",VEX_RMrX,16),TNSZ("vpmaxud",VEX_RMrX,16),
1647 /* [44] */ INVALID, TSaZ("vpsrlv",VEX_RMrX,16),TNSZ("vpsravd",VEX_RMrX,16),TSaZ("vpsllv",VEX_RMrX,16),
1653 /* [58] */ TNSZ("vpbroadcastd",VEX_MX,16),TNSZ("vpbroadcastq",VEX_MX,16),TNSZ("vbroadcasti128",VEX_MX,16),INVALID,
1671 /* [90] */ TNSZ("vpgatherd",VEX_SbVM,16),TNSZ("vpgatherq",VEX_SbVM,16),TNSZ("vgatherdp",VEX_SbVM,16),TNSZ("vgatherqp",VEX_SbVM,16),
1673 /* [98] */ TNSZ("vfmadd132p",FMA,16),TNSZ("vfmadd132s",FMA,16),TNSZ("vfmsub132p",FMA,16),TNSZ("vfmsub132s",FMA,16),
1674 /* [9C] */ TNSZ("vfnmadd132p",FMA,16),TNSZ("vfnmadd132s",FMA,16),TNSZ("vfnmsub132p",FMA,16),TNSZ("vfnmsub132s",FMA,16),
1678 /* [A8] */ TNSZ("vfmadd213p",FMA,16),TNSZ("vfmadd213s",FMA,16),TNSZ("vfmsub213p",FMA,16),TNSZ("vfmsub213s",FMA,16),
1679 /* [AC] */ TNSZ("vfnmadd213p",FMA,16),TNSZ("vfnmadd213s",FMA,16),TNSZ("vfnmsub213p",FMA,16),TNSZ("vfnmsub213s",FMA,16),
1683 /* [B8] */ TNSZ("vfmadd231p",FMA,16),TNSZ("vfmadd231s",FMA,16),TNSZ("vfmsub231p",FMA,16),TNSZ("vfmsub231s",FMA,16),
1684 /* [BC] */ TNSZ("vfnmadd231p",FMA,16),TNSZ("vfnmadd231s",FMA,16),TNSZ("vfnmsub231p",FMA,16),TNSZ("vfnmsub231s",FMA,16),
1694 /* [DC] */ TNSZ("vaesenc",VEX_RMrX,16),TNSZ("vaesenclast",VEX_RMrX,16),TNSZ("vaesdec",VEX_RMrX,16),TNSZ("vaesdeclast",VEX_RMrX,16),
1704 };
1709 /* [08] */ TNSZ("roundps",XMMP_66r,16),TNSZ("roundpd",XMMP_66r,16),TNSZ("roundss",XMMP_66r,16),TNSZ("roundsd",XMMP_66r,16),
1710 /* [0C] */ TNSZ("blendps",XMMP_66r,16),TNSZ("blendpd",XMMP_66r,16),TNSZ("pblendw",XMMP_66r,16),TNSZ("palignr",XMMP_66o,16),
1713 /* [14] */ TNSZ("pextrb",XMM3PM_66r,8),TNSZ("pextrw",XMM3PM_66r,16),TSZ("pextr",XMM3PM_66r,16),TNSZ("extractps",XMM3PM_66r,16),
1717 /* [20] */ TNSZ("pinsrb",XMMPRM_66r,8),TNSZ("insertps",XMMP_66r,16),TSZ("pinsr",XMMPRM_66r,16),INVALID,
1727 /* [40] */ TNSZ("dpps",XMMP_66r,16),TNSZ("dppd",XMMP_66r,16),TNSZ("mpsadbw",XMMP_66r,16),INVALID,
1737 /* [60] */ TNSZ("pcmpestrm",XMMP_66r,16),TNSZ("pcmpestri",XMMP_66r,16),TNSZ("pcmpistrm",XMMP_66r,16),TNSZ("pcmpistri",XMMP_66r,16),
1786 };
1789 /* [00] */ TNSZ("vpermq",VEX_MXI,16),TNSZ("vpermpd",VEX_MXI,16),TNSZ("vpblendd",VEX_RMRX,16),INVALID,
1790 /* [04] */ TNSZ("vpermilps",VEX_MXI,8),TNSZ("vpermilpd",VEX_MXI,16),TNSZ("vperm2f128",VEX_RMRX,16),INVALID,
1791 /* [08] */ TNSZ("vroundps",VEX_MXI,16),TNSZ("vroundpd",VEX_MXI,16),TNSZ("vroundss",VEX_RMRX,16),TNSZ("vroundsd",VEX_RMRX,16),
1792 /* [0C] */ TNSZ("vblendps",VEX_RMRX,16),TNSZ("vblendpd",VEX_RMRX,16),TNSZ("vpblendw",VEX_RMRX,16),TNSZ("vpalignr",VEX_RMRX,16),
1795 /* [14] */ TNSZ("vpextrb",VEX_RRi,8),TNSZ("vpextrw",VEX_RRi,16),TNSZ("vpextrd",VEX_RRi,16),TNSZ("vextractps",VEX_RM,16),
1799 /* [20] */ TNSZ("vpinsrb",VEX_RMRX,8),TNSZ("vinsertps",VEX_RMRX,16),TNSZ("vpinsrd",VEX_RMRX,16),INVALID,
1804 /* [30] */ TSvo("kshiftr",VEX_MXI), TSvo("kshiftr",VEX_MXI), TSvo("kshiftl",VEX_MXI), TSvo("kshiftl",VEX_MXI),
1809 /* [40] */ TNSZ("vdpps",VEX_RMRX,16),TNSZ("vdppd",VEX_RMRX,16),TNSZ("vmpsadbw",VEX_RMRX,16),INVALID,
1819 /* [60] */ TNSZ("vpcmpestrm",VEX_MXI,16),TNSZ("vpcmpestri",VEX_MXI,16),TNSZ("vpcmpistrm",VEX_MXI,16),TNSZ("vpcmpistri",VEX_MXI,16),
1868 };
1870 /*
1871 * Decode table for 0x0F0D which uses the first byte of the mod_rm to
1872 * indicate a sub-code.
1873 */
1877 };
1879 /*
1880 * Decode table for 0x0F opcodes
1881 */
1884 {
1889 }, {
1890 /* [10] */ TNSZ("movups",XMMO,16), TNSZ("movups",XMMOS,16),TNSZ("movlps",XMMO,8), TNSZ("movlps",XMMOS,8),
1891 /* [14] */ TNSZ("unpcklps",XMMO,16),TNSZ("unpckhps",XMMO,16),TNSZ("movhps",XMMOM,8),TNSZ("movhps",XMMOMS,8),
1894 }, {
1897 /* [28] */ TNSZ("movaps",XMMO,16), TNSZ("movaps",XMMOS,16),TNSZ("cvtpi2ps",XMMOMX,8),TNSZ("movntps",XMMOS,16),
1898 /* [2C] */ TNSZ("cvttps2pi",XMMOXMM,8),TNSZ("cvtps2pi",XMMOXMM,8),TNSZ("ucomiss",XMMO,4),TNSZ("comiss",XMMO,4),
1899 }, {
1904 }, {
1909 }, {
1910 /* [50] */ TNS("movmskps",XMMOX3), TNSZ("sqrtps",XMMO,16), TNSZ("rsqrtps",XMMO,16),TNSZ("rcpps",XMMO,16),
1911 /* [54] */ TNSZ("andps",XMMO,16), TNSZ("andnps",XMMO,16), TNSZ("orps",XMMO,16), TNSZ("xorps",XMMO,16),
1912 /* [58] */ TNSZ("addps",XMMO,16), TNSZ("mulps",XMMO,16), TNSZ("cvtps2pd",XMMO,8),TNSZ("cvtdq2ps",XMMO,16),
1913 /* [5C] */ TNSZ("subps",XMMO,16), TNSZ("minps",XMMO,16), TNSZ("divps",XMMO,16), TNSZ("maxps",XMMO,16),
1914 }, {
1915 /* [60] */ TNSZ("punpcklbw",MMO,4),TNSZ("punpcklwd",MMO,4),TNSZ("punpckldq",MMO,4),TNSZ("packsswb",MMO,8),
1916 /* [64] */ TNSZ("pcmpgtb",MMO,8), TNSZ("pcmpgtw",MMO,8), TNSZ("pcmpgtd",MMO,8), TNSZ("packuswb",MMO,8),
1917 /* [68] */ TNSZ("punpckhbw",MMO,8),TNSZ("punpckhwd",MMO,8),TNSZ("punpckhdq",MMO,8),TNSZ("packssdw",MMO,8),
1918 /* [6C] */ TNSZ("INVALID",MMO,0), TNSZ("INVALID",MMO,0), TNSZ("movd",MMO,4), TNSZ("movq",MMO,8),
1919 }, {
1921 /* [74] */ TNSZ("pcmpeqb",MMO,8), TNSZ("pcmpeqw",MMO,8), TNSZ("pcmpeqd",MMO,8), TNS("emms",NORM),
1924 }, {
1929 }, {
1934 }, {
1939 }, {
1944 }, {
1946 /* [C4] */ TNSZ("pinsrw",MMOPRM,2),TNS("pextrw",MMO3P), TNSZ("shufps",XMMOPM,16),IND(dis_op0FC7),
1949 }, {
1951 /* [D4] */ TNSZ("paddq",MMO,8), TNSZ("pmullw",MMO,8), TNSZ("INVALID",MMO,0), TNS("pmovmskb",MMOM3),
1952 /* [D8] */ TNSZ("psubusb",MMO,8), TNSZ("psubusw",MMO,8), TNSZ("pminub",MMO,8), TNSZ("pand",MMO,8),
1953 /* [DC] */ TNSZ("paddusb",MMO,8), TNSZ("paddusw",MMO,8), TNSZ("pmaxub",MMO,8), TNSZ("pandn",MMO,8),
1954 }, {
1956 /* [E4] */ TNSZ("pmulhuw",MMO,8), TNSZ("pmulhw",MMO,8), TNS("INVALID",XMMO), TNSZ("movntq",MMOMS,8),
1957 /* [E8] */ TNSZ("psubsb",MMO,8), TNSZ("psubsw",MMO,8), TNSZ("pminsw",MMO,8), TNSZ("por",MMO,8),
1958 /* [EC] */ TNSZ("paddsb",MMO,8), TNSZ("paddsw",MMO,8), TNSZ("pmaxsw",MMO,8), TNSZ("pxor",MMO,8),
1959 }, {
1961 /* [F4] */ TNSZ("pmuludq",MMO,8), TNSZ("pmaddwd",MMO,8), TNSZ("psadbw",MMO,8), TNSZ("maskmovq",MMOIMPL,8),
1964 } };
1967 {
1972 }, {
1973 /* [10] */ TNSZ("vmovups",VEX_MX,16), TNSZ("vmovups",VEX_RM,16),TNSZ("vmovlps",VEX_RMrX,8), TNSZ("vmovlps",VEX_RM,8),
1974 /* [14] */ TNSZ("vunpcklps",VEX_RMrX,16),TNSZ("vunpckhps",VEX_RMrX,16),TNSZ("vmovhps",VEX_RMrX,8),TNSZ("vmovhps",VEX_RM,8),
1977 }, {
1980 /* [28] */ TNSZ("vmovaps",VEX_MX,16), TNSZ("vmovaps",VEX_RX,16),INVALID, TNSZ("vmovntps",VEX_RM,16),
1982 }, {
1987 }, {
1989 /* [44] */ TSvo("knot",VEX_MX), TSvo("kor",VEX_RMX), TSvo("kxnor",VEX_RMX), TSvo("kxor",VEX_RMX),
1992 }, {
1993 /* [50] */ TNS("vmovmskps",VEX_MR), TNSZ("vsqrtps",VEX_MX,16), TNSZ("vrsqrtps",VEX_MX,16),TNSZ("vrcpps",VEX_MX,16),
1994 /* [54] */ TNSZ("vandps",VEX_RMrX,16), TNSZ("vandnps",VEX_RMrX,16), TNSZ("vorps",VEX_RMrX,16), TNSZ("vxorps",VEX_RMrX,16),
1995 /* [58] */ TNSZ("vaddps",VEX_RMrX,16), TNSZ("vmulps",VEX_RMrX,16), TNSZ("vcvtps2pd",VEX_MX,8),TNSZ("vcvtdq2ps",VEX_MX,16),
1996 /* [5C] */ TNSZ("vsubps",VEX_RMrX,16), TNSZ("vminps",VEX_RMrX,16), TNSZ("vdivps",VEX_RMrX,16), TNSZ("vmaxps",VEX_RMrX,16),
1997 }, {
2002 }, {
2007 }, {
2012 }, {
2013 /* [90] */ TSvo("kmov",VEX_KRM), TSvo("kmov",VEX_KMR), TSvo("kmov",VEX_KRR), TSvo("kmov",VEX_MR),
2017 }, {
2022 }, {
2027 }, {
2032 }, {
2037 }, {
2042 }, {
2047 } };
2049 /*
2050 * Decode table for 0x80 opcodes
2051 */
2057 };
2060 /*
2061 * Decode table for 0x81 opcodes.
2062 */
2068 };
2071 /*
2072 * Decode table for 0x82 opcodes.
2073 */
2079 };
2080 /*
2081 * Decode table for 0x83 opcodes.
2082 */
2088 };
2090 /*
2091 * Decode table for 0xC0 opcodes.
2092 */
2098 };
2100 /*
2101 * Decode table for 0xD0 opcodes.
2102 */
2108 };
2110 /*
2111 * Decode table for 0xC1 opcodes.
2112 * 186 instruction set
2113 */
2119 };
2121 /*
2122 * Decode table for 0xD1 opcodes.
2123 */
2129 };
2132 /*
2133 * Decode table for 0xD2 opcodes.
2134 */
2140 };
2141 /*
2142 * Decode table for 0xD3 opcodes.
2143 */
2149 };
2152 /*
2153 * Decode table for 0xF6 opcodes.
2154 */
2160 };
2163 /*
2164 * Decode table for 0xF7 opcodes.
2165 */
2171 };
2174 /*
2175 * Decode table for 0xFE opcodes.
2176 */
2182 };
2183 /*
2184 * Decode table for 0xFF opcodes.
2185 */
2191 };
2193 /* for 287 instructions, which are a mess to decode */
2196 {
2197 /* bit pattern: 1101 1xxx MODxx xR/M */
2200 }, {
2203 }, {
2206 }, {
2209 }, {
2212 }, {
2215 }, {
2218 }, {
2221 } };
2224 {
2225 /* bit pattern: 1101 1xxx 11xx xREG */
2228 }, {
2231 }, {
2234 }, {
2237 }, {
2240 }, {
2243 }, {
2246 }, {
2249 } };
2252 {
2253 /* bit pattern: 1101 1001 111x xxxx */
2256 }, {
2259 }, {
2262 }, {
2265 } };
2268 /* bit pattern: 1101 1011 111x xxxx */
2271 };
2274 /* bit pattern: 1101 1011 11yy yxxx */
2277 };
2280 /* bit pattern: 1101 1010 11yy yxxx */
2283 };
2285 /*
2286 * Main decode table for the op codes. The first two nibbles
2287 * will be used as an index into the table. If there is a
2288 * a need to further decode an instruction, the array to be
2289 * referenced is indicated with the other two entries being
2290 * empty.
2291 */
2294 {
2299 }, {
2304 }, {
2309 }, {
2314 }, {
2319 }, {
2324 }, {
2325 /* [6,0] */ TSZx("pusha",IMPLMEM,28),TSZx("popa",IMPLMEM,28), TSx("bound",RM), TNS("arpl",RMw),
2328 /* [6,C] */ TNSZ("insb",IMPLMEM,1), TSZ("ins",IMPLMEM,4), TNSZ("outsb",IMPLMEM,1),TSZ("outs",IMPLMEM,4),
2329 }, {
2334 }, {
2339 }, {
2343 /* [9,C] */ TSZy("pushf",IMPLMEM,4),TSZy("popf",IMPLMEM,4), TNS("sahf",NORM), TNS("lahf",NORM),
2344 }, {
2349 }, {
2354 }, {
2359 }, {
2363 /* 287 instructions. Note that although the indirect field */
2364 /* indicates opFP1n2 for further decoding, this is not necessarily */
2365 /* the case since the opFP arrays are not partitioned according to key1 */
2366 /* and key2. opFP1n2 is given only to indicate that we haven't */
2367 /* finished decoding the instruction. */
2370 }, {
2375 }, {
2380 } };
2382 /* END CSTYLED */
2384 /*
2385 * common functions to decode and disassemble an x86 or amd64 instruction
2386 */
2388 /*
2389 * These are the individual fields of a REX prefix. Note that a REX
2390 * prefix with none of these set is still needed to:
2391 * - use the MOVSXD (sign extend 32 to 64 bits) instruction
2392 * - access the %sil, %dil, %bpl, %spl registers
2393 */
2399 /*
2400 * These are the individual fields of a VEX/EVEX prefix.
2401 */
2406 /* Additional EVEX prefix definitions */
2411 /* Vector Length, 0: scalar or 128-bit vector, 1: 256-bit vector */
2412 #define VEX_L 0x04
2413 /* Vector Length, 0: scalar or 128-bit vector, 1: 256-bit vector, 2: 512-bit */
2421 /* VEX m-mmmm field, only used by three bytes prefix */
2426 /* VEX pp field, providing equivalent functionality of a SIMD prefix */
2427 #define VEX_p_66 0x01
2428 #define VEX_p_F3 0x02
2429 #define VEX_p_F2 0x03
2431 /*
2432 * Even in 64 bit mode, usually only 4 byte immediate operands are supported.
2433 */
2437 /*
2438 * Just a bunch of useful macros.
2439 */
2443 #define OPSIZE(osize, wbit) ((wbit) ? isize[osize] : 1)
2444 #define OPSIZE64(osize, wbit) ((wbit) ? isize64[osize] : 1)
2461 /*
2462 * The AVX2 gather instructions are a bit of a mess. While there's a pattern,
2463 * there's not really a consistent scheme that we can use to know what the mode
2464 * is supposed to be for a given type. Various instructions, like VPGATHERDD,
2465 * always match the value of VEX_L. Other instructions like VPGATHERDQ, have
2466 * some registers match VEX_L, but the VSIB is always XMM.
2467 *
2468 * The simplest way to deal with this is to just define a table based on the
2469 * instruction opcodes, which are 0x90-0x93, so we subtract 0x90 to index into
2470 * them.
2471 *
2472 * We further have to subdivide this based on the value of VEX_W and the value
2473 * of VEX_L. The array is constructed to be indexed as:
2474 * [opcode - 0x90][VEX_W][VEX_L].
2475 */
2476 /* w = 0, 0x90 */
2485 {
2486 /* op 0x90, W.0 */
2487 {
2490 },
2491 /* op 0x90, W.1 */
2492 {
2495 }
2496 },
2497 {
2498 /* op 0x91, W.0 */
2499 {
2502 },
2503 /* op 0x91, W.1 */
2504 {
2507 }
2508 },
2509 {
2510 /* op 0x92, W.0 */
2511 {
2514 },
2515 /* op 0x92, W.1 */
2516 {
2519 }
2520 },
2521 {
2522 /* op 0x93, W.0 */
2523 {
2526 },
2527 /* op 0x93, W.1 */
2528 {
2531 }
2532 }
2533 };
2535 /*
2536 * Get the next byte and separate the op code into the high and low nibbles.
2537 */
2538 static int
2540 {
2543 /*
2544 * x86 instructions have a maximum length of 15 bytes. Bail out if
2545 * we try to read more.
2546 */
2559 }
2561 /*
2562 * Get and decode an SIB (scaled index base) byte
2563 */
2564 static void
2566 {
2576 }
2582 }
2584 /*
2585 * Get the byte following the op code and separate it into the
2586 * mode, register, and r/m fields.
2587 */
2588 static void
2590 {
2596 }
2597 }
2599 /*
2600 * Adjust register selection based on any REX prefix bits present.
2601 */
2602 /*ARGSUSED*/
2603 static void
2605 {
2614 }
2615 }
2617 /*
2618 * Adjust register selection based on any VEX prefix bits present.
2619 * Notes: VEX.R, VEX.X and VEX.B use the inverted form compared with REX prefix
2620 */
2621 /*ARGSUSED*/
2622 static void
2624 {
2633 }
2634 }
2636 /*
2637 * Adjust the instruction mnemonic with the appropriate suffix.
2638 */
2639 /* ARGSUSED */
2640 static void
2642 uint_t evex_byte2)
2643 {
2644 #ifdef DIS_TEXT
2647 /* Aligned or Unaligned? */
2651 OPLEN);
2667 }
2668 }
2672 }
2673 #endif
2674 }
2676 /*
2677 * The following three functions adjust the register selection based on any
2678 * EVEX prefix bits present. See Intel 64 and IA-32 Architectures Software
2679 * Developer’s Manual Volume 2 (IASDv2), section 2.6.1 Table 2-30 and
2680 * section 2.6.2 Table 2-31.
2681 */
2682 static void
2684 {
2688 }
2691 }
2692 }
2693 }
2695 static void
2697 {
2701 }
2704 }
2705 }
2706 }
2708 /*
2709 * Use evex_L to set wbit. See IASDv2 Section 2.6.10 and Table 2-36.
2710 */
2711 static void
2713 {
2724 }
2725 }
2727 /*
2728 * Adjust operand value for disp8*N immediate. See IASDv2 Section 2.6.5.
2729 * This currently only handles a subset of the possibilities.
2730 */
2731 static void
2733 {
2739 /* Check disp8 bit in the ModR/M byte */
2743 /* use evex_L to adjust the value */
2754 }
2755 }
2757 /*
2758 * Adjust target for opmask and zeroing. See IASDv2 Section 2.6.1 Table 2-30.
2759 */
2760 /* ARGSUSED */
2761 static void
2763 {
2764 #ifdef DIS_TEXT
2767 #endif
2771 #ifdef DIS_TEXT
2773 /* Append the opmask register to operand 1 */
2777 }
2779 /* Append the 'zeroing' modifier to operand 1 */
2781 }
2783 }
2785 /*
2786 * Get an immediate operand of the given size, with sign extension.
2787 */
2788 static void
2790 {
2807 else
2823 }
2835 }
2838 }
2839 /* Do sign extension */
2844 }
2845 #ifdef DIS_TEXT
2849 #endif
2850 }
2852 /*
2853 * Get an ip relative operand of the given size, with sign extension.
2854 */
2855 static void
2857 {
2859 #ifdef DIS_TEXT
2861 #endif
2862 }
2864 /*
2865 * Check to see if there is a segment override prefix pending.
2866 * If so, print it in the current 'operand' location and set
2867 * the override flag back to false.
2868 */
2869 /*ARGSUSED*/
2870 static void
2872 {
2873 #ifdef DIS_TEXT
2877 }
2878 #endif
2880 }
2883 /*
2884 * Process a single instruction Register or Memory operand.
2885 *
2886 * mode = addressing mode from ModRM byte
2887 * r_m = r_m (or reg if mode == 3) field from ModRM byte
2888 * wbit = indicates which register (8bit, 16bit, ... MMX, etc.) set to use.
2889 * o = index of operand that we are processing (0, 1 or 2)
2890 *
2891 * the value of reg or r_m must have already been adjusted for any REX prefix.
2892 */
2893 /*ARGSUSED*/
2894 static void
2896 {
2902 #ifdef DIS_TEXT
2904 #endif
2912 /*
2913 * first handle a simple register
2914 */
2916 #ifdef DIS_TEXT
2948 else
2959 else
2962 }
2965 }
2967 /*
2968 * if symbolic representation, skip override prefix, if any
2969 */
2972 /*
2973 * Handle 16 bit memory references first, since they decode
2974 * the mode values more simply.
2975 * mode 1 is r_m + 8 bit displacement
2976 * mode 2 is r_m + 16 bit displacement
2977 * mode 0 is just r_m, unless r_m is 6 which is 16 bit disp
2978 */
2984 #ifdef DIS_TEXT
2989 else
2992 #endif
2994 }
2996 /*
2997 * 32 and 64 bit addressing modes are more complex since they
2998 * can involve an SIB (scaled index and base) byte to decode.
2999 */
3012 }
3014 /*
3015 * Compute the displacement size and get its bytes
3016 */
3032 }
3034 #ifdef DIS_TEXT
3042 OPLEN);
3043 else
3045 OPLEN);
3049 OPLEN);
3052 MODE_RIPREL;
3053 }
3056 OPLEN);
3057 }
3058 }
3066 else
3076 }
3081 }
3083 /*
3084 * print the base (if any)
3085 */
3090 }
3095 }
3097 /*
3098 * print the index (if any)
3099 */
3107 }
3108 #endif
3109 }
3111 /*
3112 * Operand sequence for standard instruction involving one register
3113 * and one register/memory operand.
3114 * wbit indicates a byte(0) or opnd_size(1) operation
3115 * vbit indicates direction (0 for "opcode r,r_m") or (1 for "opcode r_m, r")
3116 */
3117 #define STANDARD_MODRM(x, mode, reg, r_m, rex_prefix, wbit, vbit) { \
3118 dtrace_get_modrm(x, &mode, ®, &r_m); \
3119 dtrace_rex_adjust(rex_prefix, mode, ®, &r_m); \
3120 dtrace_get_operand(x, mode, r_m, wbit, vbit); \
3121 dtrace_get_operand(x, REG_ONLY, reg, wbit, 1 - vbit); \
3122 }
3124 /*
3125 * Similar to above, but allows for the two operands to be of different
3126 * classes (ie. wbit).
3127 * wbit is for the r_m operand
3128 * w2 is for the reg operand
3129 */
3130 #define MIXED_MM(x, mode, reg, r_m, rex_prefix, wbit, w2, vbit) { \
3131 dtrace_get_modrm(x, &mode, ®, &r_m); \
3132 dtrace_rex_adjust(rex_prefix, mode, ®, &r_m); \
3133 dtrace_get_operand(x, mode, r_m, wbit, vbit); \
3134 dtrace_get_operand(x, REG_ONLY, reg, w2, 1 - vbit); \
3135 }
3137 /*
3138 * Similar, but for 2 operands plus an immediate.
3139 * vbit indicates direction
3140 * 0 for "opcode imm, r, r_m" or
3141 * 1 for "opcode imm, r_m, r"
3142 */
3143 #define THREEOPERAND(x, mode, reg, r_m, rex_prefix, wbit, w2, immsize, vbit) { \
3144 dtrace_get_modrm(x, &mode, ®, &r_m); \
3145 dtrace_rex_adjust(rex_prefix, mode, ®, &r_m); \
3146 dtrace_get_operand(x, mode, r_m, wbit, 2-vbit); \
3147 dtrace_get_operand(x, REG_ONLY, reg, w2, 1+vbit); \
3148 dtrace_imm_opnd(x, wbit, immsize, 0); \
3149 }
3151 /*
3152 * Similar, but for 2 operands plus two immediates.
3153 */
3154 #define FOUROPERAND(x, mode, reg, r_m, rex_prefix, wbit, w2, immsize) { \
3155 dtrace_get_modrm(x, &mode, ®, &r_m); \
3156 dtrace_rex_adjust(rex_prefix, mode, ®, &r_m); \
3157 dtrace_get_operand(x, mode, r_m, wbit, 2); \
3158 dtrace_get_operand(x, REG_ONLY, reg, w2, 3); \
3159 dtrace_imm_opnd(x, wbit, immsize, 1); \
3160 dtrace_imm_opnd(x, wbit, immsize, 0); \
3161 }
3163 /*
3164 * 1 operands plus two immediates.
3165 */
3166 #define ONEOPERAND_TWOIMM(x, mode, reg, r_m, rex_prefix, wbit, immsize) { \
3167 dtrace_get_modrm(x, &mode, ®, &r_m); \
3168 dtrace_rex_adjust(rex_prefix, mode, ®, &r_m); \
3169 dtrace_get_operand(x, mode, r_m, wbit, 2); \
3170 dtrace_imm_opnd(x, wbit, immsize, 1); \
3171 dtrace_imm_opnd(x, wbit, immsize, 0); \
3172 }
3174 /*
3175 * Dissassemble a single x86 or amd64 instruction.
3176 *
3177 * Mode determines the default operating mode (SIZE16, SIZE32 or SIZE64)
3178 * for interpreting instructions.
3179 *
3180 * returns non-zero for bad opcode
3181 */
3182 int
3184 {
3186 #ifdef DIS_TEXT
3187 uint_t i;
3188 #endif
3189 #ifdef DIS_MEM
3191 #define NOMEM (nomem = 1)
3192 #else
3194 #endif
3199 uint_t vbit;
3215 /*
3216 * legacy prefixes come in 5 flavors, you should have only one of each
3217 */
3225 /*
3226 * Intel VEX instruction encoding prefix and fields
3227 */
3229 /* 0xC4 means 3 bytes prefix, 0xC5 means 2 bytes prefix */
3232 /*
3233 * VEX prefix byte 1, includes vex.r, vex.x and vex.b
3234 * (for 3 bytes prefix)
3235 */
3238 /*
3239 * EVEX prefix byte 1 includes vex.r, vex.x, vex.b and evex.r.
3240 */
3245 /*
3246 * For 32-bit mode, it should prefetch the next byte to
3247 * distinguish between AVX and les/lds
3248 */
3258 uint_t vex_L;
3259 uint_t evex_L;
3260 uint_t evex_modrm;
3263 #ifdef DIS_TEXT
3264 /* Instruction name for BLS* family of instructions */
3266 #endif
3270 instable_t dp_mmx;
3275 #ifdef DIS_TEXT
3285 }
3286 #endif
3301 }
3303 /*
3304 * Get one opcode byte and check for zero padding that follows
3305 * jump tables.
3306 */
3312 #ifdef DIS_TEXT
3314 #endif
3316 }
3318 /*
3319 * Gather up legacy x86 prefix bytes.
3320 */
3335 #ifdef DIS_TEXT
3337 #endif
3347 }
3353 }
3355 /*
3356 * Handle amd64 mode PREFIX values.
3357 * Some of the segment prefixes are no-ops. (only FS/GS actually work)
3358 * We might have a REX prefix (opcodes 0x40-0x4f)
3359 */
3371 /* AVX instructions */
3374 }
3376 /* LDS, LES or AVX */
3381 /* AVX */
3386 }
3387 }
3389 /*
3390 * The EVEX prefix and "bound" instruction share the same first byte.
3391 * "bound" is only valid for 32-bit. For 64-bit this byte begins the
3392 * EVEX prefix and the 2nd byte must have bits 2 & 3 set to 0.
3393 */
3395 /*
3396 * An EVEX prefix is 4 bytes long, get the next 3 bytes.
3397 */
3402 /*
3403 * Upper bits in 2nd byte == 0 is 'bound' instn.
3404 *
3405 * We've already read the byte so perform the
3406 * equivalent of dtrace_get_modrm on the byte and set
3407 * the flag to indicate we've already read it.
3408 */
3416 }
3418 /* check for correct bits being 0 in 2nd byte */
3424 /* check for correct bit being 1 in 3rd byte */
3431 /* Reuse opcode1 & opcode2 to get the real opcode now */
3435 /*
3436 * We only use the high nibble from the 2nd byte of the prefix
3437 * and save it in the low bits of evex_byte1. This is because
3438 * two of the bits in opcode5 are constant 0 (checked above),
3439 * and the other two bits are captured in vex_m. Also, the VEX
3440 * constants we check in evex_byte1 are against the low bits.
3441 */
3451 /* Currently only 3 valid values for evex L'L: 00, 01, 10 */
3455 }
3456 not_avx512:
3462 }
3467 /*
3468 * The vex.x and vex.b bits are not defined in two bytes
3469 * mode vex prefix, their default values are 1
3470 */
3496 }
3502 }
3526 /* Only these three vex_m values valid; others are reserved */
3538 &dis_opAVX660F
3542 &dis_opAVX660F38
3546 &dis_opAVX660F3A
3550 }
3555 &dis_opAVXF30F
3559 &dis_opAVXF30F38
3563 }
3568 &dis_opAVXF20F
3572 &dis_opAVXF20F3A
3576 &dis_opAVXF20F38
3580 }
3586 }
3587 }
3598 }
3599 }
3600 }
3602 /*
3603 * Deal with selection of operand and address size now.
3604 * Note that the REX.W bit being set causes opnd_size_prefix to be
3605 * ignored.
3606 */
3625 }
3626 /*
3627 * The pause instruction - a repz'd nop. This doesn't fit
3628 * with any of the other prefix goop added for SSE, so we'll
3629 * special-case it here.
3630 */
3634 }
3636 /*
3637 * Some 386 instructions have 2 bytes of opcode before the mod_r/m
3638 * byte so we may need to perform a table indirection.
3639 */
3645 uint_t subcode;
3663 #ifdef DIS_TEXT
3666 #endif
3675 }
3680 /* SSSE3 MMX instructions */
3684 #ifdef DIS_MEM
3686 #endif
3687 }
3691 }
3698 /*
3699 * Both crc32 and movbe have the same 3rd opcode
3700 * byte of either 0xF0 or 0xF1, so we use another
3701 * indirection to distinguish between the two.
3702 */
3708 /* It is movbe */
3709 dp++;
3710 }
3711 }
3713 /*
3714 * The adx family of instructions (adcx and adox)
3715 * continue the classic Intel tradition of abusing
3716 * arbitrary prefixes without actually meaning the
3717 * prefix bit. Therefore, if we find either the
3718 * opnd_size_prefix or rep_prefix we end up zeroing it
3719 * out after making our determination so as to ensure
3720 * that we don't get confused and accidentally print
3721 * repz prefixes and the like on these instructions.
3722 *
3723 * In addition, these instructions are actually much
3724 * closer to AVX instructions in semantics. Importantly,
3725 * they always default to having 32-bit operands.
3726 * However, if the CPU is in 64-bit mode, then and only
3727 * then, does it use REX.w promotes things to 64-bits
3728 * and REX.r allows 64-bit mode to use register r8-r15.
3729 */
3734 /* It is adox */
3735 dp++;
3738 /* It isn't adcx */
3740 }
3746 }
3748 #ifdef DIS_TEXT
3751 #endif
3761 }
3765 /* SSSE3 MMX instructions */
3769 #ifdef DIS_MEM
3771 #endif
3772 }
3777 }
3783 }
3787 }
3790 }
3791 }
3793 /*
3794 * If still not at a TERM decode entry, then a ModRM byte
3795 * exists and its fields further decode the instruction.
3796 */
3804 /*
3805 * decode 287 instructions (D8-DF) from opcodeN
3806 */
3819 else
3824 }
3825 }
3827 /*
3828 * In amd64 bit mode, ARPL opcode is changed to MOVSXD
3829 * (sign extend 32bit to 64 bit)
3830 */
3835 /*
3836 * at this point we should have a correct (or invalid) opcode
3837 */
3844 /*
3845 * Deal with MMX/SSE opcodes which are changed by prefixes. Note, we do
3846 * need to include UNKNOWN below, as we may have instructions that
3847 * actually have a prefix, but don't exist in any other form.
3848 */
3867 /*
3868 * This is horrible. Some SIMD instructions take the
3869 * form 0x0F 0x?? ..., which is easily decoded using the
3870 * existing tables. Other SIMD instructions use various
3871 * prefix bytes to overload existing instructions. For
3872 * Example, addps is F0, 58, whereas addss is F3 (repz),
3873 * F0, 58. Presumably someone got a raise for this.
3874 *
3875 * If we see one of the instructions which can be
3876 * modified in this way (if we've got one of the SIMDO*
3877 * address modes), we'll check to see if the last prefix
3878 * was a repz. If it was, we strip the prefix from the
3879 * mnemonic, and we indirect using the dis_opSIMDrepz
3880 * table.
3881 */
3883 /*
3884 * Calculate our offset in dis_op0F
3885 */
3892 /*
3893 * Rewrite if this instruction used one of the magic prefixes.
3894 */
3898 else
3906 }
3910 /*
3911 * More horribleness: the group 9 (0xF0 0xC7) instructions are
3912 * allowed an optional prefix of 0x66 or 0xF3. This is similar
3913 * to the SIMD business described above, but with a different
3914 * addressing mode (and an indirect table), so we deal with it
3915 * separately (if similarly).
3916 *
3917 * Intel further complicated this with the release of Ivy Bridge
3918 * where they overloaded these instructions based on the ModR/M
3919 * bytes. The VMX instructions have a mode of 0 since they are
3920 * memory instructions but rdrand instructions have a mode of
3921 * 0b11 (REG_ONLY) because they only operate on registers. While
3922 * there are different prefix formats, for now it is sufficient
3923 * to use a single different table.
3924 */
3926 /*
3927 * Calculate our offset in dis_op0FC7 (the group 9 table)
3928 */
3935 /*
3936 * If we have a mode of 0b11 then we have to rewrite this.
3937 */
3942 }
3944 /*
3945 * Rewrite if this instruction used one of the magic prefixes.
3946 */
3950 else
3959 /*
3960 * We have xsavec (4) or xsaves (5), so rewrite.
3961 */
3964 }
3969 /*
3970 * As with the "normal" SIMD instructions, the MMX
3971 * shuffle instructions are overloaded. These
3972 * instructions, however, are special in that they use
3973 * an extra byte, and thus an extra table. As of this
3974 * writing, they only use the opnd_size prefix.
3975 */
3977 /*
3978 * Calculate our offset in dis_op0F7123
3979 */
3991 }
3997 /*
3998 * Calculate our offset in dis_op0F
3999 */
4011 }
4012 }
4014 }
4016 /*
4017 * In 64 bit mode, some opcodes automatically use opnd_size == SIZE64.
4018 */
4023 #ifdef DIS_TEXT
4024 /*
4025 * At this point most instructions can format the opcode mnemonic
4026 * including the prefixes.
4027 */
4047 OPLEN);
4049 /* opmask instructions */
4052 /* It's a kunpck. */
4057 /* vex_prefix == VEX_3bytes */
4060 }
4062 /* It's a kshift[l|r]. */
4069 /* W == 1 */
4073 }
4075 /* if (vex_prefix == VEX_2bytes) { */
4081 OPLEN);
4083 /* vex_prefix == VEX_3bytes */
4086 }
4087 }
4091 /* It's a cmovx.yy. Replace the suffix x */
4095 }
4100 /*
4101 * To handle PINSRD and PEXTRD
4102 */
4105 /* bound instructions (0x62) have no suffix */
4107 OPLEN);
4108 }
4109 }
4110 }
4111 #endif
4113 /*
4114 * Process operands based on the addressing modes.
4115 */
4117 /*
4118 * In vex mode the rex_prefix has no meaning
4119 */
4126 /*
4127 * amd64 instruction to sign extend 32 bit reg/mem operands
4128 * into 64 bit register values
4129 */
4131 #ifdef DIS_TEXT
4134 #endif
4144 /*
4145 * movsbl movsbw movsbq (0x0FBE) or movswl movswq (0x0FBF)
4146 * movzbl movzbw movzbq (0x0FB6) or movzwl movzwq (0x0FB7)
4147 * wbit lives in 2nd byte, note that operands
4148 * are different sized
4149 */
4152 /* target register size = 64 bit */
4154 }
4188 /* reg -> mem */
4192 /* mem -> reg */
4195 }
4198 /*
4199 * imul instruction, with either 8-bit or longer immediate
4200 * opcode 0x6B for byte, sign-extended displacement, 0x69 for word(s)
4201 */
4208 /* memory or register operand to register, with 'w' bit */
4215 /* register to memory or register operand, with 'w' bit */
4216 /* arpl happens to fit here also because it is odd */
4220 else
4225 /* xaddb instruction */
4231 /* MMX register to memory or register operand */
4234 #ifdef DIS_TEXT
4236 #else
4238 #endif
4242 /* MMX register to memory */
4251 /* Double shift. Has immediate operand specifying the shift. */
4261 /*
4262 * Double shift. With no immediate operand, specifies using %cl.
4263 */
4269 /* immediate to memory or register operand */
4274 /*
4275 * Have long immediate for opcode 0x81, but not 0x80 nor 0x83
4276 */
4280 /* immediate to memory or register operand with the */
4281 /* 'w' bit present */
4290 /* immediate to register with register in low 3 bits */
4291 /* of op code */
4293 /* w-bit here (with regs) is bit 3 */
4303 /* MMX immediate shift of register */
4309 /* SIMD immediate shift of register */
4312 mm_shift:
4317 NOMEM;
4320 /* accumulator to memory operand */
4323 /*FALLTHROUGH*/
4325 /* memory operand to accumulator */
4330 #ifdef DIS_TEXT
4332 #endif
4336 /* segment register to memory or register operand */
4339 /*FALLTHROUGH*/
4341 /* memory or register operand to segment register */
4349 /*
4350 * rotate or shift instructions, which may shift by 1 or
4351 * consult the cl register, depending on the 'v' bit
4352 */
4358 #ifdef DIS_TEXT
4365 }
4366 #endif
4368 /*
4369 * immediate rotate or shift instructions
4370 */
4373 normal_imm_mem:
4379 /* bit test instructions */
4384 /* single memory or register operand with 'w' bit present */
4387 just_mem:
4395 #ifdef DIS_TEXT
4397 #endif
4398 NOMEM;
4401 #ifdef DIS_TEXT
4403 #endif
4404 NOMEM;
4406 }
4408 /*FALLTHROUGH*/
4410 /* prefetch instruction - memory operand, but no memory acess */
4412 NOMEM;
4413 /*FALLTHROUGH*/
4415 /* single memory or register operand */
4421 /* single memory or register byte operand */
4428 #ifdef DIS_TEXT
4446 }
4449 #else
4452 #endif
4454 NOMEM;
4456 }
4457 /*FALLTHROUGH*/
4460 #if DIS_TEXT
4488 }
4491 #endif
4492 NOMEM;
4494 }
4495 /*FALLTHROUGH*/
4499 #ifdef DIS_TEXT
4501 #endif
4502 NOMEM;
4505 #ifdef DIS_TEXT
4507 #endif
4508 NOMEM;
4511 #ifdef DIS_TEXT
4513 #endif
4514 NOMEM;
4517 #ifdef DIS_TEXT
4519 #endif
4520 NOMEM;
4524 }
4525 }
4526 /*FALLTHROUGH*/
4530 #ifdef DIS_TEXT
4532 #endif
4533 NOMEM;
4536 #ifdef DIS_TEXT
4538 #endif
4539 NOMEM;
4543 }
4545 }
4546 /*FALLTHROUGH*/
4548 /* Similar to M, but only memory (no direct registers) */
4557 /* move special register to register or reverse if vbit */
4563 /*FALLTHROUGH*/
4570 /*FALLTHROUGH*/
4577 /*FALLTHROUGH*/
4582 }
4587 NOMEM;
4590 /*
4591 * single register operand with register in the low 3
4592 * bits of op code
4593 */
4597 else
4601 NOMEM;
4604 /*
4605 * register to accumulator with register in the low 3
4606 * bits of op code, xchg instructions
4607 */
4609 NOMEM;
4616 /*
4617 * single segment register operand, with register in
4618 * bits 3-4 of op code byte
4619 */
4621 NOMEM;
4626 /*
4627 * single segment register operand, with register in
4628 * bits 3-5 of op code
4629 */
4631 NOMEM;
4632 /* long seg reg from opcode */
4637 /* memory or register operand to register */
4653 /* MMX/SIMD-Int memory or mm reg to mm reg */
4656 #ifdef DIS_TEXT
4658 #else
4660 #endif
4665 #ifdef DIS_TEXT
4667 #else
4669 #endif
4680 /* MMX/SIMD-Int and SIMD-FP predicated mm reg to r32 */
4686 xmm3p:
4693 NOMEM;
4701 /* MMX/SIMD-Int predicated r32/mem to mm reg */
4710 xmmprm:
4714 /* MMX/SIMD-Int predicated mm/mem to mm reg */
4720 /* MMX/SIMD-Int mm reg to r32 */
4722 NOMEM;
4730 /* SIMD memory or xmm reg operand to xmm reg */
4742 #ifdef DIS_TEXT
4743 /*
4744 * movlps and movhlps share opcodes. They differ in the
4745 * addressing modes allowed for their operands.
4746 * movhps and movlhps behave similarly.
4747 */
4753 }
4754 #endif
4759 /* SIMD xmm reg to memory or xmm reg */
4765 #ifdef DIS_TEXT
4771 #endif
4776 /* SIMD memory to xmm reg */
4782 #ifdef DIS_TEXT
4786 else
4788 }
4789 #endif
4793 /* SIMD memory or r32 to xmm reg */
4804 /* SIMD memory or mm reg to xmm reg */
4806 /* SIMD mm to xmm */
4812 /* SIMD memory or xmm reg to mm reg */
4821 /* SIMD memory or xmm reg to r32 */
4827 /* SIMD xmm to r32 */
4836 NOMEM;
4839 /* SIMD predicated memory or xmm reg with/to xmm reg */
4848 #ifdef DIS_TEXT
4849 /*
4850 * cmpps and cmpss vary their instruction name based
4851 * on the value of imm8. Other XMMP instructions,
4852 * such as shufps, require explicit specification of
4853 * the predicate.
4854 */
4866 OPLEN);
4869 OPLEN);
4873 }
4875 /*
4876 * The pclmulqdq instruction has a series of alternate names for
4877 * various encodings of the immediate byte. As such, if we
4878 * happen to find it and the immediate value matches, we'll
4879 * rewrite the mnemonic.
4880 */
4886 OPLEN);
4890 OPLEN);
4894 OPLEN);
4898 OPLEN);
4903 }
4910 }
4911 }
4912 #endif
4918 NOMEM;
4923 NOMEM;
4926 /* immediate operand to accumulator */
4931 NOMEM;
4934 /* memory or register operand to accumulator */
4941 /* si register to di register used to reference memory */
4943 #ifdef DIS_TEXT
4948 OPLEN);
4950 OPLEN);
4953 OPLEN);
4955 OPLEN);
4958 OPLEN);
4960 OPLEN);
4961 }
4962 #endif
4966 /* accumulator to di register */
4969 #ifdef DIS_TEXT
4975 OPLEN);
4978 OPLEN);
4979 else
4981 OPLEN);
4982 #endif
4985 /* si register to accumulator */
4988 #ifdef DIS_TEXT
4993 OPLEN);
4996 OPLEN);
4997 else
4999 OPLEN);
5001 #endif
5004 /*
5005 * single operand, a 16/32 bit displacement
5006 */
5010 NOMEM;
5013 /* jmp/call indirect to memory or register operand */
5015 #ifdef DIS_TEXT
5017 #endif
5023 /*
5024 * for long jumps and long calls -- a new code segment
5025 * register and an offset in IP -- stored in object
5026 * code in reverse order. Note - not valid in amd64
5027 */
5032 #ifdef DIS_TEXT
5034 #endif
5035 /* will now get segment operand */
5039 /*
5040 * jmp/call. single operand, 8 bit displacement.
5041 * added to current EIP in 'compofff'
5042 */
5045 NOMEM;
5048 /* single 32/16 bit immediate operand */
5054 /* single 8 bit immediate operand */
5074 }
5078 /* 16-bit immediate operand */
5084 /* single 8 bit port operand */
5088 NOMEM;
5091 /* single operand, dx register (variable port instruction) */
5095 #ifdef DIS_TEXT
5097 #endif
5098 NOMEM;
5101 /*
5102 * The int instruction, which has two forms:
5103 * int 3 (breakpoint) or
5104 * int n, where n is indicated in the subsequent
5105 * byte (format Ib). The int 3 instruction (opcode 0xCC),
5106 * where, although the 3 looks like an operand,
5107 * it is implied by the opcode. It must be converted
5108 * to the correct base and output.
5109 */
5111 #ifdef DIS_TEXT
5116 #endif
5117 NOMEM;
5120 /* single 8 bit immediate operand */
5123 NOMEM;
5126 /* an unused byte must be discarded */
5131 NOMEM;
5135 #ifdef DIS_TEXT
5140 else
5142 #endif
5144 NOMEM;
5148 #ifdef DIS_TEXT
5153 else
5155 #endif
5157 NOMEM;
5161 /*
5162 * sfence is sfence if mode is REG_ONLY. If mode isn't
5163 * REG_ONLY, mnemonic should be 'clflush'.
5164 */
5167 /* sfence doesn't take operands */
5168 #ifdef DIS_TEXT
5175 NOMEM;
5176 }
5177 #else
5181 NOMEM;
5182 }
5183 #endif
5186 /*
5187 * no disassembly, the mnemonic was all there was so go on
5188 */
5192 NOMEM;
5193 /*FALLTHROUGH*/
5198 /*
5199 * XRSTOR, XSAVEOPT and LFENCE share the same opcode but
5200 * differ in mode and reg.
5201 */
5205 /*
5206 * Only the following exact byte sequences are allowed:
5207 *
5208 * 0f ae e8 lfence
5209 * 0f ae f0 mfence
5210 */
5215 #ifdef DIS_TEXT
5222 }
5223 #endif
5226 }
5229 /* float reg */
5231 #ifdef DIS_TEXT
5235 #endif
5236 NOMEM;
5239 /* float reg to float reg, with ret bit present */
5242 /*FALLTHROUGH*/
5244 #ifdef DIS_TEXT
5249 #endif
5250 NOMEM;
5253 /* AVX instructions */
5255 /* op(ModR/M.r/m) */
5258 #ifdef DIS_TEXT
5261 #endif
5267 /* ModR/M.reg := op(VEX.vvvv, ModR/M.r/m) */
5272 /*
5273 * In classic Intel fashion, the opcodes for all of the FMA
5274 * instructions all have two possible mnemonics which vary by
5275 * one letter, which is selected based on the value of the wbit.
5276 * When wbit is one, they have the 'd' suffix and when 'wbit' is
5277 * 0, they have the 's' suffix. Otherwise, the FMA instructions
5278 * are all a standard VEX_RMrX.
5279 */
5280 #ifdef DIS_TEXT
5287 }
5288 }
5289 #endif
5294 /* vmovsd <m64>, <xmm> */
5295 /* or vmovss <m64>, <xmm> */
5298 }
5299 }
5302 /*
5303 * VEX prefix uses the 1's complement form to encode the
5304 * XMM/YMM regs
5305 */
5310 /*
5311 * vcvtsi2si </r,m>, <xmm>, <xmm> or vcvtsi2ss </r,m>,
5312 * <xmm>, <xmm>
5313 */
5315 }
5316 #ifdef DIS_TEXT
5323 }
5324 #endif
5330 /* ModR/M.reg := op(MODR/M.r/m, VEX.vvvv) */
5336 /*
5337 * VEX prefix uses the 1's complement form to encode the
5338 * XMM/YMM regs
5339 */
5346 /* ModR/M.reg := op(MODR/M.r/m, VSIB, VEX.vvvv) */
5350 /*
5351 * All instructions that use VSIB are currently a mess. See the
5352 * comment around the dis_gather_regs_t structure definition.
5353 */
5357 #ifdef DIS_TEXT
5361 #endif
5367 /*
5368 * VEX prefix uses the 1's complement form to encode the
5369 * XMM/YMM regs
5370 */
5377 /* ModR/M.rm := op(VEX.vvvv, ModR/M.reg) */
5386 /* vmovsd <xmm>, <m64> */
5387 /* or vmovss <xmm>, <m64> */
5390 }
5391 }
5399 /* ModR/M.reg := op(VEX.vvvv, ModR/M.r_m, imm8[7:4]) */
5407 /* vinsertf128 <imm8>, <xmm>, <ymm>, <ymm> */
5411 /* vpinsrb <imm8>, <reg/mm>, <xmm>, <xmm> */
5412 /* or vpinsrw <imm8>, <reg/mm>, <xmm>, <xmm> */
5415 /* vpinsrd/q <imm8>, <reg/mm>, <xmm>, <xmm> */
5416 #ifdef DIS_TEXT
5419 #endif
5423 }
5425 /* one byte immediate number */
5428 /* vblendvpd, vblendvps, vblendvb use the imm encode the regs */
5432 #ifdef DIS_TEXT
5434 #endif
5436 #ifdef DIS_TEXT
5440 else
5443 #endif
5444 }
5448 /* ModR/M.reg := op(ModR/M.rm) */
5453 L_VEX_MX:
5458 /* vcvtpd2dq <ymm>, <xmm> */
5459 /* or vcvtpd2ps <ymm>, <xmm> */
5460 /* or vcvttpd2dq <ymm>, <xmm> */
5472 /* vcvtdq2pd <xmm>, <ymm> */
5473 /* or vcvtps2pd <xmm>, <ymm> */
5474 /* or vcvtph2ps <xmm>, <ymm> */
5475 /* or vbroadcasts* <xmm>, <ymm> */
5479 /* vmovd/q <reg/mem 32/64>, <xmm> */
5480 #ifdef DIS_TEXT
5483 #endif
5489 }
5494 /* ModR/M.reg := op(ModR/M.rm, imm8) */
5503 /* one byte immediate number */
5508 /* VEX.vvvv := op(ModR/M.rm, imm8) */
5512 #ifdef DIS_TEXT
5514 OPLEN);
5515 #endif
5521 /* one byte immediate number */
5526 /* ModR/M.reg (reg32/64) := op(ModR/M.rm) */
5528 /* vpextrw <imm8>, <xmm>, <reg> */
5534 }
5547 /* opmask: mod_rm := %k */
5556 /* opmask: mod_reg := mod_rm */
5565 }
5569 /* opmask: mod_reg := mod_rm */
5578 /* implicit(eflags/r32) := op(ModR/M.reg, ModR/M.rm) */
5588 /* ModR/M.rm := op(ModR/M.reg) */
5589 /* vextractf128 || vcvtps2ph */
5600 /* one byte immediate number */
5603 }
5614 /* ModR/M.rm := op(ModR/M.reg) */
5621 /* vmovd/q <reg/mem 32/64>, <xmm> */
5622 #ifdef DIS_TEXT
5625 #endif
5634 /* ModR/M.rm := op(ModR/M.reg, imm) */
5640 #ifdef DIS_TEXT
5642 /* vpextrd/q <imm>, <xmm>, <reg/mem 32/64> */
5645 }
5646 #endif
5650 /* one byte immediate number */
5654 /* ModR/M.rm := op(ModR/M.reg, imm) */
5662 /* one byte immediate number */
5667 /* ModR/M.rm := op(ModR/M.reg) */
5676 /* one byte immediate number */
5679 }
5684 L_VEX_RM:
5692 /* ModR/M.rm := op(VEX.vvvv, ModR/M.reg) */
5698 /* VEX use the 1's complement form encode the XMM/YMM regs */
5704 /* ModR/M.reg := op(VEX.vvvv, ModR/M.rm) */
5715 #ifdef DIS_TEXT
5718 #endif
5722 /*
5723 * The BLS instructions are VEX instructions that are based on
5724 * VEX.0F38.F3; however, they are considered special group 17
5725 * and like everything else, they use the bits in 3-5 of the
5726 * MOD R/M to determine the sub instruction. Unlike many others
5727 * like the VMX instructions, these are valid both for memory
5728 * and register forms.
5729 */
5736 #ifdef DIS_TEXT
5738 #endif
5741 #ifdef DIS_TEXT
5743 #endif
5746 #ifdef DIS_TEXT
5748 #endif
5752 }
5755 #ifdef DIS_TEXT
5757 #endif
5761 }
5763 /* ModR/M.reg := op(ModR/M.rm) */
5777 /* ModR/M.rm := op(ModR/M.reg) */
5790 /* an invalid op code */
5796 NOMEM;
5803 done:
5804 #ifdef DIS_MEM
5805 /*
5806 * compute the size of any memory accessed by the instruction
5807 */
5821 }
5826 /*
5827 * In 64 bit mode descriptor table entries
5828 * go up to 10 bytes and popf/pushf are always 8 bytes
5829 */
5835 else
5846 else
5854 }
5855 #endif
5858 error:
5859 #ifdef DIS_TEXT
5861 #endif
5863 }
5865 #ifdef DIS_TEXT
5867 /*
5868 * Some instructions should have immediate operands printed
5869 * as unsigned integers. We compare against this table.
5870 */
5874 0
5875 };
5878 static int
5880 {
5885 /*
5886 * Work back to start of last mnemonic, since we may have
5887 * prefixes on some opcodes.
5888 */
5901 }
5903 }
5905 /*
5906 * Print a numeric immediate into end of buf, maximum length buflen.
5907 * The immediate may be an address or a displacement. Mask is set
5908 * for address size. If the immediate is a "small negative", or
5909 * if it's a negative displacement of any magnitude, print as -<absval>.
5910 * Respect the "octal" flag. "Small negative" is defined as "in the
5911 * interval [NEG_LIMIT, 0)".
5912 *
5913 * Also, "isunsigned_op()" instructions never print negatives.
5914 *
5915 * Return whether we decided to print a negative value or not.
5916 */
5918 #define NEG_LIMIT -255
5922 static int
5925 {
5942 else
5947 }
5948 }
5951 static int
5953 {
5959 }
5961 }
5963 /* ARGSUSED */
5964 void
5967 {
5981 /*
5982 * For PC-relative jumps, the pc is really the next pc after executing
5983 * this instruction, so increment it appropriately.
5984 */
5995 /*
5996 * sv is for the signed, possibly-truncated immediate or
5997 * displacement; usv retains the original size and
5998 * unsignedness for symbol lookup.
5999 */
6003 /*
6004 * About masks: for immediates that represent
6005 * addresses, the appropriate display size is
6006 * the effective address size of the instruction.
6007 * This includes MODE_OFFSET, MODE_IPREL, and
6008 * MODE_RIPREL. Immediates that are simply
6009 * immediate values should display in the operand's
6010 * size, however, since they don't represent addresses.
6011 */
6013 /* d86_addr_size is SIZEnn, which is log2(real size) */
6016 /* d86_value_size and d86_imm_bytes are in bytes */
6036 buflen);
6041 }
6048 /*
6049 * We printed a negative value for an
6050 * immediate that wasn't a
6051 * displacement. Note that fact so we can
6052 * print the positive value as an
6053 * annotation.
6054 */
6058 }
6075 }
6083 }
6084 }
6086 /*
6087 * The symbol lookups may result in false positives,
6088 * particularly on object files, where small numbers may match
6089 * the 0-relative non-relocated addresses of symbols.
6090 */
6101 }
6103 /*
6104 * If we printed a negative immediate above, print the
6105 * positive in case our heuristic was unhelpful
6106 */
6112 }
6113 }
6116 /* Print symbol or effective address for reltgt */
6123 }
6124 }