| blob | 78a9881b2a5bde56de4c763f6924209aec892d70 |
1 /*
2 *
3 * CDDL HEADER START
4 *
5 * The contents of this file are subject to the terms of the
6 * Common Development and Distribution License (the "License").
7 * You may not use this file except in compliance with the License.
8 *
9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10 * or http://www.opensolaris.org/os/licensing.
11 * See the License for the specific language governing permissions
12 * and limitations under the License.
13 *
14 * When distributing Covered Code, include this CDDL HEADER in each
15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16 * If applicable, add the following below this CDDL HEADER, with the
17 * fields enclosed by brackets "[]" replaced with your own identifying
18 * information: Portions Copyright [yyyy] [name of copyright owner]
19 *
20 * CDDL HEADER END
21 */
22 /*
23 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2017 Joyent, Inc.
25 */
27 /*
28 * Copyright (c) 2010, Intel Corporation.
29 * All rights reserved.
30 */
32 /* Copyright (c) 1988 AT&T */
33 /* All Rights Reserved */
37 /* BEGIN CSTYLED */
39 /*
40 * Disassembly begins in dis_distable, which is equivalent to the One-byte
41 * Opcode Map in the Intel IA32 ISA Reference (page A-6 in my copy). The
42 * decoding loops then traverse out through the other tables as necessary to
43 * decode a given instruction.
44 *
45 * The behavior of this file can be controlled by one of the following flags:
46 *
47 * DIS_TEXT Include text for disassembly
48 * DIS_MEM Include memory-size calculations
49 *
50 * Either or both of these can be defined.
51 *
52 * This file is not, and will never be, cstyled. If anything, the tables should
53 * be taken out another tab stop or two so nothing overlaps.
54 */
56 /*
57 * These functions must be provided for the consumer to do disassembly.
58 */
59 #ifdef DIS_TEXT
65 #endif
69 /* field terminates - no pointer. */
71 /* Used to decode instructions. */
74 uchar_t it_adrmode;
75 #ifdef DIS_TEXT
78 #endif
79 #ifdef DIS_MEM
81 #endif
91 /*
92 * Instruction formats.
93 */
95 UNKNOWN,
96 MRw,
97 IMlw,
98 IMw,
99 IR,
100 OA,
101 AO,
102 MS,
103 SM,
104 Mv,
105 Mw,
110 PREF,
111 SWAPGS_RDTSCP,
112 MONITOR_MWAIT,
113 R,
114 RA,
115 SEG,
116 MR,
117 RM,
119 IA,
120 MA,
121 SD,
122 AD,
123 SA,
124 D,
125 INM,
126 SO,
127 BD,
128 I,
129 P,
130 V,
132 U,
133 OVERRIDE,
165 /*
166 * MMX/SIMD addressing modes.
167 */
217 XGETBV_XSETBV,
248 EVEX_RMrX /* EVEX EVEX.vvvv, mod_rm -> mod_reg */
249 };
251 /*
252 * VEX prefixes
253 */
259 /*
260 ** Register numbers for the i386
261 */
262 #define EAX_REGNO 0
263 #define ECX_REGNO 1
264 #define EDX_REGNO 2
265 #define EBX_REGNO 3
266 #define ESP_REGNO 4
267 #define EBP_REGNO 5
268 #define ESI_REGNO 6
269 #define EDI_REGNO 7
271 /*
272 * modes for immediate values
273 */
274 #define MODE_NONE 0
281 /*
282 * The letters used in these macros are:
283 * IND - indirect to another to another table
284 * "T" - means to Terminate indirections (this is the final opcode)
285 * "S" - means "operand length suffix required"
286 * "Sa" - means AVX2 suffix (q/d) required
287 * "Sq" - means AVX512 suffix (q/d) required
288 * "Sd" - means AVX512 suffix (d/s) required
289 * "NS" - means "no suffix" which is the operand length suffix of the opcode
290 * "Z" - means instruction size arg required
291 * "u" - means the opcode is invalid in IA32 but valid in amd64
292 * "x" - means the opcode is invalid in amd64, but not IA32
293 * "y" - means the operand size is always 64 bits in 64 bit mode
294 * "p" - means push/pop stack operation
295 * "vr" - means VEX instruction that operates on normal registers, not fpu
296 * "vo" - means VEX instruction that operates on opmask registers, not fpu
297 */
303 #if defined(DIS_TEXT) && defined(DIS_MEM)
306 #define TNS(name, amode) {TERM, amode, name, 0, 0, 0, 0, 0, 0}
307 #define TNSu(name, amode) {TERM, amode, name, 0, 0, 0, 0, 1, 0}
308 #define TNSx(name, amode) {TERM, amode, name, 0, 0, 1, 0, 0, 0}
309 #define TNSy(name, amode) {TERM, amode, name, 0, 0, 0, 1, 0, 0}
310 #define TNSyp(name, amode) {TERM, amode, name, 0, 0, 0, 1, 0, 1}
311 #define TNSZ(name, amode, sz) {TERM, amode, name, 0, sz, 0, 0, 0, 0}
312 #define TNSZy(name, amode, sz) {TERM, amode, name, 0, sz, 0, 1, 0, 0}
313 #define TNSZvr(name, amode, sz) {TERM, amode, name, 0, sz, 0, 0, 0, 0, 1}
314 #define TSvo(name, amode) {TERM, amode, name, 1, 0, 0, 0, 0, 0, 0, 0, 1}
315 #define TS(name, amode) {TERM, amode, name, 1, 0, 0, 0, 0, 0}
316 #define TSx(name, amode) {TERM, amode, name, 1, 0, 1, 0, 0, 0}
317 #define TSy(name, amode) {TERM, amode, name, 1, 0, 0, 1, 0, 0}
318 #define TSp(name, amode) {TERM, amode, name, 1, 0, 0, 0, 0, 1}
319 #define TSZ(name, amode, sz) {TERM, amode, name, 1, sz, 0, 0, 0, 0}
320 #define TSaZ(name, amode, sz) {TERM, amode, name, 1, sz, 0, 0, 0, 0, 0, AVS2}
321 #define TSq(name, amode) {TERM, amode, name, 0, 0, 0, 0, 0, 0, 0, AVS5Q}
322 #define TSd(name, amode) {TERM, amode, name, 0, 0, 0, 0, 0, 0, 0, AVS5D}
323 #define TSZx(name, amode, sz) {TERM, amode, name, 1, sz, 1, 0, 0, 0}
324 #define TSZy(name, amode, sz) {TERM, amode, name, 1, sz, 0, 1, 0, 0}
326 #elif defined(DIS_TEXT)
329 #define TNS(name, amode) {TERM, amode, name, 0, 0, 0, 0, 0}
330 #define TNSu(name, amode) {TERM, amode, name, 0, 0, 0, 1, 0}
331 #define TNSx(name, amode) {TERM, amode, name, 0, 1, 0, 0, 0}
332 #define TNSy(name, amode) {TERM, amode, name, 0, 0, 1, 0, 0}
333 #define TNSyp(name, amode) {TERM, amode, name, 0, 0, 1, 0, 1}
334 #define TNSZ(name, amode, sz) {TERM, amode, name, 0, 0, 0, 0, 0}
335 #define TNSZy(name, amode, sz) {TERM, amode, name, 0, 0, 1, 0, 0}
336 #define TNSZvr(name, amode, sz) {TERM, amode, name, 0, 0, 0, 0, 0, 1}
337 #define TSvo(name, amode) {TERM, amode, name, 1, 0, 0, 0, 0, 0, 0, 1}
338 #define TS(name, amode) {TERM, amode, name, 1, 0, 0, 0, 0}
339 #define TSx(name, amode) {TERM, amode, name, 1, 1, 0, 0, 0}
340 #define TSy(name, amode) {TERM, amode, name, 1, 0, 1, 0, 0}
341 #define TSp(name, amode) {TERM, amode, name, 1, 0, 0, 0, 1}
342 #define TSZ(name, amode, sz) {TERM, amode, name, 1, 0, 0, 0, 0}
343 #define TSaZ(name, amode, sz) {TERM, amode, name, 1, 0, 0, 0, 0, 0, AVS2}
344 #define TSq(name, amode) {TERM, amode, name, 0, 0, 0, 0, 0, 0, AVS5Q}
345 #define TSd(name, amode) {TERM, amode, name, 0, 0, 0, 0, 0, 0, AVS5D}
346 #define TSZx(name, amode, sz) {TERM, amode, name, 1, 1, 0, 0, 0}
347 #define TSZy(name, amode, sz) {TERM, amode, name, 1, 0, 1, 0, 0}
349 #elif defined(DIS_MEM)
350 #define IND(table) {(instable_t *)table, 0, 0, 0, 0, 0, 0}
351 #define INDx(table) {(instable_t *)table, 0, 0, 1, 0, 0, 0}
352 #define TNS(name, amode) {TERM, amode, 0, 0, 0, 0, 0}
353 #define TNSu(name, amode) {TERM, amode, 0, 0, 0, 1, 0}
354 #define TNSy(name, amode) {TERM, amode, 0, 0, 1, 0, 0}
355 #define TNSyp(name, amode) {TERM, amode, 0, 0, 1, 0, 1}
356 #define TNSx(name, amode) {TERM, amode, 0, 1, 0, 0, 0}
357 #define TNSZ(name, amode, sz) {TERM, amode, sz, 0, 0, 0, 0}
358 #define TNSZy(name, amode, sz) {TERM, amode, sz, 0, 1, 0, 0}
359 #define TNSZvr(name, amode, sz) {TERM, amode, sz, 0, 0, 0, 0, 1}
360 #define TSvo(name, amode) {TERM, amode, 0, 0, 0, 0, 0, 0, 0, 1}
361 #define TS(name, amode) {TERM, amode, 0, 0, 0, 0, 0}
362 #define TSx(name, amode) {TERM, amode, 0, 1, 0, 0, 0}
363 #define TSy(name, amode) {TERM, amode, 0, 0, 1, 0, 0}
364 #define TSp(name, amode) {TERM, amode, 0, 0, 0, 0, 1}
365 #define TSZ(name, amode, sz) {TERM, amode, sz, 0, 0, 0, 0}
366 #define TSaZ(name, amode, sz) {TERM, amode, sz, 0, 0, 0, 0, 0, AVS2}
367 #define TSq(name, amode) {TERM, amode, 0, 0, 0, 0, 0, 0, AVS5Q}
368 #define TSd(name, amode) {TERM, amode, 0, 0, 0, 0, 0, 0, AVS5D}
369 #define TSZx(name, amode, sz) {TERM, amode, sz, 1, 0, 0, 0}
370 #define TSZy(name, amode, sz) {TERM, amode, sz, 0, 1, 0, 0}
371 #define INVALID {TERM, UNKNOWN, 0, 0, 0, 0, 0}
372 #else
373 #define IND(table) {(instable_t *)table, 0, 0, 0, 0, 0}
374 #define INDx(table) {(instable_t *)table, 0, 1, 0, 0, 0}
375 #define TNS(name, amode) {TERM, amode, 0, 0, 0, 0}
376 #define TNSu(name, amode) {TERM, amode, 0, 0, 1, 0}
377 #define TNSy(name, amode) {TERM, amode, 0, 1, 0, 0}
378 #define TNSyp(name, amode) {TERM, amode, 0, 1, 0, 1}
379 #define TNSx(name, amode) {TERM, amode, 1, 0, 0, 0}
380 #define TNSZ(name, amode, sz) {TERM, amode, 0, 0, 0, 0}
381 #define TNSZy(name, amode, sz) {TERM, amode, 0, 1, 0, 0}
382 #define TNSZvr(name, amode, sz) {TERM, amode, 0, 0, 0, 0, 1}
383 #define TSvo(name, amode) {TERM, amode, 0, 0, 0, 0, 0, 0, 1}
384 #define TS(name, amode) {TERM, amode, 0, 0, 0, 0}
385 #define TSx(name, amode) {TERM, amode, 1, 0, 0, 0}
386 #define TSy(name, amode) {TERM, amode, 0, 1, 0, 0}
387 #define TSp(name, amode) {TERM, amode, 0, 0, 0, 1}
388 #define TSZ(name, amode, sz) {TERM, amode, 0, 0, 0, 0}
389 #define TSaZ(name, amode, sz) {TERM, amode, 0, 0, 0, 0, 0, AVS2}
390 #define TSq(name, amode) {TERM, amode, 0, 0, 0, 0, 0, AVS5Q}
391 #define TSd(name, amode) {TERM, amode, 0, 0, 0, 0, 0, AVS5D}
392 #define TSZx(name, amode, sz) {TERM, amode, 1, 0, 0, 0}
393 #define TSZy(name, amode, sz) {TERM, amode, 0, 1, 0, 0}
394 #define INVALID {TERM, UNKNOWN, 0, 0, 0, 0}
395 #endif
397 #ifdef DIS_TEXT
398 /*
399 * this decodes the r_m field for mode's 0, 1, 2 in 16 bit mode
400 */
408 };
411 /*
412 * This decodes 32 bit addressing mode r_m field for modes 0, 1, 2
413 */
417 };
422 };
424 /*
425 * This decodes 64 bit addressing mode r_m field for modes 0, 1, 2
426 */
430 };
434 };
436 /*
437 * decode for scale from SIB byte
438 */
441 /*
442 * decode for scale from VSIB byte, note that we always include the scale factor
443 * to match gas.
444 */
447 /*
448 * register decoding for normal references to registers (ie. not addressing)
449 */
453 };
458 };
463 };
468 };
473 };
478 };
483 };
488 };
493 };
504 };
515 };
526 };
530 };
535 };
537 /*
538 * SIMD predicate suffixes
539 */
542 };
545 /*0 1 2 3 4 5 6 7*/
549 };
553 /*
554 * "decode table" for 64 bit mode MOVSXD instruction (opcode 0x63)
555 */
558 /*
559 * "decode table" for pause and clflush instructions
560 */
563 /*
564 * Decode table for 0x0F00 opcodes
565 */
570 };
573 /*
574 * Decode table for 0x0F01 opcodes
575 */
578 /* [0] */ TNSZ("sgdt",VMx,6), TNSZ("sidt",MONITOR_MWAIT,6), TNSZ("lgdt",XGETBV_XSETBV,6), TNSZ("lidt",SVM,6),
580 };
582 /*
583 * Decode table for 0x0F18 opcodes -- SIMD prefetch
584 */
587 /* [0] */ TNS("prefetchnta",PREF),TNS("prefetcht0",PREF), TNS("prefetcht1",PREF), TNS("prefetcht2",PREF),
589 };
591 /*
592 * Decode table for 0x0FAE opcodes -- SIMD state save/restore
593 */
596 /* [4] */ TNSZ("xsave",M,512), TNS("lfence",XMMFENCE), TNS("mfence",XMMFENCE), TNS("sfence",XMMSFNC),
597 };
599 /*
600 * Decode table for 0x0FBA opcodes
601 */
607 };
609 /*
610 * Decode table for 0x0FC7 opcode (group 9)
611 */
617 };
619 /*
620 * Decode table for 0x0FC7 opcode (group 9) mode 3
621 */
627 };
629 /*
630 * Decode table for 0x0FC7 opcode with 0x66 prefix
631 */
637 };
639 /*
640 * Decode table for 0x0FC7 opcode with 0xF3 prefix
641 */
647 };
649 /*
650 * Decode table for 0x0FC8 opcode -- 486 bswap instruction
651 *
652 *bit pattern: 0000 1111 1100 1reg
653 */
656 };
658 /*
659 * Decode table for 0x0F71, 0x0F72, and 0x0F73 opcodes -- MMX instructions
660 */
662 {
665 }, {
668 }, {
671 }, {
674 } };
676 /*
677 * Decode table for SIMD extensions to above 0x0F71-0x0F73 opcodes.
678 */
691 };
693 /*
694 * SIMD instructions have been wedged into the existing IA32 instruction
695 * set through the use of prefixes. That is, while 0xf0 0x58 may be
696 * addps, 0xf3 0xf0 0x58 (literally, repz addps) is a completely different
697 * instruction - addss. At present, three prefixes have been coopted in
698 * this manner - address size (0x66), repnz (0xf2) and repz (0xf3). The
699 * following tables are used to provide the prefixed instruction names.
700 * The arrays are sparse, but they're fast.
701 */
703 /*
704 * Decode table for SIMD instructions with the address size (0x66) prefix.
705 */
712 /* [10] */ TNSZ("movupd",XMM,16), TNSZ("movupd",XMMS,16), TNSZ("movlpd",XMMM,8), TNSZ("movlpd",XMMMS,8),
713 /* [14] */ TNSZ("unpcklpd",XMM,16),TNSZ("unpckhpd",XMM,16),TNSZ("movhpd",XMMM,8), TNSZ("movhpd",XMMMS,8),
719 /* [28] */ TNSZ("movapd",XMM,16), TNSZ("movapd",XMMS,16), TNSZ("cvtpi2pd",XMMOMX,8),TNSZ("movntpd",XMMOMS,16),
720 /* [2C] */ TNSZ("cvttpd2pi",XMMXMM,16),TNSZ("cvtpd2pi",XMMXMM,16),TNSZ("ucomisd",XMM,8),TNSZ("comisd",XMM,8),
733 /* [54] */ TNSZ("andpd",XMM,16), TNSZ("andnpd",XMM,16), TNSZ("orpd",XMM,16), TNSZ("xorpd",XMM,16),
734 /* [58] */ TNSZ("addpd",XMM,16), TNSZ("mulpd",XMM,16), TNSZ("cvtpd2ps",XMM,16),TNSZ("cvtps2dq",XMM,16),
735 /* [5C] */ TNSZ("subpd",XMM,16), TNSZ("minpd",XMM,16), TNSZ("divpd",XMM,16), TNSZ("maxpd",XMM,16),
737 /* [60] */ TNSZ("punpcklbw",XMM,16),TNSZ("punpcklwd",XMM,16),TNSZ("punpckldq",XMM,16),TNSZ("packsswb",XMM,16),
738 /* [64] */ TNSZ("pcmpgtb",XMM,16), TNSZ("pcmpgtw",XMM,16), TNSZ("pcmpgtd",XMM,16), TNSZ("packuswb",XMM,16),
739 /* [68] */ TNSZ("punpckhbw",XMM,16),TNSZ("punpckhwd",XMM,16),TNSZ("punpckhdq",XMM,16),TNSZ("packssdw",XMM,16),
740 /* [6C] */ TNSZ("punpcklqdq",XMM,16),TNSZ("punpckhqdq",XMM,16),TNSZ("movd",XMM3MX,4),TNSZ("movdqa",XMM,16),
745 /* [7C] */ TNSZ("haddpd",XMM,16), TNSZ("hsubpd",XMM,16), TNSZ("movd",XMM3MXS,4), TNSZ("movdqa",XMMS,16),
772 /* [D0] */ TNSZ("addsubpd",XMM,16),TNSZ("psrlw",XMM,16), TNSZ("psrld",XMM,16), TNSZ("psrlq",XMM,16),
773 /* [D4] */ TNSZ("paddq",XMM,16), TNSZ("pmullw",XMM,16), TNSZ("movq",XMMS,8), TNS("pmovmskb",XMMX3),
774 /* [D8] */ TNSZ("psubusb",XMM,16), TNSZ("psubusw",XMM,16), TNSZ("pminub",XMM,16), TNSZ("pand",XMM,16),
775 /* [DC] */ TNSZ("paddusb",XMM,16), TNSZ("paddusw",XMM,16), TNSZ("pmaxub",XMM,16), TNSZ("pandn",XMM,16),
777 /* [E0] */ TNSZ("pavgb",XMM,16), TNSZ("psraw",XMM,16), TNSZ("psrad",XMM,16), TNSZ("pavgw",XMM,16),
778 /* [E4] */ TNSZ("pmulhuw",XMM,16), TNSZ("pmulhw",XMM,16), TNSZ("cvttpd2dq",XMM,16),TNSZ("movntdq",XMMS,16),
779 /* [E8] */ TNSZ("psubsb",XMM,16), TNSZ("psubsw",XMM,16), TNSZ("pminsw",XMM,16), TNSZ("por",XMM,16),
780 /* [EC] */ TNSZ("paddsb",XMM,16), TNSZ("paddsw",XMM,16), TNSZ("pmaxsw",XMM,16), TNSZ("pxor",XMM,16),
783 /* [F4] */ TNSZ("pmuludq",XMM,16), TNSZ("pmaddwd",XMM,16), TNSZ("psadbw",XMM,16), TNSZ("maskmovdqu", XMMXIMPL,16),
784 /* [F8] */ TNSZ("psubb",XMM,16), TNSZ("psubw",XMM,16), TNSZ("psubd",XMM,16), TNSZ("psubq",XMM,16),
786 };
794 /* [10] */ TNSZ("vmovupd",VEX_MX,16), TNSZ("vmovupd",VEX_RX,16), TNSZ("vmovlpd",VEX_RMrX,8), TNSZ("vmovlpd",VEX_RM,8),
795 /* [14] */ TNSZ("vunpcklpd",VEX_RMrX,16),TNSZ("vunpckhpd",VEX_RMrX,16),TNSZ("vmovhpd",VEX_RMrX,8), TNSZ("vmovhpd",VEX_RM,8),
801 /* [28] */ TNSZ("vmovapd",VEX_MX,16), TNSZ("vmovapd",VEX_RX,16), INVALID, TNSZ("vmovntpd",VEX_RM,16),
810 /* [44] */ TSvo("knot",VEX_MX), TSvo("kor",VEX_RMX), TSvo("kxnor",VEX_RMX), TSvo("kxor",VEX_RMX),
815 /* [54] */ TNSZ("vandpd",VEX_RMrX,16), TNSZ("vandnpd",VEX_RMrX,16), TNSZ("vorpd",VEX_RMrX,16), TNSZ("vxorpd",VEX_RMrX,16),
816 /* [58] */ TNSZ("vaddpd",VEX_RMrX,16), TNSZ("vmulpd",VEX_RMrX,16), TNSZ("vcvtpd2ps",VEX_MX,16),TNSZ("vcvtps2dq",VEX_MX,16),
817 /* [5C] */ TNSZ("vsubpd",VEX_RMrX,16), TNSZ("vminpd",VEX_RMrX,16), TNSZ("vdivpd",VEX_RMrX,16), TNSZ("vmaxpd",VEX_RMrX,16),
819 /* [60] */ TNSZ("vpunpcklbw",VEX_RMrX,16),TNSZ("vpunpcklwd",VEX_RMrX,16),TNSZ("vpunpckldq",VEX_RMrX,16),TNSZ("vpacksswb",VEX_RMrX,16),
820 /* [64] */ TNSZ("vpcmpgtb",VEX_RMrX,16), TNSZ("vpcmpgtw",VEX_RMrX,16), TNSZ("vpcmpgtd",VEX_RMrX,16), TNSZ("vpackuswb",VEX_RMrX,16),
821 /* [68] */ TNSZ("vpunpckhbw",VEX_RMrX,16),TNSZ("vpunpckhwd",VEX_RMrX,16),TNSZ("vpunpckhdq",VEX_RMrX,16),TNSZ("vpackssdw",VEX_RMrX,16),
822 /* [6C] */ TNSZ("vpunpcklqdq",VEX_RMrX,16),TNSZ("vpunpckhqdq",VEX_RMrX,16),TNSZ("vmovd",VEX_MX,4),TNSZ("vmovdqa",VEX_MX,16),
824 /* [70] */ TNSZ("vpshufd",VEX_MXI,16), TNSZ("vgrp71",VEX_XXI,16), TNSZ("vgrp72",VEX_XXI,16), TNSZ("vgrp73",VEX_XXI,16),
825 /* [74] */ TNSZ("vpcmpeqb",VEX_RMrX,16), TNSZ("vpcmpeqw",VEX_RMrX,16), TNSZ("vpcmpeqd",VEX_RMrX,16), INVALID,
827 /* [7C] */ TNSZ("vhaddpd",VEX_RMrX,16), TNSZ("vhsubpd",VEX_RMrX,16), TNSZ("vmovd",VEX_RR,4), TNSZ("vmovdqa",VEX_RX,16),
834 /* [90] */ TSvo("kmov",VEX_KRM), TSvo("kmov",VEX_KMR), TSvo("kmov",VEX_KRR), TSvo("kmov",VEX_MR),
850 /* [C4] */ TNSZ("vpinsrw",VEX_RMRX,2),TNS("vpextrw",VEX_MR), TNSZ("vshufpd",VEX_RMRX,16), INVALID,
854 /* [D0] */ TNSZ("vaddsubpd",VEX_RMrX,16),TNSZ("vpsrlw",VEX_RMrX,16), TNSZ("vpsrld",VEX_RMrX,16), TNSZ("vpsrlq",VEX_RMrX,16),
855 /* [D4] */ TNSZ("vpaddq",VEX_RMrX,16), TNSZ("vpmullw",VEX_RMrX,16), TNSZ("vmovq",VEX_RX,8), TNS("vpmovmskb",VEX_MR),
856 /* [D8] */ TNSZ("vpsubusb",VEX_RMrX,16), TNSZ("vpsubusw",VEX_RMrX,16), TNSZ("vpminub",VEX_RMrX,16), TNSZ("vpand",VEX_RMrX,16),
857 /* [DC] */ TNSZ("vpaddusb",VEX_RMrX,16), TNSZ("vpaddusw",VEX_RMrX,16), TNSZ("vpmaxub",VEX_RMrX,16), TNSZ("vpandn",VEX_RMrX,16),
859 /* [E0] */ TNSZ("vpavgb",VEX_RMrX,16), TNSZ("vpsraw",VEX_RMrX,16), TNSZ("vpsrad",VEX_RMrX,16), TNSZ("vpavgw",VEX_RMrX,16),
860 /* [E4] */ TNSZ("vpmulhuw",VEX_RMrX,16), TNSZ("vpmulhw",VEX_RMrX,16), TNSZ("vcvttpd2dq",VEX_MX,16),TNSZ("vmovntdq",VEX_RM,16),
861 /* [E8] */ TNSZ("vpsubsb",VEX_RMrX,16), TNSZ("vpsubsw",VEX_RMrX,16), TNSZ("vpminsw",VEX_RMrX,16), TNSZ("vpor",VEX_RMrX,16),
862 /* [EC] */ TNSZ("vpaddsb",VEX_RMrX,16), TNSZ("vpaddsw",VEX_RMrX,16), TNSZ("vpmaxsw",VEX_RMrX,16), TNSZ("vpxor",VEX_RMrX,16),
864 /* [F0] */ INVALID, TNSZ("vpsllw",VEX_RMrX,16), TNSZ("vpslld",VEX_RMrX,16), TNSZ("vpsllq",VEX_RMrX,16),
865 /* [F4] */ TNSZ("vpmuludq",VEX_RMrX,16), TNSZ("vpmaddwd",VEX_RMrX,16), TNSZ("vpsadbw",VEX_RMrX,16), TNS("vmaskmovdqu",VEX_MX),
866 /* [F8] */ TNSZ("vpsubb",VEX_RMrX,16), TNSZ("vpsubw",VEX_RMrX,16), TNSZ("vpsubd",VEX_RMrX,16), TNSZ("vpsubq",VEX_RMrX,16),
867 /* [FC] */ TNSZ("vpaddb",VEX_RMrX,16), TNSZ("vpaddw",VEX_RMrX,16), TNSZ("vpaddd",VEX_RMrX,16), INVALID,
868 };
870 /*
871 * Decode table for SIMD instructions with the repnz (0xf2) prefix.
872 */
953 };
961 /* [10] */ TNSZ("vmovsd",VEX_RMrX,8), TNSZ("vmovsd",VEX_RRX,8), TNSZ("vmovddup",VEX_MX,8), INVALID,
983 /* [58] */ TNSZ("vaddsd",VEX_RMrX,8), TNSZ("vmulsd",VEX_RMrX,8), TNSZ("vcvtsd2ss",VEX_RMrX,8), INVALID,
984 /* [5C] */ TNSZ("vsubsd",VEX_RMrX,8), TNSZ("vminsd",VEX_RMrX,8), TNSZ("vdivsd",VEX_RMrX,8), TNSZ("vmaxsd",VEX_RMrX,8),
1035 };
1117 };
1196 /* [F4] */ INVALID, TNSZvr("pdep",VEX_RMrX,5),TNSZvr("mulx",VEX_RMrX,5),TNSZvr("shrx",VEX_VRMrX,5),
1199 };
1281 };
1282 /*
1283 * Decode table for SIMD instructions with the repz (0xf3) prefix.
1284 */
1313 /* [58] */ TNSZ("addss",XMM,4), TNSZ("mulss",XMM,4), TNSZ("cvtss2sd",XMM,4), TNSZ("cvttps2dq",XMM,16),
1365 };
1373 /* [10] */ TNSZ("vmovss",VEX_RMrX,4), TNSZ("vmovss",VEX_RRX,4), TNSZ("vmovsldup",VEX_MX,4), INVALID,
1393 /* [50] */ INVALID, TNSZ("vsqrtss",VEX_RMrX,4), TNSZ("vrsqrtss",VEX_RMrX,4), TNSZ("vrcpss",VEX_RMrX,4),
1395 /* [58] */ TNSZ("vaddss",VEX_RMrX,4), TNSZ("vmulss",VEX_RMrX,4), TNSZ("vcvtss2sd",VEX_RMrX,4), TNSZ("vcvttps2dq",VEX_MX,16),
1396 /* [5C] */ TNSZ("vsubss",VEX_RMrX,4), TNSZ("vminss",VEX_RMrX,4), TNSZ("vdivss",VEX_RMrX,4), TNSZ("vmaxss",VEX_RMrX,4),
1447 };
1449 /*
1450 * Table for instructions with an EVEX prefix.
1451 */
1479 /* [54] */ TSd("vandp",EVEX_RMrX), TSd("vandnp",EVEX_RMrX), TSd("vorp",EVEX_RMrX), TSd("vxorp",EVEX_RMrX),
1532 };
1534 /*
1535 * The following two tables are used to encode crc32 and movbe
1536 * since they share the same opcodes.
1537 */
1541 };
1546 };
1548 /*
1549 * The following table is used to distinguish between adox and adcx which share
1550 * the same opcodes.
1551 */
1555 };
1558 /* [00] */ TNSZ("pshufb",XMM_66o,16),TNSZ("phaddw",XMM_66o,16),TNSZ("phaddd",XMM_66o,16),TNSZ("phaddsw",XMM_66o,16),
1559 /* [04] */ TNSZ("pmaddubsw",XMM_66o,16),TNSZ("phsubw",XMM_66o,16), TNSZ("phsubd",XMM_66o,16),TNSZ("phsubsw",XMM_66o,16),
1560 /* [08] */ TNSZ("psignb",XMM_66o,16),TNSZ("psignw",XMM_66o,16),TNSZ("psignd",XMM_66o,16),TNSZ("pmulhrsw",XMM_66o,16),
1564 /* [14] */ TNSZ("blendvps",XMM_66r,16),TNSZ("blendvpd",XMM_66r,16),INVALID, TNSZ("ptest",XMM_66r,16),
1568 /* [20] */ TNSZ("pmovsxbw",XMM_66r,16),TNSZ("pmovsxbd",XMM_66r,16),TNSZ("pmovsxbq",XMM_66r,16),TNSZ("pmovsxwd",XMM_66r,16),
1570 /* [28] */ TNSZ("pmuldq",XMM_66r,16),TNSZ("pcmpeqq",XMM_66r,16),TNSZ("movntdqa",XMMM_66r,16),TNSZ("packusdw",XMM_66r,16),
1573 /* [30] */ TNSZ("pmovzxbw",XMM_66r,16),TNSZ("pmovzxbd",XMM_66r,16),TNSZ("pmovzxbq",XMM_66r,16),TNSZ("pmovzxwd",XMM_66r,16),
1574 /* [34] */ TNSZ("pmovzxwq",XMM_66r,16),TNSZ("pmovzxdq",XMM_66r,16),INVALID, TNSZ("pcmpgtq",XMM_66r,16),
1575 /* [38] */ TNSZ("pminsb",XMM_66r,16),TNSZ("pminsd",XMM_66r,16),TNSZ("pminuw",XMM_66r,16),TNSZ("pminud",XMM_66r,16),
1576 /* [3C] */ TNSZ("pmaxsb",XMM_66r,16),TNSZ("pmaxsd",XMM_66r,16),TNSZ("pmaxuw",XMM_66r,16),TNSZ("pmaxud",XMM_66r,16),
1620 /* [C8] */ TNSZ("sha1nexte",XMM,16),TNSZ("sha1msg1",XMM,16),TNSZ("sha1msg2",XMM,16),TNSZ("sha256rnds2",XMM,16),
1626 /* [DC] */ TNSZ("aesenc",XMM_66r,16),TNSZ("aesenclast",XMM_66r,16),TNSZ("aesdec",XMM_66r,16),TNSZ("aesdeclast",XMM_66r,16),
1636 };
1639 /* [00] */ TNSZ("vpshufb",VEX_RMrX,16),TNSZ("vphaddw",VEX_RMrX,16),TNSZ("vphaddd",VEX_RMrX,16),TNSZ("vphaddsw",VEX_RMrX,16),
1640 /* [04] */ TNSZ("vpmaddubsw",VEX_RMrX,16),TNSZ("vphsubw",VEX_RMrX,16), TNSZ("vphsubd",VEX_RMrX,16),TNSZ("vphsubsw",VEX_RMrX,16),
1641 /* [08] */ TNSZ("vpsignb",VEX_RMrX,16),TNSZ("vpsignw",VEX_RMrX,16),TNSZ("vpsignd",VEX_RMrX,16),TNSZ("vpmulhrsw",VEX_RMrX,16),
1642 /* [0C] */ TNSZ("vpermilps",VEX_RMrX,8),TNSZ("vpermilpd",VEX_RMrX,16),TNSZ("vtestps",VEX_RRI,8), TNSZ("vtestpd",VEX_RRI,16),
1646 /* [18] */ TNSZ("vbroadcastss",VEX_MX,4),TNSZ("vbroadcastsd",VEX_MX,8),TNSZ("vbroadcastf128",VEX_MX,16),INVALID,
1649 /* [20] */ TNSZ("vpmovsxbw",VEX_MX,16),TNSZ("vpmovsxbd",VEX_MX,16),TNSZ("vpmovsxbq",VEX_MX,16),TNSZ("vpmovsxwd",VEX_MX,16),
1651 /* [28] */ TNSZ("vpmuldq",VEX_RMrX,16),TNSZ("vpcmpeqq",VEX_RMrX,16),TNSZ("vmovntdqa",VEX_MX,16),TNSZ("vpackusdw",VEX_RMrX,16),
1652 /* [2C] */ TNSZ("vmaskmovps",VEX_RMrX,8),TNSZ("vmaskmovpd",VEX_RMrX,16),TNSZ("vmaskmovps",VEX_RRM,8),TNSZ("vmaskmovpd",VEX_RRM,16),
1654 /* [30] */ TNSZ("vpmovzxbw",VEX_MX,16),TNSZ("vpmovzxbd",VEX_MX,16),TNSZ("vpmovzxbq",VEX_MX,16),TNSZ("vpmovzxwd",VEX_MX,16),
1655 /* [34] */ TNSZ("vpmovzxwq",VEX_MX,16),TNSZ("vpmovzxdq",VEX_MX,16),TNSZ("vpermd",VEX_RMrX,16),TNSZ("vpcmpgtq",VEX_RMrX,16),
1656 /* [38] */ TNSZ("vpminsb",VEX_RMrX,16),TNSZ("vpminsd",VEX_RMrX,16),TNSZ("vpminuw",VEX_RMrX,16),TNSZ("vpminud",VEX_RMrX,16),
1657 /* [3C] */ TNSZ("vpmaxsb",VEX_RMrX,16),TNSZ("vpmaxsd",VEX_RMrX,16),TNSZ("vpmaxuw",VEX_RMrX,16),TNSZ("vpmaxud",VEX_RMrX,16),
1660 /* [44] */ INVALID, TSaZ("vpsrlv",VEX_RMrX,16),TNSZ("vpsravd",VEX_RMrX,16),TSaZ("vpsllv",VEX_RMrX,16),
1666 /* [58] */ TNSZ("vpbroadcastd",VEX_MX,16),TNSZ("vpbroadcastq",VEX_MX,16),TNSZ("vbroadcasti128",VEX_MX,16),INVALID,
1684 /* [90] */ TNSZ("vpgatherd",VEX_SbVM,16),TNSZ("vpgatherq",VEX_SbVM,16),TNSZ("vgatherdp",VEX_SbVM,16),TNSZ("vgatherqp",VEX_SbVM,16),
1686 /* [98] */ TNSZ("vfmadd132p",FMA,16),TNSZ("vfmadd132s",FMA,16),TNSZ("vfmsub132p",FMA,16),TNSZ("vfmsub132s",FMA,16),
1687 /* [9C] */ TNSZ("vfnmadd132p",FMA,16),TNSZ("vfnmadd132s",FMA,16),TNSZ("vfnmsub132p",FMA,16),TNSZ("vfnmsub132s",FMA,16),
1691 /* [A8] */ TNSZ("vfmadd213p",FMA,16),TNSZ("vfmadd213s",FMA,16),TNSZ("vfmsub213p",FMA,16),TNSZ("vfmsub213s",FMA,16),
1692 /* [AC] */ TNSZ("vfnmadd213p",FMA,16),TNSZ("vfnmadd213s",FMA,16),TNSZ("vfnmsub213p",FMA,16),TNSZ("vfnmsub213s",FMA,16),
1696 /* [B8] */ TNSZ("vfmadd231p",FMA,16),TNSZ("vfmadd231s",FMA,16),TNSZ("vfmsub231p",FMA,16),TNSZ("vfmsub231s",FMA,16),
1697 /* [BC] */ TNSZ("vfnmadd231p",FMA,16),TNSZ("vfnmadd231s",FMA,16),TNSZ("vfnmsub231p",FMA,16),TNSZ("vfnmsub231s",FMA,16),
1707 /* [DC] */ TNSZ("vaesenc",VEX_RMrX,16),TNSZ("vaesenclast",VEX_RMrX,16),TNSZ("vaesdec",VEX_RMrX,16),TNSZ("vaesdeclast",VEX_RMrX,16),
1717 };
1722 /* [08] */ TNSZ("roundps",XMMP_66r,16),TNSZ("roundpd",XMMP_66r,16),TNSZ("roundss",XMMP_66r,16),TNSZ("roundsd",XMMP_66r,16),
1723 /* [0C] */ TNSZ("blendps",XMMP_66r,16),TNSZ("blendpd",XMMP_66r,16),TNSZ("pblendw",XMMP_66r,16),TNSZ("palignr",XMMP_66o,16),
1726 /* [14] */ TNSZ("pextrb",XMM3PM_66r,8),TNSZ("pextrw",XMM3PM_66r,16),TSZ("pextr",XMM3PM_66r,16),TNSZ("extractps",XMM3PM_66r,16),
1730 /* [20] */ TNSZ("pinsrb",XMMPRM_66r,8),TNSZ("insertps",XMMP_66r,16),TSZ("pinsr",XMMPRM_66r,16),INVALID,
1740 /* [40] */ TNSZ("dpps",XMMP_66r,16),TNSZ("dppd",XMMP_66r,16),TNSZ("mpsadbw",XMMP_66r,16),INVALID,
1750 /* [60] */ TNSZ("pcmpestrm",XMMP_66r,16),TNSZ("pcmpestri",XMMP_66r,16),TNSZ("pcmpistrm",XMMP_66r,16),TNSZ("pcmpistri",XMMP_66r,16),
1799 };
1802 /* [00] */ TNSZ("vpermq",VEX_MXI,16),TNSZ("vpermpd",VEX_MXI,16),TNSZ("vpblendd",VEX_RMRX,16),INVALID,
1803 /* [04] */ TNSZ("vpermilps",VEX_MXI,8),TNSZ("vpermilpd",VEX_MXI,16),TNSZ("vperm2f128",VEX_RMRX,16),INVALID,
1804 /* [08] */ TNSZ("vroundps",VEX_MXI,16),TNSZ("vroundpd",VEX_MXI,16),TNSZ("vroundss",VEX_RMRX,16),TNSZ("vroundsd",VEX_RMRX,16),
1805 /* [0C] */ TNSZ("vblendps",VEX_RMRX,16),TNSZ("vblendpd",VEX_RMRX,16),TNSZ("vpblendw",VEX_RMRX,16),TNSZ("vpalignr",VEX_RMRX,16),
1808 /* [14] */ TNSZ("vpextrb",VEX_RRi,8),TNSZ("vpextrw",VEX_RRi,16),TNSZ("vpextrd",VEX_RRi,16),TNSZ("vextractps",VEX_RM,16),
1812 /* [20] */ TNSZ("vpinsrb",VEX_RMRX,8),TNSZ("vinsertps",VEX_RMRX,16),TNSZ("vpinsrd",VEX_RMRX,16),INVALID,
1817 /* [30] */ TSvo("kshiftr",VEX_MXI), TSvo("kshiftr",VEX_MXI), TSvo("kshiftl",VEX_MXI), TSvo("kshiftl",VEX_MXI),
1822 /* [40] */ TNSZ("vdpps",VEX_RMRX,16),TNSZ("vdppd",VEX_RMRX,16),TNSZ("vmpsadbw",VEX_RMRX,16),INVALID,
1832 /* [60] */ TNSZ("vpcmpestrm",VEX_MXI,16),TNSZ("vpcmpestri",VEX_MXI,16),TNSZ("vpcmpistrm",VEX_MXI,16),TNSZ("vpcmpistri",VEX_MXI,16),
1881 };
1883 /*
1884 * Decode table for 0x0F0D which uses the first byte of the mod_rm to
1885 * indicate a sub-code.
1886 */
1890 };
1892 /*
1893 * Decode table for 0x0F opcodes
1894 */
1897 {
1902 }, {
1903 /* [10] */ TNSZ("movups",XMMO,16), TNSZ("movups",XMMOS,16),TNSZ("movlps",XMMO,8), TNSZ("movlps",XMMOS,8),
1904 /* [14] */ TNSZ("unpcklps",XMMO,16),TNSZ("unpckhps",XMMO,16),TNSZ("movhps",XMMOM,8),TNSZ("movhps",XMMOMS,8),
1907 }, {
1910 /* [28] */ TNSZ("movaps",XMMO,16), TNSZ("movaps",XMMOS,16),TNSZ("cvtpi2ps",XMMOMX,8),TNSZ("movntps",XMMOS,16),
1911 /* [2C] */ TNSZ("cvttps2pi",XMMOXMM,8),TNSZ("cvtps2pi",XMMOXMM,8),TNSZ("ucomiss",XMMO,4),TNSZ("comiss",XMMO,4),
1912 }, {
1917 }, {
1922 }, {
1923 /* [50] */ TNS("movmskps",XMMOX3), TNSZ("sqrtps",XMMO,16), TNSZ("rsqrtps",XMMO,16),TNSZ("rcpps",XMMO,16),
1924 /* [54] */ TNSZ("andps",XMMO,16), TNSZ("andnps",XMMO,16), TNSZ("orps",XMMO,16), TNSZ("xorps",XMMO,16),
1925 /* [58] */ TNSZ("addps",XMMO,16), TNSZ("mulps",XMMO,16), TNSZ("cvtps2pd",XMMO,8),TNSZ("cvtdq2ps",XMMO,16),
1926 /* [5C] */ TNSZ("subps",XMMO,16), TNSZ("minps",XMMO,16), TNSZ("divps",XMMO,16), TNSZ("maxps",XMMO,16),
1927 }, {
1928 /* [60] */ TNSZ("punpcklbw",MMO,4),TNSZ("punpcklwd",MMO,4),TNSZ("punpckldq",MMO,4),TNSZ("packsswb",MMO,8),
1929 /* [64] */ TNSZ("pcmpgtb",MMO,8), TNSZ("pcmpgtw",MMO,8), TNSZ("pcmpgtd",MMO,8), TNSZ("packuswb",MMO,8),
1930 /* [68] */ TNSZ("punpckhbw",MMO,8),TNSZ("punpckhwd",MMO,8),TNSZ("punpckhdq",MMO,8),TNSZ("packssdw",MMO,8),
1931 /* [6C] */ TNSZ("INVALID",MMO,0), TNSZ("INVALID",MMO,0), TNSZ("movd",MMO,4), TNSZ("movq",MMO,8),
1932 }, {
1934 /* [74] */ TNSZ("pcmpeqb",MMO,8), TNSZ("pcmpeqw",MMO,8), TNSZ("pcmpeqd",MMO,8), TNS("emms",NORM),
1937 }, {
1942 }, {
1947 }, {
1952 }, {
1957 }, {
1959 /* [C4] */ TNSZ("pinsrw",MMOPRM,2),TNS("pextrw",MMO3P), TNSZ("shufps",XMMOPM,16),IND(dis_op0FC7),
1962 }, {
1964 /* [D4] */ TNSZ("paddq",MMO,8), TNSZ("pmullw",MMO,8), TNSZ("INVALID",MMO,0), TNS("pmovmskb",MMOM3),
1965 /* [D8] */ TNSZ("psubusb",MMO,8), TNSZ("psubusw",MMO,8), TNSZ("pminub",MMO,8), TNSZ("pand",MMO,8),
1966 /* [DC] */ TNSZ("paddusb",MMO,8), TNSZ("paddusw",MMO,8), TNSZ("pmaxub",MMO,8), TNSZ("pandn",MMO,8),
1967 }, {
1969 /* [E4] */ TNSZ("pmulhuw",MMO,8), TNSZ("pmulhw",MMO,8), TNS("INVALID",XMMO), TNSZ("movntq",MMOMS,8),
1970 /* [E8] */ TNSZ("psubsb",MMO,8), TNSZ("psubsw",MMO,8), TNSZ("pminsw",MMO,8), TNSZ("por",MMO,8),
1971 /* [EC] */ TNSZ("paddsb",MMO,8), TNSZ("paddsw",MMO,8), TNSZ("pmaxsw",MMO,8), TNSZ("pxor",MMO,8),
1972 }, {
1974 /* [F4] */ TNSZ("pmuludq",MMO,8), TNSZ("pmaddwd",MMO,8), TNSZ("psadbw",MMO,8), TNSZ("maskmovq",MMOIMPL,8),
1977 } };
1980 {
1985 }, {
1986 /* [10] */ TNSZ("vmovups",VEX_MX,16), TNSZ("vmovups",VEX_RM,16),TNSZ("vmovlps",VEX_RMrX,8), TNSZ("vmovlps",VEX_RM,8),
1987 /* [14] */ TNSZ("vunpcklps",VEX_RMrX,16),TNSZ("vunpckhps",VEX_RMrX,16),TNSZ("vmovhps",VEX_RMrX,8),TNSZ("vmovhps",VEX_RM,8),
1990 }, {
1993 /* [28] */ TNSZ("vmovaps",VEX_MX,16), TNSZ("vmovaps",VEX_RX,16),INVALID, TNSZ("vmovntps",VEX_RM,16),
1995 }, {
2000 }, {
2002 /* [44] */ TSvo("knot",VEX_MX), TSvo("kor",VEX_RMX), TSvo("kxnor",VEX_RMX), TSvo("kxor",VEX_RMX),
2005 }, {
2006 /* [50] */ TNS("vmovmskps",VEX_MR), TNSZ("vsqrtps",VEX_MX,16), TNSZ("vrsqrtps",VEX_MX,16),TNSZ("vrcpps",VEX_MX,16),
2007 /* [54] */ TNSZ("vandps",VEX_RMrX,16), TNSZ("vandnps",VEX_RMrX,16), TNSZ("vorps",VEX_RMrX,16), TNSZ("vxorps",VEX_RMrX,16),
2008 /* [58] */ TNSZ("vaddps",VEX_RMrX,16), TNSZ("vmulps",VEX_RMrX,16), TNSZ("vcvtps2pd",VEX_MX,8),TNSZ("vcvtdq2ps",VEX_MX,16),
2009 /* [5C] */ TNSZ("vsubps",VEX_RMrX,16), TNSZ("vminps",VEX_RMrX,16), TNSZ("vdivps",VEX_RMrX,16), TNSZ("vmaxps",VEX_RMrX,16),
2010 }, {
2015 }, {
2020 }, {
2025 }, {
2026 /* [90] */ TSvo("kmov",VEX_KRM), TSvo("kmov",VEX_KMR), TSvo("kmov",VEX_KRR), TSvo("kmov",VEX_MR),
2030 }, {
2035 }, {
2040 }, {
2045 }, {
2050 }, {
2055 }, {
2060 } };
2062 /*
2063 * Decode table for 0x80 opcodes
2064 */
2070 };
2073 /*
2074 * Decode table for 0x81 opcodes.
2075 */
2081 };
2084 /*
2085 * Decode table for 0x82 opcodes.
2086 */
2092 };
2093 /*
2094 * Decode table for 0x83 opcodes.
2095 */
2101 };
2103 /*
2104 * Decode table for 0xC0 opcodes.
2105 */
2111 };
2113 /*
2114 * Decode table for 0xD0 opcodes.
2115 */
2121 };
2123 /*
2124 * Decode table for 0xC1 opcodes.
2125 * 186 instruction set
2126 */
2132 };
2134 /*
2135 * Decode table for 0xD1 opcodes.
2136 */
2142 };
2145 /*
2146 * Decode table for 0xD2 opcodes.
2147 */
2153 };
2154 /*
2155 * Decode table for 0xD3 opcodes.
2156 */
2162 };
2165 /*
2166 * Decode table for 0xF6 opcodes.
2167 */
2173 };
2176 /*
2177 * Decode table for 0xF7 opcodes.
2178 */
2184 };
2187 /*
2188 * Decode table for 0xFE opcodes.
2189 */
2195 };
2196 /*
2197 * Decode table for 0xFF opcodes.
2198 */
2204 };
2206 /* for 287 instructions, which are a mess to decode */
2209 {
2210 /* bit pattern: 1101 1xxx MODxx xR/M */
2213 }, {
2216 }, {
2219 }, {
2222 }, {
2225 }, {
2228 }, {
2231 }, {
2234 } };
2237 {
2238 /* bit pattern: 1101 1xxx 11xx xREG */
2241 }, {
2244 }, {
2247 }, {
2250 }, {
2253 }, {
2256 }, {
2259 }, {
2262 } };
2265 {
2266 /* bit pattern: 1101 1001 111x xxxx */
2269 }, {
2272 }, {
2275 }, {
2278 } };
2281 /* bit pattern: 1101 1011 111x xxxx */
2284 };
2287 /* bit pattern: 1101 1011 11yy yxxx */
2290 };
2293 /* bit pattern: 1101 1010 11yy yxxx */
2296 };
2298 /*
2299 * Main decode table for the op codes. The first two nibbles
2300 * will be used as an index into the table. If there is a
2301 * a need to further decode an instruction, the array to be
2302 * referenced is indicated with the other two entries being
2303 * empty.
2304 */
2307 {
2312 }, {
2317 }, {
2322 }, {
2327 }, {
2332 }, {
2337 }, {
2338 /* [6,0] */ TSZx("pusha",IMPLMEM,28),TSZx("popa",IMPLMEM,28), TSx("bound",RM), TNS("arpl",RMw),
2341 /* [6,C] */ TNSZ("insb",IMPLMEM,1), TSZ("ins",IMPLMEM,4), TNSZ("outsb",IMPLMEM,1),TSZ("outs",IMPLMEM,4),
2342 }, {
2347 }, {
2352 }, {
2356 /* [9,C] */ TSZy("pushf",IMPLMEM,4),TSZy("popf",IMPLMEM,4), TNS("sahf",NORM), TNS("lahf",NORM),
2357 }, {
2362 }, {
2367 }, {
2372 }, {
2376 /* 287 instructions. Note that although the indirect field */
2377 /* indicates opFP1n2 for further decoding, this is not necessarily */
2378 /* the case since the opFP arrays are not partitioned according to key1 */
2379 /* and key2. opFP1n2 is given only to indicate that we haven't */
2380 /* finished decoding the instruction. */
2383 }, {
2388 }, {
2393 } };
2395 /* END CSTYLED */
2397 /*
2398 * common functions to decode and disassemble an x86 or amd64 instruction
2399 */
2401 /*
2402 * These are the individual fields of a REX prefix. Note that a REX
2403 * prefix with none of these set is still needed to:
2404 * - use the MOVSXD (sign extend 32 to 64 bits) instruction
2405 * - access the %sil, %dil, %bpl, %spl registers
2406 */
2412 /*
2413 * These are the individual fields of a VEX/EVEX prefix.
2414 */
2419 /* Additional EVEX prefix definitions */
2424 /* Vector Length, 0: scalar or 128-bit vector, 1: 256-bit vector */
2425 #define VEX_L 0x04
2426 /* Vector Length, 0: scalar or 128-bit vector, 1: 256-bit vector, 2: 512-bit */
2434 /* VEX m-mmmm field, only used by three bytes prefix */
2439 /* VEX pp field, providing equivalent functionality of a SIMD prefix */
2440 #define VEX_p_66 0x01
2441 #define VEX_p_F3 0x02
2442 #define VEX_p_F2 0x03
2444 /*
2445 * Even in 64 bit mode, usually only 4 byte immediate operands are supported.
2446 */
2450 /*
2451 * Just a bunch of useful macros.
2452 */
2456 #define OPSIZE(osize, wbit) ((wbit) ? isize[osize] : 1)
2457 #define OPSIZE64(osize, wbit) ((wbit) ? isize64[osize] : 1)
2474 /*
2475 * The AVX2 gather instructions are a bit of a mess. While there's a pattern,
2476 * there's not really a consistent scheme that we can use to know what the mode
2477 * is supposed to be for a given type. Various instructions, like VPGATHERDD,
2478 * always match the value of VEX_L. Other instructions like VPGATHERDQ, have
2479 * some registers match VEX_L, but the VSIB is always XMM.
2480 *
2481 * The simplest way to deal with this is to just define a table based on the
2482 * instruction opcodes, which are 0x90-0x93, so we subtract 0x90 to index into
2483 * them.
2484 *
2485 * We further have to subdivide this based on the value of VEX_W and the value
2486 * of VEX_L. The array is constructed to be indexed as:
2487 * [opcode - 0x90][VEX_W][VEX_L].
2488 */
2489 /* w = 0, 0x90 */
2498 {
2499 /* op 0x90, W.0 */
2500 {
2503 },
2504 /* op 0x90, W.1 */
2505 {
2508 }
2509 },
2510 {
2511 /* op 0x91, W.0 */
2512 {
2515 },
2516 /* op 0x91, W.1 */
2517 {
2520 }
2521 },
2522 {
2523 /* op 0x92, W.0 */
2524 {
2527 },
2528 /* op 0x92, W.1 */
2529 {
2532 }
2533 },
2534 {
2535 /* op 0x93, W.0 */
2536 {
2539 },
2540 /* op 0x93, W.1 */
2541 {
2544 }
2545 }
2546 };
2548 /*
2549 * Get the next byte and separate the op code into the high and low nibbles.
2550 */
2551 static int
2553 {
2556 /*
2557 * x86 instructions have a maximum length of 15 bytes. Bail out if
2558 * we try to read more.
2559 */
2572 }
2574 /*
2575 * Get and decode an SIB (scaled index base) byte
2576 */
2577 static void
2579 {
2589 }
2595 }
2597 /*
2598 * Get the byte following the op code and separate it into the
2599 * mode, register, and r/m fields.
2600 */
2601 static void
2603 {
2609 }
2610 }
2612 /*
2613 * Adjust register selection based on any REX prefix bits present.
2614 */
2615 /*ARGSUSED*/
2616 static void
2618 {
2627 }
2628 }
2630 /*
2631 * Adjust register selection based on any VEX prefix bits present.
2632 * Notes: VEX.R, VEX.X and VEX.B use the inverted form compared with REX prefix
2633 */
2634 /*ARGSUSED*/
2635 static void
2637 {
2646 }
2647 }
2649 /*
2650 * Adjust the instruction mnemonic with the appropriate suffix.
2651 */
2652 /* ARGSUSED */
2653 static void
2655 uint_t evex_byte2)
2656 {
2657 #ifdef DIS_TEXT
2660 /* Aligned or Unaligned? */
2664 OPLEN);
2680 }
2681 }
2686 OPLEN);
2689 OPLEN);
2690 }
2691 }
2692 #endif
2693 }
2695 /*
2696 * The following three functions adjust the register selection based on any
2697 * EVEX prefix bits present. See Intel 64 and IA-32 Architectures Software
2698 * Developer’s Manual Volume 2 (IASDv2), section 2.6.1 Table 2-30 and
2699 * section 2.6.2 Table 2-31.
2700 */
2701 static void
2703 {
2707 }
2710 }
2711 }
2712 }
2714 static void
2716 {
2720 }
2723 }
2724 }
2725 }
2727 /*
2728 * Use evex_L to set wbit. See IASDv2 Section 2.6.10 and Table 2-36.
2729 */
2730 static void
2732 {
2743 }
2744 }
2746 /*
2747 * Adjust operand value for disp8*N immediate. See IASDv2 Section 2.6.5.
2748 * This currently only handles a subset of the possibilities.
2749 */
2750 static void
2752 {
2758 /* Check disp8 bit in the ModR/M byte */
2762 /* use evex_L to adjust the value */
2773 }
2774 }
2776 /*
2777 * Adjust target for opmask and zeroing. See IASDv2 Section 2.6.1 Table 2-30.
2778 */
2779 /* ARGSUSED */
2780 static void
2782 {
2783 #ifdef DIS_TEXT
2786 #endif
2790 #ifdef DIS_TEXT
2792 /* Append the opmask register to operand 1 */
2796 }
2798 /* Append the 'zeroing' modifier to operand 1 */
2800 }
2802 }
2804 /*
2805 * Get an immediate operand of the given size, with sign extension.
2806 */
2807 static void
2809 {
2826 else
2842 }
2854 }
2857 }
2858 /* Do sign extension */
2863 }
2864 #ifdef DIS_TEXT
2868 #endif
2869 }
2871 /*
2872 * Get an ip relative operand of the given size, with sign extension.
2873 */
2874 static void
2876 {
2878 #ifdef DIS_TEXT
2880 #endif
2881 }
2883 /*
2884 * Check to see if there is a segment override prefix pending.
2885 * If so, print it in the current 'operand' location and set
2886 * the override flag back to false.
2887 */
2888 /*ARGSUSED*/
2889 static void
2891 {
2892 #ifdef DIS_TEXT
2896 }
2897 #endif
2899 }
2902 /*
2903 * Process a single instruction Register or Memory operand.
2904 *
2905 * mode = addressing mode from ModRM byte
2906 * r_m = r_m (or reg if mode == 3) field from ModRM byte
2907 * wbit = indicates which register (8bit, 16bit, ... MMX, etc.) set to use.
2908 * o = index of operand that we are processing (0, 1 or 2)
2909 *
2910 * the value of reg or r_m must have already been adjusted for any REX prefix.
2911 */
2912 /*ARGSUSED*/
2913 static void
2915 {
2921 #ifdef DIS_TEXT
2923 #endif
2931 /*
2932 * first handle a simple register
2933 */
2935 #ifdef DIS_TEXT
2967 else
2978 else
2981 }
2984 }
2986 /*
2987 * if symbolic representation, skip override prefix, if any
2988 */
2991 /*
2992 * Handle 16 bit memory references first, since they decode
2993 * the mode values more simply.
2994 * mode 1 is r_m + 8 bit displacement
2995 * mode 2 is r_m + 16 bit displacement
2996 * mode 0 is just r_m, unless r_m is 6 which is 16 bit disp
2997 */
3003 #ifdef DIS_TEXT
3008 else
3011 #endif
3013 }
3015 /*
3016 * 32 and 64 bit addressing modes are more complex since they
3017 * can involve an SIB (scaled index and base) byte to decode.
3018 */
3031 }
3033 /*
3034 * Compute the displacement size and get its bytes
3035 */
3051 }
3053 #ifdef DIS_TEXT
3061 OPLEN);
3062 else
3064 OPLEN);
3068 OPLEN);
3071 MODE_RIPREL;
3072 }
3075 OPLEN);
3076 }
3077 }
3085 else
3095 }
3100 }
3102 /*
3103 * print the base (if any)
3104 */
3109 }
3114 }
3116 /*
3117 * print the index (if any)
3118 */
3126 }
3127 #endif
3128 }
3130 /*
3131 * Operand sequence for standard instruction involving one register
3132 * and one register/memory operand.
3133 * wbit indicates a byte(0) or opnd_size(1) operation
3134 * vbit indicates direction (0 for "opcode r,r_m") or (1 for "opcode r_m, r")
3135 */
3136 #define STANDARD_MODRM(x, mode, reg, r_m, rex_prefix, wbit, vbit) { \
3137 dtrace_get_modrm(x, &mode, ®, &r_m); \
3138 dtrace_rex_adjust(rex_prefix, mode, ®, &r_m); \
3139 dtrace_get_operand(x, mode, r_m, wbit, vbit); \
3140 dtrace_get_operand(x, REG_ONLY, reg, wbit, 1 - vbit); \
3141 }
3143 /*
3144 * Similar to above, but allows for the two operands to be of different
3145 * classes (ie. wbit).
3146 * wbit is for the r_m operand
3147 * w2 is for the reg operand
3148 */
3149 #define MIXED_MM(x, mode, reg, r_m, rex_prefix, wbit, w2, vbit) { \
3150 dtrace_get_modrm(x, &mode, ®, &r_m); \
3151 dtrace_rex_adjust(rex_prefix, mode, ®, &r_m); \
3152 dtrace_get_operand(x, mode, r_m, wbit, vbit); \
3153 dtrace_get_operand(x, REG_ONLY, reg, w2, 1 - vbit); \
3154 }
3156 /*
3157 * Similar, but for 2 operands plus an immediate.
3158 * vbit indicates direction
3159 * 0 for "opcode imm, r, r_m" or
3160 * 1 for "opcode imm, r_m, r"
3161 */
3162 #define THREEOPERAND(x, mode, reg, r_m, rex_prefix, wbit, w2, immsize, vbit) { \
3163 dtrace_get_modrm(x, &mode, ®, &r_m); \
3164 dtrace_rex_adjust(rex_prefix, mode, ®, &r_m); \
3165 dtrace_get_operand(x, mode, r_m, wbit, 2-vbit); \
3166 dtrace_get_operand(x, REG_ONLY, reg, w2, 1+vbit); \
3167 dtrace_imm_opnd(x, wbit, immsize, 0); \
3168 }
3170 /*
3171 * Similar, but for 2 operands plus two immediates.
3172 */
3173 #define FOUROPERAND(x, mode, reg, r_m, rex_prefix, wbit, w2, immsize) { \
3174 dtrace_get_modrm(x, &mode, ®, &r_m); \
3175 dtrace_rex_adjust(rex_prefix, mode, ®, &r_m); \
3176 dtrace_get_operand(x, mode, r_m, wbit, 2); \
3177 dtrace_get_operand(x, REG_ONLY, reg, w2, 3); \
3178 dtrace_imm_opnd(x, wbit, immsize, 1); \
3179 dtrace_imm_opnd(x, wbit, immsize, 0); \
3180 }
3182 /*
3183 * 1 operands plus two immediates.
3184 */
3185 #define ONEOPERAND_TWOIMM(x, mode, reg, r_m, rex_prefix, wbit, immsize) { \
3186 dtrace_get_modrm(x, &mode, ®, &r_m); \
3187 dtrace_rex_adjust(rex_prefix, mode, ®, &r_m); \
3188 dtrace_get_operand(x, mode, r_m, wbit, 2); \
3189 dtrace_imm_opnd(x, wbit, immsize, 1); \
3190 dtrace_imm_opnd(x, wbit, immsize, 0); \
3191 }
3193 /*
3194 * Dissassemble a single x86 or amd64 instruction.
3195 *
3196 * Mode determines the default operating mode (SIZE16, SIZE32 or SIZE64)
3197 * for interpreting instructions.
3198 *
3199 * returns non-zero for bad opcode
3200 */
3201 int
3203 {
3205 #ifdef DIS_TEXT
3206 uint_t i;
3207 #endif
3208 #ifdef DIS_MEM
3210 #define NOMEM (nomem = 1)
3211 #else
3213 #endif
3218 uint_t vbit;
3234 /*
3235 * legacy prefixes come in 5 flavors, you should have only one of each
3236 */
3244 /*
3245 * Intel VEX instruction encoding prefix and fields
3246 */
3248 /* 0xC4 means 3 bytes prefix, 0xC5 means 2 bytes prefix */
3251 /*
3252 * VEX prefix byte 1, includes vex.r, vex.x and vex.b
3253 * (for 3 bytes prefix)
3254 */
3257 /*
3258 * EVEX prefix byte 1 includes vex.r, vex.x, vex.b and evex.r.
3259 */
3264 /*
3265 * For 32-bit mode, it should prefetch the next byte to
3266 * distinguish between AVX and les/lds
3267 */
3282 #ifdef DIS_TEXT
3283 /* Instruction name for BLS* family of instructions */
3285 #endif
3289 instable_t dp_mmx;
3294 #ifdef DIS_TEXT
3304 }
3305 #endif
3320 }
3322 /*
3323 * Get one opcode byte and check for zero padding that follows
3324 * jump tables.
3325 */
3331 #ifdef DIS_TEXT
3333 #endif
3335 }
3337 /*
3338 * Gather up legacy x86 prefix bytes.
3339 */
3354 #ifdef DIS_TEXT
3356 #endif
3366 }
3372 }
3374 /*
3375 * Handle amd64 mode PREFIX values.
3376 * Some of the segment prefixes are no-ops. (only FS/GS actually work)
3377 * We might have a REX prefix (opcodes 0x40-0x4f)
3378 */
3390 /* AVX instructions */
3393 }
3395 /* LDS, LES or AVX */
3400 /* AVX */
3405 }
3406 }
3408 /*
3409 * The EVEX prefix and "bound" instruction share the same first byte.
3410 * "bound" is only valid for 32-bit. For 64-bit this byte begins the
3411 * EVEX prefix and the 2nd byte must have bits 2 & 3 set to 0.
3412 */
3414 /*
3415 * An EVEX prefix is 4 bytes long, get the next 3 bytes.
3416 */
3421 /*
3422 * Upper bits in 2nd byte == 0 is 'bound' instn.
3423 *
3424 * We've already read the byte so perform the
3425 * equivalent of dtrace_get_modrm on the byte and set
3426 * the flag to indicate we've already read it.
3427 */
3435 }
3437 /* check for correct bits being 0 in 2nd byte */
3443 /* check for correct bit being 1 in 3rd byte */
3450 /* Reuse opcode1 & opcode2 to get the real opcode now */
3454 /*
3455 * We only use the high nibble from the 2nd byte of the prefix
3456 * and save it in the low bits of evex_byte1. This is because
3457 * two of the bits in opcode5 are constant 0 (checked above),
3458 * and the other two bits are captured in vex_m. Also, the VEX
3459 * constants we check in evex_byte1 are against the low bits.
3460 */
3470 /* Currently only 3 valid values for evex L'L: 00, 01, 10 */
3474 }
3475 not_avx512:
3481 }
3486 /*
3487 * The vex.x and vex.b bits are not defined in two bytes
3488 * mode vex prefix, their default values are 1
3489 */
3515 }
3521 }
3545 /* Only these three vex_m values valid; others are reserved */
3557 &dis_opAVX660F
3561 &dis_opAVX660F38
3565 &dis_opAVX660F3A
3569 }
3574 &dis_opAVXF30F
3578 &dis_opAVXF30F38
3582 }
3587 &dis_opAVXF20F
3591 &dis_opAVXF20F3A
3595 &dis_opAVXF20F38
3599 }
3605 }
3606 }
3617 }
3618 }
3619 }
3621 /*
3622 * Deal with selection of operand and address size now.
3623 * Note that the REX.W bit being set causes opnd_size_prefix to be
3624 * ignored.
3625 */
3644 }
3645 /*
3646 * The pause instruction - a repz'd nop. This doesn't fit
3647 * with any of the other prefix goop added for SSE, so we'll
3648 * special-case it here.
3649 */
3653 }
3655 /*
3656 * Some 386 instructions have 2 bytes of opcode before the mod_r/m
3657 * byte so we may need to perform a table indirection.
3658 */
3664 uint_t subcode;
3682 #ifdef DIS_TEXT
3685 #endif
3694 }
3699 /* SSSE3 MMX instructions */
3703 #ifdef DIS_MEM
3705 #endif
3706 }
3710 }
3717 /*
3718 * Both crc32 and movbe have the same 3rd opcode
3719 * byte of either 0xF0 or 0xF1, so we use another
3720 * indirection to distinguish between the two.
3721 */
3727 /* It is movbe */
3728 dp++;
3729 }
3730 }
3732 /*
3733 * The adx family of instructions (adcx and adox)
3734 * continue the classic Intel tradition of abusing
3735 * arbitrary prefixes without actually meaning the
3736 * prefix bit. Therefore, if we find either the
3737 * opnd_size_prefix or rep_prefix we end up zeroing it
3738 * out after making our determination so as to ensure
3739 * that we don't get confused and accidentally print
3740 * repz prefixes and the like on these instructions.
3741 *
3742 * In addition, these instructions are actually much
3743 * closer to AVX instructions in semantics. Importantly,
3744 * they always default to having 32-bit operands.
3745 * However, if the CPU is in 64-bit mode, then and only
3746 * then, does it use REX.w promotes things to 64-bits
3747 * and REX.r allows 64-bit mode to use register r8-r15.
3748 */
3753 /* It is adox */
3754 dp++;
3757 /* It isn't adcx */
3759 }
3765 }
3767 #ifdef DIS_TEXT
3770 #endif
3780 }
3784 /* SSSE3 MMX instructions */
3788 #ifdef DIS_MEM
3790 #endif
3791 }
3796 }
3802 }
3806 }
3809 }
3810 }
3812 /*
3813 * If still not at a TERM decode entry, then a ModRM byte
3814 * exists and its fields further decode the instruction.
3815 */
3823 /*
3824 * decode 287 instructions (D8-DF) from opcodeN
3825 */
3838 else
3843 }
3844 }
3846 /*
3847 * In amd64 bit mode, ARPL opcode is changed to MOVSXD
3848 * (sign extend 32bit to 64 bit)
3849 */
3854 /*
3855 * at this point we should have a correct (or invalid) opcode
3856 */
3863 /*
3864 * Deal with MMX/SSE opcodes which are changed by prefixes. Note, we do
3865 * need to include UNKNOWN below, as we may have instructions that
3866 * actually have a prefix, but don't exist in any other form.
3867 */
3886 /*
3887 * This is horrible. Some SIMD instructions take the
3888 * form 0x0F 0x?? ..., which is easily decoded using the
3889 * existing tables. Other SIMD instructions use various
3890 * prefix bytes to overload existing instructions. For
3891 * Example, addps is F0, 58, whereas addss is F3 (repz),
3892 * F0, 58. Presumably someone got a raise for this.
3893 *
3894 * If we see one of the instructions which can be
3895 * modified in this way (if we've got one of the SIMDO*
3896 * address modes), we'll check to see if the last prefix
3897 * was a repz. If it was, we strip the prefix from the
3898 * mnemonic, and we indirect using the dis_opSIMDrepz
3899 * table.
3900 */
3902 /*
3903 * Calculate our offset in dis_op0F
3904 */
3911 /*
3912 * Rewrite if this instruction used one of the magic prefixes.
3913 */
3917 else
3925 }
3929 /*
3930 * More horribleness: the group 9 (0xF0 0xC7) instructions are
3931 * allowed an optional prefix of 0x66 or 0xF3. This is similar
3932 * to the SIMD business described above, but with a different
3933 * addressing mode (and an indirect table), so we deal with it
3934 * separately (if similarly).
3935 *
3936 * Intel further complicated this with the release of Ivy Bridge
3937 * where they overloaded these instructions based on the ModR/M
3938 * bytes. The VMX instructions have a mode of 0 since they are
3939 * memory instructions but rdrand instructions have a mode of
3940 * 0b11 (REG_ONLY) because they only operate on registers. While
3941 * there are different prefix formats, for now it is sufficient
3942 * to use a single different table.
3943 */
3945 /*
3946 * Calculate our offset in dis_op0FC7 (the group 9 table)
3947 */
3954 /*
3955 * If we have a mode of 0b11 then we have to rewrite this.
3956 */
3961 }
3963 /*
3964 * Rewrite if this instruction used one of the magic prefixes.
3965 */
3969 else
3978 /*
3979 * We have xsavec (4) or xsaves (5), so rewrite.
3980 */
3983 }
3988 /*
3989 * As with the "normal" SIMD instructions, the MMX
3990 * shuffle instructions are overloaded. These
3991 * instructions, however, are special in that they use
3992 * an extra byte, and thus an extra table. As of this
3993 * writing, they only use the opnd_size prefix.
3994 */
3996 /*
3997 * Calculate our offset in dis_op0F7123
3998 */
4010 }
4016 /*
4017 * Calculate our offset in dis_op0F
4018 */
4030 }
4031 }
4033 }
4035 /*
4036 * In 64 bit mode, some opcodes automatically use opnd_size == SIZE64.
4037 */
4042 #ifdef DIS_TEXT
4043 /*
4044 * At this point most instructions can format the opcode mnemonic
4045 * including the prefixes.
4046 */
4066 OPLEN);
4068 /* opmask instructions */
4071 /* It's a kunpck. */
4076 /* vex_prefix == VEX_3bytes */
4079 }
4081 /* It's a kshift[l|r]. */
4088 /* W == 1 */
4092 }
4094 /* if (vex_prefix == VEX_2bytes) { */
4100 OPLEN);
4102 /* vex_prefix == VEX_3bytes */
4105 }
4106 }
4110 /* It's a cmovx.yy. Replace the suffix x */
4114 }
4119 /*
4120 * To handle PINSRD and PEXTRD
4121 */
4124 /* bound instructions (0x62) have no suffix */
4126 OPLEN);
4127 }
4128 }
4129 }
4130 #endif
4132 /*
4133 * Process operands based on the addressing modes.
4134 */
4136 /*
4137 * In vex mode the rex_prefix has no meaning
4138 */
4145 /*
4146 * amd64 instruction to sign extend 32 bit reg/mem operands
4147 * into 64 bit register values
4148 */
4150 #ifdef DIS_TEXT
4153 #endif
4163 /*
4164 * movsbl movsbw movsbq (0x0FBE) or movswl movswq (0x0FBF)
4165 * movzbl movzbw movzbq (0x0FB6) or movzwl movzwq (0x0FB7)
4166 * wbit lives in 2nd byte, note that operands
4167 * are different sized
4168 */
4171 /* target register size = 64 bit */
4173 }
4207 /* reg -> mem */
4211 /* mem -> reg */
4214 }
4217 /*
4218 * imul instruction, with either 8-bit or longer immediate
4219 * opcode 0x6B for byte, sign-extended displacement, 0x69 for word(s)
4220 */
4227 /* memory or register operand to register, with 'w' bit */
4234 /* register to memory or register operand, with 'w' bit */
4235 /* arpl happens to fit here also because it is odd */
4239 else
4244 /* xaddb instruction */
4250 /* MMX register to memory or register operand */
4253 #ifdef DIS_TEXT
4255 #else
4257 #endif
4261 /* MMX register to memory */
4270 /* Double shift. Has immediate operand specifying the shift. */
4280 /*
4281 * Double shift. With no immediate operand, specifies using %cl.
4282 */
4288 /* immediate to memory or register operand */
4293 /*
4294 * Have long immediate for opcode 0x81, but not 0x80 nor 0x83
4295 */
4299 /* immediate to memory or register operand with the */
4300 /* 'w' bit present */
4309 /* immediate to register with register in low 3 bits */
4310 /* of op code */
4312 /* w-bit here (with regs) is bit 3 */
4322 /* MMX immediate shift of register */
4328 /* SIMD immediate shift of register */
4331 mm_shift:
4336 NOMEM;
4339 /* accumulator to memory operand */
4342 /*FALLTHROUGH*/
4344 /* memory operand to accumulator */
4349 #ifdef DIS_TEXT
4351 #endif
4355 /* segment register to memory or register operand */
4358 /*FALLTHROUGH*/
4360 /* memory or register operand to segment register */
4368 /*
4369 * rotate or shift instructions, which may shift by 1 or
4370 * consult the cl register, depending on the 'v' bit
4371 */
4377 #ifdef DIS_TEXT
4384 }
4385 #endif
4387 /*
4388 * immediate rotate or shift instructions
4389 */
4392 normal_imm_mem:
4398 /* bit test instructions */
4403 /* single memory or register operand with 'w' bit present */
4406 just_mem:
4414 #ifdef DIS_TEXT
4416 #endif
4417 NOMEM;
4420 #ifdef DIS_TEXT
4422 #endif
4423 NOMEM;
4425 }
4427 /*FALLTHROUGH*/
4429 /* prefetch instruction - memory operand, but no memory acess */
4431 NOMEM;
4432 /*FALLTHROUGH*/
4434 /* single memory or register operand */
4440 /* single memory or register byte operand */
4447 #ifdef DIS_TEXT
4465 }
4468 #else
4471 #endif
4473 NOMEM;
4475 }
4476 /*FALLTHROUGH*/
4479 #if DIS_TEXT
4507 }
4510 #endif
4511 NOMEM;
4513 }
4514 /*FALLTHROUGH*/
4518 #ifdef DIS_TEXT
4520 #endif
4521 NOMEM;
4524 #ifdef DIS_TEXT
4526 #endif
4527 NOMEM;
4530 #ifdef DIS_TEXT
4532 #endif
4533 NOMEM;
4536 #ifdef DIS_TEXT
4538 #endif
4539 NOMEM;
4543 }
4544 }
4545 /*FALLTHROUGH*/
4549 #ifdef DIS_TEXT
4551 #endif
4552 NOMEM;
4555 #ifdef DIS_TEXT
4557 #endif
4558 NOMEM;
4562 }
4564 }
4565 /*FALLTHROUGH*/
4567 /* Similar to M, but only memory (no direct registers) */
4576 /* move special register to register or reverse if vbit */
4582 /*FALLTHROUGH*/
4589 /*FALLTHROUGH*/
4596 /*FALLTHROUGH*/
4601 }
4606 NOMEM;
4609 /*
4610 * single register operand with register in the low 3
4611 * bits of op code
4612 */
4616 else
4620 NOMEM;
4623 /*
4624 * register to accumulator with register in the low 3
4625 * bits of op code, xchg instructions
4626 */
4628 NOMEM;
4635 /*
4636 * single segment register operand, with register in
4637 * bits 3-4 of op code byte
4638 */
4640 NOMEM;
4645 /*
4646 * single segment register operand, with register in
4647 * bits 3-5 of op code
4648 */
4650 NOMEM;
4651 /* long seg reg from opcode */
4656 /* memory or register operand to register */
4672 /* MMX/SIMD-Int memory or mm reg to mm reg */
4675 #ifdef DIS_TEXT
4677 #else
4679 #endif
4684 #ifdef DIS_TEXT
4686 #else
4688 #endif
4699 /* MMX/SIMD-Int and SIMD-FP predicated mm reg to r32 */
4705 xmm3p:
4712 NOMEM;
4720 /* MMX/SIMD-Int predicated r32/mem to mm reg */
4729 xmmprm:
4733 /* MMX/SIMD-Int predicated mm/mem to mm reg */
4739 /* MMX/SIMD-Int mm reg to r32 */
4741 NOMEM;
4749 /* SIMD memory or xmm reg operand to xmm reg */
4761 #ifdef DIS_TEXT
4762 /*
4763 * movlps and movhlps share opcodes. They differ in the
4764 * addressing modes allowed for their operands.
4765 * movhps and movlhps behave similarly.
4766 */
4772 }
4773 #endif
4778 /* SIMD xmm reg to memory or xmm reg */
4784 #ifdef DIS_TEXT
4790 #endif
4795 /* SIMD memory to xmm reg */
4801 #ifdef DIS_TEXT
4805 else
4807 }
4808 #endif
4812 /* SIMD memory or r32 to xmm reg */
4823 /* SIMD memory or mm reg to xmm reg */
4825 /* SIMD mm to xmm */
4831 /* SIMD memory or xmm reg to mm reg */
4840 /* SIMD memory or xmm reg to r32 */
4846 /* SIMD xmm to r32 */
4855 NOMEM;
4858 /* SIMD predicated memory or xmm reg with/to xmm reg */
4867 #ifdef DIS_TEXT
4868 /*
4869 * cmpps and cmpss vary their instruction name based
4870 * on the value of imm8. Other XMMP instructions,
4871 * such as shufps, require explicit specification of
4872 * the predicate.
4873 */
4885 OPLEN);
4888 OPLEN);
4892 }
4894 /*
4895 * The pclmulqdq instruction has a series of alternate names for
4896 * various encodings of the immediate byte. As such, if we
4897 * happen to find it and the immediate value matches, we'll
4898 * rewrite the mnemonic.
4899 */
4905 OPLEN);
4909 OPLEN);
4913 OPLEN);
4917 OPLEN);
4922 }
4929 }
4930 }
4931 #endif
4937 NOMEM;
4942 NOMEM;
4945 /* immediate operand to accumulator */
4950 NOMEM;
4953 /* memory or register operand to accumulator */
4960 /* si register to di register used to reference memory */
4962 #ifdef DIS_TEXT
4967 OPLEN);
4969 OPLEN);
4972 OPLEN);
4974 OPLEN);
4977 OPLEN);
4979 OPLEN);
4980 }
4981 #endif
4985 /* accumulator to di register */
4988 #ifdef DIS_TEXT
4994 OPLEN);
4997 OPLEN);
4998 else
5000 OPLEN);
5001 #endif
5004 /* si register to accumulator */
5007 #ifdef DIS_TEXT
5012 OPLEN);
5015 OPLEN);
5016 else
5018 OPLEN);
5020 #endif
5023 /*
5024 * single operand, a 16/32 bit displacement
5025 */
5029 NOMEM;
5032 /* jmp/call indirect to memory or register operand */
5034 #ifdef DIS_TEXT
5036 #endif
5042 /*
5043 * for long jumps and long calls -- a new code segment
5044 * register and an offset in IP -- stored in object
5045 * code in reverse order. Note - not valid in amd64
5046 */
5051 #ifdef DIS_TEXT
5053 #endif
5054 /* will now get segment operand */
5058 /*
5059 * jmp/call. single operand, 8 bit displacement.
5060 * added to current EIP in 'compofff'
5061 */
5064 NOMEM;
5067 /* single 32/16 bit immediate operand */
5073 /* single 8 bit immediate operand */
5093 }
5097 /* 16-bit immediate operand */
5103 /* single 8 bit port operand */
5107 NOMEM;
5110 /* single operand, dx register (variable port instruction) */
5114 #ifdef DIS_TEXT
5116 #endif
5117 NOMEM;
5120 /*
5121 * The int instruction, which has two forms:
5122 * int 3 (breakpoint) or
5123 * int n, where n is indicated in the subsequent
5124 * byte (format Ib). The int 3 instruction (opcode 0xCC),
5125 * where, although the 3 looks like an operand,
5126 * it is implied by the opcode. It must be converted
5127 * to the correct base and output.
5128 */
5130 #ifdef DIS_TEXT
5135 #endif
5136 NOMEM;
5139 /* single 8 bit immediate operand */
5142 NOMEM;
5145 /* an unused byte must be discarded */
5150 NOMEM;
5154 #ifdef DIS_TEXT
5159 else
5161 #endif
5163 NOMEM;
5167 #ifdef DIS_TEXT
5172 else
5174 #endif
5176 NOMEM;
5180 /*
5181 * sfence is sfence if mode is REG_ONLY. If mode isn't
5182 * REG_ONLY, mnemonic should be 'clflush'.
5183 */
5186 /* sfence doesn't take operands */
5187 #ifdef DIS_TEXT
5194 NOMEM;
5195 }
5196 #else
5200 NOMEM;
5201 }
5202 #endif
5205 /*
5206 * no disassembly, the mnemonic was all there was so go on
5207 */
5211 NOMEM;
5212 /*FALLTHROUGH*/
5217 /*
5218 * XRSTOR, XSAVEOPT and LFENCE share the same opcode but
5219 * differ in mode and reg.
5220 */
5224 /*
5225 * Only the following exact byte sequences are allowed:
5226 *
5227 * 0f ae e8 lfence
5228 * 0f ae f0 mfence
5229 */
5234 #ifdef DIS_TEXT
5241 }
5242 #endif
5245 }
5248 /* float reg */
5250 #ifdef DIS_TEXT
5254 #endif
5255 NOMEM;
5258 /* float reg to float reg, with ret bit present */
5261 /*FALLTHROUGH*/
5263 #ifdef DIS_TEXT
5268 #endif
5269 NOMEM;
5272 /* AVX instructions */
5274 /* op(ModR/M.r/m) */
5277 #ifdef DIS_TEXT
5280 #endif
5286 /* ModR/M.reg := op(VEX.vvvv, ModR/M.r/m) */
5291 /*
5292 * In classic Intel fashion, the opcodes for all of the FMA
5293 * instructions all have two possible mnemonics which vary by
5294 * one letter, which is selected based on the value of the wbit.
5295 * When wbit is one, they have the 'd' suffix and when 'wbit' is
5296 * 0, they have the 's' suffix. Otherwise, the FMA instructions
5297 * are all a standard VEX_RMrX.
5298 */
5299 #ifdef DIS_TEXT
5306 }
5307 }
5308 #endif
5313 /* vmovsd <m64>, <xmm> */
5314 /* or vmovss <m64>, <xmm> */
5317 }
5318 }
5321 /*
5322 * VEX prefix uses the 1's complement form to encode the
5323 * XMM/YMM regs
5324 */
5329 /*
5330 * vcvtsi2si </r,m>, <xmm>, <xmm> or vcvtsi2ss </r,m>,
5331 * <xmm>, <xmm>
5332 */
5334 }
5335 #ifdef DIS_TEXT
5342 }
5343 #endif
5349 /* ModR/M.reg := op(MODR/M.r/m, VEX.vvvv) */
5355 /*
5356 * VEX prefix uses the 1's complement form to encode the
5357 * XMM/YMM regs
5358 */
5365 /* ModR/M.reg := op(MODR/M.r/m, VSIB, VEX.vvvv) */
5369 /*
5370 * All instructions that use VSIB are currently a mess. See the
5371 * comment around the dis_gather_regs_t structure definition.
5372 */
5376 #ifdef DIS_TEXT
5380 #endif
5386 /*
5387 * VEX prefix uses the 1's complement form to encode the
5388 * XMM/YMM regs
5389 */
5396 /* ModR/M.rm := op(VEX.vvvv, ModR/M.reg) */
5405 /* vmovsd <xmm>, <m64> */
5406 /* or vmovss <xmm>, <m64> */
5409 }
5410 }
5418 /* ModR/M.reg := op(VEX.vvvv, ModR/M.r_m, imm8[7:4]) */
5426 /* vinsertf128 <imm8>, <xmm>, <ymm>, <ymm> */
5430 /* vpinsrb <imm8>, <reg/mm>, <xmm>, <xmm> */
5431 /* or vpinsrw <imm8>, <reg/mm>, <xmm>, <xmm> */
5434 /* vpinsrd/q <imm8>, <reg/mm>, <xmm>, <xmm> */
5435 #ifdef DIS_TEXT
5438 #endif
5442 }
5444 /* one byte immediate number */
5447 /* vblendvpd, vblendvps, vblendvb use the imm encode the regs */
5451 #ifdef DIS_TEXT
5453 #endif
5455 #ifdef DIS_TEXT
5459 else
5462 #endif
5463 }
5467 /* ModR/M.reg := op(ModR/M.rm) */
5472 L_VEX_MX:
5477 /* vcvtpd2dq <ymm>, <xmm> */
5478 /* or vcvtpd2ps <ymm>, <xmm> */
5479 /* or vcvttpd2dq <ymm>, <xmm> */
5491 /* vcvtdq2pd <xmm>, <ymm> */
5492 /* or vcvtps2pd <xmm>, <ymm> */
5493 /* or vcvtph2ps <xmm>, <ymm> */
5494 /* or vbroadcasts* <xmm>, <ymm> */
5498 /* vmovd/q <reg/mem 32/64>, <xmm> */
5499 #ifdef DIS_TEXT
5502 #endif
5508 }
5513 /* ModR/M.reg := op(ModR/M.rm, imm8) */
5522 /* one byte immediate number */
5527 /* VEX.vvvv := op(ModR/M.rm, imm8) */
5531 #ifdef DIS_TEXT
5533 OPLEN);
5534 #endif
5540 /* one byte immediate number */
5545 /* ModR/M.reg (reg32/64) := op(ModR/M.rm) */
5547 /* vpextrw <imm8>, <xmm>, <reg> */
5553 }
5566 /* opmask: mod_rm := %k */
5575 /* opmask: mod_reg := mod_rm */
5584 }
5588 /* opmask: mod_reg := mod_rm */
5597 /* implicit(eflags/r32) := op(ModR/M.reg, ModR/M.rm) */
5607 /* ModR/M.rm := op(ModR/M.reg) */
5608 /* vextractf128 || vcvtps2ph */
5619 /* one byte immediate number */
5622 }
5633 /* ModR/M.rm := op(ModR/M.reg) */
5640 /* vmovd/q <reg/mem 32/64>, <xmm> */
5641 #ifdef DIS_TEXT
5644 #endif
5653 /* ModR/M.rm := op(ModR/M.reg, imm) */
5659 #ifdef DIS_TEXT
5661 /* vpextrd/q <imm>, <xmm>, <reg/mem 32/64> */
5664 }
5665 #endif
5669 /* one byte immediate number */
5673 /* ModR/M.rm := op(ModR/M.reg, imm) */
5681 /* one byte immediate number */
5686 /* ModR/M.rm := op(ModR/M.reg) */
5695 /* one byte immediate number */
5698 }
5703 L_VEX_RM:
5711 /* ModR/M.rm := op(VEX.vvvv, ModR/M.reg) */
5717 /* VEX use the 1's complement form encode the XMM/YMM regs */
5723 /* ModR/M.reg := op(VEX.vvvv, ModR/M.rm) */
5734 #ifdef DIS_TEXT
5737 #endif
5741 /*
5742 * The BLS instructions are VEX instructions that are based on
5743 * VEX.0F38.F3; however, they are considered special group 17
5744 * and like everything else, they use the bits in 3-5 of the
5745 * MOD R/M to determine the sub instruction. Unlike many others
5746 * like the VMX instructions, these are valid both for memory
5747 * and register forms.
5748 */
5755 #ifdef DIS_TEXT
5757 #endif
5760 #ifdef DIS_TEXT
5762 #endif
5765 #ifdef DIS_TEXT
5767 #endif
5771 }
5774 #ifdef DIS_TEXT
5776 #endif
5780 }
5782 /* ModR/M.reg := op(ModR/M.rm) */
5796 /* ModR/M.rm := op(ModR/M.reg) */
5810 /* ModR/M.reg := op(EVEX.vvvv, ModR/M.r/m) */
5819 /*
5820 * EVEX.vvvv is the same as VEX.vvvv (ones complement of the
5821 * register specifier). The EVEX prefix handling uses the vex_v
5822 * variable for these bits.
5823 */
5829 /* an invalid op code */
5835 NOMEM;
5842 done:
5843 #ifdef DIS_MEM
5844 /*
5845 * compute the size of any memory accessed by the instruction
5846 */
5860 }
5865 /*
5866 * In 64 bit mode descriptor table entries
5867 * go up to 10 bytes and popf/pushf are always 8 bytes
5868 */
5874 else
5885 else
5893 }
5894 #endif
5897 error:
5898 #ifdef DIS_TEXT
5900 #endif
5902 }
5904 #ifdef DIS_TEXT
5906 /*
5907 * Some instructions should have immediate operands printed
5908 * as unsigned integers. We compare against this table.
5909 */
5913 0
5914 };
5917 static int
5919 {
5924 /*
5925 * Work back to start of last mnemonic, since we may have
5926 * prefixes on some opcodes.
5927 */
5940 }
5942 }
5944 /*
5945 * Print a numeric immediate into end of buf, maximum length buflen.
5946 * The immediate may be an address or a displacement. Mask is set
5947 * for address size. If the immediate is a "small negative", or
5948 * if it's a negative displacement of any magnitude, print as -<absval>.
5949 * Respect the "octal" flag. "Small negative" is defined as "in the
5950 * interval [NEG_LIMIT, 0)".
5951 *
5952 * Also, "isunsigned_op()" instructions never print negatives.
5953 *
5954 * Return whether we decided to print a negative value or not.
5955 */
5957 #define NEG_LIMIT -255
5961 static int
5964 {
5981 else
5986 }
5987 }
5990 static int
5992 {
5998 }
6000 }
6002 /* ARGSUSED */
6003 void
6006 {
6020 /*
6021 * For PC-relative jumps, the pc is really the next pc after executing
6022 * this instruction, so increment it appropriately.
6023 */
6034 /*
6035 * sv is for the signed, possibly-truncated immediate or
6036 * displacement; usv retains the original size and
6037 * unsignedness for symbol lookup.
6038 */
6042 /*
6043 * About masks: for immediates that represent
6044 * addresses, the appropriate display size is
6045 * the effective address size of the instruction.
6046 * This includes MODE_OFFSET, MODE_IPREL, and
6047 * MODE_RIPREL. Immediates that are simply
6048 * immediate values should display in the operand's
6049 * size, however, since they don't represent addresses.
6050 */
6052 /* d86_addr_size is SIZEnn, which is log2(real size) */
6055 /* d86_value_size and d86_imm_bytes are in bytes */
6075 buflen);
6080 }
6087 /*
6088 * We printed a negative value for an
6089 * immediate that wasn't a
6090 * displacement. Note that fact so we can
6091 * print the positive value as an
6092 * annotation.
6093 */
6097 }
6114 }
6122 }
6123 }
6125 /*
6126 * The symbol lookups may result in false positives,
6127 * particularly on object files, where small numbers may match
6128 * the 0-relative non-relocated addresses of symbols.
6129 */
6140 }
6142 /*
6143 * If we printed a negative immediate above, print the
6144 * positive in case our heuristic was unhelpful
6145 */
6151 }
6152 }
6155 /* Print symbol or effective address for reltgt */
6162 }
6163 }