1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf(_f , ## _a)
28 #include <linux/kvm_host.h>
29 #include "kvm_cache_regs.h"
30 #define DPRINTF(x...) do {} while (0)
32 #include <linux/module.h>
33 #include <asm/kvm_emulate.h>
38 * Opcode effective-address decode tables.
39 * Note that we only emulate instructions that have at least one memory
40 * operand (excluding implicit stack references). We assume that stack
41 * references and instruction fetches will never occur in special memory
42 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
46 /* Operand sizes: 8-bit operands or specified/overridden size. */
47 #define ByteOp (1<<0) /* 8-bit operands. */
48 /* Destination operand type. */
49 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
50 #define DstReg (2<<1) /* Register operand. */
51 #define DstMem (3<<1) /* Memory operand. */
52 #define DstAcc (4<<1) /* Destination Accumulator */
53 #define DstMask (7<<1)
54 /* Source operand type. */
55 #define SrcNone (0<<4) /* No source operand. */
56 #define SrcImplicit (0<<4) /* Source operand is implicit in the opcode. */
57 #define SrcReg (1<<4) /* Register operand. */
58 #define SrcMem (2<<4) /* Memory operand. */
59 #define SrcMem16 (3<<4) /* Memory operand (16-bit). */
60 #define SrcMem32 (4<<4) /* Memory operand (32-bit). */
61 #define SrcImm (5<<4) /* Immediate operand. */
62 #define SrcImmByte (6<<4) /* 8-bit sign-extended immediate operand. */
63 #define SrcOne (7<<4) /* Implied '1' */
64 #define SrcImmUByte (8<<4) /* 8-bit unsigned immediate operand. */
65 #define SrcImmU (9<<4) /* Immediate operand, unsigned */
66 #define SrcMask (0xf<<4)
67 /* Generic ModRM decode. */
69 /* Destination is only written; never read. */
72 #define MemAbs (1<<11) /* Memory operand is absolute displacement */
73 #define String (1<<12) /* String instruction (rep capable) */
74 #define Stack (1<<13) /* Stack instruction (push/pop) */
75 #define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
76 #define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
77 #define GroupMask 0xff /* Group number stored in bits 0:7 */
80 /* Source 2 operand type */
81 #define Src2None (0<<29)
82 #define Src2CL (1<<29)
83 #define Src2ImmByte (2<<29)
84 #define Src2One (3<<29)
85 #define Src2Imm16 (4<<29)
86 #define Src2Mask (7<<29)
89 Group1_80, Group1_81, Group1_82, Group1_83,
90 Group1A, Group3_Byte, Group3, Group4, Group5, Group7,
94 static u32 opcode_table[256] = {
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
98 ByteOp | DstAcc | SrcImm, DstAcc | SrcImm,
99 ImplicitOps | Stack | No64, ImplicitOps | Stack | No64,
101 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
102 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
103 ByteOp | DstAcc | SrcImm, DstAcc | SrcImm,
104 ImplicitOps | Stack | No64, 0,
106 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
107 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
108 ByteOp | DstAcc | SrcImm, DstAcc | SrcImm,
109 ImplicitOps | Stack | No64, ImplicitOps | Stack | No64,
111 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
112 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
113 ByteOp | DstAcc | SrcImm, DstAcc | SrcImm,
114 ImplicitOps | Stack | No64, ImplicitOps | Stack | No64,
116 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
117 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
118 DstAcc | SrcImmByte, DstAcc | SrcImm, 0, 0,
120 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
121 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
124 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
125 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
128 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
129 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
130 ByteOp | DstAcc | SrcImm, DstAcc | SrcImm,
133 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
135 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
137 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
138 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
140 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
141 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
143 ImplicitOps | Stack | No64, ImplicitOps | Stack | No64,
144 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
147 SrcImm | Mov | Stack, 0, SrcImmByte | Mov | Stack, 0,
148 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
149 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
151 SrcImmByte, SrcImmByte, SrcImmByte, SrcImmByte,
152 SrcImmByte, SrcImmByte, SrcImmByte, SrcImmByte,
154 SrcImmByte, SrcImmByte, SrcImmByte, SrcImmByte,
155 SrcImmByte, SrcImmByte, SrcImmByte, SrcImmByte,
157 Group | Group1_80, Group | Group1_81,
158 Group | Group1_82, Group | Group1_83,
159 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
160 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
162 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
163 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
164 DstMem | SrcReg | ModRM | Mov, ModRM | DstReg,
165 DstReg | SrcMem | ModRM | Mov, Group | Group1A,
167 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
169 0, 0, SrcImm | Src2Imm16 | No64, 0,
170 ImplicitOps | Stack, ImplicitOps | Stack, 0, 0,
172 ByteOp | DstReg | SrcMem | Mov | MemAbs, DstReg | SrcMem | Mov | MemAbs,
173 ByteOp | DstMem | SrcReg | Mov | MemAbs, DstMem | SrcReg | Mov | MemAbs,
174 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
175 ByteOp | ImplicitOps | String, ImplicitOps | String,
177 0, 0, ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
178 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
179 ByteOp | ImplicitOps | String, ImplicitOps | String,
181 ByteOp | DstReg | SrcImm | Mov, ByteOp | DstReg | SrcImm | Mov,
182 ByteOp | DstReg | SrcImm | Mov, ByteOp | DstReg | SrcImm | Mov,
183 ByteOp | DstReg | SrcImm | Mov, ByteOp | DstReg | SrcImm | Mov,
184 ByteOp | DstReg | SrcImm | Mov, ByteOp | DstReg | SrcImm | Mov,
186 DstReg | SrcImm | Mov, DstReg | SrcImm | Mov,
187 DstReg | SrcImm | Mov, DstReg | SrcImm | Mov,
188 DstReg | SrcImm | Mov, DstReg | SrcImm | Mov,
189 DstReg | SrcImm | Mov, DstReg | SrcImm | Mov,
191 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
192 0, ImplicitOps | Stack, 0, 0,
193 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
195 0, 0, 0, ImplicitOps | Stack,
196 ImplicitOps, SrcImmByte, ImplicitOps | No64, ImplicitOps,
198 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
199 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
202 0, 0, 0, 0, 0, 0, 0, 0,
205 ByteOp | SrcImmUByte, SrcImmUByte,
206 ByteOp | SrcImmUByte, SrcImmUByte,
208 SrcImm | Stack, SrcImm | ImplicitOps,
209 SrcImmU | Src2Imm16 | No64, SrcImmByte | ImplicitOps,
210 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps,
211 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps,
214 ImplicitOps, ImplicitOps, Group | Group3_Byte, Group | Group3,
216 ImplicitOps, 0, ImplicitOps, ImplicitOps,
217 ImplicitOps, ImplicitOps, Group | Group4, Group | Group5,
220 static u32 twobyte_table[256] = {
222 0, Group | GroupDual | Group7, 0, 0, 0, ImplicitOps, ImplicitOps, 0,
223 ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
225 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
227 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
228 0, 0, 0, 0, 0, 0, 0, 0,
230 ImplicitOps, 0, ImplicitOps, 0,
231 ImplicitOps, ImplicitOps, 0, 0,
232 0, 0, 0, 0, 0, 0, 0, 0,
234 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
235 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
236 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
237 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
239 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
240 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
241 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
242 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
244 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
246 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
248 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
250 SrcImm, SrcImm, SrcImm, SrcImm, SrcImm, SrcImm, SrcImm, SrcImm,
251 SrcImm, SrcImm, SrcImm, SrcImm, SrcImm, SrcImm, SrcImm, SrcImm,
253 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
255 ImplicitOps | Stack, ImplicitOps | Stack,
256 0, DstMem | SrcReg | ModRM | BitOp,
257 DstMem | SrcReg | Src2ImmByte | ModRM,
258 DstMem | SrcReg | Src2CL | ModRM, 0, 0,
260 ImplicitOps | Stack, ImplicitOps | Stack,
261 0, DstMem | SrcReg | ModRM | BitOp,
262 DstMem | SrcReg | Src2ImmByte | ModRM,
263 DstMem | SrcReg | Src2CL | ModRM,
266 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
267 DstMem | SrcReg | ModRM | BitOp,
268 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
269 DstReg | SrcMem16 | ModRM | Mov,
271 0, 0, Group | Group8, DstMem | SrcReg | ModRM | BitOp,
272 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
273 DstReg | SrcMem16 | ModRM | Mov,
275 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
276 0, 0, 0, 0, 0, 0, 0, 0,
278 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
280 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
282 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
285 static u32 group_table[] = {
287 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
288 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
289 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
290 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
292 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
293 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
294 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
295 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
297 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
298 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
299 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
300 ByteOp | DstMem | SrcImm | ModRM, ByteOp | DstMem | SrcImm | ModRM,
302 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
303 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
304 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
305 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
307 DstMem | SrcNone | ModRM | Mov | Stack, 0, 0, 0, 0, 0, 0, 0,
309 ByteOp | SrcImm | DstMem | ModRM, 0,
310 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
313 DstMem | SrcImm | ModRM, 0,
314 DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
317 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
320 DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
321 SrcMem | ModRM | Stack, 0,
322 SrcMem | ModRM | Stack, 0, SrcMem | ModRM | Stack, 0,
324 0, 0, ModRM | SrcMem, ModRM | SrcMem,
325 SrcNone | ModRM | DstMem | Mov, 0,
326 SrcMem16 | ModRM | Mov, SrcMem | ModRM | ByteOp,
329 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
330 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM,
333 static u32 group2_table[] = {
335 SrcNone | ModRM, 0, 0, SrcNone | ModRM,
336 SrcNone | ModRM | DstMem | Mov, 0,
337 SrcMem16 | ModRM | Mov, 0,
340 /* EFLAGS bit definitions. */
341 #define EFLG_VM (1<<17)
342 #define EFLG_RF (1<<16)
343 #define EFLG_OF (1<<11)
344 #define EFLG_DF (1<<10)
345 #define EFLG_IF (1<<9)
346 #define EFLG_SF (1<<7)
347 #define EFLG_ZF (1<<6)
348 #define EFLG_AF (1<<4)
349 #define EFLG_PF (1<<2)
350 #define EFLG_CF (1<<0)
353 * Instruction emulation:
354 * Most instructions are emulated directly via a fragment of inline assembly
355 * code. This allows us to save/restore EFLAGS and thus very easily pick up
356 * any modified flags.
359 #if defined(CONFIG_X86_64)
360 #define _LO32 "k" /* force 32-bit operand */
361 #define _STK "%%rsp" /* stack pointer */
362 #elif defined(__i386__)
363 #define _LO32 "" /* force 32-bit operand */
364 #define _STK "%%esp" /* stack pointer */
368 * These EFLAGS bits are restored from saved value during emulation, and
369 * any changes are written back to the saved value after emulation.
371 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
373 /* Before executing instruction: restore necessary bits in EFLAGS. */
374 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
375 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
376 "movl %"_sav",%"_LO32 _tmp"; " \
379 "movl %"_msk",%"_LO32 _tmp"; " \
380 "andl %"_LO32 _tmp",("_STK"); " \
382 "notl %"_LO32 _tmp"; " \
383 "andl %"_LO32 _tmp",("_STK"); " \
384 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
386 "orl %"_LO32 _tmp",("_STK"); " \
390 /* After executing instruction: write-back necessary bits in EFLAGS. */
391 #define _POST_EFLAGS(_sav, _msk, _tmp) \
392 /* _sav |= EFLAGS & _msk; */ \
395 "andl %"_msk",%"_LO32 _tmp"; " \
396 "orl %"_LO32 _tmp",%"_sav"; "
404 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix) \
406 __asm__ __volatile__ ( \
407 _PRE_EFLAGS("0", "4", "2") \
408 _op _suffix " %"_x"3,%1; " \
409 _POST_EFLAGS("0", "4", "2") \
410 : "=m" (_eflags), "=m" ((_dst).val), \
412 : _y ((_src).val), "i" (EFLAGS_MASK)); \
416 /* Raw emulation: instruction has two explicit operands. */
417 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
419 unsigned long _tmp; \
421 switch ((_dst).bytes) { \
423 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
426 ____emulate_2op(_op,_src,_dst,_eflags,_lx,_ly,"l"); \
429 ON64(____emulate_2op(_op,_src,_dst,_eflags,_qx,_qy,"q")); \
434 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
436 unsigned long _tmp; \
437 switch ((_dst).bytes) { \
439 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b"); \
442 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
443 _wx, _wy, _lx, _ly, _qx, _qy); \
448 /* Source operand is byte-sized and may be restricted to just %cl. */
449 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
450 __emulate_2op(_op, _src, _dst, _eflags, \
451 "b", "c", "b", "c", "b", "c", "b", "c")
453 /* Source operand is byte, word, long or quad sized. */
454 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
455 __emulate_2op(_op, _src, _dst, _eflags, \
456 "b", "q", "w", "r", _LO32, "r", "", "r")
458 /* Source operand is word, long or quad sized. */
459 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
460 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
461 "w", "r", _LO32, "r", "", "r")
463 /* Instruction has three operands and one operand is stored in ECX register */
464 #define __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, _suffix, _type) \
466 unsigned long _tmp; \
467 _type _clv = (_cl).val; \
468 _type _srcv = (_src).val; \
469 _type _dstv = (_dst).val; \
471 __asm__ __volatile__ ( \
472 _PRE_EFLAGS("0", "5", "2") \
473 _op _suffix " %4,%1 \n" \
474 _POST_EFLAGS("0", "5", "2") \
475 : "=m" (_eflags), "+r" (_dstv), "=&r" (_tmp) \
476 : "c" (_clv) , "r" (_srcv), "i" (EFLAGS_MASK) \
479 (_cl).val = (unsigned long) _clv; \
480 (_src).val = (unsigned long) _srcv; \
481 (_dst).val = (unsigned long) _dstv; \
484 #define emulate_2op_cl(_op, _cl, _src, _dst, _eflags) \
486 switch ((_dst).bytes) { \
488 __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
489 "w", unsigned short); \
492 __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
493 "l", unsigned int); \
496 ON64(__emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
497 "q", unsigned long)); \
502 #define __emulate_1op(_op, _dst, _eflags, _suffix) \
504 unsigned long _tmp; \
506 __asm__ __volatile__ ( \
507 _PRE_EFLAGS("0", "3", "2") \
508 _op _suffix " %1; " \
509 _POST_EFLAGS("0", "3", "2") \
510 : "=m" (_eflags), "+m" ((_dst).val), \
512 : "i" (EFLAGS_MASK)); \
515 /* Instruction has only one explicit operand (no source operand). */
516 #define emulate_1op(_op, _dst, _eflags) \
518 switch ((_dst).bytes) { \
519 case 1: __emulate_1op(_op, _dst, _eflags, "b"); break; \
520 case 2: __emulate_1op(_op, _dst, _eflags, "w"); break; \
521 case 4: __emulate_1op(_op, _dst, _eflags, "l"); break; \
522 case 8: ON64(__emulate_1op(_op, _dst, _eflags, "q")); break; \
526 /* Fetch next part of the instruction being emulated. */
527 #define insn_fetch(_type, _size, _eip) \
528 ({ unsigned long _x; \
529 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
536 static inline unsigned long ad_mask(struct decode_cache *c)
538 return (1UL << (c->ad_bytes << 3)) - 1;
541 /* Access/update address held in a register, based on addressing mode. */
542 static inline unsigned long
543 address_mask(struct decode_cache *c, unsigned long reg)
545 if (c->ad_bytes == sizeof(unsigned long))
548 return reg & ad_mask(c);
551 static inline unsigned long
552 register_address(struct decode_cache *c, unsigned long base, unsigned long reg)
554 return base + address_mask(c, reg);
558 register_address_increment(struct decode_cache *c, unsigned long *reg, int inc)
560 if (c->ad_bytes == sizeof(unsigned long))
563 *reg = (*reg & ~ad_mask(c)) | ((*reg + inc) & ad_mask(c));
566 static inline void jmp_rel(struct decode_cache *c, int rel)
568 register_address_increment(c, &c->eip, rel);
571 static void set_seg_override(struct decode_cache *c, int seg)
573 c->has_seg_override = true;
574 c->seg_override = seg;
577 static unsigned long seg_base(struct x86_emulate_ctxt *ctxt, int seg)
579 if (ctxt->mode == X86EMUL_MODE_PROT64 && seg < VCPU_SREG_FS)
582 return kvm_x86_ops->get_segment_base(ctxt->vcpu, seg);
585 static unsigned long seg_override_base(struct x86_emulate_ctxt *ctxt,
586 struct decode_cache *c)
588 if (!c->has_seg_override)
591 return seg_base(ctxt, c->seg_override);
594 static unsigned long es_base(struct x86_emulate_ctxt *ctxt)
596 return seg_base(ctxt, VCPU_SREG_ES);
599 static unsigned long ss_base(struct x86_emulate_ctxt *ctxt)
601 return seg_base(ctxt, VCPU_SREG_SS);
604 static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
605 struct x86_emulate_ops *ops,
606 unsigned long linear, u8 *dest)
608 struct fetch_cache *fc = &ctxt->decode.fetch;
612 if (linear < fc->start || linear >= fc->end) {
613 size = min(15UL, PAGE_SIZE - offset_in_page(linear));
614 rc = ops->read_std(linear, fc->data, size, ctxt->vcpu);
618 fc->end = linear + size;
620 *dest = fc->data[linear - fc->start];
624 static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
625 struct x86_emulate_ops *ops,
626 unsigned long eip, void *dest, unsigned size)
630 /* x86 instructions are limited to 15 bytes. */
631 if (eip + size - ctxt->decode.eip_orig > 15)
632 return X86EMUL_UNHANDLEABLE;
633 eip += ctxt->cs_base;
635 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
643 * Given the 'reg' portion of a ModRM byte, and a register block, return a
644 * pointer into the block that addresses the relevant register.
645 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
647 static void *decode_register(u8 modrm_reg, unsigned long *regs,
652 p = ®s[modrm_reg];
653 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
654 p = (unsigned char *)®s[modrm_reg & 3] + 1;
658 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
659 struct x86_emulate_ops *ops,
661 u16 *size, unsigned long *address, int op_bytes)
668 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
672 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
677 static int test_cc(unsigned int condition, unsigned int flags)
681 switch ((condition & 15) >> 1) {
683 rc |= (flags & EFLG_OF);
685 case 1: /* b/c/nae */
686 rc |= (flags & EFLG_CF);
689 rc |= (flags & EFLG_ZF);
692 rc |= (flags & (EFLG_CF|EFLG_ZF));
695 rc |= (flags & EFLG_SF);
698 rc |= (flags & EFLG_PF);
701 rc |= (flags & EFLG_ZF);
704 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
708 /* Odd condition identifiers (lsb == 1) have inverted sense. */
709 return (!!rc ^ (condition & 1));
712 static void decode_register_operand(struct operand *op,
713 struct decode_cache *c,
716 unsigned reg = c->modrm_reg;
717 int highbyte_regs = c->rex_prefix == 0;
720 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
722 if ((c->d & ByteOp) && !inhibit_bytereg) {
723 op->ptr = decode_register(reg, c->regs, highbyte_regs);
724 op->val = *(u8 *)op->ptr;
727 op->ptr = decode_register(reg, c->regs, 0);
728 op->bytes = c->op_bytes;
731 op->val = *(u16 *)op->ptr;
734 op->val = *(u32 *)op->ptr;
737 op->val = *(u64 *) op->ptr;
741 op->orig_val = op->val;
744 static int decode_modrm(struct x86_emulate_ctxt *ctxt,
745 struct x86_emulate_ops *ops)
747 struct decode_cache *c = &ctxt->decode;
749 int index_reg = 0, base_reg = 0, scale;
753 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
754 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
755 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
758 c->modrm = insn_fetch(u8, 1, c->eip);
759 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
760 c->modrm_reg |= (c->modrm & 0x38) >> 3;
761 c->modrm_rm |= (c->modrm & 0x07);
765 if (c->modrm_mod == 3) {
766 c->modrm_ptr = decode_register(c->modrm_rm,
767 c->regs, c->d & ByteOp);
768 c->modrm_val = *(unsigned long *)c->modrm_ptr;
772 if (c->ad_bytes == 2) {
773 unsigned bx = c->regs[VCPU_REGS_RBX];
774 unsigned bp = c->regs[VCPU_REGS_RBP];
775 unsigned si = c->regs[VCPU_REGS_RSI];
776 unsigned di = c->regs[VCPU_REGS_RDI];
778 /* 16-bit ModR/M decode. */
779 switch (c->modrm_mod) {
781 if (c->modrm_rm == 6)
782 c->modrm_ea += insn_fetch(u16, 2, c->eip);
785 c->modrm_ea += insn_fetch(s8, 1, c->eip);
788 c->modrm_ea += insn_fetch(u16, 2, c->eip);
791 switch (c->modrm_rm) {
793 c->modrm_ea += bx + si;
796 c->modrm_ea += bx + di;
799 c->modrm_ea += bp + si;
802 c->modrm_ea += bp + di;
811 if (c->modrm_mod != 0)
818 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
819 (c->modrm_rm == 6 && c->modrm_mod != 0))
820 if (!c->has_seg_override)
821 set_seg_override(c, VCPU_SREG_SS);
822 c->modrm_ea = (u16)c->modrm_ea;
824 /* 32/64-bit ModR/M decode. */
825 if ((c->modrm_rm & 7) == 4) {
826 sib = insn_fetch(u8, 1, c->eip);
827 index_reg |= (sib >> 3) & 7;
831 if ((base_reg & 7) == 5 && c->modrm_mod == 0)
832 c->modrm_ea += insn_fetch(s32, 4, c->eip);
834 c->modrm_ea += c->regs[base_reg];
836 c->modrm_ea += c->regs[index_reg] << scale;
837 } else if ((c->modrm_rm & 7) == 5 && c->modrm_mod == 0) {
838 if (ctxt->mode == X86EMUL_MODE_PROT64)
841 c->modrm_ea += c->regs[c->modrm_rm];
842 switch (c->modrm_mod) {
844 if (c->modrm_rm == 5)
845 c->modrm_ea += insn_fetch(s32, 4, c->eip);
848 c->modrm_ea += insn_fetch(s8, 1, c->eip);
851 c->modrm_ea += insn_fetch(s32, 4, c->eip);
859 static int decode_abs(struct x86_emulate_ctxt *ctxt,
860 struct x86_emulate_ops *ops)
862 struct decode_cache *c = &ctxt->decode;
865 switch (c->ad_bytes) {
867 c->modrm_ea = insn_fetch(u16, 2, c->eip);
870 c->modrm_ea = insn_fetch(u32, 4, c->eip);
873 c->modrm_ea = insn_fetch(u64, 8, c->eip);
881 x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
883 struct decode_cache *c = &ctxt->decode;
885 int mode = ctxt->mode;
886 int def_op_bytes, def_ad_bytes, group;
888 /* Shadow copy of register state. Committed on successful emulation. */
890 memset(c, 0, sizeof(struct decode_cache));
891 c->eip = c->eip_orig = kvm_rip_read(ctxt->vcpu);
892 ctxt->cs_base = seg_base(ctxt, VCPU_SREG_CS);
893 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
896 case X86EMUL_MODE_REAL:
897 case X86EMUL_MODE_PROT16:
898 def_op_bytes = def_ad_bytes = 2;
900 case X86EMUL_MODE_PROT32:
901 def_op_bytes = def_ad_bytes = 4;
904 case X86EMUL_MODE_PROT64:
913 c->op_bytes = def_op_bytes;
914 c->ad_bytes = def_ad_bytes;
916 /* Legacy prefixes. */
918 switch (c->b = insn_fetch(u8, 1, c->eip)) {
919 case 0x66: /* operand-size override */
920 /* switch between 2/4 bytes */
921 c->op_bytes = def_op_bytes ^ 6;
923 case 0x67: /* address-size override */
924 if (mode == X86EMUL_MODE_PROT64)
925 /* switch between 4/8 bytes */
926 c->ad_bytes = def_ad_bytes ^ 12;
928 /* switch between 2/4 bytes */
929 c->ad_bytes = def_ad_bytes ^ 6;
931 case 0x26: /* ES override */
932 case 0x2e: /* CS override */
933 case 0x36: /* SS override */
934 case 0x3e: /* DS override */
935 set_seg_override(c, (c->b >> 3) & 3);
937 case 0x64: /* FS override */
938 case 0x65: /* GS override */
939 set_seg_override(c, c->b & 7);
941 case 0x40 ... 0x4f: /* REX */
942 if (mode != X86EMUL_MODE_PROT64)
944 c->rex_prefix = c->b;
946 case 0xf0: /* LOCK */
949 case 0xf2: /* REPNE/REPNZ */
950 c->rep_prefix = REPNE_PREFIX;
952 case 0xf3: /* REP/REPE/REPZ */
953 c->rep_prefix = REPE_PREFIX;
959 /* Any legacy prefix after a REX prefix nullifies its effect. */
968 if (c->rex_prefix & 8)
969 c->op_bytes = 8; /* REX.W */
971 /* Opcode byte(s). */
972 c->d = opcode_table[c->b];
974 /* Two-byte opcode? */
977 c->b = insn_fetch(u8, 1, c->eip);
978 c->d = twobyte_table[c->b];
982 if (mode == X86EMUL_MODE_PROT64 && (c->d & No64)) {
983 kvm_report_emulation_failure(ctxt->vcpu, "invalid x86/64 instruction");;
988 group = c->d & GroupMask;
989 c->modrm = insn_fetch(u8, 1, c->eip);
992 group = (group << 3) + ((c->modrm >> 3) & 7);
993 if ((c->d & GroupDual) && (c->modrm >> 6) == 3)
994 c->d = group2_table[group];
996 c->d = group_table[group];
1001 DPRINTF("Cannot emulate %02x\n", c->b);
1005 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
1008 /* ModRM and SIB bytes. */
1010 rc = decode_modrm(ctxt, ops);
1011 else if (c->d & MemAbs)
1012 rc = decode_abs(ctxt, ops);
1016 if (!c->has_seg_override)
1017 set_seg_override(c, VCPU_SREG_DS);
1019 if (!(!c->twobyte && c->b == 0x8d))
1020 c->modrm_ea += seg_override_base(ctxt, c);
1022 if (c->ad_bytes != 8)
1023 c->modrm_ea = (u32)c->modrm_ea;
1025 * Decode and fetch the source operand: register, memory
1028 switch (c->d & SrcMask) {
1032 decode_register_operand(&c->src, c, 0);
1041 c->src.bytes = (c->d & ByteOp) ? 1 :
1043 /* Don't fetch the address for invlpg: it could be unmapped. */
1044 if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
1048 * For instructions with a ModR/M byte, switch to register
1049 * access if Mod = 3.
1051 if ((c->d & ModRM) && c->modrm_mod == 3) {
1052 c->src.type = OP_REG;
1053 c->src.val = c->modrm_val;
1054 c->src.ptr = c->modrm_ptr;
1057 c->src.type = OP_MEM;
1061 c->src.type = OP_IMM;
1062 c->src.ptr = (unsigned long *)c->eip;
1063 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1064 if (c->src.bytes == 8)
1066 /* NB. Immediates are sign-extended as necessary. */
1067 switch (c->src.bytes) {
1069 c->src.val = insn_fetch(s8, 1, c->eip);
1072 c->src.val = insn_fetch(s16, 2, c->eip);
1075 c->src.val = insn_fetch(s32, 4, c->eip);
1078 if ((c->d & SrcMask) == SrcImmU) {
1079 switch (c->src.bytes) {
1084 c->src.val &= 0xffff;
1087 c->src.val &= 0xffffffff;
1094 c->src.type = OP_IMM;
1095 c->src.ptr = (unsigned long *)c->eip;
1097 if ((c->d & SrcMask) == SrcImmByte)
1098 c->src.val = insn_fetch(s8, 1, c->eip);
1100 c->src.val = insn_fetch(u8, 1, c->eip);
1109 * Decode and fetch the second source operand: register, memory
1112 switch (c->d & Src2Mask) {
1117 c->src2.val = c->regs[VCPU_REGS_RCX] & 0x8;
1120 c->src2.type = OP_IMM;
1121 c->src2.ptr = (unsigned long *)c->eip;
1123 c->src2.val = insn_fetch(u8, 1, c->eip);
1126 c->src2.type = OP_IMM;
1127 c->src2.ptr = (unsigned long *)c->eip;
1129 c->src2.val = insn_fetch(u16, 2, c->eip);
1137 /* Decode and fetch the destination operand: register or memory. */
1138 switch (c->d & DstMask) {
1140 /* Special instructions do their own operand decoding. */
1143 decode_register_operand(&c->dst, c,
1144 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
1147 if ((c->d & ModRM) && c->modrm_mod == 3) {
1148 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1149 c->dst.type = OP_REG;
1150 c->dst.val = c->dst.orig_val = c->modrm_val;
1151 c->dst.ptr = c->modrm_ptr;
1154 c->dst.type = OP_MEM;
1157 c->dst.type = OP_REG;
1158 c->dst.bytes = c->op_bytes;
1159 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1160 switch (c->op_bytes) {
1162 c->dst.val = *(u8 *)c->dst.ptr;
1165 c->dst.val = *(u16 *)c->dst.ptr;
1168 c->dst.val = *(u32 *)c->dst.ptr;
1171 c->dst.orig_val = c->dst.val;
1175 if (c->rip_relative)
1176 c->modrm_ea += c->eip;
1179 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1182 static inline void emulate_push(struct x86_emulate_ctxt *ctxt)
1184 struct decode_cache *c = &ctxt->decode;
1186 c->dst.type = OP_MEM;
1187 c->dst.bytes = c->op_bytes;
1188 c->dst.val = c->src.val;
1189 register_address_increment(c, &c->regs[VCPU_REGS_RSP], -c->op_bytes);
1190 c->dst.ptr = (void *) register_address(c, ss_base(ctxt),
1191 c->regs[VCPU_REGS_RSP]);
1194 static int emulate_pop(struct x86_emulate_ctxt *ctxt,
1195 struct x86_emulate_ops *ops,
1196 void *dest, int len)
1198 struct decode_cache *c = &ctxt->decode;
1201 rc = ops->read_emulated(register_address(c, ss_base(ctxt),
1202 c->regs[VCPU_REGS_RSP]),
1203 dest, len, ctxt->vcpu);
1204 if (rc != X86EMUL_CONTINUE)
1207 register_address_increment(c, &c->regs[VCPU_REGS_RSP], len);
1211 static void emulate_push_sreg(struct x86_emulate_ctxt *ctxt, int seg)
1213 struct decode_cache *c = &ctxt->decode;
1214 struct kvm_segment segment;
1216 kvm_x86_ops->get_segment(ctxt->vcpu, &segment, seg);
1218 c->src.val = segment.selector;
1222 static int emulate_pop_sreg(struct x86_emulate_ctxt *ctxt,
1223 struct x86_emulate_ops *ops, int seg)
1225 struct decode_cache *c = &ctxt->decode;
1226 unsigned long selector;
1229 rc = emulate_pop(ctxt, ops, &selector, c->op_bytes);
1233 rc = kvm_load_segment_descriptor(ctxt->vcpu, (u16)selector, 1, seg);
1237 static void emulate_pusha(struct x86_emulate_ctxt *ctxt)
1239 struct decode_cache *c = &ctxt->decode;
1240 unsigned long old_esp = c->regs[VCPU_REGS_RSP];
1241 int reg = VCPU_REGS_RAX;
1243 while (reg <= VCPU_REGS_RDI) {
1244 (reg == VCPU_REGS_RSP) ?
1245 (c->src.val = old_esp) : (c->src.val = c->regs[reg]);
1252 static int emulate_popa(struct x86_emulate_ctxt *ctxt,
1253 struct x86_emulate_ops *ops)
1255 struct decode_cache *c = &ctxt->decode;
1257 int reg = VCPU_REGS_RDI;
1259 while (reg >= VCPU_REGS_RAX) {
1260 if (reg == VCPU_REGS_RSP) {
1261 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1266 rc = emulate_pop(ctxt, ops, &c->regs[reg], c->op_bytes);
1274 static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
1275 struct x86_emulate_ops *ops)
1277 struct decode_cache *c = &ctxt->decode;
1280 rc = emulate_pop(ctxt, ops, &c->dst.val, c->dst.bytes);
1286 static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
1288 struct decode_cache *c = &ctxt->decode;
1289 switch (c->modrm_reg) {
1291 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
1294 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
1297 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
1300 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
1302 case 4: /* sal/shl */
1303 case 6: /* sal/shl */
1304 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
1307 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
1310 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
1315 static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
1316 struct x86_emulate_ops *ops)
1318 struct decode_cache *c = &ctxt->decode;
1321 switch (c->modrm_reg) {
1322 case 0 ... 1: /* test */
1323 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1326 c->dst.val = ~c->dst.val;
1329 emulate_1op("neg", c->dst, ctxt->eflags);
1332 DPRINTF("Cannot emulate %02x\n", c->b);
1333 rc = X86EMUL_UNHANDLEABLE;
1339 static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
1340 struct x86_emulate_ops *ops)
1342 struct decode_cache *c = &ctxt->decode;
1344 switch (c->modrm_reg) {
1346 emulate_1op("inc", c->dst, ctxt->eflags);
1349 emulate_1op("dec", c->dst, ctxt->eflags);
1351 case 2: /* call near abs */ {
1354 c->eip = c->src.val;
1355 c->src.val = old_eip;
1359 case 4: /* jmp abs */
1360 c->eip = c->src.val;
1369 static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
1370 struct x86_emulate_ops *ops,
1371 unsigned long memop)
1373 struct decode_cache *c = &ctxt->decode;
1377 rc = ops->read_emulated(memop, &old, 8, ctxt->vcpu);
1378 if (rc != X86EMUL_CONTINUE)
1381 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1382 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
1384 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1385 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1386 ctxt->eflags &= ~EFLG_ZF;
1389 new = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1390 (u32) c->regs[VCPU_REGS_RBX];
1392 rc = ops->cmpxchg_emulated(memop, &old, &new, 8, ctxt->vcpu);
1393 if (rc != X86EMUL_CONTINUE)
1395 ctxt->eflags |= EFLG_ZF;
1400 static int emulate_ret_far(struct x86_emulate_ctxt *ctxt,
1401 struct x86_emulate_ops *ops)
1403 struct decode_cache *c = &ctxt->decode;
1407 rc = emulate_pop(ctxt, ops, &c->eip, c->op_bytes);
1410 if (c->op_bytes == 4)
1411 c->eip = (u32)c->eip;
1412 rc = emulate_pop(ctxt, ops, &cs, c->op_bytes);
1415 rc = kvm_load_segment_descriptor(ctxt->vcpu, (u16)cs, 1, VCPU_SREG_CS);
1419 static inline int writeback(struct x86_emulate_ctxt *ctxt,
1420 struct x86_emulate_ops *ops)
1423 struct decode_cache *c = &ctxt->decode;
1425 switch (c->dst.type) {
1427 /* The 4-byte case *is* correct:
1428 * in 64-bit mode we zero-extend.
1430 switch (c->dst.bytes) {
1432 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1435 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1438 *c->dst.ptr = (u32)c->dst.val;
1439 break; /* 64b: zero-ext */
1441 *c->dst.ptr = c->dst.val;
1447 rc = ops->cmpxchg_emulated(
1448 (unsigned long)c->dst.ptr,
1454 rc = ops->write_emulated(
1455 (unsigned long)c->dst.ptr,
1459 if (rc != X86EMUL_CONTINUE)
1471 static void toggle_interruptibility(struct x86_emulate_ctxt *ctxt, u32 mask)
1473 u32 int_shadow = kvm_x86_ops->get_interrupt_shadow(ctxt->vcpu, mask);
1475 * an sti; sti; sequence only disable interrupts for the first
1476 * instruction. So, if the last instruction, be it emulated or
1477 * not, left the system with the INT_STI flag enabled, it
1478 * means that the last instruction is an sti. We should not
1479 * leave the flag on in this case. The same goes for mov ss
1481 if (!(int_shadow & mask))
1482 ctxt->interruptibility = mask;
1486 setup_syscalls_segments(struct x86_emulate_ctxt *ctxt,
1487 struct kvm_segment *cs, struct kvm_segment *ss)
1489 memset(cs, 0, sizeof(struct kvm_segment));
1490 kvm_x86_ops->get_segment(ctxt->vcpu, cs, VCPU_SREG_CS);
1491 memset(ss, 0, sizeof(struct kvm_segment));
1493 cs->l = 0; /* will be adjusted later */
1494 cs->base = 0; /* flat segment */
1495 cs->g = 1; /* 4kb granularity */
1496 cs->limit = 0xffffffff; /* 4GB limit */
1497 cs->type = 0x0b; /* Read, Execute, Accessed */
1499 cs->dpl = 0; /* will be adjusted later */
1504 ss->base = 0; /* flat segment */
1505 ss->limit = 0xffffffff; /* 4GB limit */
1506 ss->g = 1; /* 4kb granularity */
1508 ss->type = 0x03; /* Read/Write, Accessed */
1509 ss->db = 1; /* 32bit stack segment */
1515 emulate_syscall(struct x86_emulate_ctxt *ctxt)
1517 struct decode_cache *c = &ctxt->decode;
1518 struct kvm_segment cs, ss;
1521 /* syscall is not available in real mode */
1522 if (c->lock_prefix || ctxt->mode == X86EMUL_MODE_REAL
1523 || !is_protmode(ctxt->vcpu))
1526 setup_syscalls_segments(ctxt, &cs, &ss);
1528 kvm_x86_ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
1530 cs.selector = (u16)(msr_data & 0xfffc);
1531 ss.selector = (u16)(msr_data + 8);
1533 if (is_long_mode(ctxt->vcpu)) {
1537 kvm_x86_ops->set_segment(ctxt->vcpu, &cs, VCPU_SREG_CS);
1538 kvm_x86_ops->set_segment(ctxt->vcpu, &ss, VCPU_SREG_SS);
1540 c->regs[VCPU_REGS_RCX] = c->eip;
1541 if (is_long_mode(ctxt->vcpu)) {
1542 #ifdef CONFIG_X86_64
1543 c->regs[VCPU_REGS_R11] = ctxt->eflags & ~EFLG_RF;
1545 kvm_x86_ops->get_msr(ctxt->vcpu,
1546 ctxt->mode == X86EMUL_MODE_PROT64 ?
1547 MSR_LSTAR : MSR_CSTAR, &msr_data);
1550 kvm_x86_ops->get_msr(ctxt->vcpu, MSR_SYSCALL_MASK, &msr_data);
1551 ctxt->eflags &= ~(msr_data | EFLG_RF);
1555 kvm_x86_ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
1556 c->eip = (u32)msr_data;
1558 ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
1565 emulate_sysenter(struct x86_emulate_ctxt *ctxt)
1567 struct decode_cache *c = &ctxt->decode;
1568 struct kvm_segment cs, ss;
1571 /* inject #UD if LOCK prefix is used */
1575 /* inject #GP if in real mode or paging is disabled */
1576 if (ctxt->mode == X86EMUL_MODE_REAL || !is_protmode(ctxt->vcpu)) {
1577 kvm_inject_gp(ctxt->vcpu, 0);
1581 /* XXX sysenter/sysexit have not been tested in 64bit mode.
1582 * Therefore, we inject an #UD.
1584 if (ctxt->mode == X86EMUL_MODE_PROT64)
1587 setup_syscalls_segments(ctxt, &cs, &ss);
1589 kvm_x86_ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_CS, &msr_data);
1590 switch (ctxt->mode) {
1591 case X86EMUL_MODE_PROT32:
1592 if ((msr_data & 0xfffc) == 0x0) {
1593 kvm_inject_gp(ctxt->vcpu, 0);
1597 case X86EMUL_MODE_PROT64:
1598 if (msr_data == 0x0) {
1599 kvm_inject_gp(ctxt->vcpu, 0);
1605 ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
1606 cs.selector = (u16)msr_data;
1607 cs.selector &= ~SELECTOR_RPL_MASK;
1608 ss.selector = cs.selector + 8;
1609 ss.selector &= ~SELECTOR_RPL_MASK;
1610 if (ctxt->mode == X86EMUL_MODE_PROT64
1611 || is_long_mode(ctxt->vcpu)) {
1616 kvm_x86_ops->set_segment(ctxt->vcpu, &cs, VCPU_SREG_CS);
1617 kvm_x86_ops->set_segment(ctxt->vcpu, &ss, VCPU_SREG_SS);
1619 kvm_x86_ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_EIP, &msr_data);
1622 kvm_x86_ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_ESP, &msr_data);
1623 c->regs[VCPU_REGS_RSP] = msr_data;
1629 emulate_sysexit(struct x86_emulate_ctxt *ctxt)
1631 struct decode_cache *c = &ctxt->decode;
1632 struct kvm_segment cs, ss;
1636 /* inject #UD if LOCK prefix is used */
1640 /* inject #GP if in real mode or paging is disabled */
1641 if (ctxt->mode == X86EMUL_MODE_REAL || !is_protmode(ctxt->vcpu)) {
1642 kvm_inject_gp(ctxt->vcpu, 0);
1646 /* sysexit must be called from CPL 0 */
1647 if (kvm_x86_ops->get_cpl(ctxt->vcpu) != 0) {
1648 kvm_inject_gp(ctxt->vcpu, 0);
1652 setup_syscalls_segments(ctxt, &cs, &ss);
1654 if ((c->rex_prefix & 0x8) != 0x0)
1655 usermode = X86EMUL_MODE_PROT64;
1657 usermode = X86EMUL_MODE_PROT32;
1661 kvm_x86_ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_CS, &msr_data);
1663 case X86EMUL_MODE_PROT32:
1664 cs.selector = (u16)(msr_data + 16);
1665 if ((msr_data & 0xfffc) == 0x0) {
1666 kvm_inject_gp(ctxt->vcpu, 0);
1669 ss.selector = (u16)(msr_data + 24);
1671 case X86EMUL_MODE_PROT64:
1672 cs.selector = (u16)(msr_data + 32);
1673 if (msr_data == 0x0) {
1674 kvm_inject_gp(ctxt->vcpu, 0);
1677 ss.selector = cs.selector + 8;
1682 cs.selector |= SELECTOR_RPL_MASK;
1683 ss.selector |= SELECTOR_RPL_MASK;
1685 kvm_x86_ops->set_segment(ctxt->vcpu, &cs, VCPU_SREG_CS);
1686 kvm_x86_ops->set_segment(ctxt->vcpu, &ss, VCPU_SREG_SS);
1688 c->eip = ctxt->vcpu->arch.regs[VCPU_REGS_RDX];
1689 c->regs[VCPU_REGS_RSP] = ctxt->vcpu->arch.regs[VCPU_REGS_RCX];
1695 x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1697 unsigned long memop = 0;
1699 unsigned long saved_eip = 0;
1700 struct decode_cache *c = &ctxt->decode;
1705 ctxt->interruptibility = 0;
1707 /* Shadow copy of register state. Committed on successful emulation.
1708 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
1712 memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
1715 if (((c->d & ModRM) && (c->modrm_mod != 3)) || (c->d & MemAbs))
1716 memop = c->modrm_ea;
1718 if (c->rep_prefix && (c->d & String)) {
1719 /* All REP prefixes have the same first termination condition */
1720 if (c->regs[VCPU_REGS_RCX] == 0) {
1721 kvm_rip_write(ctxt->vcpu, c->eip);
1724 /* The second termination condition only applies for REPE
1725 * and REPNE. Test if the repeat string operation prefix is
1726 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
1727 * corresponding termination condition according to:
1728 * - if REPE/REPZ and ZF = 0 then done
1729 * - if REPNE/REPNZ and ZF = 1 then done
1731 if ((c->b == 0xa6) || (c->b == 0xa7) ||
1732 (c->b == 0xae) || (c->b == 0xaf)) {
1733 if ((c->rep_prefix == REPE_PREFIX) &&
1734 ((ctxt->eflags & EFLG_ZF) == 0)) {
1735 kvm_rip_write(ctxt->vcpu, c->eip);
1738 if ((c->rep_prefix == REPNE_PREFIX) &&
1739 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF)) {
1740 kvm_rip_write(ctxt->vcpu, c->eip);
1744 c->regs[VCPU_REGS_RCX]--;
1745 c->eip = kvm_rip_read(ctxt->vcpu);
1748 if (c->src.type == OP_MEM) {
1749 c->src.ptr = (unsigned long *)memop;
1751 rc = ops->read_emulated((unsigned long)c->src.ptr,
1755 if (rc != X86EMUL_CONTINUE)
1757 c->src.orig_val = c->src.val;
1760 if ((c->d & DstMask) == ImplicitOps)
1764 if (c->dst.type == OP_MEM) {
1765 c->dst.ptr = (unsigned long *)memop;
1766 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1769 unsigned long mask = ~(c->dst.bytes * 8 - 1);
1771 c->dst.ptr = (void *)c->dst.ptr +
1772 (c->src.val & mask) / 8;
1774 if (!(c->d & Mov)) {
1775 /* optimisation - avoid slow emulated read */
1776 rc = ops->read_emulated((unsigned long)c->dst.ptr,
1780 if (rc != X86EMUL_CONTINUE)
1784 c->dst.orig_val = c->dst.val;
1794 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
1796 case 0x06: /* push es */
1797 emulate_push_sreg(ctxt, VCPU_SREG_ES);
1799 case 0x07: /* pop es */
1800 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_ES);
1806 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
1808 case 0x0e: /* push cs */
1809 emulate_push_sreg(ctxt, VCPU_SREG_CS);
1813 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
1815 case 0x16: /* push ss */
1816 emulate_push_sreg(ctxt, VCPU_SREG_SS);
1818 case 0x17: /* pop ss */
1819 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_SS);
1825 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
1827 case 0x1e: /* push ds */
1828 emulate_push_sreg(ctxt, VCPU_SREG_DS);
1830 case 0x1f: /* pop ds */
1831 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_DS);
1837 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
1841 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
1845 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
1849 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1851 case 0x40 ... 0x47: /* inc r16/r32 */
1852 emulate_1op("inc", c->dst, ctxt->eflags);
1854 case 0x48 ... 0x4f: /* dec r16/r32 */
1855 emulate_1op("dec", c->dst, ctxt->eflags);
1857 case 0x50 ... 0x57: /* push reg */
1860 case 0x58 ... 0x5f: /* pop reg */
1862 rc = emulate_pop(ctxt, ops, &c->dst.val, c->op_bytes);
1866 case 0x60: /* pusha */
1867 emulate_pusha(ctxt);
1869 case 0x61: /* popa */
1870 rc = emulate_popa(ctxt, ops);
1874 case 0x63: /* movsxd */
1875 if (ctxt->mode != X86EMUL_MODE_PROT64)
1876 goto cannot_emulate;
1877 c->dst.val = (s32) c->src.val;
1879 case 0x68: /* push imm */
1880 case 0x6a: /* push imm8 */
1883 case 0x6c: /* insb */
1884 case 0x6d: /* insw/insd */
1885 if (kvm_emulate_pio_string(ctxt->vcpu,
1887 (c->d & ByteOp) ? 1 : c->op_bytes,
1889 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1,
1890 (ctxt->eflags & EFLG_DF),
1891 register_address(c, es_base(ctxt),
1892 c->regs[VCPU_REGS_RDI]),
1894 c->regs[VCPU_REGS_RDX]) == 0) {
1899 case 0x6e: /* outsb */
1900 case 0x6f: /* outsw/outsd */
1901 if (kvm_emulate_pio_string(ctxt->vcpu,
1903 (c->d & ByteOp) ? 1 : c->op_bytes,
1905 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1,
1906 (ctxt->eflags & EFLG_DF),
1908 seg_override_base(ctxt, c),
1909 c->regs[VCPU_REGS_RSI]),
1911 c->regs[VCPU_REGS_RDX]) == 0) {
1916 case 0x70 ... 0x7f: /* jcc (short) */
1917 if (test_cc(c->b, ctxt->eflags))
1918 jmp_rel(c, c->src.val);
1920 case 0x80 ... 0x83: /* Grp1 */
1921 switch (c->modrm_reg) {
1941 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1943 case 0x86 ... 0x87: /* xchg */
1945 /* Write back the register source. */
1946 switch (c->dst.bytes) {
1948 *(u8 *) c->src.ptr = (u8) c->dst.val;
1951 *(u16 *) c->src.ptr = (u16) c->dst.val;
1954 *c->src.ptr = (u32) c->dst.val;
1955 break; /* 64b reg: zero-extend */
1957 *c->src.ptr = c->dst.val;
1961 * Write back the memory destination with implicit LOCK
1964 c->dst.val = c->src.val;
1967 case 0x88 ... 0x8b: /* mov */
1969 case 0x8c: { /* mov r/m, sreg */
1970 struct kvm_segment segreg;
1972 if (c->modrm_reg <= 5)
1973 kvm_get_segment(ctxt->vcpu, &segreg, c->modrm_reg);
1975 printk(KERN_INFO "0x8c: Invalid segreg in modrm byte 0x%02x\n",
1977 goto cannot_emulate;
1979 c->dst.val = segreg.selector;
1982 case 0x8d: /* lea r16/r32, m */
1983 c->dst.val = c->modrm_ea;
1985 case 0x8e: { /* mov seg, r/m16 */
1991 if (c->modrm_reg == VCPU_SREG_SS)
1992 toggle_interruptibility(ctxt, X86_SHADOW_INT_MOV_SS);
1994 if (c->modrm_reg <= 5) {
1995 type_bits = (c->modrm_reg == 1) ? 9 : 1;
1996 err = kvm_load_segment_descriptor(ctxt->vcpu, sel,
1997 type_bits, c->modrm_reg);
1999 printk(KERN_INFO "Invalid segreg in modrm byte 0x%02x\n",
2001 goto cannot_emulate;
2005 goto cannot_emulate;
2007 c->dst.type = OP_NONE; /* Disable writeback. */
2010 case 0x8f: /* pop (sole member of Grp1a) */
2011 rc = emulate_grp1a(ctxt, ops);
2015 case 0x90: /* nop / xchg r8,rax */
2016 if (!(c->rex_prefix & 1)) { /* nop */
2017 c->dst.type = OP_NONE;
2020 case 0x91 ... 0x97: /* xchg reg,rax */
2021 c->src.type = c->dst.type = OP_REG;
2022 c->src.bytes = c->dst.bytes = c->op_bytes;
2023 c->src.ptr = (unsigned long *) &c->regs[VCPU_REGS_RAX];
2024 c->src.val = *(c->src.ptr);
2026 case 0x9c: /* pushf */
2027 c->src.val = (unsigned long) ctxt->eflags;
2030 case 0x9d: /* popf */
2031 c->dst.type = OP_REG;
2032 c->dst.ptr = (unsigned long *) &ctxt->eflags;
2033 c->dst.bytes = c->op_bytes;
2034 goto pop_instruction;
2035 case 0xa0 ... 0xa1: /* mov */
2036 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
2037 c->dst.val = c->src.val;
2039 case 0xa2 ... 0xa3: /* mov */
2040 c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
2042 case 0xa4 ... 0xa5: /* movs */
2043 c->dst.type = OP_MEM;
2044 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
2045 c->dst.ptr = (unsigned long *)register_address(c,
2047 c->regs[VCPU_REGS_RDI]);
2048 rc = ops->read_emulated(register_address(c,
2049 seg_override_base(ctxt, c),
2050 c->regs[VCPU_REGS_RSI]),
2052 c->dst.bytes, ctxt->vcpu);
2053 if (rc != X86EMUL_CONTINUE)
2055 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
2056 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
2058 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
2059 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
2062 case 0xa6 ... 0xa7: /* cmps */
2063 c->src.type = OP_NONE; /* Disable writeback. */
2064 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
2065 c->src.ptr = (unsigned long *)register_address(c,
2066 seg_override_base(ctxt, c),
2067 c->regs[VCPU_REGS_RSI]);
2068 rc = ops->read_emulated((unsigned long)c->src.ptr,
2072 if (rc != X86EMUL_CONTINUE)
2075 c->dst.type = OP_NONE; /* Disable writeback. */
2076 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
2077 c->dst.ptr = (unsigned long *)register_address(c,
2079 c->regs[VCPU_REGS_RDI]);
2080 rc = ops->read_emulated((unsigned long)c->dst.ptr,
2084 if (rc != X86EMUL_CONTINUE)
2087 DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c->src.ptr, c->dst.ptr);
2089 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
2091 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
2092 (ctxt->eflags & EFLG_DF) ? -c->src.bytes
2094 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
2095 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
2099 case 0xaa ... 0xab: /* stos */
2100 c->dst.type = OP_MEM;
2101 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
2102 c->dst.ptr = (unsigned long *)register_address(c,
2104 c->regs[VCPU_REGS_RDI]);
2105 c->dst.val = c->regs[VCPU_REGS_RAX];
2106 register_address_increment(c, &c->regs[VCPU_REGS_RDI],
2107 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
2110 case 0xac ... 0xad: /* lods */
2111 c->dst.type = OP_REG;
2112 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
2113 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
2114 rc = ops->read_emulated(register_address(c,
2115 seg_override_base(ctxt, c),
2116 c->regs[VCPU_REGS_RSI]),
2120 if (rc != X86EMUL_CONTINUE)
2122 register_address_increment(c, &c->regs[VCPU_REGS_RSI],
2123 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
2126 case 0xae ... 0xaf: /* scas */
2127 DPRINTF("Urk! I don't handle SCAS.\n");
2128 goto cannot_emulate;
2129 case 0xb0 ... 0xbf: /* mov r, imm */
2134 case 0xc3: /* ret */
2135 c->dst.type = OP_REG;
2136 c->dst.ptr = &c->eip;
2137 c->dst.bytes = c->op_bytes;
2138 goto pop_instruction;
2139 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
2141 c->dst.val = c->src.val;
2143 case 0xcb: /* ret far */
2144 rc = emulate_ret_far(ctxt, ops);
2148 case 0xd0 ... 0xd1: /* Grp2 */
2152 case 0xd2 ... 0xd3: /* Grp2 */
2153 c->src.val = c->regs[VCPU_REGS_RCX];
2156 case 0xe4: /* inb */
2161 case 0xe6: /* outb */
2162 case 0xe7: /* out */
2166 case 0xe8: /* call (near) */ {
2167 long int rel = c->src.val;
2168 c->src.val = (unsigned long) c->eip;
2173 case 0xe9: /* jmp rel */
2175 case 0xea: /* jmp far */
2176 if (kvm_load_segment_descriptor(ctxt->vcpu, c->src2.val, 9,
2177 VCPU_SREG_CS) < 0) {
2178 DPRINTF("jmp far: Failed to load CS descriptor\n");
2179 goto cannot_emulate;
2182 c->eip = c->src.val;
2185 jmp: /* jmp rel short */
2186 jmp_rel(c, c->src.val);
2187 c->dst.type = OP_NONE; /* Disable writeback. */
2189 case 0xec: /* in al,dx */
2190 case 0xed: /* in (e/r)ax,dx */
2191 port = c->regs[VCPU_REGS_RDX];
2194 case 0xee: /* out al,dx */
2195 case 0xef: /* out (e/r)ax,dx */
2196 port = c->regs[VCPU_REGS_RDX];
2198 do_io: if (kvm_emulate_pio(ctxt->vcpu, io_dir_in,
2199 (c->d & ByteOp) ? 1 : c->op_bytes,
2202 goto cannot_emulate;
2205 case 0xf4: /* hlt */
2206 ctxt->vcpu->arch.halt_request = 1;
2208 case 0xf5: /* cmc */
2209 /* complement carry flag from eflags reg */
2210 ctxt->eflags ^= EFLG_CF;
2211 c->dst.type = OP_NONE; /* Disable writeback. */
2213 case 0xf6 ... 0xf7: /* Grp3 */
2214 rc = emulate_grp3(ctxt, ops);
2218 case 0xf8: /* clc */
2219 ctxt->eflags &= ~EFLG_CF;
2220 c->dst.type = OP_NONE; /* Disable writeback. */
2222 case 0xfa: /* cli */
2223 ctxt->eflags &= ~X86_EFLAGS_IF;
2224 c->dst.type = OP_NONE; /* Disable writeback. */
2226 case 0xfb: /* sti */
2227 toggle_interruptibility(ctxt, X86_SHADOW_INT_STI);
2228 ctxt->eflags |= X86_EFLAGS_IF;
2229 c->dst.type = OP_NONE; /* Disable writeback. */
2231 case 0xfc: /* cld */
2232 ctxt->eflags &= ~EFLG_DF;
2233 c->dst.type = OP_NONE; /* Disable writeback. */
2235 case 0xfd: /* std */
2236 ctxt->eflags |= EFLG_DF;
2237 c->dst.type = OP_NONE; /* Disable writeback. */
2239 case 0xfe ... 0xff: /* Grp4/Grp5 */
2240 rc = emulate_grp45(ctxt, ops);
2247 rc = writeback(ctxt, ops);
2251 /* Commit shadow register state. */
2252 memcpy(ctxt->vcpu->arch.regs, c->regs, sizeof c->regs);
2253 kvm_rip_write(ctxt->vcpu, c->eip);
2256 if (rc == X86EMUL_UNHANDLEABLE) {
2264 case 0x01: /* lgdt, lidt, lmsw */
2265 switch (c->modrm_reg) {
2267 unsigned long address;
2269 case 0: /* vmcall */
2270 if (c->modrm_mod != 3 || c->modrm_rm != 1)
2271 goto cannot_emulate;
2273 rc = kvm_fix_hypercall(ctxt->vcpu);
2277 /* Let the processor re-execute the fixed hypercall */
2278 c->eip = kvm_rip_read(ctxt->vcpu);
2279 /* Disable writeback. */
2280 c->dst.type = OP_NONE;
2283 rc = read_descriptor(ctxt, ops, c->src.ptr,
2284 &size, &address, c->op_bytes);
2287 realmode_lgdt(ctxt->vcpu, size, address);
2288 /* Disable writeback. */
2289 c->dst.type = OP_NONE;
2291 case 3: /* lidt/vmmcall */
2292 if (c->modrm_mod == 3) {
2293 switch (c->modrm_rm) {
2295 rc = kvm_fix_hypercall(ctxt->vcpu);
2300 goto cannot_emulate;
2303 rc = read_descriptor(ctxt, ops, c->src.ptr,
2308 realmode_lidt(ctxt->vcpu, size, address);
2310 /* Disable writeback. */
2311 c->dst.type = OP_NONE;
2315 c->dst.val = realmode_get_cr(ctxt->vcpu, 0);
2318 realmode_lmsw(ctxt->vcpu, (u16)c->src.val,
2320 c->dst.type = OP_NONE;
2323 emulate_invlpg(ctxt->vcpu, memop);
2324 /* Disable writeback. */
2325 c->dst.type = OP_NONE;
2328 goto cannot_emulate;
2331 case 0x05: /* syscall */
2332 if (emulate_syscall(ctxt) == -1)
2333 goto cannot_emulate;
2338 emulate_clts(ctxt->vcpu);
2339 c->dst.type = OP_NONE;
2341 case 0x08: /* invd */
2342 case 0x09: /* wbinvd */
2343 case 0x0d: /* GrpP (prefetch) */
2344 case 0x18: /* Grp16 (prefetch/nop) */
2345 c->dst.type = OP_NONE;
2347 case 0x20: /* mov cr, reg */
2348 if (c->modrm_mod != 3)
2349 goto cannot_emulate;
2350 c->regs[c->modrm_rm] =
2351 realmode_get_cr(ctxt->vcpu, c->modrm_reg);
2352 c->dst.type = OP_NONE; /* no writeback */
2354 case 0x21: /* mov from dr to reg */
2355 if (c->modrm_mod != 3)
2356 goto cannot_emulate;
2357 rc = emulator_get_dr(ctxt, c->modrm_reg, &c->regs[c->modrm_rm]);
2359 goto cannot_emulate;
2360 c->dst.type = OP_NONE; /* no writeback */
2362 case 0x22: /* mov reg, cr */
2363 if (c->modrm_mod != 3)
2364 goto cannot_emulate;
2365 realmode_set_cr(ctxt->vcpu,
2366 c->modrm_reg, c->modrm_val, &ctxt->eflags);
2367 c->dst.type = OP_NONE;
2369 case 0x23: /* mov from reg to dr */
2370 if (c->modrm_mod != 3)
2371 goto cannot_emulate;
2372 rc = emulator_set_dr(ctxt, c->modrm_reg,
2373 c->regs[c->modrm_rm]);
2375 goto cannot_emulate;
2376 c->dst.type = OP_NONE; /* no writeback */
2380 msr_data = (u32)c->regs[VCPU_REGS_RAX]
2381 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
2382 rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
2384 kvm_inject_gp(ctxt->vcpu, 0);
2385 c->eip = kvm_rip_read(ctxt->vcpu);
2387 rc = X86EMUL_CONTINUE;
2388 c->dst.type = OP_NONE;
2392 rc = kvm_get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data);
2394 kvm_inject_gp(ctxt->vcpu, 0);
2395 c->eip = kvm_rip_read(ctxt->vcpu);
2397 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
2398 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
2400 rc = X86EMUL_CONTINUE;
2401 c->dst.type = OP_NONE;
2403 case 0x34: /* sysenter */
2404 if (emulate_sysenter(ctxt) == -1)
2405 goto cannot_emulate;
2409 case 0x35: /* sysexit */
2410 if (emulate_sysexit(ctxt) == -1)
2411 goto cannot_emulate;
2415 case 0x40 ... 0x4f: /* cmov */
2416 c->dst.val = c->dst.orig_val = c->src.val;
2417 if (!test_cc(c->b, ctxt->eflags))
2418 c->dst.type = OP_NONE; /* no writeback */
2420 case 0x80 ... 0x8f: /* jnz rel, etc*/
2421 if (test_cc(c->b, ctxt->eflags))
2422 jmp_rel(c, c->src.val);
2423 c->dst.type = OP_NONE;
2425 case 0xa0: /* push fs */
2426 emulate_push_sreg(ctxt, VCPU_SREG_FS);
2428 case 0xa1: /* pop fs */
2429 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_FS);
2435 c->dst.type = OP_NONE;
2436 /* only subword offset */
2437 c->src.val &= (c->dst.bytes << 3) - 1;
2438 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
2440 case 0xa4: /* shld imm8, r, r/m */
2441 case 0xa5: /* shld cl, r, r/m */
2442 emulate_2op_cl("shld", c->src2, c->src, c->dst, ctxt->eflags);
2444 case 0xa8: /* push gs */
2445 emulate_push_sreg(ctxt, VCPU_SREG_GS);
2447 case 0xa9: /* pop gs */
2448 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_GS);
2454 /* only subword offset */
2455 c->src.val &= (c->dst.bytes << 3) - 1;
2456 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
2458 case 0xac: /* shrd imm8, r, r/m */
2459 case 0xad: /* shrd cl, r, r/m */
2460 emulate_2op_cl("shrd", c->src2, c->src, c->dst, ctxt->eflags);
2462 case 0xae: /* clflush */
2464 case 0xb0 ... 0xb1: /* cmpxchg */
2466 * Save real source value, then compare EAX against
2469 c->src.orig_val = c->src.val;
2470 c->src.val = c->regs[VCPU_REGS_RAX];
2471 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
2472 if (ctxt->eflags & EFLG_ZF) {
2473 /* Success: write back to memory. */
2474 c->dst.val = c->src.orig_val;
2476 /* Failure: write the value we saw to EAX. */
2477 c->dst.type = OP_REG;
2478 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
2483 /* only subword offset */
2484 c->src.val &= (c->dst.bytes << 3) - 1;
2485 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
2487 case 0xb6 ... 0xb7: /* movzx */
2488 c->dst.bytes = c->op_bytes;
2489 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
2492 case 0xba: /* Grp8 */
2493 switch (c->modrm_reg & 3) {
2506 /* only subword offset */
2507 c->src.val &= (c->dst.bytes << 3) - 1;
2508 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
2510 case 0xbe ... 0xbf: /* movsx */
2511 c->dst.bytes = c->op_bytes;
2512 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
2515 case 0xc3: /* movnti */
2516 c->dst.bytes = c->op_bytes;
2517 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
2520 case 0xc7: /* Grp9 (cmpxchg8b) */
2521 rc = emulate_grp9(ctxt, ops, memop);
2524 c->dst.type = OP_NONE;
2530 DPRINTF("Cannot emulate %02x\n", c->b);