]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - drivers/kvm/x86_emulate.c
projects / mirror_ubuntu-bionic-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
KVM: Remove useless assignment
[mirror_ubuntu-bionic-kernel.git] / drivers / kvm / x86_emulate.c
CommitLineData
6aa8b732
AK		 1/******************************************************************************
2 * x86_emulate.c
3 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
dcc0766b 9 * privileged instructions:
6aa8b732
AK		 10 *
11 * Copyright (C) 2006 Qumranet
12 *
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
15 *
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
18 *
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
20 */
21
22#ifndef __KERNEL__
23#include <stdio.h>
24#include <stdint.h>
25#include <public/xen.h>
26#define DPRINTF(_f, _a ...) printf( _f , ## _a )
27#else
28#include "kvm.h"
29#define DPRINTF(x...) do {} while (0)
30#endif
31#include "x86_emulate.h"
32#include <linux/module.h>
33
34/*
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
40 * not be handled.
41 */
42
43/* Operand sizes: 8-bit operands or specified/overridden size. */
44#define ByteOp (1<<0) /* 8-bit operands. */
45/* Destination operand type. */
46#define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47#define DstReg (2<<1) /* Register operand. */
48#define DstMem (3<<1) /* Memory operand. */
49#define DstMask (3<<1)
50/* Source operand type. */
51#define SrcNone (0<<3) /* No source operand. */
52#define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53#define SrcReg (1<<3) /* Register operand. */
54#define SrcMem (2<<3) /* Memory operand. */
55#define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56#define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57#define SrcImm (5<<3) /* Immediate operand. */
58#define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59#define SrcMask (7<<3)
60/* Generic ModRM decode. */
61#define ModRM (1<<6)
62/* Destination is only written; never read. */
63#define Mov (1<<7)
038e51de 64#define BitOp (1<<8)
6aa8b732
AK		 65
66static u8 opcode_table[256] = {
67 /* 0x00 - 0x07 */
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
70 0, 0, 0, 0,
71 /* 0x08 - 0x0F */
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
74 0, 0, 0, 0,
75 /* 0x10 - 0x17 */
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
78 0, 0, 0, 0,
79 /* 0x18 - 0x1F */
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
82 0, 0, 0, 0,
83 /* 0x20 - 0x27 */
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 0, 0, 0, 0,
87 /* 0x28 - 0x2F */
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
90 0, 0, 0, 0,
91 /* 0x30 - 0x37 */
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
94 0, 0, 0, 0,
95 /* 0x38 - 0x3F */
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
98 0, 0, 0, 0,
99 /* 0x40 - 0x4F */
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
7f0aaee0
NK		 101 /* 0x50 - 0x57 */
102 0, 0, 0, 0, 0, 0, 0, 0,
103 /* 0x58 - 0x5F */
104 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
6aa8b732
AK		 106 /* 0x60 - 0x6F */
107 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
108 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
109 /* 0x70 - 0x7F */
110 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
111 /* 0x80 - 0x87 */
112 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
113 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
114 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
115 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
116 /* 0x88 - 0x8F */
117 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
118 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
119 0, 0, 0, DstMem | SrcNone | ModRM | Mov,
120 /* 0x90 - 0x9F */
121 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
122 /* 0xA0 - 0xA7 */
123 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
124 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
125 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
126 ByteOp | ImplicitOps, ImplicitOps,
127 /* 0xA8 - 0xAF */
128 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
129 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
130 ByteOp | ImplicitOps, ImplicitOps,
131 /* 0xB0 - 0xBF */
132 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
133 /* 0xC0 - 0xC7 */
d9413cd7
NK		 134 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
135 0, ImplicitOps, 0, 0,
136 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
6aa8b732
AK		 137 /* 0xC8 - 0xCF */
138 0, 0, 0, 0, 0, 0, 0, 0,
139 /* 0xD0 - 0xD7 */
140 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
141 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
142 0, 0, 0, 0,
143 /* 0xD8 - 0xDF */
144 0, 0, 0, 0, 0, 0, 0, 0,
145 /* 0xE0 - 0xEF */
146 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
147 /* 0xF0 - 0xF7 */
148 0, 0, 0, 0,
72d6e5a0
AK		 149 ImplicitOps, 0,
150 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
6aa8b732
AK		 151 /* 0xF8 - 0xFF */
152 0, 0, 0, 0,
153 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
154};
155
038e51de 156static u16 twobyte_table[256] = {
6aa8b732
AK		 157 /* 0x00 - 0x0F */
158 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
687fdbfe 159 0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
6aa8b732
AK		 160 /* 0x10 - 0x1F */
161 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
162 /* 0x20 - 0x2F */
163 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
164 0, 0, 0, 0, 0, 0, 0, 0,
165 /* 0x30 - 0x3F */
35f3f286 166 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
6aa8b732
AK		 167 /* 0x40 - 0x47 */
168 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
169 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
170 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
171 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
172 /* 0x48 - 0x4F */
173 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
174 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
175 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
176 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
177 /* 0x50 - 0x5F */
178 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
179 /* 0x60 - 0x6F */
180 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
181 /* 0x70 - 0x7F */
182 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
183 /* 0x80 - 0x8F */
184 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
185 /* 0x90 - 0x9F */
186 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
187 /* 0xA0 - 0xA7 */
038e51de 188 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732 189 /* 0xA8 - 0xAF */
038e51de 190 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732
AK		 191 /* 0xB0 - 0xB7 */
192 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
038e51de 193 DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 194 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
195 DstReg | SrcMem16 | ModRM | Mov,
196 /* 0xB8 - 0xBF */
038e51de 197 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 198 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
199 DstReg | SrcMem16 | ModRM | Mov,
200 /* 0xC0 - 0xCF */
201 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
202 /* 0xD0 - 0xDF */
203 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
204 /* 0xE0 - 0xEF */
205 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
206 /* 0xF0 - 0xFF */
207 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
208};
209
210/*
211 * Tell the emulator that of the Group 7 instructions (sgdt, lidt, etc.) we
212 * are interested only in invlpg and not in any of the rest.
213 *
214 * invlpg is a special instruction in that the data it references may not
215 * be mapped.
216 */
217void kvm_emulator_want_group7_invlpg(void)
218{
219 twobyte_table[1] &= ~SrcMem;
220}
221EXPORT_SYMBOL_GPL(kvm_emulator_want_group7_invlpg);
222
223/* Type, address-of, and value of an instruction's operand. */
224struct operand {
225 enum { OP_REG, OP_MEM, OP_IMM } type;
226 unsigned int bytes;
227 unsigned long val, orig_val, *ptr;
228};
229
230/* EFLAGS bit definitions. */
231#define EFLG_OF (1<<11)
232#define EFLG_DF (1<<10)
233#define EFLG_SF (1<<7)
234#define EFLG_ZF (1<<6)
235#define EFLG_AF (1<<4)
236#define EFLG_PF (1<<2)
237#define EFLG_CF (1<<0)
238
239/*
240 * Instruction emulation:
241 * Most instructions are emulated directly via a fragment of inline assembly
242 * code. This allows us to save/restore EFLAGS and thus very easily pick up
243 * any modified flags.
244 */
245
05b3e0c2 246#if defined(CONFIG_X86_64)
6aa8b732
AK		 247#define _LO32 "k" /* force 32-bit operand */
248#define _STK "%%rsp" /* stack pointer */
249#elif defined(__i386__)
250#define _LO32 "" /* force 32-bit operand */
251#define _STK "%%esp" /* stack pointer */
252#endif
253
254/*
255 * These EFLAGS bits are restored from saved value during emulation, and
256 * any changes are written back to the saved value after emulation.
257 */
258#define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
259
260/* Before executing instruction: restore necessary bits in EFLAGS. */
261#define _PRE_EFLAGS(_sav, _msk, _tmp) \
262 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
263 "push %"_sav"; " \
264 "movl %"_msk",%"_LO32 _tmp"; " \
265 "andl %"_LO32 _tmp",("_STK"); " \
266 "pushf; " \
267 "notl %"_LO32 _tmp"; " \
268 "andl %"_LO32 _tmp",("_STK"); " \
269 "pop %"_tmp"; " \
270 "orl %"_LO32 _tmp",("_STK"); " \
271 "popf; " \
272 /* _sav &= ~msk; */ \
273 "movl %"_msk",%"_LO32 _tmp"; " \
274 "notl %"_LO32 _tmp"; " \
275 "andl %"_LO32 _tmp",%"_sav"; "
276
277/* After executing instruction: write-back necessary bits in EFLAGS. */
278#define _POST_EFLAGS(_sav, _msk, _tmp) \
279 /* _sav |= EFLAGS & _msk; */ \
280 "pushf; " \
281 "pop %"_tmp"; " \
282 "andl %"_msk",%"_LO32 _tmp"; " \
283 "orl %"_LO32 _tmp",%"_sav"; "
284
285/* Raw emulation: instruction has two explicit operands. */
286#define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
287 do { \
288 unsigned long _tmp; \
289 \
290 switch ((_dst).bytes) { \
291 case 2: \
292 __asm__ __volatile__ ( \
293 _PRE_EFLAGS("0","4","2") \
294 _op"w %"_wx"3,%1; " \
295 _POST_EFLAGS("0","4","2") \
296 : "=m" (_eflags), "=m" ((_dst).val), \
297 "=&r" (_tmp) \
298 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
299 break; \
300 case 4: \
301 __asm__ __volatile__ ( \
302 _PRE_EFLAGS("0","4","2") \
303 _op"l %"_lx"3,%1; " \
304 _POST_EFLAGS("0","4","2") \
305 : "=m" (_eflags), "=m" ((_dst).val), \
306 "=&r" (_tmp) \
307 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
308 break; \
309 case 8: \
310 __emulate_2op_8byte(_op, _src, _dst, \
311 _eflags, _qx, _qy); \
312 break; \
313 } \
314 } while (0)
315
316#define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
317 do { \
318 unsigned long _tmp; \
319 switch ( (_dst).bytes ) \
320 { \
321 case 1: \
322 __asm__ __volatile__ ( \
323 _PRE_EFLAGS("0","4","2") \
324 _op"b %"_bx"3,%1; " \
325 _POST_EFLAGS("0","4","2") \
326 : "=m" (_eflags), "=m" ((_dst).val), \
327 "=&r" (_tmp) \
328 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
329 break; \
330 default: \
331 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
332 _wx, _wy, _lx, _ly, _qx, _qy); \
333 break; \
334 } \
335 } while (0)
336
337/* Source operand is byte-sized and may be restricted to just %cl. */
338#define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
339 __emulate_2op(_op, _src, _dst, _eflags, \
340 "b", "c", "b", "c", "b", "c", "b", "c")
341
342/* Source operand is byte, word, long or quad sized. */
343#define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
344 __emulate_2op(_op, _src, _dst, _eflags, \
345 "b", "q", "w", "r", _LO32, "r", "", "r")
346
347/* Source operand is word, long or quad sized. */
348#define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
349 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
350 "w", "r", _LO32, "r", "", "r")
351
352/* Instruction has only one explicit operand (no source operand). */
353#define emulate_1op(_op, _dst, _eflags) \
354 do { \
355 unsigned long _tmp; \
356 \
357 switch ( (_dst).bytes ) \
358 { \
359 case 1: \
360 __asm__ __volatile__ ( \
361 _PRE_EFLAGS("0","3","2") \
362 _op"b %1; " \
363 _POST_EFLAGS("0","3","2") \
364 : "=m" (_eflags), "=m" ((_dst).val), \
365 "=&r" (_tmp) \
366 : "i" (EFLAGS_MASK) ); \
367 break; \
368 case 2: \
369 __asm__ __volatile__ ( \
370 _PRE_EFLAGS("0","3","2") \
371 _op"w %1; " \
372 _POST_EFLAGS("0","3","2") \
373 : "=m" (_eflags), "=m" ((_dst).val), \
374 "=&r" (_tmp) \
375 : "i" (EFLAGS_MASK) ); \
376 break; \
377 case 4: \
378 __asm__ __volatile__ ( \
379 _PRE_EFLAGS("0","3","2") \
380 _op"l %1; " \
381 _POST_EFLAGS("0","3","2") \
382 : "=m" (_eflags), "=m" ((_dst).val), \
383 "=&r" (_tmp) \
384 : "i" (EFLAGS_MASK) ); \
385 break; \
386 case 8: \
387 __emulate_1op_8byte(_op, _dst, _eflags); \
388 break; \
389 } \
390 } while (0)
391
392/* Emulate an instruction with quadword operands (x86/64 only). */
05b3e0c2 393#if defined(CONFIG_X86_64)
6aa8b732
AK		 394#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
395 do { \
396 __asm__ __volatile__ ( \
397 _PRE_EFLAGS("0","4","2") \
398 _op"q %"_qx"3,%1; " \
399 _POST_EFLAGS("0","4","2") \
400 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
401 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
402 } while (0)
403
404#define __emulate_1op_8byte(_op, _dst, _eflags) \
405 do { \
406 __asm__ __volatile__ ( \
407 _PRE_EFLAGS("0","3","2") \
408 _op"q %1; " \
409 _POST_EFLAGS("0","3","2") \
410 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
411 : "i" (EFLAGS_MASK) ); \
412 } while (0)
413
414#elif defined(__i386__)
415#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
416#define __emulate_1op_8byte(_op, _dst, _eflags)
417#endif /* __i386__ */
418
419/* Fetch next part of the instruction being emulated. */
420#define insn_fetch(_type, _size, _eip) \
421({ unsigned long _x; \
422 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
cebff02b 423 (_size), ctxt->vcpu); \
6aa8b732
AK		 424 if ( rc != 0 ) \
425 goto done; \
426 (_eip) += (_size); \
427 (_type)_x; \
428})
429
430/* Access/update address held in a register, based on addressing mode. */
431#define register_address(base, reg) \
432 ((base) + ((ad_bytes == sizeof(unsigned long)) ? (reg) : \
433 ((reg) & ((1UL << (ad_bytes << 3)) - 1))))
434
435#define register_address_increment(reg, inc) \
436 do { \
437 /* signed type ensures sign extension to long */ \
438 int _inc = (inc); \
439 if ( ad_bytes == sizeof(unsigned long) ) \
440 (reg) += _inc; \
441 else \
442 (reg) = ((reg) & ~((1UL << (ad_bytes << 3)) - 1)) | \
443 (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
444 } while (0)
445
1e3c5cb0
RR		 446/*
447 * Given the 'reg' portion of a ModRM byte, and a register block, return a
448 * pointer into the block that addresses the relevant register.
449 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
450 */
451static void *decode_register(u8 modrm_reg, unsigned long *regs,
452 int highbyte_regs)
6aa8b732
AK		 453{
454 void *p;
455
456 p = &regs[modrm_reg];
457 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
458 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
459 return p;
460}
461
462static int read_descriptor(struct x86_emulate_ctxt *ctxt,
463 struct x86_emulate_ops *ops,
464 void *ptr,
465 u16 *size, unsigned long *address, int op_bytes)
466{
467 int rc;
468
469 if (op_bytes == 2)
470 op_bytes = 3;
471 *address = 0;
cebff02b
LV		 472 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
473 ctxt->vcpu);
6aa8b732
AK		 474 if (rc)
475 return rc;
cebff02b
LV		 476 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
477 ctxt->vcpu);
6aa8b732
AK		 478 return rc;
479}
480
481int
482x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
483{
038e51de
AK		 484 unsigned d;
485 u8 b, sib, twobyte = 0, rex_prefix = 0;
6aa8b732
AK		 486 u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
487 unsigned long *override_base = NULL;
488 unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
489 int rc = 0;
490 struct operand src, dst;
491 unsigned long cr2 = ctxt->cr2;
492 int mode = ctxt->mode;
493 unsigned long modrm_ea;
494 int use_modrm_ea, index_reg = 0, base_reg = 0, scale, rip_relative = 0;
02c03a32 495 int no_wb = 0;
35f3f286 496 u64 msr_data;
6aa8b732
AK		 497
498 /* Shadow copy of register state. Committed on successful emulation. */
499 unsigned long _regs[NR_VCPU_REGS];
500 unsigned long _eip = ctxt->vcpu->rip, _eflags = ctxt->eflags;
501 unsigned long modrm_val = 0;
502
503 memcpy(_regs, ctxt->vcpu->regs, sizeof _regs);
504
505 switch (mode) {
506 case X86EMUL_MODE_REAL:
507 case X86EMUL_MODE_PROT16:
508 op_bytes = ad_bytes = 2;
509 break;
510 case X86EMUL_MODE_PROT32:
511 op_bytes = ad_bytes = 4;
512 break;
05b3e0c2 513#ifdef CONFIG_X86_64
6aa8b732
AK		 514 case X86EMUL_MODE_PROT64:
515 op_bytes = 4;
516 ad_bytes = 8;
517 break;
518#endif
519 default:
520 return -1;
521 }
522
523 /* Legacy prefixes. */
524 for (i = 0; i < 8; i++) {
525 switch (b = insn_fetch(u8, 1, _eip)) {
526 case 0x66: /* operand-size override */
527 op_bytes ^= 6; /* switch between 2/4 bytes */
528 break;
529 case 0x67: /* address-size override */
530 if (mode == X86EMUL_MODE_PROT64)
531 ad_bytes ^= 12; /* switch between 4/8 bytes */
532 else
533 ad_bytes ^= 6; /* switch between 2/4 bytes */
534 break;
535 case 0x2e: /* CS override */
536 override_base = &ctxt->cs_base;
537 break;
538 case 0x3e: /* DS override */
539 override_base = &ctxt->ds_base;
540 break;
541 case 0x26: /* ES override */
542 override_base = &ctxt->es_base;
543 break;
544 case 0x64: /* FS override */
545 override_base = &ctxt->fs_base;
546 break;
547 case 0x65: /* GS override */
548 override_base = &ctxt->gs_base;
549 break;
550 case 0x36: /* SS override */
551 override_base = &ctxt->ss_base;
552 break;
553 case 0xf0: /* LOCK */
554 lock_prefix = 1;
555 break;
556 case 0xf3: /* REP/REPE/REPZ */
557 rep_prefix = 1;
558 break;
559 case 0xf2: /* REPNE/REPNZ */
560 break;
561 default:
562 goto done_prefixes;
563 }
564 }
565
566done_prefixes:
567
568 /* REX prefix. */
569 if ((mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40)) {
570 rex_prefix = b;
571 if (b & 8)
572 op_bytes = 8; /* REX.W */
573 modrm_reg = (b & 4) << 1; /* REX.R */
574 index_reg = (b & 2) << 2; /* REX.X */
575 modrm_rm = base_reg = (b & 1) << 3; /* REG.B */
576 b = insn_fetch(u8, 1, _eip);
577 }
578
579 /* Opcode byte(s). */
580 d = opcode_table[b];
581 if (d == 0) {
582 /* Two-byte opcode? */
583 if (b == 0x0f) {
584 twobyte = 1;
585 b = insn_fetch(u8, 1, _eip);
586 d = twobyte_table[b];
587 }
588
589 /* Unrecognised? */
590 if (d == 0)
591 goto cannot_emulate;
592 }
593
594 /* ModRM and SIB bytes. */
595 if (d & ModRM) {
596 modrm = insn_fetch(u8, 1, _eip);
597 modrm_mod |= (modrm & 0xc0) >> 6;
598 modrm_reg |= (modrm & 0x38) >> 3;
599 modrm_rm |= (modrm & 0x07);
600 modrm_ea = 0;
601 use_modrm_ea = 1;
602
603 if (modrm_mod == 3) {
604 modrm_val = *(unsigned long *)
605 decode_register(modrm_rm, _regs, d & ByteOp);
606 goto modrm_done;
607 }
608
609 if (ad_bytes == 2) {
610 unsigned bx = _regs[VCPU_REGS_RBX];
611 unsigned bp = _regs[VCPU_REGS_RBP];
612 unsigned si = _regs[VCPU_REGS_RSI];
613 unsigned di = _regs[VCPU_REGS_RDI];
614
615 /* 16-bit ModR/M decode. */
616 switch (modrm_mod) {
617 case 0:
618 if (modrm_rm == 6)
619 modrm_ea += insn_fetch(u16, 2, _eip);
620 break;
621 case 1:
622 modrm_ea += insn_fetch(s8, 1, _eip);
623 break;
624 case 2:
625 modrm_ea += insn_fetch(u16, 2, _eip);
626 break;
627 }
628 switch (modrm_rm) {
629 case 0:
630 modrm_ea += bx + si;
631 break;
632 case 1:
633 modrm_ea += bx + di;
634 break;
635 case 2:
636 modrm_ea += bp + si;
637 break;
638 case 3:
639 modrm_ea += bp + di;
640 break;
641 case 4:
642 modrm_ea += si;
643 break;
644 case 5:
645 modrm_ea += di;
646 break;
647 case 6:
648 if (modrm_mod != 0)
649 modrm_ea += bp;
650 break;
651 case 7:
652 modrm_ea += bx;
653 break;
654 }
655 if (modrm_rm == 2 || modrm_rm == 3 ||
656 (modrm_rm == 6 && modrm_mod != 0))
657 if (!override_base)
658 override_base = &ctxt->ss_base;
659 modrm_ea = (u16)modrm_ea;
660 } else {
661 /* 32/64-bit ModR/M decode. */
662 switch (modrm_rm) {
663 case 4:
664 case 12:
665 sib = insn_fetch(u8, 1, _eip);
666 index_reg |= (sib >> 3) & 7;
667 base_reg |= sib & 7;
668 scale = sib >> 6;
669
670 switch (base_reg) {
671 case 5:
672 if (modrm_mod != 0)
673 modrm_ea += _regs[base_reg];
674 else
675 modrm_ea += insn_fetch(s32, 4, _eip);
676 break;
677 default:
678 modrm_ea += _regs[base_reg];
679 }
680 switch (index_reg) {
681 case 4:
682 break;
683 default:
684 modrm_ea += _regs[index_reg] << scale;
685
686 }
687 break;
688 case 5:
689 if (modrm_mod != 0)
690 modrm_ea += _regs[modrm_rm];
691 else if (mode == X86EMUL_MODE_PROT64)
692 rip_relative = 1;
693 break;
694 default:
695 modrm_ea += _regs[modrm_rm];
696 break;
697 }
698 switch (modrm_mod) {
699 case 0:
700 if (modrm_rm == 5)
701 modrm_ea += insn_fetch(s32, 4, _eip);
702 break;
703 case 1:
704 modrm_ea += insn_fetch(s8, 1, _eip);
705 break;
706 case 2:
707 modrm_ea += insn_fetch(s32, 4, _eip);
708 break;
709 }
710 }
711 if (!override_base)
712 override_base = &ctxt->ds_base;
713 if (mode == X86EMUL_MODE_PROT64 &&
714 override_base != &ctxt->fs_base &&
715 override_base != &ctxt->gs_base)
716 override_base = NULL;
717
718 if (override_base)
719 modrm_ea += *override_base;
720
721 if (rip_relative) {
722 modrm_ea += _eip;
723 switch (d & SrcMask) {
724 case SrcImmByte:
725 modrm_ea += 1;
726 break;
727 case SrcImm:
728 if (d & ByteOp)
729 modrm_ea += 1;
730 else
731 if (op_bytes == 8)
732 modrm_ea += 4;
733 else
734 modrm_ea += op_bytes;
735 }
736 }
737 if (ad_bytes != 8)
738 modrm_ea = (u32)modrm_ea;
739 cr2 = modrm_ea;
740 modrm_done:
741 ;
742 }
743
6aa8b732
AK		 744 /*
745 * Decode and fetch the source operand: register, memory
746 * or immediate.
747 */
748 switch (d & SrcMask) {
749 case SrcNone:
750 break;
751 case SrcReg:
752 src.type = OP_REG;
753 if (d & ByteOp) {
754 src.ptr = decode_register(modrm_reg, _regs,
755 (rex_prefix == 0));
756 src.val = src.orig_val = *(u8 *) src.ptr;
757 src.bytes = 1;
758 } else {
759 src.ptr = decode_register(modrm_reg, _regs, 0);
760 switch ((src.bytes = op_bytes)) {
761 case 2:
762 src.val = src.orig_val = *(u16 *) src.ptr;
763 break;
764 case 4:
765 src.val = src.orig_val = *(u32 *) src.ptr;
766 break;
767 case 8:
768 src.val = src.orig_val = *(u64 *) src.ptr;
769 break;
770 }
771 }
772 break;
773 case SrcMem16:
774 src.bytes = 2;
775 goto srcmem_common;
776 case SrcMem32:
777 src.bytes = 4;
778 goto srcmem_common;
779 case SrcMem:
780 src.bytes = (d & ByteOp) ? 1 : op_bytes;
781 srcmem_common:
782 src.type = OP_MEM;
783 src.ptr = (unsigned long *)cr2;
784 if ((rc = ops->read_emulated((unsigned long)src.ptr,
cebff02b 785 &src.val, src.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 786 goto done;
787 src.orig_val = src.val;
788 break;
789 case SrcImm:
790 src.type = OP_IMM;
791 src.ptr = (unsigned long *)_eip;
792 src.bytes = (d & ByteOp) ? 1 : op_bytes;
793 if (src.bytes == 8)
794 src.bytes = 4;
795 /* NB. Immediates are sign-extended as necessary. */
796 switch (src.bytes) {
797 case 1:
798 src.val = insn_fetch(s8, 1, _eip);
799 break;
800 case 2:
801 src.val = insn_fetch(s16, 2, _eip);
802 break;
803 case 4:
804 src.val = insn_fetch(s32, 4, _eip);
805 break;
806 }
807 break;
808 case SrcImmByte:
809 src.type = OP_IMM;
810 src.ptr = (unsigned long *)_eip;
811 src.bytes = 1;
812 src.val = insn_fetch(s8, 1, _eip);
813 break;
814 }
815
038e51de
AK		 816 /* Decode and fetch the destination operand: register or memory. */
817 switch (d & DstMask) {
818 case ImplicitOps:
819 /* Special instructions do their own operand decoding. */
820 goto special_insn;
821 case DstReg:
822 dst.type = OP_REG;
823 if ((d & ByteOp)
394b6e59 824 && !(twobyte && (b == 0xb6 || b == 0xb7))) {
038e51de
AK		 825 dst.ptr = decode_register(modrm_reg, _regs,
826 (rex_prefix == 0));
827 dst.val = *(u8 *) dst.ptr;
828 dst.bytes = 1;
829 } else {
830 dst.ptr = decode_register(modrm_reg, _regs, 0);
831 switch ((dst.bytes = op_bytes)) {
832 case 2:
833 dst.val = *(u16 *)dst.ptr;
834 break;
835 case 4:
836 dst.val = *(u32 *)dst.ptr;
837 break;
838 case 8:
839 dst.val = *(u64 *)dst.ptr;
840 break;
841 }
842 }
843 break;
844 case DstMem:
845 dst.type = OP_MEM;
846 dst.ptr = (unsigned long *)cr2;
847 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
848 if (d & BitOp) {
df513e2c
AK		 849 unsigned long mask = ~(dst.bytes * 8 - 1);
850
851 dst.ptr = (void *)dst.ptr + (src.val & mask) / 8;
038e51de
AK		 852 }
853 if (!(d & Mov) && /* optimisation - avoid slow emulated read */
854 ((rc = ops->read_emulated((unsigned long)dst.ptr,
cebff02b 855 &dst.val, dst.bytes, ctxt->vcpu)) != 0))
038e51de
AK		 856 goto done;
857 break;
858 }
859 dst.orig_val = dst.val;
860
6aa8b732
AK		 861 if (twobyte)
862 goto twobyte_insn;
863
864 switch (b) {
865 case 0x00 ... 0x05:
866 add: /* add */
867 emulate_2op_SrcV("add", src, dst, _eflags);
868 break;
869 case 0x08 ... 0x0d:
870 or: /* or */
871 emulate_2op_SrcV("or", src, dst, _eflags);
872 break;
873 case 0x10 ... 0x15:
874 adc: /* adc */
875 emulate_2op_SrcV("adc", src, dst, _eflags);
876 break;
877 case 0x18 ... 0x1d:
878 sbb: /* sbb */
879 emulate_2op_SrcV("sbb", src, dst, _eflags);
880 break;
881 case 0x20 ... 0x25:
882 and: /* and */
883 emulate_2op_SrcV("and", src, dst, _eflags);
884 break;
885 case 0x28 ... 0x2d:
886 sub: /* sub */
887 emulate_2op_SrcV("sub", src, dst, _eflags);
888 break;
889 case 0x30 ... 0x35:
890 xor: /* xor */
891 emulate_2op_SrcV("xor", src, dst, _eflags);
892 break;
893 case 0x38 ... 0x3d:
894 cmp: /* cmp */
895 emulate_2op_SrcV("cmp", src, dst, _eflags);
896 break;
897 case 0x63: /* movsxd */
898 if (mode != X86EMUL_MODE_PROT64)
899 goto cannot_emulate;
900 dst.val = (s32) src.val;
901 break;
902 case 0x80 ... 0x83: /* Grp1 */
903 switch (modrm_reg) {
904 case 0:
905 goto add;
906 case 1:
907 goto or;
908 case 2:
909 goto adc;
910 case 3:
911 goto sbb;
912 case 4:
913 goto and;
914 case 5:
915 goto sub;
916 case 6:
917 goto xor;
918 case 7:
919 goto cmp;
920 }
921 break;
922 case 0x84 ... 0x85:
923 test: /* test */
924 emulate_2op_SrcV("test", src, dst, _eflags);
925 break;
926 case 0x86 ... 0x87: /* xchg */
927 /* Write back the register source. */
928 switch (dst.bytes) {
929 case 1:
930 *(u8 *) src.ptr = (u8) dst.val;
931 break;
932 case 2:
933 *(u16 *) src.ptr = (u16) dst.val;
934 break;
935 case 4:
936 *src.ptr = (u32) dst.val;
937 break; /* 64b reg: zero-extend */
938 case 8:
939 *src.ptr = dst.val;
940 break;
941 }
942 /*
943 * Write back the memory destination with implicit LOCK
944 * prefix.
945 */
946 dst.val = src.val;
947 lock_prefix = 1;
948 break;
949 case 0xa0 ... 0xa1: /* mov */
950 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
951 dst.val = src.val;
952 _eip += ad_bytes; /* skip src displacement */
953 break;
954 case 0xa2 ... 0xa3: /* mov */
955 dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
956 _eip += ad_bytes; /* skip dst displacement */
957 break;
958 case 0x88 ... 0x8b: /* mov */
959 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
960 dst.val = src.val;
961 break;
962 case 0x8f: /* pop (sole member of Grp1a) */
963 /* 64-bit mode: POP always pops a 64-bit operand. */
964 if (mode == X86EMUL_MODE_PROT64)
965 dst.bytes = 8;
966 if ((rc = ops->read_std(register_address(ctxt->ss_base,
967 _regs[VCPU_REGS_RSP]),
cebff02b 968 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 969 goto done;
970 register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
971 break;
972 case 0xc0 ... 0xc1:
973 grp2: /* Grp2 */
974 switch (modrm_reg) {
975 case 0: /* rol */
976 emulate_2op_SrcB("rol", src, dst, _eflags);
977 break;
978 case 1: /* ror */
979 emulate_2op_SrcB("ror", src, dst, _eflags);
980 break;
981 case 2: /* rcl */
982 emulate_2op_SrcB("rcl", src, dst, _eflags);
983 break;
984 case 3: /* rcr */
985 emulate_2op_SrcB("rcr", src, dst, _eflags);
986 break;
987 case 4: /* sal/shl */
988 case 6: /* sal/shl */
989 emulate_2op_SrcB("sal", src, dst, _eflags);
990 break;
991 case 5: /* shr */
992 emulate_2op_SrcB("shr", src, dst, _eflags);
993 break;
994 case 7: /* sar */
995 emulate_2op_SrcB("sar", src, dst, _eflags);
996 break;
997 }
998 break;
999 case 0xd0 ... 0xd1: /* Grp2 */
1000 src.val = 1;
1001 goto grp2;
1002 case 0xd2 ... 0xd3: /* Grp2 */
1003 src.val = _regs[VCPU_REGS_RCX];
1004 goto grp2;
1005 case 0xf6 ... 0xf7: /* Grp3 */
1006 switch (modrm_reg) {
1007 case 0 ... 1: /* test */
1008 /*
1009 * Special case in Grp3: test has an immediate
1010 * source operand.
1011 */
1012 src.type = OP_IMM;
1013 src.ptr = (unsigned long *)_eip;
1014 src.bytes = (d & ByteOp) ? 1 : op_bytes;
1015 if (src.bytes == 8)
1016 src.bytes = 4;
1017 switch (src.bytes) {
1018 case 1:
1019 src.val = insn_fetch(s8, 1, _eip);
1020 break;
1021 case 2:
1022 src.val = insn_fetch(s16, 2, _eip);
1023 break;
1024 case 4:
1025 src.val = insn_fetch(s32, 4, _eip);
1026 break;
1027 }
1028 goto test;
1029 case 2: /* not */
1030 dst.val = ~dst.val;
1031 break;
1032 case 3: /* neg */
1033 emulate_1op("neg", dst, _eflags);
1034 break;
1035 default:
1036 goto cannot_emulate;
1037 }
1038 break;
1039 case 0xfe ... 0xff: /* Grp4/Grp5 */
1040 switch (modrm_reg) {
1041 case 0: /* inc */
1042 emulate_1op("inc", dst, _eflags);
1043 break;
1044 case 1: /* dec */
1045 emulate_1op("dec", dst, _eflags);
1046 break;
1047 case 6: /* push */
1048 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1049 if (mode == X86EMUL_MODE_PROT64) {
1050 dst.bytes = 8;
1051 if ((rc = ops->read_std((unsigned long)dst.ptr,
1052 &dst.val, 8,
cebff02b 1053 ctxt->vcpu)) != 0)
6aa8b732
AK		 1054 goto done;
1055 }
1056 register_address_increment(_regs[VCPU_REGS_RSP],
1057 -dst.bytes);
1058 if ((rc = ops->write_std(
1059 register_address(ctxt->ss_base,
1060 _regs[VCPU_REGS_RSP]),
cebff02b 1061 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732 1062 goto done;
02c03a32 1063 no_wb = 1;
6aa8b732
AK		 1064 break;
1065 default:
1066 goto cannot_emulate;
1067 }
1068 break;
1069 }
1070
1071writeback:
02c03a32 1072 if (!no_wb) {
6aa8b732
AK		 1073 switch (dst.type) {
1074 case OP_REG:
1075 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1076 switch (dst.bytes) {
1077 case 1:
1078 *(u8 *)dst.ptr = (u8)dst.val;
1079 break;
1080 case 2:
1081 *(u16 *)dst.ptr = (u16)dst.val;
1082 break;
1083 case 4:
1084 *dst.ptr = (u32)dst.val;
1085 break; /* 64b: zero-ext */
1086 case 8:
1087 *dst.ptr = dst.val;
1088 break;
1089 }
1090 break;
1091 case OP_MEM:
1092 if (lock_prefix)
1093 rc = ops->cmpxchg_emulated((unsigned long)dst.
4c690a1e
AK		 1094 ptr, &dst.orig_val,
1095 &dst.val, dst.bytes,
cebff02b 1096 ctxt->vcpu);
6aa8b732
AK		 1097 else
1098 rc = ops->write_emulated((unsigned long)dst.ptr,
4c690a1e 1099 &dst.val, dst.bytes,
cebff02b 1100 ctxt->vcpu);
6aa8b732
AK		 1101 if (rc != 0)
1102 goto done;
1103 default:
1104 break;
1105 }
1106 }
1107
1108 /* Commit shadow register state. */
1109 memcpy(ctxt->vcpu->regs, _regs, sizeof _regs);
1110 ctxt->eflags = _eflags;
1111 ctxt->vcpu->rip = _eip;
1112
1113done:
1114 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1115
1116special_insn:
1117 if (twobyte)
1118 goto twobyte_special_insn;
1119 if (rep_prefix) {
1120 if (_regs[VCPU_REGS_RCX] == 0) {
1121 ctxt->vcpu->rip = _eip;
1122 goto done;
1123 }
1124 _regs[VCPU_REGS_RCX]--;
1125 _eip = ctxt->vcpu->rip;
1126 }
1127 switch (b) {
1128 case 0xa4 ... 0xa5: /* movs */
1129 dst.type = OP_MEM;
1130 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1131 dst.ptr = (unsigned long *)register_address(ctxt->es_base,
1132 _regs[VCPU_REGS_RDI]);
1133 if ((rc = ops->read_emulated(register_address(
1134 override_base ? *override_base : ctxt->ds_base,
cebff02b 1135 _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 1136 goto done;
1137 register_address_increment(_regs[VCPU_REGS_RSI],
1138 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1139 register_address_increment(_regs[VCPU_REGS_RDI],
1140 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1141 break;
1142 case 0xa6 ... 0xa7: /* cmps */
1143 DPRINTF("Urk! I don't handle CMPS.\n");
1144 goto cannot_emulate;
1145 case 0xaa ... 0xab: /* stos */
1146 dst.type = OP_MEM;
1147 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1148 dst.ptr = (unsigned long *)cr2;
1149 dst.val = _regs[VCPU_REGS_RAX];
1150 register_address_increment(_regs[VCPU_REGS_RDI],
1151 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1152 break;
1153 case 0xac ... 0xad: /* lods */
1154 dst.type = OP_REG;
1155 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1156 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
cebff02b
LV		 1157 if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes,
1158 ctxt->vcpu)) != 0)
6aa8b732
AK		 1159 goto done;
1160 register_address_increment(_regs[VCPU_REGS_RSI],
1161 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1162 break;
1163 case 0xae ... 0xaf: /* scas */
1164 DPRINTF("Urk! I don't handle SCAS.\n");
1165 goto cannot_emulate;
72d6e5a0
AK		 1166 case 0xf4: /* hlt */
1167 ctxt->vcpu->halt_request = 1;
1168 goto done;
d9413cd7
NK		 1169 case 0xc3: /* ret */
1170 dst.ptr = &_eip;
1171 goto pop_instruction;
7f0aaee0
NK		 1172 case 0x58 ... 0x5f: /* pop reg */
1173 dst.ptr = (unsigned long *)&_regs[b & 0x7];
1174
d9413cd7 1175pop_instruction:
7f0aaee0 1176 if ((rc = ops->read_std(register_address(ctxt->ss_base,
cebff02b
LV		 1177 _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt->vcpu))
1178 != 0)
7f0aaee0
NK		 1179 goto done;
1180
d9413cd7 1181 register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
02c03a32 1182 no_wb = 1; /* Disable writeback. */
7f0aaee0 1183 break;
6aa8b732
AK		 1184 }
1185 goto writeback;
1186
1187twobyte_insn:
1188 switch (b) {
1189 case 0x01: /* lgdt, lidt, lmsw */
d37c8557
AJ		 1190 /* Disable writeback. */
1191 no_wb = 1;
6aa8b732
AK		 1192 switch (modrm_reg) {
1193 u16 size;
1194 unsigned long address;
1195
1196 case 2: /* lgdt */
1197 rc = read_descriptor(ctxt, ops, src.ptr,
1198 &size, &address, op_bytes);
1199 if (rc)
1200 goto done;
1201 realmode_lgdt(ctxt->vcpu, size, address);
1202 break;
1203 case 3: /* lidt */
1204 rc = read_descriptor(ctxt, ops, src.ptr,
1205 &size, &address, op_bytes);
1206 if (rc)
1207 goto done;
1208 realmode_lidt(ctxt->vcpu, size, address);
1209 break;
1210 case 4: /* smsw */
1211 if (modrm_mod != 3)
1212 goto cannot_emulate;
1213 *(u16 *)&_regs[modrm_rm]
1214 = realmode_get_cr(ctxt->vcpu, 0);
1215 break;
1216 case 6: /* lmsw */
1217 if (modrm_mod != 3)
1218 goto cannot_emulate;
1219 realmode_lmsw(ctxt->vcpu, (u16)modrm_val, &_eflags);
1220 break;
1221 case 7: /* invlpg*/
1222 emulate_invlpg(ctxt->vcpu, cr2);
1223 break;
1224 default:
1225 goto cannot_emulate;
1226 }
1227 break;
1228 case 0x21: /* mov from dr to reg */
bac27d35 1229 no_wb = 1;
6aa8b732
AK		 1230 if (modrm_mod != 3)
1231 goto cannot_emulate;
1232 rc = emulator_get_dr(ctxt, modrm_reg, &_regs[modrm_rm]);
1233 break;
1234 case 0x23: /* mov from reg to dr */
bac27d35 1235 no_wb = 1;
6aa8b732
AK		 1236 if (modrm_mod != 3)
1237 goto cannot_emulate;
1238 rc = emulator_set_dr(ctxt, modrm_reg, _regs[modrm_rm]);
1239 break;
1240 case 0x40 ... 0x4f: /* cmov */
1241 dst.val = dst.orig_val = src.val;
e3243452 1242 no_wb = 1;
6aa8b732
AK		 1243 /*
1244 * First, assume we're decoding an even cmov opcode
1245 * (lsb == 0).
1246 */
1247 switch ((b & 15) >> 1) {
1248 case 0: /* cmovo */
e3243452 1249 no_wb = (_eflags & EFLG_OF) ? 0 : 1;
6aa8b732
AK		 1250 break;
1251 case 1: /* cmovb/cmovc/cmovnae */
e3243452 1252 no_wb = (_eflags & EFLG_CF) ? 0 : 1;
6aa8b732
AK		 1253 break;
1254 case 2: /* cmovz/cmove */
e3243452 1255 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
6aa8b732
AK		 1256 break;
1257 case 3: /* cmovbe/cmovna */
e3243452 1258 no_wb = (_eflags & (EFLG_CF | EFLG_ZF)) ? 0 : 1;
6aa8b732
AK		 1259 break;
1260 case 4: /* cmovs */
e3243452 1261 no_wb = (_eflags & EFLG_SF) ? 0 : 1;
6aa8b732
AK		 1262 break;
1263 case 5: /* cmovp/cmovpe */
e3243452 1264 no_wb = (_eflags & EFLG_PF) ? 0 : 1;
6aa8b732
AK		 1265 break;
1266 case 7: /* cmovle/cmovng */
e3243452 1267 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
6aa8b732
AK		 1268 /* fall through */
1269 case 6: /* cmovl/cmovnge */
e3243452
AK		 1270 no_wb &= (!(_eflags & EFLG_SF) !=
1271 !(_eflags & EFLG_OF)) ? 0 : 1;
6aa8b732
AK		 1272 break;
1273 }
1274 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
e3243452 1275 no_wb ^= b & 1;
6aa8b732
AK		 1276 break;
1277 case 0xb0 ... 0xb1: /* cmpxchg */
1278 /*
1279 * Save real source value, then compare EAX against
1280 * destination.
1281 */
1282 src.orig_val = src.val;
1283 src.val = _regs[VCPU_REGS_RAX];
1284 emulate_2op_SrcV("cmp", src, dst, _eflags);
6aa8b732
AK		 1285 if (_eflags & EFLG_ZF) {
1286 /* Success: write back to memory. */
1287 dst.val = src.orig_val;
1288 } else {
1289 /* Failure: write the value we saw to EAX. */
1290 dst.type = OP_REG;
1291 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1292 }
1293 break;
1294 case 0xa3:
1295 bt: /* bt */
1296 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1297 emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
1298 break;
1299 case 0xb3:
1300 btr: /* btr */
1301 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1302 emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
1303 break;
1304 case 0xab:
1305 bts: /* bts */
1306 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1307 emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
1308 break;
1309 case 0xb6 ... 0xb7: /* movzx */
1310 dst.bytes = op_bytes;
1311 dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
1312 break;
1313 case 0xbb:
1314 btc: /* btc */
1315 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1316 emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
1317 break;
1318 case 0xba: /* Grp8 */
1319 switch (modrm_reg & 3) {
1320 case 0:
1321 goto bt;
1322 case 1:
1323 goto bts;
1324 case 2:
1325 goto btr;
1326 case 3:
1327 goto btc;
1328 }
1329 break;
1330 case 0xbe ... 0xbf: /* movsx */
1331 dst.bytes = op_bytes;
1332 dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
1333 break;
1334 }
1335 goto writeback;
1336
1337twobyte_special_insn:
1338 /* Disable writeback. */
02c03a32 1339 no_wb = 1;
6aa8b732 1340 switch (b) {
687fdbfe
AK		 1341 case 0x09: /* wbinvd */
1342 break;
6aa8b732
AK		 1343 case 0x0d: /* GrpP (prefetch) */
1344 case 0x18: /* Grp16 (prefetch/nop) */
1345 break;
1346 case 0x06:
1347 emulate_clts(ctxt->vcpu);
1348 break;
1349 case 0x20: /* mov cr, reg */
1350 if (modrm_mod != 3)
1351 goto cannot_emulate;
1352 _regs[modrm_rm] = realmode_get_cr(ctxt->vcpu, modrm_reg);
1353 break;
1354 case 0x22: /* mov reg, cr */
1355 if (modrm_mod != 3)
1356 goto cannot_emulate;
1357 realmode_set_cr(ctxt->vcpu, modrm_reg, modrm_val, &_eflags);
1358 break;
35f3f286
AK		 1359 case 0x30:
1360 /* wrmsr */
1361 msr_data = (u32)_regs[VCPU_REGS_RAX]
1362 | ((u64)_regs[VCPU_REGS_RDX] << 32);
1363 rc = kvm_set_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], msr_data);
1364 if (rc) {
1365 kvm_arch_ops->inject_gp(ctxt->vcpu, 0);
1366 _eip = ctxt->vcpu->rip;
1367 }
1368 rc = X86EMUL_CONTINUE;
1369 break;
1370 case 0x32:
1371 /* rdmsr */
1372 rc = kvm_get_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], &msr_data);
1373 if (rc) {
1374 kvm_arch_ops->inject_gp(ctxt->vcpu, 0);
1375 _eip = ctxt->vcpu->rip;
1376 } else {
1377 _regs[VCPU_REGS_RAX] = (u32)msr_data;
1378 _regs[VCPU_REGS_RDX] = msr_data >> 32;
1379 }
1380 rc = X86EMUL_CONTINUE;
1381 break;
6aa8b732 1382 case 0xc7: /* Grp9 (cmpxchg8b) */
6aa8b732 1383 {
4c690a1e 1384 u64 old, new;
cebff02b
LV		 1385 if ((rc = ops->read_emulated(cr2, &old, 8, ctxt->vcpu))
1386 != 0)
6aa8b732
AK		 1387 goto done;
1388 if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
1389 ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
1390 _regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1391 _regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1392 _eflags &= ~EFLG_ZF;
1393 } else {
4c690a1e
AK		 1394 new = ((u64)_regs[VCPU_REGS_RCX] << 32)
1395 | (u32) _regs[VCPU_REGS_RBX];
1396 if ((rc = ops->cmpxchg_emulated(cr2, &old,
cebff02b 1397 &new, 8, ctxt->vcpu)) != 0)
6aa8b732
AK		 1398 goto done;
1399 _eflags |= EFLG_ZF;
1400 }
1401 break;
1402 }
6aa8b732
AK		 1403 }
1404 goto writeback;
1405
1406cannot_emulate:
1407 DPRINTF("Cannot emulate %02x\n", b);
1408 return -1;
1409}
1410
1411#ifdef __XEN__
1412
1413#include <asm/mm.h>
1414#include <asm/uaccess.h>
1415
1416int
1417x86_emulate_read_std(unsigned long addr,
1418 unsigned long *val,
1419 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1420{
1421 unsigned int rc;
1422
1423 *val = 0;
1424
1425 if ((rc = copy_from_user((void *)val, (void *)addr, bytes)) != 0) {
1426 propagate_page_fault(addr + bytes - rc, 0); /* read fault */
1427 return X86EMUL_PROPAGATE_FAULT;
1428 }
1429
1430 return X86EMUL_CONTINUE;
1431}
1432
1433int
1434x86_emulate_write_std(unsigned long addr,
1435 unsigned long val,
1436 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1437{
1438 unsigned int rc;
1439
1440 if ((rc = copy_to_user((void *)addr, (void *)&val, bytes)) != 0) {
1441 propagate_page_fault(addr + bytes - rc, PGERR_write_access);
1442 return X86EMUL_PROPAGATE_FAULT;
1443 }
1444
1445 return X86EMUL_CONTINUE;
1446}
1447
1448#endif
ubuntu-bionic-kernel mirror