blob: ea188a338afbc1db2097081ddefa345e82c79730 [file] [log] [blame]
Avi Kivity6aa8b732006-12-10 02:21:36 -08001/******************************************************************************
Avi Kivity56e82312009-08-12 15:04:37 +03002 * emulate.c
Avi Kivity6aa8b732006-12-10 02:21:36 -08003 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
Rusty Russelldcc07662007-07-17 23:16:56 +10009 * privileged instructions:
Avi Kivity6aa8b732006-12-10 02:21:36 -080010 *
11 * Copyright (C) 2006 Qumranet
Nicolas Kaiser9611c182010-10-06 14:23:22 +020012 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
Avi Kivity6aa8b732006-12-10 02:21:36 -080013 *
14 * Avi Kivity <avi@qumranet.com>
15 * Yaniv Kamay <yaniv@qumranet.com>
16 *
17 * This work is licensed under the terms of the GNU GPL, version 2. See
18 * the COPYING file in the top-level directory.
19 *
20 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
21 */
22
Avi Kivityedf88412007-12-16 11:02:48 +020023#include <linux/kvm_host.h>
Marcelo Tosatti5fdbf972008-06-27 14:58:02 -030024#include "kvm_cache_regs.h"
Avi Kivity6aa8b732006-12-10 02:21:36 -080025#include <linux/module.h>
Avi Kivity56e82312009-08-12 15:04:37 +030026#include <asm/kvm_emulate.h>
Avi Kivityb7d491e2013-01-04 16:18:49 +020027#include <linux/stringify.h>
Avi Kivity6aa8b732006-12-10 02:21:36 -080028
Avi Kivity3eeb3282010-01-21 15:31:48 +020029#include "x86.h"
Gleb Natapov38ba30b2010-03-18 15:20:17 +020030#include "tss.h"
Andre Przywarae99f0502009-06-17 15:50:33 +020031
Avi Kivity6aa8b732006-12-10 02:21:36 -080032/*
Avi Kivitya9945542011-09-13 10:45:41 +030033 * Operand types
34 */
Avi Kivityb1ea50b2011-09-13 10:45:42 +030035#define OpNone 0ull
36#define OpImplicit 1ull /* No generic decode */
37#define OpReg 2ull /* Register */
38#define OpMem 3ull /* Memory */
39#define OpAcc 4ull /* Accumulator: AL/AX/EAX/RAX */
40#define OpDI 5ull /* ES:DI/EDI/RDI */
41#define OpMem64 6ull /* Memory, 64-bit */
42#define OpImmUByte 7ull /* Zero-extended 8-bit immediate */
43#define OpDX 8ull /* DX register */
Avi Kivity4dd6a572011-09-13 10:45:43 +030044#define OpCL 9ull /* CL register (for shifts) */
45#define OpImmByte 10ull /* 8-bit sign extended immediate */
46#define OpOne 11ull /* Implied 1 */
Nadav Amit5e2c6882012-12-06 21:55:10 -020047#define OpImm 12ull /* Sign extended up to 32-bit immediate */
Avi Kivity0fe59122011-09-13 10:45:47 +030048#define OpMem16 13ull /* Memory operand (16-bit). */
49#define OpMem32 14ull /* Memory operand (32-bit). */
50#define OpImmU 15ull /* Immediate operand, zero extended */
51#define OpSI 16ull /* SI/ESI/RSI */
52#define OpImmFAddr 17ull /* Immediate far address */
53#define OpMemFAddr 18ull /* Far address in memory */
54#define OpImmU16 19ull /* Immediate operand, 16 bits, zero extended */
Avi Kivityc191a7a2011-09-13 10:45:49 +030055#define OpES 20ull /* ES */
56#define OpCS 21ull /* CS */
57#define OpSS 22ull /* SS */
58#define OpDS 23ull /* DS */
59#define OpFS 24ull /* FS */
60#define OpGS 25ull /* GS */
Avi Kivity28867ce2012-01-16 15:08:44 +020061#define OpMem8 26ull /* 8-bit zero extended memory operand */
Nadav Amit5e2c6882012-12-06 21:55:10 -020062#define OpImm64 27ull /* Sign extended 16/32/64-bit immediate */
Paolo Bonzini7fa57952013-05-09 11:32:50 +020063#define OpXLat 28ull /* memory at BX/EBX/RBX + zero-extended AL */
Avi Kivity820207c2013-02-09 11:31:45 +020064#define OpAccLo 29ull /* Low part of extended acc (AX/AX/EAX/RAX) */
65#define OpAccHi 30ull /* High part of extended acc (-/DX/EDX/RDX) */
Avi Kivitya9945542011-09-13 10:45:41 +030066
Avi Kivity0fe59122011-09-13 10:45:47 +030067#define OpBits 5 /* Width of operand field */
Avi Kivityb1ea50b2011-09-13 10:45:42 +030068#define OpMask ((1ull << OpBits) - 1)
Avi Kivitya9945542011-09-13 10:45:41 +030069
70/*
Avi Kivity6aa8b732006-12-10 02:21:36 -080071 * Opcode effective-address decode tables.
72 * Note that we only emulate instructions that have at least one memory
73 * operand (excluding implicit stack references). We assume that stack
74 * references and instruction fetches will never occur in special memory
75 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
76 * not be handled.
77 */
78
79/* Operand sizes: 8-bit operands or specified/overridden size. */
Avi Kivityab85b12b2010-07-29 15:11:49 +030080#define ByteOp (1<<0) /* 8-bit operands. */
Avi Kivity6aa8b732006-12-10 02:21:36 -080081/* Destination operand type. */
Avi Kivitya9945542011-09-13 10:45:41 +030082#define DstShift 1
83#define ImplicitOps (OpImplicit << DstShift)
84#define DstReg (OpReg << DstShift)
85#define DstMem (OpMem << DstShift)
86#define DstAcc (OpAcc << DstShift)
87#define DstDI (OpDI << DstShift)
88#define DstMem64 (OpMem64 << DstShift)
89#define DstImmUByte (OpImmUByte << DstShift)
90#define DstDX (OpDX << DstShift)
Avi Kivity820207c2013-02-09 11:31:45 +020091#define DstAccLo (OpAccLo << DstShift)
Avi Kivitya9945542011-09-13 10:45:41 +030092#define DstMask (OpMask << DstShift)
Avi Kivity6aa8b732006-12-10 02:21:36 -080093/* Source operand type. */
Avi Kivity0fe59122011-09-13 10:45:47 +030094#define SrcShift 6
95#define SrcNone (OpNone << SrcShift)
96#define SrcReg (OpReg << SrcShift)
97#define SrcMem (OpMem << SrcShift)
98#define SrcMem16 (OpMem16 << SrcShift)
99#define SrcMem32 (OpMem32 << SrcShift)
100#define SrcImm (OpImm << SrcShift)
101#define SrcImmByte (OpImmByte << SrcShift)
102#define SrcOne (OpOne << SrcShift)
103#define SrcImmUByte (OpImmUByte << SrcShift)
104#define SrcImmU (OpImmU << SrcShift)
105#define SrcSI (OpSI << SrcShift)
Paolo Bonzini7fa57952013-05-09 11:32:50 +0200106#define SrcXLat (OpXLat << SrcShift)
Avi Kivity0fe59122011-09-13 10:45:47 +0300107#define SrcImmFAddr (OpImmFAddr << SrcShift)
108#define SrcMemFAddr (OpMemFAddr << SrcShift)
109#define SrcAcc (OpAcc << SrcShift)
110#define SrcImmU16 (OpImmU16 << SrcShift)
Nadav Amit5e2c6882012-12-06 21:55:10 -0200111#define SrcImm64 (OpImm64 << SrcShift)
Avi Kivity0fe59122011-09-13 10:45:47 +0300112#define SrcDX (OpDX << SrcShift)
Avi Kivity28867ce2012-01-16 15:08:44 +0200113#define SrcMem8 (OpMem8 << SrcShift)
Avi Kivity820207c2013-02-09 11:31:45 +0200114#define SrcAccHi (OpAccHi << SrcShift)
Avi Kivity0fe59122011-09-13 10:45:47 +0300115#define SrcMask (OpMask << SrcShift)
Marcelo Tosatti221192b2011-05-30 15:23:14 -0300116#define BitOp (1<<11)
117#define MemAbs (1<<12) /* Memory operand is absolute displacement */
118#define String (1<<13) /* String instruction (rep capable) */
119#define Stack (1<<14) /* Stack instruction (push/pop) */
120#define GroupMask (7<<15) /* Opcode uses one of the group mechanisms */
121#define Group (1<<15) /* Bits 3:5 of modrm byte extend opcode */
122#define GroupDual (2<<15) /* Alternate decoding of mod == 3 */
123#define Prefix (3<<15) /* Instruction varies with 66/f2/f3 prefix */
124#define RMExt (4<<15) /* Opcode extension in ModRM r/m if mod == 3 */
Gleb Natapov045a2822012-12-20 16:57:43 +0200125#define Escape (5<<15) /* Escape to coprocessor instruction */
Marcelo Tosatti221192b2011-05-30 15:23:14 -0300126#define Sse (1<<18) /* SSE Vector instruction */
Avi Kivity20c29ff2011-09-13 10:45:44 +0300127/* Generic ModRM decode. */
128#define ModRM (1<<19)
129/* Destination is only written; never read. */
130#define Mov (1<<20)
Mohammed Gamald8769fe2009-08-23 14:24:25 +0300131/* Misc flags */
Joerg Roedel8ea7d6a2011-04-04 12:39:26 +0200132#define Prot (1<<21) /* instruction generates #UD if not in prot-mode */
Borislav Petkovb51e9742013-09-22 16:44:52 +0200133#define EmulateOnUD (1<<22) /* Emulate if unsupported by the host */
Avi Kivity5a506b12010-08-01 15:10:29 +0300134#define NoAccess (1<<23) /* Don't access memory (lea/invlpg/verr etc) */
Avi Kivity7f9b4b72010-08-01 14:46:54 +0300135#define Op3264 (1<<24) /* Operand is 64b in long mode, 32b otherwise */
Avi Kivity047a4812010-07-26 14:37:47 +0300136#define Undefined (1<<25) /* No Such Instruction */
Gleb Natapovd380a5e2010-02-10 14:21:36 +0200137#define Lock (1<<26) /* lock prefix is allowed for the instruction */
Gleb Natapove92805a2010-02-10 14:21:35 +0200138#define Priv (1<<27) /* instruction generates #GP if current CPL != 0 */
Mohammed Gamald8769fe2009-08-23 14:24:25 +0300139#define No64 (1<<28)
Xiao Guangrongd5ae7ce2011-09-22 16:53:46 +0800140#define PageTable (1 << 29) /* instruction used to write page table */
Gleb Natapov0b789ee2013-04-11 11:59:55 +0300141#define NotImpl (1 << 30) /* instruction is not implemented */
Guillaume Thouvenin0dc8d102008-12-04 14:26:42 +0100142/* Source 2 operand type */
Gleb Natapov0b789ee2013-04-11 11:59:55 +0300143#define Src2Shift (31)
Avi Kivity4dd6a572011-09-13 10:45:43 +0300144#define Src2None (OpNone << Src2Shift)
Avi Kivityab2c5ce2013-02-09 11:31:46 +0200145#define Src2Mem (OpMem << Src2Shift)
Avi Kivity4dd6a572011-09-13 10:45:43 +0300146#define Src2CL (OpCL << Src2Shift)
147#define Src2ImmByte (OpImmByte << Src2Shift)
148#define Src2One (OpOne << Src2Shift)
149#define Src2Imm (OpImm << Src2Shift)
Avi Kivityc191a7a2011-09-13 10:45:49 +0300150#define Src2ES (OpES << Src2Shift)
151#define Src2CS (OpCS << Src2Shift)
152#define Src2SS (OpSS << Src2Shift)
153#define Src2DS (OpDS << Src2Shift)
154#define Src2FS (OpFS << Src2Shift)
155#define Src2GS (OpGS << Src2Shift)
Avi Kivity4dd6a572011-09-13 10:45:43 +0300156#define Src2Mask (OpMask << Src2Shift)
Avi Kivitycbe2c9d2012-04-09 18:40:02 +0300157#define Mmx ((u64)1 << 40) /* MMX Vector instruction */
Avi Kivity1c11b372012-04-09 18:39:59 +0300158#define Aligned ((u64)1 << 41) /* Explicitly aligned (e.g. MOVDQA) */
159#define Unaligned ((u64)1 << 42) /* Explicitly unaligned (e.g. MOVDQU) */
160#define Avx ((u64)1 << 43) /* Advanced Vector Extensions */
Avi Kivitye28bbd42013-01-04 16:18:48 +0200161#define Fastop ((u64)1 << 44) /* Use opcode::u.fastop */
Avi Kivityb6744dc2013-01-04 16:18:50 +0200162#define NoWrite ((u64)1 << 45) /* No writeback */
Avi Kivityfb32b1e2013-02-09 11:31:44 +0200163#define SrcWrite ((u64)1 << 46) /* Write back src operand */
Nadav Amit9b88ae92014-05-25 23:05:21 +0300164#define NoMod ((u64)1 << 47) /* Mod field is ignored */
Paolo Bonzinid40a6892014-03-27 11:58:02 +0100165#define Intercept ((u64)1 << 48) /* Has valid intercept field */
166#define CheckPerm ((u64)1 << 49) /* Has valid check_perm field */
Avi Kivity6aa8b732006-12-10 02:21:36 -0800167
Avi Kivity820207c2013-02-09 11:31:45 +0200168#define DstXacc (DstAccLo | SrcAccHi | SrcWrite)
Avi Kivity6aa8b732006-12-10 02:21:36 -0800169
Avi Kivityd0e53322010-07-29 15:11:54 +0300170#define X2(x...) x, x
171#define X3(x...) X2(x), x
172#define X4(x...) X2(x), X2(x)
173#define X5(x...) X4(x), x
174#define X6(x...) X4(x), X2(x)
175#define X7(x...) X4(x), X3(x)
176#define X8(x...) X4(x), X4(x)
177#define X16(x...) X8(x), X8(x)
Avi Kivity83babbc2010-07-26 14:37:39 +0300178
Avi Kivitye28bbd42013-01-04 16:18:48 +0200179#define NR_FASTOP (ilog2(sizeof(ulong)) + 1)
180#define FASTOP_SIZE 8
181
182/*
183 * fastop functions have a special calling convention:
184 *
Avi Kivity017da7b2013-02-09 11:31:47 +0200185 * dst: rax (in/out)
186 * src: rdx (in/out)
Avi Kivitye28bbd42013-01-04 16:18:48 +0200187 * src2: rcx (in)
188 * flags: rflags (in/out)
Avi Kivityb8c0b6a2013-02-09 11:31:49 +0200189 * ex: rsi (in:fastop pointer, out:zero if exception)
Avi Kivitye28bbd42013-01-04 16:18:48 +0200190 *
191 * Moreover, they are all exactly FASTOP_SIZE bytes long, so functions for
192 * different operand sizes can be reached by calculation, rather than a jump
193 * table (which would be bigger than the code).
194 *
195 * fastop functions are declared as taking a never-defined fastop parameter,
196 * so they can't be called from C directly.
197 */
198
199struct fastop;
200
Avi Kivityd65b1de2010-07-29 15:11:35 +0300201struct opcode {
Avi Kivityb1ea50b2011-09-13 10:45:42 +0300202 u64 flags : 56;
203 u64 intercept : 8;
Avi Kivity120df892010-07-29 15:11:39 +0300204 union {
Avi Kivityef65c882010-07-29 15:11:51 +0300205 int (*execute)(struct x86_emulate_ctxt *ctxt);
Mathias Krausefd0a0d82012-08-30 01:30:15 +0200206 const struct opcode *group;
207 const struct group_dual *gdual;
208 const struct gprefix *gprefix;
Gleb Natapov045a2822012-12-20 16:57:43 +0200209 const struct escape *esc;
Avi Kivitye28bbd42013-01-04 16:18:48 +0200210 void (*fastop)(struct fastop *fake);
Avi Kivity120df892010-07-29 15:11:39 +0300211 } u;
Joerg Roedeld09beab2011-04-04 12:39:25 +0200212 int (*check_perm)(struct x86_emulate_ctxt *ctxt);
Avi Kivity120df892010-07-29 15:11:39 +0300213};
214
215struct group_dual {
216 struct opcode mod012[8];
217 struct opcode mod3[8];
Avi Kivityd65b1de2010-07-29 15:11:35 +0300218};
219
Avi Kivity0d7cdee2011-03-29 11:34:38 +0200220struct gprefix {
221 struct opcode pfx_no;
222 struct opcode pfx_66;
223 struct opcode pfx_f2;
224 struct opcode pfx_f3;
225};
226
Gleb Natapov045a2822012-12-20 16:57:43 +0200227struct escape {
228 struct opcode op[8];
229 struct opcode high[64];
230};
231
Avi Kivity6aa8b732006-12-10 02:21:36 -0800232/* EFLAGS bit definitions. */
Gleb Natapovd4c6a152010-02-10 14:21:34 +0200233#define EFLG_ID (1<<21)
234#define EFLG_VIP (1<<20)
235#define EFLG_VIF (1<<19)
236#define EFLG_AC (1<<18)
Andre Przywarab1d86142009-06-17 15:50:32 +0200237#define EFLG_VM (1<<17)
238#define EFLG_RF (1<<16)
Gleb Natapovd4c6a152010-02-10 14:21:34 +0200239#define EFLG_IOPL (3<<12)
240#define EFLG_NT (1<<14)
Avi Kivity6aa8b732006-12-10 02:21:36 -0800241#define EFLG_OF (1<<11)
242#define EFLG_DF (1<<10)
Andre Przywarab1d86142009-06-17 15:50:32 +0200243#define EFLG_IF (1<<9)
Gleb Natapovd4c6a152010-02-10 14:21:34 +0200244#define EFLG_TF (1<<8)
Avi Kivity6aa8b732006-12-10 02:21:36 -0800245#define EFLG_SF (1<<7)
246#define EFLG_ZF (1<<6)
247#define EFLG_AF (1<<4)
248#define EFLG_PF (1<<2)
249#define EFLG_CF (1<<0)
250
Mohammed Gamal62bd4302010-07-28 12:38:40 +0300251#define EFLG_RESERVED_ZEROS_MASK 0xffc0802a
252#define EFLG_RESERVED_ONE_MASK 2
253
Avi Kivitydd856ef2012-08-27 23:46:17 +0300254static ulong reg_read(struct x86_emulate_ctxt *ctxt, unsigned nr)
255{
256 if (!(ctxt->regs_valid & (1 << nr))) {
257 ctxt->regs_valid |= 1 << nr;
258 ctxt->_regs[nr] = ctxt->ops->read_gpr(ctxt, nr);
259 }
260 return ctxt->_regs[nr];
261}
262
263static ulong *reg_write(struct x86_emulate_ctxt *ctxt, unsigned nr)
264{
265 ctxt->regs_valid |= 1 << nr;
266 ctxt->regs_dirty |= 1 << nr;
267 return &ctxt->_regs[nr];
268}
269
270static ulong *reg_rmw(struct x86_emulate_ctxt *ctxt, unsigned nr)
271{
272 reg_read(ctxt, nr);
273 return reg_write(ctxt, nr);
274}
275
276static void writeback_registers(struct x86_emulate_ctxt *ctxt)
277{
278 unsigned reg;
279
280 for_each_set_bit(reg, (ulong *)&ctxt->regs_dirty, 16)
281 ctxt->ops->write_gpr(ctxt, reg, ctxt->_regs[reg]);
282}
283
284static void invalidate_registers(struct x86_emulate_ctxt *ctxt)
285{
286 ctxt->regs_dirty = 0;
287 ctxt->regs_valid = 0;
288}
289
Avi Kivity6aa8b732006-12-10 02:21:36 -0800290/*
Avi Kivity6aa8b732006-12-10 02:21:36 -0800291 * These EFLAGS bits are restored from saved value during emulation, and
292 * any changes are written back to the saved value after emulation.
293 */
294#define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
295
Avi Kivitydda96d82008-11-26 15:14:10 +0200296#ifdef CONFIG_X86_64
297#define ON64(x) x
298#else
299#define ON64(x)
300#endif
301
Avi Kivity4d758342013-01-19 19:51:55 +0200302static int fastop(struct x86_emulate_ctxt *ctxt, void (*fop)(struct fastop *));
303
Avi Kivityb7d491e2013-01-04 16:18:49 +0200304#define FOP_ALIGN ".align " __stringify(FASTOP_SIZE) " \n\t"
305#define FOP_RET "ret \n\t"
306
307#define FOP_START(op) \
308 extern void em_##op(struct fastop *fake); \
309 asm(".pushsection .text, \"ax\" \n\t" \
310 ".global em_" #op " \n\t" \
311 FOP_ALIGN \
312 "em_" #op ": \n\t"
313
314#define FOP_END \
315 ".popsection")
316
Avi Kivity0bdea062013-01-19 19:51:50 +0200317#define FOPNOP() FOP_ALIGN FOP_RET
318
Avi Kivityb7d491e2013-01-04 16:18:49 +0200319#define FOP1E(op, dst) \
Avi Kivityb8c0b6a2013-02-09 11:31:49 +0200320 FOP_ALIGN "10: " #op " %" #dst " \n\t" FOP_RET
321
322#define FOP1EEX(op, dst) \
323 FOP1E(op, dst) _ASM_EXTABLE(10b, kvm_fastop_exception)
Avi Kivityb7d491e2013-01-04 16:18:49 +0200324
325#define FASTOP1(op) \
326 FOP_START(op) \
327 FOP1E(op##b, al) \
328 FOP1E(op##w, ax) \
329 FOP1E(op##l, eax) \
330 ON64(FOP1E(op##q, rax)) \
331 FOP_END
332
Avi Kivityb9fa4092013-02-09 11:31:48 +0200333/* 1-operand, using src2 (for MUL/DIV r/m) */
334#define FASTOP1SRC2(op, name) \
335 FOP_START(name) \
336 FOP1E(op, cl) \
337 FOP1E(op, cx) \
338 FOP1E(op, ecx) \
339 ON64(FOP1E(op, rcx)) \
340 FOP_END
341
Avi Kivityb8c0b6a2013-02-09 11:31:49 +0200342/* 1-operand, using src2 (for MUL/DIV r/m), with exceptions */
343#define FASTOP1SRC2EX(op, name) \
344 FOP_START(name) \
345 FOP1EEX(op, cl) \
346 FOP1EEX(op, cx) \
347 FOP1EEX(op, ecx) \
348 ON64(FOP1EEX(op, rcx)) \
349 FOP_END
350
Avi Kivityf7857f32013-01-04 16:18:53 +0200351#define FOP2E(op, dst, src) \
352 FOP_ALIGN #op " %" #src ", %" #dst " \n\t" FOP_RET
353
354#define FASTOP2(op) \
355 FOP_START(op) \
Avi Kivity017da7b2013-02-09 11:31:47 +0200356 FOP2E(op##b, al, dl) \
357 FOP2E(op##w, ax, dx) \
358 FOP2E(op##l, eax, edx) \
359 ON64(FOP2E(op##q, rax, rdx)) \
Avi Kivityf7857f32013-01-04 16:18:53 +0200360 FOP_END
361
Avi Kivity11c363b2013-01-19 19:51:54 +0200362/* 2 operand, word only */
363#define FASTOP2W(op) \
364 FOP_START(op) \
365 FOPNOP() \
Avi Kivity017da7b2013-02-09 11:31:47 +0200366 FOP2E(op##w, ax, dx) \
367 FOP2E(op##l, eax, edx) \
368 ON64(FOP2E(op##q, rax, rdx)) \
Avi Kivity11c363b2013-01-19 19:51:54 +0200369 FOP_END
370
Avi Kivity007a3b52013-01-19 19:51:51 +0200371/* 2 operand, src is CL */
372#define FASTOP2CL(op) \
373 FOP_START(op) \
374 FOP2E(op##b, al, cl) \
375 FOP2E(op##w, ax, cl) \
376 FOP2E(op##l, eax, cl) \
377 ON64(FOP2E(op##q, rax, cl)) \
378 FOP_END
379
Avi Kivity0bdea062013-01-19 19:51:50 +0200380#define FOP3E(op, dst, src, src2) \
381 FOP_ALIGN #op " %" #src2 ", %" #src ", %" #dst " \n\t" FOP_RET
382
383/* 3-operand, word-only, src2=cl */
384#define FASTOP3WCL(op) \
385 FOP_START(op) \
386 FOPNOP() \
Avi Kivity017da7b2013-02-09 11:31:47 +0200387 FOP3E(op##w, ax, dx, cl) \
388 FOP3E(op##l, eax, edx, cl) \
389 ON64(FOP3E(op##q, rax, rdx, cl)) \
Avi Kivity0bdea062013-01-19 19:51:50 +0200390 FOP_END
391
Avi Kivity9ae9feb2013-01-19 19:51:52 +0200392/* Special case for SETcc - 1 instruction per cc */
393#define FOP_SETCC(op) ".align 4; " #op " %al; ret \n\t"
394
Avi Kivityb8c0b6a2013-02-09 11:31:49 +0200395asm(".global kvm_fastop_exception \n"
396 "kvm_fastop_exception: xor %esi, %esi; ret");
397
Avi Kivity9ae9feb2013-01-19 19:51:52 +0200398FOP_START(setcc)
399FOP_SETCC(seto)
400FOP_SETCC(setno)
401FOP_SETCC(setc)
402FOP_SETCC(setnc)
403FOP_SETCC(setz)
404FOP_SETCC(setnz)
405FOP_SETCC(setbe)
406FOP_SETCC(setnbe)
407FOP_SETCC(sets)
408FOP_SETCC(setns)
409FOP_SETCC(setp)
410FOP_SETCC(setnp)
411FOP_SETCC(setl)
412FOP_SETCC(setnl)
413FOP_SETCC(setle)
414FOP_SETCC(setnle)
415FOP_END;
416
Paolo Bonzini326f5782013-05-09 11:32:51 +0200417FOP_START(salc) "pushf; sbb %al, %al; popf \n\t" FOP_RET
418FOP_END;
419
Joerg Roedel8a76d7f2011-04-04 12:39:27 +0200420static int emulator_check_intercept(struct x86_emulate_ctxt *ctxt,
421 enum x86_intercept intercept,
422 enum x86_intercept_stage stage)
423{
424 struct x86_instruction_info info = {
425 .intercept = intercept,
Avi Kivity9dac77f2011-06-01 15:34:25 +0300426 .rep_prefix = ctxt->rep_prefix,
427 .modrm_mod = ctxt->modrm_mod,
428 .modrm_reg = ctxt->modrm_reg,
429 .modrm_rm = ctxt->modrm_rm,
430 .src_val = ctxt->src.val64,
Jan Kiszka6cbc5f52014-06-30 12:52:55 +0200431 .dst_val = ctxt->dst.val64,
Avi Kivity9dac77f2011-06-01 15:34:25 +0300432 .src_bytes = ctxt->src.bytes,
433 .dst_bytes = ctxt->dst.bytes,
434 .ad_bytes = ctxt->ad_bytes,
Joerg Roedel8a76d7f2011-04-04 12:39:27 +0200435 .next_rip = ctxt->eip,
436 };
437
Avi Kivity29535382011-04-20 13:37:53 +0300438 return ctxt->ops->intercept(ctxt, &info, stage);
Joerg Roedel8a76d7f2011-04-04 12:39:27 +0200439}
440
Avi Kivityf47cfa32012-06-07 17:49:24 +0300441static void assign_masked(ulong *dest, ulong src, ulong mask)
442{
443 *dest = (*dest & ~mask) | (src & mask);
444}
445
Avi Kivity9dac77f2011-06-01 15:34:25 +0300446static inline unsigned long ad_mask(struct x86_emulate_ctxt *ctxt)
Harvey Harrisonddcb2882008-02-18 11:12:48 -0800447{
Avi Kivity9dac77f2011-06-01 15:34:25 +0300448 return (1UL << (ctxt->ad_bytes << 3)) - 1;
Harvey Harrisonddcb2882008-02-18 11:12:48 -0800449}
450
Avi Kivityf47cfa32012-06-07 17:49:24 +0300451static ulong stack_mask(struct x86_emulate_ctxt *ctxt)
452{
453 u16 sel;
454 struct desc_struct ss;
455
456 if (ctxt->mode == X86EMUL_MODE_PROT64)
457 return ~0UL;
458 ctxt->ops->get_segment(ctxt, &sel, &ss, NULL, VCPU_SREG_SS);
459 return ~0U >> ((ss.d ^ 1) * 16); /* d=0: 0xffff; d=1: 0xffffffff */
460}
461
Avi Kivity612e89f2012-06-12 20:03:23 +0300462static int stack_size(struct x86_emulate_ctxt *ctxt)
463{
464 return (__fls(stack_mask(ctxt)) + 1) >> 3;
465}
466
Avi Kivity6aa8b732006-12-10 02:21:36 -0800467/* Access/update address held in a register, based on addressing mode. */
Harvey Harrisone4706772008-02-19 07:40:38 -0800468static inline unsigned long
Avi Kivity9dac77f2011-06-01 15:34:25 +0300469address_mask(struct x86_emulate_ctxt *ctxt, unsigned long reg)
Harvey Harrisone4706772008-02-19 07:40:38 -0800470{
Avi Kivity9dac77f2011-06-01 15:34:25 +0300471 if (ctxt->ad_bytes == sizeof(unsigned long))
Harvey Harrisone4706772008-02-19 07:40:38 -0800472 return reg;
473 else
Avi Kivity9dac77f2011-06-01 15:34:25 +0300474 return reg & ad_mask(ctxt);
Harvey Harrisone4706772008-02-19 07:40:38 -0800475}
476
477static inline unsigned long
Avi Kivity9dac77f2011-06-01 15:34:25 +0300478register_address(struct x86_emulate_ctxt *ctxt, unsigned long reg)
Harvey Harrisone4706772008-02-19 07:40:38 -0800479{
Avi Kivity9dac77f2011-06-01 15:34:25 +0300480 return address_mask(ctxt, reg);
Harvey Harrisone4706772008-02-19 07:40:38 -0800481}
482
Avi Kivity5ad105e2012-08-19 14:34:31 +0300483static void masked_increment(ulong *reg, ulong mask, int inc)
484{
485 assign_masked(reg, *reg + inc, mask);
486}
487
Harvey Harrison7a9572752008-02-19 07:40:41 -0800488static inline void
Avi Kivity9dac77f2011-06-01 15:34:25 +0300489register_address_increment(struct x86_emulate_ctxt *ctxt, unsigned long *reg, int inc)
Harvey Harrison7a9572752008-02-19 07:40:41 -0800490{
Avi Kivity5ad105e2012-08-19 14:34:31 +0300491 ulong mask;
492
Avi Kivity9dac77f2011-06-01 15:34:25 +0300493 if (ctxt->ad_bytes == sizeof(unsigned long))
Avi Kivity5ad105e2012-08-19 14:34:31 +0300494 mask = ~0UL;
Harvey Harrison7a9572752008-02-19 07:40:41 -0800495 else
Avi Kivity5ad105e2012-08-19 14:34:31 +0300496 mask = ad_mask(ctxt);
497 masked_increment(reg, mask, inc);
498}
499
500static void rsp_increment(struct x86_emulate_ctxt *ctxt, int inc)
501{
Avi Kivitydd856ef2012-08-27 23:46:17 +0300502 masked_increment(reg_rmw(ctxt, VCPU_REGS_RSP), stack_mask(ctxt), inc);
Harvey Harrison7a9572752008-02-19 07:40:41 -0800503}
Avi Kivity6aa8b732006-12-10 02:21:36 -0800504
Avi Kivity9dac77f2011-06-01 15:34:25 +0300505static inline void jmp_rel(struct x86_emulate_ctxt *ctxt, int rel)
Harvey Harrison7a9572752008-02-19 07:40:41 -0800506{
Avi Kivity9dac77f2011-06-01 15:34:25 +0300507 register_address_increment(ctxt, &ctxt->_eip, rel);
Harvey Harrison7a9572752008-02-19 07:40:41 -0800508}
Nitin A Kamble098c9372007-08-19 11:00:36 +0300509
Avi Kivity56697682011-04-03 14:08:51 +0300510static u32 desc_limit_scaled(struct desc_struct *desc)
511{
512 u32 limit = get_desc_limit(desc);
513
514 return desc->g ? (limit << 12) | 0xfff : limit;
515}
516
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +0900517static unsigned long seg_base(struct x86_emulate_ctxt *ctxt, int seg)
Avi Kivity7a5b56d2008-06-22 16:22:51 +0300518{
519 if (ctxt->mode == X86EMUL_MODE_PROT64 && seg < VCPU_SREG_FS)
520 return 0;
521
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +0900522 return ctxt->ops->get_cached_segment_base(ctxt, seg);
Avi Kivity7a5b56d2008-06-22 16:22:51 +0300523}
524
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200525static int emulate_exception(struct x86_emulate_ctxt *ctxt, int vec,
526 u32 error, bool valid)
Gleb Natapov54b84862010-04-28 19:15:44 +0300527{
Avi Kivityda9cb572010-11-22 17:53:21 +0200528 ctxt->exception.vector = vec;
529 ctxt->exception.error_code = error;
530 ctxt->exception.error_code_valid = valid;
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200531 return X86EMUL_PROPAGATE_FAULT;
Gleb Natapov54b84862010-04-28 19:15:44 +0300532}
533
Joerg Roedel3b88e412011-04-04 12:39:29 +0200534static int emulate_db(struct x86_emulate_ctxt *ctxt)
535{
536 return emulate_exception(ctxt, DB_VECTOR, 0, false);
537}
538
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200539static int emulate_gp(struct x86_emulate_ctxt *ctxt, int err)
Gleb Natapov54b84862010-04-28 19:15:44 +0300540{
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200541 return emulate_exception(ctxt, GP_VECTOR, err, true);
Gleb Natapov54b84862010-04-28 19:15:44 +0300542}
543
Avi Kivity618ff152011-04-03 12:32:09 +0300544static int emulate_ss(struct x86_emulate_ctxt *ctxt, int err)
545{
546 return emulate_exception(ctxt, SS_VECTOR, err, true);
547}
548
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200549static int emulate_ud(struct x86_emulate_ctxt *ctxt)
Gleb Natapov54b84862010-04-28 19:15:44 +0300550{
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200551 return emulate_exception(ctxt, UD_VECTOR, 0, false);
Gleb Natapov54b84862010-04-28 19:15:44 +0300552}
553
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200554static int emulate_ts(struct x86_emulate_ctxt *ctxt, int err)
Gleb Natapov54b84862010-04-28 19:15:44 +0300555{
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200556 return emulate_exception(ctxt, TS_VECTOR, err, true);
Gleb Natapov54b84862010-04-28 19:15:44 +0300557}
558
Avi Kivity34d1f492010-08-26 11:59:01 +0300559static int emulate_de(struct x86_emulate_ctxt *ctxt)
560{
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200561 return emulate_exception(ctxt, DE_VECTOR, 0, false);
Avi Kivity34d1f492010-08-26 11:59:01 +0300562}
563
Avi Kivity12537912011-03-29 11:41:27 +0200564static int emulate_nm(struct x86_emulate_ctxt *ctxt)
565{
566 return emulate_exception(ctxt, NM_VECTOR, 0, false);
567}
568
Avi Kivity1aa36612011-04-27 13:20:30 +0300569static u16 get_segment_selector(struct x86_emulate_ctxt *ctxt, unsigned seg)
570{
571 u16 selector;
572 struct desc_struct desc;
573
574 ctxt->ops->get_segment(ctxt, &selector, &desc, NULL, seg);
575 return selector;
576}
577
578static void set_segment_selector(struct x86_emulate_ctxt *ctxt, u16 selector,
579 unsigned seg)
580{
581 u16 dummy;
582 u32 base3;
583 struct desc_struct desc;
584
585 ctxt->ops->get_segment(ctxt, &dummy, &desc, &base3, seg);
586 ctxt->ops->set_segment(ctxt, selector, &desc, base3, seg);
587}
588
Avi Kivity1c11b372012-04-09 18:39:59 +0300589/*
590 * x86 defines three classes of vector instructions: explicitly
591 * aligned, explicitly unaligned, and the rest, which change behaviour
592 * depending on whether they're AVX encoded or not.
593 *
594 * Also included is CMPXCHG16B which is not a vector instruction, yet it is
595 * subject to the same check.
596 */
597static bool insn_aligned(struct x86_emulate_ctxt *ctxt, unsigned size)
598{
599 if (likely(size < 16))
600 return false;
601
602 if (ctxt->d & Aligned)
603 return true;
604 else if (ctxt->d & Unaligned)
605 return false;
606 else if (ctxt->d & Avx)
607 return false;
608 else
609 return true;
610}
611
Nelson Elhage3d9b9382011-04-18 12:05:53 -0400612static int __linearize(struct x86_emulate_ctxt *ctxt,
Avi Kivity52fd8b42011-04-03 12:33:12 +0300613 struct segmented_address addr,
Nelson Elhage3d9b9382011-04-18 12:05:53 -0400614 unsigned size, bool write, bool fetch,
Avi Kivity52fd8b42011-04-03 12:33:12 +0300615 ulong *linear)
616{
Avi Kivity618ff152011-04-03 12:32:09 +0300617 struct desc_struct desc;
618 bool usable;
Avi Kivity52fd8b42011-04-03 12:33:12 +0300619 ulong la;
Avi Kivity618ff152011-04-03 12:32:09 +0300620 u32 lim;
Avi Kivity1aa36612011-04-27 13:20:30 +0300621 u16 sel;
Gleb Natapov3a78a4f2012-12-20 16:57:42 +0200622 unsigned cpl;
Avi Kivity52fd8b42011-04-03 12:33:12 +0300623
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +0900624 la = seg_base(ctxt, addr.seg) + addr.ea;
Avi Kivity618ff152011-04-03 12:32:09 +0300625 switch (ctxt->mode) {
Avi Kivity618ff152011-04-03 12:32:09 +0300626 case X86EMUL_MODE_PROT64:
627 if (((signed long)la << 16) >> 16 != la)
628 return emulate_gp(ctxt, 0);
629 break;
630 default:
Avi Kivity1aa36612011-04-27 13:20:30 +0300631 usable = ctxt->ops->get_segment(ctxt, &sel, &desc, NULL,
632 addr.seg);
Avi Kivity618ff152011-04-03 12:32:09 +0300633 if (!usable)
634 goto bad;
Gleb Natapov58b78252012-12-11 15:14:12 +0200635 /* code segment in protected mode or read-only data segment */
636 if ((((ctxt->mode != X86EMUL_MODE_REAL) && (desc.type & 8))
637 || !(desc.type & 2)) && write)
Avi Kivity618ff152011-04-03 12:32:09 +0300638 goto bad;
639 /* unreadable code segment */
Nelson Elhage3d9b9382011-04-18 12:05:53 -0400640 if (!fetch && (desc.type & 8) && !(desc.type & 2))
Avi Kivity618ff152011-04-03 12:32:09 +0300641 goto bad;
642 lim = desc_limit_scaled(&desc);
643 if ((desc.type & 8) || !(desc.type & 4)) {
644 /* expand-up segment */
645 if (addr.ea > lim || (u32)(addr.ea + size - 1) > lim)
646 goto bad;
647 } else {
Guo Chaofc058682012-06-28 15:19:51 +0800648 /* expand-down segment */
Avi Kivity618ff152011-04-03 12:32:09 +0300649 if (addr.ea <= lim || (u32)(addr.ea + size - 1) <= lim)
650 goto bad;
651 lim = desc.d ? 0xffffffff : 0xffff;
652 if (addr.ea > lim || (u32)(addr.ea + size - 1) > lim)
653 goto bad;
654 }
Avi Kivity717746e2011-04-20 13:37:53 +0300655 cpl = ctxt->ops->cpl(ctxt);
Avi Kivity618ff152011-04-03 12:32:09 +0300656 if (!(desc.type & 8)) {
657 /* data segment */
658 if (cpl > desc.dpl)
659 goto bad;
660 } else if ((desc.type & 8) && !(desc.type & 4)) {
661 /* nonconforming code segment */
662 if (cpl != desc.dpl)
663 goto bad;
664 } else if ((desc.type & 8) && (desc.type & 4)) {
665 /* conforming code segment */
666 if (cpl < desc.dpl)
667 goto bad;
668 }
669 break;
670 }
Avi Kivity9dac77f2011-06-01 15:34:25 +0300671 if (fetch ? ctxt->mode != X86EMUL_MODE_PROT64 : ctxt->ad_bytes != 8)
Avi Kivity52fd8b42011-04-03 12:33:12 +0300672 la &= (u32)-1;
Avi Kivity1c11b372012-04-09 18:39:59 +0300673 if (insn_aligned(ctxt, size) && ((la & (size - 1)) != 0))
674 return emulate_gp(ctxt, 0);
Avi Kivity52fd8b42011-04-03 12:33:12 +0300675 *linear = la;
676 return X86EMUL_CONTINUE;
Avi Kivity618ff152011-04-03 12:32:09 +0300677bad:
678 if (addr.seg == VCPU_SREG_SS)
Avi Kivity0afbe2f2012-08-21 17:07:06 +0300679 return emulate_ss(ctxt, sel);
Avi Kivity618ff152011-04-03 12:32:09 +0300680 else
Avi Kivity0afbe2f2012-08-21 17:07:06 +0300681 return emulate_gp(ctxt, sel);
Avi Kivity52fd8b42011-04-03 12:33:12 +0300682}
683
Nelson Elhage3d9b9382011-04-18 12:05:53 -0400684static int linearize(struct x86_emulate_ctxt *ctxt,
685 struct segmented_address addr,
686 unsigned size, bool write,
687 ulong *linear)
688{
689 return __linearize(ctxt, addr, size, write, false, linear);
690}
691
692
Avi Kivity3ca3ac42011-03-31 16:52:26 +0200693static int segmented_read_std(struct x86_emulate_ctxt *ctxt,
694 struct segmented_address addr,
695 void *data,
696 unsigned size)
697{
Avi Kivity9fa088f2011-03-31 18:54:30 +0200698 int rc;
699 ulong linear;
700
Avi Kivity83b87952011-04-03 11:31:19 +0300701 rc = linearize(ctxt, addr, size, false, &linear);
Avi Kivity9fa088f2011-03-31 18:54:30 +0200702 if (rc != X86EMUL_CONTINUE)
703 return rc;
Avi Kivity0f65dd72011-04-20 13:37:53 +0300704 return ctxt->ops->read_std(ctxt, linear, data, size, &ctxt->exception);
Avi Kivity3ca3ac42011-03-31 16:52:26 +0200705}
706
Takuya Yoshikawa807941b2011-07-30 18:00:17 +0900707/*
Paolo Bonzini285ca9e2014-05-06 12:24:32 +0200708 * Prefetch the remaining bytes of the instruction without crossing page
Takuya Yoshikawa807941b2011-07-30 18:00:17 +0900709 * boundary if they are not in fetch_cache yet.
710 */
Paolo Bonzini285ca9e2014-05-06 12:24:32 +0200711static int do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt)
Avi Kivity62266862007-11-20 13:15:52 +0200712{
Avi Kivity9dac77f2011-06-01 15:34:25 +0300713 struct fetch_cache *fc = &ctxt->fetch;
Avi Kivity62266862007-11-20 13:15:52 +0200714 int rc;
Avi Kivity2fb53ad2010-04-11 13:05:15 +0300715 int size, cur_size;
Paolo Bonzini285ca9e2014-05-06 12:24:32 +0200716 unsigned long linear;
Avi Kivity62266862007-11-20 13:15:52 +0200717
Paolo Bonzini285ca9e2014-05-06 12:24:32 +0200718 struct segmented_address addr = { .seg = VCPU_SREG_CS,
719 .ea = fc->end };
720 cur_size = fc->end - fc->start;
721 size = min(15UL - cur_size,
722 PAGE_SIZE - offset_in_page(fc->end));
723 if (unlikely(size == 0))
724 return X86EMUL_UNHANDLEABLE;
725 rc = __linearize(ctxt, addr, size, false, true, &linear);
726 if (unlikely(rc != X86EMUL_CONTINUE))
727 return rc;
728 rc = ctxt->ops->fetch(ctxt, linear, fc->data + cur_size,
729 size, &ctxt->exception);
730 if (unlikely(rc != X86EMUL_CONTINUE))
731 return rc;
732 fc->end += size;
Takuya Yoshikawa3e2815e2010-02-12 15:53:59 +0900733 return X86EMUL_CONTINUE;
Avi Kivity62266862007-11-20 13:15:52 +0200734}
735
736static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
Paolo Bonzini285ca9e2014-05-06 12:24:32 +0200737 void *__dest, unsigned size)
Avi Kivity62266862007-11-20 13:15:52 +0200738{
Takuya Yoshikawa3e2815e2010-02-12 15:53:59 +0900739 int rc;
Paolo Bonzini285ca9e2014-05-06 12:24:32 +0200740 struct fetch_cache *fc = &ctxt->fetch;
741 u8 *dest = __dest;
742 u8 *src = &fc->data[ctxt->_eip - fc->start];
Avi Kivity62266862007-11-20 13:15:52 +0200743
Avi Kivity62266862007-11-20 13:15:52 +0200744 while (size--) {
Paolo Bonzini285ca9e2014-05-06 12:24:32 +0200745 if (unlikely(ctxt->_eip == fc->end)) {
746 rc = do_insn_fetch_bytes(ctxt);
747 if (rc != X86EMUL_CONTINUE)
748 return rc;
749 }
750 *dest++ = *src++;
751 ctxt->_eip++;
752 continue;
Avi Kivity62266862007-11-20 13:15:52 +0200753 }
Takuya Yoshikawa3e2815e2010-02-12 15:53:59 +0900754 return X86EMUL_CONTINUE;
Avi Kivity62266862007-11-20 13:15:52 +0200755}
756
Takuya Yoshikawa67cbc902011-05-15 00:54:58 +0900757/* Fetch next part of the instruction being emulated. */
Takuya Yoshikawae85a1082011-07-30 18:01:26 +0900758#define insn_fetch(_type, _ctxt) \
Takuya Yoshikawa67cbc902011-05-15 00:54:58 +0900759({ unsigned long _x; \
Takuya Yoshikawae85a1082011-07-30 18:01:26 +0900760 rc = do_insn_fetch(_ctxt, &_x, sizeof(_type)); \
Takuya Yoshikawa67cbc902011-05-15 00:54:58 +0900761 if (rc != X86EMUL_CONTINUE) \
762 goto done; \
Takuya Yoshikawa67cbc902011-05-15 00:54:58 +0900763 (_type)_x; \
764})
765
Takuya Yoshikawa807941b2011-07-30 18:00:17 +0900766#define insn_fetch_arr(_arr, _size, _ctxt) \
767({ rc = do_insn_fetch(_ctxt, _arr, (_size)); \
Takuya Yoshikawa67cbc902011-05-15 00:54:58 +0900768 if (rc != X86EMUL_CONTINUE) \
769 goto done; \
Takuya Yoshikawa67cbc902011-05-15 00:54:58 +0900770})
771
Rusty Russell1e3c5cb2007-07-17 23:16:11 +1000772/*
773 * Given the 'reg' portion of a ModRM byte, and a register block, return a
774 * pointer into the block that addresses the relevant register.
775 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
776 */
Avi Kivitydd856ef2012-08-27 23:46:17 +0300777static void *decode_register(struct x86_emulate_ctxt *ctxt, u8 modrm_reg,
Gleb Natapovaa9ac1a2013-11-04 15:52:41 +0200778 int byteop)
Avi Kivity6aa8b732006-12-10 02:21:36 -0800779{
780 void *p;
Gleb Natapovaa9ac1a2013-11-04 15:52:41 +0200781 int highbyte_regs = (ctxt->rex_prefix == 0) && byteop;
Avi Kivity6aa8b732006-12-10 02:21:36 -0800782
Avi Kivity6aa8b732006-12-10 02:21:36 -0800783 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
Avi Kivitydd856ef2012-08-27 23:46:17 +0300784 p = (unsigned char *)reg_rmw(ctxt, modrm_reg & 3) + 1;
785 else
786 p = reg_rmw(ctxt, modrm_reg);
Avi Kivity6aa8b732006-12-10 02:21:36 -0800787 return p;
788}
789
790static int read_descriptor(struct x86_emulate_ctxt *ctxt,
Avi Kivity90de84f2010-11-17 15:28:21 +0200791 struct segmented_address addr,
Avi Kivity6aa8b732006-12-10 02:21:36 -0800792 u16 *size, unsigned long *address, int op_bytes)
793{
794 int rc;
795
796 if (op_bytes == 2)
797 op_bytes = 3;
798 *address = 0;
Avi Kivity3ca3ac42011-03-31 16:52:26 +0200799 rc = segmented_read_std(ctxt, addr, size, 2);
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +0900800 if (rc != X86EMUL_CONTINUE)
Avi Kivity6aa8b732006-12-10 02:21:36 -0800801 return rc;
Avi Kivity30b31ab2010-11-17 15:28:22 +0200802 addr.ea += 2;
Avi Kivity3ca3ac42011-03-31 16:52:26 +0200803 rc = segmented_read_std(ctxt, addr, address, op_bytes);
Avi Kivity6aa8b732006-12-10 02:21:36 -0800804 return rc;
805}
806
Avi Kivity34b77652013-01-19 19:51:56 +0200807FASTOP2(add);
808FASTOP2(or);
809FASTOP2(adc);
810FASTOP2(sbb);
811FASTOP2(and);
812FASTOP2(sub);
813FASTOP2(xor);
814FASTOP2(cmp);
815FASTOP2(test);
816
Avi Kivityb9fa4092013-02-09 11:31:48 +0200817FASTOP1SRC2(mul, mul_ex);
818FASTOP1SRC2(imul, imul_ex);
Avi Kivityb8c0b6a2013-02-09 11:31:49 +0200819FASTOP1SRC2EX(div, div_ex);
820FASTOP1SRC2EX(idiv, idiv_ex);
Avi Kivityb9fa4092013-02-09 11:31:48 +0200821
Avi Kivity34b77652013-01-19 19:51:56 +0200822FASTOP3WCL(shld);
823FASTOP3WCL(shrd);
824
825FASTOP2W(imul);
826
827FASTOP1(not);
828FASTOP1(neg);
829FASTOP1(inc);
830FASTOP1(dec);
831
832FASTOP2CL(rol);
833FASTOP2CL(ror);
834FASTOP2CL(rcl);
835FASTOP2CL(rcr);
836FASTOP2CL(shl);
837FASTOP2CL(shr);
838FASTOP2CL(sar);
839
840FASTOP2W(bsf);
841FASTOP2W(bsr);
842FASTOP2W(bt);
843FASTOP2W(bts);
844FASTOP2W(btr);
845FASTOP2W(btc);
846
Avi Kivitye47a5f52013-02-09 11:31:51 +0200847FASTOP2(xadd);
848
Avi Kivity9ae9feb2013-01-19 19:51:52 +0200849static u8 test_cc(unsigned int condition, unsigned long flags)
Nitin A Kamblebbe9abb2007-09-15 10:23:07 +0300850{
Avi Kivity9ae9feb2013-01-19 19:51:52 +0200851 u8 rc;
852 void (*fop)(void) = (void *)em_setcc + 4 * (condition & 0xf);
Nitin A Kamblebbe9abb2007-09-15 10:23:07 +0300853
Avi Kivity9ae9feb2013-01-19 19:51:52 +0200854 flags = (flags & EFLAGS_MASK) | X86_EFLAGS_IF;
Avi Kivity3f0c3d02013-01-26 23:56:04 +0200855 asm("push %[flags]; popf; call *%[fastop]"
Avi Kivity9ae9feb2013-01-19 19:51:52 +0200856 : "=a"(rc) : [fastop]"r"(fop), [flags]"r"(flags));
857 return rc;
Nitin A Kamblebbe9abb2007-09-15 10:23:07 +0300858}
859
Avi Kivity91ff3cb2010-08-01 12:53:09 +0300860static void fetch_register_operand(struct operand *op)
861{
862 switch (op->bytes) {
863 case 1:
864 op->val = *(u8 *)op->addr.reg;
865 break;
866 case 2:
867 op->val = *(u16 *)op->addr.reg;
868 break;
869 case 4:
870 op->val = *(u32 *)op->addr.reg;
871 break;
872 case 8:
873 op->val = *(u64 *)op->addr.reg;
874 break;
875 }
876}
877
Avi Kivity12537912011-03-29 11:41:27 +0200878static void read_sse_reg(struct x86_emulate_ctxt *ctxt, sse128_t *data, int reg)
879{
880 ctxt->ops->get_fpu(ctxt);
881 switch (reg) {
Mathias Krause89a87c62012-08-30 01:30:14 +0200882 case 0: asm("movdqa %%xmm0, %0" : "=m"(*data)); break;
883 case 1: asm("movdqa %%xmm1, %0" : "=m"(*data)); break;
884 case 2: asm("movdqa %%xmm2, %0" : "=m"(*data)); break;
885 case 3: asm("movdqa %%xmm3, %0" : "=m"(*data)); break;
886 case 4: asm("movdqa %%xmm4, %0" : "=m"(*data)); break;
887 case 5: asm("movdqa %%xmm5, %0" : "=m"(*data)); break;
888 case 6: asm("movdqa %%xmm6, %0" : "=m"(*data)); break;
889 case 7: asm("movdqa %%xmm7, %0" : "=m"(*data)); break;
Avi Kivity12537912011-03-29 11:41:27 +0200890#ifdef CONFIG_X86_64
Mathias Krause89a87c62012-08-30 01:30:14 +0200891 case 8: asm("movdqa %%xmm8, %0" : "=m"(*data)); break;
892 case 9: asm("movdqa %%xmm9, %0" : "=m"(*data)); break;
893 case 10: asm("movdqa %%xmm10, %0" : "=m"(*data)); break;
894 case 11: asm("movdqa %%xmm11, %0" : "=m"(*data)); break;
895 case 12: asm("movdqa %%xmm12, %0" : "=m"(*data)); break;
896 case 13: asm("movdqa %%xmm13, %0" : "=m"(*data)); break;
897 case 14: asm("movdqa %%xmm14, %0" : "=m"(*data)); break;
898 case 15: asm("movdqa %%xmm15, %0" : "=m"(*data)); break;
Avi Kivity12537912011-03-29 11:41:27 +0200899#endif
900 default: BUG();
901 }
902 ctxt->ops->put_fpu(ctxt);
903}
904
905static void write_sse_reg(struct x86_emulate_ctxt *ctxt, sse128_t *data,
906 int reg)
907{
908 ctxt->ops->get_fpu(ctxt);
909 switch (reg) {
Mathias Krause89a87c62012-08-30 01:30:14 +0200910 case 0: asm("movdqa %0, %%xmm0" : : "m"(*data)); break;
911 case 1: asm("movdqa %0, %%xmm1" : : "m"(*data)); break;
912 case 2: asm("movdqa %0, %%xmm2" : : "m"(*data)); break;
913 case 3: asm("movdqa %0, %%xmm3" : : "m"(*data)); break;
914 case 4: asm("movdqa %0, %%xmm4" : : "m"(*data)); break;
915 case 5: asm("movdqa %0, %%xmm5" : : "m"(*data)); break;
916 case 6: asm("movdqa %0, %%xmm6" : : "m"(*data)); break;
917 case 7: asm("movdqa %0, %%xmm7" : : "m"(*data)); break;
Avi Kivity12537912011-03-29 11:41:27 +0200918#ifdef CONFIG_X86_64
Mathias Krause89a87c62012-08-30 01:30:14 +0200919 case 8: asm("movdqa %0, %%xmm8" : : "m"(*data)); break;
920 case 9: asm("movdqa %0, %%xmm9" : : "m"(*data)); break;
921 case 10: asm("movdqa %0, %%xmm10" : : "m"(*data)); break;
922 case 11: asm("movdqa %0, %%xmm11" : : "m"(*data)); break;
923 case 12: asm("movdqa %0, %%xmm12" : : "m"(*data)); break;
924 case 13: asm("movdqa %0, %%xmm13" : : "m"(*data)); break;
925 case 14: asm("movdqa %0, %%xmm14" : : "m"(*data)); break;
926 case 15: asm("movdqa %0, %%xmm15" : : "m"(*data)); break;
Avi Kivity12537912011-03-29 11:41:27 +0200927#endif
928 default: BUG();
929 }
930 ctxt->ops->put_fpu(ctxt);
931}
932
Avi Kivitycbe2c9d2012-04-09 18:40:02 +0300933static void read_mmx_reg(struct x86_emulate_ctxt *ctxt, u64 *data, int reg)
934{
935 ctxt->ops->get_fpu(ctxt);
936 switch (reg) {
937 case 0: asm("movq %%mm0, %0" : "=m"(*data)); break;
938 case 1: asm("movq %%mm1, %0" : "=m"(*data)); break;
939 case 2: asm("movq %%mm2, %0" : "=m"(*data)); break;
940 case 3: asm("movq %%mm3, %0" : "=m"(*data)); break;
941 case 4: asm("movq %%mm4, %0" : "=m"(*data)); break;
942 case 5: asm("movq %%mm5, %0" : "=m"(*data)); break;
943 case 6: asm("movq %%mm6, %0" : "=m"(*data)); break;
944 case 7: asm("movq %%mm7, %0" : "=m"(*data)); break;
945 default: BUG();
946 }
947 ctxt->ops->put_fpu(ctxt);
948}
949
950static void write_mmx_reg(struct x86_emulate_ctxt *ctxt, u64 *data, int reg)
951{
952 ctxt->ops->get_fpu(ctxt);
953 switch (reg) {
954 case 0: asm("movq %0, %%mm0" : : "m"(*data)); break;
955 case 1: asm("movq %0, %%mm1" : : "m"(*data)); break;
956 case 2: asm("movq %0, %%mm2" : : "m"(*data)); break;
957 case 3: asm("movq %0, %%mm3" : : "m"(*data)); break;
958 case 4: asm("movq %0, %%mm4" : : "m"(*data)); break;
959 case 5: asm("movq %0, %%mm5" : : "m"(*data)); break;
960 case 6: asm("movq %0, %%mm6" : : "m"(*data)); break;
961 case 7: asm("movq %0, %%mm7" : : "m"(*data)); break;
962 default: BUG();
963 }
964 ctxt->ops->put_fpu(ctxt);
965}
966
Gleb Natapov045a2822012-12-20 16:57:43 +0200967static int em_fninit(struct x86_emulate_ctxt *ctxt)
968{
969 if (ctxt->ops->get_cr(ctxt, 0) & (X86_CR0_TS | X86_CR0_EM))
970 return emulate_nm(ctxt);
971
972 ctxt->ops->get_fpu(ctxt);
973 asm volatile("fninit");
974 ctxt->ops->put_fpu(ctxt);
975 return X86EMUL_CONTINUE;
976}
977
978static int em_fnstcw(struct x86_emulate_ctxt *ctxt)
979{
980 u16 fcw;
981
982 if (ctxt->ops->get_cr(ctxt, 0) & (X86_CR0_TS | X86_CR0_EM))
983 return emulate_nm(ctxt);
984
985 ctxt->ops->get_fpu(ctxt);
986 asm volatile("fnstcw %0": "+m"(fcw));
987 ctxt->ops->put_fpu(ctxt);
988
989 /* force 2 byte destination */
990 ctxt->dst.bytes = 2;
991 ctxt->dst.val = fcw;
992
993 return X86EMUL_CONTINUE;
994}
995
996static int em_fnstsw(struct x86_emulate_ctxt *ctxt)
997{
998 u16 fsw;
999
1000 if (ctxt->ops->get_cr(ctxt, 0) & (X86_CR0_TS | X86_CR0_EM))
1001 return emulate_nm(ctxt);
1002
1003 ctxt->ops->get_fpu(ctxt);
1004 asm volatile("fnstsw %0": "+m"(fsw));
1005 ctxt->ops->put_fpu(ctxt);
1006
1007 /* force 2 byte destination */
1008 ctxt->dst.bytes = 2;
1009 ctxt->dst.val = fsw;
1010
1011 return X86EMUL_CONTINUE;
1012}
1013
Avi Kivity12537912011-03-29 11:41:27 +02001014static void decode_register_operand(struct x86_emulate_ctxt *ctxt,
Avi Kivity2adb5ad2012-01-16 15:08:45 +02001015 struct operand *op)
Avi Kivity3c118e22007-10-31 10:27:04 +02001016{
Avi Kivity9dac77f2011-06-01 15:34:25 +03001017 unsigned reg = ctxt->modrm_reg;
Avi Kivity33615aa2007-10-31 11:15:56 +02001018
Avi Kivity9dac77f2011-06-01 15:34:25 +03001019 if (!(ctxt->d & ModRM))
1020 reg = (ctxt->b & 7) | ((ctxt->rex_prefix & 1) << 3);
Avi Kivity12537912011-03-29 11:41:27 +02001021
Avi Kivity9dac77f2011-06-01 15:34:25 +03001022 if (ctxt->d & Sse) {
Avi Kivity12537912011-03-29 11:41:27 +02001023 op->type = OP_XMM;
1024 op->bytes = 16;
1025 op->addr.xmm = reg;
1026 read_sse_reg(ctxt, &op->vec_val, reg);
1027 return;
1028 }
Avi Kivitycbe2c9d2012-04-09 18:40:02 +03001029 if (ctxt->d & Mmx) {
1030 reg &= 7;
1031 op->type = OP_MM;
1032 op->bytes = 8;
1033 op->addr.mm = reg;
1034 return;
1035 }
Avi Kivity12537912011-03-29 11:41:27 +02001036
Avi Kivity3c118e22007-10-31 10:27:04 +02001037 op->type = OP_REG;
Gleb Natapov6d4d85e2013-11-04 15:52:42 +02001038 op->bytes = (ctxt->d & ByteOp) ? 1 : ctxt->op_bytes;
1039 op->addr.reg = decode_register(ctxt, reg, ctxt->d & ByteOp);
1040
Avi Kivity91ff3cb2010-08-01 12:53:09 +03001041 fetch_register_operand(op);
Avi Kivity3c118e22007-10-31 10:27:04 +02001042 op->orig_val = op->val;
1043}
1044
Avi Kivitya6e34072012-06-10 17:15:39 +03001045static void adjust_modrm_seg(struct x86_emulate_ctxt *ctxt, int base_reg)
1046{
1047 if (base_reg == VCPU_REGS_RSP || base_reg == VCPU_REGS_RBP)
1048 ctxt->modrm_seg = VCPU_SREG_SS;
1049}
1050
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001051static int decode_modrm(struct x86_emulate_ctxt *ctxt,
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001052 struct operand *op)
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001053{
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001054 u8 sib;
Bandan Das02357bd2014-04-16 12:46:11 -04001055 int index_reg, base_reg, scale;
Takuya Yoshikawa3e2815e2010-02-12 15:53:59 +09001056 int rc = X86EMUL_CONTINUE;
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001057 ulong modrm_ea = 0;
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001058
Bandan Das02357bd2014-04-16 12:46:11 -04001059 ctxt->modrm_reg = ((ctxt->rex_prefix << 1) & 8); /* REX.R */
1060 index_reg = (ctxt->rex_prefix << 2) & 8; /* REX.X */
1061 base_reg = (ctxt->rex_prefix << 3) & 8; /* REX.B */
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001062
Bandan Das02357bd2014-04-16 12:46:11 -04001063 ctxt->modrm_mod = (ctxt->modrm & 0xc0) >> 6;
Avi Kivity9dac77f2011-06-01 15:34:25 +03001064 ctxt->modrm_reg |= (ctxt->modrm & 0x38) >> 3;
Bandan Das02357bd2014-04-16 12:46:11 -04001065 ctxt->modrm_rm = base_reg | (ctxt->modrm & 0x07);
Avi Kivity9dac77f2011-06-01 15:34:25 +03001066 ctxt->modrm_seg = VCPU_SREG_DS;
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001067
Nadav Amit9b88ae92014-05-25 23:05:21 +03001068 if (ctxt->modrm_mod == 3 || (ctxt->d & NoMod)) {
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001069 op->type = OP_REG;
Avi Kivity9dac77f2011-06-01 15:34:25 +03001070 op->bytes = (ctxt->d & ByteOp) ? 1 : ctxt->op_bytes;
Paolo Bonzini8acb42072013-05-30 16:35:55 +02001071 op->addr.reg = decode_register(ctxt, ctxt->modrm_rm,
Gleb Natapovaa9ac1a2013-11-04 15:52:41 +02001072 ctxt->d & ByteOp);
Avi Kivity9dac77f2011-06-01 15:34:25 +03001073 if (ctxt->d & Sse) {
Avi Kivity12537912011-03-29 11:41:27 +02001074 op->type = OP_XMM;
1075 op->bytes = 16;
Avi Kivity9dac77f2011-06-01 15:34:25 +03001076 op->addr.xmm = ctxt->modrm_rm;
1077 read_sse_reg(ctxt, &op->vec_val, ctxt->modrm_rm);
Avi Kivity12537912011-03-29 11:41:27 +02001078 return rc;
1079 }
Avi Kivitycbe2c9d2012-04-09 18:40:02 +03001080 if (ctxt->d & Mmx) {
1081 op->type = OP_MM;
1082 op->bytes = 8;
Paolo Bonzinibdc90722014-05-06 14:03:29 +02001083 op->addr.mm = ctxt->modrm_rm & 7;
Avi Kivitycbe2c9d2012-04-09 18:40:02 +03001084 return rc;
1085 }
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001086 fetch_register_operand(op);
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001087 return rc;
1088 }
1089
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001090 op->type = OP_MEM;
1091
Avi Kivity9dac77f2011-06-01 15:34:25 +03001092 if (ctxt->ad_bytes == 2) {
Avi Kivitydd856ef2012-08-27 23:46:17 +03001093 unsigned bx = reg_read(ctxt, VCPU_REGS_RBX);
1094 unsigned bp = reg_read(ctxt, VCPU_REGS_RBP);
1095 unsigned si = reg_read(ctxt, VCPU_REGS_RSI);
1096 unsigned di = reg_read(ctxt, VCPU_REGS_RDI);
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001097
1098 /* 16-bit ModR/M decode. */
Avi Kivity9dac77f2011-06-01 15:34:25 +03001099 switch (ctxt->modrm_mod) {
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001100 case 0:
Avi Kivity9dac77f2011-06-01 15:34:25 +03001101 if (ctxt->modrm_rm == 6)
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09001102 modrm_ea += insn_fetch(u16, ctxt);
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001103 break;
1104 case 1:
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09001105 modrm_ea += insn_fetch(s8, ctxt);
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001106 break;
1107 case 2:
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09001108 modrm_ea += insn_fetch(u16, ctxt);
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001109 break;
1110 }
Avi Kivity9dac77f2011-06-01 15:34:25 +03001111 switch (ctxt->modrm_rm) {
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001112 case 0:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001113 modrm_ea += bx + si;
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001114 break;
1115 case 1:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001116 modrm_ea += bx + di;
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001117 break;
1118 case 2:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001119 modrm_ea += bp + si;
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001120 break;
1121 case 3:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001122 modrm_ea += bp + di;
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001123 break;
1124 case 4:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001125 modrm_ea += si;
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001126 break;
1127 case 5:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001128 modrm_ea += di;
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001129 break;
1130 case 6:
Avi Kivity9dac77f2011-06-01 15:34:25 +03001131 if (ctxt->modrm_mod != 0)
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001132 modrm_ea += bp;
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001133 break;
1134 case 7:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001135 modrm_ea += bx;
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001136 break;
1137 }
Avi Kivity9dac77f2011-06-01 15:34:25 +03001138 if (ctxt->modrm_rm == 2 || ctxt->modrm_rm == 3 ||
1139 (ctxt->modrm_rm == 6 && ctxt->modrm_mod != 0))
1140 ctxt->modrm_seg = VCPU_SREG_SS;
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001141 modrm_ea = (u16)modrm_ea;
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001142 } else {
1143 /* 32/64-bit ModR/M decode. */
Avi Kivity9dac77f2011-06-01 15:34:25 +03001144 if ((ctxt->modrm_rm & 7) == 4) {
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09001145 sib = insn_fetch(u8, ctxt);
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001146 index_reg |= (sib >> 3) & 7;
1147 base_reg |= sib & 7;
1148 scale = sib >> 6;
1149
Avi Kivity9dac77f2011-06-01 15:34:25 +03001150 if ((base_reg & 7) == 5 && ctxt->modrm_mod == 0)
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09001151 modrm_ea += insn_fetch(s32, ctxt);
Avi Kivitya6e34072012-06-10 17:15:39 +03001152 else {
Avi Kivitydd856ef2012-08-27 23:46:17 +03001153 modrm_ea += reg_read(ctxt, base_reg);
Avi Kivitya6e34072012-06-10 17:15:39 +03001154 adjust_modrm_seg(ctxt, base_reg);
1155 }
Avi Kivitydc71d0f2008-06-15 21:23:17 -07001156 if (index_reg != 4)
Avi Kivitydd856ef2012-08-27 23:46:17 +03001157 modrm_ea += reg_read(ctxt, index_reg) << scale;
Avi Kivity9dac77f2011-06-01 15:34:25 +03001158 } else if ((ctxt->modrm_rm & 7) == 5 && ctxt->modrm_mod == 0) {
Avi Kivity84411d82008-06-15 21:53:26 -07001159 if (ctxt->mode == X86EMUL_MODE_PROT64)
Avi Kivity9dac77f2011-06-01 15:34:25 +03001160 ctxt->rip_relative = 1;
Avi Kivitya6e34072012-06-10 17:15:39 +03001161 } else {
1162 base_reg = ctxt->modrm_rm;
Avi Kivitydd856ef2012-08-27 23:46:17 +03001163 modrm_ea += reg_read(ctxt, base_reg);
Avi Kivitya6e34072012-06-10 17:15:39 +03001164 adjust_modrm_seg(ctxt, base_reg);
1165 }
Avi Kivity9dac77f2011-06-01 15:34:25 +03001166 switch (ctxt->modrm_mod) {
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001167 case 0:
Avi Kivity9dac77f2011-06-01 15:34:25 +03001168 if (ctxt->modrm_rm == 5)
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09001169 modrm_ea += insn_fetch(s32, ctxt);
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001170 break;
1171 case 1:
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09001172 modrm_ea += insn_fetch(s8, ctxt);
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001173 break;
1174 case 2:
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09001175 modrm_ea += insn_fetch(s32, ctxt);
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001176 break;
1177 }
1178 }
Avi Kivity90de84f2010-11-17 15:28:21 +02001179 op->addr.mem.ea = modrm_ea;
Bandan Das41061cd2014-04-16 12:46:14 -04001180 if (ctxt->ad_bytes != 8)
1181 ctxt->memop.addr.mem.ea = (u32)ctxt->memop.addr.mem.ea;
1182
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001183done:
1184 return rc;
1185}
1186
1187static int decode_abs(struct x86_emulate_ctxt *ctxt,
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001188 struct operand *op)
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001189{
Takuya Yoshikawa3e2815e2010-02-12 15:53:59 +09001190 int rc = X86EMUL_CONTINUE;
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001191
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03001192 op->type = OP_MEM;
Avi Kivity9dac77f2011-06-01 15:34:25 +03001193 switch (ctxt->ad_bytes) {
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001194 case 2:
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09001195 op->addr.mem.ea = insn_fetch(u16, ctxt);
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001196 break;
1197 case 4:
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09001198 op->addr.mem.ea = insn_fetch(u32, ctxt);
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001199 break;
1200 case 8:
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09001201 op->addr.mem.ea = insn_fetch(u64, ctxt);
Avi Kivity1c73ef6652007-11-01 06:31:28 +02001202 break;
1203 }
1204done:
1205 return rc;
1206}
1207
Avi Kivity9dac77f2011-06-01 15:34:25 +03001208static void fetch_bit_operand(struct x86_emulate_ctxt *ctxt)
Wei Yongjun35c843c2010-08-09 11:34:56 +08001209{
Sheng Yang7129eec2010-09-28 16:33:32 +08001210 long sv = 0, mask;
Wei Yongjun35c843c2010-08-09 11:34:56 +08001211
Avi Kivity9dac77f2011-06-01 15:34:25 +03001212 if (ctxt->dst.type == OP_MEM && ctxt->src.type == OP_REG) {
Nadav Amit7dec5602014-06-15 16:12:57 +03001213 mask = ~((long)ctxt->dst.bytes * 8 - 1);
Wei Yongjun35c843c2010-08-09 11:34:56 +08001214
Avi Kivity9dac77f2011-06-01 15:34:25 +03001215 if (ctxt->src.bytes == 2)
1216 sv = (s16)ctxt->src.val & (s16)mask;
1217 else if (ctxt->src.bytes == 4)
1218 sv = (s32)ctxt->src.val & (s32)mask;
Nadav Amit7dec5602014-06-15 16:12:57 +03001219 else
1220 sv = (s64)ctxt->src.val & (s64)mask;
Wei Yongjun35c843c2010-08-09 11:34:56 +08001221
Avi Kivity9dac77f2011-06-01 15:34:25 +03001222 ctxt->dst.addr.mem.ea += (sv >> 3);
Wei Yongjun35c843c2010-08-09 11:34:56 +08001223 }
Wei Yongjunba7ff2b2010-08-09 11:39:14 +08001224
1225 /* only subword offset */
Avi Kivity9dac77f2011-06-01 15:34:25 +03001226 ctxt->src.val &= (ctxt->dst.bytes << 3) - 1;
Wei Yongjun35c843c2010-08-09 11:34:56 +08001227}
1228
Gleb Natapov9de41572010-04-28 19:15:22 +03001229static int read_emulated(struct x86_emulate_ctxt *ctxt,
Gleb Natapov9de41572010-04-28 19:15:22 +03001230 unsigned long addr, void *dest, unsigned size)
1231{
1232 int rc;
Avi Kivity9dac77f2011-06-01 15:34:25 +03001233 struct read_cache *mc = &ctxt->mem_read;
Gleb Natapov9de41572010-04-28 19:15:22 +03001234
Xiao Guangrongf23b0702012-07-26 13:12:22 +08001235 if (mc->pos < mc->end)
1236 goto read_cached;
Gleb Natapov9de41572010-04-28 19:15:22 +03001237
Xiao Guangrongf23b0702012-07-26 13:12:22 +08001238 WARN_ON((mc->end + size) >= sizeof(mc->data));
Gleb Natapov9de41572010-04-28 19:15:22 +03001239
Xiao Guangrongf23b0702012-07-26 13:12:22 +08001240 rc = ctxt->ops->read_emulated(ctxt, addr, mc->data + mc->end, size,
1241 &ctxt->exception);
1242 if (rc != X86EMUL_CONTINUE)
1243 return rc;
1244
1245 mc->end += size;
1246
1247read_cached:
1248 memcpy(dest, mc->data + mc->pos, size);
1249 mc->pos += size;
Gleb Natapov9de41572010-04-28 19:15:22 +03001250 return X86EMUL_CONTINUE;
1251}
1252
Avi Kivity3ca3ac42011-03-31 16:52:26 +02001253static int segmented_read(struct x86_emulate_ctxt *ctxt,
1254 struct segmented_address addr,
1255 void *data,
1256 unsigned size)
1257{
Avi Kivity9fa088f2011-03-31 18:54:30 +02001258 int rc;
1259 ulong linear;
1260
Avi Kivity83b87952011-04-03 11:31:19 +03001261 rc = linearize(ctxt, addr, size, false, &linear);
Avi Kivity9fa088f2011-03-31 18:54:30 +02001262 if (rc != X86EMUL_CONTINUE)
1263 return rc;
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001264 return read_emulated(ctxt, linear, data, size);
Avi Kivity3ca3ac42011-03-31 16:52:26 +02001265}
1266
1267static int segmented_write(struct x86_emulate_ctxt *ctxt,
1268 struct segmented_address addr,
1269 const void *data,
1270 unsigned size)
1271{
Avi Kivity9fa088f2011-03-31 18:54:30 +02001272 int rc;
1273 ulong linear;
1274
Avi Kivity83b87952011-04-03 11:31:19 +03001275 rc = linearize(ctxt, addr, size, true, &linear);
Avi Kivity9fa088f2011-03-31 18:54:30 +02001276 if (rc != X86EMUL_CONTINUE)
1277 return rc;
Avi Kivity0f65dd72011-04-20 13:37:53 +03001278 return ctxt->ops->write_emulated(ctxt, linear, data, size,
1279 &ctxt->exception);
Avi Kivity3ca3ac42011-03-31 16:52:26 +02001280}
1281
1282static int segmented_cmpxchg(struct x86_emulate_ctxt *ctxt,
1283 struct segmented_address addr,
1284 const void *orig_data, const void *data,
1285 unsigned size)
1286{
Avi Kivity9fa088f2011-03-31 18:54:30 +02001287 int rc;
1288 ulong linear;
1289
Avi Kivity83b87952011-04-03 11:31:19 +03001290 rc = linearize(ctxt, addr, size, true, &linear);
Avi Kivity9fa088f2011-03-31 18:54:30 +02001291 if (rc != X86EMUL_CONTINUE)
1292 return rc;
Avi Kivity0f65dd72011-04-20 13:37:53 +03001293 return ctxt->ops->cmpxchg_emulated(ctxt, linear, orig_data, data,
1294 size, &ctxt->exception);
Avi Kivity3ca3ac42011-03-31 16:52:26 +02001295}
1296
Gleb Natapov7b262e92010-03-18 15:20:27 +02001297static int pio_in_emulated(struct x86_emulate_ctxt *ctxt,
Gleb Natapov7b262e92010-03-18 15:20:27 +02001298 unsigned int size, unsigned short port,
1299 void *dest)
1300{
Avi Kivity9dac77f2011-06-01 15:34:25 +03001301 struct read_cache *rc = &ctxt->io_read;
Gleb Natapov7b262e92010-03-18 15:20:27 +02001302
1303 if (rc->pos == rc->end) { /* refill pio read ahead */
Gleb Natapov7b262e92010-03-18 15:20:27 +02001304 unsigned int in_page, n;
Avi Kivity9dac77f2011-06-01 15:34:25 +03001305 unsigned int count = ctxt->rep_prefix ?
Avi Kivitydd856ef2012-08-27 23:46:17 +03001306 address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) : 1;
Gleb Natapov7b262e92010-03-18 15:20:27 +02001307 in_page = (ctxt->eflags & EFLG_DF) ?
Avi Kivitydd856ef2012-08-27 23:46:17 +03001308 offset_in_page(reg_read(ctxt, VCPU_REGS_RDI)) :
1309 PAGE_SIZE - offset_in_page(reg_read(ctxt, VCPU_REGS_RDI));
Gleb Natapov7b262e92010-03-18 15:20:27 +02001310 n = min(min(in_page, (unsigned int)sizeof(rc->data)) / size,
1311 count);
1312 if (n == 0)
1313 n = 1;
1314 rc->pos = rc->end = 0;
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001315 if (!ctxt->ops->pio_in_emulated(ctxt, size, port, rc->data, n))
Gleb Natapov7b262e92010-03-18 15:20:27 +02001316 return 0;
1317 rc->end = n * size;
1318 }
1319
Nadav Amite6e39f02014-04-18 03:35:10 +03001320 if (ctxt->rep_prefix && (ctxt->d & String) &&
1321 !(ctxt->eflags & EFLG_DF)) {
Gleb Natapovb3356bf2012-09-03 15:24:29 +03001322 ctxt->dst.data = rc->data + rc->pos;
1323 ctxt->dst.type = OP_MEM_STR;
1324 ctxt->dst.count = (rc->end - rc->pos) / size;
1325 rc->pos = rc->end;
1326 } else {
1327 memcpy(dest, rc->data + rc->pos, size);
1328 rc->pos += size;
1329 }
Gleb Natapov7b262e92010-03-18 15:20:27 +02001330 return 1;
1331}
1332
Kevin Wolf7f3d35f2012-02-08 14:34:38 +01001333static int read_interrupt_descriptor(struct x86_emulate_ctxt *ctxt,
1334 u16 index, struct desc_struct *desc)
1335{
1336 struct desc_ptr dt;
1337 ulong addr;
1338
1339 ctxt->ops->get_idt(ctxt, &dt);
1340
1341 if (dt.size < index * 8 + 7)
1342 return emulate_gp(ctxt, index << 3 | 0x2);
1343
1344 addr = dt.address + index * 8;
1345 return ctxt->ops->read_std(ctxt, addr, desc, sizeof *desc,
1346 &ctxt->exception);
1347}
1348
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001349static void get_descriptor_table_ptr(struct x86_emulate_ctxt *ctxt,
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001350 u16 selector, struct desc_ptr *dt)
1351{
Mathias Krause0225fb52012-08-30 01:30:16 +02001352 const struct x86_emulate_ops *ops = ctxt->ops;
Nadav Amit2eedcac2014-06-02 18:34:05 +03001353 u32 base3 = 0;
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001354
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001355 if (selector & 1 << 2) {
1356 struct desc_struct desc;
Avi Kivity1aa36612011-04-27 13:20:30 +03001357 u16 sel;
1358
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001359 memset (dt, 0, sizeof *dt);
Nadav Amit2eedcac2014-06-02 18:34:05 +03001360 if (!ops->get_segment(ctxt, &sel, &desc, &base3,
1361 VCPU_SREG_LDTR))
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001362 return;
1363
1364 dt->size = desc_limit_scaled(&desc); /* what if limit > 65535? */
Nadav Amit2eedcac2014-06-02 18:34:05 +03001365 dt->address = get_desc_base(&desc) | ((u64)base3 << 32);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001366 } else
Avi Kivity4bff1e862011-04-20 13:37:53 +03001367 ops->get_gdt(ctxt, dt);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001368}
1369
1370/* allowed just for 8 bytes segments */
1371static int read_segment_descriptor(struct x86_emulate_ctxt *ctxt,
Avi Kivitye9194642012-06-13 16:29:39 +03001372 u16 selector, struct desc_struct *desc,
1373 ulong *desc_addr_p)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001374{
1375 struct desc_ptr dt;
1376 u16 index = selector >> 3;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001377 ulong addr;
1378
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001379 get_descriptor_table_ptr(ctxt, selector, &dt);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001380
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001381 if (dt.size < index * 8 + 7)
1382 return emulate_gp(ctxt, selector & 0xfffc);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001383
Avi Kivitye9194642012-06-13 16:29:39 +03001384 *desc_addr_p = addr = dt.address + index * 8;
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001385 return ctxt->ops->read_std(ctxt, addr, desc, sizeof *desc,
1386 &ctxt->exception);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001387}
1388
1389/* allowed just for 8 bytes segments */
1390static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt,
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001391 u16 selector, struct desc_struct *desc)
1392{
1393 struct desc_ptr dt;
1394 u16 index = selector >> 3;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001395 ulong addr;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001396
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001397 get_descriptor_table_ptr(ctxt, selector, &dt);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001398
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001399 if (dt.size < index * 8 + 7)
1400 return emulate_gp(ctxt, selector & 0xfffc);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001401
1402 addr = dt.address + index * 8;
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001403 return ctxt->ops->write_std(ctxt, addr, desc, sizeof *desc,
1404 &ctxt->exception);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001405}
1406
Gleb Natapov5601d052011-03-07 14:55:06 +02001407/* Does not support long mode */
Paolo Bonzini2356aae2014-05-15 17:56:57 +02001408static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
Paolo Bonzini5045b462014-05-15 18:09:29 +02001409 u16 selector, int seg, u8 cpl, bool in_task_switch)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001410{
Avi Kivity869be992012-06-13 16:30:53 +03001411 struct desc_struct seg_desc, old_desc;
Paolo Bonzini2356aae2014-05-15 17:56:57 +02001412 u8 dpl, rpl;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001413 unsigned err_vec = GP_VECTOR;
1414 u32 err_code = 0;
1415 bool null_selector = !(selector & ~0x3); /* 0000-0003 are null */
Avi Kivitye9194642012-06-13 16:29:39 +03001416 ulong desc_addr;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001417 int ret;
Avi Kivity03ebebe2012-08-21 17:07:04 +03001418 u16 dummy;
Nadav Amite37a75a2014-06-02 18:34:04 +03001419 u32 base3 = 0;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001420
1421 memset(&seg_desc, 0, sizeof seg_desc);
1422
Kevin Wolff8da94e2013-04-11 14:06:03 +02001423 if (ctxt->mode == X86EMUL_MODE_REAL) {
1424 /* set real mode segment descriptor (keep limit etc. for
1425 * unreal mode) */
Avi Kivity03ebebe2012-08-21 17:07:04 +03001426 ctxt->ops->get_segment(ctxt, &dummy, &seg_desc, NULL, seg);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001427 set_desc_base(&seg_desc, selector << 4);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001428 goto load;
Kevin Wolff8da94e2013-04-11 14:06:03 +02001429 } else if (seg <= VCPU_SREG_GS && ctxt->mode == X86EMUL_MODE_VM86) {
1430 /* VM86 needs a clean new segment descriptor */
1431 set_desc_base(&seg_desc, selector << 4);
1432 set_desc_limit(&seg_desc, 0xffff);
1433 seg_desc.type = 3;
1434 seg_desc.p = 1;
1435 seg_desc.s = 1;
1436 seg_desc.dpl = 3;
1437 goto load;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001438 }
1439
Avi Kivity79d5b4c2012-06-07 17:03:42 +03001440 rpl = selector & 3;
Avi Kivity79d5b4c2012-06-07 17:03:42 +03001441
1442 /* NULL selector is not valid for TR, CS and SS (except for long mode) */
1443 if ((seg == VCPU_SREG_CS
1444 || (seg == VCPU_SREG_SS
1445 && (ctxt->mode != X86EMUL_MODE_PROT64 || rpl != cpl))
1446 || seg == VCPU_SREG_TR)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001447 && null_selector)
1448 goto exception;
1449
1450 /* TR should be in GDT only */
1451 if (seg == VCPU_SREG_TR && (selector & (1 << 2)))
1452 goto exception;
1453
1454 if (null_selector) /* for NULL selector skip all following checks */
1455 goto load;
1456
Avi Kivitye9194642012-06-13 16:29:39 +03001457 ret = read_segment_descriptor(ctxt, selector, &seg_desc, &desc_addr);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001458 if (ret != X86EMUL_CONTINUE)
1459 return ret;
1460
1461 err_code = selector & 0xfffc;
1462 err_vec = GP_VECTOR;
1463
Guo Chaofc058682012-06-28 15:19:51 +08001464 /* can't load system descriptor into segment selector */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001465 if (seg <= VCPU_SREG_GS && !seg_desc.s)
1466 goto exception;
1467
1468 if (!seg_desc.p) {
1469 err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR;
1470 goto exception;
1471 }
1472
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001473 dpl = seg_desc.dpl;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001474
1475 switch (seg) {
1476 case VCPU_SREG_SS:
1477 /*
1478 * segment is not a writable data segment or segment
1479 * selector's RPL != CPL or segment selector's RPL != CPL
1480 */
1481 if (rpl != cpl || (seg_desc.type & 0xa) != 0x2 || dpl != cpl)
1482 goto exception;
1483 break;
1484 case VCPU_SREG_CS:
Paolo Bonzini5045b462014-05-15 18:09:29 +02001485 if (in_task_switch && rpl != dpl)
1486 goto exception;
1487
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001488 if (!(seg_desc.type & 8))
1489 goto exception;
1490
1491 if (seg_desc.type & 4) {
1492 /* conforming */
1493 if (dpl > cpl)
1494 goto exception;
1495 } else {
1496 /* nonconforming */
1497 if (rpl > cpl || dpl != cpl)
1498 goto exception;
1499 }
1500 /* CS(RPL) <- CPL */
1501 selector = (selector & 0xfffc) | cpl;
1502 break;
1503 case VCPU_SREG_TR:
1504 if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9))
1505 goto exception;
Avi Kivity869be992012-06-13 16:30:53 +03001506 old_desc = seg_desc;
1507 seg_desc.type |= 2; /* busy */
1508 ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc,
1509 sizeof(seg_desc), &ctxt->exception);
1510 if (ret != X86EMUL_CONTINUE)
1511 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001512 break;
1513 case VCPU_SREG_LDTR:
1514 if (seg_desc.s || seg_desc.type != 2)
1515 goto exception;
1516 break;
1517 default: /* DS, ES, FS, or GS */
1518 /*
1519 * segment is not a data or readable code segment or
1520 * ((segment is a data or nonconforming code segment)
1521 * and (both RPL and CPL > DPL))
1522 */
1523 if ((seg_desc.type & 0xa) == 0x8 ||
1524 (((seg_desc.type & 0xc) != 0xc) &&
1525 (rpl > dpl && cpl > dpl)))
1526 goto exception;
1527 break;
1528 }
1529
1530 if (seg_desc.s) {
1531 /* mark segment as accessed */
1532 seg_desc.type |= 1;
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001533 ret = write_segment_descriptor(ctxt, selector, &seg_desc);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001534 if (ret != X86EMUL_CONTINUE)
1535 return ret;
Nadav Amite37a75a2014-06-02 18:34:04 +03001536 } else if (ctxt->mode == X86EMUL_MODE_PROT64) {
1537 ret = ctxt->ops->read_std(ctxt, desc_addr+8, &base3,
1538 sizeof(base3), &ctxt->exception);
1539 if (ret != X86EMUL_CONTINUE)
1540 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001541 }
1542load:
Nadav Amite37a75a2014-06-02 18:34:04 +03001543 ctxt->ops->set_segment(ctxt, selector, &seg_desc, base3, seg);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001544 return X86EMUL_CONTINUE;
1545exception:
Gleb Natapov54b84862010-04-28 19:15:44 +03001546 emulate_exception(ctxt, err_vec, err_code, true);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001547 return X86EMUL_PROPAGATE_FAULT;
1548}
1549
Paolo Bonzini2356aae2014-05-15 17:56:57 +02001550static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
1551 u16 selector, int seg)
1552{
1553 u8 cpl = ctxt->ops->cpl(ctxt);
Paolo Bonzini5045b462014-05-15 18:09:29 +02001554 return __load_segment_descriptor(ctxt, selector, seg, cpl, false);
Paolo Bonzini2356aae2014-05-15 17:56:57 +02001555}
1556
Wei Yongjun31be40b2010-08-17 09:17:30 +08001557static void write_register_operand(struct operand *op)
1558{
1559 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1560 switch (op->bytes) {
1561 case 1:
1562 *(u8 *)op->addr.reg = (u8)op->val;
1563 break;
1564 case 2:
1565 *(u16 *)op->addr.reg = (u16)op->val;
1566 break;
1567 case 4:
1568 *op->addr.reg = (u32)op->val;
1569 break; /* 64b: zero-extend */
1570 case 8:
1571 *op->addr.reg = op->val;
1572 break;
1573 }
1574}
1575
Avi Kivityfb32b1e2013-02-09 11:31:44 +02001576static int writeback(struct x86_emulate_ctxt *ctxt, struct operand *op)
Wei Yongjunc37eda12010-06-15 09:03:33 +08001577{
Avi Kivityfb32b1e2013-02-09 11:31:44 +02001578 switch (op->type) {
Wei Yongjunc37eda12010-06-15 09:03:33 +08001579 case OP_REG:
Avi Kivityfb32b1e2013-02-09 11:31:44 +02001580 write_register_operand(op);
Wei Yongjunc37eda12010-06-15 09:03:33 +08001581 break;
1582 case OP_MEM:
Avi Kivity9dac77f2011-06-01 15:34:25 +03001583 if (ctxt->lock_prefix)
Paolo Bonzinif5f87df2014-04-01 13:23:24 +02001584 return segmented_cmpxchg(ctxt,
1585 op->addr.mem,
1586 &op->orig_val,
1587 &op->val,
1588 op->bytes);
1589 else
1590 return segmented_write(ctxt,
Avi Kivityfb32b1e2013-02-09 11:31:44 +02001591 op->addr.mem,
Avi Kivityfb32b1e2013-02-09 11:31:44 +02001592 &op->val,
1593 op->bytes);
Wei Yongjunc37eda12010-06-15 09:03:33 +08001594 break;
Gleb Natapovb3356bf2012-09-03 15:24:29 +03001595 case OP_MEM_STR:
Paolo Bonzinif5f87df2014-04-01 13:23:24 +02001596 return segmented_write(ctxt,
1597 op->addr.mem,
1598 op->data,
1599 op->bytes * op->count);
Gleb Natapovb3356bf2012-09-03 15:24:29 +03001600 break;
Avi Kivity12537912011-03-29 11:41:27 +02001601 case OP_XMM:
Avi Kivityfb32b1e2013-02-09 11:31:44 +02001602 write_sse_reg(ctxt, &op->vec_val, op->addr.xmm);
Avi Kivity12537912011-03-29 11:41:27 +02001603 break;
Avi Kivitycbe2c9d2012-04-09 18:40:02 +03001604 case OP_MM:
Avi Kivityfb32b1e2013-02-09 11:31:44 +02001605 write_mmx_reg(ctxt, &op->mm_val, op->addr.mm);
Avi Kivitycbe2c9d2012-04-09 18:40:02 +03001606 break;
Wei Yongjunc37eda12010-06-15 09:03:33 +08001607 case OP_NONE:
1608 /* no writeback */
1609 break;
1610 default:
1611 break;
1612 }
1613 return X86EMUL_CONTINUE;
1614}
1615
Avi Kivity51ddff52012-06-12 20:19:40 +03001616static int push(struct x86_emulate_ctxt *ctxt, void *data, int bytes)
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001617{
Takuya Yoshikawa4179bb02011-04-13 00:29:09 +09001618 struct segmented_address addr;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001619
Avi Kivity5ad105e2012-08-19 14:34:31 +03001620 rsp_increment(ctxt, -bytes);
Avi Kivitydd856ef2012-08-27 23:46:17 +03001621 addr.ea = reg_read(ctxt, VCPU_REGS_RSP) & stack_mask(ctxt);
Takuya Yoshikawa4179bb02011-04-13 00:29:09 +09001622 addr.seg = VCPU_SREG_SS;
1623
Avi Kivity51ddff52012-06-12 20:19:40 +03001624 return segmented_write(ctxt, addr, data, bytes);
1625}
1626
1627static int em_push(struct x86_emulate_ctxt *ctxt)
1628{
Takuya Yoshikawa4179bb02011-04-13 00:29:09 +09001629 /* Disable writeback. */
Avi Kivity9dac77f2011-06-01 15:34:25 +03001630 ctxt->dst.type = OP_NONE;
Avi Kivity51ddff52012-06-12 20:19:40 +03001631 return push(ctxt, &ctxt->src.val, ctxt->op_bytes);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001632}
1633
Avi Kivityfaa5a3a2008-11-27 17:36:41 +02001634static int emulate_pop(struct x86_emulate_ctxt *ctxt,
Avi Kivity350f69d2009-01-05 11:12:40 +02001635 void *dest, int len)
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001636{
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001637 int rc;
Avi Kivity90de84f2010-11-17 15:28:21 +02001638 struct segmented_address addr;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001639
Avi Kivitydd856ef2012-08-27 23:46:17 +03001640 addr.ea = reg_read(ctxt, VCPU_REGS_RSP) & stack_mask(ctxt);
Avi Kivity90de84f2010-11-17 15:28:21 +02001641 addr.seg = VCPU_SREG_SS;
Avi Kivity3ca3ac42011-03-31 16:52:26 +02001642 rc = segmented_read(ctxt, addr, dest, len);
Takuya Yoshikawab60d5132010-01-20 16:47:21 +09001643 if (rc != X86EMUL_CONTINUE)
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001644 return rc;
1645
Avi Kivity5ad105e2012-08-19 14:34:31 +03001646 rsp_increment(ctxt, len);
Avi Kivityfaa5a3a2008-11-27 17:36:41 +02001647 return rc;
1648}
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001649
Takuya Yoshikawac54fe502011-04-23 18:49:40 +09001650static int em_pop(struct x86_emulate_ctxt *ctxt)
1651{
Avi Kivity9dac77f2011-06-01 15:34:25 +03001652 return emulate_pop(ctxt, &ctxt->dst.val, ctxt->op_bytes);
Takuya Yoshikawac54fe502011-04-23 18:49:40 +09001653}
1654
Gleb Natapovd4c6a152010-02-10 14:21:34 +02001655static int emulate_popf(struct x86_emulate_ctxt *ctxt,
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001656 void *dest, int len)
Gleb Natapovd4c6a152010-02-10 14:21:34 +02001657{
1658 int rc;
1659 unsigned long val, change_mask;
1660 int iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001661 int cpl = ctxt->ops->cpl(ctxt);
Gleb Natapovd4c6a152010-02-10 14:21:34 +02001662
Takuya Yoshikawa3b9be3b2011-05-02 02:27:55 +09001663 rc = emulate_pop(ctxt, &val, len);
Gleb Natapovd4c6a152010-02-10 14:21:34 +02001664 if (rc != X86EMUL_CONTINUE)
1665 return rc;
1666
1667 change_mask = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF | EFLG_OF
1668 | EFLG_TF | EFLG_DF | EFLG_NT | EFLG_RF | EFLG_AC | EFLG_ID;
1669
1670 switch(ctxt->mode) {
1671 case X86EMUL_MODE_PROT64:
1672 case X86EMUL_MODE_PROT32:
1673 case X86EMUL_MODE_PROT16:
1674 if (cpl == 0)
1675 change_mask |= EFLG_IOPL;
1676 if (cpl <= iopl)
1677 change_mask |= EFLG_IF;
1678 break;
1679 case X86EMUL_MODE_VM86:
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001680 if (iopl < 3)
1681 return emulate_gp(ctxt, 0);
Gleb Natapovd4c6a152010-02-10 14:21:34 +02001682 change_mask |= EFLG_IF;
1683 break;
1684 default: /* real mode */
1685 change_mask |= (EFLG_IOPL | EFLG_IF);
1686 break;
1687 }
1688
1689 *(unsigned long *)dest =
1690 (ctxt->eflags & ~change_mask) | (val & change_mask);
1691
1692 return rc;
1693}
1694
Takuya Yoshikawa62aaa2f2011-04-23 18:52:56 +09001695static int em_popf(struct x86_emulate_ctxt *ctxt)
1696{
Avi Kivity9dac77f2011-06-01 15:34:25 +03001697 ctxt->dst.type = OP_REG;
1698 ctxt->dst.addr.reg = &ctxt->eflags;
1699 ctxt->dst.bytes = ctxt->op_bytes;
1700 return emulate_popf(ctxt, &ctxt->dst.val, ctxt->op_bytes);
Takuya Yoshikawa62aaa2f2011-04-23 18:52:56 +09001701}
1702
Avi Kivity612e89f2012-06-12 20:03:23 +03001703static int em_enter(struct x86_emulate_ctxt *ctxt)
1704{
1705 int rc;
1706 unsigned frame_size = ctxt->src.val;
1707 unsigned nesting_level = ctxt->src2.val & 31;
Avi Kivitydd856ef2012-08-27 23:46:17 +03001708 ulong rbp;
Avi Kivity612e89f2012-06-12 20:03:23 +03001709
1710 if (nesting_level)
1711 return X86EMUL_UNHANDLEABLE;
1712
Avi Kivitydd856ef2012-08-27 23:46:17 +03001713 rbp = reg_read(ctxt, VCPU_REGS_RBP);
1714 rc = push(ctxt, &rbp, stack_size(ctxt));
Avi Kivity612e89f2012-06-12 20:03:23 +03001715 if (rc != X86EMUL_CONTINUE)
1716 return rc;
Avi Kivitydd856ef2012-08-27 23:46:17 +03001717 assign_masked(reg_rmw(ctxt, VCPU_REGS_RBP), reg_read(ctxt, VCPU_REGS_RSP),
Avi Kivity612e89f2012-06-12 20:03:23 +03001718 stack_mask(ctxt));
Avi Kivitydd856ef2012-08-27 23:46:17 +03001719 assign_masked(reg_rmw(ctxt, VCPU_REGS_RSP),
1720 reg_read(ctxt, VCPU_REGS_RSP) - frame_size,
Avi Kivity612e89f2012-06-12 20:03:23 +03001721 stack_mask(ctxt));
1722 return X86EMUL_CONTINUE;
1723}
1724
Avi Kivityf47cfa32012-06-07 17:49:24 +03001725static int em_leave(struct x86_emulate_ctxt *ctxt)
1726{
Avi Kivitydd856ef2012-08-27 23:46:17 +03001727 assign_masked(reg_rmw(ctxt, VCPU_REGS_RSP), reg_read(ctxt, VCPU_REGS_RBP),
Avi Kivityf47cfa32012-06-07 17:49:24 +03001728 stack_mask(ctxt));
Avi Kivitydd856ef2012-08-27 23:46:17 +03001729 return emulate_pop(ctxt, reg_rmw(ctxt, VCPU_REGS_RBP), ctxt->op_bytes);
Avi Kivityf47cfa32012-06-07 17:49:24 +03001730}
1731
Avi Kivity1cd196e2011-09-13 10:45:51 +03001732static int em_push_sreg(struct x86_emulate_ctxt *ctxt)
Mohammed Gamal0934ac92009-08-23 14:24:24 +03001733{
Avi Kivity1cd196e2011-09-13 10:45:51 +03001734 int seg = ctxt->src2.val;
1735
Avi Kivity9dac77f2011-06-01 15:34:25 +03001736 ctxt->src.val = get_segment_selector(ctxt, seg);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03001737
Takuya Yoshikawa4487b3b2011-04-13 00:31:23 +09001738 return em_push(ctxt);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03001739}
1740
Avi Kivity1cd196e2011-09-13 10:45:51 +03001741static int em_pop_sreg(struct x86_emulate_ctxt *ctxt)
Mohammed Gamal0934ac92009-08-23 14:24:24 +03001742{
Avi Kivity1cd196e2011-09-13 10:45:51 +03001743 int seg = ctxt->src2.val;
Mohammed Gamal0934ac92009-08-23 14:24:24 +03001744 unsigned long selector;
1745 int rc;
1746
Avi Kivity9dac77f2011-06-01 15:34:25 +03001747 rc = emulate_pop(ctxt, &selector, ctxt->op_bytes);
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09001748 if (rc != X86EMUL_CONTINUE)
Mohammed Gamal0934ac92009-08-23 14:24:24 +03001749 return rc;
1750
Paolo Bonzinia5457e72014-06-05 17:29:34 +02001751 if (ctxt->modrm_reg == VCPU_SREG_SS)
1752 ctxt->interruptibility = KVM_X86_SHADOW_INT_MOV_SS;
1753
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001754 rc = load_segment_descriptor(ctxt, (u16)selector, seg);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03001755 return rc;
1756}
1757
Takuya Yoshikawab96a7fa2011-04-23 18:51:07 +09001758static int em_pusha(struct x86_emulate_ctxt *ctxt)
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001759{
Avi Kivitydd856ef2012-08-27 23:46:17 +03001760 unsigned long old_esp = reg_read(ctxt, VCPU_REGS_RSP);
Wei Yongjunc37eda12010-06-15 09:03:33 +08001761 int rc = X86EMUL_CONTINUE;
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001762 int reg = VCPU_REGS_RAX;
1763
1764 while (reg <= VCPU_REGS_RDI) {
1765 (reg == VCPU_REGS_RSP) ?
Avi Kivitydd856ef2012-08-27 23:46:17 +03001766 (ctxt->src.val = old_esp) : (ctxt->src.val = reg_read(ctxt, reg));
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001767
Takuya Yoshikawa4487b3b2011-04-13 00:31:23 +09001768 rc = em_push(ctxt);
Wei Yongjunc37eda12010-06-15 09:03:33 +08001769 if (rc != X86EMUL_CONTINUE)
1770 return rc;
1771
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001772 ++reg;
1773 }
Wei Yongjunc37eda12010-06-15 09:03:33 +08001774
Wei Yongjunc37eda12010-06-15 09:03:33 +08001775 return rc;
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001776}
1777
Takuya Yoshikawa62aaa2f2011-04-23 18:52:56 +09001778static int em_pushf(struct x86_emulate_ctxt *ctxt)
1779{
Avi Kivity9dac77f2011-06-01 15:34:25 +03001780 ctxt->src.val = (unsigned long)ctxt->eflags;
Takuya Yoshikawa62aaa2f2011-04-23 18:52:56 +09001781 return em_push(ctxt);
1782}
1783
Takuya Yoshikawab96a7fa2011-04-23 18:51:07 +09001784static int em_popa(struct x86_emulate_ctxt *ctxt)
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001785{
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09001786 int rc = X86EMUL_CONTINUE;
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001787 int reg = VCPU_REGS_RDI;
1788
1789 while (reg >= VCPU_REGS_RAX) {
1790 if (reg == VCPU_REGS_RSP) {
Avi Kivity5ad105e2012-08-19 14:34:31 +03001791 rsp_increment(ctxt, ctxt->op_bytes);
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001792 --reg;
1793 }
1794
Avi Kivitydd856ef2012-08-27 23:46:17 +03001795 rc = emulate_pop(ctxt, reg_rmw(ctxt, reg), ctxt->op_bytes);
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09001796 if (rc != X86EMUL_CONTINUE)
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001797 break;
1798 --reg;
1799 }
1800 return rc;
1801}
1802
Avi Kivitydd856ef2012-08-27 23:46:17 +03001803static int __emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq)
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001804{
Mathias Krause0225fb52012-08-30 01:30:16 +02001805 const struct x86_emulate_ops *ops = ctxt->ops;
Avi Kivity5c56e1c2010-08-17 11:17:51 +03001806 int rc;
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001807 struct desc_ptr dt;
1808 gva_t cs_addr;
1809 gva_t eip_addr;
1810 u16 cs, eip;
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001811
1812 /* TODO: Add limit checks */
Avi Kivity9dac77f2011-06-01 15:34:25 +03001813 ctxt->src.val = ctxt->eflags;
Takuya Yoshikawa4487b3b2011-04-13 00:31:23 +09001814 rc = em_push(ctxt);
Avi Kivity5c56e1c2010-08-17 11:17:51 +03001815 if (rc != X86EMUL_CONTINUE)
1816 return rc;
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001817
1818 ctxt->eflags &= ~(EFLG_IF | EFLG_TF | EFLG_AC);
1819
Avi Kivity9dac77f2011-06-01 15:34:25 +03001820 ctxt->src.val = get_segment_selector(ctxt, VCPU_SREG_CS);
Takuya Yoshikawa4487b3b2011-04-13 00:31:23 +09001821 rc = em_push(ctxt);
Avi Kivity5c56e1c2010-08-17 11:17:51 +03001822 if (rc != X86EMUL_CONTINUE)
1823 return rc;
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001824
Avi Kivity9dac77f2011-06-01 15:34:25 +03001825 ctxt->src.val = ctxt->_eip;
Takuya Yoshikawa4487b3b2011-04-13 00:31:23 +09001826 rc = em_push(ctxt);
Avi Kivity5c56e1c2010-08-17 11:17:51 +03001827 if (rc != X86EMUL_CONTINUE)
1828 return rc;
1829
Avi Kivity4bff1e862011-04-20 13:37:53 +03001830 ops->get_idt(ctxt, &dt);
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001831
1832 eip_addr = dt.address + (irq << 2);
1833 cs_addr = dt.address + (irq << 2) + 2;
1834
Avi Kivity0f65dd72011-04-20 13:37:53 +03001835 rc = ops->read_std(ctxt, cs_addr, &cs, 2, &ctxt->exception);
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001836 if (rc != X86EMUL_CONTINUE)
1837 return rc;
1838
Avi Kivity0f65dd72011-04-20 13:37:53 +03001839 rc = ops->read_std(ctxt, eip_addr, &eip, 2, &ctxt->exception);
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001840 if (rc != X86EMUL_CONTINUE)
1841 return rc;
1842
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001843 rc = load_segment_descriptor(ctxt, cs, VCPU_SREG_CS);
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001844 if (rc != X86EMUL_CONTINUE)
1845 return rc;
1846
Avi Kivity9dac77f2011-06-01 15:34:25 +03001847 ctxt->_eip = eip;
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001848
1849 return rc;
1850}
1851
Avi Kivitydd856ef2012-08-27 23:46:17 +03001852int emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq)
1853{
1854 int rc;
1855
1856 invalidate_registers(ctxt);
1857 rc = __emulate_int_real(ctxt, irq);
1858 if (rc == X86EMUL_CONTINUE)
1859 writeback_registers(ctxt);
1860 return rc;
1861}
1862
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001863static int emulate_int(struct x86_emulate_ctxt *ctxt, int irq)
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001864{
1865 switch(ctxt->mode) {
1866 case X86EMUL_MODE_REAL:
Avi Kivitydd856ef2012-08-27 23:46:17 +03001867 return __emulate_int_real(ctxt, irq);
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001868 case X86EMUL_MODE_VM86:
1869 case X86EMUL_MODE_PROT16:
1870 case X86EMUL_MODE_PROT32:
1871 case X86EMUL_MODE_PROT64:
1872 default:
1873 /* Protected mode interrupts unimplemented yet */
1874 return X86EMUL_UNHANDLEABLE;
1875 }
1876}
1877
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001878static int emulate_iret_real(struct x86_emulate_ctxt *ctxt)
Mohammed Gamal62bd4302010-07-28 12:38:40 +03001879{
Mohammed Gamal62bd4302010-07-28 12:38:40 +03001880 int rc = X86EMUL_CONTINUE;
1881 unsigned long temp_eip = 0;
1882 unsigned long temp_eflags = 0;
1883 unsigned long cs = 0;
1884 unsigned long mask = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF | EFLG_TF |
1885 EFLG_IF | EFLG_DF | EFLG_OF | EFLG_IOPL | EFLG_NT | EFLG_RF |
1886 EFLG_AC | EFLG_ID | (1 << 1); /* Last one is the reserved bit */
1887 unsigned long vm86_mask = EFLG_VM | EFLG_VIF | EFLG_VIP;
1888
1889 /* TODO: Add stack limit check */
1890
Avi Kivity9dac77f2011-06-01 15:34:25 +03001891 rc = emulate_pop(ctxt, &temp_eip, ctxt->op_bytes);
Mohammed Gamal62bd4302010-07-28 12:38:40 +03001892
1893 if (rc != X86EMUL_CONTINUE)
1894 return rc;
1895
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001896 if (temp_eip & ~0xffff)
1897 return emulate_gp(ctxt, 0);
Mohammed Gamal62bd4302010-07-28 12:38:40 +03001898
Avi Kivity9dac77f2011-06-01 15:34:25 +03001899 rc = emulate_pop(ctxt, &cs, ctxt->op_bytes);
Mohammed Gamal62bd4302010-07-28 12:38:40 +03001900
1901 if (rc != X86EMUL_CONTINUE)
1902 return rc;
1903
Avi Kivity9dac77f2011-06-01 15:34:25 +03001904 rc = emulate_pop(ctxt, &temp_eflags, ctxt->op_bytes);
Mohammed Gamal62bd4302010-07-28 12:38:40 +03001905
1906 if (rc != X86EMUL_CONTINUE)
1907 return rc;
1908
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001909 rc = load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS);
Mohammed Gamal62bd4302010-07-28 12:38:40 +03001910
1911 if (rc != X86EMUL_CONTINUE)
1912 return rc;
1913
Avi Kivity9dac77f2011-06-01 15:34:25 +03001914 ctxt->_eip = temp_eip;
Mohammed Gamal62bd4302010-07-28 12:38:40 +03001915
1916
Avi Kivity9dac77f2011-06-01 15:34:25 +03001917 if (ctxt->op_bytes == 4)
Mohammed Gamal62bd4302010-07-28 12:38:40 +03001918 ctxt->eflags = ((temp_eflags & mask) | (ctxt->eflags & vm86_mask));
Avi Kivity9dac77f2011-06-01 15:34:25 +03001919 else if (ctxt->op_bytes == 2) {
Mohammed Gamal62bd4302010-07-28 12:38:40 +03001920 ctxt->eflags &= ~0xffff;
1921 ctxt->eflags |= temp_eflags;
1922 }
1923
1924 ctxt->eflags &= ~EFLG_RESERVED_ZEROS_MASK; /* Clear reserved zeros */
1925 ctxt->eflags |= EFLG_RESERVED_ONE_MASK;
1926
1927 return rc;
1928}
1929
Takuya Yoshikawae01991e2011-05-29 21:55:10 +09001930static int em_iret(struct x86_emulate_ctxt *ctxt)
Mohammed Gamal62bd4302010-07-28 12:38:40 +03001931{
1932 switch(ctxt->mode) {
1933 case X86EMUL_MODE_REAL:
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001934 return emulate_iret_real(ctxt);
Mohammed Gamal62bd4302010-07-28 12:38:40 +03001935 case X86EMUL_MODE_VM86:
1936 case X86EMUL_MODE_PROT16:
1937 case X86EMUL_MODE_PROT32:
1938 case X86EMUL_MODE_PROT64:
1939 default:
1940 /* iret from protected mode unimplemented yet */
1941 return X86EMUL_UNHANDLEABLE;
1942 }
1943}
1944
Takuya Yoshikawad2f62762011-05-02 02:30:48 +09001945static int em_jmp_far(struct x86_emulate_ctxt *ctxt)
1946{
Takuya Yoshikawad2f62762011-05-02 02:30:48 +09001947 int rc;
1948 unsigned short sel;
1949
Avi Kivity9dac77f2011-06-01 15:34:25 +03001950 memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2);
Takuya Yoshikawad2f62762011-05-02 02:30:48 +09001951
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09001952 rc = load_segment_descriptor(ctxt, sel, VCPU_SREG_CS);
Takuya Yoshikawad2f62762011-05-02 02:30:48 +09001953 if (rc != X86EMUL_CONTINUE)
1954 return rc;
1955
Avi Kivity9dac77f2011-06-01 15:34:25 +03001956 ctxt->_eip = 0;
1957 memcpy(&ctxt->_eip, ctxt->src.valptr, ctxt->op_bytes);
Takuya Yoshikawad2f62762011-05-02 02:30:48 +09001958 return X86EMUL_CONTINUE;
1959}
1960
Takuya Yoshikawa51187682011-05-02 02:29:17 +09001961static int em_grp45(struct x86_emulate_ctxt *ctxt)
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001962{
Takuya Yoshikawa4179bb02011-04-13 00:29:09 +09001963 int rc = X86EMUL_CONTINUE;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001964
Avi Kivity9dac77f2011-06-01 15:34:25 +03001965 switch (ctxt->modrm_reg) {
Mohammed Gamald19292e2008-09-08 21:47:19 +03001966 case 2: /* call near abs */ {
1967 long int old_eip;
Avi Kivity9dac77f2011-06-01 15:34:25 +03001968 old_eip = ctxt->_eip;
1969 ctxt->_eip = ctxt->src.val;
1970 ctxt->src.val = old_eip;
Takuya Yoshikawa4487b3b2011-04-13 00:31:23 +09001971 rc = em_push(ctxt);
Mohammed Gamald19292e2008-09-08 21:47:19 +03001972 break;
1973 }
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001974 case 4: /* jmp abs */
Avi Kivity9dac77f2011-06-01 15:34:25 +03001975 ctxt->_eip = ctxt->src.val;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001976 break;
Takuya Yoshikawad2f62762011-05-02 02:30:48 +09001977 case 5: /* jmp far */
1978 rc = em_jmp_far(ctxt);
1979 break;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001980 case 6: /* push */
Takuya Yoshikawa4487b3b2011-04-13 00:31:23 +09001981 rc = em_push(ctxt);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001982 break;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001983 }
Takuya Yoshikawa4179bb02011-04-13 00:29:09 +09001984 return rc;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001985}
1986
Takuya Yoshikawae0dac402011-12-06 18:07:27 +09001987static int em_cmpxchg8b(struct x86_emulate_ctxt *ctxt)
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001988{
Avi Kivity9dac77f2011-06-01 15:34:25 +03001989 u64 old = ctxt->dst.orig_val64;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001990
Nadav Amitaaa05f22014-06-02 18:34:10 +03001991 if (ctxt->dst.bytes == 16)
1992 return X86EMUL_UNHANDLEABLE;
1993
Avi Kivitydd856ef2012-08-27 23:46:17 +03001994 if (((u32) (old >> 0) != (u32) reg_read(ctxt, VCPU_REGS_RAX)) ||
1995 ((u32) (old >> 32) != (u32) reg_read(ctxt, VCPU_REGS_RDX))) {
1996 *reg_write(ctxt, VCPU_REGS_RAX) = (u32) (old >> 0);
1997 *reg_write(ctxt, VCPU_REGS_RDX) = (u32) (old >> 32);
Laurent Vivier05f086f2007-09-24 11:10:55 +02001998 ctxt->eflags &= ~EFLG_ZF;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001999 } else {
Avi Kivitydd856ef2012-08-27 23:46:17 +03002000 ctxt->dst.val64 = ((u64)reg_read(ctxt, VCPU_REGS_RCX) << 32) |
2001 (u32) reg_read(ctxt, VCPU_REGS_RBX);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02002002
Laurent Vivier05f086f2007-09-24 11:10:55 +02002003 ctxt->eflags |= EFLG_ZF;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02002004 }
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09002005 return X86EMUL_CONTINUE;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02002006}
2007
Takuya Yoshikawaebda02c2011-05-29 22:00:22 +09002008static int em_ret(struct x86_emulate_ctxt *ctxt)
2009{
Avi Kivity9dac77f2011-06-01 15:34:25 +03002010 ctxt->dst.type = OP_REG;
2011 ctxt->dst.addr.reg = &ctxt->_eip;
2012 ctxt->dst.bytes = ctxt->op_bytes;
Takuya Yoshikawaebda02c2011-05-29 22:00:22 +09002013 return em_pop(ctxt);
2014}
2015
Takuya Yoshikawae01991e2011-05-29 21:55:10 +09002016static int em_ret_far(struct x86_emulate_ctxt *ctxt)
Avi Kivitya77ab5e2009-01-05 13:27:34 +02002017{
Avi Kivitya77ab5e2009-01-05 13:27:34 +02002018 int rc;
2019 unsigned long cs;
Nadav Amit9e8919a2014-06-15 16:12:59 +03002020 int cpl = ctxt->ops->cpl(ctxt);
Avi Kivitya77ab5e2009-01-05 13:27:34 +02002021
Avi Kivity9dac77f2011-06-01 15:34:25 +03002022 rc = emulate_pop(ctxt, &ctxt->_eip, ctxt->op_bytes);
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09002023 if (rc != X86EMUL_CONTINUE)
Avi Kivitya77ab5e2009-01-05 13:27:34 +02002024 return rc;
Avi Kivity9dac77f2011-06-01 15:34:25 +03002025 if (ctxt->op_bytes == 4)
2026 ctxt->_eip = (u32)ctxt->_eip;
2027 rc = emulate_pop(ctxt, &cs, ctxt->op_bytes);
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09002028 if (rc != X86EMUL_CONTINUE)
Avi Kivitya77ab5e2009-01-05 13:27:34 +02002029 return rc;
Nadav Amit9e8919a2014-06-15 16:12:59 +03002030 /* Outer-privilege level return is not implemented */
2031 if (ctxt->mode >= X86EMUL_MODE_PROT16 && (cs & 3) > cpl)
2032 return X86EMUL_UNHANDLEABLE;
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002033 rc = load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS);
Avi Kivitya77ab5e2009-01-05 13:27:34 +02002034 return rc;
2035}
2036
Bruce Rogers32611072013-09-09 09:40:20 -06002037static int em_ret_far_imm(struct x86_emulate_ctxt *ctxt)
2038{
2039 int rc;
2040
2041 rc = em_ret_far(ctxt);
2042 if (rc != X86EMUL_CONTINUE)
2043 return rc;
2044 rsp_increment(ctxt, ctxt->src.val);
2045 return X86EMUL_CONTINUE;
2046}
2047
Takuya Yoshikawae940b5c2011-11-22 15:20:47 +09002048static int em_cmpxchg(struct x86_emulate_ctxt *ctxt)
2049{
2050 /* Save real source value, then compare EAX against destination. */
Nadav Amit37c564f2014-06-02 18:34:07 +03002051 ctxt->dst.orig_val = ctxt->dst.val;
2052 ctxt->dst.val = reg_read(ctxt, VCPU_REGS_RAX);
Takuya Yoshikawae940b5c2011-11-22 15:20:47 +09002053 ctxt->src.orig_val = ctxt->src.val;
Nadav Amit37c564f2014-06-02 18:34:07 +03002054 ctxt->src.val = ctxt->dst.orig_val;
Avi Kivity158de572013-01-19 19:51:57 +02002055 fastop(ctxt, em_cmp);
Takuya Yoshikawae940b5c2011-11-22 15:20:47 +09002056
2057 if (ctxt->eflags & EFLG_ZF) {
2058 /* Success: write back to memory. */
2059 ctxt->dst.val = ctxt->src.orig_val;
2060 } else {
2061 /* Failure: write the value we saw to EAX. */
2062 ctxt->dst.type = OP_REG;
Avi Kivitydd856ef2012-08-27 23:46:17 +03002063 ctxt->dst.addr.reg = reg_rmw(ctxt, VCPU_REGS_RAX);
Nadav Amit37c564f2014-06-02 18:34:07 +03002064 ctxt->dst.val = ctxt->dst.orig_val;
Takuya Yoshikawae940b5c2011-11-22 15:20:47 +09002065 }
2066 return X86EMUL_CONTINUE;
2067}
2068
Avi Kivityd4b43252011-09-13 10:45:50 +03002069static int em_lseg(struct x86_emulate_ctxt *ctxt)
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08002070{
Avi Kivityd4b43252011-09-13 10:45:50 +03002071 int seg = ctxt->src2.val;
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08002072 unsigned short sel;
2073 int rc;
2074
Avi Kivity9dac77f2011-06-01 15:34:25 +03002075 memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2);
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08002076
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002077 rc = load_segment_descriptor(ctxt, sel, seg);
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08002078 if (rc != X86EMUL_CONTINUE)
2079 return rc;
2080
Avi Kivity9dac77f2011-06-01 15:34:25 +03002081 ctxt->dst.val = ctxt->src.val;
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08002082 return rc;
2083}
2084
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002085static void
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002086setup_syscalls_segments(struct x86_emulate_ctxt *ctxt,
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002087 struct desc_struct *cs, struct desc_struct *ss)
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002088{
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002089 cs->l = 0; /* will be adjusted later */
Gleb Natapov79168fd2010-04-28 19:15:30 +03002090 set_desc_base(cs, 0); /* flat segment */
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002091 cs->g = 1; /* 4kb granularity */
Gleb Natapov79168fd2010-04-28 19:15:30 +03002092 set_desc_limit(cs, 0xfffff); /* 4GB limit */
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002093 cs->type = 0x0b; /* Read, Execute, Accessed */
2094 cs->s = 1;
2095 cs->dpl = 0; /* will be adjusted later */
Gleb Natapov79168fd2010-04-28 19:15:30 +03002096 cs->p = 1;
2097 cs->d = 1;
Gleb Natapov99245b52012-07-25 15:49:42 +03002098 cs->avl = 0;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002099
Gleb Natapov79168fd2010-04-28 19:15:30 +03002100 set_desc_base(ss, 0); /* flat segment */
2101 set_desc_limit(ss, 0xfffff); /* 4GB limit */
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002102 ss->g = 1; /* 4kb granularity */
2103 ss->s = 1;
2104 ss->type = 0x03; /* Read/Write, Accessed */
Gleb Natapov79168fd2010-04-28 19:15:30 +03002105 ss->d = 1; /* 32bit stack segment */
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002106 ss->dpl = 0;
Gleb Natapov79168fd2010-04-28 19:15:30 +03002107 ss->p = 1;
Gleb Natapov99245b52012-07-25 15:49:42 +03002108 ss->l = 0;
2109 ss->avl = 0;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002110}
2111
Avi Kivity1a18a692012-02-01 12:23:21 +02002112static bool vendor_intel(struct x86_emulate_ctxt *ctxt)
2113{
2114 u32 eax, ebx, ecx, edx;
2115
2116 eax = ecx = 0;
Avi Kivity0017f932012-06-07 14:10:16 +03002117 ctxt->ops->get_cpuid(ctxt, &eax, &ebx, &ecx, &edx);
2118 return ebx == X86EMUL_CPUID_VENDOR_GenuineIntel_ebx
Avi Kivity1a18a692012-02-01 12:23:21 +02002119 && ecx == X86EMUL_CPUID_VENDOR_GenuineIntel_ecx
2120 && edx == X86EMUL_CPUID_VENDOR_GenuineIntel_edx;
2121}
2122
Stephan Bärwolfc2226fc2012-01-12 16:43:04 +01002123static bool em_syscall_is_enabled(struct x86_emulate_ctxt *ctxt)
2124{
Mathias Krause0225fb52012-08-30 01:30:16 +02002125 const struct x86_emulate_ops *ops = ctxt->ops;
Stephan Bärwolfc2226fc2012-01-12 16:43:04 +01002126 u32 eax, ebx, ecx, edx;
2127
2128 /*
2129 * syscall should always be enabled in longmode - so only become
2130 * vendor specific (cpuid) if other modes are active...
2131 */
2132 if (ctxt->mode == X86EMUL_MODE_PROT64)
2133 return true;
2134
2135 eax = 0x00000000;
2136 ecx = 0x00000000;
Avi Kivity0017f932012-06-07 14:10:16 +03002137 ops->get_cpuid(ctxt, &eax, &ebx, &ecx, &edx);
2138 /*
2139 * Intel ("GenuineIntel")
2140 * remark: Intel CPUs only support "syscall" in 64bit
2141 * longmode. Also an 64bit guest with a
2142 * 32bit compat-app running will #UD !! While this
2143 * behaviour can be fixed (by emulating) into AMD
2144 * response - CPUs of AMD can't behave like Intel.
2145 */
2146 if (ebx == X86EMUL_CPUID_VENDOR_GenuineIntel_ebx &&
2147 ecx == X86EMUL_CPUID_VENDOR_GenuineIntel_ecx &&
2148 edx == X86EMUL_CPUID_VENDOR_GenuineIntel_edx)
2149 return false;
Stephan Bärwolfc2226fc2012-01-12 16:43:04 +01002150
Avi Kivity0017f932012-06-07 14:10:16 +03002151 /* AMD ("AuthenticAMD") */
2152 if (ebx == X86EMUL_CPUID_VENDOR_AuthenticAMD_ebx &&
2153 ecx == X86EMUL_CPUID_VENDOR_AuthenticAMD_ecx &&
2154 edx == X86EMUL_CPUID_VENDOR_AuthenticAMD_edx)
2155 return true;
Stephan Bärwolfc2226fc2012-01-12 16:43:04 +01002156
Avi Kivity0017f932012-06-07 14:10:16 +03002157 /* AMD ("AMDisbetter!") */
2158 if (ebx == X86EMUL_CPUID_VENDOR_AMDisbetterI_ebx &&
2159 ecx == X86EMUL_CPUID_VENDOR_AMDisbetterI_ecx &&
2160 edx == X86EMUL_CPUID_VENDOR_AMDisbetterI_edx)
2161 return true;
Stephan Bärwolfc2226fc2012-01-12 16:43:04 +01002162
2163 /* default: (not Intel, not AMD), apply Intel's stricter rules... */
2164 return false;
2165}
2166
Takuya Yoshikawae01991e2011-05-29 21:55:10 +09002167static int em_syscall(struct x86_emulate_ctxt *ctxt)
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002168{
Mathias Krause0225fb52012-08-30 01:30:16 +02002169 const struct x86_emulate_ops *ops = ctxt->ops;
Gleb Natapov79168fd2010-04-28 19:15:30 +03002170 struct desc_struct cs, ss;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002171 u64 msr_data;
Gleb Natapov79168fd2010-04-28 19:15:30 +03002172 u16 cs_sel, ss_sel;
Avi Kivityc2ad2bb2011-04-20 15:21:35 +03002173 u64 efer = 0;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002174
2175 /* syscall is not available in real mode */
Gleb Natapov2e901c42010-03-18 15:20:12 +02002176 if (ctxt->mode == X86EMUL_MODE_REAL ||
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002177 ctxt->mode == X86EMUL_MODE_VM86)
2178 return emulate_ud(ctxt);
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002179
Stephan Bärwolfc2226fc2012-01-12 16:43:04 +01002180 if (!(em_syscall_is_enabled(ctxt)))
2181 return emulate_ud(ctxt);
2182
Avi Kivityc2ad2bb2011-04-20 15:21:35 +03002183 ops->get_msr(ctxt, MSR_EFER, &efer);
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002184 setup_syscalls_segments(ctxt, &cs, &ss);
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002185
Stephan Bärwolfc2226fc2012-01-12 16:43:04 +01002186 if (!(efer & EFER_SCE))
2187 return emulate_ud(ctxt);
2188
Avi Kivity717746e2011-04-20 13:37:53 +03002189 ops->get_msr(ctxt, MSR_STAR, &msr_data);
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002190 msr_data >>= 32;
Gleb Natapov79168fd2010-04-28 19:15:30 +03002191 cs_sel = (u16)(msr_data & 0xfffc);
2192 ss_sel = (u16)(msr_data + 8);
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002193
Avi Kivityc2ad2bb2011-04-20 15:21:35 +03002194 if (efer & EFER_LMA) {
Gleb Natapov79168fd2010-04-28 19:15:30 +03002195 cs.d = 0;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002196 cs.l = 1;
2197 }
Avi Kivity1aa36612011-04-27 13:20:30 +03002198 ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS);
2199 ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002200
Avi Kivitydd856ef2012-08-27 23:46:17 +03002201 *reg_write(ctxt, VCPU_REGS_RCX) = ctxt->_eip;
Avi Kivityc2ad2bb2011-04-20 15:21:35 +03002202 if (efer & EFER_LMA) {
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002203#ifdef CONFIG_X86_64
Avi Kivitydd856ef2012-08-27 23:46:17 +03002204 *reg_write(ctxt, VCPU_REGS_R11) = ctxt->eflags & ~EFLG_RF;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002205
Avi Kivity717746e2011-04-20 13:37:53 +03002206 ops->get_msr(ctxt,
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03002207 ctxt->mode == X86EMUL_MODE_PROT64 ?
2208 MSR_LSTAR : MSR_CSTAR, &msr_data);
Avi Kivity9dac77f2011-06-01 15:34:25 +03002209 ctxt->_eip = msr_data;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002210
Avi Kivity717746e2011-04-20 13:37:53 +03002211 ops->get_msr(ctxt, MSR_SYSCALL_MASK, &msr_data);
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002212 ctxt->eflags &= ~(msr_data | EFLG_RF);
2213#endif
2214 } else {
2215 /* legacy mode */
Avi Kivity717746e2011-04-20 13:37:53 +03002216 ops->get_msr(ctxt, MSR_STAR, &msr_data);
Avi Kivity9dac77f2011-06-01 15:34:25 +03002217 ctxt->_eip = (u32)msr_data;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002218
2219 ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
2220 }
2221
Takuya Yoshikawae54cfa92010-02-18 12:15:02 +02002222 return X86EMUL_CONTINUE;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02002223}
2224
Takuya Yoshikawae01991e2011-05-29 21:55:10 +09002225static int em_sysenter(struct x86_emulate_ctxt *ctxt)
Andre Przywara8c604352009-06-18 12:56:01 +02002226{
Mathias Krause0225fb52012-08-30 01:30:16 +02002227 const struct x86_emulate_ops *ops = ctxt->ops;
Gleb Natapov79168fd2010-04-28 19:15:30 +03002228 struct desc_struct cs, ss;
Andre Przywara8c604352009-06-18 12:56:01 +02002229 u64 msr_data;
Gleb Natapov79168fd2010-04-28 19:15:30 +03002230 u16 cs_sel, ss_sel;
Avi Kivityc2ad2bb2011-04-20 15:21:35 +03002231 u64 efer = 0;
Andre Przywara8c604352009-06-18 12:56:01 +02002232
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002233 ops->get_msr(ctxt, MSR_EFER, &efer);
Gleb Natapova0044752010-02-10 14:21:31 +02002234 /* inject #GP if in real mode */
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002235 if (ctxt->mode == X86EMUL_MODE_REAL)
2236 return emulate_gp(ctxt, 0);
Andre Przywara8c604352009-06-18 12:56:01 +02002237
Avi Kivity1a18a692012-02-01 12:23:21 +02002238 /*
2239 * Not recognized on AMD in compat mode (but is recognized in legacy
2240 * mode).
2241 */
2242 if ((ctxt->mode == X86EMUL_MODE_PROT32) && (efer & EFER_LMA)
2243 && !vendor_intel(ctxt))
2244 return emulate_ud(ctxt);
2245
Andre Przywara8c604352009-06-18 12:56:01 +02002246 /* XXX sysenter/sysexit have not been tested in 64bit mode.
2247 * Therefore, we inject an #UD.
2248 */
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002249 if (ctxt->mode == X86EMUL_MODE_PROT64)
2250 return emulate_ud(ctxt);
Andre Przywara8c604352009-06-18 12:56:01 +02002251
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002252 setup_syscalls_segments(ctxt, &cs, &ss);
Andre Przywara8c604352009-06-18 12:56:01 +02002253
Avi Kivity717746e2011-04-20 13:37:53 +03002254 ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
Andre Przywara8c604352009-06-18 12:56:01 +02002255 switch (ctxt->mode) {
2256 case X86EMUL_MODE_PROT32:
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002257 if ((msr_data & 0xfffc) == 0x0)
2258 return emulate_gp(ctxt, 0);
Andre Przywara8c604352009-06-18 12:56:01 +02002259 break;
2260 case X86EMUL_MODE_PROT64:
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002261 if (msr_data == 0x0)
2262 return emulate_gp(ctxt, 0);
Andre Przywara8c604352009-06-18 12:56:01 +02002263 break;
Gleb Natapov9d1b39a2012-09-03 15:24:27 +03002264 default:
2265 break;
Andre Przywara8c604352009-06-18 12:56:01 +02002266 }
2267
2268 ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
Gleb Natapov79168fd2010-04-28 19:15:30 +03002269 cs_sel = (u16)msr_data;
2270 cs_sel &= ~SELECTOR_RPL_MASK;
2271 ss_sel = cs_sel + 8;
2272 ss_sel &= ~SELECTOR_RPL_MASK;
Avi Kivityc2ad2bb2011-04-20 15:21:35 +03002273 if (ctxt->mode == X86EMUL_MODE_PROT64 || (efer & EFER_LMA)) {
Gleb Natapov79168fd2010-04-28 19:15:30 +03002274 cs.d = 0;
Andre Przywara8c604352009-06-18 12:56:01 +02002275 cs.l = 1;
2276 }
2277
Avi Kivity1aa36612011-04-27 13:20:30 +03002278 ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS);
2279 ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
Andre Przywara8c604352009-06-18 12:56:01 +02002280
Avi Kivity717746e2011-04-20 13:37:53 +03002281 ops->get_msr(ctxt, MSR_IA32_SYSENTER_EIP, &msr_data);
Avi Kivity9dac77f2011-06-01 15:34:25 +03002282 ctxt->_eip = msr_data;
Andre Przywara8c604352009-06-18 12:56:01 +02002283
Avi Kivity717746e2011-04-20 13:37:53 +03002284 ops->get_msr(ctxt, MSR_IA32_SYSENTER_ESP, &msr_data);
Avi Kivitydd856ef2012-08-27 23:46:17 +03002285 *reg_write(ctxt, VCPU_REGS_RSP) = msr_data;
Andre Przywara8c604352009-06-18 12:56:01 +02002286
Takuya Yoshikawae54cfa92010-02-18 12:15:02 +02002287 return X86EMUL_CONTINUE;
Andre Przywara8c604352009-06-18 12:56:01 +02002288}
2289
Takuya Yoshikawae01991e2011-05-29 21:55:10 +09002290static int em_sysexit(struct x86_emulate_ctxt *ctxt)
Andre Przywara4668f052009-06-18 12:56:02 +02002291{
Mathias Krause0225fb52012-08-30 01:30:16 +02002292 const struct x86_emulate_ops *ops = ctxt->ops;
Gleb Natapov79168fd2010-04-28 19:15:30 +03002293 struct desc_struct cs, ss;
Andre Przywara4668f052009-06-18 12:56:02 +02002294 u64 msr_data;
2295 int usermode;
Xiao Guangrong1249b962011-05-15 23:25:10 +08002296 u16 cs_sel = 0, ss_sel = 0;
Andre Przywara4668f052009-06-18 12:56:02 +02002297
Gleb Natapova0044752010-02-10 14:21:31 +02002298 /* inject #GP if in real mode or Virtual 8086 mode */
2299 if (ctxt->mode == X86EMUL_MODE_REAL ||
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002300 ctxt->mode == X86EMUL_MODE_VM86)
2301 return emulate_gp(ctxt, 0);
Andre Przywara4668f052009-06-18 12:56:02 +02002302
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002303 setup_syscalls_segments(ctxt, &cs, &ss);
Andre Przywara4668f052009-06-18 12:56:02 +02002304
Avi Kivity9dac77f2011-06-01 15:34:25 +03002305 if ((ctxt->rex_prefix & 0x8) != 0x0)
Andre Przywara4668f052009-06-18 12:56:02 +02002306 usermode = X86EMUL_MODE_PROT64;
2307 else
2308 usermode = X86EMUL_MODE_PROT32;
2309
2310 cs.dpl = 3;
2311 ss.dpl = 3;
Avi Kivity717746e2011-04-20 13:37:53 +03002312 ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
Andre Przywara4668f052009-06-18 12:56:02 +02002313 switch (usermode) {
2314 case X86EMUL_MODE_PROT32:
Gleb Natapov79168fd2010-04-28 19:15:30 +03002315 cs_sel = (u16)(msr_data + 16);
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002316 if ((msr_data & 0xfffc) == 0x0)
2317 return emulate_gp(ctxt, 0);
Gleb Natapov79168fd2010-04-28 19:15:30 +03002318 ss_sel = (u16)(msr_data + 24);
Andre Przywara4668f052009-06-18 12:56:02 +02002319 break;
2320 case X86EMUL_MODE_PROT64:
Gleb Natapov79168fd2010-04-28 19:15:30 +03002321 cs_sel = (u16)(msr_data + 32);
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002322 if (msr_data == 0x0)
2323 return emulate_gp(ctxt, 0);
Gleb Natapov79168fd2010-04-28 19:15:30 +03002324 ss_sel = cs_sel + 8;
2325 cs.d = 0;
Andre Przywara4668f052009-06-18 12:56:02 +02002326 cs.l = 1;
2327 break;
2328 }
Gleb Natapov79168fd2010-04-28 19:15:30 +03002329 cs_sel |= SELECTOR_RPL_MASK;
2330 ss_sel |= SELECTOR_RPL_MASK;
Andre Przywara4668f052009-06-18 12:56:02 +02002331
Avi Kivity1aa36612011-04-27 13:20:30 +03002332 ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS);
2333 ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
Andre Przywara4668f052009-06-18 12:56:02 +02002334
Avi Kivitydd856ef2012-08-27 23:46:17 +03002335 ctxt->_eip = reg_read(ctxt, VCPU_REGS_RDX);
2336 *reg_write(ctxt, VCPU_REGS_RSP) = reg_read(ctxt, VCPU_REGS_RCX);
Andre Przywara4668f052009-06-18 12:56:02 +02002337
Takuya Yoshikawae54cfa92010-02-18 12:15:02 +02002338 return X86EMUL_CONTINUE;
Andre Przywara4668f052009-06-18 12:56:02 +02002339}
2340
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002341static bool emulator_bad_iopl(struct x86_emulate_ctxt *ctxt)
Gleb Natapovf850e2e2010-02-10 14:21:33 +02002342{
2343 int iopl;
2344 if (ctxt->mode == X86EMUL_MODE_REAL)
2345 return false;
2346 if (ctxt->mode == X86EMUL_MODE_VM86)
2347 return true;
2348 iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002349 return ctxt->ops->cpl(ctxt) > iopl;
Gleb Natapovf850e2e2010-02-10 14:21:33 +02002350}
2351
2352static bool emulator_io_port_access_allowed(struct x86_emulate_ctxt *ctxt,
Gleb Natapovf850e2e2010-02-10 14:21:33 +02002353 u16 port, u16 len)
2354{
Mathias Krause0225fb52012-08-30 01:30:16 +02002355 const struct x86_emulate_ops *ops = ctxt->ops;
Gleb Natapov79168fd2010-04-28 19:15:30 +03002356 struct desc_struct tr_seg;
Gleb Natapov5601d052011-03-07 14:55:06 +02002357 u32 base3;
Gleb Natapovf850e2e2010-02-10 14:21:33 +02002358 int r;
Avi Kivity1aa36612011-04-27 13:20:30 +03002359 u16 tr, io_bitmap_ptr, perm, bit_idx = port & 0x7;
Gleb Natapovf850e2e2010-02-10 14:21:33 +02002360 unsigned mask = (1 << len) - 1;
Gleb Natapov5601d052011-03-07 14:55:06 +02002361 unsigned long base;
Gleb Natapovf850e2e2010-02-10 14:21:33 +02002362
Avi Kivity1aa36612011-04-27 13:20:30 +03002363 ops->get_segment(ctxt, &tr, &tr_seg, &base3, VCPU_SREG_TR);
Gleb Natapov79168fd2010-04-28 19:15:30 +03002364 if (!tr_seg.p)
Gleb Natapovf850e2e2010-02-10 14:21:33 +02002365 return false;
Gleb Natapov79168fd2010-04-28 19:15:30 +03002366 if (desc_limit_scaled(&tr_seg) < 103)
Gleb Natapovf850e2e2010-02-10 14:21:33 +02002367 return false;
Gleb Natapov5601d052011-03-07 14:55:06 +02002368 base = get_desc_base(&tr_seg);
2369#ifdef CONFIG_X86_64
2370 base |= ((u64)base3) << 32;
2371#endif
Avi Kivity0f65dd72011-04-20 13:37:53 +03002372 r = ops->read_std(ctxt, base + 102, &io_bitmap_ptr, 2, NULL);
Gleb Natapovf850e2e2010-02-10 14:21:33 +02002373 if (r != X86EMUL_CONTINUE)
2374 return false;
Gleb Natapov79168fd2010-04-28 19:15:30 +03002375 if (io_bitmap_ptr + port/8 > desc_limit_scaled(&tr_seg))
Gleb Natapovf850e2e2010-02-10 14:21:33 +02002376 return false;
Avi Kivity0f65dd72011-04-20 13:37:53 +03002377 r = ops->read_std(ctxt, base + io_bitmap_ptr + port/8, &perm, 2, NULL);
Gleb Natapovf850e2e2010-02-10 14:21:33 +02002378 if (r != X86EMUL_CONTINUE)
2379 return false;
2380 if ((perm >> bit_idx) & mask)
2381 return false;
2382 return true;
2383}
2384
2385static bool emulator_io_permited(struct x86_emulate_ctxt *ctxt,
Gleb Natapovf850e2e2010-02-10 14:21:33 +02002386 u16 port, u16 len)
2387{
Gleb Natapov4fc40f02010-08-02 12:47:51 +03002388 if (ctxt->perm_ok)
2389 return true;
2390
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002391 if (emulator_bad_iopl(ctxt))
2392 if (!emulator_io_port_access_allowed(ctxt, port, len))
Gleb Natapovf850e2e2010-02-10 14:21:33 +02002393 return false;
Gleb Natapov4fc40f02010-08-02 12:47:51 +03002394
2395 ctxt->perm_ok = true;
2396
Gleb Natapovf850e2e2010-02-10 14:21:33 +02002397 return true;
2398}
2399
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002400static void save_state_to_tss16(struct x86_emulate_ctxt *ctxt,
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002401 struct tss_segment_16 *tss)
2402{
Avi Kivity9dac77f2011-06-01 15:34:25 +03002403 tss->ip = ctxt->_eip;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002404 tss->flag = ctxt->eflags;
Avi Kivitydd856ef2012-08-27 23:46:17 +03002405 tss->ax = reg_read(ctxt, VCPU_REGS_RAX);
2406 tss->cx = reg_read(ctxt, VCPU_REGS_RCX);
2407 tss->dx = reg_read(ctxt, VCPU_REGS_RDX);
2408 tss->bx = reg_read(ctxt, VCPU_REGS_RBX);
2409 tss->sp = reg_read(ctxt, VCPU_REGS_RSP);
2410 tss->bp = reg_read(ctxt, VCPU_REGS_RBP);
2411 tss->si = reg_read(ctxt, VCPU_REGS_RSI);
2412 tss->di = reg_read(ctxt, VCPU_REGS_RDI);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002413
Avi Kivity1aa36612011-04-27 13:20:30 +03002414 tss->es = get_segment_selector(ctxt, VCPU_SREG_ES);
2415 tss->cs = get_segment_selector(ctxt, VCPU_SREG_CS);
2416 tss->ss = get_segment_selector(ctxt, VCPU_SREG_SS);
2417 tss->ds = get_segment_selector(ctxt, VCPU_SREG_DS);
2418 tss->ldt = get_segment_selector(ctxt, VCPU_SREG_LDTR);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002419}
2420
2421static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002422 struct tss_segment_16 *tss)
2423{
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002424 int ret;
Paolo Bonzini2356aae2014-05-15 17:56:57 +02002425 u8 cpl;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002426
Avi Kivity9dac77f2011-06-01 15:34:25 +03002427 ctxt->_eip = tss->ip;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002428 ctxt->eflags = tss->flag | 2;
Avi Kivitydd856ef2012-08-27 23:46:17 +03002429 *reg_write(ctxt, VCPU_REGS_RAX) = tss->ax;
2430 *reg_write(ctxt, VCPU_REGS_RCX) = tss->cx;
2431 *reg_write(ctxt, VCPU_REGS_RDX) = tss->dx;
2432 *reg_write(ctxt, VCPU_REGS_RBX) = tss->bx;
2433 *reg_write(ctxt, VCPU_REGS_RSP) = tss->sp;
2434 *reg_write(ctxt, VCPU_REGS_RBP) = tss->bp;
2435 *reg_write(ctxt, VCPU_REGS_RSI) = tss->si;
2436 *reg_write(ctxt, VCPU_REGS_RDI) = tss->di;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002437
2438 /*
2439 * SDM says that segment selectors are loaded before segment
2440 * descriptors
2441 */
Avi Kivity1aa36612011-04-27 13:20:30 +03002442 set_segment_selector(ctxt, tss->ldt, VCPU_SREG_LDTR);
2443 set_segment_selector(ctxt, tss->es, VCPU_SREG_ES);
2444 set_segment_selector(ctxt, tss->cs, VCPU_SREG_CS);
2445 set_segment_selector(ctxt, tss->ss, VCPU_SREG_SS);
2446 set_segment_selector(ctxt, tss->ds, VCPU_SREG_DS);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002447
Paolo Bonzini2356aae2014-05-15 17:56:57 +02002448 cpl = tss->cs & 3;
2449
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002450 /*
Guo Chaofc058682012-06-28 15:19:51 +08002451 * Now load segment descriptors. If fault happens at this stage
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002452 * it is handled in a context of new task
2453 */
Paolo Bonzini5045b462014-05-15 18:09:29 +02002454 ret = __load_segment_descriptor(ctxt, tss->ldt, VCPU_SREG_LDTR, cpl, true);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002455 if (ret != X86EMUL_CONTINUE)
2456 return ret;
Paolo Bonzini5045b462014-05-15 18:09:29 +02002457 ret = __load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, cpl, true);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002458 if (ret != X86EMUL_CONTINUE)
2459 return ret;
Paolo Bonzini5045b462014-05-15 18:09:29 +02002460 ret = __load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, cpl, true);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002461 if (ret != X86EMUL_CONTINUE)
2462 return ret;
Paolo Bonzini5045b462014-05-15 18:09:29 +02002463 ret = __load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, cpl, true);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002464 if (ret != X86EMUL_CONTINUE)
2465 return ret;
Paolo Bonzini5045b462014-05-15 18:09:29 +02002466 ret = __load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, cpl, true);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002467 if (ret != X86EMUL_CONTINUE)
2468 return ret;
2469
2470 return X86EMUL_CONTINUE;
2471}
2472
2473static int task_switch_16(struct x86_emulate_ctxt *ctxt,
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002474 u16 tss_selector, u16 old_tss_sel,
2475 ulong old_tss_base, struct desc_struct *new_desc)
2476{
Mathias Krause0225fb52012-08-30 01:30:16 +02002477 const struct x86_emulate_ops *ops = ctxt->ops;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002478 struct tss_segment_16 tss_seg;
2479 int ret;
Avi Kivitybcc55cb2010-11-22 17:53:22 +02002480 u32 new_tss_base = get_desc_base(new_desc);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002481
Avi Kivity0f65dd72011-04-20 13:37:53 +03002482 ret = ops->read_std(ctxt, old_tss_base, &tss_seg, sizeof tss_seg,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02002483 &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02002484 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002485 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002486 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002487
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002488 save_state_to_tss16(ctxt, &tss_seg);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002489
Avi Kivity0f65dd72011-04-20 13:37:53 +03002490 ret = ops->write_std(ctxt, old_tss_base, &tss_seg, sizeof tss_seg,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02002491 &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02002492 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002493 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002494 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002495
Avi Kivity0f65dd72011-04-20 13:37:53 +03002496 ret = ops->read_std(ctxt, new_tss_base, &tss_seg, sizeof tss_seg,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02002497 &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02002498 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002499 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002500 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002501
2502 if (old_tss_sel != 0xffff) {
2503 tss_seg.prev_task_link = old_tss_sel;
2504
Avi Kivity0f65dd72011-04-20 13:37:53 +03002505 ret = ops->write_std(ctxt, new_tss_base,
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002506 &tss_seg.prev_task_link,
2507 sizeof tss_seg.prev_task_link,
Avi Kivity0f65dd72011-04-20 13:37:53 +03002508 &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02002509 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002510 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002511 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002512 }
2513
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002514 return load_state_from_tss16(ctxt, &tss_seg);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002515}
2516
2517static void save_state_to_tss32(struct x86_emulate_ctxt *ctxt,
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002518 struct tss_segment_32 *tss)
2519{
Nadav Amit5c7411e2014-04-07 18:37:47 +03002520 /* CR3 and ldt selector are not saved intentionally */
Avi Kivity9dac77f2011-06-01 15:34:25 +03002521 tss->eip = ctxt->_eip;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002522 tss->eflags = ctxt->eflags;
Avi Kivitydd856ef2012-08-27 23:46:17 +03002523 tss->eax = reg_read(ctxt, VCPU_REGS_RAX);
2524 tss->ecx = reg_read(ctxt, VCPU_REGS_RCX);
2525 tss->edx = reg_read(ctxt, VCPU_REGS_RDX);
2526 tss->ebx = reg_read(ctxt, VCPU_REGS_RBX);
2527 tss->esp = reg_read(ctxt, VCPU_REGS_RSP);
2528 tss->ebp = reg_read(ctxt, VCPU_REGS_RBP);
2529 tss->esi = reg_read(ctxt, VCPU_REGS_RSI);
2530 tss->edi = reg_read(ctxt, VCPU_REGS_RDI);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002531
Avi Kivity1aa36612011-04-27 13:20:30 +03002532 tss->es = get_segment_selector(ctxt, VCPU_SREG_ES);
2533 tss->cs = get_segment_selector(ctxt, VCPU_SREG_CS);
2534 tss->ss = get_segment_selector(ctxt, VCPU_SREG_SS);
2535 tss->ds = get_segment_selector(ctxt, VCPU_SREG_DS);
2536 tss->fs = get_segment_selector(ctxt, VCPU_SREG_FS);
2537 tss->gs = get_segment_selector(ctxt, VCPU_SREG_GS);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002538}
2539
2540static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002541 struct tss_segment_32 *tss)
2542{
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002543 int ret;
Paolo Bonzini2356aae2014-05-15 17:56:57 +02002544 u8 cpl;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002545
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002546 if (ctxt->ops->set_cr(ctxt, 3, tss->cr3))
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002547 return emulate_gp(ctxt, 0);
Avi Kivity9dac77f2011-06-01 15:34:25 +03002548 ctxt->_eip = tss->eip;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002549 ctxt->eflags = tss->eflags | 2;
Kevin Wolf4cee4792012-02-08 14:34:41 +01002550
2551 /* General purpose registers */
Avi Kivitydd856ef2012-08-27 23:46:17 +03002552 *reg_write(ctxt, VCPU_REGS_RAX) = tss->eax;
2553 *reg_write(ctxt, VCPU_REGS_RCX) = tss->ecx;
2554 *reg_write(ctxt, VCPU_REGS_RDX) = tss->edx;
2555 *reg_write(ctxt, VCPU_REGS_RBX) = tss->ebx;
2556 *reg_write(ctxt, VCPU_REGS_RSP) = tss->esp;
2557 *reg_write(ctxt, VCPU_REGS_RBP) = tss->ebp;
2558 *reg_write(ctxt, VCPU_REGS_RSI) = tss->esi;
2559 *reg_write(ctxt, VCPU_REGS_RDI) = tss->edi;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002560
2561 /*
2562 * SDM says that segment selectors are loaded before segment
Paolo Bonzini2356aae2014-05-15 17:56:57 +02002563 * descriptors. This is important because CPL checks will
2564 * use CS.RPL.
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002565 */
Avi Kivity1aa36612011-04-27 13:20:30 +03002566 set_segment_selector(ctxt, tss->ldt_selector, VCPU_SREG_LDTR);
2567 set_segment_selector(ctxt, tss->es, VCPU_SREG_ES);
2568 set_segment_selector(ctxt, tss->cs, VCPU_SREG_CS);
2569 set_segment_selector(ctxt, tss->ss, VCPU_SREG_SS);
2570 set_segment_selector(ctxt, tss->ds, VCPU_SREG_DS);
2571 set_segment_selector(ctxt, tss->fs, VCPU_SREG_FS);
2572 set_segment_selector(ctxt, tss->gs, VCPU_SREG_GS);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002573
2574 /*
Kevin Wolf4cee4792012-02-08 14:34:41 +01002575 * If we're switching between Protected Mode and VM86, we need to make
2576 * sure to update the mode before loading the segment descriptors so
2577 * that the selectors are interpreted correctly.
Kevin Wolf4cee4792012-02-08 14:34:41 +01002578 */
Paolo Bonzini2356aae2014-05-15 17:56:57 +02002579 if (ctxt->eflags & X86_EFLAGS_VM) {
Kevin Wolf4cee4792012-02-08 14:34:41 +01002580 ctxt->mode = X86EMUL_MODE_VM86;
Paolo Bonzini2356aae2014-05-15 17:56:57 +02002581 cpl = 3;
2582 } else {
Kevin Wolf4cee4792012-02-08 14:34:41 +01002583 ctxt->mode = X86EMUL_MODE_PROT32;
Paolo Bonzini2356aae2014-05-15 17:56:57 +02002584 cpl = tss->cs & 3;
2585 }
Kevin Wolf4cee4792012-02-08 14:34:41 +01002586
2587 /*
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002588 * Now load segment descriptors. If fault happenes at this stage
2589 * it is handled in a context of new task
2590 */
Paolo Bonzini5045b462014-05-15 18:09:29 +02002591 ret = __load_segment_descriptor(ctxt, tss->ldt_selector, VCPU_SREG_LDTR, cpl, true);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002592 if (ret != X86EMUL_CONTINUE)
2593 return ret;
Paolo Bonzini5045b462014-05-15 18:09:29 +02002594 ret = __load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, cpl, true);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002595 if (ret != X86EMUL_CONTINUE)
2596 return ret;
Paolo Bonzini5045b462014-05-15 18:09:29 +02002597 ret = __load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, cpl, true);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002598 if (ret != X86EMUL_CONTINUE)
2599 return ret;
Paolo Bonzini5045b462014-05-15 18:09:29 +02002600 ret = __load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, cpl, true);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002601 if (ret != X86EMUL_CONTINUE)
2602 return ret;
Paolo Bonzini5045b462014-05-15 18:09:29 +02002603 ret = __load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, cpl, true);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002604 if (ret != X86EMUL_CONTINUE)
2605 return ret;
Paolo Bonzini5045b462014-05-15 18:09:29 +02002606 ret = __load_segment_descriptor(ctxt, tss->fs, VCPU_SREG_FS, cpl, true);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002607 if (ret != X86EMUL_CONTINUE)
2608 return ret;
Paolo Bonzini5045b462014-05-15 18:09:29 +02002609 ret = __load_segment_descriptor(ctxt, tss->gs, VCPU_SREG_GS, cpl, true);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002610 if (ret != X86EMUL_CONTINUE)
2611 return ret;
2612
2613 return X86EMUL_CONTINUE;
2614}
2615
2616static int task_switch_32(struct x86_emulate_ctxt *ctxt,
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002617 u16 tss_selector, u16 old_tss_sel,
2618 ulong old_tss_base, struct desc_struct *new_desc)
2619{
Mathias Krause0225fb52012-08-30 01:30:16 +02002620 const struct x86_emulate_ops *ops = ctxt->ops;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002621 struct tss_segment_32 tss_seg;
2622 int ret;
Avi Kivitybcc55cb2010-11-22 17:53:22 +02002623 u32 new_tss_base = get_desc_base(new_desc);
Nadav Amit5c7411e2014-04-07 18:37:47 +03002624 u32 eip_offset = offsetof(struct tss_segment_32, eip);
2625 u32 ldt_sel_offset = offsetof(struct tss_segment_32, ldt_selector);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002626
Avi Kivity0f65dd72011-04-20 13:37:53 +03002627 ret = ops->read_std(ctxt, old_tss_base, &tss_seg, sizeof tss_seg,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02002628 &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02002629 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002630 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002631 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002632
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002633 save_state_to_tss32(ctxt, &tss_seg);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002634
Nadav Amit5c7411e2014-04-07 18:37:47 +03002635 /* Only GP registers and segment selectors are saved */
2636 ret = ops->write_std(ctxt, old_tss_base + eip_offset, &tss_seg.eip,
2637 ldt_sel_offset - eip_offset, &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02002638 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002639 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002640 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002641
Avi Kivity0f65dd72011-04-20 13:37:53 +03002642 ret = ops->read_std(ctxt, new_tss_base, &tss_seg, sizeof tss_seg,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02002643 &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02002644 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002645 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002646 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002647
2648 if (old_tss_sel != 0xffff) {
2649 tss_seg.prev_task_link = old_tss_sel;
2650
Avi Kivity0f65dd72011-04-20 13:37:53 +03002651 ret = ops->write_std(ctxt, new_tss_base,
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002652 &tss_seg.prev_task_link,
2653 sizeof tss_seg.prev_task_link,
Avi Kivity0f65dd72011-04-20 13:37:53 +03002654 &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02002655 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002656 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002657 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002658 }
2659
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002660 return load_state_from_tss32(ctxt, &tss_seg);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002661}
2662
2663static int emulator_do_task_switch(struct x86_emulate_ctxt *ctxt,
Kevin Wolf7f3d35f2012-02-08 14:34:38 +01002664 u16 tss_selector, int idt_index, int reason,
Jan Kiszkae269fb22010-04-14 15:51:09 +02002665 bool has_error_code, u32 error_code)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002666{
Mathias Krause0225fb52012-08-30 01:30:16 +02002667 const struct x86_emulate_ops *ops = ctxt->ops;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002668 struct desc_struct curr_tss_desc, next_tss_desc;
2669 int ret;
Avi Kivity1aa36612011-04-27 13:20:30 +03002670 u16 old_tss_sel = get_segment_selector(ctxt, VCPU_SREG_TR);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002671 ulong old_tss_base =
Avi Kivity4bff1e862011-04-20 13:37:53 +03002672 ops->get_cached_segment_base(ctxt, VCPU_SREG_TR);
Gleb Natapovceffb452010-03-18 15:20:19 +02002673 u32 desc_limit;
Avi Kivitye9194642012-06-13 16:29:39 +03002674 ulong desc_addr;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002675
2676 /* FIXME: old_tss_base == ~0 ? */
2677
Avi Kivitye9194642012-06-13 16:29:39 +03002678 ret = read_segment_descriptor(ctxt, tss_selector, &next_tss_desc, &desc_addr);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002679 if (ret != X86EMUL_CONTINUE)
2680 return ret;
Avi Kivitye9194642012-06-13 16:29:39 +03002681 ret = read_segment_descriptor(ctxt, old_tss_sel, &curr_tss_desc, &desc_addr);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002682 if (ret != X86EMUL_CONTINUE)
2683 return ret;
2684
2685 /* FIXME: check that next_tss_desc is tss */
2686
Kevin Wolf7f3d35f2012-02-08 14:34:38 +01002687 /*
2688 * Check privileges. The three cases are task switch caused by...
2689 *
2690 * 1. jmp/call/int to task gate: Check against DPL of the task gate
2691 * 2. Exception/IRQ/iret: No check is performed
Guo Chaofc058682012-06-28 15:19:51 +08002692 * 3. jmp/call to TSS: Check against DPL of the TSS
Kevin Wolf7f3d35f2012-02-08 14:34:38 +01002693 */
2694 if (reason == TASK_SWITCH_GATE) {
2695 if (idt_index != -1) {
2696 /* Software interrupts */
2697 struct desc_struct task_gate_desc;
2698 int dpl;
2699
2700 ret = read_interrupt_descriptor(ctxt, idt_index,
2701 &task_gate_desc);
2702 if (ret != X86EMUL_CONTINUE)
2703 return ret;
2704
2705 dpl = task_gate_desc.dpl;
2706 if ((tss_selector & 3) > dpl || ops->cpl(ctxt) > dpl)
2707 return emulate_gp(ctxt, (idt_index << 3) | 0x2);
2708 }
2709 } else if (reason != TASK_SWITCH_IRET) {
2710 int dpl = next_tss_desc.dpl;
2711 if ((tss_selector & 3) > dpl || ops->cpl(ctxt) > dpl)
2712 return emulate_gp(ctxt, tss_selector);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002713 }
2714
Kevin Wolf7f3d35f2012-02-08 14:34:38 +01002715
Gleb Natapovceffb452010-03-18 15:20:19 +02002716 desc_limit = desc_limit_scaled(&next_tss_desc);
2717 if (!next_tss_desc.p ||
2718 ((desc_limit < 0x67 && (next_tss_desc.type & 8)) ||
2719 desc_limit < 0x2b)) {
Gleb Natapov54b84862010-04-28 19:15:44 +03002720 emulate_ts(ctxt, tss_selector & 0xfffc);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002721 return X86EMUL_PROPAGATE_FAULT;
2722 }
2723
2724 if (reason == TASK_SWITCH_IRET || reason == TASK_SWITCH_JMP) {
2725 curr_tss_desc.type &= ~(1 << 1); /* clear busy flag */
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002726 write_segment_descriptor(ctxt, old_tss_sel, &curr_tss_desc);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002727 }
2728
2729 if (reason == TASK_SWITCH_IRET)
2730 ctxt->eflags = ctxt->eflags & ~X86_EFLAGS_NT;
2731
2732 /* set back link to prev task only if NT bit is set in eflags
Guo Chaofc058682012-06-28 15:19:51 +08002733 note that old_tss_sel is not used after this point */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002734 if (reason != TASK_SWITCH_CALL && reason != TASK_SWITCH_GATE)
2735 old_tss_sel = 0xffff;
2736
2737 if (next_tss_desc.type & 8)
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002738 ret = task_switch_32(ctxt, tss_selector, old_tss_sel,
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002739 old_tss_base, &next_tss_desc);
2740 else
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002741 ret = task_switch_16(ctxt, tss_selector, old_tss_sel,
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002742 old_tss_base, &next_tss_desc);
Jan Kiszka0760d442010-04-14 15:50:57 +02002743 if (ret != X86EMUL_CONTINUE)
2744 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002745
2746 if (reason == TASK_SWITCH_CALL || reason == TASK_SWITCH_GATE)
2747 ctxt->eflags = ctxt->eflags | X86_EFLAGS_NT;
2748
2749 if (reason != TASK_SWITCH_IRET) {
2750 next_tss_desc.type |= (1 << 1); /* set busy flag */
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002751 write_segment_descriptor(ctxt, tss_selector, &next_tss_desc);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002752 }
2753
Avi Kivity717746e2011-04-20 13:37:53 +03002754 ops->set_cr(ctxt, 0, ops->get_cr(ctxt, 0) | X86_CR0_TS);
Avi Kivity1aa36612011-04-27 13:20:30 +03002755 ops->set_segment(ctxt, tss_selector, &next_tss_desc, 0, VCPU_SREG_TR);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002756
Jan Kiszkae269fb22010-04-14 15:51:09 +02002757 if (has_error_code) {
Avi Kivity9dac77f2011-06-01 15:34:25 +03002758 ctxt->op_bytes = ctxt->ad_bytes = (next_tss_desc.type & 8) ? 4 : 2;
2759 ctxt->lock_prefix = 0;
2760 ctxt->src.val = (unsigned long) error_code;
Takuya Yoshikawa4487b3b2011-04-13 00:31:23 +09002761 ret = em_push(ctxt);
Jan Kiszkae269fb22010-04-14 15:51:09 +02002762 }
2763
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002764 return ret;
2765}
2766
2767int emulator_task_switch(struct x86_emulate_ctxt *ctxt,
Kevin Wolf7f3d35f2012-02-08 14:34:38 +01002768 u16 tss_selector, int idt_index, int reason,
Jan Kiszkae269fb22010-04-14 15:51:09 +02002769 bool has_error_code, u32 error_code)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002770{
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002771 int rc;
2772
Avi Kivitydd856ef2012-08-27 23:46:17 +03002773 invalidate_registers(ctxt);
Avi Kivity9dac77f2011-06-01 15:34:25 +03002774 ctxt->_eip = ctxt->eip;
2775 ctxt->dst.type = OP_NONE;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002776
Kevin Wolf7f3d35f2012-02-08 14:34:38 +01002777 rc = emulator_do_task_switch(ctxt, tss_selector, idt_index, reason,
Jan Kiszkae269fb22010-04-14 15:51:09 +02002778 has_error_code, error_code);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002779
Avi Kivitydd856ef2012-08-27 23:46:17 +03002780 if (rc == X86EMUL_CONTINUE) {
Avi Kivity9dac77f2011-06-01 15:34:25 +03002781 ctxt->eip = ctxt->_eip;
Avi Kivitydd856ef2012-08-27 23:46:17 +03002782 writeback_registers(ctxt);
2783 }
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002784
Gleb Natapova0c0ab22011-03-28 16:57:49 +02002785 return (rc == X86EMUL_UNHANDLEABLE) ? EMULATION_FAILED : EMULATION_OK;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002786}
2787
Gleb Natapovf3bd64c2012-09-03 15:24:28 +03002788static void string_addr_inc(struct x86_emulate_ctxt *ctxt, int reg,
2789 struct operand *op)
Gleb Natapova682e352010-03-18 15:20:21 +02002790{
Gleb Natapovb3356bf2012-09-03 15:24:29 +03002791 int df = (ctxt->eflags & EFLG_DF) ? -op->count : op->count;
Gleb Natapova682e352010-03-18 15:20:21 +02002792
Avi Kivitydd856ef2012-08-27 23:46:17 +03002793 register_address_increment(ctxt, reg_rmw(ctxt, reg), df * op->bytes);
2794 op->addr.mem.ea = register_address(ctxt, reg_read(ctxt, reg));
Gleb Natapova682e352010-03-18 15:20:21 +02002795}
2796
Avi Kivity7af04fc2010-08-18 14:16:35 +03002797static int em_das(struct x86_emulate_ctxt *ctxt)
2798{
Avi Kivity7af04fc2010-08-18 14:16:35 +03002799 u8 al, old_al;
2800 bool af, cf, old_cf;
2801
2802 cf = ctxt->eflags & X86_EFLAGS_CF;
Avi Kivity9dac77f2011-06-01 15:34:25 +03002803 al = ctxt->dst.val;
Avi Kivity7af04fc2010-08-18 14:16:35 +03002804
2805 old_al = al;
2806 old_cf = cf;
2807 cf = false;
2808 af = ctxt->eflags & X86_EFLAGS_AF;
2809 if ((al & 0x0f) > 9 || af) {
2810 al -= 6;
2811 cf = old_cf | (al >= 250);
2812 af = true;
2813 } else {
2814 af = false;
2815 }
2816 if (old_al > 0x99 || old_cf) {
2817 al -= 0x60;
2818 cf = true;
2819 }
2820
Avi Kivity9dac77f2011-06-01 15:34:25 +03002821 ctxt->dst.val = al;
Avi Kivity7af04fc2010-08-18 14:16:35 +03002822 /* Set PF, ZF, SF */
Avi Kivity9dac77f2011-06-01 15:34:25 +03002823 ctxt->src.type = OP_IMM;
2824 ctxt->src.val = 0;
2825 ctxt->src.bytes = 1;
Avi Kivity158de572013-01-19 19:51:57 +02002826 fastop(ctxt, em_or);
Avi Kivity7af04fc2010-08-18 14:16:35 +03002827 ctxt->eflags &= ~(X86_EFLAGS_AF | X86_EFLAGS_CF);
2828 if (cf)
2829 ctxt->eflags |= X86_EFLAGS_CF;
2830 if (af)
2831 ctxt->eflags |= X86_EFLAGS_AF;
2832 return X86EMUL_CONTINUE;
2833}
2834
Paolo Bonzinia035d5c62013-05-09 11:32:49 +02002835static int em_aam(struct x86_emulate_ctxt *ctxt)
2836{
2837 u8 al, ah;
2838
2839 if (ctxt->src.val == 0)
2840 return emulate_de(ctxt);
2841
2842 al = ctxt->dst.val & 0xff;
2843 ah = al / ctxt->src.val;
2844 al %= ctxt->src.val;
2845
2846 ctxt->dst.val = (ctxt->dst.val & 0xffff0000) | al | (ah << 8);
2847
2848 /* Set PF, ZF, SF */
2849 ctxt->src.type = OP_IMM;
2850 ctxt->src.val = 0;
2851 ctxt->src.bytes = 1;
2852 fastop(ctxt, em_or);
2853
2854 return X86EMUL_CONTINUE;
2855}
2856
Gleb Natapov7f662272012-12-10 11:42:30 +02002857static int em_aad(struct x86_emulate_ctxt *ctxt)
2858{
2859 u8 al = ctxt->dst.val & 0xff;
2860 u8 ah = (ctxt->dst.val >> 8) & 0xff;
2861
2862 al = (al + (ah * ctxt->src.val)) & 0xff;
2863
2864 ctxt->dst.val = (ctxt->dst.val & 0xffff0000) | al;
2865
Gleb Natapovf583c292013-02-13 17:50:39 +02002866 /* Set PF, ZF, SF */
2867 ctxt->src.type = OP_IMM;
2868 ctxt->src.val = 0;
2869 ctxt->src.bytes = 1;
2870 fastop(ctxt, em_or);
Gleb Natapov7f662272012-12-10 11:42:30 +02002871
2872 return X86EMUL_CONTINUE;
2873}
2874
Takuya Yoshikawad4ddafc2011-11-22 15:18:35 +09002875static int em_call(struct x86_emulate_ctxt *ctxt)
2876{
2877 long rel = ctxt->src.val;
2878
2879 ctxt->src.val = (unsigned long)ctxt->_eip;
2880 jmp_rel(ctxt, rel);
2881 return em_push(ctxt);
2882}
2883
Avi Kivity0ef753b2010-08-18 14:51:45 +03002884static int em_call_far(struct x86_emulate_ctxt *ctxt)
2885{
Avi Kivity0ef753b2010-08-18 14:51:45 +03002886 u16 sel, old_cs;
2887 ulong old_eip;
2888 int rc;
2889
Avi Kivity1aa36612011-04-27 13:20:30 +03002890 old_cs = get_segment_selector(ctxt, VCPU_SREG_CS);
Avi Kivity9dac77f2011-06-01 15:34:25 +03002891 old_eip = ctxt->_eip;
Avi Kivity0ef753b2010-08-18 14:51:45 +03002892
Avi Kivity9dac77f2011-06-01 15:34:25 +03002893 memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2);
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09002894 if (load_segment_descriptor(ctxt, sel, VCPU_SREG_CS))
Avi Kivity0ef753b2010-08-18 14:51:45 +03002895 return X86EMUL_CONTINUE;
2896
Avi Kivity9dac77f2011-06-01 15:34:25 +03002897 ctxt->_eip = 0;
2898 memcpy(&ctxt->_eip, ctxt->src.valptr, ctxt->op_bytes);
Avi Kivity0ef753b2010-08-18 14:51:45 +03002899
Avi Kivity9dac77f2011-06-01 15:34:25 +03002900 ctxt->src.val = old_cs;
Takuya Yoshikawa4487b3b2011-04-13 00:31:23 +09002901 rc = em_push(ctxt);
Avi Kivity0ef753b2010-08-18 14:51:45 +03002902 if (rc != X86EMUL_CONTINUE)
2903 return rc;
2904
Avi Kivity9dac77f2011-06-01 15:34:25 +03002905 ctxt->src.val = old_eip;
Takuya Yoshikawa4487b3b2011-04-13 00:31:23 +09002906 return em_push(ctxt);
Avi Kivity0ef753b2010-08-18 14:51:45 +03002907}
2908
Avi Kivity40ece7c2010-08-18 15:12:09 +03002909static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt)
2910{
Avi Kivity40ece7c2010-08-18 15:12:09 +03002911 int rc;
2912
Avi Kivity9dac77f2011-06-01 15:34:25 +03002913 ctxt->dst.type = OP_REG;
2914 ctxt->dst.addr.reg = &ctxt->_eip;
2915 ctxt->dst.bytes = ctxt->op_bytes;
2916 rc = emulate_pop(ctxt, &ctxt->dst.val, ctxt->op_bytes);
Avi Kivity40ece7c2010-08-18 15:12:09 +03002917 if (rc != X86EMUL_CONTINUE)
2918 return rc;
Avi Kivity5ad105e2012-08-19 14:34:31 +03002919 rsp_increment(ctxt, ctxt->src.val);
Avi Kivity40ece7c2010-08-18 15:12:09 +03002920 return X86EMUL_CONTINUE;
2921}
2922
Takuya Yoshikawae4f973a2011-05-29 21:59:09 +09002923static int em_xchg(struct x86_emulate_ctxt *ctxt)
2924{
Takuya Yoshikawae4f973a2011-05-29 21:59:09 +09002925 /* Write back the register source. */
Avi Kivity9dac77f2011-06-01 15:34:25 +03002926 ctxt->src.val = ctxt->dst.val;
2927 write_register_operand(&ctxt->src);
Takuya Yoshikawae4f973a2011-05-29 21:59:09 +09002928
2929 /* Write back the memory destination with implicit LOCK prefix. */
Avi Kivity9dac77f2011-06-01 15:34:25 +03002930 ctxt->dst.val = ctxt->src.orig_val;
2931 ctxt->lock_prefix = 1;
Takuya Yoshikawae4f973a2011-05-29 21:59:09 +09002932 return X86EMUL_CONTINUE;
2933}
2934
Avi Kivityf3a1b9f2010-08-18 18:25:25 +03002935static int em_imul_3op(struct x86_emulate_ctxt *ctxt)
2936{
Avi Kivity9dac77f2011-06-01 15:34:25 +03002937 ctxt->dst.val = ctxt->src2.val;
Avi Kivity4d758342013-01-19 19:51:55 +02002938 return fastop(ctxt, em_imul);
Avi Kivityf3a1b9f2010-08-18 18:25:25 +03002939}
2940
Avi Kivity61429142010-08-19 15:13:00 +03002941static int em_cwd(struct x86_emulate_ctxt *ctxt)
2942{
Avi Kivity9dac77f2011-06-01 15:34:25 +03002943 ctxt->dst.type = OP_REG;
2944 ctxt->dst.bytes = ctxt->src.bytes;
Avi Kivitydd856ef2012-08-27 23:46:17 +03002945 ctxt->dst.addr.reg = reg_rmw(ctxt, VCPU_REGS_RDX);
Avi Kivity9dac77f2011-06-01 15:34:25 +03002946 ctxt->dst.val = ~((ctxt->src.val >> (ctxt->src.bytes * 8 - 1)) - 1);
Avi Kivity61429142010-08-19 15:13:00 +03002947
2948 return X86EMUL_CONTINUE;
2949}
2950
Avi Kivity48bb5d32010-08-18 18:54:34 +03002951static int em_rdtsc(struct x86_emulate_ctxt *ctxt)
2952{
Avi Kivity48bb5d32010-08-18 18:54:34 +03002953 u64 tsc = 0;
2954
Avi Kivity717746e2011-04-20 13:37:53 +03002955 ctxt->ops->get_msr(ctxt, MSR_IA32_TSC, &tsc);
Avi Kivitydd856ef2012-08-27 23:46:17 +03002956 *reg_write(ctxt, VCPU_REGS_RAX) = (u32)tsc;
2957 *reg_write(ctxt, VCPU_REGS_RDX) = tsc >> 32;
Avi Kivity48bb5d32010-08-18 18:54:34 +03002958 return X86EMUL_CONTINUE;
2959}
2960
Avi Kivity222d21a2011-11-10 14:57:30 +02002961static int em_rdpmc(struct x86_emulate_ctxt *ctxt)
2962{
2963 u64 pmc;
2964
Avi Kivitydd856ef2012-08-27 23:46:17 +03002965 if (ctxt->ops->read_pmc(ctxt, reg_read(ctxt, VCPU_REGS_RCX), &pmc))
Avi Kivity222d21a2011-11-10 14:57:30 +02002966 return emulate_gp(ctxt, 0);
Avi Kivitydd856ef2012-08-27 23:46:17 +03002967 *reg_write(ctxt, VCPU_REGS_RAX) = (u32)pmc;
2968 *reg_write(ctxt, VCPU_REGS_RDX) = pmc >> 32;
Avi Kivity222d21a2011-11-10 14:57:30 +02002969 return X86EMUL_CONTINUE;
2970}
2971
Avi Kivityb9eac5f2010-08-03 14:46:56 +03002972static int em_mov(struct x86_emulate_ctxt *ctxt)
2973{
Paolo Bonzini54cfdb32014-03-27 11:36:25 +01002974 memcpy(ctxt->dst.valptr, ctxt->src.valptr, sizeof(ctxt->src.valptr));
Avi Kivityb9eac5f2010-08-03 14:46:56 +03002975 return X86EMUL_CONTINUE;
2976}
2977
Borislav Petkov84cffe42013-10-29 12:54:56 +01002978#define FFL(x) bit(X86_FEATURE_##x)
2979
2980static int em_movbe(struct x86_emulate_ctxt *ctxt)
2981{
2982 u32 ebx, ecx, edx, eax = 1;
2983 u16 tmp;
2984
2985 /*
2986 * Check MOVBE is set in the guest-visible CPUID leaf.
2987 */
2988 ctxt->ops->get_cpuid(ctxt, &eax, &ebx, &ecx, &edx);
2989 if (!(ecx & FFL(MOVBE)))
2990 return emulate_ud(ctxt);
2991
2992 switch (ctxt->op_bytes) {
2993 case 2:
2994 /*
2995 * From MOVBE definition: "...When the operand size is 16 bits,
2996 * the upper word of the destination register remains unchanged
2997 * ..."
2998 *
2999 * Both casting ->valptr and ->val to u16 breaks strict aliasing
3000 * rules so we have to do the operation almost per hand.
3001 */
3002 tmp = (u16)ctxt->src.val;
3003 ctxt->dst.val &= ~0xffffUL;
3004 ctxt->dst.val |= (unsigned long)swab16(tmp);
3005 break;
3006 case 4:
3007 ctxt->dst.val = swab32((u32)ctxt->src.val);
3008 break;
3009 case 8:
3010 ctxt->dst.val = swab64(ctxt->src.val);
3011 break;
3012 default:
3013 return X86EMUL_PROPAGATE_FAULT;
3014 }
3015 return X86EMUL_CONTINUE;
3016}
3017
Takuya Yoshikawabc00f8d2011-11-22 15:19:19 +09003018static int em_cr_write(struct x86_emulate_ctxt *ctxt)
3019{
3020 if (ctxt->ops->set_cr(ctxt, ctxt->modrm_reg, ctxt->src.val))
3021 return emulate_gp(ctxt, 0);
3022
3023 /* Disable writeback. */
3024 ctxt->dst.type = OP_NONE;
3025 return X86EMUL_CONTINUE;
3026}
3027
3028static int em_dr_write(struct x86_emulate_ctxt *ctxt)
3029{
3030 unsigned long val;
3031
3032 if (ctxt->mode == X86EMUL_MODE_PROT64)
3033 val = ctxt->src.val & ~0ULL;
3034 else
3035 val = ctxt->src.val & ~0U;
3036
3037 /* #UD condition is already handled. */
3038 if (ctxt->ops->set_dr(ctxt, ctxt->modrm_reg, val) < 0)
3039 return emulate_gp(ctxt, 0);
3040
3041 /* Disable writeback. */
3042 ctxt->dst.type = OP_NONE;
3043 return X86EMUL_CONTINUE;
3044}
3045
Takuya Yoshikawae1e210b2011-11-22 15:20:03 +09003046static int em_wrmsr(struct x86_emulate_ctxt *ctxt)
3047{
3048 u64 msr_data;
3049
Avi Kivitydd856ef2012-08-27 23:46:17 +03003050 msr_data = (u32)reg_read(ctxt, VCPU_REGS_RAX)
3051 | ((u64)reg_read(ctxt, VCPU_REGS_RDX) << 32);
3052 if (ctxt->ops->set_msr(ctxt, reg_read(ctxt, VCPU_REGS_RCX), msr_data))
Takuya Yoshikawae1e210b2011-11-22 15:20:03 +09003053 return emulate_gp(ctxt, 0);
3054
3055 return X86EMUL_CONTINUE;
3056}
3057
3058static int em_rdmsr(struct x86_emulate_ctxt *ctxt)
3059{
3060 u64 msr_data;
3061
Avi Kivitydd856ef2012-08-27 23:46:17 +03003062 if (ctxt->ops->get_msr(ctxt, reg_read(ctxt, VCPU_REGS_RCX), &msr_data))
Takuya Yoshikawae1e210b2011-11-22 15:20:03 +09003063 return emulate_gp(ctxt, 0);
3064
Avi Kivitydd856ef2012-08-27 23:46:17 +03003065 *reg_write(ctxt, VCPU_REGS_RAX) = (u32)msr_data;
3066 *reg_write(ctxt, VCPU_REGS_RDX) = msr_data >> 32;
Takuya Yoshikawae1e210b2011-11-22 15:20:03 +09003067 return X86EMUL_CONTINUE;
3068}
3069
Takuya Yoshikawa1bd5f462011-05-29 22:01:33 +09003070static int em_mov_rm_sreg(struct x86_emulate_ctxt *ctxt)
3071{
Avi Kivity9dac77f2011-06-01 15:34:25 +03003072 if (ctxt->modrm_reg > VCPU_SREG_GS)
Takuya Yoshikawa1bd5f462011-05-29 22:01:33 +09003073 return emulate_ud(ctxt);
3074
Avi Kivity9dac77f2011-06-01 15:34:25 +03003075 ctxt->dst.val = get_segment_selector(ctxt, ctxt->modrm_reg);
Takuya Yoshikawa1bd5f462011-05-29 22:01:33 +09003076 return X86EMUL_CONTINUE;
3077}
3078
3079static int em_mov_sreg_rm(struct x86_emulate_ctxt *ctxt)
3080{
Avi Kivity9dac77f2011-06-01 15:34:25 +03003081 u16 sel = ctxt->src.val;
Takuya Yoshikawa1bd5f462011-05-29 22:01:33 +09003082
Avi Kivity9dac77f2011-06-01 15:34:25 +03003083 if (ctxt->modrm_reg == VCPU_SREG_CS || ctxt->modrm_reg > VCPU_SREG_GS)
Takuya Yoshikawa1bd5f462011-05-29 22:01:33 +09003084 return emulate_ud(ctxt);
3085
Avi Kivity9dac77f2011-06-01 15:34:25 +03003086 if (ctxt->modrm_reg == VCPU_SREG_SS)
Takuya Yoshikawa1bd5f462011-05-29 22:01:33 +09003087 ctxt->interruptibility = KVM_X86_SHADOW_INT_MOV_SS;
3088
3089 /* Disable writeback. */
Avi Kivity9dac77f2011-06-01 15:34:25 +03003090 ctxt->dst.type = OP_NONE;
3091 return load_segment_descriptor(ctxt, sel, ctxt->modrm_reg);
Takuya Yoshikawa1bd5f462011-05-29 22:01:33 +09003092}
3093
Avi Kivitya14e5792012-06-13 12:28:33 +03003094static int em_lldt(struct x86_emulate_ctxt *ctxt)
3095{
3096 u16 sel = ctxt->src.val;
3097
3098 /* Disable writeback. */
3099 ctxt->dst.type = OP_NONE;
3100 return load_segment_descriptor(ctxt, sel, VCPU_SREG_LDTR);
3101}
3102
Avi Kivity80890002012-06-13 16:33:29 +03003103static int em_ltr(struct x86_emulate_ctxt *ctxt)
3104{
3105 u16 sel = ctxt->src.val;
3106
3107 /* Disable writeback. */
3108 ctxt->dst.type = OP_NONE;
3109 return load_segment_descriptor(ctxt, sel, VCPU_SREG_TR);
3110}
3111
Avi Kivity38503912011-03-31 18:48:09 +02003112static int em_invlpg(struct x86_emulate_ctxt *ctxt)
3113{
Avi Kivity9fa088f2011-03-31 18:54:30 +02003114 int rc;
3115 ulong linear;
3116
Avi Kivity9dac77f2011-06-01 15:34:25 +03003117 rc = linearize(ctxt, ctxt->src.addr.mem, 1, false, &linear);
Avi Kivity9fa088f2011-03-31 18:54:30 +02003118 if (rc == X86EMUL_CONTINUE)
Avi Kivity3cb16fe2011-04-20 15:38:44 +03003119 ctxt->ops->invlpg(ctxt, linear);
Avi Kivity38503912011-03-31 18:48:09 +02003120 /* Disable writeback. */
Avi Kivity9dac77f2011-06-01 15:34:25 +03003121 ctxt->dst.type = OP_NONE;
Avi Kivity38503912011-03-31 18:48:09 +02003122 return X86EMUL_CONTINUE;
3123}
3124
Avi Kivity2d04a052011-04-20 15:32:49 +03003125static int em_clts(struct x86_emulate_ctxt *ctxt)
3126{
3127 ulong cr0;
3128
3129 cr0 = ctxt->ops->get_cr(ctxt, 0);
3130 cr0 &= ~X86_CR0_TS;
3131 ctxt->ops->set_cr(ctxt, 0, cr0);
3132 return X86EMUL_CONTINUE;
3133}
3134
Avi Kivity26d05cc2011-04-21 12:07:59 +03003135static int em_vmcall(struct x86_emulate_ctxt *ctxt)
3136{
Avi Kivity26d05cc2011-04-21 12:07:59 +03003137 int rc;
3138
Avi Kivity9dac77f2011-06-01 15:34:25 +03003139 if (ctxt->modrm_mod != 3 || ctxt->modrm_rm != 1)
Avi Kivity26d05cc2011-04-21 12:07:59 +03003140 return X86EMUL_UNHANDLEABLE;
3141
3142 rc = ctxt->ops->fix_hypercall(ctxt);
3143 if (rc != X86EMUL_CONTINUE)
3144 return rc;
3145
3146 /* Let the processor re-execute the fixed hypercall */
Avi Kivity9dac77f2011-06-01 15:34:25 +03003147 ctxt->_eip = ctxt->eip;
Avi Kivity26d05cc2011-04-21 12:07:59 +03003148 /* Disable writeback. */
Avi Kivity9dac77f2011-06-01 15:34:25 +03003149 ctxt->dst.type = OP_NONE;
Avi Kivity26d05cc2011-04-21 12:07:59 +03003150 return X86EMUL_CONTINUE;
3151}
3152
Avi Kivity96051572012-06-10 17:21:18 +03003153static int emulate_store_desc_ptr(struct x86_emulate_ctxt *ctxt,
3154 void (*get)(struct x86_emulate_ctxt *ctxt,
3155 struct desc_ptr *ptr))
3156{
3157 struct desc_ptr desc_ptr;
3158
3159 if (ctxt->mode == X86EMUL_MODE_PROT64)
3160 ctxt->op_bytes = 8;
3161 get(ctxt, &desc_ptr);
3162 if (ctxt->op_bytes == 2) {
3163 ctxt->op_bytes = 4;
3164 desc_ptr.address &= 0x00ffffff;
3165 }
3166 /* Disable writeback. */
3167 ctxt->dst.type = OP_NONE;
3168 return segmented_write(ctxt, ctxt->dst.addr.mem,
3169 &desc_ptr, 2 + ctxt->op_bytes);
3170}
3171
3172static int em_sgdt(struct x86_emulate_ctxt *ctxt)
3173{
3174 return emulate_store_desc_ptr(ctxt, ctxt->ops->get_gdt);
3175}
3176
3177static int em_sidt(struct x86_emulate_ctxt *ctxt)
3178{
3179 return emulate_store_desc_ptr(ctxt, ctxt->ops->get_idt);
3180}
3181
Avi Kivity26d05cc2011-04-21 12:07:59 +03003182static int em_lgdt(struct x86_emulate_ctxt *ctxt)
3183{
Avi Kivity26d05cc2011-04-21 12:07:59 +03003184 struct desc_ptr desc_ptr;
3185 int rc;
3186
Avi Kivity510425f2012-06-07 17:04:36 +03003187 if (ctxt->mode == X86EMUL_MODE_PROT64)
3188 ctxt->op_bytes = 8;
Avi Kivity9dac77f2011-06-01 15:34:25 +03003189 rc = read_descriptor(ctxt, ctxt->src.addr.mem,
Avi Kivity26d05cc2011-04-21 12:07:59 +03003190 &desc_ptr.size, &desc_ptr.address,
Avi Kivity9dac77f2011-06-01 15:34:25 +03003191 ctxt->op_bytes);
Avi Kivity26d05cc2011-04-21 12:07:59 +03003192 if (rc != X86EMUL_CONTINUE)
3193 return rc;
3194 ctxt->ops->set_gdt(ctxt, &desc_ptr);
3195 /* Disable writeback. */
Avi Kivity9dac77f2011-06-01 15:34:25 +03003196 ctxt->dst.type = OP_NONE;
Avi Kivity26d05cc2011-04-21 12:07:59 +03003197 return X86EMUL_CONTINUE;
3198}
3199
Avi Kivity5ef39c72011-04-21 12:21:50 +03003200static int em_vmmcall(struct x86_emulate_ctxt *ctxt)
Avi Kivity26d05cc2011-04-21 12:07:59 +03003201{
Avi Kivity26d05cc2011-04-21 12:07:59 +03003202 int rc;
3203
Avi Kivity5ef39c72011-04-21 12:21:50 +03003204 rc = ctxt->ops->fix_hypercall(ctxt);
3205
Avi Kivity26d05cc2011-04-21 12:07:59 +03003206 /* Disable writeback. */
Avi Kivity9dac77f2011-06-01 15:34:25 +03003207 ctxt->dst.type = OP_NONE;
Avi Kivity26d05cc2011-04-21 12:07:59 +03003208 return rc;
3209}
3210
3211static int em_lidt(struct x86_emulate_ctxt *ctxt)
3212{
Avi Kivity26d05cc2011-04-21 12:07:59 +03003213 struct desc_ptr desc_ptr;
3214 int rc;
3215
Avi Kivity510425f2012-06-07 17:04:36 +03003216 if (ctxt->mode == X86EMUL_MODE_PROT64)
3217 ctxt->op_bytes = 8;
Avi Kivity9dac77f2011-06-01 15:34:25 +03003218 rc = read_descriptor(ctxt, ctxt->src.addr.mem,
Takuya Yoshikawa509cf9f2011-05-02 02:25:07 +09003219 &desc_ptr.size, &desc_ptr.address,
Avi Kivity9dac77f2011-06-01 15:34:25 +03003220 ctxt->op_bytes);
Avi Kivity26d05cc2011-04-21 12:07:59 +03003221 if (rc != X86EMUL_CONTINUE)
3222 return rc;
3223 ctxt->ops->set_idt(ctxt, &desc_ptr);
3224 /* Disable writeback. */
Avi Kivity9dac77f2011-06-01 15:34:25 +03003225 ctxt->dst.type = OP_NONE;
Avi Kivity26d05cc2011-04-21 12:07:59 +03003226 return X86EMUL_CONTINUE;
3227}
3228
3229static int em_smsw(struct x86_emulate_ctxt *ctxt)
3230{
Nadav Amit32e94d02014-06-02 18:34:11 +03003231 if (ctxt->dst.type == OP_MEM)
3232 ctxt->dst.bytes = 2;
Avi Kivity9dac77f2011-06-01 15:34:25 +03003233 ctxt->dst.val = ctxt->ops->get_cr(ctxt, 0);
Avi Kivity26d05cc2011-04-21 12:07:59 +03003234 return X86EMUL_CONTINUE;
3235}
3236
3237static int em_lmsw(struct x86_emulate_ctxt *ctxt)
3238{
Avi Kivity26d05cc2011-04-21 12:07:59 +03003239 ctxt->ops->set_cr(ctxt, 0, (ctxt->ops->get_cr(ctxt, 0) & ~0x0eul)
Avi Kivity9dac77f2011-06-01 15:34:25 +03003240 | (ctxt->src.val & 0x0f));
3241 ctxt->dst.type = OP_NONE;
Avi Kivity26d05cc2011-04-21 12:07:59 +03003242 return X86EMUL_CONTINUE;
3243}
3244
Takuya Yoshikawad06e03a2011-05-29 22:04:08 +09003245static int em_loop(struct x86_emulate_ctxt *ctxt)
3246{
Avi Kivitydd856ef2012-08-27 23:46:17 +03003247 register_address_increment(ctxt, reg_rmw(ctxt, VCPU_REGS_RCX), -1);
3248 if ((address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) != 0) &&
Avi Kivity9dac77f2011-06-01 15:34:25 +03003249 (ctxt->b == 0xe2 || test_cc(ctxt->b ^ 0x5, ctxt->eflags)))
3250 jmp_rel(ctxt, ctxt->src.val);
Takuya Yoshikawad06e03a2011-05-29 22:04:08 +09003251
3252 return X86EMUL_CONTINUE;
3253}
3254
3255static int em_jcxz(struct x86_emulate_ctxt *ctxt)
3256{
Avi Kivitydd856ef2012-08-27 23:46:17 +03003257 if (address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) == 0)
Avi Kivity9dac77f2011-06-01 15:34:25 +03003258 jmp_rel(ctxt, ctxt->src.val);
Takuya Yoshikawad06e03a2011-05-29 22:04:08 +09003259
3260 return X86EMUL_CONTINUE;
3261}
3262
Takuya Yoshikawad7841a42011-11-22 15:16:54 +09003263static int em_in(struct x86_emulate_ctxt *ctxt)
3264{
3265 if (!pio_in_emulated(ctxt, ctxt->dst.bytes, ctxt->src.val,
3266 &ctxt->dst.val))
3267 return X86EMUL_IO_NEEDED;
3268
3269 return X86EMUL_CONTINUE;
3270}
3271
3272static int em_out(struct x86_emulate_ctxt *ctxt)
3273{
3274 ctxt->ops->pio_out_emulated(ctxt, ctxt->src.bytes, ctxt->dst.val,
3275 &ctxt->src.val, 1);
3276 /* Disable writeback. */
3277 ctxt->dst.type = OP_NONE;
3278 return X86EMUL_CONTINUE;
3279}
3280
Takuya Yoshikawaf411e6c2011-05-29 22:05:15 +09003281static int em_cli(struct x86_emulate_ctxt *ctxt)
3282{
3283 if (emulator_bad_iopl(ctxt))
3284 return emulate_gp(ctxt, 0);
3285
3286 ctxt->eflags &= ~X86_EFLAGS_IF;
3287 return X86EMUL_CONTINUE;
3288}
3289
3290static int em_sti(struct x86_emulate_ctxt *ctxt)
3291{
3292 if (emulator_bad_iopl(ctxt))
3293 return emulate_gp(ctxt, 0);
3294
3295 ctxt->interruptibility = KVM_X86_SHADOW_INT_STI;
3296 ctxt->eflags |= X86_EFLAGS_IF;
3297 return X86EMUL_CONTINUE;
3298}
3299
Avi Kivity6d6eede2012-06-07 14:11:36 +03003300static int em_cpuid(struct x86_emulate_ctxt *ctxt)
3301{
3302 u32 eax, ebx, ecx, edx;
3303
Avi Kivitydd856ef2012-08-27 23:46:17 +03003304 eax = reg_read(ctxt, VCPU_REGS_RAX);
3305 ecx = reg_read(ctxt, VCPU_REGS_RCX);
Avi Kivity6d6eede2012-06-07 14:11:36 +03003306 ctxt->ops->get_cpuid(ctxt, &eax, &ebx, &ecx, &edx);
Avi Kivitydd856ef2012-08-27 23:46:17 +03003307 *reg_write(ctxt, VCPU_REGS_RAX) = eax;
3308 *reg_write(ctxt, VCPU_REGS_RBX) = ebx;
3309 *reg_write(ctxt, VCPU_REGS_RCX) = ecx;
3310 *reg_write(ctxt, VCPU_REGS_RDX) = edx;
Avi Kivity6d6eede2012-06-07 14:11:36 +03003311 return X86EMUL_CONTINUE;
3312}
3313
Paolo Bonzini98f73632013-10-31 11:19:42 +01003314static int em_sahf(struct x86_emulate_ctxt *ctxt)
3315{
3316 u32 flags;
3317
3318 flags = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF;
3319 flags &= *reg_rmw(ctxt, VCPU_REGS_RAX) >> 8;
3320
3321 ctxt->eflags &= ~0xffUL;
3322 ctxt->eflags |= flags | X86_EFLAGS_FIXED;
3323 return X86EMUL_CONTINUE;
3324}
3325
Avi Kivity2dd7caa2012-06-11 13:09:07 +03003326static int em_lahf(struct x86_emulate_ctxt *ctxt)
3327{
Avi Kivitydd856ef2012-08-27 23:46:17 +03003328 *reg_rmw(ctxt, VCPU_REGS_RAX) &= ~0xff00UL;
3329 *reg_rmw(ctxt, VCPU_REGS_RAX) |= (ctxt->eflags & 0xff) << 8;
Avi Kivity2dd7caa2012-06-11 13:09:07 +03003330 return X86EMUL_CONTINUE;
3331}
3332
Avi Kivity92998362012-06-13 12:25:06 +03003333static int em_bswap(struct x86_emulate_ctxt *ctxt)
3334{
3335 switch (ctxt->op_bytes) {
3336#ifdef CONFIG_X86_64
3337 case 8:
3338 asm("bswap %0" : "+r"(ctxt->dst.val));
3339 break;
3340#endif
3341 default:
3342 asm("bswap %0" : "+r"(*(u32 *)&ctxt->dst.val));
3343 break;
3344 }
3345 return X86EMUL_CONTINUE;
3346}
3347
Joerg Roedelcfec82c2011-04-04 12:39:28 +02003348static bool valid_cr(int nr)
3349{
3350 switch (nr) {
3351 case 0:
3352 case 2 ... 4:
3353 case 8:
3354 return true;
3355 default:
3356 return false;
3357 }
3358}
3359
3360static int check_cr_read(struct x86_emulate_ctxt *ctxt)
3361{
Avi Kivity9dac77f2011-06-01 15:34:25 +03003362 if (!valid_cr(ctxt->modrm_reg))
Joerg Roedelcfec82c2011-04-04 12:39:28 +02003363 return emulate_ud(ctxt);
3364
3365 return X86EMUL_CONTINUE;
3366}
3367
3368static int check_cr_write(struct x86_emulate_ctxt *ctxt)
3369{
Avi Kivity9dac77f2011-06-01 15:34:25 +03003370 u64 new_val = ctxt->src.val64;
3371 int cr = ctxt->modrm_reg;
Avi Kivityc2ad2bb2011-04-20 15:21:35 +03003372 u64 efer = 0;
Joerg Roedelcfec82c2011-04-04 12:39:28 +02003373
3374 static u64 cr_reserved_bits[] = {
3375 0xffffffff00000000ULL,
3376 0, 0, 0, /* CR3 checked later */
3377 CR4_RESERVED_BITS,
3378 0, 0, 0,
3379 CR8_RESERVED_BITS,
3380 };
3381
3382 if (!valid_cr(cr))
3383 return emulate_ud(ctxt);
3384
3385 if (new_val & cr_reserved_bits[cr])
3386 return emulate_gp(ctxt, 0);
3387
3388 switch (cr) {
3389 case 0: {
Avi Kivityc2ad2bb2011-04-20 15:21:35 +03003390 u64 cr4;
Joerg Roedelcfec82c2011-04-04 12:39:28 +02003391 if (((new_val & X86_CR0_PG) && !(new_val & X86_CR0_PE)) ||
3392 ((new_val & X86_CR0_NW) && !(new_val & X86_CR0_CD)))
3393 return emulate_gp(ctxt, 0);
3394
Avi Kivity717746e2011-04-20 13:37:53 +03003395 cr4 = ctxt->ops->get_cr(ctxt, 4);
3396 ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
Joerg Roedelcfec82c2011-04-04 12:39:28 +02003397
3398 if ((new_val & X86_CR0_PG) && (efer & EFER_LME) &&
3399 !(cr4 & X86_CR4_PAE))
3400 return emulate_gp(ctxt, 0);
3401
3402 break;
3403 }
3404 case 3: {
3405 u64 rsvd = 0;
3406
Avi Kivityc2ad2bb2011-04-20 15:21:35 +03003407 ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
3408 if (efer & EFER_LMA)
Joerg Roedelcfec82c2011-04-04 12:39:28 +02003409 rsvd = CR3_L_MODE_RESERVED_BITS;
Joerg Roedelcfec82c2011-04-04 12:39:28 +02003410
3411 if (new_val & rsvd)
3412 return emulate_gp(ctxt, 0);
3413
3414 break;
3415 }
3416 case 4: {
Avi Kivity717746e2011-04-20 13:37:53 +03003417 ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
Joerg Roedelcfec82c2011-04-04 12:39:28 +02003418
3419 if ((efer & EFER_LMA) && !(new_val & X86_CR4_PAE))
3420 return emulate_gp(ctxt, 0);
3421
3422 break;
3423 }
3424 }
3425
3426 return X86EMUL_CONTINUE;
3427}
3428
Joerg Roedel3b88e412011-04-04 12:39:29 +02003429static int check_dr7_gd(struct x86_emulate_ctxt *ctxt)
3430{
3431 unsigned long dr7;
3432
Avi Kivity717746e2011-04-20 13:37:53 +03003433 ctxt->ops->get_dr(ctxt, 7, &dr7);
Joerg Roedel3b88e412011-04-04 12:39:29 +02003434
3435 /* Check if DR7.Global_Enable is set */
3436 return dr7 & (1 << 13);
3437}
3438
3439static int check_dr_read(struct x86_emulate_ctxt *ctxt)
3440{
Avi Kivity9dac77f2011-06-01 15:34:25 +03003441 int dr = ctxt->modrm_reg;
Joerg Roedel3b88e412011-04-04 12:39:29 +02003442 u64 cr4;
3443
3444 if (dr > 7)
3445 return emulate_ud(ctxt);
3446
Avi Kivity717746e2011-04-20 13:37:53 +03003447 cr4 = ctxt->ops->get_cr(ctxt, 4);
Joerg Roedel3b88e412011-04-04 12:39:29 +02003448 if ((cr4 & X86_CR4_DE) && (dr == 4 || dr == 5))
3449 return emulate_ud(ctxt);
3450
3451 if (check_dr7_gd(ctxt))
3452 return emulate_db(ctxt);
3453
3454 return X86EMUL_CONTINUE;
3455}
3456
3457static int check_dr_write(struct x86_emulate_ctxt *ctxt)
3458{
Avi Kivity9dac77f2011-06-01 15:34:25 +03003459 u64 new_val = ctxt->src.val64;
3460 int dr = ctxt->modrm_reg;
Joerg Roedel3b88e412011-04-04 12:39:29 +02003461
3462 if ((dr == 6 || dr == 7) && (new_val & 0xffffffff00000000ULL))
3463 return emulate_gp(ctxt, 0);
3464
3465 return check_dr_read(ctxt);
3466}
3467
Joerg Roedel01de8b02011-04-04 12:39:31 +02003468static int check_svme(struct x86_emulate_ctxt *ctxt)
3469{
3470 u64 efer;
3471
Avi Kivity717746e2011-04-20 13:37:53 +03003472 ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
Joerg Roedel01de8b02011-04-04 12:39:31 +02003473
3474 if (!(efer & EFER_SVME))
3475 return emulate_ud(ctxt);
3476
3477 return X86EMUL_CONTINUE;
3478}
3479
3480static int check_svme_pa(struct x86_emulate_ctxt *ctxt)
3481{
Avi Kivitydd856ef2012-08-27 23:46:17 +03003482 u64 rax = reg_read(ctxt, VCPU_REGS_RAX);
Joerg Roedel01de8b02011-04-04 12:39:31 +02003483
3484 /* Valid physical address? */
Randy Dunlapd4224442011-04-21 09:09:22 -07003485 if (rax & 0xffff000000000000ULL)
Joerg Roedel01de8b02011-04-04 12:39:31 +02003486 return emulate_gp(ctxt, 0);
3487
3488 return check_svme(ctxt);
3489}
3490
Joerg Roedeld7eb8202011-04-04 12:39:32 +02003491static int check_rdtsc(struct x86_emulate_ctxt *ctxt)
3492{
Avi Kivity717746e2011-04-20 13:37:53 +03003493 u64 cr4 = ctxt->ops->get_cr(ctxt, 4);
Joerg Roedeld7eb8202011-04-04 12:39:32 +02003494
Avi Kivity717746e2011-04-20 13:37:53 +03003495 if (cr4 & X86_CR4_TSD && ctxt->ops->cpl(ctxt))
Joerg Roedeld7eb8202011-04-04 12:39:32 +02003496 return emulate_ud(ctxt);
3497
3498 return X86EMUL_CONTINUE;
3499}
3500
Joerg Roedel80612522011-04-04 12:39:33 +02003501static int check_rdpmc(struct x86_emulate_ctxt *ctxt)
3502{
Avi Kivity717746e2011-04-20 13:37:53 +03003503 u64 cr4 = ctxt->ops->get_cr(ctxt, 4);
Avi Kivitydd856ef2012-08-27 23:46:17 +03003504 u64 rcx = reg_read(ctxt, VCPU_REGS_RCX);
Joerg Roedel80612522011-04-04 12:39:33 +02003505
Avi Kivity717746e2011-04-20 13:37:53 +03003506 if ((!(cr4 & X86_CR4_PCE) && ctxt->ops->cpl(ctxt)) ||
Nadav Amit67f4d422014-06-02 18:34:09 +03003507 ctxt->ops->check_pmc(ctxt, rcx))
Joerg Roedel80612522011-04-04 12:39:33 +02003508 return emulate_gp(ctxt, 0);
3509
3510 return X86EMUL_CONTINUE;
3511}
3512
Joerg Roedelf6511932011-04-04 12:39:35 +02003513static int check_perm_in(struct x86_emulate_ctxt *ctxt)
3514{
Avi Kivity9dac77f2011-06-01 15:34:25 +03003515 ctxt->dst.bytes = min(ctxt->dst.bytes, 4u);
3516 if (!emulator_io_permited(ctxt, ctxt->src.val, ctxt->dst.bytes))
Joerg Roedelf6511932011-04-04 12:39:35 +02003517 return emulate_gp(ctxt, 0);
3518
3519 return X86EMUL_CONTINUE;
3520}
3521
3522static int check_perm_out(struct x86_emulate_ctxt *ctxt)
3523{
Avi Kivity9dac77f2011-06-01 15:34:25 +03003524 ctxt->src.bytes = min(ctxt->src.bytes, 4u);
3525 if (!emulator_io_permited(ctxt, ctxt->dst.val, ctxt->src.bytes))
Joerg Roedelf6511932011-04-04 12:39:35 +02003526 return emulate_gp(ctxt, 0);
3527
3528 return X86EMUL_CONTINUE;
3529}
3530
Avi Kivity73fba5f2010-07-29 15:11:53 +03003531#define D(_y) { .flags = (_y) }
Paolo Bonzinid40a6892014-03-27 11:58:02 +01003532#define DI(_y, _i) { .flags = (_y)|Intercept, .intercept = x86_intercept_##_i }
3533#define DIP(_y, _i, _p) { .flags = (_y)|Intercept|CheckPerm, \
3534 .intercept = x86_intercept_##_i, .check_perm = (_p) }
Gleb Natapov0b789ee2013-04-11 11:59:55 +03003535#define N D(NotImpl)
Joerg Roedel01de8b02011-04-04 12:39:31 +02003536#define EXT(_f, _e) { .flags = ((_f) | RMExt), .u.group = (_e) }
Takuya Yoshikawa1c2545b2012-04-30 17:46:31 +09003537#define G(_f, _g) { .flags = ((_f) | Group | ModRM), .u.group = (_g) }
3538#define GD(_f, _g) { .flags = ((_f) | GroupDual | ModRM), .u.gdual = (_g) }
Gleb Natapov045a2822012-12-20 16:57:43 +02003539#define E(_f, _e) { .flags = ((_f) | Escape | ModRM), .u.esc = (_e) }
Avi Kivity73fba5f2010-07-29 15:11:53 +03003540#define I(_f, _e) { .flags = (_f), .u.execute = (_e) }
Avi Kivitye28bbd42013-01-04 16:18:48 +02003541#define F(_f, _e) { .flags = (_f) | Fastop, .u.fastop = (_e) }
Avi Kivityc4f035c2011-04-04 12:39:22 +02003542#define II(_f, _e, _i) \
Paolo Bonzinid40a6892014-03-27 11:58:02 +01003543 { .flags = (_f)|Intercept, .u.execute = (_e), .intercept = x86_intercept_##_i }
Joerg Roedeld09beab2011-04-04 12:39:25 +02003544#define IIP(_f, _e, _i, _p) \
Paolo Bonzinid40a6892014-03-27 11:58:02 +01003545 { .flags = (_f)|Intercept|CheckPerm, .u.execute = (_e), \
3546 .intercept = x86_intercept_##_i, .check_perm = (_p) }
Avi Kivityaa97bb42010-01-20 18:09:23 +02003547#define GP(_f, _g) { .flags = ((_f) | Prefix), .u.gprefix = (_g) }
Avi Kivity73fba5f2010-07-29 15:11:53 +03003548
Avi Kivity8d8f4e92010-08-26 11:56:06 +03003549#define D2bv(_f) D((_f) | ByteOp), D(_f)
Joerg Roedelf6511932011-04-04 12:39:35 +02003550#define D2bvIP(_f, _i, _p) DIP((_f) | ByteOp, _i, _p), DIP(_f, _i, _p)
Avi Kivity8d8f4e92010-08-26 11:56:06 +03003551#define I2bv(_f, _e) I((_f) | ByteOp, _e), I(_f, _e)
Avi Kivityf7857f32013-01-04 16:18:53 +02003552#define F2bv(_f, _e) F((_f) | ByteOp, _e), F(_f, _e)
Takuya Yoshikawad7841a42011-11-22 15:16:54 +09003553#define I2bvIP(_f, _e, _i, _p) \
3554 IIP((_f) | ByteOp, _e, _i, _p), IIP(_f, _e, _i, _p)
Avi Kivity8d8f4e92010-08-26 11:56:06 +03003555
Avi Kivityfb864fb2013-01-04 16:18:54 +02003556#define F6ALU(_f, _e) F2bv((_f) | DstMem | SrcReg | ModRM, _e), \
3557 F2bv(((_f) | DstReg | SrcMem | ModRM) & ~Lock, _e), \
3558 F2bv(((_f) & ~Lock) | DstAcc | SrcImm, _e)
Avi Kivity6230f7f2010-08-26 18:34:55 +03003559
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003560static const struct opcode group7_rm1[] = {
Takuya Yoshikawa1c2545b2012-04-30 17:46:31 +09003561 DI(SrcNone | Priv, monitor),
3562 DI(SrcNone | Priv, mwait),
Joerg Roedeld7eb8202011-04-04 12:39:32 +02003563 N, N, N, N, N, N,
3564};
3565
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003566static const struct opcode group7_rm3[] = {
Takuya Yoshikawa1c2545b2012-04-30 17:46:31 +09003567 DIP(SrcNone | Prot | Priv, vmrun, check_svme_pa),
Borislav Petkovb51e9742013-09-22 16:44:52 +02003568 II(SrcNone | Prot | EmulateOnUD, em_vmmcall, vmmcall),
Takuya Yoshikawa1c2545b2012-04-30 17:46:31 +09003569 DIP(SrcNone | Prot | Priv, vmload, check_svme_pa),
3570 DIP(SrcNone | Prot | Priv, vmsave, check_svme_pa),
3571 DIP(SrcNone | Prot | Priv, stgi, check_svme),
3572 DIP(SrcNone | Prot | Priv, clgi, check_svme),
3573 DIP(SrcNone | Prot | Priv, skinit, check_svme),
3574 DIP(SrcNone | Prot | Priv, invlpga, check_svme),
Joerg Roedel01de8b02011-04-04 12:39:31 +02003575};
Avi Kivity6230f7f2010-08-26 18:34:55 +03003576
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003577static const struct opcode group7_rm7[] = {
Joerg Roedeld7eb8202011-04-04 12:39:32 +02003578 N,
Takuya Yoshikawa1c2545b2012-04-30 17:46:31 +09003579 DIP(SrcNone, rdtscp, check_rdtsc),
Joerg Roedeld7eb8202011-04-04 12:39:32 +02003580 N, N, N, N, N, N,
3581};
Takuya Yoshikawad67fc272011-04-23 18:48:02 +09003582
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003583static const struct opcode group1[] = {
Avi Kivityfb864fb2013-01-04 16:18:54 +02003584 F(Lock, em_add),
3585 F(Lock | PageTable, em_or),
3586 F(Lock, em_adc),
3587 F(Lock, em_sbb),
3588 F(Lock | PageTable, em_and),
3589 F(Lock, em_sub),
3590 F(Lock, em_xor),
3591 F(NoWrite, em_cmp),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003592};
3593
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003594static const struct opcode group1A[] = {
Takuya Yoshikawa1c2545b2012-04-30 17:46:31 +09003595 I(DstMem | SrcNone | Mov | Stack, em_pop), N, N, N, N, N, N, N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03003596};
3597
Avi Kivity007a3b52013-01-19 19:51:51 +02003598static const struct opcode group2[] = {
3599 F(DstMem | ModRM, em_rol),
3600 F(DstMem | ModRM, em_ror),
3601 F(DstMem | ModRM, em_rcl),
3602 F(DstMem | ModRM, em_rcr),
3603 F(DstMem | ModRM, em_shl),
3604 F(DstMem | ModRM, em_shr),
3605 F(DstMem | ModRM, em_shl),
3606 F(DstMem | ModRM, em_sar),
3607};
3608
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003609static const struct opcode group3[] = {
Avi Kivityfb864fb2013-01-04 16:18:54 +02003610 F(DstMem | SrcImm | NoWrite, em_test),
3611 F(DstMem | SrcImm | NoWrite, em_test),
Avi Kivity45a14672013-01-04 16:18:52 +02003612 F(DstMem | SrcNone | Lock, em_not),
3613 F(DstMem | SrcNone | Lock, em_neg),
Avi Kivityb9fa4092013-02-09 11:31:48 +02003614 F(DstXacc | Src2Mem, em_mul_ex),
3615 F(DstXacc | Src2Mem, em_imul_ex),
Avi Kivityb8c0b6a2013-02-09 11:31:49 +02003616 F(DstXacc | Src2Mem, em_div_ex),
3617 F(DstXacc | Src2Mem, em_idiv_ex),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003618};
3619
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003620static const struct opcode group4[] = {
Avi Kivity95413dc2013-01-19 19:51:53 +02003621 F(ByteOp | DstMem | SrcNone | Lock, em_inc),
3622 F(ByteOp | DstMem | SrcNone | Lock, em_dec),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003623 N, N, N, N, N, N,
3624};
3625
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003626static const struct opcode group5[] = {
Avi Kivity95413dc2013-01-19 19:51:53 +02003627 F(DstMem | SrcNone | Lock, em_inc),
3628 F(DstMem | SrcNone | Lock, em_dec),
Takuya Yoshikawa1c2545b2012-04-30 17:46:31 +09003629 I(SrcMem | Stack, em_grp45),
3630 I(SrcMemFAddr | ImplicitOps | Stack, em_call_far),
3631 I(SrcMem | Stack, em_grp45),
3632 I(SrcMemFAddr | ImplicitOps, em_grp45),
Gleb Natapov188424b2013-04-11 12:32:14 +03003633 I(SrcMem | Stack, em_grp45), D(Undefined),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003634};
3635
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003636static const struct opcode group6[] = {
Takuya Yoshikawa1c2545b2012-04-30 17:46:31 +09003637 DI(Prot, sldt),
3638 DI(Prot, str),
Avi Kivitya14e5792012-06-13 12:28:33 +03003639 II(Prot | Priv | SrcMem16, em_lldt, lldt),
Avi Kivity80890002012-06-13 16:33:29 +03003640 II(Prot | Priv | SrcMem16, em_ltr, ltr),
Joerg Roedeldee6bb72011-04-04 12:39:30 +02003641 N, N, N, N,
3642};
3643
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003644static const struct group_dual group7 = { {
Nadav Amit606b1c32014-06-02 18:34:06 +03003645 II(Mov | DstMem, em_sgdt, sgdt),
3646 II(Mov | DstMem, em_sidt, sidt),
Takuya Yoshikawa1c2545b2012-04-30 17:46:31 +09003647 II(SrcMem | Priv, em_lgdt, lgdt),
3648 II(SrcMem | Priv, em_lidt, lidt),
3649 II(SrcNone | DstMem | Mov, em_smsw, smsw), N,
3650 II(SrcMem16 | Mov | Priv, em_lmsw, lmsw),
3651 II(SrcMem | ByteOp | Priv | NoAccess, em_invlpg, invlpg),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003652}, {
Borislav Petkovb51e9742013-09-22 16:44:52 +02003653 I(SrcNone | Priv | EmulateOnUD, em_vmcall),
Avi Kivity5ef39c72011-04-21 12:21:50 +03003654 EXT(0, group7_rm1),
Joerg Roedel01de8b02011-04-04 12:39:31 +02003655 N, EXT(0, group7_rm3),
Takuya Yoshikawa1c2545b2012-04-30 17:46:31 +09003656 II(SrcNone | DstMem | Mov, em_smsw, smsw), N,
3657 II(SrcMem16 | Mov | Priv, em_lmsw, lmsw),
3658 EXT(0, group7_rm7),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003659} };
3660
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003661static const struct opcode group8[] = {
Avi Kivity73fba5f2010-07-29 15:11:53 +03003662 N, N, N, N,
Avi Kivity11c363b2013-01-19 19:51:54 +02003663 F(DstMem | SrcImmByte | NoWrite, em_bt),
3664 F(DstMem | SrcImmByte | Lock | PageTable, em_bts),
3665 F(DstMem | SrcImmByte | Lock, em_btr),
3666 F(DstMem | SrcImmByte | Lock | PageTable, em_btc),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003667};
3668
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003669static const struct group_dual group9 = { {
Takuya Yoshikawa1c2545b2012-04-30 17:46:31 +09003670 N, I(DstMem64 | Lock | PageTable, em_cmpxchg8b), N, N, N, N, N, N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03003671}, {
3672 N, N, N, N, N, N, N, N,
3673} };
3674
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003675static const struct opcode group11[] = {
Takuya Yoshikawa1c2545b2012-04-30 17:46:31 +09003676 I(DstMem | SrcImm | Mov | PageTable, em_mov),
Xiao Guangrongd5ae7ce2011-09-22 16:53:46 +08003677 X7(D(Undefined)),
Avi Kivitya4d4a7c2010-08-03 15:05:46 +03003678};
3679
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003680static const struct gprefix pfx_0f_6f_0f_7f = {
Avi Kivitye5971752012-04-09 18:40:03 +03003681 I(Mmx, em_mov), I(Sse | Aligned, em_mov), N, I(Sse | Unaligned, em_mov),
Avi Kivityaa97bb42010-01-20 18:09:23 +02003682};
3683
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003684static const struct gprefix pfx_vmovntpx = {
Avi Kivity3e114eb2012-04-09 18:40:01 +03003685 I(0, em_mov), N, N, N,
3686};
3687
Igor Mammedov27ce8252014-03-15 21:01:59 +01003688static const struct gprefix pfx_0f_28_0f_29 = {
Igor Mammedov6fec27d2014-03-15 21:02:00 +01003689 I(Aligned, em_mov), I(Aligned, em_mov), N, N,
Igor Mammedov27ce8252014-03-15 21:01:59 +01003690};
3691
Gleb Natapov045a2822012-12-20 16:57:43 +02003692static const struct escape escape_d9 = { {
3693 N, N, N, N, N, N, N, I(DstMem, em_fnstcw),
3694}, {
3695 /* 0xC0 - 0xC7 */
3696 N, N, N, N, N, N, N, N,
3697 /* 0xC8 - 0xCF */
3698 N, N, N, N, N, N, N, N,
3699 /* 0xD0 - 0xC7 */
3700 N, N, N, N, N, N, N, N,
3701 /* 0xD8 - 0xDF */
3702 N, N, N, N, N, N, N, N,
3703 /* 0xE0 - 0xE7 */
3704 N, N, N, N, N, N, N, N,
3705 /* 0xE8 - 0xEF */
3706 N, N, N, N, N, N, N, N,
3707 /* 0xF0 - 0xF7 */
3708 N, N, N, N, N, N, N, N,
3709 /* 0xF8 - 0xFF */
3710 N, N, N, N, N, N, N, N,
3711} };
3712
3713static const struct escape escape_db = { {
3714 N, N, N, N, N, N, N, N,
3715}, {
3716 /* 0xC0 - 0xC7 */
3717 N, N, N, N, N, N, N, N,
3718 /* 0xC8 - 0xCF */
3719 N, N, N, N, N, N, N, N,
3720 /* 0xD0 - 0xC7 */
3721 N, N, N, N, N, N, N, N,
3722 /* 0xD8 - 0xDF */
3723 N, N, N, N, N, N, N, N,
3724 /* 0xE0 - 0xE7 */
3725 N, N, N, I(ImplicitOps, em_fninit), N, N, N, N,
3726 /* 0xE8 - 0xEF */
3727 N, N, N, N, N, N, N, N,
3728 /* 0xF0 - 0xF7 */
3729 N, N, N, N, N, N, N, N,
3730 /* 0xF8 - 0xFF */
3731 N, N, N, N, N, N, N, N,
3732} };
3733
3734static const struct escape escape_dd = { {
3735 N, N, N, N, N, N, N, I(DstMem, em_fnstsw),
3736}, {
3737 /* 0xC0 - 0xC7 */
3738 N, N, N, N, N, N, N, N,
3739 /* 0xC8 - 0xCF */
3740 N, N, N, N, N, N, N, N,
3741 /* 0xD0 - 0xC7 */
3742 N, N, N, N, N, N, N, N,
3743 /* 0xD8 - 0xDF */
3744 N, N, N, N, N, N, N, N,
3745 /* 0xE0 - 0xE7 */
3746 N, N, N, N, N, N, N, N,
3747 /* 0xE8 - 0xEF */
3748 N, N, N, N, N, N, N, N,
3749 /* 0xF0 - 0xF7 */
3750 N, N, N, N, N, N, N, N,
3751 /* 0xF8 - 0xFF */
3752 N, N, N, N, N, N, N, N,
3753} };
3754
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003755static const struct opcode opcode_table[256] = {
Avi Kivity73fba5f2010-07-29 15:11:53 +03003756 /* 0x00 - 0x07 */
Avi Kivityfb864fb2013-01-04 16:18:54 +02003757 F6ALU(Lock, em_add),
Avi Kivity1cd196e2011-09-13 10:45:51 +03003758 I(ImplicitOps | Stack | No64 | Src2ES, em_push_sreg),
3759 I(ImplicitOps | Stack | No64 | Src2ES, em_pop_sreg),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003760 /* 0x08 - 0x0F */
Avi Kivityfb864fb2013-01-04 16:18:54 +02003761 F6ALU(Lock | PageTable, em_or),
Avi Kivity1cd196e2011-09-13 10:45:51 +03003762 I(ImplicitOps | Stack | No64 | Src2CS, em_push_sreg),
3763 N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03003764 /* 0x10 - 0x17 */
Avi Kivityfb864fb2013-01-04 16:18:54 +02003765 F6ALU(Lock, em_adc),
Avi Kivity1cd196e2011-09-13 10:45:51 +03003766 I(ImplicitOps | Stack | No64 | Src2SS, em_push_sreg),
3767 I(ImplicitOps | Stack | No64 | Src2SS, em_pop_sreg),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003768 /* 0x18 - 0x1F */
Avi Kivityfb864fb2013-01-04 16:18:54 +02003769 F6ALU(Lock, em_sbb),
Avi Kivity1cd196e2011-09-13 10:45:51 +03003770 I(ImplicitOps | Stack | No64 | Src2DS, em_push_sreg),
3771 I(ImplicitOps | Stack | No64 | Src2DS, em_pop_sreg),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003772 /* 0x20 - 0x27 */
Avi Kivityfb864fb2013-01-04 16:18:54 +02003773 F6ALU(Lock | PageTable, em_and), N, N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03003774 /* 0x28 - 0x2F */
Avi Kivityfb864fb2013-01-04 16:18:54 +02003775 F6ALU(Lock, em_sub), N, I(ByteOp | DstAcc | No64, em_das),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003776 /* 0x30 - 0x37 */
Avi Kivityfb864fb2013-01-04 16:18:54 +02003777 F6ALU(Lock, em_xor), N, N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03003778 /* 0x38 - 0x3F */
Avi Kivityfb864fb2013-01-04 16:18:54 +02003779 F6ALU(NoWrite, em_cmp), N, N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03003780 /* 0x40 - 0x4F */
Avi Kivity95413dc2013-01-19 19:51:53 +02003781 X8(F(DstReg, em_inc)), X8(F(DstReg, em_dec)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003782 /* 0x50 - 0x57 */
Avi Kivity63540382010-07-29 15:11:55 +03003783 X8(I(SrcReg | Stack, em_push)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003784 /* 0x58 - 0x5F */
Takuya Yoshikawac54fe502011-04-23 18:49:40 +09003785 X8(I(DstReg | Stack, em_pop)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003786 /* 0x60 - 0x67 */
Takuya Yoshikawab96a7fa2011-04-23 18:51:07 +09003787 I(ImplicitOps | Stack | No64, em_pusha),
3788 I(ImplicitOps | Stack | No64, em_popa),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003789 N, D(DstReg | SrcMem32 | ModRM | Mov) /* movsxd (x86/64) */ ,
3790 N, N, N, N,
3791 /* 0x68 - 0x6F */
Avi Kivityd46164d2010-08-18 19:29:33 +03003792 I(SrcImm | Mov | Stack, em_push),
3793 I(DstReg | SrcMem | ModRM | Src2Imm, em_imul_3op),
Avi Kivityf3a1b9f2010-08-18 18:25:25 +03003794 I(SrcImmByte | Mov | Stack, em_push),
3795 I(DstReg | SrcMem | ModRM | Src2ImmByte, em_imul_3op),
Gleb Natapovb3356bf2012-09-03 15:24:29 +03003796 I2bvIP(DstDI | SrcDX | Mov | String | Unaligned, em_in, ins, check_perm_in), /* insb, insw/insd */
Takuya Yoshikawa2b5e97e2011-11-23 12:27:39 +09003797 I2bvIP(SrcSI | DstDX | String, em_out, outs, check_perm_out), /* outsb, outsw/outsd */
Avi Kivity73fba5f2010-07-29 15:11:53 +03003798 /* 0x70 - 0x7F */
3799 X16(D(SrcImmByte)),
3800 /* 0x80 - 0x87 */
Takuya Yoshikawa1c2545b2012-04-30 17:46:31 +09003801 G(ByteOp | DstMem | SrcImm, group1),
3802 G(DstMem | SrcImm, group1),
3803 G(ByteOp | DstMem | SrcImm | No64, group1),
3804 G(DstMem | SrcImmByte, group1),
Avi Kivityfb864fb2013-01-04 16:18:54 +02003805 F2bv(DstMem | SrcReg | ModRM | NoWrite, em_test),
Xiao Guangrongd5ae7ce2011-09-22 16:53:46 +08003806 I2bv(DstMem | SrcReg | ModRM | Lock | PageTable, em_xchg),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003807 /* 0x88 - 0x8F */
Xiao Guangrongd5ae7ce2011-09-22 16:53:46 +08003808 I2bv(DstMem | SrcReg | ModRM | Mov | PageTable, em_mov),
Avi Kivityb9eac5f2010-08-03 14:46:56 +03003809 I2bv(DstReg | SrcMem | ModRM | Mov, em_mov),
Xiao Guangrongd5ae7ce2011-09-22 16:53:46 +08003810 I(DstMem | SrcNone | ModRM | Mov | PageTable, em_mov_rm_sreg),
Takuya Yoshikawa1bd5f462011-05-29 22:01:33 +09003811 D(ModRM | SrcMem | NoAccess | DstReg),
3812 I(ImplicitOps | SrcMem16 | ModRM, em_mov_sreg_rm),
3813 G(0, group1A),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003814 /* 0x90 - 0x97 */
Joerg Roedelbf608f82011-04-04 12:39:34 +02003815 DI(SrcAcc | DstReg, pause), X7(D(SrcAcc | DstReg)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003816 /* 0x98 - 0x9F */
Avi Kivity61429142010-08-19 15:13:00 +03003817 D(DstAcc | SrcNone), I(ImplicitOps | SrcAcc, em_cwd),
Wei Yongjuncc4feed2010-08-25 14:10:53 +08003818 I(SrcImmFAddr | No64, em_call_far), N,
Takuya Yoshikawa62aaa2f2011-04-23 18:52:56 +09003819 II(ImplicitOps | Stack, em_pushf, pushf),
Paolo Bonzini98f73632013-10-31 11:19:42 +01003820 II(ImplicitOps | Stack, em_popf, popf),
3821 I(ImplicitOps, em_sahf), I(ImplicitOps, em_lahf),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003822 /* 0xA0 - 0xA7 */
Avi Kivityb9eac5f2010-08-03 14:46:56 +03003823 I2bv(DstAcc | SrcMem | Mov | MemAbs, em_mov),
Xiao Guangrongd5ae7ce2011-09-22 16:53:46 +08003824 I2bv(DstMem | SrcAcc | Mov | MemAbs | PageTable, em_mov),
Avi Kivityb9eac5f2010-08-03 14:46:56 +03003825 I2bv(SrcSI | DstDI | Mov | String, em_mov),
Avi Kivityfb864fb2013-01-04 16:18:54 +02003826 F2bv(SrcSI | DstDI | String | NoWrite, em_cmp),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003827 /* 0xA8 - 0xAF */
Avi Kivityfb864fb2013-01-04 16:18:54 +02003828 F2bv(DstAcc | SrcImm | NoWrite, em_test),
Avi Kivityb9eac5f2010-08-03 14:46:56 +03003829 I2bv(SrcAcc | DstDI | Mov | String, em_mov),
3830 I2bv(SrcSI | DstAcc | Mov | String, em_mov),
Avi Kivityfb864fb2013-01-04 16:18:54 +02003831 F2bv(SrcAcc | DstDI | String | NoWrite, em_cmp),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003832 /* 0xB0 - 0xB7 */
Avi Kivityb9eac5f2010-08-03 14:46:56 +03003833 X8(I(ByteOp | DstReg | SrcImm | Mov, em_mov)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003834 /* 0xB8 - 0xBF */
Nadav Amit5e2c6882012-12-06 21:55:10 -02003835 X8(I(DstReg | SrcImm64 | Mov, em_mov)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003836 /* 0xC0 - 0xC7 */
Avi Kivity007a3b52013-01-19 19:51:51 +02003837 G(ByteOp | Src2ImmByte, group2), G(Src2ImmByte, group2),
Avi Kivity40ece7c2010-08-18 15:12:09 +03003838 I(ImplicitOps | Stack | SrcImmU16, em_ret_near_imm),
Takuya Yoshikawaebda02c2011-05-29 22:00:22 +09003839 I(ImplicitOps | Stack, em_ret),
Avi Kivityd4b43252011-09-13 10:45:50 +03003840 I(DstReg | SrcMemFAddr | ModRM | No64 | Src2ES, em_lseg),
3841 I(DstReg | SrcMemFAddr | ModRM | No64 | Src2DS, em_lseg),
Avi Kivitya4d4a7c2010-08-03 15:05:46 +03003842 G(ByteOp, group11), G(0, group11),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003843 /* 0xC8 - 0xCF */
Avi Kivity612e89f2012-06-12 20:03:23 +03003844 I(Stack | SrcImmU16 | Src2ImmByte, em_enter), I(Stack, em_leave),
Bruce Rogers32611072013-09-09 09:40:20 -06003845 I(ImplicitOps | Stack | SrcImmU16, em_ret_far_imm),
3846 I(ImplicitOps | Stack, em_ret_far),
Avi Kivity3c6e2762011-04-04 12:39:23 +02003847 D(ImplicitOps), DI(SrcImmByte, intn),
Takuya Yoshikawadb5b0762011-05-29 21:56:26 +09003848 D(ImplicitOps | No64), II(ImplicitOps, em_iret, iret),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003849 /* 0xD0 - 0xD7 */
Avi Kivity007a3b52013-01-19 19:51:51 +02003850 G(Src2One | ByteOp, group2), G(Src2One, group2),
3851 G(Src2CL | ByteOp, group2), G(Src2CL, group2),
Paolo Bonzinia035d5c62013-05-09 11:32:49 +02003852 I(DstAcc | SrcImmUByte | No64, em_aam),
Paolo Bonzini326f5782013-05-09 11:32:51 +02003853 I(DstAcc | SrcImmUByte | No64, em_aad),
3854 F(DstAcc | ByteOp | No64, em_salc),
Paolo Bonzini7fa57952013-05-09 11:32:50 +02003855 I(DstAcc | SrcXLat | ByteOp, em_mov),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003856 /* 0xD8 - 0xDF */
Gleb Natapov045a2822012-12-20 16:57:43 +02003857 N, E(0, &escape_d9), N, E(0, &escape_db), N, E(0, &escape_dd), N, N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03003858 /* 0xE0 - 0xE7 */
Takuya Yoshikawad06e03a2011-05-29 22:04:08 +09003859 X3(I(SrcImmByte, em_loop)),
3860 I(SrcImmByte, em_jcxz),
Takuya Yoshikawad7841a42011-11-22 15:16:54 +09003861 I2bvIP(SrcImmUByte | DstAcc, em_in, in, check_perm_in),
3862 I2bvIP(SrcAcc | DstImmUByte, em_out, out, check_perm_out),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003863 /* 0xE8 - 0xEF */
Takuya Yoshikawad4ddafc2011-11-22 15:18:35 +09003864 I(SrcImm | Stack, em_call), D(SrcImm | ImplicitOps),
Takuya Yoshikawadb5b0762011-05-29 21:56:26 +09003865 I(SrcImmFAddr | No64, em_jmp_far), D(SrcImmByte | ImplicitOps),
Takuya Yoshikawad7841a42011-11-22 15:16:54 +09003866 I2bvIP(SrcDX | DstAcc, em_in, in, check_perm_in),
3867 I2bvIP(SrcAcc | DstDX, em_out, out, check_perm_out),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003868 /* 0xF0 - 0xF7 */
Joerg Roedelbf608f82011-04-04 12:39:34 +02003869 N, DI(ImplicitOps, icebp), N, N,
Avi Kivity3c6e2762011-04-04 12:39:23 +02003870 DI(ImplicitOps | Priv, hlt), D(ImplicitOps),
3871 G(ByteOp, group3), G(0, group3),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003872 /* 0xF8 - 0xFF */
Takuya Yoshikawaf411e6c2011-05-29 22:05:15 +09003873 D(ImplicitOps), D(ImplicitOps),
3874 I(ImplicitOps, em_cli), I(ImplicitOps, em_sti),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003875 D(ImplicitOps), D(ImplicitOps), G(0, group4), G(0, group5),
3876};
3877
Mathias Krausefd0a0d82012-08-30 01:30:15 +02003878static const struct opcode twobyte_table[256] = {
Avi Kivity73fba5f2010-07-29 15:11:53 +03003879 /* 0x00 - 0x0F */
Joerg Roedeldee6bb72011-04-04 12:39:30 +02003880 G(0, group6), GD(0, &group7), N, N,
Borislav Petkovb51e9742013-09-22 16:44:52 +02003881 N, I(ImplicitOps | EmulateOnUD, em_syscall),
Takuya Yoshikawadb5b0762011-05-29 21:56:26 +09003882 II(ImplicitOps | Priv, em_clts, clts), N,
Avi Kivity3c6e2762011-04-04 12:39:23 +02003883 DI(ImplicitOps | Priv, invd), DI(ImplicitOps | Priv, wbinvd), N, N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03003884 N, D(ImplicitOps | ModRM), N, N,
3885 /* 0x10 - 0x1F */
Paolo Bonzini103f98e2013-05-30 13:22:39 +02003886 N, N, N, N, N, N, N, N,
3887 D(ImplicitOps | ModRM), N, N, N, N, N, N, D(ImplicitOps | ModRM),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003888 /* 0x20 - 0x2F */
Nadav Amit9b88ae92014-05-25 23:05:21 +03003889 DIP(ModRM | DstMem | Priv | Op3264 | NoMod, cr_read, check_cr_read),
3890 DIP(ModRM | DstMem | Priv | Op3264 | NoMod, dr_read, check_dr_read),
3891 IIP(ModRM | SrcMem | Priv | Op3264 | NoMod, em_cr_write, cr_write,
3892 check_cr_write),
3893 IIP(ModRM | SrcMem | Priv | Op3264 | NoMod, em_dr_write, dr_write,
3894 check_dr_write),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003895 N, N, N, N,
Igor Mammedov27ce8252014-03-15 21:01:59 +01003896 GP(ModRM | DstReg | SrcMem | Mov | Sse, &pfx_0f_28_0f_29),
3897 GP(ModRM | DstMem | SrcReg | Mov | Sse, &pfx_0f_28_0f_29),
3898 N, GP(ModRM | DstMem | SrcReg | Sse | Mov | Aligned, &pfx_vmovntpx),
Avi Kivity3e114eb2012-04-09 18:40:01 +03003899 N, N, N, N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03003900 /* 0x30 - 0x3F */
Takuya Yoshikawae1e210b2011-11-22 15:20:03 +09003901 II(ImplicitOps | Priv, em_wrmsr, wrmsr),
Joerg Roedel80612522011-04-04 12:39:33 +02003902 IIP(ImplicitOps, em_rdtsc, rdtsc, check_rdtsc),
Takuya Yoshikawae1e210b2011-11-22 15:20:03 +09003903 II(ImplicitOps | Priv, em_rdmsr, rdmsr),
Avi Kivity222d21a2011-11-10 14:57:30 +02003904 IIP(ImplicitOps, em_rdpmc, rdpmc, check_rdpmc),
Borislav Petkovb51e9742013-09-22 16:44:52 +02003905 I(ImplicitOps | EmulateOnUD, em_sysenter),
3906 I(ImplicitOps | Priv | EmulateOnUD, em_sysexit),
Avi Kivityd8671622011-02-01 16:32:03 +02003907 N, N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03003908 N, N, N, N, N, N, N, N,
3909 /* 0x40 - 0x4F */
Nadav Amit140bad82014-06-15 16:13:00 +03003910 X16(D(DstReg | SrcMem | ModRM)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003911 /* 0x50 - 0x5F */
3912 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
3913 /* 0x60 - 0x6F */
Avi Kivityaa97bb42010-01-20 18:09:23 +02003914 N, N, N, N,
3915 N, N, N, N,
3916 N, N, N, N,
3917 N, N, N, GP(SrcMem | DstReg | ModRM | Mov, &pfx_0f_6f_0f_7f),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003918 /* 0x70 - 0x7F */
Avi Kivityaa97bb42010-01-20 18:09:23 +02003919 N, N, N, N,
3920 N, N, N, N,
3921 N, N, N, N,
3922 N, N, N, GP(SrcReg | DstMem | ModRM | Mov, &pfx_0f_6f_0f_7f),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003923 /* 0x80 - 0x8F */
3924 X16(D(SrcImm)),
3925 /* 0x90 - 0x9F */
Wei Yongjunee45b582010-08-06 17:10:07 +08003926 X16(D(ByteOp | DstMem | SrcNone | ModRM| Mov)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003927 /* 0xA0 - 0xA7 */
Avi Kivity1cd196e2011-09-13 10:45:51 +03003928 I(Stack | Src2FS, em_push_sreg), I(Stack | Src2FS, em_pop_sreg),
Avi Kivity11c363b2013-01-19 19:51:54 +02003929 II(ImplicitOps, em_cpuid, cpuid),
3930 F(DstMem | SrcReg | ModRM | BitOp | NoWrite, em_bt),
Avi Kivity0bdea062013-01-19 19:51:50 +02003931 F(DstMem | SrcReg | Src2ImmByte | ModRM, em_shld),
3932 F(DstMem | SrcReg | Src2CL | ModRM, em_shld), N, N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03003933 /* 0xA8 - 0xAF */
Avi Kivity1cd196e2011-09-13 10:45:51 +03003934 I(Stack | Src2GS, em_push_sreg), I(Stack | Src2GS, em_pop_sreg),
Xiao Guangrongd5ae7ce2011-09-22 16:53:46 +08003935 DI(ImplicitOps, rsm),
Avi Kivity11c363b2013-01-19 19:51:54 +02003936 F(DstMem | SrcReg | ModRM | BitOp | Lock | PageTable, em_bts),
Avi Kivity0bdea062013-01-19 19:51:50 +02003937 F(DstMem | SrcReg | Src2ImmByte | ModRM, em_shrd),
3938 F(DstMem | SrcReg | Src2CL | ModRM, em_shrd),
Avi Kivity4d758342013-01-19 19:51:55 +02003939 D(ModRM), F(DstReg | SrcMem | ModRM, em_imul),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003940 /* 0xB0 - 0xB7 */
Takuya Yoshikawae940b5c2011-11-22 15:20:47 +09003941 I2bv(DstMem | SrcReg | ModRM | Lock | PageTable, em_cmpxchg),
Avi Kivityd4b43252011-09-13 10:45:50 +03003942 I(DstReg | SrcMemFAddr | ModRM | Src2SS, em_lseg),
Avi Kivity11c363b2013-01-19 19:51:54 +02003943 F(DstMem | SrcReg | ModRM | BitOp | Lock, em_btr),
Avi Kivityd4b43252011-09-13 10:45:50 +03003944 I(DstReg | SrcMemFAddr | ModRM | Src2FS, em_lseg),
3945 I(DstReg | SrcMemFAddr | ModRM | Src2GS, em_lseg),
Avi Kivity2adb5ad2012-01-16 15:08:45 +02003946 D(DstReg | SrcMem8 | ModRM | Mov), D(DstReg | SrcMem16 | ModRM | Mov),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003947 /* 0xB8 - 0xBF */
3948 N, N,
Takuya Yoshikawace7faab2011-11-22 15:17:48 +09003949 G(BitOp, group8),
Avi Kivity11c363b2013-01-19 19:51:54 +02003950 F(DstMem | SrcReg | ModRM | BitOp | Lock | PageTable, em_btc),
3951 F(DstReg | SrcMem | ModRM, em_bsf), F(DstReg | SrcMem | ModRM, em_bsr),
Avi Kivity2adb5ad2012-01-16 15:08:45 +02003952 D(DstReg | SrcMem8 | ModRM | Mov), D(DstReg | SrcMem16 | ModRM | Mov),
Avi Kivity92998362012-06-13 12:25:06 +03003953 /* 0xC0 - 0xC7 */
Avi Kivitye47a5f52013-02-09 11:31:51 +02003954 F2bv(DstMem | SrcReg | ModRM | SrcWrite | Lock, em_xadd),
Wei Yongjun92f738a2010-08-17 09:19:34 +08003955 N, D(DstMem | SrcReg | ModRM | Mov),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003956 N, N, N, GD(0, &group9),
Avi Kivity92998362012-06-13 12:25:06 +03003957 /* 0xC8 - 0xCF */
3958 X8(I(DstReg, em_bswap)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03003959 /* 0xD0 - 0xDF */
3960 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
3961 /* 0xE0 - 0xEF */
3962 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
3963 /* 0xF0 - 0xFF */
3964 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N
3965};
3966
Borislav Petkov0bc5eed2013-10-29 12:54:10 +01003967static const struct gprefix three_byte_0f_38_f0 = {
Borislav Petkov84cffe42013-10-29 12:54:56 +01003968 I(DstReg | SrcMem | Mov, em_movbe), N, N, N
Borislav Petkov0bc5eed2013-10-29 12:54:10 +01003969};
3970
3971static const struct gprefix three_byte_0f_38_f1 = {
Borislav Petkov84cffe42013-10-29 12:54:56 +01003972 I(DstMem | SrcReg | Mov, em_movbe), N, N, N
Borislav Petkov0bc5eed2013-10-29 12:54:10 +01003973};
3974
3975/*
3976 * Insns below are selected by the prefix which indexed by the third opcode
3977 * byte.
3978 */
3979static const struct opcode opcode_map_0f_38[256] = {
3980 /* 0x00 - 0x7f */
3981 X16(N), X16(N), X16(N), X16(N), X16(N), X16(N), X16(N), X16(N),
Borislav Petkov84cffe42013-10-29 12:54:56 +01003982 /* 0x80 - 0xef */
3983 X16(N), X16(N), X16(N), X16(N), X16(N), X16(N), X16(N),
3984 /* 0xf0 - 0xf1 */
3985 GP(EmulateOnUD | ModRM | Prefix, &three_byte_0f_38_f0),
3986 GP(EmulateOnUD | ModRM | Prefix, &three_byte_0f_38_f1),
3987 /* 0xf2 - 0xff */
3988 N, N, X4(N), X8(N)
Borislav Petkov0bc5eed2013-10-29 12:54:10 +01003989};
3990
Avi Kivity73fba5f2010-07-29 15:11:53 +03003991#undef D
3992#undef N
3993#undef G
3994#undef GD
3995#undef I
Avi Kivityaa97bb42010-01-20 18:09:23 +02003996#undef GP
Joerg Roedel01de8b02011-04-04 12:39:31 +02003997#undef EXT
Avi Kivity73fba5f2010-07-29 15:11:53 +03003998
Avi Kivity8d8f4e92010-08-26 11:56:06 +03003999#undef D2bv
Joerg Roedelf6511932011-04-04 12:39:35 +02004000#undef D2bvIP
Avi Kivity8d8f4e92010-08-26 11:56:06 +03004001#undef I2bv
Takuya Yoshikawad7841a42011-11-22 15:16:54 +09004002#undef I2bvIP
Takuya Yoshikawad67fc272011-04-23 18:48:02 +09004003#undef I6ALU
Avi Kivity8d8f4e92010-08-26 11:56:06 +03004004
Avi Kivity9dac77f2011-06-01 15:34:25 +03004005static unsigned imm_size(struct x86_emulate_ctxt *ctxt)
Avi Kivity39f21ee2010-08-18 19:20:21 +03004006{
4007 unsigned size;
4008
Avi Kivity9dac77f2011-06-01 15:34:25 +03004009 size = (ctxt->d & ByteOp) ? 1 : ctxt->op_bytes;
Avi Kivity39f21ee2010-08-18 19:20:21 +03004010 if (size == 8)
4011 size = 4;
4012 return size;
4013}
4014
4015static int decode_imm(struct x86_emulate_ctxt *ctxt, struct operand *op,
4016 unsigned size, bool sign_extension)
4017{
Avi Kivity39f21ee2010-08-18 19:20:21 +03004018 int rc = X86EMUL_CONTINUE;
4019
4020 op->type = OP_IMM;
4021 op->bytes = size;
Avi Kivity9dac77f2011-06-01 15:34:25 +03004022 op->addr.mem.ea = ctxt->_eip;
Avi Kivity39f21ee2010-08-18 19:20:21 +03004023 /* NB. Immediates are sign-extended as necessary. */
4024 switch (op->bytes) {
4025 case 1:
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09004026 op->val = insn_fetch(s8, ctxt);
Avi Kivity39f21ee2010-08-18 19:20:21 +03004027 break;
4028 case 2:
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09004029 op->val = insn_fetch(s16, ctxt);
Avi Kivity39f21ee2010-08-18 19:20:21 +03004030 break;
4031 case 4:
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09004032 op->val = insn_fetch(s32, ctxt);
Avi Kivity39f21ee2010-08-18 19:20:21 +03004033 break;
Nadav Amit5e2c6882012-12-06 21:55:10 -02004034 case 8:
4035 op->val = insn_fetch(s64, ctxt);
4036 break;
Avi Kivity39f21ee2010-08-18 19:20:21 +03004037 }
4038 if (!sign_extension) {
4039 switch (op->bytes) {
4040 case 1:
4041 op->val &= 0xff;
4042 break;
4043 case 2:
4044 op->val &= 0xffff;
4045 break;
4046 case 4:
4047 op->val &= 0xffffffff;
4048 break;
4049 }
4050 }
4051done:
4052 return rc;
4053}
4054
Avi Kivitya9945542011-09-13 10:45:41 +03004055static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
4056 unsigned d)
4057{
4058 int rc = X86EMUL_CONTINUE;
4059
4060 switch (d) {
4061 case OpReg:
Avi Kivity2adb5ad2012-01-16 15:08:45 +02004062 decode_register_operand(ctxt, op);
Avi Kivitya9945542011-09-13 10:45:41 +03004063 break;
4064 case OpImmUByte:
Avi Kivity608aabe2011-09-13 10:45:45 +03004065 rc = decode_imm(ctxt, op, 1, false);
Avi Kivitya9945542011-09-13 10:45:41 +03004066 break;
4067 case OpMem:
Avi Kivity41ddf972011-09-13 10:45:48 +03004068 ctxt->memop.bytes = (ctxt->d & ByteOp) ? 1 : ctxt->op_bytes;
Avi Kivity0fe59122011-09-13 10:45:47 +03004069 mem_common:
Avi Kivitya9945542011-09-13 10:45:41 +03004070 *op = ctxt->memop;
4071 ctxt->memopp = op;
Paolo Bonzini96888972014-04-01 14:54:19 +02004072 if (ctxt->d & BitOp)
Avi Kivitya9945542011-09-13 10:45:41 +03004073 fetch_bit_operand(ctxt);
4074 op->orig_val = op->val;
4075 break;
Avi Kivity41ddf972011-09-13 10:45:48 +03004076 case OpMem64:
Nadav Amitaaa05f22014-06-02 18:34:10 +03004077 ctxt->memop.bytes = (ctxt->op_bytes == 8) ? 16 : 8;
Avi Kivity41ddf972011-09-13 10:45:48 +03004078 goto mem_common;
Avi Kivitya9945542011-09-13 10:45:41 +03004079 case OpAcc:
4080 op->type = OP_REG;
4081 op->bytes = (ctxt->d & ByteOp) ? 1 : ctxt->op_bytes;
Avi Kivitydd856ef2012-08-27 23:46:17 +03004082 op->addr.reg = reg_rmw(ctxt, VCPU_REGS_RAX);
Avi Kivitya9945542011-09-13 10:45:41 +03004083 fetch_register_operand(op);
4084 op->orig_val = op->val;
4085 break;
Avi Kivity820207c2013-02-09 11:31:45 +02004086 case OpAccLo:
4087 op->type = OP_REG;
4088 op->bytes = (ctxt->d & ByteOp) ? 2 : ctxt->op_bytes;
4089 op->addr.reg = reg_rmw(ctxt, VCPU_REGS_RAX);
4090 fetch_register_operand(op);
4091 op->orig_val = op->val;
4092 break;
4093 case OpAccHi:
4094 if (ctxt->d & ByteOp) {
4095 op->type = OP_NONE;
4096 break;
4097 }
4098 op->type = OP_REG;
4099 op->bytes = ctxt->op_bytes;
4100 op->addr.reg = reg_rmw(ctxt, VCPU_REGS_RDX);
4101 fetch_register_operand(op);
4102 op->orig_val = op->val;
4103 break;
Avi Kivitya9945542011-09-13 10:45:41 +03004104 case OpDI:
4105 op->type = OP_MEM;
4106 op->bytes = (ctxt->d & ByteOp) ? 1 : ctxt->op_bytes;
4107 op->addr.mem.ea =
Avi Kivitydd856ef2012-08-27 23:46:17 +03004108 register_address(ctxt, reg_read(ctxt, VCPU_REGS_RDI));
Avi Kivitya9945542011-09-13 10:45:41 +03004109 op->addr.mem.seg = VCPU_SREG_ES;
4110 op->val = 0;
Gleb Natapovb3356bf2012-09-03 15:24:29 +03004111 op->count = 1;
Avi Kivitya9945542011-09-13 10:45:41 +03004112 break;
4113 case OpDX:
4114 op->type = OP_REG;
4115 op->bytes = 2;
Avi Kivitydd856ef2012-08-27 23:46:17 +03004116 op->addr.reg = reg_rmw(ctxt, VCPU_REGS_RDX);
Avi Kivitya9945542011-09-13 10:45:41 +03004117 fetch_register_operand(op);
4118 break;
Avi Kivity4dd6a572011-09-13 10:45:43 +03004119 case OpCL:
4120 op->bytes = 1;
Avi Kivitydd856ef2012-08-27 23:46:17 +03004121 op->val = reg_read(ctxt, VCPU_REGS_RCX) & 0xff;
Avi Kivity4dd6a572011-09-13 10:45:43 +03004122 break;
4123 case OpImmByte:
4124 rc = decode_imm(ctxt, op, 1, true);
4125 break;
4126 case OpOne:
4127 op->bytes = 1;
4128 op->val = 1;
4129 break;
4130 case OpImm:
4131 rc = decode_imm(ctxt, op, imm_size(ctxt), true);
4132 break;
Nadav Amit5e2c6882012-12-06 21:55:10 -02004133 case OpImm64:
4134 rc = decode_imm(ctxt, op, ctxt->op_bytes, true);
4135 break;
Avi Kivity28867ce2012-01-16 15:08:44 +02004136 case OpMem8:
4137 ctxt->memop.bytes = 1;
Gleb Natapov660696d2013-04-24 13:38:36 +03004138 if (ctxt->memop.type == OP_REG) {
Gleb Natapovaa9ac1a2013-11-04 15:52:41 +02004139 ctxt->memop.addr.reg = decode_register(ctxt,
4140 ctxt->modrm_rm, true);
Gleb Natapov660696d2013-04-24 13:38:36 +03004141 fetch_register_operand(&ctxt->memop);
4142 }
Avi Kivity28867ce2012-01-16 15:08:44 +02004143 goto mem_common;
Avi Kivity0fe59122011-09-13 10:45:47 +03004144 case OpMem16:
4145 ctxt->memop.bytes = 2;
4146 goto mem_common;
4147 case OpMem32:
4148 ctxt->memop.bytes = 4;
4149 goto mem_common;
4150 case OpImmU16:
4151 rc = decode_imm(ctxt, op, 2, false);
4152 break;
4153 case OpImmU:
4154 rc = decode_imm(ctxt, op, imm_size(ctxt), false);
4155 break;
4156 case OpSI:
4157 op->type = OP_MEM;
4158 op->bytes = (ctxt->d & ByteOp) ? 1 : ctxt->op_bytes;
4159 op->addr.mem.ea =
Avi Kivitydd856ef2012-08-27 23:46:17 +03004160 register_address(ctxt, reg_read(ctxt, VCPU_REGS_RSI));
Bandan Das573e80f2014-04-16 12:46:13 -04004161 op->addr.mem.seg = ctxt->seg_override;
Avi Kivity0fe59122011-09-13 10:45:47 +03004162 op->val = 0;
Gleb Natapovb3356bf2012-09-03 15:24:29 +03004163 op->count = 1;
Avi Kivity0fe59122011-09-13 10:45:47 +03004164 break;
Paolo Bonzini7fa57952013-05-09 11:32:50 +02004165 case OpXLat:
4166 op->type = OP_MEM;
4167 op->bytes = (ctxt->d & ByteOp) ? 1 : ctxt->op_bytes;
4168 op->addr.mem.ea =
4169 register_address(ctxt,
4170 reg_read(ctxt, VCPU_REGS_RBX) +
4171 (reg_read(ctxt, VCPU_REGS_RAX) & 0xff));
Bandan Das573e80f2014-04-16 12:46:13 -04004172 op->addr.mem.seg = ctxt->seg_override;
Paolo Bonzini7fa57952013-05-09 11:32:50 +02004173 op->val = 0;
4174 break;
Avi Kivity0fe59122011-09-13 10:45:47 +03004175 case OpImmFAddr:
4176 op->type = OP_IMM;
4177 op->addr.mem.ea = ctxt->_eip;
4178 op->bytes = ctxt->op_bytes + 2;
4179 insn_fetch_arr(op->valptr, op->bytes, ctxt);
4180 break;
4181 case OpMemFAddr:
4182 ctxt->memop.bytes = ctxt->op_bytes + 2;
4183 goto mem_common;
Avi Kivityc191a7a2011-09-13 10:45:49 +03004184 case OpES:
4185 op->val = VCPU_SREG_ES;
4186 break;
4187 case OpCS:
4188 op->val = VCPU_SREG_CS;
4189 break;
4190 case OpSS:
4191 op->val = VCPU_SREG_SS;
4192 break;
4193 case OpDS:
4194 op->val = VCPU_SREG_DS;
4195 break;
4196 case OpFS:
4197 op->val = VCPU_SREG_FS;
4198 break;
4199 case OpGS:
4200 op->val = VCPU_SREG_GS;
4201 break;
Avi Kivitya9945542011-09-13 10:45:41 +03004202 case OpImplicit:
4203 /* Special instructions do their own operand decoding. */
4204 default:
4205 op->type = OP_NONE; /* Disable writeback. */
4206 break;
4207 }
4208
4209done:
4210 return rc;
4211}
4212
Takuya Yoshikawaef5d75c2011-05-15 00:57:43 +09004213int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004214{
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004215 int rc = X86EMUL_CONTINUE;
4216 int mode = ctxt->mode;
Avi Kivity46561642011-04-24 14:09:59 +03004217 int def_op_bytes, def_ad_bytes, goffset, simd_prefix;
Avi Kivity0d7cdee2011-03-29 11:34:38 +02004218 bool op_prefix = false;
Bandan Das573e80f2014-04-16 12:46:13 -04004219 bool has_seg_override = false;
Avi Kivity46561642011-04-24 14:09:59 +03004220 struct opcode opcode;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004221
Avi Kivityf09ed832011-09-13 10:45:40 +03004222 ctxt->memop.type = OP_NONE;
4223 ctxt->memopp = NULL;
Avi Kivity9dac77f2011-06-01 15:34:25 +03004224 ctxt->_eip = ctxt->eip;
4225 ctxt->fetch.start = ctxt->_eip;
4226 ctxt->fetch.end = ctxt->fetch.start + insn_len;
Borislav Petkov1ce19dc2013-09-22 16:44:51 +02004227 ctxt->opcode_len = 1;
Andre Przywaradc25e892010-12-21 11:12:07 +01004228 if (insn_len > 0)
Avi Kivity9dac77f2011-06-01 15:34:25 +03004229 memcpy(ctxt->fetch.data, insn, insn_len);
Paolo Bonzini285ca9e2014-05-06 12:24:32 +02004230 else {
4231 rc = do_insn_fetch_bytes(ctxt);
4232 if (rc != X86EMUL_CONTINUE)
4233 return rc;
4234 }
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004235
4236 switch (mode) {
4237 case X86EMUL_MODE_REAL:
4238 case X86EMUL_MODE_VM86:
4239 case X86EMUL_MODE_PROT16:
4240 def_op_bytes = def_ad_bytes = 2;
4241 break;
4242 case X86EMUL_MODE_PROT32:
4243 def_op_bytes = def_ad_bytes = 4;
4244 break;
4245#ifdef CONFIG_X86_64
4246 case X86EMUL_MODE_PROT64:
4247 def_op_bytes = 4;
4248 def_ad_bytes = 8;
4249 break;
4250#endif
4251 default:
Takuya Yoshikawa1d2887e2011-07-30 18:03:34 +09004252 return EMULATION_FAILED;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004253 }
4254
Avi Kivity9dac77f2011-06-01 15:34:25 +03004255 ctxt->op_bytes = def_op_bytes;
4256 ctxt->ad_bytes = def_ad_bytes;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004257
4258 /* Legacy prefixes. */
4259 for (;;) {
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09004260 switch (ctxt->b = insn_fetch(u8, ctxt)) {
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004261 case 0x66: /* operand-size override */
Avi Kivity0d7cdee2011-03-29 11:34:38 +02004262 op_prefix = true;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004263 /* switch between 2/4 bytes */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004264 ctxt->op_bytes = def_op_bytes ^ 6;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004265 break;
4266 case 0x67: /* address-size override */
4267 if (mode == X86EMUL_MODE_PROT64)
4268 /* switch between 4/8 bytes */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004269 ctxt->ad_bytes = def_ad_bytes ^ 12;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004270 else
4271 /* switch between 2/4 bytes */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004272 ctxt->ad_bytes = def_ad_bytes ^ 6;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004273 break;
4274 case 0x26: /* ES override */
4275 case 0x2e: /* CS override */
4276 case 0x36: /* SS override */
4277 case 0x3e: /* DS override */
Bandan Das573e80f2014-04-16 12:46:13 -04004278 has_seg_override = true;
4279 ctxt->seg_override = (ctxt->b >> 3) & 3;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004280 break;
4281 case 0x64: /* FS override */
4282 case 0x65: /* GS override */
Bandan Das573e80f2014-04-16 12:46:13 -04004283 has_seg_override = true;
4284 ctxt->seg_override = ctxt->b & 7;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004285 break;
4286 case 0x40 ... 0x4f: /* REX */
4287 if (mode != X86EMUL_MODE_PROT64)
4288 goto done_prefixes;
Avi Kivity9dac77f2011-06-01 15:34:25 +03004289 ctxt->rex_prefix = ctxt->b;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004290 continue;
4291 case 0xf0: /* LOCK */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004292 ctxt->lock_prefix = 1;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004293 break;
4294 case 0xf2: /* REPNE/REPNZ */
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004295 case 0xf3: /* REP/REPE/REPZ */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004296 ctxt->rep_prefix = ctxt->b;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004297 break;
4298 default:
4299 goto done_prefixes;
4300 }
4301
4302 /* Any legacy prefix after a REX prefix nullifies its effect. */
4303
Avi Kivity9dac77f2011-06-01 15:34:25 +03004304 ctxt->rex_prefix = 0;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004305 }
4306
4307done_prefixes:
4308
4309 /* REX prefix. */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004310 if (ctxt->rex_prefix & 8)
4311 ctxt->op_bytes = 8; /* REX.W */
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004312
4313 /* Opcode byte(s). */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004314 opcode = opcode_table[ctxt->b];
Wei Yongjund3ad6242010-08-05 16:34:39 +08004315 /* Two-byte opcode? */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004316 if (ctxt->b == 0x0f) {
Borislav Petkov1ce19dc2013-09-22 16:44:51 +02004317 ctxt->opcode_len = 2;
Takuya Yoshikawae85a1082011-07-30 18:01:26 +09004318 ctxt->b = insn_fetch(u8, ctxt);
Avi Kivity9dac77f2011-06-01 15:34:25 +03004319 opcode = twobyte_table[ctxt->b];
Borislav Petkov0bc5eed2013-10-29 12:54:10 +01004320
4321 /* 0F_38 opcode map */
4322 if (ctxt->b == 0x38) {
4323 ctxt->opcode_len = 3;
4324 ctxt->b = insn_fetch(u8, ctxt);
4325 opcode = opcode_map_0f_38[ctxt->b];
4326 }
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004327 }
Avi Kivity9dac77f2011-06-01 15:34:25 +03004328 ctxt->d = opcode.flags;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004329
Takuya Yoshikawa9f4260e2012-04-30 17:48:25 +09004330 if (ctxt->d & ModRM)
4331 ctxt->modrm = insn_fetch(u8, ctxt);
4332
Nadav Amit7fe864d2014-06-02 18:34:03 +03004333 /* vex-prefix instructions are not implemented */
4334 if (ctxt->opcode_len == 1 && (ctxt->b == 0xc5 || ctxt->b == 0xc4) &&
4335 (mode == X86EMUL_MODE_PROT64 ||
4336 (mode >= X86EMUL_MODE_PROT16 && (ctxt->modrm & 0x80)))) {
4337 ctxt->d = NotImpl;
4338 }
4339
Avi Kivity9dac77f2011-06-01 15:34:25 +03004340 while (ctxt->d & GroupMask) {
4341 switch (ctxt->d & GroupMask) {
Avi Kivity46561642011-04-24 14:09:59 +03004342 case Group:
Avi Kivity9dac77f2011-06-01 15:34:25 +03004343 goffset = (ctxt->modrm >> 3) & 7;
Avi Kivity46561642011-04-24 14:09:59 +03004344 opcode = opcode.u.group[goffset];
4345 break;
4346 case GroupDual:
Avi Kivity9dac77f2011-06-01 15:34:25 +03004347 goffset = (ctxt->modrm >> 3) & 7;
4348 if ((ctxt->modrm >> 6) == 3)
Avi Kivity46561642011-04-24 14:09:59 +03004349 opcode = opcode.u.gdual->mod3[goffset];
4350 else
4351 opcode = opcode.u.gdual->mod012[goffset];
4352 break;
4353 case RMExt:
Avi Kivity9dac77f2011-06-01 15:34:25 +03004354 goffset = ctxt->modrm & 7;
Joerg Roedel01de8b02011-04-04 12:39:31 +02004355 opcode = opcode.u.group[goffset];
Avi Kivity46561642011-04-24 14:09:59 +03004356 break;
4357 case Prefix:
Avi Kivity9dac77f2011-06-01 15:34:25 +03004358 if (ctxt->rep_prefix && op_prefix)
Takuya Yoshikawa1d2887e2011-07-30 18:03:34 +09004359 return EMULATION_FAILED;
Avi Kivity9dac77f2011-06-01 15:34:25 +03004360 simd_prefix = op_prefix ? 0x66 : ctxt->rep_prefix;
Avi Kivity46561642011-04-24 14:09:59 +03004361 switch (simd_prefix) {
4362 case 0x00: opcode = opcode.u.gprefix->pfx_no; break;
4363 case 0x66: opcode = opcode.u.gprefix->pfx_66; break;
4364 case 0xf2: opcode = opcode.u.gprefix->pfx_f2; break;
4365 case 0xf3: opcode = opcode.u.gprefix->pfx_f3; break;
4366 }
4367 break;
Gleb Natapov045a2822012-12-20 16:57:43 +02004368 case Escape:
4369 if (ctxt->modrm > 0xbf)
4370 opcode = opcode.u.esc->high[ctxt->modrm - 0xc0];
4371 else
4372 opcode = opcode.u.esc->op[(ctxt->modrm >> 3) & 7];
4373 break;
Avi Kivity46561642011-04-24 14:09:59 +03004374 default:
Takuya Yoshikawa1d2887e2011-07-30 18:03:34 +09004375 return EMULATION_FAILED;
Avi Kivity0d7cdee2011-03-29 11:34:38 +02004376 }
Avi Kivity46561642011-04-24 14:09:59 +03004377
Avi Kivityb1ea50b2011-09-13 10:45:42 +03004378 ctxt->d &= ~(u64)GroupMask;
Avi Kivity9dac77f2011-06-01 15:34:25 +03004379 ctxt->d |= opcode.flags;
Avi Kivity0d7cdee2011-03-29 11:34:38 +02004380 }
4381
Paolo Bonzinie24186e2014-03-27 12:00:57 +01004382 /* Unrecognised? */
4383 if (ctxt->d == 0)
4384 return EMULATION_FAILED;
4385
Avi Kivity9dac77f2011-06-01 15:34:25 +03004386 ctxt->execute = opcode.u.execute;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004387
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004388 if (unlikely(ctxt->d &
4389 (NotImpl|EmulateOnUD|Stack|Op3264|Sse|Mmx|Intercept|CheckPerm))) {
4390 /*
4391 * These are copied unconditionally here, and checked unconditionally
4392 * in x86_emulate_insn.
4393 */
4394 ctxt->check_perm = opcode.check_perm;
4395 ctxt->intercept = opcode.intercept;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004396
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004397 if (ctxt->d & NotImpl)
4398 return EMULATION_FAILED;
Avi Kivityd8671622011-02-01 16:32:03 +02004399
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004400 if (!(ctxt->d & EmulateOnUD) && ctxt->ud)
4401 return EMULATION_FAILED;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004402
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004403 if (mode == X86EMUL_MODE_PROT64 && (ctxt->d & Stack))
Avi Kivity9dac77f2011-06-01 15:34:25 +03004404 ctxt->op_bytes = 8;
Avi Kivity7f9b4b72010-08-01 14:46:54 +03004405
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004406 if (ctxt->d & Op3264) {
4407 if (mode == X86EMUL_MODE_PROT64)
4408 ctxt->op_bytes = 8;
4409 else
4410 ctxt->op_bytes = 4;
4411 }
4412
4413 if (ctxt->d & Sse)
4414 ctxt->op_bytes = 16;
4415 else if (ctxt->d & Mmx)
4416 ctxt->op_bytes = 8;
4417 }
Avi Kivity12537912011-03-29 11:41:27 +02004418
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004419 /* ModRM and SIB bytes. */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004420 if (ctxt->d & ModRM) {
Avi Kivityf09ed832011-09-13 10:45:40 +03004421 rc = decode_modrm(ctxt, &ctxt->memop);
Bandan Das573e80f2014-04-16 12:46:13 -04004422 if (!has_seg_override) {
4423 has_seg_override = true;
4424 ctxt->seg_override = ctxt->modrm_seg;
4425 }
Avi Kivity9dac77f2011-06-01 15:34:25 +03004426 } else if (ctxt->d & MemAbs)
Avi Kivityf09ed832011-09-13 10:45:40 +03004427 rc = decode_abs(ctxt, &ctxt->memop);
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004428 if (rc != X86EMUL_CONTINUE)
4429 goto done;
4430
Bandan Das573e80f2014-04-16 12:46:13 -04004431 if (!has_seg_override)
4432 ctxt->seg_override = VCPU_SREG_DS;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004433
Bandan Das573e80f2014-04-16 12:46:13 -04004434 ctxt->memop.addr.mem.seg = ctxt->seg_override;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004435
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004436 /*
4437 * Decode and fetch the source operand: register, memory
4438 * or immediate.
4439 */
Avi Kivity0fe59122011-09-13 10:45:47 +03004440 rc = decode_operand(ctxt, &ctxt->src, (ctxt->d >> SrcShift) & OpMask);
Avi Kivity39f21ee2010-08-18 19:20:21 +03004441 if (rc != X86EMUL_CONTINUE)
4442 goto done;
4443
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004444 /*
4445 * Decode and fetch the second source operand: register, memory
4446 * or immediate.
4447 */
Avi Kivity4dd6a572011-09-13 10:45:43 +03004448 rc = decode_operand(ctxt, &ctxt->src2, (ctxt->d >> Src2Shift) & OpMask);
Avi Kivity39f21ee2010-08-18 19:20:21 +03004449 if (rc != X86EMUL_CONTINUE)
4450 goto done;
4451
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004452 /* Decode and fetch the destination operand: register or memory. */
Avi Kivitya9945542011-09-13 10:45:41 +03004453 rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask);
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004454
4455done:
Bandan Das41061cd2014-04-16 12:46:14 -04004456 if (ctxt->rip_relative)
Avi Kivityf09ed832011-09-13 10:45:40 +03004457 ctxt->memopp->addr.mem.ea += ctxt->_eip;
Avi Kivitycb16c342011-06-19 19:21:11 +03004458
Takuya Yoshikawa1d2887e2011-07-30 18:03:34 +09004459 return (rc != X86EMUL_CONTINUE) ? EMULATION_FAILED : EMULATION_OK;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03004460}
4461
Xiao Guangrong1cb3f3a2011-09-22 17:02:48 +08004462bool x86_page_table_writing_insn(struct x86_emulate_ctxt *ctxt)
4463{
4464 return ctxt->d & PageTable;
4465}
4466
Gleb Natapov3e2f65d2010-08-25 12:47:42 +03004467static bool string_insn_completed(struct x86_emulate_ctxt *ctxt)
4468{
Gleb Natapov3e2f65d2010-08-25 12:47:42 +03004469 /* The second termination condition only applies for REPE
4470 * and REPNE. Test if the repeat string operation prefix is
4471 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
4472 * corresponding termination condition according to:
4473 * - if REPE/REPZ and ZF = 0 then done
4474 * - if REPNE/REPNZ and ZF = 1 then done
4475 */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004476 if (((ctxt->b == 0xa6) || (ctxt->b == 0xa7) ||
4477 (ctxt->b == 0xae) || (ctxt->b == 0xaf))
4478 && (((ctxt->rep_prefix == REPE_PREFIX) &&
Gleb Natapov3e2f65d2010-08-25 12:47:42 +03004479 ((ctxt->eflags & EFLG_ZF) == 0))
Avi Kivity9dac77f2011-06-01 15:34:25 +03004480 || ((ctxt->rep_prefix == REPNE_PREFIX) &&
Gleb Natapov3e2f65d2010-08-25 12:47:42 +03004481 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF))))
4482 return true;
4483
4484 return false;
4485}
4486
Avi Kivitycbe2c9d2012-04-09 18:40:02 +03004487static int flush_pending_x87_faults(struct x86_emulate_ctxt *ctxt)
4488{
4489 bool fault = false;
4490
4491 ctxt->ops->get_fpu(ctxt);
4492 asm volatile("1: fwait \n\t"
4493 "2: \n\t"
4494 ".pushsection .fixup,\"ax\" \n\t"
4495 "3: \n\t"
4496 "movb $1, %[fault] \n\t"
4497 "jmp 2b \n\t"
4498 ".popsection \n\t"
4499 _ASM_EXTABLE(1b, 3b)
Avi Kivity38e8a2d2012-04-22 15:12:50 +03004500 : [fault]"+qm"(fault));
Avi Kivitycbe2c9d2012-04-09 18:40:02 +03004501 ctxt->ops->put_fpu(ctxt);
4502
4503 if (unlikely(fault))
4504 return emulate_exception(ctxt, MF_VECTOR, 0, false);
4505
4506 return X86EMUL_CONTINUE;
4507}
4508
4509static void fetch_possible_mmx_operand(struct x86_emulate_ctxt *ctxt,
4510 struct operand *op)
4511{
4512 if (op->type == OP_MM)
4513 read_mmx_reg(ctxt, &op->mm_val, op->addr.mm);
4514}
4515
Avi Kivitye28bbd42013-01-04 16:18:48 +02004516static int fastop(struct x86_emulate_ctxt *ctxt, void (*fop)(struct fastop *))
4517{
4518 ulong flags = (ctxt->eflags & EFLAGS_MASK) | X86_EFLAGS_IF;
Avi Kivityb9fa4092013-02-09 11:31:48 +02004519 if (!(ctxt->d & ByteOp))
4520 fop += __ffs(ctxt->dst.bytes) * FASTOP_SIZE;
Avi Kivitye28bbd42013-01-04 16:18:48 +02004521 asm("push %[flags]; popf; call *%[fastop]; pushf; pop %[flags]\n"
Avi Kivityb8c0b6a2013-02-09 11:31:49 +02004522 : "+a"(ctxt->dst.val), "+d"(ctxt->src.val), [flags]"+D"(flags),
4523 [fastop]"+S"(fop)
4524 : "c"(ctxt->src2.val));
Avi Kivitye28bbd42013-01-04 16:18:48 +02004525 ctxt->eflags = (ctxt->eflags & ~EFLAGS_MASK) | (flags & EFLAGS_MASK);
Avi Kivityb8c0b6a2013-02-09 11:31:49 +02004526 if (!fop) /* exception is returned in fop variable */
4527 return emulate_de(ctxt);
Avi Kivitye28bbd42013-01-04 16:18:48 +02004528 return X86EMUL_CONTINUE;
4529}
Avi Kivitydd856ef2012-08-27 23:46:17 +03004530
Bandan Das14985072014-04-16 12:46:09 -04004531void init_decode_cache(struct x86_emulate_ctxt *ctxt)
4532{
Bandan Das573e80f2014-04-16 12:46:13 -04004533 memset(&ctxt->rip_relative, 0,
4534 (void *)&ctxt->modrm - (void *)&ctxt->rip_relative);
Bandan Das14985072014-04-16 12:46:09 -04004535
Bandan Das14985072014-04-16 12:46:09 -04004536 ctxt->io_read.pos = 0;
4537 ctxt->io_read.end = 0;
Bandan Das14985072014-04-16 12:46:09 -04004538 ctxt->mem_read.end = 0;
4539}
4540
Takuya Yoshikawa7b105ca2011-05-15 01:00:52 +09004541int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
Laurent Vivier8b4caf62007-09-18 11:27:19 +02004542{
Mathias Krause0225fb52012-08-30 01:30:16 +02004543 const struct x86_emulate_ops *ops = ctxt->ops;
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09004544 int rc = X86EMUL_CONTINUE;
Avi Kivity9dac77f2011-06-01 15:34:25 +03004545 int saved_dst_type = ctxt->dst.type;
Laurent Vivier8b4caf62007-09-18 11:27:19 +02004546
Avi Kivity9dac77f2011-06-01 15:34:25 +03004547 ctxt->mem_read.pos = 0;
Glauber Costa310b5d32009-05-12 16:21:06 -04004548
Gleb Natapovd380a5e2010-02-10 14:21:36 +02004549 /* LOCK prefix is allowed only with some instructions */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004550 if (ctxt->lock_prefix && (!(ctxt->d & Lock) || ctxt->dst.type != OP_MEM)) {
Avi Kivity35d3d4a2010-11-22 17:53:25 +02004551 rc = emulate_ud(ctxt);
Gleb Natapovd380a5e2010-02-10 14:21:36 +02004552 goto done;
4553 }
4554
Avi Kivity9dac77f2011-06-01 15:34:25 +03004555 if ((ctxt->d & SrcMask) == SrcMemFAddr && ctxt->src.type != OP_MEM) {
Avi Kivity35d3d4a2010-11-22 17:53:25 +02004556 rc = emulate_ud(ctxt);
Avi Kivity081bca02010-08-26 11:06:15 +03004557 goto done;
4558 }
4559
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004560 if (unlikely(ctxt->d &
4561 (No64|Undefined|Sse|Mmx|Intercept|CheckPerm|Priv|Prot|String))) {
4562 if ((ctxt->mode == X86EMUL_MODE_PROT64 && (ctxt->d & No64)) ||
4563 (ctxt->d & Undefined)) {
4564 rc = emulate_ud(ctxt);
Avi Kivitycbe2c9d2012-04-09 18:40:02 +03004565 goto done;
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004566 }
Avi Kivitycbe2c9d2012-04-09 18:40:02 +03004567
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004568 if (((ctxt->d & (Sse|Mmx)) && ((ops->get_cr(ctxt, 0) & X86_CR0_EM)))
4569 || ((ctxt->d & Sse) && !(ops->get_cr(ctxt, 4) & X86_CR4_OSFXSR))) {
4570 rc = emulate_ud(ctxt);
Avi Kivityc4f035c2011-04-04 12:39:22 +02004571 goto done;
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004572 }
Avi Kivityc4f035c2011-04-04 12:39:22 +02004573
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004574 if ((ctxt->d & (Sse|Mmx)) && (ops->get_cr(ctxt, 0) & X86_CR0_TS)) {
4575 rc = emulate_nm(ctxt);
Joerg Roedeld09beab2011-04-04 12:39:25 +02004576 goto done;
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004577 }
Joerg Roedeld09beab2011-04-04 12:39:25 +02004578
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004579 if (ctxt->d & Mmx) {
4580 rc = flush_pending_x87_faults(ctxt);
4581 if (rc != X86EMUL_CONTINUE)
4582 goto done;
4583 /*
4584 * Now that we know the fpu is exception safe, we can fetch
4585 * operands from it.
4586 */
4587 fetch_possible_mmx_operand(ctxt, &ctxt->src);
4588 fetch_possible_mmx_operand(ctxt, &ctxt->src2);
4589 if (!(ctxt->d & Mov))
4590 fetch_possible_mmx_operand(ctxt, &ctxt->dst);
4591 }
Avi Kivityc4f035c2011-04-04 12:39:22 +02004592
Bandan Das685bbf42014-04-16 12:46:10 -04004593 if (unlikely(ctxt->guest_mode) && (ctxt->d & Intercept)) {
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004594 rc = emulator_check_intercept(ctxt, ctxt->intercept,
4595 X86_ICPT_PRE_EXCEPT);
4596 if (rc != X86EMUL_CONTINUE)
4597 goto done;
4598 }
4599
4600 /* Privileged instruction can be executed only in CPL=0 */
4601 if ((ctxt->d & Priv) && ops->cpl(ctxt)) {
4602 rc = emulate_gp(ctxt, 0);
Avi Kivityb9fa9d62007-11-27 19:05:37 +02004603 goto done;
4604 }
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004605
4606 /* Instruction can only be executed in protected mode */
4607 if ((ctxt->d & Prot) && ctxt->mode < X86EMUL_MODE_PROT16) {
4608 rc = emulate_ud(ctxt);
4609 goto done;
4610 }
4611
4612 /* Do instruction specific permission checks */
Bandan Das685bbf42014-04-16 12:46:10 -04004613 if (ctxt->d & CheckPerm) {
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004614 rc = ctxt->check_perm(ctxt);
4615 if (rc != X86EMUL_CONTINUE)
4616 goto done;
4617 }
4618
Bandan Das685bbf42014-04-16 12:46:10 -04004619 if (unlikely(ctxt->guest_mode) && (ctxt->d & Intercept)) {
Paolo Bonzinid40a6892014-03-27 11:58:02 +01004620 rc = emulator_check_intercept(ctxt, ctxt->intercept,
4621 X86_ICPT_POST_EXCEPT);
4622 if (rc != X86EMUL_CONTINUE)
4623 goto done;
4624 }
4625
4626 if (ctxt->rep_prefix && (ctxt->d & String)) {
4627 /* All REP prefixes have the same first termination condition */
4628 if (address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) == 0) {
4629 ctxt->eip = ctxt->_eip;
4630 goto done;
4631 }
4632 }
Avi Kivityb9fa9d62007-11-27 19:05:37 +02004633 }
4634
Avi Kivity9dac77f2011-06-01 15:34:25 +03004635 if ((ctxt->src.type == OP_MEM) && !(ctxt->d & NoAccess)) {
4636 rc = segmented_read(ctxt, ctxt->src.addr.mem,
4637 ctxt->src.valptr, ctxt->src.bytes);
Takuya Yoshikawab60d5132010-01-20 16:47:21 +09004638 if (rc != X86EMUL_CONTINUE)
Laurent Vivier8b4caf62007-09-18 11:27:19 +02004639 goto done;
Avi Kivity9dac77f2011-06-01 15:34:25 +03004640 ctxt->src.orig_val64 = ctxt->src.val64;
Laurent Vivier8b4caf62007-09-18 11:27:19 +02004641 }
4642
Avi Kivity9dac77f2011-06-01 15:34:25 +03004643 if (ctxt->src2.type == OP_MEM) {
4644 rc = segmented_read(ctxt, ctxt->src2.addr.mem,
4645 &ctxt->src2.val, ctxt->src2.bytes);
Gleb Natapove35b7b92010-02-25 16:36:42 +02004646 if (rc != X86EMUL_CONTINUE)
4647 goto done;
4648 }
4649
Avi Kivity9dac77f2011-06-01 15:34:25 +03004650 if ((ctxt->d & DstMask) == ImplicitOps)
Laurent Vivier8b4caf62007-09-18 11:27:19 +02004651 goto special_insn;
4652
4653
Avi Kivity9dac77f2011-06-01 15:34:25 +03004654 if ((ctxt->dst.type == OP_MEM) && !(ctxt->d & Mov)) {
Gleb Natapov69f55cb2010-03-18 15:20:20 +02004655 /* optimisation - avoid slow emulated read if Mov */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004656 rc = segmented_read(ctxt, ctxt->dst.addr.mem,
4657 &ctxt->dst.val, ctxt->dst.bytes);
Gleb Natapov69f55cb2010-03-18 15:20:20 +02004658 if (rc != X86EMUL_CONTINUE)
4659 goto done;
Avi Kivity038e51d2007-01-22 20:40:40 -08004660 }
Avi Kivity9dac77f2011-06-01 15:34:25 +03004661 ctxt->dst.orig_val = ctxt->dst.val;
Avi Kivity038e51d2007-01-22 20:40:40 -08004662
Avi Kivity018a98d2007-11-27 19:30:56 +02004663special_insn:
4664
Bandan Das685bbf42014-04-16 12:46:10 -04004665 if (unlikely(ctxt->guest_mode) && (ctxt->d & Intercept)) {
Avi Kivity9dac77f2011-06-01 15:34:25 +03004666 rc = emulator_check_intercept(ctxt, ctxt->intercept,
Joerg Roedel8a76d7f2011-04-04 12:39:27 +02004667 X86_ICPT_POST_MEMACCESS);
Avi Kivityc4f035c2011-04-04 12:39:22 +02004668 if (rc != X86EMUL_CONTINUE)
4669 goto done;
4670 }
4671
Avi Kivity9dac77f2011-06-01 15:34:25 +03004672 if (ctxt->execute) {
Avi Kivitye28bbd42013-01-04 16:18:48 +02004673 if (ctxt->d & Fastop) {
4674 void (*fop)(struct fastop *) = (void *)ctxt->execute;
4675 rc = fastop(ctxt, fop);
4676 if (rc != X86EMUL_CONTINUE)
4677 goto done;
4678 goto writeback;
4679 }
Avi Kivity9dac77f2011-06-01 15:34:25 +03004680 rc = ctxt->execute(ctxt);
Avi Kivityef65c882010-07-29 15:11:51 +03004681 if (rc != X86EMUL_CONTINUE)
4682 goto done;
4683 goto writeback;
4684 }
4685
Borislav Petkov1ce19dc2013-09-22 16:44:51 +02004686 if (ctxt->opcode_len == 2)
Avi Kivity6aa8b732006-12-10 02:21:36 -08004687 goto twobyte_insn;
Borislav Petkov0bc5eed2013-10-29 12:54:10 +01004688 else if (ctxt->opcode_len == 3)
4689 goto threebyte_insn;
Avi Kivity6aa8b732006-12-10 02:21:36 -08004690
Avi Kivity9dac77f2011-06-01 15:34:25 +03004691 switch (ctxt->b) {
Avi Kivity6aa8b732006-12-10 02:21:36 -08004692 case 0x63: /* movsxd */
Laurent Vivier8b4caf62007-09-18 11:27:19 +02004693 if (ctxt->mode != X86EMUL_MODE_PROT64)
Avi Kivity6aa8b732006-12-10 02:21:36 -08004694 goto cannot_emulate;
Avi Kivity9dac77f2011-06-01 15:34:25 +03004695 ctxt->dst.val = (s32) ctxt->src.val;
Avi Kivity6aa8b732006-12-10 02:21:36 -08004696 break;
Gleb Natapovb2833e32009-04-12 13:36:30 +03004697 case 0x70 ... 0x7f: /* jcc (short) */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004698 if (test_cc(ctxt->b, ctxt->eflags))
4699 jmp_rel(ctxt, ctxt->src.val);
Avi Kivity018a98d2007-11-27 19:30:56 +02004700 break;
Nitin A Kamble7e0b54b2007-09-15 10:35:36 +03004701 case 0x8d: /* lea r16/r32, m */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004702 ctxt->dst.val = ctxt->src.addr.mem.ea;
Nitin A Kamble7e0b54b2007-09-15 10:35:36 +03004703 break;
Avi Kivity3d9e77d2010-08-01 12:41:59 +03004704 case 0x90 ... 0x97: /* nop / xchg reg, rax */
Avi Kivitydd856ef2012-08-27 23:46:17 +03004705 if (ctxt->dst.addr.reg == reg_rmw(ctxt, VCPU_REGS_RAX))
Nadav Amita825f5c2014-06-15 16:13:01 +03004706 ctxt->dst.type = OP_NONE;
4707 else
4708 rc = em_xchg(ctxt);
Takuya Yoshikawae4f973a2011-05-29 21:59:09 +09004709 break;
Wei Yongjune8b6fa72010-08-18 16:43:13 +08004710 case 0x98: /* cbw/cwde/cdqe */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004711 switch (ctxt->op_bytes) {
4712 case 2: ctxt->dst.val = (s8)ctxt->dst.val; break;
4713 case 4: ctxt->dst.val = (s16)ctxt->dst.val; break;
4714 case 8: ctxt->dst.val = (s32)ctxt->dst.val; break;
Wei Yongjune8b6fa72010-08-18 16:43:13 +08004715 }
4716 break;
Mohammed Gamal6e154e52010-08-04 14:38:06 +03004717 case 0xcc: /* int3 */
Takuya Yoshikawa5c5df762011-05-29 22:02:55 +09004718 rc = emulate_int(ctxt, 3);
4719 break;
Mohammed Gamal6e154e52010-08-04 14:38:06 +03004720 case 0xcd: /* int n */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004721 rc = emulate_int(ctxt, ctxt->src.val);
Mohammed Gamal6e154e52010-08-04 14:38:06 +03004722 break;
4723 case 0xce: /* into */
Takuya Yoshikawa5c5df762011-05-29 22:02:55 +09004724 if (ctxt->eflags & EFLG_OF)
4725 rc = emulate_int(ctxt, 4);
Mohammed Gamal6e154e52010-08-04 14:38:06 +03004726 break;
Nitin A Kamble1a52e052007-09-18 16:34:25 -07004727 case 0xe9: /* jmp rel */
Takuya Yoshikawadb5b0762011-05-29 21:56:26 +09004728 case 0xeb: /* jmp rel short */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004729 jmp_rel(ctxt, ctxt->src.val);
4730 ctxt->dst.type = OP_NONE; /* Disable writeback. */
Nitin A Kamble1a52e052007-09-18 16:34:25 -07004731 break;
Avi Kivity111de5d2007-11-27 19:14:21 +02004732 case 0xf4: /* hlt */
Avi Kivity6c3287f2011-04-20 15:43:05 +03004733 ctxt->ops->halt(ctxt);
Mohammed Gamal19fdfa02008-07-06 16:51:26 +03004734 break;
Avi Kivity111de5d2007-11-27 19:14:21 +02004735 case 0xf5: /* cmc */
4736 /* complement carry flag from eflags reg */
4737 ctxt->eflags ^= EFLG_CF;
Avi Kivity111de5d2007-11-27 19:14:21 +02004738 break;
4739 case 0xf8: /* clc */
4740 ctxt->eflags &= ~EFLG_CF;
Avi Kivity111de5d2007-11-27 19:14:21 +02004741 break;
Mohammed Gamal8744aa92010-08-05 15:42:49 +03004742 case 0xf9: /* stc */
4743 ctxt->eflags |= EFLG_CF;
4744 break;
Mohammed Gamalfb4616f2008-09-01 04:52:24 +03004745 case 0xfc: /* cld */
4746 ctxt->eflags &= ~EFLG_DF;
Mohammed Gamalfb4616f2008-09-01 04:52:24 +03004747 break;
4748 case 0xfd: /* std */
4749 ctxt->eflags |= EFLG_DF;
Mohammed Gamalfb4616f2008-09-01 04:52:24 +03004750 break;
Avi Kivity91269b82010-07-25 14:51:16 +03004751 default:
4752 goto cannot_emulate;
Avi Kivity6aa8b732006-12-10 02:21:36 -08004753 }
Avi Kivity018a98d2007-11-27 19:30:56 +02004754
Avi Kivity7d9ddae2010-08-30 17:12:28 +03004755 if (rc != X86EMUL_CONTINUE)
4756 goto done;
4757
Avi Kivity018a98d2007-11-27 19:30:56 +02004758writeback:
Avi Kivityfb32b1e2013-02-09 11:31:44 +02004759 if (ctxt->d & SrcWrite) {
4760 BUG_ON(ctxt->src.type == OP_MEM || ctxt->src.type == OP_MEM_STR);
4761 rc = writeback(ctxt, &ctxt->src);
4762 if (rc != X86EMUL_CONTINUE)
4763 goto done;
4764 }
Nadav Amitee212292014-06-15 16:12:58 +03004765 if (!(ctxt->d & NoWrite)) {
4766 rc = writeback(ctxt, &ctxt->dst);
4767 if (rc != X86EMUL_CONTINUE)
4768 goto done;
4769 }
Avi Kivity018a98d2007-11-27 19:30:56 +02004770
Gleb Natapov5cd21912010-03-18 15:20:26 +02004771 /*
4772 * restore dst type in case the decoding will be reused
4773 * (happens for string instruction )
4774 */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004775 ctxt->dst.type = saved_dst_type;
Gleb Natapov5cd21912010-03-18 15:20:26 +02004776
Avi Kivity9dac77f2011-06-01 15:34:25 +03004777 if ((ctxt->d & SrcMask) == SrcSI)
Gleb Natapovf3bd64c2012-09-03 15:24:28 +03004778 string_addr_inc(ctxt, VCPU_REGS_RSI, &ctxt->src);
Gleb Natapova682e352010-03-18 15:20:21 +02004779
Avi Kivity9dac77f2011-06-01 15:34:25 +03004780 if ((ctxt->d & DstMask) == DstDI)
Gleb Natapovf3bd64c2012-09-03 15:24:28 +03004781 string_addr_inc(ctxt, VCPU_REGS_RDI, &ctxt->dst);
Gleb Natapovd9271122010-03-18 15:20:22 +02004782
Avi Kivity9dac77f2011-06-01 15:34:25 +03004783 if (ctxt->rep_prefix && (ctxt->d & String)) {
Gleb Natapovb3356bf2012-09-03 15:24:29 +03004784 unsigned int count;
Avi Kivity9dac77f2011-06-01 15:34:25 +03004785 struct read_cache *r = &ctxt->io_read;
Gleb Natapovb3356bf2012-09-03 15:24:29 +03004786 if ((ctxt->d & SrcMask) == SrcSI)
4787 count = ctxt->src.count;
4788 else
4789 count = ctxt->dst.count;
4790 register_address_increment(ctxt, reg_rmw(ctxt, VCPU_REGS_RCX),
4791 -count);
Gleb Natapov3e2f65d2010-08-25 12:47:42 +03004792
Gleb Natapovd2ddd1c2010-08-25 12:47:43 +03004793 if (!string_insn_completed(ctxt)) {
4794 /*
4795 * Re-enter guest when pio read ahead buffer is empty
4796 * or, if it is not used, after each 1024 iteration.
4797 */
Avi Kivitydd856ef2012-08-27 23:46:17 +03004798 if ((r->end != 0 || reg_read(ctxt, VCPU_REGS_RCX) & 0x3ff) &&
Gleb Natapovd2ddd1c2010-08-25 12:47:43 +03004799 (r->end == 0 || r->end != r->pos)) {
4800 /*
4801 * Reset read cache. Usually happens before
4802 * decode, but since instruction is restarted
4803 * we have to do it here.
4804 */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004805 ctxt->mem_read.end = 0;
Avi Kivitydd856ef2012-08-27 23:46:17 +03004806 writeback_registers(ctxt);
Gleb Natapovd2ddd1c2010-08-25 12:47:43 +03004807 return EMULATION_RESTART;
4808 }
4809 goto done; /* skip rip writeback */
Avi Kivity0fa6ccb2010-08-17 11:22:17 +03004810 }
Gleb Natapov5cd21912010-03-18 15:20:26 +02004811 }
Gleb Natapovd2ddd1c2010-08-25 12:47:43 +03004812
Avi Kivity9dac77f2011-06-01 15:34:25 +03004813 ctxt->eip = ctxt->_eip;
Avi Kivity018a98d2007-11-27 19:30:56 +02004814
4815done:
Avi Kivityda9cb572010-11-22 17:53:21 +02004816 if (rc == X86EMUL_PROPAGATE_FAULT)
4817 ctxt->have_exception = true;
Joerg Roedel775fde82011-04-04 12:39:24 +02004818 if (rc == X86EMUL_INTERCEPTED)
4819 return EMULATION_INTERCEPTED;
4820
Avi Kivitydd856ef2012-08-27 23:46:17 +03004821 if (rc == X86EMUL_CONTINUE)
4822 writeback_registers(ctxt);
4823
Gleb Natapovd2ddd1c2010-08-25 12:47:43 +03004824 return (rc == X86EMUL_UNHANDLEABLE) ? EMULATION_FAILED : EMULATION_OK;
Avi Kivity6aa8b732006-12-10 02:21:36 -08004825
4826twobyte_insn:
Avi Kivity9dac77f2011-06-01 15:34:25 +03004827 switch (ctxt->b) {
Avi Kivity018a98d2007-11-27 19:30:56 +02004828 case 0x09: /* wbinvd */
Clemens Nosscfb22372011-04-21 21:16:05 +02004829 (ctxt->ops->wbinvd)(ctxt);
Sheng Yangf5f48ee2010-06-30 12:25:15 +08004830 break;
4831 case 0x08: /* invd */
Avi Kivity018a98d2007-11-27 19:30:56 +02004832 case 0x0d: /* GrpP (prefetch) */
4833 case 0x18: /* Grp16 (prefetch/nop) */
Paolo Bonzini103f98e2013-05-30 13:22:39 +02004834 case 0x1f: /* nop */
Avi Kivity018a98d2007-11-27 19:30:56 +02004835 break;
4836 case 0x20: /* mov cr, reg */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004837 ctxt->dst.val = ops->get_cr(ctxt, ctxt->modrm_reg);
Avi Kivity018a98d2007-11-27 19:30:56 +02004838 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08004839 case 0x21: /* mov from dr to reg */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004840 ops->get_dr(ctxt, ctxt->modrm_reg, &ctxt->dst.val);
Avi Kivity6aa8b732006-12-10 02:21:36 -08004841 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08004842 case 0x40 ... 0x4f: /* cmov */
Nadav Amit140bad82014-06-15 16:13:00 +03004843 if (test_cc(ctxt->b, ctxt->eflags))
4844 ctxt->dst.val = ctxt->src.val;
4845 else if (ctxt->mode != X86EMUL_MODE_PROT64 ||
4846 ctxt->op_bytes != 4)
Avi Kivity9dac77f2011-06-01 15:34:25 +03004847 ctxt->dst.type = OP_NONE; /* no writeback */
Avi Kivity6aa8b732006-12-10 02:21:36 -08004848 break;
Gleb Natapovb2833e32009-04-12 13:36:30 +03004849 case 0x80 ... 0x8f: /* jnz rel, etc*/
Avi Kivity9dac77f2011-06-01 15:34:25 +03004850 if (test_cc(ctxt->b, ctxt->eflags))
4851 jmp_rel(ctxt, ctxt->src.val);
Avi Kivity018a98d2007-11-27 19:30:56 +02004852 break;
Wei Yongjunee45b582010-08-06 17:10:07 +08004853 case 0x90 ... 0x9f: /* setcc r/m8 */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004854 ctxt->dst.val = test_cc(ctxt->b, ctxt->eflags);
Wei Yongjunee45b582010-08-06 17:10:07 +08004855 break;
Glauber Costa2a7c5b82008-07-10 17:08:15 -03004856 case 0xae: /* clflush */
4857 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08004858 case 0xb6 ... 0xb7: /* movzx */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004859 ctxt->dst.bytes = ctxt->op_bytes;
Avi Kivity361cad22012-06-11 19:40:15 +03004860 ctxt->dst.val = (ctxt->src.bytes == 1) ? (u8) ctxt->src.val
Avi Kivity9dac77f2011-06-01 15:34:25 +03004861 : (u16) ctxt->src.val;
Avi Kivity6aa8b732006-12-10 02:21:36 -08004862 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08004863 case 0xbe ... 0xbf: /* movsx */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004864 ctxt->dst.bytes = ctxt->op_bytes;
Avi Kivity361cad22012-06-11 19:40:15 +03004865 ctxt->dst.val = (ctxt->src.bytes == 1) ? (s8) ctxt->src.val :
Avi Kivity9dac77f2011-06-01 15:34:25 +03004866 (s16) ctxt->src.val;
Avi Kivity6aa8b732006-12-10 02:21:36 -08004867 break;
Sheng Yanga012e652007-10-15 14:24:20 +08004868 case 0xc3: /* movnti */
Avi Kivity9dac77f2011-06-01 15:34:25 +03004869 ctxt->dst.bytes = ctxt->op_bytes;
Nadav Amit3b320042014-06-02 18:34:08 +03004870 ctxt->dst.val = (ctxt->op_bytes == 8) ? (u64) ctxt->src.val :
4871 (u32) ctxt->src.val;
Sheng Yanga012e652007-10-15 14:24:20 +08004872 break;
Avi Kivity91269b82010-07-25 14:51:16 +03004873 default:
4874 goto cannot_emulate;
Avi Kivity6aa8b732006-12-10 02:21:36 -08004875 }
Avi Kivity7d9ddae2010-08-30 17:12:28 +03004876
Borislav Petkov0bc5eed2013-10-29 12:54:10 +01004877threebyte_insn:
4878
Avi Kivity7d9ddae2010-08-30 17:12:28 +03004879 if (rc != X86EMUL_CONTINUE)
4880 goto done;
4881
Avi Kivity6aa8b732006-12-10 02:21:36 -08004882 goto writeback;
4883
4884cannot_emulate:
Gleb Natapova0c0ab22011-03-28 16:57:49 +02004885 return EMULATION_FAILED;
Avi Kivity6aa8b732006-12-10 02:21:36 -08004886}
Avi Kivitydd856ef2012-08-27 23:46:17 +03004887
4888void emulator_invalidate_register_cache(struct x86_emulate_ctxt *ctxt)
4889{
4890 invalidate_registers(ctxt);
4891}
4892
4893void emulator_writeback_register_cache(struct x86_emulate_ctxt *ctxt)
4894{
4895 writeback_registers(ctxt);
4896}