hvm: Fix a bug in the mmio emulation of SUB instruction.

Signed-off-by: Dexuan Cui <dexuan.cui@intel.com>

diff --git a/tools/ioemu/target-i386-dm/helper2.c b/tools/ioemu/target-i386-dm/helper2.c
index 7beda011c6e9b1c69e40f3fb23dd8bdc074db014..513d925b732d2c811119eb1ab5fdf377c98b8b8c 100644 (file)
--- a/tools/ioemu/target-i386-dm/helper2.c
+++ b/tools/ioemu/target-i386-dm/helper2.c
@@ -408,6 +408,21 @@ void cpu_ioreq_add(CPUState *env, ioreq_t *req)
     req->data = tmp1;
 }
 
+void cpu_ioreq_sub(CPUState *env, ioreq_t *req)
+{
+    unsigned long tmp1, tmp2;
+
+    if (req->data_is_ptr != 0)
+        hw_error("expected scalar value");
+
+    read_physical(req->addr, req->size, &tmp1);
+    if (req->dir == IOREQ_WRITE) {
+        tmp2 = tmp1 - (unsigned long) req->data;
+        write_physical(req->addr, req->size, &tmp2);
+    }
+    req->data = tmp1;
+}
+
 void cpu_ioreq_or(CPUState *env, ioreq_t *req)
 {
     unsigned long tmp1, tmp2;
@@ -496,6 +511,9 @@ void __handle_ioreq(CPUState *env, ioreq_t *req)
     case IOREQ_TYPE_ADD:
         cpu_ioreq_add(env, req);
         break;
+    case IOREQ_TYPE_SUB:
+        cpu_ioreq_sub(env, req);
+        break;
     case IOREQ_TYPE_OR:
         cpu_ioreq_or(env, req);
         break;

diff --git a/xen/arch/x86/hvm/platform.c b/xen/arch/x86/hvm/platform.c
index 8bb3e3439bdbdc50df95ef8a397cefa2dd3a2324..caa2b377c9dc057543927926e20a87b30b1ffd09 100644 (file)
--- a/xen/arch/x86/hvm/platform.c
+++ b/xen/arch/x86/hvm/platform.c
@@ -1240,6 +1240,10 @@ void handle_mmio(unsigned long gpa)
         mmio_operands(IOREQ_TYPE_ADD, gpa, mmio_op, op_size);
         break;
 
+    case INSTR_SUB:
+        mmio_operands(IOREQ_TYPE_SUB, gpa, mmio_op, op_size);
+        break;
+
     case INSTR_XOR:
         mmio_operands(IOREQ_TYPE_XOR, gpa, mmio_op, op_size);
         break;
@@ -1261,7 +1265,6 @@ void handle_mmio(unsigned long gpa)
 
     case INSTR_CMP:        /* Pass through */
     case INSTR_TEST:
-    case INSTR_SUB:
         /* send the request and wait for the value */
         send_mmio_req(IOREQ_TYPE_COPY, gpa, 1, op_size, 0, IOREQ_READ, df, 0);
         break;

diff --git a/xen/include/public/hvm/ioreq.h b/xen/include/public/hvm/ioreq.h
index 063810cc74281f41f51749b6098be97d22e9ff2d..e9f6495e21a6c61070c31aa38a5723d7491ad9fb 100644 (file)
--- a/xen/include/public/hvm/ioreq.h
+++ b/xen/include/public/hvm/ioreq.h
@@ -41,6 +41,7 @@
 #define IOREQ_TYPE_ADD          6
 #define IOREQ_TYPE_TIMEOFFSET   7
 #define IOREQ_TYPE_INVALIDATE   8 /* mapcache */
+#define IOREQ_TYPE_SUB          9
 
 /*
  * VMExit dispatcher should cooperate with instruction decoder to