1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf(_f , ## _a)
28 #include <linux/kvm_host.h>
29 #define DPRINTF(x...) do {} while (0)
31 #include <linux/module.h>
32 #include <asm/kvm_x86_emulate.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
65 #define MemAbs (1<<9) /* Memory operand is absolute displacement */
66 #define String (1<<10) /* String instruction (rep capable) */
67 #define Stack (1<<11) /* Stack instruction (push/pop) */
68 #define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
69 #define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
70 #define GroupMask 0xff /* Group number stored in bits 0:7 */
73 Group1_80, Group1_81, Group1_82, Group1_83,
74 Group1A, Group3_Byte, Group3, Group4, Group5, Group7,
77 static u16 opcode_table[256] = {
79 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
80 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
83 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
84 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
87 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
88 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
91 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
92 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
95 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
96 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
97 SrcImmByte, SrcImm, 0, 0,
99 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
100 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
103 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
104 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
107 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
108 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
111 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
113 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
115 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
116 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
118 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
119 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
121 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
124 0, 0, ImplicitOps | Mov | Stack, 0,
125 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
126 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
128 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
129 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
131 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
132 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
134 Group | Group1_80, Group | Group1_81,
135 Group | Group1_82, Group | Group1_83,
136 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
137 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
139 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
140 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
141 0, ModRM | DstReg, 0, Group | Group1A,
143 0, 0, 0, 0, 0, 0, 0, 0,
144 0, 0, 0, 0, ImplicitOps | Stack, ImplicitOps | Stack, 0, 0,
146 ByteOp | DstReg | SrcMem | Mov | MemAbs, DstReg | SrcMem | Mov | MemAbs,
147 ByteOp | DstMem | SrcReg | Mov | MemAbs, DstMem | SrcReg | Mov | MemAbs,
148 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
149 ByteOp | ImplicitOps | String, ImplicitOps | String,
151 0, 0, ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
152 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
153 ByteOp | ImplicitOps | String, ImplicitOps | String,
155 0, 0, 0, 0, 0, 0, 0, 0,
156 DstReg | SrcImm | Mov, 0, 0, 0, 0, 0, 0, 0,
158 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
159 0, ImplicitOps | Stack, 0, 0,
160 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
162 0, 0, 0, 0, 0, 0, 0, 0,
164 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
165 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
168 0, 0, 0, 0, 0, 0, 0, 0,
170 0, 0, 0, 0, 0, 0, 0, 0,
172 ImplicitOps | Stack, SrcImm | ImplicitOps,
173 ImplicitOps, SrcImmByte | ImplicitOps,
177 ImplicitOps, ImplicitOps, Group | Group3_Byte, Group | Group3,
179 ImplicitOps, 0, ImplicitOps, ImplicitOps,
180 0, 0, Group | Group4, Group | Group5,
183 static u16 twobyte_table[256] = {
185 0, Group | GroupDual | Group7, 0, 0, 0, 0, ImplicitOps, 0,
186 ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
188 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
190 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
191 0, 0, 0, 0, 0, 0, 0, 0,
193 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
195 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
196 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
197 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
198 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
200 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
201 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
202 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
203 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
205 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
207 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
209 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
211 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
212 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
213 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
214 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
216 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
218 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
220 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
222 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
223 DstMem | SrcReg | ModRM | BitOp,
224 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
225 DstReg | SrcMem16 | ModRM | Mov,
227 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
228 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
229 DstReg | SrcMem16 | ModRM | Mov,
231 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
232 0, 0, 0, 0, 0, 0, 0, 0,
234 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
236 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
238 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
241 static u16 group_table[] = {
243 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
244 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
245 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
246 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
248 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
249 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
250 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
251 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
253 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
254 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
255 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
256 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
258 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
259 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
260 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
261 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
263 DstMem | SrcNone | ModRM | Mov | Stack, 0, 0, 0, 0, 0, 0, 0,
265 ByteOp | SrcImm | DstMem | ModRM, 0,
266 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
269 DstMem | SrcImm | ModRM | SrcImm, 0,
270 DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
273 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
276 DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM, 0, 0,
277 SrcMem | ModRM, 0, SrcMem | ModRM | Stack, 0,
279 0, 0, ModRM | SrcMem, ModRM | SrcMem,
280 SrcNone | ModRM | DstMem | Mov, 0,
281 SrcMem16 | ModRM | Mov, SrcMem | ModRM | ByteOp,
284 static u16 group2_table[] = {
286 SrcNone | ModRM, 0, 0, 0,
287 SrcNone | ModRM | DstMem | Mov, 0,
288 SrcMem16 | ModRM | Mov, 0,
291 /* EFLAGS bit definitions. */
292 #define EFLG_OF (1<<11)
293 #define EFLG_DF (1<<10)
294 #define EFLG_SF (1<<7)
295 #define EFLG_ZF (1<<6)
296 #define EFLG_AF (1<<4)
297 #define EFLG_PF (1<<2)
298 #define EFLG_CF (1<<0)
301 * Instruction emulation:
302 * Most instructions are emulated directly via a fragment of inline assembly
303 * code. This allows us to save/restore EFLAGS and thus very easily pick up
304 * any modified flags.
307 #if defined(CONFIG_X86_64)
308 #define _LO32 "k" /* force 32-bit operand */
309 #define _STK "%%rsp" /* stack pointer */
310 #elif defined(__i386__)
311 #define _LO32 "" /* force 32-bit operand */
312 #define _STK "%%esp" /* stack pointer */
316 * These EFLAGS bits are restored from saved value during emulation, and
317 * any changes are written back to the saved value after emulation.
319 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
321 /* Before executing instruction: restore necessary bits in EFLAGS. */
322 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
323 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
324 "movl %"_sav",%"_LO32 _tmp"; " \
327 "movl %"_msk",%"_LO32 _tmp"; " \
328 "andl %"_LO32 _tmp",("_STK"); " \
330 "notl %"_LO32 _tmp"; " \
331 "andl %"_LO32 _tmp",("_STK"); " \
332 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
334 "orl %"_LO32 _tmp",("_STK"); " \
338 /* After executing instruction: write-back necessary bits in EFLAGS. */
339 #define _POST_EFLAGS(_sav, _msk, _tmp) \
340 /* _sav |= EFLAGS & _msk; */ \
343 "andl %"_msk",%"_LO32 _tmp"; " \
344 "orl %"_LO32 _tmp",%"_sav"; "
346 /* Raw emulation: instruction has two explicit operands. */
347 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
349 unsigned long _tmp; \
351 switch ((_dst).bytes) { \
353 __asm__ __volatile__ ( \
354 _PRE_EFLAGS("0", "4", "2") \
355 _op"w %"_wx"3,%1; " \
356 _POST_EFLAGS("0", "4", "2") \
357 : "=m" (_eflags), "=m" ((_dst).val), \
359 : _wy ((_src).val), "i" (EFLAGS_MASK)); \
362 __asm__ __volatile__ ( \
363 _PRE_EFLAGS("0", "4", "2") \
364 _op"l %"_lx"3,%1; " \
365 _POST_EFLAGS("0", "4", "2") \
366 : "=m" (_eflags), "=m" ((_dst).val), \
368 : _ly ((_src).val), "i" (EFLAGS_MASK)); \
371 __emulate_2op_8byte(_op, _src, _dst, \
372 _eflags, _qx, _qy); \
377 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
379 unsigned long __tmp; \
380 switch ((_dst).bytes) { \
382 __asm__ __volatile__ ( \
383 _PRE_EFLAGS("0", "4", "2") \
384 _op"b %"_bx"3,%1; " \
385 _POST_EFLAGS("0", "4", "2") \
386 : "=m" (_eflags), "=m" ((_dst).val), \
388 : _by ((_src).val), "i" (EFLAGS_MASK)); \
391 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
392 _wx, _wy, _lx, _ly, _qx, _qy); \
397 /* Source operand is byte-sized and may be restricted to just %cl. */
398 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
399 __emulate_2op(_op, _src, _dst, _eflags, \
400 "b", "c", "b", "c", "b", "c", "b", "c")
402 /* Source operand is byte, word, long or quad sized. */
403 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
404 __emulate_2op(_op, _src, _dst, _eflags, \
405 "b", "q", "w", "r", _LO32, "r", "", "r")
407 /* Source operand is word, long or quad sized. */
408 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
409 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
410 "w", "r", _LO32, "r", "", "r")
412 /* Instruction has only one explicit operand (no source operand). */
413 #define emulate_1op(_op, _dst, _eflags) \
415 unsigned long _tmp; \
417 switch ((_dst).bytes) { \
419 __asm__ __volatile__ ( \
420 _PRE_EFLAGS("0", "3", "2") \
422 _POST_EFLAGS("0", "3", "2") \
423 : "=m" (_eflags), "=m" ((_dst).val), \
425 : "i" (EFLAGS_MASK)); \
428 __asm__ __volatile__ ( \
429 _PRE_EFLAGS("0", "3", "2") \
431 _POST_EFLAGS("0", "3", "2") \
432 : "=m" (_eflags), "=m" ((_dst).val), \
434 : "i" (EFLAGS_MASK)); \
437 __asm__ __volatile__ ( \
438 _PRE_EFLAGS("0", "3", "2") \
440 _POST_EFLAGS("0", "3", "2") \
441 : "=m" (_eflags), "=m" ((_dst).val), \
443 : "i" (EFLAGS_MASK)); \
446 __emulate_1op_8byte(_op, _dst, _eflags); \
451 /* Emulate an instruction with quadword operands (x86/64 only). */
452 #if defined(CONFIG_X86_64)
453 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
455 __asm__ __volatile__ ( \
456 _PRE_EFLAGS("0", "4", "2") \
457 _op"q %"_qx"3,%1; " \
458 _POST_EFLAGS("0", "4", "2") \
459 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
460 : _qy ((_src).val), "i" (EFLAGS_MASK)); \
463 #define __emulate_1op_8byte(_op, _dst, _eflags) \
465 __asm__ __volatile__ ( \
466 _PRE_EFLAGS("0", "3", "2") \
468 _POST_EFLAGS("0", "3", "2") \
469 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
470 : "i" (EFLAGS_MASK)); \
473 #elif defined(__i386__)
474 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
475 #define __emulate_1op_8byte(_op, _dst, _eflags)
476 #endif /* __i386__ */
478 /* Fetch next part of the instruction being emulated. */
479 #define insn_fetch(_type, _size, _eip) \
480 ({ unsigned long _x; \
481 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
488 static inline unsigned long ad_mask(struct decode_cache *c)
490 return (1UL << (c->ad_bytes << 3)) - 1;
493 /* Access/update address held in a register, based on addressing mode. */
494 static inline unsigned long
495 address_mask(struct decode_cache *c, unsigned long reg)
497 if (c->ad_bytes == sizeof(unsigned long))
500 return reg & ad_mask(c);
503 static inline unsigned long
504 register_address(struct decode_cache *c, unsigned long base, unsigned long reg)
506 return base + address_mask(c, reg);
510 register_address_increment(struct decode_cache *c, unsigned long *reg, int inc)
512 if (c->ad_bytes == sizeof(unsigned long))
515 *reg = (*reg & ~ad_mask(c)) | ((*reg + inc) & ad_mask(c));
518 static inline void jmp_rel(struct decode_cache *c, int rel)
520 register_address_increment(c, &c->eip, rel);
523 static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
524 struct x86_emulate_ops *ops,
525 unsigned long linear, u8 *dest)
527 struct fetch_cache *fc = &ctxt->decode.fetch;
531 if (linear < fc->start || linear >= fc->end) {
532 size = min(15UL, PAGE_SIZE - offset_in_page(linear));
533 rc = ops->read_std(linear, fc->data, size, ctxt->vcpu);
537 fc->end = linear + size;
539 *dest = fc->data[linear - fc->start];
543 static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
544 struct x86_emulate_ops *ops,
545 unsigned long eip, void *dest, unsigned size)
549 eip += ctxt->cs_base;
551 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
559 * Given the 'reg' portion of a ModRM byte, and a register block, return a
560 * pointer into the block that addresses the relevant register.
561 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
563 static void *decode_register(u8 modrm_reg, unsigned long *regs,
568 p = ®s[modrm_reg];
569 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
570 p = (unsigned char *)®s[modrm_reg & 3] + 1;
574 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
575 struct x86_emulate_ops *ops,
577 u16 *size, unsigned long *address, int op_bytes)
584 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
588 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
593 static int test_cc(unsigned int condition, unsigned int flags)
597 switch ((condition & 15) >> 1) {
599 rc |= (flags & EFLG_OF);
601 case 1: /* b/c/nae */
602 rc |= (flags & EFLG_CF);
605 rc |= (flags & EFLG_ZF);
608 rc |= (flags & (EFLG_CF|EFLG_ZF));
611 rc |= (flags & EFLG_SF);
614 rc |= (flags & EFLG_PF);
617 rc |= (flags & EFLG_ZF);
620 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
624 /* Odd condition identifiers (lsb == 1) have inverted sense. */
625 return (!!rc ^ (condition & 1));
628 static void decode_register_operand(struct operand *op,
629 struct decode_cache *c,
632 unsigned reg = c->modrm_reg;
633 int highbyte_regs = c->rex_prefix == 0;
636 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
638 if ((c->d & ByteOp) && !inhibit_bytereg) {
639 op->ptr = decode_register(reg, c->regs, highbyte_regs);
640 op->val = *(u8 *)op->ptr;
643 op->ptr = decode_register(reg, c->regs, 0);
644 op->bytes = c->op_bytes;
647 op->val = *(u16 *)op->ptr;
650 op->val = *(u32 *)op->ptr;
653 op->val = *(u64 *) op->ptr;
657 op->orig_val = op->val;
660 static int decode_modrm(struct x86_emulate_ctxt *ctxt,
661 struct x86_emulate_ops *ops)
663 struct decode_cache *c = &ctxt->decode;
665 int index_reg = 0, base_reg = 0, scale, rip_relative = 0;
669 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
670 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
671 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
674 c->modrm = insn_fetch(u8, 1, c->eip);
675 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
676 c->modrm_reg |= (c->modrm & 0x38) >> 3;
677 c->modrm_rm |= (c->modrm & 0x07);
681 if (c->modrm_mod == 3) {
682 c->modrm_ptr = decode_register(c->modrm_rm,
683 c->regs, c->d & ByteOp);
684 c->modrm_val = *(unsigned long *)c->modrm_ptr;
688 if (c->ad_bytes == 2) {
689 unsigned bx = c->regs[VCPU_REGS_RBX];
690 unsigned bp = c->regs[VCPU_REGS_RBP];
691 unsigned si = c->regs[VCPU_REGS_RSI];
692 unsigned di = c->regs[VCPU_REGS_RDI];
694 /* 16-bit ModR/M decode. */
695 switch (c->modrm_mod) {
697 if (c->modrm_rm == 6)
698 c->modrm_ea += insn_fetch(u16, 2, c->eip);
701 c->modrm_ea += insn_fetch(s8, 1, c->eip);
704 c->modrm_ea += insn_fetch(u16, 2, c->eip);
707 switch (c->modrm_rm) {
709 c->modrm_ea += bx + si;
712 c->modrm_ea += bx + di;
715 c->modrm_ea += bp + si;
718 c->modrm_ea += bp + di;
727 if (c->modrm_mod != 0)
734 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
735 (c->modrm_rm == 6 && c->modrm_mod != 0))
736 if (!c->override_base)
737 c->override_base = &ctxt->ss_base;
738 c->modrm_ea = (u16)c->modrm_ea;
740 /* 32/64-bit ModR/M decode. */
741 switch (c->modrm_rm) {
744 sib = insn_fetch(u8, 1, c->eip);
745 index_reg |= (sib >> 3) & 7;
751 if (c->modrm_mod != 0)
752 c->modrm_ea += c->regs[base_reg];
755 insn_fetch(s32, 4, c->eip);
758 c->modrm_ea += c->regs[base_reg];
764 c->modrm_ea += c->regs[index_reg] << scale;
768 if (c->modrm_mod != 0)
769 c->modrm_ea += c->regs[c->modrm_rm];
770 else if (ctxt->mode == X86EMUL_MODE_PROT64)
774 c->modrm_ea += c->regs[c->modrm_rm];
777 switch (c->modrm_mod) {
779 if (c->modrm_rm == 5)
780 c->modrm_ea += insn_fetch(s32, 4, c->eip);
783 c->modrm_ea += insn_fetch(s8, 1, c->eip);
786 c->modrm_ea += insn_fetch(s32, 4, c->eip);
791 c->modrm_ea += c->eip;
792 switch (c->d & SrcMask) {
800 if (c->op_bytes == 8)
803 c->modrm_ea += c->op_bytes;
810 static int decode_abs(struct x86_emulate_ctxt *ctxt,
811 struct x86_emulate_ops *ops)
813 struct decode_cache *c = &ctxt->decode;
816 switch (c->ad_bytes) {
818 c->modrm_ea = insn_fetch(u16, 2, c->eip);
821 c->modrm_ea = insn_fetch(u32, 4, c->eip);
824 c->modrm_ea = insn_fetch(u64, 8, c->eip);
832 x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
834 struct decode_cache *c = &ctxt->decode;
836 int mode = ctxt->mode;
837 int def_op_bytes, def_ad_bytes, group;
839 /* Shadow copy of register state. Committed on successful emulation. */
841 memset(c, 0, sizeof(struct decode_cache));
842 c->eip = ctxt->vcpu->arch.rip;
843 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
846 case X86EMUL_MODE_REAL:
847 case X86EMUL_MODE_PROT16:
848 def_op_bytes = def_ad_bytes = 2;
850 case X86EMUL_MODE_PROT32:
851 def_op_bytes = def_ad_bytes = 4;
854 case X86EMUL_MODE_PROT64:
863 c->op_bytes = def_op_bytes;
864 c->ad_bytes = def_ad_bytes;
866 /* Legacy prefixes. */
868 switch (c->b = insn_fetch(u8, 1, c->eip)) {
869 case 0x66: /* operand-size override */
870 /* switch between 2/4 bytes */
871 c->op_bytes = def_op_bytes ^ 6;
873 case 0x67: /* address-size override */
874 if (mode == X86EMUL_MODE_PROT64)
875 /* switch between 4/8 bytes */
876 c->ad_bytes = def_ad_bytes ^ 12;
878 /* switch between 2/4 bytes */
879 c->ad_bytes = def_ad_bytes ^ 6;
881 case 0x2e: /* CS override */
882 c->override_base = &ctxt->cs_base;
884 case 0x3e: /* DS override */
885 c->override_base = &ctxt->ds_base;
887 case 0x26: /* ES override */
888 c->override_base = &ctxt->es_base;
890 case 0x64: /* FS override */
891 c->override_base = &ctxt->fs_base;
893 case 0x65: /* GS override */
894 c->override_base = &ctxt->gs_base;
896 case 0x36: /* SS override */
897 c->override_base = &ctxt->ss_base;
899 case 0x40 ... 0x4f: /* REX */
900 if (mode != X86EMUL_MODE_PROT64)
902 c->rex_prefix = c->b;
904 case 0xf0: /* LOCK */
907 case 0xf2: /* REPNE/REPNZ */
908 c->rep_prefix = REPNE_PREFIX;
910 case 0xf3: /* REP/REPE/REPZ */
911 c->rep_prefix = REPE_PREFIX;
917 /* Any legacy prefix after a REX prefix nullifies its effect. */
926 if (c->rex_prefix & 8)
927 c->op_bytes = 8; /* REX.W */
929 /* Opcode byte(s). */
930 c->d = opcode_table[c->b];
932 /* Two-byte opcode? */
935 c->b = insn_fetch(u8, 1, c->eip);
936 c->d = twobyte_table[c->b];
941 group = c->d & GroupMask;
942 c->modrm = insn_fetch(u8, 1, c->eip);
945 group = (group << 3) + ((c->modrm >> 3) & 7);
946 if ((c->d & GroupDual) && (c->modrm >> 6) == 3)
947 c->d = group2_table[group];
949 c->d = group_table[group];
954 DPRINTF("Cannot emulate %02x\n", c->b);
958 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
961 /* ModRM and SIB bytes. */
963 rc = decode_modrm(ctxt, ops);
964 else if (c->d & MemAbs)
965 rc = decode_abs(ctxt, ops);
969 if (!c->override_base)
970 c->override_base = &ctxt->ds_base;
971 if (mode == X86EMUL_MODE_PROT64 &&
972 c->override_base != &ctxt->fs_base &&
973 c->override_base != &ctxt->gs_base)
974 c->override_base = NULL;
976 if (c->override_base)
977 c->modrm_ea += *c->override_base;
979 if (c->ad_bytes != 8)
980 c->modrm_ea = (u32)c->modrm_ea;
982 * Decode and fetch the source operand: register, memory
985 switch (c->d & SrcMask) {
989 decode_register_operand(&c->src, c, 0);
998 c->src.bytes = (c->d & ByteOp) ? 1 :
1000 /* Don't fetch the address for invlpg: it could be unmapped. */
1001 if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
1005 * For instructions with a ModR/M byte, switch to register
1006 * access if Mod = 3.
1008 if ((c->d & ModRM) && c->modrm_mod == 3) {
1009 c->src.type = OP_REG;
1010 c->src.val = c->modrm_val;
1011 c->src.ptr = c->modrm_ptr;
1014 c->src.type = OP_MEM;
1017 c->src.type = OP_IMM;
1018 c->src.ptr = (unsigned long *)c->eip;
1019 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1020 if (c->src.bytes == 8)
1022 /* NB. Immediates are sign-extended as necessary. */
1023 switch (c->src.bytes) {
1025 c->src.val = insn_fetch(s8, 1, c->eip);
1028 c->src.val = insn_fetch(s16, 2, c->eip);
1031 c->src.val = insn_fetch(s32, 4, c->eip);
1036 c->src.type = OP_IMM;
1037 c->src.ptr = (unsigned long *)c->eip;
1039 c->src.val = insn_fetch(s8, 1, c->eip);
1043 /* Decode and fetch the destination operand: register or memory. */
1044 switch (c->d & DstMask) {
1046 /* Special instructions do their own operand decoding. */
1049 decode_register_operand(&c->dst, c,
1050 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
1053 if ((c->d & ModRM) && c->modrm_mod == 3) {
1054 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1055 c->dst.type = OP_REG;
1056 c->dst.val = c->dst.orig_val = c->modrm_val;
1057 c->dst.ptr = c->modrm_ptr;
1060 c->dst.type = OP_MEM;
1065 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1068 static inline void emulate_push(struct x86_emulate_ctxt *ctxt)
1070 struct decode_cache *c = &ctxt->decode;
1072 c->dst.type = OP_MEM;
1073 c->dst.bytes = c->op_bytes;
1074 c->dst.val = c->src.val;
1075 register_address_increment(c, &c->regs[VCPU_REGS_RSP], -c->op_bytes);
1076 c->dst.ptr = (void *) register_address(c, ctxt->ss_base,
1077 c->regs[VCPU_REGS_RSP]);
1080 static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
1081 struct x86_emulate_ops *ops)
1083 struct decode_cache *c = &ctxt->decode;
1086 rc = ops->read_std(register_address(c, ctxt->ss_base,
1087 c->regs[VCPU_REGS_RSP]),
1088 &c->dst.val, c->dst.bytes, ctxt->vcpu);
1092 register_address_increment(c, &c->regs[VCPU_REGS_RSP], c->dst.bytes);
1097 static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
1099 struct decode_cache *c = &ctxt->decode;
1100 switch (c->modrm_reg) {
1102 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
1105 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
1108 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
1111 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
1113 case 4: /* sal/shl */
1114 case 6: /* sal/shl */
1115 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
1118 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
1121 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
1126 static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
1127 struct x86_emulate_ops *ops)
1129 struct decode_cache *c = &ctxt->decode;
1132 switch (c->modrm_reg) {
1133 case 0 ... 1: /* test */
1134 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1137 c->dst.val = ~c->dst.val;
1140 emulate_1op("neg", c->dst, ctxt->eflags);
1143 DPRINTF("Cannot emulate %02x\n", c->b);
1144 rc = X86EMUL_UNHANDLEABLE;
1150 static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
1151 struct x86_emulate_ops *ops)
1153 struct decode_cache *c = &ctxt->decode;
1155 switch (c->modrm_reg) {
1157 emulate_1op("inc", c->dst, ctxt->eflags);
1160 emulate_1op("dec", c->dst, ctxt->eflags);
1162 case 4: /* jmp abs */
1163 c->eip = c->src.val;
1172 static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
1173 struct x86_emulate_ops *ops,
1174 unsigned long memop)
1176 struct decode_cache *c = &ctxt->decode;
1180 rc = ops->read_emulated(memop, &old, 8, ctxt->vcpu);
1184 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1185 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
1187 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1188 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1189 ctxt->eflags &= ~EFLG_ZF;
1192 new = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1193 (u32) c->regs[VCPU_REGS_RBX];
1195 rc = ops->cmpxchg_emulated(memop, &old, &new, 8, ctxt->vcpu);
1198 ctxt->eflags |= EFLG_ZF;
1203 static inline int writeback(struct x86_emulate_ctxt *ctxt,
1204 struct x86_emulate_ops *ops)
1207 struct decode_cache *c = &ctxt->decode;
1209 switch (c->dst.type) {
1211 /* The 4-byte case *is* correct:
1212 * in 64-bit mode we zero-extend.
1214 switch (c->dst.bytes) {
1216 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1219 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1222 *c->dst.ptr = (u32)c->dst.val;
1223 break; /* 64b: zero-ext */
1225 *c->dst.ptr = c->dst.val;
1231 rc = ops->cmpxchg_emulated(
1232 (unsigned long)c->dst.ptr,
1238 rc = ops->write_emulated(
1239 (unsigned long)c->dst.ptr,
1256 x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1258 unsigned long memop = 0;
1260 unsigned long saved_eip = 0;
1261 struct decode_cache *c = &ctxt->decode;
1264 /* Shadow copy of register state. Committed on successful emulation.
1265 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
1269 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
1272 if (((c->d & ModRM) && (c->modrm_mod != 3)) || (c->d & MemAbs))
1273 memop = c->modrm_ea;
1275 if (c->rep_prefix && (c->d & String)) {
1276 /* All REP prefixes have the same first termination condition */
1277 if (c->regs[VCPU_REGS_RCX] == 0) {
1278 ctxt->vcpu->arch.rip = c->eip;
1281 /* The second termination condition only applies for REPE
1282 * and REPNE. Test if the repeat string operation prefix is
1283 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
1284 * corresponding termination condition according to:
1285 * - if REPE/REPZ and ZF = 0 then done
1286 * - if REPNE/REPNZ and ZF = 1 then done
1288 if ((c->b == 0xa6) || (c->b == 0xa7) ||
1289 (c->b == 0xae) || (c->b == 0xaf)) {
1290 if ((c->rep_prefix == REPE_PREFIX) &&
1291 ((ctxt->eflags & EFLG_ZF) == 0)) {
1292 ctxt->vcpu->arch.rip = c->eip;
1295 if ((c->rep_prefix == REPNE_PREFIX) &&
1296 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF)) {
1297 ctxt->vcpu->arch.rip = c->eip;
1301 c->regs[VCPU_REGS_RCX]--;
1302 c->eip = ctxt->vcpu->arch.rip;
1305 if (c->src.type == OP_MEM) {
1306 c->src.ptr = (unsigned long *)memop;
1308 rc = ops->read_emulated((unsigned long)c->src.ptr,
1314 c->src.orig_val = c->src.val;
1317 if ((c->d & DstMask) == ImplicitOps)
1321 if (c->dst.type == OP_MEM) {
1322 c->dst.ptr = (unsigned long *)memop;
1323 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1326 unsigned long mask = ~(c->dst.bytes * 8 - 1);
1328 c->dst.ptr = (void *)c->dst.ptr +
1329 (c->src.val & mask) / 8;
1331 if (!(c->d & Mov) &&
1332 /* optimisation - avoid slow emulated read */
1333 ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1335 c->dst.bytes, ctxt->vcpu)) != 0))
1338 c->dst.orig_val = c->dst.val;
1348 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
1352 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
1356 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
1360 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
1364 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
1366 case 0x24: /* and al imm8 */
1367 c->dst.type = OP_REG;
1368 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1369 c->dst.val = *(u8 *)c->dst.ptr;
1371 c->dst.orig_val = c->dst.val;
1373 case 0x25: /* and ax imm16, or eax imm32 */
1374 c->dst.type = OP_REG;
1375 c->dst.bytes = c->op_bytes;
1376 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1377 if (c->op_bytes == 2)
1378 c->dst.val = *(u16 *)c->dst.ptr;
1380 c->dst.val = *(u32 *)c->dst.ptr;
1381 c->dst.orig_val = c->dst.val;
1385 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
1389 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
1393 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1395 case 0x40 ... 0x47: /* inc r16/r32 */
1396 emulate_1op("inc", c->dst, ctxt->eflags);
1398 case 0x48 ... 0x4f: /* dec r16/r32 */
1399 emulate_1op("dec", c->dst, ctxt->eflags);
1401 case 0x50 ... 0x57: /* push reg */
1402 c->dst.type = OP_MEM;
1403 c->dst.bytes = c->op_bytes;
1404 c->dst.val = c->src.val;
1405 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1407 c->dst.ptr = (void *) register_address(
1408 c, ctxt->ss_base, c->regs[VCPU_REGS_RSP]);
1410 case 0x58 ... 0x5f: /* pop reg */
1412 if ((rc = ops->read_std(register_address(c, ctxt->ss_base,
1413 c->regs[VCPU_REGS_RSP]), c->dst.ptr,
1414 c->op_bytes, ctxt->vcpu)) != 0)
1417 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1419 c->dst.type = OP_NONE; /* Disable writeback. */
1421 case 0x63: /* movsxd */
1422 if (ctxt->mode != X86EMUL_MODE_PROT64)
1423 goto cannot_emulate;
1424 c->dst.val = (s32) c->src.val;
1426 case 0x6a: /* push imm8 */
1428 c->src.val = insn_fetch(s8, 1, c->eip);
1431 case 0x6c: /* insb */
1432 case 0x6d: /* insw/insd */
1433 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1435 (c->d & ByteOp) ? 1 : c->op_bytes,
1437 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1,
1438 (ctxt->eflags & EFLG_DF),
1439 register_address(c, ctxt->es_base,
1440 c->regs[VCPU_REGS_RDI]),
1442 c->regs[VCPU_REGS_RDX]) == 0) {
1447 case 0x6e: /* outsb */
1448 case 0x6f: /* outsw/outsd */
1449 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1451 (c->d & ByteOp) ? 1 : c->op_bytes,
1453 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1,
1454 (ctxt->eflags & EFLG_DF),
1455 register_address(c, c->override_base ?
1458 c->regs[VCPU_REGS_RSI]),
1460 c->regs[VCPU_REGS_RDX]) == 0) {
1465 case 0x70 ... 0x7f: /* jcc (short) */ {
1466 int rel = insn_fetch(s8, 1, c->eip);
1468 if (test_cc(c->b, ctxt->eflags))
1472 case 0x80 ... 0x83: /* Grp1 */
1473 switch (c->modrm_reg) {
1493 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1495 case 0x86 ... 0x87: /* xchg */
1496 /* Write back the register source. */
1497 switch (c->dst.bytes) {
1499 *(u8 *) c->src.ptr = (u8) c->dst.val;
1502 *(u16 *) c->src.ptr = (u16) c->dst.val;
1505 *c->src.ptr = (u32) c->dst.val;
1506 break; /* 64b reg: zero-extend */
1508 *c->src.ptr = c->dst.val;
1512 * Write back the memory destination with implicit LOCK
1515 c->dst.val = c->src.val;
1518 case 0x88 ... 0x8b: /* mov */
1520 case 0x8d: /* lea r16/r32, m */
1521 c->dst.val = c->modrm_ea;
1523 case 0x8f: /* pop (sole member of Grp1a) */
1524 rc = emulate_grp1a(ctxt, ops);
1528 case 0x9c: /* pushf */
1529 c->src.val = (unsigned long) ctxt->eflags;
1532 case 0x9d: /* popf */
1533 c->dst.ptr = (unsigned long *) &ctxt->eflags;
1534 goto pop_instruction;
1535 case 0xa0 ... 0xa1: /* mov */
1536 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1537 c->dst.val = c->src.val;
1539 case 0xa2 ... 0xa3: /* mov */
1540 c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
1542 case 0xa4 ... 0xa5: /* movs */
1543 c->dst.type = OP_MEM;
1544 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1545 c->dst.ptr = (unsigned long *)register_address(c,
1547 c->regs[VCPU_REGS_RDI]);
1548 if ((rc = ops->read_emulated(register_address(c,
1549 c->override_base ? *c->override_base :
1551 c->regs[VCPU_REGS_RSI]),
1553 c->dst.bytes, ctxt->vcpu)) != 0)
1555 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1556 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1558 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1559 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1562 case 0xa6 ... 0xa7: /* cmps */
1563 c->src.type = OP_NONE; /* Disable writeback. */
1564 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1565 c->src.ptr = (unsigned long *)register_address(c,
1566 c->override_base ? *c->override_base :
1568 c->regs[VCPU_REGS_RSI]);
1569 if ((rc = ops->read_emulated((unsigned long)c->src.ptr,
1575 c->dst.type = OP_NONE; /* Disable writeback. */
1576 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1577 c->dst.ptr = (unsigned long *)register_address(c,
1579 c->regs[VCPU_REGS_RDI]);
1580 if ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1586 DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c->src.ptr, c->dst.ptr);
1588 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1590 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1591 (ctxt->eflags & EFLG_DF) ? -c->src.bytes
1593 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1594 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1598 case 0xaa ... 0xab: /* stos */
1599 c->dst.type = OP_MEM;
1600 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1601 c->dst.ptr = (unsigned long *)register_address(c,
1603 c->regs[VCPU_REGS_RDI]);
1604 c->dst.val = c->regs[VCPU_REGS_RAX];
1605 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1606 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1609 case 0xac ... 0xad: /* lods */
1610 c->dst.type = OP_REG;
1611 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1612 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1613 if ((rc = ops->read_emulated(register_address(c,
1614 c->override_base ? *c->override_base :
1616 c->regs[VCPU_REGS_RSI]),
1621 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1622 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1625 case 0xae ... 0xaf: /* scas */
1626 DPRINTF("Urk! I don't handle SCAS.\n");
1627 goto cannot_emulate;
1628 case 0xb8: /* mov r, imm */
1633 case 0xc3: /* ret */
1634 c->dst.ptr = &c->eip;
1635 goto pop_instruction;
1636 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1638 c->dst.val = c->src.val;
1640 case 0xd0 ... 0xd1: /* Grp2 */
1644 case 0xd2 ... 0xd3: /* Grp2 */
1645 c->src.val = c->regs[VCPU_REGS_RCX];
1648 case 0xe8: /* call (near) */ {
1650 switch (c->op_bytes) {
1652 rel = insn_fetch(s16, 2, c->eip);
1655 rel = insn_fetch(s32, 4, c->eip);
1658 DPRINTF("Call: Invalid op_bytes\n");
1659 goto cannot_emulate;
1661 c->src.val = (unsigned long) c->eip;
1663 c->op_bytes = c->ad_bytes;
1667 case 0xe9: /* jmp rel */
1669 case 0xea: /* jmp far */ {
1673 switch (c->op_bytes) {
1675 eip = insn_fetch(u16, 2, c->eip);
1678 eip = insn_fetch(u32, 4, c->eip);
1681 DPRINTF("jmp far: Invalid op_bytes\n");
1682 goto cannot_emulate;
1684 sel = insn_fetch(u16, 2, c->eip);
1685 if (kvm_load_segment_descriptor(ctxt->vcpu, sel, 9, VCPU_SREG_CS) < 0) {
1686 DPRINTF("jmp far: Failed to load CS descriptor\n");
1687 goto cannot_emulate;
1694 jmp: /* jmp rel short */
1695 jmp_rel(c, c->src.val);
1696 c->dst.type = OP_NONE; /* Disable writeback. */
1698 case 0xf4: /* hlt */
1699 ctxt->vcpu->arch.halt_request = 1;
1701 case 0xf5: /* cmc */
1702 /* complement carry flag from eflags reg */
1703 ctxt->eflags ^= EFLG_CF;
1704 c->dst.type = OP_NONE; /* Disable writeback. */
1706 case 0xf6 ... 0xf7: /* Grp3 */
1707 rc = emulate_grp3(ctxt, ops);
1711 case 0xf8: /* clc */
1712 ctxt->eflags &= ~EFLG_CF;
1713 c->dst.type = OP_NONE; /* Disable writeback. */
1715 case 0xfa: /* cli */
1716 ctxt->eflags &= ~X86_EFLAGS_IF;
1717 c->dst.type = OP_NONE; /* Disable writeback. */
1719 case 0xfb: /* sti */
1720 ctxt->eflags |= X86_EFLAGS_IF;
1721 c->dst.type = OP_NONE; /* Disable writeback. */
1723 case 0xfe ... 0xff: /* Grp4/Grp5 */
1724 rc = emulate_grp45(ctxt, ops);
1731 rc = writeback(ctxt, ops);
1735 /* Commit shadow register state. */
1736 memcpy(ctxt->vcpu->arch.regs, c->regs, sizeof c->regs);
1737 ctxt->vcpu->arch.rip = c->eip;
1740 if (rc == X86EMUL_UNHANDLEABLE) {
1748 case 0x01: /* lgdt, lidt, lmsw */
1749 switch (c->modrm_reg) {
1751 unsigned long address;
1753 case 0: /* vmcall */
1754 if (c->modrm_mod != 3 || c->modrm_rm != 1)
1755 goto cannot_emulate;
1757 rc = kvm_fix_hypercall(ctxt->vcpu);
1761 /* Let the processor re-execute the fixed hypercall */
1762 c->eip = ctxt->vcpu->arch.rip;
1763 /* Disable writeback. */
1764 c->dst.type = OP_NONE;
1767 rc = read_descriptor(ctxt, ops, c->src.ptr,
1768 &size, &address, c->op_bytes);
1771 realmode_lgdt(ctxt->vcpu, size, address);
1772 /* Disable writeback. */
1773 c->dst.type = OP_NONE;
1775 case 3: /* lidt/vmmcall */
1776 if (c->modrm_mod == 3 && c->modrm_rm == 1) {
1777 rc = kvm_fix_hypercall(ctxt->vcpu);
1780 kvm_emulate_hypercall(ctxt->vcpu);
1782 rc = read_descriptor(ctxt, ops, c->src.ptr,
1787 realmode_lidt(ctxt->vcpu, size, address);
1789 /* Disable writeback. */
1790 c->dst.type = OP_NONE;
1794 c->dst.val = realmode_get_cr(ctxt->vcpu, 0);
1797 realmode_lmsw(ctxt->vcpu, (u16)c->src.val,
1799 c->dst.type = OP_NONE;
1802 emulate_invlpg(ctxt->vcpu, memop);
1803 /* Disable writeback. */
1804 c->dst.type = OP_NONE;
1807 goto cannot_emulate;
1811 emulate_clts(ctxt->vcpu);
1812 c->dst.type = OP_NONE;
1814 case 0x08: /* invd */
1815 case 0x09: /* wbinvd */
1816 case 0x0d: /* GrpP (prefetch) */
1817 case 0x18: /* Grp16 (prefetch/nop) */
1818 c->dst.type = OP_NONE;
1820 case 0x20: /* mov cr, reg */
1821 if (c->modrm_mod != 3)
1822 goto cannot_emulate;
1823 c->regs[c->modrm_rm] =
1824 realmode_get_cr(ctxt->vcpu, c->modrm_reg);
1825 c->dst.type = OP_NONE; /* no writeback */
1827 case 0x21: /* mov from dr to reg */
1828 if (c->modrm_mod != 3)
1829 goto cannot_emulate;
1830 rc = emulator_get_dr(ctxt, c->modrm_reg, &c->regs[c->modrm_rm]);
1832 goto cannot_emulate;
1833 c->dst.type = OP_NONE; /* no writeback */
1835 case 0x22: /* mov reg, cr */
1836 if (c->modrm_mod != 3)
1837 goto cannot_emulate;
1838 realmode_set_cr(ctxt->vcpu,
1839 c->modrm_reg, c->modrm_val, &ctxt->eflags);
1840 c->dst.type = OP_NONE;
1842 case 0x23: /* mov from reg to dr */
1843 if (c->modrm_mod != 3)
1844 goto cannot_emulate;
1845 rc = emulator_set_dr(ctxt, c->modrm_reg,
1846 c->regs[c->modrm_rm]);
1848 goto cannot_emulate;
1849 c->dst.type = OP_NONE; /* no writeback */
1853 msr_data = (u32)c->regs[VCPU_REGS_RAX]
1854 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
1855 rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
1857 kvm_inject_gp(ctxt->vcpu, 0);
1858 c->eip = ctxt->vcpu->arch.rip;
1860 rc = X86EMUL_CONTINUE;
1861 c->dst.type = OP_NONE;
1865 rc = kvm_get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data);
1867 kvm_inject_gp(ctxt->vcpu, 0);
1868 c->eip = ctxt->vcpu->arch.rip;
1870 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
1871 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
1873 rc = X86EMUL_CONTINUE;
1874 c->dst.type = OP_NONE;
1876 case 0x40 ... 0x4f: /* cmov */
1877 c->dst.val = c->dst.orig_val = c->src.val;
1878 if (!test_cc(c->b, ctxt->eflags))
1879 c->dst.type = OP_NONE; /* no writeback */
1881 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1884 switch (c->op_bytes) {
1886 rel = insn_fetch(s16, 2, c->eip);
1889 rel = insn_fetch(s32, 4, c->eip);
1892 rel = insn_fetch(s64, 8, c->eip);
1895 DPRINTF("jnz: Invalid op_bytes\n");
1896 goto cannot_emulate;
1898 if (test_cc(c->b, ctxt->eflags))
1900 c->dst.type = OP_NONE;
1905 c->dst.type = OP_NONE;
1906 /* only subword offset */
1907 c->src.val &= (c->dst.bytes << 3) - 1;
1908 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
1912 /* only subword offset */
1913 c->src.val &= (c->dst.bytes << 3) - 1;
1914 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
1916 case 0xb0 ... 0xb1: /* cmpxchg */
1918 * Save real source value, then compare EAX against
1921 c->src.orig_val = c->src.val;
1922 c->src.val = c->regs[VCPU_REGS_RAX];
1923 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1924 if (ctxt->eflags & EFLG_ZF) {
1925 /* Success: write back to memory. */
1926 c->dst.val = c->src.orig_val;
1928 /* Failure: write the value we saw to EAX. */
1929 c->dst.type = OP_REG;
1930 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1935 /* only subword offset */
1936 c->src.val &= (c->dst.bytes << 3) - 1;
1937 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
1939 case 0xb6 ... 0xb7: /* movzx */
1940 c->dst.bytes = c->op_bytes;
1941 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
1944 case 0xba: /* Grp8 */
1945 switch (c->modrm_reg & 3) {
1958 /* only subword offset */
1959 c->src.val &= (c->dst.bytes << 3) - 1;
1960 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
1962 case 0xbe ... 0xbf: /* movsx */
1963 c->dst.bytes = c->op_bytes;
1964 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
1967 case 0xc3: /* movnti */
1968 c->dst.bytes = c->op_bytes;
1969 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
1972 case 0xc7: /* Grp9 (cmpxchg8b) */
1973 rc = emulate_grp9(ctxt, ops, memop);
1976 c->dst.type = OP_NONE;
1982 DPRINTF("Cannot emulate %02x\n", c->b);