projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
KVM: VMX: Fix exit qualification width on i386
[deliverable/linux.git] / drivers / kvm / x86_emulate.c
CommitLineData
6aa8b732
AK		 1/******************************************************************************
2 * x86_emulate.c
3 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
dcc0766b 9 * privileged instructions:
6aa8b732
AK		 10 *
11 * Copyright (C) 2006 Qumranet
12 *
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
15 *
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
18 *
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
20 */
21
22#ifndef __KERNEL__
23#include <stdio.h>
24#include <stdint.h>
25#include <public/xen.h>
26#define DPRINTF(_f, _a ...) printf( _f , ## _a )
27#else
28#include "kvm.h"
29#define DPRINTF(x...) do {} while (0)
30#endif
31#include "x86_emulate.h"
32#include <linux/module.h>
33
34/*
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
40 * not be handled.
41 */
42
43/* Operand sizes: 8-bit operands or specified/overridden size. */
44#define ByteOp (1<<0) /* 8-bit operands. */
45/* Destination operand type. */
46#define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47#define DstReg (2<<1) /* Register operand. */
48#define DstMem (3<<1) /* Memory operand. */
49#define DstMask (3<<1)
50/* Source operand type. */
51#define SrcNone (0<<3) /* No source operand. */
52#define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53#define SrcReg (1<<3) /* Register operand. */
54#define SrcMem (2<<3) /* Memory operand. */
55#define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56#define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57#define SrcImm (5<<3) /* Immediate operand. */
58#define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59#define SrcMask (7<<3)
60/* Generic ModRM decode. */
61#define ModRM (1<<6)
62/* Destination is only written; never read. */
63#define Mov (1<<7)
038e51de 64#define BitOp (1<<8)
6aa8b732
AK		 65
66static u8 opcode_table[256] = {
67 /* 0x00 - 0x07 */
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
70 0, 0, 0, 0,
71 /* 0x08 - 0x0F */
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
74 0, 0, 0, 0,
75 /* 0x10 - 0x17 */
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
78 0, 0, 0, 0,
79 /* 0x18 - 0x1F */
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
82 0, 0, 0, 0,
83 /* 0x20 - 0x27 */
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
19eb938e 86 SrcImmByte, SrcImm, 0, 0,
6aa8b732
AK		 87 /* 0x28 - 0x2F */
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
90 0, 0, 0, 0,
91 /* 0x30 - 0x37 */
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
94 0, 0, 0, 0,
95 /* 0x38 - 0x3F */
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
98 0, 0, 0, 0,
99 /* 0x40 - 0x4F */
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
7f0aaee0 101 /* 0x50 - 0x57 */
7e778161
NK		 102 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
103 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
7f0aaee0
NK		 104 /* 0x58 - 0x5F */
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
106 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
e70669ab 107 /* 0x60 - 0x6B */
6aa8b732 108 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
e70669ab
LV		 109 0, 0, 0, 0, 0, 0, 0, 0,
110 /* 0x6C - 0x6F */
111 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
112 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
6aa8b732
AK		 113 /* 0x70 - 0x7F */
114 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
115 /* 0x80 - 0x87 */
116 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
117 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
118 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
119 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
120 /* 0x88 - 0x8F */
121 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
122 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
123 0, 0, 0, DstMem | SrcNone | ModRM | Mov,
124 /* 0x90 - 0x9F */
125 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
126 /* 0xA0 - 0xA7 */
127 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
128 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
129 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
130 ByteOp | ImplicitOps, ImplicitOps,
131 /* 0xA8 - 0xAF */
132 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
133 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
134 ByteOp | ImplicitOps, ImplicitOps,
135 /* 0xB0 - 0xBF */
136 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
137 /* 0xC0 - 0xC7 */
d9413cd7
NK		 138 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
139 0, ImplicitOps, 0, 0,
140 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
6aa8b732
AK		 141 /* 0xC8 - 0xCF */
142 0, 0, 0, 0, 0, 0, 0, 0,
143 /* 0xD0 - 0xD7 */
144 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
145 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
146 0, 0, 0, 0,
147 /* 0xD8 - 0xDF */
148 0, 0, 0, 0, 0, 0, 0, 0,
098c937b
NK		 149 /* 0xE0 - 0xE7 */
150 0, 0, 0, 0, 0, 0, 0, 0,
151 /* 0xE8 - 0xEF */
c53ce170 152 0, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps, 0, 0, 0, 0,
6aa8b732
AK		 153 /* 0xF0 - 0xF7 */
154 0, 0, 0, 0,
72d6e5a0
AK		 155 ImplicitOps, 0,
156 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
6aa8b732
AK		 157 /* 0xF8 - 0xFF */
158 0, 0, 0, 0,
159 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
160};
161
038e51de 162static u16 twobyte_table[256] = {
6aa8b732
AK		 163 /* 0x00 - 0x0F */
164 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
687fdbfe 165 0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
6aa8b732
AK		 166 /* 0x10 - 0x1F */
167 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
168 /* 0x20 - 0x2F */
169 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
170 0, 0, 0, 0, 0, 0, 0, 0,
171 /* 0x30 - 0x3F */
35f3f286 172 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
6aa8b732
AK		 173 /* 0x40 - 0x47 */
174 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
175 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
176 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
177 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
178 /* 0x48 - 0x4F */
179 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
180 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
181 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
182 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
183 /* 0x50 - 0x5F */
184 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
185 /* 0x60 - 0x6F */
186 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
187 /* 0x70 - 0x7F */
188 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
189 /* 0x80 - 0x8F */
190 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
191 /* 0x90 - 0x9F */
192 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
193 /* 0xA0 - 0xA7 */
038e51de 194 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732 195 /* 0xA8 - 0xAF */
038e51de 196 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732
AK		 197 /* 0xB0 - 0xB7 */
198 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
038e51de 199 DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 200 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
201 DstReg | SrcMem16 | ModRM | Mov,
202 /* 0xB8 - 0xBF */
038e51de 203 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 204 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
205 DstReg | SrcMem16 | ModRM | Mov,
206 /* 0xC0 - 0xCF */
207 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
208 /* 0xD0 - 0xDF */
209 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
210 /* 0xE0 - 0xEF */
211 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
212 /* 0xF0 - 0xFF */
213 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
214};
215
6aa8b732
AK		 216/* Type, address-of, and value of an instruction's operand. */
217struct operand {
218 enum { OP_REG, OP_MEM, OP_IMM } type;
219 unsigned int bytes;
220 unsigned long val, orig_val, *ptr;
221};
222
223/* EFLAGS bit definitions. */
224#define EFLG_OF (1<<11)
225#define EFLG_DF (1<<10)
226#define EFLG_SF (1<<7)
227#define EFLG_ZF (1<<6)
228#define EFLG_AF (1<<4)
229#define EFLG_PF (1<<2)
230#define EFLG_CF (1<<0)
231
232/*
233 * Instruction emulation:
234 * Most instructions are emulated directly via a fragment of inline assembly
235 * code. This allows us to save/restore EFLAGS and thus very easily pick up
236 * any modified flags.
237 */
238
05b3e0c2 239#if defined(CONFIG_X86_64)
6aa8b732
AK		 240#define _LO32 "k" /* force 32-bit operand */
241#define _STK "%%rsp" /* stack pointer */
242#elif defined(__i386__)
243#define _LO32 "" /* force 32-bit operand */
244#define _STK "%%esp" /* stack pointer */
245#endif
246
247/*
248 * These EFLAGS bits are restored from saved value during emulation, and
249 * any changes are written back to the saved value after emulation.
250 */
251#define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
252
253/* Before executing instruction: restore necessary bits in EFLAGS. */
254#define _PRE_EFLAGS(_sav, _msk, _tmp) \
255 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
256 "push %"_sav"; " \
257 "movl %"_msk",%"_LO32 _tmp"; " \
258 "andl %"_LO32 _tmp",("_STK"); " \
259 "pushf; " \
260 "notl %"_LO32 _tmp"; " \
261 "andl %"_LO32 _tmp",("_STK"); " \
262 "pop %"_tmp"; " \
263 "orl %"_LO32 _tmp",("_STK"); " \
264 "popf; " \
265 /* _sav &= ~msk; */ \
266 "movl %"_msk",%"_LO32 _tmp"; " \
267 "notl %"_LO32 _tmp"; " \
268 "andl %"_LO32 _tmp",%"_sav"; "
269
270/* After executing instruction: write-back necessary bits in EFLAGS. */
271#define _POST_EFLAGS(_sav, _msk, _tmp) \
272 /* _sav |= EFLAGS & _msk; */ \
273 "pushf; " \
274 "pop %"_tmp"; " \
275 "andl %"_msk",%"_LO32 _tmp"; " \
276 "orl %"_LO32 _tmp",%"_sav"; "
277
278/* Raw emulation: instruction has two explicit operands. */
279#define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
280 do { \
281 unsigned long _tmp; \
282 \
283 switch ((_dst).bytes) { \
284 case 2: \
285 __asm__ __volatile__ ( \
286 _PRE_EFLAGS("0","4","2") \
287 _op"w %"_wx"3,%1; " \
288 _POST_EFLAGS("0","4","2") \
289 : "=m" (_eflags), "=m" ((_dst).val), \
290 "=&r" (_tmp) \
291 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
292 break; \
293 case 4: \
294 __asm__ __volatile__ ( \
295 _PRE_EFLAGS("0","4","2") \
296 _op"l %"_lx"3,%1; " \
297 _POST_EFLAGS("0","4","2") \
298 : "=m" (_eflags), "=m" ((_dst).val), \
299 "=&r" (_tmp) \
300 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
301 break; \
302 case 8: \
303 __emulate_2op_8byte(_op, _src, _dst, \
304 _eflags, _qx, _qy); \
305 break; \
306 } \
307 } while (0)
308
309#define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
310 do { \
311 unsigned long _tmp; \
312 switch ( (_dst).bytes ) \
313 { \
314 case 1: \
315 __asm__ __volatile__ ( \
316 _PRE_EFLAGS("0","4","2") \
317 _op"b %"_bx"3,%1; " \
318 _POST_EFLAGS("0","4","2") \
319 : "=m" (_eflags), "=m" ((_dst).val), \
320 "=&r" (_tmp) \
321 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
322 break; \
323 default: \
324 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
325 _wx, _wy, _lx, _ly, _qx, _qy); \
326 break; \
327 } \
328 } while (0)
329
330/* Source operand is byte-sized and may be restricted to just %cl. */
331#define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
332 __emulate_2op(_op, _src, _dst, _eflags, \
333 "b", "c", "b", "c", "b", "c", "b", "c")
334
335/* Source operand is byte, word, long or quad sized. */
336#define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
337 __emulate_2op(_op, _src, _dst, _eflags, \
338 "b", "q", "w", "r", _LO32, "r", "", "r")
339
340/* Source operand is word, long or quad sized. */
341#define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
342 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
343 "w", "r", _LO32, "r", "", "r")
344
345/* Instruction has only one explicit operand (no source operand). */
346#define emulate_1op(_op, _dst, _eflags) \
347 do { \
348 unsigned long _tmp; \
349 \
350 switch ( (_dst).bytes ) \
351 { \
352 case 1: \
353 __asm__ __volatile__ ( \
354 _PRE_EFLAGS("0","3","2") \
355 _op"b %1; " \
356 _POST_EFLAGS("0","3","2") \
357 : "=m" (_eflags), "=m" ((_dst).val), \
358 "=&r" (_tmp) \
359 : "i" (EFLAGS_MASK) ); \
360 break; \
361 case 2: \
362 __asm__ __volatile__ ( \
363 _PRE_EFLAGS("0","3","2") \
364 _op"w %1; " \
365 _POST_EFLAGS("0","3","2") \
366 : "=m" (_eflags), "=m" ((_dst).val), \
367 "=&r" (_tmp) \
368 : "i" (EFLAGS_MASK) ); \
369 break; \
370 case 4: \
371 __asm__ __volatile__ ( \
372 _PRE_EFLAGS("0","3","2") \
373 _op"l %1; " \
374 _POST_EFLAGS("0","3","2") \
375 : "=m" (_eflags), "=m" ((_dst).val), \
376 "=&r" (_tmp) \
377 : "i" (EFLAGS_MASK) ); \
378 break; \
379 case 8: \
380 __emulate_1op_8byte(_op, _dst, _eflags); \
381 break; \
382 } \
383 } while (0)
384
385/* Emulate an instruction with quadword operands (x86/64 only). */
05b3e0c2 386#if defined(CONFIG_X86_64)
6aa8b732
AK		 387#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
388 do { \
389 __asm__ __volatile__ ( \
390 _PRE_EFLAGS("0","4","2") \
391 _op"q %"_qx"3,%1; " \
392 _POST_EFLAGS("0","4","2") \
393 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
394 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
395 } while (0)
396
397#define __emulate_1op_8byte(_op, _dst, _eflags) \
398 do { \
399 __asm__ __volatile__ ( \
400 _PRE_EFLAGS("0","3","2") \
401 _op"q %1; " \
402 _POST_EFLAGS("0","3","2") \
403 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
404 : "i" (EFLAGS_MASK) ); \
405 } while (0)
406
407#elif defined(__i386__)
408#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
409#define __emulate_1op_8byte(_op, _dst, _eflags)
410#endif /* __i386__ */
411
412/* Fetch next part of the instruction being emulated. */
413#define insn_fetch(_type, _size, _eip) \
414({ unsigned long _x; \
415 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
cebff02b 416 (_size), ctxt->vcpu); \
6aa8b732
AK		 417 if ( rc != 0 ) \
418 goto done; \
419 (_eip) += (_size); \
420 (_type)_x; \
421})
422
423/* Access/update address held in a register, based on addressing mode. */
e70669ab
LV		 424#define address_mask(reg) \
425 ((ad_bytes == sizeof(unsigned long)) ? \
426 (reg) : ((reg) & ((1UL << (ad_bytes << 3)) - 1)))
6aa8b732 427#define register_address(base, reg) \
e70669ab 428 ((base) + address_mask(reg))
6aa8b732
AK		 429#define register_address_increment(reg, inc) \
430 do { \
431 /* signed type ensures sign extension to long */ \
432 int _inc = (inc); \
433 if ( ad_bytes == sizeof(unsigned long) ) \
434 (reg) += _inc; \
435 else \
436 (reg) = ((reg) & ~((1UL << (ad_bytes << 3)) - 1)) | \
437 (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
438 } while (0)
439
098c937b
NK		 440#define JMP_REL(rel) \
441 do { \
442 _eip += (int)(rel); \
443 _eip = ((op_bytes == 2) ? (uint16_t)_eip : (uint32_t)_eip); \
444 } while (0)
445
1e3c5cb0
RR		 446/*
447 * Given the 'reg' portion of a ModRM byte, and a register block, return a
448 * pointer into the block that addresses the relevant register.
449 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
450 */
451static void *decode_register(u8 modrm_reg, unsigned long *regs,
452 int highbyte_regs)
6aa8b732
AK		 453{
454 void *p;
455
456 p = &regs[modrm_reg];
457 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
458 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
459 return p;
460}
461
462static int read_descriptor(struct x86_emulate_ctxt *ctxt,
463 struct x86_emulate_ops *ops,
464 void *ptr,
465 u16 *size, unsigned long *address, int op_bytes)
466{
467 int rc;
468
469 if (op_bytes == 2)
470 op_bytes = 3;
471 *address = 0;
cebff02b
LV		 472 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
473 ctxt->vcpu);
6aa8b732
AK		 474 if (rc)
475 return rc;
cebff02b
LV		 476 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
477 ctxt->vcpu);
6aa8b732
AK		 478 return rc;
479}
480
481int
482x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
483{
038e51de
AK		 484 unsigned d;
485 u8 b, sib, twobyte = 0, rex_prefix = 0;
6aa8b732
AK		 486 u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
487 unsigned long *override_base = NULL;
488 unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
489 int rc = 0;
490 struct operand src, dst;
491 unsigned long cr2 = ctxt->cr2;
492 int mode = ctxt->mode;
493 unsigned long modrm_ea;
494 int use_modrm_ea, index_reg = 0, base_reg = 0, scale, rip_relative = 0;
02c03a32 495 int no_wb = 0;
35f3f286 496 u64 msr_data;
6aa8b732
AK		 497
498 /* Shadow copy of register state. Committed on successful emulation. */
499 unsigned long _regs[NR_VCPU_REGS];
500 unsigned long _eip = ctxt->vcpu->rip, _eflags = ctxt->eflags;
501 unsigned long modrm_val = 0;
502
503 memcpy(_regs, ctxt->vcpu->regs, sizeof _regs);
504
505 switch (mode) {
506 case X86EMUL_MODE_REAL:
507 case X86EMUL_MODE_PROT16:
508 op_bytes = ad_bytes = 2;
509 break;
510 case X86EMUL_MODE_PROT32:
511 op_bytes = ad_bytes = 4;
512 break;
05b3e0c2 513#ifdef CONFIG_X86_64
6aa8b732
AK		 514 case X86EMUL_MODE_PROT64:
515 op_bytes = 4;
516 ad_bytes = 8;
517 break;
518#endif
519 default:
520 return -1;
521 }
522
523 /* Legacy prefixes. */
524 for (i = 0; i < 8; i++) {
525 switch (b = insn_fetch(u8, 1, _eip)) {
526 case 0x66: /* operand-size override */
527 op_bytes ^= 6; /* switch between 2/4 bytes */
528 break;
529 case 0x67: /* address-size override */
530 if (mode == X86EMUL_MODE_PROT64)
531 ad_bytes ^= 12; /* switch between 4/8 bytes */
532 else
533 ad_bytes ^= 6; /* switch between 2/4 bytes */
534 break;
535 case 0x2e: /* CS override */
536 override_base = &ctxt->cs_base;
537 break;
538 case 0x3e: /* DS override */
539 override_base = &ctxt->ds_base;
540 break;
541 case 0x26: /* ES override */
542 override_base = &ctxt->es_base;
543 break;
544 case 0x64: /* FS override */
545 override_base = &ctxt->fs_base;
546 break;
547 case 0x65: /* GS override */
548 override_base = &ctxt->gs_base;
549 break;
550 case 0x36: /* SS override */
551 override_base = &ctxt->ss_base;
552 break;
553 case 0xf0: /* LOCK */
554 lock_prefix = 1;
555 break;
556 case 0xf3: /* REP/REPE/REPZ */
557 rep_prefix = 1;
558 break;
559 case 0xf2: /* REPNE/REPNZ */
560 break;
561 default:
562 goto done_prefixes;
563 }
564 }
565
566done_prefixes:
567
568 /* REX prefix. */
569 if ((mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40)) {
570 rex_prefix = b;
571 if (b & 8)
572 op_bytes = 8; /* REX.W */
573 modrm_reg = (b & 4) << 1; /* REX.R */
574 index_reg = (b & 2) << 2; /* REX.X */
575 modrm_rm = base_reg = (b & 1) << 3; /* REG.B */
576 b = insn_fetch(u8, 1, _eip);
577 }
578
579 /* Opcode byte(s). */
580 d = opcode_table[b];
581 if (d == 0) {
582 /* Two-byte opcode? */
583 if (b == 0x0f) {
584 twobyte = 1;
585 b = insn_fetch(u8, 1, _eip);
586 d = twobyte_table[b];
587 }
588
589 /* Unrecognised? */
590 if (d == 0)
591 goto cannot_emulate;
592 }
593
594 /* ModRM and SIB bytes. */
595 if (d & ModRM) {
596 modrm = insn_fetch(u8, 1, _eip);
597 modrm_mod |= (modrm & 0xc0) >> 6;
598 modrm_reg |= (modrm & 0x38) >> 3;
599 modrm_rm |= (modrm & 0x07);
600 modrm_ea = 0;
601 use_modrm_ea = 1;
602
603 if (modrm_mod == 3) {
604 modrm_val = *(unsigned long *)
605 decode_register(modrm_rm, _regs, d & ByteOp);
606 goto modrm_done;
607 }
608
609 if (ad_bytes == 2) {
610 unsigned bx = _regs[VCPU_REGS_RBX];
611 unsigned bp = _regs[VCPU_REGS_RBP];
612 unsigned si = _regs[VCPU_REGS_RSI];
613 unsigned di = _regs[VCPU_REGS_RDI];
614
615 /* 16-bit ModR/M decode. */
616 switch (modrm_mod) {
617 case 0:
618 if (modrm_rm == 6)
619 modrm_ea += insn_fetch(u16, 2, _eip);
620 break;
621 case 1:
622 modrm_ea += insn_fetch(s8, 1, _eip);
623 break;
624 case 2:
625 modrm_ea += insn_fetch(u16, 2, _eip);
626 break;
627 }
628 switch (modrm_rm) {
629 case 0:
630 modrm_ea += bx + si;
631 break;
632 case 1:
633 modrm_ea += bx + di;
634 break;
635 case 2:
636 modrm_ea += bp + si;
637 break;
638 case 3:
639 modrm_ea += bp + di;
640 break;
641 case 4:
642 modrm_ea += si;
643 break;
644 case 5:
645 modrm_ea += di;
646 break;
647 case 6:
648 if (modrm_mod != 0)
649 modrm_ea += bp;
650 break;
651 case 7:
652 modrm_ea += bx;
653 break;
654 }
655 if (modrm_rm == 2 || modrm_rm == 3 ||
656 (modrm_rm == 6 && modrm_mod != 0))
657 if (!override_base)
658 override_base = &ctxt->ss_base;
659 modrm_ea = (u16)modrm_ea;
660 } else {
661 /* 32/64-bit ModR/M decode. */
662 switch (modrm_rm) {
663 case 4:
664 case 12:
665 sib = insn_fetch(u8, 1, _eip);
666 index_reg |= (sib >> 3) & 7;
667 base_reg |= sib & 7;
668 scale = sib >> 6;
669
670 switch (base_reg) {
671 case 5:
672 if (modrm_mod != 0)
673 modrm_ea += _regs[base_reg];
674 else
675 modrm_ea += insn_fetch(s32, 4, _eip);
676 break;
677 default:
678 modrm_ea += _regs[base_reg];
679 }
680 switch (index_reg) {
681 case 4:
682 break;
683 default:
684 modrm_ea += _regs[index_reg] << scale;
685
686 }
687 break;
688 case 5:
689 if (modrm_mod != 0)
690 modrm_ea += _regs[modrm_rm];
691 else if (mode == X86EMUL_MODE_PROT64)
692 rip_relative = 1;
693 break;
694 default:
695 modrm_ea += _regs[modrm_rm];
696 break;
697 }
698 switch (modrm_mod) {
699 case 0:
700 if (modrm_rm == 5)
701 modrm_ea += insn_fetch(s32, 4, _eip);
702 break;
703 case 1:
704 modrm_ea += insn_fetch(s8, 1, _eip);
705 break;
706 case 2:
707 modrm_ea += insn_fetch(s32, 4, _eip);
708 break;
709 }
710 }
711 if (!override_base)
712 override_base = &ctxt->ds_base;
713 if (mode == X86EMUL_MODE_PROT64 &&
714 override_base != &ctxt->fs_base &&
715 override_base != &ctxt->gs_base)
716 override_base = NULL;
717
718 if (override_base)
719 modrm_ea += *override_base;
720
721 if (rip_relative) {
722 modrm_ea += _eip;
723 switch (d & SrcMask) {
724 case SrcImmByte:
725 modrm_ea += 1;
726 break;
727 case SrcImm:
728 if (d & ByteOp)
729 modrm_ea += 1;
730 else
731 if (op_bytes == 8)
732 modrm_ea += 4;
733 else
734 modrm_ea += op_bytes;
735 }
736 }
737 if (ad_bytes != 8)
738 modrm_ea = (u32)modrm_ea;
739 cr2 = modrm_ea;
740 modrm_done:
741 ;
742 }
743
6aa8b732
AK		 744 /*
745 * Decode and fetch the source operand: register, memory
746 * or immediate.
747 */
748 switch (d & SrcMask) {
749 case SrcNone:
750 break;
751 case SrcReg:
752 src.type = OP_REG;
753 if (d & ByteOp) {
754 src.ptr = decode_register(modrm_reg, _regs,
755 (rex_prefix == 0));
756 src.val = src.orig_val = *(u8 *) src.ptr;
757 src.bytes = 1;
758 } else {
759 src.ptr = decode_register(modrm_reg, _regs, 0);
760 switch ((src.bytes = op_bytes)) {
761 case 2:
762 src.val = src.orig_val = *(u16 *) src.ptr;
763 break;
764 case 4:
765 src.val = src.orig_val = *(u32 *) src.ptr;
766 break;
767 case 8:
768 src.val = src.orig_val = *(u64 *) src.ptr;
769 break;
770 }
771 }
772 break;
773 case SrcMem16:
774 src.bytes = 2;
775 goto srcmem_common;
776 case SrcMem32:
777 src.bytes = 4;
778 goto srcmem_common;
779 case SrcMem:
780 src.bytes = (d & ByteOp) ? 1 : op_bytes;
b85b9ee9
RR		 781 /* Don't fetch the address for invlpg: it could be unmapped. */
782 if (twobyte && b == 0x01 && modrm_reg == 7)
783 break;
6aa8b732
AK		 784 srcmem_common:
785 src.type = OP_MEM;
786 src.ptr = (unsigned long *)cr2;
787 if ((rc = ops->read_emulated((unsigned long)src.ptr,
cebff02b 788 &src.val, src.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 789 goto done;
790 src.orig_val = src.val;
791 break;
792 case SrcImm:
793 src.type = OP_IMM;
794 src.ptr = (unsigned long *)_eip;
795 src.bytes = (d & ByteOp) ? 1 : op_bytes;
796 if (src.bytes == 8)
797 src.bytes = 4;
798 /* NB. Immediates are sign-extended as necessary. */
799 switch (src.bytes) {
800 case 1:
801 src.val = insn_fetch(s8, 1, _eip);
802 break;
803 case 2:
804 src.val = insn_fetch(s16, 2, _eip);
805 break;
806 case 4:
807 src.val = insn_fetch(s32, 4, _eip);
808 break;
809 }
810 break;
811 case SrcImmByte:
812 src.type = OP_IMM;
813 src.ptr = (unsigned long *)_eip;
814 src.bytes = 1;
815 src.val = insn_fetch(s8, 1, _eip);
816 break;
817 }
818
038e51de
AK		 819 /* Decode and fetch the destination operand: register or memory. */
820 switch (d & DstMask) {
821 case ImplicitOps:
822 /* Special instructions do their own operand decoding. */
823 goto special_insn;
824 case DstReg:
825 dst.type = OP_REG;
826 if ((d & ByteOp)
394b6e59 827 && !(twobyte && (b == 0xb6 || b == 0xb7))) {
038e51de
AK		 828 dst.ptr = decode_register(modrm_reg, _regs,
829 (rex_prefix == 0));
830 dst.val = *(u8 *) dst.ptr;
831 dst.bytes = 1;
832 } else {
833 dst.ptr = decode_register(modrm_reg, _regs, 0);
834 switch ((dst.bytes = op_bytes)) {
835 case 2:
836 dst.val = *(u16 *)dst.ptr;
837 break;
838 case 4:
839 dst.val = *(u32 *)dst.ptr;
840 break;
841 case 8:
842 dst.val = *(u64 *)dst.ptr;
843 break;
844 }
845 }
846 break;
847 case DstMem:
848 dst.type = OP_MEM;
849 dst.ptr = (unsigned long *)cr2;
850 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
851 if (d & BitOp) {
df513e2c
AK		 852 unsigned long mask = ~(dst.bytes * 8 - 1);
853
854 dst.ptr = (void *)dst.ptr + (src.val & mask) / 8;
038e51de
AK		 855 }
856 if (!(d & Mov) && /* optimisation - avoid slow emulated read */
857 ((rc = ops->read_emulated((unsigned long)dst.ptr,
cebff02b 858 &dst.val, dst.bytes, ctxt->vcpu)) != 0))
038e51de
AK		 859 goto done;
860 break;
861 }
862 dst.orig_val = dst.val;
863
6aa8b732
AK		 864 if (twobyte)
865 goto twobyte_insn;
866
867 switch (b) {
868 case 0x00 ... 0x05:
869 add: /* add */
870 emulate_2op_SrcV("add", src, dst, _eflags);
871 break;
872 case 0x08 ... 0x0d:
873 or: /* or */
874 emulate_2op_SrcV("or", src, dst, _eflags);
875 break;
876 case 0x10 ... 0x15:
877 adc: /* adc */
878 emulate_2op_SrcV("adc", src, dst, _eflags);
879 break;
880 case 0x18 ... 0x1d:
881 sbb: /* sbb */
882 emulate_2op_SrcV("sbb", src, dst, _eflags);
883 break;
19eb938e 884 case 0x20 ... 0x23:
6aa8b732
AK		 885 and: /* and */
886 emulate_2op_SrcV("and", src, dst, _eflags);
887 break;
19eb938e
NK		 888 case 0x24: /* and al imm8 */
889 dst.type = OP_REG;
890 dst.ptr = &_regs[VCPU_REGS_RAX];
891 dst.val = *(u8 *)dst.ptr;
892 dst.bytes = 1;
893 dst.orig_val = dst.val;
894 goto and;
895 case 0x25: /* and ax imm16, or eax imm32 */
896 dst.type = OP_REG;
897 dst.bytes = op_bytes;
898 dst.ptr = &_regs[VCPU_REGS_RAX];
899 if (op_bytes == 2)
900 dst.val = *(u16 *)dst.ptr;
901 else
902 dst.val = *(u32 *)dst.ptr;
903 dst.orig_val = dst.val;
904 goto and;
6aa8b732
AK		 905 case 0x28 ... 0x2d:
906 sub: /* sub */
907 emulate_2op_SrcV("sub", src, dst, _eflags);
908 break;
909 case 0x30 ... 0x35:
910 xor: /* xor */
911 emulate_2op_SrcV("xor", src, dst, _eflags);
912 break;
913 case 0x38 ... 0x3d:
914 cmp: /* cmp */
915 emulate_2op_SrcV("cmp", src, dst, _eflags);
916 break;
917 case 0x63: /* movsxd */
918 if (mode != X86EMUL_MODE_PROT64)
919 goto cannot_emulate;
920 dst.val = (s32) src.val;
921 break;
922 case 0x80 ... 0x83: /* Grp1 */
923 switch (modrm_reg) {
924 case 0:
925 goto add;
926 case 1:
927 goto or;
928 case 2:
929 goto adc;
930 case 3:
931 goto sbb;
932 case 4:
933 goto and;
934 case 5:
935 goto sub;
936 case 6:
937 goto xor;
938 case 7:
939 goto cmp;
940 }
941 break;
942 case 0x84 ... 0x85:
943 test: /* test */
944 emulate_2op_SrcV("test", src, dst, _eflags);
945 break;
946 case 0x86 ... 0x87: /* xchg */
947 /* Write back the register source. */
948 switch (dst.bytes) {
949 case 1:
950 *(u8 *) src.ptr = (u8) dst.val;
951 break;
952 case 2:
953 *(u16 *) src.ptr = (u16) dst.val;
954 break;
955 case 4:
956 *src.ptr = (u32) dst.val;
957 break; /* 64b reg: zero-extend */
958 case 8:
959 *src.ptr = dst.val;
960 break;
961 }
962 /*
963 * Write back the memory destination with implicit LOCK
964 * prefix.
965 */
966 dst.val = src.val;
967 lock_prefix = 1;
968 break;
969 case 0xa0 ... 0xa1: /* mov */
970 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
971 dst.val = src.val;
972 _eip += ad_bytes; /* skip src displacement */
973 break;
974 case 0xa2 ... 0xa3: /* mov */
975 dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
976 _eip += ad_bytes; /* skip dst displacement */
977 break;
978 case 0x88 ... 0x8b: /* mov */
979 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
980 dst.val = src.val;
981 break;
982 case 0x8f: /* pop (sole member of Grp1a) */
983 /* 64-bit mode: POP always pops a 64-bit operand. */
984 if (mode == X86EMUL_MODE_PROT64)
985 dst.bytes = 8;
986 if ((rc = ops->read_std(register_address(ctxt->ss_base,
987 _regs[VCPU_REGS_RSP]),
cebff02b 988 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 989 goto done;
990 register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
991 break;
992 case 0xc0 ... 0xc1:
993 grp2: /* Grp2 */
994 switch (modrm_reg) {
995 case 0: /* rol */
996 emulate_2op_SrcB("rol", src, dst, _eflags);
997 break;
998 case 1: /* ror */
999 emulate_2op_SrcB("ror", src, dst, _eflags);
1000 break;
1001 case 2: /* rcl */
1002 emulate_2op_SrcB("rcl", src, dst, _eflags);
1003 break;
1004 case 3: /* rcr */
1005 emulate_2op_SrcB("rcr", src, dst, _eflags);
1006 break;
1007 case 4: /* sal/shl */
1008 case 6: /* sal/shl */
1009 emulate_2op_SrcB("sal", src, dst, _eflags);
1010 break;
1011 case 5: /* shr */
1012 emulate_2op_SrcB("shr", src, dst, _eflags);
1013 break;
1014 case 7: /* sar */
1015 emulate_2op_SrcB("sar", src, dst, _eflags);
1016 break;
1017 }
1018 break;
1019 case 0xd0 ... 0xd1: /* Grp2 */
1020 src.val = 1;
1021 goto grp2;
1022 case 0xd2 ... 0xd3: /* Grp2 */
1023 src.val = _regs[VCPU_REGS_RCX];
1024 goto grp2;
098c937b 1025 case 0xe9: /* jmp rel */
c53ce170 1026 case 0xeb: /* jmp rel short */
098c937b
NK		 1027 JMP_REL(src.val);
1028 no_wb = 1; /* Disable writeback. */
1029 break;
6aa8b732
AK		 1030 case 0xf6 ... 0xf7: /* Grp3 */
1031 switch (modrm_reg) {
1032 case 0 ... 1: /* test */
1033 /*
1034 * Special case in Grp3: test has an immediate
1035 * source operand.
1036 */
1037 src.type = OP_IMM;
1038 src.ptr = (unsigned long *)_eip;
1039 src.bytes = (d & ByteOp) ? 1 : op_bytes;
1040 if (src.bytes == 8)
1041 src.bytes = 4;
1042 switch (src.bytes) {
1043 case 1:
1044 src.val = insn_fetch(s8, 1, _eip);
1045 break;
1046 case 2:
1047 src.val = insn_fetch(s16, 2, _eip);
1048 break;
1049 case 4:
1050 src.val = insn_fetch(s32, 4, _eip);
1051 break;
1052 }
1053 goto test;
1054 case 2: /* not */
1055 dst.val = ~dst.val;
1056 break;
1057 case 3: /* neg */
1058 emulate_1op("neg", dst, _eflags);
1059 break;
1060 default:
1061 goto cannot_emulate;
1062 }
1063 break;
1064 case 0xfe ... 0xff: /* Grp4/Grp5 */
1065 switch (modrm_reg) {
1066 case 0: /* inc */
1067 emulate_1op("inc", dst, _eflags);
1068 break;
1069 case 1: /* dec */
1070 emulate_1op("dec", dst, _eflags);
1071 break;
1072 case 6: /* push */
1073 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1074 if (mode == X86EMUL_MODE_PROT64) {
1075 dst.bytes = 8;
1076 if ((rc = ops->read_std((unsigned long)dst.ptr,
1077 &dst.val, 8,
cebff02b 1078 ctxt->vcpu)) != 0)
6aa8b732
AK		 1079 goto done;
1080 }
1081 register_address_increment(_regs[VCPU_REGS_RSP],
1082 -dst.bytes);
1083 if ((rc = ops->write_std(
1084 register_address(ctxt->ss_base,
1085 _regs[VCPU_REGS_RSP]),
cebff02b 1086 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732 1087 goto done;
02c03a32 1088 no_wb = 1;
6aa8b732
AK		 1089 break;
1090 default:
1091 goto cannot_emulate;
1092 }
1093 break;
1094 }
1095
1096writeback:
02c03a32 1097 if (!no_wb) {
6aa8b732
AK		 1098 switch (dst.type) {
1099 case OP_REG:
1100 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1101 switch (dst.bytes) {
1102 case 1:
1103 *(u8 *)dst.ptr = (u8)dst.val;
1104 break;
1105 case 2:
1106 *(u16 *)dst.ptr = (u16)dst.val;
1107 break;
1108 case 4:
1109 *dst.ptr = (u32)dst.val;
1110 break; /* 64b: zero-ext */
1111 case 8:
1112 *dst.ptr = dst.val;
1113 break;
1114 }
1115 break;
1116 case OP_MEM:
1117 if (lock_prefix)
1118 rc = ops->cmpxchg_emulated((unsigned long)dst.
4c690a1e
AK		 1119 ptr, &dst.orig_val,
1120 &dst.val, dst.bytes,
cebff02b 1121 ctxt->vcpu);
6aa8b732
AK		 1122 else
1123 rc = ops->write_emulated((unsigned long)dst.ptr,
4c690a1e 1124 &dst.val, dst.bytes,
cebff02b 1125 ctxt->vcpu);
6aa8b732
AK		 1126 if (rc != 0)
1127 goto done;
1128 default:
1129 break;
1130 }
1131 }
1132
1133 /* Commit shadow register state. */
1134 memcpy(ctxt->vcpu->regs, _regs, sizeof _regs);
1135 ctxt->eflags = _eflags;
1136 ctxt->vcpu->rip = _eip;
1137
1138done:
1139 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1140
1141special_insn:
1142 if (twobyte)
1143 goto twobyte_special_insn;
e70669ab 1144 switch(b) {
7e778161
NK		 1145 case 0x50 ... 0x57: /* push reg */
1146 if (op_bytes == 2)
1147 src.val = (u16) _regs[b & 0x7];
1148 else
1149 src.val = (u32) _regs[b & 0x7];
1150 dst.type = OP_MEM;
1151 dst.bytes = op_bytes;
1152 dst.val = src.val;
1153 register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
1154 dst.ptr = (void *) register_address(
1155 ctxt->ss_base, _regs[VCPU_REGS_RSP]);
7e778161 1156 break;
e70669ab
LV		 1157 case 0x6c: /* insb */
1158 case 0x6d: /* insw/insd */
3090dd73 1159 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
e70669ab
LV		 1160 1, /* in */
1161 (d & ByteOp) ? 1 : op_bytes, /* size */
1162 rep_prefix ?
1163 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
e70669ab
LV		 1164 (_eflags & EFLG_DF), /* down */
1165 register_address(ctxt->es_base,
1166 _regs[VCPU_REGS_RDI]), /* address */
1167 rep_prefix,
1168 _regs[VCPU_REGS_RDX] /* port */
1169 ) == 0)
1170 return -1;
1171 return 0;
1172 case 0x6e: /* outsb */
1173 case 0x6f: /* outsw/outsd */
3090dd73 1174 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
e70669ab
LV		 1175 0, /* in */
1176 (d & ByteOp) ? 1 : op_bytes, /* size */
1177 rep_prefix ?
1178 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
e70669ab
LV		 1179 (_eflags & EFLG_DF), /* down */
1180 register_address(override_base ?
1181 *override_base : ctxt->ds_base,
1182 _regs[VCPU_REGS_RSI]), /* address */
1183 rep_prefix,
1184 _regs[VCPU_REGS_RDX] /* port */
1185 ) == 0)
1186 return -1;
1187 return 0;
1188 }
6aa8b732
AK		 1189 if (rep_prefix) {
1190 if (_regs[VCPU_REGS_RCX] == 0) {
1191 ctxt->vcpu->rip = _eip;
1192 goto done;
1193 }
1194 _regs[VCPU_REGS_RCX]--;
1195 _eip = ctxt->vcpu->rip;
1196 }
1197 switch (b) {
1198 case 0xa4 ... 0xa5: /* movs */
1199 dst.type = OP_MEM;
1200 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1201 dst.ptr = (unsigned long *)register_address(ctxt->es_base,
1202 _regs[VCPU_REGS_RDI]);
1203 if ((rc = ops->read_emulated(register_address(
1204 override_base ? *override_base : ctxt->ds_base,
cebff02b 1205 _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 1206 goto done;
1207 register_address_increment(_regs[VCPU_REGS_RSI],
1208 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1209 register_address_increment(_regs[VCPU_REGS_RDI],
1210 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1211 break;
1212 case 0xa6 ... 0xa7: /* cmps */
1213 DPRINTF("Urk! I don't handle CMPS.\n");
1214 goto cannot_emulate;
1215 case 0xaa ... 0xab: /* stos */
1216 dst.type = OP_MEM;
1217 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1218 dst.ptr = (unsigned long *)cr2;
1219 dst.val = _regs[VCPU_REGS_RAX];
1220 register_address_increment(_regs[VCPU_REGS_RDI],
1221 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1222 break;
1223 case 0xac ... 0xad: /* lods */
1224 dst.type = OP_REG;
1225 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1226 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
cebff02b
LV		 1227 if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes,
1228 ctxt->vcpu)) != 0)
6aa8b732
AK		 1229 goto done;
1230 register_address_increment(_regs[VCPU_REGS_RSI],
1231 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1232 break;
1233 case 0xae ... 0xaf: /* scas */
1234 DPRINTF("Urk! I don't handle SCAS.\n");
1235 goto cannot_emulate;
72d6e5a0
AK		 1236 case 0xf4: /* hlt */
1237 ctxt->vcpu->halt_request = 1;
1238 goto done;
d9413cd7
NK		 1239 case 0xc3: /* ret */
1240 dst.ptr = &_eip;
1241 goto pop_instruction;
7f0aaee0
NK		 1242 case 0x58 ... 0x5f: /* pop reg */
1243 dst.ptr = (unsigned long *)&_regs[b & 0x7];
1244
d9413cd7 1245pop_instruction:
7f0aaee0 1246 if ((rc = ops->read_std(register_address(ctxt->ss_base,
cebff02b
LV		 1247 _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt->vcpu))
1248 != 0)
7f0aaee0
NK		 1249 goto done;
1250
d9413cd7 1251 register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
02c03a32 1252 no_wb = 1; /* Disable writeback. */
7f0aaee0 1253 break;
6aa8b732
AK		 1254 }
1255 goto writeback;
1256
1257twobyte_insn:
1258 switch (b) {
1259 case 0x01: /* lgdt, lidt, lmsw */
d37c8557
AJ		 1260 /* Disable writeback. */
1261 no_wb = 1;
6aa8b732
AK		 1262 switch (modrm_reg) {
1263 u16 size;
1264 unsigned long address;
1265
1266 case 2: /* lgdt */
1267 rc = read_descriptor(ctxt, ops, src.ptr,
1268 &size, &address, op_bytes);
1269 if (rc)
1270 goto done;
1271 realmode_lgdt(ctxt->vcpu, size, address);
1272 break;
1273 case 3: /* lidt */
1274 rc = read_descriptor(ctxt, ops, src.ptr,
1275 &size, &address, op_bytes);
1276 if (rc)
1277 goto done;
1278 realmode_lidt(ctxt->vcpu, size, address);
1279 break;
1280 case 4: /* smsw */
1281 if (modrm_mod != 3)
1282 goto cannot_emulate;
1283 *(u16 *)&_regs[modrm_rm]
1284 = realmode_get_cr(ctxt->vcpu, 0);
1285 break;
1286 case 6: /* lmsw */
1287 if (modrm_mod != 3)
1288 goto cannot_emulate;
1289 realmode_lmsw(ctxt->vcpu, (u16)modrm_val, &_eflags);
1290 break;
1291 case 7: /* invlpg*/
1292 emulate_invlpg(ctxt->vcpu, cr2);
1293 break;
1294 default:
1295 goto cannot_emulate;
1296 }
1297 break;
1298 case 0x21: /* mov from dr to reg */
bac27d35 1299 no_wb = 1;
6aa8b732
AK		 1300 if (modrm_mod != 3)
1301 goto cannot_emulate;
1302 rc = emulator_get_dr(ctxt, modrm_reg, &_regs[modrm_rm]);
1303 break;
1304 case 0x23: /* mov from reg to dr */
bac27d35 1305 no_wb = 1;
6aa8b732
AK		 1306 if (modrm_mod != 3)
1307 goto cannot_emulate;
1308 rc = emulator_set_dr(ctxt, modrm_reg, _regs[modrm_rm]);
1309 break;
1310 case 0x40 ... 0x4f: /* cmov */
1311 dst.val = dst.orig_val = src.val;
e3243452 1312 no_wb = 1;
6aa8b732
AK		 1313 /*
1314 * First, assume we're decoding an even cmov opcode
1315 * (lsb == 0).
1316 */
1317 switch ((b & 15) >> 1) {
1318 case 0: /* cmovo */
e3243452 1319 no_wb = (_eflags & EFLG_OF) ? 0 : 1;
6aa8b732
AK		 1320 break;
1321 case 1: /* cmovb/cmovc/cmovnae */
e3243452 1322 no_wb = (_eflags & EFLG_CF) ? 0 : 1;
6aa8b732
AK		 1323 break;
1324 case 2: /* cmovz/cmove */
e3243452 1325 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
6aa8b732
AK		 1326 break;
1327 case 3: /* cmovbe/cmovna */
e3243452 1328 no_wb = (_eflags & (EFLG_CF | EFLG_ZF)) ? 0 : 1;
6aa8b732
AK		 1329 break;
1330 case 4: /* cmovs */
e3243452 1331 no_wb = (_eflags & EFLG_SF) ? 0 : 1;
6aa8b732
AK		 1332 break;
1333 case 5: /* cmovp/cmovpe */
e3243452 1334 no_wb = (_eflags & EFLG_PF) ? 0 : 1;
6aa8b732
AK		 1335 break;
1336 case 7: /* cmovle/cmovng */
e3243452 1337 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
6aa8b732
AK		 1338 /* fall through */
1339 case 6: /* cmovl/cmovnge */
e3243452
AK		 1340 no_wb &= (!(_eflags & EFLG_SF) !=
1341 !(_eflags & EFLG_OF)) ? 0 : 1;
6aa8b732
AK		 1342 break;
1343 }
1344 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
e3243452 1345 no_wb ^= b & 1;
6aa8b732
AK		 1346 break;
1347 case 0xb0 ... 0xb1: /* cmpxchg */
1348 /*
1349 * Save real source value, then compare EAX against
1350 * destination.
1351 */
1352 src.orig_val = src.val;
1353 src.val = _regs[VCPU_REGS_RAX];
1354 emulate_2op_SrcV("cmp", src, dst, _eflags);
6aa8b732
AK		 1355 if (_eflags & EFLG_ZF) {
1356 /* Success: write back to memory. */
1357 dst.val = src.orig_val;
1358 } else {
1359 /* Failure: write the value we saw to EAX. */
1360 dst.type = OP_REG;
1361 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1362 }
1363 break;
1364 case 0xa3:
1365 bt: /* bt */
1366 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1367 emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
1368 break;
1369 case 0xb3:
1370 btr: /* btr */
1371 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1372 emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
1373 break;
1374 case 0xab:
1375 bts: /* bts */
1376 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1377 emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
1378 break;
1379 case 0xb6 ... 0xb7: /* movzx */
1380 dst.bytes = op_bytes;
1381 dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
1382 break;
1383 case 0xbb:
1384 btc: /* btc */
1385 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1386 emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
1387 break;
1388 case 0xba: /* Grp8 */
1389 switch (modrm_reg & 3) {
1390 case 0:
1391 goto bt;
1392 case 1:
1393 goto bts;
1394 case 2:
1395 goto btr;
1396 case 3:
1397 goto btc;
1398 }
1399 break;
1400 case 0xbe ... 0xbf: /* movsx */
1401 dst.bytes = op_bytes;
1402 dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
1403 break;
1404 }
1405 goto writeback;
1406
1407twobyte_special_insn:
1408 /* Disable writeback. */
02c03a32 1409 no_wb = 1;
6aa8b732 1410 switch (b) {
687fdbfe
AK		 1411 case 0x09: /* wbinvd */
1412 break;
6aa8b732
AK		 1413 case 0x0d: /* GrpP (prefetch) */
1414 case 0x18: /* Grp16 (prefetch/nop) */
1415 break;
1416 case 0x06:
1417 emulate_clts(ctxt->vcpu);
1418 break;
1419 case 0x20: /* mov cr, reg */
1420 if (modrm_mod != 3)
1421 goto cannot_emulate;
1422 _regs[modrm_rm] = realmode_get_cr(ctxt->vcpu, modrm_reg);
1423 break;
1424 case 0x22: /* mov reg, cr */
1425 if (modrm_mod != 3)
1426 goto cannot_emulate;
1427 realmode_set_cr(ctxt->vcpu, modrm_reg, modrm_val, &_eflags);
1428 break;
35f3f286
AK		 1429 case 0x30:
1430 /* wrmsr */
1431 msr_data = (u32)_regs[VCPU_REGS_RAX]
1432 | ((u64)_regs[VCPU_REGS_RDX] << 32);
1433 rc = kvm_set_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], msr_data);
1434 if (rc) {
cbdd1bea 1435 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
35f3f286
AK		 1436 _eip = ctxt->vcpu->rip;
1437 }
1438 rc = X86EMUL_CONTINUE;
1439 break;
1440 case 0x32:
1441 /* rdmsr */
1442 rc = kvm_get_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], &msr_data);
1443 if (rc) {
cbdd1bea 1444 kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
35f3f286
AK		 1445 _eip = ctxt->vcpu->rip;
1446 } else {
1447 _regs[VCPU_REGS_RAX] = (u32)msr_data;
1448 _regs[VCPU_REGS_RDX] = msr_data >> 32;
1449 }
1450 rc = X86EMUL_CONTINUE;
1451 break;
6aa8b732 1452 case 0xc7: /* Grp9 (cmpxchg8b) */
6aa8b732 1453 {
4c690a1e 1454 u64 old, new;
cebff02b
LV		 1455 if ((rc = ops->read_emulated(cr2, &old, 8, ctxt->vcpu))
1456 != 0)
6aa8b732
AK		 1457 goto done;
1458 if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
1459 ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
1460 _regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1461 _regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1462 _eflags &= ~EFLG_ZF;
1463 } else {
4c690a1e
AK		 1464 new = ((u64)_regs[VCPU_REGS_RCX] << 32)
1465 | (u32) _regs[VCPU_REGS_RBX];
1466 if ((rc = ops->cmpxchg_emulated(cr2, &old,
cebff02b 1467 &new, 8, ctxt->vcpu)) != 0)
6aa8b732
AK		 1468 goto done;
1469 _eflags |= EFLG_ZF;
1470 }
1471 break;
1472 }
6aa8b732
AK		 1473 }
1474 goto writeback;
1475
1476cannot_emulate:
1477 DPRINTF("Cannot emulate %02x\n", b);
1478 return -1;
1479}
1480
1481#ifdef __XEN__
1482
1483#include <asm/mm.h>
1484#include <asm/uaccess.h>
1485
1486int
1487x86_emulate_read_std(unsigned long addr,
1488 unsigned long *val,
1489 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1490{
1491 unsigned int rc;
1492
1493 *val = 0;
1494
1495 if ((rc = copy_from_user((void *)val, (void *)addr, bytes)) != 0) {
1496 propagate_page_fault(addr + bytes - rc, 0); /* read fault */
1497 return X86EMUL_PROPAGATE_FAULT;
1498 }
1499
1500 return X86EMUL_CONTINUE;
1501}
1502
1503int
1504x86_emulate_write_std(unsigned long addr,
1505 unsigned long val,
1506 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1507{
1508 unsigned int rc;
1509
1510 if ((rc = copy_to_user((void *)addr, (void *)&val, bytes)) != 0) {
1511 propagate_page_fault(addr + bytes - rc, PGERR_write_access);
1512 return X86EMUL_PROPAGATE_FAULT;
1513 }
1514
1515 return X86EMUL_CONTINUE;
1516}
1517
1518#endif
Linux kernel - Deliverables
This page took 0.16508 seconds and 5 git commands to generate.