@samitouri / QOSamiQemu
Code Commits Issues Pulls Sessions CI/CD
master
master
inc 3,201 lines 122 KB
Raw
1 /*
2 * New-style decoder for i386 instructions
3 *
4 * Copyright (c) 2022 Red Hat, Inc.
5 *
6 * Author: Paolo Bonzini <pbonzini@redhat.com>
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 /*
23 * The decoder is mostly based on tables copied from the Intel SDM. As
24 * a result, most operand load and writeback is done entirely in common
25 * table-driven code using the same operand type (X86_TYPE_*) and
26 * size (X86_SIZE_*) codes used in the manual. There are a few differences
27 * though.
28 *
29 * Operand sizes
30 * -------------
31 *
32 * The manual lists d64 ("cannot encode 32-bit size in 64-bit mode") and f64
33 * ("cannot encode 16-bit or 32-bit size in 64-bit mode") as modifiers of the
34 * "v" or "z" sizes. The decoder simply makes them separate operand sizes.
35 *
36 * The manual lists immediate far destinations as Ap (technically an implicit
37 * argument). The decoder splits them into two immediates, using "Ip" for
38 * the offset part (that comes first in the instruction stream) and "Iw" for
39 * the segment/selector part. The size of the offset is given by s->dflag
40 * and the instructions are illegal in 64-bit mode, so the choice of "Ip"
41 * is somewhat arbitrary; "Iv" or "Iz" would work just as well.
42 *
43 * Operand types
44 * -------------
45 *
46 * For memory-only operands, if the emitter functions wants to rely on
47 * generic load and writeback, the decoder needs to know the type of the
48 * operand. Therefore, M is often replaced by the more specific EM and WM
49 * (respectively selecting an ALU operand, like the operand type E, or a
50 * vector operand like the operand type W).
51 *
52 * Immediates are almost always signed or masked away in helpers. Two
53 * common exceptions are IN/OUT and absolute jumps. For these, there is
54 * an additional custom operand type "I_unsigned". Alternatively, the
55 * mask could be applied (and the original sign-extended value would be
56 * optimized away by TCG) in the emitter function.
57 *
58 * Finally, a "nop" operand type is used for multi-byte NOPs. It accepts
59 * any value of mod including 11b (unlike M) but it does not try to
60 * interpret the operand (like M).
61 *
62 * Vector operands
63 * ---------------
64 *
65 * The main difference is that the V, U and W types are extended to
66 * cover MMX as well; if an instruction is like
67 *
68 * por Pq, Qq
69 * 66 por Vx, Hx, Wx
70 *
71 * only the second row is included and the instruction is marked as a
72 * valid MMX instruction. The MMX flag directs the decoder to rewrite
73 * the V/U/H/W types to P/N/P/Q if there is no prefix, as well as changing
74 * "x" to "q" if there is no prefix.
75 *
76 * In addition, the ss/ps/sd/pd types are sometimes mushed together as "x"
77 * if the difference is expressed via prefixes. Individual instructions
78 * are separated by prefix in the generator functions.
79 *
80 * There is a custom size "xh" used to address half of a SSE/AVX operand.
81 * This points to a 64-bit operand for SSE operations, 128-bit operand
82 * for 256-bit AVX operands, etc. It is used for conversion operations
83 * such as VCVTPH2PS or VCVTSS2SD.
84 *
85 * There are a couple cases in which instructions (e.g. MOVD) write the
86 * whole XMM or MM register but are established incorrectly in the manual
87 * as "d" or "q". These have to be fixed for the decoder to work correctly.
88 *
89 * VEX exception classes
90 * ---------------------
91 *
92 * Speaking about imprecisions in the manual, the decoder treats all
93 * exception-class 4 instructions as having an optional VEX prefix, and
94 * all exception-class 6 instructions as having a mandatory VEX prefix.
95 * This is true except for a dozen instructions; these are in exception
96 * class 4 but do not ignore the VEX.W bit (which does not even exist
97 * without a VEX prefix). These instructions are mostly listed in Intel's
98 * table 2-16, but with a few exceptions.
99 *
100 * The AMD manual has more precise subclasses for exceptions, and unlike Intel
101 * they list the VEX.W requirements in the exception classes as well (except
102 * when they don't). AMD describes class 6 as "AVX Mixed Memory Argument"
103 * without defining what a mixed memory argument is, but still use 4 as the
104 * primary exception class... except when they don't.
105 *
106 * The summary is:
107 * Intel AMD VEX.W note
108 * -------------------------------------------------------------------
109 * vpblendd 4 4J 0
110 * vpblendvb 4 4E-X 0 (*)
111 * vpbroadcastq 6 6D 0 (+)
112 * vpermd/vpermps 4 4H 0 (§)
113 * vpermq/vpermpd 4 4H-1 1 (§)
114 * vpermilpd/vpermilps 4 6E 0 (^)
115 * vpmaskmovd 6 4K significant (^)
116 * vpsllv 4 4K significant
117 * vpsrav 4 4J 0
118 * vpsrlv 4 4K significant
119 * vtestps/vtestpd 4 4G 0
120 *
121 * (*) AMD lists VPBLENDVB as related to SSE4.1 PBLENDVB, which may
122 * explain why it is considered exception class 4. However,
123 * Intel says that VEX-only instructions should be in class 6...
124 *
125 * (+) Not found in Intel's table 2-16
126 *
127 * (§) 4H and 4H-1 do not mention VEX.W requirements, which are
128 * however present in the description of the instruction
129 *
130 * (^) these are the two cases in which Intel and AMD disagree on the
131 * primary exception class
132 *
133 * Instructions still in translate.c
134 * ---------------------------------
135 * Generation of TCG opcodes for almost all instructions is in emit.c.inc;
136 * this file interprets the prefixes and opcode bytes down to individual
137 * instruction mnemonics. There is only a handful of opcodes still using
138 * a switch statement to decode modrm bits 3-5 and prefixes after decoding
139 * is complete; these are relics of the older x86 decoder and their code
140 * generation is performed in translate.c.
141 *
142 * These unconverted opcodes also perform their own effective address
143 * generation using the gen_lea_modrm() function.
144 *
145 * There is nothing particularly complicated about them; simply, they don't
146 * need any nasty hacks in the decoder, and they shouldn't get in the way
147 * of the implementation of new x86 instructions, so they are left alone
148 * for the time being.
149 *
150 * x87:
151 * 0xD8 - 0xDF
152 *
153 * privileged/system:
154 * 0x0F 0x00 group 6 (SLDT, STR, LLDT, LTR, VERR, VERW)
155 * 0x0F 0x01 group 7 (SGDT, SIDT, LGDT, LIDT, SMSW, LMSW, INVLPG,
156 * MONITOR, MWAIT, CLAC, STAC, XGETBV, XSETBV,
157 * SWAPGS, RDTSCP)
158 * 0x0F 0xC7 (reg operand) group 9 (RDRAND, RDSEED, RDPID)
159 *
160 * MPX:
161 * 0x0F 0x1A BNDLDX, BNDMOV, BNDCL, BNDCU
162 * 0x0F 0x1B BNDSTX, BNDMOV, BNDMK, BNDCN
163 */
164
165 #define X86_OP_NONE { 0 },
166
167 #define X86_OP_GROUP3(op, op0_, s0_, op1_, s1_, op2_, s2_, ...) { \
168 .decode = glue(decode_, op), \
169 .op0 = glue(X86_TYPE_, op0_), \
170 .s0 = glue(X86_SIZE_, s0_), \
171 .op1 = glue(X86_TYPE_, op1_), \
172 .s1 = glue(X86_SIZE_, s1_), \
173 .op2 = glue(X86_TYPE_, op2_), \
174 .s2 = glue(X86_SIZE_, s2_), \
175 .is_decode = true, \
176 ## __VA_ARGS__ \
177 }
178
179 #define X86_OP_GROUP1(op, op0, s0, ...) \
180 X86_OP_GROUP3(op, op0, s0, 2op, s0, None, None, ## __VA_ARGS__)
181 #define X86_OP_GROUP2(op, op0, s0, op1, s1, ...) \
182 X86_OP_GROUP3(op, op0, s0, 2op, s0, op1, s1, ## __VA_ARGS__)
183 #define X86_OP_GROUPw(op, op0, s0, ...) \
184 X86_OP_GROUP3(op, op0, s0, None, None, None, None, ## __VA_ARGS__)
185 #define X86_OP_GROUPwr(op, op0, s0, op1, s1, ...) \
186 X86_OP_GROUP3(op, op0, s0, op1, s1, None, None, ## __VA_ARGS__)
187 #define X86_OP_GROUP0(op, ...) \
188 X86_OP_GROUP3(op, None, None, None, None, None, None, ## __VA_ARGS__)
189
190 #define X86_OP_ENTRY3(op, op0_, s0_, op1_, s1_, op2_, s2_, ...) { \
191 .gen = glue(gen_, op), \
192 .op0 = glue(X86_TYPE_, op0_), \
193 .s0 = glue(X86_SIZE_, s0_), \
194 .op1 = glue(X86_TYPE_, op1_), \
195 .s1 = glue(X86_SIZE_, s1_), \
196 .op2 = glue(X86_TYPE_, op2_), \
197 .s2 = glue(X86_SIZE_, s2_), \
198 ## __VA_ARGS__ \
199 }
200
201 #define X86_OP_ENTRY4(op, op0_, s0_, op1_, s1_, op2_, s2_, ...) \
202 X86_OP_ENTRY3(op, op0_, s0_, op1_, s1_, op2_, s2_, \
203 .op3 = X86_TYPE_I, .s3 = X86_SIZE_b, \
204 ## __VA_ARGS__)
205
206 /*
207 * Short forms that are mostly useful for ALU opcodes and other
208 * one-byte opcodes. For vector instructions it is usually
209 * clearer to write all three operands explicitly, because the
210 * corresponding gen_* function will use OP_PTRn rather than s->T0
211 * and s->T1.
212 */
213 #define X86_OP_ENTRYrr(op, op0, s0, op1, s1, ...) \
214 X86_OP_ENTRY3(op, None, None, op0, s0, op1, s1, ## __VA_ARGS__)
215 #define X86_OP_ENTRYwr(op, op0, s0, op1, s1, ...) \
216 X86_OP_ENTRY3(op, op0, s0, op1, s1, None, None, ## __VA_ARGS__)
217 #define X86_OP_ENTRY2(op, op0, s0, op1, s1, ...) \
218 X86_OP_ENTRY3(op, op0, s0, 2op, s0, op1, s1, ## __VA_ARGS__)
219 #define X86_OP_ENTRYw(op, op0, s0, ...) \
220 X86_OP_ENTRY3(op, op0, s0, None, None, None, None, ## __VA_ARGS__)
221 #define X86_OP_ENTRYr(op, op0, s0, ...) \
222 X86_OP_ENTRY3(op, None, None, op0, s0, None, None, ## __VA_ARGS__)
223 #define X86_OP_ENTRY1(op, op0, s0, ...) \
224 X86_OP_ENTRY3(op, op0, s0, 2op, s0, None, None, ## __VA_ARGS__)
225 #define X86_OP_ENTRY0(op, ...) \
226 X86_OP_ENTRY3(op, None, None, None, None, None, None, ## __VA_ARGS__)
227
228 #define cpuid(feat) .cpuid = X86_FEAT_##feat,
229 #define nolea .special = X86_SPECIAL_NoLoadEA,
230 #define xchg .special = X86_SPECIAL_Locked,
231 #define lock .special = X86_SPECIAL_HasLock,
232 #define mmx .special = X86_SPECIAL_MMX,
233 #define op0_Rd .special = X86_SPECIAL_Op0_Rd,
234 #define op2_Ry .special = X86_SPECIAL_Op2_Ry,
235 #define avx_movx .special = X86_SPECIAL_AVXExtMov,
236 #define sextT0 .special = X86_SPECIAL_SExtT0,
237 #define zextT0 .special = X86_SPECIAL_ZExtT0,
238 #define op0_Mw .special = X86_SPECIAL_Op0_Mw,
239 #define btEvGv .special = X86_SPECIAL_BitTest,
240
241 #define vex1 .vex_class = 1,
242 #define vex1_rep3 .vex_class = 1, .vex_special = X86_VEX_REPScalar,
243 #define vex2 .vex_class = 2,
244 #define vex2_rep3 .vex_class = 2, .vex_special = X86_VEX_REPScalar,
245 #define vex3 .vex_class = 3,
246 #define vex4 .vex_class = 4,
247 #define vex4_unal .vex_class = 4, .vex_special = X86_VEX_SSEUnaligned,
248 #define vex4_rep5 .vex_class = 4, .vex_special = X86_VEX_REPScalar,
249 #define vex5 .vex_class = 5,
250 #define vex6 .vex_class = 6,
251 #define vex7 .vex_class = 7,
252 #define vex8 .vex_class = 8,
253 #define vex11 .vex_class = 11,
254 #define vex12 .vex_class = 12,
255 #define vex13 .vex_class = 13,
256
257 #define chk(a) .check = X86_CHECK_##a,
258 #define chk2(a, b) .check = X86_CHECK_##a | X86_CHECK_##b,
259 #define chk3(a, b, c) .check = X86_CHECK_##a | X86_CHECK_##b | X86_CHECK_##c,
260 #define svm(a) .intercept = SVM_EXIT_##a, .has_intercept = true,
261
262 #define avx2_256 .vex_special = X86_VEX_AVX2_256,
263
264 #define P_00 1
265 #define P_66 (1 << PREFIX_DATA)
266 #define P_F3 (1 << PREFIX_REPZ)
267 #define P_F2 (1 << PREFIX_REPNZ)
268
269 #define p_00 .valid_prefix = P_00,
270 #define p_66 .valid_prefix = P_66,
271 #define p_f3 .valid_prefix = P_F3,
272 #define p_f2 .valid_prefix = P_F2,
273 #define p_00_66 .valid_prefix = P_00 | P_66,
274 #define p_00_f3 .valid_prefix = P_00 | P_F3,
275 #define p_66_f2 .valid_prefix = P_66 | P_F2,
276 #define p_00_66_f3 .valid_prefix = P_00 | P_66 | P_F3,
277 #define p_66_f3_f2 .valid_prefix = P_66 | P_F3 | P_F2,
278 #define p_00_66_f3_f2 .valid_prefix = P_00 | P_66 | P_F3 | P_F2,
279
280 #define UNKNOWN_OPCODE ((X86OpEntry) {})
281
282 #define X86_MAX_INSN_LENGTH 15
283
284 static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
285 {
286 uint64_t pc = s->pc;
287
288 /* This is a subsequent insn that crosses a page boundary. */
289 if (s->base.num_insns > 1 &&
290 !translator_is_same_page(&s->base, s->pc + num_bytes - 1)) {
291 siglongjmp(s->jmpbuf, 2);
292 }
293
294 s->pc += num_bytes;
295 if (unlikely(cur_insn_len(s) > X86_MAX_INSN_LENGTH)) {
296 /* If the instruction's 16th byte is on a different page than the 1st, a
297 * page fault on the second page wins over the general protection fault
298 * caused by the instruction being too long.
299 * This can happen even if the operand is only one byte long!
300 */
301 if (((s->pc - 1) ^ (pc - 1)) & TARGET_PAGE_MASK) {
302 (void)translator_ldub(env, &s->base,
303 (s->pc - 1) & TARGET_PAGE_MASK);
304 }
305 siglongjmp(s->jmpbuf, 1);
306 }
307
308 return pc;
309 }
310
311 static inline uint8_t x86_ldub_code(CPUX86State *env, DisasContext *s)
312 {
313 return translator_ldub(env, &s->base, advance_pc(env, s, 1));
314 }
315
316 static inline uint16_t x86_lduw_code(CPUX86State *env, DisasContext *s)
317 {
318 return translator_lduw_end(env, &s->base, advance_pc(env, s, 2), MO_LE);
319 }
320
321 static inline uint32_t x86_ldl_code(CPUX86State *env, DisasContext *s)
322 {
323 return translator_ldl_end(env, &s->base, advance_pc(env, s, 4), MO_LE);
324 }
325
326 #ifdef TARGET_X86_64
327 static inline uint64_t x86_ldq_code(CPUX86State *env, DisasContext *s)
328 {
329 return translator_ldq_end(env, &s->base, advance_pc(env, s, 8), MO_LE);
330 }
331 #endif
332
333 static target_ulong insn_get_addr(CPUX86State *env, DisasContext *s, MemOp ot)
334 {
335 target_ulong ret;
336
337 switch (ot) {
338 case MO_8:
339 ret = x86_ldub_code(env, s);
340 break;
341 case MO_16:
342 ret = x86_lduw_code(env, s);
343 break;
344 case MO_32:
345 ret = x86_ldl_code(env, s);
346 break;
347 #ifdef TARGET_X86_64
348 case MO_64:
349 ret = x86_ldq_code(env, s);
350 break;
351 #endif
352 default:
353 g_assert_not_reached();
354 }
355 return ret;
356 }
357
358 static inline uint32_t insn_get(CPUX86State *env, DisasContext *s, MemOp ot)
359 {
360 uint32_t ret;
361
362 switch (ot) {
363 case MO_8:
364 ret = x86_ldub_code(env, s);
365 break;
366 case MO_16:
367 ret = x86_lduw_code(env, s);
368 break;
369 case MO_32:
370 #ifdef TARGET_X86_64
371 case MO_64:
372 #endif
373 ret = x86_ldl_code(env, s);
374 break;
375 default:
376 g_assert_not_reached();
377 }
378 return ret;
379 }
380
381 static target_long insn_get_signed(CPUX86State *env, DisasContext *s, MemOp ot)
382 {
383 target_long ret;
384
385 switch (ot) {
386 case MO_8:
387 ret = (int8_t) x86_ldub_code(env, s);
388 break;
389 case MO_16:
390 ret = (int16_t) x86_lduw_code(env, s);
391 break;
392 case MO_32:
393 ret = (int32_t) x86_ldl_code(env, s);
394 break;
395 #ifdef TARGET_X86_64
396 case MO_64:
397 ret = x86_ldq_code(env, s);
398 break;
399 #endif
400 default:
401 g_assert_not_reached();
402 }
403 return ret;
404 }
405
406 static uint8_t get_modrm(DisasContext *s, CPUX86State *env)
407 {
408 if (!s->has_modrm) {
409 s->modrm = x86_ldub_code(env, s);
410 s->has_modrm = true;
411 }
412 return s->modrm;
413 }
414
415 static inline const X86OpEntry *decode_by_prefix(DisasContext *s, const X86OpEntry entries[4])
416 {
417 if (s->prefix & PREFIX_REPNZ) {
418 return &entries[3];
419 } else if (s->prefix & PREFIX_REPZ) {
420 return &entries[2];
421 } else if (s->prefix & PREFIX_DATA) {
422 return &entries[1];
423 } else {
424 return &entries[0];
425 }
426 }
427
428 static void decode_group8(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
429 {
430 static const X86GenFunc group8_gen[8] = {
431 NULL, NULL, NULL, NULL,
432 gen_BT, gen_BTS, gen_BTR, gen_BTC,
433 };
434 int op = (get_modrm(s, env) >> 3) & 7;
435 entry->gen = group8_gen[op];
436 if (op == 4) {
437 /* prevent writeback and LOCK for BT */
438 entry->op1 = entry->op0;
439 entry->op0 = X86_TYPE_None;
440 entry->s0 = X86_SIZE_None;
441 } else {
442 entry->special = X86_SPECIAL_HasLock;
443 }
444 }
445
446 static void decode_group9(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
447 {
448 static const X86OpEntry group9_reg =
449 X86_OP_ENTRY0(multi0F); /* unconverted */
450 static const X86OpEntry cmpxchg8b =
451 X86_OP_ENTRY1(CMPXCHG8B, M,q, lock p_00 cpuid(CX8));
452 static const X86OpEntry cmpxchg16b =
453 X86_OP_ENTRY1(CMPXCHG16B, M,dq, lock p_00 cpuid(CX16));
454
455 int modrm = get_modrm(s, env);
456 int op = (modrm >> 3) & 7;
457
458 if ((modrm >> 6) == 3) {
459 *entry = group9_reg;
460 } else if (op == 1) {
461 *entry = REX_W(s) ? cmpxchg16b : cmpxchg8b;
462 } else {
463 *entry = UNKNOWN_OPCODE;
464 }
465 }
466
467 static void decode_group15(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
468 {
469 static const X86OpEntry group15_reg[8] = {
470 [0] = X86_OP_ENTRYw(RDxxBASE, R,y, cpuid(FSGSBASE) chk(o64) p_f3),
471 [1] = X86_OP_ENTRYw(RDxxBASE, R,y, cpuid(FSGSBASE) chk(o64) p_f3),
472 [2] = X86_OP_ENTRYr(WRxxBASE, R,y, cpuid(FSGSBASE) chk(o64) p_f3 zextT0),
473 [3] = X86_OP_ENTRYr(WRxxBASE, R,y, cpuid(FSGSBASE) chk(o64) p_f3 zextT0),
474 [5] = X86_OP_ENTRY0(LFENCE, cpuid(SSE) p_00),
475 [6] = X86_OP_ENTRY0(MFENCE, cpuid(SSE2) p_00),
476 [7] = X86_OP_ENTRY0(SFENCE, cpuid(SSE) p_00),
477 };
478
479 static const X86OpEntry group15_mem[8] = {
480 [0] = X86_OP_ENTRYw(FXSAVE, M,y, cpuid(FXSR) p_00),
481 [1] = X86_OP_ENTRYr(FXRSTOR, M,y, cpuid(FXSR) p_00),
482 [2] = X86_OP_ENTRYr(LDMXCSR, E,d, vex5 chk(VEX128) p_00),
483 [3] = X86_OP_ENTRYw(STMXCSR, E,d, vex5 chk(VEX128) p_00),
484 [4] = X86_OP_ENTRYw(XSAVE, M,y, cpuid(XSAVE) p_00),
485 [5] = X86_OP_ENTRYr(XRSTOR, M,y, cpuid(XSAVE) p_00),
486 [6] = X86_OP_ENTRYw(XSAVEOPT, M,b, cpuid(XSAVEOPT) p_00),
487 [7] = X86_OP_ENTRYw(NOP, M,b, cpuid(CLFLUSH) p_00),
488 };
489
490 static const X86OpEntry group15_mem_66[8] = {
491 [6] = X86_OP_ENTRYw(NOP, M,b, cpuid(CLWB)),
492 [7] = X86_OP_ENTRYw(NOP, M,b, cpuid(CLFLUSHOPT)),
493 };
494
495 uint8_t modrm = get_modrm(s, env);
496 int op = (modrm >> 3) & 7;
497
498 if ((modrm >> 6) == 3) {
499 *entry = group15_reg[op];
500 } else if (s->prefix & PREFIX_DATA) {
501 *entry = group15_mem_66[op];
502 } else {
503 *entry = group15_mem[op];
504 }
505 }
506
507 static void decode_group17(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
508 {
509 static const X86GenFunc group17_gen[8] = {
510 NULL, gen_BLSR, gen_BLSMSK, gen_BLSI,
511 };
512 int op = (get_modrm(s, env) >> 3) & 7;
513 entry->gen = group17_gen[op];
514 }
515
516 static void decode_group12(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
517 {
518 static const X86OpEntry opcodes_group12[8] = {
519 {},
520 {},
521 X86_OP_ENTRY3(PSRLW_i, H,x, U,x, I,b, vex7 mmx avx2_256 p_00_66),
522 {},
523 X86_OP_ENTRY3(PSRAW_i, H,x, U,x, I,b, vex7 mmx avx2_256 p_00_66),
524 {},
525 X86_OP_ENTRY3(PSLLW_i, H,x, U,x, I,b, vex7 mmx avx2_256 p_00_66),
526 {},
527 };
528
529 int op = (get_modrm(s, env) >> 3) & 7;
530 *entry = opcodes_group12[op];
531 }
532
533 static void decode_group13(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
534 {
535 static const X86OpEntry opcodes_group13[8] = {
536 {},
537 {},
538 X86_OP_ENTRY3(PSRLD_i, H,x, U,x, I,b, vex7 mmx avx2_256 p_00_66),
539 {},
540 X86_OP_ENTRY3(PSRAD_i, H,x, U,x, I,b, vex7 mmx avx2_256 p_00_66),
541 {},
542 X86_OP_ENTRY3(PSLLD_i, H,x, U,x, I,b, vex7 mmx avx2_256 p_00_66),
543 {},
544 };
545
546 int op = (get_modrm(s, env) >> 3) & 7;
547 *entry = opcodes_group13[op];
548 }
549
550 static void decode_group14(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
551 {
552 static const X86OpEntry opcodes_group14[8] = {
553 /* grp14 */
554 {},
555 {},
556 X86_OP_ENTRY3(PSRLQ_i, H,x, U,x, I,b, vex7 mmx avx2_256 p_00_66),
557 X86_OP_ENTRY3(PSRLDQ_i, H,x, U,x, I,b, vex7 avx2_256 p_66),
558 {},
559 {},
560 X86_OP_ENTRY3(PSLLQ_i, H,x, U,x, I,b, vex7 mmx avx2_256 p_00_66),
561 X86_OP_ENTRY3(PSLLDQ_i, H,x, U,x, I,b, vex7 avx2_256 p_66),
562 };
563
564 int op = (get_modrm(s, env) >> 3) & 7;
565 *entry = opcodes_group14[op];
566 }
567
568 static void decode_0F6F(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
569 {
570 static const X86OpEntry opcodes_0F6F[4] = {
571 X86_OP_ENTRY3(MOVDQ, P,q, None,None, Q,q, vex5 mmx), /* movq */
572 X86_OP_ENTRY3(MOVDQ, V,x, None,None, W,x, vex1), /* movdqa */
573 X86_OP_ENTRY3(MOVDQ, V,x, None,None, W,x, vex4_unal), /* movdqu */
574 {},
575 };
576 *entry = *decode_by_prefix(s, opcodes_0F6F);
577 }
578
579 static void decode_0F70(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
580 {
581 static const X86OpEntry pshufw[4] = {
582 X86_OP_ENTRY3(PSHUFW, P,q, Q,q, I,b, vex4 mmx),
583 X86_OP_ENTRY3(PSHUFD, V,x, W,x, I,b, vex4 avx2_256),
584 X86_OP_ENTRY3(PSHUFHW, V,x, W,x, I,b, vex4 avx2_256),
585 X86_OP_ENTRY3(PSHUFLW, V,x, W,x, I,b, vex4 avx2_256),
586 };
587
588 *entry = *decode_by_prefix(s, pshufw);
589 }
590
591 static void decode_0F77(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
592 {
593 if (!(s->prefix & PREFIX_VEX)) {
594 entry->gen = gen_EMMS;
595 } else if (!s->vex_l) {
596 entry->gen = gen_VZEROUPPER;
597 entry->vex_class = 8;
598 } else {
599 entry->gen = gen_VZEROALL;
600 entry->vex_class = 8;
601 }
602 }
603
604 static void decode_0F78(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
605 {
606 static const X86OpEntry opcodes_0F78_f2 =
607 X86_OP_ENTRY3(INSERTQ_i, V,x, U,x, I,w, cpuid(SSE4A)); /* AMD extension */
608 static const X86OpEntry opcodes_0F78_66 =
609 X86_OP_ENTRY3(EXTRQ_i, U,x, None,None, I,w, cpuid(SSE4A)); /* AMD extension */
610
611 entry->gen = NULL;
612 if (s->prefix & PREFIX_REPNZ) {
613 *entry = opcodes_0F78_f2;
614 } else if (s->prefix & PREFIX_REPZ) {
615 /* undefined */
616 } else if (s->prefix & PREFIX_DATA) {
617 int op = (get_modrm(s, env) >> 3) & 7;
618 if (op == 0) {
619 *entry = opcodes_0F78_66;
620 }
621 }
622 }
623
624 static void decode_0F79(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
625 {
626 entry->gen = NULL;
627 if (s->prefix & PREFIX_REPNZ) {
628 entry->gen = gen_INSERTQ_r; /* AMD extension */
629 } else if (s->prefix & PREFIX_REPZ) {
630 /* undefined */
631 } else if (s->prefix & PREFIX_DATA) {
632 entry->gen = gen_EXTRQ_r; /* AMD extension */
633 };
634 }
635
636 static void decode_0F7E(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
637 {
638 static const X86OpEntry opcodes_0F7E[4] = {
639 X86_OP_ENTRY3(MOVD_from, E,y, None,None, P,y, vex5 mmx),
640 X86_OP_ENTRY3(MOVD_from, E,y, None,None, V,y, vex5),
641 X86_OP_ENTRY3(MOVQ, V,dq,None,None, W,q, vex5), /* wrong dest Vq on SDM! */
642 {},
643 };
644 *entry = *decode_by_prefix(s, opcodes_0F7E);
645 }
646
647 static void decode_0F7F(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
648 {
649 static const X86OpEntry opcodes_0F7F[4] = {
650 X86_OP_ENTRY3(MOVDQ, W,x, None,None, V,x, vex5 mmx), /* movq */
651 X86_OP_ENTRY3(MOVDQ, W,x, None,None, V,x, vex1), /* movdqa */
652 X86_OP_ENTRY3(MOVDQ, W,x, None,None, V,x, vex4_unal), /* movdqu */
653 {},
654 };
655 *entry = *decode_by_prefix(s, opcodes_0F7F);
656 }
657
658 static void decode_0FB8(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
659 {
660 static const X86OpEntry popcnt =
661 X86_OP_ENTRYwr(POPCNT, G,v, E,v, cpuid(POPCNT) zextT0);
662
663 if (s->prefix & PREFIX_REPZ) {
664 *entry = popcnt;
665 } else {
666 memset(entry, 0, sizeof(*entry));
667 }
668 }
669
670 static void decode_0FBC(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
671 {
672 /* For BSF, pass 2op as the third operand so that we can use zextT0 */
673 static const X86OpEntry opcodes_0FBC[4] = {
674 X86_OP_ENTRY3(BSF, G,v, E,v, 2op,v, zextT0),
675 X86_OP_ENTRY3(BSF, G,v, E,v, 2op,v, zextT0), /* 0x66 */
676 X86_OP_ENTRYwr(TZCNT, G,v, E,v, zextT0), /* 0xf3 */
677 X86_OP_ENTRY3(BSF, G,v, E,v, 2op,v, zextT0), /* 0xf2 */
678 };
679 if (!(s->cpuid_ext3_features & CPUID_EXT3_ABM)) {
680 *entry = opcodes_0FBC[0];
681 } else {
682 *entry = *decode_by_prefix(s, opcodes_0FBC);
683 }
684 }
685
686 static void decode_0FBD(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
687 {
688 /* For BSR, pass 2op as the third operand so that we can use zextT0 */
689 static const X86OpEntry opcodes_0FBD[4] = {
690 X86_OP_ENTRY3(BSR, G,v, E,v, 2op,v, zextT0),
691 X86_OP_ENTRY3(BSR, G,v, E,v, 2op,v, zextT0), /* 0x66 */
692 X86_OP_ENTRYwr(LZCNT, G,v, E,v, zextT0), /* 0xf3 */
693 X86_OP_ENTRY3(BSR, G,v, E,v, 2op,v, zextT0), /* 0xf2 */
694 };
695 if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_BMI1)) {
696 *entry = opcodes_0FBD[0];
697 } else {
698 *entry = *decode_by_prefix(s, opcodes_0FBD);
699 }
700 }
701
702 static void decode_0FD6(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
703 {
704 static const X86OpEntry movq[4] = {
705 {},
706 X86_OP_ENTRY3(MOVQ, W,dq, None, None, V,q, vex5),
707 X86_OP_ENTRY3(MOVq_dq, V,dq, None, None, N,q),
708 X86_OP_ENTRY3(MOVq_dq, P,q, None, None, U,q),
709 };
710
711 *entry = *decode_by_prefix(s, movq);
712 }
713
714 static const X86OpEntry opcodes_0F38_00toEF[240] = {
715 [0x00] = X86_OP_ENTRY3(PSHUFB, V,x, H,x, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
716 [0x01] = X86_OP_ENTRY3(PHADDW, V,x, H,x, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
717 [0x02] = X86_OP_ENTRY3(PHADDD, V,x, H,x, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
718 [0x03] = X86_OP_ENTRY3(PHADDSW, V,x, H,x, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
719 [0x04] = X86_OP_ENTRY3(PMADDUBSW, V,x, H,x, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
720 [0x05] = X86_OP_ENTRY3(PHSUBW, V,x, H,x, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
721 [0x06] = X86_OP_ENTRY3(PHSUBD, V,x, H,x, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
722 [0x07] = X86_OP_ENTRY3(PHSUBSW, V,x, H,x, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
723
724 [0x10] = X86_OP_ENTRY2(PBLENDVB, V,x, W,x, vex4 cpuid(SSE41) avx2_256 p_66),
725 [0x13] = X86_OP_ENTRY2(VCVTPH2PS, V,x, W,xh, vex11 chk(W0) cpuid(F16C) p_66),
726 [0x14] = X86_OP_ENTRY2(BLENDVPS, V,x, W,x, vex4 cpuid(SSE41) p_66),
727 [0x15] = X86_OP_ENTRY2(BLENDVPD, V,x, W,x, vex4 cpuid(SSE41) p_66),
728 /* Listed incorrectly as type 4 */
729 [0x16] = X86_OP_ENTRY3(VPERMD, V,qq, H,qq, W,qq, vex6 chk(W0) cpuid(AVX2) p_66), /* vpermps */
730 [0x17] = X86_OP_ENTRY3(VPTEST, None,None, V,x, W,x, vex4 cpuid(SSE41) p_66),
731
732 /*
733 * Source operand listed as Mq/Ux and similar in the manual; incorrectly listed
734 * as 128-bit only in 2-17.
735 */
736 [0x20] = X86_OP_ENTRY3(VPMOVSXBW, V,x, None,None, W,q, vex5 cpuid(SSE41) avx_movx avx2_256 p_66),
737 [0x21] = X86_OP_ENTRY3(VPMOVSXBD, V,x, None,None, W,d, vex5 cpuid(SSE41) avx_movx avx2_256 p_66),
738 [0x22] = X86_OP_ENTRY3(VPMOVSXBQ, V,x, None,None, W,w, vex5 cpuid(SSE41) avx_movx avx2_256 p_66),
739 [0x23] = X86_OP_ENTRY3(VPMOVSXWD, V,x, None,None, W,q, vex5 cpuid(SSE41) avx_movx avx2_256 p_66),
740 [0x24] = X86_OP_ENTRY3(VPMOVSXWQ, V,x, None,None, W,d, vex5 cpuid(SSE41) avx_movx avx2_256 p_66),
741 [0x25] = X86_OP_ENTRY3(VPMOVSXDQ, V,x, None,None, W,q, vex5 cpuid(SSE41) avx_movx avx2_256 p_66),
742
743 /* Same as PMOVSX. */
744 [0x30] = X86_OP_ENTRY3(VPMOVZXBW, V,x, None,None, W,q, vex5 cpuid(SSE41) avx_movx avx2_256 p_66),
745 [0x31] = X86_OP_ENTRY3(VPMOVZXBD, V,x, None,None, W,d, vex5 cpuid(SSE41) avx_movx avx2_256 p_66),
746 [0x32] = X86_OP_ENTRY3(VPMOVZXBQ, V,x, None,None, W,w, vex5 cpuid(SSE41) avx_movx avx2_256 p_66),
747 [0x33] = X86_OP_ENTRY3(VPMOVZXWD, V,x, None,None, W,q, vex5 cpuid(SSE41) avx_movx avx2_256 p_66),
748 [0x34] = X86_OP_ENTRY3(VPMOVZXWQ, V,x, None,None, W,d, vex5 cpuid(SSE41) avx_movx avx2_256 p_66),
749 [0x35] = X86_OP_ENTRY3(VPMOVZXDQ, V,x, None,None, W,q, vex5 cpuid(SSE41) avx_movx avx2_256 p_66),
750 [0x36] = X86_OP_ENTRY3(VPERMD, V,qq, H,qq, W,qq, vex6 chk(W0) cpuid(AVX2) p_66),
751 [0x37] = X86_OP_ENTRY3(PCMPGTQ, V,x, H,x, W,x, vex4 cpuid(SSE42) avx2_256 p_66),
752
753 [0x40] = X86_OP_ENTRY3(PMULLD, V,x, H,x, W,x, vex4 cpuid(SSE41) avx2_256 p_66),
754 [0x41] = X86_OP_ENTRY3(VPHMINPOSUW, V,dq, None,None, W,dq, vex4 cpuid(SSE41) p_66),
755 /* Listed incorrectly as type 4 */
756 [0x45] = X86_OP_ENTRY3(VPSRLV, V,x, H,x, W,x, vex6 cpuid(AVX2) p_66),
757 [0x46] = X86_OP_ENTRY3(VPSRAV, V,x, H,x, W,x, vex6 chk(W0) cpuid(AVX2) p_66),
758 [0x47] = X86_OP_ENTRY3(VPSLLV, V,x, H,x, W,x, vex6 cpuid(AVX2) p_66),
759
760 [0x90] = X86_OP_ENTRY3(VPGATHERD, V,x, H,x, M,d, vex12 cpuid(AVX2) p_66), /* vpgatherdd/q */
761 [0x91] = X86_OP_ENTRY3(VPGATHERQ, V,x, H,x, M,q, vex12 cpuid(AVX2) p_66), /* vpgatherqd/q */
762 [0x92] = X86_OP_ENTRY3(VPGATHERD, V,x, H,x, M,d, vex12 cpuid(AVX2) p_66), /* vgatherdps/d */
763 [0x93] = X86_OP_ENTRY3(VPGATHERQ, V,x, H,x, M,q, vex12 cpuid(AVX2) p_66), /* vgatherqps/d */
764
765 /* Should be exception type 2 but they do not have legacy SSE equivalents? */
766 [0x96] = X86_OP_ENTRY3(VFMADDSUB132Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
767 [0x97] = X86_OP_ENTRY3(VFMSUBADD132Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
768
769 [0xa6] = X86_OP_ENTRY3(VFMADDSUB213Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
770 [0xa7] = X86_OP_ENTRY3(VFMSUBADD213Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
771
772 [0xb6] = X86_OP_ENTRY3(VFMADDSUB231Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
773 [0xb7] = X86_OP_ENTRY3(VFMSUBADD231Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
774
775 [0x08] = X86_OP_ENTRY3(PSIGNB, V,x, H,x, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
776 [0x09] = X86_OP_ENTRY3(PSIGNW, V,x, H,x, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
777 [0x0a] = X86_OP_ENTRY3(PSIGND, V,x, H,x, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
778 [0x0b] = X86_OP_ENTRY3(PMULHRSW, V,x, H,x, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
779 /* Listed incorrectly as type 4 */
780 [0x0c] = X86_OP_ENTRY3(VPERMILPS, V,x, H,x, W,x, vex6 chk(W0) cpuid(AVX) p_66),
781 [0x0d] = X86_OP_ENTRY3(VPERMILPD, V,x, H,x, W,x, vex6 chk(W0) cpuid(AVX) p_66),
782 [0x0e] = X86_OP_ENTRY3(VTESTPS, None,None, V,x, W,x, vex6 chk(W0) cpuid(AVX) p_66),
783 [0x0f] = X86_OP_ENTRY3(VTESTPD, None,None, V,x, W,x, vex6 chk(W0) cpuid(AVX) p_66),
784
785 [0x18] = X86_OP_ENTRY3(VPBROADCASTD, V,x, None,None, W,d, vex6 chk(W0) cpuid(AVX) p_66), /* vbroadcastss */
786 [0x19] = X86_OP_ENTRY3(VPBROADCASTQ, V,qq, None,None, W,q, vex6 chk(W0) cpuid(AVX) p_66), /* vbroadcastsd */
787 [0x1a] = X86_OP_ENTRY3(VBROADCASTx128, V,qq, None,None, WM,dq,vex6 chk(W0) cpuid(AVX) p_66),
788 [0x1c] = X86_OP_ENTRY3(PABSB, V,x, None,None, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
789 [0x1d] = X86_OP_ENTRY3(PABSW, V,x, None,None, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
790 [0x1e] = X86_OP_ENTRY3(PABSD, V,x, None,None, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
791
792 [0x28] = X86_OP_ENTRY3(PMULDQ, V,x, H,x, W,x, vex4 cpuid(SSE41) avx2_256 p_66),
793 [0x29] = X86_OP_ENTRY3(PCMPEQQ, V,x, H,x, W,x, vex4 cpuid(SSE41) avx2_256 p_66),
794 [0x2a] = X86_OP_ENTRY3(MOVDQ, V,x, None,None, WM,x, vex1 cpuid(SSE41) avx2_256 p_66), /* movntdqa */
795 [0x2b] = X86_OP_ENTRY3(VPACKUSDW, V,x, H,x, W,x, vex4 cpuid(SSE41) avx2_256 p_66),
796 [0x2c] = X86_OP_ENTRY3(VMASKMOVPS, V,x, H,x, WM,x, vex6 chk(W0) cpuid(AVX) p_66),
797 [0x2d] = X86_OP_ENTRY3(VMASKMOVPD, V,x, H,x, WM,x, vex6 chk(W0) cpuid(AVX) p_66),
798 /* Incorrectly listed as Mx,Hx,Vx in the manual */
799 [0x2e] = X86_OP_ENTRY3(VMASKMOVPS_st, M,x, V,x, H,x, vex6 chk(W0) cpuid(AVX) p_66),
800 [0x2f] = X86_OP_ENTRY3(VMASKMOVPD_st, M,x, V,x, H,x, vex6 chk(W0) cpuid(AVX) p_66),
801
802 [0x38] = X86_OP_ENTRY3(PMINSB, V,x, H,x, W,x, vex4 cpuid(SSE41) avx2_256 p_66),
803 [0x39] = X86_OP_ENTRY3(PMINSD, V,x, H,x, W,x, vex4 cpuid(SSE41) avx2_256 p_66),
804 [0x3a] = X86_OP_ENTRY3(PMINUW, V,x, H,x, W,x, vex4 cpuid(SSE41) avx2_256 p_66),
805 [0x3b] = X86_OP_ENTRY3(PMINUD, V,x, H,x, W,x, vex4 cpuid(SSE41) avx2_256 p_66),
806 [0x3c] = X86_OP_ENTRY3(PMAXSB, V,x, H,x, W,x, vex4 cpuid(SSE41) avx2_256 p_66),
807 [0x3d] = X86_OP_ENTRY3(PMAXSD, V,x, H,x, W,x, vex4 cpuid(SSE41) avx2_256 p_66),
808 [0x3e] = X86_OP_ENTRY3(PMAXUW, V,x, H,x, W,x, vex4 cpuid(SSE41) avx2_256 p_66),
809 [0x3f] = X86_OP_ENTRY3(PMAXUD, V,x, H,x, W,x, vex4 cpuid(SSE41) avx2_256 p_66),
810
811 /* VPBROADCASTQ not listed as W0 in table 2-16 */
812 [0x58] = X86_OP_ENTRY3(VPBROADCASTD, V,x, None,None, W,d, vex6 chk(W0) cpuid(AVX2) p_66),
813 [0x59] = X86_OP_ENTRY3(VPBROADCASTQ, V,x, None,None, W,q, vex6 chk(W0) cpuid(AVX2) p_66),
814 [0x5a] = X86_OP_ENTRY3(VBROADCASTx128, V,qq, None,None, WM,dq,vex6 chk(W0) cpuid(AVX2) p_66),
815
816 [0x78] = X86_OP_ENTRY3(VPBROADCASTB, V,x, None,None, W,b, vex6 chk(W0) cpuid(AVX2) p_66),
817 [0x79] = X86_OP_ENTRY3(VPBROADCASTW, V,x, None,None, W,w, vex6 chk(W0) cpuid(AVX2) p_66),
818
819 [0x8c] = X86_OP_ENTRY3(VPMASKMOV, V,x, H,x, WM,x, vex6 cpuid(AVX2) p_66),
820 [0x8e] = X86_OP_ENTRY3(VPMASKMOV_st, M,x, V,x, H,x, vex6 cpuid(AVX2) p_66),
821
822 /* Should be exception type 2 or 3 but they do not have legacy SSE equivalents? */
823 [0x98] = X86_OP_ENTRY3(VFMADD132Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
824 [0x99] = X86_OP_ENTRY3(VFMADD132Sx, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
825 [0x9a] = X86_OP_ENTRY3(VFMSUB132Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
826 [0x9b] = X86_OP_ENTRY3(VFMSUB132Sx, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
827 [0x9c] = X86_OP_ENTRY3(VFNMADD132Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
828 [0x9d] = X86_OP_ENTRY3(VFNMADD132Sx, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
829 [0x9e] = X86_OP_ENTRY3(VFNMSUB132Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
830 [0x9f] = X86_OP_ENTRY3(VFNMSUB132Sx, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
831
832 [0xa8] = X86_OP_ENTRY3(VFMADD213Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
833 [0xa9] = X86_OP_ENTRY3(VFMADD213Sx, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
834 [0xaa] = X86_OP_ENTRY3(VFMSUB213Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
835 [0xab] = X86_OP_ENTRY3(VFMSUB213Sx, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
836 [0xac] = X86_OP_ENTRY3(VFNMADD213Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
837 [0xad] = X86_OP_ENTRY3(VFNMADD213Sx, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
838 [0xae] = X86_OP_ENTRY3(VFNMSUB213Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
839 [0xaf] = X86_OP_ENTRY3(VFNMSUB213Sx, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
840
841 [0xb8] = X86_OP_ENTRY3(VFMADD231Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
842 [0xb9] = X86_OP_ENTRY3(VFMADD231Sx, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
843 [0xba] = X86_OP_ENTRY3(VFMSUB231Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
844 [0xbb] = X86_OP_ENTRY3(VFMSUB231Sx, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
845 [0xbc] = X86_OP_ENTRY3(VFNMADD231Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
846 [0xbd] = X86_OP_ENTRY3(VFNMADD231Sx, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
847 [0xbe] = X86_OP_ENTRY3(VFNMSUB231Px, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
848 [0xbf] = X86_OP_ENTRY3(VFNMSUB231Sx, V,x, H,x, W,x, vex6 cpuid(FMA) p_66),
849
850 [0xc8] = X86_OP_ENTRY2(SHA1NEXTE, V,dq, W,dq, cpuid(SHA_NI)),
851 [0xc9] = X86_OP_ENTRY2(SHA1MSG1, V,dq, W,dq, cpuid(SHA_NI)),
852 [0xca] = X86_OP_ENTRY2(SHA1MSG2, V,dq, W,dq, cpuid(SHA_NI)),
853 [0xcb] = X86_OP_ENTRY2(SHA256RNDS2, V,dq, W,dq, cpuid(SHA_NI)),
854 [0xcc] = X86_OP_ENTRY2(SHA256MSG1, V,dq, W,dq, cpuid(SHA_NI)),
855 [0xcd] = X86_OP_ENTRY2(SHA256MSG2, V,dq, W,dq, cpuid(SHA_NI)),
856
857 [0xdb] = X86_OP_ENTRY3(VAESIMC, V,dq, None,None, W,dq, vex4 cpuid(AES) p_66),
858 [0xdc] = X86_OP_ENTRY3(VAESENC, V,x, H,x, W,x, vex4 cpuid(AES) p_66),
859 [0xdd] = X86_OP_ENTRY3(VAESENCLAST, V,x, H,x, W,x, vex4 cpuid(AES) p_66),
860 [0xde] = X86_OP_ENTRY3(VAESDEC, V,x, H,x, W,x, vex4 cpuid(AES) p_66),
861 [0xdf] = X86_OP_ENTRY3(VAESDECLAST, V,x, H,x, W,x, vex4 cpuid(AES) p_66),
862
863 /*
864 * REG selects srcdest2 operand, VEX.vvvv selects src3. VEX class not found
865 * in manual, assumed to be 13 from the VEX.L0 constraint.
866 */
867 [0xe0] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
868 [0xe1] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
869 [0xe2] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
870 [0xe3] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
871 [0xe4] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
872 [0xe5] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
873 [0xe6] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
874 [0xe7] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
875
876 [0xe8] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
877 [0xe9] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
878 [0xea] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
879 [0xeb] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
880 [0xec] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
881 [0xed] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
882 [0xee] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
883 [0xef] = X86_OP_ENTRY3(CMPccXADD, M,y, G,y, B,y, vex13 xchg chk(o64) cpuid(CMPCCXADD) p_66),
884 };
885
886 /* four rows for no prefix, 66, F3, F2 (including 66+F2 operand size override) */
887 static const X86OpEntry opcodes_0F38_F0toFF[16][4] = {
888 /*
889 * MOVBE and CRC32 are incorrectly listed as always doing 32-bit operation
890 * without prefix and 16-bit operation with 0x66.
891 */
892 [0] = {
893 X86_OP_ENTRYwr(MOVBE, G,v, M,v, cpuid(MOVBE)),
894 X86_OP_ENTRYwr(MOVBE, G,v, M,v, cpuid(MOVBE)),
895 {},
896 X86_OP_ENTRY2(CRC32, G,d, E,b, cpuid(SSE42)),
897 },
898 [1] = {
899 X86_OP_ENTRYwr(MOVBE, M,v, G,v, cpuid(MOVBE)),
900 X86_OP_ENTRYwr(MOVBE, M,v, G,v, cpuid(MOVBE)),
901 {},
902 X86_OP_ENTRY2(CRC32, G,d, E,v, cpuid(SSE42)),
903 },
904 [2] = {
905 X86_OP_ENTRY3(ANDN, G,y, B,y, E,y, vex13 cpuid(BMI1)),
906 {},
907 {},
908 {},
909 },
910 [3] = {
911 X86_OP_GROUP3(group17, B,y, None,None, E,y, vex13 cpuid(BMI1)),
912 {},
913 {},
914 {},
915 },
916 [5] = {
917 X86_OP_ENTRY3(BZHI, G,y, E,y, B,y, vex13 cpuid(BMI1)),
918 {},
919 X86_OP_ENTRY3(PEXT, G,y, B,y, E,y, vex13 zextT0 cpuid(BMI2)),
920 X86_OP_ENTRY3(PDEP, G,y, B,y, E,y, vex13 zextT0 cpuid(BMI2)),
921 },
922 [6] = {
923 {},
924 X86_OP_ENTRY2(ADCX, G,y, E,y, cpuid(ADX)),
925 X86_OP_ENTRY2(ADOX, G,y, E,y, cpuid(ADX)),
926 X86_OP_ENTRY3(MULX, /* B,y, */ G,y, E,y, 2,y, vex13 cpuid(BMI2)),
927 },
928 [7] = {
929 X86_OP_ENTRY3(BEXTR, G,y, E,y, B,y, vex13 zextT0 cpuid(BMI1)),
930 X86_OP_ENTRY3(SHLX, G,y, E,y, B,y, vex13 cpuid(BMI1)),
931 X86_OP_ENTRY3(SARX, G,y, E,y, B,y, vex13 sextT0 cpuid(BMI1)),
932 X86_OP_ENTRY3(SHRX, G,y, E,y, B,y, vex13 zextT0 cpuid(BMI1)),
933 },
934 };
935
936 static void decode_0F38(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
937 {
938 *b = x86_ldub_code(env, s);
939 if (*b < 0xf0) {
940 *entry = opcodes_0F38_00toEF[*b];
941 } else {
942 *entry = *decode_by_prefix(s, opcodes_0F38_F0toFF[*b & 15]);
943 }
944 }
945
946 static void decode_VINSERTPS(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
947 {
948 static const X86OpEntry
949 vinsertps_reg = X86_OP_ENTRY4(VINSERTPS_r, V,dq, H,dq, U,dq, vex5 cpuid(SSE41) p_66),
950 vinsertps_mem = X86_OP_ENTRY4(VINSERTPS_m, V,dq, H,dq, M,d, vex5 cpuid(SSE41) p_66);
951
952 int modrm = get_modrm(s, env);
953 *entry = (modrm >> 6) == 3 ? vinsertps_reg : vinsertps_mem;
954 }
955
956 static const X86OpEntry opcodes_0F3A[256] = {
957 /*
958 * These are VEX-only, but incorrectly listed in the manual as exception type 4.
959 * Also the "qq" instructions are sometimes omitted by Table 2-17, but are VEX256
960 * only.
961 */
962 [0x00] = X86_OP_ENTRY3(VPERMQ, V,qq, W,qq, I,b, vex6 chk(W1) cpuid(AVX2) p_66),
963 [0x01] = X86_OP_ENTRY3(VPERMQ, V,qq, W,qq, I,b, vex6 chk(W1) cpuid(AVX2) p_66), /* VPERMPD */
964 [0x02] = X86_OP_ENTRY4(VBLENDPS, V,x, H,x, W,x, vex6 chk(W0) cpuid(AVX2) p_66), /* VPBLENDD */
965 [0x04] = X86_OP_ENTRY3(VPERMILPS_i, V,x, W,x, I,b, vex6 chk(W0) cpuid(AVX) p_66),
966 [0x05] = X86_OP_ENTRY3(VPERMILPD_i, V,x, W,x, I,b, vex6 chk(W0) cpuid(AVX) p_66),
967 [0x06] = X86_OP_ENTRY4(VPERM2x128, V,qq, H,qq, W,qq, vex6 chk(W0) cpuid(AVX) p_66),
968
969 [0x14] = X86_OP_ENTRY3(PEXTRB, E,b, V,dq, I,b, vex5 cpuid(SSE41) op0_Rd p_66),
970 [0x15] = X86_OP_ENTRY3(PEXTRW, E,w, V,dq, I,b, vex5 cpuid(SSE41) op0_Rd p_66),
971 [0x16] = X86_OP_ENTRY3(PEXTR, E,y, V,dq, I,b, vex5 cpuid(SSE41) p_66),
972 [0x17] = X86_OP_ENTRY3(VEXTRACTPS, E,d, V,dq, I,b, vex5 cpuid(SSE41) p_66),
973 [0x1d] = X86_OP_ENTRY3(VCVTPS2PH, W,xh, V,x, I,b, vex11 chk(W0) cpuid(F16C) p_66),
974
975 [0x20] = X86_OP_ENTRY4(PINSRB, V,dq, H,dq, E,b, vex5 cpuid(SSE41) op2_Ry p_66),
976 [0x21] = X86_OP_GROUP0(VINSERTPS),
977 [0x22] = X86_OP_ENTRY4(PINSR, V,dq, H,dq, E,y, vex5 cpuid(SSE41) p_66),
978
979 [0x40] = X86_OP_ENTRY4(VDPPS, V,x, H,x, W,x, vex2 cpuid(SSE41) p_66),
980 [0x41] = X86_OP_ENTRY4(VDPPD, V,dq, H,dq, W,dq, vex2 cpuid(SSE41) p_66),
981 [0x42] = X86_OP_ENTRY4(VMPSADBW, V,x, H,x, W,x, vex2 cpuid(SSE41) avx2_256 p_66),
982 [0x44] = X86_OP_ENTRY4(PCLMULQDQ, V,dq, H,dq, W,dq, vex4 cpuid(PCLMULQDQ) p_66),
983 [0x46] = X86_OP_ENTRY4(VPERM2x128, V,qq, H,qq, W,qq, vex6 chk(W0) cpuid(AVX2) p_66),
984
985 [0x60] = X86_OP_ENTRY4(PCMPESTRM, None,None, V,dq, W,dq, vex4_unal cpuid(SSE42) p_66),
986 [0x61] = X86_OP_ENTRY4(PCMPESTRI, None,None, V,dq, W,dq, vex4_unal cpuid(SSE42) p_66),
987 [0x62] = X86_OP_ENTRY4(PCMPISTRM, None,None, V,dq, W,dq, vex4_unal cpuid(SSE42) p_66),
988 [0x63] = X86_OP_ENTRY4(PCMPISTRI, None,None, V,dq, W,dq, vex4_unal cpuid(SSE42) p_66),
989
990 [0x08] = X86_OP_ENTRY3(VROUNDPS, V,x, W,x, I,b, vex2 cpuid(SSE41) p_66),
991 [0x09] = X86_OP_ENTRY3(VROUNDPD, V,x, W,x, I,b, vex2 cpuid(SSE41) p_66),
992 /*
993 * Not listed as four operand in the manual. Also writes and reads 128-bits
994 * from the first two operands due to the V operand picking higher entries of
995 * the H operand; the "Vss,Hss,Wss" description from the manual is incorrect.
996 * For other unary operations such as VSQRTSx this is hidden by the "REPScalar"
997 * value of vex_special, because the table lists the operand types of VSQRTPx.
998 */
999 [0x0a] = X86_OP_ENTRY4(VROUNDSS, V,x, H,x, W,ss, vex3 cpuid(SSE41) p_66),
1000 [0x0b] = X86_OP_ENTRY4(VROUNDSD, V,x, H,x, W,sd, vex3 cpuid(SSE41) p_66),
1001 [0x0c] = X86_OP_ENTRY4(VBLENDPS, V,x, H,x, W,x, vex4 cpuid(SSE41) p_66),
1002 [0x0d] = X86_OP_ENTRY4(VBLENDPD, V,x, H,x, W,x, vex4 cpuid(SSE41) p_66),
1003 [0x0e] = X86_OP_ENTRY4(VPBLENDW, V,x, H,x, W,x, vex4 cpuid(SSE41) avx2_256 p_66),
1004 [0x0f] = X86_OP_ENTRY4(PALIGNR, V,x, H,x, W,x, vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
1005
1006 [0x18] = X86_OP_ENTRY4(VINSERTx128, V,qq, H,qq, W,dq, vex6 chk(W0) cpuid(AVX) p_66),
1007 [0x19] = X86_OP_ENTRY3(VEXTRACTx128, W,dq, V,qq, I,b, vex6 chk(W0) cpuid(AVX) p_66),
1008
1009 [0x38] = X86_OP_ENTRY4(VINSERTx128, V,qq, H,qq, W,dq, vex6 chk(W0) cpuid(AVX2) p_66),
1010 [0x39] = X86_OP_ENTRY3(VEXTRACTx128, W,dq, V,qq, I,b, vex6 chk(W0) cpuid(AVX2) p_66),
1011
1012 /* Listed incorrectly as type 4 */
1013 [0x4a] = X86_OP_ENTRY4(VBLENDVPS, V,x, H,x, W,x, vex6 chk(W0) cpuid(AVX) p_66),
1014 [0x4b] = X86_OP_ENTRY4(VBLENDVPD, V,x, H,x, W,x, vex6 chk(W0) cpuid(AVX) p_66),
1015 [0x4c] = X86_OP_ENTRY4(VPBLENDVB, V,x, H,x, W,x, vex6 chk(W0) cpuid(AVX) p_66 avx2_256),
1016
1017 [0xcc] = X86_OP_ENTRY3(SHA1RNDS4, V,dq, W,dq, I,b, cpuid(SHA_NI)),
1018
1019 [0xdf] = X86_OP_ENTRY3(VAESKEYGEN, V,dq, W,dq, I,b, vex4 cpuid(AES) p_66),
1020
1021 [0xF0] = X86_OP_ENTRY3(RORX, G,y, E,y, I,b, vex13 cpuid(BMI2) p_f2),
1022 };
1023
1024 static void decode_0F3A(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1025 {
1026 *b = x86_ldub_code(env, s);
1027 *entry = opcodes_0F3A[*b];
1028 }
1029
1030 /*
1031 * There are some mistakes in the operands in the manual, and the load/store/register
1032 * cases are easiest to keep separate, so the entries for 10-17 follow simplicity and
1033 * efficiency of implementation rather than copying what the manual says.
1034 *
1035 * In particular:
1036 *
1037 * 1) "VMOVSS m32, xmm1" and "VMOVSD m64, xmm1" do not support VEX.vvvv != 1111b,
1038 * but this is not mentioned in the tables.
1039 *
1040 * 2) MOVHLPS, MOVHPS, MOVHPD, MOVLPD, MOVLPS read the high quadword of one of their
1041 * operands, which must therefore be dq; MOVLPD and MOVLPS also write the high
1042 * quadword of the V operand.
1043 */
1044 static void decode_0F10(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1045 {
1046 static const X86OpEntry opcodes_0F10_reg[4] = {
1047 X86_OP_ENTRY3(MOVDQ, V,x, None,None, W,x, vex4_unal), /* MOVUPS */
1048 X86_OP_ENTRY3(MOVDQ, V,x, None,None, W,x, vex4_unal), /* MOVUPD */
1049 X86_OP_ENTRY3(VMOVSS, V,x, H,x, W,x, vex5),
1050 X86_OP_ENTRY3(VMOVLPx, V,x, H,x, W,x, vex5), /* MOVSD */
1051 };
1052
1053 static const X86OpEntry opcodes_0F10_mem[4] = {
1054 X86_OP_ENTRY3(MOVDQ, V,x, None,None, W,x, vex4_unal), /* MOVUPS */
1055 X86_OP_ENTRY3(MOVDQ, V,x, None,None, W,x, vex4_unal), /* MOVUPD */
1056 X86_OP_ENTRY3(VMOVSS_ld, V,x, H,x, M,ss, vex5),
1057 X86_OP_ENTRY3(VMOVSD_ld, V,x, H,x, M,sd, vex5),
1058 };
1059
1060 if ((get_modrm(s, env) >> 6) == 3) {
1061 *entry = *decode_by_prefix(s, opcodes_0F10_reg);
1062 } else {
1063 *entry = *decode_by_prefix(s, opcodes_0F10_mem);
1064 }
1065 }
1066
1067 static void decode_0F11(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1068 {
1069 static const X86OpEntry opcodes_0F11_reg[4] = {
1070 X86_OP_ENTRY3(MOVDQ, W,x, None,None, V,x, vex4_unal), /* MOVUPS */
1071 X86_OP_ENTRY3(MOVDQ, W,x, None,None, V,x, vex4_unal), /* MOVUPD */
1072 X86_OP_ENTRY3(VMOVSS, W,x, H,x, V,x, vex5),
1073 X86_OP_ENTRY3(VMOVLPx, W,x, H,x, V,q, vex5), /* MOVSD */
1074 };
1075
1076 static const X86OpEntry opcodes_0F11_mem[4] = {
1077 X86_OP_ENTRY3(MOVDQ, W,x, None,None, V,x, vex4_unal), /* MOVUPS */
1078 X86_OP_ENTRY3(MOVDQ, W,x, None,None, V,x, vex4_unal), /* MOVUPD */
1079 X86_OP_ENTRY3(VMOVSS_st, M,ss, None,None, V,x, vex5),
1080 X86_OP_ENTRY3(VMOVLPx_st, M,sd, None,None, V,x, vex5), /* MOVSD */
1081 };
1082
1083 if ((get_modrm(s, env) >> 6) == 3) {
1084 *entry = *decode_by_prefix(s, opcodes_0F11_reg);
1085 } else {
1086 *entry = *decode_by_prefix(s, opcodes_0F11_mem);
1087 }
1088 }
1089
1090 static void decode_0F12(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1091 {
1092 static const X86OpEntry opcodes_0F12_mem[4] = {
1093 /*
1094 * Use dq for operand for compatibility with gen_MOVSD and
1095 * to allow VEX128 only.
1096 */
1097 X86_OP_ENTRY3(VMOVLPx_ld, V,dq, H,dq, M,q, vex5), /* MOVLPS */
1098 X86_OP_ENTRY3(VMOVLPx_ld, V,dq, H,dq, M,q, vex5), /* MOVLPD */
1099 X86_OP_ENTRY3(VMOVSLDUP, V,x, None,None, W,x, vex4 cpuid(SSE3)),
1100 X86_OP_ENTRY3(VMOVDDUP, V,x, None,None, WM,q, vex5 cpuid(SSE3)), /* qq if VEX.256 */
1101 };
1102 static const X86OpEntry opcodes_0F12_reg[4] = {
1103 X86_OP_ENTRY3(VMOVHLPS, V,dq, H,dq, U,dq, vex7),
1104 X86_OP_ENTRY3(VMOVLPx, W,dq, H,dq, U,q, vex5), /* MOVLPD */
1105 X86_OP_ENTRY3(VMOVSLDUP, V,x, None,None, U,x, vex4 cpuid(SSE3)),
1106 X86_OP_ENTRY3(VMOVDDUP, V,x, None,None, U,x, vex5 cpuid(SSE3)),
1107 };
1108
1109 if ((get_modrm(s, env) >> 6) == 3) {
1110 *entry = *decode_by_prefix(s, opcodes_0F12_reg);
1111 } else {
1112 *entry = *decode_by_prefix(s, opcodes_0F12_mem);
1113 if ((s->prefix & PREFIX_REPNZ) && s->vex_l) {
1114 entry->s2 = X86_SIZE_qq;
1115 }
1116 }
1117 }
1118
1119 static void decode_0F16(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1120 {
1121 static const X86OpEntry opcodes_0F16_mem[4] = {
1122 /*
1123 * Operand 1 technically only reads the low 64 bits, but uses dq so that
1124 * it is easier to check for op0 == op1 in an endianness-neutral manner.
1125 */
1126 X86_OP_ENTRY3(VMOVHPx_ld, V,dq, H,dq, M,q, vex5), /* MOVHPS */
1127 X86_OP_ENTRY3(VMOVHPx_ld, V,dq, H,dq, M,q, vex5), /* MOVHPD */
1128 X86_OP_ENTRY3(VMOVSHDUP, V,x, None,None, W,x, vex4 cpuid(SSE3)),
1129 {},
1130 };
1131 static const X86OpEntry opcodes_0F16_reg[4] = {
1132 /* Same as above, operand 1 could be Hq if it wasn't for big-endian. */
1133 X86_OP_ENTRY3(VMOVLHPS, V,dq, H,dq, U,q, vex7),
1134 X86_OP_ENTRY3(VMOVHPx, V,x, H,x, U,x, vex5), /* MOVHPD */
1135 X86_OP_ENTRY3(VMOVSHDUP, V,x, None,None, U,x, vex4 cpuid(SSE3)),
1136 {},
1137 };
1138
1139 if ((get_modrm(s, env) >> 6) == 3) {
1140 *entry = *decode_by_prefix(s, opcodes_0F16_reg);
1141 } else {
1142 *entry = *decode_by_prefix(s, opcodes_0F16_mem);
1143 }
1144 }
1145
1146 static void decode_0F2A(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1147 {
1148 static const X86OpEntry opcodes_0F2A[4] = {
1149 X86_OP_ENTRY3(CVTPI2Px, V,x, None,None, Q,q),
1150 X86_OP_ENTRY3(CVTPI2Px, V,x, None,None, Q,q),
1151 X86_OP_ENTRY3(VCVTSI2Sx, V,x, H,x, E,y, vex3),
1152 X86_OP_ENTRY3(VCVTSI2Sx, V,x, H,x, E,y, vex3),
1153 };
1154 *entry = *decode_by_prefix(s, opcodes_0F2A);
1155 }
1156
1157 static void decode_0F2B(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1158 {
1159 static const X86OpEntry opcodes_0F2B[4] = {
1160 X86_OP_ENTRY3(MOVDQ, M,x, None,None, V,x, vex1), /* MOVNTPS */
1161 X86_OP_ENTRY3(MOVDQ, M,x, None,None, V,x, vex1), /* MOVNTPD */
1162 /* AMD extensions */
1163 X86_OP_ENTRY3(VMOVSS_st, M,ss, None,None, V,x, vex4 cpuid(SSE4A)), /* MOVNTSS */
1164 X86_OP_ENTRY3(VMOVLPx_st, M,sd, None,None, V,x, vex4 cpuid(SSE4A)), /* MOVNTSD */
1165 };
1166
1167 *entry = *decode_by_prefix(s, opcodes_0F2B);
1168 }
1169
1170 static void decode_0F2C(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1171 {
1172 static const X86OpEntry opcodes_0F2C[4] = {
1173 /* Listed as ps/pd in the manual, but CVTTPS2PI only reads 64-bit. */
1174 X86_OP_ENTRY3(CVTTPx2PI, P,q, None,None, W,q),
1175 X86_OP_ENTRY3(CVTTPx2PI, P,q, None,None, W,dq),
1176 X86_OP_ENTRY3(VCVTTSx2SI, G,y, None,None, W,ss, vex3),
1177 X86_OP_ENTRY3(VCVTTSx2SI, G,y, None,None, W,sd, vex3),
1178 };
1179 *entry = *decode_by_prefix(s, opcodes_0F2C);
1180 }
1181
1182 static void decode_0F2D(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1183 {
1184 static const X86OpEntry opcodes_0F2D[4] = {
1185 /* Listed as ps/pd in the manual, but CVTPS2PI only reads 64-bit. */
1186 X86_OP_ENTRY3(CVTPx2PI, P,q, None,None, W,q),
1187 X86_OP_ENTRY3(CVTPx2PI, P,q, None,None, W,dq),
1188 X86_OP_ENTRY3(VCVTSx2SI, G,y, None,None, W,ss, vex3),
1189 X86_OP_ENTRY3(VCVTSx2SI, G,y, None,None, W,sd, vex3),
1190 };
1191 *entry = *decode_by_prefix(s, opcodes_0F2D);
1192 }
1193
1194 static void decode_VxCOMISx(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1195 {
1196 /*
1197 * VUCOMISx and VCOMISx are different and use no-prefix and 0x66 for SS and SD
1198 * respectively. Scalar values usually are associated with 0xF2 and 0xF3, for
1199 * which X86_VEX_REPScalar exists, but here it has to be decoded by hand.
1200 */
1201 entry->s1 = entry->s2 = (s->prefix & PREFIX_DATA ? X86_SIZE_sd : X86_SIZE_ss);
1202 entry->gen = (*b == 0x2E ? gen_VUCOMI : gen_VCOMI);
1203 }
1204
1205 static void decode_sse_unary(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1206 {
1207 if (!(s->prefix & (PREFIX_REPZ | PREFIX_REPNZ))) {
1208 entry->op1 = X86_TYPE_None;
1209 entry->s1 = X86_SIZE_None;
1210 }
1211 switch (*b) {
1212 case 0x51: entry->gen = gen_VSQRT; break;
1213 case 0x52: entry->gen = gen_VRSQRT; break;
1214 case 0x53: entry->gen = gen_VRCP; break;
1215 }
1216 }
1217
1218 static void decode_0F5A(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1219 {
1220 static const X86OpEntry opcodes_0F5A[4] = {
1221 X86_OP_ENTRY2(VCVTPS2PD, V,x, W,xh, vex2), /* VCVTPS2PD */
1222 X86_OP_ENTRY2(VCVTPD2PS, V,x, W,x, vex2), /* VCVTPD2PS */
1223 X86_OP_ENTRY3(VCVTSS2SD, V,x, H,x, W,x, vex2_rep3), /* VCVTSS2SD */
1224 X86_OP_ENTRY3(VCVTSD2SS, V,x, H,x, W,x, vex2_rep3), /* VCVTSD2SS */
1225 };
1226 *entry = *decode_by_prefix(s, opcodes_0F5A);
1227 }
1228
1229 static void decode_0F5B(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1230 {
1231 static const X86OpEntry opcodes_0F5B[4] = {
1232 X86_OP_ENTRY2(VCVTDQ2PS, V,x, W,x, vex2),
1233 X86_OP_ENTRY2(VCVTPS2DQ, V,x, W,x, vex2),
1234 X86_OP_ENTRY2(VCVTTPS2DQ, V,x, W,x, vex2),
1235 {},
1236 };
1237 *entry = *decode_by_prefix(s, opcodes_0F5B);
1238 }
1239
1240 static void decode_0FE6(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1241 {
1242 static const X86OpEntry opcodes_0FE6[4] = {
1243 {},
1244 X86_OP_ENTRY2(VCVTTPD2DQ, V,x, W,x, vex2),
1245 X86_OP_ENTRY2(VCVTDQ2PD, V,x, W,x, vex5),
1246 X86_OP_ENTRY2(VCVTPD2DQ, V,x, W,x, vex2),
1247 };
1248 *entry = *decode_by_prefix(s, opcodes_0FE6);
1249 }
1250
1251 /*
1252 * These ignore the mod bits (assume (modrm&0xc0)==0xc0), so group the
1253 * pre-decode tweak here for all MOVs from/to CR and DR.
1254 *
1255 * AMD documentation (24594.pdf) and testing of Intel 386 and 486
1256 * processors all show that the mod bits are assumed to be 1's,
1257 * regardless of actual values.
1258 */
1259 static void decode_MOV_CR_DR(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1260 {
1261 /*
1262 */
1263 get_modrm(s, env);
1264 s->modrm |= 0xC0;
1265
1266 entry->gen = gen_MOV;
1267 }
1268
1269 static const X86OpEntry opcodes_0F[256] = {
1270 [0x00] = X86_OP_ENTRY1(multi0F, nop,v, nolea), /* unconverted */
1271 [0x01] = X86_OP_ENTRY1(multi0F, nop,v, nolea), /* unconverted */
1272 [0x02] = X86_OP_ENTRYwr(LAR, G,v, E,w, chk(prot)),
1273 [0x03] = X86_OP_ENTRYwr(LSL, G,v, E,w, chk(prot)),
1274 [0x05] = X86_OP_ENTRY0(SYSCALL, chk(o64_intel)),
1275 [0x06] = X86_OP_ENTRY0(CLTS, chk(cpl0) svm(WRITE_CR0)),
1276 [0x07] = X86_OP_ENTRY0(SYSRET, chk3(o64_intel, prot, cpl0)),
1277
1278 [0x10] = X86_OP_GROUP0(0F10),
1279 [0x11] = X86_OP_GROUP0(0F11),
1280 [0x12] = X86_OP_GROUP0(0F12),
1281 [0x13] = X86_OP_ENTRY3(VMOVLPx_st, M,q, None,None, V,q, vex5 p_00_66),
1282 [0x14] = X86_OP_ENTRY3(VUNPCKLPx, V,x, H,x, W,x, vex4 p_00_66),
1283 [0x15] = X86_OP_ENTRY3(VUNPCKHPx, V,x, H,x, W,x, vex4 p_00_66),
1284 [0x16] = X86_OP_GROUP0(0F16),
1285 /* Incorrectly listed as Mq,Vq in the manual */
1286 [0x17] = X86_OP_ENTRY3(VMOVHPx_st, M,q, None,None, V,dq, vex5 p_00_66),
1287
1288 /*
1289 * Incorrectly listed as using "d" operand type in the manual. In reality
1290 * there's no 16-bit version (like y) and it does not use REX.W (like d64).
1291 */
1292 [0x20] = X86_OP_GROUPwr(MOV_CR_DR, R,y_d64, C,y_d64, chk(cpl0) svm(READ_CR0)),
1293 [0x21] = X86_OP_GROUPwr(MOV_CR_DR, R,y_d64, D,y_d64, chk(cpl0) svm(READ_DR0)),
1294 [0x22] = X86_OP_GROUPwr(MOV_CR_DR, C,y_d64, R,y_d64, zextT0 chk(cpl0) svm(WRITE_CR0)),
1295 [0x23] = X86_OP_GROUPwr(MOV_CR_DR, D,y_d64, R,y_d64, zextT0 chk(cpl0) svm(WRITE_DR0)),
1296
1297 [0x30] = X86_OP_ENTRY0(WRMSR, chk(cpl0)),
1298 [0x31] = X86_OP_ENTRY0(RDTSC),
1299 [0x32] = X86_OP_ENTRY0(RDMSR, chk(cpl0)),
1300 [0x33] = X86_OP_ENTRY0(RDPMC),
1301 [0x34] = X86_OP_ENTRY0(SYSENTER, chk2(i64_amd, prot_or_vm86)),
1302 [0x35] = X86_OP_ENTRY0(SYSEXIT, chk3(i64_amd, prot, cpl0)),
1303
1304 [0x40] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1305 [0x41] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1306 [0x42] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1307 [0x43] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1308 [0x44] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1309 [0x45] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1310 [0x46] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1311 [0x47] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1312
1313 [0x50] = X86_OP_ENTRY3(MOVMSK, G,y, None,None, U,x, vex7 p_00_66),
1314 [0x51] = X86_OP_GROUP3(sse_unary, V,x, H,x, W,x, vex2_rep3 p_00_66_f3_f2), /* sqrtps */
1315 [0x52] = X86_OP_GROUP3(sse_unary, V,x, H,x, W,x, vex4_rep5 p_00_f3), /* rsqrtps */
1316 [0x53] = X86_OP_GROUP3(sse_unary, V,x, H,x, W,x, vex4_rep5 p_00_f3), /* rcpps */
1317 [0x54] = X86_OP_ENTRY3(PAND, V,x, H,x, W,x, vex4 p_00_66), /* vand */
1318 [0x55] = X86_OP_ENTRY3(PANDN, V,x, H,x, W,x, vex4 p_00_66), /* vandn */
1319 [0x56] = X86_OP_ENTRY3(POR, V,x, H,x, W,x, vex4 p_00_66), /* vor */
1320 [0x57] = X86_OP_ENTRY3(PXOR, V,x, H,x, W,x, vex4 p_00_66), /* vxor */
1321
1322 [0x60] = X86_OP_ENTRY3(PUNPCKLBW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1323 [0x61] = X86_OP_ENTRY3(PUNPCKLWD, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1324 [0x62] = X86_OP_ENTRY3(PUNPCKLDQ, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1325 [0x63] = X86_OP_ENTRY3(PACKSSWB, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1326 [0x64] = X86_OP_ENTRY3(PCMPGTB, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1327 [0x65] = X86_OP_ENTRY3(PCMPGTW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1328 [0x66] = X86_OP_ENTRY3(PCMPGTD, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1329 [0x67] = X86_OP_ENTRY3(PACKUSWB, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1330
1331 [0x70] = X86_OP_GROUP0(0F70),
1332 [0x71] = X86_OP_GROUP0(group12),
1333 [0x72] = X86_OP_GROUP0(group13),
1334 [0x73] = X86_OP_GROUP0(group14),
1335 [0x74] = X86_OP_ENTRY3(PCMPEQB, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1336 [0x75] = X86_OP_ENTRY3(PCMPEQW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1337 [0x76] = X86_OP_ENTRY3(PCMPEQD, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1338 [0x77] = X86_OP_GROUP0(0F77),
1339
1340 [0x80] = X86_OP_ENTRYr(Jcc, J,z_f64),
1341 [0x81] = X86_OP_ENTRYr(Jcc, J,z_f64),
1342 [0x82] = X86_OP_ENTRYr(Jcc, J,z_f64),
1343 [0x83] = X86_OP_ENTRYr(Jcc, J,z_f64),
1344 [0x84] = X86_OP_ENTRYr(Jcc, J,z_f64),
1345 [0x85] = X86_OP_ENTRYr(Jcc, J,z_f64),
1346 [0x86] = X86_OP_ENTRYr(Jcc, J,z_f64),
1347 [0x87] = X86_OP_ENTRYr(Jcc, J,z_f64),
1348
1349 [0x90] = X86_OP_ENTRYw(SETcc, E,b),
1350 [0x91] = X86_OP_ENTRYw(SETcc, E,b),
1351 [0x92] = X86_OP_ENTRYw(SETcc, E,b),
1352 [0x93] = X86_OP_ENTRYw(SETcc, E,b),
1353 [0x94] = X86_OP_ENTRYw(SETcc, E,b),
1354 [0x95] = X86_OP_ENTRYw(SETcc, E,b),
1355 [0x96] = X86_OP_ENTRYw(SETcc, E,b),
1356 [0x97] = X86_OP_ENTRYw(SETcc, E,b),
1357
1358 [0xa0] = X86_OP_ENTRYr(PUSH, FS, w),
1359 [0xa1] = X86_OP_ENTRYw(POP, FS, w),
1360 [0xa2] = X86_OP_ENTRY0(CPUID),
1361 [0xa3] = X86_OP_ENTRYrr(BT, E,v, G,v, btEvGv),
1362 [0xa4] = X86_OP_ENTRY4(SHLD, E,v, 2op,v, G,v),
1363 [0xa5] = X86_OP_ENTRY3(SHLD, E,v, 2op,v, G,v),
1364
1365 [0xb0] = X86_OP_ENTRY2(CMPXCHG,E,b, G,b, lock),
1366 [0xb1] = X86_OP_ENTRY2(CMPXCHG,E,v, G,v, lock),
1367 [0xb2] = X86_OP_ENTRY3(LSS, G,v, EM,p, None, None),
1368 [0xb3] = X86_OP_ENTRY2(BTR, E,v, G,v, btEvGv),
1369 [0xb4] = X86_OP_ENTRY3(LFS, G,v, EM,p, None, None),
1370 [0xb5] = X86_OP_ENTRY3(LGS, G,v, EM,p, None, None),
1371 [0xb6] = X86_OP_ENTRY3(MOV, G,v, E,b, None, None, zextT0), /* MOVZX */
1372 [0xb7] = X86_OP_ENTRY3(MOV, G,v, E,w, None, None, zextT0), /* MOVZX */
1373
1374 [0xc0] = X86_OP_ENTRY2(XADD, E,b, G,b, lock),
1375 [0xc1] = X86_OP_ENTRY2(XADD, E,v, G,v, lock),
1376 [0xc2] = X86_OP_ENTRY4(VCMP, V,x, H,x, W,x, vex2_rep3 p_00_66_f3_f2),
1377 [0xc3] = X86_OP_ENTRY3(MOV, EM,y,G,y, None,None, cpuid(SSE2)), /* MOVNTI */
1378 [0xc4] = X86_OP_ENTRY4(PINSRW, V,dq,H,dq,E,w, vex5 mmx p_00_66),
1379 [0xc5] = X86_OP_ENTRY3(PEXTRW, G,d, U,dq,I,b, vex5 mmx p_00_66),
1380 [0xc6] = X86_OP_ENTRY4(VSHUF, V,x, H,x, W,x, vex4 p_00_66),
1381 [0xc7] = X86_OP_GROUP0(group9),
1382
1383 [0xd0] = X86_OP_ENTRY3(VADDSUB, V,x, H,x, W,x, vex2 cpuid(SSE3) p_66_f2),
1384 [0xd1] = X86_OP_ENTRY3(PSRLW_r, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1385 [0xd2] = X86_OP_ENTRY3(PSRLD_r, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1386 [0xd3] = X86_OP_ENTRY3(PSRLQ_r, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1387 [0xd4] = X86_OP_ENTRY3(PADDQ, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1388 [0xd5] = X86_OP_ENTRY3(PMULLW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1389 [0xd6] = X86_OP_GROUP0(0FD6),
1390 [0xd7] = X86_OP_ENTRY3(PMOVMSKB, G,d, None,None, U,x, vex7 mmx avx2_256 p_00_66),
1391
1392 [0xe0] = X86_OP_ENTRY3(PAVGB, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1393 [0xe1] = X86_OP_ENTRY3(PSRAW_r, V,x, H,x, W,x, vex7 mmx avx2_256 p_00_66),
1394 [0xe2] = X86_OP_ENTRY3(PSRAD_r, V,x, H,x, W,x, vex7 mmx avx2_256 p_00_66),
1395 [0xe3] = X86_OP_ENTRY3(PAVGW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1396 [0xe4] = X86_OP_ENTRY3(PMULHUW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1397 [0xe5] = X86_OP_ENTRY3(PMULHW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1398 [0xe6] = X86_OP_GROUP0(0FE6),
1399 [0xe7] = X86_OP_ENTRY3(MOVDQ, W,x, None,None, V,x, vex1 mmx p_00_66), /* MOVNTQ/MOVNTDQ */
1400
1401 [0xf0] = X86_OP_ENTRY3(MOVDQ, V,x, None,None, WM,x, vex4_unal cpuid(SSE3) p_f2), /* LDDQU */
1402 [0xf1] = X86_OP_ENTRY3(PSLLW_r, V,x, H,x, W,x, vex7 mmx avx2_256 p_00_66),
1403 [0xf2] = X86_OP_ENTRY3(PSLLD_r, V,x, H,x, W,x, vex7 mmx avx2_256 p_00_66),
1404 [0xf3] = X86_OP_ENTRY3(PSLLQ_r, V,x, H,x, W,x, vex7 mmx avx2_256 p_00_66),
1405 [0xf4] = X86_OP_ENTRY3(PMULUDQ, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1406 [0xf5] = X86_OP_ENTRY3(PMADDWD, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1407 [0xf6] = X86_OP_ENTRY3(PSADBW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1408 [0xf7] = X86_OP_ENTRY3(MASKMOV, None,None, V,dq, U,dq, vex4_unal avx2_256 mmx p_00_66),
1409
1410 [0x08] = X86_OP_ENTRY0(NOP, svm(INVD)),
1411 [0x09] = X86_OP_ENTRY0(NOP, svm(WBINVD)),
1412 [0x0b] = X86_OP_ENTRY0(UD), /* UD2 */
1413 [0x0d] = X86_OP_ENTRY1(NOP, M,v), /* 3DNow! prefetch */
1414 [0x0e] = X86_OP_ENTRY0(EMMS, cpuid(3DNOW)), /* femms */
1415 /*
1416 * 3DNow!'s opcode byte comes *after* modrm and displacements, making it
1417 * more like an Ib operand. Dispatch to the right helper in a single gen_*
1418 * function.
1419 */
1420 [0x0f] = X86_OP_ENTRY3(3dnow, P,q, Q,q, I,b, cpuid(3DNOW)),
1421
1422 [0x18] = X86_OP_ENTRY1(NOP, nop,v), /* prefetch/reserved NOP */
1423 [0x19] = X86_OP_ENTRY1(NOP, nop,v), /* reserved NOP */
1424 [0x1a] = X86_OP_ENTRY1(multi0F, nop,v, nolea), /* unconverted MPX */
1425 [0x1b] = X86_OP_ENTRY1(multi0F, nop,v, nolea), /* unconverted MPX */
1426 [0x1c] = X86_OP_ENTRY1(NOP, nop,v), /* reserved NOP */
1427 [0x1d] = X86_OP_ENTRY1(NOP, nop,v), /* reserved NOP */
1428 [0x1e] = X86_OP_ENTRY1(NOP, nop,v), /* reserved NOP */
1429 [0x1f] = X86_OP_ENTRY1(NOP, nop,v), /* NOP/reserved NOP */
1430
1431 [0x28] = X86_OP_ENTRY3(MOVDQ, V,x, None,None, W,x, vex1 p_00_66), /* MOVAPS */
1432 [0x29] = X86_OP_ENTRY3(MOVDQ, W,x, None,None, V,x, vex1 p_00_66), /* MOVAPS */
1433 [0x2A] = X86_OP_GROUP0(0F2A),
1434 [0x2B] = X86_OP_GROUP0(0F2B),
1435 [0x2C] = X86_OP_GROUP0(0F2C),
1436 [0x2D] = X86_OP_GROUP0(0F2D),
1437 [0x2E] = X86_OP_GROUP3(VxCOMISx, None,None, V,x, W,x, vex3 p_00_66), /* VUCOMISS/SD */
1438 [0x2F] = X86_OP_GROUP3(VxCOMISx, None,None, V,x, W,x, vex3 p_00_66), /* VCOMISS/SD */
1439
1440 [0x38] = X86_OP_GROUP0(0F38),
1441 [0x3a] = X86_OP_GROUP0(0F3A),
1442
1443 [0x48] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1444 [0x49] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1445 [0x4a] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1446 [0x4b] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1447 [0x4c] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1448 [0x4d] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1449 [0x4e] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1450 [0x4f] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
1451
1452 [0x58] = X86_OP_ENTRY3(VADD, V,x, H,x, W,x, vex2_rep3 p_00_66_f3_f2),
1453 [0x59] = X86_OP_ENTRY3(VMUL, V,x, H,x, W,x, vex2_rep3 p_00_66_f3_f2),
1454 [0x5a] = X86_OP_GROUP0(0F5A),
1455 [0x5b] = X86_OP_GROUP0(0F5B),
1456 [0x5c] = X86_OP_ENTRY3(VSUB, V,x, H,x, W,x, vex2_rep3 p_00_66_f3_f2),
1457 [0x5d] = X86_OP_ENTRY3(VMIN, V,x, H,x, W,x, vex2_rep3 p_00_66_f3_f2),
1458 [0x5e] = X86_OP_ENTRY3(VDIV, V,x, H,x, W,x, vex2_rep3 p_00_66_f3_f2),
1459 [0x5f] = X86_OP_ENTRY3(VMAX, V,x, H,x, W,x, vex2_rep3 p_00_66_f3_f2),
1460
1461 [0x68] = X86_OP_ENTRY3(PUNPCKHBW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1462 [0x69] = X86_OP_ENTRY3(PUNPCKHWD, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1463 [0x6a] = X86_OP_ENTRY3(PUNPCKHDQ, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1464 [0x6b] = X86_OP_ENTRY3(PACKSSDW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1465 [0x6c] = X86_OP_ENTRY3(PUNPCKLQDQ, V,x, H,x, W,x, vex4 p_66 avx2_256),
1466 [0x6d] = X86_OP_ENTRY3(PUNPCKHQDQ, V,x, H,x, W,x, vex4 p_66 avx2_256),
1467 [0x6e] = X86_OP_ENTRY3(MOVD_to, V,dq,None,None, E,y, vex5 mmx p_00_66), /* wrong dest Vy on SDM! */
1468 [0x6f] = X86_OP_GROUP0(0F6F),
1469
1470 [0x78] = X86_OP_GROUP0(0F78),
1471 [0x79] = X86_OP_GROUP2(0F79, V,x, U,x, cpuid(SSE4A)),
1472 [0x7c] = X86_OP_ENTRY3(VHADD, V,x, H,x, W,x, vex2 cpuid(SSE3) p_66_f2),
1473 [0x7d] = X86_OP_ENTRY3(VHSUB, V,x, H,x, W,x, vex2 cpuid(SSE3) p_66_f2),
1474 [0x7e] = X86_OP_GROUP0(0F7E),
1475 [0x7f] = X86_OP_GROUP0(0F7F),
1476
1477 [0x88] = X86_OP_ENTRYr(Jcc, J,z_f64),
1478 [0x89] = X86_OP_ENTRYr(Jcc, J,z_f64),
1479 [0x8a] = X86_OP_ENTRYr(Jcc, J,z_f64),
1480 [0x8b] = X86_OP_ENTRYr(Jcc, J,z_f64),
1481 [0x8c] = X86_OP_ENTRYr(Jcc, J,z_f64),
1482 [0x8d] = X86_OP_ENTRYr(Jcc, J,z_f64),
1483 [0x8e] = X86_OP_ENTRYr(Jcc, J,z_f64),
1484 [0x8f] = X86_OP_ENTRYr(Jcc, J,z_f64),
1485
1486 [0x98] = X86_OP_ENTRYw(SETcc, E,b),
1487 [0x99] = X86_OP_ENTRYw(SETcc, E,b),
1488 [0x9a] = X86_OP_ENTRYw(SETcc, E,b),
1489 [0x9b] = X86_OP_ENTRYw(SETcc, E,b),
1490 [0x9c] = X86_OP_ENTRYw(SETcc, E,b),
1491 [0x9d] = X86_OP_ENTRYw(SETcc, E,b),
1492 [0x9e] = X86_OP_ENTRYw(SETcc, E,b),
1493 [0x9f] = X86_OP_ENTRYw(SETcc, E,b),
1494
1495 [0xa8] = X86_OP_ENTRYr(PUSH, GS, w),
1496 [0xa9] = X86_OP_ENTRYw(POP, GS, w),
1497 [0xaa] = X86_OP_ENTRY0(RSM, chk(smm) svm(RSM)),
1498 [0xab] = X86_OP_ENTRY2(BTS, E,v, G,v, btEvGv),
1499 [0xac] = X86_OP_ENTRY4(SHRD, E,v, 2op,v, G,v),
1500 [0xad] = X86_OP_ENTRY3(SHRD, E,v, 2op,v, G,v),
1501 [0xae] = X86_OP_GROUP0(group15),
1502 /*
1503 * It's slightly more efficient to put Ev operand in T0 and allow gen_IMUL3
1504 * to assume sextT0. Multiplication is commutative anyway.
1505 */
1506 [0xaf] = X86_OP_ENTRY3(IMUL3, G,v, E,v, 2op,v, sextT0),
1507
1508 [0xb8] = X86_OP_GROUP0(0FB8),
1509 /* decoded as modrm, which is visible as a difference between page fault and #UD */
1510 [0xb9] = X86_OP_ENTRYr(UD, nop,v), /* UD1 */
1511 [0xba] = X86_OP_GROUP2(group8, E,v, I,b),
1512 [0xbb] = X86_OP_ENTRY2(BTC, E,v, G,v, btEvGv),
1513 [0xbc] = X86_OP_GROUP0(0FBC),
1514 [0xbd] = X86_OP_GROUP0(0FBD),
1515 [0xbe] = X86_OP_ENTRY3(MOV, G,v, E,b, None, None, sextT0), /* MOVSX */
1516 [0xbf] = X86_OP_ENTRY3(MOV, G,v, E,w, None, None, sextT0), /* MOVSX */
1517
1518 [0xc8] = X86_OP_ENTRY1(BSWAP, LoBits,y),
1519 [0xc9] = X86_OP_ENTRY1(BSWAP, LoBits,y),
1520 [0xca] = X86_OP_ENTRY1(BSWAP, LoBits,y),
1521 [0xcb] = X86_OP_ENTRY1(BSWAP, LoBits,y),
1522 [0xcc] = X86_OP_ENTRY1(BSWAP, LoBits,y),
1523 [0xcd] = X86_OP_ENTRY1(BSWAP, LoBits,y),
1524 [0xce] = X86_OP_ENTRY1(BSWAP, LoBits,y),
1525 [0xcf] = X86_OP_ENTRY1(BSWAP, LoBits,y),
1526
1527 /* Incorrectly missing from 2-17 */
1528 [0xd8] = X86_OP_ENTRY3(PSUBUSB, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1529 [0xd9] = X86_OP_ENTRY3(PSUBUSW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1530 [0xda] = X86_OP_ENTRY3(PMINUB, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1531 [0xdb] = X86_OP_ENTRY3(PAND, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1532 [0xdc] = X86_OP_ENTRY3(PADDUSB, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1533 [0xdd] = X86_OP_ENTRY3(PADDUSW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1534 [0xde] = X86_OP_ENTRY3(PMAXUB, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1535 [0xdf] = X86_OP_ENTRY3(PANDN, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1536
1537 [0xe8] = X86_OP_ENTRY3(PSUBSB, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1538 [0xe9] = X86_OP_ENTRY3(PSUBSW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1539 [0xea] = X86_OP_ENTRY3(PMINSW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1540 [0xeb] = X86_OP_ENTRY3(POR, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1541 [0xec] = X86_OP_ENTRY3(PADDSB, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1542 [0xed] = X86_OP_ENTRY3(PADDSW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1543 [0xee] = X86_OP_ENTRY3(PMAXSW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1544 [0xef] = X86_OP_ENTRY3(PXOR, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1545
1546 [0xf8] = X86_OP_ENTRY3(PSUBB, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1547 [0xf9] = X86_OP_ENTRY3(PSUBW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1548 [0xfa] = X86_OP_ENTRY3(PSUBD, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1549 [0xfb] = X86_OP_ENTRY3(PSUBQ, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1550 [0xfc] = X86_OP_ENTRY3(PADDB, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1551 [0xfd] = X86_OP_ENTRY3(PADDW, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1552 [0xfe] = X86_OP_ENTRY3(PADDD, V,x, H,x, W,x, vex4 mmx avx2_256 p_00_66),
1553 [0xff] = X86_OP_ENTRYr(UD, nop,v), /* UD0 */
1554 };
1555
1556 static void decode_0F(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1557 {
1558 *b = x86_ldub_code(env, s);
1559 *entry = opcodes_0F[*b];
1560 }
1561
1562 static void decode_63(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1563 {
1564 static const X86OpEntry arpl = X86_OP_ENTRY2(ARPL, E,w, G,w, chk(prot));
1565 static const X86OpEntry mov = X86_OP_ENTRY3(MOV, G,v, E,v, None, None);
1566 static const X86OpEntry movsxd = X86_OP_ENTRY3(MOV, G,v, E,d, None, None, sextT0);
1567 if (!CODE64(s)) {
1568 *entry = arpl;
1569 } else if (REX_W(s)) {
1570 *entry = movsxd;
1571 } else {
1572 *entry = mov;
1573 }
1574 }
1575
1576 static void decode_group1(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1577 {
1578 static const X86GenFunc group1_gen[8] = {
1579 gen_ADD, gen_OR, gen_ADC, gen_SBB, gen_AND, gen_SUB, gen_XOR, gen_SUB,
1580 };
1581 int op = (get_modrm(s, env) >> 3) & 7;
1582 entry->gen = group1_gen[op];
1583
1584 if (op == 7) {
1585 /* prevent writeback for CMP */
1586 entry->op1 = entry->op0;
1587 entry->op0 = X86_TYPE_None;
1588 entry->s0 = X86_SIZE_None;
1589 } else {
1590 entry->special = X86_SPECIAL_HasLock;
1591 }
1592 }
1593
1594 static void decode_group1A(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1595 {
1596 int op = (get_modrm(s, env) >> 3) & 7;
1597 if (op != 0) {
1598 /* could be XOP prefix too */
1599 *entry = UNKNOWN_OPCODE;
1600 } else {
1601 entry->gen = gen_POP;
1602 /* The address must use the value of ESP after the pop. */
1603 s->popl_esp_hack = 1 << mo_pushpop(s, s->dflag);
1604 }
1605 }
1606
1607 static void decode_group2(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1608 {
1609 static const X86GenFunc group2_gen[8] = {
1610 gen_ROL, gen_ROR, gen_RCL, gen_RCR,
1611 gen_SHL, gen_SHR, gen_SHL /* SAL, undocumented */, gen_SAR,
1612 };
1613 int op = (get_modrm(s, env) >> 3) & 7;
1614 entry->gen = group2_gen[op];
1615 if (op == 7) {
1616 entry->special = X86_SPECIAL_SExtT0;
1617 } else {
1618 entry->special = X86_SPECIAL_ZExtT0;
1619 }
1620 }
1621
1622 static void decode_group3(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1623 {
1624 static const X86OpEntry opcodes_grp3[16] = {
1625 /* 0xf6 */
1626 [0x00] = X86_OP_ENTRYrr(AND, E,b, I,b),
1627 [0x01] = X86_OP_ENTRYrr(AND, E,b, I,b),
1628 [0x02] = X86_OP_ENTRY1(NOT, E,b, lock),
1629 [0x03] = X86_OP_ENTRY1(NEG, E,b, lock),
1630 [0x04] = X86_OP_ENTRYrr(MUL, E,b, 0,b, zextT0),
1631 [0x05] = X86_OP_ENTRYrr(IMUL,E,b, 0,b, sextT0),
1632 [0x06] = X86_OP_ENTRYr(DIV, E,b),
1633 [0x07] = X86_OP_ENTRYr(IDIV, E,b),
1634
1635 /* 0xf7 */
1636 [0x08] = X86_OP_ENTRYrr(AND, E,v, I,z),
1637 [0x09] = X86_OP_ENTRYrr(AND, E,v, I,z),
1638 [0x0a] = X86_OP_ENTRY1(NOT, E,v, lock),
1639 [0x0b] = X86_OP_ENTRY1(NEG, E,v, lock),
1640 [0x0c] = X86_OP_ENTRYrr(MUL, E,v, 0,v, zextT0),
1641 [0x0d] = X86_OP_ENTRYrr(IMUL,E,v, 0,v, sextT0),
1642 [0x0e] = X86_OP_ENTRYr(DIV, E,v),
1643 [0x0f] = X86_OP_ENTRYr(IDIV, E,v),
1644 };
1645
1646 int w = (*b & 1);
1647 int reg = (get_modrm(s, env) >> 3) & 7;
1648
1649 *entry = opcodes_grp3[(w << 3) | reg];
1650 }
1651
1652 static void decode_group4_5(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1653 {
1654 static const X86OpEntry opcodes_grp4_5[16] = {
1655 /* 0xfe */
1656 [0x00] = X86_OP_ENTRY1(INC, E,b, lock),
1657 [0x01] = X86_OP_ENTRY1(DEC, E,b, lock),
1658
1659 /* 0xff */
1660 [0x08] = X86_OP_ENTRY1(INC, E,v, lock),
1661 [0x09] = X86_OP_ENTRY1(DEC, E,v, lock),
1662 [0x0a] = X86_OP_ENTRYr(CALL_m, E,f64, zextT0),
1663 [0x0b] = X86_OP_ENTRYr(CALLF_m, M,p),
1664 [0x0c] = X86_OP_ENTRYr(JMP_m, E,f64, zextT0),
1665 [0x0d] = X86_OP_ENTRYr(JMPF_m, M,p),
1666 [0x0e] = X86_OP_ENTRYr(PUSH, E,d64),
1667 };
1668
1669 int w = (*b & 1);
1670 int reg = (get_modrm(s, env) >> 3) & 7;
1671
1672 *entry = opcodes_grp4_5[(w << 3) | reg];
1673 }
1674
1675
1676 static void decode_group11(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1677 {
1678 int op = (get_modrm(s, env) >> 3) & 7;
1679 if (op != 0) {
1680 *entry = UNKNOWN_OPCODE;
1681 } else {
1682 entry->gen = gen_MOV;
1683 }
1684 }
1685
1686 static void decode_90(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
1687 {
1688 static X86OpEntry pause = X86_OP_ENTRY0(PAUSE, svm(PAUSE));
1689 static X86OpEntry nop = X86_OP_ENTRY0(NOP);
1690 static X86OpEntry xchg_ax = X86_OP_ENTRY2(XCHG, 0,v, LoBits,v);
1691
1692 if (REX_B(s)) {
1693 *entry = xchg_ax;
1694 } else {
1695 *entry = (s->prefix & PREFIX_REPZ) ? pause : nop;
1696 }
1697 }
1698
1699 static const X86OpEntry opcodes_root[256] = {
1700 [0x00] = X86_OP_ENTRY2(ADD, E,b, G,b, lock),
1701 [0x01] = X86_OP_ENTRY2(ADD, E,v, G,v, lock),
1702 [0x02] = X86_OP_ENTRY2(ADD, G,b, E,b, lock),
1703 [0x03] = X86_OP_ENTRY2(ADD, G,v, E,v, lock),
1704 [0x04] = X86_OP_ENTRY2(ADD, 0,b, I,b, lock), /* AL, Ib */
1705 [0x05] = X86_OP_ENTRY2(ADD, 0,v, I,z, lock), /* rAX, Iz */
1706 [0x06] = X86_OP_ENTRYr(PUSH, ES, w, chk(i64)),
1707 [0x07] = X86_OP_ENTRYw(POP, ES, w, chk(i64)),
1708
1709 [0x10] = X86_OP_ENTRY2(ADC, E,b, G,b, lock),
1710 [0x11] = X86_OP_ENTRY2(ADC, E,v, G,v, lock),
1711 [0x12] = X86_OP_ENTRY2(ADC, G,b, E,b, lock),
1712 [0x13] = X86_OP_ENTRY2(ADC, G,v, E,v, lock),
1713 [0x14] = X86_OP_ENTRY2(ADC, 0,b, I,b, lock), /* AL, Ib */
1714 [0x15] = X86_OP_ENTRY2(ADC, 0,v, I,z, lock), /* rAX, Iz */
1715 [0x16] = X86_OP_ENTRYr(PUSH, SS, w, chk(i64)),
1716 [0x17] = X86_OP_ENTRYw(POP, SS, w, chk(i64)),
1717
1718 [0x20] = X86_OP_ENTRY2(AND, E,b, G,b, lock),
1719 [0x21] = X86_OP_ENTRY2(AND, E,v, G,v, lock),
1720 [0x22] = X86_OP_ENTRY2(AND, G,b, E,b, lock),
1721 [0x23] = X86_OP_ENTRY2(AND, G,v, E,v, lock),
1722 [0x24] = X86_OP_ENTRY2(AND, 0,b, I,b, lock), /* AL, Ib */
1723 [0x25] = X86_OP_ENTRY2(AND, 0,v, I,z, lock), /* rAX, Iz */
1724 [0x26] = {},
1725 [0x27] = X86_OP_ENTRY0(DAA, chk(i64)),
1726
1727 [0x30] = X86_OP_ENTRY2(XOR, E,b, G,b, lock),
1728 [0x31] = X86_OP_ENTRY2(XOR, E,v, G,v, lock),
1729 [0x32] = X86_OP_ENTRY2(XOR, G,b, E,b, lock),
1730 [0x33] = X86_OP_ENTRY2(XOR, G,v, E,v, lock),
1731 [0x34] = X86_OP_ENTRY2(XOR, 0,b, I,b, lock), /* AL, Ib */
1732 [0x35] = X86_OP_ENTRY2(XOR, 0,v, I,z, lock), /* rAX, Iz */
1733 [0x36] = {},
1734 [0x37] = X86_OP_ENTRY0(AAA, chk(i64)),
1735
1736 [0x40] = X86_OP_ENTRY1(INC, 0,v, chk(i64)),
1737 [0x41] = X86_OP_ENTRY1(INC, 1,v, chk(i64)),
1738 [0x42] = X86_OP_ENTRY1(INC, 2,v, chk(i64)),
1739 [0x43] = X86_OP_ENTRY1(INC, 3,v, chk(i64)),
1740 [0x44] = X86_OP_ENTRY1(INC, 4,v, chk(i64)),
1741 [0x45] = X86_OP_ENTRY1(INC, 5,v, chk(i64)),
1742 [0x46] = X86_OP_ENTRY1(INC, 6,v, chk(i64)),
1743 [0x47] = X86_OP_ENTRY1(INC, 7,v, chk(i64)),
1744
1745 [0x50] = X86_OP_ENTRYr(PUSH, LoBits,d64),
1746 [0x51] = X86_OP_ENTRYr(PUSH, LoBits,d64),
1747 [0x52] = X86_OP_ENTRYr(PUSH, LoBits,d64),
1748 [0x53] = X86_OP_ENTRYr(PUSH, LoBits,d64),
1749 [0x54] = X86_OP_ENTRYr(PUSH, LoBits,d64),
1750 [0x55] = X86_OP_ENTRYr(PUSH, LoBits,d64),
1751 [0x56] = X86_OP_ENTRYr(PUSH, LoBits,d64),
1752 [0x57] = X86_OP_ENTRYr(PUSH, LoBits,d64),
1753
1754 [0x60] = X86_OP_ENTRY0(PUSHA, chk(i64)),
1755 [0x61] = X86_OP_ENTRY0(POPA, chk(i64)),
1756 [0x62] = X86_OP_ENTRYrr(BOUND, G,v, M,a, chk(i64)),
1757 [0x63] = X86_OP_GROUP0(63),
1758 [0x64] = {},
1759 [0x65] = {},
1760 [0x66] = {},
1761 [0x67] = {},
1762
1763 [0x70] = X86_OP_ENTRYr(Jcc, J,b),
1764 [0x71] = X86_OP_ENTRYr(Jcc, J,b),
1765 [0x72] = X86_OP_ENTRYr(Jcc, J,b),
1766 [0x73] = X86_OP_ENTRYr(Jcc, J,b),
1767 [0x74] = X86_OP_ENTRYr(Jcc, J,b),
1768 [0x75] = X86_OP_ENTRYr(Jcc, J,b),
1769 [0x76] = X86_OP_ENTRYr(Jcc, J,b),
1770 [0x77] = X86_OP_ENTRYr(Jcc, J,b),
1771
1772 [0x80] = X86_OP_GROUP2(group1, E,b, I,b),
1773 [0x81] = X86_OP_GROUP2(group1, E,v, I,z),
1774 [0x82] = X86_OP_GROUP2(group1, E,b, I,b, chk(i64)),
1775 [0x83] = X86_OP_GROUP2(group1, E,v, I,b),
1776 [0x84] = X86_OP_ENTRYrr(AND, E,b, G,b),
1777 [0x85] = X86_OP_ENTRYrr(AND, E,v, G,v),
1778 [0x86] = X86_OP_ENTRY2(XCHG, E,b, G,b, xchg),
1779 [0x87] = X86_OP_ENTRY2(XCHG, E,v, G,v, xchg),
1780
1781 [0x90] = X86_OP_GROUP0(90),
1782 [0x91] = X86_OP_ENTRY2(XCHG, 0,v, LoBits,v),
1783 [0x92] = X86_OP_ENTRY2(XCHG, 0,v, LoBits,v),
1784 [0x93] = X86_OP_ENTRY2(XCHG, 0,v, LoBits,v),
1785 [0x94] = X86_OP_ENTRY2(XCHG, 0,v, LoBits,v),
1786 [0x95] = X86_OP_ENTRY2(XCHG, 0,v, LoBits,v),
1787 [0x96] = X86_OP_ENTRY2(XCHG, 0,v, LoBits,v),
1788 [0x97] = X86_OP_ENTRY2(XCHG, 0,v, LoBits,v),
1789
1790 [0xA0] = X86_OP_ENTRY3(MOV, 0,b, O,b, None, None), /* AL, Ob */
1791 [0xA1] = X86_OP_ENTRY3(MOV, 0,v, O,v, None, None), /* rAX, Ov */
1792 [0xA2] = X86_OP_ENTRY3(MOV, O,b, 0,b, None, None), /* Ob, AL */
1793 [0xA3] = X86_OP_ENTRY3(MOV, O,v, 0,v, None, None), /* Ov, rAX */
1794 [0xA4] = X86_OP_ENTRYrr(MOVS, Y,b, X,b),
1795 [0xA5] = X86_OP_ENTRYrr(MOVS, Y,v, X,v),
1796 [0xA6] = X86_OP_ENTRYrr(CMPS, Y,b, X,b),
1797 [0xA7] = X86_OP_ENTRYrr(CMPS, Y,v, X,v),
1798
1799 [0xB0] = X86_OP_ENTRY3(MOV, LoBits,b, I,b, None, None),
1800 [0xB1] = X86_OP_ENTRY3(MOV, LoBits,b, I,b, None, None),
1801 [0xB2] = X86_OP_ENTRY3(MOV, LoBits,b, I,b, None, None),
1802 [0xB3] = X86_OP_ENTRY3(MOV, LoBits,b, I,b, None, None),
1803 [0xB4] = X86_OP_ENTRY3(MOV, LoBits,b, I,b, None, None),
1804 [0xB5] = X86_OP_ENTRY3(MOV, LoBits,b, I,b, None, None),
1805 [0xB6] = X86_OP_ENTRY3(MOV, LoBits,b, I,b, None, None),
1806 [0xB7] = X86_OP_ENTRY3(MOV, LoBits,b, I,b, None, None),
1807
1808 [0xC0] = X86_OP_GROUP2(group2, E,b, I,b),
1809 [0xC1] = X86_OP_GROUP2(group2, E,v, I,b),
1810 [0xC2] = X86_OP_ENTRYr(RET, I,w),
1811 [0xC3] = X86_OP_ENTRY0(RET),
1812 [0xC4] = X86_OP_ENTRY3(LES, G,z, EM,p, None, None, chk(i64)),
1813 [0xC5] = X86_OP_ENTRY3(LDS, G,z, EM,p, None, None, chk(i64)),
1814 [0xC6] = X86_OP_GROUP3(group11, E,b, I,b, None, None), /* reg=000b */
1815 [0xC7] = X86_OP_GROUP3(group11, E,v, I,z, None, None), /* reg=000b */
1816
1817 [0xD0] = X86_OP_GROUP1(group2, E,b),
1818 [0xD1] = X86_OP_GROUP1(group2, E,v),
1819 [0xD2] = X86_OP_GROUP2(group2, E,b, 1,b), /* CL */
1820 [0xD3] = X86_OP_GROUP2(group2, E,v, 1,b), /* CL */
1821 [0xD4] = X86_OP_ENTRY2(AAM, 0,w, I,b, chk(i64)),
1822 [0xD5] = X86_OP_ENTRY2(AAD, 0,w, I,b, chk(i64)),
1823 [0xD6] = X86_OP_ENTRYw(SALC, 0,b, chk(i64)),
1824 [0xD7] = X86_OP_ENTRY1(XLAT, 0,b, zextT0), /* AL read/written */
1825
1826 [0xE0] = X86_OP_ENTRYr(LOOPNE, J,b), /* implicit: CX with aflag size */
1827 [0xE1] = X86_OP_ENTRYr(LOOPE, J,b), /* implicit: CX with aflag size */
1828 [0xE2] = X86_OP_ENTRYr(LOOP, J,b), /* implicit: CX with aflag size */
1829 [0xE3] = X86_OP_ENTRYr(JCXZ, J,b), /* implicit: CX with aflag size */
1830 [0xE4] = X86_OP_ENTRYwr(IN, 0,b, I_unsigned,b), /* AL */
1831 [0xE5] = X86_OP_ENTRYwr(IN, 0,z, I_unsigned,b), /* AX/EAX */
1832 [0xE6] = X86_OP_ENTRYrr(OUT, 0,b, I_unsigned,b), /* AL */
1833 [0xE7] = X86_OP_ENTRYrr(OUT, 0,z, I_unsigned,b), /* AX/EAX */
1834
1835 [0xF1] = X86_OP_ENTRY0(INT1, svm(ICEBP)),
1836 [0xF4] = X86_OP_ENTRY0(HLT, chk(cpl0) svm(HLT)),
1837 [0xF5] = X86_OP_ENTRY0(CMC),
1838 [0xF6] = X86_OP_GROUP1(group3, E,b),
1839 [0xF7] = X86_OP_GROUP1(group3, E,v),
1840
1841 [0x08] = X86_OP_ENTRY2(OR, E,b, G,b, lock),
1842 [0x09] = X86_OP_ENTRY2(OR, E,v, G,v, lock),
1843 [0x0A] = X86_OP_ENTRY2(OR, G,b, E,b, lock),
1844 [0x0B] = X86_OP_ENTRY2(OR, G,v, E,v, lock),
1845 [0x0C] = X86_OP_ENTRY2(OR, 0,b, I,b, lock), /* AL, Ib */
1846 [0x0D] = X86_OP_ENTRY2(OR, 0,v, I,z, lock), /* rAX, Iz */
1847 [0x0E] = X86_OP_ENTRYr(PUSH, CS, w, chk(i64)),
1848 [0x0F] = X86_OP_GROUP0(0F),
1849
1850 [0x18] = X86_OP_ENTRY2(SBB, E,b, G,b, lock),
1851 [0x19] = X86_OP_ENTRY2(SBB, E,v, G,v, lock),
1852 [0x1A] = X86_OP_ENTRY2(SBB, G,b, E,b, lock),
1853 [0x1B] = X86_OP_ENTRY2(SBB, G,v, E,v, lock),
1854 [0x1C] = X86_OP_ENTRY2(SBB, 0,b, I,b, lock), /* AL, Ib */
1855 [0x1D] = X86_OP_ENTRY2(SBB, 0,v, I,z, lock), /* rAX, Iz */
1856 [0x1E] = X86_OP_ENTRYr(PUSH, DS, w, chk(i64)),
1857 [0x1F] = X86_OP_ENTRYw(POP, DS, w, chk(i64)),
1858
1859 [0x28] = X86_OP_ENTRY2(SUB, E,b, G,b, lock),
1860 [0x29] = X86_OP_ENTRY2(SUB, E,v, G,v, lock),
1861 [0x2A] = X86_OP_ENTRY2(SUB, G,b, E,b, lock),
1862 [0x2B] = X86_OP_ENTRY2(SUB, G,v, E,v, lock),
1863 [0x2C] = X86_OP_ENTRY2(SUB, 0,b, I,b, lock), /* AL, Ib */
1864 [0x2D] = X86_OP_ENTRY2(SUB, 0,v, I,z, lock), /* rAX, Iz */
1865 [0x2E] = {},
1866 [0x2F] = X86_OP_ENTRY0(DAS, chk(i64)),
1867
1868 [0x38] = X86_OP_ENTRYrr(SUB, E,b, G,b),
1869 [0x39] = X86_OP_ENTRYrr(SUB, E,v, G,v),
1870 [0x3A] = X86_OP_ENTRYrr(SUB, G,b, E,b),
1871 [0x3B] = X86_OP_ENTRYrr(SUB, G,v, E,v),
1872 [0x3C] = X86_OP_ENTRYrr(SUB, 0,b, I,b), /* AL, Ib */
1873 [0x3D] = X86_OP_ENTRYrr(SUB, 0,v, I,z), /* rAX, Iz */
1874 [0x3E] = {},
1875 [0x3F] = X86_OP_ENTRY0(AAS, chk(i64)),
1876
1877 [0x48] = X86_OP_ENTRY1(DEC, 0,v, chk(i64)),
1878 [0x49] = X86_OP_ENTRY1(DEC, 1,v, chk(i64)),
1879 [0x4A] = X86_OP_ENTRY1(DEC, 2,v, chk(i64)),
1880 [0x4B] = X86_OP_ENTRY1(DEC, 3,v, chk(i64)),
1881 [0x4C] = X86_OP_ENTRY1(DEC, 4,v, chk(i64)),
1882 [0x4D] = X86_OP_ENTRY1(DEC, 5,v, chk(i64)),
1883 [0x4E] = X86_OP_ENTRY1(DEC, 6,v, chk(i64)),
1884 [0x4F] = X86_OP_ENTRY1(DEC, 7,v, chk(i64)),
1885
1886 [0x58] = X86_OP_ENTRYw(POP, LoBits,d64),
1887 [0x59] = X86_OP_ENTRYw(POP, LoBits,d64),
1888 [0x5A] = X86_OP_ENTRYw(POP, LoBits,d64),
1889 [0x5B] = X86_OP_ENTRYw(POP, LoBits,d64),
1890 [0x5C] = X86_OP_ENTRYw(POP, LoBits,d64),
1891 [0x5D] = X86_OP_ENTRYw(POP, LoBits,d64),
1892 [0x5E] = X86_OP_ENTRYw(POP, LoBits,d64),
1893 [0x5F] = X86_OP_ENTRYw(POP, LoBits,d64),
1894
1895 [0x68] = X86_OP_ENTRYr(PUSH, I,z),
1896 [0x69] = X86_OP_ENTRY3(IMUL3, G,v, E,v, I,z, sextT0),
1897 [0x6A] = X86_OP_ENTRYr(PUSH, I,b),
1898 [0x6B] = X86_OP_ENTRY3(IMUL3, G,v, E,v, I,b, sextT0),
1899 [0x6C] = X86_OP_ENTRYrr(INS, Y,b, 2,w), /* DX */
1900 [0x6D] = X86_OP_ENTRYrr(INS, Y,z, 2,w), /* DX */
1901 [0x6E] = X86_OP_ENTRYrr(OUTS, X,b, 2,w), /* DX */
1902 [0x6F] = X86_OP_ENTRYrr(OUTS, X,z, 2,w), /* DX */
1903
1904 [0x78] = X86_OP_ENTRYr(Jcc, J,b),
1905 [0x79] = X86_OP_ENTRYr(Jcc, J,b),
1906 [0x7A] = X86_OP_ENTRYr(Jcc, J,b),
1907 [0x7B] = X86_OP_ENTRYr(Jcc, J,b),
1908 [0x7C] = X86_OP_ENTRYr(Jcc, J,b),
1909 [0x7D] = X86_OP_ENTRYr(Jcc, J,b),
1910 [0x7E] = X86_OP_ENTRYr(Jcc, J,b),
1911 [0x7F] = X86_OP_ENTRYr(Jcc, J,b),
1912
1913 [0x88] = X86_OP_ENTRYwr(MOV, E,b, G,b),
1914 [0x89] = X86_OP_ENTRYwr(MOV, E,v, G,v),
1915 [0x8A] = X86_OP_ENTRYwr(MOV, G,b, E,b),
1916 [0x8B] = X86_OP_ENTRYwr(MOV, G,v, E,v),
1917 /* Missing in Table A-2: memory destination is always 16-bit. */
1918 [0x8C] = X86_OP_ENTRYwr(MOV, E,v, S,w, op0_Mw),
1919 [0x8D] = X86_OP_ENTRYwr(LEA, G,v, M,v, nolea),
1920 [0x8E] = X86_OP_ENTRYwr(MOV, S,w, E,w),
1921 [0x8F] = X86_OP_GROUPw(group1A, E,d64),
1922
1923 [0x98] = X86_OP_ENTRY1(CBW, 0,v), /* rAX */
1924 [0x99] = X86_OP_ENTRYwr(CWD, 2,v, 0,v), /* rDX, rAX */
1925 [0x9A] = X86_OP_ENTRYrr(CALLF, I_unsigned,p, I_unsigned,w, chk(i64)),
1926 [0x9B] = X86_OP_ENTRY0(WAIT),
1927 [0x9C] = X86_OP_ENTRY0(PUSHF, chk(vm86_iopl) svm(PUSHF)),
1928 [0x9D] = X86_OP_ENTRY0(POPF, chk(vm86_iopl) svm(POPF)),
1929 [0x9E] = X86_OP_ENTRY0(SAHF),
1930 [0x9F] = X86_OP_ENTRY0(LAHF),
1931
1932 [0xA8] = X86_OP_ENTRYrr(AND, 0,b, I,b), /* AL, Ib */
1933 [0xA9] = X86_OP_ENTRYrr(AND, 0,v, I,z), /* rAX, Iz */
1934 [0xAA] = X86_OP_ENTRYwr(STOS, Y,b, 0,b),
1935 [0xAB] = X86_OP_ENTRYwr(STOS, Y,v, 0,v),
1936 /* Manual writeback because REP LODS (!) has to write EAX/RAX after every LODS. */
1937 [0xAC] = X86_OP_ENTRYr(LODS, X,b),
1938 [0xAD] = X86_OP_ENTRYr(LODS, X,v),
1939 [0xAE] = X86_OP_ENTRYrr(SCAS, 0,b, Y,b),
1940 [0xAF] = X86_OP_ENTRYrr(SCAS, 0,v, Y,v),
1941
1942 [0xB8] = X86_OP_ENTRYwr(MOV, LoBits,v, I,v),
1943 [0xB9] = X86_OP_ENTRYwr(MOV, LoBits,v, I,v),
1944 [0xBA] = X86_OP_ENTRYwr(MOV, LoBits,v, I,v),
1945 [0xBB] = X86_OP_ENTRYwr(MOV, LoBits,v, I,v),
1946 [0xBC] = X86_OP_ENTRYwr(MOV, LoBits,v, I,v),
1947 [0xBD] = X86_OP_ENTRYwr(MOV, LoBits,v, I,v),
1948 [0xBE] = X86_OP_ENTRYwr(MOV, LoBits,v, I,v),
1949 [0xBF] = X86_OP_ENTRYwr(MOV, LoBits,v, I,v),
1950
1951 [0xC8] = X86_OP_ENTRYrr(ENTER, I,w, I,b),
1952 [0xC9] = X86_OP_ENTRY1(LEAVE, A,d64),
1953 [0xCA] = X86_OP_ENTRYr(RETF, I,w),
1954 [0xCB] = X86_OP_ENTRY0(RETF),
1955 [0xCC] = X86_OP_ENTRY0(INT3),
1956 [0xCD] = X86_OP_ENTRYr(INT, I,b, chk(vm86_iopl)),
1957 [0xCE] = X86_OP_ENTRY0(INTO, chk(i64)),
1958 [0xCF] = X86_OP_ENTRY0(IRET, chk(vm86_iopl) svm(IRET)),
1959
1960 /*
1961 * x87 is nolea because it needs the address without segment base,
1962 * in order to store it in fdp.
1963 */
1964 [0xD8] = X86_OP_ENTRY1(x87, nop,v, nolea),
1965 [0xD9] = X86_OP_ENTRY1(x87, nop,v, nolea),
1966 [0xDA] = X86_OP_ENTRY1(x87, nop,v, nolea),
1967 [0xDB] = X86_OP_ENTRY1(x87, nop,v, nolea),
1968 [0xDC] = X86_OP_ENTRY1(x87, nop,v, nolea),
1969 [0xDD] = X86_OP_ENTRY1(x87, nop,v, nolea),
1970 [0xDE] = X86_OP_ENTRY1(x87, nop,v, nolea),
1971 [0xDF] = X86_OP_ENTRY1(x87, nop,v, nolea),
1972
1973 [0xE8] = X86_OP_ENTRYr(CALL, J,z_f64),
1974 [0xE9] = X86_OP_ENTRYr(JMP, J,z_f64),
1975 [0xEA] = X86_OP_ENTRYrr(JMPF, I_unsigned,p, I_unsigned,w, chk(i64)),
1976 [0xEB] = X86_OP_ENTRYr(JMP, J,b),
1977 [0xEC] = X86_OP_ENTRYwr(IN, 0,b, 2,w), /* AL, DX */
1978 [0xED] = X86_OP_ENTRYwr(IN, 0,z, 2,w), /* AX/EAX, DX */
1979 [0xEE] = X86_OP_ENTRYrr(OUT, 0,b, 2,w), /* DX, AL */
1980 [0xEF] = X86_OP_ENTRYrr(OUT, 0,z, 2,w), /* DX, AX/EAX */
1981
1982 [0xF8] = X86_OP_ENTRY0(CLC),
1983 [0xF9] = X86_OP_ENTRY0(STC),
1984 [0xFA] = X86_OP_ENTRY0(CLI, chk(iopl)),
1985 [0xFB] = X86_OP_ENTRY0(STI, chk(iopl)),
1986 [0xFC] = X86_OP_ENTRY0(CLD),
1987 [0xFD] = X86_OP_ENTRY0(STD),
1988 [0xFE] = X86_OP_GROUP1(group4_5, E,b),
1989 [0xFF] = X86_OP_GROUP1(group4_5, E,v),
1990 };
1991
1992 #undef mmx
1993 #undef vex1
1994 #undef vex2
1995 #undef vex3
1996 #undef vex4
1997 #undef vex4_unal
1998 #undef vex5
1999 #undef vex6
2000 #undef vex7
2001 #undef vex8
2002 #undef vex11
2003 #undef vex12
2004 #undef vex13
2005
2006 static void decode_root(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
2007 {
2008 *entry = opcodes_root[*b];
2009 }
2010
2011 /* Decode the MODRM and SIB bytes into a register or memory operand. */
2012 static void decode_modrm(DisasContext *s, CPUX86State *env,
2013 X86DecodedInsn *decode, X86DecodedOp *op)
2014 {
2015 int mod = (s->modrm >> 6) & 3;
2016 int rm = s->modrm & 7;
2017 bool is_vsib = decode->e.vex_class == 12;
2018 int sib = -1;
2019
2020 if (mod == 3) {
2021 op->n = rm;
2022 if (op->unit != X86_OP_MMX) {
2023 op->n |= REX_B(s);
2024 }
2025 return;
2026 }
2027
2028 /* Decompose an address. */
2029 int def_seg = R_DS;
2030 int base = rm | REX_B(s);
2031 int index = -1;
2032 int scale = 0;
2033 target_ulong disp = 0;
2034
2035 switch (s->aflag) {
2036 case MO_64:
2037 case MO_32:
2038 if (rm == 4) {
2039 sib = x86_ldub_code(env, s);
2040 scale = (sib >> 6) & 3;
2041 index = ((sib >> 3) & 7) | REX_X(s);
2042 if (index == 4 && !is_vsib) {
2043 index = -1; /* no index */
2044 }
2045 base = (sib & 7) | REX_B(s);
2046 }
2047
2048 switch (mod) {
2049 case 0:
2050 if ((base & 7) == 5) {
2051 base = -1;
2052 disp = (int32_t)x86_ldl_code(env, s);
2053 if (CODE64(s) && sib == -1) {
2054 base = -2;
2055 disp += s->pc + s->rip_offset;
2056 }
2057 }
2058 break;
2059 case 1:
2060 disp = (int8_t)x86_ldub_code(env, s);
2061 break;
2062 default:
2063 case 2:
2064 disp = (int32_t)x86_ldl_code(env, s);
2065 break;
2066 }
2067
2068 /* For correct popl handling with esp. */
2069 if (base == R_ESP && s->popl_esp_hack) {
2070 disp += s->popl_esp_hack;
2071 }
2072 if (base == R_EBP || base == R_ESP) {
2073 def_seg = R_SS;
2074 }
2075 break;
2076
2077 case MO_16:
2078 if (mod == 0) {
2079 if (rm == 6) {
2080 base = -1;
2081 disp = x86_lduw_code(env, s);
2082 break;
2083 }
2084 } else if (mod == 1) {
2085 disp = (int8_t)x86_ldub_code(env, s);
2086 } else {
2087 disp = (int16_t)x86_lduw_code(env, s);
2088 }
2089
2090 switch (rm) {
2091 case 0:
2092 base = R_EBX;
2093 index = R_ESI;
2094 break;
2095 case 1:
2096 base = R_EBX;
2097 index = R_EDI;
2098 break;
2099 case 2:
2100 base = R_EBP;
2101 index = R_ESI;
2102 def_seg = R_SS;
2103 break;
2104 case 3:
2105 base = R_EBP;
2106 index = R_EDI;
2107 def_seg = R_SS;
2108 break;
2109 case 4:
2110 base = R_ESI;
2111 break;
2112 case 5:
2113 base = R_EDI;
2114 break;
2115 case 6:
2116 base = R_EBP;
2117 def_seg = R_SS;
2118 break;
2119 default:
2120 case 7:
2121 base = R_EBX;
2122 break;
2123 }
2124 break;
2125
2126 default:
2127 g_assert_not_reached();
2128 }
2129
2130 op->has_ea = true;
2131 op->n = -1;
2132 decode->mem = (AddressParts){ def_seg, base, index, scale, disp };
2133 }
2134
2135 static bool decode_op_size(DisasContext *s, X86OpEntry *e, X86OpSize size, MemOp *ot)
2136 {
2137 switch (size) {
2138 case X86_SIZE_b: /* byte */
2139 *ot = MO_8;
2140 return true;
2141
2142 case X86_SIZE_d: /* 32-bit */
2143 case X86_SIZE_ss: /* SSE/AVX scalar single precision */
2144 *ot = MO_32;
2145 return true;
2146
2147 case X86_SIZE_p: /* Far pointer, return offset size */
2148 case X86_SIZE_s: /* Descriptor, return offset size */
2149 case X86_SIZE_v: /* 16/32/64-bit, based on operand size */
2150 *ot = s->dflag;
2151 return true;
2152
2153 case X86_SIZE_pi: /* MMX */
2154 case X86_SIZE_q: /* 64-bit */
2155 case X86_SIZE_sd: /* SSE/AVX scalar double precision */
2156 *ot = MO_64;
2157 return true;
2158
2159 case X86_SIZE_w: /* 16-bit */
2160 *ot = MO_16;
2161 return true;
2162
2163 case X86_SIZE_y: /* 32/64-bit, based on operand size */
2164 *ot = s->dflag == MO_16 ? MO_32 : s->dflag;
2165 return true;
2166
2167 case X86_SIZE_y_d64: /* Full (not 16-bit) register access */
2168 *ot = CODE64(s) ? MO_64 : MO_32;
2169 return true;
2170
2171 case X86_SIZE_z: /* 16-bit for 16-bit operand size, else 32-bit */
2172 *ot = s->dflag == MO_16 ? MO_16 : MO_32;
2173 return true;
2174
2175 case X86_SIZE_z_f64: /* 32-bit for 32-bit operand size or 64-bit mode, else 16-bit */
2176 *ot = !CODE64(s) && s->dflag == MO_16 ? MO_16 : MO_32;
2177 return true;
2178
2179 case X86_SIZE_dq: /* SSE/AVX 128-bit */
2180 if (e->special == X86_SPECIAL_MMX &&
2181 !(s->prefix & (PREFIX_DATA | PREFIX_REPZ | PREFIX_REPNZ))) {
2182 *ot = MO_64;
2183 return true;
2184 }
2185 if (s->vex_l && e->s0 != X86_SIZE_qq && e->s1 != X86_SIZE_qq) {
2186 return false;
2187 }
2188 *ot = MO_128;
2189 return true;
2190
2191 case X86_SIZE_qq: /* AVX 256-bit */
2192 if (!s->vex_l) {
2193 return false;
2194 }
2195 *ot = MO_256;
2196 return true;
2197
2198 case X86_SIZE_x: /* 128/256-bit, based on operand size */
2199 if (e->special == X86_SPECIAL_MMX &&
2200 !(s->prefix & (PREFIX_DATA | PREFIX_REPZ | PREFIX_REPNZ))) {
2201 *ot = MO_64;
2202 return true;
2203 }
2204 /* fall through */
2205 case X86_SIZE_ps: /* SSE/AVX packed single precision */
2206 case X86_SIZE_pd: /* SSE/AVX packed double precision */
2207 *ot = s->vex_l ? MO_256 : MO_128;
2208 return true;
2209
2210 case X86_SIZE_xh: /* SSE/AVX packed half register */
2211 *ot = s->vex_l ? MO_128 : MO_64;
2212 return true;
2213
2214 case X86_SIZE_d64: /* Default to 64-bit in 64-bit mode */
2215 *ot = CODE64(s) && s->dflag == MO_32 ? MO_64 : s->dflag;
2216 return true;
2217
2218 case X86_SIZE_f64: /* Ignore size override prefix in 64-bit mode */
2219 *ot = CODE64(s) ? MO_64 : s->dflag;
2220 return true;
2221
2222 default:
2223 *ot = -1;
2224 return true;
2225 }
2226 }
2227
2228 static bool op_has_modrm(X86OpType type)
2229 {
2230 switch (type) {
2231 case X86_TYPE_C: /* REG in the modrm byte selects a control register */
2232 case X86_TYPE_D: /* REG in the modrm byte selects a debug register */
2233 case X86_TYPE_E: /* ALU modrm operand */
2234 case X86_TYPE_EM: /* modrm byte selects an ALU memory operand */
2235 case X86_TYPE_G: /* REG in the modrm byte selects a GPR */
2236 case X86_TYPE_M: /* modrm byte selects a memory operand */
2237 case X86_TYPE_nop: /* modrm operand decoded but not fetched */
2238 case X86_TYPE_N: /* R/M in the modrm byte selects an MMX register */
2239 case X86_TYPE_P: /* REG in the modrm byte selects an MMX register */
2240 case X86_TYPE_Q: /* MMX modrm operand */
2241 case X86_TYPE_R: /* R/M in the modrm byte selects a register */
2242 case X86_TYPE_U: /* R/M in the modrm byte selects an XMM/YMM register */
2243 case X86_TYPE_V: /* reg in the modrm byte selects an XMM/YMM register */
2244 case X86_TYPE_WM: /* modrm byte selects an XMM/YMM memory operand */
2245 case X86_TYPE_W: /* XMM/YMM modrm operand */
2246 return true;
2247 default:
2248 return false;
2249 }
2250 }
2251
2252 static bool decode_op(DisasContext *s, CPUX86State *env, X86DecodedInsn *decode,
2253 X86DecodedOp *op, X86OpType type, int b)
2254 {
2255 switch (type) {
2256 case X86_TYPE_None: /* Implicit or absent */
2257 case X86_TYPE_A: /* Implicit */
2258 case X86_TYPE_F: /* EFLAGS/RFLAGS */
2259 case X86_TYPE_X: /* string source */
2260 case X86_TYPE_Y: /* string destination */
2261 break;
2262
2263 case X86_TYPE_B: /* VEX.vvvv selects a GPR */
2264 op->unit = X86_OP_INT;
2265 op->n = s->vex_v;
2266 break;
2267
2268 case X86_TYPE_C: /* REG in the modrm byte selects a control register */
2269 op->unit = X86_OP_CR;
2270 op->n = ((s->modrm >> 3) & 7) | REX_R(s);
2271 if (op->n == 0 && (s->prefix & PREFIX_LOCK) &&
2272 (s->cpuid_ext3_features & CPUID_EXT3_CR8LEG)) {
2273 op->n = 8;
2274 s->prefix &= ~PREFIX_LOCK;
2275 }
2276 if (op->n != 0 && op->n != 2 && op->n != 3 && op->n != 4 && op->n != 8) {
2277 return false;
2278 }
2279 if (decode->e.intercept) {
2280 decode->e.intercept += op->n;
2281 }
2282 break;
2283
2284 case X86_TYPE_D: /* REG in the modrm byte selects a debug register */
2285 op->unit = X86_OP_DR;
2286 op->n = ((s->modrm >> 3) & 7) | REX_R(s);
2287 if (op->n >= 8) {
2288 /*
2289 * illegal opcode. The DR4 and DR5 case is checked in the generated
2290 * code instead, to save on hflags bits.
2291 */
2292 return false;
2293 }
2294 if (decode->e.intercept) {
2295 decode->e.intercept += op->n;
2296 }
2297 break;
2298
2299 case X86_TYPE_G: /* REG in the modrm byte selects a GPR */
2300 op->unit = X86_OP_INT;
2301 goto get_reg;
2302
2303 case X86_TYPE_S: /* reg selects a segment register */
2304 op->unit = X86_OP_SEG;
2305 op->n = (s->modrm >> 3) & 7;
2306 /* Values outside [CDEFGS]S, as well as storing to CS, are invalid. */
2307 if (op->n >= 6 || (op->n == R_CS && op == &decode->op[0])) {
2308 return false;
2309 }
2310 break;
2311
2312 case X86_TYPE_P: /* REG in the modrm byte selects an MMX register */
2313 op->unit = X86_OP_MMX;
2314 goto get_reg;
2315
2316 case X86_TYPE_V: /* reg in the modrm byte selects an XMM/YMM register */
2317 if (decode->e.special == X86_SPECIAL_MMX &&
2318 !(s->prefix & (PREFIX_DATA | PREFIX_REPZ | PREFIX_REPNZ))) {
2319 op->unit = X86_OP_MMX;
2320 } else {
2321 op->unit = X86_OP_SSE;
2322 }
2323 get_reg:
2324 op->n = ((s->modrm >> 3) & 7);
2325 if (op->unit != X86_OP_MMX) {
2326 op->n |= REX_R(s);
2327 }
2328 break;
2329
2330 case X86_TYPE_E: /* ALU modrm operand */
2331 op->unit = X86_OP_INT;
2332 goto get_modrm;
2333
2334 case X86_TYPE_Q: /* MMX modrm operand */
2335 op->unit = X86_OP_MMX;
2336 goto get_modrm;
2337
2338 case X86_TYPE_W: /* XMM/YMM modrm operand */
2339 if (decode->e.special == X86_SPECIAL_MMX &&
2340 !(s->prefix & (PREFIX_DATA | PREFIX_REPZ | PREFIX_REPNZ))) {
2341 op->unit = X86_OP_MMX;
2342 } else {
2343 op->unit = X86_OP_SSE;
2344 }
2345 goto get_modrm;
2346
2347 case X86_TYPE_N: /* R/M in the modrm byte selects an MMX register */
2348 op->unit = X86_OP_MMX;
2349 goto get_modrm_reg;
2350
2351 case X86_TYPE_U: /* R/M in the modrm byte selects an XMM/YMM register */
2352 if (decode->e.special == X86_SPECIAL_MMX &&
2353 !(s->prefix & (PREFIX_DATA | PREFIX_REPZ | PREFIX_REPNZ))) {
2354 op->unit = X86_OP_MMX;
2355 } else {
2356 op->unit = X86_OP_SSE;
2357 }
2358 goto get_modrm_reg;
2359
2360 case X86_TYPE_R: /* R/M in the modrm byte selects a register */
2361 op->unit = X86_OP_INT;
2362 get_modrm_reg:
2363 if ((s->modrm >> 6) != 3) {
2364 return false;
2365 }
2366 goto get_modrm;
2367
2368 case X86_TYPE_WM: /* modrm byte selects an XMM/YMM memory operand */
2369 op->unit = X86_OP_SSE;
2370 goto get_modrm_mem;
2371
2372 case X86_TYPE_EM: /* modrm byte selects an ALU memory operand */
2373 op->unit = X86_OP_INT;
2374 /* fall through */
2375 case X86_TYPE_M: /* modrm byte selects a memory operand */
2376 get_modrm_mem:
2377 if ((s->modrm >> 6) == 3) {
2378 return false;
2379 }
2380 /* fall through */
2381 case X86_TYPE_nop: /* modrm operand decoded but not fetched */
2382 get_modrm:
2383 decode_modrm(s, env, decode, op);
2384 break;
2385
2386 case X86_TYPE_O: /* Absolute address encoded in the instruction */
2387 op->unit = X86_OP_INT;
2388 op->has_ea = true;
2389 op->n = -1;
2390 decode->mem = (AddressParts) {
2391 .def_seg = R_DS,
2392 .base = -1,
2393 .index = -1,
2394 .disp = insn_get_addr(env, s, s->aflag)
2395 };
2396 break;
2397
2398 case X86_TYPE_H: /* For AVX, VEX.vvvv selects an XMM/YMM register */
2399 if ((s->prefix & PREFIX_VEX)) {
2400 op->unit = X86_OP_SSE;
2401 op->n = s->vex_v;
2402 break;
2403 }
2404 if (op == &decode->op[0]) {
2405 /* shifts place the destination in VEX.vvvv, use modrm */
2406 return decode_op(s, env, decode, op, decode->e.op1, b);
2407 } else {
2408 return decode_op(s, env, decode, op, decode->e.op0, b);
2409 }
2410
2411 case X86_TYPE_I: /* Immediate */
2412 case X86_TYPE_J: /* Relative offset for a jump */
2413 op->unit = X86_OP_IMM;
2414 decode->immediate = op->imm = insn_get_signed(env, s, op->ot);
2415 break;
2416
2417 case X86_TYPE_I_unsigned: /* Immediate */
2418 op->unit = X86_OP_IMM;
2419 decode->immediate = op->imm = insn_get(env, s, op->ot);
2420 break;
2421
2422 case X86_TYPE_L: /* The upper 4 bits of the immediate select a 128-bit register */
2423 op->n = insn_get(env, s, op->ot) >> 4;
2424 break;
2425
2426 case X86_TYPE_2op:
2427 *op = decode->op[0];
2428 break;
2429
2430 case X86_TYPE_LoBits:
2431 op->n = (b & 7) | REX_B(s);
2432 op->unit = X86_OP_INT;
2433 break;
2434
2435 case X86_TYPE_0 ... X86_TYPE_7:
2436 op->n = type - X86_TYPE_0;
2437 op->unit = X86_OP_INT;
2438 break;
2439
2440 case X86_TYPE_ES ... X86_TYPE_GS:
2441 op->n = type - X86_TYPE_ES;
2442 op->unit = X86_OP_SEG;
2443 break;
2444 }
2445
2446 return true;
2447 }
2448
2449 static bool validate_sse_prefix(DisasContext *s, X86OpEntry *e)
2450 {
2451 uint16_t sse_prefixes;
2452
2453 if (!e->valid_prefix) {
2454 return true;
2455 }
2456 if (s->prefix & (PREFIX_REPZ | PREFIX_REPNZ)) {
2457 /* In SSE instructions, 0xF3 and 0xF2 cancel 0x66. */
2458 s->prefix &= ~PREFIX_DATA;
2459 }
2460
2461 /* Now, either zero or one bit is set in sse_prefixes. */
2462 sse_prefixes = s->prefix & (PREFIX_REPZ | PREFIX_REPNZ | PREFIX_DATA);
2463 return e->valid_prefix & (1 << sse_prefixes);
2464 }
2465
2466 static bool decode_insn(DisasContext *s, CPUX86State *env, X86DecodeFunc decode_func,
2467 X86DecodedInsn *decode)
2468 {
2469 X86OpEntry *e = &decode->e;
2470
2471 /*
2472 * Each step decodes part of the opcode and leaves the last not-fully-decoded
2473 * byte in decode->b. If the modrm byte is read, it is placed in s->modrm.
2474 */
2475 decode_func(s, env, e, &decode->b);
2476 while (e->is_decode) {
2477 e->is_decode = false;
2478 e->decode(s, env, e, &decode->b);
2479 }
2480
2481 if (!validate_sse_prefix(s, e)) {
2482 return false;
2483 }
2484
2485 /* Compute size of operands here in order to initialize s->rip_offset. */
2486 if (e->op0 != X86_TYPE_None) {
2487 if (!decode_op_size(s, e, e->s0, &decode->op[0].ot)) {
2488 return false;
2489 }
2490 if (e->op0 == X86_TYPE_I) {
2491 s->rip_offset += 1 << decode->op[0].ot;
2492 }
2493 }
2494 if (e->op1 != X86_TYPE_None) {
2495 if (!decode_op_size(s, e, e->s1, &decode->op[1].ot)) {
2496 return false;
2497 }
2498 if (e->op1 == X86_TYPE_I) {
2499 s->rip_offset += 1 << decode->op[1].ot;
2500 }
2501 }
2502 if (e->op2 != X86_TYPE_None) {
2503 if (!decode_op_size(s, e, e->s2, &decode->op[2].ot)) {
2504 return false;
2505 }
2506 if (e->op2 == X86_TYPE_I) {
2507 s->rip_offset += 1 << decode->op[2].ot;
2508 }
2509 }
2510 if (e->op3 != X86_TYPE_None) {
2511 /*
2512 * A couple instructions actually use the extra immediate byte for an Lx
2513 * register operand; those are handled in the gen_* functions as one off.
2514 */
2515 assert(e->op3 == X86_TYPE_I && e->s3 == X86_SIZE_b);
2516 s->rip_offset += 1;
2517 }
2518 return true;
2519 }
2520
2521 static bool decode_ops(DisasContext *s, CPUX86State *env, X86DecodeFunc decode_func,
2522 X86DecodedInsn *decode)
2523 {
2524 X86OpEntry *e = &decode->e;
2525
2526 if (e->op0 != X86_TYPE_None &&
2527 !decode_op(s, env, decode, &decode->op[0], e->op0, decode->b)) {
2528 return false;
2529 }
2530
2531 if (e->op1 != X86_TYPE_None &&
2532 !decode_op(s, env, decode, &decode->op[1], e->op1, decode->b)) {
2533 return false;
2534 }
2535
2536 if (e->op2 != X86_TYPE_None &&
2537 !decode_op(s, env, decode, &decode->op[2], e->op2, decode->b)) {
2538 return false;
2539 }
2540
2541 if (e->op3 != X86_TYPE_None) {
2542 decode->immediate = insn_get_signed(env, s, MO_8);
2543 }
2544
2545 if (e->vex_class == 12) {
2546 /* Check no overlap between registers. */
2547 if (!decode->op[0].has_ea &&
2548 (decode->op[0].n == decode->mem.index || decode->op[0].n == decode->op[1].n)) {
2549 return false;
2550 }
2551 assert(!decode->op[1].has_ea);
2552 if (decode->op[1].n == decode->mem.index) {
2553 return false;
2554 }
2555 if (!decode->op[2].has_ea &&
2556 (decode->op[2].n == decode->mem.index || decode->op[2].n == decode->op[1].n)) {
2557 return false;
2558 }
2559 }
2560
2561 return true;
2562 }
2563
2564 static bool has_cpuid_feature(DisasContext *s, X86CPUIDFeature cpuid)
2565 {
2566 switch (cpuid) {
2567 case X86_FEAT_None:
2568 return true;
2569 case X86_FEAT_CMOV:
2570 return (s->cpuid_features & CPUID_CMOV);
2571 case X86_FEAT_CLFLUSH:
2572 return (s->cpuid_features & CPUID_CLFLUSH);
2573 case X86_FEAT_CX8:
2574 return (s->cpuid_features & CPUID_CX8);
2575 case X86_FEAT_FXSR:
2576 return (s->cpuid_features & CPUID_FXSR);
2577 case X86_FEAT_CX16:
2578 return (s->cpuid_ext_features & CPUID_EXT_CX16);
2579 case X86_FEAT_F16C:
2580 return (s->cpuid_ext_features & CPUID_EXT_F16C);
2581 case X86_FEAT_FMA:
2582 return (s->cpuid_ext_features & CPUID_EXT_FMA);
2583 case X86_FEAT_MOVBE:
2584 return (s->cpuid_ext_features & CPUID_EXT_MOVBE);
2585 case X86_FEAT_PCLMULQDQ:
2586 return (s->cpuid_ext_features & CPUID_EXT_PCLMULQDQ);
2587 case X86_FEAT_POPCNT:
2588 return (s->cpuid_ext_features & CPUID_EXT_POPCNT);
2589 case X86_FEAT_SSE:
2590 return (s->cpuid_features & CPUID_SSE);
2591 case X86_FEAT_SSE2:
2592 return (s->cpuid_features & CPUID_SSE2);
2593 case X86_FEAT_SSE3:
2594 return (s->cpuid_ext_features & CPUID_EXT_SSE3);
2595 case X86_FEAT_SSSE3:
2596 return (s->cpuid_ext_features & CPUID_EXT_SSSE3);
2597 case X86_FEAT_SSE41:
2598 return (s->cpuid_ext_features & CPUID_EXT_SSE41);
2599 case X86_FEAT_SSE42:
2600 return (s->cpuid_ext_features & CPUID_EXT_SSE42);
2601 case X86_FEAT_AES:
2602 if (!(s->cpuid_ext_features & CPUID_EXT_AES)) {
2603 return false;
2604 } else if (!(s->prefix & PREFIX_VEX)) {
2605 return true;
2606 } else if (!(s->cpuid_ext_features & CPUID_EXT_AVX)) {
2607 return false;
2608 } else {
2609 return !s->vex_l || (s->cpuid_7_0_ecx_features & CPUID_7_0_ECX_VAES);
2610 }
2611
2612 case X86_FEAT_AVX:
2613 return (s->cpuid_ext_features & CPUID_EXT_AVX);
2614 case X86_FEAT_XSAVE:
2615 return (s->cpuid_ext_features & CPUID_EXT_XSAVE);
2616
2617 case X86_FEAT_3DNOW:
2618 return (s->cpuid_ext2_features & CPUID_EXT2_3DNOW);
2619 case X86_FEAT_SSE4A:
2620 return (s->cpuid_ext3_features & CPUID_EXT3_SSE4A);
2621
2622 case X86_FEAT_ADX:
2623 return (s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_ADX);
2624 case X86_FEAT_BMI1:
2625 return (s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_BMI1);
2626 case X86_FEAT_BMI2:
2627 return (s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_BMI2);
2628 case X86_FEAT_AVX2:
2629 return (s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_AVX2);
2630 case X86_FEAT_CLFLUSHOPT:
2631 return (s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_CLFLUSHOPT);
2632 case X86_FEAT_CLWB:
2633 return (s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_CLWB);
2634 case X86_FEAT_FSGSBASE:
2635 return (s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_FSGSBASE);
2636 case X86_FEAT_SHA_NI:
2637 return (s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_SHA_NI);
2638
2639 case X86_FEAT_CMPCCXADD:
2640 return (s->cpuid_7_1_eax_features & CPUID_7_1_EAX_CMPCCXADD);
2641
2642 case X86_FEAT_XSAVEOPT:
2643 return (s->cpuid_xsave_features & CPUID_XSAVE_XSAVEOPT);
2644 }
2645 g_assert_not_reached();
2646 }
2647
2648 static bool validate_vex(DisasContext *s, X86DecodedInsn *decode)
2649 {
2650 X86OpEntry *e = &decode->e;
2651
2652 switch (e->vex_special) {
2653 case X86_VEX_None:
2654 break;
2655
2656 case X86_VEX_REPScalar:
2657 /*
2658 * Instructions which differ between 00/66 and F2/F3 in the
2659 * exception classification and the size of the memory operand.
2660 */
2661 assert(e->vex_class == 1 || e->vex_class == 2 || e->vex_class == 4);
2662 if (s->prefix & (PREFIX_REPZ | PREFIX_REPNZ)) {
2663 e->vex_class = e->vex_class < 4 ? 3 : 5;
2664 if (s->vex_l) {
2665 goto illegal;
2666 }
2667 assert(e->op2 == X86_TYPE_W && e->s2 == X86_SIZE_x);
2668 if ((s->modrm >> 6) != 3) {
2669 e->s2 = s->prefix & PREFIX_REPNZ ? X86_SIZE_sd : X86_SIZE_ss;
2670 }
2671 }
2672 break;
2673
2674 case X86_VEX_SSEUnaligned:
2675 /* handled in sse_needs_alignment. */
2676 break;
2677
2678 case X86_VEX_AVX2_256:
2679 if ((s->prefix & PREFIX_VEX) && s->vex_l && !has_cpuid_feature(s, X86_FEAT_AVX2)) {
2680 goto illegal;
2681 }
2682 }
2683
2684 switch (e->vex_class) {
2685 case 0:
2686 g_assert_not_reached();
2687 case 1:
2688 case 2:
2689 case 3:
2690 case 4:
2691 case 5:
2692 case 7:
2693 if (s->prefix & PREFIX_VEX) {
2694 if (!(s->flags & HF_AVX_EN_MASK)) {
2695 goto illegal;
2696 }
2697 } else if (e->special != X86_SPECIAL_MMX ||
2698 (s->prefix & (PREFIX_REPZ | PREFIX_REPNZ | PREFIX_DATA))) {
2699 if (!(s->flags & HF_OSFXSR_MASK)) {
2700 goto illegal;
2701 }
2702 }
2703 break;
2704 case 12:
2705 /* Must have a VSIB byte and no address prefix. */
2706 assert(s->has_modrm);
2707 if ((s->modrm & 7) != 4 || s->aflag == MO_16) {
2708 goto illegal;
2709 }
2710
2711 /* fall through */
2712 case 6:
2713 case 11:
2714 if (!(s->prefix & PREFIX_VEX)) {
2715 goto illegal;
2716 }
2717 if (!(s->flags & HF_AVX_EN_MASK)) {
2718 goto illegal;
2719 }
2720 break;
2721 case 8:
2722 /* Non-VEX case handled in decode_0F77. */
2723 assert(s->prefix & PREFIX_VEX);
2724 if (!(s->flags & HF_AVX_EN_MASK)) {
2725 goto illegal;
2726 }
2727 break;
2728 case 13:
2729 if (!(s->prefix & PREFIX_VEX)) {
2730 goto illegal;
2731 }
2732 if (s->vex_l) {
2733 goto illegal;
2734 }
2735 /* All integer instructions use VEX.vvvv, so exit. */
2736 return true;
2737 }
2738
2739 if (s->vex_v != 0 &&
2740 e->op0 != X86_TYPE_H && e->op0 != X86_TYPE_B &&
2741 e->op1 != X86_TYPE_H && e->op1 != X86_TYPE_B &&
2742 e->op2 != X86_TYPE_H && e->op2 != X86_TYPE_B) {
2743 goto illegal;
2744 }
2745
2746 if (s->flags & HF_TS_MASK) {
2747 goto nm_exception;
2748 }
2749 if (s->flags & HF_EM_MASK) {
2750 goto illegal;
2751 }
2752 return true;
2753
2754 nm_exception:
2755 gen_NM_exception(s);
2756 return false;
2757 illegal:
2758 gen_illegal_opcode(s);
2759 return false;
2760 }
2761
2762 static void dump_unknown_opcode(CPUX86State *env, DisasContext *s)
2763 {
2764 if (qemu_loglevel_mask(LOG_UNIMP)) {
2765 FILE *logfile = qemu_log_trylock();
2766 if (logfile) {
2767 target_ulong pc = s->base.pc_next, end = s->pc;
2768
2769 fprintf(logfile, "ILLOPC: " TARGET_FMT_lx ":", pc);
2770 for (; pc < end; ++pc) {
2771 fprintf(logfile, " %02x", translator_ldub(env, &s->base, pc));
2772 }
2773 fprintf(logfile, "\n");
2774 qemu_log_unlock(logfile);
2775 }
2776 }
2777 }
2778
2779 /*
2780 * Convert one instruction. s->base.is_jmp is set if the translation must
2781 * be stopped.
2782 */
2783 static void disas_insn(DisasContext *s, CPUState *cpu)
2784 {
2785 CPUX86State *env = cpu_env(cpu);
2786 X86DecodedInsn decode;
2787 X86DecodeFunc decode_func = decode_root;
2788 bool accept_lock = false;
2789 uint8_t cc_live, b;
2790
2791 s->pc = s->base.pc_next;
2792 s->override = -1;
2793 s->popl_esp_hack = 0;
2794 #ifdef TARGET_X86_64
2795 s->rex_r = 0;
2796 s->rex_x = 0;
2797 s->rex_b = 0;
2798 #endif
2799 s->rip_offset = 0; /* for relative ip address */
2800 s->vex_l = 0;
2801 s->vex_v = 0;
2802 s->vex_w = false;
2803 s->has_modrm = false;
2804 s->prefix = 0;
2805
2806 next_byte:;
2807 #ifdef TARGET_X86_64
2808 /* clear any REX prefix followed by other prefixes. */
2809 int rex;
2810 rex = -1;
2811 next_byte_rex:
2812 #endif
2813 b = x86_ldub_code(env, s);
2814
2815 /* Collect prefixes. */
2816 switch (b) {
2817 case 0xf3:
2818 s->prefix |= PREFIX_REPZ;
2819 s->prefix &= ~PREFIX_REPNZ;
2820 goto next_byte;
2821 case 0xf2:
2822 s->prefix |= PREFIX_REPNZ;
2823 s->prefix &= ~PREFIX_REPZ;
2824 goto next_byte;
2825 case 0xf0:
2826 s->prefix |= PREFIX_LOCK;
2827 goto next_byte;
2828 case 0x2e:
2829 if (!CODE64(s)) {
2830 s->override = R_CS;
2831 }
2832 goto next_byte;
2833 case 0x36:
2834 if (!CODE64(s)) {
2835 s->override = R_SS;
2836 }
2837 goto next_byte;
2838 case 0x3e:
2839 if (!CODE64(s)) {
2840 s->override = R_DS;
2841 }
2842 goto next_byte;
2843 case 0x26:
2844 if (!CODE64(s)) {
2845 s->override = R_ES;
2846 }
2847 goto next_byte;
2848 case 0x64:
2849 s->override = R_FS;
2850 goto next_byte;
2851 case 0x65:
2852 s->override = R_GS;
2853 goto next_byte;
2854 case 0x66:
2855 s->prefix |= PREFIX_DATA;
2856 goto next_byte;
2857 case 0x67:
2858 s->prefix |= PREFIX_ADR;
2859 goto next_byte;
2860 #ifdef TARGET_X86_64
2861 case 0x40 ... 0x4f:
2862 if (CODE64(s)) {
2863 /*
2864 * REX prefix; ignored unless it is the last prefix, so
2865 * for now just stash it
2866 */
2867 rex = b;
2868 goto next_byte_rex;
2869 }
2870 break;
2871 #endif
2872 case 0xc5: /* 2-byte VEX */
2873 case 0xc4: /* 3-byte VEX */
2874 /*
2875 * Bits 6-7 of the first byte must be set except in 64-bit mode.
2876 * Otherwise the instruction is LES or LDS. Not allowed in real mode.
2877 */
2878 if (PE(s) && !VM86(s)) {
2879 static const int pp_prefix[4] = {
2880 0, PREFIX_DATA, PREFIX_REPZ, PREFIX_REPNZ
2881 };
2882 int vex3, vex2 = x86_ldub_code(env, s);
2883
2884 if (!CODE64(s) && (vex2 & 0xc0) != 0xc0) {
2885 s->pc--; /* rewind the advance_pc() x86_ldub_code() did */
2886 break;
2887 }
2888
2889 /* 4.1.1-4.1.3: No preceding lock, 66, f2, f3, or rex prefixes. */
2890 if (s->prefix & (PREFIX_REPZ | PREFIX_REPNZ
2891 | PREFIX_LOCK | PREFIX_DATA)) {
2892 goto illegal_op;
2893 }
2894 #ifdef TARGET_X86_64
2895 if (rex != -1) {
2896 goto illegal_op;
2897 }
2898 s->rex_r = (~vex2 >> 4) & 8;
2899 #endif
2900 if (b == 0xc5) {
2901 /* 2-byte VEX prefix: RVVVVlpp, implied 0f leading opcode byte */
2902 vex3 = vex2;
2903 decode_func = decode_0F;
2904 } else {
2905 /* 3-byte VEX prefix: RXBmmmmm wVVVVlpp */
2906 vex3 = x86_ldub_code(env, s);
2907 #ifdef TARGET_X86_64
2908 s->rex_x = (~vex2 >> 3) & 8;
2909 s->rex_b = (~vex2 >> 2) & 8;
2910 #endif
2911 s->vex_w = (vex3 >> 7) & 1;
2912 switch (vex2 & 0x1f) {
2913 case 0x01: /* Implied 0f leading opcode bytes. */
2914 decode_func = decode_0F;
2915 break;
2916 case 0x02: /* Implied 0f 38 leading opcode bytes. */
2917 decode_func = decode_0F38;
2918 break;
2919 case 0x03: /* Implied 0f 3a leading opcode bytes. */
2920 decode_func = decode_0F3A;
2921 break;
2922 default: /* Reserved for future use. */
2923 goto unknown_op;
2924 }
2925 }
2926 s->vex_v = (~vex3 >> 3) & (CODE64(s) ? 15 : 7);
2927 s->vex_l = (vex3 >> 2) & 1;
2928 s->prefix |= pp_prefix[vex3 & 3] | PREFIX_VEX;
2929 }
2930 break;
2931 default:
2932 break;
2933 }
2934
2935 /* Post-process prefixes. */
2936 if (CODE64(s)) {
2937 #ifdef TARGET_X86_64
2938 if (rex != -1) {
2939 s->prefix |= PREFIX_REX;
2940 s->vex_w = (rex >> 3) & 1;
2941 s->rex_r = (rex & 0x4) << 1;
2942 s->rex_x = (rex & 0x2) << 2;
2943 s->rex_b = (rex & 0x1) << 3;
2944 }
2945 #endif
2946
2947 /*
2948 * In 64-bit mode, the default data size is 32-bit. Select 64-bit
2949 * data with rex_w, and 16-bit data with 0x66; rex_w takes precedence
2950 * over 0x66 if both are present.
2951 */
2952 s->dflag = (REX_W(s) ? MO_64 : s->prefix & PREFIX_DATA ? MO_16 : MO_32);
2953 /* In 64-bit mode, 0x67 selects 32-bit addressing. */
2954 s->aflag = (s->prefix & PREFIX_ADR ? MO_32 : MO_64);
2955 } else {
2956 /* In 16/32-bit mode, 0x66 selects the opposite data size. */
2957 if (CODE32(s) ^ ((s->prefix & PREFIX_DATA) != 0)) {
2958 s->dflag = MO_32;
2959 } else {
2960 s->dflag = MO_16;
2961 }
2962 /* In 16/32-bit mode, 0x67 selects the opposite addressing. */
2963 if (CODE32(s) ^ ((s->prefix & PREFIX_ADR) != 0)) {
2964 s->aflag = MO_32;
2965 } else {
2966 s->aflag = MO_16;
2967 }
2968 }
2969
2970 memset(&decode, 0, sizeof(decode));
2971 decode.cc_op = -1;
2972 decode.b = b;
2973 if (!decode_insn(s, env, decode_func, &decode)) {
2974 goto illegal_op;
2975 }
2976 if (!decode.e.gen) {
2977 goto unknown_op;
2978 }
2979
2980 if (!has_cpuid_feature(s, decode.e.cpuid)) {
2981 goto illegal_op;
2982 }
2983
2984 /* Checks that result in #UD come first. */
2985 if (decode.e.check) {
2986 if (CODE64(s)) {
2987 if (decode.e.check & X86_CHECK_i64) {
2988 goto illegal_op;
2989 }
2990 if ((decode.e.check & X86_CHECK_i64_amd) && !IS_INTEL_CPU(env)) {
2991 goto illegal_op;
2992 }
2993 } else {
2994 if (decode.e.check & X86_CHECK_o64) {
2995 goto illegal_op;
2996 }
2997 if ((decode.e.check & X86_CHECK_o64_intel) && IS_INTEL_CPU(env)) {
2998 goto illegal_op;
2999 }
3000 }
3001 if (decode.e.check & X86_CHECK_prot_or_vm86) {
3002 if (!PE(s)) {
3003 goto illegal_op;
3004 }
3005 }
3006 if (decode.e.check & X86_CHECK_no_vm86) {
3007 if (VM86(s)) {
3008 goto illegal_op;
3009 }
3010 }
3011 if ((decode.e.check & X86_CHECK_VEX128) && s->vex_l) {
3012 goto illegal_op;
3013 }
3014 if ((decode.e.check & X86_CHECK_W0) && s->vex_w) {
3015 goto illegal_op;
3016 }
3017 if ((decode.e.check & X86_CHECK_W1) && !s->vex_w) {
3018 goto illegal_op;
3019 }
3020 }
3021
3022 if (op_has_modrm(decode.e.op0) || op_has_modrm(decode.e.op1) ||
3023 op_has_modrm(decode.e.op2)) {
3024 get_modrm(s, env);
3025 }
3026
3027 if (decode.e.vex_class == 0) {
3028 if (s->prefix & PREFIX_VEX) {
3029 goto illegal_op;
3030 }
3031 } else {
3032 if (!validate_vex(s, &decode)) {
3033 return;
3034 }
3035 }
3036
3037 if (!decode_ops(s, env, decode_func, &decode)) {
3038 goto illegal_op;
3039 }
3040
3041 switch (decode.e.special) {
3042 case X86_SPECIAL_None:
3043 break;
3044
3045 case X86_SPECIAL_Locked:
3046 if (decode.op[0].has_ea) {
3047 s->prefix |= PREFIX_LOCK;
3048 }
3049 /* fallthrough */
3050 case X86_SPECIAL_HasLock:
3051 case X86_SPECIAL_BitTest:
3052 accept_lock = decode.op[0].has_ea;
3053 break;
3054
3055 case X86_SPECIAL_Op0_Rd:
3056 assert(decode.op[0].unit == X86_OP_INT);
3057 if (!decode.op[0].has_ea) {
3058 decode.op[0].ot = MO_32;
3059 }
3060 break;
3061
3062 case X86_SPECIAL_Op2_Ry:
3063 assert(decode.op[2].unit == X86_OP_INT);
3064 if (!decode.op[2].has_ea) {
3065 decode.op[2].ot = s->dflag == MO_16 ? MO_32 : s->dflag;
3066 }
3067 break;
3068
3069 case X86_SPECIAL_AVXExtMov:
3070 if (!decode.op[2].has_ea) {
3071 decode.op[2].ot = s->vex_l ? MO_256 : MO_128;
3072 } else if (s->vex_l) {
3073 decode.op[2].ot++;
3074 }
3075 break;
3076
3077 case X86_SPECIAL_SExtT0:
3078 case X86_SPECIAL_ZExtT0:
3079 /* Handled in gen_load. */
3080 assert(decode.op[1].unit == X86_OP_INT);
3081 break;
3082
3083 case X86_SPECIAL_Op0_Mw:
3084 assert(decode.op[0].unit == X86_OP_INT);
3085 if (decode.op[0].has_ea) {
3086 decode.op[0].ot = MO_16;
3087 }
3088 break;
3089
3090 default:
3091 break;
3092 }
3093
3094 if ((s->prefix & PREFIX_LOCK) && !accept_lock) {
3095 goto illegal_op;
3096 }
3097
3098 /*
3099 * Checks that result in #GP or VMEXIT come second. Intercepts are
3100 * generally checked after non-memory exceptions (i.e. after all
3101 * exceptions if there is no memory operand). Exceptions are
3102 * vm86 checks (INTn, IRET, PUSHF/POPF), RSM and XSETBV (!).
3103 *
3104 * XSETBV will check for CPL0 in the gen_* function instead of using chk().
3105 */
3106 if (decode.e.check & X86_CHECK_cpl0) {
3107 if (CPL(s) != 0) {
3108 goto gp_fault;
3109 }
3110 }
3111 if (decode.e.has_intercept && unlikely(GUEST(s))) {
3112 gen_helper_svm_check_intercept(tcg_env,
3113 tcg_constant_i32(decode.e.intercept));
3114 }
3115 if (decode.e.check) {
3116 if ((decode.e.check & X86_CHECK_smm) && !(s->flags & HF_SMM_MASK)) {
3117 goto illegal_op;
3118 }
3119 if ((decode.e.check & X86_CHECK_vm86_iopl) && VM86(s)) {
3120 if (IOPL(s) < 3) {
3121 goto gp_fault;
3122 }
3123 } else if (decode.e.check & X86_CHECK_cpl_iopl) {
3124 if (IOPL(s) < CPL(s)) {
3125 goto gp_fault;
3126 }
3127 }
3128 }
3129
3130 if (decode.e.special == X86_SPECIAL_MMX &&
3131 !(s->prefix & (PREFIX_REPZ | PREFIX_REPNZ | PREFIX_DATA))) {
3132 gen_helper_enter_mmx(tcg_env);
3133 }
3134
3135 if (decode.e.special != X86_SPECIAL_NoLoadEA &&
3136 (decode.op[0].has_ea || decode.op[1].has_ea || decode.op[2].has_ea)) {
3137 gen_lea_modrm(s, &decode);
3138 }
3139 if (s->prefix & PREFIX_LOCK) {
3140 assert(decode.op[0].has_ea && !decode.op[2].has_ea);
3141 gen_load(s, &decode, 2, s->T1);
3142 decode.e.gen(s, &decode);
3143 } else {
3144 if (decode.op[0].unit == X86_OP_MMX) {
3145 compute_mmx_offset(&decode.op[0]);
3146 } else if (decode.op[0].unit == X86_OP_SSE) {
3147 compute_xmm_offset(&decode.op[0]);
3148 }
3149 gen_load(s, &decode, 1, s->T0);
3150 gen_load(s, &decode, 2, s->T1);
3151 decode.e.gen(s, &decode);
3152 gen_writeback(s, &decode, 0, s->T0);
3153 }
3154
3155 /*
3156 * Write back flags after last memory access. Some older ALU instructions, as
3157 * well as SSE instructions, write flags in the gen_* function, but that can
3158 * cause incorrect tracking of CC_OP for instructions that write to both memory
3159 * and flags.
3160 */
3161 if (decode.cc_op != -1) {
3162 if (decode.cc_dst) {
3163 tcg_gen_mov_tl(cpu_cc_dst, decode.cc_dst);
3164 }
3165 if (decode.cc_src) {
3166 tcg_gen_mov_tl(cpu_cc_src, decode.cc_src);
3167 }
3168 if (decode.cc_src2) {
3169 tcg_gen_mov_tl(cpu_cc_src2, decode.cc_src2);
3170 }
3171 if (decode.cc_op == CC_OP_DYNAMIC) {
3172 tcg_gen_mov_i32(cpu_cc_op, decode.cc_op_dynamic);
3173 }
3174 set_cc_op(s, decode.cc_op);
3175 cc_live = cc_op_live(decode.cc_op);
3176 } else {
3177 cc_live = 0;
3178 }
3179 if (decode.cc_op != CC_OP_DYNAMIC) {
3180 assert(!decode.cc_op_dynamic);
3181 assert(!!decode.cc_dst == !!(cc_live & USES_CC_DST));
3182 assert(!!decode.cc_src == !!(cc_live & USES_CC_SRC));
3183 assert(!!decode.cc_src2 == !!(cc_live & USES_CC_SRC2));
3184 }
3185
3186 return;
3187 gp_fault:
3188 gen_exception_gpf(s);
3189 return;
3190 illegal_op:
3191 gen_illegal_opcode(s);
3192 return;
3193 unknown_op:
3194 /*
3195 * Similarly, except that the assumption here is that we don't decode
3196 * the instruction at all -- either a missing opcode, an unimplemented
3197 * feature, or just a bogus instruction stream.
3198 */
3199 gen_illegal_opcode(s);
3200 dump_unknown_opcode(env, s);
3201 }