1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf(_f , ## _a)
28 #include <linux/kvm_host.h>
29 #define DPRINTF(x...) do {} while (0)
31 #include <linux/module.h>
32 #include <asm/kvm_x86_emulate.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
65 #define MemAbs (1<<9) /* Memory operand is absolute displacement */
66 #define String (1<<10) /* String instruction (rep capable) */
67 #define Stack (1<<11) /* Stack instruction (push/pop) */
68 #define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
69 #define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
70 #define GroupMask 0xff /* Group number stored in bits 0:7 */
73 Group1A, Group3_Byte, Group3,
76 static u16 opcode_table[256] = {
78 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
79 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
82 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
83 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
87 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
90 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
91 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
94 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
95 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
96 SrcImmByte, SrcImm, 0, 0,
98 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
99 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
102 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
103 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
106 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
107 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
110 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
112 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
114 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
115 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
117 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
118 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
120 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
123 0, 0, ImplicitOps | Mov | Stack, 0,
124 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
125 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
127 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
128 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
130 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
131 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
133 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
134 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
135 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
136 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
138 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
139 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
140 0, ModRM | DstReg, 0, Group | Group1A,
142 0, 0, 0, 0, 0, 0, 0, 0,
143 0, 0, 0, 0, ImplicitOps | Stack, ImplicitOps | Stack, 0, 0,
145 ByteOp | DstReg | SrcMem | Mov | MemAbs, DstReg | SrcMem | Mov | MemAbs,
146 ByteOp | DstMem | SrcReg | Mov | MemAbs, DstMem | SrcReg | Mov | MemAbs,
147 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
148 ByteOp | ImplicitOps | String, ImplicitOps | String,
150 0, 0, ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
151 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
152 ByteOp | ImplicitOps | String, ImplicitOps | String,
154 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
156 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
157 0, ImplicitOps | Stack, 0, 0,
158 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
160 0, 0, 0, 0, 0, 0, 0, 0,
162 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
163 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
166 0, 0, 0, 0, 0, 0, 0, 0,
168 0, 0, 0, 0, 0, 0, 0, 0,
170 ImplicitOps | Stack, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps,
174 ImplicitOps, ImplicitOps, Group | Group3_Byte, Group | Group3,
176 ImplicitOps, 0, ImplicitOps, ImplicitOps,
177 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
180 static u16 twobyte_table[256] = {
182 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
183 ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
185 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
187 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
188 0, 0, 0, 0, 0, 0, 0, 0,
190 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
192 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
193 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
194 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
195 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
197 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
198 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
199 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
200 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
202 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
204 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
206 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
208 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
209 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
210 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
211 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
213 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
215 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
217 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
219 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
220 DstMem | SrcReg | ModRM | BitOp,
221 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
222 DstReg | SrcMem16 | ModRM | Mov,
224 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
225 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
226 DstReg | SrcMem16 | ModRM | Mov,
228 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
229 0, 0, 0, 0, 0, 0, 0, 0,
231 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
233 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
235 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
238 static u16 group_table[] = {
240 DstMem | SrcNone | ModRM | Mov | Stack, 0, 0, 0, 0, 0, 0, 0,
242 ByteOp | SrcImm | DstMem | ModRM, 0,
243 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
246 DstMem | SrcImm | ModRM | SrcImm, 0,
247 DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
251 static u16 group2_table[] = {
254 /* EFLAGS bit definitions. */
255 #define EFLG_OF (1<<11)
256 #define EFLG_DF (1<<10)
257 #define EFLG_SF (1<<7)
258 #define EFLG_ZF (1<<6)
259 #define EFLG_AF (1<<4)
260 #define EFLG_PF (1<<2)
261 #define EFLG_CF (1<<0)
264 * Instruction emulation:
265 * Most instructions are emulated directly via a fragment of inline assembly
266 * code. This allows us to save/restore EFLAGS and thus very easily pick up
267 * any modified flags.
270 #if defined(CONFIG_X86_64)
271 #define _LO32 "k" /* force 32-bit operand */
272 #define _STK "%%rsp" /* stack pointer */
273 #elif defined(__i386__)
274 #define _LO32 "" /* force 32-bit operand */
275 #define _STK "%%esp" /* stack pointer */
279 * These EFLAGS bits are restored from saved value during emulation, and
280 * any changes are written back to the saved value after emulation.
282 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
284 /* Before executing instruction: restore necessary bits in EFLAGS. */
285 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
286 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
287 "movl %"_sav",%"_LO32 _tmp"; " \
290 "movl %"_msk",%"_LO32 _tmp"; " \
291 "andl %"_LO32 _tmp",("_STK"); " \
293 "notl %"_LO32 _tmp"; " \
294 "andl %"_LO32 _tmp",("_STK"); " \
295 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
297 "orl %"_LO32 _tmp",("_STK"); " \
301 /* After executing instruction: write-back necessary bits in EFLAGS. */
302 #define _POST_EFLAGS(_sav, _msk, _tmp) \
303 /* _sav |= EFLAGS & _msk; */ \
306 "andl %"_msk",%"_LO32 _tmp"; " \
307 "orl %"_LO32 _tmp",%"_sav"; "
309 /* Raw emulation: instruction has two explicit operands. */
310 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
312 unsigned long _tmp; \
314 switch ((_dst).bytes) { \
316 __asm__ __volatile__ ( \
317 _PRE_EFLAGS("0", "4", "2") \
318 _op"w %"_wx"3,%1; " \
319 _POST_EFLAGS("0", "4", "2") \
320 : "=m" (_eflags), "=m" ((_dst).val), \
322 : _wy ((_src).val), "i" (EFLAGS_MASK)); \
325 __asm__ __volatile__ ( \
326 _PRE_EFLAGS("0", "4", "2") \
327 _op"l %"_lx"3,%1; " \
328 _POST_EFLAGS("0", "4", "2") \
329 : "=m" (_eflags), "=m" ((_dst).val), \
331 : _ly ((_src).val), "i" (EFLAGS_MASK)); \
334 __emulate_2op_8byte(_op, _src, _dst, \
335 _eflags, _qx, _qy); \
340 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
342 unsigned long _tmp; \
343 switch ((_dst).bytes) { \
345 __asm__ __volatile__ ( \
346 _PRE_EFLAGS("0", "4", "2") \
347 _op"b %"_bx"3,%1; " \
348 _POST_EFLAGS("0", "4", "2") \
349 : "=m" (_eflags), "=m" ((_dst).val), \
351 : _by ((_src).val), "i" (EFLAGS_MASK)); \
354 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
355 _wx, _wy, _lx, _ly, _qx, _qy); \
360 /* Source operand is byte-sized and may be restricted to just %cl. */
361 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
362 __emulate_2op(_op, _src, _dst, _eflags, \
363 "b", "c", "b", "c", "b", "c", "b", "c")
365 /* Source operand is byte, word, long or quad sized. */
366 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
367 __emulate_2op(_op, _src, _dst, _eflags, \
368 "b", "q", "w", "r", _LO32, "r", "", "r")
370 /* Source operand is word, long or quad sized. */
371 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
372 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
373 "w", "r", _LO32, "r", "", "r")
375 /* Instruction has only one explicit operand (no source operand). */
376 #define emulate_1op(_op, _dst, _eflags) \
378 unsigned long _tmp; \
380 switch ((_dst).bytes) { \
382 __asm__ __volatile__ ( \
383 _PRE_EFLAGS("0", "3", "2") \
385 _POST_EFLAGS("0", "3", "2") \
386 : "=m" (_eflags), "=m" ((_dst).val), \
388 : "i" (EFLAGS_MASK)); \
391 __asm__ __volatile__ ( \
392 _PRE_EFLAGS("0", "3", "2") \
394 _POST_EFLAGS("0", "3", "2") \
395 : "=m" (_eflags), "=m" ((_dst).val), \
397 : "i" (EFLAGS_MASK)); \
400 __asm__ __volatile__ ( \
401 _PRE_EFLAGS("0", "3", "2") \
403 _POST_EFLAGS("0", "3", "2") \
404 : "=m" (_eflags), "=m" ((_dst).val), \
406 : "i" (EFLAGS_MASK)); \
409 __emulate_1op_8byte(_op, _dst, _eflags); \
414 /* Emulate an instruction with quadword operands (x86/64 only). */
415 #if defined(CONFIG_X86_64)
416 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
418 __asm__ __volatile__ ( \
419 _PRE_EFLAGS("0", "4", "2") \
420 _op"q %"_qx"3,%1; " \
421 _POST_EFLAGS("0", "4", "2") \
422 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
423 : _qy ((_src).val), "i" (EFLAGS_MASK)); \
426 #define __emulate_1op_8byte(_op, _dst, _eflags) \
428 __asm__ __volatile__ ( \
429 _PRE_EFLAGS("0", "3", "2") \
431 _POST_EFLAGS("0", "3", "2") \
432 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
433 : "i" (EFLAGS_MASK)); \
436 #elif defined(__i386__)
437 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
438 #define __emulate_1op_8byte(_op, _dst, _eflags)
439 #endif /* __i386__ */
441 /* Fetch next part of the instruction being emulated. */
442 #define insn_fetch(_type, _size, _eip) \
443 ({ unsigned long _x; \
444 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
451 /* Access/update address held in a register, based on addressing mode. */
452 #define address_mask(reg) \
453 ((c->ad_bytes == sizeof(unsigned long)) ? \
454 (reg) : ((reg) & ((1UL << (c->ad_bytes << 3)) - 1)))
455 #define register_address(base, reg) \
456 ((base) + address_mask(reg))
457 #define register_address_increment(reg, inc) \
459 /* signed type ensures sign extension to long */ \
461 if (c->ad_bytes == sizeof(unsigned long)) \
465 ~((1UL << (c->ad_bytes << 3)) - 1)) | \
467 ((1UL << (c->ad_bytes << 3)) - 1)); \
470 #define JMP_REL(rel) \
472 register_address_increment(c->eip, rel); \
475 static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
476 struct x86_emulate_ops *ops,
477 unsigned long linear, u8 *dest)
479 struct fetch_cache *fc = &ctxt->decode.fetch;
483 if (linear < fc->start || linear >= fc->end) {
484 size = min(15UL, PAGE_SIZE - offset_in_page(linear));
485 rc = ops->read_std(linear, fc->data, size, ctxt->vcpu);
489 fc->end = linear + size;
491 *dest = fc->data[linear - fc->start];
495 static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
496 struct x86_emulate_ops *ops,
497 unsigned long eip, void *dest, unsigned size)
501 eip += ctxt->cs_base;
503 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
511 * Given the 'reg' portion of a ModRM byte, and a register block, return a
512 * pointer into the block that addresses the relevant register.
513 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
515 static void *decode_register(u8 modrm_reg, unsigned long *regs,
520 p = ®s[modrm_reg];
521 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
522 p = (unsigned char *)®s[modrm_reg & 3] + 1;
526 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
527 struct x86_emulate_ops *ops,
529 u16 *size, unsigned long *address, int op_bytes)
536 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
540 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
545 static int test_cc(unsigned int condition, unsigned int flags)
549 switch ((condition & 15) >> 1) {
551 rc |= (flags & EFLG_OF);
553 case 1: /* b/c/nae */
554 rc |= (flags & EFLG_CF);
557 rc |= (flags & EFLG_ZF);
560 rc |= (flags & (EFLG_CF|EFLG_ZF));
563 rc |= (flags & EFLG_SF);
566 rc |= (flags & EFLG_PF);
569 rc |= (flags & EFLG_ZF);
572 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
576 /* Odd condition identifiers (lsb == 1) have inverted sense. */
577 return (!!rc ^ (condition & 1));
580 static void decode_register_operand(struct operand *op,
581 struct decode_cache *c,
584 unsigned reg = c->modrm_reg;
585 int highbyte_regs = c->rex_prefix == 0;
588 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
590 if ((c->d & ByteOp) && !inhibit_bytereg) {
591 op->ptr = decode_register(reg, c->regs, highbyte_regs);
592 op->val = *(u8 *)op->ptr;
595 op->ptr = decode_register(reg, c->regs, 0);
596 op->bytes = c->op_bytes;
599 op->val = *(u16 *)op->ptr;
602 op->val = *(u32 *)op->ptr;
605 op->val = *(u64 *) op->ptr;
609 op->orig_val = op->val;
612 static int decode_modrm(struct x86_emulate_ctxt *ctxt,
613 struct x86_emulate_ops *ops)
615 struct decode_cache *c = &ctxt->decode;
617 int index_reg = 0, base_reg = 0, scale, rip_relative = 0;
621 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
622 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
623 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
626 c->modrm = insn_fetch(u8, 1, c->eip);
627 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
628 c->modrm_reg |= (c->modrm & 0x38) >> 3;
629 c->modrm_rm |= (c->modrm & 0x07);
633 if (c->modrm_mod == 3) {
634 c->modrm_val = *(unsigned long *)
635 decode_register(c->modrm_rm, c->regs, c->d & ByteOp);
639 if (c->ad_bytes == 2) {
640 unsigned bx = c->regs[VCPU_REGS_RBX];
641 unsigned bp = c->regs[VCPU_REGS_RBP];
642 unsigned si = c->regs[VCPU_REGS_RSI];
643 unsigned di = c->regs[VCPU_REGS_RDI];
645 /* 16-bit ModR/M decode. */
646 switch (c->modrm_mod) {
648 if (c->modrm_rm == 6)
649 c->modrm_ea += insn_fetch(u16, 2, c->eip);
652 c->modrm_ea += insn_fetch(s8, 1, c->eip);
655 c->modrm_ea += insn_fetch(u16, 2, c->eip);
658 switch (c->modrm_rm) {
660 c->modrm_ea += bx + si;
663 c->modrm_ea += bx + di;
666 c->modrm_ea += bp + si;
669 c->modrm_ea += bp + di;
678 if (c->modrm_mod != 0)
685 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
686 (c->modrm_rm == 6 && c->modrm_mod != 0))
687 if (!c->override_base)
688 c->override_base = &ctxt->ss_base;
689 c->modrm_ea = (u16)c->modrm_ea;
691 /* 32/64-bit ModR/M decode. */
692 switch (c->modrm_rm) {
695 sib = insn_fetch(u8, 1, c->eip);
696 index_reg |= (sib >> 3) & 7;
702 if (c->modrm_mod != 0)
703 c->modrm_ea += c->regs[base_reg];
706 insn_fetch(s32, 4, c->eip);
709 c->modrm_ea += c->regs[base_reg];
715 c->modrm_ea += c->regs[index_reg] << scale;
719 if (c->modrm_mod != 0)
720 c->modrm_ea += c->regs[c->modrm_rm];
721 else if (ctxt->mode == X86EMUL_MODE_PROT64)
725 c->modrm_ea += c->regs[c->modrm_rm];
728 switch (c->modrm_mod) {
730 if (c->modrm_rm == 5)
731 c->modrm_ea += insn_fetch(s32, 4, c->eip);
734 c->modrm_ea += insn_fetch(s8, 1, c->eip);
737 c->modrm_ea += insn_fetch(s32, 4, c->eip);
742 c->modrm_ea += c->eip;
743 switch (c->d & SrcMask) {
751 if (c->op_bytes == 8)
754 c->modrm_ea += c->op_bytes;
761 static int decode_abs(struct x86_emulate_ctxt *ctxt,
762 struct x86_emulate_ops *ops)
764 struct decode_cache *c = &ctxt->decode;
767 switch (c->ad_bytes) {
769 c->modrm_ea = insn_fetch(u16, 2, c->eip);
772 c->modrm_ea = insn_fetch(u32, 4, c->eip);
775 c->modrm_ea = insn_fetch(u64, 8, c->eip);
783 x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
785 struct decode_cache *c = &ctxt->decode;
787 int mode = ctxt->mode;
788 int def_op_bytes, def_ad_bytes, group;
790 /* Shadow copy of register state. Committed on successful emulation. */
792 memset(c, 0, sizeof(struct decode_cache));
793 c->eip = ctxt->vcpu->arch.rip;
794 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
797 case X86EMUL_MODE_REAL:
798 case X86EMUL_MODE_PROT16:
799 def_op_bytes = def_ad_bytes = 2;
801 case X86EMUL_MODE_PROT32:
802 def_op_bytes = def_ad_bytes = 4;
805 case X86EMUL_MODE_PROT64:
814 c->op_bytes = def_op_bytes;
815 c->ad_bytes = def_ad_bytes;
817 /* Legacy prefixes. */
819 switch (c->b = insn_fetch(u8, 1, c->eip)) {
820 case 0x66: /* operand-size override */
821 /* switch between 2/4 bytes */
822 c->op_bytes = def_op_bytes ^ 6;
824 case 0x67: /* address-size override */
825 if (mode == X86EMUL_MODE_PROT64)
826 /* switch between 4/8 bytes */
827 c->ad_bytes = def_ad_bytes ^ 12;
829 /* switch between 2/4 bytes */
830 c->ad_bytes = def_ad_bytes ^ 6;
832 case 0x2e: /* CS override */
833 c->override_base = &ctxt->cs_base;
835 case 0x3e: /* DS override */
836 c->override_base = &ctxt->ds_base;
838 case 0x26: /* ES override */
839 c->override_base = &ctxt->es_base;
841 case 0x64: /* FS override */
842 c->override_base = &ctxt->fs_base;
844 case 0x65: /* GS override */
845 c->override_base = &ctxt->gs_base;
847 case 0x36: /* SS override */
848 c->override_base = &ctxt->ss_base;
850 case 0x40 ... 0x4f: /* REX */
851 if (mode != X86EMUL_MODE_PROT64)
853 c->rex_prefix = c->b;
855 case 0xf0: /* LOCK */
858 case 0xf2: /* REPNE/REPNZ */
859 c->rep_prefix = REPNE_PREFIX;
861 case 0xf3: /* REP/REPE/REPZ */
862 c->rep_prefix = REPE_PREFIX;
868 /* Any legacy prefix after a REX prefix nullifies its effect. */
877 if (c->rex_prefix & 8)
878 c->op_bytes = 8; /* REX.W */
880 /* Opcode byte(s). */
881 c->d = opcode_table[c->b];
883 /* Two-byte opcode? */
886 c->b = insn_fetch(u8, 1, c->eip);
887 c->d = twobyte_table[c->b];
892 group = c->d & GroupMask;
893 c->modrm = insn_fetch(u8, 1, c->eip);
896 group = (group << 3) + ((c->modrm >> 3) & 7);
897 if ((c->d & GroupDual) && (c->modrm >> 6) == 3)
898 c->d = group2_table[group];
900 c->d = group_table[group];
905 DPRINTF("Cannot emulate %02x\n", c->b);
909 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
912 /* ModRM and SIB bytes. */
914 rc = decode_modrm(ctxt, ops);
915 else if (c->d & MemAbs)
916 rc = decode_abs(ctxt, ops);
920 if (!c->override_base)
921 c->override_base = &ctxt->ds_base;
922 if (mode == X86EMUL_MODE_PROT64 &&
923 c->override_base != &ctxt->fs_base &&
924 c->override_base != &ctxt->gs_base)
925 c->override_base = NULL;
927 if (c->override_base)
928 c->modrm_ea += *c->override_base;
930 if (c->ad_bytes != 8)
931 c->modrm_ea = (u32)c->modrm_ea;
933 * Decode and fetch the source operand: register, memory
936 switch (c->d & SrcMask) {
940 decode_register_operand(&c->src, c, 0);
949 c->src.bytes = (c->d & ByteOp) ? 1 :
951 /* Don't fetch the address for invlpg: it could be unmapped. */
952 if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
956 * For instructions with a ModR/M byte, switch to register
959 if ((c->d & ModRM) && c->modrm_mod == 3) {
960 c->src.type = OP_REG;
963 c->src.type = OP_MEM;
966 c->src.type = OP_IMM;
967 c->src.ptr = (unsigned long *)c->eip;
968 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
969 if (c->src.bytes == 8)
971 /* NB. Immediates are sign-extended as necessary. */
972 switch (c->src.bytes) {
974 c->src.val = insn_fetch(s8, 1, c->eip);
977 c->src.val = insn_fetch(s16, 2, c->eip);
980 c->src.val = insn_fetch(s32, 4, c->eip);
985 c->src.type = OP_IMM;
986 c->src.ptr = (unsigned long *)c->eip;
988 c->src.val = insn_fetch(s8, 1, c->eip);
992 /* Decode and fetch the destination operand: register or memory. */
993 switch (c->d & DstMask) {
995 /* Special instructions do their own operand decoding. */
998 decode_register_operand(&c->dst, c,
999 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
1002 if ((c->d & ModRM) && c->modrm_mod == 3) {
1003 c->dst.type = OP_REG;
1006 c->dst.type = OP_MEM;
1011 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1014 static inline void emulate_push(struct x86_emulate_ctxt *ctxt)
1016 struct decode_cache *c = &ctxt->decode;
1018 c->dst.type = OP_MEM;
1019 c->dst.bytes = c->op_bytes;
1020 c->dst.val = c->src.val;
1021 register_address_increment(c->regs[VCPU_REGS_RSP], -c->op_bytes);
1022 c->dst.ptr = (void *) register_address(ctxt->ss_base,
1023 c->regs[VCPU_REGS_RSP]);
1026 static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
1027 struct x86_emulate_ops *ops)
1029 struct decode_cache *c = &ctxt->decode;
1032 rc = ops->read_std(register_address(ctxt->ss_base,
1033 c->regs[VCPU_REGS_RSP]),
1034 &c->dst.val, c->dst.bytes, ctxt->vcpu);
1038 register_address_increment(c->regs[VCPU_REGS_RSP], c->dst.bytes);
1043 static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
1045 struct decode_cache *c = &ctxt->decode;
1046 switch (c->modrm_reg) {
1048 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
1051 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
1054 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
1057 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
1059 case 4: /* sal/shl */
1060 case 6: /* sal/shl */
1061 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
1064 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
1067 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
1072 static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
1073 struct x86_emulate_ops *ops)
1075 struct decode_cache *c = &ctxt->decode;
1078 switch (c->modrm_reg) {
1079 case 0 ... 1: /* test */
1080 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1083 c->dst.val = ~c->dst.val;
1086 emulate_1op("neg", c->dst, ctxt->eflags);
1089 DPRINTF("Cannot emulate %02x\n", c->b);
1090 rc = X86EMUL_UNHANDLEABLE;
1096 static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
1097 struct x86_emulate_ops *ops)
1099 struct decode_cache *c = &ctxt->decode;
1102 switch (c->modrm_reg) {
1104 emulate_1op("inc", c->dst, ctxt->eflags);
1107 emulate_1op("dec", c->dst, ctxt->eflags);
1109 case 4: /* jmp abs */
1111 c->eip = c->dst.val;
1113 DPRINTF("Cannot emulate %02x\n", c->b);
1114 return X86EMUL_UNHANDLEABLE;
1119 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1121 if (ctxt->mode == X86EMUL_MODE_PROT64) {
1123 rc = ops->read_std((unsigned long)c->dst.ptr,
1124 &c->dst.val, 8, ctxt->vcpu);
1128 register_address_increment(c->regs[VCPU_REGS_RSP],
1130 rc = ops->write_emulated(register_address(ctxt->ss_base,
1131 c->regs[VCPU_REGS_RSP]), &c->dst.val,
1132 c->dst.bytes, ctxt->vcpu);
1135 c->dst.type = OP_NONE;
1138 DPRINTF("Cannot emulate %02x\n", c->b);
1139 return X86EMUL_UNHANDLEABLE;
1144 static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
1145 struct x86_emulate_ops *ops,
1146 unsigned long memop)
1148 struct decode_cache *c = &ctxt->decode;
1152 rc = ops->read_emulated(memop, &old, 8, ctxt->vcpu);
1156 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1157 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
1159 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1160 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1161 ctxt->eflags &= ~EFLG_ZF;
1164 new = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1165 (u32) c->regs[VCPU_REGS_RBX];
1167 rc = ops->cmpxchg_emulated(memop, &old, &new, 8, ctxt->vcpu);
1170 ctxt->eflags |= EFLG_ZF;
1175 static inline int writeback(struct x86_emulate_ctxt *ctxt,
1176 struct x86_emulate_ops *ops)
1179 struct decode_cache *c = &ctxt->decode;
1181 switch (c->dst.type) {
1183 /* The 4-byte case *is* correct:
1184 * in 64-bit mode we zero-extend.
1186 switch (c->dst.bytes) {
1188 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1191 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1194 *c->dst.ptr = (u32)c->dst.val;
1195 break; /* 64b: zero-ext */
1197 *c->dst.ptr = c->dst.val;
1203 rc = ops->cmpxchg_emulated(
1204 (unsigned long)c->dst.ptr,
1210 rc = ops->write_emulated(
1211 (unsigned long)c->dst.ptr,
1228 x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1230 unsigned long memop = 0;
1232 unsigned long saved_eip = 0;
1233 struct decode_cache *c = &ctxt->decode;
1236 /* Shadow copy of register state. Committed on successful emulation.
1237 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
1241 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
1244 if (((c->d & ModRM) && (c->modrm_mod != 3)) || (c->d & MemAbs))
1245 memop = c->modrm_ea;
1247 if (c->rep_prefix && (c->d & String)) {
1248 /* All REP prefixes have the same first termination condition */
1249 if (c->regs[VCPU_REGS_RCX] == 0) {
1250 ctxt->vcpu->arch.rip = c->eip;
1253 /* The second termination condition only applies for REPE
1254 * and REPNE. Test if the repeat string operation prefix is
1255 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
1256 * corresponding termination condition according to:
1257 * - if REPE/REPZ and ZF = 0 then done
1258 * - if REPNE/REPNZ and ZF = 1 then done
1260 if ((c->b == 0xa6) || (c->b == 0xa7) ||
1261 (c->b == 0xae) || (c->b == 0xaf)) {
1262 if ((c->rep_prefix == REPE_PREFIX) &&
1263 ((ctxt->eflags & EFLG_ZF) == 0)) {
1264 ctxt->vcpu->arch.rip = c->eip;
1267 if ((c->rep_prefix == REPNE_PREFIX) &&
1268 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF)) {
1269 ctxt->vcpu->arch.rip = c->eip;
1273 c->regs[VCPU_REGS_RCX]--;
1274 c->eip = ctxt->vcpu->arch.rip;
1277 if (c->src.type == OP_MEM) {
1278 c->src.ptr = (unsigned long *)memop;
1280 rc = ops->read_emulated((unsigned long)c->src.ptr,
1286 c->src.orig_val = c->src.val;
1289 if ((c->d & DstMask) == ImplicitOps)
1293 if (c->dst.type == OP_MEM) {
1294 c->dst.ptr = (unsigned long *)memop;
1295 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1298 unsigned long mask = ~(c->dst.bytes * 8 - 1);
1300 c->dst.ptr = (void *)c->dst.ptr +
1301 (c->src.val & mask) / 8;
1303 if (!(c->d & Mov) &&
1304 /* optimisation - avoid slow emulated read */
1305 ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1307 c->dst.bytes, ctxt->vcpu)) != 0))
1310 c->dst.orig_val = c->dst.val;
1320 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
1324 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
1328 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
1332 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
1336 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
1338 case 0x24: /* and al imm8 */
1339 c->dst.type = OP_REG;
1340 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1341 c->dst.val = *(u8 *)c->dst.ptr;
1343 c->dst.orig_val = c->dst.val;
1345 case 0x25: /* and ax imm16, or eax imm32 */
1346 c->dst.type = OP_REG;
1347 c->dst.bytes = c->op_bytes;
1348 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1349 if (c->op_bytes == 2)
1350 c->dst.val = *(u16 *)c->dst.ptr;
1352 c->dst.val = *(u32 *)c->dst.ptr;
1353 c->dst.orig_val = c->dst.val;
1357 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
1361 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
1365 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1367 case 0x40 ... 0x47: /* inc r16/r32 */
1368 emulate_1op("inc", c->dst, ctxt->eflags);
1370 case 0x48 ... 0x4f: /* dec r16/r32 */
1371 emulate_1op("dec", c->dst, ctxt->eflags);
1373 case 0x50 ... 0x57: /* push reg */
1374 c->dst.type = OP_MEM;
1375 c->dst.bytes = c->op_bytes;
1376 c->dst.val = c->src.val;
1377 register_address_increment(c->regs[VCPU_REGS_RSP],
1379 c->dst.ptr = (void *) register_address(
1380 ctxt->ss_base, c->regs[VCPU_REGS_RSP]);
1382 case 0x58 ... 0x5f: /* pop reg */
1384 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1385 c->regs[VCPU_REGS_RSP]), c->dst.ptr,
1386 c->op_bytes, ctxt->vcpu)) != 0)
1389 register_address_increment(c->regs[VCPU_REGS_RSP],
1391 c->dst.type = OP_NONE; /* Disable writeback. */
1393 case 0x63: /* movsxd */
1394 if (ctxt->mode != X86EMUL_MODE_PROT64)
1395 goto cannot_emulate;
1396 c->dst.val = (s32) c->src.val;
1398 case 0x6a: /* push imm8 */
1400 c->src.val = insn_fetch(s8, 1, c->eip);
1403 case 0x6c: /* insb */
1404 case 0x6d: /* insw/insd */
1405 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1407 (c->d & ByteOp) ? 1 : c->op_bytes,
1409 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1410 (ctxt->eflags & EFLG_DF),
1411 register_address(ctxt->es_base,
1412 c->regs[VCPU_REGS_RDI]),
1414 c->regs[VCPU_REGS_RDX]) == 0) {
1419 case 0x6e: /* outsb */
1420 case 0x6f: /* outsw/outsd */
1421 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1423 (c->d & ByteOp) ? 1 : c->op_bytes,
1425 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1426 (ctxt->eflags & EFLG_DF),
1427 register_address(c->override_base ?
1430 c->regs[VCPU_REGS_RSI]),
1432 c->regs[VCPU_REGS_RDX]) == 0) {
1437 case 0x70 ... 0x7f: /* jcc (short) */ {
1438 int rel = insn_fetch(s8, 1, c->eip);
1440 if (test_cc(c->b, ctxt->eflags))
1444 case 0x80 ... 0x83: /* Grp1 */
1445 switch (c->modrm_reg) {
1465 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1467 case 0x86 ... 0x87: /* xchg */
1468 /* Write back the register source. */
1469 switch (c->dst.bytes) {
1471 *(u8 *) c->src.ptr = (u8) c->dst.val;
1474 *(u16 *) c->src.ptr = (u16) c->dst.val;
1477 *c->src.ptr = (u32) c->dst.val;
1478 break; /* 64b reg: zero-extend */
1480 *c->src.ptr = c->dst.val;
1484 * Write back the memory destination with implicit LOCK
1487 c->dst.val = c->src.val;
1490 case 0x88 ... 0x8b: /* mov */
1492 case 0x8d: /* lea r16/r32, m */
1493 c->dst.val = c->modrm_val;
1495 case 0x8f: /* pop (sole member of Grp1a) */
1496 rc = emulate_grp1a(ctxt, ops);
1500 case 0x9c: /* pushf */
1501 c->src.val = (unsigned long) ctxt->eflags;
1504 case 0x9d: /* popf */
1505 c->dst.ptr = (unsigned long *) &ctxt->eflags;
1506 goto pop_instruction;
1507 case 0xa0 ... 0xa1: /* mov */
1508 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1509 c->dst.val = c->src.val;
1511 case 0xa2 ... 0xa3: /* mov */
1512 c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
1514 case 0xa4 ... 0xa5: /* movs */
1515 c->dst.type = OP_MEM;
1516 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1517 c->dst.ptr = (unsigned long *)register_address(
1519 c->regs[VCPU_REGS_RDI]);
1520 if ((rc = ops->read_emulated(register_address(
1521 c->override_base ? *c->override_base :
1523 c->regs[VCPU_REGS_RSI]),
1525 c->dst.bytes, ctxt->vcpu)) != 0)
1527 register_address_increment(c->regs[VCPU_REGS_RSI],
1528 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1530 register_address_increment(c->regs[VCPU_REGS_RDI],
1531 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1534 case 0xa6 ... 0xa7: /* cmps */
1535 c->src.type = OP_NONE; /* Disable writeback. */
1536 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1537 c->src.ptr = (unsigned long *)register_address(
1538 c->override_base ? *c->override_base :
1540 c->regs[VCPU_REGS_RSI]);
1541 if ((rc = ops->read_emulated((unsigned long)c->src.ptr,
1547 c->dst.type = OP_NONE; /* Disable writeback. */
1548 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1549 c->dst.ptr = (unsigned long *)register_address(
1551 c->regs[VCPU_REGS_RDI]);
1552 if ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1558 DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c->src.ptr, c->dst.ptr);
1560 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1562 register_address_increment(c->regs[VCPU_REGS_RSI],
1563 (ctxt->eflags & EFLG_DF) ? -c->src.bytes
1565 register_address_increment(c->regs[VCPU_REGS_RDI],
1566 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1570 case 0xaa ... 0xab: /* stos */
1571 c->dst.type = OP_MEM;
1572 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1573 c->dst.ptr = (unsigned long *)register_address(
1575 c->regs[VCPU_REGS_RDI]);
1576 c->dst.val = c->regs[VCPU_REGS_RAX];
1577 register_address_increment(c->regs[VCPU_REGS_RDI],
1578 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1581 case 0xac ... 0xad: /* lods */
1582 c->dst.type = OP_REG;
1583 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1584 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1585 if ((rc = ops->read_emulated(register_address(
1586 c->override_base ? *c->override_base :
1588 c->regs[VCPU_REGS_RSI]),
1593 register_address_increment(c->regs[VCPU_REGS_RSI],
1594 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1597 case 0xae ... 0xaf: /* scas */
1598 DPRINTF("Urk! I don't handle SCAS.\n");
1599 goto cannot_emulate;
1603 case 0xc3: /* ret */
1604 c->dst.ptr = &c->eip;
1605 goto pop_instruction;
1606 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1608 c->dst.val = c->src.val;
1610 case 0xd0 ... 0xd1: /* Grp2 */
1614 case 0xd2 ... 0xd3: /* Grp2 */
1615 c->src.val = c->regs[VCPU_REGS_RCX];
1618 case 0xe8: /* call (near) */ {
1620 switch (c->op_bytes) {
1622 rel = insn_fetch(s16, 2, c->eip);
1625 rel = insn_fetch(s32, 4, c->eip);
1628 DPRINTF("Call: Invalid op_bytes\n");
1629 goto cannot_emulate;
1631 c->src.val = (unsigned long) c->eip;
1633 c->op_bytes = c->ad_bytes;
1637 case 0xe9: /* jmp rel */
1638 case 0xeb: /* jmp rel short */
1639 JMP_REL(c->src.val);
1640 c->dst.type = OP_NONE; /* Disable writeback. */
1642 case 0xf4: /* hlt */
1643 ctxt->vcpu->arch.halt_request = 1;
1645 case 0xf5: /* cmc */
1646 /* complement carry flag from eflags reg */
1647 ctxt->eflags ^= EFLG_CF;
1648 c->dst.type = OP_NONE; /* Disable writeback. */
1650 case 0xf6 ... 0xf7: /* Grp3 */
1651 rc = emulate_grp3(ctxt, ops);
1655 case 0xf8: /* clc */
1656 ctxt->eflags &= ~EFLG_CF;
1657 c->dst.type = OP_NONE; /* Disable writeback. */
1659 case 0xfa: /* cli */
1660 ctxt->eflags &= ~X86_EFLAGS_IF;
1661 c->dst.type = OP_NONE; /* Disable writeback. */
1663 case 0xfb: /* sti */
1664 ctxt->eflags |= X86_EFLAGS_IF;
1665 c->dst.type = OP_NONE; /* Disable writeback. */
1667 case 0xfe ... 0xff: /* Grp4/Grp5 */
1668 rc = emulate_grp45(ctxt, ops);
1675 rc = writeback(ctxt, ops);
1679 /* Commit shadow register state. */
1680 memcpy(ctxt->vcpu->arch.regs, c->regs, sizeof c->regs);
1681 ctxt->vcpu->arch.rip = c->eip;
1684 if (rc == X86EMUL_UNHANDLEABLE) {
1692 case 0x01: /* lgdt, lidt, lmsw */
1693 switch (c->modrm_reg) {
1695 unsigned long address;
1697 case 0: /* vmcall */
1698 if (c->modrm_mod != 3 || c->modrm_rm != 1)
1699 goto cannot_emulate;
1701 rc = kvm_fix_hypercall(ctxt->vcpu);
1705 kvm_emulate_hypercall(ctxt->vcpu);
1708 rc = read_descriptor(ctxt, ops, c->src.ptr,
1709 &size, &address, c->op_bytes);
1712 realmode_lgdt(ctxt->vcpu, size, address);
1714 case 3: /* lidt/vmmcall */
1715 if (c->modrm_mod == 3 && c->modrm_rm == 1) {
1716 rc = kvm_fix_hypercall(ctxt->vcpu);
1719 kvm_emulate_hypercall(ctxt->vcpu);
1721 rc = read_descriptor(ctxt, ops, c->src.ptr,
1726 realmode_lidt(ctxt->vcpu, size, address);
1730 if (c->modrm_mod != 3)
1731 goto cannot_emulate;
1732 *(u16 *)&c->regs[c->modrm_rm]
1733 = realmode_get_cr(ctxt->vcpu, 0);
1736 if (c->modrm_mod != 3)
1737 goto cannot_emulate;
1738 realmode_lmsw(ctxt->vcpu, (u16)c->modrm_val,
1742 emulate_invlpg(ctxt->vcpu, memop);
1745 goto cannot_emulate;
1747 /* Disable writeback. */
1748 c->dst.type = OP_NONE;
1751 emulate_clts(ctxt->vcpu);
1752 c->dst.type = OP_NONE;
1754 case 0x08: /* invd */
1755 case 0x09: /* wbinvd */
1756 case 0x0d: /* GrpP (prefetch) */
1757 case 0x18: /* Grp16 (prefetch/nop) */
1758 c->dst.type = OP_NONE;
1760 case 0x20: /* mov cr, reg */
1761 if (c->modrm_mod != 3)
1762 goto cannot_emulate;
1763 c->regs[c->modrm_rm] =
1764 realmode_get_cr(ctxt->vcpu, c->modrm_reg);
1765 c->dst.type = OP_NONE; /* no writeback */
1767 case 0x21: /* mov from dr to reg */
1768 if (c->modrm_mod != 3)
1769 goto cannot_emulate;
1770 rc = emulator_get_dr(ctxt, c->modrm_reg, &c->regs[c->modrm_rm]);
1772 goto cannot_emulate;
1773 c->dst.type = OP_NONE; /* no writeback */
1775 case 0x22: /* mov reg, cr */
1776 if (c->modrm_mod != 3)
1777 goto cannot_emulate;
1778 realmode_set_cr(ctxt->vcpu,
1779 c->modrm_reg, c->modrm_val, &ctxt->eflags);
1780 c->dst.type = OP_NONE;
1782 case 0x23: /* mov from reg to dr */
1783 if (c->modrm_mod != 3)
1784 goto cannot_emulate;
1785 rc = emulator_set_dr(ctxt, c->modrm_reg,
1786 c->regs[c->modrm_rm]);
1788 goto cannot_emulate;
1789 c->dst.type = OP_NONE; /* no writeback */
1793 msr_data = (u32)c->regs[VCPU_REGS_RAX]
1794 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
1795 rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
1797 kvm_inject_gp(ctxt->vcpu, 0);
1798 c->eip = ctxt->vcpu->arch.rip;
1800 rc = X86EMUL_CONTINUE;
1801 c->dst.type = OP_NONE;
1805 rc = kvm_get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data);
1807 kvm_inject_gp(ctxt->vcpu, 0);
1808 c->eip = ctxt->vcpu->arch.rip;
1810 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
1811 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
1813 rc = X86EMUL_CONTINUE;
1814 c->dst.type = OP_NONE;
1816 case 0x40 ... 0x4f: /* cmov */
1817 c->dst.val = c->dst.orig_val = c->src.val;
1818 if (!test_cc(c->b, ctxt->eflags))
1819 c->dst.type = OP_NONE; /* no writeback */
1821 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1824 switch (c->op_bytes) {
1826 rel = insn_fetch(s16, 2, c->eip);
1829 rel = insn_fetch(s32, 4, c->eip);
1832 rel = insn_fetch(s64, 8, c->eip);
1835 DPRINTF("jnz: Invalid op_bytes\n");
1836 goto cannot_emulate;
1838 if (test_cc(c->b, ctxt->eflags))
1840 c->dst.type = OP_NONE;
1845 c->dst.type = OP_NONE;
1846 /* only subword offset */
1847 c->src.val &= (c->dst.bytes << 3) - 1;
1848 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
1852 /* only subword offset */
1853 c->src.val &= (c->dst.bytes << 3) - 1;
1854 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
1856 case 0xb0 ... 0xb1: /* cmpxchg */
1858 * Save real source value, then compare EAX against
1861 c->src.orig_val = c->src.val;
1862 c->src.val = c->regs[VCPU_REGS_RAX];
1863 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1864 if (ctxt->eflags & EFLG_ZF) {
1865 /* Success: write back to memory. */
1866 c->dst.val = c->src.orig_val;
1868 /* Failure: write the value we saw to EAX. */
1869 c->dst.type = OP_REG;
1870 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1875 /* only subword offset */
1876 c->src.val &= (c->dst.bytes << 3) - 1;
1877 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
1879 case 0xb6 ... 0xb7: /* movzx */
1880 c->dst.bytes = c->op_bytes;
1881 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
1884 case 0xba: /* Grp8 */
1885 switch (c->modrm_reg & 3) {
1898 /* only subword offset */
1899 c->src.val &= (c->dst.bytes << 3) - 1;
1900 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
1902 case 0xbe ... 0xbf: /* movsx */
1903 c->dst.bytes = c->op_bytes;
1904 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
1907 case 0xc3: /* movnti */
1908 c->dst.bytes = c->op_bytes;
1909 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
1912 case 0xc7: /* Grp9 (cmpxchg8b) */
1913 rc = emulate_grp9(ctxt, ops, memop);
1916 c->dst.type = OP_NONE;
1922 DPRINTF("Cannot emulate %02x\n", c->b);