projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
KVM: x86 emulator: imlpement jump conditional relative
[deliverable/linux.git] / drivers / kvm / x86_emulate.c
1 /******************************************************************************
2 * x86_emulate.c
3 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
10 *
11 * Copyright (C) 2006 Qumranet
12 *
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
15 *
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
18 *
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
20 */
21
22 #ifndef __KERNEL__
23 #include <stdio.h>
24 #include <stdint.h>
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf( _f , ## _a )
27 #else
28 #include "kvm.h"
29 #define DPRINTF(x...) do {} while (0)
30 #endif
31 #include "x86_emulate.h"
32 #include <linux/module.h>
33
34 /*
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
40 * not be handled.
41 */
42
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
61 #define ModRM (1<<6)
62 /* Destination is only written; never read. */
63 #define Mov (1<<7)
64 #define BitOp (1<<8)
65
66 static u8 opcode_table[256] = {
67 /* 0x00 - 0x07 */
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
70 0, 0, 0, 0,
71 /* 0x08 - 0x0F */
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
74 0, 0, 0, 0,
75 /* 0x10 - 0x17 */
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
78 0, 0, 0, 0,
79 /* 0x18 - 0x1F */
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
82 0, 0, 0, 0,
83 /* 0x20 - 0x27 */
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 SrcImmByte, SrcImm, 0, 0,
87 /* 0x28 - 0x2F */
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
90 0, 0, 0, 0,
91 /* 0x30 - 0x37 */
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
94 0, 0, 0, 0,
95 /* 0x38 - 0x3F */
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
98 0, 0, 0, 0,
99 /* 0x40 - 0x4F */
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
101 /* 0x50 - 0x57 */
102 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
103 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
104 /* 0x58 - 0x5F */
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
106 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
107 /* 0x60 - 0x67 */
108 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
109 0, 0, 0, 0,
110 /* 0x68 - 0x6F */
111 0, 0, ImplicitOps|Mov, 0,
112 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
113 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
114 /* 0x70 - 0x7F */
115 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
116 /* 0x80 - 0x87 */
117 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
118 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
119 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
120 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
121 /* 0x88 - 0x8F */
122 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
123 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
124 0, 0, 0, DstMem | SrcNone | ModRM | Mov,
125 /* 0x90 - 0x9F */
126 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps, 0, 0, 0,
127 /* 0xA0 - 0xA7 */
128 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
129 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
130 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
131 ByteOp | ImplicitOps, ImplicitOps,
132 /* 0xA8 - 0xAF */
133 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
134 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
135 ByteOp | ImplicitOps, ImplicitOps,
136 /* 0xB0 - 0xBF */
137 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
138 /* 0xC0 - 0xC7 */
139 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
140 0, ImplicitOps, 0, 0,
141 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
142 /* 0xC8 - 0xCF */
143 0, 0, 0, 0, 0, 0, 0, 0,
144 /* 0xD0 - 0xD7 */
145 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
146 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
147 0, 0, 0, 0,
148 /* 0xD8 - 0xDF */
149 0, 0, 0, 0, 0, 0, 0, 0,
150 /* 0xE0 - 0xE7 */
151 0, 0, 0, 0, 0, 0, 0, 0,
152 /* 0xE8 - 0xEF */
153 ImplicitOps, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps, 0, 0, 0, 0,
154 /* 0xF0 - 0xF7 */
155 0, 0, 0, 0,
156 ImplicitOps, 0,
157 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
158 /* 0xF8 - 0xFF */
159 0, 0, 0, 0,
160 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
161 };
162
163 static u16 twobyte_table[256] = {
164 /* 0x00 - 0x0F */
165 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
166 0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
167 /* 0x10 - 0x1F */
168 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
169 /* 0x20 - 0x2F */
170 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
171 0, 0, 0, 0, 0, 0, 0, 0,
172 /* 0x30 - 0x3F */
173 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
174 /* 0x40 - 0x47 */
175 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
176 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
177 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
178 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
179 /* 0x48 - 0x4F */
180 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
181 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
182 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
183 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
184 /* 0x50 - 0x5F */
185 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
186 /* 0x60 - 0x6F */
187 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
188 /* 0x70 - 0x7F */
189 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
190 /* 0x80 - 0x8F */
191 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
192 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
193 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
194 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
195 /* 0x90 - 0x9F */
196 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
197 /* 0xA0 - 0xA7 */
198 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
199 /* 0xA8 - 0xAF */
200 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
201 /* 0xB0 - 0xB7 */
202 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
203 DstMem | SrcReg | ModRM | BitOp,
204 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
205 DstReg | SrcMem16 | ModRM | Mov,
206 /* 0xB8 - 0xBF */
207 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
208 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
209 DstReg | SrcMem16 | ModRM | Mov,
210 /* 0xC0 - 0xCF */
211 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
212 /* 0xD0 - 0xDF */
213 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
214 /* 0xE0 - 0xEF */
215 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
216 /* 0xF0 - 0xFF */
217 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
218 };
219
220 /* Type, address-of, and value of an instruction's operand. */
221 struct operand {
222 enum { OP_REG, OP_MEM, OP_IMM } type;
223 unsigned int bytes;
224 unsigned long val, orig_val, *ptr;
225 };
226
227 /* EFLAGS bit definitions. */
228 #define EFLG_OF (1<<11)
229 #define EFLG_DF (1<<10)
230 #define EFLG_SF (1<<7)
231 #define EFLG_ZF (1<<6)
232 #define EFLG_AF (1<<4)
233 #define EFLG_PF (1<<2)
234 #define EFLG_CF (1<<0)
235
236 /*
237 * Instruction emulation:
238 * Most instructions are emulated directly via a fragment of inline assembly
239 * code. This allows us to save/restore EFLAGS and thus very easily pick up
240 * any modified flags.
241 */
242
243 #if defined(CONFIG_X86_64)
244 #define _LO32 "k" /* force 32-bit operand */
245 #define _STK "%%rsp" /* stack pointer */
246 #elif defined(__i386__)
247 #define _LO32 "" /* force 32-bit operand */
248 #define _STK "%%esp" /* stack pointer */
249 #endif
250
251 /*
252 * These EFLAGS bits are restored from saved value during emulation, and
253 * any changes are written back to the saved value after emulation.
254 */
255 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
256
257 /* Before executing instruction: restore necessary bits in EFLAGS. */
258 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
259 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
260 "push %"_sav"; " \
261 "movl %"_msk",%"_LO32 _tmp"; " \
262 "andl %"_LO32 _tmp",("_STK"); " \
263 "pushf; " \
264 "notl %"_LO32 _tmp"; " \
265 "andl %"_LO32 _tmp",("_STK"); " \
266 "pop %"_tmp"; " \
267 "orl %"_LO32 _tmp",("_STK"); " \
268 "popf; " \
269 /* _sav &= ~msk; */ \
270 "movl %"_msk",%"_LO32 _tmp"; " \
271 "notl %"_LO32 _tmp"; " \
272 "andl %"_LO32 _tmp",%"_sav"; "
273
274 /* After executing instruction: write-back necessary bits in EFLAGS. */
275 #define _POST_EFLAGS(_sav, _msk, _tmp) \
276 /* _sav |= EFLAGS & _msk; */ \
277 "pushf; " \
278 "pop %"_tmp"; " \
279 "andl %"_msk",%"_LO32 _tmp"; " \
280 "orl %"_LO32 _tmp",%"_sav"; "
281
282 /* Raw emulation: instruction has two explicit operands. */
283 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
284 do { \
285 unsigned long _tmp; \
286 \
287 switch ((_dst).bytes) { \
288 case 2: \
289 __asm__ __volatile__ ( \
290 _PRE_EFLAGS("0","4","2") \
291 _op"w %"_wx"3,%1; " \
292 _POST_EFLAGS("0","4","2") \
293 : "=m" (_eflags), "=m" ((_dst).val), \
294 "=&r" (_tmp) \
295 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
296 break; \
297 case 4: \
298 __asm__ __volatile__ ( \
299 _PRE_EFLAGS("0","4","2") \
300 _op"l %"_lx"3,%1; " \
301 _POST_EFLAGS("0","4","2") \
302 : "=m" (_eflags), "=m" ((_dst).val), \
303 "=&r" (_tmp) \
304 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
305 break; \
306 case 8: \
307 __emulate_2op_8byte(_op, _src, _dst, \
308 _eflags, _qx, _qy); \
309 break; \
310 } \
311 } while (0)
312
313 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
314 do { \
315 unsigned long _tmp; \
316 switch ( (_dst).bytes ) \
317 { \
318 case 1: \
319 __asm__ __volatile__ ( \
320 _PRE_EFLAGS("0","4","2") \
321 _op"b %"_bx"3,%1; " \
322 _POST_EFLAGS("0","4","2") \
323 : "=m" (_eflags), "=m" ((_dst).val), \
324 "=&r" (_tmp) \
325 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
326 break; \
327 default: \
328 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
329 _wx, _wy, _lx, _ly, _qx, _qy); \
330 break; \
331 } \
332 } while (0)
333
334 /* Source operand is byte-sized and may be restricted to just %cl. */
335 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
336 __emulate_2op(_op, _src, _dst, _eflags, \
337 "b", "c", "b", "c", "b", "c", "b", "c")
338
339 /* Source operand is byte, word, long or quad sized. */
340 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
341 __emulate_2op(_op, _src, _dst, _eflags, \
342 "b", "q", "w", "r", _LO32, "r", "", "r")
343
344 /* Source operand is word, long or quad sized. */
345 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
346 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
347 "w", "r", _LO32, "r", "", "r")
348
349 /* Instruction has only one explicit operand (no source operand). */
350 #define emulate_1op(_op, _dst, _eflags) \
351 do { \
352 unsigned long _tmp; \
353 \
354 switch ( (_dst).bytes ) \
355 { \
356 case 1: \
357 __asm__ __volatile__ ( \
358 _PRE_EFLAGS("0","3","2") \
359 _op"b %1; " \
360 _POST_EFLAGS("0","3","2") \
361 : "=m" (_eflags), "=m" ((_dst).val), \
362 "=&r" (_tmp) \
363 : "i" (EFLAGS_MASK) ); \
364 break; \
365 case 2: \
366 __asm__ __volatile__ ( \
367 _PRE_EFLAGS("0","3","2") \
368 _op"w %1; " \
369 _POST_EFLAGS("0","3","2") \
370 : "=m" (_eflags), "=m" ((_dst).val), \
371 "=&r" (_tmp) \
372 : "i" (EFLAGS_MASK) ); \
373 break; \
374 case 4: \
375 __asm__ __volatile__ ( \
376 _PRE_EFLAGS("0","3","2") \
377 _op"l %1; " \
378 _POST_EFLAGS("0","3","2") \
379 : "=m" (_eflags), "=m" ((_dst).val), \
380 "=&r" (_tmp) \
381 : "i" (EFLAGS_MASK) ); \
382 break; \
383 case 8: \
384 __emulate_1op_8byte(_op, _dst, _eflags); \
385 break; \
386 } \
387 } while (0)
388
389 /* Emulate an instruction with quadword operands (x86/64 only). */
390 #if defined(CONFIG_X86_64)
391 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
392 do { \
393 __asm__ __volatile__ ( \
394 _PRE_EFLAGS("0","4","2") \
395 _op"q %"_qx"3,%1; " \
396 _POST_EFLAGS("0","4","2") \
397 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
398 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
399 } while (0)
400
401 #define __emulate_1op_8byte(_op, _dst, _eflags) \
402 do { \
403 __asm__ __volatile__ ( \
404 _PRE_EFLAGS("0","3","2") \
405 _op"q %1; " \
406 _POST_EFLAGS("0","3","2") \
407 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
408 : "i" (EFLAGS_MASK) ); \
409 } while (0)
410
411 #elif defined(__i386__)
412 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
413 #define __emulate_1op_8byte(_op, _dst, _eflags)
414 #endif /* __i386__ */
415
416 /* Fetch next part of the instruction being emulated. */
417 #define insn_fetch(_type, _size, _eip) \
418 ({ unsigned long _x; \
419 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
420 (_size), ctxt->vcpu); \
421 if ( rc != 0 ) \
422 goto done; \
423 (_eip) += (_size); \
424 (_type)_x; \
425 })
426
427 /* Access/update address held in a register, based on addressing mode. */
428 #define address_mask(reg) \
429 ((ad_bytes == sizeof(unsigned long)) ? \
430 (reg) : ((reg) & ((1UL << (ad_bytes << 3)) - 1)))
431 #define register_address(base, reg) \
432 ((base) + address_mask(reg))
433 #define register_address_increment(reg, inc) \
434 do { \
435 /* signed type ensures sign extension to long */ \
436 int _inc = (inc); \
437 if ( ad_bytes == sizeof(unsigned long) ) \
438 (reg) += _inc; \
439 else \
440 (reg) = ((reg) & ~((1UL << (ad_bytes << 3)) - 1)) | \
441 (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
442 } while (0)
443
444 #define JMP_REL(rel) \
445 do { \
446 _eip += (int)(rel); \
447 _eip = ((op_bytes == 2) ? (uint16_t)_eip : (uint32_t)_eip); \
448 } while (0)
449
450 /*
451 * Given the 'reg' portion of a ModRM byte, and a register block, return a
452 * pointer into the block that addresses the relevant register.
453 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
454 */
455 static void *decode_register(u8 modrm_reg, unsigned long *regs,
456 int highbyte_regs)
457 {
458 void *p;
459
460 p = &regs[modrm_reg];
461 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
462 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
463 return p;
464 }
465
466 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
467 struct x86_emulate_ops *ops,
468 void *ptr,
469 u16 *size, unsigned long *address, int op_bytes)
470 {
471 int rc;
472
473 if (op_bytes == 2)
474 op_bytes = 3;
475 *address = 0;
476 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
477 ctxt->vcpu);
478 if (rc)
479 return rc;
480 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
481 ctxt->vcpu);
482 return rc;
483 }
484
485 static int test_cc(unsigned int condition, unsigned int flags)
486 {
487 int rc = 0;
488
489 switch ((condition & 15) >> 1) {
490 case 0: /* o */
491 rc |= (flags & EFLG_OF);
492 break;
493 case 1: /* b/c/nae */
494 rc |= (flags & EFLG_CF);
495 break;
496 case 2: /* z/e */
497 rc |= (flags & EFLG_ZF);
498 break;
499 case 3: /* be/na */
500 rc |= (flags & (EFLG_CF|EFLG_ZF));
501 break;
502 case 4: /* s */
503 rc |= (flags & EFLG_SF);
504 break;
505 case 5: /* p/pe */
506 rc |= (flags & EFLG_PF);
507 break;
508 case 7: /* le/ng */
509 rc |= (flags & EFLG_ZF);
510 /* fall through */
511 case 6: /* l/nge */
512 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
513 break;
514 }
515
516 /* Odd condition identifiers (lsb == 1) have inverted sense. */
517 return (!!rc ^ (condition & 1));
518 }
519
520 int
521 x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
522 {
523 unsigned d;
524 u8 b, sib, twobyte = 0, rex_prefix = 0;
525 u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
526 unsigned long *override_base = NULL;
527 unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
528 int rc = 0;
529 struct operand src, dst;
530 unsigned long cr2 = ctxt->cr2;
531 int mode = ctxt->mode;
532 unsigned long modrm_ea;
533 int use_modrm_ea, index_reg = 0, base_reg = 0, scale, rip_relative = 0;
534 int no_wb = 0;
535 u64 msr_data;
536
537 /* Shadow copy of register state. Committed on successful emulation. */
538 unsigned long _regs[NR_VCPU_REGS];
539 unsigned long _eip = ctxt->vcpu->rip, _eflags = ctxt->eflags;
540 unsigned long modrm_val = 0;
541
542 memcpy(_regs, ctxt->vcpu->regs, sizeof _regs);
543
544 switch (mode) {
545 case X86EMUL_MODE_REAL:
546 case X86EMUL_MODE_PROT16:
547 op_bytes = ad_bytes = 2;
548 break;
549 case X86EMUL_MODE_PROT32:
550 op_bytes = ad_bytes = 4;
551 break;
552 #ifdef CONFIG_X86_64
553 case X86EMUL_MODE_PROT64:
554 op_bytes = 4;
555 ad_bytes = 8;
556 break;
557 #endif
558 default:
559 return -1;
560 }
561
562 /* Legacy prefixes. */
563 for (i = 0; i < 8; i++) {
564 switch (b = insn_fetch(u8, 1, _eip)) {
565 case 0x66: /* operand-size override */
566 op_bytes ^= 6; /* switch between 2/4 bytes */
567 break;
568 case 0x67: /* address-size override */
569 if (mode == X86EMUL_MODE_PROT64)
570 ad_bytes ^= 12; /* switch between 4/8 bytes */
571 else
572 ad_bytes ^= 6; /* switch between 2/4 bytes */
573 break;
574 case 0x2e: /* CS override */
575 override_base = &ctxt->cs_base;
576 break;
577 case 0x3e: /* DS override */
578 override_base = &ctxt->ds_base;
579 break;
580 case 0x26: /* ES override */
581 override_base = &ctxt->es_base;
582 break;
583 case 0x64: /* FS override */
584 override_base = &ctxt->fs_base;
585 break;
586 case 0x65: /* GS override */
587 override_base = &ctxt->gs_base;
588 break;
589 case 0x36: /* SS override */
590 override_base = &ctxt->ss_base;
591 break;
592 case 0xf0: /* LOCK */
593 lock_prefix = 1;
594 break;
595 case 0xf3: /* REP/REPE/REPZ */
596 rep_prefix = 1;
597 break;
598 case 0xf2: /* REPNE/REPNZ */
599 break;
600 default:
601 goto done_prefixes;
602 }
603 }
604
605 done_prefixes:
606
607 /* REX prefix. */
608 if ((mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40)) {
609 rex_prefix = b;
610 if (b & 8)
611 op_bytes = 8; /* REX.W */
612 modrm_reg = (b & 4) << 1; /* REX.R */
613 index_reg = (b & 2) << 2; /* REX.X */
614 modrm_rm = base_reg = (b & 1) << 3; /* REG.B */
615 b = insn_fetch(u8, 1, _eip);
616 }
617
618 /* Opcode byte(s). */
619 d = opcode_table[b];
620 if (d == 0) {
621 /* Two-byte opcode? */
622 if (b == 0x0f) {
623 twobyte = 1;
624 b = insn_fetch(u8, 1, _eip);
625 d = twobyte_table[b];
626 }
627
628 /* Unrecognised? */
629 if (d == 0)
630 goto cannot_emulate;
631 }
632
633 /* ModRM and SIB bytes. */
634 if (d & ModRM) {
635 modrm = insn_fetch(u8, 1, _eip);
636 modrm_mod |= (modrm & 0xc0) >> 6;
637 modrm_reg |= (modrm & 0x38) >> 3;
638 modrm_rm |= (modrm & 0x07);
639 modrm_ea = 0;
640 use_modrm_ea = 1;
641
642 if (modrm_mod == 3) {
643 modrm_val = *(unsigned long *)
644 decode_register(modrm_rm, _regs, d & ByteOp);
645 goto modrm_done;
646 }
647
648 if (ad_bytes == 2) {
649 unsigned bx = _regs[VCPU_REGS_RBX];
650 unsigned bp = _regs[VCPU_REGS_RBP];
651 unsigned si = _regs[VCPU_REGS_RSI];
652 unsigned di = _regs[VCPU_REGS_RDI];
653
654 /* 16-bit ModR/M decode. */
655 switch (modrm_mod) {
656 case 0:
657 if (modrm_rm == 6)
658 modrm_ea += insn_fetch(u16, 2, _eip);
659 break;
660 case 1:
661 modrm_ea += insn_fetch(s8, 1, _eip);
662 break;
663 case 2:
664 modrm_ea += insn_fetch(u16, 2, _eip);
665 break;
666 }
667 switch (modrm_rm) {
668 case 0:
669 modrm_ea += bx + si;
670 break;
671 case 1:
672 modrm_ea += bx + di;
673 break;
674 case 2:
675 modrm_ea += bp + si;
676 break;
677 case 3:
678 modrm_ea += bp + di;
679 break;
680 case 4:
681 modrm_ea += si;
682 break;
683 case 5:
684 modrm_ea += di;
685 break;
686 case 6:
687 if (modrm_mod != 0)
688 modrm_ea += bp;
689 break;
690 case 7:
691 modrm_ea += bx;
692 break;
693 }
694 if (modrm_rm == 2 || modrm_rm == 3 ||
695 (modrm_rm == 6 && modrm_mod != 0))
696 if (!override_base)
697 override_base = &ctxt->ss_base;
698 modrm_ea = (u16)modrm_ea;
699 } else {
700 /* 32/64-bit ModR/M decode. */
701 switch (modrm_rm) {
702 case 4:
703 case 12:
704 sib = insn_fetch(u8, 1, _eip);
705 index_reg |= (sib >> 3) & 7;
706 base_reg |= sib & 7;
707 scale = sib >> 6;
708
709 switch (base_reg) {
710 case 5:
711 if (modrm_mod != 0)
712 modrm_ea += _regs[base_reg];
713 else
714 modrm_ea += insn_fetch(s32, 4, _eip);
715 break;
716 default:
717 modrm_ea += _regs[base_reg];
718 }
719 switch (index_reg) {
720 case 4:
721 break;
722 default:
723 modrm_ea += _regs[index_reg] << scale;
724
725 }
726 break;
727 case 5:
728 if (modrm_mod != 0)
729 modrm_ea += _regs[modrm_rm];
730 else if (mode == X86EMUL_MODE_PROT64)
731 rip_relative = 1;
732 break;
733 default:
734 modrm_ea += _regs[modrm_rm];
735 break;
736 }
737 switch (modrm_mod) {
738 case 0:
739 if (modrm_rm == 5)
740 modrm_ea += insn_fetch(s32, 4, _eip);
741 break;
742 case 1:
743 modrm_ea += insn_fetch(s8, 1, _eip);
744 break;
745 case 2:
746 modrm_ea += insn_fetch(s32, 4, _eip);
747 break;
748 }
749 }
750 if (!override_base)
751 override_base = &ctxt->ds_base;
752 if (mode == X86EMUL_MODE_PROT64 &&
753 override_base != &ctxt->fs_base &&
754 override_base != &ctxt->gs_base)
755 override_base = NULL;
756
757 if (override_base)
758 modrm_ea += *override_base;
759
760 if (rip_relative) {
761 modrm_ea += _eip;
762 switch (d & SrcMask) {
763 case SrcImmByte:
764 modrm_ea += 1;
765 break;
766 case SrcImm:
767 if (d & ByteOp)
768 modrm_ea += 1;
769 else
770 if (op_bytes == 8)
771 modrm_ea += 4;
772 else
773 modrm_ea += op_bytes;
774 }
775 }
776 if (ad_bytes != 8)
777 modrm_ea = (u32)modrm_ea;
778 cr2 = modrm_ea;
779 modrm_done:
780 ;
781 }
782
783 /*
784 * Decode and fetch the source operand: register, memory
785 * or immediate.
786 */
787 switch (d & SrcMask) {
788 case SrcNone:
789 break;
790 case SrcReg:
791 src.type = OP_REG;
792 if (d & ByteOp) {
793 src.ptr = decode_register(modrm_reg, _regs,
794 (rex_prefix == 0));
795 src.val = src.orig_val = *(u8 *) src.ptr;
796 src.bytes = 1;
797 } else {
798 src.ptr = decode_register(modrm_reg, _regs, 0);
799 switch ((src.bytes = op_bytes)) {
800 case 2:
801 src.val = src.orig_val = *(u16 *) src.ptr;
802 break;
803 case 4:
804 src.val = src.orig_val = *(u32 *) src.ptr;
805 break;
806 case 8:
807 src.val = src.orig_val = *(u64 *) src.ptr;
808 break;
809 }
810 }
811 break;
812 case SrcMem16:
813 src.bytes = 2;
814 goto srcmem_common;
815 case SrcMem32:
816 src.bytes = 4;
817 goto srcmem_common;
818 case SrcMem:
819 src.bytes = (d & ByteOp) ? 1 : op_bytes;
820 /* Don't fetch the address for invlpg: it could be unmapped. */
821 if (twobyte && b == 0x01 && modrm_reg == 7)
822 break;
823 srcmem_common:
824 src.type = OP_MEM;
825 src.ptr = (unsigned long *)cr2;
826 if ((rc = ops->read_emulated((unsigned long)src.ptr,
827 &src.val, src.bytes, ctxt->vcpu)) != 0)
828 goto done;
829 src.orig_val = src.val;
830 break;
831 case SrcImm:
832 src.type = OP_IMM;
833 src.ptr = (unsigned long *)_eip;
834 src.bytes = (d & ByteOp) ? 1 : op_bytes;
835 if (src.bytes == 8)
836 src.bytes = 4;
837 /* NB. Immediates are sign-extended as necessary. */
838 switch (src.bytes) {
839 case 1:
840 src.val = insn_fetch(s8, 1, _eip);
841 break;
842 case 2:
843 src.val = insn_fetch(s16, 2, _eip);
844 break;
845 case 4:
846 src.val = insn_fetch(s32, 4, _eip);
847 break;
848 }
849 break;
850 case SrcImmByte:
851 src.type = OP_IMM;
852 src.ptr = (unsigned long *)_eip;
853 src.bytes = 1;
854 src.val = insn_fetch(s8, 1, _eip);
855 break;
856 }
857
858 /* Decode and fetch the destination operand: register or memory. */
859 switch (d & DstMask) {
860 case ImplicitOps:
861 /* Special instructions do their own operand decoding. */
862 goto special_insn;
863 case DstReg:
864 dst.type = OP_REG;
865 if ((d & ByteOp)
866 && !(twobyte && (b == 0xb6 || b == 0xb7))) {
867 dst.ptr = decode_register(modrm_reg, _regs,
868 (rex_prefix == 0));
869 dst.val = *(u8 *) dst.ptr;
870 dst.bytes = 1;
871 } else {
872 dst.ptr = decode_register(modrm_reg, _regs, 0);
873 switch ((dst.bytes = op_bytes)) {
874 case 2:
875 dst.val = *(u16 *)dst.ptr;
876 break;
877 case 4:
878 dst.val = *(u32 *)dst.ptr;
879 break;
880 case 8:
881 dst.val = *(u64 *)dst.ptr;
882 break;
883 }
884 }
885 break;
886 case DstMem:
887 dst.type = OP_MEM;
888 dst.ptr = (unsigned long *)cr2;
889 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
890 if (d & BitOp) {
891 unsigned long mask = ~(dst.bytes * 8 - 1);
892
893 dst.ptr = (void *)dst.ptr + (src.val & mask) / 8;
894 }
895 if (!(d & Mov) && /* optimisation - avoid slow emulated read */
896 ((rc = ops->read_emulated((unsigned long)dst.ptr,
897 &dst.val, dst.bytes, ctxt->vcpu)) != 0))
898 goto done;
899 break;
900 }
901 dst.orig_val = dst.val;
902
903 if (twobyte)
904 goto twobyte_insn;
905
906 switch (b) {
907 case 0x00 ... 0x05:
908 add: /* add */
909 emulate_2op_SrcV("add", src, dst, _eflags);
910 break;
911 case 0x08 ... 0x0d:
912 or: /* or */
913 emulate_2op_SrcV("or", src, dst, _eflags);
914 break;
915 case 0x10 ... 0x15:
916 adc: /* adc */
917 emulate_2op_SrcV("adc", src, dst, _eflags);
918 break;
919 case 0x18 ... 0x1d:
920 sbb: /* sbb */
921 emulate_2op_SrcV("sbb", src, dst, _eflags);
922 break;
923 case 0x20 ... 0x23:
924 and: /* and */
925 emulate_2op_SrcV("and", src, dst, _eflags);
926 break;
927 case 0x24: /* and al imm8 */
928 dst.type = OP_REG;
929 dst.ptr = &_regs[VCPU_REGS_RAX];
930 dst.val = *(u8 *)dst.ptr;
931 dst.bytes = 1;
932 dst.orig_val = dst.val;
933 goto and;
934 case 0x25: /* and ax imm16, or eax imm32 */
935 dst.type = OP_REG;
936 dst.bytes = op_bytes;
937 dst.ptr = &_regs[VCPU_REGS_RAX];
938 if (op_bytes == 2)
939 dst.val = *(u16 *)dst.ptr;
940 else
941 dst.val = *(u32 *)dst.ptr;
942 dst.orig_val = dst.val;
943 goto and;
944 case 0x28 ... 0x2d:
945 sub: /* sub */
946 emulate_2op_SrcV("sub", src, dst, _eflags);
947 break;
948 case 0x30 ... 0x35:
949 xor: /* xor */
950 emulate_2op_SrcV("xor", src, dst, _eflags);
951 break;
952 case 0x38 ... 0x3d:
953 cmp: /* cmp */
954 emulate_2op_SrcV("cmp", src, dst, _eflags);
955 break;
956 case 0x63: /* movsxd */
957 if (mode != X86EMUL_MODE_PROT64)
958 goto cannot_emulate;
959 dst.val = (s32) src.val;
960 break;
961 case 0x6a: /* push imm8 */
962 src.val = 0L;
963 src.val = insn_fetch(s8, 1, _eip);
964 push:
965 dst.type = OP_MEM;
966 dst.bytes = op_bytes;
967 dst.val = src.val;
968 register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
969 dst.ptr = (void *) register_address(ctxt->ss_base,
970 _regs[VCPU_REGS_RSP]);
971 break;
972 case 0x80 ... 0x83: /* Grp1 */
973 switch (modrm_reg) {
974 case 0:
975 goto add;
976 case 1:
977 goto or;
978 case 2:
979 goto adc;
980 case 3:
981 goto sbb;
982 case 4:
983 goto and;
984 case 5:
985 goto sub;
986 case 6:
987 goto xor;
988 case 7:
989 goto cmp;
990 }
991 break;
992 case 0x84 ... 0x85:
993 test: /* test */
994 emulate_2op_SrcV("test", src, dst, _eflags);
995 break;
996 case 0x86 ... 0x87: /* xchg */
997 /* Write back the register source. */
998 switch (dst.bytes) {
999 case 1:
1000 *(u8 *) src.ptr = (u8) dst.val;
1001 break;
1002 case 2:
1003 *(u16 *) src.ptr = (u16) dst.val;
1004 break;
1005 case 4:
1006 *src.ptr = (u32) dst.val;
1007 break; /* 64b reg: zero-extend */
1008 case 8:
1009 *src.ptr = dst.val;
1010 break;
1011 }
1012 /*
1013 * Write back the memory destination with implicit LOCK
1014 * prefix.
1015 */
1016 dst.val = src.val;
1017 lock_prefix = 1;
1018 break;
1019 case 0x88 ... 0x8b: /* mov */
1020 goto mov;
1021 case 0x8f: /* pop (sole member of Grp1a) */
1022 /* 64-bit mode: POP always pops a 64-bit operand. */
1023 if (mode == X86EMUL_MODE_PROT64)
1024 dst.bytes = 8;
1025 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1026 _regs[VCPU_REGS_RSP]),
1027 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
1028 goto done;
1029 register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
1030 break;
1031 case 0xa0 ... 0xa1: /* mov */
1032 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1033 dst.val = src.val;
1034 _eip += ad_bytes; /* skip src displacement */
1035 break;
1036 case 0xa2 ... 0xa3: /* mov */
1037 dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
1038 _eip += ad_bytes; /* skip dst displacement */
1039 break;
1040 case 0xc0 ... 0xc1:
1041 grp2: /* Grp2 */
1042 switch (modrm_reg) {
1043 case 0: /* rol */
1044 emulate_2op_SrcB("rol", src, dst, _eflags);
1045 break;
1046 case 1: /* ror */
1047 emulate_2op_SrcB("ror", src, dst, _eflags);
1048 break;
1049 case 2: /* rcl */
1050 emulate_2op_SrcB("rcl", src, dst, _eflags);
1051 break;
1052 case 3: /* rcr */
1053 emulate_2op_SrcB("rcr", src, dst, _eflags);
1054 break;
1055 case 4: /* sal/shl */
1056 case 6: /* sal/shl */
1057 emulate_2op_SrcB("sal", src, dst, _eflags);
1058 break;
1059 case 5: /* shr */
1060 emulate_2op_SrcB("shr", src, dst, _eflags);
1061 break;
1062 case 7: /* sar */
1063 emulate_2op_SrcB("sar", src, dst, _eflags);
1064 break;
1065 }
1066 break;
1067 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
1068 mov:
1069 dst.val = src.val;
1070 break;
1071 case 0xd0 ... 0xd1: /* Grp2 */
1072 src.val = 1;
1073 goto grp2;
1074 case 0xd2 ... 0xd3: /* Grp2 */
1075 src.val = _regs[VCPU_REGS_RCX];
1076 goto grp2;
1077 case 0xe8: /* call (near) */ {
1078 long int rel;
1079 switch (op_bytes) {
1080 case 2:
1081 rel = insn_fetch(s16, 2, _eip);
1082 break;
1083 case 4:
1084 rel = insn_fetch(s32, 4, _eip);
1085 break;
1086 case 8:
1087 rel = insn_fetch(s64, 8, _eip);
1088 break;
1089 default:
1090 DPRINTF("Call: Invalid op_bytes\n");
1091 goto cannot_emulate;
1092 }
1093 src.val = (unsigned long) _eip;
1094 JMP_REL(rel);
1095 goto push;
1096 }
1097 case 0xe9: /* jmp rel */
1098 case 0xeb: /* jmp rel short */
1099 JMP_REL(src.val);
1100 no_wb = 1; /* Disable writeback. */
1101 break;
1102 case 0xf6 ... 0xf7: /* Grp3 */
1103 switch (modrm_reg) {
1104 case 0 ... 1: /* test */
1105 /*
1106 * Special case in Grp3: test has an immediate
1107 * source operand.
1108 */
1109 src.type = OP_IMM;
1110 src.ptr = (unsigned long *)_eip;
1111 src.bytes = (d & ByteOp) ? 1 : op_bytes;
1112 if (src.bytes == 8)
1113 src.bytes = 4;
1114 switch (src.bytes) {
1115 case 1:
1116 src.val = insn_fetch(s8, 1, _eip);
1117 break;
1118 case 2:
1119 src.val = insn_fetch(s16, 2, _eip);
1120 break;
1121 case 4:
1122 src.val = insn_fetch(s32, 4, _eip);
1123 break;
1124 }
1125 goto test;
1126 case 2: /* not */
1127 dst.val = ~dst.val;
1128 break;
1129 case 3: /* neg */
1130 emulate_1op("neg", dst, _eflags);
1131 break;
1132 default:
1133 goto cannot_emulate;
1134 }
1135 break;
1136 case 0xfe ... 0xff: /* Grp4/Grp5 */
1137 switch (modrm_reg) {
1138 case 0: /* inc */
1139 emulate_1op("inc", dst, _eflags);
1140 break;
1141 case 1: /* dec */
1142 emulate_1op("dec", dst, _eflags);
1143 break;
1144 case 6: /* push */
1145 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1146 if (mode == X86EMUL_MODE_PROT64) {
1147 dst.bytes = 8;
1148 if ((rc = ops->read_std((unsigned long)dst.ptr,
1149 &dst.val, 8,
1150 ctxt->vcpu)) != 0)
1151 goto done;
1152 }
1153 register_address_increment(_regs[VCPU_REGS_RSP],
1154 -dst.bytes);
1155 if ((rc = ops->write_std(
1156 register_address(ctxt->ss_base,
1157 _regs[VCPU_REGS_RSP]),
1158 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
1159 goto done;
1160 no_wb = 1;
1161 break;
1162 default:
1163 goto cannot_emulate;
1164 }
1165 break;
1166 }
1167
1168 writeback:
1169 if (!no_wb) {
1170 switch (dst.type) {
1171 case OP_REG:
1172 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1173 switch (dst.bytes) {
1174 case 1:
1175 *(u8 *)dst.ptr = (u8)dst.val;
1176 break;
1177 case 2:
1178 *(u16 *)dst.ptr = (u16)dst.val;
1179 break;
1180 case 4:
1181 *dst.ptr = (u32)dst.val;
1182 break; /* 64b: zero-ext */
1183 case 8:
1184 *dst.ptr = dst.val;
1185 break;
1186 }
1187 break;
1188 case OP_MEM:
1189 if (lock_prefix)
1190 rc = ops->cmpxchg_emulated((unsigned long)dst.
1191 ptr, &dst.orig_val,
1192 &dst.val, dst.bytes,
1193 ctxt->vcpu);
1194 else
1195 rc = ops->write_emulated((unsigned long)dst.ptr,
1196 &dst.val, dst.bytes,
1197 ctxt->vcpu);
1198 if (rc != 0)
1199 goto done;
1200 default:
1201 break;
1202 }
1203 }
1204
1205 /* Commit shadow register state. */
1206 memcpy(ctxt->vcpu->regs, _regs, sizeof _regs);
1207 ctxt->eflags = _eflags;
1208 ctxt->vcpu->rip = _eip;
1209
1210 done:
1211 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1212
1213 special_insn:
1214 if (twobyte)
1215 goto twobyte_special_insn;
1216 switch(b) {
1217 case 0x50 ... 0x57: /* push reg */
1218 if (op_bytes == 2)
1219 src.val = (u16) _regs[b & 0x7];
1220 else
1221 src.val = (u32) _regs[b & 0x7];
1222 dst.type = OP_MEM;
1223 dst.bytes = op_bytes;
1224 dst.val = src.val;
1225 register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
1226 dst.ptr = (void *) register_address(
1227 ctxt->ss_base, _regs[VCPU_REGS_RSP]);
1228 break;
1229 case 0x58 ... 0x5f: /* pop reg */
1230 dst.ptr = (unsigned long *)&_regs[b & 0x7];
1231 pop_instruction:
1232 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1233 _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt->vcpu))
1234 != 0)
1235 goto done;
1236
1237 register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
1238 no_wb = 1; /* Disable writeback. */
1239 break;
1240 case 0x6c: /* insb */
1241 case 0x6d: /* insw/insd */
1242 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1243 1, /* in */
1244 (d & ByteOp) ? 1 : op_bytes, /* size */
1245 rep_prefix ?
1246 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
1247 (_eflags & EFLG_DF), /* down */
1248 register_address(ctxt->es_base,
1249 _regs[VCPU_REGS_RDI]), /* address */
1250 rep_prefix,
1251 _regs[VCPU_REGS_RDX] /* port */
1252 ) == 0)
1253 return -1;
1254 return 0;
1255 case 0x6e: /* outsb */
1256 case 0x6f: /* outsw/outsd */
1257 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
1258 0, /* in */
1259 (d & ByteOp) ? 1 : op_bytes, /* size */
1260 rep_prefix ?
1261 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
1262 (_eflags & EFLG_DF), /* down */
1263 register_address(override_base ?
1264 *override_base : ctxt->ds_base,
1265 _regs[VCPU_REGS_RSI]), /* address */
1266 rep_prefix,
1267 _regs[VCPU_REGS_RDX] /* port */
1268 ) == 0)
1269 return -1;
1270 return 0;
1271 case 0x9c: /* pushf */
1272 src.val = (unsigned long) _eflags;
1273 goto push;
1274 case 0xc3: /* ret */
1275 dst.ptr = &_eip;
1276 goto pop_instruction;
1277 case 0xf4: /* hlt */
1278 ctxt->vcpu->halt_request = 1;
1279 goto done;
1280 }
1281 if (rep_prefix) {
1282 if (_regs[VCPU_REGS_RCX] == 0) {
1283 ctxt->vcpu->rip = _eip;
1284 goto done;
1285 }
1286 _regs[VCPU_REGS_RCX]--;
1287 _eip = ctxt->vcpu->rip;
1288 }
1289 switch (b) {
1290 case 0xa4 ... 0xa5: /* movs */
1291 dst.type = OP_MEM;
1292 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1293 dst.ptr = (unsigned long *)register_address(ctxt->es_base,
1294 _regs[VCPU_REGS_RDI]);
1295 if ((rc = ops->read_emulated(register_address(
1296 override_base ? *override_base : ctxt->ds_base,
1297 _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt->vcpu)) != 0)
1298 goto done;
1299 register_address_increment(_regs[VCPU_REGS_RSI],
1300 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1301 register_address_increment(_regs[VCPU_REGS_RDI],
1302 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1303 break;
1304 case 0xa6 ... 0xa7: /* cmps */
1305 DPRINTF("Urk! I don't handle CMPS.\n");
1306 goto cannot_emulate;
1307 case 0xaa ... 0xab: /* stos */
1308 dst.type = OP_MEM;
1309 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1310 dst.ptr = (unsigned long *)cr2;
1311 dst.val = _regs[VCPU_REGS_RAX];
1312 register_address_increment(_regs[VCPU_REGS_RDI],
1313 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1314 break;
1315 case 0xac ... 0xad: /* lods */
1316 dst.type = OP_REG;
1317 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1318 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1319 if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes,
1320 ctxt->vcpu)) != 0)
1321 goto done;
1322 register_address_increment(_regs[VCPU_REGS_RSI],
1323 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1324 break;
1325 case 0xae ... 0xaf: /* scas */
1326 DPRINTF("Urk! I don't handle SCAS.\n");
1327 goto cannot_emulate;
1328
1329 }
1330 goto writeback;
1331
1332 twobyte_insn:
1333 switch (b) {
1334 case 0x01: /* lgdt, lidt, lmsw */
1335 /* Disable writeback. */
1336 no_wb = 1;
1337 switch (modrm_reg) {
1338 u16 size;
1339 unsigned long address;
1340
1341 case 2: /* lgdt */
1342 rc = read_descriptor(ctxt, ops, src.ptr,
1343 &size, &address, op_bytes);
1344 if (rc)
1345 goto done;
1346 realmode_lgdt(ctxt->vcpu, size, address);
1347 break;
1348 case 3: /* lidt */
1349 rc = read_descriptor(ctxt, ops, src.ptr,
1350 &size, &address, op_bytes);
1351 if (rc)
1352 goto done;
1353 realmode_lidt(ctxt->vcpu, size, address);
1354 break;
1355 case 4: /* smsw */
1356 if (modrm_mod != 3)
1357 goto cannot_emulate;
1358 *(u16 *)&_regs[modrm_rm]
1359 = realmode_get_cr(ctxt->vcpu, 0);
1360 break;
1361 case 6: /* lmsw */
1362 if (modrm_mod != 3)
1363 goto cannot_emulate;
1364 realmode_lmsw(ctxt->vcpu, (u16)modrm_val, &_eflags);
1365 break;
1366 case 7: /* invlpg*/
1367 emulate_invlpg(ctxt->vcpu, cr2);
1368 break;
1369 default:
1370 goto cannot_emulate;
1371 }
1372 break;
1373 case 0x21: /* mov from dr to reg */
1374 no_wb = 1;
1375 if (modrm_mod != 3)
1376 goto cannot_emulate;
1377 rc = emulator_get_dr(ctxt, modrm_reg, &_regs[modrm_rm]);
1378 break;
1379 case 0x23: /* mov from reg to dr */
1380 no_wb = 1;
1381 if (modrm_mod != 3)
1382 goto cannot_emulate;
1383 rc = emulator_set_dr(ctxt, modrm_reg, _regs[modrm_rm]);
1384 break;
1385 case 0x40 ... 0x4f: /* cmov */
1386 dst.val = dst.orig_val = src.val;
1387 no_wb = 1;
1388 /*
1389 * First, assume we're decoding an even cmov opcode
1390 * (lsb == 0).
1391 */
1392 switch ((b & 15) >> 1) {
1393 case 0: /* cmovo */
1394 no_wb = (_eflags & EFLG_OF) ? 0 : 1;
1395 break;
1396 case 1: /* cmovb/cmovc/cmovnae */
1397 no_wb = (_eflags & EFLG_CF) ? 0 : 1;
1398 break;
1399 case 2: /* cmovz/cmove */
1400 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
1401 break;
1402 case 3: /* cmovbe/cmovna */
1403 no_wb = (_eflags & (EFLG_CF | EFLG_ZF)) ? 0 : 1;
1404 break;
1405 case 4: /* cmovs */
1406 no_wb = (_eflags & EFLG_SF) ? 0 : 1;
1407 break;
1408 case 5: /* cmovp/cmovpe */
1409 no_wb = (_eflags & EFLG_PF) ? 0 : 1;
1410 break;
1411 case 7: /* cmovle/cmovng */
1412 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
1413 /* fall through */
1414 case 6: /* cmovl/cmovnge */
1415 no_wb &= (!(_eflags & EFLG_SF) !=
1416 !(_eflags & EFLG_OF)) ? 0 : 1;
1417 break;
1418 }
1419 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
1420 no_wb ^= b & 1;
1421 break;
1422 case 0xa3:
1423 bt: /* bt */
1424 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1425 emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
1426 break;
1427 case 0xab:
1428 bts: /* bts */
1429 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1430 emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
1431 break;
1432 case 0xb0 ... 0xb1: /* cmpxchg */
1433 /*
1434 * Save real source value, then compare EAX against
1435 * destination.
1436 */
1437 src.orig_val = src.val;
1438 src.val = _regs[VCPU_REGS_RAX];
1439 emulate_2op_SrcV("cmp", src, dst, _eflags);
1440 if (_eflags & EFLG_ZF) {
1441 /* Success: write back to memory. */
1442 dst.val = src.orig_val;
1443 } else {
1444 /* Failure: write the value we saw to EAX. */
1445 dst.type = OP_REG;
1446 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1447 }
1448 break;
1449 case 0xb3:
1450 btr: /* btr */
1451 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1452 emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
1453 break;
1454 case 0xb6 ... 0xb7: /* movzx */
1455 dst.bytes = op_bytes;
1456 dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
1457 break;
1458 case 0xba: /* Grp8 */
1459 switch (modrm_reg & 3) {
1460 case 0:
1461 goto bt;
1462 case 1:
1463 goto bts;
1464 case 2:
1465 goto btr;
1466 case 3:
1467 goto btc;
1468 }
1469 break;
1470 case 0xbb:
1471 btc: /* btc */
1472 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1473 emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
1474 break;
1475 case 0xbe ... 0xbf: /* movsx */
1476 dst.bytes = op_bytes;
1477 dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
1478 break;
1479 }
1480 goto writeback;
1481
1482 twobyte_special_insn:
1483 /* Disable writeback. */
1484 no_wb = 1;
1485 switch (b) {
1486 case 0x06:
1487 emulate_clts(ctxt->vcpu);
1488 break;
1489 case 0x09: /* wbinvd */
1490 break;
1491 case 0x0d: /* GrpP (prefetch) */
1492 case 0x18: /* Grp16 (prefetch/nop) */
1493 break;
1494 case 0x20: /* mov cr, reg */
1495 if (modrm_mod != 3)
1496 goto cannot_emulate;
1497 _regs[modrm_rm] = realmode_get_cr(ctxt->vcpu, modrm_reg);
1498 break;
1499 case 0x22: /* mov reg, cr */
1500 if (modrm_mod != 3)
1501 goto cannot_emulate;
1502 realmode_set_cr(ctxt->vcpu, modrm_reg, modrm_val, &_eflags);
1503 break;
1504 case 0x30:
1505 /* wrmsr */
1506 msr_data = (u32)_regs[VCPU_REGS_RAX]
1507 | ((u64)_regs[VCPU_REGS_RDX] << 32);
1508 rc = kvm_set_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], msr_data);
1509 if (rc) {
1510 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
1511 _eip = ctxt->vcpu->rip;
1512 }
1513 rc = X86EMUL_CONTINUE;
1514 break;
1515 case 0x32:
1516 /* rdmsr */
1517 rc = kvm_get_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], &msr_data);
1518 if (rc) {
1519 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
1520 _eip = ctxt->vcpu->rip;
1521 } else {
1522 _regs[VCPU_REGS_RAX] = (u32)msr_data;
1523 _regs[VCPU_REGS_RDX] = msr_data >> 32;
1524 }
1525 rc = X86EMUL_CONTINUE;
1526 break;
1527 case 0x80 ... 0x8f: /* jnz rel, etc*/ {
1528 long int rel;
1529
1530 switch (op_bytes) {
1531 case 2:
1532 rel = insn_fetch(s16, 2, _eip);
1533 break;
1534 case 4:
1535 rel = insn_fetch(s32, 4, _eip);
1536 break;
1537 case 8:
1538 rel = insn_fetch(s64, 8, _eip);
1539 break;
1540 default:
1541 DPRINTF("jnz: Invalid op_bytes\n");
1542 goto cannot_emulate;
1543 }
1544 if (test_cc(b, _eflags))
1545 JMP_REL(rel);
1546 break;
1547 }
1548 case 0xc7: /* Grp9 (cmpxchg8b) */
1549 {
1550 u64 old, new;
1551 if ((rc = ops->read_emulated(cr2, &old, 8, ctxt->vcpu))
1552 != 0)
1553 goto done;
1554 if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
1555 ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
1556 _regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1557 _regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1558 _eflags &= ~EFLG_ZF;
1559 } else {
1560 new = ((u64)_regs[VCPU_REGS_RCX] << 32)
1561 | (u32) _regs[VCPU_REGS_RBX];
1562 if ((rc = ops->cmpxchg_emulated(cr2, &old,
1563 &new, 8, ctxt->vcpu)) != 0)
1564 goto done;
1565 _eflags |= EFLG_ZF;
1566 }
1567 break;
1568 }
1569 }
1570 goto writeback;
1571
1572 cannot_emulate:
1573 DPRINTF("Cannot emulate %02x\n", b);
1574 return -1;
1575 }
1576
1577 #ifdef __XEN__
1578
1579 #include <asm/mm.h>
1580 #include <asm/uaccess.h>
1581
1582 int
1583 x86_emulate_read_std(unsigned long addr,
1584 unsigned long *val,
1585 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1586 {
1587 unsigned int rc;
1588
1589 *val = 0;
1590
1591 if ((rc = copy_from_user((void *)val, (void *)addr, bytes)) != 0) {
1592 propagate_page_fault(addr + bytes - rc, 0); /* read fault */
1593 return X86EMUL_PROPAGATE_FAULT;
1594 }
1595
1596 return X86EMUL_CONTINUE;
1597 }
1598
1599 int
1600 x86_emulate_write_std(unsigned long addr,
1601 unsigned long val,
1602 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1603 {
1604 unsigned int rc;
1605
1606 if ((rc = copy_to_user((void *)addr, (void *)&val, bytes)) != 0) {
1607 propagate_page_fault(addr + bytes - rc, PGERR_write_access);
1608 return X86EMUL_PROPAGATE_FAULT;
1609 }
1610
1611 return X86EMUL_CONTINUE;
1612 }
1613
1614 #endif
Linux kernel - Deliverables
This page took 0.340758 seconds and 5 git commands to generate.