kvm_emulate.h 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451
  1. /* SPDX-License-Identifier: GPL-2.0 */
  2. /******************************************************************************
  3. * x86_emulate.h
  4. *
  5. * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
  6. *
  7. * Copyright (c) 2005 Keir Fraser
  8. *
  9. * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
  10. */
  11. #ifndef _ASM_X86_KVM_X86_EMULATE_H
  12. #define _ASM_X86_KVM_X86_EMULATE_H
  13. #include <asm/desc_defs.h>
  14. struct x86_emulate_ctxt;
  15. enum x86_intercept;
  16. enum x86_intercept_stage;
  17. struct x86_exception {
  18. u8 vector;
  19. bool error_code_valid;
  20. u16 error_code;
  21. bool nested_page_fault;
  22. u64 address; /* cr2 or nested page fault gpa */
  23. u8 async_page_fault;
  24. };
  25. /*
  26. * This struct is used to carry enough information from the instruction
  27. * decoder to main KVM so that a decision can be made whether the
  28. * instruction needs to be intercepted or not.
  29. */
  30. struct x86_instruction_info {
  31. u8 intercept; /* which intercept */
  32. u8 rep_prefix; /* rep prefix? */
  33. u8 modrm_mod; /* mod part of modrm */
  34. u8 modrm_reg; /* index of register used */
  35. u8 modrm_rm; /* rm part of modrm */
  36. u64 src_val; /* value of source operand */
  37. u64 dst_val; /* value of destination operand */
  38. u8 src_bytes; /* size of source operand */
  39. u8 dst_bytes; /* size of destination operand */
  40. u8 ad_bytes; /* size of src/dst address */
  41. u64 next_rip; /* rip following the instruction */
  42. };
  43. /*
  44. * x86_emulate_ops:
  45. *
  46. * These operations represent the instruction emulator's interface to memory.
  47. * There are two categories of operation: those that act on ordinary memory
  48. * regions (*_std), and those that act on memory regions known to require
  49. * special treatment or emulation (*_emulated).
  50. *
  51. * The emulator assumes that an instruction accesses only one 'emulated memory'
  52. * location, that this location is the given linear faulting address (cr2), and
  53. * that this is one of the instruction's data operands. Instruction fetches and
  54. * stack operations are assumed never to access emulated memory. The emulator
  55. * automatically deduces which operand of a string-move operation is accessing
  56. * emulated memory, and assumes that the other operand accesses normal memory.
  57. *
  58. * NOTES:
  59. * 1. The emulator isn't very smart about emulated vs. standard memory.
  60. * 'Emulated memory' access addresses should be checked for sanity.
  61. * 'Normal memory' accesses may fault, and the caller must arrange to
  62. * detect and handle reentrancy into the emulator via recursive faults.
  63. * Accesses may be unaligned and may cross page boundaries.
  64. * 2. If the access fails (cannot emulate, or a standard access faults) then
  65. * it is up to the memop to propagate the fault to the guest VM via
  66. * some out-of-band mechanism, unknown to the emulator. The memop signals
  67. * failure by returning X86EMUL_PROPAGATE_FAULT to the emulator, which will
  68. * then immediately bail.
  69. * 3. Valid access sizes are 1, 2, 4 and 8 bytes. On x86/32 systems only
  70. * cmpxchg8b_emulated need support 8-byte accesses.
  71. * 4. The emulator cannot handle 64-bit mode emulation on an x86/32 system.
  72. */
  73. /* Access completed successfully: continue emulation as normal. */
  74. #define X86EMUL_CONTINUE 0
  75. /* Access is unhandleable: bail from emulation and return error to caller. */
  76. #define X86EMUL_UNHANDLEABLE 1
  77. /* Terminate emulation but return success to the caller. */
  78. #define X86EMUL_PROPAGATE_FAULT 2 /* propagate a generated fault to guest */
  79. #define X86EMUL_RETRY_INSTR 3 /* retry the instruction for some reason */
  80. #define X86EMUL_CMPXCHG_FAILED 4 /* cmpxchg did not see expected value */
  81. #define X86EMUL_IO_NEEDED 5 /* IO is needed to complete emulation */
  82. #define X86EMUL_INTERCEPTED 6 /* Intercepted by nested VMCB/VMCS */
  83. struct x86_emulate_ops {
  84. /*
  85. * read_gpr: read a general purpose register (rax - r15)
  86. *
  87. * @reg: gpr number.
  88. */
  89. ulong (*read_gpr)(struct x86_emulate_ctxt *ctxt, unsigned reg);
  90. /*
  91. * write_gpr: write a general purpose register (rax - r15)
  92. *
  93. * @reg: gpr number.
  94. * @val: value to write.
  95. */
  96. void (*write_gpr)(struct x86_emulate_ctxt *ctxt, unsigned reg, ulong val);
  97. /*
  98. * read_std: Read bytes of standard (non-emulated/special) memory.
  99. * Used for descriptor reading.
  100. * @addr: [IN ] Linear address from which to read.
  101. * @val: [OUT] Value read from memory, zero-extended to 'u_long'.
  102. * @bytes: [IN ] Number of bytes to read from memory.
  103. */
  104. int (*read_std)(struct x86_emulate_ctxt *ctxt,
  105. unsigned long addr, void *val,
  106. unsigned int bytes,
  107. struct x86_exception *fault);
  108. /*
  109. * read_phys: Read bytes of standard (non-emulated/special) memory.
  110. * Used for descriptor reading.
  111. * @addr: [IN ] Physical address from which to read.
  112. * @val: [OUT] Value read from memory.
  113. * @bytes: [IN ] Number of bytes to read from memory.
  114. */
  115. int (*read_phys)(struct x86_emulate_ctxt *ctxt, unsigned long addr,
  116. void *val, unsigned int bytes);
  117. /*
  118. * write_std: Write bytes of standard (non-emulated/special) memory.
  119. * Used for descriptor writing.
  120. * @addr: [IN ] Linear address to which to write.
  121. * @val: [OUT] Value write to memory, zero-extended to 'u_long'.
  122. * @bytes: [IN ] Number of bytes to write to memory.
  123. */
  124. int (*write_std)(struct x86_emulate_ctxt *ctxt,
  125. unsigned long addr, void *val, unsigned int bytes,
  126. struct x86_exception *fault);
  127. /*
  128. * fetch: Read bytes of standard (non-emulated/special) memory.
  129. * Used for instruction fetch.
  130. * @addr: [IN ] Linear address from which to read.
  131. * @val: [OUT] Value read from memory, zero-extended to 'u_long'.
  132. * @bytes: [IN ] Number of bytes to read from memory.
  133. */
  134. int (*fetch)(struct x86_emulate_ctxt *ctxt,
  135. unsigned long addr, void *val, unsigned int bytes,
  136. struct x86_exception *fault);
  137. /*
  138. * read_emulated: Read bytes from emulated/special memory area.
  139. * @addr: [IN ] Linear address from which to read.
  140. * @val: [OUT] Value read from memory, zero-extended to 'u_long'.
  141. * @bytes: [IN ] Number of bytes to read from memory.
  142. */
  143. int (*read_emulated)(struct x86_emulate_ctxt *ctxt,
  144. unsigned long addr, void *val, unsigned int bytes,
  145. struct x86_exception *fault);
  146. /*
  147. * write_emulated: Write bytes to emulated/special memory area.
  148. * @addr: [IN ] Linear address to which to write.
  149. * @val: [IN ] Value to write to memory (low-order bytes used as
  150. * required).
  151. * @bytes: [IN ] Number of bytes to write to memory.
  152. */
  153. int (*write_emulated)(struct x86_emulate_ctxt *ctxt,
  154. unsigned long addr, const void *val,
  155. unsigned int bytes,
  156. struct x86_exception *fault);
  157. /*
  158. * cmpxchg_emulated: Emulate an atomic (LOCKed) CMPXCHG operation on an
  159. * emulated/special memory area.
  160. * @addr: [IN ] Linear address to access.
  161. * @old: [IN ] Value expected to be current at @addr.
  162. * @new: [IN ] Value to write to @addr.
  163. * @bytes: [IN ] Number of bytes to access using CMPXCHG.
  164. */
  165. int (*cmpxchg_emulated)(struct x86_emulate_ctxt *ctxt,
  166. unsigned long addr,
  167. const void *old,
  168. const void *new,
  169. unsigned int bytes,
  170. struct x86_exception *fault);
  171. void (*invlpg)(struct x86_emulate_ctxt *ctxt, ulong addr);
  172. int (*pio_in_emulated)(struct x86_emulate_ctxt *ctxt,
  173. int size, unsigned short port, void *val,
  174. unsigned int count);
  175. int (*pio_out_emulated)(struct x86_emulate_ctxt *ctxt,
  176. int size, unsigned short port, const void *val,
  177. unsigned int count);
  178. bool (*get_segment)(struct x86_emulate_ctxt *ctxt, u16 *selector,
  179. struct desc_struct *desc, u32 *base3, int seg);
  180. void (*set_segment)(struct x86_emulate_ctxt *ctxt, u16 selector,
  181. struct desc_struct *desc, u32 base3, int seg);
  182. unsigned long (*get_cached_segment_base)(struct x86_emulate_ctxt *ctxt,
  183. int seg);
  184. void (*get_gdt)(struct x86_emulate_ctxt *ctxt, struct desc_ptr *dt);
  185. void (*get_idt)(struct x86_emulate_ctxt *ctxt, struct desc_ptr *dt);
  186. void (*set_gdt)(struct x86_emulate_ctxt *ctxt, struct desc_ptr *dt);
  187. void (*set_idt)(struct x86_emulate_ctxt *ctxt, struct desc_ptr *dt);
  188. ulong (*get_cr)(struct x86_emulate_ctxt *ctxt, int cr);
  189. int (*set_cr)(struct x86_emulate_ctxt *ctxt, int cr, ulong val);
  190. int (*cpl)(struct x86_emulate_ctxt *ctxt);
  191. int (*get_dr)(struct x86_emulate_ctxt *ctxt, int dr, ulong *dest);
  192. int (*set_dr)(struct x86_emulate_ctxt *ctxt, int dr, ulong value);
  193. u64 (*get_smbase)(struct x86_emulate_ctxt *ctxt);
  194. void (*set_smbase)(struct x86_emulate_ctxt *ctxt, u64 smbase);
  195. int (*set_msr)(struct x86_emulate_ctxt *ctxt, u32 msr_index, u64 data);
  196. int (*get_msr)(struct x86_emulate_ctxt *ctxt, u32 msr_index, u64 *pdata);
  197. int (*check_pmc)(struct x86_emulate_ctxt *ctxt, u32 pmc);
  198. int (*read_pmc)(struct x86_emulate_ctxt *ctxt, u32 pmc, u64 *pdata);
  199. void (*halt)(struct x86_emulate_ctxt *ctxt);
  200. void (*wbinvd)(struct x86_emulate_ctxt *ctxt);
  201. int (*fix_hypercall)(struct x86_emulate_ctxt *ctxt);
  202. int (*intercept)(struct x86_emulate_ctxt *ctxt,
  203. struct x86_instruction_info *info,
  204. enum x86_intercept_stage stage);
  205. bool (*get_cpuid)(struct x86_emulate_ctxt *ctxt, u32 *eax, u32 *ebx,
  206. u32 *ecx, u32 *edx, bool check_limit);
  207. void (*set_nmi_mask)(struct x86_emulate_ctxt *ctxt, bool masked);
  208. unsigned (*get_hflags)(struct x86_emulate_ctxt *ctxt);
  209. void (*set_hflags)(struct x86_emulate_ctxt *ctxt, unsigned hflags);
  210. int (*pre_leave_smm)(struct x86_emulate_ctxt *ctxt, u64 smbase);
  211. };
  212. typedef u32 __attribute__((vector_size(16))) sse128_t;
  213. /* Type, address-of, and value of an instruction's operand. */
  214. struct operand {
  215. enum { OP_REG, OP_MEM, OP_MEM_STR, OP_IMM, OP_XMM, OP_MM, OP_NONE } type;
  216. unsigned int bytes;
  217. unsigned int count;
  218. union {
  219. unsigned long orig_val;
  220. u64 orig_val64;
  221. };
  222. union {
  223. unsigned long *reg;
  224. struct segmented_address {
  225. ulong ea;
  226. unsigned seg;
  227. } mem;
  228. unsigned xmm;
  229. unsigned mm;
  230. } addr;
  231. union {
  232. unsigned long val;
  233. u64 val64;
  234. char valptr[sizeof(sse128_t)];
  235. sse128_t vec_val;
  236. u64 mm_val;
  237. void *data;
  238. };
  239. };
  240. struct fetch_cache {
  241. u8 data[15];
  242. u8 *ptr;
  243. u8 *end;
  244. };
  245. struct read_cache {
  246. u8 data[1024];
  247. unsigned long pos;
  248. unsigned long end;
  249. };
  250. /* Execution mode, passed to the emulator. */
  251. enum x86emul_mode {
  252. X86EMUL_MODE_REAL, /* Real mode. */
  253. X86EMUL_MODE_VM86, /* Virtual 8086 mode. */
  254. X86EMUL_MODE_PROT16, /* 16-bit protected mode. */
  255. X86EMUL_MODE_PROT32, /* 32-bit protected mode. */
  256. X86EMUL_MODE_PROT64, /* 64-bit (long) mode. */
  257. };
  258. /* These match some of the HF_* flags defined in kvm_host.h */
  259. #define X86EMUL_GUEST_MASK (1 << 5) /* VCPU is in guest-mode */
  260. #define X86EMUL_SMM_MASK (1 << 6)
  261. #define X86EMUL_SMM_INSIDE_NMI_MASK (1 << 7)
  262. struct x86_emulate_ctxt {
  263. const struct x86_emulate_ops *ops;
  264. /* Register state before/after emulation. */
  265. unsigned long eflags;
  266. unsigned long eip; /* eip before instruction emulation */
  267. /* Emulated execution mode, represented by an X86EMUL_MODE value. */
  268. enum x86emul_mode mode;
  269. /* interruptibility state, as a result of execution of STI or MOV SS */
  270. int interruptibility;
  271. bool perm_ok; /* do not check permissions if true */
  272. bool ud; /* inject an #UD if host doesn't support insn */
  273. bool tf; /* TF value before instruction (after for syscall/sysret) */
  274. bool have_exception;
  275. struct x86_exception exception;
  276. /*
  277. * decode cache
  278. */
  279. /* current opcode length in bytes */
  280. u8 opcode_len;
  281. u8 b;
  282. u8 intercept;
  283. u8 op_bytes;
  284. u8 ad_bytes;
  285. struct operand src;
  286. struct operand src2;
  287. struct operand dst;
  288. int (*execute)(struct x86_emulate_ctxt *ctxt);
  289. int (*check_perm)(struct x86_emulate_ctxt *ctxt);
  290. /*
  291. * The following six fields are cleared together,
  292. * the rest are initialized unconditionally in x86_decode_insn
  293. * or elsewhere
  294. */
  295. bool rip_relative;
  296. u8 rex_prefix;
  297. u8 lock_prefix;
  298. u8 rep_prefix;
  299. /* bitmaps of registers in _regs[] that can be read */
  300. u32 regs_valid;
  301. /* bitmaps of registers in _regs[] that have been written */
  302. u32 regs_dirty;
  303. /* modrm */
  304. u8 modrm;
  305. u8 modrm_mod;
  306. u8 modrm_reg;
  307. u8 modrm_rm;
  308. u8 modrm_seg;
  309. u8 seg_override;
  310. u64 d;
  311. unsigned long _eip;
  312. struct operand memop;
  313. /* Fields above regs are cleared together. */
  314. unsigned long _regs[NR_VCPU_REGS];
  315. struct operand *memopp;
  316. struct fetch_cache fetch;
  317. struct read_cache io_read;
  318. struct read_cache mem_read;
  319. };
  320. /* Repeat String Operation Prefix */
  321. #define REPE_PREFIX 0xf3
  322. #define REPNE_PREFIX 0xf2
  323. /* CPUID vendors */
  324. #define X86EMUL_CPUID_VENDOR_AuthenticAMD_ebx 0x68747541
  325. #define X86EMUL_CPUID_VENDOR_AuthenticAMD_ecx 0x444d4163
  326. #define X86EMUL_CPUID_VENDOR_AuthenticAMD_edx 0x69746e65
  327. #define X86EMUL_CPUID_VENDOR_AMDisbetterI_ebx 0x69444d41
  328. #define X86EMUL_CPUID_VENDOR_AMDisbetterI_ecx 0x21726574
  329. #define X86EMUL_CPUID_VENDOR_AMDisbetterI_edx 0x74656273
  330. #define X86EMUL_CPUID_VENDOR_GenuineIntel_ebx 0x756e6547
  331. #define X86EMUL_CPUID_VENDOR_GenuineIntel_ecx 0x6c65746e
  332. #define X86EMUL_CPUID_VENDOR_GenuineIntel_edx 0x49656e69
  333. enum x86_intercept_stage {
  334. X86_ICTP_NONE = 0, /* Allow zero-init to not match anything */
  335. X86_ICPT_PRE_EXCEPT,
  336. X86_ICPT_POST_EXCEPT,
  337. X86_ICPT_POST_MEMACCESS,
  338. };
  339. enum x86_intercept {
  340. x86_intercept_none,
  341. x86_intercept_cr_read,
  342. x86_intercept_cr_write,
  343. x86_intercept_clts,
  344. x86_intercept_lmsw,
  345. x86_intercept_smsw,
  346. x86_intercept_dr_read,
  347. x86_intercept_dr_write,
  348. x86_intercept_lidt,
  349. x86_intercept_sidt,
  350. x86_intercept_lgdt,
  351. x86_intercept_sgdt,
  352. x86_intercept_lldt,
  353. x86_intercept_sldt,
  354. x86_intercept_ltr,
  355. x86_intercept_str,
  356. x86_intercept_rdtsc,
  357. x86_intercept_rdpmc,
  358. x86_intercept_pushf,
  359. x86_intercept_popf,
  360. x86_intercept_cpuid,
  361. x86_intercept_rsm,
  362. x86_intercept_iret,
  363. x86_intercept_intn,
  364. x86_intercept_invd,
  365. x86_intercept_pause,
  366. x86_intercept_hlt,
  367. x86_intercept_invlpg,
  368. x86_intercept_invlpga,
  369. x86_intercept_vmrun,
  370. x86_intercept_vmload,
  371. x86_intercept_vmsave,
  372. x86_intercept_vmmcall,
  373. x86_intercept_stgi,
  374. x86_intercept_clgi,
  375. x86_intercept_skinit,
  376. x86_intercept_rdtscp,
  377. x86_intercept_icebp,
  378. x86_intercept_wbinvd,
  379. x86_intercept_monitor,
  380. x86_intercept_mwait,
  381. x86_intercept_rdmsr,
  382. x86_intercept_wrmsr,
  383. x86_intercept_in,
  384. x86_intercept_ins,
  385. x86_intercept_out,
  386. x86_intercept_outs,
  387. nr_x86_intercepts
  388. };
  389. /* Host execution mode. */
  390. #if defined(CONFIG_X86_32)
  391. #define X86EMUL_MODE_HOST X86EMUL_MODE_PROT32
  392. #elif defined(CONFIG_X86_64)
  393. #define X86EMUL_MODE_HOST X86EMUL_MODE_PROT64
  394. #endif
  395. int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len);
  396. bool x86_page_table_writing_insn(struct x86_emulate_ctxt *ctxt);
  397. #define EMULATION_FAILED -1
  398. #define EMULATION_OK 0
  399. #define EMULATION_RESTART 1
  400. #define EMULATION_INTERCEPTED 2
  401. void init_decode_cache(struct x86_emulate_ctxt *ctxt);
  402. int x86_emulate_insn(struct x86_emulate_ctxt *ctxt);
  403. int emulator_task_switch(struct x86_emulate_ctxt *ctxt,
  404. u16 tss_selector, int idt_index, int reason,
  405. bool has_error_code, u32 error_code);
  406. int emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq);
  407. void emulator_invalidate_register_cache(struct x86_emulate_ctxt *ctxt);
  408. void emulator_writeback_register_cache(struct x86_emulate_ctxt *ctxt);
  409. bool emulator_can_use_gpa(struct x86_emulate_ctxt *ctxt);
  410. #endif /* _ASM_X86_KVM_X86_EMULATE_H */