]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - arch/x86/kvm/emulate.c
projects / mirror_ubuntu-bionic-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
KVM: x86 emulator: Make group storage bits separate from operand bits
[mirror_ubuntu-bionic-kernel.git] / arch / x86 / kvm / emulate.c
CommitLineData
6aa8b732 1/******************************************************************************
56e82318 2 * emulate.c
6aa8b732
AK		 3 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
dcc0766b 9 * privileged instructions:
6aa8b732
AK		 10 *
11 * Copyright (C) 2006 Qumranet
221d059d 12 * Copyright 2010 Red Hat, Inc. and/or its affilates.
6aa8b732
AK		 13 *
14 * Avi Kivity <avi@qumranet.com>
15 * Yaniv Kamay <yaniv@qumranet.com>
16 *
17 * This work is licensed under the terms of the GNU GPL, version 2. See
18 * the COPYING file in the top-level directory.
19 *
20 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
21 */
22
23#ifndef __KERNEL__
24#include <stdio.h>
25#include <stdint.h>
26#include <public/xen.h>
d77c26fc 27#define DPRINTF(_f, _a ...) printf(_f , ## _a)
6aa8b732 28#else
edf88417 29#include <linux/kvm_host.h>
5fdbf976 30#include "kvm_cache_regs.h"
6aa8b732
AK		 31#define DPRINTF(x...) do {} while (0)
32#endif
6aa8b732 33#include <linux/module.h>
56e82318 34#include <asm/kvm_emulate.h>
6aa8b732 35
3eeb3288 36#include "x86.h"
38ba30ba 37#include "tss.h"
e99f0507 38
6aa8b732
AK		 39/*
40 * Opcode effective-address decode tables.
41 * Note that we only emulate instructions that have at least one memory
42 * operand (excluding implicit stack references). We assume that stack
43 * references and instruction fetches will never occur in special memory
44 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
45 * not be handled.
46 */
47
48/* Operand sizes: 8-bit operands or specified/overridden size. */
2ce49536 49#define ByteOp (1<<16) /* 8-bit operands. */
6aa8b732 50/* Destination operand type. */
2ce49536
AK		 51#define ImplicitOps (1<<17) /* Implicit in opcode. No generic decode. */
52#define DstReg (2<<17) /* Register operand. */
53#define DstMem (3<<17) /* Memory operand. */
54#define DstAcc (4<<17) /* Destination Accumulator */
55#define DstDI (5<<17) /* Destination is in ES:(E)DI */
56#define DstMem64 (6<<17) /* 64bit memory operand */
57#define DstMask (7<<17)
6aa8b732 58/* Source operand type. */
9c9fddd0
GT		 59#define SrcNone (0<<4) /* No source operand. */
60#define SrcImplicit (0<<4) /* Source operand is implicit in the opcode. */
61#define SrcReg (1<<4) /* Register operand. */
62#define SrcMem (2<<4) /* Memory operand. */
63#define SrcMem16 (3<<4) /* Memory operand (16-bit). */
64#define SrcMem32 (4<<4) /* Memory operand (32-bit). */
65#define SrcImm (5<<4) /* Immediate operand. */
66#define SrcImmByte (6<<4) /* 8-bit sign-extended immediate operand. */
bfcadf83 67#define SrcOne (7<<4) /* Implied '1' */
341de7e3 68#define SrcImmUByte (8<<4) /* 8-bit unsigned immediate operand. */
c9eaf20f 69#define SrcImmU (9<<4) /* Immediate operand, unsigned */
a682e354 70#define SrcSI (0xa<<4) /* Source is in the DS:RSI */
414e6277
GN		 71#define SrcImmFAddr (0xb<<4) /* Source is immediate far address */
72#define SrcMemFAddr (0xc<<4) /* Source is far address in memory */
5d55f299 73#define SrcAcc (0xd<<4) /* Source Accumulator */
341de7e3 74#define SrcMask (0xf<<4)
6aa8b732 75/* Generic ModRM decode. */
341de7e3 76#define ModRM (1<<8)
6aa8b732 77/* Destination is only written; never read. */
341de7e3
GN		 78#define Mov (1<<9)
79#define BitOp (1<<10)
80#define MemAbs (1<<11) /* Memory operand is absolute displacement */
9c9fddd0
GT		 81#define String (1<<12) /* String instruction (rep capable) */
82#define Stack (1<<13) /* Stack instruction (push/pop) */
e09d082c
AK		 83#define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
84#define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
2ce49536 85#define GroupMask 0x0f /* Group number stored in bits 0:3 */
d8769fed 86/* Misc flags */
d380a5e4 87#define Lock (1<<26) /* lock prefix is allowed for the instruction */
e92805ac 88#define Priv (1<<27) /* instruction generates #GP if current CPL != 0 */
d8769fed 89#define No64 (1<<28)
0dc8d10f
GT		 90/* Source 2 operand type */
91#define Src2None (0<<29)
92#define Src2CL (1<<29)
93#define Src2ImmByte (2<<29)
94#define Src2One (3<<29)
95#define Src2Mask (7<<29)
6aa8b732 96
83babbca
AK		 97#define X2(x) (x), (x)
98#define X3(x) X2(x), (x)
99#define X4(x) X2(x), X2(x)
100#define X5(x) X4(x), (x)
101#define X6(x) X4(x), X2(x)
102#define X7(x) X4(x), X3(x)
103#define X8(x) X4(x), X4(x)
104#define X16(x) X8(x), X8(x)
105
43bb19cd 106enum {
1d6ad207 107 Group1_80, Group1_81, Group1_82, Group1_83,
d95058a1 108 Group1A, Group3_Byte, Group3, Group4, Group5, Group7,
60a29d4e 109 Group8, Group9,
43bb19cd
AK		 110};
111
45ed60b3 112static u32 opcode_table[256] = {
6aa8b732 113 /* 0x00 - 0x07 */
d380a5e4 114 ByteOp | DstMem | SrcReg | ModRM | Lock, DstMem | SrcReg | ModRM | Lock,
6aa8b732 115 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
0934ac9d 116 ByteOp | DstAcc | SrcImm, DstAcc | SrcImm,
d8769fed 117 ImplicitOps | Stack | No64, ImplicitOps | Stack | No64,
6aa8b732 118 /* 0x08 - 0x0F */
d380a5e4 119 ByteOp | DstMem | SrcReg | ModRM | Lock, DstMem | SrcReg | ModRM | Lock,
6aa8b732 120 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
94677e61
MG		 121 ByteOp | DstAcc | SrcImm, DstAcc | SrcImm,
122 ImplicitOps | Stack | No64, 0,
6aa8b732 123 /* 0x10 - 0x17 */
d380a5e4 124 ByteOp | DstMem | SrcReg | ModRM | Lock, DstMem | SrcReg | ModRM | Lock,
6aa8b732 125 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
0934ac9d 126 ByteOp | DstAcc | SrcImm, DstAcc | SrcImm,
d8769fed 127 ImplicitOps | Stack | No64, ImplicitOps | Stack | No64,
6aa8b732 128 /* 0x18 - 0x1F */
d380a5e4 129 ByteOp | DstMem | SrcReg | ModRM | Lock, DstMem | SrcReg | ModRM | Lock,
6aa8b732 130 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
0934ac9d 131 ByteOp | DstAcc | SrcImm, DstAcc | SrcImm,
d8769fed 132 ImplicitOps | Stack | No64, ImplicitOps | Stack | No64,
6aa8b732 133 /* 0x20 - 0x27 */
d380a5e4 134 ByteOp | DstMem | SrcReg | ModRM | Lock, DstMem | SrcReg | ModRM | Lock,
6aa8b732 135 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
e97e883f 136 ByteOp | DstAcc | SrcImmByte, DstAcc | SrcImm, 0, 0,
6aa8b732 137 /* 0x28 - 0x2F */
d380a5e4 138 ByteOp | DstMem | SrcReg | ModRM | Lock, DstMem | SrcReg | ModRM | Lock,
6aa8b732 139 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
abc19083 140 ByteOp | DstAcc | SrcImmByte, DstAcc | SrcImm, 0, 0,
6aa8b732 141 /* 0x30 - 0x37 */
d380a5e4 142 ByteOp | DstMem | SrcReg | ModRM | Lock, DstMem | SrcReg | ModRM | Lock,
6aa8b732 143 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
222b7c52 144 ByteOp | DstAcc | SrcImmByte, DstAcc | SrcImm, 0, 0,
6aa8b732
AK		 145 /* 0x38 - 0x3F */
146 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
147 ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
8a9fee67
GT		 148 ByteOp | DstAcc | SrcImm, DstAcc | SrcImm,
149 0, 0,
749358a6
AK		 150 /* 0x40 - 0x4F */
151 X16(DstReg),
7f0aaee0 152 /* 0x50 - 0x57 */
3849186c 153 X8(SrcReg | Stack),
7f0aaee0 154 /* 0x58 - 0x5F */
3849186c 155 X8(DstReg | Stack),
7d316911 156 /* 0x60 - 0x67 */
abcf14b5
MG		 157 ImplicitOps | Stack | No64, ImplicitOps | Stack | No64,
158 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
7d316911
NK		 159 0, 0, 0, 0,
160 /* 0x68 - 0x6F */
91ed7a0e 161 SrcImm | Mov | Stack, 0, SrcImmByte | Mov | Stack, 0,
7972995b
GN		 162 DstDI | ByteOp | Mov | String, DstDI | Mov | String, /* insb, insw/insd */
163 SrcSI | ByteOp | ImplicitOps | String, SrcSI | ImplicitOps | String, /* outsb, outsw/outsd */
b3ab3405
AK		 164 /* 0x70 - 0x7F */
165 X16(SrcImmByte),
6aa8b732 166 /* 0x80 - 0x87 */
1d6ad207
AK		 167 Group | Group1_80, Group | Group1_81,
168 Group | Group1_82, Group | Group1_83,
6aa8b732 169 ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
d380a5e4 170 ByteOp | DstMem | SrcReg | ModRM | Lock, DstMem | SrcReg | ModRM | Lock,
6aa8b732
AK		 171 /* 0x88 - 0x8F */
172 ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
173 ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
b16b2b7b 174 DstMem | SrcNone | ModRM | Mov, ModRM | DstReg,
a5046e6c 175 ImplicitOps | SrcMem16 | ModRM, Group | Group1A,
b13354f8
MG		 176 /* 0x90 - 0x97 */
177 DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg, DstReg,
178 /* 0x98 - 0x9F */
414e6277 179 0, 0, SrcImmFAddr | No64, 0,
0654169e 180 ImplicitOps | Stack, ImplicitOps | Stack, 0, 0,
6aa8b732 181 /* 0xA0 - 0xA7 */
5d55f299
WY		 182 ByteOp | DstAcc | SrcMem | Mov | MemAbs, DstAcc | SrcMem | Mov | MemAbs,
183 ByteOp | DstMem | SrcAcc | Mov | MemAbs, DstMem | SrcAcc | Mov | MemAbs,
a682e354
GN		 184 ByteOp | SrcSI | DstDI | Mov | String, SrcSI | DstDI | Mov | String,
185 ByteOp | SrcSI | DstDI | String, SrcSI | DstDI | String,
6aa8b732 186 /* 0xA8 - 0xAF */
dfb507c4 187 DstAcc | SrcImmByte | ByteOp, DstAcc | SrcImm, ByteOp | DstDI | Mov | String, DstDI | Mov | String,
a682e354
GN		 188 ByteOp | SrcSI | DstAcc | Mov | String, SrcSI | DstAcc | Mov | String,
189 ByteOp | DstDI | String, DstDI | String,
a5e2e82b 190 /* 0xB0 - 0xB7 */
b6e61538 191 X8(ByteOp | DstReg | SrcImm | Mov),
a5e2e82b 192 /* 0xB8 - 0xBF */
b6e61538 193 X8(DstReg | SrcImm | Mov),
6aa8b732 194 /* 0xC0 - 0xC7 */
d9413cd7 195 ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
6e3d5dfb 196 0, ImplicitOps | Stack, 0, 0,
d9413cd7 197 ByteOp | DstMem | SrcImm | ModRM | Mov, DstMem | SrcImm | ModRM | Mov,
6aa8b732 198 /* 0xC8 - 0xCF */
e637b823 199 0, 0, 0, ImplicitOps | Stack,
d8769fed 200 ImplicitOps, SrcImmByte, ImplicitOps | No64, ImplicitOps,
6aa8b732
AK		 201 /* 0xD0 - 0xD7 */
202 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
203 ByteOp | DstMem | SrcImplicit | ModRM, DstMem | SrcImplicit | ModRM,
204 0, 0, 0, 0,
205 /* 0xD8 - 0xDF */
206 0, 0, 0, 0, 0, 0, 0, 0,
098c937b 207 /* 0xE0 - 0xE7 */
a6a3034c 208 0, 0, 0, 0,
cf8f70bf
GN		 209 ByteOp | SrcImmUByte | DstAcc, SrcImmUByte | DstAcc,
210 ByteOp | SrcImmUByte | DstAcc, SrcImmUByte | DstAcc,
098c937b 211 /* 0xE8 - 0xEF */
d53c4777 212 SrcImm | Stack, SrcImm | ImplicitOps,
414e6277 213 SrcImmFAddr | No64, SrcImmByte | ImplicitOps,
cf8f70bf
GN		 214 SrcNone | ByteOp | DstAcc, SrcNone | DstAcc,
215 SrcNone | ByteOp | DstAcc, SrcNone | DstAcc,
6aa8b732
AK		 216 /* 0xF0 - 0xF7 */
217 0, 0, 0, 0,
e92805ac 218 ImplicitOps | Priv, ImplicitOps, Group | Group3_Byte, Group | Group3,
6aa8b732 219 /* 0xF8 - 0xFF */
b284be57 220 ImplicitOps, 0, ImplicitOps, ImplicitOps,
fb4616f4 221 ImplicitOps, ImplicitOps, Group | Group4, Group | Group5,
6aa8b732
AK		 222};
223
45ed60b3 224static u32 twobyte_table[256] = {
6aa8b732 225 /* 0x00 - 0x0F */
e92805ac
GN		 226 0, Group | GroupDual | Group7, 0, 0,
227 0, ImplicitOps, ImplicitOps | Priv, 0,
228 ImplicitOps | Priv, ImplicitOps | Priv, 0, 0,
229 0, ImplicitOps | ModRM, 0, 0,
6aa8b732
AK		 230 /* 0x10 - 0x1F */
231 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
232 /* 0x20 - 0x2F */
e92805ac
GN		 233 ModRM | ImplicitOps | Priv, ModRM | Priv,
234 ModRM | ImplicitOps | Priv, ModRM | Priv,
235 0, 0, 0, 0,
6aa8b732
AK		 236 0, 0, 0, 0, 0, 0, 0, 0,
237 /* 0x30 - 0x3F */
e92805ac
GN		 238 ImplicitOps | Priv, 0, ImplicitOps | Priv, 0,
239 ImplicitOps, ImplicitOps | Priv, 0, 0,
e99f0507 240 0, 0, 0, 0, 0, 0, 0, 0,
be8eacdd
AK		 241 /* 0x40 - 0x4F */
242 X16(DstReg | SrcMem | ModRM | Mov),
6aa8b732
AK		 243 /* 0x50 - 0x5F */
244 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
245 /* 0x60 - 0x6F */
246 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
247 /* 0x70 - 0x7F */
248 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
249 /* 0x80 - 0x8F */
880a1883 250 X16(SrcImm),
6aa8b732
AK		 251 /* 0x90 - 0x9F */
252 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
253 /* 0xA0 - 0xA7 */
0934ac9d
MG		 254 ImplicitOps | Stack, ImplicitOps | Stack,
255 0, DstMem | SrcReg | ModRM | BitOp,
9bf8ea42
GT		 256 DstMem | SrcReg | Src2ImmByte | ModRM,
257 DstMem | SrcReg | Src2CL | ModRM, 0, 0,
6aa8b732 258 /* 0xA8 - 0xAF */
0934ac9d 259 ImplicitOps | Stack, ImplicitOps | Stack,
d380a5e4 260 0, DstMem | SrcReg | ModRM | BitOp | Lock,
9bf8ea42
GT		 261 DstMem | SrcReg | Src2ImmByte | ModRM,
262 DstMem | SrcReg | Src2CL | ModRM,
263 ModRM, 0,
6aa8b732 264 /* 0xB0 - 0xB7 */
d380a5e4
GN		 265 ByteOp | DstMem | SrcReg | ModRM | Lock, DstMem | SrcReg | ModRM | Lock,
266 0, DstMem | SrcReg | ModRM | BitOp | Lock,
6aa8b732
AK		 267 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
268 DstReg | SrcMem16 | ModRM | Mov,
269 /* 0xB8 - 0xBF */
d380a5e4
GN		 270 0, 0,
271 Group | Group8, DstMem | SrcReg | ModRM | BitOp | Lock,
6aa8b732
AK		 272 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
273 DstReg | SrcMem16 | ModRM | Mov,
274 /* 0xC0 - 0xCF */
60a29d4e
GN		 275 0, 0, 0, DstMem | SrcReg | ModRM | Mov,
276 0, 0, 0, Group | GroupDual | Group9,
a012e65a 277 0, 0, 0, 0, 0, 0, 0, 0,
6aa8b732
AK		 278 /* 0xD0 - 0xDF */
279 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
280 /* 0xE0 - 0xEF */
281 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
282 /* 0xF0 - 0xFF */
283 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
284};
285
45ed60b3 286static u32 group_table[] = {
1d6ad207 287 [Group1_80*8] =
d380a5e4
GN		 288 ByteOp | DstMem | SrcImm | ModRM | Lock,
289 ByteOp | DstMem | SrcImm | ModRM | Lock,
290 ByteOp | DstMem | SrcImm | ModRM | Lock,
291 ByteOp | DstMem | SrcImm | ModRM | Lock,
292 ByteOp | DstMem | SrcImm | ModRM | Lock,
293 ByteOp | DstMem | SrcImm | ModRM | Lock,
294 ByteOp | DstMem | SrcImm | ModRM | Lock,
295 ByteOp | DstMem | SrcImm | ModRM,
1d6ad207 296 [Group1_81*8] =
d380a5e4
GN		 297 DstMem | SrcImm | ModRM | Lock,
298 DstMem | SrcImm | ModRM | Lock,
299 DstMem | SrcImm | ModRM | Lock,
300 DstMem | SrcImm | ModRM | Lock,
301 DstMem | SrcImm | ModRM | Lock,
302 DstMem | SrcImm | ModRM | Lock,
303 DstMem | SrcImm | ModRM | Lock,
304 DstMem | SrcImm | ModRM,
1d6ad207 305 [Group1_82*8] =
e424e191
GN		 306 ByteOp | DstMem | SrcImm | ModRM | No64 | Lock,
307 ByteOp | DstMem | SrcImm | ModRM | No64 | Lock,
308 ByteOp | DstMem | SrcImm | ModRM | No64 | Lock,
309 ByteOp | DstMem | SrcImm | ModRM | No64 | Lock,
310 ByteOp | DstMem | SrcImm | ModRM | No64 | Lock,
311 ByteOp | DstMem | SrcImm | ModRM | No64 | Lock,
312 ByteOp | DstMem | SrcImm | ModRM | No64 | Lock,
313 ByteOp | DstMem | SrcImm | ModRM | No64,
1d6ad207 314 [Group1_83*8] =
d380a5e4
GN		 315 DstMem | SrcImmByte | ModRM | Lock,
316 DstMem | SrcImmByte | ModRM | Lock,
317 DstMem | SrcImmByte | ModRM | Lock,
318 DstMem | SrcImmByte | ModRM | Lock,
319 DstMem | SrcImmByte | ModRM | Lock,
320 DstMem | SrcImmByte | ModRM | Lock,
321 DstMem | SrcImmByte | ModRM | Lock,
322 DstMem | SrcImmByte | ModRM,
43bb19cd
AK		 323 [Group1A*8] =
324 DstMem | SrcNone | ModRM | Mov | Stack, 0, 0, 0, 0, 0, 0, 0,
7d858a19 325 [Group3_Byte*8] =
7d5993d6 326 ByteOp | SrcImm | DstMem | ModRM, ByteOp | SrcImm | DstMem | ModRM,
7d858a19
AK		 327 ByteOp | DstMem | SrcNone | ModRM, ByteOp | DstMem | SrcNone | ModRM,
328 0, 0, 0, 0,
329 [Group3*8] =
7d5993d6 330 DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
6eb06cb2 331 DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM,
7d858a19 332 0, 0, 0, 0,
fd60754e 333 [Group4*8] =
c0e0608c 334 ByteOp | DstMem | SrcNone | ModRM | Lock, ByteOp | DstMem | SrcNone | ModRM | Lock,
fd60754e
AK		 335 0, 0, 0, 0, 0, 0,
336 [Group5*8] =
c0e0608c 337 DstMem | SrcNone | ModRM | Lock, DstMem | SrcNone | ModRM | Lock,
d19292e4 338 SrcMem | ModRM | Stack, 0,
414e6277 339 SrcMem | ModRM | Stack, SrcMemFAddr | ModRM | ImplicitOps,
ea79849d 340 SrcMem | ModRM | Stack, 0,
d95058a1 341 [Group7*8] =
e92805ac 342 0, 0, ModRM | SrcMem | Priv, ModRM | SrcMem | Priv,
16286d08 343 SrcNone | ModRM | DstMem | Mov, 0,
e92805ac 344 SrcMem16 | ModRM | Mov | Priv, SrcMem | ModRM | ByteOp | Priv,
2db2c2eb
GN		 345 [Group8*8] =
346 0, 0, 0, 0,
d380a5e4
GN		 347 DstMem | SrcImmByte | ModRM, DstMem | SrcImmByte | ModRM | Lock,
348 DstMem | SrcImmByte | ModRM | Lock, DstMem | SrcImmByte | ModRM | Lock,
60a29d4e 349 [Group9*8] =
6550e1f1 350 0, DstMem64 | ModRM | Lock, 0, 0, 0, 0, 0, 0,
e09d082c
AK		 351};
352
45ed60b3 353static u32 group2_table[] = {
d95058a1 354 [Group7*8] =
835e6b80 355 SrcNone | ModRM | Priv, 0, 0, SrcNone | ModRM | Priv,
16286d08 356 SrcNone | ModRM | DstMem | Mov, 0,
835e6b80 357 SrcMem16 | ModRM | Mov | Priv, 0,
60a29d4e
GN		 358 [Group9*8] =
359 0, 0, 0, 0, 0, 0, 0, 0,
e09d082c
AK		 360};
361
6aa8b732 362/* EFLAGS bit definitions. */
d4c6a154
GN		 363#define EFLG_ID (1<<21)
364#define EFLG_VIP (1<<20)
365#define EFLG_VIF (1<<19)
366#define EFLG_AC (1<<18)
b1d86143
AP		 367#define EFLG_VM (1<<17)
368#define EFLG_RF (1<<16)
d4c6a154
GN		 369#define EFLG_IOPL (3<<12)
370#define EFLG_NT (1<<14)
6aa8b732
AK		 371#define EFLG_OF (1<<11)
372#define EFLG_DF (1<<10)
b1d86143 373#define EFLG_IF (1<<9)
d4c6a154 374#define EFLG_TF (1<<8)
6aa8b732
AK		 375#define EFLG_SF (1<<7)
376#define EFLG_ZF (1<<6)
377#define EFLG_AF (1<<4)
378#define EFLG_PF (1<<2)
379#define EFLG_CF (1<<0)
380
381/*
382 * Instruction emulation:
383 * Most instructions are emulated directly via a fragment of inline assembly
384 * code. This allows us to save/restore EFLAGS and thus very easily pick up
385 * any modified flags.
386 */
387
05b3e0c2 388#if defined(CONFIG_X86_64)
6aa8b732
AK		 389#define _LO32 "k" /* force 32-bit operand */
390#define _STK "%%rsp" /* stack pointer */
391#elif defined(__i386__)
392#define _LO32 "" /* force 32-bit operand */
393#define _STK "%%esp" /* stack pointer */
394#endif
395
396/*
397 * These EFLAGS bits are restored from saved value during emulation, and
398 * any changes are written back to the saved value after emulation.
399 */
400#define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
401
402/* Before executing instruction: restore necessary bits in EFLAGS. */
e934c9c1
AK		 403#define _PRE_EFLAGS(_sav, _msk, _tmp) \
404 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
405 "movl %"_sav",%"_LO32 _tmp"; " \
406 "push %"_tmp"; " \
407 "push %"_tmp"; " \
408 "movl %"_msk",%"_LO32 _tmp"; " \
409 "andl %"_LO32 _tmp",("_STK"); " \
410 "pushf; " \
411 "notl %"_LO32 _tmp"; " \
412 "andl %"_LO32 _tmp",("_STK"); " \
413 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
414 "pop %"_tmp"; " \
415 "orl %"_LO32 _tmp",("_STK"); " \
416 "popf; " \
417 "pop %"_sav"; "
6aa8b732
AK		 418
419/* After executing instruction: write-back necessary bits in EFLAGS. */
420#define _POST_EFLAGS(_sav, _msk, _tmp) \
421 /* _sav |= EFLAGS & _msk; */ \
422 "pushf; " \
423 "pop %"_tmp"; " \
424 "andl %"_msk",%"_LO32 _tmp"; " \
425 "orl %"_LO32 _tmp",%"_sav"; "
426
dda96d8f
AK		 427#ifdef CONFIG_X86_64
428#define ON64(x) x
429#else
430#define ON64(x)
431#endif
432
6b7ad61f
AK		 433#define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix) \
434 do { \
435 __asm__ __volatile__ ( \
436 _PRE_EFLAGS("0", "4", "2") \
437 _op _suffix " %"_x"3,%1; " \
438 _POST_EFLAGS("0", "4", "2") \
439 : "=m" (_eflags), "=m" ((_dst).val), \
440 "=&r" (_tmp) \
441 : _y ((_src).val), "i" (EFLAGS_MASK)); \
f3fd92fb 442 } while (0)
6b7ad61f
AK		 443
444
6aa8b732
AK		 445/* Raw emulation: instruction has two explicit operands. */
446#define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
6b7ad61f
AK		 447 do { \
448 unsigned long _tmp; \
449 \
450 switch ((_dst).bytes) { \
451 case 2: \
452 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
453 break; \
454 case 4: \
455 ____emulate_2op(_op,_src,_dst,_eflags,_lx,_ly,"l"); \
456 break; \
457 case 8: \
458 ON64(____emulate_2op(_op,_src,_dst,_eflags,_qx,_qy,"q")); \
459 break; \
460 } \
6aa8b732
AK		 461 } while (0)
462
463#define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
464 do { \
6b7ad61f 465 unsigned long _tmp; \
d77c26fc 466 switch ((_dst).bytes) { \
6aa8b732 467 case 1: \
6b7ad61f 468 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b"); \
6aa8b732
AK		 469 break; \
470 default: \
471 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
472 _wx, _wy, _lx, _ly, _qx, _qy); \
473 break; \
474 } \
475 } while (0)
476
477/* Source operand is byte-sized and may be restricted to just %cl. */
478#define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
479 __emulate_2op(_op, _src, _dst, _eflags, \
480 "b", "c", "b", "c", "b", "c", "b", "c")
481
482/* Source operand is byte, word, long or quad sized. */
483#define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
484 __emulate_2op(_op, _src, _dst, _eflags, \
485 "b", "q", "w", "r", _LO32, "r", "", "r")
486
487/* Source operand is word, long or quad sized. */
488#define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
489 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
490 "w", "r", _LO32, "r", "", "r")
491
d175226a
GT		 492/* Instruction has three operands and one operand is stored in ECX register */
493#define __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, _suffix, _type) \
494 do { \
495 unsigned long _tmp; \
496 _type _clv = (_cl).val; \
497 _type _srcv = (_src).val; \
498 _type _dstv = (_dst).val; \
499 \
500 __asm__ __volatile__ ( \
501 _PRE_EFLAGS("0", "5", "2") \
502 _op _suffix " %4,%1 \n" \
503 _POST_EFLAGS("0", "5", "2") \
504 : "=m" (_eflags), "+r" (_dstv), "=&r" (_tmp) \
505 : "c" (_clv) , "r" (_srcv), "i" (EFLAGS_MASK) \
506 ); \
507 \
508 (_cl).val = (unsigned long) _clv; \
509 (_src).val = (unsigned long) _srcv; \
510 (_dst).val = (unsigned long) _dstv; \
511 } while (0)
512
513#define emulate_2op_cl(_op, _cl, _src, _dst, _eflags) \
514 do { \
515 switch ((_dst).bytes) { \
516 case 2: \
517 __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
518 "w", unsigned short); \
519 break; \
520 case 4: \
521 __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
522 "l", unsigned int); \
523 break; \
524 case 8: \
525 ON64(__emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
526 "q", unsigned long)); \
527 break; \
528 } \
529 } while (0)
530
dda96d8f 531#define __emulate_1op(_op, _dst, _eflags, _suffix) \
6aa8b732
AK		 532 do { \
533 unsigned long _tmp; \
534 \
dda96d8f
AK		 535 __asm__ __volatile__ ( \
536 _PRE_EFLAGS("0", "3", "2") \
537 _op _suffix " %1; " \
538 _POST_EFLAGS("0", "3", "2") \
539 : "=m" (_eflags), "+m" ((_dst).val), \
540 "=&r" (_tmp) \
541 : "i" (EFLAGS_MASK)); \
542 } while (0)
543
544/* Instruction has only one explicit operand (no source operand). */
545#define emulate_1op(_op, _dst, _eflags) \
546 do { \
d77c26fc 547 switch ((_dst).bytes) { \
dda96d8f
AK		 548 case 1: __emulate_1op(_op, _dst, _eflags, "b"); break; \
549 case 2: __emulate_1op(_op, _dst, _eflags, "w"); break; \
550 case 4: __emulate_1op(_op, _dst, _eflags, "l"); break; \
551 case 8: ON64(__emulate_1op(_op, _dst, _eflags, "q")); break; \
6aa8b732
AK		 552 } \
553 } while (0)
554
6aa8b732
AK		 555/* Fetch next part of the instruction being emulated. */
556#define insn_fetch(_type, _size, _eip) \
557({ unsigned long _x; \
62266869 558 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
af5b4f7f 559 if (rc != X86EMUL_CONTINUE) \
6aa8b732
AK		 560 goto done; \
561 (_eip) += (_size); \
562 (_type)_x; \
563})
564
414e6277
GN		 565#define insn_fetch_arr(_arr, _size, _eip) \
566({ rc = do_insn_fetch(ctxt, ops, (_eip), _arr, (_size)); \
567 if (rc != X86EMUL_CONTINUE) \
568 goto done; \
569 (_eip) += (_size); \
570})
571
ddcb2885
HH		 572static inline unsigned long ad_mask(struct decode_cache *c)
573{
574 return (1UL << (c->ad_bytes << 3)) - 1;
575}
576
6aa8b732 577/* Access/update address held in a register, based on addressing mode. */
e4706772
HH		 578static inline unsigned long
579address_mask(struct decode_cache *c, unsigned long reg)
580{
581 if (c->ad_bytes == sizeof(unsigned long))
582 return reg;
583 else
584 return reg & ad_mask(c);
585}
586
587static inline unsigned long
588register_address(struct decode_cache *c, unsigned long base, unsigned long reg)
589{
590 return base + address_mask(c, reg);
591}
592
7a957275
HH		 593static inline void
594register_address_increment(struct decode_cache *c, unsigned long *reg, int inc)
595{
596 if (c->ad_bytes == sizeof(unsigned long))
597 *reg += inc;
598 else
599 *reg = (*reg & ~ad_mask(c)) | ((*reg + inc) & ad_mask(c));
600}
6aa8b732 601
7a957275
HH		 602static inline void jmp_rel(struct decode_cache *c, int rel)
603{
604 register_address_increment(c, &c->eip, rel);
605}
098c937b 606
7a5b56df
AK		 607static void set_seg_override(struct decode_cache *c, int seg)
608{
609 c->has_seg_override = true;
610 c->seg_override = seg;
611}
612
79168fd1
GN		 613static unsigned long seg_base(struct x86_emulate_ctxt *ctxt,
614 struct x86_emulate_ops *ops, int seg)
7a5b56df
AK		 615{
616 if (ctxt->mode == X86EMUL_MODE_PROT64 && seg < VCPU_SREG_FS)
617 return 0;
618
79168fd1 619 return ops->get_cached_segment_base(seg, ctxt->vcpu);
7a5b56df
AK		 620}
621
622static unsigned long seg_override_base(struct x86_emulate_ctxt *ctxt,
79168fd1 623 struct x86_emulate_ops *ops,
7a5b56df
AK		 624 struct decode_cache *c)
625{
626 if (!c->has_seg_override)
627 return 0;
628
79168fd1 629 return seg_base(ctxt, ops, c->seg_override);
7a5b56df
AK		 630}
631
79168fd1
GN		 632static unsigned long es_base(struct x86_emulate_ctxt *ctxt,
633 struct x86_emulate_ops *ops)
7a5b56df 634{
79168fd1 635 return seg_base(ctxt, ops, VCPU_SREG_ES);
7a5b56df
AK		 636}
637
79168fd1
GN		 638static unsigned long ss_base(struct x86_emulate_ctxt *ctxt,
639 struct x86_emulate_ops *ops)
7a5b56df 640{
79168fd1 641 return seg_base(ctxt, ops, VCPU_SREG_SS);
7a5b56df
AK		 642}
643
54b8486f
GN		 644static void emulate_exception(struct x86_emulate_ctxt *ctxt, int vec,
645 u32 error, bool valid)
646{
647 ctxt->exception = vec;
648 ctxt->error_code = error;
649 ctxt->error_code_valid = valid;
650 ctxt->restart = false;
651}
652
653static void emulate_gp(struct x86_emulate_ctxt *ctxt, int err)
654{
655 emulate_exception(ctxt, GP_VECTOR, err, true);
656}
657
658static void emulate_pf(struct x86_emulate_ctxt *ctxt, unsigned long addr,
659 int err)
660{
661 ctxt->cr2 = addr;
662 emulate_exception(ctxt, PF_VECTOR, err, true);
663}
664
665static void emulate_ud(struct x86_emulate_ctxt *ctxt)
666{
667 emulate_exception(ctxt, UD_VECTOR, 0, false);
668}
669
670static void emulate_ts(struct x86_emulate_ctxt *ctxt, int err)
671{
672 emulate_exception(ctxt, TS_VECTOR, err, true);
673}
674
62266869
AK		 675static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
676 struct x86_emulate_ops *ops,
2fb53ad8 677 unsigned long eip, u8 *dest)
62266869
AK		 678{
679 struct fetch_cache *fc = &ctxt->decode.fetch;
680 int rc;
2fb53ad8 681 int size, cur_size;
62266869 682
2fb53ad8
AK		 683 if (eip == fc->end) {
684 cur_size = fc->end - fc->start;
685 size = min(15UL - cur_size, PAGE_SIZE - offset_in_page(eip));
686 rc = ops->fetch(ctxt->cs_base + eip, fc->data + cur_size,
687 size, ctxt->vcpu, NULL);
3e2815e9 688 if (rc != X86EMUL_CONTINUE)
62266869 689 return rc;
2fb53ad8 690 fc->end += size;
62266869 691 }
2fb53ad8 692 *dest = fc->data[eip - fc->start];
3e2815e9 693 return X86EMUL_CONTINUE;
62266869
AK		 694}
695
696static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
697 struct x86_emulate_ops *ops,
698 unsigned long eip, void *dest, unsigned size)
699{
3e2815e9 700 int rc;
62266869 701
eb3c79e6 702 /* x86 instructions are limited to 15 bytes. */
063db061 703 if (eip + size - ctxt->eip > 15)
eb3c79e6 704 return X86EMUL_UNHANDLEABLE;
62266869
AK		 705 while (size--) {
706 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
3e2815e9 707 if (rc != X86EMUL_CONTINUE)
62266869
AK		 708 return rc;
709 }
3e2815e9 710 return X86EMUL_CONTINUE;
62266869
AK		 711}
712
1e3c5cb0
RR		 713/*
714 * Given the 'reg' portion of a ModRM byte, and a register block, return a
715 * pointer into the block that addresses the relevant register.
716 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
717 */
718static void *decode_register(u8 modrm_reg, unsigned long *regs,
719 int highbyte_regs)
6aa8b732
AK		 720{
721 void *p;
722
723 p = &regs[modrm_reg];
724 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
725 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
726 return p;
727}
728
729static int read_descriptor(struct x86_emulate_ctxt *ctxt,
730 struct x86_emulate_ops *ops,
731 void *ptr,
732 u16 *size, unsigned long *address, int op_bytes)
733{
734 int rc;
735
736 if (op_bytes == 2)
737 op_bytes = 3;
738 *address = 0;
cebff02b 739 rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
1871c602 740 ctxt->vcpu, NULL);
1b30eaa8 741 if (rc != X86EMUL_CONTINUE)
6aa8b732 742 return rc;
cebff02b 743 rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
1871c602 744 ctxt->vcpu, NULL);
6aa8b732
AK		 745 return rc;
746}
747
bbe9abbd
NK		 748static int test_cc(unsigned int condition, unsigned int flags)
749{
750 int rc = 0;
751
752 switch ((condition & 15) >> 1) {
753 case 0: /* o */
754 rc |= (flags & EFLG_OF);
755 break;
756 case 1: /* b/c/nae */
757 rc |= (flags & EFLG_CF);
758 break;
759 case 2: /* z/e */
760 rc |= (flags & EFLG_ZF);
761 break;
762 case 3: /* be/na */
763 rc |= (flags & (EFLG_CF|EFLG_ZF));
764 break;
765 case 4: /* s */
766 rc |= (flags & EFLG_SF);
767 break;
768 case 5: /* p/pe */
769 rc |= (flags & EFLG_PF);
770 break;
771 case 7: /* le/ng */
772 rc |= (flags & EFLG_ZF);
773 /* fall through */
774 case 6: /* l/nge */
775 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
776 break;
777 }
778
779 /* Odd condition identifiers (lsb == 1) have inverted sense. */
780 return (!!rc ^ (condition & 1));
781}
782
3c118e24
AK		 783static void decode_register_operand(struct operand *op,
784 struct decode_cache *c,
3c118e24
AK		 785 int inhibit_bytereg)
786{
33615aa9 787 unsigned reg = c->modrm_reg;
9f1ef3f8 788 int highbyte_regs = c->rex_prefix == 0;
33615aa9
AK		 789
790 if (!(c->d & ModRM))
791 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
3c118e24
AK		 792 op->type = OP_REG;
793 if ((c->d & ByteOp) && !inhibit_bytereg) {
33615aa9 794 op->ptr = decode_register(reg, c->regs, highbyte_regs);
3c118e24
AK		 795 op->val = *(u8 *)op->ptr;
796 op->bytes = 1;
797 } else {
33615aa9 798 op->ptr = decode_register(reg, c->regs, 0);
3c118e24
AK		 799 op->bytes = c->op_bytes;
800 switch (op->bytes) {
801 case 2:
802 op->val = *(u16 *)op->ptr;
803 break;
804 case 4:
805 op->val = *(u32 *)op->ptr;
806 break;
807 case 8:
808 op->val = *(u64 *) op->ptr;
809 break;
810 }
811 }
812 op->orig_val = op->val;
813}
814
1c73ef66
AK		 815static int decode_modrm(struct x86_emulate_ctxt *ctxt,
816 struct x86_emulate_ops *ops)
817{
818 struct decode_cache *c = &ctxt->decode;
819 u8 sib;
f5b4edcd 820 int index_reg = 0, base_reg = 0, scale;
3e2815e9 821 int rc = X86EMUL_CONTINUE;
1c73ef66
AK		 822
823 if (c->rex_prefix) {
824 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
825 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
826 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
827 }
828
829 c->modrm = insn_fetch(u8, 1, c->eip);
830 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
831 c->modrm_reg |= (c->modrm & 0x38) >> 3;
832 c->modrm_rm |= (c->modrm & 0x07);
833 c->modrm_ea = 0;
834 c->use_modrm_ea = 1;
835
836 if (c->modrm_mod == 3) {
107d6d2e
AK		 837 c->modrm_ptr = decode_register(c->modrm_rm,
838 c->regs, c->d & ByteOp);
839 c->modrm_val = *(unsigned long *)c->modrm_ptr;
1c73ef66
AK		 840 return rc;
841 }
842
843 if (c->ad_bytes == 2) {
844 unsigned bx = c->regs[VCPU_REGS_RBX];
845 unsigned bp = c->regs[VCPU_REGS_RBP];
846 unsigned si = c->regs[VCPU_REGS_RSI];
847 unsigned di = c->regs[VCPU_REGS_RDI];
848
849 /* 16-bit ModR/M decode. */
850 switch (c->modrm_mod) {
851 case 0:
852 if (c->modrm_rm == 6)
853 c->modrm_ea += insn_fetch(u16, 2, c->eip);
854 break;
855 case 1:
856 c->modrm_ea += insn_fetch(s8, 1, c->eip);
857 break;
858 case 2:
859 c->modrm_ea += insn_fetch(u16, 2, c->eip);
860 break;
861 }
862 switch (c->modrm_rm) {
863 case 0:
864 c->modrm_ea += bx + si;
865 break;
866 case 1:
867 c->modrm_ea += bx + di;
868 break;
869 case 2:
870 c->modrm_ea += bp + si;
871 break;
872 case 3:
873 c->modrm_ea += bp + di;
874 break;
875 case 4:
876 c->modrm_ea += si;
877 break;
878 case 5:
879 c->modrm_ea += di;
880 break;
881 case 6:
882 if (c->modrm_mod != 0)
883 c->modrm_ea += bp;
884 break;
885 case 7:
886 c->modrm_ea += bx;
887 break;
888 }
889 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
890 (c->modrm_rm == 6 && c->modrm_mod != 0))
7a5b56df
AK		 891 if (!c->has_seg_override)
892 set_seg_override(c, VCPU_SREG_SS);
1c73ef66
AK		 893 c->modrm_ea = (u16)c->modrm_ea;
894 } else {
895 /* 32/64-bit ModR/M decode. */
84411d85 896 if ((c->modrm_rm & 7) == 4) {
1c73ef66
AK		 897 sib = insn_fetch(u8, 1, c->eip);
898 index_reg |= (sib >> 3) & 7;
899 base_reg |= sib & 7;
900 scale = sib >> 6;
901
dc71d0f1
AK		 902 if ((base_reg & 7) == 5 && c->modrm_mod == 0)
903 c->modrm_ea += insn_fetch(s32, 4, c->eip);
904 else
1c73ef66 905 c->modrm_ea += c->regs[base_reg];
dc71d0f1 906 if (index_reg != 4)
1c73ef66 907 c->modrm_ea += c->regs[index_reg] << scale;
84411d85
AK		 908 } else if ((c->modrm_rm & 7) == 5 && c->modrm_mod == 0) {
909 if (ctxt->mode == X86EMUL_MODE_PROT64)
f5b4edcd 910 c->rip_relative = 1;
84411d85 911 } else
1c73ef66 912 c->modrm_ea += c->regs[c->modrm_rm];
1c73ef66
AK		 913 switch (c->modrm_mod) {
914 case 0:
915 if (c->modrm_rm == 5)
916 c->modrm_ea += insn_fetch(s32, 4, c->eip);
917 break;
918 case 1:
919 c->modrm_ea += insn_fetch(s8, 1, c->eip);
920 break;
921 case 2:
922 c->modrm_ea += insn_fetch(s32, 4, c->eip);
923 break;
924 }
925 }
1c73ef66
AK		 926done:
927 return rc;
928}
929
930static int decode_abs(struct x86_emulate_ctxt *ctxt,
931 struct x86_emulate_ops *ops)
932{
933 struct decode_cache *c = &ctxt->decode;
3e2815e9 934 int rc = X86EMUL_CONTINUE;
1c73ef66
AK		 935
936 switch (c->ad_bytes) {
937 case 2:
938 c->modrm_ea = insn_fetch(u16, 2, c->eip);
939 break;
940 case 4:
941 c->modrm_ea = insn_fetch(u32, 4, c->eip);
942 break;
943 case 8:
944 c->modrm_ea = insn_fetch(u64, 8, c->eip);
945 break;
946 }
947done:
948 return rc;
949}
950
6aa8b732 951int
8b4caf66 952x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
6aa8b732 953{
e4e03ded 954 struct decode_cache *c = &ctxt->decode;
3e2815e9 955 int rc = X86EMUL_CONTINUE;
6aa8b732 956 int mode = ctxt->mode;
e09d082c 957 int def_op_bytes, def_ad_bytes, group;
6aa8b732 958
6aa8b732 959
5cd21917
GN		 960 /* we cannot decode insn before we complete previous rep insn */
961 WARN_ON(ctxt->restart);
962
063db061 963 c->eip = ctxt->eip;
2fb53ad8 964 c->fetch.start = c->fetch.end = c->eip;
79168fd1 965 ctxt->cs_base = seg_base(ctxt, ops, VCPU_SREG_CS);
6aa8b732
AK		 966
967 switch (mode) {
968 case X86EMUL_MODE_REAL:
a0044755 969 case X86EMUL_MODE_VM86:
6aa8b732 970 case X86EMUL_MODE_PROT16:
f21b8bf4 971 def_op_bytes = def_ad_bytes = 2;
6aa8b732
AK		 972 break;
973 case X86EMUL_MODE_PROT32:
f21b8bf4 974 def_op_bytes = def_ad_bytes = 4;
6aa8b732 975 break;
05b3e0c2 976#ifdef CONFIG_X86_64
6aa8b732 977 case X86EMUL_MODE_PROT64:
f21b8bf4
AK		 978 def_op_bytes = 4;
979 def_ad_bytes = 8;
6aa8b732
AK		 980 break;
981#endif
982 default:
983 return -1;
984 }
985
f21b8bf4
AK		 986 c->op_bytes = def_op_bytes;
987 c->ad_bytes = def_ad_bytes;
988
6aa8b732 989 /* Legacy prefixes. */
b4c6abfe 990 for (;;) {
e4e03ded 991 switch (c->b = insn_fetch(u8, 1, c->eip)) {
6aa8b732 992 case 0x66: /* operand-size override */
f21b8bf4
AK		 993 /* switch between 2/4 bytes */
994 c->op_bytes = def_op_bytes ^ 6;
6aa8b732
AK		 995 break;
996 case 0x67: /* address-size override */
997 if (mode == X86EMUL_MODE_PROT64)
e4e03ded 998 /* switch between 4/8 bytes */
f21b8bf4 999 c->ad_bytes = def_ad_bytes ^ 12;
6aa8b732 1000 else
e4e03ded 1001 /* switch between 2/4 bytes */
f21b8bf4 1002 c->ad_bytes = def_ad_bytes ^ 6;
6aa8b732 1003 break;
7a5b56df 1004 case 0x26: /* ES override */
6aa8b732 1005 case 0x2e: /* CS override */
7a5b56df 1006 case 0x36: /* SS override */
6aa8b732 1007 case 0x3e: /* DS override */
7a5b56df 1008 set_seg_override(c, (c->b >> 3) & 3);
6aa8b732
AK		 1009 break;
1010 case 0x64: /* FS override */
6aa8b732 1011 case 0x65: /* GS override */
7a5b56df 1012 set_seg_override(c, c->b & 7);
6aa8b732 1013 break;
b4c6abfe
LV		 1014 case 0x40 ... 0x4f: /* REX */
1015 if (mode != X86EMUL_MODE_PROT64)
1016 goto done_prefixes;
33615aa9 1017 c->rex_prefix = c->b;
b4c6abfe 1018 continue;
6aa8b732 1019 case 0xf0: /* LOCK */
e4e03ded 1020 c->lock_prefix = 1;
6aa8b732 1021 break;
ae6200ba 1022 case 0xf2: /* REPNE/REPNZ */
90e0a28f
GT		 1023 c->rep_prefix = REPNE_PREFIX;
1024 break;
6aa8b732 1025 case 0xf3: /* REP/REPE/REPZ */
90e0a28f 1026 c->rep_prefix = REPE_PREFIX;
6aa8b732 1027 break;
6aa8b732
AK		 1028 default:
1029 goto done_prefixes;
1030 }
b4c6abfe
LV		 1031
1032 /* Any legacy prefix after a REX prefix nullifies its effect. */
1033
33615aa9 1034 c->rex_prefix = 0;
6aa8b732
AK		 1035 }
1036
1037done_prefixes:
1038
1039 /* REX prefix. */
1c73ef66 1040 if (c->rex_prefix)
33615aa9 1041 if (c->rex_prefix & 8)
e4e03ded 1042 c->op_bytes = 8; /* REX.W */
6aa8b732
AK		 1043
1044 /* Opcode byte(s). */
e4e03ded
LV		 1045 c->d = opcode_table[c->b];
1046 if (c->d == 0) {
6aa8b732 1047 /* Two-byte opcode? */
e4e03ded
LV		 1048 if (c->b == 0x0f) {
1049 c->twobyte = 1;
1050 c->b = insn_fetch(u8, 1, c->eip);
1051 c->d = twobyte_table[c->b];
6aa8b732 1052 }
e09d082c 1053 }
6aa8b732 1054
e09d082c
AK		 1055 if (c->d & Group) {
1056 group = c->d & GroupMask;
1057 c->modrm = insn_fetch(u8, 1, c->eip);
1058 --c->eip;
1059
1060 group = (group << 3) + ((c->modrm >> 3) & 7);
1061 if ((c->d & GroupDual) && (c->modrm >> 6) == 3)
1062 c->d = group2_table[group];
1063 else
1064 c->d = group_table[group];
1065 }
1066
1067 /* Unrecognised? */
1068 if (c->d == 0) {
1069 DPRINTF("Cannot emulate %02x\n", c->b);
1070 return -1;
6aa8b732
AK		 1071 }
1072
6e3d5dfb
AK		 1073 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
1074 c->op_bytes = 8;
1075
6aa8b732 1076 /* ModRM and SIB bytes. */
1c73ef66
AK		 1077 if (c->d & ModRM)
1078 rc = decode_modrm(ctxt, ops);
1079 else if (c->d & MemAbs)
1080 rc = decode_abs(ctxt, ops);
3e2815e9 1081 if (rc != X86EMUL_CONTINUE)
1c73ef66 1082 goto done;
6aa8b732 1083
7a5b56df
AK		 1084 if (!c->has_seg_override)
1085 set_seg_override(c, VCPU_SREG_DS);
c7e75a3d 1086
7a5b56df 1087 if (!(!c->twobyte && c->b == 0x8d))
79168fd1 1088 c->modrm_ea += seg_override_base(ctxt, ops, c);
c7e75a3d
AK		 1089
1090 if (c->ad_bytes != 8)
1091 c->modrm_ea = (u32)c->modrm_ea;
69f55cb1
GN		 1092
1093 if (c->rip_relative)
1094 c->modrm_ea += c->eip;
1095
6aa8b732
AK		 1096 /*
1097 * Decode and fetch the source operand: register, memory
1098 * or immediate.
1099 */
e4e03ded 1100 switch (c->d & SrcMask) {
6aa8b732
AK		 1101 case SrcNone:
1102 break;
1103 case SrcReg:
9f1ef3f8 1104 decode_register_operand(&c->src, c, 0);
6aa8b732
AK		 1105 break;
1106 case SrcMem16:
e4e03ded 1107 c->src.bytes = 2;
6aa8b732
AK		 1108 goto srcmem_common;
1109 case SrcMem32:
e4e03ded 1110 c->src.bytes = 4;
6aa8b732
AK		 1111 goto srcmem_common;
1112 case SrcMem:
e4e03ded
LV		 1113 c->src.bytes = (c->d & ByteOp) ? 1 :
1114 c->op_bytes;
b85b9ee9 1115 /* Don't fetch the address for invlpg: it could be unmapped. */
d77c26fc 1116 if (c->twobyte && c->b == 0x01 && c->modrm_reg == 7)
b85b9ee9 1117 break;
d77c26fc 1118 srcmem_common:
4e62417b
AJ		 1119 /*
1120 * For instructions with a ModR/M byte, switch to register
1121 * access if Mod = 3.
1122 */
e4e03ded
LV		 1123 if ((c->d & ModRM) && c->modrm_mod == 3) {
1124 c->src.type = OP_REG;
66b85505 1125 c->src.val = c->modrm_val;
107d6d2e 1126 c->src.ptr = c->modrm_ptr;
4e62417b
AJ		 1127 break;
1128 }
e4e03ded 1129 c->src.type = OP_MEM;
69f55cb1
GN		 1130 c->src.ptr = (unsigned long *)c->modrm_ea;
1131 c->src.val = 0;
6aa8b732
AK		 1132 break;
1133 case SrcImm:
c9eaf20f 1134 case SrcImmU:
e4e03ded
LV		 1135 c->src.type = OP_IMM;
1136 c->src.ptr = (unsigned long *)c->eip;
1137 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1138 if (c->src.bytes == 8)
1139 c->src.bytes = 4;
6aa8b732 1140 /* NB. Immediates are sign-extended as necessary. */
e4e03ded 1141 switch (c->src.bytes) {
6aa8b732 1142 case 1:
e4e03ded 1143 c->src.val = insn_fetch(s8, 1, c->eip);
6aa8b732
AK		 1144 break;
1145 case 2:
e4e03ded 1146 c->src.val = insn_fetch(s16, 2, c->eip);
6aa8b732
AK		 1147 break;
1148 case 4:
e4e03ded 1149 c->src.val = insn_fetch(s32, 4, c->eip);
6aa8b732
AK		 1150 break;
1151 }
c9eaf20f
AK		 1152 if ((c->d & SrcMask) == SrcImmU) {
1153 switch (c->src.bytes) {
1154 case 1:
1155 c->src.val &= 0xff;
1156 break;
1157 case 2:
1158 c->src.val &= 0xffff;
1159 break;
1160 case 4:
1161 c->src.val &= 0xffffffff;
1162 break;
1163 }
1164 }
6aa8b732
AK		 1165 break;
1166 case SrcImmByte:
341de7e3 1167 case SrcImmUByte:
e4e03ded
LV		 1168 c->src.type = OP_IMM;
1169 c->src.ptr = (unsigned long *)c->eip;
1170 c->src.bytes = 1;
341de7e3
GN		 1171 if ((c->d & SrcMask) == SrcImmByte)
1172 c->src.val = insn_fetch(s8, 1, c->eip);
1173 else
1174 c->src.val = insn_fetch(u8, 1, c->eip);
6aa8b732 1175 break;
5d55f299
WY		 1176 case SrcAcc:
1177 c->src.type = OP_REG;
1178 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1179 c->src.ptr = &c->regs[VCPU_REGS_RAX];
1180 switch (c->src.bytes) {
1181 case 1:
1182 c->src.val = *(u8 *)c->src.ptr;
1183 break;
1184 case 2:
1185 c->src.val = *(u16 *)c->src.ptr;
1186 break;
1187 case 4:
1188 c->src.val = *(u32 *)c->src.ptr;
1189 break;
1190 case 8:
1191 c->src.val = *(u64 *)c->src.ptr;
1192 break;
1193 }
1194 break;
bfcadf83
GT		 1195 case SrcOne:
1196 c->src.bytes = 1;
1197 c->src.val = 1;
1198 break;
a682e354
GN		 1199 case SrcSI:
1200 c->src.type = OP_MEM;
1201 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1202 c->src.ptr = (unsigned long *)
79168fd1 1203 register_address(c, seg_override_base(ctxt, ops, c),
a682e354
GN		 1204 c->regs[VCPU_REGS_RSI]);
1205 c->src.val = 0;
1206 break;
414e6277
GN		 1207 case SrcImmFAddr:
1208 c->src.type = OP_IMM;
1209 c->src.ptr = (unsigned long *)c->eip;
1210 c->src.bytes = c->op_bytes + 2;
1211 insn_fetch_arr(c->src.valptr, c->src.bytes, c->eip);
1212 break;
1213 case SrcMemFAddr:
1214 c->src.type = OP_MEM;
1215 c->src.ptr = (unsigned long *)c->modrm_ea;
1216 c->src.bytes = c->op_bytes + 2;
1217 break;
6aa8b732
AK		 1218 }
1219
0dc8d10f
GT		 1220 /*
1221 * Decode and fetch the second source operand: register, memory
1222 * or immediate.
1223 */
1224 switch (c->d & Src2Mask) {
1225 case Src2None:
1226 break;
1227 case Src2CL:
1228 c->src2.bytes = 1;
1229 c->src2.val = c->regs[VCPU_REGS_RCX] & 0x8;
1230 break;
1231 case Src2ImmByte:
1232 c->src2.type = OP_IMM;
1233 c->src2.ptr = (unsigned long *)c->eip;
1234 c->src2.bytes = 1;
1235 c->src2.val = insn_fetch(u8, 1, c->eip);
1236 break;
1237 case Src2One:
1238 c->src2.bytes = 1;
1239 c->src2.val = 1;
1240 break;
1241 }
1242
038e51de 1243 /* Decode and fetch the destination operand: register or memory. */
e4e03ded 1244 switch (c->d & DstMask) {
038e51de
AK		 1245 case ImplicitOps:
1246 /* Special instructions do their own operand decoding. */
8b4caf66 1247 return 0;
038e51de 1248 case DstReg:
9f1ef3f8 1249 decode_register_operand(&c->dst, c,
3c118e24 1250 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
038e51de
AK		 1251 break;
1252 case DstMem:
6550e1f1 1253 case DstMem64:
e4e03ded 1254 if ((c->d & ModRM) && c->modrm_mod == 3) {
89c69638 1255 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
e4e03ded 1256 c->dst.type = OP_REG;
66b85505 1257 c->dst.val = c->dst.orig_val = c->modrm_val;
107d6d2e 1258 c->dst.ptr = c->modrm_ptr;
4e62417b
AJ		 1259 break;
1260 }
8b4caf66 1261 c->dst.type = OP_MEM;
69f55cb1 1262 c->dst.ptr = (unsigned long *)c->modrm_ea;
6550e1f1
GN		 1263 if ((c->d & DstMask) == DstMem64)
1264 c->dst.bytes = 8;
1265 else
1266 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
69f55cb1
GN		 1267 c->dst.val = 0;
1268 if (c->d & BitOp) {
1269 unsigned long mask = ~(c->dst.bytes * 8 - 1);
1270
1271 c->dst.ptr = (void *)c->dst.ptr +
1272 (c->src.val & mask) / 8;
1273 }
8b4caf66 1274 break;
9c9fddd0
GT		 1275 case DstAcc:
1276 c->dst.type = OP_REG;
d6d367d6 1277 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
9c9fddd0 1278 c->dst.ptr = &c->regs[VCPU_REGS_RAX];
d6d367d6 1279 switch (c->dst.bytes) {
9c9fddd0
GT		 1280 case 1:
1281 c->dst.val = *(u8 *)c->dst.ptr;
1282 break;
1283 case 2:
1284 c->dst.val = *(u16 *)c->dst.ptr;
1285 break;
1286 case 4:
1287 c->dst.val = *(u32 *)c->dst.ptr;
1288 break;
d6d367d6
GN		 1289 case 8:
1290 c->dst.val = *(u64 *)c->dst.ptr;
1291 break;
9c9fddd0
GT		 1292 }
1293 c->dst.orig_val = c->dst.val;
1294 break;
a682e354
GN		 1295 case DstDI:
1296 c->dst.type = OP_MEM;
1297 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1298 c->dst.ptr = (unsigned long *)
79168fd1 1299 register_address(c, es_base(ctxt, ops),
a682e354
GN		 1300 c->regs[VCPU_REGS_RDI]);
1301 c->dst.val = 0;
1302 break;
8b4caf66
LV		 1303 }
1304
1305done:
1306 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
1307}
1308
9de41573
GN		 1309static int read_emulated(struct x86_emulate_ctxt *ctxt,
1310 struct x86_emulate_ops *ops,
1311 unsigned long addr, void *dest, unsigned size)
1312{
1313 int rc;
1314 struct read_cache *mc = &ctxt->decode.mem_read;
8fe681e9 1315 u32 err;
9de41573
GN		 1316
1317 while (size) {
1318 int n = min(size, 8u);
1319 size -= n;
1320 if (mc->pos < mc->end)
1321 goto read_cached;
1322
8fe681e9
GN		 1323 rc = ops->read_emulated(addr, mc->data + mc->end, n, &err,
1324 ctxt->vcpu);
1325 if (rc == X86EMUL_PROPAGATE_FAULT)
54b8486f 1326 emulate_pf(ctxt, addr, err);
9de41573
GN		 1327 if (rc != X86EMUL_CONTINUE)
1328 return rc;
1329 mc->end += n;
1330
1331 read_cached:
1332 memcpy(dest, mc->data + mc->pos, n);
1333 mc->pos += n;
1334 dest += n;
1335 addr += n;
1336 }
1337 return X86EMUL_CONTINUE;
1338}
1339
7b262e90
GN		 1340static int pio_in_emulated(struct x86_emulate_ctxt *ctxt,
1341 struct x86_emulate_ops *ops,
1342 unsigned int size, unsigned short port,
1343 void *dest)
1344{
1345 struct read_cache *rc = &ctxt->decode.io_read;
1346
1347 if (rc->pos == rc->end) { /* refill pio read ahead */
1348 struct decode_cache *c = &ctxt->decode;
1349 unsigned int in_page, n;
1350 unsigned int count = c->rep_prefix ?
1351 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1;
1352 in_page = (ctxt->eflags & EFLG_DF) ?
1353 offset_in_page(c->regs[VCPU_REGS_RDI]) :
1354 PAGE_SIZE - offset_in_page(c->regs[VCPU_REGS_RDI]);
1355 n = min(min(in_page, (unsigned int)sizeof(rc->data)) / size,
1356 count);
1357 if (n == 0)
1358 n = 1;
1359 rc->pos = rc->end = 0;
1360 if (!ops->pio_in_emulated(size, port, rc->data, n, ctxt->vcpu))
1361 return 0;
1362 rc->end = n * size;
1363 }
1364
1365 memcpy(dest, rc->data + rc->pos, size);
1366 rc->pos += size;
1367 return 1;
1368}
1369
38ba30ba
GN		 1370static u32 desc_limit_scaled(struct desc_struct *desc)
1371{
1372 u32 limit = get_desc_limit(desc);
1373
1374 return desc->g ? (limit << 12) | 0xfff : limit;
1375}
1376
1377static void get_descriptor_table_ptr(struct x86_emulate_ctxt *ctxt,
1378 struct x86_emulate_ops *ops,
1379 u16 selector, struct desc_ptr *dt)
1380{
1381 if (selector & 1 << 2) {
1382 struct desc_struct desc;
1383 memset (dt, 0, sizeof *dt);
1384 if (!ops->get_cached_descriptor(&desc, VCPU_SREG_LDTR, ctxt->vcpu))
1385 return;
1386
1387 dt->size = desc_limit_scaled(&desc); /* what if limit > 65535? */
1388 dt->address = get_desc_base(&desc);
1389 } else
1390 ops->get_gdt(dt, ctxt->vcpu);
1391}
1392
1393/* allowed just for 8 bytes segments */
1394static int read_segment_descriptor(struct x86_emulate_ctxt *ctxt,
1395 struct x86_emulate_ops *ops,
1396 u16 selector, struct desc_struct *desc)
1397{
1398 struct desc_ptr dt;
1399 u16 index = selector >> 3;
1400 int ret;
1401 u32 err;
1402 ulong addr;
1403
1404 get_descriptor_table_ptr(ctxt, ops, selector, &dt);
1405
1406 if (dt.size < index * 8 + 7) {
54b8486f 1407 emulate_gp(ctxt, selector & 0xfffc);
38ba30ba
GN		 1408 return X86EMUL_PROPAGATE_FAULT;
1409 }
1410 addr = dt.address + index * 8;
1411 ret = ops->read_std(addr, desc, sizeof *desc, ctxt->vcpu, &err);
1412 if (ret == X86EMUL_PROPAGATE_FAULT)
54b8486f 1413 emulate_pf(ctxt, addr, err);
38ba30ba
GN		 1414
1415 return ret;
1416}
1417
1418/* allowed just for 8 bytes segments */
1419static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt,
1420 struct x86_emulate_ops *ops,
1421 u16 selector, struct desc_struct *desc)
1422{
1423 struct desc_ptr dt;
1424 u16 index = selector >> 3;
1425 u32 err;
1426 ulong addr;
1427 int ret;
1428
1429 get_descriptor_table_ptr(ctxt, ops, selector, &dt);
1430
1431 if (dt.size < index * 8 + 7) {
54b8486f 1432 emulate_gp(ctxt, selector & 0xfffc);
38ba30ba
GN		 1433 return X86EMUL_PROPAGATE_FAULT;
1434 }
1435
1436 addr = dt.address + index * 8;
1437 ret = ops->write_std(addr, desc, sizeof *desc, ctxt->vcpu, &err);
1438 if (ret == X86EMUL_PROPAGATE_FAULT)
54b8486f 1439 emulate_pf(ctxt, addr, err);
38ba30ba
GN		 1440
1441 return ret;
1442}
1443
1444static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
1445 struct x86_emulate_ops *ops,
1446 u16 selector, int seg)
1447{
1448 struct desc_struct seg_desc;
1449 u8 dpl, rpl, cpl;
1450 unsigned err_vec = GP_VECTOR;
1451 u32 err_code = 0;
1452 bool null_selector = !(selector & ~0x3); /* 0000-0003 are null */
1453 int ret;
1454
1455 memset(&seg_desc, 0, sizeof seg_desc);
1456
1457 if ((seg <= VCPU_SREG_GS && ctxt->mode == X86EMUL_MODE_VM86)
1458 || ctxt->mode == X86EMUL_MODE_REAL) {
1459 /* set real mode segment descriptor */
1460 set_desc_base(&seg_desc, selector << 4);
1461 set_desc_limit(&seg_desc, 0xffff);
1462 seg_desc.type = 3;
1463 seg_desc.p = 1;
1464 seg_desc.s = 1;
1465 goto load;
1466 }
1467
1468 /* NULL selector is not valid for TR, CS and SS */
1469 if ((seg == VCPU_SREG_CS || seg == VCPU_SREG_SS || seg == VCPU_SREG_TR)
1470 && null_selector)
1471 goto exception;
1472
1473 /* TR should be in GDT only */
1474 if (seg == VCPU_SREG_TR && (selector & (1 << 2)))
1475 goto exception;
1476
1477 if (null_selector) /* for NULL selector skip all following checks */
1478 goto load;
1479
1480 ret = read_segment_descriptor(ctxt, ops, selector, &seg_desc);
1481 if (ret != X86EMUL_CONTINUE)
1482 return ret;
1483
1484 err_code = selector & 0xfffc;
1485 err_vec = GP_VECTOR;
1486
1487 /* can't load system descriptor into segment selecor */
1488 if (seg <= VCPU_SREG_GS && !seg_desc.s)
1489 goto exception;
1490
1491 if (!seg_desc.p) {
1492 err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR;
1493 goto exception;
1494 }
1495
1496 rpl = selector & 3;
1497 dpl = seg_desc.dpl;
1498 cpl = ops->cpl(ctxt->vcpu);
1499
1500 switch (seg) {
1501 case VCPU_SREG_SS:
1502 /*
1503 * segment is not a writable data segment or segment
1504 * selector's RPL != CPL or segment selector's RPL != CPL
1505 */
1506 if (rpl != cpl || (seg_desc.type & 0xa) != 0x2 || dpl != cpl)
1507 goto exception;
1508 break;
1509 case VCPU_SREG_CS:
1510 if (!(seg_desc.type & 8))
1511 goto exception;
1512
1513 if (seg_desc.type & 4) {
1514 /* conforming */
1515 if (dpl > cpl)
1516 goto exception;
1517 } else {
1518 /* nonconforming */
1519 if (rpl > cpl || dpl != cpl)
1520 goto exception;
1521 }
1522 /* CS(RPL) <- CPL */
1523 selector = (selector & 0xfffc) | cpl;
1524 break;
1525 case VCPU_SREG_TR:
1526 if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9))
1527 goto exception;
1528 break;
1529 case VCPU_SREG_LDTR:
1530 if (seg_desc.s || seg_desc.type != 2)
1531 goto exception;
1532 break;
1533 default: /* DS, ES, FS, or GS */
1534 /*
1535 * segment is not a data or readable code segment or
1536 * ((segment is a data or nonconforming code segment)
1537 * and (both RPL and CPL > DPL))
1538 */
1539 if ((seg_desc.type & 0xa) == 0x8 ||
1540 (((seg_desc.type & 0xc) != 0xc) &&
1541 (rpl > dpl && cpl > dpl)))
1542 goto exception;
1543 break;
1544 }
1545
1546 if (seg_desc.s) {
1547 /* mark segment as accessed */
1548 seg_desc.type |= 1;
1549 ret = write_segment_descriptor(ctxt, ops, selector, &seg_desc);
1550 if (ret != X86EMUL_CONTINUE)
1551 return ret;
1552 }
1553load:
1554 ops->set_segment_selector(selector, seg, ctxt->vcpu);
1555 ops->set_cached_descriptor(&seg_desc, seg, ctxt->vcpu);
1556 return X86EMUL_CONTINUE;
1557exception:
54b8486f 1558 emulate_exception(ctxt, err_vec, err_code, true);
38ba30ba
GN		 1559 return X86EMUL_PROPAGATE_FAULT;
1560}
1561
c37eda13
WY		 1562static inline int writeback(struct x86_emulate_ctxt *ctxt,
1563 struct x86_emulate_ops *ops)
1564{
1565 int rc;
1566 struct decode_cache *c = &ctxt->decode;
1567 u32 err;
1568
1569 switch (c->dst.type) {
1570 case OP_REG:
1571 /* The 4-byte case *is* correct:
1572 * in 64-bit mode we zero-extend.
1573 */
1574 switch (c->dst.bytes) {
1575 case 1:
1576 *(u8 *)c->dst.ptr = (u8)c->dst.val;
1577 break;
1578 case 2:
1579 *(u16 *)c->dst.ptr = (u16)c->dst.val;
1580 break;
1581 case 4:
1582 *c->dst.ptr = (u32)c->dst.val;
1583 break; /* 64b: zero-ext */
1584 case 8:
1585 *c->dst.ptr = c->dst.val;
1586 break;
1587 }
1588 break;
1589 case OP_MEM:
1590 if (c->lock_prefix)
1591 rc = ops->cmpxchg_emulated(
1592 (unsigned long)c->dst.ptr,
1593 &c->dst.orig_val,
1594 &c->dst.val,
1595 c->dst.bytes,
1596 &err,
1597 ctxt->vcpu);
1598 else
1599 rc = ops->write_emulated(
1600 (unsigned long)c->dst.ptr,
1601 &c->dst.val,
1602 c->dst.bytes,
1603 &err,
1604 ctxt->vcpu);
1605 if (rc == X86EMUL_PROPAGATE_FAULT)
1606 emulate_pf(ctxt,
1607 (unsigned long)c->dst.ptr, err);
1608 if (rc != X86EMUL_CONTINUE)
1609 return rc;
1610 break;
1611 case OP_NONE:
1612 /* no writeback */
1613 break;
1614 default:
1615 break;
1616 }
1617 return X86EMUL_CONTINUE;
1618}
1619
79168fd1
GN		 1620static inline void emulate_push(struct x86_emulate_ctxt *ctxt,
1621 struct x86_emulate_ops *ops)
8cdbd2c9
LV		 1622{
1623 struct decode_cache *c = &ctxt->decode;
1624
1625 c->dst.type = OP_MEM;
1626 c->dst.bytes = c->op_bytes;
1627 c->dst.val = c->src.val;
7a957275 1628 register_address_increment(c, &c->regs[VCPU_REGS_RSP], -c->op_bytes);
79168fd1 1629 c->dst.ptr = (void *) register_address(c, ss_base(ctxt, ops),
8cdbd2c9
LV		 1630 c->regs[VCPU_REGS_RSP]);
1631}
1632
faa5a3ae 1633static int emulate_pop(struct x86_emulate_ctxt *ctxt,
350f69dc
AK		 1634 struct x86_emulate_ops *ops,
1635 void *dest, int len)
8cdbd2c9
LV		 1636{
1637 struct decode_cache *c = &ctxt->decode;
1638 int rc;
1639
79168fd1 1640 rc = read_emulated(ctxt, ops, register_address(c, ss_base(ctxt, ops),
9de41573
GN		 1641 c->regs[VCPU_REGS_RSP]),
1642 dest, len);
b60d513c 1643 if (rc != X86EMUL_CONTINUE)
8cdbd2c9
LV		 1644 return rc;
1645
350f69dc 1646 register_address_increment(c, &c->regs[VCPU_REGS_RSP], len);
faa5a3ae
AK		 1647 return rc;
1648}
8cdbd2c9 1649
d4c6a154
GN		 1650static int emulate_popf(struct x86_emulate_ctxt *ctxt,
1651 struct x86_emulate_ops *ops,
1652 void *dest, int len)
1653{
1654 int rc;
1655 unsigned long val, change_mask;
1656 int iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
9c537244 1657 int cpl = ops->cpl(ctxt->vcpu);
d4c6a154
GN		 1658
1659 rc = emulate_pop(ctxt, ops, &val, len);
1660 if (rc != X86EMUL_CONTINUE)
1661 return rc;
1662
1663 change_mask = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF | EFLG_OF
1664 | EFLG_TF | EFLG_DF | EFLG_NT | EFLG_RF | EFLG_AC | EFLG_ID;
1665
1666 switch(ctxt->mode) {
1667 case X86EMUL_MODE_PROT64:
1668 case X86EMUL_MODE_PROT32:
1669 case X86EMUL_MODE_PROT16:
1670 if (cpl == 0)
1671 change_mask |= EFLG_IOPL;
1672 if (cpl <= iopl)
1673 change_mask |= EFLG_IF;
1674 break;
1675 case X86EMUL_MODE_VM86:
1676 if (iopl < 3) {
54b8486f 1677 emulate_gp(ctxt, 0);
d4c6a154
GN		 1678 return X86EMUL_PROPAGATE_FAULT;
1679 }
1680 change_mask |= EFLG_IF;
1681 break;
1682 default: /* real mode */
1683 change_mask |= (EFLG_IOPL | EFLG_IF);
1684 break;
1685 }
1686
1687 *(unsigned long *)dest =
1688 (ctxt->eflags & ~change_mask) | (val & change_mask);
1689
1690 return rc;
1691}
1692
79168fd1
GN		 1693static void emulate_push_sreg(struct x86_emulate_ctxt *ctxt,
1694 struct x86_emulate_ops *ops, int seg)
0934ac9d
MG		 1695{
1696 struct decode_cache *c = &ctxt->decode;
0934ac9d 1697
79168fd1 1698 c->src.val = ops->get_segment_selector(seg, ctxt->vcpu);
0934ac9d 1699
79168fd1 1700 emulate_push(ctxt, ops);
0934ac9d
MG		 1701}
1702
1703static int emulate_pop_sreg(struct x86_emulate_ctxt *ctxt,
1704 struct x86_emulate_ops *ops, int seg)
1705{
1706 struct decode_cache *c = &ctxt->decode;
1707 unsigned long selector;
1708 int rc;
1709
1710 rc = emulate_pop(ctxt, ops, &selector, c->op_bytes);
1b30eaa8 1711 if (rc != X86EMUL_CONTINUE)
0934ac9d
MG		 1712 return rc;
1713
2e873022 1714 rc = load_segment_descriptor(ctxt, ops, (u16)selector, seg);
0934ac9d
MG		 1715 return rc;
1716}
1717
c37eda13 1718static int emulate_pusha(struct x86_emulate_ctxt *ctxt,
79168fd1 1719 struct x86_emulate_ops *ops)
abcf14b5
MG		 1720{
1721 struct decode_cache *c = &ctxt->decode;
1722 unsigned long old_esp = c->regs[VCPU_REGS_RSP];
c37eda13 1723 int rc = X86EMUL_CONTINUE;
abcf14b5
MG		 1724 int reg = VCPU_REGS_RAX;
1725
1726 while (reg <= VCPU_REGS_RDI) {
1727 (reg == VCPU_REGS_RSP) ?
1728 (c->src.val = old_esp) : (c->src.val = c->regs[reg]);
1729
79168fd1 1730 emulate_push(ctxt, ops);
c37eda13
WY		 1731
1732 rc = writeback(ctxt, ops);
1733 if (rc != X86EMUL_CONTINUE)
1734 return rc;
1735
abcf14b5
MG		 1736 ++reg;
1737 }
c37eda13
WY		 1738
1739 /* Disable writeback. */
1740 c->dst.type = OP_NONE;
1741
1742 return rc;
abcf14b5
MG		 1743}
1744
1745static int emulate_popa(struct x86_emulate_ctxt *ctxt,
1746 struct x86_emulate_ops *ops)
1747{
1748 struct decode_cache *c = &ctxt->decode;
1b30eaa8 1749 int rc = X86EMUL_CONTINUE;
abcf14b5
MG		 1750 int reg = VCPU_REGS_RDI;
1751
1752 while (reg >= VCPU_REGS_RAX) {
1753 if (reg == VCPU_REGS_RSP) {
1754 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1755 c->op_bytes);
1756 --reg;
1757 }
1758
1759 rc = emulate_pop(ctxt, ops, &c->regs[reg], c->op_bytes);
1b30eaa8 1760 if (rc != X86EMUL_CONTINUE)
abcf14b5
MG		 1761 break;
1762 --reg;
1763 }
1764 return rc;
1765}
1766
faa5a3ae
AK		 1767static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
1768 struct x86_emulate_ops *ops)
1769{
1770 struct decode_cache *c = &ctxt->decode;
faa5a3ae 1771
1b30eaa8 1772 return emulate_pop(ctxt, ops, &c->dst.val, c->dst.bytes);
8cdbd2c9
LV		 1773}
1774
05f086f8 1775static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
8cdbd2c9 1776{
05f086f8 1777 struct decode_cache *c = &ctxt->decode;
8cdbd2c9
LV		 1778 switch (c->modrm_reg) {
1779 case 0: /* rol */
05f086f8 1780 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1781 break;
1782 case 1: /* ror */
05f086f8 1783 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1784 break;
1785 case 2: /* rcl */
05f086f8 1786 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1787 break;
1788 case 3: /* rcr */
05f086f8 1789 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1790 break;
1791 case 4: /* sal/shl */
1792 case 6: /* sal/shl */
05f086f8 1793 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1794 break;
1795 case 5: /* shr */
05f086f8 1796 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1797 break;
1798 case 7: /* sar */
05f086f8 1799 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1800 break;
1801 }
1802}
1803
1804static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
05f086f8 1805 struct x86_emulate_ops *ops)
8cdbd2c9
LV		 1806{
1807 struct decode_cache *c = &ctxt->decode;
8cdbd2c9
LV		 1808
1809 switch (c->modrm_reg) {
1810 case 0 ... 1: /* test */
05f086f8 1811 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1812 break;
1813 case 2: /* not */
1814 c->dst.val = ~c->dst.val;
1815 break;
1816 case 3: /* neg */
05f086f8 1817 emulate_1op("neg", c->dst, ctxt->eflags);
8cdbd2c9
LV		 1818 break;
1819 default:
aca06a83 1820 return 0;
8cdbd2c9 1821 }
aca06a83 1822 return 1;
8cdbd2c9
LV		 1823}
1824
1825static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
a01af5ec 1826 struct x86_emulate_ops *ops)
8cdbd2c9
LV		 1827{
1828 struct decode_cache *c = &ctxt->decode;
8cdbd2c9
LV		 1829
1830 switch (c->modrm_reg) {
1831 case 0: /* inc */
05f086f8 1832 emulate_1op("inc", c->dst, ctxt->eflags);
8cdbd2c9
LV		 1833 break;
1834 case 1: /* dec */
05f086f8 1835 emulate_1op("dec", c->dst, ctxt->eflags);
8cdbd2c9 1836 break;
d19292e4
MG		 1837 case 2: /* call near abs */ {
1838 long int old_eip;
1839 old_eip = c->eip;
1840 c->eip = c->src.val;
1841 c->src.val = old_eip;
79168fd1 1842 emulate_push(ctxt, ops);
d19292e4
MG		 1843 break;
1844 }
8cdbd2c9 1845 case 4: /* jmp abs */
fd60754e 1846 c->eip = c->src.val;
8cdbd2c9
LV		 1847 break;
1848 case 6: /* push */
79168fd1 1849 emulate_push(ctxt, ops);
8cdbd2c9 1850 break;
8cdbd2c9 1851 }
1b30eaa8 1852 return X86EMUL_CONTINUE;
8cdbd2c9
LV		 1853}
1854
1855static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
69f55cb1 1856 struct x86_emulate_ops *ops)
8cdbd2c9
LV		 1857{
1858 struct decode_cache *c = &ctxt->decode;
16518d5a 1859 u64 old = c->dst.orig_val64;
8cdbd2c9
LV		 1860
1861 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1862 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
8cdbd2c9
LV		 1863 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1864 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
05f086f8 1865 ctxt->eflags &= ~EFLG_ZF;
8cdbd2c9 1866 } else {
16518d5a
AK		 1867 c->dst.val64 = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1868 (u32) c->regs[VCPU_REGS_RBX];
8cdbd2c9 1869
05f086f8 1870 ctxt->eflags |= EFLG_ZF;
8cdbd2c9 1871 }
1b30eaa8 1872 return X86EMUL_CONTINUE;
8cdbd2c9
LV		 1873}
1874
a77ab5ea
AK		 1875static int emulate_ret_far(struct x86_emulate_ctxt *ctxt,
1876 struct x86_emulate_ops *ops)
1877{
1878 struct decode_cache *c = &ctxt->decode;
1879 int rc;
1880 unsigned long cs;
1881
1882 rc = emulate_pop(ctxt, ops, &c->eip, c->op_bytes);
1b30eaa8 1883 if (rc != X86EMUL_CONTINUE)
a77ab5ea
AK		 1884 return rc;
1885 if (c->op_bytes == 4)
1886 c->eip = (u32)c->eip;
1887 rc = emulate_pop(ctxt, ops, &cs, c->op_bytes);
1b30eaa8 1888 if (rc != X86EMUL_CONTINUE)
a77ab5ea 1889 return rc;
2e873022 1890 rc = load_segment_descriptor(ctxt, ops, (u16)cs, VCPU_SREG_CS);
a77ab5ea
AK		 1891 return rc;
1892}
1893
e66bb2cc
AP		 1894static inline void
1895setup_syscalls_segments(struct x86_emulate_ctxt *ctxt,
79168fd1
GN		 1896 struct x86_emulate_ops *ops, struct desc_struct *cs,
1897 struct desc_struct *ss)
e66bb2cc 1898{
79168fd1
GN		 1899 memset(cs, 0, sizeof(struct desc_struct));
1900 ops->get_cached_descriptor(cs, VCPU_SREG_CS, ctxt->vcpu);
1901 memset(ss, 0, sizeof(struct desc_struct));
e66bb2cc
AP		 1902
1903 cs->l = 0; /* will be adjusted later */
79168fd1 1904 set_desc_base(cs, 0); /* flat segment */
e66bb2cc 1905 cs->g = 1; /* 4kb granularity */
79168fd1 1906 set_desc_limit(cs, 0xfffff); /* 4GB limit */
e66bb2cc
AP		 1907 cs->type = 0x0b; /* Read, Execute, Accessed */
1908 cs->s = 1;
1909 cs->dpl = 0; /* will be adjusted later */
79168fd1
GN		 1910 cs->p = 1;
1911 cs->d = 1;
e66bb2cc 1912
79168fd1
GN		 1913 set_desc_base(ss, 0); /* flat segment */
1914 set_desc_limit(ss, 0xfffff); /* 4GB limit */
e66bb2cc
AP		 1915 ss->g = 1; /* 4kb granularity */
1916 ss->s = 1;
1917 ss->type = 0x03; /* Read/Write, Accessed */
79168fd1 1918 ss->d = 1; /* 32bit stack segment */
e66bb2cc 1919 ss->dpl = 0;
79168fd1 1920 ss->p = 1;
e66bb2cc
AP		 1921}
1922
1923static int
3fb1b5db 1924emulate_syscall(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
e66bb2cc
AP		 1925{
1926 struct decode_cache *c = &ctxt->decode;
79168fd1 1927 struct desc_struct cs, ss;
e66bb2cc 1928 u64 msr_data;
79168fd1 1929 u16 cs_sel, ss_sel;
e66bb2cc
AP		 1930
1931 /* syscall is not available in real mode */
2e901c4c
GN		 1932 if (ctxt->mode == X86EMUL_MODE_REAL ||
1933 ctxt->mode == X86EMUL_MODE_VM86) {
54b8486f 1934 emulate_ud(ctxt);
2e901c4c
GN		 1935 return X86EMUL_PROPAGATE_FAULT;
1936 }
e66bb2cc 1937
79168fd1 1938 setup_syscalls_segments(ctxt, ops, &cs, &ss);
e66bb2cc 1939
3fb1b5db 1940 ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
e66bb2cc 1941 msr_data >>= 32;
79168fd1
GN		 1942 cs_sel = (u16)(msr_data & 0xfffc);
1943 ss_sel = (u16)(msr_data + 8);
e66bb2cc
AP		 1944
1945 if (is_long_mode(ctxt->vcpu)) {
79168fd1 1946 cs.d = 0;
e66bb2cc
AP		 1947 cs.l = 1;
1948 }
79168fd1
GN		 1949 ops->set_cached_descriptor(&cs, VCPU_SREG_CS, ctxt->vcpu);
1950 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
1951 ops->set_cached_descriptor(&ss, VCPU_SREG_SS, ctxt->vcpu);
1952 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
e66bb2cc
AP		 1953
1954 c->regs[VCPU_REGS_RCX] = c->eip;
1955 if (is_long_mode(ctxt->vcpu)) {
1956#ifdef CONFIG_X86_64
1957 c->regs[VCPU_REGS_R11] = ctxt->eflags & ~EFLG_RF;
1958
3fb1b5db
GN		 1959 ops->get_msr(ctxt->vcpu,
1960 ctxt->mode == X86EMUL_MODE_PROT64 ?
1961 MSR_LSTAR : MSR_CSTAR, &msr_data);
e66bb2cc
AP		 1962 c->eip = msr_data;
1963
3fb1b5db 1964 ops->get_msr(ctxt->vcpu, MSR_SYSCALL_MASK, &msr_data);
e66bb2cc
AP		 1965 ctxt->eflags &= ~(msr_data | EFLG_RF);
1966#endif
1967 } else {
1968 /* legacy mode */
3fb1b5db 1969 ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
e66bb2cc
AP		 1970 c->eip = (u32)msr_data;
1971
1972 ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
1973 }
1974
e54cfa97 1975 return X86EMUL_CONTINUE;
e66bb2cc
AP		 1976}
1977
8c604352 1978static int
3fb1b5db 1979emulate_sysenter(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
8c604352
AP		 1980{
1981 struct decode_cache *c = &ctxt->decode;
79168fd1 1982 struct desc_struct cs, ss;
8c604352 1983 u64 msr_data;
79168fd1 1984 u16 cs_sel, ss_sel;
8c604352 1985
a0044755
GN		 1986 /* inject #GP if in real mode */
1987 if (ctxt->mode == X86EMUL_MODE_REAL) {
54b8486f 1988 emulate_gp(ctxt, 0);
2e901c4c 1989 return X86EMUL_PROPAGATE_FAULT;
8c604352
AP		 1990 }
1991
1992 /* XXX sysenter/sysexit have not been tested in 64bit mode.
1993 * Therefore, we inject an #UD.
1994 */
2e901c4c 1995 if (ctxt->mode == X86EMUL_MODE_PROT64) {
54b8486f 1996 emulate_ud(ctxt);
2e901c4c
GN		 1997 return X86EMUL_PROPAGATE_FAULT;
1998 }
8c604352 1999
79168fd1 2000 setup_syscalls_segments(ctxt, ops, &cs, &ss);
8c604352 2001
3fb1b5db 2002 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_CS, &msr_data);
8c604352
AP		 2003 switch (ctxt->mode) {
2004 case X86EMUL_MODE_PROT32:
2005 if ((msr_data & 0xfffc) == 0x0) {
54b8486f 2006 emulate_gp(ctxt, 0);
e54cfa97 2007 return X86EMUL_PROPAGATE_FAULT;
8c604352
AP		 2008 }
2009 break;
2010 case X86EMUL_MODE_PROT64:
2011 if (msr_data == 0x0) {
54b8486f 2012 emulate_gp(ctxt, 0);
e54cfa97 2013 return X86EMUL_PROPAGATE_FAULT;
8c604352
AP		 2014 }
2015 break;
2016 }
2017
2018 ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
79168fd1
GN		 2019 cs_sel = (u16)msr_data;
2020 cs_sel &= ~SELECTOR_RPL_MASK;
2021 ss_sel = cs_sel + 8;
2022 ss_sel &= ~SELECTOR_RPL_MASK;
8c604352
AP		 2023 if (ctxt->mode == X86EMUL_MODE_PROT64
2024 || is_long_mode(ctxt->vcpu)) {
79168fd1 2025 cs.d = 0;
8c604352
AP		 2026 cs.l = 1;
2027 }
2028
79168fd1
GN		 2029 ops->set_cached_descriptor(&cs, VCPU_SREG_CS, ctxt->vcpu);
2030 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
2031 ops->set_cached_descriptor(&ss, VCPU_SREG_SS, ctxt->vcpu);
2032 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
8c604352 2033
3fb1b5db 2034 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_EIP, &msr_data);
8c604352
AP		 2035 c->eip = msr_data;
2036
3fb1b5db 2037 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_ESP, &msr_data);
8c604352
AP		 2038 c->regs[VCPU_REGS_RSP] = msr_data;
2039
e54cfa97 2040 return X86EMUL_CONTINUE;
8c604352
AP		 2041}
2042
4668f050 2043static int
3fb1b5db 2044emulate_sysexit(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
4668f050
AP		 2045{
2046 struct decode_cache *c = &ctxt->decode;
79168fd1 2047 struct desc_struct cs, ss;
4668f050
AP		 2048 u64 msr_data;
2049 int usermode;
79168fd1 2050 u16 cs_sel, ss_sel;
4668f050 2051
a0044755
GN		 2052 /* inject #GP if in real mode or Virtual 8086 mode */
2053 if (ctxt->mode == X86EMUL_MODE_REAL ||
2054 ctxt->mode == X86EMUL_MODE_VM86) {
54b8486f 2055 emulate_gp(ctxt, 0);
2e901c4c 2056 return X86EMUL_PROPAGATE_FAULT;
4668f050
AP		 2057 }
2058
79168fd1 2059 setup_syscalls_segments(ctxt, ops, &cs, &ss);
4668f050
AP		 2060
2061 if ((c->rex_prefix & 0x8) != 0x0)
2062 usermode = X86EMUL_MODE_PROT64;
2063 else
2064 usermode = X86EMUL_MODE_PROT32;
2065
2066 cs.dpl = 3;
2067 ss.dpl = 3;
3fb1b5db 2068 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_CS, &msr_data);
4668f050
AP		 2069 switch (usermode) {
2070 case X86EMUL_MODE_PROT32:
79168fd1 2071 cs_sel = (u16)(msr_data + 16);
4668f050 2072 if ((msr_data & 0xfffc) == 0x0) {
54b8486f 2073 emulate_gp(ctxt, 0);
e54cfa97 2074 return X86EMUL_PROPAGATE_FAULT;
4668f050 2075 }
79168fd1 2076 ss_sel = (u16)(msr_data + 24);
4668f050
AP		 2077 break;
2078 case X86EMUL_MODE_PROT64:
79168fd1 2079 cs_sel = (u16)(msr_data + 32);
4668f050 2080 if (msr_data == 0x0) {
54b8486f 2081 emulate_gp(ctxt, 0);
e54cfa97 2082 return X86EMUL_PROPAGATE_FAULT;
4668f050 2083 }
79168fd1
GN		 2084 ss_sel = cs_sel + 8;
2085 cs.d = 0;
4668f050
AP		 2086 cs.l = 1;
2087 break;
2088 }
79168fd1
GN		 2089 cs_sel |= SELECTOR_RPL_MASK;
2090 ss_sel |= SELECTOR_RPL_MASK;
4668f050 2091
79168fd1
GN		 2092 ops->set_cached_descriptor(&cs, VCPU_SREG_CS, ctxt->vcpu);
2093 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
2094 ops->set_cached_descriptor(&ss, VCPU_SREG_SS, ctxt->vcpu);
2095 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
4668f050 2096
bdb475a3
GN		 2097 c->eip = c->regs[VCPU_REGS_RDX];
2098 c->regs[VCPU_REGS_RSP] = c->regs[VCPU_REGS_RCX];
4668f050 2099
e54cfa97 2100 return X86EMUL_CONTINUE;
4668f050
AP		 2101}
2102
9c537244
GN		 2103static bool emulator_bad_iopl(struct x86_emulate_ctxt *ctxt,
2104 struct x86_emulate_ops *ops)
f850e2e6
GN		 2105{
2106 int iopl;
2107 if (ctxt->mode == X86EMUL_MODE_REAL)
2108 return false;
2109 if (ctxt->mode == X86EMUL_MODE_VM86)
2110 return true;
2111 iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
9c537244 2112 return ops->cpl(ctxt->vcpu) > iopl;
f850e2e6
GN		 2113}
2114
2115static bool emulator_io_port_access_allowed(struct x86_emulate_ctxt *ctxt,
2116 struct x86_emulate_ops *ops,
2117 u16 port, u16 len)
2118{
79168fd1 2119 struct desc_struct tr_seg;
f850e2e6
GN		 2120 int r;
2121 u16 io_bitmap_ptr;
2122 u8 perm, bit_idx = port & 0x7;
2123 unsigned mask = (1 << len) - 1;
2124
79168fd1
GN		 2125 ops->get_cached_descriptor(&tr_seg, VCPU_SREG_TR, ctxt->vcpu);
2126 if (!tr_seg.p)
f850e2e6 2127 return false;
79168fd1 2128 if (desc_limit_scaled(&tr_seg) < 103)
f850e2e6 2129 return false;
79168fd1
GN		 2130 r = ops->read_std(get_desc_base(&tr_seg) + 102, &io_bitmap_ptr, 2,
2131 ctxt->vcpu, NULL);
f850e2e6
GN		 2132 if (r != X86EMUL_CONTINUE)
2133 return false;
79168fd1 2134 if (io_bitmap_ptr + port/8 > desc_limit_scaled(&tr_seg))
f850e2e6 2135 return false;
79168fd1
GN		 2136 r = ops->read_std(get_desc_base(&tr_seg) + io_bitmap_ptr + port/8,
2137 &perm, 1, ctxt->vcpu, NULL);
f850e2e6
GN		 2138 if (r != X86EMUL_CONTINUE)
2139 return false;
2140 if ((perm >> bit_idx) & mask)
2141 return false;
2142 return true;
2143}
2144
2145static bool emulator_io_permited(struct x86_emulate_ctxt *ctxt,
2146 struct x86_emulate_ops *ops,
2147 u16 port, u16 len)
2148{
9c537244 2149 if (emulator_bad_iopl(ctxt, ops))
f850e2e6
GN		 2150 if (!emulator_io_port_access_allowed(ctxt, ops, port, len))
2151 return false;
2152 return true;
2153}
2154
38ba30ba
GN		 2155static void save_state_to_tss16(struct x86_emulate_ctxt *ctxt,
2156 struct x86_emulate_ops *ops,
2157 struct tss_segment_16 *tss)
2158{
2159 struct decode_cache *c = &ctxt->decode;
2160
2161 tss->ip = c->eip;
2162 tss->flag = ctxt->eflags;
2163 tss->ax = c->regs[VCPU_REGS_RAX];
2164 tss->cx = c->regs[VCPU_REGS_RCX];
2165 tss->dx = c->regs[VCPU_REGS_RDX];
2166 tss->bx = c->regs[VCPU_REGS_RBX];
2167 tss->sp = c->regs[VCPU_REGS_RSP];
2168 tss->bp = c->regs[VCPU_REGS_RBP];
2169 tss->si = c->regs[VCPU_REGS_RSI];
2170 tss->di = c->regs[VCPU_REGS_RDI];
2171
2172 tss->es = ops->get_segment_selector(VCPU_SREG_ES, ctxt->vcpu);
2173 tss->cs = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
2174 tss->ss = ops->get_segment_selector(VCPU_SREG_SS, ctxt->vcpu);
2175 tss->ds = ops->get_segment_selector(VCPU_SREG_DS, ctxt->vcpu);
2176 tss->ldt = ops->get_segment_selector(VCPU_SREG_LDTR, ctxt->vcpu);
2177}
2178
2179static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
2180 struct x86_emulate_ops *ops,
2181 struct tss_segment_16 *tss)
2182{
2183 struct decode_cache *c = &ctxt->decode;
2184 int ret;
2185
2186 c->eip = tss->ip;
2187 ctxt->eflags = tss->flag | 2;
2188 c->regs[VCPU_REGS_RAX] = tss->ax;
2189 c->regs[VCPU_REGS_RCX] = tss->cx;
2190 c->regs[VCPU_REGS_RDX] = tss->dx;
2191 c->regs[VCPU_REGS_RBX] = tss->bx;
2192 c->regs[VCPU_REGS_RSP] = tss->sp;
2193 c->regs[VCPU_REGS_RBP] = tss->bp;
2194 c->regs[VCPU_REGS_RSI] = tss->si;
2195 c->regs[VCPU_REGS_RDI] = tss->di;
2196
2197 /*
2198 * SDM says that segment selectors are loaded before segment
2199 * descriptors
2200 */
2201 ops->set_segment_selector(tss->ldt, VCPU_SREG_LDTR, ctxt->vcpu);
2202 ops->set_segment_selector(tss->es, VCPU_SREG_ES, ctxt->vcpu);
2203 ops->set_segment_selector(tss->cs, VCPU_SREG_CS, ctxt->vcpu);
2204 ops->set_segment_selector(tss->ss, VCPU_SREG_SS, ctxt->vcpu);
2205 ops->set_segment_selector(tss->ds, VCPU_SREG_DS, ctxt->vcpu);
2206
2207 /*
2208 * Now load segment descriptors. If fault happenes at this stage
2209 * it is handled in a context of new task
2210 */
2211 ret = load_segment_descriptor(ctxt, ops, tss->ldt, VCPU_SREG_LDTR);
2212 if (ret != X86EMUL_CONTINUE)
2213 return ret;
2214 ret = load_segment_descriptor(ctxt, ops, tss->es, VCPU_SREG_ES);
2215 if (ret != X86EMUL_CONTINUE)
2216 return ret;
2217 ret = load_segment_descriptor(ctxt, ops, tss->cs, VCPU_SREG_CS);
2218 if (ret != X86EMUL_CONTINUE)
2219 return ret;
2220 ret = load_segment_descriptor(ctxt, ops, tss->ss, VCPU_SREG_SS);
2221 if (ret != X86EMUL_CONTINUE)
2222 return ret;
2223 ret = load_segment_descriptor(ctxt, ops, tss->ds, VCPU_SREG_DS);
2224 if (ret != X86EMUL_CONTINUE)
2225 return ret;
2226
2227 return X86EMUL_CONTINUE;
2228}
2229
2230static int task_switch_16(struct x86_emulate_ctxt *ctxt,
2231 struct x86_emulate_ops *ops,
2232 u16 tss_selector, u16 old_tss_sel,
2233 ulong old_tss_base, struct desc_struct *new_desc)
2234{
2235 struct tss_segment_16 tss_seg;
2236 int ret;
2237 u32 err, new_tss_base = get_desc_base(new_desc);
2238
2239 ret = ops->read_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2240 &err);
2241 if (ret == X86EMUL_PROPAGATE_FAULT) {
2242 /* FIXME: need to provide precise fault address */
54b8486f 2243 emulate_pf(ctxt, old_tss_base, err);
38ba30ba
GN		 2244 return ret;
2245 }
2246
2247 save_state_to_tss16(ctxt, ops, &tss_seg);
2248
2249 ret = ops->write_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2250 &err);
2251 if (ret == X86EMUL_PROPAGATE_FAULT) {
2252 /* FIXME: need to provide precise fault address */
54b8486f 2253 emulate_pf(ctxt, old_tss_base, err);
38ba30ba
GN		 2254 return ret;
2255 }
2256
2257 ret = ops->read_std(new_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2258 &err);
2259 if (ret == X86EMUL_PROPAGATE_FAULT) {
2260 /* FIXME: need to provide precise fault address */
54b8486f 2261 emulate_pf(ctxt, new_tss_base, err);
38ba30ba
GN		 2262 return ret;
2263 }
2264
2265 if (old_tss_sel != 0xffff) {
2266 tss_seg.prev_task_link = old_tss_sel;
2267
2268 ret = ops->write_std(new_tss_base,
2269 &tss_seg.prev_task_link,
2270 sizeof tss_seg.prev_task_link,
2271 ctxt->vcpu, &err);
2272 if (ret == X86EMUL_PROPAGATE_FAULT) {
2273 /* FIXME: need to provide precise fault address */
54b8486f 2274 emulate_pf(ctxt, new_tss_base, err);
38ba30ba
GN		 2275 return ret;
2276 }
2277 }
2278
2279 return load_state_from_tss16(ctxt, ops, &tss_seg);
2280}
2281
2282static void save_state_to_tss32(struct x86_emulate_ctxt *ctxt,
2283 struct x86_emulate_ops *ops,
2284 struct tss_segment_32 *tss)
2285{
2286 struct decode_cache *c = &ctxt->decode;
2287
2288 tss->cr3 = ops->get_cr(3, ctxt->vcpu);
2289 tss->eip = c->eip;
2290 tss->eflags = ctxt->eflags;
2291 tss->eax = c->regs[VCPU_REGS_RAX];
2292 tss->ecx = c->regs[VCPU_REGS_RCX];
2293 tss->edx = c->regs[VCPU_REGS_RDX];
2294 tss->ebx = c->regs[VCPU_REGS_RBX];
2295 tss->esp = c->regs[VCPU_REGS_RSP];
2296 tss->ebp = c->regs[VCPU_REGS_RBP];
2297 tss->esi = c->regs[VCPU_REGS_RSI];
2298 tss->edi = c->regs[VCPU_REGS_RDI];
2299
2300 tss->es = ops->get_segment_selector(VCPU_SREG_ES, ctxt->vcpu);
2301 tss->cs = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
2302 tss->ss = ops->get_segment_selector(VCPU_SREG_SS, ctxt->vcpu);
2303 tss->ds = ops->get_segment_selector(VCPU_SREG_DS, ctxt->vcpu);
2304 tss->fs = ops->get_segment_selector(VCPU_SREG_FS, ctxt->vcpu);
2305 tss->gs = ops->get_segment_selector(VCPU_SREG_GS, ctxt->vcpu);
2306 tss->ldt_selector = ops->get_segment_selector(VCPU_SREG_LDTR, ctxt->vcpu);
2307}
2308
2309static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
2310 struct x86_emulate_ops *ops,
2311 struct tss_segment_32 *tss)
2312{
2313 struct decode_cache *c = &ctxt->decode;
2314 int ret;
2315
0f12244f 2316 if (ops->set_cr(3, tss->cr3, ctxt->vcpu)) {
54b8486f 2317 emulate_gp(ctxt, 0);
0f12244f
GN		 2318 return X86EMUL_PROPAGATE_FAULT;
2319 }
38ba30ba
GN		 2320 c->eip = tss->eip;
2321 ctxt->eflags = tss->eflags | 2;
2322 c->regs[VCPU_REGS_RAX] = tss->eax;
2323 c->regs[VCPU_REGS_RCX] = tss->ecx;
2324 c->regs[VCPU_REGS_RDX] = tss->edx;
2325 c->regs[VCPU_REGS_RBX] = tss->ebx;
2326 c->regs[VCPU_REGS_RSP] = tss->esp;
2327 c->regs[VCPU_REGS_RBP] = tss->ebp;
2328 c->regs[VCPU_REGS_RSI] = tss->esi;
2329 c->regs[VCPU_REGS_RDI] = tss->edi;
2330
2331 /*
2332 * SDM says that segment selectors are loaded before segment
2333 * descriptors
2334 */
2335 ops->set_segment_selector(tss->ldt_selector, VCPU_SREG_LDTR, ctxt->vcpu);
2336 ops->set_segment_selector(tss->es, VCPU_SREG_ES, ctxt->vcpu);
2337 ops->set_segment_selector(tss->cs, VCPU_SREG_CS, ctxt->vcpu);
2338 ops->set_segment_selector(tss->ss, VCPU_SREG_SS, ctxt->vcpu);
2339 ops->set_segment_selector(tss->ds, VCPU_SREG_DS, ctxt->vcpu);
2340 ops->set_segment_selector(tss->fs, VCPU_SREG_FS, ctxt->vcpu);
2341 ops->set_segment_selector(tss->gs, VCPU_SREG_GS, ctxt->vcpu);
2342
2343 /*
2344 * Now load segment descriptors. If fault happenes at this stage
2345 * it is handled in a context of new task
2346 */
2347 ret = load_segment_descriptor(ctxt, ops, tss->ldt_selector, VCPU_SREG_LDTR);
2348 if (ret != X86EMUL_CONTINUE)
2349 return ret;
2350 ret = load_segment_descriptor(ctxt, ops, tss->es, VCPU_SREG_ES);
2351 if (ret != X86EMUL_CONTINUE)
2352 return ret;
2353 ret = load_segment_descriptor(ctxt, ops, tss->cs, VCPU_SREG_CS);
2354 if (ret != X86EMUL_CONTINUE)
2355 return ret;
2356 ret = load_segment_descriptor(ctxt, ops, tss->ss, VCPU_SREG_SS);
2357 if (ret != X86EMUL_CONTINUE)
2358 return ret;
2359 ret = load_segment_descriptor(ctxt, ops, tss->ds, VCPU_SREG_DS);
2360 if (ret != X86EMUL_CONTINUE)
2361 return ret;
2362 ret = load_segment_descriptor(ctxt, ops, tss->fs, VCPU_SREG_FS);
2363 if (ret != X86EMUL_CONTINUE)
2364 return ret;
2365 ret = load_segment_descriptor(ctxt, ops, tss->gs, VCPU_SREG_GS);
2366 if (ret != X86EMUL_CONTINUE)
2367 return ret;
2368
2369 return X86EMUL_CONTINUE;
2370}
2371
2372static int task_switch_32(struct x86_emulate_ctxt *ctxt,
2373 struct x86_emulate_ops *ops,
2374 u16 tss_selector, u16 old_tss_sel,
2375 ulong old_tss_base, struct desc_struct *new_desc)
2376{
2377 struct tss_segment_32 tss_seg;
2378 int ret;
2379 u32 err, new_tss_base = get_desc_base(new_desc);
2380
2381 ret = ops->read_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2382 &err);
2383 if (ret == X86EMUL_PROPAGATE_FAULT) {
2384 /* FIXME: need to provide precise fault address */
54b8486f 2385 emulate_pf(ctxt, old_tss_base, err);
38ba30ba
GN		 2386 return ret;
2387 }
2388
2389 save_state_to_tss32(ctxt, ops, &tss_seg);
2390
2391 ret = ops->write_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2392 &err);
2393 if (ret == X86EMUL_PROPAGATE_FAULT) {
2394 /* FIXME: need to provide precise fault address */
54b8486f 2395 emulate_pf(ctxt, old_tss_base, err);
38ba30ba
GN		 2396 return ret;
2397 }
2398
2399 ret = ops->read_std(new_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
2400 &err);
2401 if (ret == X86EMUL_PROPAGATE_FAULT) {
2402 /* FIXME: need to provide precise fault address */
54b8486f 2403 emulate_pf(ctxt, new_tss_base, err);
38ba30ba
GN		 2404 return ret;
2405 }
2406
2407 if (old_tss_sel != 0xffff) {
2408 tss_seg.prev_task_link = old_tss_sel;
2409
2410 ret = ops->write_std(new_tss_base,
2411 &tss_seg.prev_task_link,
2412 sizeof tss_seg.prev_task_link,
2413 ctxt->vcpu, &err);
2414 if (ret == X86EMUL_PROPAGATE_FAULT) {
2415 /* FIXME: need to provide precise fault address */
54b8486f 2416 emulate_pf(ctxt, new_tss_base, err);
38ba30ba
GN		 2417 return ret;
2418 }
2419 }
2420
2421 return load_state_from_tss32(ctxt, ops, &tss_seg);
2422}
2423
2424static int emulator_do_task_switch(struct x86_emulate_ctxt *ctxt,
e269fb21
JK		 2425 struct x86_emulate_ops *ops,
2426 u16 tss_selector, int reason,
2427 bool has_error_code, u32 error_code)
38ba30ba
GN		 2428{
2429 struct desc_struct curr_tss_desc, next_tss_desc;
2430 int ret;
2431 u16 old_tss_sel = ops->get_segment_selector(VCPU_SREG_TR, ctxt->vcpu);
2432 ulong old_tss_base =
5951c442 2433 ops->get_cached_segment_base(VCPU_SREG_TR, ctxt->vcpu);
ceffb459 2434 u32 desc_limit;
38ba30ba
GN		 2435
2436 /* FIXME: old_tss_base == ~0 ? */
2437
2438 ret = read_segment_descriptor(ctxt, ops, tss_selector, &next_tss_desc);
2439 if (ret != X86EMUL_CONTINUE)
2440 return ret;
2441 ret = read_segment_descriptor(ctxt, ops, old_tss_sel, &curr_tss_desc);
2442 if (ret != X86EMUL_CONTINUE)
2443 return ret;
2444
2445 /* FIXME: check that next_tss_desc is tss */
2446
2447 if (reason != TASK_SWITCH_IRET) {
2448 if ((tss_selector & 3) > next_tss_desc.dpl ||
2449 ops->cpl(ctxt->vcpu) > next_tss_desc.dpl) {
54b8486f 2450 emulate_gp(ctxt, 0);
38ba30ba
GN		 2451 return X86EMUL_PROPAGATE_FAULT;
2452 }
2453 }
2454
ceffb459
GN		 2455 desc_limit = desc_limit_scaled(&next_tss_desc);
2456 if (!next_tss_desc.p ||
2457 ((desc_limit < 0x67 && (next_tss_desc.type & 8)) ||
2458 desc_limit < 0x2b)) {
54b8486f 2459 emulate_ts(ctxt, tss_selector & 0xfffc);
38ba30ba
GN		 2460 return X86EMUL_PROPAGATE_FAULT;
2461 }
2462
2463 if (reason == TASK_SWITCH_IRET || reason == TASK_SWITCH_JMP) {
2464 curr_tss_desc.type &= ~(1 << 1); /* clear busy flag */
2465 write_segment_descriptor(ctxt, ops, old_tss_sel,
2466 &curr_tss_desc);
2467 }
2468
2469 if (reason == TASK_SWITCH_IRET)
2470 ctxt->eflags = ctxt->eflags & ~X86_EFLAGS_NT;
2471
2472 /* set back link to prev task only if NT bit is set in eflags
2473 note that old_tss_sel is not used afetr this point */
2474 if (reason != TASK_SWITCH_CALL && reason != TASK_SWITCH_GATE)
2475 old_tss_sel = 0xffff;
2476
2477 if (next_tss_desc.type & 8)
2478 ret = task_switch_32(ctxt, ops, tss_selector, old_tss_sel,
2479 old_tss_base, &next_tss_desc);
2480 else
2481 ret = task_switch_16(ctxt, ops, tss_selector, old_tss_sel,
2482 old_tss_base, &next_tss_desc);
0760d448
JK		 2483 if (ret != X86EMUL_CONTINUE)
2484 return ret;
38ba30ba
GN		 2485
2486 if (reason == TASK_SWITCH_CALL || reason == TASK_SWITCH_GATE)
2487 ctxt->eflags = ctxt->eflags | X86_EFLAGS_NT;
2488
2489 if (reason != TASK_SWITCH_IRET) {
2490 next_tss_desc.type |= (1 << 1); /* set busy flag */
2491 write_segment_descriptor(ctxt, ops, tss_selector,
2492 &next_tss_desc);
2493 }
2494
2495 ops->set_cr(0, ops->get_cr(0, ctxt->vcpu) | X86_CR0_TS, ctxt->vcpu);
2496 ops->set_cached_descriptor(&next_tss_desc, VCPU_SREG_TR, ctxt->vcpu);
2497 ops->set_segment_selector(tss_selector, VCPU_SREG_TR, ctxt->vcpu);
2498
e269fb21
JK		 2499 if (has_error_code) {
2500 struct decode_cache *c = &ctxt->decode;
2501
2502 c->op_bytes = c->ad_bytes = (next_tss_desc.type & 8) ? 4 : 2;
2503 c->lock_prefix = 0;
2504 c->src.val = (unsigned long) error_code;
79168fd1 2505 emulate_push(ctxt, ops);
e269fb21
JK		 2506 }
2507
38ba30ba
GN		 2508 return ret;
2509}
2510
2511int emulator_task_switch(struct x86_emulate_ctxt *ctxt,
2512 struct x86_emulate_ops *ops,
e269fb21
JK		 2513 u16 tss_selector, int reason,
2514 bool has_error_code, u32 error_code)
38ba30ba
GN		 2515{
2516 struct decode_cache *c = &ctxt->decode;
2517 int rc;
2518
38ba30ba 2519 c->eip = ctxt->eip;
e269fb21 2520 c->dst.type = OP_NONE;
38ba30ba 2521
e269fb21
JK		 2522 rc = emulator_do_task_switch(ctxt, ops, tss_selector, reason,
2523 has_error_code, error_code);
38ba30ba
GN		 2524
2525 if (rc == X86EMUL_CONTINUE) {
e269fb21 2526 rc = writeback(ctxt, ops);
95c55886
GN		 2527 if (rc == X86EMUL_CONTINUE)
2528 ctxt->eip = c->eip;
38ba30ba
GN		 2529 }
2530
19d04437 2531 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
38ba30ba
GN		 2532}
2533
a682e354 2534static void string_addr_inc(struct x86_emulate_ctxt *ctxt, unsigned long base,
d9271123 2535 int reg, struct operand *op)
a682e354
GN		 2536{
2537 struct decode_cache *c = &ctxt->decode;
2538 int df = (ctxt->eflags & EFLG_DF) ? -1 : 1;
2539
d9271123
GN		 2540 register_address_increment(c, &c->regs[reg], df * op->bytes);
2541 op->ptr = (unsigned long *)register_address(c, base, c->regs[reg]);
a682e354
GN		 2542}
2543
8b4caf66 2544int
1be3aa47 2545x86_emulate_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
8b4caf66 2546{
8b4caf66 2547 u64 msr_data;
8b4caf66 2548 struct decode_cache *c = &ctxt->decode;
1b30eaa8 2549 int rc = X86EMUL_CONTINUE;
5cd21917 2550 int saved_dst_type = c->dst.type;
8b4caf66 2551
9de41573 2552 ctxt->decode.mem_read.pos = 0;
310b5d30 2553
1161624f 2554 if (ctxt->mode == X86EMUL_MODE_PROT64 && (c->d & No64)) {
54b8486f 2555 emulate_ud(ctxt);
1161624f
GN		 2556 goto done;
2557 }
2558
d380a5e4 2559 /* LOCK prefix is allowed only with some instructions */
a41ffb75 2560 if (c->lock_prefix && (!(c->d & Lock) || c->dst.type != OP_MEM)) {
54b8486f 2561 emulate_ud(ctxt);
d380a5e4
GN		 2562 goto done;
2563 }
2564
e92805ac 2565 /* Privileged instruction can be executed only in CPL=0 */
9c537244 2566 if ((c->d & Priv) && ops->cpl(ctxt->vcpu)) {
54b8486f 2567 emulate_gp(ctxt, 0);
e92805ac
GN		 2568 goto done;
2569 }
2570
b9fa9d6b 2571 if (c->rep_prefix && (c->d & String)) {
5cd21917 2572 ctxt->restart = true;
b9fa9d6b 2573 /* All REP prefixes have the same first termination condition */
c73e197b 2574 if (address_mask(c, c->regs[VCPU_REGS_RCX]) == 0) {
5cd21917
GN		 2575 string_done:
2576 ctxt->restart = false;
95c55886 2577 ctxt->eip = c->eip;
b9fa9d6b
AK		 2578 goto done;
2579 }
2580 /* The second termination condition only applies for REPE
2581 * and REPNE. Test if the repeat string operation prefix is
2582 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
2583 * corresponding termination condition according to:
2584 * - if REPE/REPZ and ZF = 0 then done
2585 * - if REPNE/REPNZ and ZF = 1 then done
2586 */
2587 if ((c->b == 0xa6) || (c->b == 0xa7) ||
5cd21917 2588 (c->b == 0xae) || (c->b == 0xaf)) {
b9fa9d6b 2589 if ((c->rep_prefix == REPE_PREFIX) &&
5cd21917
GN		 2590 ((ctxt->eflags & EFLG_ZF) == 0))
2591 goto string_done;
b9fa9d6b 2592 if ((c->rep_prefix == REPNE_PREFIX) &&
5cd21917
GN		 2593 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF))
2594 goto string_done;
b9fa9d6b 2595 }
063db061 2596 c->eip = ctxt->eip;
b9fa9d6b
AK		 2597 }
2598
8b4caf66 2599 if (c->src.type == OP_MEM) {
9de41573 2600 rc = read_emulated(ctxt, ops, (unsigned long)c->src.ptr,
414e6277 2601 c->src.valptr, c->src.bytes);
b60d513c 2602 if (rc != X86EMUL_CONTINUE)
8b4caf66 2603 goto done;
16518d5a 2604 c->src.orig_val64 = c->src.val64;
8b4caf66
LV		 2605 }
2606
e35b7b9c 2607 if (c->src2.type == OP_MEM) {
9de41573
GN		 2608 rc = read_emulated(ctxt, ops, (unsigned long)c->src2.ptr,
2609 &c->src2.val, c->src2.bytes);
e35b7b9c
GN		 2610 if (rc != X86EMUL_CONTINUE)
2611 goto done;
2612 }
2613
8b4caf66
LV		 2614 if ((c->d & DstMask) == ImplicitOps)
2615 goto special_insn;
2616
2617
69f55cb1
GN		 2618 if ((c->dst.type == OP_MEM) && !(c->d & Mov)) {
2619 /* optimisation - avoid slow emulated read if Mov */
9de41573
GN		 2620 rc = read_emulated(ctxt, ops, (unsigned long)c->dst.ptr,
2621 &c->dst.val, c->dst.bytes);
69f55cb1
GN		 2622 if (rc != X86EMUL_CONTINUE)
2623 goto done;
038e51de 2624 }
e4e03ded 2625 c->dst.orig_val = c->dst.val;
038e51de 2626
018a98db
AK		 2627special_insn:
2628
e4e03ded 2629 if (c->twobyte)
6aa8b732
AK		 2630 goto twobyte_insn;
2631
e4e03ded 2632 switch (c->b) {
6aa8b732
AK		 2633 case 0x00 ... 0x05:
2634 add: /* add */
05f086f8 2635 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
6aa8b732 2636 break;
0934ac9d 2637 case 0x06: /* push es */
79168fd1 2638 emulate_push_sreg(ctxt, ops, VCPU_SREG_ES);
0934ac9d
MG		 2639 break;
2640 case 0x07: /* pop es */
0934ac9d 2641 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_ES);
1b30eaa8 2642 if (rc != X86EMUL_CONTINUE)
0934ac9d
MG		 2643 goto done;
2644 break;
6aa8b732
AK		 2645 case 0x08 ... 0x0d:
2646 or: /* or */
05f086f8 2647 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
6aa8b732 2648 break;
0934ac9d 2649 case 0x0e: /* push cs */
79168fd1 2650 emulate_push_sreg(ctxt, ops, VCPU_SREG_CS);
0934ac9d 2651 break;
6aa8b732
AK		 2652 case 0x10 ... 0x15:
2653 adc: /* adc */
05f086f8 2654 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
6aa8b732 2655 break;
0934ac9d 2656 case 0x16: /* push ss */
79168fd1 2657 emulate_push_sreg(ctxt, ops, VCPU_SREG_SS);
0934ac9d
MG		 2658 break;
2659 case 0x17: /* pop ss */
0934ac9d 2660 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_SS);
1b30eaa8 2661 if (rc != X86EMUL_CONTINUE)
0934ac9d
MG		 2662 goto done;
2663 break;
6aa8b732
AK		 2664 case 0x18 ... 0x1d:
2665 sbb: /* sbb */
05f086f8 2666 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
6aa8b732 2667 break;
0934ac9d 2668 case 0x1e: /* push ds */
79168fd1 2669 emulate_push_sreg(ctxt, ops, VCPU_SREG_DS);
0934ac9d
MG		 2670 break;
2671 case 0x1f: /* pop ds */
0934ac9d 2672 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_DS);
1b30eaa8 2673 if (rc != X86EMUL_CONTINUE)
0934ac9d
MG		 2674 goto done;
2675 break;
aa3a816b 2676 case 0x20 ... 0x25:
6aa8b732 2677 and: /* and */
05f086f8 2678 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 2679 break;
2680 case 0x28 ... 0x2d:
2681 sub: /* sub */
05f086f8 2682 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 2683 break;
2684 case 0x30 ... 0x35:
2685 xor: /* xor */
05f086f8 2686 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 2687 break;
2688 case 0x38 ... 0x3d:
2689 cmp: /* cmp */
05f086f8 2690 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
6aa8b732 2691 break;
33615aa9
AK		 2692 case 0x40 ... 0x47: /* inc r16/r32 */
2693 emulate_1op("inc", c->dst, ctxt->eflags);
2694 break;
2695 case 0x48 ... 0x4f: /* dec r16/r32 */
2696 emulate_1op("dec", c->dst, ctxt->eflags);
2697 break;
2698 case 0x50 ... 0x57: /* push reg */
79168fd1 2699 emulate_push(ctxt, ops);
33615aa9
AK		 2700 break;
2701 case 0x58 ... 0x5f: /* pop reg */
2702 pop_instruction:
350f69dc 2703 rc = emulate_pop(ctxt, ops, &c->dst.val, c->op_bytes);
1b30eaa8 2704 if (rc != X86EMUL_CONTINUE)
33615aa9 2705 goto done;
33615aa9 2706 break;
abcf14b5 2707 case 0x60: /* pusha */
c37eda13
WY		 2708 rc = emulate_pusha(ctxt, ops);
2709 if (rc != X86EMUL_CONTINUE)
2710 goto done;
abcf14b5
MG		 2711 break;
2712 case 0x61: /* popa */
2713 rc = emulate_popa(ctxt, ops);
1b30eaa8 2714 if (rc != X86EMUL_CONTINUE)
abcf14b5
MG		 2715 goto done;
2716 break;
6aa8b732 2717 case 0x63: /* movsxd */
8b4caf66 2718 if (ctxt->mode != X86EMUL_MODE_PROT64)
6aa8b732 2719 goto cannot_emulate;
e4e03ded 2720 c->dst.val = (s32) c->src.val;
6aa8b732 2721 break;
91ed7a0e 2722 case 0x68: /* push imm */
018a98db 2723 case 0x6a: /* push imm8 */
79168fd1 2724 emulate_push(ctxt, ops);
018a98db
AK		 2725 break;
2726 case 0x6c: /* insb */
2727 case 0x6d: /* insw/insd */
7972995b 2728 c->dst.bytes = min(c->dst.bytes, 4u);
f850e2e6 2729 if (!emulator_io_permited(ctxt, ops, c->regs[VCPU_REGS_RDX],
7972995b 2730 c->dst.bytes)) {
54b8486f 2731 emulate_gp(ctxt, 0);
f850e2e6
GN		 2732 goto done;
2733 }
7b262e90
GN		 2734 if (!pio_in_emulated(ctxt, ops, c->dst.bytes,
2735 c->regs[VCPU_REGS_RDX], &c->dst.val))
7972995b
GN		 2736 goto done; /* IO is needed, skip writeback */
2737 break;
018a98db
AK		 2738 case 0x6e: /* outsb */
2739 case 0x6f: /* outsw/outsd */
7972995b 2740 c->src.bytes = min(c->src.bytes, 4u);
f850e2e6 2741 if (!emulator_io_permited(ctxt, ops, c->regs[VCPU_REGS_RDX],
7972995b 2742 c->src.bytes)) {
54b8486f 2743 emulate_gp(ctxt, 0);
f850e2e6
GN		 2744 goto done;
2745 }
7972995b
GN		 2746 ops->pio_out_emulated(c->src.bytes, c->regs[VCPU_REGS_RDX],
2747 &c->src.val, 1, ctxt->vcpu);
2748
2749 c->dst.type = OP_NONE; /* nothing to writeback */
2750 break;
b2833e3c 2751 case 0x70 ... 0x7f: /* jcc (short) */
018a98db 2752 if (test_cc(c->b, ctxt->eflags))
b2833e3c 2753 jmp_rel(c, c->src.val);
018a98db 2754 break;
6aa8b732 2755 case 0x80 ... 0x83: /* Grp1 */
e4e03ded 2756 switch (c->modrm_reg) {
6aa8b732
AK		 2757 case 0:
2758 goto add;
2759 case 1:
2760 goto or;
2761 case 2:
2762 goto adc;
2763 case 3:
2764 goto sbb;
2765 case 4:
2766 goto and;
2767 case 5:
2768 goto sub;
2769 case 6:
2770 goto xor;
2771 case 7:
2772 goto cmp;
2773 }
2774 break;
2775 case 0x84 ... 0x85:
dfb507c4 2776 test:
05f086f8 2777 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 2778 break;
2779 case 0x86 ... 0x87: /* xchg */
b13354f8 2780 xchg:
6aa8b732 2781 /* Write back the register source. */
e4e03ded 2782 switch (c->dst.bytes) {
6aa8b732 2783 case 1:
e4e03ded 2784 *(u8 *) c->src.ptr = (u8) c->dst.val;
6aa8b732
AK		 2785 break;
2786 case 2:
e4e03ded 2787 *(u16 *) c->src.ptr = (u16) c->dst.val;
6aa8b732
AK		 2788 break;
2789 case 4:
e4e03ded 2790 *c->src.ptr = (u32) c->dst.val;
6aa8b732
AK		 2791 break; /* 64b reg: zero-extend */
2792 case 8:
e4e03ded 2793 *c->src.ptr = c->dst.val;
6aa8b732
AK		 2794 break;
2795 }
2796 /*
2797 * Write back the memory destination with implicit LOCK
2798 * prefix.
2799 */
e4e03ded
LV		 2800 c->dst.val = c->src.val;
2801 c->lock_prefix = 1;
6aa8b732 2802 break;
6aa8b732 2803 case 0x88 ... 0x8b: /* mov */
7de75248 2804 goto mov;
79168fd1
GN		 2805 case 0x8c: /* mov r/m, sreg */
2806 if (c->modrm_reg > VCPU_SREG_GS) {
54b8486f 2807 emulate_ud(ctxt);
5e3ae6c5 2808 goto done;
38d5bc6d 2809 }
79168fd1 2810 c->dst.val = ops->get_segment_selector(c->modrm_reg, ctxt->vcpu);
38d5bc6d 2811 break;
7e0b54b1 2812 case 0x8d: /* lea r16/r32, m */
f9b7aab3 2813 c->dst.val = c->modrm_ea;
7e0b54b1 2814 break;
4257198a
GT		 2815 case 0x8e: { /* mov seg, r/m16 */
2816 uint16_t sel;
4257198a
GT		 2817
2818 sel = c->src.val;
8b9f4414 2819
c697518a
GN		 2820 if (c->modrm_reg == VCPU_SREG_CS ||
2821 c->modrm_reg > VCPU_SREG_GS) {
54b8486f 2822 emulate_ud(ctxt);
8b9f4414
GN		 2823 goto done;
2824 }
2825
310b5d30 2826 if (c->modrm_reg == VCPU_SREG_SS)
95cb2295 2827 ctxt->interruptibility = KVM_X86_SHADOW_INT_MOV_SS;
310b5d30 2828
2e873022 2829 rc = load_segment_descriptor(ctxt, ops, sel, c->modrm_reg);
4257198a
GT		 2830
2831 c->dst.type = OP_NONE; /* Disable writeback. */
2832 break;
2833 }
6aa8b732 2834 case 0x8f: /* pop (sole member of Grp1a) */
8cdbd2c9 2835 rc = emulate_grp1a(ctxt, ops);
1b30eaa8 2836 if (rc != X86EMUL_CONTINUE)
6aa8b732 2837 goto done;
6aa8b732 2838 break;
b13354f8 2839 case 0x90: /* nop / xchg r8,rax */
b8a98945
GN		 2840 if (c->dst.ptr == (unsigned long *)&c->regs[VCPU_REGS_RAX]) {
2841 c->dst.type = OP_NONE; /* nop */
b13354f8
MG		 2842 break;
2843 }
2844 case 0x91 ... 0x97: /* xchg reg,rax */
f0c13ef1
GN		 2845 c->src.type = OP_REG;
2846 c->src.bytes = c->op_bytes;
b13354f8
MG		 2847 c->src.ptr = (unsigned long *) &c->regs[VCPU_REGS_RAX];
2848 c->src.val = *(c->src.ptr);
2849 goto xchg;
fd2a7608 2850 case 0x9c: /* pushf */
05f086f8 2851 c->src.val = (unsigned long) ctxt->eflags;
79168fd1 2852 emulate_push(ctxt, ops);
8cdbd2c9 2853 break;
535eabcf 2854 case 0x9d: /* popf */
2b48cc75 2855 c->dst.type = OP_REG;
05f086f8 2856 c->dst.ptr = (unsigned long *) &ctxt->eflags;
2b48cc75 2857 c->dst.bytes = c->op_bytes;
d4c6a154
GN		 2858 rc = emulate_popf(ctxt, ops, &c->dst.val, c->op_bytes);
2859 if (rc != X86EMUL_CONTINUE)
2860 goto done;
2861 break;
5d55f299 2862 case 0xa0 ... 0xa3: /* mov */
6aa8b732 2863 case 0xa4 ... 0xa5: /* movs */
a682e354 2864 goto mov;
6aa8b732 2865 case 0xa6 ... 0xa7: /* cmps */
d7e5117a 2866 c->dst.type = OP_NONE; /* Disable writeback. */
d7e5117a 2867 DPRINTF("cmps: mem1=0x%p mem2=0x%p\n", c->src.ptr, c->dst.ptr);
a682e354 2868 goto cmp;
dfb507c4
MG		 2869 case 0xa8 ... 0xa9: /* test ax, imm */
2870 goto test;
6aa8b732 2871 case 0xaa ... 0xab: /* stos */
e4e03ded 2872 c->dst.val = c->regs[VCPU_REGS_RAX];
6aa8b732
AK		 2873 break;
2874 case 0xac ... 0xad: /* lods */
a682e354 2875 goto mov;
6aa8b732
AK		 2876 case 0xae ... 0xaf: /* scas */
2877 DPRINTF("Urk! I don't handle SCAS.\n");
2878 goto cannot_emulate;
a5e2e82b 2879 case 0xb0 ... 0xbf: /* mov r, imm */
615ac125 2880 goto mov;
018a98db
AK		 2881 case 0xc0 ... 0xc1:
2882 emulate_grp2(ctxt);
2883 break;
111de5d6 2884 case 0xc3: /* ret */
cf5de4f8 2885 c->dst.type = OP_REG;
111de5d6 2886 c->dst.ptr = &c->eip;
cf5de4f8 2887 c->dst.bytes = c->op_bytes;
111de5d6 2888 goto pop_instruction;
018a98db
AK		 2889 case 0xc6 ... 0xc7: /* mov (sole member of Grp11) */
2890 mov:
2891 c->dst.val = c->src.val;
2892 break;
a77ab5ea
AK		 2893 case 0xcb: /* ret far */
2894 rc = emulate_ret_far(ctxt, ops);
1b30eaa8 2895 if (rc != X86EMUL_CONTINUE)
a77ab5ea
AK		 2896 goto done;
2897 break;
018a98db
AK		 2898 case 0xd0 ... 0xd1: /* Grp2 */
2899 c->src.val = 1;
2900 emulate_grp2(ctxt);
2901 break;
2902 case 0xd2 ... 0xd3: /* Grp2 */
2903 c->src.val = c->regs[VCPU_REGS_RCX];
2904 emulate_grp2(ctxt);
2905 break;
a6a3034c
MG		 2906 case 0xe4: /* inb */
2907 case 0xe5: /* in */
cf8f70bf 2908 goto do_io_in;
a6a3034c
MG		 2909 case 0xe6: /* outb */
2910 case 0xe7: /* out */
cf8f70bf 2911 goto do_io_out;
1a52e051 2912 case 0xe8: /* call (near) */ {
d53c4777 2913 long int rel = c->src.val;
e4e03ded 2914 c->src.val = (unsigned long) c->eip;
7a957275 2915 jmp_rel(c, rel);
79168fd1 2916 emulate_push(ctxt, ops);
8cdbd2c9 2917 break;
1a52e051
NK		 2918 }
2919 case 0xe9: /* jmp rel */
954cd36f 2920 goto jmp;
414e6277
GN		 2921 case 0xea: { /* jmp far */
2922 unsigned short sel;
ea79849d 2923 jump_far:
414e6277
GN		 2924 memcpy(&sel, c->src.valptr + c->op_bytes, 2);
2925
2926 if (load_segment_descriptor(ctxt, ops, sel, VCPU_SREG_CS))
c697518a 2927 goto done;
954cd36f 2928
414e6277
GN		 2929 c->eip = 0;
2930 memcpy(&c->eip, c->src.valptr, c->op_bytes);
954cd36f 2931 break;
414e6277 2932 }
954cd36f
GT		 2933 case 0xeb:
2934 jmp: /* jmp rel short */
7a957275 2935 jmp_rel(c, c->src.val);
a01af5ec 2936 c->dst.type = OP_NONE; /* Disable writeback. */
1a52e051 2937 break;
a6a3034c
MG		 2938 case 0xec: /* in al,dx */
2939 case 0xed: /* in (e/r)ax,dx */
cf8f70bf
GN		 2940 c->src.val = c->regs[VCPU_REGS_RDX];
2941 do_io_in:
2942 c->dst.bytes = min(c->dst.bytes, 4u);
2943 if (!emulator_io_permited(ctxt, ops, c->src.val, c->dst.bytes)) {
54b8486f 2944 emulate_gp(ctxt, 0);
cf8f70bf
GN		 2945 goto done;
2946 }
7b262e90
GN		 2947 if (!pio_in_emulated(ctxt, ops, c->dst.bytes, c->src.val,
2948 &c->dst.val))
cf8f70bf
GN		 2949 goto done; /* IO is needed */
2950 break;
ce7a0ad3
WY		 2951 case 0xee: /* out dx,al */
2952 case 0xef: /* out dx,(e/r)ax */
cf8f70bf
GN		 2953 c->src.val = c->regs[VCPU_REGS_RDX];
2954 do_io_out:
2955 c->dst.bytes = min(c->dst.bytes, 4u);
2956 if (!emulator_io_permited(ctxt, ops, c->src.val, c->dst.bytes)) {
54b8486f 2957 emulate_gp(ctxt, 0);
f850e2e6
GN		 2958 goto done;
2959 }
cf8f70bf
GN		 2960 ops->pio_out_emulated(c->dst.bytes, c->src.val, &c->dst.val, 1,
2961 ctxt->vcpu);
2962 c->dst.type = OP_NONE; /* Disable writeback. */
e93f36bc 2963 break;
111de5d6 2964 case 0xf4: /* hlt */
ad312c7c 2965 ctxt->vcpu->arch.halt_request = 1;
19fdfa0d 2966 break;
111de5d6
AK		 2967 case 0xf5: /* cmc */
2968 /* complement carry flag from eflags reg */
2969 ctxt->eflags ^= EFLG_CF;
2970 c->dst.type = OP_NONE; /* Disable writeback. */
2971 break;
018a98db 2972 case 0xf6 ... 0xf7: /* Grp3 */
aca06a83
GN		 2973 if (!emulate_grp3(ctxt, ops))
2974 goto cannot_emulate;
018a98db 2975 break;
111de5d6
AK		 2976 case 0xf8: /* clc */
2977 ctxt->eflags &= ~EFLG_CF;
2978 c->dst.type = OP_NONE; /* Disable writeback. */
2979 break;
2980 case 0xfa: /* cli */
07cbc6c1 2981 if (emulator_bad_iopl(ctxt, ops)) {
54b8486f 2982 emulate_gp(ctxt, 0);
07cbc6c1
WY		 2983 goto done;
2984 } else {
f850e2e6
GN		 2985 ctxt->eflags &= ~X86_EFLAGS_IF;
2986 c->dst.type = OP_NONE; /* Disable writeback. */
2987 }
111de5d6
AK		 2988 break;
2989 case 0xfb: /* sti */
07cbc6c1 2990 if (emulator_bad_iopl(ctxt, ops)) {
54b8486f 2991 emulate_gp(ctxt, 0);
07cbc6c1
WY		 2992 goto done;
2993 } else {
95cb2295 2994 ctxt->interruptibility = KVM_X86_SHADOW_INT_STI;
f850e2e6
GN		 2995 ctxt->eflags |= X86_EFLAGS_IF;
2996 c->dst.type = OP_NONE; /* Disable writeback. */
2997 }
111de5d6 2998 break;
fb4616f4
MG		 2999 case 0xfc: /* cld */
3000 ctxt->eflags &= ~EFLG_DF;
3001 c->dst.type = OP_NONE; /* Disable writeback. */
3002 break;
3003 case 0xfd: /* std */
3004 ctxt->eflags |= EFLG_DF;
3005 c->dst.type = OP_NONE; /* Disable writeback. */
3006 break;
ea79849d
GN		 3007 case 0xfe: /* Grp4 */
3008 grp45:
018a98db 3009 rc = emulate_grp45(ctxt, ops);
1b30eaa8 3010 if (rc != X86EMUL_CONTINUE)
018a98db
AK		 3011 goto done;
3012 break;
ea79849d
GN		 3013 case 0xff: /* Grp5 */
3014 if (c->modrm_reg == 5)
3015 goto jump_far;
3016 goto grp45;
91269b8f
AK		 3017 default:
3018 goto cannot_emulate;
6aa8b732 3019 }
018a98db
AK		 3020
3021writeback:
3022 rc = writeback(ctxt, ops);
1b30eaa8 3023 if (rc != X86EMUL_CONTINUE)
018a98db
AK		 3024 goto done;
3025
5cd21917
GN		 3026 /*
3027 * restore dst type in case the decoding will be reused
3028 * (happens for string instruction )
3029 */
3030 c->dst.type = saved_dst_type;
3031
a682e354 3032 if ((c->d & SrcMask) == SrcSI)
79168fd1
GN		 3033 string_addr_inc(ctxt, seg_override_base(ctxt, ops, c),
3034 VCPU_REGS_RSI, &c->src);
a682e354
GN		 3035
3036 if ((c->d & DstMask) == DstDI)
79168fd1
GN		 3037 string_addr_inc(ctxt, es_base(ctxt, ops), VCPU_REGS_RDI,
3038 &c->dst);
d9271123 3039
5cd21917 3040 if (c->rep_prefix && (c->d & String)) {
7b262e90 3041 struct read_cache *rc = &ctxt->decode.io_read;
d9271123 3042 register_address_increment(c, &c->regs[VCPU_REGS_RCX], -1);
7b262e90
GN		 3043 /*
3044 * Re-enter guest when pio read ahead buffer is empty or,
3045 * if it is not used, after each 1024 iteration.
3046 */
3047 if ((rc->end == 0 && !(c->regs[VCPU_REGS_RCX] & 0x3ff)) ||
3048 (rc->end != 0 && rc->end == rc->pos))
5cd21917
GN		 3049 ctxt->restart = false;
3050 }
9de41573
GN		 3051 /*
3052 * reset read cache here in case string instruction is restared
3053 * without decoding
3054 */
3055 ctxt->decode.mem_read.end = 0;
95c55886 3056 ctxt->eip = c->eip;
018a98db
AK		 3057
3058done:
cb404fe0 3059 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
6aa8b732
AK		 3060
3061twobyte_insn:
e4e03ded 3062 switch (c->b) {
6aa8b732 3063 case 0x01: /* lgdt, lidt, lmsw */
e4e03ded 3064 switch (c->modrm_reg) {
6aa8b732
AK		 3065 u16 size;
3066 unsigned long address;
3067
aca7f966 3068 case 0: /* vmcall */
e4e03ded 3069 if (c->modrm_mod != 3 || c->modrm_rm != 1)
aca7f966
AL		 3070 goto cannot_emulate;
3071
7aa81cc0 3072 rc = kvm_fix_hypercall(ctxt->vcpu);
1b30eaa8 3073 if (rc != X86EMUL_CONTINUE)
7aa81cc0
AL		 3074 goto done;
3075
33e3885d 3076 /* Let the processor re-execute the fixed hypercall */
063db061 3077 c->eip = ctxt->eip;
16286d08
AK		 3078 /* Disable writeback. */
3079 c->dst.type = OP_NONE;
aca7f966 3080 break;
6aa8b732 3081 case 2: /* lgdt */
e4e03ded
LV		 3082 rc = read_descriptor(ctxt, ops, c->src.ptr,
3083 &size, &address, c->op_bytes);
1b30eaa8 3084 if (rc != X86EMUL_CONTINUE)
6aa8b732
AK		 3085 goto done;
3086 realmode_lgdt(ctxt->vcpu, size, address);
16286d08
AK		 3087 /* Disable writeback. */
3088 c->dst.type = OP_NONE;
6aa8b732 3089 break;
aca7f966 3090 case 3: /* lidt/vmmcall */
2b3d2a20
AK		 3091 if (c->modrm_mod == 3) {
3092 switch (c->modrm_rm) {
3093 case 1:
3094 rc = kvm_fix_hypercall(ctxt->vcpu);
1b30eaa8 3095 if (rc != X86EMUL_CONTINUE)
2b3d2a20
AK		 3096 goto done;
3097 break;
3098 default:
3099 goto cannot_emulate;
3100 }
aca7f966 3101 } else {
e4e03ded 3102 rc = read_descriptor(ctxt, ops, c->src.ptr,
aca7f966 3103 &size, &address,
e4e03ded 3104 c->op_bytes);
1b30eaa8 3105 if (rc != X86EMUL_CONTINUE)
aca7f966
AL		 3106 goto done;
3107 realmode_lidt(ctxt->vcpu, size, address);
3108 }
16286d08
AK		 3109 /* Disable writeback. */
3110 c->dst.type = OP_NONE;
6aa8b732
AK		 3111 break;
3112 case 4: /* smsw */
16286d08 3113 c->dst.bytes = 2;
52a46617 3114 c->dst.val = ops->get_cr(0, ctxt->vcpu);
6aa8b732
AK		 3115 break;
3116 case 6: /* lmsw */
93a152be
GN		 3117 ops->set_cr(0, (ops->get_cr(0, ctxt->vcpu) & ~0x0ful) |
3118 (c->src.val & 0x0f), ctxt->vcpu);
dc7457ea 3119 c->dst.type = OP_NONE;
6aa8b732 3120 break;
6e1e5ffe 3121 case 5: /* not defined */
54b8486f 3122 emulate_ud(ctxt);
6e1e5ffe 3123 goto done;
6aa8b732 3124 case 7: /* invlpg*/
69f55cb1 3125 emulate_invlpg(ctxt->vcpu, c->modrm_ea);
16286d08
AK		 3126 /* Disable writeback. */
3127 c->dst.type = OP_NONE;
6aa8b732
AK		 3128 break;
3129 default:
3130 goto cannot_emulate;
3131 }
3132 break;
e99f0507 3133 case 0x05: /* syscall */
3fb1b5db 3134 rc = emulate_syscall(ctxt, ops);
e54cfa97
TY		 3135 if (rc != X86EMUL_CONTINUE)
3136 goto done;
e66bb2cc
AP		 3137 else
3138 goto writeback;
e99f0507 3139 break;
018a98db
AK		 3140 case 0x06:
3141 emulate_clts(ctxt->vcpu);
3142 c->dst.type = OP_NONE;
3143 break;
018a98db 3144 case 0x09: /* wbinvd */
f5f48ee1
SY		 3145 kvm_emulate_wbinvd(ctxt->vcpu);
3146 c->dst.type = OP_NONE;
3147 break;
3148 case 0x08: /* invd */
018a98db
AK		 3149 case 0x0d: /* GrpP (prefetch) */
3150 case 0x18: /* Grp16 (prefetch/nop) */
3151 c->dst.type = OP_NONE;
3152 break;
3153 case 0x20: /* mov cr, reg */
6aebfa6e
GN		 3154 switch (c->modrm_reg) {
3155 case 1:
3156 case 5 ... 7:
3157 case 9 ... 15:
54b8486f 3158 emulate_ud(ctxt);
6aebfa6e
GN		 3159 goto done;
3160 }
52a46617 3161 c->regs[c->modrm_rm] = ops->get_cr(c->modrm_reg, ctxt->vcpu);
018a98db
AK		 3162 c->dst.type = OP_NONE; /* no writeback */
3163 break;
6aa8b732 3164 case 0x21: /* mov from dr to reg */
1e470be5
GN		 3165 if ((ops->get_cr(4, ctxt->vcpu) & X86_CR4_DE) &&
3166 (c->modrm_reg == 4 || c->modrm_reg == 5)) {
54b8486f 3167 emulate_ud(ctxt);
1e470be5
GN		 3168 goto done;
3169 }
35aa5375 3170 ops->get_dr(c->modrm_reg, &c->regs[c->modrm_rm], ctxt->vcpu);
a01af5ec 3171 c->dst.type = OP_NONE; /* no writeback */
6aa8b732 3172 break;
018a98db 3173 case 0x22: /* mov reg, cr */
0f12244f 3174 if (ops->set_cr(c->modrm_reg, c->modrm_val, ctxt->vcpu)) {
54b8486f 3175 emulate_gp(ctxt, 0);
0f12244f
GN		 3176 goto done;
3177 }
018a98db
AK		 3178 c->dst.type = OP_NONE;
3179 break;
6aa8b732 3180 case 0x23: /* mov from reg to dr */
1e470be5
GN		 3181 if ((ops->get_cr(4, ctxt->vcpu) & X86_CR4_DE) &&
3182 (c->modrm_reg == 4 || c->modrm_reg == 5)) {
54b8486f 3183 emulate_ud(ctxt);
1e470be5
GN		 3184 goto done;
3185 }
35aa5375 3186
338dbc97
GN		 3187 if (ops->set_dr(c->modrm_reg, c->regs[c->modrm_rm] &
3188 ((ctxt->mode == X86EMUL_MODE_PROT64) ?
3189 ~0ULL : ~0U), ctxt->vcpu) < 0) {
3190 /* #UD condition is already handled by the code above */
54b8486f 3191 emulate_gp(ctxt, 0);
338dbc97
GN		 3192 goto done;
3193 }
3194
a01af5ec 3195 c->dst.type = OP_NONE; /* no writeback */
6aa8b732 3196 break;
018a98db
AK		 3197 case 0x30:
3198 /* wrmsr */
3199 msr_data = (u32)c->regs[VCPU_REGS_RAX]
3200 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
3fb1b5db 3201 if (ops->set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data)) {
54b8486f 3202 emulate_gp(ctxt, 0);
fd525365 3203 goto done;
018a98db
AK		 3204 }
3205 rc = X86EMUL_CONTINUE;
3206 c->dst.type = OP_NONE;
3207 break;
3208 case 0x32:
3209 /* rdmsr */
3fb1b5db 3210 if (ops->get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data)) {
54b8486f 3211 emulate_gp(ctxt, 0);
fd525365 3212 goto done;
018a98db
AK		 3213 } else {
3214 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
3215 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
3216 }
3217 rc = X86EMUL_CONTINUE;
3218 c->dst.type = OP_NONE;
3219 break;
e99f0507 3220 case 0x34: /* sysenter */
3fb1b5db 3221 rc = emulate_sysenter(ctxt, ops);
e54cfa97
TY		 3222 if (rc != X86EMUL_CONTINUE)
3223 goto done;
8c604352
AP		 3224 else
3225 goto writeback;
e99f0507
AP		 3226 break;
3227 case 0x35: /* sysexit */
3fb1b5db 3228 rc = emulate_sysexit(ctxt, ops);
e54cfa97
TY		 3229 if (rc != X86EMUL_CONTINUE)
3230 goto done;
4668f050
AP		 3231 else
3232 goto writeback;
e99f0507 3233 break;
6aa8b732 3234 case 0x40 ... 0x4f: /* cmov */
e4e03ded 3235 c->dst.val = c->dst.orig_val = c->src.val;
a01af5ec
LV		 3236 if (!test_cc(c->b, ctxt->eflags))
3237 c->dst.type = OP_NONE; /* no writeback */
6aa8b732 3238 break;
b2833e3c 3239 case 0x80 ... 0x8f: /* jnz rel, etc*/
018a98db 3240 if (test_cc(c->b, ctxt->eflags))
b2833e3c 3241 jmp_rel(c, c->src.val);
018a98db
AK		 3242 c->dst.type = OP_NONE;
3243 break;
0934ac9d 3244 case 0xa0: /* push fs */
79168fd1 3245 emulate_push_sreg(ctxt, ops, VCPU_SREG_FS);
0934ac9d
MG		 3246 break;
3247 case 0xa1: /* pop fs */
3248 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_FS);
1b30eaa8 3249 if (rc != X86EMUL_CONTINUE)
0934ac9d
MG		 3250 goto done;
3251 break;
7de75248
NK		 3252 case 0xa3:
3253 bt: /* bt */
e4f8e039 3254 c->dst.type = OP_NONE;
e4e03ded
LV		 3255 /* only subword offset */
3256 c->src.val &= (c->dst.bytes << 3) - 1;
05f086f8 3257 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
7de75248 3258 break;
9bf8ea42
GT		 3259 case 0xa4: /* shld imm8, r, r/m */
3260 case 0xa5: /* shld cl, r, r/m */
3261 emulate_2op_cl("shld", c->src2, c->src, c->dst, ctxt->eflags);
3262 break;
0934ac9d 3263 case 0xa8: /* push gs */
79168fd1 3264 emulate_push_sreg(ctxt, ops, VCPU_SREG_GS);
0934ac9d
MG		 3265 break;
3266 case 0xa9: /* pop gs */
3267 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_GS);
1b30eaa8 3268 if (rc != X86EMUL_CONTINUE)
0934ac9d
MG		 3269 goto done;
3270 break;
7de75248
NK		 3271 case 0xab:
3272 bts: /* bts */
e4e03ded
LV		 3273 /* only subword offset */
3274 c->src.val &= (c->dst.bytes << 3) - 1;
05f086f8 3275 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
7de75248 3276 break;
9bf8ea42
GT		 3277 case 0xac: /* shrd imm8, r, r/m */
3278 case 0xad: /* shrd cl, r, r/m */
3279 emulate_2op_cl("shrd", c->src2, c->src, c->dst, ctxt->eflags);
3280 break;
2a7c5b8b
GC		 3281 case 0xae: /* clflush */
3282 break;
6aa8b732
AK		 3283 case 0xb0 ... 0xb1: /* cmpxchg */
3284 /*
3285 * Save real source value, then compare EAX against
3286 * destination.
3287 */
e4e03ded
LV		 3288 c->src.orig_val = c->src.val;
3289 c->src.val = c->regs[VCPU_REGS_RAX];
05f086f8
LV		 3290 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
3291 if (ctxt->eflags & EFLG_ZF) {
6aa8b732 3292 /* Success: write back to memory. */
e4e03ded 3293 c->dst.val = c->src.orig_val;
6aa8b732
AK		 3294 } else {
3295 /* Failure: write the value we saw to EAX. */
e4e03ded
LV		 3296 c->dst.type = OP_REG;
3297 c->dst.ptr = (unsigned long *)&c->regs[VCPU_REGS_RAX];
6aa8b732
AK		 3298 }
3299 break;
6aa8b732
AK		 3300 case 0xb3:
3301 btr: /* btr */
e4e03ded
LV		 3302 /* only subword offset */
3303 c->src.val &= (c->dst.bytes << 3) - 1;
05f086f8 3304 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
6aa8b732 3305 break;
6aa8b732 3306 case 0xb6 ... 0xb7: /* movzx */
e4e03ded
LV		 3307 c->dst.bytes = c->op_bytes;
3308 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
3309 : (u16) c->src.val;
6aa8b732 3310 break;
6aa8b732 3311 case 0xba: /* Grp8 */
e4e03ded 3312 switch (c->modrm_reg & 3) {
6aa8b732
AK		 3313 case 0:
3314 goto bt;
3315 case 1:
3316 goto bts;
3317 case 2:
3318 goto btr;
3319 case 3:
3320 goto btc;
3321 }
3322 break;
7de75248
NK		 3323 case 0xbb:
3324 btc: /* btc */
e4e03ded
LV		 3325 /* only subword offset */
3326 c->src.val &= (c->dst.bytes << 3) - 1;
05f086f8 3327 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
7de75248 3328 break;
6aa8b732 3329 case 0xbe ... 0xbf: /* movsx */
e4e03ded
LV		 3330 c->dst.bytes = c->op_bytes;
3331 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
3332 (s16) c->src.val;
6aa8b732 3333 break;
a012e65a 3334 case 0xc3: /* movnti */
e4e03ded
LV		 3335 c->dst.bytes = c->op_bytes;
3336 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
3337 (u64) c->src.val;
a012e65a 3338 break;
6aa8b732 3339 case 0xc7: /* Grp9 (cmpxchg8b) */
69f55cb1 3340 rc = emulate_grp9(ctxt, ops);
1b30eaa8 3341 if (rc != X86EMUL_CONTINUE)
8cdbd2c9
LV		 3342 goto done;
3343 break;
91269b8f
AK		 3344 default:
3345 goto cannot_emulate;
6aa8b732
AK		 3346 }
3347 goto writeback;
3348
3349cannot_emulate:
e4e03ded 3350 DPRINTF("Cannot emulate %02x\n", c->b);
6aa8b732
AK		 3351 return -1;
3352}
ubuntu-bionic-kernel mirror