1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf(_f , ## _a)
28 #include <linux/kvm_host.h>
29 #define DPRINTF(x...) do {} while (0)
31 #include <linux/module.h>
32 #include <asm/kvm_x86_emulate.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
65 #define MemAbs (1<<9) /* Memory operand is absolute displacement */
66 #define String (1<<10) /* String instruction (rep capable) */
67 #define Stack (1<<11) /* Stack instruction (push/pop) */
68 #define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
69 #define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
70 #define GroupMask 0xff /* Group number stored in bits 0:7 */
73 Group1_80, Group1_81, Group1_82, Group1_83,
74 Group1A, Group3_Byte, Group3, Group4, Group5, Group7,
77 static u16 opcode_table[256] = {
79 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
80 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
83 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
84 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
87 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
88 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
91 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
92 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
95 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
96 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
97 SrcImmByte, SrcImm, 0, 0,
99 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
100 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
103 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
104 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
107 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
108 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
111 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
113 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
115 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
116 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
118 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
119 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
121 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
124 0, 0, ImplicitOps | Mov | Stack, 0,
125 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
126 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
128 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
129 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
131 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
132 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
134 Group | Group1_80, Group | Group1_81,
135 Group | Group1_82, Group | Group1_83,
136 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
137 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
139 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
140 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
141 0, ModRM | DstReg, 0, Group | Group1A,
143 0, 0, 0, 0, 0, 0, 0, 0,
144 0, 0, 0, 0, ImplicitOps | Stack, ImplicitOps | Stack, 0, 0,
146 ByteOp | DstReg | SrcMem | Mov | MemAbs, DstReg | SrcMem | Mov | MemAbs,
147 ByteOp | DstMem | SrcReg | Mov | MemAbs, DstMem | SrcReg | Mov | MemAbs,
148 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
149 ByteOp | ImplicitOps | String, ImplicitOps | String,
151 0, 0, ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
152 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
153 ByteOp | ImplicitOps | String, ImplicitOps | String,
155 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
157 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
158 0, ImplicitOps | Stack, 0, 0,
159 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
161 0, 0, 0, 0, 0, 0, 0, 0,
163 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
164 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
167 0, 0, 0, 0, 0, 0, 0, 0,
169 0, 0, 0, 0, 0, 0, 0, 0,
171 ImplicitOps | Stack, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps,
175 ImplicitOps, ImplicitOps, Group | Group3_Byte, Group | Group3,
177 ImplicitOps, 0, ImplicitOps, ImplicitOps,
178 0, 0, Group | Group4, Group | Group5,
181 static u16 twobyte_table[256] = {
183 0, Group | GroupDual | Group7, 0, 0, 0, 0, ImplicitOps, 0,
184 ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
186 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
188 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
189 0, 0, 0, 0, 0, 0, 0, 0,
191 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
193 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
194 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
195 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
196 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
198 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
199 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
200 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
201 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
203 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
205 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
207 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
209 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
210 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
211 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
212 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
214 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
216 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
218 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
220 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
221 DstMem | SrcReg | ModRM | BitOp,
222 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
223 DstReg | SrcMem16 | ModRM | Mov,
225 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
226 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
227 DstReg | SrcMem16 | ModRM | Mov,
229 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
230 0, 0, 0, 0, 0, 0, 0, 0,
232 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
234 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
236 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
239 static u16 group_table[] = {
241 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
242 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
243 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
244 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
246 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
247 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
248 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
249 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
251 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
252 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
253 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
254 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
256 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
257 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
258 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
259 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
261 DstMem | SrcNone | ModRM | Mov | Stack, 0, 0, 0, 0, 0, 0, 0,
263 ByteOp | SrcImm | DstMem | ModRM, 0,
264 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
267 DstMem | SrcImm | ModRM | SrcImm, 0,
268 DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
271 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
274 DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM, 0, 0,
275 SrcMem | ModRM, 0, SrcMem | ModRM | Stack, 0,
277 0, 0, ModRM | SrcMem, ModRM | SrcMem,
278 SrcNone | ModRM | DstMem, 0, SrcMem | ModRM, SrcMem | ModRM | ByteOp,
281 static u16 group2_table[] = {
283 SrcNone | ModRM, 0, 0, 0, SrcNone | ModRM | DstMem, 0, SrcMem | ModRM, 0,
286 /* EFLAGS bit definitions. */
287 #define EFLG_OF (1<<11)
288 #define EFLG_DF (1<<10)
289 #define EFLG_SF (1<<7)
290 #define EFLG_ZF (1<<6)
291 #define EFLG_AF (1<<4)
292 #define EFLG_PF (1<<2)
293 #define EFLG_CF (1<<0)
296 * Instruction emulation:
297 * Most instructions are emulated directly via a fragment of inline assembly
298 * code. This allows us to save/restore EFLAGS and thus very easily pick up
299 * any modified flags.
302 #if defined(CONFIG_X86_64)
303 #define _LO32 "k" /* force 32-bit operand */
304 #define _STK "%%rsp" /* stack pointer */
305 #elif defined(__i386__)
306 #define _LO32 "" /* force 32-bit operand */
307 #define _STK "%%esp" /* stack pointer */
311 * These EFLAGS bits are restored from saved value during emulation, and
312 * any changes are written back to the saved value after emulation.
314 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
316 /* Before executing instruction: restore necessary bits in EFLAGS. */
317 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
318 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
319 "movl %"_sav",%"_LO32 _tmp"; " \
322 "movl %"_msk",%"_LO32 _tmp"; " \
323 "andl %"_LO32 _tmp",("_STK"); " \
325 "notl %"_LO32 _tmp"; " \
326 "andl %"_LO32 _tmp",("_STK"); " \
327 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
329 "orl %"_LO32 _tmp",("_STK"); " \
333 /* After executing instruction: write-back necessary bits in EFLAGS. */
334 #define _POST_EFLAGS(_sav, _msk, _tmp) \
335 /* _sav |= EFLAGS & _msk; */ \
338 "andl %"_msk",%"_LO32 _tmp"; " \
339 "orl %"_LO32 _tmp",%"_sav"; "
341 /* Raw emulation: instruction has two explicit operands. */
342 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
344 unsigned long _tmp; \
346 switch ((_dst).bytes) { \
348 __asm__ __volatile__ ( \
349 _PRE_EFLAGS("0", "4", "2") \
350 _op"w %"_wx"3,%1; " \
351 _POST_EFLAGS("0", "4", "2") \
352 : "=m" (_eflags), "=m" ((_dst).val), \
354 : _wy ((_src).val), "i" (EFLAGS_MASK)); \
357 __asm__ __volatile__ ( \
358 _PRE_EFLAGS("0", "4", "2") \
359 _op"l %"_lx"3,%1; " \
360 _POST_EFLAGS("0", "4", "2") \
361 : "=m" (_eflags), "=m" ((_dst).val), \
363 : _ly ((_src).val), "i" (EFLAGS_MASK)); \
366 __emulate_2op_8byte(_op, _src, _dst, \
367 _eflags, _qx, _qy); \
372 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
374 unsigned long __tmp; \
375 switch ((_dst).bytes) { \
377 __asm__ __volatile__ ( \
378 _PRE_EFLAGS("0", "4", "2") \
379 _op"b %"_bx"3,%1; " \
380 _POST_EFLAGS("0", "4", "2") \
381 : "=m" (_eflags), "=m" ((_dst).val), \
383 : _by ((_src).val), "i" (EFLAGS_MASK)); \
386 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
387 _wx, _wy, _lx, _ly, _qx, _qy); \
392 /* Source operand is byte-sized and may be restricted to just %cl. */
393 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
394 __emulate_2op(_op, _src, _dst, _eflags, \
395 "b", "c", "b", "c", "b", "c", "b", "c")
397 /* Source operand is byte, word, long or quad sized. */
398 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
399 __emulate_2op(_op, _src, _dst, _eflags, \
400 "b", "q", "w", "r", _LO32, "r", "", "r")
402 /* Source operand is word, long or quad sized. */
403 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
404 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
405 "w", "r", _LO32, "r", "", "r")
407 /* Instruction has only one explicit operand (no source operand). */
408 #define emulate_1op(_op, _dst, _eflags) \
410 unsigned long _tmp; \
412 switch ((_dst).bytes) { \
414 __asm__ __volatile__ ( \
415 _PRE_EFLAGS("0", "3", "2") \
417 _POST_EFLAGS("0", "3", "2") \
418 : "=m" (_eflags), "=m" ((_dst).val), \
420 : "i" (EFLAGS_MASK)); \
423 __asm__ __volatile__ ( \
424 _PRE_EFLAGS("0", "3", "2") \
426 _POST_EFLAGS("0", "3", "2") \
427 : "=m" (_eflags), "=m" ((_dst).val), \
429 : "i" (EFLAGS_MASK)); \
432 __asm__ __volatile__ ( \
433 _PRE_EFLAGS("0", "3", "2") \
435 _POST_EFLAGS("0", "3", "2") \
436 : "=m" (_eflags), "=m" ((_dst).val), \
438 : "i" (EFLAGS_MASK)); \
441 __emulate_1op_8byte(_op, _dst, _eflags); \
446 /* Emulate an instruction with quadword operands (x86/64 only). */
447 #if defined(CONFIG_X86_64)
448 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
450 __asm__ __volatile__ ( \
451 _PRE_EFLAGS("0", "4", "2") \
452 _op"q %"_qx"3,%1; " \
453 _POST_EFLAGS("0", "4", "2") \
454 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
455 : _qy ((_src).val), "i" (EFLAGS_MASK)); \
458 #define __emulate_1op_8byte(_op, _dst, _eflags) \
460 __asm__ __volatile__ ( \
461 _PRE_EFLAGS("0", "3", "2") \
463 _POST_EFLAGS("0", "3", "2") \
464 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
465 : "i" (EFLAGS_MASK)); \
468 #elif defined(__i386__)
469 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
470 #define __emulate_1op_8byte(_op, _dst, _eflags)
471 #endif /* __i386__ */
473 /* Fetch next part of the instruction being emulated. */
474 #define insn_fetch(_type, _size, _eip) \
475 ({ unsigned long _x; \
476 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
483 static inline unsigned long ad_mask(struct decode_cache *c)
485 return (1UL << (c->ad_bytes << 3)) - 1;
488 /* Access/update address held in a register, based on addressing mode. */
489 static inline unsigned long
490 address_mask(struct decode_cache *c, unsigned long reg)
492 if (c->ad_bytes == sizeof(unsigned long))
495 return reg & ad_mask(c);
498 static inline unsigned long
499 register_address(struct decode_cache *c, unsigned long base, unsigned long reg)
501 return base + address_mask(c, reg);
505 register_address_increment(struct decode_cache *c, unsigned long *reg, int inc)
507 if (c->ad_bytes == sizeof(unsigned long))
510 *reg = (*reg & ~ad_mask(c)) | ((*reg + inc) & ad_mask(c));
513 static inline void jmp_rel(struct decode_cache *c, int rel)
515 register_address_increment(c, &c->eip, rel);
518 static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
519 struct x86_emulate_ops *ops,
520 unsigned long linear, u8 *dest)
522 struct fetch_cache *fc = &ctxt->decode.fetch;
526 if (linear < fc->start || linear >= fc->end) {
527 size = min(15UL, PAGE_SIZE - offset_in_page(linear));
528 rc = ops->read_std(linear, fc->data, size, ctxt->vcpu);
532 fc->end = linear + size;
534 *dest = fc->data[linear - fc->start];
538 static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
539 struct x86_emulate_ops *ops,
540 unsigned long eip, void *dest, unsigned size)
544 eip += ctxt->cs_base;
546 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
554 * Given the 'reg' portion of a ModRM byte, and a register block, return a
555 * pointer into the block that addresses the relevant register.
556 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
558 static void *decode_register(u8 modrm_reg, unsigned long *regs,
563 p = ®s[modrm_reg];
564 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
565 p = (unsigned char *)®s[modrm_reg & 3] + 1;
569 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
570 struct x86_emulate_ops *ops,
572 u16 *size, unsigned long *address, int op_bytes)
579 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
583 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
588 static int test_cc(unsigned int condition, unsigned int flags)
592 switch ((condition & 15) >> 1) {
594 rc |= (flags & EFLG_OF);
596 case 1: /* b/c/nae */
597 rc |= (flags & EFLG_CF);
600 rc |= (flags & EFLG_ZF);
603 rc |= (flags & (EFLG_CF|EFLG_ZF));
606 rc |= (flags & EFLG_SF);
609 rc |= (flags & EFLG_PF);
612 rc |= (flags & EFLG_ZF);
615 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
619 /* Odd condition identifiers (lsb == 1) have inverted sense. */
620 return (!!rc ^ (condition & 1));
623 static void decode_register_operand(struct operand *op,
624 struct decode_cache *c,
627 unsigned reg = c->modrm_reg;
628 int highbyte_regs = c->rex_prefix == 0;
631 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
633 if ((c->d & ByteOp) && !inhibit_bytereg) {
634 op->ptr = decode_register(reg, c->regs, highbyte_regs);
635 op->val = *(u8 *)op->ptr;
638 op->ptr = decode_register(reg, c->regs, 0);
639 op->bytes = c->op_bytes;
642 op->val = *(u16 *)op->ptr;
645 op->val = *(u32 *)op->ptr;
648 op->val = *(u64 *) op->ptr;
652 op->orig_val = op->val;
655 static int decode_modrm(struct x86_emulate_ctxt *ctxt,
656 struct x86_emulate_ops *ops)
658 struct decode_cache *c = &ctxt->decode;
660 int index_reg = 0, base_reg = 0, scale, rip_relative = 0;
664 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
665 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
666 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
669 c->modrm = insn_fetch(u8, 1, c->eip);
670 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
671 c->modrm_reg |= (c->modrm & 0x38) >> 3;
672 c->modrm_rm |= (c->modrm & 0x07);
676 if (c->modrm_mod == 3) {
677 c->modrm_val = *(unsigned long *)
678 decode_register(c->modrm_rm, c->regs, c->d & ByteOp);
682 if (c->ad_bytes == 2) {
683 unsigned bx = c->regs[VCPU_REGS_RBX];
684 unsigned bp = c->regs[VCPU_REGS_RBP];
685 unsigned si = c->regs[VCPU_REGS_RSI];
686 unsigned di = c->regs[VCPU_REGS_RDI];
688 /* 16-bit ModR/M decode. */
689 switch (c->modrm_mod) {
691 if (c->modrm_rm == 6)
692 c->modrm_ea += insn_fetch(u16, 2, c->eip);
695 c->modrm_ea += insn_fetch(s8, 1, c->eip);
698 c->modrm_ea += insn_fetch(u16, 2, c->eip);
701 switch (c->modrm_rm) {
703 c->modrm_ea += bx + si;
706 c->modrm_ea += bx + di;
709 c->modrm_ea += bp + si;
712 c->modrm_ea += bp + di;
721 if (c->modrm_mod != 0)
728 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
729 (c->modrm_rm == 6 && c->modrm_mod != 0))
730 if (!c->override_base)
731 c->override_base = &ctxt->ss_base;
732 c->modrm_ea = (u16)c->modrm_ea;
734 /* 32/64-bit ModR/M decode. */
735 switch (c->modrm_rm) {
738 sib = insn_fetch(u8, 1, c->eip);
739 index_reg |= (sib >> 3) & 7;
745 if (c->modrm_mod != 0)
746 c->modrm_ea += c->regs[base_reg];
749 insn_fetch(s32, 4, c->eip);
752 c->modrm_ea += c->regs[base_reg];
758 c->modrm_ea += c->regs[index_reg] << scale;
762 if (c->modrm_mod != 0)
763 c->modrm_ea += c->regs[c->modrm_rm];
764 else if (ctxt->mode == X86EMUL_MODE_PROT64)
768 c->modrm_ea += c->regs[c->modrm_rm];
771 switch (c->modrm_mod) {
773 if (c->modrm_rm == 5)
774 c->modrm_ea += insn_fetch(s32, 4, c->eip);
777 c->modrm_ea += insn_fetch(s8, 1, c->eip);
780 c->modrm_ea += insn_fetch(s32, 4, c->eip);
785 c->modrm_ea += c->eip;
786 switch (c->d & SrcMask) {
794 if (c->op_bytes == 8)
797 c->modrm_ea += c->op_bytes;
804 static int decode_abs(struct x86_emulate_ctxt *ctxt,
805 struct x86_emulate_ops *ops)
807 struct decode_cache *c = &ctxt->decode;
810 switch (c->ad_bytes) {
812 c->modrm_ea = insn_fetch(u16, 2, c->eip);
815 c->modrm_ea = insn_fetch(u32, 4, c->eip);
818 c->modrm_ea = insn_fetch(u64, 8, c->eip);
826 x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
828 struct decode_cache *c = &ctxt->decode;
830 int mode = ctxt->mode;
831 int def_op_bytes, def_ad_bytes, group;
833 /* Shadow copy of register state. Committed on successful emulation. */
835 memset(c, 0, sizeof(struct decode_cache));
836 c->eip = ctxt->vcpu->arch.rip;
837 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
840 case X86EMUL_MODE_REAL:
841 case X86EMUL_MODE_PROT16:
842 def_op_bytes = def_ad_bytes = 2;
844 case X86EMUL_MODE_PROT32:
845 def_op_bytes = def_ad_bytes = 4;
848 case X86EMUL_MODE_PROT64:
857 c->op_bytes = def_op_bytes;
858 c->ad_bytes = def_ad_bytes;
860 /* Legacy prefixes. */
862 switch (c->b = insn_fetch(u8, 1, c->eip)) {
863 case 0x66: /* operand-size override */
864 /* switch between 2/4 bytes */
865 c->op_bytes = def_op_bytes ^ 6;
867 case 0x67: /* address-size override */
868 if (mode == X86EMUL_MODE_PROT64)
869 /* switch between 4/8 bytes */
870 c->ad_bytes = def_ad_bytes ^ 12;
872 /* switch between 2/4 bytes */
873 c->ad_bytes = def_ad_bytes ^ 6;
875 case 0x2e: /* CS override */
876 c->override_base = &ctxt->cs_base;
878 case 0x3e: /* DS override */
879 c->override_base = &ctxt->ds_base;
881 case 0x26: /* ES override */
882 c->override_base = &ctxt->es_base;
884 case 0x64: /* FS override */
885 c->override_base = &ctxt->fs_base;
887 case 0x65: /* GS override */
888 c->override_base = &ctxt->gs_base;
890 case 0x36: /* SS override */
891 c->override_base = &ctxt->ss_base;
893 case 0x40 ... 0x4f: /* REX */
894 if (mode != X86EMUL_MODE_PROT64)
896 c->rex_prefix = c->b;
898 case 0xf0: /* LOCK */
901 case 0xf2: /* REPNE/REPNZ */
902 c->rep_prefix = REPNE_PREFIX;
904 case 0xf3: /* REP/REPE/REPZ */
905 c->rep_prefix = REPE_PREFIX;
911 /* Any legacy prefix after a REX prefix nullifies its effect. */
920 if (c->rex_prefix & 8)
921 c->op_bytes = 8; /* REX.W */
923 /* Opcode byte(s). */
924 c->d = opcode_table[c->b];
926 /* Two-byte opcode? */
929 c->b = insn_fetch(u8, 1, c->eip);
930 c->d = twobyte_table[c->b];
935 group = c->d & GroupMask;
936 c->modrm = insn_fetch(u8, 1, c->eip);
939 group = (group << 3) + ((c->modrm >> 3) & 7);
940 if ((c->d & GroupDual) && (c->modrm >> 6) == 3)
941 c->d = group2_table[group];
943 c->d = group_table[group];
948 DPRINTF("Cannot emulate %02x\n", c->b);
952 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
955 /* ModRM and SIB bytes. */
957 rc = decode_modrm(ctxt, ops);
958 else if (c->d & MemAbs)
959 rc = decode_abs(ctxt, ops);
963 if (!c->override_base)
964 c->override_base = &ctxt->ds_base;
965 if (mode == X86EMUL_MODE_PROT64 &&
966 c->override_base != &ctxt->fs_base &&
967 c->override_base != &ctxt->gs_base)
968 c->override_base = NULL;
970 if (c->override_base)
971 c->modrm_ea += *c->override_base;
973 if (c->ad_bytes != 8)
974 c->modrm_ea = (u32)c->modrm_ea;
976 * Decode and fetch the source operand: register, memory
979 switch (c->d & SrcMask) {
983 decode_register_operand(&c->src, c, 0);
992 c->src.bytes = (c->d & ByteOp) ? 1 :
994 /* Don't fetch the address for invlpg: it could be unmapped. */
995 if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
999 * For instructions with a ModR/M byte, switch to register
1000 * access if Mod = 3.
1002 if ((c->d & ModRM) && c->modrm_mod == 3) {
1003 c->src.type = OP_REG;
1004 c->src.val = c->modrm_val;
1007 c->src.type = OP_MEM;
1010 c->src.type = OP_IMM;
1011 c->src.ptr = (unsigned long *)c->eip;
1012 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1013 if (c->src.bytes == 8)
1015 /* NB. Immediates are sign-extended as necessary. */
1016 switch (c->src.bytes) {
1018 c->src.val = insn_fetch(s8, 1, c->eip);
1021 c->src.val = insn_fetch(s16, 2, c->eip);
1024 c->src.val = insn_fetch(s32, 4, c->eip);
1029 c->src.type = OP_IMM;
1030 c->src.ptr = (unsigned long *)c->eip;
1032 c->src.val = insn_fetch(s8, 1, c->eip);
1036 /* Decode and fetch the destination operand: register or memory. */
1037 switch (c->d & DstMask) {
1039 /* Special instructions do their own operand decoding. */
1042 decode_register_operand(&c->dst, c,
1043 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
1046 if ((c->d & ModRM) && c->modrm_mod == 3) {
1047 c->dst.type = OP_REG;
1048 c->dst.val = c->dst.orig_val = c->modrm_val;
1051 c->dst.type = OP_MEM;
1056 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1059 static inline void emulate_push(struct x86_emulate_ctxt *ctxt)
1061 struct decode_cache *c = &ctxt->decode;
1063 c->dst.type = OP_MEM;
1064 c->dst.bytes = c->op_bytes;
1065 c->dst.val = c->src.val;
1066 register_address_increment(c, &c->regs[VCPU_REGS_RSP], -c->op_bytes);
1067 c->dst.ptr = (void *) register_address(c, ctxt->ss_base,
1068 c->regs[VCPU_REGS_RSP]);
1071 static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
1072 struct x86_emulate_ops *ops)
1074 struct decode_cache *c = &ctxt->decode;
1077 rc = ops->read_std(register_address(c, ctxt->ss_base,
1078 c->regs[VCPU_REGS_RSP]),
1079 &c->dst.val, c->dst.bytes, ctxt->vcpu);
1083 register_address_increment(c, &c->regs[VCPU_REGS_RSP], c->dst.bytes);
1088 static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
1090 struct decode_cache *c = &ctxt->decode;
1091 switch (c->modrm_reg) {
1093 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
1096 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
1099 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
1102 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
1104 case 4: /* sal/shl */
1105 case 6: /* sal/shl */
1106 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
1109 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
1112 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
1117 static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
1118 struct x86_emulate_ops *ops)
1120 struct decode_cache *c = &ctxt->decode;
1123 switch (c->modrm_reg) {
1124 case 0 ... 1: /* test */
1125 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1128 c->dst.val = ~c->dst.val;
1131 emulate_1op("neg", c->dst, ctxt->eflags);
1134 DPRINTF("Cannot emulate %02x\n", c->b);
1135 rc = X86EMUL_UNHANDLEABLE;
1141 static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
1142 struct x86_emulate_ops *ops)
1144 struct decode_cache *c = &ctxt->decode;
1146 switch (c->modrm_reg) {
1148 emulate_1op("inc", c->dst, ctxt->eflags);
1151 emulate_1op("dec", c->dst, ctxt->eflags);
1153 case 4: /* jmp abs */
1154 c->eip = c->src.val;
1163 static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
1164 struct x86_emulate_ops *ops,
1165 unsigned long memop)
1167 struct decode_cache *c = &ctxt->decode;
1171 rc = ops->read_emulated(memop, &old, 8, ctxt->vcpu);
1175 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1176 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
1178 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1179 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1180 ctxt->eflags &= ~EFLG_ZF;
1183 new = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1184 (u32) c->regs[VCPU_REGS_RBX];
1186 rc = ops->cmpxchg_emulated(memop, &old, &new, 8, ctxt->vcpu);
1189 ctxt->eflags |= EFLG_ZF;
1194 static inline int writeback(struct x86_emulate_ctxt *ctxt,
1195 struct x86_emulate_ops *ops)
1198 struct decode_cache *c = &ctxt->decode;
1200 switch (c->dst.type) {
1202 /* The 4-byte case *is* correct:
1203 * in 64-bit mode we zero-extend.
1205 switch (c->dst.bytes) {
1207 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1210 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1213 *c->dst.ptr = (u32)c->dst.val;
1214 break; /* 64b: zero-ext */
1216 *c->dst.ptr = c->dst.val;
1222 rc = ops->cmpxchg_emulated(
1223 (unsigned long)c->dst.ptr,
1229 rc = ops->write_emulated(
1230 (unsigned long)c->dst.ptr,
1247 x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1249 unsigned long memop = 0;
1251 unsigned long saved_eip = 0;
1252 struct decode_cache *c = &ctxt->decode;
1255 /* Shadow copy of register state. Committed on successful emulation.
1256 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
1260 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
1263 if (((c->d & ModRM) && (c->modrm_mod != 3)) || (c->d & MemAbs))
1264 memop = c->modrm_ea;
1266 if (c->rep_prefix && (c->d & String)) {
1267 /* All REP prefixes have the same first termination condition */
1268 if (c->regs[VCPU_REGS_RCX] == 0) {
1269 ctxt->vcpu->arch.rip = c->eip;
1272 /* The second termination condition only applies for REPE
1273 * and REPNE. Test if the repeat string operation prefix is
1274 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
1275 * corresponding termination condition according to:
1276 * - if REPE/REPZ and ZF = 0 then done
1277 * - if REPNE/REPNZ and ZF = 1 then done
1279 if ((c->b == 0xa6) || (c->b == 0xa7) ||
1280 (c->b == 0xae) || (c->b == 0xaf)) {
1281 if ((c->rep_prefix == REPE_PREFIX) &&
1282 ((ctxt->eflags & EFLG_ZF) == 0)) {
1283 ctxt->vcpu->arch.rip = c->eip;
1286 if ((c->rep_prefix == REPNE_PREFIX) &&
1287 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF)) {
1288 ctxt->vcpu->arch.rip = c->eip;
1292 c->regs[VCPU_REGS_RCX]--;
1293 c->eip = ctxt->vcpu->arch.rip;
1296 if (c->src.type == OP_MEM) {
1297 c->src.ptr = (unsigned long *)memop;
1299 rc = ops->read_emulated((unsigned long)c->src.ptr,
1305 c->src.orig_val = c->src.val;
1308 if ((c->d & DstMask) == ImplicitOps)
1312 if (c->dst.type == OP_MEM) {
1313 c->dst.ptr = (unsigned long *)memop;
1314 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1317 unsigned long mask = ~(c->dst.bytes * 8 - 1);
1319 c->dst.ptr = (void *)c->dst.ptr +
1320 (c->src.val & mask) / 8;
1322 if (!(c->d & Mov) &&
1323 /* optimisation - avoid slow emulated read */
1324 ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1326 c->dst.bytes, ctxt->vcpu)) != 0))
1329 c->dst.orig_val = c->dst.val;
1339 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
1343 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
1347 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
1351 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
1355 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
1357 case 0x24: /* and al imm8 */
1358 c->dst.type = OP_REG;
1359 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1360 c->dst.val = *(u8 *)c->dst.ptr;
1362 c->dst.orig_val = c->dst.val;
1364 case 0x25: /* and ax imm16, or eax imm32 */
1365 c->dst.type = OP_REG;
1366 c->dst.bytes = c->op_bytes;
1367 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1368 if (c->op_bytes == 2)
1369 c->dst.val = *(u16 *)c->dst.ptr;
1371 c->dst.val = *(u32 *)c->dst.ptr;
1372 c->dst.orig_val = c->dst.val;
1376 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
1380 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
1384 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1386 case 0x40 ... 0x47: /* inc r16/r32 */
1387 emulate_1op("inc", c->dst, ctxt->eflags);
1389 case 0x48 ... 0x4f: /* dec r16/r32 */
1390 emulate_1op("dec", c->dst, ctxt->eflags);
1392 case 0x50 ... 0x57: /* push reg */
1393 c->dst.type = OP_MEM;
1394 c->dst.bytes = c->op_bytes;
1395 c->dst.val = c->src.val;
1396 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1398 c->dst.ptr = (void *) register_address(
1399 c, ctxt->ss_base, c->regs[VCPU_REGS_RSP]);
1401 case 0x58 ... 0x5f: /* pop reg */
1403 if ((rc = ops->read_std(register_address(c, ctxt->ss_base,
1404 c->regs[VCPU_REGS_RSP]), c->dst.ptr,
1405 c->op_bytes, ctxt->vcpu)) != 0)
1408 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1410 c->dst.type = OP_NONE; /* Disable writeback. */
1412 case 0x63: /* movsxd */
1413 if (ctxt->mode != X86EMUL_MODE_PROT64)
1414 goto cannot_emulate;
1415 c->dst.val = (s32) c->src.val;
1417 case 0x6a: /* push imm8 */
1419 c->src.val = insn_fetch(s8, 1, c->eip);
1422 case 0x6c: /* insb */
1423 case 0x6d: /* insw/insd */
1424 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1426 (c->d & ByteOp) ? 1 : c->op_bytes,
1428 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1,
1429 (ctxt->eflags & EFLG_DF),
1430 register_address(c, ctxt->es_base,
1431 c->regs[VCPU_REGS_RDI]),
1433 c->regs[VCPU_REGS_RDX]) == 0) {
1438 case 0x6e: /* outsb */
1439 case 0x6f: /* outsw/outsd */
1440 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1442 (c->d & ByteOp) ? 1 : c->op_bytes,
1444 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1,
1445 (ctxt->eflags & EFLG_DF),
1446 register_address(c, c->override_base ?
1449 c->regs[VCPU_REGS_RSI]),
1451 c->regs[VCPU_REGS_RDX]) == 0) {
1456 case 0x70 ... 0x7f: /* jcc (short) */ {
1457 int rel = insn_fetch(s8, 1, c->eip);
1459 if (test_cc(c->b, ctxt->eflags))
1463 case 0x80 ... 0x83: /* Grp1 */
1464 switch (c->modrm_reg) {
1484 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1486 case 0x86 ... 0x87: /* xchg */
1487 /* Write back the register source. */
1488 switch (c->dst.bytes) {
1490 *(u8 *) c->src.ptr = (u8) c->dst.val;
1493 *(u16 *) c->src.ptr = (u16) c->dst.val;
1496 *c->src.ptr = (u32) c->dst.val;
1497 break; /* 64b reg: zero-extend */
1499 *c->src.ptr = c->dst.val;
1503 * Write back the memory destination with implicit LOCK
1506 c->dst.val = c->src.val;
1509 case 0x88 ... 0x8b: /* mov */
1511 case 0x8d: /* lea r16/r32, m */
1512 c->dst.val = c->modrm_val;
1514 case 0x8f: /* pop (sole member of Grp1a) */
1515 rc = emulate_grp1a(ctxt, ops);
1519 case 0x9c: /* pushf */
1520 c->src.val = (unsigned long) ctxt->eflags;
1523 case 0x9d: /* popf */
1524 c->dst.ptr = (unsigned long *) &ctxt->eflags;
1525 goto pop_instruction;
1526 case 0xa0 ... 0xa1: /* mov */
1527 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1528 c->dst.val = c->src.val;
1530 case 0xa2 ... 0xa3: /* mov */
1531 c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
1533 case 0xa4 ... 0xa5: /* movs */
1534 c->dst.type = OP_MEM;
1535 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1536 c->dst.ptr = (unsigned long *)register_address(c,
1538 c->regs[VCPU_REGS_RDI]);
1539 if ((rc = ops->read_emulated(register_address(c,
1540 c->override_base ? *c->override_base :
1542 c->regs[VCPU_REGS_RSI]),
1544 c->dst.bytes, ctxt->vcpu)) != 0)
1546 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1547 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1549 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1550 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1553 case 0xa6 ... 0xa7: /* cmps */
1554 c->src.type = OP_NONE; /* Disable writeback. */
1555 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1556 c->src.ptr = (unsigned long *)register_address(c,
1557 c->override_base ? *c->override_base :
1559 c->regs[VCPU_REGS_RSI]);
1560 if ((rc = ops->read_emulated((unsigned long)c->src.ptr,
1566 c->dst.type = OP_NONE; /* Disable writeback. */
1567 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1568 c->dst.ptr = (unsigned long *)register_address(c,
1570 c->regs[VCPU_REGS_RDI]);
1571 if ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1577 DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c->src.ptr, c->dst.ptr);
1579 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1581 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1582 (ctxt->eflags & EFLG_DF) ? -c->src.bytes
1584 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1585 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1589 case 0xaa ... 0xab: /* stos */
1590 c->dst.type = OP_MEM;
1591 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1592 c->dst.ptr = (unsigned long *)register_address(c,
1594 c->regs[VCPU_REGS_RDI]);
1595 c->dst.val = c->regs[VCPU_REGS_RAX];
1596 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1597 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1600 case 0xac ... 0xad: /* lods */
1601 c->dst.type = OP_REG;
1602 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1603 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1604 if ((rc = ops->read_emulated(register_address(c,
1605 c->override_base ? *c->override_base :
1607 c->regs[VCPU_REGS_RSI]),
1612 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1613 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1616 case 0xae ... 0xaf: /* scas */
1617 DPRINTF("Urk! I don't handle SCAS.\n");
1618 goto cannot_emulate;
1622 case 0xc3: /* ret */
1623 c->dst.ptr = &c->eip;
1624 goto pop_instruction;
1625 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1627 c->dst.val = c->src.val;
1629 case 0xd0 ... 0xd1: /* Grp2 */
1633 case 0xd2 ... 0xd3: /* Grp2 */
1634 c->src.val = c->regs[VCPU_REGS_RCX];
1637 case 0xe8: /* call (near) */ {
1639 switch (c->op_bytes) {
1641 rel = insn_fetch(s16, 2, c->eip);
1644 rel = insn_fetch(s32, 4, c->eip);
1647 DPRINTF("Call: Invalid op_bytes\n");
1648 goto cannot_emulate;
1650 c->src.val = (unsigned long) c->eip;
1652 c->op_bytes = c->ad_bytes;
1656 case 0xe9: /* jmp rel */
1657 case 0xeb: /* jmp rel short */
1658 jmp_rel(c, c->src.val);
1659 c->dst.type = OP_NONE; /* Disable writeback. */
1661 case 0xf4: /* hlt */
1662 ctxt->vcpu->arch.halt_request = 1;
1664 case 0xf5: /* cmc */
1665 /* complement carry flag from eflags reg */
1666 ctxt->eflags ^= EFLG_CF;
1667 c->dst.type = OP_NONE; /* Disable writeback. */
1669 case 0xf6 ... 0xf7: /* Grp3 */
1670 rc = emulate_grp3(ctxt, ops);
1674 case 0xf8: /* clc */
1675 ctxt->eflags &= ~EFLG_CF;
1676 c->dst.type = OP_NONE; /* Disable writeback. */
1678 case 0xfa: /* cli */
1679 ctxt->eflags &= ~X86_EFLAGS_IF;
1680 c->dst.type = OP_NONE; /* Disable writeback. */
1682 case 0xfb: /* sti */
1683 ctxt->eflags |= X86_EFLAGS_IF;
1684 c->dst.type = OP_NONE; /* Disable writeback. */
1686 case 0xfe ... 0xff: /* Grp4/Grp5 */
1687 rc = emulate_grp45(ctxt, ops);
1694 rc = writeback(ctxt, ops);
1698 /* Commit shadow register state. */
1699 memcpy(ctxt->vcpu->arch.regs, c->regs, sizeof c->regs);
1700 ctxt->vcpu->arch.rip = c->eip;
1703 if (rc == X86EMUL_UNHANDLEABLE) {
1711 case 0x01: /* lgdt, lidt, lmsw */
1712 switch (c->modrm_reg) {
1714 unsigned long address;
1716 case 0: /* vmcall */
1717 if (c->modrm_mod != 3 || c->modrm_rm != 1)
1718 goto cannot_emulate;
1720 rc = kvm_fix_hypercall(ctxt->vcpu);
1724 kvm_emulate_hypercall(ctxt->vcpu);
1727 rc = read_descriptor(ctxt, ops, c->src.ptr,
1728 &size, &address, c->op_bytes);
1731 realmode_lgdt(ctxt->vcpu, size, address);
1733 case 3: /* lidt/vmmcall */
1734 if (c->modrm_mod == 3 && c->modrm_rm == 1) {
1735 rc = kvm_fix_hypercall(ctxt->vcpu);
1738 kvm_emulate_hypercall(ctxt->vcpu);
1740 rc = read_descriptor(ctxt, ops, c->src.ptr,
1745 realmode_lidt(ctxt->vcpu, size, address);
1749 if (c->modrm_mod != 3)
1750 goto cannot_emulate;
1751 *(u16 *)&c->regs[c->modrm_rm]
1752 = realmode_get_cr(ctxt->vcpu, 0);
1755 if (c->modrm_mod != 3)
1756 goto cannot_emulate;
1757 realmode_lmsw(ctxt->vcpu, (u16)c->modrm_val,
1761 emulate_invlpg(ctxt->vcpu, memop);
1764 goto cannot_emulate;
1766 /* Disable writeback. */
1767 c->dst.type = OP_NONE;
1770 emulate_clts(ctxt->vcpu);
1771 c->dst.type = OP_NONE;
1773 case 0x08: /* invd */
1774 case 0x09: /* wbinvd */
1775 case 0x0d: /* GrpP (prefetch) */
1776 case 0x18: /* Grp16 (prefetch/nop) */
1777 c->dst.type = OP_NONE;
1779 case 0x20: /* mov cr, reg */
1780 if (c->modrm_mod != 3)
1781 goto cannot_emulate;
1782 c->regs[c->modrm_rm] =
1783 realmode_get_cr(ctxt->vcpu, c->modrm_reg);
1784 c->dst.type = OP_NONE; /* no writeback */
1786 case 0x21: /* mov from dr to reg */
1787 if (c->modrm_mod != 3)
1788 goto cannot_emulate;
1789 rc = emulator_get_dr(ctxt, c->modrm_reg, &c->regs[c->modrm_rm]);
1791 goto cannot_emulate;
1792 c->dst.type = OP_NONE; /* no writeback */
1794 case 0x22: /* mov reg, cr */
1795 if (c->modrm_mod != 3)
1796 goto cannot_emulate;
1797 realmode_set_cr(ctxt->vcpu,
1798 c->modrm_reg, c->modrm_val, &ctxt->eflags);
1799 c->dst.type = OP_NONE;
1801 case 0x23: /* mov from reg to dr */
1802 if (c->modrm_mod != 3)
1803 goto cannot_emulate;
1804 rc = emulator_set_dr(ctxt, c->modrm_reg,
1805 c->regs[c->modrm_rm]);
1807 goto cannot_emulate;
1808 c->dst.type = OP_NONE; /* no writeback */
1812 msr_data = (u32)c->regs[VCPU_REGS_RAX]
1813 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
1814 rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
1816 kvm_inject_gp(ctxt->vcpu, 0);
1817 c->eip = ctxt->vcpu->arch.rip;
1819 rc = X86EMUL_CONTINUE;
1820 c->dst.type = OP_NONE;
1824 rc = kvm_get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data);
1826 kvm_inject_gp(ctxt->vcpu, 0);
1827 c->eip = ctxt->vcpu->arch.rip;
1829 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
1830 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
1832 rc = X86EMUL_CONTINUE;
1833 c->dst.type = OP_NONE;
1835 case 0x40 ... 0x4f: /* cmov */
1836 c->dst.val = c->dst.orig_val = c->src.val;
1837 if (!test_cc(c->b, ctxt->eflags))
1838 c->dst.type = OP_NONE; /* no writeback */
1840 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1843 switch (c->op_bytes) {
1845 rel = insn_fetch(s16, 2, c->eip);
1848 rel = insn_fetch(s32, 4, c->eip);
1851 rel = insn_fetch(s64, 8, c->eip);
1854 DPRINTF("jnz: Invalid op_bytes\n");
1855 goto cannot_emulate;
1857 if (test_cc(c->b, ctxt->eflags))
1859 c->dst.type = OP_NONE;
1864 c->dst.type = OP_NONE;
1865 /* only subword offset */
1866 c->src.val &= (c->dst.bytes << 3) - 1;
1867 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
1871 /* only subword offset */
1872 c->src.val &= (c->dst.bytes << 3) - 1;
1873 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
1875 case 0xb0 ... 0xb1: /* cmpxchg */
1877 * Save real source value, then compare EAX against
1880 c->src.orig_val = c->src.val;
1881 c->src.val = c->regs[VCPU_REGS_RAX];
1882 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1883 if (ctxt->eflags & EFLG_ZF) {
1884 /* Success: write back to memory. */
1885 c->dst.val = c->src.orig_val;
1887 /* Failure: write the value we saw to EAX. */
1888 c->dst.type = OP_REG;
1889 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1894 /* only subword offset */
1895 c->src.val &= (c->dst.bytes << 3) - 1;
1896 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
1898 case 0xb6 ... 0xb7: /* movzx */
1899 c->dst.bytes = c->op_bytes;
1900 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
1903 case 0xba: /* Grp8 */
1904 switch (c->modrm_reg & 3) {
1917 /* only subword offset */
1918 c->src.val &= (c->dst.bytes << 3) - 1;
1919 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
1921 case 0xbe ... 0xbf: /* movsx */
1922 c->dst.bytes = c->op_bytes;
1923 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
1926 case 0xc3: /* movnti */
1927 c->dst.bytes = c->op_bytes;
1928 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
1931 case 0xc7: /* Grp9 (cmpxchg8b) */
1932 rc = emulate_grp9(ctxt, ops, memop);
1935 c->dst.type = OP_NONE;
1941 DPRINTF("Cannot emulate %02x\n", c->b);