]>
git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blob - drivers/kvm/x86_emulate.c
1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf( _f , ## _a )
29 #define DPRINTF(x...) do {} while (0)
31 #include "x86_emulate.h"
32 #include <linux/module.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
66 static u8 opcode_table
[256] = {
68 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
69 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
72 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
73 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
76 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
77 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
80 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
81 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
84 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
85 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
86 SrcImmByte
, SrcImm
, 0, 0,
88 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
89 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
92 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
93 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
96 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
97 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
102 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
103 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
105 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
106 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
108 0, 0, 0, DstReg
| SrcMem32
| ModRM
| Mov
/* movsxd (x86/64) */ ,
111 0, 0, ImplicitOps
|Mov
, 0,
112 SrcNone
| ByteOp
| ImplicitOps
, SrcNone
| ImplicitOps
, /* insb, insw/insd */
113 SrcNone
| ByteOp
| ImplicitOps
, SrcNone
| ImplicitOps
, /* outsb, outsw/outsd */
115 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
116 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
118 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
119 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
121 ByteOp
| DstMem
| SrcImm
| ModRM
, DstMem
| SrcImm
| ModRM
,
122 ByteOp
| DstMem
| SrcImm
| ModRM
, DstMem
| SrcImmByte
| ModRM
,
123 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
124 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
126 ByteOp
| DstMem
| SrcReg
| ModRM
| Mov
, DstMem
| SrcReg
| ModRM
| Mov
,
127 ByteOp
| DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
128 0, ModRM
| DstReg
, 0, DstMem
| SrcNone
| ModRM
| Mov
,
130 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps
, ImplicitOps
, 0, 0,
132 ByteOp
| DstReg
| SrcMem
| Mov
, DstReg
| SrcMem
| Mov
,
133 ByteOp
| DstMem
| SrcReg
| Mov
, DstMem
| SrcReg
| Mov
,
134 ByteOp
| ImplicitOps
| Mov
, ImplicitOps
| Mov
,
135 ByteOp
| ImplicitOps
, ImplicitOps
,
137 0, 0, ByteOp
| ImplicitOps
| Mov
, ImplicitOps
| Mov
,
138 ByteOp
| ImplicitOps
| Mov
, ImplicitOps
| Mov
,
139 ByteOp
| ImplicitOps
, ImplicitOps
,
141 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
143 ByteOp
| DstMem
| SrcImm
| ModRM
, DstMem
| SrcImmByte
| ModRM
,
144 0, ImplicitOps
, 0, 0,
145 ByteOp
| DstMem
| SrcImm
| ModRM
| Mov
, DstMem
| SrcImm
| ModRM
| Mov
,
147 0, 0, 0, 0, 0, 0, 0, 0,
149 ByteOp
| DstMem
| SrcImplicit
| ModRM
, DstMem
| SrcImplicit
| ModRM
,
150 ByteOp
| DstMem
| SrcImplicit
| ModRM
, DstMem
| SrcImplicit
| ModRM
,
153 0, 0, 0, 0, 0, 0, 0, 0,
155 0, 0, 0, 0, 0, 0, 0, 0,
157 ImplicitOps
, SrcImm
|ImplicitOps
, 0, SrcImmByte
|ImplicitOps
, 0, 0, 0, 0,
161 ByteOp
| DstMem
| SrcNone
| ModRM
, DstMem
| SrcNone
| ModRM
,
164 0, 0, ByteOp
| DstMem
| SrcNone
| ModRM
, DstMem
| SrcNone
| ModRM
167 static u16 twobyte_table
[256] = {
169 0, SrcMem
| ModRM
| DstReg
, 0, 0, 0, 0, ImplicitOps
, 0,
170 ImplicitOps
, ImplicitOps
, 0, 0, 0, ImplicitOps
| ModRM
, 0, 0,
172 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps
| ModRM
, 0, 0, 0, 0, 0, 0, 0,
174 ModRM
| ImplicitOps
, ModRM
, ModRM
| ImplicitOps
, ModRM
, 0, 0, 0, 0,
175 0, 0, 0, 0, 0, 0, 0, 0,
177 ImplicitOps
, 0, ImplicitOps
, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
179 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
180 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
181 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
182 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
184 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
185 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
186 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
187 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
189 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
191 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
193 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
195 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
196 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
197 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
198 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
200 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
202 0, 0, 0, DstMem
| SrcReg
| ModRM
| BitOp
, 0, 0, 0, 0,
204 0, 0, 0, DstMem
| SrcReg
| ModRM
| BitOp
, 0, 0, 0, 0,
206 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
, 0,
207 DstMem
| SrcReg
| ModRM
| BitOp
,
208 0, 0, ByteOp
| DstReg
| SrcMem
| ModRM
| Mov
,
209 DstReg
| SrcMem16
| ModRM
| Mov
,
211 0, 0, DstMem
| SrcImmByte
| ModRM
, DstMem
| SrcReg
| ModRM
| BitOp
,
212 0, 0, ByteOp
| DstReg
| SrcMem
| ModRM
| Mov
,
213 DstReg
| SrcMem16
| ModRM
| Mov
,
215 0, 0, 0, DstMem
| SrcReg
| ModRM
| Mov
, 0, 0, 0, ImplicitOps
| ModRM
,
216 0, 0, 0, 0, 0, 0, 0, 0,
218 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
220 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
222 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
225 /* EFLAGS bit definitions. */
226 #define EFLG_OF (1<<11)
227 #define EFLG_DF (1<<10)
228 #define EFLG_SF (1<<7)
229 #define EFLG_ZF (1<<6)
230 #define EFLG_AF (1<<4)
231 #define EFLG_PF (1<<2)
232 #define EFLG_CF (1<<0)
235 * Instruction emulation:
236 * Most instructions are emulated directly via a fragment of inline assembly
237 * code. This allows us to save/restore EFLAGS and thus very easily pick up
238 * any modified flags.
241 #if defined(CONFIG_X86_64)
242 #define _LO32 "k" /* force 32-bit operand */
243 #define _STK "%%rsp" /* stack pointer */
244 #elif defined(__i386__)
245 #define _LO32 "" /* force 32-bit operand */
246 #define _STK "%%esp" /* stack pointer */
250 * These EFLAGS bits are restored from saved value during emulation, and
251 * any changes are written back to the saved value after emulation.
253 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
255 /* Before executing instruction: restore necessary bits in EFLAGS. */
256 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
257 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
259 "movl %"_msk",%"_LO32 _tmp"; " \
260 "andl %"_LO32 _tmp",("_STK"); " \
262 "notl %"_LO32 _tmp"; " \
263 "andl %"_LO32 _tmp",("_STK"); " \
265 "orl %"_LO32 _tmp",("_STK"); " \
267 /* _sav &= ~msk; */ \
268 "movl %"_msk",%"_LO32 _tmp"; " \
269 "notl %"_LO32 _tmp"; " \
270 "andl %"_LO32 _tmp",%"_sav"; "
272 /* After executing instruction: write-back necessary bits in EFLAGS. */
273 #define _POST_EFLAGS(_sav, _msk, _tmp) \
274 /* _sav |= EFLAGS & _msk; */ \
277 "andl %"_msk",%"_LO32 _tmp"; " \
278 "orl %"_LO32 _tmp",%"_sav"; "
280 /* Raw emulation: instruction has two explicit operands. */
281 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
283 unsigned long _tmp; \
285 switch ((_dst).bytes) { \
287 __asm__ __volatile__ ( \
288 _PRE_EFLAGS("0","4","2") \
289 _op"w %"_wx"3,%1; " \
290 _POST_EFLAGS("0","4","2") \
291 : "=m" (_eflags), "=m" ((_dst).val), \
293 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
296 __asm__ __volatile__ ( \
297 _PRE_EFLAGS("0","4","2") \
298 _op"l %"_lx"3,%1; " \
299 _POST_EFLAGS("0","4","2") \
300 : "=m" (_eflags), "=m" ((_dst).val), \
302 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
305 __emulate_2op_8byte(_op, _src, _dst, \
306 _eflags, _qx, _qy); \
311 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
313 unsigned long _tmp; \
314 switch ( (_dst).bytes ) \
317 __asm__ __volatile__ ( \
318 _PRE_EFLAGS("0","4","2") \
319 _op"b %"_bx"3,%1; " \
320 _POST_EFLAGS("0","4","2") \
321 : "=m" (_eflags), "=m" ((_dst).val), \
323 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
326 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
327 _wx, _wy, _lx, _ly, _qx, _qy); \
332 /* Source operand is byte-sized and may be restricted to just %cl. */
333 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
334 __emulate_2op(_op, _src, _dst, _eflags, \
335 "b", "c", "b", "c", "b", "c", "b", "c")
337 /* Source operand is byte, word, long or quad sized. */
338 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
339 __emulate_2op(_op, _src, _dst, _eflags, \
340 "b", "q", "w", "r", _LO32, "r", "", "r")
342 /* Source operand is word, long or quad sized. */
343 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
344 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
345 "w", "r", _LO32, "r", "", "r")
347 /* Instruction has only one explicit operand (no source operand). */
348 #define emulate_1op(_op, _dst, _eflags) \
350 unsigned long _tmp; \
352 switch ( (_dst).bytes ) \
355 __asm__ __volatile__ ( \
356 _PRE_EFLAGS("0","3","2") \
358 _POST_EFLAGS("0","3","2") \
359 : "=m" (_eflags), "=m" ((_dst).val), \
361 : "i" (EFLAGS_MASK) ); \
364 __asm__ __volatile__ ( \
365 _PRE_EFLAGS("0","3","2") \
367 _POST_EFLAGS("0","3","2") \
368 : "=m" (_eflags), "=m" ((_dst).val), \
370 : "i" (EFLAGS_MASK) ); \
373 __asm__ __volatile__ ( \
374 _PRE_EFLAGS("0","3","2") \
376 _POST_EFLAGS("0","3","2") \
377 : "=m" (_eflags), "=m" ((_dst).val), \
379 : "i" (EFLAGS_MASK) ); \
382 __emulate_1op_8byte(_op, _dst, _eflags); \
387 /* Emulate an instruction with quadword operands (x86/64 only). */
388 #if defined(CONFIG_X86_64)
389 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
391 __asm__ __volatile__ ( \
392 _PRE_EFLAGS("0","4","2") \
393 _op"q %"_qx"3,%1; " \
394 _POST_EFLAGS("0","4","2") \
395 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
396 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
399 #define __emulate_1op_8byte(_op, _dst, _eflags) \
401 __asm__ __volatile__ ( \
402 _PRE_EFLAGS("0","3","2") \
404 _POST_EFLAGS("0","3","2") \
405 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
406 : "i" (EFLAGS_MASK) ); \
409 #elif defined(__i386__)
410 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
411 #define __emulate_1op_8byte(_op, _dst, _eflags)
412 #endif /* __i386__ */
414 /* Fetch next part of the instruction being emulated. */
415 #define insn_fetch(_type, _size, _eip) \
416 ({ unsigned long _x; \
417 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
418 (_size), ctxt->vcpu); \
425 /* Access/update address held in a register, based on addressing mode. */
426 #define address_mask(reg) \
427 ((c->ad_bytes == sizeof(unsigned long)) ? \
428 (reg) : ((reg) & ((1UL << (c->ad_bytes << 3)) - 1)))
429 #define register_address(base, reg) \
430 ((base) + address_mask(reg))
431 #define register_address_increment(reg, inc) \
433 /* signed type ensures sign extension to long */ \
435 if (c->ad_bytes == sizeof(unsigned long)) \
439 ~((1UL << (c->ad_bytes << 3)) - 1)) | \
441 ((1UL << (c->ad_bytes << 3)) - 1)); \
444 #define JMP_REL(rel) \
446 register_address_increment(c->eip, rel); \
450 * Given the 'reg' portion of a ModRM byte, and a register block, return a
451 * pointer into the block that addresses the relevant register.
452 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
454 static void *decode_register(u8 modrm_reg
, unsigned long *regs
,
459 p
= ®s
[modrm_reg
];
460 if (highbyte_regs
&& modrm_reg
>= 4 && modrm_reg
< 8)
461 p
= (unsigned char *)®s
[modrm_reg
& 3] + 1;
465 static int read_descriptor(struct x86_emulate_ctxt
*ctxt
,
466 struct x86_emulate_ops
*ops
,
468 u16
*size
, unsigned long *address
, int op_bytes
)
475 rc
= ops
->read_std((unsigned long)ptr
, (unsigned long *)size
, 2,
479 rc
= ops
->read_std((unsigned long)ptr
+ 2, address
, op_bytes
,
484 static int test_cc(unsigned int condition
, unsigned int flags
)
488 switch ((condition
& 15) >> 1) {
490 rc
|= (flags
& EFLG_OF
);
492 case 1: /* b/c/nae */
493 rc
|= (flags
& EFLG_CF
);
496 rc
|= (flags
& EFLG_ZF
);
499 rc
|= (flags
& (EFLG_CF
|EFLG_ZF
));
502 rc
|= (flags
& EFLG_SF
);
505 rc
|= (flags
& EFLG_PF
);
508 rc
|= (flags
& EFLG_ZF
);
511 rc
|= (!(flags
& EFLG_SF
) != !(flags
& EFLG_OF
));
515 /* Odd condition identifiers (lsb == 1) have inverted sense. */
516 return (!!rc
^ (condition
& 1));
520 x86_decode_insn(struct x86_emulate_ctxt
*ctxt
, struct x86_emulate_ops
*ops
)
522 struct decode_cache
*c
= &ctxt
->decode
;
523 u8 sib
, rex_prefix
= 0;
525 int mode
= ctxt
->mode
;
526 int index_reg
= 0, base_reg
= 0, scale
, rip_relative
= 0;
528 /* Shadow copy of register state. Committed on successful emulation. */
530 memset(c
, 0, sizeof(struct decode_cache
));
531 c
->eip
= ctxt
->vcpu
->rip
;
532 memcpy(c
->regs
, ctxt
->vcpu
->regs
, sizeof c
->regs
);
535 case X86EMUL_MODE_REAL
:
536 case X86EMUL_MODE_PROT16
:
537 c
->op_bytes
= c
->ad_bytes
= 2;
539 case X86EMUL_MODE_PROT32
:
540 c
->op_bytes
= c
->ad_bytes
= 4;
543 case X86EMUL_MODE_PROT64
:
552 /* Legacy prefixes. */
554 switch (c
->b
= insn_fetch(u8
, 1, c
->eip
)) {
555 case 0x66: /* operand-size override */
556 c
->op_bytes
^= 6; /* switch between 2/4 bytes */
558 case 0x67: /* address-size override */
559 if (mode
== X86EMUL_MODE_PROT64
)
560 /* switch between 4/8 bytes */
563 /* switch between 2/4 bytes */
566 case 0x2e: /* CS override */
567 c
->override_base
= &ctxt
->cs_base
;
569 case 0x3e: /* DS override */
570 c
->override_base
= &ctxt
->ds_base
;
572 case 0x26: /* ES override */
573 c
->override_base
= &ctxt
->es_base
;
575 case 0x64: /* FS override */
576 c
->override_base
= &ctxt
->fs_base
;
578 case 0x65: /* GS override */
579 c
->override_base
= &ctxt
->gs_base
;
581 case 0x36: /* SS override */
582 c
->override_base
= &ctxt
->ss_base
;
584 case 0x40 ... 0x4f: /* REX */
585 if (mode
!= X86EMUL_MODE_PROT64
)
589 case 0xf0: /* LOCK */
592 case 0xf2: /* REPNE/REPNZ */
593 case 0xf3: /* REP/REPE/REPZ */
600 /* Any legacy prefix after a REX prefix nullifies its effect. */
610 c
->op_bytes
= 8; /* REX.W */
611 c
->modrm_reg
= (rex_prefix
& 4) << 1; /* REX.R */
612 index_reg
= (rex_prefix
& 2) << 2; /* REX.X */
613 c
->modrm_rm
= base_reg
= (rex_prefix
& 1) << 3; /* REG.B */
616 /* Opcode byte(s). */
617 c
->d
= opcode_table
[c
->b
];
619 /* Two-byte opcode? */
622 c
->b
= insn_fetch(u8
, 1, c
->eip
);
623 c
->d
= twobyte_table
[c
->b
];
628 DPRINTF("Cannot emulate %02x\n", c
->b
);
633 /* ModRM and SIB bytes. */
635 c
->modrm
= insn_fetch(u8
, 1, c
->eip
);
636 c
->modrm_mod
|= (c
->modrm
& 0xc0) >> 6;
637 c
->modrm_reg
|= (c
->modrm
& 0x38) >> 3;
638 c
->modrm_rm
|= (c
->modrm
& 0x07);
642 if (c
->modrm_mod
== 3) {
643 c
->modrm_val
= *(unsigned long *)
644 decode_register(c
->modrm_rm
, c
->regs
, c
->d
& ByteOp
);
648 if (c
->ad_bytes
== 2) {
649 unsigned bx
= c
->regs
[VCPU_REGS_RBX
];
650 unsigned bp
= c
->regs
[VCPU_REGS_RBP
];
651 unsigned si
= c
->regs
[VCPU_REGS_RSI
];
652 unsigned di
= c
->regs
[VCPU_REGS_RDI
];
654 /* 16-bit ModR/M decode. */
655 switch (c
->modrm_mod
) {
657 if (c
->modrm_rm
== 6)
659 insn_fetch(u16
, 2, c
->eip
);
662 c
->modrm_ea
+= insn_fetch(s8
, 1, c
->eip
);
665 c
->modrm_ea
+= insn_fetch(u16
, 2, c
->eip
);
668 switch (c
->modrm_rm
) {
670 c
->modrm_ea
+= bx
+ si
;
673 c
->modrm_ea
+= bx
+ di
;
676 c
->modrm_ea
+= bp
+ si
;
679 c
->modrm_ea
+= bp
+ di
;
688 if (c
->modrm_mod
!= 0)
695 if (c
->modrm_rm
== 2 || c
->modrm_rm
== 3 ||
696 (c
->modrm_rm
== 6 && c
->modrm_mod
!= 0))
697 if (!c
->override_base
)
698 c
->override_base
= &ctxt
->ss_base
;
699 c
->modrm_ea
= (u16
)c
->modrm_ea
;
701 /* 32/64-bit ModR/M decode. */
702 switch (c
->modrm_rm
) {
705 sib
= insn_fetch(u8
, 1, c
->eip
);
706 index_reg
|= (sib
>> 3) & 7;
712 if (c
->modrm_mod
!= 0)
717 insn_fetch(s32
, 4, c
->eip
);
720 c
->modrm_ea
+= c
->regs
[base_reg
];
727 c
->regs
[index_reg
] << scale
;
732 if (c
->modrm_mod
!= 0)
733 c
->modrm_ea
+= c
->regs
[c
->modrm_rm
];
734 else if (mode
== X86EMUL_MODE_PROT64
)
738 c
->modrm_ea
+= c
->regs
[c
->modrm_rm
];
741 switch (c
->modrm_mod
) {
743 if (c
->modrm_rm
== 5)
745 insn_fetch(s32
, 4, c
->eip
);
748 c
->modrm_ea
+= insn_fetch(s8
, 1, c
->eip
);
751 c
->modrm_ea
+= insn_fetch(s32
, 4, c
->eip
);
755 if (!c
->override_base
)
756 c
->override_base
= &ctxt
->ds_base
;
757 if (mode
== X86EMUL_MODE_PROT64
&&
758 c
->override_base
!= &ctxt
->fs_base
&&
759 c
->override_base
!= &ctxt
->gs_base
)
760 c
->override_base
= NULL
;
762 if (c
->override_base
)
763 c
->modrm_ea
+= *c
->override_base
;
766 c
->modrm_ea
+= c
->eip
;
767 switch (c
->d
& SrcMask
) {
775 if (c
->op_bytes
== 8)
778 c
->modrm_ea
+= c
->op_bytes
;
781 if (c
->ad_bytes
!= 8)
782 c
->modrm_ea
= (u32
)c
->modrm_ea
;
788 * Decode and fetch the source operand: register, memory
791 switch (c
->d
& SrcMask
) {
795 c
->src
.type
= OP_REG
;
798 decode_register(c
->modrm_reg
, c
->regs
,
800 c
->src
.val
= c
->src
.orig_val
= *(u8
*)c
->src
.ptr
;
804 decode_register(c
->modrm_reg
, c
->regs
, 0);
805 switch ((c
->src
.bytes
= c
->op_bytes
)) {
807 c
->src
.val
= c
->src
.orig_val
=
811 c
->src
.val
= c
->src
.orig_val
=
815 c
->src
.val
= c
->src
.orig_val
=
828 c
->src
.bytes
= (c
->d
& ByteOp
) ? 1 :
830 /* Don't fetch the address for invlpg: it could be unmapped. */
831 if (c
->twobyte
&& c
->b
== 0x01
832 && c
->modrm_reg
== 7)
836 * For instructions with a ModR/M byte, switch to register
839 if ((c
->d
& ModRM
) && c
->modrm_mod
== 3) {
840 c
->src
.type
= OP_REG
;
843 c
->src
.type
= OP_MEM
;
846 c
->src
.type
= OP_IMM
;
847 c
->src
.ptr
= (unsigned long *)c
->eip
;
848 c
->src
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
849 if (c
->src
.bytes
== 8)
851 /* NB. Immediates are sign-extended as necessary. */
852 switch (c
->src
.bytes
) {
854 c
->src
.val
= insn_fetch(s8
, 1, c
->eip
);
857 c
->src
.val
= insn_fetch(s16
, 2, c
->eip
);
860 c
->src
.val
= insn_fetch(s32
, 4, c
->eip
);
865 c
->src
.type
= OP_IMM
;
866 c
->src
.ptr
= (unsigned long *)c
->eip
;
868 c
->src
.val
= insn_fetch(s8
, 1, c
->eip
);
872 /* Decode and fetch the destination operand: register or memory. */
873 switch (c
->d
& DstMask
) {
875 /* Special instructions do their own operand decoding. */
878 c
->dst
.type
= OP_REG
;
881 (c
->b
== 0xb6 || c
->b
== 0xb7))) {
883 decode_register(c
->modrm_reg
, c
->regs
,
885 c
->dst
.val
= *(u8
*) c
->dst
.ptr
;
889 decode_register(c
->modrm_reg
, c
->regs
, 0);
890 switch ((c
->dst
.bytes
= c
->op_bytes
)) {
892 c
->dst
.val
= *(u16
*)c
->dst
.ptr
;
895 c
->dst
.val
= *(u32
*)c
->dst
.ptr
;
898 c
->dst
.val
= *(u64
*)c
->dst
.ptr
;
904 if ((c
->d
& ModRM
) && c
->modrm_mod
== 3) {
905 c
->dst
.type
= OP_REG
;
908 c
->dst
.type
= OP_MEM
;
913 return (rc
== X86EMUL_UNHANDLEABLE
) ? -1 : 0;
916 static inline void emulate_push(struct x86_emulate_ctxt
*ctxt
)
918 struct decode_cache
*c
= &ctxt
->decode
;
920 c
->dst
.type
= OP_MEM
;
921 c
->dst
.bytes
= c
->op_bytes
;
922 c
->dst
.val
= c
->src
.val
;
923 register_address_increment(c
->regs
[VCPU_REGS_RSP
], -c
->op_bytes
);
924 c
->dst
.ptr
= (void *) register_address(ctxt
->ss_base
,
925 c
->regs
[VCPU_REGS_RSP
]);
928 static inline int emulate_grp1a(struct x86_emulate_ctxt
*ctxt
,
929 struct x86_emulate_ops
*ops
)
931 struct decode_cache
*c
= &ctxt
->decode
;
934 /* 64-bit mode: POP always pops a 64-bit operand. */
936 if (ctxt
->mode
== X86EMUL_MODE_PROT64
)
939 rc
= ops
->read_std(register_address(ctxt
->ss_base
,
940 c
->regs
[VCPU_REGS_RSP
]),
941 &c
->dst
.val
, c
->dst
.bytes
, ctxt
->vcpu
);
945 register_address_increment(c
->regs
[VCPU_REGS_RSP
], c
->dst
.bytes
);
950 static inline void emulate_grp2(struct x86_emulate_ctxt
*ctxt
)
952 struct decode_cache
*c
= &ctxt
->decode
;
953 switch (c
->modrm_reg
) {
955 emulate_2op_SrcB("rol", c
->src
, c
->dst
, ctxt
->eflags
);
958 emulate_2op_SrcB("ror", c
->src
, c
->dst
, ctxt
->eflags
);
961 emulate_2op_SrcB("rcl", c
->src
, c
->dst
, ctxt
->eflags
);
964 emulate_2op_SrcB("rcr", c
->src
, c
->dst
, ctxt
->eflags
);
966 case 4: /* sal/shl */
967 case 6: /* sal/shl */
968 emulate_2op_SrcB("sal", c
->src
, c
->dst
, ctxt
->eflags
);
971 emulate_2op_SrcB("shr", c
->src
, c
->dst
, ctxt
->eflags
);
974 emulate_2op_SrcB("sar", c
->src
, c
->dst
, ctxt
->eflags
);
979 static inline int emulate_grp3(struct x86_emulate_ctxt
*ctxt
,
980 struct x86_emulate_ops
*ops
)
982 struct decode_cache
*c
= &ctxt
->decode
;
985 switch (c
->modrm_reg
) {
986 case 0 ... 1: /* test */
988 * Special case in Grp3: test has an immediate
991 c
->src
.type
= OP_IMM
;
992 c
->src
.ptr
= (unsigned long *)c
->eip
;
993 c
->src
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
994 if (c
->src
.bytes
== 8)
996 switch (c
->src
.bytes
) {
998 c
->src
.val
= insn_fetch(s8
, 1, c
->eip
);
1001 c
->src
.val
= insn_fetch(s16
, 2, c
->eip
);
1004 c
->src
.val
= insn_fetch(s32
, 4, c
->eip
);
1007 emulate_2op_SrcV("test", c
->src
, c
->dst
, ctxt
->eflags
);
1010 c
->dst
.val
= ~c
->dst
.val
;
1013 emulate_1op("neg", c
->dst
, ctxt
->eflags
);
1016 DPRINTF("Cannot emulate %02x\n", c
->b
);
1017 rc
= X86EMUL_UNHANDLEABLE
;
1024 static inline int emulate_grp45(struct x86_emulate_ctxt
*ctxt
,
1025 struct x86_emulate_ops
*ops
)
1027 struct decode_cache
*c
= &ctxt
->decode
;
1030 switch (c
->modrm_reg
) {
1032 emulate_1op("inc", c
->dst
, ctxt
->eflags
);
1035 emulate_1op("dec", c
->dst
, ctxt
->eflags
);
1037 case 4: /* jmp abs */
1039 c
->eip
= c
->dst
.val
;
1041 DPRINTF("Cannot emulate %02x\n", c
->b
);
1042 return X86EMUL_UNHANDLEABLE
;
1047 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1049 if (ctxt
->mode
== X86EMUL_MODE_PROT64
) {
1051 rc
= ops
->read_std((unsigned long)c
->dst
.ptr
,
1052 &c
->dst
.val
, 8, ctxt
->vcpu
);
1056 register_address_increment(c
->regs
[VCPU_REGS_RSP
],
1058 rc
= ops
->write_emulated(register_address(ctxt
->ss_base
,
1059 c
->regs
[VCPU_REGS_RSP
]), &c
->dst
.val
,
1060 c
->dst
.bytes
, ctxt
->vcpu
);
1063 c
->dst
.type
= OP_NONE
;
1066 DPRINTF("Cannot emulate %02x\n", c
->b
);
1067 return X86EMUL_UNHANDLEABLE
;
1072 static inline int emulate_grp9(struct x86_emulate_ctxt
*ctxt
,
1073 struct x86_emulate_ops
*ops
,
1076 struct decode_cache
*c
= &ctxt
->decode
;
1080 rc
= ops
->read_emulated(cr2
, &old
, 8, ctxt
->vcpu
);
1084 if (((u32
) (old
>> 0) != (u32
) c
->regs
[VCPU_REGS_RAX
]) ||
1085 ((u32
) (old
>> 32) != (u32
) c
->regs
[VCPU_REGS_RDX
])) {
1087 c
->regs
[VCPU_REGS_RAX
] = (u32
) (old
>> 0);
1088 c
->regs
[VCPU_REGS_RDX
] = (u32
) (old
>> 32);
1089 ctxt
->eflags
&= ~EFLG_ZF
;
1092 new = ((u64
)c
->regs
[VCPU_REGS_RCX
] << 32) |
1093 (u32
) c
->regs
[VCPU_REGS_RBX
];
1095 rc
= ops
->cmpxchg_emulated(cr2
, &old
, &new, 8, ctxt
->vcpu
);
1098 ctxt
->eflags
|= EFLG_ZF
;
1103 static inline int writeback(struct x86_emulate_ctxt
*ctxt
,
1104 struct x86_emulate_ops
*ops
)
1107 struct decode_cache
*c
= &ctxt
->decode
;
1109 switch (c
->dst
.type
) {
1111 /* The 4-byte case *is* correct:
1112 * in 64-bit mode we zero-extend.
1114 switch (c
->dst
.bytes
) {
1116 *(u8
*)c
->dst
.ptr
= (u8
)c
->dst
.val
;
1119 *(u16
*)c
->dst
.ptr
= (u16
)c
->dst
.val
;
1122 *c
->dst
.ptr
= (u32
)c
->dst
.val
;
1123 break; /* 64b: zero-ext */
1125 *c
->dst
.ptr
= c
->dst
.val
;
1131 rc
= ops
->cmpxchg_emulated(
1132 (unsigned long)c
->dst
.ptr
,
1138 rc
= ops
->write_emulated(
1139 (unsigned long)c
->dst
.ptr
,
1156 x86_emulate_insn(struct x86_emulate_ctxt
*ctxt
, struct x86_emulate_ops
*ops
)
1158 unsigned long cr2
= ctxt
->cr2
;
1160 unsigned long saved_eip
= 0;
1161 struct decode_cache
*c
= &ctxt
->decode
;
1164 /* Shadow copy of register state. Committed on successful emulation.
1165 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
1169 memcpy(c
->regs
, ctxt
->vcpu
->regs
, sizeof c
->regs
);
1172 if ((c
->d
& ModRM
) && (c
->modrm_mod
!= 3))
1175 if (c
->src
.type
== OP_MEM
) {
1176 c
->src
.ptr
= (unsigned long *)cr2
;
1178 if ((rc
= ops
->read_emulated((unsigned long)c
->src
.ptr
,
1183 c
->src
.orig_val
= c
->src
.val
;
1186 if ((c
->d
& DstMask
) == ImplicitOps
)
1190 if (c
->dst
.type
== OP_MEM
) {
1191 c
->dst
.ptr
= (unsigned long *)cr2
;
1192 c
->dst
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
1195 unsigned long mask
= ~(c
->dst
.bytes
* 8 - 1);
1197 c
->dst
.ptr
= (void *)c
->dst
.ptr
+
1198 (c
->src
.val
& mask
) / 8;
1200 if (!(c
->d
& Mov
) &&
1201 /* optimisation - avoid slow emulated read */
1202 ((rc
= ops
->read_emulated((unsigned long)c
->dst
.ptr
,
1204 c
->dst
.bytes
, ctxt
->vcpu
)) != 0))
1207 c
->dst
.orig_val
= c
->dst
.val
;
1215 emulate_2op_SrcV("add", c
->src
, c
->dst
, ctxt
->eflags
);
1219 emulate_2op_SrcV("or", c
->src
, c
->dst
, ctxt
->eflags
);
1223 emulate_2op_SrcV("adc", c
->src
, c
->dst
, ctxt
->eflags
);
1227 emulate_2op_SrcV("sbb", c
->src
, c
->dst
, ctxt
->eflags
);
1231 emulate_2op_SrcV("and", c
->src
, c
->dst
, ctxt
->eflags
);
1233 case 0x24: /* and al imm8 */
1234 c
->dst
.type
= OP_REG
;
1235 c
->dst
.ptr
= &c
->regs
[VCPU_REGS_RAX
];
1236 c
->dst
.val
= *(u8
*)c
->dst
.ptr
;
1238 c
->dst
.orig_val
= c
->dst
.val
;
1240 case 0x25: /* and ax imm16, or eax imm32 */
1241 c
->dst
.type
= OP_REG
;
1242 c
->dst
.bytes
= c
->op_bytes
;
1243 c
->dst
.ptr
= &c
->regs
[VCPU_REGS_RAX
];
1244 if (c
->op_bytes
== 2)
1245 c
->dst
.val
= *(u16
*)c
->dst
.ptr
;
1247 c
->dst
.val
= *(u32
*)c
->dst
.ptr
;
1248 c
->dst
.orig_val
= c
->dst
.val
;
1252 emulate_2op_SrcV("sub", c
->src
, c
->dst
, ctxt
->eflags
);
1256 emulate_2op_SrcV("xor", c
->src
, c
->dst
, ctxt
->eflags
);
1260 emulate_2op_SrcV("cmp", c
->src
, c
->dst
, ctxt
->eflags
);
1262 case 0x63: /* movsxd */
1263 if (ctxt
->mode
!= X86EMUL_MODE_PROT64
)
1264 goto cannot_emulate
;
1265 c
->dst
.val
= (s32
) c
->src
.val
;
1267 case 0x80 ... 0x83: /* Grp1 */
1268 switch (c
->modrm_reg
) {
1288 emulate_2op_SrcV("test", c
->src
, c
->dst
, ctxt
->eflags
);
1290 case 0x86 ... 0x87: /* xchg */
1291 /* Write back the register source. */
1292 switch (c
->dst
.bytes
) {
1294 *(u8
*) c
->src
.ptr
= (u8
) c
->dst
.val
;
1297 *(u16
*) c
->src
.ptr
= (u16
) c
->dst
.val
;
1300 *c
->src
.ptr
= (u32
) c
->dst
.val
;
1301 break; /* 64b reg: zero-extend */
1303 *c
->src
.ptr
= c
->dst
.val
;
1307 * Write back the memory destination with implicit LOCK
1310 c
->dst
.val
= c
->src
.val
;
1313 case 0x88 ... 0x8b: /* mov */
1315 case 0x8d: /* lea r16/r32, m */
1316 c
->dst
.val
= c
->modrm_val
;
1318 case 0x8f: /* pop (sole member of Grp1a) */
1319 rc
= emulate_grp1a(ctxt
, ops
);
1323 case 0xa0 ... 0xa1: /* mov */
1324 c
->dst
.ptr
= (unsigned long *)&c
->regs
[VCPU_REGS_RAX
];
1325 c
->dst
.val
= c
->src
.val
;
1326 /* skip src displacement */
1327 c
->eip
+= c
->ad_bytes
;
1329 case 0xa2 ... 0xa3: /* mov */
1330 c
->dst
.val
= (unsigned long)c
->regs
[VCPU_REGS_RAX
];
1331 /* skip c->dst displacement */
1332 c
->eip
+= c
->ad_bytes
;
1337 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1339 c
->dst
.val
= c
->src
.val
;
1341 case 0xd0 ... 0xd1: /* Grp2 */
1345 case 0xd2 ... 0xd3: /* Grp2 */
1346 c
->src
.val
= c
->regs
[VCPU_REGS_RCX
];
1349 case 0xf6 ... 0xf7: /* Grp3 */
1350 rc
= emulate_grp3(ctxt
, ops
);
1354 case 0xfe ... 0xff: /* Grp4/Grp5 */
1355 rc
= emulate_grp45(ctxt
, ops
);
1362 rc
= writeback(ctxt
, ops
);
1366 /* Commit shadow register state. */
1367 memcpy(ctxt
->vcpu
->regs
, c
->regs
, sizeof c
->regs
);
1368 ctxt
->vcpu
->rip
= c
->eip
;
1371 if (rc
== X86EMUL_UNHANDLEABLE
) {
1379 goto twobyte_special_insn
;
1381 case 0x50 ... 0x57: /* push reg */
1382 if (c
->op_bytes
== 2)
1383 c
->src
.val
= (u16
) c
->regs
[c
->b
& 0x7];
1385 c
->src
.val
= (u32
) c
->regs
[c
->b
& 0x7];
1386 c
->dst
.type
= OP_MEM
;
1387 c
->dst
.bytes
= c
->op_bytes
;
1388 c
->dst
.val
= c
->src
.val
;
1389 register_address_increment(c
->regs
[VCPU_REGS_RSP
],
1391 c
->dst
.ptr
= (void *) register_address(
1392 ctxt
->ss_base
, c
->regs
[VCPU_REGS_RSP
]);
1394 case 0x58 ... 0x5f: /* pop reg */
1395 c
->dst
.ptr
= (unsigned long *)&c
->regs
[c
->b
& 0x7];
1397 if ((rc
= ops
->read_std(register_address(ctxt
->ss_base
,
1398 c
->regs
[VCPU_REGS_RSP
]), c
->dst
.ptr
,
1399 c
->op_bytes
, ctxt
->vcpu
)) != 0)
1402 register_address_increment(c
->regs
[VCPU_REGS_RSP
],
1404 c
->dst
.type
= OP_NONE
; /* Disable writeback. */
1406 case 0x6a: /* push imm8 */
1408 c
->src
.val
= insn_fetch(s8
, 1, c
->eip
);
1411 case 0x6c: /* insb */
1412 case 0x6d: /* insw/insd */
1413 if (kvm_emulate_pio_string(ctxt
->vcpu
, NULL
,
1415 (c
->d
& ByteOp
) ? 1 : c
->op_bytes
,
1417 address_mask(c
->regs
[VCPU_REGS_RCX
]) : 1,
1418 (ctxt
->eflags
& EFLG_DF
),
1419 register_address(ctxt
->es_base
,
1420 c
->regs
[VCPU_REGS_RDI
]),
1422 c
->regs
[VCPU_REGS_RDX
]) == 0) {
1427 case 0x6e: /* outsb */
1428 case 0x6f: /* outsw/outsd */
1429 if (kvm_emulate_pio_string(ctxt
->vcpu
, NULL
,
1431 (c
->d
& ByteOp
) ? 1 : c
->op_bytes
,
1433 address_mask(c
->regs
[VCPU_REGS_RCX
]) : 1,
1434 (ctxt
->eflags
& EFLG_DF
),
1435 register_address(c
->override_base
?
1438 c
->regs
[VCPU_REGS_RSI
]),
1440 c
->regs
[VCPU_REGS_RDX
]) == 0) {
1445 case 0x70 ... 0x7f: /* jcc (short) */ {
1446 int rel
= insn_fetch(s8
, 1, c
->eip
);
1448 if (test_cc(c
->b
, ctxt
->eflags
))
1452 case 0x9c: /* pushf */
1453 c
->src
.val
= (unsigned long) ctxt
->eflags
;
1456 case 0x9d: /* popf */
1457 c
->dst
.ptr
= (unsigned long *) &ctxt
->eflags
;
1458 goto pop_instruction
;
1459 case 0xc3: /* ret */
1460 c
->dst
.ptr
= &c
->eip
;
1461 goto pop_instruction
;
1462 case 0xf4: /* hlt */
1463 ctxt
->vcpu
->halt_request
= 1;
1466 if (c
->rep_prefix
) {
1467 if (c
->regs
[VCPU_REGS_RCX
] == 0) {
1468 ctxt
->vcpu
->rip
= c
->eip
;
1471 c
->regs
[VCPU_REGS_RCX
]--;
1472 c
->eip
= ctxt
->vcpu
->rip
;
1475 case 0xa4 ... 0xa5: /* movs */
1476 c
->dst
.type
= OP_MEM
;
1477 c
->dst
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
1478 c
->dst
.ptr
= (unsigned long *)register_address(
1480 c
->regs
[VCPU_REGS_RDI
]);
1481 if ((rc
= ops
->read_emulated(register_address(
1482 c
->override_base
? *c
->override_base
:
1484 c
->regs
[VCPU_REGS_RSI
]),
1486 c
->dst
.bytes
, ctxt
->vcpu
)) != 0)
1488 register_address_increment(c
->regs
[VCPU_REGS_RSI
],
1489 (ctxt
->eflags
& EFLG_DF
) ? -c
->dst
.bytes
1491 register_address_increment(c
->regs
[VCPU_REGS_RDI
],
1492 (ctxt
->eflags
& EFLG_DF
) ? -c
->dst
.bytes
1495 case 0xa6 ... 0xa7: /* cmps */
1496 DPRINTF("Urk! I don't handle CMPS.\n");
1497 goto cannot_emulate
;
1498 case 0xaa ... 0xab: /* stos */
1499 c
->dst
.type
= OP_MEM
;
1500 c
->dst
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
1501 c
->dst
.ptr
= (unsigned long *)cr2
;
1502 c
->dst
.val
= c
->regs
[VCPU_REGS_RAX
];
1503 register_address_increment(c
->regs
[VCPU_REGS_RDI
],
1504 (ctxt
->eflags
& EFLG_DF
) ? -c
->dst
.bytes
1507 case 0xac ... 0xad: /* lods */
1508 c
->dst
.type
= OP_REG
;
1509 c
->dst
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
1510 c
->dst
.ptr
= (unsigned long *)&c
->regs
[VCPU_REGS_RAX
];
1511 if ((rc
= ops
->read_emulated(cr2
, &c
->dst
.val
,
1515 register_address_increment(c
->regs
[VCPU_REGS_RSI
],
1516 (ctxt
->eflags
& EFLG_DF
) ? -c
->dst
.bytes
1519 case 0xae ... 0xaf: /* scas */
1520 DPRINTF("Urk! I don't handle SCAS.\n");
1521 goto cannot_emulate
;
1522 case 0xe8: /* call (near) */ {
1524 switch (c
->op_bytes
) {
1526 rel
= insn_fetch(s16
, 2, c
->eip
);
1529 rel
= insn_fetch(s32
, 4, c
->eip
);
1532 rel
= insn_fetch(s64
, 8, c
->eip
);
1535 DPRINTF("Call: Invalid op_bytes\n");
1536 goto cannot_emulate
;
1538 c
->src
.val
= (unsigned long) c
->eip
;
1540 c
->op_bytes
= c
->ad_bytes
;
1544 case 0xe9: /* jmp rel */
1545 case 0xeb: /* jmp rel short */
1546 JMP_REL(c
->src
.val
);
1547 c
->dst
.type
= OP_NONE
; /* Disable writeback. */
1556 case 0x01: /* lgdt, lidt, lmsw */
1557 switch (c
->modrm_reg
) {
1559 unsigned long address
;
1561 case 0: /* vmcall */
1562 if (c
->modrm_mod
!= 3 || c
->modrm_rm
!= 1)
1563 goto cannot_emulate
;
1565 rc
= kvm_fix_hypercall(ctxt
->vcpu
);
1569 kvm_emulate_hypercall(ctxt
->vcpu
);
1572 rc
= read_descriptor(ctxt
, ops
, c
->src
.ptr
,
1573 &size
, &address
, c
->op_bytes
);
1576 realmode_lgdt(ctxt
->vcpu
, size
, address
);
1578 case 3: /* lidt/vmmcall */
1579 if (c
->modrm_mod
== 3 && c
->modrm_rm
== 1) {
1580 rc
= kvm_fix_hypercall(ctxt
->vcpu
);
1583 kvm_emulate_hypercall(ctxt
->vcpu
);
1585 rc
= read_descriptor(ctxt
, ops
, c
->src
.ptr
,
1590 realmode_lidt(ctxt
->vcpu
, size
, address
);
1594 if (c
->modrm_mod
!= 3)
1595 goto cannot_emulate
;
1596 *(u16
*)&c
->regs
[c
->modrm_rm
]
1597 = realmode_get_cr(ctxt
->vcpu
, 0);
1600 if (c
->modrm_mod
!= 3)
1601 goto cannot_emulate
;
1602 realmode_lmsw(ctxt
->vcpu
, (u16
)c
->modrm_val
,
1606 emulate_invlpg(ctxt
->vcpu
, cr2
);
1609 goto cannot_emulate
;
1611 /* Disable writeback. */
1612 c
->dst
.type
= OP_NONE
;
1614 case 0x21: /* mov from dr to reg */
1615 if (c
->modrm_mod
!= 3)
1616 goto cannot_emulate
;
1617 rc
= emulator_get_dr(ctxt
, c
->modrm_reg
, &c
->regs
[c
->modrm_rm
]);
1619 goto cannot_emulate
;
1620 c
->dst
.type
= OP_NONE
; /* no writeback */
1622 case 0x23: /* mov from reg to dr */
1623 if (c
->modrm_mod
!= 3)
1624 goto cannot_emulate
;
1625 rc
= emulator_set_dr(ctxt
, c
->modrm_reg
,
1626 c
->regs
[c
->modrm_rm
]);
1628 goto cannot_emulate
;
1629 c
->dst
.type
= OP_NONE
; /* no writeback */
1631 case 0x40 ... 0x4f: /* cmov */
1632 c
->dst
.val
= c
->dst
.orig_val
= c
->src
.val
;
1633 if (!test_cc(c
->b
, ctxt
->eflags
))
1634 c
->dst
.type
= OP_NONE
; /* no writeback */
1638 c
->dst
.type
= OP_NONE
;
1639 /* only subword offset */
1640 c
->src
.val
&= (c
->dst
.bytes
<< 3) - 1;
1641 emulate_2op_SrcV_nobyte("bt", c
->src
, c
->dst
, ctxt
->eflags
);
1645 /* only subword offset */
1646 c
->src
.val
&= (c
->dst
.bytes
<< 3) - 1;
1647 emulate_2op_SrcV_nobyte("bts", c
->src
, c
->dst
, ctxt
->eflags
);
1649 case 0xb0 ... 0xb1: /* cmpxchg */
1651 * Save real source value, then compare EAX against
1654 c
->src
.orig_val
= c
->src
.val
;
1655 c
->src
.val
= c
->regs
[VCPU_REGS_RAX
];
1656 emulate_2op_SrcV("cmp", c
->src
, c
->dst
, ctxt
->eflags
);
1657 if (ctxt
->eflags
& EFLG_ZF
) {
1658 /* Success: write back to memory. */
1659 c
->dst
.val
= c
->src
.orig_val
;
1661 /* Failure: write the value we saw to EAX. */
1662 c
->dst
.type
= OP_REG
;
1663 c
->dst
.ptr
= (unsigned long *)&c
->regs
[VCPU_REGS_RAX
];
1668 /* only subword offset */
1669 c
->src
.val
&= (c
->dst
.bytes
<< 3) - 1;
1670 emulate_2op_SrcV_nobyte("btr", c
->src
, c
->dst
, ctxt
->eflags
);
1672 case 0xb6 ... 0xb7: /* movzx */
1673 c
->dst
.bytes
= c
->op_bytes
;
1674 c
->dst
.val
= (c
->d
& ByteOp
) ? (u8
) c
->src
.val
1677 case 0xba: /* Grp8 */
1678 switch (c
->modrm_reg
& 3) {
1691 /* only subword offset */
1692 c
->src
.val
&= (c
->dst
.bytes
<< 3) - 1;
1693 emulate_2op_SrcV_nobyte("btc", c
->src
, c
->dst
, ctxt
->eflags
);
1695 case 0xbe ... 0xbf: /* movsx */
1696 c
->dst
.bytes
= c
->op_bytes
;
1697 c
->dst
.val
= (c
->d
& ByteOp
) ? (s8
) c
->src
.val
:
1700 case 0xc3: /* movnti */
1701 c
->dst
.bytes
= c
->op_bytes
;
1702 c
->dst
.val
= (c
->op_bytes
== 4) ? (u32
) c
->src
.val
:
1708 twobyte_special_insn
:
1711 emulate_clts(ctxt
->vcpu
);
1713 case 0x08: /* invd */
1715 case 0x09: /* wbinvd */
1717 case 0x0d: /* GrpP (prefetch) */
1718 case 0x18: /* Grp16 (prefetch/nop) */
1720 case 0x20: /* mov cr, reg */
1721 if (c
->modrm_mod
!= 3)
1722 goto cannot_emulate
;
1723 c
->regs
[c
->modrm_rm
] =
1724 realmode_get_cr(ctxt
->vcpu
, c
->modrm_reg
);
1726 case 0x22: /* mov reg, cr */
1727 if (c
->modrm_mod
!= 3)
1728 goto cannot_emulate
;
1729 realmode_set_cr(ctxt
->vcpu
,
1730 c
->modrm_reg
, c
->modrm_val
, &ctxt
->eflags
);
1734 msr_data
= (u32
)c
->regs
[VCPU_REGS_RAX
]
1735 | ((u64
)c
->regs
[VCPU_REGS_RDX
] << 32);
1736 rc
= kvm_set_msr(ctxt
->vcpu
, c
->regs
[VCPU_REGS_RCX
], msr_data
);
1738 kvm_x86_ops
->inject_gp(ctxt
->vcpu
, 0);
1739 c
->eip
= ctxt
->vcpu
->rip
;
1741 rc
= X86EMUL_CONTINUE
;
1745 rc
= kvm_get_msr(ctxt
->vcpu
, c
->regs
[VCPU_REGS_RCX
], &msr_data
);
1747 kvm_x86_ops
->inject_gp(ctxt
->vcpu
, 0);
1748 c
->eip
= ctxt
->vcpu
->rip
;
1750 c
->regs
[VCPU_REGS_RAX
] = (u32
)msr_data
;
1751 c
->regs
[VCPU_REGS_RDX
] = msr_data
>> 32;
1753 rc
= X86EMUL_CONTINUE
;
1755 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1758 switch (c
->op_bytes
) {
1760 rel
= insn_fetch(s16
, 2, c
->eip
);
1763 rel
= insn_fetch(s32
, 4, c
->eip
);
1766 rel
= insn_fetch(s64
, 8, c
->eip
);
1769 DPRINTF("jnz: Invalid op_bytes\n");
1770 goto cannot_emulate
;
1772 if (test_cc(c
->b
, ctxt
->eflags
))
1776 case 0xc7: /* Grp9 (cmpxchg8b) */
1777 rc
= emulate_grp9(ctxt
, ops
, cr2
);
1782 /* Disable writeback. */
1783 c
->dst
.type
= OP_NONE
;
1787 DPRINTF("Cannot emulate %02x\n", c
->b
);