x86_emulate.c 37 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415
  1. /******************************************************************************
  2. * x86_emulate.c
  3. *
  4. * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
  5. *
  6. * Copyright (c) 2005 Keir Fraser
  7. *
  8. * Linux coding style, mod r/m decoder, segment base fixes, real-mode
  9. * privieged instructions:
  10. *
  11. * Copyright (C) 2006 Qumranet
  12. *
  13. * Avi Kivity <avi@qumranet.com>
  14. * Yaniv Kamay <yaniv@qumranet.com>
  15. *
  16. * This work is licensed under the terms of the GNU GPL, version 2. See
  17. * the COPYING file in the top-level directory.
  18. *
  19. * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
  20. */
  21. #ifndef __KERNEL__
  22. #include <stdio.h>
  23. #include <stdint.h>
  24. #include <public/xen.h>
  25. #define DPRINTF(_f, _a ...) printf( _f , ## _a )
  26. #else
  27. #include "kvm.h"
  28. #define DPRINTF(x...) do {} while (0)
  29. #endif
  30. #include "x86_emulate.h"
  31. #include <linux/module.h>
  32. /*
  33. * Opcode effective-address decode tables.
  34. * Note that we only emulate instructions that have at least one memory
  35. * operand (excluding implicit stack references). We assume that stack
  36. * references and instruction fetches will never occur in special memory
  37. * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
  38. * not be handled.
  39. */
  40. /* Operand sizes: 8-bit operands or specified/overridden size. */
  41. #define ByteOp (1<<0) /* 8-bit operands. */
  42. /* Destination operand type. */
  43. #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
  44. #define DstReg (2<<1) /* Register operand. */
  45. #define DstMem (3<<1) /* Memory operand. */
  46. #define DstMask (3<<1)
  47. /* Source operand type. */
  48. #define SrcNone (0<<3) /* No source operand. */
  49. #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
  50. #define SrcReg (1<<3) /* Register operand. */
  51. #define SrcMem (2<<3) /* Memory operand. */
  52. #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
  53. #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
  54. #define SrcImm (5<<3) /* Immediate operand. */
  55. #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
  56. #define SrcMask (7<<3)
  57. /* Generic ModRM decode. */
  58. #define ModRM (1<<6)
  59. /* Destination is only written; never read. */
  60. #define Mov (1<<7)
  61. #define BitOp (1<<8)
  62. static u8 opcode_table[256] = {
  63. /* 0x00 - 0x07 */
  64. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  65. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  66. 0, 0, 0, 0,
  67. /* 0x08 - 0x0F */
  68. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  69. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  70. 0, 0, 0, 0,
  71. /* 0x10 - 0x17 */
  72. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  73. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  74. 0, 0, 0, 0,
  75. /* 0x18 - 0x1F */
  76. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  77. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  78. 0, 0, 0, 0,
  79. /* 0x20 - 0x27 */
  80. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  81. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  82. 0, 0, 0, 0,
  83. /* 0x28 - 0x2F */
  84. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  85. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  86. 0, 0, 0, 0,
  87. /* 0x30 - 0x37 */
  88. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  89. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  90. 0, 0, 0, 0,
  91. /* 0x38 - 0x3F */
  92. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  93. ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
  94. 0, 0, 0, 0,
  95. /* 0x40 - 0x4F */
  96. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  97. /* 0x50 - 0x5F */
  98. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  99. /* 0x60 - 0x6F */
  100. 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
  101. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  102. /* 0x70 - 0x7F */
  103. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  104. /* 0x80 - 0x87 */
  105. ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
  106. ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
  107. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  108. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
  109. /* 0x88 - 0x8F */
  110. ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
  111. ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  112. 0, 0, 0, DstMem | SrcNone | ModRM | Mov,
  113. /* 0x90 - 0x9F */
  114. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  115. /* 0xA0 - 0xA7 */
  116. ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
  117. ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
  118. ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
  119. ByteOp | ImplicitOps, ImplicitOps,
  120. /* 0xA8 - 0xAF */
  121. 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
  122. ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
  123. ByteOp | ImplicitOps, ImplicitOps,
  124. /* 0xB0 - 0xBF */
  125. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  126. /* 0xC0 - 0xC7 */
  127. ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM, 0, 0,
  128. 0, 0, ByteOp | DstMem | SrcImm | ModRM | Mov,
  129. DstMem | SrcImm | ModRM | Mov,
  130. /* 0xC8 - 0xCF */
  131. 0, 0, 0, 0, 0, 0, 0, 0,
  132. /* 0xD0 - 0xD7 */
  133. ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
  134. ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
  135. 0, 0, 0, 0,
  136. /* 0xD8 - 0xDF */
  137. 0, 0, 0, 0, 0, 0, 0, 0,
  138. /* 0xE0 - 0xEF */
  139. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  140. /* 0xF0 - 0xF7 */
  141. 0, 0, 0, 0,
  142. 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
  143. /* 0xF8 - 0xFF */
  144. 0, 0, 0, 0,
  145. 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
  146. };
  147. static u16 twobyte_table[256] = {
  148. /* 0x00 - 0x0F */
  149. 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
  150. 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
  151. /* 0x10 - 0x1F */
  152. 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
  153. /* 0x20 - 0x2F */
  154. ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
  155. 0, 0, 0, 0, 0, 0, 0, 0,
  156. /* 0x30 - 0x3F */
  157. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  158. /* 0x40 - 0x47 */
  159. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  160. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  161. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  162. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  163. /* 0x48 - 0x4F */
  164. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  165. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  166. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  167. DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
  168. /* 0x50 - 0x5F */
  169. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  170. /* 0x60 - 0x6F */
  171. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  172. /* 0x70 - 0x7F */
  173. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  174. /* 0x80 - 0x8F */
  175. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  176. /* 0x90 - 0x9F */
  177. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  178. /* 0xA0 - 0xA7 */
  179. 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
  180. /* 0xA8 - 0xAF */
  181. 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
  182. /* 0xB0 - 0xB7 */
  183. ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
  184. DstMem | SrcReg | ModRM | BitOp,
  185. 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
  186. DstReg | SrcMem16 | ModRM | Mov,
  187. /* 0xB8 - 0xBF */
  188. 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
  189. 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
  190. DstReg | SrcMem16 | ModRM | Mov,
  191. /* 0xC0 - 0xCF */
  192. 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
  193. /* 0xD0 - 0xDF */
  194. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  195. /* 0xE0 - 0xEF */
  196. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  197. /* 0xF0 - 0xFF */
  198. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
  199. };
  200. /*
  201. * Tell the emulator that of the Group 7 instructions (sgdt, lidt, etc.) we
  202. * are interested only in invlpg and not in any of the rest.
  203. *
  204. * invlpg is a special instruction in that the data it references may not
  205. * be mapped.
  206. */
  207. void kvm_emulator_want_group7_invlpg(void)
  208. {
  209. twobyte_table[1] &= ~SrcMem;
  210. }
  211. EXPORT_SYMBOL_GPL(kvm_emulator_want_group7_invlpg);
  212. /* Type, address-of, and value of an instruction's operand. */
  213. struct operand {
  214. enum { OP_REG, OP_MEM, OP_IMM } type;
  215. unsigned int bytes;
  216. unsigned long val, orig_val, *ptr;
  217. };
  218. /* EFLAGS bit definitions. */
  219. #define EFLG_OF (1<<11)
  220. #define EFLG_DF (1<<10)
  221. #define EFLG_SF (1<<7)
  222. #define EFLG_ZF (1<<6)
  223. #define EFLG_AF (1<<4)
  224. #define EFLG_PF (1<<2)
  225. #define EFLG_CF (1<<0)
  226. /*
  227. * Instruction emulation:
  228. * Most instructions are emulated directly via a fragment of inline assembly
  229. * code. This allows us to save/restore EFLAGS and thus very easily pick up
  230. * any modified flags.
  231. */
  232. #if defined(CONFIG_X86_64)
  233. #define _LO32 "k" /* force 32-bit operand */
  234. #define _STK "%%rsp" /* stack pointer */
  235. #elif defined(__i386__)
  236. #define _LO32 "" /* force 32-bit operand */
  237. #define _STK "%%esp" /* stack pointer */
  238. #endif
  239. /*
  240. * These EFLAGS bits are restored from saved value during emulation, and
  241. * any changes are written back to the saved value after emulation.
  242. */
  243. #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
  244. /* Before executing instruction: restore necessary bits in EFLAGS. */
  245. #define _PRE_EFLAGS(_sav, _msk, _tmp) \
  246. /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
  247. "push %"_sav"; " \
  248. "movl %"_msk",%"_LO32 _tmp"; " \
  249. "andl %"_LO32 _tmp",("_STK"); " \
  250. "pushf; " \
  251. "notl %"_LO32 _tmp"; " \
  252. "andl %"_LO32 _tmp",("_STK"); " \
  253. "pop %"_tmp"; " \
  254. "orl %"_LO32 _tmp",("_STK"); " \
  255. "popf; " \
  256. /* _sav &= ~msk; */ \
  257. "movl %"_msk",%"_LO32 _tmp"; " \
  258. "notl %"_LO32 _tmp"; " \
  259. "andl %"_LO32 _tmp",%"_sav"; "
  260. /* After executing instruction: write-back necessary bits in EFLAGS. */
  261. #define _POST_EFLAGS(_sav, _msk, _tmp) \
  262. /* _sav |= EFLAGS & _msk; */ \
  263. "pushf; " \
  264. "pop %"_tmp"; " \
  265. "andl %"_msk",%"_LO32 _tmp"; " \
  266. "orl %"_LO32 _tmp",%"_sav"; "
  267. /* Raw emulation: instruction has two explicit operands. */
  268. #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
  269. do { \
  270. unsigned long _tmp; \
  271. \
  272. switch ((_dst).bytes) { \
  273. case 2: \
  274. __asm__ __volatile__ ( \
  275. _PRE_EFLAGS("0","4","2") \
  276. _op"w %"_wx"3,%1; " \
  277. _POST_EFLAGS("0","4","2") \
  278. : "=m" (_eflags), "=m" ((_dst).val), \
  279. "=&r" (_tmp) \
  280. : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
  281. break; \
  282. case 4: \
  283. __asm__ __volatile__ ( \
  284. _PRE_EFLAGS("0","4","2") \
  285. _op"l %"_lx"3,%1; " \
  286. _POST_EFLAGS("0","4","2") \
  287. : "=m" (_eflags), "=m" ((_dst).val), \
  288. "=&r" (_tmp) \
  289. : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
  290. break; \
  291. case 8: \
  292. __emulate_2op_8byte(_op, _src, _dst, \
  293. _eflags, _qx, _qy); \
  294. break; \
  295. } \
  296. } while (0)
  297. #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
  298. do { \
  299. unsigned long _tmp; \
  300. switch ( (_dst).bytes ) \
  301. { \
  302. case 1: \
  303. __asm__ __volatile__ ( \
  304. _PRE_EFLAGS("0","4","2") \
  305. _op"b %"_bx"3,%1; " \
  306. _POST_EFLAGS("0","4","2") \
  307. : "=m" (_eflags), "=m" ((_dst).val), \
  308. "=&r" (_tmp) \
  309. : _by ((_src).val), "i" (EFLAGS_MASK) ); \
  310. break; \
  311. default: \
  312. __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
  313. _wx, _wy, _lx, _ly, _qx, _qy); \
  314. break; \
  315. } \
  316. } while (0)
  317. /* Source operand is byte-sized and may be restricted to just %cl. */
  318. #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
  319. __emulate_2op(_op, _src, _dst, _eflags, \
  320. "b", "c", "b", "c", "b", "c", "b", "c")
  321. /* Source operand is byte, word, long or quad sized. */
  322. #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
  323. __emulate_2op(_op, _src, _dst, _eflags, \
  324. "b", "q", "w", "r", _LO32, "r", "", "r")
  325. /* Source operand is word, long or quad sized. */
  326. #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
  327. __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
  328. "w", "r", _LO32, "r", "", "r")
  329. /* Instruction has only one explicit operand (no source operand). */
  330. #define emulate_1op(_op, _dst, _eflags) \
  331. do { \
  332. unsigned long _tmp; \
  333. \
  334. switch ( (_dst).bytes ) \
  335. { \
  336. case 1: \
  337. __asm__ __volatile__ ( \
  338. _PRE_EFLAGS("0","3","2") \
  339. _op"b %1; " \
  340. _POST_EFLAGS("0","3","2") \
  341. : "=m" (_eflags), "=m" ((_dst).val), \
  342. "=&r" (_tmp) \
  343. : "i" (EFLAGS_MASK) ); \
  344. break; \
  345. case 2: \
  346. __asm__ __volatile__ ( \
  347. _PRE_EFLAGS("0","3","2") \
  348. _op"w %1; " \
  349. _POST_EFLAGS("0","3","2") \
  350. : "=m" (_eflags), "=m" ((_dst).val), \
  351. "=&r" (_tmp) \
  352. : "i" (EFLAGS_MASK) ); \
  353. break; \
  354. case 4: \
  355. __asm__ __volatile__ ( \
  356. _PRE_EFLAGS("0","3","2") \
  357. _op"l %1; " \
  358. _POST_EFLAGS("0","3","2") \
  359. : "=m" (_eflags), "=m" ((_dst).val), \
  360. "=&r" (_tmp) \
  361. : "i" (EFLAGS_MASK) ); \
  362. break; \
  363. case 8: \
  364. __emulate_1op_8byte(_op, _dst, _eflags); \
  365. break; \
  366. } \
  367. } while (0)
  368. /* Emulate an instruction with quadword operands (x86/64 only). */
  369. #if defined(CONFIG_X86_64)
  370. #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
  371. do { \
  372. __asm__ __volatile__ ( \
  373. _PRE_EFLAGS("0","4","2") \
  374. _op"q %"_qx"3,%1; " \
  375. _POST_EFLAGS("0","4","2") \
  376. : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
  377. : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
  378. } while (0)
  379. #define __emulate_1op_8byte(_op, _dst, _eflags) \
  380. do { \
  381. __asm__ __volatile__ ( \
  382. _PRE_EFLAGS("0","3","2") \
  383. _op"q %1; " \
  384. _POST_EFLAGS("0","3","2") \
  385. : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
  386. : "i" (EFLAGS_MASK) ); \
  387. } while (0)
  388. #elif defined(__i386__)
  389. #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
  390. #define __emulate_1op_8byte(_op, _dst, _eflags)
  391. #endif /* __i386__ */
  392. /* Fetch next part of the instruction being emulated. */
  393. #define insn_fetch(_type, _size, _eip) \
  394. ({ unsigned long _x; \
  395. rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
  396. (_size), ctxt); \
  397. if ( rc != 0 ) \
  398. goto done; \
  399. (_eip) += (_size); \
  400. (_type)_x; \
  401. })
  402. /* Access/update address held in a register, based on addressing mode. */
  403. #define register_address(base, reg) \
  404. ((base) + ((ad_bytes == sizeof(unsigned long)) ? (reg) : \
  405. ((reg) & ((1UL << (ad_bytes << 3)) - 1))))
  406. #define register_address_increment(reg, inc) \
  407. do { \
  408. /* signed type ensures sign extension to long */ \
  409. int _inc = (inc); \
  410. if ( ad_bytes == sizeof(unsigned long) ) \
  411. (reg) += _inc; \
  412. else \
  413. (reg) = ((reg) & ~((1UL << (ad_bytes << 3)) - 1)) | \
  414. (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
  415. } while (0)
  416. void *decode_register(u8 modrm_reg, unsigned long *regs,
  417. int highbyte_regs)
  418. {
  419. void *p;
  420. p = &regs[modrm_reg];
  421. if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
  422. p = (unsigned char *)&regs[modrm_reg & 3] + 1;
  423. return p;
  424. }
  425. static int read_descriptor(struct x86_emulate_ctxt *ctxt,
  426. struct x86_emulate_ops *ops,
  427. void *ptr,
  428. u16 *size, unsigned long *address, int op_bytes)
  429. {
  430. int rc;
  431. if (op_bytes == 2)
  432. op_bytes = 3;
  433. *address = 0;
  434. rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2, ctxt);
  435. if (rc)
  436. return rc;
  437. rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes, ctxt);
  438. return rc;
  439. }
  440. int
  441. x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
  442. {
  443. unsigned d;
  444. u8 b, sib, twobyte = 0, rex_prefix = 0;
  445. u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
  446. unsigned long *override_base = NULL;
  447. unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
  448. int rc = 0;
  449. struct operand src, dst;
  450. unsigned long cr2 = ctxt->cr2;
  451. int mode = ctxt->mode;
  452. unsigned long modrm_ea;
  453. int use_modrm_ea, index_reg = 0, base_reg = 0, scale, rip_relative = 0;
  454. /* Shadow copy of register state. Committed on successful emulation. */
  455. unsigned long _regs[NR_VCPU_REGS];
  456. unsigned long _eip = ctxt->vcpu->rip, _eflags = ctxt->eflags;
  457. unsigned long modrm_val = 0;
  458. memcpy(_regs, ctxt->vcpu->regs, sizeof _regs);
  459. switch (mode) {
  460. case X86EMUL_MODE_REAL:
  461. case X86EMUL_MODE_PROT16:
  462. op_bytes = ad_bytes = 2;
  463. break;
  464. case X86EMUL_MODE_PROT32:
  465. op_bytes = ad_bytes = 4;
  466. break;
  467. #ifdef CONFIG_X86_64
  468. case X86EMUL_MODE_PROT64:
  469. op_bytes = 4;
  470. ad_bytes = 8;
  471. break;
  472. #endif
  473. default:
  474. return -1;
  475. }
  476. /* Legacy prefixes. */
  477. for (i = 0; i < 8; i++) {
  478. switch (b = insn_fetch(u8, 1, _eip)) {
  479. case 0x66: /* operand-size override */
  480. op_bytes ^= 6; /* switch between 2/4 bytes */
  481. break;
  482. case 0x67: /* address-size override */
  483. if (mode == X86EMUL_MODE_PROT64)
  484. ad_bytes ^= 12; /* switch between 4/8 bytes */
  485. else
  486. ad_bytes ^= 6; /* switch between 2/4 bytes */
  487. break;
  488. case 0x2e: /* CS override */
  489. override_base = &ctxt->cs_base;
  490. break;
  491. case 0x3e: /* DS override */
  492. override_base = &ctxt->ds_base;
  493. break;
  494. case 0x26: /* ES override */
  495. override_base = &ctxt->es_base;
  496. break;
  497. case 0x64: /* FS override */
  498. override_base = &ctxt->fs_base;
  499. break;
  500. case 0x65: /* GS override */
  501. override_base = &ctxt->gs_base;
  502. break;
  503. case 0x36: /* SS override */
  504. override_base = &ctxt->ss_base;
  505. break;
  506. case 0xf0: /* LOCK */
  507. lock_prefix = 1;
  508. break;
  509. case 0xf3: /* REP/REPE/REPZ */
  510. rep_prefix = 1;
  511. break;
  512. case 0xf2: /* REPNE/REPNZ */
  513. break;
  514. default:
  515. goto done_prefixes;
  516. }
  517. }
  518. done_prefixes:
  519. /* REX prefix. */
  520. if ((mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40)) {
  521. rex_prefix = b;
  522. if (b & 8)
  523. op_bytes = 8; /* REX.W */
  524. modrm_reg = (b & 4) << 1; /* REX.R */
  525. index_reg = (b & 2) << 2; /* REX.X */
  526. modrm_rm = base_reg = (b & 1) << 3; /* REG.B */
  527. b = insn_fetch(u8, 1, _eip);
  528. }
  529. /* Opcode byte(s). */
  530. d = opcode_table[b];
  531. if (d == 0) {
  532. /* Two-byte opcode? */
  533. if (b == 0x0f) {
  534. twobyte = 1;
  535. b = insn_fetch(u8, 1, _eip);
  536. d = twobyte_table[b];
  537. }
  538. /* Unrecognised? */
  539. if (d == 0)
  540. goto cannot_emulate;
  541. }
  542. /* ModRM and SIB bytes. */
  543. if (d & ModRM) {
  544. modrm = insn_fetch(u8, 1, _eip);
  545. modrm_mod |= (modrm & 0xc0) >> 6;
  546. modrm_reg |= (modrm & 0x38) >> 3;
  547. modrm_rm |= (modrm & 0x07);
  548. modrm_ea = 0;
  549. use_modrm_ea = 1;
  550. if (modrm_mod == 3) {
  551. modrm_val = *(unsigned long *)
  552. decode_register(modrm_rm, _regs, d & ByteOp);
  553. goto modrm_done;
  554. }
  555. if (ad_bytes == 2) {
  556. unsigned bx = _regs[VCPU_REGS_RBX];
  557. unsigned bp = _regs[VCPU_REGS_RBP];
  558. unsigned si = _regs[VCPU_REGS_RSI];
  559. unsigned di = _regs[VCPU_REGS_RDI];
  560. /* 16-bit ModR/M decode. */
  561. switch (modrm_mod) {
  562. case 0:
  563. if (modrm_rm == 6)
  564. modrm_ea += insn_fetch(u16, 2, _eip);
  565. break;
  566. case 1:
  567. modrm_ea += insn_fetch(s8, 1, _eip);
  568. break;
  569. case 2:
  570. modrm_ea += insn_fetch(u16, 2, _eip);
  571. break;
  572. }
  573. switch (modrm_rm) {
  574. case 0:
  575. modrm_ea += bx + si;
  576. break;
  577. case 1:
  578. modrm_ea += bx + di;
  579. break;
  580. case 2:
  581. modrm_ea += bp + si;
  582. break;
  583. case 3:
  584. modrm_ea += bp + di;
  585. break;
  586. case 4:
  587. modrm_ea += si;
  588. break;
  589. case 5:
  590. modrm_ea += di;
  591. break;
  592. case 6:
  593. if (modrm_mod != 0)
  594. modrm_ea += bp;
  595. break;
  596. case 7:
  597. modrm_ea += bx;
  598. break;
  599. }
  600. if (modrm_rm == 2 || modrm_rm == 3 ||
  601. (modrm_rm == 6 && modrm_mod != 0))
  602. if (!override_base)
  603. override_base = &ctxt->ss_base;
  604. modrm_ea = (u16)modrm_ea;
  605. } else {
  606. /* 32/64-bit ModR/M decode. */
  607. switch (modrm_rm) {
  608. case 4:
  609. case 12:
  610. sib = insn_fetch(u8, 1, _eip);
  611. index_reg |= (sib >> 3) & 7;
  612. base_reg |= sib & 7;
  613. scale = sib >> 6;
  614. switch (base_reg) {
  615. case 5:
  616. if (modrm_mod != 0)
  617. modrm_ea += _regs[base_reg];
  618. else
  619. modrm_ea += insn_fetch(s32, 4, _eip);
  620. break;
  621. default:
  622. modrm_ea += _regs[base_reg];
  623. }
  624. switch (index_reg) {
  625. case 4:
  626. break;
  627. default:
  628. modrm_ea += _regs[index_reg] << scale;
  629. }
  630. break;
  631. case 5:
  632. if (modrm_mod != 0)
  633. modrm_ea += _regs[modrm_rm];
  634. else if (mode == X86EMUL_MODE_PROT64)
  635. rip_relative = 1;
  636. break;
  637. default:
  638. modrm_ea += _regs[modrm_rm];
  639. break;
  640. }
  641. switch (modrm_mod) {
  642. case 0:
  643. if (modrm_rm == 5)
  644. modrm_ea += insn_fetch(s32, 4, _eip);
  645. break;
  646. case 1:
  647. modrm_ea += insn_fetch(s8, 1, _eip);
  648. break;
  649. case 2:
  650. modrm_ea += insn_fetch(s32, 4, _eip);
  651. break;
  652. }
  653. }
  654. if (!override_base)
  655. override_base = &ctxt->ds_base;
  656. if (mode == X86EMUL_MODE_PROT64 &&
  657. override_base != &ctxt->fs_base &&
  658. override_base != &ctxt->gs_base)
  659. override_base = NULL;
  660. if (override_base)
  661. modrm_ea += *override_base;
  662. if (rip_relative) {
  663. modrm_ea += _eip;
  664. switch (d & SrcMask) {
  665. case SrcImmByte:
  666. modrm_ea += 1;
  667. break;
  668. case SrcImm:
  669. if (d & ByteOp)
  670. modrm_ea += 1;
  671. else
  672. if (op_bytes == 8)
  673. modrm_ea += 4;
  674. else
  675. modrm_ea += op_bytes;
  676. }
  677. }
  678. if (ad_bytes != 8)
  679. modrm_ea = (u32)modrm_ea;
  680. cr2 = modrm_ea;
  681. modrm_done:
  682. ;
  683. }
  684. /*
  685. * Decode and fetch the source operand: register, memory
  686. * or immediate.
  687. */
  688. switch (d & SrcMask) {
  689. case SrcNone:
  690. break;
  691. case SrcReg:
  692. src.type = OP_REG;
  693. if (d & ByteOp) {
  694. src.ptr = decode_register(modrm_reg, _regs,
  695. (rex_prefix == 0));
  696. src.val = src.orig_val = *(u8 *) src.ptr;
  697. src.bytes = 1;
  698. } else {
  699. src.ptr = decode_register(modrm_reg, _regs, 0);
  700. switch ((src.bytes = op_bytes)) {
  701. case 2:
  702. src.val = src.orig_val = *(u16 *) src.ptr;
  703. break;
  704. case 4:
  705. src.val = src.orig_val = *(u32 *) src.ptr;
  706. break;
  707. case 8:
  708. src.val = src.orig_val = *(u64 *) src.ptr;
  709. break;
  710. }
  711. }
  712. break;
  713. case SrcMem16:
  714. src.bytes = 2;
  715. goto srcmem_common;
  716. case SrcMem32:
  717. src.bytes = 4;
  718. goto srcmem_common;
  719. case SrcMem:
  720. src.bytes = (d & ByteOp) ? 1 : op_bytes;
  721. srcmem_common:
  722. src.type = OP_MEM;
  723. src.ptr = (unsigned long *)cr2;
  724. if ((rc = ops->read_emulated((unsigned long)src.ptr,
  725. &src.val, src.bytes, ctxt)) != 0)
  726. goto done;
  727. src.orig_val = src.val;
  728. break;
  729. case SrcImm:
  730. src.type = OP_IMM;
  731. src.ptr = (unsigned long *)_eip;
  732. src.bytes = (d & ByteOp) ? 1 : op_bytes;
  733. if (src.bytes == 8)
  734. src.bytes = 4;
  735. /* NB. Immediates are sign-extended as necessary. */
  736. switch (src.bytes) {
  737. case 1:
  738. src.val = insn_fetch(s8, 1, _eip);
  739. break;
  740. case 2:
  741. src.val = insn_fetch(s16, 2, _eip);
  742. break;
  743. case 4:
  744. src.val = insn_fetch(s32, 4, _eip);
  745. break;
  746. }
  747. break;
  748. case SrcImmByte:
  749. src.type = OP_IMM;
  750. src.ptr = (unsigned long *)_eip;
  751. src.bytes = 1;
  752. src.val = insn_fetch(s8, 1, _eip);
  753. break;
  754. }
  755. /* Decode and fetch the destination operand: register or memory. */
  756. switch (d & DstMask) {
  757. case ImplicitOps:
  758. /* Special instructions do their own operand decoding. */
  759. goto special_insn;
  760. case DstReg:
  761. dst.type = OP_REG;
  762. if ((d & ByteOp)
  763. && !(twobyte_table && (b == 0xb6 || b == 0xb7))) {
  764. dst.ptr = decode_register(modrm_reg, _regs,
  765. (rex_prefix == 0));
  766. dst.val = *(u8 *) dst.ptr;
  767. dst.bytes = 1;
  768. } else {
  769. dst.ptr = decode_register(modrm_reg, _regs, 0);
  770. switch ((dst.bytes = op_bytes)) {
  771. case 2:
  772. dst.val = *(u16 *)dst.ptr;
  773. break;
  774. case 4:
  775. dst.val = *(u32 *)dst.ptr;
  776. break;
  777. case 8:
  778. dst.val = *(u64 *)dst.ptr;
  779. break;
  780. }
  781. }
  782. break;
  783. case DstMem:
  784. dst.type = OP_MEM;
  785. dst.ptr = (unsigned long *)cr2;
  786. dst.bytes = (d & ByteOp) ? 1 : op_bytes;
  787. if (d & BitOp) {
  788. dst.ptr += src.val / BITS_PER_LONG;
  789. dst.bytes = sizeof(long);
  790. }
  791. if (!(d & Mov) && /* optimisation - avoid slow emulated read */
  792. ((rc = ops->read_emulated((unsigned long)dst.ptr,
  793. &dst.val, dst.bytes, ctxt)) != 0))
  794. goto done;
  795. break;
  796. }
  797. dst.orig_val = dst.val;
  798. if (twobyte)
  799. goto twobyte_insn;
  800. switch (b) {
  801. case 0x00 ... 0x05:
  802. add: /* add */
  803. emulate_2op_SrcV("add", src, dst, _eflags);
  804. break;
  805. case 0x08 ... 0x0d:
  806. or: /* or */
  807. emulate_2op_SrcV("or", src, dst, _eflags);
  808. break;
  809. case 0x10 ... 0x15:
  810. adc: /* adc */
  811. emulate_2op_SrcV("adc", src, dst, _eflags);
  812. break;
  813. case 0x18 ... 0x1d:
  814. sbb: /* sbb */
  815. emulate_2op_SrcV("sbb", src, dst, _eflags);
  816. break;
  817. case 0x20 ... 0x25:
  818. and: /* and */
  819. emulate_2op_SrcV("and", src, dst, _eflags);
  820. break;
  821. case 0x28 ... 0x2d:
  822. sub: /* sub */
  823. emulate_2op_SrcV("sub", src, dst, _eflags);
  824. break;
  825. case 0x30 ... 0x35:
  826. xor: /* xor */
  827. emulate_2op_SrcV("xor", src, dst, _eflags);
  828. break;
  829. case 0x38 ... 0x3d:
  830. cmp: /* cmp */
  831. emulate_2op_SrcV("cmp", src, dst, _eflags);
  832. break;
  833. case 0x63: /* movsxd */
  834. if (mode != X86EMUL_MODE_PROT64)
  835. goto cannot_emulate;
  836. dst.val = (s32) src.val;
  837. break;
  838. case 0x80 ... 0x83: /* Grp1 */
  839. switch (modrm_reg) {
  840. case 0:
  841. goto add;
  842. case 1:
  843. goto or;
  844. case 2:
  845. goto adc;
  846. case 3:
  847. goto sbb;
  848. case 4:
  849. goto and;
  850. case 5:
  851. goto sub;
  852. case 6:
  853. goto xor;
  854. case 7:
  855. goto cmp;
  856. }
  857. break;
  858. case 0x84 ... 0x85:
  859. test: /* test */
  860. emulate_2op_SrcV("test", src, dst, _eflags);
  861. break;
  862. case 0x86 ... 0x87: /* xchg */
  863. /* Write back the register source. */
  864. switch (dst.bytes) {
  865. case 1:
  866. *(u8 *) src.ptr = (u8) dst.val;
  867. break;
  868. case 2:
  869. *(u16 *) src.ptr = (u16) dst.val;
  870. break;
  871. case 4:
  872. *src.ptr = (u32) dst.val;
  873. break; /* 64b reg: zero-extend */
  874. case 8:
  875. *src.ptr = dst.val;
  876. break;
  877. }
  878. /*
  879. * Write back the memory destination with implicit LOCK
  880. * prefix.
  881. */
  882. dst.val = src.val;
  883. lock_prefix = 1;
  884. break;
  885. case 0xa0 ... 0xa1: /* mov */
  886. dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
  887. dst.val = src.val;
  888. _eip += ad_bytes; /* skip src displacement */
  889. break;
  890. case 0xa2 ... 0xa3: /* mov */
  891. dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
  892. _eip += ad_bytes; /* skip dst displacement */
  893. break;
  894. case 0x88 ... 0x8b: /* mov */
  895. case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
  896. dst.val = src.val;
  897. break;
  898. case 0x8f: /* pop (sole member of Grp1a) */
  899. /* 64-bit mode: POP always pops a 64-bit operand. */
  900. if (mode == X86EMUL_MODE_PROT64)
  901. dst.bytes = 8;
  902. if ((rc = ops->read_std(register_address(ctxt->ss_base,
  903. _regs[VCPU_REGS_RSP]),
  904. &dst.val, dst.bytes, ctxt)) != 0)
  905. goto done;
  906. register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
  907. break;
  908. case 0xc0 ... 0xc1:
  909. grp2: /* Grp2 */
  910. switch (modrm_reg) {
  911. case 0: /* rol */
  912. emulate_2op_SrcB("rol", src, dst, _eflags);
  913. break;
  914. case 1: /* ror */
  915. emulate_2op_SrcB("ror", src, dst, _eflags);
  916. break;
  917. case 2: /* rcl */
  918. emulate_2op_SrcB("rcl", src, dst, _eflags);
  919. break;
  920. case 3: /* rcr */
  921. emulate_2op_SrcB("rcr", src, dst, _eflags);
  922. break;
  923. case 4: /* sal/shl */
  924. case 6: /* sal/shl */
  925. emulate_2op_SrcB("sal", src, dst, _eflags);
  926. break;
  927. case 5: /* shr */
  928. emulate_2op_SrcB("shr", src, dst, _eflags);
  929. break;
  930. case 7: /* sar */
  931. emulate_2op_SrcB("sar", src, dst, _eflags);
  932. break;
  933. }
  934. break;
  935. case 0xd0 ... 0xd1: /* Grp2 */
  936. src.val = 1;
  937. goto grp2;
  938. case 0xd2 ... 0xd3: /* Grp2 */
  939. src.val = _regs[VCPU_REGS_RCX];
  940. goto grp2;
  941. case 0xf6 ... 0xf7: /* Grp3 */
  942. switch (modrm_reg) {
  943. case 0 ... 1: /* test */
  944. /*
  945. * Special case in Grp3: test has an immediate
  946. * source operand.
  947. */
  948. src.type = OP_IMM;
  949. src.ptr = (unsigned long *)_eip;
  950. src.bytes = (d & ByteOp) ? 1 : op_bytes;
  951. if (src.bytes == 8)
  952. src.bytes = 4;
  953. switch (src.bytes) {
  954. case 1:
  955. src.val = insn_fetch(s8, 1, _eip);
  956. break;
  957. case 2:
  958. src.val = insn_fetch(s16, 2, _eip);
  959. break;
  960. case 4:
  961. src.val = insn_fetch(s32, 4, _eip);
  962. break;
  963. }
  964. goto test;
  965. case 2: /* not */
  966. dst.val = ~dst.val;
  967. break;
  968. case 3: /* neg */
  969. emulate_1op("neg", dst, _eflags);
  970. break;
  971. default:
  972. goto cannot_emulate;
  973. }
  974. break;
  975. case 0xfe ... 0xff: /* Grp4/Grp5 */
  976. switch (modrm_reg) {
  977. case 0: /* inc */
  978. emulate_1op("inc", dst, _eflags);
  979. break;
  980. case 1: /* dec */
  981. emulate_1op("dec", dst, _eflags);
  982. break;
  983. case 6: /* push */
  984. /* 64-bit mode: PUSH always pushes a 64-bit operand. */
  985. if (mode == X86EMUL_MODE_PROT64) {
  986. dst.bytes = 8;
  987. if ((rc = ops->read_std((unsigned long)dst.ptr,
  988. &dst.val, 8,
  989. ctxt)) != 0)
  990. goto done;
  991. }
  992. register_address_increment(_regs[VCPU_REGS_RSP],
  993. -dst.bytes);
  994. if ((rc = ops->write_std(
  995. register_address(ctxt->ss_base,
  996. _regs[VCPU_REGS_RSP]),
  997. dst.val, dst.bytes, ctxt)) != 0)
  998. goto done;
  999. dst.val = dst.orig_val; /* skanky: disable writeback */
  1000. break;
  1001. default:
  1002. goto cannot_emulate;
  1003. }
  1004. break;
  1005. }
  1006. writeback:
  1007. if ((d & Mov) || (dst.orig_val != dst.val)) {
  1008. switch (dst.type) {
  1009. case OP_REG:
  1010. /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
  1011. switch (dst.bytes) {
  1012. case 1:
  1013. *(u8 *)dst.ptr = (u8)dst.val;
  1014. break;
  1015. case 2:
  1016. *(u16 *)dst.ptr = (u16)dst.val;
  1017. break;
  1018. case 4:
  1019. *dst.ptr = (u32)dst.val;
  1020. break; /* 64b: zero-ext */
  1021. case 8:
  1022. *dst.ptr = dst.val;
  1023. break;
  1024. }
  1025. break;
  1026. case OP_MEM:
  1027. if (lock_prefix)
  1028. rc = ops->cmpxchg_emulated((unsigned long)dst.
  1029. ptr, dst.orig_val,
  1030. dst.val, dst.bytes,
  1031. ctxt);
  1032. else
  1033. rc = ops->write_emulated((unsigned long)dst.ptr,
  1034. dst.val, dst.bytes,
  1035. ctxt);
  1036. if (rc != 0)
  1037. goto done;
  1038. default:
  1039. break;
  1040. }
  1041. }
  1042. /* Commit shadow register state. */
  1043. memcpy(ctxt->vcpu->regs, _regs, sizeof _regs);
  1044. ctxt->eflags = _eflags;
  1045. ctxt->vcpu->rip = _eip;
  1046. done:
  1047. return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
  1048. special_insn:
  1049. if (twobyte)
  1050. goto twobyte_special_insn;
  1051. if (rep_prefix) {
  1052. if (_regs[VCPU_REGS_RCX] == 0) {
  1053. ctxt->vcpu->rip = _eip;
  1054. goto done;
  1055. }
  1056. _regs[VCPU_REGS_RCX]--;
  1057. _eip = ctxt->vcpu->rip;
  1058. }
  1059. switch (b) {
  1060. case 0xa4 ... 0xa5: /* movs */
  1061. dst.type = OP_MEM;
  1062. dst.bytes = (d & ByteOp) ? 1 : op_bytes;
  1063. dst.ptr = (unsigned long *)register_address(ctxt->es_base,
  1064. _regs[VCPU_REGS_RDI]);
  1065. if ((rc = ops->read_emulated(register_address(
  1066. override_base ? *override_base : ctxt->ds_base,
  1067. _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt)) != 0)
  1068. goto done;
  1069. register_address_increment(_regs[VCPU_REGS_RSI],
  1070. (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
  1071. register_address_increment(_regs[VCPU_REGS_RDI],
  1072. (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
  1073. break;
  1074. case 0xa6 ... 0xa7: /* cmps */
  1075. DPRINTF("Urk! I don't handle CMPS.\n");
  1076. goto cannot_emulate;
  1077. case 0xaa ... 0xab: /* stos */
  1078. dst.type = OP_MEM;
  1079. dst.bytes = (d & ByteOp) ? 1 : op_bytes;
  1080. dst.ptr = (unsigned long *)cr2;
  1081. dst.val = _regs[VCPU_REGS_RAX];
  1082. register_address_increment(_regs[VCPU_REGS_RDI],
  1083. (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
  1084. break;
  1085. case 0xac ... 0xad: /* lods */
  1086. dst.type = OP_REG;
  1087. dst.bytes = (d & ByteOp) ? 1 : op_bytes;
  1088. dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
  1089. if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes, ctxt)) != 0)
  1090. goto done;
  1091. register_address_increment(_regs[VCPU_REGS_RSI],
  1092. (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
  1093. break;
  1094. case 0xae ... 0xaf: /* scas */
  1095. DPRINTF("Urk! I don't handle SCAS.\n");
  1096. goto cannot_emulate;
  1097. }
  1098. goto writeback;
  1099. twobyte_insn:
  1100. switch (b) {
  1101. case 0x01: /* lgdt, lidt, lmsw */
  1102. switch (modrm_reg) {
  1103. u16 size;
  1104. unsigned long address;
  1105. case 2: /* lgdt */
  1106. rc = read_descriptor(ctxt, ops, src.ptr,
  1107. &size, &address, op_bytes);
  1108. if (rc)
  1109. goto done;
  1110. realmode_lgdt(ctxt->vcpu, size, address);
  1111. break;
  1112. case 3: /* lidt */
  1113. rc = read_descriptor(ctxt, ops, src.ptr,
  1114. &size, &address, op_bytes);
  1115. if (rc)
  1116. goto done;
  1117. realmode_lidt(ctxt->vcpu, size, address);
  1118. break;
  1119. case 4: /* smsw */
  1120. if (modrm_mod != 3)
  1121. goto cannot_emulate;
  1122. *(u16 *)&_regs[modrm_rm]
  1123. = realmode_get_cr(ctxt->vcpu, 0);
  1124. break;
  1125. case 6: /* lmsw */
  1126. if (modrm_mod != 3)
  1127. goto cannot_emulate;
  1128. realmode_lmsw(ctxt->vcpu, (u16)modrm_val, &_eflags);
  1129. break;
  1130. case 7: /* invlpg*/
  1131. emulate_invlpg(ctxt->vcpu, cr2);
  1132. break;
  1133. default:
  1134. goto cannot_emulate;
  1135. }
  1136. break;
  1137. case 0x21: /* mov from dr to reg */
  1138. if (modrm_mod != 3)
  1139. goto cannot_emulate;
  1140. rc = emulator_get_dr(ctxt, modrm_reg, &_regs[modrm_rm]);
  1141. break;
  1142. case 0x23: /* mov from reg to dr */
  1143. if (modrm_mod != 3)
  1144. goto cannot_emulate;
  1145. rc = emulator_set_dr(ctxt, modrm_reg, _regs[modrm_rm]);
  1146. break;
  1147. case 0x40 ... 0x4f: /* cmov */
  1148. dst.val = dst.orig_val = src.val;
  1149. d &= ~Mov; /* default to no move */
  1150. /*
  1151. * First, assume we're decoding an even cmov opcode
  1152. * (lsb == 0).
  1153. */
  1154. switch ((b & 15) >> 1) {
  1155. case 0: /* cmovo */
  1156. d |= (_eflags & EFLG_OF) ? Mov : 0;
  1157. break;
  1158. case 1: /* cmovb/cmovc/cmovnae */
  1159. d |= (_eflags & EFLG_CF) ? Mov : 0;
  1160. break;
  1161. case 2: /* cmovz/cmove */
  1162. d |= (_eflags & EFLG_ZF) ? Mov : 0;
  1163. break;
  1164. case 3: /* cmovbe/cmovna */
  1165. d |= (_eflags & (EFLG_CF | EFLG_ZF)) ? Mov : 0;
  1166. break;
  1167. case 4: /* cmovs */
  1168. d |= (_eflags & EFLG_SF) ? Mov : 0;
  1169. break;
  1170. case 5: /* cmovp/cmovpe */
  1171. d |= (_eflags & EFLG_PF) ? Mov : 0;
  1172. break;
  1173. case 7: /* cmovle/cmovng */
  1174. d |= (_eflags & EFLG_ZF) ? Mov : 0;
  1175. /* fall through */
  1176. case 6: /* cmovl/cmovnge */
  1177. d |= (!(_eflags & EFLG_SF) !=
  1178. !(_eflags & EFLG_OF)) ? Mov : 0;
  1179. break;
  1180. }
  1181. /* Odd cmov opcodes (lsb == 1) have inverted sense. */
  1182. d ^= (b & 1) ? Mov : 0;
  1183. break;
  1184. case 0xb0 ... 0xb1: /* cmpxchg */
  1185. /*
  1186. * Save real source value, then compare EAX against
  1187. * destination.
  1188. */
  1189. src.orig_val = src.val;
  1190. src.val = _regs[VCPU_REGS_RAX];
  1191. emulate_2op_SrcV("cmp", src, dst, _eflags);
  1192. /* Always write back. The question is: where to? */
  1193. d |= Mov;
  1194. if (_eflags & EFLG_ZF) {
  1195. /* Success: write back to memory. */
  1196. dst.val = src.orig_val;
  1197. } else {
  1198. /* Failure: write the value we saw to EAX. */
  1199. dst.type = OP_REG;
  1200. dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
  1201. }
  1202. break;
  1203. case 0xa3:
  1204. bt: /* bt */
  1205. src.val &= (dst.bytes << 3) - 1; /* only subword offset */
  1206. emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
  1207. break;
  1208. case 0xb3:
  1209. btr: /* btr */
  1210. src.val &= (dst.bytes << 3) - 1; /* only subword offset */
  1211. emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
  1212. break;
  1213. case 0xab:
  1214. bts: /* bts */
  1215. src.val &= (dst.bytes << 3) - 1; /* only subword offset */
  1216. emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
  1217. break;
  1218. case 0xb6 ... 0xb7: /* movzx */
  1219. dst.bytes = op_bytes;
  1220. dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
  1221. break;
  1222. case 0xbb:
  1223. btc: /* btc */
  1224. src.val &= (dst.bytes << 3) - 1; /* only subword offset */
  1225. emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
  1226. break;
  1227. case 0xba: /* Grp8 */
  1228. switch (modrm_reg & 3) {
  1229. case 0:
  1230. goto bt;
  1231. case 1:
  1232. goto bts;
  1233. case 2:
  1234. goto btr;
  1235. case 3:
  1236. goto btc;
  1237. }
  1238. break;
  1239. case 0xbe ... 0xbf: /* movsx */
  1240. dst.bytes = op_bytes;
  1241. dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
  1242. break;
  1243. }
  1244. goto writeback;
  1245. twobyte_special_insn:
  1246. /* Disable writeback. */
  1247. dst.orig_val = dst.val;
  1248. switch (b) {
  1249. case 0x0d: /* GrpP (prefetch) */
  1250. case 0x18: /* Grp16 (prefetch/nop) */
  1251. break;
  1252. case 0x06:
  1253. emulate_clts(ctxt->vcpu);
  1254. break;
  1255. case 0x20: /* mov cr, reg */
  1256. if (modrm_mod != 3)
  1257. goto cannot_emulate;
  1258. _regs[modrm_rm] = realmode_get_cr(ctxt->vcpu, modrm_reg);
  1259. break;
  1260. case 0x22: /* mov reg, cr */
  1261. if (modrm_mod != 3)
  1262. goto cannot_emulate;
  1263. realmode_set_cr(ctxt->vcpu, modrm_reg, modrm_val, &_eflags);
  1264. break;
  1265. case 0xc7: /* Grp9 (cmpxchg8b) */
  1266. #if defined(__i386__)
  1267. {
  1268. unsigned long old_lo, old_hi;
  1269. if (((rc = ops->read_emulated(cr2 + 0, &old_lo, 4,
  1270. ctxt)) != 0)
  1271. || ((rc = ops->read_emulated(cr2 + 4, &old_hi, 4,
  1272. ctxt)) != 0))
  1273. goto done;
  1274. if ((old_lo != _regs[VCPU_REGS_RAX])
  1275. || (old_hi != _regs[VCPU_REGS_RDX])) {
  1276. _regs[VCPU_REGS_RAX] = old_lo;
  1277. _regs[VCPU_REGS_RDX] = old_hi;
  1278. _eflags &= ~EFLG_ZF;
  1279. } else if (ops->cmpxchg8b_emulated == NULL) {
  1280. rc = X86EMUL_UNHANDLEABLE;
  1281. goto done;
  1282. } else {
  1283. if ((rc = ops->cmpxchg8b_emulated(cr2, old_lo,
  1284. old_hi,
  1285. _regs[VCPU_REGS_RBX],
  1286. _regs[VCPU_REGS_RCX],
  1287. ctxt)) != 0)
  1288. goto done;
  1289. _eflags |= EFLG_ZF;
  1290. }
  1291. break;
  1292. }
  1293. #elif defined(CONFIG_X86_64)
  1294. {
  1295. unsigned long old, new;
  1296. if ((rc = ops->read_emulated(cr2, &old, 8, ctxt)) != 0)
  1297. goto done;
  1298. if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
  1299. ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
  1300. _regs[VCPU_REGS_RAX] = (u32) (old >> 0);
  1301. _regs[VCPU_REGS_RDX] = (u32) (old >> 32);
  1302. _eflags &= ~EFLG_ZF;
  1303. } else {
  1304. new = (_regs[VCPU_REGS_RCX] << 32) | (u32) _regs[VCPU_REGS_RBX];
  1305. if ((rc = ops->cmpxchg_emulated(cr2, old,
  1306. new, 8, ctxt)) != 0)
  1307. goto done;
  1308. _eflags |= EFLG_ZF;
  1309. }
  1310. break;
  1311. }
  1312. #endif
  1313. }
  1314. goto writeback;
  1315. cannot_emulate:
  1316. DPRINTF("Cannot emulate %02x\n", b);
  1317. return -1;
  1318. }
  1319. #ifdef __XEN__
  1320. #include <asm/mm.h>
  1321. #include <asm/uaccess.h>
  1322. int
  1323. x86_emulate_read_std(unsigned long addr,
  1324. unsigned long *val,
  1325. unsigned int bytes, struct x86_emulate_ctxt *ctxt)
  1326. {
  1327. unsigned int rc;
  1328. *val = 0;
  1329. if ((rc = copy_from_user((void *)val, (void *)addr, bytes)) != 0) {
  1330. propagate_page_fault(addr + bytes - rc, 0); /* read fault */
  1331. return X86EMUL_PROPAGATE_FAULT;
  1332. }
  1333. return X86EMUL_CONTINUE;
  1334. }
  1335. int
  1336. x86_emulate_write_std(unsigned long addr,
  1337. unsigned long val,
  1338. unsigned int bytes, struct x86_emulate_ctxt *ctxt)
  1339. {
  1340. unsigned int rc;
  1341. if ((rc = copy_to_user((void *)addr, (void *)&val, bytes)) != 0) {
  1342. propagate_page_fault(addr + bytes - rc, PGERR_write_access);
  1343. return X86EMUL_PROPAGATE_FAULT;
  1344. }
  1345. return X86EMUL_CONTINUE;
  1346. }
  1347. #endif