1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf(_f , ## _a)
28 #include <linux/kvm_host.h>
29 #define DPRINTF(x...) do {} while (0)
31 #include <linux/module.h>
32 #include <asm/kvm_x86_emulate.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
65 #define MemAbs (1<<9) /* Memory operand is absolute displacement */
66 #define String (1<<10) /* String instruction (rep capable) */
67 #define Stack (1<<11) /* Stack instruction (push/pop) */
68 #define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
69 #define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
70 #define GroupMask 0xff /* Group number stored in bits 0:7 */
73 Group1_80, Group1_81, Group1_82, Group1_83,
74 Group1A, Group3_Byte, Group3, Group4, Group5, Group7,
77 static u16 opcode_table[256] = {
79 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
80 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
83 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
84 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
87 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
88 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
91 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
92 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
95 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
96 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
97 SrcImmByte, SrcImm, 0, 0,
99 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
100 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
103 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
104 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
107 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
108 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
111 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
113 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
115 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
116 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
118 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
119 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
121 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
124 0, 0, ImplicitOps | Mov | Stack, 0,
125 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
126 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
128 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
129 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
131 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
132 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
134 Group | Group1_80, Group | Group1_81,
135 Group | Group1_82, Group | Group1_83,
136 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
137 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
139 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
140 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
141 0, ModRM | DstReg, 0, Group | Group1A,
143 0, 0, 0, 0, 0, 0, 0, 0,
144 0, 0, 0, 0, ImplicitOps | Stack, ImplicitOps | Stack, 0, 0,
146 ByteOp | DstReg | SrcMem | Mov | MemAbs, DstReg | SrcMem | Mov | MemAbs,
147 ByteOp | DstMem | SrcReg | Mov | MemAbs, DstMem | SrcReg | Mov | MemAbs,
148 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
149 ByteOp | ImplicitOps | String, ImplicitOps | String,
151 0, 0, ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
152 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
153 ByteOp | ImplicitOps | String, ImplicitOps | String,
155 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
157 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
158 0, ImplicitOps | Stack, 0, 0,
159 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
161 0, 0, 0, 0, 0, 0, 0, 0,
163 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
164 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
167 0, 0, 0, 0, 0, 0, 0, 0,
169 0, 0, 0, 0, 0, 0, 0, 0,
171 ImplicitOps | Stack, SrcImm | ImplicitOps,
172 ImplicitOps, SrcImmByte | ImplicitOps,
176 ImplicitOps, ImplicitOps, Group | Group3_Byte, Group | Group3,
178 ImplicitOps, 0, ImplicitOps, ImplicitOps,
179 0, 0, Group | Group4, Group | Group5,
182 static u16 twobyte_table[256] = {
184 0, Group | GroupDual | Group7, 0, 0, 0, 0, ImplicitOps, 0,
185 ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
187 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
189 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
190 0, 0, 0, 0, 0, 0, 0, 0,
192 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
194 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
195 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
196 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
197 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
199 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
200 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
201 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
202 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
204 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
206 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
208 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
210 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
211 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
212 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
213 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
215 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
217 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
219 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
221 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
222 DstMem | SrcReg | ModRM | BitOp,
223 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
224 DstReg | SrcMem16 | ModRM | Mov,
226 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
227 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
228 DstReg | SrcMem16 | ModRM | Mov,
230 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
231 0, 0, 0, 0, 0, 0, 0, 0,
233 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
235 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
237 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
240 static u16 group_table[] = {
242 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
243 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
244 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
245 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
247 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
248 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
249 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
250 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
252 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
253 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
254 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
255 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
257 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
258 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
259 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
260 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
262 DstMem | SrcNone | ModRM | Mov | Stack, 0, 0, 0, 0, 0, 0, 0,
264 ByteOp | SrcImm | DstMem | ModRM, 0,
265 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
268 DstMem | SrcImm | ModRM | SrcImm, 0,
269 DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
272 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
275 DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM, 0, 0,
276 SrcMem | ModRM, 0, SrcMem | ModRM | Stack, 0,
278 0, 0, ModRM | SrcMem, ModRM | SrcMem,
279 SrcNone | ModRM | DstMem | Mov, 0,
280 SrcMem16 | ModRM | Mov, SrcMem | ModRM | ByteOp,
283 static u16 group2_table[] = {
285 SrcNone | ModRM, 0, 0, 0,
286 SrcNone | ModRM | DstMem | Mov, 0,
287 SrcMem16 | ModRM | Mov, 0,
290 /* EFLAGS bit definitions. */
291 #define EFLG_OF (1<<11)
292 #define EFLG_DF (1<<10)
293 #define EFLG_SF (1<<7)
294 #define EFLG_ZF (1<<6)
295 #define EFLG_AF (1<<4)
296 #define EFLG_PF (1<<2)
297 #define EFLG_CF (1<<0)
300 * Instruction emulation:
301 * Most instructions are emulated directly via a fragment of inline assembly
302 * code. This allows us to save/restore EFLAGS and thus very easily pick up
303 * any modified flags.
306 #if defined(CONFIG_X86_64)
307 #define _LO32 "k" /* force 32-bit operand */
308 #define _STK "%%rsp" /* stack pointer */
309 #elif defined(__i386__)
310 #define _LO32 "" /* force 32-bit operand */
311 #define _STK "%%esp" /* stack pointer */
315 * These EFLAGS bits are restored from saved value during emulation, and
316 * any changes are written back to the saved value after emulation.
318 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
320 /* Before executing instruction: restore necessary bits in EFLAGS. */
321 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
322 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
323 "movl %"_sav",%"_LO32 _tmp"; " \
326 "movl %"_msk",%"_LO32 _tmp"; " \
327 "andl %"_LO32 _tmp",("_STK"); " \
329 "notl %"_LO32 _tmp"; " \
330 "andl %"_LO32 _tmp",("_STK"); " \
331 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
333 "orl %"_LO32 _tmp",("_STK"); " \
337 /* After executing instruction: write-back necessary bits in EFLAGS. */
338 #define _POST_EFLAGS(_sav, _msk, _tmp) \
339 /* _sav |= EFLAGS & _msk; */ \
342 "andl %"_msk",%"_LO32 _tmp"; " \
343 "orl %"_LO32 _tmp",%"_sav"; "
345 /* Raw emulation: instruction has two explicit operands. */
346 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
348 unsigned long _tmp; \
350 switch ((_dst).bytes) { \
352 __asm__ __volatile__ ( \
353 _PRE_EFLAGS("0", "4", "2") \
354 _op"w %"_wx"3,%1; " \
355 _POST_EFLAGS("0", "4", "2") \
356 : "=m" (_eflags), "=m" ((_dst).val), \
358 : _wy ((_src).val), "i" (EFLAGS_MASK)); \
361 __asm__ __volatile__ ( \
362 _PRE_EFLAGS("0", "4", "2") \
363 _op"l %"_lx"3,%1; " \
364 _POST_EFLAGS("0", "4", "2") \
365 : "=m" (_eflags), "=m" ((_dst).val), \
367 : _ly ((_src).val), "i" (EFLAGS_MASK)); \
370 __emulate_2op_8byte(_op, _src, _dst, \
371 _eflags, _qx, _qy); \
376 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
378 unsigned long __tmp; \
379 switch ((_dst).bytes) { \
381 __asm__ __volatile__ ( \
382 _PRE_EFLAGS("0", "4", "2") \
383 _op"b %"_bx"3,%1; " \
384 _POST_EFLAGS("0", "4", "2") \
385 : "=m" (_eflags), "=m" ((_dst).val), \
387 : _by ((_src).val), "i" (EFLAGS_MASK)); \
390 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
391 _wx, _wy, _lx, _ly, _qx, _qy); \
396 /* Source operand is byte-sized and may be restricted to just %cl. */
397 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
398 __emulate_2op(_op, _src, _dst, _eflags, \
399 "b", "c", "b", "c", "b", "c", "b", "c")
401 /* Source operand is byte, word, long or quad sized. */
402 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
403 __emulate_2op(_op, _src, _dst, _eflags, \
404 "b", "q", "w", "r", _LO32, "r", "", "r")
406 /* Source operand is word, long or quad sized. */
407 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
408 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
409 "w", "r", _LO32, "r", "", "r")
411 /* Instruction has only one explicit operand (no source operand). */
412 #define emulate_1op(_op, _dst, _eflags) \
414 unsigned long _tmp; \
416 switch ((_dst).bytes) { \
418 __asm__ __volatile__ ( \
419 _PRE_EFLAGS("0", "3", "2") \
421 _POST_EFLAGS("0", "3", "2") \
422 : "=m" (_eflags), "=m" ((_dst).val), \
424 : "i" (EFLAGS_MASK)); \
427 __asm__ __volatile__ ( \
428 _PRE_EFLAGS("0", "3", "2") \
430 _POST_EFLAGS("0", "3", "2") \
431 : "=m" (_eflags), "=m" ((_dst).val), \
433 : "i" (EFLAGS_MASK)); \
436 __asm__ __volatile__ ( \
437 _PRE_EFLAGS("0", "3", "2") \
439 _POST_EFLAGS("0", "3", "2") \
440 : "=m" (_eflags), "=m" ((_dst).val), \
442 : "i" (EFLAGS_MASK)); \
445 __emulate_1op_8byte(_op, _dst, _eflags); \
450 /* Emulate an instruction with quadword operands (x86/64 only). */
451 #if defined(CONFIG_X86_64)
452 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
454 __asm__ __volatile__ ( \
455 _PRE_EFLAGS("0", "4", "2") \
456 _op"q %"_qx"3,%1; " \
457 _POST_EFLAGS("0", "4", "2") \
458 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
459 : _qy ((_src).val), "i" (EFLAGS_MASK)); \
462 #define __emulate_1op_8byte(_op, _dst, _eflags) \
464 __asm__ __volatile__ ( \
465 _PRE_EFLAGS("0", "3", "2") \
467 _POST_EFLAGS("0", "3", "2") \
468 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
469 : "i" (EFLAGS_MASK)); \
472 #elif defined(__i386__)
473 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
474 #define __emulate_1op_8byte(_op, _dst, _eflags)
475 #endif /* __i386__ */
477 /* Fetch next part of the instruction being emulated. */
478 #define insn_fetch(_type, _size, _eip) \
479 ({ unsigned long _x; \
480 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
487 static inline unsigned long ad_mask(struct decode_cache *c)
489 return (1UL << (c->ad_bytes << 3)) - 1;
492 /* Access/update address held in a register, based on addressing mode. */
493 static inline unsigned long
494 address_mask(struct decode_cache *c, unsigned long reg)
496 if (c->ad_bytes == sizeof(unsigned long))
499 return reg & ad_mask(c);
502 static inline unsigned long
503 register_address(struct decode_cache *c, unsigned long base, unsigned long reg)
505 return base + address_mask(c, reg);
509 register_address_increment(struct decode_cache *c, unsigned long *reg, int inc)
511 if (c->ad_bytes == sizeof(unsigned long))
514 *reg = (*reg & ~ad_mask(c)) | ((*reg + inc) & ad_mask(c));
517 static inline void jmp_rel(struct decode_cache *c, int rel)
519 register_address_increment(c, &c->eip, rel);
522 static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
523 struct x86_emulate_ops *ops,
524 unsigned long linear, u8 *dest)
526 struct fetch_cache *fc = &ctxt->decode.fetch;
530 if (linear < fc->start || linear >= fc->end) {
531 size = min(15UL, PAGE_SIZE - offset_in_page(linear));
532 rc = ops->read_std(linear, fc->data, size, ctxt->vcpu);
536 fc->end = linear + size;
538 *dest = fc->data[linear - fc->start];
542 static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
543 struct x86_emulate_ops *ops,
544 unsigned long eip, void *dest, unsigned size)
548 eip += ctxt->cs_base;
550 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
558 * Given the 'reg' portion of a ModRM byte, and a register block, return a
559 * pointer into the block that addresses the relevant register.
560 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
562 static void *decode_register(u8 modrm_reg, unsigned long *regs,
567 p = ®s[modrm_reg];
568 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
569 p = (unsigned char *)®s[modrm_reg & 3] + 1;
573 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
574 struct x86_emulate_ops *ops,
576 u16 *size, unsigned long *address, int op_bytes)
583 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
587 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
592 static int test_cc(unsigned int condition, unsigned int flags)
596 switch ((condition & 15) >> 1) {
598 rc |= (flags & EFLG_OF);
600 case 1: /* b/c/nae */
601 rc |= (flags & EFLG_CF);
604 rc |= (flags & EFLG_ZF);
607 rc |= (flags & (EFLG_CF|EFLG_ZF));
610 rc |= (flags & EFLG_SF);
613 rc |= (flags & EFLG_PF);
616 rc |= (flags & EFLG_ZF);
619 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
623 /* Odd condition identifiers (lsb == 1) have inverted sense. */
624 return (!!rc ^ (condition & 1));
627 static void decode_register_operand(struct operand *op,
628 struct decode_cache *c,
631 unsigned reg = c->modrm_reg;
632 int highbyte_regs = c->rex_prefix == 0;
635 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
637 if ((c->d & ByteOp) && !inhibit_bytereg) {
638 op->ptr = decode_register(reg, c->regs, highbyte_regs);
639 op->val = *(u8 *)op->ptr;
642 op->ptr = decode_register(reg, c->regs, 0);
643 op->bytes = c->op_bytes;
646 op->val = *(u16 *)op->ptr;
649 op->val = *(u32 *)op->ptr;
652 op->val = *(u64 *) op->ptr;
656 op->orig_val = op->val;
659 static int decode_modrm(struct x86_emulate_ctxt *ctxt,
660 struct x86_emulate_ops *ops)
662 struct decode_cache *c = &ctxt->decode;
664 int index_reg = 0, base_reg = 0, scale, rip_relative = 0;
668 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
669 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
670 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
673 c->modrm = insn_fetch(u8, 1, c->eip);
674 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
675 c->modrm_reg |= (c->modrm & 0x38) >> 3;
676 c->modrm_rm |= (c->modrm & 0x07);
680 if (c->modrm_mod == 3) {
681 c->modrm_ptr = decode_register(c->modrm_rm,
682 c->regs, c->d & ByteOp);
683 c->modrm_val = *(unsigned long *)c->modrm_ptr;
687 if (c->ad_bytes == 2) {
688 unsigned bx = c->regs[VCPU_REGS_RBX];
689 unsigned bp = c->regs[VCPU_REGS_RBP];
690 unsigned si = c->regs[VCPU_REGS_RSI];
691 unsigned di = c->regs[VCPU_REGS_RDI];
693 /* 16-bit ModR/M decode. */
694 switch (c->modrm_mod) {
696 if (c->modrm_rm == 6)
697 c->modrm_ea += insn_fetch(u16, 2, c->eip);
700 c->modrm_ea += insn_fetch(s8, 1, c->eip);
703 c->modrm_ea += insn_fetch(u16, 2, c->eip);
706 switch (c->modrm_rm) {
708 c->modrm_ea += bx + si;
711 c->modrm_ea += bx + di;
714 c->modrm_ea += bp + si;
717 c->modrm_ea += bp + di;
726 if (c->modrm_mod != 0)
733 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
734 (c->modrm_rm == 6 && c->modrm_mod != 0))
735 if (!c->override_base)
736 c->override_base = &ctxt->ss_base;
737 c->modrm_ea = (u16)c->modrm_ea;
739 /* 32/64-bit ModR/M decode. */
740 switch (c->modrm_rm) {
743 sib = insn_fetch(u8, 1, c->eip);
744 index_reg |= (sib >> 3) & 7;
750 if (c->modrm_mod != 0)
751 c->modrm_ea += c->regs[base_reg];
754 insn_fetch(s32, 4, c->eip);
757 c->modrm_ea += c->regs[base_reg];
763 c->modrm_ea += c->regs[index_reg] << scale;
767 if (c->modrm_mod != 0)
768 c->modrm_ea += c->regs[c->modrm_rm];
769 else if (ctxt->mode == X86EMUL_MODE_PROT64)
773 c->modrm_ea += c->regs[c->modrm_rm];
776 switch (c->modrm_mod) {
778 if (c->modrm_rm == 5)
779 c->modrm_ea += insn_fetch(s32, 4, c->eip);
782 c->modrm_ea += insn_fetch(s8, 1, c->eip);
785 c->modrm_ea += insn_fetch(s32, 4, c->eip);
790 c->modrm_ea += c->eip;
791 switch (c->d & SrcMask) {
799 if (c->op_bytes == 8)
802 c->modrm_ea += c->op_bytes;
809 static int decode_abs(struct x86_emulate_ctxt *ctxt,
810 struct x86_emulate_ops *ops)
812 struct decode_cache *c = &ctxt->decode;
815 switch (c->ad_bytes) {
817 c->modrm_ea = insn_fetch(u16, 2, c->eip);
820 c->modrm_ea = insn_fetch(u32, 4, c->eip);
823 c->modrm_ea = insn_fetch(u64, 8, c->eip);
831 x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
833 struct decode_cache *c = &ctxt->decode;
835 int mode = ctxt->mode;
836 int def_op_bytes, def_ad_bytes, group;
838 /* Shadow copy of register state. Committed on successful emulation. */
840 memset(c, 0, sizeof(struct decode_cache));
841 c->eip = ctxt->vcpu->arch.rip;
842 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
845 case X86EMUL_MODE_REAL:
846 case X86EMUL_MODE_PROT16:
847 def_op_bytes = def_ad_bytes = 2;
849 case X86EMUL_MODE_PROT32:
850 def_op_bytes = def_ad_bytes = 4;
853 case X86EMUL_MODE_PROT64:
862 c->op_bytes = def_op_bytes;
863 c->ad_bytes = def_ad_bytes;
865 /* Legacy prefixes. */
867 switch (c->b = insn_fetch(u8, 1, c->eip)) {
868 case 0x66: /* operand-size override */
869 /* switch between 2/4 bytes */
870 c->op_bytes = def_op_bytes ^ 6;
872 case 0x67: /* address-size override */
873 if (mode == X86EMUL_MODE_PROT64)
874 /* switch between 4/8 bytes */
875 c->ad_bytes = def_ad_bytes ^ 12;
877 /* switch between 2/4 bytes */
878 c->ad_bytes = def_ad_bytes ^ 6;
880 case 0x2e: /* CS override */
881 c->override_base = &ctxt->cs_base;
883 case 0x3e: /* DS override */
884 c->override_base = &ctxt->ds_base;
886 case 0x26: /* ES override */
887 c->override_base = &ctxt->es_base;
889 case 0x64: /* FS override */
890 c->override_base = &ctxt->fs_base;
892 case 0x65: /* GS override */
893 c->override_base = &ctxt->gs_base;
895 case 0x36: /* SS override */
896 c->override_base = &ctxt->ss_base;
898 case 0x40 ... 0x4f: /* REX */
899 if (mode != X86EMUL_MODE_PROT64)
901 c->rex_prefix = c->b;
903 case 0xf0: /* LOCK */
906 case 0xf2: /* REPNE/REPNZ */
907 c->rep_prefix = REPNE_PREFIX;
909 case 0xf3: /* REP/REPE/REPZ */
910 c->rep_prefix = REPE_PREFIX;
916 /* Any legacy prefix after a REX prefix nullifies its effect. */
925 if (c->rex_prefix & 8)
926 c->op_bytes = 8; /* REX.W */
928 /* Opcode byte(s). */
929 c->d = opcode_table[c->b];
931 /* Two-byte opcode? */
934 c->b = insn_fetch(u8, 1, c->eip);
935 c->d = twobyte_table[c->b];
940 group = c->d & GroupMask;
941 c->modrm = insn_fetch(u8, 1, c->eip);
944 group = (group << 3) + ((c->modrm >> 3) & 7);
945 if ((c->d & GroupDual) && (c->modrm >> 6) == 3)
946 c->d = group2_table[group];
948 c->d = group_table[group];
953 DPRINTF("Cannot emulate %02x\n", c->b);
957 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
960 /* ModRM and SIB bytes. */
962 rc = decode_modrm(ctxt, ops);
963 else if (c->d & MemAbs)
964 rc = decode_abs(ctxt, ops);
968 if (!c->override_base)
969 c->override_base = &ctxt->ds_base;
970 if (mode == X86EMUL_MODE_PROT64 &&
971 c->override_base != &ctxt->fs_base &&
972 c->override_base != &ctxt->gs_base)
973 c->override_base = NULL;
975 if (c->override_base)
976 c->modrm_ea += *c->override_base;
978 if (c->ad_bytes != 8)
979 c->modrm_ea = (u32)c->modrm_ea;
981 * Decode and fetch the source operand: register, memory
984 switch (c->d & SrcMask) {
988 decode_register_operand(&c->src, c, 0);
997 c->src.bytes = (c->d & ByteOp) ? 1 :
999 /* Don't fetch the address for invlpg: it could be unmapped. */
1000 if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
1004 * For instructions with a ModR/M byte, switch to register
1005 * access if Mod = 3.
1007 if ((c->d & ModRM) && c->modrm_mod == 3) {
1008 c->src.type = OP_REG;
1009 c->src.val = c->modrm_val;
1010 c->src.ptr = c->modrm_ptr;
1013 c->src.type = OP_MEM;
1016 c->src.type = OP_IMM;
1017 c->src.ptr = (unsigned long *)c->eip;
1018 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1019 if (c->src.bytes == 8)
1021 /* NB. Immediates are sign-extended as necessary. */
1022 switch (c->src.bytes) {
1024 c->src.val = insn_fetch(s8, 1, c->eip);
1027 c->src.val = insn_fetch(s16, 2, c->eip);
1030 c->src.val = insn_fetch(s32, 4, c->eip);
1035 c->src.type = OP_IMM;
1036 c->src.ptr = (unsigned long *)c->eip;
1038 c->src.val = insn_fetch(s8, 1, c->eip);
1042 /* Decode and fetch the destination operand: register or memory. */
1043 switch (c->d & DstMask) {
1045 /* Special instructions do their own operand decoding. */
1048 decode_register_operand(&c->dst, c,
1049 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
1052 if ((c->d & ModRM) && c->modrm_mod == 3) {
1053 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1054 c->dst.type = OP_REG;
1055 c->dst.val = c->dst.orig_val = c->modrm_val;
1056 c->dst.ptr = c->modrm_ptr;
1059 c->dst.type = OP_MEM;
1064 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1067 static inline void emulate_push(struct x86_emulate_ctxt *ctxt)
1069 struct decode_cache *c = &ctxt->decode;
1071 c->dst.type = OP_MEM;
1072 c->dst.bytes = c->op_bytes;
1073 c->dst.val = c->src.val;
1074 register_address_increment(c, &c->regs[VCPU_REGS_RSP], -c->op_bytes);
1075 c->dst.ptr = (void *) register_address(c, ctxt->ss_base,
1076 c->regs[VCPU_REGS_RSP]);
1079 static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
1080 struct x86_emulate_ops *ops)
1082 struct decode_cache *c = &ctxt->decode;
1085 rc = ops->read_std(register_address(c, ctxt->ss_base,
1086 c->regs[VCPU_REGS_RSP]),
1087 &c->dst.val, c->dst.bytes, ctxt->vcpu);
1091 register_address_increment(c, &c->regs[VCPU_REGS_RSP], c->dst.bytes);
1096 static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
1098 struct decode_cache *c = &ctxt->decode;
1099 switch (c->modrm_reg) {
1101 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
1104 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
1107 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
1110 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
1112 case 4: /* sal/shl */
1113 case 6: /* sal/shl */
1114 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
1117 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
1120 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
1125 static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
1126 struct x86_emulate_ops *ops)
1128 struct decode_cache *c = &ctxt->decode;
1131 switch (c->modrm_reg) {
1132 case 0 ... 1: /* test */
1133 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1136 c->dst.val = ~c->dst.val;
1139 emulate_1op("neg", c->dst, ctxt->eflags);
1142 DPRINTF("Cannot emulate %02x\n", c->b);
1143 rc = X86EMUL_UNHANDLEABLE;
1149 static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
1150 struct x86_emulate_ops *ops)
1152 struct decode_cache *c = &ctxt->decode;
1154 switch (c->modrm_reg) {
1156 emulate_1op("inc", c->dst, ctxt->eflags);
1159 emulate_1op("dec", c->dst, ctxt->eflags);
1161 case 4: /* jmp abs */
1162 c->eip = c->src.val;
1171 static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
1172 struct x86_emulate_ops *ops,
1173 unsigned long memop)
1175 struct decode_cache *c = &ctxt->decode;
1179 rc = ops->read_emulated(memop, &old, 8, ctxt->vcpu);
1183 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1184 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
1186 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1187 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1188 ctxt->eflags &= ~EFLG_ZF;
1191 new = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1192 (u32) c->regs[VCPU_REGS_RBX];
1194 rc = ops->cmpxchg_emulated(memop, &old, &new, 8, ctxt->vcpu);
1197 ctxt->eflags |= EFLG_ZF;
1202 static inline int writeback(struct x86_emulate_ctxt *ctxt,
1203 struct x86_emulate_ops *ops)
1206 struct decode_cache *c = &ctxt->decode;
1208 switch (c->dst.type) {
1210 /* The 4-byte case *is* correct:
1211 * in 64-bit mode we zero-extend.
1213 switch (c->dst.bytes) {
1215 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1218 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1221 *c->dst.ptr = (u32)c->dst.val;
1222 break; /* 64b: zero-ext */
1224 *c->dst.ptr = c->dst.val;
1230 rc = ops->cmpxchg_emulated(
1231 (unsigned long)c->dst.ptr,
1237 rc = ops->write_emulated(
1238 (unsigned long)c->dst.ptr,
1255 x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1257 unsigned long memop = 0;
1259 unsigned long saved_eip = 0;
1260 struct decode_cache *c = &ctxt->decode;
1263 /* Shadow copy of register state. Committed on successful emulation.
1264 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
1268 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
1271 if (((c->d & ModRM) && (c->modrm_mod != 3)) || (c->d & MemAbs))
1272 memop = c->modrm_ea;
1274 if (c->rep_prefix && (c->d & String)) {
1275 /* All REP prefixes have the same first termination condition */
1276 if (c->regs[VCPU_REGS_RCX] == 0) {
1277 ctxt->vcpu->arch.rip = c->eip;
1280 /* The second termination condition only applies for REPE
1281 * and REPNE. Test if the repeat string operation prefix is
1282 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
1283 * corresponding termination condition according to:
1284 * - if REPE/REPZ and ZF = 0 then done
1285 * - if REPNE/REPNZ and ZF = 1 then done
1287 if ((c->b == 0xa6) || (c->b == 0xa7) ||
1288 (c->b == 0xae) || (c->b == 0xaf)) {
1289 if ((c->rep_prefix == REPE_PREFIX) &&
1290 ((ctxt->eflags & EFLG_ZF) == 0)) {
1291 ctxt->vcpu->arch.rip = c->eip;
1294 if ((c->rep_prefix == REPNE_PREFIX) &&
1295 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF)) {
1296 ctxt->vcpu->arch.rip = c->eip;
1300 c->regs[VCPU_REGS_RCX]--;
1301 c->eip = ctxt->vcpu->arch.rip;
1304 if (c->src.type == OP_MEM) {
1305 c->src.ptr = (unsigned long *)memop;
1307 rc = ops->read_emulated((unsigned long)c->src.ptr,
1313 c->src.orig_val = c->src.val;
1316 if ((c->d & DstMask) == ImplicitOps)
1320 if (c->dst.type == OP_MEM) {
1321 c->dst.ptr = (unsigned long *)memop;
1322 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1325 unsigned long mask = ~(c->dst.bytes * 8 - 1);
1327 c->dst.ptr = (void *)c->dst.ptr +
1328 (c->src.val & mask) / 8;
1330 if (!(c->d & Mov) &&
1331 /* optimisation - avoid slow emulated read */
1332 ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1334 c->dst.bytes, ctxt->vcpu)) != 0))
1337 c->dst.orig_val = c->dst.val;
1347 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
1351 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
1355 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
1359 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
1363 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
1365 case 0x24: /* and al imm8 */
1366 c->dst.type = OP_REG;
1367 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1368 c->dst.val = *(u8 *)c->dst.ptr;
1370 c->dst.orig_val = c->dst.val;
1372 case 0x25: /* and ax imm16, or eax imm32 */
1373 c->dst.type = OP_REG;
1374 c->dst.bytes = c->op_bytes;
1375 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1376 if (c->op_bytes == 2)
1377 c->dst.val = *(u16 *)c->dst.ptr;
1379 c->dst.val = *(u32 *)c->dst.ptr;
1380 c->dst.orig_val = c->dst.val;
1384 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
1388 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
1392 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1394 case 0x40 ... 0x47: /* inc r16/r32 */
1395 emulate_1op("inc", c->dst, ctxt->eflags);
1397 case 0x48 ... 0x4f: /* dec r16/r32 */
1398 emulate_1op("dec", c->dst, ctxt->eflags);
1400 case 0x50 ... 0x57: /* push reg */
1401 c->dst.type = OP_MEM;
1402 c->dst.bytes = c->op_bytes;
1403 c->dst.val = c->src.val;
1404 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1406 c->dst.ptr = (void *) register_address(
1407 c, ctxt->ss_base, c->regs[VCPU_REGS_RSP]);
1409 case 0x58 ... 0x5f: /* pop reg */
1411 if ((rc = ops->read_std(register_address(c, ctxt->ss_base,
1412 c->regs[VCPU_REGS_RSP]), c->dst.ptr,
1413 c->op_bytes, ctxt->vcpu)) != 0)
1416 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1418 c->dst.type = OP_NONE; /* Disable writeback. */
1420 case 0x63: /* movsxd */
1421 if (ctxt->mode != X86EMUL_MODE_PROT64)
1422 goto cannot_emulate;
1423 c->dst.val = (s32) c->src.val;
1425 case 0x6a: /* push imm8 */
1427 c->src.val = insn_fetch(s8, 1, c->eip);
1430 case 0x6c: /* insb */
1431 case 0x6d: /* insw/insd */
1432 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1434 (c->d & ByteOp) ? 1 : c->op_bytes,
1436 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1,
1437 (ctxt->eflags & EFLG_DF),
1438 register_address(c, ctxt->es_base,
1439 c->regs[VCPU_REGS_RDI]),
1441 c->regs[VCPU_REGS_RDX]) == 0) {
1446 case 0x6e: /* outsb */
1447 case 0x6f: /* outsw/outsd */
1448 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1450 (c->d & ByteOp) ? 1 : c->op_bytes,
1452 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1,
1453 (ctxt->eflags & EFLG_DF),
1454 register_address(c, c->override_base ?
1457 c->regs[VCPU_REGS_RSI]),
1459 c->regs[VCPU_REGS_RDX]) == 0) {
1464 case 0x70 ... 0x7f: /* jcc (short) */ {
1465 int rel = insn_fetch(s8, 1, c->eip);
1467 if (test_cc(c->b, ctxt->eflags))
1471 case 0x80 ... 0x83: /* Grp1 */
1472 switch (c->modrm_reg) {
1492 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1494 case 0x86 ... 0x87: /* xchg */
1495 /* Write back the register source. */
1496 switch (c->dst.bytes) {
1498 *(u8 *) c->src.ptr = (u8) c->dst.val;
1501 *(u16 *) c->src.ptr = (u16) c->dst.val;
1504 *c->src.ptr = (u32) c->dst.val;
1505 break; /* 64b reg: zero-extend */
1507 *c->src.ptr = c->dst.val;
1511 * Write back the memory destination with implicit LOCK
1514 c->dst.val = c->src.val;
1517 case 0x88 ... 0x8b: /* mov */
1519 case 0x8d: /* lea r16/r32, m */
1520 c->dst.val = c->modrm_ea;
1522 case 0x8f: /* pop (sole member of Grp1a) */
1523 rc = emulate_grp1a(ctxt, ops);
1527 case 0x9c: /* pushf */
1528 c->src.val = (unsigned long) ctxt->eflags;
1531 case 0x9d: /* popf */
1532 c->dst.ptr = (unsigned long *) &ctxt->eflags;
1533 goto pop_instruction;
1534 case 0xa0 ... 0xa1: /* mov */
1535 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1536 c->dst.val = c->src.val;
1538 case 0xa2 ... 0xa3: /* mov */
1539 c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
1541 case 0xa4 ... 0xa5: /* movs */
1542 c->dst.type = OP_MEM;
1543 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1544 c->dst.ptr = (unsigned long *)register_address(c,
1546 c->regs[VCPU_REGS_RDI]);
1547 if ((rc = ops->read_emulated(register_address(c,
1548 c->override_base ? *c->override_base :
1550 c->regs[VCPU_REGS_RSI]),
1552 c->dst.bytes, ctxt->vcpu)) != 0)
1554 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1555 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1557 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1558 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1561 case 0xa6 ... 0xa7: /* cmps */
1562 c->src.type = OP_NONE; /* Disable writeback. */
1563 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1564 c->src.ptr = (unsigned long *)register_address(c,
1565 c->override_base ? *c->override_base :
1567 c->regs[VCPU_REGS_RSI]);
1568 if ((rc = ops->read_emulated((unsigned long)c->src.ptr,
1574 c->dst.type = OP_NONE; /* Disable writeback. */
1575 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1576 c->dst.ptr = (unsigned long *)register_address(c,
1578 c->regs[VCPU_REGS_RDI]);
1579 if ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1585 DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c->src.ptr, c->dst.ptr);
1587 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1589 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1590 (ctxt->eflags & EFLG_DF) ? -c->src.bytes
1592 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1593 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1597 case 0xaa ... 0xab: /* stos */
1598 c->dst.type = OP_MEM;
1599 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1600 c->dst.ptr = (unsigned long *)register_address(c,
1602 c->regs[VCPU_REGS_RDI]);
1603 c->dst.val = c->regs[VCPU_REGS_RAX];
1604 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1605 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1608 case 0xac ... 0xad: /* lods */
1609 c->dst.type = OP_REG;
1610 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1611 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1612 if ((rc = ops->read_emulated(register_address(c,
1613 c->override_base ? *c->override_base :
1615 c->regs[VCPU_REGS_RSI]),
1620 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1621 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1624 case 0xae ... 0xaf: /* scas */
1625 DPRINTF("Urk! I don't handle SCAS.\n");
1626 goto cannot_emulate;
1630 case 0xc3: /* ret */
1631 c->dst.ptr = &c->eip;
1632 goto pop_instruction;
1633 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1635 c->dst.val = c->src.val;
1637 case 0xd0 ... 0xd1: /* Grp2 */
1641 case 0xd2 ... 0xd3: /* Grp2 */
1642 c->src.val = c->regs[VCPU_REGS_RCX];
1645 case 0xe8: /* call (near) */ {
1647 switch (c->op_bytes) {
1649 rel = insn_fetch(s16, 2, c->eip);
1652 rel = insn_fetch(s32, 4, c->eip);
1655 DPRINTF("Call: Invalid op_bytes\n");
1656 goto cannot_emulate;
1658 c->src.val = (unsigned long) c->eip;
1660 c->op_bytes = c->ad_bytes;
1664 case 0xe9: /* jmp rel */
1666 case 0xea: /* jmp far */ {
1670 switch (c->op_bytes) {
1672 eip = insn_fetch(u16, 2, c->eip);
1675 eip = insn_fetch(u32, 4, c->eip);
1678 DPRINTF("jmp far: Invalid op_bytes\n");
1679 goto cannot_emulate;
1681 sel = insn_fetch(u16, 2, c->eip);
1682 if (kvm_load_segment_descriptor(ctxt->vcpu, sel, 9, VCPU_SREG_CS) < 0) {
1683 DPRINTF("jmp far: Failed to load CS descriptor\n");
1684 goto cannot_emulate;
1691 jmp: /* jmp rel short */
1692 jmp_rel(c, c->src.val);
1693 c->dst.type = OP_NONE; /* Disable writeback. */
1695 case 0xf4: /* hlt */
1696 ctxt->vcpu->arch.halt_request = 1;
1698 case 0xf5: /* cmc */
1699 /* complement carry flag from eflags reg */
1700 ctxt->eflags ^= EFLG_CF;
1701 c->dst.type = OP_NONE; /* Disable writeback. */
1703 case 0xf6 ... 0xf7: /* Grp3 */
1704 rc = emulate_grp3(ctxt, ops);
1708 case 0xf8: /* clc */
1709 ctxt->eflags &= ~EFLG_CF;
1710 c->dst.type = OP_NONE; /* Disable writeback. */
1712 case 0xfa: /* cli */
1713 ctxt->eflags &= ~X86_EFLAGS_IF;
1714 c->dst.type = OP_NONE; /* Disable writeback. */
1716 case 0xfb: /* sti */
1717 ctxt->eflags |= X86_EFLAGS_IF;
1718 c->dst.type = OP_NONE; /* Disable writeback. */
1720 case 0xfe ... 0xff: /* Grp4/Grp5 */
1721 rc = emulate_grp45(ctxt, ops);
1728 rc = writeback(ctxt, ops);
1732 /* Commit shadow register state. */
1733 memcpy(ctxt->vcpu->arch.regs, c->regs, sizeof c->regs);
1734 ctxt->vcpu->arch.rip = c->eip;
1737 if (rc == X86EMUL_UNHANDLEABLE) {
1745 case 0x01: /* lgdt, lidt, lmsw */
1746 switch (c->modrm_reg) {
1748 unsigned long address;
1750 case 0: /* vmcall */
1751 if (c->modrm_mod != 3 || c->modrm_rm != 1)
1752 goto cannot_emulate;
1754 rc = kvm_fix_hypercall(ctxt->vcpu);
1758 /* Let the processor re-execute the fixed hypercall */
1759 c->eip = ctxt->vcpu->arch.rip;
1760 /* Disable writeback. */
1761 c->dst.type = OP_NONE;
1764 rc = read_descriptor(ctxt, ops, c->src.ptr,
1765 &size, &address, c->op_bytes);
1768 realmode_lgdt(ctxt->vcpu, size, address);
1769 /* Disable writeback. */
1770 c->dst.type = OP_NONE;
1772 case 3: /* lidt/vmmcall */
1773 if (c->modrm_mod == 3 && c->modrm_rm == 1) {
1774 rc = kvm_fix_hypercall(ctxt->vcpu);
1777 kvm_emulate_hypercall(ctxt->vcpu);
1779 rc = read_descriptor(ctxt, ops, c->src.ptr,
1784 realmode_lidt(ctxt->vcpu, size, address);
1786 /* Disable writeback. */
1787 c->dst.type = OP_NONE;
1791 c->dst.val = realmode_get_cr(ctxt->vcpu, 0);
1794 realmode_lmsw(ctxt->vcpu, (u16)c->src.val,
1796 c->dst.type = OP_NONE;
1799 emulate_invlpg(ctxt->vcpu, memop);
1800 /* Disable writeback. */
1801 c->dst.type = OP_NONE;
1804 goto cannot_emulate;
1808 emulate_clts(ctxt->vcpu);
1809 c->dst.type = OP_NONE;
1811 case 0x08: /* invd */
1812 case 0x09: /* wbinvd */
1813 case 0x0d: /* GrpP (prefetch) */
1814 case 0x18: /* Grp16 (prefetch/nop) */
1815 c->dst.type = OP_NONE;
1817 case 0x20: /* mov cr, reg */
1818 if (c->modrm_mod != 3)
1819 goto cannot_emulate;
1820 c->regs[c->modrm_rm] =
1821 realmode_get_cr(ctxt->vcpu, c->modrm_reg);
1822 c->dst.type = OP_NONE; /* no writeback */
1824 case 0x21: /* mov from dr to reg */
1825 if (c->modrm_mod != 3)
1826 goto cannot_emulate;
1827 rc = emulator_get_dr(ctxt, c->modrm_reg, &c->regs[c->modrm_rm]);
1829 goto cannot_emulate;
1830 c->dst.type = OP_NONE; /* no writeback */
1832 case 0x22: /* mov reg, cr */
1833 if (c->modrm_mod != 3)
1834 goto cannot_emulate;
1835 realmode_set_cr(ctxt->vcpu,
1836 c->modrm_reg, c->modrm_val, &ctxt->eflags);
1837 c->dst.type = OP_NONE;
1839 case 0x23: /* mov from reg to dr */
1840 if (c->modrm_mod != 3)
1841 goto cannot_emulate;
1842 rc = emulator_set_dr(ctxt, c->modrm_reg,
1843 c->regs[c->modrm_rm]);
1845 goto cannot_emulate;
1846 c->dst.type = OP_NONE; /* no writeback */
1850 msr_data = (u32)c->regs[VCPU_REGS_RAX]
1851 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
1852 rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
1854 kvm_inject_gp(ctxt->vcpu, 0);
1855 c->eip = ctxt->vcpu->arch.rip;
1857 rc = X86EMUL_CONTINUE;
1858 c->dst.type = OP_NONE;
1862 rc = kvm_get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data);
1864 kvm_inject_gp(ctxt->vcpu, 0);
1865 c->eip = ctxt->vcpu->arch.rip;
1867 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
1868 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
1870 rc = X86EMUL_CONTINUE;
1871 c->dst.type = OP_NONE;
1873 case 0x40 ... 0x4f: /* cmov */
1874 c->dst.val = c->dst.orig_val = c->src.val;
1875 if (!test_cc(c->b, ctxt->eflags))
1876 c->dst.type = OP_NONE; /* no writeback */
1878 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1881 switch (c->op_bytes) {
1883 rel = insn_fetch(s16, 2, c->eip);
1886 rel = insn_fetch(s32, 4, c->eip);
1889 rel = insn_fetch(s64, 8, c->eip);
1892 DPRINTF("jnz: Invalid op_bytes\n");
1893 goto cannot_emulate;
1895 if (test_cc(c->b, ctxt->eflags))
1897 c->dst.type = OP_NONE;
1902 c->dst.type = OP_NONE;
1903 /* only subword offset */
1904 c->src.val &= (c->dst.bytes << 3) - 1;
1905 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
1909 /* only subword offset */
1910 c->src.val &= (c->dst.bytes << 3) - 1;
1911 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
1913 case 0xb0 ... 0xb1: /* cmpxchg */
1915 * Save real source value, then compare EAX against
1918 c->src.orig_val = c->src.val;
1919 c->src.val = c->regs[VCPU_REGS_RAX];
1920 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1921 if (ctxt->eflags & EFLG_ZF) {
1922 /* Success: write back to memory. */
1923 c->dst.val = c->src.orig_val;
1925 /* Failure: write the value we saw to EAX. */
1926 c->dst.type = OP_REG;
1927 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1932 /* only subword offset */
1933 c->src.val &= (c->dst.bytes << 3) - 1;
1934 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
1936 case 0xb6 ... 0xb7: /* movzx */
1937 c->dst.bytes = c->op_bytes;
1938 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
1941 case 0xba: /* Grp8 */
1942 switch (c->modrm_reg & 3) {
1955 /* only subword offset */
1956 c->src.val &= (c->dst.bytes << 3) - 1;
1957 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
1959 case 0xbe ... 0xbf: /* movsx */
1960 c->dst.bytes = c->op_bytes;
1961 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
1964 case 0xc3: /* movnti */
1965 c->dst.bytes = c->op_bytes;
1966 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
1969 case 0xc7: /* Grp9 (cmpxchg8b) */
1970 rc = emulate_grp9(ctxt, ops, memop);
1973 c->dst.type = OP_NONE;
1979 DPRINTF("Cannot emulate %02x\n", c->b);