]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blame - drivers/kvm/x86_emulate.c
projects / mirror_ubuntu-zesty-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
KVM: Add support for in-kernel pio handlers
[mirror_ubuntu-zesty-kernel.git] / drivers / kvm / x86_emulate.c
CommitLineData
6aa8b732
AK		 1/******************************************************************************
2 * x86_emulate.c
3 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privieged instructions:
10 *
11 * Copyright (C) 2006 Qumranet
12 *
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
15 *
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
18 *
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
20 */
21
22#ifndef __KERNEL__
23#include <stdio.h>
24#include <stdint.h>
25#include <public/xen.h>
26#define DPRINTF(_f, _a ...) printf( _f , ## _a )
27#else
28#include "kvm.h"
29#define DPRINTF(x...) do {} while (0)
30#endif
31#include "x86_emulate.h"
32#include <linux/module.h>
33
34/*
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
40 * not be handled.
41 */
42
43/* Operand sizes: 8-bit operands or specified/overridden size. */
44#define ByteOp (1<<0) /* 8-bit operands. */
45/* Destination operand type. */
46#define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47#define DstReg (2<<1) /* Register operand. */
48#define DstMem (3<<1) /* Memory operand. */
49#define DstMask (3<<1)
50/* Source operand type. */
51#define SrcNone (0<<3) /* No source operand. */
52#define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53#define SrcReg (1<<3) /* Register operand. */
54#define SrcMem (2<<3) /* Memory operand. */
55#define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56#define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57#define SrcImm (5<<3) /* Immediate operand. */
58#define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59#define SrcMask (7<<3)
60/* Generic ModRM decode. */
61#define ModRM (1<<6)
62/* Destination is only written; never read. */
63#define Mov (1<<7)
038e51de 64#define BitOp (1<<8)
6aa8b732
AK		 65
66static u8 opcode_table[256] = {
67 /* 0x00 - 0x07 */
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
70 0, 0, 0, 0,
71 /* 0x08 - 0x0F */
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
74 0, 0, 0, 0,
75 /* 0x10 - 0x17 */
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
78 0, 0, 0, 0,
79 /* 0x18 - 0x1F */
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
82 0, 0, 0, 0,
83 /* 0x20 - 0x27 */
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 0, 0, 0, 0,
87 /* 0x28 - 0x2F */
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
90 0, 0, 0, 0,
91 /* 0x30 - 0x37 */
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
94 0, 0, 0, 0,
95 /* 0x38 - 0x3F */
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
98 0, 0, 0, 0,
99 /* 0x40 - 0x4F */
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
7f0aaee0
NK		 101 /* 0x50 - 0x57 */
102 0, 0, 0, 0, 0, 0, 0, 0,
103 /* 0x58 - 0x5F */
104 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
6aa8b732
AK		 106 /* 0x60 - 0x6F */
107 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
108 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
109 /* 0x70 - 0x7F */
110 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
111 /* 0x80 - 0x87 */
112 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
113 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
114 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
115 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
116 /* 0x88 - 0x8F */
117 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
118 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
119 0, 0, 0, DstMem | SrcNone | ModRM | Mov,
120 /* 0x90 - 0x9F */
121 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
122 /* 0xA0 - 0xA7 */
123 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
124 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
125 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
126 ByteOp | ImplicitOps, ImplicitOps,
127 /* 0xA8 - 0xAF */
128 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
129 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
130 ByteOp | ImplicitOps, ImplicitOps,
131 /* 0xB0 - 0xBF */
132 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
133 /* 0xC0 - 0xC7 */
d9413cd7
NK		 134 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
135 0, ImplicitOps, 0, 0,
136 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
6aa8b732
AK		 137 /* 0xC8 - 0xCF */
138 0, 0, 0, 0, 0, 0, 0, 0,
139 /* 0xD0 - 0xD7 */
140 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
141 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
142 0, 0, 0, 0,
143 /* 0xD8 - 0xDF */
144 0, 0, 0, 0, 0, 0, 0, 0,
145 /* 0xE0 - 0xEF */
146 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
147 /* 0xF0 - 0xF7 */
148 0, 0, 0, 0,
72d6e5a0
AK		 149 ImplicitOps, 0,
150 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
6aa8b732
AK		 151 /* 0xF8 - 0xFF */
152 0, 0, 0, 0,
153 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
154};
155
038e51de 156static u16 twobyte_table[256] = {
6aa8b732
AK		 157 /* 0x00 - 0x0F */
158 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
687fdbfe 159 0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
6aa8b732
AK		 160 /* 0x10 - 0x1F */
161 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
162 /* 0x20 - 0x2F */
163 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
164 0, 0, 0, 0, 0, 0, 0, 0,
165 /* 0x30 - 0x3F */
166 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
167 /* 0x40 - 0x47 */
168 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
169 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
170 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
171 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
172 /* 0x48 - 0x4F */
173 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
174 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
175 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
176 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
177 /* 0x50 - 0x5F */
178 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
179 /* 0x60 - 0x6F */
180 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
181 /* 0x70 - 0x7F */
182 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
183 /* 0x80 - 0x8F */
184 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
185 /* 0x90 - 0x9F */
186 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
187 /* 0xA0 - 0xA7 */
038e51de 188 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732 189 /* 0xA8 - 0xAF */
038e51de 190 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732
AK		 191 /* 0xB0 - 0xB7 */
192 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
038e51de 193 DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 194 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
195 DstReg | SrcMem16 | ModRM | Mov,
196 /* 0xB8 - 0xBF */
038e51de 197 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 198 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
199 DstReg | SrcMem16 | ModRM | Mov,
200 /* 0xC0 - 0xCF */
201 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
202 /* 0xD0 - 0xDF */
203 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
204 /* 0xE0 - 0xEF */
205 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
206 /* 0xF0 - 0xFF */
207 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
208};
209
210/*
211 * Tell the emulator that of the Group 7 instructions (sgdt, lidt, etc.) we
212 * are interested only in invlpg and not in any of the rest.
213 *
214 * invlpg is a special instruction in that the data it references may not
215 * be mapped.
216 */
217void kvm_emulator_want_group7_invlpg(void)
218{
219 twobyte_table[1] &= ~SrcMem;
220}
221EXPORT_SYMBOL_GPL(kvm_emulator_want_group7_invlpg);
222
223/* Type, address-of, and value of an instruction's operand. */
224struct operand {
225 enum { OP_REG, OP_MEM, OP_IMM } type;
226 unsigned int bytes;
227 unsigned long val, orig_val, *ptr;
228};
229
230/* EFLAGS bit definitions. */
231#define EFLG_OF (1<<11)
232#define EFLG_DF (1<<10)
233#define EFLG_SF (1<<7)
234#define EFLG_ZF (1<<6)
235#define EFLG_AF (1<<4)
236#define EFLG_PF (1<<2)
237#define EFLG_CF (1<<0)
238
239/*
240 * Instruction emulation:
241 * Most instructions are emulated directly via a fragment of inline assembly
242 * code. This allows us to save/restore EFLAGS and thus very easily pick up
243 * any modified flags.
244 */
245
05b3e0c2 246#if defined(CONFIG_X86_64)
6aa8b732
AK		 247#define _LO32 "k" /* force 32-bit operand */
248#define _STK "%%rsp" /* stack pointer */
249#elif defined(__i386__)
250#define _LO32 "" /* force 32-bit operand */
251#define _STK "%%esp" /* stack pointer */
252#endif
253
254/*
255 * These EFLAGS bits are restored from saved value during emulation, and
256 * any changes are written back to the saved value after emulation.
257 */
258#define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
259
260/* Before executing instruction: restore necessary bits in EFLAGS. */
261#define _PRE_EFLAGS(_sav, _msk, _tmp) \
262 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
263 "push %"_sav"; " \
264 "movl %"_msk",%"_LO32 _tmp"; " \
265 "andl %"_LO32 _tmp",("_STK"); " \
266 "pushf; " \
267 "notl %"_LO32 _tmp"; " \
268 "andl %"_LO32 _tmp",("_STK"); " \
269 "pop %"_tmp"; " \
270 "orl %"_LO32 _tmp",("_STK"); " \
271 "popf; " \
272 /* _sav &= ~msk; */ \
273 "movl %"_msk",%"_LO32 _tmp"; " \
274 "notl %"_LO32 _tmp"; " \
275 "andl %"_LO32 _tmp",%"_sav"; "
276
277/* After executing instruction: write-back necessary bits in EFLAGS. */
278#define _POST_EFLAGS(_sav, _msk, _tmp) \
279 /* _sav |= EFLAGS & _msk; */ \
280 "pushf; " \
281 "pop %"_tmp"; " \
282 "andl %"_msk",%"_LO32 _tmp"; " \
283 "orl %"_LO32 _tmp",%"_sav"; "
284
285/* Raw emulation: instruction has two explicit operands. */
286#define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
287 do { \
288 unsigned long _tmp; \
289 \
290 switch ((_dst).bytes) { \
291 case 2: \
292 __asm__ __volatile__ ( \
293 _PRE_EFLAGS("0","4","2") \
294 _op"w %"_wx"3,%1; " \
295 _POST_EFLAGS("0","4","2") \
296 : "=m" (_eflags), "=m" ((_dst).val), \
297 "=&r" (_tmp) \
298 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
299 break; \
300 case 4: \
301 __asm__ __volatile__ ( \
302 _PRE_EFLAGS("0","4","2") \
303 _op"l %"_lx"3,%1; " \
304 _POST_EFLAGS("0","4","2") \
305 : "=m" (_eflags), "=m" ((_dst).val), \
306 "=&r" (_tmp) \
307 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
308 break; \
309 case 8: \
310 __emulate_2op_8byte(_op, _src, _dst, \
311 _eflags, _qx, _qy); \
312 break; \
313 } \
314 } while (0)
315
316#define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
317 do { \
318 unsigned long _tmp; \
319 switch ( (_dst).bytes ) \
320 { \
321 case 1: \
322 __asm__ __volatile__ ( \
323 _PRE_EFLAGS("0","4","2") \
324 _op"b %"_bx"3,%1; " \
325 _POST_EFLAGS("0","4","2") \
326 : "=m" (_eflags), "=m" ((_dst).val), \
327 "=&r" (_tmp) \
328 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
329 break; \
330 default: \
331 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
332 _wx, _wy, _lx, _ly, _qx, _qy); \
333 break; \
334 } \
335 } while (0)
336
337/* Source operand is byte-sized and may be restricted to just %cl. */
338#define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
339 __emulate_2op(_op, _src, _dst, _eflags, \
340 "b", "c", "b", "c", "b", "c", "b", "c")
341
342/* Source operand is byte, word, long or quad sized. */
343#define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
344 __emulate_2op(_op, _src, _dst, _eflags, \
345 "b", "q", "w", "r", _LO32, "r", "", "r")
346
347/* Source operand is word, long or quad sized. */
348#define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
349 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
350 "w", "r", _LO32, "r", "", "r")
351
352/* Instruction has only one explicit operand (no source operand). */
353#define emulate_1op(_op, _dst, _eflags) \
354 do { \
355 unsigned long _tmp; \
356 \
357 switch ( (_dst).bytes ) \
358 { \
359 case 1: \
360 __asm__ __volatile__ ( \
361 _PRE_EFLAGS("0","3","2") \
362 _op"b %1; " \
363 _POST_EFLAGS("0","3","2") \
364 : "=m" (_eflags), "=m" ((_dst).val), \
365 "=&r" (_tmp) \
366 : "i" (EFLAGS_MASK) ); \
367 break; \
368 case 2: \
369 __asm__ __volatile__ ( \
370 _PRE_EFLAGS("0","3","2") \
371 _op"w %1; " \
372 _POST_EFLAGS("0","3","2") \
373 : "=m" (_eflags), "=m" ((_dst).val), \
374 "=&r" (_tmp) \
375 : "i" (EFLAGS_MASK) ); \
376 break; \
377 case 4: \
378 __asm__ __volatile__ ( \
379 _PRE_EFLAGS("0","3","2") \
380 _op"l %1; " \
381 _POST_EFLAGS("0","3","2") \
382 : "=m" (_eflags), "=m" ((_dst).val), \
383 "=&r" (_tmp) \
384 : "i" (EFLAGS_MASK) ); \
385 break; \
386 case 8: \
387 __emulate_1op_8byte(_op, _dst, _eflags); \
388 break; \
389 } \
390 } while (0)
391
392/* Emulate an instruction with quadword operands (x86/64 only). */
05b3e0c2 393#if defined(CONFIG_X86_64)
6aa8b732
AK		 394#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
395 do { \
396 __asm__ __volatile__ ( \
397 _PRE_EFLAGS("0","4","2") \
398 _op"q %"_qx"3,%1; " \
399 _POST_EFLAGS("0","4","2") \
400 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
401 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
402 } while (0)
403
404#define __emulate_1op_8byte(_op, _dst, _eflags) \
405 do { \
406 __asm__ __volatile__ ( \
407 _PRE_EFLAGS("0","3","2") \
408 _op"q %1; " \
409 _POST_EFLAGS("0","3","2") \
410 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
411 : "i" (EFLAGS_MASK) ); \
412 } while (0)
413
414#elif defined(__i386__)
415#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
416#define __emulate_1op_8byte(_op, _dst, _eflags)
417#endif /* __i386__ */
418
419/* Fetch next part of the instruction being emulated. */
420#define insn_fetch(_type, _size, _eip) \
421({ unsigned long _x; \
422 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
423 (_size), ctxt); \
424 if ( rc != 0 ) \
425 goto done; \
426 (_eip) += (_size); \
427 (_type)_x; \
428})
429
430/* Access/update address held in a register, based on addressing mode. */
431#define register_address(base, reg) \
432 ((base) + ((ad_bytes == sizeof(unsigned long)) ? (reg) : \
433 ((reg) & ((1UL << (ad_bytes << 3)) - 1))))
434
435#define register_address_increment(reg, inc) \
436 do { \
437 /* signed type ensures sign extension to long */ \
438 int _inc = (inc); \
439 if ( ad_bytes == sizeof(unsigned long) ) \
440 (reg) += _inc; \
441 else \
442 (reg) = ((reg) & ~((1UL << (ad_bytes << 3)) - 1)) | \
443 (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
444 } while (0)
445
446void *decode_register(u8 modrm_reg, unsigned long *regs,
447 int highbyte_regs)
448{
449 void *p;
450
451 p = &regs[modrm_reg];
452 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
453 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
454 return p;
455}
456
457static int read_descriptor(struct x86_emulate_ctxt *ctxt,
458 struct x86_emulate_ops *ops,
459 void *ptr,
460 u16 *size, unsigned long *address, int op_bytes)
461{
462 int rc;
463
464 if (op_bytes == 2)
465 op_bytes = 3;
466 *address = 0;
467 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2, ctxt);
468 if (rc)
469 return rc;
470 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes, ctxt);
471 return rc;
472}
473
474int
475x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
476{
038e51de
AK		 477 unsigned d;
478 u8 b, sib, twobyte = 0, rex_prefix = 0;
6aa8b732
AK		 479 u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
480 unsigned long *override_base = NULL;
481 unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
482 int rc = 0;
483 struct operand src, dst;
484 unsigned long cr2 = ctxt->cr2;
485 int mode = ctxt->mode;
486 unsigned long modrm_ea;
487 int use_modrm_ea, index_reg = 0, base_reg = 0, scale, rip_relative = 0;
488
489 /* Shadow copy of register state. Committed on successful emulation. */
490 unsigned long _regs[NR_VCPU_REGS];
491 unsigned long _eip = ctxt->vcpu->rip, _eflags = ctxt->eflags;
492 unsigned long modrm_val = 0;
493
494 memcpy(_regs, ctxt->vcpu->regs, sizeof _regs);
495
496 switch (mode) {
497 case X86EMUL_MODE_REAL:
498 case X86EMUL_MODE_PROT16:
499 op_bytes = ad_bytes = 2;
500 break;
501 case X86EMUL_MODE_PROT32:
502 op_bytes = ad_bytes = 4;
503 break;
05b3e0c2 504#ifdef CONFIG_X86_64
6aa8b732
AK		 505 case X86EMUL_MODE_PROT64:
506 op_bytes = 4;
507 ad_bytes = 8;
508 break;
509#endif
510 default:
511 return -1;
512 }
513
514 /* Legacy prefixes. */
515 for (i = 0; i < 8; i++) {
516 switch (b = insn_fetch(u8, 1, _eip)) {
517 case 0x66: /* operand-size override */
518 op_bytes ^= 6; /* switch between 2/4 bytes */
519 break;
520 case 0x67: /* address-size override */
521 if (mode == X86EMUL_MODE_PROT64)
522 ad_bytes ^= 12; /* switch between 4/8 bytes */
523 else
524 ad_bytes ^= 6; /* switch between 2/4 bytes */
525 break;
526 case 0x2e: /* CS override */
527 override_base = &ctxt->cs_base;
528 break;
529 case 0x3e: /* DS override */
530 override_base = &ctxt->ds_base;
531 break;
532 case 0x26: /* ES override */
533 override_base = &ctxt->es_base;
534 break;
535 case 0x64: /* FS override */
536 override_base = &ctxt->fs_base;
537 break;
538 case 0x65: /* GS override */
539 override_base = &ctxt->gs_base;
540 break;
541 case 0x36: /* SS override */
542 override_base = &ctxt->ss_base;
543 break;
544 case 0xf0: /* LOCK */
545 lock_prefix = 1;
546 break;
547 case 0xf3: /* REP/REPE/REPZ */
548 rep_prefix = 1;
549 break;
550 case 0xf2: /* REPNE/REPNZ */
551 break;
552 default:
553 goto done_prefixes;
554 }
555 }
556
557done_prefixes:
558
559 /* REX prefix. */
560 if ((mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40)) {
561 rex_prefix = b;
562 if (b & 8)
563 op_bytes = 8; /* REX.W */
564 modrm_reg = (b & 4) << 1; /* REX.R */
565 index_reg = (b & 2) << 2; /* REX.X */
566 modrm_rm = base_reg = (b & 1) << 3; /* REG.B */
567 b = insn_fetch(u8, 1, _eip);
568 }
569
570 /* Opcode byte(s). */
571 d = opcode_table[b];
572 if (d == 0) {
573 /* Two-byte opcode? */
574 if (b == 0x0f) {
575 twobyte = 1;
576 b = insn_fetch(u8, 1, _eip);
577 d = twobyte_table[b];
578 }
579
580 /* Unrecognised? */
581 if (d == 0)
582 goto cannot_emulate;
583 }
584
585 /* ModRM and SIB bytes. */
586 if (d & ModRM) {
587 modrm = insn_fetch(u8, 1, _eip);
588 modrm_mod |= (modrm & 0xc0) >> 6;
589 modrm_reg |= (modrm & 0x38) >> 3;
590 modrm_rm |= (modrm & 0x07);
591 modrm_ea = 0;
592 use_modrm_ea = 1;
593
594 if (modrm_mod == 3) {
595 modrm_val = *(unsigned long *)
596 decode_register(modrm_rm, _regs, d & ByteOp);
597 goto modrm_done;
598 }
599
600 if (ad_bytes == 2) {
601 unsigned bx = _regs[VCPU_REGS_RBX];
602 unsigned bp = _regs[VCPU_REGS_RBP];
603 unsigned si = _regs[VCPU_REGS_RSI];
604 unsigned di = _regs[VCPU_REGS_RDI];
605
606 /* 16-bit ModR/M decode. */
607 switch (modrm_mod) {
608 case 0:
609 if (modrm_rm == 6)
610 modrm_ea += insn_fetch(u16, 2, _eip);
611 break;
612 case 1:
613 modrm_ea += insn_fetch(s8, 1, _eip);
614 break;
615 case 2:
616 modrm_ea += insn_fetch(u16, 2, _eip);
617 break;
618 }
619 switch (modrm_rm) {
620 case 0:
621 modrm_ea += bx + si;
622 break;
623 case 1:
624 modrm_ea += bx + di;
625 break;
626 case 2:
627 modrm_ea += bp + si;
628 break;
629 case 3:
630 modrm_ea += bp + di;
631 break;
632 case 4:
633 modrm_ea += si;
634 break;
635 case 5:
636 modrm_ea += di;
637 break;
638 case 6:
639 if (modrm_mod != 0)
640 modrm_ea += bp;
641 break;
642 case 7:
643 modrm_ea += bx;
644 break;
645 }
646 if (modrm_rm == 2 || modrm_rm == 3 ||
647 (modrm_rm == 6 && modrm_mod != 0))
648 if (!override_base)
649 override_base = &ctxt->ss_base;
650 modrm_ea = (u16)modrm_ea;
651 } else {
652 /* 32/64-bit ModR/M decode. */
653 switch (modrm_rm) {
654 case 4:
655 case 12:
656 sib = insn_fetch(u8, 1, _eip);
657 index_reg |= (sib >> 3) & 7;
658 base_reg |= sib & 7;
659 scale = sib >> 6;
660
661 switch (base_reg) {
662 case 5:
663 if (modrm_mod != 0)
664 modrm_ea += _regs[base_reg];
665 else
666 modrm_ea += insn_fetch(s32, 4, _eip);
667 break;
668 default:
669 modrm_ea += _regs[base_reg];
670 }
671 switch (index_reg) {
672 case 4:
673 break;
674 default:
675 modrm_ea += _regs[index_reg] << scale;
676
677 }
678 break;
679 case 5:
680 if (modrm_mod != 0)
681 modrm_ea += _regs[modrm_rm];
682 else if (mode == X86EMUL_MODE_PROT64)
683 rip_relative = 1;
684 break;
685 default:
686 modrm_ea += _regs[modrm_rm];
687 break;
688 }
689 switch (modrm_mod) {
690 case 0:
691 if (modrm_rm == 5)
692 modrm_ea += insn_fetch(s32, 4, _eip);
693 break;
694 case 1:
695 modrm_ea += insn_fetch(s8, 1, _eip);
696 break;
697 case 2:
698 modrm_ea += insn_fetch(s32, 4, _eip);
699 break;
700 }
701 }
702 if (!override_base)
703 override_base = &ctxt->ds_base;
704 if (mode == X86EMUL_MODE_PROT64 &&
705 override_base != &ctxt->fs_base &&
706 override_base != &ctxt->gs_base)
707 override_base = NULL;
708
709 if (override_base)
710 modrm_ea += *override_base;
711
712 if (rip_relative) {
713 modrm_ea += _eip;
714 switch (d & SrcMask) {
715 case SrcImmByte:
716 modrm_ea += 1;
717 break;
718 case SrcImm:
719 if (d & ByteOp)
720 modrm_ea += 1;
721 else
722 if (op_bytes == 8)
723 modrm_ea += 4;
724 else
725 modrm_ea += op_bytes;
726 }
727 }
728 if (ad_bytes != 8)
729 modrm_ea = (u32)modrm_ea;
730 cr2 = modrm_ea;
731 modrm_done:
732 ;
733 }
734
6aa8b732
AK		 735 /*
736 * Decode and fetch the source operand: register, memory
737 * or immediate.
738 */
739 switch (d & SrcMask) {
740 case SrcNone:
741 break;
742 case SrcReg:
743 src.type = OP_REG;
744 if (d & ByteOp) {
745 src.ptr = decode_register(modrm_reg, _regs,
746 (rex_prefix == 0));
747 src.val = src.orig_val = *(u8 *) src.ptr;
748 src.bytes = 1;
749 } else {
750 src.ptr = decode_register(modrm_reg, _regs, 0);
751 switch ((src.bytes = op_bytes)) {
752 case 2:
753 src.val = src.orig_val = *(u16 *) src.ptr;
754 break;
755 case 4:
756 src.val = src.orig_val = *(u32 *) src.ptr;
757 break;
758 case 8:
759 src.val = src.orig_val = *(u64 *) src.ptr;
760 break;
761 }
762 }
763 break;
764 case SrcMem16:
765 src.bytes = 2;
766 goto srcmem_common;
767 case SrcMem32:
768 src.bytes = 4;
769 goto srcmem_common;
770 case SrcMem:
771 src.bytes = (d & ByteOp) ? 1 : op_bytes;
772 srcmem_common:
773 src.type = OP_MEM;
774 src.ptr = (unsigned long *)cr2;
775 if ((rc = ops->read_emulated((unsigned long)src.ptr,
776 &src.val, src.bytes, ctxt)) != 0)
777 goto done;
778 src.orig_val = src.val;
779 break;
780 case SrcImm:
781 src.type = OP_IMM;
782 src.ptr = (unsigned long *)_eip;
783 src.bytes = (d & ByteOp) ? 1 : op_bytes;
784 if (src.bytes == 8)
785 src.bytes = 4;
786 /* NB. Immediates are sign-extended as necessary. */
787 switch (src.bytes) {
788 case 1:
789 src.val = insn_fetch(s8, 1, _eip);
790 break;
791 case 2:
792 src.val = insn_fetch(s16, 2, _eip);
793 break;
794 case 4:
795 src.val = insn_fetch(s32, 4, _eip);
796 break;
797 }
798 break;
799 case SrcImmByte:
800 src.type = OP_IMM;
801 src.ptr = (unsigned long *)_eip;
802 src.bytes = 1;
803 src.val = insn_fetch(s8, 1, _eip);
804 break;
805 }
806
038e51de
AK		 807 /* Decode and fetch the destination operand: register or memory. */
808 switch (d & DstMask) {
809 case ImplicitOps:
810 /* Special instructions do their own operand decoding. */
811 goto special_insn;
812 case DstReg:
813 dst.type = OP_REG;
814 if ((d & ByteOp)
815 && !(twobyte_table && (b == 0xb6 || b == 0xb7))) {
816 dst.ptr = decode_register(modrm_reg, _regs,
817 (rex_prefix == 0));
818 dst.val = *(u8 *) dst.ptr;
819 dst.bytes = 1;
820 } else {
821 dst.ptr = decode_register(modrm_reg, _regs, 0);
822 switch ((dst.bytes = op_bytes)) {
823 case 2:
824 dst.val = *(u16 *)dst.ptr;
825 break;
826 case 4:
827 dst.val = *(u32 *)dst.ptr;
828 break;
829 case 8:
830 dst.val = *(u64 *)dst.ptr;
831 break;
832 }
833 }
834 break;
835 case DstMem:
836 dst.type = OP_MEM;
837 dst.ptr = (unsigned long *)cr2;
838 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
839 if (d & BitOp) {
df513e2c
AK		 840 unsigned long mask = ~(dst.bytes * 8 - 1);
841
842 dst.ptr = (void *)dst.ptr + (src.val & mask) / 8;
038e51de
AK		 843 }
844 if (!(d & Mov) && /* optimisation - avoid slow emulated read */
845 ((rc = ops->read_emulated((unsigned long)dst.ptr,
846 &dst.val, dst.bytes, ctxt)) != 0))
847 goto done;
848 break;
849 }
850 dst.orig_val = dst.val;
851
6aa8b732
AK		 852 if (twobyte)
853 goto twobyte_insn;
854
855 switch (b) {
856 case 0x00 ... 0x05:
857 add: /* add */
858 emulate_2op_SrcV("add", src, dst, _eflags);
859 break;
860 case 0x08 ... 0x0d:
861 or: /* or */
862 emulate_2op_SrcV("or", src, dst, _eflags);
863 break;
864 case 0x10 ... 0x15:
865 adc: /* adc */
866 emulate_2op_SrcV("adc", src, dst, _eflags);
867 break;
868 case 0x18 ... 0x1d:
869 sbb: /* sbb */
870 emulate_2op_SrcV("sbb", src, dst, _eflags);
871 break;
872 case 0x20 ... 0x25:
873 and: /* and */
874 emulate_2op_SrcV("and", src, dst, _eflags);
875 break;
876 case 0x28 ... 0x2d:
877 sub: /* sub */
878 emulate_2op_SrcV("sub", src, dst, _eflags);
879 break;
880 case 0x30 ... 0x35:
881 xor: /* xor */
882 emulate_2op_SrcV("xor", src, dst, _eflags);
883 break;
884 case 0x38 ... 0x3d:
885 cmp: /* cmp */
886 emulate_2op_SrcV("cmp", src, dst, _eflags);
887 break;
888 case 0x63: /* movsxd */
889 if (mode != X86EMUL_MODE_PROT64)
890 goto cannot_emulate;
891 dst.val = (s32) src.val;
892 break;
893 case 0x80 ... 0x83: /* Grp1 */
894 switch (modrm_reg) {
895 case 0:
896 goto add;
897 case 1:
898 goto or;
899 case 2:
900 goto adc;
901 case 3:
902 goto sbb;
903 case 4:
904 goto and;
905 case 5:
906 goto sub;
907 case 6:
908 goto xor;
909 case 7:
910 goto cmp;
911 }
912 break;
913 case 0x84 ... 0x85:
914 test: /* test */
915 emulate_2op_SrcV("test", src, dst, _eflags);
916 break;
917 case 0x86 ... 0x87: /* xchg */
918 /* Write back the register source. */
919 switch (dst.bytes) {
920 case 1:
921 *(u8 *) src.ptr = (u8) dst.val;
922 break;
923 case 2:
924 *(u16 *) src.ptr = (u16) dst.val;
925 break;
926 case 4:
927 *src.ptr = (u32) dst.val;
928 break; /* 64b reg: zero-extend */
929 case 8:
930 *src.ptr = dst.val;
931 break;
932 }
933 /*
934 * Write back the memory destination with implicit LOCK
935 * prefix.
936 */
937 dst.val = src.val;
938 lock_prefix = 1;
939 break;
940 case 0xa0 ... 0xa1: /* mov */
941 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
942 dst.val = src.val;
943 _eip += ad_bytes; /* skip src displacement */
944 break;
945 case 0xa2 ... 0xa3: /* mov */
946 dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
947 _eip += ad_bytes; /* skip dst displacement */
948 break;
949 case 0x88 ... 0x8b: /* mov */
950 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
951 dst.val = src.val;
952 break;
953 case 0x8f: /* pop (sole member of Grp1a) */
954 /* 64-bit mode: POP always pops a 64-bit operand. */
955 if (mode == X86EMUL_MODE_PROT64)
956 dst.bytes = 8;
957 if ((rc = ops->read_std(register_address(ctxt->ss_base,
958 _regs[VCPU_REGS_RSP]),
959 &dst.val, dst.bytes, ctxt)) != 0)
960 goto done;
961 register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
962 break;
963 case 0xc0 ... 0xc1:
964 grp2: /* Grp2 */
965 switch (modrm_reg) {
966 case 0: /* rol */
967 emulate_2op_SrcB("rol", src, dst, _eflags);
968 break;
969 case 1: /* ror */
970 emulate_2op_SrcB("ror", src, dst, _eflags);
971 break;
972 case 2: /* rcl */
973 emulate_2op_SrcB("rcl", src, dst, _eflags);
974 break;
975 case 3: /* rcr */
976 emulate_2op_SrcB("rcr", src, dst, _eflags);
977 break;
978 case 4: /* sal/shl */
979 case 6: /* sal/shl */
980 emulate_2op_SrcB("sal", src, dst, _eflags);
981 break;
982 case 5: /* shr */
983 emulate_2op_SrcB("shr", src, dst, _eflags);
984 break;
985 case 7: /* sar */
986 emulate_2op_SrcB("sar", src, dst, _eflags);
987 break;
988 }
989 break;
990 case 0xd0 ... 0xd1: /* Grp2 */
991 src.val = 1;
992 goto grp2;
993 case 0xd2 ... 0xd3: /* Grp2 */
994 src.val = _regs[VCPU_REGS_RCX];
995 goto grp2;
996 case 0xf6 ... 0xf7: /* Grp3 */
997 switch (modrm_reg) {
998 case 0 ... 1: /* test */
999 /*
1000 * Special case in Grp3: test has an immediate
1001 * source operand.
1002 */
1003 src.type = OP_IMM;
1004 src.ptr = (unsigned long *)_eip;
1005 src.bytes = (d & ByteOp) ? 1 : op_bytes;
1006 if (src.bytes == 8)
1007 src.bytes = 4;
1008 switch (src.bytes) {
1009 case 1:
1010 src.val = insn_fetch(s8, 1, _eip);
1011 break;
1012 case 2:
1013 src.val = insn_fetch(s16, 2, _eip);
1014 break;
1015 case 4:
1016 src.val = insn_fetch(s32, 4, _eip);
1017 break;
1018 }
1019 goto test;
1020 case 2: /* not */
1021 dst.val = ~dst.val;
1022 break;
1023 case 3: /* neg */
1024 emulate_1op("neg", dst, _eflags);
1025 break;
1026 default:
1027 goto cannot_emulate;
1028 }
1029 break;
1030 case 0xfe ... 0xff: /* Grp4/Grp5 */
1031 switch (modrm_reg) {
1032 case 0: /* inc */
1033 emulate_1op("inc", dst, _eflags);
1034 break;
1035 case 1: /* dec */
1036 emulate_1op("dec", dst, _eflags);
1037 break;
1038 case 6: /* push */
1039 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1040 if (mode == X86EMUL_MODE_PROT64) {
1041 dst.bytes = 8;
1042 if ((rc = ops->read_std((unsigned long)dst.ptr,
1043 &dst.val, 8,
1044 ctxt)) != 0)
1045 goto done;
1046 }
1047 register_address_increment(_regs[VCPU_REGS_RSP],
1048 -dst.bytes);
1049 if ((rc = ops->write_std(
1050 register_address(ctxt->ss_base,
1051 _regs[VCPU_REGS_RSP]),
4c690a1e 1052 &dst.val, dst.bytes, ctxt)) != 0)
6aa8b732
AK		 1053 goto done;
1054 dst.val = dst.orig_val; /* skanky: disable writeback */
1055 break;
1056 default:
1057 goto cannot_emulate;
1058 }
1059 break;
1060 }
1061
1062writeback:
1063 if ((d & Mov) || (dst.orig_val != dst.val)) {
1064 switch (dst.type) {
1065 case OP_REG:
1066 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1067 switch (dst.bytes) {
1068 case 1:
1069 *(u8 *)dst.ptr = (u8)dst.val;
1070 break;
1071 case 2:
1072 *(u16 *)dst.ptr = (u16)dst.val;
1073 break;
1074 case 4:
1075 *dst.ptr = (u32)dst.val;
1076 break; /* 64b: zero-ext */
1077 case 8:
1078 *dst.ptr = dst.val;
1079 break;
1080 }
1081 break;
1082 case OP_MEM:
1083 if (lock_prefix)
1084 rc = ops->cmpxchg_emulated((unsigned long)dst.
4c690a1e
AK		 1085 ptr, &dst.orig_val,
1086 &dst.val, dst.bytes,
6aa8b732
AK		 1087 ctxt);
1088 else
1089 rc = ops->write_emulated((unsigned long)dst.ptr,
4c690a1e 1090 &dst.val, dst.bytes,
6aa8b732
AK		 1091 ctxt);
1092 if (rc != 0)
1093 goto done;
1094 default:
1095 break;
1096 }
1097 }
1098
1099 /* Commit shadow register state. */
1100 memcpy(ctxt->vcpu->regs, _regs, sizeof _regs);
1101 ctxt->eflags = _eflags;
1102 ctxt->vcpu->rip = _eip;
1103
1104done:
1105 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1106
1107special_insn:
1108 if (twobyte)
1109 goto twobyte_special_insn;
1110 if (rep_prefix) {
1111 if (_regs[VCPU_REGS_RCX] == 0) {
1112 ctxt->vcpu->rip = _eip;
1113 goto done;
1114 }
1115 _regs[VCPU_REGS_RCX]--;
1116 _eip = ctxt->vcpu->rip;
1117 }
1118 switch (b) {
1119 case 0xa4 ... 0xa5: /* movs */
1120 dst.type = OP_MEM;
1121 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1122 dst.ptr = (unsigned long *)register_address(ctxt->es_base,
1123 _regs[VCPU_REGS_RDI]);
1124 if ((rc = ops->read_emulated(register_address(
1125 override_base ? *override_base : ctxt->ds_base,
1126 _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt)) != 0)
1127 goto done;
1128 register_address_increment(_regs[VCPU_REGS_RSI],
1129 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1130 register_address_increment(_regs[VCPU_REGS_RDI],
1131 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1132 break;
1133 case 0xa6 ... 0xa7: /* cmps */
1134 DPRINTF("Urk! I don't handle CMPS.\n");
1135 goto cannot_emulate;
1136 case 0xaa ... 0xab: /* stos */
1137 dst.type = OP_MEM;
1138 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1139 dst.ptr = (unsigned long *)cr2;
1140 dst.val = _regs[VCPU_REGS_RAX];
1141 register_address_increment(_regs[VCPU_REGS_RDI],
1142 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1143 break;
1144 case 0xac ... 0xad: /* lods */
1145 dst.type = OP_REG;
1146 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1147 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1148 if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes, ctxt)) != 0)
1149 goto done;
1150 register_address_increment(_regs[VCPU_REGS_RSI],
1151 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1152 break;
1153 case 0xae ... 0xaf: /* scas */
1154 DPRINTF("Urk! I don't handle SCAS.\n");
1155 goto cannot_emulate;
72d6e5a0
AK		 1156 case 0xf4: /* hlt */
1157 ctxt->vcpu->halt_request = 1;
1158 goto done;
d9413cd7
NK		 1159 case 0xc3: /* ret */
1160 dst.ptr = &_eip;
1161 goto pop_instruction;
7f0aaee0
NK		 1162 case 0x58 ... 0x5f: /* pop reg */
1163 dst.ptr = (unsigned long *)&_regs[b & 0x7];
1164
d9413cd7 1165pop_instruction:
7f0aaee0
NK		 1166 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1167 _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt)) != 0)
1168 goto done;
1169
d9413cd7 1170 register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
7f0aaee0
NK		 1171 dst.orig_val = dst.val; /* Disable writeback. */
1172 break;
6aa8b732
AK		 1173 }
1174 goto writeback;
1175
1176twobyte_insn:
1177 switch (b) {
1178 case 0x01: /* lgdt, lidt, lmsw */
1179 switch (modrm_reg) {
1180 u16 size;
1181 unsigned long address;
1182
1183 case 2: /* lgdt */
1184 rc = read_descriptor(ctxt, ops, src.ptr,
1185 &size, &address, op_bytes);
1186 if (rc)
1187 goto done;
1188 realmode_lgdt(ctxt->vcpu, size, address);
1189 break;
1190 case 3: /* lidt */
1191 rc = read_descriptor(ctxt, ops, src.ptr,
1192 &size, &address, op_bytes);
1193 if (rc)
1194 goto done;
1195 realmode_lidt(ctxt->vcpu, size, address);
1196 break;
1197 case 4: /* smsw */
1198 if (modrm_mod != 3)
1199 goto cannot_emulate;
1200 *(u16 *)&_regs[modrm_rm]
1201 = realmode_get_cr(ctxt->vcpu, 0);
1202 break;
1203 case 6: /* lmsw */
1204 if (modrm_mod != 3)
1205 goto cannot_emulate;
1206 realmode_lmsw(ctxt->vcpu, (u16)modrm_val, &_eflags);
1207 break;
1208 case 7: /* invlpg*/
1209 emulate_invlpg(ctxt->vcpu, cr2);
1210 break;
1211 default:
1212 goto cannot_emulate;
1213 }
1214 break;
1215 case 0x21: /* mov from dr to reg */
1216 if (modrm_mod != 3)
1217 goto cannot_emulate;
1218 rc = emulator_get_dr(ctxt, modrm_reg, &_regs[modrm_rm]);
1219 break;
1220 case 0x23: /* mov from reg to dr */
1221 if (modrm_mod != 3)
1222 goto cannot_emulate;
1223 rc = emulator_set_dr(ctxt, modrm_reg, _regs[modrm_rm]);
1224 break;
1225 case 0x40 ... 0x4f: /* cmov */
1226 dst.val = dst.orig_val = src.val;
1227 d &= ~Mov; /* default to no move */
1228 /*
1229 * First, assume we're decoding an even cmov opcode
1230 * (lsb == 0).
1231 */
1232 switch ((b & 15) >> 1) {
1233 case 0: /* cmovo */
1234 d |= (_eflags & EFLG_OF) ? Mov : 0;
1235 break;
1236 case 1: /* cmovb/cmovc/cmovnae */
1237 d |= (_eflags & EFLG_CF) ? Mov : 0;
1238 break;
1239 case 2: /* cmovz/cmove */
1240 d |= (_eflags & EFLG_ZF) ? Mov : 0;
1241 break;
1242 case 3: /* cmovbe/cmovna */
1243 d |= (_eflags & (EFLG_CF | EFLG_ZF)) ? Mov : 0;
1244 break;
1245 case 4: /* cmovs */
1246 d |= (_eflags & EFLG_SF) ? Mov : 0;
1247 break;
1248 case 5: /* cmovp/cmovpe */
1249 d |= (_eflags & EFLG_PF) ? Mov : 0;
1250 break;
1251 case 7: /* cmovle/cmovng */
1252 d |= (_eflags & EFLG_ZF) ? Mov : 0;
1253 /* fall through */
1254 case 6: /* cmovl/cmovnge */
1255 d |= (!(_eflags & EFLG_SF) !=
1256 !(_eflags & EFLG_OF)) ? Mov : 0;
1257 break;
1258 }
1259 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
1260 d ^= (b & 1) ? Mov : 0;
1261 break;
1262 case 0xb0 ... 0xb1: /* cmpxchg */
1263 /*
1264 * Save real source value, then compare EAX against
1265 * destination.
1266 */
1267 src.orig_val = src.val;
1268 src.val = _regs[VCPU_REGS_RAX];
1269 emulate_2op_SrcV("cmp", src, dst, _eflags);
1270 /* Always write back. The question is: where to? */
1271 d |= Mov;
1272 if (_eflags & EFLG_ZF) {
1273 /* Success: write back to memory. */
1274 dst.val = src.orig_val;
1275 } else {
1276 /* Failure: write the value we saw to EAX. */
1277 dst.type = OP_REG;
1278 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1279 }
1280 break;
1281 case 0xa3:
1282 bt: /* bt */
1283 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1284 emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
1285 break;
1286 case 0xb3:
1287 btr: /* btr */
1288 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1289 emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
1290 break;
1291 case 0xab:
1292 bts: /* bts */
1293 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1294 emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
1295 break;
1296 case 0xb6 ... 0xb7: /* movzx */
1297 dst.bytes = op_bytes;
1298 dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
1299 break;
1300 case 0xbb:
1301 btc: /* btc */
1302 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1303 emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
1304 break;
1305 case 0xba: /* Grp8 */
1306 switch (modrm_reg & 3) {
1307 case 0:
1308 goto bt;
1309 case 1:
1310 goto bts;
1311 case 2:
1312 goto btr;
1313 case 3:
1314 goto btc;
1315 }
1316 break;
1317 case 0xbe ... 0xbf: /* movsx */
1318 dst.bytes = op_bytes;
1319 dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
1320 break;
1321 }
1322 goto writeback;
1323
1324twobyte_special_insn:
1325 /* Disable writeback. */
1326 dst.orig_val = dst.val;
1327 switch (b) {
687fdbfe
AK		 1328 case 0x09: /* wbinvd */
1329 break;
6aa8b732
AK		 1330 case 0x0d: /* GrpP (prefetch) */
1331 case 0x18: /* Grp16 (prefetch/nop) */
1332 break;
1333 case 0x06:
1334 emulate_clts(ctxt->vcpu);
1335 break;
1336 case 0x20: /* mov cr, reg */
1337 if (modrm_mod != 3)
1338 goto cannot_emulate;
1339 _regs[modrm_rm] = realmode_get_cr(ctxt->vcpu, modrm_reg);
1340 break;
1341 case 0x22: /* mov reg, cr */
1342 if (modrm_mod != 3)
1343 goto cannot_emulate;
1344 realmode_set_cr(ctxt->vcpu, modrm_reg, modrm_val, &_eflags);
1345 break;
1346 case 0xc7: /* Grp9 (cmpxchg8b) */
6aa8b732 1347 {
4c690a1e 1348 u64 old, new;
6aa8b732
AK		 1349 if ((rc = ops->read_emulated(cr2, &old, 8, ctxt)) != 0)
1350 goto done;
1351 if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
1352 ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
1353 _regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1354 _regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1355 _eflags &= ~EFLG_ZF;
1356 } else {
4c690a1e
AK		 1357 new = ((u64)_regs[VCPU_REGS_RCX] << 32)
1358 | (u32) _regs[VCPU_REGS_RBX];
1359 if ((rc = ops->cmpxchg_emulated(cr2, &old,
1360 &new, 8, ctxt)) != 0)
6aa8b732
AK		 1361 goto done;
1362 _eflags |= EFLG_ZF;
1363 }
1364 break;
1365 }
6aa8b732
AK		 1366 }
1367 goto writeback;
1368
1369cannot_emulate:
1370 DPRINTF("Cannot emulate %02x\n", b);
1371 return -1;
1372}
1373
1374#ifdef __XEN__
1375
1376#include <asm/mm.h>
1377#include <asm/uaccess.h>
1378
1379int
1380x86_emulate_read_std(unsigned long addr,
1381 unsigned long *val,
1382 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1383{
1384 unsigned int rc;
1385
1386 *val = 0;
1387
1388 if ((rc = copy_from_user((void *)val, (void *)addr, bytes)) != 0) {
1389 propagate_page_fault(addr + bytes - rc, 0); /* read fault */
1390 return X86EMUL_PROPAGATE_FAULT;
1391 }
1392
1393 return X86EMUL_CONTINUE;
1394}
1395
1396int
1397x86_emulate_write_std(unsigned long addr,
1398 unsigned long val,
1399 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1400{
1401 unsigned int rc;
1402
1403 if ((rc = copy_to_user((void *)addr, (void *)&val, bytes)) != 0) {
1404 propagate_page_fault(addr + bytes - rc, PGERR_write_access);
1405 return X86EMUL_PROPAGATE_FAULT;
1406 }
1407
1408 return X86EMUL_CONTINUE;
1409}
1410
1411#endif
ubuntu-zesty-kernel mirror