1 /******************************************************************************
2  * x86_emulate.h
3  *
4  * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5  *
6  * Copyright (c) 2005 Keir Fraser
7  *
8  * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
9  */
10 
11 #ifndef _ASM_X86_KVM_X86_EMULATE_H
12 #define _ASM_X86_KVM_X86_EMULATE_H
13 
14 #include <asm/desc_defs.h>
15 
16 struct x86_emulate_ctxt;
17 enum x86_intercept;
18 enum x86_intercept_stage;
19 
20 struct x86_exception {
21 	u8 vector;
22 	bool error_code_valid;
23 	u16 error_code;
24 	bool nested_page_fault;
25 	u64 address; /* cr2 or nested page fault gpa */
26 };
27 
28 /*
29  * This struct is used to carry enough information from the instruction
30  * decoder to main KVM so that a decision can be made whether the
31  * instruction needs to be intercepted or not.
32  */
33 struct x86_instruction_info {
34 	u8  intercept;          /* which intercept                      */
35 	u8  rep_prefix;         /* rep prefix?                          */
36 	u8  modrm_mod;		/* mod part of modrm			*/
37 	u8  modrm_reg;          /* index of register used               */
38 	u8  modrm_rm;		/* rm part of modrm			*/
39 	u64 src_val;            /* value of source operand              */
40 	u8  src_bytes;          /* size of source operand               */
41 	u8  dst_bytes;          /* size of destination operand          */
42 	u8  ad_bytes;           /* size of src/dst address              */
43 	u64 next_rip;           /* rip following the instruction        */
44 };
45 
46 /*
47  * x86_emulate_ops:
48  *
49  * These operations represent the instruction emulator's interface to memory.
50  * There are two categories of operation: those that act on ordinary memory
51  * regions (*_std), and those that act on memory regions known to require
52  * special treatment or emulation (*_emulated).
53  *
54  * The emulator assumes that an instruction accesses only one 'emulated memory'
55  * location, that this location is the given linear faulting address (cr2), and
56  * that this is one of the instruction's data operands. Instruction fetches and
57  * stack operations are assumed never to access emulated memory. The emulator
58  * automatically deduces which operand of a string-move operation is accessing
59  * emulated memory, and assumes that the other operand accesses normal memory.
60  *
61  * NOTES:
62  *  1. The emulator isn't very smart about emulated vs. standard memory.
63  *     'Emulated memory' access addresses should be checked for sanity.
64  *     'Normal memory' accesses may fault, and the caller must arrange to
65  *     detect and handle reentrancy into the emulator via recursive faults.
66  *     Accesses may be unaligned and may cross page boundaries.
67  *  2. If the access fails (cannot emulate, or a standard access faults) then
68  *     it is up to the memop to propagate the fault to the guest VM via
69  *     some out-of-band mechanism, unknown to the emulator. The memop signals
70  *     failure by returning X86EMUL_PROPAGATE_FAULT to the emulator, which will
71  *     then immediately bail.
72  *  3. Valid access sizes are 1, 2, 4 and 8 bytes. On x86/32 systems only
73  *     cmpxchg8b_emulated need support 8-byte accesses.
74  *  4. The emulator cannot handle 64-bit mode emulation on an x86/32 system.
75  */
76 /* Access completed successfully: continue emulation as normal. */
77 #define X86EMUL_CONTINUE        0
78 /* Access is unhandleable: bail from emulation and return error to caller. */
79 #define X86EMUL_UNHANDLEABLE    1
80 /* Terminate emulation but return success to the caller. */
81 #define X86EMUL_PROPAGATE_FAULT 2 /* propagate a generated fault to guest */
82 #define X86EMUL_RETRY_INSTR     3 /* retry the instruction for some reason */
83 #define X86EMUL_CMPXCHG_FAILED  4 /* cmpxchg did not see expected value */
84 #define X86EMUL_IO_NEEDED       5 /* IO is needed to complete emulation */
85 #define X86EMUL_INTERCEPTED     6 /* Intercepted by nested VMCB/VMCS */
86 
87 struct x86_emulate_ops {
88 	/*
89 	 * read_std: Read bytes of standard (non-emulated/special) memory.
90 	 *           Used for descriptor reading.
91 	 *  @addr:  [IN ] Linear address from which to read.
92 	 *  @val:   [OUT] Value read from memory, zero-extended to 'u_long'.
93 	 *  @bytes: [IN ] Number of bytes to read from memory.
94 	 */
95 	int (*read_std)(struct x86_emulate_ctxt *ctxt,
96 			unsigned long addr, void *val,
97 			unsigned int bytes,
98 			struct x86_exception *fault);
99 
100 	/*
101 	 * write_std: Write bytes of standard (non-emulated/special) memory.
102 	 *            Used for descriptor writing.
103 	 *  @addr:  [IN ] Linear address to which to write.
104 	 *  @val:   [OUT] Value write to memory, zero-extended to 'u_long'.
105 	 *  @bytes: [IN ] Number of bytes to write to memory.
106 	 */
107 	int (*write_std)(struct x86_emulate_ctxt *ctxt,
108 			 unsigned long addr, void *val, unsigned int bytes,
109 			 struct x86_exception *fault);
110 	/*
111 	 * fetch: Read bytes of standard (non-emulated/special) memory.
112 	 *        Used for instruction fetch.
113 	 *  @addr:  [IN ] Linear address from which to read.
114 	 *  @val:   [OUT] Value read from memory, zero-extended to 'u_long'.
115 	 *  @bytes: [IN ] Number of bytes to read from memory.
116 	 */
117 	int (*fetch)(struct x86_emulate_ctxt *ctxt,
118 		     unsigned long addr, void *val, unsigned int bytes,
119 		     struct x86_exception *fault);
120 
121 	/*
122 	 * read_emulated: Read bytes from emulated/special memory area.
123 	 *  @addr:  [IN ] Linear address from which to read.
124 	 *  @val:   [OUT] Value read from memory, zero-extended to 'u_long'.
125 	 *  @bytes: [IN ] Number of bytes to read from memory.
126 	 */
127 	int (*read_emulated)(struct x86_emulate_ctxt *ctxt,
128 			     unsigned long addr, void *val, unsigned int bytes,
129 			     struct x86_exception *fault);
130 
131 	/*
132 	 * write_emulated: Write bytes to emulated/special memory area.
133 	 *  @addr:  [IN ] Linear address to which to write.
134 	 *  @val:   [IN ] Value to write to memory (low-order bytes used as
135 	 *                required).
136 	 *  @bytes: [IN ] Number of bytes to write to memory.
137 	 */
138 	int (*write_emulated)(struct x86_emulate_ctxt *ctxt,
139 			      unsigned long addr, const void *val,
140 			      unsigned int bytes,
141 			      struct x86_exception *fault);
142 
143 	/*
144 	 * cmpxchg_emulated: Emulate an atomic (LOCKed) CMPXCHG operation on an
145 	 *                   emulated/special memory area.
146 	 *  @addr:  [IN ] Linear address to access.
147 	 *  @old:   [IN ] Value expected to be current at @addr.
148 	 *  @new:   [IN ] Value to write to @addr.
149 	 *  @bytes: [IN ] Number of bytes to access using CMPXCHG.
150 	 */
151 	int (*cmpxchg_emulated)(struct x86_emulate_ctxt *ctxt,
152 				unsigned long addr,
153 				const void *old,
154 				const void *new,
155 				unsigned int bytes,
156 				struct x86_exception *fault);
157 	void (*invlpg)(struct x86_emulate_ctxt *ctxt, ulong addr);
158 
159 	int (*pio_in_emulated)(struct x86_emulate_ctxt *ctxt,
160 			       int size, unsigned short port, void *val,
161 			       unsigned int count);
162 
163 	int (*pio_out_emulated)(struct x86_emulate_ctxt *ctxt,
164 				int size, unsigned short port, const void *val,
165 				unsigned int count);
166 
167 	bool (*get_segment)(struct x86_emulate_ctxt *ctxt, u16 *selector,
168 			    struct desc_struct *desc, u32 *base3, int seg);
169 	void (*set_segment)(struct x86_emulate_ctxt *ctxt, u16 selector,
170 			    struct desc_struct *desc, u32 base3, int seg);
171 	unsigned long (*get_cached_segment_base)(struct x86_emulate_ctxt *ctxt,
172 						 int seg);
173 	void (*get_gdt)(struct x86_emulate_ctxt *ctxt, struct desc_ptr *dt);
174 	void (*get_idt)(struct x86_emulate_ctxt *ctxt, struct desc_ptr *dt);
175 	void (*set_gdt)(struct x86_emulate_ctxt *ctxt, struct desc_ptr *dt);
176 	void (*set_idt)(struct x86_emulate_ctxt *ctxt, struct desc_ptr *dt);
177 	ulong (*get_cr)(struct x86_emulate_ctxt *ctxt, int cr);
178 	int (*set_cr)(struct x86_emulate_ctxt *ctxt, int cr, ulong val);
179 	void (*set_rflags)(struct x86_emulate_ctxt *ctxt, ulong val);
180 	int (*cpl)(struct x86_emulate_ctxt *ctxt);
181 	int (*get_dr)(struct x86_emulate_ctxt *ctxt, int dr, ulong *dest);
182 	int (*set_dr)(struct x86_emulate_ctxt *ctxt, int dr, ulong value);
183 	int (*set_msr)(struct x86_emulate_ctxt *ctxt, u32 msr_index, u64 data);
184 	int (*get_msr)(struct x86_emulate_ctxt *ctxt, u32 msr_index, u64 *pdata);
185 	int (*read_pmc)(struct x86_emulate_ctxt *ctxt, u32 pmc, u64 *pdata);
186 	void (*halt)(struct x86_emulate_ctxt *ctxt);
187 	void (*wbinvd)(struct x86_emulate_ctxt *ctxt);
188 	int (*fix_hypercall)(struct x86_emulate_ctxt *ctxt);
189 	void (*get_fpu)(struct x86_emulate_ctxt *ctxt); /* disables preempt */
190 	void (*put_fpu)(struct x86_emulate_ctxt *ctxt); /* reenables preempt */
191 	int (*intercept)(struct x86_emulate_ctxt *ctxt,
192 			 struct x86_instruction_info *info,
193 			 enum x86_intercept_stage stage);
194 
195 	bool (*get_cpuid)(struct x86_emulate_ctxt *ctxt,
196 			 u32 *eax, u32 *ebx, u32 *ecx, u32 *edx);
197 };
198 
199 typedef u32 __attribute__((vector_size(16))) sse128_t;
200 
201 /* Type, address-of, and value of an instruction's operand. */
202 struct operand {
203 	enum { OP_REG, OP_MEM, OP_IMM, OP_XMM, OP_NONE } type;
204 	unsigned int bytes;
205 	union {
206 		unsigned long orig_val;
207 		u64 orig_val64;
208 	};
209 	union {
210 		unsigned long *reg;
211 		struct segmented_address {
212 			ulong ea;
213 			unsigned seg;
214 		} mem;
215 		unsigned xmm;
216 	} addr;
217 	union {
218 		unsigned long val;
219 		u64 val64;
220 		char valptr[sizeof(unsigned long) + 2];
221 		sse128_t vec_val;
222 	};
223 };
224 
225 struct fetch_cache {
226 	u8 data[15];
227 	unsigned long start;
228 	unsigned long end;
229 };
230 
231 struct read_cache {
232 	u8 data[1024];
233 	unsigned long pos;
234 	unsigned long end;
235 };
236 
237 struct x86_emulate_ctxt {
238 	struct x86_emulate_ops *ops;
239 
240 	/* Register state before/after emulation. */
241 	unsigned long eflags;
242 	unsigned long eip; /* eip before instruction emulation */
243 	/* Emulated execution mode, represented by an X86EMUL_MODE value. */
244 	int mode;
245 
246 	/* interruptibility state, as a result of execution of STI or MOV SS */
247 	int interruptibility;
248 
249 	bool guest_mode; /* guest running a nested guest */
250 	bool perm_ok; /* do not check permissions if true */
251 	bool only_vendor_specific_insn;
252 
253 	bool have_exception;
254 	struct x86_exception exception;
255 
256 	/* decode cache */
257 	u8 twobyte;
258 	u8 b;
259 	u8 intercept;
260 	u8 lock_prefix;
261 	u8 rep_prefix;
262 	u8 op_bytes;
263 	u8 ad_bytes;
264 	u8 rex_prefix;
265 	struct operand src;
266 	struct operand src2;
267 	struct operand dst;
268 	bool has_seg_override;
269 	u8 seg_override;
270 	u64 d;
271 	int (*execute)(struct x86_emulate_ctxt *ctxt);
272 	int (*check_perm)(struct x86_emulate_ctxt *ctxt);
273 	/* modrm */
274 	u8 modrm;
275 	u8 modrm_mod;
276 	u8 modrm_reg;
277 	u8 modrm_rm;
278 	u8 modrm_seg;
279 	bool rip_relative;
280 	unsigned long _eip;
281 	/* Fields above regs are cleared together. */
282 	unsigned long regs[NR_VCPU_REGS];
283 	struct operand memop;
284 	struct operand *memopp;
285 	struct fetch_cache fetch;
286 	struct read_cache io_read;
287 	struct read_cache mem_read;
288 };
289 
290 /* Repeat String Operation Prefix */
291 #define REPE_PREFIX	0xf3
292 #define REPNE_PREFIX	0xf2
293 
294 /* Execution mode, passed to the emulator. */
295 #define X86EMUL_MODE_REAL     0	/* Real mode.             */
296 #define X86EMUL_MODE_VM86     1	/* Virtual 8086 mode.     */
297 #define X86EMUL_MODE_PROT16   2	/* 16-bit protected mode. */
298 #define X86EMUL_MODE_PROT32   4	/* 32-bit protected mode. */
299 #define X86EMUL_MODE_PROT64   8	/* 64-bit (long) mode.    */
300 
301 /* any protected mode   */
302 #define X86EMUL_MODE_PROT     (X86EMUL_MODE_PROT16|X86EMUL_MODE_PROT32| \
303 			       X86EMUL_MODE_PROT64)
304 
305 /* CPUID vendors */
306 #define X86EMUL_CPUID_VENDOR_AuthenticAMD_ebx 0x68747541
307 #define X86EMUL_CPUID_VENDOR_AuthenticAMD_ecx 0x444d4163
308 #define X86EMUL_CPUID_VENDOR_AuthenticAMD_edx 0x69746e65
309 
310 #define X86EMUL_CPUID_VENDOR_AMDisbetterI_ebx 0x69444d41
311 #define X86EMUL_CPUID_VENDOR_AMDisbetterI_ecx 0x21726574
312 #define X86EMUL_CPUID_VENDOR_AMDisbetterI_edx 0x74656273
313 
314 #define X86EMUL_CPUID_VENDOR_GenuineIntel_ebx 0x756e6547
315 #define X86EMUL_CPUID_VENDOR_GenuineIntel_ecx 0x6c65746e
316 #define X86EMUL_CPUID_VENDOR_GenuineIntel_edx 0x49656e69
317 
318 enum x86_intercept_stage {
319 	X86_ICTP_NONE = 0,   /* Allow zero-init to not match anything */
320 	X86_ICPT_PRE_EXCEPT,
321 	X86_ICPT_POST_EXCEPT,
322 	X86_ICPT_POST_MEMACCESS,
323 };
324 
325 enum x86_intercept {
326 	x86_intercept_none,
327 	x86_intercept_cr_read,
328 	x86_intercept_cr_write,
329 	x86_intercept_clts,
330 	x86_intercept_lmsw,
331 	x86_intercept_smsw,
332 	x86_intercept_dr_read,
333 	x86_intercept_dr_write,
334 	x86_intercept_lidt,
335 	x86_intercept_sidt,
336 	x86_intercept_lgdt,
337 	x86_intercept_sgdt,
338 	x86_intercept_lldt,
339 	x86_intercept_sldt,
340 	x86_intercept_ltr,
341 	x86_intercept_str,
342 	x86_intercept_rdtsc,
343 	x86_intercept_rdpmc,
344 	x86_intercept_pushf,
345 	x86_intercept_popf,
346 	x86_intercept_cpuid,
347 	x86_intercept_rsm,
348 	x86_intercept_iret,
349 	x86_intercept_intn,
350 	x86_intercept_invd,
351 	x86_intercept_pause,
352 	x86_intercept_hlt,
353 	x86_intercept_invlpg,
354 	x86_intercept_invlpga,
355 	x86_intercept_vmrun,
356 	x86_intercept_vmload,
357 	x86_intercept_vmsave,
358 	x86_intercept_vmmcall,
359 	x86_intercept_stgi,
360 	x86_intercept_clgi,
361 	x86_intercept_skinit,
362 	x86_intercept_rdtscp,
363 	x86_intercept_icebp,
364 	x86_intercept_wbinvd,
365 	x86_intercept_monitor,
366 	x86_intercept_mwait,
367 	x86_intercept_rdmsr,
368 	x86_intercept_wrmsr,
369 	x86_intercept_in,
370 	x86_intercept_ins,
371 	x86_intercept_out,
372 	x86_intercept_outs,
373 
374 	nr_x86_intercepts
375 };
376 
377 /* Host execution mode. */
378 #if defined(CONFIG_X86_32)
379 #define X86EMUL_MODE_HOST X86EMUL_MODE_PROT32
380 #elif defined(CONFIG_X86_64)
381 #define X86EMUL_MODE_HOST X86EMUL_MODE_PROT64
382 #endif
383 
384 int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len);
385 bool x86_page_table_writing_insn(struct x86_emulate_ctxt *ctxt);
386 #define EMULATION_FAILED -1
387 #define EMULATION_OK 0
388 #define EMULATION_RESTART 1
389 #define EMULATION_INTERCEPTED 2
390 int x86_emulate_insn(struct x86_emulate_ctxt *ctxt);
391 int emulator_task_switch(struct x86_emulate_ctxt *ctxt,
392 			 u16 tss_selector, int idt_index, int reason,
393 			 bool has_error_code, u32 error_code);
394 int emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq);
395 #endif /* _ASM_X86_KVM_X86_EMULATE_H */
396