/* SPDX-License-Identifier: GPL-2.0-or-later */

/******************************************************************************

 * decode.c - helper for x86_emulate.c

 *

 * Generic x86 (32-bit and 64-bit) instruction decoder.

 *

 * Copyright (c) 2005-2007 Keir Fraser

 * Copyright (c) 2005-2007 XenSource Inc.

 */

#include "private.h"

#ifdef __XEN__

# include <xen/err.h>

#else

# define ERR_PTR(val) NULL

#endif

#define evex_encoded() (s->evex.mbs)

struct x86_emulate_state *

x86_decode_insn(

    struct x86_emulate_ctxt *ctxt,

    int (*insn_fetch)(

        unsigned long offset, void *p_data, unsigned int bytes,

        struct x86_emulate_ctxt *ctxt))

{

    static DEFINE_PER_CPU(struct x86_emulate_state, state);

    struct x86_emulate_state *s = &this_cpu(state);

    const struct x86_emulate_ops ops = {

        .insn_fetch = insn_fetch,

        .read       = x86emul_unhandleable_rw,

    };

    int rc;

    init_context(ctxt);

    rc = x86emul_decode(s, ctxt, &ops);

    if ( unlikely(rc != X86EMUL_OKAY) )

        return ERR_PTR(-rc);

#if defined(__XEN__) && !defined(NDEBUG)

    /*

     * While we avoid memory allocation (by use of per-CPU data) above,

     * nevertheless make sure callers properly release the state structure

     * for forward compatibility.

     */

    if ( s->caller )

    {

        printk(XENLOG_ERR "Unreleased emulation state acquired by %ps\n",

               s->caller);

        dump_execution_state();

    }

    s->caller = __builtin_return_address(0);

#endif

    return s;

}

static const opcode_desc_t opcode_table[256] = {

    /* 0x00 - 0x07 */

    ByteOp|DstMem|SrcReg|ModRM, DstMem|SrcReg|ModRM,

    ByteOp|DstReg|SrcMem|ModRM, DstReg|SrcMem|ModRM,

    ByteOp|DstEax|SrcImm, DstEax|SrcImm, ImplicitOps|Mov, ImplicitOps|Mov,

    /* 0x08 - 0x0F */

    ByteOp|DstMem|SrcReg|ModRM, DstMem|SrcReg|ModRM,

    ByteOp|DstReg|SrcMem|ModRM, DstReg|SrcMem|ModRM,

    ByteOp|DstEax|SrcImm, DstEax|SrcImm, ImplicitOps|Mov, 0,

    /* 0x10 - 0x17 */

    ByteOp|DstMem|SrcReg|ModRM, DstMem|SrcReg|ModRM,

    ByteOp|DstReg|SrcMem|ModRM, DstReg|SrcMem|ModRM,

    ByteOp|DstEax|SrcImm, DstEax|SrcImm, ImplicitOps|Mov, ImplicitOps|Mov,

    /* 0x18 - 0x1F */

    ByteOp|DstMem|SrcReg|ModRM, DstMem|SrcReg|ModRM,

    ByteOp|DstReg|SrcMem|ModRM, DstReg|SrcMem|ModRM,

    ByteOp|DstEax|SrcImm, DstEax|SrcImm, ImplicitOps|Mov, ImplicitOps|Mov,

    /* 0x20 - 0x27 */

    ByteOp|DstMem|SrcReg|ModRM, DstMem|SrcReg|ModRM,

    ByteOp|DstReg|SrcMem|ModRM, DstReg|SrcMem|ModRM,

    ByteOp|DstEax|SrcImm, DstEax|SrcImm, 0, ImplicitOps,

    /* 0x28 - 0x2F */

    ByteOp|DstMem|SrcReg|ModRM, DstMem|SrcReg|ModRM,

    ByteOp|DstReg|SrcMem|ModRM, DstReg|SrcMem|ModRM,

    ByteOp|DstEax|SrcImm, DstEax|SrcImm, 0, ImplicitOps,

    /* 0x30 - 0x37 */

    ByteOp|DstMem|SrcReg|ModRM, DstMem|SrcReg|ModRM,

    ByteOp|DstReg|SrcMem|ModRM, DstReg|SrcMem|ModRM,

    ByteOp|DstEax|SrcImm, DstEax|SrcImm, 0, ImplicitOps,

    /* 0x38 - 0x3F */

    ByteOp|DstReg|SrcMem|ModRM, DstReg|SrcMem|ModRM,

    ByteOp|DstReg|SrcMem|ModRM, DstReg|SrcMem|ModRM,

    ByteOp|DstEax|SrcImm, DstEax|SrcImm, 0, ImplicitOps,

    /* 0x40 - 0x4F */

    ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,

    ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,

    ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,

    ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,

    /* 0x50 - 0x5F */

    ImplicitOps|Mov, ImplicitOps|Mov, ImplicitOps|Mov, ImplicitOps|Mov,

    ImplicitOps|Mov, ImplicitOps|Mov, ImplicitOps|Mov, ImplicitOps|Mov,

    ImplicitOps|Mov, ImplicitOps|Mov, ImplicitOps|Mov, ImplicitOps|Mov,

    ImplicitOps|Mov, ImplicitOps|Mov, ImplicitOps|Mov, ImplicitOps|Mov,

    /* 0x60 - 0x67 */

    ImplicitOps, ImplicitOps, DstReg|SrcMem|ModRM, DstReg|SrcNone|ModRM|Mov,

    0, 0, 0, 0,

    /* 0x68 - 0x6F */

    DstImplicit|SrcImm|Mov, DstReg|SrcImm|ModRM|Mov,

    DstImplicit|SrcImmByte|Mov, DstReg|SrcImmByte|ModRM|Mov,

    ImplicitOps|Mov, ImplicitOps|Mov, ImplicitOps|Mov, ImplicitOps|Mov,

    /* 0x70 - 0x77 */

    DstImplicit|SrcImmByte, DstImplicit|SrcImmByte,

    DstImplicit|SrcImmByte, DstImplicit|SrcImmByte,

    DstImplicit|SrcImmByte, DstImplicit|SrcImmByte,

    DstImplicit|SrcImmByte, DstImplicit|SrcImmByte,

    /* 0x78 - 0x7F */

    DstImplicit|SrcImmByte, DstImplicit|SrcImmByte,

    DstImplicit|SrcImmByte, DstImplicit|SrcImmByte,

    DstImplicit|SrcImmByte, DstImplicit|SrcImmByte,

    DstImplicit|SrcImmByte, DstImplicit|SrcImmByte,

    /* 0x80 - 0x87 */

    ByteOp|DstMem|SrcImm|ModRM, DstMem|SrcImm|ModRM,

    ByteOp|DstMem|SrcImm|ModRM, DstMem|SrcImmByte|ModRM,

    ByteOp|DstReg|SrcMem|ModRM, DstReg|SrcMem|ModRM,

    ByteOp|DstMem|SrcReg|ModRM, DstMem|SrcReg|ModRM,

    /* 0x88 - 0x8F */

    ByteOp|DstMem|SrcReg|ModRM|Mov, DstMem|SrcReg|ModRM|Mov,

    ByteOp|DstReg|SrcMem|ModRM|Mov, DstReg|SrcMem|ModRM|Mov,

    DstMem|SrcReg|ModRM|Mov, DstReg|SrcNone|ModRM,

    DstReg|SrcMem16|ModRM|Mov, DstMem|SrcNone|ModRM|Mov,

    /* 0x90 - 0x97 */

    DstImplicit|SrcEax, DstImplicit|SrcEax,

    DstImplicit|SrcEax, DstImplicit|SrcEax,

    DstImplicit|SrcEax, DstImplicit|SrcEax,

    DstImplicit|SrcEax, DstImplicit|SrcEax,

    /* 0x98 - 0x9F */

    ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,

    ImplicitOps|Mov, ImplicitOps|Mov, ImplicitOps, ImplicitOps,

    /* 0xA0 - 0xA7 */

    ByteOp|DstEax|SrcMem|Mov, DstEax|SrcMem|Mov,

    ByteOp|DstMem|SrcEax|Mov, DstMem|SrcEax|Mov,

    ByteOp|ImplicitOps|Mov, ImplicitOps|Mov,

    ByteOp|ImplicitOps, ImplicitOps,

    /* 0xA8 - 0xAF */

    ByteOp|DstEax|SrcImm, DstEax|SrcImm,

    ByteOp|DstImplicit|SrcEax|Mov, DstImplicit|SrcEax|Mov,

    ByteOp|DstEax|SrcImplicit|Mov, DstEax|SrcImplicit|Mov,

    ByteOp|DstImplicit|SrcEax, DstImplicit|SrcEax,

    /* 0xB0 - 0xB7 */

    ByteOp|DstReg|SrcImm|Mov, ByteOp|DstReg|SrcImm|Mov,

    ByteOp|DstReg|SrcImm|Mov, ByteOp|DstReg|SrcImm|Mov,

    ByteOp|DstReg|SrcImm|Mov, ByteOp|DstReg|SrcImm|Mov,

    ByteOp|DstReg|SrcImm|Mov, ByteOp|DstReg|SrcImm|Mov,

    /* 0xB8 - 0xBF */

    DstReg|SrcImm|Mov, DstReg|SrcImm|Mov, DstReg|SrcImm|Mov, DstReg|SrcImm|Mov,

    DstReg|SrcImm|Mov, DstReg|SrcImm|Mov, DstReg|SrcImm|Mov, DstReg|SrcImm|Mov,

    /* 0xC0 - 0xC7 */

    ByteOp|DstMem|SrcImm|ModRM, DstMem|SrcImmByte|ModRM,

    DstImplicit|SrcImm16, ImplicitOps,

    DstReg|SrcMem|ModRM|Mov, DstReg|SrcMem|ModRM|Mov,

    ByteOp|DstMem|SrcImm|ModRM|Mov, DstMem|SrcImm|ModRM|Mov,

    /* 0xC8 - 0xCF */

    DstImplicit|SrcImm16, ImplicitOps, DstImplicit|SrcImm16, ImplicitOps,

    ImplicitOps, DstImplicit|SrcImmByte, ImplicitOps, ImplicitOps,

    /* 0xD0 - 0xD7 */

    ByteOp|DstMem|SrcImplicit|ModRM, DstMem|SrcImplicit|ModRM,

    ByteOp|DstMem|SrcImplicit|ModRM, DstMem|SrcImplicit|ModRM,

    DstImplicit|SrcImmByte, DstImplicit|SrcImmByte, ImplicitOps, ImplicitOps,

    /* 0xD8 - 0xDF */

    ImplicitOps|ModRM, ImplicitOps|ModRM|Mov,

    ImplicitOps|ModRM, ImplicitOps|ModRM|Mov,

    ImplicitOps|ModRM, ImplicitOps|ModRM|Mov,

    DstImplicit|SrcMem16|ModRM, ImplicitOps|ModRM|Mov,

    /* 0xE0 - 0xE7 */

    DstImplicit|SrcImmByte, DstImplicit|SrcImmByte,

    DstImplicit|SrcImmByte, DstImplicit|SrcImmByte,

    DstEax|SrcImmByte, DstEax|SrcImmByte,

    DstImplicit|SrcImmByte, DstImplicit|SrcImmByte,

    /* 0xE8 - 0xEF */

    DstImplicit|SrcImm|Mov, DstImplicit|SrcImm,

    ImplicitOps, DstImplicit|SrcImmByte,

    DstEax|SrcImplicit, DstEax|SrcImplicit, ImplicitOps, ImplicitOps,

    /* 0xF0 - 0xF7 */

    0, ImplicitOps, 0, 0,

    ImplicitOps, ImplicitOps, ByteOp|ModRM, ModRM,

    /* 0xF8 - 0xFF */

    ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,

    ImplicitOps, ImplicitOps, ByteOp|DstMem|SrcNone|ModRM, DstMem|SrcNone|ModRM

};

static const struct twobyte_table {

    opcode_desc_t desc;

    simd_opsize_t size:4;

    disp8scale_t d8s:4;

} twobyte_table[256] = {

    [0x00] = { ModRM },

    [0x01] = { ImplicitOps|ModRM },

    [0x02] = { DstReg|SrcMem16|ModRM },

    [0x03] = { DstReg|SrcMem16|ModRM },

    [0x05] = { ImplicitOps },

    [0x06] = { ImplicitOps },

    [0x07] = { ImplicitOps },

    [0x08] = { ImplicitOps },

    [0x09] = { ImplicitOps },

    [0x0b] = { ImplicitOps },

    [0x0d] = { ImplicitOps|ModRM },

    [0x0e] = { ImplicitOps },

    [0x0f] = { ModRM|SrcImmByte },

    [0x10] = { DstImplicit|SrcMem|ModRM|Mov, simd_any_fp, d8s_vl },

    [0x11] = { DstMem|SrcImplicit|ModRM|Mov, simd_any_fp, d8s_vl },

    [0x12] = { DstImplicit|SrcMem|ModRM|Mov, simd_other, 3 },

    [0x13] = { DstMem|SrcImplicit|ModRM|Mov, simd_other, 3 },

    [0x14 ... 0x15] = { DstImplicit|SrcMem|ModRM, simd_packed_fp, d8s_vl },

    [0x16] = { DstImplicit|SrcMem|ModRM|Mov, simd_other, 3 },

    [0x17] = { DstMem|SrcImplicit|ModRM|Mov, simd_other, 3 },

    [0x18 ... 0x1c] = { ImplicitOps|ModRM },

    [0x1d] = { ImplicitOps|ModRM, simd_none, d8s_vl },

    [0x1e ... 0x1f] = { ImplicitOps|ModRM },

    [0x20 ... 0x21] = { DstMem|SrcImplicit|ModRM },

    [0x22 ... 0x23] = { DstImplicit|SrcMem|ModRM },

    [0x28] = { DstImplicit|SrcMem|ModRM|Mov, simd_packed_fp, d8s_vl },

    [0x29] = { DstMem|SrcImplicit|ModRM|Mov, simd_packed_fp, d8s_vl },

    [0x2a] = { DstImplicit|SrcMem|ModRM|Mov, simd_other, d8s_dq64 },

    [0x2b] = { DstMem|SrcImplicit|ModRM|Mov, simd_any_fp, d8s_vl },

    [0x2c ... 0x2d] = { DstImplicit|SrcMem|ModRM|Mov, simd_other },

    [0x2e ... 0x2f] = { ImplicitOps|ModRM|TwoOp, simd_none, d8s_dq },

    [0x30 ... 0x35] = { ImplicitOps },

    [0x37] = { ImplicitOps },

    [0x38] = { DstReg|SrcMem|ModRM },

    [0x3a] = { DstReg|SrcImmByte|ModRM },

    [0x40 ... 0x4f] = { DstReg|SrcMem|ModRM|Mov },

    [0x50] = { DstReg|SrcImplicit|ModRM|Mov },

    [0x51] = { DstImplicit|SrcMem|ModRM|TwoOp, simd_any_fp, d8s_vl },

    [0x52 ... 0x53] = { DstImplicit|SrcMem|ModRM|TwoOp, simd_single_fp },

    [0x54 ... 0x57] = { DstImplicit|SrcMem|ModRM, simd_packed_fp, d8s_vl },

    [0x58 ... 0x59] = { DstImplicit|SrcMem|ModRM, simd_any_fp, d8s_vl },

    [0x5a] = { DstImplicit|SrcMem|ModRM|Mov, simd_any_fp, d8s_vl },

    [0x5b] = { DstImplicit|SrcMem|ModRM|Mov, simd_packed_fp, d8s_vl },

    [0x5c ... 0x5f] = { DstImplicit|SrcMem|ModRM, simd_any_fp, d8s_vl },

    [0x60 ... 0x62] = { DstImplicit|SrcMem|ModRM, simd_other, d8s_vl },

    [0x63 ... 0x67] = { DstImplicit|SrcMem|ModRM, simd_packed_int, d8s_vl },

    [0x68 ... 0x6a] = { DstImplicit|SrcMem|ModRM, simd_other, d8s_vl },

    [0x6b ... 0x6d] = { DstImplicit|SrcMem|ModRM, simd_packed_int, d8s_vl },

    [0x6e] = { DstImplicit|SrcMem|ModRM|Mov, simd_none, d8s_dq64 },

    [0x6f] = { DstImplicit|SrcMem|ModRM|Mov, simd_packed_int, d8s_vl },

    [0x70] = { SrcImmByte|ModRM|TwoOp, simd_other, d8s_vl },

    [0x71 ... 0x73] = { DstImplicit|SrcImmByte|ModRM, simd_none, d8s_vl },

    [0x74 ... 0x76] = { DstImplicit|SrcMem|ModRM, simd_packed_int, d8s_vl },

    [0x77] = { DstImplicit|SrcNone },

    [0x78 ... 0x79] = { DstImplicit|SrcMem|ModRM|Mov, simd_other, d8s_vl },

    [0x7a] = { DstImplicit|SrcMem|ModRM|Mov, simd_packed_fp, d8s_vl },

    [0x7b] = { DstImplicit|SrcMem|ModRM|Mov, simd_other, d8s_dq64 },

    [0x7c ... 0x7d] = { DstImplicit|SrcMem|ModRM, simd_other, d8s_vl },

    [0x7e] = { DstMem|SrcImplicit|ModRM|Mov, simd_none, d8s_dq64 },

    [0x7f] = { DstMem|SrcImplicit|ModRM|Mov, simd_packed_int, d8s_vl },

    [0x80 ... 0x8f] = { DstImplicit|SrcImm },

    [0x90 ... 0x9f] = { ByteOp|DstMem|SrcNone|ModRM|Mov },

    [0xa0 ... 0xa1] = { ImplicitOps|Mov },

    [0xa2] = { ImplicitOps },

    [0xa3] = { DstBitBase|SrcReg|ModRM },

    [0xa4] = { DstMem|SrcImmByte|ModRM },

    [0xa5] = { DstMem|SrcReg|ModRM },

    [0xa6 ... 0xa7] = { ModRM },

    [0xa8 ... 0xa9] = { ImplicitOps|Mov },

    [0xaa] = { ImplicitOps },

    [0xab] = { DstBitBase|SrcReg|ModRM },

    [0xac] = { DstMem|SrcImmByte|ModRM },

    [0xad] = { DstMem|SrcReg|ModRM },

    [0xae] = { ImplicitOps|ModRM },

    [0xaf] = { DstReg|SrcMem|ModRM },

    [0xb0] = { ByteOp|DstMem|SrcReg|ModRM },

    [0xb1] = { DstMem|SrcReg|ModRM },

    [0xb2] = { DstReg|SrcMem|ModRM|Mov },

    [0xb3] = { DstBitBase|SrcReg|ModRM },

    [0xb4 ... 0xb5] = { DstReg|SrcMem|ModRM|Mov },

    [0xb6] = { ByteOp|DstReg|SrcMem|ModRM|Mov },

    [0xb7] = { DstReg|SrcMem16|ModRM|Mov },

    [0xb8] = { DstReg|SrcMem|ModRM },

    [0xb9] = { ModRM },

    [0xba] = { DstBitBase|SrcImmByte|ModRM },

    [0xbb] = { DstBitBase|SrcReg|ModRM },

    [0xbc ... 0xbd] = { DstReg|SrcMem|ModRM },

    [0xbe] = { ByteOp|DstReg|SrcMem|ModRM|Mov },

    [0xbf] = { DstReg|SrcMem16|ModRM|Mov },

    [0xc0] = { ByteOp|DstMem|SrcReg|ModRM },

    [0xc1] = { DstMem|SrcReg|ModRM },

    [0xc2] = { DstImplicit|SrcImmByte|ModRM, simd_any_fp, d8s_vl },

    [0xc3] = { DstMem|SrcReg|ModRM|Mov },

    [0xc4] = { DstImplicit|SrcImmByte|ModRM, simd_none, 1 },

    [0xc5] = { DstReg|SrcImmByte|ModRM|Mov },

    [0xc6] = { DstImplicit|SrcImmByte|ModRM, simd_packed_fp, d8s_vl },

    [0xc7] = { ImplicitOps|ModRM },

    [0xc8 ... 0xcf] = { ImplicitOps },

    [0xd0] = { DstImplicit|SrcMem|ModRM, simd_other },

    [0xd1 ... 0xd3] = { DstImplicit|SrcMem|ModRM, simd_128, 4 },

    [0xd4 ... 0xd5] = { DstImplicit|SrcMem|ModRM, simd_packed_int, d8s_vl },

    [0xd6] = { DstMem|SrcImplicit|ModRM|Mov, simd_other, 3 },

    [0xd7] = { DstReg|SrcImplicit|ModRM|Mov },

    [0xd8 ... 0xdf] = { DstImplicit|SrcMem|ModRM, simd_packed_int, d8s_vl },

    [0xe0] = { DstImplicit|SrcMem|ModRM, simd_packed_int, d8s_vl },

    [0xe1 ... 0xe2] = { DstImplicit|SrcMem|ModRM, simd_128, 4 },

    [0xe3 ... 0xe5] = { DstImplicit|SrcMem|ModRM, simd_packed_int, d8s_vl },

    [0xe6] = { DstImplicit|SrcMem|ModRM|Mov, simd_packed_fp, d8s_vl },

    [0xe7] = { DstMem|SrcImplicit|ModRM|Mov, simd_packed_int, d8s_vl },

    [0xe8 ... 0xef] = { DstImplicit|SrcMem|ModRM, simd_packed_int, d8s_vl },

    [0xf0] = { DstImplicit|SrcMem|ModRM|Mov, simd_other },

    [0xf1 ... 0xf3] = { DstImplicit|SrcMem|ModRM, simd_128, 4 },

    [0xf4 ... 0xf6] = { DstImplicit|SrcMem|ModRM, simd_packed_int, d8s_vl },

    [0xf7] = { DstMem|SrcMem|ModRM|Mov, simd_packed_int },

    [0xf8 ... 0xfe] = { DstImplicit|SrcMem|ModRM, simd_packed_int, d8s_vl },

    [0xff] = { ModRM }

};

/*

 * "two_op" and "four_op" below refer to the number of register operands

 * (one of which possibly also allowing to be a memory one). The named

 * operand counts do not include any immediate operands.

 */

static const struct ext0f38_table {

    uint8_t simd_size:5;

    uint8_t to_mem:1;

    uint8_t two_op:1;

    uint8_t vsib:1;

    disp8scale_t d8s:4;

} ext0f38_table[256] = {

    [0x00] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x01 ... 0x03] = { .simd_size = simd_packed_int },

    [0x04] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x05 ... 0x0a] = { .simd_size = simd_packed_int },

    [0x0b] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x0c ... 0x0d] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0x0e ... 0x0f] = { .simd_size = simd_packed_fp },

    [0x10 ... 0x12] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x13] = { .simd_size = simd_other, .two_op = 1, .d8s = d8s_vl_by_2 },

    [0x14 ... 0x16] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0x17] = { .simd_size = simd_packed_int, .two_op = 1 },

    [0x18] = { .simd_size = simd_scalar_opc, .two_op = 1, .d8s = 2 },

    [0x19] = { .simd_size = simd_scalar_opc, .two_op = 1, .d8s = 3 },

    [0x1a] = { .simd_size = simd_128, .two_op = 1, .d8s = 4 },

    [0x1b] = { .simd_size = simd_256, .two_op = 1, .d8s = d8s_vl_by_2 },

    [0x1c ... 0x1f] = { .simd_size = simd_packed_int, .two_op = 1, .d8s = d8s_vl },

    [0x20] = { .simd_size = simd_other, .two_op = 1, .d8s = d8s_vl_by_2 },

    [0x21] = { .simd_size = simd_other, .two_op = 1, .d8s = d8s_vl_by_4 },

    [0x22] = { .simd_size = simd_other, .two_op = 1, .d8s = d8s_vl_by_8 },

    [0x23] = { .simd_size = simd_other, .two_op = 1, .d8s = d8s_vl_by_2 },

    [0x24] = { .simd_size = simd_other, .two_op = 1, .d8s = d8s_vl_by_4 },

    [0x25] = { .simd_size = simd_other, .two_op = 1, .d8s = d8s_vl_by_2 },

    [0x26 ... 0x29] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x2a] = { .simd_size = simd_packed_int, .two_op = 1, .d8s = d8s_vl },

    [0x2b] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x2c] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0x2d] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0x2e ... 0x2f] = { .simd_size = simd_packed_fp, .to_mem = 1 },

    [0x30] = { .simd_size = simd_other, .two_op = 1, .d8s = d8s_vl_by_2 },

    [0x31] = { .simd_size = simd_other, .two_op = 1, .d8s = d8s_vl_by_4 },

    [0x32] = { .simd_size = simd_other, .two_op = 1, .d8s = d8s_vl_by_8 },

    [0x33] = { .simd_size = simd_other, .two_op = 1, .d8s = d8s_vl_by_2 },

    [0x34] = { .simd_size = simd_other, .two_op = 1, .d8s = d8s_vl_by_4 },

    [0x35] = { .simd_size = simd_other, .two_op = 1, .d8s = d8s_vl_by_2 },

    [0x36 ... 0x3f] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x40] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x41] = { .simd_size = simd_packed_int, .two_op = 1 },

    [0x42] = { .simd_size = simd_packed_fp, .two_op = 1, .d8s = d8s_vl },

    [0x43] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0x44] = { .simd_size = simd_packed_int, .two_op = 1, .d8s = d8s_vl },

    [0x45 ... 0x47] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x4c] = { .simd_size = simd_packed_fp, .two_op = 1, .d8s = d8s_vl },

    [0x4d] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0x4e] = { .simd_size = simd_packed_fp, .two_op = 1, .d8s = d8s_vl },

    [0x4f] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0x50 ... 0x53] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x54 ... 0x55] = { .simd_size = simd_packed_int, .two_op = 1, .d8s = d8s_vl },

    [0x56] = { .simd_size = simd_other, .d8s = d8s_vl },

    [0x57] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0x58] = { .simd_size = simd_other, .two_op = 1, .d8s = 2 },

    [0x59] = { .simd_size = simd_other, .two_op = 1, .d8s = 3 },

    [0x5a] = { .simd_size = simd_128, .two_op = 1, .d8s = 4 },

    [0x5b] = { .simd_size = simd_256, .two_op = 1, .d8s = d8s_vl_by_2 },

    [0x62] = { .simd_size = simd_packed_int, .two_op = 1, .d8s = d8s_bw },

    [0x63] = { .simd_size = simd_packed_int, .to_mem = 1, .two_op = 1, .d8s = d8s_bw },

    [0x64 ... 0x66] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x68] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x70 ... 0x73] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x75 ... 0x76] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x77] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0x78] = { .simd_size = simd_other, .two_op = 1 },

    [0x79] = { .simd_size = simd_other, .two_op = 1, .d8s = 1 },

    [0x7a ... 0x7c] = { .simd_size = simd_none, .two_op = 1 },

    [0x7d ... 0x7e] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x7f] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0x80 ... 0x81] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x82] = { .simd_size = simd_other },

    [0x83] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x88] = { .simd_size = simd_packed_fp, .two_op = 1, .d8s = d8s_dq },

    [0x89] = { .simd_size = simd_packed_int, .two_op = 1, .d8s = d8s_dq },

    [0x8a] = { .simd_size = simd_packed_fp, .to_mem = 1, .two_op = 1, .d8s = d8s_dq },

    [0x8b] = { .simd_size = simd_packed_int, .to_mem = 1, .two_op = 1, .d8s = d8s_dq },

    [0x8c] = { .simd_size = simd_packed_int },

    [0x8d] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x8e] = { .simd_size = simd_packed_int, .to_mem = 1 },

    [0x8f] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x90 ... 0x93] = { .simd_size = simd_other, .vsib = 1, .d8s = d8s_dq },

    [0x96 ... 0x98] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0x99] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0x9a] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0x9b] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0x9c] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0x9d] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0x9e] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0x9f] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0xa0 ... 0xa3] = { .simd_size = simd_other, .to_mem = 1, .vsib = 1, .d8s = d8s_dq },

    [0xa6 ... 0xa8] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0xa9] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0xaa] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0xab] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0xac] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0xad] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0xae] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0xaf] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0xb0] = { .simd_size = simd_other, .two_op = 1 },

    [0xb1] = { .simd_size = simd_other, .two_op = 1 },

    [0xb4 ... 0xb5] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0xb6 ... 0xb8] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0xb9] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0xba] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0xbb] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0xbc] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0xbd] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0xbe] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0xbf] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0xc4] = { .simd_size = simd_packed_int, .two_op = 1, .d8s = d8s_vl },

    [0xc8] = { .simd_size = simd_packed_fp, .two_op = 1, .d8s = d8s_vl },

    [0xc9] = { .simd_size = simd_other },

    [0xca] = { .simd_size = simd_packed_fp, .two_op = 1, .d8s = d8s_vl },

    [0xcb] = { .simd_size = simd_other, .d8s = d8s_vl },

    [0xcc ... 0xcd] = { .simd_size = simd_other, .two_op = 1, .d8s = d8s_vl },

    [0xcf] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0xd2] = { .simd_size = simd_other },

    [0xd3] = { .simd_size = simd_other },

    [0xd6] = { .simd_size = simd_other, .d8s = d8s_vl },

    [0xd7] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0xda] = { .simd_size = simd_other },

    [0xdb] = { .simd_size = simd_packed_int, .two_op = 1 },

    [0xdc ... 0xdf] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0xe0 ... 0xef] = { .to_mem = 1 },

    [0xf0] = { .two_op = 1 },

    [0xf1] = { .to_mem = 1, .two_op = 1 },

    [0xf2 ... 0xf3] = {},

    [0xf5 ... 0xf7] = {},

    [0xf8] = { .simd_size = simd_other },

    [0xf9] = { .to_mem = 1, .two_op = 1 /* Mov */ },

};

static const struct ext0f3a_table {

    uint8_t simd_size:5;

    uint8_t to_mem:1;

    uint8_t two_op:1;

    uint8_t four_op:1;

    disp8scale_t d8s:4;

} ext0f3a_table[256] = {

    [0x00] = { .simd_size = simd_packed_int, .two_op = 1, .d8s = d8s_vl },

    [0x01] = { .simd_size = simd_packed_fp, .two_op = 1, .d8s = d8s_vl },

    [0x02] = { .simd_size = simd_packed_int },

    [0x03] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x04 ... 0x05] = { .simd_size = simd_packed_fp, .two_op = 1, .d8s = d8s_vl },

    [0x06] = { .simd_size = simd_packed_fp },

    [0x08 ... 0x09] = { .simd_size = simd_packed_fp, .two_op = 1, .d8s = d8s_vl },

    [0x0a ... 0x0b] = { .simd_size = simd_scalar_opc, .d8s = d8s_dq },

    [0x0c ... 0x0d] = { .simd_size = simd_packed_fp },

    [0x0e] = { .simd_size = simd_packed_int },

    [0x0f] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x14] = { .simd_size = simd_none, .to_mem = 1, .two_op = 1, .d8s = 0 },

    [0x15] = { .simd_size = simd_none, .to_mem = 1, .two_op = 1, .d8s = 1 },

    [0x16] = { .simd_size = simd_none, .to_mem = 1, .two_op = 1, .d8s = d8s_dq64 },

    [0x17] = { .simd_size = simd_none, .to_mem = 1, .two_op = 1, .d8s = 2 },

    [0x18] = { .simd_size = simd_128, .d8s = 4 },

    [0x19] = { .simd_size = simd_128, .to_mem = 1, .two_op = 1, .d8s = 4 },

    [0x1a] = { .simd_size = simd_256, .d8s = d8s_vl_by_2 },

    [0x1b] = { .simd_size = simd_256, .to_mem = 1, .two_op = 1, .d8s = d8s_vl_by_2 },

    [0x1d] = { .simd_size = simd_other, .to_mem = 1, .two_op = 1, .d8s = d8s_vl_by_2 },

    [0x1e ... 0x1f] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x20] = { .simd_size = simd_none, .d8s = 0 },

    [0x21] = { .simd_size = simd_other, .d8s = 2 },

    [0x22] = { .simd_size = simd_none, .d8s = d8s_dq64 },

    [0x23] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x25] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x26] = { .simd_size = simd_packed_fp, .two_op = 1, .d8s = d8s_vl },

    [0x27] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0x30 ... 0x33] = { .simd_size = simd_other, .two_op = 1 },

    [0x38] = { .simd_size = simd_128, .d8s = 4 },

    [0x3a] = { .simd_size = simd_256, .d8s = d8s_vl_by_2 },

    [0x39] = { .simd_size = simd_128, .to_mem = 1, .two_op = 1, .d8s = 4 },

    [0x3b] = { .simd_size = simd_256, .to_mem = 1, .two_op = 1, .d8s = d8s_vl_by_2 },

    [0x3e ... 0x3f] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x40 ... 0x41] = { .simd_size = simd_packed_fp },

    [0x42 ... 0x43] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x44] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x46] = { .simd_size = simd_packed_int },

    [0x48 ... 0x49] = { .simd_size = simd_packed_fp, .four_op = 1 },

    [0x4a ... 0x4b] = { .simd_size = simd_packed_fp, .four_op = 1 },

    [0x4c] = { .simd_size = simd_packed_int, .four_op = 1 },

    [0x50] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0x51] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0x54] = { .simd_size = simd_packed_fp, .d8s = d8s_vl },

    [0x55] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0x56] = { .simd_size = simd_packed_fp, .two_op = 1, .d8s = d8s_vl },

    [0x57] = { .simd_size = simd_scalar_vexw, .d8s = d8s_dq },

    [0x5c ... 0x5f] = { .simd_size = simd_packed_fp, .four_op = 1 },

    [0x60 ... 0x63] = { .simd_size = simd_packed_int, .two_op = 1 },

    [0x66] = { .simd_size = simd_packed_fp, .two_op = 1, .d8s = d8s_vl },

    [0x67] = { .simd_size = simd_scalar_vexw, .two_op = 1, .d8s = d8s_dq },

    [0x68 ... 0x69] = { .simd_size = simd_packed_fp, .four_op = 1 },

    [0x6a ... 0x6b] = { .simd_size = simd_scalar_opc, .four_op = 1 },

    [0x6c ... 0x6d] = { .simd_size = simd_packed_fp, .four_op = 1 },

    [0x6e ... 0x6f] = { .simd_size = simd_scalar_opc, .four_op = 1 },

    [0x70 ... 0x73] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0x78 ... 0x79] = { .simd_size = simd_packed_fp, .four_op = 1 },

    [0x7a ... 0x7b] = { .simd_size = simd_scalar_opc, .four_op = 1 },

    [0x7c ... 0x7d] = { .simd_size = simd_packed_fp, .four_op = 1 },

    [0x7e ... 0x7f] = { .simd_size = simd_scalar_opc, .four_op = 1 },

    [0xc2] = { .simd_size = simd_any_fp, .d8s = d8s_vl },

    [0xcc] = { .simd_size = simd_other },

    [0xce ... 0xcf] = { .simd_size = simd_packed_int, .d8s = d8s_vl },

    [0xde] = { .simd_size = simd_other },

    [0xdf] = { .simd_size = simd_packed_int, .two_op = 1 },

    [0xf0] = { .two_op = 1 /* Mov */ },

};

static const opcode_desc_t xop_table[] = {

    DstReg|SrcImmByte|ModRM,

    DstReg|SrcMem|ModRM,

    DstReg|SrcImm|ModRM,

};

static const struct ext8f08_table {

    uint8_t simd_size:5;

    uint8_t two_op:1;

    uint8_t four_op:1;

} ext8f08_table[256] = {

    [0xa2] = { .simd_size = simd_packed_int, .four_op = 1 },

    [0x85 ... 0x87] = { .simd_size = simd_packed_int, .four_op = 1 },

    [0x8e ... 0x8f] = { .simd_size = simd_packed_int, .four_op = 1 },

    [0x95 ... 0x97] = { .simd_size = simd_packed_int, .four_op = 1 },

    [0x9e ... 0x9f] = { .simd_size = simd_packed_int, .four_op = 1 },

    [0xa3] = { .simd_size = simd_packed_int, .four_op = 1 },

    [0xa6] = { .simd_size = simd_packed_int, .four_op = 1 },

    [0xb6] = { .simd_size = simd_packed_int, .four_op = 1 },

    [0xc0 ... 0xc3] = { .simd_size = simd_packed_int, .two_op = 1 },

    [0xcc ... 0xcf] = { .simd_size = simd_packed_int },

    [0xec ... 0xef] = { .simd_size = simd_packed_int },

};

static const struct ext8f09_table {

    uint8_t simd_size:5;

    uint8_t two_op:1;

} ext8f09_table[256] = {

    [0x01 ... 0x02] = { .two_op = 1 },

    [0x80 ... 0x81] = { .simd_size = simd_packed_fp, .two_op = 1 },

    [0x82 ... 0x83] = { .simd_size = simd_scalar_opc, .two_op = 1 },

    [0x90 ... 0x9b] = { .simd_size = simd_packed_int },

    [0xc1 ... 0xc3] = { .simd_size = simd_packed_int, .two_op = 1 },

    [0xc6 ... 0xc7] = { .simd_size = simd_packed_int, .two_op = 1 },

    [0xcb] = { .simd_size = simd_packed_int, .two_op = 1 },

    [0xd1 ... 0xd3] = { .simd_size = simd_packed_int, .two_op = 1 },

    [0xd6 ... 0xd7] = { .simd_size = simd_packed_int, .two_op = 1 },

    [0xdb] = { .simd_size = simd_packed_int, .two_op = 1 },

    [0xe1 ... 0xe3] = { .simd_size = simd_packed_int, .two_op = 1 },

};

static unsigned int decode_disp8scale(enum disp8scale scale,

                                      const struct x86_emulate_state *s)

{

    switch ( scale )

    {

    case d8s_bw:

        return s->evex.w;

    default:

        if ( scale < d8s_vl )

            return scale;

        if ( s->evex.brs )

        {

    case d8s_dq:

            return 1 + !s->fp16 + s->evex.w;

        }

        break;

    case d8s_dq64:

        return 1 + !s->fp16 + (s->op_bytes == 8);

    }

    switch ( s->simd_size )

    {

    case simd_any_fp:

    case simd_single_fp:

        if ( !(s->evex.pfx & VEX_PREFIX_SCALAR_MASK) )

            break;

        /* fall through */

    case simd_scalar_opc:

    case simd_scalar_vexw:

        return 1 + !s->fp16 + s->evex.w;

    case simd_128:

        /* These should have an explicit size specified. */

        ASSERT_UNREACHABLE();

        return 4;

    default:

        break;

    }

    return 4 + s->evex.lr - (scale - d8s_vl);

}

/* Fetch next part of the instruction being emulated. */

#define insn_fetch_bytes(_size) ({                                    \

   unsigned long _x = 0, _ip = s->ip;                                 \

   s->ip += (_size); /* real hardware doesn't truncate */             \

   generate_exception_if((uint8_t)(s->ip -                            \

                                   ctxt->regs->r(ip)) > MAX_INST_LEN, \

                         X86_EXC_GP, 0);                              \

   rc = ops->insn_fetch(_ip, &_x, _size, ctxt);                       \

   if ( rc ) goto done;                                               \

   _x;                                                                \

})

#define insn_fetch_type(type) ((type)insn_fetch_bytes(sizeof(type)))

static int

decode_onebyte(struct x86_emulate_state *s,

               struct x86_emulate_ctxt *ctxt,

               const struct x86_emulate_ops *ops)

{

    int rc = X86EMUL_OKAY;

    switch ( ctxt->opcode )

    {

    case 0x06: /* push %%es */

    case 0x07: /* pop %%es */

    case 0x0e: /* push %%cs */

    case 0x16: /* push %%ss */

    case 0x17: /* pop %%ss */

    case 0x1e: /* push %%ds */

    case 0x1f: /* pop %%ds */

    case 0x27: /* daa */

    case 0x2f: /* das */

    case 0x37: /* aaa */

    case 0x3f: /* aas */

    case 0x60: /* pusha */

    case 0x61: /* popa */

    case 0x62: /* bound */

    case 0xc4: /* les */

    case 0xc5: /* lds */

    case 0xce: /* into */

    case 0xd4: /* aam */

    case 0xd5: /* aad */

    case 0xd6: /* salc / udb */

        s->not_64bit = true;

        break;

    case 0x82: /* Grp1 (x86/32 only) */

        s->not_64bit = true;

        /* fall through */

    case 0x80: case 0x81: case 0x83: /* Grp1 */

        if ( (s->modrm_reg & 7) == 7 ) /* cmp */

            s->desc = (s->desc & ByteOp) | DstNone | SrcMem;

        break;

    case 0x90: /* nop / pause */

        if ( s->vex.pfx == vex_f3 )

            ctxt->opcode |= X86EMUL_OPC_F3(0, 0);

        break;

    case 0x9a: /* call (far, absolute) */

    case 0xea: /* jmp (far, absolute) */

        generate_exception_if(mode_64bit(), X86_EXC_UD);

        s->imm1 = insn_fetch_bytes(s->op_bytes);

        s->imm2 = insn_fetch_type(uint16_t);

        break;

    case 0xa0: case 0xa1: /* mov mem.offs,{%al,%ax,%eax,%rax} */

    case 0xa2: case 0xa3: /* mov {%al,%ax,%eax,%rax},mem.offs */

        /* Source EA is not encoded via ModRM. */

        s->ea.type = OP_MEM;

        s->ea.mem.off = insn_fetch_bytes(s->ad_bytes);

        break;

    case 0xb8 ... 0xbf: /* mov imm{16,32,64},r{16,32,64} */

        if ( s->op_bytes == 8 ) /* Fetch more bytes to obtain imm64. */

            s->imm1 = ((uint32_t)s->imm1 |

                       ((uint64_t)insn_fetch_type(uint32_t) << 32));

        break;

    case 0xc8: /* enter imm16,imm8 */

        s->imm2 = insn_fetch_type(uint8_t);

        break;

    case 0xf6: case 0xf7: /* Grp3 */

        if ( !(s->modrm_reg & 6) ) /* test */

            s->desc = (s->desc & ByteOp) | DstNone | SrcMem;

        break;

    case 0xff: /* Grp5 */

        switch ( s->modrm_reg & 7 )

        {

        case 2: /* call (near) */

        case 4: /* jmp (near) */

            if ( mode_64bit() && (s->op_bytes == 4 || !amd_like(ctxt)) )

                s->op_bytes = 8;

            s->desc = DstNone | SrcMem | Mov;

            break;

        case 3: /* call (far, absolute indirect) */

        case 5: /* jmp (far, absolute indirect) */

            /* REX.W ignored on a vendor-dependent basis. */

            if ( s->op_bytes == 8 && amd_like(ctxt) )

                s->op_bytes = 4;

            s->desc = DstNone | SrcMem | Mov;

            break;

        case 6: /* push */

            if ( mode_64bit() && s->op_bytes == 4 )

                s->op_bytes = 8;

            s->desc = DstNone | SrcMem | Mov;

            break;

        }

        break;

    }

 done:

    return rc;

}

static int

decode_twobyte(struct x86_emulate_state *s,

               struct x86_emulate_ctxt *ctxt,

               const struct x86_emulate_ops *ops)

{

    int rc = X86EMUL_OKAY;

    switch ( ctxt->opcode & X86EMUL_OPC_MASK )

    {

    case 0x00: /* Grp6 */

        switch ( s->modrm_reg & 6 )

        {

        case 0:

            s->desc |= DstMem | SrcImplicit | Mov;

            break;

        case 6:

            if ( !(s->modrm_reg & 1) && mode_64bit() )

            {

        case 2: case 4:

                s->desc |= SrcMem16;

            }

            break;

        }

        break;

    case 0x78:

        s->desc = ImplicitOps;

        s->simd_size = simd_none;

        switch ( s->vex.pfx )

        {

        case vex_66: /* extrq $imm8, $imm8, xmm */

        case vex_f2: /* insertq $imm8, $imm8, xmm, xmm */

            s->imm1 = insn_fetch_type(uint8_t);

            s->imm2 = insn_fetch_type(uint8_t);

            break;

        }

        /* fall through */

    case 0x10 ... 0x18:

    case 0x28 ... 0x2f:

    case 0x50 ... 0x77:

    case 0x7a ... 0x7d:

    case 0x7f:

    case 0xc2 ... 0xc3:

    case 0xc5 ... 0xc6:

    case 0xd0 ... 0xef:

    case 0xf1 ... 0xfe:

        ctxt->opcode |= MASK_INSR(s->vex.pfx, X86EMUL_OPC_PFX_MASK);

        break;

    case 0x20: case 0x22: /* mov to/from cr */

        if ( s->lock_prefix && vcpu_has_cr8_legacy() && s->modrm_reg == 0 )

        {

            s->modrm_reg = 8;

            s->lock_prefix = false;

        }

        fallthrough;

    case 0x21: case 0x23: /* mov to/from dr */

        ASSERT(s->ea.type == OP_REG); /* Early operand adjustment ensures this. */

        generate_exception_if(s->lock_prefix, X86_EXC_UD);

        s->op_bytes = mode_64bit() ? 8 : 4;

        break;

    case 0x79:

        s->desc = DstReg | SrcMem;

        s->simd_size = simd_packed_int;

        ctxt->opcode |= MASK_INSR(s->vex.pfx, X86EMUL_OPC_PFX_MASK);

        break;

    case 0x7e:

        ctxt->opcode |= MASK_INSR(s->vex.pfx, X86EMUL_OPC_PFX_MASK);

        if ( s->vex.pfx == vex_f3 ) /* movq xmm/m64,xmm */

        {

    case X86EMUL_OPC_VEX_F3(0, 0x7e): /* vmovq xmm/m64,xmm */

    case X86EMUL_OPC_EVEX_F3(0, 0x7e): /* vmovq xmm/m64,xmm */

            s->desc = DstImplicit | SrcMem | TwoOp;

            s->simd_size = simd_other;

            /* Avoid the s->desc clobbering of TwoOp below. */

            return X86EMUL_OKAY;

        }

        break;

    case X86EMUL_OPC_VEX(0, 0x90):    /* kmov{w,q} */

    case X86EMUL_OPC_VEX_66(0, 0x90): /* kmov{b,d} */

        s->desc = DstReg | SrcMem | Mov;

        s->simd_size = simd_other;

        break;

    case X86EMUL_OPC_VEX(0, 0x91):    /* kmov{w,q} */

    case X86EMUL_OPC_VEX_66(0, 0x91): /* kmov{b,d} */

        s->desc = DstMem | SrcReg | Mov;

        s->simd_size = simd_other;

        break;

    case 0xae:

        ctxt->opcode |= MASK_INSR(s->vex.pfx, X86EMUL_OPC_PFX_MASK);

        /* fall through */

    case X86EMUL_OPC_VEX(0, 0xae):

        switch ( s->modrm_reg & 7 )

        {

        case 2: /* {,v}ldmxcsr */

            s->desc = DstImplicit | SrcMem | Mov;

            s->op_bytes = 4;

            break;

        case 3: /* {,v}stmxcsr */

            s->desc = DstMem | SrcImplicit | Mov;

            s->op_bytes = 4;

            break;

        }

        break;

    case 0xb2: /* lss */

    case 0xb4: /* lfs */

    case 0xb5: /* lgs */

        /* REX.W ignored on a vendor-dependent basis. */

        if ( s->op_bytes == 8 && amd_like(ctxt) )

            s->op_bytes = 4;

        break;

    case 0xb8: /* jmpe / popcnt */

        if ( s->vex.pfx >= vex_f3 )

            ctxt->opcode |= MASK_INSR(s->vex.pfx, X86EMUL_OPC_PFX_MASK);

        break;

        /* Intentionally not handling here despite being modified by F3:

    case 0xbc: bsf / tzcnt

    case 0xbd: bsr / lzcnt

         * They're being dealt with in the execution phase (if at all).

         */

    case 0xc4: /* pinsrw */

        ctxt->opcode |= MASK_INSR(s->vex.pfx, X86EMUL_OPC_PFX_MASK);

        /* fall through */

    case X86EMUL_OPC_VEX_66(0, 0xc4): /* vpinsrw */

    case X86EMUL_OPC_EVEX_66(0, 0xc4): /* vpinsrw */

        s->desc = DstImplicit | SrcMem16;

        break;

    case 0xf0:

        ctxt->opcode |= MASK_INSR(s->vex.pfx, X86EMUL_OPC_PFX_MASK);

        if ( s->vex.pfx == vex_f2 ) /* lddqu mem,xmm */

        {

        /* fall through */

    case X86EMUL_OPC_VEX_F2(0, 0xf0): /* vlddqu mem,{x,y}mm */

            s->desc = DstImplicit | SrcMem | TwoOp;

            s->simd_size = simd_other;

            /* Avoid the s->desc clobbering of TwoOp below. */

            return X86EMUL_OKAY;

        }

        break;

    }

    /*

     * Scalar forms of most VEX-/EVEX-encoded TwoOp instructions have

     * three operands.  Those which do really have two operands

     * should have exited earlier.

     */

    if ( s->simd_size && s->vex.opcx &&

         (s->vex.pfx & VEX_PREFIX_SCALAR_MASK) )

        s->desc &= ~TwoOp;

 done:

    return rc;

}

static int

decode_0f38(struct x86_emulate_state *s,

            struct x86_emulate_ctxt *ctxt,

            const struct x86_emulate_ops *ops)

{

    switch ( ctxt->opcode & X86EMUL_OPC_MASK )

    {

    case 0x00 ... 0x89:

    case 0x8c ... 0xef:

    case 0xf2 ... 0xf5:

    case 0xf7 ... 0xf8:

    case 0xfa ... 0xff:

        s->op_bytes = 0;

        /* fall through */

    case 0xf6: /* adcx / adox */

    case 0xf9: /* movdiri */

        ctxt->opcode |= MASK_INSR(s->vex.pfx, X86EMUL_OPC_PFX_MASK);

        break;

    case 0x8a ... 0x8b: /* movrs */

        s->desc = DstReg | SrcMem | Mov;

        if ( !(ctxt->opcode & 1) )

            s->desc |= ByteOp;

        s->simd_size = simd_none;

        break;

    case X86EMUL_OPC_VEX_66(0, 0x2d): /* vmaskmovpd */

        s->simd_size = simd_packed_fp;

        break;

    case X86EMUL_OPC_EVEX_66(0, 0x7a): /* vpbroadcastb */

    case X86EMUL_OPC_EVEX_66(0, 0x7b): /* vpbroadcastw */

    case X86EMUL_OPC_EVEX_66(0, 0x7c): /* vpbroadcast{d,q} */

        break;

    case 0xf0: /* movbe / crc32 */

        s->desc |= s->vex.pfx == vex_f2 ? ByteOp : Mov;

        if ( s->vex.pfx >= vex_f3 )

            ctxt->opcode |= MASK_INSR(s->vex.pfx, X86EMUL_OPC_PFX_MASK);

        break;

    case 0xf1: /* movbe / crc32 */

        if ( s->vex.pfx == vex_f2 )

            s->desc = DstReg | SrcMem;

        if ( s->vex.pfx >= vex_f3 )

            ctxt->opcode |= MASK_INSR(s->vex.pfx, X86EMUL_OPC_PFX_MASK);

        break;

    case X86EMUL_OPC_VEX_66(0, 0xe0) ...

         X86EMUL_OPC_VEX_66(0, 0xef): /* cmp<cc>xadd */

    case X86EMUL_OPC_VEX(0, 0xf2):    /* andn */

    case X86EMUL_OPC_VEX(0, 0xf3):    /* Grp 17 */

    case X86EMUL_OPC_VEX(0, 0xf5):    /* bzhi */

    case X86EMUL_OPC_VEX_F3(0, 0xf5): /* pext */

    case X86EMUL_OPC_VEX_F2(0, 0xf5): /* pdep */

    case X86EMUL_OPC_VEX_F2(0, 0xf6): /* mulx */

    case X86EMUL_OPC_VEX(0, 0xf7):    /* bextr */

    case X86EMUL_OPC_VEX_66(0, 0xf7): /* shlx */

    case X86EMUL_OPC_VEX_F3(0, 0xf7): /* sarx */

    case X86EMUL_OPC_VEX_F2(0, 0xf7): /* shrx */

        break;

    default:

        s->op_bytes = 0;

        break;

    }

    return X86EMUL_OKAY;

}

static int

decode_0f3a(struct x86_emulate_state *s,

            struct x86_emulate_ctxt *ctxt,

            const struct x86_emulate_ops *ops)

{

    if ( !s->vex.opcx )

        ctxt->opcode |= MASK_INSR(s->vex.pfx, X86EMUL_OPC_PFX_MASK);

    switch ( ctxt->opcode & X86EMUL_OPC_MASK )

    {

    case X86EMUL_OPC_66(0, 0x14)

     ... X86EMUL_OPC_66(0, 0x17):     /* pextr*, extractps */

    case X86EMUL_OPC_VEX_66(0, 0x14)

     ... X86EMUL_OPC_VEX_66(0, 0x17): /* vpextr*, vextractps */

    case X86EMUL_OPC_EVEX_66(0, 0x14)

     ... X86EMUL_OPC_EVEX_66(0, 0x17): /* vpextr*, vextractps */

    case X86EMUL_OPC_VEX_F2(0, 0xf0): /* rorx */

        break;

    case X86EMUL_OPC_66(0, 0x20):     /* pinsrb */

    case X86EMUL_OPC_VEX_66(0, 0x20): /* vpinsrb */

    case X86EMUL_OPC_EVEX_66(0, 0x20): /* vpinsrb */

        s->desc = DstImplicit | SrcMem;

        if ( s->modrm_mod != 3 )

            s->desc |= ByteOp;

        break;

    case X86EMUL_OPC_66(0, 0x22):     /* pinsr{d,q} */

    case X86EMUL_OPC_VEX_66(0, 0x22): /* vpinsr{d,q} */

    case X86EMUL_OPC_EVEX_66(0, 0x22): /* vpinsr{d,q} */

        s->desc = DstImplicit | SrcMem;

        break;

    default:

        s->op_bytes = 0;

        break;

    }

    return X86EMUL_OKAY;

}

#define ad_bytes (s->ad_bytes) /* for truncate_ea() */

int x86emul_decode(struct x86_emulate_state *s,

                   struct x86_emulate_ctxt *ctxt,

                   const struct x86_emulate_ops *ops)

{

    uint8_t b, d;

    unsigned int def_op_bytes, def_ad_bytes, opcode;

    enum x86_segment override_seg = x86_seg_none;

    bool pc_rel = false;

    int rc = X86EMUL_OKAY;

    ASSERT(ops->insn_fetch);

    memset(s, 0, sizeof(*s));

    s->ea.type = OP_NONE;

    s->ea.mem.seg = x86_seg_ds;

    s->ea.reg = PTR_POISON;

    s->ip = ctxt->regs->r(ip);

    s->op_bytes = def_op_bytes = ad_bytes = def_ad_bytes =

        ctxt->addr_size / 8;

    if ( s->op_bytes == 8 )

    {

        s->op_bytes = def_op_bytes = 4;

#ifndef __x86_64__

        return X86EMUL_UNHANDLEABLE;

#endif

    }

    /* Prefix bytes. */

    for ( ; ; )

    {

        switch ( b = insn_fetch_type(uint8_t) )

        {

        case 0x66: /* operand-size override */

            s->op_bytes = def_op_bytes ^ 6;

            if ( !s->vex.pfx )

                s->vex.pfx = vex_66;

            break;

        case 0x67: /* address-size override */

            ad_bytes = def_ad_bytes ^ (mode_64bit() ? 12 : 6);

            break;

        case 0x26: /* ES override */

        case 0x2e: /* CS override */

        case 0x36: /* SS override */

        case 0x3e: /* DS override, all ignored in 64-bit mode */

            if ( !mode_64bit() )

                override_seg = (b >> 3) & 3;

            break;

        case 0x64: /* FS override */

            override_seg = x86_seg_fs;

            break;

        case 0x65: /* GS override */

            override_seg = x86_seg_gs;

            break;

        case 0xf0: /* LOCK */

            s->lock_prefix = true;

            break;

        case 0xf2: /* REPNE/REPNZ */

            s->vex.pfx = vex_f2;

            break;

        case 0xf3: /* REP/REPE/REPZ */

            s->vex.pfx = vex_f3;

            break;

        case 0x40 ... 0x4f: /* REX */

            if ( !mode_64bit() )

                goto done_prefixes;