1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf(_f , ## _a)
28 #include <linux/kvm_host.h>
29 #define DPRINTF(x...) do {} while (0)
31 #include <linux/module.h>
32 #include <asm/kvm_x86_emulate.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
65 #define MemAbs (1<<9) /* Memory operand is absolute displacement */
66 #define String (1<<10) /* String instruction (rep capable) */
67 #define Stack (1<<11) /* Stack instruction (push/pop) */
68 #define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
69 #define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
70 #define GroupMask 0xff /* Group number stored in bits 0:7 */
72 static u16 opcode_table[256] = {
74 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
75 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
78 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
79 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
82 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
83 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
87 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
90 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
91 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
92 SrcImmByte, SrcImm, 0, 0,
94 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
95 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
98 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
99 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
102 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
103 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
106 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
108 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
110 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
111 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
113 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
114 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
116 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
119 0, 0, ImplicitOps | Mov | Stack, 0,
120 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
121 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
123 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
124 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
126 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
127 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
129 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
130 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
131 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
132 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
134 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
135 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
136 0, ModRM | DstReg, 0, DstMem | SrcNone | ModRM | Mov | Stack,
138 0, 0, 0, 0, 0, 0, 0, 0,
139 0, 0, 0, 0, ImplicitOps | Stack, ImplicitOps | Stack, 0, 0,
141 ByteOp | DstReg | SrcMem | Mov | MemAbs, DstReg | SrcMem | Mov | MemAbs,
142 ByteOp | DstMem | SrcReg | Mov | MemAbs, DstMem | SrcReg | Mov | MemAbs,
143 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
144 ByteOp | ImplicitOps | String, ImplicitOps | String,
146 0, 0, ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
147 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
148 ByteOp | ImplicitOps | String, ImplicitOps | String,
150 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
152 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
153 0, ImplicitOps | Stack, 0, 0,
154 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
156 0, 0, 0, 0, 0, 0, 0, 0,
158 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
159 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
162 0, 0, 0, 0, 0, 0, 0, 0,
164 0, 0, 0, 0, 0, 0, 0, 0,
166 ImplicitOps | Stack, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps,
170 ImplicitOps, ImplicitOps,
171 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
173 ImplicitOps, 0, ImplicitOps, ImplicitOps,
174 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
177 static u16 twobyte_table[256] = {
179 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
180 ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
182 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
184 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
185 0, 0, 0, 0, 0, 0, 0, 0,
187 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
189 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
190 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
191 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
192 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
194 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
195 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
196 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
197 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
199 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
201 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
203 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
205 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
206 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
207 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
208 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
210 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
212 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
214 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
216 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
217 DstMem | SrcReg | ModRM | BitOp,
218 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
219 DstReg | SrcMem16 | ModRM | Mov,
221 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
222 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
223 DstReg | SrcMem16 | ModRM | Mov,
225 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
226 0, 0, 0, 0, 0, 0, 0, 0,
228 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
230 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
232 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
235 static u16 group_table[] = {
238 static u16 group2_table[] = {
241 /* EFLAGS bit definitions. */
242 #define EFLG_OF (1<<11)
243 #define EFLG_DF (1<<10)
244 #define EFLG_SF (1<<7)
245 #define EFLG_ZF (1<<6)
246 #define EFLG_AF (1<<4)
247 #define EFLG_PF (1<<2)
248 #define EFLG_CF (1<<0)
251 * Instruction emulation:
252 * Most instructions are emulated directly via a fragment of inline assembly
253 * code. This allows us to save/restore EFLAGS and thus very easily pick up
254 * any modified flags.
257 #if defined(CONFIG_X86_64)
258 #define _LO32 "k" /* force 32-bit operand */
259 #define _STK "%%rsp" /* stack pointer */
260 #elif defined(__i386__)
261 #define _LO32 "" /* force 32-bit operand */
262 #define _STK "%%esp" /* stack pointer */
266 * These EFLAGS bits are restored from saved value during emulation, and
267 * any changes are written back to the saved value after emulation.
269 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
271 /* Before executing instruction: restore necessary bits in EFLAGS. */
272 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
273 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
274 "movl %"_sav",%"_LO32 _tmp"; " \
277 "movl %"_msk",%"_LO32 _tmp"; " \
278 "andl %"_LO32 _tmp",("_STK"); " \
280 "notl %"_LO32 _tmp"; " \
281 "andl %"_LO32 _tmp",("_STK"); " \
282 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
284 "orl %"_LO32 _tmp",("_STK"); " \
288 /* After executing instruction: write-back necessary bits in EFLAGS. */
289 #define _POST_EFLAGS(_sav, _msk, _tmp) \
290 /* _sav |= EFLAGS & _msk; */ \
293 "andl %"_msk",%"_LO32 _tmp"; " \
294 "orl %"_LO32 _tmp",%"_sav"; "
296 /* Raw emulation: instruction has two explicit operands. */
297 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
299 unsigned long _tmp; \
301 switch ((_dst).bytes) { \
303 __asm__ __volatile__ ( \
304 _PRE_EFLAGS("0", "4", "2") \
305 _op"w %"_wx"3,%1; " \
306 _POST_EFLAGS("0", "4", "2") \
307 : "=m" (_eflags), "=m" ((_dst).val), \
309 : _wy ((_src).val), "i" (EFLAGS_MASK)); \
312 __asm__ __volatile__ ( \
313 _PRE_EFLAGS("0", "4", "2") \
314 _op"l %"_lx"3,%1; " \
315 _POST_EFLAGS("0", "4", "2") \
316 : "=m" (_eflags), "=m" ((_dst).val), \
318 : _ly ((_src).val), "i" (EFLAGS_MASK)); \
321 __emulate_2op_8byte(_op, _src, _dst, \
322 _eflags, _qx, _qy); \
327 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
329 unsigned long _tmp; \
330 switch ((_dst).bytes) { \
332 __asm__ __volatile__ ( \
333 _PRE_EFLAGS("0", "4", "2") \
334 _op"b %"_bx"3,%1; " \
335 _POST_EFLAGS("0", "4", "2") \
336 : "=m" (_eflags), "=m" ((_dst).val), \
338 : _by ((_src).val), "i" (EFLAGS_MASK)); \
341 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
342 _wx, _wy, _lx, _ly, _qx, _qy); \
347 /* Source operand is byte-sized and may be restricted to just %cl. */
348 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
349 __emulate_2op(_op, _src, _dst, _eflags, \
350 "b", "c", "b", "c", "b", "c", "b", "c")
352 /* Source operand is byte, word, long or quad sized. */
353 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
354 __emulate_2op(_op, _src, _dst, _eflags, \
355 "b", "q", "w", "r", _LO32, "r", "", "r")
357 /* Source operand is word, long or quad sized. */
358 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
359 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
360 "w", "r", _LO32, "r", "", "r")
362 /* Instruction has only one explicit operand (no source operand). */
363 #define emulate_1op(_op, _dst, _eflags) \
365 unsigned long _tmp; \
367 switch ((_dst).bytes) { \
369 __asm__ __volatile__ ( \
370 _PRE_EFLAGS("0", "3", "2") \
372 _POST_EFLAGS("0", "3", "2") \
373 : "=m" (_eflags), "=m" ((_dst).val), \
375 : "i" (EFLAGS_MASK)); \
378 __asm__ __volatile__ ( \
379 _PRE_EFLAGS("0", "3", "2") \
381 _POST_EFLAGS("0", "3", "2") \
382 : "=m" (_eflags), "=m" ((_dst).val), \
384 : "i" (EFLAGS_MASK)); \
387 __asm__ __volatile__ ( \
388 _PRE_EFLAGS("0", "3", "2") \
390 _POST_EFLAGS("0", "3", "2") \
391 : "=m" (_eflags), "=m" ((_dst).val), \
393 : "i" (EFLAGS_MASK)); \
396 __emulate_1op_8byte(_op, _dst, _eflags); \
401 /* Emulate an instruction with quadword operands (x86/64 only). */
402 #if defined(CONFIG_X86_64)
403 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
405 __asm__ __volatile__ ( \
406 _PRE_EFLAGS("0", "4", "2") \
407 _op"q %"_qx"3,%1; " \
408 _POST_EFLAGS("0", "4", "2") \
409 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
410 : _qy ((_src).val), "i" (EFLAGS_MASK)); \
413 #define __emulate_1op_8byte(_op, _dst, _eflags) \
415 __asm__ __volatile__ ( \
416 _PRE_EFLAGS("0", "3", "2") \
418 _POST_EFLAGS("0", "3", "2") \
419 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
420 : "i" (EFLAGS_MASK)); \
423 #elif defined(__i386__)
424 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
425 #define __emulate_1op_8byte(_op, _dst, _eflags)
426 #endif /* __i386__ */
428 /* Fetch next part of the instruction being emulated. */
429 #define insn_fetch(_type, _size, _eip) \
430 ({ unsigned long _x; \
431 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
438 /* Access/update address held in a register, based on addressing mode. */
439 #define address_mask(reg) \
440 ((c->ad_bytes == sizeof(unsigned long)) ? \
441 (reg) : ((reg) & ((1UL << (c->ad_bytes << 3)) - 1)))
442 #define register_address(base, reg) \
443 ((base) + address_mask(reg))
444 #define register_address_increment(reg, inc) \
446 /* signed type ensures sign extension to long */ \
448 if (c->ad_bytes == sizeof(unsigned long)) \
452 ~((1UL << (c->ad_bytes << 3)) - 1)) | \
454 ((1UL << (c->ad_bytes << 3)) - 1)); \
457 #define JMP_REL(rel) \
459 register_address_increment(c->eip, rel); \
462 static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
463 struct x86_emulate_ops *ops,
464 unsigned long linear, u8 *dest)
466 struct fetch_cache *fc = &ctxt->decode.fetch;
470 if (linear < fc->start || linear >= fc->end) {
471 size = min(15UL, PAGE_SIZE - offset_in_page(linear));
472 rc = ops->read_std(linear, fc->data, size, ctxt->vcpu);
476 fc->end = linear + size;
478 *dest = fc->data[linear - fc->start];
482 static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
483 struct x86_emulate_ops *ops,
484 unsigned long eip, void *dest, unsigned size)
488 eip += ctxt->cs_base;
490 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
498 * Given the 'reg' portion of a ModRM byte, and a register block, return a
499 * pointer into the block that addresses the relevant register.
500 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
502 static void *decode_register(u8 modrm_reg, unsigned long *regs,
507 p = ®s[modrm_reg];
508 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
509 p = (unsigned char *)®s[modrm_reg & 3] + 1;
513 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
514 struct x86_emulate_ops *ops,
516 u16 *size, unsigned long *address, int op_bytes)
523 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
527 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
532 static int test_cc(unsigned int condition, unsigned int flags)
536 switch ((condition & 15) >> 1) {
538 rc |= (flags & EFLG_OF);
540 case 1: /* b/c/nae */
541 rc |= (flags & EFLG_CF);
544 rc |= (flags & EFLG_ZF);
547 rc |= (flags & (EFLG_CF|EFLG_ZF));
550 rc |= (flags & EFLG_SF);
553 rc |= (flags & EFLG_PF);
556 rc |= (flags & EFLG_ZF);
559 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
563 /* Odd condition identifiers (lsb == 1) have inverted sense. */
564 return (!!rc ^ (condition & 1));
567 static void decode_register_operand(struct operand *op,
568 struct decode_cache *c,
571 unsigned reg = c->modrm_reg;
572 int highbyte_regs = c->rex_prefix == 0;
575 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
577 if ((c->d & ByteOp) && !inhibit_bytereg) {
578 op->ptr = decode_register(reg, c->regs, highbyte_regs);
579 op->val = *(u8 *)op->ptr;
582 op->ptr = decode_register(reg, c->regs, 0);
583 op->bytes = c->op_bytes;
586 op->val = *(u16 *)op->ptr;
589 op->val = *(u32 *)op->ptr;
592 op->val = *(u64 *) op->ptr;
596 op->orig_val = op->val;
599 static int decode_modrm(struct x86_emulate_ctxt *ctxt,
600 struct x86_emulate_ops *ops)
602 struct decode_cache *c = &ctxt->decode;
604 int index_reg = 0, base_reg = 0, scale, rip_relative = 0;
608 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
609 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
610 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
613 c->modrm = insn_fetch(u8, 1, c->eip);
614 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
615 c->modrm_reg |= (c->modrm & 0x38) >> 3;
616 c->modrm_rm |= (c->modrm & 0x07);
620 if (c->modrm_mod == 3) {
621 c->modrm_val = *(unsigned long *)
622 decode_register(c->modrm_rm, c->regs, c->d & ByteOp);
626 if (c->ad_bytes == 2) {
627 unsigned bx = c->regs[VCPU_REGS_RBX];
628 unsigned bp = c->regs[VCPU_REGS_RBP];
629 unsigned si = c->regs[VCPU_REGS_RSI];
630 unsigned di = c->regs[VCPU_REGS_RDI];
632 /* 16-bit ModR/M decode. */
633 switch (c->modrm_mod) {
635 if (c->modrm_rm == 6)
636 c->modrm_ea += insn_fetch(u16, 2, c->eip);
639 c->modrm_ea += insn_fetch(s8, 1, c->eip);
642 c->modrm_ea += insn_fetch(u16, 2, c->eip);
645 switch (c->modrm_rm) {
647 c->modrm_ea += bx + si;
650 c->modrm_ea += bx + di;
653 c->modrm_ea += bp + si;
656 c->modrm_ea += bp + di;
665 if (c->modrm_mod != 0)
672 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
673 (c->modrm_rm == 6 && c->modrm_mod != 0))
674 if (!c->override_base)
675 c->override_base = &ctxt->ss_base;
676 c->modrm_ea = (u16)c->modrm_ea;
678 /* 32/64-bit ModR/M decode. */
679 switch (c->modrm_rm) {
682 sib = insn_fetch(u8, 1, c->eip);
683 index_reg |= (sib >> 3) & 7;
689 if (c->modrm_mod != 0)
690 c->modrm_ea += c->regs[base_reg];
693 insn_fetch(s32, 4, c->eip);
696 c->modrm_ea += c->regs[base_reg];
702 c->modrm_ea += c->regs[index_reg] << scale;
706 if (c->modrm_mod != 0)
707 c->modrm_ea += c->regs[c->modrm_rm];
708 else if (ctxt->mode == X86EMUL_MODE_PROT64)
712 c->modrm_ea += c->regs[c->modrm_rm];
715 switch (c->modrm_mod) {
717 if (c->modrm_rm == 5)
718 c->modrm_ea += insn_fetch(s32, 4, c->eip);
721 c->modrm_ea += insn_fetch(s8, 1, c->eip);
724 c->modrm_ea += insn_fetch(s32, 4, c->eip);
729 c->modrm_ea += c->eip;
730 switch (c->d & SrcMask) {
738 if (c->op_bytes == 8)
741 c->modrm_ea += c->op_bytes;
748 static int decode_abs(struct x86_emulate_ctxt *ctxt,
749 struct x86_emulate_ops *ops)
751 struct decode_cache *c = &ctxt->decode;
754 switch (c->ad_bytes) {
756 c->modrm_ea = insn_fetch(u16, 2, c->eip);
759 c->modrm_ea = insn_fetch(u32, 4, c->eip);
762 c->modrm_ea = insn_fetch(u64, 8, c->eip);
770 x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
772 struct decode_cache *c = &ctxt->decode;
774 int mode = ctxt->mode;
775 int def_op_bytes, def_ad_bytes, group;
777 /* Shadow copy of register state. Committed on successful emulation. */
779 memset(c, 0, sizeof(struct decode_cache));
780 c->eip = ctxt->vcpu->arch.rip;
781 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
784 case X86EMUL_MODE_REAL:
785 case X86EMUL_MODE_PROT16:
786 def_op_bytes = def_ad_bytes = 2;
788 case X86EMUL_MODE_PROT32:
789 def_op_bytes = def_ad_bytes = 4;
792 case X86EMUL_MODE_PROT64:
801 c->op_bytes = def_op_bytes;
802 c->ad_bytes = def_ad_bytes;
804 /* Legacy prefixes. */
806 switch (c->b = insn_fetch(u8, 1, c->eip)) {
807 case 0x66: /* operand-size override */
808 /* switch between 2/4 bytes */
809 c->op_bytes = def_op_bytes ^ 6;
811 case 0x67: /* address-size override */
812 if (mode == X86EMUL_MODE_PROT64)
813 /* switch between 4/8 bytes */
814 c->ad_bytes = def_ad_bytes ^ 12;
816 /* switch between 2/4 bytes */
817 c->ad_bytes = def_ad_bytes ^ 6;
819 case 0x2e: /* CS override */
820 c->override_base = &ctxt->cs_base;
822 case 0x3e: /* DS override */
823 c->override_base = &ctxt->ds_base;
825 case 0x26: /* ES override */
826 c->override_base = &ctxt->es_base;
828 case 0x64: /* FS override */
829 c->override_base = &ctxt->fs_base;
831 case 0x65: /* GS override */
832 c->override_base = &ctxt->gs_base;
834 case 0x36: /* SS override */
835 c->override_base = &ctxt->ss_base;
837 case 0x40 ... 0x4f: /* REX */
838 if (mode != X86EMUL_MODE_PROT64)
840 c->rex_prefix = c->b;
842 case 0xf0: /* LOCK */
845 case 0xf2: /* REPNE/REPNZ */
846 c->rep_prefix = REPNE_PREFIX;
848 case 0xf3: /* REP/REPE/REPZ */
849 c->rep_prefix = REPE_PREFIX;
855 /* Any legacy prefix after a REX prefix nullifies its effect. */
864 if (c->rex_prefix & 8)
865 c->op_bytes = 8; /* REX.W */
867 /* Opcode byte(s). */
868 c->d = opcode_table[c->b];
870 /* Two-byte opcode? */
873 c->b = insn_fetch(u8, 1, c->eip);
874 c->d = twobyte_table[c->b];
879 group = c->d & GroupMask;
880 c->modrm = insn_fetch(u8, 1, c->eip);
883 group = (group << 3) + ((c->modrm >> 3) & 7);
884 if ((c->d & GroupDual) && (c->modrm >> 6) == 3)
885 c->d = group2_table[group];
887 c->d = group_table[group];
892 DPRINTF("Cannot emulate %02x\n", c->b);
896 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
899 /* ModRM and SIB bytes. */
901 rc = decode_modrm(ctxt, ops);
902 else if (c->d & MemAbs)
903 rc = decode_abs(ctxt, ops);
907 if (!c->override_base)
908 c->override_base = &ctxt->ds_base;
909 if (mode == X86EMUL_MODE_PROT64 &&
910 c->override_base != &ctxt->fs_base &&
911 c->override_base != &ctxt->gs_base)
912 c->override_base = NULL;
914 if (c->override_base)
915 c->modrm_ea += *c->override_base;
917 if (c->ad_bytes != 8)
918 c->modrm_ea = (u32)c->modrm_ea;
920 * Decode and fetch the source operand: register, memory
923 switch (c->d & SrcMask) {
927 decode_register_operand(&c->src, c, 0);
936 c->src.bytes = (c->d & ByteOp) ? 1 :
938 /* Don't fetch the address for invlpg: it could be unmapped. */
939 if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
943 * For instructions with a ModR/M byte, switch to register
946 if ((c->d & ModRM) && c->modrm_mod == 3) {
947 c->src.type = OP_REG;
950 c->src.type = OP_MEM;
953 c->src.type = OP_IMM;
954 c->src.ptr = (unsigned long *)c->eip;
955 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
956 if (c->src.bytes == 8)
958 /* NB. Immediates are sign-extended as necessary. */
959 switch (c->src.bytes) {
961 c->src.val = insn_fetch(s8, 1, c->eip);
964 c->src.val = insn_fetch(s16, 2, c->eip);
967 c->src.val = insn_fetch(s32, 4, c->eip);
972 c->src.type = OP_IMM;
973 c->src.ptr = (unsigned long *)c->eip;
975 c->src.val = insn_fetch(s8, 1, c->eip);
979 /* Decode and fetch the destination operand: register or memory. */
980 switch (c->d & DstMask) {
982 /* Special instructions do their own operand decoding. */
985 decode_register_operand(&c->dst, c,
986 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
989 if ((c->d & ModRM) && c->modrm_mod == 3) {
990 c->dst.type = OP_REG;
993 c->dst.type = OP_MEM;
998 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1001 static inline void emulate_push(struct x86_emulate_ctxt *ctxt)
1003 struct decode_cache *c = &ctxt->decode;
1005 c->dst.type = OP_MEM;
1006 c->dst.bytes = c->op_bytes;
1007 c->dst.val = c->src.val;
1008 register_address_increment(c->regs[VCPU_REGS_RSP], -c->op_bytes);
1009 c->dst.ptr = (void *) register_address(ctxt->ss_base,
1010 c->regs[VCPU_REGS_RSP]);
1013 static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
1014 struct x86_emulate_ops *ops)
1016 struct decode_cache *c = &ctxt->decode;
1019 rc = ops->read_std(register_address(ctxt->ss_base,
1020 c->regs[VCPU_REGS_RSP]),
1021 &c->dst.val, c->dst.bytes, ctxt->vcpu);
1025 register_address_increment(c->regs[VCPU_REGS_RSP], c->dst.bytes);
1030 static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
1032 struct decode_cache *c = &ctxt->decode;
1033 switch (c->modrm_reg) {
1035 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
1038 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
1041 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
1044 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
1046 case 4: /* sal/shl */
1047 case 6: /* sal/shl */
1048 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
1051 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
1054 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
1059 static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
1060 struct x86_emulate_ops *ops)
1062 struct decode_cache *c = &ctxt->decode;
1065 switch (c->modrm_reg) {
1066 case 0 ... 1: /* test */
1068 * Special case in Grp3: test has an immediate
1071 c->src.type = OP_IMM;
1072 c->src.ptr = (unsigned long *)c->eip;
1073 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1074 if (c->src.bytes == 8)
1076 switch (c->src.bytes) {
1078 c->src.val = insn_fetch(s8, 1, c->eip);
1081 c->src.val = insn_fetch(s16, 2, c->eip);
1084 c->src.val = insn_fetch(s32, 4, c->eip);
1087 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1090 c->dst.val = ~c->dst.val;
1093 emulate_1op("neg", c->dst, ctxt->eflags);
1096 DPRINTF("Cannot emulate %02x\n", c->b);
1097 rc = X86EMUL_UNHANDLEABLE;
1104 static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
1105 struct x86_emulate_ops *ops)
1107 struct decode_cache *c = &ctxt->decode;
1110 switch (c->modrm_reg) {
1112 emulate_1op("inc", c->dst, ctxt->eflags);
1115 emulate_1op("dec", c->dst, ctxt->eflags);
1117 case 4: /* jmp abs */
1119 c->eip = c->dst.val;
1121 DPRINTF("Cannot emulate %02x\n", c->b);
1122 return X86EMUL_UNHANDLEABLE;
1127 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1129 if (ctxt->mode == X86EMUL_MODE_PROT64) {
1131 rc = ops->read_std((unsigned long)c->dst.ptr,
1132 &c->dst.val, 8, ctxt->vcpu);
1136 register_address_increment(c->regs[VCPU_REGS_RSP],
1138 rc = ops->write_emulated(register_address(ctxt->ss_base,
1139 c->regs[VCPU_REGS_RSP]), &c->dst.val,
1140 c->dst.bytes, ctxt->vcpu);
1143 c->dst.type = OP_NONE;
1146 DPRINTF("Cannot emulate %02x\n", c->b);
1147 return X86EMUL_UNHANDLEABLE;
1152 static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
1153 struct x86_emulate_ops *ops,
1154 unsigned long memop)
1156 struct decode_cache *c = &ctxt->decode;
1160 rc = ops->read_emulated(memop, &old, 8, ctxt->vcpu);
1164 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1165 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
1167 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1168 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1169 ctxt->eflags &= ~EFLG_ZF;
1172 new = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1173 (u32) c->regs[VCPU_REGS_RBX];
1175 rc = ops->cmpxchg_emulated(memop, &old, &new, 8, ctxt->vcpu);
1178 ctxt->eflags |= EFLG_ZF;
1183 static inline int writeback(struct x86_emulate_ctxt *ctxt,
1184 struct x86_emulate_ops *ops)
1187 struct decode_cache *c = &ctxt->decode;
1189 switch (c->dst.type) {
1191 /* The 4-byte case *is* correct:
1192 * in 64-bit mode we zero-extend.
1194 switch (c->dst.bytes) {
1196 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1199 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1202 *c->dst.ptr = (u32)c->dst.val;
1203 break; /* 64b: zero-ext */
1205 *c->dst.ptr = c->dst.val;
1211 rc = ops->cmpxchg_emulated(
1212 (unsigned long)c->dst.ptr,
1218 rc = ops->write_emulated(
1219 (unsigned long)c->dst.ptr,
1236 x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1238 unsigned long memop = 0;
1240 unsigned long saved_eip = 0;
1241 struct decode_cache *c = &ctxt->decode;
1244 /* Shadow copy of register state. Committed on successful emulation.
1245 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
1249 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
1252 if (((c->d & ModRM) && (c->modrm_mod != 3)) || (c->d & MemAbs))
1253 memop = c->modrm_ea;
1255 if (c->rep_prefix && (c->d & String)) {
1256 /* All REP prefixes have the same first termination condition */
1257 if (c->regs[VCPU_REGS_RCX] == 0) {
1258 ctxt->vcpu->arch.rip = c->eip;
1261 /* The second termination condition only applies for REPE
1262 * and REPNE. Test if the repeat string operation prefix is
1263 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
1264 * corresponding termination condition according to:
1265 * - if REPE/REPZ and ZF = 0 then done
1266 * - if REPNE/REPNZ and ZF = 1 then done
1268 if ((c->b == 0xa6) || (c->b == 0xa7) ||
1269 (c->b == 0xae) || (c->b == 0xaf)) {
1270 if ((c->rep_prefix == REPE_PREFIX) &&
1271 ((ctxt->eflags & EFLG_ZF) == 0)) {
1272 ctxt->vcpu->arch.rip = c->eip;
1275 if ((c->rep_prefix == REPNE_PREFIX) &&
1276 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF)) {
1277 ctxt->vcpu->arch.rip = c->eip;
1281 c->regs[VCPU_REGS_RCX]--;
1282 c->eip = ctxt->vcpu->arch.rip;
1285 if (c->src.type == OP_MEM) {
1286 c->src.ptr = (unsigned long *)memop;
1288 rc = ops->read_emulated((unsigned long)c->src.ptr,
1294 c->src.orig_val = c->src.val;
1297 if ((c->d & DstMask) == ImplicitOps)
1301 if (c->dst.type == OP_MEM) {
1302 c->dst.ptr = (unsigned long *)memop;
1303 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1306 unsigned long mask = ~(c->dst.bytes * 8 - 1);
1308 c->dst.ptr = (void *)c->dst.ptr +
1309 (c->src.val & mask) / 8;
1311 if (!(c->d & Mov) &&
1312 /* optimisation - avoid slow emulated read */
1313 ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1315 c->dst.bytes, ctxt->vcpu)) != 0))
1318 c->dst.orig_val = c->dst.val;
1328 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
1332 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
1336 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
1340 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
1344 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
1346 case 0x24: /* and al imm8 */
1347 c->dst.type = OP_REG;
1348 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1349 c->dst.val = *(u8 *)c->dst.ptr;
1351 c->dst.orig_val = c->dst.val;
1353 case 0x25: /* and ax imm16, or eax imm32 */
1354 c->dst.type = OP_REG;
1355 c->dst.bytes = c->op_bytes;
1356 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1357 if (c->op_bytes == 2)
1358 c->dst.val = *(u16 *)c->dst.ptr;
1360 c->dst.val = *(u32 *)c->dst.ptr;
1361 c->dst.orig_val = c->dst.val;
1365 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
1369 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
1373 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1375 case 0x40 ... 0x47: /* inc r16/r32 */
1376 emulate_1op("inc", c->dst, ctxt->eflags);
1378 case 0x48 ... 0x4f: /* dec r16/r32 */
1379 emulate_1op("dec", c->dst, ctxt->eflags);
1381 case 0x50 ... 0x57: /* push reg */
1382 c->dst.type = OP_MEM;
1383 c->dst.bytes = c->op_bytes;
1384 c->dst.val = c->src.val;
1385 register_address_increment(c->regs[VCPU_REGS_RSP],
1387 c->dst.ptr = (void *) register_address(
1388 ctxt->ss_base, c->regs[VCPU_REGS_RSP]);
1390 case 0x58 ... 0x5f: /* pop reg */
1392 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1393 c->regs[VCPU_REGS_RSP]), c->dst.ptr,
1394 c->op_bytes, ctxt->vcpu)) != 0)
1397 register_address_increment(c->regs[VCPU_REGS_RSP],
1399 c->dst.type = OP_NONE; /* Disable writeback. */
1401 case 0x63: /* movsxd */
1402 if (ctxt->mode != X86EMUL_MODE_PROT64)
1403 goto cannot_emulate;
1404 c->dst.val = (s32) c->src.val;
1406 case 0x6a: /* push imm8 */
1408 c->src.val = insn_fetch(s8, 1, c->eip);
1411 case 0x6c: /* insb */
1412 case 0x6d: /* insw/insd */
1413 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1415 (c->d & ByteOp) ? 1 : c->op_bytes,
1417 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1418 (ctxt->eflags & EFLG_DF),
1419 register_address(ctxt->es_base,
1420 c->regs[VCPU_REGS_RDI]),
1422 c->regs[VCPU_REGS_RDX]) == 0) {
1427 case 0x6e: /* outsb */
1428 case 0x6f: /* outsw/outsd */
1429 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1431 (c->d & ByteOp) ? 1 : c->op_bytes,
1433 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1434 (ctxt->eflags & EFLG_DF),
1435 register_address(c->override_base ?
1438 c->regs[VCPU_REGS_RSI]),
1440 c->regs[VCPU_REGS_RDX]) == 0) {
1445 case 0x70 ... 0x7f: /* jcc (short) */ {
1446 int rel = insn_fetch(s8, 1, c->eip);
1448 if (test_cc(c->b, ctxt->eflags))
1452 case 0x80 ... 0x83: /* Grp1 */
1453 switch (c->modrm_reg) {
1473 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1475 case 0x86 ... 0x87: /* xchg */
1476 /* Write back the register source. */
1477 switch (c->dst.bytes) {
1479 *(u8 *) c->src.ptr = (u8) c->dst.val;
1482 *(u16 *) c->src.ptr = (u16) c->dst.val;
1485 *c->src.ptr = (u32) c->dst.val;
1486 break; /* 64b reg: zero-extend */
1488 *c->src.ptr = c->dst.val;
1492 * Write back the memory destination with implicit LOCK
1495 c->dst.val = c->src.val;
1498 case 0x88 ... 0x8b: /* mov */
1500 case 0x8d: /* lea r16/r32, m */
1501 c->dst.val = c->modrm_val;
1503 case 0x8f: /* pop (sole member of Grp1a) */
1504 rc = emulate_grp1a(ctxt, ops);
1508 case 0x9c: /* pushf */
1509 c->src.val = (unsigned long) ctxt->eflags;
1512 case 0x9d: /* popf */
1513 c->dst.ptr = (unsigned long *) &ctxt->eflags;
1514 goto pop_instruction;
1515 case 0xa0 ... 0xa1: /* mov */
1516 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1517 c->dst.val = c->src.val;
1519 case 0xa2 ... 0xa3: /* mov */
1520 c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
1522 case 0xa4 ... 0xa5: /* movs */
1523 c->dst.type = OP_MEM;
1524 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1525 c->dst.ptr = (unsigned long *)register_address(
1527 c->regs[VCPU_REGS_RDI]);
1528 if ((rc = ops->read_emulated(register_address(
1529 c->override_base ? *c->override_base :
1531 c->regs[VCPU_REGS_RSI]),
1533 c->dst.bytes, ctxt->vcpu)) != 0)
1535 register_address_increment(c->regs[VCPU_REGS_RSI],
1536 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1538 register_address_increment(c->regs[VCPU_REGS_RDI],
1539 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1542 case 0xa6 ... 0xa7: /* cmps */
1543 c->src.type = OP_NONE; /* Disable writeback. */
1544 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1545 c->src.ptr = (unsigned long *)register_address(
1546 c->override_base ? *c->override_base :
1548 c->regs[VCPU_REGS_RSI]);
1549 if ((rc = ops->read_emulated((unsigned long)c->src.ptr,
1555 c->dst.type = OP_NONE; /* Disable writeback. */
1556 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1557 c->dst.ptr = (unsigned long *)register_address(
1559 c->regs[VCPU_REGS_RDI]);
1560 if ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1566 DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c->src.ptr, c->dst.ptr);
1568 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1570 register_address_increment(c->regs[VCPU_REGS_RSI],
1571 (ctxt->eflags & EFLG_DF) ? -c->src.bytes
1573 register_address_increment(c->regs[VCPU_REGS_RDI],
1574 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1578 case 0xaa ... 0xab: /* stos */
1579 c->dst.type = OP_MEM;
1580 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1581 c->dst.ptr = (unsigned long *)register_address(
1583 c->regs[VCPU_REGS_RDI]);
1584 c->dst.val = c->regs[VCPU_REGS_RAX];
1585 register_address_increment(c->regs[VCPU_REGS_RDI],
1586 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1589 case 0xac ... 0xad: /* lods */
1590 c->dst.type = OP_REG;
1591 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1592 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1593 if ((rc = ops->read_emulated(register_address(
1594 c->override_base ? *c->override_base :
1596 c->regs[VCPU_REGS_RSI]),
1601 register_address_increment(c->regs[VCPU_REGS_RSI],
1602 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1605 case 0xae ... 0xaf: /* scas */
1606 DPRINTF("Urk! I don't handle SCAS.\n");
1607 goto cannot_emulate;
1611 case 0xc3: /* ret */
1612 c->dst.ptr = &c->eip;
1613 goto pop_instruction;
1614 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1616 c->dst.val = c->src.val;
1618 case 0xd0 ... 0xd1: /* Grp2 */
1622 case 0xd2 ... 0xd3: /* Grp2 */
1623 c->src.val = c->regs[VCPU_REGS_RCX];
1626 case 0xe8: /* call (near) */ {
1628 switch (c->op_bytes) {
1630 rel = insn_fetch(s16, 2, c->eip);
1633 rel = insn_fetch(s32, 4, c->eip);
1636 DPRINTF("Call: Invalid op_bytes\n");
1637 goto cannot_emulate;
1639 c->src.val = (unsigned long) c->eip;
1641 c->op_bytes = c->ad_bytes;
1645 case 0xe9: /* jmp rel */
1646 case 0xeb: /* jmp rel short */
1647 JMP_REL(c->src.val);
1648 c->dst.type = OP_NONE; /* Disable writeback. */
1650 case 0xf4: /* hlt */
1651 ctxt->vcpu->arch.halt_request = 1;
1653 case 0xf5: /* cmc */
1654 /* complement carry flag from eflags reg */
1655 ctxt->eflags ^= EFLG_CF;
1656 c->dst.type = OP_NONE; /* Disable writeback. */
1658 case 0xf6 ... 0xf7: /* Grp3 */
1659 rc = emulate_grp3(ctxt, ops);
1663 case 0xf8: /* clc */
1664 ctxt->eflags &= ~EFLG_CF;
1665 c->dst.type = OP_NONE; /* Disable writeback. */
1667 case 0xfa: /* cli */
1668 ctxt->eflags &= ~X86_EFLAGS_IF;
1669 c->dst.type = OP_NONE; /* Disable writeback. */
1671 case 0xfb: /* sti */
1672 ctxt->eflags |= X86_EFLAGS_IF;
1673 c->dst.type = OP_NONE; /* Disable writeback. */
1675 case 0xfe ... 0xff: /* Grp4/Grp5 */
1676 rc = emulate_grp45(ctxt, ops);
1683 rc = writeback(ctxt, ops);
1687 /* Commit shadow register state. */
1688 memcpy(ctxt->vcpu->arch.regs, c->regs, sizeof c->regs);
1689 ctxt->vcpu->arch.rip = c->eip;
1692 if (rc == X86EMUL_UNHANDLEABLE) {
1700 case 0x01: /* lgdt, lidt, lmsw */
1701 switch (c->modrm_reg) {
1703 unsigned long address;
1705 case 0: /* vmcall */
1706 if (c->modrm_mod != 3 || c->modrm_rm != 1)
1707 goto cannot_emulate;
1709 rc = kvm_fix_hypercall(ctxt->vcpu);
1713 kvm_emulate_hypercall(ctxt->vcpu);
1716 rc = read_descriptor(ctxt, ops, c->src.ptr,
1717 &size, &address, c->op_bytes);
1720 realmode_lgdt(ctxt->vcpu, size, address);
1722 case 3: /* lidt/vmmcall */
1723 if (c->modrm_mod == 3 && c->modrm_rm == 1) {
1724 rc = kvm_fix_hypercall(ctxt->vcpu);
1727 kvm_emulate_hypercall(ctxt->vcpu);
1729 rc = read_descriptor(ctxt, ops, c->src.ptr,
1734 realmode_lidt(ctxt->vcpu, size, address);
1738 if (c->modrm_mod != 3)
1739 goto cannot_emulate;
1740 *(u16 *)&c->regs[c->modrm_rm]
1741 = realmode_get_cr(ctxt->vcpu, 0);
1744 if (c->modrm_mod != 3)
1745 goto cannot_emulate;
1746 realmode_lmsw(ctxt->vcpu, (u16)c->modrm_val,
1750 emulate_invlpg(ctxt->vcpu, memop);
1753 goto cannot_emulate;
1755 /* Disable writeback. */
1756 c->dst.type = OP_NONE;
1759 emulate_clts(ctxt->vcpu);
1760 c->dst.type = OP_NONE;
1762 case 0x08: /* invd */
1763 case 0x09: /* wbinvd */
1764 case 0x0d: /* GrpP (prefetch) */
1765 case 0x18: /* Grp16 (prefetch/nop) */
1766 c->dst.type = OP_NONE;
1768 case 0x20: /* mov cr, reg */
1769 if (c->modrm_mod != 3)
1770 goto cannot_emulate;
1771 c->regs[c->modrm_rm] =
1772 realmode_get_cr(ctxt->vcpu, c->modrm_reg);
1773 c->dst.type = OP_NONE; /* no writeback */
1775 case 0x21: /* mov from dr to reg */
1776 if (c->modrm_mod != 3)
1777 goto cannot_emulate;
1778 rc = emulator_get_dr(ctxt, c->modrm_reg, &c->regs[c->modrm_rm]);
1780 goto cannot_emulate;
1781 c->dst.type = OP_NONE; /* no writeback */
1783 case 0x22: /* mov reg, cr */
1784 if (c->modrm_mod != 3)
1785 goto cannot_emulate;
1786 realmode_set_cr(ctxt->vcpu,
1787 c->modrm_reg, c->modrm_val, &ctxt->eflags);
1788 c->dst.type = OP_NONE;
1790 case 0x23: /* mov from reg to dr */
1791 if (c->modrm_mod != 3)
1792 goto cannot_emulate;
1793 rc = emulator_set_dr(ctxt, c->modrm_reg,
1794 c->regs[c->modrm_rm]);
1796 goto cannot_emulate;
1797 c->dst.type = OP_NONE; /* no writeback */
1801 msr_data = (u32)c->regs[VCPU_REGS_RAX]
1802 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
1803 rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
1805 kvm_inject_gp(ctxt->vcpu, 0);
1806 c->eip = ctxt->vcpu->arch.rip;
1808 rc = X86EMUL_CONTINUE;
1809 c->dst.type = OP_NONE;
1813 rc = kvm_get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data);
1815 kvm_inject_gp(ctxt->vcpu, 0);
1816 c->eip = ctxt->vcpu->arch.rip;
1818 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
1819 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
1821 rc = X86EMUL_CONTINUE;
1822 c->dst.type = OP_NONE;
1824 case 0x40 ... 0x4f: /* cmov */
1825 c->dst.val = c->dst.orig_val = c->src.val;
1826 if (!test_cc(c->b, ctxt->eflags))
1827 c->dst.type = OP_NONE; /* no writeback */
1829 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1832 switch (c->op_bytes) {
1834 rel = insn_fetch(s16, 2, c->eip);
1837 rel = insn_fetch(s32, 4, c->eip);
1840 rel = insn_fetch(s64, 8, c->eip);
1843 DPRINTF("jnz: Invalid op_bytes\n");
1844 goto cannot_emulate;
1846 if (test_cc(c->b, ctxt->eflags))
1848 c->dst.type = OP_NONE;
1853 c->dst.type = OP_NONE;
1854 /* only subword offset */
1855 c->src.val &= (c->dst.bytes << 3) - 1;
1856 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
1860 /* only subword offset */
1861 c->src.val &= (c->dst.bytes << 3) - 1;
1862 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
1864 case 0xb0 ... 0xb1: /* cmpxchg */
1866 * Save real source value, then compare EAX against
1869 c->src.orig_val = c->src.val;
1870 c->src.val = c->regs[VCPU_REGS_RAX];
1871 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1872 if (ctxt->eflags & EFLG_ZF) {
1873 /* Success: write back to memory. */
1874 c->dst.val = c->src.orig_val;
1876 /* Failure: write the value we saw to EAX. */
1877 c->dst.type = OP_REG;
1878 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1883 /* only subword offset */
1884 c->src.val &= (c->dst.bytes << 3) - 1;
1885 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
1887 case 0xb6 ... 0xb7: /* movzx */
1888 c->dst.bytes = c->op_bytes;
1889 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
1892 case 0xba: /* Grp8 */
1893 switch (c->modrm_reg & 3) {
1906 /* only subword offset */
1907 c->src.val &= (c->dst.bytes << 3) - 1;
1908 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
1910 case 0xbe ... 0xbf: /* movsx */
1911 c->dst.bytes = c->op_bytes;
1912 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
1915 case 0xc3: /* movnti */
1916 c->dst.bytes = c->op_bytes;
1917 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
1920 case 0xc7: /* Grp9 (cmpxchg8b) */
1921 rc = emulate_grp9(ctxt, ops, memop);
1924 c->dst.type = OP_NONE;
1930 DPRINTF("Cannot emulate %02x\n", c->b);