1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf(_f , ## _a)
30 #define DPRINTF(x...) do {} while (0)
32 #include "x86_emulate.h"
33 #include <linux/module.h>
36 * Opcode effective-address decode tables.
37 * Note that we only emulate instructions that have at least one memory
38 * operand (excluding implicit stack references). We assume that stack
39 * references and instruction fetches will never occur in special memory
40 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
44 /* Operand sizes: 8-bit operands or specified/overridden size. */
45 #define ByteOp (1<<0) /* 8-bit operands. */
46 /* Destination operand type. */
47 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
48 #define DstReg (2<<1) /* Register operand. */
49 #define DstMem (3<<1) /* Memory operand. */
50 #define DstMask (3<<1)
51 /* Source operand type. */
52 #define SrcNone (0<<3) /* No source operand. */
53 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
54 #define SrcReg (1<<3) /* Register operand. */
55 #define SrcMem (2<<3) /* Memory operand. */
56 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
57 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
58 #define SrcImm (5<<3) /* Immediate operand. */
59 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
60 #define SrcMask (7<<3)
61 /* Generic ModRM decode. */
63 /* Destination is only written; never read. */
66 #define MemAbs (1<<9) /* Memory operand is absolute displacement */
68 static u16 opcode_table[256] = {
70 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
71 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
74 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
75 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
78 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
79 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
82 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
83 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
87 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
88 SrcImmByte, SrcImm, 0, 0,
90 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
91 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
94 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
95 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
98 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
99 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
102 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
104 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
106 SrcReg, SrcReg, SrcReg, SrcReg, SrcReg, SrcReg, SrcReg, SrcReg,
108 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
110 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
113 0, 0, ImplicitOps|Mov, 0,
114 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
115 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
117 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
118 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
120 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
121 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
123 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
124 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
125 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
126 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
128 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
129 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
130 0, ModRM | DstReg, 0, DstMem | SrcNone | ModRM | Mov,
132 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps, ImplicitOps, 0, 0,
134 ByteOp | DstReg | SrcMem | Mov | MemAbs, DstReg | SrcMem | Mov | MemAbs,
135 ByteOp | DstMem | SrcReg | Mov | MemAbs, DstMem | SrcReg | Mov | MemAbs,
136 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
137 ByteOp | ImplicitOps, ImplicitOps,
139 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
140 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
141 ByteOp | ImplicitOps, ImplicitOps,
143 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
145 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
146 0, ImplicitOps, 0, 0,
147 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
149 0, 0, 0, 0, 0, 0, 0, 0,
151 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
152 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
155 0, 0, 0, 0, 0, 0, 0, 0,
157 0, 0, 0, 0, 0, 0, 0, 0,
159 ImplicitOps, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps, 0, 0, 0, 0,
162 ImplicitOps, ImplicitOps,
163 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
165 ImplicitOps, 0, ImplicitOps, ImplicitOps,
166 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
169 static u16 twobyte_table[256] = {
171 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
172 ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
174 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
176 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
177 0, 0, 0, 0, 0, 0, 0, 0,
179 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
181 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
182 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
183 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
184 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
186 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
187 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
188 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
189 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
191 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
193 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
195 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
197 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
198 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
199 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
200 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
202 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
204 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
206 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
208 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
209 DstMem | SrcReg | ModRM | BitOp,
210 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
211 DstReg | SrcMem16 | ModRM | Mov,
213 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
214 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
215 DstReg | SrcMem16 | ModRM | Mov,
217 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
218 0, 0, 0, 0, 0, 0, 0, 0,
220 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
222 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
224 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
227 /* EFLAGS bit definitions. */
228 #define EFLG_OF (1<<11)
229 #define EFLG_DF (1<<10)
230 #define EFLG_SF (1<<7)
231 #define EFLG_ZF (1<<6)
232 #define EFLG_AF (1<<4)
233 #define EFLG_PF (1<<2)
234 #define EFLG_CF (1<<0)
237 * Instruction emulation:
238 * Most instructions are emulated directly via a fragment of inline assembly
239 * code. This allows us to save/restore EFLAGS and thus very easily pick up
240 * any modified flags.
243 #if defined(CONFIG_X86_64)
244 #define _LO32 "k" /* force 32-bit operand */
245 #define _STK "%%rsp" /* stack pointer */
246 #elif defined(__i386__)
247 #define _LO32 "" /* force 32-bit operand */
248 #define _STK "%%esp" /* stack pointer */
252 * These EFLAGS bits are restored from saved value during emulation, and
253 * any changes are written back to the saved value after emulation.
255 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
257 /* Before executing instruction: restore necessary bits in EFLAGS. */
258 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
259 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
261 "movl %"_msk",%"_LO32 _tmp"; " \
262 "andl %"_LO32 _tmp",("_STK"); " \
264 "notl %"_LO32 _tmp"; " \
265 "andl %"_LO32 _tmp",("_STK"); " \
267 "orl %"_LO32 _tmp",("_STK"); " \
269 /* _sav &= ~msk; */ \
270 "movl %"_msk",%"_LO32 _tmp"; " \
271 "notl %"_LO32 _tmp"; " \
272 "andl %"_LO32 _tmp",%"_sav"; "
274 /* After executing instruction: write-back necessary bits in EFLAGS. */
275 #define _POST_EFLAGS(_sav, _msk, _tmp) \
276 /* _sav |= EFLAGS & _msk; */ \
279 "andl %"_msk",%"_LO32 _tmp"; " \
280 "orl %"_LO32 _tmp",%"_sav"; "
282 /* Raw emulation: instruction has two explicit operands. */
283 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
285 unsigned long _tmp; \
287 switch ((_dst).bytes) { \
289 __asm__ __volatile__ ( \
290 _PRE_EFLAGS("0", "4", "2") \
291 _op"w %"_wx"3,%1; " \
292 _POST_EFLAGS("0", "4", "2") \
293 : "=m" (_eflags), "=m" ((_dst).val), \
295 : _wy ((_src).val), "i" (EFLAGS_MASK)); \
298 __asm__ __volatile__ ( \
299 _PRE_EFLAGS("0", "4", "2") \
300 _op"l %"_lx"3,%1; " \
301 _POST_EFLAGS("0", "4", "2") \
302 : "=m" (_eflags), "=m" ((_dst).val), \
304 : _ly ((_src).val), "i" (EFLAGS_MASK)); \
307 __emulate_2op_8byte(_op, _src, _dst, \
308 _eflags, _qx, _qy); \
313 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
315 unsigned long _tmp; \
316 switch ((_dst).bytes) { \
318 __asm__ __volatile__ ( \
319 _PRE_EFLAGS("0", "4", "2") \
320 _op"b %"_bx"3,%1; " \
321 _POST_EFLAGS("0", "4", "2") \
322 : "=m" (_eflags), "=m" ((_dst).val), \
324 : _by ((_src).val), "i" (EFLAGS_MASK)); \
327 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
328 _wx, _wy, _lx, _ly, _qx, _qy); \
333 /* Source operand is byte-sized and may be restricted to just %cl. */
334 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
335 __emulate_2op(_op, _src, _dst, _eflags, \
336 "b", "c", "b", "c", "b", "c", "b", "c")
338 /* Source operand is byte, word, long or quad sized. */
339 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
340 __emulate_2op(_op, _src, _dst, _eflags, \
341 "b", "q", "w", "r", _LO32, "r", "", "r")
343 /* Source operand is word, long or quad sized. */
344 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
345 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
346 "w", "r", _LO32, "r", "", "r")
348 /* Instruction has only one explicit operand (no source operand). */
349 #define emulate_1op(_op, _dst, _eflags) \
351 unsigned long _tmp; \
353 switch ((_dst).bytes) { \
355 __asm__ __volatile__ ( \
356 _PRE_EFLAGS("0", "3", "2") \
358 _POST_EFLAGS("0", "3", "2") \
359 : "=m" (_eflags), "=m" ((_dst).val), \
361 : "i" (EFLAGS_MASK)); \
364 __asm__ __volatile__ ( \
365 _PRE_EFLAGS("0", "3", "2") \
367 _POST_EFLAGS("0", "3", "2") \
368 : "=m" (_eflags), "=m" ((_dst).val), \
370 : "i" (EFLAGS_MASK)); \
373 __asm__ __volatile__ ( \
374 _PRE_EFLAGS("0", "3", "2") \
376 _POST_EFLAGS("0", "3", "2") \
377 : "=m" (_eflags), "=m" ((_dst).val), \
379 : "i" (EFLAGS_MASK)); \
382 __emulate_1op_8byte(_op, _dst, _eflags); \
387 /* Emulate an instruction with quadword operands (x86/64 only). */
388 #if defined(CONFIG_X86_64)
389 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
391 __asm__ __volatile__ ( \
392 _PRE_EFLAGS("0", "4", "2") \
393 _op"q %"_qx"3,%1; " \
394 _POST_EFLAGS("0", "4", "2") \
395 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
396 : _qy ((_src).val), "i" (EFLAGS_MASK)); \
399 #define __emulate_1op_8byte(_op, _dst, _eflags) \
401 __asm__ __volatile__ ( \
402 _PRE_EFLAGS("0", "3", "2") \
404 _POST_EFLAGS("0", "3", "2") \
405 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
406 : "i" (EFLAGS_MASK)); \
409 #elif defined(__i386__)
410 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
411 #define __emulate_1op_8byte(_op, _dst, _eflags)
412 #endif /* __i386__ */
414 /* Fetch next part of the instruction being emulated. */
415 #define insn_fetch(_type, _size, _eip) \
416 ({ unsigned long _x; \
417 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
424 /* Access/update address held in a register, based on addressing mode. */
425 #define address_mask(reg) \
426 ((c->ad_bytes == sizeof(unsigned long)) ? \
427 (reg) : ((reg) & ((1UL << (c->ad_bytes << 3)) - 1)))
428 #define register_address(base, reg) \
429 ((base) + address_mask(reg))
430 #define register_address_increment(reg, inc) \
432 /* signed type ensures sign extension to long */ \
434 if (c->ad_bytes == sizeof(unsigned long)) \
438 ~((1UL << (c->ad_bytes << 3)) - 1)) | \
440 ((1UL << (c->ad_bytes << 3)) - 1)); \
443 #define JMP_REL(rel) \
445 register_address_increment(c->eip, rel); \
448 static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
449 struct x86_emulate_ops *ops,
450 unsigned long linear, u8 *dest)
452 struct fetch_cache *fc = &ctxt->decode.fetch;
456 if (linear < fc->start || linear >= fc->end) {
457 size = min(15UL, PAGE_SIZE - offset_in_page(linear));
458 rc = ops->read_std(linear, fc->data, size, ctxt->vcpu);
462 fc->end = linear + size;
464 *dest = fc->data[linear - fc->start];
468 static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
469 struct x86_emulate_ops *ops,
470 unsigned long eip, void *dest, unsigned size)
474 eip += ctxt->cs_base;
476 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
484 * Given the 'reg' portion of a ModRM byte, and a register block, return a
485 * pointer into the block that addresses the relevant register.
486 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
488 static void *decode_register(u8 modrm_reg, unsigned long *regs,
493 p = ®s[modrm_reg];
494 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
495 p = (unsigned char *)®s[modrm_reg & 3] + 1;
499 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
500 struct x86_emulate_ops *ops,
502 u16 *size, unsigned long *address, int op_bytes)
509 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
513 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
518 static int test_cc(unsigned int condition, unsigned int flags)
522 switch ((condition & 15) >> 1) {
524 rc |= (flags & EFLG_OF);
526 case 1: /* b/c/nae */
527 rc |= (flags & EFLG_CF);
530 rc |= (flags & EFLG_ZF);
533 rc |= (flags & (EFLG_CF|EFLG_ZF));
536 rc |= (flags & EFLG_SF);
539 rc |= (flags & EFLG_PF);
542 rc |= (flags & EFLG_ZF);
545 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
549 /* Odd condition identifiers (lsb == 1) have inverted sense. */
550 return (!!rc ^ (condition & 1));
553 static void decode_register_operand(struct operand *op,
554 struct decode_cache *c,
557 unsigned reg = c->modrm_reg;
558 int highbyte_regs = c->rex_prefix == 0;
561 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
563 if ((c->d & ByteOp) && !inhibit_bytereg) {
564 op->ptr = decode_register(reg, c->regs, highbyte_regs);
565 op->val = *(u8 *)op->ptr;
568 op->ptr = decode_register(reg, c->regs, 0);
569 op->bytes = c->op_bytes;
572 op->val = *(u16 *)op->ptr;
575 op->val = *(u32 *)op->ptr;
578 op->val = *(u64 *) op->ptr;
582 op->orig_val = op->val;
585 static int decode_modrm(struct x86_emulate_ctxt *ctxt,
586 struct x86_emulate_ops *ops)
588 struct decode_cache *c = &ctxt->decode;
590 int index_reg = 0, base_reg = 0, scale, rip_relative = 0;
594 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
595 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
596 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
599 c->modrm = insn_fetch(u8, 1, c->eip);
600 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
601 c->modrm_reg |= (c->modrm & 0x38) >> 3;
602 c->modrm_rm |= (c->modrm & 0x07);
606 if (c->modrm_mod == 3) {
607 c->modrm_val = *(unsigned long *)
608 decode_register(c->modrm_rm, c->regs, c->d & ByteOp);
612 if (c->ad_bytes == 2) {
613 unsigned bx = c->regs[VCPU_REGS_RBX];
614 unsigned bp = c->regs[VCPU_REGS_RBP];
615 unsigned si = c->regs[VCPU_REGS_RSI];
616 unsigned di = c->regs[VCPU_REGS_RDI];
618 /* 16-bit ModR/M decode. */
619 switch (c->modrm_mod) {
621 if (c->modrm_rm == 6)
622 c->modrm_ea += insn_fetch(u16, 2, c->eip);
625 c->modrm_ea += insn_fetch(s8, 1, c->eip);
628 c->modrm_ea += insn_fetch(u16, 2, c->eip);
631 switch (c->modrm_rm) {
633 c->modrm_ea += bx + si;
636 c->modrm_ea += bx + di;
639 c->modrm_ea += bp + si;
642 c->modrm_ea += bp + di;
651 if (c->modrm_mod != 0)
658 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
659 (c->modrm_rm == 6 && c->modrm_mod != 0))
660 if (!c->override_base)
661 c->override_base = &ctxt->ss_base;
662 c->modrm_ea = (u16)c->modrm_ea;
664 /* 32/64-bit ModR/M decode. */
665 switch (c->modrm_rm) {
668 sib = insn_fetch(u8, 1, c->eip);
669 index_reg |= (sib >> 3) & 7;
675 if (c->modrm_mod != 0)
676 c->modrm_ea += c->regs[base_reg];
679 insn_fetch(s32, 4, c->eip);
682 c->modrm_ea += c->regs[base_reg];
688 c->modrm_ea += c->regs[index_reg] << scale;
692 if (c->modrm_mod != 0)
693 c->modrm_ea += c->regs[c->modrm_rm];
694 else if (ctxt->mode == X86EMUL_MODE_PROT64)
698 c->modrm_ea += c->regs[c->modrm_rm];
701 switch (c->modrm_mod) {
703 if (c->modrm_rm == 5)
704 c->modrm_ea += insn_fetch(s32, 4, c->eip);
707 c->modrm_ea += insn_fetch(s8, 1, c->eip);
710 c->modrm_ea += insn_fetch(s32, 4, c->eip);
715 c->modrm_ea += c->eip;
716 switch (c->d & SrcMask) {
724 if (c->op_bytes == 8)
727 c->modrm_ea += c->op_bytes;
734 static int decode_abs(struct x86_emulate_ctxt *ctxt,
735 struct x86_emulate_ops *ops)
737 struct decode_cache *c = &ctxt->decode;
740 switch (c->ad_bytes) {
742 c->modrm_ea = insn_fetch(u16, 2, c->eip);
745 c->modrm_ea = insn_fetch(u32, 4, c->eip);
748 c->modrm_ea = insn_fetch(u64, 8, c->eip);
756 x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
758 struct decode_cache *c = &ctxt->decode;
760 int mode = ctxt->mode;
761 int def_op_bytes, def_ad_bytes;
763 /* Shadow copy of register state. Committed on successful emulation. */
765 memset(c, 0, sizeof(struct decode_cache));
766 c->eip = ctxt->vcpu->rip;
767 memcpy(c->regs, ctxt->vcpu->regs, sizeof c->regs);
770 case X86EMUL_MODE_REAL:
771 case X86EMUL_MODE_PROT16:
772 def_op_bytes = def_ad_bytes = 2;
774 case X86EMUL_MODE_PROT32:
775 def_op_bytes = def_ad_bytes = 4;
778 case X86EMUL_MODE_PROT64:
787 c->op_bytes = def_op_bytes;
788 c->ad_bytes = def_ad_bytes;
790 /* Legacy prefixes. */
792 switch (c->b = insn_fetch(u8, 1, c->eip)) {
793 case 0x66: /* operand-size override */
794 /* switch between 2/4 bytes */
795 c->op_bytes = def_op_bytes ^ 6;
797 case 0x67: /* address-size override */
798 if (mode == X86EMUL_MODE_PROT64)
799 /* switch between 4/8 bytes */
800 c->ad_bytes = def_ad_bytes ^ 12;
802 /* switch between 2/4 bytes */
803 c->ad_bytes = def_ad_bytes ^ 6;
805 case 0x2e: /* CS override */
806 c->override_base = &ctxt->cs_base;
808 case 0x3e: /* DS override */
809 c->override_base = &ctxt->ds_base;
811 case 0x26: /* ES override */
812 c->override_base = &ctxt->es_base;
814 case 0x64: /* FS override */
815 c->override_base = &ctxt->fs_base;
817 case 0x65: /* GS override */
818 c->override_base = &ctxt->gs_base;
820 case 0x36: /* SS override */
821 c->override_base = &ctxt->ss_base;
823 case 0x40 ... 0x4f: /* REX */
824 if (mode != X86EMUL_MODE_PROT64)
826 c->rex_prefix = c->b;
828 case 0xf0: /* LOCK */
831 case 0xf2: /* REPNE/REPNZ */
832 c->rep_prefix = REPNE_PREFIX;
834 case 0xf3: /* REP/REPE/REPZ */
835 c->rep_prefix = REPE_PREFIX;
841 /* Any legacy prefix after a REX prefix nullifies its effect. */
850 if (c->rex_prefix & 8)
851 c->op_bytes = 8; /* REX.W */
853 /* Opcode byte(s). */
854 c->d = opcode_table[c->b];
856 /* Two-byte opcode? */
859 c->b = insn_fetch(u8, 1, c->eip);
860 c->d = twobyte_table[c->b];
865 DPRINTF("Cannot emulate %02x\n", c->b);
870 /* ModRM and SIB bytes. */
872 rc = decode_modrm(ctxt, ops);
873 else if (c->d & MemAbs)
874 rc = decode_abs(ctxt, ops);
878 if (!c->override_base)
879 c->override_base = &ctxt->ds_base;
880 if (mode == X86EMUL_MODE_PROT64 &&
881 c->override_base != &ctxt->fs_base &&
882 c->override_base != &ctxt->gs_base)
883 c->override_base = NULL;
885 if (c->override_base)
886 c->modrm_ea += *c->override_base;
888 if (c->ad_bytes != 8)
889 c->modrm_ea = (u32)c->modrm_ea;
891 * Decode and fetch the source operand: register, memory
894 switch (c->d & SrcMask) {
898 decode_register_operand(&c->src, c, 0);
907 c->src.bytes = (c->d & ByteOp) ? 1 :
909 /* Don't fetch the address for invlpg: it could be unmapped. */
910 if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
914 * For instructions with a ModR/M byte, switch to register
917 if ((c->d & ModRM) && c->modrm_mod == 3) {
918 c->src.type = OP_REG;
921 c->src.type = OP_MEM;
924 c->src.type = OP_IMM;
925 c->src.ptr = (unsigned long *)c->eip;
926 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
927 if (c->src.bytes == 8)
929 /* NB. Immediates are sign-extended as necessary. */
930 switch (c->src.bytes) {
932 c->src.val = insn_fetch(s8, 1, c->eip);
935 c->src.val = insn_fetch(s16, 2, c->eip);
938 c->src.val = insn_fetch(s32, 4, c->eip);
943 c->src.type = OP_IMM;
944 c->src.ptr = (unsigned long *)c->eip;
946 c->src.val = insn_fetch(s8, 1, c->eip);
950 /* Decode and fetch the destination operand: register or memory. */
951 switch (c->d & DstMask) {
953 /* Special instructions do their own operand decoding. */
956 decode_register_operand(&c->dst, c,
957 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
960 if ((c->d & ModRM) && c->modrm_mod == 3) {
961 c->dst.type = OP_REG;
964 c->dst.type = OP_MEM;
969 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
972 static inline void emulate_push(struct x86_emulate_ctxt *ctxt)
974 struct decode_cache *c = &ctxt->decode;
976 c->dst.type = OP_MEM;
977 c->dst.bytes = c->op_bytes;
978 c->dst.val = c->src.val;
979 register_address_increment(c->regs[VCPU_REGS_RSP], -c->op_bytes);
980 c->dst.ptr = (void *) register_address(ctxt->ss_base,
981 c->regs[VCPU_REGS_RSP]);
984 static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
985 struct x86_emulate_ops *ops)
987 struct decode_cache *c = &ctxt->decode;
990 /* 64-bit mode: POP always pops a 64-bit operand. */
992 if (ctxt->mode == X86EMUL_MODE_PROT64)
995 rc = ops->read_std(register_address(ctxt->ss_base,
996 c->regs[VCPU_REGS_RSP]),
997 &c->dst.val, c->dst.bytes, ctxt->vcpu);
1001 register_address_increment(c->regs[VCPU_REGS_RSP], c->dst.bytes);
1006 static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
1008 struct decode_cache *c = &ctxt->decode;
1009 switch (c->modrm_reg) {
1011 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
1014 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
1017 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
1020 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
1022 case 4: /* sal/shl */
1023 case 6: /* sal/shl */
1024 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
1027 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
1030 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
1035 static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
1036 struct x86_emulate_ops *ops)
1038 struct decode_cache *c = &ctxt->decode;
1041 switch (c->modrm_reg) {
1042 case 0 ... 1: /* test */
1044 * Special case in Grp3: test has an immediate
1047 c->src.type = OP_IMM;
1048 c->src.ptr = (unsigned long *)c->eip;
1049 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1050 if (c->src.bytes == 8)
1052 switch (c->src.bytes) {
1054 c->src.val = insn_fetch(s8, 1, c->eip);
1057 c->src.val = insn_fetch(s16, 2, c->eip);
1060 c->src.val = insn_fetch(s32, 4, c->eip);
1063 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1066 c->dst.val = ~c->dst.val;
1069 emulate_1op("neg", c->dst, ctxt->eflags);
1072 DPRINTF("Cannot emulate %02x\n", c->b);
1073 rc = X86EMUL_UNHANDLEABLE;
1080 static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
1081 struct x86_emulate_ops *ops)
1083 struct decode_cache *c = &ctxt->decode;
1086 switch (c->modrm_reg) {
1088 emulate_1op("inc", c->dst, ctxt->eflags);
1091 emulate_1op("dec", c->dst, ctxt->eflags);
1093 case 4: /* jmp abs */
1095 c->eip = c->dst.val;
1097 DPRINTF("Cannot emulate %02x\n", c->b);
1098 return X86EMUL_UNHANDLEABLE;
1103 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1105 if (ctxt->mode == X86EMUL_MODE_PROT64) {
1107 rc = ops->read_std((unsigned long)c->dst.ptr,
1108 &c->dst.val, 8, ctxt->vcpu);
1112 register_address_increment(c->regs[VCPU_REGS_RSP],
1114 rc = ops->write_emulated(register_address(ctxt->ss_base,
1115 c->regs[VCPU_REGS_RSP]), &c->dst.val,
1116 c->dst.bytes, ctxt->vcpu);
1119 c->dst.type = OP_NONE;
1122 DPRINTF("Cannot emulate %02x\n", c->b);
1123 return X86EMUL_UNHANDLEABLE;
1128 static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
1129 struct x86_emulate_ops *ops,
1132 struct decode_cache *c = &ctxt->decode;
1136 rc = ops->read_emulated(cr2, &old, 8, ctxt->vcpu);
1140 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1141 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
1143 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1144 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1145 ctxt->eflags &= ~EFLG_ZF;
1148 new = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1149 (u32) c->regs[VCPU_REGS_RBX];
1151 rc = ops->cmpxchg_emulated(cr2, &old, &new, 8, ctxt->vcpu);
1154 ctxt->eflags |= EFLG_ZF;
1159 static inline int writeback(struct x86_emulate_ctxt *ctxt,
1160 struct x86_emulate_ops *ops)
1163 struct decode_cache *c = &ctxt->decode;
1165 switch (c->dst.type) {
1167 /* The 4-byte case *is* correct:
1168 * in 64-bit mode we zero-extend.
1170 switch (c->dst.bytes) {
1172 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1175 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1178 *c->dst.ptr = (u32)c->dst.val;
1179 break; /* 64b: zero-ext */
1181 *c->dst.ptr = c->dst.val;
1187 rc = ops->cmpxchg_emulated(
1188 (unsigned long)c->dst.ptr,
1194 rc = ops->write_emulated(
1195 (unsigned long)c->dst.ptr,
1212 x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1214 unsigned long cr2 = ctxt->cr2;
1216 unsigned long saved_eip = 0;
1217 struct decode_cache *c = &ctxt->decode;
1220 /* Shadow copy of register state. Committed on successful emulation.
1221 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
1225 memcpy(c->regs, ctxt->vcpu->regs, sizeof c->regs);
1228 if (((c->d & ModRM) && (c->modrm_mod != 3)) || (c->d & MemAbs))
1231 if (c->src.type == OP_MEM) {
1232 c->src.ptr = (unsigned long *)cr2;
1234 rc = ops->read_emulated((unsigned long)c->src.ptr,
1240 c->src.orig_val = c->src.val;
1243 if ((c->d & DstMask) == ImplicitOps)
1247 if (c->dst.type == OP_MEM) {
1248 c->dst.ptr = (unsigned long *)cr2;
1249 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1252 unsigned long mask = ~(c->dst.bytes * 8 - 1);
1254 c->dst.ptr = (void *)c->dst.ptr +
1255 (c->src.val & mask) / 8;
1257 if (!(c->d & Mov) &&
1258 /* optimisation - avoid slow emulated read */
1259 ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1261 c->dst.bytes, ctxt->vcpu)) != 0))
1264 c->dst.orig_val = c->dst.val;
1272 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
1276 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
1280 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
1284 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
1288 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
1290 case 0x24: /* and al imm8 */
1291 c->dst.type = OP_REG;
1292 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1293 c->dst.val = *(u8 *)c->dst.ptr;
1295 c->dst.orig_val = c->dst.val;
1297 case 0x25: /* and ax imm16, or eax imm32 */
1298 c->dst.type = OP_REG;
1299 c->dst.bytes = c->op_bytes;
1300 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1301 if (c->op_bytes == 2)
1302 c->dst.val = *(u16 *)c->dst.ptr;
1304 c->dst.val = *(u32 *)c->dst.ptr;
1305 c->dst.orig_val = c->dst.val;
1309 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
1313 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
1317 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1319 case 0x40 ... 0x47: /* inc r16/r32 */
1320 emulate_1op("inc", c->dst, ctxt->eflags);
1322 case 0x48 ... 0x4f: /* dec r16/r32 */
1323 emulate_1op("dec", c->dst, ctxt->eflags);
1325 case 0x50 ... 0x57: /* push reg */
1326 c->dst.type = OP_MEM;
1327 c->dst.bytes = c->op_bytes;
1328 c->dst.val = c->src.val;
1329 register_address_increment(c->regs[VCPU_REGS_RSP],
1331 c->dst.ptr = (void *) register_address(
1332 ctxt->ss_base, c->regs[VCPU_REGS_RSP]);
1334 case 0x58 ... 0x5f: /* pop reg */
1336 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1337 c->regs[VCPU_REGS_RSP]), c->dst.ptr,
1338 c->op_bytes, ctxt->vcpu)) != 0)
1341 register_address_increment(c->regs[VCPU_REGS_RSP],
1343 c->dst.type = OP_NONE; /* Disable writeback. */
1345 case 0x63: /* movsxd */
1346 if (ctxt->mode != X86EMUL_MODE_PROT64)
1347 goto cannot_emulate;
1348 c->dst.val = (s32) c->src.val;
1350 case 0x80 ... 0x83: /* Grp1 */
1351 switch (c->modrm_reg) {
1371 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1373 case 0x86 ... 0x87: /* xchg */
1374 /* Write back the register source. */
1375 switch (c->dst.bytes) {
1377 *(u8 *) c->src.ptr = (u8) c->dst.val;
1380 *(u16 *) c->src.ptr = (u16) c->dst.val;
1383 *c->src.ptr = (u32) c->dst.val;
1384 break; /* 64b reg: zero-extend */
1386 *c->src.ptr = c->dst.val;
1390 * Write back the memory destination with implicit LOCK
1393 c->dst.val = c->src.val;
1396 case 0x88 ... 0x8b: /* mov */
1398 case 0x8d: /* lea r16/r32, m */
1399 c->dst.val = c->modrm_val;
1401 case 0x8f: /* pop (sole member of Grp1a) */
1402 rc = emulate_grp1a(ctxt, ops);
1406 case 0xa0 ... 0xa1: /* mov */
1407 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1408 c->dst.val = c->src.val;
1410 case 0xa2 ... 0xa3: /* mov */
1411 c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
1416 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1418 c->dst.val = c->src.val;
1420 case 0xd0 ... 0xd1: /* Grp2 */
1424 case 0xd2 ... 0xd3: /* Grp2 */
1425 c->src.val = c->regs[VCPU_REGS_RCX];
1428 case 0xf6 ... 0xf7: /* Grp3 */
1429 rc = emulate_grp3(ctxt, ops);
1433 case 0xfe ... 0xff: /* Grp4/Grp5 */
1434 rc = emulate_grp45(ctxt, ops);
1441 rc = writeback(ctxt, ops);
1445 /* Commit shadow register state. */
1446 memcpy(ctxt->vcpu->regs, c->regs, sizeof c->regs);
1447 ctxt->vcpu->rip = c->eip;
1450 if (rc == X86EMUL_UNHANDLEABLE) {
1458 goto twobyte_special_insn;
1460 case 0x6a: /* push imm8 */
1462 c->src.val = insn_fetch(s8, 1, c->eip);
1465 case 0x6c: /* insb */
1466 case 0x6d: /* insw/insd */
1467 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1469 (c->d & ByteOp) ? 1 : c->op_bytes,
1471 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1472 (ctxt->eflags & EFLG_DF),
1473 register_address(ctxt->es_base,
1474 c->regs[VCPU_REGS_RDI]),
1476 c->regs[VCPU_REGS_RDX]) == 0) {
1481 case 0x6e: /* outsb */
1482 case 0x6f: /* outsw/outsd */
1483 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1485 (c->d & ByteOp) ? 1 : c->op_bytes,
1487 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1488 (ctxt->eflags & EFLG_DF),
1489 register_address(c->override_base ?
1492 c->regs[VCPU_REGS_RSI]),
1494 c->regs[VCPU_REGS_RDX]) == 0) {
1499 case 0x70 ... 0x7f: /* jcc (short) */ {
1500 int rel = insn_fetch(s8, 1, c->eip);
1502 if (test_cc(c->b, ctxt->eflags))
1506 case 0x9c: /* pushf */
1507 c->src.val = (unsigned long) ctxt->eflags;
1510 case 0x9d: /* popf */
1511 c->dst.ptr = (unsigned long *) &ctxt->eflags;
1512 goto pop_instruction;
1513 case 0xc3: /* ret */
1514 c->dst.ptr = &c->eip;
1515 goto pop_instruction;
1516 case 0xf4: /* hlt */
1517 ctxt->vcpu->halt_request = 1;
1519 case 0xf5: /* cmc */
1520 /* complement carry flag from eflags reg */
1521 ctxt->eflags ^= EFLG_CF;
1522 c->dst.type = OP_NONE; /* Disable writeback. */
1524 case 0xf8: /* clc */
1525 ctxt->eflags &= ~EFLG_CF;
1526 c->dst.type = OP_NONE; /* Disable writeback. */
1528 case 0xfa: /* cli */
1529 ctxt->eflags &= ~X86_EFLAGS_IF;
1530 c->dst.type = OP_NONE; /* Disable writeback. */
1532 case 0xfb: /* sti */
1533 ctxt->eflags |= X86_EFLAGS_IF;
1534 c->dst.type = OP_NONE; /* Disable writeback. */
1537 if (c->rep_prefix) {
1538 if (c->regs[VCPU_REGS_RCX] == 0) {
1539 ctxt->vcpu->rip = c->eip;
1542 c->regs[VCPU_REGS_RCX]--;
1543 c->eip = ctxt->vcpu->rip;
1546 case 0xa4 ... 0xa5: /* movs */
1547 c->dst.type = OP_MEM;
1548 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1549 c->dst.ptr = (unsigned long *)register_address(
1551 c->regs[VCPU_REGS_RDI]);
1552 if ((rc = ops->read_emulated(register_address(
1553 c->override_base ? *c->override_base :
1555 c->regs[VCPU_REGS_RSI]),
1557 c->dst.bytes, ctxt->vcpu)) != 0)
1559 register_address_increment(c->regs[VCPU_REGS_RSI],
1560 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1562 register_address_increment(c->regs[VCPU_REGS_RDI],
1563 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1566 case 0xa6 ... 0xa7: /* cmps */
1567 DPRINTF("Urk! I don't handle CMPS.\n");
1568 goto cannot_emulate;
1569 case 0xaa ... 0xab: /* stos */
1570 c->dst.type = OP_MEM;
1571 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1572 c->dst.ptr = (unsigned long *)register_address(
1574 c->regs[VCPU_REGS_RDI]);
1575 c->dst.val = c->regs[VCPU_REGS_RAX];
1576 register_address_increment(c->regs[VCPU_REGS_RDI],
1577 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1580 case 0xac ... 0xad: /* lods */
1581 c->dst.type = OP_REG;
1582 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1583 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1584 if ((rc = ops->read_emulated(register_address(
1585 c->override_base ? *c->override_base :
1587 c->regs[VCPU_REGS_RSI]),
1592 register_address_increment(c->regs[VCPU_REGS_RSI],
1593 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1596 case 0xae ... 0xaf: /* scas */
1597 DPRINTF("Urk! I don't handle SCAS.\n");
1598 goto cannot_emulate;
1599 case 0xe8: /* call (near) */ {
1601 switch (c->op_bytes) {
1603 rel = insn_fetch(s16, 2, c->eip);
1606 rel = insn_fetch(s32, 4, c->eip);
1609 DPRINTF("Call: Invalid op_bytes\n");
1610 goto cannot_emulate;
1612 c->src.val = (unsigned long) c->eip;
1614 c->op_bytes = c->ad_bytes;
1618 case 0xe9: /* jmp rel */
1619 case 0xeb: /* jmp rel short */
1620 JMP_REL(c->src.val);
1621 c->dst.type = OP_NONE; /* Disable writeback. */
1630 case 0x01: /* lgdt, lidt, lmsw */
1631 switch (c->modrm_reg) {
1633 unsigned long address;
1635 case 0: /* vmcall */
1636 if (c->modrm_mod != 3 || c->modrm_rm != 1)
1637 goto cannot_emulate;
1639 rc = kvm_fix_hypercall(ctxt->vcpu);
1643 kvm_emulate_hypercall(ctxt->vcpu);
1646 rc = read_descriptor(ctxt, ops, c->src.ptr,
1647 &size, &address, c->op_bytes);
1650 realmode_lgdt(ctxt->vcpu, size, address);
1652 case 3: /* lidt/vmmcall */
1653 if (c->modrm_mod == 3 && c->modrm_rm == 1) {
1654 rc = kvm_fix_hypercall(ctxt->vcpu);
1657 kvm_emulate_hypercall(ctxt->vcpu);
1659 rc = read_descriptor(ctxt, ops, c->src.ptr,
1664 realmode_lidt(ctxt->vcpu, size, address);
1668 if (c->modrm_mod != 3)
1669 goto cannot_emulate;
1670 *(u16 *)&c->regs[c->modrm_rm]
1671 = realmode_get_cr(ctxt->vcpu, 0);
1674 if (c->modrm_mod != 3)
1675 goto cannot_emulate;
1676 realmode_lmsw(ctxt->vcpu, (u16)c->modrm_val,
1680 emulate_invlpg(ctxt->vcpu, cr2);
1683 goto cannot_emulate;
1685 /* Disable writeback. */
1686 c->dst.type = OP_NONE;
1688 case 0x21: /* mov from dr to reg */
1689 if (c->modrm_mod != 3)
1690 goto cannot_emulate;
1691 rc = emulator_get_dr(ctxt, c->modrm_reg, &c->regs[c->modrm_rm]);
1693 goto cannot_emulate;
1694 c->dst.type = OP_NONE; /* no writeback */
1696 case 0x23: /* mov from reg to dr */
1697 if (c->modrm_mod != 3)
1698 goto cannot_emulate;
1699 rc = emulator_set_dr(ctxt, c->modrm_reg,
1700 c->regs[c->modrm_rm]);
1702 goto cannot_emulate;
1703 c->dst.type = OP_NONE; /* no writeback */
1705 case 0x40 ... 0x4f: /* cmov */
1706 c->dst.val = c->dst.orig_val = c->src.val;
1707 if (!test_cc(c->b, ctxt->eflags))
1708 c->dst.type = OP_NONE; /* no writeback */
1712 c->dst.type = OP_NONE;
1713 /* only subword offset */
1714 c->src.val &= (c->dst.bytes << 3) - 1;
1715 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
1719 /* only subword offset */
1720 c->src.val &= (c->dst.bytes << 3) - 1;
1721 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
1723 case 0xb0 ... 0xb1: /* cmpxchg */
1725 * Save real source value, then compare EAX against
1728 c->src.orig_val = c->src.val;
1729 c->src.val = c->regs[VCPU_REGS_RAX];
1730 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1731 if (ctxt->eflags & EFLG_ZF) {
1732 /* Success: write back to memory. */
1733 c->dst.val = c->src.orig_val;
1735 /* Failure: write the value we saw to EAX. */
1736 c->dst.type = OP_REG;
1737 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1742 /* only subword offset */
1743 c->src.val &= (c->dst.bytes << 3) - 1;
1744 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
1746 case 0xb6 ... 0xb7: /* movzx */
1747 c->dst.bytes = c->op_bytes;
1748 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
1751 case 0xba: /* Grp8 */
1752 switch (c->modrm_reg & 3) {
1765 /* only subword offset */
1766 c->src.val &= (c->dst.bytes << 3) - 1;
1767 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
1769 case 0xbe ... 0xbf: /* movsx */
1770 c->dst.bytes = c->op_bytes;
1771 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
1774 case 0xc3: /* movnti */
1775 c->dst.bytes = c->op_bytes;
1776 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
1782 twobyte_special_insn:
1785 emulate_clts(ctxt->vcpu);
1787 case 0x08: /* invd */
1789 case 0x09: /* wbinvd */
1791 case 0x0d: /* GrpP (prefetch) */
1792 case 0x18: /* Grp16 (prefetch/nop) */
1794 case 0x20: /* mov cr, reg */
1795 if (c->modrm_mod != 3)
1796 goto cannot_emulate;
1797 c->regs[c->modrm_rm] =
1798 realmode_get_cr(ctxt->vcpu, c->modrm_reg);
1800 case 0x22: /* mov reg, cr */
1801 if (c->modrm_mod != 3)
1802 goto cannot_emulate;
1803 realmode_set_cr(ctxt->vcpu,
1804 c->modrm_reg, c->modrm_val, &ctxt->eflags);
1808 msr_data = (u32)c->regs[VCPU_REGS_RAX]
1809 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
1810 rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
1812 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
1813 c->eip = ctxt->vcpu->rip;
1815 rc = X86EMUL_CONTINUE;
1819 rc = kvm_get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data);
1821 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
1822 c->eip = ctxt->vcpu->rip;
1824 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
1825 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
1827 rc = X86EMUL_CONTINUE;
1829 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1832 switch (c->op_bytes) {
1834 rel = insn_fetch(s16, 2, c->eip);
1837 rel = insn_fetch(s32, 4, c->eip);
1840 rel = insn_fetch(s64, 8, c->eip);
1843 DPRINTF("jnz: Invalid op_bytes\n");
1844 goto cannot_emulate;
1846 if (test_cc(c->b, ctxt->eflags))
1850 case 0xc7: /* Grp9 (cmpxchg8b) */
1851 rc = emulate_grp9(ctxt, ops, cr2);
1856 /* Disable writeback. */
1857 c->dst.type = OP_NONE;
1861 DPRINTF("Cannot emulate %02x\n", c->b);