1 /******************************************************************************
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
6 * Copyright (c) 2005 Keir Fraser
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
11 * Copyright (C) 2006 Qumranet
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf(_f , ## _a)
28 #include <linux/kvm_host.h>
29 #include "kvm_cache_regs.h"
30 #define DPRINTF(x...) do {} while (0)
32 #include <linux/module.h>
33 #include <asm/kvm_emulate.h>
39 * Opcode effective-address decode tables.
40 * Note that we only emulate instructions that have at least one memory
41 * operand (excluding implicit stack references). We assume that stack
42 * references and instruction fetches will never occur in special memory
43 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
47 /* Operand sizes: 8-bit operands or specified/overridden size. */
48 #define ByteOp (1<<0) /* 8-bit operands. */
49 /* Destination operand type. */
50 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
51 #define DstReg (2<<1) /* Register operand. */
52 #define DstMem (3<<1) /* Memory operand. */
53 #define DstAcc (4<<1) /* Destination Accumulator */
54 #define DstDI (5<<1) /* Destination is in ES:(E)DI */
55 #define DstMem64 (6<<1) /* 64bit memory operand */
56 #define DstMask (7<<1)
57 /* Source operand type. */
58 #define SrcNone (0<<4) /* No source operand. */
59 #define SrcImplicit (0<<4) /* Source operand is implicit in the opcode. */
60 #define SrcReg (1<<4) /* Register operand. */
61 #define SrcMem (2<<4) /* Memory operand. */
62 #define SrcMem16 (3<<4) /* Memory operand (16-bit). */
63 #define SrcMem32 (4<<4) /* Memory operand (32-bit). */
64 #define SrcImm (5<<4) /* Immediate operand. */
65 #define SrcImmByte (6<<4) /* 8-bit sign-extended immediate operand. */
66 #define SrcOne (7<<4) /* Implied '1' */
67 #define SrcImmUByte (8<<4) /* 8-bit unsigned immediate operand. */
68 #define SrcImmU (9<<4) /* Immediate operand, unsigned */
69 #define SrcSI (0xa<<4) /* Source is in the DS:RSI */
70 #define SrcImmFAddr (0xb<<4) /* Source is immediate far address */
71 #define SrcMemFAddr (0xc<<4) /* Source is far address in memory */
72 #define SrcMask (0xf<<4)
73 /* Generic ModRM decode. */
75 /* Destination is only written; never read. */
78 #define MemAbs (1<<11) /* Memory operand is absolute displacement */
79 #define String (1<<12) /* String instruction (rep capable) */
80 #define Stack (1<<13) /* Stack instruction (push/pop) */
81 #define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
82 #define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
83 #define GroupMask 0xff /* Group number stored in bits 0:7 */
85 #define Lock (1<<26) /* lock prefix is allowed for the instruction */
86 #define Priv (1<<27) /* instruction generates #GP if current CPL != 0 */
88 /* Source 2 operand type */
89 #define Src2None (0<<29)
90 #define Src2CL (1<<29)
91 #define Src2ImmByte (2<<29)
92 #define Src2One (3<<29)
93 #define Src2Mask (7<<29)
96 Group1_80
, Group1_81
, Group1_82
, Group1_83
,
97 Group1A
, Group3_Byte
, Group3
, Group4
, Group5
, Group7
,
101 static u32 opcode_table
[256] = {
103 ByteOp
| DstMem
| SrcReg
| ModRM
| Lock
, DstMem
| SrcReg
| ModRM
| Lock
,
104 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
105 ByteOp
| DstAcc
| SrcImm
, DstAcc
| SrcImm
,
106 ImplicitOps
| Stack
| No64
, ImplicitOps
| Stack
| No64
,
108 ByteOp
| DstMem
| SrcReg
| ModRM
| Lock
, DstMem
| SrcReg
| ModRM
| Lock
,
109 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
110 ByteOp
| DstAcc
| SrcImm
, DstAcc
| SrcImm
,
111 ImplicitOps
| Stack
| No64
, 0,
113 ByteOp
| DstMem
| SrcReg
| ModRM
| Lock
, DstMem
| SrcReg
| ModRM
| Lock
,
114 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
115 ByteOp
| DstAcc
| SrcImm
, DstAcc
| SrcImm
,
116 ImplicitOps
| Stack
| No64
, ImplicitOps
| Stack
| No64
,
118 ByteOp
| DstMem
| SrcReg
| ModRM
| Lock
, DstMem
| SrcReg
| ModRM
| Lock
,
119 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
120 ByteOp
| DstAcc
| SrcImm
, DstAcc
| SrcImm
,
121 ImplicitOps
| Stack
| No64
, ImplicitOps
| Stack
| No64
,
123 ByteOp
| DstMem
| SrcReg
| ModRM
| Lock
, DstMem
| SrcReg
| ModRM
| Lock
,
124 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
125 DstAcc
| SrcImmByte
, DstAcc
| SrcImm
, 0, 0,
127 ByteOp
| DstMem
| SrcReg
| ModRM
| Lock
, DstMem
| SrcReg
| ModRM
| Lock
,
128 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
131 ByteOp
| DstMem
| SrcReg
| ModRM
| Lock
, DstMem
| SrcReg
| ModRM
| Lock
,
132 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
135 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
136 ByteOp
| DstReg
| SrcMem
| ModRM
, DstReg
| SrcMem
| ModRM
,
137 ByteOp
| DstAcc
| SrcImm
, DstAcc
| SrcImm
,
140 DstReg
, DstReg
, DstReg
, DstReg
, DstReg
, DstReg
, DstReg
, DstReg
,
142 DstReg
, DstReg
, DstReg
, DstReg
, DstReg
, DstReg
, DstReg
, DstReg
,
144 SrcReg
| Stack
, SrcReg
| Stack
, SrcReg
| Stack
, SrcReg
| Stack
,
145 SrcReg
| Stack
, SrcReg
| Stack
, SrcReg
| Stack
, SrcReg
| Stack
,
147 DstReg
| Stack
, DstReg
| Stack
, DstReg
| Stack
, DstReg
| Stack
,
148 DstReg
| Stack
, DstReg
| Stack
, DstReg
| Stack
, DstReg
| Stack
,
150 ImplicitOps
| Stack
| No64
, ImplicitOps
| Stack
| No64
,
151 0, DstReg
| SrcMem32
| ModRM
| Mov
/* movsxd (x86/64) */ ,
154 SrcImm
| Mov
| Stack
, 0, SrcImmByte
| Mov
| Stack
, 0,
155 DstDI
| ByteOp
| Mov
| String
, DstDI
| Mov
| String
, /* insb, insw/insd */
156 SrcSI
| ByteOp
| ImplicitOps
| String
, SrcSI
| ImplicitOps
| String
, /* outsb, outsw/outsd */
158 SrcImmByte
, SrcImmByte
, SrcImmByte
, SrcImmByte
,
159 SrcImmByte
, SrcImmByte
, SrcImmByte
, SrcImmByte
,
161 SrcImmByte
, SrcImmByte
, SrcImmByte
, SrcImmByte
,
162 SrcImmByte
, SrcImmByte
, SrcImmByte
, SrcImmByte
,
164 Group
| Group1_80
, Group
| Group1_81
,
165 Group
| Group1_82
, Group
| Group1_83
,
166 ByteOp
| DstMem
| SrcReg
| ModRM
, DstMem
| SrcReg
| ModRM
,
167 ByteOp
| DstMem
| SrcReg
| ModRM
| Lock
, DstMem
| SrcReg
| ModRM
| Lock
,
169 ByteOp
| DstMem
| SrcReg
| ModRM
| Mov
, DstMem
| SrcReg
| ModRM
| Mov
,
170 ByteOp
| DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
171 DstMem
| SrcReg
| ModRM
| Mov
, ModRM
| DstReg
,
172 ImplicitOps
| SrcMem
| ModRM
, Group
| Group1A
,
174 DstReg
, DstReg
, DstReg
, DstReg
, DstReg
, DstReg
, DstReg
, DstReg
,
176 0, 0, SrcImmFAddr
| No64
, 0,
177 ImplicitOps
| Stack
, ImplicitOps
| Stack
, 0, 0,
179 ByteOp
| DstReg
| SrcMem
| Mov
| MemAbs
, DstReg
| SrcMem
| Mov
| MemAbs
,
180 ByteOp
| DstMem
| SrcReg
| Mov
| MemAbs
, DstMem
| SrcReg
| Mov
| MemAbs
,
181 ByteOp
| SrcSI
| DstDI
| Mov
| String
, SrcSI
| DstDI
| Mov
| String
,
182 ByteOp
| SrcSI
| DstDI
| String
, SrcSI
| DstDI
| String
,
184 0, 0, ByteOp
| DstDI
| Mov
| String
, DstDI
| Mov
| String
,
185 ByteOp
| SrcSI
| DstAcc
| Mov
| String
, SrcSI
| DstAcc
| Mov
| String
,
186 ByteOp
| DstDI
| String
, DstDI
| String
,
188 ByteOp
| DstReg
| SrcImm
| Mov
, ByteOp
| DstReg
| SrcImm
| Mov
,
189 ByteOp
| DstReg
| SrcImm
| Mov
, ByteOp
| DstReg
| SrcImm
| Mov
,
190 ByteOp
| DstReg
| SrcImm
| Mov
, ByteOp
| DstReg
| SrcImm
| Mov
,
191 ByteOp
| DstReg
| SrcImm
| Mov
, ByteOp
| DstReg
| SrcImm
| Mov
,
193 DstReg
| SrcImm
| Mov
, DstReg
| SrcImm
| Mov
,
194 DstReg
| SrcImm
| Mov
, DstReg
| SrcImm
| Mov
,
195 DstReg
| SrcImm
| Mov
, DstReg
| SrcImm
| Mov
,
196 DstReg
| SrcImm
| Mov
, DstReg
| SrcImm
| Mov
,
198 ByteOp
| DstMem
| SrcImm
| ModRM
, DstMem
| SrcImmByte
| ModRM
,
199 0, ImplicitOps
| Stack
, 0, 0,
200 ByteOp
| DstMem
| SrcImm
| ModRM
| Mov
, DstMem
| SrcImm
| ModRM
| Mov
,
202 0, 0, 0, ImplicitOps
| Stack
,
203 ImplicitOps
, SrcImmByte
, ImplicitOps
| No64
, ImplicitOps
,
205 ByteOp
| DstMem
| SrcImplicit
| ModRM
, DstMem
| SrcImplicit
| ModRM
,
206 ByteOp
| DstMem
| SrcImplicit
| ModRM
, DstMem
| SrcImplicit
| ModRM
,
209 0, 0, 0, 0, 0, 0, 0, 0,
212 ByteOp
| SrcImmUByte
| DstAcc
, SrcImmUByte
| DstAcc
,
213 ByteOp
| SrcImmUByte
| DstAcc
, SrcImmUByte
| DstAcc
,
215 SrcImm
| Stack
, SrcImm
| ImplicitOps
,
216 SrcImmFAddr
| No64
, SrcImmByte
| ImplicitOps
,
217 SrcNone
| ByteOp
| DstAcc
, SrcNone
| DstAcc
,
218 SrcNone
| ByteOp
| DstAcc
, SrcNone
| DstAcc
,
221 ImplicitOps
| Priv
, ImplicitOps
, Group
| Group3_Byte
, Group
| Group3
,
223 ImplicitOps
, 0, ImplicitOps
, ImplicitOps
,
224 ImplicitOps
, ImplicitOps
, Group
| Group4
, Group
| Group5
,
227 static u32 twobyte_table
[256] = {
229 0, Group
| GroupDual
| Group7
, 0, 0,
230 0, ImplicitOps
, ImplicitOps
| Priv
, 0,
231 ImplicitOps
| Priv
, ImplicitOps
| Priv
, 0, 0,
232 0, ImplicitOps
| ModRM
, 0, 0,
234 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps
| ModRM
, 0, 0, 0, 0, 0, 0, 0,
236 ModRM
| ImplicitOps
| Priv
, ModRM
| Priv
,
237 ModRM
| ImplicitOps
| Priv
, ModRM
| Priv
,
239 0, 0, 0, 0, 0, 0, 0, 0,
241 ImplicitOps
| Priv
, 0, ImplicitOps
| Priv
, 0,
242 ImplicitOps
, ImplicitOps
| Priv
, 0, 0,
243 0, 0, 0, 0, 0, 0, 0, 0,
245 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
246 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
247 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
248 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
250 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
251 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
252 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
253 DstReg
| SrcMem
| ModRM
| Mov
, DstReg
| SrcMem
| ModRM
| Mov
,
255 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
257 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
259 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
261 SrcImm
, SrcImm
, SrcImm
, SrcImm
, SrcImm
, SrcImm
, SrcImm
, SrcImm
,
262 SrcImm
, SrcImm
, SrcImm
, SrcImm
, SrcImm
, SrcImm
, SrcImm
, SrcImm
,
264 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
266 ImplicitOps
| Stack
, ImplicitOps
| Stack
,
267 0, DstMem
| SrcReg
| ModRM
| BitOp
,
268 DstMem
| SrcReg
| Src2ImmByte
| ModRM
,
269 DstMem
| SrcReg
| Src2CL
| ModRM
, 0, 0,
271 ImplicitOps
| Stack
, ImplicitOps
| Stack
,
272 0, DstMem
| SrcReg
| ModRM
| BitOp
| Lock
,
273 DstMem
| SrcReg
| Src2ImmByte
| ModRM
,
274 DstMem
| SrcReg
| Src2CL
| ModRM
,
277 ByteOp
| DstMem
| SrcReg
| ModRM
| Lock
, DstMem
| SrcReg
| ModRM
| Lock
,
278 0, DstMem
| SrcReg
| ModRM
| BitOp
| Lock
,
279 0, 0, ByteOp
| DstReg
| SrcMem
| ModRM
| Mov
,
280 DstReg
| SrcMem16
| ModRM
| Mov
,
283 Group
| Group8
, DstMem
| SrcReg
| ModRM
| BitOp
| Lock
,
284 0, 0, ByteOp
| DstReg
| SrcMem
| ModRM
| Mov
,
285 DstReg
| SrcMem16
| ModRM
| Mov
,
287 0, 0, 0, DstMem
| SrcReg
| ModRM
| Mov
,
288 0, 0, 0, Group
| GroupDual
| Group9
,
289 0, 0, 0, 0, 0, 0, 0, 0,
291 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
293 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
295 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
298 static u32 group_table
[] = {
300 ByteOp
| DstMem
| SrcImm
| ModRM
| Lock
,
301 ByteOp
| DstMem
| SrcImm
| ModRM
| Lock
,
302 ByteOp
| DstMem
| SrcImm
| ModRM
| Lock
,
303 ByteOp
| DstMem
| SrcImm
| ModRM
| Lock
,
304 ByteOp
| DstMem
| SrcImm
| ModRM
| Lock
,
305 ByteOp
| DstMem
| SrcImm
| ModRM
| Lock
,
306 ByteOp
| DstMem
| SrcImm
| ModRM
| Lock
,
307 ByteOp
| DstMem
| SrcImm
| ModRM
,
309 DstMem
| SrcImm
| ModRM
| Lock
,
310 DstMem
| SrcImm
| ModRM
| Lock
,
311 DstMem
| SrcImm
| ModRM
| Lock
,
312 DstMem
| SrcImm
| ModRM
| Lock
,
313 DstMem
| SrcImm
| ModRM
| Lock
,
314 DstMem
| SrcImm
| ModRM
| Lock
,
315 DstMem
| SrcImm
| ModRM
| Lock
,
316 DstMem
| SrcImm
| ModRM
,
318 ByteOp
| DstMem
| SrcImm
| ModRM
| No64
| Lock
,
319 ByteOp
| DstMem
| SrcImm
| ModRM
| No64
| Lock
,
320 ByteOp
| DstMem
| SrcImm
| ModRM
| No64
| Lock
,
321 ByteOp
| DstMem
| SrcImm
| ModRM
| No64
| Lock
,
322 ByteOp
| DstMem
| SrcImm
| ModRM
| No64
| Lock
,
323 ByteOp
| DstMem
| SrcImm
| ModRM
| No64
| Lock
,
324 ByteOp
| DstMem
| SrcImm
| ModRM
| No64
| Lock
,
325 ByteOp
| DstMem
| SrcImm
| ModRM
| No64
,
327 DstMem
| SrcImmByte
| ModRM
| Lock
,
328 DstMem
| SrcImmByte
| ModRM
| Lock
,
329 DstMem
| SrcImmByte
| ModRM
| Lock
,
330 DstMem
| SrcImmByte
| ModRM
| Lock
,
331 DstMem
| SrcImmByte
| ModRM
| Lock
,
332 DstMem
| SrcImmByte
| ModRM
| Lock
,
333 DstMem
| SrcImmByte
| ModRM
| Lock
,
334 DstMem
| SrcImmByte
| ModRM
,
336 DstMem
| SrcNone
| ModRM
| Mov
| Stack
, 0, 0, 0, 0, 0, 0, 0,
338 ByteOp
| SrcImm
| DstMem
| ModRM
, 0,
339 ByteOp
| DstMem
| SrcNone
| ModRM
, ByteOp
| DstMem
| SrcNone
| ModRM
,
342 DstMem
| SrcImm
| ModRM
, 0,
343 DstMem
| SrcNone
| ModRM
, DstMem
| SrcNone
| ModRM
,
346 ByteOp
| DstMem
| SrcNone
| ModRM
, ByteOp
| DstMem
| SrcNone
| ModRM
,
349 DstMem
| SrcNone
| ModRM
, DstMem
| SrcNone
| ModRM
,
350 SrcMem
| ModRM
| Stack
, 0,
351 SrcMem
| ModRM
| Stack
, SrcMemFAddr
| ModRM
| ImplicitOps
,
352 SrcMem
| ModRM
| Stack
, 0,
354 0, 0, ModRM
| SrcMem
| Priv
, ModRM
| SrcMem
| Priv
,
355 SrcNone
| ModRM
| DstMem
| Mov
, 0,
356 SrcMem16
| ModRM
| Mov
| Priv
, SrcMem
| ModRM
| ByteOp
| Priv
,
359 DstMem
| SrcImmByte
| ModRM
, DstMem
| SrcImmByte
| ModRM
| Lock
,
360 DstMem
| SrcImmByte
| ModRM
| Lock
, DstMem
| SrcImmByte
| ModRM
| Lock
,
362 0, DstMem64
| ModRM
| Lock
, 0, 0, 0, 0, 0, 0,
365 static u32 group2_table
[] = {
367 SrcNone
| ModRM
| Priv
, 0, 0, SrcNone
| ModRM
| Priv
,
368 SrcNone
| ModRM
| DstMem
| Mov
, 0,
369 SrcMem16
| ModRM
| Mov
| Priv
, 0,
371 0, 0, 0, 0, 0, 0, 0, 0,
374 /* EFLAGS bit definitions. */
375 #define EFLG_ID (1<<21)
376 #define EFLG_VIP (1<<20)
377 #define EFLG_VIF (1<<19)
378 #define EFLG_AC (1<<18)
379 #define EFLG_VM (1<<17)
380 #define EFLG_RF (1<<16)
381 #define EFLG_IOPL (3<<12)
382 #define EFLG_NT (1<<14)
383 #define EFLG_OF (1<<11)
384 #define EFLG_DF (1<<10)
385 #define EFLG_IF (1<<9)
386 #define EFLG_TF (1<<8)
387 #define EFLG_SF (1<<7)
388 #define EFLG_ZF (1<<6)
389 #define EFLG_AF (1<<4)
390 #define EFLG_PF (1<<2)
391 #define EFLG_CF (1<<0)
394 * Instruction emulation:
395 * Most instructions are emulated directly via a fragment of inline assembly
396 * code. This allows us to save/restore EFLAGS and thus very easily pick up
397 * any modified flags.
400 #if defined(CONFIG_X86_64)
401 #define _LO32 "k" /* force 32-bit operand */
402 #define _STK "%%rsp" /* stack pointer */
403 #elif defined(__i386__)
404 #define _LO32 "" /* force 32-bit operand */
405 #define _STK "%%esp" /* stack pointer */
409 * These EFLAGS bits are restored from saved value during emulation, and
410 * any changes are written back to the saved value after emulation.
412 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
414 /* Before executing instruction: restore necessary bits in EFLAGS. */
415 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
416 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
417 "movl %"_sav",%"_LO32 _tmp"; " \
420 "movl %"_msk",%"_LO32 _tmp"; " \
421 "andl %"_LO32 _tmp",("_STK"); " \
423 "notl %"_LO32 _tmp"; " \
424 "andl %"_LO32 _tmp",("_STK"); " \
425 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
427 "orl %"_LO32 _tmp",("_STK"); " \
431 /* After executing instruction: write-back necessary bits in EFLAGS. */
432 #define _POST_EFLAGS(_sav, _msk, _tmp) \
433 /* _sav |= EFLAGS & _msk; */ \
436 "andl %"_msk",%"_LO32 _tmp"; " \
437 "orl %"_LO32 _tmp",%"_sav"; "
445 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix) \
447 __asm__ __volatile__ ( \
448 _PRE_EFLAGS("0", "4", "2") \
449 _op _suffix " %"_x"3,%1; " \
450 _POST_EFLAGS("0", "4", "2") \
451 : "=m" (_eflags), "=m" ((_dst).val), \
453 : _y ((_src).val), "i" (EFLAGS_MASK)); \
457 /* Raw emulation: instruction has two explicit operands. */
458 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
460 unsigned long _tmp; \
462 switch ((_dst).bytes) { \
464 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
467 ____emulate_2op(_op,_src,_dst,_eflags,_lx,_ly,"l"); \
470 ON64(____emulate_2op(_op,_src,_dst,_eflags,_qx,_qy,"q")); \
475 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
477 unsigned long _tmp; \
478 switch ((_dst).bytes) { \
480 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b"); \
483 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
484 _wx, _wy, _lx, _ly, _qx, _qy); \
489 /* Source operand is byte-sized and may be restricted to just %cl. */
490 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
491 __emulate_2op(_op, _src, _dst, _eflags, \
492 "b", "c", "b", "c", "b", "c", "b", "c")
494 /* Source operand is byte, word, long or quad sized. */
495 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
496 __emulate_2op(_op, _src, _dst, _eflags, \
497 "b", "q", "w", "r", _LO32, "r", "", "r")
499 /* Source operand is word, long or quad sized. */
500 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
501 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
502 "w", "r", _LO32, "r", "", "r")
504 /* Instruction has three operands and one operand is stored in ECX register */
505 #define __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, _suffix, _type) \
507 unsigned long _tmp; \
508 _type _clv = (_cl).val; \
509 _type _srcv = (_src).val; \
510 _type _dstv = (_dst).val; \
512 __asm__ __volatile__ ( \
513 _PRE_EFLAGS("0", "5", "2") \
514 _op _suffix " %4,%1 \n" \
515 _POST_EFLAGS("0", "5", "2") \
516 : "=m" (_eflags), "+r" (_dstv), "=&r" (_tmp) \
517 : "c" (_clv) , "r" (_srcv), "i" (EFLAGS_MASK) \
520 (_cl).val = (unsigned long) _clv; \
521 (_src).val = (unsigned long) _srcv; \
522 (_dst).val = (unsigned long) _dstv; \
525 #define emulate_2op_cl(_op, _cl, _src, _dst, _eflags) \
527 switch ((_dst).bytes) { \
529 __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
530 "w", unsigned short); \
533 __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
534 "l", unsigned int); \
537 ON64(__emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
538 "q", unsigned long)); \
543 #define __emulate_1op(_op, _dst, _eflags, _suffix) \
545 unsigned long _tmp; \
547 __asm__ __volatile__ ( \
548 _PRE_EFLAGS("0", "3", "2") \
549 _op _suffix " %1; " \
550 _POST_EFLAGS("0", "3", "2") \
551 : "=m" (_eflags), "+m" ((_dst).val), \
553 : "i" (EFLAGS_MASK)); \
556 /* Instruction has only one explicit operand (no source operand). */
557 #define emulate_1op(_op, _dst, _eflags) \
559 switch ((_dst).bytes) { \
560 case 1: __emulate_1op(_op, _dst, _eflags, "b"); break; \
561 case 2: __emulate_1op(_op, _dst, _eflags, "w"); break; \
562 case 4: __emulate_1op(_op, _dst, _eflags, "l"); break; \
563 case 8: ON64(__emulate_1op(_op, _dst, _eflags, "q")); break; \
567 /* Fetch next part of the instruction being emulated. */
568 #define insn_fetch(_type, _size, _eip) \
569 ({ unsigned long _x; \
570 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
571 if (rc != X86EMUL_CONTINUE) \
577 #define insn_fetch_arr(_arr, _size, _eip) \
578 ({ rc = do_insn_fetch(ctxt, ops, (_eip), _arr, (_size)); \
579 if (rc != X86EMUL_CONTINUE) \
584 static inline unsigned long ad_mask(struct decode_cache
*c
)
586 return (1UL << (c
->ad_bytes
<< 3)) - 1;
589 /* Access/update address held in a register, based on addressing mode. */
590 static inline unsigned long
591 address_mask(struct decode_cache
*c
, unsigned long reg
)
593 if (c
->ad_bytes
== sizeof(unsigned long))
596 return reg
& ad_mask(c
);
599 static inline unsigned long
600 register_address(struct decode_cache
*c
, unsigned long base
, unsigned long reg
)
602 return base
+ address_mask(c
, reg
);
606 register_address_increment(struct decode_cache
*c
, unsigned long *reg
, int inc
)
608 if (c
->ad_bytes
== sizeof(unsigned long))
611 *reg
= (*reg
& ~ad_mask(c
)) | ((*reg
+ inc
) & ad_mask(c
));
614 static inline void jmp_rel(struct decode_cache
*c
, int rel
)
616 register_address_increment(c
, &c
->eip
, rel
);
619 static void set_seg_override(struct decode_cache
*c
, int seg
)
621 c
->has_seg_override
= true;
622 c
->seg_override
= seg
;
625 static unsigned long seg_base(struct x86_emulate_ctxt
*ctxt
,
626 struct x86_emulate_ops
*ops
, int seg
)
628 if (ctxt
->mode
== X86EMUL_MODE_PROT64
&& seg
< VCPU_SREG_FS
)
631 return ops
->get_cached_segment_base(seg
, ctxt
->vcpu
);
634 static unsigned long seg_override_base(struct x86_emulate_ctxt
*ctxt
,
635 struct x86_emulate_ops
*ops
,
636 struct decode_cache
*c
)
638 if (!c
->has_seg_override
)
641 return seg_base(ctxt
, ops
, c
->seg_override
);
644 static unsigned long es_base(struct x86_emulate_ctxt
*ctxt
,
645 struct x86_emulate_ops
*ops
)
647 return seg_base(ctxt
, ops
, VCPU_SREG_ES
);
650 static unsigned long ss_base(struct x86_emulate_ctxt
*ctxt
,
651 struct x86_emulate_ops
*ops
)
653 return seg_base(ctxt
, ops
, VCPU_SREG_SS
);
656 static int do_fetch_insn_byte(struct x86_emulate_ctxt
*ctxt
,
657 struct x86_emulate_ops
*ops
,
658 unsigned long eip
, u8
*dest
)
660 struct fetch_cache
*fc
= &ctxt
->decode
.fetch
;
664 if (eip
== fc
->end
) {
665 cur_size
= fc
->end
- fc
->start
;
666 size
= min(15UL - cur_size
, PAGE_SIZE
- offset_in_page(eip
));
667 rc
= ops
->fetch(ctxt
->cs_base
+ eip
, fc
->data
+ cur_size
,
668 size
, ctxt
->vcpu
, NULL
);
669 if (rc
!= X86EMUL_CONTINUE
)
673 *dest
= fc
->data
[eip
- fc
->start
];
674 return X86EMUL_CONTINUE
;
677 static int do_insn_fetch(struct x86_emulate_ctxt
*ctxt
,
678 struct x86_emulate_ops
*ops
,
679 unsigned long eip
, void *dest
, unsigned size
)
683 /* x86 instructions are limited to 15 bytes. */
684 if (eip
+ size
- ctxt
->eip
> 15)
685 return X86EMUL_UNHANDLEABLE
;
687 rc
= do_fetch_insn_byte(ctxt
, ops
, eip
++, dest
++);
688 if (rc
!= X86EMUL_CONTINUE
)
691 return X86EMUL_CONTINUE
;
695 * Given the 'reg' portion of a ModRM byte, and a register block, return a
696 * pointer into the block that addresses the relevant register.
697 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
699 static void *decode_register(u8 modrm_reg
, unsigned long *regs
,
704 p
= ®s
[modrm_reg
];
705 if (highbyte_regs
&& modrm_reg
>= 4 && modrm_reg
< 8)
706 p
= (unsigned char *)®s
[modrm_reg
& 3] + 1;
710 static int read_descriptor(struct x86_emulate_ctxt
*ctxt
,
711 struct x86_emulate_ops
*ops
,
713 u16
*size
, unsigned long *address
, int op_bytes
)
720 rc
= ops
->read_std((unsigned long)ptr
, (unsigned long *)size
, 2,
722 if (rc
!= X86EMUL_CONTINUE
)
724 rc
= ops
->read_std((unsigned long)ptr
+ 2, address
, op_bytes
,
729 static int test_cc(unsigned int condition
, unsigned int flags
)
733 switch ((condition
& 15) >> 1) {
735 rc
|= (flags
& EFLG_OF
);
737 case 1: /* b/c/nae */
738 rc
|= (flags
& EFLG_CF
);
741 rc
|= (flags
& EFLG_ZF
);
744 rc
|= (flags
& (EFLG_CF
|EFLG_ZF
));
747 rc
|= (flags
& EFLG_SF
);
750 rc
|= (flags
& EFLG_PF
);
753 rc
|= (flags
& EFLG_ZF
);
756 rc
|= (!(flags
& EFLG_SF
) != !(flags
& EFLG_OF
));
760 /* Odd condition identifiers (lsb == 1) have inverted sense. */
761 return (!!rc
^ (condition
& 1));
764 static void decode_register_operand(struct operand
*op
,
765 struct decode_cache
*c
,
768 unsigned reg
= c
->modrm_reg
;
769 int highbyte_regs
= c
->rex_prefix
== 0;
772 reg
= (c
->b
& 7) | ((c
->rex_prefix
& 1) << 3);
774 if ((c
->d
& ByteOp
) && !inhibit_bytereg
) {
775 op
->ptr
= decode_register(reg
, c
->regs
, highbyte_regs
);
776 op
->val
= *(u8
*)op
->ptr
;
779 op
->ptr
= decode_register(reg
, c
->regs
, 0);
780 op
->bytes
= c
->op_bytes
;
783 op
->val
= *(u16
*)op
->ptr
;
786 op
->val
= *(u32
*)op
->ptr
;
789 op
->val
= *(u64
*) op
->ptr
;
793 op
->orig_val
= op
->val
;
796 static int decode_modrm(struct x86_emulate_ctxt
*ctxt
,
797 struct x86_emulate_ops
*ops
)
799 struct decode_cache
*c
= &ctxt
->decode
;
801 int index_reg
= 0, base_reg
= 0, scale
;
802 int rc
= X86EMUL_CONTINUE
;
805 c
->modrm_reg
= (c
->rex_prefix
& 4) << 1; /* REX.R */
806 index_reg
= (c
->rex_prefix
& 2) << 2; /* REX.X */
807 c
->modrm_rm
= base_reg
= (c
->rex_prefix
& 1) << 3; /* REG.B */
810 c
->modrm
= insn_fetch(u8
, 1, c
->eip
);
811 c
->modrm_mod
|= (c
->modrm
& 0xc0) >> 6;
812 c
->modrm_reg
|= (c
->modrm
& 0x38) >> 3;
813 c
->modrm_rm
|= (c
->modrm
& 0x07);
817 if (c
->modrm_mod
== 3) {
818 c
->modrm_ptr
= decode_register(c
->modrm_rm
,
819 c
->regs
, c
->d
& ByteOp
);
820 c
->modrm_val
= *(unsigned long *)c
->modrm_ptr
;
824 if (c
->ad_bytes
== 2) {
825 unsigned bx
= c
->regs
[VCPU_REGS_RBX
];
826 unsigned bp
= c
->regs
[VCPU_REGS_RBP
];
827 unsigned si
= c
->regs
[VCPU_REGS_RSI
];
828 unsigned di
= c
->regs
[VCPU_REGS_RDI
];
830 /* 16-bit ModR/M decode. */
831 switch (c
->modrm_mod
) {
833 if (c
->modrm_rm
== 6)
834 c
->modrm_ea
+= insn_fetch(u16
, 2, c
->eip
);
837 c
->modrm_ea
+= insn_fetch(s8
, 1, c
->eip
);
840 c
->modrm_ea
+= insn_fetch(u16
, 2, c
->eip
);
843 switch (c
->modrm_rm
) {
845 c
->modrm_ea
+= bx
+ si
;
848 c
->modrm_ea
+= bx
+ di
;
851 c
->modrm_ea
+= bp
+ si
;
854 c
->modrm_ea
+= bp
+ di
;
863 if (c
->modrm_mod
!= 0)
870 if (c
->modrm_rm
== 2 || c
->modrm_rm
== 3 ||
871 (c
->modrm_rm
== 6 && c
->modrm_mod
!= 0))
872 if (!c
->has_seg_override
)
873 set_seg_override(c
, VCPU_SREG_SS
);
874 c
->modrm_ea
= (u16
)c
->modrm_ea
;
876 /* 32/64-bit ModR/M decode. */
877 if ((c
->modrm_rm
& 7) == 4) {
878 sib
= insn_fetch(u8
, 1, c
->eip
);
879 index_reg
|= (sib
>> 3) & 7;
883 if ((base_reg
& 7) == 5 && c
->modrm_mod
== 0)
884 c
->modrm_ea
+= insn_fetch(s32
, 4, c
->eip
);
886 c
->modrm_ea
+= c
->regs
[base_reg
];
888 c
->modrm_ea
+= c
->regs
[index_reg
] << scale
;
889 } else if ((c
->modrm_rm
& 7) == 5 && c
->modrm_mod
== 0) {
890 if (ctxt
->mode
== X86EMUL_MODE_PROT64
)
893 c
->modrm_ea
+= c
->regs
[c
->modrm_rm
];
894 switch (c
->modrm_mod
) {
896 if (c
->modrm_rm
== 5)
897 c
->modrm_ea
+= insn_fetch(s32
, 4, c
->eip
);
900 c
->modrm_ea
+= insn_fetch(s8
, 1, c
->eip
);
903 c
->modrm_ea
+= insn_fetch(s32
, 4, c
->eip
);
911 static int decode_abs(struct x86_emulate_ctxt
*ctxt
,
912 struct x86_emulate_ops
*ops
)
914 struct decode_cache
*c
= &ctxt
->decode
;
915 int rc
= X86EMUL_CONTINUE
;
917 switch (c
->ad_bytes
) {
919 c
->modrm_ea
= insn_fetch(u16
, 2, c
->eip
);
922 c
->modrm_ea
= insn_fetch(u32
, 4, c
->eip
);
925 c
->modrm_ea
= insn_fetch(u64
, 8, c
->eip
);
933 x86_decode_insn(struct x86_emulate_ctxt
*ctxt
, struct x86_emulate_ops
*ops
)
935 struct decode_cache
*c
= &ctxt
->decode
;
936 int rc
= X86EMUL_CONTINUE
;
937 int mode
= ctxt
->mode
;
938 int def_op_bytes
, def_ad_bytes
, group
;
941 /* we cannot decode insn before we complete previous rep insn */
942 WARN_ON(ctxt
->restart
);
944 /* Shadow copy of register state. Committed on successful emulation. */
945 memset(c
, 0, sizeof(struct decode_cache
));
947 c
->fetch
.start
= c
->fetch
.end
= c
->eip
;
948 ctxt
->cs_base
= seg_base(ctxt
, ops
, VCPU_SREG_CS
);
949 memcpy(c
->regs
, ctxt
->vcpu
->arch
.regs
, sizeof c
->regs
);
952 case X86EMUL_MODE_REAL
:
953 case X86EMUL_MODE_VM86
:
954 case X86EMUL_MODE_PROT16
:
955 def_op_bytes
= def_ad_bytes
= 2;
957 case X86EMUL_MODE_PROT32
:
958 def_op_bytes
= def_ad_bytes
= 4;
961 case X86EMUL_MODE_PROT64
:
970 c
->op_bytes
= def_op_bytes
;
971 c
->ad_bytes
= def_ad_bytes
;
973 /* Legacy prefixes. */
975 switch (c
->b
= insn_fetch(u8
, 1, c
->eip
)) {
976 case 0x66: /* operand-size override */
977 /* switch between 2/4 bytes */
978 c
->op_bytes
= def_op_bytes
^ 6;
980 case 0x67: /* address-size override */
981 if (mode
== X86EMUL_MODE_PROT64
)
982 /* switch between 4/8 bytes */
983 c
->ad_bytes
= def_ad_bytes
^ 12;
985 /* switch between 2/4 bytes */
986 c
->ad_bytes
= def_ad_bytes
^ 6;
988 case 0x26: /* ES override */
989 case 0x2e: /* CS override */
990 case 0x36: /* SS override */
991 case 0x3e: /* DS override */
992 set_seg_override(c
, (c
->b
>> 3) & 3);
994 case 0x64: /* FS override */
995 case 0x65: /* GS override */
996 set_seg_override(c
, c
->b
& 7);
998 case 0x40 ... 0x4f: /* REX */
999 if (mode
!= X86EMUL_MODE_PROT64
)
1001 c
->rex_prefix
= c
->b
;
1003 case 0xf0: /* LOCK */
1006 case 0xf2: /* REPNE/REPNZ */
1007 c
->rep_prefix
= REPNE_PREFIX
;
1009 case 0xf3: /* REP/REPE/REPZ */
1010 c
->rep_prefix
= REPE_PREFIX
;
1016 /* Any legacy prefix after a REX prefix nullifies its effect. */
1025 if (c
->rex_prefix
& 8)
1026 c
->op_bytes
= 8; /* REX.W */
1028 /* Opcode byte(s). */
1029 c
->d
= opcode_table
[c
->b
];
1031 /* Two-byte opcode? */
1034 c
->b
= insn_fetch(u8
, 1, c
->eip
);
1035 c
->d
= twobyte_table
[c
->b
];
1040 group
= c
->d
& GroupMask
;
1041 c
->modrm
= insn_fetch(u8
, 1, c
->eip
);
1044 group
= (group
<< 3) + ((c
->modrm
>> 3) & 7);
1045 if ((c
->d
& GroupDual
) && (c
->modrm
>> 6) == 3)
1046 c
->d
= group2_table
[group
];
1048 c
->d
= group_table
[group
];
1053 DPRINTF("Cannot emulate %02x\n", c
->b
);
1057 if (mode
== X86EMUL_MODE_PROT64
&& (c
->d
& Stack
))
1060 /* ModRM and SIB bytes. */
1062 rc
= decode_modrm(ctxt
, ops
);
1063 else if (c
->d
& MemAbs
)
1064 rc
= decode_abs(ctxt
, ops
);
1065 if (rc
!= X86EMUL_CONTINUE
)
1068 if (!c
->has_seg_override
)
1069 set_seg_override(c
, VCPU_SREG_DS
);
1071 if (!(!c
->twobyte
&& c
->b
== 0x8d))
1072 c
->modrm_ea
+= seg_override_base(ctxt
, ops
, c
);
1074 if (c
->ad_bytes
!= 8)
1075 c
->modrm_ea
= (u32
)c
->modrm_ea
;
1077 if (c
->rip_relative
)
1078 c
->modrm_ea
+= c
->eip
;
1081 * Decode and fetch the source operand: register, memory
1084 switch (c
->d
& SrcMask
) {
1088 decode_register_operand(&c
->src
, c
, 0);
1097 c
->src
.bytes
= (c
->d
& ByteOp
) ? 1 :
1099 /* Don't fetch the address for invlpg: it could be unmapped. */
1100 if (c
->twobyte
&& c
->b
== 0x01 && c
->modrm_reg
== 7)
1104 * For instructions with a ModR/M byte, switch to register
1105 * access if Mod = 3.
1107 if ((c
->d
& ModRM
) && c
->modrm_mod
== 3) {
1108 c
->src
.type
= OP_REG
;
1109 c
->src
.val
= c
->modrm_val
;
1110 c
->src
.ptr
= c
->modrm_ptr
;
1113 c
->src
.type
= OP_MEM
;
1114 c
->src
.ptr
= (unsigned long *)c
->modrm_ea
;
1119 c
->src
.type
= OP_IMM
;
1120 c
->src
.ptr
= (unsigned long *)c
->eip
;
1121 c
->src
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
1122 if (c
->src
.bytes
== 8)
1124 /* NB. Immediates are sign-extended as necessary. */
1125 switch (c
->src
.bytes
) {
1127 c
->src
.val
= insn_fetch(s8
, 1, c
->eip
);
1130 c
->src
.val
= insn_fetch(s16
, 2, c
->eip
);
1133 c
->src
.val
= insn_fetch(s32
, 4, c
->eip
);
1136 if ((c
->d
& SrcMask
) == SrcImmU
) {
1137 switch (c
->src
.bytes
) {
1142 c
->src
.val
&= 0xffff;
1145 c
->src
.val
&= 0xffffffff;
1152 c
->src
.type
= OP_IMM
;
1153 c
->src
.ptr
= (unsigned long *)c
->eip
;
1155 if ((c
->d
& SrcMask
) == SrcImmByte
)
1156 c
->src
.val
= insn_fetch(s8
, 1, c
->eip
);
1158 c
->src
.val
= insn_fetch(u8
, 1, c
->eip
);
1165 c
->src
.type
= OP_MEM
;
1166 c
->src
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
1167 c
->src
.ptr
= (unsigned long *)
1168 register_address(c
, seg_override_base(ctxt
, ops
, c
),
1169 c
->regs
[VCPU_REGS_RSI
]);
1173 c
->src
.type
= OP_IMM
;
1174 c
->src
.ptr
= (unsigned long *)c
->eip
;
1175 c
->src
.bytes
= c
->op_bytes
+ 2;
1176 insn_fetch_arr(c
->src
.valptr
, c
->src
.bytes
, c
->eip
);
1179 c
->src
.type
= OP_MEM
;
1180 c
->src
.ptr
= (unsigned long *)c
->modrm_ea
;
1181 c
->src
.bytes
= c
->op_bytes
+ 2;
1186 * Decode and fetch the second source operand: register, memory
1189 switch (c
->d
& Src2Mask
) {
1194 c
->src2
.val
= c
->regs
[VCPU_REGS_RCX
] & 0x8;
1197 c
->src2
.type
= OP_IMM
;
1198 c
->src2
.ptr
= (unsigned long *)c
->eip
;
1200 c
->src2
.val
= insn_fetch(u8
, 1, c
->eip
);
1208 /* Decode and fetch the destination operand: register or memory. */
1209 switch (c
->d
& DstMask
) {
1211 /* Special instructions do their own operand decoding. */
1214 decode_register_operand(&c
->dst
, c
,
1215 c
->twobyte
&& (c
->b
== 0xb6 || c
->b
== 0xb7));
1219 if ((c
->d
& ModRM
) && c
->modrm_mod
== 3) {
1220 c
->dst
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
1221 c
->dst
.type
= OP_REG
;
1222 c
->dst
.val
= c
->dst
.orig_val
= c
->modrm_val
;
1223 c
->dst
.ptr
= c
->modrm_ptr
;
1226 c
->dst
.type
= OP_MEM
;
1227 c
->dst
.ptr
= (unsigned long *)c
->modrm_ea
;
1228 if ((c
->d
& DstMask
) == DstMem64
)
1231 c
->dst
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
1234 unsigned long mask
= ~(c
->dst
.bytes
* 8 - 1);
1236 c
->dst
.ptr
= (void *)c
->dst
.ptr
+
1237 (c
->src
.val
& mask
) / 8;
1241 c
->dst
.type
= OP_REG
;
1242 c
->dst
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
1243 c
->dst
.ptr
= &c
->regs
[VCPU_REGS_RAX
];
1244 switch (c
->dst
.bytes
) {
1246 c
->dst
.val
= *(u8
*)c
->dst
.ptr
;
1249 c
->dst
.val
= *(u16
*)c
->dst
.ptr
;
1252 c
->dst
.val
= *(u32
*)c
->dst
.ptr
;
1255 c
->dst
.val
= *(u64
*)c
->dst
.ptr
;
1258 c
->dst
.orig_val
= c
->dst
.val
;
1261 c
->dst
.type
= OP_MEM
;
1262 c
->dst
.bytes
= (c
->d
& ByteOp
) ? 1 : c
->op_bytes
;
1263 c
->dst
.ptr
= (unsigned long *)
1264 register_address(c
, es_base(ctxt
, ops
),
1265 c
->regs
[VCPU_REGS_RDI
]);
1271 return (rc
== X86EMUL_UNHANDLEABLE
) ? -1 : 0;
1274 static int read_emulated(struct x86_emulate_ctxt
*ctxt
,
1275 struct x86_emulate_ops
*ops
,
1276 unsigned long addr
, void *dest
, unsigned size
)
1279 struct read_cache
*mc
= &ctxt
->decode
.mem_read
;
1282 int n
= min(size
, 8u);
1284 if (mc
->pos
< mc
->end
)
1287 rc
= ops
->read_emulated(addr
, mc
->data
+ mc
->end
, n
, ctxt
->vcpu
);
1288 if (rc
!= X86EMUL_CONTINUE
)
1293 memcpy(dest
, mc
->data
+ mc
->pos
, n
);
1298 return X86EMUL_CONTINUE
;
1301 static int pio_in_emulated(struct x86_emulate_ctxt
*ctxt
,
1302 struct x86_emulate_ops
*ops
,
1303 unsigned int size
, unsigned short port
,
1306 struct read_cache
*rc
= &ctxt
->decode
.io_read
;
1308 if (rc
->pos
== rc
->end
) { /* refill pio read ahead */
1309 struct decode_cache
*c
= &ctxt
->decode
;
1310 unsigned int in_page
, n
;
1311 unsigned int count
= c
->rep_prefix
?
1312 address_mask(c
, c
->regs
[VCPU_REGS_RCX
]) : 1;
1313 in_page
= (ctxt
->eflags
& EFLG_DF
) ?
1314 offset_in_page(c
->regs
[VCPU_REGS_RDI
]) :
1315 PAGE_SIZE
- offset_in_page(c
->regs
[VCPU_REGS_RDI
]);
1316 n
= min(min(in_page
, (unsigned int)sizeof(rc
->data
)) / size
,
1320 rc
->pos
= rc
->end
= 0;
1321 if (!ops
->pio_in_emulated(size
, port
, rc
->data
, n
, ctxt
->vcpu
))
1326 memcpy(dest
, rc
->data
+ rc
->pos
, size
);
1331 static u32
desc_limit_scaled(struct desc_struct
*desc
)
1333 u32 limit
= get_desc_limit(desc
);
1335 return desc
->g
? (limit
<< 12) | 0xfff : limit
;
1338 static void get_descriptor_table_ptr(struct x86_emulate_ctxt
*ctxt
,
1339 struct x86_emulate_ops
*ops
,
1340 u16 selector
, struct desc_ptr
*dt
)
1342 if (selector
& 1 << 2) {
1343 struct desc_struct desc
;
1344 memset (dt
, 0, sizeof *dt
);
1345 if (!ops
->get_cached_descriptor(&desc
, VCPU_SREG_LDTR
, ctxt
->vcpu
))
1348 dt
->size
= desc_limit_scaled(&desc
); /* what if limit > 65535? */
1349 dt
->address
= get_desc_base(&desc
);
1351 ops
->get_gdt(dt
, ctxt
->vcpu
);
1354 /* allowed just for 8 bytes segments */
1355 static int read_segment_descriptor(struct x86_emulate_ctxt
*ctxt
,
1356 struct x86_emulate_ops
*ops
,
1357 u16 selector
, struct desc_struct
*desc
)
1360 u16 index
= selector
>> 3;
1365 get_descriptor_table_ptr(ctxt
, ops
, selector
, &dt
);
1367 if (dt
.size
< index
* 8 + 7) {
1368 kvm_inject_gp(ctxt
->vcpu
, selector
& 0xfffc);
1369 return X86EMUL_PROPAGATE_FAULT
;
1371 addr
= dt
.address
+ index
* 8;
1372 ret
= ops
->read_std(addr
, desc
, sizeof *desc
, ctxt
->vcpu
, &err
);
1373 if (ret
== X86EMUL_PROPAGATE_FAULT
)
1374 kvm_inject_page_fault(ctxt
->vcpu
, addr
, err
);
1379 /* allowed just for 8 bytes segments */
1380 static int write_segment_descriptor(struct x86_emulate_ctxt
*ctxt
,
1381 struct x86_emulate_ops
*ops
,
1382 u16 selector
, struct desc_struct
*desc
)
1385 u16 index
= selector
>> 3;
1390 get_descriptor_table_ptr(ctxt
, ops
, selector
, &dt
);
1392 if (dt
.size
< index
* 8 + 7) {
1393 kvm_inject_gp(ctxt
->vcpu
, selector
& 0xfffc);
1394 return X86EMUL_PROPAGATE_FAULT
;
1397 addr
= dt
.address
+ index
* 8;
1398 ret
= ops
->write_std(addr
, desc
, sizeof *desc
, ctxt
->vcpu
, &err
);
1399 if (ret
== X86EMUL_PROPAGATE_FAULT
)
1400 kvm_inject_page_fault(ctxt
->vcpu
, addr
, err
);
1405 static int load_segment_descriptor(struct x86_emulate_ctxt
*ctxt
,
1406 struct x86_emulate_ops
*ops
,
1407 u16 selector
, int seg
)
1409 struct desc_struct seg_desc
;
1411 unsigned err_vec
= GP_VECTOR
;
1413 bool null_selector
= !(selector
& ~0x3); /* 0000-0003 are null */
1416 memset(&seg_desc
, 0, sizeof seg_desc
);
1418 if ((seg
<= VCPU_SREG_GS
&& ctxt
->mode
== X86EMUL_MODE_VM86
)
1419 || ctxt
->mode
== X86EMUL_MODE_REAL
) {
1420 /* set real mode segment descriptor */
1421 set_desc_base(&seg_desc
, selector
<< 4);
1422 set_desc_limit(&seg_desc
, 0xffff);
1429 /* NULL selector is not valid for TR, CS and SS */
1430 if ((seg
== VCPU_SREG_CS
|| seg
== VCPU_SREG_SS
|| seg
== VCPU_SREG_TR
)
1434 /* TR should be in GDT only */
1435 if (seg
== VCPU_SREG_TR
&& (selector
& (1 << 2)))
1438 if (null_selector
) /* for NULL selector skip all following checks */
1441 ret
= read_segment_descriptor(ctxt
, ops
, selector
, &seg_desc
);
1442 if (ret
!= X86EMUL_CONTINUE
)
1445 err_code
= selector
& 0xfffc;
1446 err_vec
= GP_VECTOR
;
1448 /* can't load system descriptor into segment selecor */
1449 if (seg
<= VCPU_SREG_GS
&& !seg_desc
.s
)
1453 err_vec
= (seg
== VCPU_SREG_SS
) ? SS_VECTOR
: NP_VECTOR
;
1459 cpl
= ops
->cpl(ctxt
->vcpu
);
1464 * segment is not a writable data segment or segment
1465 * selector's RPL != CPL or segment selector's RPL != CPL
1467 if (rpl
!= cpl
|| (seg_desc
.type
& 0xa) != 0x2 || dpl
!= cpl
)
1471 if (!(seg_desc
.type
& 8))
1474 if (seg_desc
.type
& 4) {
1480 if (rpl
> cpl
|| dpl
!= cpl
)
1483 /* CS(RPL) <- CPL */
1484 selector
= (selector
& 0xfffc) | cpl
;
1487 if (seg_desc
.s
|| (seg_desc
.type
!= 1 && seg_desc
.type
!= 9))
1490 case VCPU_SREG_LDTR
:
1491 if (seg_desc
.s
|| seg_desc
.type
!= 2)
1494 default: /* DS, ES, FS, or GS */
1496 * segment is not a data or readable code segment or
1497 * ((segment is a data or nonconforming code segment)
1498 * and (both RPL and CPL > DPL))
1500 if ((seg_desc
.type
& 0xa) == 0x8 ||
1501 (((seg_desc
.type
& 0xc) != 0xc) &&
1502 (rpl
> dpl
&& cpl
> dpl
)))
1508 /* mark segment as accessed */
1510 ret
= write_segment_descriptor(ctxt
, ops
, selector
, &seg_desc
);
1511 if (ret
!= X86EMUL_CONTINUE
)
1515 ops
->set_segment_selector(selector
, seg
, ctxt
->vcpu
);
1516 ops
->set_cached_descriptor(&seg_desc
, seg
, ctxt
->vcpu
);
1517 return X86EMUL_CONTINUE
;
1519 kvm_queue_exception_e(ctxt
->vcpu
, err_vec
, err_code
);
1520 return X86EMUL_PROPAGATE_FAULT
;
1523 static inline void emulate_push(struct x86_emulate_ctxt
*ctxt
,
1524 struct x86_emulate_ops
*ops
)
1526 struct decode_cache
*c
= &ctxt
->decode
;
1528 c
->dst
.type
= OP_MEM
;
1529 c
->dst
.bytes
= c
->op_bytes
;
1530 c
->dst
.val
= c
->src
.val
;
1531 register_address_increment(c
, &c
->regs
[VCPU_REGS_RSP
], -c
->op_bytes
);
1532 c
->dst
.ptr
= (void *) register_address(c
, ss_base(ctxt
, ops
),
1533 c
->regs
[VCPU_REGS_RSP
]);
1536 static int emulate_pop(struct x86_emulate_ctxt
*ctxt
,
1537 struct x86_emulate_ops
*ops
,
1538 void *dest
, int len
)
1540 struct decode_cache
*c
= &ctxt
->decode
;
1543 rc
= read_emulated(ctxt
, ops
, register_address(c
, ss_base(ctxt
, ops
),
1544 c
->regs
[VCPU_REGS_RSP
]),
1546 if (rc
!= X86EMUL_CONTINUE
)
1549 register_address_increment(c
, &c
->regs
[VCPU_REGS_RSP
], len
);
1553 static int emulate_popf(struct x86_emulate_ctxt
*ctxt
,
1554 struct x86_emulate_ops
*ops
,
1555 void *dest
, int len
)
1558 unsigned long val
, change_mask
;
1559 int iopl
= (ctxt
->eflags
& X86_EFLAGS_IOPL
) >> IOPL_SHIFT
;
1560 int cpl
= ops
->cpl(ctxt
->vcpu
);
1562 rc
= emulate_pop(ctxt
, ops
, &val
, len
);
1563 if (rc
!= X86EMUL_CONTINUE
)
1566 change_mask
= EFLG_CF
| EFLG_PF
| EFLG_AF
| EFLG_ZF
| EFLG_SF
| EFLG_OF
1567 | EFLG_TF
| EFLG_DF
| EFLG_NT
| EFLG_RF
| EFLG_AC
| EFLG_ID
;
1569 switch(ctxt
->mode
) {
1570 case X86EMUL_MODE_PROT64
:
1571 case X86EMUL_MODE_PROT32
:
1572 case X86EMUL_MODE_PROT16
:
1574 change_mask
|= EFLG_IOPL
;
1576 change_mask
|= EFLG_IF
;
1578 case X86EMUL_MODE_VM86
:
1580 kvm_inject_gp(ctxt
->vcpu
, 0);
1581 return X86EMUL_PROPAGATE_FAULT
;
1583 change_mask
|= EFLG_IF
;
1585 default: /* real mode */
1586 change_mask
|= (EFLG_IOPL
| EFLG_IF
);
1590 *(unsigned long *)dest
=
1591 (ctxt
->eflags
& ~change_mask
) | (val
& change_mask
);
1596 static void emulate_push_sreg(struct x86_emulate_ctxt
*ctxt
,
1597 struct x86_emulate_ops
*ops
, int seg
)
1599 struct decode_cache
*c
= &ctxt
->decode
;
1601 c
->src
.val
= ops
->get_segment_selector(seg
, ctxt
->vcpu
);
1603 emulate_push(ctxt
, ops
);
1606 static int emulate_pop_sreg(struct x86_emulate_ctxt
*ctxt
,
1607 struct x86_emulate_ops
*ops
, int seg
)
1609 struct decode_cache
*c
= &ctxt
->decode
;
1610 unsigned long selector
;
1613 rc
= emulate_pop(ctxt
, ops
, &selector
, c
->op_bytes
);
1614 if (rc
!= X86EMUL_CONTINUE
)
1617 rc
= load_segment_descriptor(ctxt
, ops
, (u16
)selector
, seg
);
1621 static void emulate_pusha(struct x86_emulate_ctxt
*ctxt
,
1622 struct x86_emulate_ops
*ops
)
1624 struct decode_cache
*c
= &ctxt
->decode
;
1625 unsigned long old_esp
= c
->regs
[VCPU_REGS_RSP
];
1626 int reg
= VCPU_REGS_RAX
;
1628 while (reg
<= VCPU_REGS_RDI
) {
1629 (reg
== VCPU_REGS_RSP
) ?
1630 (c
->src
.val
= old_esp
) : (c
->src
.val
= c
->regs
[reg
]);
1632 emulate_push(ctxt
, ops
);
1637 static int emulate_popa(struct x86_emulate_ctxt
*ctxt
,
1638 struct x86_emulate_ops
*ops
)
1640 struct decode_cache
*c
= &ctxt
->decode
;
1641 int rc
= X86EMUL_CONTINUE
;
1642 int reg
= VCPU_REGS_RDI
;
1644 while (reg
>= VCPU_REGS_RAX
) {
1645 if (reg
== VCPU_REGS_RSP
) {
1646 register_address_increment(c
, &c
->regs
[VCPU_REGS_RSP
],
1651 rc
= emulate_pop(ctxt
, ops
, &c
->regs
[reg
], c
->op_bytes
);
1652 if (rc
!= X86EMUL_CONTINUE
)
1659 static inline int emulate_grp1a(struct x86_emulate_ctxt
*ctxt
,
1660 struct x86_emulate_ops
*ops
)
1662 struct decode_cache
*c
= &ctxt
->decode
;
1664 return emulate_pop(ctxt
, ops
, &c
->dst
.val
, c
->dst
.bytes
);
1667 static inline void emulate_grp2(struct x86_emulate_ctxt
*ctxt
)
1669 struct decode_cache
*c
= &ctxt
->decode
;
1670 switch (c
->modrm_reg
) {
1672 emulate_2op_SrcB("rol", c
->src
, c
->dst
, ctxt
->eflags
);
1675 emulate_2op_SrcB("ror", c
->src
, c
->dst
, ctxt
->eflags
);
1678 emulate_2op_SrcB("rcl", c
->src
, c
->dst
, ctxt
->eflags
);
1681 emulate_2op_SrcB("rcr", c
->src
, c
->dst
, ctxt
->eflags
);
1683 case 4: /* sal/shl */
1684 case 6: /* sal/shl */
1685 emulate_2op_SrcB("sal", c
->src
, c
->dst
, ctxt
->eflags
);
1688 emulate_2op_SrcB("shr", c
->src
, c
->dst
, ctxt
->eflags
);
1691 emulate_2op_SrcB("sar", c
->src
, c
->dst
, ctxt
->eflags
);
1696 static inline int emulate_grp3(struct x86_emulate_ctxt
*ctxt
,
1697 struct x86_emulate_ops
*ops
)
1699 struct decode_cache
*c
= &ctxt
->decode
;
1701 switch (c
->modrm_reg
) {
1702 case 0 ... 1: /* test */
1703 emulate_2op_SrcV("test", c
->src
, c
->dst
, ctxt
->eflags
);
1706 c
->dst
.val
= ~c
->dst
.val
;
1709 emulate_1op("neg", c
->dst
, ctxt
->eflags
);
1717 static inline int emulate_grp45(struct x86_emulate_ctxt
*ctxt
,
1718 struct x86_emulate_ops
*ops
)
1720 struct decode_cache
*c
= &ctxt
->decode
;
1722 switch (c
->modrm_reg
) {
1724 emulate_1op("inc", c
->dst
, ctxt
->eflags
);
1727 emulate_1op("dec", c
->dst
, ctxt
->eflags
);
1729 case 2: /* call near abs */ {
1732 c
->eip
= c
->src
.val
;
1733 c
->src
.val
= old_eip
;
1734 emulate_push(ctxt
, ops
);
1737 case 4: /* jmp abs */
1738 c
->eip
= c
->src
.val
;
1741 emulate_push(ctxt
, ops
);
1744 return X86EMUL_CONTINUE
;
1747 static inline int emulate_grp9(struct x86_emulate_ctxt
*ctxt
,
1748 struct x86_emulate_ops
*ops
)
1750 struct decode_cache
*c
= &ctxt
->decode
;
1751 u64 old
= c
->dst
.orig_val
;
1753 if (((u32
) (old
>> 0) != (u32
) c
->regs
[VCPU_REGS_RAX
]) ||
1754 ((u32
) (old
>> 32) != (u32
) c
->regs
[VCPU_REGS_RDX
])) {
1756 c
->regs
[VCPU_REGS_RAX
] = (u32
) (old
>> 0);
1757 c
->regs
[VCPU_REGS_RDX
] = (u32
) (old
>> 32);
1758 ctxt
->eflags
&= ~EFLG_ZF
;
1760 c
->dst
.val
= ((u64
)c
->regs
[VCPU_REGS_RCX
] << 32) |
1761 (u32
) c
->regs
[VCPU_REGS_RBX
];
1763 ctxt
->eflags
|= EFLG_ZF
;
1765 return X86EMUL_CONTINUE
;
1768 static int emulate_ret_far(struct x86_emulate_ctxt
*ctxt
,
1769 struct x86_emulate_ops
*ops
)
1771 struct decode_cache
*c
= &ctxt
->decode
;
1775 rc
= emulate_pop(ctxt
, ops
, &c
->eip
, c
->op_bytes
);
1776 if (rc
!= X86EMUL_CONTINUE
)
1778 if (c
->op_bytes
== 4)
1779 c
->eip
= (u32
)c
->eip
;
1780 rc
= emulate_pop(ctxt
, ops
, &cs
, c
->op_bytes
);
1781 if (rc
!= X86EMUL_CONTINUE
)
1783 rc
= load_segment_descriptor(ctxt
, ops
, (u16
)cs
, VCPU_SREG_CS
);
1787 static inline int writeback(struct x86_emulate_ctxt
*ctxt
,
1788 struct x86_emulate_ops
*ops
)
1791 struct decode_cache
*c
= &ctxt
->decode
;
1793 switch (c
->dst
.type
) {
1795 /* The 4-byte case *is* correct:
1796 * in 64-bit mode we zero-extend.
1798 switch (c
->dst
.bytes
) {
1800 *(u8
*)c
->dst
.ptr
= (u8
)c
->dst
.val
;
1803 *(u16
*)c
->dst
.ptr
= (u16
)c
->dst
.val
;
1806 *c
->dst
.ptr
= (u32
)c
->dst
.val
;
1807 break; /* 64b: zero-ext */
1809 *c
->dst
.ptr
= c
->dst
.val
;
1815 rc
= ops
->cmpxchg_emulated(
1816 (unsigned long)c
->dst
.ptr
,
1822 rc
= ops
->write_emulated(
1823 (unsigned long)c
->dst
.ptr
,
1827 if (rc
!= X86EMUL_CONTINUE
)
1836 return X86EMUL_CONTINUE
;
1839 static void toggle_interruptibility(struct x86_emulate_ctxt
*ctxt
, u32 mask
)
1841 u32 int_shadow
= kvm_x86_ops
->get_interrupt_shadow(ctxt
->vcpu
, mask
);
1843 * an sti; sti; sequence only disable interrupts for the first
1844 * instruction. So, if the last instruction, be it emulated or
1845 * not, left the system with the INT_STI flag enabled, it
1846 * means that the last instruction is an sti. We should not
1847 * leave the flag on in this case. The same goes for mov ss
1849 if (!(int_shadow
& mask
))
1850 ctxt
->interruptibility
= mask
;
1854 setup_syscalls_segments(struct x86_emulate_ctxt
*ctxt
,
1855 struct x86_emulate_ops
*ops
, struct desc_struct
*cs
,
1856 struct desc_struct
*ss
)
1858 memset(cs
, 0, sizeof(struct desc_struct
));
1859 ops
->get_cached_descriptor(cs
, VCPU_SREG_CS
, ctxt
->vcpu
);
1860 memset(ss
, 0, sizeof(struct desc_struct
));
1862 cs
->l
= 0; /* will be adjusted later */
1863 set_desc_base(cs
, 0); /* flat segment */
1864 cs
->g
= 1; /* 4kb granularity */
1865 set_desc_limit(cs
, 0xfffff); /* 4GB limit */
1866 cs
->type
= 0x0b; /* Read, Execute, Accessed */
1868 cs
->dpl
= 0; /* will be adjusted later */
1872 set_desc_base(ss
, 0); /* flat segment */
1873 set_desc_limit(ss
, 0xfffff); /* 4GB limit */
1874 ss
->g
= 1; /* 4kb granularity */
1876 ss
->type
= 0x03; /* Read/Write, Accessed */
1877 ss
->d
= 1; /* 32bit stack segment */
1883 emulate_syscall(struct x86_emulate_ctxt
*ctxt
, struct x86_emulate_ops
*ops
)
1885 struct decode_cache
*c
= &ctxt
->decode
;
1886 struct desc_struct cs
, ss
;
1890 /* syscall is not available in real mode */
1891 if (ctxt
->mode
== X86EMUL_MODE_REAL
||
1892 ctxt
->mode
== X86EMUL_MODE_VM86
) {
1893 kvm_queue_exception(ctxt
->vcpu
, UD_VECTOR
);
1894 return X86EMUL_PROPAGATE_FAULT
;
1897 setup_syscalls_segments(ctxt
, ops
, &cs
, &ss
);
1899 ops
->get_msr(ctxt
->vcpu
, MSR_STAR
, &msr_data
);
1901 cs_sel
= (u16
)(msr_data
& 0xfffc);
1902 ss_sel
= (u16
)(msr_data
+ 8);
1904 if (is_long_mode(ctxt
->vcpu
)) {
1908 ops
->set_cached_descriptor(&cs
, VCPU_SREG_CS
, ctxt
->vcpu
);
1909 ops
->set_segment_selector(cs_sel
, VCPU_SREG_CS
, ctxt
->vcpu
);
1910 ops
->set_cached_descriptor(&ss
, VCPU_SREG_SS
, ctxt
->vcpu
);
1911 ops
->set_segment_selector(ss_sel
, VCPU_SREG_SS
, ctxt
->vcpu
);
1913 c
->regs
[VCPU_REGS_RCX
] = c
->eip
;
1914 if (is_long_mode(ctxt
->vcpu
)) {
1915 #ifdef CONFIG_X86_64
1916 c
->regs
[VCPU_REGS_R11
] = ctxt
->eflags
& ~EFLG_RF
;
1918 ops
->get_msr(ctxt
->vcpu
,
1919 ctxt
->mode
== X86EMUL_MODE_PROT64
?
1920 MSR_LSTAR
: MSR_CSTAR
, &msr_data
);
1923 ops
->get_msr(ctxt
->vcpu
, MSR_SYSCALL_MASK
, &msr_data
);
1924 ctxt
->eflags
&= ~(msr_data
| EFLG_RF
);
1928 ops
->get_msr(ctxt
->vcpu
, MSR_STAR
, &msr_data
);
1929 c
->eip
= (u32
)msr_data
;
1931 ctxt
->eflags
&= ~(EFLG_VM
| EFLG_IF
| EFLG_RF
);
1934 return X86EMUL_CONTINUE
;
1938 emulate_sysenter(struct x86_emulate_ctxt
*ctxt
, struct x86_emulate_ops
*ops
)
1940 struct decode_cache
*c
= &ctxt
->decode
;
1941 struct desc_struct cs
, ss
;
1945 /* inject #GP if in real mode */
1946 if (ctxt
->mode
== X86EMUL_MODE_REAL
) {
1947 kvm_inject_gp(ctxt
->vcpu
, 0);
1948 return X86EMUL_PROPAGATE_FAULT
;
1951 /* XXX sysenter/sysexit have not been tested in 64bit mode.
1952 * Therefore, we inject an #UD.
1954 if (ctxt
->mode
== X86EMUL_MODE_PROT64
) {
1955 kvm_queue_exception(ctxt
->vcpu
, UD_VECTOR
);
1956 return X86EMUL_PROPAGATE_FAULT
;
1959 setup_syscalls_segments(ctxt
, ops
, &cs
, &ss
);
1961 ops
->get_msr(ctxt
->vcpu
, MSR_IA32_SYSENTER_CS
, &msr_data
);
1962 switch (ctxt
->mode
) {
1963 case X86EMUL_MODE_PROT32
:
1964 if ((msr_data
& 0xfffc) == 0x0) {
1965 kvm_inject_gp(ctxt
->vcpu
, 0);
1966 return X86EMUL_PROPAGATE_FAULT
;
1969 case X86EMUL_MODE_PROT64
:
1970 if (msr_data
== 0x0) {
1971 kvm_inject_gp(ctxt
->vcpu
, 0);
1972 return X86EMUL_PROPAGATE_FAULT
;
1977 ctxt
->eflags
&= ~(EFLG_VM
| EFLG_IF
| EFLG_RF
);
1978 cs_sel
= (u16
)msr_data
;
1979 cs_sel
&= ~SELECTOR_RPL_MASK
;
1980 ss_sel
= cs_sel
+ 8;
1981 ss_sel
&= ~SELECTOR_RPL_MASK
;
1982 if (ctxt
->mode
== X86EMUL_MODE_PROT64
1983 || is_long_mode(ctxt
->vcpu
)) {
1988 ops
->set_cached_descriptor(&cs
, VCPU_SREG_CS
, ctxt
->vcpu
);
1989 ops
->set_segment_selector(cs_sel
, VCPU_SREG_CS
, ctxt
->vcpu
);
1990 ops
->set_cached_descriptor(&ss
, VCPU_SREG_SS
, ctxt
->vcpu
);
1991 ops
->set_segment_selector(ss_sel
, VCPU_SREG_SS
, ctxt
->vcpu
);
1993 ops
->get_msr(ctxt
->vcpu
, MSR_IA32_SYSENTER_EIP
, &msr_data
);
1996 ops
->get_msr(ctxt
->vcpu
, MSR_IA32_SYSENTER_ESP
, &msr_data
);
1997 c
->regs
[VCPU_REGS_RSP
] = msr_data
;
1999 return X86EMUL_CONTINUE
;
2003 emulate_sysexit(struct x86_emulate_ctxt
*ctxt
, struct x86_emulate_ops
*ops
)
2005 struct decode_cache
*c
= &ctxt
->decode
;
2006 struct desc_struct cs
, ss
;
2011 /* inject #GP if in real mode or Virtual 8086 mode */
2012 if (ctxt
->mode
== X86EMUL_MODE_REAL
||
2013 ctxt
->mode
== X86EMUL_MODE_VM86
) {
2014 kvm_inject_gp(ctxt
->vcpu
, 0);
2015 return X86EMUL_PROPAGATE_FAULT
;
2018 setup_syscalls_segments(ctxt
, ops
, &cs
, &ss
);
2020 if ((c
->rex_prefix
& 0x8) != 0x0)
2021 usermode
= X86EMUL_MODE_PROT64
;
2023 usermode
= X86EMUL_MODE_PROT32
;
2027 ops
->get_msr(ctxt
->vcpu
, MSR_IA32_SYSENTER_CS
, &msr_data
);
2029 case X86EMUL_MODE_PROT32
:
2030 cs_sel
= (u16
)(msr_data
+ 16);
2031 if ((msr_data
& 0xfffc) == 0x0) {
2032 kvm_inject_gp(ctxt
->vcpu
, 0);
2033 return X86EMUL_PROPAGATE_FAULT
;
2035 ss_sel
= (u16
)(msr_data
+ 24);
2037 case X86EMUL_MODE_PROT64
:
2038 cs_sel
= (u16
)(msr_data
+ 32);
2039 if (msr_data
== 0x0) {
2040 kvm_inject_gp(ctxt
->vcpu
, 0);
2041 return X86EMUL_PROPAGATE_FAULT
;
2043 ss_sel
= cs_sel
+ 8;
2048 cs_sel
|= SELECTOR_RPL_MASK
;
2049 ss_sel
|= SELECTOR_RPL_MASK
;
2051 ops
->set_cached_descriptor(&cs
, VCPU_SREG_CS
, ctxt
->vcpu
);
2052 ops
->set_segment_selector(cs_sel
, VCPU_SREG_CS
, ctxt
->vcpu
);
2053 ops
->set_cached_descriptor(&ss
, VCPU_SREG_SS
, ctxt
->vcpu
);
2054 ops
->set_segment_selector(ss_sel
, VCPU_SREG_SS
, ctxt
->vcpu
);
2056 c
->eip
= ctxt
->vcpu
->arch
.regs
[VCPU_REGS_RDX
];
2057 c
->regs
[VCPU_REGS_RSP
] = ctxt
->vcpu
->arch
.regs
[VCPU_REGS_RCX
];
2059 return X86EMUL_CONTINUE
;
2062 static bool emulator_bad_iopl(struct x86_emulate_ctxt
*ctxt
,
2063 struct x86_emulate_ops
*ops
)
2066 if (ctxt
->mode
== X86EMUL_MODE_REAL
)
2068 if (ctxt
->mode
== X86EMUL_MODE_VM86
)
2070 iopl
= (ctxt
->eflags
& X86_EFLAGS_IOPL
) >> IOPL_SHIFT
;
2071 return ops
->cpl(ctxt
->vcpu
) > iopl
;
2074 static bool emulator_io_port_access_allowed(struct x86_emulate_ctxt
*ctxt
,
2075 struct x86_emulate_ops
*ops
,
2078 struct desc_struct tr_seg
;
2081 u8 perm
, bit_idx
= port
& 0x7;
2082 unsigned mask
= (1 << len
) - 1;
2084 ops
->get_cached_descriptor(&tr_seg
, VCPU_SREG_TR
, ctxt
->vcpu
);
2087 if (desc_limit_scaled(&tr_seg
) < 103)
2089 r
= ops
->read_std(get_desc_base(&tr_seg
) + 102, &io_bitmap_ptr
, 2,
2091 if (r
!= X86EMUL_CONTINUE
)
2093 if (io_bitmap_ptr
+ port
/8 > desc_limit_scaled(&tr_seg
))
2095 r
= ops
->read_std(get_desc_base(&tr_seg
) + io_bitmap_ptr
+ port
/8,
2096 &perm
, 1, ctxt
->vcpu
, NULL
);
2097 if (r
!= X86EMUL_CONTINUE
)
2099 if ((perm
>> bit_idx
) & mask
)
2104 static bool emulator_io_permited(struct x86_emulate_ctxt
*ctxt
,
2105 struct x86_emulate_ops
*ops
,
2108 if (emulator_bad_iopl(ctxt
, ops
))
2109 if (!emulator_io_port_access_allowed(ctxt
, ops
, port
, len
))
2114 static void save_state_to_tss16(struct x86_emulate_ctxt
*ctxt
,
2115 struct x86_emulate_ops
*ops
,
2116 struct tss_segment_16
*tss
)
2118 struct decode_cache
*c
= &ctxt
->decode
;
2121 tss
->flag
= ctxt
->eflags
;
2122 tss
->ax
= c
->regs
[VCPU_REGS_RAX
];
2123 tss
->cx
= c
->regs
[VCPU_REGS_RCX
];
2124 tss
->dx
= c
->regs
[VCPU_REGS_RDX
];
2125 tss
->bx
= c
->regs
[VCPU_REGS_RBX
];
2126 tss
->sp
= c
->regs
[VCPU_REGS_RSP
];
2127 tss
->bp
= c
->regs
[VCPU_REGS_RBP
];
2128 tss
->si
= c
->regs
[VCPU_REGS_RSI
];
2129 tss
->di
= c
->regs
[VCPU_REGS_RDI
];
2131 tss
->es
= ops
->get_segment_selector(VCPU_SREG_ES
, ctxt
->vcpu
);
2132 tss
->cs
= ops
->get_segment_selector(VCPU_SREG_CS
, ctxt
->vcpu
);
2133 tss
->ss
= ops
->get_segment_selector(VCPU_SREG_SS
, ctxt
->vcpu
);
2134 tss
->ds
= ops
->get_segment_selector(VCPU_SREG_DS
, ctxt
->vcpu
);
2135 tss
->ldt
= ops
->get_segment_selector(VCPU_SREG_LDTR
, ctxt
->vcpu
);
2138 static int load_state_from_tss16(struct x86_emulate_ctxt
*ctxt
,
2139 struct x86_emulate_ops
*ops
,
2140 struct tss_segment_16
*tss
)
2142 struct decode_cache
*c
= &ctxt
->decode
;
2146 ctxt
->eflags
= tss
->flag
| 2;
2147 c
->regs
[VCPU_REGS_RAX
] = tss
->ax
;
2148 c
->regs
[VCPU_REGS_RCX
] = tss
->cx
;
2149 c
->regs
[VCPU_REGS_RDX
] = tss
->dx
;
2150 c
->regs
[VCPU_REGS_RBX
] = tss
->bx
;
2151 c
->regs
[VCPU_REGS_RSP
] = tss
->sp
;
2152 c
->regs
[VCPU_REGS_RBP
] = tss
->bp
;
2153 c
->regs
[VCPU_REGS_RSI
] = tss
->si
;
2154 c
->regs
[VCPU_REGS_RDI
] = tss
->di
;
2157 * SDM says that segment selectors are loaded before segment
2160 ops
->set_segment_selector(tss
->ldt
, VCPU_SREG_LDTR
, ctxt
->vcpu
);
2161 ops
->set_segment_selector(tss
->es
, VCPU_SREG_ES
, ctxt
->vcpu
);
2162 ops
->set_segment_selector(tss
->cs
, VCPU_SREG_CS
, ctxt
->vcpu
);
2163 ops
->set_segment_selector(tss
->ss
, VCPU_SREG_SS
, ctxt
->vcpu
);
2164 ops
->set_segment_selector(tss
->ds
, VCPU_SREG_DS
, ctxt
->vcpu
);
2167 * Now load segment descriptors. If fault happenes at this stage
2168 * it is handled in a context of new task
2170 ret
= load_segment_descriptor(ctxt
, ops
, tss
->ldt
, VCPU_SREG_LDTR
);
2171 if (ret
!= X86EMUL_CONTINUE
)
2173 ret
= load_segment_descriptor(ctxt
, ops
, tss
->es
, VCPU_SREG_ES
);
2174 if (ret
!= X86EMUL_CONTINUE
)
2176 ret
= load_segment_descriptor(ctxt
, ops
, tss
->cs
, VCPU_SREG_CS
);
2177 if (ret
!= X86EMUL_CONTINUE
)
2179 ret
= load_segment_descriptor(ctxt
, ops
, tss
->ss
, VCPU_SREG_SS
);
2180 if (ret
!= X86EMUL_CONTINUE
)
2182 ret
= load_segment_descriptor(ctxt
, ops
, tss
->ds
, VCPU_SREG_DS
);
2183 if (ret
!= X86EMUL_CONTINUE
)
2186 return X86EMUL_CONTINUE
;
2189 static int task_switch_16(struct x86_emulate_ctxt
*ctxt
,
2190 struct x86_emulate_ops
*ops
,
2191 u16 tss_selector
, u16 old_tss_sel
,
2192 ulong old_tss_base
, struct desc_struct
*new_desc
)
2194 struct tss_segment_16 tss_seg
;
2196 u32 err
, new_tss_base
= get_desc_base(new_desc
);
2198 ret
= ops
->read_std(old_tss_base
, &tss_seg
, sizeof tss_seg
, ctxt
->vcpu
,
2200 if (ret
== X86EMUL_PROPAGATE_FAULT
) {
2201 /* FIXME: need to provide precise fault address */
2202 kvm_inject_page_fault(ctxt
->vcpu
, old_tss_base
, err
);
2206 save_state_to_tss16(ctxt
, ops
, &tss_seg
);
2208 ret
= ops
->write_std(old_tss_base
, &tss_seg
, sizeof tss_seg
, ctxt
->vcpu
,
2210 if (ret
== X86EMUL_PROPAGATE_FAULT
) {
2211 /* FIXME: need to provide precise fault address */
2212 kvm_inject_page_fault(ctxt
->vcpu
, old_tss_base
, err
);
2216 ret
= ops
->read_std(new_tss_base
, &tss_seg
, sizeof tss_seg
, ctxt
->vcpu
,
2218 if (ret
== X86EMUL_PROPAGATE_FAULT
) {
2219 /* FIXME: need to provide precise fault address */
2220 kvm_inject_page_fault(ctxt
->vcpu
, new_tss_base
, err
);
2224 if (old_tss_sel
!= 0xffff) {
2225 tss_seg
.prev_task_link
= old_tss_sel
;
2227 ret
= ops
->write_std(new_tss_base
,
2228 &tss_seg
.prev_task_link
,
2229 sizeof tss_seg
.prev_task_link
,
2231 if (ret
== X86EMUL_PROPAGATE_FAULT
) {
2232 /* FIXME: need to provide precise fault address */
2233 kvm_inject_page_fault(ctxt
->vcpu
, new_tss_base
, err
);
2238 return load_state_from_tss16(ctxt
, ops
, &tss_seg
);
2241 static void save_state_to_tss32(struct x86_emulate_ctxt
*ctxt
,
2242 struct x86_emulate_ops
*ops
,
2243 struct tss_segment_32
*tss
)
2245 struct decode_cache
*c
= &ctxt
->decode
;
2247 tss
->cr3
= ops
->get_cr(3, ctxt
->vcpu
);
2249 tss
->eflags
= ctxt
->eflags
;
2250 tss
->eax
= c
->regs
[VCPU_REGS_RAX
];
2251 tss
->ecx
= c
->regs
[VCPU_REGS_RCX
];
2252 tss
->edx
= c
->regs
[VCPU_REGS_RDX
];
2253 tss
->ebx
= c
->regs
[VCPU_REGS_RBX
];
2254 tss
->esp
= c
->regs
[VCPU_REGS_RSP
];
2255 tss
->ebp
= c
->regs
[VCPU_REGS_RBP
];
2256 tss
->esi
= c
->regs
[VCPU_REGS_RSI
];
2257 tss
->edi
= c
->regs
[VCPU_REGS_RDI
];
2259 tss
->es
= ops
->get_segment_selector(VCPU_SREG_ES
, ctxt
->vcpu
);
2260 tss
->cs
= ops
->get_segment_selector(VCPU_SREG_CS
, ctxt
->vcpu
);
2261 tss
->ss
= ops
->get_segment_selector(VCPU_SREG_SS
, ctxt
->vcpu
);
2262 tss
->ds
= ops
->get_segment_selector(VCPU_SREG_DS
, ctxt
->vcpu
);
2263 tss
->fs
= ops
->get_segment_selector(VCPU_SREG_FS
, ctxt
->vcpu
);
2264 tss
->gs
= ops
->get_segment_selector(VCPU_SREG_GS
, ctxt
->vcpu
);
2265 tss
->ldt_selector
= ops
->get_segment_selector(VCPU_SREG_LDTR
, ctxt
->vcpu
);
2268 static int load_state_from_tss32(struct x86_emulate_ctxt
*ctxt
,
2269 struct x86_emulate_ops
*ops
,
2270 struct tss_segment_32
*tss
)
2272 struct decode_cache
*c
= &ctxt
->decode
;
2275 if (ops
->set_cr(3, tss
->cr3
, ctxt
->vcpu
)) {
2276 kvm_inject_gp(ctxt
->vcpu
, 0);
2277 return X86EMUL_PROPAGATE_FAULT
;
2280 ctxt
->eflags
= tss
->eflags
| 2;
2281 c
->regs
[VCPU_REGS_RAX
] = tss
->eax
;
2282 c
->regs
[VCPU_REGS_RCX
] = tss
->ecx
;
2283 c
->regs
[VCPU_REGS_RDX
] = tss
->edx
;
2284 c
->regs
[VCPU_REGS_RBX
] = tss
->ebx
;
2285 c
->regs
[VCPU_REGS_RSP
] = tss
->esp
;
2286 c
->regs
[VCPU_REGS_RBP
] = tss
->ebp
;
2287 c
->regs
[VCPU_REGS_RSI
] = tss
->esi
;
2288 c
->regs
[VCPU_REGS_RDI
] = tss
->edi
;
2291 * SDM says that segment selectors are loaded before segment
2294 ops
->set_segment_selector(tss
->ldt_selector
, VCPU_SREG_LDTR
, ctxt
->vcpu
);
2295 ops
->set_segment_selector(tss
->es
, VCPU_SREG_ES
, ctxt
->vcpu
);
2296 ops
->set_segment_selector(tss
->cs
, VCPU_SREG_CS
, ctxt
->vcpu
);
2297 ops
->set_segment_selector(tss
->ss
, VCPU_SREG_SS
, ctxt
->vcpu
);
2298 ops
->set_segment_selector(tss
->ds
, VCPU_SREG_DS
, ctxt
->vcpu
);
2299 ops
->set_segment_selector(tss
->fs
, VCPU_SREG_FS
, ctxt
->vcpu
);
2300 ops
->set_segment_selector(tss
->gs
, VCPU_SREG_GS
, ctxt
->vcpu
);
2303 * Now load segment descriptors. If fault happenes at this stage
2304 * it is handled in a context of new task
2306 ret
= load_segment_descriptor(ctxt
, ops
, tss
->ldt_selector
, VCPU_SREG_LDTR
);
2307 if (ret
!= X86EMUL_CONTINUE
)
2309 ret
= load_segment_descriptor(ctxt
, ops
, tss
->es
, VCPU_SREG_ES
);
2310 if (ret
!= X86EMUL_CONTINUE
)
2312 ret
= load_segment_descriptor(ctxt
, ops
, tss
->cs
, VCPU_SREG_CS
);
2313 if (ret
!= X86EMUL_CONTINUE
)
2315 ret
= load_segment_descriptor(ctxt
, ops
, tss
->ss
, VCPU_SREG_SS
);
2316 if (ret
!= X86EMUL_CONTINUE
)
2318 ret
= load_segment_descriptor(ctxt
, ops
, tss
->ds
, VCPU_SREG_DS
);
2319 if (ret
!= X86EMUL_CONTINUE
)
2321 ret
= load_segment_descriptor(ctxt
, ops
, tss
->fs
, VCPU_SREG_FS
);
2322 if (ret
!= X86EMUL_CONTINUE
)
2324 ret
= load_segment_descriptor(ctxt
, ops
, tss
->gs
, VCPU_SREG_GS
);
2325 if (ret
!= X86EMUL_CONTINUE
)
2328 return X86EMUL_CONTINUE
;
2331 static int task_switch_32(struct x86_emulate_ctxt
*ctxt
,
2332 struct x86_emulate_ops
*ops
,
2333 u16 tss_selector
, u16 old_tss_sel
,
2334 ulong old_tss_base
, struct desc_struct
*new_desc
)
2336 struct tss_segment_32 tss_seg
;
2338 u32 err
, new_tss_base
= get_desc_base(new_desc
);
2340 ret
= ops
->read_std(old_tss_base
, &tss_seg
, sizeof tss_seg
, ctxt
->vcpu
,
2342 if (ret
== X86EMUL_PROPAGATE_FAULT
) {
2343 /* FIXME: need to provide precise fault address */
2344 kvm_inject_page_fault(ctxt
->vcpu
, old_tss_base
, err
);
2348 save_state_to_tss32(ctxt
, ops
, &tss_seg
);
2350 ret
= ops
->write_std(old_tss_base
, &tss_seg
, sizeof tss_seg
, ctxt
->vcpu
,
2352 if (ret
== X86EMUL_PROPAGATE_FAULT
) {
2353 /* FIXME: need to provide precise fault address */
2354 kvm_inject_page_fault(ctxt
->vcpu
, old_tss_base
, err
);
2358 ret
= ops
->read_std(new_tss_base
, &tss_seg
, sizeof tss_seg
, ctxt
->vcpu
,
2360 if (ret
== X86EMUL_PROPAGATE_FAULT
) {
2361 /* FIXME: need to provide precise fault address */
2362 kvm_inject_page_fault(ctxt
->vcpu
, new_tss_base
, err
);
2366 if (old_tss_sel
!= 0xffff) {
2367 tss_seg
.prev_task_link
= old_tss_sel
;
2369 ret
= ops
->write_std(new_tss_base
,
2370 &tss_seg
.prev_task_link
,
2371 sizeof tss_seg
.prev_task_link
,
2373 if (ret
== X86EMUL_PROPAGATE_FAULT
) {
2374 /* FIXME: need to provide precise fault address */
2375 kvm_inject_page_fault(ctxt
->vcpu
, new_tss_base
, err
);
2380 return load_state_from_tss32(ctxt
, ops
, &tss_seg
);
2383 static int emulator_do_task_switch(struct x86_emulate_ctxt
*ctxt
,
2384 struct x86_emulate_ops
*ops
,
2385 u16 tss_selector
, int reason
,
2386 bool has_error_code
, u32 error_code
)
2388 struct desc_struct curr_tss_desc
, next_tss_desc
;
2390 u16 old_tss_sel
= ops
->get_segment_selector(VCPU_SREG_TR
, ctxt
->vcpu
);
2391 ulong old_tss_base
=
2392 ops
->get_cached_segment_base(VCPU_SREG_TR
, ctxt
->vcpu
);
2395 /* FIXME: old_tss_base == ~0 ? */
2397 ret
= read_segment_descriptor(ctxt
, ops
, tss_selector
, &next_tss_desc
);
2398 if (ret
!= X86EMUL_CONTINUE
)
2400 ret
= read_segment_descriptor(ctxt
, ops
, old_tss_sel
, &curr_tss_desc
);
2401 if (ret
!= X86EMUL_CONTINUE
)
2404 /* FIXME: check that next_tss_desc is tss */
2406 if (reason
!= TASK_SWITCH_IRET
) {
2407 if ((tss_selector
& 3) > next_tss_desc
.dpl
||
2408 ops
->cpl(ctxt
->vcpu
) > next_tss_desc
.dpl
) {
2409 kvm_inject_gp(ctxt
->vcpu
, 0);
2410 return X86EMUL_PROPAGATE_FAULT
;
2414 desc_limit
= desc_limit_scaled(&next_tss_desc
);
2415 if (!next_tss_desc
.p
||
2416 ((desc_limit
< 0x67 && (next_tss_desc
.type
& 8)) ||
2417 desc_limit
< 0x2b)) {
2418 kvm_queue_exception_e(ctxt
->vcpu
, TS_VECTOR
,
2419 tss_selector
& 0xfffc);
2420 return X86EMUL_PROPAGATE_FAULT
;
2423 if (reason
== TASK_SWITCH_IRET
|| reason
== TASK_SWITCH_JMP
) {
2424 curr_tss_desc
.type
&= ~(1 << 1); /* clear busy flag */
2425 write_segment_descriptor(ctxt
, ops
, old_tss_sel
,
2429 if (reason
== TASK_SWITCH_IRET
)
2430 ctxt
->eflags
= ctxt
->eflags
& ~X86_EFLAGS_NT
;
2432 /* set back link to prev task only if NT bit is set in eflags
2433 note that old_tss_sel is not used afetr this point */
2434 if (reason
!= TASK_SWITCH_CALL
&& reason
!= TASK_SWITCH_GATE
)
2435 old_tss_sel
= 0xffff;
2437 if (next_tss_desc
.type
& 8)
2438 ret
= task_switch_32(ctxt
, ops
, tss_selector
, old_tss_sel
,
2439 old_tss_base
, &next_tss_desc
);
2441 ret
= task_switch_16(ctxt
, ops
, tss_selector
, old_tss_sel
,
2442 old_tss_base
, &next_tss_desc
);
2443 if (ret
!= X86EMUL_CONTINUE
)
2446 if (reason
== TASK_SWITCH_CALL
|| reason
== TASK_SWITCH_GATE
)
2447 ctxt
->eflags
= ctxt
->eflags
| X86_EFLAGS_NT
;
2449 if (reason
!= TASK_SWITCH_IRET
) {
2450 next_tss_desc
.type
|= (1 << 1); /* set busy flag */
2451 write_segment_descriptor(ctxt
, ops
, tss_selector
,
2455 ops
->set_cr(0, ops
->get_cr(0, ctxt
->vcpu
) | X86_CR0_TS
, ctxt
->vcpu
);
2456 ops
->set_cached_descriptor(&next_tss_desc
, VCPU_SREG_TR
, ctxt
->vcpu
);
2457 ops
->set_segment_selector(tss_selector
, VCPU_SREG_TR
, ctxt
->vcpu
);
2459 if (has_error_code
) {
2460 struct decode_cache
*c
= &ctxt
->decode
;
2462 c
->op_bytes
= c
->ad_bytes
= (next_tss_desc
.type
& 8) ? 4 : 2;
2464 c
->src
.val
= (unsigned long) error_code
;
2465 emulate_push(ctxt
, ops
);
2471 int emulator_task_switch(struct x86_emulate_ctxt
*ctxt
,
2472 struct x86_emulate_ops
*ops
,
2473 u16 tss_selector
, int reason
,
2474 bool has_error_code
, u32 error_code
)
2476 struct decode_cache
*c
= &ctxt
->decode
;
2479 memset(c
, 0, sizeof(struct decode_cache
));
2481 memcpy(c
->regs
, ctxt
->vcpu
->arch
.regs
, sizeof c
->regs
);
2482 c
->dst
.type
= OP_NONE
;
2484 rc
= emulator_do_task_switch(ctxt
, ops
, tss_selector
, reason
,
2485 has_error_code
, error_code
);
2487 if (rc
== X86EMUL_CONTINUE
) {
2488 memcpy(ctxt
->vcpu
->arch
.regs
, c
->regs
, sizeof c
->regs
);
2489 kvm_rip_write(ctxt
->vcpu
, c
->eip
);
2490 rc
= writeback(ctxt
, ops
);
2493 return (rc
== X86EMUL_UNHANDLEABLE
) ? -1 : 0;
2496 static void string_addr_inc(struct x86_emulate_ctxt
*ctxt
, unsigned long base
,
2497 int reg
, struct operand
*op
)
2499 struct decode_cache
*c
= &ctxt
->decode
;
2500 int df
= (ctxt
->eflags
& EFLG_DF
) ? -1 : 1;
2502 register_address_increment(c
, &c
->regs
[reg
], df
* op
->bytes
);
2503 op
->ptr
= (unsigned long *)register_address(c
, base
, c
->regs
[reg
]);
2507 x86_emulate_insn(struct x86_emulate_ctxt
*ctxt
, struct x86_emulate_ops
*ops
)
2510 struct decode_cache
*c
= &ctxt
->decode
;
2511 int rc
= X86EMUL_CONTINUE
;
2512 int saved_dst_type
= c
->dst
.type
;
2514 ctxt
->interruptibility
= 0;
2515 ctxt
->decode
.mem_read
.pos
= 0;
2517 /* Shadow copy of register state. Committed on successful emulation.
2518 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
2522 memcpy(c
->regs
, ctxt
->vcpu
->arch
.regs
, sizeof c
->regs
);
2524 if (ctxt
->mode
== X86EMUL_MODE_PROT64
&& (c
->d
& No64
)) {
2525 kvm_queue_exception(ctxt
->vcpu
, UD_VECTOR
);
2529 /* LOCK prefix is allowed only with some instructions */
2530 if (c
->lock_prefix
&& (!(c
->d
& Lock
) || c
->dst
.type
!= OP_MEM
)) {
2531 kvm_queue_exception(ctxt
->vcpu
, UD_VECTOR
);
2535 /* Privileged instruction can be executed only in CPL=0 */
2536 if ((c
->d
& Priv
) && ops
->cpl(ctxt
->vcpu
)) {
2537 kvm_inject_gp(ctxt
->vcpu
, 0);
2541 if (c
->rep_prefix
&& (c
->d
& String
)) {
2542 ctxt
->restart
= true;
2543 /* All REP prefixes have the same first termination condition */
2544 if (address_mask(c
, c
->regs
[VCPU_REGS_RCX
]) == 0) {
2546 ctxt
->restart
= false;
2547 kvm_rip_write(ctxt
->vcpu
, c
->eip
);
2550 /* The second termination condition only applies for REPE
2551 * and REPNE. Test if the repeat string operation prefix is
2552 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
2553 * corresponding termination condition according to:
2554 * - if REPE/REPZ and ZF = 0 then done
2555 * - if REPNE/REPNZ and ZF = 1 then done
2557 if ((c
->b
== 0xa6) || (c
->b
== 0xa7) ||
2558 (c
->b
== 0xae) || (c
->b
== 0xaf)) {
2559 if ((c
->rep_prefix
== REPE_PREFIX
) &&
2560 ((ctxt
->eflags
& EFLG_ZF
) == 0))
2562 if ((c
->rep_prefix
== REPNE_PREFIX
) &&
2563 ((ctxt
->eflags
& EFLG_ZF
) == EFLG_ZF
))
2569 if (c
->src
.type
== OP_MEM
) {
2570 rc
= read_emulated(ctxt
, ops
, (unsigned long)c
->src
.ptr
,
2571 c
->src
.valptr
, c
->src
.bytes
);
2572 if (rc
!= X86EMUL_CONTINUE
)
2574 c
->src
.orig_val
= c
->src
.val
;
2577 if (c
->src2
.type
== OP_MEM
) {
2578 rc
= read_emulated(ctxt
, ops
, (unsigned long)c
->src2
.ptr
,
2579 &c
->src2
.val
, c
->src2
.bytes
);
2580 if (rc
!= X86EMUL_CONTINUE
)
2584 if ((c
->d
& DstMask
) == ImplicitOps
)
2588 if ((c
->dst
.type
== OP_MEM
) && !(c
->d
& Mov
)) {
2589 /* optimisation - avoid slow emulated read if Mov */
2590 rc
= read_emulated(ctxt
, ops
, (unsigned long)c
->dst
.ptr
,
2591 &c
->dst
.val
, c
->dst
.bytes
);
2592 if (rc
!= X86EMUL_CONTINUE
)
2595 c
->dst
.orig_val
= c
->dst
.val
;
2605 emulate_2op_SrcV("add", c
->src
, c
->dst
, ctxt
->eflags
);
2607 case 0x06: /* push es */
2608 emulate_push_sreg(ctxt
, ops
, VCPU_SREG_ES
);
2610 case 0x07: /* pop es */
2611 rc
= emulate_pop_sreg(ctxt
, ops
, VCPU_SREG_ES
);
2612 if (rc
!= X86EMUL_CONTINUE
)
2617 emulate_2op_SrcV("or", c
->src
, c
->dst
, ctxt
->eflags
);
2619 case 0x0e: /* push cs */
2620 emulate_push_sreg(ctxt
, ops
, VCPU_SREG_CS
);
2624 emulate_2op_SrcV("adc", c
->src
, c
->dst
, ctxt
->eflags
);
2626 case 0x16: /* push ss */
2627 emulate_push_sreg(ctxt
, ops
, VCPU_SREG_SS
);
2629 case 0x17: /* pop ss */
2630 rc
= emulate_pop_sreg(ctxt
, ops
, VCPU_SREG_SS
);
2631 if (rc
!= X86EMUL_CONTINUE
)
2636 emulate_2op_SrcV("sbb", c
->src
, c
->dst
, ctxt
->eflags
);
2638 case 0x1e: /* push ds */
2639 emulate_push_sreg(ctxt
, ops
, VCPU_SREG_DS
);
2641 case 0x1f: /* pop ds */
2642 rc
= emulate_pop_sreg(ctxt
, ops
, VCPU_SREG_DS
);
2643 if (rc
!= X86EMUL_CONTINUE
)
2648 emulate_2op_SrcV("and", c
->src
, c
->dst
, ctxt
->eflags
);
2652 emulate_2op_SrcV("sub", c
->src
, c
->dst
, ctxt
->eflags
);
2656 emulate_2op_SrcV("xor", c
->src
, c
->dst
, ctxt
->eflags
);
2660 emulate_2op_SrcV("cmp", c
->src
, c
->dst
, ctxt
->eflags
);
2662 case 0x40 ... 0x47: /* inc r16/r32 */
2663 emulate_1op("inc", c
->dst
, ctxt
->eflags
);
2665 case 0x48 ... 0x4f: /* dec r16/r32 */
2666 emulate_1op("dec", c
->dst
, ctxt
->eflags
);
2668 case 0x50 ... 0x57: /* push reg */
2669 emulate_push(ctxt
, ops
);
2671 case 0x58 ... 0x5f: /* pop reg */
2673 rc
= emulate_pop(ctxt
, ops
, &c
->dst
.val
, c
->op_bytes
);
2674 if (rc
!= X86EMUL_CONTINUE
)
2677 case 0x60: /* pusha */
2678 emulate_pusha(ctxt
, ops
);
2680 case 0x61: /* popa */
2681 rc
= emulate_popa(ctxt
, ops
);
2682 if (rc
!= X86EMUL_CONTINUE
)
2685 case 0x63: /* movsxd */
2686 if (ctxt
->mode
!= X86EMUL_MODE_PROT64
)
2687 goto cannot_emulate
;
2688 c
->dst
.val
= (s32
) c
->src
.val
;
2690 case 0x68: /* push imm */
2691 case 0x6a: /* push imm8 */
2692 emulate_push(ctxt
, ops
);
2694 case 0x6c: /* insb */
2695 case 0x6d: /* insw/insd */
2696 c
->dst
.bytes
= min(c
->dst
.bytes
, 4u);
2697 if (!emulator_io_permited(ctxt
, ops
, c
->regs
[VCPU_REGS_RDX
],
2699 kvm_inject_gp(ctxt
->vcpu
, 0);
2702 if (!pio_in_emulated(ctxt
, ops
, c
->dst
.bytes
,
2703 c
->regs
[VCPU_REGS_RDX
], &c
->dst
.val
))
2704 goto done
; /* IO is needed, skip writeback */
2706 case 0x6e: /* outsb */
2707 case 0x6f: /* outsw/outsd */
2708 c
->src
.bytes
= min(c
->src
.bytes
, 4u);
2709 if (!emulator_io_permited(ctxt
, ops
, c
->regs
[VCPU_REGS_RDX
],
2711 kvm_inject_gp(ctxt
->vcpu
, 0);
2714 ops
->pio_out_emulated(c
->src
.bytes
, c
->regs
[VCPU_REGS_RDX
],
2715 &c
->src
.val
, 1, ctxt
->vcpu
);
2717 c
->dst
.type
= OP_NONE
; /* nothing to writeback */
2719 case 0x70 ... 0x7f: /* jcc (short) */
2720 if (test_cc(c
->b
, ctxt
->eflags
))
2721 jmp_rel(c
, c
->src
.val
);
2723 case 0x80 ... 0x83: /* Grp1 */
2724 switch (c
->modrm_reg
) {
2744 emulate_2op_SrcV("test", c
->src
, c
->dst
, ctxt
->eflags
);
2746 case 0x86 ... 0x87: /* xchg */
2748 /* Write back the register source. */
2749 switch (c
->dst
.bytes
) {
2751 *(u8
*) c
->src
.ptr
= (u8
) c
->dst
.val
;
2754 *(u16
*) c
->src
.ptr
= (u16
) c
->dst
.val
;
2757 *c
->src
.ptr
= (u32
) c
->dst
.val
;
2758 break; /* 64b reg: zero-extend */
2760 *c
->src
.ptr
= c
->dst
.val
;
2764 * Write back the memory destination with implicit LOCK
2767 c
->dst
.val
= c
->src
.val
;
2770 case 0x88 ... 0x8b: /* mov */
2772 case 0x8c: /* mov r/m, sreg */
2773 if (c
->modrm_reg
> VCPU_SREG_GS
) {
2774 kvm_queue_exception(ctxt
->vcpu
, UD_VECTOR
);
2777 c
->dst
.val
= ops
->get_segment_selector(c
->modrm_reg
, ctxt
->vcpu
);
2779 case 0x8d: /* lea r16/r32, m */
2780 c
->dst
.val
= c
->modrm_ea
;
2782 case 0x8e: { /* mov seg, r/m16 */
2787 if (c
->modrm_reg
== VCPU_SREG_CS
||
2788 c
->modrm_reg
> VCPU_SREG_GS
) {
2789 kvm_queue_exception(ctxt
->vcpu
, UD_VECTOR
);
2793 if (c
->modrm_reg
== VCPU_SREG_SS
)
2794 toggle_interruptibility(ctxt
, KVM_X86_SHADOW_INT_MOV_SS
);
2796 rc
= load_segment_descriptor(ctxt
, ops
, sel
, c
->modrm_reg
);
2798 c
->dst
.type
= OP_NONE
; /* Disable writeback. */
2801 case 0x8f: /* pop (sole member of Grp1a) */
2802 rc
= emulate_grp1a(ctxt
, ops
);
2803 if (rc
!= X86EMUL_CONTINUE
)
2806 case 0x90: /* nop / xchg r8,rax */
2807 if (c
->dst
.ptr
== (unsigned long *)&c
->regs
[VCPU_REGS_RAX
]) {
2808 c
->dst
.type
= OP_NONE
; /* nop */
2811 case 0x91 ... 0x97: /* xchg reg,rax */
2812 c
->src
.type
= OP_REG
;
2813 c
->src
.bytes
= c
->op_bytes
;
2814 c
->src
.ptr
= (unsigned long *) &c
->regs
[VCPU_REGS_RAX
];
2815 c
->src
.val
= *(c
->src
.ptr
);
2817 case 0x9c: /* pushf */
2818 c
->src
.val
= (unsigned long) ctxt
->eflags
;
2819 emulate_push(ctxt
, ops
);
2821 case 0x9d: /* popf */
2822 c
->dst
.type
= OP_REG
;
2823 c
->dst
.ptr
= (unsigned long *) &ctxt
->eflags
;
2824 c
->dst
.bytes
= c
->op_bytes
;
2825 rc
= emulate_popf(ctxt
, ops
, &c
->dst
.val
, c
->op_bytes
);
2826 if (rc
!= X86EMUL_CONTINUE
)
2829 case 0xa0 ... 0xa1: /* mov */
2830 c
->dst
.ptr
= (unsigned long *)&c
->regs
[VCPU_REGS_RAX
];
2831 c
->dst
.val
= c
->src
.val
;
2833 case 0xa2 ... 0xa3: /* mov */
2834 c
->dst
.val
= (unsigned long)c
->regs
[VCPU_REGS_RAX
];
2836 case 0xa4 ... 0xa5: /* movs */
2838 case 0xa6 ... 0xa7: /* cmps */
2839 c
->dst
.type
= OP_NONE
; /* Disable writeback. */
2840 DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c
->src
.ptr
, c
->dst
.ptr
);
2842 case 0xaa ... 0xab: /* stos */
2843 c
->dst
.val
= c
->regs
[VCPU_REGS_RAX
];
2845 case 0xac ... 0xad: /* lods */
2847 case 0xae ... 0xaf: /* scas */
2848 DPRINTF("Urk! I don't handle SCAS.\n");
2849 goto cannot_emulate
;
2850 case 0xb0 ... 0xbf: /* mov r, imm */
2855 case 0xc3: /* ret */
2856 c
->dst
.type
= OP_REG
;
2857 c
->dst
.ptr
= &c
->eip
;
2858 c
->dst
.bytes
= c
->op_bytes
;
2859 goto pop_instruction
;
2860 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
2862 c
->dst
.val
= c
->src
.val
;
2864 case 0xcb: /* ret far */
2865 rc
= emulate_ret_far(ctxt
, ops
);
2866 if (rc
!= X86EMUL_CONTINUE
)
2869 case 0xd0 ... 0xd1: /* Grp2 */
2873 case 0xd2 ... 0xd3: /* Grp2 */
2874 c
->src
.val
= c
->regs
[VCPU_REGS_RCX
];
2877 case 0xe4: /* inb */
2880 case 0xe6: /* outb */
2881 case 0xe7: /* out */
2883 case 0xe8: /* call (near) */ {
2884 long int rel
= c
->src
.val
;
2885 c
->src
.val
= (unsigned long) c
->eip
;
2887 emulate_push(ctxt
, ops
);
2890 case 0xe9: /* jmp rel */
2892 case 0xea: { /* jmp far */
2895 memcpy(&sel
, c
->src
.valptr
+ c
->op_bytes
, 2);
2897 if (load_segment_descriptor(ctxt
, ops
, sel
, VCPU_SREG_CS
))
2901 memcpy(&c
->eip
, c
->src
.valptr
, c
->op_bytes
);
2905 jmp
: /* jmp rel short */
2906 jmp_rel(c
, c
->src
.val
);
2907 c
->dst
.type
= OP_NONE
; /* Disable writeback. */
2909 case 0xec: /* in al,dx */
2910 case 0xed: /* in (e/r)ax,dx */
2911 c
->src
.val
= c
->regs
[VCPU_REGS_RDX
];
2913 c
->dst
.bytes
= min(c
->dst
.bytes
, 4u);
2914 if (!emulator_io_permited(ctxt
, ops
, c
->src
.val
, c
->dst
.bytes
)) {
2915 kvm_inject_gp(ctxt
->vcpu
, 0);
2918 if (!pio_in_emulated(ctxt
, ops
, c
->dst
.bytes
, c
->src
.val
,
2920 goto done
; /* IO is needed */
2922 case 0xee: /* out al,dx */
2923 case 0xef: /* out (e/r)ax,dx */
2924 c
->src
.val
= c
->regs
[VCPU_REGS_RDX
];
2926 c
->dst
.bytes
= min(c
->dst
.bytes
, 4u);
2927 if (!emulator_io_permited(ctxt
, ops
, c
->src
.val
, c
->dst
.bytes
)) {
2928 kvm_inject_gp(ctxt
->vcpu
, 0);
2931 ops
->pio_out_emulated(c
->dst
.bytes
, c
->src
.val
, &c
->dst
.val
, 1,
2933 c
->dst
.type
= OP_NONE
; /* Disable writeback. */
2935 case 0xf4: /* hlt */
2936 ctxt
->vcpu
->arch
.halt_request
= 1;
2938 case 0xf5: /* cmc */
2939 /* complement carry flag from eflags reg */
2940 ctxt
->eflags
^= EFLG_CF
;
2941 c
->dst
.type
= OP_NONE
; /* Disable writeback. */
2943 case 0xf6 ... 0xf7: /* Grp3 */
2944 if (!emulate_grp3(ctxt
, ops
))
2945 goto cannot_emulate
;
2947 case 0xf8: /* clc */
2948 ctxt
->eflags
&= ~EFLG_CF
;
2949 c
->dst
.type
= OP_NONE
; /* Disable writeback. */
2951 case 0xfa: /* cli */
2952 if (emulator_bad_iopl(ctxt
, ops
))
2953 kvm_inject_gp(ctxt
->vcpu
, 0);
2955 ctxt
->eflags
&= ~X86_EFLAGS_IF
;
2956 c
->dst
.type
= OP_NONE
; /* Disable writeback. */
2959 case 0xfb: /* sti */
2960 if (emulator_bad_iopl(ctxt
, ops
))
2961 kvm_inject_gp(ctxt
->vcpu
, 0);
2963 toggle_interruptibility(ctxt
, KVM_X86_SHADOW_INT_STI
);
2964 ctxt
->eflags
|= X86_EFLAGS_IF
;
2965 c
->dst
.type
= OP_NONE
; /* Disable writeback. */
2968 case 0xfc: /* cld */
2969 ctxt
->eflags
&= ~EFLG_DF
;
2970 c
->dst
.type
= OP_NONE
; /* Disable writeback. */
2972 case 0xfd: /* std */
2973 ctxt
->eflags
|= EFLG_DF
;
2974 c
->dst
.type
= OP_NONE
; /* Disable writeback. */
2976 case 0xfe: /* Grp4 */
2978 rc
= emulate_grp45(ctxt
, ops
);
2979 if (rc
!= X86EMUL_CONTINUE
)
2982 case 0xff: /* Grp5 */
2983 if (c
->modrm_reg
== 5)
2989 rc
= writeback(ctxt
, ops
);
2990 if (rc
!= X86EMUL_CONTINUE
)
2994 * restore dst type in case the decoding will be reused
2995 * (happens for string instruction )
2997 c
->dst
.type
= saved_dst_type
;
2999 if ((c
->d
& SrcMask
) == SrcSI
)
3000 string_addr_inc(ctxt
, seg_override_base(ctxt
, ops
, c
),
3001 VCPU_REGS_RSI
, &c
->src
);
3003 if ((c
->d
& DstMask
) == DstDI
)
3004 string_addr_inc(ctxt
, es_base(ctxt
, ops
), VCPU_REGS_RDI
,
3007 if (c
->rep_prefix
&& (c
->d
& String
)) {
3008 struct read_cache
*rc
= &ctxt
->decode
.io_read
;
3009 register_address_increment(c
, &c
->regs
[VCPU_REGS_RCX
], -1);
3011 * Re-enter guest when pio read ahead buffer is empty or,
3012 * if it is not used, after each 1024 iteration.
3014 if ((rc
->end
== 0 && !(c
->regs
[VCPU_REGS_RCX
] & 0x3ff)) ||
3015 (rc
->end
!= 0 && rc
->end
== rc
->pos
))
3016 ctxt
->restart
= false;
3019 * reset read cache here in case string instruction is restared
3022 ctxt
->decode
.mem_read
.end
= 0;
3023 /* Commit shadow register state. */
3024 memcpy(ctxt
->vcpu
->arch
.regs
, c
->regs
, sizeof c
->regs
);
3025 kvm_rip_write(ctxt
->vcpu
, c
->eip
);
3026 ops
->set_rflags(ctxt
->vcpu
, ctxt
->eflags
);
3029 return (rc
== X86EMUL_UNHANDLEABLE
) ? -1 : 0;
3033 case 0x01: /* lgdt, lidt, lmsw */
3034 switch (c
->modrm_reg
) {
3036 unsigned long address
;
3038 case 0: /* vmcall */
3039 if (c
->modrm_mod
!= 3 || c
->modrm_rm
!= 1)
3040 goto cannot_emulate
;
3042 rc
= kvm_fix_hypercall(ctxt
->vcpu
);
3043 if (rc
!= X86EMUL_CONTINUE
)
3046 /* Let the processor re-execute the fixed hypercall */
3048 /* Disable writeback. */
3049 c
->dst
.type
= OP_NONE
;
3052 rc
= read_descriptor(ctxt
, ops
, c
->src
.ptr
,
3053 &size
, &address
, c
->op_bytes
);
3054 if (rc
!= X86EMUL_CONTINUE
)
3056 realmode_lgdt(ctxt
->vcpu
, size
, address
);
3057 /* Disable writeback. */
3058 c
->dst
.type
= OP_NONE
;
3060 case 3: /* lidt/vmmcall */
3061 if (c
->modrm_mod
== 3) {
3062 switch (c
->modrm_rm
) {
3064 rc
= kvm_fix_hypercall(ctxt
->vcpu
);
3065 if (rc
!= X86EMUL_CONTINUE
)
3069 goto cannot_emulate
;
3072 rc
= read_descriptor(ctxt
, ops
, c
->src
.ptr
,
3075 if (rc
!= X86EMUL_CONTINUE
)
3077 realmode_lidt(ctxt
->vcpu
, size
, address
);
3079 /* Disable writeback. */
3080 c
->dst
.type
= OP_NONE
;
3084 c
->dst
.val
= ops
->get_cr(0, ctxt
->vcpu
);
3087 ops
->set_cr(0, (ops
->get_cr(0, ctxt
->vcpu
) & ~0x0ful
) |
3088 (c
->src
.val
& 0x0f), ctxt
->vcpu
);
3089 c
->dst
.type
= OP_NONE
;
3091 case 5: /* not defined */
3092 kvm_queue_exception(ctxt
->vcpu
, UD_VECTOR
);
3095 emulate_invlpg(ctxt
->vcpu
, c
->modrm_ea
);
3096 /* Disable writeback. */
3097 c
->dst
.type
= OP_NONE
;
3100 goto cannot_emulate
;
3103 case 0x05: /* syscall */
3104 rc
= emulate_syscall(ctxt
, ops
);
3105 if (rc
!= X86EMUL_CONTINUE
)
3111 emulate_clts(ctxt
->vcpu
);
3112 c
->dst
.type
= OP_NONE
;
3114 case 0x08: /* invd */
3115 case 0x09: /* wbinvd */
3116 case 0x0d: /* GrpP (prefetch) */
3117 case 0x18: /* Grp16 (prefetch/nop) */
3118 c
->dst
.type
= OP_NONE
;
3120 case 0x20: /* mov cr, reg */
3121 switch (c
->modrm_reg
) {
3125 kvm_queue_exception(ctxt
->vcpu
, UD_VECTOR
);
3128 c
->regs
[c
->modrm_rm
] = ops
->get_cr(c
->modrm_reg
, ctxt
->vcpu
);
3129 c
->dst
.type
= OP_NONE
; /* no writeback */
3131 case 0x21: /* mov from dr to reg */
3132 if ((ops
->get_cr(4, ctxt
->vcpu
) & X86_CR4_DE
) &&
3133 (c
->modrm_reg
== 4 || c
->modrm_reg
== 5)) {
3134 kvm_queue_exception(ctxt
->vcpu
, UD_VECTOR
);
3137 ops
->get_dr(c
->modrm_reg
, &c
->regs
[c
->modrm_rm
], ctxt
->vcpu
);
3138 c
->dst
.type
= OP_NONE
; /* no writeback */
3140 case 0x22: /* mov reg, cr */
3141 if (ops
->set_cr(c
->modrm_reg
, c
->modrm_val
, ctxt
->vcpu
)) {
3142 kvm_inject_gp(ctxt
->vcpu
, 0);
3145 c
->dst
.type
= OP_NONE
;
3147 case 0x23: /* mov from reg to dr */
3148 if ((ops
->get_cr(4, ctxt
->vcpu
) & X86_CR4_DE
) &&
3149 (c
->modrm_reg
== 4 || c
->modrm_reg
== 5)) {
3150 kvm_queue_exception(ctxt
->vcpu
, UD_VECTOR
);
3154 if (ops
->set_dr(c
->modrm_reg
, c
->regs
[c
->modrm_rm
] &
3155 ((ctxt
->mode
== X86EMUL_MODE_PROT64
) ?
3156 ~0ULL : ~0U), ctxt
->vcpu
) < 0) {
3157 /* #UD condition is already handled by the code above */
3158 kvm_inject_gp(ctxt
->vcpu
, 0);
3162 c
->dst
.type
= OP_NONE
; /* no writeback */
3166 msr_data
= (u32
)c
->regs
[VCPU_REGS_RAX
]
3167 | ((u64
)c
->regs
[VCPU_REGS_RDX
] << 32);
3168 if (ops
->set_msr(ctxt
->vcpu
, c
->regs
[VCPU_REGS_RCX
], msr_data
)) {
3169 kvm_inject_gp(ctxt
->vcpu
, 0);
3172 rc
= X86EMUL_CONTINUE
;
3173 c
->dst
.type
= OP_NONE
;
3177 if (ops
->get_msr(ctxt
->vcpu
, c
->regs
[VCPU_REGS_RCX
], &msr_data
)) {
3178 kvm_inject_gp(ctxt
->vcpu
, 0);
3181 c
->regs
[VCPU_REGS_RAX
] = (u32
)msr_data
;
3182 c
->regs
[VCPU_REGS_RDX
] = msr_data
>> 32;
3184 rc
= X86EMUL_CONTINUE
;
3185 c
->dst
.type
= OP_NONE
;
3187 case 0x34: /* sysenter */
3188 rc
= emulate_sysenter(ctxt
, ops
);
3189 if (rc
!= X86EMUL_CONTINUE
)
3194 case 0x35: /* sysexit */
3195 rc
= emulate_sysexit(ctxt
, ops
);
3196 if (rc
!= X86EMUL_CONTINUE
)
3201 case 0x40 ... 0x4f: /* cmov */
3202 c
->dst
.val
= c
->dst
.orig_val
= c
->src
.val
;
3203 if (!test_cc(c
->b
, ctxt
->eflags
))
3204 c
->dst
.type
= OP_NONE
; /* no writeback */
3206 case 0x80 ... 0x8f: /* jnz rel, etc*/
3207 if (test_cc(c
->b
, ctxt
->eflags
))
3208 jmp_rel(c
, c
->src
.val
);
3209 c
->dst
.type
= OP_NONE
;
3211 case 0xa0: /* push fs */
3212 emulate_push_sreg(ctxt
, ops
, VCPU_SREG_FS
);
3214 case 0xa1: /* pop fs */
3215 rc
= emulate_pop_sreg(ctxt
, ops
, VCPU_SREG_FS
);
3216 if (rc
!= X86EMUL_CONTINUE
)
3221 c
->dst
.type
= OP_NONE
;
3222 /* only subword offset */
3223 c
->src
.val
&= (c
->dst
.bytes
<< 3) - 1;
3224 emulate_2op_SrcV_nobyte("bt", c
->src
, c
->dst
, ctxt
->eflags
);
3226 case 0xa4: /* shld imm8, r, r/m */
3227 case 0xa5: /* shld cl, r, r/m */
3228 emulate_2op_cl("shld", c
->src2
, c
->src
, c
->dst
, ctxt
->eflags
);
3230 case 0xa8: /* push gs */
3231 emulate_push_sreg(ctxt
, ops
, VCPU_SREG_GS
);
3233 case 0xa9: /* pop gs */
3234 rc
= emulate_pop_sreg(ctxt
, ops
, VCPU_SREG_GS
);
3235 if (rc
!= X86EMUL_CONTINUE
)
3240 /* only subword offset */
3241 c
->src
.val
&= (c
->dst
.bytes
<< 3) - 1;
3242 emulate_2op_SrcV_nobyte("bts", c
->src
, c
->dst
, ctxt
->eflags
);
3244 case 0xac: /* shrd imm8, r, r/m */
3245 case 0xad: /* shrd cl, r, r/m */
3246 emulate_2op_cl("shrd", c
->src2
, c
->src
, c
->dst
, ctxt
->eflags
);
3248 case 0xae: /* clflush */
3250 case 0xb0 ... 0xb1: /* cmpxchg */
3252 * Save real source value, then compare EAX against
3255 c
->src
.orig_val
= c
->src
.val
;
3256 c
->src
.val
= c
->regs
[VCPU_REGS_RAX
];
3257 emulate_2op_SrcV("cmp", c
->src
, c
->dst
, ctxt
->eflags
);
3258 if (ctxt
->eflags
& EFLG_ZF
) {
3259 /* Success: write back to memory. */
3260 c
->dst
.val
= c
->src
.orig_val
;
3262 /* Failure: write the value we saw to EAX. */
3263 c
->dst
.type
= OP_REG
;
3264 c
->dst
.ptr
= (unsigned long *)&c
->regs
[VCPU_REGS_RAX
];
3269 /* only subword offset */
3270 c
->src
.val
&= (c
->dst
.bytes
<< 3) - 1;
3271 emulate_2op_SrcV_nobyte("btr", c
->src
, c
->dst
, ctxt
->eflags
);
3273 case 0xb6 ... 0xb7: /* movzx */
3274 c
->dst
.bytes
= c
->op_bytes
;
3275 c
->dst
.val
= (c
->d
& ByteOp
) ? (u8
) c
->src
.val
3278 case 0xba: /* Grp8 */
3279 switch (c
->modrm_reg
& 3) {
3292 /* only subword offset */
3293 c
->src
.val
&= (c
->dst
.bytes
<< 3) - 1;
3294 emulate_2op_SrcV_nobyte("btc", c
->src
, c
->dst
, ctxt
->eflags
);
3296 case 0xbe ... 0xbf: /* movsx */
3297 c
->dst
.bytes
= c
->op_bytes
;
3298 c
->dst
.val
= (c
->d
& ByteOp
) ? (s8
) c
->src
.val
:
3301 case 0xc3: /* movnti */
3302 c
->dst
.bytes
= c
->op_bytes
;
3303 c
->dst
.val
= (c
->op_bytes
== 4) ? (u32
) c
->src
.val
:
3306 case 0xc7: /* Grp9 (cmpxchg8b) */
3307 rc
= emulate_grp9(ctxt
, ops
);
3308 if (rc
!= X86EMUL_CONTINUE
)
3315 DPRINTF("Cannot emulate %02x\n", c
->b
);