projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
KVM: x86 emulator: move ByteOp and Dst back to bits 0:3
[deliverable/linux.git] / arch / x86 / kvm / emulate.c
CommitLineData
6aa8b732 1/******************************************************************************
56e82318 2 * emulate.c
6aa8b732
AK		 3 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
dcc0766b 9 * privileged instructions:
6aa8b732
AK		 10 *
11 * Copyright (C) 2006 Qumranet
221d059d 12 * Copyright 2010 Red Hat, Inc. and/or its affilates.
6aa8b732
AK		 13 *
14 * Avi Kivity <avi@qumranet.com>
15 * Yaniv Kamay <yaniv@qumranet.com>
16 *
17 * This work is licensed under the terms of the GNU GPL, version 2. See
18 * the COPYING file in the top-level directory.
19 *
20 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
21 */
22
23#ifndef __KERNEL__
24#include <stdio.h>
25#include <stdint.h>
26#include <public/xen.h>
d77c26fc 27#define DPRINTF(_f, _a ...) printf(_f , ## _a)
6aa8b732 28#else
edf88417 29#include <linux/kvm_host.h>
5fdbf976 30#include "kvm_cache_regs.h"
6aa8b732
AK		 31#define DPRINTF(x...) do {} while (0)
32#endif
6aa8b732 33#include <linux/module.h>
56e82318 34#include <asm/kvm_emulate.h>
6aa8b732 35
3eeb3288 36#include "x86.h"
38ba30ba 37#include "tss.h"
e99f0507 38
6aa8b732
AK		 39/*
40 * Opcode effective-address decode tables.
41 * Note that we only emulate instructions that have at least one memory
42 * operand (excluding implicit stack references). We assume that stack
43 * references and instruction fetches will never occur in special memory
44 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
45 * not be handled.
46 */
47
48/* Operand sizes: 8-bit operands or specified/overridden size. */
ab85b12b 49#define ByteOp (1<<0) /* 8-bit operands. */
6aa8b732 50/* Destination operand type. */
ab85b12b
AK		 51#define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
52#define DstReg (2<<1) /* Register operand. */
53#define DstMem (3<<1) /* Memory operand. */
54#define DstAcc (4<<1) /* Destination Accumulator */
55#define DstDI (5<<1) /* Destination is in ES:(E)DI */
56#define DstMem64 (6<<1) /* 64bit memory operand */
57#define DstMask (7<<1)
6aa8b732 58/* Source operand type. */
9c9fddd0
GT		 59#define SrcNone (0<<4) /* No source operand. */
60#define SrcImplicit (0<<4) /* Source operand is implicit in the opcode. */
61#define SrcReg (1<<4) /* Register operand. */
62#define SrcMem (2<<4) /* Memory operand. */
63#define SrcMem16 (3<<4) /* Memory operand (16-bit). */
64#define SrcMem32 (4<<4) /* Memory operand (32-bit). */
65#define SrcImm (5<<4) /* Immediate operand. */
66#define SrcImmByte (6<<4) /* 8-bit sign-extended immediate operand. */
bfcadf83 67#define SrcOne (7<<4) /* Implied '1' */
341de7e3 68#define SrcImmUByte (8<<4) /* 8-bit unsigned immediate operand. */
c9eaf20f 69#define SrcImmU (9<<4) /* Immediate operand, unsigned */
a682e354 70#define SrcSI (0xa<<4) /* Source is in the DS:RSI */
414e6277
GN		 71#define SrcImmFAddr (0xb<<4) /* Source is immediate far address */
72#define SrcMemFAddr (0xc<<4) /* Source is far address in memory */
5d55f299 73#define SrcAcc (0xd<<4) /* Source Accumulator */
341de7e3 74#define SrcMask (0xf<<4)
6aa8b732 75/* Generic ModRM decode. */
341de7e3 76#define ModRM (1<<8)
6aa8b732 77/* Destination is only written; never read. */
341de7e3
GN		 78#define Mov (1<<9)
79#define BitOp (1<<10)
80#define MemAbs (1<<11) /* Memory operand is absolute displacement */
9c9fddd0
GT		 81#define String (1<<12) /* String instruction (rep capable) */
82#define Stack (1<<13) /* Stack instruction (push/pop) */
e09d082c
AK		 83#define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
84#define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
d8769fed 85/* Misc flags */
047a4818 86#define Undefined (1<<25) /* No Such Instruction */
d380a5e4 87#define Lock (1<<26) /* lock prefix is allowed for the instruction */
e92805ac 88#define Priv (1<<27) /* instruction generates #GP if current CPL != 0 */
d8769fed 89#define No64 (1<<28)
0dc8d10f
GT		 90/* Source 2 operand type */
91#define Src2None (0<<29)
92#define Src2CL (1<<29)
93#define Src2ImmByte (2<<29)
94#define Src2One (3<<29)
95#define Src2Mask (7<<29)
6aa8b732 96
ea9ef04e
AK		 97#define X2(x) x, x
98#define X3(x) X2(x), x
83babbca 99#define X4(x) X2(x), X2(x)
ea9ef04e 100#define X5(x) X4(x), x
83babbca
AK		 101#define X6(x) X4(x), X2(x)
102#define X7(x) X4(x), X3(x)
103#define X8(x) X4(x), X4(x)
104#define X16(x) X8(x), X8(x)
105
d65b1dee
AK		 106struct opcode {
107 u32 flags;
120df890
AK		 108 union {
109 struct opcode *group;
110 struct group_dual *gdual;
111 } u;
112};
113
114struct group_dual {
115 struct opcode mod012[8];
116 struct opcode mod3[8];
d65b1dee
AK		 117};
118
fd853310
AK		 119#define D(_y) { .flags = (_y) }
120#define N D(0)
120df890
AK		 121#define G(_f, _g) { .flags = ((_f) | Group), .u.group = (_g) }
122#define GD(_f, _g) { .flags = ((_f) | Group | GroupDual), .u.gdual = (_g) }
fd853310 123
5b92b5fa
AK		 124static struct opcode group1[] = {
125 X7(D(Lock)), N
126};
127
99880c5c 128static struct opcode group1A[] = {
42a1c520 129 D(DstMem | SrcNone | ModRM | Mov | Stack), N, N, N, N, N, N, N,
99880c5c
AK		 130};
131
ee70ea30 132static struct opcode group3[] = {
42a1c520
AK		 133 D(DstMem | SrcImm | ModRM), D(DstMem | SrcImm | ModRM),
134 D(DstMem | SrcNone | ModRM | Lock), D(DstMem | SrcNone | ModRM | Lock),
135 X4(D(Undefined)),
ee70ea30
AK		 136};
137
591c9d20 138static struct opcode group4[] = {
42a1c520
AK		 139 D(ByteOp | DstMem | SrcNone | ModRM | Lock), D(ByteOp | DstMem | SrcNone | ModRM | Lock),
140 N, N, N, N, N, N,
591c9d20
AK		 141};
142
b67f9f07 143static struct opcode group5[] = {
42a1c520
AK		 144 D(DstMem | SrcNone | ModRM | Lock), D(DstMem | SrcNone | ModRM | Lock),
145 D(SrcMem | ModRM | Stack), N,
146 D(SrcMem | ModRM | Stack), D(SrcMemFAddr | ModRM | ImplicitOps),
147 D(SrcMem | ModRM | Stack), N,
b67f9f07
AK		 148};
149
2f3a9bc9 150static struct group_dual group7 = { {
42a1c520
AK		 151 N, N, D(ModRM | SrcMem | Priv), D(ModRM | SrcMem | Priv),
152 D(SrcNone | ModRM | DstMem | Mov), N,
153 D(SrcMem16 | ModRM | Mov | Priv), D(SrcMem | ModRM | ByteOp | Priv),
2f3a9bc9
AK		 154}, {
155 D(SrcNone | ModRM | Priv), N, N, D(SrcNone | ModRM | Priv),
156 D(SrcNone | ModRM | DstMem | Mov), N,
157 D(SrcMem16 | ModRM | Mov | Priv), N,
158} };
159
2cb20bc8 160static struct opcode group8[] = {
42a1c520
AK		 161 N, N, N, N,
162 D(DstMem | SrcImmByte | ModRM), D(DstMem | SrcImmByte | ModRM | Lock),
163 D(DstMem | SrcImmByte | ModRM | Lock), D(DstMem | SrcImmByte | ModRM | Lock),
2cb20bc8
AK		 164};
165
9f5d3220 166static struct group_dual group9 = { {
42a1c520 167 N, D(DstMem64 | ModRM | Lock), N, N, N, N, N, N,
9f5d3220
AK		 168}, {
169 N, N, N, N, N, N, N, N,
170} };
171
d65b1dee 172static struct opcode opcode_table[256] = {
6aa8b732 173 /* 0x00 - 0x07 */
fd853310
AK		 174 D(ByteOp | DstMem | SrcReg | ModRM | Lock), D(DstMem | SrcReg | ModRM | Lock),
175 D(ByteOp | DstReg | SrcMem | ModRM), D(DstReg | SrcMem | ModRM),
176 D(ByteOp | DstAcc | SrcImm), D(DstAcc | SrcImm),
177 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
6aa8b732 178 /* 0x08 - 0x0F */
fd853310
AK		 179 D(ByteOp | DstMem | SrcReg | ModRM | Lock), D(DstMem | SrcReg | ModRM | Lock),
180 D(ByteOp | DstReg | SrcMem | ModRM), D(DstReg | SrcMem | ModRM),
181 D(ByteOp | DstAcc | SrcImm), D(DstAcc | SrcImm),
182 D(ImplicitOps | Stack | No64), N,
6aa8b732 183 /* 0x10 - 0x17 */
fd853310
AK		 184 D(ByteOp | DstMem | SrcReg | ModRM | Lock), D(DstMem | SrcReg | ModRM | Lock),
185 D(ByteOp | DstReg | SrcMem | ModRM), D(DstReg | SrcMem | ModRM),
186 D(ByteOp | DstAcc | SrcImm), D(DstAcc | SrcImm),
187 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
6aa8b732 188 /* 0x18 - 0x1F */
fd853310
AK		 189 D(ByteOp | DstMem | SrcReg | ModRM | Lock), D(DstMem | SrcReg | ModRM | Lock),
190 D(ByteOp | DstReg | SrcMem | ModRM), D(DstReg | SrcMem | ModRM),
191 D(ByteOp | DstAcc | SrcImm), D(DstAcc | SrcImm),
192 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
6aa8b732 193 /* 0x20 - 0x27 */
fd853310
AK		 194 D(ByteOp | DstMem | SrcReg | ModRM | Lock), D(DstMem | SrcReg | ModRM | Lock),
195 D(ByteOp | DstReg | SrcMem | ModRM), D(DstReg | SrcMem | ModRM),
196 D(ByteOp | DstAcc | SrcImmByte), D(DstAcc | SrcImm), N, N,
6aa8b732 197 /* 0x28 - 0x2F */
fd853310
AK		 198 D(ByteOp | DstMem | SrcReg | ModRM | Lock), D(DstMem | SrcReg | ModRM | Lock),
199 D(ByteOp | DstReg | SrcMem | ModRM), D(DstReg | SrcMem | ModRM),
200 D(ByteOp | DstAcc | SrcImmByte), D(DstAcc | SrcImm), N, N,
6aa8b732 201 /* 0x30 - 0x37 */
fd853310
AK		 202 D(ByteOp | DstMem | SrcReg | ModRM | Lock), D(DstMem | SrcReg | ModRM | Lock),
203 D(ByteOp | DstReg | SrcMem | ModRM), D(DstReg | SrcMem | ModRM),
204 D(ByteOp | DstAcc | SrcImmByte), D(DstAcc | SrcImm), N, N,
6aa8b732 205 /* 0x38 - 0x3F */
fd853310
AK		 206 D(ByteOp | DstMem | SrcReg | ModRM), D(DstMem | SrcReg | ModRM),
207 D(ByteOp | DstReg | SrcMem | ModRM), D(DstReg | SrcMem | ModRM),
208 D(ByteOp | DstAcc | SrcImm), D(DstAcc | SrcImm),
209 N, N,
749358a6 210 /* 0x40 - 0x4F */
fd853310 211 X16(D(DstReg)),
7f0aaee0 212 /* 0x50 - 0x57 */
fd853310 213 X8(D(SrcReg | Stack)),
7f0aaee0 214 /* 0x58 - 0x5F */
fd853310 215 X8(D(DstReg | Stack)),
7d316911 216 /* 0x60 - 0x67 */
fd853310
AK		 217 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
218 N, D(DstReg | SrcMem32 | ModRM | Mov) /* movsxd (x86/64) */ ,
219 N, N, N, N,
7d316911 220 /* 0x68 - 0x6F */
fd853310
AK		 221 D(SrcImm | Mov | Stack), N, D(SrcImmByte | Mov | Stack), N,
222 D(DstDI | ByteOp | Mov | String), D(DstDI | Mov | String), /* insb, insw/insd */
223 D(SrcSI | ByteOp | ImplicitOps | String), D(SrcSI | ImplicitOps | String), /* outsb, outsw/outsd */
b3ab3405 224 /* 0x70 - 0x7F */
fd853310 225 X16(D(SrcImmByte)),
6aa8b732 226 /* 0x80 - 0x87 */
5b92b5fa
AK		 227 G(ByteOp | DstMem | SrcImm | ModRM | Group, group1),
228 G(DstMem | SrcImm | ModRM | Group, group1),
229 G(ByteOp | DstMem | SrcImm | ModRM | No64 | Group, group1),
230 G(DstMem | SrcImmByte | ModRM | Group, group1),
fd853310
AK		 231 D(ByteOp | DstMem | SrcReg | ModRM), D(DstMem | SrcReg | ModRM),
232 D(ByteOp | DstMem | SrcReg | ModRM | Lock), D(DstMem | SrcReg | ModRM | Lock),
6aa8b732 233 /* 0x88 - 0x8F */
fd853310
AK		 234 D(ByteOp | DstMem | SrcReg | ModRM | Mov), D(DstMem | SrcReg | ModRM | Mov),
235 D(ByteOp | DstReg | SrcMem | ModRM | Mov), D(DstReg | SrcMem | ModRM | Mov),
236 D(DstMem | SrcNone | ModRM | Mov), D(ModRM | DstReg),
99880c5c 237 D(ImplicitOps | SrcMem16 | ModRM), G(0, group1A),
b13354f8 238 /* 0x90 - 0x97 */
fd853310 239 D(DstReg), D(DstReg), D(DstReg), D(DstReg), D(DstReg), D(DstReg), D(DstReg), D(DstReg),
b13354f8 240 /* 0x98 - 0x9F */
fd853310
AK		 241 N, N, D(SrcImmFAddr | No64), N,
242 D(ImplicitOps | Stack), D(ImplicitOps | Stack), N, N,
6aa8b732 243 /* 0xA0 - 0xA7 */
fd853310
AK		 244 D(ByteOp | DstAcc | SrcMem | Mov | MemAbs), D(DstAcc | SrcMem | Mov | MemAbs),
245 D(ByteOp | DstMem | SrcAcc | Mov | MemAbs), D(DstMem | SrcAcc | Mov | MemAbs),
246 D(ByteOp | SrcSI | DstDI | Mov | String), D(SrcSI | DstDI | Mov | String),
247 D(ByteOp | SrcSI | DstDI | String), D(SrcSI | DstDI | String),
6aa8b732 248 /* 0xA8 - 0xAF */
fd853310
AK		 249 D(DstAcc | SrcImmByte | ByteOp), D(DstAcc | SrcImm), D(ByteOp | DstDI | Mov | String), D(DstDI | Mov | String),
250 D(ByteOp | SrcSI | DstAcc | Mov | String), D(SrcSI | DstAcc | Mov | String),
251 D(ByteOp | DstDI | String), D(DstDI | String),
a5e2e82b 252 /* 0xB0 - 0xB7 */
fd853310 253 X8(D(ByteOp | DstReg | SrcImm | Mov)),
a5e2e82b 254 /* 0xB8 - 0xBF */
fd853310 255 X8(D(DstReg | SrcImm | Mov)),
6aa8b732 256 /* 0xC0 - 0xC7 */
fd853310
AK		 257 D(ByteOp | DstMem | SrcImm | ModRM), D(DstMem | SrcImmByte | ModRM),
258 N, D(ImplicitOps | Stack), N, N,
259 D(ByteOp | DstMem | SrcImm | ModRM | Mov), D(DstMem | SrcImm | ModRM | Mov),
6aa8b732 260 /* 0xC8 - 0xCF */
fd853310
AK		 261 N, N, N, D(ImplicitOps | Stack),
262 D(ImplicitOps), D(SrcImmByte), D(ImplicitOps | No64), D(ImplicitOps),
6aa8b732 263 /* 0xD0 - 0xD7 */
fd853310
AK		 264 D(ByteOp | DstMem | SrcImplicit | ModRM), D(DstMem | SrcImplicit | ModRM),
265 D(ByteOp | DstMem | SrcImplicit | ModRM), D(DstMem | SrcImplicit | ModRM),
266 N, N, N, N,
6aa8b732 267 /* 0xD8 - 0xDF */
fd853310 268 N, N, N, N, N, N, N, N,
098c937b 269 /* 0xE0 - 0xE7 */
fd853310
AK		 270 N, N, N, N,
271 D(ByteOp | SrcImmUByte | DstAcc), D(SrcImmUByte | DstAcc),
272 D(ByteOp | SrcImmUByte | DstAcc), D(SrcImmUByte | DstAcc),
098c937b 273 /* 0xE8 - 0xEF */
fd853310
AK		 274 D(SrcImm | Stack), D(SrcImm | ImplicitOps),
275 D(SrcImmFAddr | No64), D(SrcImmByte | ImplicitOps),
276 D(SrcNone | ByteOp | DstAcc), D(SrcNone | DstAcc),
277 D(SrcNone | ByteOp | DstAcc), D(SrcNone | DstAcc),
6aa8b732 278 /* 0xF0 - 0xF7 */
fd853310 279 N, N, N, N,
ee70ea30 280 D(ImplicitOps | Priv), D(ImplicitOps), G(ByteOp, group3), G(0, group3),
6aa8b732 281 /* 0xF8 - 0xFF */
fd853310 282 D(ImplicitOps), N, D(ImplicitOps), D(ImplicitOps),
b67f9f07 283 D(ImplicitOps), D(ImplicitOps), G(0, group4), G(0, group5),
6aa8b732
AK		 284};
285
d65b1dee 286static struct opcode twobyte_table[256] = {
6aa8b732 287 /* 0x00 - 0x0F */
2f3a9bc9 288 N, GD(0, &group7), N, N,
fd853310
AK		 289 N, D(ImplicitOps), D(ImplicitOps | Priv), N,
290 D(ImplicitOps | Priv), D(ImplicitOps | Priv), N, N,
291 N, D(ImplicitOps | ModRM), N, N,
6aa8b732 292 /* 0x10 - 0x1F */
fd853310 293 N, N, N, N, N, N, N, N, D(ImplicitOps | ModRM), N, N, N, N, N, N, N,
6aa8b732 294 /* 0x20 - 0x2F */
fd853310
AK		 295 D(ModRM | ImplicitOps | Priv), D(ModRM | Priv),
296 D(ModRM | ImplicitOps | Priv), D(ModRM | Priv),
297 N, N, N, N,
298 N, N, N, N, N, N, N, N,
6aa8b732 299 /* 0x30 - 0x3F */
fd853310
AK		 300 D(ImplicitOps | Priv), N, D(ImplicitOps | Priv), N,
301 D(ImplicitOps), D(ImplicitOps | Priv), N, N,
302 N, N, N, N, N, N, N, N,
be8eacdd 303 /* 0x40 - 0x4F */
fd853310 304 X16(D(DstReg | SrcMem | ModRM | Mov)),
6aa8b732 305 /* 0x50 - 0x5F */
fd853310 306 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
6aa8b732 307 /* 0x60 - 0x6F */
fd853310 308 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
6aa8b732 309 /* 0x70 - 0x7F */
fd853310 310 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
6aa8b732 311 /* 0x80 - 0x8F */
fd853310 312 X16(D(SrcImm)),
6aa8b732 313 /* 0x90 - 0x9F */
fd853310 314 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
6aa8b732 315 /* 0xA0 - 0xA7 */
fd853310
AK		 316 D(ImplicitOps | Stack), D(ImplicitOps | Stack),
317 N, D(DstMem | SrcReg | ModRM | BitOp),
318 D(DstMem | SrcReg | Src2ImmByte | ModRM),
319 D(DstMem | SrcReg | Src2CL | ModRM), N, N,
6aa8b732 320 /* 0xA8 - 0xAF */
fd853310
AK		 321 D(ImplicitOps | Stack), D(ImplicitOps | Stack),
322 N, D(DstMem | SrcReg | ModRM | BitOp | Lock),
323 D(DstMem | SrcReg | Src2ImmByte | ModRM),
324 D(DstMem | SrcReg | Src2CL | ModRM),
325 D(ModRM), N,
6aa8b732 326 /* 0xB0 - 0xB7 */
fd853310
AK		 327 D(ByteOp | DstMem | SrcReg | ModRM | Lock), D(DstMem | SrcReg | ModRM | Lock),
328 N, D(DstMem | SrcReg | ModRM | BitOp | Lock),
329 N, N, D(ByteOp | DstReg | SrcMem | ModRM | Mov),
330 D(DstReg | SrcMem16 | ModRM | Mov),
6aa8b732 331 /* 0xB8 - 0xBF */
fd853310 332 N, N,
2cb20bc8 333 G(0, group8), D(DstMem | SrcReg | ModRM | BitOp | Lock),
fd853310
AK		 334 N, N, D(ByteOp | DstReg | SrcMem | ModRM | Mov),
335 D(DstReg | SrcMem16 | ModRM | Mov),
6aa8b732 336 /* 0xC0 - 0xCF */
fd853310 337 N, N, N, D(DstMem | SrcReg | ModRM | Mov),
9f5d3220 338 N, N, N, GD(0, &group9),
fd853310 339 N, N, N, N, N, N, N, N,
6aa8b732 340 /* 0xD0 - 0xDF */
fd853310 341 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
6aa8b732 342 /* 0xE0 - 0xEF */
fd853310 343 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
6aa8b732 344 /* 0xF0 - 0xFF */
fd853310 345 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N
6aa8b732
AK		 346};
347
fd853310
AK		 348#undef D
349#undef N
120df890
AK		 350#undef G
351#undef GD
fd853310 352
6aa8b732 353/* EFLAGS bit definitions. */
d4c6a154
GN		 354#define EFLG_ID (1<<21)
355#define EFLG_VIP (1<<20)
356#define EFLG_VIF (1<<19)
357#define EFLG_AC (1<<18)
b1d86143
AP		 358#define EFLG_VM (1<<17)
359#define EFLG_RF (1<<16)
d4c6a154
GN		 360#define EFLG_IOPL (3<<12)
361#define EFLG_NT (1<<14)
6aa8b732
AK		 362#define EFLG_OF (1<<11)
363#define EFLG_DF (1<<10)
b1d86143 364#define EFLG_IF (1<<9)
d4c6a154 365#define EFLG_TF (1<<8)
6aa8b732
AK		 366#define EFLG_SF (1<<7)
367#define EFLG_ZF (1<<6)
368#define EFLG_AF (1<<4)
369#define EFLG_PF (1<<2)
370#define EFLG_CF (1<<0)
371
62bd430e
MG		 372#define EFLG_RESERVED_ZEROS_MASK 0xffc0802a
373#define EFLG_RESERVED_ONE_MASK 2
374
6aa8b732
AK		 375/*
376 * Instruction emulation:
377 * Most instructions are emulated directly via a fragment of inline assembly
378 * code. This allows us to save/restore EFLAGS and thus very easily pick up
379 * any modified flags.
380 */
381
05b3e0c2 382#if defined(CONFIG_X86_64)
6aa8b732
AK		 383#define _LO32 "k" /* force 32-bit operand */
384#define _STK "%%rsp" /* stack pointer */
385#elif defined(__i386__)
386#define _LO32 "" /* force 32-bit operand */
387#define _STK "%%esp" /* stack pointer */
388#endif
389
390/*
391 * These EFLAGS bits are restored from saved value during emulation, and
392 * any changes are written back to the saved value after emulation.
393 */
394#define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
395
396/* Before executing instruction: restore necessary bits in EFLAGS. */
e934c9c1
AK		 397#define _PRE_EFLAGS(_sav, _msk, _tmp) \
398 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
399 "movl %"_sav",%"_LO32 _tmp"; " \
400 "push %"_tmp"; " \
401 "push %"_tmp"; " \
402 "movl %"_msk",%"_LO32 _tmp"; " \
403 "andl %"_LO32 _tmp",("_STK"); " \
404 "pushf; " \
405 "notl %"_LO32 _tmp"; " \
406 "andl %"_LO32 _tmp",("_STK"); " \
407 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
408 "pop %"_tmp"; " \
409 "orl %"_LO32 _tmp",("_STK"); " \
410 "popf; " \
411 "pop %"_sav"; "
6aa8b732
AK		 412
413/* After executing instruction: write-back necessary bits in EFLAGS. */
414#define _POST_EFLAGS(_sav, _msk, _tmp) \
415 /* _sav |= EFLAGS & _msk; */ \
416 "pushf; " \
417 "pop %"_tmp"; " \
418 "andl %"_msk",%"_LO32 _tmp"; " \
419 "orl %"_LO32 _tmp",%"_sav"; "
420
dda96d8f
AK		 421#ifdef CONFIG_X86_64
422#define ON64(x) x
423#else
424#define ON64(x)
425#endif
426
6b7ad61f
AK		 427#define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix) \
428 do { \
429 __asm__ __volatile__ ( \
430 _PRE_EFLAGS("0", "4", "2") \
431 _op _suffix " %"_x"3,%1; " \
432 _POST_EFLAGS("0", "4", "2") \
433 : "=m" (_eflags), "=m" ((_dst).val), \
434 "=&r" (_tmp) \
435 : _y ((_src).val), "i" (EFLAGS_MASK)); \
f3fd92fb 436 } while (0)
6b7ad61f
AK		 437
438
6aa8b732
AK		 439/* Raw emulation: instruction has two explicit operands. */
440#define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
6b7ad61f
AK		 441 do { \
442 unsigned long _tmp; \
443 \
444 switch ((_dst).bytes) { \
445 case 2: \
446 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
447 break; \
448 case 4: \
449 ____emulate_2op(_op,_src,_dst,_eflags,_lx,_ly,"l"); \
450 break; \
451 case 8: \
452 ON64(____emulate_2op(_op,_src,_dst,_eflags,_qx,_qy,"q")); \
453 break; \
454 } \
6aa8b732
AK		 455 } while (0)
456
457#define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
458 do { \
6b7ad61f 459 unsigned long _tmp; \
d77c26fc 460 switch ((_dst).bytes) { \
6aa8b732 461 case 1: \
6b7ad61f 462 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b"); \
6aa8b732
AK		 463 break; \
464 default: \
465 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
466 _wx, _wy, _lx, _ly, _qx, _qy); \
467 break; \
468 } \
469 } while (0)
470
471/* Source operand is byte-sized and may be restricted to just %cl. */
472#define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
473 __emulate_2op(_op, _src, _dst, _eflags, \
474 "b", "c", "b", "c", "b", "c", "b", "c")
475
476/* Source operand is byte, word, long or quad sized. */
477#define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
478 __emulate_2op(_op, _src, _dst, _eflags, \
479 "b", "q", "w", "r", _LO32, "r", "", "r")
480
481/* Source operand is word, long or quad sized. */
482#define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
483 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
484 "w", "r", _LO32, "r", "", "r")
485
d175226a
GT		 486/* Instruction has three operands and one operand is stored in ECX register */
487#define __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, _suffix, _type) \
488 do { \
489 unsigned long _tmp; \
490 _type _clv = (_cl).val; \
491 _type _srcv = (_src).val; \
492 _type _dstv = (_dst).val; \
493 \
494 __asm__ __volatile__ ( \
495 _PRE_EFLAGS("0", "5", "2") \
496 _op _suffix " %4,%1 \n" \
497 _POST_EFLAGS("0", "5", "2") \
498 : "=m" (_eflags), "+r" (_dstv), "=&r" (_tmp) \
499 : "c" (_clv) , "r" (_srcv), "i" (EFLAGS_MASK) \
500 ); \
501 \
502 (_cl).val = (unsigned long) _clv; \
503 (_src).val = (unsigned long) _srcv; \
504 (_dst).val = (unsigned long) _dstv; \
505 } while (0)
506
507#define emulate_2op_cl(_op, _cl, _src, _dst, _eflags) \
508 do { \
509 switch ((_dst).bytes) { \
510 case 2: \
511 __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
512 "w", unsigned short); \
513 break; \
514 case 4: \
515 __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
516 "l", unsigned int); \
517 break; \
518 case 8: \
519 ON64(__emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
520 "q", unsigned long)); \
521 break; \
522 } \
523 } while (0)
524
dda96d8f 525#define __emulate_1op(_op, _dst, _eflags, _suffix) \
6aa8b732
AK		 526 do { \
527 unsigned long _tmp; \
528 \
dda96d8f
AK		 529 __asm__ __volatile__ ( \
530 _PRE_EFLAGS("0", "3", "2") \
531 _op _suffix " %1; " \
532 _POST_EFLAGS("0", "3", "2") \
533 : "=m" (_eflags), "+m" ((_dst).val), \
534 "=&r" (_tmp) \
535 : "i" (EFLAGS_MASK)); \
536 } while (0)
537
538/* Instruction has only one explicit operand (no source operand). */
539#define emulate_1op(_op, _dst, _eflags) \
540 do { \
d77c26fc 541 switch ((_dst).bytes) { \
dda96d8f
AK		 542 case 1: __emulate_1op(_op, _dst, _eflags, "b"); break; \
543 case 2: __emulate_1op(_op, _dst, _eflags, "w"); break; \
544 case 4: __emulate_1op(_op, _dst, _eflags, "l"); break; \
545 case 8: ON64(__emulate_1op(_op, _dst, _eflags, "q")); break; \
6aa8b732
AK		 546 } \
547 } while (0)
548
6aa8b732
AK		 549/* Fetch next part of the instruction being emulated. */
550#define insn_fetch(_type, _size, _eip) \
551({ unsigned long _x; \
62266869 552 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
af5b4f7f 553 if (rc != X86EMUL_CONTINUE) \
6aa8b732
AK		 554 goto done; \
555 (_eip) += (_size); \
556 (_type)_x; \
557})
558
414e6277
GN		 559#define insn_fetch_arr(_arr, _size, _eip) \
560({ rc = do_insn_fetch(ctxt, ops, (_eip), _arr, (_size)); \
561 if (rc != X86EMUL_CONTINUE) \
562 goto done; \
563 (_eip) += (_size); \
564})
565
ddcb2885
HH		 566static inline unsigned long ad_mask(struct decode_cache *c)
567{
568 return (1UL << (c->ad_bytes << 3)) - 1;
569}
570
6aa8b732 571/* Access/update address held in a register, based on addressing mode. */
e4706772
HH		 572static inline unsigned long
573address_mask(struct decode_cache *c, unsigned long reg)
574{
575 if (c->ad_bytes == sizeof(unsigned long))
576 return reg;
577 else
578 return reg & ad_mask(c);
579}
580
581static inline unsigned long
582register_address(struct decode_cache *c, unsigned long base, unsigned long reg)
583{
584 return base + address_mask(c, reg);
585}
586
7a957275
HH		 587static inline void
588register_address_increment(struct decode_cache *c, unsigned long *reg, int inc)
589{
590 if (c->ad_bytes == sizeof(unsigned long))
591 *reg += inc;
592 else
593 *reg = (*reg & ~ad_mask(c)) | ((*reg + inc) & ad_mask(c));
594}
6aa8b732 595
7a957275
HH		 596static inline void jmp_rel(struct decode_cache *c, int rel)
597{
598 register_address_increment(c, &c->eip, rel);
599}
098c937b 600
7a5b56df
AK		 601static void set_seg_override(struct decode_cache *c, int seg)
602{
603 c->has_seg_override = true;
604 c->seg_override = seg;
605}
606
79168fd1
GN		 607static unsigned long seg_base(struct x86_emulate_ctxt *ctxt,
608 struct x86_emulate_ops *ops, int seg)
7a5b56df
AK		 609{
610 if (ctxt->mode == X86EMUL_MODE_PROT64 && seg < VCPU_SREG_FS)
611 return 0;
612
79168fd1 613 return ops->get_cached_segment_base(seg, ctxt->vcpu);
7a5b56df
AK		 614}
615
616static unsigned long seg_override_base(struct x86_emulate_ctxt *ctxt,
79168fd1 617 struct x86_emulate_ops *ops,
7a5b56df
AK		 618 struct decode_cache *c)
619{
620 if (!c->has_seg_override)
621 return 0;
622
79168fd1 623 return seg_base(ctxt, ops, c->seg_override);
7a5b56df
AK		 624}
625
79168fd1
GN		 626static unsigned long es_base(struct x86_emulate_ctxt *ctxt,
627 struct x86_emulate_ops *ops)
7a5b56df 628{
79168fd1 629 return seg_base(ctxt, ops, VCPU_SREG_ES);
7a5b56df
AK		 630}
631
79168fd1
GN		 632static unsigned long ss_base(struct x86_emulate_ctxt *ctxt,
633 struct x86_emulate_ops *ops)
7a5b56df 634{
79168fd1 635 return seg_base(ctxt, ops, VCPU_SREG_SS);
7a5b56df
AK		 636}
637
54b8486f
GN		 638static void emulate_exception(struct x86_emulate_ctxt *ctxt, int vec,
639 u32 error, bool valid)
640{
641 ctxt->exception = vec;
642 ctxt->error_code = error;
643 ctxt->error_code_valid = valid;
644 ctxt->restart = false;
645}
646
647static void emulate_gp(struct x86_emulate_ctxt *ctxt, int err)
648{
649 emulate_exception(ctxt, GP_VECTOR, err, true);
650}
651
652static void emulate_pf(struct x86_emulate_ctxt *ctxt, unsigned long addr,
653 int err)
654{
655 ctxt->cr2 = addr;
656 emulate_exception(ctxt, PF_VECTOR, err, true);
657}
658
659static void emulate_ud(struct x86_emulate_ctxt *ctxt)
660{
661 emulate_exception(ctxt, UD_VECTOR, 0, false);
662}
663
664static void emulate_ts(struct x86_emulate_ctxt *ctxt, int err)
665{
666 emulate_exception(ctxt, TS_VECTOR, err, true);
667}
668
62266869
AK		 669static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
670 struct x86_emulate_ops *ops,
2fb53ad8 671 unsigned long eip, u8 *dest)
62266869
AK		 672{
673 struct fetch_cache *fc = &ctxt->decode.fetch;
674 int rc;
2fb53ad8 675 int size, cur_size;
62266869 676
2fb53ad8
AK		 677 if (eip == fc->end) {
678 cur_size = fc->end - fc->start;
679 size = min(15UL - cur_size, PAGE_SIZE - offset_in_page(eip));
680 rc = ops->fetch(ctxt->cs_base + eip, fc->data + cur_size,
681 size, ctxt->vcpu, NULL);
3e2815e9 682 if (rc != X86EMUL_CONTINUE)
62266869 683 return rc;
2fb53ad8 684 fc->end += size;
62266869 685 }
2fb53ad8 686 *dest = fc->data[eip - fc->start];
3e2815e9 687 return X86EMUL_CONTINUE;
62266869
AK		 688}
689
690static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
691 struct x86_emulate_ops *ops,
692 unsigned long eip, void *dest, unsigned size)
693{
3e2815e9 694 int rc;
62266869 695
eb3c79e6 696 /* x86 instructions are limited to 15 bytes. */
063db061 697 if (eip + size - ctxt->eip > 15)
eb3c79e6 698 return X86EMUL_UNHANDLEABLE;
62266869
AK		 699 while (size--) {
700 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
3e2815e9 701 if (rc != X86EMUL_CONTINUE)
62266869
AK		 702 return rc;
703 }
3e2815e9 704 return X86EMUL_CONTINUE;
62266869
AK		 705}
706
1e3c5cb0
RR		 707/*
708 * Given the 'reg' portion of a ModRM byte, and a register block, return a
709 * pointer into the block that addresses the relevant register.
710 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
711 */
712static void *decode_register(u8 modrm_reg, unsigned long *regs,
713 int highbyte_regs)
6aa8b732
AK		 714{
715 void *p;
716
717 p = &regs[modrm_reg];
718 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
719 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
720 return p;
721}
722
723static int read_descriptor(struct x86_emulate_ctxt *ctxt,
724 struct x86_emulate_ops *ops,
725 void *ptr,
726 u16 *size, unsigned long *address, int op_bytes)
727{
728 int rc;
729
730 if (op_bytes == 2)
731 op_bytes = 3;
732 *address = 0;
cebff02b 733 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
1871c602 734 ctxt->vcpu, NULL);
1b30eaa8 735 if (rc != X86EMUL_CONTINUE)
6aa8b732 736 return rc;
cebff02b 737 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
1871c602 738 ctxt->vcpu, NULL);
6aa8b732
AK		 739 return rc;
740}
741
bbe9abbd
NK		 742static int test_cc(unsigned int condition, unsigned int flags)
743{
744 int rc = 0;
745
746 switch ((condition & 15) >> 1) {
747 case 0: /* o */
748 rc |= (flags & EFLG_OF);
749 break;
750 case 1: /* b/c/nae */
751 rc |= (flags & EFLG_CF);
752 break;
753 case 2: /* z/e */
754 rc |= (flags & EFLG_ZF);
755 break;
756 case 3: /* be/na */
757 rc |= (flags & (EFLG_CF|EFLG_ZF));
758 break;
759 case 4: /* s */
760 rc |= (flags & EFLG_SF);
761 break;
762 case 5: /* p/pe */
763 rc |= (flags & EFLG_PF);
764 break;
765 case 7: /* le/ng */
766 rc |= (flags & EFLG_ZF);
767 /* fall through */
768 case 6: /* l/nge */
769 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
770 break;
771 }
772
773 /* Odd condition identifiers (lsb == 1) have inverted sense. */
774 return (!!rc ^ (condition & 1));
775}
776
3c118e24
AK		 777static void decode_register_operand(struct operand *op,
778 struct decode_cache *c,
3c118e24
AK		 779 int inhibit_bytereg)
780{
33615aa9 781 unsigned reg = c->modrm_reg;
9f1ef3f8 782 int highbyte_regs = c->rex_prefix == 0;
33615aa9
AK		 783
784 if (!(c->d & ModRM))
785 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
3c118e24
AK		 786 op->type = OP_REG;
787 if ((c->d & ByteOp) && !inhibit_bytereg) {
33615aa9 788 op->ptr = decode_register(reg, c->regs, highbyte_regs);
3c118e24
AK		 789 op->val = *(u8 *)op->ptr;
790 op->bytes = 1;
791 } else {
33615aa9 792 op->ptr = decode_register(reg, c->regs, 0);
3c118e24
AK		 793 op->bytes = c->op_bytes;
794 switch (op->bytes) {
795 case 2:
796 op->val = *(u16 *)op->ptr;
797 break;
798 case 4:
799 op->val = *(u32 *)op->ptr;
800 break;
801 case 8:
802 op->val = *(u64 *) op->ptr;
803 break;
804 }
805 }
806 op->orig_val = op->val;
807}
808
1c73ef66
AK		 809static int decode_modrm(struct x86_emulate_ctxt *ctxt,
810 struct x86_emulate_ops *ops)
811{
812 struct decode_cache *c = &ctxt->decode;
813 u8 sib;
f5b4edcd 814 int index_reg = 0, base_reg = 0, scale;
3e2815e9 815 int rc = X86EMUL_CONTINUE;
1c73ef66
AK		 816
817 if (c->rex_prefix) {
818 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
819 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
820 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
821 }
822
823 c->modrm = insn_fetch(u8, 1, c->eip);
824 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
825 c->modrm_reg |= (c->modrm & 0x38) >> 3;
826 c->modrm_rm |= (c->modrm & 0x07);
827 c->modrm_ea = 0;
828 c->use_modrm_ea = 1;
829
830 if (c->modrm_mod == 3) {
107d6d2e
AK		 831 c->modrm_ptr = decode_register(c->modrm_rm,
832 c->regs, c->d & ByteOp);
833 c->modrm_val = *(unsigned long *)c->modrm_ptr;
1c73ef66
AK		 834 return rc;
835 }
836
837 if (c->ad_bytes == 2) {
838 unsigned bx = c->regs[VCPU_REGS_RBX];
839 unsigned bp = c->regs[VCPU_REGS_RBP];
840 unsigned si = c->regs[VCPU_REGS_RSI];
841 unsigned di = c->regs[VCPU_REGS_RDI];
842
843 /* 16-bit ModR/M decode. */
844 switch (c->modrm_mod) {
845 case 0:
846 if (c->modrm_rm == 6)
847 c->modrm_ea += insn_fetch(u16, 2, c->eip);
848 break;
849 case 1:
850 c->modrm_ea += insn_fetch(s8, 1, c->eip);
851 break;
852 case 2:
853 c->modrm_ea += insn_fetch(u16, 2, c->eip);
854 break;
855 }
856 switch (c->modrm_rm) {
857 case 0:
858 c->modrm_ea += bx + si;
859 break;
860 case 1:
861 c->modrm_ea += bx + di;
862 break;
863 case 2:
864 c->modrm_ea += bp + si;
865 break;
866 case 3:
867 c->modrm_ea += bp + di;
868 break;
869 case 4:
870 c->modrm_ea += si;
871 break;
872 case 5:
873 c->modrm_ea += di;
874 break;
875 case 6:
876 if (c->modrm_mod != 0)
877 c->modrm_ea += bp;
878 break;
879 case 7:
880 c->modrm_ea += bx;
881 break;
882 }
883 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
884 (c->modrm_rm == 6 && c->modrm_mod != 0))
7a5b56df
AK		 885 if (!c->has_seg_override)
886 set_seg_override(c, VCPU_SREG_SS);
1c73ef66
AK		 887 c->modrm_ea = (u16)c->modrm_ea;
888 } else {
889 /* 32/64-bit ModR/M decode. */
84411d85 890 if ((c->modrm_rm & 7) == 4) {
1c73ef66
AK		 891 sib = insn_fetch(u8, 1, c->eip);
892 index_reg |= (sib >> 3) & 7;
893 base_reg |= sib & 7;
894 scale = sib >> 6;
895
dc71d0f1
AK		 896 if ((base_reg & 7) == 5 && c->modrm_mod == 0)
897 c->modrm_ea += insn_fetch(s32, 4, c->eip);
898 else
1c73ef66 899 c->modrm_ea += c->regs[base_reg];
dc71d0f1 900 if (index_reg != 4)
1c73ef66 901 c->modrm_ea += c->regs[index_reg] << scale;
84411d85
AK		 902 } else if ((c->modrm_rm & 7) == 5 && c->modrm_mod == 0) {
903 if (ctxt->mode == X86EMUL_MODE_PROT64)
f5b4edcd 904 c->rip_relative = 1;
84411d85 905 } else
1c73ef66 906 c->modrm_ea += c->regs[c->modrm_rm];
1c73ef66
AK		 907 switch (c->modrm_mod) {
908 case 0:
909 if (c->modrm_rm == 5)
910 c->modrm_ea += insn_fetch(s32, 4, c->eip);
911 break;
912 case 1:
913 c->modrm_ea += insn_fetch(s8, 1, c->eip);
914 break;
915 case 2:
916 c->modrm_ea += insn_fetch(s32, 4, c->eip);
917 break;
918 }
919 }
1c73ef66
AK		 920done:
921 return rc;
922}
923
924static int decode_abs(struct x86_emulate_ctxt *ctxt,
925 struct x86_emulate_ops *ops)
926{
927 struct decode_cache *c = &ctxt->decode;
3e2815e9 928 int rc = X86EMUL_CONTINUE;
1c73ef66
AK		 929
930 switch (c->ad_bytes) {
931 case 2:
932 c->modrm_ea = insn_fetch(u16, 2, c->eip);
933 break;
934 case 4:
935 c->modrm_ea = insn_fetch(u32, 4, c->eip);
936 break;
937 case 8:
938 c->modrm_ea = insn_fetch(u64, 8, c->eip);
939 break;
940 }
941done:
942 return rc;
943}
944
6aa8b732 945int
8b4caf66 946x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
6aa8b732 947{
e4e03ded 948 struct decode_cache *c = &ctxt->decode;
3e2815e9 949 int rc = X86EMUL_CONTINUE;
6aa8b732 950 int mode = ctxt->mode;
3885d530 951 int def_op_bytes, def_ad_bytes, dual, goffset;
120df890 952 struct opcode opcode, *g_mod012, *g_mod3;
6aa8b732 953
5cd21917
GN		 954 /* we cannot decode insn before we complete previous rep insn */
955 WARN_ON(ctxt->restart);
956
063db061 957 c->eip = ctxt->eip;
2fb53ad8 958 c->fetch.start = c->fetch.end = c->eip;
79168fd1 959 ctxt->cs_base = seg_base(ctxt, ops, VCPU_SREG_CS);
6aa8b732
AK		 960
961 switch (mode) {
962 case X86EMUL_MODE_REAL:
a0044755 963 case X86EMUL_MODE_VM86:
6aa8b732 964 case X86EMUL_MODE_PROT16:
f21b8bf4 965 def_op_bytes = def_ad_bytes = 2;
6aa8b732
AK		 966 break;
967 case X86EMUL_MODE_PROT32:
f21b8bf4 968 def_op_bytes = def_ad_bytes = 4;
6aa8b732 969 break;
05b3e0c2 970#ifdef CONFIG_X86_64
6aa8b732 971 case X86EMUL_MODE_PROT64:
f21b8bf4
AK		 972 def_op_bytes = 4;
973 def_ad_bytes = 8;
6aa8b732
AK		 974 break;
975#endif
976 default:
977 return -1;
978 }
979
f21b8bf4
AK		 980 c->op_bytes = def_op_bytes;
981 c->ad_bytes = def_ad_bytes;
982
6aa8b732 983 /* Legacy prefixes. */
b4c6abfe 984 for (;;) {
e4e03ded 985 switch (c->b = insn_fetch(u8, 1, c->eip)) {
6aa8b732 986 case 0x66: /* operand-size override */
f21b8bf4
AK		 987 /* switch between 2/4 bytes */
988 c->op_bytes = def_op_bytes ^ 6;
6aa8b732
AK		 989 break;
990 case 0x67: /* address-size override */
991 if (mode == X86EMUL_MODE_PROT64)
e4e03ded 992 /* switch between 4/8 bytes */
f21b8bf4 993 c->ad_bytes = def_ad_bytes ^ 12;
6aa8b732 994 else
e4e03ded 995 /* switch between 2/4 bytes */
f21b8bf4 996 c->ad_bytes = def_ad_bytes ^ 6;
6aa8b732 997 break;
7a5b56df 998 case 0x26: /* ES override */
6aa8b732 999 case 0x2e: /* CS override */
7a5b56df 1000 case 0x36: /* SS override */
6aa8b732 1001 case 0x3e: /* DS override */
7a5b56df 1002 set_seg_override(c, (c->b >> 3) & 3);
6aa8b732
AK		 1003 break;
1004 case 0x64: /* FS override */
6aa8b732 1005 case 0x65: /* GS override */
7a5b56df 1006 set_seg_override(c, c->b & 7);
6aa8b732 1007 break;
b4c6abfe
LV		 1008 case 0x40 ... 0x4f: /* REX */
1009 if (mode != X86EMUL_MODE_PROT64)
1010 goto done_prefixes;
33615aa9 1011 c->rex_prefix = c->b;
b4c6abfe 1012 continue;
6aa8b732 1013 case 0xf0: /* LOCK */
e4e03ded 1014 c->lock_prefix = 1;
6aa8b732 1015 break;
ae6200ba 1016 case 0xf2: /* REPNE/REPNZ */
90e0a28f
GT		 1017 c->rep_prefix = REPNE_PREFIX;
1018 break;
6aa8b732 1019 case 0xf3: /* REP/REPE/REPZ */
90e0a28f 1020 c->rep_prefix = REPE_PREFIX;
6aa8b732 1021 break;
6aa8b732
AK		 1022 default:
1023 goto done_prefixes;
1024 }
b4c6abfe
LV		 1025
1026 /* Any legacy prefix after a REX prefix nullifies its effect. */
1027
33615aa9 1028 c->rex_prefix = 0;
6aa8b732
AK		 1029 }
1030
1031done_prefixes:
1032
1033 /* REX prefix. */
1c73ef66 1034 if (c->rex_prefix)
33615aa9 1035 if (c->rex_prefix & 8)
e4e03ded 1036 c->op_bytes = 8; /* REX.W */
6aa8b732
AK		 1037
1038 /* Opcode byte(s). */
120df890
AK		 1039 opcode = opcode_table[c->b];
1040 if (opcode.flags == 0) {
6aa8b732 1041 /* Two-byte opcode? */
e4e03ded
LV		 1042 if (c->b == 0x0f) {
1043 c->twobyte = 1;
1044 c->b = insn_fetch(u8, 1, c->eip);
120df890 1045 opcode = twobyte_table[c->b];
6aa8b732 1046 }
e09d082c 1047 }
120df890 1048 c->d = opcode.flags;
6aa8b732 1049
e09d082c 1050 if (c->d & Group) {
52811d7d 1051 dual = c->d & GroupDual;
e09d082c
AK		 1052 c->modrm = insn_fetch(u8, 1, c->eip);
1053 --c->eip;
1054
3885d530
AK		 1055 if (c->d & GroupDual) {
1056 g_mod012 = opcode.u.gdual->mod012;
1057 g_mod3 = opcode.u.gdual->mod3;
1058 } else
1059 g_mod012 = g_mod3 = opcode.u.group;
120df890 1060
3885d530 1061 c->d &= ~(Group | GroupDual);
120df890
AK		 1062
1063 goffset = (c->modrm >> 3) & 7;
1064
1065 if ((c->modrm >> 6) == 3)
1066 opcode = g_mod3[goffset];
e09d082c 1067 else
120df890
AK		 1068 opcode = g_mod012[goffset];
1069 c->d |= opcode.flags;
e09d082c
AK		 1070 }
1071
1072 /* Unrecognised? */
047a4818 1073 if (c->d == 0 || (c->d & Undefined)) {
e09d082c
AK		 1074 DPRINTF("Cannot emulate %02x\n", c->b);
1075 return -1;
6aa8b732
AK		 1076 }
1077
6e3d5dfb
AK		 1078 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
1079 c->op_bytes = 8;
1080
6aa8b732 1081 /* ModRM and SIB bytes. */
1c73ef66
AK		 1082 if (c->d & ModRM)
1083 rc = decode_modrm(ctxt, ops);
1084 else if (c->d & MemAbs)
1085 rc = decode_abs(ctxt, ops);
3e2815e9 1086 if (rc != X86EMUL_CONTINUE)
1c73ef66 1087 goto done;
6aa8b732 1088
7a5b56df
AK		 1089 if (!c->has_seg_override)
1090 set_seg_override(c, VCPU_SREG_DS);
c7e75a3d 1091
7a5b56df 1092 if (!(!c->twobyte && c->b == 0x8d))
79168fd1 1093 c->modrm_ea += seg_override_base(ctxt, ops, c);
c7e75a3d
AK		 1094
1095 if (c->ad_bytes != 8)
1096 c->modrm_ea = (u32)c->modrm_ea;
69f55cb1
GN		 1097
1098 if (c->rip_relative)
1099 c->modrm_ea += c->eip;
1100
6aa8b732
AK		 1101 /*
1102 * Decode and fetch the source operand: register, memory
1103 * or immediate.
1104 */
e4e03ded 1105 switch (c->d & SrcMask) {
6aa8b732
AK		 1106 case SrcNone:
1107 break;
1108 case SrcReg:
9f1ef3f8 1109 decode_register_operand(&c->src, c, 0);
6aa8b732
AK		 1110 break;
1111 case SrcMem16:
e4e03ded 1112 c->src.bytes = 2;
6aa8b732
AK		 1113 goto srcmem_common;
1114 case SrcMem32:
e4e03ded 1115 c->src.bytes = 4;
6aa8b732
AK		 1116 goto srcmem_common;
1117 case SrcMem:
e4e03ded
LV		 1118 c->src.bytes = (c->d & ByteOp) ? 1 :
1119 c->op_bytes;
b85b9ee9 1120 /* Don't fetch the address for invlpg: it could be unmapped. */
d77c26fc 1121 if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
b85b9ee9 1122 break;
d77c26fc 1123 srcmem_common:
4e62417b
AJ		 1124 /*
1125 * For instructions with a ModR/M byte, switch to register
1126 * access if Mod = 3.
1127 */
e4e03ded
LV		 1128 if ((c->d & ModRM) && c->modrm_mod == 3) {
1129 c->src.type = OP_REG;
66b85505 1130 c->src.val = c->modrm_val;
107d6d2e 1131 c->src.ptr = c->modrm_ptr;
4e62417b
AJ		 1132 break;
1133 }
e4e03ded 1134 c->src.type = OP_MEM;
69f55cb1
GN		 1135 c->src.ptr = (unsigned long *)c->modrm_ea;
1136 c->src.val = 0;
6aa8b732
AK		 1137 break;
1138 case SrcImm:
c9eaf20f 1139 case SrcImmU:
e4e03ded
LV		 1140 c->src.type = OP_IMM;
1141 c->src.ptr = (unsigned long *)c->eip;
1142 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1143 if (c->src.bytes == 8)
1144 c->src.bytes = 4;
6aa8b732 1145 /* NB. Immediates are sign-extended as necessary. */
e4e03ded 1146 switch (c->src.bytes) {
6aa8b732 1147 case 1:
e4e03ded 1148 c->src.val = insn_fetch(s8, 1, c->eip);
6aa8b732
AK		 1149 break;
1150 case 2:
e4e03ded 1151 c->src.val = insn_fetch(s16, 2, c->eip);
6aa8b732
AK		 1152 break;
1153 case 4:
e4e03ded 1154 c->src.val = insn_fetch(s32, 4, c->eip);
6aa8b732
AK		 1155 break;
1156 }
c9eaf20f
AK		 1157 if ((c->d & SrcMask) == SrcImmU) {
1158 switch (c->src.bytes) {
1159 case 1:
1160 c->src.val &= 0xff;
1161 break;
1162 case 2:
1163 c->src.val &= 0xffff;
1164 break;
1165 case 4:
1166 c->src.val &= 0xffffffff;
1167 break;
1168 }
1169 }
6aa8b732
AK		 1170 break;
1171 case SrcImmByte:
341de7e3 1172 case SrcImmUByte:
e4e03ded
LV		 1173 c->src.type = OP_IMM;
1174 c->src.ptr = (unsigned long *)c->eip;
1175 c->src.bytes = 1;
341de7e3
GN		 1176 if ((c->d & SrcMask) == SrcImmByte)
1177 c->src.val = insn_fetch(s8, 1, c->eip);
1178 else
1179 c->src.val = insn_fetch(u8, 1, c->eip);
6aa8b732 1180 break;
5d55f299
WY		 1181 case SrcAcc:
1182 c->src.type = OP_REG;
1183 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1184 c->src.ptr = &c->regs[VCPU_REGS_RAX];
1185 switch (c->src.bytes) {
1186 case 1:
1187 c->src.val = *(u8 *)c->src.ptr;
1188 break;
1189 case 2:
1190 c->src.val = *(u16 *)c->src.ptr;
1191 break;
1192 case 4:
1193 c->src.val = *(u32 *)c->src.ptr;
1194 break;
1195 case 8:
1196 c->src.val = *(u64 *)c->src.ptr;
1197 break;
1198 }
1199 break;
bfcadf83
GT		 1200 case SrcOne:
1201 c->src.bytes = 1;
1202 c->src.val = 1;
1203 break;
a682e354
GN		 1204 case SrcSI:
1205 c->src.type = OP_MEM;
1206 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1207 c->src.ptr = (unsigned long *)
79168fd1 1208 register_address(c, seg_override_base(ctxt, ops, c),
a682e354
GN		 1209 c->regs[VCPU_REGS_RSI]);
1210 c->src.val = 0;
1211 break;
414e6277
GN		 1212 case SrcImmFAddr:
1213 c->src.type = OP_IMM;
1214 c->src.ptr = (unsigned long *)c->eip;
1215 c->src.bytes = c->op_bytes + 2;
1216 insn_fetch_arr(c->src.valptr, c->src.bytes, c->eip);
1217 break;
1218 case SrcMemFAddr:
1219 c->src.type = OP_MEM;
1220 c->src.ptr = (unsigned long *)c->modrm_ea;
1221 c->src.bytes = c->op_bytes + 2;
1222 break;
6aa8b732
AK		 1223 }
1224
0dc8d10f
GT		 1225 /*
1226 * Decode and fetch the second source operand: register, memory
1227 * or immediate.
1228 */
1229 switch (c->d & Src2Mask) {
1230 case Src2None:
1231 break;
1232 case Src2CL:
1233 c->src2.bytes = 1;
1234 c->src2.val = c->regs[VCPU_REGS_RCX] & 0x8;
1235 break;
1236 case Src2ImmByte:
1237 c->src2.type = OP_IMM;
1238 c->src2.ptr = (unsigned long *)c->eip;
1239 c->src2.bytes = 1;
1240 c->src2.val = insn_fetch(u8, 1, c->eip);
1241 break;
1242 case Src2One:
1243 c->src2.bytes = 1;
1244 c->src2.val = 1;
1245 break;
1246 }
1247
038e51de 1248 /* Decode and fetch the destination operand: register or memory. */
e4e03ded 1249 switch (c->d & DstMask) {
038e51de
AK		 1250 case ImplicitOps:
1251 /* Special instructions do their own operand decoding. */
8b4caf66 1252 return 0;
038e51de 1253 case DstReg:
9f1ef3f8 1254 decode_register_operand(&c->dst, c,
3c118e24 1255 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
038e51de
AK		 1256 break;
1257 case DstMem:
6550e1f1 1258 case DstMem64:
e4e03ded 1259 if ((c->d & ModRM) && c->modrm_mod == 3) {
89c69638 1260 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
e4e03ded 1261 c->dst.type = OP_REG;
66b85505 1262 c->dst.val = c->dst.orig_val = c->modrm_val;
107d6d2e 1263 c->dst.ptr = c->modrm_ptr;
4e62417b
AJ		 1264 break;
1265 }
8b4caf66 1266 c->dst.type = OP_MEM;
69f55cb1 1267 c->dst.ptr = (unsigned long *)c->modrm_ea;
6550e1f1
GN		 1268 if ((c->d & DstMask) == DstMem64)
1269 c->dst.bytes = 8;
1270 else
1271 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
69f55cb1
GN		 1272 c->dst.val = 0;
1273 if (c->d & BitOp) {
1274 unsigned long mask = ~(c->dst.bytes * 8 - 1);
1275
1276 c->dst.ptr = (void *)c->dst.ptr +
1277 (c->src.val & mask) / 8;
1278 }
8b4caf66 1279 break;
9c9fddd0
GT		 1280 case DstAcc:
1281 c->dst.type = OP_REG;
d6d367d6 1282 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
9c9fddd0 1283 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
d6d367d6 1284 switch (c->dst.bytes) {
9c9fddd0
GT		 1285 case 1:
1286 c->dst.val = *(u8 *)c->dst.ptr;
1287 break;
1288 case 2:
1289 c->dst.val = *(u16 *)c->dst.ptr;
1290 break;
1291 case 4:
1292 c->dst.val = *(u32 *)c->dst.ptr;
1293 break;
d6d367d6
GN		 1294 case 8:
1295 c->dst.val = *(u64 *)c->dst.ptr;
1296 break;
9c9fddd0
GT		 1297 }
1298 c->dst.orig_val = c->dst.val;
1299 break;
a682e354
GN		 1300 case DstDI:
1301 c->dst.type = OP_MEM;
1302 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1303 c->dst.ptr = (unsigned long *)
79168fd1 1304 register_address(c, es_base(ctxt, ops),
a682e354
GN		 1305 c->regs[VCPU_REGS_RDI]);
1306 c->dst.val = 0;
1307 break;
8b4caf66
LV		 1308 }
1309
1310done:
1311 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1312}
1313
9de41573
GN		 1314static int read_emulated(struct x86_emulate_ctxt *ctxt,
1315 struct x86_emulate_ops *ops,
1316 unsigned long addr, void *dest, unsigned size)
1317{
1318 int rc;
1319 struct read_cache *mc = &ctxt->decode.mem_read;
8fe681e9 1320 u32 err;
9de41573
GN		 1321
1322 while (size) {
1323 int n = min(size, 8u);
1324 size -= n;
1325 if (mc->pos < mc->end)
1326 goto read_cached;
1327
8fe681e9
GN		 1328 rc = ops->read_emulated(addr, mc->data + mc->end, n, &err,
1329 ctxt->vcpu);
1330 if (rc == X86EMUL_PROPAGATE_FAULT)
54b8486f 1331 emulate_pf(ctxt, addr, err);
9de41573
GN		 1332 if (rc != X86EMUL_CONTINUE)
1333 return rc;
1334 mc->end += n;
1335
1336 read_cached:
1337 memcpy(dest, mc->data + mc->pos, n);
1338 mc->pos += n;
1339 dest += n;
1340 addr += n;
1341 }
1342 return X86EMUL_CONTINUE;
1343}
1344
7b262e90
GN		 1345static int pio_in_emulated(struct x86_emulate_ctxt *ctxt,
1346 struct x86_emulate_ops *ops,
1347 unsigned int size, unsigned short port,
1348 void *dest)
1349{
1350 struct read_cache *rc = &ctxt->decode.io_read;
1351
1352 if (rc->pos == rc->end) { /* refill pio read ahead */
1353 struct decode_cache *c = &ctxt->decode;
1354 unsigned int in_page, n;
1355 unsigned int count = c->rep_prefix ?
1356 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1;
1357 in_page = (ctxt->eflags & EFLG_DF) ?
1358 offset_in_page(c->regs[VCPU_REGS_RDI]) :
1359 PAGE_SIZE - offset_in_page(c->regs[VCPU_REGS_RDI]);
1360 n = min(min(in_page, (unsigned int)sizeof(rc->data)) / size,
1361 count);
1362 if (n == 0)
1363 n = 1;
1364 rc->pos = rc->end = 0;
1365 if (!ops->pio_in_emulated(size, port, rc->data, n, ctxt->vcpu))
1366 return 0;
1367 rc->end = n * size;
1368 }
1369
1370 memcpy(dest, rc->data + rc->pos, size);
1371 rc->pos += size;
1372 return 1;
1373}
1374
38ba30ba
GN		 1375static u32 desc_limit_scaled(struct desc_struct *desc)
1376{
1377 u32 limit = get_desc_limit(desc);
1378
1379 return desc->g ? (limit << 12) | 0xfff : limit;
1380}
1381
1382static void get_descriptor_table_ptr(struct x86_emulate_ctxt *ctxt,
1383 struct x86_emulate_ops *ops,
1384 u16 selector, struct desc_ptr *dt)
1385{
1386 if (selector & 1 << 2) {
1387 struct desc_struct desc;
1388 memset (dt, 0, sizeof *dt);
1389 if (!ops->get_cached_descriptor(&desc, VCPU_SREG_LDTR, ctxt->vcpu))
1390 return;
1391
1392 dt->size = desc_limit_scaled(&desc); /* what if limit > 65535? */
1393 dt->address = get_desc_base(&desc);
1394 } else
1395 ops->get_gdt(dt, ctxt->vcpu);
1396}
1397
1398/* allowed just for 8 bytes segments */
1399static int read_segment_descriptor(struct x86_emulate_ctxt *ctxt,
1400 struct x86_emulate_ops *ops,
1401 u16 selector, struct desc_struct *desc)
1402{
1403 struct desc_ptr dt;
1404 u16 index = selector >> 3;
1405 int ret;
1406 u32 err;
1407 ulong addr;
1408
1409 get_descriptor_table_ptr(ctxt, ops, selector, &dt);
1410
1411 if (dt.size < index * 8 + 7) {
54b8486f 1412 emulate_gp(ctxt, selector & 0xfffc);
38ba30ba
GN		 1413 return X86EMUL_PROPAGATE_FAULT;
1414 }
1415 addr = dt.address + index * 8;
1416 ret = ops->read_std(addr, desc, sizeof *desc, ctxt->vcpu, &err);
1417 if (ret == X86EMUL_PROPAGATE_FAULT)
54b8486f 1418 emulate_pf(ctxt, addr, err);
38ba30ba
GN		 1419
1420 return ret;
1421}
1422
1423/* allowed just for 8 bytes segments */
1424static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt,
1425 struct x86_emulate_ops *ops,
1426 u16 selector, struct desc_struct *desc)
1427{
1428 struct desc_ptr dt;
1429 u16 index = selector >> 3;
1430 u32 err;
1431 ulong addr;
1432 int ret;
1433
1434 get_descriptor_table_ptr(ctxt, ops, selector, &dt);
1435
1436 if (dt.size < index * 8 + 7) {
54b8486f 1437 emulate_gp(ctxt, selector & 0xfffc);
38ba30ba
GN		 1438 return X86EMUL_PROPAGATE_FAULT;
1439 }
1440
1441 addr = dt.address + index * 8;
1442 ret = ops->write_std(addr, desc, sizeof *desc, ctxt->vcpu, &err);
1443 if (ret == X86EMUL_PROPAGATE_FAULT)
54b8486f 1444 emulate_pf(ctxt, addr, err);
38ba30ba
GN		 1445
1446 return ret;
1447}
1448
1449static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
1450 struct x86_emulate_ops *ops,
1451 u16 selector, int seg)
1452{
1453 struct desc_struct seg_desc;
1454 u8 dpl, rpl, cpl;
1455 unsigned err_vec = GP_VECTOR;
1456 u32 err_code = 0;
1457 bool null_selector = !(selector & ~0x3); /* 0000-0003 are null */
1458 int ret;
1459
1460 memset(&seg_desc, 0, sizeof seg_desc);
1461
1462 if ((seg <= VCPU_SREG_GS && ctxt->mode == X86EMUL_MODE_VM86)
1463 || ctxt->mode == X86EMUL_MODE_REAL) {
1464 /* set real mode segment descriptor */
1465 set_desc_base(&seg_desc, selector << 4);
1466 set_desc_limit(&seg_desc, 0xffff);
1467 seg_desc.type = 3;
1468 seg_desc.p = 1;
1469 seg_desc.s = 1;
1470 goto load;
1471 }
1472
1473 /* NULL selector is not valid for TR, CS and SS */
1474 if ((seg == VCPU_SREG_CS || seg == VCPU_SREG_SS || seg == VCPU_SREG_TR)
1475 && null_selector)
1476 goto exception;
1477
1478 /* TR should be in GDT only */
1479 if (seg == VCPU_SREG_TR && (selector & (1 << 2)))
1480 goto exception;
1481
1482 if (null_selector) /* for NULL selector skip all following checks */
1483 goto load;
1484
1485 ret = read_segment_descriptor(ctxt, ops, selector, &seg_desc);
1486 if (ret != X86EMUL_CONTINUE)
1487 return ret;
1488
1489 err_code = selector & 0xfffc;
1490 err_vec = GP_VECTOR;
1491
1492 /* can't load system descriptor into segment selecor */
1493 if (seg <= VCPU_SREG_GS && !seg_desc.s)
1494 goto exception;
1495
1496 if (!seg_desc.p) {
1497 err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR;
1498 goto exception;
1499 }
1500
1501 rpl = selector & 3;
1502 dpl = seg_desc.dpl;
1503 cpl = ops->cpl(ctxt->vcpu);
1504
1505 switch (seg) {
1506 case VCPU_SREG_SS:
1507 /*
1508 * segment is not a writable data segment or segment
1509 * selector's RPL != CPL or segment selector's RPL != CPL
1510 */
1511 if (rpl != cpl || (seg_desc.type & 0xa) != 0x2 || dpl != cpl)
1512 goto exception;
1513 break;
1514 case VCPU_SREG_CS:
1515 if (!(seg_desc.type & 8))
1516 goto exception;
1517
1518 if (seg_desc.type & 4) {
1519 /* conforming */
1520 if (dpl > cpl)
1521 goto exception;
1522 } else {
1523 /* nonconforming */
1524 if (rpl > cpl || dpl != cpl)
1525 goto exception;
1526 }
1527 /* CS(RPL) <- CPL */
1528 selector = (selector & 0xfffc) | cpl;
1529 break;
1530 case VCPU_SREG_TR:
1531 if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9))
1532 goto exception;
1533 break;
1534 case VCPU_SREG_LDTR:
1535 if (seg_desc.s || seg_desc.type != 2)
1536 goto exception;
1537 break;
1538 default: /* DS, ES, FS, or GS */
1539 /*
1540 * segment is not a data or readable code segment or
1541 * ((segment is a data or nonconforming code segment)
1542 * and (both RPL and CPL > DPL))
1543 */
1544 if ((seg_desc.type & 0xa) == 0x8 ||
1545 (((seg_desc.type & 0xc) != 0xc) &&
1546 (rpl > dpl && cpl > dpl)))
1547 goto exception;
1548 break;
1549 }
1550
1551 if (seg_desc.s) {
1552 /* mark segment as accessed */
1553 seg_desc.type |= 1;
1554 ret = write_segment_descriptor(ctxt, ops, selector, &seg_desc);
1555 if (ret != X86EMUL_CONTINUE)
1556 return ret;
1557 }
1558load:
1559 ops->set_segment_selector(selector, seg, ctxt->vcpu);
1560 ops->set_cached_descriptor(&seg_desc, seg, ctxt->vcpu);
1561 return X86EMUL_CONTINUE;
1562exception:
54b8486f 1563 emulate_exception(ctxt, err_vec, err_code, true);
38ba30ba
GN		 1564 return X86EMUL_PROPAGATE_FAULT;
1565}
1566
c37eda13
WY		 1567static inline int writeback(struct x86_emulate_ctxt *ctxt,
1568 struct x86_emulate_ops *ops)
1569{
1570 int rc;
1571 struct decode_cache *c = &ctxt->decode;
1572 u32 err;
1573
1574 switch (c->dst.type) {
1575 case OP_REG:
1576 /* The 4-byte case *is* correct:
1577 * in 64-bit mode we zero-extend.
1578 */
1579 switch (c->dst.bytes) {
1580 case 1:
1581 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1582 break;
1583 case 2:
1584 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1585 break;
1586 case 4:
1587 *c->dst.ptr = (u32)c->dst.val;
1588 break; /* 64b: zero-ext */
1589 case 8:
1590 *c->dst.ptr = c->dst.val;
1591 break;
1592 }
1593 break;
1594 case OP_MEM:
1595 if (c->lock_prefix)
1596 rc = ops->cmpxchg_emulated(
1597 (unsigned long)c->dst.ptr,
1598 &c->dst.orig_val,
1599 &c->dst.val,
1600 c->dst.bytes,
1601 &err,
1602 ctxt->vcpu);
1603 else
1604 rc = ops->write_emulated(
1605 (unsigned long)c->dst.ptr,
1606 &c->dst.val,
1607 c->dst.bytes,
1608 &err,
1609 ctxt->vcpu);
1610 if (rc == X86EMUL_PROPAGATE_FAULT)
1611 emulate_pf(ctxt,
1612 (unsigned long)c->dst.ptr, err);
1613 if (rc != X86EMUL_CONTINUE)
1614 return rc;
1615 break;
1616 case OP_NONE:
1617 /* no writeback */
1618 break;
1619 default:
1620 break;
1621 }
1622 return X86EMUL_CONTINUE;
1623}
1624
79168fd1
GN		 1625static inline void emulate_push(struct x86_emulate_ctxt *ctxt,
1626 struct x86_emulate_ops *ops)
8cdbd2c9
LV		 1627{
1628 struct decode_cache *c = &ctxt->decode;
1629
1630 c->dst.type = OP_MEM;
1631 c->dst.bytes = c->op_bytes;
1632 c->dst.val = c->src.val;
7a957275 1633 register_address_increment(c, &c->regs[VCPU_REGS_RSP], -c->op_bytes);
79168fd1 1634 c->dst.ptr = (void *) register_address(c, ss_base(ctxt, ops),
8cdbd2c9
LV		 1635 c->regs[VCPU_REGS_RSP]);
1636}
1637
faa5a3ae 1638static int emulate_pop(struct x86_emulate_ctxt *ctxt,
350f69dc
AK		 1639 struct x86_emulate_ops *ops,
1640 void *dest, int len)
8cdbd2c9
LV		 1641{
1642 struct decode_cache *c = &ctxt->decode;
1643 int rc;
1644
79168fd1 1645 rc = read_emulated(ctxt, ops, register_address(c, ss_base(ctxt, ops),
9de41573
GN		 1646 c->regs[VCPU_REGS_RSP]),
1647 dest, len);
b60d513c 1648 if (rc != X86EMUL_CONTINUE)
8cdbd2c9
LV		 1649 return rc;
1650
350f69dc 1651 register_address_increment(c, &c->regs[VCPU_REGS_RSP], len);
faa5a3ae
AK		 1652 return rc;
1653}
8cdbd2c9 1654
d4c6a154
GN		 1655static int emulate_popf(struct x86_emulate_ctxt *ctxt,
1656 struct x86_emulate_ops *ops,
1657 void *dest, int len)
1658{
1659 int rc;
1660 unsigned long val, change_mask;
1661 int iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
9c537244 1662 int cpl = ops->cpl(ctxt->vcpu);
d4c6a154
GN		 1663
1664 rc = emulate_pop(ctxt, ops, &val, len);
1665 if (rc != X86EMUL_CONTINUE)
1666 return rc;
1667
1668 change_mask = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF | EFLG_OF
1669 | EFLG_TF | EFLG_DF | EFLG_NT | EFLG_RF | EFLG_AC | EFLG_ID;
1670
1671 switch(ctxt->mode) {
1672 case X86EMUL_MODE_PROT64:
1673 case X86EMUL_MODE_PROT32:
1674 case X86EMUL_MODE_PROT16:
1675 if (cpl == 0)
1676 change_mask |= EFLG_IOPL;
1677 if (cpl <= iopl)
1678 change_mask |= EFLG_IF;
1679 break;
1680 case X86EMUL_MODE_VM86:
1681 if (iopl < 3) {
54b8486f 1682 emulate_gp(ctxt, 0);
d4c6a154
GN		 1683 return X86EMUL_PROPAGATE_FAULT;
1684 }
1685 change_mask |= EFLG_IF;
1686 break;
1687 default: /* real mode */
1688 change_mask |= (EFLG_IOPL | EFLG_IF);
1689 break;
1690 }
1691
1692 *(unsigned long *)dest =
1693 (ctxt->eflags & ~change_mask) | (val & change_mask);
1694
1695 return rc;
1696}
1697
79168fd1
GN		 1698static void emulate_push_sreg(struct x86_emulate_ctxt *ctxt,
1699 struct x86_emulate_ops *ops, int seg)
0934ac9d
MG		 1700{
1701 struct decode_cache *c = &ctxt->decode;
0934ac9d 1702
79168fd1 1703 c->src.val = ops->get_segment_selector(seg, ctxt->vcpu);
0934ac9d 1704
79168fd1 1705 emulate_push(ctxt, ops);
0934ac9d
MG		 1706}
1707
1708static int emulate_pop_sreg(struct x86_emulate_ctxt *ctxt,
1709 struct x86_emulate_ops *ops, int seg)
1710{
1711 struct decode_cache *c = &ctxt->decode;
1712 unsigned long selector;
1713 int rc;
1714
1715 rc = emulate_pop(ctxt, ops, &selector, c->op_bytes);
1b30eaa8 1716 if (rc != X86EMUL_CONTINUE)
0934ac9d
MG		 1717 return rc;
1718
2e873022 1719 rc = load_segment_descriptor(ctxt, ops, (u16)selector, seg);
0934ac9d
MG		 1720 return rc;
1721}
1722
c37eda13 1723static int emulate_pusha(struct x86_emulate_ctxt *ctxt,
79168fd1 1724 struct x86_emulate_ops *ops)
abcf14b5
MG		 1725{
1726 struct decode_cache *c = &ctxt->decode;
1727 unsigned long old_esp = c->regs[VCPU_REGS_RSP];
c37eda13 1728 int rc = X86EMUL_CONTINUE;
abcf14b5
MG		 1729 int reg = VCPU_REGS_RAX;
1730
1731 while (reg <= VCPU_REGS_RDI) {
1732 (reg == VCPU_REGS_RSP) ?
1733 (c->src.val = old_esp) : (c->src.val = c->regs[reg]);
1734
79168fd1 1735 emulate_push(ctxt, ops);
c37eda13
WY		 1736
1737 rc = writeback(ctxt, ops);
1738 if (rc != X86EMUL_CONTINUE)
1739 return rc;
1740
abcf14b5
MG		 1741 ++reg;
1742 }
c37eda13
WY		 1743
1744 /* Disable writeback. */
1745 c->dst.type = OP_NONE;
1746
1747 return rc;
abcf14b5
MG		 1748}
1749
1750static int emulate_popa(struct x86_emulate_ctxt *ctxt,
1751 struct x86_emulate_ops *ops)
1752{
1753 struct decode_cache *c = &ctxt->decode;
1b30eaa8 1754 int rc = X86EMUL_CONTINUE;
abcf14b5
MG		 1755 int reg = VCPU_REGS_RDI;
1756
1757 while (reg >= VCPU_REGS_RAX) {
1758 if (reg == VCPU_REGS_RSP) {
1759 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1760 c->op_bytes);
1761 --reg;
1762 }
1763
1764 rc = emulate_pop(ctxt, ops, &c->regs[reg], c->op_bytes);
1b30eaa8 1765 if (rc != X86EMUL_CONTINUE)
abcf14b5
MG		 1766 break;
1767 --reg;
1768 }
1769 return rc;
1770}
1771
62bd430e
MG		 1772static int emulate_iret_real(struct x86_emulate_ctxt *ctxt,
1773 struct x86_emulate_ops *ops)
1774{
1775 struct decode_cache *c = &ctxt->decode;
1776 int rc = X86EMUL_CONTINUE;
1777 unsigned long temp_eip = 0;
1778 unsigned long temp_eflags = 0;
1779 unsigned long cs = 0;
1780 unsigned long mask = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF | EFLG_TF |
1781 EFLG_IF | EFLG_DF | EFLG_OF | EFLG_IOPL | EFLG_NT | EFLG_RF |
1782 EFLG_AC | EFLG_ID | (1 << 1); /* Last one is the reserved bit */
1783 unsigned long vm86_mask = EFLG_VM | EFLG_VIF | EFLG_VIP;
1784
1785 /* TODO: Add stack limit check */
1786
1787 rc = emulate_pop(ctxt, ops, &temp_eip, c->op_bytes);
1788
1789 if (rc != X86EMUL_CONTINUE)
1790 return rc;
1791
1792 if (temp_eip & ~0xffff) {
1793 emulate_gp(ctxt, 0);
1794 return X86EMUL_PROPAGATE_FAULT;
1795 }
1796
1797 rc = emulate_pop(ctxt, ops, &cs, c->op_bytes);
1798
1799 if (rc != X86EMUL_CONTINUE)
1800 return rc;
1801
1802 rc = emulate_pop(ctxt, ops, &temp_eflags, c->op_bytes);
1803
1804 if (rc != X86EMUL_CONTINUE)
1805 return rc;
1806
1807 rc = load_segment_descriptor(ctxt, ops, (u16)cs, VCPU_SREG_CS);
1808
1809 if (rc != X86EMUL_CONTINUE)
1810 return rc;
1811
1812 c->eip = temp_eip;
1813
1814
1815 if (c->op_bytes == 4)
1816 ctxt->eflags = ((temp_eflags & mask) | (ctxt->eflags & vm86_mask));
1817 else if (c->op_bytes == 2) {
1818 ctxt->eflags &= ~0xffff;
1819 ctxt->eflags |= temp_eflags;
1820 }
1821
1822 ctxt->eflags &= ~EFLG_RESERVED_ZEROS_MASK; /* Clear reserved zeros */
1823 ctxt->eflags |= EFLG_RESERVED_ONE_MASK;
1824
1825 return rc;
1826}
1827
1828static inline int emulate_iret(struct x86_emulate_ctxt *ctxt,
1829 struct x86_emulate_ops* ops)
1830{
1831 switch(ctxt->mode) {
1832 case X86EMUL_MODE_REAL:
1833 return emulate_iret_real(ctxt, ops);
1834 case X86EMUL_MODE_VM86:
1835 case X86EMUL_MODE_PROT16:
1836 case X86EMUL_MODE_PROT32:
1837 case X86EMUL_MODE_PROT64:
1838 default:
1839 /* iret from protected mode unimplemented yet */
1840 return X86EMUL_UNHANDLEABLE;
1841 }
1842}
1843
faa5a3ae
AK		 1844static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
1845 struct x86_emulate_ops *ops)
1846{
1847 struct decode_cache *c = &ctxt->decode;
faa5a3ae 1848
1b30eaa8 1849 return emulate_pop(ctxt, ops, &c->dst.val, c->dst.bytes);
8cdbd2c9
LV		 1850}
1851
05f086f8 1852static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
8cdbd2c9 1853{
05f086f8 1854 struct decode_cache *c = &ctxt->decode;
8cdbd2c9
LV		 1855 switch (c->modrm_reg) {
1856 case 0: /* rol */
05f086f8 1857 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1858 break;
1859 case 1: /* ror */
05f086f8 1860 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1861 break;
1862 case 2: /* rcl */
05f086f8 1863 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1864 break;
1865 case 3: /* rcr */
05f086f8 1866 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1867 break;
1868 case 4: /* sal/shl */
1869 case 6: /* sal/shl */
05f086f8 1870 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1871 break;
1872 case 5: /* shr */
05f086f8 1873 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1874 break;
1875 case 7: /* sar */
05f086f8 1876 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1877 break;
1878 }
1879}
1880
1881static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
05f086f8 1882 struct x86_emulate_ops *ops)
8cdbd2c9
LV		 1883{
1884 struct decode_cache *c = &ctxt->decode;
8cdbd2c9
LV		 1885
1886 switch (c->modrm_reg) {
1887 case 0 ... 1: /* test */
05f086f8 1888 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1889 break;
1890 case 2: /* not */
1891 c->dst.val = ~c->dst.val;
1892 break;
1893 case 3: /* neg */
05f086f8 1894 emulate_1op("neg", c->dst, ctxt->eflags);
8cdbd2c9
LV		 1895 break;
1896 default:
aca06a83 1897 return 0;
8cdbd2c9 1898 }
aca06a83 1899 return 1;
8cdbd2c9
LV		 1900}
1901
1902static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
a01af5ec 1903 struct x86_emulate_ops *ops)
8cdbd2c9
LV		 1904{
1905 struct decode_cache *c = &ctxt->decode;
8cdbd2c9
LV		 1906
1907 switch (c->modrm_reg) {
1908 case 0: /* inc */
05f086f8 1909 emulate_1op("inc", c->dst, ctxt->eflags);
8cdbd2c9
LV		 1910 break;
1911 case 1: /* dec */
05f086f8 1912 emulate_1op("dec", c->dst, ctxt->eflags);
8cdbd2c9 1913 break;
d19292e4
MG		 1914 case 2: /* call near abs */ {
1915 long int old_eip;
1916 old_eip = c->eip;
1917 c->eip = c->src.val;
1918 c->src.val = old_eip;
79168fd1 1919 emulate_push(ctxt, ops);
d19292e4
MG		 1920 break;
1921 }
8cdbd2c9 1922 case 4: /* jmp abs */
fd60754e 1923 c->eip = c->src.val;
8cdbd2c9
LV		 1924 break;
1925 case 6: /* push */
79168fd1 1926 emulate_push(ctxt, ops);
8cdbd2c9 1927 break;
8cdbd2c9 1928 }
1b30eaa8 1929 return X86EMUL_CONTINUE;
8cdbd2c9
LV		 1930}
1931
1932static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
69f55cb1 1933 struct x86_emulate_ops *ops)
8cdbd2c9
LV		 1934{
1935 struct decode_cache *c = &ctxt->decode;
16518d5a 1936 u64 old = c->dst.orig_val64;
8cdbd2c9
LV		 1937
1938 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1939 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
8cdbd2c9
LV		 1940 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1941 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
05f086f8 1942 ctxt->eflags &= ~EFLG_ZF;
8cdbd2c9 1943 } else {
16518d5a
AK		 1944 c->dst.val64 = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1945 (u32) c->regs[VCPU_REGS_RBX];
8cdbd2c9 1946
05f086f8 1947 ctxt->eflags |= EFLG_ZF;
8cdbd2c9 1948 }
1b30eaa8 1949 return X86EMUL_CONTINUE;
8cdbd2c9
LV		 1950}
1951
a77ab5ea
AK		 1952static int emulate_ret_far(struct x86_emulate_ctxt *ctxt,
1953 struct x86_emulate_ops *ops)
1954{
1955 struct decode_cache *c = &ctxt->decode;
1956 int rc;
1957 unsigned long cs;
1958
1959 rc = emulate_pop(ctxt, ops, &c->eip, c->op_bytes);
1b30eaa8 1960 if (rc != X86EMUL_CONTINUE)
a77ab5ea
AK		 1961 return rc;
1962 if (c->op_bytes == 4)
1963 c->eip = (u32)c->eip;
1964 rc = emulate_pop(ctxt, ops, &cs, c->op_bytes);
1b30eaa8 1965 if (rc != X86EMUL_CONTINUE)
a77ab5ea 1966 return rc;
2e873022 1967 rc = load_segment_descriptor(ctxt, ops, (u16)cs, VCPU_SREG_CS);
a77ab5ea
AK		 1968 return rc;
1969}
1970
e66bb2cc
AP		 1971static inline void
1972setup_syscalls_segments(struct x86_emulate_ctxt *ctxt,
79168fd1
GN		 1973 struct x86_emulate_ops *ops, struct desc_struct *cs,
1974 struct desc_struct *ss)
e66bb2cc 1975{
79168fd1
GN		 1976 memset(cs, 0, sizeof(struct desc_struct));
1977 ops->get_cached_descriptor(cs, VCPU_SREG_CS, ctxt->vcpu);
1978 memset(ss, 0, sizeof(struct desc_struct));
e66bb2cc
AP		 1979
1980 cs->l = 0; /* will be adjusted later */
79168fd1 1981 set_desc_base(cs, 0); /* flat segment */
e66bb2cc 1982 cs->g = 1; /* 4kb granularity */
79168fd1 1983 set_desc_limit(cs, 0xfffff); /* 4GB limit */
e66bb2cc
AP		 1984 cs->type = 0x0b; /* Read, Execute, Accessed */
1985 cs->s = 1;
1986 cs->dpl = 0; /* will be adjusted later */
79168fd1
GN		 1987 cs->p = 1;
1988 cs->d = 1;
e66bb2cc 1989
79168fd1
GN		 1990 set_desc_base(ss, 0); /* flat segment */
1991 set_desc_limit(ss, 0xfffff); /* 4GB limit */
e66bb2cc
AP		 1992 ss->g = 1; /* 4kb granularity */
1993 ss->s = 1;
1994 ss->type = 0x03; /* Read/Write, Accessed */
79168fd1 1995 ss->d = 1; /* 32bit stack segment */
e66bb2cc 1996 ss->dpl = 0;
79168fd1 1997 ss->p = 1;
e66bb2cc
AP		 1998}
1999
2000static int
3fb1b5db 2001emulate_syscall(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
e66bb2cc
AP		 2002{
2003 struct decode_cache *c = &ctxt->decode;
79168fd1 2004 struct desc_struct cs, ss;
e66bb2cc 2005 u64 msr_data;
79168fd1 2006 u16 cs_sel, ss_sel;
e66bb2cc
AP		 2007
2008 /* syscall is not available in real mode */
2e901c4c
GN		 2009 if (ctxt->mode == X86EMUL_MODE_REAL ||
2010 ctxt->mode == X86EMUL_MODE_VM86) {
54b8486f 2011 emulate_ud(ctxt);
2e901c4c
GN		 2012 return X86EMUL_PROPAGATE_FAULT;
2013 }
e66bb2cc 2014
79168fd1 2015 setup_syscalls_segments(ctxt, ops, &cs, &ss);
e66bb2cc 2016
3fb1b5db 2017 ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
e66bb2cc 2018 msr_data >>= 32;
79168fd1
GN		 2019 cs_sel = (u16)(msr_data & 0xfffc);
2020 ss_sel = (u16)(msr_data + 8);
e66bb2cc
AP		 2021
2022 if (is_long_mode(ctxt->vcpu)) {
79168fd1 2023 cs.d = 0;
e66bb2cc
AP		 2024 cs.l = 1;
2025 }
79168fd1
GN		 2026 ops->set_cached_descriptor(&cs, VCPU_SREG_CS, ctxt->vcpu);
2027 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
2028 ops->set_cached_descriptor(&ss, VCPU_SREG_SS, ctxt->vcpu);
2029 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
e66bb2cc
AP		 2030
2031 c->regs[VCPU_REGS_RCX] = c->eip;
2032 if (is_long_mode(ctxt->vcpu)) {
2033#ifdef CONFIG_X86_64
2034 c->regs[VCPU_REGS_R11] = ctxt->eflags & ~EFLG_RF;
2035
3fb1b5db
GN		 2036 ops->get_msr(ctxt->vcpu,
2037 ctxt->mode == X86EMUL_MODE_PROT64 ?
2038 MSR_LSTAR : MSR_CSTAR, &msr_data);
e66bb2cc
AP		 2039 c->eip = msr_data;
2040
3fb1b5db 2041 ops->get_msr(ctxt->vcpu, MSR_SYSCALL_MASK, &msr_data);
e66bb2cc
AP		 2042 ctxt->eflags &= ~(msr_data | EFLG_RF);
2043#endif
2044 } else {
2045 /* legacy mode */
3fb1b5db 2046 ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
e66bb2cc
AP		 2047 c->eip = (u32)msr_data;
2048
2049 ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
2050 }
2051
e54cfa97 2052 return X86EMUL_CONTINUE;
e66bb2cc
AP		 2053}
2054
8c604352 2055static int
3fb1b5db 2056emulate_sysenter(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
8c604352
AP		 2057{
2058 struct decode_cache *c = &ctxt->decode;
79168fd1 2059 struct desc_struct cs, ss;
8c604352 2060 u64 msr_data;
79168fd1 2061 u16 cs_sel, ss_sel;
8c604352 2062
a0044755
GN		 2063 /* inject #GP if in real mode */
2064 if (ctxt->mode == X86EMUL_MODE_REAL) {
54b8486f 2065 emulate_gp(ctxt, 0);
2e901c4c 2066 return X86EMUL_PROPAGATE_FAULT;
8c604352
AP		 2067 }
2068
2069 /* XXX sysenter/sysexit have not been tested in 64bit mode.
2070 * Therefore, we inject an #UD.
2071 */
2e901c4c 2072 if (ctxt->mode == X86EMUL_MODE_PROT64) {
54b8486f 2073 emulate_ud(ctxt);
2e901c4c
GN		 2074 return X86EMUL_PROPAGATE_FAULT;
2075 }
8c604352 2076
79168fd1 2077 setup_syscalls_segments(ctxt, ops, &cs, &ss);
8c604352 2078
3fb1b5db 2079 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_CS, &msr_data);
8c604352
AP		 2080 switch (ctxt->mode) {
2081 case X86EMUL_MODE_PROT32:
2082 if ((msr_data & 0xfffc) == 0x0) {
54b8486f 2083 emulate_gp(ctxt, 0);
e54cfa97 2084 return X86EMUL_PROPAGATE_FAULT;
8c604352
AP		 2085 }
2086 break;
2087 case X86EMUL_MODE_PROT64:
2088 if (msr_data == 0x0) {
54b8486f 2089 emulate_gp(ctxt, 0);
e54cfa97 2090 return X86EMUL_PROPAGATE_FAULT;
8c604352
AP		 2091 }
2092 break;
2093 }
2094
2095 ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
79168fd1
GN		 2096 cs_sel = (u16)msr_data;
2097 cs_sel &= ~SELECTOR_RPL_MASK;
2098 ss_sel = cs_sel + 8;
2099 ss_sel &= ~SELECTOR_RPL_MASK;
8c604352
AP		 2100 if (ctxt->mode == X86EMUL_MODE_PROT64
2101 || is_long_mode(ctxt->vcpu)) {
79168fd1 2102 cs.d = 0;
8c604352
AP		 2103 cs.l = 1;
2104 }
2105
79168fd1
GN		 2106 ops->set_cached_descriptor(&cs, VCPU_SREG_CS, ctxt->vcpu);
2107 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
2108 ops->set_cached_descriptor(&ss, VCPU_SREG_SS, ctxt->vcpu);
2109 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
8c604352 2110
3fb1b5db 2111 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_EIP, &msr_data);
8c604352
AP		 2112 c->eip = msr_data;
2113
3fb1b5db 2114 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_ESP, &msr_data);
8c604352
AP		 2115 c->regs[VCPU_REGS_RSP] = msr_data;
2116
e54cfa97 2117 return X86EMUL_CONTINUE;
8c604352
AP		 2118}
2119
4668f050 2120static int
3fb1b5db 2121emulate_sysexit(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
4668f050
AP		 2122{
2123 struct decode_cache *c = &ctxt->decode;
79168fd1 2124 struct desc_struct cs, ss;
4668f050
AP		 2125 u64 msr_data;
2126 int usermode;
79168fd1 2127 u16 cs_sel, ss_sel;
4668f050 2128
a0044755
GN		 2129 /* inject #GP if in real mode or Virtual 8086 mode */
2130 if (ctxt->mode == X86EMUL_MODE_REAL ||
2131 ctxt->mode == X86EMUL_MODE_VM86) {
54b8486f 2132 emulate_gp(ctxt, 0);
2e901c4c 2133 return X86EMUL_PROPAGATE_FAULT;
4668f050
AP		 2134 }
2135
79168fd1 2136 setup_syscalls_segments(ctxt, ops, &cs, &ss);
4668f050
AP		 2137
2138 if ((c->rex_prefix & 0x8) != 0x0)
2139 usermode = X86EMUL_MODE_PROT64;
2140 else
2141 usermode = X86EMUL_MODE_PROT32;
2142
2143 cs.dpl = 3;
2144 ss.dpl = 3;
3fb1b5db 2145 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_CS, &msr_data);
4668f050
AP		 2146 switch (usermode) {
2147 case X86EMUL_MODE_PROT32:
79168fd1 2148 cs_sel = (u16)(msr_data + 16);
4668f050 2149 if ((msr_data & 0xfffc) == 0x0) {
54b8486f 2150 emulate_gp(ctxt, 0);
e54cfa97 2151 return X86EMUL_PROPAGATE_FAULT;
4668f050 2152 }
79168fd1 2153 ss_sel = (u16)(msr_data + 24);
4668f050
AP		 2154 break;
2155 case X86EMUL_MODE_PROT64:
79168fd1 2156 cs_sel = (u16)(msr_data + 32);
4668f050 2157 if (msr_data == 0x0) {
54b8486f 2158 emulate_gp(ctxt, 0);
e54cfa97 2159 return X86EMUL_PROPAGATE_FAULT;
4668f050 2160 }
79168fd1
GN		 2161 ss_sel = cs_sel + 8;
2162 cs.d = 0;
4668f050
AP		 2163 cs.l = 1;
2164 break;
2165 }
79168fd1
GN		 2166 cs_sel |= SELECTOR_RPL_MASK;
2167 ss_sel |= SELECTOR_RPL_MASK;
4668f050 2168
79168fd1
GN		 2169 ops->set_cached_descriptor(&cs, VCPU_SREG_CS, ctxt->vcpu);
2170 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
2171 ops->set_cached_descriptor(&ss, VCPU_SREG_SS, ctxt->vcpu);
2172 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
4668f050 2173
bdb475a3
GN		 2174 c->eip = c->regs[VCPU_REGS_RDX];
2175 c->regs[VCPU_REGS_RSP] = c->regs[VCPU_REGS_RCX];
4668f050 2176
e54cfa97 2177 return X86EMUL_CONTINUE;
4668f050
AP		 2178}
2179
9c537244
GN		 2180static bool emulator_bad_iopl(struct x86_emulate_ctxt *ctxt,
2181 struct x86_emulate_ops *ops)
f850e2e6
GN		 2182{
2183 int iopl;
2184 if (ctxt->mode == X86EMUL_MODE_REAL)
2185 return false;
2186 if (ctxt->mode == X86EMUL_MODE_VM86)
2187 return true;
2188 iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
9c537244 2189 return ops->cpl(ctxt->vcpu) > iopl;
f850e2e6
GN		 2190}
2191
2192static bool emulator_io_port_access_allowed(struct x86_emulate_ctxt *ctxt,
2193 struct x86_emulate_ops *ops,
2194 u16 port, u16 len)
2195{
79168fd1 2196 struct desc_struct tr_seg;
f850e2e6
GN		 2197 int r;
2198 u16 io_bitmap_ptr;
2199 u8 perm, bit_idx = port & 0x7;
2200 unsigned mask = (1 << len) - 1;
2201
79168fd1
GN		 2202 ops->get_cached_descriptor(&tr_seg, VCPU_SREG_TR, ctxt->vcpu);
2203 if (!tr_seg.p)
f850e2e6 2204 return false;
79168fd1 2205 if (desc_limit_scaled(&tr_seg) < 103)
f850e2e6 2206 return false;
79168fd1
GN		 2207 r = ops->read_std(get_desc_base(&tr_seg) + 102, &io_bitmap_ptr, 2,
2208 ctxt->vcpu, NULL);
f850e2e6
GN		 2209 if (r != X86EMUL_CONTINUE)
2210 return false;
79168fd1 2211 if (io_bitmap_ptr + port/8 > desc_limit_scaled(&tr_seg))
f850e2e6 2212 return false;
79168fd1
GN		 2213 r = ops->read_std(get_desc_base(&tr_seg) + io_bitmap_ptr + port/8,
2214 &perm, 1, ctxt->vcpu, NULL);
f850e2e6
GN		 2215 if (r != X86EMUL_CONTINUE)
2216 return false;
2217 if ((perm >> bit_idx) & mask)
2218 return false;
2219 return true;
2220}
2221
2222static bool emulator_io_permited(struct x86_emulate_ctxt *ctxt,
2223 struct x86_emulate_ops *ops,
2224 u16 port, u16 len)
2225{
9c537244 2226 if (emulator_bad_iopl(ctxt, ops))
f850e2e6
GN		 2227 if (!emulator_io_port_access_allowed(ctxt, ops, port, len))
2228 return false;
2229 return true;
2230}
2231
38ba30ba
GN		 2232static void save_state_to_tss16(struct x86_emulate_ctxt *ctxt,
2233 struct x86_emulate_ops *ops,
2234 struct tss_segment_16 *tss)
2235{
2236 struct decode_cache *c = &ctxt->decode;
2237
2238 tss->ip = c->eip;
2239 tss->flag = ctxt->eflags;
2240 tss->ax = c->regs[VCPU_REGS_RAX];
2241 tss->cx = c->regs[VCPU_REGS_RCX];
2242 tss->dx = c->regs[VCPU_REGS_RDX];
2243 tss->bx = c->regs[VCPU_REGS_RBX];
2244 tss->sp = c->regs[VCPU_REGS_RSP];
2245 tss->bp = c->regs[VCPU_REGS_RBP];
2246 tss->si = c->regs[VCPU_REGS_RSI];
2247 tss->di = c->regs[VCPU_REGS_RDI];
2248
2249 tss->es = ops->get_segment_selector(VCPU_SREG_ES, ctxt->vcpu);
2250 tss->cs = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
2251 tss->ss = ops->get_segment_selector(VCPU_SREG_SS, ctxt->vcpu);
2252 tss->ds = ops->get_segment_selector(VCPU_SREG_DS, ctxt->vcpu);
2253 tss->ldt = ops->get_segment_selector(VCPU_SREG_LDTR, ctxt->vcpu);
2254}
2255
2256static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
2257 struct x86_emulate_ops *ops,
2258 struct tss_segment_16 *tss)
2259{
2260 struct decode_cache *c = &ctxt->decode;
2261 int ret;
2262
2263 c->eip = tss->ip;
2264 ctxt->eflags = tss->flag | 2;
2265 c->regs[VCPU_REGS_RAX] = tss->ax;
2266 c->regs[VCPU_REGS_RCX] = tss->cx;
2267 c->regs[VCPU_REGS_RDX] = tss->dx;
2268 c->regs[VCPU_REGS_RBX] = tss->bx;
2269 c->regs[VCPU_REGS_RSP] = tss->sp;
2270 c->regs[VCPU_REGS_RBP] = tss->bp;
2271 c->regs[VCPU_REGS_RSI] = tss->si;
2272 c->regs[VCPU_REGS_RDI] = tss->di;
2273
2274 /*
2275 * SDM says that segment selectors are loaded before segment
2276 * descriptors
2277 */
2278 ops->set_segment_selector(tss->ldt, VCPU_SREG_LDTR, ctxt->vcpu);
2279 ops->set_segment_selector(tss->es, VCPU_SREG_ES, ctxt->vcpu);
2280 ops->set_segment_selector(tss->cs, VCPU_SREG_CS, ctxt->vcpu);
2281 ops->set_segment_selector(tss->ss, VCPU_SREG_SS, ctxt->vcpu);
2282 ops->set_segment_selector(tss->ds, VCPU_SREG_DS, ctxt->vcpu);
2283
2284 /*
2285 * Now load segment descriptors. If fault happenes at this stage
2286 * it is handled in a context of new task
2287 */
2288 ret = load_segment_descriptor(ctxt, ops, tss->ldt, VCPU_SREG_LDTR);
2289 if (ret != X86EMUL_CONTINUE)
2290 return ret;
2291 ret = load_segment_descriptor(ctxt, ops, tss->es, VCPU_SREG_ES);
2292 if (ret != X86EMUL_CONTINUE)
2293 return ret;
2294 ret = load_segment_descriptor(ctxt, ops, tss->cs, VCPU_SREG_CS);
2295 if (ret != X86EMUL_CONTINUE)
2296 return ret;
2297 ret = load_segment_descriptor(ctxt, ops, tss->ss, VCPU_SREG_SS);
2298 if (ret != X86EMUL_CONTINUE)
2299 return ret;
2300 ret = load_segment_descriptor(ctxt, ops, tss->ds, VCPU_SREG_DS);
2301 if (ret != X86EMUL_CONTINUE)
2302 return ret;
2303
2304 return X86EMUL_CONTINUE;
2305}
2306
2307static int task_switch_16(struct x86_emulate_ctxt *ctxt,
2308 struct x86_emulate_ops *ops,
2309 u16 tss_selector, u16 old_tss_sel,
2310 ulong old_tss_base, struct desc_struct *new_desc)
2311{
2312 struct tss_segment_16 tss_seg;
2313 int ret;
2314 u32 err, new_tss_base = get_desc_base(new_desc);
2315
2316 ret = ops->read_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2317 &err);
2318 if (ret == X86EMUL_PROPAGATE_FAULT) {
2319 /* FIXME: need to provide precise fault address */
54b8486f 2320 emulate_pf(ctxt, old_tss_base, err);
38ba30ba
GN		 2321 return ret;
2322 }
2323
2324 save_state_to_tss16(ctxt, ops, &tss_seg);
2325
2326 ret = ops->write_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2327 &err);
2328 if (ret == X86EMUL_PROPAGATE_FAULT) {
2329 /* FIXME: need to provide precise fault address */
54b8486f 2330 emulate_pf(ctxt, old_tss_base, err);
38ba30ba
GN		 2331 return ret;
2332 }
2333
2334 ret = ops->read_std(new_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2335 &err);
2336 if (ret == X86EMUL_PROPAGATE_FAULT) {
2337 /* FIXME: need to provide precise fault address */
54b8486f 2338 emulate_pf(ctxt, new_tss_base, err);
38ba30ba
GN		 2339 return ret;
2340 }
2341
2342 if (old_tss_sel != 0xffff) {
2343 tss_seg.prev_task_link = old_tss_sel;
2344
2345 ret = ops->write_std(new_tss_base,
2346 &tss_seg.prev_task_link,
2347 sizeof tss_seg.prev_task_link,
2348 ctxt->vcpu, &err);
2349 if (ret == X86EMUL_PROPAGATE_FAULT) {
2350 /* FIXME: need to provide precise fault address */
54b8486f 2351 emulate_pf(ctxt, new_tss_base, err);
38ba30ba
GN		 2352 return ret;
2353 }
2354 }
2355
2356 return load_state_from_tss16(ctxt, ops, &tss_seg);
2357}
2358
2359static void save_state_to_tss32(struct x86_emulate_ctxt *ctxt,
2360 struct x86_emulate_ops *ops,
2361 struct tss_segment_32 *tss)
2362{
2363 struct decode_cache *c = &ctxt->decode;
2364
2365 tss->cr3 = ops->get_cr(3, ctxt->vcpu);
2366 tss->eip = c->eip;
2367 tss->eflags = ctxt->eflags;
2368 tss->eax = c->regs[VCPU_REGS_RAX];
2369 tss->ecx = c->regs[VCPU_REGS_RCX];
2370 tss->edx = c->regs[VCPU_REGS_RDX];
2371 tss->ebx = c->regs[VCPU_REGS_RBX];
2372 tss->esp = c->regs[VCPU_REGS_RSP];
2373 tss->ebp = c->regs[VCPU_REGS_RBP];
2374 tss->esi = c->regs[VCPU_REGS_RSI];
2375 tss->edi = c->regs[VCPU_REGS_RDI];
2376
2377 tss->es = ops->get_segment_selector(VCPU_SREG_ES, ctxt->vcpu);
2378 tss->cs = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
2379 tss->ss = ops->get_segment_selector(VCPU_SREG_SS, ctxt->vcpu);
2380 tss->ds = ops->get_segment_selector(VCPU_SREG_DS, ctxt->vcpu);
2381 tss->fs = ops->get_segment_selector(VCPU_SREG_FS, ctxt->vcpu);
2382 tss->gs = ops->get_segment_selector(VCPU_SREG_GS, ctxt->vcpu);
2383 tss->ldt_selector = ops->get_segment_selector(VCPU_SREG_LDTR, ctxt->vcpu);
2384}
2385
2386static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
2387 struct x86_emulate_ops *ops,
2388 struct tss_segment_32 *tss)
2389{
2390 struct decode_cache *c = &ctxt->decode;
2391 int ret;
2392
0f12244f 2393 if (ops->set_cr(3, tss->cr3, ctxt->vcpu)) {
54b8486f 2394 emulate_gp(ctxt, 0);
0f12244f
GN		 2395 return X86EMUL_PROPAGATE_FAULT;
2396 }
38ba30ba
GN		 2397 c->eip = tss->eip;
2398 ctxt->eflags = tss->eflags | 2;
2399 c->regs[VCPU_REGS_RAX] = tss->eax;
2400 c->regs[VCPU_REGS_RCX] = tss->ecx;
2401 c->regs[VCPU_REGS_RDX] = tss->edx;
2402 c->regs[VCPU_REGS_RBX] = tss->ebx;
2403 c->regs[VCPU_REGS_RSP] = tss->esp;
2404 c->regs[VCPU_REGS_RBP] = tss->ebp;
2405 c->regs[VCPU_REGS_RSI] = tss->esi;
2406 c->regs[VCPU_REGS_RDI] = tss->edi;
2407
2408 /*
2409 * SDM says that segment selectors are loaded before segment
2410 * descriptors
2411 */
2412 ops->set_segment_selector(tss->ldt_selector, VCPU_SREG_LDTR, ctxt->vcpu);
2413 ops->set_segment_selector(tss->es, VCPU_SREG_ES, ctxt->vcpu);
2414 ops->set_segment_selector(tss->cs, VCPU_SREG_CS, ctxt->vcpu);
2415 ops->set_segment_selector(tss->ss, VCPU_SREG_SS, ctxt->vcpu);
2416 ops->set_segment_selector(tss->ds, VCPU_SREG_DS, ctxt->vcpu);
2417 ops->set_segment_selector(tss->fs, VCPU_SREG_FS, ctxt->vcpu);
2418 ops->set_segment_selector(tss->gs, VCPU_SREG_GS, ctxt->vcpu);
2419
2420 /*
2421 * Now load segment descriptors. If fault happenes at this stage
2422 * it is handled in a context of new task
2423 */
2424 ret = load_segment_descriptor(ctxt, ops, tss->ldt_selector, VCPU_SREG_LDTR);
2425 if (ret != X86EMUL_CONTINUE)
2426 return ret;
2427 ret = load_segment_descriptor(ctxt, ops, tss->es, VCPU_SREG_ES);
2428 if (ret != X86EMUL_CONTINUE)
2429 return ret;
2430 ret = load_segment_descriptor(ctxt, ops, tss->cs, VCPU_SREG_CS);
2431 if (ret != X86EMUL_CONTINUE)
2432 return ret;
2433 ret = load_segment_descriptor(ctxt, ops, tss->ss, VCPU_SREG_SS);
2434 if (ret != X86EMUL_CONTINUE)
2435 return ret;
2436 ret = load_segment_descriptor(ctxt, ops, tss->ds, VCPU_SREG_DS);
2437 if (ret != X86EMUL_CONTINUE)
2438 return ret;
2439 ret = load_segment_descriptor(ctxt, ops, tss->fs, VCPU_SREG_FS);
2440 if (ret != X86EMUL_CONTINUE)
2441 return ret;
2442 ret = load_segment_descriptor(ctxt, ops, tss->gs, VCPU_SREG_GS);
2443 if (ret != X86EMUL_CONTINUE)
2444 return ret;
2445
2446 return X86EMUL_CONTINUE;
2447}
2448
2449static int task_switch_32(struct x86_emulate_ctxt *ctxt,
2450 struct x86_emulate_ops *ops,
2451 u16 tss_selector, u16 old_tss_sel,
2452 ulong old_tss_base, struct desc_struct *new_desc)
2453{
2454 struct tss_segment_32 tss_seg;
2455 int ret;
2456 u32 err, new_tss_base = get_desc_base(new_desc);
2457
2458 ret = ops->read_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2459 &err);
2460 if (ret == X86EMUL_PROPAGATE_FAULT) {
2461 /* FIXME: need to provide precise fault address */
54b8486f 2462 emulate_pf(ctxt, old_tss_base, err);
38ba30ba
GN		 2463 return ret;
2464 }
2465
2466 save_state_to_tss32(ctxt, ops, &tss_seg);
2467
2468 ret = ops->write_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2469 &err);
2470 if (ret == X86EMUL_PROPAGATE_FAULT) {
2471 /* FIXME: need to provide precise fault address */
54b8486f 2472 emulate_pf(ctxt, old_tss_base, err);
38ba30ba
GN		 2473 return ret;
2474 }
2475
2476 ret = ops->read_std(new_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2477 &err);
2478 if (ret == X86EMUL_PROPAGATE_FAULT) {
2479 /* FIXME: need to provide precise fault address */
54b8486f 2480 emulate_pf(ctxt, new_tss_base, err);
38ba30ba
GN		 2481 return ret;
2482 }
2483
2484 if (old_tss_sel != 0xffff) {
2485 tss_seg.prev_task_link = old_tss_sel;
2486
2487 ret = ops->write_std(new_tss_base,
2488 &tss_seg.prev_task_link,
2489 sizeof tss_seg.prev_task_link,
2490 ctxt->vcpu, &err);
2491 if (ret == X86EMUL_PROPAGATE_FAULT) {
2492 /* FIXME: need to provide precise fault address */
54b8486f 2493 emulate_pf(ctxt, new_tss_base, err);
38ba30ba
GN		 2494 return ret;
2495 }
2496 }
2497
2498 return load_state_from_tss32(ctxt, ops, &tss_seg);
2499}
2500
2501static int emulator_do_task_switch(struct x86_emulate_ctxt *ctxt,
e269fb21
JK		 2502 struct x86_emulate_ops *ops,
2503 u16 tss_selector, int reason,
2504 bool has_error_code, u32 error_code)
38ba30ba
GN		 2505{
2506 struct desc_struct curr_tss_desc, next_tss_desc;
2507 int ret;
2508 u16 old_tss_sel = ops->get_segment_selector(VCPU_SREG_TR, ctxt->vcpu);
2509 ulong old_tss_base =
5951c442 2510 ops->get_cached_segment_base(VCPU_SREG_TR, ctxt->vcpu);
ceffb459 2511 u32 desc_limit;
38ba30ba
GN		 2512
2513 /* FIXME: old_tss_base == ~0 ? */
2514
2515 ret = read_segment_descriptor(ctxt, ops, tss_selector, &next_tss_desc);
2516 if (ret != X86EMUL_CONTINUE)
2517 return ret;
2518 ret = read_segment_descriptor(ctxt, ops, old_tss_sel, &curr_tss_desc);
2519 if (ret != X86EMUL_CONTINUE)
2520 return ret;
2521
2522 /* FIXME: check that next_tss_desc is tss */
2523
2524 if (reason != TASK_SWITCH_IRET) {
2525 if ((tss_selector & 3) > next_tss_desc.dpl ||
2526 ops->cpl(ctxt->vcpu) > next_tss_desc.dpl) {
54b8486f 2527 emulate_gp(ctxt, 0);
38ba30ba
GN		 2528 return X86EMUL_PROPAGATE_FAULT;
2529 }
2530 }
2531
ceffb459
GN		 2532 desc_limit = desc_limit_scaled(&next_tss_desc);
2533 if (!next_tss_desc.p ||
2534 ((desc_limit < 0x67 && (next_tss_desc.type & 8)) ||
2535 desc_limit < 0x2b)) {
54b8486f 2536 emulate_ts(ctxt, tss_selector & 0xfffc);
38ba30ba
GN		 2537 return X86EMUL_PROPAGATE_FAULT;
2538 }
2539
2540 if (reason == TASK_SWITCH_IRET || reason == TASK_SWITCH_JMP) {
2541 curr_tss_desc.type &= ~(1 << 1); /* clear busy flag */
2542 write_segment_descriptor(ctxt, ops, old_tss_sel,
2543 &curr_tss_desc);
2544 }
2545
2546 if (reason == TASK_SWITCH_IRET)
2547 ctxt->eflags = ctxt->eflags & ~X86_EFLAGS_NT;
2548
2549 /* set back link to prev task only if NT bit is set in eflags
2550 note that old_tss_sel is not used afetr this point */
2551 if (reason != TASK_SWITCH_CALL && reason != TASK_SWITCH_GATE)
2552 old_tss_sel = 0xffff;
2553
2554 if (next_tss_desc.type & 8)
2555 ret = task_switch_32(ctxt, ops, tss_selector, old_tss_sel,
2556 old_tss_base, &next_tss_desc);
2557 else
2558 ret = task_switch_16(ctxt, ops, tss_selector, old_tss_sel,
2559 old_tss_base, &next_tss_desc);
0760d448
JK		 2560 if (ret != X86EMUL_CONTINUE)
2561 return ret;
38ba30ba
GN		 2562
2563 if (reason == TASK_SWITCH_CALL || reason == TASK_SWITCH_GATE)
2564 ctxt->eflags = ctxt->eflags | X86_EFLAGS_NT;
2565
2566 if (reason != TASK_SWITCH_IRET) {
2567 next_tss_desc.type |= (1 << 1); /* set busy flag */
2568 write_segment_descriptor(ctxt, ops, tss_selector,
2569 &next_tss_desc);
2570 }
2571
2572 ops->set_cr(0, ops->get_cr(0, ctxt->vcpu) | X86_CR0_TS, ctxt->vcpu);
2573 ops->set_cached_descriptor(&next_tss_desc, VCPU_SREG_TR, ctxt->vcpu);
2574 ops->set_segment_selector(tss_selector, VCPU_SREG_TR, ctxt->vcpu);
2575
e269fb21
JK		 2576 if (has_error_code) {
2577 struct decode_cache *c = &ctxt->decode;
2578
2579 c->op_bytes = c->ad_bytes = (next_tss_desc.type & 8) ? 4 : 2;
2580 c->lock_prefix = 0;
2581 c->src.val = (unsigned long) error_code;
79168fd1 2582 emulate_push(ctxt, ops);
e269fb21
JK		 2583 }
2584
38ba30ba
GN		 2585 return ret;
2586}
2587
2588int emulator_task_switch(struct x86_emulate_ctxt *ctxt,
2589 struct x86_emulate_ops *ops,
e269fb21
JK		 2590 u16 tss_selector, int reason,
2591 bool has_error_code, u32 error_code)
38ba30ba
GN		 2592{
2593 struct decode_cache *c = &ctxt->decode;
2594 int rc;
2595
38ba30ba 2596 c->eip = ctxt->eip;
e269fb21 2597 c->dst.type = OP_NONE;
38ba30ba 2598
e269fb21
JK		 2599 rc = emulator_do_task_switch(ctxt, ops, tss_selector, reason,
2600 has_error_code, error_code);
38ba30ba
GN		 2601
2602 if (rc == X86EMUL_CONTINUE) {
e269fb21 2603 rc = writeback(ctxt, ops);
95c55886
GN		 2604 if (rc == X86EMUL_CONTINUE)
2605 ctxt->eip = c->eip;
38ba30ba
GN		 2606 }
2607
19d04437 2608 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
38ba30ba
GN		 2609}
2610
a682e354 2611static void string_addr_inc(struct x86_emulate_ctxt *ctxt, unsigned long base,
d9271123 2612 int reg, struct operand *op)
a682e354
GN		 2613{
2614 struct decode_cache *c = &ctxt->decode;
2615 int df = (ctxt->eflags & EFLG_DF) ? -1 : 1;
2616
d9271123
GN		 2617 register_address_increment(c, &c->regs[reg], df * op->bytes);
2618 op->ptr = (unsigned long *)register_address(c, base, c->regs[reg]);
a682e354
GN		 2619}
2620
8b4caf66 2621int
1be3aa47 2622x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
8b4caf66 2623{
8b4caf66 2624 u64 msr_data;
8b4caf66 2625 struct decode_cache *c = &ctxt->decode;
1b30eaa8 2626 int rc = X86EMUL_CONTINUE;
5cd21917 2627 int saved_dst_type = c->dst.type;
8b4caf66 2628
9de41573 2629 ctxt->decode.mem_read.pos = 0;
310b5d30 2630
1161624f 2631 if (ctxt->mode == X86EMUL_MODE_PROT64 && (c->d & No64)) {
54b8486f 2632 emulate_ud(ctxt);
1161624f
GN		 2633 goto done;
2634 }
2635
d380a5e4 2636 /* LOCK prefix is allowed only with some instructions */
a41ffb75 2637 if (c->lock_prefix && (!(c->d & Lock) || c->dst.type != OP_MEM)) {
54b8486f 2638 emulate_ud(ctxt);
d380a5e4
GN		 2639 goto done;
2640 }
2641
e92805ac 2642 /* Privileged instruction can be executed only in CPL=0 */
9c537244 2643 if ((c->d & Priv) && ops->cpl(ctxt->vcpu)) {
54b8486f 2644 emulate_gp(ctxt, 0);
e92805ac
GN		 2645 goto done;
2646 }
2647
b9fa9d6b 2648 if (c->rep_prefix && (c->d & String)) {
5cd21917 2649 ctxt->restart = true;
b9fa9d6b 2650 /* All REP prefixes have the same first termination condition */
c73e197b 2651 if (address_mask(c, c->regs[VCPU_REGS_RCX]) == 0) {
5cd21917
GN		 2652 string_done:
2653 ctxt->restart = false;
95c55886 2654 ctxt->eip = c->eip;
b9fa9d6b
AK		 2655 goto done;
2656 }
2657 /* The second termination condition only applies for REPE
2658 * and REPNE. Test if the repeat string operation prefix is
2659 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
2660 * corresponding termination condition according to:
2661 * - if REPE/REPZ and ZF = 0 then done
2662 * - if REPNE/REPNZ and ZF = 1 then done
2663 */
2664 if ((c->b == 0xa6) || (c->b == 0xa7) ||
5cd21917 2665 (c->b == 0xae) || (c->b == 0xaf)) {
b9fa9d6b 2666 if ((c->rep_prefix == REPE_PREFIX) &&
5cd21917
GN		 2667 ((ctxt->eflags & EFLG_ZF) == 0))
2668 goto string_done;
b9fa9d6b 2669 if ((c->rep_prefix == REPNE_PREFIX) &&
5cd21917
GN		 2670 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF))
2671 goto string_done;
b9fa9d6b 2672 }
063db061 2673 c->eip = ctxt->eip;
b9fa9d6b
AK		 2674 }
2675
8b4caf66 2676 if (c->src.type == OP_MEM) {
9de41573 2677 rc = read_emulated(ctxt, ops, (unsigned long)c->src.ptr,
414e6277 2678 c->src.valptr, c->src.bytes);
b60d513c 2679 if (rc != X86EMUL_CONTINUE)
8b4caf66 2680 goto done;
16518d5a 2681 c->src.orig_val64 = c->src.val64;
8b4caf66
LV		 2682 }
2683
e35b7b9c 2684 if (c->src2.type == OP_MEM) {
9de41573
GN		 2685 rc = read_emulated(ctxt, ops, (unsigned long)c->src2.ptr,
2686 &c->src2.val, c->src2.bytes);
e35b7b9c
GN		 2687 if (rc != X86EMUL_CONTINUE)
2688 goto done;
2689 }
2690
8b4caf66
LV		 2691 if ((c->d & DstMask) == ImplicitOps)
2692 goto special_insn;
2693
2694
69f55cb1
GN		 2695 if ((c->dst.type == OP_MEM) && !(c->d & Mov)) {
2696 /* optimisation - avoid slow emulated read if Mov */
9de41573
GN		 2697 rc = read_emulated(ctxt, ops, (unsigned long)c->dst.ptr,
2698 &c->dst.val, c->dst.bytes);
69f55cb1
GN		 2699 if (rc != X86EMUL_CONTINUE)
2700 goto done;
038e51de 2701 }
e4e03ded 2702 c->dst.orig_val = c->dst.val;
038e51de 2703
018a98db
AK		 2704special_insn:
2705
e4e03ded 2706 if (c->twobyte)
6aa8b732
AK		 2707 goto twobyte_insn;
2708
e4e03ded 2709 switch (c->b) {
6aa8b732
AK		 2710 case 0x00 ... 0x05:
2711 add: /* add */
05f086f8 2712 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
6aa8b732 2713 break;
0934ac9d 2714 case 0x06: /* push es */
79168fd1 2715 emulate_push_sreg(ctxt, ops, VCPU_SREG_ES);
0934ac9d
MG		 2716 break;
2717 case 0x07: /* pop es */
0934ac9d 2718 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_ES);
1b30eaa8 2719 if (rc != X86EMUL_CONTINUE)
0934ac9d
MG		 2720 goto done;
2721 break;
6aa8b732
AK		 2722 case 0x08 ... 0x0d:
2723 or: /* or */
05f086f8 2724 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
6aa8b732 2725 break;
0934ac9d 2726 case 0x0e: /* push cs */
79168fd1 2727 emulate_push_sreg(ctxt, ops, VCPU_SREG_CS);
0934ac9d 2728 break;
6aa8b732
AK		 2729 case 0x10 ... 0x15:
2730 adc: /* adc */
05f086f8 2731 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
6aa8b732 2732 break;
0934ac9d 2733 case 0x16: /* push ss */
79168fd1 2734 emulate_push_sreg(ctxt, ops, VCPU_SREG_SS);
0934ac9d
MG		 2735 break;
2736 case 0x17: /* pop ss */
0934ac9d 2737 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_SS);
1b30eaa8 2738 if (rc != X86EMUL_CONTINUE)
0934ac9d
MG		 2739 goto done;
2740 break;
6aa8b732
AK		 2741 case 0x18 ... 0x1d:
2742 sbb: /* sbb */
05f086f8 2743 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
6aa8b732 2744 break;
0934ac9d 2745 case 0x1e: /* push ds */
79168fd1 2746 emulate_push_sreg(ctxt, ops, VCPU_SREG_DS);
0934ac9d
MG		 2747 break;
2748 case 0x1f: /* pop ds */
0934ac9d 2749 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_DS);
1b30eaa8 2750 if (rc != X86EMUL_CONTINUE)
0934ac9d
MG		 2751 goto done;
2752 break;
aa3a816b 2753 case 0x20 ... 0x25:
6aa8b732 2754 and: /* and */
05f086f8 2755 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 2756 break;
2757 case 0x28 ... 0x2d:
2758 sub: /* sub */
05f086f8 2759 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 2760 break;
2761 case 0x30 ... 0x35:
2762 xor: /* xor */
05f086f8 2763 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 2764 break;
2765 case 0x38 ... 0x3d:
2766 cmp: /* cmp */
05f086f8 2767 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
6aa8b732 2768 break;
33615aa9
AK		 2769 case 0x40 ... 0x47: /* inc r16/r32 */
2770 emulate_1op("inc", c->dst, ctxt->eflags);
2771 break;
2772 case 0x48 ... 0x4f: /* dec r16/r32 */
2773 emulate_1op("dec", c->dst, ctxt->eflags);
2774 break;
2775 case 0x50 ... 0x57: /* push reg */
79168fd1 2776 emulate_push(ctxt, ops);
33615aa9
AK		 2777 break;
2778 case 0x58 ... 0x5f: /* pop reg */
2779 pop_instruction:
350f69dc 2780 rc = emulate_pop(ctxt, ops, &c->dst.val, c->op_bytes);
1b30eaa8 2781 if (rc != X86EMUL_CONTINUE)
33615aa9 2782 goto done;
33615aa9 2783 break;
abcf14b5 2784 case 0x60: /* pusha */
c37eda13
WY		 2785 rc = emulate_pusha(ctxt, ops);
2786 if (rc != X86EMUL_CONTINUE)
2787 goto done;
abcf14b5
MG		 2788 break;
2789 case 0x61: /* popa */
2790 rc = emulate_popa(ctxt, ops);
1b30eaa8 2791 if (rc != X86EMUL_CONTINUE)
abcf14b5
MG		 2792 goto done;
2793 break;
6aa8b732 2794 case 0x63: /* movsxd */
8b4caf66 2795 if (ctxt->mode != X86EMUL_MODE_PROT64)
6aa8b732 2796 goto cannot_emulate;
e4e03ded 2797 c->dst.val = (s32) c->src.val;
6aa8b732 2798 break;
91ed7a0e 2799 case 0x68: /* push imm */
018a98db 2800 case 0x6a: /* push imm8 */
79168fd1 2801 emulate_push(ctxt, ops);
018a98db
AK		 2802 break;
2803 case 0x6c: /* insb */
2804 case 0x6d: /* insw/insd */
7972995b 2805 c->dst.bytes = min(c->dst.bytes, 4u);
f850e2e6 2806 if (!emulator_io_permited(ctxt, ops, c->regs[VCPU_REGS_RDX],
7972995b 2807 c->dst.bytes)) {
54b8486f 2808 emulate_gp(ctxt, 0);
f850e2e6
GN		 2809 goto done;
2810 }
7b262e90
GN		 2811 if (!pio_in_emulated(ctxt, ops, c->dst.bytes,
2812 c->regs[VCPU_REGS_RDX], &c->dst.val))
7972995b
GN		 2813 goto done; /* IO is needed, skip writeback */
2814 break;
018a98db
AK		 2815 case 0x6e: /* outsb */
2816 case 0x6f: /* outsw/outsd */
7972995b 2817 c->src.bytes = min(c->src.bytes, 4u);
f850e2e6 2818 if (!emulator_io_permited(ctxt, ops, c->regs[VCPU_REGS_RDX],
7972995b 2819 c->src.bytes)) {
54b8486f 2820 emulate_gp(ctxt, 0);
f850e2e6
GN		 2821 goto done;
2822 }
7972995b
GN		 2823 ops->pio_out_emulated(c->src.bytes, c->regs[VCPU_REGS_RDX],
2824 &c->src.val, 1, ctxt->vcpu);
2825
2826 c->dst.type = OP_NONE; /* nothing to writeback */
2827 break;
b2833e3c 2828 case 0x70 ... 0x7f: /* jcc (short) */
018a98db 2829 if (test_cc(c->b, ctxt->eflags))
b2833e3c 2830 jmp_rel(c, c->src.val);
018a98db 2831 break;
6aa8b732 2832 case 0x80 ... 0x83: /* Grp1 */
e4e03ded 2833 switch (c->modrm_reg) {
6aa8b732
AK		 2834 case 0:
2835 goto add;
2836 case 1:
2837 goto or;
2838 case 2:
2839 goto adc;
2840 case 3:
2841 goto sbb;
2842 case 4:
2843 goto and;
2844 case 5:
2845 goto sub;
2846 case 6:
2847 goto xor;
2848 case 7:
2849 goto cmp;
2850 }
2851 break;
2852 case 0x84 ... 0x85:
dfb507c4 2853 test:
05f086f8 2854 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 2855 break;
2856 case 0x86 ... 0x87: /* xchg */
b13354f8 2857 xchg:
6aa8b732 2858 /* Write back the register source. */
e4e03ded 2859 switch (c->dst.bytes) {
6aa8b732 2860 case 1:
e4e03ded 2861 *(u8 *) c->src.ptr = (u8) c->dst.val;
6aa8b732
AK		 2862 break;
2863 case 2:
e4e03ded 2864 *(u16 *) c->src.ptr = (u16) c->dst.val;
6aa8b732
AK		 2865 break;
2866 case 4:
e4e03ded 2867 *c->src.ptr = (u32) c->dst.val;
6aa8b732
AK		 2868 break; /* 64b reg: zero-extend */
2869 case 8:
e4e03ded 2870 *c->src.ptr = c->dst.val;
6aa8b732
AK		 2871 break;
2872 }
2873 /*
2874 * Write back the memory destination with implicit LOCK
2875 * prefix.
2876 */
e4e03ded
LV		 2877 c->dst.val = c->src.val;
2878 c->lock_prefix = 1;
6aa8b732 2879 break;
6aa8b732 2880 case 0x88 ... 0x8b: /* mov */
7de75248 2881 goto mov;
79168fd1
GN		 2882 case 0x8c: /* mov r/m, sreg */
2883 if (c->modrm_reg > VCPU_SREG_GS) {
54b8486f 2884 emulate_ud(ctxt);
5e3ae6c5 2885 goto done;
38d5bc6d 2886 }
79168fd1 2887 c->dst.val = ops->get_segment_selector(c->modrm_reg, ctxt->vcpu);
38d5bc6d 2888 break;
7e0b54b1 2889 case 0x8d: /* lea r16/r32, m */
f9b7aab3 2890 c->dst.val = c->modrm_ea;
7e0b54b1 2891 break;
4257198a
GT		 2892 case 0x8e: { /* mov seg, r/m16 */
2893 uint16_t sel;
4257198a
GT		 2894
2895 sel = c->src.val;
8b9f4414 2896
c697518a
GN		 2897 if (c->modrm_reg == VCPU_SREG_CS ||
2898 c->modrm_reg > VCPU_SREG_GS) {
54b8486f 2899 emulate_ud(ctxt);
8b9f4414
GN		 2900 goto done;
2901 }
2902
310b5d30 2903 if (c->modrm_reg == VCPU_SREG_SS)
95cb2295 2904 ctxt->interruptibility = KVM_X86_SHADOW_INT_MOV_SS;
310b5d30 2905
2e873022 2906 rc = load_segment_descriptor(ctxt, ops, sel, c->modrm_reg);
4257198a
GT		 2907
2908 c->dst.type = OP_NONE; /* Disable writeback. */
2909 break;
2910 }
6aa8b732 2911 case 0x8f: /* pop (sole member of Grp1a) */
8cdbd2c9 2912 rc = emulate_grp1a(ctxt, ops);
1b30eaa8 2913 if (rc != X86EMUL_CONTINUE)
6aa8b732 2914 goto done;
6aa8b732 2915 break;
b13354f8 2916 case 0x90: /* nop / xchg r8,rax */
b8a98945
GN		 2917 if (c->dst.ptr == (unsigned long *)&c->regs[VCPU_REGS_RAX]) {
2918 c->dst.type = OP_NONE; /* nop */
b13354f8
MG		 2919 break;
2920 }
2921 case 0x91 ... 0x97: /* xchg reg,rax */
f0c13ef1
GN		 2922 c->src.type = OP_REG;
2923 c->src.bytes = c->op_bytes;
b13354f8
MG		 2924 c->src.ptr = (unsigned long *) &c->regs[VCPU_REGS_RAX];
2925 c->src.val = *(c->src.ptr);
2926 goto xchg;
fd2a7608 2927 case 0x9c: /* pushf */
05f086f8 2928 c->src.val = (unsigned long) ctxt->eflags;
79168fd1 2929 emulate_push(ctxt, ops);
8cdbd2c9 2930 break;
535eabcf 2931 case 0x9d: /* popf */
2b48cc75 2932 c->dst.type = OP_REG;
05f086f8 2933 c->dst.ptr = (unsigned long *) &ctxt->eflags;
2b48cc75 2934 c->dst.bytes = c->op_bytes;
d4c6a154
GN		 2935 rc = emulate_popf(ctxt, ops, &c->dst.val, c->op_bytes);
2936 if (rc != X86EMUL_CONTINUE)
2937 goto done;
2938 break;
5d55f299 2939 case 0xa0 ... 0xa3: /* mov */
6aa8b732 2940 case 0xa4 ... 0xa5: /* movs */
a682e354 2941 goto mov;
6aa8b732 2942 case 0xa6 ... 0xa7: /* cmps */
d7e5117a 2943 c->dst.type = OP_NONE; /* Disable writeback. */
d7e5117a 2944 DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c->src.ptr, c->dst.ptr);
a682e354 2945 goto cmp;
dfb507c4
MG		 2946 case 0xa8 ... 0xa9: /* test ax, imm */
2947 goto test;
6aa8b732 2948 case 0xaa ... 0xab: /* stos */
e4e03ded 2949 c->dst.val = c->regs[VCPU_REGS_RAX];
6aa8b732
AK		 2950 break;
2951 case 0xac ... 0xad: /* lods */
a682e354 2952 goto mov;
6aa8b732
AK		 2953 case 0xae ... 0xaf: /* scas */
2954 DPRINTF("Urk! I don't handle SCAS.\n");
2955 goto cannot_emulate;
a5e2e82b 2956 case 0xb0 ... 0xbf: /* mov r, imm */
615ac125 2957 goto mov;
018a98db
AK		 2958 case 0xc0 ... 0xc1:
2959 emulate_grp2(ctxt);
2960 break;
111de5d6 2961 case 0xc3: /* ret */
cf5de4f8 2962 c->dst.type = OP_REG;
111de5d6 2963 c->dst.ptr = &c->eip;
cf5de4f8 2964 c->dst.bytes = c->op_bytes;
111de5d6 2965 goto pop_instruction;
018a98db
AK		 2966 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
2967 mov:
2968 c->dst.val = c->src.val;
2969 break;
a77ab5ea
AK		 2970 case 0xcb: /* ret far */
2971 rc = emulate_ret_far(ctxt, ops);
62bd430e
MG		 2972 if (rc != X86EMUL_CONTINUE)
2973 goto done;
2974 break;
2975 case 0xcf: /* iret */
2976 rc = emulate_iret(ctxt, ops);
2977
1b30eaa8 2978 if (rc != X86EMUL_CONTINUE)
a77ab5ea
AK		 2979 goto done;
2980 break;
018a98db
AK		 2981 case 0xd0 ... 0xd1: /* Grp2 */
2982 c->src.val = 1;
2983 emulate_grp2(ctxt);
2984 break;
2985 case 0xd2 ... 0xd3: /* Grp2 */
2986 c->src.val = c->regs[VCPU_REGS_RCX];
2987 emulate_grp2(ctxt);
2988 break;
a6a3034c
MG		 2989 case 0xe4: /* inb */
2990 case 0xe5: /* in */
cf8f70bf 2991 goto do_io_in;
a6a3034c
MG		 2992 case 0xe6: /* outb */
2993 case 0xe7: /* out */
cf8f70bf 2994 goto do_io_out;
1a52e051 2995 case 0xe8: /* call (near) */ {
d53c4777 2996 long int rel = c->src.val;
e4e03ded 2997 c->src.val = (unsigned long) c->eip;
7a957275 2998 jmp_rel(c, rel);
79168fd1 2999 emulate_push(ctxt, ops);
8cdbd2c9 3000 break;
1a52e051
NK		 3001 }
3002 case 0xe9: /* jmp rel */
954cd36f 3003 goto jmp;
414e6277
GN		 3004 case 0xea: { /* jmp far */
3005 unsigned short sel;
ea79849d 3006 jump_far:
414e6277
GN		 3007 memcpy(&sel, c->src.valptr + c->op_bytes, 2);
3008
3009 if (load_segment_descriptor(ctxt, ops, sel, VCPU_SREG_CS))
c697518a 3010 goto done;
954cd36f 3011
414e6277
GN		 3012 c->eip = 0;
3013 memcpy(&c->eip, c->src.valptr, c->op_bytes);
954cd36f 3014 break;
414e6277 3015 }
954cd36f
GT		 3016 case 0xeb:
3017 jmp: /* jmp rel short */
7a957275 3018 jmp_rel(c, c->src.val);
a01af5ec 3019 c->dst.type = OP_NONE; /* Disable writeback. */
1a52e051 3020 break;
a6a3034c
MG		 3021 case 0xec: /* in al,dx */
3022 case 0xed: /* in (e/r)ax,dx */
cf8f70bf
GN		 3023 c->src.val = c->regs[VCPU_REGS_RDX];
3024 do_io_in:
3025 c->dst.bytes = min(c->dst.bytes, 4u);
3026 if (!emulator_io_permited(ctxt, ops, c->src.val, c->dst.bytes)) {
54b8486f 3027 emulate_gp(ctxt, 0);
cf8f70bf
GN		 3028 goto done;
3029 }
7b262e90
GN		 3030 if (!pio_in_emulated(ctxt, ops, c->dst.bytes, c->src.val,
3031 &c->dst.val))
cf8f70bf
GN		 3032 goto done; /* IO is needed */
3033 break;
ce7a0ad3
WY		 3034 case 0xee: /* out dx,al */
3035 case 0xef: /* out dx,(e/r)ax */
cf8f70bf
GN		 3036 c->src.val = c->regs[VCPU_REGS_RDX];
3037 do_io_out:
3038 c->dst.bytes = min(c->dst.bytes, 4u);
3039 if (!emulator_io_permited(ctxt, ops, c->src.val, c->dst.bytes)) {
54b8486f 3040 emulate_gp(ctxt, 0);
f850e2e6
GN		 3041 goto done;
3042 }
cf8f70bf
GN		 3043 ops->pio_out_emulated(c->dst.bytes, c->src.val, &c->dst.val, 1,
3044 ctxt->vcpu);
3045 c->dst.type = OP_NONE; /* Disable writeback. */
e93f36bc 3046 break;
111de5d6 3047 case 0xf4: /* hlt */
ad312c7c 3048 ctxt->vcpu->arch.halt_request = 1;
19fdfa0d 3049 break;
111de5d6
AK		 3050 case 0xf5: /* cmc */
3051 /* complement carry flag from eflags reg */
3052 ctxt->eflags ^= EFLG_CF;
3053 c->dst.type = OP_NONE; /* Disable writeback. */
3054 break;
018a98db 3055 case 0xf6 ... 0xf7: /* Grp3 */
aca06a83
GN		 3056 if (!emulate_grp3(ctxt, ops))
3057 goto cannot_emulate;
018a98db 3058 break;
111de5d6
AK		 3059 case 0xf8: /* clc */
3060 ctxt->eflags &= ~EFLG_CF;
3061 c->dst.type = OP_NONE; /* Disable writeback. */
3062 break;
3063 case 0xfa: /* cli */
07cbc6c1 3064 if (emulator_bad_iopl(ctxt, ops)) {
54b8486f 3065 emulate_gp(ctxt, 0);
07cbc6c1
WY		 3066 goto done;
3067 } else {
f850e2e6
GN		 3068 ctxt->eflags &= ~X86_EFLAGS_IF;
3069 c->dst.type = OP_NONE; /* Disable writeback. */
3070 }
111de5d6
AK		 3071 break;
3072 case 0xfb: /* sti */
07cbc6c1 3073 if (emulator_bad_iopl(ctxt, ops)) {
54b8486f 3074 emulate_gp(ctxt, 0);
07cbc6c1
WY		 3075 goto done;
3076 } else {
95cb2295 3077 ctxt->interruptibility = KVM_X86_SHADOW_INT_STI;
f850e2e6
GN		 3078 ctxt->eflags |= X86_EFLAGS_IF;
3079 c->dst.type = OP_NONE; /* Disable writeback. */
3080 }
111de5d6 3081 break;
fb4616f4
MG		 3082 case 0xfc: /* cld */
3083 ctxt->eflags &= ~EFLG_DF;
3084 c->dst.type = OP_NONE; /* Disable writeback. */
3085 break;
3086 case 0xfd: /* std */
3087 ctxt->eflags |= EFLG_DF;
3088 c->dst.type = OP_NONE; /* Disable writeback. */
3089 break;
ea79849d
GN		 3090 case 0xfe: /* Grp4 */
3091 grp45:
018a98db 3092 rc = emulate_grp45(ctxt, ops);
1b30eaa8 3093 if (rc != X86EMUL_CONTINUE)
018a98db
AK		 3094 goto done;
3095 break;
ea79849d
GN		 3096 case 0xff: /* Grp5 */
3097 if (c->modrm_reg == 5)
3098 goto jump_far;
3099 goto grp45;
91269b8f
AK		 3100 default:
3101 goto cannot_emulate;
6aa8b732 3102 }
018a98db
AK		 3103
3104writeback:
3105 rc = writeback(ctxt, ops);
1b30eaa8 3106 if (rc != X86EMUL_CONTINUE)
018a98db
AK		 3107 goto done;
3108
5cd21917
GN		 3109 /*
3110 * restore dst type in case the decoding will be reused
3111 * (happens for string instruction )
3112 */
3113 c->dst.type = saved_dst_type;
3114
a682e354 3115 if ((c->d & SrcMask) == SrcSI)
79168fd1
GN		 3116 string_addr_inc(ctxt, seg_override_base(ctxt, ops, c),
3117 VCPU_REGS_RSI, &c->src);
a682e354
GN		 3118
3119 if ((c->d & DstMask) == DstDI)
79168fd1
GN		 3120 string_addr_inc(ctxt, es_base(ctxt, ops), VCPU_REGS_RDI,
3121 &c->dst);
d9271123 3122
5cd21917 3123 if (c->rep_prefix && (c->d & String)) {
7b262e90 3124 struct read_cache *rc = &ctxt->decode.io_read;
d9271123 3125 register_address_increment(c, &c->regs[VCPU_REGS_RCX], -1);
7b262e90
GN		 3126 /*
3127 * Re-enter guest when pio read ahead buffer is empty or,
3128 * if it is not used, after each 1024 iteration.
3129 */
3130 if ((rc->end == 0 && !(c->regs[VCPU_REGS_RCX] & 0x3ff)) ||
3131 (rc->end != 0 && rc->end == rc->pos))
5cd21917
GN		 3132 ctxt->restart = false;
3133 }
9de41573
GN		 3134 /*
3135 * reset read cache here in case string instruction is restared
3136 * without decoding
3137 */
3138 ctxt->decode.mem_read.end = 0;
95c55886 3139 ctxt->eip = c->eip;
018a98db
AK		 3140
3141done:
cb404fe0 3142 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
6aa8b732
AK		 3143
3144twobyte_insn:
e4e03ded 3145 switch (c->b) {
6aa8b732 3146 case 0x01: /* lgdt, lidt, lmsw */
e4e03ded 3147 switch (c->modrm_reg) {
6aa8b732
AK		 3148 u16 size;
3149 unsigned long address;
3150
aca7f966 3151 case 0: /* vmcall */
e4e03ded 3152 if (c->modrm_mod != 3 || c->modrm_rm != 1)
aca7f966
AL		 3153 goto cannot_emulate;
3154
7aa81cc0 3155 rc = kvm_fix_hypercall(ctxt->vcpu);
1b30eaa8 3156 if (rc != X86EMUL_CONTINUE)
7aa81cc0
AL		 3157 goto done;
3158
33e3885d 3159 /* Let the processor re-execute the fixed hypercall */
063db061 3160 c->eip = ctxt->eip;
16286d08
AK		 3161 /* Disable writeback. */
3162 c->dst.type = OP_NONE;
aca7f966 3163 break;
6aa8b732 3164 case 2: /* lgdt */
e4e03ded
LV		 3165 rc = read_descriptor(ctxt, ops, c->src.ptr,
3166 &size, &address, c->op_bytes);
1b30eaa8 3167 if (rc != X86EMUL_CONTINUE)
6aa8b732
AK		 3168 goto done;
3169 realmode_lgdt(ctxt->vcpu, size, address);
16286d08
AK		 3170 /* Disable writeback. */
3171 c->dst.type = OP_NONE;
6aa8b732 3172 break;
aca7f966 3173 case 3: /* lidt/vmmcall */
2b3d2a20
AK		 3174 if (c->modrm_mod == 3) {
3175 switch (c->modrm_rm) {
3176 case 1:
3177 rc = kvm_fix_hypercall(ctxt->vcpu);
1b30eaa8 3178 if (rc != X86EMUL_CONTINUE)
2b3d2a20
AK		 3179 goto done;
3180 break;
3181 default:
3182 goto cannot_emulate;
3183 }
aca7f966 3184 } else {
e4e03ded 3185 rc = read_descriptor(ctxt, ops, c->src.ptr,
aca7f966 3186 &size, &address,
e4e03ded 3187 c->op_bytes);
1b30eaa8 3188 if (rc != X86EMUL_CONTINUE)
aca7f966
AL		 3189 goto done;
3190 realmode_lidt(ctxt->vcpu, size, address);
3191 }
16286d08
AK		 3192 /* Disable writeback. */
3193 c->dst.type = OP_NONE;
6aa8b732
AK		 3194 break;
3195 case 4: /* smsw */
16286d08 3196 c->dst.bytes = 2;
52a46617 3197 c->dst.val = ops->get_cr(0, ctxt->vcpu);
6aa8b732
AK		 3198 break;
3199 case 6: /* lmsw */
93a152be
GN		 3200 ops->set_cr(0, (ops->get_cr(0, ctxt->vcpu) & ~0x0ful) |
3201 (c->src.val & 0x0f), ctxt->vcpu);
dc7457ea 3202 c->dst.type = OP_NONE;
6aa8b732 3203 break;
6e1e5ffe 3204 case 5: /* not defined */
54b8486f 3205 emulate_ud(ctxt);
6e1e5ffe 3206 goto done;
6aa8b732 3207 case 7: /* invlpg*/
69f55cb1 3208 emulate_invlpg(ctxt->vcpu, c->modrm_ea);
16286d08
AK		 3209 /* Disable writeback. */
3210 c->dst.type = OP_NONE;
6aa8b732
AK		 3211 break;
3212 default:
3213 goto cannot_emulate;
3214 }
3215 break;
e99f0507 3216 case 0x05: /* syscall */
3fb1b5db 3217 rc = emulate_syscall(ctxt, ops);
e54cfa97
TY		 3218 if (rc != X86EMUL_CONTINUE)
3219 goto done;
e66bb2cc
AP		 3220 else
3221 goto writeback;
e99f0507 3222 break;
018a98db
AK		 3223 case 0x06:
3224 emulate_clts(ctxt->vcpu);
3225 c->dst.type = OP_NONE;
3226 break;
018a98db 3227 case 0x09: /* wbinvd */
f5f48ee1
SY		 3228 kvm_emulate_wbinvd(ctxt->vcpu);
3229 c->dst.type = OP_NONE;
3230 break;
3231 case 0x08: /* invd */
018a98db
AK		 3232 case 0x0d: /* GrpP (prefetch) */
3233 case 0x18: /* Grp16 (prefetch/nop) */
3234 c->dst.type = OP_NONE;
3235 break;
3236 case 0x20: /* mov cr, reg */
6aebfa6e
GN		 3237 switch (c->modrm_reg) {
3238 case 1:
3239 case 5 ... 7:
3240 case 9 ... 15:
54b8486f 3241 emulate_ud(ctxt);
6aebfa6e
GN		 3242 goto done;
3243 }
52a46617 3244 c->regs[c->modrm_rm] = ops->get_cr(c->modrm_reg, ctxt->vcpu);
018a98db
AK		 3245 c->dst.type = OP_NONE; /* no writeback */
3246 break;
6aa8b732 3247 case 0x21: /* mov from dr to reg */
1e470be5
GN		 3248 if ((ops->get_cr(4, ctxt->vcpu) & X86_CR4_DE) &&
3249 (c->modrm_reg == 4 || c->modrm_reg == 5)) {
54b8486f 3250 emulate_ud(ctxt);
1e470be5
GN		 3251 goto done;
3252 }
35aa5375 3253 ops->get_dr(c->modrm_reg, &c->regs[c->modrm_rm], ctxt->vcpu);
a01af5ec 3254 c->dst.type = OP_NONE; /* no writeback */
6aa8b732 3255 break;
018a98db 3256 case 0x22: /* mov reg, cr */
0f12244f 3257 if (ops->set_cr(c->modrm_reg, c->modrm_val, ctxt->vcpu)) {
54b8486f 3258 emulate_gp(ctxt, 0);
0f12244f
GN		 3259 goto done;
3260 }
018a98db
AK		 3261 c->dst.type = OP_NONE;
3262 break;
6aa8b732 3263 case 0x23: /* mov from reg to dr */
1e470be5
GN		 3264 if ((ops->get_cr(4, ctxt->vcpu) & X86_CR4_DE) &&
3265 (c->modrm_reg == 4 || c->modrm_reg == 5)) {
54b8486f 3266 emulate_ud(ctxt);
1e470be5
GN		 3267 goto done;
3268 }
35aa5375 3269
338dbc97
GN		 3270 if (ops->set_dr(c->modrm_reg, c->regs[c->modrm_rm] &
3271 ((ctxt->mode == X86EMUL_MODE_PROT64) ?
3272 ~0ULL : ~0U), ctxt->vcpu) < 0) {
3273 /* #UD condition is already handled by the code above */
54b8486f 3274 emulate_gp(ctxt, 0);
338dbc97
GN		 3275 goto done;
3276 }
3277
a01af5ec 3278 c->dst.type = OP_NONE; /* no writeback */
6aa8b732 3279 break;
018a98db
AK		 3280 case 0x30:
3281 /* wrmsr */
3282 msr_data = (u32)c->regs[VCPU_REGS_RAX]
3283 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
3fb1b5db 3284 if (ops->set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data)) {
54b8486f 3285 emulate_gp(ctxt, 0);
fd525365 3286 goto done;
018a98db
AK		 3287 }
3288 rc = X86EMUL_CONTINUE;
3289 c->dst.type = OP_NONE;
3290 break;
3291 case 0x32:
3292 /* rdmsr */
3fb1b5db 3293 if (ops->get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data)) {
54b8486f 3294 emulate_gp(ctxt, 0);
fd525365 3295 goto done;
018a98db
AK		 3296 } else {
3297 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
3298 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
3299 }
3300 rc = X86EMUL_CONTINUE;
3301 c->dst.type = OP_NONE;
3302 break;
e99f0507 3303 case 0x34: /* sysenter */
3fb1b5db 3304 rc = emulate_sysenter(ctxt, ops);
e54cfa97
TY		 3305 if (rc != X86EMUL_CONTINUE)
3306 goto done;
8c604352
AP		 3307 else
3308 goto writeback;
e99f0507
AP		 3309 break;
3310 case 0x35: /* sysexit */
3fb1b5db 3311 rc = emulate_sysexit(ctxt, ops);
e54cfa97
TY		 3312 if (rc != X86EMUL_CONTINUE)
3313 goto done;
4668f050
AP		 3314 else
3315 goto writeback;
e99f0507 3316 break;
6aa8b732 3317 case 0x40 ... 0x4f: /* cmov */
e4e03ded 3318 c->dst.val = c->dst.orig_val = c->src.val;
a01af5ec
LV		 3319 if (!test_cc(c->b, ctxt->eflags))
3320 c->dst.type = OP_NONE; /* no writeback */
6aa8b732 3321 break;
b2833e3c 3322 case 0x80 ... 0x8f: /* jnz rel, etc*/
018a98db 3323 if (test_cc(c->b, ctxt->eflags))
b2833e3c 3324 jmp_rel(c, c->src.val);
018a98db
AK		 3325 c->dst.type = OP_NONE;
3326 break;
0934ac9d 3327 case 0xa0: /* push fs */
79168fd1 3328 emulate_push_sreg(ctxt, ops, VCPU_SREG_FS);
0934ac9d
MG		 3329 break;
3330 case 0xa1: /* pop fs */
3331 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_FS);
1b30eaa8 3332 if (rc != X86EMUL_CONTINUE)
0934ac9d
MG		 3333 goto done;
3334 break;
7de75248
NK		 3335 case 0xa3:
3336 bt: /* bt */
e4f8e039 3337 c->dst.type = OP_NONE;
e4e03ded
LV		 3338 /* only subword offset */
3339 c->src.val &= (c->dst.bytes << 3) - 1;
05f086f8 3340 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
7de75248 3341 break;
9bf8ea42
GT		 3342 case 0xa4: /* shld imm8, r, r/m */
3343 case 0xa5: /* shld cl, r, r/m */
3344 emulate_2op_cl("shld", c->src2, c->src, c->dst, ctxt->eflags);
3345 break;
0934ac9d 3346 case 0xa8: /* push gs */
79168fd1 3347 emulate_push_sreg(ctxt, ops, VCPU_SREG_GS);
0934ac9d
MG		 3348 break;
3349 case 0xa9: /* pop gs */
3350 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_GS);
1b30eaa8 3351 if (rc != X86EMUL_CONTINUE)
0934ac9d
MG		 3352 goto done;
3353 break;
7de75248
NK		 3354 case 0xab:
3355 bts: /* bts */
e4e03ded
LV		 3356 /* only subword offset */
3357 c->src.val &= (c->dst.bytes << 3) - 1;
05f086f8 3358 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
7de75248 3359 break;
9bf8ea42
GT		 3360 case 0xac: /* shrd imm8, r, r/m */
3361 case 0xad: /* shrd cl, r, r/m */
3362 emulate_2op_cl("shrd", c->src2, c->src, c->dst, ctxt->eflags);
3363 break;
2a7c5b8b
GC		 3364 case 0xae: /* clflush */
3365 break;
6aa8b732
AK		 3366 case 0xb0 ... 0xb1: /* cmpxchg */
3367 /*
3368 * Save real source value, then compare EAX against
3369 * destination.
3370 */
e4e03ded
LV		 3371 c->src.orig_val = c->src.val;
3372 c->src.val = c->regs[VCPU_REGS_RAX];
05f086f8
LV		 3373 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
3374 if (ctxt->eflags & EFLG_ZF) {
6aa8b732 3375 /* Success: write back to memory. */
e4e03ded 3376 c->dst.val = c->src.orig_val;
6aa8b732
AK		 3377 } else {
3378 /* Failure: write the value we saw to EAX. */
e4e03ded
LV		 3379 c->dst.type = OP_REG;
3380 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
6aa8b732
AK		 3381 }
3382 break;
6aa8b732
AK		 3383 case 0xb3:
3384 btr: /* btr */
e4e03ded
LV		 3385 /* only subword offset */
3386 c->src.val &= (c->dst.bytes << 3) - 1;
05f086f8 3387 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
6aa8b732 3388 break;
6aa8b732 3389 case 0xb6 ... 0xb7: /* movzx */
e4e03ded
LV		 3390 c->dst.bytes = c->op_bytes;
3391 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
3392 : (u16) c->src.val;
6aa8b732 3393 break;
6aa8b732 3394 case 0xba: /* Grp8 */
e4e03ded 3395 switch (c->modrm_reg & 3) {
6aa8b732
AK		 3396 case 0:
3397 goto bt;
3398 case 1:
3399 goto bts;
3400 case 2:
3401 goto btr;
3402 case 3:
3403 goto btc;
3404 }
3405 break;
7de75248
NK		 3406 case 0xbb:
3407 btc: /* btc */
e4e03ded
LV		 3408 /* only subword offset */
3409 c->src.val &= (c->dst.bytes << 3) - 1;
05f086f8 3410 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
7de75248 3411 break;
6aa8b732 3412 case 0xbe ... 0xbf: /* movsx */
e4e03ded
LV		 3413 c->dst.bytes = c->op_bytes;
3414 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
3415 (s16) c->src.val;
6aa8b732 3416 break;
a012e65a 3417 case 0xc3: /* movnti */
e4e03ded
LV		 3418 c->dst.bytes = c->op_bytes;
3419 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
3420 (u64) c->src.val;
a012e65a 3421 break;
6aa8b732 3422 case 0xc7: /* Grp9 (cmpxchg8b) */
69f55cb1 3423 rc = emulate_grp9(ctxt, ops);
1b30eaa8 3424 if (rc != X86EMUL_CONTINUE)
8cdbd2c9
LV		 3425 goto done;
3426 break;
91269b8f
AK		 3427 default:
3428 goto cannot_emulate;
6aa8b732
AK		 3429 }
3430 goto writeback;
3431
3432cannot_emulate:
e4e03ded 3433 DPRINTF("Cannot emulate %02x\n", c->b);
6aa8b732
AK		 3434 return -1;
3435}
Linux kernel - Deliverables
This page took 0.759369 seconds and 5 git commands to generate.