1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf( _f , ## _a )
29 #define DPRINTF(x...) do {} while (0)
31 #include "x86_emulate.h"
32 #include <linux/module.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
66 static u8 opcode_table
[256] = {
68 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
69 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
72 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
73 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
76 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
77 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
80 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
81 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
84 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
85 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
86 SrcImmByte
, SrcImm
, 0, 0,
88 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
89 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
92 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
93 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
96 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
97 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
102 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
103 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
105 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
106 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
108 0, 0, 0, DstReg
| SrcMem32
| ModRM
| Mov
/* movsxd (x86/64) */ ,
111 0, 0, ImplicitOps
|Mov
, 0,
112 SrcNone
| ByteOp
| ImplicitOps
, SrcNone
| ImplicitOps
, /* insb, insw/insd */
113 SrcNone
| ByteOp
| ImplicitOps
, SrcNone
| ImplicitOps
, /* outsb, outsw/outsd */
115 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
116 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
118 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
119 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
121 ByteOp
| DstMem
| SrcImm
| ModRM
, DstMem
| SrcImm
| ModRM
,
122 ByteOp
| DstMem
| SrcImm
| ModRM
, DstMem
| SrcImmByte
| ModRM
,
123 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
124 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
126 ByteOp
| DstMem
| SrcReg
| ModRM
| Mov
, DstMem
| SrcReg
| ModRM
| Mov
,
127 ByteOp
| DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
128 0, ModRM
| DstReg
, 0, DstMem
| SrcNone
| ModRM
| Mov
,
130 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps
, ImplicitOps
, 0, 0,
132 ByteOp
| DstReg
| SrcMem
| Mov
, DstReg
| SrcMem
| Mov
,
133 ByteOp
| DstMem
| SrcReg
| Mov
, DstMem
| SrcReg
| Mov
,
134 ByteOp
| ImplicitOps
| Mov
, ImplicitOps
| Mov
,
135 ByteOp
| ImplicitOps
, ImplicitOps
,
137 0, 0, ByteOp
| ImplicitOps
| Mov
, ImplicitOps
| Mov
,
138 ByteOp
| ImplicitOps
| Mov
, ImplicitOps
| Mov
,
139 ByteOp
| ImplicitOps
, ImplicitOps
,
141 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
143 ByteOp
| DstMem
| SrcImm
| ModRM
, DstMem
| SrcImmByte
| ModRM
,
144 0, ImplicitOps
, 0, 0,
145 ByteOp
| DstMem
| SrcImm
| ModRM
| Mov
, DstMem
| SrcImm
| ModRM
| Mov
,
147 0, 0, 0, 0, 0, 0, 0, 0,
149 ByteOp
| DstMem
| SrcImplicit
| ModRM
, DstMem
| SrcImplicit
| ModRM
,
150 ByteOp
| DstMem
| SrcImplicit
| ModRM
, DstMem
| SrcImplicit
| ModRM
,
153 0, 0, 0, 0, 0, 0, 0, 0,
155 0, 0, 0, 0, 0, 0, 0, 0,
157 ImplicitOps
, SrcImm
|ImplicitOps
, 0, SrcImmByte
|ImplicitOps
, 0, 0, 0, 0,
161 ByteOp
| DstMem
| SrcNone
| ModRM
, DstMem
| SrcNone
| ModRM
,
164 0, 0, ByteOp
| DstMem
| SrcNone
| ModRM
, DstMem
| SrcNone
| ModRM
167 static u16 twobyte_table
[256] = {
169 0, SrcMem
| ModRM
| DstReg
, 0, 0, 0, 0, ImplicitOps
, 0,
170 ImplicitOps
, ImplicitOps
, 0, 0, 0, ImplicitOps
| ModRM
, 0, 0,
172 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps
| ModRM
, 0, 0, 0, 0, 0, 0, 0,
174 ModRM
| ImplicitOps
, ModRM
, ModRM
| ImplicitOps
, ModRM
, 0, 0, 0, 0,
175 0, 0, 0, 0, 0, 0, 0, 0,
177 ImplicitOps
, 0, ImplicitOps
, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
179 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
180 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
181 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
182 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
184 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
185 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
186 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
187 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
189 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
191 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
193 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
195 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
196 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
197 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
198 ImplicitOps
, ImplicitOps
, ImplicitOps
, ImplicitOps
,
200 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
202 0, 0, 0, DstMem
| SrcReg
| ModRM
| BitOp
, 0, 0, 0, 0,
204 0, 0, 0, DstMem
| SrcReg
| ModRM
| BitOp
, 0, 0, 0, 0,
206 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
, 0,
207 DstMem
| SrcReg
| ModRM
| BitOp
,
208 0, 0, ByteOp
| DstReg
| SrcMem
| ModRM
| Mov
,
209 DstReg
| SrcMem16
| ModRM
| Mov
,
211 0, 0, DstMem
| SrcImmByte
| ModRM
, DstMem
| SrcReg
| ModRM
| BitOp
,
212 0, 0, ByteOp
| DstReg
| SrcMem
| ModRM
| Mov
,
213 DstReg
| SrcMem16
| ModRM
| Mov
,
215 0, 0, 0, DstMem
| SrcReg
| ModRM
| Mov
, 0, 0, 0, ImplicitOps
| ModRM
,
216 0, 0, 0, 0, 0, 0, 0, 0,
218 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
220 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
222 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
225 /* EFLAGS bit definitions. */
226 #define EFLG_OF (1<<11)
227 #define EFLG_DF (1<<10)
228 #define EFLG_SF (1<<7)
229 #define EFLG_ZF (1<<6)
230 #define EFLG_AF (1<<4)
231 #define EFLG_PF (1<<2)
232 #define EFLG_CF (1<<0)
235 * Instruction emulation:
236 * Most instructions are emulated directly via a fragment of inline assembly
237 * code. This allows us to save/restore EFLAGS and thus very easily pick up
238 * any modified flags.
241 #if defined(CONFIG_X86_64)
242 #define _LO32 "k" /* force 32-bit operand */
243 #define _STK "%%rsp" /* stack pointer */
244 #elif defined(__i386__)
245 #define _LO32 "" /* force 32-bit operand */
246 #define _STK "%%esp" /* stack pointer */
250 * These EFLAGS bits are restored from saved value during emulation, and
251 * any changes are written back to the saved value after emulation.
253 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
255 /* Before executing instruction: restore necessary bits in EFLAGS. */
256 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
257 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
259 "movl %"_msk",%"_LO32 _tmp"; " \
260 "andl %"_LO32 _tmp",("_STK"); " \
262 "notl %"_LO32 _tmp"; " \
263 "andl %"_LO32 _tmp",("_STK"); " \
265 "orl %"_LO32 _tmp",("_STK"); " \
267 /* _sav &= ~msk; */ \
268 "movl %"_msk",%"_LO32 _tmp"; " \
269 "notl %"_LO32 _tmp"; " \
270 "andl %"_LO32 _tmp",%"_sav"; "
272 /* After executing instruction: write-back necessary bits in EFLAGS. */
273 #define _POST_EFLAGS(_sav, _msk, _tmp) \
274 /* _sav |= EFLAGS & _msk; */ \
277 "andl %"_msk",%"_LO32 _tmp"; " \
278 "orl %"_LO32 _tmp",%"_sav"; "
280 /* Raw emulation: instruction has two explicit operands. */
281 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
283 unsigned long _tmp; \
285 switch ((_dst).bytes) { \
287 __asm__ __volatile__ ( \
288 _PRE_EFLAGS("0","4","2") \
289 _op"w %"_wx"3,%1; " \
290 _POST_EFLAGS("0","4","2") \
291 : "=m" (_eflags), "=m" ((_dst).val), \
293 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
296 __asm__ __volatile__ ( \
297 _PRE_EFLAGS("0","4","2") \
298 _op"l %"_lx"3,%1; " \
299 _POST_EFLAGS("0","4","2") \
300 : "=m" (_eflags), "=m" ((_dst).val), \
302 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
305 __emulate_2op_8byte(_op, _src, _dst, \
306 _eflags, _qx, _qy); \
311 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
313 unsigned long _tmp; \
314 switch ( (_dst).bytes ) \
317 __asm__ __volatile__ ( \
318 _PRE_EFLAGS("0","4","2") \
319 _op"b %"_bx"3,%1; " \
320 _POST_EFLAGS("0","4","2") \
321 : "=m" (_eflags), "=m" ((_dst).val), \
323 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
326 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
327 _wx, _wy, _lx, _ly, _qx, _qy); \
332 /* Source operand is byte-sized and may be restricted to just %cl. */
333 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
334 __emulate_2op(_op, _src, _dst, _eflags, \
335 "b", "c", "b", "c", "b", "c", "b", "c")
337 /* Source operand is byte, word, long or quad sized. */
338 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
339 __emulate_2op(_op, _src, _dst, _eflags, \
340 "b", "q", "w", "r", _LO32, "r", "", "r")
342 /* Source operand is word, long or quad sized. */
343 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
344 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
345 "w", "r", _LO32, "r", "", "r")
347 /* Instruction has only one explicit operand (no source operand). */
348 #define emulate_1op(_op, _dst, _eflags) \
350 unsigned long _tmp; \
352 switch ( (_dst).bytes ) \
355 __asm__ __volatile__ ( \
356 _PRE_EFLAGS("0","3","2") \
358 _POST_EFLAGS("0","3","2") \
359 : "=m" (_eflags), "=m" ((_dst).val), \
361 : "i" (EFLAGS_MASK) ); \
364 __asm__ __volatile__ ( \
365 _PRE_EFLAGS("0","3","2") \
367 _POST_EFLAGS("0","3","2") \
368 : "=m" (_eflags), "=m" ((_dst).val), \
370 : "i" (EFLAGS_MASK) ); \
373 __asm__ __volatile__ ( \
374 _PRE_EFLAGS("0","3","2") \
376 _POST_EFLAGS("0","3","2") \
377 : "=m" (_eflags), "=m" ((_dst).val), \
379 : "i" (EFLAGS_MASK) ); \
382 __emulate_1op_8byte(_op, _dst, _eflags); \
387 /* Emulate an instruction with quadword operands (x86/64 only). */
388 #if defined(CONFIG_X86_64)
389 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
391 __asm__ __volatile__ ( \
392 _PRE_EFLAGS("0","4","2") \
393 _op"q %"_qx"3,%1; " \
394 _POST_EFLAGS("0","4","2") \
395 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
396 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
399 #define __emulate_1op_8byte(_op, _dst, _eflags) \
401 __asm__ __volatile__ ( \
402 _PRE_EFLAGS("0","3","2") \
404 _POST_EFLAGS("0","3","2") \
405 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
406 : "i" (EFLAGS_MASK) ); \
409 #elif defined(__i386__)
410 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
411 #define __emulate_1op_8byte(_op, _dst, _eflags)
412 #endif /* __i386__ */
414 /* Fetch next part of the instruction being emulated. */
415 #define insn_fetch(_type, _size, _eip) \
416 ({ unsigned long _x; \
417 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
418 (_size), ctxt->vcpu); \
425 /* Access/update address held in a register, based on addressing mode. */
426 #define address_mask(reg) \
427 ((c->ad_bytes == sizeof(unsigned long)) ? \
428 (reg) : ((reg) & ((1UL << (c->ad_bytes << 3)) - 1)))
429 #define register_address(base, reg) \
430 ((base) + address_mask(reg))
431 #define register_address_increment(reg, inc) \
433 /* signed type ensures sign extension to long */ \
435 if (c->ad_bytes == sizeof(unsigned long)) \
439 ~((1UL << (c->ad_bytes << 3)) - 1)) | \
441 ((1UL << (c->ad_bytes << 3)) - 1)); \
444 #define JMP_REL(rel) \
446 register_address_increment(c->eip, rel); \
450 * Given the 'reg' portion of a ModRM byte, and a register block, return a
451 * pointer into the block that addresses the relevant register.
452 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
454 static void *decode_register(u8 modrm_reg
, unsigned long *regs
,
459 p
= ®s
[modrm_reg
];
460 if (highbyte_regs
&& modrm_reg
>= 4 && modrm_reg
< 8)
461 p
= (unsigned char *)®s
[modrm_reg
& 3] + 1;
465 static int read_descriptor(struct x86_emulate_ctxt
*ctxt
,
466 struct x86_emulate_ops
*ops
,
468 u16
*size
, unsigned long *address
, int op_bytes
)
475 rc
= ops
->read_std((unsigned long)ptr
, (unsigned long *)size
, 2,
479 rc
= ops
->read_std((unsigned long)ptr
+ 2, address
, op_bytes
,
484 static int test_cc(unsigned int condition
, unsigned int flags
)
488 switch ((condition
& 15) >> 1) {
490 rc
|= (flags
& EFLG_OF
);
492 case 1: /* b/c/nae */
493 rc
|= (flags
& EFLG_CF
);
496 rc
|= (flags
& EFLG_ZF
);
499 rc
|= (flags
& (EFLG_CF
|EFLG_ZF
));
502 rc
|= (flags
& EFLG_SF
);
505 rc
|= (flags
& EFLG_PF
);
508 rc
|= (flags
& EFLG_ZF
);
511 rc
|= (!(flags
& EFLG_SF
) != !(flags
& EFLG_OF
));
515 /* Odd condition identifiers (lsb == 1) have inverted sense. */
516 return (!!rc
^ (condition
& 1));
520 x86_decode_insn(struct x86_emulate_ctxt
*ctxt
, struct x86_emulate_ops
*ops
)
522 struct decode_cache
*c
= &ctxt
->decode
;
523 u8 sib
, rex_prefix
= 0;
526 int mode
= ctxt
->mode
;
527 int index_reg
= 0, base_reg
= 0, scale
, rip_relative
= 0;
529 /* Shadow copy of register state. Committed on successful emulation. */
531 memset(c
, 0, sizeof(struct decode_cache
));
532 c
->eip
= ctxt
->vcpu
->rip
;
533 memcpy(c
->regs
, ctxt
->vcpu
->regs
, sizeof c
->regs
);
536 case X86EMUL_MODE_REAL
:
537 case X86EMUL_MODE_PROT16
:
538 c
->op_bytes
= c
->ad_bytes
= 2;
540 case X86EMUL_MODE_PROT32
:
541 c
->op_bytes
= c
->ad_bytes
= 4;
544 case X86EMUL_MODE_PROT64
:
553 /* Legacy prefixes. */
554 for (i
= 0; i
< 8; i
++) {
555 switch (c
->b
= insn_fetch(u8
, 1, c
->eip
)) {
556 case 0x66: /* operand-size override */
557 c
->op_bytes
^= 6; /* switch between 2/4 bytes */
559 case 0x67: /* address-size override */
560 if (mode
== X86EMUL_MODE_PROT64
)
561 /* switch between 4/8 bytes */
564 /* switch between 2/4 bytes */
567 case 0x2e: /* CS override */
568 c
->override_base
= &ctxt
->cs_base
;
570 case 0x3e: /* DS override */
571 c
->override_base
= &ctxt
->ds_base
;
573 case 0x26: /* ES override */
574 c
->override_base
= &ctxt
->es_base
;
576 case 0x64: /* FS override */
577 c
->override_base
= &ctxt
->fs_base
;
579 case 0x65: /* GS override */
580 c
->override_base
= &ctxt
->gs_base
;
582 case 0x36: /* SS override */
583 c
->override_base
= &ctxt
->ss_base
;
585 case 0xf0: /* LOCK */
588 case 0xf2: /* REPNE/REPNZ */
589 case 0xf3: /* REP/REPE/REPZ */
600 if ((mode
== X86EMUL_MODE_PROT64
) && ((c
->b
& 0xf0) == 0x40)) {
603 c
->op_bytes
= 8; /* REX.W */
604 c
->modrm_reg
= (c
->b
& 4) << 1; /* REX.R */
605 index_reg
= (c
->b
& 2) << 2; /* REX.X */
606 c
->modrm_rm
= base_reg
= (c
->b
& 1) << 3; /* REG.B */
607 c
->b
= insn_fetch(u8
, 1, c
->eip
);
610 /* Opcode byte(s). */
611 c
->d
= opcode_table
[c
->b
];
613 /* Two-byte opcode? */
616 c
->b
= insn_fetch(u8
, 1, c
->eip
);
617 c
->d
= twobyte_table
[c
->b
];
622 DPRINTF("Cannot emulate %02x\n", c
->b
);
627 /* ModRM and SIB bytes. */
629 c
->modrm
= insn_fetch(u8
, 1, c
->eip
);
630 c
->modrm_mod
|= (c
->modrm
& 0xc0) >> 6;
631 c
->modrm_reg
|= (c
->modrm
& 0x38) >> 3;
632 c
->modrm_rm
|= (c
->modrm
& 0x07);
636 if (c
->modrm_mod
== 3) {
637 c
->modrm_val
= *(unsigned long *)
638 decode_register(c
->modrm_rm
, c
->regs
, c
->d
& ByteOp
);
642 if (c
->ad_bytes
== 2) {
643 unsigned bx
= c
->regs
[VCPU_REGS_RBX
];
644 unsigned bp
= c
->regs
[VCPU_REGS_RBP
];
645 unsigned si
= c
->regs
[VCPU_REGS_RSI
];
646 unsigned di
= c
->regs
[VCPU_REGS_RDI
];
648 /* 16-bit ModR/M decode. */
649 switch (c
->modrm_mod
) {
651 if (c
->modrm_rm
== 6)
653 insn_fetch(u16
, 2, c
->eip
);
656 c
->modrm_ea
+= insn_fetch(s8
, 1, c
->eip
);
659 c
->modrm_ea
+= insn_fetch(u16
, 2, c
->eip
);
662 switch (c
->modrm_rm
) {
664 c
->modrm_ea
+= bx
+ si
;
667 c
->modrm_ea
+= bx
+ di
;
670 c
->modrm_ea
+= bp
+ si
;
673 c
->modrm_ea
+= bp
+ di
;
682 if (c
->modrm_mod
!= 0)
689 if (c
->modrm_rm
== 2 || c
->modrm_rm
== 3 ||
690 (c
->modrm_rm
== 6 && c
->modrm_mod
!= 0))
691 if (!c
->override_base
)
692 c
->override_base
= &ctxt
->ss_base
;
693 c
->modrm_ea
= (u16
)c
->modrm_ea
;
695 /* 32/64-bit ModR/M decode. */
696 switch (c
->modrm_rm
) {
699 sib
= insn_fetch(u8
, 1, c
->eip
);
700 index_reg
|= (sib
>> 3) & 7;
706 if (c
->modrm_mod
!= 0)
711 insn_fetch(s32
, 4, c
->eip
);
714 c
->modrm_ea
+= c
->regs
[base_reg
];
721 c
->regs
[index_reg
] << scale
;
726 if (c
->modrm_mod
!= 0)
727 c
->modrm_ea
+= c
->regs
[c
->modrm_rm
];
728 else if (mode
== X86EMUL_MODE_PROT64
)
732 c
->modrm_ea
+= c
->regs
[c
->modrm_rm
];
735 switch (c
->modrm_mod
) {
737 if (c
->modrm_rm
== 5)
739 insn_fetch(s32
, 4, c
->eip
);
742 c
->modrm_ea
+= insn_fetch(s8
, 1, c
->eip
);
745 c
->modrm_ea
+= insn_fetch(s32
, 4, c
->eip
);
749 if (!c
->override_base
)
750 c
->override_base
= &ctxt
->ds_base
;
751 if (mode
== X86EMUL_MODE_PROT64
&&
752 c
->override_base
!= &ctxt
->fs_base
&&
753 c
->override_base
!= &ctxt
->gs_base
)
754 c
->override_base
= NULL
;
756 if (c
->override_base
)
757 c
->modrm_ea
+= *c
->override_base
;
760 c
->modrm_ea
+= c
->eip
;
761 switch (c
->d
& SrcMask
) {
769 if (c
->op_bytes
== 8)
772 c
->modrm_ea
+= c
->op_bytes
;
775 if (c
->ad_bytes
!= 8)
776 c
->modrm_ea
= (u32
)c
->modrm_ea
;
782 * Decode and fetch the source operand: register, memory
785 switch (c
->d
& SrcMask
) {
789 c
->src
.type
= OP_REG
;
792 decode_register(c
->modrm_reg
, c
->regs
,
794 c
->src
.val
= c
->src
.orig_val
= *(u8
*)c
->src
.ptr
;
798 decode_register(c
->modrm_reg
, c
->regs
, 0);
799 switch ((c
->src
.bytes
= c
->op_bytes
)) {
801 c
->src
.val
= c
->src
.orig_val
=
805 c
->src
.val
= c
->src
.orig_val
=
809 c
->src
.val
= c
->src
.orig_val
=
822 c
->src
.bytes
= (c
->d
& ByteOp
) ? 1 :
824 /* Don't fetch the address for invlpg: it could be unmapped. */
825 if (c
->twobyte
&& c
->b
== 0x01
826 && c
->modrm_reg
== 7)
830 * For instructions with a ModR/M byte, switch to register
833 if ((c
->d
& ModRM
) && c
->modrm_mod
== 3) {
834 c
->src
.type
= OP_REG
;
837 c
->src
.type
= OP_MEM
;
840 c
->src
.type
= OP_IMM
;
841 c
->src
.ptr
= (unsigned long *)c
->eip
;
842 c
->src
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
843 if (c
->src
.bytes
== 8)
845 /* NB. Immediates are sign-extended as necessary. */
846 switch (c
->src
.bytes
) {
848 c
->src
.val
= insn_fetch(s8
, 1, c
->eip
);
851 c
->src
.val
= insn_fetch(s16
, 2, c
->eip
);
854 c
->src
.val
= insn_fetch(s32
, 4, c
->eip
);
859 c
->src
.type
= OP_IMM
;
860 c
->src
.ptr
= (unsigned long *)c
->eip
;
862 c
->src
.val
= insn_fetch(s8
, 1, c
->eip
);
866 /* Decode and fetch the destination operand: register or memory. */
867 switch (c
->d
& DstMask
) {
869 /* Special instructions do their own operand decoding. */
872 c
->dst
.type
= OP_REG
;
875 (c
->b
== 0xb6 || c
->b
== 0xb7))) {
877 decode_register(c
->modrm_reg
, c
->regs
,
879 c
->dst
.val
= *(u8
*) c
->dst
.ptr
;
883 decode_register(c
->modrm_reg
, c
->regs
, 0);
884 switch ((c
->dst
.bytes
= c
->op_bytes
)) {
886 c
->dst
.val
= *(u16
*)c
->dst
.ptr
;
889 c
->dst
.val
= *(u32
*)c
->dst
.ptr
;
892 c
->dst
.val
= *(u64
*)c
->dst
.ptr
;
898 if ((c
->d
& ModRM
) && c
->modrm_mod
== 3) {
899 c
->dst
.type
= OP_REG
;
902 c
->dst
.type
= OP_MEM
;
907 return (rc
== X86EMUL_UNHANDLEABLE
) ? -1 : 0;
911 x86_emulate_insn(struct x86_emulate_ctxt
*ctxt
, struct x86_emulate_ops
*ops
)
913 unsigned long cr2
= ctxt
->cr2
;
916 unsigned long saved_eip
= 0;
917 unsigned long _eflags
= ctxt
->eflags
;
918 struct decode_cache
*c
= &ctxt
->decode
;
921 /* Shadow copy of register state. Committed on successful emulation.
922 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
926 memcpy(c
->regs
, ctxt
->vcpu
->regs
, sizeof c
->regs
);
929 if ((c
->d
& ModRM
) && (c
->modrm_mod
!= 3))
932 if (c
->src
.type
== OP_MEM
) {
933 c
->src
.ptr
= (unsigned long *)cr2
;
935 if ((rc
= ops
->read_emulated((unsigned long)c
->src
.ptr
,
940 c
->src
.orig_val
= c
->src
.val
;
943 if ((c
->d
& DstMask
) == ImplicitOps
)
947 if (c
->dst
.type
== OP_MEM
) {
948 c
->dst
.ptr
= (unsigned long *)cr2
;
949 c
->dst
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
952 unsigned long mask
= ~(c
->dst
.bytes
* 8 - 1);
954 c
->dst
.ptr
= (void *)c
->dst
.ptr
+
955 (c
->src
.val
& mask
) / 8;
958 /* optimisation - avoid slow emulated read */
959 ((rc
= ops
->read_emulated((unsigned long)c
->dst
.ptr
,
961 c
->dst
.bytes
, ctxt
->vcpu
)) != 0))
964 c
->dst
.orig_val
= c
->dst
.val
;
972 emulate_2op_SrcV("add", c
->src
, c
->dst
, _eflags
);
976 emulate_2op_SrcV("or", c
->src
, c
->dst
, _eflags
);
980 emulate_2op_SrcV("adc", c
->src
, c
->dst
, _eflags
);
984 emulate_2op_SrcV("sbb", c
->src
, c
->dst
, _eflags
);
988 emulate_2op_SrcV("and", c
->src
, c
->dst
, _eflags
);
990 case 0x24: /* and al imm8 */
991 c
->dst
.type
= OP_REG
;
992 c
->dst
.ptr
= &c
->regs
[VCPU_REGS_RAX
];
993 c
->dst
.val
= *(u8
*)c
->dst
.ptr
;
995 c
->dst
.orig_val
= c
->dst
.val
;
997 case 0x25: /* and ax imm16, or eax imm32 */
998 c
->dst
.type
= OP_REG
;
999 c
->dst
.bytes
= c
->op_bytes
;
1000 c
->dst
.ptr
= &c
->regs
[VCPU_REGS_RAX
];
1001 if (c
->op_bytes
== 2)
1002 c
->dst
.val
= *(u16
*)c
->dst
.ptr
;
1004 c
->dst
.val
= *(u32
*)c
->dst
.ptr
;
1005 c
->dst
.orig_val
= c
->dst
.val
;
1009 emulate_2op_SrcV("sub", c
->src
, c
->dst
, _eflags
);
1013 emulate_2op_SrcV("xor", c
->src
, c
->dst
, _eflags
);
1017 emulate_2op_SrcV("cmp", c
->src
, c
->dst
, _eflags
);
1019 case 0x63: /* movsxd */
1020 if (ctxt
->mode
!= X86EMUL_MODE_PROT64
)
1021 goto cannot_emulate
;
1022 c
->dst
.val
= (s32
) c
->src
.val
;
1024 case 0x80 ... 0x83: /* Grp1 */
1025 switch (c
->modrm_reg
) {
1046 emulate_2op_SrcV("test", c
->src
, c
->dst
, _eflags
);
1048 case 0x86 ... 0x87: /* xchg */
1049 /* Write back the register source. */
1050 switch (c
->dst
.bytes
) {
1052 *(u8
*) c
->src
.ptr
= (u8
) c
->dst
.val
;
1055 *(u16
*) c
->src
.ptr
= (u16
) c
->dst
.val
;
1058 *c
->src
.ptr
= (u32
) c
->dst
.val
;
1059 break; /* 64b reg: zero-extend */
1061 *c
->src
.ptr
= c
->dst
.val
;
1065 * Write back the memory destination with implicit LOCK
1068 c
->dst
.val
= c
->src
.val
;
1071 case 0x88 ... 0x8b: /* mov */
1073 case 0x8d: /* lea r16/r32, m */
1074 c
->dst
.val
= c
->modrm_val
;
1076 case 0x8f: /* pop (sole member of Grp1a) */
1077 /* 64-bit mode: POP always pops a 64-bit operand. */
1078 if (ctxt
->mode
== X86EMUL_MODE_PROT64
)
1080 if ((rc
= ops
->read_std(register_address(
1082 c
->regs
[VCPU_REGS_RSP
]),
1087 register_address_increment(c
->regs
[VCPU_REGS_RSP
],
1090 case 0xa0 ... 0xa1: /* mov */
1091 c
->dst
.ptr
= (unsigned long *)&c
->regs
[VCPU_REGS_RAX
];
1092 c
->dst
.val
= c
->src
.val
;
1093 /* skip src displacement */
1094 c
->eip
+= c
->ad_bytes
;
1096 case 0xa2 ... 0xa3: /* mov */
1097 c
->dst
.val
= (unsigned long)c
->regs
[VCPU_REGS_RAX
];
1098 /* skip c->dst displacement */
1099 c
->eip
+= c
->ad_bytes
;
1103 switch (c
->modrm_reg
) {
1105 emulate_2op_SrcB("rol", c
->src
, c
->dst
, _eflags
);
1108 emulate_2op_SrcB("ror", c
->src
, c
->dst
, _eflags
);
1111 emulate_2op_SrcB("rcl", c
->src
, c
->dst
, _eflags
);
1114 emulate_2op_SrcB("rcr", c
->src
, c
->dst
, _eflags
);
1116 case 4: /* sal/shl */
1117 case 6: /* sal/shl */
1118 emulate_2op_SrcB("sal", c
->src
, c
->dst
, _eflags
);
1121 emulate_2op_SrcB("shr", c
->src
, c
->dst
, _eflags
);
1124 emulate_2op_SrcB("sar", c
->src
, c
->dst
, _eflags
);
1128 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1130 c
->dst
.val
= c
->src
.val
;
1132 case 0xd0 ... 0xd1: /* Grp2 */
1135 case 0xd2 ... 0xd3: /* Grp2 */
1136 c
->src
.val
= c
->regs
[VCPU_REGS_RCX
];
1138 case 0xf6 ... 0xf7: /* Grp3 */
1139 switch (c
->modrm_reg
) {
1140 case 0 ... 1: /* test */
1142 * Special case in Grp3: test has an immediate
1145 c
->src
.type
= OP_IMM
;
1146 c
->src
.ptr
= (unsigned long *)c
->eip
;
1147 c
->src
.bytes
= (c
->d
& ByteOp
) ? 1 :
1149 if (c
->src
.bytes
== 8)
1151 switch (c
->src
.bytes
) {
1153 c
->src
.val
= insn_fetch(s8
, 1, c
->eip
);
1156 c
->src
.val
= insn_fetch(s16
, 2, c
->eip
);
1159 c
->src
.val
= insn_fetch(s32
, 4, c
->eip
);
1164 c
->dst
.val
= ~c
->dst
.val
;
1167 emulate_1op("neg", c
->dst
, _eflags
);
1170 goto cannot_emulate
;
1173 case 0xfe ... 0xff: /* Grp4/Grp5 */
1174 switch (c
->modrm_reg
) {
1176 emulate_1op("inc", c
->dst
, _eflags
);
1179 emulate_1op("dec", c
->dst
, _eflags
);
1181 case 4: /* jmp abs */
1183 c
->eip
= c
->dst
.val
;
1185 goto cannot_emulate
;
1188 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1189 if (ctxt
->mode
== X86EMUL_MODE_PROT64
) {
1191 if ((rc
= ops
->read_std(
1192 (unsigned long)c
->dst
.ptr
,
1197 register_address_increment(c
->regs
[VCPU_REGS_RSP
],
1199 if ((rc
= ops
->write_emulated(
1200 register_address(ctxt
->ss_base
,
1201 c
->regs
[VCPU_REGS_RSP
]),
1203 c
->dst
.bytes
, ctxt
->vcpu
)) != 0)
1208 goto cannot_emulate
;
1215 switch (c
->dst
.type
) {
1217 /* The 4-byte case *is* correct:
1218 * in 64-bit mode we zero-extend.
1220 switch (c
->dst
.bytes
) {
1222 *(u8
*)c
->dst
.ptr
= (u8
)c
->dst
.val
;
1225 *(u16
*)c
->dst
.ptr
= (u16
)c
->dst
.val
;
1228 *c
->dst
.ptr
= (u32
)c
->dst
.val
;
1229 break; /* 64b: zero-ext */
1231 *c
->dst
.ptr
= c
->dst
.val
;
1237 rc
= ops
->cmpxchg_emulated(
1238 (unsigned long)c
->dst
.ptr
,
1244 rc
= ops
->write_emulated(
1245 (unsigned long)c
->dst
.ptr
,
1256 /* Commit shadow register state. */
1257 memcpy(ctxt
->vcpu
->regs
, c
->regs
, sizeof c
->regs
);
1258 ctxt
->eflags
= _eflags
;
1259 ctxt
->vcpu
->rip
= c
->eip
;
1262 if (rc
== X86EMUL_UNHANDLEABLE
) {
1270 goto twobyte_special_insn
;
1272 case 0x50 ... 0x57: /* push reg */
1273 if (c
->op_bytes
== 2)
1274 c
->src
.val
= (u16
) c
->regs
[c
->b
& 0x7];
1276 c
->src
.val
= (u32
) c
->regs
[c
->b
& 0x7];
1277 c
->dst
.type
= OP_MEM
;
1278 c
->dst
.bytes
= c
->op_bytes
;
1279 c
->dst
.val
= c
->src
.val
;
1280 register_address_increment(c
->regs
[VCPU_REGS_RSP
],
1282 c
->dst
.ptr
= (void *) register_address(
1283 ctxt
->ss_base
, c
->regs
[VCPU_REGS_RSP
]);
1285 case 0x58 ... 0x5f: /* pop reg */
1287 (unsigned long *)&c
->regs
[c
->b
& 0x7];
1289 if ((rc
= ops
->read_std(register_address(ctxt
->ss_base
,
1290 c
->regs
[VCPU_REGS_RSP
]), c
->dst
.ptr
,
1291 c
->op_bytes
, ctxt
->vcpu
)) != 0)
1294 register_address_increment(c
->regs
[VCPU_REGS_RSP
],
1296 no_wb
= 1; /* Disable writeback. */
1298 case 0x6a: /* push imm8 */
1300 c
->src
.val
= insn_fetch(s8
, 1, c
->eip
);
1302 c
->dst
.type
= OP_MEM
;
1303 c
->dst
.bytes
= c
->op_bytes
;
1304 c
->dst
.val
= c
->src
.val
;
1305 register_address_increment(c
->regs
[VCPU_REGS_RSP
],
1307 c
->dst
.ptr
= (void *) register_address(ctxt
->ss_base
,
1308 c
->regs
[VCPU_REGS_RSP
]);
1310 case 0x6c: /* insb */
1311 case 0x6d: /* insw/insd */
1312 if (kvm_emulate_pio_string(ctxt
->vcpu
, NULL
,
1314 (c
->d
& ByteOp
) ? 1 : c
->op_bytes
,
1316 address_mask(c
->regs
[VCPU_REGS_RCX
]) : 1,
1317 (_eflags
& EFLG_DF
),
1318 register_address(ctxt
->es_base
,
1319 c
->regs
[VCPU_REGS_RDI
]),
1321 c
->regs
[VCPU_REGS_RDX
]) == 0) {
1326 case 0x6e: /* outsb */
1327 case 0x6f: /* outsw/outsd */
1328 if (kvm_emulate_pio_string(ctxt
->vcpu
, NULL
,
1330 (c
->d
& ByteOp
) ? 1 : c
->op_bytes
,
1332 address_mask(c
->regs
[VCPU_REGS_RCX
]) : 1,
1333 (_eflags
& EFLG_DF
),
1334 register_address(c
->override_base
?
1337 c
->regs
[VCPU_REGS_RSI
]),
1339 c
->regs
[VCPU_REGS_RDX
]) == 0) {
1344 case 0x70 ... 0x7f: /* jcc (short) */ {
1345 int rel
= insn_fetch(s8
, 1, c
->eip
);
1347 if (test_cc(c
->b
, _eflags
))
1351 case 0x9c: /* pushf */
1352 c
->src
.val
= (unsigned long) _eflags
;
1354 case 0x9d: /* popf */
1355 c
->dst
.ptr
= (unsigned long *) &_eflags
;
1356 goto pop_instruction
;
1357 case 0xc3: /* ret */
1358 c
->dst
.ptr
= &c
->eip
;
1359 goto pop_instruction
;
1360 case 0xf4: /* hlt */
1361 ctxt
->vcpu
->halt_request
= 1;
1364 if (c
->rep_prefix
) {
1365 if (c
->regs
[VCPU_REGS_RCX
] == 0) {
1366 ctxt
->vcpu
->rip
= c
->eip
;
1369 c
->regs
[VCPU_REGS_RCX
]--;
1370 c
->eip
= ctxt
->vcpu
->rip
;
1373 case 0xa4 ... 0xa5: /* movs */
1374 c
->dst
.type
= OP_MEM
;
1375 c
->dst
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
1376 c
->dst
.ptr
= (unsigned long *)register_address(
1378 c
->regs
[VCPU_REGS_RDI
]);
1379 if ((rc
= ops
->read_emulated(register_address(
1380 c
->override_base
? *c
->override_base
:
1382 c
->regs
[VCPU_REGS_RSI
]),
1384 c
->dst
.bytes
, ctxt
->vcpu
)) != 0)
1386 register_address_increment(c
->regs
[VCPU_REGS_RSI
],
1387 (_eflags
& EFLG_DF
) ? -c
->dst
.bytes
1389 register_address_increment(c
->regs
[VCPU_REGS_RDI
],
1390 (_eflags
& EFLG_DF
) ? -c
->dst
.bytes
1393 case 0xa6 ... 0xa7: /* cmps */
1394 DPRINTF("Urk! I don't handle CMPS.\n");
1395 goto cannot_emulate
;
1396 case 0xaa ... 0xab: /* stos */
1397 c
->dst
.type
= OP_MEM
;
1398 c
->dst
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
1399 c
->dst
.ptr
= (unsigned long *)cr2
;
1400 c
->dst
.val
= c
->regs
[VCPU_REGS_RAX
];
1401 register_address_increment(c
->regs
[VCPU_REGS_RDI
],
1402 (_eflags
& EFLG_DF
) ? -c
->dst
.bytes
1405 case 0xac ... 0xad: /* lods */
1406 c
->dst
.type
= OP_REG
;
1407 c
->dst
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
1408 c
->dst
.ptr
= (unsigned long *)&c
->regs
[VCPU_REGS_RAX
];
1409 if ((rc
= ops
->read_emulated(cr2
, &c
->dst
.val
,
1413 register_address_increment(c
->regs
[VCPU_REGS_RSI
],
1414 (_eflags
& EFLG_DF
) ? -c
->dst
.bytes
1417 case 0xae ... 0xaf: /* scas */
1418 DPRINTF("Urk! I don't handle SCAS.\n");
1419 goto cannot_emulate
;
1420 case 0xe8: /* call (near) */ {
1422 switch (c
->op_bytes
) {
1424 rel
= insn_fetch(s16
, 2, c
->eip
);
1427 rel
= insn_fetch(s32
, 4, c
->eip
);
1430 rel
= insn_fetch(s64
, 8, c
->eip
);
1433 DPRINTF("Call: Invalid op_bytes\n");
1434 goto cannot_emulate
;
1436 c
->src
.val
= (unsigned long) c
->eip
;
1438 c
->op_bytes
= c
->ad_bytes
;
1441 case 0xe9: /* jmp rel */
1442 case 0xeb: /* jmp rel short */
1443 JMP_REL(c
->src
.val
);
1444 no_wb
= 1; /* Disable writeback. */
1453 case 0x01: /* lgdt, lidt, lmsw */
1454 /* Disable writeback. */
1456 switch (c
->modrm_reg
) {
1458 unsigned long address
;
1460 case 0: /* vmcall */
1461 if (c
->modrm_mod
!= 3 || c
->modrm_rm
!= 1)
1462 goto cannot_emulate
;
1464 rc
= kvm_fix_hypercall(ctxt
->vcpu
);
1468 kvm_emulate_hypercall(ctxt
->vcpu
);
1471 rc
= read_descriptor(ctxt
, ops
, c
->src
.ptr
,
1472 &size
, &address
, c
->op_bytes
);
1475 realmode_lgdt(ctxt
->vcpu
, size
, address
);
1477 case 3: /* lidt/vmmcall */
1478 if (c
->modrm_mod
== 3 && c
->modrm_rm
== 1) {
1479 rc
= kvm_fix_hypercall(ctxt
->vcpu
);
1482 kvm_emulate_hypercall(ctxt
->vcpu
);
1484 rc
= read_descriptor(ctxt
, ops
, c
->src
.ptr
,
1489 realmode_lidt(ctxt
->vcpu
, size
, address
);
1493 if (c
->modrm_mod
!= 3)
1494 goto cannot_emulate
;
1495 *(u16
*)&c
->regs
[c
->modrm_rm
]
1496 = realmode_get_cr(ctxt
->vcpu
, 0);
1499 if (c
->modrm_mod
!= 3)
1500 goto cannot_emulate
;
1501 realmode_lmsw(ctxt
->vcpu
, (u16
)c
->modrm_val
, &_eflags
);
1504 emulate_invlpg(ctxt
->vcpu
, cr2
);
1507 goto cannot_emulate
;
1510 case 0x21: /* mov from dr to reg */
1512 if (c
->modrm_mod
!= 3)
1513 goto cannot_emulate
;
1514 rc
= emulator_get_dr(ctxt
, c
->modrm_reg
,
1515 &c
->regs
[c
->modrm_rm
]);
1517 case 0x23: /* mov from reg to dr */
1519 if (c
->modrm_mod
!= 3)
1520 goto cannot_emulate
;
1521 rc
= emulator_set_dr(ctxt
, c
->modrm_reg
,
1522 c
->regs
[c
->modrm_rm
]);
1524 case 0x40 ... 0x4f: /* cmov */
1525 c
->dst
.val
= c
->dst
.orig_val
= c
->src
.val
;
1528 * First, assume we're decoding an even cmov opcode
1531 switch ((c
->b
& 15) >> 1) {
1533 no_wb
= (_eflags
& EFLG_OF
) ? 0 : 1;
1535 case 1: /* cmovb/cmovc/cmovnae */
1536 no_wb
= (_eflags
& EFLG_CF
) ? 0 : 1;
1538 case 2: /* cmovz/cmove */
1539 no_wb
= (_eflags
& EFLG_ZF
) ? 0 : 1;
1541 case 3: /* cmovbe/cmovna */
1542 no_wb
= (_eflags
& (EFLG_CF
| EFLG_ZF
)) ? 0 : 1;
1545 no_wb
= (_eflags
& EFLG_SF
) ? 0 : 1;
1547 case 5: /* cmovp/cmovpe */
1548 no_wb
= (_eflags
& EFLG_PF
) ? 0 : 1;
1550 case 7: /* cmovle/cmovng */
1551 no_wb
= (_eflags
& EFLG_ZF
) ? 0 : 1;
1553 case 6: /* cmovl/cmovnge */
1554 no_wb
&= (!(_eflags
& EFLG_SF
) !=
1555 !(_eflags
& EFLG_OF
)) ? 0 : 1;
1558 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
1563 /* only subword offset */
1564 c
->src
.val
&= (c
->dst
.bytes
<< 3) - 1;
1565 emulate_2op_SrcV_nobyte("bt", c
->src
, c
->dst
, _eflags
);
1569 /* only subword offset */
1570 c
->src
.val
&= (c
->dst
.bytes
<< 3) - 1;
1571 emulate_2op_SrcV_nobyte("bts", c
->src
, c
->dst
, _eflags
);
1573 case 0xb0 ... 0xb1: /* cmpxchg */
1575 * Save real source value, then compare EAX against
1578 c
->src
.orig_val
= c
->src
.val
;
1579 c
->src
.val
= c
->regs
[VCPU_REGS_RAX
];
1580 emulate_2op_SrcV("cmp", c
->src
, c
->dst
, _eflags
);
1581 if (_eflags
& EFLG_ZF
) {
1582 /* Success: write back to memory. */
1583 c
->dst
.val
= c
->src
.orig_val
;
1585 /* Failure: write the value we saw to EAX. */
1586 c
->dst
.type
= OP_REG
;
1587 c
->dst
.ptr
= (unsigned long *)&c
->regs
[VCPU_REGS_RAX
];
1592 /* only subword offset */
1593 c
->src
.val
&= (c
->dst
.bytes
<< 3) - 1;
1594 emulate_2op_SrcV_nobyte("btr", c
->src
, c
->dst
, _eflags
);
1596 case 0xb6 ... 0xb7: /* movzx */
1597 c
->dst
.bytes
= c
->op_bytes
;
1598 c
->dst
.val
= (c
->d
& ByteOp
) ? (u8
) c
->src
.val
1601 case 0xba: /* Grp8 */
1602 switch (c
->modrm_reg
& 3) {
1615 /* only subword offset */
1616 c
->src
.val
&= (c
->dst
.bytes
<< 3) - 1;
1617 emulate_2op_SrcV_nobyte("btc", c
->src
, c
->dst
, _eflags
);
1619 case 0xbe ... 0xbf: /* movsx */
1620 c
->dst
.bytes
= c
->op_bytes
;
1621 c
->dst
.val
= (c
->d
& ByteOp
) ? (s8
) c
->src
.val
:
1624 case 0xc3: /* movnti */
1625 c
->dst
.bytes
= c
->op_bytes
;
1626 c
->dst
.val
= (c
->op_bytes
== 4) ? (u32
) c
->src
.val
:
1632 twobyte_special_insn
:
1633 /* Disable writeback. */
1637 emulate_clts(ctxt
->vcpu
);
1639 case 0x08: /* invd */
1641 case 0x09: /* wbinvd */
1643 case 0x0d: /* GrpP (prefetch) */
1644 case 0x18: /* Grp16 (prefetch/nop) */
1646 case 0x20: /* mov cr, reg */
1647 if (c
->modrm_mod
!= 3)
1648 goto cannot_emulate
;
1649 c
->regs
[c
->modrm_rm
] =
1650 realmode_get_cr(ctxt
->vcpu
, c
->modrm_reg
);
1652 case 0x22: /* mov reg, cr */
1653 if (c
->modrm_mod
!= 3)
1654 goto cannot_emulate
;
1655 realmode_set_cr(ctxt
->vcpu
,
1656 c
->modrm_reg
, c
->modrm_val
, &_eflags
);
1660 msr_data
= (u32
)c
->regs
[VCPU_REGS_RAX
]
1661 | ((u64
)c
->regs
[VCPU_REGS_RDX
] << 32);
1662 rc
= kvm_set_msr(ctxt
->vcpu
, c
->regs
[VCPU_REGS_RCX
], msr_data
);
1664 kvm_x86_ops
->inject_gp(ctxt
->vcpu
, 0);
1665 c
->eip
= ctxt
->vcpu
->rip
;
1667 rc
= X86EMUL_CONTINUE
;
1671 rc
= kvm_get_msr(ctxt
->vcpu
,
1672 c
->regs
[VCPU_REGS_RCX
], &msr_data
);
1674 kvm_x86_ops
->inject_gp(ctxt
->vcpu
, 0);
1675 c
->eip
= ctxt
->vcpu
->rip
;
1677 c
->regs
[VCPU_REGS_RAX
] = (u32
)msr_data
;
1678 c
->regs
[VCPU_REGS_RDX
] = msr_data
>> 32;
1680 rc
= X86EMUL_CONTINUE
;
1682 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1685 switch (c
->op_bytes
) {
1687 rel
= insn_fetch(s16
, 2, c
->eip
);
1690 rel
= insn_fetch(s32
, 4, c
->eip
);
1693 rel
= insn_fetch(s64
, 8, c
->eip
);
1696 DPRINTF("jnz: Invalid op_bytes\n");
1697 goto cannot_emulate
;
1699 if (test_cc(c
->b
, _eflags
))
1703 case 0xc7: /* Grp9 (cmpxchg8b) */
1706 if ((rc
= ops
->read_emulated(cr2
, &old
, 8, ctxt
->vcpu
))
1709 if (((u32
) (old
>> 0) !=
1710 (u32
) c
->regs
[VCPU_REGS_RAX
]) ||
1711 ((u32
) (old
>> 32) !=
1712 (u32
) c
->regs
[VCPU_REGS_RDX
])) {
1713 c
->regs
[VCPU_REGS_RAX
] = (u32
) (old
>> 0);
1714 c
->regs
[VCPU_REGS_RDX
] = (u32
) (old
>> 32);
1715 _eflags
&= ~EFLG_ZF
;
1717 new = ((u64
)c
->regs
[VCPU_REGS_RCX
] << 32)
1718 | (u32
) c
->regs
[VCPU_REGS_RBX
];
1719 if ((rc
= ops
->cmpxchg_emulated(cr2
, &old
,
1720 &new, 8, ctxt
->vcpu
)) != 0)
1730 DPRINTF("Cannot emulate %02x\n", c
->b
);
This page took 0.117235 seconds and 5 git commands to generate.