projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
KVM: Improve emulation failure reporting
[deliverable/linux.git] / drivers / kvm / x86_emulate.c
CommitLineData
6aa8b732
AK		 1/******************************************************************************
2 * x86_emulate.c
3 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
dcc0766b 9 * privileged instructions:
6aa8b732
AK		 10 *
11 * Copyright (C) 2006 Qumranet
12 *
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
15 *
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
18 *
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
20 */
21
22#ifndef __KERNEL__
23#include <stdio.h>
24#include <stdint.h>
25#include <public/xen.h>
26#define DPRINTF(_f, _a ...) printf( _f , ## _a )
27#else
28#include "kvm.h"
29#define DPRINTF(x...) do {} while (0)
30#endif
31#include "x86_emulate.h"
32#include <linux/module.h>
33
34/*
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
40 * not be handled.
41 */
42
43/* Operand sizes: 8-bit operands or specified/overridden size. */
44#define ByteOp (1<<0) /* 8-bit operands. */
45/* Destination operand type. */
46#define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47#define DstReg (2<<1) /* Register operand. */
48#define DstMem (3<<1) /* Memory operand. */
49#define DstMask (3<<1)
50/* Source operand type. */
51#define SrcNone (0<<3) /* No source operand. */
52#define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53#define SrcReg (1<<3) /* Register operand. */
54#define SrcMem (2<<3) /* Memory operand. */
55#define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56#define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57#define SrcImm (5<<3) /* Immediate operand. */
58#define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59#define SrcMask (7<<3)
60/* Generic ModRM decode. */
61#define ModRM (1<<6)
62/* Destination is only written; never read. */
63#define Mov (1<<7)
038e51de 64#define BitOp (1<<8)
6aa8b732
AK		 65
66static u8 opcode_table[256] = {
67 /* 0x00 - 0x07 */
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
70 0, 0, 0, 0,
71 /* 0x08 - 0x0F */
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
74 0, 0, 0, 0,
75 /* 0x10 - 0x17 */
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
78 0, 0, 0, 0,
79 /* 0x18 - 0x1F */
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
82 0, 0, 0, 0,
83 /* 0x20 - 0x27 */
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
19eb938e 86 SrcImmByte, SrcImm, 0, 0,
6aa8b732
AK		 87 /* 0x28 - 0x2F */
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
90 0, 0, 0, 0,
91 /* 0x30 - 0x37 */
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
94 0, 0, 0, 0,
95 /* 0x38 - 0x3F */
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
98 0, 0, 0, 0,
99 /* 0x40 - 0x4F */
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
7f0aaee0 101 /* 0x50 - 0x57 */
7e778161
NK		 102 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
103 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
7f0aaee0
NK		 104 /* 0x58 - 0x5F */
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
106 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
7d316911 107 /* 0x60 - 0x67 */
6aa8b732 108 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
7d316911
NK		 109 0, 0, 0, 0,
110 /* 0x68 - 0x6F */
111 0, 0, ImplicitOps|Mov, 0,
e70669ab
LV		 112 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
113 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
6aa8b732
AK		 114 /* 0x70 - 0x7F */
115 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
116 /* 0x80 - 0x87 */
117 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
118 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
119 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
120 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
121 /* 0x88 - 0x8F */
122 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
123 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
124 0, 0, 0, DstMem | SrcNone | ModRM | Mov,
125 /* 0x90 - 0x9F */
fd2a7608 126 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps, 0, 0, 0,
6aa8b732
AK		 127 /* 0xA0 - 0xA7 */
128 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
129 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
130 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
131 ByteOp | ImplicitOps, ImplicitOps,
132 /* 0xA8 - 0xAF */
133 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
134 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
135 ByteOp | ImplicitOps, ImplicitOps,
136 /* 0xB0 - 0xBF */
137 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
138 /* 0xC0 - 0xC7 */
d9413cd7
NK		 139 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
140 0, ImplicitOps, 0, 0,
141 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
6aa8b732
AK		 142 /* 0xC8 - 0xCF */
143 0, 0, 0, 0, 0, 0, 0, 0,
144 /* 0xD0 - 0xD7 */
145 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
146 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
147 0, 0, 0, 0,
148 /* 0xD8 - 0xDF */
149 0, 0, 0, 0, 0, 0, 0, 0,
098c937b
NK		 150 /* 0xE0 - 0xE7 */
151 0, 0, 0, 0, 0, 0, 0, 0,
152 /* 0xE8 - 0xEF */
f6eed391 153 ImplicitOps, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps, 0, 0, 0, 0,
6aa8b732
AK		 154 /* 0xF0 - 0xF7 */
155 0, 0, 0, 0,
72d6e5a0
AK		 156 ImplicitOps, 0,
157 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
6aa8b732
AK		 158 /* 0xF8 - 0xFF */
159 0, 0, 0, 0,
160 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
161};
162
038e51de 163static u16 twobyte_table[256] = {
6aa8b732
AK		 164 /* 0x00 - 0x0F */
165 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
687fdbfe 166 0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
6aa8b732
AK		 167 /* 0x10 - 0x1F */
168 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
169 /* 0x20 - 0x2F */
170 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
171 0, 0, 0, 0, 0, 0, 0, 0,
172 /* 0x30 - 0x3F */
35f3f286 173 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
6aa8b732
AK		 174 /* 0x40 - 0x47 */
175 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
176 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
177 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
178 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
179 /* 0x48 - 0x4F */
180 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
181 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
182 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
183 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
184 /* 0x50 - 0x5F */
185 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
186 /* 0x60 - 0x6F */
187 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
188 /* 0x70 - 0x7F */
189 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
190 /* 0x80 - 0x8F */
191 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
192 /* 0x90 - 0x9F */
193 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
194 /* 0xA0 - 0xA7 */
038e51de 195 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732 196 /* 0xA8 - 0xAF */
038e51de 197 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732
AK		 198 /* 0xB0 - 0xB7 */
199 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
038e51de 200 DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 201 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
202 DstReg | SrcMem16 | ModRM | Mov,
203 /* 0xB8 - 0xBF */
038e51de 204 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 205 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
206 DstReg | SrcMem16 | ModRM | Mov,
207 /* 0xC0 - 0xCF */
208 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
209 /* 0xD0 - 0xDF */
210 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
211 /* 0xE0 - 0xEF */
212 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
213 /* 0xF0 - 0xFF */
214 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
215};
216
6aa8b732
AK		 217/* Type, address-of, and value of an instruction's operand. */
218struct operand {
219 enum { OP_REG, OP_MEM, OP_IMM } type;
220 unsigned int bytes;
221 unsigned long val, orig_val, *ptr;
222};
223
224/* EFLAGS bit definitions. */
225#define EFLG_OF (1<<11)
226#define EFLG_DF (1<<10)
227#define EFLG_SF (1<<7)
228#define EFLG_ZF (1<<6)
229#define EFLG_AF (1<<4)
230#define EFLG_PF (1<<2)
231#define EFLG_CF (1<<0)
232
233/*
234 * Instruction emulation:
235 * Most instructions are emulated directly via a fragment of inline assembly
236 * code. This allows us to save/restore EFLAGS and thus very easily pick up
237 * any modified flags.
238 */
239
05b3e0c2 240#if defined(CONFIG_X86_64)
6aa8b732
AK		 241#define _LO32 "k" /* force 32-bit operand */
242#define _STK "%%rsp" /* stack pointer */
243#elif defined(__i386__)
244#define _LO32 "" /* force 32-bit operand */
245#define _STK "%%esp" /* stack pointer */
246#endif
247
248/*
249 * These EFLAGS bits are restored from saved value during emulation, and
250 * any changes are written back to the saved value after emulation.
251 */
252#define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
253
254/* Before executing instruction: restore necessary bits in EFLAGS. */
255#define _PRE_EFLAGS(_sav, _msk, _tmp) \
256 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
257 "push %"_sav"; " \
258 "movl %"_msk",%"_LO32 _tmp"; " \
259 "andl %"_LO32 _tmp",("_STK"); " \
260 "pushf; " \
261 "notl %"_LO32 _tmp"; " \
262 "andl %"_LO32 _tmp",("_STK"); " \
263 "pop %"_tmp"; " \
264 "orl %"_LO32 _tmp",("_STK"); " \
265 "popf; " \
266 /* _sav &= ~msk; */ \
267 "movl %"_msk",%"_LO32 _tmp"; " \
268 "notl %"_LO32 _tmp"; " \
269 "andl %"_LO32 _tmp",%"_sav"; "
270
271/* After executing instruction: write-back necessary bits in EFLAGS. */
272#define _POST_EFLAGS(_sav, _msk, _tmp) \
273 /* _sav |= EFLAGS & _msk; */ \
274 "pushf; " \
275 "pop %"_tmp"; " \
276 "andl %"_msk",%"_LO32 _tmp"; " \
277 "orl %"_LO32 _tmp",%"_sav"; "
278
279/* Raw emulation: instruction has two explicit operands. */
280#define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
281 do { \
282 unsigned long _tmp; \
283 \
284 switch ((_dst).bytes) { \
285 case 2: \
286 __asm__ __volatile__ ( \
287 _PRE_EFLAGS("0","4","2") \
288 _op"w %"_wx"3,%1; " \
289 _POST_EFLAGS("0","4","2") \
290 : "=m" (_eflags), "=m" ((_dst).val), \
291 "=&r" (_tmp) \
292 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
293 break; \
294 case 4: \
295 __asm__ __volatile__ ( \
296 _PRE_EFLAGS("0","4","2") \
297 _op"l %"_lx"3,%1; " \
298 _POST_EFLAGS("0","4","2") \
299 : "=m" (_eflags), "=m" ((_dst).val), \
300 "=&r" (_tmp) \
301 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
302 break; \
303 case 8: \
304 __emulate_2op_8byte(_op, _src, _dst, \
305 _eflags, _qx, _qy); \
306 break; \
307 } \
308 } while (0)
309
310#define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
311 do { \
312 unsigned long _tmp; \
313 switch ( (_dst).bytes ) \
314 { \
315 case 1: \
316 __asm__ __volatile__ ( \
317 _PRE_EFLAGS("0","4","2") \
318 _op"b %"_bx"3,%1; " \
319 _POST_EFLAGS("0","4","2") \
320 : "=m" (_eflags), "=m" ((_dst).val), \
321 "=&r" (_tmp) \
322 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
323 break; \
324 default: \
325 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
326 _wx, _wy, _lx, _ly, _qx, _qy); \
327 break; \
328 } \
329 } while (0)
330
331/* Source operand is byte-sized and may be restricted to just %cl. */
332#define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
333 __emulate_2op(_op, _src, _dst, _eflags, \
334 "b", "c", "b", "c", "b", "c", "b", "c")
335
336/* Source operand is byte, word, long or quad sized. */
337#define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
338 __emulate_2op(_op, _src, _dst, _eflags, \
339 "b", "q", "w", "r", _LO32, "r", "", "r")
340
341/* Source operand is word, long or quad sized. */
342#define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
343 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
344 "w", "r", _LO32, "r", "", "r")
345
346/* Instruction has only one explicit operand (no source operand). */
347#define emulate_1op(_op, _dst, _eflags) \
348 do { \
349 unsigned long _tmp; \
350 \
351 switch ( (_dst).bytes ) \
352 { \
353 case 1: \
354 __asm__ __volatile__ ( \
355 _PRE_EFLAGS("0","3","2") \
356 _op"b %1; " \
357 _POST_EFLAGS("0","3","2") \
358 : "=m" (_eflags), "=m" ((_dst).val), \
359 "=&r" (_tmp) \
360 : "i" (EFLAGS_MASK) ); \
361 break; \
362 case 2: \
363 __asm__ __volatile__ ( \
364 _PRE_EFLAGS("0","3","2") \
365 _op"w %1; " \
366 _POST_EFLAGS("0","3","2") \
367 : "=m" (_eflags), "=m" ((_dst).val), \
368 "=&r" (_tmp) \
369 : "i" (EFLAGS_MASK) ); \
370 break; \
371 case 4: \
372 __asm__ __volatile__ ( \
373 _PRE_EFLAGS("0","3","2") \
374 _op"l %1; " \
375 _POST_EFLAGS("0","3","2") \
376 : "=m" (_eflags), "=m" ((_dst).val), \
377 "=&r" (_tmp) \
378 : "i" (EFLAGS_MASK) ); \
379 break; \
380 case 8: \
381 __emulate_1op_8byte(_op, _dst, _eflags); \
382 break; \
383 } \
384 } while (0)
385
386/* Emulate an instruction with quadword operands (x86/64 only). */
05b3e0c2 387#if defined(CONFIG_X86_64)
6aa8b732
AK		 388#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
389 do { \
390 __asm__ __volatile__ ( \
391 _PRE_EFLAGS("0","4","2") \
392 _op"q %"_qx"3,%1; " \
393 _POST_EFLAGS("0","4","2") \
394 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
395 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
396 } while (0)
397
398#define __emulate_1op_8byte(_op, _dst, _eflags) \
399 do { \
400 __asm__ __volatile__ ( \
401 _PRE_EFLAGS("0","3","2") \
402 _op"q %1; " \
403 _POST_EFLAGS("0","3","2") \
404 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
405 : "i" (EFLAGS_MASK) ); \
406 } while (0)
407
408#elif defined(__i386__)
409#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
410#define __emulate_1op_8byte(_op, _dst, _eflags)
411#endif /* __i386__ */
412
413/* Fetch next part of the instruction being emulated. */
414#define insn_fetch(_type, _size, _eip) \
415({ unsigned long _x; \
416 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
cebff02b 417 (_size), ctxt->vcpu); \
6aa8b732
AK		 418 if ( rc != 0 ) \
419 goto done; \
420 (_eip) += (_size); \
421 (_type)_x; \
422})
423
424/* Access/update address held in a register, based on addressing mode. */
e70669ab
LV		 425#define address_mask(reg) \
426 ((ad_bytes == sizeof(unsigned long)) ? \
427 (reg) : ((reg) & ((1UL << (ad_bytes << 3)) - 1)))
6aa8b732 428#define register_address(base, reg) \
e70669ab 429 ((base) + address_mask(reg))
6aa8b732
AK		 430#define register_address_increment(reg, inc) \
431 do { \
432 /* signed type ensures sign extension to long */ \
433 int _inc = (inc); \
434 if ( ad_bytes == sizeof(unsigned long) ) \
435 (reg) += _inc; \
436 else \
437 (reg) = ((reg) & ~((1UL << (ad_bytes << 3)) - 1)) | \
438 (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
439 } while (0)
440
098c937b
NK		 441#define JMP_REL(rel) \
442 do { \
443 _eip += (int)(rel); \
444 _eip = ((op_bytes == 2) ? (uint16_t)_eip : (uint32_t)_eip); \
445 } while (0)
446
1e3c5cb0
RR		 447/*
448 * Given the 'reg' portion of a ModRM byte, and a register block, return a
449 * pointer into the block that addresses the relevant register.
450 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
451 */
452static void *decode_register(u8 modrm_reg, unsigned long *regs,
453 int highbyte_regs)
6aa8b732
AK		 454{
455 void *p;
456
457 p = &regs[modrm_reg];
458 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
459 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
460 return p;
461}
462
463static int read_descriptor(struct x86_emulate_ctxt *ctxt,
464 struct x86_emulate_ops *ops,
465 void *ptr,
466 u16 *size, unsigned long *address, int op_bytes)
467{
468 int rc;
469
470 if (op_bytes == 2)
471 op_bytes = 3;
472 *address = 0;
cebff02b
LV		 473 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
474 ctxt->vcpu);
6aa8b732
AK		 475 if (rc)
476 return rc;
cebff02b
LV		 477 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
478 ctxt->vcpu);
6aa8b732
AK		 479 return rc;
480}
481
482int
483x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
484{
038e51de
AK		 485 unsigned d;
486 u8 b, sib, twobyte = 0, rex_prefix = 0;
6aa8b732
AK		 487 u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
488 unsigned long *override_base = NULL;
489 unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
490 int rc = 0;
491 struct operand src, dst;
492 unsigned long cr2 = ctxt->cr2;
493 int mode = ctxt->mode;
494 unsigned long modrm_ea;
495 int use_modrm_ea, index_reg = 0, base_reg = 0, scale, rip_relative = 0;
02c03a32 496 int no_wb = 0;
35f3f286 497 u64 msr_data;
6aa8b732
AK		 498
499 /* Shadow copy of register state. Committed on successful emulation. */
500 unsigned long _regs[NR_VCPU_REGS];
501 unsigned long _eip = ctxt->vcpu->rip, _eflags = ctxt->eflags;
502 unsigned long modrm_val = 0;
503
504 memcpy(_regs, ctxt->vcpu->regs, sizeof _regs);
505
506 switch (mode) {
507 case X86EMUL_MODE_REAL:
508 case X86EMUL_MODE_PROT16:
509 op_bytes = ad_bytes = 2;
510 break;
511 case X86EMUL_MODE_PROT32:
512 op_bytes = ad_bytes = 4;
513 break;
05b3e0c2 514#ifdef CONFIG_X86_64
6aa8b732
AK		 515 case X86EMUL_MODE_PROT64:
516 op_bytes = 4;
517 ad_bytes = 8;
518 break;
519#endif
520 default:
521 return -1;
522 }
523
524 /* Legacy prefixes. */
525 for (i = 0; i < 8; i++) {
526 switch (b = insn_fetch(u8, 1, _eip)) {
527 case 0x66: /* operand-size override */
528 op_bytes ^= 6; /* switch between 2/4 bytes */
529 break;
530 case 0x67: /* address-size override */
531 if (mode == X86EMUL_MODE_PROT64)
532 ad_bytes ^= 12; /* switch between 4/8 bytes */
533 else
534 ad_bytes ^= 6; /* switch between 2/4 bytes */
535 break;
536 case 0x2e: /* CS override */
537 override_base = &ctxt->cs_base;
538 break;
539 case 0x3e: /* DS override */
540 override_base = &ctxt->ds_base;
541 break;
542 case 0x26: /* ES override */
543 override_base = &ctxt->es_base;
544 break;
545 case 0x64: /* FS override */
546 override_base = &ctxt->fs_base;
547 break;
548 case 0x65: /* GS override */
549 override_base = &ctxt->gs_base;
550 break;
551 case 0x36: /* SS override */
552 override_base = &ctxt->ss_base;
553 break;
554 case 0xf0: /* LOCK */
555 lock_prefix = 1;
556 break;
557 case 0xf3: /* REP/REPE/REPZ */
558 rep_prefix = 1;
559 break;
560 case 0xf2: /* REPNE/REPNZ */
561 break;
562 default:
563 goto done_prefixes;
564 }
565 }
566
567done_prefixes:
568
569 /* REX prefix. */
570 if ((mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40)) {
571 rex_prefix = b;
572 if (b & 8)
573 op_bytes = 8; /* REX.W */
574 modrm_reg = (b & 4) << 1; /* REX.R */
575 index_reg = (b & 2) << 2; /* REX.X */
576 modrm_rm = base_reg = (b & 1) << 3; /* REG.B */
577 b = insn_fetch(u8, 1, _eip);
578 }
579
580 /* Opcode byte(s). */
581 d = opcode_table[b];
582 if (d == 0) {
583 /* Two-byte opcode? */
584 if (b == 0x0f) {
585 twobyte = 1;
586 b = insn_fetch(u8, 1, _eip);
587 d = twobyte_table[b];
588 }
589
590 /* Unrecognised? */
591 if (d == 0)
592 goto cannot_emulate;
593 }
594
595 /* ModRM and SIB bytes. */
596 if (d & ModRM) {
597 modrm = insn_fetch(u8, 1, _eip);
598 modrm_mod |= (modrm & 0xc0) >> 6;
599 modrm_reg |= (modrm & 0x38) >> 3;
600 modrm_rm |= (modrm & 0x07);
601 modrm_ea = 0;
602 use_modrm_ea = 1;
603
604 if (modrm_mod == 3) {
605 modrm_val = *(unsigned long *)
606 decode_register(modrm_rm, _regs, d & ByteOp);
607 goto modrm_done;
608 }
609
610 if (ad_bytes == 2) {
611 unsigned bx = _regs[VCPU_REGS_RBX];
612 unsigned bp = _regs[VCPU_REGS_RBP];
613 unsigned si = _regs[VCPU_REGS_RSI];
614 unsigned di = _regs[VCPU_REGS_RDI];
615
616 /* 16-bit ModR/M decode. */
617 switch (modrm_mod) {
618 case 0:
619 if (modrm_rm == 6)
620 modrm_ea += insn_fetch(u16, 2, _eip);
621 break;
622 case 1:
623 modrm_ea += insn_fetch(s8, 1, _eip);
624 break;
625 case 2:
626 modrm_ea += insn_fetch(u16, 2, _eip);
627 break;
628 }
629 switch (modrm_rm) {
630 case 0:
631 modrm_ea += bx + si;
632 break;
633 case 1:
634 modrm_ea += bx + di;
635 break;
636 case 2:
637 modrm_ea += bp + si;
638 break;
639 case 3:
640 modrm_ea += bp + di;
641 break;
642 case 4:
643 modrm_ea += si;
644 break;
645 case 5:
646 modrm_ea += di;
647 break;
648 case 6:
649 if (modrm_mod != 0)
650 modrm_ea += bp;
651 break;
652 case 7:
653 modrm_ea += bx;
654 break;
655 }
656 if (modrm_rm == 2 || modrm_rm == 3 ||
657 (modrm_rm == 6 && modrm_mod != 0))
658 if (!override_base)
659 override_base = &ctxt->ss_base;
660 modrm_ea = (u16)modrm_ea;
661 } else {
662 /* 32/64-bit ModR/M decode. */
663 switch (modrm_rm) {
664 case 4:
665 case 12:
666 sib = insn_fetch(u8, 1, _eip);
667 index_reg |= (sib >> 3) & 7;
668 base_reg |= sib & 7;
669 scale = sib >> 6;
670
671 switch (base_reg) {
672 case 5:
673 if (modrm_mod != 0)
674 modrm_ea += _regs[base_reg];
675 else
676 modrm_ea += insn_fetch(s32, 4, _eip);
677 break;
678 default:
679 modrm_ea += _regs[base_reg];
680 }
681 switch (index_reg) {
682 case 4:
683 break;
684 default:
685 modrm_ea += _regs[index_reg] << scale;
686
687 }
688 break;
689 case 5:
690 if (modrm_mod != 0)
691 modrm_ea += _regs[modrm_rm];
692 else if (mode == X86EMUL_MODE_PROT64)
693 rip_relative = 1;
694 break;
695 default:
696 modrm_ea += _regs[modrm_rm];
697 break;
698 }
699 switch (modrm_mod) {
700 case 0:
701 if (modrm_rm == 5)
702 modrm_ea += insn_fetch(s32, 4, _eip);
703 break;
704 case 1:
705 modrm_ea += insn_fetch(s8, 1, _eip);
706 break;
707 case 2:
708 modrm_ea += insn_fetch(s32, 4, _eip);
709 break;
710 }
711 }
712 if (!override_base)
713 override_base = &ctxt->ds_base;
714 if (mode == X86EMUL_MODE_PROT64 &&
715 override_base != &ctxt->fs_base &&
716 override_base != &ctxt->gs_base)
717 override_base = NULL;
718
719 if (override_base)
720 modrm_ea += *override_base;
721
722 if (rip_relative) {
723 modrm_ea += _eip;
724 switch (d & SrcMask) {
725 case SrcImmByte:
726 modrm_ea += 1;
727 break;
728 case SrcImm:
729 if (d & ByteOp)
730 modrm_ea += 1;
731 else
732 if (op_bytes == 8)
733 modrm_ea += 4;
734 else
735 modrm_ea += op_bytes;
736 }
737 }
738 if (ad_bytes != 8)
739 modrm_ea = (u32)modrm_ea;
740 cr2 = modrm_ea;
741 modrm_done:
742 ;
743 }
744
6aa8b732
AK		 745 /*
746 * Decode and fetch the source operand: register, memory
747 * or immediate.
748 */
749 switch (d & SrcMask) {
750 case SrcNone:
751 break;
752 case SrcReg:
753 src.type = OP_REG;
754 if (d & ByteOp) {
755 src.ptr = decode_register(modrm_reg, _regs,
756 (rex_prefix == 0));
757 src.val = src.orig_val = *(u8 *) src.ptr;
758 src.bytes = 1;
759 } else {
760 src.ptr = decode_register(modrm_reg, _regs, 0);
761 switch ((src.bytes = op_bytes)) {
762 case 2:
763 src.val = src.orig_val = *(u16 *) src.ptr;
764 break;
765 case 4:
766 src.val = src.orig_val = *(u32 *) src.ptr;
767 break;
768 case 8:
769 src.val = src.orig_val = *(u64 *) src.ptr;
770 break;
771 }
772 }
773 break;
774 case SrcMem16:
775 src.bytes = 2;
776 goto srcmem_common;
777 case SrcMem32:
778 src.bytes = 4;
779 goto srcmem_common;
780 case SrcMem:
781 src.bytes = (d & ByteOp) ? 1 : op_bytes;
b85b9ee9
RR		 782 /* Don't fetch the address for invlpg: it could be unmapped. */
783 if (twobyte && b == 0x01 && modrm_reg == 7)
784 break;
6aa8b732
AK		 785 srcmem_common:
786 src.type = OP_MEM;
787 src.ptr = (unsigned long *)cr2;
788 if ((rc = ops->read_emulated((unsigned long)src.ptr,
cebff02b 789 &src.val, src.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 790 goto done;
791 src.orig_val = src.val;
792 break;
793 case SrcImm:
794 src.type = OP_IMM;
795 src.ptr = (unsigned long *)_eip;
796 src.bytes = (d & ByteOp) ? 1 : op_bytes;
797 if (src.bytes == 8)
798 src.bytes = 4;
799 /* NB. Immediates are sign-extended as necessary. */
800 switch (src.bytes) {
801 case 1:
802 src.val = insn_fetch(s8, 1, _eip);
803 break;
804 case 2:
805 src.val = insn_fetch(s16, 2, _eip);
806 break;
807 case 4:
808 src.val = insn_fetch(s32, 4, _eip);
809 break;
810 }
811 break;
812 case SrcImmByte:
813 src.type = OP_IMM;
814 src.ptr = (unsigned long *)_eip;
815 src.bytes = 1;
816 src.val = insn_fetch(s8, 1, _eip);
817 break;
818 }
819
038e51de
AK		 820 /* Decode and fetch the destination operand: register or memory. */
821 switch (d & DstMask) {
822 case ImplicitOps:
823 /* Special instructions do their own operand decoding. */
824 goto special_insn;
825 case DstReg:
826 dst.type = OP_REG;
827 if ((d & ByteOp)
394b6e59 828 && !(twobyte && (b == 0xb6 || b == 0xb7))) {
038e51de
AK		 829 dst.ptr = decode_register(modrm_reg, _regs,
830 (rex_prefix == 0));
831 dst.val = *(u8 *) dst.ptr;
832 dst.bytes = 1;
833 } else {
834 dst.ptr = decode_register(modrm_reg, _regs, 0);
835 switch ((dst.bytes = op_bytes)) {
836 case 2:
837 dst.val = *(u16 *)dst.ptr;
838 break;
839 case 4:
840 dst.val = *(u32 *)dst.ptr;
841 break;
842 case 8:
843 dst.val = *(u64 *)dst.ptr;
844 break;
845 }
846 }
847 break;
848 case DstMem:
849 dst.type = OP_MEM;
850 dst.ptr = (unsigned long *)cr2;
851 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
852 if (d & BitOp) {
df513e2c
AK		 853 unsigned long mask = ~(dst.bytes * 8 - 1);
854
855 dst.ptr = (void *)dst.ptr + (src.val & mask) / 8;
038e51de
AK		 856 }
857 if (!(d & Mov) && /* optimisation - avoid slow emulated read */
858 ((rc = ops->read_emulated((unsigned long)dst.ptr,
cebff02b 859 &dst.val, dst.bytes, ctxt->vcpu)) != 0))
038e51de
AK		 860 goto done;
861 break;
862 }
863 dst.orig_val = dst.val;
864
6aa8b732
AK		 865 if (twobyte)
866 goto twobyte_insn;
867
868 switch (b) {
869 case 0x00 ... 0x05:
870 add: /* add */
871 emulate_2op_SrcV("add", src, dst, _eflags);
872 break;
873 case 0x08 ... 0x0d:
874 or: /* or */
875 emulate_2op_SrcV("or", src, dst, _eflags);
876 break;
877 case 0x10 ... 0x15:
878 adc: /* adc */
879 emulate_2op_SrcV("adc", src, dst, _eflags);
880 break;
881 case 0x18 ... 0x1d:
882 sbb: /* sbb */
883 emulate_2op_SrcV("sbb", src, dst, _eflags);
884 break;
19eb938e 885 case 0x20 ... 0x23:
6aa8b732
AK		 886 and: /* and */
887 emulate_2op_SrcV("and", src, dst, _eflags);
888 break;
19eb938e
NK		 889 case 0x24: /* and al imm8 */
890 dst.type = OP_REG;
891 dst.ptr = &_regs[VCPU_REGS_RAX];
892 dst.val = *(u8 *)dst.ptr;
893 dst.bytes = 1;
894 dst.orig_val = dst.val;
895 goto and;
896 case 0x25: /* and ax imm16, or eax imm32 */
897 dst.type = OP_REG;
898 dst.bytes = op_bytes;
899 dst.ptr = &_regs[VCPU_REGS_RAX];
900 if (op_bytes == 2)
901 dst.val = *(u16 *)dst.ptr;
902 else
903 dst.val = *(u32 *)dst.ptr;
904 dst.orig_val = dst.val;
905 goto and;
6aa8b732
AK		 906 case 0x28 ... 0x2d:
907 sub: /* sub */
908 emulate_2op_SrcV("sub", src, dst, _eflags);
909 break;
910 case 0x30 ... 0x35:
911 xor: /* xor */
912 emulate_2op_SrcV("xor", src, dst, _eflags);
913 break;
914 case 0x38 ... 0x3d:
915 cmp: /* cmp */
916 emulate_2op_SrcV("cmp", src, dst, _eflags);
917 break;
918 case 0x63: /* movsxd */
919 if (mode != X86EMUL_MODE_PROT64)
920 goto cannot_emulate;
921 dst.val = (s32) src.val;
922 break;
7d316911
NK		 923 case 0x6a: /* push imm8 */
924 src.val = 0L;
925 src.val = insn_fetch(s8, 1, _eip);
926push:
927 dst.type = OP_MEM;
928 dst.bytes = op_bytes;
929 dst.val = src.val;
930 register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
fd2a7608
NK		 931 dst.ptr = (void *) register_address(ctxt->ss_base,
932 _regs[VCPU_REGS_RSP]);
7d316911 933 break;
6aa8b732
AK		 934 case 0x80 ... 0x83: /* Grp1 */
935 switch (modrm_reg) {
936 case 0:
937 goto add;
938 case 1:
939 goto or;
940 case 2:
941 goto adc;
942 case 3:
943 goto sbb;
944 case 4:
945 goto and;
946 case 5:
947 goto sub;
948 case 6:
949 goto xor;
950 case 7:
951 goto cmp;
952 }
953 break;
954 case 0x84 ... 0x85:
955 test: /* test */
956 emulate_2op_SrcV("test", src, dst, _eflags);
957 break;
958 case 0x86 ... 0x87: /* xchg */
959 /* Write back the register source. */
960 switch (dst.bytes) {
961 case 1:
962 *(u8 *) src.ptr = (u8) dst.val;
963 break;
964 case 2:
965 *(u16 *) src.ptr = (u16) dst.val;
966 break;
967 case 4:
968 *src.ptr = (u32) dst.val;
969 break; /* 64b reg: zero-extend */
970 case 8:
971 *src.ptr = dst.val;
972 break;
973 }
974 /*
975 * Write back the memory destination with implicit LOCK
976 * prefix.
977 */
978 dst.val = src.val;
979 lock_prefix = 1;
980 break;
981 case 0xa0 ... 0xa1: /* mov */
982 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
983 dst.val = src.val;
984 _eip += ad_bytes; /* skip src displacement */
985 break;
986 case 0xa2 ... 0xa3: /* mov */
987 dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
988 _eip += ad_bytes; /* skip dst displacement */
989 break;
990 case 0x88 ... 0x8b: /* mov */
991 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
992 dst.val = src.val;
993 break;
994 case 0x8f: /* pop (sole member of Grp1a) */
995 /* 64-bit mode: POP always pops a 64-bit operand. */
996 if (mode == X86EMUL_MODE_PROT64)
997 dst.bytes = 8;
998 if ((rc = ops->read_std(register_address(ctxt->ss_base,
999 _regs[VCPU_REGS_RSP]),
cebff02b 1000 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 1001 goto done;
1002 register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
1003 break;
1004 case 0xc0 ... 0xc1:
1005 grp2: /* Grp2 */
1006 switch (modrm_reg) {
1007 case 0: /* rol */
1008 emulate_2op_SrcB("rol", src, dst, _eflags);
1009 break;
1010 case 1: /* ror */
1011 emulate_2op_SrcB("ror", src, dst, _eflags);
1012 break;
1013 case 2: /* rcl */
1014 emulate_2op_SrcB("rcl", src, dst, _eflags);
1015 break;
1016 case 3: /* rcr */
1017 emulate_2op_SrcB("rcr", src, dst, _eflags);
1018 break;
1019 case 4: /* sal/shl */
1020 case 6: /* sal/shl */
1021 emulate_2op_SrcB("sal", src, dst, _eflags);
1022 break;
1023 case 5: /* shr */
1024 emulate_2op_SrcB("shr", src, dst, _eflags);
1025 break;
1026 case 7: /* sar */
1027 emulate_2op_SrcB("sar", src, dst, _eflags);
1028 break;
1029 }
1030 break;
1031 case 0xd0 ... 0xd1: /* Grp2 */
1032 src.val = 1;
1033 goto grp2;
1034 case 0xd2 ... 0xd3: /* Grp2 */
1035 src.val = _regs[VCPU_REGS_RCX];
1036 goto grp2;
f6eed391
NK		 1037 case 0xe8: /* call (near) */ {
1038 long int rel;
1039 switch (op_bytes) {
1040 case 2:
1041 rel = insn_fetch(s16, 2, _eip);
1042 break;
1043 case 4:
1044 rel = insn_fetch(s32, 4, _eip);
1045 break;
1046 case 8:
1047 rel = insn_fetch(s64, 8, _eip);
1048 break;
1049 default:
1050 DPRINTF("Call: Invalid op_bytes\n");
1051 goto cannot_emulate;
1052 }
1053 src.val = (unsigned long) _eip;
1054 JMP_REL(rel);
1055 goto push;
1056 }
098c937b 1057 case 0xe9: /* jmp rel */
c53ce170 1058 case 0xeb: /* jmp rel short */
098c937b
NK		 1059 JMP_REL(src.val);
1060 no_wb = 1; /* Disable writeback. */
1061 break;
6aa8b732
AK		 1062 case 0xf6 ... 0xf7: /* Grp3 */
1063 switch (modrm_reg) {
1064 case 0 ... 1: /* test */
1065 /*
1066 * Special case in Grp3: test has an immediate
1067 * source operand.
1068 */
1069 src.type = OP_IMM;
1070 src.ptr = (unsigned long *)_eip;
1071 src.bytes = (d & ByteOp) ? 1 : op_bytes;
1072 if (src.bytes == 8)
1073 src.bytes = 4;
1074 switch (src.bytes) {
1075 case 1:
1076 src.val = insn_fetch(s8, 1, _eip);
1077 break;
1078 case 2:
1079 src.val = insn_fetch(s16, 2, _eip);
1080 break;
1081 case 4:
1082 src.val = insn_fetch(s32, 4, _eip);
1083 break;
1084 }
1085 goto test;
1086 case 2: /* not */
1087 dst.val = ~dst.val;
1088 break;
1089 case 3: /* neg */
1090 emulate_1op("neg", dst, _eflags);
1091 break;
1092 default:
1093 goto cannot_emulate;
1094 }
1095 break;
1096 case 0xfe ... 0xff: /* Grp4/Grp5 */
1097 switch (modrm_reg) {
1098 case 0: /* inc */
1099 emulate_1op("inc", dst, _eflags);
1100 break;
1101 case 1: /* dec */
1102 emulate_1op("dec", dst, _eflags);
1103 break;
1104 case 6: /* push */
1105 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1106 if (mode == X86EMUL_MODE_PROT64) {
1107 dst.bytes = 8;
1108 if ((rc = ops->read_std((unsigned long)dst.ptr,
1109 &dst.val, 8,
cebff02b 1110 ctxt->vcpu)) != 0)
6aa8b732
AK		 1111 goto done;
1112 }
1113 register_address_increment(_regs[VCPU_REGS_RSP],
1114 -dst.bytes);
1115 if ((rc = ops->write_std(
1116 register_address(ctxt->ss_base,
1117 _regs[VCPU_REGS_RSP]),
cebff02b 1118 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732 1119 goto done;
02c03a32 1120 no_wb = 1;
6aa8b732
AK		 1121 break;
1122 default:
1123 goto cannot_emulate;
1124 }
1125 break;
1126 }
1127
1128writeback:
02c03a32 1129 if (!no_wb) {
6aa8b732
AK		 1130 switch (dst.type) {
1131 case OP_REG:
1132 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1133 switch (dst.bytes) {
1134 case 1:
1135 *(u8 *)dst.ptr = (u8)dst.val;
1136 break;
1137 case 2:
1138 *(u16 *)dst.ptr = (u16)dst.val;
1139 break;
1140 case 4:
1141 *dst.ptr = (u32)dst.val;
1142 break; /* 64b: zero-ext */
1143 case 8:
1144 *dst.ptr = dst.val;
1145 break;
1146 }
1147 break;
1148 case OP_MEM:
1149 if (lock_prefix)
1150 rc = ops->cmpxchg_emulated((unsigned long)dst.
4c690a1e
AK		 1151 ptr, &dst.orig_val,
1152 &dst.val, dst.bytes,
cebff02b 1153 ctxt->vcpu);
6aa8b732
AK		 1154 else
1155 rc = ops->write_emulated((unsigned long)dst.ptr,
4c690a1e 1156 &dst.val, dst.bytes,
cebff02b 1157 ctxt->vcpu);
6aa8b732
AK		 1158 if (rc != 0)
1159 goto done;
1160 default:
1161 break;
1162 }
1163 }
1164
1165 /* Commit shadow register state. */
1166 memcpy(ctxt->vcpu->regs, _regs, sizeof _regs);
1167 ctxt->eflags = _eflags;
1168 ctxt->vcpu->rip = _eip;
1169
1170done:
1171 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1172
1173special_insn:
1174 if (twobyte)
1175 goto twobyte_special_insn;
e70669ab 1176 switch(b) {
7e778161
NK		 1177 case 0x50 ... 0x57: /* push reg */
1178 if (op_bytes == 2)
1179 src.val = (u16) _regs[b & 0x7];
1180 else
1181 src.val = (u32) _regs[b & 0x7];
1182 dst.type = OP_MEM;
1183 dst.bytes = op_bytes;
1184 dst.val = src.val;
1185 register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
1186 dst.ptr = (void *) register_address(
1187 ctxt->ss_base, _regs[VCPU_REGS_RSP]);
7e778161 1188 break;
e70669ab
LV		 1189 case 0x6c: /* insb */
1190 case 0x6d: /* insw/insd */
3090dd73 1191 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
e70669ab
LV		 1192 1, /* in */
1193 (d & ByteOp) ? 1 : op_bytes, /* size */
1194 rep_prefix ?
1195 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
e70669ab
LV		 1196 (_eflags & EFLG_DF), /* down */
1197 register_address(ctxt->es_base,
1198 _regs[VCPU_REGS_RDI]), /* address */
1199 rep_prefix,
1200 _regs[VCPU_REGS_RDX] /* port */
1201 ) == 0)
1202 return -1;
1203 return 0;
1204 case 0x6e: /* outsb */
1205 case 0x6f: /* outsw/outsd */
3090dd73 1206 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
e70669ab
LV		 1207 0, /* in */
1208 (d & ByteOp) ? 1 : op_bytes, /* size */
1209 rep_prefix ?
1210 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
e70669ab
LV		 1211 (_eflags & EFLG_DF), /* down */
1212 register_address(override_base ?
1213 *override_base : ctxt->ds_base,
1214 _regs[VCPU_REGS_RSI]), /* address */
1215 rep_prefix,
1216 _regs[VCPU_REGS_RDX] /* port */
1217 ) == 0)
1218 return -1;
1219 return 0;
fd2a7608
NK		 1220
1221 case 0x9c: /* pushf */
1222 src.val = (unsigned long) _eflags;
1223 goto push;
1224 break;
1225
e70669ab 1226 }
6aa8b732
AK		 1227 if (rep_prefix) {
1228 if (_regs[VCPU_REGS_RCX] == 0) {
1229 ctxt->vcpu->rip = _eip;
1230 goto done;
1231 }
1232 _regs[VCPU_REGS_RCX]--;
1233 _eip = ctxt->vcpu->rip;
1234 }
1235 switch (b) {
1236 case 0xa4 ... 0xa5: /* movs */
1237 dst.type = OP_MEM;
1238 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1239 dst.ptr = (unsigned long *)register_address(ctxt->es_base,
1240 _regs[VCPU_REGS_RDI]);
1241 if ((rc = ops->read_emulated(register_address(
1242 override_base ? *override_base : ctxt->ds_base,
cebff02b 1243 _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 1244 goto done;
1245 register_address_increment(_regs[VCPU_REGS_RSI],
1246 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1247 register_address_increment(_regs[VCPU_REGS_RDI],
1248 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1249 break;
1250 case 0xa6 ... 0xa7: /* cmps */
1251 DPRINTF("Urk! I don't handle CMPS.\n");
1252 goto cannot_emulate;
1253 case 0xaa ... 0xab: /* stos */
1254 dst.type = OP_MEM;
1255 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1256 dst.ptr = (unsigned long *)cr2;
1257 dst.val = _regs[VCPU_REGS_RAX];
1258 register_address_increment(_regs[VCPU_REGS_RDI],
1259 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1260 break;
1261 case 0xac ... 0xad: /* lods */
1262 dst.type = OP_REG;
1263 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1264 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
cebff02b
LV		 1265 if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes,
1266 ctxt->vcpu)) != 0)
6aa8b732
AK		 1267 goto done;
1268 register_address_increment(_regs[VCPU_REGS_RSI],
1269 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1270 break;
1271 case 0xae ... 0xaf: /* scas */
1272 DPRINTF("Urk! I don't handle SCAS.\n");
1273 goto cannot_emulate;
72d6e5a0
AK		 1274 case 0xf4: /* hlt */
1275 ctxt->vcpu->halt_request = 1;
1276 goto done;
d9413cd7
NK		 1277 case 0xc3: /* ret */
1278 dst.ptr = &_eip;
1279 goto pop_instruction;
7f0aaee0
NK		 1280 case 0x58 ... 0x5f: /* pop reg */
1281 dst.ptr = (unsigned long *)&_regs[b & 0x7];
1282
d9413cd7 1283pop_instruction:
7f0aaee0 1284 if ((rc = ops->read_std(register_address(ctxt->ss_base,
cebff02b
LV		 1285 _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt->vcpu))
1286 != 0)
7f0aaee0
NK		 1287 goto done;
1288
d9413cd7 1289 register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
02c03a32 1290 no_wb = 1; /* Disable writeback. */
7f0aaee0 1291 break;
6aa8b732
AK		 1292 }
1293 goto writeback;
1294
1295twobyte_insn:
1296 switch (b) {
1297 case 0x01: /* lgdt, lidt, lmsw */
d37c8557
AJ		 1298 /* Disable writeback. */
1299 no_wb = 1;
6aa8b732
AK		 1300 switch (modrm_reg) {
1301 u16 size;
1302 unsigned long address;
1303
1304 case 2: /* lgdt */
1305 rc = read_descriptor(ctxt, ops, src.ptr,
1306 &size, &address, op_bytes);
1307 if (rc)
1308 goto done;
1309 realmode_lgdt(ctxt->vcpu, size, address);
1310 break;
1311 case 3: /* lidt */
1312 rc = read_descriptor(ctxt, ops, src.ptr,
1313 &size, &address, op_bytes);
1314 if (rc)
1315 goto done;
1316 realmode_lidt(ctxt->vcpu, size, address);
1317 break;
1318 case 4: /* smsw */
1319 if (modrm_mod != 3)
1320 goto cannot_emulate;
1321 *(u16 *)&_regs[modrm_rm]
1322 = realmode_get_cr(ctxt->vcpu, 0);
1323 break;
1324 case 6: /* lmsw */
1325 if (modrm_mod != 3)
1326 goto cannot_emulate;
1327 realmode_lmsw(ctxt->vcpu, (u16)modrm_val, &_eflags);
1328 break;
1329 case 7: /* invlpg*/
1330 emulate_invlpg(ctxt->vcpu, cr2);
1331 break;
1332 default:
1333 goto cannot_emulate;
1334 }
1335 break;
1336 case 0x21: /* mov from dr to reg */
bac27d35 1337 no_wb = 1;
6aa8b732
AK		 1338 if (modrm_mod != 3)
1339 goto cannot_emulate;
1340 rc = emulator_get_dr(ctxt, modrm_reg, &_regs[modrm_rm]);
1341 break;
1342 case 0x23: /* mov from reg to dr */
bac27d35 1343 no_wb = 1;
6aa8b732
AK		 1344 if (modrm_mod != 3)
1345 goto cannot_emulate;
1346 rc = emulator_set_dr(ctxt, modrm_reg, _regs[modrm_rm]);
1347 break;
1348 case 0x40 ... 0x4f: /* cmov */
1349 dst.val = dst.orig_val = src.val;
e3243452 1350 no_wb = 1;
6aa8b732
AK		 1351 /*
1352 * First, assume we're decoding an even cmov opcode
1353 * (lsb == 0).
1354 */
1355 switch ((b & 15) >> 1) {
1356 case 0: /* cmovo */
e3243452 1357 no_wb = (_eflags & EFLG_OF) ? 0 : 1;
6aa8b732
AK		 1358 break;
1359 case 1: /* cmovb/cmovc/cmovnae */
e3243452 1360 no_wb = (_eflags & EFLG_CF) ? 0 : 1;
6aa8b732
AK		 1361 break;
1362 case 2: /* cmovz/cmove */
e3243452 1363 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
6aa8b732
AK		 1364 break;
1365 case 3: /* cmovbe/cmovna */
e3243452 1366 no_wb = (_eflags & (EFLG_CF | EFLG_ZF)) ? 0 : 1;
6aa8b732
AK		 1367 break;
1368 case 4: /* cmovs */
e3243452 1369 no_wb = (_eflags & EFLG_SF) ? 0 : 1;
6aa8b732
AK		 1370 break;
1371 case 5: /* cmovp/cmovpe */
e3243452 1372 no_wb = (_eflags & EFLG_PF) ? 0 : 1;
6aa8b732
AK		 1373 break;
1374 case 7: /* cmovle/cmovng */
e3243452 1375 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
6aa8b732
AK		 1376 /* fall through */
1377 case 6: /* cmovl/cmovnge */
e3243452
AK		 1378 no_wb &= (!(_eflags & EFLG_SF) !=
1379 !(_eflags & EFLG_OF)) ? 0 : 1;
6aa8b732
AK		 1380 break;
1381 }
1382 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
e3243452 1383 no_wb ^= b & 1;
6aa8b732
AK		 1384 break;
1385 case 0xb0 ... 0xb1: /* cmpxchg */
1386 /*
1387 * Save real source value, then compare EAX against
1388 * destination.
1389 */
1390 src.orig_val = src.val;
1391 src.val = _regs[VCPU_REGS_RAX];
1392 emulate_2op_SrcV("cmp", src, dst, _eflags);
6aa8b732
AK		 1393 if (_eflags & EFLG_ZF) {
1394 /* Success: write back to memory. */
1395 dst.val = src.orig_val;
1396 } else {
1397 /* Failure: write the value we saw to EAX. */
1398 dst.type = OP_REG;
1399 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1400 }
1401 break;
1402 case 0xa3:
1403 bt: /* bt */
1404 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1405 emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
1406 break;
1407 case 0xb3:
1408 btr: /* btr */
1409 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1410 emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
1411 break;
1412 case 0xab:
1413 bts: /* bts */
1414 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1415 emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
1416 break;
1417 case 0xb6 ... 0xb7: /* movzx */
1418 dst.bytes = op_bytes;
1419 dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
1420 break;
1421 case 0xbb:
1422 btc: /* btc */
1423 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1424 emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
1425 break;
1426 case 0xba: /* Grp8 */
1427 switch (modrm_reg & 3) {
1428 case 0:
1429 goto bt;
1430 case 1:
1431 goto bts;
1432 case 2:
1433 goto btr;
1434 case 3:
1435 goto btc;
1436 }
1437 break;
1438 case 0xbe ... 0xbf: /* movsx */
1439 dst.bytes = op_bytes;
1440 dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
1441 break;
1442 }
1443 goto writeback;
1444
1445twobyte_special_insn:
1446 /* Disable writeback. */
02c03a32 1447 no_wb = 1;
6aa8b732 1448 switch (b) {
687fdbfe
AK		 1449 case 0x09: /* wbinvd */
1450 break;
6aa8b732
AK		 1451 case 0x0d: /* GrpP (prefetch) */
1452 case 0x18: /* Grp16 (prefetch/nop) */
1453 break;
1454 case 0x06:
1455 emulate_clts(ctxt->vcpu);
1456 break;
1457 case 0x20: /* mov cr, reg */
1458 if (modrm_mod != 3)
1459 goto cannot_emulate;
1460 _regs[modrm_rm] = realmode_get_cr(ctxt->vcpu, modrm_reg);
1461 break;
1462 case 0x22: /* mov reg, cr */
1463 if (modrm_mod != 3)
1464 goto cannot_emulate;
1465 realmode_set_cr(ctxt->vcpu, modrm_reg, modrm_val, &_eflags);
1466 break;
35f3f286
AK		 1467 case 0x30:
1468 /* wrmsr */
1469 msr_data = (u32)_regs[VCPU_REGS_RAX]
1470 | ((u64)_regs[VCPU_REGS_RDX] << 32);
1471 rc = kvm_set_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], msr_data);
1472 if (rc) {
cbdd1bea 1473 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
35f3f286
AK		 1474 _eip = ctxt->vcpu->rip;
1475 }
1476 rc = X86EMUL_CONTINUE;
1477 break;
1478 case 0x32:
1479 /* rdmsr */
1480 rc = kvm_get_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], &msr_data);
1481 if (rc) {
cbdd1bea 1482 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
35f3f286
AK		 1483 _eip = ctxt->vcpu->rip;
1484 } else {
1485 _regs[VCPU_REGS_RAX] = (u32)msr_data;
1486 _regs[VCPU_REGS_RDX] = msr_data >> 32;
1487 }
1488 rc = X86EMUL_CONTINUE;
1489 break;
6aa8b732 1490 case 0xc7: /* Grp9 (cmpxchg8b) */
6aa8b732 1491 {
4c690a1e 1492 u64 old, new;
cebff02b
LV		 1493 if ((rc = ops->read_emulated(cr2, &old, 8, ctxt->vcpu))
1494 != 0)
6aa8b732
AK		 1495 goto done;
1496 if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
1497 ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
1498 _regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1499 _regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1500 _eflags &= ~EFLG_ZF;
1501 } else {
4c690a1e
AK		 1502 new = ((u64)_regs[VCPU_REGS_RCX] << 32)
1503 | (u32) _regs[VCPU_REGS_RBX];
1504 if ((rc = ops->cmpxchg_emulated(cr2, &old,
cebff02b 1505 &new, 8, ctxt->vcpu)) != 0)
6aa8b732
AK		 1506 goto done;
1507 _eflags |= EFLG_ZF;
1508 }
1509 break;
1510 }
6aa8b732
AK		 1511 }
1512 goto writeback;
1513
1514cannot_emulate:
1515 DPRINTF("Cannot emulate %02x\n", b);
1516 return -1;
1517}
1518
1519#ifdef __XEN__
1520
1521#include <asm/mm.h>
1522#include <asm/uaccess.h>
1523
1524int
1525x86_emulate_read_std(unsigned long addr,
1526 unsigned long *val,
1527 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1528{
1529 unsigned int rc;
1530
1531 *val = 0;
1532
1533 if ((rc = copy_from_user((void *)val, (void *)addr, bytes)) != 0) {
1534 propagate_page_fault(addr + bytes - rc, 0); /* read fault */
1535 return X86EMUL_PROPAGATE_FAULT;
1536 }
1537
1538 return X86EMUL_CONTINUE;
1539}
1540
1541int
1542x86_emulate_write_std(unsigned long addr,
1543 unsigned long val,
1544 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1545{
1546 unsigned int rc;
1547
1548 if ((rc = copy_to_user((void *)addr, (void *)&val, bytes)) != 0) {
1549 propagate_page_fault(addr + bytes - rc, PGERR_write_access);
1550 return X86EMUL_PROPAGATE_FAULT;
1551 }
1552
1553 return X86EMUL_CONTINUE;
1554}
1555
1556#endif
Linux kernel - Deliverables
This page took 0.193786 seconds and 5 git commands to generate.