1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf( _f , ## _a )
29 #define DPRINTF(x...) do {} while (0)
31 #include "x86_emulate.h"
32 #include <linux/module.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
66 static u8 opcode_table[256] = {
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 SrcImmByte, SrcImm, 0, 0,
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
102 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
103 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
106 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
108 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
111 0, 0, ImplicitOps|Mov, 0,
112 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
113 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
115 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
117 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
118 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
119 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
120 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
122 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
123 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
124 0, 0, 0, DstMem | SrcNone | ModRM | Mov,
126 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps, 0, 0, 0,
128 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
129 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
130 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
131 ByteOp | ImplicitOps, ImplicitOps,
133 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
134 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
135 ByteOp | ImplicitOps, ImplicitOps,
137 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
139 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
140 0, ImplicitOps, 0, 0,
141 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
143 0, 0, 0, 0, 0, 0, 0, 0,
145 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
146 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
149 0, 0, 0, 0, 0, 0, 0, 0,
151 0, 0, 0, 0, 0, 0, 0, 0,
153 ImplicitOps, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps, 0, 0, 0, 0,
157 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
160 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
163 static u16 twobyte_table[256] = {
165 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
166 0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
168 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
170 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
171 0, 0, 0, 0, 0, 0, 0, 0,
173 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
175 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
176 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
177 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
178 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
180 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
181 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
182 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
183 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
185 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
187 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
189 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
191 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
193 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
195 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
197 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
199 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
200 DstMem | SrcReg | ModRM | BitOp,
201 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
202 DstReg | SrcMem16 | ModRM | Mov,
204 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
205 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
206 DstReg | SrcMem16 | ModRM | Mov,
208 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
210 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
212 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
214 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
217 /* Type, address-of, and value of an instruction's operand. */
219 enum { OP_REG, OP_MEM, OP_IMM } type;
221 unsigned long val, orig_val, *ptr;
224 /* EFLAGS bit definitions. */
225 #define EFLG_OF (1<<11)
226 #define EFLG_DF (1<<10)
227 #define EFLG_SF (1<<7)
228 #define EFLG_ZF (1<<6)
229 #define EFLG_AF (1<<4)
230 #define EFLG_PF (1<<2)
231 #define EFLG_CF (1<<0)
234 * Instruction emulation:
235 * Most instructions are emulated directly via a fragment of inline assembly
236 * code. This allows us to save/restore EFLAGS and thus very easily pick up
237 * any modified flags.
240 #if defined(CONFIG_X86_64)
241 #define _LO32 "k" /* force 32-bit operand */
242 #define _STK "%%rsp" /* stack pointer */
243 #elif defined(__i386__)
244 #define _LO32 "" /* force 32-bit operand */
245 #define _STK "%%esp" /* stack pointer */
249 * These EFLAGS bits are restored from saved value during emulation, and
250 * any changes are written back to the saved value after emulation.
252 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
254 /* Before executing instruction: restore necessary bits in EFLAGS. */
255 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
256 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
258 "movl %"_msk",%"_LO32 _tmp"; " \
259 "andl %"_LO32 _tmp",("_STK"); " \
261 "notl %"_LO32 _tmp"; " \
262 "andl %"_LO32 _tmp",("_STK"); " \
264 "orl %"_LO32 _tmp",("_STK"); " \
266 /* _sav &= ~msk; */ \
267 "movl %"_msk",%"_LO32 _tmp"; " \
268 "notl %"_LO32 _tmp"; " \
269 "andl %"_LO32 _tmp",%"_sav"; "
271 /* After executing instruction: write-back necessary bits in EFLAGS. */
272 #define _POST_EFLAGS(_sav, _msk, _tmp) \
273 /* _sav |= EFLAGS & _msk; */ \
276 "andl %"_msk",%"_LO32 _tmp"; " \
277 "orl %"_LO32 _tmp",%"_sav"; "
279 /* Raw emulation: instruction has two explicit operands. */
280 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
282 unsigned long _tmp; \
284 switch ((_dst).bytes) { \
286 __asm__ __volatile__ ( \
287 _PRE_EFLAGS("0","4","2") \
288 _op"w %"_wx"3,%1; " \
289 _POST_EFLAGS("0","4","2") \
290 : "=m" (_eflags), "=m" ((_dst).val), \
292 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
295 __asm__ __volatile__ ( \
296 _PRE_EFLAGS("0","4","2") \
297 _op"l %"_lx"3,%1; " \
298 _POST_EFLAGS("0","4","2") \
299 : "=m" (_eflags), "=m" ((_dst).val), \
301 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
304 __emulate_2op_8byte(_op, _src, _dst, \
305 _eflags, _qx, _qy); \
310 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
312 unsigned long _tmp; \
313 switch ( (_dst).bytes ) \
316 __asm__ __volatile__ ( \
317 _PRE_EFLAGS("0","4","2") \
318 _op"b %"_bx"3,%1; " \
319 _POST_EFLAGS("0","4","2") \
320 : "=m" (_eflags), "=m" ((_dst).val), \
322 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
325 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
326 _wx, _wy, _lx, _ly, _qx, _qy); \
331 /* Source operand is byte-sized and may be restricted to just %cl. */
332 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
333 __emulate_2op(_op, _src, _dst, _eflags, \
334 "b", "c", "b", "c", "b", "c", "b", "c")
336 /* Source operand is byte, word, long or quad sized. */
337 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
338 __emulate_2op(_op, _src, _dst, _eflags, \
339 "b", "q", "w", "r", _LO32, "r", "", "r")
341 /* Source operand is word, long or quad sized. */
342 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
343 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
344 "w", "r", _LO32, "r", "", "r")
346 /* Instruction has only one explicit operand (no source operand). */
347 #define emulate_1op(_op, _dst, _eflags) \
349 unsigned long _tmp; \
351 switch ( (_dst).bytes ) \
354 __asm__ __volatile__ ( \
355 _PRE_EFLAGS("0","3","2") \
357 _POST_EFLAGS("0","3","2") \
358 : "=m" (_eflags), "=m" ((_dst).val), \
360 : "i" (EFLAGS_MASK) ); \
363 __asm__ __volatile__ ( \
364 _PRE_EFLAGS("0","3","2") \
366 _POST_EFLAGS("0","3","2") \
367 : "=m" (_eflags), "=m" ((_dst).val), \
369 : "i" (EFLAGS_MASK) ); \
372 __asm__ __volatile__ ( \
373 _PRE_EFLAGS("0","3","2") \
375 _POST_EFLAGS("0","3","2") \
376 : "=m" (_eflags), "=m" ((_dst).val), \
378 : "i" (EFLAGS_MASK) ); \
381 __emulate_1op_8byte(_op, _dst, _eflags); \
386 /* Emulate an instruction with quadword operands (x86/64 only). */
387 #if defined(CONFIG_X86_64)
388 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
390 __asm__ __volatile__ ( \
391 _PRE_EFLAGS("0","4","2") \
392 _op"q %"_qx"3,%1; " \
393 _POST_EFLAGS("0","4","2") \
394 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
395 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
398 #define __emulate_1op_8byte(_op, _dst, _eflags) \
400 __asm__ __volatile__ ( \
401 _PRE_EFLAGS("0","3","2") \
403 _POST_EFLAGS("0","3","2") \
404 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
405 : "i" (EFLAGS_MASK) ); \
408 #elif defined(__i386__)
409 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
410 #define __emulate_1op_8byte(_op, _dst, _eflags)
411 #endif /* __i386__ */
413 /* Fetch next part of the instruction being emulated. */
414 #define insn_fetch(_type, _size, _eip) \
415 ({ unsigned long _x; \
416 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
417 (_size), ctxt->vcpu); \
424 /* Access/update address held in a register, based on addressing mode. */
425 #define address_mask(reg) \
426 ((ad_bytes == sizeof(unsigned long)) ? \
427 (reg) : ((reg) & ((1UL << (ad_bytes << 3)) - 1)))
428 #define register_address(base, reg) \
429 ((base) + address_mask(reg))
430 #define register_address_increment(reg, inc) \
432 /* signed type ensures sign extension to long */ \
434 if ( ad_bytes == sizeof(unsigned long) ) \
437 (reg) = ((reg) & ~((1UL << (ad_bytes << 3)) - 1)) | \
438 (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
441 #define JMP_REL(rel) \
443 _eip += (int)(rel); \
444 _eip = ((op_bytes == 2) ? (uint16_t)_eip : (uint32_t)_eip); \
448 * Given the 'reg' portion of a ModRM byte, and a register block, return a
449 * pointer into the block that addresses the relevant register.
450 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
452 static void *decode_register(u8 modrm_reg, unsigned long *regs,
457 p = ®s[modrm_reg];
458 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
459 p = (unsigned char *)®s[modrm_reg & 3] + 1;
463 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
464 struct x86_emulate_ops *ops,
466 u16 *size, unsigned long *address, int op_bytes)
473 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
477 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
483 x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
486 u8 b, sib, twobyte = 0, rex_prefix = 0;
487 u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
488 unsigned long *override_base = NULL;
489 unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
491 struct operand src, dst;
492 unsigned long cr2 = ctxt->cr2;
493 int mode = ctxt->mode;
494 unsigned long modrm_ea;
495 int use_modrm_ea, index_reg = 0, base_reg = 0, scale, rip_relative = 0;
499 /* Shadow copy of register state. Committed on successful emulation. */
500 unsigned long _regs[NR_VCPU_REGS];
501 unsigned long _eip = ctxt->vcpu->rip, _eflags = ctxt->eflags;
502 unsigned long modrm_val = 0;
504 memcpy(_regs, ctxt->vcpu->regs, sizeof _regs);
507 case X86EMUL_MODE_REAL:
508 case X86EMUL_MODE_PROT16:
509 op_bytes = ad_bytes = 2;
511 case X86EMUL_MODE_PROT32:
512 op_bytes = ad_bytes = 4;
515 case X86EMUL_MODE_PROT64:
524 /* Legacy prefixes. */
525 for (i = 0; i < 8; i++) {
526 switch (b = insn_fetch(u8, 1, _eip)) {
527 case 0x66: /* operand-size override */
528 op_bytes ^= 6; /* switch between 2/4 bytes */
530 case 0x67: /* address-size override */
531 if (mode == X86EMUL_MODE_PROT64)
532 ad_bytes ^= 12; /* switch between 4/8 bytes */
534 ad_bytes ^= 6; /* switch between 2/4 bytes */
536 case 0x2e: /* CS override */
537 override_base = &ctxt->cs_base;
539 case 0x3e: /* DS override */
540 override_base = &ctxt->ds_base;
542 case 0x26: /* ES override */
543 override_base = &ctxt->es_base;
545 case 0x64: /* FS override */
546 override_base = &ctxt->fs_base;
548 case 0x65: /* GS override */
549 override_base = &ctxt->gs_base;
551 case 0x36: /* SS override */
552 override_base = &ctxt->ss_base;
554 case 0xf0: /* LOCK */
557 case 0xf3: /* REP/REPE/REPZ */
560 case 0xf2: /* REPNE/REPNZ */
570 if ((mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40)) {
573 op_bytes = 8; /* REX.W */
574 modrm_reg = (b & 4) << 1; /* REX.R */
575 index_reg = (b & 2) << 2; /* REX.X */
576 modrm_rm = base_reg = (b & 1) << 3; /* REG.B */
577 b = insn_fetch(u8, 1, _eip);
580 /* Opcode byte(s). */
583 /* Two-byte opcode? */
586 b = insn_fetch(u8, 1, _eip);
587 d = twobyte_table[b];
595 /* ModRM and SIB bytes. */
597 modrm = insn_fetch(u8, 1, _eip);
598 modrm_mod |= (modrm & 0xc0) >> 6;
599 modrm_reg |= (modrm & 0x38) >> 3;
600 modrm_rm |= (modrm & 0x07);
604 if (modrm_mod == 3) {
605 modrm_val = *(unsigned long *)
606 decode_register(modrm_rm, _regs, d & ByteOp);
611 unsigned bx = _regs[VCPU_REGS_RBX];
612 unsigned bp = _regs[VCPU_REGS_RBP];
613 unsigned si = _regs[VCPU_REGS_RSI];
614 unsigned di = _regs[VCPU_REGS_RDI];
616 /* 16-bit ModR/M decode. */
620 modrm_ea += insn_fetch(u16, 2, _eip);
623 modrm_ea += insn_fetch(s8, 1, _eip);
626 modrm_ea += insn_fetch(u16, 2, _eip);
656 if (modrm_rm == 2 || modrm_rm == 3 ||
657 (modrm_rm == 6 && modrm_mod != 0))
659 override_base = &ctxt->ss_base;
660 modrm_ea = (u16)modrm_ea;
662 /* 32/64-bit ModR/M decode. */
666 sib = insn_fetch(u8, 1, _eip);
667 index_reg |= (sib >> 3) & 7;
674 modrm_ea += _regs[base_reg];
676 modrm_ea += insn_fetch(s32, 4, _eip);
679 modrm_ea += _regs[base_reg];
685 modrm_ea += _regs[index_reg] << scale;
691 modrm_ea += _regs[modrm_rm];
692 else if (mode == X86EMUL_MODE_PROT64)
696 modrm_ea += _regs[modrm_rm];
702 modrm_ea += insn_fetch(s32, 4, _eip);
705 modrm_ea += insn_fetch(s8, 1, _eip);
708 modrm_ea += insn_fetch(s32, 4, _eip);
713 override_base = &ctxt->ds_base;
714 if (mode == X86EMUL_MODE_PROT64 &&
715 override_base != &ctxt->fs_base &&
716 override_base != &ctxt->gs_base)
717 override_base = NULL;
720 modrm_ea += *override_base;
724 switch (d & SrcMask) {
735 modrm_ea += op_bytes;
739 modrm_ea = (u32)modrm_ea;
746 * Decode and fetch the source operand: register, memory
749 switch (d & SrcMask) {
755 src.ptr = decode_register(modrm_reg, _regs,
757 src.val = src.orig_val = *(u8 *) src.ptr;
760 src.ptr = decode_register(modrm_reg, _regs, 0);
761 switch ((src.bytes = op_bytes)) {
763 src.val = src.orig_val = *(u16 *) src.ptr;
766 src.val = src.orig_val = *(u32 *) src.ptr;
769 src.val = src.orig_val = *(u64 *) src.ptr;
781 src.bytes = (d & ByteOp) ? 1 : op_bytes;
782 /* Don't fetch the address for invlpg: it could be unmapped. */
783 if (twobyte && b == 0x01 && modrm_reg == 7)
787 src.ptr = (unsigned long *)cr2;
788 if ((rc = ops->read_emulated((unsigned long)src.ptr,
789 &src.val, src.bytes, ctxt->vcpu)) != 0)
791 src.orig_val = src.val;
795 src.ptr = (unsigned long *)_eip;
796 src.bytes = (d & ByteOp) ? 1 : op_bytes;
799 /* NB. Immediates are sign-extended as necessary. */
802 src.val = insn_fetch(s8, 1, _eip);
805 src.val = insn_fetch(s16, 2, _eip);
808 src.val = insn_fetch(s32, 4, _eip);
814 src.ptr = (unsigned long *)_eip;
816 src.val = insn_fetch(s8, 1, _eip);
820 /* Decode and fetch the destination operand: register or memory. */
821 switch (d & DstMask) {
823 /* Special instructions do their own operand decoding. */
828 && !(twobyte && (b == 0xb6 || b == 0xb7))) {
829 dst.ptr = decode_register(modrm_reg, _regs,
831 dst.val = *(u8 *) dst.ptr;
834 dst.ptr = decode_register(modrm_reg, _regs, 0);
835 switch ((dst.bytes = op_bytes)) {
837 dst.val = *(u16 *)dst.ptr;
840 dst.val = *(u32 *)dst.ptr;
843 dst.val = *(u64 *)dst.ptr;
850 dst.ptr = (unsigned long *)cr2;
851 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
853 unsigned long mask = ~(dst.bytes * 8 - 1);
855 dst.ptr = (void *)dst.ptr + (src.val & mask) / 8;
857 if (!(d & Mov) && /* optimisation - avoid slow emulated read */
858 ((rc = ops->read_emulated((unsigned long)dst.ptr,
859 &dst.val, dst.bytes, ctxt->vcpu)) != 0))
863 dst.orig_val = dst.val;
871 emulate_2op_SrcV("add", src, dst, _eflags);
875 emulate_2op_SrcV("or", src, dst, _eflags);
879 emulate_2op_SrcV("adc", src, dst, _eflags);
883 emulate_2op_SrcV("sbb", src, dst, _eflags);
887 emulate_2op_SrcV("and", src, dst, _eflags);
889 case 0x24: /* and al imm8 */
891 dst.ptr = &_regs[VCPU_REGS_RAX];
892 dst.val = *(u8 *)dst.ptr;
894 dst.orig_val = dst.val;
896 case 0x25: /* and ax imm16, or eax imm32 */
898 dst.bytes = op_bytes;
899 dst.ptr = &_regs[VCPU_REGS_RAX];
901 dst.val = *(u16 *)dst.ptr;
903 dst.val = *(u32 *)dst.ptr;
904 dst.orig_val = dst.val;
908 emulate_2op_SrcV("sub", src, dst, _eflags);
912 emulate_2op_SrcV("xor", src, dst, _eflags);
916 emulate_2op_SrcV("cmp", src, dst, _eflags);
918 case 0x63: /* movsxd */
919 if (mode != X86EMUL_MODE_PROT64)
921 dst.val = (s32) src.val;
923 case 0x6a: /* push imm8 */
925 src.val = insn_fetch(s8, 1, _eip);
928 dst.bytes = op_bytes;
930 register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
931 dst.ptr = (void *) register_address(ctxt->ss_base,
932 _regs[VCPU_REGS_RSP]);
934 case 0x80 ... 0x83: /* Grp1 */
956 emulate_2op_SrcV("test", src, dst, _eflags);
958 case 0x86 ... 0x87: /* xchg */
959 /* Write back the register source. */
962 *(u8 *) src.ptr = (u8) dst.val;
965 *(u16 *) src.ptr = (u16) dst.val;
968 *src.ptr = (u32) dst.val;
969 break; /* 64b reg: zero-extend */
975 * Write back the memory destination with implicit LOCK
981 case 0x88 ... 0x8b: /* mov */
983 case 0x8f: /* pop (sole member of Grp1a) */
984 /* 64-bit mode: POP always pops a 64-bit operand. */
985 if (mode == X86EMUL_MODE_PROT64)
987 if ((rc = ops->read_std(register_address(ctxt->ss_base,
988 _regs[VCPU_REGS_RSP]),
989 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
991 register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
993 case 0xa0 ... 0xa1: /* mov */
994 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
996 _eip += ad_bytes; /* skip src displacement */
998 case 0xa2 ... 0xa3: /* mov */
999 dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
1000 _eip += ad_bytes; /* skip dst displacement */
1004 switch (modrm_reg) {
1006 emulate_2op_SrcB("rol", src, dst, _eflags);
1009 emulate_2op_SrcB("ror", src, dst, _eflags);
1012 emulate_2op_SrcB("rcl", src, dst, _eflags);
1015 emulate_2op_SrcB("rcr", src, dst, _eflags);
1017 case 4: /* sal/shl */
1018 case 6: /* sal/shl */
1019 emulate_2op_SrcB("sal", src, dst, _eflags);
1022 emulate_2op_SrcB("shr", src, dst, _eflags);
1025 emulate_2op_SrcB("sar", src, dst, _eflags);
1029 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1033 case 0xd0 ... 0xd1: /* Grp2 */
1036 case 0xd2 ... 0xd3: /* Grp2 */
1037 src.val = _regs[VCPU_REGS_RCX];
1039 case 0xe8: /* call (near) */ {
1043 rel = insn_fetch(s16, 2, _eip);
1046 rel = insn_fetch(s32, 4, _eip);
1049 rel = insn_fetch(s64, 8, _eip);
1052 DPRINTF("Call: Invalid op_bytes\n");
1053 goto cannot_emulate;
1055 src.val = (unsigned long) _eip;
1059 case 0xe9: /* jmp rel */
1060 case 0xeb: /* jmp rel short */
1062 no_wb = 1; /* Disable writeback. */
1064 case 0xf6 ... 0xf7: /* Grp3 */
1065 switch (modrm_reg) {
1066 case 0 ... 1: /* test */
1068 * Special case in Grp3: test has an immediate
1072 src.ptr = (unsigned long *)_eip;
1073 src.bytes = (d & ByteOp) ? 1 : op_bytes;
1076 switch (src.bytes) {
1078 src.val = insn_fetch(s8, 1, _eip);
1081 src.val = insn_fetch(s16, 2, _eip);
1084 src.val = insn_fetch(s32, 4, _eip);
1092 emulate_1op("neg", dst, _eflags);
1095 goto cannot_emulate;
1098 case 0xfe ... 0xff: /* Grp4/Grp5 */
1099 switch (modrm_reg) {
1101 emulate_1op("inc", dst, _eflags);
1104 emulate_1op("dec", dst, _eflags);
1107 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1108 if (mode == X86EMUL_MODE_PROT64) {
1110 if ((rc = ops->read_std((unsigned long)dst.ptr,
1115 register_address_increment(_regs[VCPU_REGS_RSP],
1117 if ((rc = ops->write_std(
1118 register_address(ctxt->ss_base,
1119 _regs[VCPU_REGS_RSP]),
1120 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
1125 goto cannot_emulate;
1134 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1135 switch (dst.bytes) {
1137 *(u8 *)dst.ptr = (u8)dst.val;
1140 *(u16 *)dst.ptr = (u16)dst.val;
1143 *dst.ptr = (u32)dst.val;
1144 break; /* 64b: zero-ext */
1152 rc = ops->cmpxchg_emulated((unsigned long)dst.
1154 &dst.val, dst.bytes,
1157 rc = ops->write_emulated((unsigned long)dst.ptr,
1158 &dst.val, dst.bytes,
1167 /* Commit shadow register state. */
1168 memcpy(ctxt->vcpu->regs, _regs, sizeof _regs);
1169 ctxt->eflags = _eflags;
1170 ctxt->vcpu->rip = _eip;
1173 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1177 goto twobyte_special_insn;
1179 case 0x50 ... 0x57: /* push reg */
1181 src.val = (u16) _regs[b & 0x7];
1183 src.val = (u32) _regs[b & 0x7];
1185 dst.bytes = op_bytes;
1187 register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
1188 dst.ptr = (void *) register_address(
1189 ctxt->ss_base, _regs[VCPU_REGS_RSP]);
1191 case 0x58 ... 0x5f: /* pop reg */
1192 dst.ptr = (unsigned long *)&_regs[b & 0x7];
1194 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1195 _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt->vcpu))
1199 register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
1200 no_wb = 1; /* Disable writeback. */
1202 case 0x6c: /* insb */
1203 case 0x6d: /* insw/insd */
1204 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1206 (d & ByteOp) ? 1 : op_bytes, /* size */
1208 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
1209 (_eflags & EFLG_DF), /* down */
1210 register_address(ctxt->es_base,
1211 _regs[VCPU_REGS_RDI]), /* address */
1213 _regs[VCPU_REGS_RDX] /* port */
1217 case 0x6e: /* outsb */
1218 case 0x6f: /* outsw/outsd */
1219 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1221 (d & ByteOp) ? 1 : op_bytes, /* size */
1223 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
1224 (_eflags & EFLG_DF), /* down */
1225 register_address(override_base ?
1226 *override_base : ctxt->ds_base,
1227 _regs[VCPU_REGS_RSI]), /* address */
1229 _regs[VCPU_REGS_RDX] /* port */
1233 case 0x9c: /* pushf */
1234 src.val = (unsigned long) _eflags;
1236 case 0xc3: /* ret */
1238 goto pop_instruction;
1239 case 0xf4: /* hlt */
1240 ctxt->vcpu->halt_request = 1;
1244 if (_regs[VCPU_REGS_RCX] == 0) {
1245 ctxt->vcpu->rip = _eip;
1248 _regs[VCPU_REGS_RCX]--;
1249 _eip = ctxt->vcpu->rip;
1252 case 0xa4 ... 0xa5: /* movs */
1254 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1255 dst.ptr = (unsigned long *)register_address(ctxt->es_base,
1256 _regs[VCPU_REGS_RDI]);
1257 if ((rc = ops->read_emulated(register_address(
1258 override_base ? *override_base : ctxt->ds_base,
1259 _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt->vcpu)) != 0)
1261 register_address_increment(_regs[VCPU_REGS_RSI],
1262 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1263 register_address_increment(_regs[VCPU_REGS_RDI],
1264 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1266 case 0xa6 ... 0xa7: /* cmps */
1267 DPRINTF("Urk! I don't handle CMPS.\n");
1268 goto cannot_emulate;
1269 case 0xaa ... 0xab: /* stos */
1271 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1272 dst.ptr = (unsigned long *)cr2;
1273 dst.val = _regs[VCPU_REGS_RAX];
1274 register_address_increment(_regs[VCPU_REGS_RDI],
1275 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1277 case 0xac ... 0xad: /* lods */
1279 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1280 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1281 if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes,
1284 register_address_increment(_regs[VCPU_REGS_RSI],
1285 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1287 case 0xae ... 0xaf: /* scas */
1288 DPRINTF("Urk! I don't handle SCAS.\n");
1289 goto cannot_emulate;
1296 case 0x01: /* lgdt, lidt, lmsw */
1297 /* Disable writeback. */
1299 switch (modrm_reg) {
1301 unsigned long address;
1304 rc = read_descriptor(ctxt, ops, src.ptr,
1305 &size, &address, op_bytes);
1308 realmode_lgdt(ctxt->vcpu, size, address);
1311 rc = read_descriptor(ctxt, ops, src.ptr,
1312 &size, &address, op_bytes);
1315 realmode_lidt(ctxt->vcpu, size, address);
1319 goto cannot_emulate;
1320 *(u16 *)&_regs[modrm_rm]
1321 = realmode_get_cr(ctxt->vcpu, 0);
1325 goto cannot_emulate;
1326 realmode_lmsw(ctxt->vcpu, (u16)modrm_val, &_eflags);
1329 emulate_invlpg(ctxt->vcpu, cr2);
1332 goto cannot_emulate;
1335 case 0x21: /* mov from dr to reg */
1338 goto cannot_emulate;
1339 rc = emulator_get_dr(ctxt, modrm_reg, &_regs[modrm_rm]);
1341 case 0x23: /* mov from reg to dr */
1344 goto cannot_emulate;
1345 rc = emulator_set_dr(ctxt, modrm_reg, _regs[modrm_rm]);
1347 case 0x40 ... 0x4f: /* cmov */
1348 dst.val = dst.orig_val = src.val;
1351 * First, assume we're decoding an even cmov opcode
1354 switch ((b & 15) >> 1) {
1356 no_wb = (_eflags & EFLG_OF) ? 0 : 1;
1358 case 1: /* cmovb/cmovc/cmovnae */
1359 no_wb = (_eflags & EFLG_CF) ? 0 : 1;
1361 case 2: /* cmovz/cmove */
1362 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
1364 case 3: /* cmovbe/cmovna */
1365 no_wb = (_eflags & (EFLG_CF | EFLG_ZF)) ? 0 : 1;
1368 no_wb = (_eflags & EFLG_SF) ? 0 : 1;
1370 case 5: /* cmovp/cmovpe */
1371 no_wb = (_eflags & EFLG_PF) ? 0 : 1;
1373 case 7: /* cmovle/cmovng */
1374 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
1376 case 6: /* cmovl/cmovnge */
1377 no_wb &= (!(_eflags & EFLG_SF) !=
1378 !(_eflags & EFLG_OF)) ? 0 : 1;
1381 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
1386 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1387 emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
1391 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1392 emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
1394 case 0xb0 ... 0xb1: /* cmpxchg */
1396 * Save real source value, then compare EAX against
1399 src.orig_val = src.val;
1400 src.val = _regs[VCPU_REGS_RAX];
1401 emulate_2op_SrcV("cmp", src, dst, _eflags);
1402 if (_eflags & EFLG_ZF) {
1403 /* Success: write back to memory. */
1404 dst.val = src.orig_val;
1406 /* Failure: write the value we saw to EAX. */
1408 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1413 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1414 emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
1416 case 0xb6 ... 0xb7: /* movzx */
1417 dst.bytes = op_bytes;
1418 dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
1420 case 0xba: /* Grp8 */
1421 switch (modrm_reg & 3) {
1434 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1435 emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
1437 case 0xbe ... 0xbf: /* movsx */
1438 dst.bytes = op_bytes;
1439 dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
1444 twobyte_special_insn:
1445 /* Disable writeback. */
1449 emulate_clts(ctxt->vcpu);
1451 case 0x09: /* wbinvd */
1453 case 0x0d: /* GrpP (prefetch) */
1454 case 0x18: /* Grp16 (prefetch/nop) */
1456 case 0x20: /* mov cr, reg */
1458 goto cannot_emulate;
1459 _regs[modrm_rm] = realmode_get_cr(ctxt->vcpu, modrm_reg);
1461 case 0x22: /* mov reg, cr */
1463 goto cannot_emulate;
1464 realmode_set_cr(ctxt->vcpu, modrm_reg, modrm_val, &_eflags);
1468 msr_data = (u32)_regs[VCPU_REGS_RAX]
1469 | ((u64)_regs[VCPU_REGS_RDX] << 32);
1470 rc = kvm_set_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], msr_data);
1472 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
1473 _eip = ctxt->vcpu->rip;
1475 rc = X86EMUL_CONTINUE;
1479 rc = kvm_get_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], &msr_data);
1481 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
1482 _eip = ctxt->vcpu->rip;
1484 _regs[VCPU_REGS_RAX] = (u32)msr_data;
1485 _regs[VCPU_REGS_RDX] = msr_data >> 32;
1487 rc = X86EMUL_CONTINUE;
1489 case 0xc7: /* Grp9 (cmpxchg8b) */
1492 if ((rc = ops->read_emulated(cr2, &old, 8, ctxt->vcpu))
1495 if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
1496 ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
1497 _regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1498 _regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1499 _eflags &= ~EFLG_ZF;
1501 new = ((u64)_regs[VCPU_REGS_RCX] << 32)
1502 | (u32) _regs[VCPU_REGS_RBX];
1503 if ((rc = ops->cmpxchg_emulated(cr2, &old,
1504 &new, 8, ctxt->vcpu)) != 0)
1514 DPRINTF("Cannot emulate %02x\n", b);
1521 #include <asm/uaccess.h>
1524 x86_emulate_read_std(unsigned long addr,
1526 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1532 if ((rc = copy_from_user((void *)val, (void *)addr, bytes)) != 0) {
1533 propagate_page_fault(addr + bytes - rc, 0); /* read fault */
1534 return X86EMUL_PROPAGATE_FAULT;
1537 return X86EMUL_CONTINUE;
1541 x86_emulate_write_std(unsigned long addr,
1543 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1547 if ((rc = copy_to_user((void *)addr, (void *)&val, bytes)) != 0) {
1548 propagate_page_fault(addr + bytes - rc, PGERR_write_access);
1549 return X86EMUL_PROPAGATE_FAULT;
1552 return X86EMUL_CONTINUE;