1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf(_f , ## _a)
28 #include <linux/kvm_host.h>
29 #define DPRINTF(x...) do {} while (0)
31 #include <linux/module.h>
32 #include <asm/kvm_x86_emulate.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
65 #define MemAbs (1<<9) /* Memory operand is absolute displacement */
66 #define String (1<<10) /* String instruction (rep capable) */
67 #define Stack (1<<11) /* Stack instruction (push/pop) */
68 #define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
69 #define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
70 #define GroupMask 0xff /* Group number stored in bits 0:7 */
73 Group1_80, Group1_81, Group1_82, Group1_83,
74 Group1A, Group3_Byte, Group3, Group4, Group5, Group7,
77 static u16 opcode_table[256] = {
79 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
80 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
83 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
84 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
87 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
88 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
91 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
92 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
95 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
96 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
97 SrcImmByte, SrcImm, 0, 0,
99 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
100 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
103 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
104 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
107 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
108 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
111 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
113 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
115 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
116 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
118 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
119 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
121 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
124 0, 0, ImplicitOps | Mov | Stack, 0,
125 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
126 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
128 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
129 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
131 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
132 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
134 Group | Group1_80, Group | Group1_81,
135 Group | Group1_82, Group | Group1_83,
136 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
137 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
139 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
140 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
141 0, ModRM | DstReg, 0, Group | Group1A,
143 0, 0, 0, 0, 0, 0, 0, 0,
144 0, 0, 0, 0, ImplicitOps | Stack, ImplicitOps | Stack, 0, 0,
146 ByteOp | DstReg | SrcMem | Mov | MemAbs, DstReg | SrcMem | Mov | MemAbs,
147 ByteOp | DstMem | SrcReg | Mov | MemAbs, DstMem | SrcReg | Mov | MemAbs,
148 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
149 ByteOp | ImplicitOps | String, ImplicitOps | String,
151 0, 0, ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
152 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
153 ByteOp | ImplicitOps | String, ImplicitOps | String,
155 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
157 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
158 0, ImplicitOps | Stack, 0, 0,
159 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
161 0, 0, 0, 0, 0, 0, 0, 0,
163 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
164 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
167 0, 0, 0, 0, 0, 0, 0, 0,
169 0, 0, 0, 0, 0, 0, 0, 0,
171 ImplicitOps | Stack, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps,
175 ImplicitOps, ImplicitOps, Group | Group3_Byte, Group | Group3,
177 ImplicitOps, 0, ImplicitOps, ImplicitOps,
178 0, 0, Group | Group4, Group | Group5,
181 static u16 twobyte_table[256] = {
183 0, Group | GroupDual | Group7, 0, 0, 0, 0, ImplicitOps, 0,
184 ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
186 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
188 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
189 0, 0, 0, 0, 0, 0, 0, 0,
191 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
193 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
194 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
195 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
196 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
198 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
199 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
200 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
201 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
203 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
205 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
207 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
209 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
210 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
211 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
212 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
214 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
216 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
218 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
220 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
221 DstMem | SrcReg | ModRM | BitOp,
222 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
223 DstReg | SrcMem16 | ModRM | Mov,
225 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
226 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
227 DstReg | SrcMem16 | ModRM | Mov,
229 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
230 0, 0, 0, 0, 0, 0, 0, 0,
232 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
234 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
236 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
239 static u16 group_table[] = {
241 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
242 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
243 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
244 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
246 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
247 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
248 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
249 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
251 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
252 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
253 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
254 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
256 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
257 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
258 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
259 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
261 DstMem | SrcNone | ModRM | Mov | Stack, 0, 0, 0, 0, 0, 0, 0,
263 ByteOp | SrcImm | DstMem | ModRM, 0,
264 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
267 DstMem | SrcImm | ModRM | SrcImm, 0,
268 DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
271 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
274 DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM, 0, 0,
275 SrcMem | ModRM, 0, SrcMem | ModRM | Stack, 0,
277 0, 0, ModRM | SrcMem, ModRM | SrcMem,
278 SrcNone | ModRM | DstMem, 0, SrcMem | ModRM, SrcMem | ModRM | ByteOp,
281 static u16 group2_table[] = {
283 SrcNone | ModRM, 0, 0, 0, SrcNone | ModRM | DstMem, 0, SrcMem | ModRM, 0,
286 /* EFLAGS bit definitions. */
287 #define EFLG_OF (1<<11)
288 #define EFLG_DF (1<<10)
289 #define EFLG_SF (1<<7)
290 #define EFLG_ZF (1<<6)
291 #define EFLG_AF (1<<4)
292 #define EFLG_PF (1<<2)
293 #define EFLG_CF (1<<0)
296 * Instruction emulation:
297 * Most instructions are emulated directly via a fragment of inline assembly
298 * code. This allows us to save/restore EFLAGS and thus very easily pick up
299 * any modified flags.
302 #if defined(CONFIG_X86_64)
303 #define _LO32 "k" /* force 32-bit operand */
304 #define _STK "%%rsp" /* stack pointer */
305 #elif defined(__i386__)
306 #define _LO32 "" /* force 32-bit operand */
307 #define _STK "%%esp" /* stack pointer */
311 * These EFLAGS bits are restored from saved value during emulation, and
312 * any changes are written back to the saved value after emulation.
314 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
316 /* Before executing instruction: restore necessary bits in EFLAGS. */
317 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
318 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
319 "movl %"_sav",%"_LO32 _tmp"; " \
322 "movl %"_msk",%"_LO32 _tmp"; " \
323 "andl %"_LO32 _tmp",("_STK"); " \
325 "notl %"_LO32 _tmp"; " \
326 "andl %"_LO32 _tmp",("_STK"); " \
327 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
329 "orl %"_LO32 _tmp",("_STK"); " \
333 /* After executing instruction: write-back necessary bits in EFLAGS. */
334 #define _POST_EFLAGS(_sav, _msk, _tmp) \
335 /* _sav |= EFLAGS & _msk; */ \
338 "andl %"_msk",%"_LO32 _tmp"; " \
339 "orl %"_LO32 _tmp",%"_sav"; "
341 /* Raw emulation: instruction has two explicit operands. */
342 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
344 unsigned long _tmp; \
346 switch ((_dst).bytes) { \
348 __asm__ __volatile__ ( \
349 _PRE_EFLAGS("0", "4", "2") \
350 _op"w %"_wx"3,%1; " \
351 _POST_EFLAGS("0", "4", "2") \
352 : "=m" (_eflags), "=m" ((_dst).val), \
354 : _wy ((_src).val), "i" (EFLAGS_MASK)); \
357 __asm__ __volatile__ ( \
358 _PRE_EFLAGS("0", "4", "2") \
359 _op"l %"_lx"3,%1; " \
360 _POST_EFLAGS("0", "4", "2") \
361 : "=m" (_eflags), "=m" ((_dst).val), \
363 : _ly ((_src).val), "i" (EFLAGS_MASK)); \
366 __emulate_2op_8byte(_op, _src, _dst, \
367 _eflags, _qx, _qy); \
372 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
374 unsigned long _tmp; \
375 switch ((_dst).bytes) { \
377 __asm__ __volatile__ ( \
378 _PRE_EFLAGS("0", "4", "2") \
379 _op"b %"_bx"3,%1; " \
380 _POST_EFLAGS("0", "4", "2") \
381 : "=m" (_eflags), "=m" ((_dst).val), \
383 : _by ((_src).val), "i" (EFLAGS_MASK)); \
386 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
387 _wx, _wy, _lx, _ly, _qx, _qy); \
392 /* Source operand is byte-sized and may be restricted to just %cl. */
393 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
394 __emulate_2op(_op, _src, _dst, _eflags, \
395 "b", "c", "b", "c", "b", "c", "b", "c")
397 /* Source operand is byte, word, long or quad sized. */
398 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
399 __emulate_2op(_op, _src, _dst, _eflags, \
400 "b", "q", "w", "r", _LO32, "r", "", "r")
402 /* Source operand is word, long or quad sized. */
403 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
404 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
405 "w", "r", _LO32, "r", "", "r")
407 /* Instruction has only one explicit operand (no source operand). */
408 #define emulate_1op(_op, _dst, _eflags) \
410 unsigned long _tmp; \
412 switch ((_dst).bytes) { \
414 __asm__ __volatile__ ( \
415 _PRE_EFLAGS("0", "3", "2") \
417 _POST_EFLAGS("0", "3", "2") \
418 : "=m" (_eflags), "=m" ((_dst).val), \
420 : "i" (EFLAGS_MASK)); \
423 __asm__ __volatile__ ( \
424 _PRE_EFLAGS("0", "3", "2") \
426 _POST_EFLAGS("0", "3", "2") \
427 : "=m" (_eflags), "=m" ((_dst).val), \
429 : "i" (EFLAGS_MASK)); \
432 __asm__ __volatile__ ( \
433 _PRE_EFLAGS("0", "3", "2") \
435 _POST_EFLAGS("0", "3", "2") \
436 : "=m" (_eflags), "=m" ((_dst).val), \
438 : "i" (EFLAGS_MASK)); \
441 __emulate_1op_8byte(_op, _dst, _eflags); \
446 /* Emulate an instruction with quadword operands (x86/64 only). */
447 #if defined(CONFIG_X86_64)
448 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
450 __asm__ __volatile__ ( \
451 _PRE_EFLAGS("0", "4", "2") \
452 _op"q %"_qx"3,%1; " \
453 _POST_EFLAGS("0", "4", "2") \
454 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
455 : _qy ((_src).val), "i" (EFLAGS_MASK)); \
458 #define __emulate_1op_8byte(_op, _dst, _eflags) \
460 __asm__ __volatile__ ( \
461 _PRE_EFLAGS("0", "3", "2") \
463 _POST_EFLAGS("0", "3", "2") \
464 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
465 : "i" (EFLAGS_MASK)); \
468 #elif defined(__i386__)
469 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
470 #define __emulate_1op_8byte(_op, _dst, _eflags)
471 #endif /* __i386__ */
473 /* Fetch next part of the instruction being emulated. */
474 #define insn_fetch(_type, _size, _eip) \
475 ({ unsigned long _x; \
476 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
483 /* Access/update address held in a register, based on addressing mode. */
484 #define address_mask(reg) \
485 ((c->ad_bytes == sizeof(unsigned long)) ? \
486 (reg) : ((reg) & ((1UL << (c->ad_bytes << 3)) - 1)))
487 #define register_address(base, reg) \
488 ((base) + address_mask(reg))
489 #define register_address_increment(reg, inc) \
491 /* signed type ensures sign extension to long */ \
493 if (c->ad_bytes == sizeof(unsigned long)) \
497 ~((1UL << (c->ad_bytes << 3)) - 1)) | \
499 ((1UL << (c->ad_bytes << 3)) - 1)); \
502 #define JMP_REL(rel) \
504 register_address_increment(c->eip, rel); \
507 static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
508 struct x86_emulate_ops *ops,
509 unsigned long linear, u8 *dest)
511 struct fetch_cache *fc = &ctxt->decode.fetch;
515 if (linear < fc->start || linear >= fc->end) {
516 size = min(15UL, PAGE_SIZE - offset_in_page(linear));
517 rc = ops->read_std(linear, fc->data, size, ctxt->vcpu);
521 fc->end = linear + size;
523 *dest = fc->data[linear - fc->start];
527 static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
528 struct x86_emulate_ops *ops,
529 unsigned long eip, void *dest, unsigned size)
533 eip += ctxt->cs_base;
535 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
543 * Given the 'reg' portion of a ModRM byte, and a register block, return a
544 * pointer into the block that addresses the relevant register.
545 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
547 static void *decode_register(u8 modrm_reg, unsigned long *regs,
552 p = ®s[modrm_reg];
553 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
554 p = (unsigned char *)®s[modrm_reg & 3] + 1;
558 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
559 struct x86_emulate_ops *ops,
561 u16 *size, unsigned long *address, int op_bytes)
568 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
572 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
577 static int test_cc(unsigned int condition, unsigned int flags)
581 switch ((condition & 15) >> 1) {
583 rc |= (flags & EFLG_OF);
585 case 1: /* b/c/nae */
586 rc |= (flags & EFLG_CF);
589 rc |= (flags & EFLG_ZF);
592 rc |= (flags & (EFLG_CF|EFLG_ZF));
595 rc |= (flags & EFLG_SF);
598 rc |= (flags & EFLG_PF);
601 rc |= (flags & EFLG_ZF);
604 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
608 /* Odd condition identifiers (lsb == 1) have inverted sense. */
609 return (!!rc ^ (condition & 1));
612 static void decode_register_operand(struct operand *op,
613 struct decode_cache *c,
616 unsigned reg = c->modrm_reg;
617 int highbyte_regs = c->rex_prefix == 0;
620 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
622 if ((c->d & ByteOp) && !inhibit_bytereg) {
623 op->ptr = decode_register(reg, c->regs, highbyte_regs);
624 op->val = *(u8 *)op->ptr;
627 op->ptr = decode_register(reg, c->regs, 0);
628 op->bytes = c->op_bytes;
631 op->val = *(u16 *)op->ptr;
634 op->val = *(u32 *)op->ptr;
637 op->val = *(u64 *) op->ptr;
641 op->orig_val = op->val;
644 static int decode_modrm(struct x86_emulate_ctxt *ctxt,
645 struct x86_emulate_ops *ops)
647 struct decode_cache *c = &ctxt->decode;
649 int index_reg = 0, base_reg = 0, scale, rip_relative = 0;
653 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
654 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
655 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
658 c->modrm = insn_fetch(u8, 1, c->eip);
659 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
660 c->modrm_reg |= (c->modrm & 0x38) >> 3;
661 c->modrm_rm |= (c->modrm & 0x07);
665 if (c->modrm_mod == 3) {
666 c->modrm_val = *(unsigned long *)
667 decode_register(c->modrm_rm, c->regs, c->d & ByteOp);
671 if (c->ad_bytes == 2) {
672 unsigned bx = c->regs[VCPU_REGS_RBX];
673 unsigned bp = c->regs[VCPU_REGS_RBP];
674 unsigned si = c->regs[VCPU_REGS_RSI];
675 unsigned di = c->regs[VCPU_REGS_RDI];
677 /* 16-bit ModR/M decode. */
678 switch (c->modrm_mod) {
680 if (c->modrm_rm == 6)
681 c->modrm_ea += insn_fetch(u16, 2, c->eip);
684 c->modrm_ea += insn_fetch(s8, 1, c->eip);
687 c->modrm_ea += insn_fetch(u16, 2, c->eip);
690 switch (c->modrm_rm) {
692 c->modrm_ea += bx + si;
695 c->modrm_ea += bx + di;
698 c->modrm_ea += bp + si;
701 c->modrm_ea += bp + di;
710 if (c->modrm_mod != 0)
717 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
718 (c->modrm_rm == 6 && c->modrm_mod != 0))
719 if (!c->override_base)
720 c->override_base = &ctxt->ss_base;
721 c->modrm_ea = (u16)c->modrm_ea;
723 /* 32/64-bit ModR/M decode. */
724 switch (c->modrm_rm) {
727 sib = insn_fetch(u8, 1, c->eip);
728 index_reg |= (sib >> 3) & 7;
734 if (c->modrm_mod != 0)
735 c->modrm_ea += c->regs[base_reg];
738 insn_fetch(s32, 4, c->eip);
741 c->modrm_ea += c->regs[base_reg];
747 c->modrm_ea += c->regs[index_reg] << scale;
751 if (c->modrm_mod != 0)
752 c->modrm_ea += c->regs[c->modrm_rm];
753 else if (ctxt->mode == X86EMUL_MODE_PROT64)
757 c->modrm_ea += c->regs[c->modrm_rm];
760 switch (c->modrm_mod) {
762 if (c->modrm_rm == 5)
763 c->modrm_ea += insn_fetch(s32, 4, c->eip);
766 c->modrm_ea += insn_fetch(s8, 1, c->eip);
769 c->modrm_ea += insn_fetch(s32, 4, c->eip);
774 c->modrm_ea += c->eip;
775 switch (c->d & SrcMask) {
783 if (c->op_bytes == 8)
786 c->modrm_ea += c->op_bytes;
793 static int decode_abs(struct x86_emulate_ctxt *ctxt,
794 struct x86_emulate_ops *ops)
796 struct decode_cache *c = &ctxt->decode;
799 switch (c->ad_bytes) {
801 c->modrm_ea = insn_fetch(u16, 2, c->eip);
804 c->modrm_ea = insn_fetch(u32, 4, c->eip);
807 c->modrm_ea = insn_fetch(u64, 8, c->eip);
815 x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
817 struct decode_cache *c = &ctxt->decode;
819 int mode = ctxt->mode;
820 int def_op_bytes, def_ad_bytes, group;
822 /* Shadow copy of register state. Committed on successful emulation. */
824 memset(c, 0, sizeof(struct decode_cache));
825 c->eip = ctxt->vcpu->arch.rip;
826 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
829 case X86EMUL_MODE_REAL:
830 case X86EMUL_MODE_PROT16:
831 def_op_bytes = def_ad_bytes = 2;
833 case X86EMUL_MODE_PROT32:
834 def_op_bytes = def_ad_bytes = 4;
837 case X86EMUL_MODE_PROT64:
846 c->op_bytes = def_op_bytes;
847 c->ad_bytes = def_ad_bytes;
849 /* Legacy prefixes. */
851 switch (c->b = insn_fetch(u8, 1, c->eip)) {
852 case 0x66: /* operand-size override */
853 /* switch between 2/4 bytes */
854 c->op_bytes = def_op_bytes ^ 6;
856 case 0x67: /* address-size override */
857 if (mode == X86EMUL_MODE_PROT64)
858 /* switch between 4/8 bytes */
859 c->ad_bytes = def_ad_bytes ^ 12;
861 /* switch between 2/4 bytes */
862 c->ad_bytes = def_ad_bytes ^ 6;
864 case 0x2e: /* CS override */
865 c->override_base = &ctxt->cs_base;
867 case 0x3e: /* DS override */
868 c->override_base = &ctxt->ds_base;
870 case 0x26: /* ES override */
871 c->override_base = &ctxt->es_base;
873 case 0x64: /* FS override */
874 c->override_base = &ctxt->fs_base;
876 case 0x65: /* GS override */
877 c->override_base = &ctxt->gs_base;
879 case 0x36: /* SS override */
880 c->override_base = &ctxt->ss_base;
882 case 0x40 ... 0x4f: /* REX */
883 if (mode != X86EMUL_MODE_PROT64)
885 c->rex_prefix = c->b;
887 case 0xf0: /* LOCK */
890 case 0xf2: /* REPNE/REPNZ */
891 c->rep_prefix = REPNE_PREFIX;
893 case 0xf3: /* REP/REPE/REPZ */
894 c->rep_prefix = REPE_PREFIX;
900 /* Any legacy prefix after a REX prefix nullifies its effect. */
909 if (c->rex_prefix & 8)
910 c->op_bytes = 8; /* REX.W */
912 /* Opcode byte(s). */
913 c->d = opcode_table[c->b];
915 /* Two-byte opcode? */
918 c->b = insn_fetch(u8, 1, c->eip);
919 c->d = twobyte_table[c->b];
924 group = c->d & GroupMask;
925 c->modrm = insn_fetch(u8, 1, c->eip);
928 group = (group << 3) + ((c->modrm >> 3) & 7);
929 if ((c->d & GroupDual) && (c->modrm >> 6) == 3)
930 c->d = group2_table[group];
932 c->d = group_table[group];
937 DPRINTF("Cannot emulate %02x\n", c->b);
941 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
944 /* ModRM and SIB bytes. */
946 rc = decode_modrm(ctxt, ops);
947 else if (c->d & MemAbs)
948 rc = decode_abs(ctxt, ops);
952 if (!c->override_base)
953 c->override_base = &ctxt->ds_base;
954 if (mode == X86EMUL_MODE_PROT64 &&
955 c->override_base != &ctxt->fs_base &&
956 c->override_base != &ctxt->gs_base)
957 c->override_base = NULL;
959 if (c->override_base)
960 c->modrm_ea += *c->override_base;
962 if (c->ad_bytes != 8)
963 c->modrm_ea = (u32)c->modrm_ea;
965 * Decode and fetch the source operand: register, memory
968 switch (c->d & SrcMask) {
972 decode_register_operand(&c->src, c, 0);
981 c->src.bytes = (c->d & ByteOp) ? 1 :
983 /* Don't fetch the address for invlpg: it could be unmapped. */
984 if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
988 * For instructions with a ModR/M byte, switch to register
991 if ((c->d & ModRM) && c->modrm_mod == 3) {
992 c->src.type = OP_REG;
995 c->src.type = OP_MEM;
998 c->src.type = OP_IMM;
999 c->src.ptr = (unsigned long *)c->eip;
1000 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1001 if (c->src.bytes == 8)
1003 /* NB. Immediates are sign-extended as necessary. */
1004 switch (c->src.bytes) {
1006 c->src.val = insn_fetch(s8, 1, c->eip);
1009 c->src.val = insn_fetch(s16, 2, c->eip);
1012 c->src.val = insn_fetch(s32, 4, c->eip);
1017 c->src.type = OP_IMM;
1018 c->src.ptr = (unsigned long *)c->eip;
1020 c->src.val = insn_fetch(s8, 1, c->eip);
1024 /* Decode and fetch the destination operand: register or memory. */
1025 switch (c->d & DstMask) {
1027 /* Special instructions do their own operand decoding. */
1030 decode_register_operand(&c->dst, c,
1031 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
1034 if ((c->d & ModRM) && c->modrm_mod == 3) {
1035 c->dst.type = OP_REG;
1038 c->dst.type = OP_MEM;
1043 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1046 static inline void emulate_push(struct x86_emulate_ctxt *ctxt)
1048 struct decode_cache *c = &ctxt->decode;
1050 c->dst.type = OP_MEM;
1051 c->dst.bytes = c->op_bytes;
1052 c->dst.val = c->src.val;
1053 register_address_increment(c->regs[VCPU_REGS_RSP], -c->op_bytes);
1054 c->dst.ptr = (void *) register_address(ctxt->ss_base,
1055 c->regs[VCPU_REGS_RSP]);
1058 static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
1059 struct x86_emulate_ops *ops)
1061 struct decode_cache *c = &ctxt->decode;
1064 rc = ops->read_std(register_address(ctxt->ss_base,
1065 c->regs[VCPU_REGS_RSP]),
1066 &c->dst.val, c->dst.bytes, ctxt->vcpu);
1070 register_address_increment(c->regs[VCPU_REGS_RSP], c->dst.bytes);
1075 static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
1077 struct decode_cache *c = &ctxt->decode;
1078 switch (c->modrm_reg) {
1080 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
1083 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
1086 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
1089 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
1091 case 4: /* sal/shl */
1092 case 6: /* sal/shl */
1093 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
1096 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
1099 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
1104 static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
1105 struct x86_emulate_ops *ops)
1107 struct decode_cache *c = &ctxt->decode;
1110 switch (c->modrm_reg) {
1111 case 0 ... 1: /* test */
1112 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1115 c->dst.val = ~c->dst.val;
1118 emulate_1op("neg", c->dst, ctxt->eflags);
1121 DPRINTF("Cannot emulate %02x\n", c->b);
1122 rc = X86EMUL_UNHANDLEABLE;
1128 static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
1129 struct x86_emulate_ops *ops)
1131 struct decode_cache *c = &ctxt->decode;
1133 switch (c->modrm_reg) {
1135 emulate_1op("inc", c->dst, ctxt->eflags);
1138 emulate_1op("dec", c->dst, ctxt->eflags);
1140 case 4: /* jmp abs */
1141 c->eip = c->src.val;
1150 static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
1151 struct x86_emulate_ops *ops,
1152 unsigned long memop)
1154 struct decode_cache *c = &ctxt->decode;
1158 rc = ops->read_emulated(memop, &old, 8, ctxt->vcpu);
1162 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1163 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
1165 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1166 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1167 ctxt->eflags &= ~EFLG_ZF;
1170 new = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1171 (u32) c->regs[VCPU_REGS_RBX];
1173 rc = ops->cmpxchg_emulated(memop, &old, &new, 8, ctxt->vcpu);
1176 ctxt->eflags |= EFLG_ZF;
1181 static inline int writeback(struct x86_emulate_ctxt *ctxt,
1182 struct x86_emulate_ops *ops)
1185 struct decode_cache *c = &ctxt->decode;
1187 switch (c->dst.type) {
1189 /* The 4-byte case *is* correct:
1190 * in 64-bit mode we zero-extend.
1192 switch (c->dst.bytes) {
1194 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1197 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1200 *c->dst.ptr = (u32)c->dst.val;
1201 break; /* 64b: zero-ext */
1203 *c->dst.ptr = c->dst.val;
1209 rc = ops->cmpxchg_emulated(
1210 (unsigned long)c->dst.ptr,
1216 rc = ops->write_emulated(
1217 (unsigned long)c->dst.ptr,
1234 x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1236 unsigned long memop = 0;
1238 unsigned long saved_eip = 0;
1239 struct decode_cache *c = &ctxt->decode;
1242 /* Shadow copy of register state. Committed on successful emulation.
1243 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
1247 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
1250 if (((c->d & ModRM) && (c->modrm_mod != 3)) || (c->d & MemAbs))
1251 memop = c->modrm_ea;
1253 if (c->rep_prefix && (c->d & String)) {
1254 /* All REP prefixes have the same first termination condition */
1255 if (c->regs[VCPU_REGS_RCX] == 0) {
1256 ctxt->vcpu->arch.rip = c->eip;
1259 /* The second termination condition only applies for REPE
1260 * and REPNE. Test if the repeat string operation prefix is
1261 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
1262 * corresponding termination condition according to:
1263 * - if REPE/REPZ and ZF = 0 then done
1264 * - if REPNE/REPNZ and ZF = 1 then done
1266 if ((c->b == 0xa6) || (c->b == 0xa7) ||
1267 (c->b == 0xae) || (c->b == 0xaf)) {
1268 if ((c->rep_prefix == REPE_PREFIX) &&
1269 ((ctxt->eflags & EFLG_ZF) == 0)) {
1270 ctxt->vcpu->arch.rip = c->eip;
1273 if ((c->rep_prefix == REPNE_PREFIX) &&
1274 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF)) {
1275 ctxt->vcpu->arch.rip = c->eip;
1279 c->regs[VCPU_REGS_RCX]--;
1280 c->eip = ctxt->vcpu->arch.rip;
1283 if (c->src.type == OP_MEM) {
1284 c->src.ptr = (unsigned long *)memop;
1286 rc = ops->read_emulated((unsigned long)c->src.ptr,
1292 c->src.orig_val = c->src.val;
1295 if ((c->d & DstMask) == ImplicitOps)
1299 if (c->dst.type == OP_MEM) {
1300 c->dst.ptr = (unsigned long *)memop;
1301 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1304 unsigned long mask = ~(c->dst.bytes * 8 - 1);
1306 c->dst.ptr = (void *)c->dst.ptr +
1307 (c->src.val & mask) / 8;
1309 if (!(c->d & Mov) &&
1310 /* optimisation - avoid slow emulated read */
1311 ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1313 c->dst.bytes, ctxt->vcpu)) != 0))
1316 c->dst.orig_val = c->dst.val;
1326 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
1330 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
1334 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
1338 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
1342 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
1344 case 0x24: /* and al imm8 */
1345 c->dst.type = OP_REG;
1346 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1347 c->dst.val = *(u8 *)c->dst.ptr;
1349 c->dst.orig_val = c->dst.val;
1351 case 0x25: /* and ax imm16, or eax imm32 */
1352 c->dst.type = OP_REG;
1353 c->dst.bytes = c->op_bytes;
1354 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1355 if (c->op_bytes == 2)
1356 c->dst.val = *(u16 *)c->dst.ptr;
1358 c->dst.val = *(u32 *)c->dst.ptr;
1359 c->dst.orig_val = c->dst.val;
1363 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
1367 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
1371 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1373 case 0x40 ... 0x47: /* inc r16/r32 */
1374 emulate_1op("inc", c->dst, ctxt->eflags);
1376 case 0x48 ... 0x4f: /* dec r16/r32 */
1377 emulate_1op("dec", c->dst, ctxt->eflags);
1379 case 0x50 ... 0x57: /* push reg */
1380 c->dst.type = OP_MEM;
1381 c->dst.bytes = c->op_bytes;
1382 c->dst.val = c->src.val;
1383 register_address_increment(c->regs[VCPU_REGS_RSP],
1385 c->dst.ptr = (void *) register_address(
1386 ctxt->ss_base, c->regs[VCPU_REGS_RSP]);
1388 case 0x58 ... 0x5f: /* pop reg */
1390 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1391 c->regs[VCPU_REGS_RSP]), c->dst.ptr,
1392 c->op_bytes, ctxt->vcpu)) != 0)
1395 register_address_increment(c->regs[VCPU_REGS_RSP],
1397 c->dst.type = OP_NONE; /* Disable writeback. */
1399 case 0x63: /* movsxd */
1400 if (ctxt->mode != X86EMUL_MODE_PROT64)
1401 goto cannot_emulate;
1402 c->dst.val = (s32) c->src.val;
1404 case 0x6a: /* push imm8 */
1406 c->src.val = insn_fetch(s8, 1, c->eip);
1409 case 0x6c: /* insb */
1410 case 0x6d: /* insw/insd */
1411 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1413 (c->d & ByteOp) ? 1 : c->op_bytes,
1415 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1416 (ctxt->eflags & EFLG_DF),
1417 register_address(ctxt->es_base,
1418 c->regs[VCPU_REGS_RDI]),
1420 c->regs[VCPU_REGS_RDX]) == 0) {
1425 case 0x6e: /* outsb */
1426 case 0x6f: /* outsw/outsd */
1427 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1429 (c->d & ByteOp) ? 1 : c->op_bytes,
1431 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1432 (ctxt->eflags & EFLG_DF),
1433 register_address(c->override_base ?
1436 c->regs[VCPU_REGS_RSI]),
1438 c->regs[VCPU_REGS_RDX]) == 0) {
1443 case 0x70 ... 0x7f: /* jcc (short) */ {
1444 int rel = insn_fetch(s8, 1, c->eip);
1446 if (test_cc(c->b, ctxt->eflags))
1450 case 0x80 ... 0x83: /* Grp1 */
1451 switch (c->modrm_reg) {
1471 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1473 case 0x86 ... 0x87: /* xchg */
1474 /* Write back the register source. */
1475 switch (c->dst.bytes) {
1477 *(u8 *) c->src.ptr = (u8) c->dst.val;
1480 *(u16 *) c->src.ptr = (u16) c->dst.val;
1483 *c->src.ptr = (u32) c->dst.val;
1484 break; /* 64b reg: zero-extend */
1486 *c->src.ptr = c->dst.val;
1490 * Write back the memory destination with implicit LOCK
1493 c->dst.val = c->src.val;
1496 case 0x88 ... 0x8b: /* mov */
1498 case 0x8d: /* lea r16/r32, m */
1499 c->dst.val = c->modrm_val;
1501 case 0x8f: /* pop (sole member of Grp1a) */
1502 rc = emulate_grp1a(ctxt, ops);
1506 case 0x9c: /* pushf */
1507 c->src.val = (unsigned long) ctxt->eflags;
1510 case 0x9d: /* popf */
1511 c->dst.ptr = (unsigned long *) &ctxt->eflags;
1512 goto pop_instruction;
1513 case 0xa0 ... 0xa1: /* mov */
1514 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1515 c->dst.val = c->src.val;
1517 case 0xa2 ... 0xa3: /* mov */
1518 c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
1520 case 0xa4 ... 0xa5: /* movs */
1521 c->dst.type = OP_MEM;
1522 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1523 c->dst.ptr = (unsigned long *)register_address(
1525 c->regs[VCPU_REGS_RDI]);
1526 if ((rc = ops->read_emulated(register_address(
1527 c->override_base ? *c->override_base :
1529 c->regs[VCPU_REGS_RSI]),
1531 c->dst.bytes, ctxt->vcpu)) != 0)
1533 register_address_increment(c->regs[VCPU_REGS_RSI],
1534 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1536 register_address_increment(c->regs[VCPU_REGS_RDI],
1537 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1540 case 0xa6 ... 0xa7: /* cmps */
1541 c->src.type = OP_NONE; /* Disable writeback. */
1542 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1543 c->src.ptr = (unsigned long *)register_address(
1544 c->override_base ? *c->override_base :
1546 c->regs[VCPU_REGS_RSI]);
1547 if ((rc = ops->read_emulated((unsigned long)c->src.ptr,
1553 c->dst.type = OP_NONE; /* Disable writeback. */
1554 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1555 c->dst.ptr = (unsigned long *)register_address(
1557 c->regs[VCPU_REGS_RDI]);
1558 if ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1564 DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c->src.ptr, c->dst.ptr);
1566 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1568 register_address_increment(c->regs[VCPU_REGS_RSI],
1569 (ctxt->eflags & EFLG_DF) ? -c->src.bytes
1571 register_address_increment(c->regs[VCPU_REGS_RDI],
1572 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1576 case 0xaa ... 0xab: /* stos */
1577 c->dst.type = OP_MEM;
1578 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1579 c->dst.ptr = (unsigned long *)register_address(
1581 c->regs[VCPU_REGS_RDI]);
1582 c->dst.val = c->regs[VCPU_REGS_RAX];
1583 register_address_increment(c->regs[VCPU_REGS_RDI],
1584 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1587 case 0xac ... 0xad: /* lods */
1588 c->dst.type = OP_REG;
1589 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1590 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1591 if ((rc = ops->read_emulated(register_address(
1592 c->override_base ? *c->override_base :
1594 c->regs[VCPU_REGS_RSI]),
1599 register_address_increment(c->regs[VCPU_REGS_RSI],
1600 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1603 case 0xae ... 0xaf: /* scas */
1604 DPRINTF("Urk! I don't handle SCAS.\n");
1605 goto cannot_emulate;
1609 case 0xc3: /* ret */
1610 c->dst.ptr = &c->eip;
1611 goto pop_instruction;
1612 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1614 c->dst.val = c->src.val;
1616 case 0xd0 ... 0xd1: /* Grp2 */
1620 case 0xd2 ... 0xd3: /* Grp2 */
1621 c->src.val = c->regs[VCPU_REGS_RCX];
1624 case 0xe8: /* call (near) */ {
1626 switch (c->op_bytes) {
1628 rel = insn_fetch(s16, 2, c->eip);
1631 rel = insn_fetch(s32, 4, c->eip);
1634 DPRINTF("Call: Invalid op_bytes\n");
1635 goto cannot_emulate;
1637 c->src.val = (unsigned long) c->eip;
1639 c->op_bytes = c->ad_bytes;
1643 case 0xe9: /* jmp rel */
1644 case 0xeb: /* jmp rel short */
1645 JMP_REL(c->src.val);
1646 c->dst.type = OP_NONE; /* Disable writeback. */
1648 case 0xf4: /* hlt */
1649 ctxt->vcpu->arch.halt_request = 1;
1651 case 0xf5: /* cmc */
1652 /* complement carry flag from eflags reg */
1653 ctxt->eflags ^= EFLG_CF;
1654 c->dst.type = OP_NONE; /* Disable writeback. */
1656 case 0xf6 ... 0xf7: /* Grp3 */
1657 rc = emulate_grp3(ctxt, ops);
1661 case 0xf8: /* clc */
1662 ctxt->eflags &= ~EFLG_CF;
1663 c->dst.type = OP_NONE; /* Disable writeback. */
1665 case 0xfa: /* cli */
1666 ctxt->eflags &= ~X86_EFLAGS_IF;
1667 c->dst.type = OP_NONE; /* Disable writeback. */
1669 case 0xfb: /* sti */
1670 ctxt->eflags |= X86_EFLAGS_IF;
1671 c->dst.type = OP_NONE; /* Disable writeback. */
1673 case 0xfe ... 0xff: /* Grp4/Grp5 */
1674 rc = emulate_grp45(ctxt, ops);
1681 rc = writeback(ctxt, ops);
1685 /* Commit shadow register state. */
1686 memcpy(ctxt->vcpu->arch.regs, c->regs, sizeof c->regs);
1687 ctxt->vcpu->arch.rip = c->eip;
1690 if (rc == X86EMUL_UNHANDLEABLE) {
1698 case 0x01: /* lgdt, lidt, lmsw */
1699 switch (c->modrm_reg) {
1701 unsigned long address;
1703 case 0: /* vmcall */
1704 if (c->modrm_mod != 3 || c->modrm_rm != 1)
1705 goto cannot_emulate;
1707 rc = kvm_fix_hypercall(ctxt->vcpu);
1711 kvm_emulate_hypercall(ctxt->vcpu);
1714 rc = read_descriptor(ctxt, ops, c->src.ptr,
1715 &size, &address, c->op_bytes);
1718 realmode_lgdt(ctxt->vcpu, size, address);
1720 case 3: /* lidt/vmmcall */
1721 if (c->modrm_mod == 3 && c->modrm_rm == 1) {
1722 rc = kvm_fix_hypercall(ctxt->vcpu);
1725 kvm_emulate_hypercall(ctxt->vcpu);
1727 rc = read_descriptor(ctxt, ops, c->src.ptr,
1732 realmode_lidt(ctxt->vcpu, size, address);
1736 if (c->modrm_mod != 3)
1737 goto cannot_emulate;
1738 *(u16 *)&c->regs[c->modrm_rm]
1739 = realmode_get_cr(ctxt->vcpu, 0);
1742 if (c->modrm_mod != 3)
1743 goto cannot_emulate;
1744 realmode_lmsw(ctxt->vcpu, (u16)c->modrm_val,
1748 emulate_invlpg(ctxt->vcpu, memop);
1751 goto cannot_emulate;
1753 /* Disable writeback. */
1754 c->dst.type = OP_NONE;
1757 emulate_clts(ctxt->vcpu);
1758 c->dst.type = OP_NONE;
1760 case 0x08: /* invd */
1761 case 0x09: /* wbinvd */
1762 case 0x0d: /* GrpP (prefetch) */
1763 case 0x18: /* Grp16 (prefetch/nop) */
1764 c->dst.type = OP_NONE;
1766 case 0x20: /* mov cr, reg */
1767 if (c->modrm_mod != 3)
1768 goto cannot_emulate;
1769 c->regs[c->modrm_rm] =
1770 realmode_get_cr(ctxt->vcpu, c->modrm_reg);
1771 c->dst.type = OP_NONE; /* no writeback */
1773 case 0x21: /* mov from dr to reg */
1774 if (c->modrm_mod != 3)
1775 goto cannot_emulate;
1776 rc = emulator_get_dr(ctxt, c->modrm_reg, &c->regs[c->modrm_rm]);
1778 goto cannot_emulate;
1779 c->dst.type = OP_NONE; /* no writeback */
1781 case 0x22: /* mov reg, cr */
1782 if (c->modrm_mod != 3)
1783 goto cannot_emulate;
1784 realmode_set_cr(ctxt->vcpu,
1785 c->modrm_reg, c->modrm_val, &ctxt->eflags);
1786 c->dst.type = OP_NONE;
1788 case 0x23: /* mov from reg to dr */
1789 if (c->modrm_mod != 3)
1790 goto cannot_emulate;
1791 rc = emulator_set_dr(ctxt, c->modrm_reg,
1792 c->regs[c->modrm_rm]);
1794 goto cannot_emulate;
1795 c->dst.type = OP_NONE; /* no writeback */
1799 msr_data = (u32)c->regs[VCPU_REGS_RAX]
1800 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
1801 rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
1803 kvm_inject_gp(ctxt->vcpu, 0);
1804 c->eip = ctxt->vcpu->arch.rip;
1806 rc = X86EMUL_CONTINUE;
1807 c->dst.type = OP_NONE;
1811 rc = kvm_get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data);
1813 kvm_inject_gp(ctxt->vcpu, 0);
1814 c->eip = ctxt->vcpu->arch.rip;
1816 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
1817 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
1819 rc = X86EMUL_CONTINUE;
1820 c->dst.type = OP_NONE;
1822 case 0x40 ... 0x4f: /* cmov */
1823 c->dst.val = c->dst.orig_val = c->src.val;
1824 if (!test_cc(c->b, ctxt->eflags))
1825 c->dst.type = OP_NONE; /* no writeback */
1827 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1830 switch (c->op_bytes) {
1832 rel = insn_fetch(s16, 2, c->eip);
1835 rel = insn_fetch(s32, 4, c->eip);
1838 rel = insn_fetch(s64, 8, c->eip);
1841 DPRINTF("jnz: Invalid op_bytes\n");
1842 goto cannot_emulate;
1844 if (test_cc(c->b, ctxt->eflags))
1846 c->dst.type = OP_NONE;
1851 c->dst.type = OP_NONE;
1852 /* only subword offset */
1853 c->src.val &= (c->dst.bytes << 3) - 1;
1854 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
1858 /* only subword offset */
1859 c->src.val &= (c->dst.bytes << 3) - 1;
1860 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
1862 case 0xb0 ... 0xb1: /* cmpxchg */
1864 * Save real source value, then compare EAX against
1867 c->src.orig_val = c->src.val;
1868 c->src.val = c->regs[VCPU_REGS_RAX];
1869 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1870 if (ctxt->eflags & EFLG_ZF) {
1871 /* Success: write back to memory. */
1872 c->dst.val = c->src.orig_val;
1874 /* Failure: write the value we saw to EAX. */
1875 c->dst.type = OP_REG;
1876 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1881 /* only subword offset */
1882 c->src.val &= (c->dst.bytes << 3) - 1;
1883 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
1885 case 0xb6 ... 0xb7: /* movzx */
1886 c->dst.bytes = c->op_bytes;
1887 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
1890 case 0xba: /* Grp8 */
1891 switch (c->modrm_reg & 3) {
1904 /* only subword offset */
1905 c->src.val &= (c->dst.bytes << 3) - 1;
1906 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
1908 case 0xbe ... 0xbf: /* movsx */
1909 c->dst.bytes = c->op_bytes;
1910 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
1913 case 0xc3: /* movnti */
1914 c->dst.bytes = c->op_bytes;
1915 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
1918 case 0xc7: /* Grp9 (cmpxchg8b) */
1919 rc = emulate_grp9(ctxt, ops, memop);
1922 c->dst.type = OP_NONE;
1928 DPRINTF("Cannot emulate %02x\n", c->b);