1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf( _f , ## _a )
29 #define DPRINTF(x...) do {} while (0)
31 #include "x86_emulate.h"
32 #include <linux/module.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
66 static u8 opcode_table[256] = {
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 SrcImmByte, SrcImm, 0, 0,
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
102 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
103 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
106 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
108 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
111 0, 0, ImplicitOps|Mov, 0,
112 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
113 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
115 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
116 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
118 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
119 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
121 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
122 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
123 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
124 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
126 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
127 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
128 0, ModRM | DstReg, 0, DstMem | SrcNone | ModRM | Mov,
130 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps, ImplicitOps, 0, 0,
132 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
133 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
134 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
135 ByteOp | ImplicitOps, ImplicitOps,
137 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
138 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
139 ByteOp | ImplicitOps, ImplicitOps,
141 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
143 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
144 0, ImplicitOps, 0, 0,
145 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
147 0, 0, 0, 0, 0, 0, 0, 0,
149 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
150 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
153 0, 0, 0, 0, 0, 0, 0, 0,
155 0, 0, 0, 0, 0, 0, 0, 0,
157 ImplicitOps, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps, 0, 0, 0, 0,
161 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
164 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
167 static u16 twobyte_table[256] = {
169 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
170 ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
172 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
174 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
175 0, 0, 0, 0, 0, 0, 0, 0,
177 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
179 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
180 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
181 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
182 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
184 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
185 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
186 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
187 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
189 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
191 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
193 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
195 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
196 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
197 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
198 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
200 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
202 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
204 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
206 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
207 DstMem | SrcReg | ModRM | BitOp,
208 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
209 DstReg | SrcMem16 | ModRM | Mov,
211 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
212 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
213 DstReg | SrcMem16 | ModRM | Mov,
215 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
216 0, 0, 0, 0, 0, 0, 0, 0,
218 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
220 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
222 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
225 /* EFLAGS bit definitions. */
226 #define EFLG_OF (1<<11)
227 #define EFLG_DF (1<<10)
228 #define EFLG_SF (1<<7)
229 #define EFLG_ZF (1<<6)
230 #define EFLG_AF (1<<4)
231 #define EFLG_PF (1<<2)
232 #define EFLG_CF (1<<0)
235 * Instruction emulation:
236 * Most instructions are emulated directly via a fragment of inline assembly
237 * code. This allows us to save/restore EFLAGS and thus very easily pick up
238 * any modified flags.
241 #if defined(CONFIG_X86_64)
242 #define _LO32 "k" /* force 32-bit operand */
243 #define _STK "%%rsp" /* stack pointer */
244 #elif defined(__i386__)
245 #define _LO32 "" /* force 32-bit operand */
246 #define _STK "%%esp" /* stack pointer */
250 * These EFLAGS bits are restored from saved value during emulation, and
251 * any changes are written back to the saved value after emulation.
253 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
255 /* Before executing instruction: restore necessary bits in EFLAGS. */
256 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
257 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
259 "movl %"_msk",%"_LO32 _tmp"; " \
260 "andl %"_LO32 _tmp",("_STK"); " \
262 "notl %"_LO32 _tmp"; " \
263 "andl %"_LO32 _tmp",("_STK"); " \
265 "orl %"_LO32 _tmp",("_STK"); " \
267 /* _sav &= ~msk; */ \
268 "movl %"_msk",%"_LO32 _tmp"; " \
269 "notl %"_LO32 _tmp"; " \
270 "andl %"_LO32 _tmp",%"_sav"; "
272 /* After executing instruction: write-back necessary bits in EFLAGS. */
273 #define _POST_EFLAGS(_sav, _msk, _tmp) \
274 /* _sav |= EFLAGS & _msk; */ \
277 "andl %"_msk",%"_LO32 _tmp"; " \
278 "orl %"_LO32 _tmp",%"_sav"; "
280 /* Raw emulation: instruction has two explicit operands. */
281 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
283 unsigned long _tmp; \
285 switch ((_dst).bytes) { \
287 __asm__ __volatile__ ( \
288 _PRE_EFLAGS("0","4","2") \
289 _op"w %"_wx"3,%1; " \
290 _POST_EFLAGS("0","4","2") \
291 : "=m" (_eflags), "=m" ((_dst).val), \
293 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
296 __asm__ __volatile__ ( \
297 _PRE_EFLAGS("0","4","2") \
298 _op"l %"_lx"3,%1; " \
299 _POST_EFLAGS("0","4","2") \
300 : "=m" (_eflags), "=m" ((_dst).val), \
302 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
305 __emulate_2op_8byte(_op, _src, _dst, \
306 _eflags, _qx, _qy); \
311 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
313 unsigned long _tmp; \
314 switch ( (_dst).bytes ) \
317 __asm__ __volatile__ ( \
318 _PRE_EFLAGS("0","4","2") \
319 _op"b %"_bx"3,%1; " \
320 _POST_EFLAGS("0","4","2") \
321 : "=m" (_eflags), "=m" ((_dst).val), \
323 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
326 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
327 _wx, _wy, _lx, _ly, _qx, _qy); \
332 /* Source operand is byte-sized and may be restricted to just %cl. */
333 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
334 __emulate_2op(_op, _src, _dst, _eflags, \
335 "b", "c", "b", "c", "b", "c", "b", "c")
337 /* Source operand is byte, word, long or quad sized. */
338 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
339 __emulate_2op(_op, _src, _dst, _eflags, \
340 "b", "q", "w", "r", _LO32, "r", "", "r")
342 /* Source operand is word, long or quad sized. */
343 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
344 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
345 "w", "r", _LO32, "r", "", "r")
347 /* Instruction has only one explicit operand (no source operand). */
348 #define emulate_1op(_op, _dst, _eflags) \
350 unsigned long _tmp; \
352 switch ( (_dst).bytes ) \
355 __asm__ __volatile__ ( \
356 _PRE_EFLAGS("0","3","2") \
358 _POST_EFLAGS("0","3","2") \
359 : "=m" (_eflags), "=m" ((_dst).val), \
361 : "i" (EFLAGS_MASK) ); \
364 __asm__ __volatile__ ( \
365 _PRE_EFLAGS("0","3","2") \
367 _POST_EFLAGS("0","3","2") \
368 : "=m" (_eflags), "=m" ((_dst).val), \
370 : "i" (EFLAGS_MASK) ); \
373 __asm__ __volatile__ ( \
374 _PRE_EFLAGS("0","3","2") \
376 _POST_EFLAGS("0","3","2") \
377 : "=m" (_eflags), "=m" ((_dst).val), \
379 : "i" (EFLAGS_MASK) ); \
382 __emulate_1op_8byte(_op, _dst, _eflags); \
387 /* Emulate an instruction with quadword operands (x86/64 only). */
388 #if defined(CONFIG_X86_64)
389 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
391 __asm__ __volatile__ ( \
392 _PRE_EFLAGS("0","4","2") \
393 _op"q %"_qx"3,%1; " \
394 _POST_EFLAGS("0","4","2") \
395 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
396 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
399 #define __emulate_1op_8byte(_op, _dst, _eflags) \
401 __asm__ __volatile__ ( \
402 _PRE_EFLAGS("0","3","2") \
404 _POST_EFLAGS("0","3","2") \
405 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
406 : "i" (EFLAGS_MASK) ); \
409 #elif defined(__i386__)
410 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
411 #define __emulate_1op_8byte(_op, _dst, _eflags)
412 #endif /* __i386__ */
414 /* Fetch next part of the instruction being emulated. */
415 #define insn_fetch(_type, _size, _eip) \
416 ({ unsigned long _x; \
417 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
418 (_size), ctxt->vcpu); \
425 /* Access/update address held in a register, based on addressing mode. */
426 #define address_mask(reg) \
427 ((c->ad_bytes == sizeof(unsigned long)) ? \
428 (reg) : ((reg) & ((1UL << (c->ad_bytes << 3)) - 1)))
429 #define register_address(base, reg) \
430 ((base) + address_mask(reg))
431 #define register_address_increment(reg, inc) \
433 /* signed type ensures sign extension to long */ \
435 if (c->ad_bytes == sizeof(unsigned long)) \
439 ~((1UL << (c->ad_bytes << 3)) - 1)) | \
441 ((1UL << (c->ad_bytes << 3)) - 1)); \
444 #define JMP_REL(rel) \
446 register_address_increment(c->eip, rel); \
450 * Given the 'reg' portion of a ModRM byte, and a register block, return a
451 * pointer into the block that addresses the relevant register.
452 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
454 static void *decode_register(u8 modrm_reg, unsigned long *regs,
459 p = ®s[modrm_reg];
460 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
461 p = (unsigned char *)®s[modrm_reg & 3] + 1;
465 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
466 struct x86_emulate_ops *ops,
468 u16 *size, unsigned long *address, int op_bytes)
475 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
479 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
484 static int test_cc(unsigned int condition, unsigned int flags)
488 switch ((condition & 15) >> 1) {
490 rc |= (flags & EFLG_OF);
492 case 1: /* b/c/nae */
493 rc |= (flags & EFLG_CF);
496 rc |= (flags & EFLG_ZF);
499 rc |= (flags & (EFLG_CF|EFLG_ZF));
502 rc |= (flags & EFLG_SF);
505 rc |= (flags & EFLG_PF);
508 rc |= (flags & EFLG_ZF);
511 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
515 /* Odd condition identifiers (lsb == 1) have inverted sense. */
516 return (!!rc ^ (condition & 1));
520 x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
522 struct decode_cache *c = &ctxt->decode;
523 u8 sib, rex_prefix = 0;
526 int mode = ctxt->mode;
527 int index_reg = 0, base_reg = 0, scale, rip_relative = 0;
529 /* Shadow copy of register state. Committed on successful emulation. */
531 memset(c, 0, sizeof(struct decode_cache));
532 c->eip = ctxt->vcpu->rip;
533 memcpy(c->regs, ctxt->vcpu->regs, sizeof c->regs);
536 case X86EMUL_MODE_REAL:
537 case X86EMUL_MODE_PROT16:
538 c->op_bytes = c->ad_bytes = 2;
540 case X86EMUL_MODE_PROT32:
541 c->op_bytes = c->ad_bytes = 4;
544 case X86EMUL_MODE_PROT64:
553 /* Legacy prefixes. */
554 for (i = 0; i < 8; i++) {
555 switch (c->b = insn_fetch(u8, 1, c->eip)) {
556 case 0x66: /* operand-size override */
557 c->op_bytes ^= 6; /* switch between 2/4 bytes */
559 case 0x67: /* address-size override */
560 if (mode == X86EMUL_MODE_PROT64)
561 /* switch between 4/8 bytes */
564 /* switch between 2/4 bytes */
567 case 0x2e: /* CS override */
568 c->override_base = &ctxt->cs_base;
570 case 0x3e: /* DS override */
571 c->override_base = &ctxt->ds_base;
573 case 0x26: /* ES override */
574 c->override_base = &ctxt->es_base;
576 case 0x64: /* FS override */
577 c->override_base = &ctxt->fs_base;
579 case 0x65: /* GS override */
580 c->override_base = &ctxt->gs_base;
582 case 0x36: /* SS override */
583 c->override_base = &ctxt->ss_base;
585 case 0xf0: /* LOCK */
588 case 0xf2: /* REPNE/REPNZ */
589 case 0xf3: /* REP/REPE/REPZ */
600 if ((mode == X86EMUL_MODE_PROT64) && ((c->b & 0xf0) == 0x40)) {
603 c->op_bytes = 8; /* REX.W */
604 c->modrm_reg = (c->b & 4) << 1; /* REX.R */
605 index_reg = (c->b & 2) << 2; /* REX.X */
606 c->modrm_rm = base_reg = (c->b & 1) << 3; /* REG.B */
607 c->b = insn_fetch(u8, 1, c->eip);
610 /* Opcode byte(s). */
611 c->d = opcode_table[c->b];
613 /* Two-byte opcode? */
616 c->b = insn_fetch(u8, 1, c->eip);
617 c->d = twobyte_table[c->b];
622 DPRINTF("Cannot emulate %02x\n", c->b);
627 /* ModRM and SIB bytes. */
629 c->modrm = insn_fetch(u8, 1, c->eip);
630 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
631 c->modrm_reg |= (c->modrm & 0x38) >> 3;
632 c->modrm_rm |= (c->modrm & 0x07);
636 if (c->modrm_mod == 3) {
637 c->modrm_val = *(unsigned long *)
638 decode_register(c->modrm_rm, c->regs, c->d & ByteOp);
642 if (c->ad_bytes == 2) {
643 unsigned bx = c->regs[VCPU_REGS_RBX];
644 unsigned bp = c->regs[VCPU_REGS_RBP];
645 unsigned si = c->regs[VCPU_REGS_RSI];
646 unsigned di = c->regs[VCPU_REGS_RDI];
648 /* 16-bit ModR/M decode. */
649 switch (c->modrm_mod) {
651 if (c->modrm_rm == 6)
653 insn_fetch(u16, 2, c->eip);
656 c->modrm_ea += insn_fetch(s8, 1, c->eip);
659 c->modrm_ea += insn_fetch(u16, 2, c->eip);
662 switch (c->modrm_rm) {
664 c->modrm_ea += bx + si;
667 c->modrm_ea += bx + di;
670 c->modrm_ea += bp + si;
673 c->modrm_ea += bp + di;
682 if (c->modrm_mod != 0)
689 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
690 (c->modrm_rm == 6 && c->modrm_mod != 0))
691 if (!c->override_base)
692 c->override_base = &ctxt->ss_base;
693 c->modrm_ea = (u16)c->modrm_ea;
695 /* 32/64-bit ModR/M decode. */
696 switch (c->modrm_rm) {
699 sib = insn_fetch(u8, 1, c->eip);
700 index_reg |= (sib >> 3) & 7;
706 if (c->modrm_mod != 0)
711 insn_fetch(s32, 4, c->eip);
714 c->modrm_ea += c->regs[base_reg];
721 c->regs[index_reg] << scale;
726 if (c->modrm_mod != 0)
727 c->modrm_ea += c->regs[c->modrm_rm];
728 else if (mode == X86EMUL_MODE_PROT64)
732 c->modrm_ea += c->regs[c->modrm_rm];
735 switch (c->modrm_mod) {
737 if (c->modrm_rm == 5)
739 insn_fetch(s32, 4, c->eip);
742 c->modrm_ea += insn_fetch(s8, 1, c->eip);
745 c->modrm_ea += insn_fetch(s32, 4, c->eip);
749 if (!c->override_base)
750 c->override_base = &ctxt->ds_base;
751 if (mode == X86EMUL_MODE_PROT64 &&
752 c->override_base != &ctxt->fs_base &&
753 c->override_base != &ctxt->gs_base)
754 c->override_base = NULL;
756 if (c->override_base)
757 c->modrm_ea += *c->override_base;
760 c->modrm_ea += c->eip;
761 switch (c->d & SrcMask) {
769 if (c->op_bytes == 8)
772 c->modrm_ea += c->op_bytes;
775 if (c->ad_bytes != 8)
776 c->modrm_ea = (u32)c->modrm_ea;
782 * Decode and fetch the source operand: register, memory
785 switch (c->d & SrcMask) {
789 c->src.type = OP_REG;
792 decode_register(c->modrm_reg, c->regs,
794 c->src.val = c->src.orig_val = *(u8 *)c->src.ptr;
798 decode_register(c->modrm_reg, c->regs, 0);
799 switch ((c->src.bytes = c->op_bytes)) {
801 c->src.val = c->src.orig_val =
805 c->src.val = c->src.orig_val =
809 c->src.val = c->src.orig_val =
822 c->src.bytes = (c->d & ByteOp) ? 1 :
824 /* Don't fetch the address for invlpg: it could be unmapped. */
825 if (c->twobyte && c->b == 0x01
826 && c->modrm_reg == 7)
830 * For instructions with a ModR/M byte, switch to register
833 if ((c->d & ModRM) && c->modrm_mod == 3) {
834 c->src.type = OP_REG;
837 c->src.type = OP_MEM;
840 c->src.type = OP_IMM;
841 c->src.ptr = (unsigned long *)c->eip;
842 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
843 if (c->src.bytes == 8)
845 /* NB. Immediates are sign-extended as necessary. */
846 switch (c->src.bytes) {
848 c->src.val = insn_fetch(s8, 1, c->eip);
851 c->src.val = insn_fetch(s16, 2, c->eip);
854 c->src.val = insn_fetch(s32, 4, c->eip);
859 c->src.type = OP_IMM;
860 c->src.ptr = (unsigned long *)c->eip;
862 c->src.val = insn_fetch(s8, 1, c->eip);
866 /* Decode and fetch the destination operand: register or memory. */
867 switch (c->d & DstMask) {
869 /* Special instructions do their own operand decoding. */
872 c->dst.type = OP_REG;
875 (c->b == 0xb6 || c->b == 0xb7))) {
877 decode_register(c->modrm_reg, c->regs,
879 c->dst.val = *(u8 *) c->dst.ptr;
883 decode_register(c->modrm_reg, c->regs, 0);
884 switch ((c->dst.bytes = c->op_bytes)) {
886 c->dst.val = *(u16 *)c->dst.ptr;
889 c->dst.val = *(u32 *)c->dst.ptr;
892 c->dst.val = *(u64 *)c->dst.ptr;
898 if ((c->d & ModRM) && c->modrm_mod == 3) {
899 c->dst.type = OP_REG;
902 c->dst.type = OP_MEM;
907 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
910 static inline void emulate_push(struct x86_emulate_ctxt *ctxt)
912 struct decode_cache *c = &ctxt->decode;
914 c->dst.type = OP_MEM;
915 c->dst.bytes = c->op_bytes;
916 c->dst.val = c->src.val;
917 register_address_increment(c->regs[VCPU_REGS_RSP], -c->op_bytes);
918 c->dst.ptr = (void *) register_address(ctxt->ss_base,
919 c->regs[VCPU_REGS_RSP]);
922 static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
923 struct x86_emulate_ops *ops)
925 struct decode_cache *c = &ctxt->decode;
928 /* 64-bit mode: POP always pops a 64-bit operand. */
930 if (ctxt->mode == X86EMUL_MODE_PROT64)
933 rc = ops->read_std(register_address(ctxt->ss_base,
934 c->regs[VCPU_REGS_RSP]),
935 &c->dst.val, c->dst.bytes, ctxt->vcpu);
939 register_address_increment(c->regs[VCPU_REGS_RSP], c->dst.bytes);
944 static inline void emulate_grp2(struct decode_cache *c, unsigned long *_eflags)
946 switch (c->modrm_reg) {
948 emulate_2op_SrcB("rol", c->src, c->dst, *_eflags);
951 emulate_2op_SrcB("ror", c->src, c->dst, *_eflags);
954 emulate_2op_SrcB("rcl", c->src, c->dst, *_eflags);
957 emulate_2op_SrcB("rcr", c->src, c->dst, *_eflags);
959 case 4: /* sal/shl */
960 case 6: /* sal/shl */
961 emulate_2op_SrcB("sal", c->src, c->dst, *_eflags);
964 emulate_2op_SrcB("shr", c->src, c->dst, *_eflags);
967 emulate_2op_SrcB("sar", c->src, c->dst, *_eflags);
972 static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
973 struct x86_emulate_ops *ops,
974 unsigned long *_eflags)
976 struct decode_cache *c = &ctxt->decode;
979 switch (c->modrm_reg) {
980 case 0 ... 1: /* test */
982 * Special case in Grp3: test has an immediate
985 c->src.type = OP_IMM;
986 c->src.ptr = (unsigned long *)c->eip;
987 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
988 if (c->src.bytes == 8)
990 switch (c->src.bytes) {
992 c->src.val = insn_fetch(s8, 1, c->eip);
995 c->src.val = insn_fetch(s16, 2, c->eip);
998 c->src.val = insn_fetch(s32, 4, c->eip);
1001 emulate_2op_SrcV("test", c->src, c->dst, *_eflags);
1004 c->dst.val = ~c->dst.val;
1007 emulate_1op("neg", c->dst, *_eflags);
1010 DPRINTF("Cannot emulate %02x\n", c->b);
1011 rc = X86EMUL_UNHANDLEABLE;
1018 static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
1019 struct x86_emulate_ops *ops,
1020 unsigned long *_eflags,
1023 struct decode_cache *c = &ctxt->decode;
1026 switch (c->modrm_reg) {
1028 emulate_1op("inc", c->dst, *_eflags);
1031 emulate_1op("dec", c->dst, *_eflags);
1033 case 4: /* jmp abs */
1035 c->eip = c->dst.val;
1037 DPRINTF("Cannot emulate %02x\n", c->b);
1038 return X86EMUL_UNHANDLEABLE;
1043 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1045 if (ctxt->mode == X86EMUL_MODE_PROT64) {
1047 rc = ops->read_std((unsigned long)c->dst.ptr,
1048 &c->dst.val, 8, ctxt->vcpu);
1052 register_address_increment(c->regs[VCPU_REGS_RSP],
1054 rc = ops->write_emulated(register_address(ctxt->ss_base,
1055 c->regs[VCPU_REGS_RSP]), &c->dst.val,
1056 c->dst.bytes, ctxt->vcpu);
1062 DPRINTF("Cannot emulate %02x\n", c->b);
1063 return X86EMUL_UNHANDLEABLE;
1068 static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
1069 struct x86_emulate_ops *ops,
1070 unsigned long *_eflags,
1073 struct decode_cache *c = &ctxt->decode;
1077 rc = ops->read_emulated(cr2, &old, 8, ctxt->vcpu);
1081 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1082 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
1084 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1085 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1086 *_eflags &= ~EFLG_ZF;
1089 new = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1090 (u32) c->regs[VCPU_REGS_RBX];
1092 rc = ops->cmpxchg_emulated(cr2, &old, &new, 8, ctxt->vcpu);
1095 *_eflags |= EFLG_ZF;
1100 static inline int writeback(struct x86_emulate_ctxt *ctxt,
1101 struct x86_emulate_ops *ops)
1104 struct decode_cache *c = &ctxt->decode;
1106 switch (c->dst.type) {
1108 /* The 4-byte case *is* correct:
1109 * in 64-bit mode we zero-extend.
1111 switch (c->dst.bytes) {
1113 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1116 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1119 *c->dst.ptr = (u32)c->dst.val;
1120 break; /* 64b: zero-ext */
1122 *c->dst.ptr = c->dst.val;
1128 rc = ops->cmpxchg_emulated(
1129 (unsigned long)c->dst.ptr,
1135 rc = ops->write_emulated(
1136 (unsigned long)c->dst.ptr,
1149 x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1151 unsigned long cr2 = ctxt->cr2;
1154 unsigned long saved_eip = 0;
1155 unsigned long _eflags = ctxt->eflags;
1156 struct decode_cache *c = &ctxt->decode;
1159 /* Shadow copy of register state. Committed on successful emulation.
1160 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
1164 memcpy(c->regs, ctxt->vcpu->regs, sizeof c->regs);
1167 if ((c->d & ModRM) && (c->modrm_mod != 3))
1170 if (c->src.type == OP_MEM) {
1171 c->src.ptr = (unsigned long *)cr2;
1173 if ((rc = ops->read_emulated((unsigned long)c->src.ptr,
1178 c->src.orig_val = c->src.val;
1181 if ((c->d & DstMask) == ImplicitOps)
1185 if (c->dst.type == OP_MEM) {
1186 c->dst.ptr = (unsigned long *)cr2;
1187 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1190 unsigned long mask = ~(c->dst.bytes * 8 - 1);
1192 c->dst.ptr = (void *)c->dst.ptr +
1193 (c->src.val & mask) / 8;
1195 if (!(c->d & Mov) &&
1196 /* optimisation - avoid slow emulated read */
1197 ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1199 c->dst.bytes, ctxt->vcpu)) != 0))
1202 c->dst.orig_val = c->dst.val;
1210 emulate_2op_SrcV("add", c->src, c->dst, _eflags);
1214 emulate_2op_SrcV("or", c->src, c->dst, _eflags);
1218 emulate_2op_SrcV("adc", c->src, c->dst, _eflags);
1222 emulate_2op_SrcV("sbb", c->src, c->dst, _eflags);
1226 emulate_2op_SrcV("and", c->src, c->dst, _eflags);
1228 case 0x24: /* and al imm8 */
1229 c->dst.type = OP_REG;
1230 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1231 c->dst.val = *(u8 *)c->dst.ptr;
1233 c->dst.orig_val = c->dst.val;
1235 case 0x25: /* and ax imm16, or eax imm32 */
1236 c->dst.type = OP_REG;
1237 c->dst.bytes = c->op_bytes;
1238 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1239 if (c->op_bytes == 2)
1240 c->dst.val = *(u16 *)c->dst.ptr;
1242 c->dst.val = *(u32 *)c->dst.ptr;
1243 c->dst.orig_val = c->dst.val;
1247 emulate_2op_SrcV("sub", c->src, c->dst, _eflags);
1251 emulate_2op_SrcV("xor", c->src, c->dst, _eflags);
1255 emulate_2op_SrcV("cmp", c->src, c->dst, _eflags);
1257 case 0x63: /* movsxd */
1258 if (ctxt->mode != X86EMUL_MODE_PROT64)
1259 goto cannot_emulate;
1260 c->dst.val = (s32) c->src.val;
1262 case 0x80 ... 0x83: /* Grp1 */
1263 switch (c->modrm_reg) {
1283 emulate_2op_SrcV("test", c->src, c->dst, _eflags);
1285 case 0x86 ... 0x87: /* xchg */
1286 /* Write back the register source. */
1287 switch (c->dst.bytes) {
1289 *(u8 *) c->src.ptr = (u8) c->dst.val;
1292 *(u16 *) c->src.ptr = (u16) c->dst.val;
1295 *c->src.ptr = (u32) c->dst.val;
1296 break; /* 64b reg: zero-extend */
1298 *c->src.ptr = c->dst.val;
1302 * Write back the memory destination with implicit LOCK
1305 c->dst.val = c->src.val;
1308 case 0x88 ... 0x8b: /* mov */
1310 case 0x8d: /* lea r16/r32, m */
1311 c->dst.val = c->modrm_val;
1313 case 0x8f: /* pop (sole member of Grp1a) */
1314 rc = emulate_grp1a(ctxt, ops);
1318 case 0xa0 ... 0xa1: /* mov */
1319 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1320 c->dst.val = c->src.val;
1321 /* skip src displacement */
1322 c->eip += c->ad_bytes;
1324 case 0xa2 ... 0xa3: /* mov */
1325 c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
1326 /* skip c->dst displacement */
1327 c->eip += c->ad_bytes;
1330 emulate_grp2(c, &_eflags);
1332 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1334 c->dst.val = c->src.val;
1336 case 0xd0 ... 0xd1: /* Grp2 */
1338 emulate_grp2(c, &_eflags);
1340 case 0xd2 ... 0xd3: /* Grp2 */
1341 c->src.val = c->regs[VCPU_REGS_RCX];
1342 emulate_grp2(c, &_eflags);
1344 case 0xf6 ... 0xf7: /* Grp3 */
1345 rc = emulate_grp3(ctxt, ops, &_eflags);
1349 case 0xfe ... 0xff: /* Grp4/Grp5 */
1350 rc = emulate_grp45(ctxt, ops, &_eflags, &no_wb);
1358 rc = writeback(ctxt, ops);
1363 /* Commit shadow register state. */
1364 memcpy(ctxt->vcpu->regs, c->regs, sizeof c->regs);
1365 ctxt->eflags = _eflags;
1366 ctxt->vcpu->rip = c->eip;
1369 if (rc == X86EMUL_UNHANDLEABLE) {
1377 goto twobyte_special_insn;
1379 case 0x50 ... 0x57: /* push reg */
1380 if (c->op_bytes == 2)
1381 c->src.val = (u16) c->regs[c->b & 0x7];
1383 c->src.val = (u32) c->regs[c->b & 0x7];
1384 c->dst.type = OP_MEM;
1385 c->dst.bytes = c->op_bytes;
1386 c->dst.val = c->src.val;
1387 register_address_increment(c->regs[VCPU_REGS_RSP],
1389 c->dst.ptr = (void *) register_address(
1390 ctxt->ss_base, c->regs[VCPU_REGS_RSP]);
1392 case 0x58 ... 0x5f: /* pop reg */
1393 c->dst.ptr = (unsigned long *)&c->regs[c->b & 0x7];
1395 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1396 c->regs[VCPU_REGS_RSP]), c->dst.ptr,
1397 c->op_bytes, ctxt->vcpu)) != 0)
1400 register_address_increment(c->regs[VCPU_REGS_RSP],
1402 no_wb = 1; /* Disable writeback. */
1404 case 0x6a: /* push imm8 */
1406 c->src.val = insn_fetch(s8, 1, c->eip);
1409 case 0x6c: /* insb */
1410 case 0x6d: /* insw/insd */
1411 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1413 (c->d & ByteOp) ? 1 : c->op_bytes,
1415 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1416 (_eflags & EFLG_DF),
1417 register_address(ctxt->es_base,
1418 c->regs[VCPU_REGS_RDI]),
1420 c->regs[VCPU_REGS_RDX]) == 0) {
1425 case 0x6e: /* outsb */
1426 case 0x6f: /* outsw/outsd */
1427 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1429 (c->d & ByteOp) ? 1 : c->op_bytes,
1431 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1432 (_eflags & EFLG_DF),
1433 register_address(c->override_base ?
1436 c->regs[VCPU_REGS_RSI]),
1438 c->regs[VCPU_REGS_RDX]) == 0) {
1443 case 0x70 ... 0x7f: /* jcc (short) */ {
1444 int rel = insn_fetch(s8, 1, c->eip);
1446 if (test_cc(c->b, _eflags))
1450 case 0x9c: /* pushf */
1451 c->src.val = (unsigned long) _eflags;
1454 case 0x9d: /* popf */
1455 c->dst.ptr = (unsigned long *) &_eflags;
1456 goto pop_instruction;
1457 case 0xc3: /* ret */
1458 c->dst.ptr = &c->eip;
1459 goto pop_instruction;
1460 case 0xf4: /* hlt */
1461 ctxt->vcpu->halt_request = 1;
1464 if (c->rep_prefix) {
1465 if (c->regs[VCPU_REGS_RCX] == 0) {
1466 ctxt->vcpu->rip = c->eip;
1469 c->regs[VCPU_REGS_RCX]--;
1470 c->eip = ctxt->vcpu->rip;
1473 case 0xa4 ... 0xa5: /* movs */
1474 c->dst.type = OP_MEM;
1475 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1476 c->dst.ptr = (unsigned long *)register_address(
1478 c->regs[VCPU_REGS_RDI]);
1479 if ((rc = ops->read_emulated(register_address(
1480 c->override_base ? *c->override_base :
1482 c->regs[VCPU_REGS_RSI]),
1484 c->dst.bytes, ctxt->vcpu)) != 0)
1486 register_address_increment(c->regs[VCPU_REGS_RSI],
1487 (_eflags & EFLG_DF) ? -c->dst.bytes
1489 register_address_increment(c->regs[VCPU_REGS_RDI],
1490 (_eflags & EFLG_DF) ? -c->dst.bytes
1493 case 0xa6 ... 0xa7: /* cmps */
1494 DPRINTF("Urk! I don't handle CMPS.\n");
1495 goto cannot_emulate;
1496 case 0xaa ... 0xab: /* stos */
1497 c->dst.type = OP_MEM;
1498 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1499 c->dst.ptr = (unsigned long *)cr2;
1500 c->dst.val = c->regs[VCPU_REGS_RAX];
1501 register_address_increment(c->regs[VCPU_REGS_RDI],
1502 (_eflags & EFLG_DF) ? -c->dst.bytes
1505 case 0xac ... 0xad: /* lods */
1506 c->dst.type = OP_REG;
1507 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1508 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1509 if ((rc = ops->read_emulated(cr2, &c->dst.val,
1513 register_address_increment(c->regs[VCPU_REGS_RSI],
1514 (_eflags & EFLG_DF) ? -c->dst.bytes
1517 case 0xae ... 0xaf: /* scas */
1518 DPRINTF("Urk! I don't handle SCAS.\n");
1519 goto cannot_emulate;
1520 case 0xe8: /* call (near) */ {
1522 switch (c->op_bytes) {
1524 rel = insn_fetch(s16, 2, c->eip);
1527 rel = insn_fetch(s32, 4, c->eip);
1530 rel = insn_fetch(s64, 8, c->eip);
1533 DPRINTF("Call: Invalid op_bytes\n");
1534 goto cannot_emulate;
1536 c->src.val = (unsigned long) c->eip;
1538 c->op_bytes = c->ad_bytes;
1542 case 0xe9: /* jmp rel */
1543 case 0xeb: /* jmp rel short */
1544 JMP_REL(c->src.val);
1545 no_wb = 1; /* Disable writeback. */
1554 case 0x01: /* lgdt, lidt, lmsw */
1555 /* Disable writeback. */
1557 switch (c->modrm_reg) {
1559 unsigned long address;
1561 case 0: /* vmcall */
1562 if (c->modrm_mod != 3 || c->modrm_rm != 1)
1563 goto cannot_emulate;
1565 rc = kvm_fix_hypercall(ctxt->vcpu);
1569 kvm_emulate_hypercall(ctxt->vcpu);
1572 rc = read_descriptor(ctxt, ops, c->src.ptr,
1573 &size, &address, c->op_bytes);
1576 realmode_lgdt(ctxt->vcpu, size, address);
1578 case 3: /* lidt/vmmcall */
1579 if (c->modrm_mod == 3 && c->modrm_rm == 1) {
1580 rc = kvm_fix_hypercall(ctxt->vcpu);
1583 kvm_emulate_hypercall(ctxt->vcpu);
1585 rc = read_descriptor(ctxt, ops, c->src.ptr,
1590 realmode_lidt(ctxt->vcpu, size, address);
1594 if (c->modrm_mod != 3)
1595 goto cannot_emulate;
1596 *(u16 *)&c->regs[c->modrm_rm]
1597 = realmode_get_cr(ctxt->vcpu, 0);
1600 if (c->modrm_mod != 3)
1601 goto cannot_emulate;
1602 realmode_lmsw(ctxt->vcpu, (u16)c->modrm_val, &_eflags);
1605 emulate_invlpg(ctxt->vcpu, cr2);
1608 goto cannot_emulate;
1611 case 0x21: /* mov from dr to reg */
1613 if (c->modrm_mod != 3)
1614 goto cannot_emulate;
1615 rc = emulator_get_dr(ctxt, c->modrm_reg, &c->regs[c->modrm_rm]);
1617 case 0x23: /* mov from reg to dr */
1619 if (c->modrm_mod != 3)
1620 goto cannot_emulate;
1621 rc = emulator_set_dr(ctxt, c->modrm_reg,
1622 c->regs[c->modrm_rm]);
1624 case 0x40 ... 0x4f: /* cmov */
1625 c->dst.val = c->dst.orig_val = c->src.val;
1628 * First, assume we're decoding an even cmov opcode
1631 switch ((c->b & 15) >> 1) {
1633 no_wb = (_eflags & EFLG_OF) ? 0 : 1;
1635 case 1: /* cmovb/cmovc/cmovnae */
1636 no_wb = (_eflags & EFLG_CF) ? 0 : 1;
1638 case 2: /* cmovz/cmove */
1639 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
1641 case 3: /* cmovbe/cmovna */
1642 no_wb = (_eflags & (EFLG_CF | EFLG_ZF)) ? 0 : 1;
1645 no_wb = (_eflags & EFLG_SF) ? 0 : 1;
1647 case 5: /* cmovp/cmovpe */
1648 no_wb = (_eflags & EFLG_PF) ? 0 : 1;
1650 case 7: /* cmovle/cmovng */
1651 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
1653 case 6: /* cmovl/cmovnge */
1654 no_wb &= (!(_eflags & EFLG_SF) !=
1655 !(_eflags & EFLG_OF)) ? 0 : 1;
1658 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
1663 /* only subword offset */
1664 c->src.val &= (c->dst.bytes << 3) - 1;
1665 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, _eflags);
1669 /* only subword offset */
1670 c->src.val &= (c->dst.bytes << 3) - 1;
1671 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, _eflags);
1673 case 0xb0 ... 0xb1: /* cmpxchg */
1675 * Save real source value, then compare EAX against
1678 c->src.orig_val = c->src.val;
1679 c->src.val = c->regs[VCPU_REGS_RAX];
1680 emulate_2op_SrcV("cmp", c->src, c->dst, _eflags);
1681 if (_eflags & EFLG_ZF) {
1682 /* Success: write back to memory. */
1683 c->dst.val = c->src.orig_val;
1685 /* Failure: write the value we saw to EAX. */
1686 c->dst.type = OP_REG;
1687 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1692 /* only subword offset */
1693 c->src.val &= (c->dst.bytes << 3) - 1;
1694 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, _eflags);
1696 case 0xb6 ... 0xb7: /* movzx */
1697 c->dst.bytes = c->op_bytes;
1698 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
1701 case 0xba: /* Grp8 */
1702 switch (c->modrm_reg & 3) {
1715 /* only subword offset */
1716 c->src.val &= (c->dst.bytes << 3) - 1;
1717 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, _eflags);
1719 case 0xbe ... 0xbf: /* movsx */
1720 c->dst.bytes = c->op_bytes;
1721 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
1724 case 0xc3: /* movnti */
1725 c->dst.bytes = c->op_bytes;
1726 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
1732 twobyte_special_insn:
1733 /* Disable writeback. */
1737 emulate_clts(ctxt->vcpu);
1739 case 0x08: /* invd */
1741 case 0x09: /* wbinvd */
1743 case 0x0d: /* GrpP (prefetch) */
1744 case 0x18: /* Grp16 (prefetch/nop) */
1746 case 0x20: /* mov cr, reg */
1747 if (c->modrm_mod != 3)
1748 goto cannot_emulate;
1749 c->regs[c->modrm_rm] =
1750 realmode_get_cr(ctxt->vcpu, c->modrm_reg);
1752 case 0x22: /* mov reg, cr */
1753 if (c->modrm_mod != 3)
1754 goto cannot_emulate;
1755 realmode_set_cr(ctxt->vcpu,
1756 c->modrm_reg, c->modrm_val, &_eflags);
1760 msr_data = (u32)c->regs[VCPU_REGS_RAX]
1761 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
1762 rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
1764 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
1765 c->eip = ctxt->vcpu->rip;
1767 rc = X86EMUL_CONTINUE;
1771 rc = kvm_get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data);
1773 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
1774 c->eip = ctxt->vcpu->rip;
1776 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
1777 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
1779 rc = X86EMUL_CONTINUE;
1781 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1784 switch (c->op_bytes) {
1786 rel = insn_fetch(s16, 2, c->eip);
1789 rel = insn_fetch(s32, 4, c->eip);
1792 rel = insn_fetch(s64, 8, c->eip);
1795 DPRINTF("jnz: Invalid op_bytes\n");
1796 goto cannot_emulate;
1798 if (test_cc(c->b, _eflags))
1802 case 0xc7: /* Grp9 (cmpxchg8b) */
1803 rc = emulate_grp9(ctxt, ops, &_eflags, cr2);
1811 DPRINTF("Cannot emulate %02x\n", c->b);