| // Copyright 2017 The Fuchsia Authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include <string.h> |
| |
| #include <hypervisor/decode.h> |
| #include <zircon/syscalls/hypervisor.h> |
| #include <zircon/syscalls/port.h> |
| |
| static const uint8_t kRexRMask = 1u << 2; |
| static const uint8_t kRexWMask = 1u << 3; |
| static const uint8_t kModRMRegMask = 0b00111000; |
| |
| static bool is_h66_prefix(uint8_t prefix) { |
| return prefix == 0x66; |
| } |
| |
| static bool is_rex_prefix(uint8_t prefix) { |
| return (prefix >> 4) == 0b0100; |
| } |
| |
| static bool has_sib_byte(uint8_t mod_rm) { |
| return (mod_rm >> 6) != 0b11 && (mod_rm & 0b111) == 0b100; |
| } |
| |
| static uint8_t displacement_size(uint8_t mod_rm) { |
| switch (mod_rm >> 6) { |
| case 0b01: |
| return 1; |
| case 0b10: |
| return 4; |
| default: |
| return (mod_rm & ~kModRMRegMask) == 0b00000101 ? 4 : 0; |
| } |
| } |
| |
| static uint8_t mem_size(bool h66, bool rex_w) { |
| if (rex_w) { |
| return 8; |
| } else if (!h66) { |
| return 4; |
| } else { |
| return 2; |
| } |
| } |
| |
| static uint8_t register_id(uint8_t mod_rm, bool rex_r) { |
| return static_cast<uint8_t>(((mod_rm >> 3) & 0b111) + (rex_r ? 0b1000 : 0)); |
| } |
| |
| static uint64_t* select_register(zx_vcpu_state_t* vcpu_state, uint8_t register_id) { |
| // From Intel Volume 2, Section 2.1. |
| switch (register_id) { |
| // From Intel Volume 2, Section 2.1.5. |
| case 0: |
| return &vcpu_state->rax; |
| case 1: |
| return &vcpu_state->rcx; |
| case 2: |
| return &vcpu_state->rdx; |
| case 3: |
| return &vcpu_state->rbx; |
| case 4: |
| return &vcpu_state->rsp; |
| case 5: |
| return &vcpu_state->rbp; |
| case 6: |
| return &vcpu_state->rsi; |
| case 7: |
| return &vcpu_state->rdi; |
| case 8: |
| return &vcpu_state->r8; |
| case 9: |
| return &vcpu_state->r9; |
| case 10: |
| return &vcpu_state->r10; |
| case 11: |
| return &vcpu_state->r11; |
| case 12: |
| return &vcpu_state->r12; |
| case 13: |
| return &vcpu_state->r13; |
| case 14: |
| return &vcpu_state->r14; |
| case 15: |
| return &vcpu_state->r15; |
| default: |
| return NULL; |
| } |
| } |
| |
| zx_status_t deconstruct_instruction(const uint8_t* inst_buf, uint32_t inst_len, |
| uint16_t* opcode, uint8_t* mod_rm) { |
| if (inst_len == 0) |
| return ZX_ERR_NOT_SUPPORTED; |
| switch (inst_buf[0]) { |
| case 0x0f: |
| if (inst_len < 3) |
| return ZX_ERR_NOT_SUPPORTED; |
| *opcode = *(uint16_t*)inst_buf; |
| *mod_rm = inst_buf[2]; |
| break; |
| default: |
| if (inst_len < 2) |
| return ZX_ERR_OUT_OF_RANGE; |
| *opcode = inst_buf[0]; |
| *mod_rm = inst_buf[1]; |
| break; |
| } |
| return ZX_OK; |
| } |
| |
| zx_status_t inst_decode(const uint8_t* inst_buf, uint32_t inst_len, zx_vcpu_state_t* vcpu_state, |
| instruction_t* inst) { |
| if (inst_len == 0) |
| return ZX_ERR_BAD_STATE; |
| if (inst_len > X86_MAX_INST_LEN) |
| return ZX_ERR_OUT_OF_RANGE; |
| |
| // Parse 66H prefix. |
| bool h66 = is_h66_prefix(inst_buf[0]); |
| if (h66) { |
| if (inst_len == 1) |
| return ZX_ERR_BAD_STATE; |
| inst_buf++; |
| inst_len--; |
| } |
| // Parse REX prefix. |
| // |
| // From Intel Volume 2, Appendix 2.2.1: Only one REX prefix is allowed per |
| // instruction. If used, the REX prefix byte must immediately precede the |
| // opcode byte or the escape opcode byte (0FH). |
| bool rex_r = false; |
| bool rex_w = false; |
| if (is_rex_prefix(inst_buf[0])) { |
| rex_r = inst_buf[0] & kRexRMask; |
| rex_w = inst_buf[0] & kRexWMask; |
| inst_buf++; |
| inst_len--; |
| } |
| // Technically this is valid, but no sane compiler should emit it. |
| if (h66 && rex_w) |
| return ZX_ERR_NOT_SUPPORTED; |
| |
| uint16_t opcode; |
| uint8_t mod_rm; |
| zx_status_t status = deconstruct_instruction(inst_buf, inst_len, &opcode, &mod_rm); |
| if (status != ZX_OK) |
| return status; |
| if (has_sib_byte(mod_rm)) |
| return ZX_ERR_NOT_SUPPORTED; |
| |
| const uint8_t disp_size = displacement_size(mod_rm); |
| switch (opcode) { |
| // Move r to r/m. |
| case 0x89: |
| if (inst_len != disp_size + 2u) |
| return ZX_ERR_OUT_OF_RANGE; |
| inst->type = INST_MOV_WRITE; |
| inst->mem = mem_size(h66, rex_w); |
| inst->imm = 0; |
| inst->reg = select_register(vcpu_state, register_id(mod_rm, rex_r)); |
| inst->flags = NULL; |
| return inst->reg == NULL ? ZX_ERR_NOT_SUPPORTED : ZX_OK; |
| // Move r/m to r. |
| case 0x8b: |
| if (inst_len != disp_size + 2u) |
| return ZX_ERR_OUT_OF_RANGE; |
| inst->type = INST_MOV_READ; |
| inst->mem = mem_size(h66, rex_w); |
| inst->imm = 0; |
| inst->reg = select_register(vcpu_state, register_id(mod_rm, rex_r)); |
| inst->flags = NULL; |
| return inst->reg == NULL ? ZX_ERR_NOT_SUPPORTED : ZX_OK; |
| // Move imm to r/m. |
| case 0xc7: { |
| const uint8_t imm_size = h66 ? 2 : 4; |
| if (inst_len != disp_size + imm_size + 2u) |
| return ZX_ERR_OUT_OF_RANGE; |
| if ((mod_rm & kModRMRegMask) != 0) |
| return ZX_ERR_INVALID_ARGS; |
| inst->type = INST_MOV_WRITE; |
| inst->mem = mem_size(h66, rex_w); |
| inst->imm = 0; |
| inst->reg = NULL; |
| inst->flags = NULL; |
| memcpy(&inst->imm, inst_buf + disp_size + 2, imm_size); |
| return ZX_OK; |
| } |
| // Move (8-bit) with zero-extend r/m to r. |
| case 0xb60f: |
| if (h66) |
| return ZX_ERR_BAD_STATE; |
| if (inst_len != disp_size + 3u) |
| return ZX_ERR_OUT_OF_RANGE; |
| inst->type = INST_MOV_READ; |
| inst->mem = 1; |
| inst->imm = 0; |
| inst->reg = select_register(vcpu_state, register_id(mod_rm, rex_r)); |
| inst->flags = NULL; |
| return inst->reg == NULL ? ZX_ERR_NOT_SUPPORTED : ZX_OK; |
| // Move (16-bit) with zero-extend r/m to r. |
| case 0xb70f: |
| if (h66) |
| return ZX_ERR_BAD_STATE; |
| if (inst_len != disp_size + 3u) |
| return ZX_ERR_OUT_OF_RANGE; |
| inst->type = INST_MOV_READ; |
| inst->mem = 2; |
| inst->imm = 0; |
| inst->reg = select_register(vcpu_state, register_id(mod_rm, rex_r)); |
| inst->flags = NULL; |
| return inst->reg == NULL ? ZX_ERR_NOT_SUPPORTED : ZX_OK; |
| // Logical compare (8-bit) imm with r/m. |
| case 0xf6: |
| if (h66) |
| return ZX_ERR_BAD_STATE; |
| if (inst_len != disp_size + 3u) |
| return ZX_ERR_OUT_OF_RANGE; |
| if ((mod_rm & kModRMRegMask) != 0) |
| return ZX_ERR_INVALID_ARGS; |
| inst->type = INST_TEST; |
| inst->mem = 1; |
| inst->imm = 0; |
| inst->reg = NULL; |
| inst->flags = &vcpu_state->flags; |
| memcpy(&inst->imm, inst_buf + disp_size + 2, 1); |
| return ZX_OK; |
| default: |
| return ZX_ERR_NOT_SUPPORTED; |
| } |
| } |
