translate.c 271.4 KB
Newer Older
B
bellard 已提交
1 2
/*
 *  i386 translation
3
 *
B
bellard 已提交
4 5 6 7 8 9 10 11 12 13 14 15 16
 *  Copyright (c) 2003 Fabrice Bellard
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
17
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
B
bellard 已提交
18 19 20 21 22 23 24
 */
#include <stdarg.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <inttypes.h>

25
#include "qemu/host-utils.h"
B
bellard 已提交
26
#include "cpu.h"
27
#include "disas/disas.h"
B
bellard 已提交
28
#include "tcg-op.h"
P
Paolo Bonzini 已提交
29
#include "exec/cpu_ldst.h"
B
bellard 已提交
30

31 32
#include "exec/helper-proto.h"
#include "exec/helper-gen.h"
P
pbrook 已提交
33

34 35 36
#include "trace-tcg.h"


B
bellard 已提交
37 38 39 40 41
#define PREFIX_REPZ   0x01
#define PREFIX_REPNZ  0x02
#define PREFIX_LOCK   0x04
#define PREFIX_DATA   0x08
#define PREFIX_ADR    0x10
42
#define PREFIX_VEX    0x20
B
bellard 已提交
43

B
bellard 已提交
44 45 46 47 48 49 50 51 52 53
#ifdef TARGET_X86_64
#define CODE64(s) ((s)->code64)
#define REX_X(s) ((s)->rex_x)
#define REX_B(s) ((s)->rex_b)
#else
#define CODE64(s) 0
#define REX_X(s) 0
#define REX_B(s) 0
#endif

54 55 56 57 58 59 60 61
#ifdef TARGET_X86_64
# define ctztl  ctz64
# define clztl  clz64
#else
# define ctztl  ctz32
# define clztl  clz32
#endif

B
bellard 已提交
62 63 64
//#define MACRO_TEST   1

/* global register indexes */
P
pbrook 已提交
65
static TCGv_ptr cpu_env;
66
static TCGv cpu_A0;
67
static TCGv cpu_cc_dst, cpu_cc_src, cpu_cc_src2, cpu_cc_srcT;
P
pbrook 已提交
68
static TCGv_i32 cpu_cc_op;
69
static TCGv cpu_regs[CPU_NB_REGS];
70
/* local temps */
P
Paolo Bonzini 已提交
71
static TCGv cpu_T[2];
B
bellard 已提交
72
/* local register indexes (only used inside old micro ops) */
P
pbrook 已提交
73 74 75 76
static TCGv cpu_tmp0, cpu_tmp4;
static TCGv_ptr cpu_ptr0, cpu_ptr1;
static TCGv_i32 cpu_tmp2_i32, cpu_tmp3_i32;
static TCGv_i64 cpu_tmp1_i64;
B
bellard 已提交
77

78
#include "exec/gen-icount.h"
P
pbrook 已提交
79

B
bellard 已提交
80 81
#ifdef TARGET_X86_64
static int x86_64_hregs;
B
bellard 已提交
82 83
#endif

B
bellard 已提交
84 85 86 87
typedef struct DisasContext {
    /* current insn context */
    int override; /* -1 if no override */
    int prefix;
88
    TCGMemOp aflag;
89
    TCGMemOp dflag;
B
bellard 已提交
90
    target_ulong pc; /* pc = eip + cs_base */
B
bellard 已提交
91 92 93
    int is_jmp; /* 1 = means jump (stop translation), 2 means CPU
                   static state change (stop translation) */
    /* current block context */
B
bellard 已提交
94
    target_ulong cs_base; /* base of CS segment */
B
bellard 已提交
95 96
    int pe;     /* protected mode */
    int code32; /* 32 bit code segment */
B
bellard 已提交
97 98 99 100 101
#ifdef TARGET_X86_64
    int lma;    /* long mode active */
    int code64; /* 64 bit code segment */
    int rex_x, rex_b;
#endif
102 103
    int vex_l;  /* vex vector length */
    int vex_v;  /* vex vvvv register, without 1's compliment.  */
B
bellard 已提交
104
    int ss32;   /* 32 bit stack segment */
105
    CCOp cc_op;  /* current CC operation */
106
    bool cc_op_dirty;
B
bellard 已提交
107 108 109 110 111 112
    int addseg; /* non zero if either DS/ES/SS have a non zero base */
    int f_st;   /* currently unused */
    int vm86;   /* vm86 mode */
    int cpl;
    int iopl;
    int tf;     /* TF cpu flag */
113
    int singlestep_enabled; /* "hardware" single step enabled */
B
bellard 已提交
114
    int jmp_opt; /* use direct block chaining for direct jumps */
115
    int repz_opt; /* optimize jumps within repz instructions */
B
bellard 已提交
116
    int mem_index; /* select memory access functions */
117
    uint64_t flags; /* all execution flags */
B
bellard 已提交
118 119
    struct TranslationBlock *tb;
    int popl_esp_hack; /* for correct popl with esp base handling */
B
bellard 已提交
120 121
    int rip_offset; /* only used in x86_64, but left for simplicity */
    int cpuid_features;
B
bellard 已提交
122
    int cpuid_ext_features;
123
    int cpuid_ext2_features;
B
bellard 已提交
124
    int cpuid_ext3_features;
H
H. Peter Anvin 已提交
125
    int cpuid_7_0_ebx_features;
B
bellard 已提交
126 127 128
} DisasContext;

static void gen_eob(DisasContext *s);
B
bellard 已提交
129 130
static void gen_jmp(DisasContext *s, target_ulong eip);
static void gen_jmp_tb(DisasContext *s, target_ulong eip, int tb_num);
131
static void gen_op(DisasContext *s1, int op, TCGMemOp ot, int d);
B
bellard 已提交
132 133 134

/* i386 arith/logic operations */
enum {
135 136 137
    OP_ADDL,
    OP_ORL,
    OP_ADCL,
B
bellard 已提交
138
    OP_SBBL,
139 140 141
    OP_ANDL,
    OP_SUBL,
    OP_XORL,
B
bellard 已提交
142 143 144 145 146
    OP_CMPL,
};

/* i386 shift ops */
enum {
147 148 149 150 151 152
    OP_ROL,
    OP_ROR,
    OP_RCL,
    OP_RCR,
    OP_SHL,
    OP_SHR,
B
bellard 已提交
153 154 155 156
    OP_SHL1, /* undocumented */
    OP_SAR = 7,
};

157 158 159 160 161 162 163 164 165 166 167
enum {
    JCC_O,
    JCC_B,
    JCC_Z,
    JCC_BE,
    JCC_S,
    JCC_P,
    JCC_L,
    JCC_LE,
};

B
bellard 已提交
168 169 170 171 172 173 174 175 176 177
enum {
    /* I386 int registers */
    OR_EAX,   /* MUST be even numbered */
    OR_ECX,
    OR_EDX,
    OR_EBX,
    OR_ESP,
    OR_EBP,
    OR_ESI,
    OR_EDI,
B
bellard 已提交
178 179

    OR_TMP0 = 16,    /* temporary operand register */
B
bellard 已提交
180 181 182 183
    OR_TMP1,
    OR_A0, /* temporary register used when doing address evaluation */
};

184
enum {
185 186
    USES_CC_DST  = 1,
    USES_CC_SRC  = 2,
187 188
    USES_CC_SRC2 = 4,
    USES_CC_SRCT = 8,
189 190 191 192
};

/* Bit set if the global variable is live after setting CC_OP to X.  */
static const uint8_t cc_op_live[CC_OP_NB] = {
193
    [CC_OP_DYNAMIC] = USES_CC_DST | USES_CC_SRC | USES_CC_SRC2,
194 195 196
    [CC_OP_EFLAGS] = USES_CC_SRC,
    [CC_OP_MULB ... CC_OP_MULQ] = USES_CC_DST | USES_CC_SRC,
    [CC_OP_ADDB ... CC_OP_ADDQ] = USES_CC_DST | USES_CC_SRC,
197
    [CC_OP_ADCB ... CC_OP_ADCQ] = USES_CC_DST | USES_CC_SRC | USES_CC_SRC2,
198
    [CC_OP_SUBB ... CC_OP_SUBQ] = USES_CC_DST | USES_CC_SRC | USES_CC_SRCT,
199
    [CC_OP_SBBB ... CC_OP_SBBQ] = USES_CC_DST | USES_CC_SRC | USES_CC_SRC2,
200 201 202 203 204
    [CC_OP_LOGICB ... CC_OP_LOGICQ] = USES_CC_DST,
    [CC_OP_INCB ... CC_OP_INCQ] = USES_CC_DST | USES_CC_SRC,
    [CC_OP_DECB ... CC_OP_DECQ] = USES_CC_DST | USES_CC_SRC,
    [CC_OP_SHLB ... CC_OP_SHLQ] = USES_CC_DST | USES_CC_SRC,
    [CC_OP_SARB ... CC_OP_SARQ] = USES_CC_DST | USES_CC_SRC,
205
    [CC_OP_BMILGB ... CC_OP_BMILGQ] = USES_CC_DST | USES_CC_SRC,
206 207 208
    [CC_OP_ADCX] = USES_CC_DST | USES_CC_SRC,
    [CC_OP_ADOX] = USES_CC_SRC | USES_CC_SRC2,
    [CC_OP_ADCOX] = USES_CC_DST | USES_CC_SRC | USES_CC_SRC2,
R
Richard Henderson 已提交
209
    [CC_OP_CLR] = 0,
210 211
};

212
static void set_cc_op(DisasContext *s, CCOp op)
213
{
214 215 216 217 218 219 220 221 222 223
    int dead;

    if (s->cc_op == op) {
        return;
    }

    /* Discard CC computation that will no longer be used.  */
    dead = cc_op_live[s->cc_op] & ~cc_op_live[op];
    if (dead & USES_CC_DST) {
        tcg_gen_discard_tl(cpu_cc_dst);
224
    }
225 226 227
    if (dead & USES_CC_SRC) {
        tcg_gen_discard_tl(cpu_cc_src);
    }
228 229 230
    if (dead & USES_CC_SRC2) {
        tcg_gen_discard_tl(cpu_cc_src2);
    }
231 232 233
    if (dead & USES_CC_SRCT) {
        tcg_gen_discard_tl(cpu_cc_srcT);
    }
234

235 236 237 238 239 240 241 242 243 244 245
    if (op == CC_OP_DYNAMIC) {
        /* The DYNAMIC setting is translator only, and should never be
           stored.  Thus we always consider it clean.  */
        s->cc_op_dirty = false;
    } else {
        /* Discard any computed CC_OP value (see shifts).  */
        if (s->cc_op == CC_OP_DYNAMIC) {
            tcg_gen_discard_i32(cpu_cc_op);
        }
        s->cc_op_dirty = true;
    }
246
    s->cc_op = op;
247 248 249 250 251
}

static void gen_update_cc_op(DisasContext *s)
{
    if (s->cc_op_dirty) {
252
        tcg_gen_movi_i32(cpu_cc_op, s->cc_op);
253 254
        s->cc_op_dirty = false;
    }
255 256
}

B
bellard 已提交
257 258 259 260 261 262 263 264 265 266
#ifdef TARGET_X86_64

#define NB_OP_SIZES 4

#else /* !TARGET_X86_64 */

#define NB_OP_SIZES 3

#endif /* !TARGET_X86_64 */

267
#if defined(HOST_WORDS_BIGENDIAN)
B
bellard 已提交
268 269 270 271 272
#define REG_B_OFFSET (sizeof(target_ulong) - 1)
#define REG_H_OFFSET (sizeof(target_ulong) - 2)
#define REG_W_OFFSET (sizeof(target_ulong) - 2)
#define REG_L_OFFSET (sizeof(target_ulong) - 4)
#define REG_LH_OFFSET (sizeof(target_ulong) - 8)
B
bellard 已提交
273
#else
B
bellard 已提交
274 275 276 277 278
#define REG_B_OFFSET 0
#define REG_H_OFFSET 1
#define REG_W_OFFSET 0
#define REG_L_OFFSET 0
#define REG_LH_OFFSET 4
B
bellard 已提交
279
#endif
B
bellard 已提交
280

281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299
/* In instruction encodings for byte register accesses the
 * register number usually indicates "low 8 bits of register N";
 * however there are some special cases where N 4..7 indicates
 * [AH, CH, DH, BH], ie "bits 15..8 of register N-4". Return
 * true for this special case, false otherwise.
 */
static inline bool byte_reg_is_xH(int reg)
{
    if (reg < 4) {
        return false;
    }
#ifdef TARGET_X86_64
    if (reg >= 8 || x86_64_hregs) {
        return false;
    }
#endif
    return true;
}

300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333
/* Select the size of a push/pop operation.  */
static inline TCGMemOp mo_pushpop(DisasContext *s, TCGMemOp ot)
{
    if (CODE64(s)) {
        return ot == MO_16 ? MO_16 : MO_64;
    } else {
        return ot;
    }
}

/* Select only size 64 else 32.  Used for SSE operand sizes.  */
static inline TCGMemOp mo_64_32(TCGMemOp ot)
{
#ifdef TARGET_X86_64
    return ot == MO_64 ? MO_64 : MO_32;
#else
    return MO_32;
#endif
}

/* Select size 8 if lsb of B is clear, else OT.  Used for decoding
   byte vs word opcodes.  */
static inline TCGMemOp mo_b_d(int b, TCGMemOp ot)
{
    return b & 1 ? ot : MO_8;
}

/* Select size 8 if lsb of B is clear, else OT capped at 32.
   Used for decoding operand size of port opcodes.  */
static inline TCGMemOp mo_b_d32(int b, TCGMemOp ot)
{
    return b & 1 ? (ot == MO_16 ? MO_16 : MO_32) : MO_8;
}

334
static void gen_op_mov_reg_v(TCGMemOp ot, int reg, TCGv t0)
B
bellard 已提交
335 336
{
    switch(ot) {
337
    case MO_8:
338
        if (!byte_reg_is_xH(reg)) {
339
            tcg_gen_deposit_tl(cpu_regs[reg], cpu_regs[reg], t0, 0, 8);
B
bellard 已提交
340
        } else {
341
            tcg_gen_deposit_tl(cpu_regs[reg - 4], cpu_regs[reg - 4], t0, 8, 8);
B
bellard 已提交
342 343
        }
        break;
344
    case MO_16:
345
        tcg_gen_deposit_tl(cpu_regs[reg], cpu_regs[reg], t0, 0, 16);
B
bellard 已提交
346
        break;
347
    case MO_32:
348 349 350
        /* For x86_64, this sets the higher half of register to zero.
           For i386, this is equivalent to a mov. */
        tcg_gen_ext32u_tl(cpu_regs[reg], t0);
B
bellard 已提交
351
        break;
352
#ifdef TARGET_X86_64
353
    case MO_64:
354
        tcg_gen_mov_tl(cpu_regs[reg], t0);
B
bellard 已提交
355
        break;
B
bellard 已提交
356
#endif
357 358
    default:
        tcg_abort();
B
bellard 已提交
359 360
    }
}
B
bellard 已提交
361

362
static inline void gen_op_mov_v_reg(TCGMemOp ot, TCGv t0, int reg)
B
bellard 已提交
363
{
364
    if (ot == MO_8 && byte_reg_is_xH(reg)) {
365 366 367
        tcg_gen_shri_tl(t0, cpu_regs[reg - 4], 8);
        tcg_gen_ext8u_tl(t0, t0);
    } else {
368
        tcg_gen_mov_tl(t0, cpu_regs[reg]);
B
bellard 已提交
369 370 371 372 373
    }
}

static inline void gen_op_movl_A0_reg(int reg)
{
374
    tcg_gen_mov_tl(cpu_A0, cpu_regs[reg]);
B
bellard 已提交
375 376 377 378 379
}

static inline void gen_op_addl_A0_im(int32_t val)
{
    tcg_gen_addi_tl(cpu_A0, cpu_A0, val);
B
bellard 已提交
380
#ifdef TARGET_X86_64
B
bellard 已提交
381
    tcg_gen_andi_tl(cpu_A0, cpu_A0, 0xffffffff);
B
bellard 已提交
382
#endif
B
bellard 已提交
383
}
B
bellard 已提交
384

B
bellard 已提交
385
#ifdef TARGET_X86_64
B
bellard 已提交
386 387 388 389
static inline void gen_op_addq_A0_im(int64_t val)
{
    tcg_gen_addi_tl(cpu_A0, cpu_A0, val);
}
B
bellard 已提交
390
#endif
B
bellard 已提交
391 392 393 394 395 396 397 398 399 400
    
static void gen_add_A0_im(DisasContext *s, int val)
{
#ifdef TARGET_X86_64
    if (CODE64(s))
        gen_op_addq_A0_im(val);
    else
#endif
        gen_op_addl_A0_im(val);
}
B
bellard 已提交
401

402
static inline void gen_op_jmp_v(TCGv dest)
B
bellard 已提交
403
{
404
    tcg_gen_st_tl(dest, cpu_env, offsetof(CPUX86State, eip));
B
bellard 已提交
405 406
}

407
static inline void gen_op_add_reg_im(TCGMemOp size, int reg, int32_t val)
B
bellard 已提交
408
{
409 410
    tcg_gen_addi_tl(cpu_tmp0, cpu_regs[reg], val);
    gen_op_mov_reg_v(size, reg, cpu_tmp0);
B
bellard 已提交
411 412
}

413
static inline void gen_op_add_reg_T0(TCGMemOp size, int reg)
B
bellard 已提交
414
{
415 416
    tcg_gen_add_tl(cpu_tmp0, cpu_regs[reg], cpu_T[0]);
    gen_op_mov_reg_v(size, reg, cpu_tmp0);
417
}
B
bellard 已提交
418 419 420

static inline void gen_op_addl_A0_reg_sN(int shift, int reg)
{
421 422
    tcg_gen_mov_tl(cpu_tmp0, cpu_regs[reg]);
    if (shift != 0)
B
bellard 已提交
423 424
        tcg_gen_shli_tl(cpu_tmp0, cpu_tmp0, shift);
    tcg_gen_add_tl(cpu_A0, cpu_A0, cpu_tmp0);
425 426 427
    /* For x86_64, this sets the higher half of register to zero.
       For i386, this is equivalent to a nop. */
    tcg_gen_ext32u_tl(cpu_A0, cpu_A0);
B
bellard 已提交
428
}
B
bellard 已提交
429

B
bellard 已提交
430 431
static inline void gen_op_movl_A0_seg(int reg)
{
432
    tcg_gen_ld32u_tl(cpu_A0, cpu_env, offsetof(CPUX86State, segs[reg].base) + REG_L_OFFSET);
B
bellard 已提交
433
}
B
bellard 已提交
434

435
static inline void gen_op_addl_A0_seg(DisasContext *s, int reg)
B
bellard 已提交
436
{
437
    tcg_gen_ld_tl(cpu_tmp0, cpu_env, offsetof(CPUX86State, segs[reg].base));
B
bellard 已提交
438
#ifdef TARGET_X86_64
439 440 441 442 443 444 445 446 447
    if (CODE64(s)) {
        tcg_gen_andi_tl(cpu_A0, cpu_A0, 0xffffffff);
        tcg_gen_add_tl(cpu_A0, cpu_A0, cpu_tmp0);
    } else {
        tcg_gen_add_tl(cpu_A0, cpu_A0, cpu_tmp0);
        tcg_gen_andi_tl(cpu_A0, cpu_A0, 0xffffffff);
    }
#else
    tcg_gen_add_tl(cpu_A0, cpu_A0, cpu_tmp0);
B
bellard 已提交
448 449
#endif
}
B
bellard 已提交
450

B
bellard 已提交
451
#ifdef TARGET_X86_64
B
bellard 已提交
452 453
static inline void gen_op_movq_A0_seg(int reg)
{
454
    tcg_gen_ld_tl(cpu_A0, cpu_env, offsetof(CPUX86State, segs[reg].base));
B
bellard 已提交
455
}
B
bellard 已提交
456

B
bellard 已提交
457 458
static inline void gen_op_addq_A0_seg(int reg)
{
459
    tcg_gen_ld_tl(cpu_tmp0, cpu_env, offsetof(CPUX86State, segs[reg].base));
B
bellard 已提交
460 461 462 463 464
    tcg_gen_add_tl(cpu_A0, cpu_A0, cpu_tmp0);
}

static inline void gen_op_movq_A0_reg(int reg)
{
465
    tcg_gen_mov_tl(cpu_A0, cpu_regs[reg]);
B
bellard 已提交
466 467 468 469
}

static inline void gen_op_addq_A0_reg_sN(int shift, int reg)
{
470 471
    tcg_gen_mov_tl(cpu_tmp0, cpu_regs[reg]);
    if (shift != 0)
B
bellard 已提交
472 473 474
        tcg_gen_shli_tl(cpu_tmp0, cpu_tmp0, shift);
    tcg_gen_add_tl(cpu_A0, cpu_A0, cpu_tmp0);
}
B
bellard 已提交
475 476
#endif

477
static inline void gen_op_ld_v(DisasContext *s, int idx, TCGv t0, TCGv a0)
B
bellard 已提交
478
{
479
    tcg_gen_qemu_ld_tl(t0, a0, s->mem_index, idx | MO_LE);
B
bellard 已提交
480
}
B
bellard 已提交
481

482
static inline void gen_op_st_v(DisasContext *s, int idx, TCGv t0, TCGv a0)
B
bellard 已提交
483
{
484
    tcg_gen_qemu_st_tl(t0, a0, s->mem_index, idx | MO_LE);
B
bellard 已提交
485
}
486

487 488 489
static inline void gen_op_st_rm_T0_A0(DisasContext *s, int idx, int d)
{
    if (d == OR_TMP0) {
490
        gen_op_st_v(s, idx, cpu_T[0], cpu_A0);
491
    } else {
492
        gen_op_mov_reg_v(idx, d, cpu_T[0]);
493 494 495
    }
}

B
bellard 已提交
496 497
static inline void gen_jmp_im(target_ulong pc)
{
B
bellard 已提交
498
    tcg_gen_movi_tl(cpu_tmp0, pc);
499
    gen_op_jmp_v(cpu_tmp0);
B
bellard 已提交
500 501
}

B
bellard 已提交
502 503 504 505 506
static inline void gen_string_movl_A0_ESI(DisasContext *s)
{
    int override;

    override = s->override;
507
    switch (s->aflag) {
B
bellard 已提交
508
#ifdef TARGET_X86_64
509
    case MO_64:
B
bellard 已提交
510
        if (override >= 0) {
B
bellard 已提交
511 512
            gen_op_movq_A0_seg(override);
            gen_op_addq_A0_reg_sN(0, R_ESI);
B
bellard 已提交
513
        } else {
B
bellard 已提交
514
            gen_op_movq_A0_reg(R_ESI);
B
bellard 已提交
515
        }
516
        break;
B
bellard 已提交
517
#endif
518
    case MO_32:
B
bellard 已提交
519 520 521 522
        /* 32 bit address */
        if (s->addseg && override < 0)
            override = R_DS;
        if (override >= 0) {
B
bellard 已提交
523 524
            gen_op_movl_A0_seg(override);
            gen_op_addl_A0_reg_sN(0, R_ESI);
B
bellard 已提交
525
        } else {
B
bellard 已提交
526
            gen_op_movl_A0_reg(R_ESI);
B
bellard 已提交
527
        }
528 529
        break;
    case MO_16:
B
bellard 已提交
530 531 532
        /* 16 address, always override */
        if (override < 0)
            override = R_DS;
533
        tcg_gen_ext16u_tl(cpu_A0, cpu_regs[R_ESI]);
534
        gen_op_addl_A0_seg(s, override);
535 536 537
        break;
    default:
        tcg_abort();
B
bellard 已提交
538 539 540 541 542
    }
}

static inline void gen_string_movl_A0_EDI(DisasContext *s)
{
543
    switch (s->aflag) {
B
bellard 已提交
544
#ifdef TARGET_X86_64
545
    case MO_64:
B
bellard 已提交
546
        gen_op_movq_A0_reg(R_EDI);
547
        break;
B
bellard 已提交
548
#endif
549
    case MO_32:
B
bellard 已提交
550
        if (s->addseg) {
B
bellard 已提交
551 552
            gen_op_movl_A0_seg(R_ES);
            gen_op_addl_A0_reg_sN(0, R_EDI);
B
bellard 已提交
553
        } else {
B
bellard 已提交
554
            gen_op_movl_A0_reg(R_EDI);
B
bellard 已提交
555
        }
556 557
        break;
    case MO_16:
558
        tcg_gen_ext16u_tl(cpu_A0, cpu_regs[R_EDI]);
559
        gen_op_addl_A0_seg(s, R_ES);
560 561 562
        break;
    default:
        tcg_abort();
B
bellard 已提交
563 564 565
    }
}

566
static inline void gen_op_movl_T0_Dshift(TCGMemOp ot)
567
{
568
    tcg_gen_ld32s_tl(cpu_T[0], cpu_env, offsetof(CPUX86State, df));
569
    tcg_gen_shli_tl(cpu_T[0], cpu_T[0], ot);
B
bellard 已提交
570 571
};

572
static TCGv gen_ext_tl(TCGv dst, TCGv src, TCGMemOp size, bool sign)
573
{
574
    switch (size) {
575
    case MO_8:
576 577 578 579 580 581
        if (sign) {
            tcg_gen_ext8s_tl(dst, src);
        } else {
            tcg_gen_ext8u_tl(dst, src);
        }
        return dst;
582
    case MO_16:
583 584 585 586 587 588 589
        if (sign) {
            tcg_gen_ext16s_tl(dst, src);
        } else {
            tcg_gen_ext16u_tl(dst, src);
        }
        return dst;
#ifdef TARGET_X86_64
590
    case MO_32:
591 592 593 594 595 596 597
        if (sign) {
            tcg_gen_ext32s_tl(dst, src);
        } else {
            tcg_gen_ext32u_tl(dst, src);
        }
        return dst;
#endif
598
    default:
599
        return src;
600 601
    }
}
602

603
static void gen_extu(TCGMemOp ot, TCGv reg)
604 605 606 607
{
    gen_ext_tl(reg, reg, ot, false);
}

608
static void gen_exts(TCGMemOp ot, TCGv reg)
609
{
610
    gen_ext_tl(reg, reg, ot, true);
611
}
B
bellard 已提交
612

613
static inline void gen_op_jnz_ecx(TCGMemOp size, TCGLabel *label1)
614
{
615
    tcg_gen_mov_tl(cpu_tmp0, cpu_regs[R_ECX]);
616
    gen_extu(size, cpu_tmp0);
P
pbrook 已提交
617
    tcg_gen_brcondi_tl(TCG_COND_NE, cpu_tmp0, 0, label1);
618 619
}

620
static inline void gen_op_jz_ecx(TCGMemOp size, TCGLabel *label1)
621
{
622
    tcg_gen_mov_tl(cpu_tmp0, cpu_regs[R_ECX]);
623
    gen_extu(size, cpu_tmp0);
P
pbrook 已提交
624
    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_tmp0, 0, label1);
625
}
B
bellard 已提交
626

627
static void gen_helper_in_func(TCGMemOp ot, TCGv v, TCGv_i32 n)
P
pbrook 已提交
628 629
{
    switch (ot) {
630
    case MO_8:
631
        gen_helper_inb(v, cpu_env, n);
632
        break;
633
    case MO_16:
634
        gen_helper_inw(v, cpu_env, n);
635
        break;
636
    case MO_32:
637
        gen_helper_inl(v, cpu_env, n);
638
        break;
639 640
    default:
        tcg_abort();
P
pbrook 已提交
641 642
    }
}
B
bellard 已提交
643

644
static void gen_helper_out_func(TCGMemOp ot, TCGv_i32 v, TCGv_i32 n)
P
pbrook 已提交
645 646
{
    switch (ot) {
647
    case MO_8:
648
        gen_helper_outb(cpu_env, v, n);
649
        break;
650
    case MO_16:
651
        gen_helper_outw(cpu_env, v, n);
652
        break;
653
    case MO_32:
654
        gen_helper_outl(cpu_env, v, n);
655
        break;
656 657
    default:
        tcg_abort();
P
pbrook 已提交
658 659
    }
}
660

661
static void gen_check_io(DisasContext *s, TCGMemOp ot, target_ulong cur_eip,
662
                         uint32_t svm_flags)
663
{
664 665
    target_ulong next_eip;

666
    if (s->pe && (s->cpl > s->iopl || s->vm86)) {
667
        tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
P
pbrook 已提交
668
        switch (ot) {
669
        case MO_8:
B
Blue Swirl 已提交
670 671
            gen_helper_check_iob(cpu_env, cpu_tmp2_i32);
            break;
672
        case MO_16:
B
Blue Swirl 已提交
673 674
            gen_helper_check_iow(cpu_env, cpu_tmp2_i32);
            break;
675
        case MO_32:
B
Blue Swirl 已提交
676 677
            gen_helper_check_iol(cpu_env, cpu_tmp2_i32);
            break;
678 679
        default:
            tcg_abort();
P
pbrook 已提交
680
        }
681
    }
B
bellard 已提交
682
    if(s->flags & HF_SVMI_MASK) {
683 684
        gen_update_cc_op(s);
        gen_jmp_im(cur_eip);
685 686
        svm_flags |= (1 << (4 + ot));
        next_eip = s->pc - s->cs_base;
687
        tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
B
Blue Swirl 已提交
688 689
        gen_helper_svm_check_io(cpu_env, cpu_tmp2_i32,
                                tcg_const_i32(svm_flags),
P
pbrook 已提交
690
                                tcg_const_i32(next_eip - cur_eip));
691 692 693
    }
}

694
static inline void gen_movs(DisasContext *s, TCGMemOp ot)
B
bellard 已提交
695 696
{
    gen_string_movl_A0_ESI(s);
697
    gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
B
bellard 已提交
698
    gen_string_movl_A0_EDI(s);
699
    gen_op_st_v(s, ot, cpu_T[0], cpu_A0);
700
    gen_op_movl_T0_Dshift(ot);
701 702
    gen_op_add_reg_T0(s->aflag, R_ESI);
    gen_op_add_reg_T0(s->aflag, R_EDI);
B
bellard 已提交
703 704
}

705 706 707 708 709 710 711 712 713 714 715
static void gen_op_update1_cc(void)
{
    tcg_gen_mov_tl(cpu_cc_dst, cpu_T[0]);
}

static void gen_op_update2_cc(void)
{
    tcg_gen_mov_tl(cpu_cc_src, cpu_T[1]);
    tcg_gen_mov_tl(cpu_cc_dst, cpu_T[0]);
}

716 717 718 719 720 721 722
static void gen_op_update3_cc(TCGv reg)
{
    tcg_gen_mov_tl(cpu_cc_src2, reg);
    tcg_gen_mov_tl(cpu_cc_src, cpu_T[1]);
    tcg_gen_mov_tl(cpu_cc_dst, cpu_T[0]);
}

723 724 725 726 727 728 729 730
static inline void gen_op_testl_T0_T1_cc(void)
{
    tcg_gen_and_tl(cpu_cc_dst, cpu_T[0], cpu_T[1]);
}

static void gen_op_update_neg_cc(void)
{
    tcg_gen_mov_tl(cpu_cc_dst, cpu_T[0]);
731 732
    tcg_gen_neg_tl(cpu_cc_src, cpu_T[0]);
    tcg_gen_movi_tl(cpu_cc_srcT, 0);
733 734
}

735 736
/* compute all eflags to cc_src */
static void gen_compute_eflags(DisasContext *s)
737
{
738
    TCGv zero, dst, src1, src2;
739 740
    int live, dead;

741 742 743
    if (s->cc_op == CC_OP_EFLAGS) {
        return;
    }
R
Richard Henderson 已提交
744
    if (s->cc_op == CC_OP_CLR) {
745
        tcg_gen_movi_tl(cpu_cc_src, CC_Z | CC_P);
R
Richard Henderson 已提交
746 747 748
        set_cc_op(s, CC_OP_EFLAGS);
        return;
    }
749 750 751 752

    TCGV_UNUSED(zero);
    dst = cpu_cc_dst;
    src1 = cpu_cc_src;
753
    src2 = cpu_cc_src2;
754 755 756

    /* Take care to not read values that are not live.  */
    live = cc_op_live[s->cc_op] & ~USES_CC_SRCT;
757
    dead = live ^ (USES_CC_DST | USES_CC_SRC | USES_CC_SRC2);
758 759 760 761 762 763 764 765
    if (dead) {
        zero = tcg_const_tl(0);
        if (dead & USES_CC_DST) {
            dst = zero;
        }
        if (dead & USES_CC_SRC) {
            src1 = zero;
        }
766 767 768
        if (dead & USES_CC_SRC2) {
            src2 = zero;
        }
769 770
    }

771
    gen_update_cc_op(s);
772
    gen_helper_cc_compute_all(cpu_cc_src, dst, src1, src2, cpu_cc_op);
773
    set_cc_op(s, CC_OP_EFLAGS);
774 775 776 777

    if (dead) {
        tcg_temp_free(zero);
    }
778 779
}

780 781 782 783 784 785 786 787 788 789
typedef struct CCPrepare {
    TCGCond cond;
    TCGv reg;
    TCGv reg2;
    target_ulong imm;
    target_ulong mask;
    bool use_reg2;
    bool no_setcond;
} CCPrepare;

790
/* compute eflags.C to reg */
791
static CCPrepare gen_prepare_eflags_c(DisasContext *s, TCGv reg)
792 793
{
    TCGv t0, t1;
794
    int size, shift;
795 796 797

    switch (s->cc_op) {
    case CC_OP_SUBB ... CC_OP_SUBQ:
798
        /* (DATA_TYPE)CC_SRCT < (DATA_TYPE)CC_SRC */
799 800 801 802
        size = s->cc_op - CC_OP_SUBB;
        t1 = gen_ext_tl(cpu_tmp0, cpu_cc_src, size, false);
        /* If no temporary was used, be careful not to alias t1 and t0.  */
        t0 = TCGV_EQUAL(t1, cpu_cc_src) ? cpu_tmp0 : reg;
803
        tcg_gen_mov_tl(t0, cpu_cc_srcT);
804 805 806 807 808 809 810 811 812
        gen_extu(size, t0);
        goto add_sub;

    case CC_OP_ADDB ... CC_OP_ADDQ:
        /* (DATA_TYPE)CC_DST < (DATA_TYPE)CC_SRC */
        size = s->cc_op - CC_OP_ADDB;
        t1 = gen_ext_tl(cpu_tmp0, cpu_cc_src, size, false);
        t0 = gen_ext_tl(reg, cpu_cc_dst, size, false);
    add_sub:
813 814
        return (CCPrepare) { .cond = TCG_COND_LTU, .reg = t0,
                             .reg2 = t1, .mask = -1, .use_reg2 = true };
815 816

    case CC_OP_LOGICB ... CC_OP_LOGICQ:
R
Richard Henderson 已提交
817
    case CC_OP_CLR:
818
        return (CCPrepare) { .cond = TCG_COND_NEVER, .mask = -1 };
819 820 821

    case CC_OP_INCB ... CC_OP_INCQ:
    case CC_OP_DECB ... CC_OP_DECQ:
822 823
        return (CCPrepare) { .cond = TCG_COND_NE, .reg = cpu_cc_src,
                             .mask = -1, .no_setcond = true };
824 825 826 827

    case CC_OP_SHLB ... CC_OP_SHLQ:
        /* (CC_SRC >> (DATA_BITS - 1)) & 1 */
        size = s->cc_op - CC_OP_SHLB;
828 829 830
        shift = (8 << size) - 1;
        return (CCPrepare) { .cond = TCG_COND_NE, .reg = cpu_cc_src,
                             .mask = (target_ulong)1 << shift };
831 832

    case CC_OP_MULB ... CC_OP_MULQ:
833 834
        return (CCPrepare) { .cond = TCG_COND_NE,
                             .reg = cpu_cc_src, .mask = -1 };
835

836 837 838 839 840
    case CC_OP_BMILGB ... CC_OP_BMILGQ:
        size = s->cc_op - CC_OP_BMILGB;
        t0 = gen_ext_tl(reg, cpu_cc_src, size, false);
        return (CCPrepare) { .cond = TCG_COND_EQ, .reg = t0, .mask = -1 };

841 842 843 844 845
    case CC_OP_ADCX:
    case CC_OP_ADCOX:
        return (CCPrepare) { .cond = TCG_COND_NE, .reg = cpu_cc_dst,
                             .mask = -1, .no_setcond = true };

846 847 848
    case CC_OP_EFLAGS:
    case CC_OP_SARB ... CC_OP_SARQ:
        /* CC_SRC & 1 */
849 850
        return (CCPrepare) { .cond = TCG_COND_NE,
                             .reg = cpu_cc_src, .mask = CC_C };
851 852 853 854 855

    default:
       /* The need to compute only C from CC_OP_DYNAMIC is important
          in efficiently implementing e.g. INC at the start of a TB.  */
       gen_update_cc_op(s);
856 857
       gen_helper_cc_compute_c(reg, cpu_cc_dst, cpu_cc_src,
                               cpu_cc_src2, cpu_cc_op);
858 859
       return (CCPrepare) { .cond = TCG_COND_NE, .reg = reg,
                            .mask = -1, .no_setcond = true };
860 861 862
    }
}

863
/* compute eflags.P to reg */
864
static CCPrepare gen_prepare_eflags_p(DisasContext *s, TCGv reg)
865
{
866
    gen_compute_eflags(s);
867 868
    return (CCPrepare) { .cond = TCG_COND_NE, .reg = cpu_cc_src,
                         .mask = CC_P };
869 870 871
}

/* compute eflags.S to reg */
872
static CCPrepare gen_prepare_eflags_s(DisasContext *s, TCGv reg)
873
{
874 875 876 877 878
    switch (s->cc_op) {
    case CC_OP_DYNAMIC:
        gen_compute_eflags(s);
        /* FALLTHRU */
    case CC_OP_EFLAGS:
879 880 881
    case CC_OP_ADCX:
    case CC_OP_ADOX:
    case CC_OP_ADCOX:
882 883
        return (CCPrepare) { .cond = TCG_COND_NE, .reg = cpu_cc_src,
                             .mask = CC_S };
R
Richard Henderson 已提交
884 885
    case CC_OP_CLR:
        return (CCPrepare) { .cond = TCG_COND_NEVER, .mask = -1 };
886 887
    default:
        {
888
            TCGMemOp size = (s->cc_op - CC_OP_ADDB) & 3;
889
            TCGv t0 = gen_ext_tl(reg, cpu_cc_dst, size, true);
890
            return (CCPrepare) { .cond = TCG_COND_LT, .reg = t0, .mask = -1 };
891 892
        }
    }
893 894 895
}

/* compute eflags.O to reg */
896
static CCPrepare gen_prepare_eflags_o(DisasContext *s, TCGv reg)
897
{
898 899 900 901 902
    switch (s->cc_op) {
    case CC_OP_ADOX:
    case CC_OP_ADCOX:
        return (CCPrepare) { .cond = TCG_COND_NE, .reg = cpu_cc_src2,
                             .mask = -1, .no_setcond = true };
R
Richard Henderson 已提交
903 904
    case CC_OP_CLR:
        return (CCPrepare) { .cond = TCG_COND_NEVER, .mask = -1 };
905 906 907 908 909
    default:
        gen_compute_eflags(s);
        return (CCPrepare) { .cond = TCG_COND_NE, .reg = cpu_cc_src,
                             .mask = CC_O };
    }
910 911 912
}

/* compute eflags.Z to reg */
913
static CCPrepare gen_prepare_eflags_z(DisasContext *s, TCGv reg)
914
{
915 916 917 918 919
    switch (s->cc_op) {
    case CC_OP_DYNAMIC:
        gen_compute_eflags(s);
        /* FALLTHRU */
    case CC_OP_EFLAGS:
920 921 922
    case CC_OP_ADCX:
    case CC_OP_ADOX:
    case CC_OP_ADCOX:
923 924
        return (CCPrepare) { .cond = TCG_COND_NE, .reg = cpu_cc_src,
                             .mask = CC_Z };
R
Richard Henderson 已提交
925 926
    case CC_OP_CLR:
        return (CCPrepare) { .cond = TCG_COND_ALWAYS, .mask = -1 };
927 928
    default:
        {
929
            TCGMemOp size = (s->cc_op - CC_OP_ADDB) & 3;
930
            TCGv t0 = gen_ext_tl(reg, cpu_cc_dst, size, false);
931
            return (CCPrepare) { .cond = TCG_COND_EQ, .reg = t0, .mask = -1 };
932
        }
933 934 935
    }
}

936 937
/* perform a conditional store into register 'reg' according to jump opcode
   value 'b'. In the fast case, T0 is guaranted not to be used. */
938
static CCPrepare gen_prepare_cc(DisasContext *s, int b, TCGv reg)
939
{
940 941
    int inv, jcc_op, cond;
    TCGMemOp size;
942
    CCPrepare cc;
943 944 945
    TCGv t0;

    inv = b & 1;
946
    jcc_op = (b >> 1) & 7;
947 948

    switch (s->cc_op) {
949 950
    case CC_OP_SUBB ... CC_OP_SUBQ:
        /* We optimize relational operators for the cmp/jcc case.  */
951 952 953
        size = s->cc_op - CC_OP_SUBB;
        switch (jcc_op) {
        case JCC_BE:
954
            tcg_gen_mov_tl(cpu_tmp4, cpu_cc_srcT);
955 956
            gen_extu(size, cpu_tmp4);
            t0 = gen_ext_tl(cpu_tmp0, cpu_cc_src, size, false);
957 958
            cc = (CCPrepare) { .cond = TCG_COND_LEU, .reg = cpu_tmp4,
                               .reg2 = t0, .mask = -1, .use_reg2 = true };
959
            break;
960

961
        case JCC_L:
962
            cond = TCG_COND_LT;
963 964
            goto fast_jcc_l;
        case JCC_LE:
965
            cond = TCG_COND_LE;
966
        fast_jcc_l:
967
            tcg_gen_mov_tl(cpu_tmp4, cpu_cc_srcT);
968 969
            gen_exts(size, cpu_tmp4);
            t0 = gen_ext_tl(cpu_tmp0, cpu_cc_src, size, true);
970 971
            cc = (CCPrepare) { .cond = cond, .reg = cpu_tmp4,
                               .reg2 = t0, .mask = -1, .use_reg2 = true };
972
            break;
973

974
        default:
975
            goto slow_jcc;
976
        }
977
        break;
978

979 980
    default:
    slow_jcc:
981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024
        /* This actually generates good code for JC, JZ and JS.  */
        switch (jcc_op) {
        case JCC_O:
            cc = gen_prepare_eflags_o(s, reg);
            break;
        case JCC_B:
            cc = gen_prepare_eflags_c(s, reg);
            break;
        case JCC_Z:
            cc = gen_prepare_eflags_z(s, reg);
            break;
        case JCC_BE:
            gen_compute_eflags(s);
            cc = (CCPrepare) { .cond = TCG_COND_NE, .reg = cpu_cc_src,
                               .mask = CC_Z | CC_C };
            break;
        case JCC_S:
            cc = gen_prepare_eflags_s(s, reg);
            break;
        case JCC_P:
            cc = gen_prepare_eflags_p(s, reg);
            break;
        case JCC_L:
            gen_compute_eflags(s);
            if (TCGV_EQUAL(reg, cpu_cc_src)) {
                reg = cpu_tmp0;
            }
            tcg_gen_shri_tl(reg, cpu_cc_src, 4); /* CC_O -> CC_S */
            tcg_gen_xor_tl(reg, reg, cpu_cc_src);
            cc = (CCPrepare) { .cond = TCG_COND_NE, .reg = reg,
                               .mask = CC_S };
            break;
        default:
        case JCC_LE:
            gen_compute_eflags(s);
            if (TCGV_EQUAL(reg, cpu_cc_src)) {
                reg = cpu_tmp0;
            }
            tcg_gen_shri_tl(reg, cpu_cc_src, 4); /* CC_O -> CC_S */
            tcg_gen_xor_tl(reg, reg, cpu_cc_src);
            cc = (CCPrepare) { .cond = TCG_COND_NE, .reg = reg,
                               .mask = CC_S | CC_Z };
            break;
        }
1025
        break;
1026
    }
1027 1028 1029 1030 1031

    if (inv) {
        cc.cond = tcg_invert_cond(cc.cond);
    }
    return cc;
1032 1033
}

1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067
static void gen_setcc1(DisasContext *s, int b, TCGv reg)
{
    CCPrepare cc = gen_prepare_cc(s, b, reg);

    if (cc.no_setcond) {
        if (cc.cond == TCG_COND_EQ) {
            tcg_gen_xori_tl(reg, cc.reg, 1);
        } else {
            tcg_gen_mov_tl(reg, cc.reg);
        }
        return;
    }

    if (cc.cond == TCG_COND_NE && !cc.use_reg2 && cc.imm == 0 &&
        cc.mask != 0 && (cc.mask & (cc.mask - 1)) == 0) {
        tcg_gen_shri_tl(reg, cc.reg, ctztl(cc.mask));
        tcg_gen_andi_tl(reg, reg, 1);
        return;
    }
    if (cc.mask != -1) {
        tcg_gen_andi_tl(reg, cc.reg, cc.mask);
        cc.reg = reg;
    }
    if (cc.use_reg2) {
        tcg_gen_setcond_tl(cc.cond, reg, cc.reg, cc.reg2);
    } else {
        tcg_gen_setcondi_tl(cc.cond, reg, cc.reg, cc.imm);
    }
}

static inline void gen_compute_eflags_c(DisasContext *s, TCGv reg)
{
    gen_setcc1(s, JCC_B << 1, reg);
}
1068

1069 1070
/* generate a conditional jump to label 'l1' according to jump opcode
   value 'b'. In the fast case, T0 is guaranted not to be used. */
1071
static inline void gen_jcc1_noeob(DisasContext *s, int b, TCGLabel *l1)
1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088
{
    CCPrepare cc = gen_prepare_cc(s, b, cpu_T[0]);

    if (cc.mask != -1) {
        tcg_gen_andi_tl(cpu_T[0], cc.reg, cc.mask);
        cc.reg = cpu_T[0];
    }
    if (cc.use_reg2) {
        tcg_gen_brcond_tl(cc.cond, cc.reg, cc.reg2, l1);
    } else {
        tcg_gen_brcondi_tl(cc.cond, cc.reg, cc.imm, l1);
    }
}

/* Generate a conditional jump to label 'l1' according to jump opcode
   value 'b'. In the fast case, T0 is guaranted not to be used.
   A translation block must end soon.  */
1089
static inline void gen_jcc1(DisasContext *s, int b, TCGLabel *l1)
1090
{
1091
    CCPrepare cc = gen_prepare_cc(s, b, cpu_T[0]);
1092

1093
    gen_update_cc_op(s);
1094 1095 1096 1097
    if (cc.mask != -1) {
        tcg_gen_andi_tl(cpu_T[0], cc.reg, cc.mask);
        cc.reg = cpu_T[0];
    }
1098
    set_cc_op(s, CC_OP_DYNAMIC);
1099 1100 1101 1102
    if (cc.use_reg2) {
        tcg_gen_brcond_tl(cc.cond, cc.reg, cc.reg2, l1);
    } else {
        tcg_gen_brcondi_tl(cc.cond, cc.reg, cc.imm, l1);
1103 1104 1105
    }
}

B
bellard 已提交
1106 1107
/* XXX: does not work with gdbstub "ice" single step - not a
   serious problem */
1108
static TCGLabel *gen_jz_ecx_string(DisasContext *s, target_ulong next_eip)
B
bellard 已提交
1109
{
1110 1111
    TCGLabel *l1 = gen_new_label();
    TCGLabel *l2 = gen_new_label();
1112
    gen_op_jnz_ecx(s->aflag, l1);
B
bellard 已提交
1113 1114 1115 1116
    gen_set_label(l2);
    gen_jmp_tb(s, next_eip, 1);
    gen_set_label(l1);
    return l2;
B
bellard 已提交
1117 1118
}

1119
static inline void gen_stos(DisasContext *s, TCGMemOp ot)
B
bellard 已提交
1120
{
1121
    gen_op_mov_v_reg(MO_32, cpu_T[0], R_EAX);
B
bellard 已提交
1122
    gen_string_movl_A0_EDI(s);
1123
    gen_op_st_v(s, ot, cpu_T[0], cpu_A0);
1124
    gen_op_movl_T0_Dshift(ot);
1125
    gen_op_add_reg_T0(s->aflag, R_EDI);
B
bellard 已提交
1126 1127
}

1128
static inline void gen_lods(DisasContext *s, TCGMemOp ot)
B
bellard 已提交
1129 1130
{
    gen_string_movl_A0_ESI(s);
1131
    gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
1132
    gen_op_mov_reg_v(ot, R_EAX, cpu_T[0]);
1133
    gen_op_movl_T0_Dshift(ot);
1134
    gen_op_add_reg_T0(s->aflag, R_ESI);
B
bellard 已提交
1135 1136
}

1137
static inline void gen_scas(DisasContext *s, TCGMemOp ot)
B
bellard 已提交
1138 1139
{
    gen_string_movl_A0_EDI(s);
1140
    gen_op_ld_v(s, ot, cpu_T[1], cpu_A0);
1141
    gen_op(s, OP_CMPL, ot, R_EAX);
1142
    gen_op_movl_T0_Dshift(ot);
1143
    gen_op_add_reg_T0(s->aflag, R_EDI);
B
bellard 已提交
1144 1145
}

1146
static inline void gen_cmps(DisasContext *s, TCGMemOp ot)
B
bellard 已提交
1147 1148
{
    gen_string_movl_A0_EDI(s);
1149
    gen_op_ld_v(s, ot, cpu_T[1], cpu_A0);
1150 1151
    gen_string_movl_A0_ESI(s);
    gen_op(s, OP_CMPL, ot, OR_TMP0);
1152
    gen_op_movl_T0_Dshift(ot);
1153 1154
    gen_op_add_reg_T0(s->aflag, R_ESI);
    gen_op_add_reg_T0(s->aflag, R_EDI);
B
bellard 已提交
1155 1156
}

1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169
static void gen_bpt_io(DisasContext *s, TCGv_i32 t_port, int ot)
{
    if (s->flags & HF_IOBPT_MASK) {
        TCGv_i32 t_size = tcg_const_i32(1 << ot);
        TCGv t_next = tcg_const_tl(s->pc - s->cs_base);

        gen_helper_bpt_io(cpu_env, t_port, t_size, t_next);
        tcg_temp_free_i32(t_size);
        tcg_temp_free(t_next);
    }
}


1170
static inline void gen_ins(DisasContext *s, TCGMemOp ot)
B
bellard 已提交
1171
{
1172
    if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
1173
        gen_io_start();
1174
    }
B
bellard 已提交
1175
    gen_string_movl_A0_EDI(s);
1176 1177
    /* Note: we must do this dummy write first to be restartable in
       case of page fault. */
1178
    tcg_gen_movi_tl(cpu_T[0], 0);
1179
    gen_op_st_v(s, ot, cpu_T[0], cpu_A0);
1180
    tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_regs[R_EDX]);
1181
    tcg_gen_andi_i32(cpu_tmp2_i32, cpu_tmp2_i32, 0xffff);
P
pbrook 已提交
1182
    gen_helper_in_func(ot, cpu_T[0], cpu_tmp2_i32);
1183
    gen_op_st_v(s, ot, cpu_T[0], cpu_A0);
1184
    gen_op_movl_T0_Dshift(ot);
1185
    gen_op_add_reg_T0(s->aflag, R_EDI);
1186
    gen_bpt_io(s, cpu_tmp2_i32, ot);
1187
    if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
1188
        gen_io_end();
1189
    }
B
bellard 已提交
1190 1191
}

1192
static inline void gen_outs(DisasContext *s, TCGMemOp ot)
B
bellard 已提交
1193
{
1194
    if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
1195
        gen_io_start();
1196
    }
B
bellard 已提交
1197
    gen_string_movl_A0_ESI(s);
1198
    gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
1199

1200
    tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_regs[R_EDX]);
1201 1202
    tcg_gen_andi_i32(cpu_tmp2_i32, cpu_tmp2_i32, 0xffff);
    tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_T[0]);
P
pbrook 已提交
1203
    gen_helper_out_func(ot, cpu_tmp2_i32, cpu_tmp3_i32);
1204
    gen_op_movl_T0_Dshift(ot);
1205
    gen_op_add_reg_T0(s->aflag, R_ESI);
1206
    gen_bpt_io(s, cpu_tmp2_i32, ot);
1207
    if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
1208
        gen_io_end();
1209
    }
B
bellard 已提交
1210 1211 1212 1213 1214
}

/* same method as Valgrind : we generate jumps to current or next
   instruction */
#define GEN_REPZ(op)                                                          \
1215
static inline void gen_repz_ ## op(DisasContext *s, TCGMemOp ot,              \
B
bellard 已提交
1216
                                 target_ulong cur_eip, target_ulong next_eip) \
B
bellard 已提交
1217
{                                                                             \
1218
    TCGLabel *l2;                                                             \
B
bellard 已提交
1219
    gen_update_cc_op(s);                                                      \
B
bellard 已提交
1220
    l2 = gen_jz_ecx_string(s, next_eip);                                      \
B
bellard 已提交
1221
    gen_ ## op(s, ot);                                                        \
1222
    gen_op_add_reg_im(s->aflag, R_ECX, -1);                                   \
B
bellard 已提交
1223 1224
    /* a loop would cause two single step exceptions if ECX = 1               \
       before rep string_insn */                                              \
1225
    if (s->repz_opt)                                                          \
1226
        gen_op_jz_ecx(s->aflag, l2);                                          \
B
bellard 已提交
1227 1228 1229 1230
    gen_jmp(s, cur_eip);                                                      \
}

#define GEN_REPZ2(op)                                                         \
1231
static inline void gen_repz_ ## op(DisasContext *s, TCGMemOp ot,              \
B
bellard 已提交
1232 1233
                                   target_ulong cur_eip,                      \
                                   target_ulong next_eip,                     \
B
bellard 已提交
1234 1235
                                   int nz)                                    \
{                                                                             \
1236
    TCGLabel *l2;                                                             \
B
bellard 已提交
1237
    gen_update_cc_op(s);                                                      \
B
bellard 已提交
1238
    l2 = gen_jz_ecx_string(s, next_eip);                                      \
B
bellard 已提交
1239
    gen_ ## op(s, ot);                                                        \
1240
    gen_op_add_reg_im(s->aflag, R_ECX, -1);                                   \
1241
    gen_update_cc_op(s);                                                      \
1242
    gen_jcc1(s, (JCC_Z << 1) | (nz ^ 1), l2);                                 \
1243
    if (s->repz_opt)                                                          \
1244
        gen_op_jz_ecx(s->aflag, l2);                                          \
B
bellard 已提交
1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255
    gen_jmp(s, cur_eip);                                                      \
}

GEN_REPZ(movs)
GEN_REPZ(stos)
GEN_REPZ(lods)
GEN_REPZ(ins)
GEN_REPZ(outs)
GEN_REPZ2(scas)
GEN_REPZ2(cmps)

P
pbrook 已提交
1256 1257 1258
static void gen_helper_fp_arith_ST0_FT0(int op)
{
    switch (op) {
B
Blue Swirl 已提交
1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282
    case 0:
        gen_helper_fadd_ST0_FT0(cpu_env);
        break;
    case 1:
        gen_helper_fmul_ST0_FT0(cpu_env);
        break;
    case 2:
        gen_helper_fcom_ST0_FT0(cpu_env);
        break;
    case 3:
        gen_helper_fcom_ST0_FT0(cpu_env);
        break;
    case 4:
        gen_helper_fsub_ST0_FT0(cpu_env);
        break;
    case 5:
        gen_helper_fsubr_ST0_FT0(cpu_env);
        break;
    case 6:
        gen_helper_fdiv_ST0_FT0(cpu_env);
        break;
    case 7:
        gen_helper_fdivr_ST0_FT0(cpu_env);
        break;
P
pbrook 已提交
1283 1284
    }
}
B
bellard 已提交
1285 1286

/* NOTE the exception in "r" op ordering */
P
pbrook 已提交
1287 1288 1289 1290
static void gen_helper_fp_arith_STN_ST0(int op, int opreg)
{
    TCGv_i32 tmp = tcg_const_i32(opreg);
    switch (op) {
B
Blue Swirl 已提交
1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308
    case 0:
        gen_helper_fadd_STN_ST0(cpu_env, tmp);
        break;
    case 1:
        gen_helper_fmul_STN_ST0(cpu_env, tmp);
        break;
    case 4:
        gen_helper_fsubr_STN_ST0(cpu_env, tmp);
        break;
    case 5:
        gen_helper_fsub_STN_ST0(cpu_env, tmp);
        break;
    case 6:
        gen_helper_fdivr_STN_ST0(cpu_env, tmp);
        break;
    case 7:
        gen_helper_fdiv_STN_ST0(cpu_env, tmp);
        break;
P
pbrook 已提交
1309 1310
    }
}
B
bellard 已提交
1311 1312

/* if d == OR_TMP0, it means memory operand (address in A0) */
1313
static void gen_op(DisasContext *s1, int op, TCGMemOp ot, int d)
B
bellard 已提交
1314 1315
{
    if (d != OR_TMP0) {
1316
        gen_op_mov_v_reg(ot, cpu_T[0], d);
B
bellard 已提交
1317
    } else {
1318
        gen_op_ld_v(s1, ot, cpu_T[0], cpu_A0);
B
bellard 已提交
1319 1320 1321
    }
    switch(op) {
    case OP_ADCL:
1322
        gen_compute_eflags_c(s1, cpu_tmp4);
B
bellard 已提交
1323 1324
        tcg_gen_add_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
        tcg_gen_add_tl(cpu_T[0], cpu_T[0], cpu_tmp4);
1325
        gen_op_st_rm_T0_A0(s1, ot, d);
1326 1327
        gen_op_update3_cc(cpu_tmp4);
        set_cc_op(s1, CC_OP_ADCB + ot);
B
bellard 已提交
1328
        break;
B
bellard 已提交
1329
    case OP_SBBL:
1330
        gen_compute_eflags_c(s1, cpu_tmp4);
B
bellard 已提交
1331 1332
        tcg_gen_sub_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
        tcg_gen_sub_tl(cpu_T[0], cpu_T[0], cpu_tmp4);
1333
        gen_op_st_rm_T0_A0(s1, ot, d);
1334 1335
        gen_op_update3_cc(cpu_tmp4);
        set_cc_op(s1, CC_OP_SBBB + ot);
B
bellard 已提交
1336
        break;
B
bellard 已提交
1337
    case OP_ADDL:
1338
        tcg_gen_add_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
1339
        gen_op_st_rm_T0_A0(s1, ot, d);
B
bellard 已提交
1340
        gen_op_update2_cc();
1341
        set_cc_op(s1, CC_OP_ADDB + ot);
B
bellard 已提交
1342 1343
        break;
    case OP_SUBL:
1344
        tcg_gen_mov_tl(cpu_cc_srcT, cpu_T[0]);
B
bellard 已提交
1345
        tcg_gen_sub_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
1346
        gen_op_st_rm_T0_A0(s1, ot, d);
B
bellard 已提交
1347
        gen_op_update2_cc();
1348
        set_cc_op(s1, CC_OP_SUBB + ot);
B
bellard 已提交
1349 1350 1351
        break;
    default:
    case OP_ANDL:
B
bellard 已提交
1352
        tcg_gen_and_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
1353
        gen_op_st_rm_T0_A0(s1, ot, d);
B
bellard 已提交
1354
        gen_op_update1_cc();
1355
        set_cc_op(s1, CC_OP_LOGICB + ot);
B
bellard 已提交
1356
        break;
B
bellard 已提交
1357
    case OP_ORL:
B
bellard 已提交
1358
        tcg_gen_or_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
1359
        gen_op_st_rm_T0_A0(s1, ot, d);
B
bellard 已提交
1360
        gen_op_update1_cc();
1361
        set_cc_op(s1, CC_OP_LOGICB + ot);
B
bellard 已提交
1362
        break;
B
bellard 已提交
1363
    case OP_XORL:
B
bellard 已提交
1364
        tcg_gen_xor_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
1365
        gen_op_st_rm_T0_A0(s1, ot, d);
B
bellard 已提交
1366
        gen_op_update1_cc();
1367
        set_cc_op(s1, CC_OP_LOGICB + ot);
B
bellard 已提交
1368 1369
        break;
    case OP_CMPL:
1370
        tcg_gen_mov_tl(cpu_cc_src, cpu_T[1]);
1371
        tcg_gen_mov_tl(cpu_cc_srcT, cpu_T[0]);
1372
        tcg_gen_sub_tl(cpu_cc_dst, cpu_T[0], cpu_T[1]);
1373
        set_cc_op(s1, CC_OP_SUBB + ot);
B
bellard 已提交
1374 1375
        break;
    }
1376 1377
}

B
bellard 已提交
1378
/* if d == OR_TMP0, it means memory operand (address in A0) */
1379
static void gen_inc(DisasContext *s1, TCGMemOp ot, int d, int c)
B
bellard 已提交
1380
{
1381
    if (d != OR_TMP0) {
1382
        gen_op_mov_v_reg(ot, cpu_T[0], d);
1383 1384 1385
    } else {
        gen_op_ld_v(s1, ot, cpu_T[0], cpu_A0);
    }
1386
    gen_compute_eflags_c(s1, cpu_cc_src);
B
bellard 已提交
1387
    if (c > 0) {
1388
        tcg_gen_addi_tl(cpu_T[0], cpu_T[0], 1);
1389
        set_cc_op(s1, CC_OP_INCB + ot);
B
bellard 已提交
1390
    } else {
1391
        tcg_gen_addi_tl(cpu_T[0], cpu_T[0], -1);
1392
        set_cc_op(s1, CC_OP_DECB + ot);
B
bellard 已提交
1393
    }
1394
    gen_op_st_rm_T0_A0(s1, ot, d);
B
bellard 已提交
1395
    tcg_gen_mov_tl(cpu_cc_dst, cpu_T[0]);
B
bellard 已提交
1396 1397
}

1398 1399
static void gen_shift_flags(DisasContext *s, TCGMemOp ot, TCGv result,
                            TCGv shm1, TCGv count, bool is_right)
1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442
{
    TCGv_i32 z32, s32, oldop;
    TCGv z_tl;

    /* Store the results into the CC variables.  If we know that the
       variable must be dead, store unconditionally.  Otherwise we'll
       need to not disrupt the current contents.  */
    z_tl = tcg_const_tl(0);
    if (cc_op_live[s->cc_op] & USES_CC_DST) {
        tcg_gen_movcond_tl(TCG_COND_NE, cpu_cc_dst, count, z_tl,
                           result, cpu_cc_dst);
    } else {
        tcg_gen_mov_tl(cpu_cc_dst, result);
    }
    if (cc_op_live[s->cc_op] & USES_CC_SRC) {
        tcg_gen_movcond_tl(TCG_COND_NE, cpu_cc_src, count, z_tl,
                           shm1, cpu_cc_src);
    } else {
        tcg_gen_mov_tl(cpu_cc_src, shm1);
    }
    tcg_temp_free(z_tl);

    /* Get the two potential CC_OP values into temporaries.  */
    tcg_gen_movi_i32(cpu_tmp2_i32, (is_right ? CC_OP_SARB : CC_OP_SHLB) + ot);
    if (s->cc_op == CC_OP_DYNAMIC) {
        oldop = cpu_cc_op;
    } else {
        tcg_gen_movi_i32(cpu_tmp3_i32, s->cc_op);
        oldop = cpu_tmp3_i32;
    }

    /* Conditionally store the CC_OP value.  */
    z32 = tcg_const_i32(0);
    s32 = tcg_temp_new_i32();
    tcg_gen_trunc_tl_i32(s32, count);
    tcg_gen_movcond_i32(TCG_COND_NE, cpu_cc_op, s32, z32, cpu_tmp2_i32, oldop);
    tcg_temp_free_i32(z32);
    tcg_temp_free_i32(s32);

    /* The CC_OP value is no longer predictable.  */
    set_cc_op(s, CC_OP_DYNAMIC);
}

1443
static void gen_shift_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
1444
                            int is_right, int is_arith)
B
bellard 已提交
1445
{
1446
    target_ulong mask = (ot == MO_64 ? 0x3f : 0x1f);
1447

1448
    /* load */
1449
    if (op1 == OR_TMP0) {
1450
        gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
1451
    } else {
1452
        gen_op_mov_v_reg(ot, cpu_T[0], op1);
1453
    }
1454

1455 1456
    tcg_gen_andi_tl(cpu_T[1], cpu_T[1], mask);
    tcg_gen_subi_tl(cpu_tmp0, cpu_T[1], 1);
1457 1458 1459

    if (is_right) {
        if (is_arith) {
B
bellard 已提交
1460
            gen_exts(ot, cpu_T[0]);
1461 1462
            tcg_gen_sar_tl(cpu_tmp0, cpu_T[0], cpu_tmp0);
            tcg_gen_sar_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
1463
        } else {
B
bellard 已提交
1464
            gen_extu(ot, cpu_T[0]);
1465 1466
            tcg_gen_shr_tl(cpu_tmp0, cpu_T[0], cpu_tmp0);
            tcg_gen_shr_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
1467 1468
        }
    } else {
1469 1470
        tcg_gen_shl_tl(cpu_tmp0, cpu_T[0], cpu_tmp0);
        tcg_gen_shl_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
1471 1472 1473
    }

    /* store */
1474
    gen_op_st_rm_T0_A0(s, ot, op1);
1475

1476
    gen_shift_flags(s, ot, cpu_T[0], cpu_tmp0, cpu_T[1], is_right);
1477 1478
}

1479
static void gen_shift_rm_im(DisasContext *s, TCGMemOp ot, int op1, int op2,
B
bellard 已提交
1480 1481
                            int is_right, int is_arith)
{
1482
    int mask = (ot == MO_64 ? 0x3f : 0x1f);
B
bellard 已提交
1483 1484 1485

    /* load */
    if (op1 == OR_TMP0)
1486
        gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
B
bellard 已提交
1487
    else
1488
        gen_op_mov_v_reg(ot, cpu_T[0], op1);
B
bellard 已提交
1489 1490 1491 1492 1493 1494

    op2 &= mask;
    if (op2 != 0) {
        if (is_right) {
            if (is_arith) {
                gen_exts(ot, cpu_T[0]);
B
bellard 已提交
1495
                tcg_gen_sari_tl(cpu_tmp4, cpu_T[0], op2 - 1);
B
bellard 已提交
1496 1497 1498
                tcg_gen_sari_tl(cpu_T[0], cpu_T[0], op2);
            } else {
                gen_extu(ot, cpu_T[0]);
B
bellard 已提交
1499
                tcg_gen_shri_tl(cpu_tmp4, cpu_T[0], op2 - 1);
B
bellard 已提交
1500 1501 1502
                tcg_gen_shri_tl(cpu_T[0], cpu_T[0], op2);
            }
        } else {
B
bellard 已提交
1503
            tcg_gen_shli_tl(cpu_tmp4, cpu_T[0], op2 - 1);
B
bellard 已提交
1504 1505 1506 1507 1508
            tcg_gen_shli_tl(cpu_T[0], cpu_T[0], op2);
        }
    }

    /* store */
1509 1510
    gen_op_st_rm_T0_A0(s, ot, op1);

B
bellard 已提交
1511 1512
    /* update eflags if non zero shift */
    if (op2 != 0) {
B
bellard 已提交
1513
        tcg_gen_mov_tl(cpu_cc_src, cpu_tmp4);
B
bellard 已提交
1514
        tcg_gen_mov_tl(cpu_cc_dst, cpu_T[0]);
1515
        set_cc_op(s, (is_right ? CC_OP_SARB : CC_OP_SHLB) + ot);
B
bellard 已提交
1516 1517 1518
    }
}

1519
static void gen_rot_rm_T1(DisasContext *s, TCGMemOp ot, int op1, int is_right)
1520
{
1521
    target_ulong mask = (ot == MO_64 ? 0x3f : 0x1f);
1522
    TCGv_i32 t0, t1;
1523 1524

    /* load */
1525
    if (op1 == OR_TMP0) {
1526
        gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
1527
    } else {
1528
        gen_op_mov_v_reg(ot, cpu_T[0], op1);
1529
    }
1530

1531
    tcg_gen_andi_tl(cpu_T[1], cpu_T[1], mask);
1532

1533
    switch (ot) {
1534
    case MO_8:
1535 1536 1537 1538
        /* Replicate the 8-bit input so that a 32-bit rotate works.  */
        tcg_gen_ext8u_tl(cpu_T[0], cpu_T[0]);
        tcg_gen_muli_tl(cpu_T[0], cpu_T[0], 0x01010101);
        goto do_long;
1539
    case MO_16:
1540 1541 1542 1543 1544
        /* Replicate the 16-bit input so that a 32-bit rotate works.  */
        tcg_gen_deposit_tl(cpu_T[0], cpu_T[0], cpu_T[0], 16, 16);
        goto do_long;
    do_long:
#ifdef TARGET_X86_64
1545
    case MO_32:
1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562
        tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
        tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_T[1]);
        if (is_right) {
            tcg_gen_rotr_i32(cpu_tmp2_i32, cpu_tmp2_i32, cpu_tmp3_i32);
        } else {
            tcg_gen_rotl_i32(cpu_tmp2_i32, cpu_tmp2_i32, cpu_tmp3_i32);
        }
        tcg_gen_extu_i32_tl(cpu_T[0], cpu_tmp2_i32);
        break;
#endif
    default:
        if (is_right) {
            tcg_gen_rotr_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
        } else {
            tcg_gen_rotl_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
        }
        break;
1563 1564 1565
    }

    /* store */
1566
    gen_op_st_rm_T0_A0(s, ot, op1);
1567

1568 1569
    /* We'll need the flags computed into CC_SRC.  */
    gen_compute_eflags(s);
1570

1571 1572 1573 1574
    /* The value that was "rotated out" is now present at the other end
       of the word.  Compute C into CC_DST and O into CC_SRC2.  Note that
       since we've computed the flags into CC_SRC, these variables are
       currently dead.  */
1575
    if (is_right) {
1576 1577
        tcg_gen_shri_tl(cpu_cc_src2, cpu_T[0], mask - 1);
        tcg_gen_shri_tl(cpu_cc_dst, cpu_T[0], mask);
P
Pavel Dovgaluk 已提交
1578
        tcg_gen_andi_tl(cpu_cc_dst, cpu_cc_dst, 1);
1579 1580 1581
    } else {
        tcg_gen_shri_tl(cpu_cc_src2, cpu_T[0], mask);
        tcg_gen_andi_tl(cpu_cc_dst, cpu_T[0], 1);
1582
    }
1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601
    tcg_gen_andi_tl(cpu_cc_src2, cpu_cc_src2, 1);
    tcg_gen_xor_tl(cpu_cc_src2, cpu_cc_src2, cpu_cc_dst);

    /* Now conditionally store the new CC_OP value.  If the shift count
       is 0 we keep the CC_OP_EFLAGS setting so that only CC_SRC is live.
       Otherwise reuse CC_OP_ADCOX which have the C and O flags split out
       exactly as we computed above.  */
    t0 = tcg_const_i32(0);
    t1 = tcg_temp_new_i32();
    tcg_gen_trunc_tl_i32(t1, cpu_T[1]);
    tcg_gen_movi_i32(cpu_tmp2_i32, CC_OP_ADCOX); 
    tcg_gen_movi_i32(cpu_tmp3_i32, CC_OP_EFLAGS);
    tcg_gen_movcond_i32(TCG_COND_NE, cpu_cc_op, t1, t0,
                        cpu_tmp2_i32, cpu_tmp3_i32);
    tcg_temp_free_i32(t0);
    tcg_temp_free_i32(t1);

    /* The CC_OP value is no longer predictable.  */ 
    set_cc_op(s, CC_OP_DYNAMIC);
1602 1603
}

1604
static void gen_rot_rm_im(DisasContext *s, TCGMemOp ot, int op1, int op2,
M
malc 已提交
1605 1606
                          int is_right)
{
1607
    int mask = (ot == MO_64 ? 0x3f : 0x1f);
1608
    int shift;
M
malc 已提交
1609 1610 1611

    /* load */
    if (op1 == OR_TMP0) {
1612
        gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
M
malc 已提交
1613
    } else {
1614
        gen_op_mov_v_reg(ot, cpu_T[0], op1);
M
malc 已提交
1615 1616 1617 1618
    }

    op2 &= mask;
    if (op2 != 0) {
1619 1620
        switch (ot) {
#ifdef TARGET_X86_64
1621
        case MO_32:
1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637
            tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
            if (is_right) {
                tcg_gen_rotri_i32(cpu_tmp2_i32, cpu_tmp2_i32, op2);
            } else {
                tcg_gen_rotli_i32(cpu_tmp2_i32, cpu_tmp2_i32, op2);
            }
            tcg_gen_extu_i32_tl(cpu_T[0], cpu_tmp2_i32);
            break;
#endif
        default:
            if (is_right) {
                tcg_gen_rotri_tl(cpu_T[0], cpu_T[0], op2);
            } else {
                tcg_gen_rotli_tl(cpu_T[0], cpu_T[0], op2);
            }
            break;
1638
        case MO_8:
1639 1640
            mask = 7;
            goto do_shifts;
1641
        case MO_16:
1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652
            mask = 15;
        do_shifts:
            shift = op2 & mask;
            if (is_right) {
                shift = mask + 1 - shift;
            }
            gen_extu(ot, cpu_T[0]);
            tcg_gen_shli_tl(cpu_tmp0, cpu_T[0], shift);
            tcg_gen_shri_tl(cpu_T[0], cpu_T[0], mask + 1 - shift);
            tcg_gen_or_tl(cpu_T[0], cpu_T[0], cpu_tmp0);
            break;
M
malc 已提交
1653 1654 1655 1656
        }
    }

    /* store */
1657
    gen_op_st_rm_T0_A0(s, ot, op1);
M
malc 已提交
1658 1659

    if (op2 != 0) {
1660
        /* Compute the flags into CC_SRC.  */
1661
        gen_compute_eflags(s);
1662

1663 1664 1665 1666
        /* The value that was "rotated out" is now present at the other end
           of the word.  Compute C into CC_DST and O into CC_SRC2.  Note that
           since we've computed the flags into CC_SRC, these variables are
           currently dead.  */
M
malc 已提交
1667
        if (is_right) {
1668 1669
            tcg_gen_shri_tl(cpu_cc_src2, cpu_T[0], mask - 1);
            tcg_gen_shri_tl(cpu_cc_dst, cpu_T[0], mask);
1670
            tcg_gen_andi_tl(cpu_cc_dst, cpu_cc_dst, 1);
1671 1672 1673
        } else {
            tcg_gen_shri_tl(cpu_cc_src2, cpu_T[0], mask);
            tcg_gen_andi_tl(cpu_cc_dst, cpu_T[0], 1);
M
malc 已提交
1674
        }
1675 1676 1677
        tcg_gen_andi_tl(cpu_cc_src2, cpu_cc_src2, 1);
        tcg_gen_xor_tl(cpu_cc_src2, cpu_cc_src2, cpu_cc_dst);
        set_cc_op(s, CC_OP_ADCOX);
M
malc 已提交
1678 1679 1680
    }
}

1681
/* XXX: add faster immediate = 1 case */
1682
static void gen_rotc_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
1683 1684
                           int is_right)
{
1685
    gen_compute_eflags(s);
1686
    assert(s->cc_op == CC_OP_EFLAGS);
1687 1688 1689

    /* load */
    if (op1 == OR_TMP0)
1690
        gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
1691
    else
1692
        gen_op_mov_v_reg(ot, cpu_T[0], op1);
1693
    
P
pbrook 已提交
1694 1695
    if (is_right) {
        switch (ot) {
1696
        case MO_8:
1697 1698
            gen_helper_rcrb(cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]);
            break;
1699
        case MO_16:
1700 1701
            gen_helper_rcrw(cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]);
            break;
1702
        case MO_32:
1703 1704
            gen_helper_rcrl(cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]);
            break;
P
pbrook 已提交
1705
#ifdef TARGET_X86_64
1706
        case MO_64:
1707 1708
            gen_helper_rcrq(cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]);
            break;
P
pbrook 已提交
1709
#endif
1710 1711
        default:
            tcg_abort();
P
pbrook 已提交
1712 1713 1714
        }
    } else {
        switch (ot) {
1715
        case MO_8:
1716 1717
            gen_helper_rclb(cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]);
            break;
1718
        case MO_16:
1719 1720
            gen_helper_rclw(cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]);
            break;
1721
        case MO_32:
1722 1723
            gen_helper_rcll(cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]);
            break;
P
pbrook 已提交
1724
#ifdef TARGET_X86_64
1725
        case MO_64:
1726 1727
            gen_helper_rclq(cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]);
            break;
P
pbrook 已提交
1728
#endif
1729 1730
        default:
            tcg_abort();
P
pbrook 已提交
1731 1732
        }
    }
1733
    /* store */
1734
    gen_op_st_rm_T0_A0(s, ot, op1);
1735 1736 1737
}

/* XXX: add faster immediate case */
1738
static void gen_shiftd_rm_T1(DisasContext *s, TCGMemOp ot, int op1,
1739
                             bool is_right, TCGv count_in)
1740
{
1741
    target_ulong mask = (ot == MO_64 ? 63 : 31);
1742
    TCGv count;
1743 1744

    /* load */
1745
    if (op1 == OR_TMP0) {
1746
        gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
1747
    } else {
1748
        gen_op_mov_v_reg(ot, cpu_T[0], op1);
1749
    }
1750

1751 1752
    count = tcg_temp_new();
    tcg_gen_andi_tl(count, count_in, mask);
1753

1754
    switch (ot) {
1755
    case MO_16:
1756 1757 1758
        /* Note: we implement the Intel behaviour for shift count > 16.
           This means "shrdw C, B, A" shifts A:B:A >> C.  Build the B:A
           portion by constructing it as a 32-bit value.  */
1759
        if (is_right) {
1760 1761 1762
            tcg_gen_deposit_tl(cpu_tmp0, cpu_T[0], cpu_T[1], 16, 16);
            tcg_gen_mov_tl(cpu_T[1], cpu_T[0]);
            tcg_gen_mov_tl(cpu_T[0], cpu_tmp0);
1763
        } else {
1764
            tcg_gen_deposit_tl(cpu_T[1], cpu_T[0], cpu_T[1], 16, 16);
1765
        }
1766 1767
        /* FALLTHRU */
#ifdef TARGET_X86_64
1768
    case MO_32:
1769 1770
        /* Concatenate the two 32-bit values and use a 64-bit shift.  */
        tcg_gen_subi_tl(cpu_tmp0, count, 1);
1771
        if (is_right) {
1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787
            tcg_gen_concat_tl_i64(cpu_T[0], cpu_T[0], cpu_T[1]);
            tcg_gen_shr_i64(cpu_tmp0, cpu_T[0], cpu_tmp0);
            tcg_gen_shr_i64(cpu_T[0], cpu_T[0], count);
        } else {
            tcg_gen_concat_tl_i64(cpu_T[0], cpu_T[1], cpu_T[0]);
            tcg_gen_shl_i64(cpu_tmp0, cpu_T[0], cpu_tmp0);
            tcg_gen_shl_i64(cpu_T[0], cpu_T[0], count);
            tcg_gen_shri_i64(cpu_tmp0, cpu_tmp0, 32);
            tcg_gen_shri_i64(cpu_T[0], cpu_T[0], 32);
        }
        break;
#endif
    default:
        tcg_gen_subi_tl(cpu_tmp0, count, 1);
        if (is_right) {
            tcg_gen_shr_tl(cpu_tmp0, cpu_T[0], cpu_tmp0);
1788

1789 1790 1791
            tcg_gen_subfi_tl(cpu_tmp4, mask + 1, count);
            tcg_gen_shr_tl(cpu_T[0], cpu_T[0], count);
            tcg_gen_shl_tl(cpu_T[1], cpu_T[1], cpu_tmp4);
1792
        } else {
1793
            tcg_gen_shl_tl(cpu_tmp0, cpu_T[0], cpu_tmp0);
1794
            if (ot == MO_16) {
1795 1796 1797 1798 1799 1800 1801 1802 1803
                /* Only needed if count > 16, for Intel behaviour.  */
                tcg_gen_subfi_tl(cpu_tmp4, 33, count);
                tcg_gen_shr_tl(cpu_tmp4, cpu_T[1], cpu_tmp4);
                tcg_gen_or_tl(cpu_tmp0, cpu_tmp0, cpu_tmp4);
            }

            tcg_gen_subfi_tl(cpu_tmp4, mask + 1, count);
            tcg_gen_shl_tl(cpu_T[0], cpu_T[0], count);
            tcg_gen_shr_tl(cpu_T[1], cpu_T[1], cpu_tmp4);
1804
        }
1805 1806 1807 1808 1809
        tcg_gen_movi_tl(cpu_tmp4, 0);
        tcg_gen_movcond_tl(TCG_COND_EQ, cpu_T[1], count, cpu_tmp4,
                           cpu_tmp4, cpu_T[1]);
        tcg_gen_or_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
        break;
1810 1811 1812
    }

    /* store */
1813
    gen_op_st_rm_T0_A0(s, ot, op1);
1814

1815 1816
    gen_shift_flags(s, ot, cpu_T[0], cpu_tmp0, count, is_right);
    tcg_temp_free(count);
1817 1818
}

1819
static void gen_shift(DisasContext *s1, int op, TCGMemOp ot, int d, int s)
1820 1821
{
    if (s != OR_TMP1)
1822
        gen_op_mov_v_reg(ot, cpu_T[1], s);
1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846
    switch(op) {
    case OP_ROL:
        gen_rot_rm_T1(s1, ot, d, 0);
        break;
    case OP_ROR:
        gen_rot_rm_T1(s1, ot, d, 1);
        break;
    case OP_SHL:
    case OP_SHL1:
        gen_shift_rm_T1(s1, ot, d, 0, 0);
        break;
    case OP_SHR:
        gen_shift_rm_T1(s1, ot, d, 1, 0);
        break;
    case OP_SAR:
        gen_shift_rm_T1(s1, ot, d, 1, 1);
        break;
    case OP_RCL:
        gen_rotc_rm_T1(s1, ot, d, 0);
        break;
    case OP_RCR:
        gen_rotc_rm_T1(s1, ot, d, 1);
        break;
    }
B
bellard 已提交
1847 1848
}

1849
static void gen_shifti(DisasContext *s1, int op, TCGMemOp ot, int d, int c)
B
bellard 已提交
1850
{
B
bellard 已提交
1851
    switch(op) {
M
malc 已提交
1852 1853 1854 1855 1856 1857
    case OP_ROL:
        gen_rot_rm_im(s1, ot, d, c, 0);
        break;
    case OP_ROR:
        gen_rot_rm_im(s1, ot, d, c, 1);
        break;
B
bellard 已提交
1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868 1869
    case OP_SHL:
    case OP_SHL1:
        gen_shift_rm_im(s1, ot, d, c, 0, 0);
        break;
    case OP_SHR:
        gen_shift_rm_im(s1, ot, d, c, 1, 0);
        break;
    case OP_SAR:
        gen_shift_rm_im(s1, ot, d, c, 1, 1);
        break;
    default:
        /* currently not optimized */
1870
        tcg_gen_movi_tl(cpu_T[1], c);
B
bellard 已提交
1871 1872 1873
        gen_shift(s1, op, ot, d, OR_TMP1);
        break;
    }
B
bellard 已提交
1874 1875
}

1876
static void gen_lea_modrm(CPUX86State *env, DisasContext *s, int modrm)
B
bellard 已提交
1877
{
B
bellard 已提交
1878
    target_long disp;
B
bellard 已提交
1879
    int havesib;
B
bellard 已提交
1880
    int base;
B
bellard 已提交
1881 1882 1883
    int index;
    int scale;
    int mod, rm, code, override, must_add_seg;
1884
    TCGv sum;
B
bellard 已提交
1885 1886 1887 1888 1889 1890 1891 1892

    override = s->override;
    must_add_seg = s->addseg;
    if (override >= 0)
        must_add_seg = 1;
    mod = (modrm >> 6) & 3;
    rm = modrm & 7;

1893 1894 1895
    switch (s->aflag) {
    case MO_64:
    case MO_32:
B
bellard 已提交
1896 1897
        havesib = 0;
        base = rm;
1898
        index = -1;
B
bellard 已提交
1899
        scale = 0;
1900

B
bellard 已提交
1901 1902
        if (base == 4) {
            havesib = 1;
1903
            code = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
1904
            scale = (code >> 6) & 3;
B
bellard 已提交
1905
            index = ((code >> 3) & 7) | REX_X(s);
1906 1907 1908
            if (index == 4) {
                index = -1;  /* no index */
            }
B
bellard 已提交
1909
            base = (code & 7);
B
bellard 已提交
1910
        }
B
bellard 已提交
1911
        base |= REX_B(s);
B
bellard 已提交
1912 1913 1914

        switch (mod) {
        case 0:
B
bellard 已提交
1915
            if ((base & 7) == 5) {
B
bellard 已提交
1916
                base = -1;
1917
                disp = (int32_t)cpu_ldl_code(env, s->pc);
B
bellard 已提交
1918
                s->pc += 4;
B
bellard 已提交
1919 1920 1921
                if (CODE64(s) && !havesib) {
                    disp += s->pc + s->rip_offset;
                }
B
bellard 已提交
1922 1923 1924 1925 1926
            } else {
                disp = 0;
            }
            break;
        case 1:
1927
            disp = (int8_t)cpu_ldub_code(env, s->pc++);
B
bellard 已提交
1928 1929 1930
            break;
        default:
        case 2:
1931
            disp = (int32_t)cpu_ldl_code(env, s->pc);
B
bellard 已提交
1932 1933 1934
            s->pc += 4;
            break;
        }
1935

1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948
        /* For correct popl handling with esp.  */
        if (base == R_ESP && s->popl_esp_hack) {
            disp += s->popl_esp_hack;
        }

        /* Compute the address, with a minimum number of TCG ops.  */
        TCGV_UNUSED(sum);
        if (index >= 0) {
            if (scale == 0) {
                sum = cpu_regs[index];
            } else {
                tcg_gen_shli_tl(cpu_A0, cpu_regs[index], scale);
                sum = cpu_A0;
B
bellard 已提交
1949
            }
1950 1951 1952
            if (base >= 0) {
                tcg_gen_add_tl(cpu_A0, sum, cpu_regs[base]);
                sum = cpu_A0;
B
bellard 已提交
1953
            }
1954 1955
        } else if (base >= 0) {
            sum = cpu_regs[base];
B
bellard 已提交
1956
        }
1957 1958 1959 1960
        if (TCGV_IS_UNUSED(sum)) {
            tcg_gen_movi_tl(cpu_A0, disp);
        } else {
            tcg_gen_addi_tl(cpu_A0, sum, disp);
B
bellard 已提交
1961
        }
1962

B
bellard 已提交
1963 1964
        if (must_add_seg) {
            if (override < 0) {
1965
                if (base == R_EBP || base == R_ESP) {
B
bellard 已提交
1966
                    override = R_SS;
1967
                } else {
B
bellard 已提交
1968
                    override = R_DS;
1969
                }
B
bellard 已提交
1970
            }
1971 1972 1973 1974

            tcg_gen_ld_tl(cpu_tmp0, cpu_env,
                          offsetof(CPUX86State, segs[override].base));
            if (CODE64(s)) {
1975
                if (s->aflag == MO_32) {
1976 1977 1978
                    tcg_gen_ext32u_tl(cpu_A0, cpu_A0);
                }
                tcg_gen_add_tl(cpu_A0, cpu_A0, cpu_tmp0);
1979
                return;
B
bellard 已提交
1980
            }
1981 1982 1983 1984

            tcg_gen_add_tl(cpu_A0, cpu_A0, cpu_tmp0);
        }

1985
        if (s->aflag == MO_32) {
1986
            tcg_gen_ext32u_tl(cpu_A0, cpu_A0);
B
bellard 已提交
1987
        }
1988 1989 1990
        break;

    case MO_16:
B
bellard 已提交
1991 1992 1993
        switch (mod) {
        case 0:
            if (rm == 6) {
1994
                disp = cpu_lduw_code(env, s->pc);
B
bellard 已提交
1995
                s->pc += 2;
1996
                tcg_gen_movi_tl(cpu_A0, disp);
B
bellard 已提交
1997 1998 1999 2000 2001 2002 2003
                rm = 0; /* avoid SS override */
                goto no_rm;
            } else {
                disp = 0;
            }
            break;
        case 1:
2004
            disp = (int8_t)cpu_ldub_code(env, s->pc++);
B
bellard 已提交
2005 2006 2007
            break;
        default:
        case 2:
2008
            disp = (int16_t)cpu_lduw_code(env, s->pc);
B
bellard 已提交
2009 2010 2011
            s->pc += 2;
            break;
        }
2012 2013 2014

        sum = cpu_A0;
        switch (rm) {
B
bellard 已提交
2015
        case 0:
2016
            tcg_gen_add_tl(cpu_A0, cpu_regs[R_EBX], cpu_regs[R_ESI]);
B
bellard 已提交
2017 2018
            break;
        case 1:
2019
            tcg_gen_add_tl(cpu_A0, cpu_regs[R_EBX], cpu_regs[R_EDI]);
B
bellard 已提交
2020 2021
            break;
        case 2:
2022
            tcg_gen_add_tl(cpu_A0, cpu_regs[R_EBP], cpu_regs[R_ESI]);
B
bellard 已提交
2023 2024
            break;
        case 3:
2025
            tcg_gen_add_tl(cpu_A0, cpu_regs[R_EBP], cpu_regs[R_EDI]);
B
bellard 已提交
2026 2027
            break;
        case 4:
2028
            sum = cpu_regs[R_ESI];
B
bellard 已提交
2029 2030
            break;
        case 5:
2031
            sum = cpu_regs[R_EDI];
B
bellard 已提交
2032 2033
            break;
        case 6:
2034
            sum = cpu_regs[R_EBP];
B
bellard 已提交
2035 2036 2037
            break;
        default:
        case 7:
2038
            sum = cpu_regs[R_EBX];
B
bellard 已提交
2039 2040
            break;
        }
2041
        tcg_gen_addi_tl(cpu_A0, sum, disp);
2042
        tcg_gen_ext16u_tl(cpu_A0, cpu_A0);
B
bellard 已提交
2043 2044 2045
    no_rm:
        if (must_add_seg) {
            if (override < 0) {
2046
                if (rm == 2 || rm == 3 || rm == 6) {
B
bellard 已提交
2047
                    override = R_SS;
2048
                } else {
B
bellard 已提交
2049
                    override = R_DS;
2050
                }
B
bellard 已提交
2051
            }
2052
            gen_op_addl_A0_seg(s, override);
B
bellard 已提交
2053
        }
2054 2055 2056 2057
        break;

    default:
        tcg_abort();
B
bellard 已提交
2058 2059 2060
    }
}

2061
static void gen_nop_modrm(CPUX86State *env, DisasContext *s, int modrm)
B
bellard 已提交
2062 2063 2064 2065 2066 2067 2068 2069
{
    int mod, rm, base, code;

    mod = (modrm >> 6) & 3;
    if (mod == 3)
        return;
    rm = modrm & 7;

2070 2071 2072
    switch (s->aflag) {
    case MO_64:
    case MO_32:
B
bellard 已提交
2073
        base = rm;
2074

B
bellard 已提交
2075
        if (base == 4) {
2076
            code = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
2077 2078
            base = (code & 7);
        }
2079

B
bellard 已提交
2080 2081 2082 2083 2084 2085 2086 2087 2088 2089 2090 2091 2092 2093
        switch (mod) {
        case 0:
            if (base == 5) {
                s->pc += 4;
            }
            break;
        case 1:
            s->pc++;
            break;
        default:
        case 2:
            s->pc += 4;
            break;
        }
2094 2095 2096
        break;

    case MO_16:
B
bellard 已提交
2097 2098 2099 2100 2101 2102 2103 2104 2105 2106 2107 2108 2109 2110
        switch (mod) {
        case 0:
            if (rm == 6) {
                s->pc += 2;
            }
            break;
        case 1:
            s->pc++;
            break;
        default:
        case 2:
            s->pc += 2;
            break;
        }
2111 2112 2113 2114
        break;

    default:
        tcg_abort();
B
bellard 已提交
2115 2116 2117
    }
}

B
bellard 已提交
2118 2119 2120 2121 2122 2123 2124 2125 2126 2127 2128
/* used for LEA and MOV AX, mem */
static void gen_add_A0_ds_seg(DisasContext *s)
{
    int override, must_add_seg;
    must_add_seg = s->addseg;
    override = R_DS;
    if (s->override >= 0) {
        override = s->override;
        must_add_seg = 1;
    }
    if (must_add_seg) {
2129 2130
#ifdef TARGET_X86_64
        if (CODE64(s)) {
B
bellard 已提交
2131
            gen_op_addq_A0_seg(override);
2132
        } else
2133 2134
#endif
        {
2135
            gen_op_addl_A0_seg(s, override);
2136
        }
B
bellard 已提交
2137 2138 2139
    }
}

B
balrog 已提交
2140
/* generate modrm memory load or store of 'reg'. TMP0 is used if reg ==
B
bellard 已提交
2141
   OR_TMP0 */
2142
static void gen_ldst_modrm(CPUX86State *env, DisasContext *s, int modrm,
2143
                           TCGMemOp ot, int reg, int is_store)
B
bellard 已提交
2144
{
2145
    int mod, rm;
B
bellard 已提交
2146 2147

    mod = (modrm >> 6) & 3;
B
bellard 已提交
2148
    rm = (modrm & 7) | REX_B(s);
B
bellard 已提交
2149 2150 2151
    if (mod == 3) {
        if (is_store) {
            if (reg != OR_TMP0)
2152
                gen_op_mov_v_reg(ot, cpu_T[0], reg);
2153
            gen_op_mov_reg_v(ot, rm, cpu_T[0]);
B
bellard 已提交
2154
        } else {
2155
            gen_op_mov_v_reg(ot, cpu_T[0], rm);
B
bellard 已提交
2156
            if (reg != OR_TMP0)
2157
                gen_op_mov_reg_v(ot, reg, cpu_T[0]);
B
bellard 已提交
2158 2159
        }
    } else {
2160
        gen_lea_modrm(env, s, modrm);
B
bellard 已提交
2161 2162
        if (is_store) {
            if (reg != OR_TMP0)
2163
                gen_op_mov_v_reg(ot, cpu_T[0], reg);
2164
            gen_op_st_v(s, ot, cpu_T[0], cpu_A0);
B
bellard 已提交
2165
        } else {
2166
            gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
B
bellard 已提交
2167
            if (reg != OR_TMP0)
2168
                gen_op_mov_reg_v(ot, reg, cpu_T[0]);
B
bellard 已提交
2169 2170 2171 2172
        }
    }
}

2173
static inline uint32_t insn_get(CPUX86State *env, DisasContext *s, TCGMemOp ot)
B
bellard 已提交
2174 2175 2176
{
    uint32_t ret;

2177
    switch (ot) {
2178
    case MO_8:
2179
        ret = cpu_ldub_code(env, s->pc);
B
bellard 已提交
2180 2181
        s->pc++;
        break;
2182
    case MO_16:
2183
        ret = cpu_lduw_code(env, s->pc);
B
bellard 已提交
2184 2185
        s->pc += 2;
        break;
2186
    case MO_32:
2187 2188 2189
#ifdef TARGET_X86_64
    case MO_64:
#endif
2190
        ret = cpu_ldl_code(env, s->pc);
B
bellard 已提交
2191 2192
        s->pc += 4;
        break;
2193 2194
    default:
        tcg_abort();
B
bellard 已提交
2195 2196 2197 2198
    }
    return ret;
}

2199
static inline int insn_const_size(TCGMemOp ot)
B
bellard 已提交
2200
{
2201
    if (ot <= MO_32) {
B
bellard 已提交
2202
        return 1 << ot;
2203
    } else {
B
bellard 已提交
2204
        return 4;
2205
    }
B
bellard 已提交
2206 2207
}

2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218
static inline void gen_goto_tb(DisasContext *s, int tb_num, target_ulong eip)
{
    TranslationBlock *tb;
    target_ulong pc;

    pc = s->cs_base + eip;
    tb = s->tb;
    /* NOTE: we handle the case where the TB spans two pages here */
    if ((pc & TARGET_PAGE_MASK) == (tb->pc & TARGET_PAGE_MASK) ||
        (pc & TARGET_PAGE_MASK) == ((s->pc - 1) & TARGET_PAGE_MASK))  {
        /* jump to same page: we can use a direct jump */
B
bellard 已提交
2219
        tcg_gen_goto_tb(tb_num);
2220
        gen_jmp_im(eip);
2221
        tcg_gen_exit_tb((uintptr_t)tb + tb_num);
2222 2223 2224 2225 2226 2227 2228
    } else {
        /* jump to another page: currently not optimized */
        gen_jmp_im(eip);
        gen_eob(s);
    }
}

2229
static inline void gen_jcc(DisasContext *s, int b,
B
bellard 已提交
2230
                           target_ulong val, target_ulong next_eip)
B
bellard 已提交
2231
{
2232
    TCGLabel *l1, *l2;
2233

B
bellard 已提交
2234
    if (s->jmp_opt) {
B
bellard 已提交
2235
        l1 = gen_new_label();
2236
        gen_jcc1(s, b, l1);
2237

2238
        gen_goto_tb(s, 0, next_eip);
B
bellard 已提交
2239 2240

        gen_set_label(l1);
2241
        gen_goto_tb(s, 1, val);
J
Jun Koi 已提交
2242
        s->is_jmp = DISAS_TB_JUMP;
B
bellard 已提交
2243
    } else {
B
bellard 已提交
2244 2245
        l1 = gen_new_label();
        l2 = gen_new_label();
2246
        gen_jcc1(s, b, l1);
2247

B
bellard 已提交
2248
        gen_jmp_im(next_eip);
2249 2250
        tcg_gen_br(l2);

B
bellard 已提交
2251 2252 2253
        gen_set_label(l1);
        gen_jmp_im(val);
        gen_set_label(l2);
B
bellard 已提交
2254 2255 2256 2257
        gen_eob(s);
    }
}

2258
static void gen_cmovcc1(CPUX86State *env, DisasContext *s, TCGMemOp ot, int b,
2259 2260
                        int modrm, int reg)
{
2261
    CCPrepare cc;
2262

2263
    gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
2264

2265 2266 2267 2268 2269 2270 2271 2272
    cc = gen_prepare_cc(s, b, cpu_T[1]);
    if (cc.mask != -1) {
        TCGv t0 = tcg_temp_new();
        tcg_gen_andi_tl(t0, cc.reg, cc.mask);
        cc.reg = t0;
    }
    if (!cc.use_reg2) {
        cc.reg2 = tcg_const_tl(cc.imm);
2273 2274
    }

2275 2276
    tcg_gen_movcond_tl(cc.cond, cpu_T[0], cc.reg, cc.reg2,
                       cpu_T[0], cpu_regs[reg]);
2277
    gen_op_mov_reg_v(ot, reg, cpu_T[0]);
2278 2279 2280 2281 2282 2283 2284

    if (cc.mask != -1) {
        tcg_temp_free(cc.reg);
    }
    if (!cc.use_reg2) {
        tcg_temp_free(cc.reg2);
    }
2285 2286
}

2287 2288 2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300 2301 2302
static inline void gen_op_movl_T0_seg(int seg_reg)
{
    tcg_gen_ld32u_tl(cpu_T[0], cpu_env, 
                     offsetof(CPUX86State,segs[seg_reg].selector));
}

static inline void gen_op_movl_seg_T0_vm(int seg_reg)
{
    tcg_gen_andi_tl(cpu_T[0], cpu_T[0], 0xffff);
    tcg_gen_st32_tl(cpu_T[0], cpu_env, 
                    offsetof(CPUX86State,segs[seg_reg].selector));
    tcg_gen_shli_tl(cpu_T[0], cpu_T[0], 4);
    tcg_gen_st_tl(cpu_T[0], cpu_env, 
                  offsetof(CPUX86State,segs[seg_reg].base));
}

B
bellard 已提交
2303 2304
/* move T0 to seg_reg and compute if the CPU state may change. Never
   call this function with seg_reg == R_CS */
2305
static void gen_movl_seg_T0(DisasContext *s, int seg_reg)
B
bellard 已提交
2306
{
2307
    if (s->pe && !s->vm86) {
2308
        tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
2309
        gen_helper_load_seg(cpu_env, tcg_const_i32(seg_reg), cpu_tmp2_i32);
B
bellard 已提交
2310 2311 2312 2313 2314
        /* abort translation because the addseg value may change or
           because ss32 may change. For R_SS, translation must always
           stop as a special handling must be done to disable hardware
           interrupts for the next instruction */
        if (seg_reg == R_SS || (s->code32 && seg_reg < R_FS))
J
Jun Koi 已提交
2315
            s->is_jmp = DISAS_TB_JUMP;
2316
    } else {
2317
        gen_op_movl_seg_T0_vm(seg_reg);
B
bellard 已提交
2318
        if (seg_reg == R_SS)
J
Jun Koi 已提交
2319
            s->is_jmp = DISAS_TB_JUMP;
2320
    }
B
bellard 已提交
2321 2322
}

T
ths 已提交
2323 2324 2325 2326 2327
static inline int svm_is_rep(int prefixes)
{
    return ((prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) ? 8 : 0);
}

B
bellard 已提交
2328
static inline void
T
ths 已提交
2329
gen_svm_check_intercept_param(DisasContext *s, target_ulong pc_start,
2330
                              uint32_t type, uint64_t param)
T
ths 已提交
2331
{
B
bellard 已提交
2332 2333 2334
    /* no SVM activated; fast case */
    if (likely(!(s->flags & HF_SVMI_MASK)))
        return;
2335
    gen_update_cc_op(s);
B
bellard 已提交
2336
    gen_jmp_im(pc_start - s->cs_base);
B
Blue Swirl 已提交
2337
    gen_helper_svm_check_intercept_param(cpu_env, tcg_const_i32(type),
P
pbrook 已提交
2338
                                         tcg_const_i64(param));
T
ths 已提交
2339 2340
}

B
bellard 已提交
2341
static inline void
T
ths 已提交
2342 2343
gen_svm_check_intercept(DisasContext *s, target_ulong pc_start, uint64_t type)
{
B
bellard 已提交
2344
    gen_svm_check_intercept_param(s, pc_start, type, 0);
T
ths 已提交
2345 2346
}

2347 2348
static inline void gen_stack_update(DisasContext *s, int addend)
{
B
bellard 已提交
2349 2350
#ifdef TARGET_X86_64
    if (CODE64(s)) {
2351
        gen_op_add_reg_im(MO_64, R_ESP, addend);
B
bellard 已提交
2352 2353
    } else
#endif
2354
    if (s->ss32) {
2355
        gen_op_add_reg_im(MO_32, R_ESP, addend);
2356
    } else {
2357
        gen_op_add_reg_im(MO_16, R_ESP, addend);
2358 2359 2360
    }
}

2361 2362
/* Generate a push. It depends on ss32, addseg and dflag.  */
static void gen_push_v(DisasContext *s, TCGv val)
B
bellard 已提交
2363
{
2364 2365 2366 2367 2368
    TCGMemOp a_ot, d_ot = mo_pushpop(s, s->dflag);
    int size = 1 << d_ot;
    TCGv new_esp = cpu_A0;

    tcg_gen_subi_tl(cpu_A0, cpu_regs[R_ESP], size);
B
bellard 已提交
2369

B
bellard 已提交
2370
    if (CODE64(s)) {
2371 2372 2373 2374 2375 2376
        a_ot = MO_64;
    } else if (s->ss32) {
        a_ot = MO_32;
        if (s->addseg) {
            new_esp = cpu_tmp4;
            tcg_gen_mov_tl(new_esp, cpu_A0);
2377
            gen_op_addl_A0_seg(s, R_SS);
2378 2379
        } else {
            tcg_gen_ext32u_tl(cpu_A0, cpu_A0);
B
bellard 已提交
2380
        }
2381 2382 2383 2384 2385 2386
    } else {
        a_ot = MO_16;
        new_esp = cpu_tmp4;
        tcg_gen_ext16u_tl(cpu_A0, cpu_A0);
        tcg_gen_mov_tl(new_esp, cpu_A0);
        gen_op_addl_A0_seg(s, R_SS);
B
bellard 已提交
2387
    }
2388 2389 2390

    gen_op_st_v(s, d_ot, val, cpu_A0);
    gen_op_mov_reg_v(a_ot, R_ESP, new_esp);
B
bellard 已提交
2391 2392
}

2393
/* two step pop is necessary for precise exceptions */
2394
static TCGMemOp gen_pop_T0(DisasContext *s)
B
bellard 已提交
2395
{
2396 2397 2398
    TCGMemOp d_ot = mo_pushpop(s, s->dflag);
    TCGv addr = cpu_A0;

B
bellard 已提交
2399
    if (CODE64(s)) {
2400 2401 2402 2403 2404 2405 2406 2407 2408
        addr = cpu_regs[R_ESP];
    } else if (!s->ss32) {
        tcg_gen_ext16u_tl(cpu_A0, cpu_regs[R_ESP]);
        gen_op_addl_A0_seg(s, R_SS);
    } else if (s->addseg) {
        tcg_gen_mov_tl(cpu_A0, cpu_regs[R_ESP]);
        gen_op_addl_A0_seg(s, R_SS);
    } else {
        tcg_gen_ext32u_tl(cpu_A0, cpu_regs[R_ESP]);
B
bellard 已提交
2409
    }
2410 2411 2412

    gen_op_ld_v(s, d_ot, cpu_T[0], addr);
    return d_ot;
B
bellard 已提交
2413 2414
}

2415
static void gen_pop_update(DisasContext *s, TCGMemOp ot)
B
bellard 已提交
2416
{
2417
    gen_stack_update(s, 1 << ot);
B
bellard 已提交
2418 2419 2420 2421
}

static void gen_stack_A0(DisasContext *s)
{
B
bellard 已提交
2422
    gen_op_movl_A0_reg(R_ESP);
B
bellard 已提交
2423
    if (!s->ss32)
2424
        tcg_gen_ext16u_tl(cpu_A0, cpu_A0);
2425
    tcg_gen_mov_tl(cpu_T[1], cpu_A0);
B
bellard 已提交
2426
    if (s->addseg)
2427
        gen_op_addl_A0_seg(s, R_SS);
B
bellard 已提交
2428 2429 2430 2431 2432 2433
}

/* NOTE: wrap around in 16 bit not fully handled */
static void gen_pusha(DisasContext *s)
{
    int i;
B
bellard 已提交
2434
    gen_op_movl_A0_reg(R_ESP);
2435
    gen_op_addl_A0_im(-(8 << s->dflag));
B
bellard 已提交
2436
    if (!s->ss32)
2437
        tcg_gen_ext16u_tl(cpu_A0, cpu_A0);
2438
    tcg_gen_mov_tl(cpu_T[1], cpu_A0);
B
bellard 已提交
2439
    if (s->addseg)
2440
        gen_op_addl_A0_seg(s, R_SS);
B
bellard 已提交
2441
    for(i = 0;i < 8; i++) {
2442
        gen_op_mov_v_reg(MO_32, cpu_T[0], 7 - i);
2443 2444
        gen_op_st_v(s, s->dflag, cpu_T[0], cpu_A0);
        gen_op_addl_A0_im(1 << s->dflag);
B
bellard 已提交
2445
    }
2446
    gen_op_mov_reg_v(MO_16 + s->ss32, R_ESP, cpu_T[1]);
B
bellard 已提交
2447 2448 2449 2450 2451 2452
}

/* NOTE: wrap around in 16 bit not fully handled */
static void gen_popa(DisasContext *s)
{
    int i;
B
bellard 已提交
2453
    gen_op_movl_A0_reg(R_ESP);
B
bellard 已提交
2454
    if (!s->ss32)
2455
        tcg_gen_ext16u_tl(cpu_A0, cpu_A0);
2456
    tcg_gen_mov_tl(cpu_T[1], cpu_A0);
2457
    tcg_gen_addi_tl(cpu_T[1], cpu_T[1], 8 << s->dflag);
B
bellard 已提交
2458
    if (s->addseg)
2459
        gen_op_addl_A0_seg(s, R_SS);
B
bellard 已提交
2460 2461 2462
    for(i = 0;i < 8; i++) {
        /* ESP is not reloaded */
        if (i != 3) {
2463
            gen_op_ld_v(s, s->dflag, cpu_T[0], cpu_A0);
2464
            gen_op_mov_reg_v(s->dflag, 7 - i, cpu_T[0]);
B
bellard 已提交
2465
        }
2466
        gen_op_addl_A0_im(1 << s->dflag);
B
bellard 已提交
2467
    }
2468
    gen_op_mov_reg_v(MO_16 + s->ss32, R_ESP, cpu_T[1]);
B
bellard 已提交
2469 2470 2471 2472
}

static void gen_enter(DisasContext *s, int esp_addend, int level)
{
2473 2474
    TCGMemOp ot = mo_pushpop(s, s->dflag);
    int opsize = 1 << ot;
B
bellard 已提交
2475 2476

    level &= 0x1f;
2477 2478
#ifdef TARGET_X86_64
    if (CODE64(s)) {
B
bellard 已提交
2479
        gen_op_movl_A0_reg(R_ESP);
2480
        gen_op_addq_A0_im(-opsize);
2481
        tcg_gen_mov_tl(cpu_T[1], cpu_A0);
2482 2483

        /* push bp */
2484
        gen_op_mov_v_reg(MO_32, cpu_T[0], R_EBP);
2485
        gen_op_st_v(s, ot, cpu_T[0], cpu_A0);
2486
        if (level) {
B
bellard 已提交
2487
            /* XXX: must save state */
2488
            gen_helper_enter64_level(cpu_env, tcg_const_i32(level),
2489
                                     tcg_const_i32((ot == MO_64)),
P
pbrook 已提交
2490
                                     cpu_T[1]);
2491
        }
2492
        gen_op_mov_reg_v(ot, R_EBP, cpu_T[1]);
2493
        tcg_gen_addi_tl(cpu_T[1], cpu_T[1], -esp_addend + (-opsize * level));
2494
        gen_op_mov_reg_v(MO_64, R_ESP, cpu_T[1]);
2495
    } else
2496 2497
#endif
    {
B
bellard 已提交
2498
        gen_op_movl_A0_reg(R_ESP);
2499 2500
        gen_op_addl_A0_im(-opsize);
        if (!s->ss32)
2501
            tcg_gen_ext16u_tl(cpu_A0, cpu_A0);
2502
        tcg_gen_mov_tl(cpu_T[1], cpu_A0);
2503
        if (s->addseg)
2504
            gen_op_addl_A0_seg(s, R_SS);
2505
        /* push bp */
2506
        gen_op_mov_v_reg(MO_32, cpu_T[0], R_EBP);
2507
        gen_op_st_v(s, ot, cpu_T[0], cpu_A0);
2508
        if (level) {
B
bellard 已提交
2509
            /* XXX: must save state */
2510
            gen_helper_enter_level(cpu_env, tcg_const_i32(level),
2511
                                   tcg_const_i32(s->dflag - 1),
P
pbrook 已提交
2512
                                   cpu_T[1]);
2513
        }
2514
        gen_op_mov_reg_v(ot, R_EBP, cpu_T[1]);
2515
        tcg_gen_addi_tl(cpu_T[1], cpu_T[1], -esp_addend + (-opsize * level));
2516
        gen_op_mov_reg_v(MO_16 + s->ss32, R_ESP, cpu_T[1]);
B
bellard 已提交
2517 2518 2519
    }
}

B
bellard 已提交
2520
static void gen_exception(DisasContext *s, int trapno, target_ulong cur_eip)
B
bellard 已提交
2521
{
2522
    gen_update_cc_op(s);
B
bellard 已提交
2523
    gen_jmp_im(cur_eip);
B
Blue Swirl 已提交
2524
    gen_helper_raise_exception(cpu_env, tcg_const_i32(trapno));
J
Jun Koi 已提交
2525
    s->is_jmp = DISAS_TB_JUMP;
B
bellard 已提交
2526 2527 2528
}

/* an interrupt is different from an exception because of the
B
blueswir1 已提交
2529
   privilege checks */
2530
static void gen_interrupt(DisasContext *s, int intno,
B
bellard 已提交
2531
                          target_ulong cur_eip, target_ulong next_eip)
B
bellard 已提交
2532
{
2533
    gen_update_cc_op(s);
B
bellard 已提交
2534
    gen_jmp_im(cur_eip);
B
Blue Swirl 已提交
2535
    gen_helper_raise_interrupt(cpu_env, tcg_const_i32(intno),
P
pbrook 已提交
2536
                               tcg_const_i32(next_eip - cur_eip));
J
Jun Koi 已提交
2537
    s->is_jmp = DISAS_TB_JUMP;
B
bellard 已提交
2538 2539
}

B
bellard 已提交
2540
static void gen_debug(DisasContext *s, target_ulong cur_eip)
B
bellard 已提交
2541
{
2542
    gen_update_cc_op(s);
B
bellard 已提交
2543
    gen_jmp_im(cur_eip);
B
Blue Swirl 已提交
2544
    gen_helper_debug(cpu_env);
J
Jun Koi 已提交
2545
    s->is_jmp = DISAS_TB_JUMP;
B
bellard 已提交
2546 2547 2548 2549 2550 2551
}

/* generate a generic end of block. Trace exception is also generated
   if needed */
static void gen_eob(DisasContext *s)
{
2552
    gen_update_cc_op(s);
2553
    if (s->tb->flags & HF_INHIBIT_IRQ_MASK) {
2554
        gen_helper_reset_inhibit_irq(cpu_env);
2555
    }
J
Jan Kiszka 已提交
2556
    if (s->tb->flags & HF_RF_MASK) {
2557
        gen_helper_reset_rf(cpu_env);
J
Jan Kiszka 已提交
2558
    }
2559
    if (s->singlestep_enabled) {
B
Blue Swirl 已提交
2560
        gen_helper_debug(cpu_env);
2561
    } else if (s->tf) {
B
Blue Swirl 已提交
2562
        gen_helper_single_step(cpu_env);
B
bellard 已提交
2563
    } else {
B
bellard 已提交
2564
        tcg_gen_exit_tb(0);
B
bellard 已提交
2565
    }
J
Jun Koi 已提交
2566
    s->is_jmp = DISAS_TB_JUMP;
B
bellard 已提交
2567 2568 2569 2570
}

/* generate a jump to eip. No segment change must happen before as a
   direct call to the next block may occur */
B
bellard 已提交
2571
static void gen_jmp_tb(DisasContext *s, target_ulong eip, int tb_num)
B
bellard 已提交
2572
{
2573 2574
    gen_update_cc_op(s);
    set_cc_op(s, CC_OP_DYNAMIC);
B
bellard 已提交
2575
    if (s->jmp_opt) {
2576
        gen_goto_tb(s, tb_num, eip);
J
Jun Koi 已提交
2577
        s->is_jmp = DISAS_TB_JUMP;
B
bellard 已提交
2578
    } else {
B
bellard 已提交
2579
        gen_jmp_im(eip);
B
bellard 已提交
2580 2581 2582 2583
        gen_eob(s);
    }
}

B
bellard 已提交
2584 2585 2586 2587 2588
static void gen_jmp(DisasContext *s, target_ulong eip)
{
    gen_jmp_tb(s, eip, 0);
}

2589
static inline void gen_ldq_env_A0(DisasContext *s, int offset)
B
bellard 已提交
2590
{
2591
    tcg_gen_qemu_ld_i64(cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ);
2592
    tcg_gen_st_i64(cpu_tmp1_i64, cpu_env, offset);
B
bellard 已提交
2593
}
B
bellard 已提交
2594

2595
static inline void gen_stq_env_A0(DisasContext *s, int offset)
B
bellard 已提交
2596
{
2597
    tcg_gen_ld_i64(cpu_tmp1_i64, cpu_env, offset);
2598
    tcg_gen_qemu_st_i64(cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ);
B
bellard 已提交
2599
}
B
bellard 已提交
2600

2601
static inline void gen_ldo_env_A0(DisasContext *s, int offset)
B
bellard 已提交
2602
{
2603
    int mem_index = s->mem_index;
2604
    tcg_gen_qemu_ld_i64(cpu_tmp1_i64, cpu_A0, mem_index, MO_LEQ);
2605
    tcg_gen_st_i64(cpu_tmp1_i64, cpu_env, offset + offsetof(XMMReg, XMM_Q(0)));
B
bellard 已提交
2606
    tcg_gen_addi_tl(cpu_tmp0, cpu_A0, 8);
2607
    tcg_gen_qemu_ld_i64(cpu_tmp1_i64, cpu_tmp0, mem_index, MO_LEQ);
2608
    tcg_gen_st_i64(cpu_tmp1_i64, cpu_env, offset + offsetof(XMMReg, XMM_Q(1)));
B
bellard 已提交
2609
}
B
bellard 已提交
2610

2611
static inline void gen_sto_env_A0(DisasContext *s, int offset)
B
bellard 已提交
2612
{
2613
    int mem_index = s->mem_index;
2614
    tcg_gen_ld_i64(cpu_tmp1_i64, cpu_env, offset + offsetof(XMMReg, XMM_Q(0)));
2615
    tcg_gen_qemu_st_i64(cpu_tmp1_i64, cpu_A0, mem_index, MO_LEQ);
B
bellard 已提交
2616
    tcg_gen_addi_tl(cpu_tmp0, cpu_A0, 8);
2617
    tcg_gen_ld_i64(cpu_tmp1_i64, cpu_env, offset + offsetof(XMMReg, XMM_Q(1)));
2618
    tcg_gen_qemu_st_i64(cpu_tmp1_i64, cpu_tmp0, mem_index, MO_LEQ);
B
bellard 已提交
2619
}
B
bellard 已提交
2620

B
bellard 已提交
2621 2622
static inline void gen_op_movo(int d_offset, int s_offset)
{
2623 2624 2625 2626
    tcg_gen_ld_i64(cpu_tmp1_i64, cpu_env, s_offset + offsetof(XMMReg, XMM_Q(0)));
    tcg_gen_st_i64(cpu_tmp1_i64, cpu_env, d_offset + offsetof(XMMReg, XMM_Q(0)));
    tcg_gen_ld_i64(cpu_tmp1_i64, cpu_env, s_offset + offsetof(XMMReg, XMM_Q(1)));
    tcg_gen_st_i64(cpu_tmp1_i64, cpu_env, d_offset + offsetof(XMMReg, XMM_Q(1)));
B
bellard 已提交
2627 2628 2629 2630
}

static inline void gen_op_movq(int d_offset, int s_offset)
{
2631 2632
    tcg_gen_ld_i64(cpu_tmp1_i64, cpu_env, s_offset);
    tcg_gen_st_i64(cpu_tmp1_i64, cpu_env, d_offset);
B
bellard 已提交
2633 2634 2635 2636
}

static inline void gen_op_movl(int d_offset, int s_offset)
{
2637 2638
    tcg_gen_ld_i32(cpu_tmp2_i32, cpu_env, s_offset);
    tcg_gen_st_i32(cpu_tmp2_i32, cpu_env, d_offset);
B
bellard 已提交
2639 2640 2641 2642
}

static inline void gen_op_movq_env_0(int d_offset)
{
2643 2644
    tcg_gen_movi_i64(cpu_tmp1_i64, 0);
    tcg_gen_st_i64(cpu_tmp1_i64, cpu_env, d_offset);
B
bellard 已提交
2645
}
B
bellard 已提交
2646

B
Blue Swirl 已提交
2647 2648 2649 2650 2651 2652 2653
typedef void (*SSEFunc_i_ep)(TCGv_i32 val, TCGv_ptr env, TCGv_ptr reg);
typedef void (*SSEFunc_l_ep)(TCGv_i64 val, TCGv_ptr env, TCGv_ptr reg);
typedef void (*SSEFunc_0_epi)(TCGv_ptr env, TCGv_ptr reg, TCGv_i32 val);
typedef void (*SSEFunc_0_epl)(TCGv_ptr env, TCGv_ptr reg, TCGv_i64 val);
typedef void (*SSEFunc_0_epp)(TCGv_ptr env, TCGv_ptr reg_a, TCGv_ptr reg_b);
typedef void (*SSEFunc_0_eppi)(TCGv_ptr env, TCGv_ptr reg_a, TCGv_ptr reg_b,
                               TCGv_i32 val);
B
Blue Swirl 已提交
2654
typedef void (*SSEFunc_0_ppi)(TCGv_ptr reg_a, TCGv_ptr reg_b, TCGv_i32 val);
B
Blue Swirl 已提交
2655 2656
typedef void (*SSEFunc_0_eppt)(TCGv_ptr env, TCGv_ptr reg_a, TCGv_ptr reg_b,
                               TCGv val);
B
Blue Swirl 已提交
2657

B
bellard 已提交
2658 2659
#define SSE_SPECIAL ((void *)1)
#define SSE_DUMMY ((void *)2)
B
bellard 已提交
2660

P
pbrook 已提交
2661 2662 2663
#define MMX_OP2(x) { gen_helper_ ## x ## _mmx, gen_helper_ ## x ## _xmm }
#define SSE_FOP(x) { gen_helper_ ## x ## ps, gen_helper_ ## x ## pd, \
                     gen_helper_ ## x ## ss, gen_helper_ ## x ## sd, }
B
bellard 已提交
2664

B
Blue Swirl 已提交
2665
static const SSEFunc_0_epp sse_op_table1[256][4] = {
A
aurel32 已提交
2666 2667 2668
    /* 3DNow! extensions */
    [0x0e] = { SSE_DUMMY }, /* femms */
    [0x0f] = { SSE_DUMMY }, /* pf... */
B
bellard 已提交
2669 2670 2671
    /* pure SSE operations */
    [0x10] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* movups, movupd, movss, movsd */
    [0x11] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* movups, movupd, movss, movsd */
B
bellard 已提交
2672
    [0x12] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* movlps, movlpd, movsldup, movddup */
B
bellard 已提交
2673
    [0x13] = { SSE_SPECIAL, SSE_SPECIAL },  /* movlps, movlpd */
P
pbrook 已提交
2674 2675
    [0x14] = { gen_helper_punpckldq_xmm, gen_helper_punpcklqdq_xmm },
    [0x15] = { gen_helper_punpckhdq_xmm, gen_helper_punpckhqdq_xmm },
B
bellard 已提交
2676 2677 2678 2679 2680 2681
    [0x16] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL },  /* movhps, movhpd, movshdup */
    [0x17] = { SSE_SPECIAL, SSE_SPECIAL },  /* movhps, movhpd */

    [0x28] = { SSE_SPECIAL, SSE_SPECIAL },  /* movaps, movapd */
    [0x29] = { SSE_SPECIAL, SSE_SPECIAL },  /* movaps, movapd */
    [0x2a] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* cvtpi2ps, cvtpi2pd, cvtsi2ss, cvtsi2sd */
2682
    [0x2b] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* movntps, movntpd, movntss, movntsd */
B
bellard 已提交
2683 2684
    [0x2c] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* cvttps2pi, cvttpd2pi, cvttsd2si, cvttss2si */
    [0x2d] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* cvtps2pi, cvtpd2pi, cvtsd2si, cvtss2si */
P
pbrook 已提交
2685 2686
    [0x2e] = { gen_helper_ucomiss, gen_helper_ucomisd },
    [0x2f] = { gen_helper_comiss, gen_helper_comisd },
B
bellard 已提交
2687 2688
    [0x50] = { SSE_SPECIAL, SSE_SPECIAL }, /* movmskps, movmskpd */
    [0x51] = SSE_FOP(sqrt),
P
pbrook 已提交
2689 2690 2691 2692 2693 2694
    [0x52] = { gen_helper_rsqrtps, NULL, gen_helper_rsqrtss, NULL },
    [0x53] = { gen_helper_rcpps, NULL, gen_helper_rcpss, NULL },
    [0x54] = { gen_helper_pand_xmm, gen_helper_pand_xmm }, /* andps, andpd */
    [0x55] = { gen_helper_pandn_xmm, gen_helper_pandn_xmm }, /* andnps, andnpd */
    [0x56] = { gen_helper_por_xmm, gen_helper_por_xmm }, /* orps, orpd */
    [0x57] = { gen_helper_pxor_xmm, gen_helper_pxor_xmm }, /* xorps, xorpd */
B
bellard 已提交
2695 2696
    [0x58] = SSE_FOP(add),
    [0x59] = SSE_FOP(mul),
P
pbrook 已提交
2697 2698 2699
    [0x5a] = { gen_helper_cvtps2pd, gen_helper_cvtpd2ps,
               gen_helper_cvtss2sd, gen_helper_cvtsd2ss },
    [0x5b] = { gen_helper_cvtdq2ps, gen_helper_cvtps2dq, gen_helper_cvttps2dq },
B
bellard 已提交
2700 2701 2702 2703 2704 2705
    [0x5c] = SSE_FOP(sub),
    [0x5d] = SSE_FOP(min),
    [0x5e] = SSE_FOP(div),
    [0x5f] = SSE_FOP(max),

    [0xc2] = SSE_FOP(cmpeq),
B
Blue Swirl 已提交
2706 2707
    [0xc6] = { (SSEFunc_0_epp)gen_helper_shufps,
               (SSEFunc_0_epp)gen_helper_shufpd }, /* XXX: casts */
B
bellard 已提交
2708

R
Richard Henderson 已提交
2709 2710 2711
    /* SSSE3, SSE4, MOVBE, CRC32, BMI1, BMI2, ADX.  */
    [0x38] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL },
    [0x3a] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL },
B
balrog 已提交
2712

B
bellard 已提交
2713 2714 2715 2716 2717 2718 2719 2720 2721 2722 2723 2724 2725
    /* MMX ops and their SSE extensions */
    [0x60] = MMX_OP2(punpcklbw),
    [0x61] = MMX_OP2(punpcklwd),
    [0x62] = MMX_OP2(punpckldq),
    [0x63] = MMX_OP2(packsswb),
    [0x64] = MMX_OP2(pcmpgtb),
    [0x65] = MMX_OP2(pcmpgtw),
    [0x66] = MMX_OP2(pcmpgtl),
    [0x67] = MMX_OP2(packuswb),
    [0x68] = MMX_OP2(punpckhbw),
    [0x69] = MMX_OP2(punpckhwd),
    [0x6a] = MMX_OP2(punpckhdq),
    [0x6b] = MMX_OP2(packssdw),
P
pbrook 已提交
2726 2727
    [0x6c] = { NULL, gen_helper_punpcklqdq_xmm },
    [0x6d] = { NULL, gen_helper_punpckhqdq_xmm },
B
bellard 已提交
2728 2729
    [0x6e] = { SSE_SPECIAL, SSE_SPECIAL }, /* movd mm, ea */
    [0x6f] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* movq, movdqa, , movqdu */
B
Blue Swirl 已提交
2730 2731 2732 2733
    [0x70] = { (SSEFunc_0_epp)gen_helper_pshufw_mmx,
               (SSEFunc_0_epp)gen_helper_pshufd_xmm,
               (SSEFunc_0_epp)gen_helper_pshufhw_xmm,
               (SSEFunc_0_epp)gen_helper_pshuflw_xmm }, /* XXX: casts */
B
bellard 已提交
2734 2735 2736 2737 2738 2739
    [0x71] = { SSE_SPECIAL, SSE_SPECIAL }, /* shiftw */
    [0x72] = { SSE_SPECIAL, SSE_SPECIAL }, /* shiftd */
    [0x73] = { SSE_SPECIAL, SSE_SPECIAL }, /* shiftq */
    [0x74] = MMX_OP2(pcmpeqb),
    [0x75] = MMX_OP2(pcmpeqw),
    [0x76] = MMX_OP2(pcmpeql),
A
aurel32 已提交
2740
    [0x77] = { SSE_DUMMY }, /* emms */
2741 2742
    [0x78] = { NULL, SSE_SPECIAL, NULL, SSE_SPECIAL }, /* extrq_i, insertq_i */
    [0x79] = { NULL, gen_helper_extrq_r, NULL, gen_helper_insertq_r },
P
pbrook 已提交
2743 2744
    [0x7c] = { NULL, gen_helper_haddpd, NULL, gen_helper_haddps },
    [0x7d] = { NULL, gen_helper_hsubpd, NULL, gen_helper_hsubps },
B
bellard 已提交
2745 2746 2747 2748
    [0x7e] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* movd, movd, , movq */
    [0x7f] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* movq, movdqa, movdqu */
    [0xc4] = { SSE_SPECIAL, SSE_SPECIAL }, /* pinsrw */
    [0xc5] = { SSE_SPECIAL, SSE_SPECIAL }, /* pextrw */
P
pbrook 已提交
2749
    [0xd0] = { NULL, gen_helper_addsubpd, NULL, gen_helper_addsubps },
B
bellard 已提交
2750 2751 2752 2753 2754 2755 2756 2757 2758 2759 2760 2761 2762 2763 2764 2765 2766 2767 2768 2769 2770
    [0xd1] = MMX_OP2(psrlw),
    [0xd2] = MMX_OP2(psrld),
    [0xd3] = MMX_OP2(psrlq),
    [0xd4] = MMX_OP2(paddq),
    [0xd5] = MMX_OP2(pmullw),
    [0xd6] = { NULL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL },
    [0xd7] = { SSE_SPECIAL, SSE_SPECIAL }, /* pmovmskb */
    [0xd8] = MMX_OP2(psubusb),
    [0xd9] = MMX_OP2(psubusw),
    [0xda] = MMX_OP2(pminub),
    [0xdb] = MMX_OP2(pand),
    [0xdc] = MMX_OP2(paddusb),
    [0xdd] = MMX_OP2(paddusw),
    [0xde] = MMX_OP2(pmaxub),
    [0xdf] = MMX_OP2(pandn),
    [0xe0] = MMX_OP2(pavgb),
    [0xe1] = MMX_OP2(psraw),
    [0xe2] = MMX_OP2(psrad),
    [0xe3] = MMX_OP2(pavgw),
    [0xe4] = MMX_OP2(pmulhuw),
    [0xe5] = MMX_OP2(pmulhw),
P
pbrook 已提交
2771
    [0xe6] = { NULL, gen_helper_cvttpd2dq, gen_helper_cvtdq2pd, gen_helper_cvtpd2dq },
B
bellard 已提交
2772 2773 2774 2775 2776 2777 2778 2779 2780
    [0xe7] = { SSE_SPECIAL , SSE_SPECIAL },  /* movntq, movntq */
    [0xe8] = MMX_OP2(psubsb),
    [0xe9] = MMX_OP2(psubsw),
    [0xea] = MMX_OP2(pminsw),
    [0xeb] = MMX_OP2(por),
    [0xec] = MMX_OP2(paddsb),
    [0xed] = MMX_OP2(paddsw),
    [0xee] = MMX_OP2(pmaxsw),
    [0xef] = MMX_OP2(pxor),
B
bellard 已提交
2781
    [0xf0] = { NULL, NULL, NULL, SSE_SPECIAL }, /* lddqu */
B
bellard 已提交
2782 2783 2784 2785 2786 2787
    [0xf1] = MMX_OP2(psllw),
    [0xf2] = MMX_OP2(pslld),
    [0xf3] = MMX_OP2(psllq),
    [0xf4] = MMX_OP2(pmuludq),
    [0xf5] = MMX_OP2(pmaddwd),
    [0xf6] = MMX_OP2(psadbw),
B
Blue Swirl 已提交
2788 2789
    [0xf7] = { (SSEFunc_0_epp)gen_helper_maskmov_mmx,
               (SSEFunc_0_epp)gen_helper_maskmov_xmm }, /* XXX: casts */
B
bellard 已提交
2790 2791 2792 2793 2794 2795 2796 2797 2798
    [0xf8] = MMX_OP2(psubb),
    [0xf9] = MMX_OP2(psubw),
    [0xfa] = MMX_OP2(psubl),
    [0xfb] = MMX_OP2(psubq),
    [0xfc] = MMX_OP2(paddb),
    [0xfd] = MMX_OP2(paddw),
    [0xfe] = MMX_OP2(paddl),
};

B
Blue Swirl 已提交
2799
static const SSEFunc_0_epp sse_op_table2[3 * 8][2] = {
B
bellard 已提交
2800 2801 2802 2803 2804 2805 2806
    [0 + 2] = MMX_OP2(psrlw),
    [0 + 4] = MMX_OP2(psraw),
    [0 + 6] = MMX_OP2(psllw),
    [8 + 2] = MMX_OP2(psrld),
    [8 + 4] = MMX_OP2(psrad),
    [8 + 6] = MMX_OP2(pslld),
    [16 + 2] = MMX_OP2(psrlq),
P
pbrook 已提交
2807
    [16 + 3] = { NULL, gen_helper_psrldq_xmm },
B
bellard 已提交
2808
    [16 + 6] = MMX_OP2(psllq),
P
pbrook 已提交
2809
    [16 + 7] = { NULL, gen_helper_pslldq_xmm },
B
bellard 已提交
2810 2811
};

B
Blue Swirl 已提交
2812
static const SSEFunc_0_epi sse_op_table3ai[] = {
P
pbrook 已提交
2813
    gen_helper_cvtsi2ss,
2814
    gen_helper_cvtsi2sd
B
Blue Swirl 已提交
2815
};
P
pbrook 已提交
2816

2817
#ifdef TARGET_X86_64
B
Blue Swirl 已提交
2818
static const SSEFunc_0_epl sse_op_table3aq[] = {
2819 2820 2821 2822 2823
    gen_helper_cvtsq2ss,
    gen_helper_cvtsq2sd
};
#endif

B
Blue Swirl 已提交
2824
static const SSEFunc_i_ep sse_op_table3bi[] = {
P
pbrook 已提交
2825 2826
    gen_helper_cvttss2si,
    gen_helper_cvtss2si,
2827
    gen_helper_cvttsd2si,
2828
    gen_helper_cvtsd2si
B
bellard 已提交
2829
};
2830

2831
#ifdef TARGET_X86_64
B
Blue Swirl 已提交
2832
static const SSEFunc_l_ep sse_op_table3bq[] = {
2833 2834
    gen_helper_cvttss2sq,
    gen_helper_cvtss2sq,
2835
    gen_helper_cvttsd2sq,
2836 2837 2838 2839
    gen_helper_cvtsd2sq
};
#endif

B
Blue Swirl 已提交
2840
static const SSEFunc_0_epp sse_op_table4[8][4] = {
B
bellard 已提交
2841 2842 2843 2844 2845 2846 2847 2848 2849
    SSE_FOP(cmpeq),
    SSE_FOP(cmplt),
    SSE_FOP(cmple),
    SSE_FOP(cmpunord),
    SSE_FOP(cmpneq),
    SSE_FOP(cmpnlt),
    SSE_FOP(cmpnle),
    SSE_FOP(cmpord),
};
2850

B
Blue Swirl 已提交
2851
static const SSEFunc_0_epp sse_op_table5[256] = {
P
pbrook 已提交
2852 2853 2854 2855 2856 2857 2858 2859 2860 2861 2862 2863 2864 2865 2866 2867 2868 2869 2870 2871 2872 2873 2874 2875
    [0x0c] = gen_helper_pi2fw,
    [0x0d] = gen_helper_pi2fd,
    [0x1c] = gen_helper_pf2iw,
    [0x1d] = gen_helper_pf2id,
    [0x8a] = gen_helper_pfnacc,
    [0x8e] = gen_helper_pfpnacc,
    [0x90] = gen_helper_pfcmpge,
    [0x94] = gen_helper_pfmin,
    [0x96] = gen_helper_pfrcp,
    [0x97] = gen_helper_pfrsqrt,
    [0x9a] = gen_helper_pfsub,
    [0x9e] = gen_helper_pfadd,
    [0xa0] = gen_helper_pfcmpgt,
    [0xa4] = gen_helper_pfmax,
    [0xa6] = gen_helper_movq, /* pfrcpit1; no need to actually increase precision */
    [0xa7] = gen_helper_movq, /* pfrsqit1 */
    [0xaa] = gen_helper_pfsubr,
    [0xae] = gen_helper_pfacc,
    [0xb0] = gen_helper_pfcmpeq,
    [0xb4] = gen_helper_pfmul,
    [0xb6] = gen_helper_movq, /* pfrcpit2 */
    [0xb7] = gen_helper_pmulhrw_mmx,
    [0xbb] = gen_helper_pswapd,
    [0xbf] = gen_helper_pavgb_mmx /* pavgusb */
A
aurel32 已提交
2876 2877
};

B
Blue Swirl 已提交
2878 2879
struct SSEOpHelper_epp {
    SSEFunc_0_epp op[2];
B
Blue Swirl 已提交
2880 2881 2882
    uint32_t ext_mask;
};

B
Blue Swirl 已提交
2883 2884
struct SSEOpHelper_eppi {
    SSEFunc_0_eppi op[2];
B
Blue Swirl 已提交
2885
    uint32_t ext_mask;
B
balrog 已提交
2886
};
B
Blue Swirl 已提交
2887

B
balrog 已提交
2888
#define SSSE3_OP(x) { MMX_OP2(x), CPUID_EXT_SSSE3 }
P
pbrook 已提交
2889 2890
#define SSE41_OP(x) { { NULL, gen_helper_ ## x ## _xmm }, CPUID_EXT_SSE41 }
#define SSE42_OP(x) { { NULL, gen_helper_ ## x ## _xmm }, CPUID_EXT_SSE42 }
B
balrog 已提交
2891
#define SSE41_SPECIAL { { NULL, SSE_SPECIAL }, CPUID_EXT_SSE41 }
2892 2893
#define PCLMULQDQ_OP(x) { { NULL, gen_helper_ ## x ## _xmm }, \
        CPUID_EXT_PCLMULQDQ }
2894
#define AESNI_OP(x) { { NULL, gen_helper_ ## x ## _xmm }, CPUID_EXT_AES }
B
Blue Swirl 已提交
2895

B
Blue Swirl 已提交
2896
static const struct SSEOpHelper_epp sse_op_table6[256] = {
B
balrog 已提交
2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913 2914 2915 2916 2917 2918 2919 2920 2921 2922 2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942
    [0x00] = SSSE3_OP(pshufb),
    [0x01] = SSSE3_OP(phaddw),
    [0x02] = SSSE3_OP(phaddd),
    [0x03] = SSSE3_OP(phaddsw),
    [0x04] = SSSE3_OP(pmaddubsw),
    [0x05] = SSSE3_OP(phsubw),
    [0x06] = SSSE3_OP(phsubd),
    [0x07] = SSSE3_OP(phsubsw),
    [0x08] = SSSE3_OP(psignb),
    [0x09] = SSSE3_OP(psignw),
    [0x0a] = SSSE3_OP(psignd),
    [0x0b] = SSSE3_OP(pmulhrsw),
    [0x10] = SSE41_OP(pblendvb),
    [0x14] = SSE41_OP(blendvps),
    [0x15] = SSE41_OP(blendvpd),
    [0x17] = SSE41_OP(ptest),
    [0x1c] = SSSE3_OP(pabsb),
    [0x1d] = SSSE3_OP(pabsw),
    [0x1e] = SSSE3_OP(pabsd),
    [0x20] = SSE41_OP(pmovsxbw),
    [0x21] = SSE41_OP(pmovsxbd),
    [0x22] = SSE41_OP(pmovsxbq),
    [0x23] = SSE41_OP(pmovsxwd),
    [0x24] = SSE41_OP(pmovsxwq),
    [0x25] = SSE41_OP(pmovsxdq),
    [0x28] = SSE41_OP(pmuldq),
    [0x29] = SSE41_OP(pcmpeqq),
    [0x2a] = SSE41_SPECIAL, /* movntqda */
    [0x2b] = SSE41_OP(packusdw),
    [0x30] = SSE41_OP(pmovzxbw),
    [0x31] = SSE41_OP(pmovzxbd),
    [0x32] = SSE41_OP(pmovzxbq),
    [0x33] = SSE41_OP(pmovzxwd),
    [0x34] = SSE41_OP(pmovzxwq),
    [0x35] = SSE41_OP(pmovzxdq),
    [0x37] = SSE42_OP(pcmpgtq),
    [0x38] = SSE41_OP(pminsb),
    [0x39] = SSE41_OP(pminsd),
    [0x3a] = SSE41_OP(pminuw),
    [0x3b] = SSE41_OP(pminud),
    [0x3c] = SSE41_OP(pmaxsb),
    [0x3d] = SSE41_OP(pmaxsd),
    [0x3e] = SSE41_OP(pmaxuw),
    [0x3f] = SSE41_OP(pmaxud),
    [0x40] = SSE41_OP(pmulld),
    [0x41] = SSE41_OP(phminposuw),
2943 2944 2945 2946 2947
    [0xdb] = AESNI_OP(aesimc),
    [0xdc] = AESNI_OP(aesenc),
    [0xdd] = AESNI_OP(aesenclast),
    [0xde] = AESNI_OP(aesdec),
    [0xdf] = AESNI_OP(aesdeclast),
B
balrog 已提交
2948 2949
};

B
Blue Swirl 已提交
2950
static const struct SSEOpHelper_eppi sse_op_table7[256] = {
B
balrog 已提交
2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965 2966 2967 2968
    [0x08] = SSE41_OP(roundps),
    [0x09] = SSE41_OP(roundpd),
    [0x0a] = SSE41_OP(roundss),
    [0x0b] = SSE41_OP(roundsd),
    [0x0c] = SSE41_OP(blendps),
    [0x0d] = SSE41_OP(blendpd),
    [0x0e] = SSE41_OP(pblendw),
    [0x0f] = SSSE3_OP(palignr),
    [0x14] = SSE41_SPECIAL, /* pextrb */
    [0x15] = SSE41_SPECIAL, /* pextrw */
    [0x16] = SSE41_SPECIAL, /* pextrd/pextrq */
    [0x17] = SSE41_SPECIAL, /* extractps */
    [0x20] = SSE41_SPECIAL, /* pinsrb */
    [0x21] = SSE41_SPECIAL, /* insertps */
    [0x22] = SSE41_SPECIAL, /* pinsrd/pinsrq */
    [0x40] = SSE41_OP(dpps),
    [0x41] = SSE41_OP(dppd),
    [0x42] = SSE41_OP(mpsadbw),
2969
    [0x44] = PCLMULQDQ_OP(pclmulqdq),
B
balrog 已提交
2970 2971 2972 2973
    [0x60] = SSE42_OP(pcmpestrm),
    [0x61] = SSE42_OP(pcmpestri),
    [0x62] = SSE42_OP(pcmpistrm),
    [0x63] = SSE42_OP(pcmpistri),
2974
    [0xdf] = AESNI_OP(aeskeygenassist),
B
balrog 已提交
2975 2976
};

2977 2978
static void gen_sse(CPUX86State *env, DisasContext *s, int b,
                    target_ulong pc_start, int rex_r)
B
bellard 已提交
2979
{
2980
    int b1, op1_offset, op2_offset, is_xmm, val;
2981
    int modrm, mod, rm, reg;
B
Blue Swirl 已提交
2982 2983
    SSEFunc_0_epp sse_fn_epp;
    SSEFunc_0_eppi sse_fn_eppi;
B
Blue Swirl 已提交
2984
    SSEFunc_0_ppi sse_fn_ppi;
B
Blue Swirl 已提交
2985
    SSEFunc_0_eppt sse_fn_eppt;
2986
    TCGMemOp ot;
B
bellard 已提交
2987 2988

    b &= 0xff;
2989
    if (s->prefix & PREFIX_DATA)
B
bellard 已提交
2990
        b1 = 1;
2991
    else if (s->prefix & PREFIX_REPZ)
B
bellard 已提交
2992
        b1 = 2;
2993
    else if (s->prefix & PREFIX_REPNZ)
B
bellard 已提交
2994 2995 2996
        b1 = 3;
    else
        b1 = 0;
B
Blue Swirl 已提交
2997 2998
    sse_fn_epp = sse_op_table1[b][b1];
    if (!sse_fn_epp) {
B
bellard 已提交
2999
        goto illegal_op;
B
Blue Swirl 已提交
3000
    }
A
aurel32 已提交
3001
    if ((b <= 0x5f && b >= 0x10) || b == 0xc6 || b == 0xc2) {
B
bellard 已提交
3002 3003 3004 3005 3006 3007 3008 3009 3010 3011 3012 3013 3014 3015 3016 3017 3018 3019 3020 3021
        is_xmm = 1;
    } else {
        if (b1 == 0) {
            /* MMX case */
            is_xmm = 0;
        } else {
            is_xmm = 1;
        }
    }
    /* simple MMX/SSE operation */
    if (s->flags & HF_TS_MASK) {
        gen_exception(s, EXCP07_PREX, pc_start - s->cs_base);
        return;
    }
    if (s->flags & HF_EM_MASK) {
    illegal_op:
        gen_exception(s, EXCP06_ILLOP, pc_start - s->cs_base);
        return;
    }
    if (is_xmm && !(s->flags & HF_OSFXSR_MASK))
B
balrog 已提交
3022 3023
        if ((b != 0x38 && b != 0x3a) || (s->prefix & PREFIX_DATA))
            goto illegal_op;
3024 3025 3026 3027
    if (b == 0x0e) {
        if (!(s->cpuid_ext2_features & CPUID_EXT2_3DNOW))
            goto illegal_op;
        /* femms */
B
Blue Swirl 已提交
3028
        gen_helper_emms(cpu_env);
3029 3030 3031 3032
        return;
    }
    if (b == 0x77) {
        /* emms */
B
Blue Swirl 已提交
3033
        gen_helper_emms(cpu_env);
B
bellard 已提交
3034 3035 3036 3037 3038
        return;
    }
    /* prepare MMX state (XXX: optimize by storing fptt and fptags in
       the static cpu state) */
    if (!is_xmm) {
B
Blue Swirl 已提交
3039
        gen_helper_enter_mmx(cpu_env);
B
bellard 已提交
3040 3041
    }

3042
    modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
3043 3044 3045 3046
    reg = ((modrm >> 3) & 7);
    if (is_xmm)
        reg |= rex_r;
    mod = (modrm >> 6) & 3;
B
Blue Swirl 已提交
3047
    if (sse_fn_epp == SSE_SPECIAL) {
B
bellard 已提交
3048 3049 3050
        b |= (b1 << 8);
        switch(b) {
        case 0x0e7: /* movntq */
3051
            if (mod == 3)
B
bellard 已提交
3052
                goto illegal_op;
3053
            gen_lea_modrm(env, s, modrm);
3054
            gen_stq_env_A0(s, offsetof(CPUX86State, fpregs[reg].mmx));
B
bellard 已提交
3055 3056 3057 3058
            break;
        case 0x1e7: /* movntdq */
        case 0x02b: /* movntps */
        case 0x12b: /* movntps */
3059 3060
            if (mod == 3)
                goto illegal_op;
3061
            gen_lea_modrm(env, s, modrm);
3062
            gen_sto_env_A0(s, offsetof(CPUX86State, xmm_regs[reg]));
3063
            break;
B
bellard 已提交
3064 3065
        case 0x3f0: /* lddqu */
            if (mod == 3)
B
bellard 已提交
3066
                goto illegal_op;
3067
            gen_lea_modrm(env, s, modrm);
3068
            gen_ldo_env_A0(s, offsetof(CPUX86State, xmm_regs[reg]));
B
bellard 已提交
3069
            break;
3070 3071 3072 3073
        case 0x22b: /* movntss */
        case 0x32b: /* movntsd */
            if (mod == 3)
                goto illegal_op;
3074
            gen_lea_modrm(env, s, modrm);
3075
            if (b1 & 1) {
3076 3077
                gen_stq_env_A0(s, offsetof(CPUX86State,
                                           xmm_regs[reg].XMM_Q(0)));
3078 3079 3080
            } else {
                tcg_gen_ld32u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,
                    xmm_regs[reg].XMM_L(0)));
3081
                gen_op_st_v(s, MO_32, cpu_T[0], cpu_A0);
3082 3083
            }
            break;
B
bellard 已提交
3084
        case 0x6e: /* movd mm, ea */
B
bellard 已提交
3085
#ifdef TARGET_X86_64
3086
            if (s->dflag == MO_64) {
3087
                gen_ldst_modrm(env, s, modrm, MO_64, OR_TMP0, 0);
B
bellard 已提交
3088
                tcg_gen_st_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,fpregs[reg].mmx));
3089
            } else
B
bellard 已提交
3090 3091
#endif
            {
3092
                gen_ldst_modrm(env, s, modrm, MO_32, OR_TMP0, 0);
B
bellard 已提交
3093 3094
                tcg_gen_addi_ptr(cpu_ptr0, cpu_env, 
                                 offsetof(CPUX86State,fpregs[reg].mmx));
P
pbrook 已提交
3095 3096
                tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
                gen_helper_movl_mm_T0_mmx(cpu_ptr0, cpu_tmp2_i32);
B
bellard 已提交
3097
            }
B
bellard 已提交
3098 3099
            break;
        case 0x16e: /* movd xmm, ea */
B
bellard 已提交
3100
#ifdef TARGET_X86_64
3101
            if (s->dflag == MO_64) {
3102
                gen_ldst_modrm(env, s, modrm, MO_64, OR_TMP0, 0);
B
bellard 已提交
3103 3104
                tcg_gen_addi_ptr(cpu_ptr0, cpu_env, 
                                 offsetof(CPUX86State,xmm_regs[reg]));
P
pbrook 已提交
3105
                gen_helper_movq_mm_T0_xmm(cpu_ptr0, cpu_T[0]);
3106
            } else
B
bellard 已提交
3107 3108
#endif
            {
3109
                gen_ldst_modrm(env, s, modrm, MO_32, OR_TMP0, 0);
B
bellard 已提交
3110 3111
                tcg_gen_addi_ptr(cpu_ptr0, cpu_env, 
                                 offsetof(CPUX86State,xmm_regs[reg]));
3112
                tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
P
pbrook 已提交
3113
                gen_helper_movl_mm_T0_xmm(cpu_ptr0, cpu_tmp2_i32);
B
bellard 已提交
3114
            }
B
bellard 已提交
3115 3116 3117
            break;
        case 0x6f: /* movq mm, ea */
            if (mod != 3) {
3118
                gen_lea_modrm(env, s, modrm);
3119
                gen_ldq_env_A0(s, offsetof(CPUX86State, fpregs[reg].mmx));
B
bellard 已提交
3120 3121
            } else {
                rm = (modrm & 7);
3122
                tcg_gen_ld_i64(cpu_tmp1_i64, cpu_env,
B
bellard 已提交
3123
                               offsetof(CPUX86State,fpregs[rm].mmx));
3124
                tcg_gen_st_i64(cpu_tmp1_i64, cpu_env,
B
bellard 已提交
3125
                               offsetof(CPUX86State,fpregs[reg].mmx));
B
bellard 已提交
3126 3127 3128 3129 3130 3131 3132 3133 3134
            }
            break;
        case 0x010: /* movups */
        case 0x110: /* movupd */
        case 0x028: /* movaps */
        case 0x128: /* movapd */
        case 0x16f: /* movdqa xmm, ea */
        case 0x26f: /* movdqu xmm, ea */
            if (mod != 3) {
3135
                gen_lea_modrm(env, s, modrm);
3136
                gen_ldo_env_A0(s, offsetof(CPUX86State, xmm_regs[reg]));
B
bellard 已提交
3137 3138 3139 3140 3141 3142 3143 3144
            } else {
                rm = (modrm & 7) | REX_B(s);
                gen_op_movo(offsetof(CPUX86State,xmm_regs[reg]),
                            offsetof(CPUX86State,xmm_regs[rm]));
            }
            break;
        case 0x210: /* movss xmm, ea */
            if (mod != 3) {
3145
                gen_lea_modrm(env, s, modrm);
3146
                gen_op_ld_v(s, MO_32, cpu_T[0], cpu_A0);
B
bellard 已提交
3147
                tcg_gen_st32_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)));
3148
                tcg_gen_movi_tl(cpu_T[0], 0);
B
bellard 已提交
3149 3150 3151
                tcg_gen_st32_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,xmm_regs[reg].XMM_L(1)));
                tcg_gen_st32_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,xmm_regs[reg].XMM_L(2)));
                tcg_gen_st32_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,xmm_regs[reg].XMM_L(3)));
B
bellard 已提交
3152 3153 3154 3155 3156 3157 3158 3159
            } else {
                rm = (modrm & 7) | REX_B(s);
                gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)),
                            offsetof(CPUX86State,xmm_regs[rm].XMM_L(0)));
            }
            break;
        case 0x310: /* movsd xmm, ea */
            if (mod != 3) {
3160
                gen_lea_modrm(env, s, modrm);
3161 3162
                gen_ldq_env_A0(s, offsetof(CPUX86State,
                                           xmm_regs[reg].XMM_Q(0)));
3163
                tcg_gen_movi_tl(cpu_T[0], 0);
B
bellard 已提交
3164 3165
                tcg_gen_st32_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,xmm_regs[reg].XMM_L(2)));
                tcg_gen_st32_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,xmm_regs[reg].XMM_L(3)));
B
bellard 已提交
3166 3167 3168 3169 3170 3171 3172 3173 3174
            } else {
                rm = (modrm & 7) | REX_B(s);
                gen_op_movq(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)),
                            offsetof(CPUX86State,xmm_regs[rm].XMM_Q(0)));
            }
            break;
        case 0x012: /* movlps */
        case 0x112: /* movlpd */
            if (mod != 3) {
3175
                gen_lea_modrm(env, s, modrm);
3176 3177
                gen_ldq_env_A0(s, offsetof(CPUX86State,
                                           xmm_regs[reg].XMM_Q(0)));
B
bellard 已提交
3178 3179 3180 3181 3182 3183 3184
            } else {
                /* movhlps */
                rm = (modrm & 7) | REX_B(s);
                gen_op_movq(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)),
                            offsetof(CPUX86State,xmm_regs[rm].XMM_Q(1)));
            }
            break;
B
bellard 已提交
3185 3186
        case 0x212: /* movsldup */
            if (mod != 3) {
3187
                gen_lea_modrm(env, s, modrm);
3188
                gen_ldo_env_A0(s, offsetof(CPUX86State, xmm_regs[reg]));
B
bellard 已提交
3189 3190 3191 3192 3193 3194 3195 3196 3197 3198 3199 3200 3201 3202
            } else {
                rm = (modrm & 7) | REX_B(s);
                gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)),
                            offsetof(CPUX86State,xmm_regs[rm].XMM_L(0)));
                gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(2)),
                            offsetof(CPUX86State,xmm_regs[rm].XMM_L(2)));
            }
            gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(1)),
                        offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)));
            gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(3)),
                        offsetof(CPUX86State,xmm_regs[reg].XMM_L(2)));
            break;
        case 0x312: /* movddup */
            if (mod != 3) {
3203
                gen_lea_modrm(env, s, modrm);
3204 3205
                gen_ldq_env_A0(s, offsetof(CPUX86State,
                                           xmm_regs[reg].XMM_Q(0)));
B
bellard 已提交
3206 3207 3208 3209 3210 3211
            } else {
                rm = (modrm & 7) | REX_B(s);
                gen_op_movq(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)),
                            offsetof(CPUX86State,xmm_regs[rm].XMM_Q(0)));
            }
            gen_op_movq(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(1)),
B
bellard 已提交
3212
                        offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)));
B
bellard 已提交
3213
            break;
B
bellard 已提交
3214 3215 3216
        case 0x016: /* movhps */
        case 0x116: /* movhpd */
            if (mod != 3) {
3217
                gen_lea_modrm(env, s, modrm);
3218 3219
                gen_ldq_env_A0(s, offsetof(CPUX86State,
                                           xmm_regs[reg].XMM_Q(1)));
B
bellard 已提交
3220 3221 3222 3223 3224 3225 3226 3227 3228
            } else {
                /* movlhps */
                rm = (modrm & 7) | REX_B(s);
                gen_op_movq(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(1)),
                            offsetof(CPUX86State,xmm_regs[rm].XMM_Q(0)));
            }
            break;
        case 0x216: /* movshdup */
            if (mod != 3) {
3229
                gen_lea_modrm(env, s, modrm);
3230
                gen_ldo_env_A0(s, offsetof(CPUX86State, xmm_regs[reg]));
B
bellard 已提交
3231 3232 3233 3234 3235 3236 3237 3238 3239 3240 3241 3242
            } else {
                rm = (modrm & 7) | REX_B(s);
                gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(1)),
                            offsetof(CPUX86State,xmm_regs[rm].XMM_L(1)));
                gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(3)),
                            offsetof(CPUX86State,xmm_regs[rm].XMM_L(3)));
            }
            gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)),
                        offsetof(CPUX86State,xmm_regs[reg].XMM_L(1)));
            gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(2)),
                        offsetof(CPUX86State,xmm_regs[reg].XMM_L(3)));
            break;
3243 3244 3245 3246 3247 3248 3249
        case 0x178:
        case 0x378:
            {
                int bit_index, field_length;

                if (b1 == 1 && reg != 0)
                    goto illegal_op;
3250 3251
                field_length = cpu_ldub_code(env, s->pc++) & 0x3F;
                bit_index = cpu_ldub_code(env, s->pc++) & 0x3F;
3252 3253 3254
                tcg_gen_addi_ptr(cpu_ptr0, cpu_env,
                    offsetof(CPUX86State,xmm_regs[reg]));
                if (b1 == 1)
B
Blue Swirl 已提交
3255 3256 3257
                    gen_helper_extrq_i(cpu_env, cpu_ptr0,
                                       tcg_const_i32(bit_index),
                                       tcg_const_i32(field_length));
3258
                else
B
Blue Swirl 已提交
3259 3260 3261
                    gen_helper_insertq_i(cpu_env, cpu_ptr0,
                                         tcg_const_i32(bit_index),
                                         tcg_const_i32(field_length));
3262 3263
            }
            break;
B
bellard 已提交
3264
        case 0x7e: /* movd ea, mm */
B
bellard 已提交
3265
#ifdef TARGET_X86_64
3266
            if (s->dflag == MO_64) {
B
bellard 已提交
3267 3268
                tcg_gen_ld_i64(cpu_T[0], cpu_env, 
                               offsetof(CPUX86State,fpregs[reg].mmx));
3269
                gen_ldst_modrm(env, s, modrm, MO_64, OR_TMP0, 1);
3270
            } else
B
bellard 已提交
3271 3272
#endif
            {
B
bellard 已提交
3273 3274
                tcg_gen_ld32u_tl(cpu_T[0], cpu_env, 
                                 offsetof(CPUX86State,fpregs[reg].mmx.MMX_L(0)));
3275
                gen_ldst_modrm(env, s, modrm, MO_32, OR_TMP0, 1);
B
bellard 已提交
3276
            }
B
bellard 已提交
3277 3278
            break;
        case 0x17e: /* movd ea, xmm */
B
bellard 已提交
3279
#ifdef TARGET_X86_64
3280
            if (s->dflag == MO_64) {
B
bellard 已提交
3281 3282
                tcg_gen_ld_i64(cpu_T[0], cpu_env, 
                               offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)));
3283
                gen_ldst_modrm(env, s, modrm, MO_64, OR_TMP0, 1);
3284
            } else
B
bellard 已提交
3285 3286
#endif
            {
B
bellard 已提交
3287 3288
                tcg_gen_ld32u_tl(cpu_T[0], cpu_env, 
                                 offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)));
3289
                gen_ldst_modrm(env, s, modrm, MO_32, OR_TMP0, 1);
B
bellard 已提交
3290
            }
B
bellard 已提交
3291 3292 3293
            break;
        case 0x27e: /* movq xmm, ea */
            if (mod != 3) {
3294
                gen_lea_modrm(env, s, modrm);
3295 3296
                gen_ldq_env_A0(s, offsetof(CPUX86State,
                                           xmm_regs[reg].XMM_Q(0)));
B
bellard 已提交
3297 3298 3299 3300 3301 3302 3303 3304 3305
            } else {
                rm = (modrm & 7) | REX_B(s);
                gen_op_movq(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)),
                            offsetof(CPUX86State,xmm_regs[rm].XMM_Q(0)));
            }
            gen_op_movq_env_0(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(1)));
            break;
        case 0x7f: /* movq ea, mm */
            if (mod != 3) {
3306
                gen_lea_modrm(env, s, modrm);
3307
                gen_stq_env_A0(s, offsetof(CPUX86State, fpregs[reg].mmx));
B
bellard 已提交
3308 3309 3310 3311 3312 3313 3314 3315 3316 3317 3318 3319 3320
            } else {
                rm = (modrm & 7);
                gen_op_movq(offsetof(CPUX86State,fpregs[rm].mmx),
                            offsetof(CPUX86State,fpregs[reg].mmx));
            }
            break;
        case 0x011: /* movups */
        case 0x111: /* movupd */
        case 0x029: /* movaps */
        case 0x129: /* movapd */
        case 0x17f: /* movdqa ea, xmm */
        case 0x27f: /* movdqu ea, xmm */
            if (mod != 3) {
3321
                gen_lea_modrm(env, s, modrm);
3322
                gen_sto_env_A0(s, offsetof(CPUX86State, xmm_regs[reg]));
B
bellard 已提交
3323 3324 3325 3326 3327 3328 3329 3330
            } else {
                rm = (modrm & 7) | REX_B(s);
                gen_op_movo(offsetof(CPUX86State,xmm_regs[rm]),
                            offsetof(CPUX86State,xmm_regs[reg]));
            }
            break;
        case 0x211: /* movss ea, xmm */
            if (mod != 3) {
3331
                gen_lea_modrm(env, s, modrm);
B
bellard 已提交
3332
                tcg_gen_ld32u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)));
3333
                gen_op_st_v(s, MO_32, cpu_T[0], cpu_A0);
B
bellard 已提交
3334 3335 3336 3337 3338 3339 3340 3341
            } else {
                rm = (modrm & 7) | REX_B(s);
                gen_op_movl(offsetof(CPUX86State,xmm_regs[rm].XMM_L(0)),
                            offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)));
            }
            break;
        case 0x311: /* movsd ea, xmm */
            if (mod != 3) {
3342
                gen_lea_modrm(env, s, modrm);
3343 3344
                gen_stq_env_A0(s, offsetof(CPUX86State,
                                           xmm_regs[reg].XMM_Q(0)));
B
bellard 已提交
3345 3346 3347 3348 3349 3350 3351 3352 3353
            } else {
                rm = (modrm & 7) | REX_B(s);
                gen_op_movq(offsetof(CPUX86State,xmm_regs[rm].XMM_Q(0)),
                            offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)));
            }
            break;
        case 0x013: /* movlps */
        case 0x113: /* movlpd */
            if (mod != 3) {
3354
                gen_lea_modrm(env, s, modrm);
3355 3356
                gen_stq_env_A0(s, offsetof(CPUX86State,
                                           xmm_regs[reg].XMM_Q(0)));
B
bellard 已提交
3357 3358 3359 3360 3361 3362 3363
            } else {
                goto illegal_op;
            }
            break;
        case 0x017: /* movhps */
        case 0x117: /* movhpd */
            if (mod != 3) {
3364
                gen_lea_modrm(env, s, modrm);
3365 3366
                gen_stq_env_A0(s, offsetof(CPUX86State,
                                           xmm_regs[reg].XMM_Q(1)));
B
bellard 已提交
3367 3368 3369 3370 3371 3372 3373 3374 3375 3376
            } else {
                goto illegal_op;
            }
            break;
        case 0x71: /* shift mm, im */
        case 0x72:
        case 0x73:
        case 0x171: /* shift xmm, im */
        case 0x172:
        case 0x173:
3377 3378 3379
            if (b1 >= 2) {
	        goto illegal_op;
            }
3380
            val = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
3381
            if (is_xmm) {
3382
                tcg_gen_movi_tl(cpu_T[0], val);
B
bellard 已提交
3383
                tcg_gen_st32_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,xmm_t0.XMM_L(0)));
3384
                tcg_gen_movi_tl(cpu_T[0], 0);
B
bellard 已提交
3385
                tcg_gen_st32_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,xmm_t0.XMM_L(1)));
B
bellard 已提交
3386 3387
                op1_offset = offsetof(CPUX86State,xmm_t0);
            } else {
3388
                tcg_gen_movi_tl(cpu_T[0], val);
B
bellard 已提交
3389
                tcg_gen_st32_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,mmx_t0.MMX_L(0)));
3390
                tcg_gen_movi_tl(cpu_T[0], 0);
B
bellard 已提交
3391
                tcg_gen_st32_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,mmx_t0.MMX_L(1)));
B
bellard 已提交
3392 3393
                op1_offset = offsetof(CPUX86State,mmx_t0);
            }
B
Blue Swirl 已提交
3394 3395 3396
            sse_fn_epp = sse_op_table2[((b - 1) & 3) * 8 +
                                       (((modrm >> 3)) & 7)][b1];
            if (!sse_fn_epp) {
B
bellard 已提交
3397
                goto illegal_op;
B
Blue Swirl 已提交
3398
            }
B
bellard 已提交
3399 3400 3401 3402 3403 3404 3405
            if (is_xmm) {
                rm = (modrm & 7) | REX_B(s);
                op2_offset = offsetof(CPUX86State,xmm_regs[rm]);
            } else {
                rm = (modrm & 7);
                op2_offset = offsetof(CPUX86State,fpregs[rm].mmx);
            }
B
bellard 已提交
3406 3407
            tcg_gen_addi_ptr(cpu_ptr0, cpu_env, op2_offset);
            tcg_gen_addi_ptr(cpu_ptr1, cpu_env, op1_offset);
B
Blue Swirl 已提交
3408
            sse_fn_epp(cpu_env, cpu_ptr0, cpu_ptr1);
B
bellard 已提交
3409 3410 3411
            break;
        case 0x050: /* movmskps */
            rm = (modrm & 7) | REX_B(s);
B
bellard 已提交
3412 3413
            tcg_gen_addi_ptr(cpu_ptr0, cpu_env, 
                             offsetof(CPUX86State,xmm_regs[rm]));
B
Blue Swirl 已提交
3414
            gen_helper_movmskps(cpu_tmp2_i32, cpu_env, cpu_ptr0);
3415
            tcg_gen_extu_i32_tl(cpu_regs[reg], cpu_tmp2_i32);
B
bellard 已提交
3416 3417 3418
            break;
        case 0x150: /* movmskpd */
            rm = (modrm & 7) | REX_B(s);
B
bellard 已提交
3419 3420
            tcg_gen_addi_ptr(cpu_ptr0, cpu_env, 
                             offsetof(CPUX86State,xmm_regs[rm]));
B
Blue Swirl 已提交
3421
            gen_helper_movmskpd(cpu_tmp2_i32, cpu_env, cpu_ptr0);
3422
            tcg_gen_extu_i32_tl(cpu_regs[reg], cpu_tmp2_i32);
B
bellard 已提交
3423 3424 3425
            break;
        case 0x02a: /* cvtpi2ps */
        case 0x12a: /* cvtpi2pd */
B
Blue Swirl 已提交
3426
            gen_helper_enter_mmx(cpu_env);
B
bellard 已提交
3427
            if (mod != 3) {
3428
                gen_lea_modrm(env, s, modrm);
B
bellard 已提交
3429
                op2_offset = offsetof(CPUX86State,mmx_t0);
3430
                gen_ldq_env_A0(s, op2_offset);
B
bellard 已提交
3431 3432 3433 3434 3435
            } else {
                rm = (modrm & 7);
                op2_offset = offsetof(CPUX86State,fpregs[rm].mmx);
            }
            op1_offset = offsetof(CPUX86State,xmm_regs[reg]);
B
bellard 已提交
3436 3437
            tcg_gen_addi_ptr(cpu_ptr0, cpu_env, op1_offset);
            tcg_gen_addi_ptr(cpu_ptr1, cpu_env, op2_offset);
B
bellard 已提交
3438 3439
            switch(b >> 8) {
            case 0x0:
B
Blue Swirl 已提交
3440
                gen_helper_cvtpi2ps(cpu_env, cpu_ptr0, cpu_ptr1);
B
bellard 已提交
3441 3442 3443
                break;
            default:
            case 0x1:
B
Blue Swirl 已提交
3444
                gen_helper_cvtpi2pd(cpu_env, cpu_ptr0, cpu_ptr1);
B
bellard 已提交
3445 3446 3447 3448 3449
                break;
            }
            break;
        case 0x22a: /* cvtsi2ss */
        case 0x32a: /* cvtsi2sd */
3450
            ot = mo_64_32(s->dflag);
3451
            gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
B
bellard 已提交
3452
            op1_offset = offsetof(CPUX86State,xmm_regs[reg]);
B
bellard 已提交
3453
            tcg_gen_addi_ptr(cpu_ptr0, cpu_env, op1_offset);
3454
            if (ot == MO_32) {
B
Blue Swirl 已提交
3455
                SSEFunc_0_epi sse_fn_epi = sse_op_table3ai[(b >> 8) & 1];
B
bellard 已提交
3456
                tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
B
Blue Swirl 已提交
3457
                sse_fn_epi(cpu_env, cpu_ptr0, cpu_tmp2_i32);
B
bellard 已提交
3458
            } else {
3459
#ifdef TARGET_X86_64
B
Blue Swirl 已提交
3460 3461
                SSEFunc_0_epl sse_fn_epl = sse_op_table3aq[(b >> 8) & 1];
                sse_fn_epl(cpu_env, cpu_ptr0, cpu_T[0]);
3462 3463 3464
#else
                goto illegal_op;
#endif
B
bellard 已提交
3465
            }
B
bellard 已提交
3466 3467 3468 3469 3470
            break;
        case 0x02c: /* cvttps2pi */
        case 0x12c: /* cvttpd2pi */
        case 0x02d: /* cvtps2pi */
        case 0x12d: /* cvtpd2pi */
B
Blue Swirl 已提交
3471
            gen_helper_enter_mmx(cpu_env);
B
bellard 已提交
3472
            if (mod != 3) {
3473
                gen_lea_modrm(env, s, modrm);
B
bellard 已提交
3474
                op2_offset = offsetof(CPUX86State,xmm_t0);
3475
                gen_ldo_env_A0(s, op2_offset);
B
bellard 已提交
3476 3477 3478 3479 3480
            } else {
                rm = (modrm & 7) | REX_B(s);
                op2_offset = offsetof(CPUX86State,xmm_regs[rm]);
            }
            op1_offset = offsetof(CPUX86State,fpregs[reg & 7].mmx);
B
bellard 已提交
3481 3482
            tcg_gen_addi_ptr(cpu_ptr0, cpu_env, op1_offset);
            tcg_gen_addi_ptr(cpu_ptr1, cpu_env, op2_offset);
B
bellard 已提交
3483 3484
            switch(b) {
            case 0x02c:
B
Blue Swirl 已提交
3485
                gen_helper_cvttps2pi(cpu_env, cpu_ptr0, cpu_ptr1);
B
bellard 已提交
3486 3487
                break;
            case 0x12c:
B
Blue Swirl 已提交
3488
                gen_helper_cvttpd2pi(cpu_env, cpu_ptr0, cpu_ptr1);
B
bellard 已提交
3489 3490
                break;
            case 0x02d:
B
Blue Swirl 已提交
3491
                gen_helper_cvtps2pi(cpu_env, cpu_ptr0, cpu_ptr1);
B
bellard 已提交
3492 3493
                break;
            case 0x12d:
B
Blue Swirl 已提交
3494
                gen_helper_cvtpd2pi(cpu_env, cpu_ptr0, cpu_ptr1);
B
bellard 已提交
3495 3496 3497 3498 3499 3500 3501
                break;
            }
            break;
        case 0x22c: /* cvttss2si */
        case 0x32c: /* cvttsd2si */
        case 0x22d: /* cvtss2si */
        case 0x32d: /* cvtsd2si */
3502
            ot = mo_64_32(s->dflag);
B
bellard 已提交
3503
            if (mod != 3) {
3504
                gen_lea_modrm(env, s, modrm);
B
bellard 已提交
3505
                if ((b >> 8) & 1) {
3506
                    gen_ldq_env_A0(s, offsetof(CPUX86State, xmm_t0.XMM_Q(0)));
B
bellard 已提交
3507
                } else {
3508
                    gen_op_ld_v(s, MO_32, cpu_T[0], cpu_A0);
B
bellard 已提交
3509
                    tcg_gen_st32_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,xmm_t0.XMM_L(0)));
B
bellard 已提交
3510 3511 3512 3513 3514 3515
                }
                op2_offset = offsetof(CPUX86State,xmm_t0);
            } else {
                rm = (modrm & 7) | REX_B(s);
                op2_offset = offsetof(CPUX86State,xmm_regs[rm]);
            }
B
bellard 已提交
3516
            tcg_gen_addi_ptr(cpu_ptr0, cpu_env, op2_offset);
3517
            if (ot == MO_32) {
B
Blue Swirl 已提交
3518
                SSEFunc_i_ep sse_fn_i_ep =
3519
                    sse_op_table3bi[((b >> 7) & 2) | (b & 1)];
B
Blue Swirl 已提交
3520
                sse_fn_i_ep(cpu_tmp2_i32, cpu_env, cpu_ptr0);
3521
                tcg_gen_extu_i32_tl(cpu_T[0], cpu_tmp2_i32);
B
bellard 已提交
3522
            } else {
3523
#ifdef TARGET_X86_64
B
Blue Swirl 已提交
3524
                SSEFunc_l_ep sse_fn_l_ep =
3525
                    sse_op_table3bq[((b >> 7) & 2) | (b & 1)];
B
Blue Swirl 已提交
3526
                sse_fn_l_ep(cpu_T[0], cpu_env, cpu_ptr0);
3527 3528 3529
#else
                goto illegal_op;
#endif
B
bellard 已提交
3530
            }
3531
            gen_op_mov_reg_v(ot, reg, cpu_T[0]);
B
bellard 已提交
3532 3533
            break;
        case 0xc4: /* pinsrw */
3534
        case 0x1c4:
B
bellard 已提交
3535
            s->rip_offset = 1;
3536
            gen_ldst_modrm(env, s, modrm, MO_16, OR_TMP0, 0);
3537
            val = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
3538 3539
            if (b1) {
                val &= 7;
B
bellard 已提交
3540 3541
                tcg_gen_st16_tl(cpu_T[0], cpu_env,
                                offsetof(CPUX86State,xmm_regs[reg].XMM_W(val)));
B
bellard 已提交
3542 3543
            } else {
                val &= 3;
B
bellard 已提交
3544 3545
                tcg_gen_st16_tl(cpu_T[0], cpu_env,
                                offsetof(CPUX86State,fpregs[reg].mmx.MMX_W(val)));
B
bellard 已提交
3546 3547 3548
            }
            break;
        case 0xc5: /* pextrw */
3549
        case 0x1c5:
B
bellard 已提交
3550 3551
            if (mod != 3)
                goto illegal_op;
3552
            ot = mo_64_32(s->dflag);
3553
            val = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
3554 3555 3556
            if (b1) {
                val &= 7;
                rm = (modrm & 7) | REX_B(s);
B
bellard 已提交
3557 3558
                tcg_gen_ld16u_tl(cpu_T[0], cpu_env,
                                 offsetof(CPUX86State,xmm_regs[rm].XMM_W(val)));
B
bellard 已提交
3559 3560 3561
            } else {
                val &= 3;
                rm = (modrm & 7);
B
bellard 已提交
3562 3563
                tcg_gen_ld16u_tl(cpu_T[0], cpu_env,
                                offsetof(CPUX86State,fpregs[rm].mmx.MMX_W(val)));
B
bellard 已提交
3564 3565
            }
            reg = ((modrm >> 3) & 7) | rex_r;
3566
            gen_op_mov_reg_v(ot, reg, cpu_T[0]);
B
bellard 已提交
3567 3568 3569
            break;
        case 0x1d6: /* movq ea, xmm */
            if (mod != 3) {
3570
                gen_lea_modrm(env, s, modrm);
3571 3572
                gen_stq_env_A0(s, offsetof(CPUX86State,
                                           xmm_regs[reg].XMM_Q(0)));
B
bellard 已提交
3573 3574 3575 3576 3577 3578 3579 3580
            } else {
                rm = (modrm & 7) | REX_B(s);
                gen_op_movq(offsetof(CPUX86State,xmm_regs[rm].XMM_Q(0)),
                            offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)));
                gen_op_movq_env_0(offsetof(CPUX86State,xmm_regs[rm].XMM_Q(1)));
            }
            break;
        case 0x2d6: /* movq2dq */
B
Blue Swirl 已提交
3581
            gen_helper_enter_mmx(cpu_env);
3582 3583 3584 3585
            rm = (modrm & 7);
            gen_op_movq(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)),
                        offsetof(CPUX86State,fpregs[rm].mmx));
            gen_op_movq_env_0(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(1)));
B
bellard 已提交
3586 3587
            break;
        case 0x3d6: /* movdq2q */
B
Blue Swirl 已提交
3588
            gen_helper_enter_mmx(cpu_env);
3589 3590 3591
            rm = (modrm & 7) | REX_B(s);
            gen_op_movq(offsetof(CPUX86State,fpregs[reg & 7].mmx),
                        offsetof(CPUX86State,xmm_regs[rm].XMM_Q(0)));
B
bellard 已提交
3592 3593 3594 3595 3596 3597 3598
            break;
        case 0xd7: /* pmovmskb */
        case 0x1d7:
            if (mod != 3)
                goto illegal_op;
            if (b1) {
                rm = (modrm & 7) | REX_B(s);
B
bellard 已提交
3599
                tcg_gen_addi_ptr(cpu_ptr0, cpu_env, offsetof(CPUX86State,xmm_regs[rm]));
B
Blue Swirl 已提交
3600
                gen_helper_pmovmskb_xmm(cpu_tmp2_i32, cpu_env, cpu_ptr0);
B
bellard 已提交
3601 3602
            } else {
                rm = (modrm & 7);
B
bellard 已提交
3603
                tcg_gen_addi_ptr(cpu_ptr0, cpu_env, offsetof(CPUX86State,fpregs[rm].mmx));
B
Blue Swirl 已提交
3604
                gen_helper_pmovmskb_mmx(cpu_tmp2_i32, cpu_env, cpu_ptr0);
B
bellard 已提交
3605 3606
            }
            reg = ((modrm >> 3) & 7) | rex_r;
3607
            tcg_gen_extu_i32_tl(cpu_regs[reg], cpu_tmp2_i32);
B
bellard 已提交
3608
            break;
R
Richard Henderson 已提交
3609

B
balrog 已提交
3610
        case 0x138:
3611
        case 0x038:
B
balrog 已提交
3612
            b = modrm;
R
Richard Henderson 已提交
3613 3614 3615
            if ((b & 0xf0) == 0xf0) {
                goto do_0f_38_fx;
            }
3616
            modrm = cpu_ldub_code(env, s->pc++);
B
balrog 已提交
3617 3618 3619
            rm = modrm & 7;
            reg = ((modrm >> 3) & 7) | rex_r;
            mod = (modrm >> 6) & 3;
3620 3621 3622
            if (b1 >= 2) {
                goto illegal_op;
            }
B
balrog 已提交
3623

B
Blue Swirl 已提交
3624 3625
            sse_fn_epp = sse_op_table6[b].op[b1];
            if (!sse_fn_epp) {
B
balrog 已提交
3626
                goto illegal_op;
B
Blue Swirl 已提交
3627
            }
B
balrog 已提交
3628 3629
            if (!(s->cpuid_ext_features & sse_op_table6[b].ext_mask))
                goto illegal_op;
B
balrog 已提交
3630 3631 3632 3633 3634 3635 3636

            if (b1) {
                op1_offset = offsetof(CPUX86State,xmm_regs[reg]);
                if (mod == 3) {
                    op2_offset = offsetof(CPUX86State,xmm_regs[rm | REX_B(s)]);
                } else {
                    op2_offset = offsetof(CPUX86State,xmm_t0);
3637
                    gen_lea_modrm(env, s, modrm);
B
balrog 已提交
3638 3639 3640 3641
                    switch (b) {
                    case 0x20: case 0x30: /* pmovsxbw, pmovzxbw */
                    case 0x23: case 0x33: /* pmovsxwd, pmovzxwd */
                    case 0x25: case 0x35: /* pmovsxdq, pmovzxdq */
3642
                        gen_ldq_env_A0(s, op2_offset +
B
balrog 已提交
3643 3644 3645 3646
                                        offsetof(XMMReg, XMM_Q(0)));
                        break;
                    case 0x21: case 0x31: /* pmovsxbd, pmovzxbd */
                    case 0x24: case 0x34: /* pmovsxwq, pmovzxwq */
3647 3648
                        tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0,
                                            s->mem_index, MO_LEUL);
B
balrog 已提交
3649 3650 3651 3652
                        tcg_gen_st_i32(cpu_tmp2_i32, cpu_env, op2_offset +
                                        offsetof(XMMReg, XMM_L(0)));
                        break;
                    case 0x22: case 0x32: /* pmovsxbq, pmovzxbq */
3653 3654
                        tcg_gen_qemu_ld_tl(cpu_tmp0, cpu_A0,
                                           s->mem_index, MO_LEUW);
B
balrog 已提交
3655 3656 3657 3658
                        tcg_gen_st16_tl(cpu_tmp0, cpu_env, op2_offset +
                                        offsetof(XMMReg, XMM_W(0)));
                        break;
                    case 0x2a:            /* movntqda */
3659
                        gen_ldo_env_A0(s, op1_offset);
B
balrog 已提交
3660 3661
                        return;
                    default:
3662
                        gen_ldo_env_A0(s, op2_offset);
B
balrog 已提交
3663
                    }
B
balrog 已提交
3664 3665 3666 3667 3668 3669 3670
                }
            } else {
                op1_offset = offsetof(CPUX86State,fpregs[reg].mmx);
                if (mod == 3) {
                    op2_offset = offsetof(CPUX86State,fpregs[rm].mmx);
                } else {
                    op2_offset = offsetof(CPUX86State,mmx_t0);
3671
                    gen_lea_modrm(env, s, modrm);
3672
                    gen_ldq_env_A0(s, op2_offset);
B
balrog 已提交
3673 3674
                }
            }
B
Blue Swirl 已提交
3675
            if (sse_fn_epp == SSE_SPECIAL) {
B
balrog 已提交
3676
                goto illegal_op;
B
Blue Swirl 已提交
3677
            }
B
balrog 已提交
3678

B
balrog 已提交
3679 3680
            tcg_gen_addi_ptr(cpu_ptr0, cpu_env, op1_offset);
            tcg_gen_addi_ptr(cpu_ptr1, cpu_env, op2_offset);
B
Blue Swirl 已提交
3681
            sse_fn_epp(cpu_env, cpu_ptr0, cpu_ptr1);
B
balrog 已提交
3682

3683 3684 3685
            if (b == 0x17) {
                set_cc_op(s, CC_OP_EFLAGS);
            }
B
balrog 已提交
3686
            break;
R
Richard Henderson 已提交
3687 3688 3689 3690 3691 3692

        case 0x238:
        case 0x338:
        do_0f_38_fx:
            /* Various integer extensions at 0f 38 f[0-f].  */
            b = modrm | (b1 << 8);
3693
            modrm = cpu_ldub_code(env, s->pc++);
B
balrog 已提交
3694 3695
            reg = ((modrm >> 3) & 7) | rex_r;

R
Richard Henderson 已提交
3696 3697 3698 3699 3700 3701 3702 3703
            switch (b) {
            case 0x3f0: /* crc32 Gd,Eb */
            case 0x3f1: /* crc32 Gd,Ey */
            do_crc32:
                if (!(s->cpuid_ext_features & CPUID_EXT_SSE42)) {
                    goto illegal_op;
                }
                if ((b & 0xff) == 0xf0) {
3704
                    ot = MO_8;
3705
                } else if (s->dflag != MO_64) {
3706
                    ot = (s->prefix & PREFIX_DATA ? MO_16 : MO_32);
R
Richard Henderson 已提交
3707
                } else {
3708
                    ot = MO_64;
R
Richard Henderson 已提交
3709
                }
B
balrog 已提交
3710

3711
                tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_regs[reg]);
R
Richard Henderson 已提交
3712 3713 3714
                gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
                gen_helper_crc32(cpu_T[0], cpu_tmp2_i32,
                                 cpu_T[0], tcg_const_i32(8 << ot));
B
balrog 已提交
3715

3716
                ot = mo_64_32(s->dflag);
3717
                gen_op_mov_reg_v(ot, reg, cpu_T[0]);
R
Richard Henderson 已提交
3718
                break;
B
balrog 已提交
3719

R
Richard Henderson 已提交
3720 3721 3722 3723 3724 3725 3726 3727 3728 3729 3730 3731 3732 3733
            case 0x1f0: /* crc32 or movbe */
            case 0x1f1:
                /* For these insns, the f3 prefix is supposed to have priority
                   over the 66 prefix, but that's not what we implement above
                   setting b1.  */
                if (s->prefix & PREFIX_REPNZ) {
                    goto do_crc32;
                }
                /* FALLTHRU */
            case 0x0f0: /* movbe Gy,My */
            case 0x0f1: /* movbe My,Gy */
                if (!(s->cpuid_ext_features & CPUID_EXT_MOVBE)) {
                    goto illegal_op;
                }
3734
                if (s->dflag != MO_64) {
3735
                    ot = (s->prefix & PREFIX_DATA ? MO_16 : MO_32);
R
Richard Henderson 已提交
3736
                } else {
3737
                    ot = MO_64;
R
Richard Henderson 已提交
3738 3739
                }

3740
                gen_lea_modrm(env, s, modrm);
R
Richard Henderson 已提交
3741
                if ((b & 1) == 0) {
3742 3743
                    tcg_gen_qemu_ld_tl(cpu_T[0], cpu_A0,
                                       s->mem_index, ot | MO_BE);
3744
                    gen_op_mov_reg_v(ot, reg, cpu_T[0]);
R
Richard Henderson 已提交
3745
                } else {
3746 3747
                    tcg_gen_qemu_st_tl(cpu_regs[reg], cpu_A0,
                                       s->mem_index, ot | MO_BE);
R
Richard Henderson 已提交
3748 3749 3750
                }
                break;

R
Richard Henderson 已提交
3751 3752 3753 3754 3755 3756
            case 0x0f2: /* andn Gy, By, Ey */
                if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_BMI1)
                    || !(s->prefix & PREFIX_VEX)
                    || s->vex_l != 0) {
                    goto illegal_op;
                }
3757
                ot = mo_64_32(s->dflag);
R
Richard Henderson 已提交
3758 3759
                gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
                tcg_gen_andc_tl(cpu_T[0], cpu_regs[s->vex_v], cpu_T[0]);
3760
                gen_op_mov_reg_v(ot, reg, cpu_T[0]);
R
Richard Henderson 已提交
3761 3762 3763 3764
                gen_op_update1_cc();
                set_cc_op(s, CC_OP_LOGICB + ot);
                break;

R
Richard Henderson 已提交
3765 3766 3767 3768 3769 3770
            case 0x0f7: /* bextr Gy, Ey, By */
                if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_BMI1)
                    || !(s->prefix & PREFIX_VEX)
                    || s->vex_l != 0) {
                    goto illegal_op;
                }
3771
                ot = mo_64_32(s->dflag);
R
Richard Henderson 已提交
3772 3773 3774 3775 3776 3777 3778 3779 3780
                {
                    TCGv bound, zero;

                    gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
                    /* Extract START, and shift the operand.
                       Shifts larger than operand size get zeros.  */
                    tcg_gen_ext8u_tl(cpu_A0, cpu_regs[s->vex_v]);
                    tcg_gen_shr_tl(cpu_T[0], cpu_T[0], cpu_A0);

3781
                    bound = tcg_const_tl(ot == MO_64 ? 63 : 31);
R
Richard Henderson 已提交
3782 3783 3784 3785 3786 3787 3788 3789 3790 3791 3792 3793 3794 3795 3796 3797 3798
                    zero = tcg_const_tl(0);
                    tcg_gen_movcond_tl(TCG_COND_LEU, cpu_T[0], cpu_A0, bound,
                                       cpu_T[0], zero);
                    tcg_temp_free(zero);

                    /* Extract the LEN into a mask.  Lengths larger than
                       operand size get all ones.  */
                    tcg_gen_shri_tl(cpu_A0, cpu_regs[s->vex_v], 8);
                    tcg_gen_ext8u_tl(cpu_A0, cpu_A0);
                    tcg_gen_movcond_tl(TCG_COND_LEU, cpu_A0, cpu_A0, bound,
                                       cpu_A0, bound);
                    tcg_temp_free(bound);
                    tcg_gen_movi_tl(cpu_T[1], 1);
                    tcg_gen_shl_tl(cpu_T[1], cpu_T[1], cpu_A0);
                    tcg_gen_subi_tl(cpu_T[1], cpu_T[1], 1);
                    tcg_gen_and_tl(cpu_T[0], cpu_T[0], cpu_T[1]);

3799
                    gen_op_mov_reg_v(ot, reg, cpu_T[0]);
R
Richard Henderson 已提交
3800 3801 3802 3803 3804
                    gen_op_update1_cc();
                    set_cc_op(s, CC_OP_LOGICB + ot);
                }
                break;

R
Richard Henderson 已提交
3805 3806 3807 3808 3809 3810
            case 0x0f5: /* bzhi Gy, Ey, By */
                if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_BMI2)
                    || !(s->prefix & PREFIX_VEX)
                    || s->vex_l != 0) {
                    goto illegal_op;
                }
3811
                ot = mo_64_32(s->dflag);
R
Richard Henderson 已提交
3812 3813 3814
                gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
                tcg_gen_ext8u_tl(cpu_T[1], cpu_regs[s->vex_v]);
                {
3815
                    TCGv bound = tcg_const_tl(ot == MO_64 ? 63 : 31);
R
Richard Henderson 已提交
3816 3817 3818 3819 3820 3821 3822 3823 3824 3825 3826
                    /* Note that since we're using BMILG (in order to get O
                       cleared) we need to store the inverse into C.  */
                    tcg_gen_setcond_tl(TCG_COND_LT, cpu_cc_src,
                                       cpu_T[1], bound);
                    tcg_gen_movcond_tl(TCG_COND_GT, cpu_T[1], cpu_T[1],
                                       bound, bound, cpu_T[1]);
                    tcg_temp_free(bound);
                }
                tcg_gen_movi_tl(cpu_A0, -1);
                tcg_gen_shl_tl(cpu_A0, cpu_A0, cpu_T[1]);
                tcg_gen_andc_tl(cpu_T[0], cpu_T[0], cpu_A0);
3827
                gen_op_mov_reg_v(ot, reg, cpu_T[0]);
R
Richard Henderson 已提交
3828 3829 3830 3831
                gen_op_update1_cc();
                set_cc_op(s, CC_OP_BMILGB + ot);
                break;

R
Richard Henderson 已提交
3832 3833 3834 3835 3836 3837
            case 0x3f6: /* mulx By, Gy, rdx, Ey */
                if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_BMI2)
                    || !(s->prefix & PREFIX_VEX)
                    || s->vex_l != 0) {
                    goto illegal_op;
                }
3838
                ot = mo_64_32(s->dflag);
R
Richard Henderson 已提交
3839 3840 3841
                gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
                switch (ot) {
                default:
3842 3843 3844 3845 3846 3847
                    tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
                    tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_regs[R_EDX]);
                    tcg_gen_mulu2_i32(cpu_tmp2_i32, cpu_tmp3_i32,
                                      cpu_tmp2_i32, cpu_tmp3_i32);
                    tcg_gen_extu_i32_tl(cpu_regs[s->vex_v], cpu_tmp2_i32);
                    tcg_gen_extu_i32_tl(cpu_regs[reg], cpu_tmp3_i32);
R
Richard Henderson 已提交
3848 3849
                    break;
#ifdef TARGET_X86_64
3850
                case MO_64:
3851 3852
                    tcg_gen_mulu2_i64(cpu_regs[s->vex_v], cpu_regs[reg],
                                      cpu_T[0], cpu_regs[R_EDX]);
R
Richard Henderson 已提交
3853 3854 3855 3856 3857
                    break;
#endif
                }
                break;

3858 3859 3860 3861 3862 3863
            case 0x3f5: /* pdep Gy, By, Ey */
                if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_BMI2)
                    || !(s->prefix & PREFIX_VEX)
                    || s->vex_l != 0) {
                    goto illegal_op;
                }
3864
                ot = mo_64_32(s->dflag);
3865 3866 3867
                gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
                /* Note that by zero-extending the mask operand, we
                   automatically handle zero-extending the result.  */
3868
                if (ot == MO_64) {
3869 3870 3871 3872 3873 3874 3875 3876 3877 3878 3879 3880 3881
                    tcg_gen_mov_tl(cpu_T[1], cpu_regs[s->vex_v]);
                } else {
                    tcg_gen_ext32u_tl(cpu_T[1], cpu_regs[s->vex_v]);
                }
                gen_helper_pdep(cpu_regs[reg], cpu_T[0], cpu_T[1]);
                break;

            case 0x2f5: /* pext Gy, By, Ey */
                if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_BMI2)
                    || !(s->prefix & PREFIX_VEX)
                    || s->vex_l != 0) {
                    goto illegal_op;
                }
3882
                ot = mo_64_32(s->dflag);
3883 3884 3885
                gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
                /* Note that by zero-extending the mask operand, we
                   automatically handle zero-extending the result.  */
3886
                if (ot == MO_64) {
3887 3888 3889 3890 3891 3892 3893
                    tcg_gen_mov_tl(cpu_T[1], cpu_regs[s->vex_v]);
                } else {
                    tcg_gen_ext32u_tl(cpu_T[1], cpu_regs[s->vex_v]);
                }
                gen_helper_pext(cpu_regs[reg], cpu_T[0], cpu_T[1]);
                break;

3894 3895 3896 3897 3898
            case 0x1f6: /* adcx Gy, Ey */
            case 0x2f6: /* adox Gy, Ey */
                if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_ADX)) {
                    goto illegal_op;
                } else {
3899
                    TCGv carry_in, carry_out, zero;
3900 3901
                    int end_op;

3902
                    ot = mo_64_32(s->dflag);
3903 3904 3905 3906 3907 3908 3909 3910 3911 3912 3913 3914 3915 3916 3917 3918 3919 3920 3921 3922 3923 3924 3925 3926 3927 3928 3929
                    gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);

                    /* Re-use the carry-out from a previous round.  */
                    TCGV_UNUSED(carry_in);
                    carry_out = (b == 0x1f6 ? cpu_cc_dst : cpu_cc_src2);
                    switch (s->cc_op) {
                    case CC_OP_ADCX:
                        if (b == 0x1f6) {
                            carry_in = cpu_cc_dst;
                            end_op = CC_OP_ADCX;
                        } else {
                            end_op = CC_OP_ADCOX;
                        }
                        break;
                    case CC_OP_ADOX:
                        if (b == 0x1f6) {
                            end_op = CC_OP_ADCOX;
                        } else {
                            carry_in = cpu_cc_src2;
                            end_op = CC_OP_ADOX;
                        }
                        break;
                    case CC_OP_ADCOX:
                        end_op = CC_OP_ADCOX;
                        carry_in = carry_out;
                        break;
                    default:
3930
                        end_op = (b == 0x1f6 ? CC_OP_ADCX : CC_OP_ADOX);
3931 3932 3933 3934 3935 3936 3937 3938 3939 3940 3941 3942 3943 3944 3945
                        break;
                    }
                    /* If we can't reuse carry-out, get it out of EFLAGS.  */
                    if (TCGV_IS_UNUSED(carry_in)) {
                        if (s->cc_op != CC_OP_ADCX && s->cc_op != CC_OP_ADOX) {
                            gen_compute_eflags(s);
                        }
                        carry_in = cpu_tmp0;
                        tcg_gen_shri_tl(carry_in, cpu_cc_src,
                                        ctz32(b == 0x1f6 ? CC_C : CC_O));
                        tcg_gen_andi_tl(carry_in, carry_in, 1);
                    }

                    switch (ot) {
#ifdef TARGET_X86_64
3946
                    case MO_32:
3947 3948 3949 3950 3951 3952 3953 3954 3955 3956 3957 3958
                        /* If we know TL is 64-bit, and we want a 32-bit
                           result, just do everything in 64-bit arithmetic.  */
                        tcg_gen_ext32u_i64(cpu_regs[reg], cpu_regs[reg]);
                        tcg_gen_ext32u_i64(cpu_T[0], cpu_T[0]);
                        tcg_gen_add_i64(cpu_T[0], cpu_T[0], cpu_regs[reg]);
                        tcg_gen_add_i64(cpu_T[0], cpu_T[0], carry_in);
                        tcg_gen_ext32u_i64(cpu_regs[reg], cpu_T[0]);
                        tcg_gen_shri_i64(carry_out, cpu_T[0], 32);
                        break;
#endif
                    default:
                        /* Otherwise compute the carry-out in two steps.  */
3959 3960 3961 3962 3963 3964 3965 3966
                        zero = tcg_const_tl(0);
                        tcg_gen_add2_tl(cpu_T[0], carry_out,
                                        cpu_T[0], zero,
                                        carry_in, zero);
                        tcg_gen_add2_tl(cpu_regs[reg], carry_out,
                                        cpu_regs[reg], carry_out,
                                        cpu_T[0], zero);
                        tcg_temp_free(zero);
3967 3968 3969 3970 3971 3972
                        break;
                    }
                    set_cc_op(s, end_op);
                }
                break;

3973 3974 3975 3976 3977 3978 3979 3980
            case 0x1f7: /* shlx Gy, Ey, By */
            case 0x2f7: /* sarx Gy, Ey, By */
            case 0x3f7: /* shrx Gy, Ey, By */
                if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_BMI2)
                    || !(s->prefix & PREFIX_VEX)
                    || s->vex_l != 0) {
                    goto illegal_op;
                }
3981
                ot = mo_64_32(s->dflag);
3982
                gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
3983
                if (ot == MO_64) {
3984 3985 3986 3987 3988 3989 3990
                    tcg_gen_andi_tl(cpu_T[1], cpu_regs[s->vex_v], 63);
                } else {
                    tcg_gen_andi_tl(cpu_T[1], cpu_regs[s->vex_v], 31);
                }
                if (b == 0x1f7) {
                    tcg_gen_shl_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
                } else if (b == 0x2f7) {
3991
                    if (ot != MO_64) {
3992 3993 3994 3995
                        tcg_gen_ext32s_tl(cpu_T[0], cpu_T[0]);
                    }
                    tcg_gen_sar_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
                } else {
3996
                    if (ot != MO_64) {
3997 3998 3999 4000
                        tcg_gen_ext32u_tl(cpu_T[0], cpu_T[0]);
                    }
                    tcg_gen_shr_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
                }
4001
                gen_op_mov_reg_v(ot, reg, cpu_T[0]);
4002 4003
                break;

4004 4005 4006 4007 4008 4009 4010 4011 4012
            case 0x0f3:
            case 0x1f3:
            case 0x2f3:
            case 0x3f3: /* Group 17 */
                if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_BMI1)
                    || !(s->prefix & PREFIX_VEX)
                    || s->vex_l != 0) {
                    goto illegal_op;
                }
4013
                ot = mo_64_32(s->dflag);
4014 4015 4016 4017 4018 4019
                gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);

                switch (reg & 7) {
                case 1: /* blsr By,Ey */
                    tcg_gen_neg_tl(cpu_T[1], cpu_T[0]);
                    tcg_gen_and_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
4020
                    gen_op_mov_reg_v(ot, s->vex_v, cpu_T[0]);
4021 4022 4023 4024 4025 4026 4027 4028 4029 4030 4031 4032 4033 4034 4035 4036 4037 4038 4039 4040 4041 4042 4043 4044 4045
                    gen_op_update2_cc();
                    set_cc_op(s, CC_OP_BMILGB + ot);
                    break;

                case 2: /* blsmsk By,Ey */
                    tcg_gen_mov_tl(cpu_cc_src, cpu_T[0]);
                    tcg_gen_subi_tl(cpu_T[0], cpu_T[0], 1);
                    tcg_gen_xor_tl(cpu_T[0], cpu_T[0], cpu_cc_src);
                    tcg_gen_mov_tl(cpu_cc_dst, cpu_T[0]);
                    set_cc_op(s, CC_OP_BMILGB + ot);
                    break;

                case 3: /* blsi By, Ey */
                    tcg_gen_mov_tl(cpu_cc_src, cpu_T[0]);
                    tcg_gen_subi_tl(cpu_T[0], cpu_T[0], 1);
                    tcg_gen_and_tl(cpu_T[0], cpu_T[0], cpu_cc_src);
                    tcg_gen_mov_tl(cpu_cc_dst, cpu_T[0]);
                    set_cc_op(s, CC_OP_BMILGB + ot);
                    break;

                default:
                    goto illegal_op;
                }
                break;

R
Richard Henderson 已提交
4046 4047 4048
            default:
                goto illegal_op;
            }
B
balrog 已提交
4049
            break;
R
Richard Henderson 已提交
4050

B
balrog 已提交
4051 4052
        case 0x03a:
        case 0x13a:
B
balrog 已提交
4053
            b = modrm;
4054
            modrm = cpu_ldub_code(env, s->pc++);
B
balrog 已提交
4055 4056 4057
            rm = modrm & 7;
            reg = ((modrm >> 3) & 7) | rex_r;
            mod = (modrm >> 6) & 3;
4058 4059 4060
            if (b1 >= 2) {
                goto illegal_op;
            }
B
balrog 已提交
4061

B
Blue Swirl 已提交
4062 4063
            sse_fn_eppi = sse_op_table7[b].op[b1];
            if (!sse_fn_eppi) {
B
balrog 已提交
4064
                goto illegal_op;
B
Blue Swirl 已提交
4065
            }
B
balrog 已提交
4066 4067 4068
            if (!(s->cpuid_ext_features & sse_op_table7[b].ext_mask))
                goto illegal_op;

B
Blue Swirl 已提交
4069
            if (sse_fn_eppi == SSE_SPECIAL) {
4070
                ot = mo_64_32(s->dflag);
B
balrog 已提交
4071 4072
                rm = (modrm & 7) | REX_B(s);
                if (mod != 3)
4073
                    gen_lea_modrm(env, s, modrm);
B
balrog 已提交
4074
                reg = ((modrm >> 3) & 7) | rex_r;
4075
                val = cpu_ldub_code(env, s->pc++);
B
balrog 已提交
4076 4077 4078 4079
                switch (b) {
                case 0x14: /* pextrb */
                    tcg_gen_ld8u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,
                                            xmm_regs[reg].XMM_B(val & 15)));
4080
                    if (mod == 3) {
4081
                        gen_op_mov_reg_v(ot, rm, cpu_T[0]);
4082 4083 4084 4085
                    } else {
                        tcg_gen_qemu_st_tl(cpu_T[0], cpu_A0,
                                           s->mem_index, MO_UB);
                    }
B
balrog 已提交
4086 4087 4088 4089
                    break;
                case 0x15: /* pextrw */
                    tcg_gen_ld16u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,
                                            xmm_regs[reg].XMM_W(val & 7)));
4090
                    if (mod == 3) {
4091
                        gen_op_mov_reg_v(ot, rm, cpu_T[0]);
4092 4093 4094 4095
                    } else {
                        tcg_gen_qemu_st_tl(cpu_T[0], cpu_A0,
                                           s->mem_index, MO_LEUW);
                    }
B
balrog 已提交
4096 4097
                    break;
                case 0x16:
4098
                    if (ot == MO_32) { /* pextrd */
B
balrog 已提交
4099 4100 4101
                        tcg_gen_ld_i32(cpu_tmp2_i32, cpu_env,
                                        offsetof(CPUX86State,
                                                xmm_regs[reg].XMM_L(val & 3)));
4102
                        if (mod == 3) {
4103
                            tcg_gen_extu_i32_tl(cpu_regs[rm], cpu_tmp2_i32);
4104
                        } else {
4105 4106
                            tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0,
                                                s->mem_index, MO_LEUL);
4107
                        }
B
balrog 已提交
4108
                    } else { /* pextrq */
P
pbrook 已提交
4109
#ifdef TARGET_X86_64
B
balrog 已提交
4110 4111 4112
                        tcg_gen_ld_i64(cpu_tmp1_i64, cpu_env,
                                        offsetof(CPUX86State,
                                                xmm_regs[reg].XMM_Q(val & 1)));
4113
                        if (mod == 3) {
4114
                            tcg_gen_mov_i64(cpu_regs[rm], cpu_tmp1_i64);
4115 4116 4117 4118
                        } else {
                            tcg_gen_qemu_st_i64(cpu_tmp1_i64, cpu_A0,
                                                s->mem_index, MO_LEQ);
                        }
P
pbrook 已提交
4119 4120 4121
#else
                        goto illegal_op;
#endif
B
balrog 已提交
4122 4123 4124 4125 4126
                    }
                    break;
                case 0x17: /* extractps */
                    tcg_gen_ld32u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,
                                            xmm_regs[reg].XMM_L(val & 3)));
4127
                    if (mod == 3) {
4128
                        gen_op_mov_reg_v(ot, rm, cpu_T[0]);
4129 4130 4131 4132
                    } else {
                        tcg_gen_qemu_st_tl(cpu_T[0], cpu_A0,
                                           s->mem_index, MO_LEUL);
                    }
B
balrog 已提交
4133 4134
                    break;
                case 0x20: /* pinsrb */
4135
                    if (mod == 3) {
4136
                        gen_op_mov_v_reg(MO_32, cpu_T[0], rm);
4137 4138 4139 4140
                    } else {
                        tcg_gen_qemu_ld_tl(cpu_T[0], cpu_A0,
                                           s->mem_index, MO_UB);
                    }
4141
                    tcg_gen_st8_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,
B
balrog 已提交
4142 4143 4144
                                            xmm_regs[reg].XMM_B(val & 15)));
                    break;
                case 0x21: /* insertps */
P
pbrook 已提交
4145
                    if (mod == 3) {
B
balrog 已提交
4146 4147 4148
                        tcg_gen_ld_i32(cpu_tmp2_i32, cpu_env,
                                        offsetof(CPUX86State,xmm_regs[rm]
                                                .XMM_L((val >> 6) & 3)));
P
pbrook 已提交
4149
                    } else {
4150 4151
                        tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0,
                                            s->mem_index, MO_LEUL);
P
pbrook 已提交
4152
                    }
B
balrog 已提交
4153 4154 4155 4156 4157 4158 4159 4160 4161 4162 4163 4164 4165 4166 4167 4168 4169 4170 4171 4172 4173
                    tcg_gen_st_i32(cpu_tmp2_i32, cpu_env,
                                    offsetof(CPUX86State,xmm_regs[reg]
                                            .XMM_L((val >> 4) & 3)));
                    if ((val >> 0) & 1)
                        tcg_gen_st_i32(tcg_const_i32(0 /*float32_zero*/),
                                        cpu_env, offsetof(CPUX86State,
                                                xmm_regs[reg].XMM_L(0)));
                    if ((val >> 1) & 1)
                        tcg_gen_st_i32(tcg_const_i32(0 /*float32_zero*/),
                                        cpu_env, offsetof(CPUX86State,
                                                xmm_regs[reg].XMM_L(1)));
                    if ((val >> 2) & 1)
                        tcg_gen_st_i32(tcg_const_i32(0 /*float32_zero*/),
                                        cpu_env, offsetof(CPUX86State,
                                                xmm_regs[reg].XMM_L(2)));
                    if ((val >> 3) & 1)
                        tcg_gen_st_i32(tcg_const_i32(0 /*float32_zero*/),
                                        cpu_env, offsetof(CPUX86State,
                                                xmm_regs[reg].XMM_L(3)));
                    break;
                case 0x22:
4174
                    if (ot == MO_32) { /* pinsrd */
4175
                        if (mod == 3) {
4176
                            tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_regs[rm]);
4177
                        } else {
4178 4179
                            tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0,
                                                s->mem_index, MO_LEUL);
4180
                        }
B
balrog 已提交
4181 4182 4183 4184
                        tcg_gen_st_i32(cpu_tmp2_i32, cpu_env,
                                        offsetof(CPUX86State,
                                                xmm_regs[reg].XMM_L(val & 3)));
                    } else { /* pinsrq */
P
pbrook 已提交
4185
#ifdef TARGET_X86_64
4186
                        if (mod == 3) {
B
balrog 已提交
4187
                            gen_op_mov_v_reg(ot, cpu_tmp1_i64, rm);
4188 4189 4190 4191
                        } else {
                            tcg_gen_qemu_ld_i64(cpu_tmp1_i64, cpu_A0,
                                                s->mem_index, MO_LEQ);
                        }
B
balrog 已提交
4192 4193 4194
                        tcg_gen_st_i64(cpu_tmp1_i64, cpu_env,
                                        offsetof(CPUX86State,
                                                xmm_regs[reg].XMM_Q(val & 1)));
P
pbrook 已提交
4195 4196 4197
#else
                        goto illegal_op;
#endif
B
balrog 已提交
4198 4199 4200 4201 4202
                    }
                    break;
                }
                return;
            }
B
balrog 已提交
4203 4204 4205 4206 4207 4208 4209

            if (b1) {
                op1_offset = offsetof(CPUX86State,xmm_regs[reg]);
                if (mod == 3) {
                    op2_offset = offsetof(CPUX86State,xmm_regs[rm | REX_B(s)]);
                } else {
                    op2_offset = offsetof(CPUX86State,xmm_t0);
4210
                    gen_lea_modrm(env, s, modrm);
4211
                    gen_ldo_env_A0(s, op2_offset);
B
balrog 已提交
4212 4213 4214 4215 4216 4217 4218
                }
            } else {
                op1_offset = offsetof(CPUX86State,fpregs[reg].mmx);
                if (mod == 3) {
                    op2_offset = offsetof(CPUX86State,fpregs[rm].mmx);
                } else {
                    op2_offset = offsetof(CPUX86State,mmx_t0);
4219
                    gen_lea_modrm(env, s, modrm);
4220
                    gen_ldq_env_A0(s, op2_offset);
B
balrog 已提交
4221 4222
                }
            }
4223
            val = cpu_ldub_code(env, s->pc++);
B
balrog 已提交
4224

B
balrog 已提交
4225
            if ((b & 0xfc) == 0x60) { /* pcmpXstrX */
4226
                set_cc_op(s, CC_OP_EFLAGS);
B
balrog 已提交
4227

4228
                if (s->dflag == MO_64) {
B
balrog 已提交
4229 4230
                    /* The helper must use entire 64-bit gp registers */
                    val |= 1 << 8;
4231
                }
B
balrog 已提交
4232 4233
            }

B
balrog 已提交
4234 4235
            tcg_gen_addi_ptr(cpu_ptr0, cpu_env, op1_offset);
            tcg_gen_addi_ptr(cpu_ptr1, cpu_env, op2_offset);
B
Blue Swirl 已提交
4236
            sse_fn_eppi(cpu_env, cpu_ptr0, cpu_ptr1, tcg_const_i32(val));
B
balrog 已提交
4237
            break;
R
Richard Henderson 已提交
4238 4239 4240 4241 4242 4243 4244 4245 4246 4247 4248 4249 4250 4251

        case 0x33a:
            /* Various integer extensions at 0f 3a f[0-f].  */
            b = modrm | (b1 << 8);
            modrm = cpu_ldub_code(env, s->pc++);
            reg = ((modrm >> 3) & 7) | rex_r;

            switch (b) {
            case 0x3f0: /* rorx Gy,Ey, Ib */
                if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_BMI2)
                    || !(s->prefix & PREFIX_VEX)
                    || s->vex_l != 0) {
                    goto illegal_op;
                }
4252
                ot = mo_64_32(s->dflag);
R
Richard Henderson 已提交
4253 4254
                gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
                b = cpu_ldub_code(env, s->pc++);
4255
                if (ot == MO_64) {
R
Richard Henderson 已提交
4256 4257 4258 4259 4260 4261
                    tcg_gen_rotri_tl(cpu_T[0], cpu_T[0], b & 63);
                } else {
                    tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
                    tcg_gen_rotri_i32(cpu_tmp2_i32, cpu_tmp2_i32, b & 31);
                    tcg_gen_extu_i32_tl(cpu_T[0], cpu_tmp2_i32);
                }
4262
                gen_op_mov_reg_v(ot, reg, cpu_T[0]);
R
Richard Henderson 已提交
4263 4264 4265 4266 4267 4268 4269
                break;

            default:
                goto illegal_op;
            }
            break;

B
bellard 已提交
4270 4271 4272 4273 4274
        default:
            goto illegal_op;
        }
    } else {
        /* generic MMX or SSE operation */
B
bellard 已提交
4275 4276 4277 4278 4279 4280 4281 4282
        switch(b) {
        case 0x70: /* pshufx insn */
        case 0xc6: /* pshufx insn */
        case 0xc2: /* compare insns */
            s->rip_offset = 1;
            break;
        default:
            break;
B
bellard 已提交
4283 4284 4285 4286
        }
        if (is_xmm) {
            op1_offset = offsetof(CPUX86State,xmm_regs[reg]);
            if (mod != 3) {
4287 4288
                int sz = 4;

4289
                gen_lea_modrm(env, s, modrm);
B
bellard 已提交
4290
                op2_offset = offsetof(CPUX86State,xmm_t0);
4291 4292 4293 4294 4295 4296

                switch (b) {
                case 0x50 ... 0x5a:
                case 0x5c ... 0x5f:
                case 0xc2:
                    /* Most sse scalar operations.  */
B
bellard 已提交
4297
                    if (b1 == 2) {
4298 4299 4300 4301 4302 4303 4304 4305 4306 4307
                        sz = 2;
                    } else if (b1 == 3) {
                        sz = 3;
                    }
                    break;

                case 0x2e:  /* ucomis[sd] */
                case 0x2f:  /* comis[sd] */
                    if (b1 == 0) {
                        sz = 2;
B
bellard 已提交
4308
                    } else {
4309
                        sz = 3;
B
bellard 已提交
4310
                    }
4311 4312 4313 4314 4315 4316 4317 4318 4319 4320 4321 4322 4323 4324 4325 4326
                    break;
                }

                switch (sz) {
                case 2:
                    /* 32 bit access */
                    gen_op_ld_v(s, MO_32, cpu_T[0], cpu_A0);
                    tcg_gen_st32_tl(cpu_T[0], cpu_env,
                                    offsetof(CPUX86State,xmm_t0.XMM_L(0)));
                    break;
                case 3:
                    /* 64 bit access */
                    gen_ldq_env_A0(s, offsetof(CPUX86State, xmm_t0.XMM_D(0)));
                    break;
                default:
                    /* 128 bit access */
4327
                    gen_ldo_env_A0(s, op2_offset);
4328
                    break;
B
bellard 已提交
4329 4330 4331 4332 4333 4334 4335 4336
                }
            } else {
                rm = (modrm & 7) | REX_B(s);
                op2_offset = offsetof(CPUX86State,xmm_regs[rm]);
            }
        } else {
            op1_offset = offsetof(CPUX86State,fpregs[reg].mmx);
            if (mod != 3) {
4337
                gen_lea_modrm(env, s, modrm);
B
bellard 已提交
4338
                op2_offset = offsetof(CPUX86State,mmx_t0);
4339
                gen_ldq_env_A0(s, op2_offset);
B
bellard 已提交
4340 4341 4342 4343 4344 4345
            } else {
                rm = (modrm & 7);
                op2_offset = offsetof(CPUX86State,fpregs[rm].mmx);
            }
        }
        switch(b) {
A
aurel32 已提交
4346
        case 0x0f: /* 3DNow! data insns */
4347 4348
            if (!(s->cpuid_ext2_features & CPUID_EXT2_3DNOW))
                goto illegal_op;
4349
            val = cpu_ldub_code(env, s->pc++);
B
Blue Swirl 已提交
4350 4351
            sse_fn_epp = sse_op_table5[val];
            if (!sse_fn_epp) {
A
aurel32 已提交
4352
                goto illegal_op;
B
Blue Swirl 已提交
4353
            }
B
bellard 已提交
4354 4355
            tcg_gen_addi_ptr(cpu_ptr0, cpu_env, op1_offset);
            tcg_gen_addi_ptr(cpu_ptr1, cpu_env, op2_offset);
B
Blue Swirl 已提交
4356
            sse_fn_epp(cpu_env, cpu_ptr0, cpu_ptr1);
A
aurel32 已提交
4357
            break;
B
bellard 已提交
4358 4359
        case 0x70: /* pshufx insn */
        case 0xc6: /* pshufx insn */
4360
            val = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
4361 4362
            tcg_gen_addi_ptr(cpu_ptr0, cpu_env, op1_offset);
            tcg_gen_addi_ptr(cpu_ptr1, cpu_env, op2_offset);
B
Blue Swirl 已提交
4363
            /* XXX: introduce a new table? */
B
Blue Swirl 已提交
4364
            sse_fn_ppi = (SSEFunc_0_ppi)sse_fn_epp;
B
Blue Swirl 已提交
4365
            sse_fn_ppi(cpu_ptr0, cpu_ptr1, tcg_const_i32(val));
B
bellard 已提交
4366 4367 4368
            break;
        case 0xc2:
            /* compare insns */
4369
            val = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
4370 4371
            if (val >= 8)
                goto illegal_op;
B
Blue Swirl 已提交
4372
            sse_fn_epp = sse_op_table4[val][b1];
B
Blue Swirl 已提交
4373

B
bellard 已提交
4374 4375
            tcg_gen_addi_ptr(cpu_ptr0, cpu_env, op1_offset);
            tcg_gen_addi_ptr(cpu_ptr1, cpu_env, op2_offset);
B
Blue Swirl 已提交
4376
            sse_fn_epp(cpu_env, cpu_ptr0, cpu_ptr1);
B
bellard 已提交
4377
            break;
4378 4379 4380 4381
        case 0xf7:
            /* maskmov : we must prepare A0 */
            if (mod != 3)
                goto illegal_op;
4382 4383
            tcg_gen_mov_tl(cpu_A0, cpu_regs[R_EDI]);
            gen_extu(s->aflag, cpu_A0);
4384 4385 4386 4387
            gen_add_A0_ds_seg(s);

            tcg_gen_addi_ptr(cpu_ptr0, cpu_env, op1_offset);
            tcg_gen_addi_ptr(cpu_ptr1, cpu_env, op2_offset);
B
Blue Swirl 已提交
4388
            /* XXX: introduce a new table? */
B
Blue Swirl 已提交
4389 4390
            sse_fn_eppt = (SSEFunc_0_eppt)sse_fn_epp;
            sse_fn_eppt(cpu_env, cpu_ptr0, cpu_ptr1, cpu_A0);
4391
            break;
B
bellard 已提交
4392
        default:
B
bellard 已提交
4393 4394
            tcg_gen_addi_ptr(cpu_ptr0, cpu_env, op1_offset);
            tcg_gen_addi_ptr(cpu_ptr1, cpu_env, op2_offset);
B
Blue Swirl 已提交
4395
            sse_fn_epp(cpu_env, cpu_ptr0, cpu_ptr1);
B
bellard 已提交
4396 4397 4398
            break;
        }
        if (b == 0x2e || b == 0x2f) {
4399
            set_cc_op(s, CC_OP_EFLAGS);
B
bellard 已提交
4400 4401 4402 4403
        }
    }
}

B
bellard 已提交
4404 4405
/* convert one instruction. s->is_jmp is set if the translation must
   be stopped. Return the next pc value */
4406 4407
static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
                               target_ulong pc_start)
B
bellard 已提交
4408
{
4409
    int b, prefixes;
4410
    int shift;
4411
    TCGMemOp ot, aflag, dflag;
4412
    int modrm, reg, rm, mod, op, opreg, val;
B
bellard 已提交
4413 4414
    target_ulong next_eip, tval;
    int rex_w, rex_r;
B
bellard 已提交
4415 4416 4417 4418

    s->pc = pc_start;
    prefixes = 0;
    s->override = -1;
B
bellard 已提交
4419 4420 4421 4422 4423
    rex_w = -1;
    rex_r = 0;
#ifdef TARGET_X86_64
    s->rex_x = 0;
    s->rex_b = 0;
4424
    x86_64_hregs = 0;
B
bellard 已提交
4425 4426
#endif
    s->rip_offset = 0; /* for relative ip address */
4427 4428
    s->vex_l = 0;
    s->vex_v = 0;
B
bellard 已提交
4429
 next_byte:
4430
    b = cpu_ldub_code(env, s->pc);
B
bellard 已提交
4431
    s->pc++;
4432 4433 4434 4435 4436 4437 4438 4439 4440 4441 4442 4443 4444 4445 4446 4447 4448 4449 4450 4451 4452 4453 4454 4455 4456 4457 4458 4459 4460 4461 4462 4463 4464 4465 4466
    /* Collect prefixes.  */
    switch (b) {
    case 0xf3:
        prefixes |= PREFIX_REPZ;
        goto next_byte;
    case 0xf2:
        prefixes |= PREFIX_REPNZ;
        goto next_byte;
    case 0xf0:
        prefixes |= PREFIX_LOCK;
        goto next_byte;
    case 0x2e:
        s->override = R_CS;
        goto next_byte;
    case 0x36:
        s->override = R_SS;
        goto next_byte;
    case 0x3e:
        s->override = R_DS;
        goto next_byte;
    case 0x26:
        s->override = R_ES;
        goto next_byte;
    case 0x64:
        s->override = R_FS;
        goto next_byte;
    case 0x65:
        s->override = R_GS;
        goto next_byte;
    case 0x66:
        prefixes |= PREFIX_DATA;
        goto next_byte;
    case 0x67:
        prefixes |= PREFIX_ADR;
        goto next_byte;
B
bellard 已提交
4467
#ifdef TARGET_X86_64
4468 4469
    case 0x40 ... 0x4f:
        if (CODE64(s)) {
B
bellard 已提交
4470 4471 4472 4473 4474 4475 4476 4477
            /* REX prefix */
            rex_w = (b >> 3) & 1;
            rex_r = (b & 0x4) << 1;
            s->rex_x = (b & 0x2) << 2;
            REX_B(s) = (b & 0x1) << 3;
            x86_64_hregs = 1; /* select uniform byte register addressing */
            goto next_byte;
        }
4478 4479
        break;
#endif
4480 4481 4482 4483 4484 4485 4486 4487 4488 4489 4490 4491 4492 4493 4494 4495 4496
    case 0xc5: /* 2-byte VEX */
    case 0xc4: /* 3-byte VEX */
        /* VEX prefixes cannot be used except in 32-bit mode.
           Otherwise the instruction is LES or LDS.  */
        if (s->code32 && !s->vm86) {
            static const int pp_prefix[4] = {
                0, PREFIX_DATA, PREFIX_REPZ, PREFIX_REPNZ
            };
            int vex3, vex2 = cpu_ldub_code(env, s->pc);

            if (!CODE64(s) && (vex2 & 0xc0) != 0xc0) {
                /* 4.1.4.6: In 32-bit mode, bits [7:6] must be 11b,
                   otherwise the instruction is LES or LDS.  */
                break;
            }
            s->pc++;

P
Peter Maydell 已提交
4497
            /* 4.1.1-4.1.3: No preceding lock, 66, f2, f3, or rex prefixes. */
4498 4499 4500 4501 4502 4503 4504 4505 4506 4507 4508 4509 4510 4511 4512 4513 4514 4515 4516 4517 4518 4519 4520 4521 4522 4523 4524 4525 4526 4527 4528 4529 4530 4531 4532 4533 4534 4535 4536
            if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ
                            | PREFIX_LOCK | PREFIX_DATA)) {
                goto illegal_op;
            }
#ifdef TARGET_X86_64
            if (x86_64_hregs) {
                goto illegal_op;
            }
#endif
            rex_r = (~vex2 >> 4) & 8;
            if (b == 0xc5) {
                vex3 = vex2;
                b = cpu_ldub_code(env, s->pc++);
            } else {
#ifdef TARGET_X86_64
                s->rex_x = (~vex2 >> 3) & 8;
                s->rex_b = (~vex2 >> 2) & 8;
#endif
                vex3 = cpu_ldub_code(env, s->pc++);
                rex_w = (vex3 >> 7) & 1;
                switch (vex2 & 0x1f) {
                case 0x01: /* Implied 0f leading opcode bytes.  */
                    b = cpu_ldub_code(env, s->pc++) | 0x100;
                    break;
                case 0x02: /* Implied 0f 38 leading opcode bytes.  */
                    b = 0x138;
                    break;
                case 0x03: /* Implied 0f 3a leading opcode bytes.  */
                    b = 0x13a;
                    break;
                default:   /* Reserved for future use.  */
                    goto illegal_op;
                }
            }
            s->vex_v = (~vex3 >> 3) & 0xf;
            s->vex_l = (vex3 >> 2) & 1;
            prefixes |= pp_prefix[vex3 & 3] | PREFIX_VEX;
        }
        break;
4537 4538 4539 4540
    }

    /* Post-process prefixes.  */
    if (CODE64(s)) {
4541 4542 4543
        /* In 64-bit mode, the default data size is 32-bit.  Select 64-bit
           data with rex_w, and 16-bit data with 0x66; rex_w takes precedence
           over 0x66 if both are present.  */
4544
        dflag = (rex_w > 0 ? MO_64 : prefixes & PREFIX_DATA ? MO_16 : MO_32);
4545
        /* In 64-bit mode, 0x67 selects 32-bit addressing.  */
4546
        aflag = (prefixes & PREFIX_ADR ? MO_32 : MO_64);
4547 4548
    } else {
        /* In 16/32-bit mode, 0x66 selects the opposite data size.  */
4549 4550 4551 4552
        if (s->code32 ^ ((prefixes & PREFIX_DATA) != 0)) {
            dflag = MO_32;
        } else {
            dflag = MO_16;
B
bellard 已提交
4553
        }
4554
        /* In 16/32-bit mode, 0x67 selects the opposite addressing.  */
4555 4556 4557 4558
        if (s->code32 ^ ((prefixes & PREFIX_ADR) != 0)) {
            aflag = MO_32;
        }  else {
            aflag = MO_16;
B
bellard 已提交
4559
        }
B
bellard 已提交
4560 4561 4562 4563 4564 4565 4566 4567
    }

    s->prefix = prefixes;
    s->aflag = aflag;
    s->dflag = dflag;

    /* lock generation */
    if (prefixes & PREFIX_LOCK)
P
pbrook 已提交
4568
        gen_helper_lock();
B
bellard 已提交
4569 4570 4571 4572 4573 4574 4575

    /* now check op code */
 reswitch:
    switch(b) {
    case 0x0f:
        /**************************/
        /* extended op code */
4576
        b = cpu_ldub_code(env, s->pc++) | 0x100;
B
bellard 已提交
4577
        goto reswitch;
4578

B
bellard 已提交
4579 4580 4581 4582 4583 4584 4585 4586 4587 4588 4589 4590 4591 4592 4593
        /**************************/
        /* arith & logic */
    case 0x00 ... 0x05:
    case 0x08 ... 0x0d:
    case 0x10 ... 0x15:
    case 0x18 ... 0x1d:
    case 0x20 ... 0x25:
    case 0x28 ... 0x2d:
    case 0x30 ... 0x35:
    case 0x38 ... 0x3d:
        {
            int op, f, val;
            op = (b >> 3) & 7;
            f = (b >> 1) & 3;

4594
            ot = mo_b_d(b, dflag);
4595

B
bellard 已提交
4596 4597
            switch(f) {
            case 0: /* OP Ev, Gv */
4598
                modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
4599
                reg = ((modrm >> 3) & 7) | rex_r;
B
bellard 已提交
4600
                mod = (modrm >> 6) & 3;
B
bellard 已提交
4601
                rm = (modrm & 7) | REX_B(s);
B
bellard 已提交
4602
                if (mod != 3) {
4603
                    gen_lea_modrm(env, s, modrm);
B
bellard 已提交
4604 4605 4606 4607
                    opreg = OR_TMP0;
                } else if (op == OP_XORL && rm == reg) {
                xor_zero:
                    /* xor reg, reg optimisation */
R
Richard Henderson 已提交
4608
                    set_cc_op(s, CC_OP_CLR);
4609
                    tcg_gen_movi_tl(cpu_T[0], 0);
4610
                    gen_op_mov_reg_v(ot, reg, cpu_T[0]);
B
bellard 已提交
4611 4612 4613 4614
                    break;
                } else {
                    opreg = rm;
                }
4615
                gen_op_mov_v_reg(ot, cpu_T[1], reg);
B
bellard 已提交
4616 4617 4618
                gen_op(s, op, ot, opreg);
                break;
            case 1: /* OP Gv, Ev */
4619
                modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
4620
                mod = (modrm >> 6) & 3;
B
bellard 已提交
4621 4622
                reg = ((modrm >> 3) & 7) | rex_r;
                rm = (modrm & 7) | REX_B(s);
B
bellard 已提交
4623
                if (mod != 3) {
4624
                    gen_lea_modrm(env, s, modrm);
4625
                    gen_op_ld_v(s, ot, cpu_T[1], cpu_A0);
B
bellard 已提交
4626 4627 4628
                } else if (op == OP_XORL && rm == reg) {
                    goto xor_zero;
                } else {
4629
                    gen_op_mov_v_reg(ot, cpu_T[1], rm);
B
bellard 已提交
4630 4631 4632 4633
                }
                gen_op(s, op, ot, reg);
                break;
            case 2: /* OP A, Iv */
4634
                val = insn_get(env, s, ot);
4635
                tcg_gen_movi_tl(cpu_T[1], val);
B
bellard 已提交
4636 4637 4638 4639 4640 4641
                gen_op(s, op, ot, OR_EAX);
                break;
            }
        }
        break;

4642 4643 4644
    case 0x82:
        if (CODE64(s))
            goto illegal_op;
B
bellard 已提交
4645 4646 4647 4648 4649 4650
    case 0x80: /* GRP1 */
    case 0x81:
    case 0x83:
        {
            int val;

4651
            ot = mo_b_d(b, dflag);
4652

4653
            modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
4654
            mod = (modrm >> 6) & 3;
B
bellard 已提交
4655
            rm = (modrm & 7) | REX_B(s);
B
bellard 已提交
4656
            op = (modrm >> 3) & 7;
4657

B
bellard 已提交
4658
            if (mod != 3) {
B
bellard 已提交
4659 4660 4661 4662
                if (b == 0x83)
                    s->rip_offset = 1;
                else
                    s->rip_offset = insn_const_size(ot);
4663
                gen_lea_modrm(env, s, modrm);
B
bellard 已提交
4664 4665
                opreg = OR_TMP0;
            } else {
B
bellard 已提交
4666
                opreg = rm;
B
bellard 已提交
4667 4668 4669 4670 4671 4672
            }

            switch(b) {
            default:
            case 0x80:
            case 0x81:
4673
            case 0x82:
4674
                val = insn_get(env, s, ot);
B
bellard 已提交
4675 4676
                break;
            case 0x83:
4677
                val = (int8_t)insn_get(env, s, MO_8);
B
bellard 已提交
4678 4679
                break;
            }
4680
            tcg_gen_movi_tl(cpu_T[1], val);
B
bellard 已提交
4681 4682 4683 4684 4685 4686 4687
            gen_op(s, op, ot, opreg);
        }
        break;

        /**************************/
        /* inc, dec, and other misc arith */
    case 0x40 ... 0x47: /* inc Gv */
4688
        ot = dflag;
B
bellard 已提交
4689 4690 4691
        gen_inc(s, ot, OR_EAX + (b & 7), 1);
        break;
    case 0x48 ... 0x4f: /* dec Gv */
4692
        ot = dflag;
B
bellard 已提交
4693 4694 4695 4696
        gen_inc(s, ot, OR_EAX + (b & 7), -1);
        break;
    case 0xf6: /* GRP3 */
    case 0xf7:
4697
        ot = mo_b_d(b, dflag);
B
bellard 已提交
4698

4699
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
4700
        mod = (modrm >> 6) & 3;
B
bellard 已提交
4701
        rm = (modrm & 7) | REX_B(s);
B
bellard 已提交
4702 4703
        op = (modrm >> 3) & 7;
        if (mod != 3) {
B
bellard 已提交
4704 4705
            if (op == 0)
                s->rip_offset = insn_const_size(ot);
4706
            gen_lea_modrm(env, s, modrm);
4707
            gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
B
bellard 已提交
4708
        } else {
4709
            gen_op_mov_v_reg(ot, cpu_T[0], rm);
B
bellard 已提交
4710 4711 4712 4713
        }

        switch(op) {
        case 0: /* test */
4714
            val = insn_get(env, s, ot);
4715
            tcg_gen_movi_tl(cpu_T[1], val);
B
bellard 已提交
4716
            gen_op_testl_T0_T1_cc();
4717
            set_cc_op(s, CC_OP_LOGICB + ot);
B
bellard 已提交
4718 4719
            break;
        case 2: /* not */
4720
            tcg_gen_not_tl(cpu_T[0], cpu_T[0]);
B
bellard 已提交
4721
            if (mod != 3) {
4722
                gen_op_st_v(s, ot, cpu_T[0], cpu_A0);
B
bellard 已提交
4723
            } else {
4724
                gen_op_mov_reg_v(ot, rm, cpu_T[0]);
B
bellard 已提交
4725 4726 4727
            }
            break;
        case 3: /* neg */
4728
            tcg_gen_neg_tl(cpu_T[0], cpu_T[0]);
B
bellard 已提交
4729
            if (mod != 3) {
4730
                gen_op_st_v(s, ot, cpu_T[0], cpu_A0);
B
bellard 已提交
4731
            } else {
4732
                gen_op_mov_reg_v(ot, rm, cpu_T[0]);
B
bellard 已提交
4733 4734
            }
            gen_op_update_neg_cc();
4735
            set_cc_op(s, CC_OP_SUBB + ot);
B
bellard 已提交
4736 4737 4738
            break;
        case 4: /* mul */
            switch(ot) {
4739
            case MO_8:
4740
                gen_op_mov_v_reg(MO_8, cpu_T[1], R_EAX);
B
bellard 已提交
4741 4742 4743 4744
                tcg_gen_ext8u_tl(cpu_T[0], cpu_T[0]);
                tcg_gen_ext8u_tl(cpu_T[1], cpu_T[1]);
                /* XXX: use 32 bit mul which could be faster */
                tcg_gen_mul_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
4745
                gen_op_mov_reg_v(MO_16, R_EAX, cpu_T[0]);
B
bellard 已提交
4746 4747
                tcg_gen_mov_tl(cpu_cc_dst, cpu_T[0]);
                tcg_gen_andi_tl(cpu_cc_src, cpu_T[0], 0xff00);
4748
                set_cc_op(s, CC_OP_MULB);
B
bellard 已提交
4749
                break;
4750
            case MO_16:
4751
                gen_op_mov_v_reg(MO_16, cpu_T[1], R_EAX);
B
bellard 已提交
4752 4753 4754 4755
                tcg_gen_ext16u_tl(cpu_T[0], cpu_T[0]);
                tcg_gen_ext16u_tl(cpu_T[1], cpu_T[1]);
                /* XXX: use 32 bit mul which could be faster */
                tcg_gen_mul_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
4756
                gen_op_mov_reg_v(MO_16, R_EAX, cpu_T[0]);
B
bellard 已提交
4757 4758
                tcg_gen_mov_tl(cpu_cc_dst, cpu_T[0]);
                tcg_gen_shri_tl(cpu_T[0], cpu_T[0], 16);
4759
                gen_op_mov_reg_v(MO_16, R_EDX, cpu_T[0]);
B
bellard 已提交
4760
                tcg_gen_mov_tl(cpu_cc_src, cpu_T[0]);
4761
                set_cc_op(s, CC_OP_MULW);
B
bellard 已提交
4762 4763
                break;
            default:
4764
            case MO_32:
4765 4766 4767 4768 4769 4770 4771 4772
                tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
                tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_regs[R_EAX]);
                tcg_gen_mulu2_i32(cpu_tmp2_i32, cpu_tmp3_i32,
                                  cpu_tmp2_i32, cpu_tmp3_i32);
                tcg_gen_extu_i32_tl(cpu_regs[R_EAX], cpu_tmp2_i32);
                tcg_gen_extu_i32_tl(cpu_regs[R_EDX], cpu_tmp3_i32);
                tcg_gen_mov_tl(cpu_cc_dst, cpu_regs[R_EAX]);
                tcg_gen_mov_tl(cpu_cc_src, cpu_regs[R_EDX]);
4773
                set_cc_op(s, CC_OP_MULL);
B
bellard 已提交
4774
                break;
B
bellard 已提交
4775
#ifdef TARGET_X86_64
4776
            case MO_64:
4777 4778 4779 4780
                tcg_gen_mulu2_i64(cpu_regs[R_EAX], cpu_regs[R_EDX],
                                  cpu_T[0], cpu_regs[R_EAX]);
                tcg_gen_mov_tl(cpu_cc_dst, cpu_regs[R_EAX]);
                tcg_gen_mov_tl(cpu_cc_src, cpu_regs[R_EDX]);
4781
                set_cc_op(s, CC_OP_MULQ);
B
bellard 已提交
4782 4783
                break;
#endif
B
bellard 已提交
4784 4785 4786 4787
            }
            break;
        case 5: /* imul */
            switch(ot) {
4788
            case MO_8:
4789
                gen_op_mov_v_reg(MO_8, cpu_T[1], R_EAX);
B
bellard 已提交
4790 4791 4792 4793
                tcg_gen_ext8s_tl(cpu_T[0], cpu_T[0]);
                tcg_gen_ext8s_tl(cpu_T[1], cpu_T[1]);
                /* XXX: use 32 bit mul which could be faster */
                tcg_gen_mul_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
4794
                gen_op_mov_reg_v(MO_16, R_EAX, cpu_T[0]);
B
bellard 已提交
4795 4796 4797
                tcg_gen_mov_tl(cpu_cc_dst, cpu_T[0]);
                tcg_gen_ext8s_tl(cpu_tmp0, cpu_T[0]);
                tcg_gen_sub_tl(cpu_cc_src, cpu_T[0], cpu_tmp0);
4798
                set_cc_op(s, CC_OP_MULB);
B
bellard 已提交
4799
                break;
4800
            case MO_16:
4801
                gen_op_mov_v_reg(MO_16, cpu_T[1], R_EAX);
B
bellard 已提交
4802 4803 4804 4805
                tcg_gen_ext16s_tl(cpu_T[0], cpu_T[0]);
                tcg_gen_ext16s_tl(cpu_T[1], cpu_T[1]);
                /* XXX: use 32 bit mul which could be faster */
                tcg_gen_mul_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
4806
                gen_op_mov_reg_v(MO_16, R_EAX, cpu_T[0]);
B
bellard 已提交
4807 4808 4809 4810
                tcg_gen_mov_tl(cpu_cc_dst, cpu_T[0]);
                tcg_gen_ext16s_tl(cpu_tmp0, cpu_T[0]);
                tcg_gen_sub_tl(cpu_cc_src, cpu_T[0], cpu_tmp0);
                tcg_gen_shri_tl(cpu_T[0], cpu_T[0], 16);
4811
                gen_op_mov_reg_v(MO_16, R_EDX, cpu_T[0]);
4812
                set_cc_op(s, CC_OP_MULW);
B
bellard 已提交
4813 4814
                break;
            default:
4815
            case MO_32:
4816 4817 4818 4819 4820 4821 4822 4823 4824 4825
                tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
                tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_regs[R_EAX]);
                tcg_gen_muls2_i32(cpu_tmp2_i32, cpu_tmp3_i32,
                                  cpu_tmp2_i32, cpu_tmp3_i32);
                tcg_gen_extu_i32_tl(cpu_regs[R_EAX], cpu_tmp2_i32);
                tcg_gen_extu_i32_tl(cpu_regs[R_EDX], cpu_tmp3_i32);
                tcg_gen_sari_i32(cpu_tmp2_i32, cpu_tmp2_i32, 31);
                tcg_gen_mov_tl(cpu_cc_dst, cpu_regs[R_EAX]);
                tcg_gen_sub_i32(cpu_tmp2_i32, cpu_tmp2_i32, cpu_tmp3_i32);
                tcg_gen_extu_i32_tl(cpu_cc_src, cpu_tmp2_i32);
4826
                set_cc_op(s, CC_OP_MULL);
B
bellard 已提交
4827
                break;
B
bellard 已提交
4828
#ifdef TARGET_X86_64
4829
            case MO_64:
4830 4831 4832 4833 4834
                tcg_gen_muls2_i64(cpu_regs[R_EAX], cpu_regs[R_EDX],
                                  cpu_T[0], cpu_regs[R_EAX]);
                tcg_gen_mov_tl(cpu_cc_dst, cpu_regs[R_EAX]);
                tcg_gen_sari_tl(cpu_cc_src, cpu_regs[R_EAX], 63);
                tcg_gen_sub_tl(cpu_cc_src, cpu_cc_src, cpu_regs[R_EDX]);
4835
                set_cc_op(s, CC_OP_MULQ);
B
bellard 已提交
4836 4837
                break;
#endif
B
bellard 已提交
4838 4839 4840 4841
            }
            break;
        case 6: /* div */
            switch(ot) {
4842
            case MO_8:
4843
                gen_helper_divb_AL(cpu_env, cpu_T[0]);
B
bellard 已提交
4844
                break;
4845
            case MO_16:
4846
                gen_helper_divw_AX(cpu_env, cpu_T[0]);
B
bellard 已提交
4847 4848
                break;
            default:
4849
            case MO_32:
4850
                gen_helper_divl_EAX(cpu_env, cpu_T[0]);
B
bellard 已提交
4851 4852
                break;
#ifdef TARGET_X86_64
4853
            case MO_64:
4854
                gen_helper_divq_EAX(cpu_env, cpu_T[0]);
B
bellard 已提交
4855
                break;
B
bellard 已提交
4856
#endif
B
bellard 已提交
4857 4858 4859 4860
            }
            break;
        case 7: /* idiv */
            switch(ot) {
4861
            case MO_8:
4862
                gen_helper_idivb_AL(cpu_env, cpu_T[0]);
B
bellard 已提交
4863
                break;
4864
            case MO_16:
4865
                gen_helper_idivw_AX(cpu_env, cpu_T[0]);
B
bellard 已提交
4866 4867
                break;
            default:
4868
            case MO_32:
4869
                gen_helper_idivl_EAX(cpu_env, cpu_T[0]);
B
bellard 已提交
4870 4871
                break;
#ifdef TARGET_X86_64
4872
            case MO_64:
4873
                gen_helper_idivq_EAX(cpu_env, cpu_T[0]);
B
bellard 已提交
4874
                break;
B
bellard 已提交
4875
#endif
B
bellard 已提交
4876 4877 4878 4879 4880 4881 4882 4883 4884
            }
            break;
        default:
            goto illegal_op;
        }
        break;

    case 0xfe: /* GRP4 */
    case 0xff: /* GRP5 */
4885
        ot = mo_b_d(b, dflag);
B
bellard 已提交
4886

4887
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
4888
        mod = (modrm >> 6) & 3;
B
bellard 已提交
4889
        rm = (modrm & 7) | REX_B(s);
B
bellard 已提交
4890 4891 4892 4893
        op = (modrm >> 3) & 7;
        if (op >= 2 && b == 0xfe) {
            goto illegal_op;
        }
B
bellard 已提交
4894
        if (CODE64(s)) {
4895
            if (op == 2 || op == 4) {
B
bellard 已提交
4896
                /* operand size for jumps is 64 bit */
4897
                ot = MO_64;
4898
            } else if (op == 3 || op == 5) {
4899
                ot = dflag != MO_16 ? MO_32 + (rex_w == 1) : MO_16;
B
bellard 已提交
4900 4901
            } else if (op == 6) {
                /* default push size is 64 bit */
4902
                ot = mo_pushpop(s, dflag);
B
bellard 已提交
4903 4904
            }
        }
B
bellard 已提交
4905
        if (mod != 3) {
4906
            gen_lea_modrm(env, s, modrm);
B
bellard 已提交
4907
            if (op >= 2 && op != 3 && op != 5)
4908
                gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
B
bellard 已提交
4909
        } else {
4910
            gen_op_mov_v_reg(ot, cpu_T[0], rm);
B
bellard 已提交
4911 4912 4913 4914 4915 4916 4917 4918 4919 4920 4921 4922 4923 4924 4925 4926 4927 4928
        }

        switch(op) {
        case 0: /* inc Ev */
            if (mod != 3)
                opreg = OR_TMP0;
            else
                opreg = rm;
            gen_inc(s, ot, opreg, 1);
            break;
        case 1: /* dec Ev */
            if (mod != 3)
                opreg = OR_TMP0;
            else
                opreg = rm;
            gen_inc(s, ot, opreg, -1);
            break;
        case 2: /* call Ev */
4929
            /* XXX: optimize if memory (no 'and' is necessary) */
4930
            if (dflag == MO_16) {
4931 4932
                tcg_gen_ext16u_tl(cpu_T[0], cpu_T[0]);
            }
B
bellard 已提交
4933
            next_eip = s->pc - s->cs_base;
4934
            tcg_gen_movi_tl(cpu_T[1], next_eip);
4935
            gen_push_v(s, cpu_T[1]);
4936
            gen_op_jmp_v(cpu_T[0]);
B
bellard 已提交
4937 4938
            gen_eob(s);
            break;
B
bellard 已提交
4939
        case 3: /* lcall Ev */
4940
            gen_op_ld_v(s, ot, cpu_T[1], cpu_A0);
4941
            gen_add_A0_im(s, 1 << ot);
4942
            gen_op_ld_v(s, MO_16, cpu_T[0], cpu_A0);
B
bellard 已提交
4943 4944
        do_lcall:
            if (s->pe && !s->vm86) {
4945
                tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
4946
                gen_helper_lcall_protected(cpu_env, cpu_tmp2_i32, cpu_T[1],
4947
                                           tcg_const_i32(dflag - 1),
4948
                                           tcg_const_tl(s->pc - s->cs_base));
B
bellard 已提交
4949
            } else {
4950
                tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
4951
                gen_helper_lcall_real(cpu_env, cpu_tmp2_i32, cpu_T[1],
4952
                                      tcg_const_i32(dflag - 1),
P
pbrook 已提交
4953
                                      tcg_const_i32(s->pc - s->cs_base));
B
bellard 已提交
4954 4955 4956 4957
            }
            gen_eob(s);
            break;
        case 4: /* jmp Ev */
4958
            if (dflag == MO_16) {
4959 4960
                tcg_gen_ext16u_tl(cpu_T[0], cpu_T[0]);
            }
4961
            gen_op_jmp_v(cpu_T[0]);
B
bellard 已提交
4962 4963 4964
            gen_eob(s);
            break;
        case 5: /* ljmp Ev */
4965
            gen_op_ld_v(s, ot, cpu_T[1], cpu_A0);
4966
            gen_add_A0_im(s, 1 << ot);
4967
            gen_op_ld_v(s, MO_16, cpu_T[0], cpu_A0);
B
bellard 已提交
4968 4969
        do_ljmp:
            if (s->pe && !s->vm86) {
4970
                tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
4971
                gen_helper_ljmp_protected(cpu_env, cpu_tmp2_i32, cpu_T[1],
4972
                                          tcg_const_tl(s->pc - s->cs_base));
B
bellard 已提交
4973
            } else {
4974
                gen_op_movl_seg_T0_vm(R_CS);
R
Richard Henderson 已提交
4975
                gen_op_jmp_v(cpu_T[1]);
B
bellard 已提交
4976 4977 4978 4979
            }
            gen_eob(s);
            break;
        case 6: /* push Ev */
4980
            gen_push_v(s, cpu_T[0]);
B
bellard 已提交
4981 4982 4983 4984 4985 4986 4987
            break;
        default:
            goto illegal_op;
        }
        break;

    case 0x84: /* test Ev, Gv */
4988
    case 0x85:
4989
        ot = mo_b_d(b, dflag);
B
bellard 已提交
4990

4991
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
4992
        reg = ((modrm >> 3) & 7) | rex_r;
4993

4994
        gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
4995
        gen_op_mov_v_reg(ot, cpu_T[1], reg);
B
bellard 已提交
4996
        gen_op_testl_T0_T1_cc();
4997
        set_cc_op(s, CC_OP_LOGICB + ot);
B
bellard 已提交
4998
        break;
4999

B
bellard 已提交
5000 5001
    case 0xa8: /* test eAX, Iv */
    case 0xa9:
5002
        ot = mo_b_d(b, dflag);
5003
        val = insn_get(env, s, ot);
B
bellard 已提交
5004

5005
        gen_op_mov_v_reg(ot, cpu_T[0], OR_EAX);
5006
        tcg_gen_movi_tl(cpu_T[1], val);
B
bellard 已提交
5007
        gen_op_testl_T0_T1_cc();
5008
        set_cc_op(s, CC_OP_LOGICB + ot);
B
bellard 已提交
5009
        break;
5010

B
bellard 已提交
5011
    case 0x98: /* CWDE/CBW */
5012
        switch (dflag) {
B
bellard 已提交
5013
#ifdef TARGET_X86_64
5014
        case MO_64:
5015
            gen_op_mov_v_reg(MO_32, cpu_T[0], R_EAX);
B
bellard 已提交
5016
            tcg_gen_ext32s_tl(cpu_T[0], cpu_T[0]);
5017
            gen_op_mov_reg_v(MO_64, R_EAX, cpu_T[0]);
5018
            break;
B
bellard 已提交
5019
#endif
5020
        case MO_32:
5021
            gen_op_mov_v_reg(MO_16, cpu_T[0], R_EAX);
B
bellard 已提交
5022
            tcg_gen_ext16s_tl(cpu_T[0], cpu_T[0]);
5023
            gen_op_mov_reg_v(MO_32, R_EAX, cpu_T[0]);
5024 5025
            break;
        case MO_16:
5026
            gen_op_mov_v_reg(MO_8, cpu_T[0], R_EAX);
B
bellard 已提交
5027
            tcg_gen_ext8s_tl(cpu_T[0], cpu_T[0]);
5028
            gen_op_mov_reg_v(MO_16, R_EAX, cpu_T[0]);
5029 5030 5031
            break;
        default:
            tcg_abort();
B
bellard 已提交
5032
        }
B
bellard 已提交
5033 5034
        break;
    case 0x99: /* CDQ/CWD */
5035
        switch (dflag) {
B
bellard 已提交
5036
#ifdef TARGET_X86_64
5037
        case MO_64:
5038
            gen_op_mov_v_reg(MO_64, cpu_T[0], R_EAX);
B
bellard 已提交
5039
            tcg_gen_sari_tl(cpu_T[0], cpu_T[0], 63);
5040
            gen_op_mov_reg_v(MO_64, R_EDX, cpu_T[0]);
5041
            break;
B
bellard 已提交
5042
#endif
5043
        case MO_32:
5044
            gen_op_mov_v_reg(MO_32, cpu_T[0], R_EAX);
B
bellard 已提交
5045 5046
            tcg_gen_ext32s_tl(cpu_T[0], cpu_T[0]);
            tcg_gen_sari_tl(cpu_T[0], cpu_T[0], 31);
5047
            gen_op_mov_reg_v(MO_32, R_EDX, cpu_T[0]);
5048 5049
            break;
        case MO_16:
5050
            gen_op_mov_v_reg(MO_16, cpu_T[0], R_EAX);
B
bellard 已提交
5051 5052
            tcg_gen_ext16s_tl(cpu_T[0], cpu_T[0]);
            tcg_gen_sari_tl(cpu_T[0], cpu_T[0], 15);
5053
            gen_op_mov_reg_v(MO_16, R_EDX, cpu_T[0]);
5054 5055 5056
            break;
        default:
            tcg_abort();
B
bellard 已提交
5057
        }
B
bellard 已提交
5058 5059 5060 5061
        break;
    case 0x1af: /* imul Gv, Ev */
    case 0x69: /* imul Gv, Ev, I */
    case 0x6b:
5062
        ot = dflag;
5063
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5064 5065 5066 5067 5068
        reg = ((modrm >> 3) & 7) | rex_r;
        if (b == 0x69)
            s->rip_offset = insn_const_size(ot);
        else if (b == 0x6b)
            s->rip_offset = 1;
5069
        gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
B
bellard 已提交
5070
        if (b == 0x69) {
5071
            val = insn_get(env, s, ot);
5072
            tcg_gen_movi_tl(cpu_T[1], val);
B
bellard 已提交
5073
        } else if (b == 0x6b) {
5074
            val = (int8_t)insn_get(env, s, MO_8);
5075
            tcg_gen_movi_tl(cpu_T[1], val);
B
bellard 已提交
5076
        } else {
5077
            gen_op_mov_v_reg(ot, cpu_T[1], reg);
B
bellard 已提交
5078
        }
5079
        switch (ot) {
B
bellard 已提交
5080
#ifdef TARGET_X86_64
5081
        case MO_64:
5082 5083 5084 5085 5086
            tcg_gen_muls2_i64(cpu_regs[reg], cpu_T[1], cpu_T[0], cpu_T[1]);
            tcg_gen_mov_tl(cpu_cc_dst, cpu_regs[reg]);
            tcg_gen_sari_tl(cpu_cc_src, cpu_cc_dst, 63);
            tcg_gen_sub_tl(cpu_cc_src, cpu_cc_src, cpu_T[1]);
            break;
B
bellard 已提交
5087
#endif
5088
        case MO_32:
5089 5090 5091 5092 5093 5094 5095 5096 5097 5098 5099
            tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
            tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_T[1]);
            tcg_gen_muls2_i32(cpu_tmp2_i32, cpu_tmp3_i32,
                              cpu_tmp2_i32, cpu_tmp3_i32);
            tcg_gen_extu_i32_tl(cpu_regs[reg], cpu_tmp2_i32);
            tcg_gen_sari_i32(cpu_tmp2_i32, cpu_tmp2_i32, 31);
            tcg_gen_mov_tl(cpu_cc_dst, cpu_regs[reg]);
            tcg_gen_sub_i32(cpu_tmp2_i32, cpu_tmp2_i32, cpu_tmp3_i32);
            tcg_gen_extu_i32_tl(cpu_cc_src, cpu_tmp2_i32);
            break;
        default:
B
bellard 已提交
5100 5101 5102 5103 5104 5105 5106
            tcg_gen_ext16s_tl(cpu_T[0], cpu_T[0]);
            tcg_gen_ext16s_tl(cpu_T[1], cpu_T[1]);
            /* XXX: use 32 bit mul which could be faster */
            tcg_gen_mul_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
            tcg_gen_mov_tl(cpu_cc_dst, cpu_T[0]);
            tcg_gen_ext16s_tl(cpu_tmp0, cpu_T[0]);
            tcg_gen_sub_tl(cpu_cc_src, cpu_T[0], cpu_tmp0);
5107
            gen_op_mov_reg_v(ot, reg, cpu_T[0]);
5108
            break;
B
bellard 已提交
5109
        }
5110
        set_cc_op(s, CC_OP_MULB + ot);
B
bellard 已提交
5111 5112 5113
        break;
    case 0x1c0:
    case 0x1c1: /* xadd Ev, Gv */
5114
        ot = mo_b_d(b, dflag);
5115
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5116
        reg = ((modrm >> 3) & 7) | rex_r;
B
bellard 已提交
5117 5118
        mod = (modrm >> 6) & 3;
        if (mod == 3) {
B
bellard 已提交
5119
            rm = (modrm & 7) | REX_B(s);
5120 5121
            gen_op_mov_v_reg(ot, cpu_T[0], reg);
            gen_op_mov_v_reg(ot, cpu_T[1], rm);
5122
            tcg_gen_add_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
5123
            gen_op_mov_reg_v(ot, reg, cpu_T[1]);
5124
            gen_op_mov_reg_v(ot, rm, cpu_T[0]);
B
bellard 已提交
5125
        } else {
5126
            gen_lea_modrm(env, s, modrm);
5127
            gen_op_mov_v_reg(ot, cpu_T[0], reg);
5128
            gen_op_ld_v(s, ot, cpu_T[1], cpu_A0);
5129
            tcg_gen_add_tl(cpu_T[0], cpu_T[0], cpu_T[1]);
5130
            gen_op_st_v(s, ot, cpu_T[0], cpu_A0);
5131
            gen_op_mov_reg_v(ot, reg, cpu_T[1]);
B
bellard 已提交
5132 5133
        }
        gen_op_update2_cc();
5134
        set_cc_op(s, CC_OP_ADDB + ot);
B
bellard 已提交
5135 5136 5137
        break;
    case 0x1b0:
    case 0x1b1: /* cmpxchg Ev, Gv */
B
bellard 已提交
5138
        {
5139
            TCGLabel *label1, *label2;
5140
            TCGv t0, t1, t2, a0;
B
bellard 已提交
5141

5142
            ot = mo_b_d(b, dflag);
5143
            modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5144 5145
            reg = ((modrm >> 3) & 7) | rex_r;
            mod = (modrm >> 6) & 3;
P
pbrook 已提交
5146 5147 5148 5149
            t0 = tcg_temp_local_new();
            t1 = tcg_temp_local_new();
            t2 = tcg_temp_local_new();
            a0 = tcg_temp_local_new();
5150
            gen_op_mov_v_reg(ot, t1, reg);
B
bellard 已提交
5151 5152
            if (mod == 3) {
                rm = (modrm & 7) | REX_B(s);
5153
                gen_op_mov_v_reg(ot, t0, rm);
B
bellard 已提交
5154
            } else {
5155
                gen_lea_modrm(env, s, modrm);
5156
                tcg_gen_mov_tl(a0, cpu_A0);
5157
                gen_op_ld_v(s, ot, t0, a0);
B
bellard 已提交
5158 5159 5160
                rm = 0; /* avoid warning */
            }
            label1 = gen_new_label();
5161 5162
            tcg_gen_mov_tl(t2, cpu_regs[R_EAX]);
            gen_extu(ot, t0);
5163
            gen_extu(ot, t2);
5164
            tcg_gen_brcond_tl(TCG_COND_EQ, t2, t0, label1);
5165
            label2 = gen_new_label();
B
bellard 已提交
5166
            if (mod == 3) {
5167
                gen_op_mov_reg_v(ot, R_EAX, t0);
B
bellard 已提交
5168 5169
                tcg_gen_br(label2);
                gen_set_label(label1);
5170
                gen_op_mov_reg_v(ot, rm, t1);
B
bellard 已提交
5171
            } else {
5172 5173 5174
                /* perform no-op store cycle like physical cpu; must be
                   before changing accumulator to ensure idempotency if
                   the store faults and the instruction is restarted */
5175
                gen_op_st_v(s, ot, t0, a0);
5176
                gen_op_mov_reg_v(ot, R_EAX, t0);
5177
                tcg_gen_br(label2);
B
bellard 已提交
5178
                gen_set_label(label1);
5179
                gen_op_st_v(s, ot, t1, a0);
B
bellard 已提交
5180
            }
5181
            gen_set_label(label2);
5182
            tcg_gen_mov_tl(cpu_cc_src, t0);
5183 5184
            tcg_gen_mov_tl(cpu_cc_srcT, t2);
            tcg_gen_sub_tl(cpu_cc_dst, t2, t0);
5185
            set_cc_op(s, CC_OP_SUBB + ot);
5186 5187 5188 5189
            tcg_temp_free(t0);
            tcg_temp_free(t1);
            tcg_temp_free(t2);
            tcg_temp_free(a0);
B
bellard 已提交
5190 5191 5192
        }
        break;
    case 0x1c7: /* cmpxchg8b */
5193
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5194
        mod = (modrm >> 6) & 3;
5195
        if ((mod == 3) || ((modrm & 0x38) != 0x8))
B
bellard 已提交
5196
            goto illegal_op;
B
bellard 已提交
5197
#ifdef TARGET_X86_64
5198
        if (dflag == MO_64) {
B
bellard 已提交
5199 5200
            if (!(s->cpuid_ext_features & CPUID_EXT_CX16))
                goto illegal_op;
5201
            gen_lea_modrm(env, s, modrm);
B
Blue Swirl 已提交
5202
            gen_helper_cmpxchg16b(cpu_env, cpu_A0);
B
bellard 已提交
5203 5204 5205 5206 5207
        } else
#endif        
        {
            if (!(s->cpuid_features & CPUID_CX8))
                goto illegal_op;
5208
            gen_lea_modrm(env, s, modrm);
B
Blue Swirl 已提交
5209
            gen_helper_cmpxchg8b(cpu_env, cpu_A0);
B
bellard 已提交
5210
        }
5211
        set_cc_op(s, CC_OP_EFLAGS);
B
bellard 已提交
5212
        break;
5213

B
bellard 已提交
5214 5215 5216
        /**************************/
        /* push/pop */
    case 0x50 ... 0x57: /* push */
5217
        gen_op_mov_v_reg(MO_32, cpu_T[0], (b & 7) | REX_B(s));
5218
        gen_push_v(s, cpu_T[0]);
B
bellard 已提交
5219 5220
        break;
    case 0x58 ... 0x5f: /* pop */
5221
        ot = gen_pop_T0(s);
B
bellard 已提交
5222
        /* NOTE: order is important for pop %sp */
5223
        gen_pop_update(s, ot);
5224
        gen_op_mov_reg_v(ot, (b & 7) | REX_B(s), cpu_T[0]);
B
bellard 已提交
5225 5226
        break;
    case 0x60: /* pusha */
B
bellard 已提交
5227 5228
        if (CODE64(s))
            goto illegal_op;
B
bellard 已提交
5229 5230 5231
        gen_pusha(s);
        break;
    case 0x61: /* popa */
B
bellard 已提交
5232 5233
        if (CODE64(s))
            goto illegal_op;
B
bellard 已提交
5234 5235 5236 5237
        gen_popa(s);
        break;
    case 0x68: /* push Iv */
    case 0x6a:
5238
        ot = mo_pushpop(s, dflag);
B
bellard 已提交
5239
        if (b == 0x68)
5240
            val = insn_get(env, s, ot);
B
bellard 已提交
5241
        else
5242
            val = (int8_t)insn_get(env, s, MO_8);
5243
        tcg_gen_movi_tl(cpu_T[0], val);
5244
        gen_push_v(s, cpu_T[0]);
B
bellard 已提交
5245 5246
        break;
    case 0x8f: /* pop Ev */
5247
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5248
        mod = (modrm >> 6) & 3;
5249
        ot = gen_pop_T0(s);
B
bellard 已提交
5250 5251
        if (mod == 3) {
            /* NOTE: order is important for pop %sp */
5252
            gen_pop_update(s, ot);
B
bellard 已提交
5253
            rm = (modrm & 7) | REX_B(s);
5254
            gen_op_mov_reg_v(ot, rm, cpu_T[0]);
B
bellard 已提交
5255 5256
        } else {
            /* NOTE: order is important too for MMU exceptions */
B
bellard 已提交
5257
            s->popl_esp_hack = 1 << ot;
5258
            gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 1);
B
bellard 已提交
5259
            s->popl_esp_hack = 0;
5260
            gen_pop_update(s, ot);
B
bellard 已提交
5261
        }
B
bellard 已提交
5262 5263 5264 5265
        break;
    case 0xc8: /* enter */
        {
            int level;
5266
            val = cpu_lduw_code(env, s->pc);
B
bellard 已提交
5267
            s->pc += 2;
5268
            level = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5269 5270 5271 5272 5273
            gen_enter(s, val, level);
        }
        break;
    case 0xc9: /* leave */
        /* XXX: exception not precise (ESP is updated before potential exception) */
B
bellard 已提交
5274
        if (CODE64(s)) {
5275
            gen_op_mov_v_reg(MO_64, cpu_T[0], R_EBP);
5276
            gen_op_mov_reg_v(MO_64, R_ESP, cpu_T[0]);
B
bellard 已提交
5277
        } else if (s->ss32) {
5278
            gen_op_mov_v_reg(MO_32, cpu_T[0], R_EBP);
5279
            gen_op_mov_reg_v(MO_32, R_ESP, cpu_T[0]);
B
bellard 已提交
5280
        } else {
5281
            gen_op_mov_v_reg(MO_16, cpu_T[0], R_EBP);
5282
            gen_op_mov_reg_v(MO_16, R_ESP, cpu_T[0]);
B
bellard 已提交
5283
        }
5284
        ot = gen_pop_T0(s);
5285
        gen_op_mov_reg_v(ot, R_EBP, cpu_T[0]);
5286
        gen_pop_update(s, ot);
B
bellard 已提交
5287 5288 5289 5290 5291
        break;
    case 0x06: /* push es */
    case 0x0e: /* push cs */
    case 0x16: /* push ss */
    case 0x1e: /* push ds */
B
bellard 已提交
5292 5293
        if (CODE64(s))
            goto illegal_op;
B
bellard 已提交
5294
        gen_op_movl_T0_seg(b >> 3);
5295
        gen_push_v(s, cpu_T[0]);
B
bellard 已提交
5296 5297 5298 5299
        break;
    case 0x1a0: /* push fs */
    case 0x1a8: /* push gs */
        gen_op_movl_T0_seg((b >> 3) & 7);
5300
        gen_push_v(s, cpu_T[0]);
B
bellard 已提交
5301 5302 5303 5304
        break;
    case 0x07: /* pop es */
    case 0x17: /* pop ss */
    case 0x1f: /* pop ds */
B
bellard 已提交
5305 5306
        if (CODE64(s))
            goto illegal_op;
B
bellard 已提交
5307
        reg = b >> 3;
5308
        ot = gen_pop_T0(s);
5309
        gen_movl_seg_T0(s, reg);
5310
        gen_pop_update(s, ot);
B
bellard 已提交
5311
        if (reg == R_SS) {
5312 5313 5314 5315
            /* if reg == SS, inhibit interrupts/trace. */
            /* If several instructions disable interrupts, only the
               _first_ does it */
            if (!(s->tb->flags & HF_INHIBIT_IRQ_MASK))
5316
                gen_helper_set_inhibit_irq(cpu_env);
B
bellard 已提交
5317 5318 5319
            s->tf = 0;
        }
        if (s->is_jmp) {
B
bellard 已提交
5320
            gen_jmp_im(s->pc - s->cs_base);
B
bellard 已提交
5321 5322 5323 5324 5325
            gen_eob(s);
        }
        break;
    case 0x1a1: /* pop fs */
    case 0x1a9: /* pop gs */
5326
        ot = gen_pop_T0(s);
5327
        gen_movl_seg_T0(s, (b >> 3) & 7);
5328
        gen_pop_update(s, ot);
B
bellard 已提交
5329
        if (s->is_jmp) {
B
bellard 已提交
5330
            gen_jmp_im(s->pc - s->cs_base);
B
bellard 已提交
5331 5332 5333 5334 5335 5336 5337 5338
            gen_eob(s);
        }
        break;

        /**************************/
        /* mov */
    case 0x88:
    case 0x89: /* mov Gv, Ev */
5339
        ot = mo_b_d(b, dflag);
5340
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5341
        reg = ((modrm >> 3) & 7) | rex_r;
5342

B
bellard 已提交
5343
        /* generate a generic store */
5344
        gen_ldst_modrm(env, s, modrm, ot, reg, 1);
B
bellard 已提交
5345 5346 5347
        break;
    case 0xc6:
    case 0xc7: /* mov Ev, Iv */
5348
        ot = mo_b_d(b, dflag);
5349
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5350
        mod = (modrm >> 6) & 3;
B
bellard 已提交
5351 5352
        if (mod != 3) {
            s->rip_offset = insn_const_size(ot);
5353
            gen_lea_modrm(env, s, modrm);
B
bellard 已提交
5354
        }
5355
        val = insn_get(env, s, ot);
5356
        tcg_gen_movi_tl(cpu_T[0], val);
5357 5358 5359
        if (mod != 3) {
            gen_op_st_v(s, ot, cpu_T[0], cpu_A0);
        } else {
5360
            gen_op_mov_reg_v(ot, (modrm & 7) | REX_B(s), cpu_T[0]);
5361
        }
B
bellard 已提交
5362 5363 5364
        break;
    case 0x8a:
    case 0x8b: /* mov Ev, Gv */
5365
        ot = mo_b_d(b, dflag);
5366
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5367
        reg = ((modrm >> 3) & 7) | rex_r;
5368

5369
        gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
5370
        gen_op_mov_reg_v(ot, reg, cpu_T[0]);
B
bellard 已提交
5371 5372
        break;
    case 0x8e: /* mov seg, Gv */
5373
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5374 5375 5376
        reg = (modrm >> 3) & 7;
        if (reg >= 6 || reg == R_CS)
            goto illegal_op;
5377
        gen_ldst_modrm(env, s, modrm, MO_16, OR_TMP0, 0);
5378
        gen_movl_seg_T0(s, reg);
B
bellard 已提交
5379 5380
        if (reg == R_SS) {
            /* if reg == SS, inhibit interrupts/trace */
5381 5382 5383
            /* If several instructions disable interrupts, only the
               _first_ does it */
            if (!(s->tb->flags & HF_INHIBIT_IRQ_MASK))
5384
                gen_helper_set_inhibit_irq(cpu_env);
B
bellard 已提交
5385 5386 5387
            s->tf = 0;
        }
        if (s->is_jmp) {
B
bellard 已提交
5388
            gen_jmp_im(s->pc - s->cs_base);
B
bellard 已提交
5389 5390 5391 5392
            gen_eob(s);
        }
        break;
    case 0x8c: /* mov Gv, seg */
5393
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5394 5395 5396 5397 5398
        reg = (modrm >> 3) & 7;
        mod = (modrm >> 6) & 3;
        if (reg >= 6)
            goto illegal_op;
        gen_op_movl_T0_seg(reg);
5399
        ot = mod == 3 ? dflag : MO_16;
5400
        gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 1);
B
bellard 已提交
5401 5402 5403 5404 5405 5406 5407
        break;

    case 0x1b6: /* movzbS Gv, Eb */
    case 0x1b7: /* movzwS Gv, Eb */
    case 0x1be: /* movsbS Gv, Eb */
    case 0x1bf: /* movswS Gv, Eb */
        {
5408 5409 5410
            TCGMemOp d_ot;
            TCGMemOp s_ot;

B
bellard 已提交
5411
            /* d_ot is the size of destination */
5412
            d_ot = dflag;
B
bellard 已提交
5413
            /* ot is the size of source */
5414
            ot = (b & 1) + MO_8;
5415 5416 5417
            /* s_ot is the sign+size of source */
            s_ot = b & 8 ? MO_SIGN | ot : ot;

5418
            modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5419
            reg = ((modrm >> 3) & 7) | rex_r;
B
bellard 已提交
5420
            mod = (modrm >> 6) & 3;
B
bellard 已提交
5421
            rm = (modrm & 7) | REX_B(s);
5422

B
bellard 已提交
5423
            if (mod == 3) {
5424
                gen_op_mov_v_reg(ot, cpu_T[0], rm);
5425 5426
                switch (s_ot) {
                case MO_UB:
B
bellard 已提交
5427
                    tcg_gen_ext8u_tl(cpu_T[0], cpu_T[0]);
B
bellard 已提交
5428
                    break;
5429
                case MO_SB:
B
bellard 已提交
5430
                    tcg_gen_ext8s_tl(cpu_T[0], cpu_T[0]);
B
bellard 已提交
5431
                    break;
5432
                case MO_UW:
B
bellard 已提交
5433
                    tcg_gen_ext16u_tl(cpu_T[0], cpu_T[0]);
B
bellard 已提交
5434 5435
                    break;
                default:
5436
                case MO_SW:
B
bellard 已提交
5437
                    tcg_gen_ext16s_tl(cpu_T[0], cpu_T[0]);
B
bellard 已提交
5438 5439
                    break;
                }
5440
                gen_op_mov_reg_v(d_ot, reg, cpu_T[0]);
B
bellard 已提交
5441
            } else {
5442
                gen_lea_modrm(env, s, modrm);
5443
                gen_op_ld_v(s, s_ot, cpu_T[0], cpu_A0);
5444
                gen_op_mov_reg_v(d_ot, reg, cpu_T[0]);
B
bellard 已提交
5445 5446 5447 5448 5449
            }
        }
        break;

    case 0x8d: /* lea */
5450
        ot = dflag;
5451
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5452 5453 5454
        mod = (modrm >> 6) & 3;
        if (mod == 3)
            goto illegal_op;
B
bellard 已提交
5455
        reg = ((modrm >> 3) & 7) | rex_r;
B
bellard 已提交
5456 5457 5458 5459
        /* we must ensure that no segment is added */
        s->override = -1;
        val = s->addseg;
        s->addseg = 0;
5460
        gen_lea_modrm(env, s, modrm);
B
bellard 已提交
5461
        s->addseg = val;
5462
        gen_op_mov_reg_v(ot, reg, cpu_A0);
B
bellard 已提交
5463
        break;
5464

B
bellard 已提交
5465 5466 5467 5468 5469
    case 0xa0: /* mov EAX, Ov */
    case 0xa1:
    case 0xa2: /* mov Ov, EAX */
    case 0xa3:
        {
B
bellard 已提交
5470 5471
            target_ulong offset_addr;

5472
            ot = mo_b_d(b, dflag);
5473
            switch (s->aflag) {
B
bellard 已提交
5474
#ifdef TARGET_X86_64
5475
            case MO_64:
5476
                offset_addr = cpu_ldq_code(env, s->pc);
B
bellard 已提交
5477
                s->pc += 8;
5478
                break;
B
bellard 已提交
5479
#endif
5480 5481 5482
            default:
                offset_addr = insn_get(env, s, s->aflag);
                break;
B
bellard 已提交
5483
            }
5484
            tcg_gen_movi_tl(cpu_A0, offset_addr);
B
bellard 已提交
5485
            gen_add_A0_ds_seg(s);
B
bellard 已提交
5486
            if ((b & 2) == 0) {
5487
                gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
5488
                gen_op_mov_reg_v(ot, R_EAX, cpu_T[0]);
B
bellard 已提交
5489
            } else {
5490
                gen_op_mov_v_reg(ot, cpu_T[0], R_EAX);
5491
                gen_op_st_v(s, ot, cpu_T[0], cpu_A0);
B
bellard 已提交
5492 5493 5494 5495
            }
        }
        break;
    case 0xd7: /* xlat */
5496 5497 5498 5499
        tcg_gen_mov_tl(cpu_A0, cpu_regs[R_EBX]);
        tcg_gen_ext8u_tl(cpu_T[0], cpu_regs[R_EAX]);
        tcg_gen_add_tl(cpu_A0, cpu_A0, cpu_T[0]);
        gen_extu(s->aflag, cpu_A0);
B
bellard 已提交
5500
        gen_add_A0_ds_seg(s);
5501
        gen_op_ld_v(s, MO_8, cpu_T[0], cpu_A0);
5502
        gen_op_mov_reg_v(MO_8, R_EAX, cpu_T[0]);
B
bellard 已提交
5503 5504
        break;
    case 0xb0 ... 0xb7: /* mov R, Ib */
5505
        val = insn_get(env, s, MO_8);
5506
        tcg_gen_movi_tl(cpu_T[0], val);
5507
        gen_op_mov_reg_v(MO_8, (b & 7) | REX_B(s), cpu_T[0]);
B
bellard 已提交
5508 5509
        break;
    case 0xb8 ... 0xbf: /* mov R, Iv */
B
bellard 已提交
5510
#ifdef TARGET_X86_64
5511
        if (dflag == MO_64) {
B
bellard 已提交
5512 5513
            uint64_t tmp;
            /* 64 bit case */
5514
            tmp = cpu_ldq_code(env, s->pc);
B
bellard 已提交
5515 5516
            s->pc += 8;
            reg = (b & 7) | REX_B(s);
5517
            tcg_gen_movi_tl(cpu_T[0], tmp);
5518
            gen_op_mov_reg_v(MO_64, reg, cpu_T[0]);
5519
        } else
B
bellard 已提交
5520 5521
#endif
        {
5522
            ot = dflag;
5523
            val = insn_get(env, s, ot);
B
bellard 已提交
5524
            reg = (b & 7) | REX_B(s);
5525
            tcg_gen_movi_tl(cpu_T[0], val);
5526
            gen_op_mov_reg_v(ot, reg, cpu_T[0]);
B
bellard 已提交
5527
        }
B
bellard 已提交
5528 5529 5530
        break;

    case 0x91 ... 0x97: /* xchg R, EAX */
R
Richard Henderson 已提交
5531
    do_xchg_reg_eax:
5532
        ot = dflag;
B
bellard 已提交
5533
        reg = (b & 7) | REX_B(s);
B
bellard 已提交
5534 5535 5536 5537
        rm = R_EAX;
        goto do_xchg_reg;
    case 0x86:
    case 0x87: /* xchg Ev, Gv */
5538
        ot = mo_b_d(b, dflag);
5539
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5540
        reg = ((modrm >> 3) & 7) | rex_r;
B
bellard 已提交
5541 5542
        mod = (modrm >> 6) & 3;
        if (mod == 3) {
B
bellard 已提交
5543
            rm = (modrm & 7) | REX_B(s);
B
bellard 已提交
5544
        do_xchg_reg:
5545 5546
            gen_op_mov_v_reg(ot, cpu_T[0], reg);
            gen_op_mov_v_reg(ot, cpu_T[1], rm);
5547
            gen_op_mov_reg_v(ot, rm, cpu_T[0]);
5548
            gen_op_mov_reg_v(ot, reg, cpu_T[1]);
B
bellard 已提交
5549
        } else {
5550
            gen_lea_modrm(env, s, modrm);
5551
            gen_op_mov_v_reg(ot, cpu_T[0], reg);
B
bellard 已提交
5552 5553
            /* for xchg, lock is implicit */
            if (!(prefixes & PREFIX_LOCK))
P
pbrook 已提交
5554
                gen_helper_lock();
5555
            gen_op_ld_v(s, ot, cpu_T[1], cpu_A0);
5556
            gen_op_st_v(s, ot, cpu_T[0], cpu_A0);
B
bellard 已提交
5557
            if (!(prefixes & PREFIX_LOCK))
P
pbrook 已提交
5558
                gen_helper_unlock();
5559
            gen_op_mov_reg_v(ot, reg, cpu_T[1]);
B
bellard 已提交
5560 5561 5562
        }
        break;
    case 0xc4: /* les Gv */
5563
        /* In CODE64 this is VEX3; see above.  */
B
bellard 已提交
5564 5565 5566
        op = R_ES;
        goto do_lxx;
    case 0xc5: /* lds Gv */
5567
        /* In CODE64 this is VEX2; see above.  */
B
bellard 已提交
5568 5569 5570 5571 5572 5573 5574 5575 5576 5577 5578
        op = R_DS;
        goto do_lxx;
    case 0x1b2: /* lss Gv */
        op = R_SS;
        goto do_lxx;
    case 0x1b4: /* lfs Gv */
        op = R_FS;
        goto do_lxx;
    case 0x1b5: /* lgs Gv */
        op = R_GS;
    do_lxx:
5579
        ot = dflag != MO_16 ? MO_32 : MO_16;
5580
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5581
        reg = ((modrm >> 3) & 7) | rex_r;
B
bellard 已提交
5582 5583 5584
        mod = (modrm >> 6) & 3;
        if (mod == 3)
            goto illegal_op;
5585
        gen_lea_modrm(env, s, modrm);
5586
        gen_op_ld_v(s, ot, cpu_T[1], cpu_A0);
5587
        gen_add_A0_im(s, 1 << ot);
B
bellard 已提交
5588
        /* load the segment first to handle exceptions properly */
5589
        gen_op_ld_v(s, MO_16, cpu_T[0], cpu_A0);
5590
        gen_movl_seg_T0(s, op);
B
bellard 已提交
5591
        /* then put the data */
5592
        gen_op_mov_reg_v(ot, reg, cpu_T[1]);
B
bellard 已提交
5593
        if (s->is_jmp) {
B
bellard 已提交
5594
            gen_jmp_im(s->pc - s->cs_base);
B
bellard 已提交
5595 5596 5597
            gen_eob(s);
        }
        break;
5598

B
bellard 已提交
5599 5600 5601 5602 5603 5604 5605 5606
        /************************/
        /* shifts */
    case 0xc0:
    case 0xc1:
        /* shift Ev,Ib */
        shift = 2;
    grp2:
        {
5607
            ot = mo_b_d(b, dflag);
5608
            modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5609 5610
            mod = (modrm >> 6) & 3;
            op = (modrm >> 3) & 7;
5611

B
bellard 已提交
5612
            if (mod != 3) {
B
bellard 已提交
5613 5614 5615
                if (shift == 2) {
                    s->rip_offset = 1;
                }
5616
                gen_lea_modrm(env, s, modrm);
B
bellard 已提交
5617 5618
                opreg = OR_TMP0;
            } else {
B
bellard 已提交
5619
                opreg = (modrm & 7) | REX_B(s);
B
bellard 已提交
5620 5621 5622 5623 5624 5625 5626
            }

            /* simpler op */
            if (shift == 0) {
                gen_shift(s, op, ot, opreg, OR_ECX);
            } else {
                if (shift == 2) {
5627
                    shift = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5628 5629 5630 5631 5632 5633 5634 5635 5636 5637 5638 5639 5640 5641 5642 5643 5644 5645 5646 5647 5648 5649 5650 5651 5652 5653 5654 5655 5656 5657 5658 5659
                }
                gen_shifti(s, op, ot, opreg, shift);
            }
        }
        break;
    case 0xd0:
    case 0xd1:
        /* shift Ev,1 */
        shift = 1;
        goto grp2;
    case 0xd2:
    case 0xd3:
        /* shift Ev,cl */
        shift = 0;
        goto grp2;

    case 0x1a4: /* shld imm */
        op = 0;
        shift = 1;
        goto do_shiftd;
    case 0x1a5: /* shld cl */
        op = 0;
        shift = 0;
        goto do_shiftd;
    case 0x1ac: /* shrd imm */
        op = 1;
        shift = 1;
        goto do_shiftd;
    case 0x1ad: /* shrd cl */
        op = 1;
        shift = 0;
    do_shiftd:
5660
        ot = dflag;
5661
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5662
        mod = (modrm >> 6) & 3;
B
bellard 已提交
5663 5664
        rm = (modrm & 7) | REX_B(s);
        reg = ((modrm >> 3) & 7) | rex_r;
B
bellard 已提交
5665
        if (mod != 3) {
5666
            gen_lea_modrm(env, s, modrm);
5667
            opreg = OR_TMP0;
B
bellard 已提交
5668
        } else {
5669
            opreg = rm;
B
bellard 已提交
5670
        }
5671
        gen_op_mov_v_reg(ot, cpu_T[1], reg);
5672

B
bellard 已提交
5673
        if (shift) {
P
Paolo Bonzini 已提交
5674 5675 5676
            TCGv imm = tcg_const_tl(cpu_ldub_code(env, s->pc++));
            gen_shiftd_rm_T1(s, ot, opreg, op, imm);
            tcg_temp_free(imm);
B
bellard 已提交
5677
        } else {
P
Paolo Bonzini 已提交
5678
            gen_shiftd_rm_T1(s, ot, opreg, op, cpu_regs[R_ECX]);
B
bellard 已提交
5679 5680 5681 5682 5683
        }
        break;

        /************************/
        /* floats */
5684
    case 0xd8 ... 0xdf:
B
bellard 已提交
5685 5686 5687 5688 5689 5690
        if (s->flags & (HF_EM_MASK | HF_TS_MASK)) {
            /* if CR0.EM or CR0.TS are set, generate an FPU exception */
            /* XXX: what to do if illegal op ? */
            gen_exception(s, EXCP07_PREX, pc_start - s->cs_base);
            break;
        }
5691
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
5692 5693 5694 5695 5696
        mod = (modrm >> 6) & 3;
        rm = modrm & 7;
        op = ((b & 7) << 3) | ((modrm >> 3) & 7);
        if (mod != 3) {
            /* memory op */
5697
            gen_lea_modrm(env, s, modrm);
B
bellard 已提交
5698 5699 5700 5701 5702 5703 5704 5705 5706 5707 5708
            switch(op) {
            case 0x00 ... 0x07: /* fxxxs */
            case 0x10 ... 0x17: /* fixxxl */
            case 0x20 ... 0x27: /* fxxxl */
            case 0x30 ... 0x37: /* fixxx */
                {
                    int op1;
                    op1 = op & 7;

                    switch(op >> 4) {
                    case 0:
5709 5710
                        tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0,
                                            s->mem_index, MO_LEUL);
B
Blue Swirl 已提交
5711
                        gen_helper_flds_FT0(cpu_env, cpu_tmp2_i32);
B
bellard 已提交
5712 5713
                        break;
                    case 1:
5714 5715
                        tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0,
                                            s->mem_index, MO_LEUL);
B
Blue Swirl 已提交
5716
                        gen_helper_fildl_FT0(cpu_env, cpu_tmp2_i32);
B
bellard 已提交
5717 5718
                        break;
                    case 2:
5719 5720
                        tcg_gen_qemu_ld_i64(cpu_tmp1_i64, cpu_A0,
                                            s->mem_index, MO_LEQ);
B
Blue Swirl 已提交
5721
                        gen_helper_fldl_FT0(cpu_env, cpu_tmp1_i64);
B
bellard 已提交
5722 5723 5724
                        break;
                    case 3:
                    default:
5725 5726
                        tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0,
                                            s->mem_index, MO_LESW);
B
Blue Swirl 已提交
5727
                        gen_helper_fildl_FT0(cpu_env, cpu_tmp2_i32);
B
bellard 已提交
5728 5729
                        break;
                    }
5730

P
pbrook 已提交
5731
                    gen_helper_fp_arith_ST0_FT0(op1);
B
bellard 已提交
5732 5733
                    if (op1 == 3) {
                        /* fcomp needs pop */
B
Blue Swirl 已提交
5734
                        gen_helper_fpop(cpu_env);
B
bellard 已提交
5735 5736 5737 5738 5739 5740
                    }
                }
                break;
            case 0x08: /* flds */
            case 0x0a: /* fsts */
            case 0x0b: /* fstps */
B
bellard 已提交
5741 5742 5743
            case 0x18 ... 0x1b: /* fildl, fisttpl, fistl, fistpl */
            case 0x28 ... 0x2b: /* fldl, fisttpll, fstl, fstpl */
            case 0x38 ... 0x3b: /* filds, fisttps, fists, fistps */
B
bellard 已提交
5744 5745 5746 5747
                switch(op & 7) {
                case 0:
                    switch(op >> 4) {
                    case 0:
5748 5749
                        tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0,
                                            s->mem_index, MO_LEUL);
B
Blue Swirl 已提交
5750
                        gen_helper_flds_ST0(cpu_env, cpu_tmp2_i32);
B
bellard 已提交
5751 5752
                        break;
                    case 1:
5753 5754
                        tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0,
                                            s->mem_index, MO_LEUL);
B
Blue Swirl 已提交
5755
                        gen_helper_fildl_ST0(cpu_env, cpu_tmp2_i32);
B
bellard 已提交
5756 5757
                        break;
                    case 2:
5758 5759
                        tcg_gen_qemu_ld_i64(cpu_tmp1_i64, cpu_A0,
                                            s->mem_index, MO_LEQ);
B
Blue Swirl 已提交
5760
                        gen_helper_fldl_ST0(cpu_env, cpu_tmp1_i64);
B
bellard 已提交
5761 5762 5763
                        break;
                    case 3:
                    default:
5764 5765
                        tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0,
                                            s->mem_index, MO_LESW);
B
Blue Swirl 已提交
5766
                        gen_helper_fildl_ST0(cpu_env, cpu_tmp2_i32);
B
bellard 已提交
5767 5768 5769
                        break;
                    }
                    break;
B
bellard 已提交
5770
                case 1:
B
bellard 已提交
5771
                    /* XXX: the corresponding CPUID bit must be tested ! */
B
bellard 已提交
5772 5773
                    switch(op >> 4) {
                    case 1:
B
Blue Swirl 已提交
5774
                        gen_helper_fisttl_ST0(cpu_tmp2_i32, cpu_env);
5775 5776
                        tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0,
                                            s->mem_index, MO_LEUL);
B
bellard 已提交
5777 5778
                        break;
                    case 2:
B
Blue Swirl 已提交
5779
                        gen_helper_fisttll_ST0(cpu_tmp1_i64, cpu_env);
5780 5781
                        tcg_gen_qemu_st_i64(cpu_tmp1_i64, cpu_A0,
                                            s->mem_index, MO_LEQ);
B
bellard 已提交
5782 5783 5784
                        break;
                    case 3:
                    default:
B
Blue Swirl 已提交
5785
                        gen_helper_fistt_ST0(cpu_tmp2_i32, cpu_env);
5786 5787
                        tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0,
                                            s->mem_index, MO_LEUW);
B
bellard 已提交
5788
                        break;
B
bellard 已提交
5789
                    }
B
Blue Swirl 已提交
5790
                    gen_helper_fpop(cpu_env);
B
bellard 已提交
5791
                    break;
B
bellard 已提交
5792 5793 5794
                default:
                    switch(op >> 4) {
                    case 0:
B
Blue Swirl 已提交
5795
                        gen_helper_fsts_ST0(cpu_tmp2_i32, cpu_env);
5796 5797
                        tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0,
                                            s->mem_index, MO_LEUL);
B
bellard 已提交
5798 5799
                        break;
                    case 1:
B
Blue Swirl 已提交
5800
                        gen_helper_fistl_ST0(cpu_tmp2_i32, cpu_env);
5801 5802
                        tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0,
                                            s->mem_index, MO_LEUL);
B
bellard 已提交
5803 5804
                        break;
                    case 2:
B
Blue Swirl 已提交
5805
                        gen_helper_fstl_ST0(cpu_tmp1_i64, cpu_env);
5806 5807
                        tcg_gen_qemu_st_i64(cpu_tmp1_i64, cpu_A0,
                                            s->mem_index, MO_LEQ);
B
bellard 已提交
5808 5809 5810
                        break;
                    case 3:
                    default:
B
Blue Swirl 已提交
5811
                        gen_helper_fist_ST0(cpu_tmp2_i32, cpu_env);
5812 5813
                        tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0,
                                            s->mem_index, MO_LEUW);
B
bellard 已提交
5814 5815 5816
                        break;
                    }
                    if ((op & 7) == 3)
B
Blue Swirl 已提交
5817
                        gen_helper_fpop(cpu_env);
B
bellard 已提交
5818 5819 5820 5821
                    break;
                }
                break;
            case 0x0c: /* fldenv mem */
5822
                gen_helper_fldenv(cpu_env, cpu_A0, tcg_const_i32(dflag - 1));
B
bellard 已提交
5823 5824
                break;
            case 0x0d: /* fldcw mem */
5825 5826
                tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0,
                                    s->mem_index, MO_LEUW);
B
Blue Swirl 已提交
5827
                gen_helper_fldcw(cpu_env, cpu_tmp2_i32);
B
bellard 已提交
5828 5829
                break;
            case 0x0e: /* fnstenv mem */
5830
                gen_helper_fstenv(cpu_env, cpu_A0, tcg_const_i32(dflag - 1));
B
bellard 已提交
5831 5832
                break;
            case 0x0f: /* fnstcw mem */
B
Blue Swirl 已提交
5833
                gen_helper_fnstcw(cpu_tmp2_i32, cpu_env);
5834 5835
                tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0,
                                    s->mem_index, MO_LEUW);
B
bellard 已提交
5836 5837
                break;
            case 0x1d: /* fldt mem */
B
Blue Swirl 已提交
5838
                gen_helper_fldt_ST0(cpu_env, cpu_A0);
B
bellard 已提交
5839 5840
                break;
            case 0x1f: /* fstpt mem */
B
Blue Swirl 已提交
5841 5842
                gen_helper_fstt_ST0(cpu_env, cpu_A0);
                gen_helper_fpop(cpu_env);
B
bellard 已提交
5843 5844
                break;
            case 0x2c: /* frstor mem */
5845
                gen_helper_frstor(cpu_env, cpu_A0, tcg_const_i32(dflag - 1));
B
bellard 已提交
5846 5847
                break;
            case 0x2e: /* fnsave mem */
5848
                gen_helper_fsave(cpu_env, cpu_A0, tcg_const_i32(dflag - 1));
B
bellard 已提交
5849 5850
                break;
            case 0x2f: /* fnstsw mem */
B
Blue Swirl 已提交
5851
                gen_helper_fnstsw(cpu_tmp2_i32, cpu_env);
5852 5853
                tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0,
                                    s->mem_index, MO_LEUW);
B
bellard 已提交
5854 5855
                break;
            case 0x3c: /* fbld */
B
Blue Swirl 已提交
5856
                gen_helper_fbld_ST0(cpu_env, cpu_A0);
B
bellard 已提交
5857 5858
                break;
            case 0x3e: /* fbstp */
B
Blue Swirl 已提交
5859 5860
                gen_helper_fbst_ST0(cpu_env, cpu_A0);
                gen_helper_fpop(cpu_env);
B
bellard 已提交
5861 5862
                break;
            case 0x3d: /* fildll */
5863
                tcg_gen_qemu_ld_i64(cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ);
B
Blue Swirl 已提交
5864
                gen_helper_fildll_ST0(cpu_env, cpu_tmp1_i64);
B
bellard 已提交
5865 5866
                break;
            case 0x3f: /* fistpll */
B
Blue Swirl 已提交
5867
                gen_helper_fistll_ST0(cpu_tmp1_i64, cpu_env);
5868
                tcg_gen_qemu_st_i64(cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ);
B
Blue Swirl 已提交
5869
                gen_helper_fpop(cpu_env);
B
bellard 已提交
5870 5871 5872 5873 5874 5875 5876 5877 5878 5879
                break;
            default:
                goto illegal_op;
            }
        } else {
            /* register float ops */
            opreg = rm;

            switch(op) {
            case 0x08: /* fld sti */
B
Blue Swirl 已提交
5880 5881 5882
                gen_helper_fpush(cpu_env);
                gen_helper_fmov_ST0_STN(cpu_env,
                                        tcg_const_i32((opreg + 1) & 7));
B
bellard 已提交
5883 5884
                break;
            case 0x09: /* fxchg sti */
B
bellard 已提交
5885 5886
            case 0x29: /* fxchg4 sti, undocumented op */
            case 0x39: /* fxchg7 sti, undocumented op */
B
Blue Swirl 已提交
5887
                gen_helper_fxchg_ST0_STN(cpu_env, tcg_const_i32(opreg));
B
bellard 已提交
5888 5889 5890 5891
                break;
            case 0x0a: /* grp d9/2 */
                switch(rm) {
                case 0: /* fnop */
5892
                    /* check exceptions (FreeBSD FPU probe) */
B
Blue Swirl 已提交
5893
                    gen_helper_fwait(cpu_env);
B
bellard 已提交
5894 5895 5896 5897 5898 5899 5900 5901
                    break;
                default:
                    goto illegal_op;
                }
                break;
            case 0x0c: /* grp d9/4 */
                switch(rm) {
                case 0: /* fchs */
B
Blue Swirl 已提交
5902
                    gen_helper_fchs_ST0(cpu_env);
B
bellard 已提交
5903 5904
                    break;
                case 1: /* fabs */
B
Blue Swirl 已提交
5905
                    gen_helper_fabs_ST0(cpu_env);
B
bellard 已提交
5906 5907
                    break;
                case 4: /* ftst */
B
Blue Swirl 已提交
5908 5909
                    gen_helper_fldz_FT0(cpu_env);
                    gen_helper_fcom_ST0_FT0(cpu_env);
B
bellard 已提交
5910 5911
                    break;
                case 5: /* fxam */
B
Blue Swirl 已提交
5912
                    gen_helper_fxam_ST0(cpu_env);
B
bellard 已提交
5913 5914 5915 5916 5917 5918 5919 5920 5921
                    break;
                default:
                    goto illegal_op;
                }
                break;
            case 0x0d: /* grp d9/5 */
                {
                    switch(rm) {
                    case 0:
B
Blue Swirl 已提交
5922 5923
                        gen_helper_fpush(cpu_env);
                        gen_helper_fld1_ST0(cpu_env);
B
bellard 已提交
5924 5925
                        break;
                    case 1:
B
Blue Swirl 已提交
5926 5927
                        gen_helper_fpush(cpu_env);
                        gen_helper_fldl2t_ST0(cpu_env);
B
bellard 已提交
5928 5929
                        break;
                    case 2:
B
Blue Swirl 已提交
5930 5931
                        gen_helper_fpush(cpu_env);
                        gen_helper_fldl2e_ST0(cpu_env);
B
bellard 已提交
5932 5933
                        break;
                    case 3:
B
Blue Swirl 已提交
5934 5935
                        gen_helper_fpush(cpu_env);
                        gen_helper_fldpi_ST0(cpu_env);
B
bellard 已提交
5936 5937
                        break;
                    case 4:
B
Blue Swirl 已提交
5938 5939
                        gen_helper_fpush(cpu_env);
                        gen_helper_fldlg2_ST0(cpu_env);
B
bellard 已提交
5940 5941
                        break;
                    case 5:
B
Blue Swirl 已提交
5942 5943
                        gen_helper_fpush(cpu_env);
                        gen_helper_fldln2_ST0(cpu_env);
B
bellard 已提交
5944 5945
                        break;
                    case 6:
B
Blue Swirl 已提交
5946 5947
                        gen_helper_fpush(cpu_env);
                        gen_helper_fldz_ST0(cpu_env);
B
bellard 已提交
5948 5949 5950 5951 5952 5953 5954 5955 5956
                        break;
                    default:
                        goto illegal_op;
                    }
                }
                break;
            case 0x0e: /* grp d9/6 */
                switch(rm) {
                case 0: /* f2xm1 */
B
Blue Swirl 已提交
5957
                    gen_helper_f2xm1(cpu_env);
B
bellard 已提交
5958 5959
                    break;
                case 1: /* fyl2x */
B
Blue Swirl 已提交
5960
                    gen_helper_fyl2x(cpu_env);
B
bellard 已提交
5961 5962
                    break;
                case 2: /* fptan */
B
Blue Swirl 已提交
5963
                    gen_helper_fptan(cpu_env);
B
bellard 已提交
5964 5965
                    break;
                case 3: /* fpatan */
B
Blue Swirl 已提交
5966
                    gen_helper_fpatan(cpu_env);
B
bellard 已提交
5967 5968
                    break;
                case 4: /* fxtract */
B
Blue Swirl 已提交
5969
                    gen_helper_fxtract(cpu_env);
B
bellard 已提交
5970 5971
                    break;
                case 5: /* fprem1 */
B
Blue Swirl 已提交
5972
                    gen_helper_fprem1(cpu_env);
B
bellard 已提交
5973 5974
                    break;
                case 6: /* fdecstp */
B
Blue Swirl 已提交
5975
                    gen_helper_fdecstp(cpu_env);
B
bellard 已提交
5976 5977 5978
                    break;
                default:
                case 7: /* fincstp */
B
Blue Swirl 已提交
5979
                    gen_helper_fincstp(cpu_env);
B
bellard 已提交
5980 5981 5982 5983 5984 5985
                    break;
                }
                break;
            case 0x0f: /* grp d9/7 */
                switch(rm) {
                case 0: /* fprem */
B
Blue Swirl 已提交
5986
                    gen_helper_fprem(cpu_env);
B
bellard 已提交
5987 5988
                    break;
                case 1: /* fyl2xp1 */
B
Blue Swirl 已提交
5989
                    gen_helper_fyl2xp1(cpu_env);
B
bellard 已提交
5990 5991
                    break;
                case 2: /* fsqrt */
B
Blue Swirl 已提交
5992
                    gen_helper_fsqrt(cpu_env);
B
bellard 已提交
5993 5994
                    break;
                case 3: /* fsincos */
B
Blue Swirl 已提交
5995
                    gen_helper_fsincos(cpu_env);
B
bellard 已提交
5996 5997
                    break;
                case 5: /* fscale */
B
Blue Swirl 已提交
5998
                    gen_helper_fscale(cpu_env);
B
bellard 已提交
5999 6000
                    break;
                case 4: /* frndint */
B
Blue Swirl 已提交
6001
                    gen_helper_frndint(cpu_env);
B
bellard 已提交
6002 6003
                    break;
                case 6: /* fsin */
B
Blue Swirl 已提交
6004
                    gen_helper_fsin(cpu_env);
B
bellard 已提交
6005 6006 6007
                    break;
                default:
                case 7: /* fcos */
B
Blue Swirl 已提交
6008
                    gen_helper_fcos(cpu_env);
B
bellard 已提交
6009 6010 6011 6012 6013 6014 6015 6016
                    break;
                }
                break;
            case 0x00: case 0x01: case 0x04 ... 0x07: /* fxxx st, sti */
            case 0x20: case 0x21: case 0x24 ... 0x27: /* fxxx sti, st */
            case 0x30: case 0x31: case 0x34 ... 0x37: /* fxxxp sti, st */
                {
                    int op1;
6017

B
bellard 已提交
6018 6019
                    op1 = op & 7;
                    if (op >= 0x20) {
P
pbrook 已提交
6020
                        gen_helper_fp_arith_STN_ST0(op1, opreg);
B
bellard 已提交
6021
                        if (op >= 0x30)
B
Blue Swirl 已提交
6022
                            gen_helper_fpop(cpu_env);
B
bellard 已提交
6023
                    } else {
B
Blue Swirl 已提交
6024
                        gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg));
P
pbrook 已提交
6025
                        gen_helper_fp_arith_ST0_FT0(op1);
B
bellard 已提交
6026 6027 6028 6029
                    }
                }
                break;
            case 0x02: /* fcom */
B
bellard 已提交
6030
            case 0x22: /* fcom2, undocumented op */
B
Blue Swirl 已提交
6031 6032
                gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg));
                gen_helper_fcom_ST0_FT0(cpu_env);
B
bellard 已提交
6033 6034
                break;
            case 0x03: /* fcomp */
B
bellard 已提交
6035 6036
            case 0x23: /* fcomp3, undocumented op */
            case 0x32: /* fcomp5, undocumented op */
B
Blue Swirl 已提交
6037 6038 6039
                gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg));
                gen_helper_fcom_ST0_FT0(cpu_env);
                gen_helper_fpop(cpu_env);
B
bellard 已提交
6040 6041 6042 6043
                break;
            case 0x15: /* da/5 */
                switch(rm) {
                case 1: /* fucompp */
B
Blue Swirl 已提交
6044 6045 6046 6047
                    gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(1));
                    gen_helper_fucom_ST0_FT0(cpu_env);
                    gen_helper_fpop(cpu_env);
                    gen_helper_fpop(cpu_env);
B
bellard 已提交
6048 6049 6050 6051 6052 6053 6054 6055 6056 6057 6058 6059
                    break;
                default:
                    goto illegal_op;
                }
                break;
            case 0x1c:
                switch(rm) {
                case 0: /* feni (287 only, just do nop here) */
                    break;
                case 1: /* fdisi (287 only, just do nop here) */
                    break;
                case 2: /* fclex */
B
Blue Swirl 已提交
6060
                    gen_helper_fclex(cpu_env);
B
bellard 已提交
6061 6062
                    break;
                case 3: /* fninit */
B
Blue Swirl 已提交
6063
                    gen_helper_fninit(cpu_env);
B
bellard 已提交
6064 6065 6066 6067 6068 6069 6070 6071
                    break;
                case 4: /* fsetpm (287 only, just do nop here) */
                    break;
                default:
                    goto illegal_op;
                }
                break;
            case 0x1d: /* fucomi */
6072 6073 6074
                if (!(s->cpuid_features & CPUID_CMOV)) {
                    goto illegal_op;
                }
6075
                gen_update_cc_op(s);
B
Blue Swirl 已提交
6076 6077
                gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg));
                gen_helper_fucomi_ST0_FT0(cpu_env);
6078
                set_cc_op(s, CC_OP_EFLAGS);
B
bellard 已提交
6079 6080
                break;
            case 0x1e: /* fcomi */
6081 6082 6083
                if (!(s->cpuid_features & CPUID_CMOV)) {
                    goto illegal_op;
                }
6084
                gen_update_cc_op(s);
B
Blue Swirl 已提交
6085 6086
                gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg));
                gen_helper_fcomi_ST0_FT0(cpu_env);
6087
                set_cc_op(s, CC_OP_EFLAGS);
B
bellard 已提交
6088
                break;
B
bellard 已提交
6089
            case 0x28: /* ffree sti */
B
Blue Swirl 已提交
6090
                gen_helper_ffree_STN(cpu_env, tcg_const_i32(opreg));
6091
                break;
B
bellard 已提交
6092
            case 0x2a: /* fst sti */
B
Blue Swirl 已提交
6093
                gen_helper_fmov_STN_ST0(cpu_env, tcg_const_i32(opreg));
B
bellard 已提交
6094 6095
                break;
            case 0x2b: /* fstp sti */
B
bellard 已提交
6096 6097 6098
            case 0x0b: /* fstp1 sti, undocumented op */
            case 0x3a: /* fstp8 sti, undocumented op */
            case 0x3b: /* fstp9 sti, undocumented op */
B
Blue Swirl 已提交
6099 6100
                gen_helper_fmov_STN_ST0(cpu_env, tcg_const_i32(opreg));
                gen_helper_fpop(cpu_env);
B
bellard 已提交
6101 6102
                break;
            case 0x2c: /* fucom st(i) */
B
Blue Swirl 已提交
6103 6104
                gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg));
                gen_helper_fucom_ST0_FT0(cpu_env);
B
bellard 已提交
6105 6106
                break;
            case 0x2d: /* fucomp st(i) */
B
Blue Swirl 已提交
6107 6108 6109
                gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg));
                gen_helper_fucom_ST0_FT0(cpu_env);
                gen_helper_fpop(cpu_env);
B
bellard 已提交
6110 6111 6112 6113
                break;
            case 0x33: /* de/3 */
                switch(rm) {
                case 1: /* fcompp */
B
Blue Swirl 已提交
6114 6115 6116 6117
                    gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(1));
                    gen_helper_fcom_ST0_FT0(cpu_env);
                    gen_helper_fpop(cpu_env);
                    gen_helper_fpop(cpu_env);
B
bellard 已提交
6118 6119 6120 6121 6122
                    break;
                default:
                    goto illegal_op;
                }
                break;
B
bellard 已提交
6123
            case 0x38: /* ffreep sti, undocumented op */
B
Blue Swirl 已提交
6124 6125
                gen_helper_ffree_STN(cpu_env, tcg_const_i32(opreg));
                gen_helper_fpop(cpu_env);
B
bellard 已提交
6126
                break;
B
bellard 已提交
6127 6128 6129
            case 0x3c: /* df/4 */
                switch(rm) {
                case 0:
B
Blue Swirl 已提交
6130
                    gen_helper_fnstsw(cpu_tmp2_i32, cpu_env);
6131
                    tcg_gen_extu_i32_tl(cpu_T[0], cpu_tmp2_i32);
6132
                    gen_op_mov_reg_v(MO_16, R_EAX, cpu_T[0]);
B
bellard 已提交
6133 6134 6135 6136 6137 6138
                    break;
                default:
                    goto illegal_op;
                }
                break;
            case 0x3d: /* fucomip */
6139 6140 6141
                if (!(s->cpuid_features & CPUID_CMOV)) {
                    goto illegal_op;
                }
6142
                gen_update_cc_op(s);
B
Blue Swirl 已提交
6143 6144 6145
                gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg));
                gen_helper_fucomi_ST0_FT0(cpu_env);
                gen_helper_fpop(cpu_env);
6146
                set_cc_op(s, CC_OP_EFLAGS);
B
bellard 已提交
6147 6148
                break;
            case 0x3e: /* fcomip */
6149 6150 6151
                if (!(s->cpuid_features & CPUID_CMOV)) {
                    goto illegal_op;
                }
6152
                gen_update_cc_op(s);
B
Blue Swirl 已提交
6153 6154 6155
                gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg));
                gen_helper_fcomi_ST0_FT0(cpu_env);
                gen_helper_fpop(cpu_env);
6156
                set_cc_op(s, CC_OP_EFLAGS);
B
bellard 已提交
6157
                break;
6158 6159 6160
            case 0x10 ... 0x13: /* fcmovxx */
            case 0x18 ... 0x1b:
                {
6161 6162
                    int op1;
                    TCGLabel *l1;
6163
                    static const uint8_t fcmov_cc[8] = {
6164 6165 6166 6167 6168
                        (JCC_B << 1),
                        (JCC_Z << 1),
                        (JCC_BE << 1),
                        (JCC_P << 1),
                    };
6169 6170 6171 6172

                    if (!(s->cpuid_features & CPUID_CMOV)) {
                        goto illegal_op;
                    }
6173
                    op1 = fcmov_cc[op & 3] | (((op >> 3) & 1) ^ 1);
B
bellard 已提交
6174
                    l1 = gen_new_label();
6175
                    gen_jcc1_noeob(s, op1, l1);
B
Blue Swirl 已提交
6176
                    gen_helper_fmov_ST0_STN(cpu_env, tcg_const_i32(opreg));
B
bellard 已提交
6177
                    gen_set_label(l1);
6178 6179
                }
                break;
B
bellard 已提交
6180 6181 6182 6183 6184 6185 6186 6187 6188 6189
            default:
                goto illegal_op;
            }
        }
        break;
        /************************/
        /* string ops */

    case 0xa4: /* movsS */
    case 0xa5:
6190
        ot = mo_b_d(b, dflag);
B
bellard 已提交
6191 6192 6193 6194 6195 6196
        if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) {
            gen_repz_movs(s, ot, pc_start - s->cs_base, s->pc - s->cs_base);
        } else {
            gen_movs(s, ot);
        }
        break;
6197

B
bellard 已提交
6198 6199
    case 0xaa: /* stosS */
    case 0xab:
6200
        ot = mo_b_d(b, dflag);
B
bellard 已提交
6201 6202 6203 6204 6205 6206 6207 6208
        if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) {
            gen_repz_stos(s, ot, pc_start - s->cs_base, s->pc - s->cs_base);
        } else {
            gen_stos(s, ot);
        }
        break;
    case 0xac: /* lodsS */
    case 0xad:
6209
        ot = mo_b_d(b, dflag);
B
bellard 已提交
6210 6211 6212 6213 6214 6215 6216 6217
        if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) {
            gen_repz_lods(s, ot, pc_start - s->cs_base, s->pc - s->cs_base);
        } else {
            gen_lods(s, ot);
        }
        break;
    case 0xae: /* scasS */
    case 0xaf:
6218
        ot = mo_b_d(b, dflag);
B
bellard 已提交
6219 6220 6221 6222 6223 6224 6225 6226 6227 6228 6229
        if (prefixes & PREFIX_REPNZ) {
            gen_repz_scas(s, ot, pc_start - s->cs_base, s->pc - s->cs_base, 1);
        } else if (prefixes & PREFIX_REPZ) {
            gen_repz_scas(s, ot, pc_start - s->cs_base, s->pc - s->cs_base, 0);
        } else {
            gen_scas(s, ot);
        }
        break;

    case 0xa6: /* cmpsS */
    case 0xa7:
6230
        ot = mo_b_d(b, dflag);
B
bellard 已提交
6231 6232 6233 6234 6235 6236 6237 6238 6239 6240
        if (prefixes & PREFIX_REPNZ) {
            gen_repz_cmps(s, ot, pc_start - s->cs_base, s->pc - s->cs_base, 1);
        } else if (prefixes & PREFIX_REPZ) {
            gen_repz_cmps(s, ot, pc_start - s->cs_base, s->pc - s->cs_base, 0);
        } else {
            gen_cmps(s, ot);
        }
        break;
    case 0x6c: /* insS */
    case 0x6d:
6241
        ot = mo_b_d32(b, dflag);
6242
        tcg_gen_ext16u_tl(cpu_T[0], cpu_regs[R_EDX]);
6243 6244
        gen_check_io(s, ot, pc_start - s->cs_base, 
                     SVM_IOIO_TYPE_MASK | svm_is_rep(prefixes) | 4);
6245 6246
        if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) {
            gen_repz_ins(s, ot, pc_start - s->cs_base, s->pc - s->cs_base);
B
bellard 已提交
6247
        } else {
6248
            gen_ins(s, ot);
6249
            if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
6250 6251
                gen_jmp(s, s->pc - s->cs_base);
            }
B
bellard 已提交
6252 6253 6254 6255
        }
        break;
    case 0x6e: /* outsS */
    case 0x6f:
6256
        ot = mo_b_d32(b, dflag);
6257
        tcg_gen_ext16u_tl(cpu_T[0], cpu_regs[R_EDX]);
6258 6259
        gen_check_io(s, ot, pc_start - s->cs_base,
                     svm_is_rep(prefixes) | 4);
6260 6261
        if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) {
            gen_repz_outs(s, ot, pc_start - s->cs_base, s->pc - s->cs_base);
B
bellard 已提交
6262
        } else {
6263
            gen_outs(s, ot);
6264
            if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
6265 6266
                gen_jmp(s, s->pc - s->cs_base);
            }
B
bellard 已提交
6267 6268 6269 6270 6271
        }
        break;

        /************************/
        /* port I/O */
T
ths 已提交
6272

B
bellard 已提交
6273 6274
    case 0xe4:
    case 0xe5:
6275
        ot = mo_b_d32(b, dflag);
6276
        val = cpu_ldub_code(env, s->pc++);
6277
        tcg_gen_movi_tl(cpu_T[0], val);
6278 6279
        gen_check_io(s, ot, pc_start - s->cs_base,
                     SVM_IOIO_TYPE_MASK | svm_is_rep(prefixes));
6280
        if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
6281
            gen_io_start();
6282
	}
6283
        tcg_gen_movi_i32(cpu_tmp2_i32, val);
P
pbrook 已提交
6284
        gen_helper_in_func(ot, cpu_T[1], cpu_tmp2_i32);
6285
        gen_op_mov_reg_v(ot, R_EAX, cpu_T[1]);
6286
        gen_bpt_io(s, cpu_tmp2_i32, ot);
6287
        if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
6288 6289 6290
            gen_io_end();
            gen_jmp(s, s->pc - s->cs_base);
        }
B
bellard 已提交
6291 6292 6293
        break;
    case 0xe6:
    case 0xe7:
6294
        ot = mo_b_d32(b, dflag);
6295
        val = cpu_ldub_code(env, s->pc++);
6296
        tcg_gen_movi_tl(cpu_T[0], val);
6297 6298
        gen_check_io(s, ot, pc_start - s->cs_base,
                     svm_is_rep(prefixes));
6299
        gen_op_mov_v_reg(ot, cpu_T[1], R_EAX);
6300

6301
        if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
6302
            gen_io_start();
6303
	}
6304
        tcg_gen_movi_i32(cpu_tmp2_i32, val);
6305
        tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_T[1]);
P
pbrook 已提交
6306
        gen_helper_out_func(ot, cpu_tmp2_i32, cpu_tmp3_i32);
6307
        gen_bpt_io(s, cpu_tmp2_i32, ot);
6308
        if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
6309 6310 6311
            gen_io_end();
            gen_jmp(s, s->pc - s->cs_base);
        }
B
bellard 已提交
6312 6313 6314
        break;
    case 0xec:
    case 0xed:
6315
        ot = mo_b_d32(b, dflag);
6316
        tcg_gen_ext16u_tl(cpu_T[0], cpu_regs[R_EDX]);
6317 6318
        gen_check_io(s, ot, pc_start - s->cs_base,
                     SVM_IOIO_TYPE_MASK | svm_is_rep(prefixes));
6319
        if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
6320
            gen_io_start();
6321
	}
6322
        tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
P
pbrook 已提交
6323
        gen_helper_in_func(ot, cpu_T[1], cpu_tmp2_i32);
6324
        gen_op_mov_reg_v(ot, R_EAX, cpu_T[1]);
6325
        gen_bpt_io(s, cpu_tmp2_i32, ot);
6326
        if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
6327 6328 6329
            gen_io_end();
            gen_jmp(s, s->pc - s->cs_base);
        }
B
bellard 已提交
6330 6331 6332
        break;
    case 0xee:
    case 0xef:
6333
        ot = mo_b_d32(b, dflag);
6334
        tcg_gen_ext16u_tl(cpu_T[0], cpu_regs[R_EDX]);
6335 6336
        gen_check_io(s, ot, pc_start - s->cs_base,
                     svm_is_rep(prefixes));
6337
        gen_op_mov_v_reg(ot, cpu_T[1], R_EAX);
6338

6339
        if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
6340
            gen_io_start();
6341
	}
6342 6343
        tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
        tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_T[1]);
P
pbrook 已提交
6344
        gen_helper_out_func(ot, cpu_tmp2_i32, cpu_tmp3_i32);
6345
        gen_bpt_io(s, cpu_tmp2_i32, ot);
6346
        if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
6347 6348 6349
            gen_io_end();
            gen_jmp(s, s->pc - s->cs_base);
        }
B
bellard 已提交
6350 6351 6352 6353 6354
        break;

        /************************/
        /* control */
    case 0xc2: /* ret im */
6355
        val = cpu_ldsw_code(env, s->pc);
B
bellard 已提交
6356
        s->pc += 2;
6357 6358 6359
        ot = gen_pop_T0(s);
        gen_stack_update(s, val + (1 << ot));
        /* Note that gen_pop_T0 uses a zero-extending load.  */
6360
        gen_op_jmp_v(cpu_T[0]);
B
bellard 已提交
6361 6362 6363
        gen_eob(s);
        break;
    case 0xc3: /* ret */
6364 6365 6366
        ot = gen_pop_T0(s);
        gen_pop_update(s, ot);
        /* Note that gen_pop_T0 uses a zero-extending load.  */
6367
        gen_op_jmp_v(cpu_T[0]);
B
bellard 已提交
6368 6369 6370
        gen_eob(s);
        break;
    case 0xca: /* lret im */
6371
        val = cpu_ldsw_code(env, s->pc);
B
bellard 已提交
6372 6373 6374
        s->pc += 2;
    do_lret:
        if (s->pe && !s->vm86) {
6375
            gen_update_cc_op(s);
B
bellard 已提交
6376
            gen_jmp_im(pc_start - s->cs_base);
6377
            gen_helper_lret_protected(cpu_env, tcg_const_i32(dflag - 1),
P
pbrook 已提交
6378
                                      tcg_const_i32(val));
B
bellard 已提交
6379 6380 6381
        } else {
            gen_stack_A0(s);
            /* pop offset */
6382
            gen_op_ld_v(s, dflag, cpu_T[0], cpu_A0);
B
bellard 已提交
6383 6384
            /* NOTE: keeping EIP updated is not a problem in case of
               exception */
6385
            gen_op_jmp_v(cpu_T[0]);
B
bellard 已提交
6386
            /* pop selector */
6387 6388
            gen_op_addl_A0_im(1 << dflag);
            gen_op_ld_v(s, dflag, cpu_T[0], cpu_A0);
6389
            gen_op_movl_seg_T0_vm(R_CS);
B
bellard 已提交
6390
            /* add stack offset */
6391
            gen_stack_update(s, val + (2 << dflag));
B
bellard 已提交
6392 6393 6394 6395 6396 6397 6398
        }
        gen_eob(s);
        break;
    case 0xcb: /* lret */
        val = 0;
        goto do_lret;
    case 0xcf: /* iret */
B
bellard 已提交
6399
        gen_svm_check_intercept(s, pc_start, SVM_EXIT_IRET);
B
bellard 已提交
6400 6401
        if (!s->pe) {
            /* real mode */
6402
            gen_helper_iret_real(cpu_env, tcg_const_i32(dflag - 1));
6403
            set_cc_op(s, CC_OP_EFLAGS);
6404 6405 6406 6407
        } else if (s->vm86) {
            if (s->iopl != 3) {
                gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
            } else {
6408
                gen_helper_iret_real(cpu_env, tcg_const_i32(dflag - 1));
6409
                set_cc_op(s, CC_OP_EFLAGS);
6410
            }
B
bellard 已提交
6411
        } else {
6412
            gen_helper_iret_protected(cpu_env, tcg_const_i32(dflag - 1),
P
pbrook 已提交
6413
                                      tcg_const_i32(s->pc - s->cs_base));
6414
            set_cc_op(s, CC_OP_EFLAGS);
B
bellard 已提交
6415 6416 6417 6418 6419
        }
        gen_eob(s);
        break;
    case 0xe8: /* call im */
        {
6420
            if (dflag != MO_16) {
6421
                tval = (int32_t)insn_get(env, s, MO_32);
6422
            } else {
6423
                tval = (int16_t)insn_get(env, s, MO_16);
6424
            }
B
bellard 已提交
6425
            next_eip = s->pc - s->cs_base;
B
bellard 已提交
6426
            tval += next_eip;
6427
            if (dflag == MO_16) {
B
bellard 已提交
6428
                tval &= 0xffff;
6429
            } else if (!CODE64(s)) {
6430
                tval &= 0xffffffff;
6431
            }
6432
            tcg_gen_movi_tl(cpu_T[0], next_eip);
6433
            gen_push_v(s, cpu_T[0]);
B
bellard 已提交
6434
            gen_jmp(s, tval);
B
bellard 已提交
6435 6436 6437 6438 6439
        }
        break;
    case 0x9a: /* lcall im */
        {
            unsigned int selector, offset;
6440

B
bellard 已提交
6441 6442
            if (CODE64(s))
                goto illegal_op;
6443
            ot = dflag;
6444
            offset = insn_get(env, s, ot);
6445
            selector = insn_get(env, s, MO_16);
6446

6447
            tcg_gen_movi_tl(cpu_T[0], selector);
6448
            tcg_gen_movi_tl(cpu_T[1], offset);
B
bellard 已提交
6449 6450
        }
        goto do_lcall;
B
bellard 已提交
6451
    case 0xe9: /* jmp im */
6452
        if (dflag != MO_16) {
6453
            tval = (int32_t)insn_get(env, s, MO_32);
6454
        } else {
6455
            tval = (int16_t)insn_get(env, s, MO_16);
6456
        }
B
bellard 已提交
6457
        tval += s->pc - s->cs_base;
6458
        if (dflag == MO_16) {
B
bellard 已提交
6459
            tval &= 0xffff;
6460
        } else if (!CODE64(s)) {
6461
            tval &= 0xffffffff;
6462
        }
B
bellard 已提交
6463
        gen_jmp(s, tval);
B
bellard 已提交
6464 6465 6466 6467 6468
        break;
    case 0xea: /* ljmp im */
        {
            unsigned int selector, offset;

B
bellard 已提交
6469 6470
            if (CODE64(s))
                goto illegal_op;
6471
            ot = dflag;
6472
            offset = insn_get(env, s, ot);
6473
            selector = insn_get(env, s, MO_16);
6474

6475
            tcg_gen_movi_tl(cpu_T[0], selector);
6476
            tcg_gen_movi_tl(cpu_T[1], offset);
B
bellard 已提交
6477 6478 6479
        }
        goto do_ljmp;
    case 0xeb: /* jmp Jb */
6480
        tval = (int8_t)insn_get(env, s, MO_8);
B
bellard 已提交
6481
        tval += s->pc - s->cs_base;
6482
        if (dflag == MO_16) {
B
bellard 已提交
6483
            tval &= 0xffff;
6484
        }
B
bellard 已提交
6485
        gen_jmp(s, tval);
B
bellard 已提交
6486 6487
        break;
    case 0x70 ... 0x7f: /* jcc Jb */
6488
        tval = (int8_t)insn_get(env, s, MO_8);
B
bellard 已提交
6489 6490
        goto do_jcc;
    case 0x180 ... 0x18f: /* jcc Jv */
6491
        if (dflag != MO_16) {
6492
            tval = (int32_t)insn_get(env, s, MO_32);
B
bellard 已提交
6493
        } else {
6494
            tval = (int16_t)insn_get(env, s, MO_16);
B
bellard 已提交
6495 6496 6497
        }
    do_jcc:
        next_eip = s->pc - s->cs_base;
B
bellard 已提交
6498
        tval += next_eip;
6499
        if (dflag == MO_16) {
B
bellard 已提交
6500
            tval &= 0xffff;
6501
        }
B
bellard 已提交
6502
        gen_jcc(s, b, tval, next_eip);
B
bellard 已提交
6503 6504 6505
        break;

    case 0x190 ... 0x19f: /* setcc Gv */
6506
        modrm = cpu_ldub_code(env, s->pc++);
6507
        gen_setcc1(s, b, cpu_T[0]);
6508
        gen_ldst_modrm(env, s, modrm, MO_8, OR_TMP0, 1);
B
bellard 已提交
6509 6510
        break;
    case 0x140 ... 0x14f: /* cmov Gv, Ev */
6511 6512 6513
        if (!(s->cpuid_features & CPUID_CMOV)) {
            goto illegal_op;
        }
6514
        ot = dflag;
6515 6516 6517
        modrm = cpu_ldub_code(env, s->pc++);
        reg = ((modrm >> 3) & 7) | rex_r;
        gen_cmovcc1(env, s, ot, b, modrm, reg);
B
bellard 已提交
6518
        break;
6519

B
bellard 已提交
6520 6521 6522
        /************************/
        /* flags */
    case 0x9c: /* pushf */
B
bellard 已提交
6523
        gen_svm_check_intercept(s, pc_start, SVM_EXIT_PUSHF);
B
bellard 已提交
6524 6525 6526
        if (s->vm86 && s->iopl != 3) {
            gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
        } else {
6527
            gen_update_cc_op(s);
6528
            gen_helper_read_eflags(cpu_T[0], cpu_env);
6529
            gen_push_v(s, cpu_T[0]);
B
bellard 已提交
6530 6531 6532
        }
        break;
    case 0x9d: /* popf */
B
bellard 已提交
6533
        gen_svm_check_intercept(s, pc_start, SVM_EXIT_POPF);
B
bellard 已提交
6534 6535 6536
        if (s->vm86 && s->iopl != 3) {
            gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
        } else {
6537
            ot = gen_pop_T0(s);
B
bellard 已提交
6538
            if (s->cpl == 0) {
6539
                if (dflag != MO_16) {
6540 6541 6542 6543 6544
                    gen_helper_write_eflags(cpu_env, cpu_T[0],
                                            tcg_const_i32((TF_MASK | AC_MASK |
                                                           ID_MASK | NT_MASK |
                                                           IF_MASK |
                                                           IOPL_MASK)));
B
bellard 已提交
6545
                } else {
6546 6547 6548 6549 6550
                    gen_helper_write_eflags(cpu_env, cpu_T[0],
                                            tcg_const_i32((TF_MASK | AC_MASK |
                                                           ID_MASK | NT_MASK |
                                                           IF_MASK | IOPL_MASK)
                                                          & 0xffff));
B
bellard 已提交
6551 6552
                }
            } else {
B
bellard 已提交
6553
                if (s->cpl <= s->iopl) {
6554
                    if (dflag != MO_16) {
6555 6556 6557 6558 6559 6560
                        gen_helper_write_eflags(cpu_env, cpu_T[0],
                                                tcg_const_i32((TF_MASK |
                                                               AC_MASK |
                                                               ID_MASK |
                                                               NT_MASK |
                                                               IF_MASK)));
B
bellard 已提交
6561
                    } else {
6562 6563 6564 6565 6566 6567 6568
                        gen_helper_write_eflags(cpu_env, cpu_T[0],
                                                tcg_const_i32((TF_MASK |
                                                               AC_MASK |
                                                               ID_MASK |
                                                               NT_MASK |
                                                               IF_MASK)
                                                              & 0xffff));
B
bellard 已提交
6569
                    }
B
bellard 已提交
6570
                } else {
6571
                    if (dflag != MO_16) {
6572 6573 6574
                        gen_helper_write_eflags(cpu_env, cpu_T[0],
                                           tcg_const_i32((TF_MASK | AC_MASK |
                                                          ID_MASK | NT_MASK)));
B
bellard 已提交
6575
                    } else {
6576 6577 6578 6579
                        gen_helper_write_eflags(cpu_env, cpu_T[0],
                                           tcg_const_i32((TF_MASK | AC_MASK |
                                                          ID_MASK | NT_MASK)
                                                         & 0xffff));
B
bellard 已提交
6580
                    }
B
bellard 已提交
6581 6582
                }
            }
6583
            gen_pop_update(s, ot);
6584
            set_cc_op(s, CC_OP_EFLAGS);
H
H. Peter Anvin 已提交
6585
            /* abort translation because TF/AC flag may change */
B
bellard 已提交
6586
            gen_jmp_im(s->pc - s->cs_base);
B
bellard 已提交
6587 6588 6589 6590
            gen_eob(s);
        }
        break;
    case 0x9e: /* sahf */
B
bellard 已提交
6591
        if (CODE64(s) && !(s->cpuid_ext3_features & CPUID_EXT3_LAHF_LM))
B
bellard 已提交
6592
            goto illegal_op;
6593
        gen_op_mov_v_reg(MO_8, cpu_T[0], R_AH);
6594
        gen_compute_eflags(s);
6595 6596 6597
        tcg_gen_andi_tl(cpu_cc_src, cpu_cc_src, CC_O);
        tcg_gen_andi_tl(cpu_T[0], cpu_T[0], CC_S | CC_Z | CC_A | CC_P | CC_C);
        tcg_gen_or_tl(cpu_cc_src, cpu_cc_src, cpu_T[0]);
B
bellard 已提交
6598 6599
        break;
    case 0x9f: /* lahf */
B
bellard 已提交
6600
        if (CODE64(s) && !(s->cpuid_ext3_features & CPUID_EXT3_LAHF_LM))
B
bellard 已提交
6601
            goto illegal_op;
6602
        gen_compute_eflags(s);
6603
        /* Note: gen_compute_eflags() only gives the condition codes */
6604
        tcg_gen_ori_tl(cpu_T[0], cpu_cc_src, 0x02);
6605
        gen_op_mov_reg_v(MO_8, R_AH, cpu_T[0]);
B
bellard 已提交
6606 6607
        break;
    case 0xf5: /* cmc */
6608
        gen_compute_eflags(s);
6609
        tcg_gen_xori_tl(cpu_cc_src, cpu_cc_src, CC_C);
B
bellard 已提交
6610 6611
        break;
    case 0xf8: /* clc */
6612
        gen_compute_eflags(s);
6613
        tcg_gen_andi_tl(cpu_cc_src, cpu_cc_src, ~CC_C);
B
bellard 已提交
6614 6615
        break;
    case 0xf9: /* stc */
6616
        gen_compute_eflags(s);
6617
        tcg_gen_ori_tl(cpu_cc_src, cpu_cc_src, CC_C);
B
bellard 已提交
6618 6619
        break;
    case 0xfc: /* cld */
6620
        tcg_gen_movi_i32(cpu_tmp2_i32, 1);
6621
        tcg_gen_st_i32(cpu_tmp2_i32, cpu_env, offsetof(CPUX86State, df));
B
bellard 已提交
6622 6623
        break;
    case 0xfd: /* std */
6624
        tcg_gen_movi_i32(cpu_tmp2_i32, -1);
6625
        tcg_gen_st_i32(cpu_tmp2_i32, cpu_env, offsetof(CPUX86State, df));
B
bellard 已提交
6626 6627 6628 6629 6630
        break;

        /************************/
        /* bit operations */
    case 0x1ba: /* bt/bts/btr/btc Gv, im */
6631
        ot = dflag;
6632
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
6633
        op = (modrm >> 3) & 7;
B
bellard 已提交
6634
        mod = (modrm >> 6) & 3;
B
bellard 已提交
6635
        rm = (modrm & 7) | REX_B(s);
B
bellard 已提交
6636
        if (mod != 3) {
B
bellard 已提交
6637
            s->rip_offset = 1;
6638
            gen_lea_modrm(env, s, modrm);
6639
            gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
B
bellard 已提交
6640
        } else {
6641
            gen_op_mov_v_reg(ot, cpu_T[0], rm);
B
bellard 已提交
6642 6643
        }
        /* load shift */
6644
        val = cpu_ldub_code(env, s->pc++);
6645
        tcg_gen_movi_tl(cpu_T[1], val);
B
bellard 已提交
6646 6647 6648
        if (op < 4)
            goto illegal_op;
        op -= 4;
B
bellard 已提交
6649
        goto bt_op;
B
bellard 已提交
6650 6651 6652 6653 6654 6655 6656 6657 6658 6659 6660 6661
    case 0x1a3: /* bt Gv, Ev */
        op = 0;
        goto do_btx;
    case 0x1ab: /* bts */
        op = 1;
        goto do_btx;
    case 0x1b3: /* btr */
        op = 2;
        goto do_btx;
    case 0x1bb: /* btc */
        op = 3;
    do_btx:
6662
        ot = dflag;
6663
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
6664
        reg = ((modrm >> 3) & 7) | rex_r;
B
bellard 已提交
6665
        mod = (modrm >> 6) & 3;
B
bellard 已提交
6666
        rm = (modrm & 7) | REX_B(s);
6667
        gen_op_mov_v_reg(MO_32, cpu_T[1], reg);
B
bellard 已提交
6668
        if (mod != 3) {
6669
            gen_lea_modrm(env, s, modrm);
B
bellard 已提交
6670
            /* specific case: we need to add a displacement */
B
bellard 已提交
6671 6672 6673 6674
            gen_exts(ot, cpu_T[1]);
            tcg_gen_sari_tl(cpu_tmp0, cpu_T[1], 3 + ot);
            tcg_gen_shli_tl(cpu_tmp0, cpu_tmp0, ot);
            tcg_gen_add_tl(cpu_A0, cpu_A0, cpu_tmp0);
6675
            gen_op_ld_v(s, ot, cpu_T[0], cpu_A0);
B
bellard 已提交
6676
        } else {
6677
            gen_op_mov_v_reg(ot, cpu_T[0], rm);
B
bellard 已提交
6678
        }
B
bellard 已提交
6679 6680
    bt_op:
        tcg_gen_andi_tl(cpu_T[1], cpu_T[1], (1 << (3 + ot)) - 1);
6681
        tcg_gen_shr_tl(cpu_tmp4, cpu_T[0], cpu_T[1]);
B
bellard 已提交
6682 6683 6684 6685 6686 6687 6688 6689 6690 6691 6692
        switch(op) {
        case 0:
            break;
        case 1:
            tcg_gen_movi_tl(cpu_tmp0, 1);
            tcg_gen_shl_tl(cpu_tmp0, cpu_tmp0, cpu_T[1]);
            tcg_gen_or_tl(cpu_T[0], cpu_T[0], cpu_tmp0);
            break;
        case 2:
            tcg_gen_movi_tl(cpu_tmp0, 1);
            tcg_gen_shl_tl(cpu_tmp0, cpu_tmp0, cpu_T[1]);
6693
            tcg_gen_andc_tl(cpu_T[0], cpu_T[0], cpu_tmp0);
B
bellard 已提交
6694 6695 6696 6697 6698 6699 6700 6701
            break;
        default:
        case 3:
            tcg_gen_movi_tl(cpu_tmp0, 1);
            tcg_gen_shl_tl(cpu_tmp0, cpu_tmp0, cpu_T[1]);
            tcg_gen_xor_tl(cpu_T[0], cpu_T[0], cpu_tmp0);
            break;
        }
B
bellard 已提交
6702
        if (op != 0) {
6703 6704 6705
            if (mod != 3) {
                gen_op_st_v(s, ot, cpu_T[0], cpu_A0);
            } else {
6706
                gen_op_mov_reg_v(ot, rm, cpu_T[0]);
6707
            }
6708 6709 6710 6711 6712 6713 6714 6715 6716 6717 6718 6719 6720 6721 6722 6723 6724 6725 6726 6727 6728
        }

        /* Delay all CC updates until after the store above.  Note that
           C is the result of the test, Z is unchanged, and the others
           are all undefined.  */
        switch (s->cc_op) {
        case CC_OP_MULB ... CC_OP_MULQ:
        case CC_OP_ADDB ... CC_OP_ADDQ:
        case CC_OP_ADCB ... CC_OP_ADCQ:
        case CC_OP_SUBB ... CC_OP_SUBQ:
        case CC_OP_SBBB ... CC_OP_SBBQ:
        case CC_OP_LOGICB ... CC_OP_LOGICQ:
        case CC_OP_INCB ... CC_OP_INCQ:
        case CC_OP_DECB ... CC_OP_DECQ:
        case CC_OP_SHLB ... CC_OP_SHLQ:
        case CC_OP_SARB ... CC_OP_SARQ:
        case CC_OP_BMILGB ... CC_OP_BMILGQ:
            /* Z was going to be computed from the non-zero status of CC_DST.
               We can get that same Z value (and the new C value) by leaving
               CC_DST alone, setting CC_SRC, and using a CC_OP_SAR of the
               same width.  */
B
bellard 已提交
6729
            tcg_gen_mov_tl(cpu_cc_src, cpu_tmp4);
6730 6731 6732 6733 6734 6735 6736 6737
            set_cc_op(s, ((s->cc_op - CC_OP_MULB) & 3) + CC_OP_SARB);
            break;
        default:
            /* Otherwise, generate EFLAGS and replace the C bit.  */
            gen_compute_eflags(s);
            tcg_gen_deposit_tl(cpu_cc_src, cpu_cc_src, cpu_tmp4,
                               ctz32(CC_C), 1);
            break;
B
bellard 已提交
6738 6739
        }
        break;
6740 6741
    case 0x1bc: /* bsf / tzcnt */
    case 0x1bd: /* bsr / lzcnt */
6742
        ot = dflag;
6743 6744 6745 6746 6747 6748 6749 6750 6751 6752 6753 6754 6755 6756 6757 6758 6759
        modrm = cpu_ldub_code(env, s->pc++);
        reg = ((modrm >> 3) & 7) | rex_r;
        gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
        gen_extu(ot, cpu_T[0]);

        /* Note that lzcnt and tzcnt are in different extensions.  */
        if ((prefixes & PREFIX_REPZ)
            && (b & 1
                ? s->cpuid_ext3_features & CPUID_EXT3_ABM
                : s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_BMI1)) {
            int size = 8 << ot;
            tcg_gen_mov_tl(cpu_cc_src, cpu_T[0]);
            if (b & 1) {
                /* For lzcnt, reduce the target_ulong result by the
                   number of zeros that we expect to find at the top.  */
                gen_helper_clz(cpu_T[0], cpu_T[0]);
                tcg_gen_subi_tl(cpu_T[0], cpu_T[0], TARGET_LONG_BITS - size);
B
bellard 已提交
6760
            } else {
6761 6762 6763 6764 6765
                /* For tzcnt, a zero input must return the operand size:
                   force all bits outside the operand size to 1.  */
                target_ulong mask = (target_ulong)-2 << (size - 1);
                tcg_gen_ori_tl(cpu_T[0], cpu_T[0], mask);
                gen_helper_ctz(cpu_T[0], cpu_T[0]);
B
bellard 已提交
6766
            }
6767 6768 6769 6770 6771 6772 6773 6774 6775 6776 6777 6778 6779 6780 6781 6782 6783 6784 6785 6786 6787 6788 6789
            /* For lzcnt/tzcnt, C and Z bits are defined and are
               related to the result.  */
            gen_op_update1_cc();
            set_cc_op(s, CC_OP_BMILGB + ot);
        } else {
            /* For bsr/bsf, only the Z bit is defined and it is related
               to the input and not the result.  */
            tcg_gen_mov_tl(cpu_cc_dst, cpu_T[0]);
            set_cc_op(s, CC_OP_LOGICB + ot);
            if (b & 1) {
                /* For bsr, return the bit index of the first 1 bit,
                   not the count of leading zeros.  */
                gen_helper_clz(cpu_T[0], cpu_T[0]);
                tcg_gen_xori_tl(cpu_T[0], cpu_T[0], TARGET_LONG_BITS - 1);
            } else {
                gen_helper_ctz(cpu_T[0], cpu_T[0]);
            }
            /* ??? The manual says that the output is undefined when the
               input is zero, but real hardware leaves it unchanged, and
               real programs appear to depend on that.  */
            tcg_gen_movi_tl(cpu_tmp0, 0);
            tcg_gen_movcond_tl(TCG_COND_EQ, cpu_T[0], cpu_cc_dst, cpu_tmp0,
                               cpu_regs[reg], cpu_T[0]);
B
bellard 已提交
6790
        }
6791
        gen_op_mov_reg_v(ot, reg, cpu_T[0]);
B
bellard 已提交
6792 6793 6794 6795
        break;
        /************************/
        /* bcd */
    case 0x27: /* daa */
B
bellard 已提交
6796 6797
        if (CODE64(s))
            goto illegal_op;
6798
        gen_update_cc_op(s);
6799
        gen_helper_daa(cpu_env);
6800
        set_cc_op(s, CC_OP_EFLAGS);
B
bellard 已提交
6801 6802
        break;
    case 0x2f: /* das */
B
bellard 已提交
6803 6804
        if (CODE64(s))
            goto illegal_op;
6805
        gen_update_cc_op(s);
6806
        gen_helper_das(cpu_env);
6807
        set_cc_op(s, CC_OP_EFLAGS);
B
bellard 已提交
6808 6809
        break;
    case 0x37: /* aaa */
B
bellard 已提交
6810 6811
        if (CODE64(s))
            goto illegal_op;
6812
        gen_update_cc_op(s);
6813
        gen_helper_aaa(cpu_env);
6814
        set_cc_op(s, CC_OP_EFLAGS);
B
bellard 已提交
6815 6816
        break;
    case 0x3f: /* aas */
B
bellard 已提交
6817 6818
        if (CODE64(s))
            goto illegal_op;
6819
        gen_update_cc_op(s);
6820
        gen_helper_aas(cpu_env);
6821
        set_cc_op(s, CC_OP_EFLAGS);
B
bellard 已提交
6822 6823
        break;
    case 0xd4: /* aam */
B
bellard 已提交
6824 6825
        if (CODE64(s))
            goto illegal_op;
6826
        val = cpu_ldub_code(env, s->pc++);
6827 6828 6829
        if (val == 0) {
            gen_exception(s, EXCP00_DIVZ, pc_start - s->cs_base);
        } else {
6830
            gen_helper_aam(cpu_env, tcg_const_i32(val));
6831
            set_cc_op(s, CC_OP_LOGICB);
6832
        }
B
bellard 已提交
6833 6834
        break;
    case 0xd5: /* aad */
B
bellard 已提交
6835 6836
        if (CODE64(s))
            goto illegal_op;
6837
        val = cpu_ldub_code(env, s->pc++);
6838
        gen_helper_aad(cpu_env, tcg_const_i32(val));
6839
        set_cc_op(s, CC_OP_LOGICB);
B
bellard 已提交
6840 6841 6842 6843
        break;
        /************************/
        /* misc */
    case 0x90: /* nop */
6844
        /* XXX: correct lock test for all insn */
R
Richard Henderson 已提交
6845
        if (prefixes & PREFIX_LOCK) {
6846
            goto illegal_op;
R
Richard Henderson 已提交
6847 6848 6849 6850 6851
        }
        /* If REX_B is set, then this is xchg eax, r8d, not a nop.  */
        if (REX_B(s)) {
            goto do_xchg_reg_eax;
        }
T
ths 已提交
6852
        if (prefixes & PREFIX_REPZ) {
6853 6854 6855 6856
            gen_update_cc_op(s);
            gen_jmp_im(pc_start - s->cs_base);
            gen_helper_pause(cpu_env, tcg_const_i32(s->pc - pc_start));
            s->is_jmp = DISAS_TB_JUMP;
T
ths 已提交
6857
        }
B
bellard 已提交
6858 6859
        break;
    case 0x9b: /* fwait */
6860
        if ((s->flags & (HF_MP_MASK | HF_TS_MASK)) ==
B
bellard 已提交
6861 6862
            (HF_MP_MASK | HF_TS_MASK)) {
            gen_exception(s, EXCP07_PREX, pc_start - s->cs_base);
B
bellard 已提交
6863
        } else {
B
Blue Swirl 已提交
6864
            gen_helper_fwait(cpu_env);
B
bellard 已提交
6865
        }
B
bellard 已提交
6866 6867 6868 6869 6870
        break;
    case 0xcc: /* int3 */
        gen_interrupt(s, EXCP03_INT3, pc_start - s->cs_base, s->pc - s->cs_base);
        break;
    case 0xcd: /* int N */
6871
        val = cpu_ldub_code(env, s->pc++);
6872
        if (s->vm86 && s->iopl != 3) {
6873
            gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
6874 6875 6876
        } else {
            gen_interrupt(s, val, pc_start - s->cs_base, s->pc - s->cs_base);
        }
B
bellard 已提交
6877 6878
        break;
    case 0xce: /* into */
B
bellard 已提交
6879 6880
        if (CODE64(s))
            goto illegal_op;
6881
        gen_update_cc_op(s);
6882
        gen_jmp_im(pc_start - s->cs_base);
B
Blue Swirl 已提交
6883
        gen_helper_into(cpu_env, tcg_const_i32(s->pc - pc_start));
B
bellard 已提交
6884
        break;
A
aurel32 已提交
6885
#ifdef WANT_ICEBP
B
bellard 已提交
6886
    case 0xf1: /* icebp (undocumented, exits to external debugger) */
B
bellard 已提交
6887
        gen_svm_check_intercept(s, pc_start, SVM_EXIT_ICEBP);
6888
#if 1
B
bellard 已提交
6889
        gen_debug(s, pc_start - s->cs_base);
6890 6891
#else
        /* start debug */
6892
        tb_flush(CPU(x86_env_get_cpu(env)));
6893
        qemu_set_log(CPU_LOG_INT | CPU_LOG_TB_IN_ASM);
6894
#endif
B
bellard 已提交
6895
        break;
A
aurel32 已提交
6896
#endif
B
bellard 已提交
6897 6898 6899
    case 0xfa: /* cli */
        if (!s->vm86) {
            if (s->cpl <= s->iopl) {
6900
                gen_helper_cli(cpu_env);
B
bellard 已提交
6901 6902 6903 6904 6905
            } else {
                gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
            }
        } else {
            if (s->iopl == 3) {
6906
                gen_helper_cli(cpu_env);
B
bellard 已提交
6907 6908 6909 6910 6911 6912 6913 6914 6915
            } else {
                gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
            }
        }
        break;
    case 0xfb: /* sti */
        if (!s->vm86) {
            if (s->cpl <= s->iopl) {
            gen_sti:
6916
                gen_helper_sti(cpu_env);
B
bellard 已提交
6917
                /* interruptions are enabled only the first insn after sti */
6918 6919 6920
                /* If several instructions disable interrupts, only the
                   _first_ does it */
                if (!(s->tb->flags & HF_INHIBIT_IRQ_MASK))
6921
                    gen_helper_set_inhibit_irq(cpu_env);
B
bellard 已提交
6922
                /* give a chance to handle pending irqs */
B
bellard 已提交
6923
                gen_jmp_im(s->pc - s->cs_base);
B
bellard 已提交
6924 6925 6926 6927 6928 6929 6930 6931 6932 6933 6934 6935 6936
                gen_eob(s);
            } else {
                gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
            }
        } else {
            if (s->iopl == 3) {
                goto gen_sti;
            } else {
                gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
            }
        }
        break;
    case 0x62: /* bound */
B
bellard 已提交
6937 6938
        if (CODE64(s))
            goto illegal_op;
6939
        ot = dflag;
6940
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
6941 6942 6943 6944
        reg = (modrm >> 3) & 7;
        mod = (modrm >> 6) & 3;
        if (mod == 3)
            goto illegal_op;
6945
        gen_op_mov_v_reg(ot, cpu_T[0], reg);
6946
        gen_lea_modrm(env, s, modrm);
6947
        tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
6948
        if (ot == MO_16) {
B
Blue Swirl 已提交
6949 6950 6951 6952
            gen_helper_boundw(cpu_env, cpu_A0, cpu_tmp2_i32);
        } else {
            gen_helper_boundl(cpu_env, cpu_A0, cpu_tmp2_i32);
        }
B
bellard 已提交
6953 6954
        break;
    case 0x1c8 ... 0x1cf: /* bswap reg */
B
bellard 已提交
6955 6956
        reg = (b & 7) | REX_B(s);
#ifdef TARGET_X86_64
6957
        if (dflag == MO_64) {
6958
            gen_op_mov_v_reg(MO_64, cpu_T[0], reg);
A
aurel32 已提交
6959
            tcg_gen_bswap64_i64(cpu_T[0], cpu_T[0]);
6960
            gen_op_mov_reg_v(MO_64, reg, cpu_T[0]);
6961
        } else
6962
#endif
B
bellard 已提交
6963
        {
6964
            gen_op_mov_v_reg(MO_32, cpu_T[0], reg);
6965 6966
            tcg_gen_ext32u_tl(cpu_T[0], cpu_T[0]);
            tcg_gen_bswap32_tl(cpu_T[0], cpu_T[0]);
6967
            gen_op_mov_reg_v(MO_32, reg, cpu_T[0]);
B
bellard 已提交
6968
        }
B
bellard 已提交
6969 6970
        break;
    case 0xd6: /* salc */
B
bellard 已提交
6971 6972
        if (CODE64(s))
            goto illegal_op;
6973
        gen_compute_eflags_c(s, cpu_T[0]);
6974
        tcg_gen_neg_tl(cpu_T[0], cpu_T[0]);
6975
        gen_op_mov_reg_v(MO_8, R_EAX, cpu_T[0]);
B
bellard 已提交
6976 6977 6978 6979 6980
        break;
    case 0xe0: /* loopnz */
    case 0xe1: /* loopz */
    case 0xe2: /* loop */
    case 0xe3: /* jecxz */
B
bellard 已提交
6981
        {
6982
            TCGLabel *l1, *l2, *l3;
B
bellard 已提交
6983

6984
            tval = (int8_t)insn_get(env, s, MO_8);
B
bellard 已提交
6985 6986
            next_eip = s->pc - s->cs_base;
            tval += next_eip;
6987
            if (dflag == MO_16) {
B
bellard 已提交
6988
                tval &= 0xffff;
6989
            }
6990

B
bellard 已提交
6991 6992
            l1 = gen_new_label();
            l2 = gen_new_label();
6993
            l3 = gen_new_label();
B
bellard 已提交
6994
            b &= 3;
6995 6996 6997
            switch(b) {
            case 0: /* loopnz */
            case 1: /* loopz */
6998 6999
                gen_op_add_reg_im(s->aflag, R_ECX, -1);
                gen_op_jz_ecx(s->aflag, l3);
7000
                gen_jcc1(s, (JCC_Z << 1) | (b ^ 1), l1);
7001 7002
                break;
            case 2: /* loop */
7003 7004
                gen_op_add_reg_im(s->aflag, R_ECX, -1);
                gen_op_jnz_ecx(s->aflag, l1);
7005 7006 7007
                break;
            default:
            case 3: /* jcxz */
7008
                gen_op_jz_ecx(s->aflag, l1);
7009
                break;
B
bellard 已提交
7010 7011
            }

7012
            gen_set_label(l3);
B
bellard 已提交
7013
            gen_jmp_im(next_eip);
7014
            tcg_gen_br(l2);
7015

B
bellard 已提交
7016 7017 7018 7019 7020
            gen_set_label(l1);
            gen_jmp_im(tval);
            gen_set_label(l2);
            gen_eob(s);
        }
B
bellard 已提交
7021 7022 7023 7024 7025 7026
        break;
    case 0x130: /* wrmsr */
    case 0x132: /* rdmsr */
        if (s->cpl != 0) {
            gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
        } else {
7027
            gen_update_cc_op(s);
B
bellard 已提交
7028
            gen_jmp_im(pc_start - s->cs_base);
T
ths 已提交
7029
            if (b & 2) {
B
Blue Swirl 已提交
7030
                gen_helper_rdmsr(cpu_env);
T
ths 已提交
7031
            } else {
B
Blue Swirl 已提交
7032
                gen_helper_wrmsr(cpu_env);
T
ths 已提交
7033
            }
B
bellard 已提交
7034 7035 7036
        }
        break;
    case 0x131: /* rdtsc */
7037
        gen_update_cc_op(s);
B
bellard 已提交
7038
        gen_jmp_im(pc_start - s->cs_base);
7039
        if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
7040
            gen_io_start();
7041
	}
B
Blue Swirl 已提交
7042
        gen_helper_rdtsc(cpu_env);
7043
        if (s->tb->cflags & CF_USE_ICOUNT) {
P
pbrook 已提交
7044 7045 7046
            gen_io_end();
            gen_jmp(s, s->pc - s->cs_base);
        }
B
bellard 已提交
7047
        break;
7048
    case 0x133: /* rdpmc */
7049
        gen_update_cc_op(s);
7050
        gen_jmp_im(pc_start - s->cs_base);
B
Blue Swirl 已提交
7051
        gen_helper_rdpmc(cpu_env);
7052
        break;
7053
    case 0x134: /* sysenter */
7054
        /* For Intel SYSENTER is valid on 64-bit */
7055
        if (CODE64(s) && env->cpuid_vendor1 != CPUID_VENDOR_INTEL_1)
B
bellard 已提交
7056
            goto illegal_op;
7057 7058 7059
        if (!s->pe) {
            gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
        } else {
7060
            gen_helper_sysenter(cpu_env);
7061 7062 7063 7064
            gen_eob(s);
        }
        break;
    case 0x135: /* sysexit */
7065
        /* For Intel SYSEXIT is valid on 64-bit */
7066
        if (CODE64(s) && env->cpuid_vendor1 != CPUID_VENDOR_INTEL_1)
B
bellard 已提交
7067
            goto illegal_op;
7068 7069 7070
        if (!s->pe) {
            gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
        } else {
7071
            gen_helper_sysexit(cpu_env, tcg_const_i32(dflag - 1));
7072 7073 7074
            gen_eob(s);
        }
        break;
B
bellard 已提交
7075 7076 7077
#ifdef TARGET_X86_64
    case 0x105: /* syscall */
        /* XXX: is it usable in real mode ? */
J
Jun Koi 已提交
7078
        gen_update_cc_op(s);
B
bellard 已提交
7079
        gen_jmp_im(pc_start - s->cs_base);
7080
        gen_helper_syscall(cpu_env, tcg_const_i32(s->pc - pc_start));
B
bellard 已提交
7081 7082 7083 7084 7085 7086
        gen_eob(s);
        break;
    case 0x107: /* sysret */
        if (!s->pe) {
            gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
        } else {
7087
            gen_helper_sysret(cpu_env, tcg_const_i32(dflag - 1));
7088
            /* condition codes are modified only in long mode */
7089 7090 7091
            if (s->lma) {
                set_cc_op(s, CC_OP_EFLAGS);
            }
B
bellard 已提交
7092 7093 7094 7095
            gen_eob(s);
        }
        break;
#endif
B
bellard 已提交
7096
    case 0x1a2: /* cpuid */
7097
        gen_update_cc_op(s);
B
bellard 已提交
7098
        gen_jmp_im(pc_start - s->cs_base);
B
Blue Swirl 已提交
7099
        gen_helper_cpuid(cpu_env);
B
bellard 已提交
7100 7101 7102 7103 7104
        break;
    case 0xf4: /* hlt */
        if (s->cpl != 0) {
            gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
        } else {
7105
            gen_update_cc_op(s);
7106
            gen_jmp_im(pc_start - s->cs_base);
B
Blue Swirl 已提交
7107
            gen_helper_hlt(cpu_env, tcg_const_i32(s->pc - pc_start));
J
Jun Koi 已提交
7108
            s->is_jmp = DISAS_TB_JUMP;
B
bellard 已提交
7109 7110 7111
        }
        break;
    case 0x100:
7112
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
7113 7114 7115 7116
        mod = (modrm >> 6) & 3;
        op = (modrm >> 3) & 7;
        switch(op) {
        case 0: /* sldt */
7117 7118
            if (!s->pe || s->vm86)
                goto illegal_op;
B
bellard 已提交
7119
            gen_svm_check_intercept(s, pc_start, SVM_EXIT_LDTR_READ);
B
bellard 已提交
7120
            tcg_gen_ld32u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,ldt.selector));
7121
            ot = mod == 3 ? dflag : MO_16;
7122
            gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 1);
B
bellard 已提交
7123 7124
            break;
        case 2: /* lldt */
7125 7126
            if (!s->pe || s->vm86)
                goto illegal_op;
B
bellard 已提交
7127 7128 7129
            if (s->cpl != 0) {
                gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
            } else {
B
bellard 已提交
7130
                gen_svm_check_intercept(s, pc_start, SVM_EXIT_LDTR_WRITE);
7131
                gen_ldst_modrm(env, s, modrm, MO_16, OR_TMP0, 0);
7132
                tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
7133
                gen_helper_lldt(cpu_env, cpu_tmp2_i32);
B
bellard 已提交
7134 7135 7136
            }
            break;
        case 1: /* str */
7137 7138
            if (!s->pe || s->vm86)
                goto illegal_op;
B
bellard 已提交
7139
            gen_svm_check_intercept(s, pc_start, SVM_EXIT_TR_READ);
B
bellard 已提交
7140
            tcg_gen_ld32u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,tr.selector));
7141
            ot = mod == 3 ? dflag : MO_16;
7142
            gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 1);
B
bellard 已提交
7143 7144
            break;
        case 3: /* ltr */
7145 7146
            if (!s->pe || s->vm86)
                goto illegal_op;
B
bellard 已提交
7147 7148 7149
            if (s->cpl != 0) {
                gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
            } else {
B
bellard 已提交
7150
                gen_svm_check_intercept(s, pc_start, SVM_EXIT_TR_WRITE);
7151
                gen_ldst_modrm(env, s, modrm, MO_16, OR_TMP0, 0);
7152
                tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
7153
                gen_helper_ltr(cpu_env, cpu_tmp2_i32);
B
bellard 已提交
7154 7155 7156 7157
            }
            break;
        case 4: /* verr */
        case 5: /* verw */
7158 7159
            if (!s->pe || s->vm86)
                goto illegal_op;
7160
            gen_ldst_modrm(env, s, modrm, MO_16, OR_TMP0, 0);
7161
            gen_update_cc_op(s);
7162 7163 7164 7165 7166
            if (op == 4) {
                gen_helper_verr(cpu_env, cpu_T[0]);
            } else {
                gen_helper_verw(cpu_env, cpu_T[0]);
            }
7167
            set_cc_op(s, CC_OP_EFLAGS);
7168
            break;
B
bellard 已提交
7169 7170 7171 7172 7173
        default:
            goto illegal_op;
        }
        break;
    case 0x101:
7174
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
7175 7176
        mod = (modrm >> 6) & 3;
        op = (modrm >> 3) & 7;
B
bellard 已提交
7177
        rm = modrm & 7;
B
bellard 已提交
7178 7179 7180 7181
        switch(op) {
        case 0: /* sgdt */
            if (mod == 3)
                goto illegal_op;
B
bellard 已提交
7182
            gen_svm_check_intercept(s, pc_start, SVM_EXIT_GDTR_READ);
7183
            gen_lea_modrm(env, s, modrm);
B
bellard 已提交
7184
            tcg_gen_ld32u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State, gdt.limit));
7185
            gen_op_st_v(s, MO_16, cpu_T[0], cpu_A0);
7186
            gen_add_A0_im(s, 2);
B
bellard 已提交
7187
            tcg_gen_ld_tl(cpu_T[0], cpu_env, offsetof(CPUX86State, gdt.base));
7188
            if (dflag == MO_16) {
7189 7190
                tcg_gen_andi_tl(cpu_T[0], cpu_T[0], 0xffffff);
            }
7191
            gen_op_st_v(s, CODE64(s) + MO_32, cpu_T[0], cpu_A0);
B
bellard 已提交
7192
            break;
B
bellard 已提交
7193 7194 7195 7196 7197 7198 7199
        case 1:
            if (mod == 3) {
                switch (rm) {
                case 0: /* monitor */
                    if (!(s->cpuid_ext_features & CPUID_EXT_MONITOR) ||
                        s->cpl != 0)
                        goto illegal_op;
7200
                    gen_update_cc_op(s);
B
bellard 已提交
7201
                    gen_jmp_im(pc_start - s->cs_base);
7202 7203
                    tcg_gen_mov_tl(cpu_A0, cpu_regs[R_EAX]);
                    gen_extu(s->aflag, cpu_A0);
B
bellard 已提交
7204
                    gen_add_A0_ds_seg(s);
B
Blue Swirl 已提交
7205
                    gen_helper_monitor(cpu_env, cpu_A0);
B
bellard 已提交
7206 7207 7208 7209 7210
                    break;
                case 1: /* mwait */
                    if (!(s->cpuid_ext_features & CPUID_EXT_MONITOR) ||
                        s->cpl != 0)
                        goto illegal_op;
J
Jun Koi 已提交
7211
                    gen_update_cc_op(s);
7212
                    gen_jmp_im(pc_start - s->cs_base);
B
Blue Swirl 已提交
7213
                    gen_helper_mwait(cpu_env, tcg_const_i32(s->pc - pc_start));
B
bellard 已提交
7214 7215
                    gen_eob(s);
                    break;
H
H. Peter Anvin 已提交
7216 7217 7218 7219 7220 7221 7222 7223 7224 7225 7226 7227 7228 7229 7230 7231 7232 7233
                case 2: /* clac */
                    if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_SMAP) ||
                        s->cpl != 0) {
                        goto illegal_op;
                    }
                    gen_helper_clac(cpu_env);
                    gen_jmp_im(s->pc - s->cs_base);
                    gen_eob(s);
                    break;
                case 3: /* stac */
                    if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_SMAP) ||
                        s->cpl != 0) {
                        goto illegal_op;
                    }
                    gen_helper_stac(cpu_env);
                    gen_jmp_im(s->pc - s->cs_base);
                    gen_eob(s);
                    break;
B
bellard 已提交
7234 7235 7236 7237
                default:
                    goto illegal_op;
                }
            } else { /* sidt */
B
bellard 已提交
7238
                gen_svm_check_intercept(s, pc_start, SVM_EXIT_IDTR_READ);
7239
                gen_lea_modrm(env, s, modrm);
B
bellard 已提交
7240
                tcg_gen_ld32u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State, idt.limit));
7241
                gen_op_st_v(s, MO_16, cpu_T[0], cpu_A0);
B
bellard 已提交
7242
                gen_add_A0_im(s, 2);
B
bellard 已提交
7243
                tcg_gen_ld_tl(cpu_T[0], cpu_env, offsetof(CPUX86State, idt.base));
7244
                if (dflag == MO_16) {
7245 7246
                    tcg_gen_andi_tl(cpu_T[0], cpu_T[0], 0xffffff);
                }
7247
                gen_op_st_v(s, CODE64(s) + MO_32, cpu_T[0], cpu_A0);
B
bellard 已提交
7248 7249
            }
            break;
B
bellard 已提交
7250 7251
        case 2: /* lgdt */
        case 3: /* lidt */
T
ths 已提交
7252
            if (mod == 3) {
7253
                gen_update_cc_op(s);
B
bellard 已提交
7254
                gen_jmp_im(pc_start - s->cs_base);
T
ths 已提交
7255 7256
                switch(rm) {
                case 0: /* VMRUN */
B
bellard 已提交
7257 7258 7259 7260
                    if (!(s->flags & HF_SVME_MASK) || !s->pe)
                        goto illegal_op;
                    if (s->cpl != 0) {
                        gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
T
ths 已提交
7261
                        break;
B
bellard 已提交
7262
                    } else {
7263
                        gen_helper_vmrun(cpu_env, tcg_const_i32(s->aflag - 1),
P
pbrook 已提交
7264
                                         tcg_const_i32(s->pc - pc_start));
7265
                        tcg_gen_exit_tb(0);
J
Jun Koi 已提交
7266
                        s->is_jmp = DISAS_TB_JUMP;
B
bellard 已提交
7267
                    }
T
ths 已提交
7268 7269
                    break;
                case 1: /* VMMCALL */
B
bellard 已提交
7270 7271
                    if (!(s->flags & HF_SVME_MASK))
                        goto illegal_op;
B
Blue Swirl 已提交
7272
                    gen_helper_vmmcall(cpu_env);
T
ths 已提交
7273 7274
                    break;
                case 2: /* VMLOAD */
B
bellard 已提交
7275 7276 7277 7278 7279 7280
                    if (!(s->flags & HF_SVME_MASK) || !s->pe)
                        goto illegal_op;
                    if (s->cpl != 0) {
                        gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
                        break;
                    } else {
7281
                        gen_helper_vmload(cpu_env, tcg_const_i32(s->aflag - 1));
B
bellard 已提交
7282
                    }
T
ths 已提交
7283 7284
                    break;
                case 3: /* VMSAVE */
B
bellard 已提交
7285 7286 7287 7288 7289 7290
                    if (!(s->flags & HF_SVME_MASK) || !s->pe)
                        goto illegal_op;
                    if (s->cpl != 0) {
                        gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
                        break;
                    } else {
7291
                        gen_helper_vmsave(cpu_env, tcg_const_i32(s->aflag - 1));
B
bellard 已提交
7292
                    }
T
ths 已提交
7293 7294
                    break;
                case 4: /* STGI */
B
bellard 已提交
7295 7296 7297 7298 7299 7300 7301 7302
                    if ((!(s->flags & HF_SVME_MASK) &&
                         !(s->cpuid_ext3_features & CPUID_EXT3_SKINIT)) || 
                        !s->pe)
                        goto illegal_op;
                    if (s->cpl != 0) {
                        gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
                        break;
                    } else {
B
Blue Swirl 已提交
7303
                        gen_helper_stgi(cpu_env);
B
bellard 已提交
7304
                    }
T
ths 已提交
7305 7306
                    break;
                case 5: /* CLGI */
B
bellard 已提交
7307 7308 7309 7310 7311 7312
                    if (!(s->flags & HF_SVME_MASK) || !s->pe)
                        goto illegal_op;
                    if (s->cpl != 0) {
                        gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
                        break;
                    } else {
B
Blue Swirl 已提交
7313
                        gen_helper_clgi(cpu_env);
B
bellard 已提交
7314
                    }
T
ths 已提交
7315 7316
                    break;
                case 6: /* SKINIT */
B
bellard 已提交
7317 7318 7319 7320
                    if ((!(s->flags & HF_SVME_MASK) && 
                         !(s->cpuid_ext3_features & CPUID_EXT3_SKINIT)) || 
                        !s->pe)
                        goto illegal_op;
B
Blue Swirl 已提交
7321
                    gen_helper_skinit(cpu_env);
T
ths 已提交
7322 7323
                    break;
                case 7: /* INVLPGA */
B
bellard 已提交
7324 7325 7326 7327 7328 7329
                    if (!(s->flags & HF_SVME_MASK) || !s->pe)
                        goto illegal_op;
                    if (s->cpl != 0) {
                        gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
                        break;
                    } else {
7330 7331
                        gen_helper_invlpga(cpu_env,
                                           tcg_const_i32(s->aflag - 1));
B
bellard 已提交
7332
                    }
T
ths 已提交
7333 7334 7335 7336 7337
                    break;
                default:
                    goto illegal_op;
                }
            } else if (s->cpl != 0) {
B
bellard 已提交
7338 7339
                gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
            } else {
B
bellard 已提交
7340 7341
                gen_svm_check_intercept(s, pc_start,
                                        op==2 ? SVM_EXIT_GDTR_WRITE : SVM_EXIT_IDTR_WRITE);
7342
                gen_lea_modrm(env, s, modrm);
7343
                gen_op_ld_v(s, MO_16, cpu_T[1], cpu_A0);
7344
                gen_add_A0_im(s, 2);
7345
                gen_op_ld_v(s, CODE64(s) + MO_32, cpu_T[0], cpu_A0);
7346
                if (dflag == MO_16) {
7347 7348
                    tcg_gen_andi_tl(cpu_T[0], cpu_T[0], 0xffffff);
                }
B
bellard 已提交
7349
                if (op == 2) {
B
bellard 已提交
7350 7351
                    tcg_gen_st_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,gdt.base));
                    tcg_gen_st32_tl(cpu_T[1], cpu_env, offsetof(CPUX86State,gdt.limit));
B
bellard 已提交
7352
                } else {
B
bellard 已提交
7353 7354
                    tcg_gen_st_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,idt.base));
                    tcg_gen_st32_tl(cpu_T[1], cpu_env, offsetof(CPUX86State,idt.limit));
B
bellard 已提交
7355 7356 7357 7358
                }
            }
            break;
        case 4: /* smsw */
B
bellard 已提交
7359
            gen_svm_check_intercept(s, pc_start, SVM_EXIT_READ_CR0);
7360
#if defined TARGET_X86_64 && defined HOST_WORDS_BIGENDIAN
7361 7362
            tcg_gen_ld32u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,cr[0]) + 4);
#else
B
bellard 已提交
7363
            tcg_gen_ld32u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,cr[0]));
7364
#endif
7365
            gen_ldst_modrm(env, s, modrm, MO_16, OR_TMP0, 1);
B
bellard 已提交
7366 7367 7368 7369 7370
            break;
        case 6: /* lmsw */
            if (s->cpl != 0) {
                gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
            } else {
B
bellard 已提交
7371
                gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_CR0);
7372
                gen_ldst_modrm(env, s, modrm, MO_16, OR_TMP0, 0);
B
Blue Swirl 已提交
7373
                gen_helper_lmsw(cpu_env, cpu_T[0]);
B
bellard 已提交
7374
                gen_jmp_im(s->pc - s->cs_base);
B
bellard 已提交
7375
                gen_eob(s);
B
bellard 已提交
7376 7377
            }
            break;
A
Andre Przywara 已提交
7378 7379 7380 7381 7382
        case 7:
            if (mod != 3) { /* invlpg */
                if (s->cpl != 0) {
                    gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
                } else {
7383
                    gen_update_cc_op(s);
A
Andre Przywara 已提交
7384
                    gen_jmp_im(pc_start - s->cs_base);
7385
                    gen_lea_modrm(env, s, modrm);
B
Blue Swirl 已提交
7386
                    gen_helper_invlpg(cpu_env, cpu_A0);
A
Andre Przywara 已提交
7387 7388 7389
                    gen_jmp_im(s->pc - s->cs_base);
                    gen_eob(s);
                }
B
bellard 已提交
7390
            } else {
A
Andre Przywara 已提交
7391 7392
                switch (rm) {
                case 0: /* swapgs */
B
bellard 已提交
7393
#ifdef TARGET_X86_64
A
Andre Przywara 已提交
7394 7395 7396 7397 7398 7399 7400 7401 7402 7403 7404 7405 7406
                    if (CODE64(s)) {
                        if (s->cpl != 0) {
                            gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
                        } else {
                            tcg_gen_ld_tl(cpu_T[0], cpu_env,
                                offsetof(CPUX86State,segs[R_GS].base));
                            tcg_gen_ld_tl(cpu_T[1], cpu_env,
                                offsetof(CPUX86State,kernelgsbase));
                            tcg_gen_st_tl(cpu_T[1], cpu_env,
                                offsetof(CPUX86State,segs[R_GS].base));
                            tcg_gen_st_tl(cpu_T[0], cpu_env,
                                offsetof(CPUX86State,kernelgsbase));
                        }
7407
                    } else
B
bellard 已提交
7408 7409 7410 7411
#endif
                    {
                        goto illegal_op;
                    }
A
Andre Przywara 已提交
7412 7413 7414 7415
                    break;
                case 1: /* rdtscp */
                    if (!(s->cpuid_ext2_features & CPUID_EXT2_RDTSCP))
                        goto illegal_op;
7416
                    gen_update_cc_op(s);
B
bellard 已提交
7417
                    gen_jmp_im(pc_start - s->cs_base);
7418
                    if (s->tb->cflags & CF_USE_ICOUNT) {
A
Andre Przywara 已提交
7419
                        gen_io_start();
7420
		    }
B
Blue Swirl 已提交
7421
                    gen_helper_rdtscp(cpu_env);
7422
                    if (s->tb->cflags & CF_USE_ICOUNT) {
A
Andre Przywara 已提交
7423 7424 7425 7426 7427 7428
                        gen_io_end();
                        gen_jmp(s, s->pc - s->cs_base);
                    }
                    break;
                default:
                    goto illegal_op;
B
bellard 已提交
7429
                }
B
bellard 已提交
7430 7431 7432 7433 7434 7435
            }
            break;
        default:
            goto illegal_op;
        }
        break;
7436 7437 7438 7439 7440
    case 0x108: /* invd */
    case 0x109: /* wbinvd */
        if (s->cpl != 0) {
            gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
        } else {
B
bellard 已提交
7441
            gen_svm_check_intercept(s, pc_start, (b & 2) ? SVM_EXIT_INVD : SVM_EXIT_WBINVD);
7442 7443 7444
            /* nothing to do */
        }
        break;
B
bellard 已提交
7445 7446 7447 7448 7449
    case 0x63: /* arpl or movslS (x86_64) */
#ifdef TARGET_X86_64
        if (CODE64(s)) {
            int d_ot;
            /* d_ot is the size of destination */
7450
            d_ot = dflag;
B
bellard 已提交
7451

7452
            modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
7453 7454 7455
            reg = ((modrm >> 3) & 7) | rex_r;
            mod = (modrm >> 6) & 3;
            rm = (modrm & 7) | REX_B(s);
7456

B
bellard 已提交
7457
            if (mod == 3) {
7458
                gen_op_mov_v_reg(MO_32, cpu_T[0], rm);
B
bellard 已提交
7459
                /* sign extend */
7460
                if (d_ot == MO_64) {
B
bellard 已提交
7461
                    tcg_gen_ext32s_tl(cpu_T[0], cpu_T[0]);
7462
                }
7463
                gen_op_mov_reg_v(d_ot, reg, cpu_T[0]);
B
bellard 已提交
7464
            } else {
7465
                gen_lea_modrm(env, s, modrm);
R
Richard Henderson 已提交
7466
                gen_op_ld_v(s, MO_32 | MO_SIGN, cpu_T[0], cpu_A0);
7467
                gen_op_mov_reg_v(d_ot, reg, cpu_T[0]);
B
bellard 已提交
7468
            }
7469
        } else
B
bellard 已提交
7470 7471
#endif
        {
7472
            TCGLabel *label1;
L
Laurent Desnogues 已提交
7473
            TCGv t0, t1, t2, a0;
7474

B
bellard 已提交
7475 7476
            if (!s->pe || s->vm86)
                goto illegal_op;
P
pbrook 已提交
7477 7478 7479
            t0 = tcg_temp_local_new();
            t1 = tcg_temp_local_new();
            t2 = tcg_temp_local_new();
7480
            ot = MO_16;
7481
            modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
7482 7483 7484 7485
            reg = (modrm >> 3) & 7;
            mod = (modrm >> 6) & 3;
            rm = modrm & 7;
            if (mod != 3) {
7486
                gen_lea_modrm(env, s, modrm);
7487
                gen_op_ld_v(s, ot, t0, cpu_A0);
L
Laurent Desnogues 已提交
7488 7489
                a0 = tcg_temp_local_new();
                tcg_gen_mov_tl(a0, cpu_A0);
B
bellard 已提交
7490
            } else {
7491
                gen_op_mov_v_reg(ot, t0, rm);
L
Laurent Desnogues 已提交
7492
                TCGV_UNUSED(a0);
B
bellard 已提交
7493
            }
7494 7495 7496 7497
            gen_op_mov_v_reg(ot, t1, reg);
            tcg_gen_andi_tl(cpu_tmp0, t0, 3);
            tcg_gen_andi_tl(t1, t1, 3);
            tcg_gen_movi_tl(t2, 0);
7498
            label1 = gen_new_label();
7499 7500 7501 7502
            tcg_gen_brcond_tl(TCG_COND_GE, cpu_tmp0, t1, label1);
            tcg_gen_andi_tl(t0, t0, ~3);
            tcg_gen_or_tl(t0, t0, t1);
            tcg_gen_movi_tl(t2, CC_Z);
7503
            gen_set_label(label1);
B
bellard 已提交
7504
            if (mod != 3) {
7505
                gen_op_st_v(s, ot, t0, a0);
L
Laurent Desnogues 已提交
7506 7507
                tcg_temp_free(a0);
           } else {
7508
                gen_op_mov_reg_v(ot, rm, t0);
B
bellard 已提交
7509
            }
7510
            gen_compute_eflags(s);
7511
            tcg_gen_andi_tl(cpu_cc_src, cpu_cc_src, ~CC_Z);
7512 7513 7514 7515
            tcg_gen_or_tl(cpu_cc_src, cpu_cc_src, t2);
            tcg_temp_free(t0);
            tcg_temp_free(t1);
            tcg_temp_free(t2);
7516 7517
        }
        break;
B
bellard 已提交
7518 7519
    case 0x102: /* lar */
    case 0x103: /* lsl */
7520
        {
7521
            TCGLabel *label1;
7522
            TCGv t0;
7523 7524
            if (!s->pe || s->vm86)
                goto illegal_op;
7525
            ot = dflag != MO_16 ? MO_32 : MO_16;
7526
            modrm = cpu_ldub_code(env, s->pc++);
7527
            reg = ((modrm >> 3) & 7) | rex_r;
7528
            gen_ldst_modrm(env, s, modrm, MO_16, OR_TMP0, 0);
P
pbrook 已提交
7529
            t0 = tcg_temp_local_new();
7530
            gen_update_cc_op(s);
7531 7532 7533 7534 7535
            if (b == 0x102) {
                gen_helper_lar(t0, cpu_env, cpu_T[0]);
            } else {
                gen_helper_lsl(t0, cpu_env, cpu_T[0]);
            }
7536 7537
            tcg_gen_andi_tl(cpu_tmp0, cpu_cc_src, CC_Z);
            label1 = gen_new_label();
P
pbrook 已提交
7538
            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_tmp0, 0, label1);
7539
            gen_op_mov_reg_v(ot, reg, t0);
7540
            gen_set_label(label1);
7541
            set_cc_op(s, CC_OP_EFLAGS);
7542
            tcg_temp_free(t0);
7543
        }
B
bellard 已提交
7544 7545
        break;
    case 0x118:
7546
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
7547 7548 7549 7550 7551 7552 7553 7554 7555
        mod = (modrm >> 6) & 3;
        op = (modrm >> 3) & 7;
        switch(op) {
        case 0: /* prefetchnta */
        case 1: /* prefetchnt0 */
        case 2: /* prefetchnt0 */
        case 3: /* prefetchnt0 */
            if (mod == 3)
                goto illegal_op;
7556
            gen_lea_modrm(env, s, modrm);
B
bellard 已提交
7557 7558
            /* nothing more to do */
            break;
B
bellard 已提交
7559
        default: /* nop (multi byte) */
7560
            gen_nop_modrm(env, s, modrm);
B
bellard 已提交
7561
            break;
B
bellard 已提交
7562 7563
        }
        break;
B
bellard 已提交
7564
    case 0x119 ... 0x11f: /* nop (multi byte) */
7565 7566
        modrm = cpu_ldub_code(env, s->pc++);
        gen_nop_modrm(env, s, modrm);
B
bellard 已提交
7567
        break;
B
bellard 已提交
7568 7569 7570 7571 7572
    case 0x120: /* mov reg, crN */
    case 0x122: /* mov crN, reg */
        if (s->cpl != 0) {
            gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
        } else {
7573
            modrm = cpu_ldub_code(env, s->pc++);
7574 7575 7576 7577 7578
            /* Ignore the mod bits (assume (modrm&0xc0)==0xc0).
             * AMD documentation (24594.pdf) and testing of
             * intel 386 and 486 processors all show that the mod bits
             * are assumed to be 1's, regardless of actual values.
             */
B
bellard 已提交
7579 7580 7581
            rm = (modrm & 7) | REX_B(s);
            reg = ((modrm >> 3) & 7) | rex_r;
            if (CODE64(s))
7582
                ot = MO_64;
B
bellard 已提交
7583
            else
7584
                ot = MO_32;
7585 7586 7587 7588
            if ((prefixes & PREFIX_LOCK) && (reg == 0) &&
                (s->cpuid_ext3_features & CPUID_EXT3_CR8LEG)) {
                reg = 8;
            }
B
bellard 已提交
7589 7590 7591 7592 7593
            switch(reg) {
            case 0:
            case 2:
            case 3:
            case 4:
B
bellard 已提交
7594
            case 8:
7595
                gen_update_cc_op(s);
B
bellard 已提交
7596
                gen_jmp_im(pc_start - s->cs_base);
B
bellard 已提交
7597
                if (b & 2) {
7598
                    gen_op_mov_v_reg(ot, cpu_T[0], rm);
B
Blue Swirl 已提交
7599 7600
                    gen_helper_write_crN(cpu_env, tcg_const_i32(reg),
                                         cpu_T[0]);
B
bellard 已提交
7601
                    gen_jmp_im(s->pc - s->cs_base);
B
bellard 已提交
7602 7603
                    gen_eob(s);
                } else {
B
Blue Swirl 已提交
7604
                    gen_helper_read_crN(cpu_T[0], cpu_env, tcg_const_i32(reg));
7605
                    gen_op_mov_reg_v(ot, rm, cpu_T[0]);
B
bellard 已提交
7606 7607 7608 7609 7610 7611 7612 7613 7614 7615 7616 7617
                }
                break;
            default:
                goto illegal_op;
            }
        }
        break;
    case 0x121: /* mov reg, drN */
    case 0x123: /* mov drN, reg */
        if (s->cpl != 0) {
            gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
        } else {
7618
            modrm = cpu_ldub_code(env, s->pc++);
7619 7620 7621 7622 7623
            /* Ignore the mod bits (assume (modrm&0xc0)==0xc0).
             * AMD documentation (24594.pdf) and testing of
             * intel 386 and 486 processors all show that the mod bits
             * are assumed to be 1's, regardless of actual values.
             */
B
bellard 已提交
7624 7625 7626
            rm = (modrm & 7) | REX_B(s);
            reg = ((modrm >> 3) & 7) | rex_r;
            if (CODE64(s))
7627
                ot = MO_64;
B
bellard 已提交
7628
            else
7629
                ot = MO_32;
7630
            if (reg >= 8) {
B
bellard 已提交
7631
                goto illegal_op;
7632
            }
B
bellard 已提交
7633
            if (b & 2) {
T
ths 已提交
7634
                gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_DR0 + reg);
7635
                gen_op_mov_v_reg(ot, cpu_T[0], rm);
7636 7637
                tcg_gen_movi_i32(cpu_tmp2_i32, reg);
                gen_helper_set_dr(cpu_env, cpu_tmp2_i32, cpu_T[0]);
B
bellard 已提交
7638
                gen_jmp_im(s->pc - s->cs_base);
B
bellard 已提交
7639 7640
                gen_eob(s);
            } else {
T
ths 已提交
7641
                gen_svm_check_intercept(s, pc_start, SVM_EXIT_READ_DR0 + reg);
7642 7643
                tcg_gen_movi_i32(cpu_tmp2_i32, reg);
                gen_helper_get_dr(cpu_T[0], cpu_env, cpu_tmp2_i32);
7644
                gen_op_mov_reg_v(ot, rm, cpu_T[0]);
B
bellard 已提交
7645 7646 7647 7648 7649 7650 7651
            }
        }
        break;
    case 0x106: /* clts */
        if (s->cpl != 0) {
            gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
        } else {
T
ths 已提交
7652
            gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_CR0);
7653
            gen_helper_clts(cpu_env);
B
bellard 已提交
7654
            /* abort block because static cpu state changed */
B
bellard 已提交
7655
            gen_jmp_im(s->pc - s->cs_base);
B
bellard 已提交
7656
            gen_eob(s);
B
bellard 已提交
7657 7658
        }
        break;
B
balrog 已提交
7659
    /* MMX/3DNow!/SSE/SSE2/SSE3/SSSE3/SSE4 support */
B
bellard 已提交
7660 7661
    case 0x1c3: /* MOVNTI reg, mem */
        if (!(s->cpuid_features & CPUID_SSE2))
B
bellard 已提交
7662
            goto illegal_op;
7663
        ot = mo_64_32(dflag);
7664
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
7665 7666 7667 7668 7669
        mod = (modrm >> 6) & 3;
        if (mod == 3)
            goto illegal_op;
        reg = ((modrm >> 3) & 7) | rex_r;
        /* generate a generic store */
7670
        gen_ldst_modrm(env, s, modrm, ot, reg, 1);
B
bellard 已提交
7671
        break;
B
bellard 已提交
7672
    case 0x1ae:
7673
        modrm = cpu_ldub_code(env, s->pc++);
B
bellard 已提交
7674 7675 7676 7677
        mod = (modrm >> 6) & 3;
        op = (modrm >> 3) & 7;
        switch(op) {
        case 0: /* fxsave */
7678
            if (mod == 3 || !(s->cpuid_features & CPUID_FXSR) ||
7679
                (s->prefix & PREFIX_LOCK))
B
bellard 已提交
7680
                goto illegal_op;
7681
            if ((s->flags & HF_EM_MASK) || (s->flags & HF_TS_MASK)) {
B
bellard 已提交
7682 7683 7684
                gen_exception(s, EXCP07_PREX, pc_start - s->cs_base);
                break;
            }
7685
            gen_lea_modrm(env, s, modrm);
7686
            gen_helper_fxsave(cpu_env, cpu_A0, tcg_const_i32(dflag == MO_64));
B
bellard 已提交
7687 7688
            break;
        case 1: /* fxrstor */
7689
            if (mod == 3 || !(s->cpuid_features & CPUID_FXSR) ||
7690
                (s->prefix & PREFIX_LOCK))
B
bellard 已提交
7691
                goto illegal_op;
7692
            if ((s->flags & HF_EM_MASK) || (s->flags & HF_TS_MASK)) {
B
bellard 已提交
7693 7694 7695
                gen_exception(s, EXCP07_PREX, pc_start - s->cs_base);
                break;
            }
7696
            gen_lea_modrm(env, s, modrm);
7697
            gen_helper_fxrstor(cpu_env, cpu_A0, tcg_const_i32(dflag == MO_64));
B
bellard 已提交
7698 7699 7700 7701 7702 7703
            break;
        case 2: /* ldmxcsr */
        case 3: /* stmxcsr */
            if (s->flags & HF_TS_MASK) {
                gen_exception(s, EXCP07_PREX, pc_start - s->cs_base);
                break;
B
bellard 已提交
7704
            }
B
bellard 已提交
7705 7706
            if ((s->flags & HF_EM_MASK) || !(s->flags & HF_OSFXSR_MASK) ||
                mod == 3)
B
bellard 已提交
7707
                goto illegal_op;
7708
            gen_lea_modrm(env, s, modrm);
B
bellard 已提交
7709
            if (op == 2) {
7710 7711
                tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0,
                                    s->mem_index, MO_LEUL);
B
Blue Swirl 已提交
7712
                gen_helper_ldmxcsr(cpu_env, cpu_tmp2_i32);
B
bellard 已提交
7713
            } else {
B
bellard 已提交
7714
                tcg_gen_ld32u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State, mxcsr));
7715
                gen_op_st_v(s, MO_32, cpu_T[0], cpu_A0);
B
bellard 已提交
7716
            }
B
bellard 已提交
7717 7718
            break;
        case 5: /* lfence */
7719
            if ((modrm & 0xc7) != 0xc0 || !(s->cpuid_features & CPUID_SSE2))
B
bellard 已提交
7720 7721
                goto illegal_op;
            break;
7722 7723 7724 7725 7726 7727 7728 7729 7730 7731 7732 7733
        case 6: /* mfence/clwb */
            if (s->prefix & PREFIX_DATA) {
                /* clwb */
                if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_CLWB))
                    goto illegal_op;
                gen_nop_modrm(env, s, modrm);
            } else {
                /* mfence */
                if ((modrm & 0xc7) != 0xc0 || !(s->cpuid_features & CPUID_SSE2))
                    goto illegal_op;
            }
            break;
7734 7735 7736
        case 7: /* sfence / clflush */
            if ((modrm & 0xc7) == 0xc0) {
                /* sfence */
A
aurel32 已提交
7737
                /* XXX: also check for cpuid_ext2_features & CPUID_EXT2_EMMX */
7738 7739 7740 7741 7742 7743
                if (!(s->cpuid_features & CPUID_SSE))
                    goto illegal_op;
            } else {
                /* clflush */
                if (!(s->cpuid_features & CPUID_CLFLUSH))
                    goto illegal_op;
7744
                gen_lea_modrm(env, s, modrm);
7745 7746
            }
            break;
B
bellard 已提交
7747
        default:
B
bellard 已提交
7748 7749 7750
            goto illegal_op;
        }
        break;
A
aurel32 已提交
7751
    case 0x10d: /* 3DNow! prefetch(w) */
7752
        modrm = cpu_ldub_code(env, s->pc++);
A
aurel32 已提交
7753 7754 7755
        mod = (modrm >> 6) & 3;
        if (mod == 3)
            goto illegal_op;
7756
        gen_lea_modrm(env, s, modrm);
7757 7758
        /* ignore for now */
        break;
B
bellard 已提交
7759
    case 0x1aa: /* rsm */
B
bellard 已提交
7760
        gen_svm_check_intercept(s, pc_start, SVM_EXIT_RSM);
B
bellard 已提交
7761 7762
        if (!(s->flags & HF_SMM_MASK))
            goto illegal_op;
J
Jun Koi 已提交
7763
        gen_update_cc_op(s);
B
bellard 已提交
7764
        gen_jmp_im(s->pc - s->cs_base);
B
Blue Swirl 已提交
7765
        gen_helper_rsm(cpu_env);
B
bellard 已提交
7766 7767
        gen_eob(s);
        break;
B
balrog 已提交
7768 7769 7770 7771 7772 7773 7774
    case 0x1b8: /* SSE4.2 popcnt */
        if ((prefixes & (PREFIX_REPZ | PREFIX_LOCK | PREFIX_REPNZ)) !=
             PREFIX_REPZ)
            goto illegal_op;
        if (!(s->cpuid_ext_features & CPUID_EXT_POPCNT))
            goto illegal_op;

7775
        modrm = cpu_ldub_code(env, s->pc++);
M
malc 已提交
7776
        reg = ((modrm >> 3) & 7) | rex_r;
B
balrog 已提交
7777

7778
        if (s->prefix & PREFIX_DATA) {
7779
            ot = MO_16;
7780 7781 7782
        } else {
            ot = mo_64_32(dflag);
        }
B
balrog 已提交
7783

7784
        gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
B
Blue Swirl 已提交
7785
        gen_helper_popcnt(cpu_T[0], cpu_env, cpu_T[0], tcg_const_i32(ot));
7786
        gen_op_mov_reg_v(ot, reg, cpu_T[0]);
B
balrog 已提交
7787

7788
        set_cc_op(s, CC_OP_EFLAGS);
B
balrog 已提交
7789
        break;
A
aurel32 已提交
7790 7791 7792
    case 0x10e ... 0x10f:
        /* 3DNow! instructions, ignore prefixes */
        s->prefix &= ~(PREFIX_REPZ | PREFIX_REPNZ | PREFIX_DATA);
B
bellard 已提交
7793 7794
    case 0x110 ... 0x117:
    case 0x128 ... 0x12f:
B
balrog 已提交
7795
    case 0x138 ... 0x13a:
7796
    case 0x150 ... 0x179:
B
bellard 已提交
7797 7798 7799 7800
    case 0x17c ... 0x17f:
    case 0x1c2:
    case 0x1c4 ... 0x1c6:
    case 0x1d0 ... 0x1fe:
7801
        gen_sse(env, s, b, pc_start, rex_r);
B
bellard 已提交
7802
        break;
B
bellard 已提交
7803 7804 7805 7806 7807
    default:
        goto illegal_op;
    }
    /* lock generation */
    if (s->prefix & PREFIX_LOCK)
P
pbrook 已提交
7808
        gen_helper_unlock();
B
bellard 已提交
7809 7810
    return s->pc;
 illegal_op:
7811
    if (s->prefix & PREFIX_LOCK)
P
pbrook 已提交
7812
        gen_helper_unlock();
B
bellard 已提交
7813 7814 7815 7816 7817 7818 7819
    /* XXX: ensure that no lock was generated */
    gen_exception(s, EXCP06_ILLOP, pc_start - s->cs_base);
    return s->pc;
}

void optimize_flags_init(void)
{
7820 7821 7822 7823 7824 7825 7826 7827 7828 7829 7830 7831 7832 7833 7834 7835 7836 7837 7838 7839 7840 7841 7842 7843 7844 7845 7846 7847 7848 7849 7850
    static const char reg_names[CPU_NB_REGS][4] = {
#ifdef TARGET_X86_64
        [R_EAX] = "rax",
        [R_EBX] = "rbx",
        [R_ECX] = "rcx",
        [R_EDX] = "rdx",
        [R_ESI] = "rsi",
        [R_EDI] = "rdi",
        [R_EBP] = "rbp",
        [R_ESP] = "rsp",
        [8]  = "r8",
        [9]  = "r9",
        [10] = "r10",
        [11] = "r11",
        [12] = "r12",
        [13] = "r13",
        [14] = "r14",
        [15] = "r15",
#else
        [R_EAX] = "eax",
        [R_EBX] = "ebx",
        [R_ECX] = "ecx",
        [R_EDX] = "edx",
        [R_ESI] = "esi",
        [R_EDI] = "edi",
        [R_EBP] = "ebp",
        [R_ESP] = "esp",
#endif
    };
    int i;

P
pbrook 已提交
7851 7852
    cpu_env = tcg_global_reg_new_ptr(TCG_AREG0, "env");
    cpu_cc_op = tcg_global_mem_new_i32(TCG_AREG0,
7853 7854
                                       offsetof(CPUX86State, cc_op), "cc_op");
    cpu_cc_dst = tcg_global_mem_new(TCG_AREG0, offsetof(CPUX86State, cc_dst),
P
pbrook 已提交
7855
                                    "cc_dst");
7856 7857
    cpu_cc_src = tcg_global_mem_new(TCG_AREG0, offsetof(CPUX86State, cc_src),
                                    "cc_src");
7858 7859
    cpu_cc_src2 = tcg_global_mem_new(TCG_AREG0, offsetof(CPUX86State, cc_src2),
                                     "cc_src2");
7860

7861 7862 7863 7864 7865
    for (i = 0; i < CPU_NB_REGS; ++i) {
        cpu_regs[i] = tcg_global_mem_new(TCG_AREG0,
                                         offsetof(CPUX86State, regs[i]),
                                         reg_names[i]);
    }
K
KONRAD Frederic 已提交
7866 7867

    helper_lock_init();
B
bellard 已提交
7868 7869 7870
}

/* generate intermediate code in gen_opc_buf and gen_opparam_buf for
7871 7872
   basic block 'tb'.  */
void gen_intermediate_code(CPUX86State *env, TranslationBlock *tb)
B
bellard 已提交
7873
{
7874
    X86CPU *cpu = x86_env_get_cpu(env);
7875
    CPUState *cs = CPU(cpu);
B
bellard 已提交
7876
    DisasContext dc1, *dc = &dc1;
B
bellard 已提交
7877
    target_ulong pc_ptr;
7878
    uint64_t flags;
B
bellard 已提交
7879 7880
    target_ulong pc_start;
    target_ulong cs_base;
P
pbrook 已提交
7881 7882
    int num_insns;
    int max_insns;
7883

B
bellard 已提交
7884
    /* generate intermediate code */
B
bellard 已提交
7885 7886
    pc_start = tb->pc;
    cs_base = tb->cs_base;
B
bellard 已提交
7887
    flags = tb->flags;
B
bellard 已提交
7888

7889
    dc->pe = (flags >> HF_PE_SHIFT) & 1;
B
bellard 已提交
7890 7891 7892 7893 7894 7895 7896 7897
    dc->code32 = (flags >> HF_CS32_SHIFT) & 1;
    dc->ss32 = (flags >> HF_SS32_SHIFT) & 1;
    dc->addseg = (flags >> HF_ADDSEG_SHIFT) & 1;
    dc->f_st = 0;
    dc->vm86 = (flags >> VM_SHIFT) & 1;
    dc->cpl = (flags >> HF_CPL_SHIFT) & 3;
    dc->iopl = (flags >> IOPL_SHIFT) & 3;
    dc->tf = (flags >> TF_SHIFT) & 1;
7898
    dc->singlestep_enabled = cs->singlestep_enabled;
B
bellard 已提交
7899
    dc->cc_op = CC_OP_DYNAMIC;
7900
    dc->cc_op_dirty = false;
B
bellard 已提交
7901 7902 7903 7904 7905 7906
    dc->cs_base = cs_base;
    dc->tb = tb;
    dc->popl_esp_hack = 0;
    /* select memory access functions */
    dc->mem_index = 0;
    if (flags & HF_SOFTMMU_MASK) {
7907
	dc->mem_index = cpu_mmu_index(env, false);
B
bellard 已提交
7908
    }
7909 7910 7911 7912 7913
    dc->cpuid_features = env->features[FEAT_1_EDX];
    dc->cpuid_ext_features = env->features[FEAT_1_ECX];
    dc->cpuid_ext2_features = env->features[FEAT_8000_0001_EDX];
    dc->cpuid_ext3_features = env->features[FEAT_8000_0001_ECX];
    dc->cpuid_7_0_ebx_features = env->features[FEAT_7_0_EBX];
B
bellard 已提交
7914 7915 7916 7917
#ifdef TARGET_X86_64
    dc->lma = (flags >> HF_LMA_SHIFT) & 1;
    dc->code64 = (flags >> HF_CS64_SHIFT) & 1;
#endif
B
bellard 已提交
7918
    dc->flags = flags;
7919
    dc->jmp_opt = !(dc->tf || cs->singlestep_enabled ||
7920
                    (flags & HF_INHIBIT_IRQ_MASK)
B
bellard 已提交
7921
#ifndef CONFIG_SOFTMMU
B
bellard 已提交
7922 7923 7924
                    || (flags & HF_SOFTMMU_MASK)
#endif
                    );
7925 7926 7927 7928 7929 7930 7931 7932 7933 7934
    /* Do not optimize repz jumps at all in icount mode, because
       rep movsS instructions are execured with different paths
       in !repz_opt and repz_opt modes. The first one was used
       always except single step mode. And this setting
       disables jumps optimization and control paths become
       equivalent in run and single step modes.
       Now there will be no jump optimization for repz in
       record/replay modes and there will always be an
       additional step for ecx=0 when icount is enabled.
     */
7935
    dc->repz_opt = !dc->jmp_opt && !(tb->cflags & CF_USE_ICOUNT);
7936 7937
#if 0
    /* check addseg logic */
B
bellard 已提交
7938
    if (!dc->addseg && (dc->vm86 || !dc->pe || !dc->code32))
7939 7940 7941
        printf("ERROR addseg\n");
#endif

P
pbrook 已提交
7942 7943 7944 7945 7946 7947 7948 7949 7950 7951 7952
    cpu_T[0] = tcg_temp_new();
    cpu_T[1] = tcg_temp_new();
    cpu_A0 = tcg_temp_new();

    cpu_tmp0 = tcg_temp_new();
    cpu_tmp1_i64 = tcg_temp_new_i64();
    cpu_tmp2_i32 = tcg_temp_new_i32();
    cpu_tmp3_i32 = tcg_temp_new_i32();
    cpu_tmp4 = tcg_temp_new();
    cpu_ptr0 = tcg_temp_new_ptr();
    cpu_ptr1 = tcg_temp_new_ptr();
7953
    cpu_cc_srcT = tcg_temp_local_new();
B
bellard 已提交
7954

B
bellard 已提交
7955 7956
    dc->is_jmp = DISAS_NEXT;
    pc_ptr = pc_start;
P
pbrook 已提交
7957 7958
    num_insns = 0;
    max_insns = tb->cflags & CF_COUNT_MASK;
R
Richard Henderson 已提交
7959
    if (max_insns == 0) {
P
pbrook 已提交
7960
        max_insns = CF_COUNT_MASK;
R
Richard Henderson 已提交
7961 7962 7963 7964
    }
    if (max_insns > TCG_MAX_INSNS) {
        max_insns = TCG_MAX_INSNS;
    }
B
bellard 已提交
7965

7966
    gen_tb_start(tb);
B
bellard 已提交
7967
    for(;;) {
7968
        tcg_gen_insn_start(pc_ptr, dc->cc_op);
7969
        num_insns++;
7970

7971 7972 7973 7974 7975
        /* If RF is set, suppress an internally generated breakpoint.  */
        if (unlikely(cpu_breakpoint_test(cs, pc_ptr,
                                         tb->flags & HF_RF_MASK
                                         ? BP_GDB : BP_ANY))) {
            gen_debug(dc, pc_ptr - dc->cs_base);
7976 7977 7978 7979 7980
            /* The address covered by the breakpoint must be included in
               [tb->pc, tb->pc + tb->size) in order to for it to be
               properly cleared -- thus we increment the PC here so that
               the logic setting tb->size below does the right thing.  */
            pc_ptr += 1;
7981 7982
            goto done_generating;
        }
7983
        if (num_insns == max_insns && (tb->cflags & CF_LAST_IO)) {
P
pbrook 已提交
7984
            gen_io_start();
7985
        }
P
pbrook 已提交
7986

7987
        pc_ptr = disas_insn(env, dc, pc_ptr);
B
bellard 已提交
7988 7989 7990 7991 7992
        /* stop translation if indicated */
        if (dc->is_jmp)
            break;
        /* if single step mode, we generate only one instruction and
           generate an exception */
7993 7994 7995
        /* if irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
           the flag and abort the translation to give the irqs a
           change to be happen */
7996
        if (dc->tf || dc->singlestep_enabled ||
P
pbrook 已提交
7997
            (flags & HF_INHIBIT_IRQ_MASK)) {
B
bellard 已提交
7998
            gen_jmp_im(pc_ptr - dc->cs_base);
B
bellard 已提交
7999 8000 8001
            gen_eob(dc);
            break;
        }
8002 8003 8004 8005 8006 8007
        /* Do not cross the boundary of the pages in icount mode,
           it can cause an exception. Do it only when boundary is
           crossed by the first instruction in the block.
           If current instruction already crossed the bound - it's ok,
           because an exception hasn't stopped this code.
         */
8008
        if ((tb->cflags & CF_USE_ICOUNT)
8009 8010 8011 8012 8013 8014 8015
            && ((pc_ptr & TARGET_PAGE_MASK)
                != ((pc_ptr + TARGET_MAX_INSN_SIZE - 1) & TARGET_PAGE_MASK)
                || (pc_ptr & ~TARGET_PAGE_MASK) == 0)) {
            gen_jmp_im(pc_ptr - dc->cs_base);
            gen_eob(dc);
            break;
        }
B
bellard 已提交
8016
        /* if too long translation, stop generation too */
8017
        if (tcg_op_buf_full() ||
P
pbrook 已提交
8018 8019
            (pc_ptr - pc_start) >= (TARGET_PAGE_SIZE - 32) ||
            num_insns >= max_insns) {
B
bellard 已提交
8020
            gen_jmp_im(pc_ptr - dc->cs_base);
B
bellard 已提交
8021 8022 8023
            gen_eob(dc);
            break;
        }
8024 8025 8026 8027 8028
        if (singlestep) {
            gen_jmp_im(pc_ptr - dc->cs_base);
            gen_eob(dc);
            break;
        }
B
bellard 已提交
8029
    }
P
pbrook 已提交
8030 8031
    if (tb->cflags & CF_LAST_IO)
        gen_io_end();
8032
done_generating:
8033
    gen_tb_end(tb, num_insns);
8034

B
bellard 已提交
8035
#ifdef DEBUG_DISAS
8036
    if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)) {
B
bellard 已提交
8037
        int disas_flags;
8038 8039
        qemu_log("----------------\n");
        qemu_log("IN: %s\n", lookup_symbol(pc_start));
B
bellard 已提交
8040 8041 8042 8043 8044 8045
#ifdef TARGET_X86_64
        if (dc->code64)
            disas_flags = 2;
        else
#endif
            disas_flags = !dc->code32;
8046
        log_target_disas(cs, pc_start, pc_ptr - pc_start, disas_flags);
8047
        qemu_log("\n");
B
bellard 已提交
8048 8049 8050
    }
#endif

8051 8052
    tb->size = pc_ptr - pc_start;
    tb->icount = num_insns;
B
bellard 已提交
8053 8054
}

8055 8056
void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb,
                          target_ulong *data)
A
aurel32 已提交
8057
{
8058 8059 8060
    int cc_op = data[1];
    env->eip = data[0] - tb->cs_base;
    if (cc_op != CC_OP_DYNAMIC) {
A
aurel32 已提交
8061
        env->cc_op = cc_op;
8062
    }
A
aurel32 已提交
8063
}