]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blame - drivers/kvm/x86_emulate.c
projects / mirror_ubuntu-artful-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
KVM: Cleanup string I/O instruction emulation
[mirror_ubuntu-artful-kernel.git] / drivers / kvm / x86_emulate.c
CommitLineData
6aa8b732
AK		 1/******************************************************************************
2 * x86_emulate.c
3 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
dcc0766b 9 * privileged instructions:
6aa8b732
AK		 10 *
11 * Copyright (C) 2006 Qumranet
12 *
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
15 *
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
18 *
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
20 */
21
22#ifndef __KERNEL__
23#include <stdio.h>
24#include <stdint.h>
25#include <public/xen.h>
26#define DPRINTF(_f, _a ...) printf( _f , ## _a )
27#else
28#include "kvm.h"
29#define DPRINTF(x...) do {} while (0)
30#endif
31#include "x86_emulate.h"
32#include <linux/module.h>
33
34/*
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
40 * not be handled.
41 */
42
43/* Operand sizes: 8-bit operands or specified/overridden size. */
44#define ByteOp (1<<0) /* 8-bit operands. */
45/* Destination operand type. */
46#define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47#define DstReg (2<<1) /* Register operand. */
48#define DstMem (3<<1) /* Memory operand. */
49#define DstMask (3<<1)
50/* Source operand type. */
51#define SrcNone (0<<3) /* No source operand. */
52#define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53#define SrcReg (1<<3) /* Register operand. */
54#define SrcMem (2<<3) /* Memory operand. */
55#define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56#define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57#define SrcImm (5<<3) /* Immediate operand. */
58#define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59#define SrcMask (7<<3)
60/* Generic ModRM decode. */
61#define ModRM (1<<6)
62/* Destination is only written; never read. */
63#define Mov (1<<7)
038e51de 64#define BitOp (1<<8)
6aa8b732
AK		 65
66static u8 opcode_table[256] = {
67 /* 0x00 - 0x07 */
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
70 0, 0, 0, 0,
71 /* 0x08 - 0x0F */
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
74 0, 0, 0, 0,
75 /* 0x10 - 0x17 */
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
78 0, 0, 0, 0,
79 /* 0x18 - 0x1F */
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
82 0, 0, 0, 0,
83 /* 0x20 - 0x27 */
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 0, 0, 0, 0,
87 /* 0x28 - 0x2F */
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
90 0, 0, 0, 0,
91 /* 0x30 - 0x37 */
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
94 0, 0, 0, 0,
95 /* 0x38 - 0x3F */
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
98 0, 0, 0, 0,
99 /* 0x40 - 0x4F */
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
7f0aaee0
NK		 101 /* 0x50 - 0x57 */
102 0, 0, 0, 0, 0, 0, 0, 0,
103 /* 0x58 - 0x5F */
104 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
e70669ab 106 /* 0x60 - 0x6B */
6aa8b732 107 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
e70669ab
LV		 108 0, 0, 0, 0, 0, 0, 0, 0,
109 /* 0x6C - 0x6F */
110 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* insb, insw/insd */
111 SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps, /* outsb, outsw/outsd */
6aa8b732
AK		 112 /* 0x70 - 0x7F */
113 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
114 /* 0x80 - 0x87 */
115 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
116 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
117 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
118 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
119 /* 0x88 - 0x8F */
120 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
121 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
122 0, 0, 0, DstMem | SrcNone | ModRM | Mov,
123 /* 0x90 - 0x9F */
124 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
125 /* 0xA0 - 0xA7 */
126 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
127 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
128 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
129 ByteOp | ImplicitOps, ImplicitOps,
130 /* 0xA8 - 0xAF */
131 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
132 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
133 ByteOp | ImplicitOps, ImplicitOps,
134 /* 0xB0 - 0xBF */
135 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
136 /* 0xC0 - 0xC7 */
d9413cd7
NK		 137 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
138 0, ImplicitOps, 0, 0,
139 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
6aa8b732
AK		 140 /* 0xC8 - 0xCF */
141 0, 0, 0, 0, 0, 0, 0, 0,
142 /* 0xD0 - 0xD7 */
143 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
144 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
145 0, 0, 0, 0,
146 /* 0xD8 - 0xDF */
147 0, 0, 0, 0, 0, 0, 0, 0,
148 /* 0xE0 - 0xEF */
149 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
150 /* 0xF0 - 0xF7 */
151 0, 0, 0, 0,
72d6e5a0
AK		 152 ImplicitOps, 0,
153 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
6aa8b732
AK		 154 /* 0xF8 - 0xFF */
155 0, 0, 0, 0,
156 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
157};
158
038e51de 159static u16 twobyte_table[256] = {
6aa8b732
AK		 160 /* 0x00 - 0x0F */
161 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
687fdbfe 162 0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
6aa8b732
AK		 163 /* 0x10 - 0x1F */
164 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
165 /* 0x20 - 0x2F */
166 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
167 0, 0, 0, 0, 0, 0, 0, 0,
168 /* 0x30 - 0x3F */
35f3f286 169 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
6aa8b732
AK		 170 /* 0x40 - 0x47 */
171 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
172 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
173 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
174 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
175 /* 0x48 - 0x4F */
176 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
177 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
178 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
179 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
180 /* 0x50 - 0x5F */
181 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
182 /* 0x60 - 0x6F */
183 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
184 /* 0x70 - 0x7F */
185 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
186 /* 0x80 - 0x8F */
187 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
188 /* 0x90 - 0x9F */
189 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
190 /* 0xA0 - 0xA7 */
038e51de 191 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732 192 /* 0xA8 - 0xAF */
038e51de 193 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
6aa8b732
AK		 194 /* 0xB0 - 0xB7 */
195 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
038e51de 196 DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 197 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
198 DstReg | SrcMem16 | ModRM | Mov,
199 /* 0xB8 - 0xBF */
038e51de 200 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
6aa8b732
AK		 201 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
202 DstReg | SrcMem16 | ModRM | Mov,
203 /* 0xC0 - 0xCF */
204 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
205 /* 0xD0 - 0xDF */
206 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
207 /* 0xE0 - 0xEF */
208 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
209 /* 0xF0 - 0xFF */
210 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
211};
212
213/*
214 * Tell the emulator that of the Group 7 instructions (sgdt, lidt, etc.) we
215 * are interested only in invlpg and not in any of the rest.
216 *
217 * invlpg is a special instruction in that the data it references may not
218 * be mapped.
219 */
220void kvm_emulator_want_group7_invlpg(void)
221{
222 twobyte_table[1] &= ~SrcMem;
223}
224EXPORT_SYMBOL_GPL(kvm_emulator_want_group7_invlpg);
225
226/* Type, address-of, and value of an instruction's operand. */
227struct operand {
228 enum { OP_REG, OP_MEM, OP_IMM } type;
229 unsigned int bytes;
230 unsigned long val, orig_val, *ptr;
231};
232
233/* EFLAGS bit definitions. */
234#define EFLG_OF (1<<11)
235#define EFLG_DF (1<<10)
236#define EFLG_SF (1<<7)
237#define EFLG_ZF (1<<6)
238#define EFLG_AF (1<<4)
239#define EFLG_PF (1<<2)
240#define EFLG_CF (1<<0)
241
242/*
243 * Instruction emulation:
244 * Most instructions are emulated directly via a fragment of inline assembly
245 * code. This allows us to save/restore EFLAGS and thus very easily pick up
246 * any modified flags.
247 */
248
05b3e0c2 249#if defined(CONFIG_X86_64)
6aa8b732
AK		 250#define _LO32 "k" /* force 32-bit operand */
251#define _STK "%%rsp" /* stack pointer */
252#elif defined(__i386__)
253#define _LO32 "" /* force 32-bit operand */
254#define _STK "%%esp" /* stack pointer */
255#endif
256
257/*
258 * These EFLAGS bits are restored from saved value during emulation, and
259 * any changes are written back to the saved value after emulation.
260 */
261#define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
262
263/* Before executing instruction: restore necessary bits in EFLAGS. */
264#define _PRE_EFLAGS(_sav, _msk, _tmp) \
265 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
266 "push %"_sav"; " \
267 "movl %"_msk",%"_LO32 _tmp"; " \
268 "andl %"_LO32 _tmp",("_STK"); " \
269 "pushf; " \
270 "notl %"_LO32 _tmp"; " \
271 "andl %"_LO32 _tmp",("_STK"); " \
272 "pop %"_tmp"; " \
273 "orl %"_LO32 _tmp",("_STK"); " \
274 "popf; " \
275 /* _sav &= ~msk; */ \
276 "movl %"_msk",%"_LO32 _tmp"; " \
277 "notl %"_LO32 _tmp"; " \
278 "andl %"_LO32 _tmp",%"_sav"; "
279
280/* After executing instruction: write-back necessary bits in EFLAGS. */
281#define _POST_EFLAGS(_sav, _msk, _tmp) \
282 /* _sav |= EFLAGS & _msk; */ \
283 "pushf; " \
284 "pop %"_tmp"; " \
285 "andl %"_msk",%"_LO32 _tmp"; " \
286 "orl %"_LO32 _tmp",%"_sav"; "
287
288/* Raw emulation: instruction has two explicit operands. */
289#define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
290 do { \
291 unsigned long _tmp; \
292 \
293 switch ((_dst).bytes) { \
294 case 2: \
295 __asm__ __volatile__ ( \
296 _PRE_EFLAGS("0","4","2") \
297 _op"w %"_wx"3,%1; " \
298 _POST_EFLAGS("0","4","2") \
299 : "=m" (_eflags), "=m" ((_dst).val), \
300 "=&r" (_tmp) \
301 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
302 break; \
303 case 4: \
304 __asm__ __volatile__ ( \
305 _PRE_EFLAGS("0","4","2") \
306 _op"l %"_lx"3,%1; " \
307 _POST_EFLAGS("0","4","2") \
308 : "=m" (_eflags), "=m" ((_dst).val), \
309 "=&r" (_tmp) \
310 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
311 break; \
312 case 8: \
313 __emulate_2op_8byte(_op, _src, _dst, \
314 _eflags, _qx, _qy); \
315 break; \
316 } \
317 } while (0)
318
319#define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
320 do { \
321 unsigned long _tmp; \
322 switch ( (_dst).bytes ) \
323 { \
324 case 1: \
325 __asm__ __volatile__ ( \
326 _PRE_EFLAGS("0","4","2") \
327 _op"b %"_bx"3,%1; " \
328 _POST_EFLAGS("0","4","2") \
329 : "=m" (_eflags), "=m" ((_dst).val), \
330 "=&r" (_tmp) \
331 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
332 break; \
333 default: \
334 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
335 _wx, _wy, _lx, _ly, _qx, _qy); \
336 break; \
337 } \
338 } while (0)
339
340/* Source operand is byte-sized and may be restricted to just %cl. */
341#define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
342 __emulate_2op(_op, _src, _dst, _eflags, \
343 "b", "c", "b", "c", "b", "c", "b", "c")
344
345/* Source operand is byte, word, long or quad sized. */
346#define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
347 __emulate_2op(_op, _src, _dst, _eflags, \
348 "b", "q", "w", "r", _LO32, "r", "", "r")
349
350/* Source operand is word, long or quad sized. */
351#define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
352 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
353 "w", "r", _LO32, "r", "", "r")
354
355/* Instruction has only one explicit operand (no source operand). */
356#define emulate_1op(_op, _dst, _eflags) \
357 do { \
358 unsigned long _tmp; \
359 \
360 switch ( (_dst).bytes ) \
361 { \
362 case 1: \
363 __asm__ __volatile__ ( \
364 _PRE_EFLAGS("0","3","2") \
365 _op"b %1; " \
366 _POST_EFLAGS("0","3","2") \
367 : "=m" (_eflags), "=m" ((_dst).val), \
368 "=&r" (_tmp) \
369 : "i" (EFLAGS_MASK) ); \
370 break; \
371 case 2: \
372 __asm__ __volatile__ ( \
373 _PRE_EFLAGS("0","3","2") \
374 _op"w %1; " \
375 _POST_EFLAGS("0","3","2") \
376 : "=m" (_eflags), "=m" ((_dst).val), \
377 "=&r" (_tmp) \
378 : "i" (EFLAGS_MASK) ); \
379 break; \
380 case 4: \
381 __asm__ __volatile__ ( \
382 _PRE_EFLAGS("0","3","2") \
383 _op"l %1; " \
384 _POST_EFLAGS("0","3","2") \
385 : "=m" (_eflags), "=m" ((_dst).val), \
386 "=&r" (_tmp) \
387 : "i" (EFLAGS_MASK) ); \
388 break; \
389 case 8: \
390 __emulate_1op_8byte(_op, _dst, _eflags); \
391 break; \
392 } \
393 } while (0)
394
395/* Emulate an instruction with quadword operands (x86/64 only). */
05b3e0c2 396#if defined(CONFIG_X86_64)
6aa8b732
AK		 397#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
398 do { \
399 __asm__ __volatile__ ( \
400 _PRE_EFLAGS("0","4","2") \
401 _op"q %"_qx"3,%1; " \
402 _POST_EFLAGS("0","4","2") \
403 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
404 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
405 } while (0)
406
407#define __emulate_1op_8byte(_op, _dst, _eflags) \
408 do { \
409 __asm__ __volatile__ ( \
410 _PRE_EFLAGS("0","3","2") \
411 _op"q %1; " \
412 _POST_EFLAGS("0","3","2") \
413 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
414 : "i" (EFLAGS_MASK) ); \
415 } while (0)
416
417#elif defined(__i386__)
418#define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
419#define __emulate_1op_8byte(_op, _dst, _eflags)
420#endif /* __i386__ */
421
422/* Fetch next part of the instruction being emulated. */
423#define insn_fetch(_type, _size, _eip) \
424({ unsigned long _x; \
425 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
cebff02b 426 (_size), ctxt->vcpu); \
6aa8b732
AK		 427 if ( rc != 0 ) \
428 goto done; \
429 (_eip) += (_size); \
430 (_type)_x; \
431})
432
433/* Access/update address held in a register, based on addressing mode. */
e70669ab
LV		 434#define address_mask(reg) \
435 ((ad_bytes == sizeof(unsigned long)) ? \
436 (reg) : ((reg) & ((1UL << (ad_bytes << 3)) - 1)))
6aa8b732 437#define register_address(base, reg) \
e70669ab 438 ((base) + address_mask(reg))
6aa8b732
AK		 439#define register_address_increment(reg, inc) \
440 do { \
441 /* signed type ensures sign extension to long */ \
442 int _inc = (inc); \
443 if ( ad_bytes == sizeof(unsigned long) ) \
444 (reg) += _inc; \
445 else \
446 (reg) = ((reg) & ~((1UL << (ad_bytes << 3)) - 1)) | \
447 (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
448 } while (0)
449
1e3c5cb0
RR		 450/*
451 * Given the 'reg' portion of a ModRM byte, and a register block, return a
452 * pointer into the block that addresses the relevant register.
453 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
454 */
455static void *decode_register(u8 modrm_reg, unsigned long *regs,
456 int highbyte_regs)
6aa8b732
AK		 457{
458 void *p;
459
460 p = &regs[modrm_reg];
461 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
462 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
463 return p;
464}
465
466static int read_descriptor(struct x86_emulate_ctxt *ctxt,
467 struct x86_emulate_ops *ops,
468 void *ptr,
469 u16 *size, unsigned long *address, int op_bytes)
470{
471 int rc;
472
473 if (op_bytes == 2)
474 op_bytes = 3;
475 *address = 0;
cebff02b
LV		 476 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
477 ctxt->vcpu);
6aa8b732
AK		 478 if (rc)
479 return rc;
cebff02b
LV		 480 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
481 ctxt->vcpu);
6aa8b732
AK		 482 return rc;
483}
484
485int
486x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
487{
038e51de
AK		 488 unsigned d;
489 u8 b, sib, twobyte = 0, rex_prefix = 0;
6aa8b732
AK		 490 u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
491 unsigned long *override_base = NULL;
492 unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
493 int rc = 0;
494 struct operand src, dst;
495 unsigned long cr2 = ctxt->cr2;
496 int mode = ctxt->mode;
497 unsigned long modrm_ea;
498 int use_modrm_ea, index_reg = 0, base_reg = 0, scale, rip_relative = 0;
02c03a32 499 int no_wb = 0;
35f3f286 500 u64 msr_data;
6aa8b732
AK		 501
502 /* Shadow copy of register state. Committed on successful emulation. */
503 unsigned long _regs[NR_VCPU_REGS];
504 unsigned long _eip = ctxt->vcpu->rip, _eflags = ctxt->eflags;
505 unsigned long modrm_val = 0;
506
507 memcpy(_regs, ctxt->vcpu->regs, sizeof _regs);
508
509 switch (mode) {
510 case X86EMUL_MODE_REAL:
511 case X86EMUL_MODE_PROT16:
512 op_bytes = ad_bytes = 2;
513 break;
514 case X86EMUL_MODE_PROT32:
515 op_bytes = ad_bytes = 4;
516 break;
05b3e0c2 517#ifdef CONFIG_X86_64
6aa8b732
AK		 518 case X86EMUL_MODE_PROT64:
519 op_bytes = 4;
520 ad_bytes = 8;
521 break;
522#endif
523 default:
524 return -1;
525 }
526
527 /* Legacy prefixes. */
528 for (i = 0; i < 8; i++) {
529 switch (b = insn_fetch(u8, 1, _eip)) {
530 case 0x66: /* operand-size override */
531 op_bytes ^= 6; /* switch between 2/4 bytes */
532 break;
533 case 0x67: /* address-size override */
534 if (mode == X86EMUL_MODE_PROT64)
535 ad_bytes ^= 12; /* switch between 4/8 bytes */
536 else
537 ad_bytes ^= 6; /* switch between 2/4 bytes */
538 break;
539 case 0x2e: /* CS override */
540 override_base = &ctxt->cs_base;
541 break;
542 case 0x3e: /* DS override */
543 override_base = &ctxt->ds_base;
544 break;
545 case 0x26: /* ES override */
546 override_base = &ctxt->es_base;
547 break;
548 case 0x64: /* FS override */
549 override_base = &ctxt->fs_base;
550 break;
551 case 0x65: /* GS override */
552 override_base = &ctxt->gs_base;
553 break;
554 case 0x36: /* SS override */
555 override_base = &ctxt->ss_base;
556 break;
557 case 0xf0: /* LOCK */
558 lock_prefix = 1;
559 break;
560 case 0xf3: /* REP/REPE/REPZ */
561 rep_prefix = 1;
562 break;
563 case 0xf2: /* REPNE/REPNZ */
564 break;
565 default:
566 goto done_prefixes;
567 }
568 }
569
570done_prefixes:
571
572 /* REX prefix. */
573 if ((mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40)) {
574 rex_prefix = b;
575 if (b & 8)
576 op_bytes = 8; /* REX.W */
577 modrm_reg = (b & 4) << 1; /* REX.R */
578 index_reg = (b & 2) << 2; /* REX.X */
579 modrm_rm = base_reg = (b & 1) << 3; /* REG.B */
580 b = insn_fetch(u8, 1, _eip);
581 }
582
583 /* Opcode byte(s). */
584 d = opcode_table[b];
585 if (d == 0) {
586 /* Two-byte opcode? */
587 if (b == 0x0f) {
588 twobyte = 1;
589 b = insn_fetch(u8, 1, _eip);
590 d = twobyte_table[b];
591 }
592
593 /* Unrecognised? */
594 if (d == 0)
595 goto cannot_emulate;
596 }
597
598 /* ModRM and SIB bytes. */
599 if (d & ModRM) {
600 modrm = insn_fetch(u8, 1, _eip);
601 modrm_mod |= (modrm & 0xc0) >> 6;
602 modrm_reg |= (modrm & 0x38) >> 3;
603 modrm_rm |= (modrm & 0x07);
604 modrm_ea = 0;
605 use_modrm_ea = 1;
606
607 if (modrm_mod == 3) {
608 modrm_val = *(unsigned long *)
609 decode_register(modrm_rm, _regs, d & ByteOp);
610 goto modrm_done;
611 }
612
613 if (ad_bytes == 2) {
614 unsigned bx = _regs[VCPU_REGS_RBX];
615 unsigned bp = _regs[VCPU_REGS_RBP];
616 unsigned si = _regs[VCPU_REGS_RSI];
617 unsigned di = _regs[VCPU_REGS_RDI];
618
619 /* 16-bit ModR/M decode. */
620 switch (modrm_mod) {
621 case 0:
622 if (modrm_rm == 6)
623 modrm_ea += insn_fetch(u16, 2, _eip);
624 break;
625 case 1:
626 modrm_ea += insn_fetch(s8, 1, _eip);
627 break;
628 case 2:
629 modrm_ea += insn_fetch(u16, 2, _eip);
630 break;
631 }
632 switch (modrm_rm) {
633 case 0:
634 modrm_ea += bx + si;
635 break;
636 case 1:
637 modrm_ea += bx + di;
638 break;
639 case 2:
640 modrm_ea += bp + si;
641 break;
642 case 3:
643 modrm_ea += bp + di;
644 break;
645 case 4:
646 modrm_ea += si;
647 break;
648 case 5:
649 modrm_ea += di;
650 break;
651 case 6:
652 if (modrm_mod != 0)
653 modrm_ea += bp;
654 break;
655 case 7:
656 modrm_ea += bx;
657 break;
658 }
659 if (modrm_rm == 2 || modrm_rm == 3 ||
660 (modrm_rm == 6 && modrm_mod != 0))
661 if (!override_base)
662 override_base = &ctxt->ss_base;
663 modrm_ea = (u16)modrm_ea;
664 } else {
665 /* 32/64-bit ModR/M decode. */
666 switch (modrm_rm) {
667 case 4:
668 case 12:
669 sib = insn_fetch(u8, 1, _eip);
670 index_reg |= (sib >> 3) & 7;
671 base_reg |= sib & 7;
672 scale = sib >> 6;
673
674 switch (base_reg) {
675 case 5:
676 if (modrm_mod != 0)
677 modrm_ea += _regs[base_reg];
678 else
679 modrm_ea += insn_fetch(s32, 4, _eip);
680 break;
681 default:
682 modrm_ea += _regs[base_reg];
683 }
684 switch (index_reg) {
685 case 4:
686 break;
687 default:
688 modrm_ea += _regs[index_reg] << scale;
689
690 }
691 break;
692 case 5:
693 if (modrm_mod != 0)
694 modrm_ea += _regs[modrm_rm];
695 else if (mode == X86EMUL_MODE_PROT64)
696 rip_relative = 1;
697 break;
698 default:
699 modrm_ea += _regs[modrm_rm];
700 break;
701 }
702 switch (modrm_mod) {
703 case 0:
704 if (modrm_rm == 5)
705 modrm_ea += insn_fetch(s32, 4, _eip);
706 break;
707 case 1:
708 modrm_ea += insn_fetch(s8, 1, _eip);
709 break;
710 case 2:
711 modrm_ea += insn_fetch(s32, 4, _eip);
712 break;
713 }
714 }
715 if (!override_base)
716 override_base = &ctxt->ds_base;
717 if (mode == X86EMUL_MODE_PROT64 &&
718 override_base != &ctxt->fs_base &&
719 override_base != &ctxt->gs_base)
720 override_base = NULL;
721
722 if (override_base)
723 modrm_ea += *override_base;
724
725 if (rip_relative) {
726 modrm_ea += _eip;
727 switch (d & SrcMask) {
728 case SrcImmByte:
729 modrm_ea += 1;
730 break;
731 case SrcImm:
732 if (d & ByteOp)
733 modrm_ea += 1;
734 else
735 if (op_bytes == 8)
736 modrm_ea += 4;
737 else
738 modrm_ea += op_bytes;
739 }
740 }
741 if (ad_bytes != 8)
742 modrm_ea = (u32)modrm_ea;
743 cr2 = modrm_ea;
744 modrm_done:
745 ;
746 }
747
6aa8b732
AK		 748 /*
749 * Decode and fetch the source operand: register, memory
750 * or immediate.
751 */
752 switch (d & SrcMask) {
753 case SrcNone:
754 break;
755 case SrcReg:
756 src.type = OP_REG;
757 if (d & ByteOp) {
758 src.ptr = decode_register(modrm_reg, _regs,
759 (rex_prefix == 0));
760 src.val = src.orig_val = *(u8 *) src.ptr;
761 src.bytes = 1;
762 } else {
763 src.ptr = decode_register(modrm_reg, _regs, 0);
764 switch ((src.bytes = op_bytes)) {
765 case 2:
766 src.val = src.orig_val = *(u16 *) src.ptr;
767 break;
768 case 4:
769 src.val = src.orig_val = *(u32 *) src.ptr;
770 break;
771 case 8:
772 src.val = src.orig_val = *(u64 *) src.ptr;
773 break;
774 }
775 }
776 break;
777 case SrcMem16:
778 src.bytes = 2;
779 goto srcmem_common;
780 case SrcMem32:
781 src.bytes = 4;
782 goto srcmem_common;
783 case SrcMem:
784 src.bytes = (d & ByteOp) ? 1 : op_bytes;
785 srcmem_common:
786 src.type = OP_MEM;
787 src.ptr = (unsigned long *)cr2;
788 if ((rc = ops->read_emulated((unsigned long)src.ptr,
cebff02b 789 &src.val, src.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 790 goto done;
791 src.orig_val = src.val;
792 break;
793 case SrcImm:
794 src.type = OP_IMM;
795 src.ptr = (unsigned long *)_eip;
796 src.bytes = (d & ByteOp) ? 1 : op_bytes;
797 if (src.bytes == 8)
798 src.bytes = 4;
799 /* NB. Immediates are sign-extended as necessary. */
800 switch (src.bytes) {
801 case 1:
802 src.val = insn_fetch(s8, 1, _eip);
803 break;
804 case 2:
805 src.val = insn_fetch(s16, 2, _eip);
806 break;
807 case 4:
808 src.val = insn_fetch(s32, 4, _eip);
809 break;
810 }
811 break;
812 case SrcImmByte:
813 src.type = OP_IMM;
814 src.ptr = (unsigned long *)_eip;
815 src.bytes = 1;
816 src.val = insn_fetch(s8, 1, _eip);
817 break;
818 }
819
038e51de
AK		 820 /* Decode and fetch the destination operand: register or memory. */
821 switch (d & DstMask) {
822 case ImplicitOps:
823 /* Special instructions do their own operand decoding. */
824 goto special_insn;
825 case DstReg:
826 dst.type = OP_REG;
827 if ((d & ByteOp)
394b6e59 828 && !(twobyte && (b == 0xb6 || b == 0xb7))) {
038e51de
AK		 829 dst.ptr = decode_register(modrm_reg, _regs,
830 (rex_prefix == 0));
831 dst.val = *(u8 *) dst.ptr;
832 dst.bytes = 1;
833 } else {
834 dst.ptr = decode_register(modrm_reg, _regs, 0);
835 switch ((dst.bytes = op_bytes)) {
836 case 2:
837 dst.val = *(u16 *)dst.ptr;
838 break;
839 case 4:
840 dst.val = *(u32 *)dst.ptr;
841 break;
842 case 8:
843 dst.val = *(u64 *)dst.ptr;
844 break;
845 }
846 }
847 break;
848 case DstMem:
849 dst.type = OP_MEM;
850 dst.ptr = (unsigned long *)cr2;
851 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
852 if (d & BitOp) {
df513e2c
AK		 853 unsigned long mask = ~(dst.bytes * 8 - 1);
854
855 dst.ptr = (void *)dst.ptr + (src.val & mask) / 8;
038e51de
AK		 856 }
857 if (!(d & Mov) && /* optimisation - avoid slow emulated read */
858 ((rc = ops->read_emulated((unsigned long)dst.ptr,
cebff02b 859 &dst.val, dst.bytes, ctxt->vcpu)) != 0))
038e51de
AK		 860 goto done;
861 break;
862 }
863 dst.orig_val = dst.val;
864
6aa8b732
AK		 865 if (twobyte)
866 goto twobyte_insn;
867
868 switch (b) {
869 case 0x00 ... 0x05:
870 add: /* add */
871 emulate_2op_SrcV("add", src, dst, _eflags);
872 break;
873 case 0x08 ... 0x0d:
874 or: /* or */
875 emulate_2op_SrcV("or", src, dst, _eflags);
876 break;
877 case 0x10 ... 0x15:
878 adc: /* adc */
879 emulate_2op_SrcV("adc", src, dst, _eflags);
880 break;
881 case 0x18 ... 0x1d:
882 sbb: /* sbb */
883 emulate_2op_SrcV("sbb", src, dst, _eflags);
884 break;
885 case 0x20 ... 0x25:
886 and: /* and */
887 emulate_2op_SrcV("and", src, dst, _eflags);
888 break;
889 case 0x28 ... 0x2d:
890 sub: /* sub */
891 emulate_2op_SrcV("sub", src, dst, _eflags);
892 break;
893 case 0x30 ... 0x35:
894 xor: /* xor */
895 emulate_2op_SrcV("xor", src, dst, _eflags);
896 break;
897 case 0x38 ... 0x3d:
898 cmp: /* cmp */
899 emulate_2op_SrcV("cmp", src, dst, _eflags);
900 break;
901 case 0x63: /* movsxd */
902 if (mode != X86EMUL_MODE_PROT64)
903 goto cannot_emulate;
904 dst.val = (s32) src.val;
905 break;
906 case 0x80 ... 0x83: /* Grp1 */
907 switch (modrm_reg) {
908 case 0:
909 goto add;
910 case 1:
911 goto or;
912 case 2:
913 goto adc;
914 case 3:
915 goto sbb;
916 case 4:
917 goto and;
918 case 5:
919 goto sub;
920 case 6:
921 goto xor;
922 case 7:
923 goto cmp;
924 }
925 break;
926 case 0x84 ... 0x85:
927 test: /* test */
928 emulate_2op_SrcV("test", src, dst, _eflags);
929 break;
930 case 0x86 ... 0x87: /* xchg */
931 /* Write back the register source. */
932 switch (dst.bytes) {
933 case 1:
934 *(u8 *) src.ptr = (u8) dst.val;
935 break;
936 case 2:
937 *(u16 *) src.ptr = (u16) dst.val;
938 break;
939 case 4:
940 *src.ptr = (u32) dst.val;
941 break; /* 64b reg: zero-extend */
942 case 8:
943 *src.ptr = dst.val;
944 break;
945 }
946 /*
947 * Write back the memory destination with implicit LOCK
948 * prefix.
949 */
950 dst.val = src.val;
951 lock_prefix = 1;
952 break;
953 case 0xa0 ... 0xa1: /* mov */
954 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
955 dst.val = src.val;
956 _eip += ad_bytes; /* skip src displacement */
957 break;
958 case 0xa2 ... 0xa3: /* mov */
959 dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
960 _eip += ad_bytes; /* skip dst displacement */
961 break;
962 case 0x88 ... 0x8b: /* mov */
963 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
964 dst.val = src.val;
965 break;
966 case 0x8f: /* pop (sole member of Grp1a) */
967 /* 64-bit mode: POP always pops a 64-bit operand. */
968 if (mode == X86EMUL_MODE_PROT64)
969 dst.bytes = 8;
970 if ((rc = ops->read_std(register_address(ctxt->ss_base,
971 _regs[VCPU_REGS_RSP]),
cebff02b 972 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 973 goto done;
974 register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
975 break;
976 case 0xc0 ... 0xc1:
977 grp2: /* Grp2 */
978 switch (modrm_reg) {
979 case 0: /* rol */
980 emulate_2op_SrcB("rol", src, dst, _eflags);
981 break;
982 case 1: /* ror */
983 emulate_2op_SrcB("ror", src, dst, _eflags);
984 break;
985 case 2: /* rcl */
986 emulate_2op_SrcB("rcl", src, dst, _eflags);
987 break;
988 case 3: /* rcr */
989 emulate_2op_SrcB("rcr", src, dst, _eflags);
990 break;
991 case 4: /* sal/shl */
992 case 6: /* sal/shl */
993 emulate_2op_SrcB("sal", src, dst, _eflags);
994 break;
995 case 5: /* shr */
996 emulate_2op_SrcB("shr", src, dst, _eflags);
997 break;
998 case 7: /* sar */
999 emulate_2op_SrcB("sar", src, dst, _eflags);
1000 break;
1001 }
1002 break;
1003 case 0xd0 ... 0xd1: /* Grp2 */
1004 src.val = 1;
1005 goto grp2;
1006 case 0xd2 ... 0xd3: /* Grp2 */
1007 src.val = _regs[VCPU_REGS_RCX];
1008 goto grp2;
1009 case 0xf6 ... 0xf7: /* Grp3 */
1010 switch (modrm_reg) {
1011 case 0 ... 1: /* test */
1012 /*
1013 * Special case in Grp3: test has an immediate
1014 * source operand.
1015 */
1016 src.type = OP_IMM;
1017 src.ptr = (unsigned long *)_eip;
1018 src.bytes = (d & ByteOp) ? 1 : op_bytes;
1019 if (src.bytes == 8)
1020 src.bytes = 4;
1021 switch (src.bytes) {
1022 case 1:
1023 src.val = insn_fetch(s8, 1, _eip);
1024 break;
1025 case 2:
1026 src.val = insn_fetch(s16, 2, _eip);
1027 break;
1028 case 4:
1029 src.val = insn_fetch(s32, 4, _eip);
1030 break;
1031 }
1032 goto test;
1033 case 2: /* not */
1034 dst.val = ~dst.val;
1035 break;
1036 case 3: /* neg */
1037 emulate_1op("neg", dst, _eflags);
1038 break;
1039 default:
1040 goto cannot_emulate;
1041 }
1042 break;
1043 case 0xfe ... 0xff: /* Grp4/Grp5 */
1044 switch (modrm_reg) {
1045 case 0: /* inc */
1046 emulate_1op("inc", dst, _eflags);
1047 break;
1048 case 1: /* dec */
1049 emulate_1op("dec", dst, _eflags);
1050 break;
1051 case 6: /* push */
1052 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1053 if (mode == X86EMUL_MODE_PROT64) {
1054 dst.bytes = 8;
1055 if ((rc = ops->read_std((unsigned long)dst.ptr,
1056 &dst.val, 8,
cebff02b 1057 ctxt->vcpu)) != 0)
6aa8b732
AK		 1058 goto done;
1059 }
1060 register_address_increment(_regs[VCPU_REGS_RSP],
1061 -dst.bytes);
1062 if ((rc = ops->write_std(
1063 register_address(ctxt->ss_base,
1064 _regs[VCPU_REGS_RSP]),
cebff02b 1065 &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732 1066 goto done;
02c03a32 1067 no_wb = 1;
6aa8b732
AK		 1068 break;
1069 default:
1070 goto cannot_emulate;
1071 }
1072 break;
1073 }
1074
1075writeback:
02c03a32 1076 if (!no_wb) {
6aa8b732
AK		 1077 switch (dst.type) {
1078 case OP_REG:
1079 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1080 switch (dst.bytes) {
1081 case 1:
1082 *(u8 *)dst.ptr = (u8)dst.val;
1083 break;
1084 case 2:
1085 *(u16 *)dst.ptr = (u16)dst.val;
1086 break;
1087 case 4:
1088 *dst.ptr = (u32)dst.val;
1089 break; /* 64b: zero-ext */
1090 case 8:
1091 *dst.ptr = dst.val;
1092 break;
1093 }
1094 break;
1095 case OP_MEM:
1096 if (lock_prefix)
1097 rc = ops->cmpxchg_emulated((unsigned long)dst.
4c690a1e
AK		 1098 ptr, &dst.orig_val,
1099 &dst.val, dst.bytes,
cebff02b 1100 ctxt->vcpu);
6aa8b732
AK		 1101 else
1102 rc = ops->write_emulated((unsigned long)dst.ptr,
4c690a1e 1103 &dst.val, dst.bytes,
cebff02b 1104 ctxt->vcpu);
6aa8b732
AK		 1105 if (rc != 0)
1106 goto done;
1107 default:
1108 break;
1109 }
1110 }
1111
1112 /* Commit shadow register state. */
1113 memcpy(ctxt->vcpu->regs, _regs, sizeof _regs);
1114 ctxt->eflags = _eflags;
1115 ctxt->vcpu->rip = _eip;
1116
1117done:
1118 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1119
1120special_insn:
1121 if (twobyte)
1122 goto twobyte_special_insn;
e70669ab
LV		 1123 switch(b) {
1124 case 0x6c: /* insb */
1125 case 0x6d: /* insw/insd */
1126 if (kvm_setup_pio(ctxt->vcpu, NULL,
1127 1, /* in */
1128 (d & ByteOp) ? 1 : op_bytes, /* size */
1129 rep_prefix ?
1130 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
1131 1, /* strings */
1132 (_eflags & EFLG_DF), /* down */
1133 register_address(ctxt->es_base,
1134 _regs[VCPU_REGS_RDI]), /* address */
1135 rep_prefix,
1136 _regs[VCPU_REGS_RDX] /* port */
1137 ) == 0)
1138 return -1;
1139 return 0;
1140 case 0x6e: /* outsb */
1141 case 0x6f: /* outsw/outsd */
1142 if (kvm_setup_pio(ctxt->vcpu, NULL,
1143 0, /* in */
1144 (d & ByteOp) ? 1 : op_bytes, /* size */
1145 rep_prefix ?
1146 address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
1147 1, /* strings */
1148 (_eflags & EFLG_DF), /* down */
1149 register_address(override_base ?
1150 *override_base : ctxt->ds_base,
1151 _regs[VCPU_REGS_RSI]), /* address */
1152 rep_prefix,
1153 _regs[VCPU_REGS_RDX] /* port */
1154 ) == 0)
1155 return -1;
1156 return 0;
1157 }
6aa8b732
AK		 1158 if (rep_prefix) {
1159 if (_regs[VCPU_REGS_RCX] == 0) {
1160 ctxt->vcpu->rip = _eip;
1161 goto done;
1162 }
1163 _regs[VCPU_REGS_RCX]--;
1164 _eip = ctxt->vcpu->rip;
1165 }
1166 switch (b) {
1167 case 0xa4 ... 0xa5: /* movs */
1168 dst.type = OP_MEM;
1169 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1170 dst.ptr = (unsigned long *)register_address(ctxt->es_base,
1171 _regs[VCPU_REGS_RDI]);
1172 if ((rc = ops->read_emulated(register_address(
1173 override_base ? *override_base : ctxt->ds_base,
cebff02b 1174 _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt->vcpu)) != 0)
6aa8b732
AK		 1175 goto done;
1176 register_address_increment(_regs[VCPU_REGS_RSI],
1177 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1178 register_address_increment(_regs[VCPU_REGS_RDI],
1179 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1180 break;
1181 case 0xa6 ... 0xa7: /* cmps */
1182 DPRINTF("Urk! I don't handle CMPS.\n");
1183 goto cannot_emulate;
1184 case 0xaa ... 0xab: /* stos */
1185 dst.type = OP_MEM;
1186 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1187 dst.ptr = (unsigned long *)cr2;
1188 dst.val = _regs[VCPU_REGS_RAX];
1189 register_address_increment(_regs[VCPU_REGS_RDI],
1190 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1191 break;
1192 case 0xac ... 0xad: /* lods */
1193 dst.type = OP_REG;
1194 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1195 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
cebff02b
LV		 1196 if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes,
1197 ctxt->vcpu)) != 0)
6aa8b732
AK		 1198 goto done;
1199 register_address_increment(_regs[VCPU_REGS_RSI],
1200 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1201 break;
1202 case 0xae ... 0xaf: /* scas */
1203 DPRINTF("Urk! I don't handle SCAS.\n");
1204 goto cannot_emulate;
72d6e5a0
AK		 1205 case 0xf4: /* hlt */
1206 ctxt->vcpu->halt_request = 1;
1207 goto done;
d9413cd7
NK		 1208 case 0xc3: /* ret */
1209 dst.ptr = &_eip;
1210 goto pop_instruction;
7f0aaee0
NK		 1211 case 0x58 ... 0x5f: /* pop reg */
1212 dst.ptr = (unsigned long *)&_regs[b & 0x7];
1213
d9413cd7 1214pop_instruction:
7f0aaee0 1215 if ((rc = ops->read_std(register_address(ctxt->ss_base,
cebff02b
LV		 1216 _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt->vcpu))
1217 != 0)
7f0aaee0
NK		 1218 goto done;
1219
d9413cd7 1220 register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
02c03a32 1221 no_wb = 1; /* Disable writeback. */
7f0aaee0 1222 break;
6aa8b732
AK		 1223 }
1224 goto writeback;
1225
1226twobyte_insn:
1227 switch (b) {
1228 case 0x01: /* lgdt, lidt, lmsw */
d37c8557
AJ		 1229 /* Disable writeback. */
1230 no_wb = 1;
6aa8b732
AK		 1231 switch (modrm_reg) {
1232 u16 size;
1233 unsigned long address;
1234
1235 case 2: /* lgdt */
1236 rc = read_descriptor(ctxt, ops, src.ptr,
1237 &size, &address, op_bytes);
1238 if (rc)
1239 goto done;
1240 realmode_lgdt(ctxt->vcpu, size, address);
1241 break;
1242 case 3: /* lidt */
1243 rc = read_descriptor(ctxt, ops, src.ptr,
1244 &size, &address, op_bytes);
1245 if (rc)
1246 goto done;
1247 realmode_lidt(ctxt->vcpu, size, address);
1248 break;
1249 case 4: /* smsw */
1250 if (modrm_mod != 3)
1251 goto cannot_emulate;
1252 *(u16 *)&_regs[modrm_rm]
1253 = realmode_get_cr(ctxt->vcpu, 0);
1254 break;
1255 case 6: /* lmsw */
1256 if (modrm_mod != 3)
1257 goto cannot_emulate;
1258 realmode_lmsw(ctxt->vcpu, (u16)modrm_val, &_eflags);
1259 break;
1260 case 7: /* invlpg*/
1261 emulate_invlpg(ctxt->vcpu, cr2);
1262 break;
1263 default:
1264 goto cannot_emulate;
1265 }
1266 break;
1267 case 0x21: /* mov from dr to reg */
bac27d35 1268 no_wb = 1;
6aa8b732
AK		 1269 if (modrm_mod != 3)
1270 goto cannot_emulate;
1271 rc = emulator_get_dr(ctxt, modrm_reg, &_regs[modrm_rm]);
1272 break;
1273 case 0x23: /* mov from reg to dr */
bac27d35 1274 no_wb = 1;
6aa8b732
AK		 1275 if (modrm_mod != 3)
1276 goto cannot_emulate;
1277 rc = emulator_set_dr(ctxt, modrm_reg, _regs[modrm_rm]);
1278 break;
1279 case 0x40 ... 0x4f: /* cmov */
1280 dst.val = dst.orig_val = src.val;
e3243452 1281 no_wb = 1;
6aa8b732
AK		 1282 /*
1283 * First, assume we're decoding an even cmov opcode
1284 * (lsb == 0).
1285 */
1286 switch ((b & 15) >> 1) {
1287 case 0: /* cmovo */
e3243452 1288 no_wb = (_eflags & EFLG_OF) ? 0 : 1;
6aa8b732
AK		 1289 break;
1290 case 1: /* cmovb/cmovc/cmovnae */
e3243452 1291 no_wb = (_eflags & EFLG_CF) ? 0 : 1;
6aa8b732
AK		 1292 break;
1293 case 2: /* cmovz/cmove */
e3243452 1294 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
6aa8b732
AK		 1295 break;
1296 case 3: /* cmovbe/cmovna */
e3243452 1297 no_wb = (_eflags & (EFLG_CF | EFLG_ZF)) ? 0 : 1;
6aa8b732
AK		 1298 break;
1299 case 4: /* cmovs */
e3243452 1300 no_wb = (_eflags & EFLG_SF) ? 0 : 1;
6aa8b732
AK		 1301 break;
1302 case 5: /* cmovp/cmovpe */
e3243452 1303 no_wb = (_eflags & EFLG_PF) ? 0 : 1;
6aa8b732
AK		 1304 break;
1305 case 7: /* cmovle/cmovng */
e3243452 1306 no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
6aa8b732
AK		 1307 /* fall through */
1308 case 6: /* cmovl/cmovnge */
e3243452
AK		 1309 no_wb &= (!(_eflags & EFLG_SF) !=
1310 !(_eflags & EFLG_OF)) ? 0 : 1;
6aa8b732
AK		 1311 break;
1312 }
1313 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
e3243452 1314 no_wb ^= b & 1;
6aa8b732
AK		 1315 break;
1316 case 0xb0 ... 0xb1: /* cmpxchg */
1317 /*
1318 * Save real source value, then compare EAX against
1319 * destination.
1320 */
1321 src.orig_val = src.val;
1322 src.val = _regs[VCPU_REGS_RAX];
1323 emulate_2op_SrcV("cmp", src, dst, _eflags);
6aa8b732
AK		 1324 if (_eflags & EFLG_ZF) {
1325 /* Success: write back to memory. */
1326 dst.val = src.orig_val;
1327 } else {
1328 /* Failure: write the value we saw to EAX. */
1329 dst.type = OP_REG;
1330 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1331 }
1332 break;
1333 case 0xa3:
1334 bt: /* bt */
1335 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1336 emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
1337 break;
1338 case 0xb3:
1339 btr: /* btr */
1340 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1341 emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
1342 break;
1343 case 0xab:
1344 bts: /* bts */
1345 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1346 emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
1347 break;
1348 case 0xb6 ... 0xb7: /* movzx */
1349 dst.bytes = op_bytes;
1350 dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
1351 break;
1352 case 0xbb:
1353 btc: /* btc */
1354 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1355 emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
1356 break;
1357 case 0xba: /* Grp8 */
1358 switch (modrm_reg & 3) {
1359 case 0:
1360 goto bt;
1361 case 1:
1362 goto bts;
1363 case 2:
1364 goto btr;
1365 case 3:
1366 goto btc;
1367 }
1368 break;
1369 case 0xbe ... 0xbf: /* movsx */
1370 dst.bytes = op_bytes;
1371 dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
1372 break;
1373 }
1374 goto writeback;
1375
1376twobyte_special_insn:
1377 /* Disable writeback. */
02c03a32 1378 no_wb = 1;
6aa8b732 1379 switch (b) {
687fdbfe
AK		 1380 case 0x09: /* wbinvd */
1381 break;
6aa8b732
AK		 1382 case 0x0d: /* GrpP (prefetch) */
1383 case 0x18: /* Grp16 (prefetch/nop) */
1384 break;
1385 case 0x06:
1386 emulate_clts(ctxt->vcpu);
1387 break;
1388 case 0x20: /* mov cr, reg */
1389 if (modrm_mod != 3)
1390 goto cannot_emulate;
1391 _regs[modrm_rm] = realmode_get_cr(ctxt->vcpu, modrm_reg);
1392 break;
1393 case 0x22: /* mov reg, cr */
1394 if (modrm_mod != 3)
1395 goto cannot_emulate;
1396 realmode_set_cr(ctxt->vcpu, modrm_reg, modrm_val, &_eflags);
1397 break;
35f3f286
AK		 1398 case 0x30:
1399 /* wrmsr */
1400 msr_data = (u32)_regs[VCPU_REGS_RAX]
1401 | ((u64)_regs[VCPU_REGS_RDX] << 32);
1402 rc = kvm_set_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], msr_data);
1403 if (rc) {
1404 kvm_arch_ops->inject_gp(ctxt->vcpu, 0);
1405 _eip = ctxt->vcpu->rip;
1406 }
1407 rc = X86EMUL_CONTINUE;
1408 break;
1409 case 0x32:
1410 /* rdmsr */
1411 rc = kvm_get_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], &msr_data);
1412 if (rc) {
1413 kvm_arch_ops->inject_gp(ctxt->vcpu, 0);
1414 _eip = ctxt->vcpu->rip;
1415 } else {
1416 _regs[VCPU_REGS_RAX] = (u32)msr_data;
1417 _regs[VCPU_REGS_RDX] = msr_data >> 32;
1418 }
1419 rc = X86EMUL_CONTINUE;
1420 break;
6aa8b732 1421 case 0xc7: /* Grp9 (cmpxchg8b) */
6aa8b732 1422 {
4c690a1e 1423 u64 old, new;
cebff02b
LV		 1424 if ((rc = ops->read_emulated(cr2, &old, 8, ctxt->vcpu))
1425 != 0)
6aa8b732
AK		 1426 goto done;
1427 if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
1428 ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
1429 _regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1430 _regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1431 _eflags &= ~EFLG_ZF;
1432 } else {
4c690a1e
AK		 1433 new = ((u64)_regs[VCPU_REGS_RCX] << 32)
1434 | (u32) _regs[VCPU_REGS_RBX];
1435 if ((rc = ops->cmpxchg_emulated(cr2, &old,
cebff02b 1436 &new, 8, ctxt->vcpu)) != 0)
6aa8b732
AK		 1437 goto done;
1438 _eflags |= EFLG_ZF;
1439 }
1440 break;
1441 }
6aa8b732
AK		 1442 }
1443 goto writeback;
1444
1445cannot_emulate:
1446 DPRINTF("Cannot emulate %02x\n", b);
1447 return -1;
1448}
1449
1450#ifdef __XEN__
1451
1452#include <asm/mm.h>
1453#include <asm/uaccess.h>
1454
1455int
1456x86_emulate_read_std(unsigned long addr,
1457 unsigned long *val,
1458 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1459{
1460 unsigned int rc;
1461
1462 *val = 0;
1463
1464 if ((rc = copy_from_user((void *)val, (void *)addr, bytes)) != 0) {
1465 propagate_page_fault(addr + bytes - rc, 0); /* read fault */
1466 return X86EMUL_PROPAGATE_FAULT;
1467 }
1468
1469 return X86EMUL_CONTINUE;
1470}
1471
1472int
1473x86_emulate_write_std(unsigned long addr,
1474 unsigned long val,
1475 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1476{
1477 unsigned int rc;
1478
1479 if ((rc = copy_to_user((void *)addr, (void *)&val, bytes)) != 0) {
1480 propagate_page_fault(addr + bytes - rc, PGERR_write_access);
1481 return X86EMUL_PROPAGATE_FAULT;
1482 }
1483
1484 return X86EMUL_CONTINUE;
1485}
1486
1487#endif
Ubuntu Artful kernel mirror