?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
powerpc: tlb_32.c build fix
[firewire-audio.git] / drivers / kvm / x86_emulate.c
blob1b800fc00342c55dbdb47c21935345330b49c4ef
1 /******************************************************************************
2 * x86_emulate.c
3 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privieged instructions:
10 *
11 * Copyright (C) 2006 Qumranet
12 *
13 * Avi Kivity <avi@qumranet.com>
14 * Yaniv Kamay <yaniv@qumranet.com>
15 *
16 * This work is licensed under the terms of the GNU GPL, version 2. See
17 * the COPYING file in the top-level directory.
18 *
19 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
20 */
21
22 #ifndef __KERNEL__
23 #include <stdio.h>
24 #include <stdint.h>
25 #include <public/xen.h>
26 #define DPRINTF(_f, _a ...) printf( _f , ## _a )
27 #else
28 #include "kvm.h"
29 #define DPRINTF(x...) do {} while (0)
30 #endif
31 #include "x86_emulate.h"
32 #include <linux/module.h>
33
34 /*
35 * Opcode effective-address decode tables.
36 * Note that we only emulate instructions that have at least one memory
37 * operand (excluding implicit stack references). We assume that stack
38 * references and instruction fetches will never occur in special memory
39 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
40 * not be handled.
41 */
42
43 /* Operand sizes: 8-bit operands or specified/overridden size. */
44 #define ByteOp (1<<0) /* 8-bit operands. */
45 /* Destination operand type. */
46 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
47 #define DstReg (2<<1) /* Register operand. */
48 #define DstMem (3<<1) /* Memory operand. */
49 #define DstMask (3<<1)
50 /* Source operand type. */
51 #define SrcNone (0<<3) /* No source operand. */
52 #define SrcImplicit (0<<3) /* Source operand is implicit in the opcode. */
53 #define SrcReg (1<<3) /* Register operand. */
54 #define SrcMem (2<<3) /* Memory operand. */
55 #define SrcMem16 (3<<3) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<3) /* Memory operand (32-bit). */
57 #define SrcImm (5<<3) /* Immediate operand. */
58 #define SrcImmByte (6<<3) /* 8-bit sign-extended immediate operand. */
59 #define SrcMask (7<<3)
60 /* Generic ModRM decode. */
61 #define ModRM (1<<6)
62 /* Destination is only written; never read. */
63 #define Mov (1<<7)
64 #define BitOp (1<<8)
65
66 static u8 opcode_table[256] = {
67 /* 0x00 - 0x07 */
68 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
69 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
70 0, 0, 0, 0,
71 /* 0x08 - 0x0F */
72 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
73 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
74 0, 0, 0, 0,
75 /* 0x10 - 0x17 */
76 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
77 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
78 0, 0, 0, 0,
79 /* 0x18 - 0x1F */
80 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
81 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
82 0, 0, 0, 0,
83 /* 0x20 - 0x27 */
84 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
85 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
86 0, 0, 0, 0,
87 /* 0x28 - 0x2F */
88 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
89 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
90 0, 0, 0, 0,
91 /* 0x30 - 0x37 */
92 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
93 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
94 0, 0, 0, 0,
95 /* 0x38 - 0x3F */
96 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
97 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
98 0, 0, 0, 0,
99 /* 0x40 - 0x4F */
100 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
101 /* 0x50 - 0x57 */
102 0, 0, 0, 0, 0, 0, 0, 0,
103 /* 0x58 - 0x5F */
104 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
105 ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
106 /* 0x60 - 0x6F */
107 0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
108 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
109 /* 0x70 - 0x7F */
110 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
111 /* 0x80 - 0x87 */
112 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
113 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
114 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
115 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
116 /* 0x88 - 0x8F */
117 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
118 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
119 0, 0, 0, DstMem | SrcNone | ModRM | Mov,
120 /* 0x90 - 0x9F */
121 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
122 /* 0xA0 - 0xA7 */
123 ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
124 ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
125 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
126 ByteOp | ImplicitOps, ImplicitOps,
127 /* 0xA8 - 0xAF */
128 0, 0, ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
129 ByteOp | ImplicitOps | Mov, ImplicitOps | Mov,
130 ByteOp | ImplicitOps, ImplicitOps,
131 /* 0xB0 - 0xBF */
132 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
133 /* 0xC0 - 0xC7 */
134 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
135 0, ImplicitOps, 0, 0,
136 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
137 /* 0xC8 - 0xCF */
138 0, 0, 0, 0, 0, 0, 0, 0,
139 /* 0xD0 - 0xD7 */
140 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
141 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
142 0, 0, 0, 0,
143 /* 0xD8 - 0xDF */
144 0, 0, 0, 0, 0, 0, 0, 0,
145 /* 0xE0 - 0xEF */
146 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
147 /* 0xF0 - 0xF7 */
148 0, 0, 0, 0,
149 ImplicitOps, 0,
150 ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
151 /* 0xF8 - 0xFF */
152 0, 0, 0, 0,
153 0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
154 };
155
156 static u16 twobyte_table[256] = {
157 /* 0x00 - 0x0F */
158 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
159 0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
160 /* 0x10 - 0x1F */
161 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
162 /* 0x20 - 0x2F */
163 ModRM | ImplicitOps, ModRM, ModRM | ImplicitOps, ModRM, 0, 0, 0, 0,
164 0, 0, 0, 0, 0, 0, 0, 0,
165 /* 0x30 - 0x3F */
166 ImplicitOps, 0, ImplicitOps, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
167 /* 0x40 - 0x47 */
168 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
169 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
170 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
171 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
172 /* 0x48 - 0x4F */
173 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
174 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
175 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
176 DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
177 /* 0x50 - 0x5F */
178 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
179 /* 0x60 - 0x6F */
180 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
181 /* 0x70 - 0x7F */
182 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
183 /* 0x80 - 0x8F */
184 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
185 /* 0x90 - 0x9F */
186 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
187 /* 0xA0 - 0xA7 */
188 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
189 /* 0xA8 - 0xAF */
190 0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
191 /* 0xB0 - 0xB7 */
192 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
193 DstMem | SrcReg | ModRM | BitOp,
194 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
195 DstReg | SrcMem16 | ModRM | Mov,
196 /* 0xB8 - 0xBF */
197 0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
198 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
199 DstReg | SrcMem16 | ModRM | Mov,
200 /* 0xC0 - 0xCF */
201 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
202 /* 0xD0 - 0xDF */
203 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
204 /* 0xE0 - 0xEF */
205 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
206 /* 0xF0 - 0xFF */
207 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
208 };
209
210 /*
211 * Tell the emulator that of the Group 7 instructions (sgdt, lidt, etc.) we
212 * are interested only in invlpg and not in any of the rest.
213 *
214 * invlpg is a special instruction in that the data it references may not
215 * be mapped.
216 */
217 void kvm_emulator_want_group7_invlpg(void)
218 {
219 twobyte_table[1] &= ~SrcMem;
220 }
221 EXPORT_SYMBOL_GPL(kvm_emulator_want_group7_invlpg);
222
223 /* Type, address-of, and value of an instruction's operand. */
224 struct operand {
225 enum { OP_REG, OP_MEM, OP_IMM } type;
226 unsigned int bytes;
227 unsigned long val, orig_val, *ptr;
228 };
229
230 /* EFLAGS bit definitions. */
231 #define EFLG_OF (1<<11)
232 #define EFLG_DF (1<<10)
233 #define EFLG_SF (1<<7)
234 #define EFLG_ZF (1<<6)
235 #define EFLG_AF (1<<4)
236 #define EFLG_PF (1<<2)
237 #define EFLG_CF (1<<0)
238
239 /*
240 * Instruction emulation:
241 * Most instructions are emulated directly via a fragment of inline assembly
242 * code. This allows us to save/restore EFLAGS and thus very easily pick up
243 * any modified flags.
244 */
245
246 #if defined(CONFIG_X86_64)
247 #define _LO32 "k" /* force 32-bit operand */
248 #define _STK "%%rsp" /* stack pointer */
249 #elif defined(__i386__)
250 #define _LO32 "" /* force 32-bit operand */
251 #define _STK "%%esp" /* stack pointer */
252 #endif
253
254 /*
255 * These EFLAGS bits are restored from saved value during emulation, and
256 * any changes are written back to the saved value after emulation.
257 */
258 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
259
260 /* Before executing instruction: restore necessary bits in EFLAGS. */
261 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
262 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); */ \
263 "push %"_sav"; " \
264 "movl %"_msk",%"_LO32 _tmp"; " \
265 "andl %"_LO32 _tmp",("_STK"); " \
266 "pushf; " \
267 "notl %"_LO32 _tmp"; " \
268 "andl %"_LO32 _tmp",("_STK"); " \
269 "pop %"_tmp"; " \
270 "orl %"_LO32 _tmp",("_STK"); " \
271 "popf; " \
272 /* _sav &= ~msk; */ \
273 "movl %"_msk",%"_LO32 _tmp"; " \
274 "notl %"_LO32 _tmp"; " \
275 "andl %"_LO32 _tmp",%"_sav"; "
276
277 /* After executing instruction: write-back necessary bits in EFLAGS. */
278 #define _POST_EFLAGS(_sav, _msk, _tmp) \
279 /* _sav |= EFLAGS & _msk; */ \
280 "pushf; " \
281 "pop %"_tmp"; " \
282 "andl %"_msk",%"_LO32 _tmp"; " \
283 "orl %"_LO32 _tmp",%"_sav"; "
284
285 /* Raw emulation: instruction has two explicit operands. */
286 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
287 do { \
288 unsigned long _tmp; \
289 \
290 switch ((_dst).bytes) { \
291 case 2: \
292 __asm__ __volatile__ ( \
293 _PRE_EFLAGS("0","4","2") \
294 _op"w %"_wx"3,%1; " \
295 _POST_EFLAGS("0","4","2") \
296 : "=m" (_eflags), "=m" ((_dst).val), \
297 "=&r" (_tmp) \
298 : _wy ((_src).val), "i" (EFLAGS_MASK) ); \
299 break; \
300 case 4: \
301 __asm__ __volatile__ ( \
302 _PRE_EFLAGS("0","4","2") \
303 _op"l %"_lx"3,%1; " \
304 _POST_EFLAGS("0","4","2") \
305 : "=m" (_eflags), "=m" ((_dst).val), \
306 "=&r" (_tmp) \
307 : _ly ((_src).val), "i" (EFLAGS_MASK) ); \
308 break; \
309 case 8: \
310 __emulate_2op_8byte(_op, _src, _dst, \
311 _eflags, _qx, _qy); \
312 break; \
313 } \
314 } while (0)
315
316 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
317 do { \
318 unsigned long _tmp; \
319 switch ( (_dst).bytes ) \
320 { \
321 case 1: \
322 __asm__ __volatile__ ( \
323 _PRE_EFLAGS("0","4","2") \
324 _op"b %"_bx"3,%1; " \
325 _POST_EFLAGS("0","4","2") \
326 : "=m" (_eflags), "=m" ((_dst).val), \
327 "=&r" (_tmp) \
328 : _by ((_src).val), "i" (EFLAGS_MASK) ); \
329 break; \
330 default: \
331 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
332 _wx, _wy, _lx, _ly, _qx, _qy); \
333 break; \
334 } \
335 } while (0)
336
337 /* Source operand is byte-sized and may be restricted to just %cl. */
338 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
339 __emulate_2op(_op, _src, _dst, _eflags, \
340 "b", "c", "b", "c", "b", "c", "b", "c")
341
342 /* Source operand is byte, word, long or quad sized. */
343 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
344 __emulate_2op(_op, _src, _dst, _eflags, \
345 "b", "q", "w", "r", _LO32, "r", "", "r")
346
347 /* Source operand is word, long or quad sized. */
348 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
349 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
350 "w", "r", _LO32, "r", "", "r")
351
352 /* Instruction has only one explicit operand (no source operand). */
353 #define emulate_1op(_op, _dst, _eflags) \
354 do { \
355 unsigned long _tmp; \
356 \
357 switch ( (_dst).bytes ) \
358 { \
359 case 1: \
360 __asm__ __volatile__ ( \
361 _PRE_EFLAGS("0","3","2") \
362 _op"b %1; " \
363 _POST_EFLAGS("0","3","2") \
364 : "=m" (_eflags), "=m" ((_dst).val), \
365 "=&r" (_tmp) \
366 : "i" (EFLAGS_MASK) ); \
367 break; \
368 case 2: \
369 __asm__ __volatile__ ( \
370 _PRE_EFLAGS("0","3","2") \
371 _op"w %1; " \
372 _POST_EFLAGS("0","3","2") \
373 : "=m" (_eflags), "=m" ((_dst).val), \
374 "=&r" (_tmp) \
375 : "i" (EFLAGS_MASK) ); \
376 break; \
377 case 4: \
378 __asm__ __volatile__ ( \
379 _PRE_EFLAGS("0","3","2") \
380 _op"l %1; " \
381 _POST_EFLAGS("0","3","2") \
382 : "=m" (_eflags), "=m" ((_dst).val), \
383 "=&r" (_tmp) \
384 : "i" (EFLAGS_MASK) ); \
385 break; \
386 case 8: \
387 __emulate_1op_8byte(_op, _dst, _eflags); \
388 break; \
389 } \
390 } while (0)
391
392 /* Emulate an instruction with quadword operands (x86/64 only). */
393 #if defined(CONFIG_X86_64)
394 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy) \
395 do { \
396 __asm__ __volatile__ ( \
397 _PRE_EFLAGS("0","4","2") \
398 _op"q %"_qx"3,%1; " \
399 _POST_EFLAGS("0","4","2") \
400 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
401 : _qy ((_src).val), "i" (EFLAGS_MASK) ); \
402 } while (0)
403
404 #define __emulate_1op_8byte(_op, _dst, _eflags) \
405 do { \
406 __asm__ __volatile__ ( \
407 _PRE_EFLAGS("0","3","2") \
408 _op"q %1; " \
409 _POST_EFLAGS("0","3","2") \
410 : "=m" (_eflags), "=m" ((_dst).val), "=&r" (_tmp) \
411 : "i" (EFLAGS_MASK) ); \
412 } while (0)
413
414 #elif defined(__i386__)
415 #define __emulate_2op_8byte(_op, _src, _dst, _eflags, _qx, _qy)
416 #define __emulate_1op_8byte(_op, _dst, _eflags)
417 #endif /* __i386__ */
418
419 /* Fetch next part of the instruction being emulated. */
420 #define insn_fetch(_type, _size, _eip) \
421 ({ unsigned long _x; \
422 rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x, \
423 (_size), ctxt); \
424 if ( rc != 0 ) \
425 goto done; \
426 (_eip) += (_size); \
427 (_type)_x; \
428 })
429
430 /* Access/update address held in a register, based on addressing mode. */
431 #define register_address(base, reg) \
432 ((base) + ((ad_bytes == sizeof(unsigned long)) ? (reg) : \
433 ((reg) & ((1UL << (ad_bytes << 3)) - 1))))
434
435 #define register_address_increment(reg, inc) \
436 do { \
437 /* signed type ensures sign extension to long */ \
438 int _inc = (inc); \
439 if ( ad_bytes == sizeof(unsigned long) ) \
440 (reg) += _inc; \
441 else \
442 (reg) = ((reg) & ~((1UL << (ad_bytes << 3)) - 1)) | \
443 (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
444 } while (0)
445
446 void *decode_register(u8 modrm_reg, unsigned long *regs,
447 int highbyte_regs)
448 {
449 void *p;
450
451 p = &regs[modrm_reg];
452 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
453 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
454 return p;
455 }
456
457 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
458 struct x86_emulate_ops *ops,
459 void *ptr,
460 u16 *size, unsigned long *address, int op_bytes)
461 {
462 int rc;
463
464 if (op_bytes == 2)
465 op_bytes = 3;
466 *address = 0;
467 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2, ctxt);
468 if (rc)
469 return rc;
470 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes, ctxt);
471 return rc;
472 }
473
474 int
475 x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
476 {
477 unsigned d;
478 u8 b, sib, twobyte = 0, rex_prefix = 0;
479 u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
480 unsigned long *override_base = NULL;
481 unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
482 int rc = 0;
483 struct operand src, dst;
484 unsigned long cr2 = ctxt->cr2;
485 int mode = ctxt->mode;
486 unsigned long modrm_ea;
487 int use_modrm_ea, index_reg = 0, base_reg = 0, scale, rip_relative = 0;
488 int no_wb = 0;
489 u64 msr_data;
490
491 /* Shadow copy of register state. Committed on successful emulation. */
492 unsigned long _regs[NR_VCPU_REGS];
493 unsigned long _eip = ctxt->vcpu->rip, _eflags = ctxt->eflags;
494 unsigned long modrm_val = 0;
495
496 memcpy(_regs, ctxt->vcpu->regs, sizeof _regs);
497
498 switch (mode) {
499 case X86EMUL_MODE_REAL:
500 case X86EMUL_MODE_PROT16:
501 op_bytes = ad_bytes = 2;
502 break;
503 case X86EMUL_MODE_PROT32:
504 op_bytes = ad_bytes = 4;
505 break;
506 #ifdef CONFIG_X86_64
507 case X86EMUL_MODE_PROT64:
508 op_bytes = 4;
509 ad_bytes = 8;
510 break;
511 #endif
512 default:
513 return -1;
514 }
515
516 /* Legacy prefixes. */
517 for (i = 0; i < 8; i++) {
518 switch (b = insn_fetch(u8, 1, _eip)) {
519 case 0x66: /* operand-size override */
520 op_bytes ^= 6; /* switch between 2/4 bytes */
521 break;
522 case 0x67: /* address-size override */
523 if (mode == X86EMUL_MODE_PROT64)
524 ad_bytes ^= 12; /* switch between 4/8 bytes */
525 else
526 ad_bytes ^= 6; /* switch between 2/4 bytes */
527 break;
528 case 0x2e: /* CS override */
529 override_base = &ctxt->cs_base;
530 break;
531 case 0x3e: /* DS override */
532 override_base = &ctxt->ds_base;
533 break;
534 case 0x26: /* ES override */
535 override_base = &ctxt->es_base;
536 break;
537 case 0x64: /* FS override */
538 override_base = &ctxt->fs_base;
539 break;
540 case 0x65: /* GS override */
541 override_base = &ctxt->gs_base;
542 break;
543 case 0x36: /* SS override */
544 override_base = &ctxt->ss_base;
545 break;
546 case 0xf0: /* LOCK */
547 lock_prefix = 1;
548 break;
549 case 0xf3: /* REP/REPE/REPZ */
550 rep_prefix = 1;
551 break;
552 case 0xf2: /* REPNE/REPNZ */
553 break;
554 default:
555 goto done_prefixes;
556 }
557 }
558
559 done_prefixes:
560
561 /* REX prefix. */
562 if ((mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40)) {
563 rex_prefix = b;
564 if (b & 8)
565 op_bytes = 8; /* REX.W */
566 modrm_reg = (b & 4) << 1; /* REX.R */
567 index_reg = (b & 2) << 2; /* REX.X */
568 modrm_rm = base_reg = (b & 1) << 3; /* REG.B */
569 b = insn_fetch(u8, 1, _eip);
570 }
571
572 /* Opcode byte(s). */
573 d = opcode_table[b];
574 if (d == 0) {
575 /* Two-byte opcode? */
576 if (b == 0x0f) {
577 twobyte = 1;
578 b = insn_fetch(u8, 1, _eip);
579 d = twobyte_table[b];
580 }
581
582 /* Unrecognised? */
583 if (d == 0)
584 goto cannot_emulate;
585 }
586
587 /* ModRM and SIB bytes. */
588 if (d & ModRM) {
589 modrm = insn_fetch(u8, 1, _eip);
590 modrm_mod |= (modrm & 0xc0) >> 6;
591 modrm_reg |= (modrm & 0x38) >> 3;
592 modrm_rm |= (modrm & 0x07);
593 modrm_ea = 0;
594 use_modrm_ea = 1;
595
596 if (modrm_mod == 3) {
597 modrm_val = *(unsigned long *)
598 decode_register(modrm_rm, _regs, d & ByteOp);
599 goto modrm_done;
600 }
601
602 if (ad_bytes == 2) {
603 unsigned bx = _regs[VCPU_REGS_RBX];
604 unsigned bp = _regs[VCPU_REGS_RBP];
605 unsigned si = _regs[VCPU_REGS_RSI];
606 unsigned di = _regs[VCPU_REGS_RDI];
607
608 /* 16-bit ModR/M decode. */
609 switch (modrm_mod) {
610 case 0:
611 if (modrm_rm == 6)
612 modrm_ea += insn_fetch(u16, 2, _eip);
613 break;
614 case 1:
615 modrm_ea += insn_fetch(s8, 1, _eip);
616 break;
617 case 2:
618 modrm_ea += insn_fetch(u16, 2, _eip);
619 break;
620 }
621 switch (modrm_rm) {
622 case 0:
623 modrm_ea += bx + si;
624 break;
625 case 1:
626 modrm_ea += bx + di;
627 break;
628 case 2:
629 modrm_ea += bp + si;
630 break;
631 case 3:
632 modrm_ea += bp + di;
633 break;
634 case 4:
635 modrm_ea += si;
636 break;
637 case 5:
638 modrm_ea += di;
639 break;
640 case 6:
641 if (modrm_mod != 0)
642 modrm_ea += bp;
643 break;
644 case 7:
645 modrm_ea += bx;
646 break;
647 }
648 if (modrm_rm == 2 || modrm_rm == 3 ||
649 (modrm_rm == 6 && modrm_mod != 0))
650 if (!override_base)
651 override_base = &ctxt->ss_base;
652 modrm_ea = (u16)modrm_ea;
653 } else {
654 /* 32/64-bit ModR/M decode. */
655 switch (modrm_rm) {
656 case 4:
657 case 12:
658 sib = insn_fetch(u8, 1, _eip);
659 index_reg |= (sib >> 3) & 7;
660 base_reg |= sib & 7;
661 scale = sib >> 6;
662
663 switch (base_reg) {
664 case 5:
665 if (modrm_mod != 0)
666 modrm_ea += _regs[base_reg];
667 else
668 modrm_ea += insn_fetch(s32, 4, _eip);
669 break;
670 default:
671 modrm_ea += _regs[base_reg];
672 }
673 switch (index_reg) {
674 case 4:
675 break;
676 default:
677 modrm_ea += _regs[index_reg] << scale;
678
679 }
680 break;
681 case 5:
682 if (modrm_mod != 0)
683 modrm_ea += _regs[modrm_rm];
684 else if (mode == X86EMUL_MODE_PROT64)
685 rip_relative = 1;
686 break;
687 default:
688 modrm_ea += _regs[modrm_rm];
689 break;
690 }
691 switch (modrm_mod) {
692 case 0:
693 if (modrm_rm == 5)
694 modrm_ea += insn_fetch(s32, 4, _eip);
695 break;
696 case 1:
697 modrm_ea += insn_fetch(s8, 1, _eip);
698 break;
699 case 2:
700 modrm_ea += insn_fetch(s32, 4, _eip);
701 break;
702 }
703 }
704 if (!override_base)
705 override_base = &ctxt->ds_base;
706 if (mode == X86EMUL_MODE_PROT64 &&
707 override_base != &ctxt->fs_base &&
708 override_base != &ctxt->gs_base)
709 override_base = NULL;
710
711 if (override_base)
712 modrm_ea += *override_base;
713
714 if (rip_relative) {
715 modrm_ea += _eip;
716 switch (d & SrcMask) {
717 case SrcImmByte:
718 modrm_ea += 1;
719 break;
720 case SrcImm:
721 if (d & ByteOp)
722 modrm_ea += 1;
723 else
724 if (op_bytes == 8)
725 modrm_ea += 4;
726 else
727 modrm_ea += op_bytes;
728 }
729 }
730 if (ad_bytes != 8)
731 modrm_ea = (u32)modrm_ea;
732 cr2 = modrm_ea;
733 modrm_done:
734 ;
735 }
736
737 /*
738 * Decode and fetch the source operand: register, memory
739 * or immediate.
740 */
741 switch (d & SrcMask) {
742 case SrcNone:
743 break;
744 case SrcReg:
745 src.type = OP_REG;
746 if (d & ByteOp) {
747 src.ptr = decode_register(modrm_reg, _regs,
748 (rex_prefix == 0));
749 src.val = src.orig_val = *(u8 *) src.ptr;
750 src.bytes = 1;
751 } else {
752 src.ptr = decode_register(modrm_reg, _regs, 0);
753 switch ((src.bytes = op_bytes)) {
754 case 2:
755 src.val = src.orig_val = *(u16 *) src.ptr;
756 break;
757 case 4:
758 src.val = src.orig_val = *(u32 *) src.ptr;
759 break;
760 case 8:
761 src.val = src.orig_val = *(u64 *) src.ptr;
762 break;
763 }
764 }
765 break;
766 case SrcMem16:
767 src.bytes = 2;
768 goto srcmem_common;
769 case SrcMem32:
770 src.bytes = 4;
771 goto srcmem_common;
772 case SrcMem:
773 src.bytes = (d & ByteOp) ? 1 : op_bytes;
774 srcmem_common:
775 src.type = OP_MEM;
776 src.ptr = (unsigned long *)cr2;
777 if ((rc = ops->read_emulated((unsigned long)src.ptr,
778 &src.val, src.bytes, ctxt)) != 0)
779 goto done;
780 src.orig_val = src.val;
781 break;
782 case SrcImm:
783 src.type = OP_IMM;
784 src.ptr = (unsigned long *)_eip;
785 src.bytes = (d & ByteOp) ? 1 : op_bytes;
786 if (src.bytes == 8)
787 src.bytes = 4;
788 /* NB. Immediates are sign-extended as necessary. */
789 switch (src.bytes) {
790 case 1:
791 src.val = insn_fetch(s8, 1, _eip);
792 break;
793 case 2:
794 src.val = insn_fetch(s16, 2, _eip);
795 break;
796 case 4:
797 src.val = insn_fetch(s32, 4, _eip);
798 break;
799 }
800 break;
801 case SrcImmByte:
802 src.type = OP_IMM;
803 src.ptr = (unsigned long *)_eip;
804 src.bytes = 1;
805 src.val = insn_fetch(s8, 1, _eip);
806 break;
807 }
808
809 /* Decode and fetch the destination operand: register or memory. */
810 switch (d & DstMask) {
811 case ImplicitOps:
812 /* Special instructions do their own operand decoding. */
813 goto special_insn;
814 case DstReg:
815 dst.type = OP_REG;
816 if ((d & ByteOp)
817 && !(twobyte_table && (b == 0xb6 || b == 0xb7))) {
818 dst.ptr = decode_register(modrm_reg, _regs,
819 (rex_prefix == 0));
820 dst.val = *(u8 *) dst.ptr;
821 dst.bytes = 1;
822 } else {
823 dst.ptr = decode_register(modrm_reg, _regs, 0);
824 switch ((dst.bytes = op_bytes)) {
825 case 2:
826 dst.val = *(u16 *)dst.ptr;
827 break;
828 case 4:
829 dst.val = *(u32 *)dst.ptr;
830 break;
831 case 8:
832 dst.val = *(u64 *)dst.ptr;
833 break;
834 }
835 }
836 break;
837 case DstMem:
838 dst.type = OP_MEM;
839 dst.ptr = (unsigned long *)cr2;
840 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
841 if (d & BitOp) {
842 unsigned long mask = ~(dst.bytes * 8 - 1);
843
844 dst.ptr = (void *)dst.ptr + (src.val & mask) / 8;
845 }
846 if (!(d & Mov) && /* optimisation - avoid slow emulated read */
847 ((rc = ops->read_emulated((unsigned long)dst.ptr,
848 &dst.val, dst.bytes, ctxt)) != 0))
849 goto done;
850 break;
851 }
852 dst.orig_val = dst.val;
853
854 if (twobyte)
855 goto twobyte_insn;
856
857 switch (b) {
858 case 0x00 ... 0x05:
859 add: /* add */
860 emulate_2op_SrcV("add", src, dst, _eflags);
861 break;
862 case 0x08 ... 0x0d:
863 or: /* or */
864 emulate_2op_SrcV("or", src, dst, _eflags);
865 break;
866 case 0x10 ... 0x15:
867 adc: /* adc */
868 emulate_2op_SrcV("adc", src, dst, _eflags);
869 break;
870 case 0x18 ... 0x1d:
871 sbb: /* sbb */
872 emulate_2op_SrcV("sbb", src, dst, _eflags);
873 break;
874 case 0x20 ... 0x25:
875 and: /* and */
876 emulate_2op_SrcV("and", src, dst, _eflags);
877 break;
878 case 0x28 ... 0x2d:
879 sub: /* sub */
880 emulate_2op_SrcV("sub", src, dst, _eflags);
881 break;
882 case 0x30 ... 0x35:
883 xor: /* xor */
884 emulate_2op_SrcV("xor", src, dst, _eflags);
885 break;
886 case 0x38 ... 0x3d:
887 cmp: /* cmp */
888 emulate_2op_SrcV("cmp", src, dst, _eflags);
889 break;
890 case 0x63: /* movsxd */
891 if (mode != X86EMUL_MODE_PROT64)
892 goto cannot_emulate;
893 dst.val = (s32) src.val;
894 break;
895 case 0x80 ... 0x83: /* Grp1 */
896 switch (modrm_reg) {
897 case 0:
898 goto add;
899 case 1:
900 goto or;
901 case 2:
902 goto adc;
903 case 3:
904 goto sbb;
905 case 4:
906 goto and;
907 case 5:
908 goto sub;
909 case 6:
910 goto xor;
911 case 7:
912 goto cmp;
913 }
914 break;
915 case 0x84 ... 0x85:
916 test: /* test */
917 emulate_2op_SrcV("test", src, dst, _eflags);
918 break;
919 case 0x86 ... 0x87: /* xchg */
920 /* Write back the register source. */
921 switch (dst.bytes) {
922 case 1:
923 *(u8 *) src.ptr = (u8) dst.val;
924 break;
925 case 2:
926 *(u16 *) src.ptr = (u16) dst.val;
927 break;
928 case 4:
929 *src.ptr = (u32) dst.val;
930 break; /* 64b reg: zero-extend */
931 case 8:
932 *src.ptr = dst.val;
933 break;
934 }
935 /*
936 * Write back the memory destination with implicit LOCK
937 * prefix.
938 */
939 dst.val = src.val;
940 lock_prefix = 1;
941 break;
942 case 0xa0 ... 0xa1: /* mov */
943 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
944 dst.val = src.val;
945 _eip += ad_bytes; /* skip src displacement */
946 break;
947 case 0xa2 ... 0xa3: /* mov */
948 dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
949 _eip += ad_bytes; /* skip dst displacement */
950 break;
951 case 0x88 ... 0x8b: /* mov */
952 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
953 dst.val = src.val;
954 break;
955 case 0x8f: /* pop (sole member of Grp1a) */
956 /* 64-bit mode: POP always pops a 64-bit operand. */
957 if (mode == X86EMUL_MODE_PROT64)
958 dst.bytes = 8;
959 if ((rc = ops->read_std(register_address(ctxt->ss_base,
960 _regs[VCPU_REGS_RSP]),
961 &dst.val, dst.bytes, ctxt)) != 0)
962 goto done;
963 register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
964 break;
965 case 0xc0 ... 0xc1:
966 grp2: /* Grp2 */
967 switch (modrm_reg) {
968 case 0: /* rol */
969 emulate_2op_SrcB("rol", src, dst, _eflags);
970 break;
971 case 1: /* ror */
972 emulate_2op_SrcB("ror", src, dst, _eflags);
973 break;
974 case 2: /* rcl */
975 emulate_2op_SrcB("rcl", src, dst, _eflags);
976 break;
977 case 3: /* rcr */
978 emulate_2op_SrcB("rcr", src, dst, _eflags);
979 break;
980 case 4: /* sal/shl */
981 case 6: /* sal/shl */
982 emulate_2op_SrcB("sal", src, dst, _eflags);
983 break;
984 case 5: /* shr */
985 emulate_2op_SrcB("shr", src, dst, _eflags);
986 break;
987 case 7: /* sar */
988 emulate_2op_SrcB("sar", src, dst, _eflags);
989 break;
990 }
991 break;
992 case 0xd0 ... 0xd1: /* Grp2 */
993 src.val = 1;
994 goto grp2;
995 case 0xd2 ... 0xd3: /* Grp2 */
996 src.val = _regs[VCPU_REGS_RCX];
997 goto grp2;
998 case 0xf6 ... 0xf7: /* Grp3 */
999 switch (modrm_reg) {
1000 case 0 ... 1: /* test */
1001 /*
1002 * Special case in Grp3: test has an immediate
1003 * source operand.
1004 */
1005 src.type = OP_IMM;
1006 src.ptr = (unsigned long *)_eip;
1007 src.bytes = (d & ByteOp) ? 1 : op_bytes;
1008 if (src.bytes == 8)
1009 src.bytes = 4;
1010 switch (src.bytes) {
1011 case 1:
1012 src.val = insn_fetch(s8, 1, _eip);
1013 break;
1014 case 2:
1015 src.val = insn_fetch(s16, 2, _eip);
1016 break;
1017 case 4:
1018 src.val = insn_fetch(s32, 4, _eip);
1019 break;
1020 }
1021 goto test;
1022 case 2: /* not */
1023 dst.val = ~dst.val;
1024 break;
1025 case 3: /* neg */
1026 emulate_1op("neg", dst, _eflags);
1027 break;
1028 default:
1029 goto cannot_emulate;
1030 }
1031 break;
1032 case 0xfe ... 0xff: /* Grp4/Grp5 */
1033 switch (modrm_reg) {
1034 case 0: /* inc */
1035 emulate_1op("inc", dst, _eflags);
1036 break;
1037 case 1: /* dec */
1038 emulate_1op("dec", dst, _eflags);
1039 break;
1040 case 6: /* push */
1041 /* 64-bit mode: PUSH always pushes a 64-bit operand. */
1042 if (mode == X86EMUL_MODE_PROT64) {
1043 dst.bytes = 8;
1044 if ((rc = ops->read_std((unsigned long)dst.ptr,
1045 &dst.val, 8,
1046 ctxt)) != 0)
1047 goto done;
1048 }
1049 register_address_increment(_regs[VCPU_REGS_RSP],
1050 -dst.bytes);
1051 if ((rc = ops->write_std(
1052 register_address(ctxt->ss_base,
1053 _regs[VCPU_REGS_RSP]),
1054 &dst.val, dst.bytes, ctxt)) != 0)
1055 goto done;
1056 no_wb = 1;
1057 break;
1058 default:
1059 goto cannot_emulate;
1060 }
1061 break;
1062 }
1063
1064 writeback:
1065 if (!no_wb) {
1066 switch (dst.type) {
1067 case OP_REG:
1068 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1069 switch (dst.bytes) {
1070 case 1:
1071 *(u8 *)dst.ptr = (u8)dst.val;
1072 break;
1073 case 2:
1074 *(u16 *)dst.ptr = (u16)dst.val;
1075 break;
1076 case 4:
1077 *dst.ptr = (u32)dst.val;
1078 break; /* 64b: zero-ext */
1079 case 8:
1080 *dst.ptr = dst.val;
1081 break;
1082 }
1083 break;
1084 case OP_MEM:
1085 if (lock_prefix)
1086 rc = ops->cmpxchg_emulated((unsigned long)dst.
1087 ptr, &dst.orig_val,
1088 &dst.val, dst.bytes,
1089 ctxt);
1090 else
1091 rc = ops->write_emulated((unsigned long)dst.ptr,
1092 &dst.val, dst.bytes,
1093 ctxt);
1094 if (rc != 0)
1095 goto done;
1096 default:
1097 break;
1098 }
1099 }
1100
1101 /* Commit shadow register state. */
1102 memcpy(ctxt->vcpu->regs, _regs, sizeof _regs);
1103 ctxt->eflags = _eflags;
1104 ctxt->vcpu->rip = _eip;
1105
1106 done:
1107 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1108
1109 special_insn:
1110 if (twobyte)
1111 goto twobyte_special_insn;
1112 if (rep_prefix) {
1113 if (_regs[VCPU_REGS_RCX] == 0) {
1114 ctxt->vcpu->rip = _eip;
1115 goto done;
1116 }
1117 _regs[VCPU_REGS_RCX]--;
1118 _eip = ctxt->vcpu->rip;
1119 }
1120 switch (b) {
1121 case 0xa4 ... 0xa5: /* movs */
1122 dst.type = OP_MEM;
1123 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1124 dst.ptr = (unsigned long *)register_address(ctxt->es_base,
1125 _regs[VCPU_REGS_RDI]);
1126 if ((rc = ops->read_emulated(register_address(
1127 override_base ? *override_base : ctxt->ds_base,
1128 _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt)) != 0)
1129 goto done;
1130 register_address_increment(_regs[VCPU_REGS_RSI],
1131 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1132 register_address_increment(_regs[VCPU_REGS_RDI],
1133 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1134 break;
1135 case 0xa6 ... 0xa7: /* cmps */
1136 DPRINTF("Urk! I don't handle CMPS.\n");
1137 goto cannot_emulate;
1138 case 0xaa ... 0xab: /* stos */
1139 dst.type = OP_MEM;
1140 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1141 dst.ptr = (unsigned long *)cr2;
1142 dst.val = _regs[VCPU_REGS_RAX];
1143 register_address_increment(_regs[VCPU_REGS_RDI],
1144 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1145 break;
1146 case 0xac ... 0xad: /* lods */
1147 dst.type = OP_REG;
1148 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
1149 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1150 if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes, ctxt)) != 0)
1151 goto done;
1152 register_address_increment(_regs[VCPU_REGS_RSI],
1153 (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
1154 break;
1155 case 0xae ... 0xaf: /* scas */
1156 DPRINTF("Urk! I don't handle SCAS.\n");
1157 goto cannot_emulate;
1158 case 0xf4: /* hlt */
1159 ctxt->vcpu->halt_request = 1;
1160 goto done;
1161 case 0xc3: /* ret */
1162 dst.ptr = &_eip;
1163 goto pop_instruction;
1164 case 0x58 ... 0x5f: /* pop reg */
1165 dst.ptr = (unsigned long *)&_regs[b & 0x7];
1166
1167 pop_instruction:
1168 if ((rc = ops->read_std(register_address(ctxt->ss_base,
1169 _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt)) != 0)
1170 goto done;
1171
1172 register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
1173 no_wb = 1; /* Disable writeback. */
1174 break;
1175 }
1176 goto writeback;
1177
1178 twobyte_insn:
1179 switch (b) {
1180 case 0x01: /* lgdt, lidt, lmsw */
1181 switch (modrm_reg) {
1182 u16 size;
1183 unsigned long address;
1184
1185 case 2: /* lgdt */
1186 rc = read_descriptor(ctxt, ops, src.ptr,
1187 &size, &address, op_bytes);
1188 if (rc)
1189 goto done;
1190 realmode_lgdt(ctxt->vcpu, size, address);
1191 break;
1192 case 3: /* lidt */
1193 rc = read_descriptor(ctxt, ops, src.ptr,
1194 &size, &address, op_bytes);
1195 if (rc)
1196 goto done;
1197 realmode_lidt(ctxt->vcpu, size, address);
1198 break;
1199 case 4: /* smsw */
1200 if (modrm_mod != 3)
1201 goto cannot_emulate;
1202 *(u16 *)&_regs[modrm_rm]
1203 = realmode_get_cr(ctxt->vcpu, 0);
1204 break;
1205 case 6: /* lmsw */
1206 if (modrm_mod != 3)
1207 goto cannot_emulate;
1208 realmode_lmsw(ctxt->vcpu, (u16)modrm_val, &_eflags);
1209 break;
1210 case 7: /* invlpg*/
1211 emulate_invlpg(ctxt->vcpu, cr2);
1212 break;
1213 default:
1214 goto cannot_emulate;
1215 }
1216 break;
1217 case 0x21: /* mov from dr to reg */
1218 if (modrm_mod != 3)
1219 goto cannot_emulate;
1220 rc = emulator_get_dr(ctxt, modrm_reg, &_regs[modrm_rm]);
1221 break;
1222 case 0x23: /* mov from reg to dr */
1223 if (modrm_mod != 3)
1224 goto cannot_emulate;
1225 rc = emulator_set_dr(ctxt, modrm_reg, _regs[modrm_rm]);
1226 break;
1227 case 0x40 ... 0x4f: /* cmov */
1228 dst.val = dst.orig_val = src.val;
1229 d &= ~Mov; /* default to no move */
1230 /*
1231 * First, assume we're decoding an even cmov opcode
1232 * (lsb == 0).
1233 */
1234 switch ((b & 15) >> 1) {
1235 case 0: /* cmovo */
1236 d |= (_eflags & EFLG_OF) ? Mov : 0;
1237 break;
1238 case 1: /* cmovb/cmovc/cmovnae */
1239 d |= (_eflags & EFLG_CF) ? Mov : 0;
1240 break;
1241 case 2: /* cmovz/cmove */
1242 d |= (_eflags & EFLG_ZF) ? Mov : 0;
1243 break;
1244 case 3: /* cmovbe/cmovna */
1245 d |= (_eflags & (EFLG_CF | EFLG_ZF)) ? Mov : 0;
1246 break;
1247 case 4: /* cmovs */
1248 d |= (_eflags & EFLG_SF) ? Mov : 0;
1249 break;
1250 case 5: /* cmovp/cmovpe */
1251 d |= (_eflags & EFLG_PF) ? Mov : 0;
1252 break;
1253 case 7: /* cmovle/cmovng */
1254 d |= (_eflags & EFLG_ZF) ? Mov : 0;
1255 /* fall through */
1256 case 6: /* cmovl/cmovnge */
1257 d |= (!(_eflags & EFLG_SF) !=
1258 !(_eflags & EFLG_OF)) ? Mov : 0;
1259 break;
1260 }
1261 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
1262 d ^= (b & 1) ? Mov : 0;
1263 break;
1264 case 0xb0 ... 0xb1: /* cmpxchg */
1265 /*
1266 * Save real source value, then compare EAX against
1267 * destination.
1268 */
1269 src.orig_val = src.val;
1270 src.val = _regs[VCPU_REGS_RAX];
1271 emulate_2op_SrcV("cmp", src, dst, _eflags);
1272 /* Always write back. The question is: where to? */
1273 d |= Mov;
1274 if (_eflags & EFLG_ZF) {
1275 /* Success: write back to memory. */
1276 dst.val = src.orig_val;
1277 } else {
1278 /* Failure: write the value we saw to EAX. */
1279 dst.type = OP_REG;
1280 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
1281 }
1282 break;
1283 case 0xa3:
1284 bt: /* bt */
1285 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1286 emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
1287 break;
1288 case 0xb3:
1289 btr: /* btr */
1290 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1291 emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
1292 break;
1293 case 0xab:
1294 bts: /* bts */
1295 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1296 emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
1297 break;
1298 case 0xb6 ... 0xb7: /* movzx */
1299 dst.bytes = op_bytes;
1300 dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
1301 break;
1302 case 0xbb:
1303 btc: /* btc */
1304 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
1305 emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
1306 break;
1307 case 0xba: /* Grp8 */
1308 switch (modrm_reg & 3) {
1309 case 0:
1310 goto bt;
1311 case 1:
1312 goto bts;
1313 case 2:
1314 goto btr;
1315 case 3:
1316 goto btc;
1317 }
1318 break;
1319 case 0xbe ... 0xbf: /* movsx */
1320 dst.bytes = op_bytes;
1321 dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
1322 break;
1323 }
1324 goto writeback;
1325
1326 twobyte_special_insn:
1327 /* Disable writeback. */
1328 no_wb = 1;
1329 switch (b) {
1330 case 0x09: /* wbinvd */
1331 break;
1332 case 0x0d: /* GrpP (prefetch) */
1333 case 0x18: /* Grp16 (prefetch/nop) */
1334 break;
1335 case 0x06:
1336 emulate_clts(ctxt->vcpu);
1337 break;
1338 case 0x20: /* mov cr, reg */
1339 if (modrm_mod != 3)
1340 goto cannot_emulate;
1341 _regs[modrm_rm] = realmode_get_cr(ctxt->vcpu, modrm_reg);
1342 break;
1343 case 0x22: /* mov reg, cr */
1344 if (modrm_mod != 3)
1345 goto cannot_emulate;
1346 realmode_set_cr(ctxt->vcpu, modrm_reg, modrm_val, &_eflags);
1347 break;
1348 case 0x30:
1349 /* wrmsr */
1350 msr_data = (u32)_regs[VCPU_REGS_RAX]
1351 | ((u64)_regs[VCPU_REGS_RDX] << 32);
1352 rc = kvm_set_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], msr_data);
1353 if (rc) {
1354 kvm_arch_ops->inject_gp(ctxt->vcpu, 0);
1355 _eip = ctxt->vcpu->rip;
1356 }
1357 rc = X86EMUL_CONTINUE;
1358 break;
1359 case 0x32:
1360 /* rdmsr */
1361 rc = kvm_get_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], &msr_data);
1362 if (rc) {
1363 kvm_arch_ops->inject_gp(ctxt->vcpu, 0);
1364 _eip = ctxt->vcpu->rip;
1365 } else {
1366 _regs[VCPU_REGS_RAX] = (u32)msr_data;
1367 _regs[VCPU_REGS_RDX] = msr_data >> 32;
1368 }
1369 rc = X86EMUL_CONTINUE;
1370 break;
1371 case 0xc7: /* Grp9 (cmpxchg8b) */
1372 {
1373 u64 old, new;
1374 if ((rc = ops->read_emulated(cr2, &old, 8, ctxt)) != 0)
1375 goto done;
1376 if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
1377 ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
1378 _regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1379 _regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1380 _eflags &= ~EFLG_ZF;
1381 } else {
1382 new = ((u64)_regs[VCPU_REGS_RCX] << 32)
1383 | (u32) _regs[VCPU_REGS_RBX];
1384 if ((rc = ops->cmpxchg_emulated(cr2, &old,
1385 &new, 8, ctxt)) != 0)
1386 goto done;
1387 _eflags |= EFLG_ZF;
1388 }
1389 break;
1390 }
1391 }
1392 goto writeback;
1393
1394 cannot_emulate:
1395 DPRINTF("Cannot emulate %02x\n", b);
1396 return -1;
1397 }
1398
1399 #ifdef __XEN__
1400
1401 #include <asm/mm.h>
1402 #include <asm/uaccess.h>
1403
1404 int
1405 x86_emulate_read_std(unsigned long addr,
1406 unsigned long *val,
1407 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1408 {
1409 unsigned int rc;
1410
1411 *val = 0;
1412
1413 if ((rc = copy_from_user((void *)val, (void *)addr, bytes)) != 0) {
1414 propagate_page_fault(addr + bytes - rc, 0); /* read fault */
1415 return X86EMUL_PROPAGATE_FAULT;
1416 }
1417
1418 return X86EMUL_CONTINUE;
1419 }
1420
1421 int
1422 x86_emulate_write_std(unsigned long addr,
1423 unsigned long val,
1424 unsigned int bytes, struct x86_emulate_ctxt *ctxt)
1425 {
1426 unsigned int rc;
1427
1428 if ((rc = copy_to_user((void *)addr, (void *)&val, bytes)) != 0) {
1429 propagate_page_fault(addr + bytes - rc, PGERR_write_access);
1430 return X86EMUL_PROPAGATE_FAULT;
1431 }
1432
1433 return X86EMUL_CONTINUE;
1434 }
1435
1436 #endif
AMDTP streaming driver for the Linux FireWire stack (Juju)