1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf( _f , ## _a )
29 #define DPRINTF(x...) do {} while (0)
31 #include "x86_emulate.h"
32 #include <linux/module.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
66 static u8 opcode_table[256] = {
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 SrcImmByte, SrcImm, 0, 0,
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
102 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
103 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
106 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
108 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
109 0, 0, 0, 0, 0, 0, 0, 0,
111 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
112 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
114 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
116 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
117 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
118 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
119 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
121 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
122 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
123 0, 0, 0, DstMem | SrcNone | ModRM | Mov,
125 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
127 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
128 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
129 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
130 ByteOp | ImplicitOps, ImplicitOps,
132 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
133 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
134 ByteOp | ImplicitOps, ImplicitOps,
136 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
138 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
139 0, ImplicitOps, 0, 0,
140 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
142 0, 0, 0, 0, 0, 0, 0, 0,
144 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
145 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
148 0, 0, 0, 0, 0, 0, 0, 0,
150 0, 0, 0, 0, 0, 0, 0, 0,
152 0, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps, 0, 0, 0, 0,
156 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
159 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
162 static u16 twobyte_table[256] = {
164 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
165 0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
167 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
169 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
170 0, 0, 0, 0, 0, 0, 0, 0,
172 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
174 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
175 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
176 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
177 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
179 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
180 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
181 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
182 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
184 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
186 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
188 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
190 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
192 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
194 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
196 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
198 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
199 DstMem | SrcReg | ModRM | BitOp,
200 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
201 DstReg | SrcMem16 | ModRM | Mov,
203 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
204 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
205 DstReg | SrcMem16 | ModRM | Mov,
207 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
209 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
211 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
213 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
217 * Tell the emulator that of the Group 7 instructions (sgdt, lidt, etc.) we
218 * are interested only in invlpg and not in any of the rest.
220 * invlpg is a special instruction in that the data it references may not
223 void kvm_emulator_want_group7_invlpg(void)
225 twobyte_table[1] &= ~SrcMem;
227 EXPORT_SYMBOL_GPL(kvm_emulator_want_group7_invlpg);
229 /* Type, address-of, and value of an instruction's operand. */
231 enum { OP_REG, OP_MEM, OP_IMM } type;
233 unsigned long val, orig_val, *ptr;
236 /* EFLAGS bit definitions. */
237 #define EFLG_OF (1<<11)
238 #define EFLG_DF (1<<10)
239 #define EFLG_SF (1<<7)
240 #define EFLG_ZF (1<<6)
241 #define EFLG_AF (1<<4)
242 #define EFLG_PF (1<<2)
243 #define EFLG_CF (1<<0)
246 * Instruction emulation:
247 * Most instructions are emulated directly via a fragment of inline assembly
248 * code. This allows us to save/restore EFLAGS and thus very easily pick up
249 * any modified flags.
252 #if defined(CONFIG_X86_64)
253 #define _LO32 "k" /* force 32-bit operand */
254 #define _STK "%%rsp" /* stack pointer */
255 #elif defined(__i386__)
256 #define _LO32 "" /* force 32-bit operand */
257 #define _STK "%%esp" /* stack pointer */
261 * These EFLAGS bits are restored from saved value during emulation, and
262 * any changes are written back to the saved value after emulation.
264 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
266 /* Before executing instruction: restore necessary bits in EFLAGS. */
267 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
268 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
270 "movl %"_msk",%"_LO32 _tmp"; " \
271 "andl %"_LO32 _tmp",("_STK"); " \
273 "notl %"_LO32 _tmp"; " \
274 "andl %"_LO32 _tmp",("_STK"); " \
276 "orl %"_LO32 _tmp",("_STK"); " \
278 /* _sav &= ~msk; */ \
279 "movl %"_msk",%"_LO32 _tmp"; " \
280 "notl %"_LO32 _tmp"; " \
281 "andl %"_LO32 _tmp",%"_sav"; "
283 /* After executing instruction: write-back necessary bits in EFLAGS. */
284 #define _POST_EFLAGS(_sav, _msk, _tmp) \
285 /* _sav |= EFLAGS & _msk; */ \
288 "andl %"_msk",%"_LO32 _tmp"; " \
289 "orl %"_LO32 _tmp",%"_sav"; "
291 /* Raw emulation: instruction has two explicit operands. */
292 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
294 unsigned long _tmp; \
296 switch ((_dst).bytes) { \
298 __asm__ __volatile__ ( \
299 _PRE_EFLAGS("0","4","2") \
300 _op"w %"_wx"3,%1; " \
301 _POST_EFLAGS("0","4","2") \
302 : "=m" (_eflags), "=m" ((_dst).val), \
304 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
307 __asm__ __volatile__ ( \
308 _PRE_EFLAGS("0","4","2") \
309 _op"l %"_lx"3,%1; " \
310 _POST_EFLAGS("0","4","2") \
311 : "=m" (_eflags), "=m" ((_dst).val), \
313 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
316 __emulate_2op_8byte(_op, _src, _dst, \
317 _eflags, _qx, _qy); \
322 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
324 unsigned long _tmp; \
325 switch ( (_dst).bytes ) \
328 __asm__ __volatile__ ( \
329 _PRE_EFLAGS("0","4","2") \
330 _op"b %"_bx"3,%1; " \
331 _POST_EFLAGS("0","4","2") \
332 : "=m" (_eflags), "=m" ((_dst).val), \
334 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
337 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
338 _wx, _wy, _lx, _ly, _qx, _qy); \
343 /* Source operand is byte-sized and may be restricted to just %cl. */
344 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
345 __emulate_2op(_op, _src, _dst, _eflags, \
346 "b", "c", "b", "c", "b", "c", "b", "c")
348 /* Source operand is byte, word, long or quad sized. */
349 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
350 __emulate_2op(_op, _src, _dst, _eflags, \
351 "b", "q", "w", "r", _LO32, "r", "", "r")
353 /* Source operand is word, long or quad sized. */
354 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
355 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
356 "w", "r", _LO32, "r", "", "r")
358 /* Instruction has only one explicit operand (no source operand). */
359 #define emulate_1op(_op, _dst, _eflags) \
361 unsigned long _tmp; \
363 switch ( (_dst).bytes ) \
366 __asm__ __volatile__ ( \
367 _PRE_EFLAGS("0","3","2") \
369 _POST_EFLAGS("0","3","2") \
370 : "=m" (_eflags), "=m" ((_dst).val), \
372 : "i" (EFLAGS_MASK) ); \
375 __asm__ __volatile__ ( \
376 _PRE_EFLAGS("0","3","2") \
378 _POST_EFLAGS("0","3","2") \
379 : "=m" (_eflags), "=m" ((_dst).val), \
381 : "i" (EFLAGS_MASK) ); \
384 __asm__ __volatile__ ( \
385 _PRE_EFLAGS("0","3","2") \
387 _POST_EFLAGS("0","3","2") \
388 : "=m" (_eflags), "=m" ((_dst).val), \
390 : "i" (EFLAGS_MASK) ); \
393 __emulate_1op_8byte(_op, _dst, _eflags); \
398 /* Emulate an instruction with quadword operands (x86/64 only). */
399 #if defined(CONFIG_X86_64)
400 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
402 __asm__ __volatile__ ( \
403 _PRE_EFLAGS("0","4","2") \
404 _op"q %"_qx"3,%1; " \
405 _POST_EFLAGS("0","4","2") \
406 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
407 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
410 #define __emulate_1op_8byte(_op, _dst, _eflags) \
412 __asm__ __volatile__ ( \
413 _PRE_EFLAGS("0","3","2") \
415 _POST_EFLAGS("0","3","2") \
416 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
417 : "i" (EFLAGS_MASK) ); \
420 #elif defined(__i386__)
421 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
422 #define __emulate_1op_8byte(_op, _dst, _eflags)
423 #endif /* __i386__ */
425 /* Fetch next part of the instruction being emulated. */
426 #define insn_fetch(_type, _size, _eip) \
427 ({ unsigned long _x; \
428 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
429 (_size), ctxt->vcpu); \
436 /* Access/update address held in a register, based on addressing mode. */
437 #define address_mask(reg) \
438 ((ad_bytes == sizeof(unsigned long)) ? \
439 (reg) : ((reg) & ((1UL << (ad_bytes << 3)) - 1)))
440 #define register_address(base, reg) \
441 ((base) + address_mask(reg))
442 #define register_address_increment(reg, inc) \
444 /* signed type ensures sign extension to long */ \
446 if ( ad_bytes == sizeof(unsigned long) ) \
449 (reg) = ((reg) & ~((1UL << (ad_bytes << 3)) - 1)) | \
450 (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
453 #define JMP_REL(rel) \
455 _eip += (int)(rel); \
456 _eip = ((op_bytes == 2) ? (uint16_t)_eip : (uint32_t)_eip); \
460 * Given the 'reg' portion of a ModRM byte, and a register block, return a
461 * pointer into the block that addresses the relevant register.
462 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
464 static void *decode_register(u8 modrm_reg, unsigned long *regs,
469 p = ®s[modrm_reg];
470 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
471 p = (unsigned char *)®s[modrm_reg & 3] + 1;
475 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
476 struct x86_emulate_ops *ops,
478 u16 *size, unsigned long *address, int op_bytes)
485 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
489 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
495 x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
498 u8 b, sib, twobyte = 0, rex_prefix = 0;
499 u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
500 unsigned long *override_base = NULL;
501 unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
503 struct operand src, dst;
504 unsigned long cr2 = ctxt->cr2;
505 int mode = ctxt->mode;
506 unsigned long modrm_ea;
507 int use_modrm_ea, index_reg = 0, base_reg = 0, scale, rip_relative = 0;
511 /* Shadow copy of register state. Committed on successful emulation. */
512 unsigned long _regs[NR_VCPU_REGS];
513 unsigned long _eip = ctxt->vcpu->rip, _eflags = ctxt->eflags;
514 unsigned long modrm_val = 0;
516 memcpy(_regs, ctxt->vcpu->regs, sizeof _regs);
519 case X86EMUL_MODE_REAL:
520 case X86EMUL_MODE_PROT16:
521 op_bytes = ad_bytes = 2;
523 case X86EMUL_MODE_PROT32:
524 op_bytes = ad_bytes = 4;
527 case X86EMUL_MODE_PROT64:
536 /* Legacy prefixes. */
537 for (i = 0; i < 8; i++) {
538 switch (b = insn_fetch(u8, 1, _eip)) {
539 case 0x66: /* operand-size override */
540 op_bytes ^= 6; /* switch between 2/4 bytes */
542 case 0x67: /* address-size override */
543 if (mode == X86EMUL_MODE_PROT64)
544 ad_bytes ^= 12; /* switch between 4/8 bytes */
546 ad_bytes ^= 6; /* switch between 2/4 bytes */
548 case 0x2e: /* CS override */
549 override_base = &ctxt->cs_base;
551 case 0x3e: /* DS override */
552 override_base = &ctxt->ds_base;
554 case 0x26: /* ES override */
555 override_base = &ctxt->es_base;
557 case 0x64: /* FS override */
558 override_base = &ctxt->fs_base;
560 case 0x65: /* GS override */
561 override_base = &ctxt->gs_base;
563 case 0x36: /* SS override */
564 override_base = &ctxt->ss_base;
566 case 0xf0: /* LOCK */
569 case 0xf3: /* REP/REPE/REPZ */
572 case 0xf2: /* REPNE/REPNZ */
582 if ((mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40)) {
585 op_bytes = 8; /* REX.W */
586 modrm_reg = (b & 4) << 1; /* REX.R */
587 index_reg = (b & 2) << 2; /* REX.X */
588 modrm_rm = base_reg = (b & 1) << 3; /* REG.B */
589 b = insn_fetch(u8, 1, _eip);
592 /* Opcode byte(s). */
595 /* Two-byte opcode? */
598 b = insn_fetch(u8, 1, _eip);
599 d = twobyte_table[b];
607 /* ModRM and SIB bytes. */
609 modrm = insn_fetch(u8, 1, _eip);
610 modrm_mod |= (modrm & 0xc0) >> 6;
611 modrm_reg |= (modrm & 0x38) >> 3;
612 modrm_rm |= (modrm & 0x07);
616 if (modrm_mod == 3) {
617 modrm_val = *(unsigned long *)
618 decode_register(modrm_rm, _regs, d & ByteOp);
623 unsigned bx = _regs[VCPU_REGS_RBX];
624 unsigned bp = _regs[VCPU_REGS_RBP];
625 unsigned si = _regs[VCPU_REGS_RSI];
626 unsigned di = _regs[VCPU_REGS_RDI];
628 /* 16-bit ModR/M decode. */
632 modrm_ea += insn_fetch(u16, 2, _eip);
635 modrm_ea += insn_fetch(s8, 1, _eip);
638 modrm_ea += insn_fetch(u16, 2, _eip);
668 if (modrm_rm == 2 || modrm_rm == 3 ||
669 (modrm_rm == 6 && modrm_mod != 0))
671 override_base = &ctxt->ss_base;
672 modrm_ea = (u16)modrm_ea;
674 /* 32/64-bit ModR/M decode. */
678 sib = insn_fetch(u8, 1, _eip);
679 index_reg |= (sib >> 3) & 7;
686 modrm_ea += _regs[base_reg];
688 modrm_ea += insn_fetch(s32, 4, _eip);
691 modrm_ea += _regs[base_reg];
697 modrm_ea += _regs[index_reg] << scale;
703 modrm_ea += _regs[modrm_rm];
704 else if (mode == X86EMUL_MODE_PROT64)
708 modrm_ea += _regs[modrm_rm];
714 modrm_ea += insn_fetch(s32, 4, _eip);
717 modrm_ea += insn_fetch(s8, 1, _eip);
720 modrm_ea += insn_fetch(s32, 4, _eip);
725 override_base = &ctxt->ds_base;
726 if (mode == X86EMUL_MODE_PROT64 &&
727 override_base != &ctxt->fs_base &&
728 override_base != &ctxt->gs_base)
729 override_base = NULL;
732 modrm_ea += *override_base;
736 switch (d & SrcMask) {
747 modrm_ea += op_bytes;
751 modrm_ea = (u32)modrm_ea;
758 * Decode and fetch the source operand: register, memory
761 switch (d & SrcMask) {
767 src.ptr = decode_register(modrm_reg, _regs,
769 src.val = src.orig_val = *(u8 *) src.ptr;
772 src.ptr = decode_register(modrm_reg, _regs, 0);
773 switch ((src.bytes = op_bytes)) {
775 src.val = src.orig_val = *(u16 *) src.ptr;
778 src.val = src.orig_val = *(u32 *) src.ptr;
781 src.val = src.orig_val = *(u64 *) src.ptr;
793 src.bytes = (d & ByteOp) ? 1 : op_bytes;
796 src.ptr = (unsigned long *)cr2;
797 if ((rc = ops->read_emulated((unsigned long)src.ptr,
798 &src.val, src.bytes, ctxt->vcpu)) != 0)
800 src.orig_val = src.val;
804 src.ptr = (unsigned long *)_eip;
805 src.bytes = (d & ByteOp) ? 1 : op_bytes;
808 /* NB. Immediates are sign-extended as necessary. */
811 src.val = insn_fetch(s8, 1, _eip);
814 src.val = insn_fetch(s16, 2, _eip);
817 src.val = insn_fetch(s32, 4, _eip);
823 src.ptr = (unsigned long *)_eip;
825 src.val = insn_fetch(s8, 1, _eip);
829 /* Decode and fetch the destination operand: register or memory. */
830 switch (d & DstMask) {
832 /* Special instructions do their own operand decoding. */
837 && !(twobyte && (b == 0xb6 || b == 0xb7))) {
838 dst.ptr = decode_register(modrm_reg, _regs,
840 dst.val = *(u8 *) dst.ptr;
843 dst.ptr = decode_register(modrm_reg, _regs, 0);
844 switch ((dst.bytes = op_bytes)) {
846 dst.val = *(u16 *)dst.ptr;
849 dst.val = *(u32 *)dst.ptr;
852 dst.val = *(u64 *)dst.ptr;
859 dst.ptr = (unsigned long *)cr2;
860 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
862 unsigned long mask = ~(dst.bytes * 8 - 1);
864 dst.ptr = (void *)dst.ptr + (src.val & mask) / 8;
866 if (!(d & Mov) && /* optimisation - avoid slow emulated read */
867 ((rc = ops->read_emulated((unsigned long)dst.ptr,
868 &dst.val, dst.bytes, ctxt->vcpu)) != 0))
872 dst.orig_val = dst.val;
880 emulate_2op_SrcV("add", src, dst, _eflags);
884 emulate_2op_SrcV("or", src, dst, _eflags);
888 emulate_2op_SrcV("adc", src, dst, _eflags);
892 emulate_2op_SrcV("sbb", src, dst, _eflags);
896 emulate_2op_SrcV("and", src, dst, _eflags);
898 case 0x24: /* and al imm8 */
900 dst.ptr = &_regs[VCPU_REGS_RAX];
901 dst.val = *(u8 *)dst.ptr;
903 dst.orig_val = dst.val;
905 case 0x25: /* and ax imm16, or eax imm32 */
907 dst.bytes = op_bytes;
908 dst.ptr = &_regs[VCPU_REGS_RAX];
910 dst.val = *(u16 *)dst.ptr;
912 dst.val = *(u32 *)dst.ptr;
913 dst.orig_val = dst.val;
917 emulate_2op_SrcV("sub", src, dst, _eflags);
921 emulate_2op_SrcV("xor", src, dst, _eflags);
925 emulate_2op_SrcV("cmp", src, dst, _eflags);
927 case 0x63: /* movsxd */
928 if (mode != X86EMUL_MODE_PROT64)
930 dst.val = (s32) src.val;
932 case 0x80 ... 0x83: /* Grp1 */
954 emulate_2op_SrcV("test", src, dst, _eflags);
956 case 0x86 ... 0x87: /* xchg */
957 /* Write back the register source. */
960 *(u8 *) src.ptr = (u8) dst.val;
963 *(u16 *) src.ptr = (u16) dst.val;
966 *src.ptr = (u32) dst.val;
967 break; /* 64b reg: zero-extend */
973 * Write back the memory destination with implicit LOCK
979 case 0xa0 ... 0xa1: /* mov */
980 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
982 _eip += ad_bytes; /* skip src displacement */
984 case 0xa2 ... 0xa3: /* mov */
985 dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
986 _eip += ad_bytes; /* skip dst displacement */
988 case 0x88 ... 0x8b: /* mov */
989 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
992 case 0x8f: /* pop (sole member of Grp1a) */
993 /* 64-bit mode: POP always pops a 64-bit operand. */
994 if (mode == X86EMUL_MODE_PROT64)
996 if ((rc = ops->read_std(register_address(ctxt->ss_base,
997 _regs[VCPU_REGS_RSP]),
998 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
1000 register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
1004 switch (modrm_reg) {
1006 emulate_2op_SrcB("rol", src, dst, _eflags);
1009 emulate_2op_SrcB("ror", src, dst, _eflags);
1012 emulate_2op_SrcB("rcl", src, dst, _eflags);
1015 emulate_2op_SrcB("rcr", src, dst, _eflags);
1017 case 4: /* sal/shl */
1018 case 6: /* sal/shl */
1019 emulate_2op_SrcB("sal", src, dst, _eflags);
1022 emulate_2op_SrcB("shr", src, dst, _eflags);
1025 emulate_2op_SrcB("sar", src, dst, _eflags);
1029 case 0xd0 ... 0xd1: /* Grp2 */
1032 case 0xd2 ... 0xd3: /* Grp2 */
1033 src.val = _regs[VCPU_REGS_RCX];
1035 case 0xe9: /* jmp rel */
1036 case 0xeb: /* jmp rel short */
1038 no_wb = 1; /* Disable writeback. */
1040 case 0xf6 ... 0xf7: /* Grp3 */
1041 switch (modrm_reg) {
1042 case 0 ... 1: /* test */
1044 * Special case in Grp3: test has an immediate
1048 src.ptr = (unsigned long *)_eip;
1049 src.bytes = (d & ByteOp) ? 1 : op_bytes;
1052 switch (src.bytes) {
1054 src.val = insn_fetch(s8, 1, _eip);
1057 src.val = insn_fetch(s16, 2, _eip);
1060 src.val = insn_fetch(s32, 4, _eip);
1068 emulate_1op("neg", dst, _eflags);
1071 goto cannot_emulate;
1074 case 0xfe ... 0xff: /* Grp4/Grp5 */
1075 switch (modrm_reg) {
1077 emulate_1op("inc", dst, _eflags);
1080 emulate_1op("dec", dst, _eflags);
1083 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1084 if (mode == X86EMUL_MODE_PROT64) {
1086 if ((rc = ops->read_std((unsigned long)dst.ptr,
1091 register_address_increment(_regs[VCPU_REGS_RSP],
1093 if ((rc = ops->write_std(
1094 register_address(ctxt->ss_base,
1095 _regs[VCPU_REGS_RSP]),
1096 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
1101 goto cannot_emulate;
1110 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1111 switch (dst.bytes) {
1113 *(u8 *)dst.ptr = (u8)dst.val;
1116 *(u16 *)dst.ptr = (u16)dst.val;
1119 *dst.ptr = (u32)dst.val;
1120 break; /* 64b: zero-ext */
1128 rc = ops->cmpxchg_emulated((unsigned long)dst.
1130 &dst.val, dst.bytes,
1133 rc = ops->write_emulated((unsigned long)dst.ptr,
1134 &dst.val, dst.bytes,
1143 /* Commit shadow register state. */
1144 memcpy(ctxt->vcpu->regs, _regs, sizeof _regs);
1145 ctxt->eflags = _eflags;
1146 ctxt->vcpu->rip = _eip;
1149 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1153 goto twobyte_special_insn;
1155 case 0x50 ... 0x57: /* push reg */
1157 src.val = (u16) _regs[b & 0x7];
1159 src.val = (u32) _regs[b & 0x7];
1161 dst.bytes = op_bytes;
1163 register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
1164 dst.ptr = (void *) register_address(
1165 ctxt->ss_base, _regs[VCPU_REGS_RSP]);
1167 case 0x6c: /* insb */
1168 case 0x6d: /* insw/insd */
1169 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1171 (d & ByteOp) ? 1 : op_bytes, /* size */
1173 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
1174 (_eflags & EFLG_DF), /* down */
1175 register_address(ctxt->es_base,
1176 _regs[VCPU_REGS_RDI]), /* address */
1178 _regs[VCPU_REGS_RDX] /* port */
1182 case 0x6e: /* outsb */
1183 case 0x6f: /* outsw/outsd */
1184 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1186 (d & ByteOp) ? 1 : op_bytes, /* size */
1188 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
1189 (_eflags & EFLG_DF), /* down */
1190 register_address(override_base ?
1191 *override_base : ctxt->ds_base,
1192 _regs[VCPU_REGS_RSI]), /* address */
1194 _regs[VCPU_REGS_RDX] /* port */
1200 if (_regs[VCPU_REGS_RCX] == 0) {
1201 ctxt->vcpu->rip = _eip;
1204 _regs[VCPU_REGS_RCX]--;
1205 _eip = ctxt->vcpu->rip;
1208 case 0xa4 ... 0xa5: /* movs */
1210 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1211 dst.ptr = (unsigned long *)register_address(ctxt->es_base,
1212 _regs[VCPU_REGS_RDI]);
1213 if ((rc = ops->read_emulated(register_address(
1214 override_base ? *override_base : ctxt->ds_base,
1215 _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt->vcpu)) != 0)
1217 register_address_increment(_regs[VCPU_REGS_RSI],
1218 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1219 register_address_increment(_regs[VCPU_REGS_RDI],
1220 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1222 case 0xa6 ... 0xa7: /* cmps */
1223 DPRINTF("Urk! I don't handle CMPS.\n");
1224 goto cannot_emulate;
1225 case 0xaa ... 0xab: /* stos */
1227 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1228 dst.ptr = (unsigned long *)cr2;
1229 dst.val = _regs[VCPU_REGS_RAX];
1230 register_address_increment(_regs[VCPU_REGS_RDI],
1231 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1233 case 0xac ... 0xad: /* lods */
1235 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1236 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1237 if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes,
1240 register_address_increment(_regs[VCPU_REGS_RSI],
1241 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1243 case 0xae ... 0xaf: /* scas */
1244 DPRINTF("Urk! I don't handle SCAS.\n");
1245 goto cannot_emulate;
1246 case 0xf4: /* hlt */
1247 ctxt->vcpu->halt_request = 1;
1249 case 0xc3: /* ret */
1251 goto pop_instruction;
1252 case 0x58 ... 0x5f: /* pop reg */
1253 dst.ptr = (unsigned long *)&_regs[b & 0x7];
1256 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1257 _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt->vcpu))
1261 register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
1262 no_wb = 1; /* Disable writeback. */
1269 case 0x01: /* lgdt, lidt, lmsw */
1270 /* Disable writeback. */
1272 switch (modrm_reg) {
1274 unsigned long address;
1277 rc = read_descriptor(ctxt, ops, src.ptr,
1278 &size, &address, op_bytes);
1281 realmode_lgdt(ctxt->vcpu, size, address);
1284 rc = read_descriptor(ctxt, ops, src.ptr,
1285 &size, &address, op_bytes);
1288 realmode_lidt(ctxt->vcpu, size, address);
1292 goto cannot_emulate;
1293 *(u16 *)&_regs[modrm_rm]
1294 = realmode_get_cr(ctxt->vcpu, 0);
1298 goto cannot_emulate;
1299 realmode_lmsw(ctxt->vcpu, (u16)modrm_val, &_eflags);
1302 emulate_invlpg(ctxt->vcpu, cr2);
1305 goto cannot_emulate;
1308 case 0x21: /* mov from dr to reg */
1311 goto cannot_emulate;
1312 rc = emulator_get_dr(ctxt, modrm_reg, &_regs[modrm_rm]);
1314 case 0x23: /* mov from reg to dr */
1317 goto cannot_emulate;
1318 rc = emulator_set_dr(ctxt, modrm_reg, _regs[modrm_rm]);
1320 case 0x40 ... 0x4f: /* cmov */
1321 dst.val = dst.orig_val = src.val;
1324 * First, assume we're decoding an even cmov opcode
1327 switch ((b & 15) >> 1) {
1329 no_wb = (_eflags & EFLG_OF) ? 0 : 1;
1331 case 1: /* cmovb/cmovc/cmovnae */
1332 no_wb = (_eflags & EFLG_CF) ? 0 : 1;
1334 case 2: /* cmovz/cmove */
1335 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
1337 case 3: /* cmovbe/cmovna */
1338 no_wb = (_eflags & (EFLG_CF | EFLG_ZF)) ? 0 : 1;
1341 no_wb = (_eflags & EFLG_SF) ? 0 : 1;
1343 case 5: /* cmovp/cmovpe */
1344 no_wb = (_eflags & EFLG_PF) ? 0 : 1;
1346 case 7: /* cmovle/cmovng */
1347 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
1349 case 6: /* cmovl/cmovnge */
1350 no_wb &= (!(_eflags & EFLG_SF) !=
1351 !(_eflags & EFLG_OF)) ? 0 : 1;
1354 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
1357 case 0xb0 ... 0xb1: /* cmpxchg */
1359 * Save real source value, then compare EAX against
1362 src.orig_val = src.val;
1363 src.val = _regs[VCPU_REGS_RAX];
1364 emulate_2op_SrcV("cmp", src, dst, _eflags);
1365 if (_eflags & EFLG_ZF) {
1366 /* Success: write back to memory. */
1367 dst.val = src.orig_val;
1369 /* Failure: write the value we saw to EAX. */
1371 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1376 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1377 emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
1381 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1382 emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
1386 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1387 emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
1389 case 0xb6 ... 0xb7: /* movzx */
1390 dst.bytes = op_bytes;
1391 dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
1395 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1396 emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
1398 case 0xba: /* Grp8 */
1399 switch (modrm_reg & 3) {
1410 case 0xbe ... 0xbf: /* movsx */
1411 dst.bytes = op_bytes;
1412 dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
1417 twobyte_special_insn:
1418 /* Disable writeback. */
1421 case 0x09: /* wbinvd */
1423 case 0x0d: /* GrpP (prefetch) */
1424 case 0x18: /* Grp16 (prefetch/nop) */
1427 emulate_clts(ctxt->vcpu);
1429 case 0x20: /* mov cr, reg */
1431 goto cannot_emulate;
1432 _regs[modrm_rm] = realmode_get_cr(ctxt->vcpu, modrm_reg);
1434 case 0x22: /* mov reg, cr */
1436 goto cannot_emulate;
1437 realmode_set_cr(ctxt->vcpu, modrm_reg, modrm_val, &_eflags);
1441 msr_data = (u32)_regs[VCPU_REGS_RAX]
1442 | ((u64)_regs[VCPU_REGS_RDX] << 32);
1443 rc = kvm_set_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], msr_data);
1445 kvm_arch_ops->inject_gp(ctxt->vcpu, 0);
1446 _eip = ctxt->vcpu->rip;
1448 rc = X86EMUL_CONTINUE;
1452 rc = kvm_get_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], &msr_data);
1454 kvm_arch_ops->inject_gp(ctxt->vcpu, 0);
1455 _eip = ctxt->vcpu->rip;
1457 _regs[VCPU_REGS_RAX] = (u32)msr_data;
1458 _regs[VCPU_REGS_RDX] = msr_data >> 32;
1460 rc = X86EMUL_CONTINUE;
1462 case 0xc7: /* Grp9 (cmpxchg8b) */
1465 if ((rc = ops->read_emulated(cr2, &old, 8, ctxt->vcpu))
1468 if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
1469 ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
1470 _regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1471 _regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1472 _eflags &= ~EFLG_ZF;
1474 new = ((u64)_regs[VCPU_REGS_RCX] << 32)
1475 | (u32) _regs[VCPU_REGS_RBX];
1476 if ((rc = ops->cmpxchg_emulated(cr2, &old,
1477 &new, 8, ctxt->vcpu)) != 0)
1487 DPRINTF("Cannot emulate %02x\n", b);
1494 #include <asm/uaccess.h>
1497 x86_emulate_read_std(unsigned long addr,
1499 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1505 if ((rc = copy_from_user((void *)val, (void *)addr, bytes)) != 0) {
1506 propagate_page_fault(addr + bytes - rc, 0); /* read fault */
1507 return X86EMUL_PROPAGATE_FAULT;
1510 return X86EMUL_CONTINUE;
1514 x86_emulate_write_std(unsigned long addr,
1516 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1520 if ((rc = copy_to_user((void *)addr, (void *)&val, bytes)) != 0) {
1521 propagate_page_fault(addr + bytes - rc, PGERR_write_access);
1522 return X86EMUL_PROPAGATE_FAULT;
1525 return X86EMUL_CONTINUE;