projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
KVM: x86 emulator: implement movdqu instruction (f3 0f 6f, f3 0f 7f)
[deliverable/linux.git] / arch / x86 / kvm / emulate.c
CommitLineData
6aa8b732 1/******************************************************************************
56e82318 2 * emulate.c
6aa8b732
AK		 3 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
dcc0766b 9 * privileged instructions:
6aa8b732
AK		 10 *
11 * Copyright (C) 2006 Qumranet
9611c187 12 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
6aa8b732
AK		 13 *
14 * Avi Kivity <avi@qumranet.com>
15 * Yaniv Kamay <yaniv@qumranet.com>
16 *
17 * This work is licensed under the terms of the GNU GPL, version 2. See
18 * the COPYING file in the top-level directory.
19 *
20 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
21 */
22
edf88417 23#include <linux/kvm_host.h>
5fdbf976 24#include "kvm_cache_regs.h"
6aa8b732 25#include <linux/module.h>
56e82318 26#include <asm/kvm_emulate.h>
6aa8b732 27
3eeb3288 28#include "x86.h"
38ba30ba 29#include "tss.h"
e99f0507 30
6aa8b732
AK		 31/*
32 * Opcode effective-address decode tables.
33 * Note that we only emulate instructions that have at least one memory
34 * operand (excluding implicit stack references). We assume that stack
35 * references and instruction fetches will never occur in special memory
36 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
37 * not be handled.
38 */
39
40/* Operand sizes: 8-bit operands or specified/overridden size. */
ab85b12b 41#define ByteOp (1<<0) /* 8-bit operands. */
6aa8b732 42/* Destination operand type. */
ab85b12b
AK		 43#define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
44#define DstReg (2<<1) /* Register operand. */
45#define DstMem (3<<1) /* Memory operand. */
46#define DstAcc (4<<1) /* Destination Accumulator */
47#define DstDI (5<<1) /* Destination is in ES:(E)DI */
48#define DstMem64 (6<<1) /* 64bit memory operand */
943858e2 49#define DstImmUByte (7<<1) /* 8-bit unsigned immediate operand */
ab85b12b 50#define DstMask (7<<1)
6aa8b732 51/* Source operand type. */
9c9fddd0 52#define SrcNone (0<<4) /* No source operand. */
9c9fddd0
GT		 53#define SrcReg (1<<4) /* Register operand. */
54#define SrcMem (2<<4) /* Memory operand. */
55#define SrcMem16 (3<<4) /* Memory operand (16-bit). */
56#define SrcMem32 (4<<4) /* Memory operand (32-bit). */
57#define SrcImm (5<<4) /* Immediate operand. */
58#define SrcImmByte (6<<4) /* 8-bit sign-extended immediate operand. */
bfcadf83 59#define SrcOne (7<<4) /* Implied '1' */
341de7e3 60#define SrcImmUByte (8<<4) /* 8-bit unsigned immediate operand. */
c9eaf20f 61#define SrcImmU (9<<4) /* Immediate operand, unsigned */
a682e354 62#define SrcSI (0xa<<4) /* Source is in the DS:RSI */
414e6277
GN		 63#define SrcImmFAddr (0xb<<4) /* Source is immediate far address */
64#define SrcMemFAddr (0xc<<4) /* Source is far address in memory */
5d55f299 65#define SrcAcc (0xd<<4) /* Source Accumulator */
b250e605 66#define SrcImmU16 (0xe<<4) /* Immediate operand, unsigned, 16 bits */
341de7e3 67#define SrcMask (0xf<<4)
6aa8b732 68/* Generic ModRM decode. */
341de7e3 69#define ModRM (1<<8)
6aa8b732 70/* Destination is only written; never read. */
341de7e3
GN		 71#define Mov (1<<9)
72#define BitOp (1<<10)
73#define MemAbs (1<<11) /* Memory operand is absolute displacement */
9c9fddd0
GT		 74#define String (1<<12) /* String instruction (rep capable) */
75#define Stack (1<<13) /* Stack instruction (push/pop) */
e09d082c
AK		 76#define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
77#define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
0d7cdee8 78#define Prefix (1<<16) /* Instruction varies with 66/f2/f3 prefix */
1253791d 79#define Sse (1<<17) /* SSE Vector instruction */
d8769fed 80/* Misc flags */
d867162c 81#define VendorSpecific (1<<22) /* Vendor specific instruction */
5a506b12 82#define NoAccess (1<<23) /* Don't access memory (lea/invlpg/verr etc) */
7f9b4b75 83#define Op3264 (1<<24) /* Operand is 64b in long mode, 32b otherwise */
047a4818 84#define Undefined (1<<25) /* No Such Instruction */
d380a5e4 85#define Lock (1<<26) /* lock prefix is allowed for the instruction */
e92805ac 86#define Priv (1<<27) /* instruction generates #GP if current CPL != 0 */
d8769fed 87#define No64 (1<<28)
0dc8d10f
GT		 88/* Source 2 operand type */
89#define Src2None (0<<29)
90#define Src2CL (1<<29)
91#define Src2ImmByte (2<<29)
92#define Src2One (3<<29)
7db41eb7 93#define Src2Imm (4<<29)
0dc8d10f 94#define Src2Mask (7<<29)
6aa8b732 95
d0e53325
AK		 96#define X2(x...) x, x
97#define X3(x...) X2(x), x
98#define X4(x...) X2(x), X2(x)
99#define X5(x...) X4(x), x
100#define X6(x...) X4(x), X2(x)
101#define X7(x...) X4(x), X3(x)
102#define X8(x...) X4(x), X4(x)
103#define X16(x...) X8(x), X8(x)
83babbca 104
d65b1dee
AK		 105struct opcode {
106 u32 flags;
120df890 107 union {
ef65c889 108 int (*execute)(struct x86_emulate_ctxt *ctxt);
120df890
AK		 109 struct opcode *group;
110 struct group_dual *gdual;
0d7cdee8 111 struct gprefix *gprefix;
120df890
AK		 112 } u;
113};
114
115struct group_dual {
116 struct opcode mod012[8];
117 struct opcode mod3[8];
d65b1dee
AK		 118};
119
0d7cdee8
AK		 120struct gprefix {
121 struct opcode pfx_no;
122 struct opcode pfx_66;
123 struct opcode pfx_f2;
124 struct opcode pfx_f3;
125};
126
6aa8b732 127/* EFLAGS bit definitions. */
d4c6a154
GN		 128#define EFLG_ID (1<<21)
129#define EFLG_VIP (1<<20)
130#define EFLG_VIF (1<<19)
131#define EFLG_AC (1<<18)
b1d86143
AP		 132#define EFLG_VM (1<<17)
133#define EFLG_RF (1<<16)
d4c6a154
GN		 134#define EFLG_IOPL (3<<12)
135#define EFLG_NT (1<<14)
6aa8b732
AK		 136#define EFLG_OF (1<<11)
137#define EFLG_DF (1<<10)
b1d86143 138#define EFLG_IF (1<<9)
d4c6a154 139#define EFLG_TF (1<<8)
6aa8b732
AK		 140#define EFLG_SF (1<<7)
141#define EFLG_ZF (1<<6)
142#define EFLG_AF (1<<4)
143#define EFLG_PF (1<<2)
144#define EFLG_CF (1<<0)
145
62bd430e
MG		 146#define EFLG_RESERVED_ZEROS_MASK 0xffc0802a
147#define EFLG_RESERVED_ONE_MASK 2
148
6aa8b732
AK		 149/*
150 * Instruction emulation:
151 * Most instructions are emulated directly via a fragment of inline assembly
152 * code. This allows us to save/restore EFLAGS and thus very easily pick up
153 * any modified flags.
154 */
155
05b3e0c2 156#if defined(CONFIG_X86_64)
6aa8b732
AK		 157#define _LO32 "k" /* force 32-bit operand */
158#define _STK "%%rsp" /* stack pointer */
159#elif defined(__i386__)
160#define _LO32 "" /* force 32-bit operand */
161#define _STK "%%esp" /* stack pointer */
162#endif
163
164/*
165 * These EFLAGS bits are restored from saved value during emulation, and
166 * any changes are written back to the saved value after emulation.
167 */
168#define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
169
170/* Before executing instruction: restore necessary bits in EFLAGS. */
e934c9c1
AK		 171#define _PRE_EFLAGS(_sav, _msk, _tmp) \
172 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
173 "movl %"_sav",%"_LO32 _tmp"; " \
174 "push %"_tmp"; " \
175 "push %"_tmp"; " \
176 "movl %"_msk",%"_LO32 _tmp"; " \
177 "andl %"_LO32 _tmp",("_STK"); " \
178 "pushf; " \
179 "notl %"_LO32 _tmp"; " \
180 "andl %"_LO32 _tmp",("_STK"); " \
181 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
182 "pop %"_tmp"; " \
183 "orl %"_LO32 _tmp",("_STK"); " \
184 "popf; " \
185 "pop %"_sav"; "
6aa8b732
AK		 186
187/* After executing instruction: write-back necessary bits in EFLAGS. */
188#define _POST_EFLAGS(_sav, _msk, _tmp) \
189 /* _sav |= EFLAGS & _msk; */ \
190 "pushf; " \
191 "pop %"_tmp"; " \
192 "andl %"_msk",%"_LO32 _tmp"; " \
193 "orl %"_LO32 _tmp",%"_sav"; "
194
dda96d8f
AK		 195#ifdef CONFIG_X86_64
196#define ON64(x) x
197#else
198#define ON64(x)
199#endif
200
b3b3d25a 201#define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \
6b7ad61f
AK		 202 do { \
203 __asm__ __volatile__ ( \
204 _PRE_EFLAGS("0", "4", "2") \
205 _op _suffix " %"_x"3,%1; " \
206 _POST_EFLAGS("0", "4", "2") \
fb2c2641 207 : "=m" (_eflags), "+q" (*(_dsttype*)&(_dst).val),\
6b7ad61f
AK		 208 "=&r" (_tmp) \
209 : _y ((_src).val), "i" (EFLAGS_MASK)); \
f3fd92fb 210 } while (0)
6b7ad61f
AK		 211
212
6aa8b732
AK		 213/* Raw emulation: instruction has two explicit operands. */
214#define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
6b7ad61f
AK		 215 do { \
216 unsigned long _tmp; \
217 \
218 switch ((_dst).bytes) { \
219 case 2: \
b3b3d25a 220 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\
6b7ad61f
AK		 221 break; \
222 case 4: \
b3b3d25a 223 ____emulate_2op(_op,_src,_dst,_eflags,_lx,_ly,"l",u32);\
6b7ad61f
AK		 224 break; \
225 case 8: \
b3b3d25a 226 ON64(____emulate_2op(_op,_src,_dst,_eflags,_qx,_qy,"q",u64)); \
6b7ad61f
AK		 227 break; \
228 } \
6aa8b732
AK		 229 } while (0)
230
231#define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
232 do { \
6b7ad61f 233 unsigned long _tmp; \
d77c26fc 234 switch ((_dst).bytes) { \
6aa8b732 235 case 1: \
b3b3d25a 236 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
6aa8b732
AK		 237 break; \
238 default: \
239 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
240 _wx, _wy, _lx, _ly, _qx, _qy); \
241 break; \
242 } \
243 } while (0)
244
245/* Source operand is byte-sized and may be restricted to just %cl. */
246#define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
247 __emulate_2op(_op, _src, _dst, _eflags, \
248 "b", "c", "b", "c", "b", "c", "b", "c")
249
250/* Source operand is byte, word, long or quad sized. */
251#define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
252 __emulate_2op(_op, _src, _dst, _eflags, \
253 "b", "q", "w", "r", _LO32, "r", "", "r")
254
255/* Source operand is word, long or quad sized. */
256#define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
257 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
258 "w", "r", _LO32, "r", "", "r")
259
d175226a
GT		 260/* Instruction has three operands and one operand is stored in ECX register */
261#define __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, _suffix, _type) \
262 do { \
263 unsigned long _tmp; \
264 _type _clv = (_cl).val; \
265 _type _srcv = (_src).val; \
266 _type _dstv = (_dst).val; \
267 \
268 __asm__ __volatile__ ( \
269 _PRE_EFLAGS("0", "5", "2") \
270 _op _suffix " %4,%1 \n" \
271 _POST_EFLAGS("0", "5", "2") \
272 : "=m" (_eflags), "+r" (_dstv), "=&r" (_tmp) \
273 : "c" (_clv) , "r" (_srcv), "i" (EFLAGS_MASK) \
274 ); \
275 \
276 (_cl).val = (unsigned long) _clv; \
277 (_src).val = (unsigned long) _srcv; \
278 (_dst).val = (unsigned long) _dstv; \
279 } while (0)
280
281#define emulate_2op_cl(_op, _cl, _src, _dst, _eflags) \
282 do { \
283 switch ((_dst).bytes) { \
284 case 2: \
285 __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
286 "w", unsigned short); \
287 break; \
288 case 4: \
289 __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
290 "l", unsigned int); \
291 break; \
292 case 8: \
293 ON64(__emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
294 "q", unsigned long)); \
295 break; \
296 } \
297 } while (0)
298
dda96d8f 299#define __emulate_1op(_op, _dst, _eflags, _suffix) \
6aa8b732
AK		 300 do { \
301 unsigned long _tmp; \
302 \
dda96d8f
AK		 303 __asm__ __volatile__ ( \
304 _PRE_EFLAGS("0", "3", "2") \
305 _op _suffix " %1; " \
306 _POST_EFLAGS("0", "3", "2") \
307 : "=m" (_eflags), "+m" ((_dst).val), \
308 "=&r" (_tmp) \
309 : "i" (EFLAGS_MASK)); \
310 } while (0)
311
312/* Instruction has only one explicit operand (no source operand). */
313#define emulate_1op(_op, _dst, _eflags) \
314 do { \
d77c26fc 315 switch ((_dst).bytes) { \
dda96d8f
AK		 316 case 1: __emulate_1op(_op, _dst, _eflags, "b"); break; \
317 case 2: __emulate_1op(_op, _dst, _eflags, "w"); break; \
318 case 4: __emulate_1op(_op, _dst, _eflags, "l"); break; \
319 case 8: ON64(__emulate_1op(_op, _dst, _eflags, "q")); break; \
6aa8b732
AK		 320 } \
321 } while (0)
322
3f9f53b0
MG		 323#define __emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, _suffix) \
324 do { \
325 unsigned long _tmp; \
326 \
327 __asm__ __volatile__ ( \
328 _PRE_EFLAGS("0", "4", "1") \
329 _op _suffix " %5; " \
330 _POST_EFLAGS("0", "4", "1") \
331 : "=m" (_eflags), "=&r" (_tmp), \
332 "+a" (_rax), "+d" (_rdx) \
333 : "i" (EFLAGS_MASK), "m" ((_src).val), \
334 "a" (_rax), "d" (_rdx)); \
335 } while (0)
336
f6b3597b
AK		 337#define __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, _eflags, _suffix, _ex) \
338 do { \
339 unsigned long _tmp; \
340 \
341 __asm__ __volatile__ ( \
342 _PRE_EFLAGS("0", "5", "1") \
343 "1: \n\t" \
344 _op _suffix " %6; " \
345 "2: \n\t" \
346 _POST_EFLAGS("0", "5", "1") \
347 ".pushsection .fixup,\"ax\" \n\t" \
348 "3: movb $1, %4 \n\t" \
349 "jmp 2b \n\t" \
350 ".popsection \n\t" \
351 _ASM_EXTABLE(1b, 3b) \
352 : "=m" (_eflags), "=&r" (_tmp), \
353 "+a" (_rax), "+d" (_rdx), "+qm"(_ex) \
354 : "i" (EFLAGS_MASK), "m" ((_src).val), \
355 "a" (_rax), "d" (_rdx)); \
356 } while (0)
357
3f9f53b0
MG		 358/* instruction has only one source operand, destination is implicit (e.g. mul, div, imul, idiv) */
359#define emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags) \
360 do { \
361 switch((_src).bytes) { \
362 case 1: __emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "b"); break; \
363 case 2: __emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "w"); break; \
364 case 4: __emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "l"); break; \
365 case 8: ON64(__emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "q")); break; \
366 } \
367 } while (0)
368
f6b3597b
AK		 369#define emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, _eflags, _ex) \
370 do { \
371 switch((_src).bytes) { \
372 case 1: \
373 __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, \
374 _eflags, "b", _ex); \
375 break; \
376 case 2: \
377 __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, \
378 _eflags, "w", _ex); \
379 break; \
380 case 4: \
381 __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, \
382 _eflags, "l", _ex); \
383 break; \
384 case 8: ON64( \
385 __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, \
386 _eflags, "q", _ex)); \
387 break; \
388 } \
389 } while (0)
390
6aa8b732
AK		 391/* Fetch next part of the instruction being emulated. */
392#define insn_fetch(_type, _size, _eip) \
393({ unsigned long _x; \
62266869 394 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
af5b4f7f 395 if (rc != X86EMUL_CONTINUE) \
6aa8b732
AK		 396 goto done; \
397 (_eip) += (_size); \
398 (_type)_x; \
399})
400
414e6277
GN		 401#define insn_fetch_arr(_arr, _size, _eip) \
402({ rc = do_insn_fetch(ctxt, ops, (_eip), _arr, (_size)); \
403 if (rc != X86EMUL_CONTINUE) \
404 goto done; \
405 (_eip) += (_size); \
406})
407
ddcb2885
HH		 408static inline unsigned long ad_mask(struct decode_cache *c)
409{
410 return (1UL << (c->ad_bytes << 3)) - 1;
411}
412
6aa8b732 413/* Access/update address held in a register, based on addressing mode. */
e4706772
HH		 414static inline unsigned long
415address_mask(struct decode_cache *c, unsigned long reg)
416{
417 if (c->ad_bytes == sizeof(unsigned long))
418 return reg;
419 else
420 return reg & ad_mask(c);
421}
422
423static inline unsigned long
90de84f5 424register_address(struct decode_cache *c, unsigned long reg)
e4706772 425{
90de84f5 426 return address_mask(c, reg);
e4706772
HH		 427}
428
7a957275
HH		 429static inline void
430register_address_increment(struct decode_cache *c, unsigned long *reg, int inc)
431{
432 if (c->ad_bytes == sizeof(unsigned long))
433 *reg += inc;
434 else
435 *reg = (*reg & ~ad_mask(c)) | ((*reg + inc) & ad_mask(c));
436}
6aa8b732 437
7a957275
HH		 438static inline void jmp_rel(struct decode_cache *c, int rel)
439{
440 register_address_increment(c, &c->eip, rel);
441}
098c937b 442
7a5b56df
AK		 443static void set_seg_override(struct decode_cache *c, int seg)
444{
445 c->has_seg_override = true;
446 c->seg_override = seg;
447}
448
79168fd1
GN		 449static unsigned long seg_base(struct x86_emulate_ctxt *ctxt,
450 struct x86_emulate_ops *ops, int seg)
7a5b56df
AK		 451{
452 if (ctxt->mode == X86EMUL_MODE_PROT64 && seg < VCPU_SREG_FS)
453 return 0;
454
79168fd1 455 return ops->get_cached_segment_base(seg, ctxt->vcpu);
7a5b56df
AK		 456}
457
90de84f5
AK		 458static unsigned seg_override(struct x86_emulate_ctxt *ctxt,
459 struct x86_emulate_ops *ops,
460 struct decode_cache *c)
7a5b56df
AK		 461{
462 if (!c->has_seg_override)
463 return 0;
464
90de84f5 465 return c->seg_override;
7a5b56df
AK		 466}
467
90de84f5
AK		 468static ulong linear(struct x86_emulate_ctxt *ctxt,
469 struct segmented_address addr)
7a5b56df 470{
90de84f5
AK		 471 struct decode_cache *c = &ctxt->decode;
472 ulong la;
7a5b56df 473
90de84f5
AK		 474 la = seg_base(ctxt, ctxt->ops, addr.seg) + addr.ea;
475 if (c->ad_bytes != 8)
476 la &= (u32)-1;
477 return la;
7a5b56df
AK		 478}
479
35d3d4a1
AK		 480static int emulate_exception(struct x86_emulate_ctxt *ctxt, int vec,
481 u32 error, bool valid)
54b8486f 482{
da9cb575
AK		 483 ctxt->exception.vector = vec;
484 ctxt->exception.error_code = error;
485 ctxt->exception.error_code_valid = valid;
35d3d4a1 486 return X86EMUL_PROPAGATE_FAULT;
54b8486f
GN		 487}
488
35d3d4a1 489static int emulate_gp(struct x86_emulate_ctxt *ctxt, int err)
54b8486f 490{
35d3d4a1 491 return emulate_exception(ctxt, GP_VECTOR, err, true);
54b8486f
GN		 492}
493
35d3d4a1 494static int emulate_ud(struct x86_emulate_ctxt *ctxt)
54b8486f 495{
35d3d4a1 496 return emulate_exception(ctxt, UD_VECTOR, 0, false);
54b8486f
GN		 497}
498
35d3d4a1 499static int emulate_ts(struct x86_emulate_ctxt *ctxt, int err)
54b8486f 500{
35d3d4a1 501 return emulate_exception(ctxt, TS_VECTOR, err, true);
54b8486f
GN		 502}
503
34d1f490
AK		 504static int emulate_de(struct x86_emulate_ctxt *ctxt)
505{
35d3d4a1 506 return emulate_exception(ctxt, DE_VECTOR, 0, false);
34d1f490
AK		 507}
508
1253791d
AK		 509static int emulate_nm(struct x86_emulate_ctxt *ctxt)
510{
511 return emulate_exception(ctxt, NM_VECTOR, 0, false);
512}
513
62266869
AK		 514static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
515 struct x86_emulate_ops *ops,
2fb53ad8 516 unsigned long eip, u8 *dest)
62266869
AK		 517{
518 struct fetch_cache *fc = &ctxt->decode.fetch;
519 int rc;
2fb53ad8 520 int size, cur_size;
62266869 521
2fb53ad8
AK		 522 if (eip == fc->end) {
523 cur_size = fc->end - fc->start;
524 size = min(15UL - cur_size, PAGE_SIZE - offset_in_page(eip));
525 rc = ops->fetch(ctxt->cs_base + eip, fc->data + cur_size,
bcc55cba 526 size, ctxt->vcpu, &ctxt->exception);
3e2815e9 527 if (rc != X86EMUL_CONTINUE)
62266869 528 return rc;
2fb53ad8 529 fc->end += size;
62266869 530 }
2fb53ad8 531 *dest = fc->data[eip - fc->start];
3e2815e9 532 return X86EMUL_CONTINUE;
62266869
AK		 533}
534
535static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
536 struct x86_emulate_ops *ops,
537 unsigned long eip, void *dest, unsigned size)
538{
3e2815e9 539 int rc;
62266869 540
eb3c79e6 541 /* x86 instructions are limited to 15 bytes. */
063db061 542 if (eip + size - ctxt->eip > 15)
eb3c79e6 543 return X86EMUL_UNHANDLEABLE;
62266869
AK		 544 while (size--) {
545 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
3e2815e9 546 if (rc != X86EMUL_CONTINUE)
62266869
AK		 547 return rc;
548 }
3e2815e9 549 return X86EMUL_CONTINUE;
62266869
AK		 550}
551
1e3c5cb0
RR		 552/*
553 * Given the 'reg' portion of a ModRM byte, and a register block, return a
554 * pointer into the block that addresses the relevant register.
555 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
556 */
557static void *decode_register(u8 modrm_reg, unsigned long *regs,
558 int highbyte_regs)
6aa8b732
AK		 559{
560 void *p;
561
562 p = &regs[modrm_reg];
563 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
564 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
565 return p;
566}
567
568static int read_descriptor(struct x86_emulate_ctxt *ctxt,
569 struct x86_emulate_ops *ops,
90de84f5 570 struct segmented_address addr,
6aa8b732
AK		 571 u16 *size, unsigned long *address, int op_bytes)
572{
573 int rc;
574
575 if (op_bytes == 2)
576 op_bytes = 3;
577 *address = 0;
90de84f5 578 rc = ops->read_std(linear(ctxt, addr), (unsigned long *)size, 2,
bcc55cba 579 ctxt->vcpu, &ctxt->exception);
1b30eaa8 580 if (rc != X86EMUL_CONTINUE)
6aa8b732 581 return rc;
30b31ab6
AK		 582 addr.ea += 2;
583 rc = ops->read_std(linear(ctxt, addr), address, op_bytes,
bcc55cba 584 ctxt->vcpu, &ctxt->exception);
6aa8b732
AK		 585 return rc;
586}
587
bbe9abbd
NK		 588static int test_cc(unsigned int condition, unsigned int flags)
589{
590 int rc = 0;
591
592 switch ((condition & 15) >> 1) {
593 case 0: /* o */
594 rc |= (flags & EFLG_OF);
595 break;
596 case 1: /* b/c/nae */
597 rc |= (flags & EFLG_CF);
598 break;
599 case 2: /* z/e */
600 rc |= (flags & EFLG_ZF);
601 break;
602 case 3: /* be/na */
603 rc |= (flags & (EFLG_CF|EFLG_ZF));
604 break;
605 case 4: /* s */
606 rc |= (flags & EFLG_SF);
607 break;
608 case 5: /* p/pe */
609 rc |= (flags & EFLG_PF);
610 break;
611 case 7: /* le/ng */
612 rc |= (flags & EFLG_ZF);
613 /* fall through */
614 case 6: /* l/nge */
615 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
616 break;
617 }
618
619 /* Odd condition identifiers (lsb == 1) have inverted sense. */
620 return (!!rc ^ (condition & 1));
621}
622
91ff3cb4
AK		 623static void fetch_register_operand(struct operand *op)
624{
625 switch (op->bytes) {
626 case 1:
627 op->val = *(u8 *)op->addr.reg;
628 break;
629 case 2:
630 op->val = *(u16 *)op->addr.reg;
631 break;
632 case 4:
633 op->val = *(u32 *)op->addr.reg;
634 break;
635 case 8:
636 op->val = *(u64 *)op->addr.reg;
637 break;
638 }
639}
640
1253791d
AK		 641static void read_sse_reg(struct x86_emulate_ctxt *ctxt, sse128_t *data, int reg)
642{
643 ctxt->ops->get_fpu(ctxt);
644 switch (reg) {
645 case 0: asm("movdqu %%xmm0, %0" : "=m"(*data)); break;
646 case 1: asm("movdqu %%xmm1, %0" : "=m"(*data)); break;
647 case 2: asm("movdqu %%xmm2, %0" : "=m"(*data)); break;
648 case 3: asm("movdqu %%xmm3, %0" : "=m"(*data)); break;
649 case 4: asm("movdqu %%xmm4, %0" : "=m"(*data)); break;
650 case 5: asm("movdqu %%xmm5, %0" : "=m"(*data)); break;
651 case 6: asm("movdqu %%xmm6, %0" : "=m"(*data)); break;
652 case 7: asm("movdqu %%xmm7, %0" : "=m"(*data)); break;
653#ifdef CONFIG_X86_64
654 case 8: asm("movdqu %%xmm8, %0" : "=m"(*data)); break;
655 case 9: asm("movdqu %%xmm9, %0" : "=m"(*data)); break;
656 case 10: asm("movdqu %%xmm10, %0" : "=m"(*data)); break;
657 case 11: asm("movdqu %%xmm11, %0" : "=m"(*data)); break;
658 case 12: asm("movdqu %%xmm12, %0" : "=m"(*data)); break;
659 case 13: asm("movdqu %%xmm13, %0" : "=m"(*data)); break;
660 case 14: asm("movdqu %%xmm14, %0" : "=m"(*data)); break;
661 case 15: asm("movdqu %%xmm15, %0" : "=m"(*data)); break;
662#endif
663 default: BUG();
664 }
665 ctxt->ops->put_fpu(ctxt);
666}
667
668static void write_sse_reg(struct x86_emulate_ctxt *ctxt, sse128_t *data,
669 int reg)
670{
671 ctxt->ops->get_fpu(ctxt);
672 switch (reg) {
673 case 0: asm("movdqu %0, %%xmm0" : : "m"(*data)); break;
674 case 1: asm("movdqu %0, %%xmm1" : : "m"(*data)); break;
675 case 2: asm("movdqu %0, %%xmm2" : : "m"(*data)); break;
676 case 3: asm("movdqu %0, %%xmm3" : : "m"(*data)); break;
677 case 4: asm("movdqu %0, %%xmm4" : : "m"(*data)); break;
678 case 5: asm("movdqu %0, %%xmm5" : : "m"(*data)); break;
679 case 6: asm("movdqu %0, %%xmm6" : : "m"(*data)); break;
680 case 7: asm("movdqu %0, %%xmm7" : : "m"(*data)); break;
681#ifdef CONFIG_X86_64
682 case 8: asm("movdqu %0, %%xmm8" : : "m"(*data)); break;
683 case 9: asm("movdqu %0, %%xmm9" : : "m"(*data)); break;
684 case 10: asm("movdqu %0, %%xmm10" : : "m"(*data)); break;
685 case 11: asm("movdqu %0, %%xmm11" : : "m"(*data)); break;
686 case 12: asm("movdqu %0, %%xmm12" : : "m"(*data)); break;
687 case 13: asm("movdqu %0, %%xmm13" : : "m"(*data)); break;
688 case 14: asm("movdqu %0, %%xmm14" : : "m"(*data)); break;
689 case 15: asm("movdqu %0, %%xmm15" : : "m"(*data)); break;
690#endif
691 default: BUG();
692 }
693 ctxt->ops->put_fpu(ctxt);
694}
695
696static void decode_register_operand(struct x86_emulate_ctxt *ctxt,
697 struct operand *op,
3c118e24 698 struct decode_cache *c,
3c118e24
AK		 699 int inhibit_bytereg)
700{
33615aa9 701 unsigned reg = c->modrm_reg;
9f1ef3f8 702 int highbyte_regs = c->rex_prefix == 0;
33615aa9
AK		 703
704 if (!(c->d & ModRM))
705 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
1253791d
AK		 706
707 if (c->d & Sse) {
708 op->type = OP_XMM;
709 op->bytes = 16;
710 op->addr.xmm = reg;
711 read_sse_reg(ctxt, &op->vec_val, reg);
712 return;
713 }
714
3c118e24
AK		 715 op->type = OP_REG;
716 if ((c->d & ByteOp) && !inhibit_bytereg) {
1a6440ae 717 op->addr.reg = decode_register(reg, c->regs, highbyte_regs);
3c118e24
AK		 718 op->bytes = 1;
719 } else {
1a6440ae 720 op->addr.reg = decode_register(reg, c->regs, 0);
3c118e24 721 op->bytes = c->op_bytes;
3c118e24 722 }
91ff3cb4 723 fetch_register_operand(op);
3c118e24
AK		 724 op->orig_val = op->val;
725}
726
1c73ef66 727static int decode_modrm(struct x86_emulate_ctxt *ctxt,
2dbd0dd7
AK		 728 struct x86_emulate_ops *ops,
729 struct operand *op)
1c73ef66
AK		 730{
731 struct decode_cache *c = &ctxt->decode;
732 u8 sib;
f5b4edcd 733 int index_reg = 0, base_reg = 0, scale;
3e2815e9 734 int rc = X86EMUL_CONTINUE;
2dbd0dd7 735 ulong modrm_ea = 0;
1c73ef66
AK		 736
737 if (c->rex_prefix) {
738 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
739 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
740 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
741 }
742
743 c->modrm = insn_fetch(u8, 1, c->eip);
744 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
745 c->modrm_reg |= (c->modrm & 0x38) >> 3;
746 c->modrm_rm |= (c->modrm & 0x07);
09ee57cd 747 c->modrm_seg = VCPU_SREG_DS;
1c73ef66
AK		 748
749 if (c->modrm_mod == 3) {
2dbd0dd7
AK		 750 op->type = OP_REG;
751 op->bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
752 op->addr.reg = decode_register(c->modrm_rm,
107d6d2e 753 c->regs, c->d & ByteOp);
1253791d
AK		 754 if (c->d & Sse) {
755 op->type = OP_XMM;
756 op->bytes = 16;
757 op->addr.xmm = c->modrm_rm;
758 read_sse_reg(ctxt, &op->vec_val, c->modrm_rm);
759 return rc;
760 }
2dbd0dd7 761 fetch_register_operand(op);
1c73ef66
AK		 762 return rc;
763 }
764
2dbd0dd7
AK		 765 op->type = OP_MEM;
766
1c73ef66
AK		 767 if (c->ad_bytes == 2) {
768 unsigned bx = c->regs[VCPU_REGS_RBX];
769 unsigned bp = c->regs[VCPU_REGS_RBP];
770 unsigned si = c->regs[VCPU_REGS_RSI];
771 unsigned di = c->regs[VCPU_REGS_RDI];
772
773 /* 16-bit ModR/M decode. */
774 switch (c->modrm_mod) {
775 case 0:
776 if (c->modrm_rm == 6)
2dbd0dd7 777 modrm_ea += insn_fetch(u16, 2, c->eip);
1c73ef66
AK		 778 break;
779 case 1:
2dbd0dd7 780 modrm_ea += insn_fetch(s8, 1, c->eip);
1c73ef66
AK		 781 break;
782 case 2:
2dbd0dd7 783 modrm_ea += insn_fetch(u16, 2, c->eip);
1c73ef66
AK		 784 break;
785 }
786 switch (c->modrm_rm) {
787 case 0:
2dbd0dd7 788 modrm_ea += bx + si;
1c73ef66
AK		 789 break;
790 case 1:
2dbd0dd7 791 modrm_ea += bx + di;
1c73ef66
AK		 792 break;
793 case 2:
2dbd0dd7 794 modrm_ea += bp + si;
1c73ef66
AK		 795 break;
796 case 3:
2dbd0dd7 797 modrm_ea += bp + di;
1c73ef66
AK		 798 break;
799 case 4:
2dbd0dd7 800 modrm_ea += si;
1c73ef66
AK		 801 break;
802 case 5:
2dbd0dd7 803 modrm_ea += di;
1c73ef66
AK		 804 break;
805 case 6:
806 if (c->modrm_mod != 0)
2dbd0dd7 807 modrm_ea += bp;
1c73ef66
AK		 808 break;
809 case 7:
2dbd0dd7 810 modrm_ea += bx;
1c73ef66
AK		 811 break;
812 }
813 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
814 (c->modrm_rm == 6 && c->modrm_mod != 0))
09ee57cd 815 c->modrm_seg = VCPU_SREG_SS;
2dbd0dd7 816 modrm_ea = (u16)modrm_ea;
1c73ef66
AK		 817 } else {
818 /* 32/64-bit ModR/M decode. */
84411d85 819 if ((c->modrm_rm & 7) == 4) {
1c73ef66
AK		 820 sib = insn_fetch(u8, 1, c->eip);
821 index_reg |= (sib >> 3) & 7;
822 base_reg |= sib & 7;
823 scale = sib >> 6;
824
dc71d0f1 825 if ((base_reg & 7) == 5 && c->modrm_mod == 0)
2dbd0dd7 826 modrm_ea += insn_fetch(s32, 4, c->eip);
dc71d0f1 827 else
2dbd0dd7 828 modrm_ea += c->regs[base_reg];
dc71d0f1 829 if (index_reg != 4)
2dbd0dd7 830 modrm_ea += c->regs[index_reg] << scale;
84411d85
AK		 831 } else if ((c->modrm_rm & 7) == 5 && c->modrm_mod == 0) {
832 if (ctxt->mode == X86EMUL_MODE_PROT64)
f5b4edcd 833 c->rip_relative = 1;
84411d85 834 } else
2dbd0dd7 835 modrm_ea += c->regs[c->modrm_rm];
1c73ef66
AK		 836 switch (c->modrm_mod) {
837 case 0:
838 if (c->modrm_rm == 5)
2dbd0dd7 839 modrm_ea += insn_fetch(s32, 4, c->eip);
1c73ef66
AK		 840 break;
841 case 1:
2dbd0dd7 842 modrm_ea += insn_fetch(s8, 1, c->eip);
1c73ef66
AK		 843 break;
844 case 2:
2dbd0dd7 845 modrm_ea += insn_fetch(s32, 4, c->eip);
1c73ef66
AK		 846 break;
847 }
848 }
90de84f5 849 op->addr.mem.ea = modrm_ea;
1c73ef66
AK		 850done:
851 return rc;
852}
853
854static int decode_abs(struct x86_emulate_ctxt *ctxt,
2dbd0dd7
AK		 855 struct x86_emulate_ops *ops,
856 struct operand *op)
1c73ef66
AK		 857{
858 struct decode_cache *c = &ctxt->decode;
3e2815e9 859 int rc = X86EMUL_CONTINUE;
1c73ef66 860
2dbd0dd7 861 op->type = OP_MEM;
1c73ef66
AK		 862 switch (c->ad_bytes) {
863 case 2:
90de84f5 864 op->addr.mem.ea = insn_fetch(u16, 2, c->eip);
1c73ef66
AK		 865 break;
866 case 4:
90de84f5 867 op->addr.mem.ea = insn_fetch(u32, 4, c->eip);
1c73ef66
AK		 868 break;
869 case 8:
90de84f5 870 op->addr.mem.ea = insn_fetch(u64, 8, c->eip);
1c73ef66
AK		 871 break;
872 }
873done:
874 return rc;
875}
876
35c843c4
WY		 877static void fetch_bit_operand(struct decode_cache *c)
878{
7129eeca 879 long sv = 0, mask;
35c843c4 880
3885f18f 881 if (c->dst.type == OP_MEM && c->src.type == OP_REG) {
35c843c4
WY		 882 mask = ~(c->dst.bytes * 8 - 1);
883
884 if (c->src.bytes == 2)
885 sv = (s16)c->src.val & (s16)mask;
886 else if (c->src.bytes == 4)
887 sv = (s32)c->src.val & (s32)mask;
888
90de84f5 889 c->dst.addr.mem.ea += (sv >> 3);
35c843c4 890 }
ba7ff2b7
WY		 891
892 /* only subword offset */
893 c->src.val &= (c->dst.bytes << 3) - 1;
35c843c4
WY		 894}
895
dde7e6d1
AK		 896static int read_emulated(struct x86_emulate_ctxt *ctxt,
897 struct x86_emulate_ops *ops,
898 unsigned long addr, void *dest, unsigned size)
6aa8b732 899{
dde7e6d1
AK		 900 int rc;
901 struct read_cache *mc = &ctxt->decode.mem_read;
6aa8b732 902
dde7e6d1
AK		 903 while (size) {
904 int n = min(size, 8u);
905 size -= n;
906 if (mc->pos < mc->end)
907 goto read_cached;
5cd21917 908
bcc55cba
AK		 909 rc = ops->read_emulated(addr, mc->data + mc->end, n,
910 &ctxt->exception, ctxt->vcpu);
dde7e6d1
AK		 911 if (rc != X86EMUL_CONTINUE)
912 return rc;
913 mc->end += n;
6aa8b732 914
dde7e6d1
AK		 915 read_cached:
916 memcpy(dest, mc->data + mc->pos, n);
917 mc->pos += n;
918 dest += n;
919 addr += n;
6aa8b732 920 }
dde7e6d1
AK		 921 return X86EMUL_CONTINUE;
922}
6aa8b732 923
dde7e6d1
AK		 924static int pio_in_emulated(struct x86_emulate_ctxt *ctxt,
925 struct x86_emulate_ops *ops,
926 unsigned int size, unsigned short port,
927 void *dest)
928{
929 struct read_cache *rc = &ctxt->decode.io_read;
b4c6abfe 930
dde7e6d1
AK		 931 if (rc->pos == rc->end) { /* refill pio read ahead */
932 struct decode_cache *c = &ctxt->decode;
933 unsigned int in_page, n;
934 unsigned int count = c->rep_prefix ?
935 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1;
936 in_page = (ctxt->eflags & EFLG_DF) ?
937 offset_in_page(c->regs[VCPU_REGS_RDI]) :
938 PAGE_SIZE - offset_in_page(c->regs[VCPU_REGS_RDI]);
939 n = min(min(in_page, (unsigned int)sizeof(rc->data)) / size,
940 count);
941 if (n == 0)
942 n = 1;
943 rc->pos = rc->end = 0;
944 if (!ops->pio_in_emulated(size, port, rc->data, n, ctxt->vcpu))
945 return 0;
946 rc->end = n * size;
6aa8b732
AK		 947 }
948
dde7e6d1
AK		 949 memcpy(dest, rc->data + rc->pos, size);
950 rc->pos += size;
951 return 1;
952}
6aa8b732 953
dde7e6d1
AK		 954static u32 desc_limit_scaled(struct desc_struct *desc)
955{
956 u32 limit = get_desc_limit(desc);
6aa8b732 957
dde7e6d1
AK		 958 return desc->g ? (limit << 12) | 0xfff : limit;
959}
6aa8b732 960
dde7e6d1
AK		 961static void get_descriptor_table_ptr(struct x86_emulate_ctxt *ctxt,
962 struct x86_emulate_ops *ops,
963 u16 selector, struct desc_ptr *dt)
964{
965 if (selector & 1 << 2) {
966 struct desc_struct desc;
967 memset (dt, 0, sizeof *dt);
5601d05b
GN		 968 if (!ops->get_cached_descriptor(&desc, NULL, VCPU_SREG_LDTR,
969 ctxt->vcpu))
dde7e6d1 970 return;
e09d082c 971
dde7e6d1
AK		 972 dt->size = desc_limit_scaled(&desc); /* what if limit > 65535? */
973 dt->address = get_desc_base(&desc);
974 } else
975 ops->get_gdt(dt, ctxt->vcpu);
976}
120df890 977
dde7e6d1
AK		 978/* allowed just for 8 bytes segments */
979static int read_segment_descriptor(struct x86_emulate_ctxt *ctxt,
980 struct x86_emulate_ops *ops,
981 u16 selector, struct desc_struct *desc)
982{
983 struct desc_ptr dt;
984 u16 index = selector >> 3;
985 int ret;
dde7e6d1 986 ulong addr;
120df890 987
dde7e6d1 988 get_descriptor_table_ptr(ctxt, ops, selector, &dt);
120df890 989
35d3d4a1
AK		 990 if (dt.size < index * 8 + 7)
991 return emulate_gp(ctxt, selector & 0xfffc);
dde7e6d1 992 addr = dt.address + index * 8;
bcc55cba
AK		 993 ret = ops->read_std(addr, desc, sizeof *desc, ctxt->vcpu,
994 &ctxt->exception);
e09d082c 995
dde7e6d1
AK		 996 return ret;
997}
ef65c889 998
dde7e6d1
AK		 999/* allowed just for 8 bytes segments */
1000static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt,
1001 struct x86_emulate_ops *ops,
1002 u16 selector, struct desc_struct *desc)
1003{
1004 struct desc_ptr dt;
1005 u16 index = selector >> 3;
dde7e6d1
AK		 1006 ulong addr;
1007 int ret;
6aa8b732 1008
dde7e6d1 1009 get_descriptor_table_ptr(ctxt, ops, selector, &dt);
6e3d5dfb 1010
35d3d4a1
AK		 1011 if (dt.size < index * 8 + 7)
1012 return emulate_gp(ctxt, selector & 0xfffc);
6aa8b732 1013
dde7e6d1 1014 addr = dt.address + index * 8;
bcc55cba
AK		 1015 ret = ops->write_std(addr, desc, sizeof *desc, ctxt->vcpu,
1016 &ctxt->exception);
c7e75a3d 1017
dde7e6d1
AK		 1018 return ret;
1019}
c7e75a3d 1020
5601d05b 1021/* Does not support long mode */
dde7e6d1
AK		 1022static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
1023 struct x86_emulate_ops *ops,
1024 u16 selector, int seg)
1025{
1026 struct desc_struct seg_desc;
1027 u8 dpl, rpl, cpl;
1028 unsigned err_vec = GP_VECTOR;
1029 u32 err_code = 0;
1030 bool null_selector = !(selector & ~0x3); /* 0000-0003 are null */
1031 int ret;
69f55cb1 1032
dde7e6d1 1033 memset(&seg_desc, 0, sizeof seg_desc);
69f55cb1 1034
dde7e6d1
AK		 1035 if ((seg <= VCPU_SREG_GS && ctxt->mode == X86EMUL_MODE_VM86)
1036 || ctxt->mode == X86EMUL_MODE_REAL) {
1037 /* set real mode segment descriptor */
1038 set_desc_base(&seg_desc, selector << 4);
1039 set_desc_limit(&seg_desc, 0xffff);
1040 seg_desc.type = 3;
1041 seg_desc.p = 1;
1042 seg_desc.s = 1;
1043 goto load;
1044 }
1045
1046 /* NULL selector is not valid for TR, CS and SS */
1047 if ((seg == VCPU_SREG_CS || seg == VCPU_SREG_SS || seg == VCPU_SREG_TR)
1048 && null_selector)
1049 goto exception;
1050
1051 /* TR should be in GDT only */
1052 if (seg == VCPU_SREG_TR && (selector & (1 << 2)))
1053 goto exception;
1054
1055 if (null_selector) /* for NULL selector skip all following checks */
1056 goto load;
1057
1058 ret = read_segment_descriptor(ctxt, ops, selector, &seg_desc);
1059 if (ret != X86EMUL_CONTINUE)
1060 return ret;
1061
1062 err_code = selector & 0xfffc;
1063 err_vec = GP_VECTOR;
1064
1065 /* can't load system descriptor into segment selecor */
1066 if (seg <= VCPU_SREG_GS && !seg_desc.s)
1067 goto exception;
1068
1069 if (!seg_desc.p) {
1070 err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR;
1071 goto exception;
1072 }
1073
1074 rpl = selector & 3;
1075 dpl = seg_desc.dpl;
1076 cpl = ops->cpl(ctxt->vcpu);
1077
1078 switch (seg) {
1079 case VCPU_SREG_SS:
1080 /*
1081 * segment is not a writable data segment or segment
1082 * selector's RPL != CPL or segment selector's RPL != CPL
1083 */
1084 if (rpl != cpl || (seg_desc.type & 0xa) != 0x2 || dpl != cpl)
1085 goto exception;
6aa8b732 1086 break;
dde7e6d1
AK		 1087 case VCPU_SREG_CS:
1088 if (!(seg_desc.type & 8))
1089 goto exception;
1090
1091 if (seg_desc.type & 4) {
1092 /* conforming */
1093 if (dpl > cpl)
1094 goto exception;
1095 } else {
1096 /* nonconforming */
1097 if (rpl > cpl || dpl != cpl)
1098 goto exception;
1099 }
1100 /* CS(RPL) <- CPL */
1101 selector = (selector & 0xfffc) | cpl;
6aa8b732 1102 break;
dde7e6d1
AK		 1103 case VCPU_SREG_TR:
1104 if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9))
1105 goto exception;
1106 break;
1107 case VCPU_SREG_LDTR:
1108 if (seg_desc.s || seg_desc.type != 2)
1109 goto exception;
1110 break;
1111 default: /* DS, ES, FS, or GS */
4e62417b 1112 /*
dde7e6d1
AK		 1113 * segment is not a data or readable code segment or
1114 * ((segment is a data or nonconforming code segment)
1115 * and (both RPL and CPL > DPL))
4e62417b 1116 */
dde7e6d1
AK		 1117 if ((seg_desc.type & 0xa) == 0x8 ||
1118 (((seg_desc.type & 0xc) != 0xc) &&
1119 (rpl > dpl && cpl > dpl)))
1120 goto exception;
6aa8b732 1121 break;
dde7e6d1
AK		 1122 }
1123
1124 if (seg_desc.s) {
1125 /* mark segment as accessed */
1126 seg_desc.type |= 1;
1127 ret = write_segment_descriptor(ctxt, ops, selector, &seg_desc);
1128 if (ret != X86EMUL_CONTINUE)
1129 return ret;
1130 }
1131load:
1132 ops->set_segment_selector(selector, seg, ctxt->vcpu);
5601d05b 1133 ops->set_cached_descriptor(&seg_desc, 0, seg, ctxt->vcpu);
dde7e6d1
AK		 1134 return X86EMUL_CONTINUE;
1135exception:
1136 emulate_exception(ctxt, err_vec, err_code, true);
1137 return X86EMUL_PROPAGATE_FAULT;
1138}
1139
31be40b3
WY		 1140static void write_register_operand(struct operand *op)
1141{
1142 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1143 switch (op->bytes) {
1144 case 1:
1145 *(u8 *)op->addr.reg = (u8)op->val;
1146 break;
1147 case 2:
1148 *(u16 *)op->addr.reg = (u16)op->val;
1149 break;
1150 case 4:
1151 *op->addr.reg = (u32)op->val;
1152 break; /* 64b: zero-extend */
1153 case 8:
1154 *op->addr.reg = op->val;
1155 break;
1156 }
1157}
1158
dde7e6d1
AK		 1159static inline int writeback(struct x86_emulate_ctxt *ctxt,
1160 struct x86_emulate_ops *ops)
1161{
1162 int rc;
1163 struct decode_cache *c = &ctxt->decode;
dde7e6d1
AK		 1164
1165 switch (c->dst.type) {
1166 case OP_REG:
31be40b3 1167 write_register_operand(&c->dst);
6aa8b732 1168 break;
dde7e6d1
AK		 1169 case OP_MEM:
1170 if (c->lock_prefix)
1171 rc = ops->cmpxchg_emulated(
90de84f5 1172 linear(ctxt, c->dst.addr.mem),
dde7e6d1
AK		 1173 &c->dst.orig_val,
1174 &c->dst.val,
1175 c->dst.bytes,
bcc55cba 1176 &ctxt->exception,
dde7e6d1 1177 ctxt->vcpu);
341de7e3 1178 else
dde7e6d1 1179 rc = ops->write_emulated(
90de84f5 1180 linear(ctxt, c->dst.addr.mem),
dde7e6d1
AK		 1181 &c->dst.val,
1182 c->dst.bytes,
bcc55cba 1183 &ctxt->exception,
dde7e6d1 1184 ctxt->vcpu);
dde7e6d1
AK		 1185 if (rc != X86EMUL_CONTINUE)
1186 return rc;
a682e354 1187 break;
1253791d
AK		 1188 case OP_XMM:
1189 write_sse_reg(ctxt, &c->dst.vec_val, c->dst.addr.xmm);
1190 break;
dde7e6d1
AK		 1191 case OP_NONE:
1192 /* no writeback */
414e6277 1193 break;
dde7e6d1 1194 default:
414e6277 1195 break;
6aa8b732 1196 }
dde7e6d1
AK		 1197 return X86EMUL_CONTINUE;
1198}
6aa8b732 1199
dde7e6d1
AK		 1200static inline void emulate_push(struct x86_emulate_ctxt *ctxt,
1201 struct x86_emulate_ops *ops)
1202{
1203 struct decode_cache *c = &ctxt->decode;
0dc8d10f 1204
dde7e6d1
AK		 1205 c->dst.type = OP_MEM;
1206 c->dst.bytes = c->op_bytes;
1207 c->dst.val = c->src.val;
1208 register_address_increment(c, &c->regs[VCPU_REGS_RSP], -c->op_bytes);
90de84f5
AK		 1209 c->dst.addr.mem.ea = register_address(c, c->regs[VCPU_REGS_RSP]);
1210 c->dst.addr.mem.seg = VCPU_SREG_SS;
dde7e6d1 1211}
69f55cb1 1212
dde7e6d1
AK		 1213static int emulate_pop(struct x86_emulate_ctxt *ctxt,
1214 struct x86_emulate_ops *ops,
1215 void *dest, int len)
1216{
1217 struct decode_cache *c = &ctxt->decode;
1218 int rc;
90de84f5 1219 struct segmented_address addr;
8b4caf66 1220
90de84f5
AK		 1221 addr.ea = register_address(c, c->regs[VCPU_REGS_RSP]);
1222 addr.seg = VCPU_SREG_SS;
1223 rc = read_emulated(ctxt, ops, linear(ctxt, addr), dest, len);
dde7e6d1
AK		 1224 if (rc != X86EMUL_CONTINUE)
1225 return rc;
1226
1227 register_address_increment(c, &c->regs[VCPU_REGS_RSP], len);
1228 return rc;
8b4caf66
LV		 1229}
1230
dde7e6d1
AK		 1231static int emulate_popf(struct x86_emulate_ctxt *ctxt,
1232 struct x86_emulate_ops *ops,
1233 void *dest, int len)
9de41573
GN		 1234{
1235 int rc;
dde7e6d1
AK		 1236 unsigned long val, change_mask;
1237 int iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
1238 int cpl = ops->cpl(ctxt->vcpu);
9de41573 1239
dde7e6d1
AK		 1240 rc = emulate_pop(ctxt, ops, &val, len);
1241 if (rc != X86EMUL_CONTINUE)
1242 return rc;
9de41573 1243
dde7e6d1
AK		 1244 change_mask = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF | EFLG_OF
1245 | EFLG_TF | EFLG_DF | EFLG_NT | EFLG_RF | EFLG_AC | EFLG_ID;
9de41573 1246
dde7e6d1
AK		 1247 switch(ctxt->mode) {
1248 case X86EMUL_MODE_PROT64:
1249 case X86EMUL_MODE_PROT32:
1250 case X86EMUL_MODE_PROT16:
1251 if (cpl == 0)
1252 change_mask |= EFLG_IOPL;
1253 if (cpl <= iopl)
1254 change_mask |= EFLG_IF;
1255 break;
1256 case X86EMUL_MODE_VM86:
35d3d4a1
AK		 1257 if (iopl < 3)
1258 return emulate_gp(ctxt, 0);
dde7e6d1
AK		 1259 change_mask |= EFLG_IF;
1260 break;
1261 default: /* real mode */
1262 change_mask |= (EFLG_IOPL | EFLG_IF);
1263 break;
9de41573 1264 }
dde7e6d1
AK		 1265
1266 *(unsigned long *)dest =
1267 (ctxt->eflags & ~change_mask) | (val & change_mask);
1268
1269 return rc;
9de41573
GN		 1270}
1271
dde7e6d1
AK		 1272static void emulate_push_sreg(struct x86_emulate_ctxt *ctxt,
1273 struct x86_emulate_ops *ops, int seg)
7b262e90 1274{
dde7e6d1 1275 struct decode_cache *c = &ctxt->decode;
7b262e90 1276
dde7e6d1 1277 c->src.val = ops->get_segment_selector(seg, ctxt->vcpu);
7b262e90 1278
dde7e6d1 1279 emulate_push(ctxt, ops);
7b262e90
GN		 1280}
1281
dde7e6d1
AK		 1282static int emulate_pop_sreg(struct x86_emulate_ctxt *ctxt,
1283 struct x86_emulate_ops *ops, int seg)
38ba30ba 1284{
dde7e6d1
AK		 1285 struct decode_cache *c = &ctxt->decode;
1286 unsigned long selector;
1287 int rc;
38ba30ba 1288
dde7e6d1
AK		 1289 rc = emulate_pop(ctxt, ops, &selector, c->op_bytes);
1290 if (rc != X86EMUL_CONTINUE)
1291 return rc;
1292
1293 rc = load_segment_descriptor(ctxt, ops, (u16)selector, seg);
1294 return rc;
38ba30ba
GN		 1295}
1296
dde7e6d1
AK		 1297static int emulate_pusha(struct x86_emulate_ctxt *ctxt,
1298 struct x86_emulate_ops *ops)
38ba30ba 1299{
dde7e6d1
AK		 1300 struct decode_cache *c = &ctxt->decode;
1301 unsigned long old_esp = c->regs[VCPU_REGS_RSP];
1302 int rc = X86EMUL_CONTINUE;
1303 int reg = VCPU_REGS_RAX;
38ba30ba 1304
dde7e6d1
AK		 1305 while (reg <= VCPU_REGS_RDI) {
1306 (reg == VCPU_REGS_RSP) ?
1307 (c->src.val = old_esp) : (c->src.val = c->regs[reg]);
38ba30ba 1308
dde7e6d1 1309 emulate_push(ctxt, ops);
38ba30ba 1310
dde7e6d1
AK		 1311 rc = writeback(ctxt, ops);
1312 if (rc != X86EMUL_CONTINUE)
1313 return rc;
38ba30ba 1314
dde7e6d1 1315 ++reg;
38ba30ba 1316 }
38ba30ba 1317
dde7e6d1
AK		 1318 /* Disable writeback. */
1319 c->dst.type = OP_NONE;
1320
1321 return rc;
38ba30ba
GN		 1322}
1323
dde7e6d1
AK		 1324static int emulate_popa(struct x86_emulate_ctxt *ctxt,
1325 struct x86_emulate_ops *ops)
38ba30ba 1326{
dde7e6d1
AK		 1327 struct decode_cache *c = &ctxt->decode;
1328 int rc = X86EMUL_CONTINUE;
1329 int reg = VCPU_REGS_RDI;
38ba30ba 1330
dde7e6d1
AK		 1331 while (reg >= VCPU_REGS_RAX) {
1332 if (reg == VCPU_REGS_RSP) {
1333 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1334 c->op_bytes);
1335 --reg;
1336 }
38ba30ba 1337
dde7e6d1
AK		 1338 rc = emulate_pop(ctxt, ops, &c->regs[reg], c->op_bytes);
1339 if (rc != X86EMUL_CONTINUE)
1340 break;
1341 --reg;
38ba30ba 1342 }
dde7e6d1 1343 return rc;
38ba30ba
GN		 1344}
1345
6e154e56
MG		 1346int emulate_int_real(struct x86_emulate_ctxt *ctxt,
1347 struct x86_emulate_ops *ops, int irq)
1348{
1349 struct decode_cache *c = &ctxt->decode;
5c56e1cf 1350 int rc;
6e154e56
MG		 1351 struct desc_ptr dt;
1352 gva_t cs_addr;
1353 gva_t eip_addr;
1354 u16 cs, eip;
6e154e56
MG		 1355
1356 /* TODO: Add limit checks */
1357 c->src.val = ctxt->eflags;
1358 emulate_push(ctxt, ops);
5c56e1cf
AK		 1359 rc = writeback(ctxt, ops);
1360 if (rc != X86EMUL_CONTINUE)
1361 return rc;
6e154e56
MG		 1362
1363 ctxt->eflags &= ~(EFLG_IF | EFLG_TF | EFLG_AC);
1364
1365 c->src.val = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
1366 emulate_push(ctxt, ops);
5c56e1cf
AK		 1367 rc = writeback(ctxt, ops);
1368 if (rc != X86EMUL_CONTINUE)
1369 return rc;
6e154e56
MG		 1370
1371 c->src.val = c->eip;
1372 emulate_push(ctxt, ops);
5c56e1cf
AK		 1373 rc = writeback(ctxt, ops);
1374 if (rc != X86EMUL_CONTINUE)
1375 return rc;
1376
1377 c->dst.type = OP_NONE;
6e154e56
MG		 1378
1379 ops->get_idt(&dt, ctxt->vcpu);
1380
1381 eip_addr = dt.address + (irq << 2);
1382 cs_addr = dt.address + (irq << 2) + 2;
1383
bcc55cba 1384 rc = ops->read_std(cs_addr, &cs, 2, ctxt->vcpu, &ctxt->exception);
6e154e56
MG		 1385 if (rc != X86EMUL_CONTINUE)
1386 return rc;
1387
bcc55cba 1388 rc = ops->read_std(eip_addr, &eip, 2, ctxt->vcpu, &ctxt->exception);
6e154e56
MG		 1389 if (rc != X86EMUL_CONTINUE)
1390 return rc;
1391
1392 rc = load_segment_descriptor(ctxt, ops, cs, VCPU_SREG_CS);
1393 if (rc != X86EMUL_CONTINUE)
1394 return rc;
1395
1396 c->eip = eip;
1397
1398 return rc;
1399}
1400
1401static int emulate_int(struct x86_emulate_ctxt *ctxt,
1402 struct x86_emulate_ops *ops, int irq)
1403{
1404 switch(ctxt->mode) {
1405 case X86EMUL_MODE_REAL:
1406 return emulate_int_real(ctxt, ops, irq);
1407 case X86EMUL_MODE_VM86:
1408 case X86EMUL_MODE_PROT16:
1409 case X86EMUL_MODE_PROT32:
1410 case X86EMUL_MODE_PROT64:
1411 default:
1412 /* Protected mode interrupts unimplemented yet */
1413 return X86EMUL_UNHANDLEABLE;
1414 }
1415}
1416
dde7e6d1
AK		 1417static int emulate_iret_real(struct x86_emulate_ctxt *ctxt,
1418 struct x86_emulate_ops *ops)
38ba30ba 1419{
dde7e6d1
AK		 1420 struct decode_cache *c = &ctxt->decode;
1421 int rc = X86EMUL_CONTINUE;
1422 unsigned long temp_eip = 0;
1423 unsigned long temp_eflags = 0;
1424 unsigned long cs = 0;
1425 unsigned long mask = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF | EFLG_TF |
1426 EFLG_IF | EFLG_DF | EFLG_OF | EFLG_IOPL | EFLG_NT | EFLG_RF |
1427 EFLG_AC | EFLG_ID | (1 << 1); /* Last one is the reserved bit */
1428 unsigned long vm86_mask = EFLG_VM | EFLG_VIF | EFLG_VIP;
38ba30ba 1429
dde7e6d1 1430 /* TODO: Add stack limit check */
38ba30ba 1431
dde7e6d1 1432 rc = emulate_pop(ctxt, ops, &temp_eip, c->op_bytes);
38ba30ba 1433
dde7e6d1
AK		 1434 if (rc != X86EMUL_CONTINUE)
1435 return rc;
38ba30ba 1436
35d3d4a1
AK		 1437 if (temp_eip & ~0xffff)
1438 return emulate_gp(ctxt, 0);
38ba30ba 1439
dde7e6d1 1440 rc = emulate_pop(ctxt, ops, &cs, c->op_bytes);
38ba30ba 1441
dde7e6d1
AK		 1442 if (rc != X86EMUL_CONTINUE)
1443 return rc;
38ba30ba 1444
dde7e6d1 1445 rc = emulate_pop(ctxt, ops, &temp_eflags, c->op_bytes);
38ba30ba 1446
dde7e6d1
AK		 1447 if (rc != X86EMUL_CONTINUE)
1448 return rc;
38ba30ba 1449
dde7e6d1 1450 rc = load_segment_descriptor(ctxt, ops, (u16)cs, VCPU_SREG_CS);
38ba30ba 1451
dde7e6d1
AK		 1452 if (rc != X86EMUL_CONTINUE)
1453 return rc;
38ba30ba 1454
dde7e6d1 1455 c->eip = temp_eip;
38ba30ba 1456
38ba30ba 1457
dde7e6d1
AK		 1458 if (c->op_bytes == 4)
1459 ctxt->eflags = ((temp_eflags & mask) | (ctxt->eflags & vm86_mask));
1460 else if (c->op_bytes == 2) {
1461 ctxt->eflags &= ~0xffff;
1462 ctxt->eflags |= temp_eflags;
38ba30ba 1463 }
dde7e6d1
AK		 1464
1465 ctxt->eflags &= ~EFLG_RESERVED_ZEROS_MASK; /* Clear reserved zeros */
1466 ctxt->eflags |= EFLG_RESERVED_ONE_MASK;
1467
1468 return rc;
38ba30ba
GN		 1469}
1470
dde7e6d1
AK		 1471static inline int emulate_iret(struct x86_emulate_ctxt *ctxt,
1472 struct x86_emulate_ops* ops)
c37eda13 1473{
dde7e6d1
AK		 1474 switch(ctxt->mode) {
1475 case X86EMUL_MODE_REAL:
1476 return emulate_iret_real(ctxt, ops);
1477 case X86EMUL_MODE_VM86:
1478 case X86EMUL_MODE_PROT16:
1479 case X86EMUL_MODE_PROT32:
1480 case X86EMUL_MODE_PROT64:
c37eda13 1481 default:
dde7e6d1
AK		 1482 /* iret from protected mode unimplemented yet */
1483 return X86EMUL_UNHANDLEABLE;
c37eda13 1484 }
c37eda13
WY		 1485}
1486
dde7e6d1 1487static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
79168fd1 1488 struct x86_emulate_ops *ops)
8cdbd2c9
LV		 1489{
1490 struct decode_cache *c = &ctxt->decode;
1491
dde7e6d1 1492 return emulate_pop(ctxt, ops, &c->dst.val, c->dst.bytes);
8cdbd2c9
LV		 1493}
1494
dde7e6d1 1495static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
8cdbd2c9 1496{
05f086f8 1497 struct decode_cache *c = &ctxt->decode;
8cdbd2c9
LV		 1498 switch (c->modrm_reg) {
1499 case 0: /* rol */
05f086f8 1500 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1501 break;
1502 case 1: /* ror */
05f086f8 1503 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1504 break;
1505 case 2: /* rcl */
05f086f8 1506 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1507 break;
1508 case 3: /* rcr */
05f086f8 1509 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1510 break;
1511 case 4: /* sal/shl */
1512 case 6: /* sal/shl */
05f086f8 1513 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1514 break;
1515 case 5: /* shr */
05f086f8 1516 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1517 break;
1518 case 7: /* sar */
05f086f8 1519 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1520 break;
1521 }
1522}
1523
1524static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
05f086f8 1525 struct x86_emulate_ops *ops)
8cdbd2c9
LV		 1526{
1527 struct decode_cache *c = &ctxt->decode;
3f9f53b0
MG		 1528 unsigned long *rax = &c->regs[VCPU_REGS_RAX];
1529 unsigned long *rdx = &c->regs[VCPU_REGS_RDX];
34d1f490 1530 u8 de = 0;
8cdbd2c9
LV		 1531
1532 switch (c->modrm_reg) {
1533 case 0 ... 1: /* test */
05f086f8 1534 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
8cdbd2c9
LV		 1535 break;
1536 case 2: /* not */
1537 c->dst.val = ~c->dst.val;
1538 break;
1539 case 3: /* neg */
05f086f8 1540 emulate_1op("neg", c->dst, ctxt->eflags);
8cdbd2c9 1541 break;
3f9f53b0
MG		 1542 case 4: /* mul */
1543 emulate_1op_rax_rdx("mul", c->src, *rax, *rdx, ctxt->eflags);
1544 break;
1545 case 5: /* imul */
1546 emulate_1op_rax_rdx("imul", c->src, *rax, *rdx, ctxt->eflags);
1547 break;
1548 case 6: /* div */
34d1f490
AK		 1549 emulate_1op_rax_rdx_ex("div", c->src, *rax, *rdx,
1550 ctxt->eflags, de);
3f9f53b0
MG		 1551 break;
1552 case 7: /* idiv */
34d1f490
AK		 1553 emulate_1op_rax_rdx_ex("idiv", c->src, *rax, *rdx,
1554 ctxt->eflags, de);
3f9f53b0 1555 break;
8cdbd2c9 1556 default:
8c5eee30 1557 return X86EMUL_UNHANDLEABLE;
8cdbd2c9 1558 }
34d1f490
AK		 1559 if (de)
1560 return emulate_de(ctxt);
8c5eee30 1561 return X86EMUL_CONTINUE;
8cdbd2c9
LV		 1562}
1563
1564static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
a01af5ec 1565 struct x86_emulate_ops *ops)
8cdbd2c9
LV		 1566{
1567 struct decode_cache *c = &ctxt->decode;
8cdbd2c9
LV		 1568
1569 switch (c->modrm_reg) {
1570 case 0: /* inc */
05f086f8 1571 emulate_1op("inc", c->dst, ctxt->eflags);
8cdbd2c9
LV		 1572 break;
1573 case 1: /* dec */
05f086f8 1574 emulate_1op("dec", c->dst, ctxt->eflags);
8cdbd2c9 1575 break;
d19292e4
MG		 1576 case 2: /* call near abs */ {
1577 long int old_eip;
1578 old_eip = c->eip;
1579 c->eip = c->src.val;
1580 c->src.val = old_eip;
79168fd1 1581 emulate_push(ctxt, ops);
d19292e4
MG		 1582 break;
1583 }
8cdbd2c9 1584 case 4: /* jmp abs */
fd60754e 1585 c->eip = c->src.val;
8cdbd2c9
LV		 1586 break;
1587 case 6: /* push */
79168fd1 1588 emulate_push(ctxt, ops);
8cdbd2c9 1589 break;
8cdbd2c9 1590 }
1b30eaa8 1591 return X86EMUL_CONTINUE;
8cdbd2c9
LV		 1592}
1593
1594static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
69f55cb1 1595 struct x86_emulate_ops *ops)
8cdbd2c9
LV		 1596{
1597 struct decode_cache *c = &ctxt->decode;
16518d5a 1598 u64 old = c->dst.orig_val64;
8cdbd2c9
LV		 1599
1600 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1601 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
8cdbd2c9
LV		 1602 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1603 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
05f086f8 1604 ctxt->eflags &= ~EFLG_ZF;
8cdbd2c9 1605 } else {
16518d5a
AK		 1606 c->dst.val64 = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1607 (u32) c->regs[VCPU_REGS_RBX];
8cdbd2c9 1608
05f086f8 1609 ctxt->eflags |= EFLG_ZF;
8cdbd2c9 1610 }
1b30eaa8 1611 return X86EMUL_CONTINUE;
8cdbd2c9
LV		 1612}
1613
a77ab5ea
AK		 1614static int emulate_ret_far(struct x86_emulate_ctxt *ctxt,
1615 struct x86_emulate_ops *ops)
1616{
1617 struct decode_cache *c = &ctxt->decode;
1618 int rc;
1619 unsigned long cs;
1620
1621 rc = emulate_pop(ctxt, ops, &c->eip, c->op_bytes);
1b30eaa8 1622 if (rc != X86EMUL_CONTINUE)
a77ab5ea
AK		 1623 return rc;
1624 if (c->op_bytes == 4)
1625 c->eip = (u32)c->eip;
1626 rc = emulate_pop(ctxt, ops, &cs, c->op_bytes);
1b30eaa8 1627 if (rc != X86EMUL_CONTINUE)
a77ab5ea 1628 return rc;
2e873022 1629 rc = load_segment_descriptor(ctxt, ops, (u16)cs, VCPU_SREG_CS);
a77ab5ea
AK		 1630 return rc;
1631}
1632
09b5f4d3
WY		 1633static int emulate_load_segment(struct x86_emulate_ctxt *ctxt,
1634 struct x86_emulate_ops *ops, int seg)
1635{
1636 struct decode_cache *c = &ctxt->decode;
1637 unsigned short sel;
1638 int rc;
1639
1640 memcpy(&sel, c->src.valptr + c->op_bytes, 2);
1641
1642 rc = load_segment_descriptor(ctxt, ops, sel, seg);
1643 if (rc != X86EMUL_CONTINUE)
1644 return rc;
1645
1646 c->dst.val = c->src.val;
1647 return rc;
1648}
1649
e66bb2cc
AP		 1650static inline void
1651setup_syscalls_segments(struct x86_emulate_ctxt *ctxt,
79168fd1
GN		 1652 struct x86_emulate_ops *ops, struct desc_struct *cs,
1653 struct desc_struct *ss)
e66bb2cc 1654{
79168fd1 1655 memset(cs, 0, sizeof(struct desc_struct));
5601d05b 1656 ops->get_cached_descriptor(cs, NULL, VCPU_SREG_CS, ctxt->vcpu);
79168fd1 1657 memset(ss, 0, sizeof(struct desc_struct));
e66bb2cc
AP		 1658
1659 cs->l = 0; /* will be adjusted later */
79168fd1 1660 set_desc_base(cs, 0); /* flat segment */
e66bb2cc 1661 cs->g = 1; /* 4kb granularity */
79168fd1 1662 set_desc_limit(cs, 0xfffff); /* 4GB limit */
e66bb2cc
AP		 1663 cs->type = 0x0b; /* Read, Execute, Accessed */
1664 cs->s = 1;
1665 cs->dpl = 0; /* will be adjusted later */
79168fd1
GN		 1666 cs->p = 1;
1667 cs->d = 1;
e66bb2cc 1668
79168fd1
GN		 1669 set_desc_base(ss, 0); /* flat segment */
1670 set_desc_limit(ss, 0xfffff); /* 4GB limit */
e66bb2cc
AP		 1671 ss->g = 1; /* 4kb granularity */
1672 ss->s = 1;
1673 ss->type = 0x03; /* Read/Write, Accessed */
79168fd1 1674 ss->d = 1; /* 32bit stack segment */
e66bb2cc 1675 ss->dpl = 0;
79168fd1 1676 ss->p = 1;
e66bb2cc
AP		 1677}
1678
1679static int
3fb1b5db 1680emulate_syscall(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
e66bb2cc
AP		 1681{
1682 struct decode_cache *c = &ctxt->decode;
79168fd1 1683 struct desc_struct cs, ss;
e66bb2cc 1684 u64 msr_data;
79168fd1 1685 u16 cs_sel, ss_sel;
e66bb2cc
AP		 1686
1687 /* syscall is not available in real mode */
2e901c4c 1688 if (ctxt->mode == X86EMUL_MODE_REAL ||
35d3d4a1
AK		 1689 ctxt->mode == X86EMUL_MODE_VM86)
1690 return emulate_ud(ctxt);
e66bb2cc 1691
79168fd1 1692 setup_syscalls_segments(ctxt, ops, &cs, &ss);
e66bb2cc 1693
3fb1b5db 1694 ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
e66bb2cc 1695 msr_data >>= 32;
79168fd1
GN		 1696 cs_sel = (u16)(msr_data & 0xfffc);
1697 ss_sel = (u16)(msr_data + 8);
e66bb2cc
AP		 1698
1699 if (is_long_mode(ctxt->vcpu)) {
79168fd1 1700 cs.d = 0;
e66bb2cc
AP		 1701 cs.l = 1;
1702 }
5601d05b 1703 ops->set_cached_descriptor(&cs, 0, VCPU_SREG_CS, ctxt->vcpu);
79168fd1 1704 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
5601d05b 1705 ops->set_cached_descriptor(&ss, 0, VCPU_SREG_SS, ctxt->vcpu);
79168fd1 1706 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
e66bb2cc
AP		 1707
1708 c->regs[VCPU_REGS_RCX] = c->eip;
1709 if (is_long_mode(ctxt->vcpu)) {
1710#ifdef CONFIG_X86_64
1711 c->regs[VCPU_REGS_R11] = ctxt->eflags & ~EFLG_RF;
1712
3fb1b5db
GN		 1713 ops->get_msr(ctxt->vcpu,
1714 ctxt->mode == X86EMUL_MODE_PROT64 ?
1715 MSR_LSTAR : MSR_CSTAR, &msr_data);
e66bb2cc
AP		 1716 c->eip = msr_data;
1717
3fb1b5db 1718 ops->get_msr(ctxt->vcpu, MSR_SYSCALL_MASK, &msr_data);
e66bb2cc
AP		 1719 ctxt->eflags &= ~(msr_data | EFLG_RF);
1720#endif
1721 } else {
1722 /* legacy mode */
3fb1b5db 1723 ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
e66bb2cc
AP		 1724 c->eip = (u32)msr_data;
1725
1726 ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
1727 }
1728
e54cfa97 1729 return X86EMUL_CONTINUE;
e66bb2cc
AP		 1730}
1731
8c604352 1732static int
3fb1b5db 1733emulate_sysenter(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
8c604352
AP		 1734{
1735 struct decode_cache *c = &ctxt->decode;
79168fd1 1736 struct desc_struct cs, ss;
8c604352 1737 u64 msr_data;
79168fd1 1738 u16 cs_sel, ss_sel;
8c604352 1739
a0044755 1740 /* inject #GP if in real mode */
35d3d4a1
AK		 1741 if (ctxt->mode == X86EMUL_MODE_REAL)
1742 return emulate_gp(ctxt, 0);
8c604352
AP		 1743
1744 /* XXX sysenter/sysexit have not been tested in 64bit mode.
1745 * Therefore, we inject an #UD.
1746 */
35d3d4a1
AK		 1747 if (ctxt->mode == X86EMUL_MODE_PROT64)
1748 return emulate_ud(ctxt);
8c604352 1749
79168fd1 1750 setup_syscalls_segments(ctxt, ops, &cs, &ss);
8c604352 1751
3fb1b5db 1752 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_CS, &msr_data);
8c604352
AP		 1753 switch (ctxt->mode) {
1754 case X86EMUL_MODE_PROT32:
35d3d4a1
AK		 1755 if ((msr_data & 0xfffc) == 0x0)
1756 return emulate_gp(ctxt, 0);
8c604352
AP		 1757 break;
1758 case X86EMUL_MODE_PROT64:
35d3d4a1
AK		 1759 if (msr_data == 0x0)
1760 return emulate_gp(ctxt, 0);
8c604352
AP		 1761 break;
1762 }
1763
1764 ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
79168fd1
GN		 1765 cs_sel = (u16)msr_data;
1766 cs_sel &= ~SELECTOR_RPL_MASK;
1767 ss_sel = cs_sel + 8;
1768 ss_sel &= ~SELECTOR_RPL_MASK;
8c604352
AP		 1769 if (ctxt->mode == X86EMUL_MODE_PROT64
1770 || is_long_mode(ctxt->vcpu)) {
79168fd1 1771 cs.d = 0;
8c604352
AP		 1772 cs.l = 1;
1773 }
1774
5601d05b 1775 ops->set_cached_descriptor(&cs, 0, VCPU_SREG_CS, ctxt->vcpu);
79168fd1 1776 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
5601d05b 1777 ops->set_cached_descriptor(&ss, 0, VCPU_SREG_SS, ctxt->vcpu);
79168fd1 1778 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
8c604352 1779
3fb1b5db 1780 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_EIP, &msr_data);
8c604352
AP		 1781 c->eip = msr_data;
1782
3fb1b5db 1783 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_ESP, &msr_data);
8c604352
AP		 1784 c->regs[VCPU_REGS_RSP] = msr_data;
1785
e54cfa97 1786 return X86EMUL_CONTINUE;
8c604352
AP		 1787}
1788
4668f050 1789static int
3fb1b5db 1790emulate_sysexit(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
4668f050
AP		 1791{
1792 struct decode_cache *c = &ctxt->decode;
79168fd1 1793 struct desc_struct cs, ss;
4668f050
AP		 1794 u64 msr_data;
1795 int usermode;
79168fd1 1796 u16 cs_sel, ss_sel;
4668f050 1797
a0044755
GN		 1798 /* inject #GP if in real mode or Virtual 8086 mode */
1799 if (ctxt->mode == X86EMUL_MODE_REAL ||
35d3d4a1
AK		 1800 ctxt->mode == X86EMUL_MODE_VM86)
1801 return emulate_gp(ctxt, 0);
4668f050 1802
79168fd1 1803 setup_syscalls_segments(ctxt, ops, &cs, &ss);
4668f050
AP		 1804
1805 if ((c->rex_prefix & 0x8) != 0x0)
1806 usermode = X86EMUL_MODE_PROT64;
1807 else
1808 usermode = X86EMUL_MODE_PROT32;
1809
1810 cs.dpl = 3;
1811 ss.dpl = 3;
3fb1b5db 1812 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_CS, &msr_data);
4668f050
AP		 1813 switch (usermode) {
1814 case X86EMUL_MODE_PROT32:
79168fd1 1815 cs_sel = (u16)(msr_data + 16);
35d3d4a1
AK		 1816 if ((msr_data & 0xfffc) == 0x0)
1817 return emulate_gp(ctxt, 0);
79168fd1 1818 ss_sel = (u16)(msr_data + 24);
4668f050
AP		 1819 break;
1820 case X86EMUL_MODE_PROT64:
79168fd1 1821 cs_sel = (u16)(msr_data + 32);
35d3d4a1
AK		 1822 if (msr_data == 0x0)
1823 return emulate_gp(ctxt, 0);
79168fd1
GN		 1824 ss_sel = cs_sel + 8;
1825 cs.d = 0;
4668f050
AP		 1826 cs.l = 1;
1827 break;
1828 }
79168fd1
GN		 1829 cs_sel |= SELECTOR_RPL_MASK;
1830 ss_sel |= SELECTOR_RPL_MASK;
4668f050 1831
5601d05b 1832 ops->set_cached_descriptor(&cs, 0, VCPU_SREG_CS, ctxt->vcpu);
79168fd1 1833 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
5601d05b 1834 ops->set_cached_descriptor(&ss, 0, VCPU_SREG_SS, ctxt->vcpu);
79168fd1 1835 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
4668f050 1836
bdb475a3
GN		 1837 c->eip = c->regs[VCPU_REGS_RDX];
1838 c->regs[VCPU_REGS_RSP] = c->regs[VCPU_REGS_RCX];
4668f050 1839
e54cfa97 1840 return X86EMUL_CONTINUE;
4668f050
AP		 1841}
1842
9c537244
GN		 1843static bool emulator_bad_iopl(struct x86_emulate_ctxt *ctxt,
1844 struct x86_emulate_ops *ops)
f850e2e6
GN		 1845{
1846 int iopl;
1847 if (ctxt->mode == X86EMUL_MODE_REAL)
1848 return false;
1849 if (ctxt->mode == X86EMUL_MODE_VM86)
1850 return true;
1851 iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
9c537244 1852 return ops->cpl(ctxt->vcpu) > iopl;
f850e2e6
GN		 1853}
1854
1855static bool emulator_io_port_access_allowed(struct x86_emulate_ctxt *ctxt,
1856 struct x86_emulate_ops *ops,
1857 u16 port, u16 len)
1858{
79168fd1 1859 struct desc_struct tr_seg;
5601d05b 1860 u32 base3;
f850e2e6 1861 int r;
399a40c9 1862 u16 io_bitmap_ptr, perm, bit_idx = port & 0x7;
f850e2e6 1863 unsigned mask = (1 << len) - 1;
5601d05b 1864 unsigned long base;
f850e2e6 1865
5601d05b 1866 ops->get_cached_descriptor(&tr_seg, &base3, VCPU_SREG_TR, ctxt->vcpu);
79168fd1 1867 if (!tr_seg.p)
f850e2e6 1868 return false;
79168fd1 1869 if (desc_limit_scaled(&tr_seg) < 103)
f850e2e6 1870 return false;
5601d05b
GN		 1871 base = get_desc_base(&tr_seg);
1872#ifdef CONFIG_X86_64
1873 base |= ((u64)base3) << 32;
1874#endif
1875 r = ops->read_std(base + 102, &io_bitmap_ptr, 2, ctxt->vcpu, NULL);
f850e2e6
GN		 1876 if (r != X86EMUL_CONTINUE)
1877 return false;
79168fd1 1878 if (io_bitmap_ptr + port/8 > desc_limit_scaled(&tr_seg))
f850e2e6 1879 return false;
399a40c9 1880 r = ops->read_std(base + io_bitmap_ptr + port/8, &perm, 2, ctxt->vcpu,
5601d05b 1881 NULL);
f850e2e6
GN		 1882 if (r != X86EMUL_CONTINUE)
1883 return false;
1884 if ((perm >> bit_idx) & mask)
1885 return false;
1886 return true;
1887}
1888
1889static bool emulator_io_permited(struct x86_emulate_ctxt *ctxt,
1890 struct x86_emulate_ops *ops,
1891 u16 port, u16 len)
1892{
4fc40f07
GN		 1893 if (ctxt->perm_ok)
1894 return true;
1895
9c537244 1896 if (emulator_bad_iopl(ctxt, ops))
f850e2e6
GN		 1897 if (!emulator_io_port_access_allowed(ctxt, ops, port, len))
1898 return false;
4fc40f07
GN		 1899
1900 ctxt->perm_ok = true;
1901
f850e2e6
GN		 1902 return true;
1903}
1904
38ba30ba
GN		 1905static void save_state_to_tss16(struct x86_emulate_ctxt *ctxt,
1906 struct x86_emulate_ops *ops,
1907 struct tss_segment_16 *tss)
1908{
1909 struct decode_cache *c = &ctxt->decode;
1910
1911 tss->ip = c->eip;
1912 tss->flag = ctxt->eflags;
1913 tss->ax = c->regs[VCPU_REGS_RAX];
1914 tss->cx = c->regs[VCPU_REGS_RCX];
1915 tss->dx = c->regs[VCPU_REGS_RDX];
1916 tss->bx = c->regs[VCPU_REGS_RBX];
1917 tss->sp = c->regs[VCPU_REGS_RSP];
1918 tss->bp = c->regs[VCPU_REGS_RBP];
1919 tss->si = c->regs[VCPU_REGS_RSI];
1920 tss->di = c->regs[VCPU_REGS_RDI];
1921
1922 tss->es = ops->get_segment_selector(VCPU_SREG_ES, ctxt->vcpu);
1923 tss->cs = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
1924 tss->ss = ops->get_segment_selector(VCPU_SREG_SS, ctxt->vcpu);
1925 tss->ds = ops->get_segment_selector(VCPU_SREG_DS, ctxt->vcpu);
1926 tss->ldt = ops->get_segment_selector(VCPU_SREG_LDTR, ctxt->vcpu);
1927}
1928
1929static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
1930 struct x86_emulate_ops *ops,
1931 struct tss_segment_16 *tss)
1932{
1933 struct decode_cache *c = &ctxt->decode;
1934 int ret;
1935
1936 c->eip = tss->ip;
1937 ctxt->eflags = tss->flag | 2;
1938 c->regs[VCPU_REGS_RAX] = tss->ax;
1939 c->regs[VCPU_REGS_RCX] = tss->cx;
1940 c->regs[VCPU_REGS_RDX] = tss->dx;
1941 c->regs[VCPU_REGS_RBX] = tss->bx;
1942 c->regs[VCPU_REGS_RSP] = tss->sp;
1943 c->regs[VCPU_REGS_RBP] = tss->bp;
1944 c->regs[VCPU_REGS_RSI] = tss->si;
1945 c->regs[VCPU_REGS_RDI] = tss->di;
1946
1947 /*
1948 * SDM says that segment selectors are loaded before segment
1949 * descriptors
1950 */
1951 ops->set_segment_selector(tss->ldt, VCPU_SREG_LDTR, ctxt->vcpu);
1952 ops->set_segment_selector(tss->es, VCPU_SREG_ES, ctxt->vcpu);
1953 ops->set_segment_selector(tss->cs, VCPU_SREG_CS, ctxt->vcpu);
1954 ops->set_segment_selector(tss->ss, VCPU_SREG_SS, ctxt->vcpu);
1955 ops->set_segment_selector(tss->ds, VCPU_SREG_DS, ctxt->vcpu);
1956
1957 /*
1958 * Now load segment descriptors. If fault happenes at this stage
1959 * it is handled in a context of new task
1960 */
1961 ret = load_segment_descriptor(ctxt, ops, tss->ldt, VCPU_SREG_LDTR);
1962 if (ret != X86EMUL_CONTINUE)
1963 return ret;
1964 ret = load_segment_descriptor(ctxt, ops, tss->es, VCPU_SREG_ES);
1965 if (ret != X86EMUL_CONTINUE)
1966 return ret;
1967 ret = load_segment_descriptor(ctxt, ops, tss->cs, VCPU_SREG_CS);
1968 if (ret != X86EMUL_CONTINUE)
1969 return ret;
1970 ret = load_segment_descriptor(ctxt, ops, tss->ss, VCPU_SREG_SS);
1971 if (ret != X86EMUL_CONTINUE)
1972 return ret;
1973 ret = load_segment_descriptor(ctxt, ops, tss->ds, VCPU_SREG_DS);
1974 if (ret != X86EMUL_CONTINUE)
1975 return ret;
1976
1977 return X86EMUL_CONTINUE;
1978}
1979
1980static int task_switch_16(struct x86_emulate_ctxt *ctxt,
1981 struct x86_emulate_ops *ops,
1982 u16 tss_selector, u16 old_tss_sel,
1983 ulong old_tss_base, struct desc_struct *new_desc)
1984{
1985 struct tss_segment_16 tss_seg;
1986 int ret;
bcc55cba 1987 u32 new_tss_base = get_desc_base(new_desc);
38ba30ba
GN		 1988
1989 ret = ops->read_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
bcc55cba 1990 &ctxt->exception);
db297e3d 1991 if (ret != X86EMUL_CONTINUE)
38ba30ba 1992 /* FIXME: need to provide precise fault address */
38ba30ba 1993 return ret;
38ba30ba
GN		 1994
1995 save_state_to_tss16(ctxt, ops, &tss_seg);
1996
1997 ret = ops->write_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
bcc55cba 1998 &ctxt->exception);
db297e3d 1999 if (ret != X86EMUL_CONTINUE)
38ba30ba 2000 /* FIXME: need to provide precise fault address */
38ba30ba 2001 return ret;
38ba30ba
GN		 2002
2003 ret = ops->read_std(new_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
bcc55cba 2004 &ctxt->exception);
db297e3d 2005 if (ret != X86EMUL_CONTINUE)
38ba30ba 2006 /* FIXME: need to provide precise fault address */
38ba30ba 2007 return ret;
38ba30ba
GN		 2008
2009 if (old_tss_sel != 0xffff) {
2010 tss_seg.prev_task_link = old_tss_sel;
2011
2012 ret = ops->write_std(new_tss_base,
2013 &tss_seg.prev_task_link,
2014 sizeof tss_seg.prev_task_link,
bcc55cba 2015 ctxt->vcpu, &ctxt->exception);
db297e3d 2016 if (ret != X86EMUL_CONTINUE)
38ba30ba 2017 /* FIXME: need to provide precise fault address */
38ba30ba 2018 return ret;
38ba30ba
GN		 2019 }
2020
2021 return load_state_from_tss16(ctxt, ops, &tss_seg);
2022}
2023
2024static void save_state_to_tss32(struct x86_emulate_ctxt *ctxt,
2025 struct x86_emulate_ops *ops,
2026 struct tss_segment_32 *tss)
2027{
2028 struct decode_cache *c = &ctxt->decode;
2029
2030 tss->cr3 = ops->get_cr(3, ctxt->vcpu);
2031 tss->eip = c->eip;
2032 tss->eflags = ctxt->eflags;
2033 tss->eax = c->regs[VCPU_REGS_RAX];
2034 tss->ecx = c->regs[VCPU_REGS_RCX];
2035 tss->edx = c->regs[VCPU_REGS_RDX];
2036 tss->ebx = c->regs[VCPU_REGS_RBX];
2037 tss->esp = c->regs[VCPU_REGS_RSP];
2038 tss->ebp = c->regs[VCPU_REGS_RBP];
2039 tss->esi = c->regs[VCPU_REGS_RSI];
2040 tss->edi = c->regs[VCPU_REGS_RDI];
2041
2042 tss->es = ops->get_segment_selector(VCPU_SREG_ES, ctxt->vcpu);
2043 tss->cs = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
2044 tss->ss = ops->get_segment_selector(VCPU_SREG_SS, ctxt->vcpu);
2045 tss->ds = ops->get_segment_selector(VCPU_SREG_DS, ctxt->vcpu);
2046 tss->fs = ops->get_segment_selector(VCPU_SREG_FS, ctxt->vcpu);
2047 tss->gs = ops->get_segment_selector(VCPU_SREG_GS, ctxt->vcpu);
2048 tss->ldt_selector = ops->get_segment_selector(VCPU_SREG_LDTR, ctxt->vcpu);
2049}
2050
2051static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
2052 struct x86_emulate_ops *ops,
2053 struct tss_segment_32 *tss)
2054{
2055 struct decode_cache *c = &ctxt->decode;
2056 int ret;
2057
35d3d4a1
AK		 2058 if (ops->set_cr(3, tss->cr3, ctxt->vcpu))
2059 return emulate_gp(ctxt, 0);
38ba30ba
GN		 2060 c->eip = tss->eip;
2061 ctxt->eflags = tss->eflags | 2;
2062 c->regs[VCPU_REGS_RAX] = tss->eax;
2063 c->regs[VCPU_REGS_RCX] = tss->ecx;
2064 c->regs[VCPU_REGS_RDX] = tss->edx;
2065 c->regs[VCPU_REGS_RBX] = tss->ebx;
2066 c->regs[VCPU_REGS_RSP] = tss->esp;
2067 c->regs[VCPU_REGS_RBP] = tss->ebp;
2068 c->regs[VCPU_REGS_RSI] = tss->esi;
2069 c->regs[VCPU_REGS_RDI] = tss->edi;
2070
2071 /*
2072 * SDM says that segment selectors are loaded before segment
2073 * descriptors
2074 */
2075 ops->set_segment_selector(tss->ldt_selector, VCPU_SREG_LDTR, ctxt->vcpu);
2076 ops->set_segment_selector(tss->es, VCPU_SREG_ES, ctxt->vcpu);
2077 ops->set_segment_selector(tss->cs, VCPU_SREG_CS, ctxt->vcpu);
2078 ops->set_segment_selector(tss->ss, VCPU_SREG_SS, ctxt->vcpu);
2079 ops->set_segment_selector(tss->ds, VCPU_SREG_DS, ctxt->vcpu);
2080 ops->set_segment_selector(tss->fs, VCPU_SREG_FS, ctxt->vcpu);
2081 ops->set_segment_selector(tss->gs, VCPU_SREG_GS, ctxt->vcpu);
2082
2083 /*
2084 * Now load segment descriptors. If fault happenes at this stage
2085 * it is handled in a context of new task
2086 */
2087 ret = load_segment_descriptor(ctxt, ops, tss->ldt_selector, VCPU_SREG_LDTR);
2088 if (ret != X86EMUL_CONTINUE)
2089 return ret;
2090 ret = load_segment_descriptor(ctxt, ops, tss->es, VCPU_SREG_ES);
2091 if (ret != X86EMUL_CONTINUE)
2092 return ret;
2093 ret = load_segment_descriptor(ctxt, ops, tss->cs, VCPU_SREG_CS);
2094 if (ret != X86EMUL_CONTINUE)
2095 return ret;
2096 ret = load_segment_descriptor(ctxt, ops, tss->ss, VCPU_SREG_SS);
2097 if (ret != X86EMUL_CONTINUE)
2098 return ret;
2099 ret = load_segment_descriptor(ctxt, ops, tss->ds, VCPU_SREG_DS);
2100 if (ret != X86EMUL_CONTINUE)
2101 return ret;
2102 ret = load_segment_descriptor(ctxt, ops, tss->fs, VCPU_SREG_FS);
2103 if (ret != X86EMUL_CONTINUE)
2104 return ret;
2105 ret = load_segment_descriptor(ctxt, ops, tss->gs, VCPU_SREG_GS);
2106 if (ret != X86EMUL_CONTINUE)
2107 return ret;
2108
2109 return X86EMUL_CONTINUE;
2110}
2111
2112static int task_switch_32(struct x86_emulate_ctxt *ctxt,
2113 struct x86_emulate_ops *ops,
2114 u16 tss_selector, u16 old_tss_sel,
2115 ulong old_tss_base, struct desc_struct *new_desc)
2116{
2117 struct tss_segment_32 tss_seg;
2118 int ret;
bcc55cba 2119 u32 new_tss_base = get_desc_base(new_desc);
38ba30ba
GN		 2120
2121 ret = ops->read_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
bcc55cba 2122 &ctxt->exception);
db297e3d 2123 if (ret != X86EMUL_CONTINUE)
38ba30ba 2124 /* FIXME: need to provide precise fault address */
38ba30ba 2125 return ret;
38ba30ba
GN		 2126
2127 save_state_to_tss32(ctxt, ops, &tss_seg);
2128
2129 ret = ops->write_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
bcc55cba 2130 &ctxt->exception);
db297e3d 2131 if (ret != X86EMUL_CONTINUE)
38ba30ba 2132 /* FIXME: need to provide precise fault address */
38ba30ba 2133 return ret;
38ba30ba
GN		 2134
2135 ret = ops->read_std(new_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
bcc55cba 2136 &ctxt->exception);
db297e3d 2137 if (ret != X86EMUL_CONTINUE)
38ba30ba 2138 /* FIXME: need to provide precise fault address */
38ba30ba 2139 return ret;
38ba30ba
GN		 2140
2141 if (old_tss_sel != 0xffff) {
2142 tss_seg.prev_task_link = old_tss_sel;
2143
2144 ret = ops->write_std(new_tss_base,
2145 &tss_seg.prev_task_link,
2146 sizeof tss_seg.prev_task_link,
bcc55cba 2147 ctxt->vcpu, &ctxt->exception);
db297e3d 2148 if (ret != X86EMUL_CONTINUE)
38ba30ba 2149 /* FIXME: need to provide precise fault address */
38ba30ba 2150 return ret;
38ba30ba
GN		 2151 }
2152
2153 return load_state_from_tss32(ctxt, ops, &tss_seg);
2154}
2155
2156static int emulator_do_task_switch(struct x86_emulate_ctxt *ctxt,
e269fb21
JK		 2157 struct x86_emulate_ops *ops,
2158 u16 tss_selector, int reason,
2159 bool has_error_code, u32 error_code)
38ba30ba
GN		 2160{
2161 struct desc_struct curr_tss_desc, next_tss_desc;
2162 int ret;
2163 u16 old_tss_sel = ops->get_segment_selector(VCPU_SREG_TR, ctxt->vcpu);
2164 ulong old_tss_base =
5951c442 2165 ops->get_cached_segment_base(VCPU_SREG_TR, ctxt->vcpu);
ceffb459 2166 u32 desc_limit;
38ba30ba
GN		 2167
2168 /* FIXME: old_tss_base == ~0 ? */
2169
2170 ret = read_segment_descriptor(ctxt, ops, tss_selector, &next_tss_desc);
2171 if (ret != X86EMUL_CONTINUE)
2172 return ret;
2173 ret = read_segment_descriptor(ctxt, ops, old_tss_sel, &curr_tss_desc);
2174 if (ret != X86EMUL_CONTINUE)
2175 return ret;
2176
2177 /* FIXME: check that next_tss_desc is tss */
2178
2179 if (reason != TASK_SWITCH_IRET) {
2180 if ((tss_selector & 3) > next_tss_desc.dpl ||
35d3d4a1
AK		 2181 ops->cpl(ctxt->vcpu) > next_tss_desc.dpl)
2182 return emulate_gp(ctxt, 0);
38ba30ba
GN		 2183 }
2184
ceffb459
GN		 2185 desc_limit = desc_limit_scaled(&next_tss_desc);
2186 if (!next_tss_desc.p ||
2187 ((desc_limit < 0x67 && (next_tss_desc.type & 8)) ||
2188 desc_limit < 0x2b)) {
54b8486f 2189 emulate_ts(ctxt, tss_selector & 0xfffc);
38ba30ba
GN		 2190 return X86EMUL_PROPAGATE_FAULT;
2191 }
2192
2193 if (reason == TASK_SWITCH_IRET || reason == TASK_SWITCH_JMP) {
2194 curr_tss_desc.type &= ~(1 << 1); /* clear busy flag */
2195 write_segment_descriptor(ctxt, ops, old_tss_sel,
2196 &curr_tss_desc);
2197 }
2198
2199 if (reason == TASK_SWITCH_IRET)
2200 ctxt->eflags = ctxt->eflags & ~X86_EFLAGS_NT;
2201
2202 /* set back link to prev task only if NT bit is set in eflags
2203 note that old_tss_sel is not used afetr this point */
2204 if (reason != TASK_SWITCH_CALL && reason != TASK_SWITCH_GATE)
2205 old_tss_sel = 0xffff;
2206
2207 if (next_tss_desc.type & 8)
2208 ret = task_switch_32(ctxt, ops, tss_selector, old_tss_sel,
2209 old_tss_base, &next_tss_desc);
2210 else
2211 ret = task_switch_16(ctxt, ops, tss_selector, old_tss_sel,
2212 old_tss_base, &next_tss_desc);
0760d448
JK		 2213 if (ret != X86EMUL_CONTINUE)
2214 return ret;
38ba30ba
GN		 2215
2216 if (reason == TASK_SWITCH_CALL || reason == TASK_SWITCH_GATE)
2217 ctxt->eflags = ctxt->eflags | X86_EFLAGS_NT;
2218
2219 if (reason != TASK_SWITCH_IRET) {
2220 next_tss_desc.type |= (1 << 1); /* set busy flag */
2221 write_segment_descriptor(ctxt, ops, tss_selector,
2222 &next_tss_desc);
2223 }
2224
2225 ops->set_cr(0, ops->get_cr(0, ctxt->vcpu) | X86_CR0_TS, ctxt->vcpu);
5601d05b 2226 ops->set_cached_descriptor(&next_tss_desc, 0, VCPU_SREG_TR, ctxt->vcpu);
38ba30ba
GN		 2227 ops->set_segment_selector(tss_selector, VCPU_SREG_TR, ctxt->vcpu);
2228
e269fb21
JK		 2229 if (has_error_code) {
2230 struct decode_cache *c = &ctxt->decode;
2231
2232 c->op_bytes = c->ad_bytes = (next_tss_desc.type & 8) ? 4 : 2;
2233 c->lock_prefix = 0;
2234 c->src.val = (unsigned long) error_code;
79168fd1 2235 emulate_push(ctxt, ops);
e269fb21
JK		 2236 }
2237
38ba30ba
GN		 2238 return ret;
2239}
2240
2241int emulator_task_switch(struct x86_emulate_ctxt *ctxt,
e269fb21
JK		 2242 u16 tss_selector, int reason,
2243 bool has_error_code, u32 error_code)
38ba30ba 2244{
9aabc88f 2245 struct x86_emulate_ops *ops = ctxt->ops;
38ba30ba
GN		 2246 struct decode_cache *c = &ctxt->decode;
2247 int rc;
2248
38ba30ba 2249 c->eip = ctxt->eip;
e269fb21 2250 c->dst.type = OP_NONE;
38ba30ba 2251
e269fb21
JK		 2252 rc = emulator_do_task_switch(ctxt, ops, tss_selector, reason,
2253 has_error_code, error_code);
38ba30ba
GN		 2254
2255 if (rc == X86EMUL_CONTINUE) {
e269fb21 2256 rc = writeback(ctxt, ops);
95c55886
GN		 2257 if (rc == X86EMUL_CONTINUE)
2258 ctxt->eip = c->eip;
38ba30ba
GN		 2259 }
2260
19d04437 2261 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
38ba30ba
GN		 2262}
2263
90de84f5 2264static void string_addr_inc(struct x86_emulate_ctxt *ctxt, unsigned seg,
d9271123 2265 int reg, struct operand *op)
a682e354
GN		 2266{
2267 struct decode_cache *c = &ctxt->decode;
2268 int df = (ctxt->eflags & EFLG_DF) ? -1 : 1;
2269
d9271123 2270 register_address_increment(c, &c->regs[reg], df * op->bytes);
90de84f5
AK		 2271 op->addr.mem.ea = register_address(c, c->regs[reg]);
2272 op->addr.mem.seg = seg;
a682e354
GN		 2273}
2274
63540382
AK		 2275static int em_push(struct x86_emulate_ctxt *ctxt)
2276{
2277 emulate_push(ctxt, ctxt->ops);
2278 return X86EMUL_CONTINUE;
2279}
2280
7af04fc0
AK		 2281static int em_das(struct x86_emulate_ctxt *ctxt)
2282{
2283 struct decode_cache *c = &ctxt->decode;
2284 u8 al, old_al;
2285 bool af, cf, old_cf;
2286
2287 cf = ctxt->eflags & X86_EFLAGS_CF;
2288 al = c->dst.val;
2289
2290 old_al = al;
2291 old_cf = cf;
2292 cf = false;
2293 af = ctxt->eflags & X86_EFLAGS_AF;
2294 if ((al & 0x0f) > 9 || af) {
2295 al -= 6;
2296 cf = old_cf | (al >= 250);
2297 af = true;
2298 } else {
2299 af = false;
2300 }
2301 if (old_al > 0x99 || old_cf) {
2302 al -= 0x60;
2303 cf = true;
2304 }
2305
2306 c->dst.val = al;
2307 /* Set PF, ZF, SF */
2308 c->src.type = OP_IMM;
2309 c->src.val = 0;
2310 c->src.bytes = 1;
2311 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
2312 ctxt->eflags &= ~(X86_EFLAGS_AF | X86_EFLAGS_CF);
2313 if (cf)
2314 ctxt->eflags |= X86_EFLAGS_CF;
2315 if (af)
2316 ctxt->eflags |= X86_EFLAGS_AF;
2317 return X86EMUL_CONTINUE;
2318}
2319
0ef753b8
AK		 2320static int em_call_far(struct x86_emulate_ctxt *ctxt)
2321{
2322 struct decode_cache *c = &ctxt->decode;
2323 u16 sel, old_cs;
2324 ulong old_eip;
2325 int rc;
2326
2327 old_cs = ctxt->ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
2328 old_eip = c->eip;
2329
2330 memcpy(&sel, c->src.valptr + c->op_bytes, 2);
2331 if (load_segment_descriptor(ctxt, ctxt->ops, sel, VCPU_SREG_CS))
2332 return X86EMUL_CONTINUE;
2333
2334 c->eip = 0;
2335 memcpy(&c->eip, c->src.valptr, c->op_bytes);
2336
2337 c->src.val = old_cs;
2338 emulate_push(ctxt, ctxt->ops);
2339 rc = writeback(ctxt, ctxt->ops);
2340 if (rc != X86EMUL_CONTINUE)
2341 return rc;
2342
2343 c->src.val = old_eip;
2344 emulate_push(ctxt, ctxt->ops);
2345 rc = writeback(ctxt, ctxt->ops);
2346 if (rc != X86EMUL_CONTINUE)
2347 return rc;
2348
2349 c->dst.type = OP_NONE;
2350
2351 return X86EMUL_CONTINUE;
2352}
2353
40ece7c7
AK		 2354static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt)
2355{
2356 struct decode_cache *c = &ctxt->decode;
2357 int rc;
2358
2359 c->dst.type = OP_REG;
2360 c->dst.addr.reg = &c->eip;
2361 c->dst.bytes = c->op_bytes;
2362 rc = emulate_pop(ctxt, ctxt->ops, &c->dst.val, c->op_bytes);
2363 if (rc != X86EMUL_CONTINUE)
2364 return rc;
2365 register_address_increment(c, &c->regs[VCPU_REGS_RSP], c->src.val);
2366 return X86EMUL_CONTINUE;
2367}
2368
5c82aa29 2369static int em_imul(struct x86_emulate_ctxt *ctxt)
f3a1b9f4
AK		 2370{
2371 struct decode_cache *c = &ctxt->decode;
2372
f3a1b9f4
AK		 2373 emulate_2op_SrcV_nobyte("imul", c->src, c->dst, ctxt->eflags);
2374 return X86EMUL_CONTINUE;
2375}
2376
5c82aa29
AK		 2377static int em_imul_3op(struct x86_emulate_ctxt *ctxt)
2378{
2379 struct decode_cache *c = &ctxt->decode;
2380
2381 c->dst.val = c->src2.val;
2382 return em_imul(ctxt);
2383}
2384
61429142
AK		 2385static int em_cwd(struct x86_emulate_ctxt *ctxt)
2386{
2387 struct decode_cache *c = &ctxt->decode;
2388
2389 c->dst.type = OP_REG;
2390 c->dst.bytes = c->src.bytes;
2391 c->dst.addr.reg = &c->regs[VCPU_REGS_RDX];
2392 c->dst.val = ~((c->src.val >> (c->src.bytes * 8 - 1)) - 1);
2393
2394 return X86EMUL_CONTINUE;
2395}
2396
48bb5d3c
AK		 2397static int em_rdtsc(struct x86_emulate_ctxt *ctxt)
2398{
2399 unsigned cpl = ctxt->ops->cpl(ctxt->vcpu);
2400 struct decode_cache *c = &ctxt->decode;
2401 u64 tsc = 0;
2402
35d3d4a1
AK		 2403 if (cpl > 0 && (ctxt->ops->get_cr(4, ctxt->vcpu) & X86_CR4_TSD))
2404 return emulate_gp(ctxt, 0);
48bb5d3c
AK		 2405 ctxt->ops->get_msr(ctxt->vcpu, MSR_IA32_TSC, &tsc);
2406 c->regs[VCPU_REGS_RAX] = (u32)tsc;
2407 c->regs[VCPU_REGS_RDX] = tsc >> 32;
2408 return X86EMUL_CONTINUE;
2409}
2410
b9eac5f4
AK		 2411static int em_mov(struct x86_emulate_ctxt *ctxt)
2412{
2413 struct decode_cache *c = &ctxt->decode;
2414 c->dst.val = c->src.val;
2415 return X86EMUL_CONTINUE;
2416}
2417
aa97bb48
AK		 2418static int em_movdqu(struct x86_emulate_ctxt *ctxt)
2419{
2420 struct decode_cache *c = &ctxt->decode;
2421 memcpy(&c->dst.vec_val, &c->src.vec_val, c->op_bytes);
2422 return X86EMUL_CONTINUE;
2423}
2424
73fba5f4
AK		 2425#define D(_y) { .flags = (_y) }
2426#define N D(0)
2427#define G(_f, _g) { .flags = ((_f) | Group), .u.group = (_g) }
2428#define GD(_f, _g) { .flags = ((_f) | Group | GroupDual), .u.gdual = (_g) }
2429#define I(_f, _e) { .flags = (_f), .u.execute = (_e) }
aa97bb48 2430#define GP(_f, _g) { .flags = ((_f) | Prefix), .u.gprefix = (_g) }
73fba5f4 2431
8d8f4e9f
AK		 2432#define D2bv(_f) D((_f) | ByteOp), D(_f)
2433#define I2bv(_f, _e) I((_f) | ByteOp, _e), I(_f, _e)
2434
6230f7fc
AK		 2435#define D6ALU(_f) D2bv((_f) | DstMem | SrcReg | ModRM), \
2436 D2bv(((_f) | DstReg | SrcMem | ModRM) & ~Lock), \
2437 D2bv(((_f) & ~Lock) | DstAcc | SrcImm)
2438
2439
73fba5f4
AK		 2440static struct opcode group1[] = {
2441 X7(D(Lock)), N
2442};
2443
2444static struct opcode group1A[] = {
2445 D(DstMem | SrcNone | ModRM | Mov | Stack), N, N, N, N, N, N, N,
2446};
2447
2448static struct opcode group3[] = {
2449 D(DstMem | SrcImm | ModRM), D(DstMem | SrcImm | ModRM),
2450 D(DstMem | SrcNone | ModRM | Lock), D(DstMem | SrcNone | ModRM | Lock),
3f9f53b0 2451 X4(D(SrcMem | ModRM)),
73fba5f4
AK		 2452};
2453
2454static struct opcode group4[] = {
2455 D(ByteOp | DstMem | SrcNone | ModRM | Lock), D(ByteOp | DstMem | SrcNone | ModRM | Lock),
2456 N, N, N, N, N, N,
2457};
2458
2459static struct opcode group5[] = {
2460 D(DstMem | SrcNone | ModRM | Lock), D(DstMem | SrcNone | ModRM | Lock),
0ef753b8
AK		 2461 D(SrcMem | ModRM | Stack),
2462 I(SrcMemFAddr | ModRM | ImplicitOps | Stack, em_call_far),
73fba5f4
AK		 2463 D(SrcMem | ModRM | Stack), D(SrcMemFAddr | ModRM | ImplicitOps),
2464 D(SrcMem | ModRM | Stack), N,
2465};
2466
2467static struct group_dual group7 = { {
2468 N, N, D(ModRM | SrcMem | Priv), D(ModRM | SrcMem | Priv),
2469 D(SrcNone | ModRM | DstMem | Mov), N,
5a506b12
AK		 2470 D(SrcMem16 | ModRM | Mov | Priv),
2471 D(SrcMem | ModRM | ByteOp | Priv | NoAccess),
73fba5f4 2472}, {
d867162c
AK		 2473 D(SrcNone | ModRM | Priv | VendorSpecific), N,
2474 N, D(SrcNone | ModRM | Priv | VendorSpecific),
73fba5f4
AK		 2475 D(SrcNone | ModRM | DstMem | Mov), N,
2476 D(SrcMem16 | ModRM | Mov | Priv), N,
2477} };
2478
2479static struct opcode group8[] = {
2480 N, N, N, N,
2481 D(DstMem | SrcImmByte | ModRM), D(DstMem | SrcImmByte | ModRM | Lock),
2482 D(DstMem | SrcImmByte | ModRM | Lock), D(DstMem | SrcImmByte | ModRM | Lock),
2483};
2484
2485static struct group_dual group9 = { {
2486 N, D(DstMem64 | ModRM | Lock), N, N, N, N, N, N,
2487}, {
2488 N, N, N, N, N, N, N, N,
2489} };
2490
a4d4a7c1
AK		 2491static struct opcode group11[] = {
2492 I(DstMem | SrcImm | ModRM | Mov, em_mov), X7(D(Undefined)),
2493};
2494
aa97bb48
AK		 2495static struct gprefix pfx_0f_6f_0f_7f = {
2496 N, N, N, I(Sse, em_movdqu),
2497};
2498
73fba5f4
AK		 2499static struct opcode opcode_table[256] = {
2500 /* 0x00 - 0x07 */
6230f7fc 2501 D6ALU(Lock),
73fba5f4
AK		 2502 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
2503 /* 0x08 - 0x0F */
6230f7fc 2504 D6ALU(Lock),
73fba5f4
AK		 2505 D(ImplicitOps | Stack | No64), N,
2506 /* 0x10 - 0x17 */
6230f7fc 2507 D6ALU(Lock),
73fba5f4
AK		 2508 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
2509 /* 0x18 - 0x1F */
6230f7fc 2510 D6ALU(Lock),
73fba5f4
AK		 2511 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
2512 /* 0x20 - 0x27 */
6230f7fc 2513 D6ALU(Lock), N, N,
73fba5f4 2514 /* 0x28 - 0x2F */
6230f7fc 2515 D6ALU(Lock), N, I(ByteOp | DstAcc | No64, em_das),
73fba5f4 2516 /* 0x30 - 0x37 */
6230f7fc 2517 D6ALU(Lock), N, N,
73fba5f4 2518 /* 0x38 - 0x3F */
6230f7fc 2519 D6ALU(0), N, N,
73fba5f4
AK		 2520 /* 0x40 - 0x4F */
2521 X16(D(DstReg)),
2522 /* 0x50 - 0x57 */
63540382 2523 X8(I(SrcReg | Stack, em_push)),
73fba5f4
AK		 2524 /* 0x58 - 0x5F */
2525 X8(D(DstReg | Stack)),
2526 /* 0x60 - 0x67 */
2527 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
2528 N, D(DstReg | SrcMem32 | ModRM | Mov) /* movsxd (x86/64) */ ,
2529 N, N, N, N,
2530 /* 0x68 - 0x6F */
d46164db
AK		 2531 I(SrcImm | Mov | Stack, em_push),
2532 I(DstReg | SrcMem | ModRM | Src2Imm, em_imul_3op),
f3a1b9f4
AK		 2533 I(SrcImmByte | Mov | Stack, em_push),
2534 I(DstReg | SrcMem | ModRM | Src2ImmByte, em_imul_3op),
48fe67b5
AK		 2535 D2bv(DstDI | Mov | String), /* insb, insw/insd */
2536 D2bv(SrcSI | ImplicitOps | String), /* outsb, outsw/outsd */
73fba5f4
AK		 2537 /* 0x70 - 0x7F */
2538 X16(D(SrcImmByte)),
2539 /* 0x80 - 0x87 */
2540 G(ByteOp | DstMem | SrcImm | ModRM | Group, group1),
2541 G(DstMem | SrcImm | ModRM | Group, group1),
2542 G(ByteOp | DstMem | SrcImm | ModRM | No64 | Group, group1),
2543 G(DstMem | SrcImmByte | ModRM | Group, group1),
76e8e68d 2544 D2bv(DstMem | SrcReg | ModRM), D2bv(DstMem | SrcReg | ModRM | Lock),
73fba5f4 2545 /* 0x88 - 0x8F */
b9eac5f4
AK		 2546 I2bv(DstMem | SrcReg | ModRM | Mov, em_mov),
2547 I2bv(DstReg | SrcMem | ModRM | Mov, em_mov),
342fc630 2548 D(DstMem | SrcNone | ModRM | Mov), D(ModRM | SrcMem | NoAccess | DstReg),
73fba5f4
AK		 2549 D(ImplicitOps | SrcMem16 | ModRM), G(0, group1A),
2550 /* 0x90 - 0x97 */
3d9e77df 2551 X8(D(SrcAcc | DstReg)),
73fba5f4 2552 /* 0x98 - 0x9F */
61429142 2553 D(DstAcc | SrcNone), I(ImplicitOps | SrcAcc, em_cwd),
cc4feed5 2554 I(SrcImmFAddr | No64, em_call_far), N,
73fba5f4
AK		 2555 D(ImplicitOps | Stack), D(ImplicitOps | Stack), N, N,
2556 /* 0xA0 - 0xA7 */
b9eac5f4
AK		 2557 I2bv(DstAcc | SrcMem | Mov | MemAbs, em_mov),
2558 I2bv(DstMem | SrcAcc | Mov | MemAbs, em_mov),
2559 I2bv(SrcSI | DstDI | Mov | String, em_mov),
2560 D2bv(SrcSI | DstDI | String),
73fba5f4 2561 /* 0xA8 - 0xAF */
50748613 2562 D2bv(DstAcc | SrcImm),
b9eac5f4
AK		 2563 I2bv(SrcAcc | DstDI | Mov | String, em_mov),
2564 I2bv(SrcSI | DstAcc | Mov | String, em_mov),
48fe67b5 2565 D2bv(SrcAcc | DstDI | String),
73fba5f4 2566 /* 0xB0 - 0xB7 */
b9eac5f4 2567 X8(I(ByteOp | DstReg | SrcImm | Mov, em_mov)),
73fba5f4 2568 /* 0xB8 - 0xBF */
b9eac5f4 2569 X8(I(DstReg | SrcImm | Mov, em_mov)),
73fba5f4 2570 /* 0xC0 - 0xC7 */
d2c6c7ad 2571 D2bv(DstMem | SrcImmByte | ModRM),
40ece7c7
AK		 2572 I(ImplicitOps | Stack | SrcImmU16, em_ret_near_imm),
2573 D(ImplicitOps | Stack),
09b5f4d3 2574 D(DstReg | SrcMemFAddr | ModRM | No64), D(DstReg | SrcMemFAddr | ModRM | No64),
a4d4a7c1 2575 G(ByteOp, group11), G(0, group11),
73fba5f4
AK		 2576 /* 0xC8 - 0xCF */
2577 N, N, N, D(ImplicitOps | Stack),
2578 D(ImplicitOps), D(SrcImmByte), D(ImplicitOps | No64), D(ImplicitOps),
2579 /* 0xD0 - 0xD7 */
d2c6c7ad 2580 D2bv(DstMem | SrcOne | ModRM), D2bv(DstMem | ModRM),
73fba5f4
AK		 2581 N, N, N, N,
2582 /* 0xD8 - 0xDF */
2583 N, N, N, N, N, N, N, N,
2584 /* 0xE0 - 0xE7 */
e4abac67 2585 X4(D(SrcImmByte)),
d269e396 2586 D2bv(SrcImmUByte | DstAcc), D2bv(SrcAcc | DstImmUByte),
73fba5f4
AK		 2587 /* 0xE8 - 0xEF */
2588 D(SrcImm | Stack), D(SrcImm | ImplicitOps),
2589 D(SrcImmFAddr | No64), D(SrcImmByte | ImplicitOps),
d269e396 2590 D2bv(SrcNone | DstAcc), D2bv(SrcAcc | ImplicitOps),
73fba5f4
AK		 2591 /* 0xF0 - 0xF7 */
2592 N, N, N, N,
2593 D(ImplicitOps | Priv), D(ImplicitOps), G(ByteOp, group3), G(0, group3),
2594 /* 0xF8 - 0xFF */
8744aa9a 2595 D(ImplicitOps), D(ImplicitOps), D(ImplicitOps), D(ImplicitOps),
73fba5f4
AK		 2596 D(ImplicitOps), D(ImplicitOps), G(0, group4), G(0, group5),
2597};
2598
2599static struct opcode twobyte_table[256] = {
2600 /* 0x00 - 0x0F */
2601 N, GD(0, &group7), N, N,
d867162c 2602 N, D(ImplicitOps | VendorSpecific), D(ImplicitOps | Priv), N,
73fba5f4
AK		 2603 D(ImplicitOps | Priv), D(ImplicitOps | Priv), N, N,
2604 N, D(ImplicitOps | ModRM), N, N,
2605 /* 0x10 - 0x1F */
2606 N, N, N, N, N, N, N, N, D(ImplicitOps | ModRM), N, N, N, N, N, N, N,
2607 /* 0x20 - 0x2F */
b27f3856
AK		 2608 D(ModRM | DstMem | Priv | Op3264), D(ModRM | DstMem | Priv | Op3264),
2609 D(ModRM | SrcMem | Priv | Op3264), D(ModRM | SrcMem | Priv | Op3264),
73fba5f4
AK		 2610 N, N, N, N,
2611 N, N, N, N, N, N, N, N,
2612 /* 0x30 - 0x3F */
48bb5d3c
AK		 2613 D(ImplicitOps | Priv), I(ImplicitOps, em_rdtsc),
2614 D(ImplicitOps | Priv), N,
d867162c
AK		 2615 D(ImplicitOps | VendorSpecific), D(ImplicitOps | Priv | VendorSpecific),
2616 N, N,
73fba5f4
AK		 2617 N, N, N, N, N, N, N, N,
2618 /* 0x40 - 0x4F */
2619 X16(D(DstReg | SrcMem | ModRM | Mov)),
2620 /* 0x50 - 0x5F */
2621 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
2622 /* 0x60 - 0x6F */
aa97bb48
AK		 2623 N, N, N, N,
2624 N, N, N, N,
2625 N, N, N, N,
2626 N, N, N, GP(SrcMem | DstReg | ModRM | Mov, &pfx_0f_6f_0f_7f),
73fba5f4 2627 /* 0x70 - 0x7F */
aa97bb48
AK		 2628 N, N, N, N,
2629 N, N, N, N,
2630 N, N, N, N,
2631 N, N, N, GP(SrcReg | DstMem | ModRM | Mov, &pfx_0f_6f_0f_7f),
73fba5f4
AK		 2632 /* 0x80 - 0x8F */
2633 X16(D(SrcImm)),
2634 /* 0x90 - 0x9F */
ee45b58e 2635 X16(D(ByteOp | DstMem | SrcNone | ModRM| Mov)),
73fba5f4
AK		 2636 /* 0xA0 - 0xA7 */
2637 D(ImplicitOps | Stack), D(ImplicitOps | Stack),
2638 N, D(DstMem | SrcReg | ModRM | BitOp),
2639 D(DstMem | SrcReg | Src2ImmByte | ModRM),
2640 D(DstMem | SrcReg | Src2CL | ModRM), N, N,
2641 /* 0xA8 - 0xAF */
2642 D(ImplicitOps | Stack), D(ImplicitOps | Stack),
2643 N, D(DstMem | SrcReg | ModRM | BitOp | Lock),
2644 D(DstMem | SrcReg | Src2ImmByte | ModRM),
2645 D(DstMem | SrcReg | Src2CL | ModRM),
5c82aa29 2646 D(ModRM), I(DstReg | SrcMem | ModRM, em_imul),
73fba5f4 2647 /* 0xB0 - 0xB7 */
739ae406 2648 D2bv(DstMem | SrcReg | ModRM | Lock),
09b5f4d3
WY		 2649 D(DstReg | SrcMemFAddr | ModRM), D(DstMem | SrcReg | ModRM | BitOp | Lock),
2650 D(DstReg | SrcMemFAddr | ModRM), D(DstReg | SrcMemFAddr | ModRM),
2651 D(ByteOp | DstReg | SrcMem | ModRM | Mov), D(DstReg | SrcMem16 | ModRM | Mov),
73fba5f4
AK		 2652 /* 0xB8 - 0xBF */
2653 N, N,
ba7ff2b7 2654 G(BitOp, group8), D(DstMem | SrcReg | ModRM | BitOp | Lock),
d9574a25
WY		 2655 D(DstReg | SrcMem | ModRM), D(DstReg | SrcMem | ModRM),
2656 D(ByteOp | DstReg | SrcMem | ModRM | Mov), D(DstReg | SrcMem16 | ModRM | Mov),
73fba5f4 2657 /* 0xC0 - 0xCF */
739ae406 2658 D2bv(DstMem | SrcReg | ModRM | Lock),
92f738a5 2659 N, D(DstMem | SrcReg | ModRM | Mov),
73fba5f4
AK		 2660 N, N, N, GD(0, &group9),
2661 N, N, N, N, N, N, N, N,
2662 /* 0xD0 - 0xDF */
2663 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
2664 /* 0xE0 - 0xEF */
2665 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
2666 /* 0xF0 - 0xFF */
2667 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N
2668};
2669
2670#undef D
2671#undef N
2672#undef G
2673#undef GD
2674#undef I
aa97bb48 2675#undef GP
73fba5f4 2676
8d8f4e9f
AK		 2677#undef D2bv
2678#undef I2bv
6230f7fc 2679#undef D6ALU
8d8f4e9f 2680
39f21ee5
AK		 2681static unsigned imm_size(struct decode_cache *c)
2682{
2683 unsigned size;
2684
2685 size = (c->d & ByteOp) ? 1 : c->op_bytes;
2686 if (size == 8)
2687 size = 4;
2688 return size;
2689}
2690
2691static int decode_imm(struct x86_emulate_ctxt *ctxt, struct operand *op,
2692 unsigned size, bool sign_extension)
2693{
2694 struct decode_cache *c = &ctxt->decode;
2695 struct x86_emulate_ops *ops = ctxt->ops;
2696 int rc = X86EMUL_CONTINUE;
2697
2698 op->type = OP_IMM;
2699 op->bytes = size;
90de84f5 2700 op->addr.mem.ea = c->eip;
39f21ee5
AK		 2701 /* NB. Immediates are sign-extended as necessary. */
2702 switch (op->bytes) {
2703 case 1:
2704 op->val = insn_fetch(s8, 1, c->eip);
2705 break;
2706 case 2:
2707 op->val = insn_fetch(s16, 2, c->eip);
2708 break;
2709 case 4:
2710 op->val = insn_fetch(s32, 4, c->eip);
2711 break;
2712 }
2713 if (!sign_extension) {
2714 switch (op->bytes) {
2715 case 1:
2716 op->val &= 0xff;
2717 break;
2718 case 2:
2719 op->val &= 0xffff;
2720 break;
2721 case 4:
2722 op->val &= 0xffffffff;
2723 break;
2724 }
2725 }
2726done:
2727 return rc;
2728}
2729
dde7e6d1 2730int
dc25e89e 2731x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
dde7e6d1
AK		 2732{
2733 struct x86_emulate_ops *ops = ctxt->ops;
2734 struct decode_cache *c = &ctxt->decode;
2735 int rc = X86EMUL_CONTINUE;
2736 int mode = ctxt->mode;
0d7cdee8
AK		 2737 int def_op_bytes, def_ad_bytes, dual, goffset, simd_prefix;
2738 bool op_prefix = false;
dde7e6d1 2739 struct opcode opcode, *g_mod012, *g_mod3;
2dbd0dd7 2740 struct operand memop = { .type = OP_NONE };
dde7e6d1 2741
dde7e6d1 2742 c->eip = ctxt->eip;
dc25e89e
AP		 2743 c->fetch.start = c->eip;
2744 c->fetch.end = c->fetch.start + insn_len;
2745 if (insn_len > 0)
2746 memcpy(c->fetch.data, insn, insn_len);
dde7e6d1
AK		 2747 ctxt->cs_base = seg_base(ctxt, ops, VCPU_SREG_CS);
2748
2749 switch (mode) {
2750 case X86EMUL_MODE_REAL:
2751 case X86EMUL_MODE_VM86:
2752 case X86EMUL_MODE_PROT16:
2753 def_op_bytes = def_ad_bytes = 2;
2754 break;
2755 case X86EMUL_MODE_PROT32:
2756 def_op_bytes = def_ad_bytes = 4;
2757 break;
2758#ifdef CONFIG_X86_64
2759 case X86EMUL_MODE_PROT64:
2760 def_op_bytes = 4;
2761 def_ad_bytes = 8;
2762 break;
2763#endif
2764 default:
2765 return -1;
2766 }
2767
2768 c->op_bytes = def_op_bytes;
2769 c->ad_bytes = def_ad_bytes;
2770
2771 /* Legacy prefixes. */
2772 for (;;) {
2773 switch (c->b = insn_fetch(u8, 1, c->eip)) {
2774 case 0x66: /* operand-size override */
0d7cdee8 2775 op_prefix = true;
dde7e6d1
AK		 2776 /* switch between 2/4 bytes */
2777 c->op_bytes = def_op_bytes ^ 6;
2778 break;
2779 case 0x67: /* address-size override */
2780 if (mode == X86EMUL_MODE_PROT64)
2781 /* switch between 4/8 bytes */
2782 c->ad_bytes = def_ad_bytes ^ 12;
2783 else
2784 /* switch between 2/4 bytes */
2785 c->ad_bytes = def_ad_bytes ^ 6;
2786 break;
2787 case 0x26: /* ES override */
2788 case 0x2e: /* CS override */
2789 case 0x36: /* SS override */
2790 case 0x3e: /* DS override */
2791 set_seg_override(c, (c->b >> 3) & 3);
2792 break;
2793 case 0x64: /* FS override */
2794 case 0x65: /* GS override */
2795 set_seg_override(c, c->b & 7);
2796 break;
2797 case 0x40 ... 0x4f: /* REX */
2798 if (mode != X86EMUL_MODE_PROT64)
2799 goto done_prefixes;
2800 c->rex_prefix = c->b;
2801 continue;
2802 case 0xf0: /* LOCK */
2803 c->lock_prefix = 1;
2804 break;
2805 case 0xf2: /* REPNE/REPNZ */
dde7e6d1 2806 case 0xf3: /* REP/REPE/REPZ */
1d6b114f 2807 c->rep_prefix = c->b;
dde7e6d1
AK		 2808 break;
2809 default:
2810 goto done_prefixes;
2811 }
2812
2813 /* Any legacy prefix after a REX prefix nullifies its effect. */
2814
2815 c->rex_prefix = 0;
2816 }
2817
2818done_prefixes:
2819
2820 /* REX prefix. */
1e87e3ef
AK		 2821 if (c->rex_prefix & 8)
2822 c->op_bytes = 8; /* REX.W */
dde7e6d1
AK		 2823
2824 /* Opcode byte(s). */
2825 opcode = opcode_table[c->b];
d3ad6243
WY		 2826 /* Two-byte opcode? */
2827 if (c->b == 0x0f) {
2828 c->twobyte = 1;
2829 c->b = insn_fetch(u8, 1, c->eip);
2830 opcode = twobyte_table[c->b];
dde7e6d1
AK		 2831 }
2832 c->d = opcode.flags;
2833
2834 if (c->d & Group) {
2835 dual = c->d & GroupDual;
2836 c->modrm = insn_fetch(u8, 1, c->eip);
2837 --c->eip;
2838
2839 if (c->d & GroupDual) {
2840 g_mod012 = opcode.u.gdual->mod012;
2841 g_mod3 = opcode.u.gdual->mod3;
2842 } else
2843 g_mod012 = g_mod3 = opcode.u.group;
2844
2845 c->d &= ~(Group | GroupDual);
2846
2847 goffset = (c->modrm >> 3) & 7;
2848
2849 if ((c->modrm >> 6) == 3)
2850 opcode = g_mod3[goffset];
2851 else
2852 opcode = g_mod012[goffset];
2853 c->d |= opcode.flags;
2854 }
2855
0d7cdee8
AK		 2856 if (c->d & Prefix) {
2857 if (c->rep_prefix && op_prefix)
2858 return X86EMUL_UNHANDLEABLE;
2859 simd_prefix = op_prefix ? 0x66 : c->rep_prefix;
2860 switch (simd_prefix) {
2861 case 0x00: opcode = opcode.u.gprefix->pfx_no; break;
2862 case 0x66: opcode = opcode.u.gprefix->pfx_66; break;
2863 case 0xf2: opcode = opcode.u.gprefix->pfx_f2; break;
2864 case 0xf3: opcode = opcode.u.gprefix->pfx_f3; break;
2865 }
2866 c->d |= opcode.flags;
2867 }
2868
dde7e6d1
AK		 2869 c->execute = opcode.u.execute;
2870
2871 /* Unrecognised? */
d53db5ef 2872 if (c->d == 0 || (c->d & Undefined))
dde7e6d1 2873 return -1;
dde7e6d1 2874
d867162c
AK		 2875 if (!(c->d & VendorSpecific) && ctxt->only_vendor_specific_insn)
2876 return -1;
2877
dde7e6d1
AK		 2878 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
2879 c->op_bytes = 8;
2880
7f9b4b75
AK		 2881 if (c->d & Op3264) {
2882 if (mode == X86EMUL_MODE_PROT64)
2883 c->op_bytes = 8;
2884 else
2885 c->op_bytes = 4;
2886 }
2887
1253791d
AK		 2888 if (c->d & Sse)
2889 c->op_bytes = 16;
2890
dde7e6d1 2891 /* ModRM and SIB bytes. */
09ee57cd 2892 if (c->d & ModRM) {
2dbd0dd7 2893 rc = decode_modrm(ctxt, ops, &memop);
09ee57cd
AK		 2894 if (!c->has_seg_override)
2895 set_seg_override(c, c->modrm_seg);
2896 } else if (c->d & MemAbs)
2dbd0dd7 2897 rc = decode_abs(ctxt, ops, &memop);
dde7e6d1
AK		 2898 if (rc != X86EMUL_CONTINUE)
2899 goto done;
2900
2901 if (!c->has_seg_override)
2902 set_seg_override(c, VCPU_SREG_DS);
2903
90de84f5 2904 memop.addr.mem.seg = seg_override(ctxt, ops, c);
dde7e6d1 2905
2dbd0dd7 2906 if (memop.type == OP_MEM && c->ad_bytes != 8)
90de84f5 2907 memop.addr.mem.ea = (u32)memop.addr.mem.ea;
dde7e6d1 2908
2dbd0dd7 2909 if (memop.type == OP_MEM && c->rip_relative)
90de84f5 2910 memop.addr.mem.ea += c->eip;
dde7e6d1
AK		 2911
2912 /*
2913 * Decode and fetch the source operand: register, memory
2914 * or immediate.
2915 */
2916 switch (c->d & SrcMask) {
2917 case SrcNone:
2918 break;
2919 case SrcReg:
1253791d 2920 decode_register_operand(ctxt, &c->src, c, 0);
dde7e6d1
AK		 2921 break;
2922 case SrcMem16:
2dbd0dd7 2923 memop.bytes = 2;
dde7e6d1
AK		 2924 goto srcmem_common;
2925 case SrcMem32:
2dbd0dd7 2926 memop.bytes = 4;
dde7e6d1
AK		 2927 goto srcmem_common;
2928 case SrcMem:
2dbd0dd7 2929 memop.bytes = (c->d & ByteOp) ? 1 :
dde7e6d1 2930 c->op_bytes;
dde7e6d1 2931 srcmem_common:
2dbd0dd7 2932 c->src = memop;
dde7e6d1 2933 break;
b250e605 2934 case SrcImmU16:
39f21ee5
AK		 2935 rc = decode_imm(ctxt, &c->src, 2, false);
2936 break;
dde7e6d1 2937 case SrcImm:
39f21ee5
AK		 2938 rc = decode_imm(ctxt, &c->src, imm_size(c), true);
2939 break;
dde7e6d1 2940 case SrcImmU:
39f21ee5 2941 rc = decode_imm(ctxt, &c->src, imm_size(c), false);
dde7e6d1
AK		 2942 break;
2943 case SrcImmByte:
39f21ee5
AK		 2944 rc = decode_imm(ctxt, &c->src, 1, true);
2945 break;
dde7e6d1 2946 case SrcImmUByte:
39f21ee5 2947 rc = decode_imm(ctxt, &c->src, 1, false);
dde7e6d1
AK		 2948 break;
2949 case SrcAcc:
2950 c->src.type = OP_REG;
2951 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1a6440ae 2952 c->src.addr.reg = &c->regs[VCPU_REGS_RAX];
91ff3cb4 2953 fetch_register_operand(&c->src);
dde7e6d1
AK		 2954 break;
2955 case SrcOne:
2956 c->src.bytes = 1;
2957 c->src.val = 1;
2958 break;
2959 case SrcSI:
2960 c->src.type = OP_MEM;
2961 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
90de84f5
AK		 2962 c->src.addr.mem.ea =
2963 register_address(c, c->regs[VCPU_REGS_RSI]);
2964 c->src.addr.mem.seg = seg_override(ctxt, ops, c),
dde7e6d1
AK		 2965 c->src.val = 0;
2966 break;
2967 case SrcImmFAddr:
2968 c->src.type = OP_IMM;
90de84f5 2969 c->src.addr.mem.ea = c->eip;
dde7e6d1
AK		 2970 c->src.bytes = c->op_bytes + 2;
2971 insn_fetch_arr(c->src.valptr, c->src.bytes, c->eip);
2972 break;
2973 case SrcMemFAddr:
2dbd0dd7
AK		 2974 memop.bytes = c->op_bytes + 2;
2975 goto srcmem_common;
dde7e6d1
AK		 2976 break;
2977 }
2978
39f21ee5
AK		 2979 if (rc != X86EMUL_CONTINUE)
2980 goto done;
2981
dde7e6d1
AK		 2982 /*
2983 * Decode and fetch the second source operand: register, memory
2984 * or immediate.
2985 */
2986 switch (c->d & Src2Mask) {
2987 case Src2None:
2988 break;
2989 case Src2CL:
2990 c->src2.bytes = 1;
2991 c->src2.val = c->regs[VCPU_REGS_RCX] & 0x8;
2992 break;
2993 case Src2ImmByte:
39f21ee5 2994 rc = decode_imm(ctxt, &c->src2, 1, true);
dde7e6d1
AK		 2995 break;
2996 case Src2One:
2997 c->src2.bytes = 1;
2998 c->src2.val = 1;
2999 break;
7db41eb7
AK		 3000 case Src2Imm:
3001 rc = decode_imm(ctxt, &c->src2, imm_size(c), true);
3002 break;
dde7e6d1
AK		 3003 }
3004
39f21ee5
AK		 3005 if (rc != X86EMUL_CONTINUE)
3006 goto done;
3007
dde7e6d1
AK		 3008 /* Decode and fetch the destination operand: register or memory. */
3009 switch (c->d & DstMask) {
dde7e6d1 3010 case DstReg:
1253791d 3011 decode_register_operand(ctxt, &c->dst, c,
dde7e6d1
AK		 3012 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
3013 break;
943858e2
WY		 3014 case DstImmUByte:
3015 c->dst.type = OP_IMM;
90de84f5 3016 c->dst.addr.mem.ea = c->eip;
943858e2
WY		 3017 c->dst.bytes = 1;
3018 c->dst.val = insn_fetch(u8, 1, c->eip);
3019 break;
dde7e6d1
AK		 3020 case DstMem:
3021 case DstMem64:
2dbd0dd7 3022 c->dst = memop;
dde7e6d1
AK		 3023 if ((c->d & DstMask) == DstMem64)
3024 c->dst.bytes = 8;
3025 else
3026 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
35c843c4
WY		 3027 if (c->d & BitOp)
3028 fetch_bit_operand(c);
2dbd0dd7 3029 c->dst.orig_val = c->dst.val;
dde7e6d1
AK		 3030 break;
3031 case DstAcc:
3032 c->dst.type = OP_REG;
3033 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
1a6440ae 3034 c->dst.addr.reg = &c->regs[VCPU_REGS_RAX];
91ff3cb4 3035 fetch_register_operand(&c->dst);
dde7e6d1
AK		 3036 c->dst.orig_val = c->dst.val;
3037 break;
3038 case DstDI:
3039 c->dst.type = OP_MEM;
3040 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
90de84f5
AK		 3041 c->dst.addr.mem.ea =
3042 register_address(c, c->regs[VCPU_REGS_RDI]);
3043 c->dst.addr.mem.seg = VCPU_SREG_ES;
dde7e6d1
AK		 3044 c->dst.val = 0;
3045 break;
36089fed
WY		 3046 case ImplicitOps:
3047 /* Special instructions do their own operand decoding. */
3048 default:
3049 c->dst.type = OP_NONE; /* Disable writeback. */
3050 return 0;
dde7e6d1
AK		 3051 }
3052
3053done:
3054 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
3055}
3056
3e2f65d5
GN		 3057static bool string_insn_completed(struct x86_emulate_ctxt *ctxt)
3058{
3059 struct decode_cache *c = &ctxt->decode;
3060
3061 /* The second termination condition only applies for REPE
3062 * and REPNE. Test if the repeat string operation prefix is
3063 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
3064 * corresponding termination condition according to:
3065 * - if REPE/REPZ and ZF = 0 then done
3066 * - if REPNE/REPNZ and ZF = 1 then done
3067 */
3068 if (((c->b == 0xa6) || (c->b == 0xa7) ||
3069 (c->b == 0xae) || (c->b == 0xaf))
3070 && (((c->rep_prefix == REPE_PREFIX) &&
3071 ((ctxt->eflags & EFLG_ZF) == 0))
3072 || ((c->rep_prefix == REPNE_PREFIX) &&
3073 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF))))
3074 return true;
3075
3076 return false;
3077}
3078
8b4caf66 3079int
9aabc88f 3080x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
8b4caf66 3081{
9aabc88f 3082 struct x86_emulate_ops *ops = ctxt->ops;
8b4caf66 3083 u64 msr_data;
8b4caf66 3084 struct decode_cache *c = &ctxt->decode;
1b30eaa8 3085 int rc = X86EMUL_CONTINUE;
5cd21917 3086 int saved_dst_type = c->dst.type;
6e154e56 3087 int irq; /* Used for int 3, int, and into */
8b4caf66 3088
9de41573 3089 ctxt->decode.mem_read.pos = 0;
310b5d30 3090
1161624f 3091 if (ctxt->mode == X86EMUL_MODE_PROT64 && (c->d & No64)) {
35d3d4a1 3092 rc = emulate_ud(ctxt);
1161624f
GN		 3093 goto done;
3094 }
3095
d380a5e4 3096 /* LOCK prefix is allowed only with some instructions */
a41ffb75 3097 if (c->lock_prefix && (!(c->d & Lock) || c->dst.type != OP_MEM)) {
35d3d4a1 3098 rc = emulate_ud(ctxt);
d380a5e4
GN		 3099 goto done;
3100 }
3101
081bca0e 3102 if ((c->d & SrcMask) == SrcMemFAddr && c->src.type != OP_MEM) {
35d3d4a1 3103 rc = emulate_ud(ctxt);
081bca0e
AK		 3104 goto done;
3105 }
3106
1253791d
AK		 3107 if ((c->d & Sse)
3108 && ((ops->get_cr(0, ctxt->vcpu) & X86_CR0_EM)
3109 || !(ops->get_cr(4, ctxt->vcpu) & X86_CR4_OSFXSR))) {
3110 rc = emulate_ud(ctxt);
3111 goto done;
3112 }
3113
3114 if ((c->d & Sse) && (ops->get_cr(0, ctxt->vcpu) & X86_CR0_TS)) {
3115 rc = emulate_nm(ctxt);
3116 goto done;
3117 }
3118
e92805ac 3119 /* Privileged instruction can be executed only in CPL=0 */
9c537244 3120 if ((c->d & Priv) && ops->cpl(ctxt->vcpu)) {
35d3d4a1 3121 rc = emulate_gp(ctxt, 0);
e92805ac
GN		 3122 goto done;
3123 }
3124
b9fa9d6b
AK		 3125 if (c->rep_prefix && (c->d & String)) {
3126 /* All REP prefixes have the same first termination condition */
c73e197b 3127 if (address_mask(c, c->regs[VCPU_REGS_RCX]) == 0) {
95c55886 3128 ctxt->eip = c->eip;
b9fa9d6b
AK		 3129 goto done;
3130 }
b9fa9d6b
AK		 3131 }
3132
c483c02a 3133 if ((c->src.type == OP_MEM) && !(c->d & NoAccess)) {
90de84f5 3134 rc = read_emulated(ctxt, ops, linear(ctxt, c->src.addr.mem),
414e6277 3135 c->src.valptr, c->src.bytes);
b60d513c 3136 if (rc != X86EMUL_CONTINUE)
8b4caf66 3137 goto done;
16518d5a 3138 c->src.orig_val64 = c->src.val64;
8b4caf66
LV		 3139 }
3140
e35b7b9c 3141 if (c->src2.type == OP_MEM) {
90de84f5 3142 rc = read_emulated(ctxt, ops, linear(ctxt, c->src2.addr.mem),
9de41573 3143 &c->src2.val, c->src2.bytes);
e35b7b9c
GN		 3144 if (rc != X86EMUL_CONTINUE)
3145 goto done;
3146 }
3147
8b4caf66
LV		 3148 if ((c->d & DstMask) == ImplicitOps)
3149 goto special_insn;
3150
3151
69f55cb1
GN		 3152 if ((c->dst.type == OP_MEM) && !(c->d & Mov)) {
3153 /* optimisation - avoid slow emulated read if Mov */
90de84f5 3154 rc = read_emulated(ctxt, ops, linear(ctxt, c->dst.addr.mem),
9de41573 3155 &c->dst.val, c->dst.bytes);
69f55cb1
GN		 3156 if (rc != X86EMUL_CONTINUE)
3157 goto done;
038e51de 3158 }
e4e03ded 3159 c->dst.orig_val = c->dst.val;
038e51de 3160
018a98db
AK		 3161special_insn:
3162
ef65c889
AK		 3163 if (c->execute) {
3164 rc = c->execute(ctxt);
3165 if (rc != X86EMUL_CONTINUE)
3166 goto done;
3167 goto writeback;
3168 }
3169
e4e03ded 3170 if (c->twobyte)
6aa8b732
AK		 3171 goto twobyte_insn;
3172
e4e03ded 3173 switch (c->b) {
6aa8b732
AK		 3174 case 0x00 ... 0x05:
3175 add: /* add */
05f086f8 3176 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
6aa8b732 3177 break;
0934ac9d 3178 case 0x06: /* push es */
79168fd1 3179 emulate_push_sreg(ctxt, ops, VCPU_SREG_ES);
0934ac9d
MG		 3180 break;
3181 case 0x07: /* pop es */
0934ac9d 3182 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_ES);
0934ac9d 3183 break;
6aa8b732
AK		 3184 case 0x08 ... 0x0d:
3185 or: /* or */
05f086f8 3186 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
6aa8b732 3187 break;
0934ac9d 3188 case 0x0e: /* push cs */
79168fd1 3189 emulate_push_sreg(ctxt, ops, VCPU_SREG_CS);
0934ac9d 3190 break;
6aa8b732
AK		 3191 case 0x10 ... 0x15:
3192 adc: /* adc */
05f086f8 3193 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
6aa8b732 3194 break;
0934ac9d 3195 case 0x16: /* push ss */
79168fd1 3196 emulate_push_sreg(ctxt, ops, VCPU_SREG_SS);
0934ac9d
MG		 3197 break;
3198 case 0x17: /* pop ss */
0934ac9d 3199 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_SS);
0934ac9d 3200 break;
6aa8b732
AK		 3201 case 0x18 ... 0x1d:
3202 sbb: /* sbb */
05f086f8 3203 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
6aa8b732 3204 break;
0934ac9d 3205 case 0x1e: /* push ds */
79168fd1 3206 emulate_push_sreg(ctxt, ops, VCPU_SREG_DS);
0934ac9d
MG		 3207 break;
3208 case 0x1f: /* pop ds */
0934ac9d 3209 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_DS);
0934ac9d 3210 break;
aa3a816b 3211 case 0x20 ... 0x25:
6aa8b732 3212 and: /* and */
05f086f8 3213 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 3214 break;
3215 case 0x28 ... 0x2d:
3216 sub: /* sub */
05f086f8 3217 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 3218 break;
3219 case 0x30 ... 0x35:
3220 xor: /* xor */
05f086f8 3221 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 3222 break;
3223 case 0x38 ... 0x3d:
3224 cmp: /* cmp */
05f086f8 3225 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
6aa8b732 3226 break;
33615aa9
AK		 3227 case 0x40 ... 0x47: /* inc r16/r32 */
3228 emulate_1op("inc", c->dst, ctxt->eflags);
3229 break;
3230 case 0x48 ... 0x4f: /* dec r16/r32 */
3231 emulate_1op("dec", c->dst, ctxt->eflags);
3232 break;
33615aa9
AK		 3233 case 0x58 ... 0x5f: /* pop reg */
3234 pop_instruction:
350f69dc 3235 rc = emulate_pop(ctxt, ops, &c->dst.val, c->op_bytes);
33615aa9 3236 break;
abcf14b5 3237 case 0x60: /* pusha */
c37eda13 3238 rc = emulate_pusha(ctxt, ops);
abcf14b5
MG		 3239 break;
3240 case 0x61: /* popa */
3241 rc = emulate_popa(ctxt, ops);
abcf14b5 3242 break;
6aa8b732 3243 case 0x63: /* movsxd */
8b4caf66 3244 if (ctxt->mode != X86EMUL_MODE_PROT64)
6aa8b732 3245 goto cannot_emulate;
e4e03ded 3246 c->dst.val = (s32) c->src.val;
6aa8b732 3247 break;
018a98db
AK		 3248 case 0x6c: /* insb */
3249 case 0x6d: /* insw/insd */
a13a63fa
WY		 3250 c->src.val = c->regs[VCPU_REGS_RDX];
3251 goto do_io_in;
018a98db
AK		 3252 case 0x6e: /* outsb */
3253 case 0x6f: /* outsw/outsd */
a13a63fa
WY		 3254 c->dst.val = c->regs[VCPU_REGS_RDX];
3255 goto do_io_out;
7972995b 3256 break;
b2833e3c 3257 case 0x70 ... 0x7f: /* jcc (short) */
018a98db 3258 if (test_cc(c->b, ctxt->eflags))
b2833e3c 3259 jmp_rel(c, c->src.val);
018a98db 3260 break;
6aa8b732 3261 case 0x80 ... 0x83: /* Grp1 */
e4e03ded 3262 switch (c->modrm_reg) {
6aa8b732
AK		 3263 case 0:
3264 goto add;
3265 case 1:
3266 goto or;
3267 case 2:
3268 goto adc;
3269 case 3:
3270 goto sbb;
3271 case 4:
3272 goto and;
3273 case 5:
3274 goto sub;
3275 case 6:
3276 goto xor;
3277 case 7:
3278 goto cmp;
3279 }
3280 break;
3281 case 0x84 ... 0x85:
dfb507c4 3282 test:
05f086f8 3283 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
6aa8b732
AK		 3284 break;
3285 case 0x86 ... 0x87: /* xchg */
b13354f8 3286 xchg:
6aa8b732 3287 /* Write back the register source. */
31be40b3
WY		 3288 c->src.val = c->dst.val;
3289 write_register_operand(&c->src);
6aa8b732
AK		 3290 /*
3291 * Write back the memory destination with implicit LOCK
3292 * prefix.
3293 */
31be40b3 3294 c->dst.val = c->src.orig_val;
e4e03ded 3295 c->lock_prefix = 1;
6aa8b732 3296 break;
79168fd1
GN		 3297 case 0x8c: /* mov r/m, sreg */
3298 if (c->modrm_reg > VCPU_SREG_GS) {
35d3d4a1 3299 rc = emulate_ud(ctxt);
5e3ae6c5 3300 goto done;
38d5bc6d 3301 }
79168fd1 3302 c->dst.val = ops->get_segment_selector(c->modrm_reg, ctxt->vcpu);
38d5bc6d 3303 break;
7e0b54b1 3304 case 0x8d: /* lea r16/r32, m */
90de84f5 3305 c->dst.val = c->src.addr.mem.ea;
7e0b54b1 3306 break;
4257198a
GT		 3307 case 0x8e: { /* mov seg, r/m16 */
3308 uint16_t sel;
4257198a
GT		 3309
3310 sel = c->src.val;
8b9f4414 3311
c697518a
GN		 3312 if (c->modrm_reg == VCPU_SREG_CS ||
3313 c->modrm_reg > VCPU_SREG_GS) {
35d3d4a1 3314 rc = emulate_ud(ctxt);
8b9f4414
GN		 3315 goto done;
3316 }
3317
310b5d30 3318 if (c->modrm_reg == VCPU_SREG_SS)
95cb2295 3319 ctxt->interruptibility = KVM_X86_SHADOW_INT_MOV_SS;
310b5d30 3320
2e873022 3321 rc = load_segment_descriptor(ctxt, ops, sel, c->modrm_reg);
4257198a
GT		 3322
3323 c->dst.type = OP_NONE; /* Disable writeback. */
3324 break;
3325 }
6aa8b732 3326 case 0x8f: /* pop (sole member of Grp1a) */
8cdbd2c9 3327 rc = emulate_grp1a(ctxt, ops);
6aa8b732 3328 break;
3d9e77df
AK		 3329 case 0x90 ... 0x97: /* nop / xchg reg, rax */
3330 if (c->dst.addr.reg == &c->regs[VCPU_REGS_RAX])
34698d8c 3331 break;
b13354f8 3332 goto xchg;
e8b6fa70
WY		 3333 case 0x98: /* cbw/cwde/cdqe */
3334 switch (c->op_bytes) {
3335 case 2: c->dst.val = (s8)c->dst.val; break;
3336 case 4: c->dst.val = (s16)c->dst.val; break;
3337 case 8: c->dst.val = (s32)c->dst.val; break;
3338 }
3339 break;
fd2a7608 3340 case 0x9c: /* pushf */
05f086f8 3341 c->src.val = (unsigned long) ctxt->eflags;
79168fd1 3342 emulate_push(ctxt, ops);
8cdbd2c9 3343 break;
535eabcf 3344 case 0x9d: /* popf */
2b48cc75 3345 c->dst.type = OP_REG;
1a6440ae 3346 c->dst.addr.reg = &ctxt->eflags;
2b48cc75 3347 c->dst.bytes = c->op_bytes;
d4c6a154 3348 rc = emulate_popf(ctxt, ops, &c->dst.val, c->op_bytes);
d4c6a154 3349 break;
6aa8b732 3350 case 0xa6 ... 0xa7: /* cmps */
d7e5117a 3351 c->dst.type = OP_NONE; /* Disable writeback. */
a682e354 3352 goto cmp;
dfb507c4
MG		 3353 case 0xa8 ... 0xa9: /* test ax, imm */
3354 goto test;
6aa8b732 3355 case 0xae ... 0xaf: /* scas */
f6b33fc5 3356 goto cmp;
018a98db
AK		 3357 case 0xc0 ... 0xc1:
3358 emulate_grp2(ctxt);
3359 break;
111de5d6 3360 case 0xc3: /* ret */
cf5de4f8 3361 c->dst.type = OP_REG;
1a6440ae 3362 c->dst.addr.reg = &c->eip;
cf5de4f8 3363 c->dst.bytes = c->op_bytes;
111de5d6 3364 goto pop_instruction;
09b5f4d3
WY		 3365 case 0xc4: /* les */
3366 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_ES);
09b5f4d3
WY		 3367 break;
3368 case 0xc5: /* lds */
3369 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_DS);
09b5f4d3 3370 break;
a77ab5ea
AK		 3371 case 0xcb: /* ret far */
3372 rc = emulate_ret_far(ctxt, ops);
62bd430e 3373 break;
6e154e56
MG		 3374 case 0xcc: /* int3 */
3375 irq = 3;
3376 goto do_interrupt;
3377 case 0xcd: /* int n */
3378 irq = c->src.val;
3379 do_interrupt:
3380 rc = emulate_int(ctxt, ops, irq);
6e154e56
MG		 3381 break;
3382 case 0xce: /* into */
3383 if (ctxt->eflags & EFLG_OF) {
3384 irq = 4;
3385 goto do_interrupt;
3386 }
3387 break;
62bd430e
MG		 3388 case 0xcf: /* iret */
3389 rc = emulate_iret(ctxt, ops);
a77ab5ea 3390 break;
018a98db 3391 case 0xd0 ... 0xd1: /* Grp2 */
018a98db
AK		 3392 emulate_grp2(ctxt);
3393 break;
3394 case 0xd2 ... 0xd3: /* Grp2 */
3395 c->src.val = c->regs[VCPU_REGS_RCX];
3396 emulate_grp2(ctxt);
3397 break;
f2f31845
WY		 3398 case 0xe0 ... 0xe2: /* loop/loopz/loopnz */
3399 register_address_increment(c, &c->regs[VCPU_REGS_RCX], -1);
3400 if (address_mask(c, c->regs[VCPU_REGS_RCX]) != 0 &&
3401 (c->b == 0xe2 || test_cc(c->b ^ 0x5, ctxt->eflags)))
3402 jmp_rel(c, c->src.val);
3403 break;
e4abac67
WY		 3404 case 0xe3: /* jcxz/jecxz/jrcxz */
3405 if (address_mask(c, c->regs[VCPU_REGS_RCX]) == 0)
3406 jmp_rel(c, c->src.val);
3407 break;
a6a3034c
MG		 3408 case 0xe4: /* inb */
3409 case 0xe5: /* in */
cf8f70bf 3410 goto do_io_in;
a6a3034c
MG		 3411 case 0xe6: /* outb */
3412 case 0xe7: /* out */
cf8f70bf 3413 goto do_io_out;
1a52e051 3414 case 0xe8: /* call (near) */ {
d53c4777 3415 long int rel = c->src.val;
e4e03ded 3416 c->src.val = (unsigned long) c->eip;
7a957275 3417 jmp_rel(c, rel);
79168fd1 3418 emulate_push(ctxt, ops);
8cdbd2c9 3419 break;
1a52e051
NK		 3420 }
3421 case 0xe9: /* jmp rel */
954cd36f 3422 goto jmp;
414e6277
GN		 3423 case 0xea: { /* jmp far */
3424 unsigned short sel;
ea79849d 3425 jump_far:
414e6277
GN		 3426 memcpy(&sel, c->src.valptr + c->op_bytes, 2);
3427
3428 if (load_segment_descriptor(ctxt, ops, sel, VCPU_SREG_CS))
c697518a 3429 goto done;
954cd36f 3430
414e6277
GN		 3431 c->eip = 0;
3432 memcpy(&c->eip, c->src.valptr, c->op_bytes);
954cd36f 3433 break;
414e6277 3434 }
954cd36f
GT		 3435 case 0xeb:
3436 jmp: /* jmp rel short */
7a957275 3437 jmp_rel(c, c->src.val);
a01af5ec 3438 c->dst.type = OP_NONE; /* Disable writeback. */
1a52e051 3439 break;
a6a3034c
MG		 3440 case 0xec: /* in al,dx */
3441 case 0xed: /* in (e/r)ax,dx */
cf8f70bf
GN		 3442 c->src.val = c->regs[VCPU_REGS_RDX];
3443 do_io_in:
3444 c->dst.bytes = min(c->dst.bytes, 4u);
3445 if (!emulator_io_permited(ctxt, ops, c->src.val, c->dst.bytes)) {
35d3d4a1 3446 rc = emulate_gp(ctxt, 0);
cf8f70bf
GN		 3447 goto done;
3448 }
7b262e90
GN		 3449 if (!pio_in_emulated(ctxt, ops, c->dst.bytes, c->src.val,
3450 &c->dst.val))
cf8f70bf
GN		 3451 goto done; /* IO is needed */
3452 break;
ce7a0ad3
WY		 3453 case 0xee: /* out dx,al */
3454 case 0xef: /* out dx,(e/r)ax */
41167be5 3455 c->dst.val = c->regs[VCPU_REGS_RDX];
cf8f70bf 3456 do_io_out:
41167be5
WY		 3457 c->src.bytes = min(c->src.bytes, 4u);
3458 if (!emulator_io_permited(ctxt, ops, c->dst.val,
3459 c->src.bytes)) {
35d3d4a1 3460 rc = emulate_gp(ctxt, 0);
f850e2e6
GN		 3461 goto done;
3462 }
41167be5
WY		 3463 ops->pio_out_emulated(c->src.bytes, c->dst.val,
3464 &c->src.val, 1, ctxt->vcpu);
cf8f70bf 3465 c->dst.type = OP_NONE; /* Disable writeback. */
e93f36bc 3466 break;
111de5d6 3467 case 0xf4: /* hlt */
ad312c7c 3468 ctxt->vcpu->arch.halt_request = 1;
19fdfa0d 3469 break;
111de5d6
AK		 3470 case 0xf5: /* cmc */
3471 /* complement carry flag from eflags reg */
3472 ctxt->eflags ^= EFLG_CF;
111de5d6 3473 break;
018a98db 3474 case 0xf6 ... 0xf7: /* Grp3 */
34d1f490 3475 rc = emulate_grp3(ctxt, ops);
018a98db 3476 break;
111de5d6
AK		 3477 case 0xf8: /* clc */
3478 ctxt->eflags &= ~EFLG_CF;
111de5d6 3479 break;
8744aa9a
MG		 3480 case 0xf9: /* stc */
3481 ctxt->eflags |= EFLG_CF;
3482 break;
111de5d6 3483 case 0xfa: /* cli */
07cbc6c1 3484 if (emulator_bad_iopl(ctxt, ops)) {
35d3d4a1 3485 rc = emulate_gp(ctxt, 0);
07cbc6c1 3486 goto done;
36089fed 3487 } else
f850e2e6 3488 ctxt->eflags &= ~X86_EFLAGS_IF;
111de5d6
AK		 3489 break;
3490 case 0xfb: /* sti */
07cbc6c1 3491 if (emulator_bad_iopl(ctxt, ops)) {
35d3d4a1 3492 rc = emulate_gp(ctxt, 0);
07cbc6c1
WY		 3493 goto done;
3494 } else {
95cb2295 3495 ctxt->interruptibility = KVM_X86_SHADOW_INT_STI;
f850e2e6 3496 ctxt->eflags |= X86_EFLAGS_IF;
f850e2e6 3497 }
111de5d6 3498 break;
fb4616f4
MG		 3499 case 0xfc: /* cld */
3500 ctxt->eflags &= ~EFLG_DF;
fb4616f4
MG		 3501 break;
3502 case 0xfd: /* std */
3503 ctxt->eflags |= EFLG_DF;
fb4616f4 3504 break;
ea79849d
GN		 3505 case 0xfe: /* Grp4 */
3506 grp45:
018a98db 3507 rc = emulate_grp45(ctxt, ops);
018a98db 3508 break;
ea79849d
GN		 3509 case 0xff: /* Grp5 */
3510 if (c->modrm_reg == 5)
3511 goto jump_far;
3512 goto grp45;
91269b8f
AK		 3513 default:
3514 goto cannot_emulate;
6aa8b732 3515 }
018a98db 3516
7d9ddaed
AK		 3517 if (rc != X86EMUL_CONTINUE)
3518 goto done;
3519
018a98db
AK		 3520writeback:
3521 rc = writeback(ctxt, ops);
1b30eaa8 3522 if (rc != X86EMUL_CONTINUE)
018a98db
AK		 3523 goto done;
3524
5cd21917
GN		 3525 /*
3526 * restore dst type in case the decoding will be reused
3527 * (happens for string instruction )
3528 */
3529 c->dst.type = saved_dst_type;
3530
a682e354 3531 if ((c->d & SrcMask) == SrcSI)
90de84f5 3532 string_addr_inc(ctxt, seg_override(ctxt, ops, c),
79168fd1 3533 VCPU_REGS_RSI, &c->src);
a682e354
GN		 3534
3535 if ((c->d & DstMask) == DstDI)
90de84f5 3536 string_addr_inc(ctxt, VCPU_SREG_ES, VCPU_REGS_RDI,
79168fd1 3537 &c->dst);
d9271123 3538
5cd21917 3539 if (c->rep_prefix && (c->d & String)) {
6e2fb2ca 3540 struct read_cache *r = &ctxt->decode.io_read;
d9271123 3541 register_address_increment(c, &c->regs[VCPU_REGS_RCX], -1);
3e2f65d5 3542
d2ddd1c4
GN		 3543 if (!string_insn_completed(ctxt)) {
3544 /*
3545 * Re-enter guest when pio read ahead buffer is empty
3546 * or, if it is not used, after each 1024 iteration.
3547 */
3548 if ((r->end != 0 || c->regs[VCPU_REGS_RCX] & 0x3ff) &&
3549 (r->end == 0 || r->end != r->pos)) {
3550 /*
3551 * Reset read cache. Usually happens before
3552 * decode, but since instruction is restarted
3553 * we have to do it here.
3554 */
3555 ctxt->decode.mem_read.end = 0;
3556 return EMULATION_RESTART;
3557 }
3558 goto done; /* skip rip writeback */
0fa6ccbd 3559 }
5cd21917 3560 }
d2ddd1c4
GN		 3561
3562 ctxt->eip = c->eip;
018a98db
AK		 3563
3564done:
da9cb575
AK		 3565 if (rc == X86EMUL_PROPAGATE_FAULT)
3566 ctxt->have_exception = true;
d2ddd1c4 3567 return (rc == X86EMUL_UNHANDLEABLE) ? EMULATION_FAILED : EMULATION_OK;
6aa8b732
AK		 3568
3569twobyte_insn:
e4e03ded 3570 switch (c->b) {
6aa8b732 3571 case 0x01: /* lgdt, lidt, lmsw */
e4e03ded 3572 switch (c->modrm_reg) {
6aa8b732
AK		 3573 u16 size;
3574 unsigned long address;
3575
aca7f966 3576 case 0: /* vmcall */
e4e03ded 3577 if (c->modrm_mod != 3 || c->modrm_rm != 1)
aca7f966
AL		 3578 goto cannot_emulate;
3579
7aa81cc0 3580 rc = kvm_fix_hypercall(ctxt->vcpu);
1b30eaa8 3581 if (rc != X86EMUL_CONTINUE)
7aa81cc0
AL		 3582 goto done;
3583
33e3885d 3584 /* Let the processor re-execute the fixed hypercall */
063db061 3585 c->eip = ctxt->eip;
16286d08
AK		 3586 /* Disable writeback. */
3587 c->dst.type = OP_NONE;
aca7f966 3588 break;
6aa8b732 3589 case 2: /* lgdt */
1a6440ae 3590 rc = read_descriptor(ctxt, ops, c->src.addr.mem,
e4e03ded 3591 &size, &address, c->op_bytes);
1b30eaa8 3592 if (rc != X86EMUL_CONTINUE)
6aa8b732
AK		 3593 goto done;
3594 realmode_lgdt(ctxt->vcpu, size, address);
16286d08
AK		 3595 /* Disable writeback. */
3596 c->dst.type = OP_NONE;
6aa8b732 3597 break;
aca7f966 3598 case 3: /* lidt/vmmcall */
2b3d2a20
AK		 3599 if (c->modrm_mod == 3) {
3600 switch (c->modrm_rm) {
3601 case 1:
3602 rc = kvm_fix_hypercall(ctxt->vcpu);
2b3d2a20
AK		 3603 break;
3604 default:
3605 goto cannot_emulate;
3606 }
aca7f966 3607 } else {
1a6440ae 3608 rc = read_descriptor(ctxt, ops, c->src.addr.mem,
aca7f966 3609 &size, &address,
e4e03ded 3610 c->op_bytes);
1b30eaa8 3611 if (rc != X86EMUL_CONTINUE)
aca7f966
AL		 3612 goto done;
3613 realmode_lidt(ctxt->vcpu, size, address);
3614 }
16286d08
AK		 3615 /* Disable writeback. */
3616 c->dst.type = OP_NONE;
6aa8b732
AK		 3617 break;
3618 case 4: /* smsw */
16286d08 3619 c->dst.bytes = 2;
52a46617 3620 c->dst.val = ops->get_cr(0, ctxt->vcpu);
6aa8b732
AK		 3621 break;
3622 case 6: /* lmsw */
9928ff60 3623 ops->set_cr(0, (ops->get_cr(0, ctxt->vcpu) & ~0x0eul) |
93a152be 3624 (c->src.val & 0x0f), ctxt->vcpu);
dc7457ea 3625 c->dst.type = OP_NONE;
6aa8b732 3626 break;
6e1e5ffe 3627 case 5: /* not defined */
54b8486f 3628 emulate_ud(ctxt);
da9cb575 3629 rc = X86EMUL_PROPAGATE_FAULT;
6e1e5ffe 3630 goto done;
6aa8b732 3631 case 7: /* invlpg*/
90de84f5
AK		 3632 emulate_invlpg(ctxt->vcpu,
3633 linear(ctxt, c->src.addr.mem));
16286d08
AK		 3634 /* Disable writeback. */
3635 c->dst.type = OP_NONE;
6aa8b732
AK		 3636 break;
3637 default:
3638 goto cannot_emulate;
3639 }
3640 break;
e99f0507 3641 case 0x05: /* syscall */
3fb1b5db 3642 rc = emulate_syscall(ctxt, ops);
e99f0507 3643 break;
018a98db
AK		 3644 case 0x06:
3645 emulate_clts(ctxt->vcpu);
018a98db 3646 break;
018a98db 3647 case 0x09: /* wbinvd */
f5f48ee1 3648 kvm_emulate_wbinvd(ctxt->vcpu);
f5f48ee1
SY		 3649 break;
3650 case 0x08: /* invd */
018a98db
AK		 3651 case 0x0d: /* GrpP (prefetch) */
3652 case 0x18: /* Grp16 (prefetch/nop) */
018a98db
AK		 3653 break;
3654 case 0x20: /* mov cr, reg */
6aebfa6e
GN		 3655 switch (c->modrm_reg) {
3656 case 1:
3657 case 5 ... 7:
3658 case 9 ... 15:
54b8486f 3659 emulate_ud(ctxt);
da9cb575 3660 rc = X86EMUL_PROPAGATE_FAULT;
6aebfa6e
GN		 3661 goto done;
3662 }
1a0c7d44 3663 c->dst.val = ops->get_cr(c->modrm_reg, ctxt->vcpu);
018a98db 3664 break;
6aa8b732 3665 case 0x21: /* mov from dr to reg */
1e470be5
GN		 3666 if ((ops->get_cr(4, ctxt->vcpu) & X86_CR4_DE) &&
3667 (c->modrm_reg == 4 || c->modrm_reg == 5)) {
54b8486f 3668 emulate_ud(ctxt);
da9cb575 3669 rc = X86EMUL_PROPAGATE_FAULT;
1e470be5
GN		 3670 goto done;
3671 }
b27f3856 3672 ops->get_dr(c->modrm_reg, &c->dst.val, ctxt->vcpu);
6aa8b732 3673 break;
018a98db 3674 case 0x22: /* mov reg, cr */
1a0c7d44 3675 if (ops->set_cr(c->modrm_reg, c->src.val, ctxt->vcpu)) {
54b8486f 3676 emulate_gp(ctxt, 0);
da9cb575 3677 rc = X86EMUL_PROPAGATE_FAULT;
0f12244f
GN		 3678 goto done;
3679 }
018a98db
AK		 3680 c->dst.type = OP_NONE;
3681 break;
6aa8b732 3682 case 0x23: /* mov from reg to dr */
1e470be5
GN		 3683 if ((ops->get_cr(4, ctxt->vcpu) & X86_CR4_DE) &&
3684 (c->modrm_reg == 4 || c->modrm_reg == 5)) {
54b8486f 3685 emulate_ud(ctxt);
da9cb575 3686 rc = X86EMUL_PROPAGATE_FAULT;
1e470be5
GN		 3687 goto done;
3688 }
35aa5375 3689
b27f3856 3690 if (ops->set_dr(c->modrm_reg, c->src.val &
338dbc97
GN		 3691 ((ctxt->mode == X86EMUL_MODE_PROT64) ?
3692 ~0ULL : ~0U), ctxt->vcpu) < 0) {
3693 /* #UD condition is already handled by the code above */
54b8486f 3694 emulate_gp(ctxt, 0);
da9cb575 3695 rc = X86EMUL_PROPAGATE_FAULT;
338dbc97
GN		 3696 goto done;
3697 }
3698
a01af5ec 3699 c->dst.type = OP_NONE; /* no writeback */
6aa8b732 3700 break;
018a98db
AK		 3701 case 0x30:
3702 /* wrmsr */
3703 msr_data = (u32)c->regs[VCPU_REGS_RAX]
3704 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
3fb1b5db 3705 if (ops->set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data)) {
54b8486f 3706 emulate_gp(ctxt, 0);
da9cb575 3707 rc = X86EMUL_PROPAGATE_FAULT;
fd525365 3708 goto done;
018a98db
AK		 3709 }
3710 rc = X86EMUL_CONTINUE;
018a98db
AK		 3711 break;
3712 case 0x32:
3713 /* rdmsr */
3fb1b5db 3714 if (ops->get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data)) {
54b8486f 3715 emulate_gp(ctxt, 0);
da9cb575 3716 rc = X86EMUL_PROPAGATE_FAULT;
fd525365 3717 goto done;
018a98db
AK		 3718 } else {
3719 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
3720 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
3721 }
3722 rc = X86EMUL_CONTINUE;
018a98db 3723 break;
e99f0507 3724 case 0x34: /* sysenter */
3fb1b5db 3725 rc = emulate_sysenter(ctxt, ops);
e99f0507
AP		 3726 break;
3727 case 0x35: /* sysexit */
3fb1b5db 3728 rc = emulate_sysexit(ctxt, ops);
e99f0507 3729 break;
6aa8b732 3730 case 0x40 ... 0x4f: /* cmov */
e4e03ded 3731 c->dst.val = c->dst.orig_val = c->src.val;
a01af5ec
LV		 3732 if (!test_cc(c->b, ctxt->eflags))
3733 c->dst.type = OP_NONE; /* no writeback */
6aa8b732 3734 break;
b2833e3c 3735 case 0x80 ... 0x8f: /* jnz rel, etc*/
018a98db 3736 if (test_cc(c->b, ctxt->eflags))
b2833e3c 3737 jmp_rel(c, c->src.val);
018a98db 3738 break;
ee45b58e
WY		 3739 case 0x90 ... 0x9f: /* setcc r/m8 */
3740 c->dst.val = test_cc(c->b, ctxt->eflags);
3741 break;
0934ac9d 3742 case 0xa0: /* push fs */
79168fd1 3743 emulate_push_sreg(ctxt, ops, VCPU_SREG_FS);
0934ac9d
MG		 3744 break;
3745 case 0xa1: /* pop fs */
3746 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_FS);
0934ac9d 3747 break;
7de75248
NK		 3748 case 0xa3:
3749 bt: /* bt */
e4f8e039 3750 c->dst.type = OP_NONE;
e4e03ded
LV		 3751 /* only subword offset */
3752 c->src.val &= (c->dst.bytes << 3) - 1;
05f086f8 3753 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
7de75248 3754 break;
9bf8ea42
GT		 3755 case 0xa4: /* shld imm8, r, r/m */
3756 case 0xa5: /* shld cl, r, r/m */
3757 emulate_2op_cl("shld", c->src2, c->src, c->dst, ctxt->eflags);
3758 break;
0934ac9d 3759 case 0xa8: /* push gs */
79168fd1 3760 emulate_push_sreg(ctxt, ops, VCPU_SREG_GS);
0934ac9d
MG		 3761 break;
3762 case 0xa9: /* pop gs */
3763 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_GS);
0934ac9d 3764 break;
7de75248
NK		 3765 case 0xab:
3766 bts: /* bts */
05f086f8 3767 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
7de75248 3768 break;
9bf8ea42
GT		 3769 case 0xac: /* shrd imm8, r, r/m */
3770 case 0xad: /* shrd cl, r, r/m */
3771 emulate_2op_cl("shrd", c->src2, c->src, c->dst, ctxt->eflags);
3772 break;
2a7c5b8b
GC		 3773 case 0xae: /* clflush */
3774 break;
6aa8b732
AK		 3775 case 0xb0 ... 0xb1: /* cmpxchg */
3776 /*
3777 * Save real source value, then compare EAX against
3778 * destination.
3779 */
e4e03ded
LV		 3780 c->src.orig_val = c->src.val;
3781 c->src.val = c->regs[VCPU_REGS_RAX];
05f086f8
LV		 3782 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
3783 if (ctxt->eflags & EFLG_ZF) {
6aa8b732 3784 /* Success: write back to memory. */
e4e03ded 3785 c->dst.val = c->src.orig_val;
6aa8b732
AK		 3786 } else {
3787 /* Failure: write the value we saw to EAX. */
e4e03ded 3788 c->dst.type = OP_REG;
1a6440ae 3789 c->dst.addr.reg = (unsigned long *)&c->regs[VCPU_REGS_RAX];
6aa8b732
AK		 3790 }
3791 break;
09b5f4d3
WY		 3792 case 0xb2: /* lss */
3793 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_SS);
09b5f4d3 3794 break;
6aa8b732
AK		 3795 case 0xb3:
3796 btr: /* btr */
05f086f8 3797 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
6aa8b732 3798 break;
09b5f4d3
WY		 3799 case 0xb4: /* lfs */
3800 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_FS);
09b5f4d3
WY		 3801 break;
3802 case 0xb5: /* lgs */
3803 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_GS);
09b5f4d3 3804 break;
6aa8b732 3805 case 0xb6 ... 0xb7: /* movzx */
e4e03ded
LV		 3806 c->dst.bytes = c->op_bytes;
3807 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
3808 : (u16) c->src.val;
6aa8b732 3809 break;
6aa8b732 3810 case 0xba: /* Grp8 */
e4e03ded 3811 switch (c->modrm_reg & 3) {
6aa8b732
AK		 3812 case 0:
3813 goto bt;
3814 case 1:
3815 goto bts;
3816 case 2:
3817 goto btr;
3818 case 3:
3819 goto btc;
3820 }
3821 break;
7de75248
NK		 3822 case 0xbb:
3823 btc: /* btc */
05f086f8 3824 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
7de75248 3825 break;
d9574a25
WY		 3826 case 0xbc: { /* bsf */
3827 u8 zf;
3828 __asm__ ("bsf %2, %0; setz %1"
3829 : "=r"(c->dst.val), "=q"(zf)
3830 : "r"(c->src.val));
3831 ctxt->eflags &= ~X86_EFLAGS_ZF;
3832 if (zf) {
3833 ctxt->eflags |= X86_EFLAGS_ZF;
3834 c->dst.type = OP_NONE; /* Disable writeback. */
3835 }
3836 break;
3837 }
3838 case 0xbd: { /* bsr */
3839 u8 zf;
3840 __asm__ ("bsr %2, %0; setz %1"
3841 : "=r"(c->dst.val), "=q"(zf)
3842 : "r"(c->src.val));
3843 ctxt->eflags &= ~X86_EFLAGS_ZF;
3844 if (zf) {
3845 ctxt->eflags |= X86_EFLAGS_ZF;
3846 c->dst.type = OP_NONE; /* Disable writeback. */
3847 }
3848 break;
3849 }
6aa8b732 3850 case 0xbe ... 0xbf: /* movsx */
e4e03ded
LV		 3851 c->dst.bytes = c->op_bytes;
3852 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
3853 (s16) c->src.val;
6aa8b732 3854 break;
92f738a5
WY		 3855 case 0xc0 ... 0xc1: /* xadd */
3856 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
3857 /* Write back the register source. */
3858 c->src.val = c->dst.orig_val;
3859 write_register_operand(&c->src);
3860 break;
a012e65a 3861 case 0xc3: /* movnti */
e4e03ded
LV		 3862 c->dst.bytes = c->op_bytes;
3863 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
3864 (u64) c->src.val;
a012e65a 3865 break;
6aa8b732 3866 case 0xc7: /* Grp9 (cmpxchg8b) */
69f55cb1 3867 rc = emulate_grp9(ctxt, ops);
8cdbd2c9 3868 break;
91269b8f
AK		 3869 default:
3870 goto cannot_emulate;
6aa8b732 3871 }
7d9ddaed
AK		 3872
3873 if (rc != X86EMUL_CONTINUE)
3874 goto done;
3875
6aa8b732
AK		 3876 goto writeback;
3877
3878cannot_emulate:
6aa8b732
AK		 3879 return -1;
3880}
Linux kernel - Deliverables
This page took 1.22664 seconds and 5 git commands to generate.