projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
KVM: x86 emulator: Add check_perm callback
[deliverable/linux.git] / arch / x86 / kvm / emulate.c
1 /******************************************************************************
2 * emulate.c
3 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
9 * privileged instructions:
10 *
11 * Copyright (C) 2006 Qumranet
12 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
13 *
14 * Avi Kivity <avi@qumranet.com>
15 * Yaniv Kamay <yaniv@qumranet.com>
16 *
17 * This work is licensed under the terms of the GNU GPL, version 2. See
18 * the COPYING file in the top-level directory.
19 *
20 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
21 */
22
23 #include <linux/kvm_host.h>
24 #include "kvm_cache_regs.h"
25 #include <linux/module.h>
26 #include <asm/kvm_emulate.h>
27
28 #include "x86.h"
29 #include "tss.h"
30
31 /*
32 * Opcode effective-address decode tables.
33 * Note that we only emulate instructions that have at least one memory
34 * operand (excluding implicit stack references). We assume that stack
35 * references and instruction fetches will never occur in special memory
36 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
37 * not be handled.
38 */
39
40 /* Operand sizes: 8-bit operands or specified/overridden size. */
41 #define ByteOp (1<<0) /* 8-bit operands. */
42 /* Destination operand type. */
43 #define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
44 #define DstReg (2<<1) /* Register operand. */
45 #define DstMem (3<<1) /* Memory operand. */
46 #define DstAcc (4<<1) /* Destination Accumulator */
47 #define DstDI (5<<1) /* Destination is in ES:(E)DI */
48 #define DstMem64 (6<<1) /* 64bit memory operand */
49 #define DstImmUByte (7<<1) /* 8-bit unsigned immediate operand */
50 #define DstMask (7<<1)
51 /* Source operand type. */
52 #define SrcNone (0<<4) /* No source operand. */
53 #define SrcReg (1<<4) /* Register operand. */
54 #define SrcMem (2<<4) /* Memory operand. */
55 #define SrcMem16 (3<<4) /* Memory operand (16-bit). */
56 #define SrcMem32 (4<<4) /* Memory operand (32-bit). */
57 #define SrcImm (5<<4) /* Immediate operand. */
58 #define SrcImmByte (6<<4) /* 8-bit sign-extended immediate operand. */
59 #define SrcOne (7<<4) /* Implied '1' */
60 #define SrcImmUByte (8<<4) /* 8-bit unsigned immediate operand. */
61 #define SrcImmU (9<<4) /* Immediate operand, unsigned */
62 #define SrcSI (0xa<<4) /* Source is in the DS:RSI */
63 #define SrcImmFAddr (0xb<<4) /* Source is immediate far address */
64 #define SrcMemFAddr (0xc<<4) /* Source is far address in memory */
65 #define SrcAcc (0xd<<4) /* Source Accumulator */
66 #define SrcImmU16 (0xe<<4) /* Immediate operand, unsigned, 16 bits */
67 #define SrcMask (0xf<<4)
68 /* Generic ModRM decode. */
69 #define ModRM (1<<8)
70 /* Destination is only written; never read. */
71 #define Mov (1<<9)
72 #define BitOp (1<<10)
73 #define MemAbs (1<<11) /* Memory operand is absolute displacement */
74 #define String (1<<12) /* String instruction (rep capable) */
75 #define Stack (1<<13) /* Stack instruction (push/pop) */
76 #define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
77 #define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
78 #define Prefix (1<<16) /* Instruction varies with 66/f2/f3 prefix */
79 #define Sse (1<<17) /* SSE Vector instruction */
80 /* Misc flags */
81 #define VendorSpecific (1<<22) /* Vendor specific instruction */
82 #define NoAccess (1<<23) /* Don't access memory (lea/invlpg/verr etc) */
83 #define Op3264 (1<<24) /* Operand is 64b in long mode, 32b otherwise */
84 #define Undefined (1<<25) /* No Such Instruction */
85 #define Lock (1<<26) /* lock prefix is allowed for the instruction */
86 #define Priv (1<<27) /* instruction generates #GP if current CPL != 0 */
87 #define No64 (1<<28)
88 /* Source 2 operand type */
89 #define Src2None (0<<29)
90 #define Src2CL (1<<29)
91 #define Src2ImmByte (2<<29)
92 #define Src2One (3<<29)
93 #define Src2Imm (4<<29)
94 #define Src2Mask (7<<29)
95
96 #define X2(x...) x, x
97 #define X3(x...) X2(x), x
98 #define X4(x...) X2(x), X2(x)
99 #define X5(x...) X4(x), x
100 #define X6(x...) X4(x), X2(x)
101 #define X7(x...) X4(x), X3(x)
102 #define X8(x...) X4(x), X4(x)
103 #define X16(x...) X8(x), X8(x)
104
105 struct opcode {
106 u32 flags;
107 u8 intercept;
108 union {
109 int (*execute)(struct x86_emulate_ctxt *ctxt);
110 struct opcode *group;
111 struct group_dual *gdual;
112 struct gprefix *gprefix;
113 } u;
114 int (*check_perm)(struct x86_emulate_ctxt *ctxt);
115 };
116
117 struct group_dual {
118 struct opcode mod012[8];
119 struct opcode mod3[8];
120 };
121
122 struct gprefix {
123 struct opcode pfx_no;
124 struct opcode pfx_66;
125 struct opcode pfx_f2;
126 struct opcode pfx_f3;
127 };
128
129 /* EFLAGS bit definitions. */
130 #define EFLG_ID (1<<21)
131 #define EFLG_VIP (1<<20)
132 #define EFLG_VIF (1<<19)
133 #define EFLG_AC (1<<18)
134 #define EFLG_VM (1<<17)
135 #define EFLG_RF (1<<16)
136 #define EFLG_IOPL (3<<12)
137 #define EFLG_NT (1<<14)
138 #define EFLG_OF (1<<11)
139 #define EFLG_DF (1<<10)
140 #define EFLG_IF (1<<9)
141 #define EFLG_TF (1<<8)
142 #define EFLG_SF (1<<7)
143 #define EFLG_ZF (1<<6)
144 #define EFLG_AF (1<<4)
145 #define EFLG_PF (1<<2)
146 #define EFLG_CF (1<<0)
147
148 #define EFLG_RESERVED_ZEROS_MASK 0xffc0802a
149 #define EFLG_RESERVED_ONE_MASK 2
150
151 /*
152 * Instruction emulation:
153 * Most instructions are emulated directly via a fragment of inline assembly
154 * code. This allows us to save/restore EFLAGS and thus very easily pick up
155 * any modified flags.
156 */
157
158 #if defined(CONFIG_X86_64)
159 #define _LO32 "k" /* force 32-bit operand */
160 #define _STK "%%rsp" /* stack pointer */
161 #elif defined(__i386__)
162 #define _LO32 "" /* force 32-bit operand */
163 #define _STK "%%esp" /* stack pointer */
164 #endif
165
166 /*
167 * These EFLAGS bits are restored from saved value during emulation, and
168 * any changes are written back to the saved value after emulation.
169 */
170 #define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
171
172 /* Before executing instruction: restore necessary bits in EFLAGS. */
173 #define _PRE_EFLAGS(_sav, _msk, _tmp) \
174 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
175 "movl %"_sav",%"_LO32 _tmp"; " \
176 "push %"_tmp"; " \
177 "push %"_tmp"; " \
178 "movl %"_msk",%"_LO32 _tmp"; " \
179 "andl %"_LO32 _tmp",("_STK"); " \
180 "pushf; " \
181 "notl %"_LO32 _tmp"; " \
182 "andl %"_LO32 _tmp",("_STK"); " \
183 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
184 "pop %"_tmp"; " \
185 "orl %"_LO32 _tmp",("_STK"); " \
186 "popf; " \
187 "pop %"_sav"; "
188
189 /* After executing instruction: write-back necessary bits in EFLAGS. */
190 #define _POST_EFLAGS(_sav, _msk, _tmp) \
191 /* _sav |= EFLAGS & _msk; */ \
192 "pushf; " \
193 "pop %"_tmp"; " \
194 "andl %"_msk",%"_LO32 _tmp"; " \
195 "orl %"_LO32 _tmp",%"_sav"; "
196
197 #ifdef CONFIG_X86_64
198 #define ON64(x) x
199 #else
200 #define ON64(x)
201 #endif
202
203 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \
204 do { \
205 __asm__ __volatile__ ( \
206 _PRE_EFLAGS("0", "4", "2") \
207 _op _suffix " %"_x"3,%1; " \
208 _POST_EFLAGS("0", "4", "2") \
209 : "=m" (_eflags), "+q" (*(_dsttype*)&(_dst).val),\
210 "=&r" (_tmp) \
211 : _y ((_src).val), "i" (EFLAGS_MASK)); \
212 } while (0)
213
214
215 /* Raw emulation: instruction has two explicit operands. */
216 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
217 do { \
218 unsigned long _tmp; \
219 \
220 switch ((_dst).bytes) { \
221 case 2: \
222 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\
223 break; \
224 case 4: \
225 ____emulate_2op(_op,_src,_dst,_eflags,_lx,_ly,"l",u32);\
226 break; \
227 case 8: \
228 ON64(____emulate_2op(_op,_src,_dst,_eflags,_qx,_qy,"q",u64)); \
229 break; \
230 } \
231 } while (0)
232
233 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
234 do { \
235 unsigned long _tmp; \
236 switch ((_dst).bytes) { \
237 case 1: \
238 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
239 break; \
240 default: \
241 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
242 _wx, _wy, _lx, _ly, _qx, _qy); \
243 break; \
244 } \
245 } while (0)
246
247 /* Source operand is byte-sized and may be restricted to just %cl. */
248 #define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
249 __emulate_2op(_op, _src, _dst, _eflags, \
250 "b", "c", "b", "c", "b", "c", "b", "c")
251
252 /* Source operand is byte, word, long or quad sized. */
253 #define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
254 __emulate_2op(_op, _src, _dst, _eflags, \
255 "b", "q", "w", "r", _LO32, "r", "", "r")
256
257 /* Source operand is word, long or quad sized. */
258 #define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
259 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
260 "w", "r", _LO32, "r", "", "r")
261
262 /* Instruction has three operands and one operand is stored in ECX register */
263 #define __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, _suffix, _type) \
264 do { \
265 unsigned long _tmp; \
266 _type _clv = (_cl).val; \
267 _type _srcv = (_src).val; \
268 _type _dstv = (_dst).val; \
269 \
270 __asm__ __volatile__ ( \
271 _PRE_EFLAGS("0", "5", "2") \
272 _op _suffix " %4,%1 \n" \
273 _POST_EFLAGS("0", "5", "2") \
274 : "=m" (_eflags), "+r" (_dstv), "=&r" (_tmp) \
275 : "c" (_clv) , "r" (_srcv), "i" (EFLAGS_MASK) \
276 ); \
277 \
278 (_cl).val = (unsigned long) _clv; \
279 (_src).val = (unsigned long) _srcv; \
280 (_dst).val = (unsigned long) _dstv; \
281 } while (0)
282
283 #define emulate_2op_cl(_op, _cl, _src, _dst, _eflags) \
284 do { \
285 switch ((_dst).bytes) { \
286 case 2: \
287 __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
288 "w", unsigned short); \
289 break; \
290 case 4: \
291 __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
292 "l", unsigned int); \
293 break; \
294 case 8: \
295 ON64(__emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
296 "q", unsigned long)); \
297 break; \
298 } \
299 } while (0)
300
301 #define __emulate_1op(_op, _dst, _eflags, _suffix) \
302 do { \
303 unsigned long _tmp; \
304 \
305 __asm__ __volatile__ ( \
306 _PRE_EFLAGS("0", "3", "2") \
307 _op _suffix " %1; " \
308 _POST_EFLAGS("0", "3", "2") \
309 : "=m" (_eflags), "+m" ((_dst).val), \
310 "=&r" (_tmp) \
311 : "i" (EFLAGS_MASK)); \
312 } while (0)
313
314 /* Instruction has only one explicit operand (no source operand). */
315 #define emulate_1op(_op, _dst, _eflags) \
316 do { \
317 switch ((_dst).bytes) { \
318 case 1: __emulate_1op(_op, _dst, _eflags, "b"); break; \
319 case 2: __emulate_1op(_op, _dst, _eflags, "w"); break; \
320 case 4: __emulate_1op(_op, _dst, _eflags, "l"); break; \
321 case 8: ON64(__emulate_1op(_op, _dst, _eflags, "q")); break; \
322 } \
323 } while (0)
324
325 #define __emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, _suffix) \
326 do { \
327 unsigned long _tmp; \
328 \
329 __asm__ __volatile__ ( \
330 _PRE_EFLAGS("0", "4", "1") \
331 _op _suffix " %5; " \
332 _POST_EFLAGS("0", "4", "1") \
333 : "=m" (_eflags), "=&r" (_tmp), \
334 "+a" (_rax), "+d" (_rdx) \
335 : "i" (EFLAGS_MASK), "m" ((_src).val), \
336 "a" (_rax), "d" (_rdx)); \
337 } while (0)
338
339 #define __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, _eflags, _suffix, _ex) \
340 do { \
341 unsigned long _tmp; \
342 \
343 __asm__ __volatile__ ( \
344 _PRE_EFLAGS("0", "5", "1") \
345 "1: \n\t" \
346 _op _suffix " %6; " \
347 "2: \n\t" \
348 _POST_EFLAGS("0", "5", "1") \
349 ".pushsection .fixup,\"ax\" \n\t" \
350 "3: movb $1, %4 \n\t" \
351 "jmp 2b \n\t" \
352 ".popsection \n\t" \
353 _ASM_EXTABLE(1b, 3b) \
354 : "=m" (_eflags), "=&r" (_tmp), \
355 "+a" (_rax), "+d" (_rdx), "+qm"(_ex) \
356 : "i" (EFLAGS_MASK), "m" ((_src).val), \
357 "a" (_rax), "d" (_rdx)); \
358 } while (0)
359
360 /* instruction has only one source operand, destination is implicit (e.g. mul, div, imul, idiv) */
361 #define emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags) \
362 do { \
363 switch((_src).bytes) { \
364 case 1: __emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "b"); break; \
365 case 2: __emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "w"); break; \
366 case 4: __emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "l"); break; \
367 case 8: ON64(__emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "q")); break; \
368 } \
369 } while (0)
370
371 #define emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, _eflags, _ex) \
372 do { \
373 switch((_src).bytes) { \
374 case 1: \
375 __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, \
376 _eflags, "b", _ex); \
377 break; \
378 case 2: \
379 __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, \
380 _eflags, "w", _ex); \
381 break; \
382 case 4: \
383 __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, \
384 _eflags, "l", _ex); \
385 break; \
386 case 8: ON64( \
387 __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, \
388 _eflags, "q", _ex)); \
389 break; \
390 } \
391 } while (0)
392
393 /* Fetch next part of the instruction being emulated. */
394 #define insn_fetch(_type, _size, _eip) \
395 ({ unsigned long _x; \
396 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
397 if (rc != X86EMUL_CONTINUE) \
398 goto done; \
399 (_eip) += (_size); \
400 (_type)_x; \
401 })
402
403 #define insn_fetch_arr(_arr, _size, _eip) \
404 ({ rc = do_insn_fetch(ctxt, ops, (_eip), _arr, (_size)); \
405 if (rc != X86EMUL_CONTINUE) \
406 goto done; \
407 (_eip) += (_size); \
408 })
409
410 static inline unsigned long ad_mask(struct decode_cache *c)
411 {
412 return (1UL << (c->ad_bytes << 3)) - 1;
413 }
414
415 /* Access/update address held in a register, based on addressing mode. */
416 static inline unsigned long
417 address_mask(struct decode_cache *c, unsigned long reg)
418 {
419 if (c->ad_bytes == sizeof(unsigned long))
420 return reg;
421 else
422 return reg & ad_mask(c);
423 }
424
425 static inline unsigned long
426 register_address(struct decode_cache *c, unsigned long reg)
427 {
428 return address_mask(c, reg);
429 }
430
431 static inline void
432 register_address_increment(struct decode_cache *c, unsigned long *reg, int inc)
433 {
434 if (c->ad_bytes == sizeof(unsigned long))
435 *reg += inc;
436 else
437 *reg = (*reg & ~ad_mask(c)) | ((*reg + inc) & ad_mask(c));
438 }
439
440 static inline void jmp_rel(struct decode_cache *c, int rel)
441 {
442 register_address_increment(c, &c->eip, rel);
443 }
444
445 static void set_seg_override(struct decode_cache *c, int seg)
446 {
447 c->has_seg_override = true;
448 c->seg_override = seg;
449 }
450
451 static unsigned long seg_base(struct x86_emulate_ctxt *ctxt,
452 struct x86_emulate_ops *ops, int seg)
453 {
454 if (ctxt->mode == X86EMUL_MODE_PROT64 && seg < VCPU_SREG_FS)
455 return 0;
456
457 return ops->get_cached_segment_base(seg, ctxt->vcpu);
458 }
459
460 static unsigned seg_override(struct x86_emulate_ctxt *ctxt,
461 struct x86_emulate_ops *ops,
462 struct decode_cache *c)
463 {
464 if (!c->has_seg_override)
465 return 0;
466
467 return c->seg_override;
468 }
469
470 static ulong linear(struct x86_emulate_ctxt *ctxt,
471 struct segmented_address addr)
472 {
473 struct decode_cache *c = &ctxt->decode;
474 ulong la;
475
476 la = seg_base(ctxt, ctxt->ops, addr.seg) + addr.ea;
477 if (c->ad_bytes != 8)
478 la &= (u32)-1;
479 return la;
480 }
481
482 static int emulate_exception(struct x86_emulate_ctxt *ctxt, int vec,
483 u32 error, bool valid)
484 {
485 ctxt->exception.vector = vec;
486 ctxt->exception.error_code = error;
487 ctxt->exception.error_code_valid = valid;
488 return X86EMUL_PROPAGATE_FAULT;
489 }
490
491 static int emulate_gp(struct x86_emulate_ctxt *ctxt, int err)
492 {
493 return emulate_exception(ctxt, GP_VECTOR, err, true);
494 }
495
496 static int emulate_ud(struct x86_emulate_ctxt *ctxt)
497 {
498 return emulate_exception(ctxt, UD_VECTOR, 0, false);
499 }
500
501 static int emulate_ts(struct x86_emulate_ctxt *ctxt, int err)
502 {
503 return emulate_exception(ctxt, TS_VECTOR, err, true);
504 }
505
506 static int emulate_de(struct x86_emulate_ctxt *ctxt)
507 {
508 return emulate_exception(ctxt, DE_VECTOR, 0, false);
509 }
510
511 static int emulate_nm(struct x86_emulate_ctxt *ctxt)
512 {
513 return emulate_exception(ctxt, NM_VECTOR, 0, false);
514 }
515
516 static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
517 struct x86_emulate_ops *ops,
518 unsigned long eip, u8 *dest)
519 {
520 struct fetch_cache *fc = &ctxt->decode.fetch;
521 int rc;
522 int size, cur_size;
523
524 if (eip == fc->end) {
525 cur_size = fc->end - fc->start;
526 size = min(15UL - cur_size, PAGE_SIZE - offset_in_page(eip));
527 rc = ops->fetch(ctxt->cs_base + eip, fc->data + cur_size,
528 size, ctxt->vcpu, &ctxt->exception);
529 if (rc != X86EMUL_CONTINUE)
530 return rc;
531 fc->end += size;
532 }
533 *dest = fc->data[eip - fc->start];
534 return X86EMUL_CONTINUE;
535 }
536
537 static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
538 struct x86_emulate_ops *ops,
539 unsigned long eip, void *dest, unsigned size)
540 {
541 int rc;
542
543 /* x86 instructions are limited to 15 bytes. */
544 if (eip + size - ctxt->eip > 15)
545 return X86EMUL_UNHANDLEABLE;
546 while (size--) {
547 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
548 if (rc != X86EMUL_CONTINUE)
549 return rc;
550 }
551 return X86EMUL_CONTINUE;
552 }
553
554 /*
555 * Given the 'reg' portion of a ModRM byte, and a register block, return a
556 * pointer into the block that addresses the relevant register.
557 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
558 */
559 static void *decode_register(u8 modrm_reg, unsigned long *regs,
560 int highbyte_regs)
561 {
562 void *p;
563
564 p = &regs[modrm_reg];
565 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
566 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
567 return p;
568 }
569
570 static int read_descriptor(struct x86_emulate_ctxt *ctxt,
571 struct x86_emulate_ops *ops,
572 struct segmented_address addr,
573 u16 *size, unsigned long *address, int op_bytes)
574 {
575 int rc;
576
577 if (op_bytes == 2)
578 op_bytes = 3;
579 *address = 0;
580 rc = ops->read_std(linear(ctxt, addr), (unsigned long *)size, 2,
581 ctxt->vcpu, &ctxt->exception);
582 if (rc != X86EMUL_CONTINUE)
583 return rc;
584 addr.ea += 2;
585 rc = ops->read_std(linear(ctxt, addr), address, op_bytes,
586 ctxt->vcpu, &ctxt->exception);
587 return rc;
588 }
589
590 static int test_cc(unsigned int condition, unsigned int flags)
591 {
592 int rc = 0;
593
594 switch ((condition & 15) >> 1) {
595 case 0: /* o */
596 rc |= (flags & EFLG_OF);
597 break;
598 case 1: /* b/c/nae */
599 rc |= (flags & EFLG_CF);
600 break;
601 case 2: /* z/e */
602 rc |= (flags & EFLG_ZF);
603 break;
604 case 3: /* be/na */
605 rc |= (flags & (EFLG_CF|EFLG_ZF));
606 break;
607 case 4: /* s */
608 rc |= (flags & EFLG_SF);
609 break;
610 case 5: /* p/pe */
611 rc |= (flags & EFLG_PF);
612 break;
613 case 7: /* le/ng */
614 rc |= (flags & EFLG_ZF);
615 /* fall through */
616 case 6: /* l/nge */
617 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
618 break;
619 }
620
621 /* Odd condition identifiers (lsb == 1) have inverted sense. */
622 return (!!rc ^ (condition & 1));
623 }
624
625 static void fetch_register_operand(struct operand *op)
626 {
627 switch (op->bytes) {
628 case 1:
629 op->val = *(u8 *)op->addr.reg;
630 break;
631 case 2:
632 op->val = *(u16 *)op->addr.reg;
633 break;
634 case 4:
635 op->val = *(u32 *)op->addr.reg;
636 break;
637 case 8:
638 op->val = *(u64 *)op->addr.reg;
639 break;
640 }
641 }
642
643 static void read_sse_reg(struct x86_emulate_ctxt *ctxt, sse128_t *data, int reg)
644 {
645 ctxt->ops->get_fpu(ctxt);
646 switch (reg) {
647 case 0: asm("movdqu %%xmm0, %0" : "=m"(*data)); break;
648 case 1: asm("movdqu %%xmm1, %0" : "=m"(*data)); break;
649 case 2: asm("movdqu %%xmm2, %0" : "=m"(*data)); break;
650 case 3: asm("movdqu %%xmm3, %0" : "=m"(*data)); break;
651 case 4: asm("movdqu %%xmm4, %0" : "=m"(*data)); break;
652 case 5: asm("movdqu %%xmm5, %0" : "=m"(*data)); break;
653 case 6: asm("movdqu %%xmm6, %0" : "=m"(*data)); break;
654 case 7: asm("movdqu %%xmm7, %0" : "=m"(*data)); break;
655 #ifdef CONFIG_X86_64
656 case 8: asm("movdqu %%xmm8, %0" : "=m"(*data)); break;
657 case 9: asm("movdqu %%xmm9, %0" : "=m"(*data)); break;
658 case 10: asm("movdqu %%xmm10, %0" : "=m"(*data)); break;
659 case 11: asm("movdqu %%xmm11, %0" : "=m"(*data)); break;
660 case 12: asm("movdqu %%xmm12, %0" : "=m"(*data)); break;
661 case 13: asm("movdqu %%xmm13, %0" : "=m"(*data)); break;
662 case 14: asm("movdqu %%xmm14, %0" : "=m"(*data)); break;
663 case 15: asm("movdqu %%xmm15, %0" : "=m"(*data)); break;
664 #endif
665 default: BUG();
666 }
667 ctxt->ops->put_fpu(ctxt);
668 }
669
670 static void write_sse_reg(struct x86_emulate_ctxt *ctxt, sse128_t *data,
671 int reg)
672 {
673 ctxt->ops->get_fpu(ctxt);
674 switch (reg) {
675 case 0: asm("movdqu %0, %%xmm0" : : "m"(*data)); break;
676 case 1: asm("movdqu %0, %%xmm1" : : "m"(*data)); break;
677 case 2: asm("movdqu %0, %%xmm2" : : "m"(*data)); break;
678 case 3: asm("movdqu %0, %%xmm3" : : "m"(*data)); break;
679 case 4: asm("movdqu %0, %%xmm4" : : "m"(*data)); break;
680 case 5: asm("movdqu %0, %%xmm5" : : "m"(*data)); break;
681 case 6: asm("movdqu %0, %%xmm6" : : "m"(*data)); break;
682 case 7: asm("movdqu %0, %%xmm7" : : "m"(*data)); break;
683 #ifdef CONFIG_X86_64
684 case 8: asm("movdqu %0, %%xmm8" : : "m"(*data)); break;
685 case 9: asm("movdqu %0, %%xmm9" : : "m"(*data)); break;
686 case 10: asm("movdqu %0, %%xmm10" : : "m"(*data)); break;
687 case 11: asm("movdqu %0, %%xmm11" : : "m"(*data)); break;
688 case 12: asm("movdqu %0, %%xmm12" : : "m"(*data)); break;
689 case 13: asm("movdqu %0, %%xmm13" : : "m"(*data)); break;
690 case 14: asm("movdqu %0, %%xmm14" : : "m"(*data)); break;
691 case 15: asm("movdqu %0, %%xmm15" : : "m"(*data)); break;
692 #endif
693 default: BUG();
694 }
695 ctxt->ops->put_fpu(ctxt);
696 }
697
698 static void decode_register_operand(struct x86_emulate_ctxt *ctxt,
699 struct operand *op,
700 struct decode_cache *c,
701 int inhibit_bytereg)
702 {
703 unsigned reg = c->modrm_reg;
704 int highbyte_regs = c->rex_prefix == 0;
705
706 if (!(c->d & ModRM))
707 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
708
709 if (c->d & Sse) {
710 op->type = OP_XMM;
711 op->bytes = 16;
712 op->addr.xmm = reg;
713 read_sse_reg(ctxt, &op->vec_val, reg);
714 return;
715 }
716
717 op->type = OP_REG;
718 if ((c->d & ByteOp) && !inhibit_bytereg) {
719 op->addr.reg = decode_register(reg, c->regs, highbyte_regs);
720 op->bytes = 1;
721 } else {
722 op->addr.reg = decode_register(reg, c->regs, 0);
723 op->bytes = c->op_bytes;
724 }
725 fetch_register_operand(op);
726 op->orig_val = op->val;
727 }
728
729 static int decode_modrm(struct x86_emulate_ctxt *ctxt,
730 struct x86_emulate_ops *ops,
731 struct operand *op)
732 {
733 struct decode_cache *c = &ctxt->decode;
734 u8 sib;
735 int index_reg = 0, base_reg = 0, scale;
736 int rc = X86EMUL_CONTINUE;
737 ulong modrm_ea = 0;
738
739 if (c->rex_prefix) {
740 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
741 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
742 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
743 }
744
745 c->modrm = insn_fetch(u8, 1, c->eip);
746 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
747 c->modrm_reg |= (c->modrm & 0x38) >> 3;
748 c->modrm_rm |= (c->modrm & 0x07);
749 c->modrm_seg = VCPU_SREG_DS;
750
751 if (c->modrm_mod == 3) {
752 op->type = OP_REG;
753 op->bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
754 op->addr.reg = decode_register(c->modrm_rm,
755 c->regs, c->d & ByteOp);
756 if (c->d & Sse) {
757 op->type = OP_XMM;
758 op->bytes = 16;
759 op->addr.xmm = c->modrm_rm;
760 read_sse_reg(ctxt, &op->vec_val, c->modrm_rm);
761 return rc;
762 }
763 fetch_register_operand(op);
764 return rc;
765 }
766
767 op->type = OP_MEM;
768
769 if (c->ad_bytes == 2) {
770 unsigned bx = c->regs[VCPU_REGS_RBX];
771 unsigned bp = c->regs[VCPU_REGS_RBP];
772 unsigned si = c->regs[VCPU_REGS_RSI];
773 unsigned di = c->regs[VCPU_REGS_RDI];
774
775 /* 16-bit ModR/M decode. */
776 switch (c->modrm_mod) {
777 case 0:
778 if (c->modrm_rm == 6)
779 modrm_ea += insn_fetch(u16, 2, c->eip);
780 break;
781 case 1:
782 modrm_ea += insn_fetch(s8, 1, c->eip);
783 break;
784 case 2:
785 modrm_ea += insn_fetch(u16, 2, c->eip);
786 break;
787 }
788 switch (c->modrm_rm) {
789 case 0:
790 modrm_ea += bx + si;
791 break;
792 case 1:
793 modrm_ea += bx + di;
794 break;
795 case 2:
796 modrm_ea += bp + si;
797 break;
798 case 3:
799 modrm_ea += bp + di;
800 break;
801 case 4:
802 modrm_ea += si;
803 break;
804 case 5:
805 modrm_ea += di;
806 break;
807 case 6:
808 if (c->modrm_mod != 0)
809 modrm_ea += bp;
810 break;
811 case 7:
812 modrm_ea += bx;
813 break;
814 }
815 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
816 (c->modrm_rm == 6 && c->modrm_mod != 0))
817 c->modrm_seg = VCPU_SREG_SS;
818 modrm_ea = (u16)modrm_ea;
819 } else {
820 /* 32/64-bit ModR/M decode. */
821 if ((c->modrm_rm & 7) == 4) {
822 sib = insn_fetch(u8, 1, c->eip);
823 index_reg |= (sib >> 3) & 7;
824 base_reg |= sib & 7;
825 scale = sib >> 6;
826
827 if ((base_reg & 7) == 5 && c->modrm_mod == 0)
828 modrm_ea += insn_fetch(s32, 4, c->eip);
829 else
830 modrm_ea += c->regs[base_reg];
831 if (index_reg != 4)
832 modrm_ea += c->regs[index_reg] << scale;
833 } else if ((c->modrm_rm & 7) == 5 && c->modrm_mod == 0) {
834 if (ctxt->mode == X86EMUL_MODE_PROT64)
835 c->rip_relative = 1;
836 } else
837 modrm_ea += c->regs[c->modrm_rm];
838 switch (c->modrm_mod) {
839 case 0:
840 if (c->modrm_rm == 5)
841 modrm_ea += insn_fetch(s32, 4, c->eip);
842 break;
843 case 1:
844 modrm_ea += insn_fetch(s8, 1, c->eip);
845 break;
846 case 2:
847 modrm_ea += insn_fetch(s32, 4, c->eip);
848 break;
849 }
850 }
851 op->addr.mem.ea = modrm_ea;
852 done:
853 return rc;
854 }
855
856 static int decode_abs(struct x86_emulate_ctxt *ctxt,
857 struct x86_emulate_ops *ops,
858 struct operand *op)
859 {
860 struct decode_cache *c = &ctxt->decode;
861 int rc = X86EMUL_CONTINUE;
862
863 op->type = OP_MEM;
864 switch (c->ad_bytes) {
865 case 2:
866 op->addr.mem.ea = insn_fetch(u16, 2, c->eip);
867 break;
868 case 4:
869 op->addr.mem.ea = insn_fetch(u32, 4, c->eip);
870 break;
871 case 8:
872 op->addr.mem.ea = insn_fetch(u64, 8, c->eip);
873 break;
874 }
875 done:
876 return rc;
877 }
878
879 static void fetch_bit_operand(struct decode_cache *c)
880 {
881 long sv = 0, mask;
882
883 if (c->dst.type == OP_MEM && c->src.type == OP_REG) {
884 mask = ~(c->dst.bytes * 8 - 1);
885
886 if (c->src.bytes == 2)
887 sv = (s16)c->src.val & (s16)mask;
888 else if (c->src.bytes == 4)
889 sv = (s32)c->src.val & (s32)mask;
890
891 c->dst.addr.mem.ea += (sv >> 3);
892 }
893
894 /* only subword offset */
895 c->src.val &= (c->dst.bytes << 3) - 1;
896 }
897
898 static int read_emulated(struct x86_emulate_ctxt *ctxt,
899 struct x86_emulate_ops *ops,
900 unsigned long addr, void *dest, unsigned size)
901 {
902 int rc;
903 struct read_cache *mc = &ctxt->decode.mem_read;
904
905 while (size) {
906 int n = min(size, 8u);
907 size -= n;
908 if (mc->pos < mc->end)
909 goto read_cached;
910
911 rc = ops->read_emulated(addr, mc->data + mc->end, n,
912 &ctxt->exception, ctxt->vcpu);
913 if (rc != X86EMUL_CONTINUE)
914 return rc;
915 mc->end += n;
916
917 read_cached:
918 memcpy(dest, mc->data + mc->pos, n);
919 mc->pos += n;
920 dest += n;
921 addr += n;
922 }
923 return X86EMUL_CONTINUE;
924 }
925
926 static int pio_in_emulated(struct x86_emulate_ctxt *ctxt,
927 struct x86_emulate_ops *ops,
928 unsigned int size, unsigned short port,
929 void *dest)
930 {
931 struct read_cache *rc = &ctxt->decode.io_read;
932
933 if (rc->pos == rc->end) { /* refill pio read ahead */
934 struct decode_cache *c = &ctxt->decode;
935 unsigned int in_page, n;
936 unsigned int count = c->rep_prefix ?
937 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1;
938 in_page = (ctxt->eflags & EFLG_DF) ?
939 offset_in_page(c->regs[VCPU_REGS_RDI]) :
940 PAGE_SIZE - offset_in_page(c->regs[VCPU_REGS_RDI]);
941 n = min(min(in_page, (unsigned int)sizeof(rc->data)) / size,
942 count);
943 if (n == 0)
944 n = 1;
945 rc->pos = rc->end = 0;
946 if (!ops->pio_in_emulated(size, port, rc->data, n, ctxt->vcpu))
947 return 0;
948 rc->end = n * size;
949 }
950
951 memcpy(dest, rc->data + rc->pos, size);
952 rc->pos += size;
953 return 1;
954 }
955
956 static u32 desc_limit_scaled(struct desc_struct *desc)
957 {
958 u32 limit = get_desc_limit(desc);
959
960 return desc->g ? (limit << 12) | 0xfff : limit;
961 }
962
963 static void get_descriptor_table_ptr(struct x86_emulate_ctxt *ctxt,
964 struct x86_emulate_ops *ops,
965 u16 selector, struct desc_ptr *dt)
966 {
967 if (selector & 1 << 2) {
968 struct desc_struct desc;
969 memset (dt, 0, sizeof *dt);
970 if (!ops->get_cached_descriptor(&desc, NULL, VCPU_SREG_LDTR,
971 ctxt->vcpu))
972 return;
973
974 dt->size = desc_limit_scaled(&desc); /* what if limit > 65535? */
975 dt->address = get_desc_base(&desc);
976 } else
977 ops->get_gdt(dt, ctxt->vcpu);
978 }
979
980 /* allowed just for 8 bytes segments */
981 static int read_segment_descriptor(struct x86_emulate_ctxt *ctxt,
982 struct x86_emulate_ops *ops,
983 u16 selector, struct desc_struct *desc)
984 {
985 struct desc_ptr dt;
986 u16 index = selector >> 3;
987 int ret;
988 ulong addr;
989
990 get_descriptor_table_ptr(ctxt, ops, selector, &dt);
991
992 if (dt.size < index * 8 + 7)
993 return emulate_gp(ctxt, selector & 0xfffc);
994 addr = dt.address + index * 8;
995 ret = ops->read_std(addr, desc, sizeof *desc, ctxt->vcpu,
996 &ctxt->exception);
997
998 return ret;
999 }
1000
1001 /* allowed just for 8 bytes segments */
1002 static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt,
1003 struct x86_emulate_ops *ops,
1004 u16 selector, struct desc_struct *desc)
1005 {
1006 struct desc_ptr dt;
1007 u16 index = selector >> 3;
1008 ulong addr;
1009 int ret;
1010
1011 get_descriptor_table_ptr(ctxt, ops, selector, &dt);
1012
1013 if (dt.size < index * 8 + 7)
1014 return emulate_gp(ctxt, selector & 0xfffc);
1015
1016 addr = dt.address + index * 8;
1017 ret = ops->write_std(addr, desc, sizeof *desc, ctxt->vcpu,
1018 &ctxt->exception);
1019
1020 return ret;
1021 }
1022
1023 /* Does not support long mode */
1024 static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
1025 struct x86_emulate_ops *ops,
1026 u16 selector, int seg)
1027 {
1028 struct desc_struct seg_desc;
1029 u8 dpl, rpl, cpl;
1030 unsigned err_vec = GP_VECTOR;
1031 u32 err_code = 0;
1032 bool null_selector = !(selector & ~0x3); /* 0000-0003 are null */
1033 int ret;
1034
1035 memset(&seg_desc, 0, sizeof seg_desc);
1036
1037 if ((seg <= VCPU_SREG_GS && ctxt->mode == X86EMUL_MODE_VM86)
1038 || ctxt->mode == X86EMUL_MODE_REAL) {
1039 /* set real mode segment descriptor */
1040 set_desc_base(&seg_desc, selector << 4);
1041 set_desc_limit(&seg_desc, 0xffff);
1042 seg_desc.type = 3;
1043 seg_desc.p = 1;
1044 seg_desc.s = 1;
1045 goto load;
1046 }
1047
1048 /* NULL selector is not valid for TR, CS and SS */
1049 if ((seg == VCPU_SREG_CS || seg == VCPU_SREG_SS || seg == VCPU_SREG_TR)
1050 && null_selector)
1051 goto exception;
1052
1053 /* TR should be in GDT only */
1054 if (seg == VCPU_SREG_TR && (selector & (1 << 2)))
1055 goto exception;
1056
1057 if (null_selector) /* for NULL selector skip all following checks */
1058 goto load;
1059
1060 ret = read_segment_descriptor(ctxt, ops, selector, &seg_desc);
1061 if (ret != X86EMUL_CONTINUE)
1062 return ret;
1063
1064 err_code = selector & 0xfffc;
1065 err_vec = GP_VECTOR;
1066
1067 /* can't load system descriptor into segment selecor */
1068 if (seg <= VCPU_SREG_GS && !seg_desc.s)
1069 goto exception;
1070
1071 if (!seg_desc.p) {
1072 err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR;
1073 goto exception;
1074 }
1075
1076 rpl = selector & 3;
1077 dpl = seg_desc.dpl;
1078 cpl = ops->cpl(ctxt->vcpu);
1079
1080 switch (seg) {
1081 case VCPU_SREG_SS:
1082 /*
1083 * segment is not a writable data segment or segment
1084 * selector's RPL != CPL or segment selector's RPL != CPL
1085 */
1086 if (rpl != cpl || (seg_desc.type & 0xa) != 0x2 || dpl != cpl)
1087 goto exception;
1088 break;
1089 case VCPU_SREG_CS:
1090 if (!(seg_desc.type & 8))
1091 goto exception;
1092
1093 if (seg_desc.type & 4) {
1094 /* conforming */
1095 if (dpl > cpl)
1096 goto exception;
1097 } else {
1098 /* nonconforming */
1099 if (rpl > cpl || dpl != cpl)
1100 goto exception;
1101 }
1102 /* CS(RPL) <- CPL */
1103 selector = (selector & 0xfffc) | cpl;
1104 break;
1105 case VCPU_SREG_TR:
1106 if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9))
1107 goto exception;
1108 break;
1109 case VCPU_SREG_LDTR:
1110 if (seg_desc.s || seg_desc.type != 2)
1111 goto exception;
1112 break;
1113 default: /* DS, ES, FS, or GS */
1114 /*
1115 * segment is not a data or readable code segment or
1116 * ((segment is a data or nonconforming code segment)
1117 * and (both RPL and CPL > DPL))
1118 */
1119 if ((seg_desc.type & 0xa) == 0x8 ||
1120 (((seg_desc.type & 0xc) != 0xc) &&
1121 (rpl > dpl && cpl > dpl)))
1122 goto exception;
1123 break;
1124 }
1125
1126 if (seg_desc.s) {
1127 /* mark segment as accessed */
1128 seg_desc.type |= 1;
1129 ret = write_segment_descriptor(ctxt, ops, selector, &seg_desc);
1130 if (ret != X86EMUL_CONTINUE)
1131 return ret;
1132 }
1133 load:
1134 ops->set_segment_selector(selector, seg, ctxt->vcpu);
1135 ops->set_cached_descriptor(&seg_desc, 0, seg, ctxt->vcpu);
1136 return X86EMUL_CONTINUE;
1137 exception:
1138 emulate_exception(ctxt, err_vec, err_code, true);
1139 return X86EMUL_PROPAGATE_FAULT;
1140 }
1141
1142 static void write_register_operand(struct operand *op)
1143 {
1144 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1145 switch (op->bytes) {
1146 case 1:
1147 *(u8 *)op->addr.reg = (u8)op->val;
1148 break;
1149 case 2:
1150 *(u16 *)op->addr.reg = (u16)op->val;
1151 break;
1152 case 4:
1153 *op->addr.reg = (u32)op->val;
1154 break; /* 64b: zero-extend */
1155 case 8:
1156 *op->addr.reg = op->val;
1157 break;
1158 }
1159 }
1160
1161 static inline int writeback(struct x86_emulate_ctxt *ctxt,
1162 struct x86_emulate_ops *ops)
1163 {
1164 int rc;
1165 struct decode_cache *c = &ctxt->decode;
1166
1167 switch (c->dst.type) {
1168 case OP_REG:
1169 write_register_operand(&c->dst);
1170 break;
1171 case OP_MEM:
1172 if (c->lock_prefix)
1173 rc = ops->cmpxchg_emulated(
1174 linear(ctxt, c->dst.addr.mem),
1175 &c->dst.orig_val,
1176 &c->dst.val,
1177 c->dst.bytes,
1178 &ctxt->exception,
1179 ctxt->vcpu);
1180 else
1181 rc = ops->write_emulated(
1182 linear(ctxt, c->dst.addr.mem),
1183 &c->dst.val,
1184 c->dst.bytes,
1185 &ctxt->exception,
1186 ctxt->vcpu);
1187 if (rc != X86EMUL_CONTINUE)
1188 return rc;
1189 break;
1190 case OP_XMM:
1191 write_sse_reg(ctxt, &c->dst.vec_val, c->dst.addr.xmm);
1192 break;
1193 case OP_NONE:
1194 /* no writeback */
1195 break;
1196 default:
1197 break;
1198 }
1199 return X86EMUL_CONTINUE;
1200 }
1201
1202 static inline void emulate_push(struct x86_emulate_ctxt *ctxt,
1203 struct x86_emulate_ops *ops)
1204 {
1205 struct decode_cache *c = &ctxt->decode;
1206
1207 c->dst.type = OP_MEM;
1208 c->dst.bytes = c->op_bytes;
1209 c->dst.val = c->src.val;
1210 register_address_increment(c, &c->regs[VCPU_REGS_RSP], -c->op_bytes);
1211 c->dst.addr.mem.ea = register_address(c, c->regs[VCPU_REGS_RSP]);
1212 c->dst.addr.mem.seg = VCPU_SREG_SS;
1213 }
1214
1215 static int emulate_pop(struct x86_emulate_ctxt *ctxt,
1216 struct x86_emulate_ops *ops,
1217 void *dest, int len)
1218 {
1219 struct decode_cache *c = &ctxt->decode;
1220 int rc;
1221 struct segmented_address addr;
1222
1223 addr.ea = register_address(c, c->regs[VCPU_REGS_RSP]);
1224 addr.seg = VCPU_SREG_SS;
1225 rc = read_emulated(ctxt, ops, linear(ctxt, addr), dest, len);
1226 if (rc != X86EMUL_CONTINUE)
1227 return rc;
1228
1229 register_address_increment(c, &c->regs[VCPU_REGS_RSP], len);
1230 return rc;
1231 }
1232
1233 static int emulate_popf(struct x86_emulate_ctxt *ctxt,
1234 struct x86_emulate_ops *ops,
1235 void *dest, int len)
1236 {
1237 int rc;
1238 unsigned long val, change_mask;
1239 int iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
1240 int cpl = ops->cpl(ctxt->vcpu);
1241
1242 rc = emulate_pop(ctxt, ops, &val, len);
1243 if (rc != X86EMUL_CONTINUE)
1244 return rc;
1245
1246 change_mask = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF | EFLG_OF
1247 | EFLG_TF | EFLG_DF | EFLG_NT | EFLG_RF | EFLG_AC | EFLG_ID;
1248
1249 switch(ctxt->mode) {
1250 case X86EMUL_MODE_PROT64:
1251 case X86EMUL_MODE_PROT32:
1252 case X86EMUL_MODE_PROT16:
1253 if (cpl == 0)
1254 change_mask |= EFLG_IOPL;
1255 if (cpl <= iopl)
1256 change_mask |= EFLG_IF;
1257 break;
1258 case X86EMUL_MODE_VM86:
1259 if (iopl < 3)
1260 return emulate_gp(ctxt, 0);
1261 change_mask |= EFLG_IF;
1262 break;
1263 default: /* real mode */
1264 change_mask |= (EFLG_IOPL | EFLG_IF);
1265 break;
1266 }
1267
1268 *(unsigned long *)dest =
1269 (ctxt->eflags & ~change_mask) | (val & change_mask);
1270
1271 return rc;
1272 }
1273
1274 static void emulate_push_sreg(struct x86_emulate_ctxt *ctxt,
1275 struct x86_emulate_ops *ops, int seg)
1276 {
1277 struct decode_cache *c = &ctxt->decode;
1278
1279 c->src.val = ops->get_segment_selector(seg, ctxt->vcpu);
1280
1281 emulate_push(ctxt, ops);
1282 }
1283
1284 static int emulate_pop_sreg(struct x86_emulate_ctxt *ctxt,
1285 struct x86_emulate_ops *ops, int seg)
1286 {
1287 struct decode_cache *c = &ctxt->decode;
1288 unsigned long selector;
1289 int rc;
1290
1291 rc = emulate_pop(ctxt, ops, &selector, c->op_bytes);
1292 if (rc != X86EMUL_CONTINUE)
1293 return rc;
1294
1295 rc = load_segment_descriptor(ctxt, ops, (u16)selector, seg);
1296 return rc;
1297 }
1298
1299 static int emulate_pusha(struct x86_emulate_ctxt *ctxt,
1300 struct x86_emulate_ops *ops)
1301 {
1302 struct decode_cache *c = &ctxt->decode;
1303 unsigned long old_esp = c->regs[VCPU_REGS_RSP];
1304 int rc = X86EMUL_CONTINUE;
1305 int reg = VCPU_REGS_RAX;
1306
1307 while (reg <= VCPU_REGS_RDI) {
1308 (reg == VCPU_REGS_RSP) ?
1309 (c->src.val = old_esp) : (c->src.val = c->regs[reg]);
1310
1311 emulate_push(ctxt, ops);
1312
1313 rc = writeback(ctxt, ops);
1314 if (rc != X86EMUL_CONTINUE)
1315 return rc;
1316
1317 ++reg;
1318 }
1319
1320 /* Disable writeback. */
1321 c->dst.type = OP_NONE;
1322
1323 return rc;
1324 }
1325
1326 static int emulate_popa(struct x86_emulate_ctxt *ctxt,
1327 struct x86_emulate_ops *ops)
1328 {
1329 struct decode_cache *c = &ctxt->decode;
1330 int rc = X86EMUL_CONTINUE;
1331 int reg = VCPU_REGS_RDI;
1332
1333 while (reg >= VCPU_REGS_RAX) {
1334 if (reg == VCPU_REGS_RSP) {
1335 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1336 c->op_bytes);
1337 --reg;
1338 }
1339
1340 rc = emulate_pop(ctxt, ops, &c->regs[reg], c->op_bytes);
1341 if (rc != X86EMUL_CONTINUE)
1342 break;
1343 --reg;
1344 }
1345 return rc;
1346 }
1347
1348 int emulate_int_real(struct x86_emulate_ctxt *ctxt,
1349 struct x86_emulate_ops *ops, int irq)
1350 {
1351 struct decode_cache *c = &ctxt->decode;
1352 int rc;
1353 struct desc_ptr dt;
1354 gva_t cs_addr;
1355 gva_t eip_addr;
1356 u16 cs, eip;
1357
1358 /* TODO: Add limit checks */
1359 c->src.val = ctxt->eflags;
1360 emulate_push(ctxt, ops);
1361 rc = writeback(ctxt, ops);
1362 if (rc != X86EMUL_CONTINUE)
1363 return rc;
1364
1365 ctxt->eflags &= ~(EFLG_IF | EFLG_TF | EFLG_AC);
1366
1367 c->src.val = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
1368 emulate_push(ctxt, ops);
1369 rc = writeback(ctxt, ops);
1370 if (rc != X86EMUL_CONTINUE)
1371 return rc;
1372
1373 c->src.val = c->eip;
1374 emulate_push(ctxt, ops);
1375 rc = writeback(ctxt, ops);
1376 if (rc != X86EMUL_CONTINUE)
1377 return rc;
1378
1379 c->dst.type = OP_NONE;
1380
1381 ops->get_idt(&dt, ctxt->vcpu);
1382
1383 eip_addr = dt.address + (irq << 2);
1384 cs_addr = dt.address + (irq << 2) + 2;
1385
1386 rc = ops->read_std(cs_addr, &cs, 2, ctxt->vcpu, &ctxt->exception);
1387 if (rc != X86EMUL_CONTINUE)
1388 return rc;
1389
1390 rc = ops->read_std(eip_addr, &eip, 2, ctxt->vcpu, &ctxt->exception);
1391 if (rc != X86EMUL_CONTINUE)
1392 return rc;
1393
1394 rc = load_segment_descriptor(ctxt, ops, cs, VCPU_SREG_CS);
1395 if (rc != X86EMUL_CONTINUE)
1396 return rc;
1397
1398 c->eip = eip;
1399
1400 return rc;
1401 }
1402
1403 static int emulate_int(struct x86_emulate_ctxt *ctxt,
1404 struct x86_emulate_ops *ops, int irq)
1405 {
1406 switch(ctxt->mode) {
1407 case X86EMUL_MODE_REAL:
1408 return emulate_int_real(ctxt, ops, irq);
1409 case X86EMUL_MODE_VM86:
1410 case X86EMUL_MODE_PROT16:
1411 case X86EMUL_MODE_PROT32:
1412 case X86EMUL_MODE_PROT64:
1413 default:
1414 /* Protected mode interrupts unimplemented yet */
1415 return X86EMUL_UNHANDLEABLE;
1416 }
1417 }
1418
1419 static int emulate_iret_real(struct x86_emulate_ctxt *ctxt,
1420 struct x86_emulate_ops *ops)
1421 {
1422 struct decode_cache *c = &ctxt->decode;
1423 int rc = X86EMUL_CONTINUE;
1424 unsigned long temp_eip = 0;
1425 unsigned long temp_eflags = 0;
1426 unsigned long cs = 0;
1427 unsigned long mask = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF | EFLG_TF |
1428 EFLG_IF | EFLG_DF | EFLG_OF | EFLG_IOPL | EFLG_NT | EFLG_RF |
1429 EFLG_AC | EFLG_ID | (1 << 1); /* Last one is the reserved bit */
1430 unsigned long vm86_mask = EFLG_VM | EFLG_VIF | EFLG_VIP;
1431
1432 /* TODO: Add stack limit check */
1433
1434 rc = emulate_pop(ctxt, ops, &temp_eip, c->op_bytes);
1435
1436 if (rc != X86EMUL_CONTINUE)
1437 return rc;
1438
1439 if (temp_eip & ~0xffff)
1440 return emulate_gp(ctxt, 0);
1441
1442 rc = emulate_pop(ctxt, ops, &cs, c->op_bytes);
1443
1444 if (rc != X86EMUL_CONTINUE)
1445 return rc;
1446
1447 rc = emulate_pop(ctxt, ops, &temp_eflags, c->op_bytes);
1448
1449 if (rc != X86EMUL_CONTINUE)
1450 return rc;
1451
1452 rc = load_segment_descriptor(ctxt, ops, (u16)cs, VCPU_SREG_CS);
1453
1454 if (rc != X86EMUL_CONTINUE)
1455 return rc;
1456
1457 c->eip = temp_eip;
1458
1459
1460 if (c->op_bytes == 4)
1461 ctxt->eflags = ((temp_eflags & mask) | (ctxt->eflags & vm86_mask));
1462 else if (c->op_bytes == 2) {
1463 ctxt->eflags &= ~0xffff;
1464 ctxt->eflags |= temp_eflags;
1465 }
1466
1467 ctxt->eflags &= ~EFLG_RESERVED_ZEROS_MASK; /* Clear reserved zeros */
1468 ctxt->eflags |= EFLG_RESERVED_ONE_MASK;
1469
1470 return rc;
1471 }
1472
1473 static inline int emulate_iret(struct x86_emulate_ctxt *ctxt,
1474 struct x86_emulate_ops* ops)
1475 {
1476 switch(ctxt->mode) {
1477 case X86EMUL_MODE_REAL:
1478 return emulate_iret_real(ctxt, ops);
1479 case X86EMUL_MODE_VM86:
1480 case X86EMUL_MODE_PROT16:
1481 case X86EMUL_MODE_PROT32:
1482 case X86EMUL_MODE_PROT64:
1483 default:
1484 /* iret from protected mode unimplemented yet */
1485 return X86EMUL_UNHANDLEABLE;
1486 }
1487 }
1488
1489 static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
1490 struct x86_emulate_ops *ops)
1491 {
1492 struct decode_cache *c = &ctxt->decode;
1493
1494 return emulate_pop(ctxt, ops, &c->dst.val, c->dst.bytes);
1495 }
1496
1497 static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
1498 {
1499 struct decode_cache *c = &ctxt->decode;
1500 switch (c->modrm_reg) {
1501 case 0: /* rol */
1502 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
1503 break;
1504 case 1: /* ror */
1505 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
1506 break;
1507 case 2: /* rcl */
1508 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
1509 break;
1510 case 3: /* rcr */
1511 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
1512 break;
1513 case 4: /* sal/shl */
1514 case 6: /* sal/shl */
1515 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
1516 break;
1517 case 5: /* shr */
1518 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
1519 break;
1520 case 7: /* sar */
1521 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
1522 break;
1523 }
1524 }
1525
1526 static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
1527 struct x86_emulate_ops *ops)
1528 {
1529 struct decode_cache *c = &ctxt->decode;
1530 unsigned long *rax = &c->regs[VCPU_REGS_RAX];
1531 unsigned long *rdx = &c->regs[VCPU_REGS_RDX];
1532 u8 de = 0;
1533
1534 switch (c->modrm_reg) {
1535 case 0 ... 1: /* test */
1536 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
1537 break;
1538 case 2: /* not */
1539 c->dst.val = ~c->dst.val;
1540 break;
1541 case 3: /* neg */
1542 emulate_1op("neg", c->dst, ctxt->eflags);
1543 break;
1544 case 4: /* mul */
1545 emulate_1op_rax_rdx("mul", c->src, *rax, *rdx, ctxt->eflags);
1546 break;
1547 case 5: /* imul */
1548 emulate_1op_rax_rdx("imul", c->src, *rax, *rdx, ctxt->eflags);
1549 break;
1550 case 6: /* div */
1551 emulate_1op_rax_rdx_ex("div", c->src, *rax, *rdx,
1552 ctxt->eflags, de);
1553 break;
1554 case 7: /* idiv */
1555 emulate_1op_rax_rdx_ex("idiv", c->src, *rax, *rdx,
1556 ctxt->eflags, de);
1557 break;
1558 default:
1559 return X86EMUL_UNHANDLEABLE;
1560 }
1561 if (de)
1562 return emulate_de(ctxt);
1563 return X86EMUL_CONTINUE;
1564 }
1565
1566 static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
1567 struct x86_emulate_ops *ops)
1568 {
1569 struct decode_cache *c = &ctxt->decode;
1570
1571 switch (c->modrm_reg) {
1572 case 0: /* inc */
1573 emulate_1op("inc", c->dst, ctxt->eflags);
1574 break;
1575 case 1: /* dec */
1576 emulate_1op("dec", c->dst, ctxt->eflags);
1577 break;
1578 case 2: /* call near abs */ {
1579 long int old_eip;
1580 old_eip = c->eip;
1581 c->eip = c->src.val;
1582 c->src.val = old_eip;
1583 emulate_push(ctxt, ops);
1584 break;
1585 }
1586 case 4: /* jmp abs */
1587 c->eip = c->src.val;
1588 break;
1589 case 6: /* push */
1590 emulate_push(ctxt, ops);
1591 break;
1592 }
1593 return X86EMUL_CONTINUE;
1594 }
1595
1596 static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
1597 struct x86_emulate_ops *ops)
1598 {
1599 struct decode_cache *c = &ctxt->decode;
1600 u64 old = c->dst.orig_val64;
1601
1602 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1603 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
1604 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1605 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
1606 ctxt->eflags &= ~EFLG_ZF;
1607 } else {
1608 c->dst.val64 = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1609 (u32) c->regs[VCPU_REGS_RBX];
1610
1611 ctxt->eflags |= EFLG_ZF;
1612 }
1613 return X86EMUL_CONTINUE;
1614 }
1615
1616 static int emulate_ret_far(struct x86_emulate_ctxt *ctxt,
1617 struct x86_emulate_ops *ops)
1618 {
1619 struct decode_cache *c = &ctxt->decode;
1620 int rc;
1621 unsigned long cs;
1622
1623 rc = emulate_pop(ctxt, ops, &c->eip, c->op_bytes);
1624 if (rc != X86EMUL_CONTINUE)
1625 return rc;
1626 if (c->op_bytes == 4)
1627 c->eip = (u32)c->eip;
1628 rc = emulate_pop(ctxt, ops, &cs, c->op_bytes);
1629 if (rc != X86EMUL_CONTINUE)
1630 return rc;
1631 rc = load_segment_descriptor(ctxt, ops, (u16)cs, VCPU_SREG_CS);
1632 return rc;
1633 }
1634
1635 static int emulate_load_segment(struct x86_emulate_ctxt *ctxt,
1636 struct x86_emulate_ops *ops, int seg)
1637 {
1638 struct decode_cache *c = &ctxt->decode;
1639 unsigned short sel;
1640 int rc;
1641
1642 memcpy(&sel, c->src.valptr + c->op_bytes, 2);
1643
1644 rc = load_segment_descriptor(ctxt, ops, sel, seg);
1645 if (rc != X86EMUL_CONTINUE)
1646 return rc;
1647
1648 c->dst.val = c->src.val;
1649 return rc;
1650 }
1651
1652 static inline void
1653 setup_syscalls_segments(struct x86_emulate_ctxt *ctxt,
1654 struct x86_emulate_ops *ops, struct desc_struct *cs,
1655 struct desc_struct *ss)
1656 {
1657 memset(cs, 0, sizeof(struct desc_struct));
1658 ops->get_cached_descriptor(cs, NULL, VCPU_SREG_CS, ctxt->vcpu);
1659 memset(ss, 0, sizeof(struct desc_struct));
1660
1661 cs->l = 0; /* will be adjusted later */
1662 set_desc_base(cs, 0); /* flat segment */
1663 cs->g = 1; /* 4kb granularity */
1664 set_desc_limit(cs, 0xfffff); /* 4GB limit */
1665 cs->type = 0x0b; /* Read, Execute, Accessed */
1666 cs->s = 1;
1667 cs->dpl = 0; /* will be adjusted later */
1668 cs->p = 1;
1669 cs->d = 1;
1670
1671 set_desc_base(ss, 0); /* flat segment */
1672 set_desc_limit(ss, 0xfffff); /* 4GB limit */
1673 ss->g = 1; /* 4kb granularity */
1674 ss->s = 1;
1675 ss->type = 0x03; /* Read/Write, Accessed */
1676 ss->d = 1; /* 32bit stack segment */
1677 ss->dpl = 0;
1678 ss->p = 1;
1679 }
1680
1681 static int
1682 emulate_syscall(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1683 {
1684 struct decode_cache *c = &ctxt->decode;
1685 struct desc_struct cs, ss;
1686 u64 msr_data;
1687 u16 cs_sel, ss_sel;
1688
1689 /* syscall is not available in real mode */
1690 if (ctxt->mode == X86EMUL_MODE_REAL ||
1691 ctxt->mode == X86EMUL_MODE_VM86)
1692 return emulate_ud(ctxt);
1693
1694 setup_syscalls_segments(ctxt, ops, &cs, &ss);
1695
1696 ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
1697 msr_data >>= 32;
1698 cs_sel = (u16)(msr_data & 0xfffc);
1699 ss_sel = (u16)(msr_data + 8);
1700
1701 if (is_long_mode(ctxt->vcpu)) {
1702 cs.d = 0;
1703 cs.l = 1;
1704 }
1705 ops->set_cached_descriptor(&cs, 0, VCPU_SREG_CS, ctxt->vcpu);
1706 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
1707 ops->set_cached_descriptor(&ss, 0, VCPU_SREG_SS, ctxt->vcpu);
1708 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
1709
1710 c->regs[VCPU_REGS_RCX] = c->eip;
1711 if (is_long_mode(ctxt->vcpu)) {
1712 #ifdef CONFIG_X86_64
1713 c->regs[VCPU_REGS_R11] = ctxt->eflags & ~EFLG_RF;
1714
1715 ops->get_msr(ctxt->vcpu,
1716 ctxt->mode == X86EMUL_MODE_PROT64 ?
1717 MSR_LSTAR : MSR_CSTAR, &msr_data);
1718 c->eip = msr_data;
1719
1720 ops->get_msr(ctxt->vcpu, MSR_SYSCALL_MASK, &msr_data);
1721 ctxt->eflags &= ~(msr_data | EFLG_RF);
1722 #endif
1723 } else {
1724 /* legacy mode */
1725 ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
1726 c->eip = (u32)msr_data;
1727
1728 ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
1729 }
1730
1731 return X86EMUL_CONTINUE;
1732 }
1733
1734 static int
1735 emulate_sysenter(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1736 {
1737 struct decode_cache *c = &ctxt->decode;
1738 struct desc_struct cs, ss;
1739 u64 msr_data;
1740 u16 cs_sel, ss_sel;
1741
1742 /* inject #GP if in real mode */
1743 if (ctxt->mode == X86EMUL_MODE_REAL)
1744 return emulate_gp(ctxt, 0);
1745
1746 /* XXX sysenter/sysexit have not been tested in 64bit mode.
1747 * Therefore, we inject an #UD.
1748 */
1749 if (ctxt->mode == X86EMUL_MODE_PROT64)
1750 return emulate_ud(ctxt);
1751
1752 setup_syscalls_segments(ctxt, ops, &cs, &ss);
1753
1754 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_CS, &msr_data);
1755 switch (ctxt->mode) {
1756 case X86EMUL_MODE_PROT32:
1757 if ((msr_data & 0xfffc) == 0x0)
1758 return emulate_gp(ctxt, 0);
1759 break;
1760 case X86EMUL_MODE_PROT64:
1761 if (msr_data == 0x0)
1762 return emulate_gp(ctxt, 0);
1763 break;
1764 }
1765
1766 ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
1767 cs_sel = (u16)msr_data;
1768 cs_sel &= ~SELECTOR_RPL_MASK;
1769 ss_sel = cs_sel + 8;
1770 ss_sel &= ~SELECTOR_RPL_MASK;
1771 if (ctxt->mode == X86EMUL_MODE_PROT64
1772 || is_long_mode(ctxt->vcpu)) {
1773 cs.d = 0;
1774 cs.l = 1;
1775 }
1776
1777 ops->set_cached_descriptor(&cs, 0, VCPU_SREG_CS, ctxt->vcpu);
1778 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
1779 ops->set_cached_descriptor(&ss, 0, VCPU_SREG_SS, ctxt->vcpu);
1780 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
1781
1782 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_EIP, &msr_data);
1783 c->eip = msr_data;
1784
1785 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_ESP, &msr_data);
1786 c->regs[VCPU_REGS_RSP] = msr_data;
1787
1788 return X86EMUL_CONTINUE;
1789 }
1790
1791 static int
1792 emulate_sysexit(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
1793 {
1794 struct decode_cache *c = &ctxt->decode;
1795 struct desc_struct cs, ss;
1796 u64 msr_data;
1797 int usermode;
1798 u16 cs_sel, ss_sel;
1799
1800 /* inject #GP if in real mode or Virtual 8086 mode */
1801 if (ctxt->mode == X86EMUL_MODE_REAL ||
1802 ctxt->mode == X86EMUL_MODE_VM86)
1803 return emulate_gp(ctxt, 0);
1804
1805 setup_syscalls_segments(ctxt, ops, &cs, &ss);
1806
1807 if ((c->rex_prefix & 0x8) != 0x0)
1808 usermode = X86EMUL_MODE_PROT64;
1809 else
1810 usermode = X86EMUL_MODE_PROT32;
1811
1812 cs.dpl = 3;
1813 ss.dpl = 3;
1814 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_CS, &msr_data);
1815 switch (usermode) {
1816 case X86EMUL_MODE_PROT32:
1817 cs_sel = (u16)(msr_data + 16);
1818 if ((msr_data & 0xfffc) == 0x0)
1819 return emulate_gp(ctxt, 0);
1820 ss_sel = (u16)(msr_data + 24);
1821 break;
1822 case X86EMUL_MODE_PROT64:
1823 cs_sel = (u16)(msr_data + 32);
1824 if (msr_data == 0x0)
1825 return emulate_gp(ctxt, 0);
1826 ss_sel = cs_sel + 8;
1827 cs.d = 0;
1828 cs.l = 1;
1829 break;
1830 }
1831 cs_sel |= SELECTOR_RPL_MASK;
1832 ss_sel |= SELECTOR_RPL_MASK;
1833
1834 ops->set_cached_descriptor(&cs, 0, VCPU_SREG_CS, ctxt->vcpu);
1835 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
1836 ops->set_cached_descriptor(&ss, 0, VCPU_SREG_SS, ctxt->vcpu);
1837 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
1838
1839 c->eip = c->regs[VCPU_REGS_RDX];
1840 c->regs[VCPU_REGS_RSP] = c->regs[VCPU_REGS_RCX];
1841
1842 return X86EMUL_CONTINUE;
1843 }
1844
1845 static bool emulator_bad_iopl(struct x86_emulate_ctxt *ctxt,
1846 struct x86_emulate_ops *ops)
1847 {
1848 int iopl;
1849 if (ctxt->mode == X86EMUL_MODE_REAL)
1850 return false;
1851 if (ctxt->mode == X86EMUL_MODE_VM86)
1852 return true;
1853 iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
1854 return ops->cpl(ctxt->vcpu) > iopl;
1855 }
1856
1857 static bool emulator_io_port_access_allowed(struct x86_emulate_ctxt *ctxt,
1858 struct x86_emulate_ops *ops,
1859 u16 port, u16 len)
1860 {
1861 struct desc_struct tr_seg;
1862 u32 base3;
1863 int r;
1864 u16 io_bitmap_ptr, perm, bit_idx = port & 0x7;
1865 unsigned mask = (1 << len) - 1;
1866 unsigned long base;
1867
1868 ops->get_cached_descriptor(&tr_seg, &base3, VCPU_SREG_TR, ctxt->vcpu);
1869 if (!tr_seg.p)
1870 return false;
1871 if (desc_limit_scaled(&tr_seg) < 103)
1872 return false;
1873 base = get_desc_base(&tr_seg);
1874 #ifdef CONFIG_X86_64
1875 base |= ((u64)base3) << 32;
1876 #endif
1877 r = ops->read_std(base + 102, &io_bitmap_ptr, 2, ctxt->vcpu, NULL);
1878 if (r != X86EMUL_CONTINUE)
1879 return false;
1880 if (io_bitmap_ptr + port/8 > desc_limit_scaled(&tr_seg))
1881 return false;
1882 r = ops->read_std(base + io_bitmap_ptr + port/8, &perm, 2, ctxt->vcpu,
1883 NULL);
1884 if (r != X86EMUL_CONTINUE)
1885 return false;
1886 if ((perm >> bit_idx) & mask)
1887 return false;
1888 return true;
1889 }
1890
1891 static bool emulator_io_permited(struct x86_emulate_ctxt *ctxt,
1892 struct x86_emulate_ops *ops,
1893 u16 port, u16 len)
1894 {
1895 if (ctxt->perm_ok)
1896 return true;
1897
1898 if (emulator_bad_iopl(ctxt, ops))
1899 if (!emulator_io_port_access_allowed(ctxt, ops, port, len))
1900 return false;
1901
1902 ctxt->perm_ok = true;
1903
1904 return true;
1905 }
1906
1907 static void save_state_to_tss16(struct x86_emulate_ctxt *ctxt,
1908 struct x86_emulate_ops *ops,
1909 struct tss_segment_16 *tss)
1910 {
1911 struct decode_cache *c = &ctxt->decode;
1912
1913 tss->ip = c->eip;
1914 tss->flag = ctxt->eflags;
1915 tss->ax = c->regs[VCPU_REGS_RAX];
1916 tss->cx = c->regs[VCPU_REGS_RCX];
1917 tss->dx = c->regs[VCPU_REGS_RDX];
1918 tss->bx = c->regs[VCPU_REGS_RBX];
1919 tss->sp = c->regs[VCPU_REGS_RSP];
1920 tss->bp = c->regs[VCPU_REGS_RBP];
1921 tss->si = c->regs[VCPU_REGS_RSI];
1922 tss->di = c->regs[VCPU_REGS_RDI];
1923
1924 tss->es = ops->get_segment_selector(VCPU_SREG_ES, ctxt->vcpu);
1925 tss->cs = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
1926 tss->ss = ops->get_segment_selector(VCPU_SREG_SS, ctxt->vcpu);
1927 tss->ds = ops->get_segment_selector(VCPU_SREG_DS, ctxt->vcpu);
1928 tss->ldt = ops->get_segment_selector(VCPU_SREG_LDTR, ctxt->vcpu);
1929 }
1930
1931 static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
1932 struct x86_emulate_ops *ops,
1933 struct tss_segment_16 *tss)
1934 {
1935 struct decode_cache *c = &ctxt->decode;
1936 int ret;
1937
1938 c->eip = tss->ip;
1939 ctxt->eflags = tss->flag | 2;
1940 c->regs[VCPU_REGS_RAX] = tss->ax;
1941 c->regs[VCPU_REGS_RCX] = tss->cx;
1942 c->regs[VCPU_REGS_RDX] = tss->dx;
1943 c->regs[VCPU_REGS_RBX] = tss->bx;
1944 c->regs[VCPU_REGS_RSP] = tss->sp;
1945 c->regs[VCPU_REGS_RBP] = tss->bp;
1946 c->regs[VCPU_REGS_RSI] = tss->si;
1947 c->regs[VCPU_REGS_RDI] = tss->di;
1948
1949 /*
1950 * SDM says that segment selectors are loaded before segment
1951 * descriptors
1952 */
1953 ops->set_segment_selector(tss->ldt, VCPU_SREG_LDTR, ctxt->vcpu);
1954 ops->set_segment_selector(tss->es, VCPU_SREG_ES, ctxt->vcpu);
1955 ops->set_segment_selector(tss->cs, VCPU_SREG_CS, ctxt->vcpu);
1956 ops->set_segment_selector(tss->ss, VCPU_SREG_SS, ctxt->vcpu);
1957 ops->set_segment_selector(tss->ds, VCPU_SREG_DS, ctxt->vcpu);
1958
1959 /*
1960 * Now load segment descriptors. If fault happenes at this stage
1961 * it is handled in a context of new task
1962 */
1963 ret = load_segment_descriptor(ctxt, ops, tss->ldt, VCPU_SREG_LDTR);
1964 if (ret != X86EMUL_CONTINUE)
1965 return ret;
1966 ret = load_segment_descriptor(ctxt, ops, tss->es, VCPU_SREG_ES);
1967 if (ret != X86EMUL_CONTINUE)
1968 return ret;
1969 ret = load_segment_descriptor(ctxt, ops, tss->cs, VCPU_SREG_CS);
1970 if (ret != X86EMUL_CONTINUE)
1971 return ret;
1972 ret = load_segment_descriptor(ctxt, ops, tss->ss, VCPU_SREG_SS);
1973 if (ret != X86EMUL_CONTINUE)
1974 return ret;
1975 ret = load_segment_descriptor(ctxt, ops, tss->ds, VCPU_SREG_DS);
1976 if (ret != X86EMUL_CONTINUE)
1977 return ret;
1978
1979 return X86EMUL_CONTINUE;
1980 }
1981
1982 static int task_switch_16(struct x86_emulate_ctxt *ctxt,
1983 struct x86_emulate_ops *ops,
1984 u16 tss_selector, u16 old_tss_sel,
1985 ulong old_tss_base, struct desc_struct *new_desc)
1986 {
1987 struct tss_segment_16 tss_seg;
1988 int ret;
1989 u32 new_tss_base = get_desc_base(new_desc);
1990
1991 ret = ops->read_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
1992 &ctxt->exception);
1993 if (ret != X86EMUL_CONTINUE)
1994 /* FIXME: need to provide precise fault address */
1995 return ret;
1996
1997 save_state_to_tss16(ctxt, ops, &tss_seg);
1998
1999 ret = ops->write_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2000 &ctxt->exception);
2001 if (ret != X86EMUL_CONTINUE)
2002 /* FIXME: need to provide precise fault address */
2003 return ret;
2004
2005 ret = ops->read_std(new_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2006 &ctxt->exception);
2007 if (ret != X86EMUL_CONTINUE)
2008 /* FIXME: need to provide precise fault address */
2009 return ret;
2010
2011 if (old_tss_sel != 0xffff) {
2012 tss_seg.prev_task_link = old_tss_sel;
2013
2014 ret = ops->write_std(new_tss_base,
2015 &tss_seg.prev_task_link,
2016 sizeof tss_seg.prev_task_link,
2017 ctxt->vcpu, &ctxt->exception);
2018 if (ret != X86EMUL_CONTINUE)
2019 /* FIXME: need to provide precise fault address */
2020 return ret;
2021 }
2022
2023 return load_state_from_tss16(ctxt, ops, &tss_seg);
2024 }
2025
2026 static void save_state_to_tss32(struct x86_emulate_ctxt *ctxt,
2027 struct x86_emulate_ops *ops,
2028 struct tss_segment_32 *tss)
2029 {
2030 struct decode_cache *c = &ctxt->decode;
2031
2032 tss->cr3 = ops->get_cr(3, ctxt->vcpu);
2033 tss->eip = c->eip;
2034 tss->eflags = ctxt->eflags;
2035 tss->eax = c->regs[VCPU_REGS_RAX];
2036 tss->ecx = c->regs[VCPU_REGS_RCX];
2037 tss->edx = c->regs[VCPU_REGS_RDX];
2038 tss->ebx = c->regs[VCPU_REGS_RBX];
2039 tss->esp = c->regs[VCPU_REGS_RSP];
2040 tss->ebp = c->regs[VCPU_REGS_RBP];
2041 tss->esi = c->regs[VCPU_REGS_RSI];
2042 tss->edi = c->regs[VCPU_REGS_RDI];
2043
2044 tss->es = ops->get_segment_selector(VCPU_SREG_ES, ctxt->vcpu);
2045 tss->cs = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
2046 tss->ss = ops->get_segment_selector(VCPU_SREG_SS, ctxt->vcpu);
2047 tss->ds = ops->get_segment_selector(VCPU_SREG_DS, ctxt->vcpu);
2048 tss->fs = ops->get_segment_selector(VCPU_SREG_FS, ctxt->vcpu);
2049 tss->gs = ops->get_segment_selector(VCPU_SREG_GS, ctxt->vcpu);
2050 tss->ldt_selector = ops->get_segment_selector(VCPU_SREG_LDTR, ctxt->vcpu);
2051 }
2052
2053 static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
2054 struct x86_emulate_ops *ops,
2055 struct tss_segment_32 *tss)
2056 {
2057 struct decode_cache *c = &ctxt->decode;
2058 int ret;
2059
2060 if (ops->set_cr(3, tss->cr3, ctxt->vcpu))
2061 return emulate_gp(ctxt, 0);
2062 c->eip = tss->eip;
2063 ctxt->eflags = tss->eflags | 2;
2064 c->regs[VCPU_REGS_RAX] = tss->eax;
2065 c->regs[VCPU_REGS_RCX] = tss->ecx;
2066 c->regs[VCPU_REGS_RDX] = tss->edx;
2067 c->regs[VCPU_REGS_RBX] = tss->ebx;
2068 c->regs[VCPU_REGS_RSP] = tss->esp;
2069 c->regs[VCPU_REGS_RBP] = tss->ebp;
2070 c->regs[VCPU_REGS_RSI] = tss->esi;
2071 c->regs[VCPU_REGS_RDI] = tss->edi;
2072
2073 /*
2074 * SDM says that segment selectors are loaded before segment
2075 * descriptors
2076 */
2077 ops->set_segment_selector(tss->ldt_selector, VCPU_SREG_LDTR, ctxt->vcpu);
2078 ops->set_segment_selector(tss->es, VCPU_SREG_ES, ctxt->vcpu);
2079 ops->set_segment_selector(tss->cs, VCPU_SREG_CS, ctxt->vcpu);
2080 ops->set_segment_selector(tss->ss, VCPU_SREG_SS, ctxt->vcpu);
2081 ops->set_segment_selector(tss->ds, VCPU_SREG_DS, ctxt->vcpu);
2082 ops->set_segment_selector(tss->fs, VCPU_SREG_FS, ctxt->vcpu);
2083 ops->set_segment_selector(tss->gs, VCPU_SREG_GS, ctxt->vcpu);
2084
2085 /*
2086 * Now load segment descriptors. If fault happenes at this stage
2087 * it is handled in a context of new task
2088 */
2089 ret = load_segment_descriptor(ctxt, ops, tss->ldt_selector, VCPU_SREG_LDTR);
2090 if (ret != X86EMUL_CONTINUE)
2091 return ret;
2092 ret = load_segment_descriptor(ctxt, ops, tss->es, VCPU_SREG_ES);
2093 if (ret != X86EMUL_CONTINUE)
2094 return ret;
2095 ret = load_segment_descriptor(ctxt, ops, tss->cs, VCPU_SREG_CS);
2096 if (ret != X86EMUL_CONTINUE)
2097 return ret;
2098 ret = load_segment_descriptor(ctxt, ops, tss->ss, VCPU_SREG_SS);
2099 if (ret != X86EMUL_CONTINUE)
2100 return ret;
2101 ret = load_segment_descriptor(ctxt, ops, tss->ds, VCPU_SREG_DS);
2102 if (ret != X86EMUL_CONTINUE)
2103 return ret;
2104 ret = load_segment_descriptor(ctxt, ops, tss->fs, VCPU_SREG_FS);
2105 if (ret != X86EMUL_CONTINUE)
2106 return ret;
2107 ret = load_segment_descriptor(ctxt, ops, tss->gs, VCPU_SREG_GS);
2108 if (ret != X86EMUL_CONTINUE)
2109 return ret;
2110
2111 return X86EMUL_CONTINUE;
2112 }
2113
2114 static int task_switch_32(struct x86_emulate_ctxt *ctxt,
2115 struct x86_emulate_ops *ops,
2116 u16 tss_selector, u16 old_tss_sel,
2117 ulong old_tss_base, struct desc_struct *new_desc)
2118 {
2119 struct tss_segment_32 tss_seg;
2120 int ret;
2121 u32 new_tss_base = get_desc_base(new_desc);
2122
2123 ret = ops->read_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2124 &ctxt->exception);
2125 if (ret != X86EMUL_CONTINUE)
2126 /* FIXME: need to provide precise fault address */
2127 return ret;
2128
2129 save_state_to_tss32(ctxt, ops, &tss_seg);
2130
2131 ret = ops->write_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2132 &ctxt->exception);
2133 if (ret != X86EMUL_CONTINUE)
2134 /* FIXME: need to provide precise fault address */
2135 return ret;
2136
2137 ret = ops->read_std(new_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2138 &ctxt->exception);
2139 if (ret != X86EMUL_CONTINUE)
2140 /* FIXME: need to provide precise fault address */
2141 return ret;
2142
2143 if (old_tss_sel != 0xffff) {
2144 tss_seg.prev_task_link = old_tss_sel;
2145
2146 ret = ops->write_std(new_tss_base,
2147 &tss_seg.prev_task_link,
2148 sizeof tss_seg.prev_task_link,
2149 ctxt->vcpu, &ctxt->exception);
2150 if (ret != X86EMUL_CONTINUE)
2151 /* FIXME: need to provide precise fault address */
2152 return ret;
2153 }
2154
2155 return load_state_from_tss32(ctxt, ops, &tss_seg);
2156 }
2157
2158 static int emulator_do_task_switch(struct x86_emulate_ctxt *ctxt,
2159 struct x86_emulate_ops *ops,
2160 u16 tss_selector, int reason,
2161 bool has_error_code, u32 error_code)
2162 {
2163 struct desc_struct curr_tss_desc, next_tss_desc;
2164 int ret;
2165 u16 old_tss_sel = ops->get_segment_selector(VCPU_SREG_TR, ctxt->vcpu);
2166 ulong old_tss_base =
2167 ops->get_cached_segment_base(VCPU_SREG_TR, ctxt->vcpu);
2168 u32 desc_limit;
2169
2170 /* FIXME: old_tss_base == ~0 ? */
2171
2172 ret = read_segment_descriptor(ctxt, ops, tss_selector, &next_tss_desc);
2173 if (ret != X86EMUL_CONTINUE)
2174 return ret;
2175 ret = read_segment_descriptor(ctxt, ops, old_tss_sel, &curr_tss_desc);
2176 if (ret != X86EMUL_CONTINUE)
2177 return ret;
2178
2179 /* FIXME: check that next_tss_desc is tss */
2180
2181 if (reason != TASK_SWITCH_IRET) {
2182 if ((tss_selector & 3) > next_tss_desc.dpl ||
2183 ops->cpl(ctxt->vcpu) > next_tss_desc.dpl)
2184 return emulate_gp(ctxt, 0);
2185 }
2186
2187 desc_limit = desc_limit_scaled(&next_tss_desc);
2188 if (!next_tss_desc.p ||
2189 ((desc_limit < 0x67 && (next_tss_desc.type & 8)) ||
2190 desc_limit < 0x2b)) {
2191 emulate_ts(ctxt, tss_selector & 0xfffc);
2192 return X86EMUL_PROPAGATE_FAULT;
2193 }
2194
2195 if (reason == TASK_SWITCH_IRET || reason == TASK_SWITCH_JMP) {
2196 curr_tss_desc.type &= ~(1 << 1); /* clear busy flag */
2197 write_segment_descriptor(ctxt, ops, old_tss_sel,
2198 &curr_tss_desc);
2199 }
2200
2201 if (reason == TASK_SWITCH_IRET)
2202 ctxt->eflags = ctxt->eflags & ~X86_EFLAGS_NT;
2203
2204 /* set back link to prev task only if NT bit is set in eflags
2205 note that old_tss_sel is not used afetr this point */
2206 if (reason != TASK_SWITCH_CALL && reason != TASK_SWITCH_GATE)
2207 old_tss_sel = 0xffff;
2208
2209 if (next_tss_desc.type & 8)
2210 ret = task_switch_32(ctxt, ops, tss_selector, old_tss_sel,
2211 old_tss_base, &next_tss_desc);
2212 else
2213 ret = task_switch_16(ctxt, ops, tss_selector, old_tss_sel,
2214 old_tss_base, &next_tss_desc);
2215 if (ret != X86EMUL_CONTINUE)
2216 return ret;
2217
2218 if (reason == TASK_SWITCH_CALL || reason == TASK_SWITCH_GATE)
2219 ctxt->eflags = ctxt->eflags | X86_EFLAGS_NT;
2220
2221 if (reason != TASK_SWITCH_IRET) {
2222 next_tss_desc.type |= (1 << 1); /* set busy flag */
2223 write_segment_descriptor(ctxt, ops, tss_selector,
2224 &next_tss_desc);
2225 }
2226
2227 ops->set_cr(0, ops->get_cr(0, ctxt->vcpu) | X86_CR0_TS, ctxt->vcpu);
2228 ops->set_cached_descriptor(&next_tss_desc, 0, VCPU_SREG_TR, ctxt->vcpu);
2229 ops->set_segment_selector(tss_selector, VCPU_SREG_TR, ctxt->vcpu);
2230
2231 if (has_error_code) {
2232 struct decode_cache *c = &ctxt->decode;
2233
2234 c->op_bytes = c->ad_bytes = (next_tss_desc.type & 8) ? 4 : 2;
2235 c->lock_prefix = 0;
2236 c->src.val = (unsigned long) error_code;
2237 emulate_push(ctxt, ops);
2238 }
2239
2240 return ret;
2241 }
2242
2243 int emulator_task_switch(struct x86_emulate_ctxt *ctxt,
2244 u16 tss_selector, int reason,
2245 bool has_error_code, u32 error_code)
2246 {
2247 struct x86_emulate_ops *ops = ctxt->ops;
2248 struct decode_cache *c = &ctxt->decode;
2249 int rc;
2250
2251 c->eip = ctxt->eip;
2252 c->dst.type = OP_NONE;
2253
2254 rc = emulator_do_task_switch(ctxt, ops, tss_selector, reason,
2255 has_error_code, error_code);
2256
2257 if (rc == X86EMUL_CONTINUE) {
2258 rc = writeback(ctxt, ops);
2259 if (rc == X86EMUL_CONTINUE)
2260 ctxt->eip = c->eip;
2261 }
2262
2263 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
2264 }
2265
2266 static void string_addr_inc(struct x86_emulate_ctxt *ctxt, unsigned seg,
2267 int reg, struct operand *op)
2268 {
2269 struct decode_cache *c = &ctxt->decode;
2270 int df = (ctxt->eflags & EFLG_DF) ? -1 : 1;
2271
2272 register_address_increment(c, &c->regs[reg], df * op->bytes);
2273 op->addr.mem.ea = register_address(c, c->regs[reg]);
2274 op->addr.mem.seg = seg;
2275 }
2276
2277 static int em_push(struct x86_emulate_ctxt *ctxt)
2278 {
2279 emulate_push(ctxt, ctxt->ops);
2280 return X86EMUL_CONTINUE;
2281 }
2282
2283 static int em_das(struct x86_emulate_ctxt *ctxt)
2284 {
2285 struct decode_cache *c = &ctxt->decode;
2286 u8 al, old_al;
2287 bool af, cf, old_cf;
2288
2289 cf = ctxt->eflags & X86_EFLAGS_CF;
2290 al = c->dst.val;
2291
2292 old_al = al;
2293 old_cf = cf;
2294 cf = false;
2295 af = ctxt->eflags & X86_EFLAGS_AF;
2296 if ((al & 0x0f) > 9 || af) {
2297 al -= 6;
2298 cf = old_cf | (al >= 250);
2299 af = true;
2300 } else {
2301 af = false;
2302 }
2303 if (old_al > 0x99 || old_cf) {
2304 al -= 0x60;
2305 cf = true;
2306 }
2307
2308 c->dst.val = al;
2309 /* Set PF, ZF, SF */
2310 c->src.type = OP_IMM;
2311 c->src.val = 0;
2312 c->src.bytes = 1;
2313 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
2314 ctxt->eflags &= ~(X86_EFLAGS_AF | X86_EFLAGS_CF);
2315 if (cf)
2316 ctxt->eflags |= X86_EFLAGS_CF;
2317 if (af)
2318 ctxt->eflags |= X86_EFLAGS_AF;
2319 return X86EMUL_CONTINUE;
2320 }
2321
2322 static int em_call_far(struct x86_emulate_ctxt *ctxt)
2323 {
2324 struct decode_cache *c = &ctxt->decode;
2325 u16 sel, old_cs;
2326 ulong old_eip;
2327 int rc;
2328
2329 old_cs = ctxt->ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
2330 old_eip = c->eip;
2331
2332 memcpy(&sel, c->src.valptr + c->op_bytes, 2);
2333 if (load_segment_descriptor(ctxt, ctxt->ops, sel, VCPU_SREG_CS))
2334 return X86EMUL_CONTINUE;
2335
2336 c->eip = 0;
2337 memcpy(&c->eip, c->src.valptr, c->op_bytes);
2338
2339 c->src.val = old_cs;
2340 emulate_push(ctxt, ctxt->ops);
2341 rc = writeback(ctxt, ctxt->ops);
2342 if (rc != X86EMUL_CONTINUE)
2343 return rc;
2344
2345 c->src.val = old_eip;
2346 emulate_push(ctxt, ctxt->ops);
2347 rc = writeback(ctxt, ctxt->ops);
2348 if (rc != X86EMUL_CONTINUE)
2349 return rc;
2350
2351 c->dst.type = OP_NONE;
2352
2353 return X86EMUL_CONTINUE;
2354 }
2355
2356 static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt)
2357 {
2358 struct decode_cache *c = &ctxt->decode;
2359 int rc;
2360
2361 c->dst.type = OP_REG;
2362 c->dst.addr.reg = &c->eip;
2363 c->dst.bytes = c->op_bytes;
2364 rc = emulate_pop(ctxt, ctxt->ops, &c->dst.val, c->op_bytes);
2365 if (rc != X86EMUL_CONTINUE)
2366 return rc;
2367 register_address_increment(c, &c->regs[VCPU_REGS_RSP], c->src.val);
2368 return X86EMUL_CONTINUE;
2369 }
2370
2371 static int em_imul(struct x86_emulate_ctxt *ctxt)
2372 {
2373 struct decode_cache *c = &ctxt->decode;
2374
2375 emulate_2op_SrcV_nobyte("imul", c->src, c->dst, ctxt->eflags);
2376 return X86EMUL_CONTINUE;
2377 }
2378
2379 static int em_imul_3op(struct x86_emulate_ctxt *ctxt)
2380 {
2381 struct decode_cache *c = &ctxt->decode;
2382
2383 c->dst.val = c->src2.val;
2384 return em_imul(ctxt);
2385 }
2386
2387 static int em_cwd(struct x86_emulate_ctxt *ctxt)
2388 {
2389 struct decode_cache *c = &ctxt->decode;
2390
2391 c->dst.type = OP_REG;
2392 c->dst.bytes = c->src.bytes;
2393 c->dst.addr.reg = &c->regs[VCPU_REGS_RDX];
2394 c->dst.val = ~((c->src.val >> (c->src.bytes * 8 - 1)) - 1);
2395
2396 return X86EMUL_CONTINUE;
2397 }
2398
2399 static int em_rdtsc(struct x86_emulate_ctxt *ctxt)
2400 {
2401 unsigned cpl = ctxt->ops->cpl(ctxt->vcpu);
2402 struct decode_cache *c = &ctxt->decode;
2403 u64 tsc = 0;
2404
2405 if (cpl > 0 && (ctxt->ops->get_cr(4, ctxt->vcpu) & X86_CR4_TSD))
2406 return emulate_gp(ctxt, 0);
2407 ctxt->ops->get_msr(ctxt->vcpu, MSR_IA32_TSC, &tsc);
2408 c->regs[VCPU_REGS_RAX] = (u32)tsc;
2409 c->regs[VCPU_REGS_RDX] = tsc >> 32;
2410 return X86EMUL_CONTINUE;
2411 }
2412
2413 static int em_mov(struct x86_emulate_ctxt *ctxt)
2414 {
2415 struct decode_cache *c = &ctxt->decode;
2416 c->dst.val = c->src.val;
2417 return X86EMUL_CONTINUE;
2418 }
2419
2420 static int em_movdqu(struct x86_emulate_ctxt *ctxt)
2421 {
2422 struct decode_cache *c = &ctxt->decode;
2423 memcpy(&c->dst.vec_val, &c->src.vec_val, c->op_bytes);
2424 return X86EMUL_CONTINUE;
2425 }
2426
2427 #define D(_y) { .flags = (_y) }
2428 #define DI(_y, _i) { .flags = (_y), .intercept = x86_intercept_##_i }
2429 #define DIP(_y, _i, _p) { .flags = (_y), .intercept = x86_intercept_##_i, \
2430 .check_perm = (_p) }
2431 #define N D(0)
2432 #define G(_f, _g) { .flags = ((_f) | Group), .u.group = (_g) }
2433 #define GD(_f, _g) { .flags = ((_f) | Group | GroupDual), .u.gdual = (_g) }
2434 #define I(_f, _e) { .flags = (_f), .u.execute = (_e) }
2435 #define II(_f, _e, _i) \
2436 { .flags = (_f), .u.execute = (_e), .intercept = x86_intercept_##_i }
2437 #define IIP(_f, _e, _i, _p) \
2438 { .flags = (_f), .u.execute = (_e), .intercept = x86_intercept_##_i, \
2439 .check_perm = (_p) }
2440 #define GP(_f, _g) { .flags = ((_f) | Prefix), .u.gprefix = (_g) }
2441
2442 #define D2bv(_f) D((_f) | ByteOp), D(_f)
2443 #define I2bv(_f, _e) I((_f) | ByteOp, _e), I(_f, _e)
2444
2445 #define D6ALU(_f) D2bv((_f) | DstMem | SrcReg | ModRM), \
2446 D2bv(((_f) | DstReg | SrcMem | ModRM) & ~Lock), \
2447 D2bv(((_f) & ~Lock) | DstAcc | SrcImm)
2448
2449
2450 static struct opcode group1[] = {
2451 X7(D(Lock)), N
2452 };
2453
2454 static struct opcode group1A[] = {
2455 D(DstMem | SrcNone | ModRM | Mov | Stack), N, N, N, N, N, N, N,
2456 };
2457
2458 static struct opcode group3[] = {
2459 D(DstMem | SrcImm | ModRM), D(DstMem | SrcImm | ModRM),
2460 D(DstMem | SrcNone | ModRM | Lock), D(DstMem | SrcNone | ModRM | Lock),
2461 X4(D(SrcMem | ModRM)),
2462 };
2463
2464 static struct opcode group4[] = {
2465 D(ByteOp | DstMem | SrcNone | ModRM | Lock), D(ByteOp | DstMem | SrcNone | ModRM | Lock),
2466 N, N, N, N, N, N,
2467 };
2468
2469 static struct opcode group5[] = {
2470 D(DstMem | SrcNone | ModRM | Lock), D(DstMem | SrcNone | ModRM | Lock),
2471 D(SrcMem | ModRM | Stack),
2472 I(SrcMemFAddr | ModRM | ImplicitOps | Stack, em_call_far),
2473 D(SrcMem | ModRM | Stack), D(SrcMemFAddr | ModRM | ImplicitOps),
2474 D(SrcMem | ModRM | Stack), N,
2475 };
2476
2477 static struct group_dual group7 = { {
2478 N, N, DI(ModRM | SrcMem | Priv, lgdt), DI(ModRM | SrcMem | Priv, lidt),
2479 DI(SrcNone | ModRM | DstMem | Mov, smsw), N,
2480 DI(SrcMem16 | ModRM | Mov | Priv, lmsw),
2481 DI(SrcMem | ModRM | ByteOp | Priv | NoAccess, invlpg),
2482 }, {
2483 D(SrcNone | ModRM | Priv | VendorSpecific), N,
2484 N, D(SrcNone | ModRM | Priv | VendorSpecific),
2485 DI(SrcNone | ModRM | DstMem | Mov, smsw), N,
2486 DI(SrcMem16 | ModRM | Mov | Priv, lmsw), N,
2487 } };
2488
2489 static struct opcode group8[] = {
2490 N, N, N, N,
2491 D(DstMem | SrcImmByte | ModRM), D(DstMem | SrcImmByte | ModRM | Lock),
2492 D(DstMem | SrcImmByte | ModRM | Lock), D(DstMem | SrcImmByte | ModRM | Lock),
2493 };
2494
2495 static struct group_dual group9 = { {
2496 N, D(DstMem64 | ModRM | Lock), N, N, N, N, N, N,
2497 }, {
2498 N, N, N, N, N, N, N, N,
2499 } };
2500
2501 static struct opcode group11[] = {
2502 I(DstMem | SrcImm | ModRM | Mov, em_mov), X7(D(Undefined)),
2503 };
2504
2505 static struct gprefix pfx_0f_6f_0f_7f = {
2506 N, N, N, I(Sse, em_movdqu),
2507 };
2508
2509 static struct opcode opcode_table[256] = {
2510 /* 0x00 - 0x07 */
2511 D6ALU(Lock),
2512 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
2513 /* 0x08 - 0x0F */
2514 D6ALU(Lock),
2515 D(ImplicitOps | Stack | No64), N,
2516 /* 0x10 - 0x17 */
2517 D6ALU(Lock),
2518 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
2519 /* 0x18 - 0x1F */
2520 D6ALU(Lock),
2521 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
2522 /* 0x20 - 0x27 */
2523 D6ALU(Lock), N, N,
2524 /* 0x28 - 0x2F */
2525 D6ALU(Lock), N, I(ByteOp | DstAcc | No64, em_das),
2526 /* 0x30 - 0x37 */
2527 D6ALU(Lock), N, N,
2528 /* 0x38 - 0x3F */
2529 D6ALU(0), N, N,
2530 /* 0x40 - 0x4F */
2531 X16(D(DstReg)),
2532 /* 0x50 - 0x57 */
2533 X8(I(SrcReg | Stack, em_push)),
2534 /* 0x58 - 0x5F */
2535 X8(D(DstReg | Stack)),
2536 /* 0x60 - 0x67 */
2537 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
2538 N, D(DstReg | SrcMem32 | ModRM | Mov) /* movsxd (x86/64) */ ,
2539 N, N, N, N,
2540 /* 0x68 - 0x6F */
2541 I(SrcImm | Mov | Stack, em_push),
2542 I(DstReg | SrcMem | ModRM | Src2Imm, em_imul_3op),
2543 I(SrcImmByte | Mov | Stack, em_push),
2544 I(DstReg | SrcMem | ModRM | Src2ImmByte, em_imul_3op),
2545 D2bv(DstDI | Mov | String), /* insb, insw/insd */
2546 D2bv(SrcSI | ImplicitOps | String), /* outsb, outsw/outsd */
2547 /* 0x70 - 0x7F */
2548 X16(D(SrcImmByte)),
2549 /* 0x80 - 0x87 */
2550 G(ByteOp | DstMem | SrcImm | ModRM | Group, group1),
2551 G(DstMem | SrcImm | ModRM | Group, group1),
2552 G(ByteOp | DstMem | SrcImm | ModRM | No64 | Group, group1),
2553 G(DstMem | SrcImmByte | ModRM | Group, group1),
2554 D2bv(DstMem | SrcReg | ModRM), D2bv(DstMem | SrcReg | ModRM | Lock),
2555 /* 0x88 - 0x8F */
2556 I2bv(DstMem | SrcReg | ModRM | Mov, em_mov),
2557 I2bv(DstReg | SrcMem | ModRM | Mov, em_mov),
2558 D(DstMem | SrcNone | ModRM | Mov), D(ModRM | SrcMem | NoAccess | DstReg),
2559 D(ImplicitOps | SrcMem16 | ModRM), G(0, group1A),
2560 /* 0x90 - 0x97 */
2561 X8(D(SrcAcc | DstReg)),
2562 /* 0x98 - 0x9F */
2563 D(DstAcc | SrcNone), I(ImplicitOps | SrcAcc, em_cwd),
2564 I(SrcImmFAddr | No64, em_call_far), N,
2565 DI(ImplicitOps | Stack, pushf), DI(ImplicitOps | Stack, popf), N, N,
2566 /* 0xA0 - 0xA7 */
2567 I2bv(DstAcc | SrcMem | Mov | MemAbs, em_mov),
2568 I2bv(DstMem | SrcAcc | Mov | MemAbs, em_mov),
2569 I2bv(SrcSI | DstDI | Mov | String, em_mov),
2570 D2bv(SrcSI | DstDI | String),
2571 /* 0xA8 - 0xAF */
2572 D2bv(DstAcc | SrcImm),
2573 I2bv(SrcAcc | DstDI | Mov | String, em_mov),
2574 I2bv(SrcSI | DstAcc | Mov | String, em_mov),
2575 D2bv(SrcAcc | DstDI | String),
2576 /* 0xB0 - 0xB7 */
2577 X8(I(ByteOp | DstReg | SrcImm | Mov, em_mov)),
2578 /* 0xB8 - 0xBF */
2579 X8(I(DstReg | SrcImm | Mov, em_mov)),
2580 /* 0xC0 - 0xC7 */
2581 D2bv(DstMem | SrcImmByte | ModRM),
2582 I(ImplicitOps | Stack | SrcImmU16, em_ret_near_imm),
2583 D(ImplicitOps | Stack),
2584 D(DstReg | SrcMemFAddr | ModRM | No64), D(DstReg | SrcMemFAddr | ModRM | No64),
2585 G(ByteOp, group11), G(0, group11),
2586 /* 0xC8 - 0xCF */
2587 N, N, N, D(ImplicitOps | Stack),
2588 D(ImplicitOps), DI(SrcImmByte, intn),
2589 D(ImplicitOps | No64), DI(ImplicitOps, iret),
2590 /* 0xD0 - 0xD7 */
2591 D2bv(DstMem | SrcOne | ModRM), D2bv(DstMem | ModRM),
2592 N, N, N, N,
2593 /* 0xD8 - 0xDF */
2594 N, N, N, N, N, N, N, N,
2595 /* 0xE0 - 0xE7 */
2596 X4(D(SrcImmByte)),
2597 D2bv(SrcImmUByte | DstAcc), D2bv(SrcAcc | DstImmUByte),
2598 /* 0xE8 - 0xEF */
2599 D(SrcImm | Stack), D(SrcImm | ImplicitOps),
2600 D(SrcImmFAddr | No64), D(SrcImmByte | ImplicitOps),
2601 D2bv(SrcNone | DstAcc), D2bv(SrcAcc | ImplicitOps),
2602 /* 0xF0 - 0xF7 */
2603 N, N, N, N,
2604 DI(ImplicitOps | Priv, hlt), D(ImplicitOps),
2605 G(ByteOp, group3), G(0, group3),
2606 /* 0xF8 - 0xFF */
2607 D(ImplicitOps), D(ImplicitOps), D(ImplicitOps), D(ImplicitOps),
2608 D(ImplicitOps), D(ImplicitOps), G(0, group4), G(0, group5),
2609 };
2610
2611 static struct opcode twobyte_table[256] = {
2612 /* 0x00 - 0x0F */
2613 N, GD(0, &group7), N, N,
2614 N, D(ImplicitOps | VendorSpecific), D(ImplicitOps | Priv), N,
2615 DI(ImplicitOps | Priv, invd), DI(ImplicitOps | Priv, wbinvd), N, N,
2616 N, D(ImplicitOps | ModRM), N, N,
2617 /* 0x10 - 0x1F */
2618 N, N, N, N, N, N, N, N, D(ImplicitOps | ModRM), N, N, N, N, N, N, N,
2619 /* 0x20 - 0x2F */
2620 D(ModRM | DstMem | Priv | Op3264), D(ModRM | DstMem | Priv | Op3264),
2621 D(ModRM | SrcMem | Priv | Op3264), D(ModRM | SrcMem | Priv | Op3264),
2622 N, N, N, N,
2623 N, N, N, N, N, N, N, N,
2624 /* 0x30 - 0x3F */
2625 D(ImplicitOps | Priv), II(ImplicitOps, em_rdtsc, rdtsc),
2626 D(ImplicitOps | Priv), N,
2627 D(ImplicitOps | VendorSpecific), D(ImplicitOps | Priv | VendorSpecific),
2628 N, N,
2629 N, N, N, N, N, N, N, N,
2630 /* 0x40 - 0x4F */
2631 X16(D(DstReg | SrcMem | ModRM | Mov)),
2632 /* 0x50 - 0x5F */
2633 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
2634 /* 0x60 - 0x6F */
2635 N, N, N, N,
2636 N, N, N, N,
2637 N, N, N, N,
2638 N, N, N, GP(SrcMem | DstReg | ModRM | Mov, &pfx_0f_6f_0f_7f),
2639 /* 0x70 - 0x7F */
2640 N, N, N, N,
2641 N, N, N, N,
2642 N, N, N, N,
2643 N, N, N, GP(SrcReg | DstMem | ModRM | Mov, &pfx_0f_6f_0f_7f),
2644 /* 0x80 - 0x8F */
2645 X16(D(SrcImm)),
2646 /* 0x90 - 0x9F */
2647 X16(D(ByteOp | DstMem | SrcNone | ModRM| Mov)),
2648 /* 0xA0 - 0xA7 */
2649 D(ImplicitOps | Stack), D(ImplicitOps | Stack),
2650 N, D(DstMem | SrcReg | ModRM | BitOp),
2651 D(DstMem | SrcReg | Src2ImmByte | ModRM),
2652 D(DstMem | SrcReg | Src2CL | ModRM), N, N,
2653 /* 0xA8 - 0xAF */
2654 D(ImplicitOps | Stack), D(ImplicitOps | Stack),
2655 N, D(DstMem | SrcReg | ModRM | BitOp | Lock),
2656 D(DstMem | SrcReg | Src2ImmByte | ModRM),
2657 D(DstMem | SrcReg | Src2CL | ModRM),
2658 D(ModRM), I(DstReg | SrcMem | ModRM, em_imul),
2659 /* 0xB0 - 0xB7 */
2660 D2bv(DstMem | SrcReg | ModRM | Lock),
2661 D(DstReg | SrcMemFAddr | ModRM), D(DstMem | SrcReg | ModRM | BitOp | Lock),
2662 D(DstReg | SrcMemFAddr | ModRM), D(DstReg | SrcMemFAddr | ModRM),
2663 D(ByteOp | DstReg | SrcMem | ModRM | Mov), D(DstReg | SrcMem16 | ModRM | Mov),
2664 /* 0xB8 - 0xBF */
2665 N, N,
2666 G(BitOp, group8), D(DstMem | SrcReg | ModRM | BitOp | Lock),
2667 D(DstReg | SrcMem | ModRM), D(DstReg | SrcMem | ModRM),
2668 D(ByteOp | DstReg | SrcMem | ModRM | Mov), D(DstReg | SrcMem16 | ModRM | Mov),
2669 /* 0xC0 - 0xCF */
2670 D2bv(DstMem | SrcReg | ModRM | Lock),
2671 N, D(DstMem | SrcReg | ModRM | Mov),
2672 N, N, N, GD(0, &group9),
2673 N, N, N, N, N, N, N, N,
2674 /* 0xD0 - 0xDF */
2675 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
2676 /* 0xE0 - 0xEF */
2677 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
2678 /* 0xF0 - 0xFF */
2679 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N
2680 };
2681
2682 #undef D
2683 #undef N
2684 #undef G
2685 #undef GD
2686 #undef I
2687 #undef GP
2688
2689 #undef D2bv
2690 #undef I2bv
2691 #undef D6ALU
2692
2693 static unsigned imm_size(struct decode_cache *c)
2694 {
2695 unsigned size;
2696
2697 size = (c->d & ByteOp) ? 1 : c->op_bytes;
2698 if (size == 8)
2699 size = 4;
2700 return size;
2701 }
2702
2703 static int decode_imm(struct x86_emulate_ctxt *ctxt, struct operand *op,
2704 unsigned size, bool sign_extension)
2705 {
2706 struct decode_cache *c = &ctxt->decode;
2707 struct x86_emulate_ops *ops = ctxt->ops;
2708 int rc = X86EMUL_CONTINUE;
2709
2710 op->type = OP_IMM;
2711 op->bytes = size;
2712 op->addr.mem.ea = c->eip;
2713 /* NB. Immediates are sign-extended as necessary. */
2714 switch (op->bytes) {
2715 case 1:
2716 op->val = insn_fetch(s8, 1, c->eip);
2717 break;
2718 case 2:
2719 op->val = insn_fetch(s16, 2, c->eip);
2720 break;
2721 case 4:
2722 op->val = insn_fetch(s32, 4, c->eip);
2723 break;
2724 }
2725 if (!sign_extension) {
2726 switch (op->bytes) {
2727 case 1:
2728 op->val &= 0xff;
2729 break;
2730 case 2:
2731 op->val &= 0xffff;
2732 break;
2733 case 4:
2734 op->val &= 0xffffffff;
2735 break;
2736 }
2737 }
2738 done:
2739 return rc;
2740 }
2741
2742 int
2743 x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
2744 {
2745 struct x86_emulate_ops *ops = ctxt->ops;
2746 struct decode_cache *c = &ctxt->decode;
2747 int rc = X86EMUL_CONTINUE;
2748 int mode = ctxt->mode;
2749 int def_op_bytes, def_ad_bytes, dual, goffset, simd_prefix;
2750 bool op_prefix = false;
2751 struct opcode opcode, *g_mod012, *g_mod3;
2752 struct operand memop = { .type = OP_NONE };
2753
2754 c->eip = ctxt->eip;
2755 c->fetch.start = c->eip;
2756 c->fetch.end = c->fetch.start + insn_len;
2757 if (insn_len > 0)
2758 memcpy(c->fetch.data, insn, insn_len);
2759 ctxt->cs_base = seg_base(ctxt, ops, VCPU_SREG_CS);
2760
2761 switch (mode) {
2762 case X86EMUL_MODE_REAL:
2763 case X86EMUL_MODE_VM86:
2764 case X86EMUL_MODE_PROT16:
2765 def_op_bytes = def_ad_bytes = 2;
2766 break;
2767 case X86EMUL_MODE_PROT32:
2768 def_op_bytes = def_ad_bytes = 4;
2769 break;
2770 #ifdef CONFIG_X86_64
2771 case X86EMUL_MODE_PROT64:
2772 def_op_bytes = 4;
2773 def_ad_bytes = 8;
2774 break;
2775 #endif
2776 default:
2777 return -1;
2778 }
2779
2780 c->op_bytes = def_op_bytes;
2781 c->ad_bytes = def_ad_bytes;
2782
2783 /* Legacy prefixes. */
2784 for (;;) {
2785 switch (c->b = insn_fetch(u8, 1, c->eip)) {
2786 case 0x66: /* operand-size override */
2787 op_prefix = true;
2788 /* switch between 2/4 bytes */
2789 c->op_bytes = def_op_bytes ^ 6;
2790 break;
2791 case 0x67: /* address-size override */
2792 if (mode == X86EMUL_MODE_PROT64)
2793 /* switch between 4/8 bytes */
2794 c->ad_bytes = def_ad_bytes ^ 12;
2795 else
2796 /* switch between 2/4 bytes */
2797 c->ad_bytes = def_ad_bytes ^ 6;
2798 break;
2799 case 0x26: /* ES override */
2800 case 0x2e: /* CS override */
2801 case 0x36: /* SS override */
2802 case 0x3e: /* DS override */
2803 set_seg_override(c, (c->b >> 3) & 3);
2804 break;
2805 case 0x64: /* FS override */
2806 case 0x65: /* GS override */
2807 set_seg_override(c, c->b & 7);
2808 break;
2809 case 0x40 ... 0x4f: /* REX */
2810 if (mode != X86EMUL_MODE_PROT64)
2811 goto done_prefixes;
2812 c->rex_prefix = c->b;
2813 continue;
2814 case 0xf0: /* LOCK */
2815 c->lock_prefix = 1;
2816 break;
2817 case 0xf2: /* REPNE/REPNZ */
2818 case 0xf3: /* REP/REPE/REPZ */
2819 c->rep_prefix = c->b;
2820 break;
2821 default:
2822 goto done_prefixes;
2823 }
2824
2825 /* Any legacy prefix after a REX prefix nullifies its effect. */
2826
2827 c->rex_prefix = 0;
2828 }
2829
2830 done_prefixes:
2831
2832 /* REX prefix. */
2833 if (c->rex_prefix & 8)
2834 c->op_bytes = 8; /* REX.W */
2835
2836 /* Opcode byte(s). */
2837 opcode = opcode_table[c->b];
2838 /* Two-byte opcode? */
2839 if (c->b == 0x0f) {
2840 c->twobyte = 1;
2841 c->b = insn_fetch(u8, 1, c->eip);
2842 opcode = twobyte_table[c->b];
2843 }
2844 c->d = opcode.flags;
2845
2846 if (c->d & Group) {
2847 dual = c->d & GroupDual;
2848 c->modrm = insn_fetch(u8, 1, c->eip);
2849 --c->eip;
2850
2851 if (c->d & GroupDual) {
2852 g_mod012 = opcode.u.gdual->mod012;
2853 g_mod3 = opcode.u.gdual->mod3;
2854 } else
2855 g_mod012 = g_mod3 = opcode.u.group;
2856
2857 c->d &= ~(Group | GroupDual);
2858
2859 goffset = (c->modrm >> 3) & 7;
2860
2861 if ((c->modrm >> 6) == 3)
2862 opcode = g_mod3[goffset];
2863 else
2864 opcode = g_mod012[goffset];
2865 c->d |= opcode.flags;
2866 }
2867
2868 if (c->d & Prefix) {
2869 if (c->rep_prefix && op_prefix)
2870 return X86EMUL_UNHANDLEABLE;
2871 simd_prefix = op_prefix ? 0x66 : c->rep_prefix;
2872 switch (simd_prefix) {
2873 case 0x00: opcode = opcode.u.gprefix->pfx_no; break;
2874 case 0x66: opcode = opcode.u.gprefix->pfx_66; break;
2875 case 0xf2: opcode = opcode.u.gprefix->pfx_f2; break;
2876 case 0xf3: opcode = opcode.u.gprefix->pfx_f3; break;
2877 }
2878 c->d |= opcode.flags;
2879 }
2880
2881 c->execute = opcode.u.execute;
2882 c->check_perm = opcode.check_perm;
2883 c->intercept = opcode.intercept;
2884
2885 /* Unrecognised? */
2886 if (c->d == 0 || (c->d & Undefined))
2887 return -1;
2888
2889 if (!(c->d & VendorSpecific) && ctxt->only_vendor_specific_insn)
2890 return -1;
2891
2892 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
2893 c->op_bytes = 8;
2894
2895 if (c->d & Op3264) {
2896 if (mode == X86EMUL_MODE_PROT64)
2897 c->op_bytes = 8;
2898 else
2899 c->op_bytes = 4;
2900 }
2901
2902 if (c->d & Sse)
2903 c->op_bytes = 16;
2904
2905 /* ModRM and SIB bytes. */
2906 if (c->d & ModRM) {
2907 rc = decode_modrm(ctxt, ops, &memop);
2908 if (!c->has_seg_override)
2909 set_seg_override(c, c->modrm_seg);
2910 } else if (c->d & MemAbs)
2911 rc = decode_abs(ctxt, ops, &memop);
2912 if (rc != X86EMUL_CONTINUE)
2913 goto done;
2914
2915 if (!c->has_seg_override)
2916 set_seg_override(c, VCPU_SREG_DS);
2917
2918 memop.addr.mem.seg = seg_override(ctxt, ops, c);
2919
2920 if (memop.type == OP_MEM && c->ad_bytes != 8)
2921 memop.addr.mem.ea = (u32)memop.addr.mem.ea;
2922
2923 if (memop.type == OP_MEM && c->rip_relative)
2924 memop.addr.mem.ea += c->eip;
2925
2926 /*
2927 * Decode and fetch the source operand: register, memory
2928 * or immediate.
2929 */
2930 switch (c->d & SrcMask) {
2931 case SrcNone:
2932 break;
2933 case SrcReg:
2934 decode_register_operand(ctxt, &c->src, c, 0);
2935 break;
2936 case SrcMem16:
2937 memop.bytes = 2;
2938 goto srcmem_common;
2939 case SrcMem32:
2940 memop.bytes = 4;
2941 goto srcmem_common;
2942 case SrcMem:
2943 memop.bytes = (c->d & ByteOp) ? 1 :
2944 c->op_bytes;
2945 srcmem_common:
2946 c->src = memop;
2947 break;
2948 case SrcImmU16:
2949 rc = decode_imm(ctxt, &c->src, 2, false);
2950 break;
2951 case SrcImm:
2952 rc = decode_imm(ctxt, &c->src, imm_size(c), true);
2953 break;
2954 case SrcImmU:
2955 rc = decode_imm(ctxt, &c->src, imm_size(c), false);
2956 break;
2957 case SrcImmByte:
2958 rc = decode_imm(ctxt, &c->src, 1, true);
2959 break;
2960 case SrcImmUByte:
2961 rc = decode_imm(ctxt, &c->src, 1, false);
2962 break;
2963 case SrcAcc:
2964 c->src.type = OP_REG;
2965 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
2966 c->src.addr.reg = &c->regs[VCPU_REGS_RAX];
2967 fetch_register_operand(&c->src);
2968 break;
2969 case SrcOne:
2970 c->src.bytes = 1;
2971 c->src.val = 1;
2972 break;
2973 case SrcSI:
2974 c->src.type = OP_MEM;
2975 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
2976 c->src.addr.mem.ea =
2977 register_address(c, c->regs[VCPU_REGS_RSI]);
2978 c->src.addr.mem.seg = seg_override(ctxt, ops, c),
2979 c->src.val = 0;
2980 break;
2981 case SrcImmFAddr:
2982 c->src.type = OP_IMM;
2983 c->src.addr.mem.ea = c->eip;
2984 c->src.bytes = c->op_bytes + 2;
2985 insn_fetch_arr(c->src.valptr, c->src.bytes, c->eip);
2986 break;
2987 case SrcMemFAddr:
2988 memop.bytes = c->op_bytes + 2;
2989 goto srcmem_common;
2990 break;
2991 }
2992
2993 if (rc != X86EMUL_CONTINUE)
2994 goto done;
2995
2996 /*
2997 * Decode and fetch the second source operand: register, memory
2998 * or immediate.
2999 */
3000 switch (c->d & Src2Mask) {
3001 case Src2None:
3002 break;
3003 case Src2CL:
3004 c->src2.bytes = 1;
3005 c->src2.val = c->regs[VCPU_REGS_RCX] & 0x8;
3006 break;
3007 case Src2ImmByte:
3008 rc = decode_imm(ctxt, &c->src2, 1, true);
3009 break;
3010 case Src2One:
3011 c->src2.bytes = 1;
3012 c->src2.val = 1;
3013 break;
3014 case Src2Imm:
3015 rc = decode_imm(ctxt, &c->src2, imm_size(c), true);
3016 break;
3017 }
3018
3019 if (rc != X86EMUL_CONTINUE)
3020 goto done;
3021
3022 /* Decode and fetch the destination operand: register or memory. */
3023 switch (c->d & DstMask) {
3024 case DstReg:
3025 decode_register_operand(ctxt, &c->dst, c,
3026 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
3027 break;
3028 case DstImmUByte:
3029 c->dst.type = OP_IMM;
3030 c->dst.addr.mem.ea = c->eip;
3031 c->dst.bytes = 1;
3032 c->dst.val = insn_fetch(u8, 1, c->eip);
3033 break;
3034 case DstMem:
3035 case DstMem64:
3036 c->dst = memop;
3037 if ((c->d & DstMask) == DstMem64)
3038 c->dst.bytes = 8;
3039 else
3040 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
3041 if (c->d & BitOp)
3042 fetch_bit_operand(c);
3043 c->dst.orig_val = c->dst.val;
3044 break;
3045 case DstAcc:
3046 c->dst.type = OP_REG;
3047 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
3048 c->dst.addr.reg = &c->regs[VCPU_REGS_RAX];
3049 fetch_register_operand(&c->dst);
3050 c->dst.orig_val = c->dst.val;
3051 break;
3052 case DstDI:
3053 c->dst.type = OP_MEM;
3054 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
3055 c->dst.addr.mem.ea =
3056 register_address(c, c->regs[VCPU_REGS_RDI]);
3057 c->dst.addr.mem.seg = VCPU_SREG_ES;
3058 c->dst.val = 0;
3059 break;
3060 case ImplicitOps:
3061 /* Special instructions do their own operand decoding. */
3062 default:
3063 c->dst.type = OP_NONE; /* Disable writeback. */
3064 return 0;
3065 }
3066
3067 done:
3068 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
3069 }
3070
3071 static bool string_insn_completed(struct x86_emulate_ctxt *ctxt)
3072 {
3073 struct decode_cache *c = &ctxt->decode;
3074
3075 /* The second termination condition only applies for REPE
3076 * and REPNE. Test if the repeat string operation prefix is
3077 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
3078 * corresponding termination condition according to:
3079 * - if REPE/REPZ and ZF = 0 then done
3080 * - if REPNE/REPNZ and ZF = 1 then done
3081 */
3082 if (((c->b == 0xa6) || (c->b == 0xa7) ||
3083 (c->b == 0xae) || (c->b == 0xaf))
3084 && (((c->rep_prefix == REPE_PREFIX) &&
3085 ((ctxt->eflags & EFLG_ZF) == 0))
3086 || ((c->rep_prefix == REPNE_PREFIX) &&
3087 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF))))
3088 return true;
3089
3090 return false;
3091 }
3092
3093 int
3094 x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
3095 {
3096 struct x86_emulate_ops *ops = ctxt->ops;
3097 u64 msr_data;
3098 struct decode_cache *c = &ctxt->decode;
3099 int rc = X86EMUL_CONTINUE;
3100 int saved_dst_type = c->dst.type;
3101 int irq; /* Used for int 3, int, and into */
3102
3103 ctxt->decode.mem_read.pos = 0;
3104
3105 if (ctxt->mode == X86EMUL_MODE_PROT64 && (c->d & No64)) {
3106 rc = emulate_ud(ctxt);
3107 goto done;
3108 }
3109
3110 /* LOCK prefix is allowed only with some instructions */
3111 if (c->lock_prefix && (!(c->d & Lock) || c->dst.type != OP_MEM)) {
3112 rc = emulate_ud(ctxt);
3113 goto done;
3114 }
3115
3116 if ((c->d & SrcMask) == SrcMemFAddr && c->src.type != OP_MEM) {
3117 rc = emulate_ud(ctxt);
3118 goto done;
3119 }
3120
3121 if ((c->d & Sse)
3122 && ((ops->get_cr(0, ctxt->vcpu) & X86_CR0_EM)
3123 || !(ops->get_cr(4, ctxt->vcpu) & X86_CR4_OSFXSR))) {
3124 rc = emulate_ud(ctxt);
3125 goto done;
3126 }
3127
3128 if ((c->d & Sse) && (ops->get_cr(0, ctxt->vcpu) & X86_CR0_TS)) {
3129 rc = emulate_nm(ctxt);
3130 goto done;
3131 }
3132
3133 if (unlikely(ctxt->guest_mode) && c->intercept) {
3134 rc = ops->intercept(ctxt, c->intercept,
3135 X86_ICPT_PRE_EXCEPT);
3136 if (rc != X86EMUL_CONTINUE)
3137 goto done;
3138 }
3139
3140 /* Privileged instruction can be executed only in CPL=0 */
3141 if ((c->d & Priv) && ops->cpl(ctxt->vcpu)) {
3142 rc = emulate_gp(ctxt, 0);
3143 goto done;
3144 }
3145
3146 /* Do instruction specific permission checks */
3147 if (c->check_perm) {
3148 rc = c->check_perm(ctxt);
3149 if (rc != X86EMUL_CONTINUE)
3150 goto done;
3151 }
3152
3153 if (unlikely(ctxt->guest_mode) && c->intercept) {
3154 rc = ops->intercept(ctxt, c->intercept,
3155 X86_ICPT_POST_EXCEPT);
3156 if (rc != X86EMUL_CONTINUE)
3157 goto done;
3158 }
3159
3160 if (c->rep_prefix && (c->d & String)) {
3161 /* All REP prefixes have the same first termination condition */
3162 if (address_mask(c, c->regs[VCPU_REGS_RCX]) == 0) {
3163 ctxt->eip = c->eip;
3164 goto done;
3165 }
3166 }
3167
3168 if ((c->src.type == OP_MEM) && !(c->d & NoAccess)) {
3169 rc = read_emulated(ctxt, ops, linear(ctxt, c->src.addr.mem),
3170 c->src.valptr, c->src.bytes);
3171 if (rc != X86EMUL_CONTINUE)
3172 goto done;
3173 c->src.orig_val64 = c->src.val64;
3174 }
3175
3176 if (c->src2.type == OP_MEM) {
3177 rc = read_emulated(ctxt, ops, linear(ctxt, c->src2.addr.mem),
3178 &c->src2.val, c->src2.bytes);
3179 if (rc != X86EMUL_CONTINUE)
3180 goto done;
3181 }
3182
3183 if ((c->d & DstMask) == ImplicitOps)
3184 goto special_insn;
3185
3186
3187 if ((c->dst.type == OP_MEM) && !(c->d & Mov)) {
3188 /* optimisation - avoid slow emulated read if Mov */
3189 rc = read_emulated(ctxt, ops, linear(ctxt, c->dst.addr.mem),
3190 &c->dst.val, c->dst.bytes);
3191 if (rc != X86EMUL_CONTINUE)
3192 goto done;
3193 }
3194 c->dst.orig_val = c->dst.val;
3195
3196 special_insn:
3197
3198 if (unlikely(ctxt->guest_mode) && c->intercept) {
3199 rc = ops->intercept(ctxt, c->intercept,
3200 X86_ICPT_POST_MEMACCESS);
3201 if (rc != X86EMUL_CONTINUE)
3202 goto done;
3203 }
3204
3205 if (c->execute) {
3206 rc = c->execute(ctxt);
3207 if (rc != X86EMUL_CONTINUE)
3208 goto done;
3209 goto writeback;
3210 }
3211
3212 if (c->twobyte)
3213 goto twobyte_insn;
3214
3215 switch (c->b) {
3216 case 0x00 ... 0x05:
3217 add: /* add */
3218 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
3219 break;
3220 case 0x06: /* push es */
3221 emulate_push_sreg(ctxt, ops, VCPU_SREG_ES);
3222 break;
3223 case 0x07: /* pop es */
3224 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_ES);
3225 break;
3226 case 0x08 ... 0x0d:
3227 or: /* or */
3228 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
3229 break;
3230 case 0x0e: /* push cs */
3231 emulate_push_sreg(ctxt, ops, VCPU_SREG_CS);
3232 break;
3233 case 0x10 ... 0x15:
3234 adc: /* adc */
3235 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
3236 break;
3237 case 0x16: /* push ss */
3238 emulate_push_sreg(ctxt, ops, VCPU_SREG_SS);
3239 break;
3240 case 0x17: /* pop ss */
3241 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_SS);
3242 break;
3243 case 0x18 ... 0x1d:
3244 sbb: /* sbb */
3245 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
3246 break;
3247 case 0x1e: /* push ds */
3248 emulate_push_sreg(ctxt, ops, VCPU_SREG_DS);
3249 break;
3250 case 0x1f: /* pop ds */
3251 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_DS);
3252 break;
3253 case 0x20 ... 0x25:
3254 and: /* and */
3255 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
3256 break;
3257 case 0x28 ... 0x2d:
3258 sub: /* sub */
3259 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
3260 break;
3261 case 0x30 ... 0x35:
3262 xor: /* xor */
3263 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
3264 break;
3265 case 0x38 ... 0x3d:
3266 cmp: /* cmp */
3267 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
3268 break;
3269 case 0x40 ... 0x47: /* inc r16/r32 */
3270 emulate_1op("inc", c->dst, ctxt->eflags);
3271 break;
3272 case 0x48 ... 0x4f: /* dec r16/r32 */
3273 emulate_1op("dec", c->dst, ctxt->eflags);
3274 break;
3275 case 0x58 ... 0x5f: /* pop reg */
3276 pop_instruction:
3277 rc = emulate_pop(ctxt, ops, &c->dst.val, c->op_bytes);
3278 break;
3279 case 0x60: /* pusha */
3280 rc = emulate_pusha(ctxt, ops);
3281 break;
3282 case 0x61: /* popa */
3283 rc = emulate_popa(ctxt, ops);
3284 break;
3285 case 0x63: /* movsxd */
3286 if (ctxt->mode != X86EMUL_MODE_PROT64)
3287 goto cannot_emulate;
3288 c->dst.val = (s32) c->src.val;
3289 break;
3290 case 0x6c: /* insb */
3291 case 0x6d: /* insw/insd */
3292 c->src.val = c->regs[VCPU_REGS_RDX];
3293 goto do_io_in;
3294 case 0x6e: /* outsb */
3295 case 0x6f: /* outsw/outsd */
3296 c->dst.val = c->regs[VCPU_REGS_RDX];
3297 goto do_io_out;
3298 break;
3299 case 0x70 ... 0x7f: /* jcc (short) */
3300 if (test_cc(c->b, ctxt->eflags))
3301 jmp_rel(c, c->src.val);
3302 break;
3303 case 0x80 ... 0x83: /* Grp1 */
3304 switch (c->modrm_reg) {
3305 case 0:
3306 goto add;
3307 case 1:
3308 goto or;
3309 case 2:
3310 goto adc;
3311 case 3:
3312 goto sbb;
3313 case 4:
3314 goto and;
3315 case 5:
3316 goto sub;
3317 case 6:
3318 goto xor;
3319 case 7:
3320 goto cmp;
3321 }
3322 break;
3323 case 0x84 ... 0x85:
3324 test:
3325 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
3326 break;
3327 case 0x86 ... 0x87: /* xchg */
3328 xchg:
3329 /* Write back the register source. */
3330 c->src.val = c->dst.val;
3331 write_register_operand(&c->src);
3332 /*
3333 * Write back the memory destination with implicit LOCK
3334 * prefix.
3335 */
3336 c->dst.val = c->src.orig_val;
3337 c->lock_prefix = 1;
3338 break;
3339 case 0x8c: /* mov r/m, sreg */
3340 if (c->modrm_reg > VCPU_SREG_GS) {
3341 rc = emulate_ud(ctxt);
3342 goto done;
3343 }
3344 c->dst.val = ops->get_segment_selector(c->modrm_reg, ctxt->vcpu);
3345 break;
3346 case 0x8d: /* lea r16/r32, m */
3347 c->dst.val = c->src.addr.mem.ea;
3348 break;
3349 case 0x8e: { /* mov seg, r/m16 */
3350 uint16_t sel;
3351
3352 sel = c->src.val;
3353
3354 if (c->modrm_reg == VCPU_SREG_CS ||
3355 c->modrm_reg > VCPU_SREG_GS) {
3356 rc = emulate_ud(ctxt);
3357 goto done;
3358 }
3359
3360 if (c->modrm_reg == VCPU_SREG_SS)
3361 ctxt->interruptibility = KVM_X86_SHADOW_INT_MOV_SS;
3362
3363 rc = load_segment_descriptor(ctxt, ops, sel, c->modrm_reg);
3364
3365 c->dst.type = OP_NONE; /* Disable writeback. */
3366 break;
3367 }
3368 case 0x8f: /* pop (sole member of Grp1a) */
3369 rc = emulate_grp1a(ctxt, ops);
3370 break;
3371 case 0x90 ... 0x97: /* nop / xchg reg, rax */
3372 if (c->dst.addr.reg == &c->regs[VCPU_REGS_RAX])
3373 break;
3374 goto xchg;
3375 case 0x98: /* cbw/cwde/cdqe */
3376 switch (c->op_bytes) {
3377 case 2: c->dst.val = (s8)c->dst.val; break;
3378 case 4: c->dst.val = (s16)c->dst.val; break;
3379 case 8: c->dst.val = (s32)c->dst.val; break;
3380 }
3381 break;
3382 case 0x9c: /* pushf */
3383 c->src.val = (unsigned long) ctxt->eflags;
3384 emulate_push(ctxt, ops);
3385 break;
3386 case 0x9d: /* popf */
3387 c->dst.type = OP_REG;
3388 c->dst.addr.reg = &ctxt->eflags;
3389 c->dst.bytes = c->op_bytes;
3390 rc = emulate_popf(ctxt, ops, &c->dst.val, c->op_bytes);
3391 break;
3392 case 0xa6 ... 0xa7: /* cmps */
3393 c->dst.type = OP_NONE; /* Disable writeback. */
3394 goto cmp;
3395 case 0xa8 ... 0xa9: /* test ax, imm */
3396 goto test;
3397 case 0xae ... 0xaf: /* scas */
3398 goto cmp;
3399 case 0xc0 ... 0xc1:
3400 emulate_grp2(ctxt);
3401 break;
3402 case 0xc3: /* ret */
3403 c->dst.type = OP_REG;
3404 c->dst.addr.reg = &c->eip;
3405 c->dst.bytes = c->op_bytes;
3406 goto pop_instruction;
3407 case 0xc4: /* les */
3408 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_ES);
3409 break;
3410 case 0xc5: /* lds */
3411 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_DS);
3412 break;
3413 case 0xcb: /* ret far */
3414 rc = emulate_ret_far(ctxt, ops);
3415 break;
3416 case 0xcc: /* int3 */
3417 irq = 3;
3418 goto do_interrupt;
3419 case 0xcd: /* int n */
3420 irq = c->src.val;
3421 do_interrupt:
3422 rc = emulate_int(ctxt, ops, irq);
3423 break;
3424 case 0xce: /* into */
3425 if (ctxt->eflags & EFLG_OF) {
3426 irq = 4;
3427 goto do_interrupt;
3428 }
3429 break;
3430 case 0xcf: /* iret */
3431 rc = emulate_iret(ctxt, ops);
3432 break;
3433 case 0xd0 ... 0xd1: /* Grp2 */
3434 emulate_grp2(ctxt);
3435 break;
3436 case 0xd2 ... 0xd3: /* Grp2 */
3437 c->src.val = c->regs[VCPU_REGS_RCX];
3438 emulate_grp2(ctxt);
3439 break;
3440 case 0xe0 ... 0xe2: /* loop/loopz/loopnz */
3441 register_address_increment(c, &c->regs[VCPU_REGS_RCX], -1);
3442 if (address_mask(c, c->regs[VCPU_REGS_RCX]) != 0 &&
3443 (c->b == 0xe2 || test_cc(c->b ^ 0x5, ctxt->eflags)))
3444 jmp_rel(c, c->src.val);
3445 break;
3446 case 0xe3: /* jcxz/jecxz/jrcxz */
3447 if (address_mask(c, c->regs[VCPU_REGS_RCX]) == 0)
3448 jmp_rel(c, c->src.val);
3449 break;
3450 case 0xe4: /* inb */
3451 case 0xe5: /* in */
3452 goto do_io_in;
3453 case 0xe6: /* outb */
3454 case 0xe7: /* out */
3455 goto do_io_out;
3456 case 0xe8: /* call (near) */ {
3457 long int rel = c->src.val;
3458 c->src.val = (unsigned long) c->eip;
3459 jmp_rel(c, rel);
3460 emulate_push(ctxt, ops);
3461 break;
3462 }
3463 case 0xe9: /* jmp rel */
3464 goto jmp;
3465 case 0xea: { /* jmp far */
3466 unsigned short sel;
3467 jump_far:
3468 memcpy(&sel, c->src.valptr + c->op_bytes, 2);
3469
3470 if (load_segment_descriptor(ctxt, ops, sel, VCPU_SREG_CS))
3471 goto done;
3472
3473 c->eip = 0;
3474 memcpy(&c->eip, c->src.valptr, c->op_bytes);
3475 break;
3476 }
3477 case 0xeb:
3478 jmp: /* jmp rel short */
3479 jmp_rel(c, c->src.val);
3480 c->dst.type = OP_NONE; /* Disable writeback. */
3481 break;
3482 case 0xec: /* in al,dx */
3483 case 0xed: /* in (e/r)ax,dx */
3484 c->src.val = c->regs[VCPU_REGS_RDX];
3485 do_io_in:
3486 c->dst.bytes = min(c->dst.bytes, 4u);
3487 if (!emulator_io_permited(ctxt, ops, c->src.val, c->dst.bytes)) {
3488 rc = emulate_gp(ctxt, 0);
3489 goto done;
3490 }
3491 if (!pio_in_emulated(ctxt, ops, c->dst.bytes, c->src.val,
3492 &c->dst.val))
3493 goto done; /* IO is needed */
3494 break;
3495 case 0xee: /* out dx,al */
3496 case 0xef: /* out dx,(e/r)ax */
3497 c->dst.val = c->regs[VCPU_REGS_RDX];
3498 do_io_out:
3499 c->src.bytes = min(c->src.bytes, 4u);
3500 if (!emulator_io_permited(ctxt, ops, c->dst.val,
3501 c->src.bytes)) {
3502 rc = emulate_gp(ctxt, 0);
3503 goto done;
3504 }
3505 ops->pio_out_emulated(c->src.bytes, c->dst.val,
3506 &c->src.val, 1, ctxt->vcpu);
3507 c->dst.type = OP_NONE; /* Disable writeback. */
3508 break;
3509 case 0xf4: /* hlt */
3510 ctxt->vcpu->arch.halt_request = 1;
3511 break;
3512 case 0xf5: /* cmc */
3513 /* complement carry flag from eflags reg */
3514 ctxt->eflags ^= EFLG_CF;
3515 break;
3516 case 0xf6 ... 0xf7: /* Grp3 */
3517 rc = emulate_grp3(ctxt, ops);
3518 break;
3519 case 0xf8: /* clc */
3520 ctxt->eflags &= ~EFLG_CF;
3521 break;
3522 case 0xf9: /* stc */
3523 ctxt->eflags |= EFLG_CF;
3524 break;
3525 case 0xfa: /* cli */
3526 if (emulator_bad_iopl(ctxt, ops)) {
3527 rc = emulate_gp(ctxt, 0);
3528 goto done;
3529 } else
3530 ctxt->eflags &= ~X86_EFLAGS_IF;
3531 break;
3532 case 0xfb: /* sti */
3533 if (emulator_bad_iopl(ctxt, ops)) {
3534 rc = emulate_gp(ctxt, 0);
3535 goto done;
3536 } else {
3537 ctxt->interruptibility = KVM_X86_SHADOW_INT_STI;
3538 ctxt->eflags |= X86_EFLAGS_IF;
3539 }
3540 break;
3541 case 0xfc: /* cld */
3542 ctxt->eflags &= ~EFLG_DF;
3543 break;
3544 case 0xfd: /* std */
3545 ctxt->eflags |= EFLG_DF;
3546 break;
3547 case 0xfe: /* Grp4 */
3548 grp45:
3549 rc = emulate_grp45(ctxt, ops);
3550 break;
3551 case 0xff: /* Grp5 */
3552 if (c->modrm_reg == 5)
3553 goto jump_far;
3554 goto grp45;
3555 default:
3556 goto cannot_emulate;
3557 }
3558
3559 if (rc != X86EMUL_CONTINUE)
3560 goto done;
3561
3562 writeback:
3563 rc = writeback(ctxt, ops);
3564 if (rc != X86EMUL_CONTINUE)
3565 goto done;
3566
3567 /*
3568 * restore dst type in case the decoding will be reused
3569 * (happens for string instruction )
3570 */
3571 c->dst.type = saved_dst_type;
3572
3573 if ((c->d & SrcMask) == SrcSI)
3574 string_addr_inc(ctxt, seg_override(ctxt, ops, c),
3575 VCPU_REGS_RSI, &c->src);
3576
3577 if ((c->d & DstMask) == DstDI)
3578 string_addr_inc(ctxt, VCPU_SREG_ES, VCPU_REGS_RDI,
3579 &c->dst);
3580
3581 if (c->rep_prefix && (c->d & String)) {
3582 struct read_cache *r = &ctxt->decode.io_read;
3583 register_address_increment(c, &c->regs[VCPU_REGS_RCX], -1);
3584
3585 if (!string_insn_completed(ctxt)) {
3586 /*
3587 * Re-enter guest when pio read ahead buffer is empty
3588 * or, if it is not used, after each 1024 iteration.
3589 */
3590 if ((r->end != 0 || c->regs[VCPU_REGS_RCX] & 0x3ff) &&
3591 (r->end == 0 || r->end != r->pos)) {
3592 /*
3593 * Reset read cache. Usually happens before
3594 * decode, but since instruction is restarted
3595 * we have to do it here.
3596 */
3597 ctxt->decode.mem_read.end = 0;
3598 return EMULATION_RESTART;
3599 }
3600 goto done; /* skip rip writeback */
3601 }
3602 }
3603
3604 ctxt->eip = c->eip;
3605
3606 done:
3607 if (rc == X86EMUL_PROPAGATE_FAULT)
3608 ctxt->have_exception = true;
3609 if (rc == X86EMUL_INTERCEPTED)
3610 return EMULATION_INTERCEPTED;
3611
3612 return (rc == X86EMUL_UNHANDLEABLE) ? EMULATION_FAILED : EMULATION_OK;
3613
3614 twobyte_insn:
3615 switch (c->b) {
3616 case 0x01: /* lgdt, lidt, lmsw */
3617 switch (c->modrm_reg) {
3618 u16 size;
3619 unsigned long address;
3620
3621 case 0: /* vmcall */
3622 if (c->modrm_mod != 3 || c->modrm_rm != 1)
3623 goto cannot_emulate;
3624
3625 rc = kvm_fix_hypercall(ctxt->vcpu);
3626 if (rc != X86EMUL_CONTINUE)
3627 goto done;
3628
3629 /* Let the processor re-execute the fixed hypercall */
3630 c->eip = ctxt->eip;
3631 /* Disable writeback. */
3632 c->dst.type = OP_NONE;
3633 break;
3634 case 2: /* lgdt */
3635 rc = read_descriptor(ctxt, ops, c->src.addr.mem,
3636 &size, &address, c->op_bytes);
3637 if (rc != X86EMUL_CONTINUE)
3638 goto done;
3639 realmode_lgdt(ctxt->vcpu, size, address);
3640 /* Disable writeback. */
3641 c->dst.type = OP_NONE;
3642 break;
3643 case 3: /* lidt/vmmcall */
3644 if (c->modrm_mod == 3) {
3645 switch (c->modrm_rm) {
3646 case 1:
3647 rc = kvm_fix_hypercall(ctxt->vcpu);
3648 break;
3649 default:
3650 goto cannot_emulate;
3651 }
3652 } else {
3653 rc = read_descriptor(ctxt, ops, c->src.addr.mem,
3654 &size, &address,
3655 c->op_bytes);
3656 if (rc != X86EMUL_CONTINUE)
3657 goto done;
3658 realmode_lidt(ctxt->vcpu, size, address);
3659 }
3660 /* Disable writeback. */
3661 c->dst.type = OP_NONE;
3662 break;
3663 case 4: /* smsw */
3664 c->dst.bytes = 2;
3665 c->dst.val = ops->get_cr(0, ctxt->vcpu);
3666 break;
3667 case 6: /* lmsw */
3668 ops->set_cr(0, (ops->get_cr(0, ctxt->vcpu) & ~0x0eul) |
3669 (c->src.val & 0x0f), ctxt->vcpu);
3670 c->dst.type = OP_NONE;
3671 break;
3672 case 5: /* not defined */
3673 emulate_ud(ctxt);
3674 rc = X86EMUL_PROPAGATE_FAULT;
3675 goto done;
3676 case 7: /* invlpg*/
3677 emulate_invlpg(ctxt->vcpu,
3678 linear(ctxt, c->src.addr.mem));
3679 /* Disable writeback. */
3680 c->dst.type = OP_NONE;
3681 break;
3682 default:
3683 goto cannot_emulate;
3684 }
3685 break;
3686 case 0x05: /* syscall */
3687 rc = emulate_syscall(ctxt, ops);
3688 break;
3689 case 0x06:
3690 emulate_clts(ctxt->vcpu);
3691 break;
3692 case 0x09: /* wbinvd */
3693 kvm_emulate_wbinvd(ctxt->vcpu);
3694 break;
3695 case 0x08: /* invd */
3696 case 0x0d: /* GrpP (prefetch) */
3697 case 0x18: /* Grp16 (prefetch/nop) */
3698 break;
3699 case 0x20: /* mov cr, reg */
3700 switch (c->modrm_reg) {
3701 case 1:
3702 case 5 ... 7:
3703 case 9 ... 15:
3704 emulate_ud(ctxt);
3705 rc = X86EMUL_PROPAGATE_FAULT;
3706 goto done;
3707 }
3708 c->dst.val = ops->get_cr(c->modrm_reg, ctxt->vcpu);
3709 break;
3710 case 0x21: /* mov from dr to reg */
3711 if ((ops->get_cr(4, ctxt->vcpu) & X86_CR4_DE) &&
3712 (c->modrm_reg == 4 || c->modrm_reg == 5)) {
3713 emulate_ud(ctxt);
3714 rc = X86EMUL_PROPAGATE_FAULT;
3715 goto done;
3716 }
3717 ops->get_dr(c->modrm_reg, &c->dst.val, ctxt->vcpu);
3718 break;
3719 case 0x22: /* mov reg, cr */
3720 if (ops->set_cr(c->modrm_reg, c->src.val, ctxt->vcpu)) {
3721 emulate_gp(ctxt, 0);
3722 rc = X86EMUL_PROPAGATE_FAULT;
3723 goto done;
3724 }
3725 c->dst.type = OP_NONE;
3726 break;
3727 case 0x23: /* mov from reg to dr */
3728 if ((ops->get_cr(4, ctxt->vcpu) & X86_CR4_DE) &&
3729 (c->modrm_reg == 4 || c->modrm_reg == 5)) {
3730 emulate_ud(ctxt);
3731 rc = X86EMUL_PROPAGATE_FAULT;
3732 goto done;
3733 }
3734
3735 if (ops->set_dr(c->modrm_reg, c->src.val &
3736 ((ctxt->mode == X86EMUL_MODE_PROT64) ?
3737 ~0ULL : ~0U), ctxt->vcpu) < 0) {
3738 /* #UD condition is already handled by the code above */
3739 emulate_gp(ctxt, 0);
3740 rc = X86EMUL_PROPAGATE_FAULT;
3741 goto done;
3742 }
3743
3744 c->dst.type = OP_NONE; /* no writeback */
3745 break;
3746 case 0x30:
3747 /* wrmsr */
3748 msr_data = (u32)c->regs[VCPU_REGS_RAX]
3749 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
3750 if (ops->set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data)) {
3751 emulate_gp(ctxt, 0);
3752 rc = X86EMUL_PROPAGATE_FAULT;
3753 goto done;
3754 }
3755 rc = X86EMUL_CONTINUE;
3756 break;
3757 case 0x32:
3758 /* rdmsr */
3759 if (ops->get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data)) {
3760 emulate_gp(ctxt, 0);
3761 rc = X86EMUL_PROPAGATE_FAULT;
3762 goto done;
3763 } else {
3764 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
3765 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
3766 }
3767 rc = X86EMUL_CONTINUE;
3768 break;
3769 case 0x34: /* sysenter */
3770 rc = emulate_sysenter(ctxt, ops);
3771 break;
3772 case 0x35: /* sysexit */
3773 rc = emulate_sysexit(ctxt, ops);
3774 break;
3775 case 0x40 ... 0x4f: /* cmov */
3776 c->dst.val = c->dst.orig_val = c->src.val;
3777 if (!test_cc(c->b, ctxt->eflags))
3778 c->dst.type = OP_NONE; /* no writeback */
3779 break;
3780 case 0x80 ... 0x8f: /* jnz rel, etc*/
3781 if (test_cc(c->b, ctxt->eflags))
3782 jmp_rel(c, c->src.val);
3783 break;
3784 case 0x90 ... 0x9f: /* setcc r/m8 */
3785 c->dst.val = test_cc(c->b, ctxt->eflags);
3786 break;
3787 case 0xa0: /* push fs */
3788 emulate_push_sreg(ctxt, ops, VCPU_SREG_FS);
3789 break;
3790 case 0xa1: /* pop fs */
3791 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_FS);
3792 break;
3793 case 0xa3:
3794 bt: /* bt */
3795 c->dst.type = OP_NONE;
3796 /* only subword offset */
3797 c->src.val &= (c->dst.bytes << 3) - 1;
3798 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
3799 break;
3800 case 0xa4: /* shld imm8, r, r/m */
3801 case 0xa5: /* shld cl, r, r/m */
3802 emulate_2op_cl("shld", c->src2, c->src, c->dst, ctxt->eflags);
3803 break;
3804 case 0xa8: /* push gs */
3805 emulate_push_sreg(ctxt, ops, VCPU_SREG_GS);
3806 break;
3807 case 0xa9: /* pop gs */
3808 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_GS);
3809 break;
3810 case 0xab:
3811 bts: /* bts */
3812 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
3813 break;
3814 case 0xac: /* shrd imm8, r, r/m */
3815 case 0xad: /* shrd cl, r, r/m */
3816 emulate_2op_cl("shrd", c->src2, c->src, c->dst, ctxt->eflags);
3817 break;
3818 case 0xae: /* clflush */
3819 break;
3820 case 0xb0 ... 0xb1: /* cmpxchg */
3821 /*
3822 * Save real source value, then compare EAX against
3823 * destination.
3824 */
3825 c->src.orig_val = c->src.val;
3826 c->src.val = c->regs[VCPU_REGS_RAX];
3827 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
3828 if (ctxt->eflags & EFLG_ZF) {
3829 /* Success: write back to memory. */
3830 c->dst.val = c->src.orig_val;
3831 } else {
3832 /* Failure: write the value we saw to EAX. */
3833 c->dst.type = OP_REG;
3834 c->dst.addr.reg = (unsigned long *)&c->regs[VCPU_REGS_RAX];
3835 }
3836 break;
3837 case 0xb2: /* lss */
3838 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_SS);
3839 break;
3840 case 0xb3:
3841 btr: /* btr */
3842 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
3843 break;
3844 case 0xb4: /* lfs */
3845 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_FS);
3846 break;
3847 case 0xb5: /* lgs */
3848 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_GS);
3849 break;
3850 case 0xb6 ... 0xb7: /* movzx */
3851 c->dst.bytes = c->op_bytes;
3852 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
3853 : (u16) c->src.val;
3854 break;
3855 case 0xba: /* Grp8 */
3856 switch (c->modrm_reg & 3) {
3857 case 0:
3858 goto bt;
3859 case 1:
3860 goto bts;
3861 case 2:
3862 goto btr;
3863 case 3:
3864 goto btc;
3865 }
3866 break;
3867 case 0xbb:
3868 btc: /* btc */
3869 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
3870 break;
3871 case 0xbc: { /* bsf */
3872 u8 zf;
3873 __asm__ ("bsf %2, %0; setz %1"
3874 : "=r"(c->dst.val), "=q"(zf)
3875 : "r"(c->src.val));
3876 ctxt->eflags &= ~X86_EFLAGS_ZF;
3877 if (zf) {
3878 ctxt->eflags |= X86_EFLAGS_ZF;
3879 c->dst.type = OP_NONE; /* Disable writeback. */
3880 }
3881 break;
3882 }
3883 case 0xbd: { /* bsr */
3884 u8 zf;
3885 __asm__ ("bsr %2, %0; setz %1"
3886 : "=r"(c->dst.val), "=q"(zf)
3887 : "r"(c->src.val));
3888 ctxt->eflags &= ~X86_EFLAGS_ZF;
3889 if (zf) {
3890 ctxt->eflags |= X86_EFLAGS_ZF;
3891 c->dst.type = OP_NONE; /* Disable writeback. */
3892 }
3893 break;
3894 }
3895 case 0xbe ... 0xbf: /* movsx */
3896 c->dst.bytes = c->op_bytes;
3897 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
3898 (s16) c->src.val;
3899 break;
3900 case 0xc0 ... 0xc1: /* xadd */
3901 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
3902 /* Write back the register source. */
3903 c->src.val = c->dst.orig_val;
3904 write_register_operand(&c->src);
3905 break;
3906 case 0xc3: /* movnti */
3907 c->dst.bytes = c->op_bytes;
3908 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
3909 (u64) c->src.val;
3910 break;
3911 case 0xc7: /* Grp9 (cmpxchg8b) */
3912 rc = emulate_grp9(ctxt, ops);
3913 break;
3914 default:
3915 goto cannot_emulate;
3916 }
3917
3918 if (rc != X86EMUL_CONTINUE)
3919 goto done;
3920
3921 goto writeback;
3922
3923 cannot_emulate:
3924 return -1;
3925 }
Linux kernel - Deliverables
This page took 0.111431 seconds and 6 git commands to generate.