x86_emulate.c 58 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172
  1. /******************************************************************************
  2. * x86_emulate.c
  3. *
  4. * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
  5. *
  6. * Copyright (c) 2005 Keir Fraser
  7. *
  8. * Linux coding style, mod r/m decoder, segment base fixes, real-mode
  9. * privileged instructions:
  10. *
  11. * Copyright (C) 2006 Qumranet
  12. *
  13. * Avi Kivity <avi@qumranet.com>
  14. * Yaniv Kamay <yaniv@qumranet.com>
  15. *
  16. * This work is licensed under the terms of the GNU GPL, version 2. See
  17. * the COPYING file in the top-level directory.
  18. *
  19. * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
  20. */
  21. #ifndef __KERNEL__
  22. #include <stdio.h>
  23. #include <stdint.h>
  24. #include <public/xen.h>
  25. #define DPRINTF(_f, _a ...) printf(_f , ## _a)
  26. #else
  27. #include <linux/kvm_host.h>
  28. #include "kvm_cache_regs.h"
  29. #define DPRINTF(x...) do {} while (0)
  30. #endif
  31. #include <linux/module.h>
  32. #include <asm/kvm_x86_emulate.h>
  33. #include "mmu.h" /* for is_long_mode() */
  34. /*
  35. * Opcode effective-address decode tables.
  36. * Note that we only emulate instructions that have at least one memory
  37. * operand (excluding implicit stack references). We assume that stack
  38. * references and instruction fetches will never occur in special memory
  39. * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
  40. * not be handled.
  41. */
  42. /* Operand sizes: 8-bit operands or specified/overridden size. */
  43. #define ByteOp (1<<0) /* 8-bit operands. */
  44. /* Destination operand type. */
  45. #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
  46. #define DstReg (2<<1) /* Register operand. */
  47. #define DstMem (3<<1) /* Memory operand. */
  48. #define DstAcc (4<<1) /* Destination Accumulator */
  49. #define DstMask (7<<1)
  50. /* Source operand type. */
  51. #define SrcNone (0<<4) /* No source operand. */
  52. #define SrcImplicit (0<<4) /* Source operand is implicit in the opcode. */
  53. #define SrcReg (1<<4) /* Register operand. */
  54. #define SrcMem (2<<4) /* Memory operand. */
  55. #define SrcMem16 (3<<4) /* Memory operand (16-bit). */
  56. #define SrcMem32 (4<<4) /* Memory operand (32-bit). */
  57. #define SrcImm (5<<4) /* Immediate operand. */
  58. #define SrcImmByte (6<<4) /* 8-bit sign-extended immediate operand. */
  59. #define SrcOne (7<<4) /* Implied '1' */
  60. #define SrcImmUByte (8<<4) /* 8-bit unsigned immediate operand. */
  61. #define SrcImmU (9<<4) /* Immediate operand, unsigned */
  62. #define SrcMask (0xf<<4)
  63. /* Generic ModRM decode. */
  64. #define ModRM (1<<8)
  65. /* Destination is only written; never read. */
  66. #define Mov (1<<9)
  67. #define BitOp (1<<10)
  68. #define MemAbs (1<<11) /* Memory operand is absolute displacement */
  69. #define String (1<<12) /* String instruction (rep capable) */
  70. #define Stack (1<<13) /* Stack instruction (push/pop) */
  71. #define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
  72. #define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
  73. #define GroupMask 0xff /* Group number stored in bits 0:7 */
  74. /* Source 2 operand type */
  75. #define Src2None (0<<29)
  76. #define Src2CL (1<<29)
  77. #define Src2ImmByte (2<<29)
  78. #define Src2One (3<<29)
  79. #define Src2Imm16 (4<<29)
  80. #define Src2Mask (7<<29)
  81. enum {
  82. Group1_80, Group1_81, Group1_82, Group1_83,
  83. Group1A, Group3_Byte, Group3, Group4, Group5, Group7,
  84. };
  85. static u32 opcode_table[256] = {
  86. /* 0x00 - 0x07 */
  87. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  88. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  89. ByteOp | DstAcc | SrcImm, DstAcc | SrcImm, 0, 0,
  90. /* 0x08 - 0x0F */
  91. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  92. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  93. 0, 0, 0, 0,
  94. /* 0x10 - 0x17 */
  95. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  96. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  97. 0, 0, 0, 0,
  98. /* 0x18 - 0x1F */
  99. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  100. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  101. 0, 0, 0, 0,
  102. /* 0x20 - 0x27 */
  103. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  104. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  105. DstAcc | SrcImmByte, DstAcc | SrcImm, 0, 0,
  106. /* 0x28 - 0x2F */
  107. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  108. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  109. 0, 0, 0, 0,
  110. /* 0x30 - 0x37 */
  111. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  112. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  113. 0, 0, 0, 0,
  114. /* 0x38 - 0x3F */
  115. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  116. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  117. ByteOp | DstAcc | SrcImm, DstAcc | SrcImm,
  118. 0, 0,
  119. /* 0x40 - 0x47 */
  120. DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
  121. /* 0x48 - 0x4F */
  122. DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
  123. /* 0x50 - 0x57 */
  124. SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
  125. SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
  126. /* 0x58 - 0x5F */
  127. DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
  128. DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
  129. /* 0x60 - 0x67 */
  130. 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
  131. 0, 0, 0, 0,
  132. /* 0x68 - 0x6F */
  133. SrcImm | Mov | Stack, 0, SrcImmByte | Mov | Stack, 0,
  134. SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
  135. SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
  136. /* 0x70 - 0x77 */
  137. SrcImmByte, SrcImmByte, SrcImmByte, SrcImmByte,
  138. SrcImmByte, SrcImmByte, SrcImmByte, SrcImmByte,
  139. /* 0x78 - 0x7F */
  140. SrcImmByte, SrcImmByte, SrcImmByte, SrcImmByte,
  141. SrcImmByte, SrcImmByte, SrcImmByte, SrcImmByte,
  142. /* 0x80 - 0x87 */
  143. Group | Group1_80, Group | Group1_81,
  144. Group | Group1_82, Group | Group1_83,
  145. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  146. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  147. /* 0x88 - 0x8F */
  148. ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
  149. ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  150. DstMem | SrcReg | ModRM | Mov, ModRM | DstReg,
  151. DstReg | SrcMem | ModRM | Mov, Group | Group1A,
  152. /* 0x90 - 0x97 */
  153. DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
  154. /* 0x98 - 0x9F */
  155. 0, 0, SrcImm | Src2Imm16, 0,
  156. ImplicitOps | Stack, ImplicitOps | Stack, 0, 0,
  157. /* 0xA0 - 0xA7 */
  158. ByteOp | DstReg | SrcMem | Mov | MemAbs, DstReg | SrcMem | Mov | MemAbs,
  159. ByteOp | DstMem | SrcReg | Mov | MemAbs, DstMem | SrcReg | Mov | MemAbs,
  160. ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
  161. ByteOp | ImplicitOps | String, ImplicitOps | String,
  162. /* 0xA8 - 0xAF */
  163. 0, 0, ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
  164. ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
  165. ByteOp | ImplicitOps | String, ImplicitOps | String,
  166. /* 0xB0 - 0xB7 */
  167. ByteOp | DstReg | SrcImm | Mov, ByteOp | DstReg | SrcImm | Mov,
  168. ByteOp | DstReg | SrcImm | Mov, ByteOp | DstReg | SrcImm | Mov,
  169. ByteOp | DstReg | SrcImm | Mov, ByteOp | DstReg | SrcImm | Mov,
  170. ByteOp | DstReg | SrcImm | Mov, ByteOp | DstReg | SrcImm | Mov,
  171. /* 0xB8 - 0xBF */
  172. DstReg | SrcImm | Mov, DstReg | SrcImm | Mov,
  173. DstReg | SrcImm | Mov, DstReg | SrcImm | Mov,
  174. DstReg | SrcImm | Mov, DstReg | SrcImm | Mov,
  175. DstReg | SrcImm | Mov, DstReg | SrcImm | Mov,
  176. /* 0xC0 - 0xC7 */
  177. ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
  178. 0, ImplicitOps | Stack, 0, 0,
  179. ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
  180. /* 0xC8 - 0xCF */
  181. 0, 0, 0, ImplicitOps | Stack,
  182. ImplicitOps, SrcImmByte, ImplicitOps, ImplicitOps,
  183. /* 0xD0 - 0xD7 */
  184. ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
  185. ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
  186. 0, 0, 0, 0,
  187. /* 0xD8 - 0xDF */
  188. 0, 0, 0, 0, 0, 0, 0, 0,
  189. /* 0xE0 - 0xE7 */
  190. 0, 0, 0, 0,
  191. ByteOp | SrcImmUByte, SrcImmUByte,
  192. ByteOp | SrcImmUByte, SrcImmUByte,
  193. /* 0xE8 - 0xEF */
  194. SrcImm | Stack, SrcImm | ImplicitOps,
  195. SrcImmU | Src2Imm16, SrcImmByte | ImplicitOps,
  196. SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps,
  197. SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps,
  198. /* 0xF0 - 0xF7 */
  199. 0, 0, 0, 0,
  200. ImplicitOps, ImplicitOps, Group | Group3_Byte, Group | Group3,
  201. /* 0xF8 - 0xFF */
  202. ImplicitOps, 0, ImplicitOps, ImplicitOps,
  203. ImplicitOps, ImplicitOps, Group | Group4, Group | Group5,
  204. };
  205. static u32 twobyte_table[256] = {
  206. /* 0x00 - 0x0F */
  207. 0, Group | GroupDual | Group7, 0, 0, 0, ImplicitOps, ImplicitOps, 0,
  208. ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
  209. /* 0x10 - 0x1F */
  210. 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
  211. /* 0x20 - 0x2F */
  212. ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
  213. 0, 0, 0, 0, 0, 0, 0, 0,
  214. /* 0x30 - 0x3F */
  215. ImplicitOps, 0, ImplicitOps, 0,
  216. ImplicitOps, ImplicitOps, 0, 0,
  217. 0, 0, 0, 0, 0, 0, 0, 0,
  218. /* 0x40 - 0x47 */
  219. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  220. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  221. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  222. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  223. /* 0x48 - 0x4F */
  224. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  225. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  226. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  227. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  228. /* 0x50 - 0x5F */
  229. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  230. /* 0x60 - 0x6F */
  231. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  232. /* 0x70 - 0x7F */
  233. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  234. /* 0x80 - 0x8F */
  235. SrcImm, SrcImm, SrcImm, SrcImm, SrcImm, SrcImm, SrcImm, SrcImm,
  236. SrcImm, SrcImm, SrcImm, SrcImm, SrcImm, SrcImm, SrcImm, SrcImm,
  237. /* 0x90 - 0x9F */
  238. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  239. /* 0xA0 - 0xA7 */
  240. 0, 0, 0, DstMem | SrcReg | ModRM | BitOp,
  241. DstMem | SrcReg | Src2ImmByte | ModRM,
  242. DstMem | SrcReg | Src2CL | ModRM, 0, 0,
  243. /* 0xA8 - 0xAF */
  244. 0, 0, 0, DstMem | SrcReg | ModRM | BitOp,
  245. DstMem | SrcReg | Src2ImmByte | ModRM,
  246. DstMem | SrcReg | Src2CL | ModRM,
  247. ModRM, 0,
  248. /* 0xB0 - 0xB7 */
  249. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
  250. DstMem | SrcReg | ModRM | BitOp,
  251. 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
  252. DstReg | SrcMem16 | ModRM | Mov,
  253. /* 0xB8 - 0xBF */
  254. 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
  255. 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
  256. DstReg | SrcMem16 | ModRM | Mov,
  257. /* 0xC0 - 0xCF */
  258. 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
  259. 0, 0, 0, 0, 0, 0, 0, 0,
  260. /* 0xD0 - 0xDF */
  261. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  262. /* 0xE0 - 0xEF */
  263. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  264. /* 0xF0 - 0xFF */
  265. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
  266. };
  267. static u32 group_table[] = {
  268. [Group1_80*8] =
  269. ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
  270. ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
  271. ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
  272. ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
  273. [Group1_81*8] =
  274. DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
  275. DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
  276. DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
  277. DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
  278. [Group1_82*8] =
  279. ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
  280. ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
  281. ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
  282. ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
  283. [Group1_83*8] =
  284. DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
  285. DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
  286. DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
  287. DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
  288. [Group1A*8] =
  289. DstMem | SrcNone | ModRM | Mov | Stack, 0, 0, 0, 0, 0, 0, 0,
  290. [Group3_Byte*8] =
  291. ByteOp | SrcImm | DstMem | ModRM, 0,
  292. ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
  293. 0, 0, 0, 0,
  294. [Group3*8] =
  295. DstMem | SrcImm | ModRM, 0,
  296. DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
  297. 0, 0, 0, 0,
  298. [Group4*8] =
  299. ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
  300. 0, 0, 0, 0, 0, 0,
  301. [Group5*8] =
  302. DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
  303. SrcMem | ModRM | Stack, 0,
  304. SrcMem | ModRM | Stack, 0, SrcMem | ModRM | Stack, 0,
  305. [Group7*8] =
  306. 0, 0, ModRM | SrcMem, ModRM | SrcMem,
  307. SrcNone | ModRM | DstMem | Mov, 0,
  308. SrcMem16 | ModRM | Mov, SrcMem | ModRM | ByteOp,
  309. };
  310. static u32 group2_table[] = {
  311. [Group7*8] =
  312. SrcNone | ModRM, 0, 0, SrcNone | ModRM,
  313. SrcNone | ModRM | DstMem | Mov, 0,
  314. SrcMem16 | ModRM | Mov, 0,
  315. };
  316. /* EFLAGS bit definitions. */
  317. #define EFLG_VM (1<<17)
  318. #define EFLG_RF (1<<16)
  319. #define EFLG_OF (1<<11)
  320. #define EFLG_DF (1<<10)
  321. #define EFLG_IF (1<<9)
  322. #define EFLG_SF (1<<7)
  323. #define EFLG_ZF (1<<6)
  324. #define EFLG_AF (1<<4)
  325. #define EFLG_PF (1<<2)
  326. #define EFLG_CF (1<<0)
  327. /*
  328. * Instruction emulation:
  329. * Most instructions are emulated directly via a fragment of inline assembly
  330. * code. This allows us to save/restore EFLAGS and thus very easily pick up
  331. * any modified flags.
  332. */
  333. #if defined(CONFIG_X86_64)
  334. #define _LO32 "k" /* force 32-bit operand */
  335. #define _STK "%%rsp" /* stack pointer */
  336. #elif defined(__i386__)
  337. #define _LO32 "" /* force 32-bit operand */
  338. #define _STK "%%esp" /* stack pointer */
  339. #endif
  340. /*
  341. * These EFLAGS bits are restored from saved value during emulation, and
  342. * any changes are written back to the saved value after emulation.
  343. */
  344. #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
  345. /* Before executing instruction: restore necessary bits in EFLAGS. */
  346. #define _PRE_EFLAGS(_sav, _msk, _tmp) \
  347. /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
  348. "movl %"_sav",%"_LO32 _tmp"; " \
  349. "push %"_tmp"; " \
  350. "push %"_tmp"; " \
  351. "movl %"_msk",%"_LO32 _tmp"; " \
  352. "andl %"_LO32 _tmp",("_STK"); " \
  353. "pushf; " \
  354. "notl %"_LO32 _tmp"; " \
  355. "andl %"_LO32 _tmp",("_STK"); " \
  356. "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
  357. "pop %"_tmp"; " \
  358. "orl %"_LO32 _tmp",("_STK"); " \
  359. "popf; " \
  360. "pop %"_sav"; "
  361. /* After executing instruction: write-back necessary bits in EFLAGS. */
  362. #define _POST_EFLAGS(_sav, _msk, _tmp) \
  363. /* _sav |= EFLAGS & _msk; */ \
  364. "pushf; " \
  365. "pop %"_tmp"; " \
  366. "andl %"_msk",%"_LO32 _tmp"; " \
  367. "orl %"_LO32 _tmp",%"_sav"; "
  368. #ifdef CONFIG_X86_64
  369. #define ON64(x) x
  370. #else
  371. #define ON64(x)
  372. #endif
  373. #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix) \
  374. do { \
  375. __asm__ __volatile__ ( \
  376. _PRE_EFLAGS("0", "4", "2") \
  377. _op _suffix " %"_x"3,%1; " \
  378. _POST_EFLAGS("0", "4", "2") \
  379. : "=m" (_eflags), "=m" ((_dst).val), \
  380. "=&r" (_tmp) \
  381. : _y ((_src).val), "i" (EFLAGS_MASK)); \
  382. } while (0)
  383. /* Raw emulation: instruction has two explicit operands. */
  384. #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
  385. do { \
  386. unsigned long _tmp; \
  387. \
  388. switch ((_dst).bytes) { \
  389. case 2: \
  390. ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
  391. break; \
  392. case 4: \
  393. ____emulate_2op(_op,_src,_dst,_eflags,_lx,_ly,"l"); \
  394. break; \
  395. case 8: \
  396. ON64(____emulate_2op(_op,_src,_dst,_eflags,_qx,_qy,"q")); \
  397. break; \
  398. } \
  399. } while (0)
  400. #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
  401. do { \
  402. unsigned long _tmp; \
  403. switch ((_dst).bytes) { \
  404. case 1: \
  405. ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b"); \
  406. break; \
  407. default: \
  408. __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
  409. _wx, _wy, _lx, _ly, _qx, _qy); \
  410. break; \
  411. } \
  412. } while (0)
  413. /* Source operand is byte-sized and may be restricted to just %cl. */
  414. #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
  415. __emulate_2op(_op, _src, _dst, _eflags, \
  416. "b", "c", "b", "c", "b", "c", "b", "c")
  417. /* Source operand is byte, word, long or quad sized. */
  418. #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
  419. __emulate_2op(_op, _src, _dst, _eflags, \
  420. "b", "q", "w", "r", _LO32, "r", "", "r")
  421. /* Source operand is word, long or quad sized. */
  422. #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
  423. __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
  424. "w", "r", _LO32, "r", "", "r")
  425. /* Instruction has three operands and one operand is stored in ECX register */
  426. #define __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, _suffix, _type) \
  427. do { \
  428. unsigned long _tmp; \
  429. _type _clv = (_cl).val; \
  430. _type _srcv = (_src).val; \
  431. _type _dstv = (_dst).val; \
  432. \
  433. __asm__ __volatile__ ( \
  434. _PRE_EFLAGS("0", "5", "2") \
  435. _op _suffix " %4,%1 \n" \
  436. _POST_EFLAGS("0", "5", "2") \
  437. : "=m" (_eflags), "+r" (_dstv), "=&r" (_tmp) \
  438. : "c" (_clv) , "r" (_srcv), "i" (EFLAGS_MASK) \
  439. ); \
  440. \
  441. (_cl).val = (unsigned long) _clv; \
  442. (_src).val = (unsigned long) _srcv; \
  443. (_dst).val = (unsigned long) _dstv; \
  444. } while (0)
  445. #define emulate_2op_cl(_op, _cl, _src, _dst, _eflags) \
  446. do { \
  447. switch ((_dst).bytes) { \
  448. case 2: \
  449. __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
  450. "w", unsigned short); \
  451. break; \
  452. case 4: \
  453. __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
  454. "l", unsigned int); \
  455. break; \
  456. case 8: \
  457. ON64(__emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
  458. "q", unsigned long)); \
  459. break; \
  460. } \
  461. } while (0)
  462. #define __emulate_1op(_op, _dst, _eflags, _suffix) \
  463. do { \
  464. unsigned long _tmp; \
  465. \
  466. __asm__ __volatile__ ( \
  467. _PRE_EFLAGS("0", "3", "2") \
  468. _op _suffix " %1; " \
  469. _POST_EFLAGS("0", "3", "2") \
  470. : "=m" (_eflags), "+m" ((_dst).val), \
  471. "=&r" (_tmp) \
  472. : "i" (EFLAGS_MASK)); \
  473. } while (0)
  474. /* Instruction has only one explicit operand (no source operand). */
  475. #define emulate_1op(_op, _dst, _eflags) \
  476. do { \
  477. switch ((_dst).bytes) { \
  478. case 1: __emulate_1op(_op, _dst, _eflags, "b"); break; \
  479. case 2: __emulate_1op(_op, _dst, _eflags, "w"); break; \
  480. case 4: __emulate_1op(_op, _dst, _eflags, "l"); break; \
  481. case 8: ON64(__emulate_1op(_op, _dst, _eflags, "q")); break; \
  482. } \
  483. } while (0)
  484. /* Fetch next part of the instruction being emulated. */
  485. #define insn_fetch(_type, _size, _eip) \
  486. ({ unsigned long _x; \
  487. rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
  488. if (rc != 0) \
  489. goto done; \
  490. (_eip) += (_size); \
  491. (_type)_x; \
  492. })
  493. static inline unsigned long ad_mask(struct decode_cache *c)
  494. {
  495. return (1UL << (c->ad_bytes << 3)) - 1;
  496. }
  497. /* Access/update address held in a register, based on addressing mode. */
  498. static inline unsigned long
  499. address_mask(struct decode_cache *c, unsigned long reg)
  500. {
  501. if (c->ad_bytes == sizeof(unsigned long))
  502. return reg;
  503. else
  504. return reg & ad_mask(c);
  505. }
  506. static inline unsigned long
  507. register_address(struct decode_cache *c, unsigned long base, unsigned long reg)
  508. {
  509. return base + address_mask(c, reg);
  510. }
  511. static inline void
  512. register_address_increment(struct decode_cache *c, unsigned long *reg, int inc)
  513. {
  514. if (c->ad_bytes == sizeof(unsigned long))
  515. *reg += inc;
  516. else
  517. *reg = (*reg & ~ad_mask(c)) | ((*reg + inc) & ad_mask(c));
  518. }
  519. static inline void jmp_rel(struct decode_cache *c, int rel)
  520. {
  521. register_address_increment(c, &c->eip, rel);
  522. }
  523. static void set_seg_override(struct decode_cache *c, int seg)
  524. {
  525. c->has_seg_override = true;
  526. c->seg_override = seg;
  527. }
  528. static unsigned long seg_base(struct x86_emulate_ctxt *ctxt, int seg)
  529. {
  530. if (ctxt->mode == X86EMUL_MODE_PROT64 && seg < VCPU_SREG_FS)
  531. return 0;
  532. return kvm_x86_ops->get_segment_base(ctxt->vcpu, seg);
  533. }
  534. static unsigned long seg_override_base(struct x86_emulate_ctxt *ctxt,
  535. struct decode_cache *c)
  536. {
  537. if (!c->has_seg_override)
  538. return 0;
  539. return seg_base(ctxt, c->seg_override);
  540. }
  541. static unsigned long es_base(struct x86_emulate_ctxt *ctxt)
  542. {
  543. return seg_base(ctxt, VCPU_SREG_ES);
  544. }
  545. static unsigned long ss_base(struct x86_emulate_ctxt *ctxt)
  546. {
  547. return seg_base(ctxt, VCPU_SREG_SS);
  548. }
  549. static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
  550. struct x86_emulate_ops *ops,
  551. unsigned long linear, u8 *dest)
  552. {
  553. struct fetch_cache *fc = &ctxt->decode.fetch;
  554. int rc;
  555. int size;
  556. if (linear < fc->start || linear >= fc->end) {
  557. size = min(15UL, PAGE_SIZE - offset_in_page(linear));
  558. rc = ops->read_std(linear, fc->data, size, ctxt->vcpu);
  559. if (rc)
  560. return rc;
  561. fc->start = linear;
  562. fc->end = linear + size;
  563. }
  564. *dest = fc->data[linear - fc->start];
  565. return 0;
  566. }
  567. static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
  568. struct x86_emulate_ops *ops,
  569. unsigned long eip, void *dest, unsigned size)
  570. {
  571. int rc = 0;
  572. eip += ctxt->cs_base;
  573. while (size--) {
  574. rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
  575. if (rc)
  576. return rc;
  577. }
  578. return 0;
  579. }
  580. /*
  581. * Given the 'reg' portion of a ModRM byte, and a register block, return a
  582. * pointer into the block that addresses the relevant register.
  583. * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
  584. */
  585. static void *decode_register(u8 modrm_reg, unsigned long *regs,
  586. int highbyte_regs)
  587. {
  588. void *p;
  589. p = &regs[modrm_reg];
  590. if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
  591. p = (unsigned char *)&regs[modrm_reg & 3] + 1;
  592. return p;
  593. }
  594. static int read_descriptor(struct x86_emulate_ctxt *ctxt,
  595. struct x86_emulate_ops *ops,
  596. void *ptr,
  597. u16 *size, unsigned long *address, int op_bytes)
  598. {
  599. int rc;
  600. if (op_bytes == 2)
  601. op_bytes = 3;
  602. *address = 0;
  603. rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
  604. ctxt->vcpu);
  605. if (rc)
  606. return rc;
  607. rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
  608. ctxt->vcpu);
  609. return rc;
  610. }
  611. static int test_cc(unsigned int condition, unsigned int flags)
  612. {
  613. int rc = 0;
  614. switch ((condition & 15) >> 1) {
  615. case 0: /* o */
  616. rc |= (flags & EFLG_OF);
  617. break;
  618. case 1: /* b/c/nae */
  619. rc |= (flags & EFLG_CF);
  620. break;
  621. case 2: /* z/e */
  622. rc |= (flags & EFLG_ZF);
  623. break;
  624. case 3: /* be/na */
  625. rc |= (flags & (EFLG_CF|EFLG_ZF));
  626. break;
  627. case 4: /* s */
  628. rc |= (flags & EFLG_SF);
  629. break;
  630. case 5: /* p/pe */
  631. rc |= (flags & EFLG_PF);
  632. break;
  633. case 7: /* le/ng */
  634. rc |= (flags & EFLG_ZF);
  635. /* fall through */
  636. case 6: /* l/nge */
  637. rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
  638. break;
  639. }
  640. /* Odd condition identifiers (lsb == 1) have inverted sense. */
  641. return (!!rc ^ (condition & 1));
  642. }
  643. static void decode_register_operand(struct operand *op,
  644. struct decode_cache *c,
  645. int inhibit_bytereg)
  646. {
  647. unsigned reg = c->modrm_reg;
  648. int highbyte_regs = c->rex_prefix == 0;
  649. if (!(c->d & ModRM))
  650. reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
  651. op->type = OP_REG;
  652. if ((c->d & ByteOp) && !inhibit_bytereg) {
  653. op->ptr = decode_register(reg, c->regs, highbyte_regs);
  654. op->val = *(u8 *)op->ptr;
  655. op->bytes = 1;
  656. } else {
  657. op->ptr = decode_register(reg, c->regs, 0);
  658. op->bytes = c->op_bytes;
  659. switch (op->bytes) {
  660. case 2:
  661. op->val = *(u16 *)op->ptr;
  662. break;
  663. case 4:
  664. op->val = *(u32 *)op->ptr;
  665. break;
  666. case 8:
  667. op->val = *(u64 *) op->ptr;
  668. break;
  669. }
  670. }
  671. op->orig_val = op->val;
  672. }
  673. static int decode_modrm(struct x86_emulate_ctxt *ctxt,
  674. struct x86_emulate_ops *ops)
  675. {
  676. struct decode_cache *c = &ctxt->decode;
  677. u8 sib;
  678. int index_reg = 0, base_reg = 0, scale;
  679. int rc = 0;
  680. if (c->rex_prefix) {
  681. c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
  682. index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
  683. c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
  684. }
  685. c->modrm = insn_fetch(u8, 1, c->eip);
  686. c->modrm_mod |= (c->modrm & 0xc0) >> 6;
  687. c->modrm_reg |= (c->modrm & 0x38) >> 3;
  688. c->modrm_rm |= (c->modrm & 0x07);
  689. c->modrm_ea = 0;
  690. c->use_modrm_ea = 1;
  691. if (c->modrm_mod == 3) {
  692. c->modrm_ptr = decode_register(c->modrm_rm,
  693. c->regs, c->d & ByteOp);
  694. c->modrm_val = *(unsigned long *)c->modrm_ptr;
  695. return rc;
  696. }
  697. if (c->ad_bytes == 2) {
  698. unsigned bx = c->regs[VCPU_REGS_RBX];
  699. unsigned bp = c->regs[VCPU_REGS_RBP];
  700. unsigned si = c->regs[VCPU_REGS_RSI];
  701. unsigned di = c->regs[VCPU_REGS_RDI];
  702. /* 16-bit ModR/M decode. */
  703. switch (c->modrm_mod) {
  704. case 0:
  705. if (c->modrm_rm == 6)
  706. c->modrm_ea += insn_fetch(u16, 2, c->eip);
  707. break;
  708. case 1:
  709. c->modrm_ea += insn_fetch(s8, 1, c->eip);
  710. break;
  711. case 2:
  712. c->modrm_ea += insn_fetch(u16, 2, c->eip);
  713. break;
  714. }
  715. switch (c->modrm_rm) {
  716. case 0:
  717. c->modrm_ea += bx + si;
  718. break;
  719. case 1:
  720. c->modrm_ea += bx + di;
  721. break;
  722. case 2:
  723. c->modrm_ea += bp + si;
  724. break;
  725. case 3:
  726. c->modrm_ea += bp + di;
  727. break;
  728. case 4:
  729. c->modrm_ea += si;
  730. break;
  731. case 5:
  732. c->modrm_ea += di;
  733. break;
  734. case 6:
  735. if (c->modrm_mod != 0)
  736. c->modrm_ea += bp;
  737. break;
  738. case 7:
  739. c->modrm_ea += bx;
  740. break;
  741. }
  742. if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
  743. (c->modrm_rm == 6 && c->modrm_mod != 0))
  744. if (!c->has_seg_override)
  745. set_seg_override(c, VCPU_SREG_SS);
  746. c->modrm_ea = (u16)c->modrm_ea;
  747. } else {
  748. /* 32/64-bit ModR/M decode. */
  749. if ((c->modrm_rm & 7) == 4) {
  750. sib = insn_fetch(u8, 1, c->eip);
  751. index_reg |= (sib >> 3) & 7;
  752. base_reg |= sib & 7;
  753. scale = sib >> 6;
  754. if ((base_reg & 7) == 5 && c->modrm_mod == 0)
  755. c->modrm_ea += insn_fetch(s32, 4, c->eip);
  756. else
  757. c->modrm_ea += c->regs[base_reg];
  758. if (index_reg != 4)
  759. c->modrm_ea += c->regs[index_reg] << scale;
  760. } else if ((c->modrm_rm & 7) == 5 && c->modrm_mod == 0) {
  761. if (ctxt->mode == X86EMUL_MODE_PROT64)
  762. c->rip_relative = 1;
  763. } else
  764. c->modrm_ea += c->regs[c->modrm_rm];
  765. switch (c->modrm_mod) {
  766. case 0:
  767. if (c->modrm_rm == 5)
  768. c->modrm_ea += insn_fetch(s32, 4, c->eip);
  769. break;
  770. case 1:
  771. c->modrm_ea += insn_fetch(s8, 1, c->eip);
  772. break;
  773. case 2:
  774. c->modrm_ea += insn_fetch(s32, 4, c->eip);
  775. break;
  776. }
  777. }
  778. done:
  779. return rc;
  780. }
  781. static int decode_abs(struct x86_emulate_ctxt *ctxt,
  782. struct x86_emulate_ops *ops)
  783. {
  784. struct decode_cache *c = &ctxt->decode;
  785. int rc = 0;
  786. switch (c->ad_bytes) {
  787. case 2:
  788. c->modrm_ea = insn_fetch(u16, 2, c->eip);
  789. break;
  790. case 4:
  791. c->modrm_ea = insn_fetch(u32, 4, c->eip);
  792. break;
  793. case 8:
  794. c->modrm_ea = insn_fetch(u64, 8, c->eip);
  795. break;
  796. }
  797. done:
  798. return rc;
  799. }
  800. int
  801. x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
  802. {
  803. struct decode_cache *c = &ctxt->decode;
  804. int rc = 0;
  805. int mode = ctxt->mode;
  806. int def_op_bytes, def_ad_bytes, group;
  807. /* Shadow copy of register state. Committed on successful emulation. */
  808. memset(c, 0, sizeof(struct decode_cache));
  809. c->eip = kvm_rip_read(ctxt->vcpu);
  810. ctxt->cs_base = seg_base(ctxt, VCPU_SREG_CS);
  811. memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
  812. switch (mode) {
  813. case X86EMUL_MODE_REAL:
  814. case X86EMUL_MODE_PROT16:
  815. def_op_bytes = def_ad_bytes = 2;
  816. break;
  817. case X86EMUL_MODE_PROT32:
  818. def_op_bytes = def_ad_bytes = 4;
  819. break;
  820. #ifdef CONFIG_X86_64
  821. case X86EMUL_MODE_PROT64:
  822. def_op_bytes = 4;
  823. def_ad_bytes = 8;
  824. break;
  825. #endif
  826. default:
  827. return -1;
  828. }
  829. c->op_bytes = def_op_bytes;
  830. c->ad_bytes = def_ad_bytes;
  831. /* Legacy prefixes. */
  832. for (;;) {
  833. switch (c->b = insn_fetch(u8, 1, c->eip)) {
  834. case 0x66: /* operand-size override */
  835. /* switch between 2/4 bytes */
  836. c->op_bytes = def_op_bytes ^ 6;
  837. break;
  838. case 0x67: /* address-size override */
  839. if (mode == X86EMUL_MODE_PROT64)
  840. /* switch between 4/8 bytes */
  841. c->ad_bytes = def_ad_bytes ^ 12;
  842. else
  843. /* switch between 2/4 bytes */
  844. c->ad_bytes = def_ad_bytes ^ 6;
  845. break;
  846. case 0x26: /* ES override */
  847. case 0x2e: /* CS override */
  848. case 0x36: /* SS override */
  849. case 0x3e: /* DS override */
  850. set_seg_override(c, (c->b >> 3) & 3);
  851. break;
  852. case 0x64: /* FS override */
  853. case 0x65: /* GS override */
  854. set_seg_override(c, c->b & 7);
  855. break;
  856. case 0x40 ... 0x4f: /* REX */
  857. if (mode != X86EMUL_MODE_PROT64)
  858. goto done_prefixes;
  859. c->rex_prefix = c->b;
  860. continue;
  861. case 0xf0: /* LOCK */
  862. c->lock_prefix = 1;
  863. break;
  864. case 0xf2: /* REPNE/REPNZ */
  865. c->rep_prefix = REPNE_PREFIX;
  866. break;
  867. case 0xf3: /* REP/REPE/REPZ */
  868. c->rep_prefix = REPE_PREFIX;
  869. break;
  870. default:
  871. goto done_prefixes;
  872. }
  873. /* Any legacy prefix after a REX prefix nullifies its effect. */
  874. c->rex_prefix = 0;
  875. }
  876. done_prefixes:
  877. /* REX prefix. */
  878. if (c->rex_prefix)
  879. if (c->rex_prefix & 8)
  880. c->op_bytes = 8; /* REX.W */
  881. /* Opcode byte(s). */
  882. c->d = opcode_table[c->b];
  883. if (c->d == 0) {
  884. /* Two-byte opcode? */
  885. if (c->b == 0x0f) {
  886. c->twobyte = 1;
  887. c->b = insn_fetch(u8, 1, c->eip);
  888. c->d = twobyte_table[c->b];
  889. }
  890. }
  891. if (c->d & Group) {
  892. group = c->d & GroupMask;
  893. c->modrm = insn_fetch(u8, 1, c->eip);
  894. --c->eip;
  895. group = (group << 3) + ((c->modrm >> 3) & 7);
  896. if ((c->d & GroupDual) && (c->modrm >> 6) == 3)
  897. c->d = group2_table[group];
  898. else
  899. c->d = group_table[group];
  900. }
  901. /* Unrecognised? */
  902. if (c->d == 0) {
  903. DPRINTF("Cannot emulate %02x\n", c->b);
  904. return -1;
  905. }
  906. if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
  907. c->op_bytes = 8;
  908. /* ModRM and SIB bytes. */
  909. if (c->d & ModRM)
  910. rc = decode_modrm(ctxt, ops);
  911. else if (c->d & MemAbs)
  912. rc = decode_abs(ctxt, ops);
  913. if (rc)
  914. goto done;
  915. if (!c->has_seg_override)
  916. set_seg_override(c, VCPU_SREG_DS);
  917. if (!(!c->twobyte && c->b == 0x8d))
  918. c->modrm_ea += seg_override_base(ctxt, c);
  919. if (c->ad_bytes != 8)
  920. c->modrm_ea = (u32)c->modrm_ea;
  921. /*
  922. * Decode and fetch the source operand: register, memory
  923. * or immediate.
  924. */
  925. switch (c->d & SrcMask) {
  926. case SrcNone:
  927. break;
  928. case SrcReg:
  929. decode_register_operand(&c->src, c, 0);
  930. break;
  931. case SrcMem16:
  932. c->src.bytes = 2;
  933. goto srcmem_common;
  934. case SrcMem32:
  935. c->src.bytes = 4;
  936. goto srcmem_common;
  937. case SrcMem:
  938. c->src.bytes = (c->d & ByteOp) ? 1 :
  939. c->op_bytes;
  940. /* Don't fetch the address for invlpg: it could be unmapped. */
  941. if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
  942. break;
  943. srcmem_common:
  944. /*
  945. * For instructions with a ModR/M byte, switch to register
  946. * access if Mod = 3.
  947. */
  948. if ((c->d & ModRM) && c->modrm_mod == 3) {
  949. c->src.type = OP_REG;
  950. c->src.val = c->modrm_val;
  951. c->src.ptr = c->modrm_ptr;
  952. break;
  953. }
  954. c->src.type = OP_MEM;
  955. break;
  956. case SrcImm:
  957. case SrcImmU:
  958. c->src.type = OP_IMM;
  959. c->src.ptr = (unsigned long *)c->eip;
  960. c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
  961. if (c->src.bytes == 8)
  962. c->src.bytes = 4;
  963. /* NB. Immediates are sign-extended as necessary. */
  964. switch (c->src.bytes) {
  965. case 1:
  966. c->src.val = insn_fetch(s8, 1, c->eip);
  967. break;
  968. case 2:
  969. c->src.val = insn_fetch(s16, 2, c->eip);
  970. break;
  971. case 4:
  972. c->src.val = insn_fetch(s32, 4, c->eip);
  973. break;
  974. }
  975. if ((c->d & SrcMask) == SrcImmU) {
  976. switch (c->src.bytes) {
  977. case 1:
  978. c->src.val &= 0xff;
  979. break;
  980. case 2:
  981. c->src.val &= 0xffff;
  982. break;
  983. case 4:
  984. c->src.val &= 0xffffffff;
  985. break;
  986. }
  987. }
  988. break;
  989. case SrcImmByte:
  990. case SrcImmUByte:
  991. c->src.type = OP_IMM;
  992. c->src.ptr = (unsigned long *)c->eip;
  993. c->src.bytes = 1;
  994. if ((c->d & SrcMask) == SrcImmByte)
  995. c->src.val = insn_fetch(s8, 1, c->eip);
  996. else
  997. c->src.val = insn_fetch(u8, 1, c->eip);
  998. break;
  999. case SrcOne:
  1000. c->src.bytes = 1;
  1001. c->src.val = 1;
  1002. break;
  1003. }
  1004. /*
  1005. * Decode and fetch the second source operand: register, memory
  1006. * or immediate.
  1007. */
  1008. switch (c->d & Src2Mask) {
  1009. case Src2None:
  1010. break;
  1011. case Src2CL:
  1012. c->src2.bytes = 1;
  1013. c->src2.val = c->regs[VCPU_REGS_RCX] & 0x8;
  1014. break;
  1015. case Src2ImmByte:
  1016. c->src2.type = OP_IMM;
  1017. c->src2.ptr = (unsigned long *)c->eip;
  1018. c->src2.bytes = 1;
  1019. c->src2.val = insn_fetch(u8, 1, c->eip);
  1020. break;
  1021. case Src2Imm16:
  1022. c->src2.type = OP_IMM;
  1023. c->src2.ptr = (unsigned long *)c->eip;
  1024. c->src2.bytes = 2;
  1025. c->src2.val = insn_fetch(u16, 2, c->eip);
  1026. break;
  1027. case Src2One:
  1028. c->src2.bytes = 1;
  1029. c->src2.val = 1;
  1030. break;
  1031. }
  1032. /* Decode and fetch the destination operand: register or memory. */
  1033. switch (c->d & DstMask) {
  1034. case ImplicitOps:
  1035. /* Special instructions do their own operand decoding. */
  1036. return 0;
  1037. case DstReg:
  1038. decode_register_operand(&c->dst, c,
  1039. c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
  1040. break;
  1041. case DstMem:
  1042. if ((c->d & ModRM) && c->modrm_mod == 3) {
  1043. c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
  1044. c->dst.type = OP_REG;
  1045. c->dst.val = c->dst.orig_val = c->modrm_val;
  1046. c->dst.ptr = c->modrm_ptr;
  1047. break;
  1048. }
  1049. c->dst.type = OP_MEM;
  1050. break;
  1051. case DstAcc:
  1052. c->dst.type = OP_REG;
  1053. c->dst.bytes = c->op_bytes;
  1054. c->dst.ptr = &c->regs[VCPU_REGS_RAX];
  1055. switch (c->op_bytes) {
  1056. case 1:
  1057. c->dst.val = *(u8 *)c->dst.ptr;
  1058. break;
  1059. case 2:
  1060. c->dst.val = *(u16 *)c->dst.ptr;
  1061. break;
  1062. case 4:
  1063. c->dst.val = *(u32 *)c->dst.ptr;
  1064. break;
  1065. }
  1066. c->dst.orig_val = c->dst.val;
  1067. break;
  1068. }
  1069. if (c->rip_relative)
  1070. c->modrm_ea += c->eip;
  1071. done:
  1072. return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
  1073. }
  1074. static inline void emulate_push(struct x86_emulate_ctxt *ctxt)
  1075. {
  1076. struct decode_cache *c = &ctxt->decode;
  1077. c->dst.type = OP_MEM;
  1078. c->dst.bytes = c->op_bytes;
  1079. c->dst.val = c->src.val;
  1080. register_address_increment(c, &c->regs[VCPU_REGS_RSP], -c->op_bytes);
  1081. c->dst.ptr = (void *) register_address(c, ss_base(ctxt),
  1082. c->regs[VCPU_REGS_RSP]);
  1083. }
  1084. static int emulate_pop(struct x86_emulate_ctxt *ctxt,
  1085. struct x86_emulate_ops *ops,
  1086. void *dest, int len)
  1087. {
  1088. struct decode_cache *c = &ctxt->decode;
  1089. int rc;
  1090. rc = ops->read_emulated(register_address(c, ss_base(ctxt),
  1091. c->regs[VCPU_REGS_RSP]),
  1092. dest, len, ctxt->vcpu);
  1093. if (rc != 0)
  1094. return rc;
  1095. register_address_increment(c, &c->regs[VCPU_REGS_RSP], len);
  1096. return rc;
  1097. }
  1098. static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
  1099. struct x86_emulate_ops *ops)
  1100. {
  1101. struct decode_cache *c = &ctxt->decode;
  1102. int rc;
  1103. rc = emulate_pop(ctxt, ops, &c->dst.val, c->dst.bytes);
  1104. if (rc != 0)
  1105. return rc;
  1106. return 0;
  1107. }
  1108. static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
  1109. {
  1110. struct decode_cache *c = &ctxt->decode;
  1111. switch (c->modrm_reg) {
  1112. case 0: /* rol */
  1113. emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
  1114. break;
  1115. case 1: /* ror */
  1116. emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
  1117. break;
  1118. case 2: /* rcl */
  1119. emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
  1120. break;
  1121. case 3: /* rcr */
  1122. emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
  1123. break;
  1124. case 4: /* sal/shl */
  1125. case 6: /* sal/shl */
  1126. emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
  1127. break;
  1128. case 5: /* shr */
  1129. emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
  1130. break;
  1131. case 7: /* sar */
  1132. emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
  1133. break;
  1134. }
  1135. }
  1136. static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
  1137. struct x86_emulate_ops *ops)
  1138. {
  1139. struct decode_cache *c = &ctxt->decode;
  1140. int rc = 0;
  1141. switch (c->modrm_reg) {
  1142. case 0 ... 1: /* test */
  1143. emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
  1144. break;
  1145. case 2: /* not */
  1146. c->dst.val = ~c->dst.val;
  1147. break;
  1148. case 3: /* neg */
  1149. emulate_1op("neg", c->dst, ctxt->eflags);
  1150. break;
  1151. default:
  1152. DPRINTF("Cannot emulate %02x\n", c->b);
  1153. rc = X86EMUL_UNHANDLEABLE;
  1154. break;
  1155. }
  1156. return rc;
  1157. }
  1158. static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
  1159. struct x86_emulate_ops *ops)
  1160. {
  1161. struct decode_cache *c = &ctxt->decode;
  1162. switch (c->modrm_reg) {
  1163. case 0: /* inc */
  1164. emulate_1op("inc", c->dst, ctxt->eflags);
  1165. break;
  1166. case 1: /* dec */
  1167. emulate_1op("dec", c->dst, ctxt->eflags);
  1168. break;
  1169. case 2: /* call near abs */ {
  1170. long int old_eip;
  1171. old_eip = c->eip;
  1172. c->eip = c->src.val;
  1173. c->src.val = old_eip;
  1174. emulate_push(ctxt);
  1175. break;
  1176. }
  1177. case 4: /* jmp abs */
  1178. c->eip = c->src.val;
  1179. break;
  1180. case 6: /* push */
  1181. emulate_push(ctxt);
  1182. break;
  1183. }
  1184. return 0;
  1185. }
  1186. static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
  1187. struct x86_emulate_ops *ops,
  1188. unsigned long memop)
  1189. {
  1190. struct decode_cache *c = &ctxt->decode;
  1191. u64 old, new;
  1192. int rc;
  1193. rc = ops->read_emulated(memop, &old, 8, ctxt->vcpu);
  1194. if (rc != 0)
  1195. return rc;
  1196. if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
  1197. ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
  1198. c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
  1199. c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
  1200. ctxt->eflags &= ~EFLG_ZF;
  1201. } else {
  1202. new = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
  1203. (u32) c->regs[VCPU_REGS_RBX];
  1204. rc = ops->cmpxchg_emulated(memop, &old, &new, 8, ctxt->vcpu);
  1205. if (rc != 0)
  1206. return rc;
  1207. ctxt->eflags |= EFLG_ZF;
  1208. }
  1209. return 0;
  1210. }
  1211. static int emulate_ret_far(struct x86_emulate_ctxt *ctxt,
  1212. struct x86_emulate_ops *ops)
  1213. {
  1214. struct decode_cache *c = &ctxt->decode;
  1215. int rc;
  1216. unsigned long cs;
  1217. rc = emulate_pop(ctxt, ops, &c->eip, c->op_bytes);
  1218. if (rc)
  1219. return rc;
  1220. if (c->op_bytes == 4)
  1221. c->eip = (u32)c->eip;
  1222. rc = emulate_pop(ctxt, ops, &cs, c->op_bytes);
  1223. if (rc)
  1224. return rc;
  1225. rc = kvm_load_segment_descriptor(ctxt->vcpu, (u16)cs, 1, VCPU_SREG_CS);
  1226. return rc;
  1227. }
  1228. static inline int writeback(struct x86_emulate_ctxt *ctxt,
  1229. struct x86_emulate_ops *ops)
  1230. {
  1231. int rc;
  1232. struct decode_cache *c = &ctxt->decode;
  1233. switch (c->dst.type) {
  1234. case OP_REG:
  1235. /* The 4-byte case *is* correct:
  1236. * in 64-bit mode we zero-extend.
  1237. */
  1238. switch (c->dst.bytes) {
  1239. case 1:
  1240. *(u8 *)c->dst.ptr = (u8)c->dst.val;
  1241. break;
  1242. case 2:
  1243. *(u16 *)c->dst.ptr = (u16)c->dst.val;
  1244. break;
  1245. case 4:
  1246. *c->dst.ptr = (u32)c->dst.val;
  1247. break; /* 64b: zero-ext */
  1248. case 8:
  1249. *c->dst.ptr = c->dst.val;
  1250. break;
  1251. }
  1252. break;
  1253. case OP_MEM:
  1254. if (c->lock_prefix)
  1255. rc = ops->cmpxchg_emulated(
  1256. (unsigned long)c->dst.ptr,
  1257. &c->dst.orig_val,
  1258. &c->dst.val,
  1259. c->dst.bytes,
  1260. ctxt->vcpu);
  1261. else
  1262. rc = ops->write_emulated(
  1263. (unsigned long)c->dst.ptr,
  1264. &c->dst.val,
  1265. c->dst.bytes,
  1266. ctxt->vcpu);
  1267. if (rc != 0)
  1268. return rc;
  1269. break;
  1270. case OP_NONE:
  1271. /* no writeback */
  1272. break;
  1273. default:
  1274. break;
  1275. }
  1276. return 0;
  1277. }
  1278. static void toggle_interruptibility(struct x86_emulate_ctxt *ctxt, u32 mask)
  1279. {
  1280. u32 int_shadow = kvm_x86_ops->get_interrupt_shadow(ctxt->vcpu, mask);
  1281. /*
  1282. * an sti; sti; sequence only disable interrupts for the first
  1283. * instruction. So, if the last instruction, be it emulated or
  1284. * not, left the system with the INT_STI flag enabled, it
  1285. * means that the last instruction is an sti. We should not
  1286. * leave the flag on in this case. The same goes for mov ss
  1287. */
  1288. if (!(int_shadow & mask))
  1289. ctxt->interruptibility = mask;
  1290. }
  1291. int
  1292. x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
  1293. {
  1294. unsigned long memop = 0;
  1295. u64 msr_data;
  1296. unsigned long saved_eip = 0;
  1297. struct decode_cache *c = &ctxt->decode;
  1298. unsigned int port;
  1299. int io_dir_in;
  1300. int rc = 0;
  1301. ctxt->interruptibility = 0;
  1302. /* Shadow copy of register state. Committed on successful emulation.
  1303. * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
  1304. * modify them.
  1305. */
  1306. memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
  1307. saved_eip = c->eip;
  1308. if (((c->d & ModRM) && (c->modrm_mod != 3)) || (c->d & MemAbs))
  1309. memop = c->modrm_ea;
  1310. if (c->rep_prefix && (c->d & String)) {
  1311. /* All REP prefixes have the same first termination condition */
  1312. if (c->regs[VCPU_REGS_RCX] == 0) {
  1313. kvm_rip_write(ctxt->vcpu, c->eip);
  1314. goto done;
  1315. }
  1316. /* The second termination condition only applies for REPE
  1317. * and REPNE. Test if the repeat string operation prefix is
  1318. * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
  1319. * corresponding termination condition according to:
  1320. * - if REPE/REPZ and ZF = 0 then done
  1321. * - if REPNE/REPNZ and ZF = 1 then done
  1322. */
  1323. if ((c->b == 0xa6) || (c->b == 0xa7) ||
  1324. (c->b == 0xae) || (c->b == 0xaf)) {
  1325. if ((c->rep_prefix == REPE_PREFIX) &&
  1326. ((ctxt->eflags & EFLG_ZF) == 0)) {
  1327. kvm_rip_write(ctxt->vcpu, c->eip);
  1328. goto done;
  1329. }
  1330. if ((c->rep_prefix == REPNE_PREFIX) &&
  1331. ((ctxt->eflags & EFLG_ZF) == EFLG_ZF)) {
  1332. kvm_rip_write(ctxt->vcpu, c->eip);
  1333. goto done;
  1334. }
  1335. }
  1336. c->regs[VCPU_REGS_RCX]--;
  1337. c->eip = kvm_rip_read(ctxt->vcpu);
  1338. }
  1339. if (c->src.type == OP_MEM) {
  1340. c->src.ptr = (unsigned long *)memop;
  1341. c->src.val = 0;
  1342. rc = ops->read_emulated((unsigned long)c->src.ptr,
  1343. &c->src.val,
  1344. c->src.bytes,
  1345. ctxt->vcpu);
  1346. if (rc != 0)
  1347. goto done;
  1348. c->src.orig_val = c->src.val;
  1349. }
  1350. if ((c->d & DstMask) == ImplicitOps)
  1351. goto special_insn;
  1352. if (c->dst.type == OP_MEM) {
  1353. c->dst.ptr = (unsigned long *)memop;
  1354. c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
  1355. c->dst.val = 0;
  1356. if (c->d & BitOp) {
  1357. unsigned long mask = ~(c->dst.bytes * 8 - 1);
  1358. c->dst.ptr = (void *)c->dst.ptr +
  1359. (c->src.val & mask) / 8;
  1360. }
  1361. if (!(c->d & Mov) &&
  1362. /* optimisation - avoid slow emulated read */
  1363. ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
  1364. &c->dst.val,
  1365. c->dst.bytes, ctxt->vcpu)) != 0))
  1366. goto done;
  1367. }
  1368. c->dst.orig_val = c->dst.val;
  1369. special_insn:
  1370. if (c->twobyte)
  1371. goto twobyte_insn;
  1372. switch (c->b) {
  1373. case 0x00 ... 0x05:
  1374. add: /* add */
  1375. emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
  1376. break;
  1377. case 0x08 ... 0x0d:
  1378. or: /* or */
  1379. emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
  1380. break;
  1381. case 0x10 ... 0x15:
  1382. adc: /* adc */
  1383. emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
  1384. break;
  1385. case 0x18 ... 0x1d:
  1386. sbb: /* sbb */
  1387. emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
  1388. break;
  1389. case 0x20 ... 0x25:
  1390. and: /* and */
  1391. emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
  1392. break;
  1393. case 0x28 ... 0x2d:
  1394. sub: /* sub */
  1395. emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
  1396. break;
  1397. case 0x30 ... 0x35:
  1398. xor: /* xor */
  1399. emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
  1400. break;
  1401. case 0x38 ... 0x3d:
  1402. cmp: /* cmp */
  1403. emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
  1404. break;
  1405. case 0x40 ... 0x47: /* inc r16/r32 */
  1406. emulate_1op("inc", c->dst, ctxt->eflags);
  1407. break;
  1408. case 0x48 ... 0x4f: /* dec r16/r32 */
  1409. emulate_1op("dec", c->dst, ctxt->eflags);
  1410. break;
  1411. case 0x50 ... 0x57: /* push reg */
  1412. emulate_push(ctxt);
  1413. break;
  1414. case 0x58 ... 0x5f: /* pop reg */
  1415. pop_instruction:
  1416. rc = emulate_pop(ctxt, ops, &c->dst.val, c->op_bytes);
  1417. if (rc != 0)
  1418. goto done;
  1419. break;
  1420. case 0x63: /* movsxd */
  1421. if (ctxt->mode != X86EMUL_MODE_PROT64)
  1422. goto cannot_emulate;
  1423. c->dst.val = (s32) c->src.val;
  1424. break;
  1425. case 0x68: /* push imm */
  1426. case 0x6a: /* push imm8 */
  1427. emulate_push(ctxt);
  1428. break;
  1429. case 0x6c: /* insb */
  1430. case 0x6d: /* insw/insd */
  1431. if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
  1432. 1,
  1433. (c->d & ByteOp) ? 1 : c->op_bytes,
  1434. c->rep_prefix ?
  1435. address_mask(c, c->regs[VCPU_REGS_RCX]) : 1,
  1436. (ctxt->eflags & EFLG_DF),
  1437. register_address(c, es_base(ctxt),
  1438. c->regs[VCPU_REGS_RDI]),
  1439. c->rep_prefix,
  1440. c->regs[VCPU_REGS_RDX]) == 0) {
  1441. c->eip = saved_eip;
  1442. return -1;
  1443. }
  1444. return 0;
  1445. case 0x6e: /* outsb */
  1446. case 0x6f: /* outsw/outsd */
  1447. if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
  1448. 0,
  1449. (c->d & ByteOp) ? 1 : c->op_bytes,
  1450. c->rep_prefix ?
  1451. address_mask(c, c->regs[VCPU_REGS_RCX]) : 1,
  1452. (ctxt->eflags & EFLG_DF),
  1453. register_address(c,
  1454. seg_override_base(ctxt, c),
  1455. c->regs[VCPU_REGS_RSI]),
  1456. c->rep_prefix,
  1457. c->regs[VCPU_REGS_RDX]) == 0) {
  1458. c->eip = saved_eip;
  1459. return -1;
  1460. }
  1461. return 0;
  1462. case 0x70 ... 0x7f: /* jcc (short) */
  1463. if (test_cc(c->b, ctxt->eflags))
  1464. jmp_rel(c, c->src.val);
  1465. break;
  1466. case 0x80 ... 0x83: /* Grp1 */
  1467. switch (c->modrm_reg) {
  1468. case 0:
  1469. goto add;
  1470. case 1:
  1471. goto or;
  1472. case 2:
  1473. goto adc;
  1474. case 3:
  1475. goto sbb;
  1476. case 4:
  1477. goto and;
  1478. case 5:
  1479. goto sub;
  1480. case 6:
  1481. goto xor;
  1482. case 7:
  1483. goto cmp;
  1484. }
  1485. break;
  1486. case 0x84 ... 0x85:
  1487. emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
  1488. break;
  1489. case 0x86 ... 0x87: /* xchg */
  1490. xchg:
  1491. /* Write back the register source. */
  1492. switch (c->dst.bytes) {
  1493. case 1:
  1494. *(u8 *) c->src.ptr = (u8) c->dst.val;
  1495. break;
  1496. case 2:
  1497. *(u16 *) c->src.ptr = (u16) c->dst.val;
  1498. break;
  1499. case 4:
  1500. *c->src.ptr = (u32) c->dst.val;
  1501. break; /* 64b reg: zero-extend */
  1502. case 8:
  1503. *c->src.ptr = c->dst.val;
  1504. break;
  1505. }
  1506. /*
  1507. * Write back the memory destination with implicit LOCK
  1508. * prefix.
  1509. */
  1510. c->dst.val = c->src.val;
  1511. c->lock_prefix = 1;
  1512. break;
  1513. case 0x88 ... 0x8b: /* mov */
  1514. goto mov;
  1515. case 0x8c: { /* mov r/m, sreg */
  1516. struct kvm_segment segreg;
  1517. if (c->modrm_reg <= 5)
  1518. kvm_get_segment(ctxt->vcpu, &segreg, c->modrm_reg);
  1519. else {
  1520. printk(KERN_INFO "0x8c: Invalid segreg in modrm byte 0x%02x\n",
  1521. c->modrm);
  1522. goto cannot_emulate;
  1523. }
  1524. c->dst.val = segreg.selector;
  1525. break;
  1526. }
  1527. case 0x8d: /* lea r16/r32, m */
  1528. c->dst.val = c->modrm_ea;
  1529. break;
  1530. case 0x8e: { /* mov seg, r/m16 */
  1531. uint16_t sel;
  1532. int type_bits;
  1533. int err;
  1534. sel = c->src.val;
  1535. if (c->modrm_reg == VCPU_SREG_SS)
  1536. toggle_interruptibility(ctxt, X86_SHADOW_INT_MOV_SS);
  1537. if (c->modrm_reg <= 5) {
  1538. type_bits = (c->modrm_reg == 1) ? 9 : 1;
  1539. err = kvm_load_segment_descriptor(ctxt->vcpu, sel,
  1540. type_bits, c->modrm_reg);
  1541. } else {
  1542. printk(KERN_INFO "Invalid segreg in modrm byte 0x%02x\n",
  1543. c->modrm);
  1544. goto cannot_emulate;
  1545. }
  1546. if (err < 0)
  1547. goto cannot_emulate;
  1548. c->dst.type = OP_NONE; /* Disable writeback. */
  1549. break;
  1550. }
  1551. case 0x8f: /* pop (sole member of Grp1a) */
  1552. rc = emulate_grp1a(ctxt, ops);
  1553. if (rc != 0)
  1554. goto done;
  1555. break;
  1556. case 0x90: /* nop / xchg r8,rax */
  1557. if (!(c->rex_prefix & 1)) { /* nop */
  1558. c->dst.type = OP_NONE;
  1559. break;
  1560. }
  1561. case 0x91 ... 0x97: /* xchg reg,rax */
  1562. c->src.type = c->dst.type = OP_REG;
  1563. c->src.bytes = c->dst.bytes = c->op_bytes;
  1564. c->src.ptr = (unsigned long *) &c->regs[VCPU_REGS_RAX];
  1565. c->src.val = *(c->src.ptr);
  1566. goto xchg;
  1567. case 0x9c: /* pushf */
  1568. c->src.val = (unsigned long) ctxt->eflags;
  1569. emulate_push(ctxt);
  1570. break;
  1571. case 0x9d: /* popf */
  1572. c->dst.type = OP_REG;
  1573. c->dst.ptr = (unsigned long *) &ctxt->eflags;
  1574. c->dst.bytes = c->op_bytes;
  1575. goto pop_instruction;
  1576. case 0xa0 ... 0xa1: /* mov */
  1577. c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
  1578. c->dst.val = c->src.val;
  1579. break;
  1580. case 0xa2 ... 0xa3: /* mov */
  1581. c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
  1582. break;
  1583. case 0xa4 ... 0xa5: /* movs */
  1584. c->dst.type = OP_MEM;
  1585. c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
  1586. c->dst.ptr = (unsigned long *)register_address(c,
  1587. es_base(ctxt),
  1588. c->regs[VCPU_REGS_RDI]);
  1589. if ((rc = ops->read_emulated(register_address(c,
  1590. seg_override_base(ctxt, c),
  1591. c->regs[VCPU_REGS_RSI]),
  1592. &c->dst.val,
  1593. c->dst.bytes, ctxt->vcpu)) != 0)
  1594. goto done;
  1595. register_address_increment(c, &c->regs[VCPU_REGS_RSI],
  1596. (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
  1597. : c->dst.bytes);
  1598. register_address_increment(c, &c->regs[VCPU_REGS_RDI],
  1599. (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
  1600. : c->dst.bytes);
  1601. break;
  1602. case 0xa6 ... 0xa7: /* cmps */
  1603. c->src.type = OP_NONE; /* Disable writeback. */
  1604. c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
  1605. c->src.ptr = (unsigned long *)register_address(c,
  1606. seg_override_base(ctxt, c),
  1607. c->regs[VCPU_REGS_RSI]);
  1608. if ((rc = ops->read_emulated((unsigned long)c->src.ptr,
  1609. &c->src.val,
  1610. c->src.bytes,
  1611. ctxt->vcpu)) != 0)
  1612. goto done;
  1613. c->dst.type = OP_NONE; /* Disable writeback. */
  1614. c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
  1615. c->dst.ptr = (unsigned long *)register_address(c,
  1616. es_base(ctxt),
  1617. c->regs[VCPU_REGS_RDI]);
  1618. if ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
  1619. &c->dst.val,
  1620. c->dst.bytes,
  1621. ctxt->vcpu)) != 0)
  1622. goto done;
  1623. DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c->src.ptr, c->dst.ptr);
  1624. emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
  1625. register_address_increment(c, &c->regs[VCPU_REGS_RSI],
  1626. (ctxt->eflags & EFLG_DF) ? -c->src.bytes
  1627. : c->src.bytes);
  1628. register_address_increment(c, &c->regs[VCPU_REGS_RDI],
  1629. (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
  1630. : c->dst.bytes);
  1631. break;
  1632. case 0xaa ... 0xab: /* stos */
  1633. c->dst.type = OP_MEM;
  1634. c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
  1635. c->dst.ptr = (unsigned long *)register_address(c,
  1636. es_base(ctxt),
  1637. c->regs[VCPU_REGS_RDI]);
  1638. c->dst.val = c->regs[VCPU_REGS_RAX];
  1639. register_address_increment(c, &c->regs[VCPU_REGS_RDI],
  1640. (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
  1641. : c->dst.bytes);
  1642. break;
  1643. case 0xac ... 0xad: /* lods */
  1644. c->dst.type = OP_REG;
  1645. c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
  1646. c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
  1647. if ((rc = ops->read_emulated(register_address(c,
  1648. seg_override_base(ctxt, c),
  1649. c->regs[VCPU_REGS_RSI]),
  1650. &c->dst.val,
  1651. c->dst.bytes,
  1652. ctxt->vcpu)) != 0)
  1653. goto done;
  1654. register_address_increment(c, &c->regs[VCPU_REGS_RSI],
  1655. (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
  1656. : c->dst.bytes);
  1657. break;
  1658. case 0xae ... 0xaf: /* scas */
  1659. DPRINTF("Urk! I don't handle SCAS.\n");
  1660. goto cannot_emulate;
  1661. case 0xb0 ... 0xbf: /* mov r, imm */
  1662. goto mov;
  1663. case 0xc0 ... 0xc1:
  1664. emulate_grp2(ctxt);
  1665. break;
  1666. case 0xc3: /* ret */
  1667. c->dst.type = OP_REG;
  1668. c->dst.ptr = &c->eip;
  1669. c->dst.bytes = c->op_bytes;
  1670. goto pop_instruction;
  1671. case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
  1672. mov:
  1673. c->dst.val = c->src.val;
  1674. break;
  1675. case 0xcb: /* ret far */
  1676. rc = emulate_ret_far(ctxt, ops);
  1677. if (rc)
  1678. goto done;
  1679. break;
  1680. case 0xd0 ... 0xd1: /* Grp2 */
  1681. c->src.val = 1;
  1682. emulate_grp2(ctxt);
  1683. break;
  1684. case 0xd2 ... 0xd3: /* Grp2 */
  1685. c->src.val = c->regs[VCPU_REGS_RCX];
  1686. emulate_grp2(ctxt);
  1687. break;
  1688. case 0xe4: /* inb */
  1689. case 0xe5: /* in */
  1690. port = c->src.val;
  1691. io_dir_in = 1;
  1692. goto do_io;
  1693. case 0xe6: /* outb */
  1694. case 0xe7: /* out */
  1695. port = c->src.val;
  1696. io_dir_in = 0;
  1697. goto do_io;
  1698. case 0xe8: /* call (near) */ {
  1699. long int rel = c->src.val;
  1700. c->src.val = (unsigned long) c->eip;
  1701. jmp_rel(c, rel);
  1702. emulate_push(ctxt);
  1703. break;
  1704. }
  1705. case 0xe9: /* jmp rel */
  1706. goto jmp;
  1707. case 0xea: /* jmp far */
  1708. if (kvm_load_segment_descriptor(ctxt->vcpu, c->src2.val, 9,
  1709. VCPU_SREG_CS) < 0) {
  1710. DPRINTF("jmp far: Failed to load CS descriptor\n");
  1711. goto cannot_emulate;
  1712. }
  1713. c->eip = c->src.val;
  1714. break;
  1715. case 0xeb:
  1716. jmp: /* jmp rel short */
  1717. jmp_rel(c, c->src.val);
  1718. c->dst.type = OP_NONE; /* Disable writeback. */
  1719. break;
  1720. case 0xec: /* in al,dx */
  1721. case 0xed: /* in (e/r)ax,dx */
  1722. port = c->regs[VCPU_REGS_RDX];
  1723. io_dir_in = 1;
  1724. goto do_io;
  1725. case 0xee: /* out al,dx */
  1726. case 0xef: /* out (e/r)ax,dx */
  1727. port = c->regs[VCPU_REGS_RDX];
  1728. io_dir_in = 0;
  1729. do_io: if (kvm_emulate_pio(ctxt->vcpu, NULL, io_dir_in,
  1730. (c->d & ByteOp) ? 1 : c->op_bytes,
  1731. port) != 0) {
  1732. c->eip = saved_eip;
  1733. goto cannot_emulate;
  1734. }
  1735. break;
  1736. case 0xf4: /* hlt */
  1737. ctxt->vcpu->arch.halt_request = 1;
  1738. break;
  1739. case 0xf5: /* cmc */
  1740. /* complement carry flag from eflags reg */
  1741. ctxt->eflags ^= EFLG_CF;
  1742. c->dst.type = OP_NONE; /* Disable writeback. */
  1743. break;
  1744. case 0xf6 ... 0xf7: /* Grp3 */
  1745. rc = emulate_grp3(ctxt, ops);
  1746. if (rc != 0)
  1747. goto done;
  1748. break;
  1749. case 0xf8: /* clc */
  1750. ctxt->eflags &= ~EFLG_CF;
  1751. c->dst.type = OP_NONE; /* Disable writeback. */
  1752. break;
  1753. case 0xfa: /* cli */
  1754. ctxt->eflags &= ~X86_EFLAGS_IF;
  1755. c->dst.type = OP_NONE; /* Disable writeback. */
  1756. break;
  1757. case 0xfb: /* sti */
  1758. toggle_interruptibility(ctxt, X86_SHADOW_INT_STI);
  1759. ctxt->eflags |= X86_EFLAGS_IF;
  1760. c->dst.type = OP_NONE; /* Disable writeback. */
  1761. break;
  1762. case 0xfc: /* cld */
  1763. ctxt->eflags &= ~EFLG_DF;
  1764. c->dst.type = OP_NONE; /* Disable writeback. */
  1765. break;
  1766. case 0xfd: /* std */
  1767. ctxt->eflags |= EFLG_DF;
  1768. c->dst.type = OP_NONE; /* Disable writeback. */
  1769. break;
  1770. case 0xfe ... 0xff: /* Grp4/Grp5 */
  1771. rc = emulate_grp45(ctxt, ops);
  1772. if (rc != 0)
  1773. goto done;
  1774. break;
  1775. }
  1776. writeback:
  1777. rc = writeback(ctxt, ops);
  1778. if (rc != 0)
  1779. goto done;
  1780. /* Commit shadow register state. */
  1781. memcpy(ctxt->vcpu->arch.regs, c->regs, sizeof c->regs);
  1782. kvm_rip_write(ctxt->vcpu, c->eip);
  1783. done:
  1784. if (rc == X86EMUL_UNHANDLEABLE) {
  1785. c->eip = saved_eip;
  1786. return -1;
  1787. }
  1788. return 0;
  1789. twobyte_insn:
  1790. switch (c->b) {
  1791. case 0x01: /* lgdt, lidt, lmsw */
  1792. switch (c->modrm_reg) {
  1793. u16 size;
  1794. unsigned long address;
  1795. case 0: /* vmcall */
  1796. if (c->modrm_mod != 3 || c->modrm_rm != 1)
  1797. goto cannot_emulate;
  1798. rc = kvm_fix_hypercall(ctxt->vcpu);
  1799. if (rc)
  1800. goto done;
  1801. /* Let the processor re-execute the fixed hypercall */
  1802. c->eip = kvm_rip_read(ctxt->vcpu);
  1803. /* Disable writeback. */
  1804. c->dst.type = OP_NONE;
  1805. break;
  1806. case 2: /* lgdt */
  1807. rc = read_descriptor(ctxt, ops, c->src.ptr,
  1808. &size, &address, c->op_bytes);
  1809. if (rc)
  1810. goto done;
  1811. realmode_lgdt(ctxt->vcpu, size, address);
  1812. /* Disable writeback. */
  1813. c->dst.type = OP_NONE;
  1814. break;
  1815. case 3: /* lidt/vmmcall */
  1816. if (c->modrm_mod == 3) {
  1817. switch (c->modrm_rm) {
  1818. case 1:
  1819. rc = kvm_fix_hypercall(ctxt->vcpu);
  1820. if (rc)
  1821. goto done;
  1822. break;
  1823. default:
  1824. goto cannot_emulate;
  1825. }
  1826. } else {
  1827. rc = read_descriptor(ctxt, ops, c->src.ptr,
  1828. &size, &address,
  1829. c->op_bytes);
  1830. if (rc)
  1831. goto done;
  1832. realmode_lidt(ctxt->vcpu, size, address);
  1833. }
  1834. /* Disable writeback. */
  1835. c->dst.type = OP_NONE;
  1836. break;
  1837. case 4: /* smsw */
  1838. c->dst.bytes = 2;
  1839. c->dst.val = realmode_get_cr(ctxt->vcpu, 0);
  1840. break;
  1841. case 6: /* lmsw */
  1842. realmode_lmsw(ctxt->vcpu, (u16)c->src.val,
  1843. &ctxt->eflags);
  1844. c->dst.type = OP_NONE;
  1845. break;
  1846. case 7: /* invlpg*/
  1847. emulate_invlpg(ctxt->vcpu, memop);
  1848. /* Disable writeback. */
  1849. c->dst.type = OP_NONE;
  1850. break;
  1851. default:
  1852. goto cannot_emulate;
  1853. }
  1854. break;
  1855. case 0x05: /* syscall */
  1856. goto cannot_emulate;
  1857. break;
  1858. case 0x06:
  1859. emulate_clts(ctxt->vcpu);
  1860. c->dst.type = OP_NONE;
  1861. break;
  1862. case 0x08: /* invd */
  1863. case 0x09: /* wbinvd */
  1864. case 0x0d: /* GrpP (prefetch) */
  1865. case 0x18: /* Grp16 (prefetch/nop) */
  1866. c->dst.type = OP_NONE;
  1867. break;
  1868. case 0x20: /* mov cr, reg */
  1869. if (c->modrm_mod != 3)
  1870. goto cannot_emulate;
  1871. c->regs[c->modrm_rm] =
  1872. realmode_get_cr(ctxt->vcpu, c->modrm_reg);
  1873. c->dst.type = OP_NONE; /* no writeback */
  1874. break;
  1875. case 0x21: /* mov from dr to reg */
  1876. if (c->modrm_mod != 3)
  1877. goto cannot_emulate;
  1878. rc = emulator_get_dr(ctxt, c->modrm_reg, &c->regs[c->modrm_rm]);
  1879. if (rc)
  1880. goto cannot_emulate;
  1881. c->dst.type = OP_NONE; /* no writeback */
  1882. break;
  1883. case 0x22: /* mov reg, cr */
  1884. if (c->modrm_mod != 3)
  1885. goto cannot_emulate;
  1886. realmode_set_cr(ctxt->vcpu,
  1887. c->modrm_reg, c->modrm_val, &ctxt->eflags);
  1888. c->dst.type = OP_NONE;
  1889. break;
  1890. case 0x23: /* mov from reg to dr */
  1891. if (c->modrm_mod != 3)
  1892. goto cannot_emulate;
  1893. rc = emulator_set_dr(ctxt, c->modrm_reg,
  1894. c->regs[c->modrm_rm]);
  1895. if (rc)
  1896. goto cannot_emulate;
  1897. c->dst.type = OP_NONE; /* no writeback */
  1898. break;
  1899. case 0x30:
  1900. /* wrmsr */
  1901. msr_data = (u32)c->regs[VCPU_REGS_RAX]
  1902. | ((u64)c->regs[VCPU_REGS_RDX] << 32);
  1903. rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
  1904. if (rc) {
  1905. kvm_inject_gp(ctxt->vcpu, 0);
  1906. c->eip = kvm_rip_read(ctxt->vcpu);
  1907. }
  1908. rc = X86EMUL_CONTINUE;
  1909. c->dst.type = OP_NONE;
  1910. break;
  1911. case 0x32:
  1912. /* rdmsr */
  1913. rc = kvm_get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data);
  1914. if (rc) {
  1915. kvm_inject_gp(ctxt->vcpu, 0);
  1916. c->eip = kvm_rip_read(ctxt->vcpu);
  1917. } else {
  1918. c->regs[VCPU_REGS_RAX] = (u32)msr_data;
  1919. c->regs[VCPU_REGS_RDX] = msr_data >> 32;
  1920. }
  1921. rc = X86EMUL_CONTINUE;
  1922. c->dst.type = OP_NONE;
  1923. break;
  1924. case 0x34: /* sysenter */
  1925. goto cannot_emulate;
  1926. break;
  1927. case 0x35: /* sysexit */
  1928. goto cannot_emulate;
  1929. break;
  1930. case 0x40 ... 0x4f: /* cmov */
  1931. c->dst.val = c->dst.orig_val = c->src.val;
  1932. if (!test_cc(c->b, ctxt->eflags))
  1933. c->dst.type = OP_NONE; /* no writeback */
  1934. break;
  1935. case 0x80 ... 0x8f: /* jnz rel, etc*/
  1936. if (test_cc(c->b, ctxt->eflags))
  1937. jmp_rel(c, c->src.val);
  1938. c->dst.type = OP_NONE;
  1939. break;
  1940. case 0xa3:
  1941. bt: /* bt */
  1942. c->dst.type = OP_NONE;
  1943. /* only subword offset */
  1944. c->src.val &= (c->dst.bytes << 3) - 1;
  1945. emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
  1946. break;
  1947. case 0xa4: /* shld imm8, r, r/m */
  1948. case 0xa5: /* shld cl, r, r/m */
  1949. emulate_2op_cl("shld", c->src2, c->src, c->dst, ctxt->eflags);
  1950. break;
  1951. case 0xab:
  1952. bts: /* bts */
  1953. /* only subword offset */
  1954. c->src.val &= (c->dst.bytes << 3) - 1;
  1955. emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
  1956. break;
  1957. case 0xac: /* shrd imm8, r, r/m */
  1958. case 0xad: /* shrd cl, r, r/m */
  1959. emulate_2op_cl("shrd", c->src2, c->src, c->dst, ctxt->eflags);
  1960. break;
  1961. case 0xae: /* clflush */
  1962. break;
  1963. case 0xb0 ... 0xb1: /* cmpxchg */
  1964. /*
  1965. * Save real source value, then compare EAX against
  1966. * destination.
  1967. */
  1968. c->src.orig_val = c->src.val;
  1969. c->src.val = c->regs[VCPU_REGS_RAX];
  1970. emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
  1971. if (ctxt->eflags & EFLG_ZF) {
  1972. /* Success: write back to memory. */
  1973. c->dst.val = c->src.orig_val;
  1974. } else {
  1975. /* Failure: write the value we saw to EAX. */
  1976. c->dst.type = OP_REG;
  1977. c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
  1978. }
  1979. break;
  1980. case 0xb3:
  1981. btr: /* btr */
  1982. /* only subword offset */
  1983. c->src.val &= (c->dst.bytes << 3) - 1;
  1984. emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
  1985. break;
  1986. case 0xb6 ... 0xb7: /* movzx */
  1987. c->dst.bytes = c->op_bytes;
  1988. c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
  1989. : (u16) c->src.val;
  1990. break;
  1991. case 0xba: /* Grp8 */
  1992. switch (c->modrm_reg & 3) {
  1993. case 0:
  1994. goto bt;
  1995. case 1:
  1996. goto bts;
  1997. case 2:
  1998. goto btr;
  1999. case 3:
  2000. goto btc;
  2001. }
  2002. break;
  2003. case 0xbb:
  2004. btc: /* btc */
  2005. /* only subword offset */
  2006. c->src.val &= (c->dst.bytes << 3) - 1;
  2007. emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
  2008. break;
  2009. case 0xbe ... 0xbf: /* movsx */
  2010. c->dst.bytes = c->op_bytes;
  2011. c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
  2012. (s16) c->src.val;
  2013. break;
  2014. case 0xc3: /* movnti */
  2015. c->dst.bytes = c->op_bytes;
  2016. c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
  2017. (u64) c->src.val;
  2018. break;
  2019. case 0xc7: /* Grp9 (cmpxchg8b) */
  2020. rc = emulate_grp9(ctxt, ops, memop);
  2021. if (rc != 0)
  2022. goto done;
  2023. c->dst.type = OP_NONE;
  2024. break;
  2025. }
  2026. goto writeback;
  2027. cannot_emulate:
  2028. DPRINTF("Cannot emulate %02x\n", c->b);
  2029. c->eip = saved_eip;
  2030. return -1;
  2031. }