projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
KVM: x86 emulator: push imm8
[deliverable/linux.git] / drivers / kvm / x86_emulate.c
CommitLineData
6aa8b732
AK		 1/******************************************************************************
2 * x86_emulate.c
3 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
dcc0766b 9 * privileged instructions:
6aa8b732
AK		 10 *
11 * Copyright (C) 2006 Qumranet
12 *
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
15 *
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
18 *
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
20 */
21
22#ifndef __KERNEL__
23#include <stdio.h>
24#include <stdint.h>
25#include <public/xen.h>
26#define DPRINTF(_f, _a ...) printf( _f , ## _a )
27#else
28#include "kvm.h"
29#define DPRINTF(x...) do {} while (0)
30#endif
31#include "x86_emulate.h"
32#include <linux/module.h>
33
34/*
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
40 * not be handled.
41 */
42
43/* Operand sizes: 8-bit operands or specified/overridden size. */
44#define ByteOp (1<<0) /* 8-bit operands. */
45/* Destination operand type. */
46#define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47#define DstReg (2<<1) /* Register operand. */
48#define DstMem (3<<1) /* Memory operand. */
49#define DstMask (3<<1)
50/* Source operand type. */
51#define SrcNone (0<<3) /* No source operand. */
52#define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53#define SrcReg (1<<3) /* Register operand. */
54#define SrcMem (2<<3) /* Memory operand. */
55#define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56#define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57#define SrcImm (5<<3) /* Immediate operand. */
58#define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59#define SrcMask (7<<3)
60/* Generic ModRM decode. */
61#define ModRM (1<<6)
62/* Destination is only written; never read. */
63#define Mov (1<<7)
038e51de 64#define BitOp (1<<8)
6aa8b732
AK		 65
66static u8 opcode_table[256] = {
67 /* 0x00 - 0x07 */
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
70 0, 0, 0, 0,
71 /* 0x08 - 0x0F */
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
74 0, 0, 0, 0,
75 /* 0x10 - 0x17 */
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
78 0, 0, 0, 0,
79 /* 0x18 - 0x1F */
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
82 0, 0, 0, 0,
83 /* 0x20 - 0x27 */
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
19eb938e 86 SrcImmByte, SrcImm, 0, 0,
6aa8b732
AK		 87 /* 0x28 - 0x2F */
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
90 0, 0, 0, 0,
91 /* 0x30 - 0x37 */
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
94 0, 0, 0, 0,
95 /* 0x38 - 0x3F */
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
98 0, 0, 0, 0,
99 /* 0x40 - 0x4F */
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
7f0aaee0 101 /* 0x50 - 0x57 */
7e778161
NK		 102 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
103 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
7f0aaee0
NK		 104 /* 0x58 - 0x5F */
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
106 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
7d316911 107 /* 0x60 - 0x67 */
6aa8b732 108 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
7d316911
NK		 109 0, 0, 0, 0,
110 /* 0x68 - 0x6F */
111 0, 0, ImplicitOps|Mov, 0,
e70669ab
LV		 112 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
113 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
6aa8b732
AK		 114 /* 0x70 - 0x7F */
115 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
116 /* 0x80 - 0x87 */
117 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
118 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
119 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
120 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
121 /* 0x88 - 0x8F */
122 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
123 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
124 0, 0, 0, DstMem | SrcNone | ModRM | Mov,
125 /* 0x90 - 0x9F */
126 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
127 /* 0xA0 - 0xA7 */
128 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
129 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
130 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
131 ByteOp | ImplicitOps, ImplicitOps,
132 /* 0xA8 - 0xAF */
133 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
134 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
135 ByteOp | ImplicitOps, ImplicitOps,
136 /* 0xB0 - 0xBF */
137 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
138 /* 0xC0 - 0xC7 */
d9413cd7
NK		 139 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
140 0, ImplicitOps, 0, 0,
141 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
6aa8b732
AK		 142 /* 0xC8 - 0xCF */
143 0, 0, 0, 0, 0, 0, 0, 0,
144 /* 0xD0 - 0xD7 */
145 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
146 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
147 0, 0, 0, 0,
148 /* 0xD8 - 0xDF */
149 0, 0, 0, 0, 0, 0, 0, 0,
098c937b
NK		 150 /* 0xE0 - 0xE7 */
151 0, 0, 0, 0, 0, 0, 0, 0,
152 /* 0xE8 - 0xEF */
c53ce170 153 0, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps, 0, 0, 0, 0,
6aa8b732
AK		 154 /* 0xF0 - 0xF7 */
155 0, 0, 0, 0,
72d6e5a0
AK		 156 ImplicitOps, 0,
157 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
6aa8b732
AK		 158 /* 0xF8 - 0xFF */
159 0, 0, 0, 0,
160 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
161};
162
038e51de 163static u16 twobyte_table[256] = {
6aa8b732
AK		 164 /* 0x00 - 0x0F */
165 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
687fdbfe 166 0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
6aa8b732
AK		 167 /* 0x10 - 0x1F */
168 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
169 /* 0x20 - 0x2F */
170 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
171 0, 0, 0, 0, 0, 0, 0, 0,
172 /* 0x30 - 0x3F */
35f3f286 173 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
6aa8b732
AK		 174 /* 0x40 - 0x47 */
175 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
176 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
177 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
178 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
179 /* 0x48 - 0x4F */
180 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
181 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
182 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
183 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
184 /* 0x50 - 0x5F */
185 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
186 /* 0x60 - 0x6F */
187 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
188 /* 0x70 - 0x7F */
189 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
190 /* 0x80 - 0x8F */
191 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
192 /* 0x90 - 0x9F */
193 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
194 /* 0xA0 - 0xA7 */
038e51de 195 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732 196 /* 0xA8 - 0xAF */
038e51de 197 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732
AK		 198 /* 0xB0 - 0xB7 */
199 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
038e51de 200 DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 201 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
202 DstReg | SrcMem16 | ModRM | Mov,
203 /* 0xB8 - 0xBF */
038e51de 204 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 205 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
206 DstReg | SrcMem16 | ModRM | Mov,
207 /* 0xC0 - 0xCF */
208 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
209 /* 0xD0 - 0xDF */
210 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
211 /* 0xE0 - 0xEF */
212 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
213 /* 0xF0 - 0xFF */
214 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
215};
216
6aa8b732
AK		 217/* Type, address-of, and value of an instruction's operand. */
218struct operand {
219 enum { OP_REG, OP_MEM, OP_IMM } type;
220 unsigned int bytes;
221 unsigned long val, orig_val, *ptr;
222};
223
224/* EFLAGS bit definitions. */
225#define EFLG_OF (1<<11)
226#define EFLG_DF (1<<10)
227#define EFLG_SF (1<<7)
228#define EFLG_ZF (1<<6)
229#define EFLG_AF (1<<4)
230#define EFLG_PF (1<<2)
231#define EFLG_CF (1<<0)
232
233/*
234 * Instruction emulation:
235 * Most instructions are emulated directly via a fragment of inline assembly
236 * code. This allows us to save/restore EFLAGS and thus very easily pick up
237 * any modified flags.
238 */
239
05b3e0c2 240#if defined(CONFIG_X86_64)
6aa8b732
AK		 241#define _LO32 "k" /* force 32-bit operand */
242#define _STK "%%rsp" /* stack pointer */
243#elif defined(__i386__)
244#define _LO32 "" /* force 32-bit operand */
245#define _STK "%%esp" /* stack pointer */
246#endif
247
248/*
249 * These EFLAGS bits are restored from saved value during emulation, and
250 * any changes are written back to the saved value after emulation.
251 */
252#define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
253
254/* Before executing instruction: restore necessary bits in EFLAGS. */
255#define _PRE_EFLAGS(_sav, _msk, _tmp) \
256 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
257 "push %"_sav"; " \
258 "movl %"_msk",%"_LO32 _tmp"; " \
259 "andl %"_LO32 _tmp",("_STK"); " \
260 "pushf; " \
261 "notl %"_LO32 _tmp"; " \
262 "andl %"_LO32 _tmp",("_STK"); " \
263 "pop %"_tmp"; " \
264 "orl %"_LO32 _tmp",("_STK"); " \
265 "popf; " \
266 /* _sav &= ~msk; */ \
267 "movl %"_msk",%"_LO32 _tmp"; " \
268 "notl %"_LO32 _tmp"; " \
269 "andl %"_LO32 _tmp",%"_sav"; "
270
271/* After executing instruction: write-back necessary bits in EFLAGS. */
272#define _POST_EFLAGS(_sav, _msk, _tmp) \
273 /* _sav |= EFLAGS & _msk; */ \
274 "pushf; " \
275 "pop %"_tmp"; " \
276 "andl %"_msk",%"_LO32 _tmp"; " \
277 "orl %"_LO32 _tmp",%"_sav"; "
278
279/* Raw emulation: instruction has two explicit operands. */
280#define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
281 do { \
282 unsigned long _tmp; \
283 \
284 switch ((_dst).bytes) { \
285 case 2: \
286 __asm__ __volatile__ ( \
287 _PRE_EFLAGS("0","4","2") \
288 _op"w %"_wx"3,%1; " \
289 _POST_EFLAGS("0","4","2") \
290 : "=m" (_eflags), "=m" ((_dst).val), \
291 "=&r" (_tmp) \
292 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
293 break; \
294 case 4: \
295 __asm__ __volatile__ ( \
296 _PRE_EFLAGS("0","4","2") \
297 _op"l %"_lx"3,%1; " \
298 _POST_EFLAGS("0","4","2") \
299 : "=m" (_eflags), "=m" ((_dst).val), \
300 "=&r" (_tmp) \
301 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
302 break; \
303 case 8: \
304 __emulate_2op_8byte(_op, _src, _dst, \
305 _eflags, _qx, _qy); \
306 break; \
307 } \
308 } while (0)
309
310#define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
311 do { \
312 unsigned long _tmp; \
313 switch ( (_dst).bytes ) \
314 { \
315 case 1: \
316 __asm__ __volatile__ ( \
317 _PRE_EFLAGS("0","4","2") \
318 _op"b %"_bx"3,%1; " \
319 _POST_EFLAGS("0","4","2") \
320 : "=m" (_eflags), "=m" ((_dst).val), \
321 "=&r" (_tmp) \
322 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
323 break; \
324 default: \
325 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
326 _wx, _wy, _lx, _ly, _qx, _qy); \
327 break; \
328 } \
329 } while (0)
330
331/* Source operand is byte-sized and may be restricted to just %cl. */
332#define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
333 __emulate_2op(_op, _src, _dst, _eflags, \
334 "b", "c", "b", "c", "b", "c", "b", "c")
335
336/* Source operand is byte, word, long or quad sized. */
337#define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
338 __emulate_2op(_op, _src, _dst, _eflags, \
339 "b", "q", "w", "r", _LO32, "r", "", "r")
340
341/* Source operand is word, long or quad sized. */
342#define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
343 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
344 "w", "r", _LO32, "r", "", "r")
345
346/* Instruction has only one explicit operand (no source operand). */
347#define emulate_1op(_op, _dst, _eflags) \
348 do { \
349 unsigned long _tmp; \
350 \
351 switch ( (_dst).bytes ) \
352 { \
353 case 1: \
354 __asm__ __volatile__ ( \
355 _PRE_EFLAGS("0","3","2") \
356 _op"b %1; " \
357 _POST_EFLAGS("0","3","2") \
358 : "=m" (_eflags), "=m" ((_dst).val), \
359 "=&r" (_tmp) \
360 : "i" (EFLAGS_MASK) ); \
361 break; \
362 case 2: \
363 __asm__ __volatile__ ( \
364 _PRE_EFLAGS("0","3","2") \
365 _op"w %1; " \
366 _POST_EFLAGS("0","3","2") \
367 : "=m" (_eflags), "=m" ((_dst).val), \
368 "=&r" (_tmp) \
369 : "i" (EFLAGS_MASK) ); \
370 break; \
371 case 4: \
372 __asm__ __volatile__ ( \
373 _PRE_EFLAGS("0","3","2") \
374 _op"l %1; " \
375 _POST_EFLAGS("0","3","2") \
376 : "=m" (_eflags), "=m" ((_dst).val), \
377 "=&r" (_tmp) \
378 : "i" (EFLAGS_MASK) ); \
379 break; \
380 case 8: \
381 __emulate_1op_8byte(_op, _dst, _eflags); \
382 break; \
383 } \
384 } while (0)
385
386/* Emulate an instruction with quadword operands (x86/64 only). */
05b3e0c2 387#if defined(CONFIG_X86_64)
6aa8b732
AK		 388#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
389 do { \
390 __asm__ __volatile__ ( \
391 _PRE_EFLAGS("0","4","2") \
392 _op"q %"_qx"3,%1; " \
393 _POST_EFLAGS("0","4","2") \
394 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
395 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
396 } while (0)
397
398#define __emulate_1op_8byte(_op, _dst, _eflags) \
399 do { \
400 __asm__ __volatile__ ( \
401 _PRE_EFLAGS("0","3","2") \
402 _op"q %1; " \
403 _POST_EFLAGS("0","3","2") \
404 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
405 : "i" (EFLAGS_MASK) ); \
406 } while (0)
407
408#elif defined(__i386__)
409#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
410#define __emulate_1op_8byte(_op, _dst, _eflags)
411#endif /* __i386__ */
412
413/* Fetch next part of the instruction being emulated. */
414#define insn_fetch(_type, _size, _eip) \
415({ unsigned long _x; \
416 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
cebff02b 417 (_size), ctxt->vcpu); \
6aa8b732
AK		 418 if ( rc != 0 ) \
419 goto done; \
420 (_eip) += (_size); \
421 (_type)_x; \
422})
423
424/* Access/update address held in a register, based on addressing mode. */
e70669ab
LV		 425#define address_mask(reg) \
426 ((ad_bytes == sizeof(unsigned long)) ? \
427 (reg) : ((reg) & ((1UL << (ad_bytes << 3)) - 1)))
6aa8b732 428#define register_address(base, reg) \
e70669ab 429 ((base) + address_mask(reg))
6aa8b732
AK		 430#define register_address_increment(reg, inc) \
431 do { \
432 /* signed type ensures sign extension to long */ \
433 int _inc = (inc); \
434 if ( ad_bytes == sizeof(unsigned long) ) \
435 (reg) += _inc; \
436 else \
437 (reg) = ((reg) & ~((1UL << (ad_bytes << 3)) - 1)) | \
438 (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
439 } while (0)
440
098c937b
NK		 441#define JMP_REL(rel) \
442 do { \
443 _eip += (int)(rel); \
444 _eip = ((op_bytes == 2) ? (uint16_t)_eip : (uint32_t)_eip); \
445 } while (0)
446
1e3c5cb0
RR		 447/*
448 * Given the 'reg' portion of a ModRM byte, and a register block, return a
449 * pointer into the block that addresses the relevant register.
450 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
451 */
452static void *decode_register(u8 modrm_reg, unsigned long *regs,
453 int highbyte_regs)
6aa8b732
AK		 454{
455 void *p;
456
457 p = &regs[modrm_reg];
458 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
459 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
460 return p;
461}
462
463static int read_descriptor(struct x86_emulate_ctxt *ctxt,
464 struct x86_emulate_ops *ops,
465 void *ptr,
466 u16 *size, unsigned long *address, int op_bytes)
467{
468 int rc;
469
470 if (op_bytes == 2)
471 op_bytes = 3;
472 *address = 0;
cebff02b
LV		 473 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
474 ctxt->vcpu);
6aa8b732
AK		 475 if (rc)
476 return rc;
cebff02b
LV		 477 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
478 ctxt->vcpu);
6aa8b732
AK		 479 return rc;
480}
481
482int
483x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
484{
038e51de
AK		 485 unsigned d;
486 u8 b, sib, twobyte = 0, rex_prefix = 0;
6aa8b732
AK		 487 u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
488 unsigned long *override_base = NULL;
489 unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
490 int rc = 0;
491 struct operand src, dst;
492 unsigned long cr2 = ctxt->cr2;
493 int mode = ctxt->mode;
494 unsigned long modrm_ea;
495 int use_modrm_ea, index_reg = 0, base_reg = 0, scale, rip_relative = 0;
02c03a32 496 int no_wb = 0;
35f3f286 497 u64 msr_data;
6aa8b732
AK		 498
499 /* Shadow copy of register state. Committed on successful emulation. */
500 unsigned long _regs[NR_VCPU_REGS];
501 unsigned long _eip = ctxt->vcpu->rip, _eflags = ctxt->eflags;
502 unsigned long modrm_val = 0;
503
504 memcpy(_regs, ctxt->vcpu->regs, sizeof _regs);
505
506 switch (mode) {
507 case X86EMUL_MODE_REAL:
508 case X86EMUL_MODE_PROT16:
509 op_bytes = ad_bytes = 2;
510 break;
511 case X86EMUL_MODE_PROT32:
512 op_bytes = ad_bytes = 4;
513 break;
05b3e0c2 514#ifdef CONFIG_X86_64
6aa8b732
AK		 515 case X86EMUL_MODE_PROT64:
516 op_bytes = 4;
517 ad_bytes = 8;
518 break;
519#endif
520 default:
521 return -1;
522 }
523
524 /* Legacy prefixes. */
525 for (i = 0; i < 8; i++) {
526 switch (b = insn_fetch(u8, 1, _eip)) {
527 case 0x66: /* operand-size override */
528 op_bytes ^= 6; /* switch between 2/4 bytes */
529 break;
530 case 0x67: /* address-size override */
531 if (mode == X86EMUL_MODE_PROT64)
532 ad_bytes ^= 12; /* switch between 4/8 bytes */
533 else
534 ad_bytes ^= 6; /* switch between 2/4 bytes */
535 break;
536 case 0x2e: /* CS override */
537 override_base = &ctxt->cs_base;
538 break;
539 case 0x3e: /* DS override */
540 override_base = &ctxt->ds_base;
541 break;
542 case 0x26: /* ES override */
543 override_base = &ctxt->es_base;
544 break;
545 case 0x64: /* FS override */
546 override_base = &ctxt->fs_base;
547 break;
548 case 0x65: /* GS override */
549 override_base = &ctxt->gs_base;
550 break;
551 case 0x36: /* SS override */
552 override_base = &ctxt->ss_base;
553 break;
554 case 0xf0: /* LOCK */
555 lock_prefix = 1;
556 break;
557 case 0xf3: /* REP/REPE/REPZ */
558 rep_prefix = 1;
559 break;
560 case 0xf2: /* REPNE/REPNZ */
561 break;
562 default:
563 goto done_prefixes;
564 }
565 }
566
567done_prefixes:
568
569 /* REX prefix. */
570 if ((mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40)) {
571 rex_prefix = b;
572 if (b & 8)
573 op_bytes = 8; /* REX.W */
574 modrm_reg = (b & 4) << 1; /* REX.R */
575 index_reg = (b & 2) << 2; /* REX.X */
576 modrm_rm = base_reg = (b & 1) << 3; /* REG.B */
577 b = insn_fetch(u8, 1, _eip);
578 }
579
580 /* Opcode byte(s). */
581 d = opcode_table[b];
582 if (d == 0) {
583 /* Two-byte opcode? */
584 if (b == 0x0f) {
585 twobyte = 1;
586 b = insn_fetch(u8, 1, _eip);
587 d = twobyte_table[b];
588 }
589
590 /* Unrecognised? */
591 if (d == 0)
592 goto cannot_emulate;
593 }
594
595 /* ModRM and SIB bytes. */
596 if (d & ModRM) {
597 modrm = insn_fetch(u8, 1, _eip);
598 modrm_mod |= (modrm & 0xc0) >> 6;
599 modrm_reg |= (modrm & 0x38) >> 3;
600 modrm_rm |= (modrm & 0x07);
601 modrm_ea = 0;
602 use_modrm_ea = 1;
603
604 if (modrm_mod == 3) {
605 modrm_val = *(unsigned long *)
606 decode_register(modrm_rm, _regs, d & ByteOp);
607 goto modrm_done;
608 }
609
610 if (ad_bytes == 2) {
611 unsigned bx = _regs[VCPU_REGS_RBX];
612 unsigned bp = _regs[VCPU_REGS_RBP];
613 unsigned si = _regs[VCPU_REGS_RSI];
614 unsigned di = _regs[VCPU_REGS_RDI];
615
616 /* 16-bit ModR/M decode. */
617 switch (modrm_mod) {
618 case 0:
619 if (modrm_rm == 6)
620 modrm_ea += insn_fetch(u16, 2, _eip);
621 break;
622 case 1:
623 modrm_ea += insn_fetch(s8, 1, _eip);
624 break;
625 case 2:
626 modrm_ea += insn_fetch(u16, 2, _eip);
627 break;
628 }
629 switch (modrm_rm) {
630 case 0:
631 modrm_ea += bx + si;
632 break;
633 case 1:
634 modrm_ea += bx + di;
635 break;
636 case 2:
637 modrm_ea += bp + si;
638 break;
639 case 3:
640 modrm_ea += bp + di;
641 break;
642 case 4:
643 modrm_ea += si;
644 break;
645 case 5:
646 modrm_ea += di;
647 break;
648 case 6:
649 if (modrm_mod != 0)
650 modrm_ea += bp;
651 break;
652 case 7:
653 modrm_ea += bx;
654 break;
655 }
656 if (modrm_rm == 2 || modrm_rm == 3 ||
657 (modrm_rm == 6 && modrm_mod != 0))
658 if (!override_base)
659 override_base = &ctxt->ss_base;
660 modrm_ea = (u16)modrm_ea;
661 } else {
662 /* 32/64-bit ModR/M decode. */
663 switch (modrm_rm) {
664 case 4:
665 case 12:
666 sib = insn_fetch(u8, 1, _eip);
667 index_reg |= (sib >> 3) & 7;
668 base_reg |= sib & 7;
669 scale = sib >> 6;
670
671 switch (base_reg) {
672 case 5:
673 if (modrm_mod != 0)
674 modrm_ea += _regs[base_reg];
675 else
676 modrm_ea += insn_fetch(s32, 4, _eip);
677 break;
678 default:
679 modrm_ea += _regs[base_reg];
680 }
681 switch (index_reg) {
682 case 4:
683 break;
684 default:
685 modrm_ea += _regs[index_reg] << scale;
686
687 }
688 break;
689 case 5:
690 if (modrm_mod != 0)
691 modrm_ea += _regs[modrm_rm];
692 else if (mode == X86EMUL_MODE_PROT64)
693 rip_relative = 1;
694 break;
695 default:
696 modrm_ea += _regs[modrm_rm];
697 break;
698 }
699 switch (modrm_mod) {
700 case 0:
701 if (modrm_rm == 5)
702 modrm_ea += insn_fetch(s32, 4, _eip);
703 break;
704 case 1:
705 modrm_ea += insn_fetch(s8, 1, _eip);
706 break;
707 case 2:
708 modrm_ea += insn_fetch(s32, 4, _eip);
709 break;
710 }
711 }
712 if (!override_base)
713 override_base = &ctxt->ds_base;
714 if (mode == X86EMUL_MODE_PROT64 &&
715 override_base != &ctxt->fs_base &&
716 override_base != &ctxt->gs_base)
717 override_base = NULL;
718
719 if (override_base)
720 modrm_ea += *override_base;
721
722 if (rip_relative) {
723 modrm_ea += _eip;
724 switch (d & SrcMask) {
725 case SrcImmByte:
726 modrm_ea += 1;
727 break;
728 case SrcImm:
729 if (d & ByteOp)
730 modrm_ea += 1;
731 else
732 if (op_bytes == 8)
733 modrm_ea += 4;
734 else
735 modrm_ea += op_bytes;
736 }
737 }
738 if (ad_bytes != 8)
739 modrm_ea = (u32)modrm_ea;
740 cr2 = modrm_ea;
741 modrm_done:
742 ;
743 }
744
6aa8b732
AK		 745 /*
746 * Decode and fetch the source operand: register, memory
747 * or immediate.
748 */
749 switch (d & SrcMask) {
750 case SrcNone:
751 break;
752 case SrcReg:
753 src.type = OP_REG;
754 if (d & ByteOp) {
755 src.ptr = decode_register(modrm_reg, _regs,
756 (rex_prefix == 0));
757 src.val = src.orig_val = *(u8 *) src.ptr;
758 src.bytes = 1;
759 } else {
760 src.ptr = decode_register(modrm_reg, _regs, 0);
761 switch ((src.bytes = op_bytes)) {
762 case 2:
763 src.val = src.orig_val = *(u16 *) src.ptr;
764 break;
765 case 4:
766 src.val = src.orig_val = *(u32 *) src.ptr;
767 break;
768 case 8:
769 src.val = src.orig_val = *(u64 *) src.ptr;
770 break;
771 }
772 }
773 break;
774 case SrcMem16:
775 src.bytes = 2;
776 goto srcmem_common;
777 case SrcMem32:
778 src.bytes = 4;
779 goto srcmem_common;
780 case SrcMem:
781 src.bytes = (d & ByteOp) ? 1 : op_bytes;
b85b9ee9
RR		 782 /* Don't fetch the address for invlpg: it could be unmapped. */
783 if (twobyte && b == 0x01 && modrm_reg == 7)
784 break;
6aa8b732
AK		 785 srcmem_common:
786 src.type = OP_MEM;
787 src.ptr = (unsigned long *)cr2;
788 if ((rc = ops->read_emulated((unsigned long)src.ptr,
cebff02b 789 &src.val, src.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 790 goto done;
791 src.orig_val = src.val;
792 break;
793 case SrcImm:
794 src.type = OP_IMM;
795 src.ptr = (unsigned long *)_eip;
796 src.bytes = (d & ByteOp) ? 1 : op_bytes;
797 if (src.bytes == 8)
798 src.bytes = 4;
799 /* NB. Immediates are sign-extended as necessary. */
800 switch (src.bytes) {
801 case 1:
802 src.val = insn_fetch(s8, 1, _eip);
803 break;
804 case 2:
805 src.val = insn_fetch(s16, 2, _eip);
806 break;
807 case 4:
808 src.val = insn_fetch(s32, 4, _eip);
809 break;
810 }
811 break;
812 case SrcImmByte:
813 src.type = OP_IMM;
814 src.ptr = (unsigned long *)_eip;
815 src.bytes = 1;
816 src.val = insn_fetch(s8, 1, _eip);
817 break;
818 }
819
038e51de
AK		 820 /* Decode and fetch the destination operand: register or memory. */
821 switch (d & DstMask) {
822 case ImplicitOps:
823 /* Special instructions do their own operand decoding. */
824 goto special_insn;
825 case DstReg:
826 dst.type = OP_REG;
827 if ((d & ByteOp)
394b6e59 828 && !(twobyte && (b == 0xb6 || b == 0xb7))) {
038e51de
AK		 829 dst.ptr = decode_register(modrm_reg, _regs,
830 (rex_prefix == 0));
831 dst.val = *(u8 *) dst.ptr;
832 dst.bytes = 1;
833 } else {
834 dst.ptr = decode_register(modrm_reg, _regs, 0);
835 switch ((dst.bytes = op_bytes)) {
836 case 2:
837 dst.val = *(u16 *)dst.ptr;
838 break;
839 case 4:
840 dst.val = *(u32 *)dst.ptr;
841 break;
842 case 8:
843 dst.val = *(u64 *)dst.ptr;
844 break;
845 }
846 }
847 break;
848 case DstMem:
849 dst.type = OP_MEM;
850 dst.ptr = (unsigned long *)cr2;
851 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
852 if (d & BitOp) {
df513e2c
AK		 853 unsigned long mask = ~(dst.bytes * 8 - 1);
854
855 dst.ptr = (void *)dst.ptr + (src.val & mask) / 8;
038e51de
AK		 856 }
857 if (!(d & Mov) && /* optimisation - avoid slow emulated read */
858 ((rc = ops->read_emulated((unsigned long)dst.ptr,
cebff02b 859 &dst.val, dst.bytes, ctxt->vcpu)) != 0))
038e51de
AK		 860 goto done;
861 break;
862 }
863 dst.orig_val = dst.val;
864
6aa8b732
AK		 865 if (twobyte)
866 goto twobyte_insn;
867
868 switch (b) {
869 case 0x00 ... 0x05:
870 add: /* add */
871 emulate_2op_SrcV("add", src, dst, _eflags);
872 break;
873 case 0x08 ... 0x0d:
874 or: /* or */
875 emulate_2op_SrcV("or", src, dst, _eflags);
876 break;
877 case 0x10 ... 0x15:
878 adc: /* adc */
879 emulate_2op_SrcV("adc", src, dst, _eflags);
880 break;
881 case 0x18 ... 0x1d:
882 sbb: /* sbb */
883 emulate_2op_SrcV("sbb", src, dst, _eflags);
884 break;
19eb938e 885 case 0x20 ... 0x23:
6aa8b732
AK		 886 and: /* and */
887 emulate_2op_SrcV("and", src, dst, _eflags);
888 break;
19eb938e
NK		 889 case 0x24: /* and al imm8 */
890 dst.type = OP_REG;
891 dst.ptr = &_regs[VCPU_REGS_RAX];
892 dst.val = *(u8 *)dst.ptr;
893 dst.bytes = 1;
894 dst.orig_val = dst.val;
895 goto and;
896 case 0x25: /* and ax imm16, or eax imm32 */
897 dst.type = OP_REG;
898 dst.bytes = op_bytes;
899 dst.ptr = &_regs[VCPU_REGS_RAX];
900 if (op_bytes == 2)
901 dst.val = *(u16 *)dst.ptr;
902 else
903 dst.val = *(u32 *)dst.ptr;
904 dst.orig_val = dst.val;
905 goto and;
6aa8b732
AK		 906 case 0x28 ... 0x2d:
907 sub: /* sub */
908 emulate_2op_SrcV("sub", src, dst, _eflags);
909 break;
910 case 0x30 ... 0x35:
911 xor: /* xor */
912 emulate_2op_SrcV("xor", src, dst, _eflags);
913 break;
914 case 0x38 ... 0x3d:
915 cmp: /* cmp */
916 emulate_2op_SrcV("cmp", src, dst, _eflags);
917 break;
918 case 0x63: /* movsxd */
919 if (mode != X86EMUL_MODE_PROT64)
920 goto cannot_emulate;
921 dst.val = (s32) src.val;
922 break;
7d316911
NK		 923 case 0x6a: /* push imm8 */
924 src.val = 0L;
925 src.val = insn_fetch(s8, 1, _eip);
926push:
927 dst.type = OP_MEM;
928 dst.bytes = op_bytes;
929 dst.val = src.val;
930 register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
931 dst.ptr = register_address(ctxt->ss_base, _regs[VCPU_REGS_RSP]);
932 break;
6aa8b732
AK		 933 case 0x80 ... 0x83: /* Grp1 */
934 switch (modrm_reg) {
935 case 0:
936 goto add;
937 case 1:
938 goto or;
939 case 2:
940 goto adc;
941 case 3:
942 goto sbb;
943 case 4:
944 goto and;
945 case 5:
946 goto sub;
947 case 6:
948 goto xor;
949 case 7:
950 goto cmp;
951 }
952 break;
953 case 0x84 ... 0x85:
954 test: /* test */
955 emulate_2op_SrcV("test", src, dst, _eflags);
956 break;
957 case 0x86 ... 0x87: /* xchg */
958 /* Write back the register source. */
959 switch (dst.bytes) {
960 case 1:
961 *(u8 *) src.ptr = (u8) dst.val;
962 break;
963 case 2:
964 *(u16 *) src.ptr = (u16) dst.val;
965 break;
966 case 4:
967 *src.ptr = (u32) dst.val;
968 break; /* 64b reg: zero-extend */
969 case 8:
970 *src.ptr = dst.val;
971 break;
972 }
973 /*
974 * Write back the memory destination with implicit LOCK
975 * prefix.
976 */
977 dst.val = src.val;
978 lock_prefix = 1;
979 break;
980 case 0xa0 ... 0xa1: /* mov */
981 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
982 dst.val = src.val;
983 _eip += ad_bytes; /* skip src displacement */
984 break;
985 case 0xa2 ... 0xa3: /* mov */
986 dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
987 _eip += ad_bytes; /* skip dst displacement */
988 break;
989 case 0x88 ... 0x8b: /* mov */
990 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
991 dst.val = src.val;
992 break;
993 case 0x8f: /* pop (sole member of Grp1a) */
994 /* 64-bit mode: POP always pops a 64-bit operand. */
995 if (mode == X86EMUL_MODE_PROT64)
996 dst.bytes = 8;
997 if ((rc = ops->read_std(register_address(ctxt->ss_base,
998 _regs[VCPU_REGS_RSP]),
cebff02b 999 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 1000 goto done;
1001 register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
1002 break;
1003 case 0xc0 ... 0xc1:
1004 grp2: /* Grp2 */
1005 switch (modrm_reg) {
1006 case 0: /* rol */
1007 emulate_2op_SrcB("rol", src, dst, _eflags);
1008 break;
1009 case 1: /* ror */
1010 emulate_2op_SrcB("ror", src, dst, _eflags);
1011 break;
1012 case 2: /* rcl */
1013 emulate_2op_SrcB("rcl", src, dst, _eflags);
1014 break;
1015 case 3: /* rcr */
1016 emulate_2op_SrcB("rcr", src, dst, _eflags);
1017 break;
1018 case 4: /* sal/shl */
1019 case 6: /* sal/shl */
1020 emulate_2op_SrcB("sal", src, dst, _eflags);
1021 break;
1022 case 5: /* shr */
1023 emulate_2op_SrcB("shr", src, dst, _eflags);
1024 break;
1025 case 7: /* sar */
1026 emulate_2op_SrcB("sar", src, dst, _eflags);
1027 break;
1028 }
1029 break;
1030 case 0xd0 ... 0xd1: /* Grp2 */
1031 src.val = 1;
1032 goto grp2;
1033 case 0xd2 ... 0xd3: /* Grp2 */
1034 src.val = _regs[VCPU_REGS_RCX];
1035 goto grp2;
098c937b 1036 case 0xe9: /* jmp rel */
c53ce170 1037 case 0xeb: /* jmp rel short */
098c937b
NK		 1038 JMP_REL(src.val);
1039 no_wb = 1; /* Disable writeback. */
1040 break;
6aa8b732
AK		 1041 case 0xf6 ... 0xf7: /* Grp3 */
1042 switch (modrm_reg) {
1043 case 0 ... 1: /* test */
1044 /*
1045 * Special case in Grp3: test has an immediate
1046 * source operand.
1047 */
1048 src.type = OP_IMM;
1049 src.ptr = (unsigned long *)_eip;
1050 src.bytes = (d & ByteOp) ? 1 : op_bytes;
1051 if (src.bytes == 8)
1052 src.bytes = 4;
1053 switch (src.bytes) {
1054 case 1:
1055 src.val = insn_fetch(s8, 1, _eip);
1056 break;
1057 case 2:
1058 src.val = insn_fetch(s16, 2, _eip);
1059 break;
1060 case 4:
1061 src.val = insn_fetch(s32, 4, _eip);
1062 break;
1063 }
1064 goto test;
1065 case 2: /* not */
1066 dst.val = ~dst.val;
1067 break;
1068 case 3: /* neg */
1069 emulate_1op("neg", dst, _eflags);
1070 break;
1071 default:
1072 goto cannot_emulate;
1073 }
1074 break;
1075 case 0xfe ... 0xff: /* Grp4/Grp5 */
1076 switch (modrm_reg) {
1077 case 0: /* inc */
1078 emulate_1op("inc", dst, _eflags);
1079 break;
1080 case 1: /* dec */
1081 emulate_1op("dec", dst, _eflags);
1082 break;
1083 case 6: /* push */
1084 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1085 if (mode == X86EMUL_MODE_PROT64) {
1086 dst.bytes = 8;
1087 if ((rc = ops->read_std((unsigned long)dst.ptr,
1088 &dst.val, 8,
cebff02b 1089 ctxt->vcpu)) != 0)
6aa8b732
AK		 1090 goto done;
1091 }
1092 register_address_increment(_regs[VCPU_REGS_RSP],
1093 -dst.bytes);
1094 if ((rc = ops->write_std(
1095 register_address(ctxt->ss_base,
1096 _regs[VCPU_REGS_RSP]),
cebff02b 1097 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732 1098 goto done;
02c03a32 1099 no_wb = 1;
6aa8b732
AK		 1100 break;
1101 default:
1102 goto cannot_emulate;
1103 }
1104 break;
1105 }
1106
1107writeback:
02c03a32 1108 if (!no_wb) {
6aa8b732
AK		 1109 switch (dst.type) {
1110 case OP_REG:
1111 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1112 switch (dst.bytes) {
1113 case 1:
1114 *(u8 *)dst.ptr = (u8)dst.val;
1115 break;
1116 case 2:
1117 *(u16 *)dst.ptr = (u16)dst.val;
1118 break;
1119 case 4:
1120 *dst.ptr = (u32)dst.val;
1121 break; /* 64b: zero-ext */
1122 case 8:
1123 *dst.ptr = dst.val;
1124 break;
1125 }
1126 break;
1127 case OP_MEM:
1128 if (lock_prefix)
1129 rc = ops->cmpxchg_emulated((unsigned long)dst.
4c690a1e
AK		 1130 ptr, &dst.orig_val,
1131 &dst.val, dst.bytes,
cebff02b 1132 ctxt->vcpu);
6aa8b732
AK		 1133 else
1134 rc = ops->write_emulated((unsigned long)dst.ptr,
4c690a1e 1135 &dst.val, dst.bytes,
cebff02b 1136 ctxt->vcpu);
6aa8b732
AK		 1137 if (rc != 0)
1138 goto done;
1139 default:
1140 break;
1141 }
1142 }
1143
1144 /* Commit shadow register state. */
1145 memcpy(ctxt->vcpu->regs, _regs, sizeof _regs);
1146 ctxt->eflags = _eflags;
1147 ctxt->vcpu->rip = _eip;
1148
1149done:
1150 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1151
1152special_insn:
1153 if (twobyte)
1154 goto twobyte_special_insn;
e70669ab 1155 switch(b) {
7e778161
NK		 1156 case 0x50 ... 0x57: /* push reg */
1157 if (op_bytes == 2)
1158 src.val = (u16) _regs[b & 0x7];
1159 else
1160 src.val = (u32) _regs[b & 0x7];
1161 dst.type = OP_MEM;
1162 dst.bytes = op_bytes;
1163 dst.val = src.val;
1164 register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
1165 dst.ptr = (void *) register_address(
1166 ctxt->ss_base, _regs[VCPU_REGS_RSP]);
7e778161 1167 break;
e70669ab
LV		 1168 case 0x6c: /* insb */
1169 case 0x6d: /* insw/insd */
3090dd73 1170 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
e70669ab
LV		 1171 1, /* in */
1172 (d & ByteOp) ? 1 : op_bytes, /* size */
1173 rep_prefix ?
1174 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
e70669ab
LV		 1175 (_eflags & EFLG_DF), /* down */
1176 register_address(ctxt->es_base,
1177 _regs[VCPU_REGS_RDI]), /* address */
1178 rep_prefix,
1179 _regs[VCPU_REGS_RDX] /* port */
1180 ) == 0)
1181 return -1;
1182 return 0;
1183 case 0x6e: /* outsb */
1184 case 0x6f: /* outsw/outsd */
3090dd73 1185 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
e70669ab
LV		 1186 0, /* in */
1187 (d & ByteOp) ? 1 : op_bytes, /* size */
1188 rep_prefix ?
1189 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
e70669ab
LV		 1190 (_eflags & EFLG_DF), /* down */
1191 register_address(override_base ?
1192 *override_base : ctxt->ds_base,
1193 _regs[VCPU_REGS_RSI]), /* address */
1194 rep_prefix,
1195 _regs[VCPU_REGS_RDX] /* port */
1196 ) == 0)
1197 return -1;
1198 return 0;
1199 }
6aa8b732
AK		 1200 if (rep_prefix) {
1201 if (_regs[VCPU_REGS_RCX] == 0) {
1202 ctxt->vcpu->rip = _eip;
1203 goto done;
1204 }
1205 _regs[VCPU_REGS_RCX]--;
1206 _eip = ctxt->vcpu->rip;
1207 }
1208 switch (b) {
1209 case 0xa4 ... 0xa5: /* movs */
1210 dst.type = OP_MEM;
1211 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1212 dst.ptr = (unsigned long *)register_address(ctxt->es_base,
1213 _regs[VCPU_REGS_RDI]);
1214 if ((rc = ops->read_emulated(register_address(
1215 override_base ? *override_base : ctxt->ds_base,
cebff02b 1216 _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 1217 goto done;
1218 register_address_increment(_regs[VCPU_REGS_RSI],
1219 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1220 register_address_increment(_regs[VCPU_REGS_RDI],
1221 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1222 break;
1223 case 0xa6 ... 0xa7: /* cmps */
1224 DPRINTF("Urk! I don't handle CMPS.\n");
1225 goto cannot_emulate;
1226 case 0xaa ... 0xab: /* stos */
1227 dst.type = OP_MEM;
1228 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1229 dst.ptr = (unsigned long *)cr2;
1230 dst.val = _regs[VCPU_REGS_RAX];
1231 register_address_increment(_regs[VCPU_REGS_RDI],
1232 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1233 break;
1234 case 0xac ... 0xad: /* lods */
1235 dst.type = OP_REG;
1236 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1237 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
cebff02b
LV		 1238 if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes,
1239 ctxt->vcpu)) != 0)
6aa8b732
AK		 1240 goto done;
1241 register_address_increment(_regs[VCPU_REGS_RSI],
1242 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1243 break;
1244 case 0xae ... 0xaf: /* scas */
1245 DPRINTF("Urk! I don't handle SCAS.\n");
1246 goto cannot_emulate;
72d6e5a0
AK		 1247 case 0xf4: /* hlt */
1248 ctxt->vcpu->halt_request = 1;
1249 goto done;
d9413cd7
NK		 1250 case 0xc3: /* ret */
1251 dst.ptr = &_eip;
1252 goto pop_instruction;
7f0aaee0
NK		 1253 case 0x58 ... 0x5f: /* pop reg */
1254 dst.ptr = (unsigned long *)&_regs[b & 0x7];
1255
d9413cd7 1256pop_instruction:
7f0aaee0 1257 if ((rc = ops->read_std(register_address(ctxt->ss_base,
cebff02b
LV		 1258 _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt->vcpu))
1259 != 0)
7f0aaee0
NK		 1260 goto done;
1261
d9413cd7 1262 register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
02c03a32 1263 no_wb = 1; /* Disable writeback. */
7f0aaee0 1264 break;
6aa8b732
AK		 1265 }
1266 goto writeback;
1267
1268twobyte_insn:
1269 switch (b) {
1270 case 0x01: /* lgdt, lidt, lmsw */
d37c8557
AJ		 1271 /* Disable writeback. */
1272 no_wb = 1;
6aa8b732
AK		 1273 switch (modrm_reg) {
1274 u16 size;
1275 unsigned long address;
1276
1277 case 2: /* lgdt */
1278 rc = read_descriptor(ctxt, ops, src.ptr,
1279 &size, &address, op_bytes);
1280 if (rc)
1281 goto done;
1282 realmode_lgdt(ctxt->vcpu, size, address);
1283 break;
1284 case 3: /* lidt */
1285 rc = read_descriptor(ctxt, ops, src.ptr,
1286 &size, &address, op_bytes);
1287 if (rc)
1288 goto done;
1289 realmode_lidt(ctxt->vcpu, size, address);
1290 break;
1291 case 4: /* smsw */
1292 if (modrm_mod != 3)
1293 goto cannot_emulate;
1294 *(u16 *)&_regs[modrm_rm]
1295 = realmode_get_cr(ctxt->vcpu, 0);
1296 break;
1297 case 6: /* lmsw */
1298 if (modrm_mod != 3)
1299 goto cannot_emulate;
1300 realmode_lmsw(ctxt->vcpu, (u16)modrm_val, &_eflags);
1301 break;
1302 case 7: /* invlpg*/
1303 emulate_invlpg(ctxt->vcpu, cr2);
1304 break;
1305 default:
1306 goto cannot_emulate;
1307 }
1308 break;
1309 case 0x21: /* mov from dr to reg */
bac27d35 1310 no_wb = 1;
6aa8b732
AK		 1311 if (modrm_mod != 3)
1312 goto cannot_emulate;
1313 rc = emulator_get_dr(ctxt, modrm_reg, &_regs[modrm_rm]);
1314 break;
1315 case 0x23: /* mov from reg to dr */
bac27d35 1316 no_wb = 1;
6aa8b732
AK		 1317 if (modrm_mod != 3)
1318 goto cannot_emulate;
1319 rc = emulator_set_dr(ctxt, modrm_reg, _regs[modrm_rm]);
1320 break;
1321 case 0x40 ... 0x4f: /* cmov */
1322 dst.val = dst.orig_val = src.val;
e3243452 1323 no_wb = 1;
6aa8b732
AK		 1324 /*
1325 * First, assume we're decoding an even cmov opcode
1326 * (lsb == 0).
1327 */
1328 switch ((b & 15) >> 1) {
1329 case 0: /* cmovo */
e3243452 1330 no_wb = (_eflags & EFLG_OF) ? 0 : 1;
6aa8b732
AK		 1331 break;
1332 case 1: /* cmovb/cmovc/cmovnae */
e3243452 1333 no_wb = (_eflags & EFLG_CF) ? 0 : 1;
6aa8b732
AK		 1334 break;
1335 case 2: /* cmovz/cmove */
e3243452 1336 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
6aa8b732
AK		 1337 break;
1338 case 3: /* cmovbe/cmovna */
e3243452 1339 no_wb = (_eflags & (EFLG_CF | EFLG_ZF)) ? 0 : 1;
6aa8b732
AK		 1340 break;
1341 case 4: /* cmovs */
e3243452 1342 no_wb = (_eflags & EFLG_SF) ? 0 : 1;
6aa8b732
AK		 1343 break;
1344 case 5: /* cmovp/cmovpe */
e3243452 1345 no_wb = (_eflags & EFLG_PF) ? 0 : 1;
6aa8b732
AK		 1346 break;
1347 case 7: /* cmovle/cmovng */
e3243452 1348 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
6aa8b732
AK		 1349 /* fall through */
1350 case 6: /* cmovl/cmovnge */
e3243452
AK		 1351 no_wb &= (!(_eflags & EFLG_SF) !=
1352 !(_eflags & EFLG_OF)) ? 0 : 1;
6aa8b732
AK		 1353 break;
1354 }
1355 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
e3243452 1356 no_wb ^= b & 1;
6aa8b732
AK		 1357 break;
1358 case 0xb0 ... 0xb1: /* cmpxchg */
1359 /*
1360 * Save real source value, then compare EAX against
1361 * destination.
1362 */
1363 src.orig_val = src.val;
1364 src.val = _regs[VCPU_REGS_RAX];
1365 emulate_2op_SrcV("cmp", src, dst, _eflags);
6aa8b732
AK		 1366 if (_eflags & EFLG_ZF) {
1367 /* Success: write back to memory. */
1368 dst.val = src.orig_val;
1369 } else {
1370 /* Failure: write the value we saw to EAX. */
1371 dst.type = OP_REG;
1372 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1373 }
1374 break;
1375 case 0xa3:
1376 bt: /* bt */
1377 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1378 emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
1379 break;
1380 case 0xb3:
1381 btr: /* btr */
1382 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1383 emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
1384 break;
1385 case 0xab:
1386 bts: /* bts */
1387 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1388 emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
1389 break;
1390 case 0xb6 ... 0xb7: /* movzx */
1391 dst.bytes = op_bytes;
1392 dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
1393 break;
1394 case 0xbb:
1395 btc: /* btc */
1396 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1397 emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
1398 break;
1399 case 0xba: /* Grp8 */
1400 switch (modrm_reg & 3) {
1401 case 0:
1402 goto bt;
1403 case 1:
1404 goto bts;
1405 case 2:
1406 goto btr;
1407 case 3:
1408 goto btc;
1409 }
1410 break;
1411 case 0xbe ... 0xbf: /* movsx */
1412 dst.bytes = op_bytes;
1413 dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
1414 break;
1415 }
1416 goto writeback;
1417
1418twobyte_special_insn:
1419 /* Disable writeback. */
02c03a32 1420 no_wb = 1;
6aa8b732 1421 switch (b) {
687fdbfe
AK		 1422 case 0x09: /* wbinvd */
1423 break;
6aa8b732
AK		 1424 case 0x0d: /* GrpP (prefetch) */
1425 case 0x18: /* Grp16 (prefetch/nop) */
1426 break;
1427 case 0x06:
1428 emulate_clts(ctxt->vcpu);
1429 break;
1430 case 0x20: /* mov cr, reg */
1431 if (modrm_mod != 3)
1432 goto cannot_emulate;
1433 _regs[modrm_rm] = realmode_get_cr(ctxt->vcpu, modrm_reg);
1434 break;
1435 case 0x22: /* mov reg, cr */
1436 if (modrm_mod != 3)
1437 goto cannot_emulate;
1438 realmode_set_cr(ctxt->vcpu, modrm_reg, modrm_val, &_eflags);
1439 break;
35f3f286
AK		 1440 case 0x30:
1441 /* wrmsr */
1442 msr_data = (u32)_regs[VCPU_REGS_RAX]
1443 | ((u64)_regs[VCPU_REGS_RDX] << 32);
1444 rc = kvm_set_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], msr_data);
1445 if (rc) {
cbdd1bea 1446 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
35f3f286
AK		 1447 _eip = ctxt->vcpu->rip;
1448 }
1449 rc = X86EMUL_CONTINUE;
1450 break;
1451 case 0x32:
1452 /* rdmsr */
1453 rc = kvm_get_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], &msr_data);
1454 if (rc) {
cbdd1bea 1455 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
35f3f286
AK		 1456 _eip = ctxt->vcpu->rip;
1457 } else {
1458 _regs[VCPU_REGS_RAX] = (u32)msr_data;
1459 _regs[VCPU_REGS_RDX] = msr_data >> 32;
1460 }
1461 rc = X86EMUL_CONTINUE;
1462 break;
6aa8b732 1463 case 0xc7: /* Grp9 (cmpxchg8b) */
6aa8b732 1464 {
4c690a1e 1465 u64 old, new;
cebff02b
LV		 1466 if ((rc = ops->read_emulated(cr2, &old, 8, ctxt->vcpu))
1467 != 0)
6aa8b732
AK		 1468 goto done;
1469 if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
1470 ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
1471 _regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1472 _regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1473 _eflags &= ~EFLG_ZF;
1474 } else {
4c690a1e
AK		 1475 new = ((u64)_regs[VCPU_REGS_RCX] << 32)
1476 | (u32) _regs[VCPU_REGS_RBX];
1477 if ((rc = ops->cmpxchg_emulated(cr2, &old,
cebff02b 1478 &new, 8, ctxt->vcpu)) != 0)
6aa8b732
AK		 1479 goto done;
1480 _eflags |= EFLG_ZF;
1481 }
1482 break;
1483 }
6aa8b732
AK		 1484 }
1485 goto writeback;
1486
1487cannot_emulate:
1488 DPRINTF("Cannot emulate %02x\n", b);
1489 return -1;
1490}
1491
1492#ifdef __XEN__
1493
1494#include <asm/mm.h>
1495#include <asm/uaccess.h>
1496
1497int
1498x86_emulate_read_std(unsigned long addr,
1499 unsigned long *val,
1500 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1501{
1502 unsigned int rc;
1503
1504 *val = 0;
1505
1506 if ((rc = copy_from_user((void *)val, (void *)addr, bytes)) != 0) {
1507 propagate_page_fault(addr + bytes - rc, 0); /* read fault */
1508 return X86EMUL_PROPAGATE_FAULT;
1509 }
1510
1511 return X86EMUL_CONTINUE;
1512}
1513
1514int
1515x86_emulate_write_std(unsigned long addr,
1516 unsigned long val,
1517 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1518{
1519 unsigned int rc;
1520
1521 if ((rc = copy_to_user((void *)addr, (void *)&val, bytes)) != 0) {
1522 propagate_page_fault(addr + bytes - rc, PGERR_write_access);
1523 return X86EMUL_PROPAGATE_FAULT;
1524 }
1525
1526 return X86EMUL_CONTINUE;
1527}
1528
1529#endif
Linux kernel - Deliverables
This page took 0.375164 seconds and 5 git commands to generate.