[PATCHv3] KVM: x86 emulator: fix BitOp instruction emulation

[Wei Yongjun]

If bit offset operands is a negative number, BitOp instruction
will return wrong value. This patch fix it.

Signed-off-by: Wei Yongjun <yj...@cn.fujitsu.com>
---
 arch/x86/kvm/emulate.c |   45 ++++++++++++++++++++++++++++++---------------
 1 files changed, 30 insertions(+), 15 deletions(-)

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index d197b46..8763708 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -724,6 +724,33 @@ done:
        return rc;
 }
 
+static void fetch_bit_operand(struct decode_cache *c)
+{
+       unsigned long mask, byte_offset;
+
+       if (c->dst.type != OP_MEM || c->src.type != OP_REG) {
+               /* Only subword offset */
+               c->src.val &= (c->dst.bytes << 3) - 1;
+               return;
+       }
+
+       if (c->src.bytes == 2)
+               c->src.val = (s16)c->src.val;
+       else if (c->src.bytes == 4)
+               c->src.val = (s32)c->src.val;
+
+       mask = ~(c->dst.bytes * 8 - 1);
+
+       if ((long)c->src.val > 0) {
+               c->dst.addr.mem = c->dst.addr.mem + (c->src.val & mask) / 8;
+               c->src.val &= (c->dst.bytes << 3) - 1;
+       } else {
+               byte_offset = c->dst.bytes + ((-c->src.val - 1) & mask) / 8;
+               c->dst.addr.mem -= byte_offset;
+               c->src.val += byte_offset << 3;
+       }
+}
+
 static int read_emulated(struct x86_emulate_ctxt *ctxt,
                         struct x86_emulate_ops *ops,
                         unsigned long addr, void *dest, unsigned size)
@@ -2261,7 +2288,7 @@ static struct opcode twobyte_table[256] = {
            D(DstReg | SrcMem16 | ModRM | Mov),
        /* 0xB8 - 0xBF */
        N, N,
-       G(0, group8), D(DstMem | SrcReg | ModRM | BitOp | Lock),
+       G(BitOp, group8), D(DstMem | SrcReg | ModRM | BitOp | Lock),
        N, N, D(ByteOp | DstReg | SrcMem | ModRM | Mov),
            D(DstReg | SrcMem16 | ModRM | Mov),
        /* 0xC0 - 0xCF */
@@ -2587,12 +2614,8 @@ done_prefixes:
                        c->dst.bytes = 8;
                else
                        c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
-               if (c->dst.type == OP_MEM && (c->d & BitOp)) {
-                       unsigned long mask = ~(c->dst.bytes * 8 - 1);
-
-                       c->dst.addr.mem = c->dst.addr.mem +
-                                                  (c->src.val & mask) / 8;
-               }
+               if (c->d & BitOp)
+                       fetch_bit_operand(c);
                c->dst.orig_val = c->dst.val;
                break;
        case DstAcc:
@@ -3303,8 +3326,6 @@ twobyte_insn:
        case 0xa3:
              bt:               /* bt */
                c->dst.type = OP_NONE;
-               /* only subword offset */
-               c->src.val &= (c->dst.bytes << 3) - 1;
                emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
                break;
        case 0xa4: /* shld imm8, r, r/m */
@@ -3321,8 +3342,6 @@ twobyte_insn:
                break;
        case 0xab:
              bts:              /* bts */
-               /* only subword offset */
-               c->src.val &= (c->dst.bytes << 3) - 1;
                emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
                break;
        case 0xac: /* shrd imm8, r, r/m */
@@ -3350,8 +3369,6 @@ twobyte_insn:
                break;
        case 0xb3:
              btr:              /* btr */
-               /* only subword offset */
-               c->src.val &= (c->dst.bytes << 3) - 1;
                emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
                break;
        case 0xb6 ... 0xb7:     /* movzx */
@@ -3373,8 +3390,6 @@ twobyte_insn:
                break;
        case 0xbb:
              btc:              /* btc */
-               /* only subword offset */
-               c->src.val &= (c->dst.bytes << 3) - 1;
                emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
                break;
        case 0xbe ... 0xbf:     /* movsx */
-- 
1.7.0.4


--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html