1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf( _f , ## _a )
29 #define DPRINTF(x...) do {} while (0)
31 #include "x86_emulate.h"
32 #include <linux/module.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
66 static u8 opcode_table[256] = {
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
102 0, 0, 0, 0, 0, 0, 0, 0,
104 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
107 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
108 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
110 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
112 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
113 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
114 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
115 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
117 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
118 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
119 0, 0, 0, DstMem | SrcNone | ModRM | Mov,
121 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
123 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
124 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
125 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
126 ByteOp | ImplicitOps, ImplicitOps,
128 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
129 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
130 ByteOp | ImplicitOps, ImplicitOps,
132 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
134 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
135 0, ImplicitOps, 0, 0,
136 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
138 0, 0, 0, 0, 0, 0, 0, 0,
140 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
141 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
144 0, 0, 0, 0, 0, 0, 0, 0,
146 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
150 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
153 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
156 static u16 twobyte_table[256] = {
158 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
159 0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
161 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
163 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
164 0, 0, 0, 0, 0, 0, 0, 0,
166 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
168 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
169 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
170 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
171 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
173 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
174 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
175 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
176 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
178 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
180 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
182 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
184 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
186 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
188 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
190 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
192 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
193 DstMem | SrcReg | ModRM | BitOp,
194 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
195 DstReg | SrcMem16 | ModRM | Mov,
197 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
198 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
199 DstReg | SrcMem16 | ModRM | Mov,
201 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
203 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
205 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
207 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
211 * Tell the emulator that of the Group 7 instructions (sgdt, lidt, etc.) we
212 * are interested only in invlpg and not in any of the rest.
214 * invlpg is a special instruction in that the data it references may not
217 void kvm_emulator_want_group7_invlpg(void)
219 twobyte_table[1] &= ~SrcMem;
221 EXPORT_SYMBOL_GPL(kvm_emulator_want_group7_invlpg);
223 /* Type, address-of, and value of an instruction's operand. */
225 enum { OP_REG, OP_MEM, OP_IMM } type;
227 unsigned long val, orig_val, *ptr;
230 /* EFLAGS bit definitions. */
231 #define EFLG_OF (1<<11)
232 #define EFLG_DF (1<<10)
233 #define EFLG_SF (1<<7)
234 #define EFLG_ZF (1<<6)
235 #define EFLG_AF (1<<4)
236 #define EFLG_PF (1<<2)
237 #define EFLG_CF (1<<0)
240 * Instruction emulation:
241 * Most instructions are emulated directly via a fragment of inline assembly
242 * code. This allows us to save/restore EFLAGS and thus very easily pick up
243 * any modified flags.
246 #if defined(CONFIG_X86_64)
247 #define _LO32 "k" /* force 32-bit operand */
248 #define _STK "%%rsp" /* stack pointer */
249 #elif defined(__i386__)
250 #define _LO32 "" /* force 32-bit operand */
251 #define _STK "%%esp" /* stack pointer */
255 * These EFLAGS bits are restored from saved value during emulation, and
256 * any changes are written back to the saved value after emulation.
258 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
260 /* Before executing instruction: restore necessary bits in EFLAGS. */
261 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
262 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
264 "movl %"_msk",%"_LO32 _tmp"; " \
265 "andl %"_LO32 _tmp",("_STK"); " \
267 "notl %"_LO32 _tmp"; " \
268 "andl %"_LO32 _tmp",("_STK"); " \
270 "orl %"_LO32 _tmp",("_STK"); " \
272 /* _sav &= ~msk; */ \
273 "movl %"_msk",%"_LO32 _tmp"; " \
274 "notl %"_LO32 _tmp"; " \
275 "andl %"_LO32 _tmp",%"_sav"; "
277 /* After executing instruction: write-back necessary bits in EFLAGS. */
278 #define _POST_EFLAGS(_sav, _msk, _tmp) \
279 /* _sav |= EFLAGS & _msk; */ \
282 "andl %"_msk",%"_LO32 _tmp"; " \
283 "orl %"_LO32 _tmp",%"_sav"; "
285 /* Raw emulation: instruction has two explicit operands. */
286 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
288 unsigned long _tmp; \
290 switch ((_dst).bytes) { \
292 __asm__ __volatile__ ( \
293 _PRE_EFLAGS("0","4","2") \
294 _op"w %"_wx"3,%1; " \
295 _POST_EFLAGS("0","4","2") \
296 : "=m" (_eflags), "=m" ((_dst).val), \
298 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
301 __asm__ __volatile__ ( \
302 _PRE_EFLAGS("0","4","2") \
303 _op"l %"_lx"3,%1; " \
304 _POST_EFLAGS("0","4","2") \
305 : "=m" (_eflags), "=m" ((_dst).val), \
307 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
310 __emulate_2op_8byte(_op, _src, _dst, \
311 _eflags, _qx, _qy); \
316 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
318 unsigned long _tmp; \
319 switch ( (_dst).bytes ) \
322 __asm__ __volatile__ ( \
323 _PRE_EFLAGS("0","4","2") \
324 _op"b %"_bx"3,%1; " \
325 _POST_EFLAGS("0","4","2") \
326 : "=m" (_eflags), "=m" ((_dst).val), \
328 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
331 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
332 _wx, _wy, _lx, _ly, _qx, _qy); \
337 /* Source operand is byte-sized and may be restricted to just %cl. */
338 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
339 __emulate_2op(_op, _src, _dst, _eflags, \
340 "b", "c", "b", "c", "b", "c", "b", "c")
342 /* Source operand is byte, word, long or quad sized. */
343 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
344 __emulate_2op(_op, _src, _dst, _eflags, \
345 "b", "q", "w", "r", _LO32, "r", "", "r")
347 /* Source operand is word, long or quad sized. */
348 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
349 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
350 "w", "r", _LO32, "r", "", "r")
352 /* Instruction has only one explicit operand (no source operand). */
353 #define emulate_1op(_op, _dst, _eflags) \
355 unsigned long _tmp; \
357 switch ( (_dst).bytes ) \
360 __asm__ __volatile__ ( \
361 _PRE_EFLAGS("0","3","2") \
363 _POST_EFLAGS("0","3","2") \
364 : "=m" (_eflags), "=m" ((_dst).val), \
366 : "i" (EFLAGS_MASK) ); \
369 __asm__ __volatile__ ( \
370 _PRE_EFLAGS("0","3","2") \
372 _POST_EFLAGS("0","3","2") \
373 : "=m" (_eflags), "=m" ((_dst).val), \
375 : "i" (EFLAGS_MASK) ); \
378 __asm__ __volatile__ ( \
379 _PRE_EFLAGS("0","3","2") \
381 _POST_EFLAGS("0","3","2") \
382 : "=m" (_eflags), "=m" ((_dst).val), \
384 : "i" (EFLAGS_MASK) ); \
387 __emulate_1op_8byte(_op, _dst, _eflags); \
392 /* Emulate an instruction with quadword operands (x86/64 only). */
393 #if defined(CONFIG_X86_64)
394 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
396 __asm__ __volatile__ ( \
397 _PRE_EFLAGS("0","4","2") \
398 _op"q %"_qx"3,%1; " \
399 _POST_EFLAGS("0","4","2") \
400 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
401 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
404 #define __emulate_1op_8byte(_op, _dst, _eflags) \
406 __asm__ __volatile__ ( \
407 _PRE_EFLAGS("0","3","2") \
409 _POST_EFLAGS("0","3","2") \
410 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
411 : "i" (EFLAGS_MASK) ); \
414 #elif defined(__i386__)
415 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
416 #define __emulate_1op_8byte(_op, _dst, _eflags)
417 #endif /* __i386__ */
419 /* Fetch next part of the instruction being emulated. */
420 #define insn_fetch(_type, _size, _eip) \
421 ({ unsigned long _x; \
422 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
423 (_size), ctxt->vcpu); \
430 /* Access/update address held in a register, based on addressing mode. */
431 #define register_address(base, reg) \
432 ((base) + ((ad_bytes == sizeof(unsigned long)) ? (reg) : \
433 ((reg) & ((1UL << (ad_bytes << 3)) - 1))))
435 #define register_address_increment(reg, inc) \
437 /* signed type ensures sign extension to long */ \
439 if ( ad_bytes == sizeof(unsigned long) ) \
442 (reg) = ((reg) & ~((1UL << (ad_bytes << 3)) - 1)) | \
443 (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
447 * Given the 'reg' portion of a ModRM byte, and a register block, return a
448 * pointer into the block that addresses the relevant register.
449 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
451 static void *decode_register(u8 modrm_reg, unsigned long *regs,
456 p = ®s[modrm_reg];
457 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
458 p = (unsigned char *)®s[modrm_reg & 3] + 1;
462 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
463 struct x86_emulate_ops *ops,
465 u16 *size, unsigned long *address, int op_bytes)
472 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
476 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
482 x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
485 u8 b, sib, twobyte = 0, rex_prefix = 0;
486 u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
487 unsigned long *override_base = NULL;
488 unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
490 struct operand src, dst;
491 unsigned long cr2 = ctxt->cr2;
492 int mode = ctxt->mode;
493 unsigned long modrm_ea;
494 int use_modrm_ea, index_reg = 0, base_reg = 0, scale, rip_relative = 0;
498 /* Shadow copy of register state. Committed on successful emulation. */
499 unsigned long _regs[NR_VCPU_REGS];
500 unsigned long _eip = ctxt->vcpu->rip, _eflags = ctxt->eflags;
501 unsigned long modrm_val = 0;
503 memcpy(_regs, ctxt->vcpu->regs, sizeof _regs);
506 case X86EMUL_MODE_REAL:
507 case X86EMUL_MODE_PROT16:
508 op_bytes = ad_bytes = 2;
510 case X86EMUL_MODE_PROT32:
511 op_bytes = ad_bytes = 4;
514 case X86EMUL_MODE_PROT64:
523 /* Legacy prefixes. */
524 for (i = 0; i < 8; i++) {
525 switch (b = insn_fetch(u8, 1, _eip)) {
526 case 0x66: /* operand-size override */
527 op_bytes ^= 6; /* switch between 2/4 bytes */
529 case 0x67: /* address-size override */
530 if (mode == X86EMUL_MODE_PROT64)
531 ad_bytes ^= 12; /* switch between 4/8 bytes */
533 ad_bytes ^= 6; /* switch between 2/4 bytes */
535 case 0x2e: /* CS override */
536 override_base = &ctxt->cs_base;
538 case 0x3e: /* DS override */
539 override_base = &ctxt->ds_base;
541 case 0x26: /* ES override */
542 override_base = &ctxt->es_base;
544 case 0x64: /* FS override */
545 override_base = &ctxt->fs_base;
547 case 0x65: /* GS override */
548 override_base = &ctxt->gs_base;
550 case 0x36: /* SS override */
551 override_base = &ctxt->ss_base;
553 case 0xf0: /* LOCK */
556 case 0xf3: /* REP/REPE/REPZ */
559 case 0xf2: /* REPNE/REPNZ */
569 if ((mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40)) {
572 op_bytes = 8; /* REX.W */
573 modrm_reg = (b & 4) << 1; /* REX.R */
574 index_reg = (b & 2) << 2; /* REX.X */
575 modrm_rm = base_reg = (b & 1) << 3; /* REG.B */
576 b = insn_fetch(u8, 1, _eip);
579 /* Opcode byte(s). */
582 /* Two-byte opcode? */
585 b = insn_fetch(u8, 1, _eip);
586 d = twobyte_table[b];
594 /* ModRM and SIB bytes. */
596 modrm = insn_fetch(u8, 1, _eip);
597 modrm_mod |= (modrm & 0xc0) >> 6;
598 modrm_reg |= (modrm & 0x38) >> 3;
599 modrm_rm |= (modrm & 0x07);
603 if (modrm_mod == 3) {
604 modrm_val = *(unsigned long *)
605 decode_register(modrm_rm, _regs, d & ByteOp);
610 unsigned bx = _regs[VCPU_REGS_RBX];
611 unsigned bp = _regs[VCPU_REGS_RBP];
612 unsigned si = _regs[VCPU_REGS_RSI];
613 unsigned di = _regs[VCPU_REGS_RDI];
615 /* 16-bit ModR/M decode. */
619 modrm_ea += insn_fetch(u16, 2, _eip);
622 modrm_ea += insn_fetch(s8, 1, _eip);
625 modrm_ea += insn_fetch(u16, 2, _eip);
655 if (modrm_rm == 2 || modrm_rm == 3 ||
656 (modrm_rm == 6 && modrm_mod != 0))
658 override_base = &ctxt->ss_base;
659 modrm_ea = (u16)modrm_ea;
661 /* 32/64-bit ModR/M decode. */
665 sib = insn_fetch(u8, 1, _eip);
666 index_reg |= (sib >> 3) & 7;
673 modrm_ea += _regs[base_reg];
675 modrm_ea += insn_fetch(s32, 4, _eip);
678 modrm_ea += _regs[base_reg];
684 modrm_ea += _regs[index_reg] << scale;
690 modrm_ea += _regs[modrm_rm];
691 else if (mode == X86EMUL_MODE_PROT64)
695 modrm_ea += _regs[modrm_rm];
701 modrm_ea += insn_fetch(s32, 4, _eip);
704 modrm_ea += insn_fetch(s8, 1, _eip);
707 modrm_ea += insn_fetch(s32, 4, _eip);
712 override_base = &ctxt->ds_base;
713 if (mode == X86EMUL_MODE_PROT64 &&
714 override_base != &ctxt->fs_base &&
715 override_base != &ctxt->gs_base)
716 override_base = NULL;
719 modrm_ea += *override_base;
723 switch (d & SrcMask) {
734 modrm_ea += op_bytes;
738 modrm_ea = (u32)modrm_ea;
745 * Decode and fetch the source operand: register, memory
748 switch (d & SrcMask) {
754 src.ptr = decode_register(modrm_reg, _regs,
756 src.val = src.orig_val = *(u8 *) src.ptr;
759 src.ptr = decode_register(modrm_reg, _regs, 0);
760 switch ((src.bytes = op_bytes)) {
762 src.val = src.orig_val = *(u16 *) src.ptr;
765 src.val = src.orig_val = *(u32 *) src.ptr;
768 src.val = src.orig_val = *(u64 *) src.ptr;
780 src.bytes = (d & ByteOp) ? 1 : op_bytes;
783 src.ptr = (unsigned long *)cr2;
784 if ((rc = ops->read_emulated((unsigned long)src.ptr,
785 &src.val, src.bytes, ctxt->vcpu)) != 0)
787 src.orig_val = src.val;
791 src.ptr = (unsigned long *)_eip;
792 src.bytes = (d & ByteOp) ? 1 : op_bytes;
795 /* NB. Immediates are sign-extended as necessary. */
798 src.val = insn_fetch(s8, 1, _eip);
801 src.val = insn_fetch(s16, 2, _eip);
804 src.val = insn_fetch(s32, 4, _eip);
810 src.ptr = (unsigned long *)_eip;
812 src.val = insn_fetch(s8, 1, _eip);
816 /* Decode and fetch the destination operand: register or memory. */
817 switch (d & DstMask) {
819 /* Special instructions do their own operand decoding. */
824 && !(twobyte && (b == 0xb6 || b == 0xb7))) {
825 dst.ptr = decode_register(modrm_reg, _regs,
827 dst.val = *(u8 *) dst.ptr;
830 dst.ptr = decode_register(modrm_reg, _regs, 0);
831 switch ((dst.bytes = op_bytes)) {
833 dst.val = *(u16 *)dst.ptr;
836 dst.val = *(u32 *)dst.ptr;
839 dst.val = *(u64 *)dst.ptr;
846 dst.ptr = (unsigned long *)cr2;
847 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
849 unsigned long mask = ~(dst.bytes * 8 - 1);
851 dst.ptr = (void *)dst.ptr + (src.val & mask) / 8;
853 if (!(d & Mov) && /* optimisation - avoid slow emulated read */
854 ((rc = ops->read_emulated((unsigned long)dst.ptr,
855 &dst.val, dst.bytes, ctxt->vcpu)) != 0))
859 dst.orig_val = dst.val;
867 emulate_2op_SrcV("add", src, dst, _eflags);
871 emulate_2op_SrcV("or", src, dst, _eflags);
875 emulate_2op_SrcV("adc", src, dst, _eflags);
879 emulate_2op_SrcV("sbb", src, dst, _eflags);
883 emulate_2op_SrcV("and", src, dst, _eflags);
887 emulate_2op_SrcV("sub", src, dst, _eflags);
891 emulate_2op_SrcV("xor", src, dst, _eflags);
895 emulate_2op_SrcV("cmp", src, dst, _eflags);
897 case 0x63: /* movsxd */
898 if (mode != X86EMUL_MODE_PROT64)
900 dst.val = (s32) src.val;
902 case 0x80 ... 0x83: /* Grp1 */
924 emulate_2op_SrcV("test", src, dst, _eflags);
926 case 0x86 ... 0x87: /* xchg */
927 /* Write back the register source. */
930 *(u8 *) src.ptr = (u8) dst.val;
933 *(u16 *) src.ptr = (u16) dst.val;
936 *src.ptr = (u32) dst.val;
937 break; /* 64b reg: zero-extend */
943 * Write back the memory destination with implicit LOCK
949 case 0xa0 ... 0xa1: /* mov */
950 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
952 _eip += ad_bytes; /* skip src displacement */
954 case 0xa2 ... 0xa3: /* mov */
955 dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
956 _eip += ad_bytes; /* skip dst displacement */
958 case 0x88 ... 0x8b: /* mov */
959 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
962 case 0x8f: /* pop (sole member of Grp1a) */
963 /* 64-bit mode: POP always pops a 64-bit operand. */
964 if (mode == X86EMUL_MODE_PROT64)
966 if ((rc = ops->read_std(register_address(ctxt->ss_base,
967 _regs[VCPU_REGS_RSP]),
968 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
970 register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
976 emulate_2op_SrcB("rol", src, dst, _eflags);
979 emulate_2op_SrcB("ror", src, dst, _eflags);
982 emulate_2op_SrcB("rcl", src, dst, _eflags);
985 emulate_2op_SrcB("rcr", src, dst, _eflags);
987 case 4: /* sal/shl */
988 case 6: /* sal/shl */
989 emulate_2op_SrcB("sal", src, dst, _eflags);
992 emulate_2op_SrcB("shr", src, dst, _eflags);
995 emulate_2op_SrcB("sar", src, dst, _eflags);
999 case 0xd0 ... 0xd1: /* Grp2 */
1002 case 0xd2 ... 0xd3: /* Grp2 */
1003 src.val = _regs[VCPU_REGS_RCX];
1005 case 0xf6 ... 0xf7: /* Grp3 */
1006 switch (modrm_reg) {
1007 case 0 ... 1: /* test */
1009 * Special case in Grp3: test has an immediate
1013 src.ptr = (unsigned long *)_eip;
1014 src.bytes = (d & ByteOp) ? 1 : op_bytes;
1017 switch (src.bytes) {
1019 src.val = insn_fetch(s8, 1, _eip);
1022 src.val = insn_fetch(s16, 2, _eip);
1025 src.val = insn_fetch(s32, 4, _eip);
1033 emulate_1op("neg", dst, _eflags);
1036 goto cannot_emulate;
1039 case 0xfe ... 0xff: /* Grp4/Grp5 */
1040 switch (modrm_reg) {
1042 emulate_1op("inc", dst, _eflags);
1045 emulate_1op("dec", dst, _eflags);
1048 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1049 if (mode == X86EMUL_MODE_PROT64) {
1051 if ((rc = ops->read_std((unsigned long)dst.ptr,
1056 register_address_increment(_regs[VCPU_REGS_RSP],
1058 if ((rc = ops->write_std(
1059 register_address(ctxt->ss_base,
1060 _regs[VCPU_REGS_RSP]),
1061 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
1066 goto cannot_emulate;
1075 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1076 switch (dst.bytes) {
1078 *(u8 *)dst.ptr = (u8)dst.val;
1081 *(u16 *)dst.ptr = (u16)dst.val;
1084 *dst.ptr = (u32)dst.val;
1085 break; /* 64b: zero-ext */
1093 rc = ops->cmpxchg_emulated((unsigned long)dst.
1095 &dst.val, dst.bytes,
1098 rc = ops->write_emulated((unsigned long)dst.ptr,
1099 &dst.val, dst.bytes,
1108 /* Commit shadow register state. */
1109 memcpy(ctxt->vcpu->regs, _regs, sizeof _regs);
1110 ctxt->eflags = _eflags;
1111 ctxt->vcpu->rip = _eip;
1114 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1118 goto twobyte_special_insn;
1120 if (_regs[VCPU_REGS_RCX] == 0) {
1121 ctxt->vcpu->rip = _eip;
1124 _regs[VCPU_REGS_RCX]--;
1125 _eip = ctxt->vcpu->rip;
1128 case 0xa4 ... 0xa5: /* movs */
1130 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1131 dst.ptr = (unsigned long *)register_address(ctxt->es_base,
1132 _regs[VCPU_REGS_RDI]);
1133 if ((rc = ops->read_emulated(register_address(
1134 override_base ? *override_base : ctxt->ds_base,
1135 _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt->vcpu)) != 0)
1137 register_address_increment(_regs[VCPU_REGS_RSI],
1138 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1139 register_address_increment(_regs[VCPU_REGS_RDI],
1140 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1142 case 0xa6 ... 0xa7: /* cmps */
1143 DPRINTF("Urk! I don't handle CMPS.\n");
1144 goto cannot_emulate;
1145 case 0xaa ... 0xab: /* stos */
1147 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1148 dst.ptr = (unsigned long *)cr2;
1149 dst.val = _regs[VCPU_REGS_RAX];
1150 register_address_increment(_regs[VCPU_REGS_RDI],
1151 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1153 case 0xac ... 0xad: /* lods */
1155 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1156 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1157 if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes,
1160 register_address_increment(_regs[VCPU_REGS_RSI],
1161 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1163 case 0xae ... 0xaf: /* scas */
1164 DPRINTF("Urk! I don't handle SCAS.\n");
1165 goto cannot_emulate;
1166 case 0xf4: /* hlt */
1167 ctxt->vcpu->halt_request = 1;
1169 case 0xc3: /* ret */
1171 goto pop_instruction;
1172 case 0x58 ... 0x5f: /* pop reg */
1173 dst.ptr = (unsigned long *)&_regs[b & 0x7];
1176 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1177 _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt->vcpu))
1181 register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
1182 no_wb = 1; /* Disable writeback. */
1189 case 0x01: /* lgdt, lidt, lmsw */
1190 /* Disable writeback. */
1192 switch (modrm_reg) {
1194 unsigned long address;
1197 rc = read_descriptor(ctxt, ops, src.ptr,
1198 &size, &address, op_bytes);
1201 realmode_lgdt(ctxt->vcpu, size, address);
1204 rc = read_descriptor(ctxt, ops, src.ptr,
1205 &size, &address, op_bytes);
1208 realmode_lidt(ctxt->vcpu, size, address);
1212 goto cannot_emulate;
1213 *(u16 *)&_regs[modrm_rm]
1214 = realmode_get_cr(ctxt->vcpu, 0);
1218 goto cannot_emulate;
1219 realmode_lmsw(ctxt->vcpu, (u16)modrm_val, &_eflags);
1222 emulate_invlpg(ctxt->vcpu, cr2);
1225 goto cannot_emulate;
1228 case 0x21: /* mov from dr to reg */
1231 goto cannot_emulate;
1232 rc = emulator_get_dr(ctxt, modrm_reg, &_regs[modrm_rm]);
1234 case 0x23: /* mov from reg to dr */
1237 goto cannot_emulate;
1238 rc = emulator_set_dr(ctxt, modrm_reg, _regs[modrm_rm]);
1240 case 0x40 ... 0x4f: /* cmov */
1241 dst.val = dst.orig_val = src.val;
1244 * First, assume we're decoding an even cmov opcode
1247 switch ((b & 15) >> 1) {
1249 no_wb = (_eflags & EFLG_OF) ? 0 : 1;
1251 case 1: /* cmovb/cmovc/cmovnae */
1252 no_wb = (_eflags & EFLG_CF) ? 0 : 1;
1254 case 2: /* cmovz/cmove */
1255 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
1257 case 3: /* cmovbe/cmovna */
1258 no_wb = (_eflags & (EFLG_CF | EFLG_ZF)) ? 0 : 1;
1261 no_wb = (_eflags & EFLG_SF) ? 0 : 1;
1263 case 5: /* cmovp/cmovpe */
1264 no_wb = (_eflags & EFLG_PF) ? 0 : 1;
1266 case 7: /* cmovle/cmovng */
1267 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
1269 case 6: /* cmovl/cmovnge */
1270 no_wb &= (!(_eflags & EFLG_SF) !=
1271 !(_eflags & EFLG_OF)) ? 0 : 1;
1274 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
1277 case 0xb0 ... 0xb1: /* cmpxchg */
1279 * Save real source value, then compare EAX against
1282 src.orig_val = src.val;
1283 src.val = _regs[VCPU_REGS_RAX];
1284 emulate_2op_SrcV("cmp", src, dst, _eflags);
1285 if (_eflags & EFLG_ZF) {
1286 /* Success: write back to memory. */
1287 dst.val = src.orig_val;
1289 /* Failure: write the value we saw to EAX. */
1291 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1296 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1297 emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
1301 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1302 emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
1306 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1307 emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
1309 case 0xb6 ... 0xb7: /* movzx */
1310 dst.bytes = op_bytes;
1311 dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
1315 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1316 emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
1318 case 0xba: /* Grp8 */
1319 switch (modrm_reg & 3) {
1330 case 0xbe ... 0xbf: /* movsx */
1331 dst.bytes = op_bytes;
1332 dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
1337 twobyte_special_insn:
1338 /* Disable writeback. */
1341 case 0x09: /* wbinvd */
1343 case 0x0d: /* GrpP (prefetch) */
1344 case 0x18: /* Grp16 (prefetch/nop) */
1347 emulate_clts(ctxt->vcpu);
1349 case 0x20: /* mov cr, reg */
1351 goto cannot_emulate;
1352 _regs[modrm_rm] = realmode_get_cr(ctxt->vcpu, modrm_reg);
1354 case 0x22: /* mov reg, cr */
1356 goto cannot_emulate;
1357 realmode_set_cr(ctxt->vcpu, modrm_reg, modrm_val, &_eflags);
1361 msr_data = (u32)_regs[VCPU_REGS_RAX]
1362 | ((u64)_regs[VCPU_REGS_RDX] << 32);
1363 rc = kvm_set_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], msr_data);
1365 kvm_arch_ops->inject_gp(ctxt->vcpu, 0);
1366 _eip = ctxt->vcpu->rip;
1368 rc = X86EMUL_CONTINUE;
1372 rc = kvm_get_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], &msr_data);
1374 kvm_arch_ops->inject_gp(ctxt->vcpu, 0);
1375 _eip = ctxt->vcpu->rip;
1377 _regs[VCPU_REGS_RAX] = (u32)msr_data;
1378 _regs[VCPU_REGS_RDX] = msr_data >> 32;
1380 rc = X86EMUL_CONTINUE;
1382 case 0xc7: /* Grp9 (cmpxchg8b) */
1385 if ((rc = ops->read_emulated(cr2, &old, 8, ctxt->vcpu))
1388 if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
1389 ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
1390 _regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1391 _regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1392 _eflags &= ~EFLG_ZF;
1394 new = ((u64)_regs[VCPU_REGS_RCX] << 32)
1395 | (u32) _regs[VCPU_REGS_RBX];
1396 if ((rc = ops->cmpxchg_emulated(cr2, &old,
1397 &new, 8, ctxt->vcpu)) != 0)
1407 DPRINTF("Cannot emulate %02x\n", b);
1414 #include <asm/uaccess.h>
1417 x86_emulate_read_std(unsigned long addr,
1419 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1425 if ((rc = copy_from_user((void *)val, (void *)addr, bytes)) != 0) {
1426 propagate_page_fault(addr + bytes - rc, 0); /* read fault */
1427 return X86EMUL_PROPAGATE_FAULT;
1430 return X86EMUL_CONTINUE;
1434 x86_emulate_write_std(unsigned long addr,
1436 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1440 if ((rc = copy_to_user((void *)addr, (void *)&val, bytes)) != 0) {
1441 propagate_page_fault(addr + bytes - rc, PGERR_write_access);
1442 return X86EMUL_PROPAGATE_FAULT;
1445 return X86EMUL_CONTINUE;