xref: /openbmc/qemu/target/i386/hvf/x86_emu.c (revision 0e4e622e)
1 /*
2  * Copyright (C) 2016 Veertu Inc,
3  * Copyright (C) 2017 Google Inc,
4  *
5  * This program is free software; you can redistribute it and/or
6  * modify it under the terms of the GNU Lesser General Public
7  * License as published by the Free Software Foundation; either
8  * version 2.1 of the License, or (at your option) any later version.
9  *
10  * This program is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
13  * Lesser General Public License for more details.
14  *
15  * You should have received a copy of the GNU Lesser General Public
16  * License along with this program; if not, see <http://www.gnu.org/licenses/>.
17  */
18 
19 /////////////////////////////////////////////////////////////////////////
20 //
21 //  Copyright (C) 2001-2012  The Bochs Project
22 //
23 //  This library is free software; you can redistribute it and/or
24 //  modify it under the terms of the GNU Lesser General Public
25 //  License as published by the Free Software Foundation; either
26 //  version 2.1 of the License, or (at your option) any later version.
27 //
28 //  This library is distributed in the hope that it will be useful,
29 //  but WITHOUT ANY WARRANTY; without even the implied warranty of
30 //  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
31 //  Lesser General Public License for more details.
32 //
33 //  You should have received a copy of the GNU Lesser General Public
34 //  License along with this library; if not, write to the Free Software
35 //  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA B 02110-1301 USA
36 /////////////////////////////////////////////////////////////////////////
37 
38 #include "qemu/osdep.h"
39 #include "panic.h"
40 #include "x86_decode.h"
41 #include "x86.h"
42 #include "x86_emu.h"
43 #include "x86_mmu.h"
44 #include "x86_flags.h"
45 #include "vmcs.h"
46 #include "vmx.h"
47 
48 void hvf_handle_io(CPUState *cs, uint16_t port, void *data,
49                    int direction, int size, uint32_t count);
50 
51 #define EXEC_2OP_FLAGS_CMD(env, decode, cmd, FLAGS_FUNC, save_res) \
52 {                                                       \
53     fetch_operands(env, decode, 2, true, true, false);  \
54     switch (decode->operand_size) {                     \
55     case 1:                                         \
56     {                                               \
57         uint8_t v1 = (uint8_t)decode->op[0].val;    \
58         uint8_t v2 = (uint8_t)decode->op[1].val;    \
59         uint8_t diff = v1 cmd v2;                   \
60         if (save_res) {                              \
61             write_val_ext(env, decode->op[0].ptr, diff, 1);  \
62         } \
63         FLAGS_FUNC##8(env, v1, v2, diff);           \
64         break;                                      \
65     }                                               \
66     case 2:                                        \
67     {                                               \
68         uint16_t v1 = (uint16_t)decode->op[0].val;  \
69         uint16_t v2 = (uint16_t)decode->op[1].val;  \
70         uint16_t diff = v1 cmd v2;                  \
71         if (save_res) {                              \
72             write_val_ext(env, decode->op[0].ptr, diff, 2); \
73         } \
74         FLAGS_FUNC##16(env, v1, v2, diff);          \
75         break;                                      \
76     }                                               \
77     case 4:                                        \
78     {                                               \
79         uint32_t v1 = (uint32_t)decode->op[0].val;  \
80         uint32_t v2 = (uint32_t)decode->op[1].val;  \
81         uint32_t diff = v1 cmd v2;                  \
82         if (save_res) {                              \
83             write_val_ext(env, decode->op[0].ptr, diff, 4); \
84         } \
85         FLAGS_FUNC##32(env, v1, v2, diff);          \
86         break;                                      \
87     }                                               \
88     default:                                        \
89         VM_PANIC("bad size\n");                    \
90     }                                                   \
91 }                                                       \
92 
read_reg(CPUX86State * env,int reg,int size)93 target_ulong read_reg(CPUX86State *env, int reg, int size)
94 {
95     switch (size) {
96     case 1:
97         return x86_reg(env, reg)->lx;
98     case 2:
99         return x86_reg(env, reg)->rx;
100     case 4:
101         return x86_reg(env, reg)->erx;
102     case 8:
103         return x86_reg(env, reg)->rrx;
104     default:
105         abort();
106     }
107     return 0;
108 }
109 
write_reg(CPUX86State * env,int reg,target_ulong val,int size)110 void write_reg(CPUX86State *env, int reg, target_ulong val, int size)
111 {
112     switch (size) {
113     case 1:
114         x86_reg(env, reg)->lx = val;
115         break;
116     case 2:
117         x86_reg(env, reg)->rx = val;
118         break;
119     case 4:
120         x86_reg(env, reg)->rrx = (uint32_t)val;
121         break;
122     case 8:
123         x86_reg(env, reg)->rrx = val;
124         break;
125     default:
126         abort();
127     }
128 }
129 
read_val_from_reg(target_ulong reg_ptr,int size)130 target_ulong read_val_from_reg(target_ulong reg_ptr, int size)
131 {
132     target_ulong val;
133 
134     switch (size) {
135     case 1:
136         val = *(uint8_t *)reg_ptr;
137         break;
138     case 2:
139         val = *(uint16_t *)reg_ptr;
140         break;
141     case 4:
142         val = *(uint32_t *)reg_ptr;
143         break;
144     case 8:
145         val = *(uint64_t *)reg_ptr;
146         break;
147     default:
148         abort();
149     }
150     return val;
151 }
152 
write_val_to_reg(target_ulong reg_ptr,target_ulong val,int size)153 void write_val_to_reg(target_ulong reg_ptr, target_ulong val, int size)
154 {
155     switch (size) {
156     case 1:
157         *(uint8_t *)reg_ptr = val;
158         break;
159     case 2:
160         *(uint16_t *)reg_ptr = val;
161         break;
162     case 4:
163         *(uint64_t *)reg_ptr = (uint32_t)val;
164         break;
165     case 8:
166         *(uint64_t *)reg_ptr = val;
167         break;
168     default:
169         abort();
170     }
171 }
172 
is_host_reg(CPUX86State * env,target_ulong ptr)173 static bool is_host_reg(CPUX86State *env, target_ulong ptr)
174 {
175     return (ptr - (target_ulong)&env->regs[0]) < sizeof(env->regs);
176 }
177 
write_val_ext(CPUX86State * env,target_ulong ptr,target_ulong val,int size)178 void write_val_ext(CPUX86State *env, target_ulong ptr, target_ulong val, int size)
179 {
180     if (is_host_reg(env, ptr)) {
181         write_val_to_reg(ptr, val, size);
182         return;
183     }
184     vmx_write_mem(env_cpu(env), ptr, &val, size);
185 }
186 
read_mmio(CPUX86State * env,target_ulong ptr,int bytes)187 uint8_t *read_mmio(CPUX86State *env, target_ulong ptr, int bytes)
188 {
189     vmx_read_mem(env_cpu(env), env->hvf_mmio_buf, ptr, bytes);
190     return env->hvf_mmio_buf;
191 }
192 
193 
read_val_ext(CPUX86State * env,target_ulong ptr,int size)194 target_ulong read_val_ext(CPUX86State *env, target_ulong ptr, int size)
195 {
196     target_ulong val;
197     uint8_t *mmio_ptr;
198 
199     if (is_host_reg(env, ptr)) {
200         return read_val_from_reg(ptr, size);
201     }
202 
203     mmio_ptr = read_mmio(env, ptr, size);
204     switch (size) {
205     case 1:
206         val = *(uint8_t *)mmio_ptr;
207         break;
208     case 2:
209         val = *(uint16_t *)mmio_ptr;
210         break;
211     case 4:
212         val = *(uint32_t *)mmio_ptr;
213         break;
214     case 8:
215         val = *(uint64_t *)mmio_ptr;
216         break;
217     default:
218         VM_PANIC("bad size\n");
219         break;
220     }
221     return val;
222 }
223 
fetch_operands(CPUX86State * env,struct x86_decode * decode,int n,bool val_op0,bool val_op1,bool val_op2)224 static void fetch_operands(CPUX86State *env, struct x86_decode *decode,
225                            int n, bool val_op0, bool val_op1, bool val_op2)
226 {
227     int i;
228     bool calc_val[3] = {val_op0, val_op1, val_op2};
229 
230     for (i = 0; i < n; i++) {
231         switch (decode->op[i].type) {
232         case X86_VAR_IMMEDIATE:
233             break;
234         case X86_VAR_REG:
235             VM_PANIC_ON(!decode->op[i].ptr);
236             if (calc_val[i]) {
237                 decode->op[i].val = read_val_from_reg(decode->op[i].ptr,
238                                                       decode->operand_size);
239             }
240             break;
241         case X86_VAR_RM:
242             calc_modrm_operand(env, decode, &decode->op[i]);
243             if (calc_val[i]) {
244                 decode->op[i].val = read_val_ext(env, decode->op[i].ptr,
245                                                  decode->operand_size);
246             }
247             break;
248         case X86_VAR_OFFSET:
249             decode->op[i].ptr = decode_linear_addr(env, decode,
250                                                    decode->op[i].ptr,
251                                                    R_DS);
252             if (calc_val[i]) {
253                 decode->op[i].val = read_val_ext(env, decode->op[i].ptr,
254                                                  decode->operand_size);
255             }
256             break;
257         default:
258             break;
259         }
260     }
261 }
262 
exec_mov(CPUX86State * env,struct x86_decode * decode)263 static void exec_mov(CPUX86State *env, struct x86_decode *decode)
264 {
265     fetch_operands(env, decode, 2, false, true, false);
266     write_val_ext(env, decode->op[0].ptr, decode->op[1].val,
267                   decode->operand_size);
268 
269     env->eip += decode->len;
270 }
271 
exec_add(CPUX86State * env,struct x86_decode * decode)272 static void exec_add(CPUX86State *env, struct x86_decode *decode)
273 {
274     EXEC_2OP_FLAGS_CMD(env, decode, +, SET_FLAGS_OSZAPC_ADD, true);
275     env->eip += decode->len;
276 }
277 
exec_or(CPUX86State * env,struct x86_decode * decode)278 static void exec_or(CPUX86State *env, struct x86_decode *decode)
279 {
280     EXEC_2OP_FLAGS_CMD(env, decode, |, SET_FLAGS_OSZAPC_LOGIC, true);
281     env->eip += decode->len;
282 }
283 
exec_adc(CPUX86State * env,struct x86_decode * decode)284 static void exec_adc(CPUX86State *env, struct x86_decode *decode)
285 {
286     EXEC_2OP_FLAGS_CMD(env, decode, +get_CF(env)+, SET_FLAGS_OSZAPC_ADD, true);
287     env->eip += decode->len;
288 }
289 
exec_sbb(CPUX86State * env,struct x86_decode * decode)290 static void exec_sbb(CPUX86State *env, struct x86_decode *decode)
291 {
292     EXEC_2OP_FLAGS_CMD(env, decode, -get_CF(env)-, SET_FLAGS_OSZAPC_SUB, true);
293     env->eip += decode->len;
294 }
295 
exec_and(CPUX86State * env,struct x86_decode * decode)296 static void exec_and(CPUX86State *env, struct x86_decode *decode)
297 {
298     EXEC_2OP_FLAGS_CMD(env, decode, &, SET_FLAGS_OSZAPC_LOGIC, true);
299     env->eip += decode->len;
300 }
301 
exec_sub(CPUX86State * env,struct x86_decode * decode)302 static void exec_sub(CPUX86State *env, struct x86_decode *decode)
303 {
304     EXEC_2OP_FLAGS_CMD(env, decode, -, SET_FLAGS_OSZAPC_SUB, true);
305     env->eip += decode->len;
306 }
307 
exec_xor(CPUX86State * env,struct x86_decode * decode)308 static void exec_xor(CPUX86State *env, struct x86_decode *decode)
309 {
310     EXEC_2OP_FLAGS_CMD(env, decode, ^, SET_FLAGS_OSZAPC_LOGIC, true);
311     env->eip += decode->len;
312 }
313 
exec_neg(CPUX86State * env,struct x86_decode * decode)314 static void exec_neg(CPUX86State *env, struct x86_decode *decode)
315 {
316     /*EXEC_2OP_FLAGS_CMD(env, decode, -, SET_FLAGS_OSZAPC_SUB, false);*/
317     int32_t val;
318     fetch_operands(env, decode, 2, true, true, false);
319 
320     val = 0 - sign(decode->op[1].val, decode->operand_size);
321     write_val_ext(env, decode->op[1].ptr, val, decode->operand_size);
322 
323     if (4 == decode->operand_size) {
324         SET_FLAGS_OSZAPC_SUB32(env, 0, 0 - val, val);
325     } else if (2 == decode->operand_size) {
326         SET_FLAGS_OSZAPC_SUB16(env, 0, 0 - val, val);
327     } else if (1 == decode->operand_size) {
328         SET_FLAGS_OSZAPC_SUB8(env, 0, 0 - val, val);
329     } else {
330         VM_PANIC("bad op size\n");
331     }
332 
333     /*lflags_to_rflags(env);*/
334     env->eip += decode->len;
335 }
336 
exec_cmp(CPUX86State * env,struct x86_decode * decode)337 static void exec_cmp(CPUX86State *env, struct x86_decode *decode)
338 {
339     EXEC_2OP_FLAGS_CMD(env, decode, -, SET_FLAGS_OSZAPC_SUB, false);
340     env->eip += decode->len;
341 }
342 
exec_inc(CPUX86State * env,struct x86_decode * decode)343 static void exec_inc(CPUX86State *env, struct x86_decode *decode)
344 {
345     decode->op[1].type = X86_VAR_IMMEDIATE;
346     decode->op[1].val = 0;
347 
348     EXEC_2OP_FLAGS_CMD(env, decode, +1+, SET_FLAGS_OSZAP_ADD, true);
349 
350     env->eip += decode->len;
351 }
352 
exec_dec(CPUX86State * env,struct x86_decode * decode)353 static void exec_dec(CPUX86State *env, struct x86_decode *decode)
354 {
355     decode->op[1].type = X86_VAR_IMMEDIATE;
356     decode->op[1].val = 0;
357 
358     EXEC_2OP_FLAGS_CMD(env, decode, -1-, SET_FLAGS_OSZAP_SUB, true);
359     env->eip += decode->len;
360 }
361 
exec_tst(CPUX86State * env,struct x86_decode * decode)362 static void exec_tst(CPUX86State *env, struct x86_decode *decode)
363 {
364     EXEC_2OP_FLAGS_CMD(env, decode, &, SET_FLAGS_OSZAPC_LOGIC, false);
365     env->eip += decode->len;
366 }
367 
exec_not(CPUX86State * env,struct x86_decode * decode)368 static void exec_not(CPUX86State *env, struct x86_decode *decode)
369 {
370     fetch_operands(env, decode, 1, true, false, false);
371 
372     write_val_ext(env, decode->op[0].ptr, ~decode->op[0].val,
373                   decode->operand_size);
374     env->eip += decode->len;
375 }
376 
exec_movzx(CPUX86State * env,struct x86_decode * decode)377 void exec_movzx(CPUX86State *env, struct x86_decode *decode)
378 {
379     int src_op_size;
380     int op_size = decode->operand_size;
381 
382     fetch_operands(env, decode, 1, false, false, false);
383 
384     if (0xb6 == decode->opcode[1]) {
385         src_op_size = 1;
386     } else {
387         src_op_size = 2;
388     }
389     decode->operand_size = src_op_size;
390     calc_modrm_operand(env, decode, &decode->op[1]);
391     decode->op[1].val = read_val_ext(env, decode->op[1].ptr, src_op_size);
392     write_val_ext(env, decode->op[0].ptr, decode->op[1].val, op_size);
393 
394     env->eip += decode->len;
395 }
396 
exec_out(CPUX86State * env,struct x86_decode * decode)397 static void exec_out(CPUX86State *env, struct x86_decode *decode)
398 {
399     switch (decode->opcode[0]) {
400     case 0xe6:
401         hvf_handle_io(env_cpu(env), decode->op[0].val, &AL(env), 1, 1, 1);
402         break;
403     case 0xe7:
404         hvf_handle_io(env_cpu(env), decode->op[0].val, &RAX(env), 1,
405                       decode->operand_size, 1);
406         break;
407     case 0xee:
408         hvf_handle_io(env_cpu(env), DX(env), &AL(env), 1, 1, 1);
409         break;
410     case 0xef:
411         hvf_handle_io(env_cpu(env), DX(env), &RAX(env), 1,
412                       decode->operand_size, 1);
413         break;
414     default:
415         VM_PANIC("Bad out opcode\n");
416         break;
417     }
418     env->eip += decode->len;
419 }
420 
exec_in(CPUX86State * env,struct x86_decode * decode)421 static void exec_in(CPUX86State *env, struct x86_decode *decode)
422 {
423     target_ulong val = 0;
424     switch (decode->opcode[0]) {
425     case 0xe4:
426         hvf_handle_io(env_cpu(env), decode->op[0].val, &AL(env), 0, 1, 1);
427         break;
428     case 0xe5:
429         hvf_handle_io(env_cpu(env), decode->op[0].val, &val, 0,
430                       decode->operand_size, 1);
431         if (decode->operand_size == 2) {
432             AX(env) = val;
433         } else {
434             RAX(env) = (uint32_t)val;
435         }
436         break;
437     case 0xec:
438         hvf_handle_io(env_cpu(env), DX(env), &AL(env), 0, 1, 1);
439         break;
440     case 0xed:
441         hvf_handle_io(env_cpu(env), DX(env), &val, 0, decode->operand_size, 1);
442         if (decode->operand_size == 2) {
443             AX(env) = val;
444         } else {
445             RAX(env) = (uint32_t)val;
446         }
447 
448         break;
449     default:
450         VM_PANIC("Bad in opcode\n");
451         break;
452     }
453 
454     env->eip += decode->len;
455 }
456 
string_increment_reg(CPUX86State * env,int reg,struct x86_decode * decode)457 static inline void string_increment_reg(CPUX86State *env, int reg,
458                                         struct x86_decode *decode)
459 {
460     target_ulong val = read_reg(env, reg, decode->addressing_size);
461     if (env->eflags & DF_MASK) {
462         val -= decode->operand_size;
463     } else {
464         val += decode->operand_size;
465     }
466     write_reg(env, reg, val, decode->addressing_size);
467 }
468 
string_rep(CPUX86State * env,struct x86_decode * decode,void (* func)(CPUX86State * env,struct x86_decode * ins),int rep)469 static inline void string_rep(CPUX86State *env, struct x86_decode *decode,
470                               void (*func)(CPUX86State *env,
471                                            struct x86_decode *ins), int rep)
472 {
473     target_ulong rcx = read_reg(env, R_ECX, decode->addressing_size);
474     while (rcx--) {
475         func(env, decode);
476         write_reg(env, R_ECX, rcx, decode->addressing_size);
477         if ((PREFIX_REP == rep) && !get_ZF(env)) {
478             break;
479         }
480         if ((PREFIX_REPN == rep) && get_ZF(env)) {
481             break;
482         }
483     }
484 }
485 
exec_ins_single(CPUX86State * env,struct x86_decode * decode)486 static void exec_ins_single(CPUX86State *env, struct x86_decode *decode)
487 {
488     target_ulong addr = linear_addr_size(env_cpu(env), RDI(env),
489                                          decode->addressing_size, R_ES);
490 
491     hvf_handle_io(env_cpu(env), DX(env), env->hvf_mmio_buf, 0,
492                   decode->operand_size, 1);
493     vmx_write_mem(env_cpu(env), addr, env->hvf_mmio_buf,
494                   decode->operand_size);
495 
496     string_increment_reg(env, R_EDI, decode);
497 }
498 
exec_ins(CPUX86State * env,struct x86_decode * decode)499 static void exec_ins(CPUX86State *env, struct x86_decode *decode)
500 {
501     if (decode->rep) {
502         string_rep(env, decode, exec_ins_single, 0);
503     } else {
504         exec_ins_single(env, decode);
505     }
506 
507     env->eip += decode->len;
508 }
509 
exec_outs_single(CPUX86State * env,struct x86_decode * decode)510 static void exec_outs_single(CPUX86State *env, struct x86_decode *decode)
511 {
512     target_ulong addr = decode_linear_addr(env, decode, RSI(env), R_DS);
513 
514     vmx_read_mem(env_cpu(env), env->hvf_mmio_buf, addr,
515                  decode->operand_size);
516     hvf_handle_io(env_cpu(env), DX(env), env->hvf_mmio_buf, 1,
517                   decode->operand_size, 1);
518 
519     string_increment_reg(env, R_ESI, decode);
520 }
521 
exec_outs(CPUX86State * env,struct x86_decode * decode)522 static void exec_outs(CPUX86State *env, struct x86_decode *decode)
523 {
524     if (decode->rep) {
525         string_rep(env, decode, exec_outs_single, 0);
526     } else {
527         exec_outs_single(env, decode);
528     }
529 
530     env->eip += decode->len;
531 }
532 
exec_movs_single(CPUX86State * env,struct x86_decode * decode)533 static void exec_movs_single(CPUX86State *env, struct x86_decode *decode)
534 {
535     target_ulong src_addr;
536     target_ulong dst_addr;
537     target_ulong val;
538 
539     src_addr = decode_linear_addr(env, decode, RSI(env), R_DS);
540     dst_addr = linear_addr_size(env_cpu(env), RDI(env),
541                                 decode->addressing_size, R_ES);
542 
543     val = read_val_ext(env, src_addr, decode->operand_size);
544     write_val_ext(env, dst_addr, val, decode->operand_size);
545 
546     string_increment_reg(env, R_ESI, decode);
547     string_increment_reg(env, R_EDI, decode);
548 }
549 
exec_movs(CPUX86State * env,struct x86_decode * decode)550 static void exec_movs(CPUX86State *env, struct x86_decode *decode)
551 {
552     if (decode->rep) {
553         string_rep(env, decode, exec_movs_single, 0);
554     } else {
555         exec_movs_single(env, decode);
556     }
557 
558     env->eip += decode->len;
559 }
560 
exec_cmps_single(CPUX86State * env,struct x86_decode * decode)561 static void exec_cmps_single(CPUX86State *env, struct x86_decode *decode)
562 {
563     target_ulong src_addr;
564     target_ulong dst_addr;
565 
566     src_addr = decode_linear_addr(env, decode, RSI(env), R_DS);
567     dst_addr = linear_addr_size(env_cpu(env), RDI(env),
568                                 decode->addressing_size, R_ES);
569 
570     decode->op[0].type = X86_VAR_IMMEDIATE;
571     decode->op[0].val = read_val_ext(env, src_addr, decode->operand_size);
572     decode->op[1].type = X86_VAR_IMMEDIATE;
573     decode->op[1].val = read_val_ext(env, dst_addr, decode->operand_size);
574 
575     EXEC_2OP_FLAGS_CMD(env, decode, -, SET_FLAGS_OSZAPC_SUB, false);
576 
577     string_increment_reg(env, R_ESI, decode);
578     string_increment_reg(env, R_EDI, decode);
579 }
580 
exec_cmps(CPUX86State * env,struct x86_decode * decode)581 static void exec_cmps(CPUX86State *env, struct x86_decode *decode)
582 {
583     if (decode->rep) {
584         string_rep(env, decode, exec_cmps_single, decode->rep);
585     } else {
586         exec_cmps_single(env, decode);
587     }
588     env->eip += decode->len;
589 }
590 
591 
exec_stos_single(CPUX86State * env,struct x86_decode * decode)592 static void exec_stos_single(CPUX86State *env, struct x86_decode *decode)
593 {
594     target_ulong addr;
595     target_ulong val;
596 
597     addr = linear_addr_size(env_cpu(env), RDI(env),
598                             decode->addressing_size, R_ES);
599     val = read_reg(env, R_EAX, decode->operand_size);
600     vmx_write_mem(env_cpu(env), addr, &val, decode->operand_size);
601 
602     string_increment_reg(env, R_EDI, decode);
603 }
604 
605 
exec_stos(CPUX86State * env,struct x86_decode * decode)606 static void exec_stos(CPUX86State *env, struct x86_decode *decode)
607 {
608     if (decode->rep) {
609         string_rep(env, decode, exec_stos_single, 0);
610     } else {
611         exec_stos_single(env, decode);
612     }
613 
614     env->eip += decode->len;
615 }
616 
exec_scas_single(CPUX86State * env,struct x86_decode * decode)617 static void exec_scas_single(CPUX86State *env, struct x86_decode *decode)
618 {
619     target_ulong addr;
620 
621     addr = linear_addr_size(env_cpu(env), RDI(env),
622                             decode->addressing_size, R_ES);
623     decode->op[1].type = X86_VAR_IMMEDIATE;
624     vmx_read_mem(env_cpu(env), &decode->op[1].val, addr, decode->operand_size);
625 
626     EXEC_2OP_FLAGS_CMD(env, decode, -, SET_FLAGS_OSZAPC_SUB, false);
627     string_increment_reg(env, R_EDI, decode);
628 }
629 
exec_scas(CPUX86State * env,struct x86_decode * decode)630 static void exec_scas(CPUX86State *env, struct x86_decode *decode)
631 {
632     decode->op[0].type = X86_VAR_REG;
633     decode->op[0].reg = R_EAX;
634     if (decode->rep) {
635         string_rep(env, decode, exec_scas_single, decode->rep);
636     } else {
637         exec_scas_single(env, decode);
638     }
639 
640     env->eip += decode->len;
641 }
642 
exec_lods_single(CPUX86State * env,struct x86_decode * decode)643 static void exec_lods_single(CPUX86State *env, struct x86_decode *decode)
644 {
645     target_ulong addr;
646     target_ulong val = 0;
647 
648     addr = decode_linear_addr(env, decode, RSI(env), R_DS);
649     vmx_read_mem(env_cpu(env), &val, addr,  decode->operand_size);
650     write_reg(env, R_EAX, val, decode->operand_size);
651 
652     string_increment_reg(env, R_ESI, decode);
653 }
654 
exec_lods(CPUX86State * env,struct x86_decode * decode)655 static void exec_lods(CPUX86State *env, struct x86_decode *decode)
656 {
657     if (decode->rep) {
658         string_rep(env, decode, exec_lods_single, 0);
659     } else {
660         exec_lods_single(env, decode);
661     }
662 
663     env->eip += decode->len;
664 }
665 
simulate_rdmsr(CPUX86State * env)666 void simulate_rdmsr(CPUX86State *env)
667 {
668     X86CPU *cpu = env_archcpu(env);
669     CPUState *cs = env_cpu(env);
670     uint32_t msr = ECX(env);
671     uint64_t val = 0;
672 
673     switch (msr) {
674     case MSR_IA32_TSC:
675         val = rdtscp() + rvmcs(cs->accel->fd, VMCS_TSC_OFFSET);
676         break;
677     case MSR_IA32_APICBASE:
678         val = cpu_get_apic_base(cpu->apic_state);
679         break;
680     case MSR_IA32_UCODE_REV:
681         val = cpu->ucode_rev;
682         break;
683     case MSR_EFER:
684         val = rvmcs(cs->accel->fd, VMCS_GUEST_IA32_EFER);
685         break;
686     case MSR_FSBASE:
687         val = rvmcs(cs->accel->fd, VMCS_GUEST_FS_BASE);
688         break;
689     case MSR_GSBASE:
690         val = rvmcs(cs->accel->fd, VMCS_GUEST_GS_BASE);
691         break;
692     case MSR_KERNELGSBASE:
693         val = rvmcs(cs->accel->fd, VMCS_HOST_FS_BASE);
694         break;
695     case MSR_STAR:
696         abort();
697         break;
698     case MSR_LSTAR:
699         abort();
700         break;
701     case MSR_CSTAR:
702         abort();
703         break;
704     case MSR_IA32_MISC_ENABLE:
705         val = env->msr_ia32_misc_enable;
706         break;
707     case MSR_MTRRphysBase(0):
708     case MSR_MTRRphysBase(1):
709     case MSR_MTRRphysBase(2):
710     case MSR_MTRRphysBase(3):
711     case MSR_MTRRphysBase(4):
712     case MSR_MTRRphysBase(5):
713     case MSR_MTRRphysBase(6):
714     case MSR_MTRRphysBase(7):
715         val = env->mtrr_var[(ECX(env) - MSR_MTRRphysBase(0)) / 2].base;
716         break;
717     case MSR_MTRRphysMask(0):
718     case MSR_MTRRphysMask(1):
719     case MSR_MTRRphysMask(2):
720     case MSR_MTRRphysMask(3):
721     case MSR_MTRRphysMask(4):
722     case MSR_MTRRphysMask(5):
723     case MSR_MTRRphysMask(6):
724     case MSR_MTRRphysMask(7):
725         val = env->mtrr_var[(ECX(env) - MSR_MTRRphysMask(0)) / 2].mask;
726         break;
727     case MSR_MTRRfix64K_00000:
728         val = env->mtrr_fixed[0];
729         break;
730     case MSR_MTRRfix16K_80000:
731     case MSR_MTRRfix16K_A0000:
732         val = env->mtrr_fixed[ECX(env) - MSR_MTRRfix16K_80000 + 1];
733         break;
734     case MSR_MTRRfix4K_C0000:
735     case MSR_MTRRfix4K_C8000:
736     case MSR_MTRRfix4K_D0000:
737     case MSR_MTRRfix4K_D8000:
738     case MSR_MTRRfix4K_E0000:
739     case MSR_MTRRfix4K_E8000:
740     case MSR_MTRRfix4K_F0000:
741     case MSR_MTRRfix4K_F8000:
742         val = env->mtrr_fixed[ECX(env) - MSR_MTRRfix4K_C0000 + 3];
743         break;
744     case MSR_MTRRdefType:
745         val = env->mtrr_deftype;
746         break;
747     case MSR_CORE_THREAD_COUNT:
748         val = cs->nr_threads * cs->nr_cores;  /* thread count, bits 15..0 */
749         val |= ((uint32_t)cs->nr_cores << 16); /* core count, bits 31..16 */
750         break;
751     default:
752         /* fprintf(stderr, "%s: unknown msr 0x%x\n", __func__, msr); */
753         val = 0;
754         break;
755     }
756 
757     RAX(env) = (uint32_t)val;
758     RDX(env) = (uint32_t)(val >> 32);
759 }
760 
exec_rdmsr(CPUX86State * env,struct x86_decode * decode)761 static void exec_rdmsr(CPUX86State *env, struct x86_decode *decode)
762 {
763     simulate_rdmsr(env);
764     env->eip += decode->len;
765 }
766 
simulate_wrmsr(CPUX86State * env)767 void simulate_wrmsr(CPUX86State *env)
768 {
769     X86CPU *cpu = env_archcpu(env);
770     CPUState *cs = env_cpu(env);
771     uint32_t msr = ECX(env);
772     uint64_t data = ((uint64_t)EDX(env) << 32) | EAX(env);
773 
774     switch (msr) {
775     case MSR_IA32_TSC:
776         break;
777     case MSR_IA32_APICBASE:
778         cpu_set_apic_base(cpu->apic_state, data);
779         break;
780     case MSR_FSBASE:
781         wvmcs(cs->accel->fd, VMCS_GUEST_FS_BASE, data);
782         break;
783     case MSR_GSBASE:
784         wvmcs(cs->accel->fd, VMCS_GUEST_GS_BASE, data);
785         break;
786     case MSR_KERNELGSBASE:
787         wvmcs(cs->accel->fd, VMCS_HOST_FS_BASE, data);
788         break;
789     case MSR_STAR:
790         abort();
791         break;
792     case MSR_LSTAR:
793         abort();
794         break;
795     case MSR_CSTAR:
796         abort();
797         break;
798     case MSR_EFER:
799         /*printf("new efer %llx\n", EFER(cs));*/
800         wvmcs(cs->accel->fd, VMCS_GUEST_IA32_EFER, data);
801         if (data & MSR_EFER_NXE) {
802             hv_vcpu_invalidate_tlb(cs->accel->fd);
803         }
804         break;
805     case MSR_MTRRphysBase(0):
806     case MSR_MTRRphysBase(1):
807     case MSR_MTRRphysBase(2):
808     case MSR_MTRRphysBase(3):
809     case MSR_MTRRphysBase(4):
810     case MSR_MTRRphysBase(5):
811     case MSR_MTRRphysBase(6):
812     case MSR_MTRRphysBase(7):
813         env->mtrr_var[(ECX(env) - MSR_MTRRphysBase(0)) / 2].base = data;
814         break;
815     case MSR_MTRRphysMask(0):
816     case MSR_MTRRphysMask(1):
817     case MSR_MTRRphysMask(2):
818     case MSR_MTRRphysMask(3):
819     case MSR_MTRRphysMask(4):
820     case MSR_MTRRphysMask(5):
821     case MSR_MTRRphysMask(6):
822     case MSR_MTRRphysMask(7):
823         env->mtrr_var[(ECX(env) - MSR_MTRRphysMask(0)) / 2].mask = data;
824         break;
825     case MSR_MTRRfix64K_00000:
826         env->mtrr_fixed[ECX(env) - MSR_MTRRfix64K_00000] = data;
827         break;
828     case MSR_MTRRfix16K_80000:
829     case MSR_MTRRfix16K_A0000:
830         env->mtrr_fixed[ECX(env) - MSR_MTRRfix16K_80000 + 1] = data;
831         break;
832     case MSR_MTRRfix4K_C0000:
833     case MSR_MTRRfix4K_C8000:
834     case MSR_MTRRfix4K_D0000:
835     case MSR_MTRRfix4K_D8000:
836     case MSR_MTRRfix4K_E0000:
837     case MSR_MTRRfix4K_E8000:
838     case MSR_MTRRfix4K_F0000:
839     case MSR_MTRRfix4K_F8000:
840         env->mtrr_fixed[ECX(env) - MSR_MTRRfix4K_C0000 + 3] = data;
841         break;
842     case MSR_MTRRdefType:
843         env->mtrr_deftype = data;
844         break;
845     default:
846         break;
847     }
848 
849     /* Related to support known hypervisor interface */
850     /* if (g_hypervisor_iface)
851          g_hypervisor_iface->wrmsr_handler(cs, msr, data);
852 
853     printf("write msr %llx\n", RCX(cs));*/
854 }
855 
exec_wrmsr(CPUX86State * env,struct x86_decode * decode)856 static void exec_wrmsr(CPUX86State *env, struct x86_decode *decode)
857 {
858     simulate_wrmsr(env);
859     env->eip += decode->len;
860 }
861 
862 /*
863  * flag:
864  * 0 - bt, 1 - btc, 2 - bts, 3 - btr
865  */
do_bt(CPUX86State * env,struct x86_decode * decode,int flag)866 static void do_bt(CPUX86State *env, struct x86_decode *decode, int flag)
867 {
868     int32_t displacement;
869     uint8_t index;
870     bool cf;
871     int mask = (4 == decode->operand_size) ? 0x1f : 0xf;
872 
873     VM_PANIC_ON(decode->rex.rex);
874 
875     fetch_operands(env, decode, 2, false, true, false);
876     index = decode->op[1].val & mask;
877 
878     if (decode->op[0].type != X86_VAR_REG) {
879         if (4 == decode->operand_size) {
880             displacement = ((int32_t) (decode->op[1].val & 0xffffffe0)) / 32;
881             decode->op[0].ptr += 4 * displacement;
882         } else if (2 == decode->operand_size) {
883             displacement = ((int16_t) (decode->op[1].val & 0xfff0)) / 16;
884             decode->op[0].ptr += 2 * displacement;
885         } else {
886             VM_PANIC("bt 64bit\n");
887         }
888     }
889     decode->op[0].val = read_val_ext(env, decode->op[0].ptr,
890                                      decode->operand_size);
891     cf = (decode->op[0].val >> index) & 0x01;
892 
893     switch (flag) {
894     case 0:
895         set_CF(env, cf);
896         return;
897     case 1:
898         decode->op[0].val ^= (1u << index);
899         break;
900     case 2:
901         decode->op[0].val |= (1u << index);
902         break;
903     case 3:
904         decode->op[0].val &= ~(1u << index);
905         break;
906     }
907     write_val_ext(env, decode->op[0].ptr, decode->op[0].val,
908                   decode->operand_size);
909     set_CF(env, cf);
910 }
911 
exec_bt(CPUX86State * env,struct x86_decode * decode)912 static void exec_bt(CPUX86State *env, struct x86_decode *decode)
913 {
914     do_bt(env, decode, 0);
915     env->eip += decode->len;
916 }
917 
exec_btc(CPUX86State * env,struct x86_decode * decode)918 static void exec_btc(CPUX86State *env, struct x86_decode *decode)
919 {
920     do_bt(env, decode, 1);
921     env->eip += decode->len;
922 }
923 
exec_btr(CPUX86State * env,struct x86_decode * decode)924 static void exec_btr(CPUX86State *env, struct x86_decode *decode)
925 {
926     do_bt(env, decode, 3);
927     env->eip += decode->len;
928 }
929 
exec_bts(CPUX86State * env,struct x86_decode * decode)930 static void exec_bts(CPUX86State *env, struct x86_decode *decode)
931 {
932     do_bt(env, decode, 2);
933     env->eip += decode->len;
934 }
935 
exec_shl(CPUX86State * env,struct x86_decode * decode)936 void exec_shl(CPUX86State *env, struct x86_decode *decode)
937 {
938     uint8_t count;
939     int of = 0, cf = 0;
940 
941     fetch_operands(env, decode, 2, true, true, false);
942 
943     count = decode->op[1].val;
944     count &= 0x1f;      /* count is masked to 5 bits*/
945     if (!count) {
946         goto exit;
947     }
948 
949     switch (decode->operand_size) {
950     case 1:
951     {
952         uint8_t res = 0;
953         if (count <= 8) {
954             res = (decode->op[0].val << count);
955             cf = (decode->op[0].val >> (8 - count)) & 0x1;
956             of = cf ^ (res >> 7);
957         }
958 
959         write_val_ext(env, decode->op[0].ptr, res, 1);
960         SET_FLAGS_OSZAPC_LOGIC8(env, 0, 0, res);
961         SET_FLAGS_OxxxxC(env, of, cf);
962         break;
963     }
964     case 2:
965     {
966         uint16_t res = 0;
967 
968         /* from bochs */
969         if (count <= 16) {
970             res = (decode->op[0].val << count);
971             cf = (decode->op[0].val >> (16 - count)) & 0x1;
972             of = cf ^ (res >> 15); /* of = cf ^ result15 */
973         }
974 
975         write_val_ext(env, decode->op[0].ptr, res, 2);
976         SET_FLAGS_OSZAPC_LOGIC16(env, 0, 0, res);
977         SET_FLAGS_OxxxxC(env, of, cf);
978         break;
979     }
980     case 4:
981     {
982         uint32_t res = decode->op[0].val << count;
983 
984         write_val_ext(env, decode->op[0].ptr, res, 4);
985         SET_FLAGS_OSZAPC_LOGIC32(env, 0, 0, res);
986         cf = (decode->op[0].val >> (32 - count)) & 0x1;
987         of = cf ^ (res >> 31); /* of = cf ^ result31 */
988         SET_FLAGS_OxxxxC(env, of, cf);
989         break;
990     }
991     default:
992         abort();
993     }
994 
995 exit:
996     /* lflags_to_rflags(env); */
997     env->eip += decode->len;
998 }
999 
exec_movsx(CPUX86State * env,struct x86_decode * decode)1000 void exec_movsx(CPUX86State *env, struct x86_decode *decode)
1001 {
1002     int src_op_size;
1003     int op_size = decode->operand_size;
1004 
1005     fetch_operands(env, decode, 2, false, false, false);
1006 
1007     if (0xbe == decode->opcode[1]) {
1008         src_op_size = 1;
1009     } else {
1010         src_op_size = 2;
1011     }
1012 
1013     decode->operand_size = src_op_size;
1014     calc_modrm_operand(env, decode, &decode->op[1]);
1015     decode->op[1].val = sign(read_val_ext(env, decode->op[1].ptr, src_op_size),
1016                              src_op_size);
1017 
1018     write_val_ext(env, decode->op[0].ptr, decode->op[1].val, op_size);
1019 
1020     env->eip += decode->len;
1021 }
1022 
exec_ror(CPUX86State * env,struct x86_decode * decode)1023 void exec_ror(CPUX86State *env, struct x86_decode *decode)
1024 {
1025     uint8_t count;
1026 
1027     fetch_operands(env, decode, 2, true, true, false);
1028     count = decode->op[1].val;
1029 
1030     switch (decode->operand_size) {
1031     case 1:
1032     {
1033         uint32_t bit6, bit7;
1034         uint8_t res;
1035 
1036         if ((count & 0x07) == 0) {
1037             if (count & 0x18) {
1038                 bit6 = ((uint8_t)decode->op[0].val >> 6) & 1;
1039                 bit7 = ((uint8_t)decode->op[0].val >> 7) & 1;
1040                 SET_FLAGS_OxxxxC(env, bit6 ^ bit7, bit7);
1041              }
1042         } else {
1043             count &= 0x7; /* use only bottom 3 bits */
1044             res = ((uint8_t)decode->op[0].val >> count) |
1045                    ((uint8_t)decode->op[0].val << (8 - count));
1046             write_val_ext(env, decode->op[0].ptr, res, 1);
1047             bit6 = (res >> 6) & 1;
1048             bit7 = (res >> 7) & 1;
1049             /* set eflags: ROR count affects the following flags: C, O */
1050             SET_FLAGS_OxxxxC(env, bit6 ^ bit7, bit7);
1051         }
1052         break;
1053     }
1054     case 2:
1055     {
1056         uint32_t bit14, bit15;
1057         uint16_t res;
1058 
1059         if ((count & 0x0f) == 0) {
1060             if (count & 0x10) {
1061                 bit14 = ((uint16_t)decode->op[0].val >> 14) & 1;
1062                 bit15 = ((uint16_t)decode->op[0].val >> 15) & 1;
1063                 /* of = result14 ^ result15 */
1064                 SET_FLAGS_OxxxxC(env, bit14 ^ bit15, bit15);
1065             }
1066         } else {
1067             count &= 0x0f;  /* use only 4 LSB's */
1068             res = ((uint16_t)decode->op[0].val >> count) |
1069                    ((uint16_t)decode->op[0].val << (16 - count));
1070             write_val_ext(env, decode->op[0].ptr, res, 2);
1071 
1072             bit14 = (res >> 14) & 1;
1073             bit15 = (res >> 15) & 1;
1074             /* of = result14 ^ result15 */
1075             SET_FLAGS_OxxxxC(env, bit14 ^ bit15, bit15);
1076         }
1077         break;
1078     }
1079     case 4:
1080     {
1081         uint32_t bit31, bit30;
1082         uint32_t res;
1083 
1084         count &= 0x1f;
1085         if (count) {
1086             res = ((uint32_t)decode->op[0].val >> count) |
1087                    ((uint32_t)decode->op[0].val << (32 - count));
1088             write_val_ext(env, decode->op[0].ptr, res, 4);
1089 
1090             bit31 = (res >> 31) & 1;
1091             bit30 = (res >> 30) & 1;
1092             /* of = result30 ^ result31 */
1093             SET_FLAGS_OxxxxC(env, bit30 ^ bit31, bit31);
1094         }
1095         break;
1096         }
1097     }
1098     env->eip += decode->len;
1099 }
1100 
exec_rol(CPUX86State * env,struct x86_decode * decode)1101 void exec_rol(CPUX86State *env, struct x86_decode *decode)
1102 {
1103     uint8_t count;
1104 
1105     fetch_operands(env, decode, 2, true, true, false);
1106     count = decode->op[1].val;
1107 
1108     switch (decode->operand_size) {
1109     case 1:
1110     {
1111         uint32_t bit0, bit7;
1112         uint8_t res;
1113 
1114         if ((count & 0x07) == 0) {
1115             if (count & 0x18) {
1116                 bit0 = ((uint8_t)decode->op[0].val & 1);
1117                 bit7 = ((uint8_t)decode->op[0].val >> 7);
1118                 SET_FLAGS_OxxxxC(env, bit0 ^ bit7, bit0);
1119             }
1120         }  else {
1121             count &= 0x7; /* use only lowest 3 bits */
1122             res = ((uint8_t)decode->op[0].val << count) |
1123                    ((uint8_t)decode->op[0].val >> (8 - count));
1124 
1125             write_val_ext(env, decode->op[0].ptr, res, 1);
1126             /* set eflags:
1127              * ROL count affects the following flags: C, O
1128              */
1129             bit0 = (res &  1);
1130             bit7 = (res >> 7);
1131             SET_FLAGS_OxxxxC(env, bit0 ^ bit7, bit0);
1132         }
1133         break;
1134     }
1135     case 2:
1136     {
1137         uint32_t bit0, bit15;
1138         uint16_t res;
1139 
1140         if ((count & 0x0f) == 0) {
1141             if (count & 0x10) {
1142                 bit0  = ((uint16_t)decode->op[0].val & 0x1);
1143                 bit15 = ((uint16_t)decode->op[0].val >> 15);
1144                 /* of = cf ^ result15 */
1145                 SET_FLAGS_OxxxxC(env, bit0 ^ bit15, bit0);
1146             }
1147         } else {
1148             count &= 0x0f; /* only use bottom 4 bits */
1149             res = ((uint16_t)decode->op[0].val << count) |
1150                    ((uint16_t)decode->op[0].val >> (16 - count));
1151 
1152             write_val_ext(env, decode->op[0].ptr, res, 2);
1153             bit0  = (res & 0x1);
1154             bit15 = (res >> 15);
1155             /* of = cf ^ result15 */
1156             SET_FLAGS_OxxxxC(env, bit0 ^ bit15, bit0);
1157         }
1158         break;
1159     }
1160     case 4:
1161     {
1162         uint32_t bit0, bit31;
1163         uint32_t res;
1164 
1165         count &= 0x1f;
1166         if (count) {
1167             res = ((uint32_t)decode->op[0].val << count) |
1168                    ((uint32_t)decode->op[0].val >> (32 - count));
1169 
1170             write_val_ext(env, decode->op[0].ptr, res, 4);
1171             bit0  = (res & 0x1);
1172             bit31 = (res >> 31);
1173             /* of = cf ^ result31 */
1174             SET_FLAGS_OxxxxC(env, bit0 ^ bit31, bit0);
1175         }
1176         break;
1177         }
1178     }
1179     env->eip += decode->len;
1180 }
1181 
1182 
exec_rcl(CPUX86State * env,struct x86_decode * decode)1183 void exec_rcl(CPUX86State *env, struct x86_decode *decode)
1184 {
1185     uint8_t count;
1186     int of = 0, cf = 0;
1187 
1188     fetch_operands(env, decode, 2, true, true, false);
1189     count = decode->op[1].val & 0x1f;
1190 
1191     switch (decode->operand_size) {
1192     case 1:
1193     {
1194         uint8_t op1_8 = decode->op[0].val;
1195         uint8_t res;
1196         count %= 9;
1197         if (!count) {
1198             break;
1199         }
1200 
1201         if (1 == count) {
1202             res = (op1_8 << 1) | get_CF(env);
1203         } else {
1204             res = (op1_8 << count) | (get_CF(env) << (count - 1)) |
1205                    (op1_8 >> (9 - count));
1206         }
1207 
1208         write_val_ext(env, decode->op[0].ptr, res, 1);
1209 
1210         cf = (op1_8 >> (8 - count)) & 0x01;
1211         of = cf ^ (res >> 7); /* of = cf ^ result7 */
1212         SET_FLAGS_OxxxxC(env, of, cf);
1213         break;
1214     }
1215     case 2:
1216     {
1217         uint16_t res;
1218         uint16_t op1_16 = decode->op[0].val;
1219 
1220         count %= 17;
1221         if (!count) {
1222             break;
1223         }
1224 
1225         if (1 == count) {
1226             res = (op1_16 << 1) | get_CF(env);
1227         } else if (count == 16) {
1228             res = (get_CF(env) << 15) | (op1_16 >> 1);
1229         } else { /* 2..15 */
1230             res = (op1_16 << count) | (get_CF(env) << (count - 1)) |
1231                    (op1_16 >> (17 - count));
1232         }
1233 
1234         write_val_ext(env, decode->op[0].ptr, res, 2);
1235 
1236         cf = (op1_16 >> (16 - count)) & 0x1;
1237         of = cf ^ (res >> 15); /* of = cf ^ result15 */
1238         SET_FLAGS_OxxxxC(env, of, cf);
1239         break;
1240     }
1241     case 4:
1242     {
1243         uint32_t res;
1244         uint32_t op1_32 = decode->op[0].val;
1245 
1246         if (!count) {
1247             break;
1248         }
1249 
1250         if (1 == count) {
1251             res = (op1_32 << 1) | get_CF(env);
1252         } else {
1253             res = (op1_32 << count) | (get_CF(env) << (count - 1)) |
1254                    (op1_32 >> (33 - count));
1255         }
1256 
1257         write_val_ext(env, decode->op[0].ptr, res, 4);
1258 
1259         cf = (op1_32 >> (32 - count)) & 0x1;
1260         of = cf ^ (res >> 31); /* of = cf ^ result31 */
1261         SET_FLAGS_OxxxxC(env, of, cf);
1262         break;
1263         }
1264     }
1265     env->eip += decode->len;
1266 }
1267 
exec_rcr(CPUX86State * env,struct x86_decode * decode)1268 void exec_rcr(CPUX86State *env, struct x86_decode *decode)
1269 {
1270     uint8_t count;
1271     int of = 0, cf = 0;
1272 
1273     fetch_operands(env, decode, 2, true, true, false);
1274     count = decode->op[1].val & 0x1f;
1275 
1276     switch (decode->operand_size) {
1277     case 1:
1278     {
1279         uint8_t op1_8 = decode->op[0].val;
1280         uint8_t res;
1281 
1282         count %= 9;
1283         if (!count) {
1284             break;
1285         }
1286         res = (op1_8 >> count) | (get_CF(env) << (8 - count)) |
1287                (op1_8 << (9 - count));
1288 
1289         write_val_ext(env, decode->op[0].ptr, res, 1);
1290 
1291         cf = (op1_8 >> (count - 1)) & 0x1;
1292         of = (((res << 1) ^ res) >> 7) & 0x1; /* of = result6 ^ result7 */
1293         SET_FLAGS_OxxxxC(env, of, cf);
1294         break;
1295     }
1296     case 2:
1297     {
1298         uint16_t op1_16 = decode->op[0].val;
1299         uint16_t res;
1300 
1301         count %= 17;
1302         if (!count) {
1303             break;
1304         }
1305         res = (op1_16 >> count) | (get_CF(env) << (16 - count)) |
1306                (op1_16 << (17 - count));
1307 
1308         write_val_ext(env, decode->op[0].ptr, res, 2);
1309 
1310         cf = (op1_16 >> (count - 1)) & 0x1;
1311         of = ((uint16_t)((res << 1) ^ res) >> 15) & 0x1; /* of = result15 ^
1312                                                             result14 */
1313         SET_FLAGS_OxxxxC(env, of, cf);
1314         break;
1315     }
1316     case 4:
1317     {
1318         uint32_t res;
1319         uint32_t op1_32 = decode->op[0].val;
1320 
1321         if (!count) {
1322             break;
1323         }
1324 
1325         if (1 == count) {
1326             res = (op1_32 >> 1) | (get_CF(env) << 31);
1327         } else {
1328             res = (op1_32 >> count) | (get_CF(env) << (32 - count)) |
1329                    (op1_32 << (33 - count));
1330         }
1331 
1332         write_val_ext(env, decode->op[0].ptr, res, 4);
1333 
1334         cf = (op1_32 >> (count - 1)) & 0x1;
1335         of = ((res << 1) ^ res) >> 31; /* of = result30 ^ result31 */
1336         SET_FLAGS_OxxxxC(env, of, cf);
1337         break;
1338         }
1339     }
1340     env->eip += decode->len;
1341 }
1342 
exec_xchg(CPUX86State * env,struct x86_decode * decode)1343 static void exec_xchg(CPUX86State *env, struct x86_decode *decode)
1344 {
1345     fetch_operands(env, decode, 2, true, true, false);
1346 
1347     write_val_ext(env, decode->op[0].ptr, decode->op[1].val,
1348                   decode->operand_size);
1349     write_val_ext(env, decode->op[1].ptr, decode->op[0].val,
1350                   decode->operand_size);
1351 
1352     env->eip += decode->len;
1353 }
1354 
exec_xadd(CPUX86State * env,struct x86_decode * decode)1355 static void exec_xadd(CPUX86State *env, struct x86_decode *decode)
1356 {
1357     EXEC_2OP_FLAGS_CMD(env, decode, +, SET_FLAGS_OSZAPC_ADD, true);
1358     write_val_ext(env, decode->op[1].ptr, decode->op[0].val,
1359                   decode->operand_size);
1360 
1361     env->eip += decode->len;
1362 }
1363 
1364 static struct cmd_handler {
1365     enum x86_decode_cmd cmd;
1366     void (*handler)(CPUX86State *env, struct x86_decode *ins);
1367 } handlers[] = {
1368     {X86_DECODE_CMD_INVL, NULL,},
1369     {X86_DECODE_CMD_MOV, exec_mov},
1370     {X86_DECODE_CMD_ADD, exec_add},
1371     {X86_DECODE_CMD_OR, exec_or},
1372     {X86_DECODE_CMD_ADC, exec_adc},
1373     {X86_DECODE_CMD_SBB, exec_sbb},
1374     {X86_DECODE_CMD_AND, exec_and},
1375     {X86_DECODE_CMD_SUB, exec_sub},
1376     {X86_DECODE_CMD_NEG, exec_neg},
1377     {X86_DECODE_CMD_XOR, exec_xor},
1378     {X86_DECODE_CMD_CMP, exec_cmp},
1379     {X86_DECODE_CMD_INC, exec_inc},
1380     {X86_DECODE_CMD_DEC, exec_dec},
1381     {X86_DECODE_CMD_TST, exec_tst},
1382     {X86_DECODE_CMD_NOT, exec_not},
1383     {X86_DECODE_CMD_MOVZX, exec_movzx},
1384     {X86_DECODE_CMD_OUT, exec_out},
1385     {X86_DECODE_CMD_IN, exec_in},
1386     {X86_DECODE_CMD_INS, exec_ins},
1387     {X86_DECODE_CMD_OUTS, exec_outs},
1388     {X86_DECODE_CMD_RDMSR, exec_rdmsr},
1389     {X86_DECODE_CMD_WRMSR, exec_wrmsr},
1390     {X86_DECODE_CMD_BT, exec_bt},
1391     {X86_DECODE_CMD_BTR, exec_btr},
1392     {X86_DECODE_CMD_BTC, exec_btc},
1393     {X86_DECODE_CMD_BTS, exec_bts},
1394     {X86_DECODE_CMD_SHL, exec_shl},
1395     {X86_DECODE_CMD_ROL, exec_rol},
1396     {X86_DECODE_CMD_ROR, exec_ror},
1397     {X86_DECODE_CMD_RCR, exec_rcr},
1398     {X86_DECODE_CMD_RCL, exec_rcl},
1399     /*{X86_DECODE_CMD_CPUID, exec_cpuid},*/
1400     {X86_DECODE_CMD_MOVS, exec_movs},
1401     {X86_DECODE_CMD_CMPS, exec_cmps},
1402     {X86_DECODE_CMD_STOS, exec_stos},
1403     {X86_DECODE_CMD_SCAS, exec_scas},
1404     {X86_DECODE_CMD_LODS, exec_lods},
1405     {X86_DECODE_CMD_MOVSX, exec_movsx},
1406     {X86_DECODE_CMD_XCHG, exec_xchg},
1407     {X86_DECODE_CMD_XADD, exec_xadd},
1408 };
1409 
1410 static struct cmd_handler _cmd_handler[X86_DECODE_CMD_LAST];
1411 
init_cmd_handler(void)1412 static void init_cmd_handler(void)
1413 {
1414     int i;
1415     for (i = 0; i < ARRAY_SIZE(handlers); i++) {
1416         _cmd_handler[handlers[i].cmd] = handlers[i];
1417     }
1418 }
1419 
load_regs(CPUState * cs)1420 void load_regs(CPUState *cs)
1421 {
1422     X86CPU *cpu = X86_CPU(cs);
1423     CPUX86State *env = &cpu->env;
1424 
1425     int i = 0;
1426     RRX(env, R_EAX) = rreg(cs->accel->fd, HV_X86_RAX);
1427     RRX(env, R_EBX) = rreg(cs->accel->fd, HV_X86_RBX);
1428     RRX(env, R_ECX) = rreg(cs->accel->fd, HV_X86_RCX);
1429     RRX(env, R_EDX) = rreg(cs->accel->fd, HV_X86_RDX);
1430     RRX(env, R_ESI) = rreg(cs->accel->fd, HV_X86_RSI);
1431     RRX(env, R_EDI) = rreg(cs->accel->fd, HV_X86_RDI);
1432     RRX(env, R_ESP) = rreg(cs->accel->fd, HV_X86_RSP);
1433     RRX(env, R_EBP) = rreg(cs->accel->fd, HV_X86_RBP);
1434     for (i = 8; i < 16; i++) {
1435         RRX(env, i) = rreg(cs->accel->fd, HV_X86_RAX + i);
1436     }
1437 
1438     env->eflags = rreg(cs->accel->fd, HV_X86_RFLAGS);
1439     rflags_to_lflags(env);
1440     env->eip = rreg(cs->accel->fd, HV_X86_RIP);
1441 }
1442 
store_regs(CPUState * cs)1443 void store_regs(CPUState *cs)
1444 {
1445     X86CPU *cpu = X86_CPU(cs);
1446     CPUX86State *env = &cpu->env;
1447 
1448     int i = 0;
1449     wreg(cs->accel->fd, HV_X86_RAX, RAX(env));
1450     wreg(cs->accel->fd, HV_X86_RBX, RBX(env));
1451     wreg(cs->accel->fd, HV_X86_RCX, RCX(env));
1452     wreg(cs->accel->fd, HV_X86_RDX, RDX(env));
1453     wreg(cs->accel->fd, HV_X86_RSI, RSI(env));
1454     wreg(cs->accel->fd, HV_X86_RDI, RDI(env));
1455     wreg(cs->accel->fd, HV_X86_RBP, RBP(env));
1456     wreg(cs->accel->fd, HV_X86_RSP, RSP(env));
1457     for (i = 8; i < 16; i++) {
1458         wreg(cs->accel->fd, HV_X86_RAX + i, RRX(env, i));
1459     }
1460 
1461     lflags_to_rflags(env);
1462     wreg(cs->accel->fd, HV_X86_RFLAGS, env->eflags);
1463     macvm_set_rip(cs, env->eip);
1464 }
1465 
exec_instruction(CPUX86State * env,struct x86_decode * ins)1466 bool exec_instruction(CPUX86State *env, struct x86_decode *ins)
1467 {
1468     /*if (hvf_vcpu_id(cs))
1469     printf("%d, %llx: exec_instruction %s\n", hvf_vcpu_id(cs),  env->eip,
1470           decode_cmd_to_string(ins->cmd));*/
1471 
1472     if (!_cmd_handler[ins->cmd].handler) {
1473         printf("Unimplemented handler (%llx) for %d (%x %x) \n", env->eip,
1474                 ins->cmd, ins->opcode[0],
1475                 ins->opcode_len > 1 ? ins->opcode[1] : 0);
1476         env->eip += ins->len;
1477         return true;
1478     }
1479 
1480     _cmd_handler[ins->cmd].handler(env, ins);
1481     return true;
1482 }
1483 
init_emu(void)1484 void init_emu(void)
1485 {
1486     init_cmd_handler();
1487 }
1488