1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf(_f , ## _a)
28 #include <linux/kvm_host.h>
29 #define DPRINTF(x...) do {} while (0)
31 #include <linux/module.h>
32 #include <asm/kvm_x86_emulate.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
65 #define MemAbs (1<<9) /* Memory operand is absolute displacement */
66 #define String (1<<10) /* String instruction (rep capable) */
67 #define Stack (1<<11) /* Stack instruction (push/pop) */
68 #define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
69 #define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
70 #define GroupMask 0xff /* Group number stored in bits 0:7 */
73 Group1_80, Group1_81, Group1_82, Group1_83,
74 Group1A, Group3_Byte, Group3, Group4, Group5, Group7,
77 static u16 opcode_table[256] = {
79 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
80 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
83 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
84 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
87 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
88 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
91 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
92 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
95 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
96 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
97 SrcImmByte, SrcImm, 0, 0,
99 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
100 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
103 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
104 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
107 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
108 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
111 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
113 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
115 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
116 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
118 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
119 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
121 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
124 0, 0, ImplicitOps | Mov | Stack, 0,
125 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
126 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
128 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
129 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
131 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
132 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
134 Group | Group1_80, Group | Group1_81,
135 Group | Group1_82, Group | Group1_83,
136 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
137 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
139 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
140 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
141 DstMem | SrcReg | ModRM | Mov, ModRM | DstReg,
142 DstReg | SrcMem | ModRM | Mov, Group | Group1A,
144 0, 0, 0, 0, 0, 0, 0, 0,
145 0, 0, 0, 0, ImplicitOps | Stack, ImplicitOps | Stack, 0, 0,
147 ByteOp | DstReg | SrcMem | Mov | MemAbs, DstReg | SrcMem | Mov | MemAbs,
148 ByteOp | DstMem | SrcReg | Mov | MemAbs, DstMem | SrcReg | Mov | MemAbs,
149 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
150 ByteOp | ImplicitOps | String, ImplicitOps | String,
152 0, 0, ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
153 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
154 ByteOp | ImplicitOps | String, ImplicitOps | String,
156 0, 0, 0, 0, 0, 0, 0, 0,
157 DstReg | SrcImm | Mov, 0, 0, 0, 0, 0, 0, 0,
159 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
160 0, ImplicitOps | Stack, 0, 0,
161 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
163 0, 0, 0, 0, 0, 0, 0, 0,
165 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
166 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
169 0, 0, 0, 0, 0, 0, 0, 0,
171 0, 0, 0, 0, 0, 0, 0, 0,
173 ImplicitOps | Stack, SrcImm | ImplicitOps,
174 ImplicitOps, SrcImmByte | ImplicitOps,
178 ImplicitOps, ImplicitOps, Group | Group3_Byte, Group | Group3,
180 ImplicitOps, 0, ImplicitOps, ImplicitOps,
181 0, 0, Group | Group4, Group | Group5,
184 static u16 twobyte_table[256] = {
186 0, Group | GroupDual | Group7, 0, 0, 0, 0, ImplicitOps, 0,
187 ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
189 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
191 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
192 0, 0, 0, 0, 0, 0, 0, 0,
194 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
196 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
197 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
198 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
199 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
201 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
202 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
203 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
204 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
206 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
208 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
210 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
212 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
213 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
214 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
215 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
217 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
219 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
221 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
223 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
224 DstMem | SrcReg | ModRM | BitOp,
225 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
226 DstReg | SrcMem16 | ModRM | Mov,
228 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
229 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
230 DstReg | SrcMem16 | ModRM | Mov,
232 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
233 0, 0, 0, 0, 0, 0, 0, 0,
235 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
237 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
239 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
242 static u16 group_table[] = {
244 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
245 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
246 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
247 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
249 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
250 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
251 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
252 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
254 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
255 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
256 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
257 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
259 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
260 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
261 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
262 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
264 DstMem | SrcNone | ModRM | Mov | Stack, 0, 0, 0, 0, 0, 0, 0,
266 ByteOp | SrcImm | DstMem | ModRM, 0,
267 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
270 DstMem | SrcImm | ModRM | SrcImm, 0,
271 DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
274 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
277 DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM, 0, 0,
278 SrcMem | ModRM, 0, SrcMem | ModRM | Stack, 0,
280 0, 0, ModRM | SrcMem, ModRM | SrcMem,
281 SrcNone | ModRM | DstMem | Mov, 0,
282 SrcMem16 | ModRM | Mov, SrcMem | ModRM | ByteOp,
285 static u16 group2_table[] = {
287 SrcNone | ModRM, 0, 0, 0,
288 SrcNone | ModRM | DstMem | Mov, 0,
289 SrcMem16 | ModRM | Mov, 0,
292 /* EFLAGS bit definitions. */
293 #define EFLG_OF (1<<11)
294 #define EFLG_DF (1<<10)
295 #define EFLG_SF (1<<7)
296 #define EFLG_ZF (1<<6)
297 #define EFLG_AF (1<<4)
298 #define EFLG_PF (1<<2)
299 #define EFLG_CF (1<<0)
302 * Instruction emulation:
303 * Most instructions are emulated directly via a fragment of inline assembly
304 * code. This allows us to save/restore EFLAGS and thus very easily pick up
305 * any modified flags.
308 #if defined(CONFIG_X86_64)
309 #define _LO32 "k" /* force 32-bit operand */
310 #define _STK "%%rsp" /* stack pointer */
311 #elif defined(__i386__)
312 #define _LO32 "" /* force 32-bit operand */
313 #define _STK "%%esp" /* stack pointer */
317 * These EFLAGS bits are restored from saved value during emulation, and
318 * any changes are written back to the saved value after emulation.
320 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
322 /* Before executing instruction: restore necessary bits in EFLAGS. */
323 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
324 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
325 "movl %"_sav",%"_LO32 _tmp"; " \
328 "movl %"_msk",%"_LO32 _tmp"; " \
329 "andl %"_LO32 _tmp",("_STK"); " \
331 "notl %"_LO32 _tmp"; " \
332 "andl %"_LO32 _tmp",("_STK"); " \
333 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
335 "orl %"_LO32 _tmp",("_STK"); " \
339 /* After executing instruction: write-back necessary bits in EFLAGS. */
340 #define _POST_EFLAGS(_sav, _msk, _tmp) \
341 /* _sav |= EFLAGS & _msk; */ \
344 "andl %"_msk",%"_LO32 _tmp"; " \
345 "orl %"_LO32 _tmp",%"_sav"; "
347 /* Raw emulation: instruction has two explicit operands. */
348 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
350 unsigned long _tmp; \
352 switch ((_dst).bytes) { \
354 __asm__ __volatile__ ( \
355 _PRE_EFLAGS("0", "4", "2") \
356 _op"w %"_wx"3,%1; " \
357 _POST_EFLAGS("0", "4", "2") \
358 : "=m" (_eflags), "=m" ((_dst).val), \
360 : _wy ((_src).val), "i" (EFLAGS_MASK)); \
363 __asm__ __volatile__ ( \
364 _PRE_EFLAGS("0", "4", "2") \
365 _op"l %"_lx"3,%1; " \
366 _POST_EFLAGS("0", "4", "2") \
367 : "=m" (_eflags), "=m" ((_dst).val), \
369 : _ly ((_src).val), "i" (EFLAGS_MASK)); \
372 __emulate_2op_8byte(_op, _src, _dst, \
373 _eflags, _qx, _qy); \
378 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
380 unsigned long __tmp; \
381 switch ((_dst).bytes) { \
383 __asm__ __volatile__ ( \
384 _PRE_EFLAGS("0", "4", "2") \
385 _op"b %"_bx"3,%1; " \
386 _POST_EFLAGS("0", "4", "2") \
387 : "=m" (_eflags), "=m" ((_dst).val), \
389 : _by ((_src).val), "i" (EFLAGS_MASK)); \
392 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
393 _wx, _wy, _lx, _ly, _qx, _qy); \
398 /* Source operand is byte-sized and may be restricted to just %cl. */
399 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
400 __emulate_2op(_op, _src, _dst, _eflags, \
401 "b", "c", "b", "c", "b", "c", "b", "c")
403 /* Source operand is byte, word, long or quad sized. */
404 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
405 __emulate_2op(_op, _src, _dst, _eflags, \
406 "b", "q", "w", "r", _LO32, "r", "", "r")
408 /* Source operand is word, long or quad sized. */
409 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
410 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
411 "w", "r", _LO32, "r", "", "r")
413 /* Instruction has only one explicit operand (no source operand). */
414 #define emulate_1op(_op, _dst, _eflags) \
416 unsigned long _tmp; \
418 switch ((_dst).bytes) { \
420 __asm__ __volatile__ ( \
421 _PRE_EFLAGS("0", "3", "2") \
423 _POST_EFLAGS("0", "3", "2") \
424 : "=m" (_eflags), "=m" ((_dst).val), \
426 : "i" (EFLAGS_MASK)); \
429 __asm__ __volatile__ ( \
430 _PRE_EFLAGS("0", "3", "2") \
432 _POST_EFLAGS("0", "3", "2") \
433 : "=m" (_eflags), "=m" ((_dst).val), \
435 : "i" (EFLAGS_MASK)); \
438 __asm__ __volatile__ ( \
439 _PRE_EFLAGS("0", "3", "2") \
441 _POST_EFLAGS("0", "3", "2") \
442 : "=m" (_eflags), "=m" ((_dst).val), \
444 : "i" (EFLAGS_MASK)); \
447 __emulate_1op_8byte(_op, _dst, _eflags); \
452 /* Emulate an instruction with quadword operands (x86/64 only). */
453 #if defined(CONFIG_X86_64)
454 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
456 __asm__ __volatile__ ( \
457 _PRE_EFLAGS("0", "4", "2") \
458 _op"q %"_qx"3,%1; " \
459 _POST_EFLAGS("0", "4", "2") \
460 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
461 : _qy ((_src).val), "i" (EFLAGS_MASK)); \
464 #define __emulate_1op_8byte(_op, _dst, _eflags) \
466 __asm__ __volatile__ ( \
467 _PRE_EFLAGS("0", "3", "2") \
469 _POST_EFLAGS("0", "3", "2") \
470 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
471 : "i" (EFLAGS_MASK)); \
474 #elif defined(__i386__)
475 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
476 #define __emulate_1op_8byte(_op, _dst, _eflags)
477 #endif /* __i386__ */
479 /* Fetch next part of the instruction being emulated. */
480 #define insn_fetch(_type, _size, _eip) \
481 ({ unsigned long _x; \
482 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
489 static inline unsigned long ad_mask(struct decode_cache *c)
491 return (1UL << (c->ad_bytes << 3)) - 1;
494 /* Access/update address held in a register, based on addressing mode. */
495 static inline unsigned long
496 address_mask(struct decode_cache *c, unsigned long reg)
498 if (c->ad_bytes == sizeof(unsigned long))
501 return reg & ad_mask(c);
504 static inline unsigned long
505 register_address(struct decode_cache *c, unsigned long base, unsigned long reg)
507 return base + address_mask(c, reg);
511 register_address_increment(struct decode_cache *c, unsigned long *reg, int inc)
513 if (c->ad_bytes == sizeof(unsigned long))
516 *reg = (*reg & ~ad_mask(c)) | ((*reg + inc) & ad_mask(c));
519 static inline void jmp_rel(struct decode_cache *c, int rel)
521 register_address_increment(c, &c->eip, rel);
524 static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
525 struct x86_emulate_ops *ops,
526 unsigned long linear, u8 *dest)
528 struct fetch_cache *fc = &ctxt->decode.fetch;
532 if (linear < fc->start || linear >= fc->end) {
533 size = min(15UL, PAGE_SIZE - offset_in_page(linear));
534 rc = ops->read_std(linear, fc->data, size, ctxt->vcpu);
538 fc->end = linear + size;
540 *dest = fc->data[linear - fc->start];
544 static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
545 struct x86_emulate_ops *ops,
546 unsigned long eip, void *dest, unsigned size)
550 eip += ctxt->cs_base;
552 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
560 * Given the 'reg' portion of a ModRM byte, and a register block, return a
561 * pointer into the block that addresses the relevant register.
562 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
564 static void *decode_register(u8 modrm_reg, unsigned long *regs,
569 p = ®s[modrm_reg];
570 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
571 p = (unsigned char *)®s[modrm_reg & 3] + 1;
575 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
576 struct x86_emulate_ops *ops,
578 u16 *size, unsigned long *address, int op_bytes)
585 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
589 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
594 static int test_cc(unsigned int condition, unsigned int flags)
598 switch ((condition & 15) >> 1) {
600 rc |= (flags & EFLG_OF);
602 case 1: /* b/c/nae */
603 rc |= (flags & EFLG_CF);
606 rc |= (flags & EFLG_ZF);
609 rc |= (flags & (EFLG_CF|EFLG_ZF));
612 rc |= (flags & EFLG_SF);
615 rc |= (flags & EFLG_PF);
618 rc |= (flags & EFLG_ZF);
621 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
625 /* Odd condition identifiers (lsb == 1) have inverted sense. */
626 return (!!rc ^ (condition & 1));
629 static void decode_register_operand(struct operand *op,
630 struct decode_cache *c,
633 unsigned reg = c->modrm_reg;
634 int highbyte_regs = c->rex_prefix == 0;
637 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
639 if ((c->d & ByteOp) && !inhibit_bytereg) {
640 op->ptr = decode_register(reg, c->regs, highbyte_regs);
641 op->val = *(u8 *)op->ptr;
644 op->ptr = decode_register(reg, c->regs, 0);
645 op->bytes = c->op_bytes;
648 op->val = *(u16 *)op->ptr;
651 op->val = *(u32 *)op->ptr;
654 op->val = *(u64 *) op->ptr;
658 op->orig_val = op->val;
661 static int decode_modrm(struct x86_emulate_ctxt *ctxt,
662 struct x86_emulate_ops *ops)
664 struct decode_cache *c = &ctxt->decode;
666 int index_reg = 0, base_reg = 0, scale, rip_relative = 0;
670 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
671 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
672 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
675 c->modrm = insn_fetch(u8, 1, c->eip);
676 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
677 c->modrm_reg |= (c->modrm & 0x38) >> 3;
678 c->modrm_rm |= (c->modrm & 0x07);
682 if (c->modrm_mod == 3) {
683 c->modrm_ptr = decode_register(c->modrm_rm,
684 c->regs, c->d & ByteOp);
685 c->modrm_val = *(unsigned long *)c->modrm_ptr;
689 if (c->ad_bytes == 2) {
690 unsigned bx = c->regs[VCPU_REGS_RBX];
691 unsigned bp = c->regs[VCPU_REGS_RBP];
692 unsigned si = c->regs[VCPU_REGS_RSI];
693 unsigned di = c->regs[VCPU_REGS_RDI];
695 /* 16-bit ModR/M decode. */
696 switch (c->modrm_mod) {
698 if (c->modrm_rm == 6)
699 c->modrm_ea += insn_fetch(u16, 2, c->eip);
702 c->modrm_ea += insn_fetch(s8, 1, c->eip);
705 c->modrm_ea += insn_fetch(u16, 2, c->eip);
708 switch (c->modrm_rm) {
710 c->modrm_ea += bx + si;
713 c->modrm_ea += bx + di;
716 c->modrm_ea += bp + si;
719 c->modrm_ea += bp + di;
728 if (c->modrm_mod != 0)
735 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
736 (c->modrm_rm == 6 && c->modrm_mod != 0))
737 if (!c->override_base)
738 c->override_base = &ctxt->ss_base;
739 c->modrm_ea = (u16)c->modrm_ea;
741 /* 32/64-bit ModR/M decode. */
742 switch (c->modrm_rm) {
745 sib = insn_fetch(u8, 1, c->eip);
746 index_reg |= (sib >> 3) & 7;
752 if (c->modrm_mod != 0)
753 c->modrm_ea += c->regs[base_reg];
756 insn_fetch(s32, 4, c->eip);
759 c->modrm_ea += c->regs[base_reg];
765 c->modrm_ea += c->regs[index_reg] << scale;
769 if (c->modrm_mod != 0)
770 c->modrm_ea += c->regs[c->modrm_rm];
771 else if (ctxt->mode == X86EMUL_MODE_PROT64)
775 c->modrm_ea += c->regs[c->modrm_rm];
778 switch (c->modrm_mod) {
780 if (c->modrm_rm == 5)
781 c->modrm_ea += insn_fetch(s32, 4, c->eip);
784 c->modrm_ea += insn_fetch(s8, 1, c->eip);
787 c->modrm_ea += insn_fetch(s32, 4, c->eip);
792 c->modrm_ea += c->eip;
793 switch (c->d & SrcMask) {
801 if (c->op_bytes == 8)
804 c->modrm_ea += c->op_bytes;
811 static int decode_abs(struct x86_emulate_ctxt *ctxt,
812 struct x86_emulate_ops *ops)
814 struct decode_cache *c = &ctxt->decode;
817 switch (c->ad_bytes) {
819 c->modrm_ea = insn_fetch(u16, 2, c->eip);
822 c->modrm_ea = insn_fetch(u32, 4, c->eip);
825 c->modrm_ea = insn_fetch(u64, 8, c->eip);
833 x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
835 struct decode_cache *c = &ctxt->decode;
837 int mode = ctxt->mode;
838 int def_op_bytes, def_ad_bytes, group;
840 /* Shadow copy of register state. Committed on successful emulation. */
842 memset(c, 0, sizeof(struct decode_cache));
843 c->eip = ctxt->vcpu->arch.rip;
844 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
847 case X86EMUL_MODE_REAL:
848 case X86EMUL_MODE_PROT16:
849 def_op_bytes = def_ad_bytes = 2;
851 case X86EMUL_MODE_PROT32:
852 def_op_bytes = def_ad_bytes = 4;
855 case X86EMUL_MODE_PROT64:
864 c->op_bytes = def_op_bytes;
865 c->ad_bytes = def_ad_bytes;
867 /* Legacy prefixes. */
869 switch (c->b = insn_fetch(u8, 1, c->eip)) {
870 case 0x66: /* operand-size override */
871 /* switch between 2/4 bytes */
872 c->op_bytes = def_op_bytes ^ 6;
874 case 0x67: /* address-size override */
875 if (mode == X86EMUL_MODE_PROT64)
876 /* switch between 4/8 bytes */
877 c->ad_bytes = def_ad_bytes ^ 12;
879 /* switch between 2/4 bytes */
880 c->ad_bytes = def_ad_bytes ^ 6;
882 case 0x2e: /* CS override */
883 c->override_base = &ctxt->cs_base;
885 case 0x3e: /* DS override */
886 c->override_base = &ctxt->ds_base;
888 case 0x26: /* ES override */
889 c->override_base = &ctxt->es_base;
891 case 0x64: /* FS override */
892 c->override_base = &ctxt->fs_base;
894 case 0x65: /* GS override */
895 c->override_base = &ctxt->gs_base;
897 case 0x36: /* SS override */
898 c->override_base = &ctxt->ss_base;
900 case 0x40 ... 0x4f: /* REX */
901 if (mode != X86EMUL_MODE_PROT64)
903 c->rex_prefix = c->b;
905 case 0xf0: /* LOCK */
908 case 0xf2: /* REPNE/REPNZ */
909 c->rep_prefix = REPNE_PREFIX;
911 case 0xf3: /* REP/REPE/REPZ */
912 c->rep_prefix = REPE_PREFIX;
918 /* Any legacy prefix after a REX prefix nullifies its effect. */
927 if (c->rex_prefix & 8)
928 c->op_bytes = 8; /* REX.W */
930 /* Opcode byte(s). */
931 c->d = opcode_table[c->b];
933 /* Two-byte opcode? */
936 c->b = insn_fetch(u8, 1, c->eip);
937 c->d = twobyte_table[c->b];
942 group = c->d & GroupMask;
943 c->modrm = insn_fetch(u8, 1, c->eip);
946 group = (group << 3) + ((c->modrm >> 3) & 7);
947 if ((c->d & GroupDual) && (c->modrm >> 6) == 3)
948 c->d = group2_table[group];
950 c->d = group_table[group];
955 DPRINTF("Cannot emulate %02x\n", c->b);
959 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
962 /* ModRM and SIB bytes. */
964 rc = decode_modrm(ctxt, ops);
965 else if (c->d & MemAbs)
966 rc = decode_abs(ctxt, ops);
970 if (!c->override_base)
971 c->override_base = &ctxt->ds_base;
972 if (mode == X86EMUL_MODE_PROT64 &&
973 c->override_base != &ctxt->fs_base &&
974 c->override_base != &ctxt->gs_base)
975 c->override_base = NULL;
977 if (c->override_base)
978 c->modrm_ea += *c->override_base;
980 if (c->ad_bytes != 8)
981 c->modrm_ea = (u32)c->modrm_ea;
983 * Decode and fetch the source operand: register, memory
986 switch (c->d & SrcMask) {
990 decode_register_operand(&c->src, c, 0);
999 c->src.bytes = (c->d & ByteOp) ? 1 :
1001 /* Don't fetch the address for invlpg: it could be unmapped. */
1002 if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
1006 * For instructions with a ModR/M byte, switch to register
1007 * access if Mod = 3.
1009 if ((c->d & ModRM) && c->modrm_mod == 3) {
1010 c->src.type = OP_REG;
1011 c->src.val = c->modrm_val;
1012 c->src.ptr = c->modrm_ptr;
1015 c->src.type = OP_MEM;
1018 c->src.type = OP_IMM;
1019 c->src.ptr = (unsigned long *)c->eip;
1020 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1021 if (c->src.bytes == 8)
1023 /* NB. Immediates are sign-extended as necessary. */
1024 switch (c->src.bytes) {
1026 c->src.val = insn_fetch(s8, 1, c->eip);
1029 c->src.val = insn_fetch(s16, 2, c->eip);
1032 c->src.val = insn_fetch(s32, 4, c->eip);
1037 c->src.type = OP_IMM;
1038 c->src.ptr = (unsigned long *)c->eip;
1040 c->src.val = insn_fetch(s8, 1, c->eip);
1044 /* Decode and fetch the destination operand: register or memory. */
1045 switch (c->d & DstMask) {
1047 /* Special instructions do their own operand decoding. */
1050 decode_register_operand(&c->dst, c,
1051 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
1054 if ((c->d & ModRM) && c->modrm_mod == 3) {
1055 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1056 c->dst.type = OP_REG;
1057 c->dst.val = c->dst.orig_val = c->modrm_val;
1058 c->dst.ptr = c->modrm_ptr;
1061 c->dst.type = OP_MEM;
1066 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1069 static inline void emulate_push(struct x86_emulate_ctxt *ctxt)
1071 struct decode_cache *c = &ctxt->decode;
1073 c->dst.type = OP_MEM;
1074 c->dst.bytes = c->op_bytes;
1075 c->dst.val = c->src.val;
1076 register_address_increment(c, &c->regs[VCPU_REGS_RSP], -c->op_bytes);
1077 c->dst.ptr = (void *) register_address(c, ctxt->ss_base,
1078 c->regs[VCPU_REGS_RSP]);
1081 static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
1082 struct x86_emulate_ops *ops)
1084 struct decode_cache *c = &ctxt->decode;
1087 rc = ops->read_std(register_address(c, ctxt->ss_base,
1088 c->regs[VCPU_REGS_RSP]),
1089 &c->dst.val, c->dst.bytes, ctxt->vcpu);
1093 register_address_increment(c, &c->regs[VCPU_REGS_RSP], c->dst.bytes);
1098 static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
1100 struct decode_cache *c = &ctxt->decode;
1101 switch (c->modrm_reg) {
1103 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
1106 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
1109 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
1112 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
1114 case 4: /* sal/shl */
1115 case 6: /* sal/shl */
1116 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
1119 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
1122 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
1127 static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
1128 struct x86_emulate_ops *ops)
1130 struct decode_cache *c = &ctxt->decode;
1133 switch (c->modrm_reg) {
1134 case 0 ... 1: /* test */
1135 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1138 c->dst.val = ~c->dst.val;
1141 emulate_1op("neg", c->dst, ctxt->eflags);
1144 DPRINTF("Cannot emulate %02x\n", c->b);
1145 rc = X86EMUL_UNHANDLEABLE;
1151 static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
1152 struct x86_emulate_ops *ops)
1154 struct decode_cache *c = &ctxt->decode;
1156 switch (c->modrm_reg) {
1158 emulate_1op("inc", c->dst, ctxt->eflags);
1161 emulate_1op("dec", c->dst, ctxt->eflags);
1163 case 4: /* jmp abs */
1164 c->eip = c->src.val;
1173 static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
1174 struct x86_emulate_ops *ops,
1175 unsigned long memop)
1177 struct decode_cache *c = &ctxt->decode;
1181 rc = ops->read_emulated(memop, &old, 8, ctxt->vcpu);
1185 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1186 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
1188 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1189 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1190 ctxt->eflags &= ~EFLG_ZF;
1193 new = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1194 (u32) c->regs[VCPU_REGS_RBX];
1196 rc = ops->cmpxchg_emulated(memop, &old, &new, 8, ctxt->vcpu);
1199 ctxt->eflags |= EFLG_ZF;
1204 static inline int writeback(struct x86_emulate_ctxt *ctxt,
1205 struct x86_emulate_ops *ops)
1208 struct decode_cache *c = &ctxt->decode;
1210 switch (c->dst.type) {
1212 /* The 4-byte case *is* correct:
1213 * in 64-bit mode we zero-extend.
1215 switch (c->dst.bytes) {
1217 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1220 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1223 *c->dst.ptr = (u32)c->dst.val;
1224 break; /* 64b: zero-ext */
1226 *c->dst.ptr = c->dst.val;
1232 rc = ops->cmpxchg_emulated(
1233 (unsigned long)c->dst.ptr,
1239 rc = ops->write_emulated(
1240 (unsigned long)c->dst.ptr,
1257 x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1259 unsigned long memop = 0;
1261 unsigned long saved_eip = 0;
1262 struct decode_cache *c = &ctxt->decode;
1265 /* Shadow copy of register state. Committed on successful emulation.
1266 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
1270 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
1273 if (((c->d & ModRM) && (c->modrm_mod != 3)) || (c->d & MemAbs))
1274 memop = c->modrm_ea;
1276 if (c->rep_prefix && (c->d & String)) {
1277 /* All REP prefixes have the same first termination condition */
1278 if (c->regs[VCPU_REGS_RCX] == 0) {
1279 ctxt->vcpu->arch.rip = c->eip;
1282 /* The second termination condition only applies for REPE
1283 * and REPNE. Test if the repeat string operation prefix is
1284 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
1285 * corresponding termination condition according to:
1286 * - if REPE/REPZ and ZF = 0 then done
1287 * - if REPNE/REPNZ and ZF = 1 then done
1289 if ((c->b == 0xa6) || (c->b == 0xa7) ||
1290 (c->b == 0xae) || (c->b == 0xaf)) {
1291 if ((c->rep_prefix == REPE_PREFIX) &&
1292 ((ctxt->eflags & EFLG_ZF) == 0)) {
1293 ctxt->vcpu->arch.rip = c->eip;
1296 if ((c->rep_prefix == REPNE_PREFIX) &&
1297 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF)) {
1298 ctxt->vcpu->arch.rip = c->eip;
1302 c->regs[VCPU_REGS_RCX]--;
1303 c->eip = ctxt->vcpu->arch.rip;
1306 if (c->src.type == OP_MEM) {
1307 c->src.ptr = (unsigned long *)memop;
1309 rc = ops->read_emulated((unsigned long)c->src.ptr,
1315 c->src.orig_val = c->src.val;
1318 if ((c->d & DstMask) == ImplicitOps)
1322 if (c->dst.type == OP_MEM) {
1323 c->dst.ptr = (unsigned long *)memop;
1324 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1327 unsigned long mask = ~(c->dst.bytes * 8 - 1);
1329 c->dst.ptr = (void *)c->dst.ptr +
1330 (c->src.val & mask) / 8;
1332 if (!(c->d & Mov) &&
1333 /* optimisation - avoid slow emulated read */
1334 ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1336 c->dst.bytes, ctxt->vcpu)) != 0))
1339 c->dst.orig_val = c->dst.val;
1349 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
1353 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
1357 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
1361 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
1365 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
1367 case 0x24: /* and al imm8 */
1368 c->dst.type = OP_REG;
1369 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1370 c->dst.val = *(u8 *)c->dst.ptr;
1372 c->dst.orig_val = c->dst.val;
1374 case 0x25: /* and ax imm16, or eax imm32 */
1375 c->dst.type = OP_REG;
1376 c->dst.bytes = c->op_bytes;
1377 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1378 if (c->op_bytes == 2)
1379 c->dst.val = *(u16 *)c->dst.ptr;
1381 c->dst.val = *(u32 *)c->dst.ptr;
1382 c->dst.orig_val = c->dst.val;
1386 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
1390 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
1394 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1396 case 0x40 ... 0x47: /* inc r16/r32 */
1397 emulate_1op("inc", c->dst, ctxt->eflags);
1399 case 0x48 ... 0x4f: /* dec r16/r32 */
1400 emulate_1op("dec", c->dst, ctxt->eflags);
1402 case 0x50 ... 0x57: /* push reg */
1403 c->dst.type = OP_MEM;
1404 c->dst.bytes = c->op_bytes;
1405 c->dst.val = c->src.val;
1406 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1408 c->dst.ptr = (void *) register_address(
1409 c, ctxt->ss_base, c->regs[VCPU_REGS_RSP]);
1411 case 0x58 ... 0x5f: /* pop reg */
1413 if ((rc = ops->read_std(register_address(c, ctxt->ss_base,
1414 c->regs[VCPU_REGS_RSP]), c->dst.ptr,
1415 c->op_bytes, ctxt->vcpu)) != 0)
1418 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1420 c->dst.type = OP_NONE; /* Disable writeback. */
1422 case 0x63: /* movsxd */
1423 if (ctxt->mode != X86EMUL_MODE_PROT64)
1424 goto cannot_emulate;
1425 c->dst.val = (s32) c->src.val;
1427 case 0x6a: /* push imm8 */
1429 c->src.val = insn_fetch(s8, 1, c->eip);
1432 case 0x6c: /* insb */
1433 case 0x6d: /* insw/insd */
1434 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1436 (c->d & ByteOp) ? 1 : c->op_bytes,
1438 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1,
1439 (ctxt->eflags & EFLG_DF),
1440 register_address(c, ctxt->es_base,
1441 c->regs[VCPU_REGS_RDI]),
1443 c->regs[VCPU_REGS_RDX]) == 0) {
1448 case 0x6e: /* outsb */
1449 case 0x6f: /* outsw/outsd */
1450 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1452 (c->d & ByteOp) ? 1 : c->op_bytes,
1454 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1,
1455 (ctxt->eflags & EFLG_DF),
1456 register_address(c, c->override_base ?
1459 c->regs[VCPU_REGS_RSI]),
1461 c->regs[VCPU_REGS_RDX]) == 0) {
1466 case 0x70 ... 0x7f: /* jcc (short) */ {
1467 int rel = insn_fetch(s8, 1, c->eip);
1469 if (test_cc(c->b, ctxt->eflags))
1473 case 0x80 ... 0x83: /* Grp1 */
1474 switch (c->modrm_reg) {
1494 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1496 case 0x86 ... 0x87: /* xchg */
1497 /* Write back the register source. */
1498 switch (c->dst.bytes) {
1500 *(u8 *) c->src.ptr = (u8) c->dst.val;
1503 *(u16 *) c->src.ptr = (u16) c->dst.val;
1506 *c->src.ptr = (u32) c->dst.val;
1507 break; /* 64b reg: zero-extend */
1509 *c->src.ptr = c->dst.val;
1513 * Write back the memory destination with implicit LOCK
1516 c->dst.val = c->src.val;
1519 case 0x88 ... 0x8b: /* mov */
1521 case 0x8c: { /* mov r/m, sreg */
1522 struct kvm_segment segreg;
1524 if (c->modrm_reg <= 5)
1525 kvm_get_segment(ctxt->vcpu, &segreg, c->modrm_reg);
1527 printk(KERN_INFO "0x8c: Invalid segreg in modrm byte 0x%02x\n",
1529 goto cannot_emulate;
1531 c->dst.val = segreg.selector;
1534 case 0x8d: /* lea r16/r32, m */
1535 c->dst.val = c->modrm_ea;
1537 case 0x8e: { /* mov seg, r/m16 */
1543 if (c->modrm_reg <= 5) {
1544 type_bits = (c->modrm_reg == 1) ? 9 : 1;
1545 err = kvm_load_segment_descriptor(ctxt->vcpu, sel,
1546 type_bits, c->modrm_reg);
1548 printk(KERN_INFO "Invalid segreg in modrm byte 0x%02x\n",
1550 goto cannot_emulate;
1554 goto cannot_emulate;
1556 c->dst.type = OP_NONE; /* Disable writeback. */
1559 case 0x8f: /* pop (sole member of Grp1a) */
1560 rc = emulate_grp1a(ctxt, ops);
1564 case 0x9c: /* pushf */
1565 c->src.val = (unsigned long) ctxt->eflags;
1568 case 0x9d: /* popf */
1569 c->dst.ptr = (unsigned long *) &ctxt->eflags;
1570 goto pop_instruction;
1571 case 0xa0 ... 0xa1: /* mov */
1572 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1573 c->dst.val = c->src.val;
1575 case 0xa2 ... 0xa3: /* mov */
1576 c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
1578 case 0xa4 ... 0xa5: /* movs */
1579 c->dst.type = OP_MEM;
1580 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1581 c->dst.ptr = (unsigned long *)register_address(c,
1583 c->regs[VCPU_REGS_RDI]);
1584 if ((rc = ops->read_emulated(register_address(c,
1585 c->override_base ? *c->override_base :
1587 c->regs[VCPU_REGS_RSI]),
1589 c->dst.bytes, ctxt->vcpu)) != 0)
1591 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1592 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1594 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1595 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1598 case 0xa6 ... 0xa7: /* cmps */
1599 c->src.type = OP_NONE; /* Disable writeback. */
1600 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1601 c->src.ptr = (unsigned long *)register_address(c,
1602 c->override_base ? *c->override_base :
1604 c->regs[VCPU_REGS_RSI]);
1605 if ((rc = ops->read_emulated((unsigned long)c->src.ptr,
1611 c->dst.type = OP_NONE; /* Disable writeback. */
1612 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1613 c->dst.ptr = (unsigned long *)register_address(c,
1615 c->regs[VCPU_REGS_RDI]);
1616 if ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1622 DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c->src.ptr, c->dst.ptr);
1624 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1626 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1627 (ctxt->eflags & EFLG_DF) ? -c->src.bytes
1629 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1630 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1634 case 0xaa ... 0xab: /* stos */
1635 c->dst.type = OP_MEM;
1636 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1637 c->dst.ptr = (unsigned long *)register_address(c,
1639 c->regs[VCPU_REGS_RDI]);
1640 c->dst.val = c->regs[VCPU_REGS_RAX];
1641 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1642 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1645 case 0xac ... 0xad: /* lods */
1646 c->dst.type = OP_REG;
1647 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1648 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1649 if ((rc = ops->read_emulated(register_address(c,
1650 c->override_base ? *c->override_base :
1652 c->regs[VCPU_REGS_RSI]),
1657 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1658 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1661 case 0xae ... 0xaf: /* scas */
1662 DPRINTF("Urk! I don't handle SCAS.\n");
1663 goto cannot_emulate;
1664 case 0xb8: /* mov r, imm */
1669 case 0xc3: /* ret */
1670 c->dst.ptr = &c->eip;
1671 goto pop_instruction;
1672 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1674 c->dst.val = c->src.val;
1676 case 0xd0 ... 0xd1: /* Grp2 */
1680 case 0xd2 ... 0xd3: /* Grp2 */
1681 c->src.val = c->regs[VCPU_REGS_RCX];
1684 case 0xe8: /* call (near) */ {
1686 switch (c->op_bytes) {
1688 rel = insn_fetch(s16, 2, c->eip);
1691 rel = insn_fetch(s32, 4, c->eip);
1694 DPRINTF("Call: Invalid op_bytes\n");
1695 goto cannot_emulate;
1697 c->src.val = (unsigned long) c->eip;
1699 c->op_bytes = c->ad_bytes;
1703 case 0xe9: /* jmp rel */
1705 case 0xea: /* jmp far */ {
1709 switch (c->op_bytes) {
1711 eip = insn_fetch(u16, 2, c->eip);
1714 eip = insn_fetch(u32, 4, c->eip);
1717 DPRINTF("jmp far: Invalid op_bytes\n");
1718 goto cannot_emulate;
1720 sel = insn_fetch(u16, 2, c->eip);
1721 if (kvm_load_segment_descriptor(ctxt->vcpu, sel, 9, VCPU_SREG_CS) < 0) {
1722 DPRINTF("jmp far: Failed to load CS descriptor\n");
1723 goto cannot_emulate;
1730 jmp: /* jmp rel short */
1731 jmp_rel(c, c->src.val);
1732 c->dst.type = OP_NONE; /* Disable writeback. */
1734 case 0xf4: /* hlt */
1735 ctxt->vcpu->arch.halt_request = 1;
1737 case 0xf5: /* cmc */
1738 /* complement carry flag from eflags reg */
1739 ctxt->eflags ^= EFLG_CF;
1740 c->dst.type = OP_NONE; /* Disable writeback. */
1742 case 0xf6 ... 0xf7: /* Grp3 */
1743 rc = emulate_grp3(ctxt, ops);
1747 case 0xf8: /* clc */
1748 ctxt->eflags &= ~EFLG_CF;
1749 c->dst.type = OP_NONE; /* Disable writeback. */
1751 case 0xfa: /* cli */
1752 ctxt->eflags &= ~X86_EFLAGS_IF;
1753 c->dst.type = OP_NONE; /* Disable writeback. */
1755 case 0xfb: /* sti */
1756 ctxt->eflags |= X86_EFLAGS_IF;
1757 c->dst.type = OP_NONE; /* Disable writeback. */
1759 case 0xfe ... 0xff: /* Grp4/Grp5 */
1760 rc = emulate_grp45(ctxt, ops);
1767 rc = writeback(ctxt, ops);
1771 /* Commit shadow register state. */
1772 memcpy(ctxt->vcpu->arch.regs, c->regs, sizeof c->regs);
1773 ctxt->vcpu->arch.rip = c->eip;
1776 if (rc == X86EMUL_UNHANDLEABLE) {
1784 case 0x01: /* lgdt, lidt, lmsw */
1785 switch (c->modrm_reg) {
1787 unsigned long address;
1789 case 0: /* vmcall */
1790 if (c->modrm_mod != 3 || c->modrm_rm != 1)
1791 goto cannot_emulate;
1793 rc = kvm_fix_hypercall(ctxt->vcpu);
1797 /* Let the processor re-execute the fixed hypercall */
1798 c->eip = ctxt->vcpu->arch.rip;
1799 /* Disable writeback. */
1800 c->dst.type = OP_NONE;
1803 rc = read_descriptor(ctxt, ops, c->src.ptr,
1804 &size, &address, c->op_bytes);
1807 realmode_lgdt(ctxt->vcpu, size, address);
1808 /* Disable writeback. */
1809 c->dst.type = OP_NONE;
1811 case 3: /* lidt/vmmcall */
1812 if (c->modrm_mod == 3 && c->modrm_rm == 1) {
1813 rc = kvm_fix_hypercall(ctxt->vcpu);
1816 kvm_emulate_hypercall(ctxt->vcpu);
1818 rc = read_descriptor(ctxt, ops, c->src.ptr,
1823 realmode_lidt(ctxt->vcpu, size, address);
1825 /* Disable writeback. */
1826 c->dst.type = OP_NONE;
1830 c->dst.val = realmode_get_cr(ctxt->vcpu, 0);
1833 realmode_lmsw(ctxt->vcpu, (u16)c->src.val,
1835 c->dst.type = OP_NONE;
1838 emulate_invlpg(ctxt->vcpu, memop);
1839 /* Disable writeback. */
1840 c->dst.type = OP_NONE;
1843 goto cannot_emulate;
1847 emulate_clts(ctxt->vcpu);
1848 c->dst.type = OP_NONE;
1850 case 0x08: /* invd */
1851 case 0x09: /* wbinvd */
1852 case 0x0d: /* GrpP (prefetch) */
1853 case 0x18: /* Grp16 (prefetch/nop) */
1854 c->dst.type = OP_NONE;
1856 case 0x20: /* mov cr, reg */
1857 if (c->modrm_mod != 3)
1858 goto cannot_emulate;
1859 c->regs[c->modrm_rm] =
1860 realmode_get_cr(ctxt->vcpu, c->modrm_reg);
1861 c->dst.type = OP_NONE; /* no writeback */
1863 case 0x21: /* mov from dr to reg */
1864 if (c->modrm_mod != 3)
1865 goto cannot_emulate;
1866 rc = emulator_get_dr(ctxt, c->modrm_reg, &c->regs[c->modrm_rm]);
1868 goto cannot_emulate;
1869 c->dst.type = OP_NONE; /* no writeback */
1871 case 0x22: /* mov reg, cr */
1872 if (c->modrm_mod != 3)
1873 goto cannot_emulate;
1874 realmode_set_cr(ctxt->vcpu,
1875 c->modrm_reg, c->modrm_val, &ctxt->eflags);
1876 c->dst.type = OP_NONE;
1878 case 0x23: /* mov from reg to dr */
1879 if (c->modrm_mod != 3)
1880 goto cannot_emulate;
1881 rc = emulator_set_dr(ctxt, c->modrm_reg,
1882 c->regs[c->modrm_rm]);
1884 goto cannot_emulate;
1885 c->dst.type = OP_NONE; /* no writeback */
1889 msr_data = (u32)c->regs[VCPU_REGS_RAX]
1890 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
1891 rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
1893 kvm_inject_gp(ctxt->vcpu, 0);
1894 c->eip = ctxt->vcpu->arch.rip;
1896 rc = X86EMUL_CONTINUE;
1897 c->dst.type = OP_NONE;
1901 rc = kvm_get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data);
1903 kvm_inject_gp(ctxt->vcpu, 0);
1904 c->eip = ctxt->vcpu->arch.rip;
1906 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
1907 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
1909 rc = X86EMUL_CONTINUE;
1910 c->dst.type = OP_NONE;
1912 case 0x40 ... 0x4f: /* cmov */
1913 c->dst.val = c->dst.orig_val = c->src.val;
1914 if (!test_cc(c->b, ctxt->eflags))
1915 c->dst.type = OP_NONE; /* no writeback */
1917 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1920 switch (c->op_bytes) {
1922 rel = insn_fetch(s16, 2, c->eip);
1925 rel = insn_fetch(s32, 4, c->eip);
1928 rel = insn_fetch(s64, 8, c->eip);
1931 DPRINTF("jnz: Invalid op_bytes\n");
1932 goto cannot_emulate;
1934 if (test_cc(c->b, ctxt->eflags))
1936 c->dst.type = OP_NONE;
1941 c->dst.type = OP_NONE;
1942 /* only subword offset */
1943 c->src.val &= (c->dst.bytes << 3) - 1;
1944 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
1948 /* only subword offset */
1949 c->src.val &= (c->dst.bytes << 3) - 1;
1950 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
1952 case 0xb0 ... 0xb1: /* cmpxchg */
1954 * Save real source value, then compare EAX against
1957 c->src.orig_val = c->src.val;
1958 c->src.val = c->regs[VCPU_REGS_RAX];
1959 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1960 if (ctxt->eflags & EFLG_ZF) {
1961 /* Success: write back to memory. */
1962 c->dst.val = c->src.orig_val;
1964 /* Failure: write the value we saw to EAX. */
1965 c->dst.type = OP_REG;
1966 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1971 /* only subword offset */
1972 c->src.val &= (c->dst.bytes << 3) - 1;
1973 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
1975 case 0xb6 ... 0xb7: /* movzx */
1976 c->dst.bytes = c->op_bytes;
1977 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
1980 case 0xba: /* Grp8 */
1981 switch (c->modrm_reg & 3) {
1994 /* only subword offset */
1995 c->src.val &= (c->dst.bytes << 3) - 1;
1996 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
1998 case 0xbe ... 0xbf: /* movsx */
1999 c->dst.bytes = c->op_bytes;
2000 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
2003 case 0xc3: /* movnti */
2004 c->dst.bytes = c->op_bytes;
2005 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
2008 case 0xc7: /* Grp9 (cmpxchg8b) */
2009 rc = emulate_grp9(ctxt, ops, memop);
2012 c->dst.type = OP_NONE;
2018 DPRINTF("Cannot emulate %02x\n", c->b);