]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - drivers/kvm/x86_emulate.c
projects / mirror_ubuntu-bionic-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
KVM: Portability: Move kvm{pic,ioapic} accesors to x86 specific code
[mirror_ubuntu-bionic-kernel.git] / drivers / kvm / x86_emulate.c
CommitLineData
6aa8b732
AK		 1/******************************************************************************
2 * x86_emulate.c
3 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
dcc0766b 9 * privileged instructions:
6aa8b732
AK		 10 *
11 * Copyright (C) 2006 Qumranet
12 *
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
15 *
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
18 *
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
20 */
21
22#ifndef __KERNEL__
23#include <stdio.h>
24#include <stdint.h>
25#include <public/xen.h>
d77c26fc 26#define DPRINTF(_f, _a ...) printf(_f , ## _a)
6aa8b732
AK		 27#else
28#include "kvm.h"
34c16eec 29#include "x86.h"
6aa8b732
AK		 30#define DPRINTF(x...) do {} while (0)
31#endif
32#include "x86_emulate.h"
33#include <linux/module.h>
34
35/*
36 * Opcode effective-address decode tables.
37 * Note that we only emulate instructions that have at least one memory
38 * operand (excluding implicit stack references). We assume that stack
39 * references and instruction fetches will never occur in special memory
40 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
41 * not be handled.
42 */
43
44/* Operand sizes: 8-bit operands or specified/overridden size. */
45#define ByteOp (1<<0) /* 8-bit operands. */
46/* Destination operand type. */
47#define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
48#define DstReg (2<<1) /* Register operand. */
49#define DstMem (3<<1) /* Memory operand. */
50#define DstMask (3<<1)
51/* Source operand type. */
52#define SrcNone (0<<3) /* No source operand. */
53#define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
54#define SrcReg (1<<3) /* Register operand. */
55#define SrcMem (2<<3) /* Memory operand. */
56#define SrcMem16 (3<<3) /* Memory operand (16-bit). */
57#define SrcMem32 (4<<3) /* Memory operand (32-bit). */
58#define SrcImm (5<<3) /* Immediate operand. */
59#define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
60#define SrcMask (7<<3)
61/* Generic ModRM decode. */
62#define ModRM (1<<6)
63/* Destination is only written; never read. */
64#define Mov (1<<7)
038e51de 65#define BitOp (1<<8)
c7e75a3d 66#define MemAbs (1<<9) /* Memory operand is absolute displacement */
b9fa9d6b 67#define String (1<<10) /* String instruction (rep capable) */
6e3d5dfb 68#define Stack (1<<11) /* Stack instruction (push/pop) */
6aa8b732 69
c7e75a3d 70static u16 opcode_table[256] = {
6aa8b732
AK		 71 /* 0x00 - 0x07 */
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
74 0, 0, 0, 0,
75 /* 0x08 - 0x0F */
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
78 0, 0, 0, 0,
79 /* 0x10 - 0x17 */
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
82 0, 0, 0, 0,
83 /* 0x18 - 0x1F */
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 0, 0, 0, 0,
87 /* 0x20 - 0x27 */
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
19eb938e 90 SrcImmByte, SrcImm, 0, 0,
6aa8b732
AK		 91 /* 0x28 - 0x2F */
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
94 0, 0, 0, 0,
95 /* 0x30 - 0x37 */
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
98 0, 0, 0, 0,
99 /* 0x38 - 0x3F */
100 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
101 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
102 0, 0, 0, 0,
d77a2507 103 /* 0x40 - 0x47 */
33615aa9 104 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
d77a2507 105 /* 0x48 - 0x4F */
33615aa9 106 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
7f0aaee0 107 /* 0x50 - 0x57 */
6e3d5dfb
AK		 108 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
109 SrcReg | Stack, SrcReg | Stack, SrcReg | Stack, SrcReg | Stack,
7f0aaee0 110 /* 0x58 - 0x5F */
6e3d5dfb
AK		 111 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
112 DstReg | Stack, DstReg | Stack, DstReg | Stack, DstReg | Stack,
7d316911 113 /* 0x60 - 0x67 */
6aa8b732 114 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
7d316911
NK		 115 0, 0, 0, 0,
116 /* 0x68 - 0x6F */
6e3d5dfb 117 0, 0, ImplicitOps | Mov | Stack, 0,
e70669ab
LV		 118 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
119 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
55bebde4
NK		 120 /* 0x70 - 0x77 */
121 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
122 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
123 /* 0x78 - 0x7F */
124 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
125 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
6aa8b732
AK		 126 /* 0x80 - 0x87 */
127 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
128 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
129 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
130 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
131 /* 0x88 - 0x8F */
132 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
133 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
6e3d5dfb 134 0, ModRM | DstReg, 0, DstMem | SrcNone | ModRM | Mov | Stack,
6aa8b732 135 /* 0x90 - 0x9F */
6e3d5dfb
AK		 136 0, 0, 0, 0, 0, 0, 0, 0,
137 0, 0, 0, 0, ImplicitOps | Stack, ImplicitOps | Stack, 0, 0,
6aa8b732 138 /* 0xA0 - 0xA7 */
c7e75a3d
AK		 139 ByteOp | DstReg | SrcMem | Mov | MemAbs, DstReg | SrcMem | Mov | MemAbs,
140 ByteOp | DstMem | SrcReg | Mov | MemAbs, DstMem | SrcReg | Mov | MemAbs,
b9fa9d6b
AK		 141 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
142 ByteOp | ImplicitOps | String, ImplicitOps | String,
6aa8b732 143 /* 0xA8 - 0xAF */
b9fa9d6b
AK		 144 0, 0, ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
145 ByteOp | ImplicitOps | Mov | String, ImplicitOps | Mov | String,
146 ByteOp | ImplicitOps | String, ImplicitOps | String,
6aa8b732
AK		 147 /* 0xB0 - 0xBF */
148 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
149 /* 0xC0 - 0xC7 */
d9413cd7 150 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
6e3d5dfb 151 0, ImplicitOps | Stack, 0, 0,
d9413cd7 152 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
6aa8b732
AK		 153 /* 0xC8 - 0xCF */
154 0, 0, 0, 0, 0, 0, 0, 0,
155 /* 0xD0 - 0xD7 */
156 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
157 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
158 0, 0, 0, 0,
159 /* 0xD8 - 0xDF */
160 0, 0, 0, 0, 0, 0, 0, 0,
098c937b
NK		 161 /* 0xE0 - 0xE7 */
162 0, 0, 0, 0, 0, 0, 0, 0,
163 /* 0xE8 - 0xEF */
6e3d5dfb
AK		 164 ImplicitOps | Stack, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps,
165 0, 0, 0, 0,
6aa8b732
AK		 166 /* 0xF0 - 0xF7 */
167 0, 0, 0, 0,
b284be57 168 ImplicitOps, ImplicitOps,
72d6e5a0 169 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
6aa8b732 170 /* 0xF8 - 0xFF */
b284be57 171 ImplicitOps, 0, ImplicitOps, ImplicitOps,
6aa8b732
AK		 172 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
173};
174
038e51de 175static u16 twobyte_table[256] = {
6aa8b732
AK		 176 /* 0x00 - 0x0F */
177 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
651a3e29 178 ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
6aa8b732
AK		 179 /* 0x10 - 0x1F */
180 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
181 /* 0x20 - 0x2F */
182 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
183 0, 0, 0, 0, 0, 0, 0, 0,
184 /* 0x30 - 0x3F */
35f3f286 185 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
6aa8b732
AK		 186 /* 0x40 - 0x47 */
187 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
188 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
189 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
190 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
191 /* 0x48 - 0x4F */
192 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
193 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
194 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
195 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
196 /* 0x50 - 0x5F */
197 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
198 /* 0x60 - 0x6F */
199 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
200 /* 0x70 - 0x7F */
201 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
202 /* 0x80 - 0x8F */
bbe9abbd
NK		 203 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
204 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
205 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
206 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
6aa8b732
AK		 207 /* 0x90 - 0x9F */
208 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
209 /* 0xA0 - 0xA7 */
038e51de 210 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732 211 /* 0xA8 - 0xAF */
038e51de 212 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732
AK		 213 /* 0xB0 - 0xB7 */
214 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
038e51de 215 DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 216 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
217 DstReg | SrcMem16 | ModRM | Mov,
218 /* 0xB8 - 0xBF */
038e51de 219 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 220 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
221 DstReg | SrcMem16 | ModRM | Mov,
222 /* 0xC0 - 0xCF */
a012e65a
SY		 223 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
224 0, 0, 0, 0, 0, 0, 0, 0,
6aa8b732
AK		 225 /* 0xD0 - 0xDF */
226 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
227 /* 0xE0 - 0xEF */
228 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
229 /* 0xF0 - 0xFF */
230 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
231};
232
6aa8b732
AK		 233/* EFLAGS bit definitions. */
234#define EFLG_OF (1<<11)
235#define EFLG_DF (1<<10)
236#define EFLG_SF (1<<7)
237#define EFLG_ZF (1<<6)
238#define EFLG_AF (1<<4)
239#define EFLG_PF (1<<2)
240#define EFLG_CF (1<<0)
241
242/*
243 * Instruction emulation:
244 * Most instructions are emulated directly via a fragment of inline assembly
245 * code. This allows us to save/restore EFLAGS and thus very easily pick up
246 * any modified flags.
247 */
248
05b3e0c2 249#if defined(CONFIG_X86_64)
6aa8b732
AK		 250#define _LO32 "k" /* force 32-bit operand */
251#define _STK "%%rsp" /* stack pointer */
252#elif defined(__i386__)
253#define _LO32 "" /* force 32-bit operand */
254#define _STK "%%esp" /* stack pointer */
255#endif
256
257/*
258 * These EFLAGS bits are restored from saved value during emulation, and
259 * any changes are written back to the saved value after emulation.
260 */
261#define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
262
263/* Before executing instruction: restore necessary bits in EFLAGS. */
e934c9c1
AK		 264#define _PRE_EFLAGS(_sav, _msk, _tmp) \
265 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
266 "movl %"_sav",%"_LO32 _tmp"; " \
267 "push %"_tmp"; " \
268 "push %"_tmp"; " \
269 "movl %"_msk",%"_LO32 _tmp"; " \
270 "andl %"_LO32 _tmp",("_STK"); " \
271 "pushf; " \
272 "notl %"_LO32 _tmp"; " \
273 "andl %"_LO32 _tmp",("_STK"); " \
274 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
275 "pop %"_tmp"; " \
276 "orl %"_LO32 _tmp",("_STK"); " \
277 "popf; " \
278 "pop %"_sav"; "
6aa8b732
AK		 279
280/* After executing instruction: write-back necessary bits in EFLAGS. */
281#define _POST_EFLAGS(_sav, _msk, _tmp) \
282 /* _sav |= EFLAGS & _msk; */ \
283 "pushf; " \
284 "pop %"_tmp"; " \
285 "andl %"_msk",%"_LO32 _tmp"; " \
286 "orl %"_LO32 _tmp",%"_sav"; "
287
288/* Raw emulation: instruction has two explicit operands. */
289#define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
290 do { \
291 unsigned long _tmp; \
292 \
293 switch ((_dst).bytes) { \
294 case 2: \
295 __asm__ __volatile__ ( \
d77c26fc 296 _PRE_EFLAGS("0", "4", "2") \
6aa8b732 297 _op"w %"_wx"3,%1; " \
d77c26fc 298 _POST_EFLAGS("0", "4", "2") \
6aa8b732
AK		 299 : "=m" (_eflags), "=m" ((_dst).val), \
300 "=&r" (_tmp) \
d77c26fc 301 : _wy ((_src).val), "i" (EFLAGS_MASK)); \
6aa8b732
AK		 302 break; \
303 case 4: \
304 __asm__ __volatile__ ( \
d77c26fc 305 _PRE_EFLAGS("0", "4", "2") \
6aa8b732 306 _op"l %"_lx"3,%1; " \
d77c26fc 307 _POST_EFLAGS("0", "4", "2") \
6aa8b732
AK		 308 : "=m" (_eflags), "=m" ((_dst).val), \
309 "=&r" (_tmp) \
d77c26fc 310 : _ly ((_src).val), "i" (EFLAGS_MASK)); \
6aa8b732
AK		 311 break; \
312 case 8: \
313 __emulate_2op_8byte(_op, _src, _dst, \
314 _eflags, _qx, _qy); \
315 break; \
316 } \
317 } while (0)
318
319#define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
320 do { \
321 unsigned long _tmp; \
d77c26fc 322 switch ((_dst).bytes) { \
6aa8b732
AK		 323 case 1: \
324 __asm__ __volatile__ ( \
d77c26fc 325 _PRE_EFLAGS("0", "4", "2") \
6aa8b732 326 _op"b %"_bx"3,%1; " \
d77c26fc 327 _POST_EFLAGS("0", "4", "2") \
6aa8b732
AK		 328 : "=m" (_eflags), "=m" ((_dst).val), \
329 "=&r" (_tmp) \
d77c26fc 330 : _by ((_src).val), "i" (EFLAGS_MASK)); \
6aa8b732
AK		 331 break; \
332 default: \
333 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
334 _wx, _wy, _lx, _ly, _qx, _qy); \
335 break; \
336 } \
337 } while (0)
338
339/* Source operand is byte-sized and may be restricted to just %cl. */
340#define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
341 __emulate_2op(_op, _src, _dst, _eflags, \
342 "b", "c", "b", "c", "b", "c", "b", "c")
343
344/* Source operand is byte, word, long or quad sized. */
345#define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
346 __emulate_2op(_op, _src, _dst, _eflags, \
347 "b", "q", "w", "r", _LO32, "r", "", "r")
348
349/* Source operand is word, long or quad sized. */
350#define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
351 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
352 "w", "r", _LO32, "r", "", "r")
353
354/* Instruction has only one explicit operand (no source operand). */
355#define emulate_1op(_op, _dst, _eflags) \
356 do { \
357 unsigned long _tmp; \
358 \
d77c26fc 359 switch ((_dst).bytes) { \
6aa8b732
AK		 360 case 1: \
361 __asm__ __volatile__ ( \
d77c26fc 362 _PRE_EFLAGS("0", "3", "2") \
6aa8b732 363 _op"b %1; " \
d77c26fc 364 _POST_EFLAGS("0", "3", "2") \
6aa8b732
AK		 365 : "=m" (_eflags), "=m" ((_dst).val), \
366 "=&r" (_tmp) \
d77c26fc 367 : "i" (EFLAGS_MASK)); \
6aa8b732
AK		 368 break; \
369 case 2: \
370 __asm__ __volatile__ ( \
d77c26fc 371 _PRE_EFLAGS("0", "3", "2") \
6aa8b732 372 _op"w %1; " \
d77c26fc 373 _POST_EFLAGS("0", "3", "2") \
6aa8b732
AK		 374 : "=m" (_eflags), "=m" ((_dst).val), \
375 "=&r" (_tmp) \
d77c26fc 376 : "i" (EFLAGS_MASK)); \
6aa8b732
AK		 377 break; \
378 case 4: \
379 __asm__ __volatile__ ( \
d77c26fc 380 _PRE_EFLAGS("0", "3", "2") \
6aa8b732 381 _op"l %1; " \
d77c26fc 382 _POST_EFLAGS("0", "3", "2") \
6aa8b732
AK		 383 : "=m" (_eflags), "=m" ((_dst).val), \
384 "=&r" (_tmp) \
d77c26fc 385 : "i" (EFLAGS_MASK)); \
6aa8b732
AK		 386 break; \
387 case 8: \
388 __emulate_1op_8byte(_op, _dst, _eflags); \
389 break; \
390 } \
391 } while (0)
392
393/* Emulate an instruction with quadword operands (x86/64 only). */
05b3e0c2 394#if defined(CONFIG_X86_64)
6aa8b732
AK		 395#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
396 do { \
397 __asm__ __volatile__ ( \
d77c26fc 398 _PRE_EFLAGS("0", "4", "2") \
6aa8b732 399 _op"q %"_qx"3,%1; " \
d77c26fc 400 _POST_EFLAGS("0", "4", "2") \
6aa8b732 401 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
d77c26fc 402 : _qy ((_src).val), "i" (EFLAGS_MASK)); \
6aa8b732
AK		 403 } while (0)
404
405#define __emulate_1op_8byte(_op, _dst, _eflags) \
406 do { \
407 __asm__ __volatile__ ( \
d77c26fc 408 _PRE_EFLAGS("0", "3", "2") \
6aa8b732 409 _op"q %1; " \
d77c26fc 410 _POST_EFLAGS("0", "3", "2") \
6aa8b732 411 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
d77c26fc 412 : "i" (EFLAGS_MASK)); \
6aa8b732
AK		 413 } while (0)
414
415#elif defined(__i386__)
416#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
417#define __emulate_1op_8byte(_op, _dst, _eflags)
418#endif /* __i386__ */
419
420/* Fetch next part of the instruction being emulated. */
421#define insn_fetch(_type, _size, _eip) \
422({ unsigned long _x; \
62266869 423 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
d77c26fc 424 if (rc != 0) \
6aa8b732
AK		 425 goto done; \
426 (_eip) += (_size); \
427 (_type)_x; \
428})
429
430/* Access/update address held in a register, based on addressing mode. */
e70669ab 431#define address_mask(reg) \
e4e03ded
LV		 432 ((c->ad_bytes == sizeof(unsigned long)) ? \
433 (reg) : ((reg) & ((1UL << (c->ad_bytes << 3)) - 1)))
6aa8b732 434#define register_address(base, reg) \
e70669ab 435 ((base) + address_mask(reg))
6aa8b732
AK		 436#define register_address_increment(reg, inc) \
437 do { \
438 /* signed type ensures sign extension to long */ \
439 int _inc = (inc); \
e4e03ded 440 if (c->ad_bytes == sizeof(unsigned long)) \
6aa8b732
AK		 441 (reg) += _inc; \
442 else \
e4e03ded
LV		 443 (reg) = ((reg) & \
444 ~((1UL << (c->ad_bytes << 3)) - 1)) | \
445 (((reg) + _inc) & \
446 ((1UL << (c->ad_bytes << 3)) - 1)); \
6aa8b732
AK		 447 } while (0)
448
098c937b
NK		 449#define JMP_REL(rel) \
450 do { \
e4e03ded 451 register_address_increment(c->eip, rel); \
098c937b
NK		 452 } while (0)
453
62266869
AK		 454static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
455 struct x86_emulate_ops *ops,
456 unsigned long linear, u8 *dest)
457{
458 struct fetch_cache *fc = &ctxt->decode.fetch;
459 int rc;
460 int size;
461
462 if (linear < fc->start || linear >= fc->end) {
463 size = min(15UL, PAGE_SIZE - offset_in_page(linear));
464 rc = ops->read_std(linear, fc->data, size, ctxt->vcpu);
465 if (rc)
466 return rc;
467 fc->start = linear;
468 fc->end = linear + size;
469 }
470 *dest = fc->data[linear - fc->start];
471 return 0;
472}
473
474static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
475 struct x86_emulate_ops *ops,
476 unsigned long eip, void *dest, unsigned size)
477{
478 int rc = 0;
479
480 eip += ctxt->cs_base;
481 while (size--) {
482 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
483 if (rc)
484 return rc;
485 }
486 return 0;
487}
488
1e3c5cb0
RR		 489/*
490 * Given the 'reg' portion of a ModRM byte, and a register block, return a
491 * pointer into the block that addresses the relevant register.
492 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
493 */
494static void *decode_register(u8 modrm_reg, unsigned long *regs,
495 int highbyte_regs)
6aa8b732
AK		 496{
497 void *p;
498
499 p = &regs[modrm_reg];
500 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
501 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
502 return p;
503}
504
505static int read_descriptor(struct x86_emulate_ctxt *ctxt,
506 struct x86_emulate_ops *ops,
507 void *ptr,
508 u16 *size, unsigned long *address, int op_bytes)
509{
510 int rc;
511
512 if (op_bytes == 2)
513 op_bytes = 3;
514 *address = 0;
cebff02b
LV		 515 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
516 ctxt->vcpu);
6aa8b732
AK		 517 if (rc)
518 return rc;
cebff02b
LV		 519 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
520 ctxt->vcpu);
6aa8b732
AK		 521 return rc;
522}
523
bbe9abbd
NK		 524static int test_cc(unsigned int condition, unsigned int flags)
525{
526 int rc = 0;
527
528 switch ((condition & 15) >> 1) {
529 case 0: /* o */
530 rc |= (flags & EFLG_OF);
531 break;
532 case 1: /* b/c/nae */
533 rc |= (flags & EFLG_CF);
534 break;
535 case 2: /* z/e */
536 rc |= (flags & EFLG_ZF);
537 break;
538 case 3: /* be/na */
539 rc |= (flags & (EFLG_CF|EFLG_ZF));
540 break;
541 case 4: /* s */
542 rc |= (flags & EFLG_SF);
543 break;
544 case 5: /* p/pe */
545 rc |= (flags & EFLG_PF);
546 break;
547 case 7: /* le/ng */
548 rc |= (flags & EFLG_ZF);
549 /* fall through */
550 case 6: /* l/nge */
551 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
552 break;
553 }
554
555 /* Odd condition identifiers (lsb == 1) have inverted sense. */
556 return (!!rc ^ (condition & 1));
557}
558
3c118e24
AK		 559static void decode_register_operand(struct operand *op,
560 struct decode_cache *c,
3c118e24
AK		 561 int inhibit_bytereg)
562{
33615aa9 563 unsigned reg = c->modrm_reg;
9f1ef3f8 564 int highbyte_regs = c->rex_prefix == 0;
33615aa9
AK		 565
566 if (!(c->d & ModRM))
567 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
3c118e24
AK		 568 op->type = OP_REG;
569 if ((c->d & ByteOp) && !inhibit_bytereg) {
33615aa9 570 op->ptr = decode_register(reg, c->regs, highbyte_regs);
3c118e24
AK		 571 op->val = *(u8 *)op->ptr;
572 op->bytes = 1;
573 } else {
33615aa9 574 op->ptr = decode_register(reg, c->regs, 0);
3c118e24
AK		 575 op->bytes = c->op_bytes;
576 switch (op->bytes) {
577 case 2:
578 op->val = *(u16 *)op->ptr;
579 break;
580 case 4:
581 op->val = *(u32 *)op->ptr;
582 break;
583 case 8:
584 op->val = *(u64 *) op->ptr;
585 break;
586 }
587 }
588 op->orig_val = op->val;
589}
590
1c73ef66
AK		 591static int decode_modrm(struct x86_emulate_ctxt *ctxt,
592 struct x86_emulate_ops *ops)
593{
594 struct decode_cache *c = &ctxt->decode;
595 u8 sib;
596 int index_reg = 0, base_reg = 0, scale, rip_relative = 0;
597 int rc = 0;
598
599 if (c->rex_prefix) {
600 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
601 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
602 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
603 }
604
605 c->modrm = insn_fetch(u8, 1, c->eip);
606 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
607 c->modrm_reg |= (c->modrm & 0x38) >> 3;
608 c->modrm_rm |= (c->modrm & 0x07);
609 c->modrm_ea = 0;
610 c->use_modrm_ea = 1;
611
612 if (c->modrm_mod == 3) {
613 c->modrm_val = *(unsigned long *)
614 decode_register(c->modrm_rm, c->regs, c->d & ByteOp);
615 return rc;
616 }
617
618 if (c->ad_bytes == 2) {
619 unsigned bx = c->regs[VCPU_REGS_RBX];
620 unsigned bp = c->regs[VCPU_REGS_RBP];
621 unsigned si = c->regs[VCPU_REGS_RSI];
622 unsigned di = c->regs[VCPU_REGS_RDI];
623
624 /* 16-bit ModR/M decode. */
625 switch (c->modrm_mod) {
626 case 0:
627 if (c->modrm_rm == 6)
628 c->modrm_ea += insn_fetch(u16, 2, c->eip);
629 break;
630 case 1:
631 c->modrm_ea += insn_fetch(s8, 1, c->eip);
632 break;
633 case 2:
634 c->modrm_ea += insn_fetch(u16, 2, c->eip);
635 break;
636 }
637 switch (c->modrm_rm) {
638 case 0:
639 c->modrm_ea += bx + si;
640 break;
641 case 1:
642 c->modrm_ea += bx + di;
643 break;
644 case 2:
645 c->modrm_ea += bp + si;
646 break;
647 case 3:
648 c->modrm_ea += bp + di;
649 break;
650 case 4:
651 c->modrm_ea += si;
652 break;
653 case 5:
654 c->modrm_ea += di;
655 break;
656 case 6:
657 if (c->modrm_mod != 0)
658 c->modrm_ea += bp;
659 break;
660 case 7:
661 c->modrm_ea += bx;
662 break;
663 }
664 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
665 (c->modrm_rm == 6 && c->modrm_mod != 0))
666 if (!c->override_base)
667 c->override_base = &ctxt->ss_base;
668 c->modrm_ea = (u16)c->modrm_ea;
669 } else {
670 /* 32/64-bit ModR/M decode. */
671 switch (c->modrm_rm) {
672 case 4:
673 case 12:
674 sib = insn_fetch(u8, 1, c->eip);
675 index_reg |= (sib >> 3) & 7;
676 base_reg |= sib & 7;
677 scale = sib >> 6;
678
679 switch (base_reg) {
680 case 5:
681 if (c->modrm_mod != 0)
682 c->modrm_ea += c->regs[base_reg];
683 else
684 c->modrm_ea +=
685 insn_fetch(s32, 4, c->eip);
686 break;
687 default:
688 c->modrm_ea += c->regs[base_reg];
689 }
690 switch (index_reg) {
691 case 4:
692 break;
693 default:
694 c->modrm_ea += c->regs[index_reg] << scale;
695 }
696 break;
697 case 5:
698 if (c->modrm_mod != 0)
699 c->modrm_ea += c->regs[c->modrm_rm];
700 else if (ctxt->mode == X86EMUL_MODE_PROT64)
701 rip_relative = 1;
702 break;
703 default:
704 c->modrm_ea += c->regs[c->modrm_rm];
705 break;
706 }
707 switch (c->modrm_mod) {
708 case 0:
709 if (c->modrm_rm == 5)
710 c->modrm_ea += insn_fetch(s32, 4, c->eip);
711 break;
712 case 1:
713 c->modrm_ea += insn_fetch(s8, 1, c->eip);
714 break;
715 case 2:
716 c->modrm_ea += insn_fetch(s32, 4, c->eip);
717 break;
718 }
719 }
720 if (rip_relative) {
721 c->modrm_ea += c->eip;
722 switch (c->d & SrcMask) {
723 case SrcImmByte:
724 c->modrm_ea += 1;
725 break;
726 case SrcImm:
727 if (c->d & ByteOp)
728 c->modrm_ea += 1;
729 else
730 if (c->op_bytes == 8)
731 c->modrm_ea += 4;
732 else
733 c->modrm_ea += c->op_bytes;
734 }
735 }
736done:
737 return rc;
738}
739
740static int decode_abs(struct x86_emulate_ctxt *ctxt,
741 struct x86_emulate_ops *ops)
742{
743 struct decode_cache *c = &ctxt->decode;
744 int rc = 0;
745
746 switch (c->ad_bytes) {
747 case 2:
748 c->modrm_ea = insn_fetch(u16, 2, c->eip);
749 break;
750 case 4:
751 c->modrm_ea = insn_fetch(u32, 4, c->eip);
752 break;
753 case 8:
754 c->modrm_ea = insn_fetch(u64, 8, c->eip);
755 break;
756 }
757done:
758 return rc;
759}
760
6aa8b732 761int
8b4caf66 762x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
6aa8b732 763{
e4e03ded 764 struct decode_cache *c = &ctxt->decode;
6aa8b732 765 int rc = 0;
6aa8b732 766 int mode = ctxt->mode;
f21b8bf4 767 int def_op_bytes, def_ad_bytes;
6aa8b732
AK		 768
769 /* Shadow copy of register state. Committed on successful emulation. */
6aa8b732 770
e4e03ded
LV		 771 memset(c, 0, sizeof(struct decode_cache));
772 c->eip = ctxt->vcpu->rip;
773 memcpy(c->regs, ctxt->vcpu->regs, sizeof c->regs);
6aa8b732
AK		 774
775 switch (mode) {
776 case X86EMUL_MODE_REAL:
777 case X86EMUL_MODE_PROT16:
f21b8bf4 778 def_op_bytes = def_ad_bytes = 2;
6aa8b732
AK		 779 break;
780 case X86EMUL_MODE_PROT32:
f21b8bf4 781 def_op_bytes = def_ad_bytes = 4;
6aa8b732 782 break;
05b3e0c2 783#ifdef CONFIG_X86_64
6aa8b732 784 case X86EMUL_MODE_PROT64:
f21b8bf4
AK		 785 def_op_bytes = 4;
786 def_ad_bytes = 8;
6aa8b732
AK		 787 break;
788#endif
789 default:
790 return -1;
791 }
792
f21b8bf4
AK		 793 c->op_bytes = def_op_bytes;
794 c->ad_bytes = def_ad_bytes;
795
6aa8b732 796 /* Legacy prefixes. */
b4c6abfe 797 for (;;) {
e4e03ded 798 switch (c->b = insn_fetch(u8, 1, c->eip)) {
6aa8b732 799 case 0x66: /* operand-size override */
f21b8bf4
AK		 800 /* switch between 2/4 bytes */
801 c->op_bytes = def_op_bytes ^ 6;
6aa8b732
AK		 802 break;
803 case 0x67: /* address-size override */
804 if (mode == X86EMUL_MODE_PROT64)
e4e03ded 805 /* switch between 4/8 bytes */
f21b8bf4 806 c->ad_bytes = def_ad_bytes ^ 12;
6aa8b732 807 else
e4e03ded 808 /* switch between 2/4 bytes */
f21b8bf4 809 c->ad_bytes = def_ad_bytes ^ 6;
6aa8b732
AK		 810 break;
811 case 0x2e: /* CS override */
e4e03ded 812 c->override_base = &ctxt->cs_base;
6aa8b732
AK		 813 break;
814 case 0x3e: /* DS override */
e4e03ded 815 c->override_base = &ctxt->ds_base;
6aa8b732
AK		 816 break;
817 case 0x26: /* ES override */
e4e03ded 818 c->override_base = &ctxt->es_base;
6aa8b732
AK		 819 break;
820 case 0x64: /* FS override */
e4e03ded 821 c->override_base = &ctxt->fs_base;
6aa8b732
AK		 822 break;
823 case 0x65: /* GS override */
e4e03ded 824 c->override_base = &ctxt->gs_base;
6aa8b732
AK		 825 break;
826 case 0x36: /* SS override */
e4e03ded 827 c->override_base = &ctxt->ss_base;
6aa8b732 828 break;
b4c6abfe
LV		 829 case 0x40 ... 0x4f: /* REX */
830 if (mode != X86EMUL_MODE_PROT64)
831 goto done_prefixes;
33615aa9 832 c->rex_prefix = c->b;
b4c6abfe 833 continue;
6aa8b732 834 case 0xf0: /* LOCK */
e4e03ded 835 c->lock_prefix = 1;
6aa8b732 836 break;
ae6200ba 837 case 0xf2: /* REPNE/REPNZ */
90e0a28f
GT		 838 c->rep_prefix = REPNE_PREFIX;
839 break;
6aa8b732 840 case 0xf3: /* REP/REPE/REPZ */
90e0a28f 841 c->rep_prefix = REPE_PREFIX;
6aa8b732 842 break;
6aa8b732
AK		 843 default:
844 goto done_prefixes;
845 }
b4c6abfe
LV		 846
847 /* Any legacy prefix after a REX prefix nullifies its effect. */
848
33615aa9 849 c->rex_prefix = 0;
6aa8b732
AK		 850 }
851
852done_prefixes:
853
854 /* REX prefix. */
1c73ef66 855 if (c->rex_prefix)
33615aa9 856 if (c->rex_prefix & 8)
e4e03ded 857 c->op_bytes = 8; /* REX.W */
6aa8b732
AK		 858
859 /* Opcode byte(s). */
e4e03ded
LV		 860 c->d = opcode_table[c->b];
861 if (c->d == 0) {
6aa8b732 862 /* Two-byte opcode? */
e4e03ded
LV		 863 if (c->b == 0x0f) {
864 c->twobyte = 1;
865 c->b = insn_fetch(u8, 1, c->eip);
866 c->d = twobyte_table[c->b];
6aa8b732
AK		 867 }
868
869 /* Unrecognised? */
8b4caf66
LV		 870 if (c->d == 0) {
871 DPRINTF("Cannot emulate %02x\n", c->b);
872 return -1;
873 }
6aa8b732
AK		 874 }
875
6e3d5dfb
AK		 876 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
877 c->op_bytes = 8;
878
6aa8b732 879 /* ModRM and SIB bytes. */
1c73ef66
AK		 880 if (c->d & ModRM)
881 rc = decode_modrm(ctxt, ops);
882 else if (c->d & MemAbs)
883 rc = decode_abs(ctxt, ops);
884 if (rc)
885 goto done;
6aa8b732 886
c7e75a3d
AK		 887 if (!c->override_base)
888 c->override_base = &ctxt->ds_base;
889 if (mode == X86EMUL_MODE_PROT64 &&
890 c->override_base != &ctxt->fs_base &&
891 c->override_base != &ctxt->gs_base)
892 c->override_base = NULL;
893
894 if (c->override_base)
895 c->modrm_ea += *c->override_base;
896
897 if (c->ad_bytes != 8)
898 c->modrm_ea = (u32)c->modrm_ea;
6aa8b732
AK		 899 /*
900 * Decode and fetch the source operand: register, memory
901 * or immediate.
902 */
e4e03ded 903 switch (c->d & SrcMask) {
6aa8b732
AK		 904 case SrcNone:
905 break;
906 case SrcReg:
9f1ef3f8 907 decode_register_operand(&c->src, c, 0);
6aa8b732
AK		 908 break;
909 case SrcMem16:
e4e03ded 910 c->src.bytes = 2;
6aa8b732
AK		 911 goto srcmem_common;
912 case SrcMem32:
e4e03ded 913 c->src.bytes = 4;
6aa8b732
AK		 914 goto srcmem_common;
915 case SrcMem:
e4e03ded
LV		 916 c->src.bytes = (c->d & ByteOp) ? 1 :
917 c->op_bytes;
b85b9ee9 918 /* Don't fetch the address for invlpg: it could be unmapped. */
d77c26fc 919 if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
b85b9ee9 920 break;
d77c26fc 921 srcmem_common:
4e62417b
AJ		 922 /*
923 * For instructions with a ModR/M byte, switch to register
924 * access if Mod = 3.
925 */
e4e03ded
LV		 926 if ((c->d & ModRM) && c->modrm_mod == 3) {
927 c->src.type = OP_REG;
4e62417b
AJ		 928 break;
929 }
e4e03ded 930 c->src.type = OP_MEM;
6aa8b732
AK		 931 break;
932 case SrcImm:
e4e03ded
LV		 933 c->src.type = OP_IMM;
934 c->src.ptr = (unsigned long *)c->eip;
935 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
936 if (c->src.bytes == 8)
937 c->src.bytes = 4;
6aa8b732 938 /* NB. Immediates are sign-extended as necessary. */
e4e03ded 939 switch (c->src.bytes) {
6aa8b732 940 case 1:
e4e03ded 941 c->src.val = insn_fetch(s8, 1, c->eip);
6aa8b732
AK		 942 break;
943 case 2:
e4e03ded 944 c->src.val = insn_fetch(s16, 2, c->eip);
6aa8b732
AK		 945 break;
946 case 4:
e4e03ded 947 c->src.val = insn_fetch(s32, 4, c->eip);
6aa8b732
AK		 948 break;
949 }
950 break;
951 case SrcImmByte:
e4e03ded
LV		 952 c->src.type = OP_IMM;
953 c->src.ptr = (unsigned long *)c->eip;
954 c->src.bytes = 1;
955 c->src.val = insn_fetch(s8, 1, c->eip);
6aa8b732
AK		 956 break;
957 }
958
038e51de 959 /* Decode and fetch the destination operand: register or memory. */
e4e03ded 960 switch (c->d & DstMask) {
038e51de
AK		 961 case ImplicitOps:
962 /* Special instructions do their own operand decoding. */
8b4caf66 963 return 0;
038e51de 964 case DstReg:
9f1ef3f8 965 decode_register_operand(&c->dst, c,
3c118e24 966 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
038e51de
AK		 967 break;
968 case DstMem:
e4e03ded
LV		 969 if ((c->d & ModRM) && c->modrm_mod == 3) {
970 c->dst.type = OP_REG;
4e62417b
AJ		 971 break;
972 }
8b4caf66
LV		 973 c->dst.type = OP_MEM;
974 break;
975 }
976
977done:
978 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
979}
980
8cdbd2c9
LV		 981static inline void emulate_push(struct x86_emulate_ctxt *ctxt)
982{
983 struct decode_cache *c = &ctxt->decode;
984
985 c->dst.type = OP_MEM;
986 c->dst.bytes = c->op_bytes;
987 c->dst.val = c->src.val;
988 register_address_increment(c->regs[VCPU_REGS_RSP], -c->op_bytes);
989 c->dst.ptr = (void *) register_address(ctxt->ss_base,
990 c->regs[VCPU_REGS_RSP]);
991}
992
993static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
994 struct x86_emulate_ops *ops)
995{
996 struct decode_cache *c = &ctxt->decode;
997 int rc;
998
8cdbd2c9
LV		 999 rc = ops->read_std(register_address(ctxt->ss_base,
1000 c->regs[VCPU_REGS_RSP]),
1001 &c->dst.val, c->dst.bytes, ctxt->vcpu);
1002 if (rc != 0)
1003 return rc;
1004
1005 register_address_increment(c->regs[VCPU_REGS_RSP], c->dst.bytes);
1006
1007 return 0;
1008}
1009
05f086f8 1010static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
8cdbd2c9 1011{
05f086f8 1012 struct decode_cache *c = &ctxt->decode;
8cdbd2c9
LV		 1013 switch (c->modrm_reg) {
1014 case 0: /* rol */
05f086f8 1015 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1016 break;
1017 case 1: /* ror */
05f086f8 1018 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1019 break;
1020 case 2: /* rcl */
05f086f8 1021 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1022 break;
1023 case 3: /* rcr */
05f086f8 1024 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1025 break;
1026 case 4: /* sal/shl */
1027 case 6: /* sal/shl */
05f086f8 1028 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1029 break;
1030 case 5: /* shr */
05f086f8 1031 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1032 break;
1033 case 7: /* sar */
05f086f8 1034 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1035 break;
1036 }
1037}
1038
1039static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
05f086f8 1040 struct x86_emulate_ops *ops)
8cdbd2c9
LV		 1041{
1042 struct decode_cache *c = &ctxt->decode;
1043 int rc = 0;
1044
1045 switch (c->modrm_reg) {
1046 case 0 ... 1: /* test */
1047 /*
1048 * Special case in Grp3: test has an immediate
1049 * source operand.
1050 */
1051 c->src.type = OP_IMM;
1052 c->src.ptr = (unsigned long *)c->eip;
1053 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1054 if (c->src.bytes == 8)
1055 c->src.bytes = 4;
1056 switch (c->src.bytes) {
1057 case 1:
1058 c->src.val = insn_fetch(s8, 1, c->eip);
1059 break;
1060 case 2:
1061 c->src.val = insn_fetch(s16, 2, c->eip);
1062 break;
1063 case 4:
1064 c->src.val = insn_fetch(s32, 4, c->eip);
1065 break;
1066 }
05f086f8 1067 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1068 break;
1069 case 2: /* not */
1070 c->dst.val = ~c->dst.val;
1071 break;
1072 case 3: /* neg */
05f086f8 1073 emulate_1op("neg", c->dst, ctxt->eflags);
8cdbd2c9
LV		 1074 break;
1075 default:
1076 DPRINTF("Cannot emulate %02x\n", c->b);
1077 rc = X86EMUL_UNHANDLEABLE;
1078 break;
1079 }
1080done:
1081 return rc;
1082}
1083
1084static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
a01af5ec 1085 struct x86_emulate_ops *ops)
8cdbd2c9
LV		 1086{
1087 struct decode_cache *c = &ctxt->decode;
1088 int rc;
1089
1090 switch (c->modrm_reg) {
1091 case 0: /* inc */
05f086f8 1092 emulate_1op("inc", c->dst, ctxt->eflags);
8cdbd2c9
LV		 1093 break;
1094 case 1: /* dec */
05f086f8 1095 emulate_1op("dec", c->dst, ctxt->eflags);
8cdbd2c9
LV		 1096 break;
1097 case 4: /* jmp abs */
1098 if (c->b == 0xff)
1099 c->eip = c->dst.val;
1100 else {
1101 DPRINTF("Cannot emulate %02x\n", c->b);
1102 return X86EMUL_UNHANDLEABLE;
1103 }
1104 break;
1105 case 6: /* push */
1106
1107 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1108
1109 if (ctxt->mode == X86EMUL_MODE_PROT64) {
1110 c->dst.bytes = 8;
1111 rc = ops->read_std((unsigned long)c->dst.ptr,
1112 &c->dst.val, 8, ctxt->vcpu);
1113 if (rc != 0)
1114 return rc;
1115 }
1116 register_address_increment(c->regs[VCPU_REGS_RSP],
1117 -c->dst.bytes);
1118 rc = ops->write_emulated(register_address(ctxt->ss_base,
1119 c->regs[VCPU_REGS_RSP]), &c->dst.val,
1120 c->dst.bytes, ctxt->vcpu);
1121 if (rc != 0)
1122 return rc;
a01af5ec 1123 c->dst.type = OP_NONE;
8cdbd2c9
LV		 1124 break;
1125 default:
1126 DPRINTF("Cannot emulate %02x\n", c->b);
1127 return X86EMUL_UNHANDLEABLE;
1128 }
1129 return 0;
1130}
1131
1132static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
1133 struct x86_emulate_ops *ops,
e8d8d7fe 1134 unsigned long memop)
8cdbd2c9
LV		 1135{
1136 struct decode_cache *c = &ctxt->decode;
1137 u64 old, new;
1138 int rc;
1139
e8d8d7fe 1140 rc = ops->read_emulated(memop, &old, 8, ctxt->vcpu);
8cdbd2c9
LV		 1141 if (rc != 0)
1142 return rc;
1143
1144 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1145 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
1146
1147 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1148 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
05f086f8 1149 ctxt->eflags &= ~EFLG_ZF;
8cdbd2c9
LV		 1150
1151 } else {
1152 new = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1153 (u32) c->regs[VCPU_REGS_RBX];
1154
e8d8d7fe 1155 rc = ops->cmpxchg_emulated(memop, &old, &new, 8, ctxt->vcpu);
8cdbd2c9
LV		 1156 if (rc != 0)
1157 return rc;
05f086f8 1158 ctxt->eflags |= EFLG_ZF;
8cdbd2c9
LV		 1159 }
1160 return 0;
1161}
1162
1163static inline int writeback(struct x86_emulate_ctxt *ctxt,
1164 struct x86_emulate_ops *ops)
1165{
1166 int rc;
1167 struct decode_cache *c = &ctxt->decode;
1168
1169 switch (c->dst.type) {
1170 case OP_REG:
1171 /* The 4-byte case *is* correct:
1172 * in 64-bit mode we zero-extend.
1173 */
1174 switch (c->dst.bytes) {
1175 case 1:
1176 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1177 break;
1178 case 2:
1179 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1180 break;
1181 case 4:
1182 *c->dst.ptr = (u32)c->dst.val;
1183 break; /* 64b: zero-ext */
1184 case 8:
1185 *c->dst.ptr = c->dst.val;
1186 break;
1187 }
1188 break;
1189 case OP_MEM:
1190 if (c->lock_prefix)
1191 rc = ops->cmpxchg_emulated(
1192 (unsigned long)c->dst.ptr,
1193 &c->dst.orig_val,
1194 &c->dst.val,
1195 c->dst.bytes,
1196 ctxt->vcpu);
1197 else
1198 rc = ops->write_emulated(
1199 (unsigned long)c->dst.ptr,
1200 &c->dst.val,
1201 c->dst.bytes,
1202 ctxt->vcpu);
1203 if (rc != 0)
1204 return rc;
a01af5ec
LV		 1205 break;
1206 case OP_NONE:
1207 /* no writeback */
1208 break;
8cdbd2c9
LV		 1209 default:
1210 break;
1211 }
1212 return 0;
1213}
1214
8b4caf66 1215int
1be3aa47 1216x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
8b4caf66 1217{
e8d8d7fe 1218 unsigned long memop = 0;
8b4caf66 1219 u64 msr_data;
3427318f 1220 unsigned long saved_eip = 0;
8b4caf66 1221 struct decode_cache *c = &ctxt->decode;
1be3aa47 1222 int rc = 0;
8b4caf66 1223
3427318f
LV		 1224 /* Shadow copy of register state. Committed on successful emulation.
1225 * NOTE: we can copy them from vcpu as x86_decode_insn() doesn't
1226 * modify them.
1227 */
1228
1229 memcpy(c->regs, ctxt->vcpu->regs, sizeof c->regs);
1230 saved_eip = c->eip;
1231
c7e75a3d 1232 if (((c->d & ModRM) && (c->modrm_mod != 3)) || (c->d & MemAbs))
e8d8d7fe 1233 memop = c->modrm_ea;
8b4caf66 1234
b9fa9d6b
AK		 1235 if (c->rep_prefix && (c->d & String)) {
1236 /* All REP prefixes have the same first termination condition */
1237 if (c->regs[VCPU_REGS_RCX] == 0) {
1238 ctxt->vcpu->rip = c->eip;
1239 goto done;
1240 }
1241 /* The second termination condition only applies for REPE
1242 * and REPNE. Test if the repeat string operation prefix is
1243 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
1244 * corresponding termination condition according to:
1245 * - if REPE/REPZ and ZF = 0 then done
1246 * - if REPNE/REPNZ and ZF = 1 then done
1247 */
1248 if ((c->b == 0xa6) || (c->b == 0xa7) ||
1249 (c->b == 0xae) || (c->b == 0xaf)) {
1250 if ((c->rep_prefix == REPE_PREFIX) &&
1251 ((ctxt->eflags & EFLG_ZF) == 0)) {
1252 ctxt->vcpu->rip = c->eip;
1253 goto done;
1254 }
1255 if ((c->rep_prefix == REPNE_PREFIX) &&
1256 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF)) {
1257 ctxt->vcpu->rip = c->eip;
1258 goto done;
1259 }
1260 }
1261 c->regs[VCPU_REGS_RCX]--;
1262 c->eip = ctxt->vcpu->rip;
1263 }
1264
8b4caf66 1265 if (c->src.type == OP_MEM) {
e8d8d7fe 1266 c->src.ptr = (unsigned long *)memop;
8b4caf66 1267 c->src.val = 0;
d77c26fc
MD		 1268 rc = ops->read_emulated((unsigned long)c->src.ptr,
1269 &c->src.val,
1270 c->src.bytes,
1271 ctxt->vcpu);
1272 if (rc != 0)
8b4caf66
LV		 1273 goto done;
1274 c->src.orig_val = c->src.val;
1275 }
1276
1277 if ((c->d & DstMask) == ImplicitOps)
1278 goto special_insn;
1279
1280
1281 if (c->dst.type == OP_MEM) {
e8d8d7fe 1282 c->dst.ptr = (unsigned long *)memop;
8b4caf66
LV		 1283 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1284 c->dst.val = 0;
e4e03ded
LV		 1285 if (c->d & BitOp) {
1286 unsigned long mask = ~(c->dst.bytes * 8 - 1);
df513e2c 1287
e4e03ded
LV		 1288 c->dst.ptr = (void *)c->dst.ptr +
1289 (c->src.val & mask) / 8;
038e51de 1290 }
e4e03ded
LV		 1291 if (!(c->d & Mov) &&
1292 /* optimisation - avoid slow emulated read */
1293 ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1294 &c->dst.val,
1295 c->dst.bytes, ctxt->vcpu)) != 0))
038e51de 1296 goto done;
038e51de 1297 }
e4e03ded 1298 c->dst.orig_val = c->dst.val;
038e51de 1299
018a98db
AK		 1300special_insn:
1301
e4e03ded 1302 if (c->twobyte)
6aa8b732
AK		 1303 goto twobyte_insn;
1304
e4e03ded 1305 switch (c->b) {
6aa8b732
AK		 1306 case 0x00 ... 0x05:
1307 add: /* add */
05f086f8 1308 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 1309 break;
1310 case 0x08 ... 0x0d:
1311 or: /* or */
05f086f8 1312 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 1313 break;
1314 case 0x10 ... 0x15:
1315 adc: /* adc */
05f086f8 1316 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 1317 break;
1318 case 0x18 ... 0x1d:
1319 sbb: /* sbb */
05f086f8 1320 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
6aa8b732 1321 break;
19eb938e 1322 case 0x20 ... 0x23:
6aa8b732 1323 and: /* and */
05f086f8 1324 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
6aa8b732 1325 break;
19eb938e 1326 case 0x24: /* and al imm8 */
e4e03ded
LV		 1327 c->dst.type = OP_REG;
1328 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1329 c->dst.val = *(u8 *)c->dst.ptr;
1330 c->dst.bytes = 1;
1331 c->dst.orig_val = c->dst.val;
19eb938e
NK		 1332 goto and;
1333 case 0x25: /* and ax imm16, or eax imm32 */
e4e03ded
LV		 1334 c->dst.type = OP_REG;
1335 c->dst.bytes = c->op_bytes;
1336 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
1337 if (c->op_bytes == 2)
1338 c->dst.val = *(u16 *)c->dst.ptr;
19eb938e 1339 else
e4e03ded
LV		 1340 c->dst.val = *(u32 *)c->dst.ptr;
1341 c->dst.orig_val = c->dst.val;
19eb938e 1342 goto and;
6aa8b732
AK		 1343 case 0x28 ... 0x2d:
1344 sub: /* sub */
05f086f8 1345 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 1346 break;
1347 case 0x30 ... 0x35:
1348 xor: /* xor */
05f086f8 1349 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 1350 break;
1351 case 0x38 ... 0x3d:
1352 cmp: /* cmp */
05f086f8 1353 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
6aa8b732 1354 break;
33615aa9
AK		 1355 case 0x40 ... 0x47: /* inc r16/r32 */
1356 emulate_1op("inc", c->dst, ctxt->eflags);
1357 break;
1358 case 0x48 ... 0x4f: /* dec r16/r32 */
1359 emulate_1op("dec", c->dst, ctxt->eflags);
1360 break;
1361 case 0x50 ... 0x57: /* push reg */
1362 c->dst.type = OP_MEM;
1363 c->dst.bytes = c->op_bytes;
1364 c->dst.val = c->src.val;
1365 register_address_increment(c->regs[VCPU_REGS_RSP],
1366 -c->op_bytes);
1367 c->dst.ptr = (void *) register_address(
1368 ctxt->ss_base, c->regs[VCPU_REGS_RSP]);
1369 break;
1370 case 0x58 ... 0x5f: /* pop reg */
1371 pop_instruction:
1372 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1373 c->regs[VCPU_REGS_RSP]), c->dst.ptr,
1374 c->op_bytes, ctxt->vcpu)) != 0)
1375 goto done;
1376
1377 register_address_increment(c->regs[VCPU_REGS_RSP],
1378 c->op_bytes);
1379 c->dst.type = OP_NONE; /* Disable writeback. */
1380 break;
6aa8b732 1381 case 0x63: /* movsxd */
8b4caf66 1382 if (ctxt->mode != X86EMUL_MODE_PROT64)
6aa8b732 1383 goto cannot_emulate;
e4e03ded 1384 c->dst.val = (s32) c->src.val;
6aa8b732 1385 break;
018a98db
AK		 1386 case 0x6a: /* push imm8 */
1387 c->src.val = 0L;
1388 c->src.val = insn_fetch(s8, 1, c->eip);
1389 emulate_push(ctxt);
1390 break;
1391 case 0x6c: /* insb */
1392 case 0x6d: /* insw/insd */
1393 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1394 1,
1395 (c->d & ByteOp) ? 1 : c->op_bytes,
1396 c->rep_prefix ?
1397 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1398 (ctxt->eflags & EFLG_DF),
1399 register_address(ctxt->es_base,
1400 c->regs[VCPU_REGS_RDI]),
1401 c->rep_prefix,
1402 c->regs[VCPU_REGS_RDX]) == 0) {
1403 c->eip = saved_eip;
1404 return -1;
1405 }
1406 return 0;
1407 case 0x6e: /* outsb */
1408 case 0x6f: /* outsw/outsd */
1409 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1410 0,
1411 (c->d & ByteOp) ? 1 : c->op_bytes,
1412 c->rep_prefix ?
1413 address_mask(c->regs[VCPU_REGS_RCX]) : 1,
1414 (ctxt->eflags & EFLG_DF),
1415 register_address(c->override_base ?
1416 *c->override_base :
1417 ctxt->ds_base,
1418 c->regs[VCPU_REGS_RSI]),
1419 c->rep_prefix,
1420 c->regs[VCPU_REGS_RDX]) == 0) {
1421 c->eip = saved_eip;
1422 return -1;
1423 }
1424 return 0;
1425 case 0x70 ... 0x7f: /* jcc (short) */ {
1426 int rel = insn_fetch(s8, 1, c->eip);
1427
1428 if (test_cc(c->b, ctxt->eflags))
1429 JMP_REL(rel);
1430 break;
1431 }
6aa8b732 1432 case 0x80 ... 0x83: /* Grp1 */
e4e03ded 1433 switch (c->modrm_reg) {
6aa8b732
AK		 1434 case 0:
1435 goto add;
1436 case 1:
1437 goto or;
1438 case 2:
1439 goto adc;
1440 case 3:
1441 goto sbb;
1442 case 4:
1443 goto and;
1444 case 5:
1445 goto sub;
1446 case 6:
1447 goto xor;
1448 case 7:
1449 goto cmp;
1450 }
1451 break;
1452 case 0x84 ... 0x85:
05f086f8 1453 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 1454 break;
1455 case 0x86 ... 0x87: /* xchg */
1456 /* Write back the register source. */
e4e03ded 1457 switch (c->dst.bytes) {
6aa8b732 1458 case 1:
e4e03ded 1459 *(u8 *) c->src.ptr = (u8) c->dst.val;
6aa8b732
AK		 1460 break;
1461 case 2:
e4e03ded 1462 *(u16 *) c->src.ptr = (u16) c->dst.val;
6aa8b732
AK		 1463 break;
1464 case 4:
e4e03ded 1465 *c->src.ptr = (u32) c->dst.val;
6aa8b732
AK		 1466 break; /* 64b reg: zero-extend */
1467 case 8:
e4e03ded 1468 *c->src.ptr = c->dst.val;
6aa8b732
AK		 1469 break;
1470 }
1471 /*
1472 * Write back the memory destination with implicit LOCK
1473 * prefix.
1474 */
e4e03ded
LV		 1475 c->dst.val = c->src.val;
1476 c->lock_prefix = 1;
6aa8b732 1477 break;
6aa8b732 1478 case 0x88 ... 0x8b: /* mov */
7de75248 1479 goto mov;
7e0b54b1 1480 case 0x8d: /* lea r16/r32, m */
e4e03ded 1481 c->dst.val = c->modrm_val;
7e0b54b1 1482 break;
6aa8b732 1483 case 0x8f: /* pop (sole member of Grp1a) */
8cdbd2c9
LV		 1484 rc = emulate_grp1a(ctxt, ops);
1485 if (rc != 0)
6aa8b732 1486 goto done;
6aa8b732 1487 break;
fd2a7608 1488 case 0x9c: /* pushf */
05f086f8 1489 c->src.val = (unsigned long) ctxt->eflags;
8cdbd2c9
LV		 1490 emulate_push(ctxt);
1491 break;
535eabcf 1492 case 0x9d: /* popf */
05f086f8 1493 c->dst.ptr = (unsigned long *) &ctxt->eflags;
535eabcf 1494 goto pop_instruction;
018a98db
AK		 1495 case 0xa0 ... 0xa1: /* mov */
1496 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
1497 c->dst.val = c->src.val;
1498 break;
1499 case 0xa2 ... 0xa3: /* mov */
1500 c->dst.val = (unsigned long)c->regs[VCPU_REGS_RAX];
1501 break;
6aa8b732 1502 case 0xa4 ... 0xa5: /* movs */
e4e03ded
LV		 1503 c->dst.type = OP_MEM;
1504 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1505 c->dst.ptr = (unsigned long *)register_address(
1506 ctxt->es_base,
1507 c->regs[VCPU_REGS_RDI]);
6aa8b732 1508 if ((rc = ops->read_emulated(register_address(
e4e03ded
LV		 1509 c->override_base ? *c->override_base :
1510 ctxt->ds_base,
1511 c->regs[VCPU_REGS_RSI]),
1512 &c->dst.val,
1513 c->dst.bytes, ctxt->vcpu)) != 0)
6aa8b732 1514 goto done;
e4e03ded 1515 register_address_increment(c->regs[VCPU_REGS_RSI],
05f086f8 1516 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
e4e03ded
LV		 1517 : c->dst.bytes);
1518 register_address_increment(c->regs[VCPU_REGS_RDI],
05f086f8 1519 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
e4e03ded 1520 : c->dst.bytes);
6aa8b732
AK		 1521 break;
1522 case 0xa6 ... 0xa7: /* cmps */
d7e5117a
GT		 1523 c->src.type = OP_NONE; /* Disable writeback. */
1524 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1525 c->src.ptr = (unsigned long *)register_address(
1526 c->override_base ? *c->override_base :
1527 ctxt->ds_base,
1528 c->regs[VCPU_REGS_RSI]);
1529 if ((rc = ops->read_emulated((unsigned long)c->src.ptr,
1530 &c->src.val,
1531 c->src.bytes,
1532 ctxt->vcpu)) != 0)
1533 goto done;
1534
1535 c->dst.type = OP_NONE; /* Disable writeback. */
1536 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1537 c->dst.ptr = (unsigned long *)register_address(
1538 ctxt->es_base,
1539 c->regs[VCPU_REGS_RDI]);
1540 if ((rc = ops->read_emulated((unsigned long)c->dst.ptr,
1541 &c->dst.val,
1542 c->dst.bytes,
1543 ctxt->vcpu)) != 0)
1544 goto done;
1545
1546 DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c->src.ptr, c->dst.ptr);
1547
1548 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1549
1550 register_address_increment(c->regs[VCPU_REGS_RSI],
1551 (ctxt->eflags & EFLG_DF) ? -c->src.bytes
1552 : c->src.bytes);
1553 register_address_increment(c->regs[VCPU_REGS_RDI],
1554 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
1555 : c->dst.bytes);
1556
1557 break;
6aa8b732 1558 case 0xaa ... 0xab: /* stos */
e4e03ded
LV		 1559 c->dst.type = OP_MEM;
1560 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
a7e6c88a
SY		 1561 c->dst.ptr = (unsigned long *)register_address(
1562 ctxt->es_base,
1563 c->regs[VCPU_REGS_RDI]);
e4e03ded
LV		 1564 c->dst.val = c->regs[VCPU_REGS_RAX];
1565 register_address_increment(c->regs[VCPU_REGS_RDI],
05f086f8 1566 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
e4e03ded 1567 : c->dst.bytes);
6aa8b732
AK		 1568 break;
1569 case 0xac ... 0xad: /* lods */
e4e03ded
LV		 1570 c->dst.type = OP_REG;
1571 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1572 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
a7e6c88a
SY		 1573 if ((rc = ops->read_emulated(register_address(
1574 c->override_base ? *c->override_base :
1575 ctxt->ds_base,
1576 c->regs[VCPU_REGS_RSI]),
1577 &c->dst.val,
1578 c->dst.bytes,
1579 ctxt->vcpu)) != 0)
6aa8b732 1580 goto done;
e4e03ded 1581 register_address_increment(c->regs[VCPU_REGS_RSI],
05f086f8 1582 (ctxt->eflags & EFLG_DF) ? -c->dst.bytes
e4e03ded 1583 : c->dst.bytes);
6aa8b732
AK		 1584 break;
1585 case 0xae ... 0xaf: /* scas */
1586 DPRINTF("Urk! I don't handle SCAS.\n");
1587 goto cannot_emulate;
018a98db
AK		 1588 case 0xc0 ... 0xc1:
1589 emulate_grp2(ctxt);
1590 break;
111de5d6
AK		 1591 case 0xc3: /* ret */
1592 c->dst.ptr = &c->eip;
1593 goto pop_instruction;
018a98db
AK		 1594 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1595 mov:
1596 c->dst.val = c->src.val;
1597 break;
1598 case 0xd0 ... 0xd1: /* Grp2 */
1599 c->src.val = 1;
1600 emulate_grp2(ctxt);
1601 break;
1602 case 0xd2 ... 0xd3: /* Grp2 */
1603 c->src.val = c->regs[VCPU_REGS_RCX];
1604 emulate_grp2(ctxt);
1605 break;
1a52e051
NK		 1606 case 0xe8: /* call (near) */ {
1607 long int rel;
e4e03ded 1608 switch (c->op_bytes) {
1a52e051 1609 case 2:
e4e03ded 1610 rel = insn_fetch(s16, 2, c->eip);
1a52e051
NK		 1611 break;
1612 case 4:
e4e03ded 1613 rel = insn_fetch(s32, 4, c->eip);
1a52e051 1614 break;
1a52e051
NK		 1615 default:
1616 DPRINTF("Call: Invalid op_bytes\n");
1617 goto cannot_emulate;
1618 }
e4e03ded 1619 c->src.val = (unsigned long) c->eip;
1a52e051 1620 JMP_REL(rel);
e4e03ded 1621 c->op_bytes = c->ad_bytes;
8cdbd2c9
LV		 1622 emulate_push(ctxt);
1623 break;
1a52e051
NK		 1624 }
1625 case 0xe9: /* jmp rel */
1626 case 0xeb: /* jmp rel short */
e4e03ded 1627 JMP_REL(c->src.val);
a01af5ec 1628 c->dst.type = OP_NONE; /* Disable writeback. */
1a52e051 1629 break;
111de5d6
AK		 1630 case 0xf4: /* hlt */
1631 ctxt->vcpu->halt_request = 1;
1632 goto done;
1633 case 0xf5: /* cmc */
1634 /* complement carry flag from eflags reg */
1635 ctxt->eflags ^= EFLG_CF;
1636 c->dst.type = OP_NONE; /* Disable writeback. */
1637 break;
018a98db
AK		 1638 case 0xf6 ... 0xf7: /* Grp3 */
1639 rc = emulate_grp3(ctxt, ops);
1640 if (rc != 0)
1641 goto done;
1642 break;
111de5d6
AK		 1643 case 0xf8: /* clc */
1644 ctxt->eflags &= ~EFLG_CF;
1645 c->dst.type = OP_NONE; /* Disable writeback. */
1646 break;
1647 case 0xfa: /* cli */
1648 ctxt->eflags &= ~X86_EFLAGS_IF;
1649 c->dst.type = OP_NONE; /* Disable writeback. */
1650 break;
1651 case 0xfb: /* sti */
1652 ctxt->eflags |= X86_EFLAGS_IF;
1653 c->dst.type = OP_NONE; /* Disable writeback. */
1654 break;
018a98db
AK		 1655 case 0xfe ... 0xff: /* Grp4/Grp5 */
1656 rc = emulate_grp45(ctxt, ops);
1657 if (rc != 0)
1658 goto done;
1659 break;
6aa8b732 1660 }
018a98db
AK		 1661
1662writeback:
1663 rc = writeback(ctxt, ops);
1664 if (rc != 0)
1665 goto done;
1666
1667 /* Commit shadow register state. */
1668 memcpy(ctxt->vcpu->regs, c->regs, sizeof c->regs);
1669 ctxt->vcpu->rip = c->eip;
1670
1671done:
1672 if (rc == X86EMUL_UNHANDLEABLE) {
1673 c->eip = saved_eip;
1674 return -1;
1675 }
1676 return 0;
6aa8b732
AK		 1677
1678twobyte_insn:
e4e03ded 1679 switch (c->b) {
6aa8b732 1680 case 0x01: /* lgdt, lidt, lmsw */
e4e03ded 1681 switch (c->modrm_reg) {
6aa8b732
AK		 1682 u16 size;
1683 unsigned long address;
1684
aca7f966 1685 case 0: /* vmcall */
e4e03ded 1686 if (c->modrm_mod != 3 || c->modrm_rm != 1)
aca7f966
AL		 1687 goto cannot_emulate;
1688
7aa81cc0
AL		 1689 rc = kvm_fix_hypercall(ctxt->vcpu);
1690 if (rc)
1691 goto done;
1692
1693 kvm_emulate_hypercall(ctxt->vcpu);
aca7f966 1694 break;
6aa8b732 1695 case 2: /* lgdt */
e4e03ded
LV		 1696 rc = read_descriptor(ctxt, ops, c->src.ptr,
1697 &size, &address, c->op_bytes);
6aa8b732
AK		 1698 if (rc)
1699 goto done;
1700 realmode_lgdt(ctxt->vcpu, size, address);
1701 break;
aca7f966 1702 case 3: /* lidt/vmmcall */
e4e03ded 1703 if (c->modrm_mod == 3 && c->modrm_rm == 1) {
7aa81cc0
AL		 1704 rc = kvm_fix_hypercall(ctxt->vcpu);
1705 if (rc)
1706 goto done;
1707 kvm_emulate_hypercall(ctxt->vcpu);
aca7f966 1708 } else {
e4e03ded 1709 rc = read_descriptor(ctxt, ops, c->src.ptr,
aca7f966 1710 &size, &address,
e4e03ded 1711 c->op_bytes);
aca7f966
AL		 1712 if (rc)
1713 goto done;
1714 realmode_lidt(ctxt->vcpu, size, address);
1715 }
6aa8b732
AK		 1716 break;
1717 case 4: /* smsw */
e4e03ded 1718 if (c->modrm_mod != 3)
6aa8b732 1719 goto cannot_emulate;
e4e03ded 1720 *(u16 *)&c->regs[c->modrm_rm]
6aa8b732
AK		 1721 = realmode_get_cr(ctxt->vcpu, 0);
1722 break;
1723 case 6: /* lmsw */
e4e03ded 1724 if (c->modrm_mod != 3)
6aa8b732 1725 goto cannot_emulate;
05f086f8
LV		 1726 realmode_lmsw(ctxt->vcpu, (u16)c->modrm_val,
1727 &ctxt->eflags);
6aa8b732
AK		 1728 break;
1729 case 7: /* invlpg*/
e8d8d7fe 1730 emulate_invlpg(ctxt->vcpu, memop);
6aa8b732
AK		 1731 break;
1732 default:
1733 goto cannot_emulate;
1734 }
a01af5ec
LV		 1735 /* Disable writeback. */
1736 c->dst.type = OP_NONE;
6aa8b732 1737 break;
018a98db
AK		 1738 case 0x06:
1739 emulate_clts(ctxt->vcpu);
1740 c->dst.type = OP_NONE;
1741 break;
1742 case 0x08: /* invd */
1743 case 0x09: /* wbinvd */
1744 case 0x0d: /* GrpP (prefetch) */
1745 case 0x18: /* Grp16 (prefetch/nop) */
1746 c->dst.type = OP_NONE;
1747 break;
1748 case 0x20: /* mov cr, reg */
1749 if (c->modrm_mod != 3)
1750 goto cannot_emulate;
1751 c->regs[c->modrm_rm] =
1752 realmode_get_cr(ctxt->vcpu, c->modrm_reg);
1753 c->dst.type = OP_NONE; /* no writeback */
1754 break;
6aa8b732 1755 case 0x21: /* mov from dr to reg */
e4e03ded 1756 if (c->modrm_mod != 3)
6aa8b732 1757 goto cannot_emulate;
8cdbd2c9 1758 rc = emulator_get_dr(ctxt, c->modrm_reg, &c->regs[c->modrm_rm]);
a01af5ec
LV		 1759 if (rc)
1760 goto cannot_emulate;
1761 c->dst.type = OP_NONE; /* no writeback */
6aa8b732 1762 break;
018a98db
AK		 1763 case 0x22: /* mov reg, cr */
1764 if (c->modrm_mod != 3)
1765 goto cannot_emulate;
1766 realmode_set_cr(ctxt->vcpu,
1767 c->modrm_reg, c->modrm_val, &ctxt->eflags);
1768 c->dst.type = OP_NONE;
1769 break;
6aa8b732 1770 case 0x23: /* mov from reg to dr */
e4e03ded 1771 if (c->modrm_mod != 3)
6aa8b732 1772 goto cannot_emulate;
e4e03ded
LV		 1773 rc = emulator_set_dr(ctxt, c->modrm_reg,
1774 c->regs[c->modrm_rm]);
a01af5ec
LV		 1775 if (rc)
1776 goto cannot_emulate;
1777 c->dst.type = OP_NONE; /* no writeback */
6aa8b732 1778 break;
018a98db
AK		 1779 case 0x30:
1780 /* wrmsr */
1781 msr_data = (u32)c->regs[VCPU_REGS_RAX]
1782 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
1783 rc = kvm_set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data);
1784 if (rc) {
c1a5d4f9 1785 kvm_inject_gp(ctxt->vcpu, 0);
018a98db
AK		 1786 c->eip = ctxt->vcpu->rip;
1787 }
1788 rc = X86EMUL_CONTINUE;
1789 c->dst.type = OP_NONE;
1790 break;
1791 case 0x32:
1792 /* rdmsr */
1793 rc = kvm_get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data);
1794 if (rc) {
c1a5d4f9 1795 kvm_inject_gp(ctxt->vcpu, 0);
018a98db
AK		 1796 c->eip = ctxt->vcpu->rip;
1797 } else {
1798 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
1799 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
1800 }
1801 rc = X86EMUL_CONTINUE;
1802 c->dst.type = OP_NONE;
1803 break;
6aa8b732 1804 case 0x40 ... 0x4f: /* cmov */
e4e03ded 1805 c->dst.val = c->dst.orig_val = c->src.val;
a01af5ec
LV		 1806 if (!test_cc(c->b, ctxt->eflags))
1807 c->dst.type = OP_NONE; /* no writeback */
6aa8b732 1808 break;
018a98db
AK		 1809 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1810 long int rel;
1811
1812 switch (c->op_bytes) {
1813 case 2:
1814 rel = insn_fetch(s16, 2, c->eip);
1815 break;
1816 case 4:
1817 rel = insn_fetch(s32, 4, c->eip);
1818 break;
1819 case 8:
1820 rel = insn_fetch(s64, 8, c->eip);
1821 break;
1822 default:
1823 DPRINTF("jnz: Invalid op_bytes\n");
1824 goto cannot_emulate;
1825 }
1826 if (test_cc(c->b, ctxt->eflags))
1827 JMP_REL(rel);
1828 c->dst.type = OP_NONE;
1829 break;
1830 }
7de75248
NK		 1831 case 0xa3:
1832 bt: /* bt */
e4f8e039 1833 c->dst.type = OP_NONE;
e4e03ded
LV		 1834 /* only subword offset */
1835 c->src.val &= (c->dst.bytes << 3) - 1;
05f086f8 1836 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
7de75248
NK		 1837 break;
1838 case 0xab:
1839 bts: /* bts */
e4e03ded
LV		 1840 /* only subword offset */
1841 c->src.val &= (c->dst.bytes << 3) - 1;
05f086f8 1842 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
7de75248 1843 break;
6aa8b732
AK		 1844 case 0xb0 ... 0xb1: /* cmpxchg */
1845 /*
1846 * Save real source value, then compare EAX against
1847 * destination.
1848 */
e4e03ded
LV		 1849 c->src.orig_val = c->src.val;
1850 c->src.val = c->regs[VCPU_REGS_RAX];
05f086f8
LV		 1851 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
1852 if (ctxt->eflags & EFLG_ZF) {
6aa8b732 1853 /* Success: write back to memory. */
e4e03ded 1854 c->dst.val = c->src.orig_val;
6aa8b732
AK		 1855 } else {
1856 /* Failure: write the value we saw to EAX. */
e4e03ded
LV		 1857 c->dst.type = OP_REG;
1858 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
6aa8b732
AK		 1859 }
1860 break;
6aa8b732
AK		 1861 case 0xb3:
1862 btr: /* btr */
e4e03ded
LV		 1863 /* only subword offset */
1864 c->src.val &= (c->dst.bytes << 3) - 1;
05f086f8 1865 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
6aa8b732 1866 break;
6aa8b732 1867 case 0xb6 ... 0xb7: /* movzx */
e4e03ded
LV		 1868 c->dst.bytes = c->op_bytes;
1869 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
1870 : (u16) c->src.val;
6aa8b732 1871 break;
6aa8b732 1872 case 0xba: /* Grp8 */
e4e03ded 1873 switch (c->modrm_reg & 3) {
6aa8b732
AK		 1874 case 0:
1875 goto bt;
1876 case 1:
1877 goto bts;
1878 case 2:
1879 goto btr;
1880 case 3:
1881 goto btc;
1882 }
1883 break;
7de75248
NK		 1884 case 0xbb:
1885 btc: /* btc */
e4e03ded
LV		 1886 /* only subword offset */
1887 c->src.val &= (c->dst.bytes << 3) - 1;
05f086f8 1888 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
7de75248 1889 break;
6aa8b732 1890 case 0xbe ... 0xbf: /* movsx */
e4e03ded
LV		 1891 c->dst.bytes = c->op_bytes;
1892 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
1893 (s16) c->src.val;
6aa8b732 1894 break;
a012e65a 1895 case 0xc3: /* movnti */
e4e03ded
LV		 1896 c->dst.bytes = c->op_bytes;
1897 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
1898 (u64) c->src.val;
a012e65a 1899 break;
6aa8b732 1900 case 0xc7: /* Grp9 (cmpxchg8b) */
e8d8d7fe 1901 rc = emulate_grp9(ctxt, ops, memop);
8cdbd2c9
LV		 1902 if (rc != 0)
1903 goto done;
018a98db 1904 c->dst.type = OP_NONE;
8cdbd2c9 1905 break;
6aa8b732
AK		 1906 }
1907 goto writeback;
1908
1909cannot_emulate:
e4e03ded 1910 DPRINTF("Cannot emulate %02x\n", c->b);
3427318f 1911 c->eip = saved_eip;
6aa8b732
AK		 1912 return -1;
1913}
ubuntu-bionic-kernel mirror