]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - drivers/kvm/x86_emulate.c
projects / mirror_ubuntu-bionic-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
KVM: Trivial: Make decode_register() static
[mirror_ubuntu-bionic-kernel.git] / drivers / kvm / x86_emulate.c
CommitLineData
6aa8b732
AK		 1/******************************************************************************
2 * x86_emulate.c
3 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privieged instructions:
10 *
11 * Copyright (C) 2006 Qumranet
12 *
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
15 *
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
18 *
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
20 */
21
22#ifndef __KERNEL__
23#include <stdio.h>
24#include <stdint.h>
25#include <public/xen.h>
26#define DPRINTF(_f, _a ...) printf( _f , ## _a )
27#else
28#include "kvm.h"
29#define DPRINTF(x...) do {} while (0)
30#endif
31#include "x86_emulate.h"
32#include <linux/module.h>
33
34/*
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
40 * not be handled.
41 */
42
43/* Operand sizes: 8-bit operands or specified/overridden size. */
44#define ByteOp (1<<0) /* 8-bit operands. */
45/* Destination operand type. */
46#define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47#define DstReg (2<<1) /* Register operand. */
48#define DstMem (3<<1) /* Memory operand. */
49#define DstMask (3<<1)
50/* Source operand type. */
51#define SrcNone (0<<3) /* No source operand. */
52#define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53#define SrcReg (1<<3) /* Register operand. */
54#define SrcMem (2<<3) /* Memory operand. */
55#define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56#define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57#define SrcImm (5<<3) /* Immediate operand. */
58#define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59#define SrcMask (7<<3)
60/* Generic ModRM decode. */
61#define ModRM (1<<6)
62/* Destination is only written; never read. */
63#define Mov (1<<7)
038e51de 64#define BitOp (1<<8)
6aa8b732
AK		 65
66static u8 opcode_table[256] = {
67 /* 0x00 - 0x07 */
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
70 0, 0, 0, 0,
71 /* 0x08 - 0x0F */
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
74 0, 0, 0, 0,
75 /* 0x10 - 0x17 */
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
78 0, 0, 0, 0,
79 /* 0x18 - 0x1F */
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
82 0, 0, 0, 0,
83 /* 0x20 - 0x27 */
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 0, 0, 0, 0,
87 /* 0x28 - 0x2F */
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
90 0, 0, 0, 0,
91 /* 0x30 - 0x37 */
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
94 0, 0, 0, 0,
95 /* 0x38 - 0x3F */
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
98 0, 0, 0, 0,
99 /* 0x40 - 0x4F */
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
7f0aaee0
NK		 101 /* 0x50 - 0x57 */
102 0, 0, 0, 0, 0, 0, 0, 0,
103 /* 0x58 - 0x5F */
104 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
6aa8b732
AK		 106 /* 0x60 - 0x6F */
107 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
108 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
109 /* 0x70 - 0x7F */
110 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
111 /* 0x80 - 0x87 */
112 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
113 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
114 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
115 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
116 /* 0x88 - 0x8F */
117 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
118 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
119 0, 0, 0, DstMem | SrcNone | ModRM | Mov,
120 /* 0x90 - 0x9F */
121 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
122 /* 0xA0 - 0xA7 */
123 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
124 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
125 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
126 ByteOp | ImplicitOps, ImplicitOps,
127 /* 0xA8 - 0xAF */
128 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
129 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
130 ByteOp | ImplicitOps, ImplicitOps,
131 /* 0xB0 - 0xBF */
132 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
133 /* 0xC0 - 0xC7 */
d9413cd7
NK		 134 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
135 0, ImplicitOps, 0, 0,
136 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
6aa8b732
AK		 137 /* 0xC8 - 0xCF */
138 0, 0, 0, 0, 0, 0, 0, 0,
139 /* 0xD0 - 0xD7 */
140 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
141 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
142 0, 0, 0, 0,
143 /* 0xD8 - 0xDF */
144 0, 0, 0, 0, 0, 0, 0, 0,
145 /* 0xE0 - 0xEF */
146 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
147 /* 0xF0 - 0xF7 */
148 0, 0, 0, 0,
72d6e5a0
AK		 149 ImplicitOps, 0,
150 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
6aa8b732
AK		 151 /* 0xF8 - 0xFF */
152 0, 0, 0, 0,
153 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
154};
155
038e51de 156static u16 twobyte_table[256] = {
6aa8b732
AK		 157 /* 0x00 - 0x0F */
158 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
687fdbfe 159 0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
6aa8b732
AK		 160 /* 0x10 - 0x1F */
161 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
162 /* 0x20 - 0x2F */
163 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
164 0, 0, 0, 0, 0, 0, 0, 0,
165 /* 0x30 - 0x3F */
35f3f286 166 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
6aa8b732
AK		 167 /* 0x40 - 0x47 */
168 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
169 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
170 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
171 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
172 /* 0x48 - 0x4F */
173 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
174 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
175 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
176 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
177 /* 0x50 - 0x5F */
178 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
179 /* 0x60 - 0x6F */
180 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
181 /* 0x70 - 0x7F */
182 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
183 /* 0x80 - 0x8F */
184 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
185 /* 0x90 - 0x9F */
186 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
187 /* 0xA0 - 0xA7 */
038e51de 188 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732 189 /* 0xA8 - 0xAF */
038e51de 190 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732
AK		 191 /* 0xB0 - 0xB7 */
192 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
038e51de 193 DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 194 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
195 DstReg | SrcMem16 | ModRM | Mov,
196 /* 0xB8 - 0xBF */
038e51de 197 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 198 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
199 DstReg | SrcMem16 | ModRM | Mov,
200 /* 0xC0 - 0xCF */
201 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
202 /* 0xD0 - 0xDF */
203 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
204 /* 0xE0 - 0xEF */
205 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
206 /* 0xF0 - 0xFF */
207 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
208};
209
210/*
211 * Tell the emulator that of the Group 7 instructions (sgdt, lidt, etc.) we
212 * are interested only in invlpg and not in any of the rest.
213 *
214 * invlpg is a special instruction in that the data it references may not
215 * be mapped.
216 */
217void kvm_emulator_want_group7_invlpg(void)
218{
219 twobyte_table[1] &= ~SrcMem;
220}
221EXPORT_SYMBOL_GPL(kvm_emulator_want_group7_invlpg);
222
223/* Type, address-of, and value of an instruction's operand. */
224struct operand {
225 enum { OP_REG, OP_MEM, OP_IMM } type;
226 unsigned int bytes;
227 unsigned long val, orig_val, *ptr;
228};
229
230/* EFLAGS bit definitions. */
231#define EFLG_OF (1<<11)
232#define EFLG_DF (1<<10)
233#define EFLG_SF (1<<7)
234#define EFLG_ZF (1<<6)
235#define EFLG_AF (1<<4)
236#define EFLG_PF (1<<2)
237#define EFLG_CF (1<<0)
238
239/*
240 * Instruction emulation:
241 * Most instructions are emulated directly via a fragment of inline assembly
242 * code. This allows us to save/restore EFLAGS and thus very easily pick up
243 * any modified flags.
244 */
245
05b3e0c2 246#if defined(CONFIG_X86_64)
6aa8b732
AK		 247#define _LO32 "k" /* force 32-bit operand */
248#define _STK "%%rsp" /* stack pointer */
249#elif defined(__i386__)
250#define _LO32 "" /* force 32-bit operand */
251#define _STK "%%esp" /* stack pointer */
252#endif
253
254/*
255 * These EFLAGS bits are restored from saved value during emulation, and
256 * any changes are written back to the saved value after emulation.
257 */
258#define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
259
260/* Before executing instruction: restore necessary bits in EFLAGS. */
261#define _PRE_EFLAGS(_sav, _msk, _tmp) \
262 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
263 "push %"_sav"; " \
264 "movl %"_msk",%"_LO32 _tmp"; " \
265 "andl %"_LO32 _tmp",("_STK"); " \
266 "pushf; " \
267 "notl %"_LO32 _tmp"; " \
268 "andl %"_LO32 _tmp",("_STK"); " \
269 "pop %"_tmp"; " \
270 "orl %"_LO32 _tmp",("_STK"); " \
271 "popf; " \
272 /* _sav &= ~msk; */ \
273 "movl %"_msk",%"_LO32 _tmp"; " \
274 "notl %"_LO32 _tmp"; " \
275 "andl %"_LO32 _tmp",%"_sav"; "
276
277/* After executing instruction: write-back necessary bits in EFLAGS. */
278#define _POST_EFLAGS(_sav, _msk, _tmp) \
279 /* _sav |= EFLAGS & _msk; */ \
280 "pushf; " \
281 "pop %"_tmp"; " \
282 "andl %"_msk",%"_LO32 _tmp"; " \
283 "orl %"_LO32 _tmp",%"_sav"; "
284
285/* Raw emulation: instruction has two explicit operands. */
286#define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
287 do { \
288 unsigned long _tmp; \
289 \
290 switch ((_dst).bytes) { \
291 case 2: \
292 __asm__ __volatile__ ( \
293 _PRE_EFLAGS("0","4","2") \
294 _op"w %"_wx"3,%1; " \
295 _POST_EFLAGS("0","4","2") \
296 : "=m" (_eflags), "=m" ((_dst).val), \
297 "=&r" (_tmp) \
298 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
299 break; \
300 case 4: \
301 __asm__ __volatile__ ( \
302 _PRE_EFLAGS("0","4","2") \
303 _op"l %"_lx"3,%1; " \
304 _POST_EFLAGS("0","4","2") \
305 : "=m" (_eflags), "=m" ((_dst).val), \
306 "=&r" (_tmp) \
307 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
308 break; \
309 case 8: \
310 __emulate_2op_8byte(_op, _src, _dst, \
311 _eflags, _qx, _qy); \
312 break; \
313 } \
314 } while (0)
315
316#define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
317 do { \
318 unsigned long _tmp; \
319 switch ( (_dst).bytes ) \
320 { \
321 case 1: \
322 __asm__ __volatile__ ( \
323 _PRE_EFLAGS("0","4","2") \
324 _op"b %"_bx"3,%1; " \
325 _POST_EFLAGS("0","4","2") \
326 : "=m" (_eflags), "=m" ((_dst).val), \
327 "=&r" (_tmp) \
328 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
329 break; \
330 default: \
331 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
332 _wx, _wy, _lx, _ly, _qx, _qy); \
333 break; \
334 } \
335 } while (0)
336
337/* Source operand is byte-sized and may be restricted to just %cl. */
338#define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
339 __emulate_2op(_op, _src, _dst, _eflags, \
340 "b", "c", "b", "c", "b", "c", "b", "c")
341
342/* Source operand is byte, word, long or quad sized. */
343#define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
344 __emulate_2op(_op, _src, _dst, _eflags, \
345 "b", "q", "w", "r", _LO32, "r", "", "r")
346
347/* Source operand is word, long or quad sized. */
348#define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
349 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
350 "w", "r", _LO32, "r", "", "r")
351
352/* Instruction has only one explicit operand (no source operand). */
353#define emulate_1op(_op, _dst, _eflags) \
354 do { \
355 unsigned long _tmp; \
356 \
357 switch ( (_dst).bytes ) \
358 { \
359 case 1: \
360 __asm__ __volatile__ ( \
361 _PRE_EFLAGS("0","3","2") \
362 _op"b %1; " \
363 _POST_EFLAGS("0","3","2") \
364 : "=m" (_eflags), "=m" ((_dst).val), \
365 "=&r" (_tmp) \
366 : "i" (EFLAGS_MASK) ); \
367 break; \
368 case 2: \
369 __asm__ __volatile__ ( \
370 _PRE_EFLAGS("0","3","2") \
371 _op"w %1; " \
372 _POST_EFLAGS("0","3","2") \
373 : "=m" (_eflags), "=m" ((_dst).val), \
374 "=&r" (_tmp) \
375 : "i" (EFLAGS_MASK) ); \
376 break; \
377 case 4: \
378 __asm__ __volatile__ ( \
379 _PRE_EFLAGS("0","3","2") \
380 _op"l %1; " \
381 _POST_EFLAGS("0","3","2") \
382 : "=m" (_eflags), "=m" ((_dst).val), \
383 "=&r" (_tmp) \
384 : "i" (EFLAGS_MASK) ); \
385 break; \
386 case 8: \
387 __emulate_1op_8byte(_op, _dst, _eflags); \
388 break; \
389 } \
390 } while (0)
391
392/* Emulate an instruction with quadword operands (x86/64 only). */
05b3e0c2 393#if defined(CONFIG_X86_64)
6aa8b732
AK		 394#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
395 do { \
396 __asm__ __volatile__ ( \
397 _PRE_EFLAGS("0","4","2") \
398 _op"q %"_qx"3,%1; " \
399 _POST_EFLAGS("0","4","2") \
400 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
401 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
402 } while (0)
403
404#define __emulate_1op_8byte(_op, _dst, _eflags) \
405 do { \
406 __asm__ __volatile__ ( \
407 _PRE_EFLAGS("0","3","2") \
408 _op"q %1; " \
409 _POST_EFLAGS("0","3","2") \
410 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
411 : "i" (EFLAGS_MASK) ); \
412 } while (0)
413
414#elif defined(__i386__)
415#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
416#define __emulate_1op_8byte(_op, _dst, _eflags)
417#endif /* __i386__ */
418
419/* Fetch next part of the instruction being emulated. */
420#define insn_fetch(_type, _size, _eip) \
421({ unsigned long _x; \
422 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
423 (_size), ctxt); \
424 if ( rc != 0 ) \
425 goto done; \
426 (_eip) += (_size); \
427 (_type)_x; \
428})
429
430/* Access/update address held in a register, based on addressing mode. */
431#define register_address(base, reg) \
432 ((base) + ((ad_bytes == sizeof(unsigned long)) ? (reg) : \
433 ((reg) & ((1UL << (ad_bytes << 3)) - 1))))
434
435#define register_address_increment(reg, inc) \
436 do { \
437 /* signed type ensures sign extension to long */ \
438 int _inc = (inc); \
439 if ( ad_bytes == sizeof(unsigned long) ) \
440 (reg) += _inc; \
441 else \
442 (reg) = ((reg) & ~((1UL << (ad_bytes << 3)) - 1)) | \
443 (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
444 } while (0)
445
1e3c5cb0
RR		 446/*
447 * Given the 'reg' portion of a ModRM byte, and a register block, return a
448 * pointer into the block that addresses the relevant register.
449 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
450 */
451static void *decode_register(u8 modrm_reg, unsigned long *regs,
452 int highbyte_regs)
6aa8b732
AK		 453{
454 void *p;
455
456 p = &regs[modrm_reg];
457 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
458 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
459 return p;
460}
461
462static int read_descriptor(struct x86_emulate_ctxt *ctxt,
463 struct x86_emulate_ops *ops,
464 void *ptr,
465 u16 *size, unsigned long *address, int op_bytes)
466{
467 int rc;
468
469 if (op_bytes == 2)
470 op_bytes = 3;
471 *address = 0;
472 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2, ctxt);
473 if (rc)
474 return rc;
475 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes, ctxt);
476 return rc;
477}
478
479int
480x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
481{
038e51de
AK		 482 unsigned d;
483 u8 b, sib, twobyte = 0, rex_prefix = 0;
6aa8b732
AK		 484 u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
485 unsigned long *override_base = NULL;
486 unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
487 int rc = 0;
488 struct operand src, dst;
489 unsigned long cr2 = ctxt->cr2;
490 int mode = ctxt->mode;
491 unsigned long modrm_ea;
492 int use_modrm_ea, index_reg = 0, base_reg = 0, scale, rip_relative = 0;
02c03a32 493 int no_wb = 0;
35f3f286 494 u64 msr_data;
6aa8b732
AK		 495
496 /* Shadow copy of register state. Committed on successful emulation. */
497 unsigned long _regs[NR_VCPU_REGS];
498 unsigned long _eip = ctxt->vcpu->rip, _eflags = ctxt->eflags;
499 unsigned long modrm_val = 0;
500
501 memcpy(_regs, ctxt->vcpu->regs, sizeof _regs);
502
503 switch (mode) {
504 case X86EMUL_MODE_REAL:
505 case X86EMUL_MODE_PROT16:
506 op_bytes = ad_bytes = 2;
507 break;
508 case X86EMUL_MODE_PROT32:
509 op_bytes = ad_bytes = 4;
510 break;
05b3e0c2 511#ifdef CONFIG_X86_64
6aa8b732
AK		 512 case X86EMUL_MODE_PROT64:
513 op_bytes = 4;
514 ad_bytes = 8;
515 break;
516#endif
517 default:
518 return -1;
519 }
520
521 /* Legacy prefixes. */
522 for (i = 0; i < 8; i++) {
523 switch (b = insn_fetch(u8, 1, _eip)) {
524 case 0x66: /* operand-size override */
525 op_bytes ^= 6; /* switch between 2/4 bytes */
526 break;
527 case 0x67: /* address-size override */
528 if (mode == X86EMUL_MODE_PROT64)
529 ad_bytes ^= 12; /* switch between 4/8 bytes */
530 else
531 ad_bytes ^= 6; /* switch between 2/4 bytes */
532 break;
533 case 0x2e: /* CS override */
534 override_base = &ctxt->cs_base;
535 break;
536 case 0x3e: /* DS override */
537 override_base = &ctxt->ds_base;
538 break;
539 case 0x26: /* ES override */
540 override_base = &ctxt->es_base;
541 break;
542 case 0x64: /* FS override */
543 override_base = &ctxt->fs_base;
544 break;
545 case 0x65: /* GS override */
546 override_base = &ctxt->gs_base;
547 break;
548 case 0x36: /* SS override */
549 override_base = &ctxt->ss_base;
550 break;
551 case 0xf0: /* LOCK */
552 lock_prefix = 1;
553 break;
554 case 0xf3: /* REP/REPE/REPZ */
555 rep_prefix = 1;
556 break;
557 case 0xf2: /* REPNE/REPNZ */
558 break;
559 default:
560 goto done_prefixes;
561 }
562 }
563
564done_prefixes:
565
566 /* REX prefix. */
567 if ((mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40)) {
568 rex_prefix = b;
569 if (b & 8)
570 op_bytes = 8; /* REX.W */
571 modrm_reg = (b & 4) << 1; /* REX.R */
572 index_reg = (b & 2) << 2; /* REX.X */
573 modrm_rm = base_reg = (b & 1) << 3; /* REG.B */
574 b = insn_fetch(u8, 1, _eip);
575 }
576
577 /* Opcode byte(s). */
578 d = opcode_table[b];
579 if (d == 0) {
580 /* Two-byte opcode? */
581 if (b == 0x0f) {
582 twobyte = 1;
583 b = insn_fetch(u8, 1, _eip);
584 d = twobyte_table[b];
585 }
586
587 /* Unrecognised? */
588 if (d == 0)
589 goto cannot_emulate;
590 }
591
592 /* ModRM and SIB bytes. */
593 if (d & ModRM) {
594 modrm = insn_fetch(u8, 1, _eip);
595 modrm_mod |= (modrm & 0xc0) >> 6;
596 modrm_reg |= (modrm & 0x38) >> 3;
597 modrm_rm |= (modrm & 0x07);
598 modrm_ea = 0;
599 use_modrm_ea = 1;
600
601 if (modrm_mod == 3) {
602 modrm_val = *(unsigned long *)
603 decode_register(modrm_rm, _regs, d & ByteOp);
604 goto modrm_done;
605 }
606
607 if (ad_bytes == 2) {
608 unsigned bx = _regs[VCPU_REGS_RBX];
609 unsigned bp = _regs[VCPU_REGS_RBP];
610 unsigned si = _regs[VCPU_REGS_RSI];
611 unsigned di = _regs[VCPU_REGS_RDI];
612
613 /* 16-bit ModR/M decode. */
614 switch (modrm_mod) {
615 case 0:
616 if (modrm_rm == 6)
617 modrm_ea += insn_fetch(u16, 2, _eip);
618 break;
619 case 1:
620 modrm_ea += insn_fetch(s8, 1, _eip);
621 break;
622 case 2:
623 modrm_ea += insn_fetch(u16, 2, _eip);
624 break;
625 }
626 switch (modrm_rm) {
627 case 0:
628 modrm_ea += bx + si;
629 break;
630 case 1:
631 modrm_ea += bx + di;
632 break;
633 case 2:
634 modrm_ea += bp + si;
635 break;
636 case 3:
637 modrm_ea += bp + di;
638 break;
639 case 4:
640 modrm_ea += si;
641 break;
642 case 5:
643 modrm_ea += di;
644 break;
645 case 6:
646 if (modrm_mod != 0)
647 modrm_ea += bp;
648 break;
649 case 7:
650 modrm_ea += bx;
651 break;
652 }
653 if (modrm_rm == 2 || modrm_rm == 3 ||
654 (modrm_rm == 6 && modrm_mod != 0))
655 if (!override_base)
656 override_base = &ctxt->ss_base;
657 modrm_ea = (u16)modrm_ea;
658 } else {
659 /* 32/64-bit ModR/M decode. */
660 switch (modrm_rm) {
661 case 4:
662 case 12:
663 sib = insn_fetch(u8, 1, _eip);
664 index_reg |= (sib >> 3) & 7;
665 base_reg |= sib & 7;
666 scale = sib >> 6;
667
668 switch (base_reg) {
669 case 5:
670 if (modrm_mod != 0)
671 modrm_ea += _regs[base_reg];
672 else
673 modrm_ea += insn_fetch(s32, 4, _eip);
674 break;
675 default:
676 modrm_ea += _regs[base_reg];
677 }
678 switch (index_reg) {
679 case 4:
680 break;
681 default:
682 modrm_ea += _regs[index_reg] << scale;
683
684 }
685 break;
686 case 5:
687 if (modrm_mod != 0)
688 modrm_ea += _regs[modrm_rm];
689 else if (mode == X86EMUL_MODE_PROT64)
690 rip_relative = 1;
691 break;
692 default:
693 modrm_ea += _regs[modrm_rm];
694 break;
695 }
696 switch (modrm_mod) {
697 case 0:
698 if (modrm_rm == 5)
699 modrm_ea += insn_fetch(s32, 4, _eip);
700 break;
701 case 1:
702 modrm_ea += insn_fetch(s8, 1, _eip);
703 break;
704 case 2:
705 modrm_ea += insn_fetch(s32, 4, _eip);
706 break;
707 }
708 }
709 if (!override_base)
710 override_base = &ctxt->ds_base;
711 if (mode == X86EMUL_MODE_PROT64 &&
712 override_base != &ctxt->fs_base &&
713 override_base != &ctxt->gs_base)
714 override_base = NULL;
715
716 if (override_base)
717 modrm_ea += *override_base;
718
719 if (rip_relative) {
720 modrm_ea += _eip;
721 switch (d & SrcMask) {
722 case SrcImmByte:
723 modrm_ea += 1;
724 break;
725 case SrcImm:
726 if (d & ByteOp)
727 modrm_ea += 1;
728 else
729 if (op_bytes == 8)
730 modrm_ea += 4;
731 else
732 modrm_ea += op_bytes;
733 }
734 }
735 if (ad_bytes != 8)
736 modrm_ea = (u32)modrm_ea;
737 cr2 = modrm_ea;
738 modrm_done:
739 ;
740 }
741
6aa8b732
AK		 742 /*
743 * Decode and fetch the source operand: register, memory
744 * or immediate.
745 */
746 switch (d & SrcMask) {
747 case SrcNone:
748 break;
749 case SrcReg:
750 src.type = OP_REG;
751 if (d & ByteOp) {
752 src.ptr = decode_register(modrm_reg, _regs,
753 (rex_prefix == 0));
754 src.val = src.orig_val = *(u8 *) src.ptr;
755 src.bytes = 1;
756 } else {
757 src.ptr = decode_register(modrm_reg, _regs, 0);
758 switch ((src.bytes = op_bytes)) {
759 case 2:
760 src.val = src.orig_val = *(u16 *) src.ptr;
761 break;
762 case 4:
763 src.val = src.orig_val = *(u32 *) src.ptr;
764 break;
765 case 8:
766 src.val = src.orig_val = *(u64 *) src.ptr;
767 break;
768 }
769 }
770 break;
771 case SrcMem16:
772 src.bytes = 2;
773 goto srcmem_common;
774 case SrcMem32:
775 src.bytes = 4;
776 goto srcmem_common;
777 case SrcMem:
778 src.bytes = (d & ByteOp) ? 1 : op_bytes;
779 srcmem_common:
780 src.type = OP_MEM;
781 src.ptr = (unsigned long *)cr2;
782 if ((rc = ops->read_emulated((unsigned long)src.ptr,
783 &src.val, src.bytes, ctxt)) != 0)
784 goto done;
785 src.orig_val = src.val;
786 break;
787 case SrcImm:
788 src.type = OP_IMM;
789 src.ptr = (unsigned long *)_eip;
790 src.bytes = (d & ByteOp) ? 1 : op_bytes;
791 if (src.bytes == 8)
792 src.bytes = 4;
793 /* NB. Immediates are sign-extended as necessary. */
794 switch (src.bytes) {
795 case 1:
796 src.val = insn_fetch(s8, 1, _eip);
797 break;
798 case 2:
799 src.val = insn_fetch(s16, 2, _eip);
800 break;
801 case 4:
802 src.val = insn_fetch(s32, 4, _eip);
803 break;
804 }
805 break;
806 case SrcImmByte:
807 src.type = OP_IMM;
808 src.ptr = (unsigned long *)_eip;
809 src.bytes = 1;
810 src.val = insn_fetch(s8, 1, _eip);
811 break;
812 }
813
038e51de
AK		 814 /* Decode and fetch the destination operand: register or memory. */
815 switch (d & DstMask) {
816 case ImplicitOps:
817 /* Special instructions do their own operand decoding. */
818 goto special_insn;
819 case DstReg:
820 dst.type = OP_REG;
821 if ((d & ByteOp)
822 && !(twobyte_table && (b == 0xb6 || b == 0xb7))) {
823 dst.ptr = decode_register(modrm_reg, _regs,
824 (rex_prefix == 0));
825 dst.val = *(u8 *) dst.ptr;
826 dst.bytes = 1;
827 } else {
828 dst.ptr = decode_register(modrm_reg, _regs, 0);
829 switch ((dst.bytes = op_bytes)) {
830 case 2:
831 dst.val = *(u16 *)dst.ptr;
832 break;
833 case 4:
834 dst.val = *(u32 *)dst.ptr;
835 break;
836 case 8:
837 dst.val = *(u64 *)dst.ptr;
838 break;
839 }
840 }
841 break;
842 case DstMem:
843 dst.type = OP_MEM;
844 dst.ptr = (unsigned long *)cr2;
845 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
846 if (d & BitOp) {
df513e2c
AK		 847 unsigned long mask = ~(dst.bytes * 8 - 1);
848
849 dst.ptr = (void *)dst.ptr + (src.val & mask) / 8;
038e51de
AK		 850 }
851 if (!(d & Mov) && /* optimisation - avoid slow emulated read */
852 ((rc = ops->read_emulated((unsigned long)dst.ptr,
853 &dst.val, dst.bytes, ctxt)) != 0))
854 goto done;
855 break;
856 }
857 dst.orig_val = dst.val;
858
6aa8b732
AK		 859 if (twobyte)
860 goto twobyte_insn;
861
862 switch (b) {
863 case 0x00 ... 0x05:
864 add: /* add */
865 emulate_2op_SrcV("add", src, dst, _eflags);
866 break;
867 case 0x08 ... 0x0d:
868 or: /* or */
869 emulate_2op_SrcV("or", src, dst, _eflags);
870 break;
871 case 0x10 ... 0x15:
872 adc: /* adc */
873 emulate_2op_SrcV("adc", src, dst, _eflags);
874 break;
875 case 0x18 ... 0x1d:
876 sbb: /* sbb */
877 emulate_2op_SrcV("sbb", src, dst, _eflags);
878 break;
879 case 0x20 ... 0x25:
880 and: /* and */
881 emulate_2op_SrcV("and", src, dst, _eflags);
882 break;
883 case 0x28 ... 0x2d:
884 sub: /* sub */
885 emulate_2op_SrcV("sub", src, dst, _eflags);
886 break;
887 case 0x30 ... 0x35:
888 xor: /* xor */
889 emulate_2op_SrcV("xor", src, dst, _eflags);
890 break;
891 case 0x38 ... 0x3d:
892 cmp: /* cmp */
893 emulate_2op_SrcV("cmp", src, dst, _eflags);
894 break;
895 case 0x63: /* movsxd */
896 if (mode != X86EMUL_MODE_PROT64)
897 goto cannot_emulate;
898 dst.val = (s32) src.val;
899 break;
900 case 0x80 ... 0x83: /* Grp1 */
901 switch (modrm_reg) {
902 case 0:
903 goto add;
904 case 1:
905 goto or;
906 case 2:
907 goto adc;
908 case 3:
909 goto sbb;
910 case 4:
911 goto and;
912 case 5:
913 goto sub;
914 case 6:
915 goto xor;
916 case 7:
917 goto cmp;
918 }
919 break;
920 case 0x84 ... 0x85:
921 test: /* test */
922 emulate_2op_SrcV("test", src, dst, _eflags);
923 break;
924 case 0x86 ... 0x87: /* xchg */
925 /* Write back the register source. */
926 switch (dst.bytes) {
927 case 1:
928 *(u8 *) src.ptr = (u8) dst.val;
929 break;
930 case 2:
931 *(u16 *) src.ptr = (u16) dst.val;
932 break;
933 case 4:
934 *src.ptr = (u32) dst.val;
935 break; /* 64b reg: zero-extend */
936 case 8:
937 *src.ptr = dst.val;
938 break;
939 }
940 /*
941 * Write back the memory destination with implicit LOCK
942 * prefix.
943 */
944 dst.val = src.val;
945 lock_prefix = 1;
946 break;
947 case 0xa0 ... 0xa1: /* mov */
948 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
949 dst.val = src.val;
950 _eip += ad_bytes; /* skip src displacement */
951 break;
952 case 0xa2 ... 0xa3: /* mov */
953 dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
954 _eip += ad_bytes; /* skip dst displacement */
955 break;
956 case 0x88 ... 0x8b: /* mov */
957 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
958 dst.val = src.val;
959 break;
960 case 0x8f: /* pop (sole member of Grp1a) */
961 /* 64-bit mode: POP always pops a 64-bit operand. */
962 if (mode == X86EMUL_MODE_PROT64)
963 dst.bytes = 8;
964 if ((rc = ops->read_std(register_address(ctxt->ss_base,
965 _regs[VCPU_REGS_RSP]),
966 &dst.val, dst.bytes, ctxt)) != 0)
967 goto done;
968 register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
969 break;
970 case 0xc0 ... 0xc1:
971 grp2: /* Grp2 */
972 switch (modrm_reg) {
973 case 0: /* rol */
974 emulate_2op_SrcB("rol", src, dst, _eflags);
975 break;
976 case 1: /* ror */
977 emulate_2op_SrcB("ror", src, dst, _eflags);
978 break;
979 case 2: /* rcl */
980 emulate_2op_SrcB("rcl", src, dst, _eflags);
981 break;
982 case 3: /* rcr */
983 emulate_2op_SrcB("rcr", src, dst, _eflags);
984 break;
985 case 4: /* sal/shl */
986 case 6: /* sal/shl */
987 emulate_2op_SrcB("sal", src, dst, _eflags);
988 break;
989 case 5: /* shr */
990 emulate_2op_SrcB("shr", src, dst, _eflags);
991 break;
992 case 7: /* sar */
993 emulate_2op_SrcB("sar", src, dst, _eflags);
994 break;
995 }
996 break;
997 case 0xd0 ... 0xd1: /* Grp2 */
998 src.val = 1;
999 goto grp2;
1000 case 0xd2 ... 0xd3: /* Grp2 */
1001 src.val = _regs[VCPU_REGS_RCX];
1002 goto grp2;
1003 case 0xf6 ... 0xf7: /* Grp3 */
1004 switch (modrm_reg) {
1005 case 0 ... 1: /* test */
1006 /*
1007 * Special case in Grp3: test has an immediate
1008 * source operand.
1009 */
1010 src.type = OP_IMM;
1011 src.ptr = (unsigned long *)_eip;
1012 src.bytes = (d & ByteOp) ? 1 : op_bytes;
1013 if (src.bytes == 8)
1014 src.bytes = 4;
1015 switch (src.bytes) {
1016 case 1:
1017 src.val = insn_fetch(s8, 1, _eip);
1018 break;
1019 case 2:
1020 src.val = insn_fetch(s16, 2, _eip);
1021 break;
1022 case 4:
1023 src.val = insn_fetch(s32, 4, _eip);
1024 break;
1025 }
1026 goto test;
1027 case 2: /* not */
1028 dst.val = ~dst.val;
1029 break;
1030 case 3: /* neg */
1031 emulate_1op("neg", dst, _eflags);
1032 break;
1033 default:
1034 goto cannot_emulate;
1035 }
1036 break;
1037 case 0xfe ... 0xff: /* Grp4/Grp5 */
1038 switch (modrm_reg) {
1039 case 0: /* inc */
1040 emulate_1op("inc", dst, _eflags);
1041 break;
1042 case 1: /* dec */
1043 emulate_1op("dec", dst, _eflags);
1044 break;
1045 case 6: /* push */
1046 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1047 if (mode == X86EMUL_MODE_PROT64) {
1048 dst.bytes = 8;
1049 if ((rc = ops->read_std((unsigned long)dst.ptr,
1050 &dst.val, 8,
1051 ctxt)) != 0)
1052 goto done;
1053 }
1054 register_address_increment(_regs[VCPU_REGS_RSP],
1055 -dst.bytes);
1056 if ((rc = ops->write_std(
1057 register_address(ctxt->ss_base,
1058 _regs[VCPU_REGS_RSP]),
4c690a1e 1059 &dst.val, dst.bytes, ctxt)) != 0)
6aa8b732 1060 goto done;
02c03a32 1061 no_wb = 1;
6aa8b732
AK		 1062 break;
1063 default:
1064 goto cannot_emulate;
1065 }
1066 break;
1067 }
1068
1069writeback:
02c03a32 1070 if (!no_wb) {
6aa8b732
AK		 1071 switch (dst.type) {
1072 case OP_REG:
1073 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1074 switch (dst.bytes) {
1075 case 1:
1076 *(u8 *)dst.ptr = (u8)dst.val;
1077 break;
1078 case 2:
1079 *(u16 *)dst.ptr = (u16)dst.val;
1080 break;
1081 case 4:
1082 *dst.ptr = (u32)dst.val;
1083 break; /* 64b: zero-ext */
1084 case 8:
1085 *dst.ptr = dst.val;
1086 break;
1087 }
1088 break;
1089 case OP_MEM:
1090 if (lock_prefix)
1091 rc = ops->cmpxchg_emulated((unsigned long)dst.
4c690a1e
AK		 1092 ptr, &dst.orig_val,
1093 &dst.val, dst.bytes,
6aa8b732
AK		 1094 ctxt);
1095 else
1096 rc = ops->write_emulated((unsigned long)dst.ptr,
4c690a1e 1097 &dst.val, dst.bytes,
6aa8b732
AK		 1098 ctxt);
1099 if (rc != 0)
1100 goto done;
1101 default:
1102 break;
1103 }
1104 }
1105
1106 /* Commit shadow register state. */
1107 memcpy(ctxt->vcpu->regs, _regs, sizeof _regs);
1108 ctxt->eflags = _eflags;
1109 ctxt->vcpu->rip = _eip;
1110
1111done:
1112 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1113
1114special_insn:
1115 if (twobyte)
1116 goto twobyte_special_insn;
1117 if (rep_prefix) {
1118 if (_regs[VCPU_REGS_RCX] == 0) {
1119 ctxt->vcpu->rip = _eip;
1120 goto done;
1121 }
1122 _regs[VCPU_REGS_RCX]--;
1123 _eip = ctxt->vcpu->rip;
1124 }
1125 switch (b) {
1126 case 0xa4 ... 0xa5: /* movs */
1127 dst.type = OP_MEM;
1128 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1129 dst.ptr = (unsigned long *)register_address(ctxt->es_base,
1130 _regs[VCPU_REGS_RDI]);
1131 if ((rc = ops->read_emulated(register_address(
1132 override_base ? *override_base : ctxt->ds_base,
1133 _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt)) != 0)
1134 goto done;
1135 register_address_increment(_regs[VCPU_REGS_RSI],
1136 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1137 register_address_increment(_regs[VCPU_REGS_RDI],
1138 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1139 break;
1140 case 0xa6 ... 0xa7: /* cmps */
1141 DPRINTF("Urk! I don't handle CMPS.\n");
1142 goto cannot_emulate;
1143 case 0xaa ... 0xab: /* stos */
1144 dst.type = OP_MEM;
1145 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1146 dst.ptr = (unsigned long *)cr2;
1147 dst.val = _regs[VCPU_REGS_RAX];
1148 register_address_increment(_regs[VCPU_REGS_RDI],
1149 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1150 break;
1151 case 0xac ... 0xad: /* lods */
1152 dst.type = OP_REG;
1153 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1154 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1155 if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes, ctxt)) != 0)
1156 goto done;
1157 register_address_increment(_regs[VCPU_REGS_RSI],
1158 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1159 break;
1160 case 0xae ... 0xaf: /* scas */
1161 DPRINTF("Urk! I don't handle SCAS.\n");
1162 goto cannot_emulate;
72d6e5a0
AK		 1163 case 0xf4: /* hlt */
1164 ctxt->vcpu->halt_request = 1;
1165 goto done;
d9413cd7
NK		 1166 case 0xc3: /* ret */
1167 dst.ptr = &_eip;
1168 goto pop_instruction;
7f0aaee0
NK		 1169 case 0x58 ... 0x5f: /* pop reg */
1170 dst.ptr = (unsigned long *)&_regs[b & 0x7];
1171
d9413cd7 1172pop_instruction:
7f0aaee0
NK		 1173 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1174 _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt)) != 0)
1175 goto done;
1176
d9413cd7 1177 register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
02c03a32 1178 no_wb = 1; /* Disable writeback. */
7f0aaee0 1179 break;
6aa8b732
AK		 1180 }
1181 goto writeback;
1182
1183twobyte_insn:
1184 switch (b) {
1185 case 0x01: /* lgdt, lidt, lmsw */
d37c8557
AJ		 1186 /* Disable writeback. */
1187 no_wb = 1;
6aa8b732
AK		 1188 switch (modrm_reg) {
1189 u16 size;
1190 unsigned long address;
1191
1192 case 2: /* lgdt */
1193 rc = read_descriptor(ctxt, ops, src.ptr,
1194 &size, &address, op_bytes);
1195 if (rc)
1196 goto done;
1197 realmode_lgdt(ctxt->vcpu, size, address);
1198 break;
1199 case 3: /* lidt */
1200 rc = read_descriptor(ctxt, ops, src.ptr,
1201 &size, &address, op_bytes);
1202 if (rc)
1203 goto done;
1204 realmode_lidt(ctxt->vcpu, size, address);
1205 break;
1206 case 4: /* smsw */
1207 if (modrm_mod != 3)
1208 goto cannot_emulate;
1209 *(u16 *)&_regs[modrm_rm]
1210 = realmode_get_cr(ctxt->vcpu, 0);
1211 break;
1212 case 6: /* lmsw */
1213 if (modrm_mod != 3)
1214 goto cannot_emulate;
1215 realmode_lmsw(ctxt->vcpu, (u16)modrm_val, &_eflags);
1216 break;
1217 case 7: /* invlpg*/
1218 emulate_invlpg(ctxt->vcpu, cr2);
1219 break;
1220 default:
1221 goto cannot_emulate;
1222 }
1223 break;
1224 case 0x21: /* mov from dr to reg */
bac27d35 1225 no_wb = 1;
6aa8b732
AK		 1226 if (modrm_mod != 3)
1227 goto cannot_emulate;
1228 rc = emulator_get_dr(ctxt, modrm_reg, &_regs[modrm_rm]);
1229 break;
1230 case 0x23: /* mov from reg to dr */
bac27d35 1231 no_wb = 1;
6aa8b732
AK		 1232 if (modrm_mod != 3)
1233 goto cannot_emulate;
1234 rc = emulator_set_dr(ctxt, modrm_reg, _regs[modrm_rm]);
1235 break;
1236 case 0x40 ... 0x4f: /* cmov */
1237 dst.val = dst.orig_val = src.val;
1238 d &= ~Mov; /* default to no move */
1239 /*
1240 * First, assume we're decoding an even cmov opcode
1241 * (lsb == 0).
1242 */
1243 switch ((b & 15) >> 1) {
1244 case 0: /* cmovo */
1245 d |= (_eflags & EFLG_OF) ? Mov : 0;
1246 break;
1247 case 1: /* cmovb/cmovc/cmovnae */
1248 d |= (_eflags & EFLG_CF) ? Mov : 0;
1249 break;
1250 case 2: /* cmovz/cmove */
1251 d |= (_eflags & EFLG_ZF) ? Mov : 0;
1252 break;
1253 case 3: /* cmovbe/cmovna */
1254 d |= (_eflags & (EFLG_CF | EFLG_ZF)) ? Mov : 0;
1255 break;
1256 case 4: /* cmovs */
1257 d |= (_eflags & EFLG_SF) ? Mov : 0;
1258 break;
1259 case 5: /* cmovp/cmovpe */
1260 d |= (_eflags & EFLG_PF) ? Mov : 0;
1261 break;
1262 case 7: /* cmovle/cmovng */
1263 d |= (_eflags & EFLG_ZF) ? Mov : 0;
1264 /* fall through */
1265 case 6: /* cmovl/cmovnge */
1266 d |= (!(_eflags & EFLG_SF) !=
1267 !(_eflags & EFLG_OF)) ? Mov : 0;
1268 break;
1269 }
1270 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
1271 d ^= (b & 1) ? Mov : 0;
1272 break;
1273 case 0xb0 ... 0xb1: /* cmpxchg */
1274 /*
1275 * Save real source value, then compare EAX against
1276 * destination.
1277 */
1278 src.orig_val = src.val;
1279 src.val = _regs[VCPU_REGS_RAX];
1280 emulate_2op_SrcV("cmp", src, dst, _eflags);
1281 /* Always write back. The question is: where to? */
1282 d |= Mov;
1283 if (_eflags & EFLG_ZF) {
1284 /* Success: write back to memory. */
1285 dst.val = src.orig_val;
1286 } else {
1287 /* Failure: write the value we saw to EAX. */
1288 dst.type = OP_REG;
1289 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1290 }
1291 break;
1292 case 0xa3:
1293 bt: /* bt */
1294 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1295 emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
1296 break;
1297 case 0xb3:
1298 btr: /* btr */
1299 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1300 emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
1301 break;
1302 case 0xab:
1303 bts: /* bts */
1304 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1305 emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
1306 break;
1307 case 0xb6 ... 0xb7: /* movzx */
1308 dst.bytes = op_bytes;
1309 dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
1310 break;
1311 case 0xbb:
1312 btc: /* btc */
1313 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1314 emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
1315 break;
1316 case 0xba: /* Grp8 */
1317 switch (modrm_reg & 3) {
1318 case 0:
1319 goto bt;
1320 case 1:
1321 goto bts;
1322 case 2:
1323 goto btr;
1324 case 3:
1325 goto btc;
1326 }
1327 break;
1328 case 0xbe ... 0xbf: /* movsx */
1329 dst.bytes = op_bytes;
1330 dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
1331 break;
1332 }
1333 goto writeback;
1334
1335twobyte_special_insn:
1336 /* Disable writeback. */
02c03a32 1337 no_wb = 1;
6aa8b732 1338 switch (b) {
687fdbfe
AK		 1339 case 0x09: /* wbinvd */
1340 break;
6aa8b732
AK		 1341 case 0x0d: /* GrpP (prefetch) */
1342 case 0x18: /* Grp16 (prefetch/nop) */
1343 break;
1344 case 0x06:
1345 emulate_clts(ctxt->vcpu);
1346 break;
1347 case 0x20: /* mov cr, reg */
1348 if (modrm_mod != 3)
1349 goto cannot_emulate;
1350 _regs[modrm_rm] = realmode_get_cr(ctxt->vcpu, modrm_reg);
1351 break;
1352 case 0x22: /* mov reg, cr */
1353 if (modrm_mod != 3)
1354 goto cannot_emulate;
1355 realmode_set_cr(ctxt->vcpu, modrm_reg, modrm_val, &_eflags);
1356 break;
35f3f286
AK		 1357 case 0x30:
1358 /* wrmsr */
1359 msr_data = (u32)_regs[VCPU_REGS_RAX]
1360 | ((u64)_regs[VCPU_REGS_RDX] << 32);
1361 rc = kvm_set_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], msr_data);
1362 if (rc) {
1363 kvm_arch_ops->inject_gp(ctxt->vcpu, 0);
1364 _eip = ctxt->vcpu->rip;
1365 }
1366 rc = X86EMUL_CONTINUE;
1367 break;
1368 case 0x32:
1369 /* rdmsr */
1370 rc = kvm_get_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], &msr_data);
1371 if (rc) {
1372 kvm_arch_ops->inject_gp(ctxt->vcpu, 0);
1373 _eip = ctxt->vcpu->rip;
1374 } else {
1375 _regs[VCPU_REGS_RAX] = (u32)msr_data;
1376 _regs[VCPU_REGS_RDX] = msr_data >> 32;
1377 }
1378 rc = X86EMUL_CONTINUE;
1379 break;
6aa8b732 1380 case 0xc7: /* Grp9 (cmpxchg8b) */
6aa8b732 1381 {
4c690a1e 1382 u64 old, new;
6aa8b732
AK		 1383 if ((rc = ops->read_emulated(cr2, &old, 8, ctxt)) != 0)
1384 goto done;
1385 if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
1386 ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
1387 _regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1388 _regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1389 _eflags &= ~EFLG_ZF;
1390 } else {
4c690a1e
AK		 1391 new = ((u64)_regs[VCPU_REGS_RCX] << 32)
1392 | (u32) _regs[VCPU_REGS_RBX];
1393 if ((rc = ops->cmpxchg_emulated(cr2, &old,
1394 &new, 8, ctxt)) != 0)
6aa8b732
AK		 1395 goto done;
1396 _eflags |= EFLG_ZF;
1397 }
1398 break;
1399 }
6aa8b732
AK		 1400 }
1401 goto writeback;
1402
1403cannot_emulate:
1404 DPRINTF("Cannot emulate %02x\n", b);
1405 return -1;
1406}
1407
1408#ifdef __XEN__
1409
1410#include <asm/mm.h>
1411#include <asm/uaccess.h>
1412
1413int
1414x86_emulate_read_std(unsigned long addr,
1415 unsigned long *val,
1416 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1417{
1418 unsigned int rc;
1419
1420 *val = 0;
1421
1422 if ((rc = copy_from_user((void *)val, (void *)addr, bytes)) != 0) {
1423 propagate_page_fault(addr + bytes - rc, 0); /* read fault */
1424 return X86EMUL_PROPAGATE_FAULT;
1425 }
1426
1427 return X86EMUL_CONTINUE;
1428}
1429
1430int
1431x86_emulate_write_std(unsigned long addr,
1432 unsigned long val,
1433 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1434{
1435 unsigned int rc;
1436
1437 if ((rc = copy_to_user((void *)addr, (void *)&val, bytes)) != 0) {
1438 propagate_page_fault(addr + bytes - rc, PGERR_write_access);
1439 return X86EMUL_PROPAGATE_FAULT;
1440 }
1441
1442 return X86EMUL_CONTINUE;
1443}
1444
1445#endif
ubuntu-bionic-kernel mirror