1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf(_f , ## _a)
28 #include <linux/kvm_host.h>
29 #define DPRINTF(x...) do {} while (0)
31 #include <linux/module.h>
32 #include <asm/kvm_x86_emulate.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
65 #define MemAbs (1<<9) /* Memory operand is absolute displacement */
66 #define String (1<<10) /* String instruction (rep capable) */
67 #define Stack (1<<11) /* Stack instruction (push/pop) */
68 #define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
69 #define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
70 #define GroupMask 0xff /* Group number stored in bits 0:7 */
73 Group1_80, Group1_81, Group1_82, Group1_83,
74 Group1A, Group3_Byte, Group3, Group4, Group5, Group7,
77 static u16 opcode_table[256] = {
79 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
80 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
83 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
84 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
87 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
88 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
91 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
92 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
95 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
96 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
97 SrcImmByte, SrcImm, 0, 0,
99 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
100 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
103 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
104 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
107 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
108 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
111 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
113 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
115 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
116 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
118 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
119 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
121 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
124 SrcImm | Mov | Stack, 0, SrcImmByte | Mov | Stack, 0,
125 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
126 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
128 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
129 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
131 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
132 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
134 Group | Group1_80, Group | Group1_81,
135 Group | Group1_82, Group | Group1_83,
136 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
137 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
139 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
140 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
141 DstMem | SrcReg | ModRM | Mov, ModRM | DstReg,
142 DstReg | SrcMem | ModRM | Mov, Group | Group1A,
144 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
146 0, 0, 0, 0, ImplicitOps | Stack, ImplicitOps | Stack, 0, 0,
148 ByteOp | DstReg | SrcMem | Mov | MemAbs, DstReg | SrcMem | Mov | MemAbs,
149 ByteOp | DstMem | SrcReg | Mov | MemAbs, DstMem | SrcReg | Mov | MemAbs,
150 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
151 ByteOp | ImplicitOps | String, ImplicitOps | String,
153 0, 0, ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
154 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
155 ByteOp | ImplicitOps | String, ImplicitOps | String,
157 0, 0, 0, 0, 0, 0, 0, 0,
158 DstReg | SrcImm | Mov, 0, 0, 0, 0, 0, 0, 0,
160 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
161 0, ImplicitOps | Stack, 0, 0,
162 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
164 0, 0, 0, 0, 0, 0, 0, 0,
166 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
167 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
170 0, 0, 0, 0, 0, 0, 0, 0,
172 0, 0, 0, 0, 0, 0, 0, 0,
174 ImplicitOps | Stack, SrcImm | ImplicitOps,
175 ImplicitOps, SrcImmByte | ImplicitOps,
179 ImplicitOps, ImplicitOps, Group | Group3_Byte, Group | Group3,
181 ImplicitOps, 0, ImplicitOps, ImplicitOps,
182 0, 0, Group | Group4, Group | Group5,
185 static u16 twobyte_table[256] = {
187 0, Group | GroupDual | Group7, 0, 0, 0, 0, ImplicitOps, 0,
188 ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
190 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
192 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
193 0, 0, 0, 0, 0, 0, 0, 0,
195 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
197 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
198 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
199 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
200 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
202 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
203 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
204 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
205 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
207 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
209 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
211 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
213 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
214 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
215 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
216 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
218 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
220 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
222 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
224 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
225 DstMem | SrcReg | ModRM | BitOp,
226 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
227 DstReg | SrcMem16 | ModRM | Mov,
229 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
230 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
231 DstReg | SrcMem16 | ModRM | Mov,
233 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
234 0, 0, 0, 0, 0, 0, 0, 0,
236 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
238 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
240 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
243 static u16 group_table[] = {
245 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
246 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
247 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
248 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
250 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
251 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
252 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
253 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
255 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
256 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
257 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
258 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
260 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
261 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
262 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
263 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
265 DstMem | SrcNone | ModRM | Mov | Stack, 0, 0, 0, 0, 0, 0, 0,
267 ByteOp | SrcImm | DstMem | ModRM, 0,
268 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
271 DstMem | SrcImm | ModRM | SrcImm, 0,
272 DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
275 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
278 DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM, 0, 0,
279 SrcMem | ModRM, 0, SrcMem | ModRM | Stack, 0,
281 0, 0, ModRM | SrcMem, ModRM | SrcMem,
282 SrcNone | ModRM | DstMem | Mov, 0,
283 SrcMem16 | ModRM | Mov, SrcMem | ModRM | ByteOp,
286 static u16 group2_table[] = {
288 SrcNone | ModRM, 0, 0, 0,
289 SrcNone | ModRM | DstMem | Mov, 0,
290 SrcMem16 | ModRM | Mov, 0,
293 /* EFLAGS bit definitions. */
294 #define EFLG_OF (1<<11)
295 #define EFLG_DF (1<<10)
296 #define EFLG_SF (1<<7)
297 #define EFLG_ZF (1<<6)
298 #define EFLG_AF (1<<4)
299 #define EFLG_PF (1<<2)
300 #define EFLG_CF (1<<0)
303 * Instruction emulation:
304 * Most instructions are emulated directly via a fragment of inline assembly
305 * code. This allows us to save/restore EFLAGS and thus very easily pick up
306 * any modified flags.
309 #if defined(CONFIG_X86_64)
310 #define _LO32 "k" /* force 32-bit operand */
311 #define _STK "%%rsp" /* stack pointer */
312 #elif defined(__i386__)
313 #define _LO32 "" /* force 32-bit operand */
314 #define _STK "%%esp" /* stack pointer */
318 * These EFLAGS bits are restored from saved value during emulation, and
319 * any changes are written back to the saved value after emulation.
321 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
323 /* Before executing instruction: restore necessary bits in EFLAGS. */
324 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
325 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
326 "movl %"_sav",%"_LO32 _tmp"; " \
329 "movl %"_msk",%"_LO32 _tmp"; " \
330 "andl %"_LO32 _tmp",("_STK"); " \
332 "notl %"_LO32 _tmp"; " \
333 "andl %"_LO32 _tmp",("_STK"); " \
334 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
336 "orl %"_LO32 _tmp",("_STK"); " \
340 /* After executing instruction: write-back necessary bits in EFLAGS. */
341 #define _POST_EFLAGS(_sav, _msk, _tmp) \
342 /* _sav |= EFLAGS & _msk; */ \
345 "andl %"_msk",%"_LO32 _tmp"; " \
346 "orl %"_LO32 _tmp",%"_sav"; "
348 /* Raw emulation: instruction has two explicit operands. */
349 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
351 unsigned long _tmp; \
353 switch ((_dst).bytes) { \
355 __asm__ __volatile__ ( \
356 _PRE_EFLAGS("0", "4", "2") \
357 _op"w %"_wx"3,%1; " \
358 _POST_EFLAGS("0", "4", "2") \
359 : "=m" (_eflags), "=m" ((_dst).val), \
361 : _wy ((_src).val), "i" (EFLAGS_MASK)); \
364 __asm__ __volatile__ ( \
365 _PRE_EFLAGS("0", "4", "2") \
366 _op"l %"_lx"3,%1; " \
367 _POST_EFLAGS("0", "4", "2") \
368 : "=m" (_eflags), "=m" ((_dst).val), \
370 : _ly ((_src).val), "i" (EFLAGS_MASK)); \
373 __emulate_2op_8byte(_op, _src, _dst, \
374 _eflags, _qx, _qy); \
379 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
381 unsigned long __tmp; \
382 switch ((_dst).bytes) { \
384 __asm__ __volatile__ ( \
385 _PRE_EFLAGS("0", "4", "2") \
386 _op"b %"_bx"3,%1; " \
387 _POST_EFLAGS("0", "4", "2") \
388 : "=m" (_eflags), "=m" ((_dst).val), \
390 : _by ((_src).val), "i" (EFLAGS_MASK)); \
393 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
394 _wx, _wy, _lx, _ly, _qx, _qy); \
399 /* Source operand is byte-sized and may be restricted to just %cl. */
400 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
401 __emulate_2op(_op, _src, _dst, _eflags, \
402 "b", "c", "b", "c", "b", "c", "b", "c")
404 /* Source operand is byte, word, long or quad sized. */
405 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
406 __emulate_2op(_op, _src, _dst, _eflags, \
407 "b", "q", "w", "r", _LO32, "r", "", "r")
409 /* Source operand is word, long or quad sized. */
410 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
411 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
412 "w", "r", _LO32, "r", "", "r")
414 /* Instruction has only one explicit operand (no source operand). */
415 #define emulate_1op(_op, _dst, _eflags) \
417 unsigned long _tmp; \
419 switch ((_dst).bytes) { \
421 __asm__ __volatile__ ( \
422 _PRE_EFLAGS("0", "3", "2") \
424 _POST_EFLAGS("0", "3", "2") \
425 : "=m" (_eflags), "=m" ((_dst).val), \
427 : "i" (EFLAGS_MASK)); \
430 __asm__ __volatile__ ( \
431 _PRE_EFLAGS("0", "3", "2") \
433 _POST_EFLAGS("0", "3", "2") \
434 : "=m" (_eflags), "=m" ((_dst).val), \
436 : "i" (EFLAGS_MASK)); \
439 __asm__ __volatile__ ( \
440 _PRE_EFLAGS("0", "3", "2") \
442 _POST_EFLAGS("0", "3", "2") \
443 : "=m" (_eflags), "=m" ((_dst).val), \
445 : "i" (EFLAGS_MASK)); \
448 __emulate_1op_8byte(_op, _dst, _eflags); \
453 /* Emulate an instruction with quadword operands (x86/64 only). */
454 #if defined(CONFIG_X86_64)
455 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
457 __asm__ __volatile__ ( \
458 _PRE_EFLAGS("0", "4", "2") \
459 _op"q %"_qx"3,%1; " \
460 _POST_EFLAGS("0", "4", "2") \
461 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
462 : _qy ((_src).val), "i" (EFLAGS_MASK)); \
465 #define __emulate_1op_8byte(_op, _dst, _eflags) \
467 __asm__ __volatile__ ( \
468 _PRE_EFLAGS("0", "3", "2") \
470 _POST_EFLAGS("0", "3", "2") \
471 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
472 : "i" (EFLAGS_MASK)); \
475 #elif defined(__i386__)
476 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
477 #define __emulate_1op_8byte(_op, _dst, _eflags)
478 #endif /* __i386__ */
480 /* Fetch next part of the instruction being emulated. */
481 #define insn_fetch(_type, _size, _eip) \
482 ({ unsigned long _x; \
483 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
490 static inline unsigned long ad_mask(struct decode_cache *c)
492 return (1UL << (c->ad_bytes << 3)) - 1;
495 /* Access/update address held in a register, based on addressing mode. */
496 static inline unsigned long
497 address_mask(struct decode_cache *c, unsigned long reg)
499 if (c->ad_bytes == sizeof(unsigned long))
502 return reg & ad_mask(c);
505 static inline unsigned long
506 register_address(struct decode_cache *c, unsigned long base, unsigned long reg)
508 return base + address_mask(c, reg);
512 register_address_increment(struct decode_cache *c, unsigned long *reg, int inc)
514 if (c->ad_bytes == sizeof(unsigned long))
517 *reg = (*reg & ~ad_mask(c)) | ((*reg + inc) & ad_mask(c));
520 static inline void jmp_rel(struct decode_cache *c, int rel)
522 register_address_increment(c, &c->eip, rel);
525 static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
526 struct x86_emulate_ops *ops,
527 unsigned long linear, u8 *dest)
529 struct fetch_cache *fc = &ctxt->decode.fetch;
533 if (linear < fc->start || linear >= fc->end) {
534 size = min(15UL, PAGE_SIZE - offset_in_page(linear));
535 rc = ops->read_std(linear, fc->data, size, ctxt->vcpu);
539 fc->end = linear + size;
541 *dest = fc->data[linear - fc->start];
545 static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
546 struct x86_emulate_ops *ops,
547 unsigned long eip, void *dest, unsigned size)
551 eip += ctxt->cs_base;
553 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
561 * Given the 'reg' portion of a ModRM byte, and a register block, return a
562 * pointer into the block that addresses the relevant register.
563 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
565 static void *decode_register(u8 modrm_reg, unsigned long *regs,
570 p = ®s[modrm_reg];
571 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
572 p = (unsigned char *)®s[modrm_reg & 3] + 1;
576 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
577 struct x86_emulate_ops *ops,
579 u16 *size, unsigned long *address, int op_bytes)
586 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
590 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
595 static int test_cc(unsigned int condition, unsigned int flags)
599 switch ((condition & 15) >> 1) {
601 rc |= (flags & EFLG_OF);
603 case 1: /* b/c/nae */
604 rc |= (flags & EFLG_CF);
607 rc |= (flags & EFLG_ZF);
610 rc |= (flags & (EFLG_CF|EFLG_ZF));
613 rc |= (flags & EFLG_SF);
616 rc |= (flags & EFLG_PF);
619 rc |= (flags & EFLG_ZF);
622 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
626 /* Odd condition identifiers (lsb == 1) have inverted sense. */
627 return (!!rc ^ (condition & 1));
630 static void decode_register_operand(struct operand *op,
631 struct decode_cache *c,
634 unsigned reg = c->modrm_reg;
635 int highbyte_regs = c->rex_prefix == 0;
638 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
640 if ((c->d & ByteOp) && !inhibit_bytereg) {
641 op->ptr = decode_register(reg, c->regs, highbyte_regs);
642 op->val = *(u8 *)op->ptr;
645 op->ptr = decode_register(reg, c->regs, 0);
646 op->bytes = c->op_bytes;
649 op->val = *(u16 *)op->ptr;
652 op->val = *(u32 *)op->ptr;
655 op->val = *(u64 *) op->ptr;
659 op->orig_val = op->val;
662 static int decode_modrm(struct x86_emulate_ctxt *ctxt,
663 struct x86_emulate_ops *ops)
665 struct decode_cache *c = &ctxt->decode;
667 int index_reg = 0, base_reg = 0, scale, rip_relative = 0;
671 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
672 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
673 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
676 c->modrm = insn_fetch(u8, 1, c->eip);
677 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
678 c->modrm_reg |= (c->modrm & 0x38) >> 3;
679 c->modrm_rm |= (c->modrm & 0x07);
683 if (c->modrm_mod == 3) {
684 c->modrm_ptr = decode_register(c->modrm_rm,
685 c->regs, c->d & ByteOp);
686 c->modrm_val = *(unsigned long *)c->modrm_ptr;
690 if (c->ad_bytes == 2) {
691 unsigned bx = c->regs[VCPU_REGS_RBX];
692 unsigned bp = c->regs[VCPU_REGS_RBP];
693 unsigned si = c->regs[VCPU_REGS_RSI];
694 unsigned di = c->regs[VCPU_REGS_RDI];
696 /* 16-bit ModR/M decode. */
697 switch (c->modrm_mod) {
699 if (c->modrm_rm == 6)
700 c->modrm_ea += insn_fetch(u16, 2, c->eip);
703 c->modrm_ea += insn_fetch(s8, 1, c->eip);
706 c->modrm_ea += insn_fetch(u16, 2, c->eip);
709 switch (c->modrm_rm) {
711 c->modrm_ea += bx + si;
714 c->modrm_ea += bx + di;
717 c->modrm_ea += bp + si;
720 c->modrm_ea += bp + di;
729 if (c->modrm_mod != 0)
736 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
737 (c->modrm_rm == 6 && c->modrm_mod != 0))
738 if (!c->override_base)
739 c->override_base = &ctxt->ss_base;
740 c->modrm_ea = (u16)c->modrm_ea;
742 /* 32/64-bit ModR/M decode. */
743 switch (c->modrm_rm) {
746 sib = insn_fetch(u8, 1, c->eip);
747 index_reg |= (sib >> 3) & 7;
753 if (c->modrm_mod != 0)
754 c->modrm_ea += c->regs[base_reg];
757 insn_fetch(s32, 4, c->eip);
760 c->modrm_ea += c->regs[base_reg];
766 c->modrm_ea += c->regs[index_reg] << scale;
770 if (c->modrm_mod != 0)
771 c->modrm_ea += c->regs[c->modrm_rm];
772 else if (ctxt->mode == X86EMUL_MODE_PROT64)
776 c->modrm_ea += c->regs[c->modrm_rm];
779 switch (c->modrm_mod) {
781 if (c->modrm_rm == 5)
782 c->modrm_ea += insn_fetch(s32, 4, c->eip);
785 c->modrm_ea += insn_fetch(s8, 1, c->eip);
788 c->modrm_ea += insn_fetch(s32, 4, c->eip);
793 c->modrm_ea += c->eip;
794 switch (c->d & SrcMask) {
802 if (c->op_bytes == 8)
805 c->modrm_ea += c->op_bytes;
812 static int decode_abs(struct x86_emulate_ctxt *ctxt,
813 struct x86_emulate_ops *ops)
815 struct decode_cache *c = &ctxt->decode;
818 switch (c->ad_bytes) {
820 c->modrm_ea = insn_fetch(u16, 2, c->eip);
823 c->modrm_ea = insn_fetch(u32, 4, c->eip);
826 c->modrm_ea = insn_fetch(u64, 8, c->eip);
834 x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
836 struct decode_cache *c = &ctxt->decode;
838 int mode = ctxt->mode;
839 int def_op_bytes, def_ad_bytes, group;
841 /* Shadow copy of register state. Committed on successful emulation. */
843 memset(c, 0, sizeof(struct decode_cache));
844 c->eip = ctxt->vcpu->arch.rip;
845 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
848 case X86EMUL_MODE_REAL:
849 case X86EMUL_MODE_PROT16:
850 def_op_bytes = def_ad_bytes = 2;
852 case X86EMUL_MODE_PROT32:
853 def_op_bytes = def_ad_bytes = 4;
856 case X86EMUL_MODE_PROT64:
865 c->op_bytes = def_op_bytes;
866 c->ad_bytes = def_ad_bytes;
868 /* Legacy prefixes. */
870 switch (c->b = insn_fetch(u8, 1, c->eip)) {
871 case 0x66: /* operand-size override */
872 /* switch between 2/4 bytes */
873 c->op_bytes = def_op_bytes ^ 6;
875 case 0x67: /* address-size override */
876 if (mode == X86EMUL_MODE_PROT64)
877 /* switch between 4/8 bytes */
878 c->ad_bytes = def_ad_bytes ^ 12;
880 /* switch between 2/4 bytes */
881 c->ad_bytes = def_ad_bytes ^ 6;
883 case 0x2e: /* CS override */
884 c->override_base = &ctxt->cs_base;
886 case 0x3e: /* DS override */
887 c->override_base = &ctxt->ds_base;
889 case 0x26: /* ES override */
890 c->override_base = &ctxt->es_base;
892 case 0x64: /* FS override */
893 c->override_base = &ctxt->fs_base;
895 case 0x65: /* GS override */
896 c->override_base = &ctxt->gs_base;
898 case 0x36: /* SS override */
899 c->override_base = &ctxt->ss_base;
901 case 0x40 ... 0x4f: /* REX */
902 if (mode != X86EMUL_MODE_PROT64)
904 c->rex_prefix = c->b;
906 case 0xf0: /* LOCK */
909 case 0xf2: /* REPNE/REPNZ */
910 c->rep_prefix = REPNE_PREFIX;
912 case 0xf3: /* REP/REPE/REPZ */
913 c->rep_prefix = REPE_PREFIX;
919 /* Any legacy prefix after a REX prefix nullifies its effect. */
928 if (c->rex_prefix & 8)
929 c->op_bytes = 8; /* REX.W */
931 /* Opcode byte(s). */
932 c->d = opcode_table[c->b];
934 /* Two-byte opcode? */
937 c->b = insn_fetch(u8, 1, c->eip);
938 c->d = twobyte_table[c->b];
943 group = c->d & GroupMask;
944 c->modrm = insn_fetch(u8, 1, c->eip);
947 group = (group << 3) + ((c->modrm >> 3) & 7);
948 if ((c->d & GroupDual) && (c->modrm >> 6) == 3)
949 c->d = group2_table[group];
951 c->d = group_table[group];
956 DPRINTF("Cannot emulate %02x\n", c->b);
960 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
963 /* ModRM and SIB bytes. */
965 rc = decode_modrm(ctxt, ops);
966 else if (c->d & MemAbs)
967 rc = decode_abs(ctxt, ops);
971 if (!c->override_base)
972 c->override_base = &ctxt->ds_base;
973 if (mode == X86EMUL_MODE_PROT64 &&
974 c->override_base != &ctxt->fs_base &&
975 c->override_base != &ctxt->gs_base)
976 c->override_base = NULL;
978 if (c->override_base)
979 c->modrm_ea += *c->override_base;
981 if (c->ad_bytes != 8)
982 c->modrm_ea = (u32)c->modrm_ea;
984 * Decode and fetch the source operand: register, memory
987 switch (c->d & SrcMask) {
991 decode_register_operand(&c->src, c, 0);
1000 c->src.bytes = (c->d & ByteOp) ? 1 :
1002 /* Don't fetch the address for invlpg: it could be unmapped. */
1003 if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
1007 * For instructions with a ModR/M byte, switch to register
1008 * access if Mod = 3.
1010 if ((c->d & ModRM) && c->modrm_mod == 3) {
1011 c->src.type = OP_REG;
1012 c->src.val = c->modrm_val;
1013 c->src.ptr = c->modrm_ptr;
1016 c->src.type = OP_MEM;
1019 c->src.type = OP_IMM;
1020 c->src.ptr = (unsigned long *)c->eip;
1021 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1022 if (c->src.bytes == 8)
1024 /* NB. Immediates are sign-extended as necessary. */
1025 switch (c->src.bytes) {
1027 c->src.val = insn_fetch(s8, 1, c->eip);
1030 c->src.val = insn_fetch(s16, 2, c->eip);
1033 c->src.val = insn_fetch(s32, 4, c->eip);
1038 c->src.type = OP_IMM;
1039 c->src.ptr = (unsigned long *)c->eip;
1041 c->src.val = insn_fetch(s8, 1, c->eip);
1045 /* Decode and fetch the destination operand: register or memory. */
1046 switch (c->d & DstMask) {
1048 /* Special instructions do their own operand decoding. */
1051 decode_register_operand(&c->dst, c,
1052 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
1055 if ((c->d & ModRM) && c->modrm_mod == 3) {
1056 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1057 c->dst.type = OP_REG;
1058 c->dst.val = c->dst.orig_val = c->modrm_val;
1059 c->dst.ptr = c->modrm_ptr;
1062 c->dst.type = OP_MEM;
1067 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1070 static inline void emulate_push(struct x86_emulate_ctxt *ctxt)
1072 struct decode_cache *c = &ctxt->decode;
1074 c->dst.type = OP_MEM;
1075 c->dst.bytes = c->op_bytes;
1076 c->dst.val = c->src.val;
1077 register_address_increment(c, &c->regs[VCPU_REGS_RSP], -c->op_bytes);
1078 c->dst.ptr = (void *) register_address(c, ctxt->ss_base,
1079 c->regs[VCPU_REGS_RSP]);
1082 static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
1083 struct x86_emulate_ops *ops)
1085 struct decode_cache *c = &ctxt->decode;
1088 rc = ops->read_std(register_address(c, ctxt->ss_base,
1089 c->regs[VCPU_REGS_RSP]),
1090 &c->dst.val, c->dst.bytes, ctxt->vcpu);
1094 register_address_increment(c, &c->regs[VCPU_REGS_RSP], c->dst.bytes);
1099 static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
1101 struct decode_cache *c = &ctxt->decode;
1102 switch (c->modrm_reg) {
1104 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
1107 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
1110 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
1113 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
1115 case 4: /* sal/shl */
1116 case 6: /* sal/shl */
1117 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
1120 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
1123 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
1128 static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
1129 struct x86_emulate_ops *ops)
1131 struct decode_cache *c = &ctxt->decode;
1134 switch (c->modrm_reg) {
1135 case 0 ... 1: /* test */
1136 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1139 c->dst.val = ~c->dst.val;
1142 emulate_1op("neg", c->dst, ctxt->eflags);
1145 DPRINTF("Cannot emulate %02x\n", c->b);
1146 rc = X86EMUL_UNHANDLEABLE;
1152 static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
1153 struct x86_emulate_ops *ops)
1155 struct decode_cache *c = &ctxt->decode;
1157 switch (c->modrm_reg) {
1159 emulate_1op("inc", c->dst, ctxt->eflags);
1162 emulate_1op("dec", c->dst, ctxt->eflags);
1164 case 4: /* jmp abs */
1165 c->eip = c->src.val;
1174 static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
1175 struct x86_emulate_ops *ops,
1176 unsigned long memop)
1178 struct decode_cache *c = &ctxt->decode;
1182 rc = ops->read_emulated(memop, &old, 8, ctxt->vcpu);
1186 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1187 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
1189 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1190 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1191 ctxt->eflags &= ~EFLG_ZF;
1194 new = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1195 (u32) c->regs[VCPU_REGS_RBX];
1197 rc = ops->cmpxchg_emulated(memop, &old, &new, 8, ctxt->vcpu);
1200 ctxt->eflags |= EFLG_ZF;
1205 static inline int writeback(struct x86_emulate_ctxt *ctxt,
1206 struct x86_emulate_ops *ops)
1209 struct decode_cache *c = &ctxt->decode;
1211 switch (c->dst.type) {
1213 /* The 4-byte case *is* correct:
1214 * in 64-bit mode we zero-extend.
1216 switch (c->dst.bytes) {
1218 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1221 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1224 *c->dst.ptr = (u32)c->dst.val;
1225 break; /* 64b: zero-ext */
1227 *c->dst.ptr = c->dst.val;
1233 rc = ops->cmpxchg_emulated(
1234 (unsigned long)c->dst.ptr,
1240 rc = ops->write_emulated(
1241 (unsigned long)c->dst.ptr,
1258 x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1260 unsigned long memop = 0;
1262 unsigned long saved_eip = 0;
1263 struct decode_cache *c = &ctxt->decode;
1266 /* Shadow copy of register state. Committed on successful emulation.
1267 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
1271 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
1274 if (((c->d & ModRM) && (c->modrm_mod != 3)) || (c->d & MemAbs))
1275 memop = c->modrm_ea;
1277 if (c->rep_prefix && (c->d & String)) {
1278 /* All REP prefixes have the same first termination condition */
1279 if (c->regs[VCPU_REGS_RCX] == 0) {
1280 ctxt->vcpu->arch.rip = c->eip;
1283 /* The second termination condition only applies for REPE
1284 * and REPNE. Test if the repeat string operation prefix is
1285 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
1286 * corresponding termination condition according to:
1287 * - if REPE/REPZ and ZF = 0 then done
1288 * - if REPNE/REPNZ and ZF = 1 then done
1290 if ((c->b == 0xa6) || (c->b == 0xa7) ||
1291 (c->b == 0xae) || (c->b == 0xaf)) {
1292 if ((c->rep_prefix == REPE_PREFIX) &&
1293 ((ctxt->eflags & EFLG_ZF) == 0)) {
1294 ctxt->vcpu->arch.rip = c->eip;
1297 if ((c->rep_prefix == REPNE_PREFIX) &&
1298 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF)) {
1299 ctxt->vcpu->arch.rip = c->eip;
1303 c->regs[VCPU_REGS_RCX]--;
1304 c->eip = ctxt->vcpu->arch.rip;
1307 if (c->src.type == OP_MEM) {
1308 c->src.ptr = (unsigned long *)memop;
1310 rc = ops->read_emulated((unsigned long)c->src.ptr,
1316 c->src.orig_val = c->src.val;
1319 if ((c->d & DstMask) == ImplicitOps)
1323 if (c->dst.type == OP_MEM) {
1324 c->dst.ptr = (unsigned long *)memop;
1325 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1328 unsigned long mask = ~(c->dst.bytes * 8 - 1);
1330 c->dst.ptr = (void *)c->dst.ptr +
1331 (c->src.val & mask) / 8;
1333 if (!(c->d & Mov) &&
1334 /* optimisation - avoid slow emulated read */
1335 ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1337 c->dst.bytes, ctxt->vcpu)) != 0))
1340 c->dst.orig_val = c->dst.val;
1350 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
1354 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
1358 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
1362 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
1366 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
1368 case 0x24: /* and al imm8 */
1369 c->dst.type = OP_REG;
1370 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1371 c->dst.val = *(u8 *)c->dst.ptr;
1373 c->dst.orig_val = c->dst.val;
1375 case 0x25: /* and ax imm16, or eax imm32 */
1376 c->dst.type = OP_REG;
1377 c->dst.bytes = c->op_bytes;
1378 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1379 if (c->op_bytes == 2)
1380 c->dst.val = *(u16 *)c->dst.ptr;
1382 c->dst.val = *(u32 *)c->dst.ptr;
1383 c->dst.orig_val = c->dst.val;
1387 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
1391 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
1395 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1397 case 0x40 ... 0x47: /* inc r16/r32 */
1398 emulate_1op("inc", c->dst, ctxt->eflags);
1400 case 0x48 ... 0x4f: /* dec r16/r32 */
1401 emulate_1op("dec", c->dst, ctxt->eflags);
1403 case 0x50 ... 0x57: /* push reg */
1404 c->dst.type = OP_MEM;
1405 c->dst.bytes = c->op_bytes;
1406 c->dst.val = c->src.val;
1407 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1409 c->dst.ptr = (void *) register_address(
1410 c, ctxt->ss_base, c->regs[VCPU_REGS_RSP]);
1412 case 0x58 ... 0x5f: /* pop reg */
1414 if ((rc = ops->read_std(register_address(c, ctxt->ss_base,
1415 c->regs[VCPU_REGS_RSP]), c->dst.ptr,
1416 c->op_bytes, ctxt->vcpu)) != 0)
1419 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1421 c->dst.type = OP_NONE; /* Disable writeback. */
1423 case 0x63: /* movsxd */
1424 if (ctxt->mode != X86EMUL_MODE_PROT64)
1425 goto cannot_emulate;
1426 c->dst.val = (s32) c->src.val;
1428 case 0x68: /* push imm */
1429 case 0x6a: /* push imm8 */
1432 case 0x6c: /* insb */
1433 case 0x6d: /* insw/insd */
1434 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1436 (c->d & ByteOp) ? 1 : c->op_bytes,
1438 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1,
1439 (ctxt->eflags & EFLG_DF),
1440 register_address(c, ctxt->es_base,
1441 c->regs[VCPU_REGS_RDI]),
1443 c->regs[VCPU_REGS_RDX]) == 0) {
1448 case 0x6e: /* outsb */
1449 case 0x6f: /* outsw/outsd */
1450 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1452 (c->d & ByteOp) ? 1 : c->op_bytes,
1454 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1,
1455 (ctxt->eflags & EFLG_DF),
1456 register_address(c, c->override_base ?
1459 c->regs[VCPU_REGS_RSI]),
1461 c->regs[VCPU_REGS_RDX]) == 0) {
1466 case 0x70 ... 0x7f: /* jcc (short) */ {
1467 int rel = insn_fetch(s8, 1, c->eip);
1469 if (test_cc(c->b, ctxt->eflags))
1473 case 0x80 ... 0x83: /* Grp1 */
1474 switch (c->modrm_reg) {
1494 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1496 case 0x86 ... 0x87: /* xchg */
1498 /* Write back the register source. */
1499 switch (c->dst.bytes) {
1501 *(u8 *) c->src.ptr = (u8) c->dst.val;
1504 *(u16 *) c->src.ptr = (u16) c->dst.val;
1507 *c->src.ptr = (u32) c->dst.val;
1508 break; /* 64b reg: zero-extend */
1510 *c->src.ptr = c->dst.val;
1514 * Write back the memory destination with implicit LOCK
1517 c->dst.val = c->src.val;
1520 case 0x88 ... 0x8b: /* mov */
1522 case 0x8c: { /* mov r/m, sreg */
1523 struct kvm_segment segreg;
1525 if (c->modrm_reg <= 5)
1526 kvm_get_segment(ctxt->vcpu, &segreg, c->modrm_reg);
1528 printk(KERN_INFO "0x8c: Invalid segreg in modrm byte 0x%02x\n",
1530 goto cannot_emulate;
1532 c->dst.val = segreg.selector;
1535 case 0x8d: /* lea r16/r32, m */
1536 c->dst.val = c->modrm_ea;
1538 case 0x8e: { /* mov seg, r/m16 */
1544 if (c->modrm_reg <= 5) {
1545 type_bits = (c->modrm_reg == 1) ? 9 : 1;
1546 err = kvm_load_segment_descriptor(ctxt->vcpu, sel,
1547 type_bits, c->modrm_reg);
1549 printk(KERN_INFO "Invalid segreg in modrm byte 0x%02x\n",
1551 goto cannot_emulate;
1555 goto cannot_emulate;
1557 c->dst.type = OP_NONE; /* Disable writeback. */
1560 case 0x8f: /* pop (sole member of Grp1a) */
1561 rc = emulate_grp1a(ctxt, ops);
1565 case 0x90: /* nop / xchg r8,rax */
1566 if (!(c->rex_prefix & 1)) { /* nop */
1567 c->dst.type = OP_NONE;
1570 case 0x91 ... 0x97: /* xchg reg,rax */
1571 c->src.type = c->dst.type = OP_REG;
1572 c->src.bytes = c->dst.bytes = c->op_bytes;
1573 c->src.ptr = (unsigned long *) &c->regs[VCPU_REGS_RAX];
1574 c->src.val = *(c->src.ptr);
1576 case 0x9c: /* pushf */
1577 c->src.val = (unsigned long) ctxt->eflags;
1580 case 0x9d: /* popf */
1581 c->dst.ptr = (unsigned long *) &ctxt->eflags;
1582 goto pop_instruction;
1583 case 0xa0 ... 0xa1: /* mov */
1584 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1585 c->dst.val = c->src.val;
1587 case 0xa2 ... 0xa3: /* mov */
1588 c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
1590 case 0xa4 ... 0xa5: /* movs */
1591 c->dst.type = OP_MEM;
1592 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1593 c->dst.ptr = (unsigned long *)register_address(c,
1595 c->regs[VCPU_REGS_RDI]);
1596 if ((rc = ops->read_emulated(register_address(c,
1597 c->override_base ? *c->override_base :
1599 c->regs[VCPU_REGS_RSI]),
1601 c->dst.bytes, ctxt->vcpu)) != 0)
1603 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1604 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1606 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1607 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1610 case 0xa6 ... 0xa7: /* cmps */
1611 c->src.type = OP_NONE; /* Disable writeback. */
1612 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1613 c->src.ptr = (unsigned long *)register_address(c,
1614 c->override_base ? *c->override_base :
1616 c->regs[VCPU_REGS_RSI]);
1617 if ((rc = ops->read_emulated((unsigned long)c->src.ptr,
1623 c->dst.type = OP_NONE; /* Disable writeback. */
1624 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1625 c->dst.ptr = (unsigned long *)register_address(c,
1627 c->regs[VCPU_REGS_RDI]);
1628 if ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1634 DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c->src.ptr, c->dst.ptr);
1636 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1638 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1639 (ctxt->eflags & EFLG_DF) ? -c->src.bytes
1641 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1642 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1646 case 0xaa ... 0xab: /* stos */
1647 c->dst.type = OP_MEM;
1648 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1649 c->dst.ptr = (unsigned long *)register_address(c,
1651 c->regs[VCPU_REGS_RDI]);
1652 c->dst.val = c->regs[VCPU_REGS_RAX];
1653 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
1654 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1657 case 0xac ... 0xad: /* lods */
1658 c->dst.type = OP_REG;
1659 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1660 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1661 if ((rc = ops->read_emulated(register_address(c,
1662 c->override_base ? *c->override_base :
1664 c->regs[VCPU_REGS_RSI]),
1669 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
1670 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1673 case 0xae ... 0xaf: /* scas */
1674 DPRINTF("Urk! I don't handle SCAS.\n");
1675 goto cannot_emulate;
1676 case 0xb8: /* mov r, imm */
1681 case 0xc3: /* ret */
1682 c->dst.ptr = &c->eip;
1683 goto pop_instruction;
1684 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1686 c->dst.val = c->src.val;
1688 case 0xd0 ... 0xd1: /* Grp2 */
1692 case 0xd2 ... 0xd3: /* Grp2 */
1693 c->src.val = c->regs[VCPU_REGS_RCX];
1696 case 0xe8: /* call (near) */ {
1698 switch (c->op_bytes) {
1700 rel = insn_fetch(s16, 2, c->eip);
1703 rel = insn_fetch(s32, 4, c->eip);
1706 DPRINTF("Call: Invalid op_bytes\n");
1707 goto cannot_emulate;
1709 c->src.val = (unsigned long) c->eip;
1711 c->op_bytes = c->ad_bytes;
1715 case 0xe9: /* jmp rel */
1717 case 0xea: /* jmp far */ {
1721 switch (c->op_bytes) {
1723 eip = insn_fetch(u16, 2, c->eip);
1726 eip = insn_fetch(u32, 4, c->eip);
1729 DPRINTF("jmp far: Invalid op_bytes\n");
1730 goto cannot_emulate;
1732 sel = insn_fetch(u16, 2, c->eip);
1733 if (kvm_load_segment_descriptor(ctxt->vcpu, sel, 9, VCPU_SREG_CS) < 0) {
1734 DPRINTF("jmp far: Failed to load CS descriptor\n");
1735 goto cannot_emulate;
1742 jmp: /* jmp rel short */
1743 jmp_rel(c, c->src.val);
1744 c->dst.type = OP_NONE; /* Disable writeback. */
1746 case 0xf4: /* hlt */
1747 ctxt->vcpu->arch.halt_request = 1;
1749 case 0xf5: /* cmc */
1750 /* complement carry flag from eflags reg */
1751 ctxt->eflags ^= EFLG_CF;
1752 c->dst.type = OP_NONE; /* Disable writeback. */
1754 case 0xf6 ... 0xf7: /* Grp3 */
1755 rc = emulate_grp3(ctxt, ops);
1759 case 0xf8: /* clc */
1760 ctxt->eflags &= ~EFLG_CF;
1761 c->dst.type = OP_NONE; /* Disable writeback. */
1763 case 0xfa: /* cli */
1764 ctxt->eflags &= ~X86_EFLAGS_IF;
1765 c->dst.type = OP_NONE; /* Disable writeback. */
1767 case 0xfb: /* sti */
1768 ctxt->eflags |= X86_EFLAGS_IF;
1769 c->dst.type = OP_NONE; /* Disable writeback. */
1771 case 0xfe ... 0xff: /* Grp4/Grp5 */
1772 rc = emulate_grp45(ctxt, ops);
1779 rc = writeback(ctxt, ops);
1783 /* Commit shadow register state. */
1784 memcpy(ctxt->vcpu->arch.regs, c->regs, sizeof c->regs);
1785 ctxt->vcpu->arch.rip = c->eip;
1788 if (rc == X86EMUL_UNHANDLEABLE) {
1796 case 0x01: /* lgdt, lidt, lmsw */
1797 switch (c->modrm_reg) {
1799 unsigned long address;
1801 case 0: /* vmcall */
1802 if (c->modrm_mod != 3 || c->modrm_rm != 1)
1803 goto cannot_emulate;
1805 rc = kvm_fix_hypercall(ctxt->vcpu);
1809 /* Let the processor re-execute the fixed hypercall */
1810 c->eip = ctxt->vcpu->arch.rip;
1811 /* Disable writeback. */
1812 c->dst.type = OP_NONE;
1815 rc = read_descriptor(ctxt, ops, c->src.ptr,
1816 &size, &address, c->op_bytes);
1819 realmode_lgdt(ctxt->vcpu, size, address);
1820 /* Disable writeback. */
1821 c->dst.type = OP_NONE;
1823 case 3: /* lidt/vmmcall */
1824 if (c->modrm_mod == 3 && c->modrm_rm == 1) {
1825 rc = kvm_fix_hypercall(ctxt->vcpu);
1828 kvm_emulate_hypercall(ctxt->vcpu);
1830 rc = read_descriptor(ctxt, ops, c->src.ptr,
1835 realmode_lidt(ctxt->vcpu, size, address);
1837 /* Disable writeback. */
1838 c->dst.type = OP_NONE;
1842 c->dst.val = realmode_get_cr(ctxt->vcpu, 0);
1845 realmode_lmsw(ctxt->vcpu, (u16)c->src.val,
1847 c->dst.type = OP_NONE;
1850 emulate_invlpg(ctxt->vcpu, memop);
1851 /* Disable writeback. */
1852 c->dst.type = OP_NONE;
1855 goto cannot_emulate;
1859 emulate_clts(ctxt->vcpu);
1860 c->dst.type = OP_NONE;
1862 case 0x08: /* invd */
1863 case 0x09: /* wbinvd */
1864 case 0x0d: /* GrpP (prefetch) */
1865 case 0x18: /* Grp16 (prefetch/nop) */
1866 c->dst.type = OP_NONE;
1868 case 0x20: /* mov cr, reg */
1869 if (c->modrm_mod != 3)
1870 goto cannot_emulate;
1871 c->regs[c->modrm_rm] =
1872 realmode_get_cr(ctxt->vcpu, c->modrm_reg);
1873 c->dst.type = OP_NONE; /* no writeback */
1875 case 0x21: /* mov from dr to reg */
1876 if (c->modrm_mod != 3)
1877 goto cannot_emulate;
1878 rc = emulator_get_dr(ctxt, c->modrm_reg, &c->regs[c->modrm_rm]);
1880 goto cannot_emulate;
1881 c->dst.type = OP_NONE; /* no writeback */
1883 case 0x22: /* mov reg, cr */
1884 if (c->modrm_mod != 3)
1885 goto cannot_emulate;
1886 realmode_set_cr(ctxt->vcpu,
1887 c->modrm_reg, c->modrm_val, &ctxt->eflags);
1888 c->dst.type = OP_NONE;
1890 case 0x23: /* mov from reg to dr */
1891 if (c->modrm_mod != 3)
1892 goto cannot_emulate;
1893 rc = emulator_set_dr(ctxt, c->modrm_reg,
1894 c->regs[c->modrm_rm]);
1896 goto cannot_emulate;
1897 c->dst.type = OP_NONE; /* no writeback */
1901 msr_data = (u32)c->regs[VCPU_REGS_RAX]
1902 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
1903 rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
1905 kvm_inject_gp(ctxt->vcpu, 0);
1906 c->eip = ctxt->vcpu->arch.rip;
1908 rc = X86EMUL_CONTINUE;
1909 c->dst.type = OP_NONE;
1913 rc = kvm_get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data);
1915 kvm_inject_gp(ctxt->vcpu, 0);
1916 c->eip = ctxt->vcpu->arch.rip;
1918 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
1919 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
1921 rc = X86EMUL_CONTINUE;
1922 c->dst.type = OP_NONE;
1924 case 0x40 ... 0x4f: /* cmov */
1925 c->dst.val = c->dst.orig_val = c->src.val;
1926 if (!test_cc(c->b, ctxt->eflags))
1927 c->dst.type = OP_NONE; /* no writeback */
1929 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1932 switch (c->op_bytes) {
1934 rel = insn_fetch(s16, 2, c->eip);
1937 rel = insn_fetch(s32, 4, c->eip);
1940 rel = insn_fetch(s64, 8, c->eip);
1943 DPRINTF("jnz: Invalid op_bytes\n");
1944 goto cannot_emulate;
1946 if (test_cc(c->b, ctxt->eflags))
1948 c->dst.type = OP_NONE;
1953 c->dst.type = OP_NONE;
1954 /* only subword offset */
1955 c->src.val &= (c->dst.bytes << 3) - 1;
1956 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
1960 /* only subword offset */
1961 c->src.val &= (c->dst.bytes << 3) - 1;
1962 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
1964 case 0xb0 ... 0xb1: /* cmpxchg */
1966 * Save real source value, then compare EAX against
1969 c->src.orig_val = c->src.val;
1970 c->src.val = c->regs[VCPU_REGS_RAX];
1971 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1972 if (ctxt->eflags & EFLG_ZF) {
1973 /* Success: write back to memory. */
1974 c->dst.val = c->src.orig_val;
1976 /* Failure: write the value we saw to EAX. */
1977 c->dst.type = OP_REG;
1978 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1983 /* only subword offset */
1984 c->src.val &= (c->dst.bytes << 3) - 1;
1985 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
1987 case 0xb6 ... 0xb7: /* movzx */
1988 c->dst.bytes = c->op_bytes;
1989 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
1992 case 0xba: /* Grp8 */
1993 switch (c->modrm_reg & 3) {
2006 /* only subword offset */
2007 c->src.val &= (c->dst.bytes << 3) - 1;
2008 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
2010 case 0xbe ... 0xbf: /* movsx */
2011 c->dst.bytes = c->op_bytes;
2012 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
2015 case 0xc3: /* movnti */
2016 c->dst.bytes = c->op_bytes;
2017 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
2020 case 0xc7: /* Grp9 (cmpxchg8b) */
2021 rc = emulate_grp9(ctxt, ops, memop);
2024 c->dst.type = OP_NONE;
2030 DPRINTF("Cannot emulate %02x\n", c->b);