OLD | NEW |
| (Empty) |
1 # Copyright (c) 2011 The Native Client Authors. All rights reserved. | |
2 # Use of this source code is governed by a BSD-style license that can be | |
3 # found in the LICENSE file. | |
4 ################################################################################ | |
5 # This file describes instructions from AMD64 Architecture Programmer’s Manual | |
6 # Volume 3: General-Purpose and System Instruction | |
7 # Chapter 3: General-Purpose Instruction Reference | |
8 ################################################################################ | |
9 # File format: three rows separated by commas. Line describes one instruction. | |
10 ################################################################################ | |
11 # First column: instruction description. | |
12 # Includes name of the instruction and arguments. | |
13 # | |
14 # Arguments consist of four parts: | |
15 # 1. Read/write attribute (optional). | |
16 # 2. Argument type. | |
17 # 3. Argument size. | |
18 # 4. Implicit argument mark (optional). | |
19 # | |
20 # Read/write attribute: | |
21 # ': Instruction does not use this argument (lea or nop). | |
22 # =: Instruction reads from this argument. | |
23 # !: Instruction writes in this argument. | |
24 # &: Instruction reads this argument and writes the result to it. | |
25 # By default one- and two-operand instructions are assumed to read all | |
26 # operands and store result to the last one, while instructions with | |
27 # three or more operands are assumed to read all operands except last one | |
28 # which is used to store the result of the execution. | |
29 # Possible argument types: | |
30 # 1: One (for instructions like “shr” or “rol”). | |
31 # a: Accumulator (%al/%ax/%eax/%rax depending on size). | |
32 # b: A memory operand addressed by the %ds:(%[er]bx). See “xlat”. | |
33 # c: Implicit %ecx/%rcx (depending on size). | |
34 # d: Implicit %edx/%rdx (depending on size). | |
35 # i: Second immediate value encoded in the instruction. | |
36 # o: I/O port in %dx (used in “in”/“out” instructions). | |
37 # p: Accumulator pair (%dx:%ax/%edx:%eax/%rdx:%rax depending on size). | |
38 # r: Register in opcode (low 3 bits plus rex.B). | |
39 # t: Top of the x87 stack (%st). | |
40 # B: General purpose register specified by the VEX/XOP.vvvv field. | |
41 # E: General purpose register or memory operand specified by the r/m | |
42 # field of the ModRM byte. For memory operands, the ModRM byte may | |
43 # be followed by a SIB byte to specify one of the indexed | |
44 # register-indirect addressing forms. | |
45 # G: General purpose register specified by the reg field of ModRM. | |
46 # H: YMM or XMM register specified by the VEX/XOP.vvvv field. | |
47 # I: Immediate value encoded in the instruction. | |
48 # J: The instruction encoding includes a relative offset that is added to | |
49 # the rIP. | |
50 # L: YMM or XMM register specified using the most-significant 4 bits of an | |
51 # 8-bit immediate value. In legacy or compatibility mode the most | |
52 # significant bit is ignored. | |
53 # M: A memory operand specified by the {mod, r/m} field of the ModRM byte. | |
54 # ModRM.mod ≠ 11b. | |
55 # N: 64-bit MMX register specified by the ModRM.r/m field. The ModRM.mod | |
56 # field must be 11b. | |
57 # O: The offset of an operand is encoded in the instruction. There is no | |
58 # ModRM byte in the instruction encoding. Indexed register-indirect | |
59 # addressing using the SIB byte is not supported. | |
60 # P: 64-bit MMX register specified by the ModRM.reg field. | |
61 # Q: 64-bit MMX-register or memory operand specified by the {mod, r/m} | |
62 # field of the ModRM byte. For memory operands, the ModRM byte may | |
63 # be followed by a SIB byte to specify one of the indexed | |
64 # register-indirect addressing forms. | |
65 # R: General purpose register specified by the ModRM.r/m field. | |
66 # The ModRM.mod field must be 11b. | |
67 # S: Segment register specified by the ModRM.reg field. | |
68 # U: YMM/XMM register specified by the ModRM.r/m field. | |
69 # The ModRM.mod field must be 11b. | |
70 # V: YMM/XMM register specified by the ModRM.reg field. | |
71 # W: YMM/XMM register or memory operand specified by the {mod, r/m} field | |
72 # of the ModRM byte. For memory operands, the ModRM byte may be | |
73 # followed by a SIB byte to specify one of the indexed | |
74 # register-indirect addressing forms. | |
75 # X: A memory operand addressed by the %ds:%[er]si registers. Used in | |
76 # string instructions. | |
77 # Y: A memory operand addressed by the %es:%[er]di registers. Used in | |
78 # string instructions. | |
79 # Possible sizes: | |
80 # ␀: A byte, word, doubleword, or quadword (in 64-bit mode), | |
81 # depending on the effective operand size. | |
82 # 2: Two bits (see VPERMIL2Px instruction). | |
83 # 7: x87 register %st(N). | |
84 # b: A byte, irrespective of the effective operand size. | |
85 # d: A doubleword (32-bit), irrespective of the effective operand size. | |
86 # do: A double octword (256 bits), irrespective of the effective operand | |
87 # size. | |
88 # dq: A double quadword (128 bits), irrespective of the effective | |
89 # operand size. | |
90 # fq: A quadra quadword (256 bits), irrespective of the effective | |
91 # operand size. | |
92 # o: An octword (128 bits), irrespective of the effective operand size. | |
93 # p: A 32-bit or 48-bit far pointer, depending on the effective operand | |
94 # size. | |
95 # pb: A Vector with byte-wide (8-bit) elements (packed byte). | |
96 # pd: A double-precision (64-bit) floating-point vector operand (packed | |
97 # double-precision). | |
98 # pdw: Vector composed of 32-bit doublewords. | |
99 # pdwx: Vector composed of 32-bit doublewords. L bit selects 256bit YMM | |
100 # registers. | |
101 # pdx: A double-precision (64-bit) floating-point vector operand (packed | |
102 # double-precision). L bit selects 256bit YMM registers. | |
103 # ph: A half-precision (16-bit) floating-point vector operand (packed | |
104 # half-precision). | |
105 # phx: A half-precision (16-bit) floating-point vector operand (packed | |
106 # half-precision). L bit selects 256bit YMM registers. | |
107 # pi: Vector composed of 16-bit integers (packed integer). | |
108 # pj: Vector composed of 32-bit integers (packed double integer). | |
109 # pjx: Vector composed of 32-bit integers (packed double integer). | |
110 # L bit selects 256bit YMM registers. | |
111 # pk: Vector composed of 8-bit integers (packed half-word integer). | |
112 # pkx: Vector composed of 8-bit integers (packed half-word integer). | |
113 # L bit selects 256bit YMM registers. | |
114 # pq: Vector composed of 64-bit integers (packed quadword integer). | |
115 # pqw: Vector composed of 64-bit quadwords (packed quadword). | |
116 # pqwx: Vector composed of 64-bit quadwords (packed quadword). L bit | |
117 # selects 256bit YMM registers. | |
118 # pqx: Vector composed of 64-bit integers (packed quadword integer). | |
119 # L bit selects 256bit YMM registers. | |
120 # ps: A single-precision floating-point vector operand (packed | |
121 # single-precision). | |
122 # psx: A single-precision floating-point vector operand (packed | |
123 # single-precision). L bit selects 256bit YMM registers. | |
124 # pw: Vector composed of 16-bit words (packed word). | |
125 # q: A quadword (64-bit), irrespective of the effective operand size. | |
126 # r: Register size (32bit in 32bit mode, 64bit in 64bit mode). | |
127 # s: A 6-byte or 10-byte pseudo-descriptor. | |
128 # sb: A scalar 10-byte packed BCD value (scalar BCD). | |
129 # sd: A scalar double-precision floating-point operand (scalar double). | |
130 # se: A 14-byte or 28-byte x87 environment. | |
131 # si: A scalar doubleword (32-bit) integer operand (scalar integer). | |
132 # sq: A scalar quadword (64-bit) integer operand (scalar integer). | |
133 # sr: A 94-byte or 108-byte x87 state. | |
134 # ss: A scalar single-precision floating-point operand (scalar single). | |
135 # st: A scalar 80bit-precision floating-point operand (scalar tenbytes). | |
136 # sw: A scalar word (16-bit) integer operand (scalar integer). | |
137 # sx: A 512-byte extended x87/MMX/XMM state. | |
138 # v: A word, doubleword, or quadword (in 64-bit mode), depending on | |
139 # the effective operand size. | |
140 # w: A word, irrespective of the effective operand size. | |
141 # y: A doubleword or quadword depending on effective operand size. | |
142 # z: A word if the effective operand size is 16 bits, or a doubleword | |
143 # if the effective operand size is 32 or 64 bits. | |
144 # Implicit argument mark: | |
145 # *: This argument is implicit. It's not shown in the diassembly listing. | |
146 ################################################################################ | |
147 # Second column: instruction opcodes. | |
148 # Includes all opcode bytes. If first opcode bytes is 0x66/data16, | |
149 # 0xf2/repnz, or 0xf3/rep/repz then they can be moved before other prefixes | |
150 # (and will be moved before REX prefix if it's allowed). Note: data16, repnz, | |
151 # and rep/repz opcodes will set appropriate flags while 0x66, 0xf2, and 0xf3 | |
152 # will not. | |
153 # If part of the opcode is stored in ModRM byte then opcode should include the | |
154 # usual “/0”, “/1”, …, “/7” “bytes”. Use /s “byte” for segment register | |
155 # operand: it'll make only registers 0..5 valid (there are only six segment | |
156 # registers in total). Use “/m” or “/r” “byte” to distinguish instructions | |
157 # which have different names for memory and register operands (such as | |
158 # “movlps” or “movhlps”). | |
159 ################################################################################ | |
160 # Third column: additional instruction notes. | |
161 # Different kind of notes for the instruction: untypical prefixes (for example | |
162 # “lock” prefix or “rep” prefix), CPUID checks, etc. | |
163 # | |
164 # Possible prefixes: | |
165 # condrep: prefixes “repnz” and “repz” are allowed for the instruction | |
166 # lock: prefix “lock” is allowed for the instruction | |
167 # rep: prefix “rep” is allowed for the instruction (it's alias of “repz”) | |
168 # no_memory_access: command does not access memory in detectable way: lea, | |
169 # nop, prefetch* instructions… | |
170 # | |
171 # Possible CPUID values: | |
172 # Fn0000_0001_ECX_AES: Fn0000_0001_ECX[AES] | |
173 # Fn0000_0001_ECX_AESAVX: Fn0000_0001_ECX[AES] && Fn0000_0001_ECX[AVX] | |
174 # Fn0000_0001_ECX_AVX: Fn0000_0001_ECX[AVX] | |
175 # Fn0000_0001_ECX_CMPXCHG16B: Fn0000_0001_ECX[CMPXCHG16B] | |
176 # Fn0000_0001_ECX_CVT16: Fn0000_0001_ECX[F16C] | |
177 # Fn0000_0001_ECX_Monitor: Fn0000_0001_ECX[Monitor] | |
178 # Fn0000_0001_ECX_PCLMULQDQ: Fn0000_0001_ECX[PCLMULQDQ] | |
179 # Fn0000_0001_ECX_PCLMULQDQAVX: Fn0000_0001_ECX[PCLMULQDQ] && | |
180 # Fn0000_0001_ECX[AVX] | |
181 # Fn0000_0001_ECX_POPCNT: Fn0000_0001_ECX[POPCNT] | |
182 # Fn0000_0001_ECX_SSE3: Fn0000_00001_ECX[SSE3] | |
183 # Fn0000_0001_ECX_SSE41: Fn0000_0001_ECX[SSE41] | |
184 # Fn0000_0001_ECX_SSE42: Fn0000_0001_ECX[SSE42] | |
185 # Fn0000_0001_ECX_SSSE3: Fn0000_00001_ECX[SSSE3] | |
186 # Fn0000_0001_ECX_XSAVE: Fn0000_0001_ECX[XSAVE] | |
187 # Fn0000_0001_EDX_X87: Fn0000_0001_EDX[x87] | |
188 # Fn0000_0001_EDX_CLFSH: Fn0000_0001_EDX[CLFSH] | |
189 # Fn0000_0001_EDX_CMOV: Fn0000_0001_EDX[CMOV] || Fn8000_0001_EDX[CMOV] | |
190 # Fn0000_0001_EDX_CMPXCHG8B: Fn0000_0001_EDX[CMPXCHG8B] || | |
191 # Fn8000_0001_EDX[CMPXCHG8B] | |
192 # Fn0000_0001_EDX_MMX: Fn0000_0001_EDX[MMX] | |
193 # Fn0000_0001_EDX_RDTSC: Fn0000_0001_EDX[RDTSC] || Fn8000_0001_EDX[RDTSC] | |
194 # Fn0000_0001_EDX_SFENCE: Fn0000_0001_EDX[SSE] || | |
195 # Fn8000_0001_EDX[MmxExt] | |
196 # Fn0000_0001_EDX_SSE1: Fn0000_0001_EDX[SSE] | |
197 # Fn0000_0001_EDX_SSE2: Fn0000_0001_EDX[SSE2] | |
198 # Fn0000_0001_EDX_SYSENTER: Fn0000_0001_EDX[SYSENTER] | |
199 # Fn0000_0007_EBX_x0_BMI: Fn0000_0007_EBX_x0[BMI] | |
200 # Fn8000_0001_ECX_3DNowPrefetch: Fn8000_0001_ECX[3DNowPrefetch] || | |
201 # Fn8000_0001_EDX[LM] || | |
202 # Fn8000_0001_EDX[3DNow] | |
203 # Fn8000_0001_ECX_AltMovCr8: Fn8000_0001_ECX[AltMovCr8] | |
204 # Fn8000_0001_ECX_FMA: Fn8000_0001_ECX[FMA] | |
205 # Fn8000_0001_ECX_FMA4: Fn8000_0001_ECX[FMA4] | |
206 # Fn8000_0001_ECX_LahfSahf: Fn8000_0001_ECX[LahfSahf] | |
207 # Fn8000_0001_ECX_LWP: Fn8000_0001_ECX[LWP] | |
208 # Fn8000_0001_ECX_SVM: Fn8000_0001_ECX[SVM] && EFER.SVME | |
209 # Fn8000_0001_ECX_SKINIT: (Fn8000_0001_ECX[SVM] && EFER.SVME) || | |
210 # Fn8000_0001_ECX[SKINIT] | |
211 # Fn8000_0001_ECX_SSE4A: Fn8000_0001_ECX[SSE4A] | |
212 # Fn8000_0001_ECX_TBM: Fn8000_0001_ECX[TBM] | |
213 # Fn8000_0001_ECX_XOP: Fn8000_0001_ECX[XOP] | |
214 # Fn8000_0001_EDX_3DNow: Fn8000_0001_EDX[3DNow] | |
215 # Fn8000_0001_EDX_MmxExt: Fn8000_0001_EDX[MmxExt] | |
216 # Fn8000_0001_EDX_MmxExtOrSSE: Fn8000_0001_EDX[MmxExt] || | |
217 # Fn0000_0001_EDX[SSE] | |
218 # Fn8000_0001_EDX_RDTSCP: Fn8000_0001_EDX[RDTSCP] | |
219 # Fn8000_0001_EDX_SYSCALL: Fn8000_0001_EDX[SYSCALL] | |
220 ######## ADC ################################################################### | |
221 adc I a, 0x14 | |
222 adc I E, 0x80 /2, lock | |
223 adc Ib Ev, 0x83 /2, lock | |
224 adc G E, 0x10, lock | |
225 adc E G, 0x12, lock | |
226 ######## ADD ################################################################### | |
227 add I a, 0x04 | |
228 add I E, 0x80 /0, lock | |
229 add Ib Ev, 0x83 /0, lock | |
230 add G E, 0x00, lock | |
231 add E G, 0x02, lock | |
232 ######## AND ################################################################### | |
233 and I a, 0x24 | |
234 and I E, 0x80 /4, lock | |
235 and Ib Ev, 0x83 /4, lock | |
236 and G E, 0x20, lock | |
237 and E G, 0x22, lock | |
238 ######## ANDN ################################################################## | |
239 andn Ey By Gy, 0xc4 RXB.02 W.src1.0.00 0xf2, Fn0000_0007_EBX_x0_BMI | |
240 ######## BEXTR ################################################################# | |
241 bextr By Ey Gy, 0xc4 RXB.02 W.cntl.0.00 0xf7, Fn0000_0007_EBX_x0_BMI | |
242 bextr Id Ey Gy, 0x8f RXB.0A W.1111.0.00 0x10, Fn0000_0007_EBX_x0_BMI | |
243 ######## BLCFILL ############################################################### | |
244 blcfill Ey By, 0x8f RXB.09 W.dest.0.00 0x01 /1, Fn8000_0001_ECX_TBM | |
245 ######## BLCI ################################################################## | |
246 blci Ey By, 0x8f RXB.09 W.dest.0.00 0x02 /6, Fn8000_0001_ECX_TBM | |
247 ######## BLCIC ################################################################# | |
248 blcic Ey By, 0x8f RXB.09 W.dest.0.00 0x01 /5, Fn8000_0001_ECX_TBM | |
249 ######## BLCMSK ################################################################ | |
250 blcmsk Ey By, 0x8f RXB.09 W.dest.0.00 0x02 /1, Fn8000_0001_ECX_TBM | |
251 ######## BLCS ################################################################## | |
252 blcs Ey By, 0x8f RXB.09 W.dest.0.00 0x01 /3, Fn8000_0001_ECX_TBM | |
253 ######## BLSFILL ############################################################### | |
254 blsfill Ey By, 0x8f RXB.09 W.dest.0.00 0x01 /2, Fn8000_0001_ECX_TBM | |
255 ######## BLSI ################################################################## | |
256 blsi Ey By, 0xc4 RXB.02 W.dest.0.00 0xf3 /3, Fn0000_0007_EBX_x0_BMI | |
257 ######## BLSIC ################################################################# | |
258 blsic Ey By, 0x8f RXB.09 W.dest.0.00 0x01 /6, Fn8000_0001_ECX_TBM | |
259 ######## BLSMSK ################################################################ | |
260 blsmsk Ey By, 0xc4 RXB.02 W.dest.0.00 0xf3 /2, Fn0000_0007_EBX_x0_BMI | |
261 ######## BLSSR ################################################################# | |
262 blsr Ey By, 0xc4 RXB.02 W.dest.0.00 0xf3 /1, Fn0000_0007_EBX_x0_BMI | |
263 ######## BSF ################################################################### | |
264 bsf Ev Gv, 0x0f 0xbc | |
265 ######## BSR ################################################################### | |
266 bsr Ev Gv, 0x0f 0xbd | |
267 ######## BSWAP ################################################################# | |
268 bswap ry, 0x0f 0xc8 | |
269 ######## BT #################################################################### | |
270 bt Gv Ev, 0x0f 0xa3, nacl-forbidden | |
271 bt Ib Ev, 0x0f 0xba /4, nacl-ia32-forbidden | |
272 ######## BTC ################################################################### | |
273 btc Gv Ev, 0x0f 0xbb, nacl-forbidden | |
274 btc Ib Ev, 0x0f 0xba /7, nacl-ia32-forbidden | |
275 ######## BTR ################################################################### | |
276 btr Gv Ev, 0x0f 0xb3, nacl-forbidden | |
277 btr Ib Ev, 0x0f 0xba /6, nacl-ia32-forbidden | |
278 ######## BTS ################################################################### | |
279 bts Gv Ev, 0x0f 0xab, nacl-forbidden | |
280 bts Ib Ev, 0x0f 0xba /5, nacl-ia32-forbidden | |
281 ######## CALL (Near) ########################################################### | |
282 call Jz, 0xe8 | |
283 # “call” does not require rex prefix and always uses 64bit addresses in x86-64 | |
284 # mode unless data16 prefix is used. We use simple solution: 16bit call is | |
285 # declared as common for 32bit/64bit mode and 32bit/64bit versions are described | |
286 # separately. | |
287 callw Ew, 0x66 0xff /2, nacl-forbidden | |
288 call Ed, 0xff /2, ia32 nacl-forbidden | |
289 callq Eq, 0xff /2, amd64 nacl-forbidden | |
290 ######## CALL (Far) ############################################################ | |
291 # “lcall” does not require rex prefix and always uses 64bit addresses in x86-64 | |
292 # mode unless data16 prefix is used. We use simple solution: 16bit call is | |
293 # declared as common for 32bit/64bit mode and 32bit/64bit versions are described | |
294 # separately. | |
295 lcallw Mp, 0x66 0xff /3, nacl-forbidden | |
296 lcall Mp, 0xff /3, ia32 nacl-forbidden | |
297 lcallq Mp, 0xff /3, amd64 nacl-forbidden | |
298 ######## CBW/CWDE/CDQE ######################################################### | |
299 cbtw, data16 0x98 | |
300 cwtl, 0x98 | |
301 cltq, REXW_NONE 0x98, amd64 | |
302 ######## CWD/CDQ/CQO ########################################################### | |
303 cltd, 0x99 | |
304 cwtd, data16 0x99 | |
305 cqto, REXW_NONE 0x99, amd64 | |
306 ######## CLC ################################################################### | |
307 clc, 0xf8 | |
308 ######## CLD ################################################################### | |
309 cld, 0xfc | |
310 ######## CLFLUSH ############################################################### | |
311 clflush Mb, 0x0f 0xae /7, Fn0000_0001_EDX_CLFSH | |
312 ######## CMC ################################################################### | |
313 cmc, 0xf5 | |
314 ######## CMOVCC ################################################################ | |
315 cmova Ev Gv, 0x0f 0x47, Fn0000_0001_EDX_CMOV | |
316 cmovae Ev Gv, 0x0f 0x43, Fn0000_0001_EDX_CMOV | |
317 cmovbe Ev Gv, 0x0f 0x46, Fn0000_0001_EDX_CMOV | |
318 cmovb Ev Gv, 0x0f 0x42, Fn0000_0001_EDX_CMOV | |
319 cmove Ev Gv, 0x0f 0x44, Fn0000_0001_EDX_CMOV | |
320 cmovg Ev Gv, 0x0f 0x4f, Fn0000_0001_EDX_CMOV | |
321 cmovge Ev Gv, 0x0f 0x4d, Fn0000_0001_EDX_CMOV | |
322 cmovle Ev Gv, 0x0f 0x4e, Fn0000_0001_EDX_CMOV | |
323 cmovl Ev Gv, 0x0f 0x4c, Fn0000_0001_EDX_CMOV | |
324 cmovne Ev Gv, 0x0f 0x45, Fn0000_0001_EDX_CMOV | |
325 cmovno Ev Gv, 0x0f 0x41, Fn0000_0001_EDX_CMOV | |
326 cmovnp Ev Gv, 0x0f 0x4b, Fn0000_0001_EDX_CMOV | |
327 cmovns Ev Gv, 0x0f 0x49, Fn0000_0001_EDX_CMOV | |
328 cmovo Ev Gv, 0x0f 0x40, Fn0000_0001_EDX_CMOV | |
329 cmovp Ev Gv, 0x0f 0x4a, Fn0000_0001_EDX_CMOV | |
330 cmovs Ev Gv, 0x0f 0x48, Fn0000_0001_EDX_CMOV | |
331 ######## CMP ################################################################### | |
332 cmp I =a, 0x3c | |
333 cmp I =E, 0x80 /7 | |
334 cmp Ib =Ev, 0x83 /7 | |
335 cmp G =E, 0x38 | |
336 cmp E =G, 0x3a | |
337 ######## CMPS/CMPSB/CMPSW/CMPSD/CMPSQ ########################################## | |
338 cmps Y X, 0xa6, condrep nacl-forbidden | |
339 ######## CMPXCHG ############################################################### | |
340 cmpxchg G E, 0x0f 0xb0, lock | |
341 ######## CMPXCHG8B/CMPXCHG16B ################################################## | |
342 cmpxchg8b Mq, 0x0f 0xc7 /1, lock Fn0000_0001_EDX_CMPXCHG8B | |
343 cmpxchg16b Mo, rexw 0x0f 0xc7 /1, amd64 lock Fn0000_0001_ECX_CMPXCHG16B | |
344 ######## CPUID ################################################################# | |
345 cpuid, 0x0f 0xa2 | |
346 ######## CRC32 ################################################################# | |
347 crc32 E Gy, 0xf2 0x0f 0x38 0xf0, Fn0000_0001_ECX_SSE42 | |
348 ######## DEC ################################################################### | |
349 dec E, 0xfe /1, lock | |
350 ######## DIV ################################################################### | |
351 div E, 0xf6 /6 | |
352 ######## ENTER ################################################################# | |
353 enter iw =Ib, 0xc8 | |
354 ######## IDIV ################################################################## | |
355 idiv E, 0xf6 /7 | |
356 ######## IMUL ################################################################## | |
357 imul E, 0xf6 /5 | |
358 imul Ev Gv, 0x0f 0xaf | |
359 imul Ib Ev Gv, 0x6b | |
360 imul Iz Ev Gv, 0x69 | |
361 ######## IN #################################################################### | |
362 in Ib ab, 0xe4, nacl-forbidden | |
363 in Ib az, 0xe5, nacl-forbidden | |
364 in ob ab, 0xec, nacl-forbidden | |
365 in oz az, 0xed, nacl-forbidden | |
366 ######## INC ################################################################### | |
367 inc E, 0xfe /0, lock | |
368 ######## INS/INSB/INSW/INSD #################################################### | |
369 ins ob Yb, 0x6c, rep nacl-forbidden | |
370 ins oz Yz, 0x6d, rep nacl-forbidden | |
371 ######## INT ################################################################### | |
372 int =Ib, 0xcd, nacl-forbidden | |
373 ######## JCXZ/JECXZ/JRCXZ ###################################################### | |
374 jecxz Jb, 0xe3, ia32 nacl-forbidden | |
375 jrcxz Jb, 0xe3, amd64 nacl-forbidden | |
376 ######## Jcc ################################################################### | |
377 ja Jb, 0x77 | |
378 ja Jw, data16 0x0f 0x87, nacl-forbidden | |
379 ja Jd, 0x0f 0x87 | |
380 jae Jb, 0x73 | |
381 jae Jw, data16 0x0f 0x83, nacl-forbidden | |
382 jae Jd, 0x0f 0x83 | |
383 jbe Jb, 0x76 | |
384 jbe Jw, data16 0x0f 0x86, nacl-forbidden | |
385 jbe Jd, 0x0f 0x86 | |
386 jb Jb, 0x72 | |
387 jb Jw, data16 0x0f 0x82, nacl-forbidden | |
388 jb Jd, 0x0f 0x82 | |
389 je Jb, 0x74 | |
390 je Jw, data16 0x0f 0x84, nacl-forbidden | |
391 je Jd, 0x0f 0x84 | |
392 jg Jb, 0x7f | |
393 jg Jw, data16 0x0f 0x8f, nacl-forbidden | |
394 jg Jd, 0x0f 0x8f | |
395 jge Jb, 0x7d | |
396 jge Jw, data16 0x0f 0x8d, nacl-forbidden | |
397 jge Jd, 0x0f 0x8d | |
398 jle Jb, 0x7e | |
399 jle Jw, data16 0x0f 0x8e, nacl-forbidden | |
400 jle Jd, 0x0f 0x8e | |
401 jl Jb, 0x7c | |
402 jl Jw, data16 0x0f 0x8c, nacl-forbidden | |
403 jl Jd, 0x0f 0x8c | |
404 jne Jb, 0x75 | |
405 jne Jw, data16 0x0f 0x85, nacl-forbidden | |
406 jne Jd, 0x0f 0x85 | |
407 jno Jb, 0x71 | |
408 jno Jw, data16 0x0f 0x81, nacl-forbidden | |
409 jno Jd, 0x0f 0x81 | |
410 jnp Jb, 0x7b | |
411 jnp Jw, data16 0x0f 0x8b, nacl-forbidden | |
412 jnp Jd, 0x0f 0x8b | |
413 jns Jb, 0x79 | |
414 jns Jw, data16 0x0f 0x89, nacl-forbidden | |
415 jns Jd, 0x0f 0x89 | |
416 jo Jb, 0x70 | |
417 jo Jw, data16 0x0f 0x80, nacl-forbidden | |
418 jo Jd, 0x0f 0x80 | |
419 jp Jb, 0x7a | |
420 jp Jw, data16 0x0f 0x8a, nacl-forbidden | |
421 jp Jd, 0x0f 0x8a | |
422 js Jb, 0x78 | |
423 js Jw, data16 0x0f 0x88, nacl-forbidden | |
424 js Jd, 0x0f 0x88 | |
425 ######## JMP (Near) ############################################################ | |
426 jmp Jz, 0xe9 | |
427 jmp Jb, 0xeb | |
428 # “jmp” does not require rex prefix and always uses 64bit addresses in x86-64 | |
429 # mode unless data16 prefix is used. We use simple solution: 16bit call is | |
430 # declared as common for 32bit/64bit mode and 32bit/64bit versions are described | |
431 # separately. | |
432 jmpw Ew, 0x66 0xff /4, nacl-forbidden | |
433 jmp Ed, 0xff /4, ia32 nacl-forbidden | |
434 jmpq Eq, 0xff /4, amd64 nacl-forbidden | |
435 ######## JMP (Far) ############################################################# | |
436 # “ljmp” does not require rex prefix and always uses 64bit addresses in x86-64 | |
437 # mode unless data16 prefix is used. We use simple solution: 16bit call is | |
438 # declared as common for 32bit/64bit mode and 32bit/64bit versions are described | |
439 # separately. | |
440 ljmpw Mp, 0x66 0xff /5, nacl-forbidden | |
441 ljmp Mp, 0xff /5, ia32 nacl-forbidden | |
442 ljmpq Mp, 0xff /5, amd64 nacl-forbidden | |
443 ######## LAHF ################################################################## | |
444 # LAHF is always awailable in 16bit/32bit mode, but not always in 64bit mode | |
445 lahf, 0x9f, ia32 | |
446 lahf, 0x9f, amd64 Fn8000_0001_ECX_LahfSahf | |
447 ######## LDS/LES/LFS/LGS/LSS (AMD version) ##################################### | |
448 # AMD manual says “executing LFS, LGS, or LSS with a 64-bit operand size only | |
449 # loads a 32-bit general purpose register and the specified segment register”. | |
450 # lfs Mp Gz, 0x0f 0xb4 | |
451 # lgs Mp Gz, 0x0f 0xb5 | |
452 # lss Mp Gz, 0x0f 0xb2 | |
453 ######## LDS/LES/LFS/LGS/LSS (Intel version) ################################### | |
454 # Intel manual says: “Using a REX prefix in the form of REX.W promotes operation | |
455 # to specify a source operand referencing an 80-bit pointer (16-bit selector, | |
456 # 64-bit offset) in memory”. | |
457 lfs Mp Gv, 0x0f 0xb4 | |
458 lgs Mp Gv, 0x0f 0xb5 | |
459 lss Mp Gv, 0x0f 0xb2 | |
460 ######## LEA ################################################################### | |
461 lea 'Mv !Gv, 0x8d, no_memory_access | |
462 ######## LEAVE ################################################################# | |
463 leave, 0xc9, ia32 nacl-forbidden | |
464 leaveq, 0xc9, amd64 nacl-forbidden | |
465 ######## LFENCE ################################################################ | |
466 lfence, 0x0f 0xae 0xe8, Fn0000_0001_EDX_SSE2 | |
467 ######## LLWPCB ################################################################ | |
468 llwpcb Ry, 0x8f RXB.09 W.1111.0.00 0x12 /0, Fn8000_0001_ECX_LWP | |
469 ######## LODS/LODSB/LODSW/LODSD/LODSQ ########################################## | |
470 lods X a, 0xac, nacl-forbidden | |
471 ######## LOOP/LOOPE/LOOPNE/LOOPNZ/LOOPZ ######################################## | |
472 loop Jb, 0xe2, nacl-forbidden | |
473 loope Jb, 0xe1, nacl-forbidden | |
474 loopne Jb, 0xe0, nacl-forbidden | |
475 ######## LWPINS ################################################################ | |
476 lwpins Id Ed By, 0x8f RXB.0A W.src1.0.00 0x12 /0, Fn8000_0001_ECX_LWP | |
477 ######## LWPVAL ################################################################ | |
478 lwpval Id Ed By, 0x8f RXB.0A W.src1.0.00 0x12 /1, Fn8000_0001_ECX_LWP | |
479 ######## LZCNT ################################################################# | |
480 lzcnt Ev Gv, 0xf3 0x0f 0xbd, Fn0000_0007_EBX_x0_BMI | |
481 ######## MFENCE ################################################################ | |
482 mfence, 0x0f 0xae 0xf0, Fn0000_0001_EDX_SSE2 | |
483 ######## MOV ################################################################### | |
484 mov G E, 0x88 | |
485 mov E G, 0x8a | |
486 mov Sw Mw, 0x8c /s | |
487 mov Sw Rv, 0x8c /s | |
488 mov Ew Sw, 0x8e /s | |
489 mov Ib rb, 0xb0 | |
490 mov Iv rv, 0xb8 | |
491 mov I E, 0xc6 /0 | |
492 mov Ob ab, 0xa0, ia32 | |
493 mov Ov av, 0xa1, ia32 | |
494 mov ab Ob, 0xa2, ia32 | |
495 mov av Ov, 0xa3, ia32 | |
496 movabs Ob ab, 0xa0, amd64 nacl-forbidden | |
497 movabs Ov av, 0xa1, amd64 nacl-forbidden | |
498 movabs ab Ob, 0xa2, amd64 nacl-forbidden | |
499 movabs av Ov, 0xa3, amd64 nacl-forbidden | |
500 ######## MOVD ################################################################## | |
501 # This is description according to AMD/Intel manual. | |
502 # movd Ey Vy, 0x66 0x0f 0x6e, Fn0000_0001_EDX_SSE2 | |
503 # movd Vy Ey, 0x66 0x0f 0x7e, Fn0000_0001_EDX_SSE2 | |
504 # movd Ey Py, 0x0f 0x6e, Fn0000_0001_EDX_MMX | |
505 # movd Py Ey, 0x0f 0x7e, Fn0000_0001_EDX_MMX | |
506 # Objdump names 64bit version not “movd” but movq”. We describe 32bit version | |
507 # and 64bit version separately. | |
508 movd Ed Vq, 0x66 0x0f 0x6e, Fn0000_0001_EDX_SSE2 | |
509 movd Vq Ed, 0x66 0x0f 0x7e, Fn0000_0001_EDX_SSE2 | |
510 movd Ed Pq, 0x0f 0x6e, Fn0000_0001_EDX_MMX | |
511 movd Pq Ed, 0x0f 0x7e, Fn0000_0001_EDX_MMX | |
512 movq Eq Vq, 0x66 rexw 0x0f 0x6e, amd64 Fn0000_0001_EDX_SSE2 | |
513 movq Vq Eq, 0x66 rexw 0x0f 0x7e, amd64 Fn0000_0001_EDX_SSE2 | |
514 movq Eq Pq, rexw 0x0f 0x6e, amd64 Fn0000_0001_EDX_MMX | |
515 movq Pq Eq, rexw 0x0f 0x7e, amd64 Fn0000_0001_EDX_MMX | |
516 ######## MOVMSKPD ############################################################## | |
517 movmskpd Upd Gd, 0x66 0x0f 0x50, Fn0000_0001_EDX_SSE2 | |
518 ######## MOVMSKPS ############################################################## | |
519 movmskps Ups Gd, 0x0f 0x50, Fn0000_0001_EDX_SSE1 | |
520 ######## MOVNTI ################################################################ | |
521 movnti Gy My, 0x0f 0xc3, Fn0000_0001_EDX_SSE2 | |
522 ######## MOVS/MOVSB/MOVSW/MOVSD/MOVSQ ########################################## | |
523 movs X Y, 0xa4, rep nacl-forbidden | |
524 ######## MOVSX ################################################################# | |
525 # This is description according to AMD/Intel manual. | |
526 # movsx Eb Gv, 0x0f 0xbe | |
527 # movsx Ew Gy, 0x0f 0xbf | |
528 # Objdump has different names for this instrustion: “movsbw”, “movsbl”, “movsbq”
, | |
529 # “movswl”, “movswq” depending on operand size. We describe 32bit versions and | |
530 # 64bit version separately. | |
531 movsbw Eb Gw, data16 0x0f 0xbe | |
532 movsbl Eb Gd, 0x0f 0xbe | |
533 movswl Ew Gd, 0x0f 0xbf | |
534 movsbq Eb Gq, rexw 0x0f 0xbe, amd64 | |
535 movswq Ew Gq, rexw 0x0f 0xbf, amd64 | |
536 ######## MOVSXD ################################################################ | |
537 movslq Ed Gv, 0x63, amd64 | |
538 ######## MOVZX ################################################################# | |
539 # This is description according to AMD/Intel manual. | |
540 # movsx Eb Gv, 0x0f 0xb6 | |
541 # movsx Ew Gy, 0x0f 0xb7 | |
542 # Objdump has different names for this instrustion: “movzbw”, “movzbl”, “movzbq”
, | |
543 # “movzwl”, “movzwq” depending on operand size. We describe 32bit versions and | |
544 # 64bit version separately. | |
545 movzbw Eb Gw, data16 0x0f 0xb6 | |
546 movzbl Eb Gd, 0x0f 0xb6 | |
547 movzwl Ew Gd, 0x0f 0xb7 | |
548 movzbq Eb Gq, rexw 0x0f 0xb6, amd64 | |
549 movzwq Ew Gq, rexw 0x0f 0xb7, amd64 | |
550 ######## MUL ################################################################### | |
551 mul E, 0xf6 /4 | |
552 ######## NEG ################################################################### | |
553 neg E, 0xf6 /3, lock | |
554 ######## NOP ################################################################### | |
555 nop, 0x90 | |
556 nop 'Ev, 0x0f 0x1f /0, no_memory_access | |
557 ######## NOT ################################################################### | |
558 not E, 0xf6 /2, lock | |
559 ######## OR #################################################################### | |
560 or I a, 0x0c | |
561 or I E, 0x80 /1, lock | |
562 or Ib Ev, 0x83 /1, lock | |
563 or G E, 0x08, lock | |
564 or E G, 0x0a, lock | |
565 ######## OUT ################################################################### | |
566 out ab =Ib, 0xe6, nacl-forbidden | |
567 out az =Ib, 0xe7, nacl-forbidden | |
568 out ab =ob, 0xee, nacl-forbidden | |
569 out az =oz, 0xef, nacl-forbidden | |
570 ######## OUTS/OUTSB/OUTSW/OUTSD ################################################ | |
571 outs Xb =ob, 0x6e, rep nacl-forbidden | |
572 outs Xz =oz, 0x6f, rep nacl-forbidden | |
573 ######## PAUSE ################################################################# | |
574 pause, 0xf3 0x90 | |
575 ######## POP ################################################################### | |
576 # “pop” does not require rex prefix and always uses 64bit addresses in x86-64 | |
577 # mode unless data16 prefix is used. We use simple solution: 16bit call is | |
578 # declared as common for 32bit/64bit mode and 32bit/64bit versions are described | |
579 # separately. | |
580 pop Ew, 0x66 0x8f /0 | |
581 pop Ed, 0x8f /0, ia32 | |
582 pop Eq, 0x8f /0, amd64 | |
583 pop rr, 0x58 | |
584 pop\ \ \ \ %fs, 0x0f 0xa1, ia32 nacl-forbidden | |
585 pop\ \ \ \ %gs, 0x0f 0xa9, ia32 nacl-forbidden | |
586 popq\ \ \ %fs, 0x0f 0xa1, amd64 nacl-forbidden | |
587 popq\ \ \ %gs, 0x0f 0xa9, amd64 nacl-forbidden | |
588 ######## POPCNT ################################################################ | |
589 popcnt Ev Gv, 0xf3 0x0f 0xb8, Fn0000_0001_ECX_POPCNT | |
590 ######## POPF/POPFD/POPFQ ###################################################### | |
591 popfw, data16 0x9d | |
592 popf, 0x9d, ia32 nacl-forbidden | |
593 popfq, 0x9d, amd64 nacl-forbidden | |
594 ######## PREFETCH/PREFETCHW #################################################### | |
595 prefetch Mb, 0x0f 0x0d /0, Fn8000_0001_ECX_3DNowPrefetch no_memory_access | |
596 prefetchw Mb, 0x0f 0x0d /1, Fn8000_0001_ECX_3DNowPrefetch no_memory_access | |
597 ######## PREFETCHlevel ######################################################### | |
598 prefetchnta Mb, 0x0f 0x18 /0, no_memory_access | |
599 prefetcht0 Mb, 0x0f 0x18 /1, no_memory_access | |
600 prefetcht1 Mb, 0x0f 0x18 /2, no_memory_access | |
601 prefetcht2 Mb, 0x0f 0x18 /3, no_memory_access | |
602 ######## PUSH ################################################################## | |
603 # “push” does not require rex prefix and always uses 64bit addresses in x86-64 | |
604 # mode unless data16 prefix is used. We use simple solution: 16bit call is | |
605 # declared as common for 32bit/64bit mode and 32bit/64bit versions are described | |
606 # separately. | |
607 # 16bit push is forbidden in x86-64 NaCl, but surprisingly is not forbidden in | |
608 # 32bit NaCl. | |
609 push =Ew, 0x66 0xff /6, nacl-amd64-forbidden | |
610 push =Ed, 0xff /6, ia32 | |
611 push =Eq, 0xff /6, amd64 | |
612 push =rr, 0x50 | |
613 push =Iz, 0x68 | |
614 push =Ib, 0x6a | |
615 push\ \ \ %fs, 0x0f 0xa0, ia32 nacl-forbidden | |
616 push\ \ \ %gs, 0x0f 0xa8, ia32 nacl-forbidden | |
617 pushq\ \ %fs, 0x0f 0xa0, amd64 nacl-forbidden | |
618 pushq\ \ %gs, 0x0f 0xa8, amd64 nacl-forbidden | |
619 ######## PUSHF/PUSHFD/PUSHFQ ################################################### | |
620 pushfw, data16 0x9c | |
621 pushf, 0x9c, ia32 nacl-forbidden | |
622 pushfq, 0x9c, amd64 nacl-forbidden | |
623 ######## RCL ################################################################### | |
624 rcl E, 0xd0 /2 | |
625 rcl cb E, 0xd2 /2 | |
626 rcl Ib E, 0xc0 /2 | |
627 ######## RCR ################################################################### | |
628 rcr E, 0xd0 /3 | |
629 rcr cb E, 0xd2 /3 | |
630 rcr Ib E, 0xc0 /3 | |
631 ######## RET (Near) ############################################################ | |
632 ret =Iw, 0xc2, nacl-forbidden | |
633 ret, 0xc3, rep ia32 nacl-forbidden | |
634 retq, 0xc3, rep amd64 nacl-forbidden | |
635 ######## RET (Far) ############################################################# | |
636 lret, 0xcb | |
637 lret =Iw, 0xca | |
638 ######## ROL ################################################################### | |
639 rol E, 0xd0 /0 | |
640 rol cb E, 0xd2 /0 | |
641 rol Ib E, 0xc0 /0 | |
642 ######## ROR ################################################################### | |
643 ror Ib E, 0xc0 /1 | |
644 ror E, 0xd0 /1 | |
645 ror cb E, 0xd2 /1 | |
646 ######## SAHF ################################################################## | |
647 # SAHF is always awailable in 16bit/32bit mode, but not always in 64bit mode | |
648 sahf, 0x9e, ia32 | |
649 sahf, 0x9e, amd64 Fn8000_0001_ECX_LahfSahf | |
650 ######## SAL ################################################################### | |
651 # AMD manual claims this opcode works identically to shl. Intel manual | |
652 # says it's reserved. Objdump does not like it. | |
653 # sal E, 0xd0 /6 | |
654 # sal cb E, 0xd2 /6 | |
655 # sal Ib E, 0xc0 /6 | |
656 ######## SAL/SHL ############################################################### | |
657 shl E, 0xd0 /4 | |
658 shl cb E, 0xd2 /4 | |
659 shl Ib E, 0xc0 /4 | |
660 ######## SAR ################################################################### | |
661 sar Ib E, 0xc0 /7 | |
662 sar E, 0xd0 /7 | |
663 sar cb E, 0xd2 /7 | |
664 ######## SBB ################################################################### | |
665 sbb I a, 0x1c | |
666 sbb I E, 0x80 /3, lock | |
667 sbb Ib Ev, 0x83 /3, lock | |
668 sbb G E, 0x18, lock | |
669 sbb E G, 0x1a, lock | |
670 ######## SCAS/SCASB/SCASW/SCASD/SCASQ ########################################## | |
671 scas Y a, 0xae, nacl-forbidden | |
672 ######## SETcc ################################################################# | |
673 seta Eb, 0x0f 0x97, Fn0000_0001_EDX_CMOV | |
674 setae Eb, 0x0f 0x93, Fn0000_0001_EDX_CMOV | |
675 setbe Eb, 0x0f 0x96, Fn0000_0001_EDX_CMOV | |
676 setb Eb, 0x0f 0x92, Fn0000_0001_EDX_CMOV | |
677 sete Eb, 0x0f 0x94, Fn0000_0001_EDX_CMOV | |
678 setg Eb, 0x0f 0x9f, Fn0000_0001_EDX_CMOV | |
679 setge Eb, 0x0f 0x9d, Fn0000_0001_EDX_CMOV | |
680 setle Eb, 0x0f 0x9e, Fn0000_0001_EDX_CMOV | |
681 setl Eb, 0x0f 0x9c, Fn0000_0001_EDX_CMOV | |
682 setne Eb, 0x0f 0x95, Fn0000_0001_EDX_CMOV | |
683 setno Eb, 0x0f 0x91, Fn0000_0001_EDX_CMOV | |
684 setnp Eb, 0x0f 0x9b, Fn0000_0001_EDX_CMOV | |
685 setns Eb, 0x0f 0x99, Fn0000_0001_EDX_CMOV | |
686 seto Eb, 0x0f 0x90, Fn0000_0001_EDX_CMOV | |
687 setp Eb, 0x0f 0x9a, Fn0000_0001_EDX_CMOV | |
688 sets Eb, 0x0f 0x98, Fn0000_0001_EDX_CMOV | |
689 ######## SFENCE ################################################################ | |
690 sfence, 0x0f 0xae 0xf8, Fn0000_0001_EDX_SFENCE | |
691 ######## SHLD ################################################################## | |
692 shld Ib Gv Ev, 0x0f 0xa4 | |
693 shld cb Gv Ev, 0x0f 0xa5 | |
694 ######## SHR ################################################################### | |
695 shr E, 0xd0 /5 | |
696 shr cb E, 0xd2 /5 | |
697 shr Ib E, 0xc0 /5 | |
698 ######## SHRD ################################################################## | |
699 shrd Ib Gv Ev, 0x0f 0xac | |
700 shrd cb Gv Ev, 0x0f 0xad | |
701 ######## SLWPCB ################################################################ | |
702 slwpcb Ry, 0x8f RXB.09 W.1111.0.00 0x12 /1, Fn8000_0001_ECX_LWP | |
703 ######## STC ################################################################### | |
704 stc, 0xf9 | |
705 ######## STD ################################################################### | |
706 std, 0xfd | |
707 ######## STOS/STOSB/STOSW/STOSD/STOSQ ########################################## | |
708 stos a Y, 0xaa, rep nacl-forbidden | |
709 ######## SUB ################################################################### | |
710 sub I a, 0x2c | |
711 sub I E, 0x80 /5, lock | |
712 sub Ib Ev, 0x83 /5, lock | |
713 sub G E, 0x28, lock | |
714 sub E G, 0x2a, lock | |
715 ######## T1MSKC ################################################################ | |
716 t1mskc Ey By, 0x8f RXB.09 W.dest.0.00 0x01 /7, Fn8000_0001_ECX_TBM | |
717 ######## TEST ################################################################## | |
718 test I a, 0xa8 | |
719 test I E, 0xf6 /0 | |
720 # AMD manual claims this opcode works identically to “/0”. Intel manual | |
721 # says it's reserved. Objdump does not like it. | |
722 # test I E, 0xf6 /1 | |
723 test G E, 0x84 | |
724 ######## TZCNT ################################################################# | |
725 tzcnt Ev Gv, 0xf3 0x0f 0xbc, Fn0000_0007_EBX_x0_BMI | |
726 ######## TZMSK ################################################################# | |
727 tzmsk Ey By, 0x8f RXB.09 W.dest.0.00 0x01 /4, Fn8000_0001_ECX_TBM | |
728 ######## XADD ################################################################## | |
729 xadd G E, 0x0f 0xc0, lock | |
730 ######## XCHG ################################################################## | |
731 xchg av rv, 0x90 | |
732 xchg G E, 0x86, lock | |
733 ######## XLAT ################################################################## | |
734 xlat bb, 0xd7 | |
735 ######## XOR ################################################################### | |
736 xor I a, 0x34 | |
737 xor I E, 0x80 /6, lock | |
738 xor Ib Ev, 0x83 /6, lock | |
739 xor G E, 0x30, lock | |
740 xor E G, 0x32, lock | |
741 ################################################################################ | |
OLD | NEW |