blob: d6088b8686fbd0423b8f771d449d4719f697f3fe [file] [log] [blame]
Avi Kivity6aa8b732006-12-10 02:21:36 -08001/******************************************************************************
Avi Kivity56e82312009-08-12 15:04:37 +03002 * emulate.c
Avi Kivity6aa8b732006-12-10 02:21:36 -08003 *
4 * Generic x86 (32-bit and 64-bit) instruction decoder and emulator.
5 *
6 * Copyright (c) 2005 Keir Fraser
7 *
8 * Linux coding style, mod r/m decoder, segment base fixes, real-mode
Rusty Russelldcc07662007-07-17 23:16:56 +10009 * privileged instructions:
Avi Kivity6aa8b732006-12-10 02:21:36 -080010 *
11 * Copyright (C) 2006 Qumranet
Nicolas Kaiser9611c182010-10-06 14:23:22 +020012 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
Avi Kivity6aa8b732006-12-10 02:21:36 -080013 *
14 * Avi Kivity <avi@qumranet.com>
15 * Yaniv Kamay <yaniv@qumranet.com>
16 *
17 * This work is licensed under the terms of the GNU GPL, version 2. See
18 * the COPYING file in the top-level directory.
19 *
20 * From: xen-unstable 10676:af9809f51f81a3c43f276f00c81a52ef558afda4
21 */
22
Avi Kivityedf88412007-12-16 11:02:48 +020023#include <linux/kvm_host.h>
Marcelo Tosatti5fdbf972008-06-27 14:58:02 -030024#include "kvm_cache_regs.h"
Avi Kivity6aa8b732006-12-10 02:21:36 -080025#include <linux/module.h>
Avi Kivity56e82312009-08-12 15:04:37 +030026#include <asm/kvm_emulate.h>
Avi Kivity6aa8b732006-12-10 02:21:36 -080027
Avi Kivity3eeb3282010-01-21 15:31:48 +020028#include "x86.h"
Gleb Natapov38ba30b2010-03-18 15:20:17 +020029#include "tss.h"
Andre Przywarae99f0502009-06-17 15:50:33 +020030
Avi Kivity6aa8b732006-12-10 02:21:36 -080031/*
32 * Opcode effective-address decode tables.
33 * Note that we only emulate instructions that have at least one memory
34 * operand (excluding implicit stack references). We assume that stack
35 * references and instruction fetches will never occur in special memory
36 * areas that require emulation. So, for example, 'mov <imm>,<reg>' need
37 * not be handled.
38 */
39
40/* Operand sizes: 8-bit operands or specified/overridden size. */
Avi Kivityab85b12b2010-07-29 15:11:49 +030041#define ByteOp (1<<0) /* 8-bit operands. */
Avi Kivity6aa8b732006-12-10 02:21:36 -080042/* Destination operand type. */
Avi Kivityab85b12b2010-07-29 15:11:49 +030043#define ImplicitOps (1<<1) /* Implicit in opcode. No generic decode. */
44#define DstReg (2<<1) /* Register operand. */
45#define DstMem (3<<1) /* Memory operand. */
46#define DstAcc (4<<1) /* Destination Accumulator */
47#define DstDI (5<<1) /* Destination is in ES:(E)DI */
48#define DstMem64 (6<<1) /* 64bit memory operand */
Wei Yongjun943858e2010-08-06 11:36:51 +080049#define DstImmUByte (7<<1) /* 8-bit unsigned immediate operand */
Avi Kivityab85b12b2010-07-29 15:11:49 +030050#define DstMask (7<<1)
Avi Kivity6aa8b732006-12-10 02:21:36 -080051/* Source operand type. */
Guillaume Thouvenin9c9fddd2008-09-12 13:50:25 +020052#define SrcNone (0<<4) /* No source operand. */
Guillaume Thouvenin9c9fddd2008-09-12 13:50:25 +020053#define SrcReg (1<<4) /* Register operand. */
54#define SrcMem (2<<4) /* Memory operand. */
55#define SrcMem16 (3<<4) /* Memory operand (16-bit). */
56#define SrcMem32 (4<<4) /* Memory operand (32-bit). */
57#define SrcImm (5<<4) /* Immediate operand. */
58#define SrcImmByte (6<<4) /* 8-bit sign-extended immediate operand. */
Guillaume Thouveninbfcadf82008-12-04 14:27:38 +010059#define SrcOne (7<<4) /* Implied '1' */
Gleb Natapov341de7e2009-04-12 13:36:41 +030060#define SrcImmUByte (8<<4) /* 8-bit unsigned immediate operand. */
Avi Kivityc9eaf20f2009-05-18 16:13:45 +030061#define SrcImmU (9<<4) /* Immediate operand, unsigned */
Gleb Natapova682e352010-03-18 15:20:21 +020062#define SrcSI (0xa<<4) /* Source is in the DS:RSI */
Gleb Natapov414e6272010-04-28 19:15:26 +030063#define SrcImmFAddr (0xb<<4) /* Source is immediate far address */
64#define SrcMemFAddr (0xc<<4) /* Source is far address in memory */
Wei Yongjun5d55f292010-07-07 17:43:35 +080065#define SrcAcc (0xd<<4) /* Source Accumulator */
Avi Kivityb250e602010-08-18 15:11:24 +030066#define SrcImmU16 (0xe<<4) /* Immediate operand, unsigned, 16 bits */
Gleb Natapov341de7e2009-04-12 13:36:41 +030067#define SrcMask (0xf<<4)
Avi Kivity6aa8b732006-12-10 02:21:36 -080068/* Generic ModRM decode. */
Gleb Natapov341de7e2009-04-12 13:36:41 +030069#define ModRM (1<<8)
Avi Kivity6aa8b732006-12-10 02:21:36 -080070/* Destination is only written; never read. */
Gleb Natapov341de7e2009-04-12 13:36:41 +030071#define Mov (1<<9)
72#define BitOp (1<<10)
73#define MemAbs (1<<11) /* Memory operand is absolute displacement */
Guillaume Thouvenin9c9fddd2008-09-12 13:50:25 +020074#define String (1<<12) /* String instruction (rep capable) */
75#define Stack (1<<13) /* Stack instruction (push/pop) */
Avi Kivitye09d0822008-01-18 12:38:59 +020076#define Group (1<<14) /* Bits 3:5 of modrm byte extend opcode */
77#define GroupDual (1<<15) /* Alternate decoding of mod == 3 */
Mohammed Gamald8769fe2009-08-23 14:24:25 +030078/* Misc flags */
Avi Kivityd8671622011-02-01 16:32:03 +020079#define VendorSpecific (1<<22) /* Vendor specific instruction */
Avi Kivity5a506b12010-08-01 15:10:29 +030080#define NoAccess (1<<23) /* Don't access memory (lea/invlpg/verr etc) */
Avi Kivity7f9b4b72010-08-01 14:46:54 +030081#define Op3264 (1<<24) /* Operand is 64b in long mode, 32b otherwise */
Avi Kivity047a4812010-07-26 14:37:47 +030082#define Undefined (1<<25) /* No Such Instruction */
Gleb Natapovd380a5e2010-02-10 14:21:36 +020083#define Lock (1<<26) /* lock prefix is allowed for the instruction */
Gleb Natapove92805a2010-02-10 14:21:35 +020084#define Priv (1<<27) /* instruction generates #GP if current CPL != 0 */
Mohammed Gamald8769fe2009-08-23 14:24:25 +030085#define No64 (1<<28)
Guillaume Thouvenin0dc8d102008-12-04 14:26:42 +010086/* Source 2 operand type */
87#define Src2None (0<<29)
88#define Src2CL (1<<29)
89#define Src2ImmByte (2<<29)
90#define Src2One (3<<29)
Avi Kivity7db41eb2010-08-18 19:25:28 +030091#define Src2Imm (4<<29)
Guillaume Thouvenin0dc8d102008-12-04 14:26:42 +010092#define Src2Mask (7<<29)
Avi Kivity6aa8b732006-12-10 02:21:36 -080093
Avi Kivityd0e53322010-07-29 15:11:54 +030094#define X2(x...) x, x
95#define X3(x...) X2(x), x
96#define X4(x...) X2(x), X2(x)
97#define X5(x...) X4(x), x
98#define X6(x...) X4(x), X2(x)
99#define X7(x...) X4(x), X3(x)
100#define X8(x...) X4(x), X4(x)
101#define X16(x...) X8(x), X8(x)
Avi Kivity83babbc2010-07-26 14:37:39 +0300102
Avi Kivityd65b1de2010-07-29 15:11:35 +0300103struct opcode {
104 u32 flags;
Avi Kivity120df892010-07-29 15:11:39 +0300105 union {
Avi Kivityef65c882010-07-29 15:11:51 +0300106 int (*execute)(struct x86_emulate_ctxt *ctxt);
Avi Kivity120df892010-07-29 15:11:39 +0300107 struct opcode *group;
108 struct group_dual *gdual;
109 } u;
110};
111
112struct group_dual {
113 struct opcode mod012[8];
114 struct opcode mod3[8];
Avi Kivityd65b1de2010-07-29 15:11:35 +0300115};
116
Avi Kivity6aa8b732006-12-10 02:21:36 -0800117/* EFLAGS bit definitions. */
Gleb Natapovd4c6a152010-02-10 14:21:34 +0200118#define EFLG_ID (1<<21)
119#define EFLG_VIP (1<<20)
120#define EFLG_VIF (1<<19)
121#define EFLG_AC (1<<18)
Andre Przywarab1d86142009-06-17 15:50:32 +0200122#define EFLG_VM (1<<17)
123#define EFLG_RF (1<<16)
Gleb Natapovd4c6a152010-02-10 14:21:34 +0200124#define EFLG_IOPL (3<<12)
125#define EFLG_NT (1<<14)
Avi Kivity6aa8b732006-12-10 02:21:36 -0800126#define EFLG_OF (1<<11)
127#define EFLG_DF (1<<10)
Andre Przywarab1d86142009-06-17 15:50:32 +0200128#define EFLG_IF (1<<9)
Gleb Natapovd4c6a152010-02-10 14:21:34 +0200129#define EFLG_TF (1<<8)
Avi Kivity6aa8b732006-12-10 02:21:36 -0800130#define EFLG_SF (1<<7)
131#define EFLG_ZF (1<<6)
132#define EFLG_AF (1<<4)
133#define EFLG_PF (1<<2)
134#define EFLG_CF (1<<0)
135
Mohammed Gamal62bd4302010-07-28 12:38:40 +0300136#define EFLG_RESERVED_ZEROS_MASK 0xffc0802a
137#define EFLG_RESERVED_ONE_MASK 2
138
Avi Kivity6aa8b732006-12-10 02:21:36 -0800139/*
140 * Instruction emulation:
141 * Most instructions are emulated directly via a fragment of inline assembly
142 * code. This allows us to save/restore EFLAGS and thus very easily pick up
143 * any modified flags.
144 */
145
Avi Kivity05b3e0c2006-12-13 00:33:45 -0800146#if defined(CONFIG_X86_64)
Avi Kivity6aa8b732006-12-10 02:21:36 -0800147#define _LO32 "k" /* force 32-bit operand */
148#define _STK "%%rsp" /* stack pointer */
149#elif defined(__i386__)
150#define _LO32 "" /* force 32-bit operand */
151#define _STK "%%esp" /* stack pointer */
152#endif
153
154/*
155 * These EFLAGS bits are restored from saved value during emulation, and
156 * any changes are written back to the saved value after emulation.
157 */
158#define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
159
160/* Before executing instruction: restore necessary bits in EFLAGS. */
Avi Kivitye934c9c2007-12-06 16:15:02 +0200161#define _PRE_EFLAGS(_sav, _msk, _tmp) \
162 /* EFLAGS = (_sav & _msk) | (EFLAGS & ~_msk); _sav &= ~_msk; */ \
163 "movl %"_sav",%"_LO32 _tmp"; " \
164 "push %"_tmp"; " \
165 "push %"_tmp"; " \
166 "movl %"_msk",%"_LO32 _tmp"; " \
167 "andl %"_LO32 _tmp",("_STK"); " \
168 "pushf; " \
169 "notl %"_LO32 _tmp"; " \
170 "andl %"_LO32 _tmp",("_STK"); " \
171 "andl %"_LO32 _tmp","__stringify(BITS_PER_LONG/4)"("_STK"); " \
172 "pop %"_tmp"; " \
173 "orl %"_LO32 _tmp",("_STK"); " \
174 "popf; " \
175 "pop %"_sav"; "
Avi Kivity6aa8b732006-12-10 02:21:36 -0800176
177/* After executing instruction: write-back necessary bits in EFLAGS. */
178#define _POST_EFLAGS(_sav, _msk, _tmp) \
179 /* _sav |= EFLAGS & _msk; */ \
180 "pushf; " \
181 "pop %"_tmp"; " \
182 "andl %"_msk",%"_LO32 _tmp"; " \
183 "orl %"_LO32 _tmp",%"_sav"; "
184
Avi Kivitydda96d82008-11-26 15:14:10 +0200185#ifdef CONFIG_X86_64
186#define ON64(x) x
187#else
188#define ON64(x)
189#endif
190
Avi Kivityb3b3d252010-08-16 17:49:52 +0300191#define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \
Avi Kivity6b7ad612008-11-26 15:30:45 +0200192 do { \
193 __asm__ __volatile__ ( \
194 _PRE_EFLAGS("0", "4", "2") \
195 _op _suffix " %"_x"3,%1; " \
196 _POST_EFLAGS("0", "4", "2") \
Avi Kivityfb2c2642010-08-16 17:50:56 +0300197 : "=m" (_eflags), "+q" (*(_dsttype*)&(_dst).val),\
Avi Kivity6b7ad612008-11-26 15:30:45 +0200198 "=&r" (_tmp) \
199 : _y ((_src).val), "i" (EFLAGS_MASK)); \
Avi Kivityf3fd92f2008-11-29 20:38:12 +0200200 } while (0)
Avi Kivity6b7ad612008-11-26 15:30:45 +0200201
202
Avi Kivity6aa8b732006-12-10 02:21:36 -0800203/* Raw emulation: instruction has two explicit operands. */
204#define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
Avi Kivity6b7ad612008-11-26 15:30:45 +0200205 do { \
206 unsigned long _tmp; \
207 \
208 switch ((_dst).bytes) { \
209 case 2: \
Avi Kivityb3b3d252010-08-16 17:49:52 +0300210 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\
Avi Kivity6b7ad612008-11-26 15:30:45 +0200211 break; \
212 case 4: \
Avi Kivityb3b3d252010-08-16 17:49:52 +0300213 ____emulate_2op(_op,_src,_dst,_eflags,_lx,_ly,"l",u32);\
Avi Kivity6b7ad612008-11-26 15:30:45 +0200214 break; \
215 case 8: \
Avi Kivityb3b3d252010-08-16 17:49:52 +0300216 ON64(____emulate_2op(_op,_src,_dst,_eflags,_qx,_qy,"q",u64)); \
Avi Kivity6b7ad612008-11-26 15:30:45 +0200217 break; \
218 } \
Avi Kivity6aa8b732006-12-10 02:21:36 -0800219 } while (0)
220
221#define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
222 do { \
Avi Kivity6b7ad612008-11-26 15:30:45 +0200223 unsigned long _tmp; \
Mike Dayd77c26f2007-10-08 09:02:08 -0400224 switch ((_dst).bytes) { \
Avi Kivity6aa8b732006-12-10 02:21:36 -0800225 case 1: \
Avi Kivityb3b3d252010-08-16 17:49:52 +0300226 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
Avi Kivity6aa8b732006-12-10 02:21:36 -0800227 break; \
228 default: \
229 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
230 _wx, _wy, _lx, _ly, _qx, _qy); \
231 break; \
232 } \
233 } while (0)
234
235/* Source operand is byte-sized and may be restricted to just %cl. */
236#define emulate_2op_SrcB(_op, _src, _dst, _eflags) \
237 __emulate_2op(_op, _src, _dst, _eflags, \
238 "b", "c", "b", "c", "b", "c", "b", "c")
239
240/* Source operand is byte, word, long or quad sized. */
241#define emulate_2op_SrcV(_op, _src, _dst, _eflags) \
242 __emulate_2op(_op, _src, _dst, _eflags, \
243 "b", "q", "w", "r", _LO32, "r", "", "r")
244
245/* Source operand is word, long or quad sized. */
246#define emulate_2op_SrcV_nobyte(_op, _src, _dst, _eflags) \
247 __emulate_2op_nobyte(_op, _src, _dst, _eflags, \
248 "w", "r", _LO32, "r", "", "r")
249
Guillaume Thouvenind1752262008-12-04 14:29:00 +0100250/* Instruction has three operands and one operand is stored in ECX register */
251#define __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, _suffix, _type) \
252 do { \
253 unsigned long _tmp; \
254 _type _clv = (_cl).val; \
255 _type _srcv = (_src).val; \
256 _type _dstv = (_dst).val; \
257 \
258 __asm__ __volatile__ ( \
259 _PRE_EFLAGS("0", "5", "2") \
260 _op _suffix " %4,%1 \n" \
261 _POST_EFLAGS("0", "5", "2") \
262 : "=m" (_eflags), "+r" (_dstv), "=&r" (_tmp) \
263 : "c" (_clv) , "r" (_srcv), "i" (EFLAGS_MASK) \
264 ); \
265 \
266 (_cl).val = (unsigned long) _clv; \
267 (_src).val = (unsigned long) _srcv; \
268 (_dst).val = (unsigned long) _dstv; \
269 } while (0)
270
271#define emulate_2op_cl(_op, _cl, _src, _dst, _eflags) \
272 do { \
273 switch ((_dst).bytes) { \
274 case 2: \
275 __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
276 "w", unsigned short); \
277 break; \
278 case 4: \
279 __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
280 "l", unsigned int); \
281 break; \
282 case 8: \
283 ON64(__emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
284 "q", unsigned long)); \
285 break; \
286 } \
287 } while (0)
288
Avi Kivitydda96d82008-11-26 15:14:10 +0200289#define __emulate_1op(_op, _dst, _eflags, _suffix) \
Avi Kivity6aa8b732006-12-10 02:21:36 -0800290 do { \
291 unsigned long _tmp; \
292 \
Avi Kivitydda96d82008-11-26 15:14:10 +0200293 __asm__ __volatile__ ( \
294 _PRE_EFLAGS("0", "3", "2") \
295 _op _suffix " %1; " \
296 _POST_EFLAGS("0", "3", "2") \
297 : "=m" (_eflags), "+m" ((_dst).val), \
298 "=&r" (_tmp) \
299 : "i" (EFLAGS_MASK)); \
300 } while (0)
301
302/* Instruction has only one explicit operand (no source operand). */
303#define emulate_1op(_op, _dst, _eflags) \
304 do { \
Mike Dayd77c26f2007-10-08 09:02:08 -0400305 switch ((_dst).bytes) { \
Avi Kivitydda96d82008-11-26 15:14:10 +0200306 case 1: __emulate_1op(_op, _dst, _eflags, "b"); break; \
307 case 2: __emulate_1op(_op, _dst, _eflags, "w"); break; \
308 case 4: __emulate_1op(_op, _dst, _eflags, "l"); break; \
309 case 8: ON64(__emulate_1op(_op, _dst, _eflags, "q")); break; \
Avi Kivity6aa8b732006-12-10 02:21:36 -0800310 } \
311 } while (0)
312
Mohammed Gamal3f9f53b2010-08-08 21:11:37 +0300313#define __emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, _suffix) \
314 do { \
315 unsigned long _tmp; \
316 \
317 __asm__ __volatile__ ( \
318 _PRE_EFLAGS("0", "4", "1") \
319 _op _suffix " %5; " \
320 _POST_EFLAGS("0", "4", "1") \
321 : "=m" (_eflags), "=&r" (_tmp), \
322 "+a" (_rax), "+d" (_rdx) \
323 : "i" (EFLAGS_MASK), "m" ((_src).val), \
324 "a" (_rax), "d" (_rdx)); \
325 } while (0)
326
Avi Kivityf6b35972010-08-26 11:59:00 +0300327#define __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, _eflags, _suffix, _ex) \
328 do { \
329 unsigned long _tmp; \
330 \
331 __asm__ __volatile__ ( \
332 _PRE_EFLAGS("0", "5", "1") \
333 "1: \n\t" \
334 _op _suffix " %6; " \
335 "2: \n\t" \
336 _POST_EFLAGS("0", "5", "1") \
337 ".pushsection .fixup,\"ax\" \n\t" \
338 "3: movb $1, %4 \n\t" \
339 "jmp 2b \n\t" \
340 ".popsection \n\t" \
341 _ASM_EXTABLE(1b, 3b) \
342 : "=m" (_eflags), "=&r" (_tmp), \
343 "+a" (_rax), "+d" (_rdx), "+qm"(_ex) \
344 : "i" (EFLAGS_MASK), "m" ((_src).val), \
345 "a" (_rax), "d" (_rdx)); \
346 } while (0)
347
Mohammed Gamal3f9f53b2010-08-08 21:11:37 +0300348/* instruction has only one source operand, destination is implicit (e.g. mul, div, imul, idiv) */
349#define emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags) \
350 do { \
351 switch((_src).bytes) { \
352 case 1: __emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "b"); break; \
353 case 2: __emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "w"); break; \
354 case 4: __emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "l"); break; \
355 case 8: ON64(__emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "q")); break; \
356 } \
357 } while (0)
358
Avi Kivityf6b35972010-08-26 11:59:00 +0300359#define emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, _eflags, _ex) \
360 do { \
361 switch((_src).bytes) { \
362 case 1: \
363 __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, \
364 _eflags, "b", _ex); \
365 break; \
366 case 2: \
367 __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, \
368 _eflags, "w", _ex); \
369 break; \
370 case 4: \
371 __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, \
372 _eflags, "l", _ex); \
373 break; \
374 case 8: ON64( \
375 __emulate_1op_rax_rdx_ex(_op, _src, _rax, _rdx, \
376 _eflags, "q", _ex)); \
377 break; \
378 } \
379 } while (0)
380
Avi Kivity6aa8b732006-12-10 02:21:36 -0800381/* Fetch next part of the instruction being emulated. */
382#define insn_fetch(_type, _size, _eip) \
383({ unsigned long _x; \
Avi Kivity62266862007-11-20 13:15:52 +0200384 rc = do_insn_fetch(ctxt, ops, (_eip), &_x, (_size)); \
Gleb Natapovaf5b4f72010-03-15 16:38:30 +0200385 if (rc != X86EMUL_CONTINUE) \
Avi Kivity6aa8b732006-12-10 02:21:36 -0800386 goto done; \
387 (_eip) += (_size); \
388 (_type)_x; \
389})
390
Gleb Natapov414e6272010-04-28 19:15:26 +0300391#define insn_fetch_arr(_arr, _size, _eip) \
392({ rc = do_insn_fetch(ctxt, ops, (_eip), _arr, (_size)); \
393 if (rc != X86EMUL_CONTINUE) \
394 goto done; \
395 (_eip) += (_size); \
396})
397
Harvey Harrisonddcb2882008-02-18 11:12:48 -0800398static inline unsigned long ad_mask(struct decode_cache *c)
399{
400 return (1UL << (c->ad_bytes << 3)) - 1;
401}
402
Avi Kivity6aa8b732006-12-10 02:21:36 -0800403/* Access/update address held in a register, based on addressing mode. */
Harvey Harrisone4706772008-02-19 07:40:38 -0800404static inline unsigned long
405address_mask(struct decode_cache *c, unsigned long reg)
406{
407 if (c->ad_bytes == sizeof(unsigned long))
408 return reg;
409 else
410 return reg & ad_mask(c);
411}
412
413static inline unsigned long
Avi Kivity90de84f2010-11-17 15:28:21 +0200414register_address(struct decode_cache *c, unsigned long reg)
Harvey Harrisone4706772008-02-19 07:40:38 -0800415{
Avi Kivity90de84f2010-11-17 15:28:21 +0200416 return address_mask(c, reg);
Harvey Harrisone4706772008-02-19 07:40:38 -0800417}
418
Harvey Harrison7a9572752008-02-19 07:40:41 -0800419static inline void
420register_address_increment(struct decode_cache *c, unsigned long *reg, int inc)
421{
422 if (c->ad_bytes == sizeof(unsigned long))
423 *reg += inc;
424 else
425 *reg = (*reg & ~ad_mask(c)) | ((*reg + inc) & ad_mask(c));
426}
Avi Kivity6aa8b732006-12-10 02:21:36 -0800427
Harvey Harrison7a9572752008-02-19 07:40:41 -0800428static inline void jmp_rel(struct decode_cache *c, int rel)
429{
430 register_address_increment(c, &c->eip, rel);
431}
Nitin A Kamble098c9372007-08-19 11:00:36 +0300432
Avi Kivity7a5b56d2008-06-22 16:22:51 +0300433static void set_seg_override(struct decode_cache *c, int seg)
434{
435 c->has_seg_override = true;
436 c->seg_override = seg;
437}
438
Gleb Natapov79168fd2010-04-28 19:15:30 +0300439static unsigned long seg_base(struct x86_emulate_ctxt *ctxt,
440 struct x86_emulate_ops *ops, int seg)
Avi Kivity7a5b56d2008-06-22 16:22:51 +0300441{
442 if (ctxt->mode == X86EMUL_MODE_PROT64 && seg < VCPU_SREG_FS)
443 return 0;
444
Gleb Natapov79168fd2010-04-28 19:15:30 +0300445 return ops->get_cached_segment_base(seg, ctxt->vcpu);
Avi Kivity7a5b56d2008-06-22 16:22:51 +0300446}
447
Avi Kivity90de84f2010-11-17 15:28:21 +0200448static unsigned seg_override(struct x86_emulate_ctxt *ctxt,
449 struct x86_emulate_ops *ops,
450 struct decode_cache *c)
Avi Kivity7a5b56d2008-06-22 16:22:51 +0300451{
452 if (!c->has_seg_override)
453 return 0;
454
Avi Kivity90de84f2010-11-17 15:28:21 +0200455 return c->seg_override;
Avi Kivity7a5b56d2008-06-22 16:22:51 +0300456}
457
Avi Kivity90de84f2010-11-17 15:28:21 +0200458static ulong linear(struct x86_emulate_ctxt *ctxt,
459 struct segmented_address addr)
Avi Kivity7a5b56d2008-06-22 16:22:51 +0300460{
Avi Kivity90de84f2010-11-17 15:28:21 +0200461 struct decode_cache *c = &ctxt->decode;
462 ulong la;
Avi Kivity7a5b56d2008-06-22 16:22:51 +0300463
Avi Kivity90de84f2010-11-17 15:28:21 +0200464 la = seg_base(ctxt, ctxt->ops, addr.seg) + addr.ea;
465 if (c->ad_bytes != 8)
466 la &= (u32)-1;
467 return la;
Avi Kivity7a5b56d2008-06-22 16:22:51 +0300468}
469
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200470static int emulate_exception(struct x86_emulate_ctxt *ctxt, int vec,
471 u32 error, bool valid)
Gleb Natapov54b84862010-04-28 19:15:44 +0300472{
Avi Kivityda9cb572010-11-22 17:53:21 +0200473 ctxt->exception.vector = vec;
474 ctxt->exception.error_code = error;
475 ctxt->exception.error_code_valid = valid;
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200476 return X86EMUL_PROPAGATE_FAULT;
Gleb Natapov54b84862010-04-28 19:15:44 +0300477}
478
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200479static int emulate_gp(struct x86_emulate_ctxt *ctxt, int err)
Gleb Natapov54b84862010-04-28 19:15:44 +0300480{
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200481 return emulate_exception(ctxt, GP_VECTOR, err, true);
Gleb Natapov54b84862010-04-28 19:15:44 +0300482}
483
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200484static int emulate_ud(struct x86_emulate_ctxt *ctxt)
Gleb Natapov54b84862010-04-28 19:15:44 +0300485{
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200486 return emulate_exception(ctxt, UD_VECTOR, 0, false);
Gleb Natapov54b84862010-04-28 19:15:44 +0300487}
488
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200489static int emulate_ts(struct x86_emulate_ctxt *ctxt, int err)
Gleb Natapov54b84862010-04-28 19:15:44 +0300490{
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200491 return emulate_exception(ctxt, TS_VECTOR, err, true);
Gleb Natapov54b84862010-04-28 19:15:44 +0300492}
493
Avi Kivity34d1f492010-08-26 11:59:01 +0300494static int emulate_de(struct x86_emulate_ctxt *ctxt)
495{
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200496 return emulate_exception(ctxt, DE_VECTOR, 0, false);
Avi Kivity34d1f492010-08-26 11:59:01 +0300497}
498
Avi Kivity62266862007-11-20 13:15:52 +0200499static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
500 struct x86_emulate_ops *ops,
Avi Kivity2fb53ad2010-04-11 13:05:15 +0300501 unsigned long eip, u8 *dest)
Avi Kivity62266862007-11-20 13:15:52 +0200502{
503 struct fetch_cache *fc = &ctxt->decode.fetch;
504 int rc;
Avi Kivity2fb53ad2010-04-11 13:05:15 +0300505 int size, cur_size;
Avi Kivity62266862007-11-20 13:15:52 +0200506
Avi Kivity2fb53ad2010-04-11 13:05:15 +0300507 if (eip == fc->end) {
508 cur_size = fc->end - fc->start;
509 size = min(15UL - cur_size, PAGE_SIZE - offset_in_page(eip));
510 rc = ops->fetch(ctxt->cs_base + eip, fc->data + cur_size,
Avi Kivitybcc55cb2010-11-22 17:53:22 +0200511 size, ctxt->vcpu, &ctxt->exception);
Takuya Yoshikawa3e2815e2010-02-12 15:53:59 +0900512 if (rc != X86EMUL_CONTINUE)
Avi Kivity62266862007-11-20 13:15:52 +0200513 return rc;
Avi Kivity2fb53ad2010-04-11 13:05:15 +0300514 fc->end += size;
Avi Kivity62266862007-11-20 13:15:52 +0200515 }
Avi Kivity2fb53ad2010-04-11 13:05:15 +0300516 *dest = fc->data[eip - fc->start];
Takuya Yoshikawa3e2815e2010-02-12 15:53:59 +0900517 return X86EMUL_CONTINUE;
Avi Kivity62266862007-11-20 13:15:52 +0200518}
519
520static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
521 struct x86_emulate_ops *ops,
522 unsigned long eip, void *dest, unsigned size)
523{
Takuya Yoshikawa3e2815e2010-02-12 15:53:59 +0900524 int rc;
Avi Kivity62266862007-11-20 13:15:52 +0200525
Avi Kivityeb3c79e2009-11-24 15:20:15 +0200526 /* x86 instructions are limited to 15 bytes. */
Gleb Natapov063db062010-03-18 15:20:06 +0200527 if (eip + size - ctxt->eip > 15)
Avi Kivityeb3c79e2009-11-24 15:20:15 +0200528 return X86EMUL_UNHANDLEABLE;
Avi Kivity62266862007-11-20 13:15:52 +0200529 while (size--) {
530 rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
Takuya Yoshikawa3e2815e2010-02-12 15:53:59 +0900531 if (rc != X86EMUL_CONTINUE)
Avi Kivity62266862007-11-20 13:15:52 +0200532 return rc;
533 }
Takuya Yoshikawa3e2815e2010-02-12 15:53:59 +0900534 return X86EMUL_CONTINUE;
Avi Kivity62266862007-11-20 13:15:52 +0200535}
536
Rusty Russell1e3c5cb2007-07-17 23:16:11 +1000537/*
538 * Given the 'reg' portion of a ModRM byte, and a register block, return a
539 * pointer into the block that addresses the relevant register.
540 * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
541 */
542static void *decode_register(u8 modrm_reg, unsigned long *regs,
543 int highbyte_regs)
Avi Kivity6aa8b732006-12-10 02:21:36 -0800544{
545 void *p;
546
547 p = &regs[modrm_reg];
548 if (highbyte_regs && modrm_reg >= 4 && modrm_reg < 8)
549 p = (unsigned char *)&regs[modrm_reg & 3] + 1;
550 return p;
551}
552
553static int read_descriptor(struct x86_emulate_ctxt *ctxt,
554 struct x86_emulate_ops *ops,
Avi Kivity90de84f2010-11-17 15:28:21 +0200555 struct segmented_address addr,
Avi Kivity6aa8b732006-12-10 02:21:36 -0800556 u16 *size, unsigned long *address, int op_bytes)
557{
558 int rc;
559
560 if (op_bytes == 2)
561 op_bytes = 3;
562 *address = 0;
Avi Kivity90de84f2010-11-17 15:28:21 +0200563 rc = ops->read_std(linear(ctxt, addr), (unsigned long *)size, 2,
Avi Kivitybcc55cb2010-11-22 17:53:22 +0200564 ctxt->vcpu, &ctxt->exception);
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +0900565 if (rc != X86EMUL_CONTINUE)
Avi Kivity6aa8b732006-12-10 02:21:36 -0800566 return rc;
Avi Kivity30b31ab2010-11-17 15:28:22 +0200567 addr.ea += 2;
568 rc = ops->read_std(linear(ctxt, addr), address, op_bytes,
Avi Kivitybcc55cb2010-11-22 17:53:22 +0200569 ctxt->vcpu, &ctxt->exception);
Avi Kivity6aa8b732006-12-10 02:21:36 -0800570 return rc;
571}
572
Nitin A Kamblebbe9abb2007-09-15 10:23:07 +0300573static int test_cc(unsigned int condition, unsigned int flags)
574{
575 int rc = 0;
576
577 switch ((condition & 15) >> 1) {
578 case 0: /* o */
579 rc |= (flags & EFLG_OF);
580 break;
581 case 1: /* b/c/nae */
582 rc |= (flags & EFLG_CF);
583 break;
584 case 2: /* z/e */
585 rc |= (flags & EFLG_ZF);
586 break;
587 case 3: /* be/na */
588 rc |= (flags & (EFLG_CF|EFLG_ZF));
589 break;
590 case 4: /* s */
591 rc |= (flags & EFLG_SF);
592 break;
593 case 5: /* p/pe */
594 rc |= (flags & EFLG_PF);
595 break;
596 case 7: /* le/ng */
597 rc |= (flags & EFLG_ZF);
598 /* fall through */
599 case 6: /* l/nge */
600 rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
601 break;
602 }
603
604 /* Odd condition identifiers (lsb == 1) have inverted sense. */
605 return (!!rc ^ (condition & 1));
606}
607
Avi Kivity91ff3cb2010-08-01 12:53:09 +0300608static void fetch_register_operand(struct operand *op)
609{
610 switch (op->bytes) {
611 case 1:
612 op->val = *(u8 *)op->addr.reg;
613 break;
614 case 2:
615 op->val = *(u16 *)op->addr.reg;
616 break;
617 case 4:
618 op->val = *(u32 *)op->addr.reg;
619 break;
620 case 8:
621 op->val = *(u64 *)op->addr.reg;
622 break;
623 }
624}
625
Avi Kivity3c118e22007-10-31 10:27:04 +0200626static void decode_register_operand(struct operand *op,
627 struct decode_cache *c,
Avi Kivity3c118e22007-10-31 10:27:04 +0200628 int inhibit_bytereg)
629{
Avi Kivity33615aa2007-10-31 11:15:56 +0200630 unsigned reg = c->modrm_reg;
Avi Kivity9f1ef3f2007-10-31 11:21:06 +0200631 int highbyte_regs = c->rex_prefix == 0;
Avi Kivity33615aa2007-10-31 11:15:56 +0200632
633 if (!(c->d & ModRM))
634 reg = (c->b & 7) | ((c->rex_prefix & 1) << 3);
Avi Kivity3c118e22007-10-31 10:27:04 +0200635 op->type = OP_REG;
636 if ((c->d & ByteOp) && !inhibit_bytereg) {
Avi Kivity1a6440aef2010-08-01 12:35:10 +0300637 op->addr.reg = decode_register(reg, c->regs, highbyte_regs);
Avi Kivity3c118e22007-10-31 10:27:04 +0200638 op->bytes = 1;
639 } else {
Avi Kivity1a6440aef2010-08-01 12:35:10 +0300640 op->addr.reg = decode_register(reg, c->regs, 0);
Avi Kivity3c118e22007-10-31 10:27:04 +0200641 op->bytes = c->op_bytes;
Avi Kivity3c118e22007-10-31 10:27:04 +0200642 }
Avi Kivity91ff3cb2010-08-01 12:53:09 +0300643 fetch_register_operand(op);
Avi Kivity3c118e22007-10-31 10:27:04 +0200644 op->orig_val = op->val;
645}
646
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200647static int decode_modrm(struct x86_emulate_ctxt *ctxt,
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300648 struct x86_emulate_ops *ops,
649 struct operand *op)
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200650{
651 struct decode_cache *c = &ctxt->decode;
652 u8 sib;
Avi Kivityf5b4edc2008-06-15 22:09:11 -0700653 int index_reg = 0, base_reg = 0, scale;
Takuya Yoshikawa3e2815e2010-02-12 15:53:59 +0900654 int rc = X86EMUL_CONTINUE;
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300655 ulong modrm_ea = 0;
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200656
657 if (c->rex_prefix) {
658 c->modrm_reg = (c->rex_prefix & 4) << 1; /* REX.R */
659 index_reg = (c->rex_prefix & 2) << 2; /* REX.X */
660 c->modrm_rm = base_reg = (c->rex_prefix & 1) << 3; /* REG.B */
661 }
662
663 c->modrm = insn_fetch(u8, 1, c->eip);
664 c->modrm_mod |= (c->modrm & 0xc0) >> 6;
665 c->modrm_reg |= (c->modrm & 0x38) >> 3;
666 c->modrm_rm |= (c->modrm & 0x07);
Avi Kivity09ee57c2010-08-01 12:07:29 +0300667 c->modrm_seg = VCPU_SREG_DS;
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200668
669 if (c->modrm_mod == 3) {
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300670 op->type = OP_REG;
671 op->bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
672 op->addr.reg = decode_register(c->modrm_rm,
Avi Kivity107d6d22008-05-05 14:58:26 +0300673 c->regs, c->d & ByteOp);
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300674 fetch_register_operand(op);
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200675 return rc;
676 }
677
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300678 op->type = OP_MEM;
679
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200680 if (c->ad_bytes == 2) {
681 unsigned bx = c->regs[VCPU_REGS_RBX];
682 unsigned bp = c->regs[VCPU_REGS_RBP];
683 unsigned si = c->regs[VCPU_REGS_RSI];
684 unsigned di = c->regs[VCPU_REGS_RDI];
685
686 /* 16-bit ModR/M decode. */
687 switch (c->modrm_mod) {
688 case 0:
689 if (c->modrm_rm == 6)
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300690 modrm_ea += insn_fetch(u16, 2, c->eip);
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200691 break;
692 case 1:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300693 modrm_ea += insn_fetch(s8, 1, c->eip);
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200694 break;
695 case 2:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300696 modrm_ea += insn_fetch(u16, 2, c->eip);
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200697 break;
698 }
699 switch (c->modrm_rm) {
700 case 0:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300701 modrm_ea += bx + si;
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200702 break;
703 case 1:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300704 modrm_ea += bx + di;
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200705 break;
706 case 2:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300707 modrm_ea += bp + si;
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200708 break;
709 case 3:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300710 modrm_ea += bp + di;
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200711 break;
712 case 4:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300713 modrm_ea += si;
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200714 break;
715 case 5:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300716 modrm_ea += di;
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200717 break;
718 case 6:
719 if (c->modrm_mod != 0)
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300720 modrm_ea += bp;
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200721 break;
722 case 7:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300723 modrm_ea += bx;
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200724 break;
725 }
726 if (c->modrm_rm == 2 || c->modrm_rm == 3 ||
727 (c->modrm_rm == 6 && c->modrm_mod != 0))
Avi Kivity09ee57c2010-08-01 12:07:29 +0300728 c->modrm_seg = VCPU_SREG_SS;
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300729 modrm_ea = (u16)modrm_ea;
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200730 } else {
731 /* 32/64-bit ModR/M decode. */
Avi Kivity84411d82008-06-15 21:53:26 -0700732 if ((c->modrm_rm & 7) == 4) {
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200733 sib = insn_fetch(u8, 1, c->eip);
734 index_reg |= (sib >> 3) & 7;
735 base_reg |= sib & 7;
736 scale = sib >> 6;
737
Avi Kivitydc71d0f2008-06-15 21:23:17 -0700738 if ((base_reg & 7) == 5 && c->modrm_mod == 0)
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300739 modrm_ea += insn_fetch(s32, 4, c->eip);
Avi Kivitydc71d0f2008-06-15 21:23:17 -0700740 else
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300741 modrm_ea += c->regs[base_reg];
Avi Kivitydc71d0f2008-06-15 21:23:17 -0700742 if (index_reg != 4)
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300743 modrm_ea += c->regs[index_reg] << scale;
Avi Kivity84411d82008-06-15 21:53:26 -0700744 } else if ((c->modrm_rm & 7) == 5 && c->modrm_mod == 0) {
745 if (ctxt->mode == X86EMUL_MODE_PROT64)
Avi Kivityf5b4edc2008-06-15 22:09:11 -0700746 c->rip_relative = 1;
Avi Kivity84411d82008-06-15 21:53:26 -0700747 } else
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300748 modrm_ea += c->regs[c->modrm_rm];
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200749 switch (c->modrm_mod) {
750 case 0:
751 if (c->modrm_rm == 5)
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300752 modrm_ea += insn_fetch(s32, 4, c->eip);
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200753 break;
754 case 1:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300755 modrm_ea += insn_fetch(s8, 1, c->eip);
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200756 break;
757 case 2:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300758 modrm_ea += insn_fetch(s32, 4, c->eip);
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200759 break;
760 }
761 }
Avi Kivity90de84f2010-11-17 15:28:21 +0200762 op->addr.mem.ea = modrm_ea;
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200763done:
764 return rc;
765}
766
767static int decode_abs(struct x86_emulate_ctxt *ctxt,
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300768 struct x86_emulate_ops *ops,
769 struct operand *op)
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200770{
771 struct decode_cache *c = &ctxt->decode;
Takuya Yoshikawa3e2815e2010-02-12 15:53:59 +0900772 int rc = X86EMUL_CONTINUE;
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200773
Avi Kivity2dbd0dd2010-08-01 15:40:19 +0300774 op->type = OP_MEM;
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200775 switch (c->ad_bytes) {
776 case 2:
Avi Kivity90de84f2010-11-17 15:28:21 +0200777 op->addr.mem.ea = insn_fetch(u16, 2, c->eip);
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200778 break;
779 case 4:
Avi Kivity90de84f2010-11-17 15:28:21 +0200780 op->addr.mem.ea = insn_fetch(u32, 4, c->eip);
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200781 break;
782 case 8:
Avi Kivity90de84f2010-11-17 15:28:21 +0200783 op->addr.mem.ea = insn_fetch(u64, 8, c->eip);
Avi Kivity1c73ef6652007-11-01 06:31:28 +0200784 break;
785 }
786done:
787 return rc;
788}
789
Wei Yongjun35c843c2010-08-09 11:34:56 +0800790static void fetch_bit_operand(struct decode_cache *c)
791{
Sheng Yang7129eec2010-09-28 16:33:32 +0800792 long sv = 0, mask;
Wei Yongjun35c843c2010-08-09 11:34:56 +0800793
Wei Yongjun3885f182010-08-09 11:37:37 +0800794 if (c->dst.type == OP_MEM && c->src.type == OP_REG) {
Wei Yongjun35c843c2010-08-09 11:34:56 +0800795 mask = ~(c->dst.bytes * 8 - 1);
796
797 if (c->src.bytes == 2)
798 sv = (s16)c->src.val & (s16)mask;
799 else if (c->src.bytes == 4)
800 sv = (s32)c->src.val & (s32)mask;
801
Avi Kivity90de84f2010-11-17 15:28:21 +0200802 c->dst.addr.mem.ea += (sv >> 3);
Wei Yongjun35c843c2010-08-09 11:34:56 +0800803 }
Wei Yongjunba7ff2b2010-08-09 11:39:14 +0800804
805 /* only subword offset */
806 c->src.val &= (c->dst.bytes << 3) - 1;
Wei Yongjun35c843c2010-08-09 11:34:56 +0800807}
808
Gleb Natapov9de41572010-04-28 19:15:22 +0300809static int read_emulated(struct x86_emulate_ctxt *ctxt,
810 struct x86_emulate_ops *ops,
811 unsigned long addr, void *dest, unsigned size)
812{
813 int rc;
814 struct read_cache *mc = &ctxt->decode.mem_read;
815
816 while (size) {
817 int n = min(size, 8u);
818 size -= n;
819 if (mc->pos < mc->end)
820 goto read_cached;
821
Avi Kivitybcc55cb2010-11-22 17:53:22 +0200822 rc = ops->read_emulated(addr, mc->data + mc->end, n,
823 &ctxt->exception, ctxt->vcpu);
Gleb Natapov9de41572010-04-28 19:15:22 +0300824 if (rc != X86EMUL_CONTINUE)
825 return rc;
826 mc->end += n;
827
828 read_cached:
829 memcpy(dest, mc->data + mc->pos, n);
830 mc->pos += n;
831 dest += n;
832 addr += n;
833 }
834 return X86EMUL_CONTINUE;
835}
836
Gleb Natapov7b262e92010-03-18 15:20:27 +0200837static int pio_in_emulated(struct x86_emulate_ctxt *ctxt,
838 struct x86_emulate_ops *ops,
839 unsigned int size, unsigned short port,
840 void *dest)
841{
842 struct read_cache *rc = &ctxt->decode.io_read;
843
844 if (rc->pos == rc->end) { /* refill pio read ahead */
845 struct decode_cache *c = &ctxt->decode;
846 unsigned int in_page, n;
847 unsigned int count = c->rep_prefix ?
848 address_mask(c, c->regs[VCPU_REGS_RCX]) : 1;
849 in_page = (ctxt->eflags & EFLG_DF) ?
850 offset_in_page(c->regs[VCPU_REGS_RDI]) :
851 PAGE_SIZE - offset_in_page(c->regs[VCPU_REGS_RDI]);
852 n = min(min(in_page, (unsigned int)sizeof(rc->data)) / size,
853 count);
854 if (n == 0)
855 n = 1;
856 rc->pos = rc->end = 0;
857 if (!ops->pio_in_emulated(size, port, rc->data, n, ctxt->vcpu))
858 return 0;
859 rc->end = n * size;
860 }
861
862 memcpy(dest, rc->data + rc->pos, size);
863 rc->pos += size;
864 return 1;
865}
866
Gleb Natapov38ba30b2010-03-18 15:20:17 +0200867static u32 desc_limit_scaled(struct desc_struct *desc)
868{
869 u32 limit = get_desc_limit(desc);
870
871 return desc->g ? (limit << 12) | 0xfff : limit;
872}
873
874static void get_descriptor_table_ptr(struct x86_emulate_ctxt *ctxt,
875 struct x86_emulate_ops *ops,
876 u16 selector, struct desc_ptr *dt)
877{
878 if (selector & 1 << 2) {
879 struct desc_struct desc;
880 memset (dt, 0, sizeof *dt);
Gleb Natapov5601d052011-03-07 14:55:06 +0200881 if (!ops->get_cached_descriptor(&desc, NULL, VCPU_SREG_LDTR,
882 ctxt->vcpu))
Gleb Natapov38ba30b2010-03-18 15:20:17 +0200883 return;
884
885 dt->size = desc_limit_scaled(&desc); /* what if limit > 65535? */
886 dt->address = get_desc_base(&desc);
887 } else
888 ops->get_gdt(dt, ctxt->vcpu);
889}
890
891/* allowed just for 8 bytes segments */
892static int read_segment_descriptor(struct x86_emulate_ctxt *ctxt,
893 struct x86_emulate_ops *ops,
894 u16 selector, struct desc_struct *desc)
895{
896 struct desc_ptr dt;
897 u16 index = selector >> 3;
898 int ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +0200899 ulong addr;
900
901 get_descriptor_table_ptr(ctxt, ops, selector, &dt);
902
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200903 if (dt.size < index * 8 + 7)
904 return emulate_gp(ctxt, selector & 0xfffc);
Gleb Natapov38ba30b2010-03-18 15:20:17 +0200905 addr = dt.address + index * 8;
Avi Kivitybcc55cb2010-11-22 17:53:22 +0200906 ret = ops->read_std(addr, desc, sizeof *desc, ctxt->vcpu,
907 &ctxt->exception);
Gleb Natapov38ba30b2010-03-18 15:20:17 +0200908
909 return ret;
910}
911
912/* allowed just for 8 bytes segments */
913static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt,
914 struct x86_emulate_ops *ops,
915 u16 selector, struct desc_struct *desc)
916{
917 struct desc_ptr dt;
918 u16 index = selector >> 3;
Gleb Natapov38ba30b2010-03-18 15:20:17 +0200919 ulong addr;
920 int ret;
921
922 get_descriptor_table_ptr(ctxt, ops, selector, &dt);
923
Avi Kivity35d3d4a2010-11-22 17:53:25 +0200924 if (dt.size < index * 8 + 7)
925 return emulate_gp(ctxt, selector & 0xfffc);
Gleb Natapov38ba30b2010-03-18 15:20:17 +0200926
927 addr = dt.address + index * 8;
Avi Kivitybcc55cb2010-11-22 17:53:22 +0200928 ret = ops->write_std(addr, desc, sizeof *desc, ctxt->vcpu,
929 &ctxt->exception);
Gleb Natapov38ba30b2010-03-18 15:20:17 +0200930
931 return ret;
932}
933
Gleb Natapov5601d052011-03-07 14:55:06 +0200934/* Does not support long mode */
Gleb Natapov38ba30b2010-03-18 15:20:17 +0200935static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
936 struct x86_emulate_ops *ops,
937 u16 selector, int seg)
938{
939 struct desc_struct seg_desc;
940 u8 dpl, rpl, cpl;
941 unsigned err_vec = GP_VECTOR;
942 u32 err_code = 0;
943 bool null_selector = !(selector & ~0x3); /* 0000-0003 are null */
944 int ret;
945
946 memset(&seg_desc, 0, sizeof seg_desc);
947
948 if ((seg <= VCPU_SREG_GS && ctxt->mode == X86EMUL_MODE_VM86)
949 || ctxt->mode == X86EMUL_MODE_REAL) {
950 /* set real mode segment descriptor */
951 set_desc_base(&seg_desc, selector << 4);
952 set_desc_limit(&seg_desc, 0xffff);
953 seg_desc.type = 3;
954 seg_desc.p = 1;
955 seg_desc.s = 1;
956 goto load;
957 }
958
959 /* NULL selector is not valid for TR, CS and SS */
960 if ((seg == VCPU_SREG_CS || seg == VCPU_SREG_SS || seg == VCPU_SREG_TR)
961 && null_selector)
962 goto exception;
963
964 /* TR should be in GDT only */
965 if (seg == VCPU_SREG_TR && (selector & (1 << 2)))
966 goto exception;
967
968 if (null_selector) /* for NULL selector skip all following checks */
969 goto load;
970
971 ret = read_segment_descriptor(ctxt, ops, selector, &seg_desc);
972 if (ret != X86EMUL_CONTINUE)
973 return ret;
974
975 err_code = selector & 0xfffc;
976 err_vec = GP_VECTOR;
977
978 /* can't load system descriptor into segment selecor */
979 if (seg <= VCPU_SREG_GS && !seg_desc.s)
980 goto exception;
981
982 if (!seg_desc.p) {
983 err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR;
984 goto exception;
985 }
986
987 rpl = selector & 3;
988 dpl = seg_desc.dpl;
989 cpl = ops->cpl(ctxt->vcpu);
990
991 switch (seg) {
992 case VCPU_SREG_SS:
993 /*
994 * segment is not a writable data segment or segment
995 * selector's RPL != CPL or segment selector's RPL != CPL
996 */
997 if (rpl != cpl || (seg_desc.type & 0xa) != 0x2 || dpl != cpl)
998 goto exception;
999 break;
1000 case VCPU_SREG_CS:
1001 if (!(seg_desc.type & 8))
1002 goto exception;
1003
1004 if (seg_desc.type & 4) {
1005 /* conforming */
1006 if (dpl > cpl)
1007 goto exception;
1008 } else {
1009 /* nonconforming */
1010 if (rpl > cpl || dpl != cpl)
1011 goto exception;
1012 }
1013 /* CS(RPL) <- CPL */
1014 selector = (selector & 0xfffc) | cpl;
1015 break;
1016 case VCPU_SREG_TR:
1017 if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9))
1018 goto exception;
1019 break;
1020 case VCPU_SREG_LDTR:
1021 if (seg_desc.s || seg_desc.type != 2)
1022 goto exception;
1023 break;
1024 default: /* DS, ES, FS, or GS */
1025 /*
1026 * segment is not a data or readable code segment or
1027 * ((segment is a data or nonconforming code segment)
1028 * and (both RPL and CPL > DPL))
1029 */
1030 if ((seg_desc.type & 0xa) == 0x8 ||
1031 (((seg_desc.type & 0xc) != 0xc) &&
1032 (rpl > dpl && cpl > dpl)))
1033 goto exception;
1034 break;
1035 }
1036
1037 if (seg_desc.s) {
1038 /* mark segment as accessed */
1039 seg_desc.type |= 1;
1040 ret = write_segment_descriptor(ctxt, ops, selector, &seg_desc);
1041 if (ret != X86EMUL_CONTINUE)
1042 return ret;
1043 }
1044load:
1045 ops->set_segment_selector(selector, seg, ctxt->vcpu);
Gleb Natapov5601d052011-03-07 14:55:06 +02001046 ops->set_cached_descriptor(&seg_desc, 0, seg, ctxt->vcpu);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001047 return X86EMUL_CONTINUE;
1048exception:
Gleb Natapov54b84862010-04-28 19:15:44 +03001049 emulate_exception(ctxt, err_vec, err_code, true);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001050 return X86EMUL_PROPAGATE_FAULT;
1051}
1052
Wei Yongjun31be40b2010-08-17 09:17:30 +08001053static void write_register_operand(struct operand *op)
1054{
1055 /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
1056 switch (op->bytes) {
1057 case 1:
1058 *(u8 *)op->addr.reg = (u8)op->val;
1059 break;
1060 case 2:
1061 *(u16 *)op->addr.reg = (u16)op->val;
1062 break;
1063 case 4:
1064 *op->addr.reg = (u32)op->val;
1065 break; /* 64b: zero-extend */
1066 case 8:
1067 *op->addr.reg = op->val;
1068 break;
1069 }
1070}
1071
Wei Yongjunc37eda12010-06-15 09:03:33 +08001072static inline int writeback(struct x86_emulate_ctxt *ctxt,
1073 struct x86_emulate_ops *ops)
1074{
1075 int rc;
1076 struct decode_cache *c = &ctxt->decode;
Wei Yongjunc37eda12010-06-15 09:03:33 +08001077
1078 switch (c->dst.type) {
1079 case OP_REG:
Wei Yongjun31be40b2010-08-17 09:17:30 +08001080 write_register_operand(&c->dst);
Wei Yongjunc37eda12010-06-15 09:03:33 +08001081 break;
1082 case OP_MEM:
1083 if (c->lock_prefix)
1084 rc = ops->cmpxchg_emulated(
Avi Kivity90de84f2010-11-17 15:28:21 +02001085 linear(ctxt, c->dst.addr.mem),
Wei Yongjunc37eda12010-06-15 09:03:33 +08001086 &c->dst.orig_val,
1087 &c->dst.val,
1088 c->dst.bytes,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02001089 &ctxt->exception,
Wei Yongjunc37eda12010-06-15 09:03:33 +08001090 ctxt->vcpu);
1091 else
1092 rc = ops->write_emulated(
Avi Kivity90de84f2010-11-17 15:28:21 +02001093 linear(ctxt, c->dst.addr.mem),
Wei Yongjunc37eda12010-06-15 09:03:33 +08001094 &c->dst.val,
1095 c->dst.bytes,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02001096 &ctxt->exception,
Wei Yongjunc37eda12010-06-15 09:03:33 +08001097 ctxt->vcpu);
Wei Yongjunc37eda12010-06-15 09:03:33 +08001098 if (rc != X86EMUL_CONTINUE)
1099 return rc;
1100 break;
1101 case OP_NONE:
1102 /* no writeback */
1103 break;
1104 default:
1105 break;
1106 }
1107 return X86EMUL_CONTINUE;
1108}
1109
Gleb Natapov79168fd2010-04-28 19:15:30 +03001110static inline void emulate_push(struct x86_emulate_ctxt *ctxt,
1111 struct x86_emulate_ops *ops)
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001112{
1113 struct decode_cache *c = &ctxt->decode;
1114
1115 c->dst.type = OP_MEM;
1116 c->dst.bytes = c->op_bytes;
1117 c->dst.val = c->src.val;
Harvey Harrison7a9572752008-02-19 07:40:41 -08001118 register_address_increment(c, &c->regs[VCPU_REGS_RSP], -c->op_bytes);
Avi Kivity90de84f2010-11-17 15:28:21 +02001119 c->dst.addr.mem.ea = register_address(c, c->regs[VCPU_REGS_RSP]);
1120 c->dst.addr.mem.seg = VCPU_SREG_SS;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001121}
1122
Avi Kivityfaa5a3a2008-11-27 17:36:41 +02001123static int emulate_pop(struct x86_emulate_ctxt *ctxt,
Avi Kivity350f69d2009-01-05 11:12:40 +02001124 struct x86_emulate_ops *ops,
1125 void *dest, int len)
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001126{
1127 struct decode_cache *c = &ctxt->decode;
1128 int rc;
Avi Kivity90de84f2010-11-17 15:28:21 +02001129 struct segmented_address addr;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001130
Avi Kivity90de84f2010-11-17 15:28:21 +02001131 addr.ea = register_address(c, c->regs[VCPU_REGS_RSP]);
1132 addr.seg = VCPU_SREG_SS;
1133 rc = read_emulated(ctxt, ops, linear(ctxt, addr), dest, len);
Takuya Yoshikawab60d5132010-01-20 16:47:21 +09001134 if (rc != X86EMUL_CONTINUE)
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001135 return rc;
1136
Avi Kivity350f69d2009-01-05 11:12:40 +02001137 register_address_increment(c, &c->regs[VCPU_REGS_RSP], len);
Avi Kivityfaa5a3a2008-11-27 17:36:41 +02001138 return rc;
1139}
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001140
Gleb Natapovd4c6a152010-02-10 14:21:34 +02001141static int emulate_popf(struct x86_emulate_ctxt *ctxt,
1142 struct x86_emulate_ops *ops,
1143 void *dest, int len)
1144{
1145 int rc;
1146 unsigned long val, change_mask;
1147 int iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
Gleb Natapov9c537242010-03-18 15:20:05 +02001148 int cpl = ops->cpl(ctxt->vcpu);
Gleb Natapovd4c6a152010-02-10 14:21:34 +02001149
1150 rc = emulate_pop(ctxt, ops, &val, len);
1151 if (rc != X86EMUL_CONTINUE)
1152 return rc;
1153
1154 change_mask = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF | EFLG_OF
1155 | EFLG_TF | EFLG_DF | EFLG_NT | EFLG_RF | EFLG_AC | EFLG_ID;
1156
1157 switch(ctxt->mode) {
1158 case X86EMUL_MODE_PROT64:
1159 case X86EMUL_MODE_PROT32:
1160 case X86EMUL_MODE_PROT16:
1161 if (cpl == 0)
1162 change_mask |= EFLG_IOPL;
1163 if (cpl <= iopl)
1164 change_mask |= EFLG_IF;
1165 break;
1166 case X86EMUL_MODE_VM86:
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001167 if (iopl < 3)
1168 return emulate_gp(ctxt, 0);
Gleb Natapovd4c6a152010-02-10 14:21:34 +02001169 change_mask |= EFLG_IF;
1170 break;
1171 default: /* real mode */
1172 change_mask |= (EFLG_IOPL | EFLG_IF);
1173 break;
1174 }
1175
1176 *(unsigned long *)dest =
1177 (ctxt->eflags & ~change_mask) | (val & change_mask);
1178
1179 return rc;
1180}
1181
Gleb Natapov79168fd2010-04-28 19:15:30 +03001182static void emulate_push_sreg(struct x86_emulate_ctxt *ctxt,
1183 struct x86_emulate_ops *ops, int seg)
Mohammed Gamal0934ac92009-08-23 14:24:24 +03001184{
1185 struct decode_cache *c = &ctxt->decode;
Mohammed Gamal0934ac92009-08-23 14:24:24 +03001186
Gleb Natapov79168fd2010-04-28 19:15:30 +03001187 c->src.val = ops->get_segment_selector(seg, ctxt->vcpu);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03001188
Gleb Natapov79168fd2010-04-28 19:15:30 +03001189 emulate_push(ctxt, ops);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03001190}
1191
1192static int emulate_pop_sreg(struct x86_emulate_ctxt *ctxt,
1193 struct x86_emulate_ops *ops, int seg)
1194{
1195 struct decode_cache *c = &ctxt->decode;
1196 unsigned long selector;
1197 int rc;
1198
1199 rc = emulate_pop(ctxt, ops, &selector, c->op_bytes);
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09001200 if (rc != X86EMUL_CONTINUE)
Mohammed Gamal0934ac92009-08-23 14:24:24 +03001201 return rc;
1202
Gleb Natapov2e873022010-03-18 15:20:18 +02001203 rc = load_segment_descriptor(ctxt, ops, (u16)selector, seg);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03001204 return rc;
1205}
1206
Wei Yongjunc37eda12010-06-15 09:03:33 +08001207static int emulate_pusha(struct x86_emulate_ctxt *ctxt,
Gleb Natapov79168fd2010-04-28 19:15:30 +03001208 struct x86_emulate_ops *ops)
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001209{
1210 struct decode_cache *c = &ctxt->decode;
1211 unsigned long old_esp = c->regs[VCPU_REGS_RSP];
Wei Yongjunc37eda12010-06-15 09:03:33 +08001212 int rc = X86EMUL_CONTINUE;
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001213 int reg = VCPU_REGS_RAX;
1214
1215 while (reg <= VCPU_REGS_RDI) {
1216 (reg == VCPU_REGS_RSP) ?
1217 (c->src.val = old_esp) : (c->src.val = c->regs[reg]);
1218
Gleb Natapov79168fd2010-04-28 19:15:30 +03001219 emulate_push(ctxt, ops);
Wei Yongjunc37eda12010-06-15 09:03:33 +08001220
1221 rc = writeback(ctxt, ops);
1222 if (rc != X86EMUL_CONTINUE)
1223 return rc;
1224
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001225 ++reg;
1226 }
Wei Yongjunc37eda12010-06-15 09:03:33 +08001227
1228 /* Disable writeback. */
1229 c->dst.type = OP_NONE;
1230
1231 return rc;
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001232}
1233
1234static int emulate_popa(struct x86_emulate_ctxt *ctxt,
1235 struct x86_emulate_ops *ops)
1236{
1237 struct decode_cache *c = &ctxt->decode;
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09001238 int rc = X86EMUL_CONTINUE;
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001239 int reg = VCPU_REGS_RDI;
1240
1241 while (reg >= VCPU_REGS_RAX) {
1242 if (reg == VCPU_REGS_RSP) {
1243 register_address_increment(c, &c->regs[VCPU_REGS_RSP],
1244 c->op_bytes);
1245 --reg;
1246 }
1247
1248 rc = emulate_pop(ctxt, ops, &c->regs[reg], c->op_bytes);
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09001249 if (rc != X86EMUL_CONTINUE)
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02001250 break;
1251 --reg;
1252 }
1253 return rc;
1254}
1255
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001256int emulate_int_real(struct x86_emulate_ctxt *ctxt,
1257 struct x86_emulate_ops *ops, int irq)
1258{
1259 struct decode_cache *c = &ctxt->decode;
Avi Kivity5c56e1c2010-08-17 11:17:51 +03001260 int rc;
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001261 struct desc_ptr dt;
1262 gva_t cs_addr;
1263 gva_t eip_addr;
1264 u16 cs, eip;
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001265
1266 /* TODO: Add limit checks */
1267 c->src.val = ctxt->eflags;
1268 emulate_push(ctxt, ops);
Avi Kivity5c56e1c2010-08-17 11:17:51 +03001269 rc = writeback(ctxt, ops);
1270 if (rc != X86EMUL_CONTINUE)
1271 return rc;
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001272
1273 ctxt->eflags &= ~(EFLG_IF | EFLG_TF | EFLG_AC);
1274
1275 c->src.val = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
1276 emulate_push(ctxt, ops);
Avi Kivity5c56e1c2010-08-17 11:17:51 +03001277 rc = writeback(ctxt, ops);
1278 if (rc != X86EMUL_CONTINUE)
1279 return rc;
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001280
1281 c->src.val = c->eip;
1282 emulate_push(ctxt, ops);
Avi Kivity5c56e1c2010-08-17 11:17:51 +03001283 rc = writeback(ctxt, ops);
1284 if (rc != X86EMUL_CONTINUE)
1285 return rc;
1286
1287 c->dst.type = OP_NONE;
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001288
1289 ops->get_idt(&dt, ctxt->vcpu);
1290
1291 eip_addr = dt.address + (irq << 2);
1292 cs_addr = dt.address + (irq << 2) + 2;
1293
Avi Kivitybcc55cb2010-11-22 17:53:22 +02001294 rc = ops->read_std(cs_addr, &cs, 2, ctxt->vcpu, &ctxt->exception);
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001295 if (rc != X86EMUL_CONTINUE)
1296 return rc;
1297
Avi Kivitybcc55cb2010-11-22 17:53:22 +02001298 rc = ops->read_std(eip_addr, &eip, 2, ctxt->vcpu, &ctxt->exception);
Mohammed Gamal6e154e52010-08-04 14:38:06 +03001299 if (rc != X86EMUL_CONTINUE)
1300 return rc;
1301
1302 rc = load_segment_descriptor(ctxt, ops, cs, VCPU_SREG_CS);
1303 if (rc != X86EMUL_CONTINUE)
1304 return rc;
1305
1306 c->eip = eip;
1307
1308 return rc;
1309}
1310
1311static int emulate_int(struct x86_emulate_ctxt *ctxt,
1312 struct x86_emulate_ops *ops, int irq)
1313{
1314 switch(ctxt->mode) {
1315 case X86EMUL_MODE_REAL:
1316 return emulate_int_real(ctxt, ops, irq);
1317 case X86EMUL_MODE_VM86:
1318 case X86EMUL_MODE_PROT16:
1319 case X86EMUL_MODE_PROT32:
1320 case X86EMUL_MODE_PROT64:
1321 default:
1322 /* Protected mode interrupts unimplemented yet */
1323 return X86EMUL_UNHANDLEABLE;
1324 }
1325}
1326
Mohammed Gamal62bd4302010-07-28 12:38:40 +03001327static int emulate_iret_real(struct x86_emulate_ctxt *ctxt,
1328 struct x86_emulate_ops *ops)
1329{
1330 struct decode_cache *c = &ctxt->decode;
1331 int rc = X86EMUL_CONTINUE;
1332 unsigned long temp_eip = 0;
1333 unsigned long temp_eflags = 0;
1334 unsigned long cs = 0;
1335 unsigned long mask = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF | EFLG_TF |
1336 EFLG_IF | EFLG_DF | EFLG_OF | EFLG_IOPL | EFLG_NT | EFLG_RF |
1337 EFLG_AC | EFLG_ID | (1 << 1); /* Last one is the reserved bit */
1338 unsigned long vm86_mask = EFLG_VM | EFLG_VIF | EFLG_VIP;
1339
1340 /* TODO: Add stack limit check */
1341
1342 rc = emulate_pop(ctxt, ops, &temp_eip, c->op_bytes);
1343
1344 if (rc != X86EMUL_CONTINUE)
1345 return rc;
1346
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001347 if (temp_eip & ~0xffff)
1348 return emulate_gp(ctxt, 0);
Mohammed Gamal62bd4302010-07-28 12:38:40 +03001349
1350 rc = emulate_pop(ctxt, ops, &cs, c->op_bytes);
1351
1352 if (rc != X86EMUL_CONTINUE)
1353 return rc;
1354
1355 rc = emulate_pop(ctxt, ops, &temp_eflags, c->op_bytes);
1356
1357 if (rc != X86EMUL_CONTINUE)
1358 return rc;
1359
1360 rc = load_segment_descriptor(ctxt, ops, (u16)cs, VCPU_SREG_CS);
1361
1362 if (rc != X86EMUL_CONTINUE)
1363 return rc;
1364
1365 c->eip = temp_eip;
1366
1367
1368 if (c->op_bytes == 4)
1369 ctxt->eflags = ((temp_eflags & mask) | (ctxt->eflags & vm86_mask));
1370 else if (c->op_bytes == 2) {
1371 ctxt->eflags &= ~0xffff;
1372 ctxt->eflags |= temp_eflags;
1373 }
1374
1375 ctxt->eflags &= ~EFLG_RESERVED_ZEROS_MASK; /* Clear reserved zeros */
1376 ctxt->eflags |= EFLG_RESERVED_ONE_MASK;
1377
1378 return rc;
1379}
1380
1381static inline int emulate_iret(struct x86_emulate_ctxt *ctxt,
1382 struct x86_emulate_ops* ops)
1383{
1384 switch(ctxt->mode) {
1385 case X86EMUL_MODE_REAL:
1386 return emulate_iret_real(ctxt, ops);
1387 case X86EMUL_MODE_VM86:
1388 case X86EMUL_MODE_PROT16:
1389 case X86EMUL_MODE_PROT32:
1390 case X86EMUL_MODE_PROT64:
1391 default:
1392 /* iret from protected mode unimplemented yet */
1393 return X86EMUL_UNHANDLEABLE;
1394 }
1395}
1396
Avi Kivityfaa5a3a2008-11-27 17:36:41 +02001397static inline int emulate_grp1a(struct x86_emulate_ctxt *ctxt,
1398 struct x86_emulate_ops *ops)
1399{
1400 struct decode_cache *c = &ctxt->decode;
Avi Kivityfaa5a3a2008-11-27 17:36:41 +02001401
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09001402 return emulate_pop(ctxt, ops, &c->dst.val, c->dst.bytes);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001403}
1404
Laurent Vivier05f086f2007-09-24 11:10:55 +02001405static inline void emulate_grp2(struct x86_emulate_ctxt *ctxt)
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001406{
Laurent Vivier05f086f2007-09-24 11:10:55 +02001407 struct decode_cache *c = &ctxt->decode;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001408 switch (c->modrm_reg) {
1409 case 0: /* rol */
Laurent Vivier05f086f2007-09-24 11:10:55 +02001410 emulate_2op_SrcB("rol", c->src, c->dst, ctxt->eflags);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001411 break;
1412 case 1: /* ror */
Laurent Vivier05f086f2007-09-24 11:10:55 +02001413 emulate_2op_SrcB("ror", c->src, c->dst, ctxt->eflags);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001414 break;
1415 case 2: /* rcl */
Laurent Vivier05f086f2007-09-24 11:10:55 +02001416 emulate_2op_SrcB("rcl", c->src, c->dst, ctxt->eflags);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001417 break;
1418 case 3: /* rcr */
Laurent Vivier05f086f2007-09-24 11:10:55 +02001419 emulate_2op_SrcB("rcr", c->src, c->dst, ctxt->eflags);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001420 break;
1421 case 4: /* sal/shl */
1422 case 6: /* sal/shl */
Laurent Vivier05f086f2007-09-24 11:10:55 +02001423 emulate_2op_SrcB("sal", c->src, c->dst, ctxt->eflags);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001424 break;
1425 case 5: /* shr */
Laurent Vivier05f086f2007-09-24 11:10:55 +02001426 emulate_2op_SrcB("shr", c->src, c->dst, ctxt->eflags);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001427 break;
1428 case 7: /* sar */
Laurent Vivier05f086f2007-09-24 11:10:55 +02001429 emulate_2op_SrcB("sar", c->src, c->dst, ctxt->eflags);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001430 break;
1431 }
1432}
1433
1434static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
Laurent Vivier05f086f2007-09-24 11:10:55 +02001435 struct x86_emulate_ops *ops)
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001436{
1437 struct decode_cache *c = &ctxt->decode;
Mohammed Gamal3f9f53b2010-08-08 21:11:37 +03001438 unsigned long *rax = &c->regs[VCPU_REGS_RAX];
1439 unsigned long *rdx = &c->regs[VCPU_REGS_RDX];
Avi Kivity34d1f492010-08-26 11:59:01 +03001440 u8 de = 0;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001441
1442 switch (c->modrm_reg) {
1443 case 0 ... 1: /* test */
Laurent Vivier05f086f2007-09-24 11:10:55 +02001444 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001445 break;
1446 case 2: /* not */
1447 c->dst.val = ~c->dst.val;
1448 break;
1449 case 3: /* neg */
Laurent Vivier05f086f2007-09-24 11:10:55 +02001450 emulate_1op("neg", c->dst, ctxt->eflags);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001451 break;
Mohammed Gamal3f9f53b2010-08-08 21:11:37 +03001452 case 4: /* mul */
1453 emulate_1op_rax_rdx("mul", c->src, *rax, *rdx, ctxt->eflags);
1454 break;
1455 case 5: /* imul */
1456 emulate_1op_rax_rdx("imul", c->src, *rax, *rdx, ctxt->eflags);
1457 break;
1458 case 6: /* div */
Avi Kivity34d1f492010-08-26 11:59:01 +03001459 emulate_1op_rax_rdx_ex("div", c->src, *rax, *rdx,
1460 ctxt->eflags, de);
Mohammed Gamal3f9f53b2010-08-08 21:11:37 +03001461 break;
1462 case 7: /* idiv */
Avi Kivity34d1f492010-08-26 11:59:01 +03001463 emulate_1op_rax_rdx_ex("idiv", c->src, *rax, *rdx,
1464 ctxt->eflags, de);
Mohammed Gamal3f9f53b2010-08-08 21:11:37 +03001465 break;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001466 default:
Mohammed Gamal8c5eee32010-08-08 21:11:38 +03001467 return X86EMUL_UNHANDLEABLE;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001468 }
Avi Kivity34d1f492010-08-26 11:59:01 +03001469 if (de)
1470 return emulate_de(ctxt);
Mohammed Gamal8c5eee32010-08-08 21:11:38 +03001471 return X86EMUL_CONTINUE;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001472}
1473
1474static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
Laurent Viviera01af5e2007-09-24 11:10:56 +02001475 struct x86_emulate_ops *ops)
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001476{
1477 struct decode_cache *c = &ctxt->decode;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001478
1479 switch (c->modrm_reg) {
1480 case 0: /* inc */
Laurent Vivier05f086f2007-09-24 11:10:55 +02001481 emulate_1op("inc", c->dst, ctxt->eflags);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001482 break;
1483 case 1: /* dec */
Laurent Vivier05f086f2007-09-24 11:10:55 +02001484 emulate_1op("dec", c->dst, ctxt->eflags);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001485 break;
Mohammed Gamald19292e2008-09-08 21:47:19 +03001486 case 2: /* call near abs */ {
1487 long int old_eip;
1488 old_eip = c->eip;
1489 c->eip = c->src.val;
1490 c->src.val = old_eip;
Gleb Natapov79168fd2010-04-28 19:15:30 +03001491 emulate_push(ctxt, ops);
Mohammed Gamald19292e2008-09-08 21:47:19 +03001492 break;
1493 }
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001494 case 4: /* jmp abs */
Avi Kivityfd607542008-01-18 13:12:26 +02001495 c->eip = c->src.val;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001496 break;
1497 case 6: /* push */
Gleb Natapov79168fd2010-04-28 19:15:30 +03001498 emulate_push(ctxt, ops);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001499 break;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001500 }
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09001501 return X86EMUL_CONTINUE;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001502}
1503
1504static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
Gleb Natapov69f55cb2010-03-18 15:20:20 +02001505 struct x86_emulate_ops *ops)
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001506{
1507 struct decode_cache *c = &ctxt->decode;
Avi Kivity16518d52010-08-26 14:31:30 +03001508 u64 old = c->dst.orig_val64;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001509
1510 if (((u32) (old >> 0) != (u32) c->regs[VCPU_REGS_RAX]) ||
1511 ((u32) (old >> 32) != (u32) c->regs[VCPU_REGS_RDX])) {
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001512 c->regs[VCPU_REGS_RAX] = (u32) (old >> 0);
1513 c->regs[VCPU_REGS_RDX] = (u32) (old >> 32);
Laurent Vivier05f086f2007-09-24 11:10:55 +02001514 ctxt->eflags &= ~EFLG_ZF;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001515 } else {
Avi Kivity16518d52010-08-26 14:31:30 +03001516 c->dst.val64 = ((u64)c->regs[VCPU_REGS_RCX] << 32) |
1517 (u32) c->regs[VCPU_REGS_RBX];
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001518
Laurent Vivier05f086f2007-09-24 11:10:55 +02001519 ctxt->eflags |= EFLG_ZF;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001520 }
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09001521 return X86EMUL_CONTINUE;
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02001522}
1523
Avi Kivitya77ab5e2009-01-05 13:27:34 +02001524static int emulate_ret_far(struct x86_emulate_ctxt *ctxt,
1525 struct x86_emulate_ops *ops)
1526{
1527 struct decode_cache *c = &ctxt->decode;
1528 int rc;
1529 unsigned long cs;
1530
1531 rc = emulate_pop(ctxt, ops, &c->eip, c->op_bytes);
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09001532 if (rc != X86EMUL_CONTINUE)
Avi Kivitya77ab5e2009-01-05 13:27:34 +02001533 return rc;
1534 if (c->op_bytes == 4)
1535 c->eip = (u32)c->eip;
1536 rc = emulate_pop(ctxt, ops, &cs, c->op_bytes);
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09001537 if (rc != X86EMUL_CONTINUE)
Avi Kivitya77ab5e2009-01-05 13:27:34 +02001538 return rc;
Gleb Natapov2e873022010-03-18 15:20:18 +02001539 rc = load_segment_descriptor(ctxt, ops, (u16)cs, VCPU_SREG_CS);
Avi Kivitya77ab5e2009-01-05 13:27:34 +02001540 return rc;
1541}
1542
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08001543static int emulate_load_segment(struct x86_emulate_ctxt *ctxt,
1544 struct x86_emulate_ops *ops, int seg)
1545{
1546 struct decode_cache *c = &ctxt->decode;
1547 unsigned short sel;
1548 int rc;
1549
1550 memcpy(&sel, c->src.valptr + c->op_bytes, 2);
1551
1552 rc = load_segment_descriptor(ctxt, ops, sel, seg);
1553 if (rc != X86EMUL_CONTINUE)
1554 return rc;
1555
1556 c->dst.val = c->src.val;
1557 return rc;
1558}
1559
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001560static inline void
1561setup_syscalls_segments(struct x86_emulate_ctxt *ctxt,
Gleb Natapov79168fd2010-04-28 19:15:30 +03001562 struct x86_emulate_ops *ops, struct desc_struct *cs,
1563 struct desc_struct *ss)
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001564{
Gleb Natapov79168fd2010-04-28 19:15:30 +03001565 memset(cs, 0, sizeof(struct desc_struct));
Gleb Natapov5601d052011-03-07 14:55:06 +02001566 ops->get_cached_descriptor(cs, NULL, VCPU_SREG_CS, ctxt->vcpu);
Gleb Natapov79168fd2010-04-28 19:15:30 +03001567 memset(ss, 0, sizeof(struct desc_struct));
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001568
1569 cs->l = 0; /* will be adjusted later */
Gleb Natapov79168fd2010-04-28 19:15:30 +03001570 set_desc_base(cs, 0); /* flat segment */
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001571 cs->g = 1; /* 4kb granularity */
Gleb Natapov79168fd2010-04-28 19:15:30 +03001572 set_desc_limit(cs, 0xfffff); /* 4GB limit */
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001573 cs->type = 0x0b; /* Read, Execute, Accessed */
1574 cs->s = 1;
1575 cs->dpl = 0; /* will be adjusted later */
Gleb Natapov79168fd2010-04-28 19:15:30 +03001576 cs->p = 1;
1577 cs->d = 1;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001578
Gleb Natapov79168fd2010-04-28 19:15:30 +03001579 set_desc_base(ss, 0); /* flat segment */
1580 set_desc_limit(ss, 0xfffff); /* 4GB limit */
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001581 ss->g = 1; /* 4kb granularity */
1582 ss->s = 1;
1583 ss->type = 0x03; /* Read/Write, Accessed */
Gleb Natapov79168fd2010-04-28 19:15:30 +03001584 ss->d = 1; /* 32bit stack segment */
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001585 ss->dpl = 0;
Gleb Natapov79168fd2010-04-28 19:15:30 +03001586 ss->p = 1;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001587}
1588
1589static int
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03001590emulate_syscall(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001591{
1592 struct decode_cache *c = &ctxt->decode;
Gleb Natapov79168fd2010-04-28 19:15:30 +03001593 struct desc_struct cs, ss;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001594 u64 msr_data;
Gleb Natapov79168fd2010-04-28 19:15:30 +03001595 u16 cs_sel, ss_sel;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001596
1597 /* syscall is not available in real mode */
Gleb Natapov2e901c42010-03-18 15:20:12 +02001598 if (ctxt->mode == X86EMUL_MODE_REAL ||
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001599 ctxt->mode == X86EMUL_MODE_VM86)
1600 return emulate_ud(ctxt);
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001601
Gleb Natapov79168fd2010-04-28 19:15:30 +03001602 setup_syscalls_segments(ctxt, ops, &cs, &ss);
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001603
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03001604 ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001605 msr_data >>= 32;
Gleb Natapov79168fd2010-04-28 19:15:30 +03001606 cs_sel = (u16)(msr_data & 0xfffc);
1607 ss_sel = (u16)(msr_data + 8);
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001608
1609 if (is_long_mode(ctxt->vcpu)) {
Gleb Natapov79168fd2010-04-28 19:15:30 +03001610 cs.d = 0;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001611 cs.l = 1;
1612 }
Gleb Natapov5601d052011-03-07 14:55:06 +02001613 ops->set_cached_descriptor(&cs, 0, VCPU_SREG_CS, ctxt->vcpu);
Gleb Natapov79168fd2010-04-28 19:15:30 +03001614 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
Gleb Natapov5601d052011-03-07 14:55:06 +02001615 ops->set_cached_descriptor(&ss, 0, VCPU_SREG_SS, ctxt->vcpu);
Gleb Natapov79168fd2010-04-28 19:15:30 +03001616 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001617
1618 c->regs[VCPU_REGS_RCX] = c->eip;
1619 if (is_long_mode(ctxt->vcpu)) {
1620#ifdef CONFIG_X86_64
1621 c->regs[VCPU_REGS_R11] = ctxt->eflags & ~EFLG_RF;
1622
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03001623 ops->get_msr(ctxt->vcpu,
1624 ctxt->mode == X86EMUL_MODE_PROT64 ?
1625 MSR_LSTAR : MSR_CSTAR, &msr_data);
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001626 c->eip = msr_data;
1627
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03001628 ops->get_msr(ctxt->vcpu, MSR_SYSCALL_MASK, &msr_data);
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001629 ctxt->eflags &= ~(msr_data | EFLG_RF);
1630#endif
1631 } else {
1632 /* legacy mode */
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03001633 ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001634 c->eip = (u32)msr_data;
1635
1636 ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
1637 }
1638
Takuya Yoshikawae54cfa92010-02-18 12:15:02 +02001639 return X86EMUL_CONTINUE;
Andre Przywarae66bb2c2009-06-18 12:56:00 +02001640}
1641
Andre Przywara8c604352009-06-18 12:56:01 +02001642static int
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03001643emulate_sysenter(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
Andre Przywara8c604352009-06-18 12:56:01 +02001644{
1645 struct decode_cache *c = &ctxt->decode;
Gleb Natapov79168fd2010-04-28 19:15:30 +03001646 struct desc_struct cs, ss;
Andre Przywara8c604352009-06-18 12:56:01 +02001647 u64 msr_data;
Gleb Natapov79168fd2010-04-28 19:15:30 +03001648 u16 cs_sel, ss_sel;
Andre Przywara8c604352009-06-18 12:56:01 +02001649
Gleb Natapova0044752010-02-10 14:21:31 +02001650 /* inject #GP if in real mode */
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001651 if (ctxt->mode == X86EMUL_MODE_REAL)
1652 return emulate_gp(ctxt, 0);
Andre Przywara8c604352009-06-18 12:56:01 +02001653
1654 /* XXX sysenter/sysexit have not been tested in 64bit mode.
1655 * Therefore, we inject an #UD.
1656 */
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001657 if (ctxt->mode == X86EMUL_MODE_PROT64)
1658 return emulate_ud(ctxt);
Andre Przywara8c604352009-06-18 12:56:01 +02001659
Gleb Natapov79168fd2010-04-28 19:15:30 +03001660 setup_syscalls_segments(ctxt, ops, &cs, &ss);
Andre Przywara8c604352009-06-18 12:56:01 +02001661
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03001662 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_CS, &msr_data);
Andre Przywara8c604352009-06-18 12:56:01 +02001663 switch (ctxt->mode) {
1664 case X86EMUL_MODE_PROT32:
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001665 if ((msr_data & 0xfffc) == 0x0)
1666 return emulate_gp(ctxt, 0);
Andre Przywara8c604352009-06-18 12:56:01 +02001667 break;
1668 case X86EMUL_MODE_PROT64:
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001669 if (msr_data == 0x0)
1670 return emulate_gp(ctxt, 0);
Andre Przywara8c604352009-06-18 12:56:01 +02001671 break;
1672 }
1673
1674 ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
Gleb Natapov79168fd2010-04-28 19:15:30 +03001675 cs_sel = (u16)msr_data;
1676 cs_sel &= ~SELECTOR_RPL_MASK;
1677 ss_sel = cs_sel + 8;
1678 ss_sel &= ~SELECTOR_RPL_MASK;
Andre Przywara8c604352009-06-18 12:56:01 +02001679 if (ctxt->mode == X86EMUL_MODE_PROT64
1680 || is_long_mode(ctxt->vcpu)) {
Gleb Natapov79168fd2010-04-28 19:15:30 +03001681 cs.d = 0;
Andre Przywara8c604352009-06-18 12:56:01 +02001682 cs.l = 1;
1683 }
1684
Gleb Natapov5601d052011-03-07 14:55:06 +02001685 ops->set_cached_descriptor(&cs, 0, VCPU_SREG_CS, ctxt->vcpu);
Gleb Natapov79168fd2010-04-28 19:15:30 +03001686 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
Gleb Natapov5601d052011-03-07 14:55:06 +02001687 ops->set_cached_descriptor(&ss, 0, VCPU_SREG_SS, ctxt->vcpu);
Gleb Natapov79168fd2010-04-28 19:15:30 +03001688 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
Andre Przywara8c604352009-06-18 12:56:01 +02001689
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03001690 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_EIP, &msr_data);
Andre Przywara8c604352009-06-18 12:56:01 +02001691 c->eip = msr_data;
1692
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03001693 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_ESP, &msr_data);
Andre Przywara8c604352009-06-18 12:56:01 +02001694 c->regs[VCPU_REGS_RSP] = msr_data;
1695
Takuya Yoshikawae54cfa92010-02-18 12:15:02 +02001696 return X86EMUL_CONTINUE;
Andre Przywara8c604352009-06-18 12:56:01 +02001697}
1698
Andre Przywara4668f052009-06-18 12:56:02 +02001699static int
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03001700emulate_sysexit(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
Andre Przywara4668f052009-06-18 12:56:02 +02001701{
1702 struct decode_cache *c = &ctxt->decode;
Gleb Natapov79168fd2010-04-28 19:15:30 +03001703 struct desc_struct cs, ss;
Andre Przywara4668f052009-06-18 12:56:02 +02001704 u64 msr_data;
1705 int usermode;
Gleb Natapov79168fd2010-04-28 19:15:30 +03001706 u16 cs_sel, ss_sel;
Andre Przywara4668f052009-06-18 12:56:02 +02001707
Gleb Natapova0044752010-02-10 14:21:31 +02001708 /* inject #GP if in real mode or Virtual 8086 mode */
1709 if (ctxt->mode == X86EMUL_MODE_REAL ||
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001710 ctxt->mode == X86EMUL_MODE_VM86)
1711 return emulate_gp(ctxt, 0);
Andre Przywara4668f052009-06-18 12:56:02 +02001712
Gleb Natapov79168fd2010-04-28 19:15:30 +03001713 setup_syscalls_segments(ctxt, ops, &cs, &ss);
Andre Przywara4668f052009-06-18 12:56:02 +02001714
1715 if ((c->rex_prefix & 0x8) != 0x0)
1716 usermode = X86EMUL_MODE_PROT64;
1717 else
1718 usermode = X86EMUL_MODE_PROT32;
1719
1720 cs.dpl = 3;
1721 ss.dpl = 3;
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03001722 ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_CS, &msr_data);
Andre Przywara4668f052009-06-18 12:56:02 +02001723 switch (usermode) {
1724 case X86EMUL_MODE_PROT32:
Gleb Natapov79168fd2010-04-28 19:15:30 +03001725 cs_sel = (u16)(msr_data + 16);
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001726 if ((msr_data & 0xfffc) == 0x0)
1727 return emulate_gp(ctxt, 0);
Gleb Natapov79168fd2010-04-28 19:15:30 +03001728 ss_sel = (u16)(msr_data + 24);
Andre Przywara4668f052009-06-18 12:56:02 +02001729 break;
1730 case X86EMUL_MODE_PROT64:
Gleb Natapov79168fd2010-04-28 19:15:30 +03001731 cs_sel = (u16)(msr_data + 32);
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001732 if (msr_data == 0x0)
1733 return emulate_gp(ctxt, 0);
Gleb Natapov79168fd2010-04-28 19:15:30 +03001734 ss_sel = cs_sel + 8;
1735 cs.d = 0;
Andre Przywara4668f052009-06-18 12:56:02 +02001736 cs.l = 1;
1737 break;
1738 }
Gleb Natapov79168fd2010-04-28 19:15:30 +03001739 cs_sel |= SELECTOR_RPL_MASK;
1740 ss_sel |= SELECTOR_RPL_MASK;
Andre Przywara4668f052009-06-18 12:56:02 +02001741
Gleb Natapov5601d052011-03-07 14:55:06 +02001742 ops->set_cached_descriptor(&cs, 0, VCPU_SREG_CS, ctxt->vcpu);
Gleb Natapov79168fd2010-04-28 19:15:30 +03001743 ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
Gleb Natapov5601d052011-03-07 14:55:06 +02001744 ops->set_cached_descriptor(&ss, 0, VCPU_SREG_SS, ctxt->vcpu);
Gleb Natapov79168fd2010-04-28 19:15:30 +03001745 ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
Andre Przywara4668f052009-06-18 12:56:02 +02001746
Gleb Natapovbdb475a2010-04-28 19:15:41 +03001747 c->eip = c->regs[VCPU_REGS_RDX];
1748 c->regs[VCPU_REGS_RSP] = c->regs[VCPU_REGS_RCX];
Andre Przywara4668f052009-06-18 12:56:02 +02001749
Takuya Yoshikawae54cfa92010-02-18 12:15:02 +02001750 return X86EMUL_CONTINUE;
Andre Przywara4668f052009-06-18 12:56:02 +02001751}
1752
Gleb Natapov9c537242010-03-18 15:20:05 +02001753static bool emulator_bad_iopl(struct x86_emulate_ctxt *ctxt,
1754 struct x86_emulate_ops *ops)
Gleb Natapovf850e2e2010-02-10 14:21:33 +02001755{
1756 int iopl;
1757 if (ctxt->mode == X86EMUL_MODE_REAL)
1758 return false;
1759 if (ctxt->mode == X86EMUL_MODE_VM86)
1760 return true;
1761 iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
Gleb Natapov9c537242010-03-18 15:20:05 +02001762 return ops->cpl(ctxt->vcpu) > iopl;
Gleb Natapovf850e2e2010-02-10 14:21:33 +02001763}
1764
1765static bool emulator_io_port_access_allowed(struct x86_emulate_ctxt *ctxt,
1766 struct x86_emulate_ops *ops,
1767 u16 port, u16 len)
1768{
Gleb Natapov79168fd2010-04-28 19:15:30 +03001769 struct desc_struct tr_seg;
Gleb Natapov5601d052011-03-07 14:55:06 +02001770 u32 base3;
Gleb Natapovf850e2e2010-02-10 14:21:33 +02001771 int r;
1772 u16 io_bitmap_ptr;
1773 u8 perm, bit_idx = port & 0x7;
1774 unsigned mask = (1 << len) - 1;
Gleb Natapov5601d052011-03-07 14:55:06 +02001775 unsigned long base;
Gleb Natapovf850e2e2010-02-10 14:21:33 +02001776
Gleb Natapov5601d052011-03-07 14:55:06 +02001777 ops->get_cached_descriptor(&tr_seg, &base3, VCPU_SREG_TR, ctxt->vcpu);
Gleb Natapov79168fd2010-04-28 19:15:30 +03001778 if (!tr_seg.p)
Gleb Natapovf850e2e2010-02-10 14:21:33 +02001779 return false;
Gleb Natapov79168fd2010-04-28 19:15:30 +03001780 if (desc_limit_scaled(&tr_seg) < 103)
Gleb Natapovf850e2e2010-02-10 14:21:33 +02001781 return false;
Gleb Natapov5601d052011-03-07 14:55:06 +02001782 base = get_desc_base(&tr_seg);
1783#ifdef CONFIG_X86_64
1784 base |= ((u64)base3) << 32;
1785#endif
1786 r = ops->read_std(base + 102, &io_bitmap_ptr, 2, ctxt->vcpu, NULL);
Gleb Natapovf850e2e2010-02-10 14:21:33 +02001787 if (r != X86EMUL_CONTINUE)
1788 return false;
Gleb Natapov79168fd2010-04-28 19:15:30 +03001789 if (io_bitmap_ptr + port/8 > desc_limit_scaled(&tr_seg))
Gleb Natapovf850e2e2010-02-10 14:21:33 +02001790 return false;
Gleb Natapov5601d052011-03-07 14:55:06 +02001791 r = ops->read_std(base + io_bitmap_ptr + port/8, &perm, 1, ctxt->vcpu,
1792 NULL);
Gleb Natapovf850e2e2010-02-10 14:21:33 +02001793 if (r != X86EMUL_CONTINUE)
1794 return false;
1795 if ((perm >> bit_idx) & mask)
1796 return false;
1797 return true;
1798}
1799
1800static bool emulator_io_permited(struct x86_emulate_ctxt *ctxt,
1801 struct x86_emulate_ops *ops,
1802 u16 port, u16 len)
1803{
Gleb Natapov4fc40f02010-08-02 12:47:51 +03001804 if (ctxt->perm_ok)
1805 return true;
1806
Gleb Natapov9c537242010-03-18 15:20:05 +02001807 if (emulator_bad_iopl(ctxt, ops))
Gleb Natapovf850e2e2010-02-10 14:21:33 +02001808 if (!emulator_io_port_access_allowed(ctxt, ops, port, len))
1809 return false;
Gleb Natapov4fc40f02010-08-02 12:47:51 +03001810
1811 ctxt->perm_ok = true;
1812
Gleb Natapovf850e2e2010-02-10 14:21:33 +02001813 return true;
1814}
1815
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001816static void save_state_to_tss16(struct x86_emulate_ctxt *ctxt,
1817 struct x86_emulate_ops *ops,
1818 struct tss_segment_16 *tss)
1819{
1820 struct decode_cache *c = &ctxt->decode;
1821
1822 tss->ip = c->eip;
1823 tss->flag = ctxt->eflags;
1824 tss->ax = c->regs[VCPU_REGS_RAX];
1825 tss->cx = c->regs[VCPU_REGS_RCX];
1826 tss->dx = c->regs[VCPU_REGS_RDX];
1827 tss->bx = c->regs[VCPU_REGS_RBX];
1828 tss->sp = c->regs[VCPU_REGS_RSP];
1829 tss->bp = c->regs[VCPU_REGS_RBP];
1830 tss->si = c->regs[VCPU_REGS_RSI];
1831 tss->di = c->regs[VCPU_REGS_RDI];
1832
1833 tss->es = ops->get_segment_selector(VCPU_SREG_ES, ctxt->vcpu);
1834 tss->cs = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
1835 tss->ss = ops->get_segment_selector(VCPU_SREG_SS, ctxt->vcpu);
1836 tss->ds = ops->get_segment_selector(VCPU_SREG_DS, ctxt->vcpu);
1837 tss->ldt = ops->get_segment_selector(VCPU_SREG_LDTR, ctxt->vcpu);
1838}
1839
1840static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
1841 struct x86_emulate_ops *ops,
1842 struct tss_segment_16 *tss)
1843{
1844 struct decode_cache *c = &ctxt->decode;
1845 int ret;
1846
1847 c->eip = tss->ip;
1848 ctxt->eflags = tss->flag | 2;
1849 c->regs[VCPU_REGS_RAX] = tss->ax;
1850 c->regs[VCPU_REGS_RCX] = tss->cx;
1851 c->regs[VCPU_REGS_RDX] = tss->dx;
1852 c->regs[VCPU_REGS_RBX] = tss->bx;
1853 c->regs[VCPU_REGS_RSP] = tss->sp;
1854 c->regs[VCPU_REGS_RBP] = tss->bp;
1855 c->regs[VCPU_REGS_RSI] = tss->si;
1856 c->regs[VCPU_REGS_RDI] = tss->di;
1857
1858 /*
1859 * SDM says that segment selectors are loaded before segment
1860 * descriptors
1861 */
1862 ops->set_segment_selector(tss->ldt, VCPU_SREG_LDTR, ctxt->vcpu);
1863 ops->set_segment_selector(tss->es, VCPU_SREG_ES, ctxt->vcpu);
1864 ops->set_segment_selector(tss->cs, VCPU_SREG_CS, ctxt->vcpu);
1865 ops->set_segment_selector(tss->ss, VCPU_SREG_SS, ctxt->vcpu);
1866 ops->set_segment_selector(tss->ds, VCPU_SREG_DS, ctxt->vcpu);
1867
1868 /*
1869 * Now load segment descriptors. If fault happenes at this stage
1870 * it is handled in a context of new task
1871 */
1872 ret = load_segment_descriptor(ctxt, ops, tss->ldt, VCPU_SREG_LDTR);
1873 if (ret != X86EMUL_CONTINUE)
1874 return ret;
1875 ret = load_segment_descriptor(ctxt, ops, tss->es, VCPU_SREG_ES);
1876 if (ret != X86EMUL_CONTINUE)
1877 return ret;
1878 ret = load_segment_descriptor(ctxt, ops, tss->cs, VCPU_SREG_CS);
1879 if (ret != X86EMUL_CONTINUE)
1880 return ret;
1881 ret = load_segment_descriptor(ctxt, ops, tss->ss, VCPU_SREG_SS);
1882 if (ret != X86EMUL_CONTINUE)
1883 return ret;
1884 ret = load_segment_descriptor(ctxt, ops, tss->ds, VCPU_SREG_DS);
1885 if (ret != X86EMUL_CONTINUE)
1886 return ret;
1887
1888 return X86EMUL_CONTINUE;
1889}
1890
1891static int task_switch_16(struct x86_emulate_ctxt *ctxt,
1892 struct x86_emulate_ops *ops,
1893 u16 tss_selector, u16 old_tss_sel,
1894 ulong old_tss_base, struct desc_struct *new_desc)
1895{
1896 struct tss_segment_16 tss_seg;
1897 int ret;
Avi Kivitybcc55cb2010-11-22 17:53:22 +02001898 u32 new_tss_base = get_desc_base(new_desc);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001899
1900 ret = ops->read_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02001901 &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02001902 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001903 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001904 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001905
1906 save_state_to_tss16(ctxt, ops, &tss_seg);
1907
1908 ret = ops->write_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02001909 &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02001910 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001911 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001912 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001913
1914 ret = ops->read_std(new_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02001915 &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02001916 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001917 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001918 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001919
1920 if (old_tss_sel != 0xffff) {
1921 tss_seg.prev_task_link = old_tss_sel;
1922
1923 ret = ops->write_std(new_tss_base,
1924 &tss_seg.prev_task_link,
1925 sizeof tss_seg.prev_task_link,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02001926 ctxt->vcpu, &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02001927 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001928 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001929 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001930 }
1931
1932 return load_state_from_tss16(ctxt, ops, &tss_seg);
1933}
1934
1935static void save_state_to_tss32(struct x86_emulate_ctxt *ctxt,
1936 struct x86_emulate_ops *ops,
1937 struct tss_segment_32 *tss)
1938{
1939 struct decode_cache *c = &ctxt->decode;
1940
1941 tss->cr3 = ops->get_cr(3, ctxt->vcpu);
1942 tss->eip = c->eip;
1943 tss->eflags = ctxt->eflags;
1944 tss->eax = c->regs[VCPU_REGS_RAX];
1945 tss->ecx = c->regs[VCPU_REGS_RCX];
1946 tss->edx = c->regs[VCPU_REGS_RDX];
1947 tss->ebx = c->regs[VCPU_REGS_RBX];
1948 tss->esp = c->regs[VCPU_REGS_RSP];
1949 tss->ebp = c->regs[VCPU_REGS_RBP];
1950 tss->esi = c->regs[VCPU_REGS_RSI];
1951 tss->edi = c->regs[VCPU_REGS_RDI];
1952
1953 tss->es = ops->get_segment_selector(VCPU_SREG_ES, ctxt->vcpu);
1954 tss->cs = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
1955 tss->ss = ops->get_segment_selector(VCPU_SREG_SS, ctxt->vcpu);
1956 tss->ds = ops->get_segment_selector(VCPU_SREG_DS, ctxt->vcpu);
1957 tss->fs = ops->get_segment_selector(VCPU_SREG_FS, ctxt->vcpu);
1958 tss->gs = ops->get_segment_selector(VCPU_SREG_GS, ctxt->vcpu);
1959 tss->ldt_selector = ops->get_segment_selector(VCPU_SREG_LDTR, ctxt->vcpu);
1960}
1961
1962static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
1963 struct x86_emulate_ops *ops,
1964 struct tss_segment_32 *tss)
1965{
1966 struct decode_cache *c = &ctxt->decode;
1967 int ret;
1968
Avi Kivity35d3d4a2010-11-22 17:53:25 +02001969 if (ops->set_cr(3, tss->cr3, ctxt->vcpu))
1970 return emulate_gp(ctxt, 0);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02001971 c->eip = tss->eip;
1972 ctxt->eflags = tss->eflags | 2;
1973 c->regs[VCPU_REGS_RAX] = tss->eax;
1974 c->regs[VCPU_REGS_RCX] = tss->ecx;
1975 c->regs[VCPU_REGS_RDX] = tss->edx;
1976 c->regs[VCPU_REGS_RBX] = tss->ebx;
1977 c->regs[VCPU_REGS_RSP] = tss->esp;
1978 c->regs[VCPU_REGS_RBP] = tss->ebp;
1979 c->regs[VCPU_REGS_RSI] = tss->esi;
1980 c->regs[VCPU_REGS_RDI] = tss->edi;
1981
1982 /*
1983 * SDM says that segment selectors are loaded before segment
1984 * descriptors
1985 */
1986 ops->set_segment_selector(tss->ldt_selector, VCPU_SREG_LDTR, ctxt->vcpu);
1987 ops->set_segment_selector(tss->es, VCPU_SREG_ES, ctxt->vcpu);
1988 ops->set_segment_selector(tss->cs, VCPU_SREG_CS, ctxt->vcpu);
1989 ops->set_segment_selector(tss->ss, VCPU_SREG_SS, ctxt->vcpu);
1990 ops->set_segment_selector(tss->ds, VCPU_SREG_DS, ctxt->vcpu);
1991 ops->set_segment_selector(tss->fs, VCPU_SREG_FS, ctxt->vcpu);
1992 ops->set_segment_selector(tss->gs, VCPU_SREG_GS, ctxt->vcpu);
1993
1994 /*
1995 * Now load segment descriptors. If fault happenes at this stage
1996 * it is handled in a context of new task
1997 */
1998 ret = load_segment_descriptor(ctxt, ops, tss->ldt_selector, VCPU_SREG_LDTR);
1999 if (ret != X86EMUL_CONTINUE)
2000 return ret;
2001 ret = load_segment_descriptor(ctxt, ops, tss->es, VCPU_SREG_ES);
2002 if (ret != X86EMUL_CONTINUE)
2003 return ret;
2004 ret = load_segment_descriptor(ctxt, ops, tss->cs, VCPU_SREG_CS);
2005 if (ret != X86EMUL_CONTINUE)
2006 return ret;
2007 ret = load_segment_descriptor(ctxt, ops, tss->ss, VCPU_SREG_SS);
2008 if (ret != X86EMUL_CONTINUE)
2009 return ret;
2010 ret = load_segment_descriptor(ctxt, ops, tss->ds, VCPU_SREG_DS);
2011 if (ret != X86EMUL_CONTINUE)
2012 return ret;
2013 ret = load_segment_descriptor(ctxt, ops, tss->fs, VCPU_SREG_FS);
2014 if (ret != X86EMUL_CONTINUE)
2015 return ret;
2016 ret = load_segment_descriptor(ctxt, ops, tss->gs, VCPU_SREG_GS);
2017 if (ret != X86EMUL_CONTINUE)
2018 return ret;
2019
2020 return X86EMUL_CONTINUE;
2021}
2022
2023static int task_switch_32(struct x86_emulate_ctxt *ctxt,
2024 struct x86_emulate_ops *ops,
2025 u16 tss_selector, u16 old_tss_sel,
2026 ulong old_tss_base, struct desc_struct *new_desc)
2027{
2028 struct tss_segment_32 tss_seg;
2029 int ret;
Avi Kivitybcc55cb2010-11-22 17:53:22 +02002030 u32 new_tss_base = get_desc_base(new_desc);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002031
2032 ret = ops->read_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02002033 &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02002034 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002035 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002036 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002037
2038 save_state_to_tss32(ctxt, ops, &tss_seg);
2039
2040 ret = ops->write_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02002041 &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02002042 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002043 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002044 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002045
2046 ret = ops->read_std(new_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02002047 &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02002048 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002049 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002050 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002051
2052 if (old_tss_sel != 0xffff) {
2053 tss_seg.prev_task_link = old_tss_sel;
2054
2055 ret = ops->write_std(new_tss_base,
2056 &tss_seg.prev_task_link,
2057 sizeof tss_seg.prev_task_link,
Avi Kivitybcc55cb2010-11-22 17:53:22 +02002058 ctxt->vcpu, &ctxt->exception);
Avi Kivitydb297e32010-11-22 17:53:24 +02002059 if (ret != X86EMUL_CONTINUE)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002060 /* FIXME: need to provide precise fault address */
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002061 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002062 }
2063
2064 return load_state_from_tss32(ctxt, ops, &tss_seg);
2065}
2066
2067static int emulator_do_task_switch(struct x86_emulate_ctxt *ctxt,
Jan Kiszkae269fb22010-04-14 15:51:09 +02002068 struct x86_emulate_ops *ops,
2069 u16 tss_selector, int reason,
2070 bool has_error_code, u32 error_code)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002071{
2072 struct desc_struct curr_tss_desc, next_tss_desc;
2073 int ret;
2074 u16 old_tss_sel = ops->get_segment_selector(VCPU_SREG_TR, ctxt->vcpu);
2075 ulong old_tss_base =
Gleb Natapov5951c442010-04-28 19:15:29 +03002076 ops->get_cached_segment_base(VCPU_SREG_TR, ctxt->vcpu);
Gleb Natapovceffb452010-03-18 15:20:19 +02002077 u32 desc_limit;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002078
2079 /* FIXME: old_tss_base == ~0 ? */
2080
2081 ret = read_segment_descriptor(ctxt, ops, tss_selector, &next_tss_desc);
2082 if (ret != X86EMUL_CONTINUE)
2083 return ret;
2084 ret = read_segment_descriptor(ctxt, ops, old_tss_sel, &curr_tss_desc);
2085 if (ret != X86EMUL_CONTINUE)
2086 return ret;
2087
2088 /* FIXME: check that next_tss_desc is tss */
2089
2090 if (reason != TASK_SWITCH_IRET) {
2091 if ((tss_selector & 3) > next_tss_desc.dpl ||
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002092 ops->cpl(ctxt->vcpu) > next_tss_desc.dpl)
2093 return emulate_gp(ctxt, 0);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002094 }
2095
Gleb Natapovceffb452010-03-18 15:20:19 +02002096 desc_limit = desc_limit_scaled(&next_tss_desc);
2097 if (!next_tss_desc.p ||
2098 ((desc_limit < 0x67 && (next_tss_desc.type & 8)) ||
2099 desc_limit < 0x2b)) {
Gleb Natapov54b84862010-04-28 19:15:44 +03002100 emulate_ts(ctxt, tss_selector & 0xfffc);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002101 return X86EMUL_PROPAGATE_FAULT;
2102 }
2103
2104 if (reason == TASK_SWITCH_IRET || reason == TASK_SWITCH_JMP) {
2105 curr_tss_desc.type &= ~(1 << 1); /* clear busy flag */
2106 write_segment_descriptor(ctxt, ops, old_tss_sel,
2107 &curr_tss_desc);
2108 }
2109
2110 if (reason == TASK_SWITCH_IRET)
2111 ctxt->eflags = ctxt->eflags & ~X86_EFLAGS_NT;
2112
2113 /* set back link to prev task only if NT bit is set in eflags
2114 note that old_tss_sel is not used afetr this point */
2115 if (reason != TASK_SWITCH_CALL && reason != TASK_SWITCH_GATE)
2116 old_tss_sel = 0xffff;
2117
2118 if (next_tss_desc.type & 8)
2119 ret = task_switch_32(ctxt, ops, tss_selector, old_tss_sel,
2120 old_tss_base, &next_tss_desc);
2121 else
2122 ret = task_switch_16(ctxt, ops, tss_selector, old_tss_sel,
2123 old_tss_base, &next_tss_desc);
Jan Kiszka0760d442010-04-14 15:50:57 +02002124 if (ret != X86EMUL_CONTINUE)
2125 return ret;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002126
2127 if (reason == TASK_SWITCH_CALL || reason == TASK_SWITCH_GATE)
2128 ctxt->eflags = ctxt->eflags | X86_EFLAGS_NT;
2129
2130 if (reason != TASK_SWITCH_IRET) {
2131 next_tss_desc.type |= (1 << 1); /* set busy flag */
2132 write_segment_descriptor(ctxt, ops, tss_selector,
2133 &next_tss_desc);
2134 }
2135
2136 ops->set_cr(0, ops->get_cr(0, ctxt->vcpu) | X86_CR0_TS, ctxt->vcpu);
Gleb Natapov5601d052011-03-07 14:55:06 +02002137 ops->set_cached_descriptor(&next_tss_desc, 0, VCPU_SREG_TR, ctxt->vcpu);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002138 ops->set_segment_selector(tss_selector, VCPU_SREG_TR, ctxt->vcpu);
2139
Jan Kiszkae269fb22010-04-14 15:51:09 +02002140 if (has_error_code) {
2141 struct decode_cache *c = &ctxt->decode;
2142
2143 c->op_bytes = c->ad_bytes = (next_tss_desc.type & 8) ? 4 : 2;
2144 c->lock_prefix = 0;
2145 c->src.val = (unsigned long) error_code;
Gleb Natapov79168fd2010-04-28 19:15:30 +03002146 emulate_push(ctxt, ops);
Jan Kiszkae269fb22010-04-14 15:51:09 +02002147 }
2148
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002149 return ret;
2150}
2151
2152int emulator_task_switch(struct x86_emulate_ctxt *ctxt,
Jan Kiszkae269fb22010-04-14 15:51:09 +02002153 u16 tss_selector, int reason,
2154 bool has_error_code, u32 error_code)
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002155{
Avi Kivity9aabc88f2010-07-29 15:11:50 +03002156 struct x86_emulate_ops *ops = ctxt->ops;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002157 struct decode_cache *c = &ctxt->decode;
2158 int rc;
2159
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002160 c->eip = ctxt->eip;
Jan Kiszkae269fb22010-04-14 15:51:09 +02002161 c->dst.type = OP_NONE;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002162
Jan Kiszkae269fb22010-04-14 15:51:09 +02002163 rc = emulator_do_task_switch(ctxt, ops, tss_selector, reason,
2164 has_error_code, error_code);
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002165
2166 if (rc == X86EMUL_CONTINUE) {
Jan Kiszkae269fb22010-04-14 15:51:09 +02002167 rc = writeback(ctxt, ops);
Gleb Natapov95c55882010-04-28 19:15:39 +03002168 if (rc == X86EMUL_CONTINUE)
2169 ctxt->eip = c->eip;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002170 }
2171
Gleb Natapov19d04432010-04-15 12:29:50 +03002172 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
Gleb Natapov38ba30b2010-03-18 15:20:17 +02002173}
2174
Avi Kivity90de84f2010-11-17 15:28:21 +02002175static void string_addr_inc(struct x86_emulate_ctxt *ctxt, unsigned seg,
Gleb Natapovd9271122010-03-18 15:20:22 +02002176 int reg, struct operand *op)
Gleb Natapova682e352010-03-18 15:20:21 +02002177{
2178 struct decode_cache *c = &ctxt->decode;
2179 int df = (ctxt->eflags & EFLG_DF) ? -1 : 1;
2180
Gleb Natapovd9271122010-03-18 15:20:22 +02002181 register_address_increment(c, &c->regs[reg], df * op->bytes);
Avi Kivity90de84f2010-11-17 15:28:21 +02002182 op->addr.mem.ea = register_address(c, c->regs[reg]);
2183 op->addr.mem.seg = seg;
Gleb Natapova682e352010-03-18 15:20:21 +02002184}
2185
Avi Kivity63540382010-07-29 15:11:55 +03002186static int em_push(struct x86_emulate_ctxt *ctxt)
2187{
2188 emulate_push(ctxt, ctxt->ops);
2189 return X86EMUL_CONTINUE;
2190}
2191
Avi Kivity7af04fc2010-08-18 14:16:35 +03002192static int em_das(struct x86_emulate_ctxt *ctxt)
2193{
2194 struct decode_cache *c = &ctxt->decode;
2195 u8 al, old_al;
2196 bool af, cf, old_cf;
2197
2198 cf = ctxt->eflags & X86_EFLAGS_CF;
2199 al = c->dst.val;
2200
2201 old_al = al;
2202 old_cf = cf;
2203 cf = false;
2204 af = ctxt->eflags & X86_EFLAGS_AF;
2205 if ((al & 0x0f) > 9 || af) {
2206 al -= 6;
2207 cf = old_cf | (al >= 250);
2208 af = true;
2209 } else {
2210 af = false;
2211 }
2212 if (old_al > 0x99 || old_cf) {
2213 al -= 0x60;
2214 cf = true;
2215 }
2216
2217 c->dst.val = al;
2218 /* Set PF, ZF, SF */
2219 c->src.type = OP_IMM;
2220 c->src.val = 0;
2221 c->src.bytes = 1;
2222 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
2223 ctxt->eflags &= ~(X86_EFLAGS_AF | X86_EFLAGS_CF);
2224 if (cf)
2225 ctxt->eflags |= X86_EFLAGS_CF;
2226 if (af)
2227 ctxt->eflags |= X86_EFLAGS_AF;
2228 return X86EMUL_CONTINUE;
2229}
2230
Avi Kivity0ef753b2010-08-18 14:51:45 +03002231static int em_call_far(struct x86_emulate_ctxt *ctxt)
2232{
2233 struct decode_cache *c = &ctxt->decode;
2234 u16 sel, old_cs;
2235 ulong old_eip;
2236 int rc;
2237
2238 old_cs = ctxt->ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
2239 old_eip = c->eip;
2240
2241 memcpy(&sel, c->src.valptr + c->op_bytes, 2);
2242 if (load_segment_descriptor(ctxt, ctxt->ops, sel, VCPU_SREG_CS))
2243 return X86EMUL_CONTINUE;
2244
2245 c->eip = 0;
2246 memcpy(&c->eip, c->src.valptr, c->op_bytes);
2247
2248 c->src.val = old_cs;
2249 emulate_push(ctxt, ctxt->ops);
2250 rc = writeback(ctxt, ctxt->ops);
2251 if (rc != X86EMUL_CONTINUE)
2252 return rc;
2253
2254 c->src.val = old_eip;
2255 emulate_push(ctxt, ctxt->ops);
2256 rc = writeback(ctxt, ctxt->ops);
2257 if (rc != X86EMUL_CONTINUE)
2258 return rc;
2259
2260 c->dst.type = OP_NONE;
2261
2262 return X86EMUL_CONTINUE;
2263}
2264
Avi Kivity40ece7c2010-08-18 15:12:09 +03002265static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt)
2266{
2267 struct decode_cache *c = &ctxt->decode;
2268 int rc;
2269
2270 c->dst.type = OP_REG;
2271 c->dst.addr.reg = &c->eip;
2272 c->dst.bytes = c->op_bytes;
2273 rc = emulate_pop(ctxt, ctxt->ops, &c->dst.val, c->op_bytes);
2274 if (rc != X86EMUL_CONTINUE)
2275 return rc;
2276 register_address_increment(c, &c->regs[VCPU_REGS_RSP], c->src.val);
2277 return X86EMUL_CONTINUE;
2278}
2279
Avi Kivity5c82aa22010-08-18 18:31:43 +03002280static int em_imul(struct x86_emulate_ctxt *ctxt)
2281{
2282 struct decode_cache *c = &ctxt->decode;
2283
2284 emulate_2op_SrcV_nobyte("imul", c->src, c->dst, ctxt->eflags);
2285 return X86EMUL_CONTINUE;
2286}
2287
Avi Kivityf3a1b9f2010-08-18 18:25:25 +03002288static int em_imul_3op(struct x86_emulate_ctxt *ctxt)
2289{
2290 struct decode_cache *c = &ctxt->decode;
2291
2292 c->dst.val = c->src2.val;
Avi Kivity5c82aa22010-08-18 18:31:43 +03002293 return em_imul(ctxt);
Avi Kivityf3a1b9f2010-08-18 18:25:25 +03002294}
2295
Avi Kivity61429142010-08-19 15:13:00 +03002296static int em_cwd(struct x86_emulate_ctxt *ctxt)
2297{
2298 struct decode_cache *c = &ctxt->decode;
2299
2300 c->dst.type = OP_REG;
2301 c->dst.bytes = c->src.bytes;
2302 c->dst.addr.reg = &c->regs[VCPU_REGS_RDX];
2303 c->dst.val = ~((c->src.val >> (c->src.bytes * 8 - 1)) - 1);
2304
2305 return X86EMUL_CONTINUE;
2306}
2307
Avi Kivity48bb5d32010-08-18 18:54:34 +03002308static int em_rdtsc(struct x86_emulate_ctxt *ctxt)
2309{
2310 unsigned cpl = ctxt->ops->cpl(ctxt->vcpu);
2311 struct decode_cache *c = &ctxt->decode;
2312 u64 tsc = 0;
2313
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002314 if (cpl > 0 && (ctxt->ops->get_cr(4, ctxt->vcpu) & X86_CR4_TSD))
2315 return emulate_gp(ctxt, 0);
Avi Kivity48bb5d32010-08-18 18:54:34 +03002316 ctxt->ops->get_msr(ctxt->vcpu, MSR_IA32_TSC, &tsc);
2317 c->regs[VCPU_REGS_RAX] = (u32)tsc;
2318 c->regs[VCPU_REGS_RDX] = tsc >> 32;
2319 return X86EMUL_CONTINUE;
2320}
2321
Avi Kivityb9eac5f2010-08-03 14:46:56 +03002322static int em_mov(struct x86_emulate_ctxt *ctxt)
2323{
2324 struct decode_cache *c = &ctxt->decode;
2325 c->dst.val = c->src.val;
2326 return X86EMUL_CONTINUE;
2327}
2328
Avi Kivity73fba5f2010-07-29 15:11:53 +03002329#define D(_y) { .flags = (_y) }
2330#define N D(0)
2331#define G(_f, _g) { .flags = ((_f) | Group), .u.group = (_g) }
2332#define GD(_f, _g) { .flags = ((_f) | Group | GroupDual), .u.gdual = (_g) }
2333#define I(_f, _e) { .flags = (_f), .u.execute = (_e) }
2334
Avi Kivity8d8f4e92010-08-26 11:56:06 +03002335#define D2bv(_f) D((_f) | ByteOp), D(_f)
2336#define I2bv(_f, _e) I((_f) | ByteOp, _e), I(_f, _e)
2337
Avi Kivity6230f7f2010-08-26 18:34:55 +03002338#define D6ALU(_f) D2bv((_f) | DstMem | SrcReg | ModRM), \
2339 D2bv(((_f) | DstReg | SrcMem | ModRM) & ~Lock), \
2340 D2bv(((_f) & ~Lock) | DstAcc | SrcImm)
2341
2342
Avi Kivity73fba5f2010-07-29 15:11:53 +03002343static struct opcode group1[] = {
2344 X7(D(Lock)), N
2345};
2346
2347static struct opcode group1A[] = {
2348 D(DstMem | SrcNone | ModRM | Mov | Stack), N, N, N, N, N, N, N,
2349};
2350
2351static struct opcode group3[] = {
2352 D(DstMem | SrcImm | ModRM), D(DstMem | SrcImm | ModRM),
2353 D(DstMem | SrcNone | ModRM | Lock), D(DstMem | SrcNone | ModRM | Lock),
Mohammed Gamal3f9f53b2010-08-08 21:11:37 +03002354 X4(D(SrcMem | ModRM)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002355};
2356
2357static struct opcode group4[] = {
2358 D(ByteOp | DstMem | SrcNone | ModRM | Lock), D(ByteOp | DstMem | SrcNone | ModRM | Lock),
2359 N, N, N, N, N, N,
2360};
2361
2362static struct opcode group5[] = {
2363 D(DstMem | SrcNone | ModRM | Lock), D(DstMem | SrcNone | ModRM | Lock),
Avi Kivity0ef753b2010-08-18 14:51:45 +03002364 D(SrcMem | ModRM | Stack),
2365 I(SrcMemFAddr | ModRM | ImplicitOps | Stack, em_call_far),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002366 D(SrcMem | ModRM | Stack), D(SrcMemFAddr | ModRM | ImplicitOps),
2367 D(SrcMem | ModRM | Stack), N,
2368};
2369
2370static struct group_dual group7 = { {
2371 N, N, D(ModRM | SrcMem | Priv), D(ModRM | SrcMem | Priv),
2372 D(SrcNone | ModRM | DstMem | Mov), N,
Avi Kivity5a506b12010-08-01 15:10:29 +03002373 D(SrcMem16 | ModRM | Mov | Priv),
2374 D(SrcMem | ModRM | ByteOp | Priv | NoAccess),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002375}, {
Avi Kivityd8671622011-02-01 16:32:03 +02002376 D(SrcNone | ModRM | Priv | VendorSpecific), N,
2377 N, D(SrcNone | ModRM | Priv | VendorSpecific),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002378 D(SrcNone | ModRM | DstMem | Mov), N,
2379 D(SrcMem16 | ModRM | Mov | Priv), N,
2380} };
2381
2382static struct opcode group8[] = {
2383 N, N, N, N,
2384 D(DstMem | SrcImmByte | ModRM), D(DstMem | SrcImmByte | ModRM | Lock),
2385 D(DstMem | SrcImmByte | ModRM | Lock), D(DstMem | SrcImmByte | ModRM | Lock),
2386};
2387
2388static struct group_dual group9 = { {
2389 N, D(DstMem64 | ModRM | Lock), N, N, N, N, N, N,
2390}, {
2391 N, N, N, N, N, N, N, N,
2392} };
2393
Avi Kivitya4d4a7c2010-08-03 15:05:46 +03002394static struct opcode group11[] = {
2395 I(DstMem | SrcImm | ModRM | Mov, em_mov), X7(D(Undefined)),
2396};
2397
Avi Kivity73fba5f2010-07-29 15:11:53 +03002398static struct opcode opcode_table[256] = {
2399 /* 0x00 - 0x07 */
Avi Kivity6230f7f2010-08-26 18:34:55 +03002400 D6ALU(Lock),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002401 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
2402 /* 0x08 - 0x0F */
Avi Kivity6230f7f2010-08-26 18:34:55 +03002403 D6ALU(Lock),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002404 D(ImplicitOps | Stack | No64), N,
2405 /* 0x10 - 0x17 */
Avi Kivity6230f7f2010-08-26 18:34:55 +03002406 D6ALU(Lock),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002407 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
2408 /* 0x18 - 0x1F */
Avi Kivity6230f7f2010-08-26 18:34:55 +03002409 D6ALU(Lock),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002410 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
2411 /* 0x20 - 0x27 */
Avi Kivity6230f7f2010-08-26 18:34:55 +03002412 D6ALU(Lock), N, N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03002413 /* 0x28 - 0x2F */
Avi Kivity6230f7f2010-08-26 18:34:55 +03002414 D6ALU(Lock), N, I(ByteOp | DstAcc | No64, em_das),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002415 /* 0x30 - 0x37 */
Avi Kivity6230f7f2010-08-26 18:34:55 +03002416 D6ALU(Lock), N, N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03002417 /* 0x38 - 0x3F */
Avi Kivity6230f7f2010-08-26 18:34:55 +03002418 D6ALU(0), N, N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03002419 /* 0x40 - 0x4F */
2420 X16(D(DstReg)),
2421 /* 0x50 - 0x57 */
Avi Kivity63540382010-07-29 15:11:55 +03002422 X8(I(SrcReg | Stack, em_push)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002423 /* 0x58 - 0x5F */
2424 X8(D(DstReg | Stack)),
2425 /* 0x60 - 0x67 */
2426 D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
2427 N, D(DstReg | SrcMem32 | ModRM | Mov) /* movsxd (x86/64) */ ,
2428 N, N, N, N,
2429 /* 0x68 - 0x6F */
Avi Kivityd46164d2010-08-18 19:29:33 +03002430 I(SrcImm | Mov | Stack, em_push),
2431 I(DstReg | SrcMem | ModRM | Src2Imm, em_imul_3op),
Avi Kivityf3a1b9f2010-08-18 18:25:25 +03002432 I(SrcImmByte | Mov | Stack, em_push),
2433 I(DstReg | SrcMem | ModRM | Src2ImmByte, em_imul_3op),
Avi Kivity48fe67b2010-08-26 11:56:08 +03002434 D2bv(DstDI | Mov | String), /* insb, insw/insd */
2435 D2bv(SrcSI | ImplicitOps | String), /* outsb, outsw/outsd */
Avi Kivity73fba5f2010-07-29 15:11:53 +03002436 /* 0x70 - 0x7F */
2437 X16(D(SrcImmByte)),
2438 /* 0x80 - 0x87 */
2439 G(ByteOp | DstMem | SrcImm | ModRM | Group, group1),
2440 G(DstMem | SrcImm | ModRM | Group, group1),
2441 G(ByteOp | DstMem | SrcImm | ModRM | No64 | Group, group1),
2442 G(DstMem | SrcImmByte | ModRM | Group, group1),
Avi Kivity76e8e682010-08-26 11:56:09 +03002443 D2bv(DstMem | SrcReg | ModRM), D2bv(DstMem | SrcReg | ModRM | Lock),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002444 /* 0x88 - 0x8F */
Avi Kivityb9eac5f2010-08-03 14:46:56 +03002445 I2bv(DstMem | SrcReg | ModRM | Mov, em_mov),
2446 I2bv(DstReg | SrcMem | ModRM | Mov, em_mov),
Avi Kivity342fc632010-08-01 15:13:22 +03002447 D(DstMem | SrcNone | ModRM | Mov), D(ModRM | SrcMem | NoAccess | DstReg),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002448 D(ImplicitOps | SrcMem16 | ModRM), G(0, group1A),
2449 /* 0x90 - 0x97 */
Avi Kivity3d9e77d2010-08-01 12:41:59 +03002450 X8(D(SrcAcc | DstReg)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002451 /* 0x98 - 0x9F */
Avi Kivity61429142010-08-19 15:13:00 +03002452 D(DstAcc | SrcNone), I(ImplicitOps | SrcAcc, em_cwd),
Wei Yongjuncc4feed2010-08-25 14:10:53 +08002453 I(SrcImmFAddr | No64, em_call_far), N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03002454 D(ImplicitOps | Stack), D(ImplicitOps | Stack), N, N,
2455 /* 0xA0 - 0xA7 */
Avi Kivityb9eac5f2010-08-03 14:46:56 +03002456 I2bv(DstAcc | SrcMem | Mov | MemAbs, em_mov),
2457 I2bv(DstMem | SrcAcc | Mov | MemAbs, em_mov),
2458 I2bv(SrcSI | DstDI | Mov | String, em_mov),
2459 D2bv(SrcSI | DstDI | String),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002460 /* 0xA8 - 0xAF */
Avi Kivity50748612010-08-26 11:56:10 +03002461 D2bv(DstAcc | SrcImm),
Avi Kivityb9eac5f2010-08-03 14:46:56 +03002462 I2bv(SrcAcc | DstDI | Mov | String, em_mov),
2463 I2bv(SrcSI | DstAcc | Mov | String, em_mov),
Avi Kivity48fe67b2010-08-26 11:56:08 +03002464 D2bv(SrcAcc | DstDI | String),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002465 /* 0xB0 - 0xB7 */
Avi Kivityb9eac5f2010-08-03 14:46:56 +03002466 X8(I(ByteOp | DstReg | SrcImm | Mov, em_mov)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002467 /* 0xB8 - 0xBF */
Avi Kivityb9eac5f2010-08-03 14:46:56 +03002468 X8(I(DstReg | SrcImm | Mov, em_mov)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002469 /* 0xC0 - 0xC7 */
Avi Kivityd2c6c7a2010-08-26 11:56:11 +03002470 D2bv(DstMem | SrcImmByte | ModRM),
Avi Kivity40ece7c2010-08-18 15:12:09 +03002471 I(ImplicitOps | Stack | SrcImmU16, em_ret_near_imm),
2472 D(ImplicitOps | Stack),
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08002473 D(DstReg | SrcMemFAddr | ModRM | No64), D(DstReg | SrcMemFAddr | ModRM | No64),
Avi Kivitya4d4a7c2010-08-03 15:05:46 +03002474 G(ByteOp, group11), G(0, group11),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002475 /* 0xC8 - 0xCF */
2476 N, N, N, D(ImplicitOps | Stack),
2477 D(ImplicitOps), D(SrcImmByte), D(ImplicitOps | No64), D(ImplicitOps),
2478 /* 0xD0 - 0xD7 */
Avi Kivityd2c6c7a2010-08-26 11:56:11 +03002479 D2bv(DstMem | SrcOne | ModRM), D2bv(DstMem | ModRM),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002480 N, N, N, N,
2481 /* 0xD8 - 0xDF */
2482 N, N, N, N, N, N, N, N,
2483 /* 0xE0 - 0xE7 */
Wei Yongjune4abac62010-08-19 14:25:48 +08002484 X4(D(SrcImmByte)),
Avi Kivityd269e392010-08-26 11:56:12 +03002485 D2bv(SrcImmUByte | DstAcc), D2bv(SrcAcc | DstImmUByte),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002486 /* 0xE8 - 0xEF */
2487 D(SrcImm | Stack), D(SrcImm | ImplicitOps),
2488 D(SrcImmFAddr | No64), D(SrcImmByte | ImplicitOps),
Avi Kivityd269e392010-08-26 11:56:12 +03002489 D2bv(SrcNone | DstAcc), D2bv(SrcAcc | ImplicitOps),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002490 /* 0xF0 - 0xF7 */
2491 N, N, N, N,
2492 D(ImplicitOps | Priv), D(ImplicitOps), G(ByteOp, group3), G(0, group3),
2493 /* 0xF8 - 0xFF */
Mohammed Gamal8744aa92010-08-05 15:42:49 +03002494 D(ImplicitOps), D(ImplicitOps), D(ImplicitOps), D(ImplicitOps),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002495 D(ImplicitOps), D(ImplicitOps), G(0, group4), G(0, group5),
2496};
2497
2498static struct opcode twobyte_table[256] = {
2499 /* 0x00 - 0x0F */
2500 N, GD(0, &group7), N, N,
Avi Kivityd8671622011-02-01 16:32:03 +02002501 N, D(ImplicitOps | VendorSpecific), D(ImplicitOps | Priv), N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03002502 D(ImplicitOps | Priv), D(ImplicitOps | Priv), N, N,
2503 N, D(ImplicitOps | ModRM), N, N,
2504 /* 0x10 - 0x1F */
2505 N, N, N, N, N, N, N, N, D(ImplicitOps | ModRM), N, N, N, N, N, N, N,
2506 /* 0x20 - 0x2F */
Avi Kivityb27f3852010-08-01 14:25:22 +03002507 D(ModRM | DstMem | Priv | Op3264), D(ModRM | DstMem | Priv | Op3264),
2508 D(ModRM | SrcMem | Priv | Op3264), D(ModRM | SrcMem | Priv | Op3264),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002509 N, N, N, N,
2510 N, N, N, N, N, N, N, N,
2511 /* 0x30 - 0x3F */
Avi Kivity48bb5d32010-08-18 18:54:34 +03002512 D(ImplicitOps | Priv), I(ImplicitOps, em_rdtsc),
2513 D(ImplicitOps | Priv), N,
Avi Kivityd8671622011-02-01 16:32:03 +02002514 D(ImplicitOps | VendorSpecific), D(ImplicitOps | Priv | VendorSpecific),
2515 N, N,
Avi Kivity73fba5f2010-07-29 15:11:53 +03002516 N, N, N, N, N, N, N, N,
2517 /* 0x40 - 0x4F */
2518 X16(D(DstReg | SrcMem | ModRM | Mov)),
2519 /* 0x50 - 0x5F */
2520 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
2521 /* 0x60 - 0x6F */
2522 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
2523 /* 0x70 - 0x7F */
2524 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
2525 /* 0x80 - 0x8F */
2526 X16(D(SrcImm)),
2527 /* 0x90 - 0x9F */
Wei Yongjunee45b582010-08-06 17:10:07 +08002528 X16(D(ByteOp | DstMem | SrcNone | ModRM| Mov)),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002529 /* 0xA0 - 0xA7 */
2530 D(ImplicitOps | Stack), D(ImplicitOps | Stack),
2531 N, D(DstMem | SrcReg | ModRM | BitOp),
2532 D(DstMem | SrcReg | Src2ImmByte | ModRM),
2533 D(DstMem | SrcReg | Src2CL | ModRM), N, N,
2534 /* 0xA8 - 0xAF */
2535 D(ImplicitOps | Stack), D(ImplicitOps | Stack),
2536 N, D(DstMem | SrcReg | ModRM | BitOp | Lock),
2537 D(DstMem | SrcReg | Src2ImmByte | ModRM),
2538 D(DstMem | SrcReg | Src2CL | ModRM),
Avi Kivity5c82aa22010-08-18 18:31:43 +03002539 D(ModRM), I(DstReg | SrcMem | ModRM, em_imul),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002540 /* 0xB0 - 0xB7 */
Avi Kivity739ae402010-08-26 11:56:13 +03002541 D2bv(DstMem | SrcReg | ModRM | Lock),
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08002542 D(DstReg | SrcMemFAddr | ModRM), D(DstMem | SrcReg | ModRM | BitOp | Lock),
2543 D(DstReg | SrcMemFAddr | ModRM), D(DstReg | SrcMemFAddr | ModRM),
2544 D(ByteOp | DstReg | SrcMem | ModRM | Mov), D(DstReg | SrcMem16 | ModRM | Mov),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002545 /* 0xB8 - 0xBF */
2546 N, N,
Wei Yongjunba7ff2b2010-08-09 11:39:14 +08002547 G(BitOp, group8), D(DstMem | SrcReg | ModRM | BitOp | Lock),
Wei Yongjund9574a22010-08-10 13:48:22 +08002548 D(DstReg | SrcMem | ModRM), D(DstReg | SrcMem | ModRM),
2549 D(ByteOp | DstReg | SrcMem | ModRM | Mov), D(DstReg | SrcMem16 | ModRM | Mov),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002550 /* 0xC0 - 0xCF */
Avi Kivity739ae402010-08-26 11:56:13 +03002551 D2bv(DstMem | SrcReg | ModRM | Lock),
Wei Yongjun92f738a2010-08-17 09:19:34 +08002552 N, D(DstMem | SrcReg | ModRM | Mov),
Avi Kivity73fba5f2010-07-29 15:11:53 +03002553 N, N, N, GD(0, &group9),
2554 N, N, N, N, N, N, N, N,
2555 /* 0xD0 - 0xDF */
2556 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
2557 /* 0xE0 - 0xEF */
2558 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N,
2559 /* 0xF0 - 0xFF */
2560 N, N, N, N, N, N, N, N, N, N, N, N, N, N, N, N
2561};
2562
2563#undef D
2564#undef N
2565#undef G
2566#undef GD
2567#undef I
2568
Avi Kivity8d8f4e92010-08-26 11:56:06 +03002569#undef D2bv
2570#undef I2bv
Avi Kivity6230f7f2010-08-26 18:34:55 +03002571#undef D6ALU
Avi Kivity8d8f4e92010-08-26 11:56:06 +03002572
Avi Kivity39f21ee2010-08-18 19:20:21 +03002573static unsigned imm_size(struct decode_cache *c)
2574{
2575 unsigned size;
2576
2577 size = (c->d & ByteOp) ? 1 : c->op_bytes;
2578 if (size == 8)
2579 size = 4;
2580 return size;
2581}
2582
2583static int decode_imm(struct x86_emulate_ctxt *ctxt, struct operand *op,
2584 unsigned size, bool sign_extension)
2585{
2586 struct decode_cache *c = &ctxt->decode;
2587 struct x86_emulate_ops *ops = ctxt->ops;
2588 int rc = X86EMUL_CONTINUE;
2589
2590 op->type = OP_IMM;
2591 op->bytes = size;
Avi Kivity90de84f2010-11-17 15:28:21 +02002592 op->addr.mem.ea = c->eip;
Avi Kivity39f21ee2010-08-18 19:20:21 +03002593 /* NB. Immediates are sign-extended as necessary. */
2594 switch (op->bytes) {
2595 case 1:
2596 op->val = insn_fetch(s8, 1, c->eip);
2597 break;
2598 case 2:
2599 op->val = insn_fetch(s16, 2, c->eip);
2600 break;
2601 case 4:
2602 op->val = insn_fetch(s32, 4, c->eip);
2603 break;
2604 }
2605 if (!sign_extension) {
2606 switch (op->bytes) {
2607 case 1:
2608 op->val &= 0xff;
2609 break;
2610 case 2:
2611 op->val &= 0xffff;
2612 break;
2613 case 4:
2614 op->val &= 0xffffffff;
2615 break;
2616 }
2617 }
2618done:
2619 return rc;
2620}
2621
Laurent Vivier8b4caf62007-09-18 11:27:19 +02002622int
Andre Przywaradc25e892010-12-21 11:12:07 +01002623x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002624{
2625 struct x86_emulate_ops *ops = ctxt->ops;
2626 struct decode_cache *c = &ctxt->decode;
2627 int rc = X86EMUL_CONTINUE;
2628 int mode = ctxt->mode;
2629 int def_op_bytes, def_ad_bytes, dual, goffset;
2630 struct opcode opcode, *g_mod012, *g_mod3;
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03002631 struct operand memop = { .type = OP_NONE };
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002632
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002633 c->eip = ctxt->eip;
Andre Przywaradc25e892010-12-21 11:12:07 +01002634 c->fetch.start = c->eip;
2635 c->fetch.end = c->fetch.start + insn_len;
2636 if (insn_len > 0)
2637 memcpy(c->fetch.data, insn, insn_len);
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002638 ctxt->cs_base = seg_base(ctxt, ops, VCPU_SREG_CS);
2639
2640 switch (mode) {
2641 case X86EMUL_MODE_REAL:
2642 case X86EMUL_MODE_VM86:
2643 case X86EMUL_MODE_PROT16:
2644 def_op_bytes = def_ad_bytes = 2;
2645 break;
2646 case X86EMUL_MODE_PROT32:
2647 def_op_bytes = def_ad_bytes = 4;
2648 break;
2649#ifdef CONFIG_X86_64
2650 case X86EMUL_MODE_PROT64:
2651 def_op_bytes = 4;
2652 def_ad_bytes = 8;
2653 break;
2654#endif
2655 default:
2656 return -1;
2657 }
2658
2659 c->op_bytes = def_op_bytes;
2660 c->ad_bytes = def_ad_bytes;
2661
2662 /* Legacy prefixes. */
2663 for (;;) {
2664 switch (c->b = insn_fetch(u8, 1, c->eip)) {
2665 case 0x66: /* operand-size override */
2666 /* switch between 2/4 bytes */
2667 c->op_bytes = def_op_bytes ^ 6;
2668 break;
2669 case 0x67: /* address-size override */
2670 if (mode == X86EMUL_MODE_PROT64)
2671 /* switch between 4/8 bytes */
2672 c->ad_bytes = def_ad_bytes ^ 12;
2673 else
2674 /* switch between 2/4 bytes */
2675 c->ad_bytes = def_ad_bytes ^ 6;
2676 break;
2677 case 0x26: /* ES override */
2678 case 0x2e: /* CS override */
2679 case 0x36: /* SS override */
2680 case 0x3e: /* DS override */
2681 set_seg_override(c, (c->b >> 3) & 3);
2682 break;
2683 case 0x64: /* FS override */
2684 case 0x65: /* GS override */
2685 set_seg_override(c, c->b & 7);
2686 break;
2687 case 0x40 ... 0x4f: /* REX */
2688 if (mode != X86EMUL_MODE_PROT64)
2689 goto done_prefixes;
2690 c->rex_prefix = c->b;
2691 continue;
2692 case 0xf0: /* LOCK */
2693 c->lock_prefix = 1;
2694 break;
2695 case 0xf2: /* REPNE/REPNZ */
2696 c->rep_prefix = REPNE_PREFIX;
2697 break;
2698 case 0xf3: /* REP/REPE/REPZ */
2699 c->rep_prefix = REPE_PREFIX;
2700 break;
2701 default:
2702 goto done_prefixes;
2703 }
2704
2705 /* Any legacy prefix after a REX prefix nullifies its effect. */
2706
2707 c->rex_prefix = 0;
2708 }
2709
2710done_prefixes:
2711
2712 /* REX prefix. */
Avi Kivity1e87e3e2010-08-01 14:42:51 +03002713 if (c->rex_prefix & 8)
2714 c->op_bytes = 8; /* REX.W */
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002715
2716 /* Opcode byte(s). */
2717 opcode = opcode_table[c->b];
Wei Yongjund3ad6242010-08-05 16:34:39 +08002718 /* Two-byte opcode? */
2719 if (c->b == 0x0f) {
2720 c->twobyte = 1;
2721 c->b = insn_fetch(u8, 1, c->eip);
2722 opcode = twobyte_table[c->b];
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002723 }
2724 c->d = opcode.flags;
2725
2726 if (c->d & Group) {
2727 dual = c->d & GroupDual;
2728 c->modrm = insn_fetch(u8, 1, c->eip);
2729 --c->eip;
2730
2731 if (c->d & GroupDual) {
2732 g_mod012 = opcode.u.gdual->mod012;
2733 g_mod3 = opcode.u.gdual->mod3;
2734 } else
2735 g_mod012 = g_mod3 = opcode.u.group;
2736
2737 c->d &= ~(Group | GroupDual);
2738
2739 goffset = (c->modrm >> 3) & 7;
2740
2741 if ((c->modrm >> 6) == 3)
2742 opcode = g_mod3[goffset];
2743 else
2744 opcode = g_mod012[goffset];
2745 c->d |= opcode.flags;
2746 }
2747
2748 c->execute = opcode.u.execute;
2749
2750 /* Unrecognised? */
Avi Kivityd53db5e2010-11-17 13:40:51 +02002751 if (c->d == 0 || (c->d & Undefined))
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002752 return -1;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002753
Avi Kivityd8671622011-02-01 16:32:03 +02002754 if (!(c->d & VendorSpecific) && ctxt->only_vendor_specific_insn)
2755 return -1;
2756
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002757 if (mode == X86EMUL_MODE_PROT64 && (c->d & Stack))
2758 c->op_bytes = 8;
2759
Avi Kivity7f9b4b72010-08-01 14:46:54 +03002760 if (c->d & Op3264) {
2761 if (mode == X86EMUL_MODE_PROT64)
2762 c->op_bytes = 8;
2763 else
2764 c->op_bytes = 4;
2765 }
2766
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002767 /* ModRM and SIB bytes. */
Avi Kivity09ee57c2010-08-01 12:07:29 +03002768 if (c->d & ModRM) {
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03002769 rc = decode_modrm(ctxt, ops, &memop);
Avi Kivity09ee57c2010-08-01 12:07:29 +03002770 if (!c->has_seg_override)
2771 set_seg_override(c, c->modrm_seg);
2772 } else if (c->d & MemAbs)
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03002773 rc = decode_abs(ctxt, ops, &memop);
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002774 if (rc != X86EMUL_CONTINUE)
2775 goto done;
2776
2777 if (!c->has_seg_override)
2778 set_seg_override(c, VCPU_SREG_DS);
2779
Avi Kivity90de84f2010-11-17 15:28:21 +02002780 memop.addr.mem.seg = seg_override(ctxt, ops, c);
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002781
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03002782 if (memop.type == OP_MEM && c->ad_bytes != 8)
Avi Kivity90de84f2010-11-17 15:28:21 +02002783 memop.addr.mem.ea = (u32)memop.addr.mem.ea;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002784
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03002785 if (memop.type == OP_MEM && c->rip_relative)
Avi Kivity90de84f2010-11-17 15:28:21 +02002786 memop.addr.mem.ea += c->eip;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002787
2788 /*
2789 * Decode and fetch the source operand: register, memory
2790 * or immediate.
2791 */
2792 switch (c->d & SrcMask) {
2793 case SrcNone:
2794 break;
2795 case SrcReg:
2796 decode_register_operand(&c->src, c, 0);
2797 break;
2798 case SrcMem16:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03002799 memop.bytes = 2;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002800 goto srcmem_common;
2801 case SrcMem32:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03002802 memop.bytes = 4;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002803 goto srcmem_common;
2804 case SrcMem:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03002805 memop.bytes = (c->d & ByteOp) ? 1 :
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002806 c->op_bytes;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002807 srcmem_common:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03002808 c->src = memop;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002809 break;
Avi Kivityb250e602010-08-18 15:11:24 +03002810 case SrcImmU16:
Avi Kivity39f21ee2010-08-18 19:20:21 +03002811 rc = decode_imm(ctxt, &c->src, 2, false);
2812 break;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002813 case SrcImm:
Avi Kivity39f21ee2010-08-18 19:20:21 +03002814 rc = decode_imm(ctxt, &c->src, imm_size(c), true);
2815 break;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002816 case SrcImmU:
Avi Kivity39f21ee2010-08-18 19:20:21 +03002817 rc = decode_imm(ctxt, &c->src, imm_size(c), false);
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002818 break;
2819 case SrcImmByte:
Avi Kivity39f21ee2010-08-18 19:20:21 +03002820 rc = decode_imm(ctxt, &c->src, 1, true);
2821 break;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002822 case SrcImmUByte:
Avi Kivity39f21ee2010-08-18 19:20:21 +03002823 rc = decode_imm(ctxt, &c->src, 1, false);
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002824 break;
2825 case SrcAcc:
2826 c->src.type = OP_REG;
2827 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
Avi Kivity1a6440aef2010-08-01 12:35:10 +03002828 c->src.addr.reg = &c->regs[VCPU_REGS_RAX];
Avi Kivity91ff3cb2010-08-01 12:53:09 +03002829 fetch_register_operand(&c->src);
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002830 break;
2831 case SrcOne:
2832 c->src.bytes = 1;
2833 c->src.val = 1;
2834 break;
2835 case SrcSI:
2836 c->src.type = OP_MEM;
2837 c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
Avi Kivity90de84f2010-11-17 15:28:21 +02002838 c->src.addr.mem.ea =
2839 register_address(c, c->regs[VCPU_REGS_RSI]);
2840 c->src.addr.mem.seg = seg_override(ctxt, ops, c),
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002841 c->src.val = 0;
2842 break;
2843 case SrcImmFAddr:
2844 c->src.type = OP_IMM;
Avi Kivity90de84f2010-11-17 15:28:21 +02002845 c->src.addr.mem.ea = c->eip;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002846 c->src.bytes = c->op_bytes + 2;
2847 insn_fetch_arr(c->src.valptr, c->src.bytes, c->eip);
2848 break;
2849 case SrcMemFAddr:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03002850 memop.bytes = c->op_bytes + 2;
2851 goto srcmem_common;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002852 break;
2853 }
2854
Avi Kivity39f21ee2010-08-18 19:20:21 +03002855 if (rc != X86EMUL_CONTINUE)
2856 goto done;
2857
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002858 /*
2859 * Decode and fetch the second source operand: register, memory
2860 * or immediate.
2861 */
2862 switch (c->d & Src2Mask) {
2863 case Src2None:
2864 break;
2865 case Src2CL:
2866 c->src2.bytes = 1;
2867 c->src2.val = c->regs[VCPU_REGS_RCX] & 0x8;
2868 break;
2869 case Src2ImmByte:
Avi Kivity39f21ee2010-08-18 19:20:21 +03002870 rc = decode_imm(ctxt, &c->src2, 1, true);
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002871 break;
2872 case Src2One:
2873 c->src2.bytes = 1;
2874 c->src2.val = 1;
2875 break;
Avi Kivity7db41eb2010-08-18 19:25:28 +03002876 case Src2Imm:
2877 rc = decode_imm(ctxt, &c->src2, imm_size(c), true);
2878 break;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002879 }
2880
Avi Kivity39f21ee2010-08-18 19:20:21 +03002881 if (rc != X86EMUL_CONTINUE)
2882 goto done;
2883
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002884 /* Decode and fetch the destination operand: register or memory. */
2885 switch (c->d & DstMask) {
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002886 case DstReg:
2887 decode_register_operand(&c->dst, c,
2888 c->twobyte && (c->b == 0xb6 || c->b == 0xb7));
2889 break;
Wei Yongjun943858e2010-08-06 11:36:51 +08002890 case DstImmUByte:
2891 c->dst.type = OP_IMM;
Avi Kivity90de84f2010-11-17 15:28:21 +02002892 c->dst.addr.mem.ea = c->eip;
Wei Yongjun943858e2010-08-06 11:36:51 +08002893 c->dst.bytes = 1;
2894 c->dst.val = insn_fetch(u8, 1, c->eip);
2895 break;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002896 case DstMem:
2897 case DstMem64:
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03002898 c->dst = memop;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002899 if ((c->d & DstMask) == DstMem64)
2900 c->dst.bytes = 8;
2901 else
2902 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
Wei Yongjun35c843c2010-08-09 11:34:56 +08002903 if (c->d & BitOp)
2904 fetch_bit_operand(c);
Avi Kivity2dbd0dd2010-08-01 15:40:19 +03002905 c->dst.orig_val = c->dst.val;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002906 break;
2907 case DstAcc:
2908 c->dst.type = OP_REG;
2909 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
Avi Kivity1a6440aef2010-08-01 12:35:10 +03002910 c->dst.addr.reg = &c->regs[VCPU_REGS_RAX];
Avi Kivity91ff3cb2010-08-01 12:53:09 +03002911 fetch_register_operand(&c->dst);
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002912 c->dst.orig_val = c->dst.val;
2913 break;
2914 case DstDI:
2915 c->dst.type = OP_MEM;
2916 c->dst.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
Avi Kivity90de84f2010-11-17 15:28:21 +02002917 c->dst.addr.mem.ea =
2918 register_address(c, c->regs[VCPU_REGS_RDI]);
2919 c->dst.addr.mem.seg = VCPU_SREG_ES;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002920 c->dst.val = 0;
2921 break;
Wei Yongjun36089fe2010-08-04 15:38:18 +08002922 case ImplicitOps:
2923 /* Special instructions do their own operand decoding. */
2924 default:
2925 c->dst.type = OP_NONE; /* Disable writeback. */
2926 return 0;
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002927 }
2928
2929done:
2930 return (rc == X86EMUL_UNHANDLEABLE) ? -1 : 0;
2931}
2932
Gleb Natapov3e2f65d2010-08-25 12:47:42 +03002933static bool string_insn_completed(struct x86_emulate_ctxt *ctxt)
2934{
2935 struct decode_cache *c = &ctxt->decode;
2936
2937 /* The second termination condition only applies for REPE
2938 * and REPNE. Test if the repeat string operation prefix is
2939 * REPE/REPZ or REPNE/REPNZ and if it's the case it tests the
2940 * corresponding termination condition according to:
2941 * - if REPE/REPZ and ZF = 0 then done
2942 * - if REPNE/REPNZ and ZF = 1 then done
2943 */
2944 if (((c->b == 0xa6) || (c->b == 0xa7) ||
2945 (c->b == 0xae) || (c->b == 0xaf))
2946 && (((c->rep_prefix == REPE_PREFIX) &&
2947 ((ctxt->eflags & EFLG_ZF) == 0))
2948 || ((c->rep_prefix == REPNE_PREFIX) &&
2949 ((ctxt->eflags & EFLG_ZF) == EFLG_ZF))))
2950 return true;
2951
2952 return false;
2953}
2954
Avi Kivitydde7e6d122010-07-29 15:11:52 +03002955int
Avi Kivity9aabc88f2010-07-29 15:11:50 +03002956x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
Laurent Vivier8b4caf62007-09-18 11:27:19 +02002957{
Avi Kivity9aabc88f2010-07-29 15:11:50 +03002958 struct x86_emulate_ops *ops = ctxt->ops;
Laurent Vivier8b4caf62007-09-18 11:27:19 +02002959 u64 msr_data;
Laurent Vivier8b4caf62007-09-18 11:27:19 +02002960 struct decode_cache *c = &ctxt->decode;
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09002961 int rc = X86EMUL_CONTINUE;
Gleb Natapov5cd21912010-03-18 15:20:26 +02002962 int saved_dst_type = c->dst.type;
Mohammed Gamal6e154e52010-08-04 14:38:06 +03002963 int irq; /* Used for int 3, int, and into */
Laurent Vivier8b4caf62007-09-18 11:27:19 +02002964
Gleb Natapov9de41572010-04-28 19:15:22 +03002965 ctxt->decode.mem_read.pos = 0;
Glauber Costa310b5d32009-05-12 16:21:06 -04002966
Gleb Natapov11616242010-02-11 14:43:14 +02002967 if (ctxt->mode == X86EMUL_MODE_PROT64 && (c->d & No64)) {
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002968 rc = emulate_ud(ctxt);
Gleb Natapov11616242010-02-11 14:43:14 +02002969 goto done;
2970 }
2971
Gleb Natapovd380a5e2010-02-10 14:21:36 +02002972 /* LOCK prefix is allowed only with some instructions */
Gleb Natapova41ffb752010-03-18 15:20:14 +02002973 if (c->lock_prefix && (!(c->d & Lock) || c->dst.type != OP_MEM)) {
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002974 rc = emulate_ud(ctxt);
Gleb Natapovd380a5e2010-02-10 14:21:36 +02002975 goto done;
2976 }
2977
Avi Kivity081bca02010-08-26 11:06:15 +03002978 if ((c->d & SrcMask) == SrcMemFAddr && c->src.type != OP_MEM) {
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002979 rc = emulate_ud(ctxt);
Avi Kivity081bca02010-08-26 11:06:15 +03002980 goto done;
2981 }
2982
Gleb Natapove92805a2010-02-10 14:21:35 +02002983 /* Privileged instruction can be executed only in CPL=0 */
Gleb Natapov9c537242010-03-18 15:20:05 +02002984 if ((c->d & Priv) && ops->cpl(ctxt->vcpu)) {
Avi Kivity35d3d4a2010-11-22 17:53:25 +02002985 rc = emulate_gp(ctxt, 0);
Gleb Natapove92805a2010-02-10 14:21:35 +02002986 goto done;
2987 }
2988
Avi Kivityb9fa9d62007-11-27 19:05:37 +02002989 if (c->rep_prefix && (c->d & String)) {
2990 /* All REP prefixes have the same first termination condition */
Gleb Natapovc73e1972010-03-15 16:38:29 +02002991 if (address_mask(c, c->regs[VCPU_REGS_RCX]) == 0) {
Gleb Natapov95c55882010-04-28 19:15:39 +03002992 ctxt->eip = c->eip;
Avi Kivityb9fa9d62007-11-27 19:05:37 +02002993 goto done;
2994 }
Avi Kivityb9fa9d62007-11-27 19:05:37 +02002995 }
2996
Wei Yongjunc483c022010-08-06 15:36:36 +08002997 if ((c->src.type == OP_MEM) && !(c->d & NoAccess)) {
Avi Kivity90de84f2010-11-17 15:28:21 +02002998 rc = read_emulated(ctxt, ops, linear(ctxt, c->src.addr.mem),
Gleb Natapov414e6272010-04-28 19:15:26 +03002999 c->src.valptr, c->src.bytes);
Takuya Yoshikawab60d5132010-01-20 16:47:21 +09003000 if (rc != X86EMUL_CONTINUE)
Laurent Vivier8b4caf62007-09-18 11:27:19 +02003001 goto done;
Avi Kivity16518d52010-08-26 14:31:30 +03003002 c->src.orig_val64 = c->src.val64;
Laurent Vivier8b4caf62007-09-18 11:27:19 +02003003 }
3004
Gleb Natapove35b7b92010-02-25 16:36:42 +02003005 if (c->src2.type == OP_MEM) {
Avi Kivity90de84f2010-11-17 15:28:21 +02003006 rc = read_emulated(ctxt, ops, linear(ctxt, c->src2.addr.mem),
Gleb Natapov9de41572010-04-28 19:15:22 +03003007 &c->src2.val, c->src2.bytes);
Gleb Natapove35b7b92010-02-25 16:36:42 +02003008 if (rc != X86EMUL_CONTINUE)
3009 goto done;
3010 }
3011
Laurent Vivier8b4caf62007-09-18 11:27:19 +02003012 if ((c->d & DstMask) == ImplicitOps)
3013 goto special_insn;
3014
3015
Gleb Natapov69f55cb2010-03-18 15:20:20 +02003016 if ((c->dst.type == OP_MEM) && !(c->d & Mov)) {
3017 /* optimisation - avoid slow emulated read if Mov */
Avi Kivity90de84f2010-11-17 15:28:21 +02003018 rc = read_emulated(ctxt, ops, linear(ctxt, c->dst.addr.mem),
Gleb Natapov9de41572010-04-28 19:15:22 +03003019 &c->dst.val, c->dst.bytes);
Gleb Natapov69f55cb2010-03-18 15:20:20 +02003020 if (rc != X86EMUL_CONTINUE)
3021 goto done;
Avi Kivity038e51d2007-01-22 20:40:40 -08003022 }
Laurent Viviere4e03de2007-09-18 11:52:50 +02003023 c->dst.orig_val = c->dst.val;
Avi Kivity038e51d2007-01-22 20:40:40 -08003024
Avi Kivity018a98d2007-11-27 19:30:56 +02003025special_insn:
3026
Avi Kivityef65c882010-07-29 15:11:51 +03003027 if (c->execute) {
3028 rc = c->execute(ctxt);
3029 if (rc != X86EMUL_CONTINUE)
3030 goto done;
3031 goto writeback;
3032 }
3033
Laurent Viviere4e03de2007-09-18 11:52:50 +02003034 if (c->twobyte)
Avi Kivity6aa8b732006-12-10 02:21:36 -08003035 goto twobyte_insn;
3036
Laurent Viviere4e03de2007-09-18 11:52:50 +02003037 switch (c->b) {
Avi Kivity6aa8b732006-12-10 02:21:36 -08003038 case 0x00 ... 0x05:
3039 add: /* add */
Laurent Vivier05f086f2007-09-24 11:10:55 +02003040 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
Avi Kivity6aa8b732006-12-10 02:21:36 -08003041 break;
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003042 case 0x06: /* push es */
Gleb Natapov79168fd2010-04-28 19:15:30 +03003043 emulate_push_sreg(ctxt, ops, VCPU_SREG_ES);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003044 break;
3045 case 0x07: /* pop es */
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003046 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_ES);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003047 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003048 case 0x08 ... 0x0d:
3049 or: /* or */
Laurent Vivier05f086f2007-09-24 11:10:55 +02003050 emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
Avi Kivity6aa8b732006-12-10 02:21:36 -08003051 break;
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003052 case 0x0e: /* push cs */
Gleb Natapov79168fd2010-04-28 19:15:30 +03003053 emulate_push_sreg(ctxt, ops, VCPU_SREG_CS);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003054 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003055 case 0x10 ... 0x15:
3056 adc: /* adc */
Laurent Vivier05f086f2007-09-24 11:10:55 +02003057 emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
Avi Kivity6aa8b732006-12-10 02:21:36 -08003058 break;
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003059 case 0x16: /* push ss */
Gleb Natapov79168fd2010-04-28 19:15:30 +03003060 emulate_push_sreg(ctxt, ops, VCPU_SREG_SS);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003061 break;
3062 case 0x17: /* pop ss */
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003063 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_SS);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003064 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003065 case 0x18 ... 0x1d:
3066 sbb: /* sbb */
Laurent Vivier05f086f2007-09-24 11:10:55 +02003067 emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
Avi Kivity6aa8b732006-12-10 02:21:36 -08003068 break;
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003069 case 0x1e: /* push ds */
Gleb Natapov79168fd2010-04-28 19:15:30 +03003070 emulate_push_sreg(ctxt, ops, VCPU_SREG_DS);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003071 break;
3072 case 0x1f: /* pop ds */
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003073 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_DS);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003074 break;
Guillaume Thouveninaa3a8162008-09-12 13:52:18 +02003075 case 0x20 ... 0x25:
Avi Kivity6aa8b732006-12-10 02:21:36 -08003076 and: /* and */
Laurent Vivier05f086f2007-09-24 11:10:55 +02003077 emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
Avi Kivity6aa8b732006-12-10 02:21:36 -08003078 break;
3079 case 0x28 ... 0x2d:
3080 sub: /* sub */
Laurent Vivier05f086f2007-09-24 11:10:55 +02003081 emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
Avi Kivity6aa8b732006-12-10 02:21:36 -08003082 break;
3083 case 0x30 ... 0x35:
3084 xor: /* xor */
Laurent Vivier05f086f2007-09-24 11:10:55 +02003085 emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
Avi Kivity6aa8b732006-12-10 02:21:36 -08003086 break;
3087 case 0x38 ... 0x3d:
3088 cmp: /* cmp */
Laurent Vivier05f086f2007-09-24 11:10:55 +02003089 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
Avi Kivity6aa8b732006-12-10 02:21:36 -08003090 break;
Avi Kivity33615aa2007-10-31 11:15:56 +02003091 case 0x40 ... 0x47: /* inc r16/r32 */
3092 emulate_1op("inc", c->dst, ctxt->eflags);
3093 break;
3094 case 0x48 ... 0x4f: /* dec r16/r32 */
3095 emulate_1op("dec", c->dst, ctxt->eflags);
3096 break;
Avi Kivity33615aa2007-10-31 11:15:56 +02003097 case 0x58 ... 0x5f: /* pop reg */
3098 pop_instruction:
Avi Kivity350f69d2009-01-05 11:12:40 +02003099 rc = emulate_pop(ctxt, ops, &c->dst.val, c->op_bytes);
Avi Kivity33615aa2007-10-31 11:15:56 +02003100 break;
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02003101 case 0x60: /* pusha */
Wei Yongjunc37eda12010-06-15 09:03:33 +08003102 rc = emulate_pusha(ctxt, ops);
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02003103 break;
3104 case 0x61: /* popa */
3105 rc = emulate_popa(ctxt, ops);
Mohammed Gamalabcf14b2009-09-01 15:28:11 +02003106 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003107 case 0x63: /* movsxd */
Laurent Vivier8b4caf62007-09-18 11:27:19 +02003108 if (ctxt->mode != X86EMUL_MODE_PROT64)
Avi Kivity6aa8b732006-12-10 02:21:36 -08003109 goto cannot_emulate;
Laurent Viviere4e03de2007-09-18 11:52:50 +02003110 c->dst.val = (s32) c->src.val;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003111 break;
Avi Kivity018a98d2007-11-27 19:30:56 +02003112 case 0x6c: /* insb */
3113 case 0x6d: /* insw/insd */
Wei Yongjuna13a63f2010-08-06 11:46:12 +08003114 c->src.val = c->regs[VCPU_REGS_RDX];
3115 goto do_io_in;
Avi Kivity018a98d2007-11-27 19:30:56 +02003116 case 0x6e: /* outsb */
3117 case 0x6f: /* outsw/outsd */
Wei Yongjuna13a63f2010-08-06 11:46:12 +08003118 c->dst.val = c->regs[VCPU_REGS_RDX];
3119 goto do_io_out;
Gleb Natapov79729952010-03-18 15:20:24 +02003120 break;
Gleb Natapovb2833e32009-04-12 13:36:30 +03003121 case 0x70 ... 0x7f: /* jcc (short) */
Avi Kivity018a98d2007-11-27 19:30:56 +02003122 if (test_cc(c->b, ctxt->eflags))
Gleb Natapovb2833e32009-04-12 13:36:30 +03003123 jmp_rel(c, c->src.val);
Avi Kivity018a98d2007-11-27 19:30:56 +02003124 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003125 case 0x80 ... 0x83: /* Grp1 */
Laurent Viviere4e03de2007-09-18 11:52:50 +02003126 switch (c->modrm_reg) {
Avi Kivity6aa8b732006-12-10 02:21:36 -08003127 case 0:
3128 goto add;
3129 case 1:
3130 goto or;
3131 case 2:
3132 goto adc;
3133 case 3:
3134 goto sbb;
3135 case 4:
3136 goto and;
3137 case 5:
3138 goto sub;
3139 case 6:
3140 goto xor;
3141 case 7:
3142 goto cmp;
3143 }
3144 break;
3145 case 0x84 ... 0x85:
Mohammed Gamaldfb507c2010-05-11 22:22:40 +03003146 test:
Laurent Vivier05f086f2007-09-24 11:10:55 +02003147 emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
Avi Kivity6aa8b732006-12-10 02:21:36 -08003148 break;
3149 case 0x86 ... 0x87: /* xchg */
Mohammed Gamalb13354f2008-06-15 19:37:38 +03003150 xchg:
Avi Kivity6aa8b732006-12-10 02:21:36 -08003151 /* Write back the register source. */
Wei Yongjun31be40b2010-08-17 09:17:30 +08003152 c->src.val = c->dst.val;
3153 write_register_operand(&c->src);
Avi Kivity6aa8b732006-12-10 02:21:36 -08003154 /*
3155 * Write back the memory destination with implicit LOCK
3156 * prefix.
3157 */
Wei Yongjun31be40b2010-08-17 09:17:30 +08003158 c->dst.val = c->src.orig_val;
Laurent Viviere4e03de2007-09-18 11:52:50 +02003159 c->lock_prefix = 1;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003160 break;
Gleb Natapov79168fd2010-04-28 19:15:30 +03003161 case 0x8c: /* mov r/m, sreg */
3162 if (c->modrm_reg > VCPU_SREG_GS) {
Avi Kivity35d3d4a2010-11-22 17:53:25 +02003163 rc = emulate_ud(ctxt);
Gleb Natapov5e3ae6c2010-03-18 15:20:07 +02003164 goto done;
Guillaume Thouvenin38d5bc62008-05-27 15:13:28 +02003165 }
Gleb Natapov79168fd2010-04-28 19:15:30 +03003166 c->dst.val = ops->get_segment_selector(c->modrm_reg, ctxt->vcpu);
Guillaume Thouvenin38d5bc62008-05-27 15:13:28 +02003167 break;
Nitin A Kamble7e0b54b2007-09-15 10:35:36 +03003168 case 0x8d: /* lea r16/r32, m */
Avi Kivity90de84f2010-11-17 15:28:21 +02003169 c->dst.val = c->src.addr.mem.ea;
Nitin A Kamble7e0b54b2007-09-15 10:35:36 +03003170 break;
Guillaume Thouvenin42571982008-05-27 14:49:15 +02003171 case 0x8e: { /* mov seg, r/m16 */
3172 uint16_t sel;
Guillaume Thouvenin42571982008-05-27 14:49:15 +02003173
3174 sel = c->src.val;
Gleb Natapov8b9f4412010-02-18 12:14:59 +02003175
Gleb Natapovc6975182010-02-18 12:15:01 +02003176 if (c->modrm_reg == VCPU_SREG_CS ||
3177 c->modrm_reg > VCPU_SREG_GS) {
Avi Kivity35d3d4a2010-11-22 17:53:25 +02003178 rc = emulate_ud(ctxt);
Gleb Natapov8b9f4412010-02-18 12:14:59 +02003179 goto done;
3180 }
3181
Glauber Costa310b5d32009-05-12 16:21:06 -04003182 if (c->modrm_reg == VCPU_SREG_SS)
Gleb Natapov95cb2292010-04-28 19:15:43 +03003183 ctxt->interruptibility = KVM_X86_SHADOW_INT_MOV_SS;
Glauber Costa310b5d32009-05-12 16:21:06 -04003184
Gleb Natapov2e873022010-03-18 15:20:18 +02003185 rc = load_segment_descriptor(ctxt, ops, sel, c->modrm_reg);
Guillaume Thouvenin42571982008-05-27 14:49:15 +02003186
3187 c->dst.type = OP_NONE; /* Disable writeback. */
3188 break;
3189 }
Avi Kivity6aa8b732006-12-10 02:21:36 -08003190 case 0x8f: /* pop (sole member of Grp1a) */
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02003191 rc = emulate_grp1a(ctxt, ops);
Avi Kivity6aa8b732006-12-10 02:21:36 -08003192 break;
Avi Kivity3d9e77d2010-08-01 12:41:59 +03003193 case 0x90 ... 0x97: /* nop / xchg reg, rax */
3194 if (c->dst.addr.reg == &c->regs[VCPU_REGS_RAX])
Mohammed Gamal34698d82010-08-04 14:41:04 +03003195 break;
Mohammed Gamalb13354f2008-06-15 19:37:38 +03003196 goto xchg;
Wei Yongjune8b6fa72010-08-18 16:43:13 +08003197 case 0x98: /* cbw/cwde/cdqe */
3198 switch (c->op_bytes) {
3199 case 2: c->dst.val = (s8)c->dst.val; break;
3200 case 4: c->dst.val = (s16)c->dst.val; break;
3201 case 8: c->dst.val = (s32)c->dst.val; break;
3202 }
3203 break;
Nitin A Kamblefd2a7602007-08-28 18:22:47 -07003204 case 0x9c: /* pushf */
Laurent Vivier05f086f2007-09-24 11:10:55 +02003205 c->src.val = (unsigned long) ctxt->eflags;
Gleb Natapov79168fd2010-04-28 19:15:30 +03003206 emulate_push(ctxt, ops);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02003207 break;
Nitin A Kamble535eabc2007-09-15 10:45:05 +03003208 case 0x9d: /* popf */
Avi Kivity2b48cc72008-11-29 20:36:13 +02003209 c->dst.type = OP_REG;
Avi Kivity1a6440aef2010-08-01 12:35:10 +03003210 c->dst.addr.reg = &ctxt->eflags;
Avi Kivity2b48cc72008-11-29 20:36:13 +02003211 c->dst.bytes = c->op_bytes;
Gleb Natapovd4c6a152010-02-10 14:21:34 +02003212 rc = emulate_popf(ctxt, ops, &c->dst.val, c->op_bytes);
Gleb Natapovd4c6a152010-02-10 14:21:34 +02003213 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003214 case 0xa6 ... 0xa7: /* cmps */
Guillaume Thouvenind7e51172007-11-26 13:49:09 +01003215 c->dst.type = OP_NONE; /* Disable writeback. */
Gleb Natapova682e352010-03-18 15:20:21 +02003216 goto cmp;
Mohammed Gamaldfb507c2010-05-11 22:22:40 +03003217 case 0xa8 ... 0xa9: /* test ax, imm */
3218 goto test;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003219 case 0xae ... 0xaf: /* scas */
Avi Kivityf6b33fc2010-08-17 11:20:37 +03003220 goto cmp;
Avi Kivity018a98d2007-11-27 19:30:56 +02003221 case 0xc0 ... 0xc1:
3222 emulate_grp2(ctxt);
3223 break;
Avi Kivity111de5d2007-11-27 19:14:21 +02003224 case 0xc3: /* ret */
Avi Kivitycf5de4f2008-11-28 00:14:07 +02003225 c->dst.type = OP_REG;
Avi Kivity1a6440aef2010-08-01 12:35:10 +03003226 c->dst.addr.reg = &c->eip;
Avi Kivitycf5de4f2008-11-28 00:14:07 +02003227 c->dst.bytes = c->op_bytes;
Avi Kivity111de5d2007-11-27 19:14:21 +02003228 goto pop_instruction;
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08003229 case 0xc4: /* les */
3230 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_ES);
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08003231 break;
3232 case 0xc5: /* lds */
3233 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_DS);
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08003234 break;
Avi Kivitya77ab5e2009-01-05 13:27:34 +02003235 case 0xcb: /* ret far */
3236 rc = emulate_ret_far(ctxt, ops);
Avi Kivitya77ab5e2009-01-05 13:27:34 +02003237 break;
Mohammed Gamal6e154e52010-08-04 14:38:06 +03003238 case 0xcc: /* int3 */
3239 irq = 3;
3240 goto do_interrupt;
3241 case 0xcd: /* int n */
3242 irq = c->src.val;
3243 do_interrupt:
3244 rc = emulate_int(ctxt, ops, irq);
Mohammed Gamal6e154e52010-08-04 14:38:06 +03003245 break;
3246 case 0xce: /* into */
3247 if (ctxt->eflags & EFLG_OF) {
3248 irq = 4;
3249 goto do_interrupt;
3250 }
3251 break;
Mohammed Gamal62bd4302010-07-28 12:38:40 +03003252 case 0xcf: /* iret */
3253 rc = emulate_iret(ctxt, ops);
Mohammed Gamal62bd4302010-07-28 12:38:40 +03003254 break;
Avi Kivity018a98d2007-11-27 19:30:56 +02003255 case 0xd0 ... 0xd1: /* Grp2 */
Avi Kivity018a98d2007-11-27 19:30:56 +02003256 emulate_grp2(ctxt);
3257 break;
3258 case 0xd2 ... 0xd3: /* Grp2 */
3259 c->src.val = c->regs[VCPU_REGS_RCX];
3260 emulate_grp2(ctxt);
3261 break;
Wei Yongjunf2f31842010-08-18 16:38:21 +08003262 case 0xe0 ... 0xe2: /* loop/loopz/loopnz */
3263 register_address_increment(c, &c->regs[VCPU_REGS_RCX], -1);
3264 if (address_mask(c, c->regs[VCPU_REGS_RCX]) != 0 &&
3265 (c->b == 0xe2 || test_cc(c->b ^ 0x5, ctxt->eflags)))
3266 jmp_rel(c, c->src.val);
3267 break;
Wei Yongjune4abac62010-08-19 14:25:48 +08003268 case 0xe3: /* jcxz/jecxz/jrcxz */
3269 if (address_mask(c, c->regs[VCPU_REGS_RCX]) == 0)
3270 jmp_rel(c, c->src.val);
3271 break;
Mohammed Gamala6a30342008-09-06 17:22:29 +03003272 case 0xe4: /* inb */
3273 case 0xe5: /* in */
Gleb Natapovcf8f70b2010-03-18 15:20:23 +02003274 goto do_io_in;
Mohammed Gamala6a30342008-09-06 17:22:29 +03003275 case 0xe6: /* outb */
3276 case 0xe7: /* out */
Gleb Natapovcf8f70b2010-03-18 15:20:23 +02003277 goto do_io_out;
Nitin A Kamble1a52e052007-09-18 16:34:25 -07003278 case 0xe8: /* call (near) */ {
Gleb Natapovd53c4772009-04-12 13:36:36 +03003279 long int rel = c->src.val;
Laurent Viviere4e03de2007-09-18 11:52:50 +02003280 c->src.val = (unsigned long) c->eip;
Harvey Harrison7a9572752008-02-19 07:40:41 -08003281 jmp_rel(c, rel);
Gleb Natapov79168fd2010-04-28 19:15:30 +03003282 emulate_push(ctxt, ops);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02003283 break;
Nitin A Kamble1a52e052007-09-18 16:34:25 -07003284 }
3285 case 0xe9: /* jmp rel */
Guillaume Thouvenin954cd362008-05-27 10:19:08 +02003286 goto jmp;
Gleb Natapov414e6272010-04-28 19:15:26 +03003287 case 0xea: { /* jmp far */
3288 unsigned short sel;
Gleb Natapovea79849d2010-02-25 16:36:43 +02003289 jump_far:
Gleb Natapov414e6272010-04-28 19:15:26 +03003290 memcpy(&sel, c->src.valptr + c->op_bytes, 2);
3291
3292 if (load_segment_descriptor(ctxt, ops, sel, VCPU_SREG_CS))
Gleb Natapovc6975182010-02-18 12:15:01 +02003293 goto done;
Guillaume Thouvenin954cd362008-05-27 10:19:08 +02003294
Gleb Natapov414e6272010-04-28 19:15:26 +03003295 c->eip = 0;
3296 memcpy(&c->eip, c->src.valptr, c->op_bytes);
Guillaume Thouvenin954cd362008-05-27 10:19:08 +02003297 break;
Gleb Natapov414e6272010-04-28 19:15:26 +03003298 }
Guillaume Thouvenin954cd362008-05-27 10:19:08 +02003299 case 0xeb:
3300 jmp: /* jmp rel short */
Harvey Harrison7a9572752008-02-19 07:40:41 -08003301 jmp_rel(c, c->src.val);
Laurent Viviera01af5e2007-09-24 11:10:56 +02003302 c->dst.type = OP_NONE; /* Disable writeback. */
Nitin A Kamble1a52e052007-09-18 16:34:25 -07003303 break;
Mohammed Gamala6a30342008-09-06 17:22:29 +03003304 case 0xec: /* in al,dx */
3305 case 0xed: /* in (e/r)ax,dx */
Gleb Natapovcf8f70b2010-03-18 15:20:23 +02003306 c->src.val = c->regs[VCPU_REGS_RDX];
3307 do_io_in:
3308 c->dst.bytes = min(c->dst.bytes, 4u);
3309 if (!emulator_io_permited(ctxt, ops, c->src.val, c->dst.bytes)) {
Avi Kivity35d3d4a2010-11-22 17:53:25 +02003310 rc = emulate_gp(ctxt, 0);
Gleb Natapovf850e2e2010-02-10 14:21:33 +02003311 goto done;
3312 }
Gleb Natapov7b262e92010-03-18 15:20:27 +02003313 if (!pio_in_emulated(ctxt, ops, c->dst.bytes, c->src.val,
3314 &c->dst.val))
Gleb Natapovcf8f70b2010-03-18 15:20:23 +02003315 goto done; /* IO is needed */
3316 break;
Wei Yongjunce7a0ad2010-07-06 16:50:21 +08003317 case 0xee: /* out dx,al */
3318 case 0xef: /* out dx,(e/r)ax */
Wei Yongjun41167be2010-08-06 11:45:12 +08003319 c->dst.val = c->regs[VCPU_REGS_RDX];
Gleb Natapovcf8f70b2010-03-18 15:20:23 +02003320 do_io_out:
Wei Yongjun41167be2010-08-06 11:45:12 +08003321 c->src.bytes = min(c->src.bytes, 4u);
3322 if (!emulator_io_permited(ctxt, ops, c->dst.val,
3323 c->src.bytes)) {
Avi Kivity35d3d4a2010-11-22 17:53:25 +02003324 rc = emulate_gp(ctxt, 0);
Gleb Natapovcf8f70b2010-03-18 15:20:23 +02003325 goto done;
Mohammed Gamala6a30342008-09-06 17:22:29 +03003326 }
Wei Yongjun41167be2010-08-06 11:45:12 +08003327 ops->pio_out_emulated(c->src.bytes, c->dst.val,
3328 &c->src.val, 1, ctxt->vcpu);
Gleb Natapovcf8f70b2010-03-18 15:20:23 +02003329 c->dst.type = OP_NONE; /* Disable writeback. */
Guillaume Thouvenine93f36b2008-10-28 10:51:30 +01003330 break;
Avi Kivity111de5d2007-11-27 19:14:21 +02003331 case 0xf4: /* hlt */
Zhang Xiantaoad312c72007-12-13 23:50:52 +08003332 ctxt->vcpu->arch.halt_request = 1;
Mohammed Gamal19fdfa02008-07-06 16:51:26 +03003333 break;
Avi Kivity111de5d2007-11-27 19:14:21 +02003334 case 0xf5: /* cmc */
3335 /* complement carry flag from eflags reg */
3336 ctxt->eflags ^= EFLG_CF;
Avi Kivity111de5d2007-11-27 19:14:21 +02003337 break;
Avi Kivity018a98d2007-11-27 19:30:56 +02003338 case 0xf6 ... 0xf7: /* Grp3 */
Avi Kivity34d1f492010-08-26 11:59:01 +03003339 rc = emulate_grp3(ctxt, ops);
Avi Kivity018a98d2007-11-27 19:30:56 +02003340 break;
Avi Kivity111de5d2007-11-27 19:14:21 +02003341 case 0xf8: /* clc */
3342 ctxt->eflags &= ~EFLG_CF;
Avi Kivity111de5d2007-11-27 19:14:21 +02003343 break;
Mohammed Gamal8744aa92010-08-05 15:42:49 +03003344 case 0xf9: /* stc */
3345 ctxt->eflags |= EFLG_CF;
3346 break;
Avi Kivity111de5d2007-11-27 19:14:21 +02003347 case 0xfa: /* cli */
Wei Yongjun07cbc6c2010-07-06 16:54:19 +08003348 if (emulator_bad_iopl(ctxt, ops)) {
Avi Kivity35d3d4a2010-11-22 17:53:25 +02003349 rc = emulate_gp(ctxt, 0);
Wei Yongjun07cbc6c2010-07-06 16:54:19 +08003350 goto done;
Wei Yongjun36089fe2010-08-04 15:38:18 +08003351 } else
Gleb Natapovf850e2e2010-02-10 14:21:33 +02003352 ctxt->eflags &= ~X86_EFLAGS_IF;
Avi Kivity111de5d2007-11-27 19:14:21 +02003353 break;
3354 case 0xfb: /* sti */
Wei Yongjun07cbc6c2010-07-06 16:54:19 +08003355 if (emulator_bad_iopl(ctxt, ops)) {
Avi Kivity35d3d4a2010-11-22 17:53:25 +02003356 rc = emulate_gp(ctxt, 0);
Wei Yongjun07cbc6c2010-07-06 16:54:19 +08003357 goto done;
3358 } else {
Gleb Natapov95cb2292010-04-28 19:15:43 +03003359 ctxt->interruptibility = KVM_X86_SHADOW_INT_STI;
Gleb Natapovf850e2e2010-02-10 14:21:33 +02003360 ctxt->eflags |= X86_EFLAGS_IF;
Gleb Natapovf850e2e2010-02-10 14:21:33 +02003361 }
Avi Kivity111de5d2007-11-27 19:14:21 +02003362 break;
Mohammed Gamalfb4616f2008-09-01 04:52:24 +03003363 case 0xfc: /* cld */
3364 ctxt->eflags &= ~EFLG_DF;
Mohammed Gamalfb4616f2008-09-01 04:52:24 +03003365 break;
3366 case 0xfd: /* std */
3367 ctxt->eflags |= EFLG_DF;
Mohammed Gamalfb4616f2008-09-01 04:52:24 +03003368 break;
Gleb Natapovea79849d2010-02-25 16:36:43 +02003369 case 0xfe: /* Grp4 */
3370 grp45:
Avi Kivity018a98d2007-11-27 19:30:56 +02003371 rc = emulate_grp45(ctxt, ops);
Avi Kivity018a98d2007-11-27 19:30:56 +02003372 break;
Gleb Natapovea79849d2010-02-25 16:36:43 +02003373 case 0xff: /* Grp5 */
3374 if (c->modrm_reg == 5)
3375 goto jump_far;
3376 goto grp45;
Avi Kivity91269b82010-07-25 14:51:16 +03003377 default:
3378 goto cannot_emulate;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003379 }
Avi Kivity018a98d2007-11-27 19:30:56 +02003380
Avi Kivity7d9ddae2010-08-30 17:12:28 +03003381 if (rc != X86EMUL_CONTINUE)
3382 goto done;
3383
Avi Kivity018a98d2007-11-27 19:30:56 +02003384writeback:
3385 rc = writeback(ctxt, ops);
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09003386 if (rc != X86EMUL_CONTINUE)
Avi Kivity018a98d2007-11-27 19:30:56 +02003387 goto done;
3388
Gleb Natapov5cd21912010-03-18 15:20:26 +02003389 /*
3390 * restore dst type in case the decoding will be reused
3391 * (happens for string instruction )
3392 */
3393 c->dst.type = saved_dst_type;
3394
Gleb Natapova682e352010-03-18 15:20:21 +02003395 if ((c->d & SrcMask) == SrcSI)
Avi Kivity90de84f2010-11-17 15:28:21 +02003396 string_addr_inc(ctxt, seg_override(ctxt, ops, c),
Gleb Natapov79168fd2010-04-28 19:15:30 +03003397 VCPU_REGS_RSI, &c->src);
Gleb Natapova682e352010-03-18 15:20:21 +02003398
3399 if ((c->d & DstMask) == DstDI)
Avi Kivity90de84f2010-11-17 15:28:21 +02003400 string_addr_inc(ctxt, VCPU_SREG_ES, VCPU_REGS_RDI,
Gleb Natapov79168fd2010-04-28 19:15:30 +03003401 &c->dst);
Gleb Natapovd9271122010-03-18 15:20:22 +02003402
Gleb Natapov5cd21912010-03-18 15:20:26 +02003403 if (c->rep_prefix && (c->d & String)) {
Gleb Natapov6e2fb2c2010-08-25 12:47:41 +03003404 struct read_cache *r = &ctxt->decode.io_read;
Gleb Natapovd9271122010-03-18 15:20:22 +02003405 register_address_increment(c, &c->regs[VCPU_REGS_RCX], -1);
Gleb Natapov3e2f65d2010-08-25 12:47:42 +03003406
Gleb Natapovd2ddd1c2010-08-25 12:47:43 +03003407 if (!string_insn_completed(ctxt)) {
3408 /*
3409 * Re-enter guest when pio read ahead buffer is empty
3410 * or, if it is not used, after each 1024 iteration.
3411 */
3412 if ((r->end != 0 || c->regs[VCPU_REGS_RCX] & 0x3ff) &&
3413 (r->end == 0 || r->end != r->pos)) {
3414 /*
3415 * Reset read cache. Usually happens before
3416 * decode, but since instruction is restarted
3417 * we have to do it here.
3418 */
3419 ctxt->decode.mem_read.end = 0;
3420 return EMULATION_RESTART;
3421 }
3422 goto done; /* skip rip writeback */
Avi Kivity0fa6ccb2010-08-17 11:22:17 +03003423 }
Gleb Natapov5cd21912010-03-18 15:20:26 +02003424 }
Gleb Natapovd2ddd1c2010-08-25 12:47:43 +03003425
3426 ctxt->eip = c->eip;
Avi Kivity018a98d2007-11-27 19:30:56 +02003427
3428done:
Avi Kivityda9cb572010-11-22 17:53:21 +02003429 if (rc == X86EMUL_PROPAGATE_FAULT)
3430 ctxt->have_exception = true;
Gleb Natapovd2ddd1c2010-08-25 12:47:43 +03003431 return (rc == X86EMUL_UNHANDLEABLE) ? EMULATION_FAILED : EMULATION_OK;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003432
3433twobyte_insn:
Laurent Viviere4e03de2007-09-18 11:52:50 +02003434 switch (c->b) {
Avi Kivity6aa8b732006-12-10 02:21:36 -08003435 case 0x01: /* lgdt, lidt, lmsw */
Laurent Viviere4e03de2007-09-18 11:52:50 +02003436 switch (c->modrm_reg) {
Avi Kivity6aa8b732006-12-10 02:21:36 -08003437 u16 size;
3438 unsigned long address;
3439
Anthony Liguoriaca7f962007-09-17 14:57:49 -05003440 case 0: /* vmcall */
Laurent Viviere4e03de2007-09-18 11:52:50 +02003441 if (c->modrm_mod != 3 || c->modrm_rm != 1)
Anthony Liguoriaca7f962007-09-17 14:57:49 -05003442 goto cannot_emulate;
3443
Anthony Liguori7aa81cc2007-09-17 14:57:50 -05003444 rc = kvm_fix_hypercall(ctxt->vcpu);
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09003445 if (rc != X86EMUL_CONTINUE)
Anthony Liguori7aa81cc2007-09-17 14:57:50 -05003446 goto done;
3447
Avi Kivity33e38852008-05-21 15:34:25 +03003448 /* Let the processor re-execute the fixed hypercall */
Gleb Natapov063db062010-03-18 15:20:06 +02003449 c->eip = ctxt->eip;
Avi Kivity16286d02008-04-14 14:40:50 +03003450 /* Disable writeback. */
3451 c->dst.type = OP_NONE;
Anthony Liguoriaca7f962007-09-17 14:57:49 -05003452 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003453 case 2: /* lgdt */
Avi Kivity1a6440aef2010-08-01 12:35:10 +03003454 rc = read_descriptor(ctxt, ops, c->src.addr.mem,
Laurent Viviere4e03de2007-09-18 11:52:50 +02003455 &size, &address, c->op_bytes);
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09003456 if (rc != X86EMUL_CONTINUE)
Avi Kivity6aa8b732006-12-10 02:21:36 -08003457 goto done;
3458 realmode_lgdt(ctxt->vcpu, size, address);
Avi Kivity16286d02008-04-14 14:40:50 +03003459 /* Disable writeback. */
3460 c->dst.type = OP_NONE;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003461 break;
Anthony Liguoriaca7f962007-09-17 14:57:49 -05003462 case 3: /* lidt/vmmcall */
Avi Kivity2b3d2a22008-12-23 19:46:01 +02003463 if (c->modrm_mod == 3) {
3464 switch (c->modrm_rm) {
3465 case 1:
3466 rc = kvm_fix_hypercall(ctxt->vcpu);
Avi Kivity2b3d2a22008-12-23 19:46:01 +02003467 break;
3468 default:
3469 goto cannot_emulate;
3470 }
Anthony Liguoriaca7f962007-09-17 14:57:49 -05003471 } else {
Avi Kivity1a6440aef2010-08-01 12:35:10 +03003472 rc = read_descriptor(ctxt, ops, c->src.addr.mem,
Anthony Liguoriaca7f962007-09-17 14:57:49 -05003473 &size, &address,
Laurent Viviere4e03de2007-09-18 11:52:50 +02003474 c->op_bytes);
Takuya Yoshikawa1b30eaa2010-02-12 15:57:56 +09003475 if (rc != X86EMUL_CONTINUE)
Anthony Liguoriaca7f962007-09-17 14:57:49 -05003476 goto done;
3477 realmode_lidt(ctxt->vcpu, size, address);
3478 }
Avi Kivity16286d02008-04-14 14:40:50 +03003479 /* Disable writeback. */
3480 c->dst.type = OP_NONE;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003481 break;
3482 case 4: /* smsw */
Avi Kivity16286d02008-04-14 14:40:50 +03003483 c->dst.bytes = 2;
Gleb Natapov52a46612010-03-18 15:20:03 +02003484 c->dst.val = ops->get_cr(0, ctxt->vcpu);
Avi Kivity6aa8b732006-12-10 02:21:36 -08003485 break;
3486 case 6: /* lmsw */
Avi Kivity9928ff62010-08-01 18:35:24 +03003487 ops->set_cr(0, (ops->get_cr(0, ctxt->vcpu) & ~0x0eul) |
Gleb Natapov93a152b2010-03-18 15:20:04 +02003488 (c->src.val & 0x0f), ctxt->vcpu);
Avi Kivitydc7457e2008-04-30 16:13:36 +03003489 c->dst.type = OP_NONE;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003490 break;
Gleb Natapov6e1e5ff2010-03-18 15:20:08 +02003491 case 5: /* not defined */
Gleb Natapov54b84862010-04-28 19:15:44 +03003492 emulate_ud(ctxt);
Avi Kivityda9cb572010-11-22 17:53:21 +02003493 rc = X86EMUL_PROPAGATE_FAULT;
Gleb Natapov6e1e5ff2010-03-18 15:20:08 +02003494 goto done;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003495 case 7: /* invlpg*/
Avi Kivity90de84f2010-11-17 15:28:21 +02003496 emulate_invlpg(ctxt->vcpu,
3497 linear(ctxt, c->src.addr.mem));
Avi Kivity16286d02008-04-14 14:40:50 +03003498 /* Disable writeback. */
3499 c->dst.type = OP_NONE;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003500 break;
3501 default:
3502 goto cannot_emulate;
3503 }
3504 break;
Andre Przywarae99f0502009-06-17 15:50:33 +02003505 case 0x05: /* syscall */
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03003506 rc = emulate_syscall(ctxt, ops);
Andre Przywarae99f0502009-06-17 15:50:33 +02003507 break;
Avi Kivity018a98d2007-11-27 19:30:56 +02003508 case 0x06:
3509 emulate_clts(ctxt->vcpu);
Avi Kivity018a98d2007-11-27 19:30:56 +02003510 break;
Avi Kivity018a98d2007-11-27 19:30:56 +02003511 case 0x09: /* wbinvd */
Sheng Yangf5f48ee2010-06-30 12:25:15 +08003512 kvm_emulate_wbinvd(ctxt->vcpu);
Sheng Yangf5f48ee2010-06-30 12:25:15 +08003513 break;
3514 case 0x08: /* invd */
Avi Kivity018a98d2007-11-27 19:30:56 +02003515 case 0x0d: /* GrpP (prefetch) */
3516 case 0x18: /* Grp16 (prefetch/nop) */
Avi Kivity018a98d2007-11-27 19:30:56 +02003517 break;
3518 case 0x20: /* mov cr, reg */
Gleb Natapov6aebfa62010-03-18 15:20:10 +02003519 switch (c->modrm_reg) {
3520 case 1:
3521 case 5 ... 7:
3522 case 9 ... 15:
Gleb Natapov54b84862010-04-28 19:15:44 +03003523 emulate_ud(ctxt);
Avi Kivityda9cb572010-11-22 17:53:21 +02003524 rc = X86EMUL_PROPAGATE_FAULT;
Gleb Natapov6aebfa62010-03-18 15:20:10 +02003525 goto done;
3526 }
Avi Kivity1a0c7d42010-08-01 14:25:22 +03003527 c->dst.val = ops->get_cr(c->modrm_reg, ctxt->vcpu);
Avi Kivity018a98d2007-11-27 19:30:56 +02003528 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003529 case 0x21: /* mov from dr to reg */
Gleb Natapov1e470be2010-03-18 15:20:11 +02003530 if ((ops->get_cr(4, ctxt->vcpu) & X86_CR4_DE) &&
3531 (c->modrm_reg == 4 || c->modrm_reg == 5)) {
Gleb Natapov54b84862010-04-28 19:15:44 +03003532 emulate_ud(ctxt);
Avi Kivityda9cb572010-11-22 17:53:21 +02003533 rc = X86EMUL_PROPAGATE_FAULT;
Gleb Natapov1e470be2010-03-18 15:20:11 +02003534 goto done;
3535 }
Avi Kivityb27f3852010-08-01 14:25:22 +03003536 ops->get_dr(c->modrm_reg, &c->dst.val, ctxt->vcpu);
Avi Kivity6aa8b732006-12-10 02:21:36 -08003537 break;
Avi Kivity018a98d2007-11-27 19:30:56 +02003538 case 0x22: /* mov reg, cr */
Avi Kivity1a0c7d42010-08-01 14:25:22 +03003539 if (ops->set_cr(c->modrm_reg, c->src.val, ctxt->vcpu)) {
Gleb Natapov54b84862010-04-28 19:15:44 +03003540 emulate_gp(ctxt, 0);
Avi Kivityda9cb572010-11-22 17:53:21 +02003541 rc = X86EMUL_PROPAGATE_FAULT;
Gleb Natapov0f122442010-04-28 19:15:31 +03003542 goto done;
3543 }
Avi Kivity018a98d2007-11-27 19:30:56 +02003544 c->dst.type = OP_NONE;
3545 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003546 case 0x23: /* mov from reg to dr */
Gleb Natapov1e470be2010-03-18 15:20:11 +02003547 if ((ops->get_cr(4, ctxt->vcpu) & X86_CR4_DE) &&
3548 (c->modrm_reg == 4 || c->modrm_reg == 5)) {
Gleb Natapov54b84862010-04-28 19:15:44 +03003549 emulate_ud(ctxt);
Avi Kivityda9cb572010-11-22 17:53:21 +02003550 rc = X86EMUL_PROPAGATE_FAULT;
Gleb Natapov1e470be2010-03-18 15:20:11 +02003551 goto done;
3552 }
Gleb Natapov35aa5372010-04-28 19:15:27 +03003553
Avi Kivityb27f3852010-08-01 14:25:22 +03003554 if (ops->set_dr(c->modrm_reg, c->src.val &
Gleb Natapov338dbc92010-04-28 19:15:32 +03003555 ((ctxt->mode == X86EMUL_MODE_PROT64) ?
3556 ~0ULL : ~0U), ctxt->vcpu) < 0) {
3557 /* #UD condition is already handled by the code above */
Gleb Natapov54b84862010-04-28 19:15:44 +03003558 emulate_gp(ctxt, 0);
Avi Kivityda9cb572010-11-22 17:53:21 +02003559 rc = X86EMUL_PROPAGATE_FAULT;
Gleb Natapov338dbc92010-04-28 19:15:32 +03003560 goto done;
3561 }
3562
Laurent Viviera01af5e2007-09-24 11:10:56 +02003563 c->dst.type = OP_NONE; /* no writeback */
Avi Kivity6aa8b732006-12-10 02:21:36 -08003564 break;
Avi Kivity018a98d2007-11-27 19:30:56 +02003565 case 0x30:
3566 /* wrmsr */
3567 msr_data = (u32)c->regs[VCPU_REGS_RAX]
3568 | ((u64)c->regs[VCPU_REGS_RDX] << 32);
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03003569 if (ops->set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data)) {
Gleb Natapov54b84862010-04-28 19:15:44 +03003570 emulate_gp(ctxt, 0);
Avi Kivityda9cb572010-11-22 17:53:21 +02003571 rc = X86EMUL_PROPAGATE_FAULT;
Gleb Natapovfd525362010-03-18 15:20:13 +02003572 goto done;
Avi Kivity018a98d2007-11-27 19:30:56 +02003573 }
3574 rc = X86EMUL_CONTINUE;
Avi Kivity018a98d2007-11-27 19:30:56 +02003575 break;
3576 case 0x32:
3577 /* rdmsr */
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03003578 if (ops->get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data)) {
Gleb Natapov54b84862010-04-28 19:15:44 +03003579 emulate_gp(ctxt, 0);
Avi Kivityda9cb572010-11-22 17:53:21 +02003580 rc = X86EMUL_PROPAGATE_FAULT;
Gleb Natapovfd525362010-03-18 15:20:13 +02003581 goto done;
Avi Kivity018a98d2007-11-27 19:30:56 +02003582 } else {
3583 c->regs[VCPU_REGS_RAX] = (u32)msr_data;
3584 c->regs[VCPU_REGS_RDX] = msr_data >> 32;
3585 }
3586 rc = X86EMUL_CONTINUE;
Avi Kivity018a98d2007-11-27 19:30:56 +02003587 break;
Andre Przywarae99f0502009-06-17 15:50:33 +02003588 case 0x34: /* sysenter */
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03003589 rc = emulate_sysenter(ctxt, ops);
Andre Przywarae99f0502009-06-17 15:50:33 +02003590 break;
3591 case 0x35: /* sysexit */
Gleb Natapov3fb1b5d2010-04-28 19:15:28 +03003592 rc = emulate_sysexit(ctxt, ops);
Andre Przywarae99f0502009-06-17 15:50:33 +02003593 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003594 case 0x40 ... 0x4f: /* cmov */
Laurent Viviere4e03de2007-09-18 11:52:50 +02003595 c->dst.val = c->dst.orig_val = c->src.val;
Laurent Viviera01af5e2007-09-24 11:10:56 +02003596 if (!test_cc(c->b, ctxt->eflags))
3597 c->dst.type = OP_NONE; /* no writeback */
Avi Kivity6aa8b732006-12-10 02:21:36 -08003598 break;
Gleb Natapovb2833e32009-04-12 13:36:30 +03003599 case 0x80 ... 0x8f: /* jnz rel, etc*/
Avi Kivity018a98d2007-11-27 19:30:56 +02003600 if (test_cc(c->b, ctxt->eflags))
Gleb Natapovb2833e32009-04-12 13:36:30 +03003601 jmp_rel(c, c->src.val);
Avi Kivity018a98d2007-11-27 19:30:56 +02003602 break;
Wei Yongjunee45b582010-08-06 17:10:07 +08003603 case 0x90 ... 0x9f: /* setcc r/m8 */
3604 c->dst.val = test_cc(c->b, ctxt->eflags);
3605 break;
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003606 case 0xa0: /* push fs */
Gleb Natapov79168fd2010-04-28 19:15:30 +03003607 emulate_push_sreg(ctxt, ops, VCPU_SREG_FS);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003608 break;
3609 case 0xa1: /* pop fs */
3610 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_FS);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003611 break;
Nitin A Kamble7de75242007-09-15 10:13:07 +03003612 case 0xa3:
3613 bt: /* bt */
Qing Hee4f8e032007-09-24 17:22:13 +08003614 c->dst.type = OP_NONE;
Laurent Viviere4e03de2007-09-18 11:52:50 +02003615 /* only subword offset */
3616 c->src.val &= (c->dst.bytes << 3) - 1;
Laurent Vivier05f086f2007-09-24 11:10:55 +02003617 emulate_2op_SrcV_nobyte("bt", c->src, c->dst, ctxt->eflags);
Nitin A Kamble7de75242007-09-15 10:13:07 +03003618 break;
Guillaume Thouvenin9bf8ea42008-12-04 14:30:13 +01003619 case 0xa4: /* shld imm8, r, r/m */
3620 case 0xa5: /* shld cl, r, r/m */
3621 emulate_2op_cl("shld", c->src2, c->src, c->dst, ctxt->eflags);
3622 break;
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003623 case 0xa8: /* push gs */
Gleb Natapov79168fd2010-04-28 19:15:30 +03003624 emulate_push_sreg(ctxt, ops, VCPU_SREG_GS);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003625 break;
3626 case 0xa9: /* pop gs */
3627 rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_GS);
Mohammed Gamal0934ac92009-08-23 14:24:24 +03003628 break;
Nitin A Kamble7de75242007-09-15 10:13:07 +03003629 case 0xab:
3630 bts: /* bts */
Laurent Vivier05f086f2007-09-24 11:10:55 +02003631 emulate_2op_SrcV_nobyte("bts", c->src, c->dst, ctxt->eflags);
Nitin A Kamble7de75242007-09-15 10:13:07 +03003632 break;
Guillaume Thouvenin9bf8ea42008-12-04 14:30:13 +01003633 case 0xac: /* shrd imm8, r, r/m */
3634 case 0xad: /* shrd cl, r, r/m */
3635 emulate_2op_cl("shrd", c->src2, c->src, c->dst, ctxt->eflags);
3636 break;
Glauber Costa2a7c5b82008-07-10 17:08:15 -03003637 case 0xae: /* clflush */
3638 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003639 case 0xb0 ... 0xb1: /* cmpxchg */
3640 /*
3641 * Save real source value, then compare EAX against
3642 * destination.
3643 */
Laurent Viviere4e03de2007-09-18 11:52:50 +02003644 c->src.orig_val = c->src.val;
3645 c->src.val = c->regs[VCPU_REGS_RAX];
Laurent Vivier05f086f2007-09-24 11:10:55 +02003646 emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
3647 if (ctxt->eflags & EFLG_ZF) {
Avi Kivity6aa8b732006-12-10 02:21:36 -08003648 /* Success: write back to memory. */
Laurent Viviere4e03de2007-09-18 11:52:50 +02003649 c->dst.val = c->src.orig_val;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003650 } else {
3651 /* Failure: write the value we saw to EAX. */
Laurent Viviere4e03de2007-09-18 11:52:50 +02003652 c->dst.type = OP_REG;
Avi Kivity1a6440aef2010-08-01 12:35:10 +03003653 c->dst.addr.reg = (unsigned long *)&c->regs[VCPU_REGS_RAX];
Avi Kivity6aa8b732006-12-10 02:21:36 -08003654 }
3655 break;
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08003656 case 0xb2: /* lss */
3657 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_SS);
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08003658 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003659 case 0xb3:
3660 btr: /* btr */
Laurent Vivier05f086f2007-09-24 11:10:55 +02003661 emulate_2op_SrcV_nobyte("btr", c->src, c->dst, ctxt->eflags);
Avi Kivity6aa8b732006-12-10 02:21:36 -08003662 break;
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08003663 case 0xb4: /* lfs */
3664 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_FS);
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08003665 break;
3666 case 0xb5: /* lgs */
3667 rc = emulate_load_segment(ctxt, ops, VCPU_SREG_GS);
Wei Yongjun09b5f4d2010-08-23 14:56:54 +08003668 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003669 case 0xb6 ... 0xb7: /* movzx */
Laurent Viviere4e03de2007-09-18 11:52:50 +02003670 c->dst.bytes = c->op_bytes;
3671 c->dst.val = (c->d & ByteOp) ? (u8) c->src.val
3672 : (u16) c->src.val;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003673 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003674 case 0xba: /* Grp8 */
Laurent Viviere4e03de2007-09-18 11:52:50 +02003675 switch (c->modrm_reg & 3) {
Avi Kivity6aa8b732006-12-10 02:21:36 -08003676 case 0:
3677 goto bt;
3678 case 1:
3679 goto bts;
3680 case 2:
3681 goto btr;
3682 case 3:
3683 goto btc;
3684 }
3685 break;
Nitin A Kamble7de75242007-09-15 10:13:07 +03003686 case 0xbb:
3687 btc: /* btc */
Laurent Vivier05f086f2007-09-24 11:10:55 +02003688 emulate_2op_SrcV_nobyte("btc", c->src, c->dst, ctxt->eflags);
Nitin A Kamble7de75242007-09-15 10:13:07 +03003689 break;
Wei Yongjund9574a22010-08-10 13:48:22 +08003690 case 0xbc: { /* bsf */
3691 u8 zf;
3692 __asm__ ("bsf %2, %0; setz %1"
3693 : "=r"(c->dst.val), "=q"(zf)
3694 : "r"(c->src.val));
3695 ctxt->eflags &= ~X86_EFLAGS_ZF;
3696 if (zf) {
3697 ctxt->eflags |= X86_EFLAGS_ZF;
3698 c->dst.type = OP_NONE; /* Disable writeback. */
3699 }
3700 break;
3701 }
3702 case 0xbd: { /* bsr */
3703 u8 zf;
3704 __asm__ ("bsr %2, %0; setz %1"
3705 : "=r"(c->dst.val), "=q"(zf)
3706 : "r"(c->src.val));
3707 ctxt->eflags &= ~X86_EFLAGS_ZF;
3708 if (zf) {
3709 ctxt->eflags |= X86_EFLAGS_ZF;
3710 c->dst.type = OP_NONE; /* Disable writeback. */
3711 }
3712 break;
3713 }
Avi Kivity6aa8b732006-12-10 02:21:36 -08003714 case 0xbe ... 0xbf: /* movsx */
Laurent Viviere4e03de2007-09-18 11:52:50 +02003715 c->dst.bytes = c->op_bytes;
3716 c->dst.val = (c->d & ByteOp) ? (s8) c->src.val :
3717 (s16) c->src.val;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003718 break;
Wei Yongjun92f738a2010-08-17 09:19:34 +08003719 case 0xc0 ... 0xc1: /* xadd */
3720 emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
3721 /* Write back the register source. */
3722 c->src.val = c->dst.orig_val;
3723 write_register_operand(&c->src);
3724 break;
Sheng Yanga012e652007-10-15 14:24:20 +08003725 case 0xc3: /* movnti */
Laurent Viviere4e03de2007-09-18 11:52:50 +02003726 c->dst.bytes = c->op_bytes;
3727 c->dst.val = (c->op_bytes == 4) ? (u32) c->src.val :
3728 (u64) c->src.val;
Sheng Yanga012e652007-10-15 14:24:20 +08003729 break;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003730 case 0xc7: /* Grp9 (cmpxchg8b) */
Gleb Natapov69f55cb2010-03-18 15:20:20 +02003731 rc = emulate_grp9(ctxt, ops);
Laurent Vivier8cdbd2c2007-09-24 11:10:54 +02003732 break;
Avi Kivity91269b82010-07-25 14:51:16 +03003733 default:
3734 goto cannot_emulate;
Avi Kivity6aa8b732006-12-10 02:21:36 -08003735 }
Avi Kivity7d9ddae2010-08-30 17:12:28 +03003736
3737 if (rc != X86EMUL_CONTINUE)
3738 goto done;
3739
Avi Kivity6aa8b732006-12-10 02:21:36 -08003740 goto writeback;
3741
3742cannot_emulate:
Avi Kivity6aa8b732006-12-10 02:21:36 -08003743 return -1;
3744}