1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf( _f , ## _a )
29 #define DPRINTF(x...) do {} while (0)
31 #include "x86_emulate.h"
32 #include <linux/module.h>
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
62 /* Destination is only written; never read. */
66 static u8 opcode_table[256] = {
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 SrcImmByte, SrcImm, 0, 0,
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
102 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
103 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
106 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
108 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
111 0, 0, ImplicitOps|Mov, 0,
112 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
113 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
115 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
117 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
118 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
119 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
120 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
122 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
123 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
124 0, 0, 0, DstMem | SrcNone | ModRM | Mov,
126 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps, 0, 0, 0,
128 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
129 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
130 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
131 ByteOp | ImplicitOps, ImplicitOps,
133 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
134 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
135 ByteOp | ImplicitOps, ImplicitOps,
137 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
139 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
140 0, ImplicitOps, 0, 0,
141 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
143 0, 0, 0, 0, 0, 0, 0, 0,
145 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
146 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
149 0, 0, 0, 0, 0, 0, 0, 0,
151 0, 0, 0, 0, 0, 0, 0, 0,
153 ImplicitOps, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps, 0, 0, 0, 0,
157 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
160 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
163 static u16 twobyte_table[256] = {
165 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
166 0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
168 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
170 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
171 0, 0, 0, 0, 0, 0, 0, 0,
173 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
175 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
176 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
177 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
178 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
180 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
181 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
182 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
183 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
185 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
187 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
189 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
191 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
192 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
193 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
194 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
196 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
198 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
200 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
202 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
203 DstMem | SrcReg | ModRM | BitOp,
204 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
205 DstReg | SrcMem16 | ModRM | Mov,
207 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
208 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
209 DstReg | SrcMem16 | ModRM | Mov,
211 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
213 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
215 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
217 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
220 /* Type, address-of, and value of an instruction's operand. */
222 enum { OP_REG, OP_MEM, OP_IMM } type;
224 unsigned long val, orig_val, *ptr;
227 /* EFLAGS bit definitions. */
228 #define EFLG_OF (1<<11)
229 #define EFLG_DF (1<<10)
230 #define EFLG_SF (1<<7)
231 #define EFLG_ZF (1<<6)
232 #define EFLG_AF (1<<4)
233 #define EFLG_PF (1<<2)
234 #define EFLG_CF (1<<0)
237 * Instruction emulation:
238 * Most instructions are emulated directly via a fragment of inline assembly
239 * code. This allows us to save/restore EFLAGS and thus very easily pick up
240 * any modified flags.
243 #if defined(CONFIG_X86_64)
244 #define _LO32 "k" /* force 32-bit operand */
245 #define _STK "%%rsp" /* stack pointer */
246 #elif defined(__i386__)
247 #define _LO32 "" /* force 32-bit operand */
248 #define _STK "%%esp" /* stack pointer */
252 * These EFLAGS bits are restored from saved value during emulation, and
253 * any changes are written back to the saved value after emulation.
255 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
257 /* Before executing instruction: restore necessary bits in EFLAGS. */
258 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
259 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
261 "movl %"_msk",%"_LO32 _tmp"; " \
262 "andl %"_LO32 _tmp",("_STK"); " \
264 "notl %"_LO32 _tmp"; " \
265 "andl %"_LO32 _tmp",("_STK"); " \
267 "orl %"_LO32 _tmp",("_STK"); " \
269 /* _sav &= ~msk; */ \
270 "movl %"_msk",%"_LO32 _tmp"; " \
271 "notl %"_LO32 _tmp"; " \
272 "andl %"_LO32 _tmp",%"_sav"; "
274 /* After executing instruction: write-back necessary bits in EFLAGS. */
275 #define _POST_EFLAGS(_sav, _msk, _tmp) \
276 /* _sav |= EFLAGS & _msk; */ \
279 "andl %"_msk",%"_LO32 _tmp"; " \
280 "orl %"_LO32 _tmp",%"_sav"; "
282 /* Raw emulation: instruction has two explicit operands. */
283 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
285 unsigned long _tmp; \
287 switch ((_dst).bytes) { \
289 __asm__ __volatile__ ( \
290 _PRE_EFLAGS("0","4","2") \
291 _op"w %"_wx"3,%1; " \
292 _POST_EFLAGS("0","4","2") \
293 : "=m" (_eflags), "=m" ((_dst).val), \
295 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
298 __asm__ __volatile__ ( \
299 _PRE_EFLAGS("0","4","2") \
300 _op"l %"_lx"3,%1; " \
301 _POST_EFLAGS("0","4","2") \
302 : "=m" (_eflags), "=m" ((_dst).val), \
304 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
307 __emulate_2op_8byte(_op, _src, _dst, \
308 _eflags, _qx, _qy); \
313 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
315 unsigned long _tmp; \
316 switch ( (_dst).bytes ) \
319 __asm__ __volatile__ ( \
320 _PRE_EFLAGS("0","4","2") \
321 _op"b %"_bx"3,%1; " \
322 _POST_EFLAGS("0","4","2") \
323 : "=m" (_eflags), "=m" ((_dst).val), \
325 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
328 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
329 _wx, _wy, _lx, _ly, _qx, _qy); \
334 /* Source operand is byte-sized and may be restricted to just %cl. */
335 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
336 __emulate_2op(_op, _src, _dst, _eflags, \
337 "b", "c", "b", "c", "b", "c", "b", "c")
339 /* Source operand is byte, word, long or quad sized. */
340 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
341 __emulate_2op(_op, _src, _dst, _eflags, \
342 "b", "q", "w", "r", _LO32, "r", "", "r")
344 /* Source operand is word, long or quad sized. */
345 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
346 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
347 "w", "r", _LO32, "r", "", "r")
349 /* Instruction has only one explicit operand (no source operand). */
350 #define emulate_1op(_op, _dst, _eflags) \
352 unsigned long _tmp; \
354 switch ( (_dst).bytes ) \
357 __asm__ __volatile__ ( \
358 _PRE_EFLAGS("0","3","2") \
360 _POST_EFLAGS("0","3","2") \
361 : "=m" (_eflags), "=m" ((_dst).val), \
363 : "i" (EFLAGS_MASK) ); \
366 __asm__ __volatile__ ( \
367 _PRE_EFLAGS("0","3","2") \
369 _POST_EFLAGS("0","3","2") \
370 : "=m" (_eflags), "=m" ((_dst).val), \
372 : "i" (EFLAGS_MASK) ); \
375 __asm__ __volatile__ ( \
376 _PRE_EFLAGS("0","3","2") \
378 _POST_EFLAGS("0","3","2") \
379 : "=m" (_eflags), "=m" ((_dst).val), \
381 : "i" (EFLAGS_MASK) ); \
384 __emulate_1op_8byte(_op, _dst, _eflags); \
389 /* Emulate an instruction with quadword operands (x86/64 only). */
390 #if defined(CONFIG_X86_64)
391 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
393 __asm__ __volatile__ ( \
394 _PRE_EFLAGS("0","4","2") \
395 _op"q %"_qx"3,%1; " \
396 _POST_EFLAGS("0","4","2") \
397 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
398 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
401 #define __emulate_1op_8byte(_op, _dst, _eflags) \
403 __asm__ __volatile__ ( \
404 _PRE_EFLAGS("0","3","2") \
406 _POST_EFLAGS("0","3","2") \
407 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
408 : "i" (EFLAGS_MASK) ); \
411 #elif defined(__i386__)
412 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
413 #define __emulate_1op_8byte(_op, _dst, _eflags)
414 #endif /* __i386__ */
416 /* Fetch next part of the instruction being emulated. */
417 #define insn_fetch(_type, _size, _eip) \
418 ({ unsigned long _x; \
419 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
420 (_size), ctxt->vcpu); \
427 /* Access/update address held in a register, based on addressing mode. */
428 #define address_mask(reg) \
429 ((ad_bytes == sizeof(unsigned long)) ? \
430 (reg) : ((reg) & ((1UL << (ad_bytes << 3)) - 1)))
431 #define register_address(base, reg) \
432 ((base) + address_mask(reg))
433 #define register_address_increment(reg, inc) \
435 /* signed type ensures sign extension to long */ \
437 if ( ad_bytes == sizeof(unsigned long) ) \
440 (reg) = ((reg) & ~((1UL << (ad_bytes << 3)) - 1)) | \
441 (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
444 #define JMP_REL(rel) \
446 _eip += (int)(rel); \
447 _eip = ((op_bytes == 2) ? (uint16_t)_eip : (uint32_t)_eip); \
451 * Given the 'reg' portion of a ModRM byte, and a register block, return a
452 * pointer into the block that addresses the relevant register.
453 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
455 static void *decode_register(u8 modrm_reg, unsigned long *regs,
460 p = ®s[modrm_reg];
461 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
462 p = (unsigned char *)®s[modrm_reg & 3] + 1;
466 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
467 struct x86_emulate_ops *ops,
469 u16 *size, unsigned long *address, int op_bytes)
476 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
480 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
485 static int test_cc(unsigned int condition, unsigned int flags)
489 switch ((condition & 15) >> 1) {
491 rc |= (flags & EFLG_OF);
493 case 1: /* b/c/nae */
494 rc |= (flags & EFLG_CF);
497 rc |= (flags & EFLG_ZF);
500 rc |= (flags & (EFLG_CF|EFLG_ZF));
503 rc |= (flags & EFLG_SF);
506 rc |= (flags & EFLG_PF);
509 rc |= (flags & EFLG_ZF);
512 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
516 /* Odd condition identifiers (lsb == 1) have inverted sense. */
517 return (!!rc ^ (condition & 1));
521 x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
524 u8 b, sib, twobyte = 0, rex_prefix = 0;
525 u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
526 unsigned long *override_base = NULL;
527 unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
529 struct operand src, dst;
530 unsigned long cr2 = ctxt->cr2;
531 int mode = ctxt->mode;
532 unsigned long modrm_ea;
533 int use_modrm_ea, index_reg = 0, base_reg = 0, scale, rip_relative = 0;
537 /* Shadow copy of register state. Committed on successful emulation. */
538 unsigned long _regs[NR_VCPU_REGS];
539 unsigned long _eip = ctxt->vcpu->rip, _eflags = ctxt->eflags;
540 unsigned long modrm_val = 0;
542 memcpy(_regs, ctxt->vcpu->regs, sizeof _regs);
545 case X86EMUL_MODE_REAL:
546 case X86EMUL_MODE_PROT16:
547 op_bytes = ad_bytes = 2;
549 case X86EMUL_MODE_PROT32:
550 op_bytes = ad_bytes = 4;
553 case X86EMUL_MODE_PROT64:
562 /* Legacy prefixes. */
563 for (i = 0; i < 8; i++) {
564 switch (b = insn_fetch(u8, 1, _eip)) {
565 case 0x66: /* operand-size override */
566 op_bytes ^= 6; /* switch between 2/4 bytes */
568 case 0x67: /* address-size override */
569 if (mode == X86EMUL_MODE_PROT64)
570 ad_bytes ^= 12; /* switch between 4/8 bytes */
572 ad_bytes ^= 6; /* switch between 2/4 bytes */
574 case 0x2e: /* CS override */
575 override_base = &ctxt->cs_base;
577 case 0x3e: /* DS override */
578 override_base = &ctxt->ds_base;
580 case 0x26: /* ES override */
581 override_base = &ctxt->es_base;
583 case 0x64: /* FS override */
584 override_base = &ctxt->fs_base;
586 case 0x65: /* GS override */
587 override_base = &ctxt->gs_base;
589 case 0x36: /* SS override */
590 override_base = &ctxt->ss_base;
592 case 0xf0: /* LOCK */
595 case 0xf3: /* REP/REPE/REPZ */
598 case 0xf2: /* REPNE/REPNZ */
608 if ((mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40)) {
611 op_bytes = 8; /* REX.W */
612 modrm_reg = (b & 4) << 1; /* REX.R */
613 index_reg = (b & 2) << 2; /* REX.X */
614 modrm_rm = base_reg = (b & 1) << 3; /* REG.B */
615 b = insn_fetch(u8, 1, _eip);
618 /* Opcode byte(s). */
621 /* Two-byte opcode? */
624 b = insn_fetch(u8, 1, _eip);
625 d = twobyte_table[b];
633 /* ModRM and SIB bytes. */
635 modrm = insn_fetch(u8, 1, _eip);
636 modrm_mod |= (modrm & 0xc0) >> 6;
637 modrm_reg |= (modrm & 0x38) >> 3;
638 modrm_rm |= (modrm & 0x07);
642 if (modrm_mod == 3) {
643 modrm_val = *(unsigned long *)
644 decode_register(modrm_rm, _regs, d & ByteOp);
649 unsigned bx = _regs[VCPU_REGS_RBX];
650 unsigned bp = _regs[VCPU_REGS_RBP];
651 unsigned si = _regs[VCPU_REGS_RSI];
652 unsigned di = _regs[VCPU_REGS_RDI];
654 /* 16-bit ModR/M decode. */
658 modrm_ea += insn_fetch(u16, 2, _eip);
661 modrm_ea += insn_fetch(s8, 1, _eip);
664 modrm_ea += insn_fetch(u16, 2, _eip);
694 if (modrm_rm == 2 || modrm_rm == 3 ||
695 (modrm_rm == 6 && modrm_mod != 0))
697 override_base = &ctxt->ss_base;
698 modrm_ea = (u16)modrm_ea;
700 /* 32/64-bit ModR/M decode. */
704 sib = insn_fetch(u8, 1, _eip);
705 index_reg |= (sib >> 3) & 7;
712 modrm_ea += _regs[base_reg];
714 modrm_ea += insn_fetch(s32, 4, _eip);
717 modrm_ea += _regs[base_reg];
723 modrm_ea += _regs[index_reg] << scale;
729 modrm_ea += _regs[modrm_rm];
730 else if (mode == X86EMUL_MODE_PROT64)
734 modrm_ea += _regs[modrm_rm];
740 modrm_ea += insn_fetch(s32, 4, _eip);
743 modrm_ea += insn_fetch(s8, 1, _eip);
746 modrm_ea += insn_fetch(s32, 4, _eip);
751 override_base = &ctxt->ds_base;
752 if (mode == X86EMUL_MODE_PROT64 &&
753 override_base != &ctxt->fs_base &&
754 override_base != &ctxt->gs_base)
755 override_base = NULL;
758 modrm_ea += *override_base;
762 switch (d & SrcMask) {
773 modrm_ea += op_bytes;
777 modrm_ea = (u32)modrm_ea;
784 * Decode and fetch the source operand: register, memory
787 switch (d & SrcMask) {
793 src.ptr = decode_register(modrm_reg, _regs,
795 src.val = src.orig_val = *(u8 *) src.ptr;
798 src.ptr = decode_register(modrm_reg, _regs, 0);
799 switch ((src.bytes = op_bytes)) {
801 src.val = src.orig_val = *(u16 *) src.ptr;
804 src.val = src.orig_val = *(u32 *) src.ptr;
807 src.val = src.orig_val = *(u64 *) src.ptr;
819 src.bytes = (d & ByteOp) ? 1 : op_bytes;
820 /* Don't fetch the address for invlpg: it could be unmapped. */
821 if (twobyte && b == 0x01 && modrm_reg == 7)
825 src.ptr = (unsigned long *)cr2;
826 if ((rc = ops->read_emulated((unsigned long)src.ptr,
827 &src.val, src.bytes, ctxt->vcpu)) != 0)
829 src.orig_val = src.val;
833 src.ptr = (unsigned long *)_eip;
834 src.bytes = (d & ByteOp) ? 1 : op_bytes;
837 /* NB. Immediates are sign-extended as necessary. */
840 src.val = insn_fetch(s8, 1, _eip);
843 src.val = insn_fetch(s16, 2, _eip);
846 src.val = insn_fetch(s32, 4, _eip);
852 src.ptr = (unsigned long *)_eip;
854 src.val = insn_fetch(s8, 1, _eip);
858 /* Decode and fetch the destination operand: register or memory. */
859 switch (d & DstMask) {
861 /* Special instructions do their own operand decoding. */
866 && !(twobyte && (b == 0xb6 || b == 0xb7))) {
867 dst.ptr = decode_register(modrm_reg, _regs,
869 dst.val = *(u8 *) dst.ptr;
872 dst.ptr = decode_register(modrm_reg, _regs, 0);
873 switch ((dst.bytes = op_bytes)) {
875 dst.val = *(u16 *)dst.ptr;
878 dst.val = *(u32 *)dst.ptr;
881 dst.val = *(u64 *)dst.ptr;
888 dst.ptr = (unsigned long *)cr2;
889 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
891 unsigned long mask = ~(dst.bytes * 8 - 1);
893 dst.ptr = (void *)dst.ptr + (src.val & mask) / 8;
895 if (!(d & Mov) && /* optimisation - avoid slow emulated read */
896 ((rc = ops->read_emulated((unsigned long)dst.ptr,
897 &dst.val, dst.bytes, ctxt->vcpu)) != 0))
901 dst.orig_val = dst.val;
909 emulate_2op_SrcV("add", src, dst, _eflags);
913 emulate_2op_SrcV("or", src, dst, _eflags);
917 emulate_2op_SrcV("adc", src, dst, _eflags);
921 emulate_2op_SrcV("sbb", src, dst, _eflags);
925 emulate_2op_SrcV("and", src, dst, _eflags);
927 case 0x24: /* and al imm8 */
929 dst.ptr = &_regs[VCPU_REGS_RAX];
930 dst.val = *(u8 *)dst.ptr;
932 dst.orig_val = dst.val;
934 case 0x25: /* and ax imm16, or eax imm32 */
936 dst.bytes = op_bytes;
937 dst.ptr = &_regs[VCPU_REGS_RAX];
939 dst.val = *(u16 *)dst.ptr;
941 dst.val = *(u32 *)dst.ptr;
942 dst.orig_val = dst.val;
946 emulate_2op_SrcV("sub", src, dst, _eflags);
950 emulate_2op_SrcV("xor", src, dst, _eflags);
954 emulate_2op_SrcV("cmp", src, dst, _eflags);
956 case 0x63: /* movsxd */
957 if (mode != X86EMUL_MODE_PROT64)
959 dst.val = (s32) src.val;
961 case 0x6a: /* push imm8 */
963 src.val = insn_fetch(s8, 1, _eip);
966 dst.bytes = op_bytes;
968 register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
969 dst.ptr = (void *) register_address(ctxt->ss_base,
970 _regs[VCPU_REGS_RSP]);
972 case 0x80 ... 0x83: /* Grp1 */
994 emulate_2op_SrcV("test", src, dst, _eflags);
996 case 0x86 ... 0x87: /* xchg */
997 /* Write back the register source. */
1000 *(u8 *) src.ptr = (u8) dst.val;
1003 *(u16 *) src.ptr = (u16) dst.val;
1006 *src.ptr = (u32) dst.val;
1007 break; /* 64b reg: zero-extend */
1013 * Write back the memory destination with implicit LOCK
1019 case 0x88 ... 0x8b: /* mov */
1021 case 0x8f: /* pop (sole member of Grp1a) */
1022 /* 64-bit mode: POP always pops a 64-bit operand. */
1023 if (mode == X86EMUL_MODE_PROT64)
1025 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1026 _regs[VCPU_REGS_RSP]),
1027 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
1029 register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
1031 case 0xa0 ... 0xa1: /* mov */
1032 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1034 _eip += ad_bytes; /* skip src displacement */
1036 case 0xa2 ... 0xa3: /* mov */
1037 dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
1038 _eip += ad_bytes; /* skip dst displacement */
1042 switch (modrm_reg) {
1044 emulate_2op_SrcB("rol", src, dst, _eflags);
1047 emulate_2op_SrcB("ror", src, dst, _eflags);
1050 emulate_2op_SrcB("rcl", src, dst, _eflags);
1053 emulate_2op_SrcB("rcr", src, dst, _eflags);
1055 case 4: /* sal/shl */
1056 case 6: /* sal/shl */
1057 emulate_2op_SrcB("sal", src, dst, _eflags);
1060 emulate_2op_SrcB("shr", src, dst, _eflags);
1063 emulate_2op_SrcB("sar", src, dst, _eflags);
1067 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1071 case 0xd0 ... 0xd1: /* Grp2 */
1074 case 0xd2 ... 0xd3: /* Grp2 */
1075 src.val = _regs[VCPU_REGS_RCX];
1077 case 0xe8: /* call (near) */ {
1081 rel = insn_fetch(s16, 2, _eip);
1084 rel = insn_fetch(s32, 4, _eip);
1087 rel = insn_fetch(s64, 8, _eip);
1090 DPRINTF("Call: Invalid op_bytes\n");
1091 goto cannot_emulate;
1093 src.val = (unsigned long) _eip;
1097 case 0xe9: /* jmp rel */
1098 case 0xeb: /* jmp rel short */
1100 no_wb = 1; /* Disable writeback. */
1102 case 0xf6 ... 0xf7: /* Grp3 */
1103 switch (modrm_reg) {
1104 case 0 ... 1: /* test */
1106 * Special case in Grp3: test has an immediate
1110 src.ptr = (unsigned long *)_eip;
1111 src.bytes = (d & ByteOp) ? 1 : op_bytes;
1114 switch (src.bytes) {
1116 src.val = insn_fetch(s8, 1, _eip);
1119 src.val = insn_fetch(s16, 2, _eip);
1122 src.val = insn_fetch(s32, 4, _eip);
1130 emulate_1op("neg", dst, _eflags);
1133 goto cannot_emulate;
1136 case 0xfe ... 0xff: /* Grp4/Grp5 */
1137 switch (modrm_reg) {
1139 emulate_1op("inc", dst, _eflags);
1142 emulate_1op("dec", dst, _eflags);
1145 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1146 if (mode == X86EMUL_MODE_PROT64) {
1148 if ((rc = ops->read_std((unsigned long)dst.ptr,
1153 register_address_increment(_regs[VCPU_REGS_RSP],
1155 if ((rc = ops->write_std(
1156 register_address(ctxt->ss_base,
1157 _regs[VCPU_REGS_RSP]),
1158 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
1163 goto cannot_emulate;
1172 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1173 switch (dst.bytes) {
1175 *(u8 *)dst.ptr = (u8)dst.val;
1178 *(u16 *)dst.ptr = (u16)dst.val;
1181 *dst.ptr = (u32)dst.val;
1182 break; /* 64b: zero-ext */
1190 rc = ops->cmpxchg_emulated((unsigned long)dst.
1192 &dst.val, dst.bytes,
1195 rc = ops->write_emulated((unsigned long)dst.ptr,
1196 &dst.val, dst.bytes,
1205 /* Commit shadow register state. */
1206 memcpy(ctxt->vcpu->regs, _regs, sizeof _regs);
1207 ctxt->eflags = _eflags;
1208 ctxt->vcpu->rip = _eip;
1211 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1215 goto twobyte_special_insn;
1217 case 0x50 ... 0x57: /* push reg */
1219 src.val = (u16) _regs[b & 0x7];
1221 src.val = (u32) _regs[b & 0x7];
1223 dst.bytes = op_bytes;
1225 register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
1226 dst.ptr = (void *) register_address(
1227 ctxt->ss_base, _regs[VCPU_REGS_RSP]);
1229 case 0x58 ... 0x5f: /* pop reg */
1230 dst.ptr = (unsigned long *)&_regs[b & 0x7];
1232 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1233 _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt->vcpu))
1237 register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
1238 no_wb = 1; /* Disable writeback. */
1240 case 0x6c: /* insb */
1241 case 0x6d: /* insw/insd */
1242 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1244 (d & ByteOp) ? 1 : op_bytes, /* size */
1246 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
1247 (_eflags & EFLG_DF), /* down */
1248 register_address(ctxt->es_base,
1249 _regs[VCPU_REGS_RDI]), /* address */
1251 _regs[VCPU_REGS_RDX] /* port */
1255 case 0x6e: /* outsb */
1256 case 0x6f: /* outsw/outsd */
1257 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1259 (d & ByteOp) ? 1 : op_bytes, /* size */
1261 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
1262 (_eflags & EFLG_DF), /* down */
1263 register_address(override_base ?
1264 *override_base : ctxt->ds_base,
1265 _regs[VCPU_REGS_RSI]), /* address */
1267 _regs[VCPU_REGS_RDX] /* port */
1271 case 0x9c: /* pushf */
1272 src.val = (unsigned long) _eflags;
1274 case 0xc3: /* ret */
1276 goto pop_instruction;
1277 case 0xf4: /* hlt */
1278 ctxt->vcpu->halt_request = 1;
1282 if (_regs[VCPU_REGS_RCX] == 0) {
1283 ctxt->vcpu->rip = _eip;
1286 _regs[VCPU_REGS_RCX]--;
1287 _eip = ctxt->vcpu->rip;
1290 case 0xa4 ... 0xa5: /* movs */
1292 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1293 dst.ptr = (unsigned long *)register_address(ctxt->es_base,
1294 _regs[VCPU_REGS_RDI]);
1295 if ((rc = ops->read_emulated(register_address(
1296 override_base ? *override_base : ctxt->ds_base,
1297 _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt->vcpu)) != 0)
1299 register_address_increment(_regs[VCPU_REGS_RSI],
1300 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1301 register_address_increment(_regs[VCPU_REGS_RDI],
1302 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1304 case 0xa6 ... 0xa7: /* cmps */
1305 DPRINTF("Urk! I don't handle CMPS.\n");
1306 goto cannot_emulate;
1307 case 0xaa ... 0xab: /* stos */
1309 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1310 dst.ptr = (unsigned long *)cr2;
1311 dst.val = _regs[VCPU_REGS_RAX];
1312 register_address_increment(_regs[VCPU_REGS_RDI],
1313 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1315 case 0xac ... 0xad: /* lods */
1317 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1318 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1319 if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes,
1322 register_address_increment(_regs[VCPU_REGS_RSI],
1323 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1325 case 0xae ... 0xaf: /* scas */
1326 DPRINTF("Urk! I don't handle SCAS.\n");
1327 goto cannot_emulate;
1334 case 0x01: /* lgdt, lidt, lmsw */
1335 /* Disable writeback. */
1337 switch (modrm_reg) {
1339 unsigned long address;
1342 rc = read_descriptor(ctxt, ops, src.ptr,
1343 &size, &address, op_bytes);
1346 realmode_lgdt(ctxt->vcpu, size, address);
1349 rc = read_descriptor(ctxt, ops, src.ptr,
1350 &size, &address, op_bytes);
1353 realmode_lidt(ctxt->vcpu, size, address);
1357 goto cannot_emulate;
1358 *(u16 *)&_regs[modrm_rm]
1359 = realmode_get_cr(ctxt->vcpu, 0);
1363 goto cannot_emulate;
1364 realmode_lmsw(ctxt->vcpu, (u16)modrm_val, &_eflags);
1367 emulate_invlpg(ctxt->vcpu, cr2);
1370 goto cannot_emulate;
1373 case 0x21: /* mov from dr to reg */
1376 goto cannot_emulate;
1377 rc = emulator_get_dr(ctxt, modrm_reg, &_regs[modrm_rm]);
1379 case 0x23: /* mov from reg to dr */
1382 goto cannot_emulate;
1383 rc = emulator_set_dr(ctxt, modrm_reg, _regs[modrm_rm]);
1385 case 0x40 ... 0x4f: /* cmov */
1386 dst.val = dst.orig_val = src.val;
1389 * First, assume we're decoding an even cmov opcode
1392 switch ((b & 15) >> 1) {
1394 no_wb = (_eflags & EFLG_OF) ? 0 : 1;
1396 case 1: /* cmovb/cmovc/cmovnae */
1397 no_wb = (_eflags & EFLG_CF) ? 0 : 1;
1399 case 2: /* cmovz/cmove */
1400 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
1402 case 3: /* cmovbe/cmovna */
1403 no_wb = (_eflags & (EFLG_CF | EFLG_ZF)) ? 0 : 1;
1406 no_wb = (_eflags & EFLG_SF) ? 0 : 1;
1408 case 5: /* cmovp/cmovpe */
1409 no_wb = (_eflags & EFLG_PF) ? 0 : 1;
1411 case 7: /* cmovle/cmovng */
1412 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
1414 case 6: /* cmovl/cmovnge */
1415 no_wb &= (!(_eflags & EFLG_SF) !=
1416 !(_eflags & EFLG_OF)) ? 0 : 1;
1419 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
1424 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1425 emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
1429 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1430 emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
1432 case 0xb0 ... 0xb1: /* cmpxchg */
1434 * Save real source value, then compare EAX against
1437 src.orig_val = src.val;
1438 src.val = _regs[VCPU_REGS_RAX];
1439 emulate_2op_SrcV("cmp", src, dst, _eflags);
1440 if (_eflags & EFLG_ZF) {
1441 /* Success: write back to memory. */
1442 dst.val = src.orig_val;
1444 /* Failure: write the value we saw to EAX. */
1446 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1451 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1452 emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
1454 case 0xb6 ... 0xb7: /* movzx */
1455 dst.bytes = op_bytes;
1456 dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
1458 case 0xba: /* Grp8 */
1459 switch (modrm_reg & 3) {
1472 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1473 emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
1475 case 0xbe ... 0xbf: /* movsx */
1476 dst.bytes = op_bytes;
1477 dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
1482 twobyte_special_insn:
1483 /* Disable writeback. */
1487 emulate_clts(ctxt->vcpu);
1489 case 0x09: /* wbinvd */
1491 case 0x0d: /* GrpP (prefetch) */
1492 case 0x18: /* Grp16 (prefetch/nop) */
1494 case 0x20: /* mov cr, reg */
1496 goto cannot_emulate;
1497 _regs[modrm_rm] = realmode_get_cr(ctxt->vcpu, modrm_reg);
1499 case 0x22: /* mov reg, cr */
1501 goto cannot_emulate;
1502 realmode_set_cr(ctxt->vcpu, modrm_reg, modrm_val, &_eflags);
1506 msr_data = (u32)_regs[VCPU_REGS_RAX]
1507 | ((u64)_regs[VCPU_REGS_RDX] << 32);
1508 rc = kvm_set_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], msr_data);
1510 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
1511 _eip = ctxt->vcpu->rip;
1513 rc = X86EMUL_CONTINUE;
1517 rc = kvm_get_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], &msr_data);
1519 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
1520 _eip = ctxt->vcpu->rip;
1522 _regs[VCPU_REGS_RAX] = (u32)msr_data;
1523 _regs[VCPU_REGS_RDX] = msr_data >> 32;
1525 rc = X86EMUL_CONTINUE;
1527 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1532 rel = insn_fetch(s16, 2, _eip);
1535 rel = insn_fetch(s32, 4, _eip);
1538 rel = insn_fetch(s64, 8, _eip);
1541 DPRINTF("jnz: Invalid op_bytes\n");
1542 goto cannot_emulate;
1544 if (test_cc(b, _eflags))
1548 case 0xc7: /* Grp9 (cmpxchg8b) */
1551 if ((rc = ops->read_emulated(cr2, &old, 8, ctxt->vcpu))
1554 if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
1555 ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
1556 _regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1557 _regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1558 _eflags &= ~EFLG_ZF;
1560 new = ((u64)_regs[VCPU_REGS_RCX] << 32)
1561 | (u32) _regs[VCPU_REGS_RBX];
1562 if ((rc = ops->cmpxchg_emulated(cr2, &old,
1563 &new, 8, ctxt->vcpu)) != 0)
1573 DPRINTF("Cannot emulate %02x\n", b);
1580 #include <asm/uaccess.h>
1583 x86_emulate_read_std(unsigned long addr,
1585 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1591 if ((rc = copy_from_user((void *)val, (void *)addr, bytes)) != 0) {
1592 propagate_page_fault(addr + bytes - rc, 0); /* read fault */
1593 return X86EMUL_PROPAGATE_FAULT;
1596 return X86EMUL_CONTINUE;
1600 x86_emulate_write_std(unsigned long addr,
1602 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1606 if ((rc = copy_to_user((void *)addr, (void *)&val, bytes)) != 0) {
1607 propagate_page_fault(addr + bytes - rc, PGERR_write_access);
1608 return X86EMUL_PROPAGATE_FAULT;
1611 return X86EMUL_CONTINUE;