1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf( _f , ## _a )
29 #define DPRINTF(x...) do {} while (0)
31 #include "x86_emulate.h"
32 #include <linux/module.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
66 static u8 opcode_table[256] = {
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 SrcImmByte, SrcImm, 0, 0,
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
102 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
103 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
106 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
108 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
111 0, 0, ImplicitOps|Mov, 0,
112 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
113 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
115 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
116 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
118 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
119 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
121 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
122 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
123 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
124 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
126 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
127 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
128 0, ModRM | DstReg, 0, DstMem | SrcNone | ModRM | Mov,
130 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps, ImplicitOps, 0, 0,
132 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
133 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
134 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
135 ByteOp | ImplicitOps, ImplicitOps,
137 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
138 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
139 ByteOp | ImplicitOps, ImplicitOps,
141 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
143 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
144 0, ImplicitOps, 0, 0,
145 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
147 0, 0, 0, 0, 0, 0, 0, 0,
149 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
150 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
153 0, 0, 0, 0, 0, 0, 0, 0,
155 0, 0, 0, 0, 0, 0, 0, 0,
157 ImplicitOps, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps, 0, 0, 0, 0,
161 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
164 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
167 static u16 twobyte_table[256] = {
169 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
170 ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
172 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
174 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
175 0, 0, 0, 0, 0, 0, 0, 0,
177 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
179 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
180 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
181 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
182 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
184 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
185 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
186 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
187 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
189 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
191 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
193 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
195 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
196 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
197 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
198 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
200 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
202 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
204 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
206 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
207 DstMem | SrcReg | ModRM | BitOp,
208 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
209 DstReg | SrcMem16 | ModRM | Mov,
211 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
212 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
213 DstReg | SrcMem16 | ModRM | Mov,
215 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
216 0, 0, 0, 0, 0, 0, 0, 0,
218 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
220 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
222 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
225 /* EFLAGS bit definitions. */
226 #define EFLG_OF (1<<11)
227 #define EFLG_DF (1<<10)
228 #define EFLG_SF (1<<7)
229 #define EFLG_ZF (1<<6)
230 #define EFLG_AF (1<<4)
231 #define EFLG_PF (1<<2)
232 #define EFLG_CF (1<<0)
235 * Instruction emulation:
236 * Most instructions are emulated directly via a fragment of inline assembly
237 * code. This allows us to save/restore EFLAGS and thus very easily pick up
238 * any modified flags.
241 #if defined(CONFIG_X86_64)
242 #define _LO32 "k" /* force 32-bit operand */
243 #define _STK "%%rsp" /* stack pointer */
244 #elif defined(__i386__)
245 #define _LO32 "" /* force 32-bit operand */
246 #define _STK "%%esp" /* stack pointer */
250 * These EFLAGS bits are restored from saved value during emulation, and
251 * any changes are written back to the saved value after emulation.
253 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
255 /* Before executing instruction: restore necessary bits in EFLAGS. */
256 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
257 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
259 "movl %"_msk",%"_LO32 _tmp"; " \
260 "andl %"_LO32 _tmp",("_STK"); " \
262 "notl %"_LO32 _tmp"; " \
263 "andl %"_LO32 _tmp",("_STK"); " \
265 "orl %"_LO32 _tmp",("_STK"); " \
267 /* _sav &= ~msk; */ \
268 "movl %"_msk",%"_LO32 _tmp"; " \
269 "notl %"_LO32 _tmp"; " \
270 "andl %"_LO32 _tmp",%"_sav"; "
272 /* After executing instruction: write-back necessary bits in EFLAGS. */
273 #define _POST_EFLAGS(_sav, _msk, _tmp) \
274 /* _sav |= EFLAGS & _msk; */ \
277 "andl %"_msk",%"_LO32 _tmp"; " \
278 "orl %"_LO32 _tmp",%"_sav"; "
280 /* Raw emulation: instruction has two explicit operands. */
281 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
283 unsigned long _tmp; \
285 switch ((_dst).bytes) { \
287 __asm__ __volatile__ ( \
288 _PRE_EFLAGS("0","4","2") \
289 _op"w %"_wx"3,%1; " \
290 _POST_EFLAGS("0","4","2") \
291 : "=m" (_eflags), "=m" ((_dst).val), \
293 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
296 __asm__ __volatile__ ( \
297 _PRE_EFLAGS("0","4","2") \
298 _op"l %"_lx"3,%1; " \
299 _POST_EFLAGS("0","4","2") \
300 : "=m" (_eflags), "=m" ((_dst).val), \
302 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
305 __emulate_2op_8byte(_op, _src, _dst, \
306 _eflags, _qx, _qy); \
311 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
313 unsigned long _tmp; \
314 switch ( (_dst).bytes ) \
317 __asm__ __volatile__ ( \
318 _PRE_EFLAGS("0","4","2") \
319 _op"b %"_bx"3,%1; " \
320 _POST_EFLAGS("0","4","2") \
321 : "=m" (_eflags), "=m" ((_dst).val), \
323 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
326 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
327 _wx, _wy, _lx, _ly, _qx, _qy); \
332 /* Source operand is byte-sized and may be restricted to just %cl. */
333 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
334 __emulate_2op(_op, _src, _dst, _eflags, \
335 "b", "c", "b", "c", "b", "c", "b", "c")
337 /* Source operand is byte, word, long or quad sized. */
338 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
339 __emulate_2op(_op, _src, _dst, _eflags, \
340 "b", "q", "w", "r", _LO32, "r", "", "r")
342 /* Source operand is word, long or quad sized. */
343 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
344 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
345 "w", "r", _LO32, "r", "", "r")
347 /* Instruction has only one explicit operand (no source operand). */
348 #define emulate_1op(_op, _dst, _eflags) \
350 unsigned long _tmp; \
352 switch ( (_dst).bytes ) \
355 __asm__ __volatile__ ( \
356 _PRE_EFLAGS("0","3","2") \
358 _POST_EFLAGS("0","3","2") \
359 : "=m" (_eflags), "=m" ((_dst).val), \
361 : "i" (EFLAGS_MASK) ); \
364 __asm__ __volatile__ ( \
365 _PRE_EFLAGS("0","3","2") \
367 _POST_EFLAGS("0","3","2") \
368 : "=m" (_eflags), "=m" ((_dst).val), \
370 : "i" (EFLAGS_MASK) ); \
373 __asm__ __volatile__ ( \
374 _PRE_EFLAGS("0","3","2") \
376 _POST_EFLAGS("0","3","2") \
377 : "=m" (_eflags), "=m" ((_dst).val), \
379 : "i" (EFLAGS_MASK) ); \
382 __emulate_1op_8byte(_op, _dst, _eflags); \
387 /* Emulate an instruction with quadword operands (x86/64 only). */
388 #if defined(CONFIG_X86_64)
389 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
391 __asm__ __volatile__ ( \
392 _PRE_EFLAGS("0","4","2") \
393 _op"q %"_qx"3,%1; " \
394 _POST_EFLAGS("0","4","2") \
395 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
396 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
399 #define __emulate_1op_8byte(_op, _dst, _eflags) \
401 __asm__ __volatile__ ( \
402 _PRE_EFLAGS("0","3","2") \
404 _POST_EFLAGS("0","3","2") \
405 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
406 : "i" (EFLAGS_MASK) ); \
409 #elif defined(__i386__)
410 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
411 #define __emulate_1op_8byte(_op, _dst, _eflags)
412 #endif /* __i386__ */
414 /* Fetch next part of the instruction being emulated. */
415 #define insn_fetch(_type, _size, _eip) \
416 ({ unsigned long _x; \
417 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
418 (_size), ctxt->vcpu); \
425 /* Access/update address held in a register, based on addressing mode. */
426 #define address_mask(reg) \
427 ((c->ad_bytes == sizeof(unsigned long)) ? \
428 (reg) : ((reg) & ((1UL << (c->ad_bytes << 3)) - 1)))
429 #define register_address(base, reg) \
430 ((base) + address_mask(reg))
431 #define register_address_increment(reg, inc) \
433 /* signed type ensures sign extension to long */ \
435 if (c->ad_bytes == sizeof(unsigned long)) \
439 ~((1UL << (c->ad_bytes << 3)) - 1)) | \
441 ((1UL << (c->ad_bytes << 3)) - 1)); \
444 #define JMP_REL(rel) \
446 register_address_increment(c->eip, rel); \
450 * Given the 'reg' portion of a ModRM byte, and a register block, return a
451 * pointer into the block that addresses the relevant register.
452 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
454 static void *decode_register(u8 modrm_reg, unsigned long *regs,
459 p = ®s[modrm_reg];
460 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
461 p = (unsigned char *)®s[modrm_reg & 3] + 1;
465 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
466 struct x86_emulate_ops *ops,
468 u16 *size, unsigned long *address, int op_bytes)
475 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
479 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
484 static int test_cc(unsigned int condition, unsigned int flags)
488 switch ((condition & 15) >> 1) {
490 rc |= (flags & EFLG_OF);
492 case 1: /* b/c/nae */
493 rc |= (flags & EFLG_CF);
496 rc |= (flags & EFLG_ZF);
499 rc |= (flags & (EFLG_CF|EFLG_ZF));
502 rc |= (flags & EFLG_SF);
505 rc |= (flags & EFLG_PF);
508 rc |= (flags & EFLG_ZF);
511 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
515 /* Odd condition identifiers (lsb == 1) have inverted sense. */
516 return (!!rc ^ (condition & 1));
520 x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
522 struct decode_cache *c = &ctxt->decode;
523 u8 sib, rex_prefix = 0;
526 unsigned long cr2 = ctxt->cr2;
527 int mode = ctxt->mode;
528 int index_reg = 0, base_reg = 0, scale, rip_relative = 0;
532 /* Shadow copy of register state. Committed on successful emulation. */
533 unsigned long _eflags = ctxt->eflags;
535 memset(c, 0, sizeof(struct decode_cache));
536 c->eip = ctxt->vcpu->rip;
537 memcpy(c->regs, ctxt->vcpu->regs, sizeof c->regs);
540 case X86EMUL_MODE_REAL:
541 case X86EMUL_MODE_PROT16:
542 c->op_bytes = c->ad_bytes = 2;
544 case X86EMUL_MODE_PROT32:
545 c->op_bytes = c->ad_bytes = 4;
548 case X86EMUL_MODE_PROT64:
557 /* Legacy prefixes. */
558 for (i = 0; i < 8; i++) {
559 switch (c->b = insn_fetch(u8, 1, c->eip)) {
560 case 0x66: /* operand-size override */
561 c->op_bytes ^= 6; /* switch between 2/4 bytes */
563 case 0x67: /* address-size override */
564 if (mode == X86EMUL_MODE_PROT64)
565 /* switch between 4/8 bytes */
568 /* switch between 2/4 bytes */
571 case 0x2e: /* CS override */
572 c->override_base = &ctxt->cs_base;
574 case 0x3e: /* DS override */
575 c->override_base = &ctxt->ds_base;
577 case 0x26: /* ES override */
578 c->override_base = &ctxt->es_base;
580 case 0x64: /* FS override */
581 c->override_base = &ctxt->fs_base;
583 case 0x65: /* GS override */
584 c->override_base = &ctxt->gs_base;
586 case 0x36: /* SS override */
587 c->override_base = &ctxt->ss_base;
589 case 0xf0: /* LOCK */
592 case 0xf2: /* REPNE/REPNZ */
593 case 0xf3: /* REP/REPE/REPZ */
604 if ((mode == X86EMUL_MODE_PROT64) && ((c->b & 0xf0) == 0x40)) {
607 c->op_bytes = 8; /* REX.W */
608 c->modrm_reg = (c->b & 4) << 1; /* REX.R */
609 index_reg = (c->b & 2) << 2; /* REX.X */
610 c->modrm_rm = base_reg = (c->b & 1) << 3; /* REG.B */
611 c->b = insn_fetch(u8, 1, c->eip);
614 /* Opcode byte(s). */
615 c->d = opcode_table[c->b];
617 /* Two-byte opcode? */
620 c->b = insn_fetch(u8, 1, c->eip);
621 c->d = twobyte_table[c->b];
629 /* ModRM and SIB bytes. */
631 c->modrm = insn_fetch(u8, 1, c->eip);
632 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
633 c->modrm_reg |= (c->modrm & 0x38) >> 3;
634 c->modrm_rm |= (c->modrm & 0x07);
638 if (c->modrm_mod == 3) {
639 c->modrm_val = *(unsigned long *)
640 decode_register(c->modrm_rm, c->regs, c->d & ByteOp);
644 if (c->ad_bytes == 2) {
645 unsigned bx = c->regs[VCPU_REGS_RBX];
646 unsigned bp = c->regs[VCPU_REGS_RBP];
647 unsigned si = c->regs[VCPU_REGS_RSI];
648 unsigned di = c->regs[VCPU_REGS_RDI];
650 /* 16-bit ModR/M decode. */
651 switch (c->modrm_mod) {
653 if (c->modrm_rm == 6)
655 insn_fetch(u16, 2, c->eip);
658 c->modrm_ea += insn_fetch(s8, 1, c->eip);
661 c->modrm_ea += insn_fetch(u16, 2, c->eip);
664 switch (c->modrm_rm) {
666 c->modrm_ea += bx + si;
669 c->modrm_ea += bx + di;
672 c->modrm_ea += bp + si;
675 c->modrm_ea += bp + di;
684 if (c->modrm_mod != 0)
691 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
692 (c->modrm_rm == 6 && c->modrm_mod != 0))
693 if (!c->override_base)
694 c->override_base = &ctxt->ss_base;
695 c->modrm_ea = (u16)c->modrm_ea;
697 /* 32/64-bit ModR/M decode. */
698 switch (c->modrm_rm) {
701 sib = insn_fetch(u8, 1, c->eip);
702 index_reg |= (sib >> 3) & 7;
708 if (c->modrm_mod != 0)
713 insn_fetch(s32, 4, c->eip);
716 c->modrm_ea += c->regs[base_reg];
723 c->regs[index_reg] << scale;
728 if (c->modrm_mod != 0)
729 c->modrm_ea += c->regs[c->modrm_rm];
730 else if (mode == X86EMUL_MODE_PROT64)
734 c->modrm_ea += c->regs[c->modrm_rm];
737 switch (c->modrm_mod) {
739 if (c->modrm_rm == 5)
741 insn_fetch(s32, 4, c->eip);
744 c->modrm_ea += insn_fetch(s8, 1, c->eip);
747 c->modrm_ea += insn_fetch(s32, 4, c->eip);
751 if (!c->override_base)
752 c->override_base = &ctxt->ds_base;
753 if (mode == X86EMUL_MODE_PROT64 &&
754 c->override_base != &ctxt->fs_base &&
755 c->override_base != &ctxt->gs_base)
756 c->override_base = NULL;
758 if (c->override_base)
759 c->modrm_ea += *c->override_base;
762 c->modrm_ea += c->eip;
763 switch (c->d & SrcMask) {
771 if (c->op_bytes == 8)
774 c->modrm_ea += c->op_bytes;
777 if (c->ad_bytes != 8)
778 c->modrm_ea = (u32)c->modrm_ea;
785 * Decode and fetch the source operand: register, memory
788 switch (c->d & SrcMask) {
792 c->src.type = OP_REG;
795 decode_register(c->modrm_reg, c->regs,
797 c->src.val = c->src.orig_val = *(u8 *)c->src.ptr;
801 decode_register(c->modrm_reg, c->regs, 0);
802 switch ((c->src.bytes = c->op_bytes)) {
804 c->src.val = c->src.orig_val =
808 c->src.val = c->src.orig_val =
812 c->src.val = c->src.orig_val =
825 c->src.bytes = (c->d & ByteOp) ? 1 :
827 /* Don't fetch the address for invlpg: it could be unmapped. */
828 if (c->twobyte && c->b == 0x01
829 && c->modrm_reg == 7)
833 * For instructions with a ModR/M byte, switch to register
836 if ((c->d & ModRM) && c->modrm_mod == 3) {
837 c->src.type = OP_REG;
840 c->src.type = OP_MEM;
841 c->src.ptr = (unsigned long *)cr2;
843 if ((rc = ops->read_emulated((unsigned long)c->src.ptr,
845 c->src.bytes, ctxt->vcpu)) != 0)
847 c->src.orig_val = c->src.val;
850 c->src.type = OP_IMM;
851 c->src.ptr = (unsigned long *)c->eip;
852 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
853 if (c->src.bytes == 8)
855 /* NB. Immediates are sign-extended as necessary. */
856 switch (c->src.bytes) {
858 c->src.val = insn_fetch(s8, 1, c->eip);
861 c->src.val = insn_fetch(s16, 2, c->eip);
864 c->src.val = insn_fetch(s32, 4, c->eip);
869 c->src.type = OP_IMM;
870 c->src.ptr = (unsigned long *)c->eip;
872 c->src.val = insn_fetch(s8, 1, c->eip);
876 /* Decode and fetch the destination operand: register or memory. */
877 switch (c->d & DstMask) {
879 /* Special instructions do their own operand decoding. */
882 c->dst.type = OP_REG;
885 (c->b == 0xb6 || c->b == 0xb7))) {
887 decode_register(c->modrm_reg, c->regs,
889 c->dst.val = *(u8 *) c->dst.ptr;
893 decode_register(c->modrm_reg, c->regs, 0);
894 switch ((c->dst.bytes = c->op_bytes)) {
896 c->dst.val = *(u16 *)c->dst.ptr;
899 c->dst.val = *(u32 *)c->dst.ptr;
902 c->dst.val = *(u64 *)c->dst.ptr;
908 c->dst.type = OP_MEM;
909 c->dst.ptr = (unsigned long *)cr2;
910 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
912 if ((c->d & ModRM) && c->modrm_mod == 3) {
913 c->dst.type = OP_REG;
917 unsigned long mask = ~(c->dst.bytes * 8 - 1);
919 c->dst.ptr = (void *)c->dst.ptr +
920 (c->src.val & mask) / 8;
923 /* optimisation - avoid slow emulated read */
924 ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
926 c->dst.bytes, ctxt->vcpu)) != 0))
930 c->dst.orig_val = c->dst.val;
938 emulate_2op_SrcV("add", c->src, c->dst, _eflags);
942 emulate_2op_SrcV("or", c->src, c->dst, _eflags);
946 emulate_2op_SrcV("adc", c->src, c->dst, _eflags);
950 emulate_2op_SrcV("sbb", c->src, c->dst, _eflags);
954 emulate_2op_SrcV("and", c->src, c->dst, _eflags);
956 case 0x24: /* and al imm8 */
957 c->dst.type = OP_REG;
958 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
959 c->dst.val = *(u8 *)c->dst.ptr;
961 c->dst.orig_val = c->dst.val;
963 case 0x25: /* and ax imm16, or eax imm32 */
964 c->dst.type = OP_REG;
965 c->dst.bytes = c->op_bytes;
966 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
967 if (c->op_bytes == 2)
968 c->dst.val = *(u16 *)c->dst.ptr;
970 c->dst.val = *(u32 *)c->dst.ptr;
971 c->dst.orig_val = c->dst.val;
975 emulate_2op_SrcV("sub", c->src, c->dst, _eflags);
979 emulate_2op_SrcV("xor", c->src, c->dst, _eflags);
983 emulate_2op_SrcV("cmp", c->src, c->dst, _eflags);
985 case 0x63: /* movsxd */
986 if (mode != X86EMUL_MODE_PROT64)
988 c->dst.val = (s32) c->src.val;
990 case 0x80 ... 0x83: /* Grp1 */
991 switch (c->modrm_reg) {
1012 emulate_2op_SrcV("test", c->src, c->dst, _eflags);
1014 case 0x86 ... 0x87: /* xchg */
1015 /* Write back the register source. */
1016 switch (c->dst.bytes) {
1018 *(u8 *) c->src.ptr = (u8) c->dst.val;
1021 *(u16 *) c->src.ptr = (u16) c->dst.val;
1024 *c->src.ptr = (u32) c->dst.val;
1025 break; /* 64b reg: zero-extend */
1027 *c->src.ptr = c->dst.val;
1031 * Write back the memory destination with implicit LOCK
1034 c->dst.val = c->src.val;
1037 case 0x88 ... 0x8b: /* mov */
1039 case 0x8d: /* lea r16/r32, m */
1040 c->dst.val = c->modrm_val;
1042 case 0x8f: /* pop (sole member of Grp1a) */
1043 /* 64-bit mode: POP always pops a 64-bit operand. */
1044 if (mode == X86EMUL_MODE_PROT64)
1046 if ((rc = ops->read_std(register_address(
1048 c->regs[VCPU_REGS_RSP]),
1053 register_address_increment(c->regs[VCPU_REGS_RSP],
1056 case 0xa0 ... 0xa1: /* mov */
1057 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1058 c->dst.val = c->src.val;
1059 /* skip src displacement */
1060 c->eip += c->ad_bytes;
1062 case 0xa2 ... 0xa3: /* mov */
1063 c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
1064 /* skip c->dst displacement */
1065 c->eip += c->ad_bytes;
1069 switch (c->modrm_reg) {
1071 emulate_2op_SrcB("rol", c->src, c->dst, _eflags);
1074 emulate_2op_SrcB("ror", c->src, c->dst, _eflags);
1077 emulate_2op_SrcB("rcl", c->src, c->dst, _eflags);
1080 emulate_2op_SrcB("rcr", c->src, c->dst, _eflags);
1082 case 4: /* sal/shl */
1083 case 6: /* sal/shl */
1084 emulate_2op_SrcB("sal", c->src, c->dst, _eflags);
1087 emulate_2op_SrcB("shr", c->src, c->dst, _eflags);
1090 emulate_2op_SrcB("sar", c->src, c->dst, _eflags);
1094 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1096 c->dst.val = c->src.val;
1098 case 0xd0 ... 0xd1: /* Grp2 */
1101 case 0xd2 ... 0xd3: /* Grp2 */
1102 c->src.val = c->regs[VCPU_REGS_RCX];
1104 case 0xf6 ... 0xf7: /* Grp3 */
1105 switch (c->modrm_reg) {
1106 case 0 ... 1: /* test */
1108 * Special case in Grp3: test has an immediate
1111 c->src.type = OP_IMM;
1112 c->src.ptr = (unsigned long *)c->eip;
1113 c->src.bytes = (c->d & ByteOp) ? 1 :
1115 if (c->src.bytes == 8)
1117 switch (c->src.bytes) {
1119 c->src.val = insn_fetch(s8, 1, c->eip);
1122 c->src.val = insn_fetch(s16, 2, c->eip);
1125 c->src.val = insn_fetch(s32, 4, c->eip);
1130 c->dst.val = ~c->dst.val;
1133 emulate_1op("neg", c->dst, _eflags);
1136 goto cannot_emulate;
1139 case 0xfe ... 0xff: /* Grp4/Grp5 */
1140 switch (c->modrm_reg) {
1142 emulate_1op("inc", c->dst, _eflags);
1145 emulate_1op("dec", c->dst, _eflags);
1147 case 4: /* jmp abs */
1149 c->eip = c->dst.val;
1151 goto cannot_emulate;
1154 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1155 if (mode == X86EMUL_MODE_PROT64) {
1157 if ((rc = ops->read_std(
1158 (unsigned long)c->dst.ptr,
1163 register_address_increment(c->regs[VCPU_REGS_RSP],
1165 if ((rc = ops->write_emulated(
1166 register_address(ctxt->ss_base,
1167 c->regs[VCPU_REGS_RSP]),
1169 c->dst.bytes, ctxt->vcpu)) != 0)
1174 goto cannot_emulate;
1181 switch (c->dst.type) {
1183 /* The 4-byte case *is* correct:
1184 * in 64-bit mode we zero-extend.
1186 switch (c->dst.bytes) {
1188 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1191 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1194 *c->dst.ptr = (u32)c->dst.val;
1195 break; /* 64b: zero-ext */
1197 *c->dst.ptr = c->dst.val;
1203 rc = ops->cmpxchg_emulated(
1204 (unsigned long)c->dst.ptr,
1210 rc = ops->write_emulated(
1211 (unsigned long)c->dst.ptr,
1222 /* Commit shadow register state. */
1223 memcpy(ctxt->vcpu->regs, c->regs, sizeof c->regs);
1224 ctxt->eflags = _eflags;
1225 ctxt->vcpu->rip = c->eip;
1228 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1232 goto twobyte_special_insn;
1234 case 0x50 ... 0x57: /* push reg */
1235 if (c->op_bytes == 2)
1236 c->src.val = (u16) c->regs[c->b & 0x7];
1238 c->src.val = (u32) c->regs[c->b & 0x7];
1239 c->dst.type = OP_MEM;
1240 c->dst.bytes = c->op_bytes;
1241 c->dst.val = c->src.val;
1242 register_address_increment(c->regs[VCPU_REGS_RSP],
1244 c->dst.ptr = (void *) register_address(
1245 ctxt->ss_base, c->regs[VCPU_REGS_RSP]);
1247 case 0x58 ... 0x5f: /* pop reg */
1249 (unsigned long *)&c->regs[c->b & 0x7];
1251 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1252 c->regs[VCPU_REGS_RSP]), c->dst.ptr,
1253 c->op_bytes, ctxt->vcpu)) != 0)
1256 register_address_increment(c->regs[VCPU_REGS_RSP],
1258 no_wb = 1; /* Disable writeback. */
1260 case 0x6a: /* push imm8 */
1262 c->src.val = insn_fetch(s8, 1, c->eip);
1264 c->dst.type = OP_MEM;
1265 c->dst.bytes = c->op_bytes;
1266 c->dst.val = c->src.val;
1267 register_address_increment(c->regs[VCPU_REGS_RSP],
1269 c->dst.ptr = (void *) register_address(ctxt->ss_base,
1270 c->regs[VCPU_REGS_RSP]);
1272 case 0x6c: /* insb */
1273 case 0x6d: /* insw/insd */
1274 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1276 (c->d & ByteOp) ? 1 : c->op_bytes,
1278 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1279 (_eflags & EFLG_DF),
1280 register_address(ctxt->es_base,
1281 c->regs[VCPU_REGS_RDI]),
1283 c->regs[VCPU_REGS_RDX]) == 0)
1286 case 0x6e: /* outsb */
1287 case 0x6f: /* outsw/outsd */
1288 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1290 (c->d & ByteOp) ? 1 : c->op_bytes,
1292 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1293 (_eflags & EFLG_DF),
1294 register_address(c->override_base ?
1297 c->regs[VCPU_REGS_RSI]),
1299 c->regs[VCPU_REGS_RDX]) == 0)
1302 case 0x70 ... 0x7f: /* jcc (short) */ {
1303 int rel = insn_fetch(s8, 1, c->eip);
1305 if (test_cc(c->b, _eflags))
1309 case 0x9c: /* pushf */
1310 c->src.val = (unsigned long) _eflags;
1312 case 0x9d: /* popf */
1313 c->dst.ptr = (unsigned long *) &_eflags;
1314 goto pop_instruction;
1315 case 0xc3: /* ret */
1316 c->dst.ptr = &c->eip;
1317 goto pop_instruction;
1318 case 0xf4: /* hlt */
1319 ctxt->vcpu->halt_request = 1;
1322 if (c->rep_prefix) {
1323 if (c->regs[VCPU_REGS_RCX] == 0) {
1324 ctxt->vcpu->rip = c->eip;
1327 c->regs[VCPU_REGS_RCX]--;
1328 c->eip = ctxt->vcpu->rip;
1331 case 0xa4 ... 0xa5: /* movs */
1332 c->dst.type = OP_MEM;
1333 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1334 c->dst.ptr = (unsigned long *)register_address(
1336 c->regs[VCPU_REGS_RDI]);
1337 if ((rc = ops->read_emulated(register_address(
1338 c->override_base ? *c->override_base :
1340 c->regs[VCPU_REGS_RSI]),
1342 c->dst.bytes, ctxt->vcpu)) != 0)
1344 register_address_increment(c->regs[VCPU_REGS_RSI],
1345 (_eflags & EFLG_DF) ? -c->dst.bytes
1347 register_address_increment(c->regs[VCPU_REGS_RDI],
1348 (_eflags & EFLG_DF) ? -c->dst.bytes
1351 case 0xa6 ... 0xa7: /* cmps */
1352 DPRINTF("Urk! I don't handle CMPS.\n");
1353 goto cannot_emulate;
1354 case 0xaa ... 0xab: /* stos */
1355 c->dst.type = OP_MEM;
1356 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1357 c->dst.ptr = (unsigned long *)cr2;
1358 c->dst.val = c->regs[VCPU_REGS_RAX];
1359 register_address_increment(c->regs[VCPU_REGS_RDI],
1360 (_eflags & EFLG_DF) ? -c->dst.bytes
1363 case 0xac ... 0xad: /* lods */
1364 c->dst.type = OP_REG;
1365 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1366 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1367 if ((rc = ops->read_emulated(cr2, &c->dst.val,
1371 register_address_increment(c->regs[VCPU_REGS_RSI],
1372 (_eflags & EFLG_DF) ? -c->dst.bytes
1375 case 0xae ... 0xaf: /* scas */
1376 DPRINTF("Urk! I don't handle SCAS.\n");
1377 goto cannot_emulate;
1378 case 0xe8: /* call (near) */ {
1380 switch (c->op_bytes) {
1382 rel = insn_fetch(s16, 2, c->eip);
1385 rel = insn_fetch(s32, 4, c->eip);
1388 rel = insn_fetch(s64, 8, c->eip);
1391 DPRINTF("Call: Invalid op_bytes\n");
1392 goto cannot_emulate;
1394 c->src.val = (unsigned long) c->eip;
1396 c->op_bytes = c->ad_bytes;
1399 case 0xe9: /* jmp rel */
1400 case 0xeb: /* jmp rel short */
1401 JMP_REL(c->src.val);
1402 no_wb = 1; /* Disable writeback. */
1411 case 0x01: /* lgdt, lidt, lmsw */
1412 /* Disable writeback. */
1414 switch (c->modrm_reg) {
1416 unsigned long address;
1418 case 0: /* vmcall */
1419 if (c->modrm_mod != 3 || c->modrm_rm != 1)
1420 goto cannot_emulate;
1422 rc = kvm_fix_hypercall(ctxt->vcpu);
1426 kvm_emulate_hypercall(ctxt->vcpu);
1429 rc = read_descriptor(ctxt, ops, c->src.ptr,
1430 &size, &address, c->op_bytes);
1433 realmode_lgdt(ctxt->vcpu, size, address);
1435 case 3: /* lidt/vmmcall */
1436 if (c->modrm_mod == 3 && c->modrm_rm == 1) {
1437 rc = kvm_fix_hypercall(ctxt->vcpu);
1440 kvm_emulate_hypercall(ctxt->vcpu);
1442 rc = read_descriptor(ctxt, ops, c->src.ptr,
1447 realmode_lidt(ctxt->vcpu, size, address);
1451 if (c->modrm_mod != 3)
1452 goto cannot_emulate;
1453 *(u16 *)&c->regs[c->modrm_rm]
1454 = realmode_get_cr(ctxt->vcpu, 0);
1457 if (c->modrm_mod != 3)
1458 goto cannot_emulate;
1459 realmode_lmsw(ctxt->vcpu, (u16)c->modrm_val, &_eflags);
1462 emulate_invlpg(ctxt->vcpu, cr2);
1465 goto cannot_emulate;
1468 case 0x21: /* mov from dr to reg */
1470 if (c->modrm_mod != 3)
1471 goto cannot_emulate;
1472 rc = emulator_get_dr(ctxt, c->modrm_reg,
1473 &c->regs[c->modrm_rm]);
1475 case 0x23: /* mov from reg to dr */
1477 if (c->modrm_mod != 3)
1478 goto cannot_emulate;
1479 rc = emulator_set_dr(ctxt, c->modrm_reg,
1480 c->regs[c->modrm_rm]);
1482 case 0x40 ... 0x4f: /* cmov */
1483 c->dst.val = c->dst.orig_val = c->src.val;
1486 * First, assume we're decoding an even cmov opcode
1489 switch ((c->b & 15) >> 1) {
1491 no_wb = (_eflags & EFLG_OF) ? 0 : 1;
1493 case 1: /* cmovb/cmovc/cmovnae */
1494 no_wb = (_eflags & EFLG_CF) ? 0 : 1;
1496 case 2: /* cmovz/cmove */
1497 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
1499 case 3: /* cmovbe/cmovna */
1500 no_wb = (_eflags & (EFLG_CF | EFLG_ZF)) ? 0 : 1;
1503 no_wb = (_eflags & EFLG_SF) ? 0 : 1;
1505 case 5: /* cmovp/cmovpe */
1506 no_wb = (_eflags & EFLG_PF) ? 0 : 1;
1508 case 7: /* cmovle/cmovng */
1509 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
1511 case 6: /* cmovl/cmovnge */
1512 no_wb &= (!(_eflags & EFLG_SF) !=
1513 !(_eflags & EFLG_OF)) ? 0 : 1;
1516 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
1521 /* only subword offset */
1522 c->src.val &= (c->dst.bytes << 3) - 1;
1523 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, _eflags);
1527 /* only subword offset */
1528 c->src.val &= (c->dst.bytes << 3) - 1;
1529 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, _eflags);
1531 case 0xb0 ... 0xb1: /* cmpxchg */
1533 * Save real source value, then compare EAX against
1536 c->src.orig_val = c->src.val;
1537 c->src.val = c->regs[VCPU_REGS_RAX];
1538 emulate_2op_SrcV("cmp", c->src, c->dst, _eflags);
1539 if (_eflags & EFLG_ZF) {
1540 /* Success: write back to memory. */
1541 c->dst.val = c->src.orig_val;
1543 /* Failure: write the value we saw to EAX. */
1544 c->dst.type = OP_REG;
1545 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1550 /* only subword offset */
1551 c->src.val &= (c->dst.bytes << 3) - 1;
1552 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, _eflags);
1554 case 0xb6 ... 0xb7: /* movzx */
1555 c->dst.bytes = c->op_bytes;
1556 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
1559 case 0xba: /* Grp8 */
1560 switch (c->modrm_reg & 3) {
1573 /* only subword offset */
1574 c->src.val &= (c->dst.bytes << 3) - 1;
1575 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, _eflags);
1577 case 0xbe ... 0xbf: /* movsx */
1578 c->dst.bytes = c->op_bytes;
1579 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
1582 case 0xc3: /* movnti */
1583 c->dst.bytes = c->op_bytes;
1584 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
1590 twobyte_special_insn:
1591 /* Disable writeback. */
1595 emulate_clts(ctxt->vcpu);
1597 case 0x08: /* invd */
1599 case 0x09: /* wbinvd */
1601 case 0x0d: /* GrpP (prefetch) */
1602 case 0x18: /* Grp16 (prefetch/nop) */
1604 case 0x20: /* mov cr, reg */
1605 if (c->modrm_mod != 3)
1606 goto cannot_emulate;
1607 c->regs[c->modrm_rm] =
1608 realmode_get_cr(ctxt->vcpu, c->modrm_reg);
1610 case 0x22: /* mov reg, cr */
1611 if (c->modrm_mod != 3)
1612 goto cannot_emulate;
1613 realmode_set_cr(ctxt->vcpu,
1614 c->modrm_reg, c->modrm_val, &_eflags);
1618 msr_data = (u32)c->regs[VCPU_REGS_RAX]
1619 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
1620 rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
1622 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
1623 c->eip = ctxt->vcpu->rip;
1625 rc = X86EMUL_CONTINUE;
1629 rc = kvm_get_msr(ctxt->vcpu,
1630 c->regs[VCPU_REGS_RCX], &msr_data);
1632 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
1633 c->eip = ctxt->vcpu->rip;
1635 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
1636 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
1638 rc = X86EMUL_CONTINUE;
1640 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1643 switch (c->op_bytes) {
1645 rel = insn_fetch(s16, 2, c->eip);
1648 rel = insn_fetch(s32, 4, c->eip);
1651 rel = insn_fetch(s64, 8, c->eip);
1654 DPRINTF("jnz: Invalid op_bytes\n");
1655 goto cannot_emulate;
1657 if (test_cc(c->b, _eflags))
1661 case 0xc7: /* Grp9 (cmpxchg8b) */
1664 if ((rc = ops->read_emulated(cr2, &old, 8, ctxt->vcpu))
1667 if (((u32) (old >> 0) !=
1668 (u32) c->regs[VCPU_REGS_RAX]) ||
1669 ((u32) (old >> 32) !=
1670 (u32) c->regs[VCPU_REGS_RDX])) {
1671 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1672 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1673 _eflags &= ~EFLG_ZF;
1675 new = ((u64)c->regs[VCPU_REGS_RCX] << 32)
1676 | (u32) c->regs[VCPU_REGS_RBX];
1677 if ((rc = ops->cmpxchg_emulated(cr2, &old,
1678 &new, 8, ctxt->vcpu)) != 0)
1688 DPRINTF("Cannot emulate %02x\n", c->b);