1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf(_f , ## _a)
28 #include <linux/kvm_host.h>
29 #define DPRINTF(x...) do {} while (0)
31 #include <linux/module.h>
32 #include <asm/kvm_x86_emulate.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
65 #define MemAbs (1<<9) /* Memory operand is absolute displacement */
66 #define String (1<<10) /* String instruction (rep capable) */
67 #define Stack (1<<11) /* Stack instruction (push/pop) */
68 #define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
69 #define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
70 #define GroupMask 0xff /* Group number stored in bits 0:7 */
73 Group1A, Group3_Byte, Group3, Group4, Group5, Group7,
76 static u16 opcode_table[256] = {
78 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
79 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
82 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
83 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
87 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
90 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
91 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
94 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
95 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
96 SrcImmByte, SrcImm, 0, 0,
98 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
99 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
102 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
103 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
106 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
107 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
110 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
112 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
114 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
115 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
117 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
118 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
120 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
123 0, 0, ImplicitOps | Mov | Stack, 0,
124 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
125 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
127 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
128 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
130 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
131 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
133 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
134 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
135 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
136 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
138 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
139 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
140 0, ModRM | DstReg, 0, Group | Group1A,
142 0, 0, 0, 0, 0, 0, 0, 0,
143 0, 0, 0, 0, ImplicitOps | Stack, ImplicitOps | Stack, 0, 0,
145 ByteOp | DstReg | SrcMem | Mov | MemAbs, DstReg | SrcMem | Mov | MemAbs,
146 ByteOp | DstMem | SrcReg | Mov | MemAbs, DstMem | SrcReg | Mov | MemAbs,
147 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
148 ByteOp | ImplicitOps | String, ImplicitOps | String,
150 0, 0, ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
151 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
152 ByteOp | ImplicitOps | String, ImplicitOps | String,
154 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
156 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
157 0, ImplicitOps | Stack, 0, 0,
158 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
160 0, 0, 0, 0, 0, 0, 0, 0,
162 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
163 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
166 0, 0, 0, 0, 0, 0, 0, 0,
168 0, 0, 0, 0, 0, 0, 0, 0,
170 ImplicitOps | Stack, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps,
174 ImplicitOps, ImplicitOps, Group | Group3_Byte, Group | Group3,
176 ImplicitOps, 0, ImplicitOps, ImplicitOps,
177 0, 0, Group | Group4, Group | Group5,
180 static u16 twobyte_table[256] = {
182 0, Group | GroupDual | Group7, 0, 0, 0, 0, ImplicitOps, 0,
183 ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
185 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
187 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
188 0, 0, 0, 0, 0, 0, 0, 0,
190 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
192 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
193 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
194 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
195 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
197 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
198 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
199 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
200 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
202 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
204 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
206 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
208 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
209 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
210 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
211 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
213 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
215 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
217 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
219 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
220 DstMem | SrcReg | ModRM | BitOp,
221 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
222 DstReg | SrcMem16 | ModRM | Mov,
224 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
225 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
226 DstReg | SrcMem16 | ModRM | Mov,
228 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
229 0, 0, 0, 0, 0, 0, 0, 0,
231 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
233 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
235 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
238 static u16 group_table[] = {
240 DstMem | SrcNone | ModRM | Mov | Stack, 0, 0, 0, 0, 0, 0, 0,
242 ByteOp | SrcImm | DstMem | ModRM, 0,
243 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
246 DstMem | SrcImm | ModRM | SrcImm, 0,
247 DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
250 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
253 DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM, 0, 0,
254 SrcMem | ModRM, 0, SrcMem | ModRM | Stack, 0,
256 0, 0, ModRM | SrcMem, ModRM | SrcMem,
257 SrcNone | ModRM | DstMem, 0, SrcMem | ModRM, SrcMem | ModRM | ByteOp,
260 static u16 group2_table[] = {
262 SrcNone | ModRM, 0, 0, 0, SrcNone | ModRM | DstMem, 0, SrcMem | ModRM, 0,
265 /* EFLAGS bit definitions. */
266 #define EFLG_OF (1<<11)
267 #define EFLG_DF (1<<10)
268 #define EFLG_SF (1<<7)
269 #define EFLG_ZF (1<<6)
270 #define EFLG_AF (1<<4)
271 #define EFLG_PF (1<<2)
272 #define EFLG_CF (1<<0)
275 * Instruction emulation:
276 * Most instructions are emulated directly via a fragment of inline assembly
277 * code. This allows us to save/restore EFLAGS and thus very easily pick up
278 * any modified flags.
281 #if defined(CONFIG_X86_64)
282 #define _LO32 "k" /* force 32-bit operand */
283 #define _STK "%%rsp" /* stack pointer */
284 #elif defined(__i386__)
285 #define _LO32 "" /* force 32-bit operand */
286 #define _STK "%%esp" /* stack pointer */
290 * These EFLAGS bits are restored from saved value during emulation, and
291 * any changes are written back to the saved value after emulation.
293 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
295 /* Before executing instruction: restore necessary bits in EFLAGS. */
296 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
297 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
298 "movl %"_sav",%"_LO32 _tmp"; " \
301 "movl %"_msk",%"_LO32 _tmp"; " \
302 "andl %"_LO32 _tmp",("_STK"); " \
304 "notl %"_LO32 _tmp"; " \
305 "andl %"_LO32 _tmp",("_STK"); " \
306 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
308 "orl %"_LO32 _tmp",("_STK"); " \
312 /* After executing instruction: write-back necessary bits in EFLAGS. */
313 #define _POST_EFLAGS(_sav, _msk, _tmp) \
314 /* _sav |= EFLAGS & _msk; */ \
317 "andl %"_msk",%"_LO32 _tmp"; " \
318 "orl %"_LO32 _tmp",%"_sav"; "
320 /* Raw emulation: instruction has two explicit operands. */
321 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
323 unsigned long _tmp; \
325 switch ((_dst).bytes) { \
327 __asm__ __volatile__ ( \
328 _PRE_EFLAGS("0", "4", "2") \
329 _op"w %"_wx"3,%1; " \
330 _POST_EFLAGS("0", "4", "2") \
331 : "=m" (_eflags), "=m" ((_dst).val), \
333 : _wy ((_src).val), "i" (EFLAGS_MASK)); \
336 __asm__ __volatile__ ( \
337 _PRE_EFLAGS("0", "4", "2") \
338 _op"l %"_lx"3,%1; " \
339 _POST_EFLAGS("0", "4", "2") \
340 : "=m" (_eflags), "=m" ((_dst).val), \
342 : _ly ((_src).val), "i" (EFLAGS_MASK)); \
345 __emulate_2op_8byte(_op, _src, _dst, \
346 _eflags, _qx, _qy); \
351 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
353 unsigned long _tmp; \
354 switch ((_dst).bytes) { \
356 __asm__ __volatile__ ( \
357 _PRE_EFLAGS("0", "4", "2") \
358 _op"b %"_bx"3,%1; " \
359 _POST_EFLAGS("0", "4", "2") \
360 : "=m" (_eflags), "=m" ((_dst).val), \
362 : _by ((_src).val), "i" (EFLAGS_MASK)); \
365 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
366 _wx, _wy, _lx, _ly, _qx, _qy); \
371 /* Source operand is byte-sized and may be restricted to just %cl. */
372 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
373 __emulate_2op(_op, _src, _dst, _eflags, \
374 "b", "c", "b", "c", "b", "c", "b", "c")
376 /* Source operand is byte, word, long or quad sized. */
377 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
378 __emulate_2op(_op, _src, _dst, _eflags, \
379 "b", "q", "w", "r", _LO32, "r", "", "r")
381 /* Source operand is word, long or quad sized. */
382 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
383 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
384 "w", "r", _LO32, "r", "", "r")
386 /* Instruction has only one explicit operand (no source operand). */
387 #define emulate_1op(_op, _dst, _eflags) \
389 unsigned long _tmp; \
391 switch ((_dst).bytes) { \
393 __asm__ __volatile__ ( \
394 _PRE_EFLAGS("0", "3", "2") \
396 _POST_EFLAGS("0", "3", "2") \
397 : "=m" (_eflags), "=m" ((_dst).val), \
399 : "i" (EFLAGS_MASK)); \
402 __asm__ __volatile__ ( \
403 _PRE_EFLAGS("0", "3", "2") \
405 _POST_EFLAGS("0", "3", "2") \
406 : "=m" (_eflags), "=m" ((_dst).val), \
408 : "i" (EFLAGS_MASK)); \
411 __asm__ __volatile__ ( \
412 _PRE_EFLAGS("0", "3", "2") \
414 _POST_EFLAGS("0", "3", "2") \
415 : "=m" (_eflags), "=m" ((_dst).val), \
417 : "i" (EFLAGS_MASK)); \
420 __emulate_1op_8byte(_op, _dst, _eflags); \
425 /* Emulate an instruction with quadword operands (x86/64 only). */
426 #if defined(CONFIG_X86_64)
427 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
429 __asm__ __volatile__ ( \
430 _PRE_EFLAGS("0", "4", "2") \
431 _op"q %"_qx"3,%1; " \
432 _POST_EFLAGS("0", "4", "2") \
433 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
434 : _qy ((_src).val), "i" (EFLAGS_MASK)); \
437 #define __emulate_1op_8byte(_op, _dst, _eflags) \
439 __asm__ __volatile__ ( \
440 _PRE_EFLAGS("0", "3", "2") \
442 _POST_EFLAGS("0", "3", "2") \
443 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
444 : "i" (EFLAGS_MASK)); \
447 #elif defined(__i386__)
448 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
449 #define __emulate_1op_8byte(_op, _dst, _eflags)
450 #endif /* __i386__ */
452 /* Fetch next part of the instruction being emulated. */
453 #define insn_fetch(_type, _size, _eip) \
454 ({ unsigned long _x; \
455 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
462 /* Access/update address held in a register, based on addressing mode. */
463 #define address_mask(reg) \
464 ((c->ad_bytes == sizeof(unsigned long)) ? \
465 (reg) : ((reg) & ((1UL << (c->ad_bytes << 3)) - 1)))
466 #define register_address(base, reg) \
467 ((base) + address_mask(reg))
468 #define register_address_increment(reg, inc) \
470 /* signed type ensures sign extension to long */ \
472 if (c->ad_bytes == sizeof(unsigned long)) \
476 ~((1UL << (c->ad_bytes << 3)) - 1)) | \
478 ((1UL << (c->ad_bytes << 3)) - 1)); \
481 #define JMP_REL(rel) \
483 register_address_increment(c->eip, rel); \
486 static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
487 struct x86_emulate_ops *ops,
488 unsigned long linear, u8 *dest)
490 struct fetch_cache *fc = &ctxt->decode.fetch;
494 if (linear < fc->start || linear >= fc->end) {
495 size = min(15UL, PAGE_SIZE - offset_in_page(linear));
496 rc = ops->read_std(linear, fc->data, size, ctxt->vcpu);
500 fc->end = linear + size;
502 *dest = fc->data[linear - fc->start];
506 static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
507 struct x86_emulate_ops *ops,
508 unsigned long eip, void *dest, unsigned size)
512 eip += ctxt->cs_base;
514 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
522 * Given the 'reg' portion of a ModRM byte, and a register block, return a
523 * pointer into the block that addresses the relevant register.
524 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
526 static void *decode_register(u8 modrm_reg, unsigned long *regs,
531 p = ®s[modrm_reg];
532 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
533 p = (unsigned char *)®s[modrm_reg & 3] + 1;
537 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
538 struct x86_emulate_ops *ops,
540 u16 *size, unsigned long *address, int op_bytes)
547 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
551 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
556 static int test_cc(unsigned int condition, unsigned int flags)
560 switch ((condition & 15) >> 1) {
562 rc |= (flags & EFLG_OF);
564 case 1: /* b/c/nae */
565 rc |= (flags & EFLG_CF);
568 rc |= (flags & EFLG_ZF);
571 rc |= (flags & (EFLG_CF|EFLG_ZF));
574 rc |= (flags & EFLG_SF);
577 rc |= (flags & EFLG_PF);
580 rc |= (flags & EFLG_ZF);
583 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
587 /* Odd condition identifiers (lsb == 1) have inverted sense. */
588 return (!!rc ^ (condition & 1));
591 static void decode_register_operand(struct operand *op,
592 struct decode_cache *c,
595 unsigned reg = c->modrm_reg;
596 int highbyte_regs = c->rex_prefix == 0;
599 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
601 if ((c->d & ByteOp) && !inhibit_bytereg) {
602 op->ptr = decode_register(reg, c->regs, highbyte_regs);
603 op->val = *(u8 *)op->ptr;
606 op->ptr = decode_register(reg, c->regs, 0);
607 op->bytes = c->op_bytes;
610 op->val = *(u16 *)op->ptr;
613 op->val = *(u32 *)op->ptr;
616 op->val = *(u64 *) op->ptr;
620 op->orig_val = op->val;
623 static int decode_modrm(struct x86_emulate_ctxt *ctxt,
624 struct x86_emulate_ops *ops)
626 struct decode_cache *c = &ctxt->decode;
628 int index_reg = 0, base_reg = 0, scale, rip_relative = 0;
632 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
633 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
634 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
637 c->modrm = insn_fetch(u8, 1, c->eip);
638 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
639 c->modrm_reg |= (c->modrm & 0x38) >> 3;
640 c->modrm_rm |= (c->modrm & 0x07);
644 if (c->modrm_mod == 3) {
645 c->modrm_val = *(unsigned long *)
646 decode_register(c->modrm_rm, c->regs, c->d & ByteOp);
650 if (c->ad_bytes == 2) {
651 unsigned bx = c->regs[VCPU_REGS_RBX];
652 unsigned bp = c->regs[VCPU_REGS_RBP];
653 unsigned si = c->regs[VCPU_REGS_RSI];
654 unsigned di = c->regs[VCPU_REGS_RDI];
656 /* 16-bit ModR/M decode. */
657 switch (c->modrm_mod) {
659 if (c->modrm_rm == 6)
660 c->modrm_ea += insn_fetch(u16, 2, c->eip);
663 c->modrm_ea += insn_fetch(s8, 1, c->eip);
666 c->modrm_ea += insn_fetch(u16, 2, c->eip);
669 switch (c->modrm_rm) {
671 c->modrm_ea += bx + si;
674 c->modrm_ea += bx + di;
677 c->modrm_ea += bp + si;
680 c->modrm_ea += bp + di;
689 if (c->modrm_mod != 0)
696 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
697 (c->modrm_rm == 6 && c->modrm_mod != 0))
698 if (!c->override_base)
699 c->override_base = &ctxt->ss_base;
700 c->modrm_ea = (u16)c->modrm_ea;
702 /* 32/64-bit ModR/M decode. */
703 switch (c->modrm_rm) {
706 sib = insn_fetch(u8, 1, c->eip);
707 index_reg |= (sib >> 3) & 7;
713 if (c->modrm_mod != 0)
714 c->modrm_ea += c->regs[base_reg];
717 insn_fetch(s32, 4, c->eip);
720 c->modrm_ea += c->regs[base_reg];
726 c->modrm_ea += c->regs[index_reg] << scale;
730 if (c->modrm_mod != 0)
731 c->modrm_ea += c->regs[c->modrm_rm];
732 else if (ctxt->mode == X86EMUL_MODE_PROT64)
736 c->modrm_ea += c->regs[c->modrm_rm];
739 switch (c->modrm_mod) {
741 if (c->modrm_rm == 5)
742 c->modrm_ea += insn_fetch(s32, 4, c->eip);
745 c->modrm_ea += insn_fetch(s8, 1, c->eip);
748 c->modrm_ea += insn_fetch(s32, 4, c->eip);
753 c->modrm_ea += c->eip;
754 switch (c->d & SrcMask) {
762 if (c->op_bytes == 8)
765 c->modrm_ea += c->op_bytes;
772 static int decode_abs(struct x86_emulate_ctxt *ctxt,
773 struct x86_emulate_ops *ops)
775 struct decode_cache *c = &ctxt->decode;
778 switch (c->ad_bytes) {
780 c->modrm_ea = insn_fetch(u16, 2, c->eip);
783 c->modrm_ea = insn_fetch(u32, 4, c->eip);
786 c->modrm_ea = insn_fetch(u64, 8, c->eip);
794 x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
796 struct decode_cache *c = &ctxt->decode;
798 int mode = ctxt->mode;
799 int def_op_bytes, def_ad_bytes, group;
801 /* Shadow copy of register state. Committed on successful emulation. */
803 memset(c, 0, sizeof(struct decode_cache));
804 c->eip = ctxt->vcpu->arch.rip;
805 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
808 case X86EMUL_MODE_REAL:
809 case X86EMUL_MODE_PROT16:
810 def_op_bytes = def_ad_bytes = 2;
812 case X86EMUL_MODE_PROT32:
813 def_op_bytes = def_ad_bytes = 4;
816 case X86EMUL_MODE_PROT64:
825 c->op_bytes = def_op_bytes;
826 c->ad_bytes = def_ad_bytes;
828 /* Legacy prefixes. */
830 switch (c->b = insn_fetch(u8, 1, c->eip)) {
831 case 0x66: /* operand-size override */
832 /* switch between 2/4 bytes */
833 c->op_bytes = def_op_bytes ^ 6;
835 case 0x67: /* address-size override */
836 if (mode == X86EMUL_MODE_PROT64)
837 /* switch between 4/8 bytes */
838 c->ad_bytes = def_ad_bytes ^ 12;
840 /* switch between 2/4 bytes */
841 c->ad_bytes = def_ad_bytes ^ 6;
843 case 0x2e: /* CS override */
844 c->override_base = &ctxt->cs_base;
846 case 0x3e: /* DS override */
847 c->override_base = &ctxt->ds_base;
849 case 0x26: /* ES override */
850 c->override_base = &ctxt->es_base;
852 case 0x64: /* FS override */
853 c->override_base = &ctxt->fs_base;
855 case 0x65: /* GS override */
856 c->override_base = &ctxt->gs_base;
858 case 0x36: /* SS override */
859 c->override_base = &ctxt->ss_base;
861 case 0x40 ... 0x4f: /* REX */
862 if (mode != X86EMUL_MODE_PROT64)
864 c->rex_prefix = c->b;
866 case 0xf0: /* LOCK */
869 case 0xf2: /* REPNE/REPNZ */
870 c->rep_prefix = REPNE_PREFIX;
872 case 0xf3: /* REP/REPE/REPZ */
873 c->rep_prefix = REPE_PREFIX;
879 /* Any legacy prefix after a REX prefix nullifies its effect. */
888 if (c->rex_prefix & 8)
889 c->op_bytes = 8; /* REX.W */
891 /* Opcode byte(s). */
892 c->d = opcode_table[c->b];
894 /* Two-byte opcode? */
897 c->b = insn_fetch(u8, 1, c->eip);
898 c->d = twobyte_table[c->b];
903 group = c->d & GroupMask;
904 c->modrm = insn_fetch(u8, 1, c->eip);
907 group = (group << 3) + ((c->modrm >> 3) & 7);
908 if ((c->d & GroupDual) && (c->modrm >> 6) == 3)
909 c->d = group2_table[group];
911 c->d = group_table[group];
916 DPRINTF("Cannot emulate %02x\n", c->b);
920 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
923 /* ModRM and SIB bytes. */
925 rc = decode_modrm(ctxt, ops);
926 else if (c->d & MemAbs)
927 rc = decode_abs(ctxt, ops);
931 if (!c->override_base)
932 c->override_base = &ctxt->ds_base;
933 if (mode == X86EMUL_MODE_PROT64 &&
934 c->override_base != &ctxt->fs_base &&
935 c->override_base != &ctxt->gs_base)
936 c->override_base = NULL;
938 if (c->override_base)
939 c->modrm_ea += *c->override_base;
941 if (c->ad_bytes != 8)
942 c->modrm_ea = (u32)c->modrm_ea;
944 * Decode and fetch the source operand: register, memory
947 switch (c->d & SrcMask) {
951 decode_register_operand(&c->src, c, 0);
960 c->src.bytes = (c->d & ByteOp) ? 1 :
962 /* Don't fetch the address for invlpg: it could be unmapped. */
963 if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
967 * For instructions with a ModR/M byte, switch to register
970 if ((c->d & ModRM) && c->modrm_mod == 3) {
971 c->src.type = OP_REG;
974 c->src.type = OP_MEM;
977 c->src.type = OP_IMM;
978 c->src.ptr = (unsigned long *)c->eip;
979 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
980 if (c->src.bytes == 8)
982 /* NB. Immediates are sign-extended as necessary. */
983 switch (c->src.bytes) {
985 c->src.val = insn_fetch(s8, 1, c->eip);
988 c->src.val = insn_fetch(s16, 2, c->eip);
991 c->src.val = insn_fetch(s32, 4, c->eip);
996 c->src.type = OP_IMM;
997 c->src.ptr = (unsigned long *)c->eip;
999 c->src.val = insn_fetch(s8, 1, c->eip);
1003 /* Decode and fetch the destination operand: register or memory. */
1004 switch (c->d & DstMask) {
1006 /* Special instructions do their own operand decoding. */
1009 decode_register_operand(&c->dst, c,
1010 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
1013 if ((c->d & ModRM) && c->modrm_mod == 3) {
1014 c->dst.type = OP_REG;
1017 c->dst.type = OP_MEM;
1022 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1025 static inline void emulate_push(struct x86_emulate_ctxt *ctxt)
1027 struct decode_cache *c = &ctxt->decode;
1029 c->dst.type = OP_MEM;
1030 c->dst.bytes = c->op_bytes;
1031 c->dst.val = c->src.val;
1032 register_address_increment(c->regs[VCPU_REGS_RSP], -c->op_bytes);
1033 c->dst.ptr = (void *) register_address(ctxt->ss_base,
1034 c->regs[VCPU_REGS_RSP]);
1037 static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
1038 struct x86_emulate_ops *ops)
1040 struct decode_cache *c = &ctxt->decode;
1043 rc = ops->read_std(register_address(ctxt->ss_base,
1044 c->regs[VCPU_REGS_RSP]),
1045 &c->dst.val, c->dst.bytes, ctxt->vcpu);
1049 register_address_increment(c->regs[VCPU_REGS_RSP], c->dst.bytes);
1054 static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
1056 struct decode_cache *c = &ctxt->decode;
1057 switch (c->modrm_reg) {
1059 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
1062 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
1065 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
1068 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
1070 case 4: /* sal/shl */
1071 case 6: /* sal/shl */
1072 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
1075 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
1078 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
1083 static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
1084 struct x86_emulate_ops *ops)
1086 struct decode_cache *c = &ctxt->decode;
1089 switch (c->modrm_reg) {
1090 case 0 ... 1: /* test */
1091 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1094 c->dst.val = ~c->dst.val;
1097 emulate_1op("neg", c->dst, ctxt->eflags);
1100 DPRINTF("Cannot emulate %02x\n", c->b);
1101 rc = X86EMUL_UNHANDLEABLE;
1107 static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
1108 struct x86_emulate_ops *ops)
1110 struct decode_cache *c = &ctxt->decode;
1112 switch (c->modrm_reg) {
1114 emulate_1op("inc", c->dst, ctxt->eflags);
1117 emulate_1op("dec", c->dst, ctxt->eflags);
1119 case 4: /* jmp abs */
1120 c->eip = c->src.val;
1129 static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
1130 struct x86_emulate_ops *ops,
1131 unsigned long memop)
1133 struct decode_cache *c = &ctxt->decode;
1137 rc = ops->read_emulated(memop, &old, 8, ctxt->vcpu);
1141 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1142 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
1144 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1145 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1146 ctxt->eflags &= ~EFLG_ZF;
1149 new = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1150 (u32) c->regs[VCPU_REGS_RBX];
1152 rc = ops->cmpxchg_emulated(memop, &old, &new, 8, ctxt->vcpu);
1155 ctxt->eflags |= EFLG_ZF;
1160 static inline int writeback(struct x86_emulate_ctxt *ctxt,
1161 struct x86_emulate_ops *ops)
1164 struct decode_cache *c = &ctxt->decode;
1166 switch (c->dst.type) {
1168 /* The 4-byte case *is* correct:
1169 * in 64-bit mode we zero-extend.
1171 switch (c->dst.bytes) {
1173 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1176 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1179 *c->dst.ptr = (u32)c->dst.val;
1180 break; /* 64b: zero-ext */
1182 *c->dst.ptr = c->dst.val;
1188 rc = ops->cmpxchg_emulated(
1189 (unsigned long)c->dst.ptr,
1195 rc = ops->write_emulated(
1196 (unsigned long)c->dst.ptr,
1213 x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1215 unsigned long memop = 0;
1217 unsigned long saved_eip = 0;
1218 struct decode_cache *c = &ctxt->decode;
1221 /* Shadow copy of register state. Committed on successful emulation.
1222 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
1226 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
1229 if (((c->d & ModRM) && (c->modrm_mod != 3)) || (c->d & MemAbs))
1230 memop = c->modrm_ea;
1232 if (c->rep_prefix && (c->d & String)) {
1233 /* All REP prefixes have the same first termination condition */
1234 if (c->regs[VCPU_REGS_RCX] == 0) {
1235 ctxt->vcpu->arch.rip = c->eip;
1238 /* The second termination condition only applies for REPE
1239 * and REPNE. Test if the repeat string operation prefix is
1240 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
1241 * corresponding termination condition according to:
1242 * - if REPE/REPZ and ZF = 0 then done
1243 * - if REPNE/REPNZ and ZF = 1 then done
1245 if ((c->b == 0xa6) || (c->b == 0xa7) ||
1246 (c->b == 0xae) || (c->b == 0xaf)) {
1247 if ((c->rep_prefix == REPE_PREFIX) &&
1248 ((ctxt->eflags & EFLG_ZF) == 0)) {
1249 ctxt->vcpu->arch.rip = c->eip;
1252 if ((c->rep_prefix == REPNE_PREFIX) &&
1253 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF)) {
1254 ctxt->vcpu->arch.rip = c->eip;
1258 c->regs[VCPU_REGS_RCX]--;
1259 c->eip = ctxt->vcpu->arch.rip;
1262 if (c->src.type == OP_MEM) {
1263 c->src.ptr = (unsigned long *)memop;
1265 rc = ops->read_emulated((unsigned long)c->src.ptr,
1271 c->src.orig_val = c->src.val;
1274 if ((c->d & DstMask) == ImplicitOps)
1278 if (c->dst.type == OP_MEM) {
1279 c->dst.ptr = (unsigned long *)memop;
1280 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1283 unsigned long mask = ~(c->dst.bytes * 8 - 1);
1285 c->dst.ptr = (void *)c->dst.ptr +
1286 (c->src.val & mask) / 8;
1288 if (!(c->d & Mov) &&
1289 /* optimisation - avoid slow emulated read */
1290 ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1292 c->dst.bytes, ctxt->vcpu)) != 0))
1295 c->dst.orig_val = c->dst.val;
1305 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
1309 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
1313 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
1317 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
1321 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
1323 case 0x24: /* and al imm8 */
1324 c->dst.type = OP_REG;
1325 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1326 c->dst.val = *(u8 *)c->dst.ptr;
1328 c->dst.orig_val = c->dst.val;
1330 case 0x25: /* and ax imm16, or eax imm32 */
1331 c->dst.type = OP_REG;
1332 c->dst.bytes = c->op_bytes;
1333 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1334 if (c->op_bytes == 2)
1335 c->dst.val = *(u16 *)c->dst.ptr;
1337 c->dst.val = *(u32 *)c->dst.ptr;
1338 c->dst.orig_val = c->dst.val;
1342 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
1346 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
1350 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1352 case 0x40 ... 0x47: /* inc r16/r32 */
1353 emulate_1op("inc", c->dst, ctxt->eflags);
1355 case 0x48 ... 0x4f: /* dec r16/r32 */
1356 emulate_1op("dec", c->dst, ctxt->eflags);
1358 case 0x50 ... 0x57: /* push reg */
1359 c->dst.type = OP_MEM;
1360 c->dst.bytes = c->op_bytes;
1361 c->dst.val = c->src.val;
1362 register_address_increment(c->regs[VCPU_REGS_RSP],
1364 c->dst.ptr = (void *) register_address(
1365 ctxt->ss_base, c->regs[VCPU_REGS_RSP]);
1367 case 0x58 ... 0x5f: /* pop reg */
1369 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1370 c->regs[VCPU_REGS_RSP]), c->dst.ptr,
1371 c->op_bytes, ctxt->vcpu)) != 0)
1374 register_address_increment(c->regs[VCPU_REGS_RSP],
1376 c->dst.type = OP_NONE; /* Disable writeback. */
1378 case 0x63: /* movsxd */
1379 if (ctxt->mode != X86EMUL_MODE_PROT64)
1380 goto cannot_emulate;
1381 c->dst.val = (s32) c->src.val;
1383 case 0x6a: /* push imm8 */
1385 c->src.val = insn_fetch(s8, 1, c->eip);
1388 case 0x6c: /* insb */
1389 case 0x6d: /* insw/insd */
1390 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1392 (c->d & ByteOp) ? 1 : c->op_bytes,
1394 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1395 (ctxt->eflags & EFLG_DF),
1396 register_address(ctxt->es_base,
1397 c->regs[VCPU_REGS_RDI]),
1399 c->regs[VCPU_REGS_RDX]) == 0) {
1404 case 0x6e: /* outsb */
1405 case 0x6f: /* outsw/outsd */
1406 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1408 (c->d & ByteOp) ? 1 : c->op_bytes,
1410 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1411 (ctxt->eflags & EFLG_DF),
1412 register_address(c->override_base ?
1415 c->regs[VCPU_REGS_RSI]),
1417 c->regs[VCPU_REGS_RDX]) == 0) {
1422 case 0x70 ... 0x7f: /* jcc (short) */ {
1423 int rel = insn_fetch(s8, 1, c->eip);
1425 if (test_cc(c->b, ctxt->eflags))
1429 case 0x80 ... 0x83: /* Grp1 */
1430 switch (c->modrm_reg) {
1450 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1452 case 0x86 ... 0x87: /* xchg */
1453 /* Write back the register source. */
1454 switch (c->dst.bytes) {
1456 *(u8 *) c->src.ptr = (u8) c->dst.val;
1459 *(u16 *) c->src.ptr = (u16) c->dst.val;
1462 *c->src.ptr = (u32) c->dst.val;
1463 break; /* 64b reg: zero-extend */
1465 *c->src.ptr = c->dst.val;
1469 * Write back the memory destination with implicit LOCK
1472 c->dst.val = c->src.val;
1475 case 0x88 ... 0x8b: /* mov */
1477 case 0x8d: /* lea r16/r32, m */
1478 c->dst.val = c->modrm_val;
1480 case 0x8f: /* pop (sole member of Grp1a) */
1481 rc = emulate_grp1a(ctxt, ops);
1485 case 0x9c: /* pushf */
1486 c->src.val = (unsigned long) ctxt->eflags;
1489 case 0x9d: /* popf */
1490 c->dst.ptr = (unsigned long *) &ctxt->eflags;
1491 goto pop_instruction;
1492 case 0xa0 ... 0xa1: /* mov */
1493 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1494 c->dst.val = c->src.val;
1496 case 0xa2 ... 0xa3: /* mov */
1497 c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
1499 case 0xa4 ... 0xa5: /* movs */
1500 c->dst.type = OP_MEM;
1501 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1502 c->dst.ptr = (unsigned long *)register_address(
1504 c->regs[VCPU_REGS_RDI]);
1505 if ((rc = ops->read_emulated(register_address(
1506 c->override_base ? *c->override_base :
1508 c->regs[VCPU_REGS_RSI]),
1510 c->dst.bytes, ctxt->vcpu)) != 0)
1512 register_address_increment(c->regs[VCPU_REGS_RSI],
1513 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1515 register_address_increment(c->regs[VCPU_REGS_RDI],
1516 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1519 case 0xa6 ... 0xa7: /* cmps */
1520 c->src.type = OP_NONE; /* Disable writeback. */
1521 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1522 c->src.ptr = (unsigned long *)register_address(
1523 c->override_base ? *c->override_base :
1525 c->regs[VCPU_REGS_RSI]);
1526 if ((rc = ops->read_emulated((unsigned long)c->src.ptr,
1532 c->dst.type = OP_NONE; /* Disable writeback. */
1533 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1534 c->dst.ptr = (unsigned long *)register_address(
1536 c->regs[VCPU_REGS_RDI]);
1537 if ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1543 DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c->src.ptr, c->dst.ptr);
1545 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1547 register_address_increment(c->regs[VCPU_REGS_RSI],
1548 (ctxt->eflags & EFLG_DF) ? -c->src.bytes
1550 register_address_increment(c->regs[VCPU_REGS_RDI],
1551 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1555 case 0xaa ... 0xab: /* stos */
1556 c->dst.type = OP_MEM;
1557 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1558 c->dst.ptr = (unsigned long *)register_address(
1560 c->regs[VCPU_REGS_RDI]);
1561 c->dst.val = c->regs[VCPU_REGS_RAX];
1562 register_address_increment(c->regs[VCPU_REGS_RDI],
1563 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1566 case 0xac ... 0xad: /* lods */
1567 c->dst.type = OP_REG;
1568 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1569 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1570 if ((rc = ops->read_emulated(register_address(
1571 c->override_base ? *c->override_base :
1573 c->regs[VCPU_REGS_RSI]),
1578 register_address_increment(c->regs[VCPU_REGS_RSI],
1579 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1582 case 0xae ... 0xaf: /* scas */
1583 DPRINTF("Urk! I don't handle SCAS.\n");
1584 goto cannot_emulate;
1588 case 0xc3: /* ret */
1589 c->dst.ptr = &c->eip;
1590 goto pop_instruction;
1591 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1593 c->dst.val = c->src.val;
1595 case 0xd0 ... 0xd1: /* Grp2 */
1599 case 0xd2 ... 0xd3: /* Grp2 */
1600 c->src.val = c->regs[VCPU_REGS_RCX];
1603 case 0xe8: /* call (near) */ {
1605 switch (c->op_bytes) {
1607 rel = insn_fetch(s16, 2, c->eip);
1610 rel = insn_fetch(s32, 4, c->eip);
1613 DPRINTF("Call: Invalid op_bytes\n");
1614 goto cannot_emulate;
1616 c->src.val = (unsigned long) c->eip;
1618 c->op_bytes = c->ad_bytes;
1622 case 0xe9: /* jmp rel */
1623 case 0xeb: /* jmp rel short */
1624 JMP_REL(c->src.val);
1625 c->dst.type = OP_NONE; /* Disable writeback. */
1627 case 0xf4: /* hlt */
1628 ctxt->vcpu->arch.halt_request = 1;
1630 case 0xf5: /* cmc */
1631 /* complement carry flag from eflags reg */
1632 ctxt->eflags ^= EFLG_CF;
1633 c->dst.type = OP_NONE; /* Disable writeback. */
1635 case 0xf6 ... 0xf7: /* Grp3 */
1636 rc = emulate_grp3(ctxt, ops);
1640 case 0xf8: /* clc */
1641 ctxt->eflags &= ~EFLG_CF;
1642 c->dst.type = OP_NONE; /* Disable writeback. */
1644 case 0xfa: /* cli */
1645 ctxt->eflags &= ~X86_EFLAGS_IF;
1646 c->dst.type = OP_NONE; /* Disable writeback. */
1648 case 0xfb: /* sti */
1649 ctxt->eflags |= X86_EFLAGS_IF;
1650 c->dst.type = OP_NONE; /* Disable writeback. */
1652 case 0xfe ... 0xff: /* Grp4/Grp5 */
1653 rc = emulate_grp45(ctxt, ops);
1660 rc = writeback(ctxt, ops);
1664 /* Commit shadow register state. */
1665 memcpy(ctxt->vcpu->arch.regs, c->regs, sizeof c->regs);
1666 ctxt->vcpu->arch.rip = c->eip;
1669 if (rc == X86EMUL_UNHANDLEABLE) {
1677 case 0x01: /* lgdt, lidt, lmsw */
1678 switch (c->modrm_reg) {
1680 unsigned long address;
1682 case 0: /* vmcall */
1683 if (c->modrm_mod != 3 || c->modrm_rm != 1)
1684 goto cannot_emulate;
1686 rc = kvm_fix_hypercall(ctxt->vcpu);
1690 kvm_emulate_hypercall(ctxt->vcpu);
1693 rc = read_descriptor(ctxt, ops, c->src.ptr,
1694 &size, &address, c->op_bytes);
1697 realmode_lgdt(ctxt->vcpu, size, address);
1699 case 3: /* lidt/vmmcall */
1700 if (c->modrm_mod == 3 && c->modrm_rm == 1) {
1701 rc = kvm_fix_hypercall(ctxt->vcpu);
1704 kvm_emulate_hypercall(ctxt->vcpu);
1706 rc = read_descriptor(ctxt, ops, c->src.ptr,
1711 realmode_lidt(ctxt->vcpu, size, address);
1715 if (c->modrm_mod != 3)
1716 goto cannot_emulate;
1717 *(u16 *)&c->regs[c->modrm_rm]
1718 = realmode_get_cr(ctxt->vcpu, 0);
1721 if (c->modrm_mod != 3)
1722 goto cannot_emulate;
1723 realmode_lmsw(ctxt->vcpu, (u16)c->modrm_val,
1727 emulate_invlpg(ctxt->vcpu, memop);
1730 goto cannot_emulate;
1732 /* Disable writeback. */
1733 c->dst.type = OP_NONE;
1736 emulate_clts(ctxt->vcpu);
1737 c->dst.type = OP_NONE;
1739 case 0x08: /* invd */
1740 case 0x09: /* wbinvd */
1741 case 0x0d: /* GrpP (prefetch) */
1742 case 0x18: /* Grp16 (prefetch/nop) */
1743 c->dst.type = OP_NONE;
1745 case 0x20: /* mov cr, reg */
1746 if (c->modrm_mod != 3)
1747 goto cannot_emulate;
1748 c->regs[c->modrm_rm] =
1749 realmode_get_cr(ctxt->vcpu, c->modrm_reg);
1750 c->dst.type = OP_NONE; /* no writeback */
1752 case 0x21: /* mov from dr to reg */
1753 if (c->modrm_mod != 3)
1754 goto cannot_emulate;
1755 rc = emulator_get_dr(ctxt, c->modrm_reg, &c->regs[c->modrm_rm]);
1757 goto cannot_emulate;
1758 c->dst.type = OP_NONE; /* no writeback */
1760 case 0x22: /* mov reg, cr */
1761 if (c->modrm_mod != 3)
1762 goto cannot_emulate;
1763 realmode_set_cr(ctxt->vcpu,
1764 c->modrm_reg, c->modrm_val, &ctxt->eflags);
1765 c->dst.type = OP_NONE;
1767 case 0x23: /* mov from reg to dr */
1768 if (c->modrm_mod != 3)
1769 goto cannot_emulate;
1770 rc = emulator_set_dr(ctxt, c->modrm_reg,
1771 c->regs[c->modrm_rm]);
1773 goto cannot_emulate;
1774 c->dst.type = OP_NONE; /* no writeback */
1778 msr_data = (u32)c->regs[VCPU_REGS_RAX]
1779 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
1780 rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
1782 kvm_inject_gp(ctxt->vcpu, 0);
1783 c->eip = ctxt->vcpu->arch.rip;
1785 rc = X86EMUL_CONTINUE;
1786 c->dst.type = OP_NONE;
1790 rc = kvm_get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data);
1792 kvm_inject_gp(ctxt->vcpu, 0);
1793 c->eip = ctxt->vcpu->arch.rip;
1795 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
1796 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
1798 rc = X86EMUL_CONTINUE;
1799 c->dst.type = OP_NONE;
1801 case 0x40 ... 0x4f: /* cmov */
1802 c->dst.val = c->dst.orig_val = c->src.val;
1803 if (!test_cc(c->b, ctxt->eflags))
1804 c->dst.type = OP_NONE; /* no writeback */
1806 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1809 switch (c->op_bytes) {
1811 rel = insn_fetch(s16, 2, c->eip);
1814 rel = insn_fetch(s32, 4, c->eip);
1817 rel = insn_fetch(s64, 8, c->eip);
1820 DPRINTF("jnz: Invalid op_bytes\n");
1821 goto cannot_emulate;
1823 if (test_cc(c->b, ctxt->eflags))
1825 c->dst.type = OP_NONE;
1830 c->dst.type = OP_NONE;
1831 /* only subword offset */
1832 c->src.val &= (c->dst.bytes << 3) - 1;
1833 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
1837 /* only subword offset */
1838 c->src.val &= (c->dst.bytes << 3) - 1;
1839 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
1841 case 0xb0 ... 0xb1: /* cmpxchg */
1843 * Save real source value, then compare EAX against
1846 c->src.orig_val = c->src.val;
1847 c->src.val = c->regs[VCPU_REGS_RAX];
1848 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1849 if (ctxt->eflags & EFLG_ZF) {
1850 /* Success: write back to memory. */
1851 c->dst.val = c->src.orig_val;
1853 /* Failure: write the value we saw to EAX. */
1854 c->dst.type = OP_REG;
1855 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1860 /* only subword offset */
1861 c->src.val &= (c->dst.bytes << 3) - 1;
1862 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
1864 case 0xb6 ... 0xb7: /* movzx */
1865 c->dst.bytes = c->op_bytes;
1866 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
1869 case 0xba: /* Grp8 */
1870 switch (c->modrm_reg & 3) {
1883 /* only subword offset */
1884 c->src.val &= (c->dst.bytes << 3) - 1;
1885 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
1887 case 0xbe ... 0xbf: /* movsx */
1888 c->dst.bytes = c->op_bytes;
1889 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
1892 case 0xc3: /* movnti */
1893 c->dst.bytes = c->op_bytes;
1894 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
1897 case 0xc7: /* Grp9 (cmpxchg8b) */
1898 rc = emulate_grp9(ctxt, ops, memop);
1901 c->dst.type = OP_NONE;
1907 DPRINTF("Cannot emulate %02x\n", c->b);