target-i386/translate.c

   1 /*
   2  *  i386 translation
   3  *
   4  *  Copyright (c) 2003 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20 #include <stdarg.h>
  21 #include <stdlib.h>
  22 #include <stdio.h>
  23 #include <string.h>
  24 #include <inttypes.h>
  25 #include <signal.h>
  26 #include <assert.h>
  27
  28 #include "cpu.h"
  29 #include "exec-all.h"
  30 #include "disas.h"
  31
  32 /* XXX: move that elsewhere */
  33 static uint16_t *gen_opc_ptr;
  34 static uint32_t *gen_opparam_ptr;
  35
  36 #define PREFIX_REPZ   0x01
  37 #define PREFIX_REPNZ  0x02
  38 #define PREFIX_LOCK   0x04
  39 #define PREFIX_DATA   0x08
  40 #define PREFIX_ADR    0x10
  41
  42 #ifdef TARGET_X86_64
  43 #define X86_64_ONLY(x) x
  44 #define X86_64_DEF(x...) x
  45 #define CODE64(s) ((s)->code64)
  46 #define REX_X(s) ((s)->rex_x)
  47 #define REX_B(s) ((s)->rex_b)
  48 /* XXX: gcc generates push/pop in some opcodes, so we cannot use them */
  49 #if 1
  50 #define BUGGY_64(x) NULL
  51 #endif
  52 #else
  53 #define X86_64_ONLY(x) NULL
  54 #define X86_64_DEF(x...)
  55 #define CODE64(s) 0
  56 #define REX_X(s) 0
  57 #define REX_B(s) 0
  58 #endif
  59
  60 #ifdef TARGET_X86_64
  61 static int x86_64_hregs;
  62 #endif
  63
  64 #ifdef USE_DIRECT_JUMP
  65 #define TBPARAM(x)
  66 #else
  67 #define TBPARAM(x) (long)(x)
  68 #endif
  69
  70 typedef struct DisasContext {
  71     /* current insn context */
  72     int override; /* -1 if no override */
  73     int prefix;
  74     int aflag, dflag;
  75     target_ulong pc; /* pc = eip + cs_base */
  76     int is_jmp; /* 1 = means jump (stop translation), 2 means CPU
  77                    static state change (stop translation) */
  78     /* current block context */
  79     target_ulong cs_base; /* base of CS segment */
  80     int pe;     /* protected mode */
  81     int code32; /* 32 bit code segment */
  82 #ifdef TARGET_X86_64
  83     int lma;    /* long mode active */
  84     int code64; /* 64 bit code segment */
  85     int rex_x, rex_b;
  86 #endif
  87     int ss32;   /* 32 bit stack segment */
  88     int cc_op;  /* current CC operation */
  89     int addseg; /* non zero if either DS/ES/SS have a non zero base */
  90     int f_st;   /* currently unused */
  91     int vm86;   /* vm86 mode */
  92     int cpl;
  93     int iopl;
  94     int tf;     /* TF cpu flag */
  95     int singlestep_enabled; /* "hardware" single step enabled */
  96     int jmp_opt; /* use direct block chaining for direct jumps */
  97     int mem_index; /* select memory access functions */
  98     int flags; /* all execution flags */
  99     struct TranslationBlock *tb;
 100     int popl_esp_hack; /* for correct popl with esp base handling */
 101     int rip_offset; /* only used in x86_64, but left for simplicity */
 102     int cpuid_features;
 103 } DisasContext;
 104
 105 static void gen_eob(DisasContext *s);
 106 static void gen_jmp(DisasContext *s, target_ulong eip);
 107 static void gen_jmp_tb(DisasContext *s, target_ulong eip, int tb_num);
 108
 109 /* i386 arith/logic operations */
 110 enum {
 111     OP_ADDL,
 112     OP_ORL,
 113     OP_ADCL,
 114     OP_SBBL,
 115     OP_ANDL,
 116     OP_SUBL,
 117     OP_XORL,
 118     OP_CMPL,
 119 };
 120
 121 /* i386 shift ops */
 122 enum {
 123     OP_ROL,
 124     OP_ROR,
 125     OP_RCL,
 126     OP_RCR,
 127     OP_SHL,
 128     OP_SHR,
 129     OP_SHL1, /* undocumented */
 130     OP_SAR = 7,
 131 };
 132
 133 enum {
 134 #define DEF(s, n, copy_size) INDEX_op_ ## s,
 135 #include "opc.h"
 136 #undef DEF
 137     NB_OPS,
 138 };
 139
 140 #include "gen-op.h"
 141
 142 /* operand size */
 143 enum {
 144     OT_BYTE = 0,
 145     OT_WORD,
 146     OT_LONG,
 147     OT_QUAD,
 148 };
 149
 150 enum {
 151     /* I386 int registers */
 152     OR_EAX,   /* MUST be even numbered */
 153     OR_ECX,
 154     OR_EDX,
 155     OR_EBX,
 156     OR_ESP,
 157     OR_EBP,
 158     OR_ESI,
 159     OR_EDI,
 160
 161     OR_TMP0 = 16,    /* temporary operand register */
 162     OR_TMP1,
 163     OR_A0, /* temporary register used when doing address evaluation */
 164 };
 165
 166 #ifdef TARGET_X86_64
 167
 168 #define NB_OP_SIZES 4
 169
 170 #define DEF_REGS(prefix, suffix) \
 171   prefix ## EAX ## suffix,\
 172   prefix ## ECX ## suffix,\
 173   prefix ## EDX ## suffix,\
 174   prefix ## EBX ## suffix,\
 175   prefix ## ESP ## suffix,\
 176   prefix ## EBP ## suffix,\
 177   prefix ## ESI ## suffix,\
 178   prefix ## EDI ## suffix,\
 179   prefix ## R8 ## suffix,\
 180   prefix ## R9 ## suffix,\
 181   prefix ## R10 ## suffix,\
 182   prefix ## R11 ## suffix,\
 183   prefix ## R12 ## suffix,\
 184   prefix ## R13 ## suffix,\
 185   prefix ## R14 ## suffix,\
 186   prefix ## R15 ## suffix,
 187
 188 #define DEF_BREGS(prefixb, prefixh, suffix)             \
 189                                                         \
 190 static void prefixb ## ESP ## suffix ## _wrapper(void)  \
 191 {                                                       \
 192     if (x86_64_hregs)                                 \
 193         prefixb ## ESP ## suffix ();                    \
 194     else                                                \
 195         prefixh ## EAX ## suffix ();                    \
 196 }                                                       \
 197                                                         \
 198 static void prefixb ## EBP ## suffix ## _wrapper(void)  \
 199 {                                                       \
 200     if (x86_64_hregs)                                 \
 201         prefixb ## EBP ## suffix ();                    \
 202     else                                                \
 203         prefixh ## ECX ## suffix ();                    \
 204 }                                                       \
 205                                                         \
 206 static void prefixb ## ESI ## suffix ## _wrapper(void)  \
 207 {                                                       \
 208     if (x86_64_hregs)                                 \
 209         prefixb ## ESI ## suffix ();                    \
 210     else                                                \
 211         prefixh ## EDX ## suffix ();                    \
 212 }                                                       \
 213                                                         \
 214 static void prefixb ## EDI ## suffix ## _wrapper(void)  \
 215 {                                                       \
 216     if (x86_64_hregs)                                 \
 217         prefixb ## EDI ## suffix ();                    \
 218     else                                                \
 219         prefixh ## EBX ## suffix ();                    \
 220 }
 221
 222 DEF_BREGS(gen_op_movb_, gen_op_movh_, _T0)
 223 DEF_BREGS(gen_op_movb_, gen_op_movh_, _T1)
 224 DEF_BREGS(gen_op_movl_T0_, gen_op_movh_T0_, )
 225 DEF_BREGS(gen_op_movl_T1_, gen_op_movh_T1_, )
 226
 227 #else /* !TARGET_X86_64 */
 228
 229 #define NB_OP_SIZES 3
 230
 231 #define DEF_REGS(prefix, suffix) \
 232   prefix ## EAX ## suffix,\
 233   prefix ## ECX ## suffix,\
 234   prefix ## EDX ## suffix,\
 235   prefix ## EBX ## suffix,\
 236   prefix ## ESP ## suffix,\
 237   prefix ## EBP ## suffix,\
 238   prefix ## ESI ## suffix,\
 239   prefix ## EDI ## suffix,
 240
 241 #endif /* !TARGET_X86_64 */
 242
 243 static GenOpFunc *gen_op_mov_reg_T0[NB_OP_SIZES][CPU_NB_REGS] = {
 244     [OT_BYTE] = {
 245         gen_op_movb_EAX_T0,
 246         gen_op_movb_ECX_T0,
 247         gen_op_movb_EDX_T0,
 248         gen_op_movb_EBX_T0,
 249 #ifdef TARGET_X86_64
 250         gen_op_movb_ESP_T0_wrapper,
 251         gen_op_movb_EBP_T0_wrapper,
 252         gen_op_movb_ESI_T0_wrapper,
 253         gen_op_movb_EDI_T0_wrapper,
 254         gen_op_movb_R8_T0,
 255         gen_op_movb_R9_T0,
 256         gen_op_movb_R10_T0,
 257         gen_op_movb_R11_T0,
 258         gen_op_movb_R12_T0,
 259         gen_op_movb_R13_T0,
 260         gen_op_movb_R14_T0,
 261         gen_op_movb_R15_T0,
 262 #else
 263         gen_op_movh_EAX_T0,
 264         gen_op_movh_ECX_T0,
 265         gen_op_movh_EDX_T0,
 266         gen_op_movh_EBX_T0,
 267 #endif
 268     },
 269     [OT_WORD] = {
 270         DEF_REGS(gen_op_movw_, _T0)
 271     },
 272     [OT_LONG] = {
 273         DEF_REGS(gen_op_movl_, _T0)
 274     },
 275 #ifdef TARGET_X86_64
 276     [OT_QUAD] = {
 277         DEF_REGS(gen_op_movq_, _T0)
 278     },
 279 #endif
 280 };
 281
 282 static GenOpFunc *gen_op_mov_reg_T1[NB_OP_SIZES][CPU_NB_REGS] = {
 283     [OT_BYTE] = {
 284         gen_op_movb_EAX_T1,
 285         gen_op_movb_ECX_T1,
 286         gen_op_movb_EDX_T1,
 287         gen_op_movb_EBX_T1,
 288 #ifdef TARGET_X86_64
 289         gen_op_movb_ESP_T1_wrapper,
 290         gen_op_movb_EBP_T1_wrapper,
 291         gen_op_movb_ESI_T1_wrapper,
 292         gen_op_movb_EDI_T1_wrapper,
 293         gen_op_movb_R8_T1,
 294         gen_op_movb_R9_T1,
 295         gen_op_movb_R10_T1,
 296         gen_op_movb_R11_T1,
 297         gen_op_movb_R12_T1,
 298         gen_op_movb_R13_T1,
 299         gen_op_movb_R14_T1,
 300         gen_op_movb_R15_T1,
 301 #else
 302         gen_op_movh_EAX_T1,
 303         gen_op_movh_ECX_T1,
 304         gen_op_movh_EDX_T1,
 305         gen_op_movh_EBX_T1,
 306 #endif
 307     },
 308     [OT_WORD] = {
 309         DEF_REGS(gen_op_movw_, _T1)
 310     },
 311     [OT_LONG] = {
 312         DEF_REGS(gen_op_movl_, _T1)
 313     },
 314 #ifdef TARGET_X86_64
 315     [OT_QUAD] = {
 316         DEF_REGS(gen_op_movq_, _T1)
 317     },
 318 #endif
 319 };
 320
 321 static GenOpFunc *gen_op_mov_reg_A0[NB_OP_SIZES - 1][CPU_NB_REGS] = {
 322     [0] = {
 323         DEF_REGS(gen_op_movw_, _A0)
 324     },
 325     [1] = {
 326         DEF_REGS(gen_op_movl_, _A0)
 327     },
 328 #ifdef TARGET_X86_64
 329     [2] = {
 330         DEF_REGS(gen_op_movq_, _A0)
 331     },
 332 #endif
 333 };
 334
 335 static GenOpFunc *gen_op_mov_TN_reg[NB_OP_SIZES][2][CPU_NB_REGS] =
 336 {
 337     [OT_BYTE] = {
 338         {
 339             gen_op_movl_T0_EAX,
 340             gen_op_movl_T0_ECX,
 341             gen_op_movl_T0_EDX,
 342             gen_op_movl_T0_EBX,
 343 #ifdef TARGET_X86_64
 344             gen_op_movl_T0_ESP_wrapper,
 345             gen_op_movl_T0_EBP_wrapper,
 346             gen_op_movl_T0_ESI_wrapper,
 347             gen_op_movl_T0_EDI_wrapper,
 348             gen_op_movl_T0_R8,
 349             gen_op_movl_T0_R9,
 350             gen_op_movl_T0_R10,
 351             gen_op_movl_T0_R11,
 352             gen_op_movl_T0_R12,
 353             gen_op_movl_T0_R13,
 354             gen_op_movl_T0_R14,
 355             gen_op_movl_T0_R15,
 356 #else
 357             gen_op_movh_T0_EAX,
 358             gen_op_movh_T0_ECX,
 359             gen_op_movh_T0_EDX,
 360             gen_op_movh_T0_EBX,
 361 #endif
 362         },
 363         {
 364             gen_op_movl_T1_EAX,
 365             gen_op_movl_T1_ECX,
 366             gen_op_movl_T1_EDX,
 367             gen_op_movl_T1_EBX,
 368 #ifdef TARGET_X86_64
 369             gen_op_movl_T1_ESP_wrapper,
 370             gen_op_movl_T1_EBP_wrapper,
 371             gen_op_movl_T1_ESI_wrapper,
 372             gen_op_movl_T1_EDI_wrapper,
 373             gen_op_movl_T1_R8,
 374             gen_op_movl_T1_R9,
 375             gen_op_movl_T1_R10,
 376             gen_op_movl_T1_R11,
 377             gen_op_movl_T1_R12,
 378             gen_op_movl_T1_R13,
 379             gen_op_movl_T1_R14,
 380             gen_op_movl_T1_R15,
 381 #else
 382             gen_op_movh_T1_EAX,
 383             gen_op_movh_T1_ECX,
 384             gen_op_movh_T1_EDX,
 385             gen_op_movh_T1_EBX,
 386 #endif
 387         },
 388     },
 389     [OT_WORD] = {
 390         {
 391             DEF_REGS(gen_op_movl_T0_, )
 392         },
 393         {
 394             DEF_REGS(gen_op_movl_T1_, )
 395         },
 396     },
 397     [OT_LONG] = {
 398         {
 399             DEF_REGS(gen_op_movl_T0_, )
 400         },
 401         {
 402             DEF_REGS(gen_op_movl_T1_, )
 403         },
 404     },
 405 #ifdef TARGET_X86_64
 406     [OT_QUAD] = {
 407         {
 408             DEF_REGS(gen_op_movl_T0_, )
 409         },
 410         {
 411             DEF_REGS(gen_op_movl_T1_, )
 412         },
 413     },
 414 #endif
 415 };
 416
 417 static GenOpFunc *gen_op_movl_A0_reg[CPU_NB_REGS] = {
 418     DEF_REGS(gen_op_movl_A0_, )
 419 };
 420
 421 static GenOpFunc *gen_op_addl_A0_reg_sN[4][CPU_NB_REGS] = {
 422     [0] = {
 423         DEF_REGS(gen_op_addl_A0_, )
 424     },
 425     [1] = {
 426         DEF_REGS(gen_op_addl_A0_, _s1)
 427     },
 428     [2] = {
 429         DEF_REGS(gen_op_addl_A0_, _s2)
 430     },
 431     [3] = {
 432         DEF_REGS(gen_op_addl_A0_, _s3)
 433     },
 434 };
 435
 436 #ifdef TARGET_X86_64
 437 static GenOpFunc *gen_op_movq_A0_reg[CPU_NB_REGS] = {
 438     DEF_REGS(gen_op_movq_A0_, )
 439 };
 440
 441 static GenOpFunc *gen_op_addq_A0_reg_sN[4][CPU_NB_REGS] = {
 442     [0] = {
 443         DEF_REGS(gen_op_addq_A0_, )
 444     },
 445     [1] = {
 446         DEF_REGS(gen_op_addq_A0_, _s1)
 447     },
 448     [2] = {
 449         DEF_REGS(gen_op_addq_A0_, _s2)
 450     },
 451     [3] = {
 452         DEF_REGS(gen_op_addq_A0_, _s3)
 453     },
 454 };
 455 #endif
 456
 457 static GenOpFunc *gen_op_cmov_reg_T1_T0[NB_OP_SIZES - 1][CPU_NB_REGS] = {
 458     [0] = {
 459         DEF_REGS(gen_op_cmovw_, _T1_T0)
 460     },
 461     [1] = {
 462         DEF_REGS(gen_op_cmovl_, _T1_T0)
 463     },
 464 #ifdef TARGET_X86_64
 465     [2] = {
 466         DEF_REGS(gen_op_cmovq_, _T1_T0)
 467     },
 468 #endif
 469 };
 470
 471 static GenOpFunc *gen_op_arith_T0_T1_cc[8] = {
 472     NULL,
 473     gen_op_orl_T0_T1,
 474     NULL,
 475     NULL,
 476     gen_op_andl_T0_T1,
 477     NULL,
 478     gen_op_xorl_T0_T1,
 479     NULL,
 480 };
 481
 482 #define DEF_ARITHC(SUFFIX)\
 483     {\
 484         gen_op_adcb ## SUFFIX ## _T0_T1_cc,\
 485         gen_op_sbbb ## SUFFIX ## _T0_T1_cc,\
 486     },\
 487     {\
 488         gen_op_adcw ## SUFFIX ## _T0_T1_cc,\
 489         gen_op_sbbw ## SUFFIX ## _T0_T1_cc,\
 490     },\
 491     {\
 492         gen_op_adcl ## SUFFIX ## _T0_T1_cc,\
 493         gen_op_sbbl ## SUFFIX ## _T0_T1_cc,\
 494     },\
 495     {\
 496         X86_64_ONLY(gen_op_adcq ## SUFFIX ## _T0_T1_cc),\
 497         X86_64_ONLY(gen_op_sbbq ## SUFFIX ## _T0_T1_cc),\
 498     },
 499
 500 static GenOpFunc *gen_op_arithc_T0_T1_cc[4][2] = {
 501     DEF_ARITHC( )
 502 };
 503
 504 static GenOpFunc *gen_op_arithc_mem_T0_T1_cc[3 * 4][2] = {
 505     DEF_ARITHC(_raw)
 506 #ifndef CONFIG_USER_ONLY
 507     DEF_ARITHC(_kernel)
 508     DEF_ARITHC(_user)
 509 #endif
 510 };
 511
 512 static const int cc_op_arithb[8] = {
 513     CC_OP_ADDB,
 514     CC_OP_LOGICB,
 515     CC_OP_ADDB,
 516     CC_OP_SUBB,
 517     CC_OP_LOGICB,
 518     CC_OP_SUBB,
 519     CC_OP_LOGICB,
 520     CC_OP_SUBB,
 521 };
 522
 523 #define DEF_CMPXCHG(SUFFIX)\
 524     gen_op_cmpxchgb ## SUFFIX ## _T0_T1_EAX_cc,\
 525     gen_op_cmpxchgw ## SUFFIX ## _T0_T1_EAX_cc,\
 526     gen_op_cmpxchgl ## SUFFIX ## _T0_T1_EAX_cc,\
 527     X86_64_ONLY(gen_op_cmpxchgq ## SUFFIX ## _T0_T1_EAX_cc),
 528
 529 static GenOpFunc *gen_op_cmpxchg_T0_T1_EAX_cc[4] = {
 530     DEF_CMPXCHG( )
 531 };
 532
 533 static GenOpFunc *gen_op_cmpxchg_mem_T0_T1_EAX_cc[3 * 4] = {
 534     DEF_CMPXCHG(_raw)
 535 #ifndef CONFIG_USER_ONLY
 536     DEF_CMPXCHG(_kernel)
 537     DEF_CMPXCHG(_user)
 538 #endif
 539 };
 540
 541 #define DEF_SHIFT(SUFFIX)\
 542     {\
 543         gen_op_rolb ## SUFFIX ## _T0_T1_cc,\
 544         gen_op_rorb ## SUFFIX ## _T0_T1_cc,\
 545         gen_op_rclb ## SUFFIX ## _T0_T1_cc,\
 546         gen_op_rcrb ## SUFFIX ## _T0_T1_cc,\
 547         gen_op_shlb ## SUFFIX ## _T0_T1_cc,\
 548         gen_op_shrb ## SUFFIX ## _T0_T1_cc,\
 549         gen_op_shlb ## SUFFIX ## _T0_T1_cc,\
 550         gen_op_sarb ## SUFFIX ## _T0_T1_cc,\
 551     },\
 552     {\
 553         gen_op_rolw ## SUFFIX ## _T0_T1_cc,\
 554         gen_op_rorw ## SUFFIX ## _T0_T1_cc,\
 555         gen_op_rclw ## SUFFIX ## _T0_T1_cc,\
 556         gen_op_rcrw ## SUFFIX ## _T0_T1_cc,\
 557         gen_op_shlw ## SUFFIX ## _T0_T1_cc,\
 558         gen_op_shrw ## SUFFIX ## _T0_T1_cc,\
 559         gen_op_shlw ## SUFFIX ## _T0_T1_cc,\
 560         gen_op_sarw ## SUFFIX ## _T0_T1_cc,\
 561     },\
 562     {\
 563         gen_op_roll ## SUFFIX ## _T0_T1_cc,\
 564         gen_op_rorl ## SUFFIX ## _T0_T1_cc,\
 565         gen_op_rcll ## SUFFIX ## _T0_T1_cc,\
 566         gen_op_rcrl ## SUFFIX ## _T0_T1_cc,\
 567         gen_op_shll ## SUFFIX ## _T0_T1_cc,\
 568         gen_op_shrl ## SUFFIX ## _T0_T1_cc,\
 569         gen_op_shll ## SUFFIX ## _T0_T1_cc,\
 570         gen_op_sarl ## SUFFIX ## _T0_T1_cc,\
 571     },\
 572     {\
 573         X86_64_ONLY(gen_op_rolq ## SUFFIX ## _T0_T1_cc),\
 574         X86_64_ONLY(gen_op_rorq ## SUFFIX ## _T0_T1_cc),\
 575         X86_64_ONLY(gen_op_rclq ## SUFFIX ## _T0_T1_cc),\
 576         X86_64_ONLY(gen_op_rcrq ## SUFFIX ## _T0_T1_cc),\
 577         X86_64_ONLY(gen_op_shlq ## SUFFIX ## _T0_T1_cc),\
 578         X86_64_ONLY(gen_op_shrq ## SUFFIX ## _T0_T1_cc),\
 579         X86_64_ONLY(gen_op_shlq ## SUFFIX ## _T0_T1_cc),\
 580         X86_64_ONLY(gen_op_sarq ## SUFFIX ## _T0_T1_cc),\
 581     },
 582
 583 static GenOpFunc *gen_op_shift_T0_T1_cc[4][8] = {
 584     DEF_SHIFT( )
 585 };
 586
 587 static GenOpFunc *gen_op_shift_mem_T0_T1_cc[3 * 4][8] = {
 588     DEF_SHIFT(_raw)
 589 #ifndef CONFIG_USER_ONLY
 590     DEF_SHIFT(_kernel)
 591     DEF_SHIFT(_user)
 592 #endif
 593 };
 594
 595 #define DEF_SHIFTD(SUFFIX, op)\
 596     {\
 597         NULL,\
 598         NULL,\
 599     },\
 600     {\
 601         gen_op_shldw ## SUFFIX ## _T0_T1_ ## op ## _cc,\
 602         gen_op_shrdw ## SUFFIX ## _T0_T1_ ## op ## _cc,\
 603      },\
 604     {\
 605         gen_op_shldl ## SUFFIX ## _T0_T1_ ## op ## _cc,\
 606         gen_op_shrdl ## SUFFIX ## _T0_T1_ ## op ## _cc,\
 607     },\
 608     {\
 609 X86_64_DEF(gen_op_shldq ## SUFFIX ## _T0_T1_ ## op ## _cc,\
 610            gen_op_shrdq ## SUFFIX ## _T0_T1_ ## op ## _cc,)\
 611     },
 612
 613 static GenOpFunc1 *gen_op_shiftd_T0_T1_im_cc[4][2] = {
 614     DEF_SHIFTD(, im)
 615 };
 616
 617 static GenOpFunc *gen_op_shiftd_T0_T1_ECX_cc[4][2] = {
 618     DEF_SHIFTD(, ECX)
 619 };
 620
 621 static GenOpFunc1 *gen_op_shiftd_mem_T0_T1_im_cc[3 * 4][2] = {
 622     DEF_SHIFTD(_raw, im)
 623 #ifndef CONFIG_USER_ONLY
 624     DEF_SHIFTD(_kernel, im)
 625     DEF_SHIFTD(_user, im)
 626 #endif
 627 };
 628
 629 static GenOpFunc *gen_op_shiftd_mem_T0_T1_ECX_cc[3 * 4][2] = {
 630     DEF_SHIFTD(_raw, ECX)
 631 #ifndef CONFIG_USER_ONLY
 632     DEF_SHIFTD(_kernel, ECX)
 633     DEF_SHIFTD(_user, ECX)
 634 #endif
 635 };
 636
 637 static GenOpFunc *gen_op_btx_T0_T1_cc[3][4] = {
 638     [0] = {
 639         gen_op_btw_T0_T1_cc,
 640         gen_op_btsw_T0_T1_cc,
 641         gen_op_btrw_T0_T1_cc,
 642         gen_op_btcw_T0_T1_cc,
 643     },
 644     [1] = {
 645         gen_op_btl_T0_T1_cc,
 646         gen_op_btsl_T0_T1_cc,
 647         gen_op_btrl_T0_T1_cc,
 648         gen_op_btcl_T0_T1_cc,
 649     },
 650 #ifdef TARGET_X86_64
 651     [2] = {
 652         gen_op_btq_T0_T1_cc,
 653         gen_op_btsq_T0_T1_cc,
 654         gen_op_btrq_T0_T1_cc,
 655         gen_op_btcq_T0_T1_cc,
 656     },
 657 #endif
 658 };
 659
 660 static GenOpFunc *gen_op_add_bit_A0_T1[3] = {
 661     gen_op_add_bitw_A0_T1,
 662     gen_op_add_bitl_A0_T1,
 663     X86_64_ONLY(gen_op_add_bitq_A0_T1),
 664 };
 665
 666 static GenOpFunc *gen_op_bsx_T0_cc[3][2] = {
 667     [0] = {
 668         gen_op_bsfw_T0_cc,
 669         gen_op_bsrw_T0_cc,
 670     },
 671     [1] = {
 672         gen_op_bsfl_T0_cc,
 673         gen_op_bsrl_T0_cc,
 674     },
 675 #ifdef TARGET_X86_64
 676     [2] = {
 677         gen_op_bsfq_T0_cc,
 678         gen_op_bsrq_T0_cc,
 679     },
 680 #endif
 681 };
 682
 683 static GenOpFunc *gen_op_lds_T0_A0[3 * 4] = {
 684     gen_op_ldsb_raw_T0_A0,
 685     gen_op_ldsw_raw_T0_A0,
 686     X86_64_ONLY(gen_op_ldsl_raw_T0_A0),
 687     NULL,
 688 #ifndef CONFIG_USER_ONLY
 689     gen_op_ldsb_kernel_T0_A0,
 690     gen_op_ldsw_kernel_T0_A0,
 691     X86_64_ONLY(gen_op_ldsl_kernel_T0_A0),
 692     NULL,
 693
 694     gen_op_ldsb_user_T0_A0,
 695     gen_op_ldsw_user_T0_A0,
 696     X86_64_ONLY(gen_op_ldsl_user_T0_A0),
 697     NULL,
 698 #endif
 699 };
 700
 701 static GenOpFunc *gen_op_ldu_T0_A0[3 * 4] = {
 702     gen_op_ldub_raw_T0_A0,
 703     gen_op_lduw_raw_T0_A0,
 704     NULL,
 705     NULL,
 706
 707 #ifndef CONFIG_USER_ONLY
 708     gen_op_ldub_kernel_T0_A0,
 709     gen_op_lduw_kernel_T0_A0,
 710     NULL,
 711     NULL,
 712
 713     gen_op_ldub_user_T0_A0,
 714     gen_op_lduw_user_T0_A0,
 715     NULL,
 716     NULL,
 717 #endif
 718 };
 719
 720 /* sign does not matter, except for lidt/lgdt call (TODO: fix it) */
 721 static GenOpFunc *gen_op_ld_T0_A0[3 * 4] = {
 722     gen_op_ldub_raw_T0_A0,
 723     gen_op_lduw_raw_T0_A0,
 724     gen_op_ldl_raw_T0_A0,
 725     X86_64_ONLY(gen_op_ldq_raw_T0_A0),
 726
 727 #ifndef CONFIG_USER_ONLY
 728     gen_op_ldub_kernel_T0_A0,
 729     gen_op_lduw_kernel_T0_A0,
 730     gen_op_ldl_kernel_T0_A0,
 731     X86_64_ONLY(gen_op_ldq_kernel_T0_A0),
 732
 733     gen_op_ldub_user_T0_A0,
 734     gen_op_lduw_user_T0_A0,
 735     gen_op_ldl_user_T0_A0,
 736     X86_64_ONLY(gen_op_ldq_user_T0_A0),
 737 #endif
 738 };
 739
 740 static GenOpFunc *gen_op_ld_T1_A0[3 * 4] = {
 741     gen_op_ldub_raw_T1_A0,
 742     gen_op_lduw_raw_T1_A0,
 743     gen_op_ldl_raw_T1_A0,
 744     X86_64_ONLY(gen_op_ldq_raw_T1_A0),
 745
 746 #ifndef CONFIG_USER_ONLY
 747     gen_op_ldub_kernel_T1_A0,
 748     gen_op_lduw_kernel_T1_A0,
 749     gen_op_ldl_kernel_T1_A0,
 750     X86_64_ONLY(gen_op_ldq_kernel_T1_A0),
 751
 752     gen_op_ldub_user_T1_A0,
 753     gen_op_lduw_user_T1_A0,
 754     gen_op_ldl_user_T1_A0,
 755     X86_64_ONLY(gen_op_ldq_user_T1_A0),
 756 #endif
 757 };
 758
 759 static GenOpFunc *gen_op_st_T0_A0[3 * 4] = {
 760     gen_op_stb_raw_T0_A0,
 761     gen_op_stw_raw_T0_A0,
 762     gen_op_stl_raw_T0_A0,
 763     X86_64_ONLY(gen_op_stq_raw_T0_A0),
 764
 765 #ifndef CONFIG_USER_ONLY
 766     gen_op_stb_kernel_T0_A0,
 767     gen_op_stw_kernel_T0_A0,
 768     gen_op_stl_kernel_T0_A0,
 769     X86_64_ONLY(gen_op_stq_kernel_T0_A0),
 770
 771     gen_op_stb_user_T0_A0,
 772     gen_op_stw_user_T0_A0,
 773     gen_op_stl_user_T0_A0,
 774     X86_64_ONLY(gen_op_stq_user_T0_A0),
 775 #endif
 776 };
 777
 778 static GenOpFunc *gen_op_st_T1_A0[3 * 4] = {
 779     NULL,
 780     gen_op_stw_raw_T1_A0,
 781     gen_op_stl_raw_T1_A0,
 782     X86_64_ONLY(gen_op_stq_raw_T1_A0),
 783
 784 #ifndef CONFIG_USER_ONLY
 785     NULL,
 786     gen_op_stw_kernel_T1_A0,
 787     gen_op_stl_kernel_T1_A0,
 788     X86_64_ONLY(gen_op_stq_kernel_T1_A0),
 789
 790     NULL,
 791     gen_op_stw_user_T1_A0,
 792     gen_op_stl_user_T1_A0,
 793     X86_64_ONLY(gen_op_stq_user_T1_A0),
 794 #endif
 795 };
 796
 797 static inline void gen_jmp_im(target_ulong pc)
 798 {
 799 #ifdef TARGET_X86_64
 800     if (pc == (uint32_t)pc) {
 801         gen_op_movl_eip_im(pc);
 802     } else if (pc == (int32_t)pc) {
 803         gen_op_movq_eip_im(pc);
 804     } else {
 805         gen_op_movq_eip_im64(pc >> 32, pc);
 806     }
 807 #else
 808     gen_op_movl_eip_im(pc);
 809 #endif
 810 }
 811
 812 static inline void gen_string_movl_A0_ESI(DisasContext *s)
 813 {
 814     int override;
 815
 816     override = s->override;
 817 #ifdef TARGET_X86_64
 818     if (s->aflag == 2) {
 819         if (override >= 0) {
 820             gen_op_movq_A0_seg(offsetof(CPUX86State,segs[override].base));
 821             gen_op_addq_A0_reg_sN[0][R_ESI]();
 822         } else {
 823             gen_op_movq_A0_reg[R_ESI]();
 824         }
 825     } else
 826 #endif
 827     if (s->aflag) {
 828         /* 32 bit address */
 829         if (s->addseg && override < 0)
 830             override = R_DS;
 831         if (override >= 0) {
 832             gen_op_movl_A0_seg(offsetof(CPUX86State,segs[override].base));
 833             gen_op_addl_A0_reg_sN[0][R_ESI]();
 834         } else {
 835             gen_op_movl_A0_reg[R_ESI]();
 836         }
 837     } else {
 838         /* 16 address, always override */
 839         if (override < 0)
 840             override = R_DS;
 841         gen_op_movl_A0_reg[R_ESI]();
 842         gen_op_andl_A0_ffff();
 843         gen_op_addl_A0_seg(offsetof(CPUX86State,segs[override].base));
 844     }
 845 }
 846
 847 static inline void gen_string_movl_A0_EDI(DisasContext *s)
 848 {
 849 #ifdef TARGET_X86_64
 850     if (s->aflag == 2) {
 851         gen_op_movq_A0_reg[R_EDI]();
 852     } else
 853 #endif
 854     if (s->aflag) {
 855         if (s->addseg) {
 856             gen_op_movl_A0_seg(offsetof(CPUX86State,segs[R_ES].base));
 857             gen_op_addl_A0_reg_sN[0][R_EDI]();
 858         } else {
 859             gen_op_movl_A0_reg[R_EDI]();
 860         }
 861     } else {
 862         gen_op_movl_A0_reg[R_EDI]();
 863         gen_op_andl_A0_ffff();
 864         gen_op_addl_A0_seg(offsetof(CPUX86State,segs[R_ES].base));
 865     }
 866 }
 867
 868 static GenOpFunc *gen_op_movl_T0_Dshift[4] = {
 869     gen_op_movl_T0_Dshiftb,
 870     gen_op_movl_T0_Dshiftw,
 871     gen_op_movl_T0_Dshiftl,
 872     X86_64_ONLY(gen_op_movl_T0_Dshiftq),
 873 };
 874
 875 static GenOpFunc1 *gen_op_jnz_ecx[3] = {
 876     gen_op_jnz_ecxw,
 877     gen_op_jnz_ecxl,
 878     X86_64_ONLY(gen_op_jnz_ecxq),
 879 };
 880
 881 static GenOpFunc1 *gen_op_jz_ecx[3] = {
 882     gen_op_jz_ecxw,
 883     gen_op_jz_ecxl,
 884     X86_64_ONLY(gen_op_jz_ecxq),
 885 };
 886
 887 static GenOpFunc *gen_op_dec_ECX[3] = {
 888     gen_op_decw_ECX,
 889     gen_op_decl_ECX,
 890     X86_64_ONLY(gen_op_decq_ECX),
 891 };
 892
 893 static GenOpFunc1 *gen_op_string_jnz_sub[2][4] = {
 894     {
 895         gen_op_jnz_subb,
 896         gen_op_jnz_subw,
 897         gen_op_jnz_subl,
 898         X86_64_ONLY(gen_op_jnz_subq),
 899     },
 900     {
 901         gen_op_jz_subb,
 902         gen_op_jz_subw,
 903         gen_op_jz_subl,
 904         X86_64_ONLY(gen_op_jz_subq),
 905     },
 906 };
 907
 908 static GenOpFunc *gen_op_in_DX_T0[3] = {
 909     gen_op_inb_DX_T0,
 910     gen_op_inw_DX_T0,
 911     gen_op_inl_DX_T0,
 912 };
 913
 914 static GenOpFunc *gen_op_out_DX_T0[3] = {
 915     gen_op_outb_DX_T0,
 916     gen_op_outw_DX_T0,
 917     gen_op_outl_DX_T0,
 918 };
 919
 920 static GenOpFunc *gen_op_in[3] = {
 921     gen_op_inb_T0_T1,
 922     gen_op_inw_T0_T1,
 923     gen_op_inl_T0_T1,
 924 };
 925
 926 static GenOpFunc *gen_op_out[3] = {
 927     gen_op_outb_T0_T1,
 928     gen_op_outw_T0_T1,
 929     gen_op_outl_T0_T1,
 930 };
 931
 932 static GenOpFunc *gen_check_io_T0[3] = {
 933     gen_op_check_iob_T0,
 934     gen_op_check_iow_T0,
 935     gen_op_check_iol_T0,
 936 };
 937
 938 static GenOpFunc *gen_check_io_DX[3] = {
 939     gen_op_check_iob_DX,
 940     gen_op_check_iow_DX,
 941     gen_op_check_iol_DX,
 942 };
 943
 944 static void gen_check_io(DisasContext *s, int ot, int use_dx, target_ulong cur_eip)
 945 {
 946     if (s->pe && (s->cpl > s->iopl || s->vm86)) {
 947         if (s->cc_op != CC_OP_DYNAMIC)
 948             gen_op_set_cc_op(s->cc_op);
 949         gen_jmp_im(cur_eip);
 950         if (use_dx)
 951             gen_check_io_DX[ot]();
 952         else
 953             gen_check_io_T0[ot]();
 954     }
 955 }
 956
 957 static inline void gen_movs(DisasContext *s, int ot)
 958 {
 959     gen_string_movl_A0_ESI(s);
 960     gen_op_ld_T0_A0[ot + s->mem_index]();
 961     gen_string_movl_A0_EDI(s);
 962     gen_op_st_T0_A0[ot + s->mem_index]();
 963     gen_op_movl_T0_Dshift[ot]();
 964 #ifdef TARGET_X86_64
 965     if (s->aflag == 2) {
 966         gen_op_addq_ESI_T0();
 967         gen_op_addq_EDI_T0();
 968     } else
 969 #endif
 970     if (s->aflag) {
 971         gen_op_addl_ESI_T0();
 972         gen_op_addl_EDI_T0();
 973     } else {
 974         gen_op_addw_ESI_T0();
 975         gen_op_addw_EDI_T0();
 976     }
 977 }
 978
 979 static inline void gen_update_cc_op(DisasContext *s)
 980 {
 981     if (s->cc_op != CC_OP_DYNAMIC) {
 982         gen_op_set_cc_op(s->cc_op);
 983         s->cc_op = CC_OP_DYNAMIC;
 984     }
 985 }
 986
 987 /* XXX: does not work with gdbstub "ice" single step - not a
 988    serious problem */
 989 static int gen_jz_ecx_string(DisasContext *s, target_ulong next_eip)
 990 {
 991     int l1, l2;
 992
 993     l1 = gen_new_label();
 994     l2 = gen_new_label();
 995     gen_op_jnz_ecx[s->aflag](l1);
 996     gen_set_label(l2);
 997     gen_jmp_tb(s, next_eip, 1);
 998     gen_set_label(l1);
 999     return l2;
1000 }
1001
1002 static inline void gen_stos(DisasContext *s, int ot)
1003 {
1004     gen_op_mov_TN_reg[OT_LONG][0][R_EAX]();
1005     gen_string_movl_A0_EDI(s);
1006     gen_op_st_T0_A0[ot + s->mem_index]();
1007     gen_op_movl_T0_Dshift[ot]();
1008 #ifdef TARGET_X86_64
1009     if (s->aflag == 2) {
1010         gen_op_addq_EDI_T0();
1011     } else
1012 #endif
1013     if (s->aflag) {
1014         gen_op_addl_EDI_T0();
1015     } else {
1016         gen_op_addw_EDI_T0();
1017     }
1018 }
1019
1020 static inline void gen_lods(DisasContext *s, int ot)
1021 {
1022     gen_string_movl_A0_ESI(s);
1023     gen_op_ld_T0_A0[ot + s->mem_index]();
1024     gen_op_mov_reg_T0[ot][R_EAX]();
1025     gen_op_movl_T0_Dshift[ot]();
1026 #ifdef TARGET_X86_64
1027     if (s->aflag == 2) {
1028         gen_op_addq_ESI_T0();
1029     } else
1030 #endif
1031     if (s->aflag) {
1032         gen_op_addl_ESI_T0();
1033     } else {
1034         gen_op_addw_ESI_T0();
1035     }
1036 }
1037
1038 static inline void gen_scas(DisasContext *s, int ot)
1039 {
1040     gen_op_mov_TN_reg[OT_LONG][0][R_EAX]();
1041     gen_string_movl_A0_EDI(s);
1042     gen_op_ld_T1_A0[ot + s->mem_index]();
1043     gen_op_cmpl_T0_T1_cc();
1044     gen_op_movl_T0_Dshift[ot]();
1045 #ifdef TARGET_X86_64
1046     if (s->aflag == 2) {
1047         gen_op_addq_EDI_T0();
1048     } else
1049 #endif
1050     if (s->aflag) {
1051         gen_op_addl_EDI_T0();
1052     } else {
1053         gen_op_addw_EDI_T0();
1054     }
1055 }
1056
1057 static inline void gen_cmps(DisasContext *s, int ot)
1058 {
1059     gen_string_movl_A0_ESI(s);
1060     gen_op_ld_T0_A0[ot + s->mem_index]();
1061     gen_string_movl_A0_EDI(s);
1062     gen_op_ld_T1_A0[ot + s->mem_index]();
1063     gen_op_cmpl_T0_T1_cc();
1064     gen_op_movl_T0_Dshift[ot]();
1065 #ifdef TARGET_X86_64
1066     if (s->aflag == 2) {
1067         gen_op_addq_ESI_T0();
1068         gen_op_addq_EDI_T0();
1069     } else
1070 #endif
1071     if (s->aflag) {
1072         gen_op_addl_ESI_T0();
1073         gen_op_addl_EDI_T0();
1074     } else {
1075         gen_op_addw_ESI_T0();
1076         gen_op_addw_EDI_T0();
1077     }
1078 }
1079
1080 static inline void gen_ins(DisasContext *s, int ot)
1081 {
1082     gen_string_movl_A0_EDI(s);
1083     gen_op_movl_T0_0();
1084     gen_op_st_T0_A0[ot + s->mem_index]();
1085     gen_op_in_DX_T0[ot]();
1086     gen_op_st_T0_A0[ot + s->mem_index]();
1087     gen_op_movl_T0_Dshift[ot]();
1088 #ifdef TARGET_X86_64
1089     if (s->aflag == 2) {
1090         gen_op_addq_EDI_T0();
1091     } else
1092 #endif
1093     if (s->aflag) {
1094         gen_op_addl_EDI_T0();
1095     } else {
1096         gen_op_addw_EDI_T0();
1097     }
1098 }
1099
1100 static inline void gen_outs(DisasContext *s, int ot)
1101 {
1102     gen_string_movl_A0_ESI(s);
1103     gen_op_ld_T0_A0[ot + s->mem_index]();
1104     gen_op_out_DX_T0[ot]();
1105     gen_op_movl_T0_Dshift[ot]();
1106 #ifdef TARGET_X86_64
1107     if (s->aflag == 2) {
1108         gen_op_addq_ESI_T0();
1109     } else
1110 #endif
1111     if (s->aflag) {
1112         gen_op_addl_ESI_T0();
1113     } else {
1114         gen_op_addw_ESI_T0();
1115     }
1116 }
1117
1118 /* same method as Valgrind : we generate jumps to current or next
1119    instruction */
1120 #define GEN_REPZ(op)                                                          \
1121 static inline void gen_repz_ ## op(DisasContext *s, int ot,                   \
1122                                  target_ulong cur_eip, target_ulong next_eip) \
1123 {                                                                             \
1124     int l2;\
1125     gen_update_cc_op(s);                                                      \
1126     l2 = gen_jz_ecx_string(s, next_eip);                                      \
1127     gen_ ## op(s, ot);                                                        \
1128     gen_op_dec_ECX[s->aflag]();                                               \
1129     /* a loop would cause two single step exceptions if ECX = 1               \
1130        before rep string_insn */                                              \
1131     if (!s->jmp_opt)                                                          \
1132         gen_op_jz_ecx[s->aflag](l2);                                          \
1133     gen_jmp(s, cur_eip);                                                      \
1134 }
1135
1136 #define GEN_REPZ2(op)                                                         \
1137 static inline void gen_repz_ ## op(DisasContext *s, int ot,                   \
1138                                    target_ulong cur_eip,                      \
1139                                    target_ulong next_eip,                     \
1140                                    int nz)                                    \
1141 {                                                                             \
1142     int l2;\
1143     gen_update_cc_op(s);                                                      \
1144     l2 = gen_jz_ecx_string(s, next_eip);                                      \
1145     gen_ ## op(s, ot);                                                        \
1146     gen_op_dec_ECX[s->aflag]();                                               \
1147     gen_op_set_cc_op(CC_OP_SUBB + ot);                                        \
1148     gen_op_string_jnz_sub[nz][ot](l2);\
1149     if (!s->jmp_opt)                                                          \
1150         gen_op_jz_ecx[s->aflag](l2);                                          \
1151     gen_jmp(s, cur_eip);                                                      \
1152 }
1153
1154 GEN_REPZ(movs)
1155 GEN_REPZ(stos)
1156 GEN_REPZ(lods)
1157 GEN_REPZ(ins)
1158 GEN_REPZ(outs)
1159 GEN_REPZ2(scas)
1160 GEN_REPZ2(cmps)
1161
1162 enum {
1163     JCC_O,
1164     JCC_B,
1165     JCC_Z,
1166     JCC_BE,
1167     JCC_S,
1168     JCC_P,
1169     JCC_L,
1170     JCC_LE,
1171 };
1172
1173 static GenOpFunc1 *gen_jcc_sub[4][8] = {
1174     [OT_BYTE] = {
1175         NULL,
1176         gen_op_jb_subb,
1177         gen_op_jz_subb,
1178         gen_op_jbe_subb,
1179         gen_op_js_subb,
1180         NULL,
1181         gen_op_jl_subb,
1182         gen_op_jle_subb,
1183     },
1184     [OT_WORD] = {
1185         NULL,
1186         gen_op_jb_subw,
1187         gen_op_jz_subw,
1188         gen_op_jbe_subw,
1189         gen_op_js_subw,
1190         NULL,
1191         gen_op_jl_subw,
1192         gen_op_jle_subw,
1193     },
1194     [OT_LONG] = {
1195         NULL,
1196         gen_op_jb_subl,
1197         gen_op_jz_subl,
1198         gen_op_jbe_subl,
1199         gen_op_js_subl,
1200         NULL,
1201         gen_op_jl_subl,
1202         gen_op_jle_subl,
1203     },
1204 #ifdef TARGET_X86_64
1205     [OT_QUAD] = {
1206         NULL,
1207         BUGGY_64(gen_op_jb_subq),
1208         gen_op_jz_subq,
1209         BUGGY_64(gen_op_jbe_subq),
1210         gen_op_js_subq,
1211         NULL,
1212         BUGGY_64(gen_op_jl_subq),
1213         BUGGY_64(gen_op_jle_subq),
1214     },
1215 #endif
1216 };
1217 static GenOpFunc1 *gen_op_loop[3][4] = {
1218     [0] = {
1219         gen_op_loopnzw,
1220         gen_op_loopzw,
1221         gen_op_jnz_ecxw,
1222     },
1223     [1] = {
1224         gen_op_loopnzl,
1225         gen_op_loopzl,
1226         gen_op_jnz_ecxl,
1227     },
1228 #ifdef TARGET_X86_64
1229     [2] = {
1230         gen_op_loopnzq,
1231         gen_op_loopzq,
1232         gen_op_jnz_ecxq,
1233     },
1234 #endif
1235 };
1236
1237 static GenOpFunc *gen_setcc_slow[8] = {
1238     gen_op_seto_T0_cc,
1239     gen_op_setb_T0_cc,
1240     gen_op_setz_T0_cc,
1241     gen_op_setbe_T0_cc,
1242     gen_op_sets_T0_cc,
1243     gen_op_setp_T0_cc,
1244     gen_op_setl_T0_cc,
1245     gen_op_setle_T0_cc,
1246 };
1247
1248 static GenOpFunc *gen_setcc_sub[4][8] = {
1249     [OT_BYTE] = {
1250         NULL,
1251         gen_op_setb_T0_subb,
1252         gen_op_setz_T0_subb,
1253         gen_op_setbe_T0_subb,
1254         gen_op_sets_T0_subb,
1255         NULL,
1256         gen_op_setl_T0_subb,
1257         gen_op_setle_T0_subb,
1258     },
1259     [OT_WORD] = {
1260         NULL,
1261         gen_op_setb_T0_subw,
1262         gen_op_setz_T0_subw,
1263         gen_op_setbe_T0_subw,
1264         gen_op_sets_T0_subw,
1265         NULL,
1266         gen_op_setl_T0_subw,
1267         gen_op_setle_T0_subw,
1268     },
1269     [OT_LONG] = {
1270         NULL,
1271         gen_op_setb_T0_subl,
1272         gen_op_setz_T0_subl,
1273         gen_op_setbe_T0_subl,
1274         gen_op_sets_T0_subl,
1275         NULL,
1276         gen_op_setl_T0_subl,
1277         gen_op_setle_T0_subl,
1278     },
1279 #ifdef TARGET_X86_64
1280     [OT_QUAD] = {
1281         NULL,
1282         gen_op_setb_T0_subq,
1283         gen_op_setz_T0_subq,
1284         gen_op_setbe_T0_subq,
1285         gen_op_sets_T0_subq,
1286         NULL,
1287         gen_op_setl_T0_subq,
1288         gen_op_setle_T0_subq,
1289     },
1290 #endif
1291 };
1292
1293 static GenOpFunc *gen_op_fp_arith_ST0_FT0[8] = {
1294     gen_op_fadd_ST0_FT0,
1295     gen_op_fmul_ST0_FT0,
1296     gen_op_fcom_ST0_FT0,
1297     gen_op_fcom_ST0_FT0,
1298     gen_op_fsub_ST0_FT0,
1299     gen_op_fsubr_ST0_FT0,
1300     gen_op_fdiv_ST0_FT0,
1301     gen_op_fdivr_ST0_FT0,
1302 };
1303
1304 /* NOTE the exception in "r" op ordering */
1305 static GenOpFunc1 *gen_op_fp_arith_STN_ST0[8] = {
1306     gen_op_fadd_STN_ST0,
1307     gen_op_fmul_STN_ST0,
1308     NULL,
1309     NULL,
1310     gen_op_fsubr_STN_ST0,
1311     gen_op_fsub_STN_ST0,
1312     gen_op_fdivr_STN_ST0,
1313     gen_op_fdiv_STN_ST0,
1314 };
1315
1316 /* if d == OR_TMP0, it means memory operand (address in A0) */
1317 static void gen_op(DisasContext *s1, int op, int ot, int d)
1318 {
1319     GenOpFunc *gen_update_cc;
1320
1321     if (d != OR_TMP0) {
1322         gen_op_mov_TN_reg[ot][0][d]();
1323     } else {
1324         gen_op_ld_T0_A0[ot + s1->mem_index]();
1325     }
1326     switch(op) {
1327     case OP_ADCL:
1328     case OP_SBBL:
1329         if (s1->cc_op != CC_OP_DYNAMIC)
1330             gen_op_set_cc_op(s1->cc_op);
1331         if (d != OR_TMP0) {
1332             gen_op_arithc_T0_T1_cc[ot][op - OP_ADCL]();
1333             gen_op_mov_reg_T0[ot][d]();
1334         } else {
1335             gen_op_arithc_mem_T0_T1_cc[ot + s1->mem_index][op - OP_ADCL]();
1336         }
1337         s1->cc_op = CC_OP_DYNAMIC;
1338         goto the_end;
1339     case OP_ADDL:
1340         gen_op_addl_T0_T1();
1341         s1->cc_op = CC_OP_ADDB + ot;
1342         gen_update_cc = gen_op_update2_cc;
1343         break;
1344     case OP_SUBL:
1345         gen_op_subl_T0_T1();
1346         s1->cc_op = CC_OP_SUBB + ot;
1347         gen_update_cc = gen_op_update2_cc;
1348         break;
1349     default:
1350     case OP_ANDL:
1351     case OP_ORL:
1352     case OP_XORL:
1353         gen_op_arith_T0_T1_cc[op]();
1354         s1->cc_op = CC_OP_LOGICB + ot;
1355         gen_update_cc = gen_op_update1_cc;
1356         break;
1357     case OP_CMPL:
1358         gen_op_cmpl_T0_T1_cc();
1359         s1->cc_op = CC_OP_SUBB + ot;
1360         gen_update_cc = NULL;
1361         break;
1362     }
1363     if (op != OP_CMPL) {
1364         if (d != OR_TMP0)
1365             gen_op_mov_reg_T0[ot][d]();
1366         else
1367             gen_op_st_T0_A0[ot + s1->mem_index]();
1368     }
1369     /* the flags update must happen after the memory write (precise
1370        exception support) */
1371     if (gen_update_cc)
1372         gen_update_cc();
1373  the_end: ;
1374 }
1375
1376 /* if d == OR_TMP0, it means memory operand (address in A0) */
1377 static void gen_inc(DisasContext *s1, int ot, int d, int c)
1378 {
1379     if (d != OR_TMP0)
1380         gen_op_mov_TN_reg[ot][0][d]();
1381     else
1382         gen_op_ld_T0_A0[ot + s1->mem_index]();
1383     if (s1->cc_op != CC_OP_DYNAMIC)
1384         gen_op_set_cc_op(s1->cc_op);
1385     if (c > 0) {
1386         gen_op_incl_T0();
1387         s1->cc_op = CC_OP_INCB + ot;
1388     } else {
1389         gen_op_decl_T0();
1390         s1->cc_op = CC_OP_DECB + ot;
1391     }
1392     if (d != OR_TMP0)
1393         gen_op_mov_reg_T0[ot][d]();
1394     else
1395         gen_op_st_T0_A0[ot + s1->mem_index]();
1396     gen_op_update_inc_cc();
1397 }
1398
1399 static void gen_shift(DisasContext *s1, int op, int ot, int d, int s)
1400 {
1401     if (d != OR_TMP0)
1402         gen_op_mov_TN_reg[ot][0][d]();
1403     else
1404         gen_op_ld_T0_A0[ot + s1->mem_index]();
1405     if (s != OR_TMP1)
1406         gen_op_mov_TN_reg[ot][1][s]();
1407     /* for zero counts, flags are not updated, so must do it dynamically */
1408     if (s1->cc_op != CC_OP_DYNAMIC)
1409         gen_op_set_cc_op(s1->cc_op);
1410
1411     if (d != OR_TMP0)
1412         gen_op_shift_T0_T1_cc[ot][op]();
1413     else
1414         gen_op_shift_mem_T0_T1_cc[ot + s1->mem_index][op]();
1415     if (d != OR_TMP0)
1416         gen_op_mov_reg_T0[ot][d]();
1417     s1->cc_op = CC_OP_DYNAMIC; /* cannot predict flags after */
1418 }
1419
1420 static void gen_shifti(DisasContext *s1, int op, int ot, int d, int c)
1421 {
1422     /* currently not optimized */
1423     gen_op_movl_T1_im(c);
1424     gen_shift(s1, op, ot, d, OR_TMP1);
1425 }
1426
1427 static void gen_lea_modrm(DisasContext *s, int modrm, int *reg_ptr, int *offset_ptr)
1428 {
1429     target_long disp;
1430     int havesib;
1431     int base;
1432     int index;
1433     int scale;
1434     int opreg;
1435     int mod, rm, code, override, must_add_seg;
1436
1437     override = s->override;
1438     must_add_seg = s->addseg;
1439     if (override >= 0)
1440         must_add_seg = 1;
1441     mod = (modrm >> 6) & 3;
1442     rm = modrm & 7;
1443
1444     if (s->aflag) {
1445
1446         havesib = 0;
1447         base = rm;
1448         index = 0;
1449         scale = 0;
1450
1451         if (base == 4) {
1452             havesib = 1;
1453             code = ldub_code(s->pc++);
1454             scale = (code >> 6) & 3;
1455             index = ((code >> 3) & 7) | REX_X(s);
1456             base = (code & 7);
1457         }
1458         base |= REX_B(s);
1459
1460         switch (mod) {
1461         case 0:
1462             if ((base & 7) == 5) {
1463                 base = -1;
1464                 disp = (int32_t)ldl_code(s->pc);
1465                 s->pc += 4;
1466                 if (CODE64(s) && !havesib) {
1467                     disp += s->pc + s->rip_offset;
1468                 }
1469             } else {
1470                 disp = 0;
1471             }
1472             break;
1473         case 1:
1474             disp = (int8_t)ldub_code(s->pc++);
1475             break;
1476         default:
1477         case 2:
1478             disp = ldl_code(s->pc);
1479             s->pc += 4;
1480             break;
1481         }
1482
1483         if (base >= 0) {
1484             /* for correct popl handling with esp */
1485             if (base == 4 && s->popl_esp_hack)
1486                 disp += s->popl_esp_hack;
1487 #ifdef TARGET_X86_64
1488             if (s->aflag == 2) {
1489                 gen_op_movq_A0_reg[base]();
1490                 if (disp != 0) {
1491                     if ((int32_t)disp == disp)
1492                         gen_op_addq_A0_im(disp);
1493                     else
1494                         gen_op_addq_A0_im64(disp >> 32, disp);
1495                 }
1496             } else
1497 #endif
1498             {
1499                 gen_op_movl_A0_reg[base]();
1500                 if (disp != 0)
1501                     gen_op_addl_A0_im(disp);
1502             }
1503         } else {
1504 #ifdef TARGET_X86_64
1505             if (s->aflag == 2) {
1506                 if ((int32_t)disp == disp)
1507                     gen_op_movq_A0_im(disp);
1508                 else
1509                     gen_op_movq_A0_im64(disp >> 32, disp);
1510             } else
1511 #endif
1512             {
1513                 gen_op_movl_A0_im(disp);
1514             }
1515         }
1516         /* XXX: index == 4 is always invalid */
1517         if (havesib && (index != 4 || scale != 0)) {
1518 #ifdef TARGET_X86_64
1519             if (s->aflag == 2) {
1520                 gen_op_addq_A0_reg_sN[scale][index]();
1521             } else
1522 #endif
1523             {
1524                 gen_op_addl_A0_reg_sN[scale][index]();
1525             }
1526         }
1527         if (must_add_seg) {
1528             if (override < 0) {
1529                 if (base == R_EBP || base == R_ESP)
1530                     override = R_SS;
1531                 else
1532                     override = R_DS;
1533             }
1534 #ifdef TARGET_X86_64
1535             if (s->aflag == 2) {
1536                 gen_op_addq_A0_seg(offsetof(CPUX86State,segs[override].base));
1537             } else
1538 #endif
1539             {
1540                 gen_op_addl_A0_seg(offsetof(CPUX86State,segs[override].base));
1541             }
1542         }
1543     } else {
1544         switch (mod) {
1545         case 0:
1546             if (rm == 6) {
1547                 disp = lduw_code(s->pc);
1548                 s->pc += 2;
1549                 gen_op_movl_A0_im(disp);
1550                 rm = 0; /* avoid SS override */
1551                 goto no_rm;
1552             } else {
1553                 disp = 0;
1554             }
1555             break;
1556         case 1:
1557             disp = (int8_t)ldub_code(s->pc++);
1558             break;
1559         default:
1560         case 2:
1561             disp = lduw_code(s->pc);
1562             s->pc += 2;
1563             break;
1564         }
1565         switch(rm) {
1566         case 0:
1567             gen_op_movl_A0_reg[R_EBX]();
1568             gen_op_addl_A0_reg_sN[0][R_ESI]();
1569             break;
1570         case 1:
1571             gen_op_movl_A0_reg[R_EBX]();
1572             gen_op_addl_A0_reg_sN[0][R_EDI]();
1573             break;
1574         case 2:
1575             gen_op_movl_A0_reg[R_EBP]();
1576             gen_op_addl_A0_reg_sN[0][R_ESI]();
1577             break;
1578         case 3:
1579             gen_op_movl_A0_reg[R_EBP]();
1580             gen_op_addl_A0_reg_sN[0][R_EDI]();
1581             break;
1582         case 4:
1583             gen_op_movl_A0_reg[R_ESI]();
1584             break;
1585         case 5:
1586             gen_op_movl_A0_reg[R_EDI]();
1587             break;
1588         case 6:
1589             gen_op_movl_A0_reg[R_EBP]();
1590             break;
1591         default:
1592         case 7:
1593             gen_op_movl_A0_reg[R_EBX]();
1594             break;
1595         }
1596         if (disp != 0)
1597             gen_op_addl_A0_im(disp);
1598         gen_op_andl_A0_ffff();
1599     no_rm:
1600         if (must_add_seg) {
1601             if (override < 0) {
1602                 if (rm == 2 || rm == 3 || rm == 6)
1603                     override = R_SS;
1604                 else
1605                     override = R_DS;
1606             }
1607             gen_op_addl_A0_seg(offsetof(CPUX86State,segs[override].base));
1608         }
1609     }
1610
1611     opreg = OR_A0;
1612     disp = 0;
1613     *reg_ptr = opreg;
1614     *offset_ptr = disp;
1615 }
1616
1617 /* used for LEA and MOV AX, mem */
1618 static void gen_add_A0_ds_seg(DisasContext *s)
1619 {
1620     int override, must_add_seg;
1621     must_add_seg = s->addseg;
1622     override = R_DS;
1623     if (s->override >= 0) {
1624         override = s->override;
1625         must_add_seg = 1;
1626     } else {
1627         override = R_DS;
1628     }
1629     if (must_add_seg) {
1630 #ifdef TARGET_X86_64
1631         if (CODE64(s)) {
1632             gen_op_addq_A0_seg(offsetof(CPUX86State,segs[override].base));
1633         } else
1634 #endif
1635         {
1636             gen_op_addl_A0_seg(offsetof(CPUX86State,segs[override].base));
1637         }
1638     }
1639 }
1640
1641 /* generate modrm memory load or store of 'reg'. TMP0 is used if reg !=
1642    OR_TMP0 */
1643 static void gen_ldst_modrm(DisasContext *s, int modrm, int ot, int reg, int is_store)
1644 {
1645     int mod, rm, opreg, disp;
1646
1647     mod = (modrm >> 6) & 3;
1648     rm = (modrm & 7) | REX_B(s);
1649     if (mod == 3) {
1650         if (is_store) {
1651             if (reg != OR_TMP0)
1652                 gen_op_mov_TN_reg[ot][0][reg]();
1653             gen_op_mov_reg_T0[ot][rm]();
1654         } else {
1655             gen_op_mov_TN_reg[ot][0][rm]();
1656             if (reg != OR_TMP0)
1657                 gen_op_mov_reg_T0[ot][reg]();
1658         }
1659     } else {
1660         gen_lea_modrm(s, modrm, &opreg, &disp);
1661         if (is_store) {
1662             if (reg != OR_TMP0)
1663                 gen_op_mov_TN_reg[ot][0][reg]();
1664             gen_op_st_T0_A0[ot + s->mem_index]();
1665         } else {
1666             gen_op_ld_T0_A0[ot + s->mem_index]();
1667             if (reg != OR_TMP0)
1668                 gen_op_mov_reg_T0[ot][reg]();
1669         }
1670     }
1671 }
1672
1673 static inline uint32_t insn_get(DisasContext *s, int ot)
1674 {
1675     uint32_t ret;
1676
1677     switch(ot) {
1678     case OT_BYTE:
1679         ret = ldub_code(s->pc);
1680         s->pc++;
1681         break;
1682     case OT_WORD:
1683         ret = lduw_code(s->pc);
1684         s->pc += 2;
1685         break;
1686     default:
1687     case OT_LONG:
1688         ret = ldl_code(s->pc);
1689         s->pc += 4;
1690         break;
1691     }
1692     return ret;
1693 }
1694
1695 static inline int insn_const_size(unsigned int ot)
1696 {
1697     if (ot <= OT_LONG)
1698         return 1 << ot;
1699     else
1700         return 4;
1701 }
1702
1703 static inline void gen_goto_tb(DisasContext *s, int tb_num, target_ulong eip)
1704 {
1705     TranslationBlock *tb;
1706     target_ulong pc;
1707
1708     pc = s->cs_base + eip;
1709     tb = s->tb;
1710     /* NOTE: we handle the case where the TB spans two pages here */
1711     if ((pc & TARGET_PAGE_MASK) == (tb->pc & TARGET_PAGE_MASK) ||
1712         (pc & TARGET_PAGE_MASK) == ((s->pc - 1) & TARGET_PAGE_MASK))  {
1713         /* jump to same page: we can use a direct jump */
1714         if (tb_num == 0)
1715             gen_op_goto_tb0(TBPARAM(tb));
1716         else
1717             gen_op_goto_tb1(TBPARAM(tb));
1718         gen_jmp_im(eip);
1719         gen_op_movl_T0_im((long)tb + tb_num);
1720         gen_op_exit_tb();
1721     } else {
1722         /* jump to another page: currently not optimized */
1723         gen_jmp_im(eip);
1724         gen_eob(s);
1725     }
1726 }
1727
1728 static inline void gen_jcc(DisasContext *s, int b,
1729                            target_ulong val, target_ulong next_eip)
1730 {
1731     TranslationBlock *tb;
1732     int inv, jcc_op;
1733     GenOpFunc1 *func;
1734     target_ulong tmp;
1735     int l1, l2;
1736
1737     inv = b & 1;
1738     jcc_op = (b >> 1) & 7;
1739
1740     if (s->jmp_opt) {
1741         switch(s->cc_op) {
1742             /* we optimize the cmp/jcc case */
1743         case CC_OP_SUBB:
1744         case CC_OP_SUBW:
1745         case CC_OP_SUBL:
1746         case CC_OP_SUBQ:
1747             func = gen_jcc_sub[s->cc_op - CC_OP_SUBB][jcc_op];
1748             break;
1749
1750             /* some jumps are easy to compute */
1751         case CC_OP_ADDB:
1752         case CC_OP_ADDW:
1753         case CC_OP_ADDL:
1754         case CC_OP_ADDQ:
1755
1756         case CC_OP_ADCB:
1757         case CC_OP_ADCW:
1758         case CC_OP_ADCL:
1759         case CC_OP_ADCQ:
1760
1761         case CC_OP_SBBB:
1762         case CC_OP_SBBW:
1763         case CC_OP_SBBL:
1764         case CC_OP_SBBQ:
1765
1766         case CC_OP_LOGICB:
1767         case CC_OP_LOGICW:
1768         case CC_OP_LOGICL:
1769         case CC_OP_LOGICQ:
1770
1771         case CC_OP_INCB:
1772         case CC_OP_INCW:
1773         case CC_OP_INCL:
1774         case CC_OP_INCQ:
1775
1776         case CC_OP_DECB:
1777         case CC_OP_DECW:
1778         case CC_OP_DECL:
1779         case CC_OP_DECQ:
1780
1781         case CC_OP_SHLB:
1782         case CC_OP_SHLW:
1783         case CC_OP_SHLL:
1784         case CC_OP_SHLQ:
1785
1786         case CC_OP_SARB:
1787         case CC_OP_SARW:
1788         case CC_OP_SARL:
1789         case CC_OP_SARQ:
1790             switch(jcc_op) {
1791             case JCC_Z:
1792                 func = gen_jcc_sub[(s->cc_op - CC_OP_ADDB) % 4][jcc_op];
1793                 break;
1794             case JCC_S:
1795                 func = gen_jcc_sub[(s->cc_op - CC_OP_ADDB) % 4][jcc_op];
1796                 break;
1797             default:
1798                 func = NULL;
1799                 break;
1800             }
1801             break;
1802         default:
1803             func = NULL;
1804             break;
1805         }
1806
1807         if (s->cc_op != CC_OP_DYNAMIC) {
1808             gen_op_set_cc_op(s->cc_op);
1809             s->cc_op = CC_OP_DYNAMIC;
1810         }
1811
1812         if (!func) {
1813             gen_setcc_slow[jcc_op]();
1814             func = gen_op_jnz_T0_label;
1815         }
1816
1817         if (inv) {
1818             tmp = val;
1819             val = next_eip;
1820             next_eip = tmp;
1821         }
1822         tb = s->tb;
1823
1824         l1 = gen_new_label();
1825         func(l1);
1826
1827         gen_goto_tb(s, 0, next_eip);
1828
1829         gen_set_label(l1);
1830         gen_goto_tb(s, 1, val);
1831
1832         s->is_jmp = 3;
1833     } else {
1834
1835         if (s->cc_op != CC_OP_DYNAMIC) {
1836             gen_op_set_cc_op(s->cc_op);
1837             s->cc_op = CC_OP_DYNAMIC;
1838         }
1839         gen_setcc_slow[jcc_op]();
1840         if (inv) {
1841             tmp = val;
1842             val = next_eip;
1843             next_eip = tmp;
1844         }
1845         l1 = gen_new_label();
1846         l2 = gen_new_label();
1847         gen_op_jnz_T0_label(l1);
1848         gen_jmp_im(next_eip);
1849         gen_op_jmp_label(l2);
1850         gen_set_label(l1);
1851         gen_jmp_im(val);
1852         gen_set_label(l2);
1853         gen_eob(s);
1854     }
1855 }
1856
1857 static void gen_setcc(DisasContext *s, int b)
1858 {
1859     int inv, jcc_op;
1860     GenOpFunc *func;
1861
1862     inv = b & 1;
1863     jcc_op = (b >> 1) & 7;
1864     switch(s->cc_op) {
1865         /* we optimize the cmp/jcc case */
1866     case CC_OP_SUBB:
1867     case CC_OP_SUBW:
1868     case CC_OP_SUBL:
1869     case CC_OP_SUBQ:
1870         func = gen_setcc_sub[s->cc_op - CC_OP_SUBB][jcc_op];
1871         if (!func)
1872             goto slow_jcc;
1873         break;
1874
1875         /* some jumps are easy to compute */
1876     case CC_OP_ADDB:
1877     case CC_OP_ADDW:
1878     case CC_OP_ADDL:
1879     case CC_OP_ADDQ:
1880
1881     case CC_OP_LOGICB:
1882     case CC_OP_LOGICW:
1883     case CC_OP_LOGICL:
1884     case CC_OP_LOGICQ:
1885
1886     case CC_OP_INCB:
1887     case CC_OP_INCW:
1888     case CC_OP_INCL:
1889     case CC_OP_INCQ:
1890
1891     case CC_OP_DECB:
1892     case CC_OP_DECW:
1893     case CC_OP_DECL:
1894     case CC_OP_DECQ:
1895
1896     case CC_OP_SHLB:
1897     case CC_OP_SHLW:
1898     case CC_OP_SHLL:
1899     case CC_OP_SHLQ:
1900         switch(jcc_op) {
1901         case JCC_Z:
1902             func = gen_setcc_sub[(s->cc_op - CC_OP_ADDB) % 4][jcc_op];
1903             break;
1904         case JCC_S:
1905             func = gen_setcc_sub[(s->cc_op - CC_OP_ADDB) % 4][jcc_op];
1906             break;
1907         default:
1908             goto slow_jcc;
1909         }
1910         break;
1911     default:
1912     slow_jcc:
1913         if (s->cc_op != CC_OP_DYNAMIC)
1914             gen_op_set_cc_op(s->cc_op);
1915         func = gen_setcc_slow[jcc_op];
1916         break;
1917     }
1918     func();
1919     if (inv) {
1920         gen_op_xor_T0_1();
1921     }
1922 }
1923
1924 /* move T0 to seg_reg and compute if the CPU state may change. Never
1925    call this function with seg_reg == R_CS */
1926 static void gen_movl_seg_T0(DisasContext *s, int seg_reg, target_ulong cur_eip)
1927 {
1928     if (s->pe && !s->vm86) {
1929         /* XXX: optimize by finding processor state dynamically */
1930         if (s->cc_op != CC_OP_DYNAMIC)
1931             gen_op_set_cc_op(s->cc_op);
1932         gen_jmp_im(cur_eip);
1933         gen_op_movl_seg_T0(seg_reg);
1934         /* abort translation because the addseg value may change or
1935            because ss32 may change. For R_SS, translation must always
1936            stop as a special handling must be done to disable hardware
1937            interrupts for the next instruction */
1938         if (seg_reg == R_SS || (s->code32 && seg_reg < R_FS))
1939             s->is_jmp = 3;
1940     } else {
1941         gen_op_movl_seg_T0_vm(offsetof(CPUX86State,segs[seg_reg]));
1942         if (seg_reg == R_SS)
1943             s->is_jmp = 3;
1944     }
1945 }
1946
1947 static inline void gen_stack_update(DisasContext *s, int addend)
1948 {
1949 #ifdef TARGET_X86_64
1950     if (CODE64(s)) {
1951         if (addend == 8)
1952             gen_op_addq_ESP_8();
1953         else
1954             gen_op_addq_ESP_im(addend);
1955     } else
1956 #endif
1957     if (s->ss32) {
1958         if (addend == 2)
1959             gen_op_addl_ESP_2();
1960         else if (addend == 4)
1961             gen_op_addl_ESP_4();
1962         else
1963             gen_op_addl_ESP_im(addend);
1964     } else {
1965         if (addend == 2)
1966             gen_op_addw_ESP_2();
1967         else if (addend == 4)
1968             gen_op_addw_ESP_4();
1969         else
1970             gen_op_addw_ESP_im(addend);
1971     }
1972 }
1973
1974 /* generate a push. It depends on ss32, addseg and dflag */
1975 static void gen_push_T0(DisasContext *s)
1976 {
1977 #ifdef TARGET_X86_64
1978     if (CODE64(s)) {
1979         gen_op_movq_A0_reg[R_ESP]();
1980         if (s->dflag) {
1981             gen_op_subq_A0_8();
1982             gen_op_st_T0_A0[OT_QUAD + s->mem_index]();
1983         } else {
1984             gen_op_subq_A0_2();
1985             gen_op_st_T0_A0[OT_WORD + s->mem_index]();
1986         }
1987         gen_op_movq_ESP_A0();
1988     } else
1989 #endif
1990     {
1991         gen_op_movl_A0_reg[R_ESP]();
1992         if (!s->dflag)
1993             gen_op_subl_A0_2();
1994         else
1995             gen_op_subl_A0_4();
1996         if (s->ss32) {
1997             if (s->addseg) {
1998                 gen_op_movl_T1_A0();
1999                 gen_op_addl_A0_SS();
2000             }
2001         } else {
2002             gen_op_andl_A0_ffff();
2003             gen_op_movl_T1_A0();
2004             gen_op_addl_A0_SS();
2005         }
2006         gen_op_st_T0_A0[s->dflag + 1 + s->mem_index]();
2007         if (s->ss32 && !s->addseg)
2008             gen_op_movl_ESP_A0();
2009         else
2010             gen_op_mov_reg_T1[s->ss32 + 1][R_ESP]();
2011     }
2012 }
2013
2014 /* generate a push. It depends on ss32, addseg and dflag */
2015 /* slower version for T1, only used for call Ev */
2016 static void gen_push_T1(DisasContext *s)
2017 {
2018 #ifdef TARGET_X86_64
2019     if (CODE64(s)) {
2020         gen_op_movq_A0_reg[R_ESP]();
2021         if (s->dflag) {
2022             gen_op_subq_A0_8();
2023             gen_op_st_T1_A0[OT_QUAD + s->mem_index]();
2024         } else {
2025             gen_op_subq_A0_2();
2026             gen_op_st_T0_A0[OT_WORD + s->mem_index]();
2027         }
2028         gen_op_movq_ESP_A0();
2029     } else
2030 #endif
2031     {
2032         gen_op_movl_A0_reg[R_ESP]();
2033         if (!s->dflag)
2034             gen_op_subl_A0_2();
2035         else
2036             gen_op_subl_A0_4();
2037         if (s->ss32) {
2038             if (s->addseg) {
2039                 gen_op_addl_A0_SS();
2040             }
2041         } else {
2042             gen_op_andl_A0_ffff();
2043             gen_op_addl_A0_SS();
2044         }
2045         gen_op_st_T1_A0[s->dflag + 1 + s->mem_index]();
2046
2047         if (s->ss32 && !s->addseg)
2048             gen_op_movl_ESP_A0();
2049         else
2050             gen_stack_update(s, (-2) << s->dflag);
2051     }
2052 }
2053
2054 /* two step pop is necessary for precise exceptions */
2055 static void gen_pop_T0(DisasContext *s)
2056 {
2057 #ifdef TARGET_X86_64
2058     if (CODE64(s)) {
2059         gen_op_movq_A0_reg[R_ESP]();
2060         gen_op_ld_T0_A0[(s->dflag ? OT_QUAD : OT_WORD) + s->mem_index]();
2061     } else
2062 #endif
2063     {
2064         gen_op_movl_A0_reg[R_ESP]();
2065         if (s->ss32) {
2066             if (s->addseg)
2067                 gen_op_addl_A0_SS();
2068         } else {
2069             gen_op_andl_A0_ffff();
2070             gen_op_addl_A0_SS();
2071         }
2072         gen_op_ld_T0_A0[s->dflag + 1 + s->mem_index]();
2073     }
2074 }
2075
2076 static void gen_pop_update(DisasContext *s)
2077 {
2078 #ifdef TARGET_X86_64
2079     if (CODE64(s) && s->dflag) {
2080         gen_stack_update(s, 8);
2081     } else
2082 #endif
2083     {
2084         gen_stack_update(s, 2 << s->dflag);
2085     }
2086 }
2087
2088 static void gen_stack_A0(DisasContext *s)
2089 {
2090     gen_op_movl_A0_ESP();
2091     if (!s->ss32)
2092         gen_op_andl_A0_ffff();
2093     gen_op_movl_T1_A0();
2094     if (s->addseg)
2095         gen_op_addl_A0_seg(offsetof(CPUX86State,segs[R_SS].base));
2096 }
2097
2098 /* NOTE: wrap around in 16 bit not fully handled */
2099 static void gen_pusha(DisasContext *s)
2100 {
2101     int i;
2102     gen_op_movl_A0_ESP();
2103     gen_op_addl_A0_im(-16 <<  s->dflag);
2104     if (!s->ss32)
2105         gen_op_andl_A0_ffff();
2106     gen_op_movl_T1_A0();
2107     if (s->addseg)
2108         gen_op_addl_A0_seg(offsetof(CPUX86State,segs[R_SS].base));
2109     for(i = 0;i < 8; i++) {
2110         gen_op_mov_TN_reg[OT_LONG][0][7 - i]();
2111         gen_op_st_T0_A0[OT_WORD + s->dflag + s->mem_index]();
2112         gen_op_addl_A0_im(2 <<  s->dflag);
2113     }
2114     gen_op_mov_reg_T1[OT_WORD + s->ss32][R_ESP]();
2115 }
2116
2117 /* NOTE: wrap around in 16 bit not fully handled */
2118 static void gen_popa(DisasContext *s)
2119 {
2120     int i;
2121     gen_op_movl_A0_ESP();
2122     if (!s->ss32)
2123         gen_op_andl_A0_ffff();
2124     gen_op_movl_T1_A0();
2125     gen_op_addl_T1_im(16 <<  s->dflag);
2126     if (s->addseg)
2127         gen_op_addl_A0_seg(offsetof(CPUX86State,segs[R_SS].base));
2128     for(i = 0;i < 8; i++) {
2129         /* ESP is not reloaded */
2130         if (i != 3) {
2131             gen_op_ld_T0_A0[OT_WORD + s->dflag + s->mem_index]();
2132             gen_op_mov_reg_T0[OT_WORD + s->dflag][7 - i]();
2133         }
2134         gen_op_addl_A0_im(2 <<  s->dflag);
2135     }
2136     gen_op_mov_reg_T1[OT_WORD + s->ss32][R_ESP]();
2137 }
2138
2139 static void gen_enter(DisasContext *s, int esp_addend, int level)
2140 {
2141     int ot, opsize;
2142
2143     level &= 0x1f;
2144 #ifdef TARGET_X86_64
2145     if (CODE64(s)) {
2146         ot = s->dflag ? OT_QUAD : OT_WORD;
2147         opsize = 1 << ot;
2148
2149         gen_op_movl_A0_ESP();
2150         gen_op_addq_A0_im(-opsize);
2151         gen_op_movl_T1_A0();
2152
2153         /* push bp */
2154         gen_op_mov_TN_reg[OT_LONG][0][R_EBP]();
2155         gen_op_st_T0_A0[ot + s->mem_index]();
2156         if (level) {
2157             gen_op_enter64_level(level, (ot == OT_QUAD));
2158         }
2159         gen_op_mov_reg_T1[ot][R_EBP]();
2160         gen_op_addl_T1_im( -esp_addend + (-opsize * level) );
2161         gen_op_mov_reg_T1[OT_QUAD][R_ESP]();
2162     } else
2163 #endif
2164     {
2165         ot = s->dflag + OT_WORD;
2166         opsize = 2 << s->dflag;
2167
2168         gen_op_movl_A0_ESP();
2169         gen_op_addl_A0_im(-opsize);
2170         if (!s->ss32)
2171             gen_op_andl_A0_ffff();
2172         gen_op_movl_T1_A0();
2173         if (s->addseg)
2174             gen_op_addl_A0_seg(offsetof(CPUX86State,segs[R_SS].base));
2175         /* push bp */
2176         gen_op_mov_TN_reg[OT_LONG][0][R_EBP]();
2177         gen_op_st_T0_A0[ot + s->mem_index]();
2178         if (level) {
2179             gen_op_enter_level(level, s->dflag);
2180         }
2181         gen_op_mov_reg_T1[ot][R_EBP]();
2182         gen_op_addl_T1_im( -esp_addend + (-opsize * level) );
2183         gen_op_mov_reg_T1[OT_WORD + s->ss32][R_ESP]();
2184     }
2185 }
2186
2187 static void gen_exception(DisasContext *s, int trapno, target_ulong cur_eip)
2188 {
2189     if (s->cc_op != CC_OP_DYNAMIC)
2190         gen_op_set_cc_op(s->cc_op);
2191     gen_jmp_im(cur_eip);
2192     gen_op_raise_exception(trapno);
2193     s->is_jmp = 3;
2194 }
2195
2196 /* an interrupt is different from an exception because of the
2197    priviledge checks */
2198 static void gen_interrupt(DisasContext *s, int intno,
2199                           target_ulong cur_eip, target_ulong next_eip)
2200 {
2201     if (s->cc_op != CC_OP_DYNAMIC)
2202         gen_op_set_cc_op(s->cc_op);
2203     gen_jmp_im(cur_eip);
2204     gen_op_raise_interrupt(intno, (int)(next_eip - cur_eip));
2205     s->is_jmp = 3;
2206 }
2207
2208 static void gen_debug(DisasContext *s, target_ulong cur_eip)
2209 {
2210     if (s->cc_op != CC_OP_DYNAMIC)
2211         gen_op_set_cc_op(s->cc_op);
2212     gen_jmp_im(cur_eip);
2213     gen_op_debug();
2214     s->is_jmp = 3;
2215 }
2216
2217 /* generate a generic end of block. Trace exception is also generated
2218    if needed */
2219 static void gen_eob(DisasContext *s)
2220 {
2221     if (s->cc_op != CC_OP_DYNAMIC)
2222         gen_op_set_cc_op(s->cc_op);
2223     if (s->tb->flags & HF_INHIBIT_IRQ_MASK) {
2224         gen_op_reset_inhibit_irq();
2225     }
2226     if (s->singlestep_enabled) {
2227         gen_op_debug();
2228     } else if (s->tf) {
2229         gen_op_raise_exception(EXCP01_SSTP);
2230     } else {
2231         gen_op_movl_T0_0();
2232         gen_op_exit_tb();
2233     }
2234     s->is_jmp = 3;
2235 }
2236
2237 /* generate a jump to eip. No segment change must happen before as a
2238    direct call to the next block may occur */
2239 static void gen_jmp_tb(DisasContext *s, target_ulong eip, int tb_num)
2240 {
2241     if (s->jmp_opt) {
2242         if (s->cc_op != CC_OP_DYNAMIC) {
2243             gen_op_set_cc_op(s->cc_op);
2244             s->cc_op = CC_OP_DYNAMIC;
2245         }
2246         gen_goto_tb(s, tb_num, eip);
2247         s->is_jmp = 3;
2248     } else {
2249         gen_jmp_im(eip);
2250         gen_eob(s);
2251     }
2252 }
2253
2254 static void gen_jmp(DisasContext *s, target_ulong eip)
2255 {
2256     gen_jmp_tb(s, eip, 0);
2257 }
2258
2259 static void gen_movtl_T0_im(target_ulong val)
2260 {
2261 #ifdef TARGET_X86_64
2262     if ((int32_t)val == val) {
2263         gen_op_movl_T0_im(val);
2264     } else {
2265         gen_op_movq_T0_im64(val >> 32, val);
2266     }
2267 #else
2268     gen_op_movl_T0_im(val);
2269 #endif
2270 }
2271
2272 static void gen_movtl_T1_im(target_ulong val)
2273 {
2274 #ifdef TARGET_X86_64
2275     if ((int32_t)val == val) {
2276         gen_op_movl_T1_im(val);
2277     } else {
2278         gen_op_movq_T1_im64(val >> 32, val);
2279     }
2280 #else
2281     gen_op_movl_T1_im(val);
2282 #endif
2283 }
2284
2285 static void gen_add_A0_im(DisasContext *s, int val)
2286 {
2287 #ifdef TARGET_X86_64
2288     if (CODE64(s))
2289         gen_op_addq_A0_im(val);
2290     else
2291 #endif
2292         gen_op_addl_A0_im(val);
2293 }
2294
2295 static GenOpFunc1 *gen_ldq_env_A0[3] = {
2296     gen_op_ldq_raw_env_A0,
2297 #ifndef CONFIG_USER_ONLY
2298     gen_op_ldq_kernel_env_A0,
2299     gen_op_ldq_user_env_A0,
2300 #endif
2301 };
2302
2303 static GenOpFunc1 *gen_stq_env_A0[3] = {
2304     gen_op_stq_raw_env_A0,
2305 #ifndef CONFIG_USER_ONLY
2306     gen_op_stq_kernel_env_A0,
2307     gen_op_stq_user_env_A0,
2308 #endif
2309 };
2310
2311 static GenOpFunc1 *gen_ldo_env_A0[3] = {
2312     gen_op_ldo_raw_env_A0,
2313 #ifndef CONFIG_USER_ONLY
2314     gen_op_ldo_kernel_env_A0,
2315     gen_op_ldo_user_env_A0,
2316 #endif
2317 };
2318
2319 static GenOpFunc1 *gen_sto_env_A0[3] = {
2320     gen_op_sto_raw_env_A0,
2321 #ifndef CONFIG_USER_ONLY
2322     gen_op_sto_kernel_env_A0,
2323     gen_op_sto_user_env_A0,
2324 #endif
2325 };
2326
2327 #define SSE_SPECIAL ((GenOpFunc2 *)1)
2328
2329 #define MMX_OP2(x) { gen_op_ ## x ## _mmx, gen_op_ ## x ## _xmm }
2330 #define SSE_FOP(x) { gen_op_ ## x ## ps, gen_op_ ## x ## pd, \
2331                      gen_op_ ## x ## ss, gen_op_ ## x ## sd, }
2332
2333 static GenOpFunc2 *sse_op_table1[256][4] = {
2334     /* pure SSE operations */
2335     [0x10] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* movups, movupd, movss, movsd */
2336     [0x11] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* movups, movupd, movss, movsd */
2337     [0x12] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* movlps, movlpd, movsldup, movddup */
2338     [0x13] = { SSE_SPECIAL, SSE_SPECIAL },  /* movlps, movlpd */
2339     [0x14] = { gen_op_punpckldq_xmm, gen_op_punpcklqdq_xmm },
2340     [0x15] = { gen_op_punpckhdq_xmm, gen_op_punpckhqdq_xmm },
2341     [0x16] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL },  /* movhps, movhpd, movshdup */
2342     [0x17] = { SSE_SPECIAL, SSE_SPECIAL },  /* movhps, movhpd */
2343
2344     [0x28] = { SSE_SPECIAL, SSE_SPECIAL },  /* movaps, movapd */
2345     [0x29] = { SSE_SPECIAL, SSE_SPECIAL },  /* movaps, movapd */
2346     [0x2a] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* cvtpi2ps, cvtpi2pd, cvtsi2ss, cvtsi2sd */
2347     [0x2b] = { SSE_SPECIAL, SSE_SPECIAL },  /* movntps, movntpd */
2348     [0x2c] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* cvttps2pi, cvttpd2pi, cvttsd2si, cvttss2si */
2349     [0x2d] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* cvtps2pi, cvtpd2pi, cvtsd2si, cvtss2si */
2350     [0x2e] = { gen_op_ucomiss, gen_op_ucomisd },
2351     [0x2f] = { gen_op_comiss, gen_op_comisd },
2352     [0x50] = { SSE_SPECIAL, SSE_SPECIAL }, /* movmskps, movmskpd */
2353     [0x51] = SSE_FOP(sqrt),
2354     [0x52] = { gen_op_rsqrtps, NULL, gen_op_rsqrtss, NULL },
2355     [0x53] = { gen_op_rcpps, NULL, gen_op_rcpss, NULL },
2356     [0x54] = { gen_op_pand_xmm, gen_op_pand_xmm }, /* andps, andpd */
2357     [0x55] = { gen_op_pandn_xmm, gen_op_pandn_xmm }, /* andnps, andnpd */
2358     [0x56] = { gen_op_por_xmm, gen_op_por_xmm }, /* orps, orpd */
2359     [0x57] = { gen_op_pxor_xmm, gen_op_pxor_xmm }, /* xorps, xorpd */
2360     [0x58] = SSE_FOP(add),
2361     [0x59] = SSE_FOP(mul),
2362     [0x5a] = { gen_op_cvtps2pd, gen_op_cvtpd2ps,
2363                gen_op_cvtss2sd, gen_op_cvtsd2ss },
2364     [0x5b] = { gen_op_cvtdq2ps, gen_op_cvtps2dq, gen_op_cvttps2dq },
2365     [0x5c] = SSE_FOP(sub),
2366     [0x5d] = SSE_FOP(min),
2367     [0x5e] = SSE_FOP(div),
2368     [0x5f] = SSE_FOP(max),
2369
2370     [0xc2] = SSE_FOP(cmpeq),
2371     [0xc6] = { (GenOpFunc2 *)gen_op_shufps, (GenOpFunc2 *)gen_op_shufpd },
2372
2373     /* MMX ops and their SSE extensions */
2374     [0x60] = MMX_OP2(punpcklbw),
2375     [0x61] = MMX_OP2(punpcklwd),
2376     [0x62] = MMX_OP2(punpckldq),
2377     [0x63] = MMX_OP2(packsswb),
2378     [0x64] = MMX_OP2(pcmpgtb),
2379     [0x65] = MMX_OP2(pcmpgtw),
2380     [0x66] = MMX_OP2(pcmpgtl),
2381     [0x67] = MMX_OP2(packuswb),
2382     [0x68] = MMX_OP2(punpckhbw),
2383     [0x69] = MMX_OP2(punpckhwd),
2384     [0x6a] = MMX_OP2(punpckhdq),
2385     [0x6b] = MMX_OP2(packssdw),
2386     [0x6c] = { NULL, gen_op_punpcklqdq_xmm },
2387     [0x6d] = { NULL, gen_op_punpckhqdq_xmm },
2388     [0x6e] = { SSE_SPECIAL, SSE_SPECIAL }, /* movd mm, ea */
2389     [0x6f] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* movq, movdqa, , movqdu */
2390     [0x70] = { (GenOpFunc2 *)gen_op_pshufw_mmx,
2391                (GenOpFunc2 *)gen_op_pshufd_xmm,
2392                (GenOpFunc2 *)gen_op_pshufhw_xmm,
2393                (GenOpFunc2 *)gen_op_pshuflw_xmm },
2394     [0x71] = { SSE_SPECIAL, SSE_SPECIAL }, /* shiftw */
2395     [0x72] = { SSE_SPECIAL, SSE_SPECIAL }, /* shiftd */
2396     [0x73] = { SSE_SPECIAL, SSE_SPECIAL }, /* shiftq */
2397     [0x74] = MMX_OP2(pcmpeqb),
2398     [0x75] = MMX_OP2(pcmpeqw),
2399     [0x76] = MMX_OP2(pcmpeql),
2400     [0x77] = { SSE_SPECIAL }, /* emms */
2401     [0x7c] = { NULL, gen_op_haddpd, NULL, gen_op_haddps },
2402     [0x7d] = { NULL, gen_op_hsubpd, NULL, gen_op_hsubps },
2403     [0x7e] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* movd, movd, , movq */
2404     [0x7f] = { SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL }, /* movq, movdqa, movdqu */
2405     [0xc4] = { SSE_SPECIAL, SSE_SPECIAL }, /* pinsrw */
2406     [0xc5] = { SSE_SPECIAL, SSE_SPECIAL }, /* pextrw */
2407     [0xd0] = { NULL, gen_op_addsubpd, NULL, gen_op_addsubps },
2408     [0xd1] = MMX_OP2(psrlw),
2409     [0xd2] = MMX_OP2(psrld),
2410     [0xd3] = MMX_OP2(psrlq),
2411     [0xd4] = MMX_OP2(paddq),
2412     [0xd5] = MMX_OP2(pmullw),
2413     [0xd6] = { NULL, SSE_SPECIAL, SSE_SPECIAL, SSE_SPECIAL },
2414     [0xd7] = { SSE_SPECIAL, SSE_SPECIAL }, /* pmovmskb */
2415     [0xd8] = MMX_OP2(psubusb),
2416     [0xd9] = MMX_OP2(psubusw),
2417     [0xda] = MMX_OP2(pminub),
2418     [0xdb] = MMX_OP2(pand),
2419     [0xdc] = MMX_OP2(paddusb),
2420     [0xdd] = MMX_OP2(paddusw),
2421     [0xde] = MMX_OP2(pmaxub),
2422     [0xdf] = MMX_OP2(pandn),
2423     [0xe0] = MMX_OP2(pavgb),
2424     [0xe1] = MMX_OP2(psraw),
2425     [0xe2] = MMX_OP2(psrad),
2426     [0xe3] = MMX_OP2(pavgw),
2427     [0xe4] = MMX_OP2(pmulhuw),
2428     [0xe5] = MMX_OP2(pmulhw),
2429     [0xe6] = { NULL, gen_op_cvttpd2dq, gen_op_cvtdq2pd, gen_op_cvtpd2dq },
2430     [0xe7] = { SSE_SPECIAL , SSE_SPECIAL },  /* movntq, movntq */
2431     [0xe8] = MMX_OP2(psubsb),
2432     [0xe9] = MMX_OP2(psubsw),
2433     [0xea] = MMX_OP2(pminsw),
2434     [0xeb] = MMX_OP2(por),
2435     [0xec] = MMX_OP2(paddsb),
2436     [0xed] = MMX_OP2(paddsw),
2437     [0xee] = MMX_OP2(pmaxsw),
2438     [0xef] = MMX_OP2(pxor),
2439     [0xf0] = { NULL, NULL, NULL, SSE_SPECIAL }, /* lddqu */
2440     [0xf1] = MMX_OP2(psllw),
2441     [0xf2] = MMX_OP2(pslld),
2442     [0xf3] = MMX_OP2(psllq),
2443     [0xf4] = MMX_OP2(pmuludq),
2444     [0xf5] = MMX_OP2(pmaddwd),
2445     [0xf6] = MMX_OP2(psadbw),
2446     [0xf7] = MMX_OP2(maskmov),
2447     [0xf8] = MMX_OP2(psubb),
2448     [0xf9] = MMX_OP2(psubw),
2449     [0xfa] = MMX_OP2(psubl),
2450     [0xfb] = MMX_OP2(psubq),
2451     [0xfc] = MMX_OP2(paddb),
2452     [0xfd] = MMX_OP2(paddw),
2453     [0xfe] = MMX_OP2(paddl),
2454 };
2455
2456 static GenOpFunc2 *sse_op_table2[3 * 8][2] = {
2457     [0 + 2] = MMX_OP2(psrlw),
2458     [0 + 4] = MMX_OP2(psraw),
2459     [0 + 6] = MMX_OP2(psllw),
2460     [8 + 2] = MMX_OP2(psrld),
2461     [8 + 4] = MMX_OP2(psrad),
2462     [8 + 6] = MMX_OP2(pslld),
2463     [16 + 2] = MMX_OP2(psrlq),
2464     [16 + 3] = { NULL, gen_op_psrldq_xmm },
2465     [16 + 6] = MMX_OP2(psllq),
2466     [16 + 7] = { NULL, gen_op_pslldq_xmm },
2467 };
2468
2469 static GenOpFunc1 *sse_op_table3[4 * 3] = {
2470     gen_op_cvtsi2ss,
2471     gen_op_cvtsi2sd,
2472     X86_64_ONLY(gen_op_cvtsq2ss),
2473     X86_64_ONLY(gen_op_cvtsq2sd),
2474
2475     gen_op_cvttss2si,
2476     gen_op_cvttsd2si,
2477     X86_64_ONLY(gen_op_cvttss2sq),
2478     X86_64_ONLY(gen_op_cvttsd2sq),
2479
2480     gen_op_cvtss2si,
2481     gen_op_cvtsd2si,
2482     X86_64_ONLY(gen_op_cvtss2sq),
2483     X86_64_ONLY(gen_op_cvtsd2sq),
2484 };
2485
2486 static GenOpFunc2 *sse_op_table4[8][4] = {
2487     SSE_FOP(cmpeq),
2488     SSE_FOP(cmplt),
2489     SSE_FOP(cmple),
2490     SSE_FOP(cmpunord),
2491     SSE_FOP(cmpneq),
2492     SSE_FOP(cmpnlt),
2493     SSE_FOP(cmpnle),
2494     SSE_FOP(cmpord),
2495 };
2496
2497 static void gen_sse(DisasContext *s, int b, target_ulong pc_start, int rex_r)
2498 {
2499     int b1, op1_offset, op2_offset, is_xmm, val, ot;
2500     int modrm, mod, rm, reg, reg_addr, offset_addr;
2501     GenOpFunc2 *sse_op2;
2502     GenOpFunc3 *sse_op3;
2503
2504     b &= 0xff;
2505     if (s->prefix & PREFIX_DATA)
2506         b1 = 1;
2507     else if (s->prefix & PREFIX_REPZ)
2508         b1 = 2;
2509     else if (s->prefix & PREFIX_REPNZ)
2510         b1 = 3;
2511     else
2512         b1 = 0;
2513     sse_op2 = sse_op_table1[b][b1];
2514     if (!sse_op2)
2515         goto illegal_op;
2516     if (b <= 0x5f || b == 0xc6 || b == 0xc2) {
2517         is_xmm = 1;
2518     } else {
2519         if (b1 == 0) {
2520             /* MMX case */
2521             is_xmm = 0;
2522         } else {
2523             is_xmm = 1;
2524         }
2525     }
2526     /* simple MMX/SSE operation */
2527     if (s->flags & HF_TS_MASK) {
2528         gen_exception(s, EXCP07_PREX, pc_start - s->cs_base);
2529         return;
2530     }
2531     if (s->flags & HF_EM_MASK) {
2532     illegal_op:
2533         gen_exception(s, EXCP06_ILLOP, pc_start - s->cs_base);
2534         return;
2535     }
2536     if (is_xmm && !(s->flags & HF_OSFXSR_MASK))
2537         goto illegal_op;
2538     if (b == 0x77) {
2539         /* emms */
2540         gen_op_emms();
2541         return;
2542     }
2543     /* prepare MMX state (XXX: optimize by storing fptt and fptags in
2544        the static cpu state) */
2545     if (!is_xmm) {
2546         gen_op_enter_mmx();
2547     }
2548
2549     modrm = ldub_code(s->pc++);
2550     reg = ((modrm >> 3) & 7);
2551     if (is_xmm)
2552         reg |= rex_r;
2553     mod = (modrm >> 6) & 3;
2554     if (sse_op2 == SSE_SPECIAL) {
2555         b |= (b1 << 8);
2556         switch(b) {
2557         case 0x0e7: /* movntq */
2558             if (mod == 3)
2559                 goto illegal_op;
2560             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2561             gen_stq_env_A0[s->mem_index >> 2](offsetof(CPUX86State,fpregs[reg].mmx));
2562             break;
2563         case 0x1e7: /* movntdq */
2564         case 0x02b: /* movntps */
2565         case 0x12b: /* movntps */
2566         case 0x3f0: /* lddqu */
2567             if (mod == 3)
2568                 goto illegal_op;
2569             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2570             gen_sto_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_regs[reg]));
2571             break;
2572         case 0x6e: /* movd mm, ea */
2573             gen_ldst_modrm(s, modrm, OT_LONG, OR_TMP0, 0);
2574             gen_op_movl_mm_T0_mmx(offsetof(CPUX86State,fpregs[reg].mmx));
2575             break;
2576         case 0x16e: /* movd xmm, ea */
2577             gen_ldst_modrm(s, modrm, OT_LONG, OR_TMP0, 0);
2578             gen_op_movl_mm_T0_xmm(offsetof(CPUX86State,xmm_regs[reg]));
2579             break;
2580         case 0x6f: /* movq mm, ea */
2581             if (mod != 3) {
2582                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2583                 gen_ldq_env_A0[s->mem_index >> 2](offsetof(CPUX86State,fpregs[reg].mmx));
2584             } else {
2585                 rm = (modrm & 7);
2586                 gen_op_movq(offsetof(CPUX86State,fpregs[reg].mmx),
2587                             offsetof(CPUX86State,fpregs[rm].mmx));
2588             }
2589             break;
2590         case 0x010: /* movups */
2591         case 0x110: /* movupd */
2592         case 0x028: /* movaps */
2593         case 0x128: /* movapd */
2594         case 0x16f: /* movdqa xmm, ea */
2595         case 0x26f: /* movdqu xmm, ea */
2596             if (mod != 3) {
2597                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2598                 gen_ldo_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_regs[reg]));
2599             } else {
2600                 rm = (modrm & 7) | REX_B(s);
2601                 gen_op_movo(offsetof(CPUX86State,xmm_regs[reg]),
2602                             offsetof(CPUX86State,xmm_regs[rm]));
2603             }
2604             break;
2605         case 0x210: /* movss xmm, ea */
2606             if (mod != 3) {
2607                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2608                 gen_op_ld_T0_A0[OT_LONG + s->mem_index]();
2609                 gen_op_movl_env_T0(offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)));
2610                 gen_op_movl_T0_0();
2611                 gen_op_movl_env_T0(offsetof(CPUX86State,xmm_regs[reg].XMM_L(1)));
2612                 gen_op_movl_env_T0(offsetof(CPUX86State,xmm_regs[reg].XMM_L(2)));
2613                 gen_op_movl_env_T0(offsetof(CPUX86State,xmm_regs[reg].XMM_L(3)));
2614             } else {
2615                 rm = (modrm & 7) | REX_B(s);
2616                 gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)),
2617                             offsetof(CPUX86State,xmm_regs[rm].XMM_L(0)));
2618             }
2619             break;
2620         case 0x310: /* movsd xmm, ea */
2621             if (mod != 3) {
2622                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2623                 gen_ldq_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)));
2624                 gen_op_movl_T0_0();
2625                 gen_op_movl_env_T0(offsetof(CPUX86State,xmm_regs[reg].XMM_L(2)));
2626                 gen_op_movl_env_T0(offsetof(CPUX86State,xmm_regs[reg].XMM_L(3)));
2627             } else {
2628                 rm = (modrm & 7) | REX_B(s);
2629                 gen_op_movq(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)),
2630                             offsetof(CPUX86State,xmm_regs[rm].XMM_Q(0)));
2631             }
2632             break;
2633         case 0x012: /* movlps */
2634         case 0x112: /* movlpd */
2635             if (mod != 3) {
2636                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2637                 gen_ldq_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)));
2638             } else {
2639                 /* movhlps */
2640                 rm = (modrm & 7) | REX_B(s);
2641                 gen_op_movq(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)),
2642                             offsetof(CPUX86State,xmm_regs[rm].XMM_Q(1)));
2643             }
2644             break;
2645         case 0x212: /* movsldup */
2646             if (mod != 3) {
2647                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2648                 gen_ldo_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_regs[reg]));
2649             } else {
2650                 rm = (modrm & 7) | REX_B(s);
2651                 gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)),
2652                             offsetof(CPUX86State,xmm_regs[rm].XMM_L(0)));
2653                 gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(2)),
2654                             offsetof(CPUX86State,xmm_regs[rm].XMM_L(2)));
2655             }
2656             gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(1)),
2657                         offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)));
2658             gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(3)),
2659                         offsetof(CPUX86State,xmm_regs[reg].XMM_L(2)));
2660             break;
2661         case 0x312: /* movddup */
2662             if (mod != 3) {
2663                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2664                 gen_ldq_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)));
2665             } else {
2666                 rm = (modrm & 7) | REX_B(s);
2667                 gen_op_movq(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)),
2668                             offsetof(CPUX86State,xmm_regs[rm].XMM_Q(0)));
2669             }
2670             gen_op_movq(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(1)),
2671                         offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)));
2672             break;
2673         case 0x016: /* movhps */
2674         case 0x116: /* movhpd */
2675             if (mod != 3) {
2676                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2677                 gen_ldq_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_regs[reg].XMM_Q(1)));
2678             } else {
2679                 /* movlhps */
2680                 rm = (modrm & 7) | REX_B(s);
2681                 gen_op_movq(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(1)),
2682                             offsetof(CPUX86State,xmm_regs[rm].XMM_Q(0)));
2683             }
2684             break;
2685         case 0x216: /* movshdup */
2686             if (mod != 3) {
2687                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2688                 gen_ldo_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_regs[reg]));
2689             } else {
2690                 rm = (modrm & 7) | REX_B(s);
2691                 gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(1)),
2692                             offsetof(CPUX86State,xmm_regs[rm].XMM_L(1)));
2693                 gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(3)),
2694                             offsetof(CPUX86State,xmm_regs[rm].XMM_L(3)));
2695             }
2696             gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)),
2697                         offsetof(CPUX86State,xmm_regs[reg].XMM_L(1)));
2698             gen_op_movl(offsetof(CPUX86State,xmm_regs[reg].XMM_L(2)),
2699                         offsetof(CPUX86State,xmm_regs[reg].XMM_L(3)));
2700             break;
2701         case 0x7e: /* movd ea, mm */
2702             gen_op_movl_T0_mm_mmx(offsetof(CPUX86State,fpregs[reg].mmx));
2703             gen_ldst_modrm(s, modrm, OT_LONG, OR_TMP0, 1);
2704             break;
2705         case 0x17e: /* movd ea, xmm */
2706             gen_op_movl_T0_mm_xmm(offsetof(CPUX86State,xmm_regs[reg]));
2707             gen_ldst_modrm(s, modrm, OT_LONG, OR_TMP0, 1);
2708             break;
2709         case 0x27e: /* movq xmm, ea */
2710             if (mod != 3) {
2711                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2712                 gen_ldq_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)));
2713             } else {
2714                 rm = (modrm & 7) | REX_B(s);
2715                 gen_op_movq(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)),
2716                             offsetof(CPUX86State,xmm_regs[rm].XMM_Q(0)));
2717             }
2718             gen_op_movq_env_0(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(1)));
2719             break;
2720         case 0x7f: /* movq ea, mm */
2721             if (mod != 3) {
2722                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2723                 gen_stq_env_A0[s->mem_index >> 2](offsetof(CPUX86State,fpregs[reg].mmx));
2724             } else {
2725                 rm = (modrm & 7);
2726                 gen_op_movq(offsetof(CPUX86State,fpregs[rm].mmx),
2727                             offsetof(CPUX86State,fpregs[reg].mmx));
2728             }
2729             break;
2730         case 0x011: /* movups */
2731         case 0x111: /* movupd */
2732         case 0x029: /* movaps */
2733         case 0x129: /* movapd */
2734         case 0x17f: /* movdqa ea, xmm */
2735         case 0x27f: /* movdqu ea, xmm */
2736             if (mod != 3) {
2737                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2738                 gen_sto_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_regs[reg]));
2739             } else {
2740                 rm = (modrm & 7) | REX_B(s);
2741                 gen_op_movo(offsetof(CPUX86State,xmm_regs[rm]),
2742                             offsetof(CPUX86State,xmm_regs[reg]));
2743             }
2744             break;
2745         case 0x211: /* movss ea, xmm */
2746             if (mod != 3) {
2747                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2748                 gen_op_movl_T0_env(offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)));
2749                 gen_op_st_T0_A0[OT_LONG + s->mem_index]();
2750             } else {
2751                 rm = (modrm & 7) | REX_B(s);
2752                 gen_op_movl(offsetof(CPUX86State,xmm_regs[rm].XMM_L(0)),
2753                             offsetof(CPUX86State,xmm_regs[reg].XMM_L(0)));
2754             }
2755             break;
2756         case 0x311: /* movsd ea, xmm */
2757             if (mod != 3) {
2758                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2759                 gen_stq_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)));
2760             } else {
2761                 rm = (modrm & 7) | REX_B(s);
2762                 gen_op_movq(offsetof(CPUX86State,xmm_regs[rm].XMM_Q(0)),
2763                             offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)));
2764             }
2765             break;
2766         case 0x013: /* movlps */
2767         case 0x113: /* movlpd */
2768             if (mod != 3) {
2769                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2770                 gen_stq_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)));
2771             } else {
2772                 goto illegal_op;
2773             }
2774             break;
2775         case 0x017: /* movhps */
2776         case 0x117: /* movhpd */
2777             if (mod != 3) {
2778                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2779                 gen_stq_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_regs[reg].XMM_Q(1)));
2780             } else {
2781                 goto illegal_op;
2782             }
2783             break;
2784         case 0x71: /* shift mm, im */
2785         case 0x72:
2786         case 0x73:
2787         case 0x171: /* shift xmm, im */
2788         case 0x172:
2789         case 0x173:
2790             val = ldub_code(s->pc++);
2791             if (is_xmm) {
2792                 gen_op_movl_T0_im(val);
2793                 gen_op_movl_env_T0(offsetof(CPUX86State,xmm_t0.XMM_L(0)));
2794                 gen_op_movl_T0_0();
2795                 gen_op_movl_env_T0(offsetof(CPUX86State,xmm_t0.XMM_L(1)));
2796                 op1_offset = offsetof(CPUX86State,xmm_t0);
2797             } else {
2798                 gen_op_movl_T0_im(val);
2799                 gen_op_movl_env_T0(offsetof(CPUX86State,mmx_t0.MMX_L(0)));
2800                 gen_op_movl_T0_0();
2801                 gen_op_movl_env_T0(offsetof(CPUX86State,mmx_t0.MMX_L(1)));
2802                 op1_offset = offsetof(CPUX86State,mmx_t0);
2803             }
2804             sse_op2 = sse_op_table2[((b - 1) & 3) * 8 + (((modrm >> 3)) & 7)][b1];
2805             if (!sse_op2)
2806                 goto illegal_op;
2807             if (is_xmm) {
2808                 rm = (modrm & 7) | REX_B(s);
2809                 op2_offset = offsetof(CPUX86State,xmm_regs[rm]);
2810             } else {
2811                 rm = (modrm & 7);
2812                 op2_offset = offsetof(CPUX86State,fpregs[rm].mmx);
2813             }
2814             sse_op2(op2_offset, op1_offset);
2815             break;
2816         case 0x050: /* movmskps */
2817             rm = (modrm & 7) | REX_B(s);
2818             gen_op_movmskps(offsetof(CPUX86State,xmm_regs[rm]));
2819             gen_op_mov_reg_T0[OT_LONG][reg]();
2820             break;
2821         case 0x150: /* movmskpd */
2822             rm = (modrm & 7) | REX_B(s);
2823             gen_op_movmskpd(offsetof(CPUX86State,xmm_regs[rm]));
2824             gen_op_mov_reg_T0[OT_LONG][reg]();
2825             break;
2826         case 0x02a: /* cvtpi2ps */
2827         case 0x12a: /* cvtpi2pd */
2828             gen_op_enter_mmx();
2829             if (mod != 3) {
2830                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2831                 op2_offset = offsetof(CPUX86State,mmx_t0);
2832                 gen_ldq_env_A0[s->mem_index >> 2](op2_offset);
2833             } else {
2834                 rm = (modrm & 7);
2835                 op2_offset = offsetof(CPUX86State,fpregs[rm].mmx);
2836             }
2837             op1_offset = offsetof(CPUX86State,xmm_regs[reg]);
2838             switch(b >> 8) {
2839             case 0x0:
2840                 gen_op_cvtpi2ps(op1_offset, op2_offset);
2841                 break;
2842             default:
2843             case 0x1:
2844                 gen_op_cvtpi2pd(op1_offset, op2_offset);
2845                 break;
2846             }
2847             break;
2848         case 0x22a: /* cvtsi2ss */
2849         case 0x32a: /* cvtsi2sd */
2850             ot = (s->dflag == 2) ? OT_QUAD : OT_LONG;
2851             gen_ldst_modrm(s, modrm, ot, OR_TMP0, 0);
2852             op1_offset = offsetof(CPUX86State,xmm_regs[reg]);
2853             sse_op_table3[(s->dflag == 2) * 2 + ((b >> 8) - 2)](op1_offset);
2854             break;
2855         case 0x02c: /* cvttps2pi */
2856         case 0x12c: /* cvttpd2pi */
2857         case 0x02d: /* cvtps2pi */
2858         case 0x12d: /* cvtpd2pi */
2859             gen_op_enter_mmx();
2860             if (mod != 3) {
2861                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2862                 op2_offset = offsetof(CPUX86State,xmm_t0);
2863                 gen_ldo_env_A0[s->mem_index >> 2](op2_offset);
2864             } else {
2865                 rm = (modrm & 7) | REX_B(s);
2866                 op2_offset = offsetof(CPUX86State,xmm_regs[rm]);
2867             }
2868             op1_offset = offsetof(CPUX86State,fpregs[reg & 7].mmx);
2869             switch(b) {
2870             case 0x02c:
2871                 gen_op_cvttps2pi(op1_offset, op2_offset);
2872                 break;
2873             case 0x12c:
2874                 gen_op_cvttpd2pi(op1_offset, op2_offset);
2875                 break;
2876             case 0x02d:
2877                 gen_op_cvtps2pi(op1_offset, op2_offset);
2878                 break;
2879             case 0x12d:
2880                 gen_op_cvtpd2pi(op1_offset, op2_offset);
2881                 break;
2882             }
2883             break;
2884         case 0x22c: /* cvttss2si */
2885         case 0x32c: /* cvttsd2si */
2886         case 0x22d: /* cvtss2si */
2887         case 0x32d: /* cvtsd2si */
2888             ot = (s->dflag == 2) ? OT_QUAD : OT_LONG;
2889             if (mod != 3) {
2890                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2891                 if ((b >> 8) & 1) {
2892                     gen_ldq_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_t0.XMM_Q(0)));
2893                 } else {
2894                     gen_op_ld_T0_A0[OT_LONG + s->mem_index]();
2895                     gen_op_movl_env_T0(offsetof(CPUX86State,xmm_t0.XMM_L(0)));
2896                 }
2897                 op2_offset = offsetof(CPUX86State,xmm_t0);
2898             } else {
2899                 rm = (modrm & 7) | REX_B(s);
2900                 op2_offset = offsetof(CPUX86State,xmm_regs[rm]);
2901             }
2902             sse_op_table3[(s->dflag == 2) * 2 + ((b >> 8) - 2) + 4 +
2903                           (b & 1) * 4](op2_offset);
2904             gen_op_mov_reg_T0[ot][reg]();
2905             break;
2906         case 0xc4: /* pinsrw */
2907         case 0x1c4:
2908             s->rip_offset = 1;
2909             gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0);
2910             val = ldub_code(s->pc++);
2911             if (b1) {
2912                 val &= 7;
2913                 gen_op_pinsrw_xmm(offsetof(CPUX86State,xmm_regs[reg]), val);
2914             } else {
2915                 val &= 3;
2916                 gen_op_pinsrw_mmx(offsetof(CPUX86State,fpregs[reg].mmx), val);
2917             }
2918             break;
2919         case 0xc5: /* pextrw */
2920         case 0x1c5:
2921             if (mod != 3)
2922                 goto illegal_op;
2923             val = ldub_code(s->pc++);
2924             if (b1) {
2925                 val &= 7;
2926                 rm = (modrm & 7) | REX_B(s);
2927                 gen_op_pextrw_xmm(offsetof(CPUX86State,xmm_regs[rm]), val);
2928             } else {
2929                 val &= 3;
2930                 rm = (modrm & 7);
2931                 gen_op_pextrw_mmx(offsetof(CPUX86State,fpregs[rm].mmx), val);
2932             }
2933             reg = ((modrm >> 3) & 7) | rex_r;
2934             gen_op_mov_reg_T0[OT_LONG][reg]();
2935             break;
2936         case 0x1d6: /* movq ea, xmm */
2937             if (mod != 3) {
2938                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
2939                 gen_stq_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)));
2940             } else {
2941                 rm = (modrm & 7) | REX_B(s);
2942                 gen_op_movq(offsetof(CPUX86State,xmm_regs[rm].XMM_Q(0)),
2943                             offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)));
2944                 gen_op_movq_env_0(offsetof(CPUX86State,xmm_regs[rm].XMM_Q(1)));
2945             }
2946             break;
2947         case 0x2d6: /* movq2dq */
2948             gen_op_enter_mmx();
2949             rm = (modrm & 7);
2950             gen_op_movq(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(0)),
2951                         offsetof(CPUX86State,fpregs[rm].mmx));
2952             gen_op_movq_env_0(offsetof(CPUX86State,xmm_regs[reg].XMM_Q(1)));
2953             break;
2954         case 0x3d6: /* movdq2q */
2955             gen_op_enter_mmx();
2956             rm = (modrm & 7) | REX_B(s);
2957             gen_op_movq(offsetof(CPUX86State,fpregs[reg & 7].mmx),
2958                         offsetof(CPUX86State,xmm_regs[rm].XMM_Q(0)));
2959             break;
2960         case 0xd7: /* pmovmskb */
2961         case 0x1d7:
2962             if (mod != 3)
2963                 goto illegal_op;
2964             if (b1) {
2965                 rm = (modrm & 7) | REX_B(s);
2966                 gen_op_pmovmskb_xmm(offsetof(CPUX86State,xmm_regs[rm]));
2967             } else {
2968                 rm = (modrm & 7);
2969                 gen_op_pmovmskb_mmx(offsetof(CPUX86State,fpregs[rm].mmx));
2970             }
2971             reg = ((modrm >> 3) & 7) | rex_r;
2972             gen_op_mov_reg_T0[OT_LONG][reg]();
2973             break;
2974         default:
2975             goto illegal_op;
2976         }
2977     } else {
2978         /* generic MMX or SSE operation */
2979         switch(b) {
2980         case 0xf7:
2981             /* maskmov : we must prepare A0 */
2982             if (mod != 3)
2983                 goto illegal_op;
2984 #ifdef TARGET_X86_64
2985             if (s->aflag == 2) {
2986                 gen_op_movq_A0_reg[R_EDI]();
2987             } else
2988 #endif
2989             {
2990                 gen_op_movl_A0_reg[R_EDI]();
2991                 if (s->aflag == 0)
2992                     gen_op_andl_A0_ffff();
2993             }
2994             gen_add_A0_ds_seg(s);
2995             break;
2996         case 0x70: /* pshufx insn */
2997         case 0xc6: /* pshufx insn */
2998         case 0xc2: /* compare insns */
2999             s->rip_offset = 1;
3000             break;
3001         default:
3002             break;
3003         }
3004         if (is_xmm) {
3005             op1_offset = offsetof(CPUX86State,xmm_regs[reg]);
3006             if (mod != 3) {
3007                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
3008                 op2_offset = offsetof(CPUX86State,xmm_t0);
3009                 if (b1 >= 2 && ((b >= 0x50 && b <= 0x5f && b != 0x5b) ||
3010                                 b == 0xc2)) {
3011                     /* specific case for SSE single instructions */
3012                     if (b1 == 2) {
3013                         /* 32 bit access */
3014                         gen_op_ld_T0_A0[OT_LONG + s->mem_index]();
3015                         gen_op_movl_env_T0(offsetof(CPUX86State,xmm_t0.XMM_L(0)));
3016                     } else {
3017                         /* 64 bit access */
3018                         gen_ldq_env_A0[s->mem_index >> 2](offsetof(CPUX86State,xmm_t0.XMM_D(0)));
3019                     }
3020                 } else {
3021                     gen_ldo_env_A0[s->mem_index >> 2](op2_offset);
3022                 }
3023             } else {
3024                 rm = (modrm & 7) | REX_B(s);
3025                 op2_offset = offsetof(CPUX86State,xmm_regs[rm]);
3026             }
3027         } else {
3028             op1_offset = offsetof(CPUX86State,fpregs[reg].mmx);
3029             if (mod != 3) {
3030                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
3031                 op2_offset = offsetof(CPUX86State,mmx_t0);
3032                 gen_ldq_env_A0[s->mem_index >> 2](op2_offset);
3033             } else {
3034                 rm = (modrm & 7);
3035                 op2_offset = offsetof(CPUX86State,fpregs[rm].mmx);
3036             }
3037         }
3038         switch(b) {
3039         case 0x70: /* pshufx insn */
3040         case 0xc6: /* pshufx insn */
3041             val = ldub_code(s->pc++);
3042             sse_op3 = (GenOpFunc3 *)sse_op2;
3043             sse_op3(op1_offset, op2_offset, val);
3044             break;
3045         case 0xc2:
3046             /* compare insns */
3047             val = ldub_code(s->pc++);
3048             if (val >= 8)
3049                 goto illegal_op;
3050             sse_op2 = sse_op_table4[val][b1];
3051             sse_op2(op1_offset, op2_offset);
3052             break;
3053         default:
3054             sse_op2(op1_offset, op2_offset);
3055             break;
3056         }
3057         if (b == 0x2e || b == 0x2f) {
3058             s->cc_op = CC_OP_EFLAGS;
3059         }
3060     }
3061 }
3062
3063
3064 /* convert one instruction. s->is_jmp is set if the translation must
3065    be stopped. Return the next pc value */
3066 static target_ulong disas_insn(DisasContext *s, target_ulong pc_start)
3067 {
3068     int b, prefixes, aflag, dflag;
3069     int shift, ot;
3070     int modrm, reg, rm, mod, reg_addr, op, opreg, offset_addr, val;
3071     target_ulong next_eip, tval;
3072     int rex_w, rex_r;
3073
3074     s->pc = pc_start;
3075     prefixes = 0;
3076     aflag = s->code32;
3077     dflag = s->code32;
3078     s->override = -1;
3079     rex_w = -1;
3080     rex_r = 0;
3081 #ifdef TARGET_X86_64
3082     s->rex_x = 0;
3083     s->rex_b = 0;
3084     x86_64_hregs = 0;
3085 #endif
3086     s->rip_offset = 0; /* for relative ip address */
3087  next_byte:
3088     b = ldub_code(s->pc);
3089     s->pc++;
3090     /* check prefixes */
3091 #ifdef TARGET_X86_64
3092     if (CODE64(s)) {
3093         switch (b) {
3094         case 0xf3:
3095             prefixes |= PREFIX_REPZ;
3096             goto next_byte;
3097         case 0xf2:
3098             prefixes |= PREFIX_REPNZ;
3099             goto next_byte;
3100         case 0xf0:
3101             prefixes |= PREFIX_LOCK;
3102             goto next_byte;
3103         case 0x2e:
3104             s->override = R_CS;
3105             goto next_byte;
3106         case 0x36:
3107             s->override = R_SS;
3108             goto next_byte;
3109         case 0x3e:
3110             s->override = R_DS;
3111             goto next_byte;
3112         case 0x26:
3113             s->override = R_ES;
3114             goto next_byte;
3115         case 0x64:
3116             s->override = R_FS;
3117             goto next_byte;
3118         case 0x65:
3119             s->override = R_GS;
3120             goto next_byte;
3121         case 0x66:
3122             prefixes |= PREFIX_DATA;
3123             goto next_byte;
3124         case 0x67:
3125             prefixes |= PREFIX_ADR;
3126             goto next_byte;
3127         case 0x40 ... 0x4f:
3128             /* REX prefix */
3129             rex_w = (b >> 3) & 1;
3130             rex_r = (b & 0x4) << 1;
3131             s->rex_x = (b & 0x2) << 2;
3132             REX_B(s) = (b & 0x1) << 3;
3133             x86_64_hregs = 1; /* select uniform byte register addressing */
3134             goto next_byte;
3135         }
3136         if (rex_w == 1) {
3137             /* 0x66 is ignored if rex.w is set */
3138             dflag = 2;
3139         } else {
3140             if (prefixes & PREFIX_DATA)
3141                 dflag ^= 1;
3142         }
3143         if (!(prefixes & PREFIX_ADR))
3144             aflag = 2;
3145     } else
3146 #endif
3147     {
3148         switch (b) {
3149         case 0xf3:
3150             prefixes |= PREFIX_REPZ;
3151             goto next_byte;
3152         case 0xf2:
3153             prefixes |= PREFIX_REPNZ;
3154             goto next_byte;
3155         case 0xf0:
3156             prefixes |= PREFIX_LOCK;
3157             goto next_byte;
3158         case 0x2e:
3159             s->override = R_CS;
3160             goto next_byte;
3161         case 0x36:
3162             s->override = R_SS;
3163             goto next_byte;
3164         case 0x3e:
3165             s->override = R_DS;
3166             goto next_byte;
3167         case 0x26:
3168             s->override = R_ES;
3169             goto next_byte;
3170         case 0x64:
3171             s->override = R_FS;
3172             goto next_byte;
3173         case 0x65:
3174             s->override = R_GS;
3175             goto next_byte;
3176         case 0x66:
3177             prefixes |= PREFIX_DATA;
3178             goto next_byte;
3179         case 0x67:
3180             prefixes |= PREFIX_ADR;
3181             goto next_byte;
3182         }
3183         if (prefixes & PREFIX_DATA)
3184             dflag ^= 1;
3185         if (prefixes & PREFIX_ADR)
3186             aflag ^= 1;
3187     }
3188
3189     s->prefix = prefixes;
3190     s->aflag = aflag;
3191     s->dflag = dflag;
3192
3193     /* lock generation */
3194     if (prefixes & PREFIX_LOCK)
3195         gen_op_lock();
3196
3197     /* now check op code */
3198  reswitch:
3199     switch(b) {
3200     case 0x0f:
3201         /**************************/
3202         /* extended op code */
3203         b = ldub_code(s->pc++) | 0x100;
3204         goto reswitch;
3205
3206         /**************************/
3207         /* arith & logic */
3208     case 0x00 ... 0x05:
3209     case 0x08 ... 0x0d:
3210     case 0x10 ... 0x15:
3211     case 0x18 ... 0x1d:
3212     case 0x20 ... 0x25:
3213     case 0x28 ... 0x2d:
3214     case 0x30 ... 0x35:
3215     case 0x38 ... 0x3d:
3216         {
3217             int op, f, val;
3218             op = (b >> 3) & 7;
3219             f = (b >> 1) & 3;
3220
3221             if ((b & 1) == 0)
3222                 ot = OT_BYTE;
3223             else
3224                 ot = dflag + OT_WORD;
3225
3226             switch(f) {
3227             case 0: /* OP Ev, Gv */
3228                 modrm = ldub_code(s->pc++);
3229                 reg = ((modrm >> 3) & 7) | rex_r;
3230                 mod = (modrm >> 6) & 3;
3231                 rm = (modrm & 7) | REX_B(s);
3232                 if (mod != 3) {
3233                     gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
3234                     opreg = OR_TMP0;
3235                 } else if (op == OP_XORL && rm == reg) {
3236                 xor_zero:
3237                     /* xor reg, reg optimisation */
3238                     gen_op_movl_T0_0();
3239                     s->cc_op = CC_OP_LOGICB + ot;
3240                     gen_op_mov_reg_T0[ot][reg]();
3241                     gen_op_update1_cc();
3242                     break;
3243                 } else {
3244                     opreg = rm;
3245                 }
3246                 gen_op_mov_TN_reg[ot][1][reg]();
3247                 gen_op(s, op, ot, opreg);
3248                 break;
3249             case 1: /* OP Gv, Ev */
3250                 modrm = ldub_code(s->pc++);
3251                 mod = (modrm >> 6) & 3;
3252                 reg = ((modrm >> 3) & 7) | rex_r;
3253                 rm = (modrm & 7) | REX_B(s);
3254                 if (mod != 3) {
3255                     gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
3256                     gen_op_ld_T1_A0[ot + s->mem_index]();
3257                 } else if (op == OP_XORL && rm == reg) {
3258                     goto xor_zero;
3259                 } else {
3260                     gen_op_mov_TN_reg[ot][1][rm]();
3261                 }
3262                 gen_op(s, op, ot, reg);
3263                 break;
3264             case 2: /* OP A, Iv */
3265                 val = insn_get(s, ot);
3266                 gen_op_movl_T1_im(val);
3267                 gen_op(s, op, ot, OR_EAX);
3268                 break;
3269             }
3270         }
3271         break;
3272
3273     case 0x80: /* GRP1 */
3274     case 0x81:
3275     case 0x82:
3276     case 0x83:
3277         {
3278             int val;
3279
3280             if ((b & 1) == 0)
3281                 ot = OT_BYTE;
3282             else
3283                 ot = dflag + OT_WORD;
3284
3285             modrm = ldub_code(s->pc++);
3286             mod = (modrm >> 6) & 3;
3287             rm = (modrm & 7) | REX_B(s);
3288             op = (modrm >> 3) & 7;
3289
3290             if (mod != 3) {
3291                 if (b == 0x83)
3292                     s->rip_offset = 1;
3293                 else
3294                     s->rip_offset = insn_const_size(ot);
3295                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
3296                 opreg = OR_TMP0;
3297             } else {
3298                 opreg = rm;
3299             }
3300
3301             switch(b) {
3302             default:
3303             case 0x80:
3304             case 0x81:
3305             case 0x82:
3306                 val = insn_get(s, ot);
3307                 break;
3308             case 0x83:
3309                 val = (int8_t)insn_get(s, OT_BYTE);
3310                 break;
3311             }
3312             gen_op_movl_T1_im(val);
3313             gen_op(s, op, ot, opreg);
3314         }
3315         break;
3316
3317         /**************************/
3318         /* inc, dec, and other misc arith */
3319     case 0x40 ... 0x47: /* inc Gv */
3320         ot = dflag ? OT_LONG : OT_WORD;
3321         gen_inc(s, ot, OR_EAX + (b & 7), 1);
3322         break;
3323     case 0x48 ... 0x4f: /* dec Gv */
3324         ot = dflag ? OT_LONG : OT_WORD;
3325         gen_inc(s, ot, OR_EAX + (b & 7), -1);
3326         break;
3327     case 0xf6: /* GRP3 */
3328     case 0xf7:
3329         if ((b & 1) == 0)
3330             ot = OT_BYTE;
3331         else
3332             ot = dflag + OT_WORD;
3333
3334         modrm = ldub_code(s->pc++);
3335         mod = (modrm >> 6) & 3;
3336         rm = (modrm & 7) | REX_B(s);
3337         op = (modrm >> 3) & 7;
3338         if (mod != 3) {
3339             if (op == 0)
3340                 s->rip_offset = insn_const_size(ot);
3341             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
3342             gen_op_ld_T0_A0[ot + s->mem_index]();
3343         } else {
3344             gen_op_mov_TN_reg[ot][0][rm]();
3345         }
3346
3347         switch(op) {
3348         case 0: /* test */
3349             val = insn_get(s, ot);
3350             gen_op_movl_T1_im(val);
3351             gen_op_testl_T0_T1_cc();
3352             s->cc_op = CC_OP_LOGICB + ot;
3353             break;
3354         case 2: /* not */
3355             gen_op_notl_T0();
3356             if (mod != 3) {
3357                 gen_op_st_T0_A0[ot + s->mem_index]();
3358             } else {
3359                 gen_op_mov_reg_T0[ot][rm]();
3360             }
3361             break;
3362         case 3: /* neg */
3363             gen_op_negl_T0();
3364             if (mod != 3) {
3365                 gen_op_st_T0_A0[ot + s->mem_index]();
3366             } else {
3367                 gen_op_mov_reg_T0[ot][rm]();
3368             }
3369             gen_op_update_neg_cc();
3370             s->cc_op = CC_OP_SUBB + ot;
3371             break;
3372         case 4: /* mul */
3373             switch(ot) {
3374             case OT_BYTE:
3375                 gen_op_mulb_AL_T0();
3376                 s->cc_op = CC_OP_MULB;
3377                 break;
3378             case OT_WORD:
3379                 gen_op_mulw_AX_T0();
3380                 s->cc_op = CC_OP_MULW;
3381                 break;
3382             default:
3383             case OT_LONG:
3384                 gen_op_mull_EAX_T0();
3385                 s->cc_op = CC_OP_MULL;
3386                 break;
3387 #ifdef TARGET_X86_64
3388             case OT_QUAD:
3389                 gen_op_mulq_EAX_T0();
3390                 s->cc_op = CC_OP_MULQ;
3391                 break;
3392 #endif
3393             }
3394             break;
3395         case 5: /* imul */
3396             switch(ot) {
3397             case OT_BYTE:
3398                 gen_op_imulb_AL_T0();
3399                 s->cc_op = CC_OP_MULB;
3400                 break;
3401             case OT_WORD:
3402                 gen_op_imulw_AX_T0();
3403                 s->cc_op = CC_OP_MULW;
3404                 break;
3405             default:
3406             case OT_LONG:
3407                 gen_op_imull_EAX_T0();
3408                 s->cc_op = CC_OP_MULL;
3409                 break;
3410 #ifdef TARGET_X86_64
3411             case OT_QUAD:
3412                 gen_op_imulq_EAX_T0();
3413                 s->cc_op = CC_OP_MULQ;
3414                 break;
3415 #endif
3416             }
3417             break;
3418         case 6: /* div */
3419             switch(ot) {
3420             case OT_BYTE:
3421                 gen_jmp_im(pc_start - s->cs_base);
3422                 gen_op_divb_AL_T0();
3423                 break;
3424             case OT_WORD:
3425                 gen_jmp_im(pc_start - s->cs_base);
3426                 gen_op_divw_AX_T0();
3427                 break;
3428             default:
3429             case OT_LONG:
3430                 gen_jmp_im(pc_start - s->cs_base);
3431                 gen_op_divl_EAX_T0();
3432                 break;
3433 #ifdef TARGET_X86_64
3434             case OT_QUAD:
3435                 gen_jmp_im(pc_start - s->cs_base);
3436                 gen_op_divq_EAX_T0();
3437                 break;
3438 #endif
3439             }
3440             break;
3441         case 7: /* idiv */
3442             switch(ot) {
3443             case OT_BYTE:
3444                 gen_jmp_im(pc_start - s->cs_base);
3445                 gen_op_idivb_AL_T0();
3446                 break;
3447             case OT_WORD:
3448                 gen_jmp_im(pc_start - s->cs_base);
3449                 gen_op_idivw_AX_T0();
3450                 break;
3451             default:
3452             case OT_LONG:
3453                 gen_jmp_im(pc_start - s->cs_base);
3454                 gen_op_idivl_EAX_T0();
3455                 break;
3456 #ifdef TARGET_X86_64
3457             case OT_QUAD:
3458                 gen_jmp_im(pc_start - s->cs_base);
3459                 gen_op_idivq_EAX_T0();
3460                 break;
3461 #endif
3462             }
3463             break;
3464         default:
3465             goto illegal_op;
3466         }
3467         break;
3468
3469     case 0xfe: /* GRP4 */
3470     case 0xff: /* GRP5 */
3471         if ((b & 1) == 0)
3472             ot = OT_BYTE;
3473         else
3474             ot = dflag + OT_WORD;
3475
3476         modrm = ldub_code(s->pc++);
3477         mod = (modrm >> 6) & 3;
3478         rm = (modrm & 7) | REX_B(s);
3479         op = (modrm >> 3) & 7;
3480         if (op >= 2 && b == 0xfe) {
3481             goto illegal_op;
3482         }
3483         if (CODE64(s)) {
3484             if (op == 2 || op == 4) {
3485                 /* operand size for jumps is 64 bit */
3486                 ot = OT_QUAD;
3487             } else if (op == 3 || op == 5) {
3488                 /* for call calls, the operand is 16 or 32 bit, even
3489                    in long mode */
3490                 ot = dflag ? OT_LONG : OT_WORD;
3491             } else if (op == 6) {
3492                 /* default push size is 64 bit */
3493                 ot = dflag ? OT_QUAD : OT_WORD;
3494             }
3495         }
3496         if (mod != 3) {
3497             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
3498             if (op >= 2 && op != 3 && op != 5)
3499                 gen_op_ld_T0_A0[ot + s->mem_index]();
3500         } else {
3501             gen_op_mov_TN_reg[ot][0][rm]();
3502         }
3503
3504         switch(op) {
3505         case 0: /* inc Ev */
3506             if (mod != 3)
3507                 opreg = OR_TMP0;
3508             else
3509                 opreg = rm;
3510             gen_inc(s, ot, opreg, 1);
3511             break;
3512         case 1: /* dec Ev */
3513             if (mod != 3)
3514                 opreg = OR_TMP0;
3515             else
3516                 opreg = rm;
3517             gen_inc(s, ot, opreg, -1);
3518             break;
3519         case 2: /* call Ev */
3520             /* XXX: optimize if memory (no 'and' is necessary) */
3521             if (s->dflag == 0)
3522                 gen_op_andl_T0_ffff();
3523             next_eip = s->pc - s->cs_base;
3524             gen_movtl_T1_im(next_eip);
3525             gen_push_T1(s);
3526             gen_op_jmp_T0();
3527             gen_eob(s);
3528             break;
3529         case 3: /* lcall Ev */
3530             gen_op_ld_T1_A0[ot + s->mem_index]();
3531             gen_add_A0_im(s, 1 << (ot - OT_WORD + 1));
3532             gen_op_ldu_T0_A0[OT_WORD + s->mem_index]();
3533         do_lcall:
3534             if (s->pe && !s->vm86) {
3535                 if (s->cc_op != CC_OP_DYNAMIC)
3536                     gen_op_set_cc_op(s->cc_op);
3537                 gen_jmp_im(pc_start - s->cs_base);
3538                 gen_op_lcall_protected_T0_T1(dflag, s->pc - pc_start);
3539             } else {
3540                 gen_op_lcall_real_T0_T1(dflag, s->pc - s->cs_base);
3541             }
3542             gen_eob(s);
3543             break;
3544         case 4: /* jmp Ev */
3545             if (s->dflag == 0)
3546                 gen_op_andl_T0_ffff();
3547             gen_op_jmp_T0();
3548             gen_eob(s);
3549             break;
3550         case 5: /* ljmp Ev */
3551             gen_op_ld_T1_A0[ot + s->mem_index]();
3552             gen_add_A0_im(s, 1 << (ot - OT_WORD + 1));
3553             gen_op_ldu_T0_A0[OT_WORD + s->mem_index]();
3554         do_ljmp:
3555             if (s->pe && !s->vm86) {
3556                 if (s->cc_op != CC_OP_DYNAMIC)
3557                     gen_op_set_cc_op(s->cc_op);
3558                 gen_jmp_im(pc_start - s->cs_base);
3559                 gen_op_ljmp_protected_T0_T1(s->pc - pc_start);
3560             } else {
3561                 gen_op_movl_seg_T0_vm(offsetof(CPUX86State,segs[R_CS]));
3562                 gen_op_movl_T0_T1();
3563                 gen_op_jmp_T0();
3564             }
3565             gen_eob(s);
3566             break;
3567         case 6: /* push Ev */
3568             gen_push_T0(s);
3569             break;
3570         default:
3571             goto illegal_op;
3572         }
3573         break;
3574
3575     case 0x84: /* test Ev, Gv */
3576     case 0x85:
3577         if ((b & 1) == 0)
3578             ot = OT_BYTE;
3579         else
3580             ot = dflag + OT_WORD;
3581
3582         modrm = ldub_code(s->pc++);
3583         mod = (modrm >> 6) & 3;
3584         rm = (modrm & 7) | REX_B(s);
3585         reg = ((modrm >> 3) & 7) | rex_r;
3586
3587         gen_ldst_modrm(s, modrm, ot, OR_TMP0, 0);
3588         gen_op_mov_TN_reg[ot][1][reg]();
3589         gen_op_testl_T0_T1_cc();
3590         s->cc_op = CC_OP_LOGICB + ot;
3591         break;
3592
3593     case 0xa8: /* test eAX, Iv */
3594     case 0xa9:
3595         if ((b & 1) == 0)
3596             ot = OT_BYTE;
3597         else
3598             ot = dflag + OT_WORD;
3599         val = insn_get(s, ot);
3600
3601         gen_op_mov_TN_reg[ot][0][OR_EAX]();
3602         gen_op_movl_T1_im(val);
3603         gen_op_testl_T0_T1_cc();
3604         s->cc_op = CC_OP_LOGICB + ot;
3605         break;
3606
3607     case 0x98: /* CWDE/CBW */
3608 #ifdef TARGET_X86_64
3609         if (dflag == 2) {
3610             gen_op_movslq_RAX_EAX();
3611         } else
3612 #endif
3613         if (dflag == 1)
3614             gen_op_movswl_EAX_AX();
3615         else
3616             gen_op_movsbw_AX_AL();
3617         break;
3618     case 0x99: /* CDQ/CWD */
3619 #ifdef TARGET_X86_64
3620         if (dflag == 2) {
3621             gen_op_movsqo_RDX_RAX();
3622         } else
3623 #endif
3624         if (dflag == 1)
3625             gen_op_movslq_EDX_EAX();
3626         else
3627             gen_op_movswl_DX_AX();
3628         break;
3629     case 0x1af: /* imul Gv, Ev */
3630     case 0x69: /* imul Gv, Ev, I */
3631     case 0x6b:
3632         ot = dflag + OT_WORD;
3633         modrm = ldub_code(s->pc++);
3634         reg = ((modrm >> 3) & 7) | rex_r;
3635         if (b == 0x69)
3636             s->rip_offset = insn_const_size(ot);
3637         else if (b == 0x6b)
3638             s->rip_offset = 1;
3639         gen_ldst_modrm(s, modrm, ot, OR_TMP0, 0);
3640         if (b == 0x69) {
3641             val = insn_get(s, ot);
3642             gen_op_movl_T1_im(val);
3643         } else if (b == 0x6b) {
3644             val = (int8_t)insn_get(s, OT_BYTE);
3645             gen_op_movl_T1_im(val);
3646         } else {
3647             gen_op_mov_TN_reg[ot][1][reg]();
3648         }
3649
3650 #ifdef TARGET_X86_64
3651         if (ot == OT_QUAD) {
3652             gen_op_imulq_T0_T1();
3653         } else
3654 #endif
3655         if (ot == OT_LONG) {
3656             gen_op_imull_T0_T1();
3657         } else {
3658             gen_op_imulw_T0_T1();
3659         }
3660         gen_op_mov_reg_T0[ot][reg]();
3661         s->cc_op = CC_OP_MULB + ot;
3662         break;
3663     case 0x1c0:
3664     case 0x1c1: /* xadd Ev, Gv */
3665         if ((b & 1) == 0)
3666             ot = OT_BYTE;
3667         else
3668             ot = dflag + OT_WORD;
3669         modrm = ldub_code(s->pc++);
3670         reg = ((modrm >> 3) & 7) | rex_r;
3671         mod = (modrm >> 6) & 3;
3672         if (mod == 3) {
3673             rm = (modrm & 7) | REX_B(s);
3674             gen_op_mov_TN_reg[ot][0][reg]();
3675             gen_op_mov_TN_reg[ot][1][rm]();
3676             gen_op_addl_T0_T1();
3677             gen_op_mov_reg_T1[ot][reg]();
3678             gen_op_mov_reg_T0[ot][rm]();
3679         } else {
3680             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
3681             gen_op_mov_TN_reg[ot][0][reg]();
3682             gen_op_ld_T1_A0[ot + s->mem_index]();
3683             gen_op_addl_T0_T1();
3684             gen_op_st_T0_A0[ot + s->mem_index]();
3685             gen_op_mov_reg_T1[ot][reg]();
3686         }
3687         gen_op_update2_cc();
3688         s->cc_op = CC_OP_ADDB + ot;
3689         break;
3690     case 0x1b0:
3691     case 0x1b1: /* cmpxchg Ev, Gv */
3692         if ((b & 1) == 0)
3693             ot = OT_BYTE;
3694         else
3695             ot = dflag + OT_WORD;
3696         modrm = ldub_code(s->pc++);
3697         reg = ((modrm >> 3) & 7) | rex_r;
3698         mod = (modrm >> 6) & 3;
3699         gen_op_mov_TN_reg[ot][1][reg]();
3700         if (mod == 3) {
3701             rm = (modrm & 7) | REX_B(s);
3702             gen_op_mov_TN_reg[ot][0][rm]();
3703             gen_op_cmpxchg_T0_T1_EAX_cc[ot]();
3704             gen_op_mov_reg_T0[ot][rm]();
3705         } else {
3706             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
3707             gen_op_ld_T0_A0[ot + s->mem_index]();
3708             gen_op_cmpxchg_mem_T0_T1_EAX_cc[ot + s->mem_index]();
3709         }
3710         s->cc_op = CC_OP_SUBB + ot;
3711         break;
3712     case 0x1c7: /* cmpxchg8b */
3713         modrm = ldub_code(s->pc++);
3714         mod = (modrm >> 6) & 3;
3715         if (mod == 3)
3716             goto illegal_op;
3717         if (s->cc_op != CC_OP_DYNAMIC)
3718             gen_op_set_cc_op(s->cc_op);
3719         gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
3720         gen_op_cmpxchg8b();
3721         s->cc_op = CC_OP_EFLAGS;
3722         break;
3723
3724         /**************************/
3725         /* push/pop */
3726     case 0x50 ... 0x57: /* push */
3727         gen_op_mov_TN_reg[OT_LONG][0][(b & 7) | REX_B(s)]();
3728         gen_push_T0(s);
3729         break;
3730     case 0x58 ... 0x5f: /* pop */
3731         if (CODE64(s)) {
3732             ot = dflag ? OT_QUAD : OT_WORD;
3733         } else {
3734             ot = dflag + OT_WORD;
3735         }
3736         gen_pop_T0(s);
3737         /* NOTE: order is important for pop %sp */
3738         gen_pop_update(s);
3739         gen_op_mov_reg_T0[ot][(b & 7) | REX_B(s)]();
3740         break;
3741     case 0x60: /* pusha */
3742         if (CODE64(s))
3743             goto illegal_op;
3744         gen_pusha(s);
3745         break;
3746     case 0x61: /* popa */
3747         if (CODE64(s))
3748             goto illegal_op;
3749         gen_popa(s);
3750         break;
3751     case 0x68: /* push Iv */
3752     case 0x6a:
3753         if (CODE64(s)) {
3754             ot = dflag ? OT_QUAD : OT_WORD;
3755         } else {
3756             ot = dflag + OT_WORD;
3757         }
3758         if (b == 0x68)
3759             val = insn_get(s, ot);
3760         else
3761             val = (int8_t)insn_get(s, OT_BYTE);
3762         gen_op_movl_T0_im(val);
3763         gen_push_T0(s);
3764         break;
3765     case 0x8f: /* pop Ev */
3766         if (CODE64(s)) {
3767             ot = dflag ? OT_QUAD : OT_WORD;
3768         } else {
3769             ot = dflag + OT_WORD;
3770         }
3771         modrm = ldub_code(s->pc++);
3772         mod = (modrm >> 6) & 3;
3773         gen_pop_T0(s);
3774         if (mod == 3) {
3775             /* NOTE: order is important for pop %sp */
3776             gen_pop_update(s);
3777             rm = (modrm & 7) | REX_B(s);
3778             gen_op_mov_reg_T0[ot][rm]();
3779         } else {
3780             /* NOTE: order is important too for MMU exceptions */
3781             s->popl_esp_hack = 1 << ot;
3782             gen_ldst_modrm(s, modrm, ot, OR_TMP0, 1);
3783             s->popl_esp_hack = 0;
3784             gen_pop_update(s);
3785         }
3786         break;
3787     case 0xc8: /* enter */
3788         {
3789             int level;
3790             val = lduw_code(s->pc);
3791             s->pc += 2;
3792             level = ldub_code(s->pc++);
3793             gen_enter(s, val, level);
3794         }
3795         break;
3796     case 0xc9: /* leave */
3797         /* XXX: exception not precise (ESP is updated before potential exception) */
3798         if (CODE64(s)) {
3799             gen_op_mov_TN_reg[OT_QUAD][0][R_EBP]();
3800             gen_op_mov_reg_T0[OT_QUAD][R_ESP]();
3801         } else if (s->ss32) {
3802             gen_op_mov_TN_reg[OT_LONG][0][R_EBP]();
3803             gen_op_mov_reg_T0[OT_LONG][R_ESP]();
3804         } else {
3805             gen_op_mov_TN_reg[OT_WORD][0][R_EBP]();
3806             gen_op_mov_reg_T0[OT_WORD][R_ESP]();
3807         }
3808         gen_pop_T0(s);
3809         if (CODE64(s)) {
3810             ot = dflag ? OT_QUAD : OT_WORD;
3811         } else {
3812             ot = dflag + OT_WORD;
3813         }
3814         gen_op_mov_reg_T0[ot][R_EBP]();
3815         gen_pop_update(s);
3816         break;
3817     case 0x06: /* push es */
3818     case 0x0e: /* push cs */
3819     case 0x16: /* push ss */
3820     case 0x1e: /* push ds */
3821         if (CODE64(s))
3822             goto illegal_op;
3823         gen_op_movl_T0_seg(b >> 3);
3824         gen_push_T0(s);
3825         break;
3826     case 0x1a0: /* push fs */
3827     case 0x1a8: /* push gs */
3828         gen_op_movl_T0_seg((b >> 3) & 7);
3829         gen_push_T0(s);
3830         break;
3831     case 0x07: /* pop es */
3832     case 0x17: /* pop ss */
3833     case 0x1f: /* pop ds */
3834         if (CODE64(s))
3835             goto illegal_op;
3836         reg = b >> 3;
3837         gen_pop_T0(s);
3838         gen_movl_seg_T0(s, reg, pc_start - s->cs_base);
3839         gen_pop_update(s);
3840         if (reg == R_SS) {
3841             /* if reg == SS, inhibit interrupts/trace. */
3842             /* If several instructions disable interrupts, only the
3843                _first_ does it */
3844             if (!(s->tb->flags & HF_INHIBIT_IRQ_MASK))
3845                 gen_op_set_inhibit_irq();
3846             s->tf = 0;
3847         }
3848         if (s->is_jmp) {
3849             gen_jmp_im(s->pc - s->cs_base);
3850             gen_eob(s);
3851         }
3852         break;
3853     case 0x1a1: /* pop fs */
3854     case 0x1a9: /* pop gs */
3855         gen_pop_T0(s);
3856         gen_movl_seg_T0(s, (b >> 3) & 7, pc_start - s->cs_base);
3857         gen_pop_update(s);
3858         if (s->is_jmp) {
3859             gen_jmp_im(s->pc - s->cs_base);
3860             gen_eob(s);
3861         }
3862         break;
3863
3864         /**************************/
3865         /* mov */
3866     case 0x88:
3867     case 0x89: /* mov Gv, Ev */
3868         if ((b & 1) == 0)
3869             ot = OT_BYTE;
3870         else
3871             ot = dflag + OT_WORD;
3872         modrm = ldub_code(s->pc++);
3873         reg = ((modrm >> 3) & 7) | rex_r;
3874
3875         /* generate a generic store */
3876         gen_ldst_modrm(s, modrm, ot, reg, 1);
3877         break;
3878     case 0xc6:
3879     case 0xc7: /* mov Ev, Iv */
3880         if ((b & 1) == 0)
3881             ot = OT_BYTE;
3882         else
3883             ot = dflag + OT_WORD;
3884         modrm = ldub_code(s->pc++);
3885         mod = (modrm >> 6) & 3;
3886         if (mod != 3) {
3887             s->rip_offset = insn_const_size(ot);
3888             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
3889         }
3890         val = insn_get(s, ot);
3891         gen_op_movl_T0_im(val);
3892         if (mod != 3)
3893             gen_op_st_T0_A0[ot + s->mem_index]();
3894         else
3895             gen_op_mov_reg_T0[ot][(modrm & 7) | REX_B(s)]();
3896         break;
3897     case 0x8a:
3898     case 0x8b: /* mov Ev, Gv */
3899         if ((b & 1) == 0)
3900             ot = OT_BYTE;
3901         else
3902             ot = OT_WORD + dflag;
3903         modrm = ldub_code(s->pc++);
3904         reg = ((modrm >> 3) & 7) | rex_r;
3905
3906         gen_ldst_modrm(s, modrm, ot, OR_TMP0, 0);
3907         gen_op_mov_reg_T0[ot][reg]();
3908         break;
3909     case 0x8e: /* mov seg, Gv */
3910         modrm = ldub_code(s->pc++);
3911         reg = (modrm >> 3) & 7;
3912         if (reg >= 6 || reg == R_CS)
3913             goto illegal_op;
3914         gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0);
3915         gen_movl_seg_T0(s, reg, pc_start - s->cs_base);
3916         if (reg == R_SS) {
3917             /* if reg == SS, inhibit interrupts/trace */
3918             /* If several instructions disable interrupts, only the
3919                _first_ does it */
3920             if (!(s->tb->flags & HF_INHIBIT_IRQ_MASK))
3921                 gen_op_set_inhibit_irq();
3922             s->tf = 0;
3923         }
3924         if (s->is_jmp) {
3925             gen_jmp_im(s->pc - s->cs_base);
3926             gen_eob(s);
3927         }
3928         break;
3929     case 0x8c: /* mov Gv, seg */
3930         modrm = ldub_code(s->pc++);
3931         reg = (modrm >> 3) & 7;
3932         mod = (modrm >> 6) & 3;
3933         if (reg >= 6)
3934             goto illegal_op;
3935         gen_op_movl_T0_seg(reg);
3936         if (mod == 3)
3937             ot = OT_WORD + dflag;
3938         else
3939             ot = OT_WORD;
3940         gen_ldst_modrm(s, modrm, ot, OR_TMP0, 1);
3941         break;
3942
3943     case 0x1b6: /* movzbS Gv, Eb */
3944     case 0x1b7: /* movzwS Gv, Eb */
3945     case 0x1be: /* movsbS Gv, Eb */
3946     case 0x1bf: /* movswS Gv, Eb */
3947         {
3948             int d_ot;
3949             /* d_ot is the size of destination */
3950             d_ot = dflag + OT_WORD;
3951             /* ot is the size of source */
3952             ot = (b & 1) + OT_BYTE;
3953             modrm = ldub_code(s->pc++);
3954             reg = ((modrm >> 3) & 7) | rex_r;
3955             mod = (modrm >> 6) & 3;
3956             rm = (modrm & 7) | REX_B(s);
3957
3958             if (mod == 3) {
3959                 gen_op_mov_TN_reg[ot][0][rm]();
3960                 switch(ot | (b & 8)) {
3961                 case OT_BYTE:
3962                     gen_op_movzbl_T0_T0();
3963                     break;
3964                 case OT_BYTE | 8:
3965                     gen_op_movsbl_T0_T0();
3966                     break;
3967                 case OT_WORD:
3968                     gen_op_movzwl_T0_T0();
3969                     break;
3970                 default:
3971                 case OT_WORD | 8:
3972                     gen_op_movswl_T0_T0();
3973                     break;
3974                 }
3975                 gen_op_mov_reg_T0[d_ot][reg]();
3976             } else {
3977                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
3978                 if (b & 8) {
3979                     gen_op_lds_T0_A0[ot + s->mem_index]();
3980                 } else {
3981                     gen_op_ldu_T0_A0[ot + s->mem_index]();
3982                 }
3983                 gen_op_mov_reg_T0[d_ot][reg]();
3984             }
3985         }
3986         break;
3987
3988     case 0x8d: /* lea */
3989         ot = dflag + OT_WORD;
3990         modrm = ldub_code(s->pc++);
3991         mod = (modrm >> 6) & 3;
3992         if (mod == 3)
3993             goto illegal_op;
3994         reg = ((modrm >> 3) & 7) | rex_r;
3995         /* we must ensure that no segment is added */
3996         s->override = -1;
3997         val = s->addseg;
3998         s->addseg = 0;
3999         gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
4000         s->addseg = val;
4001         gen_op_mov_reg_A0[ot - OT_WORD][reg]();
4002         break;
4003
4004     case 0xa0: /* mov EAX, Ov */
4005     case 0xa1:
4006     case 0xa2: /* mov Ov, EAX */
4007     case 0xa3:
4008         {
4009             target_ulong offset_addr;
4010
4011             if ((b & 1) == 0)
4012                 ot = OT_BYTE;
4013             else
4014                 ot = dflag + OT_WORD;
4015 #ifdef TARGET_X86_64
4016             if (s->aflag == 2) {
4017                 offset_addr = ldq_code(s->pc);
4018                 s->pc += 8;
4019                 if (offset_addr == (int32_t)offset_addr)
4020                     gen_op_movq_A0_im(offset_addr);
4021                 else
4022                     gen_op_movq_A0_im64(offset_addr >> 32, offset_addr);
4023             } else
4024 #endif
4025             {
4026                 if (s->aflag) {
4027                     offset_addr = insn_get(s, OT_LONG);
4028                 } else {
4029                     offset_addr = insn_get(s, OT_WORD);
4030                 }
4031                 gen_op_movl_A0_im(offset_addr);
4032             }
4033             gen_add_A0_ds_seg(s);
4034             if ((b & 2) == 0) {
4035                 gen_op_ld_T0_A0[ot + s->mem_index]();
4036                 gen_op_mov_reg_T0[ot][R_EAX]();
4037             } else {
4038                 gen_op_mov_TN_reg[ot][0][R_EAX]();
4039                 gen_op_st_T0_A0[ot + s->mem_index]();
4040             }
4041         }
4042         break;
4043     case 0xd7: /* xlat */
4044 #ifdef TARGET_X86_64
4045         if (s->aflag == 2) {
4046             gen_op_movq_A0_reg[R_EBX]();
4047             gen_op_addq_A0_AL();
4048         } else
4049 #endif
4050         {
4051             gen_op_movl_A0_reg[R_EBX]();
4052             gen_op_addl_A0_AL();
4053             if (s->aflag == 0)
4054                 gen_op_andl_A0_ffff();
4055         }
4056         gen_add_A0_ds_seg(s);
4057         gen_op_ldu_T0_A0[OT_BYTE + s->mem_index]();
4058         gen_op_mov_reg_T0[OT_BYTE][R_EAX]();
4059         break;
4060     case 0xb0 ... 0xb7: /* mov R, Ib */
4061         val = insn_get(s, OT_BYTE);
4062         gen_op_movl_T0_im(val);
4063         gen_op_mov_reg_T0[OT_BYTE][(b & 7) | REX_B(s)]();
4064         break;
4065     case 0xb8 ... 0xbf: /* mov R, Iv */
4066 #ifdef TARGET_X86_64
4067         if (dflag == 2) {
4068             uint64_t tmp;
4069             /* 64 bit case */
4070             tmp = ldq_code(s->pc);
4071             s->pc += 8;
4072             reg = (b & 7) | REX_B(s);
4073             gen_movtl_T0_im(tmp);
4074             gen_op_mov_reg_T0[OT_QUAD][reg]();
4075         } else
4076 #endif
4077         {
4078             ot = dflag ? OT_LONG : OT_WORD;
4079             val = insn_get(s, ot);
4080             reg = (b & 7) | REX_B(s);
4081             gen_op_movl_T0_im(val);
4082             gen_op_mov_reg_T0[ot][reg]();
4083         }
4084         break;
4085
4086     case 0x91 ... 0x97: /* xchg R, EAX */
4087         ot = dflag + OT_WORD;
4088         reg = (b & 7) | REX_B(s);
4089         rm = R_EAX;
4090         goto do_xchg_reg;
4091     case 0x86:
4092     case 0x87: /* xchg Ev, Gv */
4093         if ((b & 1) == 0)
4094             ot = OT_BYTE;
4095         else
4096             ot = dflag + OT_WORD;
4097         modrm = ldub_code(s->pc++);
4098         reg = ((modrm >> 3) & 7) | rex_r;
4099         mod = (modrm >> 6) & 3;
4100         if (mod == 3) {
4101             rm = (modrm & 7) | REX_B(s);
4102         do_xchg_reg:
4103             gen_op_mov_TN_reg[ot][0][reg]();
4104             gen_op_mov_TN_reg[ot][1][rm]();
4105             gen_op_mov_reg_T0[ot][rm]();
4106             gen_op_mov_reg_T1[ot][reg]();
4107         } else {
4108             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
4109             gen_op_mov_TN_reg[ot][0][reg]();
4110             /* for xchg, lock is implicit */
4111             if (!(prefixes & PREFIX_LOCK))
4112                 gen_op_lock();
4113             gen_op_ld_T1_A0[ot + s->mem_index]();
4114             gen_op_st_T0_A0[ot + s->mem_index]();
4115             if (!(prefixes & PREFIX_LOCK))
4116                 gen_op_unlock();
4117             gen_op_mov_reg_T1[ot][reg]();
4118         }
4119         break;
4120     case 0xc4: /* les Gv */
4121         if (CODE64(s))
4122             goto illegal_op;
4123         op = R_ES;
4124         goto do_lxx;
4125     case 0xc5: /* lds Gv */
4126         if (CODE64(s))
4127             goto illegal_op;
4128         op = R_DS;
4129         goto do_lxx;
4130     case 0x1b2: /* lss Gv */
4131         op = R_SS;
4132         goto do_lxx;
4133     case 0x1b4: /* lfs Gv */
4134         op = R_FS;
4135         goto do_lxx;
4136     case 0x1b5: /* lgs Gv */
4137         op = R_GS;
4138     do_lxx:
4139         ot = dflag ? OT_LONG : OT_WORD;
4140         modrm = ldub_code(s->pc++);
4141         reg = ((modrm >> 3) & 7) | rex_r;
4142         mod = (modrm >> 6) & 3;
4143         if (mod == 3)
4144             goto illegal_op;
4145         gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
4146         gen_op_ld_T1_A0[ot + s->mem_index]();
4147         gen_add_A0_im(s, 1 << (ot - OT_WORD + 1));
4148         /* load the segment first to handle exceptions properly */
4149         gen_op_ldu_T0_A0[OT_WORD + s->mem_index]();
4150         gen_movl_seg_T0(s, op, pc_start - s->cs_base);
4151         /* then put the data */
4152         gen_op_mov_reg_T1[ot][reg]();
4153         if (s->is_jmp) {
4154             gen_jmp_im(s->pc - s->cs_base);
4155             gen_eob(s);
4156         }
4157         break;
4158
4159         /************************/
4160         /* shifts */
4161     case 0xc0:
4162     case 0xc1:
4163         /* shift Ev,Ib */
4164         shift = 2;
4165     grp2:
4166         {
4167             if ((b & 1) == 0)
4168                 ot = OT_BYTE;
4169             else
4170                 ot = dflag + OT_WORD;
4171
4172             modrm = ldub_code(s->pc++);
4173             mod = (modrm >> 6) & 3;
4174             op = (modrm >> 3) & 7;
4175
4176             if (mod != 3) {
4177                 if (shift == 2) {
4178                     s->rip_offset = 1;
4179                 }
4180                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
4181                 opreg = OR_TMP0;
4182             } else {
4183                 opreg = (modrm & 7) | REX_B(s);
4184             }
4185
4186             /* simpler op */
4187             if (shift == 0) {
4188                 gen_shift(s, op, ot, opreg, OR_ECX);
4189             } else {
4190                 if (shift == 2) {
4191                     shift = ldub_code(s->pc++);
4192                 }
4193                 gen_shifti(s, op, ot, opreg, shift);
4194             }
4195         }
4196         break;
4197     case 0xd0:
4198     case 0xd1:
4199         /* shift Ev,1 */
4200         shift = 1;
4201         goto grp2;
4202     case 0xd2:
4203     case 0xd3:
4204         /* shift Ev,cl */
4205         shift = 0;
4206         goto grp2;
4207
4208     case 0x1a4: /* shld imm */
4209         op = 0;
4210         shift = 1;
4211         goto do_shiftd;
4212     case 0x1a5: /* shld cl */
4213         op = 0;
4214         shift = 0;
4215         goto do_shiftd;
4216     case 0x1ac: /* shrd imm */
4217         op = 1;
4218         shift = 1;
4219         goto do_shiftd;
4220     case 0x1ad: /* shrd cl */
4221         op = 1;
4222         shift = 0;
4223     do_shiftd:
4224         ot = dflag + OT_WORD;
4225         modrm = ldub_code(s->pc++);
4226         mod = (modrm >> 6) & 3;
4227         rm = (modrm & 7) | REX_B(s);
4228         reg = ((modrm >> 3) & 7) | rex_r;
4229
4230         if (mod != 3) {
4231             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
4232             gen_op_ld_T0_A0[ot + s->mem_index]();
4233         } else {
4234             gen_op_mov_TN_reg[ot][0][rm]();
4235         }
4236         gen_op_mov_TN_reg[ot][1][reg]();
4237
4238         if (shift) {
4239             val = ldub_code(s->pc++);
4240             if (ot == OT_QUAD)
4241                 val &= 0x3f;
4242             else
4243                 val &= 0x1f;
4244             if (val) {
4245                 if (mod == 3)
4246                     gen_op_shiftd_T0_T1_im_cc[ot][op](val);
4247                 else
4248                     gen_op_shiftd_mem_T0_T1_im_cc[ot + s->mem_index][op](val);
4249                 if (op == 0 && ot != OT_WORD)
4250                     s->cc_op = CC_OP_SHLB + ot;
4251                 else
4252                     s->cc_op = CC_OP_SARB + ot;
4253             }
4254         } else {
4255             if (s->cc_op != CC_OP_DYNAMIC)
4256                 gen_op_set_cc_op(s->cc_op);
4257             if (mod == 3)
4258                 gen_op_shiftd_T0_T1_ECX_cc[ot][op]();
4259             else
4260                 gen_op_shiftd_mem_T0_T1_ECX_cc[ot + s->mem_index][op]();
4261             s->cc_op = CC_OP_DYNAMIC; /* cannot predict flags after */
4262         }
4263         if (mod == 3) {
4264             gen_op_mov_reg_T0[ot][rm]();
4265         }
4266         break;
4267
4268         /************************/
4269         /* floats */
4270     case 0xd8 ... 0xdf:
4271         if (s->flags & (HF_EM_MASK | HF_TS_MASK)) {
4272             /* if CR0.EM or CR0.TS are set, generate an FPU exception */
4273             /* XXX: what to do if illegal op ? */
4274             gen_exception(s, EXCP07_PREX, pc_start - s->cs_base);
4275             break;
4276         }
4277         modrm = ldub_code(s->pc++);
4278         mod = (modrm >> 6) & 3;
4279         rm = modrm & 7;
4280         op = ((b & 7) << 3) | ((modrm >> 3) & 7);
4281         if (mod != 3) {
4282             /* memory op */
4283             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
4284             switch(op) {
4285             case 0x00 ... 0x07: /* fxxxs */
4286             case 0x10 ... 0x17: /* fixxxl */
4287             case 0x20 ... 0x27: /* fxxxl */
4288             case 0x30 ... 0x37: /* fixxx */
4289                 {
4290                     int op1;
4291                     op1 = op & 7;
4292
4293                     switch(op >> 4) {
4294                     case 0:
4295                         gen_op_flds_FT0_A0();
4296                         break;
4297                     case 1:
4298                         gen_op_fildl_FT0_A0();
4299                         break;
4300                     case 2:
4301                         gen_op_fldl_FT0_A0();
4302                         break;
4303                     case 3:
4304                     default:
4305                         gen_op_fild_FT0_A0();
4306                         break;
4307                     }
4308
4309                     gen_op_fp_arith_ST0_FT0[op1]();
4310                     if (op1 == 3) {
4311                         /* fcomp needs pop */
4312                         gen_op_fpop();
4313                     }
4314                 }
4315                 break;
4316             case 0x08: /* flds */
4317             case 0x0a: /* fsts */
4318             case 0x0b: /* fstps */
4319             case 0x18 ... 0x1b: /* fildl, fisttpl, fistl, fistpl */
4320             case 0x28 ... 0x2b: /* fldl, fisttpll, fstl, fstpl */
4321             case 0x38 ... 0x3b: /* filds, fisttps, fists, fistps */
4322                 switch(op & 7) {
4323                 case 0:
4324                     switch(op >> 4) {
4325                     case 0:
4326                         gen_op_flds_ST0_A0();
4327                         break;
4328                     case 1:
4329                         gen_op_fildl_ST0_A0();
4330                         break;
4331                     case 2:
4332                         gen_op_fldl_ST0_A0();
4333                         break;
4334                     case 3:
4335                     default:
4336                         gen_op_fild_ST0_A0();
4337                         break;
4338                     }
4339                     break;
4340                 case 1:
4341                     switch(op >> 4) {
4342                     case 1:
4343                         gen_op_fisttl_ST0_A0();
4344                         break;
4345                     case 2:
4346                         gen_op_fisttll_ST0_A0();
4347                         break;
4348                     case 3:
4349                     default:
4350                         gen_op_fistt_ST0_A0();
4351                     }
4352                     gen_op_fpop();
4353                     break;
4354                 default:
4355                     switch(op >> 4) {
4356                     case 0:
4357                         gen_op_fsts_ST0_A0();
4358                         break;
4359                     case 1:
4360                         gen_op_fistl_ST0_A0();
4361                         break;
4362                     case 2:
4363                         gen_op_fstl_ST0_A0();
4364                         break;
4365                     case 3:
4366                     default:
4367                         gen_op_fist_ST0_A0();
4368                         break;
4369                     }
4370                     if ((op & 7) == 3)
4371                         gen_op_fpop();
4372                     break;
4373                 }
4374                 break;
4375             case 0x0c: /* fldenv mem */
4376                 gen_op_fldenv_A0(s->dflag);
4377                 break;
4378             case 0x0d: /* fldcw mem */
4379                 gen_op_fldcw_A0();
4380                 break;
4381             case 0x0e: /* fnstenv mem */
4382                 gen_op_fnstenv_A0(s->dflag);
4383                 break;
4384             case 0x0f: /* fnstcw mem */
4385                 gen_op_fnstcw_A0();
4386                 break;
4387             case 0x1d: /* fldt mem */
4388                 gen_op_fldt_ST0_A0();
4389                 break;
4390             case 0x1f: /* fstpt mem */
4391                 gen_op_fstt_ST0_A0();
4392                 gen_op_fpop();
4393                 break;
4394             case 0x2c: /* frstor mem */
4395                 gen_op_frstor_A0(s->dflag);
4396                 break;
4397             case 0x2e: /* fnsave mem */
4398                 gen_op_fnsave_A0(s->dflag);
4399                 break;
4400             case 0x2f: /* fnstsw mem */
4401                 gen_op_fnstsw_A0();
4402                 break;
4403             case 0x3c: /* fbld */
4404                 gen_op_fbld_ST0_A0();
4405                 break;
4406             case 0x3e: /* fbstp */
4407                 gen_op_fbst_ST0_A0();
4408                 gen_op_fpop();
4409                 break;
4410             case 0x3d: /* fildll */
4411                 gen_op_fildll_ST0_A0();
4412                 break;
4413             case 0x3f: /* fistpll */
4414                 gen_op_fistll_ST0_A0();
4415                 gen_op_fpop();
4416                 break;
4417             default:
4418                 goto illegal_op;
4419             }
4420         } else {
4421             /* register float ops */
4422             opreg = rm;
4423
4424             switch(op) {
4425             case 0x08: /* fld sti */
4426                 gen_op_fpush();
4427                 gen_op_fmov_ST0_STN((opreg + 1) & 7);
4428                 break;
4429             case 0x09: /* fxchg sti */
4430             case 0x29: /* fxchg4 sti, undocumented op */
4431             case 0x39: /* fxchg7 sti, undocumented op */
4432                 gen_op_fxchg_ST0_STN(opreg);
4433                 break;
4434             case 0x0a: /* grp d9/2 */
4435                 switch(rm) {
4436                 case 0: /* fnop */
4437                     /* check exceptions (FreeBSD FPU probe) */
4438                     if (s->cc_op != CC_OP_DYNAMIC)
4439                         gen_op_set_cc_op(s->cc_op);
4440                     gen_jmp_im(pc_start - s->cs_base);
4441                     gen_op_fwait();
4442                     break;
4443                 default:
4444                     goto illegal_op;
4445                 }
4446                 break;
4447             case 0x0c: /* grp d9/4 */
4448                 switch(rm) {
4449                 case 0: /* fchs */
4450                     gen_op_fchs_ST0();
4451                     break;
4452                 case 1: /* fabs */
4453                     gen_op_fabs_ST0();
4454                     break;
4455                 case 4: /* ftst */
4456                     gen_op_fldz_FT0();
4457                     gen_op_fcom_ST0_FT0();
4458                     break;
4459                 case 5: /* fxam */
4460                     gen_op_fxam_ST0();
4461                     break;
4462                 default:
4463                     goto illegal_op;
4464                 }
4465                 break;
4466             case 0x0d: /* grp d9/5 */
4467                 {
4468                     switch(rm) {
4469                     case 0:
4470                         gen_op_fpush();
4471                         gen_op_fld1_ST0();
4472                         break;
4473                     case 1:
4474                         gen_op_fpush();
4475                         gen_op_fldl2t_ST0();
4476                         break;
4477                     case 2:
4478                         gen_op_fpush();
4479                         gen_op_fldl2e_ST0();
4480                         break;
4481                     case 3:
4482                         gen_op_fpush();
4483                         gen_op_fldpi_ST0();
4484                         break;
4485                     case 4:
4486                         gen_op_fpush();
4487                         gen_op_fldlg2_ST0();
4488                         break;
4489                     case 5:
4490                         gen_op_fpush();
4491                         gen_op_fldln2_ST0();
4492                         break;
4493                     case 6:
4494                         gen_op_fpush();
4495                         gen_op_fldz_ST0();
4496                         break;
4497                     default:
4498                         goto illegal_op;
4499                     }
4500                 }
4501                 break;
4502             case 0x0e: /* grp d9/6 */
4503                 switch(rm) {
4504                 case 0: /* f2xm1 */
4505                     gen_op_f2xm1();
4506                     break;
4507                 case 1: /* fyl2x */
4508                     gen_op_fyl2x();
4509                     break;
4510                 case 2: /* fptan */
4511                     gen_op_fptan();
4512                     break;
4513                 case 3: /* fpatan */
4514                     gen_op_fpatan();
4515                     break;
4516                 case 4: /* fxtract */
4517                     gen_op_fxtract();
4518                     break;
4519                 case 5: /* fprem1 */
4520                     gen_op_fprem1();
4521                     break;
4522                 case 6: /* fdecstp */
4523                     gen_op_fdecstp();
4524                     break;
4525                 default:
4526                 case 7: /* fincstp */
4527                     gen_op_fincstp();
4528                     break;
4529                 }
4530                 break;
4531             case 0x0f: /* grp d9/7 */
4532                 switch(rm) {
4533                 case 0: /* fprem */
4534                     gen_op_fprem();
4535                     break;
4536                 case 1: /* fyl2xp1 */
4537                     gen_op_fyl2xp1();
4538                     break;
4539                 case 2: /* fsqrt */
4540                     gen_op_fsqrt();
4541                     break;
4542                 case 3: /* fsincos */
4543                     gen_op_fsincos();
4544                     break;
4545                 case 5: /* fscale */
4546                     gen_op_fscale();
4547                     break;
4548                 case 4: /* frndint */
4549                     gen_op_frndint();
4550                     break;
4551                 case 6: /* fsin */
4552                     gen_op_fsin();
4553                     break;
4554                 default:
4555                 case 7: /* fcos */
4556                     gen_op_fcos();
4557                     break;
4558                 }
4559                 break;
4560             case 0x00: case 0x01: case 0x04 ... 0x07: /* fxxx st, sti */
4561             case 0x20: case 0x21: case 0x24 ... 0x27: /* fxxx sti, st */
4562             case 0x30: case 0x31: case 0x34 ... 0x37: /* fxxxp sti, st */
4563                 {
4564                     int op1;
4565
4566                     op1 = op & 7;
4567                     if (op >= 0x20) {
4568                         gen_op_fp_arith_STN_ST0[op1](opreg);
4569                         if (op >= 0x30)
4570                             gen_op_fpop();
4571                     } else {
4572                         gen_op_fmov_FT0_STN(opreg);
4573                         gen_op_fp_arith_ST0_FT0[op1]();
4574                     }
4575                 }
4576                 break;
4577             case 0x02: /* fcom */
4578             case 0x22: /* fcom2, undocumented op */
4579                 gen_op_fmov_FT0_STN(opreg);
4580                 gen_op_fcom_ST0_FT0();
4581                 break;
4582             case 0x03: /* fcomp */
4583             case 0x23: /* fcomp3, undocumented op */
4584             case 0x32: /* fcomp5, undocumented op */
4585                 gen_op_fmov_FT0_STN(opreg);
4586                 gen_op_fcom_ST0_FT0();
4587                 gen_op_fpop();
4588                 break;
4589             case 0x15: /* da/5 */
4590                 switch(rm) {
4591                 case 1: /* fucompp */
4592                     gen_op_fmov_FT0_STN(1);
4593                     gen_op_fucom_ST0_FT0();
4594                     gen_op_fpop();
4595                     gen_op_fpop();
4596                     break;
4597                 default:
4598                     goto illegal_op;
4599                 }
4600                 break;
4601             case 0x1c:
4602                 switch(rm) {
4603                 case 0: /* feni (287 only, just do nop here) */
4604                     break;
4605                 case 1: /* fdisi (287 only, just do nop here) */
4606                     break;
4607                 case 2: /* fclex */
4608                     gen_op_fclex();
4609                     break;
4610                 case 3: /* fninit */
4611                     gen_op_fninit();
4612                     break;
4613                 case 4: /* fsetpm (287 only, just do nop here) */
4614                     break;
4615                 default:
4616                     goto illegal_op;
4617                 }
4618                 break;
4619             case 0x1d: /* fucomi */
4620                 if (s->cc_op != CC_OP_DYNAMIC)
4621                     gen_op_set_cc_op(s->cc_op);
4622                 gen_op_fmov_FT0_STN(opreg);
4623                 gen_op_fucomi_ST0_FT0();
4624                 s->cc_op = CC_OP_EFLAGS;
4625                 break;
4626             case 0x1e: /* fcomi */
4627                 if (s->cc_op != CC_OP_DYNAMIC)
4628                     gen_op_set_cc_op(s->cc_op);
4629                 gen_op_fmov_FT0_STN(opreg);
4630                 gen_op_fcomi_ST0_FT0();
4631                 s->cc_op = CC_OP_EFLAGS;
4632                 break;
4633             case 0x28: /* ffree sti */
4634                 gen_op_ffree_STN(opreg);
4635                 break;
4636             case 0x2a: /* fst sti */
4637                 gen_op_fmov_STN_ST0(opreg);
4638                 break;
4639             case 0x2b: /* fstp sti */
4640             case 0x0b: /* fstp1 sti, undocumented op */
4641             case 0x3a: /* fstp8 sti, undocumented op */
4642             case 0x3b: /* fstp9 sti, undocumented op */
4643                 gen_op_fmov_STN_ST0(opreg);
4644                 gen_op_fpop();
4645                 break;
4646             case 0x2c: /* fucom st(i) */
4647                 gen_op_fmov_FT0_STN(opreg);
4648                 gen_op_fucom_ST0_FT0();
4649                 break;
4650             case 0x2d: /* fucomp st(i) */
4651                 gen_op_fmov_FT0_STN(opreg);
4652                 gen_op_fucom_ST0_FT0();
4653                 gen_op_fpop();
4654                 break;
4655             case 0x33: /* de/3 */
4656                 switch(rm) {
4657                 case 1: /* fcompp */
4658                     gen_op_fmov_FT0_STN(1);
4659                     gen_op_fcom_ST0_FT0();
4660                     gen_op_fpop();
4661                     gen_op_fpop();
4662                     break;
4663                 default:
4664                     goto illegal_op;
4665                 }
4666                 break;
4667             case 0x38: /* ffreep sti, undocumented op */
4668                 gen_op_ffree_STN(opreg);
4669                 gen_op_fpop();
4670                 break;
4671             case 0x3c: /* df/4 */
4672                 switch(rm) {
4673                 case 0:
4674                     gen_op_fnstsw_EAX();
4675                     break;
4676                 default:
4677                     goto illegal_op;
4678                 }
4679                 break;
4680             case 0x3d: /* fucomip */
4681                 if (s->cc_op != CC_OP_DYNAMIC)
4682                     gen_op_set_cc_op(s->cc_op);
4683                 gen_op_fmov_FT0_STN(opreg);
4684                 gen_op_fucomi_ST0_FT0();
4685                 gen_op_fpop();
4686                 s->cc_op = CC_OP_EFLAGS;
4687                 break;
4688             case 0x3e: /* fcomip */
4689                 if (s->cc_op != CC_OP_DYNAMIC)
4690                     gen_op_set_cc_op(s->cc_op);
4691                 gen_op_fmov_FT0_STN(opreg);
4692                 gen_op_fcomi_ST0_FT0();
4693                 gen_op_fpop();
4694                 s->cc_op = CC_OP_EFLAGS;
4695                 break;
4696             case 0x10 ... 0x13: /* fcmovxx */
4697             case 0x18 ... 0x1b:
4698                 {
4699                     int op1;
4700                     const static uint8_t fcmov_cc[8] = {
4701                         (JCC_B << 1),
4702                         (JCC_Z << 1),
4703                         (JCC_BE << 1),
4704                         (JCC_P << 1),
4705                     };
4706                     op1 = fcmov_cc[op & 3] | ((op >> 3) & 1);
4707                     gen_setcc(s, op1);
4708                     gen_op_fcmov_ST0_STN_T0(opreg);
4709                 }
4710                 break;
4711             default:
4712                 goto illegal_op;
4713             }
4714         }
4715 #ifdef USE_CODE_COPY
4716         s->tb->cflags |= CF_TB_FP_USED;
4717 #endif
4718         break;
4719         /************************/
4720         /* string ops */
4721
4722     case 0xa4: /* movsS */
4723     case 0xa5:
4724         if ((b & 1) == 0)
4725             ot = OT_BYTE;
4726         else
4727             ot = dflag + OT_WORD;
4728
4729         if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) {
4730             gen_repz_movs(s, ot, pc_start - s->cs_base, s->pc - s->cs_base);
4731         } else {
4732             gen_movs(s, ot);
4733         }
4734         break;
4735
4736     case 0xaa: /* stosS */
4737     case 0xab:
4738         if ((b & 1) == 0)
4739             ot = OT_BYTE;
4740         else
4741             ot = dflag + OT_WORD;
4742
4743         if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) {
4744             gen_repz_stos(s, ot, pc_start - s->cs_base, s->pc - s->cs_base);
4745         } else {
4746             gen_stos(s, ot);
4747         }
4748         break;
4749     case 0xac: /* lodsS */
4750     case 0xad:
4751         if ((b & 1) == 0)
4752             ot = OT_BYTE;
4753         else
4754             ot = dflag + OT_WORD;
4755         if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) {
4756             gen_repz_lods(s, ot, pc_start - s->cs_base, s->pc - s->cs_base);
4757         } else {
4758             gen_lods(s, ot);
4759         }
4760         break;
4761     case 0xae: /* scasS */
4762     case 0xaf:
4763         if ((b & 1) == 0)
4764             ot = OT_BYTE;
4765         else
4766             ot = dflag + OT_WORD;
4767         if (prefixes & PREFIX_REPNZ) {
4768             gen_repz_scas(s, ot, pc_start - s->cs_base, s->pc - s->cs_base, 1);
4769         } else if (prefixes & PREFIX_REPZ) {
4770             gen_repz_scas(s, ot, pc_start - s->cs_base, s->pc - s->cs_base, 0);
4771         } else {
4772             gen_scas(s, ot);
4773             s->cc_op = CC_OP_SUBB + ot;
4774         }
4775         break;
4776
4777     case 0xa6: /* cmpsS */
4778     case 0xa7:
4779         if ((b & 1) == 0)
4780             ot = OT_BYTE;
4781         else
4782             ot = dflag + OT_WORD;
4783         if (prefixes & PREFIX_REPNZ) {
4784             gen_repz_cmps(s, ot, pc_start - s->cs_base, s->pc - s->cs_base, 1);
4785         } else if (prefixes & PREFIX_REPZ) {
4786             gen_repz_cmps(s, ot, pc_start - s->cs_base, s->pc - s->cs_base, 0);
4787         } else {
4788             gen_cmps(s, ot);
4789             s->cc_op = CC_OP_SUBB + ot;
4790         }
4791         break;
4792     case 0x6c: /* insS */
4793     case 0x6d:
4794         if ((b & 1) == 0)
4795             ot = OT_BYTE;
4796         else
4797             ot = dflag ? OT_LONG : OT_WORD;
4798         gen_check_io(s, ot, 1, pc_start - s->cs_base);
4799         if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) {
4800             gen_repz_ins(s, ot, pc_start - s->cs_base, s->pc - s->cs_base);
4801         } else {
4802             gen_ins(s, ot);
4803         }
4804         break;
4805     case 0x6e: /* outsS */
4806     case 0x6f:
4807         if ((b & 1) == 0)
4808             ot = OT_BYTE;
4809         else
4810             ot = dflag ? OT_LONG : OT_WORD;
4811         gen_check_io(s, ot, 1, pc_start - s->cs_base);
4812         if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) {
4813             gen_repz_outs(s, ot, pc_start - s->cs_base, s->pc - s->cs_base);
4814         } else {
4815             gen_outs(s, ot);
4816         }
4817         break;
4818
4819         /************************/
4820         /* port I/O */
4821     case 0xe4:
4822     case 0xe5:
4823         if ((b & 1) == 0)
4824             ot = OT_BYTE;
4825         else
4826             ot = dflag ? OT_LONG : OT_WORD;
4827         val = ldub_code(s->pc++);
4828         gen_op_movl_T0_im(val);
4829         gen_check_io(s, ot, 0, pc_start - s->cs_base);
4830         gen_op_in[ot]();
4831         gen_op_mov_reg_T1[ot][R_EAX]();
4832         break;
4833     case 0xe6:
4834     case 0xe7:
4835         if ((b & 1) == 0)
4836             ot = OT_BYTE;
4837         else
4838             ot = dflag ? OT_LONG : OT_WORD;
4839         val = ldub_code(s->pc++);
4840         gen_op_movl_T0_im(val);
4841         gen_check_io(s, ot, 0, pc_start - s->cs_base);
4842         gen_op_mov_TN_reg[ot][1][R_EAX]();
4843         gen_op_out[ot]();
4844         break;
4845     case 0xec:
4846     case 0xed:
4847         if ((b & 1) == 0)
4848             ot = OT_BYTE;
4849         else
4850             ot = dflag ? OT_LONG : OT_WORD;
4851         gen_op_mov_TN_reg[OT_WORD][0][R_EDX]();
4852         gen_op_andl_T0_ffff();
4853         gen_check_io(s, ot, 0, pc_start - s->cs_base);
4854         gen_op_in[ot]();
4855         gen_op_mov_reg_T1[ot][R_EAX]();
4856         break;
4857     case 0xee:
4858     case 0xef:
4859         if ((b & 1) == 0)
4860             ot = OT_BYTE;
4861         else
4862             ot = dflag ? OT_LONG : OT_WORD;
4863         gen_op_mov_TN_reg[OT_WORD][0][R_EDX]();
4864         gen_op_andl_T0_ffff();
4865         gen_check_io(s, ot, 0, pc_start - s->cs_base);
4866         gen_op_mov_TN_reg[ot][1][R_EAX]();
4867         gen_op_out[ot]();
4868         break;
4869
4870         /************************/
4871         /* control */
4872     case 0xc2: /* ret im */
4873         val = ldsw_code(s->pc);
4874         s->pc += 2;
4875         gen_pop_T0(s);
4876         if (CODE64(s) && s->dflag)
4877             s->dflag = 2;
4878         gen_stack_update(s, val + (2 << s->dflag));
4879         if (s->dflag == 0)
4880             gen_op_andl_T0_ffff();
4881         gen_op_jmp_T0();
4882         gen_eob(s);
4883         break;
4884     case 0xc3: /* ret */
4885         gen_pop_T0(s);
4886         gen_pop_update(s);
4887         if (s->dflag == 0)
4888             gen_op_andl_T0_ffff();
4889         gen_op_jmp_T0();
4890         gen_eob(s);
4891         break;
4892     case 0xca: /* lret im */
4893         val = ldsw_code(s->pc);
4894         s->pc += 2;
4895     do_lret:
4896         if (s->pe && !s->vm86) {
4897             if (s->cc_op != CC_OP_DYNAMIC)
4898                 gen_op_set_cc_op(s->cc_op);
4899             gen_jmp_im(pc_start - s->cs_base);
4900             gen_op_lret_protected(s->dflag, val);
4901         } else {
4902             gen_stack_A0(s);
4903             /* pop offset */
4904             gen_op_ld_T0_A0[1 + s->dflag + s->mem_index]();
4905             if (s->dflag == 0)
4906                 gen_op_andl_T0_ffff();
4907             /* NOTE: keeping EIP updated is not a problem in case of
4908                exception */
4909             gen_op_jmp_T0();
4910             /* pop selector */
4911             gen_op_addl_A0_im(2 << s->dflag);
4912             gen_op_ld_T0_A0[1 + s->dflag + s->mem_index]();
4913             gen_op_movl_seg_T0_vm(offsetof(CPUX86State,segs[R_CS]));
4914             /* add stack offset */
4915             gen_stack_update(s, val + (4 << s->dflag));
4916         }
4917         gen_eob(s);
4918         break;
4919     case 0xcb: /* lret */
4920         val = 0;
4921         goto do_lret;
4922     case 0xcf: /* iret */
4923         if (!s->pe) {
4924             /* real mode */
4925             gen_op_iret_real(s->dflag);
4926             s->cc_op = CC_OP_EFLAGS;
4927         } else if (s->vm86) {
4928             if (s->iopl != 3) {
4929                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
4930             } else {
4931                 gen_op_iret_real(s->dflag);
4932                 s->cc_op = CC_OP_EFLAGS;
4933             }
4934         } else {
4935             if (s->cc_op != CC_OP_DYNAMIC)
4936                 gen_op_set_cc_op(s->cc_op);
4937             gen_jmp_im(pc_start - s->cs_base);
4938             gen_op_iret_protected(s->dflag, s->pc - s->cs_base);
4939             s->cc_op = CC_OP_EFLAGS;
4940         }
4941         gen_eob(s);
4942         break;
4943     case 0xe8: /* call im */
4944         {
4945             if (dflag)
4946                 tval = (int32_t)insn_get(s, OT_LONG);
4947             else
4948                 tval = (int16_t)insn_get(s, OT_WORD);
4949             next_eip = s->pc - s->cs_base;
4950             tval += next_eip;
4951             if (s->dflag == 0)
4952                 tval &= 0xffff;
4953             gen_movtl_T0_im(next_eip);
4954             gen_push_T0(s);
4955             gen_jmp(s, tval);
4956         }
4957         break;
4958     case 0x9a: /* lcall im */
4959         {
4960             unsigned int selector, offset;
4961
4962             if (CODE64(s))
4963                 goto illegal_op;
4964             ot = dflag ? OT_LONG : OT_WORD;
4965             offset = insn_get(s, ot);
4966             selector = insn_get(s, OT_WORD);
4967
4968             gen_op_movl_T0_im(selector);
4969             gen_op_movl_T1_imu(offset);
4970         }
4971         goto do_lcall;
4972     case 0xe9: /* jmp im */
4973         if (dflag)
4974             tval = (int32_t)insn_get(s, OT_LONG);
4975         else
4976             tval = (int16_t)insn_get(s, OT_WORD);
4977         tval += s->pc - s->cs_base;
4978         if (s->dflag == 0)
4979             tval &= 0xffff;
4980         gen_jmp(s, tval);
4981         break;
4982     case 0xea: /* ljmp im */
4983         {
4984             unsigned int selector, offset;
4985
4986             if (CODE64(s))
4987                 goto illegal_op;
4988             ot = dflag ? OT_LONG : OT_WORD;
4989             offset = insn_get(s, ot);
4990             selector = insn_get(s, OT_WORD);
4991
4992             gen_op_movl_T0_im(selector);
4993             gen_op_movl_T1_imu(offset);
4994         }
4995         goto do_ljmp;
4996     case 0xeb: /* jmp Jb */
4997         tval = (int8_t)insn_get(s, OT_BYTE);
4998         tval += s->pc - s->cs_base;
4999         if (s->dflag == 0)
5000             tval &= 0xffff;
5001         gen_jmp(s, tval);
5002         break;
5003     case 0x70 ... 0x7f: /* jcc Jb */
5004         tval = (int8_t)insn_get(s, OT_BYTE);
5005         goto do_jcc;
5006     case 0x180 ... 0x18f: /* jcc Jv */
5007         if (dflag) {
5008             tval = (int32_t)insn_get(s, OT_LONG);
5009         } else {
5010             tval = (int16_t)insn_get(s, OT_WORD);
5011         }
5012     do_jcc:
5013         next_eip = s->pc - s->cs_base;
5014         tval += next_eip;
5015         if (s->dflag == 0)
5016             tval &= 0xffff;
5017         gen_jcc(s, b, tval, next_eip);
5018         break;
5019
5020     case 0x190 ... 0x19f: /* setcc Gv */
5021         modrm = ldub_code(s->pc++);
5022         gen_setcc(s, b);
5023         gen_ldst_modrm(s, modrm, OT_BYTE, OR_TMP0, 1);
5024         break;
5025     case 0x140 ... 0x14f: /* cmov Gv, Ev */
5026         ot = dflag + OT_WORD;
5027         modrm = ldub_code(s->pc++);
5028         reg = ((modrm >> 3) & 7) | rex_r;
5029         mod = (modrm >> 6) & 3;
5030         gen_setcc(s, b);
5031         if (mod != 3) {
5032             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5033             gen_op_ld_T1_A0[ot + s->mem_index]();
5034         } else {
5035             rm = (modrm & 7) | REX_B(s);
5036             gen_op_mov_TN_reg[ot][1][rm]();
5037         }
5038         gen_op_cmov_reg_T1_T0[ot - OT_WORD][reg]();
5039         break;
5040
5041         /************************/
5042         /* flags */
5043     case 0x9c: /* pushf */
5044         if (s->vm86 && s->iopl != 3) {
5045             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5046         } else {
5047             if (s->cc_op != CC_OP_DYNAMIC)
5048                 gen_op_set_cc_op(s->cc_op);
5049             gen_op_movl_T0_eflags();
5050             gen_push_T0(s);
5051         }
5052         break;
5053     case 0x9d: /* popf */
5054         if (s->vm86 && s->iopl != 3) {
5055             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5056         } else {
5057             gen_pop_T0(s);
5058             if (s->cpl == 0) {
5059                 if (s->dflag) {
5060                     gen_op_movl_eflags_T0_cpl0();
5061                 } else {
5062                     gen_op_movw_eflags_T0_cpl0();
5063                 }
5064             } else {
5065                 if (s->cpl <= s->iopl) {
5066                     if (s->dflag) {
5067                         gen_op_movl_eflags_T0_io();
5068                     } else {
5069                         gen_op_movw_eflags_T0_io();
5070                     }
5071                 } else {
5072                     if (s->dflag) {
5073                         gen_op_movl_eflags_T0();
5074                     } else {
5075                         gen_op_movw_eflags_T0();
5076                     }
5077                 }
5078             }
5079             gen_pop_update(s);
5080             s->cc_op = CC_OP_EFLAGS;
5081             /* abort translation because TF flag may change */
5082             gen_jmp_im(s->pc - s->cs_base);
5083             gen_eob(s);
5084         }
5085         break;
5086     case 0x9e: /* sahf */
5087         if (CODE64(s))
5088             goto illegal_op;
5089         gen_op_mov_TN_reg[OT_BYTE][0][R_AH]();
5090         if (s->cc_op != CC_OP_DYNAMIC)
5091             gen_op_set_cc_op(s->cc_op);
5092         gen_op_movb_eflags_T0();
5093         s->cc_op = CC_OP_EFLAGS;
5094         break;
5095     case 0x9f: /* lahf */
5096         if (CODE64(s))
5097             goto illegal_op;
5098         if (s->cc_op != CC_OP_DYNAMIC)
5099             gen_op_set_cc_op(s->cc_op);
5100         gen_op_movl_T0_eflags();
5101         gen_op_mov_reg_T0[OT_BYTE][R_AH]();
5102         break;
5103     case 0xf5: /* cmc */
5104         if (s->cc_op != CC_OP_DYNAMIC)
5105             gen_op_set_cc_op(s->cc_op);
5106         gen_op_cmc();
5107         s->cc_op = CC_OP_EFLAGS;
5108         break;
5109     case 0xf8: /* clc */
5110         if (s->cc_op != CC_OP_DYNAMIC)
5111             gen_op_set_cc_op(s->cc_op);
5112         gen_op_clc();
5113         s->cc_op = CC_OP_EFLAGS;
5114         break;
5115     case 0xf9: /* stc */
5116         if (s->cc_op != CC_OP_DYNAMIC)
5117             gen_op_set_cc_op(s->cc_op);
5118         gen_op_stc();
5119         s->cc_op = CC_OP_EFLAGS;
5120         break;
5121     case 0xfc: /* cld */
5122         gen_op_cld();
5123         break;
5124     case 0xfd: /* std */
5125         gen_op_std();
5126         break;
5127
5128         /************************/
5129         /* bit operations */
5130     case 0x1ba: /* bt/bts/btr/btc Gv, im */
5131         ot = dflag + OT_WORD;
5132         modrm = ldub_code(s->pc++);
5133         op = (modrm >> 3) & 7;
5134         mod = (modrm >> 6) & 3;
5135         rm = (modrm & 7) | REX_B(s);
5136         if (mod != 3) {
5137             s->rip_offset = 1;
5138             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5139             gen_op_ld_T0_A0[ot + s->mem_index]();
5140         } else {
5141             gen_op_mov_TN_reg[ot][0][rm]();
5142         }
5143         /* load shift */
5144         val = ldub_code(s->pc++);
5145         gen_op_movl_T1_im(val);
5146         if (op < 4)
5147             goto illegal_op;
5148         op -= 4;
5149         gen_op_btx_T0_T1_cc[ot - OT_WORD][op]();
5150         s->cc_op = CC_OP_SARB + ot;
5151         if (op != 0) {
5152             if (mod != 3)
5153                 gen_op_st_T0_A0[ot + s->mem_index]();
5154             else
5155                 gen_op_mov_reg_T0[ot][rm]();
5156             gen_op_update_bt_cc();
5157         }
5158         break;
5159     case 0x1a3: /* bt Gv, Ev */
5160         op = 0;
5161         goto do_btx;
5162     case 0x1ab: /* bts */
5163         op = 1;
5164         goto do_btx;
5165     case 0x1b3: /* btr */
5166         op = 2;
5167         goto do_btx;
5168     case 0x1bb: /* btc */
5169         op = 3;
5170     do_btx:
5171         ot = dflag + OT_WORD;
5172         modrm = ldub_code(s->pc++);
5173         reg = ((modrm >> 3) & 7) | rex_r;
5174         mod = (modrm >> 6) & 3;
5175         rm = (modrm & 7) | REX_B(s);
5176         gen_op_mov_TN_reg[OT_LONG][1][reg]();
5177         if (mod != 3) {
5178             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5179             /* specific case: we need to add a displacement */
5180             gen_op_add_bit_A0_T1[ot - OT_WORD]();
5181             gen_op_ld_T0_A0[ot + s->mem_index]();
5182         } else {
5183             gen_op_mov_TN_reg[ot][0][rm]();
5184         }
5185         gen_op_btx_T0_T1_cc[ot - OT_WORD][op]();
5186         s->cc_op = CC_OP_SARB + ot;
5187         if (op != 0) {
5188             if (mod != 3)
5189                 gen_op_st_T0_A0[ot + s->mem_index]();
5190             else
5191                 gen_op_mov_reg_T0[ot][rm]();
5192             gen_op_update_bt_cc();
5193         }
5194         break;
5195     case 0x1bc: /* bsf */
5196     case 0x1bd: /* bsr */
5197         ot = dflag + OT_WORD;
5198         modrm = ldub_code(s->pc++);
5199         reg = ((modrm >> 3) & 7) | rex_r;
5200         gen_ldst_modrm(s, modrm, ot, OR_TMP0, 0);
5201         /* NOTE: in order to handle the 0 case, we must load the
5202            result. It could be optimized with a generated jump */
5203         gen_op_mov_TN_reg[ot][1][reg]();
5204         gen_op_bsx_T0_cc[ot - OT_WORD][b & 1]();
5205         gen_op_mov_reg_T1[ot][reg]();
5206         s->cc_op = CC_OP_LOGICB + ot;
5207         break;
5208         /************************/
5209         /* bcd */
5210     case 0x27: /* daa */
5211         if (CODE64(s))
5212             goto illegal_op;
5213         if (s->cc_op != CC_OP_DYNAMIC)
5214             gen_op_set_cc_op(s->cc_op);
5215         gen_op_daa();
5216         s->cc_op = CC_OP_EFLAGS;
5217         break;
5218     case 0x2f: /* das */
5219         if (CODE64(s))
5220             goto illegal_op;
5221         if (s->cc_op != CC_OP_DYNAMIC)
5222             gen_op_set_cc_op(s->cc_op);
5223         gen_op_das();
5224         s->cc_op = CC_OP_EFLAGS;
5225         break;
5226     case 0x37: /* aaa */
5227         if (CODE64(s))
5228             goto illegal_op;
5229         if (s->cc_op != CC_OP_DYNAMIC)
5230             gen_op_set_cc_op(s->cc_op);
5231         gen_op_aaa();
5232         s->cc_op = CC_OP_EFLAGS;
5233         break;
5234     case 0x3f: /* aas */
5235         if (CODE64(s))
5236             goto illegal_op;
5237         if (s->cc_op != CC_OP_DYNAMIC)
5238             gen_op_set_cc_op(s->cc_op);
5239         gen_op_aas();
5240         s->cc_op = CC_OP_EFLAGS;
5241         break;
5242     case 0xd4: /* aam */
5243         if (CODE64(s))
5244             goto illegal_op;
5245         val = ldub_code(s->pc++);
5246         gen_op_aam(val);
5247         s->cc_op = CC_OP_LOGICB;
5248         break;
5249     case 0xd5: /* aad */
5250         if (CODE64(s))
5251             goto illegal_op;
5252         val = ldub_code(s->pc++);
5253         gen_op_aad(val);
5254         s->cc_op = CC_OP_LOGICB;
5255         break;
5256         /************************/
5257         /* misc */
5258     case 0x90: /* nop */
5259         /* XXX: xchg + rex handling */
5260         /* XXX: correct lock test for all insn */
5261         if (prefixes & PREFIX_LOCK)
5262             goto illegal_op;
5263         break;
5264     case 0x9b: /* fwait */
5265         if ((s->flags & (HF_MP_MASK | HF_TS_MASK)) ==
5266             (HF_MP_MASK | HF_TS_MASK)) {
5267             gen_exception(s, EXCP07_PREX, pc_start - s->cs_base);
5268         } else {
5269             if (s->cc_op != CC_OP_DYNAMIC)
5270                 gen_op_set_cc_op(s->cc_op);
5271             gen_jmp_im(pc_start - s->cs_base);
5272             gen_op_fwait();
5273         }
5274         break;
5275     case 0xcc: /* int3 */
5276         gen_interrupt(s, EXCP03_INT3, pc_start - s->cs_base, s->pc - s->cs_base);
5277         break;
5278     case 0xcd: /* int N */
5279         val = ldub_code(s->pc++);
5280         if (s->vm86 && s->iopl != 3) {
5281             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5282         } else {
5283             gen_interrupt(s, val, pc_start - s->cs_base, s->pc - s->cs_base);
5284         }
5285         break;
5286     case 0xce: /* into */
5287         if (CODE64(s))
5288             goto illegal_op;
5289         if (s->cc_op != CC_OP_DYNAMIC)
5290             gen_op_set_cc_op(s->cc_op);
5291         gen_jmp_im(pc_start - s->cs_base);
5292         gen_op_into(s->pc - pc_start);
5293         break;
5294     case 0xf1: /* icebp (undocumented, exits to external debugger) */
5295 #if 1
5296         gen_debug(s, pc_start - s->cs_base);
5297 #else
5298         /* start debug */
5299         tb_flush(cpu_single_env);
5300         cpu_set_log(CPU_LOG_INT | CPU_LOG_TB_IN_ASM);
5301 #endif
5302         break;
5303     case 0xfa: /* cli */
5304         if (!s->vm86) {
5305             if (s->cpl <= s->iopl) {
5306                 gen_op_cli();
5307             } else {
5308                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5309             }
5310         } else {
5311             if (s->iopl == 3) {
5312                 gen_op_cli();
5313             } else {
5314                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5315             }
5316         }
5317         break;
5318     case 0xfb: /* sti */
5319         if (!s->vm86) {
5320             if (s->cpl <= s->iopl) {
5321             gen_sti:
5322                 gen_op_sti();
5323                 /* interruptions are enabled only the first insn after sti */
5324                 /* If several instructions disable interrupts, only the
5325                    _first_ does it */
5326                 if (!(s->tb->flags & HF_INHIBIT_IRQ_MASK))
5327                     gen_op_set_inhibit_irq();
5328                 /* give a chance to handle pending irqs */
5329                 gen_jmp_im(s->pc - s->cs_base);
5330                 gen_eob(s);
5331             } else {
5332                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5333             }
5334         } else {
5335             if (s->iopl == 3) {
5336                 goto gen_sti;
5337             } else {
5338                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5339             }
5340         }
5341         break;
5342     case 0x62: /* bound */
5343         if (CODE64(s))
5344             goto illegal_op;
5345         ot = dflag ? OT_LONG : OT_WORD;
5346         modrm = ldub_code(s->pc++);
5347         reg = (modrm >> 3) & 7;
5348         mod = (modrm >> 6) & 3;
5349         if (mod == 3)
5350             goto illegal_op;
5351         gen_op_mov_TN_reg[ot][0][reg]();
5352         gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5353         gen_jmp_im(pc_start - s->cs_base);
5354         if (ot == OT_WORD)
5355             gen_op_boundw();
5356         else
5357             gen_op_boundl();
5358         break;
5359     case 0x1c8 ... 0x1cf: /* bswap reg */
5360         reg = (b & 7) | REX_B(s);
5361 #ifdef TARGET_X86_64
5362         if (dflag == 2) {
5363             gen_op_mov_TN_reg[OT_QUAD][0][reg]();
5364             gen_op_bswapq_T0();
5365             gen_op_mov_reg_T0[OT_QUAD][reg]();
5366         } else
5367 #endif
5368         {
5369             gen_op_mov_TN_reg[OT_LONG][0][reg]();
5370             gen_op_bswapl_T0();
5371             gen_op_mov_reg_T0[OT_LONG][reg]();
5372         }
5373         break;
5374     case 0xd6: /* salc */
5375         if (CODE64(s))
5376             goto illegal_op;
5377         if (s->cc_op != CC_OP_DYNAMIC)
5378             gen_op_set_cc_op(s->cc_op);
5379         gen_op_salc();
5380         break;
5381     case 0xe0: /* loopnz */
5382     case 0xe1: /* loopz */
5383         if (s->cc_op != CC_OP_DYNAMIC)
5384             gen_op_set_cc_op(s->cc_op);
5385         /* FALL THRU */
5386     case 0xe2: /* loop */
5387     case 0xe3: /* jecxz */
5388         {
5389             int l1, l2;
5390
5391             tval = (int8_t)insn_get(s, OT_BYTE);
5392             next_eip = s->pc - s->cs_base;
5393             tval += next_eip;
5394             if (s->dflag == 0)
5395                 tval &= 0xffff;
5396
5397             l1 = gen_new_label();
5398             l2 = gen_new_label();
5399             b &= 3;
5400             if (b == 3) {
5401                 gen_op_jz_ecx[s->aflag](l1);
5402             } else {
5403                 gen_op_dec_ECX[s->aflag]();
5404                 if (b <= 1)
5405                     gen_op_mov_T0_cc();
5406                 gen_op_loop[s->aflag][b](l1);
5407             }
5408
5409             gen_jmp_im(next_eip);
5410             gen_op_jmp_label(l2);
5411             gen_set_label(l1);
5412             gen_jmp_im(tval);
5413             gen_set_label(l2);
5414             gen_eob(s);
5415         }
5416         break;
5417     case 0x130: /* wrmsr */
5418     case 0x132: /* rdmsr */
5419         if (s->cpl != 0) {
5420             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5421         } else {
5422             if (b & 2)
5423                 gen_op_rdmsr();
5424             else
5425                 gen_op_wrmsr();
5426         }
5427         break;
5428     case 0x131: /* rdtsc */
5429         gen_jmp_im(pc_start - s->cs_base);
5430         gen_op_rdtsc();
5431         break;
5432     case 0x134: /* sysenter */
5433         if (CODE64(s))
5434             goto illegal_op;
5435         if (!s->pe) {
5436             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5437         } else {
5438             if (s->cc_op != CC_OP_DYNAMIC) {
5439                 gen_op_set_cc_op(s->cc_op);
5440                 s->cc_op = CC_OP_DYNAMIC;
5441             }
5442             gen_jmp_im(pc_start - s->cs_base);
5443             gen_op_sysenter();
5444             gen_eob(s);
5445         }
5446         break;
5447     case 0x135: /* sysexit */
5448         if (CODE64(s))
5449             goto illegal_op;
5450         if (!s->pe) {
5451             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5452         } else {
5453             if (s->cc_op != CC_OP_DYNAMIC) {
5454                 gen_op_set_cc_op(s->cc_op);
5455                 s->cc_op = CC_OP_DYNAMIC;
5456             }
5457             gen_jmp_im(pc_start - s->cs_base);
5458             gen_op_sysexit();
5459             gen_eob(s);
5460         }
5461         break;
5462 #ifdef TARGET_X86_64
5463     case 0x105: /* syscall */
5464         /* XXX: is it usable in real mode ? */
5465         if (s->cc_op != CC_OP_DYNAMIC) {
5466             gen_op_set_cc_op(s->cc_op);
5467             s->cc_op = CC_OP_DYNAMIC;
5468         }
5469         gen_jmp_im(pc_start - s->cs_base);
5470         gen_op_syscall(s->pc - pc_start);
5471         gen_eob(s);
5472         break;
5473     case 0x107: /* sysret */
5474         if (!s->pe) {
5475             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5476         } else {
5477             if (s->cc_op != CC_OP_DYNAMIC) {
5478                 gen_op_set_cc_op(s->cc_op);
5479                 s->cc_op = CC_OP_DYNAMIC;
5480             }
5481             gen_jmp_im(pc_start - s->cs_base);
5482             gen_op_sysret(s->dflag);
5483             /* condition codes are modified only in long mode */
5484             if (s->lma)
5485                 s->cc_op = CC_OP_EFLAGS;
5486             gen_eob(s);
5487         }
5488         break;
5489 #endif
5490     case 0x1a2: /* cpuid */
5491         gen_op_cpuid();
5492         break;
5493     case 0xf4: /* hlt */
5494         if (s->cpl != 0) {
5495             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5496         } else {
5497             if (s->cc_op != CC_OP_DYNAMIC)
5498                 gen_op_set_cc_op(s->cc_op);
5499             gen_jmp_im(s->pc - s->cs_base);
5500             gen_op_hlt();
5501             s->is_jmp = 3;
5502         }
5503         break;
5504     case 0x100:
5505         modrm = ldub_code(s->pc++);
5506         mod = (modrm >> 6) & 3;
5507         op = (modrm >> 3) & 7;
5508         switch(op) {
5509         case 0: /* sldt */
5510             if (!s->pe || s->vm86)
5511                 goto illegal_op;
5512             gen_op_movl_T0_env(offsetof(CPUX86State,ldt.selector));
5513             ot = OT_WORD;
5514             if (mod == 3)
5515                 ot += s->dflag;
5516             gen_ldst_modrm(s, modrm, ot, OR_TMP0, 1);
5517             break;
5518         case 2: /* lldt */
5519             if (!s->pe || s->vm86)
5520                 goto illegal_op;
5521             if (s->cpl != 0) {
5522                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5523             } else {
5524                 gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0);
5525                 gen_jmp_im(pc_start - s->cs_base);
5526                 gen_op_lldt_T0();
5527             }
5528             break;
5529         case 1: /* str */
5530             if (!s->pe || s->vm86)
5531                 goto illegal_op;
5532             gen_op_movl_T0_env(offsetof(CPUX86State,tr.selector));
5533             ot = OT_WORD;
5534             if (mod == 3)
5535                 ot += s->dflag;
5536             gen_ldst_modrm(s, modrm, ot, OR_TMP0, 1);
5537             break;
5538         case 3: /* ltr */
5539             if (!s->pe || s->vm86)
5540                 goto illegal_op;
5541             if (s->cpl != 0) {
5542                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5543             } else {
5544                 gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0);
5545                 gen_jmp_im(pc_start - s->cs_base);
5546                 gen_op_ltr_T0();
5547             }
5548             break;
5549         case 4: /* verr */
5550         case 5: /* verw */
5551             if (!s->pe || s->vm86)
5552                 goto illegal_op;
5553             gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0);
5554             if (s->cc_op != CC_OP_DYNAMIC)
5555                 gen_op_set_cc_op(s->cc_op);
5556             if (op == 4)
5557                 gen_op_verr();
5558             else
5559                 gen_op_verw();
5560             s->cc_op = CC_OP_EFLAGS;
5561             break;
5562         default:
5563             goto illegal_op;
5564         }
5565         break;
5566     case 0x101:
5567         modrm = ldub_code(s->pc++);
5568         mod = (modrm >> 6) & 3;
5569         op = (modrm >> 3) & 7;
5570         switch(op) {
5571         case 0: /* sgdt */
5572         case 1: /* sidt */
5573             if (mod == 3)
5574                 goto illegal_op;
5575             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5576             if (op == 0)
5577                 gen_op_movl_T0_env(offsetof(CPUX86State,gdt.limit));
5578             else
5579                 gen_op_movl_T0_env(offsetof(CPUX86State,idt.limit));
5580             gen_op_st_T0_A0[OT_WORD + s->mem_index]();
5581             gen_add_A0_im(s, 2);
5582             if (op == 0)
5583                 gen_op_movtl_T0_env(offsetof(CPUX86State,gdt.base));
5584             else
5585                 gen_op_movtl_T0_env(offsetof(CPUX86State,idt.base));
5586             if (!s->dflag)
5587                 gen_op_andl_T0_im(0xffffff);
5588             gen_op_st_T0_A0[CODE64(s) + OT_LONG + s->mem_index]();
5589             break;
5590         case 2: /* lgdt */
5591         case 3: /* lidt */
5592             if (mod == 3)
5593                 goto illegal_op;
5594             if (s->cpl != 0) {
5595                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5596             } else {
5597                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5598                 gen_op_ld_T1_A0[OT_WORD + s->mem_index]();
5599                 gen_add_A0_im(s, 2);
5600                 gen_op_ld_T0_A0[CODE64(s) + OT_LONG + s->mem_index]();
5601                 if (!s->dflag)
5602                     gen_op_andl_T0_im(0xffffff);
5603                 if (op == 2) {
5604                     gen_op_movtl_env_T0(offsetof(CPUX86State,gdt.base));
5605                     gen_op_movl_env_T1(offsetof(CPUX86State,gdt.limit));
5606                 } else {
5607                     gen_op_movtl_env_T0(offsetof(CPUX86State,idt.base));
5608                     gen_op_movl_env_T1(offsetof(CPUX86State,idt.limit));
5609                 }
5610             }
5611             break;
5612         case 4: /* smsw */
5613             gen_op_movl_T0_env(offsetof(CPUX86State,cr[0]));
5614             gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 1);
5615             break;
5616         case 6: /* lmsw */
5617             if (s->cpl != 0) {
5618                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5619             } else {
5620                 gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0);
5621                 gen_op_lmsw_T0();
5622                 gen_jmp_im(s->pc - s->cs_base);
5623                 gen_eob(s);
5624             }
5625             break;
5626         case 7: /* invlpg */
5627             if (s->cpl != 0) {
5628                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5629             } else {
5630                 if (mod == 3) {
5631 #ifdef TARGET_X86_64
5632                     if (CODE64(s) && (modrm & 7) == 0) {
5633                         /* swapgs */
5634                         gen_op_movtl_T0_env(offsetof(CPUX86State,segs[R_GS].base));
5635                         gen_op_movtl_T1_env(offsetof(CPUX86State,kernelgsbase));
5636                         gen_op_movtl_env_T1(offsetof(CPUX86State,segs[R_GS].base));
5637                         gen_op_movtl_env_T0(offsetof(CPUX86State,kernelgsbase));
5638                     } else
5639 #endif
5640                     {
5641                         goto illegal_op;
5642                     }
5643                 } else {
5644                     gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5645                     gen_op_invlpg_A0();
5646                     gen_jmp_im(s->pc - s->cs_base);
5647                     gen_eob(s);
5648                 }
5649             }
5650             break;
5651         default:
5652             goto illegal_op;
5653         }
5654         break;
5655     case 0x108: /* invd */
5656     case 0x109: /* wbinvd */
5657         if (s->cpl != 0) {
5658             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5659         } else {
5660             /* nothing to do */
5661         }
5662         break;
5663     case 0x63: /* arpl or movslS (x86_64) */
5664 #ifdef TARGET_X86_64
5665         if (CODE64(s)) {
5666             int d_ot;
5667             /* d_ot is the size of destination */
5668             d_ot = dflag + OT_WORD;
5669
5670             modrm = ldub_code(s->pc++);
5671             reg = ((modrm >> 3) & 7) | rex_r;
5672             mod = (modrm >> 6) & 3;
5673             rm = (modrm & 7) | REX_B(s);
5674
5675             if (mod == 3) {
5676                 gen_op_mov_TN_reg[OT_LONG][0][rm]();
5677                 /* sign extend */
5678                 if (d_ot == OT_QUAD)
5679                     gen_op_movslq_T0_T0();
5680                 gen_op_mov_reg_T0[d_ot][reg]();
5681             } else {
5682                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5683                 if (d_ot == OT_QUAD) {
5684                     gen_op_lds_T0_A0[OT_LONG + s->mem_index]();
5685                 } else {
5686                     gen_op_ld_T0_A0[OT_LONG + s->mem_index]();
5687                 }
5688                 gen_op_mov_reg_T0[d_ot][reg]();
5689             }
5690         } else
5691 #endif
5692         {
5693             if (!s->pe || s->vm86)
5694                 goto illegal_op;
5695             ot = dflag ? OT_LONG : OT_WORD;
5696             modrm = ldub_code(s->pc++);
5697             reg = (modrm >> 3) & 7;
5698             mod = (modrm >> 6) & 3;
5699             rm = modrm & 7;
5700             if (mod != 3) {
5701                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5702                 gen_op_ld_T0_A0[ot + s->mem_index]();
5703             } else {
5704                 gen_op_mov_TN_reg[ot][0][rm]();
5705             }
5706             if (s->cc_op != CC_OP_DYNAMIC)
5707                 gen_op_set_cc_op(s->cc_op);
5708             gen_op_arpl();
5709             s->cc_op = CC_OP_EFLAGS;
5710             if (mod != 3) {
5711                 gen_op_st_T0_A0[ot + s->mem_index]();
5712             } else {
5713                 gen_op_mov_reg_T0[ot][rm]();
5714             }
5715             gen_op_arpl_update();
5716         }
5717         break;
5718     case 0x102: /* lar */
5719     case 0x103: /* lsl */
5720         if (!s->pe || s->vm86)
5721             goto illegal_op;
5722         ot = dflag ? OT_LONG : OT_WORD;
5723         modrm = ldub_code(s->pc++);
5724         reg = ((modrm >> 3) & 7) | rex_r;
5725         gen_ldst_modrm(s, modrm, ot, OR_TMP0, 0);
5726         gen_op_mov_TN_reg[ot][1][reg]();
5727         if (s->cc_op != CC_OP_DYNAMIC)
5728             gen_op_set_cc_op(s->cc_op);
5729         if (b == 0x102)
5730             gen_op_lar();
5731         else
5732             gen_op_lsl();
5733         s->cc_op = CC_OP_EFLAGS;
5734         gen_op_mov_reg_T1[ot][reg]();
5735         break;
5736     case 0x118:
5737         modrm = ldub_code(s->pc++);
5738         mod = (modrm >> 6) & 3;
5739         op = (modrm >> 3) & 7;
5740         switch(op) {
5741         case 0: /* prefetchnta */
5742         case 1: /* prefetchnt0 */
5743         case 2: /* prefetchnt0 */
5744         case 3: /* prefetchnt0 */
5745             if (mod == 3)
5746                 goto illegal_op;
5747             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5748             /* nothing more to do */
5749             break;
5750         default:
5751             goto illegal_op;
5752         }
5753         break;
5754     case 0x120: /* mov reg, crN */
5755     case 0x122: /* mov crN, reg */
5756         if (s->cpl != 0) {
5757             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5758         } else {
5759             modrm = ldub_code(s->pc++);
5760             if ((modrm & 0xc0) != 0xc0)
5761                 goto illegal_op;
5762             rm = (modrm & 7) | REX_B(s);
5763             reg = ((modrm >> 3) & 7) | rex_r;
5764             if (CODE64(s))
5765                 ot = OT_QUAD;
5766             else
5767                 ot = OT_LONG;
5768             switch(reg) {
5769             case 0:
5770             case 2:
5771             case 3:
5772             case 4:
5773             case 8:
5774                 if (b & 2) {
5775                     gen_op_mov_TN_reg[ot][0][rm]();
5776                     gen_op_movl_crN_T0(reg);
5777                     gen_jmp_im(s->pc - s->cs_base);
5778                     gen_eob(s);
5779                 } else {
5780 #if !defined(CONFIG_USER_ONLY)
5781                     if (reg == 8)
5782                         gen_op_movtl_T0_cr8();
5783                     else
5784 #endif
5785                         gen_op_movtl_T0_env(offsetof(CPUX86State,cr[reg]));
5786                     gen_op_mov_reg_T0[ot][rm]();
5787                 }
5788                 break;
5789             default:
5790                 goto illegal_op;
5791             }
5792         }
5793         break;
5794     case 0x121: /* mov reg, drN */
5795     case 0x123: /* mov drN, reg */
5796         if (s->cpl != 0) {
5797             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5798         } else {
5799             modrm = ldub_code(s->pc++);
5800             if ((modrm & 0xc0) != 0xc0)
5801                 goto illegal_op;
5802             rm = (modrm & 7) | REX_B(s);
5803             reg = ((modrm >> 3) & 7) | rex_r;
5804             if (CODE64(s))
5805                 ot = OT_QUAD;
5806             else
5807                 ot = OT_LONG;
5808             /* XXX: do it dynamically with CR4.DE bit */
5809             if (reg == 4 || reg == 5 || reg >= 8)
5810                 goto illegal_op;
5811             if (b & 2) {
5812                 gen_op_mov_TN_reg[ot][0][rm]();
5813                 gen_op_movl_drN_T0(reg);
5814                 gen_jmp_im(s->pc - s->cs_base);
5815                 gen_eob(s);
5816             } else {
5817                 gen_op_movtl_T0_env(offsetof(CPUX86State,dr[reg]));
5818                 gen_op_mov_reg_T0[ot][rm]();
5819             }
5820         }
5821         break;
5822     case 0x106: /* clts */
5823         if (s->cpl != 0) {
5824             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
5825         } else {
5826             gen_op_clts();
5827             /* abort block because static cpu state changed */
5828             gen_jmp_im(s->pc - s->cs_base);
5829             gen_eob(s);
5830         }
5831         break;
5832     /* MMX/SSE/SSE2/PNI support */
5833     case 0x1c3: /* MOVNTI reg, mem */
5834         if (!(s->cpuid_features & CPUID_SSE2))
5835             goto illegal_op;
5836         ot = s->dflag == 2 ? OT_QUAD : OT_LONG;
5837         modrm = ldub_code(s->pc++);
5838         mod = (modrm >> 6) & 3;
5839         if (mod == 3)
5840             goto illegal_op;
5841         reg = ((modrm >> 3) & 7) | rex_r;
5842         /* generate a generic store */
5843         gen_ldst_modrm(s, modrm, ot, reg, 1);
5844         break;
5845     case 0x1ae:
5846         modrm = ldub_code(s->pc++);
5847         mod = (modrm >> 6) & 3;
5848         op = (modrm >> 3) & 7;
5849         switch(op) {
5850         case 0: /* fxsave */
5851             if (mod == 3 || !(s->cpuid_features & CPUID_FXSR) ||
5852                 (s->flags & HF_EM_MASK))
5853                 goto illegal_op;
5854             if (s->flags & HF_TS_MASK) {
5855                 gen_exception(s, EXCP07_PREX, pc_start - s->cs_base);
5856                 break;
5857             }
5858             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5859             gen_op_fxsave_A0((s->dflag == 2));
5860             break;
5861         case 1: /* fxrstor */
5862             if (mod == 3 || !(s->cpuid_features & CPUID_FXSR) ||
5863                 (s->flags & HF_EM_MASK))
5864                 goto illegal_op;
5865             if (s->flags & HF_TS_MASK) {
5866                 gen_exception(s, EXCP07_PREX, pc_start - s->cs_base);
5867                 break;
5868             }
5869             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5870             gen_op_fxrstor_A0((s->dflag == 2));
5871             break;
5872         case 2: /* ldmxcsr */
5873         case 3: /* stmxcsr */
5874             if (s->flags & HF_TS_MASK) {
5875                 gen_exception(s, EXCP07_PREX, pc_start - s->cs_base);
5876                 break;
5877             }
5878             if ((s->flags & HF_EM_MASK) || !(s->flags & HF_OSFXSR_MASK) ||
5879                 mod == 3)
5880                 goto illegal_op;
5881             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5882             if (op == 2) {
5883                 gen_op_ld_T0_A0[OT_LONG + s->mem_index]();
5884                 gen_op_movl_env_T0(offsetof(CPUX86State, mxcsr));
5885             } else {
5886                 gen_op_movl_T0_env(offsetof(CPUX86State, mxcsr));
5887                 gen_op_st_T0_A0[OT_LONG + s->mem_index]();
5888             }
5889             break;
5890         case 5: /* lfence */
5891         case 6: /* mfence */
5892             if ((modrm & 0xc7) != 0xc0 || !(s->cpuid_features & CPUID_SSE))
5893                 goto illegal_op;
5894             break;
5895         case 7: /* sfence / clflush */
5896             if ((modrm & 0xc7) == 0xc0) {
5897                 /* sfence */
5898                 if (!(s->cpuid_features & CPUID_SSE))
5899                     goto illegal_op;
5900             } else {
5901                 /* clflush */
5902                 if (!(s->cpuid_features & CPUID_CLFLUSH))
5903                     goto illegal_op;
5904                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5905             }
5906             break;
5907         default:
5908             goto illegal_op;
5909         }
5910         break;
5911     case 0x10d: /* prefetch */
5912         modrm = ldub_code(s->pc++);
5913         gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
5914         /* ignore for now */
5915         break;
5916     case 0x110 ... 0x117:
5917     case 0x128 ... 0x12f:
5918     case 0x150 ... 0x177:
5919     case 0x17c ... 0x17f:
5920     case 0x1c2:
5921     case 0x1c4 ... 0x1c6:
5922     case 0x1d0 ... 0x1fe:
5923         gen_sse(s, b, pc_start, rex_r);
5924         break;
5925     default:
5926         goto illegal_op;
5927     }
5928     /* lock generation */
5929     if (s->prefix & PREFIX_LOCK)
5930         gen_op_unlock();
5931     return s->pc;
5932  illegal_op:
5933     if (s->prefix & PREFIX_LOCK)
5934         gen_op_unlock();
5935     /* XXX: ensure that no lock was generated */
5936     gen_exception(s, EXCP06_ILLOP, pc_start - s->cs_base);
5937     return s->pc;
5938 }
5939
5940 #define CC_OSZAPC (CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C)
5941 #define CC_OSZAP (CC_O | CC_S | CC_Z | CC_A | CC_P)
5942
5943 /* flags read by an operation */
5944 static uint16_t opc_read_flags[NB_OPS] = {
5945     [INDEX_op_aas] = CC_A,
5946     [INDEX_op_aaa] = CC_A,
5947     [INDEX_op_das] = CC_A | CC_C,
5948     [INDEX_op_daa] = CC_A | CC_C,
5949
5950     /* subtle: due to the incl/decl implementation, C is used */
5951     [INDEX_op_update_inc_cc] = CC_C,
5952
5953     [INDEX_op_into] = CC_O,
5954
5955     [INDEX_op_jb_subb] = CC_C,
5956     [INDEX_op_jb_subw] = CC_C,
5957     [INDEX_op_jb_subl] = CC_C,
5958
5959     [INDEX_op_jz_subb] = CC_Z,
5960     [INDEX_op_jz_subw] = CC_Z,
5961     [INDEX_op_jz_subl] = CC_Z,
5962
5963     [INDEX_op_jbe_subb] = CC_Z | CC_C,
5964     [INDEX_op_jbe_subw] = CC_Z | CC_C,
5965     [INDEX_op_jbe_subl] = CC_Z | CC_C,
5966
5967     [INDEX_op_js_subb] = CC_S,
5968     [INDEX_op_js_subw] = CC_S,
5969     [INDEX_op_js_subl] = CC_S,
5970
5971     [INDEX_op_jl_subb] = CC_O | CC_S,
5972     [INDEX_op_jl_subw] = CC_O | CC_S,
5973     [INDEX_op_jl_subl] = CC_O | CC_S,
5974
5975     [INDEX_op_jle_subb] = CC_O | CC_S | CC_Z,
5976     [INDEX_op_jle_subw] = CC_O | CC_S | CC_Z,
5977     [INDEX_op_jle_subl] = CC_O | CC_S | CC_Z,
5978
5979     [INDEX_op_loopnzw] = CC_Z,
5980     [INDEX_op_loopnzl] = CC_Z,
5981     [INDEX_op_loopzw] = CC_Z,
5982     [INDEX_op_loopzl] = CC_Z,
5983
5984     [INDEX_op_seto_T0_cc] = CC_O,
5985     [INDEX_op_setb_T0_cc] = CC_C,
5986     [INDEX_op_setz_T0_cc] = CC_Z,
5987     [INDEX_op_setbe_T0_cc] = CC_Z | CC_C,
5988     [INDEX_op_sets_T0_cc] = CC_S,
5989     [INDEX_op_setp_T0_cc] = CC_P,
5990     [INDEX_op_setl_T0_cc] = CC_O | CC_S,
5991     [INDEX_op_setle_T0_cc] = CC_O | CC_S | CC_Z,
5992
5993     [INDEX_op_setb_T0_subb] = CC_C,
5994     [INDEX_op_setb_T0_subw] = CC_C,
5995     [INDEX_op_setb_T0_subl] = CC_C,
5996
5997     [INDEX_op_setz_T0_subb] = CC_Z,
5998     [INDEX_op_setz_T0_subw] = CC_Z,
5999     [INDEX_op_setz_T0_subl] = CC_Z,
6000
6001     [INDEX_op_setbe_T0_subb] = CC_Z | CC_C,
6002     [INDEX_op_setbe_T0_subw] = CC_Z | CC_C,
6003     [INDEX_op_setbe_T0_subl] = CC_Z | CC_C,
6004
6005     [INDEX_op_sets_T0_subb] = CC_S,
6006     [INDEX_op_sets_T0_subw] = CC_S,
6007     [INDEX_op_sets_T0_subl] = CC_S,
6008
6009     [INDEX_op_setl_T0_subb] = CC_O | CC_S,
6010     [INDEX_op_setl_T0_subw] = CC_O | CC_S,
6011     [INDEX_op_setl_T0_subl] = CC_O | CC_S,
6012
6013     [INDEX_op_setle_T0_subb] = CC_O | CC_S | CC_Z,
6014     [INDEX_op_setle_T0_subw] = CC_O | CC_S | CC_Z,
6015     [INDEX_op_setle_T0_subl] = CC_O | CC_S | CC_Z,
6016
6017     [INDEX_op_movl_T0_eflags] = CC_OSZAPC,
6018     [INDEX_op_cmc] = CC_C,
6019     [INDEX_op_salc] = CC_C,
6020
6021     /* needed for correct flag optimisation before string ops */
6022     [INDEX_op_jnz_ecxw] = CC_OSZAPC,
6023     [INDEX_op_jnz_ecxl] = CC_OSZAPC,
6024     [INDEX_op_jz_ecxw] = CC_OSZAPC,
6025     [INDEX_op_jz_ecxl] = CC_OSZAPC,
6026
6027 #ifdef TARGET_X86_64
6028     [INDEX_op_jb_subq] = CC_C,
6029     [INDEX_op_jz_subq] = CC_Z,
6030     [INDEX_op_jbe_subq] = CC_Z | CC_C,
6031     [INDEX_op_js_subq] = CC_S,
6032     [INDEX_op_jl_subq] = CC_O | CC_S,
6033     [INDEX_op_jle_subq] = CC_O | CC_S | CC_Z,
6034
6035     [INDEX_op_loopnzq] = CC_Z,
6036     [INDEX_op_loopzq] = CC_Z,
6037
6038     [INDEX_op_setb_T0_subq] = CC_C,
6039     [INDEX_op_setz_T0_subq] = CC_Z,
6040     [INDEX_op_setbe_T0_subq] = CC_Z | CC_C,
6041     [INDEX_op_sets_T0_subq] = CC_S,
6042     [INDEX_op_setl_T0_subq] = CC_O | CC_S,
6043     [INDEX_op_setle_T0_subq] = CC_O | CC_S | CC_Z,
6044
6045     [INDEX_op_jnz_ecxq] = CC_OSZAPC,
6046     [INDEX_op_jz_ecxq] = CC_OSZAPC,
6047 #endif
6048
6049 #define DEF_READF(SUFFIX)\
6050     [INDEX_op_adcb ## SUFFIX ## _T0_T1_cc] = CC_C,\
6051     [INDEX_op_adcw ## SUFFIX ## _T0_T1_cc] = CC_C,\
6052     [INDEX_op_adcl ## SUFFIX ## _T0_T1_cc] = CC_C,\
6053     X86_64_DEF([INDEX_op_adcq ## SUFFIX ## _T0_T1_cc] = CC_C,)\
6054     [INDEX_op_sbbb ## SUFFIX ## _T0_T1_cc] = CC_C,\
6055     [INDEX_op_sbbw ## SUFFIX ## _T0_T1_cc] = CC_C,\
6056     [INDEX_op_sbbl ## SUFFIX ## _T0_T1_cc] = CC_C,\
6057     X86_64_DEF([INDEX_op_sbbq ## SUFFIX ## _T0_T1_cc] = CC_C,)\
6058 \
6059     [INDEX_op_rclb ## SUFFIX ## _T0_T1_cc] = CC_C,\
6060     [INDEX_op_rclw ## SUFFIX ## _T0_T1_cc] = CC_C,\
6061     [INDEX_op_rcll ## SUFFIX ## _T0_T1_cc] = CC_C,\
6062     X86_64_DEF([INDEX_op_rclq ## SUFFIX ## _T0_T1_cc] = CC_C,)\
6063     [INDEX_op_rcrb ## SUFFIX ## _T0_T1_cc] = CC_C,\
6064     [INDEX_op_rcrw ## SUFFIX ## _T0_T1_cc] = CC_C,\
6065     [INDEX_op_rcrl ## SUFFIX ## _T0_T1_cc] = CC_C,\
6066     X86_64_DEF([INDEX_op_rcrq ## SUFFIX ## _T0_T1_cc] = CC_C,)
6067
6068     DEF_READF( )
6069     DEF_READF(_raw)
6070 #ifndef CONFIG_USER_ONLY
6071     DEF_READF(_kernel)
6072     DEF_READF(_user)
6073 #endif
6074 };
6075
6076 /* flags written by an operation */
6077 static uint16_t opc_write_flags[NB_OPS] = {
6078     [INDEX_op_update2_cc] = CC_OSZAPC,
6079     [INDEX_op_update1_cc] = CC_OSZAPC,
6080     [INDEX_op_cmpl_T0_T1_cc] = CC_OSZAPC,
6081     [INDEX_op_update_neg_cc] = CC_OSZAPC,
6082     /* subtle: due to the incl/decl implementation, C is used */
6083     [INDEX_op_update_inc_cc] = CC_OSZAPC,
6084     [INDEX_op_testl_T0_T1_cc] = CC_OSZAPC,
6085
6086     [INDEX_op_mulb_AL_T0] = CC_OSZAPC,
6087     [INDEX_op_mulw_AX_T0] = CC_OSZAPC,
6088     [INDEX_op_mull_EAX_T0] = CC_OSZAPC,
6089     X86_64_DEF([INDEX_op_mulq_EAX_T0] = CC_OSZAPC,)
6090     [INDEX_op_imulb_AL_T0] = CC_OSZAPC,
6091     [INDEX_op_imulw_AX_T0] = CC_OSZAPC,
6092     [INDEX_op_imull_EAX_T0] = CC_OSZAPC,
6093     X86_64_DEF([INDEX_op_imulq_EAX_T0] = CC_OSZAPC,)
6094     [INDEX_op_imulw_T0_T1] = CC_OSZAPC,
6095     [INDEX_op_imull_T0_T1] = CC_OSZAPC,
6096     X86_64_DEF([INDEX_op_imulq_T0_T1] = CC_OSZAPC,)
6097
6098     /* sse */
6099     [INDEX_op_ucomiss] = CC_OSZAPC,
6100     [INDEX_op_ucomisd] = CC_OSZAPC,
6101     [INDEX_op_comiss] = CC_OSZAPC,
6102     [INDEX_op_comisd] = CC_OSZAPC,
6103
6104     /* bcd */
6105     [INDEX_op_aam] = CC_OSZAPC,
6106     [INDEX_op_aad] = CC_OSZAPC,
6107     [INDEX_op_aas] = CC_OSZAPC,
6108     [INDEX_op_aaa] = CC_OSZAPC,
6109     [INDEX_op_das] = CC_OSZAPC,
6110     [INDEX_op_daa] = CC_OSZAPC,
6111
6112     [INDEX_op_movb_eflags_T0] = CC_S | CC_Z | CC_A | CC_P | CC_C,
6113     [INDEX_op_movw_eflags_T0] = CC_OSZAPC,
6114     [INDEX_op_movl_eflags_T0] = CC_OSZAPC,
6115     [INDEX_op_movw_eflags_T0_io] = CC_OSZAPC,
6116     [INDEX_op_movl_eflags_T0_io] = CC_OSZAPC,
6117     [INDEX_op_movw_eflags_T0_cpl0] = CC_OSZAPC,
6118     [INDEX_op_movl_eflags_T0_cpl0] = CC_OSZAPC,
6119     [INDEX_op_clc] = CC_C,
6120     [INDEX_op_stc] = CC_C,
6121     [INDEX_op_cmc] = CC_C,
6122
6123     [INDEX_op_btw_T0_T1_cc] = CC_OSZAPC,
6124     [INDEX_op_btl_T0_T1_cc] = CC_OSZAPC,
6125     X86_64_DEF([INDEX_op_btq_T0_T1_cc] = CC_OSZAPC,)
6126     [INDEX_op_btsw_T0_T1_cc] = CC_OSZAPC,
6127     [INDEX_op_btsl_T0_T1_cc] = CC_OSZAPC,
6128     X86_64_DEF([INDEX_op_btsq_T0_T1_cc] = CC_OSZAPC,)
6129     [INDEX_op_btrw_T0_T1_cc] = CC_OSZAPC,
6130     [INDEX_op_btrl_T0_T1_cc] = CC_OSZAPC,
6131     X86_64_DEF([INDEX_op_btrq_T0_T1_cc] = CC_OSZAPC,)
6132     [INDEX_op_btcw_T0_T1_cc] = CC_OSZAPC,
6133     [INDEX_op_btcl_T0_T1_cc] = CC_OSZAPC,
6134     X86_64_DEF([INDEX_op_btcq_T0_T1_cc] = CC_OSZAPC,)
6135
6136     [INDEX_op_bsfw_T0_cc] = CC_OSZAPC,
6137     [INDEX_op_bsfl_T0_cc] = CC_OSZAPC,
6138     X86_64_DEF([INDEX_op_bsfq_T0_cc] = CC_OSZAPC,)
6139     [INDEX_op_bsrw_T0_cc] = CC_OSZAPC,
6140     [INDEX_op_bsrl_T0_cc] = CC_OSZAPC,
6141     X86_64_DEF([INDEX_op_bsrq_T0_cc] = CC_OSZAPC,)
6142
6143     [INDEX_op_cmpxchgb_T0_T1_EAX_cc] = CC_OSZAPC,
6144     [INDEX_op_cmpxchgw_T0_T1_EAX_cc] = CC_OSZAPC,
6145     [INDEX_op_cmpxchgl_T0_T1_EAX_cc] = CC_OSZAPC,
6146     X86_64_DEF([INDEX_op_cmpxchgq_T0_T1_EAX_cc] = CC_OSZAPC,)
6147
6148     [INDEX_op_cmpxchg8b] = CC_Z,
6149     [INDEX_op_lar] = CC_Z,
6150     [INDEX_op_lsl] = CC_Z,
6151     [INDEX_op_verr] = CC_Z,
6152     [INDEX_op_verw] = CC_Z,
6153     [INDEX_op_fcomi_ST0_FT0] = CC_Z | CC_P | CC_C,
6154     [INDEX_op_fucomi_ST0_FT0] = CC_Z | CC_P | CC_C,
6155
6156 #define DEF_WRITEF(SUFFIX)\
6157     [INDEX_op_adcb ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6158     [INDEX_op_adcw ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6159     [INDEX_op_adcl ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6160     X86_64_DEF([INDEX_op_adcq ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,)\
6161     [INDEX_op_sbbb ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6162     [INDEX_op_sbbw ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6163     [INDEX_op_sbbl ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6164     X86_64_DEF([INDEX_op_sbbq ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,)\
6165 \
6166     [INDEX_op_rolb ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,\
6167     [INDEX_op_rolw ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,\
6168     [INDEX_op_roll ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,\
6169     X86_64_DEF([INDEX_op_rolq ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,)\
6170     [INDEX_op_rorb ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,\
6171     [INDEX_op_rorw ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,\
6172     [INDEX_op_rorl ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,\
6173     X86_64_DEF([INDEX_op_rorq ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,)\
6174 \
6175     [INDEX_op_rclb ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,\
6176     [INDEX_op_rclw ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,\
6177     [INDEX_op_rcll ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,\
6178     X86_64_DEF([INDEX_op_rclq ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,)\
6179     [INDEX_op_rcrb ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,\
6180     [INDEX_op_rcrw ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,\
6181     [INDEX_op_rcrl ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,\
6182     X86_64_DEF([INDEX_op_rcrq ## SUFFIX ## _T0_T1_cc] = CC_O | CC_C,)\
6183 \
6184     [INDEX_op_shlb ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6185     [INDEX_op_shlw ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6186     [INDEX_op_shll ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6187     X86_64_DEF([INDEX_op_shlq ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,)\
6188 \
6189     [INDEX_op_shrb ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6190     [INDEX_op_shrw ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6191     [INDEX_op_shrl ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6192     X86_64_DEF([INDEX_op_shrq ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,)\
6193 \
6194     [INDEX_op_sarb ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6195     [INDEX_op_sarw ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6196     [INDEX_op_sarl ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,\
6197     X86_64_DEF([INDEX_op_sarq ## SUFFIX ## _T0_T1_cc] = CC_OSZAPC,)\
6198 \
6199     [INDEX_op_shldw ## SUFFIX ## _T0_T1_ECX_cc] = CC_OSZAPC,\
6200     [INDEX_op_shldl ## SUFFIX ## _T0_T1_ECX_cc] = CC_OSZAPC,\
6201     X86_64_DEF([INDEX_op_shldq ## SUFFIX ## _T0_T1_ECX_cc] = CC_OSZAPC,)\
6202     [INDEX_op_shldw ## SUFFIX ## _T0_T1_im_cc] = CC_OSZAPC,\
6203     [INDEX_op_shldl ## SUFFIX ## _T0_T1_im_cc] = CC_OSZAPC,\
6204     X86_64_DEF([INDEX_op_shldq ## SUFFIX ## _T0_T1_im_cc] = CC_OSZAPC,)\
6205 \
6206     [INDEX_op_shrdw ## SUFFIX ## _T0_T1_ECX_cc] = CC_OSZAPC,\
6207     [INDEX_op_shrdl ## SUFFIX ## _T0_T1_ECX_cc] = CC_OSZAPC,\
6208     X86_64_DEF([INDEX_op_shrdq ## SUFFIX ## _T0_T1_ECX_cc] = CC_OSZAPC,)\
6209     [INDEX_op_shrdw ## SUFFIX ## _T0_T1_im_cc] = CC_OSZAPC,\
6210     [INDEX_op_shrdl ## SUFFIX ## _T0_T1_im_cc] = CC_OSZAPC,\
6211     X86_64_DEF([INDEX_op_shrdq ## SUFFIX ## _T0_T1_im_cc] = CC_OSZAPC,)\
6212 \
6213     [INDEX_op_cmpxchgb ## SUFFIX ## _T0_T1_EAX_cc] = CC_OSZAPC,\
6214     [INDEX_op_cmpxchgw ## SUFFIX ## _T0_T1_EAX_cc] = CC_OSZAPC,\
6215     [INDEX_op_cmpxchgl ## SUFFIX ## _T0_T1_EAX_cc] = CC_OSZAPC,\
6216     X86_64_DEF([INDEX_op_cmpxchgq ## SUFFIX ## _T0_T1_EAX_cc] = CC_OSZAPC,)
6217
6218
6219     DEF_WRITEF( )
6220     DEF_WRITEF(_raw)
6221 #ifndef CONFIG_USER_ONLY
6222     DEF_WRITEF(_kernel)
6223     DEF_WRITEF(_user)
6224 #endif
6225 };
6226
6227 /* simpler form of an operation if no flags need to be generated */
6228 static uint16_t opc_simpler[NB_OPS] = {
6229     [INDEX_op_update2_cc] = INDEX_op_nop,
6230     [INDEX_op_update1_cc] = INDEX_op_nop,
6231     [INDEX_op_update_neg_cc] = INDEX_op_nop,
6232 #if 0
6233     /* broken: CC_OP logic must be rewritten */
6234     [INDEX_op_update_inc_cc] = INDEX_op_nop,
6235 #endif
6236
6237     [INDEX_op_shlb_T0_T1_cc] = INDEX_op_shlb_T0_T1,
6238     [INDEX_op_shlw_T0_T1_cc] = INDEX_op_shlw_T0_T1,
6239     [INDEX_op_shll_T0_T1_cc] = INDEX_op_shll_T0_T1,
6240     X86_64_DEF([INDEX_op_shlq_T0_T1_cc] = INDEX_op_shlq_T0_T1,)
6241
6242     [INDEX_op_shrb_T0_T1_cc] = INDEX_op_shrb_T0_T1,
6243     [INDEX_op_shrw_T0_T1_cc] = INDEX_op_shrw_T0_T1,
6244     [INDEX_op_shrl_T0_T1_cc] = INDEX_op_shrl_T0_T1,
6245     X86_64_DEF([INDEX_op_shrq_T0_T1_cc] = INDEX_op_shrq_T0_T1,)
6246
6247     [INDEX_op_sarb_T0_T1_cc] = INDEX_op_sarb_T0_T1,
6248     [INDEX_op_sarw_T0_T1_cc] = INDEX_op_sarw_T0_T1,
6249     [INDEX_op_sarl_T0_T1_cc] = INDEX_op_sarl_T0_T1,
6250     X86_64_DEF([INDEX_op_sarq_T0_T1_cc] = INDEX_op_sarq_T0_T1,)
6251
6252 #define DEF_SIMPLER(SUFFIX)\
6253     [INDEX_op_rolb ## SUFFIX ## _T0_T1_cc] = INDEX_op_rolb ## SUFFIX ## _T0_T1,\
6254     [INDEX_op_rolw ## SUFFIX ## _T0_T1_cc] = INDEX_op_rolw ## SUFFIX ## _T0_T1,\
6255     [INDEX_op_roll ## SUFFIX ## _T0_T1_cc] = INDEX_op_roll ## SUFFIX ## _T0_T1,\
6256     X86_64_DEF([INDEX_op_rolq ## SUFFIX ## _T0_T1_cc] = INDEX_op_rolq ## SUFFIX ## _T0_T1,)\
6257 \
6258     [INDEX_op_rorb ## SUFFIX ## _T0_T1_cc] = INDEX_op_rorb ## SUFFIX ## _T0_T1,\
6259     [INDEX_op_rorw ## SUFFIX ## _T0_T1_cc] = INDEX_op_rorw ## SUFFIX ## _T0_T1,\
6260     [INDEX_op_rorl ## SUFFIX ## _T0_T1_cc] = INDEX_op_rorl ## SUFFIX ## _T0_T1,\
6261     X86_64_DEF([INDEX_op_rorq ## SUFFIX ## _T0_T1_cc] = INDEX_op_rorq ## SUFFIX ## _T0_T1,)
6262
6263     DEF_SIMPLER( )
6264     DEF_SIMPLER(_raw)
6265 #ifndef CONFIG_USER_ONLY
6266     DEF_SIMPLER(_kernel)
6267     DEF_SIMPLER(_user)
6268 #endif
6269 };
6270
6271 void optimize_flags_init(void)
6272 {
6273     int i;
6274     /* put default values in arrays */
6275     for(i = 0; i < NB_OPS; i++) {
6276         if (opc_simpler[i] == 0)
6277             opc_simpler[i] = i;
6278     }
6279 }
6280
6281 /* CPU flags computation optimization: we move backward thru the
6282    generated code to see which flags are needed. The operation is
6283    modified if suitable */
6284 static void optimize_flags(uint16_t *opc_buf, int opc_buf_len)
6285 {
6286     uint16_t *opc_ptr;
6287     int live_flags, write_flags, op;
6288
6289     opc_ptr = opc_buf + opc_buf_len;
6290     /* live_flags contains the flags needed by the next instructions
6291        in the code. At the end of the bloc, we consider that all the
6292        flags are live. */
6293     live_flags = CC_OSZAPC;
6294     while (opc_ptr > opc_buf) {
6295         op = *--opc_ptr;
6296         /* if none of the flags written by the instruction is used,
6297            then we can try to find a simpler instruction */
6298         write_flags = opc_write_flags[op];
6299         if ((live_flags & write_flags) == 0) {
6300             *opc_ptr = opc_simpler[op];
6301         }
6302         /* compute the live flags before the instruction */
6303         live_flags &= ~write_flags;
6304         live_flags |= opc_read_flags[op];
6305     }
6306 }
6307
6308 /* generate intermediate code in gen_opc_buf and gen_opparam_buf for
6309    basic block 'tb'. If search_pc is TRUE, also generate PC
6310    information for each intermediate instruction. */
6311 static inline int gen_intermediate_code_internal(CPUState *env,
6312                                                  TranslationBlock *tb,
6313                                                  int search_pc)
6314 {
6315     DisasContext dc1, *dc = &dc1;
6316     target_ulong pc_ptr;
6317     uint16_t *gen_opc_end;
6318     int flags, j, lj, cflags;
6319     target_ulong pc_start;
6320     target_ulong cs_base;
6321
6322     /* generate intermediate code */
6323     pc_start = tb->pc;
6324     cs_base = tb->cs_base;
6325     flags = tb->flags;
6326     cflags = tb->cflags;
6327
6328     dc->pe = (flags >> HF_PE_SHIFT) & 1;
6329     dc->code32 = (flags >> HF_CS32_SHIFT) & 1;
6330     dc->ss32 = (flags >> HF_SS32_SHIFT) & 1;
6331     dc->addseg = (flags >> HF_ADDSEG_SHIFT) & 1;
6332     dc->f_st = 0;
6333     dc->vm86 = (flags >> VM_SHIFT) & 1;
6334     dc->cpl = (flags >> HF_CPL_SHIFT) & 3;
6335     dc->iopl = (flags >> IOPL_SHIFT) & 3;
6336     dc->tf = (flags >> TF_SHIFT) & 1;
6337     dc->singlestep_enabled = env->singlestep_enabled;
6338     dc->cc_op = CC_OP_DYNAMIC;
6339     dc->cs_base = cs_base;
6340     dc->tb = tb;
6341     dc->popl_esp_hack = 0;
6342     /* select memory access functions */
6343     dc->mem_index = 0;
6344     if (flags & HF_SOFTMMU_MASK) {
6345         if (dc->cpl == 3)
6346             dc->mem_index = 2 * 4;
6347         else
6348             dc->mem_index = 1 * 4;
6349     }
6350     dc->cpuid_features = env->cpuid_features;
6351 #ifdef TARGET_X86_64
6352     dc->lma = (flags >> HF_LMA_SHIFT) & 1;
6353     dc->code64 = (flags >> HF_CS64_SHIFT) & 1;
6354 #endif
6355     dc->flags = flags;
6356     dc->jmp_opt = !(dc->tf || env->singlestep_enabled ||
6357                     (flags & HF_INHIBIT_IRQ_MASK)
6358 #ifndef CONFIG_SOFTMMU
6359                     || (flags & HF_SOFTMMU_MASK)
6360 #endif
6361                     );
6362 #if 0
6363     /* check addseg logic */
6364     if (!dc->addseg && (dc->vm86 || !dc->pe || !dc->code32))
6365         printf("ERROR addseg\n");
6366 #endif
6367
6368     gen_opc_ptr = gen_opc_buf;
6369     gen_opc_end = gen_opc_buf + OPC_MAX_SIZE;
6370     gen_opparam_ptr = gen_opparam_buf;
6371     nb_gen_labels = 0;
6372
6373     dc->is_jmp = DISAS_NEXT;
6374     pc_ptr = pc_start;
6375     lj = -1;
6376
6377     for(;;) {
6378         if (env->nb_breakpoints > 0) {
6379             for(j = 0; j < env->nb_breakpoints; j++) {
6380                 if (env->breakpoints[j] == pc_ptr) {
6381                     gen_debug(dc, pc_ptr - dc->cs_base);
6382                     break;
6383                 }
6384             }
6385         }
6386         if (search_pc) {
6387             j = gen_opc_ptr - gen_opc_buf;
6388             if (lj < j) {
6389                 lj++;
6390                 while (lj < j)
6391                     gen_opc_instr_start[lj++] = 0;
6392             }
6393             gen_opc_pc[lj] = pc_ptr;
6394             gen_opc_cc_op[lj] = dc->cc_op;
6395             gen_opc_instr_start[lj] = 1;
6396         }
6397         pc_ptr = disas_insn(dc, pc_ptr);
6398         /* stop translation if indicated */
6399         if (dc->is_jmp)
6400             break;
6401         /* if single step mode, we generate only one instruction and
6402            generate an exception */
6403         /* if irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
6404            the flag and abort the translation to give the irqs a
6405            change to be happen */
6406         if (dc->tf || dc->singlestep_enabled ||
6407             (flags & HF_INHIBIT_IRQ_MASK) ||
6408             (cflags & CF_SINGLE_INSN)) {
6409             gen_jmp_im(pc_ptr - dc->cs_base);
6410             gen_eob(dc);
6411             break;
6412         }
6413         /* if too long translation, stop generation too */
6414         if (gen_opc_ptr >= gen_opc_end ||
6415             (pc_ptr - pc_start) >= (TARGET_PAGE_SIZE - 32)) {
6416             gen_jmp_im(pc_ptr - dc->cs_base);
6417             gen_eob(dc);
6418             break;
6419         }
6420     }
6421     *gen_opc_ptr = INDEX_op_end;
6422     /* we don't forget to fill the last values */
6423     if (search_pc) {
6424         j = gen_opc_ptr - gen_opc_buf;
6425         lj++;
6426         while (lj <= j)
6427             gen_opc_instr_start[lj++] = 0;
6428     }
6429
6430 #ifdef DEBUG_DISAS
6431     if (loglevel & CPU_LOG_TB_CPU) {
6432         cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
6433     }
6434     if (loglevel & CPU_LOG_TB_IN_ASM) {
6435         int disas_flags;
6436         fprintf(logfile, "----------------\n");
6437         fprintf(logfile, "IN: %s\n", lookup_symbol(pc_start));
6438 #ifdef TARGET_X86_64
6439         if (dc->code64)
6440             disas_flags = 2;
6441         else
6442 #endif
6443             disas_flags = !dc->code32;
6444         target_disas(logfile, pc_start, pc_ptr - pc_start, disas_flags);
6445         fprintf(logfile, "\n");
6446         if (loglevel & CPU_LOG_TB_OP) {
6447             fprintf(logfile, "OP:\n");
6448             dump_ops(gen_opc_buf, gen_opparam_buf);
6449             fprintf(logfile, "\n");
6450         }
6451     }
6452 #endif
6453
6454     /* optimize flag computations */
6455     optimize_flags(gen_opc_buf, gen_opc_ptr - gen_opc_buf);
6456
6457 #ifdef DEBUG_DISAS
6458     if (loglevel & CPU_LOG_TB_OP_OPT) {
6459         fprintf(logfile, "AFTER FLAGS OPT:\n");
6460         dump_ops(gen_opc_buf, gen_opparam_buf);
6461         fprintf(logfile, "\n");
6462     }
6463 #endif
6464     if (!search_pc)
6465         tb->size = pc_ptr - pc_start;
6466     return 0;
6467 }
6468
6469 int gen_intermediate_code(CPUState *env, TranslationBlock *tb)
6470 {
6471     return gen_intermediate_code_internal(env, tb, 0);
6472 }
6473
6474 int gen_intermediate_code_pc(CPUState *env, TranslationBlock *tb)
6475 {
6476     return gen_intermediate_code_internal(env, tb, 1);
6477 }
6478