qdev: integrate with QEMU Object Model (v2)
[qemu.git] / target-i386 / op_helper.c
1 /*
2 * i386 helpers
3 *
4 * Copyright (c) 2003 Fabrice Bellard
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include <math.h>
21 #include "cpu.h"
22 #include "dyngen-exec.h"
23 #include "host-utils.h"
24 #include "ioport.h"
25 #include "qemu-common.h"
26 #include "qemu-log.h"
27 #include "cpu-defs.h"
28 #include "helper.h"
29
30 #if !defined(CONFIG_USER_ONLY)
31 #include "softmmu_exec.h"
32 #endif /* !defined(CONFIG_USER_ONLY) */
33
34 //#define DEBUG_PCALL
35
36 #ifdef DEBUG_PCALL
37 # define LOG_PCALL(...) qemu_log_mask(CPU_LOG_PCALL, ## __VA_ARGS__)
38 # define LOG_PCALL_STATE(env) \
39 log_cpu_state_mask(CPU_LOG_PCALL, (env), X86_DUMP_CCOP)
40 #else
41 # define LOG_PCALL(...) do { } while (0)
42 # define LOG_PCALL_STATE(env) do { } while (0)
43 #endif
44
45 /* n must be a constant to be efficient */
46 static inline target_long lshift(target_long x, int n)
47 {
48 if (n >= 0) {
49 return x << n;
50 } else {
51 return x >> (-n);
52 }
53 }
54
55 #define FPU_RC_MASK 0xc00
56 #define FPU_RC_NEAR 0x000
57 #define FPU_RC_DOWN 0x400
58 #define FPU_RC_UP 0x800
59 #define FPU_RC_CHOP 0xc00
60
61 #define MAXTAN 9223372036854775808.0
62
63 /* the following deal with x86 long double-precision numbers */
64 #define MAXEXPD 0x7fff
65 #define EXPBIAS 16383
66 #define EXPD(fp) (fp.l.upper & 0x7fff)
67 #define SIGND(fp) ((fp.l.upper) & 0x8000)
68 #define MANTD(fp) (fp.l.lower)
69 #define BIASEXPONENT(fp) fp.l.upper = (fp.l.upper & ~(0x7fff)) | EXPBIAS
70
71 static inline void fpush(void)
72 {
73 env->fpstt = (env->fpstt - 1) & 7;
74 env->fptags[env->fpstt] = 0; /* validate stack entry */
75 }
76
77 static inline void fpop(void)
78 {
79 env->fptags[env->fpstt] = 1; /* invvalidate stack entry */
80 env->fpstt = (env->fpstt + 1) & 7;
81 }
82
83 static inline floatx80 helper_fldt(target_ulong ptr)
84 {
85 CPU_LDoubleU temp;
86
87 temp.l.lower = ldq(ptr);
88 temp.l.upper = lduw(ptr + 8);
89 return temp.d;
90 }
91
92 static inline void helper_fstt(floatx80 f, target_ulong ptr)
93 {
94 CPU_LDoubleU temp;
95
96 temp.d = f;
97 stq(ptr, temp.l.lower);
98 stw(ptr + 8, temp.l.upper);
99 }
100
101 #define FPUS_IE (1 << 0)
102 #define FPUS_DE (1 << 1)
103 #define FPUS_ZE (1 << 2)
104 #define FPUS_OE (1 << 3)
105 #define FPUS_UE (1 << 4)
106 #define FPUS_PE (1 << 5)
107 #define FPUS_SF (1 << 6)
108 #define FPUS_SE (1 << 7)
109 #define FPUS_B (1 << 15)
110
111 #define FPUC_EM 0x3f
112
113 static inline uint32_t compute_eflags(void)
114 {
115 return env->eflags | helper_cc_compute_all(CC_OP) | (DF & DF_MASK);
116 }
117
118 /* NOTE: CC_OP must be modified manually to CC_OP_EFLAGS */
119 static inline void load_eflags(int eflags, int update_mask)
120 {
121 CC_SRC = eflags & (CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C);
122 DF = 1 - (2 * ((eflags >> 10) & 1));
123 env->eflags = (env->eflags & ~update_mask) |
124 (eflags & update_mask) | 0x2;
125 }
126
127 /* load efer and update the corresponding hflags. XXX: do consistency
128 checks with cpuid bits ? */
129 static inline void cpu_load_efer(CPUState *env, uint64_t val)
130 {
131 env->efer = val;
132 env->hflags &= ~(HF_LMA_MASK | HF_SVME_MASK);
133 if (env->efer & MSR_EFER_LMA) {
134 env->hflags |= HF_LMA_MASK;
135 }
136 if (env->efer & MSR_EFER_SVME) {
137 env->hflags |= HF_SVME_MASK;
138 }
139 }
140
141 #if 0
142 #define raise_exception_err(a, b)\
143 do {\
144 qemu_log("raise_exception line=%d\n", __LINE__);\
145 (raise_exception_err)(a, b);\
146 } while (0)
147 #endif
148
149 static void QEMU_NORETURN raise_exception_err(int exception_index,
150 int error_code);
151
152 static const uint8_t parity_table[256] = {
153 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
154 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
155 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
156 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
157 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
158 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
159 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
160 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
161 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
162 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
163 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
164 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
165 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
166 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
167 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
168 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
169 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
170 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
171 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
172 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
173 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
174 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
175 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
176 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
177 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
178 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
179 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
180 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
181 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
182 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
183 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
184 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
185 };
186
187 /* modulo 17 table */
188 static const uint8_t rclw_table[32] = {
189 0, 1, 2, 3, 4, 5, 6, 7,
190 8, 9,10,11,12,13,14,15,
191 16, 0, 1, 2, 3, 4, 5, 6,
192 7, 8, 9,10,11,12,13,14,
193 };
194
195 /* modulo 9 table */
196 static const uint8_t rclb_table[32] = {
197 0, 1, 2, 3, 4, 5, 6, 7,
198 8, 0, 1, 2, 3, 4, 5, 6,
199 7, 8, 0, 1, 2, 3, 4, 5,
200 6, 7, 8, 0, 1, 2, 3, 4,
201 };
202
203 #define floatx80_lg2 make_floatx80( 0x3ffd, 0x9a209a84fbcff799LL )
204 #define floatx80_l2e make_floatx80( 0x3fff, 0xb8aa3b295c17f0bcLL )
205 #define floatx80_l2t make_floatx80( 0x4000, 0xd49a784bcd1b8afeLL )
206
207 /* broken thread support */
208
209 static spinlock_t global_cpu_lock = SPIN_LOCK_UNLOCKED;
210
211 void helper_lock(void)
212 {
213 spin_lock(&global_cpu_lock);
214 }
215
216 void helper_unlock(void)
217 {
218 spin_unlock(&global_cpu_lock);
219 }
220
221 void helper_write_eflags(target_ulong t0, uint32_t update_mask)
222 {
223 load_eflags(t0, update_mask);
224 }
225
226 target_ulong helper_read_eflags(void)
227 {
228 uint32_t eflags;
229 eflags = helper_cc_compute_all(CC_OP);
230 eflags |= (DF & DF_MASK);
231 eflags |= env->eflags & ~(VM_MASK | RF_MASK);
232 return eflags;
233 }
234
235 /* return non zero if error */
236 static inline int load_segment(uint32_t *e1_ptr, uint32_t *e2_ptr,
237 int selector)
238 {
239 SegmentCache *dt;
240 int index;
241 target_ulong ptr;
242
243 if (selector & 0x4)
244 dt = &env->ldt;
245 else
246 dt = &env->gdt;
247 index = selector & ~7;
248 if ((index + 7) > dt->limit)
249 return -1;
250 ptr = dt->base + index;
251 *e1_ptr = ldl_kernel(ptr);
252 *e2_ptr = ldl_kernel(ptr + 4);
253 return 0;
254 }
255
256 static inline unsigned int get_seg_limit(uint32_t e1, uint32_t e2)
257 {
258 unsigned int limit;
259 limit = (e1 & 0xffff) | (e2 & 0x000f0000);
260 if (e2 & DESC_G_MASK)
261 limit = (limit << 12) | 0xfff;
262 return limit;
263 }
264
265 static inline uint32_t get_seg_base(uint32_t e1, uint32_t e2)
266 {
267 return ((e1 >> 16) | ((e2 & 0xff) << 16) | (e2 & 0xff000000));
268 }
269
270 static inline void load_seg_cache_raw_dt(SegmentCache *sc, uint32_t e1, uint32_t e2)
271 {
272 sc->base = get_seg_base(e1, e2);
273 sc->limit = get_seg_limit(e1, e2);
274 sc->flags = e2;
275 }
276
277 /* init the segment cache in vm86 mode. */
278 static inline void load_seg_vm(int seg, int selector)
279 {
280 selector &= 0xffff;
281 cpu_x86_load_seg_cache(env, seg, selector,
282 (selector << 4), 0xffff, 0);
283 }
284
285 static inline void get_ss_esp_from_tss(uint32_t *ss_ptr,
286 uint32_t *esp_ptr, int dpl)
287 {
288 int type, index, shift;
289
290 #if 0
291 {
292 int i;
293 printf("TR: base=%p limit=%x\n", env->tr.base, env->tr.limit);
294 for(i=0;i<env->tr.limit;i++) {
295 printf("%02x ", env->tr.base[i]);
296 if ((i & 7) == 7) printf("\n");
297 }
298 printf("\n");
299 }
300 #endif
301
302 if (!(env->tr.flags & DESC_P_MASK))
303 cpu_abort(env, "invalid tss");
304 type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
305 if ((type & 7) != 1)
306 cpu_abort(env, "invalid tss type");
307 shift = type >> 3;
308 index = (dpl * 4 + 2) << shift;
309 if (index + (4 << shift) - 1 > env->tr.limit)
310 raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
311 if (shift == 0) {
312 *esp_ptr = lduw_kernel(env->tr.base + index);
313 *ss_ptr = lduw_kernel(env->tr.base + index + 2);
314 } else {
315 *esp_ptr = ldl_kernel(env->tr.base + index);
316 *ss_ptr = lduw_kernel(env->tr.base + index + 4);
317 }
318 }
319
320 /* XXX: merge with load_seg() */
321 static void tss_load_seg(int seg_reg, int selector)
322 {
323 uint32_t e1, e2;
324 int rpl, dpl, cpl;
325
326 if ((selector & 0xfffc) != 0) {
327 if (load_segment(&e1, &e2, selector) != 0)
328 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
329 if (!(e2 & DESC_S_MASK))
330 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
331 rpl = selector & 3;
332 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
333 cpl = env->hflags & HF_CPL_MASK;
334 if (seg_reg == R_CS) {
335 if (!(e2 & DESC_CS_MASK))
336 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
337 /* XXX: is it correct ? */
338 if (dpl != rpl)
339 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
340 if ((e2 & DESC_C_MASK) && dpl > rpl)
341 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
342 } else if (seg_reg == R_SS) {
343 /* SS must be writable data */
344 if ((e2 & DESC_CS_MASK) || !(e2 & DESC_W_MASK))
345 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
346 if (dpl != cpl || dpl != rpl)
347 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
348 } else {
349 /* not readable code */
350 if ((e2 & DESC_CS_MASK) && !(e2 & DESC_R_MASK))
351 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
352 /* if data or non conforming code, checks the rights */
353 if (((e2 >> DESC_TYPE_SHIFT) & 0xf) < 12) {
354 if (dpl < cpl || dpl < rpl)
355 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
356 }
357 }
358 if (!(e2 & DESC_P_MASK))
359 raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
360 cpu_x86_load_seg_cache(env, seg_reg, selector,
361 get_seg_base(e1, e2),
362 get_seg_limit(e1, e2),
363 e2);
364 } else {
365 if (seg_reg == R_SS || seg_reg == R_CS)
366 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
367 }
368 }
369
370 #define SWITCH_TSS_JMP 0
371 #define SWITCH_TSS_IRET 1
372 #define SWITCH_TSS_CALL 2
373
374 /* XXX: restore CPU state in registers (PowerPC case) */
375 static void switch_tss(int tss_selector,
376 uint32_t e1, uint32_t e2, int source,
377 uint32_t next_eip)
378 {
379 int tss_limit, tss_limit_max, type, old_tss_limit_max, old_type, v1, v2, i;
380 target_ulong tss_base;
381 uint32_t new_regs[8], new_segs[6];
382 uint32_t new_eflags, new_eip, new_cr3, new_ldt, new_trap;
383 uint32_t old_eflags, eflags_mask;
384 SegmentCache *dt;
385 int index;
386 target_ulong ptr;
387
388 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
389 LOG_PCALL("switch_tss: sel=0x%04x type=%d src=%d\n", tss_selector, type, source);
390
391 /* if task gate, we read the TSS segment and we load it */
392 if (type == 5) {
393 if (!(e2 & DESC_P_MASK))
394 raise_exception_err(EXCP0B_NOSEG, tss_selector & 0xfffc);
395 tss_selector = e1 >> 16;
396 if (tss_selector & 4)
397 raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
398 if (load_segment(&e1, &e2, tss_selector) != 0)
399 raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
400 if (e2 & DESC_S_MASK)
401 raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
402 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
403 if ((type & 7) != 1)
404 raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
405 }
406
407 if (!(e2 & DESC_P_MASK))
408 raise_exception_err(EXCP0B_NOSEG, tss_selector & 0xfffc);
409
410 if (type & 8)
411 tss_limit_max = 103;
412 else
413 tss_limit_max = 43;
414 tss_limit = get_seg_limit(e1, e2);
415 tss_base = get_seg_base(e1, e2);
416 if ((tss_selector & 4) != 0 ||
417 tss_limit < tss_limit_max)
418 raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
419 old_type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
420 if (old_type & 8)
421 old_tss_limit_max = 103;
422 else
423 old_tss_limit_max = 43;
424
425 /* read all the registers from the new TSS */
426 if (type & 8) {
427 /* 32 bit */
428 new_cr3 = ldl_kernel(tss_base + 0x1c);
429 new_eip = ldl_kernel(tss_base + 0x20);
430 new_eflags = ldl_kernel(tss_base + 0x24);
431 for(i = 0; i < 8; i++)
432 new_regs[i] = ldl_kernel(tss_base + (0x28 + i * 4));
433 for(i = 0; i < 6; i++)
434 new_segs[i] = lduw_kernel(tss_base + (0x48 + i * 4));
435 new_ldt = lduw_kernel(tss_base + 0x60);
436 new_trap = ldl_kernel(tss_base + 0x64);
437 } else {
438 /* 16 bit */
439 new_cr3 = 0;
440 new_eip = lduw_kernel(tss_base + 0x0e);
441 new_eflags = lduw_kernel(tss_base + 0x10);
442 for(i = 0; i < 8; i++)
443 new_regs[i] = lduw_kernel(tss_base + (0x12 + i * 2)) | 0xffff0000;
444 for(i = 0; i < 4; i++)
445 new_segs[i] = lduw_kernel(tss_base + (0x22 + i * 4));
446 new_ldt = lduw_kernel(tss_base + 0x2a);
447 new_segs[R_FS] = 0;
448 new_segs[R_GS] = 0;
449 new_trap = 0;
450 }
451 /* XXX: avoid a compiler warning, see
452 http://support.amd.com/us/Processor_TechDocs/24593.pdf
453 chapters 12.2.5 and 13.2.4 on how to implement TSS Trap bit */
454 (void)new_trap;
455
456 /* NOTE: we must avoid memory exceptions during the task switch,
457 so we make dummy accesses before */
458 /* XXX: it can still fail in some cases, so a bigger hack is
459 necessary to valid the TLB after having done the accesses */
460
461 v1 = ldub_kernel(env->tr.base);
462 v2 = ldub_kernel(env->tr.base + old_tss_limit_max);
463 stb_kernel(env->tr.base, v1);
464 stb_kernel(env->tr.base + old_tss_limit_max, v2);
465
466 /* clear busy bit (it is restartable) */
467 if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_IRET) {
468 target_ulong ptr;
469 uint32_t e2;
470 ptr = env->gdt.base + (env->tr.selector & ~7);
471 e2 = ldl_kernel(ptr + 4);
472 e2 &= ~DESC_TSS_BUSY_MASK;
473 stl_kernel(ptr + 4, e2);
474 }
475 old_eflags = compute_eflags();
476 if (source == SWITCH_TSS_IRET)
477 old_eflags &= ~NT_MASK;
478
479 /* save the current state in the old TSS */
480 if (type & 8) {
481 /* 32 bit */
482 stl_kernel(env->tr.base + 0x20, next_eip);
483 stl_kernel(env->tr.base + 0x24, old_eflags);
484 stl_kernel(env->tr.base + (0x28 + 0 * 4), EAX);
485 stl_kernel(env->tr.base + (0x28 + 1 * 4), ECX);
486 stl_kernel(env->tr.base + (0x28 + 2 * 4), EDX);
487 stl_kernel(env->tr.base + (0x28 + 3 * 4), EBX);
488 stl_kernel(env->tr.base + (0x28 + 4 * 4), ESP);
489 stl_kernel(env->tr.base + (0x28 + 5 * 4), EBP);
490 stl_kernel(env->tr.base + (0x28 + 6 * 4), ESI);
491 stl_kernel(env->tr.base + (0x28 + 7 * 4), EDI);
492 for(i = 0; i < 6; i++)
493 stw_kernel(env->tr.base + (0x48 + i * 4), env->segs[i].selector);
494 } else {
495 /* 16 bit */
496 stw_kernel(env->tr.base + 0x0e, next_eip);
497 stw_kernel(env->tr.base + 0x10, old_eflags);
498 stw_kernel(env->tr.base + (0x12 + 0 * 2), EAX);
499 stw_kernel(env->tr.base + (0x12 + 1 * 2), ECX);
500 stw_kernel(env->tr.base + (0x12 + 2 * 2), EDX);
501 stw_kernel(env->tr.base + (0x12 + 3 * 2), EBX);
502 stw_kernel(env->tr.base + (0x12 + 4 * 2), ESP);
503 stw_kernel(env->tr.base + (0x12 + 5 * 2), EBP);
504 stw_kernel(env->tr.base + (0x12 + 6 * 2), ESI);
505 stw_kernel(env->tr.base + (0x12 + 7 * 2), EDI);
506 for(i = 0; i < 4; i++)
507 stw_kernel(env->tr.base + (0x22 + i * 4), env->segs[i].selector);
508 }
509
510 /* now if an exception occurs, it will occurs in the next task
511 context */
512
513 if (source == SWITCH_TSS_CALL) {
514 stw_kernel(tss_base, env->tr.selector);
515 new_eflags |= NT_MASK;
516 }
517
518 /* set busy bit */
519 if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_CALL) {
520 target_ulong ptr;
521 uint32_t e2;
522 ptr = env->gdt.base + (tss_selector & ~7);
523 e2 = ldl_kernel(ptr + 4);
524 e2 |= DESC_TSS_BUSY_MASK;
525 stl_kernel(ptr + 4, e2);
526 }
527
528 /* set the new CPU state */
529 /* from this point, any exception which occurs can give problems */
530 env->cr[0] |= CR0_TS_MASK;
531 env->hflags |= HF_TS_MASK;
532 env->tr.selector = tss_selector;
533 env->tr.base = tss_base;
534 env->tr.limit = tss_limit;
535 env->tr.flags = e2 & ~DESC_TSS_BUSY_MASK;
536
537 if ((type & 8) && (env->cr[0] & CR0_PG_MASK)) {
538 cpu_x86_update_cr3(env, new_cr3);
539 }
540
541 /* load all registers without an exception, then reload them with
542 possible exception */
543 env->eip = new_eip;
544 eflags_mask = TF_MASK | AC_MASK | ID_MASK |
545 IF_MASK | IOPL_MASK | VM_MASK | RF_MASK | NT_MASK;
546 if (!(type & 8))
547 eflags_mask &= 0xffff;
548 load_eflags(new_eflags, eflags_mask);
549 /* XXX: what to do in 16 bit case ? */
550 EAX = new_regs[0];
551 ECX = new_regs[1];
552 EDX = new_regs[2];
553 EBX = new_regs[3];
554 ESP = new_regs[4];
555 EBP = new_regs[5];
556 ESI = new_regs[6];
557 EDI = new_regs[7];
558 if (new_eflags & VM_MASK) {
559 for(i = 0; i < 6; i++)
560 load_seg_vm(i, new_segs[i]);
561 /* in vm86, CPL is always 3 */
562 cpu_x86_set_cpl(env, 3);
563 } else {
564 /* CPL is set the RPL of CS */
565 cpu_x86_set_cpl(env, new_segs[R_CS] & 3);
566 /* first just selectors as the rest may trigger exceptions */
567 for(i = 0; i < 6; i++)
568 cpu_x86_load_seg_cache(env, i, new_segs[i], 0, 0, 0);
569 }
570
571 env->ldt.selector = new_ldt & ~4;
572 env->ldt.base = 0;
573 env->ldt.limit = 0;
574 env->ldt.flags = 0;
575
576 /* load the LDT */
577 if (new_ldt & 4)
578 raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
579
580 if ((new_ldt & 0xfffc) != 0) {
581 dt = &env->gdt;
582 index = new_ldt & ~7;
583 if ((index + 7) > dt->limit)
584 raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
585 ptr = dt->base + index;
586 e1 = ldl_kernel(ptr);
587 e2 = ldl_kernel(ptr + 4);
588 if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2)
589 raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
590 if (!(e2 & DESC_P_MASK))
591 raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
592 load_seg_cache_raw_dt(&env->ldt, e1, e2);
593 }
594
595 /* load the segments */
596 if (!(new_eflags & VM_MASK)) {
597 tss_load_seg(R_CS, new_segs[R_CS]);
598 tss_load_seg(R_SS, new_segs[R_SS]);
599 tss_load_seg(R_ES, new_segs[R_ES]);
600 tss_load_seg(R_DS, new_segs[R_DS]);
601 tss_load_seg(R_FS, new_segs[R_FS]);
602 tss_load_seg(R_GS, new_segs[R_GS]);
603 }
604
605 /* check that EIP is in the CS segment limits */
606 if (new_eip > env->segs[R_CS].limit) {
607 /* XXX: different exception if CALL ? */
608 raise_exception_err(EXCP0D_GPF, 0);
609 }
610
611 #ifndef CONFIG_USER_ONLY
612 /* reset local breakpoints */
613 if (env->dr[7] & 0x55) {
614 for (i = 0; i < 4; i++) {
615 if (hw_breakpoint_enabled(env->dr[7], i) == 0x1)
616 hw_breakpoint_remove(env, i);
617 }
618 env->dr[7] &= ~0x55;
619 }
620 #endif
621 }
622
623 /* check if Port I/O is allowed in TSS */
624 static inline void check_io(int addr, int size)
625 {
626 int io_offset, val, mask;
627
628 /* TSS must be a valid 32 bit one */
629 if (!(env->tr.flags & DESC_P_MASK) ||
630 ((env->tr.flags >> DESC_TYPE_SHIFT) & 0xf) != 9 ||
631 env->tr.limit < 103)
632 goto fail;
633 io_offset = lduw_kernel(env->tr.base + 0x66);
634 io_offset += (addr >> 3);
635 /* Note: the check needs two bytes */
636 if ((io_offset + 1) > env->tr.limit)
637 goto fail;
638 val = lduw_kernel(env->tr.base + io_offset);
639 val >>= (addr & 7);
640 mask = (1 << size) - 1;
641 /* all bits must be zero to allow the I/O */
642 if ((val & mask) != 0) {
643 fail:
644 raise_exception_err(EXCP0D_GPF, 0);
645 }
646 }
647
648 void helper_check_iob(uint32_t t0)
649 {
650 check_io(t0, 1);
651 }
652
653 void helper_check_iow(uint32_t t0)
654 {
655 check_io(t0, 2);
656 }
657
658 void helper_check_iol(uint32_t t0)
659 {
660 check_io(t0, 4);
661 }
662
663 void helper_outb(uint32_t port, uint32_t data)
664 {
665 cpu_outb(port, data & 0xff);
666 }
667
668 target_ulong helper_inb(uint32_t port)
669 {
670 return cpu_inb(port);
671 }
672
673 void helper_outw(uint32_t port, uint32_t data)
674 {
675 cpu_outw(port, data & 0xffff);
676 }
677
678 target_ulong helper_inw(uint32_t port)
679 {
680 return cpu_inw(port);
681 }
682
683 void helper_outl(uint32_t port, uint32_t data)
684 {
685 cpu_outl(port, data);
686 }
687
688 target_ulong helper_inl(uint32_t port)
689 {
690 return cpu_inl(port);
691 }
692
693 static inline unsigned int get_sp_mask(unsigned int e2)
694 {
695 if (e2 & DESC_B_MASK)
696 return 0xffffffff;
697 else
698 return 0xffff;
699 }
700
701 static int exeption_has_error_code(int intno)
702 {
703 switch(intno) {
704 case 8:
705 case 10:
706 case 11:
707 case 12:
708 case 13:
709 case 14:
710 case 17:
711 return 1;
712 }
713 return 0;
714 }
715
716 #ifdef TARGET_X86_64
717 #define SET_ESP(val, sp_mask)\
718 do {\
719 if ((sp_mask) == 0xffff)\
720 ESP = (ESP & ~0xffff) | ((val) & 0xffff);\
721 else if ((sp_mask) == 0xffffffffLL)\
722 ESP = (uint32_t)(val);\
723 else\
724 ESP = (val);\
725 } while (0)
726 #else
727 #define SET_ESP(val, sp_mask) ESP = (ESP & ~(sp_mask)) | ((val) & (sp_mask))
728 #endif
729
730 /* in 64-bit machines, this can overflow. So this segment addition macro
731 * can be used to trim the value to 32-bit whenever needed */
732 #define SEG_ADDL(ssp, sp, sp_mask) ((uint32_t)((ssp) + (sp & (sp_mask))))
733
734 /* XXX: add a is_user flag to have proper security support */
735 #define PUSHW(ssp, sp, sp_mask, val)\
736 {\
737 sp -= 2;\
738 stw_kernel((ssp) + (sp & (sp_mask)), (val));\
739 }
740
741 #define PUSHL(ssp, sp, sp_mask, val)\
742 {\
743 sp -= 4;\
744 stl_kernel(SEG_ADDL(ssp, sp, sp_mask), (uint32_t)(val));\
745 }
746
747 #define POPW(ssp, sp, sp_mask, val)\
748 {\
749 val = lduw_kernel((ssp) + (sp & (sp_mask)));\
750 sp += 2;\
751 }
752
753 #define POPL(ssp, sp, sp_mask, val)\
754 {\
755 val = (uint32_t)ldl_kernel(SEG_ADDL(ssp, sp, sp_mask));\
756 sp += 4;\
757 }
758
759 /* protected mode interrupt */
760 static void do_interrupt_protected(int intno, int is_int, int error_code,
761 unsigned int next_eip, int is_hw)
762 {
763 SegmentCache *dt;
764 target_ulong ptr, ssp;
765 int type, dpl, selector, ss_dpl, cpl;
766 int has_error_code, new_stack, shift;
767 uint32_t e1, e2, offset, ss = 0, esp, ss_e1 = 0, ss_e2 = 0;
768 uint32_t old_eip, sp_mask;
769
770 has_error_code = 0;
771 if (!is_int && !is_hw)
772 has_error_code = exeption_has_error_code(intno);
773 if (is_int)
774 old_eip = next_eip;
775 else
776 old_eip = env->eip;
777
778 dt = &env->idt;
779 if (intno * 8 + 7 > dt->limit)
780 raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
781 ptr = dt->base + intno * 8;
782 e1 = ldl_kernel(ptr);
783 e2 = ldl_kernel(ptr + 4);
784 /* check gate type */
785 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
786 switch(type) {
787 case 5: /* task gate */
788 /* must do that check here to return the correct error code */
789 if (!(e2 & DESC_P_MASK))
790 raise_exception_err(EXCP0B_NOSEG, intno * 8 + 2);
791 switch_tss(intno * 8, e1, e2, SWITCH_TSS_CALL, old_eip);
792 if (has_error_code) {
793 int type;
794 uint32_t mask;
795 /* push the error code */
796 type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
797 shift = type >> 3;
798 if (env->segs[R_SS].flags & DESC_B_MASK)
799 mask = 0xffffffff;
800 else
801 mask = 0xffff;
802 esp = (ESP - (2 << shift)) & mask;
803 ssp = env->segs[R_SS].base + esp;
804 if (shift)
805 stl_kernel(ssp, error_code);
806 else
807 stw_kernel(ssp, error_code);
808 SET_ESP(esp, mask);
809 }
810 return;
811 case 6: /* 286 interrupt gate */
812 case 7: /* 286 trap gate */
813 case 14: /* 386 interrupt gate */
814 case 15: /* 386 trap gate */
815 break;
816 default:
817 raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
818 break;
819 }
820 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
821 cpl = env->hflags & HF_CPL_MASK;
822 /* check privilege if software int */
823 if (is_int && dpl < cpl)
824 raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
825 /* check valid bit */
826 if (!(e2 & DESC_P_MASK))
827 raise_exception_err(EXCP0B_NOSEG, intno * 8 + 2);
828 selector = e1 >> 16;
829 offset = (e2 & 0xffff0000) | (e1 & 0x0000ffff);
830 if ((selector & 0xfffc) == 0)
831 raise_exception_err(EXCP0D_GPF, 0);
832
833 if (load_segment(&e1, &e2, selector) != 0)
834 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
835 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK)))
836 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
837 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
838 if (dpl > cpl)
839 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
840 if (!(e2 & DESC_P_MASK))
841 raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
842 if (!(e2 & DESC_C_MASK) && dpl < cpl) {
843 /* to inner privilege */
844 get_ss_esp_from_tss(&ss, &esp, dpl);
845 if ((ss & 0xfffc) == 0)
846 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
847 if ((ss & 3) != dpl)
848 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
849 if (load_segment(&ss_e1, &ss_e2, ss) != 0)
850 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
851 ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
852 if (ss_dpl != dpl)
853 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
854 if (!(ss_e2 & DESC_S_MASK) ||
855 (ss_e2 & DESC_CS_MASK) ||
856 !(ss_e2 & DESC_W_MASK))
857 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
858 if (!(ss_e2 & DESC_P_MASK))
859 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
860 new_stack = 1;
861 sp_mask = get_sp_mask(ss_e2);
862 ssp = get_seg_base(ss_e1, ss_e2);
863 } else if ((e2 & DESC_C_MASK) || dpl == cpl) {
864 /* to same privilege */
865 if (env->eflags & VM_MASK)
866 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
867 new_stack = 0;
868 sp_mask = get_sp_mask(env->segs[R_SS].flags);
869 ssp = env->segs[R_SS].base;
870 esp = ESP;
871 dpl = cpl;
872 } else {
873 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
874 new_stack = 0; /* avoid warning */
875 sp_mask = 0; /* avoid warning */
876 ssp = 0; /* avoid warning */
877 esp = 0; /* avoid warning */
878 }
879
880 shift = type >> 3;
881
882 #if 0
883 /* XXX: check that enough room is available */
884 push_size = 6 + (new_stack << 2) + (has_error_code << 1);
885 if (env->eflags & VM_MASK)
886 push_size += 8;
887 push_size <<= shift;
888 #endif
889 if (shift == 1) {
890 if (new_stack) {
891 if (env->eflags & VM_MASK) {
892 PUSHL(ssp, esp, sp_mask, env->segs[R_GS].selector);
893 PUSHL(ssp, esp, sp_mask, env->segs[R_FS].selector);
894 PUSHL(ssp, esp, sp_mask, env->segs[R_DS].selector);
895 PUSHL(ssp, esp, sp_mask, env->segs[R_ES].selector);
896 }
897 PUSHL(ssp, esp, sp_mask, env->segs[R_SS].selector);
898 PUSHL(ssp, esp, sp_mask, ESP);
899 }
900 PUSHL(ssp, esp, sp_mask, compute_eflags());
901 PUSHL(ssp, esp, sp_mask, env->segs[R_CS].selector);
902 PUSHL(ssp, esp, sp_mask, old_eip);
903 if (has_error_code) {
904 PUSHL(ssp, esp, sp_mask, error_code);
905 }
906 } else {
907 if (new_stack) {
908 if (env->eflags & VM_MASK) {
909 PUSHW(ssp, esp, sp_mask, env->segs[R_GS].selector);
910 PUSHW(ssp, esp, sp_mask, env->segs[R_FS].selector);
911 PUSHW(ssp, esp, sp_mask, env->segs[R_DS].selector);
912 PUSHW(ssp, esp, sp_mask, env->segs[R_ES].selector);
913 }
914 PUSHW(ssp, esp, sp_mask, env->segs[R_SS].selector);
915 PUSHW(ssp, esp, sp_mask, ESP);
916 }
917 PUSHW(ssp, esp, sp_mask, compute_eflags());
918 PUSHW(ssp, esp, sp_mask, env->segs[R_CS].selector);
919 PUSHW(ssp, esp, sp_mask, old_eip);
920 if (has_error_code) {
921 PUSHW(ssp, esp, sp_mask, error_code);
922 }
923 }
924
925 if (new_stack) {
926 if (env->eflags & VM_MASK) {
927 cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0, 0);
928 cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0, 0);
929 cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0, 0);
930 cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0, 0);
931 }
932 ss = (ss & ~3) | dpl;
933 cpu_x86_load_seg_cache(env, R_SS, ss,
934 ssp, get_seg_limit(ss_e1, ss_e2), ss_e2);
935 }
936 SET_ESP(esp, sp_mask);
937
938 selector = (selector & ~3) | dpl;
939 cpu_x86_load_seg_cache(env, R_CS, selector,
940 get_seg_base(e1, e2),
941 get_seg_limit(e1, e2),
942 e2);
943 cpu_x86_set_cpl(env, dpl);
944 env->eip = offset;
945
946 /* interrupt gate clear IF mask */
947 if ((type & 1) == 0) {
948 env->eflags &= ~IF_MASK;
949 }
950 env->eflags &= ~(TF_MASK | VM_MASK | RF_MASK | NT_MASK);
951 }
952
953 #ifdef TARGET_X86_64
954
955 #define PUSHQ(sp, val)\
956 {\
957 sp -= 8;\
958 stq_kernel(sp, (val));\
959 }
960
961 #define POPQ(sp, val)\
962 {\
963 val = ldq_kernel(sp);\
964 sp += 8;\
965 }
966
967 static inline target_ulong get_rsp_from_tss(int level)
968 {
969 int index;
970
971 #if 0
972 printf("TR: base=" TARGET_FMT_lx " limit=%x\n",
973 env->tr.base, env->tr.limit);
974 #endif
975
976 if (!(env->tr.flags & DESC_P_MASK))
977 cpu_abort(env, "invalid tss");
978 index = 8 * level + 4;
979 if ((index + 7) > env->tr.limit)
980 raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
981 return ldq_kernel(env->tr.base + index);
982 }
983
984 /* 64 bit interrupt */
985 static void do_interrupt64(int intno, int is_int, int error_code,
986 target_ulong next_eip, int is_hw)
987 {
988 SegmentCache *dt;
989 target_ulong ptr;
990 int type, dpl, selector, cpl, ist;
991 int has_error_code, new_stack;
992 uint32_t e1, e2, e3, ss;
993 target_ulong old_eip, esp, offset;
994
995 has_error_code = 0;
996 if (!is_int && !is_hw)
997 has_error_code = exeption_has_error_code(intno);
998 if (is_int)
999 old_eip = next_eip;
1000 else
1001 old_eip = env->eip;
1002
1003 dt = &env->idt;
1004 if (intno * 16 + 15 > dt->limit)
1005 raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
1006 ptr = dt->base + intno * 16;
1007 e1 = ldl_kernel(ptr);
1008 e2 = ldl_kernel(ptr + 4);
1009 e3 = ldl_kernel(ptr + 8);
1010 /* check gate type */
1011 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
1012 switch(type) {
1013 case 14: /* 386 interrupt gate */
1014 case 15: /* 386 trap gate */
1015 break;
1016 default:
1017 raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
1018 break;
1019 }
1020 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1021 cpl = env->hflags & HF_CPL_MASK;
1022 /* check privilege if software int */
1023 if (is_int && dpl < cpl)
1024 raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
1025 /* check valid bit */
1026 if (!(e2 & DESC_P_MASK))
1027 raise_exception_err(EXCP0B_NOSEG, intno * 16 + 2);
1028 selector = e1 >> 16;
1029 offset = ((target_ulong)e3 << 32) | (e2 & 0xffff0000) | (e1 & 0x0000ffff);
1030 ist = e2 & 7;
1031 if ((selector & 0xfffc) == 0)
1032 raise_exception_err(EXCP0D_GPF, 0);
1033
1034 if (load_segment(&e1, &e2, selector) != 0)
1035 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1036 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK)))
1037 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1038 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1039 if (dpl > cpl)
1040 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1041 if (!(e2 & DESC_P_MASK))
1042 raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
1043 if (!(e2 & DESC_L_MASK) || (e2 & DESC_B_MASK))
1044 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1045 if ((!(e2 & DESC_C_MASK) && dpl < cpl) || ist != 0) {
1046 /* to inner privilege */
1047 if (ist != 0)
1048 esp = get_rsp_from_tss(ist + 3);
1049 else
1050 esp = get_rsp_from_tss(dpl);
1051 esp &= ~0xfLL; /* align stack */
1052 ss = 0;
1053 new_stack = 1;
1054 } else if ((e2 & DESC_C_MASK) || dpl == cpl) {
1055 /* to same privilege */
1056 if (env->eflags & VM_MASK)
1057 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1058 new_stack = 0;
1059 if (ist != 0)
1060 esp = get_rsp_from_tss(ist + 3);
1061 else
1062 esp = ESP;
1063 esp &= ~0xfLL; /* align stack */
1064 dpl = cpl;
1065 } else {
1066 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1067 new_stack = 0; /* avoid warning */
1068 esp = 0; /* avoid warning */
1069 }
1070
1071 PUSHQ(esp, env->segs[R_SS].selector);
1072 PUSHQ(esp, ESP);
1073 PUSHQ(esp, compute_eflags());
1074 PUSHQ(esp, env->segs[R_CS].selector);
1075 PUSHQ(esp, old_eip);
1076 if (has_error_code) {
1077 PUSHQ(esp, error_code);
1078 }
1079
1080 if (new_stack) {
1081 ss = 0 | dpl;
1082 cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, 0);
1083 }
1084 ESP = esp;
1085
1086 selector = (selector & ~3) | dpl;
1087 cpu_x86_load_seg_cache(env, R_CS, selector,
1088 get_seg_base(e1, e2),
1089 get_seg_limit(e1, e2),
1090 e2);
1091 cpu_x86_set_cpl(env, dpl);
1092 env->eip = offset;
1093
1094 /* interrupt gate clear IF mask */
1095 if ((type & 1) == 0) {
1096 env->eflags &= ~IF_MASK;
1097 }
1098 env->eflags &= ~(TF_MASK | VM_MASK | RF_MASK | NT_MASK);
1099 }
1100 #endif
1101
1102 #ifdef TARGET_X86_64
1103 #if defined(CONFIG_USER_ONLY)
1104 void helper_syscall(int next_eip_addend)
1105 {
1106 env->exception_index = EXCP_SYSCALL;
1107 env->exception_next_eip = env->eip + next_eip_addend;
1108 cpu_loop_exit(env);
1109 }
1110 #else
1111 void helper_syscall(int next_eip_addend)
1112 {
1113 int selector;
1114
1115 if (!(env->efer & MSR_EFER_SCE)) {
1116 raise_exception_err(EXCP06_ILLOP, 0);
1117 }
1118 selector = (env->star >> 32) & 0xffff;
1119 if (env->hflags & HF_LMA_MASK) {
1120 int code64;
1121
1122 ECX = env->eip + next_eip_addend;
1123 env->regs[11] = compute_eflags();
1124
1125 code64 = env->hflags & HF_CS64_MASK;
1126
1127 cpu_x86_set_cpl(env, 0);
1128 cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
1129 0, 0xffffffff,
1130 DESC_G_MASK | DESC_P_MASK |
1131 DESC_S_MASK |
1132 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);
1133 cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
1134 0, 0xffffffff,
1135 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1136 DESC_S_MASK |
1137 DESC_W_MASK | DESC_A_MASK);
1138 env->eflags &= ~env->fmask;
1139 load_eflags(env->eflags, 0);
1140 if (code64)
1141 env->eip = env->lstar;
1142 else
1143 env->eip = env->cstar;
1144 } else {
1145 ECX = (uint32_t)(env->eip + next_eip_addend);
1146
1147 cpu_x86_set_cpl(env, 0);
1148 cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
1149 0, 0xffffffff,
1150 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1151 DESC_S_MASK |
1152 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
1153 cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
1154 0, 0xffffffff,
1155 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1156 DESC_S_MASK |
1157 DESC_W_MASK | DESC_A_MASK);
1158 env->eflags &= ~(IF_MASK | RF_MASK | VM_MASK);
1159 env->eip = (uint32_t)env->star;
1160 }
1161 }
1162 #endif
1163 #endif
1164
1165 #ifdef TARGET_X86_64
1166 void helper_sysret(int dflag)
1167 {
1168 int cpl, selector;
1169
1170 if (!(env->efer & MSR_EFER_SCE)) {
1171 raise_exception_err(EXCP06_ILLOP, 0);
1172 }
1173 cpl = env->hflags & HF_CPL_MASK;
1174 if (!(env->cr[0] & CR0_PE_MASK) || cpl != 0) {
1175 raise_exception_err(EXCP0D_GPF, 0);
1176 }
1177 selector = (env->star >> 48) & 0xffff;
1178 if (env->hflags & HF_LMA_MASK) {
1179 if (dflag == 2) {
1180 cpu_x86_load_seg_cache(env, R_CS, (selector + 16) | 3,
1181 0, 0xffffffff,
1182 DESC_G_MASK | DESC_P_MASK |
1183 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1184 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK |
1185 DESC_L_MASK);
1186 env->eip = ECX;
1187 } else {
1188 cpu_x86_load_seg_cache(env, R_CS, selector | 3,
1189 0, 0xffffffff,
1190 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1191 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1192 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
1193 env->eip = (uint32_t)ECX;
1194 }
1195 cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1196 0, 0xffffffff,
1197 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1198 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1199 DESC_W_MASK | DESC_A_MASK);
1200 load_eflags((uint32_t)(env->regs[11]), TF_MASK | AC_MASK | ID_MASK |
1201 IF_MASK | IOPL_MASK | VM_MASK | RF_MASK | NT_MASK);
1202 cpu_x86_set_cpl(env, 3);
1203 } else {
1204 cpu_x86_load_seg_cache(env, R_CS, selector | 3,
1205 0, 0xffffffff,
1206 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1207 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1208 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
1209 env->eip = (uint32_t)ECX;
1210 cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1211 0, 0xffffffff,
1212 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1213 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1214 DESC_W_MASK | DESC_A_MASK);
1215 env->eflags |= IF_MASK;
1216 cpu_x86_set_cpl(env, 3);
1217 }
1218 }
1219 #endif
1220
1221 /* real mode interrupt */
1222 static void do_interrupt_real(int intno, int is_int, int error_code,
1223 unsigned int next_eip)
1224 {
1225 SegmentCache *dt;
1226 target_ulong ptr, ssp;
1227 int selector;
1228 uint32_t offset, esp;
1229 uint32_t old_cs, old_eip;
1230
1231 /* real mode (simpler !) */
1232 dt = &env->idt;
1233 if (intno * 4 + 3 > dt->limit)
1234 raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
1235 ptr = dt->base + intno * 4;
1236 offset = lduw_kernel(ptr);
1237 selector = lduw_kernel(ptr + 2);
1238 esp = ESP;
1239 ssp = env->segs[R_SS].base;
1240 if (is_int)
1241 old_eip = next_eip;
1242 else
1243 old_eip = env->eip;
1244 old_cs = env->segs[R_CS].selector;
1245 /* XXX: use SS segment size ? */
1246 PUSHW(ssp, esp, 0xffff, compute_eflags());
1247 PUSHW(ssp, esp, 0xffff, old_cs);
1248 PUSHW(ssp, esp, 0xffff, old_eip);
1249
1250 /* update processor state */
1251 ESP = (ESP & ~0xffff) | (esp & 0xffff);
1252 env->eip = offset;
1253 env->segs[R_CS].selector = selector;
1254 env->segs[R_CS].base = (selector << 4);
1255 env->eflags &= ~(IF_MASK | TF_MASK | AC_MASK | RF_MASK);
1256 }
1257
1258 #if defined(CONFIG_USER_ONLY)
1259 /* fake user mode interrupt */
1260 static void do_interrupt_user(int intno, int is_int, int error_code,
1261 target_ulong next_eip)
1262 {
1263 SegmentCache *dt;
1264 target_ulong ptr;
1265 int dpl, cpl, shift;
1266 uint32_t e2;
1267
1268 dt = &env->idt;
1269 if (env->hflags & HF_LMA_MASK) {
1270 shift = 4;
1271 } else {
1272 shift = 3;
1273 }
1274 ptr = dt->base + (intno << shift);
1275 e2 = ldl_kernel(ptr + 4);
1276
1277 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1278 cpl = env->hflags & HF_CPL_MASK;
1279 /* check privilege if software int */
1280 if (is_int && dpl < cpl)
1281 raise_exception_err(EXCP0D_GPF, (intno << shift) + 2);
1282
1283 /* Since we emulate only user space, we cannot do more than
1284 exiting the emulation with the suitable exception and error
1285 code */
1286 if (is_int)
1287 EIP = next_eip;
1288 }
1289
1290 #else
1291
1292 static void handle_even_inj(int intno, int is_int, int error_code,
1293 int is_hw, int rm)
1294 {
1295 uint32_t event_inj = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj));
1296 if (!(event_inj & SVM_EVTINJ_VALID)) {
1297 int type;
1298 if (is_int)
1299 type = SVM_EVTINJ_TYPE_SOFT;
1300 else
1301 type = SVM_EVTINJ_TYPE_EXEPT;
1302 event_inj = intno | type | SVM_EVTINJ_VALID;
1303 if (!rm && exeption_has_error_code(intno)) {
1304 event_inj |= SVM_EVTINJ_VALID_ERR;
1305 stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj_err), error_code);
1306 }
1307 stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj), event_inj);
1308 }
1309 }
1310 #endif
1311
1312 /*
1313 * Begin execution of an interruption. is_int is TRUE if coming from
1314 * the int instruction. next_eip is the EIP value AFTER the interrupt
1315 * instruction. It is only relevant if is_int is TRUE.
1316 */
1317 static void do_interrupt_all(int intno, int is_int, int error_code,
1318 target_ulong next_eip, int is_hw)
1319 {
1320 if (qemu_loglevel_mask(CPU_LOG_INT)) {
1321 if ((env->cr[0] & CR0_PE_MASK)) {
1322 static int count;
1323 qemu_log("%6d: v=%02x e=%04x i=%d cpl=%d IP=%04x:" TARGET_FMT_lx " pc=" TARGET_FMT_lx " SP=%04x:" TARGET_FMT_lx,
1324 count, intno, error_code, is_int,
1325 env->hflags & HF_CPL_MASK,
1326 env->segs[R_CS].selector, EIP,
1327 (int)env->segs[R_CS].base + EIP,
1328 env->segs[R_SS].selector, ESP);
1329 if (intno == 0x0e) {
1330 qemu_log(" CR2=" TARGET_FMT_lx, env->cr[2]);
1331 } else {
1332 qemu_log(" EAX=" TARGET_FMT_lx, EAX);
1333 }
1334 qemu_log("\n");
1335 log_cpu_state(env, X86_DUMP_CCOP);
1336 #if 0
1337 {
1338 int i;
1339 target_ulong ptr;
1340 qemu_log(" code=");
1341 ptr = env->segs[R_CS].base + env->eip;
1342 for(i = 0; i < 16; i++) {
1343 qemu_log(" %02x", ldub(ptr + i));
1344 }
1345 qemu_log("\n");
1346 }
1347 #endif
1348 count++;
1349 }
1350 }
1351 if (env->cr[0] & CR0_PE_MASK) {
1352 #if !defined(CONFIG_USER_ONLY)
1353 if (env->hflags & HF_SVMI_MASK)
1354 handle_even_inj(intno, is_int, error_code, is_hw, 0);
1355 #endif
1356 #ifdef TARGET_X86_64
1357 if (env->hflags & HF_LMA_MASK) {
1358 do_interrupt64(intno, is_int, error_code, next_eip, is_hw);
1359 } else
1360 #endif
1361 {
1362 do_interrupt_protected(intno, is_int, error_code, next_eip, is_hw);
1363 }
1364 } else {
1365 #if !defined(CONFIG_USER_ONLY)
1366 if (env->hflags & HF_SVMI_MASK)
1367 handle_even_inj(intno, is_int, error_code, is_hw, 1);
1368 #endif
1369 do_interrupt_real(intno, is_int, error_code, next_eip);
1370 }
1371
1372 #if !defined(CONFIG_USER_ONLY)
1373 if (env->hflags & HF_SVMI_MASK) {
1374 uint32_t event_inj = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj));
1375 stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj), event_inj & ~SVM_EVTINJ_VALID);
1376 }
1377 #endif
1378 }
1379
1380 void do_interrupt(CPUState *env1)
1381 {
1382 CPUState *saved_env;
1383
1384 saved_env = env;
1385 env = env1;
1386 #if defined(CONFIG_USER_ONLY)
1387 /* if user mode only, we simulate a fake exception
1388 which will be handled outside the cpu execution
1389 loop */
1390 do_interrupt_user(env->exception_index,
1391 env->exception_is_int,
1392 env->error_code,
1393 env->exception_next_eip);
1394 /* successfully delivered */
1395 env->old_exception = -1;
1396 #else
1397 /* simulate a real cpu exception. On i386, it can
1398 trigger new exceptions, but we do not handle
1399 double or triple faults yet. */
1400 do_interrupt_all(env->exception_index,
1401 env->exception_is_int,
1402 env->error_code,
1403 env->exception_next_eip, 0);
1404 /* successfully delivered */
1405 env->old_exception = -1;
1406 #endif
1407 env = saved_env;
1408 }
1409
1410 void do_interrupt_x86_hardirq(CPUState *env1, int intno, int is_hw)
1411 {
1412 CPUState *saved_env;
1413
1414 saved_env = env;
1415 env = env1;
1416 do_interrupt_all(intno, 0, 0, 0, is_hw);
1417 env = saved_env;
1418 }
1419
1420 /* This should come from sysemu.h - if we could include it here... */
1421 void qemu_system_reset_request(void);
1422
1423 /*
1424 * Check nested exceptions and change to double or triple fault if
1425 * needed. It should only be called, if this is not an interrupt.
1426 * Returns the new exception number.
1427 */
1428 static int check_exception(int intno, int *error_code)
1429 {
1430 int first_contributory = env->old_exception == 0 ||
1431 (env->old_exception >= 10 &&
1432 env->old_exception <= 13);
1433 int second_contributory = intno == 0 ||
1434 (intno >= 10 && intno <= 13);
1435
1436 qemu_log_mask(CPU_LOG_INT, "check_exception old: 0x%x new 0x%x\n",
1437 env->old_exception, intno);
1438
1439 #if !defined(CONFIG_USER_ONLY)
1440 if (env->old_exception == EXCP08_DBLE) {
1441 if (env->hflags & HF_SVMI_MASK)
1442 helper_vmexit(SVM_EXIT_SHUTDOWN, 0); /* does not return */
1443
1444 qemu_log_mask(CPU_LOG_RESET, "Triple fault\n");
1445
1446 qemu_system_reset_request();
1447 return EXCP_HLT;
1448 }
1449 #endif
1450
1451 if ((first_contributory && second_contributory)
1452 || (env->old_exception == EXCP0E_PAGE &&
1453 (second_contributory || (intno == EXCP0E_PAGE)))) {
1454 intno = EXCP08_DBLE;
1455 *error_code = 0;
1456 }
1457
1458 if (second_contributory || (intno == EXCP0E_PAGE) ||
1459 (intno == EXCP08_DBLE))
1460 env->old_exception = intno;
1461
1462 return intno;
1463 }
1464
1465 /*
1466 * Signal an interruption. It is executed in the main CPU loop.
1467 * is_int is TRUE if coming from the int instruction. next_eip is the
1468 * EIP value AFTER the interrupt instruction. It is only relevant if
1469 * is_int is TRUE.
1470 */
1471 static void QEMU_NORETURN raise_interrupt(int intno, int is_int, int error_code,
1472 int next_eip_addend)
1473 {
1474 if (!is_int) {
1475 helper_svm_check_intercept_param(SVM_EXIT_EXCP_BASE + intno, error_code);
1476 intno = check_exception(intno, &error_code);
1477 } else {
1478 helper_svm_check_intercept_param(SVM_EXIT_SWINT, 0);
1479 }
1480
1481 env->exception_index = intno;
1482 env->error_code = error_code;
1483 env->exception_is_int = is_int;
1484 env->exception_next_eip = env->eip + next_eip_addend;
1485 cpu_loop_exit(env);
1486 }
1487
1488 /* shortcuts to generate exceptions */
1489
1490 static void QEMU_NORETURN raise_exception_err(int exception_index,
1491 int error_code)
1492 {
1493 raise_interrupt(exception_index, 0, error_code, 0);
1494 }
1495
1496 void raise_exception_err_env(CPUState *nenv, int exception_index,
1497 int error_code)
1498 {
1499 env = nenv;
1500 raise_interrupt(exception_index, 0, error_code, 0);
1501 }
1502
1503 static void QEMU_NORETURN raise_exception(int exception_index)
1504 {
1505 raise_interrupt(exception_index, 0, 0, 0);
1506 }
1507
1508 void raise_exception_env(int exception_index, CPUState *nenv)
1509 {
1510 env = nenv;
1511 raise_exception(exception_index);
1512 }
1513 /* SMM support */
1514
1515 #if defined(CONFIG_USER_ONLY)
1516
1517 void do_smm_enter(CPUState *env1)
1518 {
1519 }
1520
1521 void helper_rsm(void)
1522 {
1523 }
1524
1525 #else
1526
1527 #ifdef TARGET_X86_64
1528 #define SMM_REVISION_ID 0x00020064
1529 #else
1530 #define SMM_REVISION_ID 0x00020000
1531 #endif
1532
1533 void do_smm_enter(CPUState *env1)
1534 {
1535 target_ulong sm_state;
1536 SegmentCache *dt;
1537 int i, offset;
1538 CPUState *saved_env;
1539
1540 saved_env = env;
1541 env = env1;
1542
1543 qemu_log_mask(CPU_LOG_INT, "SMM: enter\n");
1544 log_cpu_state_mask(CPU_LOG_INT, env, X86_DUMP_CCOP);
1545
1546 env->hflags |= HF_SMM_MASK;
1547 cpu_smm_update(env);
1548
1549 sm_state = env->smbase + 0x8000;
1550
1551 #ifdef TARGET_X86_64
1552 for(i = 0; i < 6; i++) {
1553 dt = &env->segs[i];
1554 offset = 0x7e00 + i * 16;
1555 stw_phys(sm_state + offset, dt->selector);
1556 stw_phys(sm_state + offset + 2, (dt->flags >> 8) & 0xf0ff);
1557 stl_phys(sm_state + offset + 4, dt->limit);
1558 stq_phys(sm_state + offset + 8, dt->base);
1559 }
1560
1561 stq_phys(sm_state + 0x7e68, env->gdt.base);
1562 stl_phys(sm_state + 0x7e64, env->gdt.limit);
1563
1564 stw_phys(sm_state + 0x7e70, env->ldt.selector);
1565 stq_phys(sm_state + 0x7e78, env->ldt.base);
1566 stl_phys(sm_state + 0x7e74, env->ldt.limit);
1567 stw_phys(sm_state + 0x7e72, (env->ldt.flags >> 8) & 0xf0ff);
1568
1569 stq_phys(sm_state + 0x7e88, env->idt.base);
1570 stl_phys(sm_state + 0x7e84, env->idt.limit);
1571
1572 stw_phys(sm_state + 0x7e90, env->tr.selector);
1573 stq_phys(sm_state + 0x7e98, env->tr.base);
1574 stl_phys(sm_state + 0x7e94, env->tr.limit);
1575 stw_phys(sm_state + 0x7e92, (env->tr.flags >> 8) & 0xf0ff);
1576
1577 stq_phys(sm_state + 0x7ed0, env->efer);
1578
1579 stq_phys(sm_state + 0x7ff8, EAX);
1580 stq_phys(sm_state + 0x7ff0, ECX);
1581 stq_phys(sm_state + 0x7fe8, EDX);
1582 stq_phys(sm_state + 0x7fe0, EBX);
1583 stq_phys(sm_state + 0x7fd8, ESP);
1584 stq_phys(sm_state + 0x7fd0, EBP);
1585 stq_phys(sm_state + 0x7fc8, ESI);
1586 stq_phys(sm_state + 0x7fc0, EDI);
1587 for(i = 8; i < 16; i++)
1588 stq_phys(sm_state + 0x7ff8 - i * 8, env->regs[i]);
1589 stq_phys(sm_state + 0x7f78, env->eip);
1590 stl_phys(sm_state + 0x7f70, compute_eflags());
1591 stl_phys(sm_state + 0x7f68, env->dr[6]);
1592 stl_phys(sm_state + 0x7f60, env->dr[7]);
1593
1594 stl_phys(sm_state + 0x7f48, env->cr[4]);
1595 stl_phys(sm_state + 0x7f50, env->cr[3]);
1596 stl_phys(sm_state + 0x7f58, env->cr[0]);
1597
1598 stl_phys(sm_state + 0x7efc, SMM_REVISION_ID);
1599 stl_phys(sm_state + 0x7f00, env->smbase);
1600 #else
1601 stl_phys(sm_state + 0x7ffc, env->cr[0]);
1602 stl_phys(sm_state + 0x7ff8, env->cr[3]);
1603 stl_phys(sm_state + 0x7ff4, compute_eflags());
1604 stl_phys(sm_state + 0x7ff0, env->eip);
1605 stl_phys(sm_state + 0x7fec, EDI);
1606 stl_phys(sm_state + 0x7fe8, ESI);
1607 stl_phys(sm_state + 0x7fe4, EBP);
1608 stl_phys(sm_state + 0x7fe0, ESP);
1609 stl_phys(sm_state + 0x7fdc, EBX);
1610 stl_phys(sm_state + 0x7fd8, EDX);
1611 stl_phys(sm_state + 0x7fd4, ECX);
1612 stl_phys(sm_state + 0x7fd0, EAX);
1613 stl_phys(sm_state + 0x7fcc, env->dr[6]);
1614 stl_phys(sm_state + 0x7fc8, env->dr[7]);
1615
1616 stl_phys(sm_state + 0x7fc4, env->tr.selector);
1617 stl_phys(sm_state + 0x7f64, env->tr.base);
1618 stl_phys(sm_state + 0x7f60, env->tr.limit);
1619 stl_phys(sm_state + 0x7f5c, (env->tr.flags >> 8) & 0xf0ff);
1620
1621 stl_phys(sm_state + 0x7fc0, env->ldt.selector);
1622 stl_phys(sm_state + 0x7f80, env->ldt.base);
1623 stl_phys(sm_state + 0x7f7c, env->ldt.limit);
1624 stl_phys(sm_state + 0x7f78, (env->ldt.flags >> 8) & 0xf0ff);
1625
1626 stl_phys(sm_state + 0x7f74, env->gdt.base);
1627 stl_phys(sm_state + 0x7f70, env->gdt.limit);
1628
1629 stl_phys(sm_state + 0x7f58, env->idt.base);
1630 stl_phys(sm_state + 0x7f54, env->idt.limit);
1631
1632 for(i = 0; i < 6; i++) {
1633 dt = &env->segs[i];
1634 if (i < 3)
1635 offset = 0x7f84 + i * 12;
1636 else
1637 offset = 0x7f2c + (i - 3) * 12;
1638 stl_phys(sm_state + 0x7fa8 + i * 4, dt->selector);
1639 stl_phys(sm_state + offset + 8, dt->base);
1640 stl_phys(sm_state + offset + 4, dt->limit);
1641 stl_phys(sm_state + offset, (dt->flags >> 8) & 0xf0ff);
1642 }
1643 stl_phys(sm_state + 0x7f14, env->cr[4]);
1644
1645 stl_phys(sm_state + 0x7efc, SMM_REVISION_ID);
1646 stl_phys(sm_state + 0x7ef8, env->smbase);
1647 #endif
1648 /* init SMM cpu state */
1649
1650 #ifdef TARGET_X86_64
1651 cpu_load_efer(env, 0);
1652 #endif
1653 load_eflags(0, ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
1654 env->eip = 0x00008000;
1655 cpu_x86_load_seg_cache(env, R_CS, (env->smbase >> 4) & 0xffff, env->smbase,
1656 0xffffffff, 0);
1657 cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0xffffffff, 0);
1658 cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0xffffffff, 0);
1659 cpu_x86_load_seg_cache(env, R_SS, 0, 0, 0xffffffff, 0);
1660 cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0xffffffff, 0);
1661 cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0xffffffff, 0);
1662
1663 cpu_x86_update_cr0(env,
1664 env->cr[0] & ~(CR0_PE_MASK | CR0_EM_MASK | CR0_TS_MASK | CR0_PG_MASK));
1665 cpu_x86_update_cr4(env, 0);
1666 env->dr[7] = 0x00000400;
1667 CC_OP = CC_OP_EFLAGS;
1668 env = saved_env;
1669 }
1670
1671 void helper_rsm(void)
1672 {
1673 target_ulong sm_state;
1674 int i, offset;
1675 uint32_t val;
1676
1677 sm_state = env->smbase + 0x8000;
1678 #ifdef TARGET_X86_64
1679 cpu_load_efer(env, ldq_phys(sm_state + 0x7ed0));
1680
1681 for(i = 0; i < 6; i++) {
1682 offset = 0x7e00 + i * 16;
1683 cpu_x86_load_seg_cache(env, i,
1684 lduw_phys(sm_state + offset),
1685 ldq_phys(sm_state + offset + 8),
1686 ldl_phys(sm_state + offset + 4),
1687 (lduw_phys(sm_state + offset + 2) & 0xf0ff) << 8);
1688 }
1689
1690 env->gdt.base = ldq_phys(sm_state + 0x7e68);
1691 env->gdt.limit = ldl_phys(sm_state + 0x7e64);
1692
1693 env->ldt.selector = lduw_phys(sm_state + 0x7e70);
1694 env->ldt.base = ldq_phys(sm_state + 0x7e78);
1695 env->ldt.limit = ldl_phys(sm_state + 0x7e74);
1696 env->ldt.flags = (lduw_phys(sm_state + 0x7e72) & 0xf0ff) << 8;
1697
1698 env->idt.base = ldq_phys(sm_state + 0x7e88);
1699 env->idt.limit = ldl_phys(sm_state + 0x7e84);
1700
1701 env->tr.selector = lduw_phys(sm_state + 0x7e90);
1702 env->tr.base = ldq_phys(sm_state + 0x7e98);
1703 env->tr.limit = ldl_phys(sm_state + 0x7e94);
1704 env->tr.flags = (lduw_phys(sm_state + 0x7e92) & 0xf0ff) << 8;
1705
1706 EAX = ldq_phys(sm_state + 0x7ff8);
1707 ECX = ldq_phys(sm_state + 0x7ff0);
1708 EDX = ldq_phys(sm_state + 0x7fe8);
1709 EBX = ldq_phys(sm_state + 0x7fe0);
1710 ESP = ldq_phys(sm_state + 0x7fd8);
1711 EBP = ldq_phys(sm_state + 0x7fd0);
1712 ESI = ldq_phys(sm_state + 0x7fc8);
1713 EDI = ldq_phys(sm_state + 0x7fc0);
1714 for(i = 8; i < 16; i++)
1715 env->regs[i] = ldq_phys(sm_state + 0x7ff8 - i * 8);
1716 env->eip = ldq_phys(sm_state + 0x7f78);
1717 load_eflags(ldl_phys(sm_state + 0x7f70),
1718 ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
1719 env->dr[6] = ldl_phys(sm_state + 0x7f68);
1720 env->dr[7] = ldl_phys(sm_state + 0x7f60);
1721
1722 cpu_x86_update_cr4(env, ldl_phys(sm_state + 0x7f48));
1723 cpu_x86_update_cr3(env, ldl_phys(sm_state + 0x7f50));
1724 cpu_x86_update_cr0(env, ldl_phys(sm_state + 0x7f58));
1725
1726 val = ldl_phys(sm_state + 0x7efc); /* revision ID */
1727 if (val & 0x20000) {
1728 env->smbase = ldl_phys(sm_state + 0x7f00) & ~0x7fff;
1729 }
1730 #else
1731 cpu_x86_update_cr0(env, ldl_phys(sm_state + 0x7ffc));
1732 cpu_x86_update_cr3(env, ldl_phys(sm_state + 0x7ff8));
1733 load_eflags(ldl_phys(sm_state + 0x7ff4),
1734 ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
1735 env->eip = ldl_phys(sm_state + 0x7ff0);
1736 EDI = ldl_phys(sm_state + 0x7fec);
1737 ESI = ldl_phys(sm_state + 0x7fe8);
1738 EBP = ldl_phys(sm_state + 0x7fe4);
1739 ESP = ldl_phys(sm_state + 0x7fe0);
1740 EBX = ldl_phys(sm_state + 0x7fdc);
1741 EDX = ldl_phys(sm_state + 0x7fd8);
1742 ECX = ldl_phys(sm_state + 0x7fd4);
1743 EAX = ldl_phys(sm_state + 0x7fd0);
1744 env->dr[6] = ldl_phys(sm_state + 0x7fcc);
1745 env->dr[7] = ldl_phys(sm_state + 0x7fc8);
1746
1747 env->tr.selector = ldl_phys(sm_state + 0x7fc4) & 0xffff;
1748 env->tr.base = ldl_phys(sm_state + 0x7f64);
1749 env->tr.limit = ldl_phys(sm_state + 0x7f60);
1750 env->tr.flags = (ldl_phys(sm_state + 0x7f5c) & 0xf0ff) << 8;
1751
1752 env->ldt.selector = ldl_phys(sm_state + 0x7fc0) & 0xffff;
1753 env->ldt.base = ldl_phys(sm_state + 0x7f80);
1754 env->ldt.limit = ldl_phys(sm_state + 0x7f7c);
1755 env->ldt.flags = (ldl_phys(sm_state + 0x7f78) & 0xf0ff) << 8;
1756
1757 env->gdt.base = ldl_phys(sm_state + 0x7f74);
1758 env->gdt.limit = ldl_phys(sm_state + 0x7f70);
1759
1760 env->idt.base = ldl_phys(sm_state + 0x7f58);
1761 env->idt.limit = ldl_phys(sm_state + 0x7f54);
1762
1763 for(i = 0; i < 6; i++) {
1764 if (i < 3)
1765 offset = 0x7f84 + i * 12;
1766 else
1767 offset = 0x7f2c + (i - 3) * 12;
1768 cpu_x86_load_seg_cache(env, i,
1769 ldl_phys(sm_state + 0x7fa8 + i * 4) & 0xffff,
1770 ldl_phys(sm_state + offset + 8),
1771 ldl_phys(sm_state + offset + 4),
1772 (ldl_phys(sm_state + offset) & 0xf0ff) << 8);
1773 }
1774 cpu_x86_update_cr4(env, ldl_phys(sm_state + 0x7f14));
1775
1776 val = ldl_phys(sm_state + 0x7efc); /* revision ID */
1777 if (val & 0x20000) {
1778 env->smbase = ldl_phys(sm_state + 0x7ef8) & ~0x7fff;
1779 }
1780 #endif
1781 CC_OP = CC_OP_EFLAGS;
1782 env->hflags &= ~HF_SMM_MASK;
1783 cpu_smm_update(env);
1784
1785 qemu_log_mask(CPU_LOG_INT, "SMM: after RSM\n");
1786 log_cpu_state_mask(CPU_LOG_INT, env, X86_DUMP_CCOP);
1787 }
1788
1789 #endif /* !CONFIG_USER_ONLY */
1790
1791
1792 /* division, flags are undefined */
1793
1794 void helper_divb_AL(target_ulong t0)
1795 {
1796 unsigned int num, den, q, r;
1797
1798 num = (EAX & 0xffff);
1799 den = (t0 & 0xff);
1800 if (den == 0) {
1801 raise_exception(EXCP00_DIVZ);
1802 }
1803 q = (num / den);
1804 if (q > 0xff)
1805 raise_exception(EXCP00_DIVZ);
1806 q &= 0xff;
1807 r = (num % den) & 0xff;
1808 EAX = (EAX & ~0xffff) | (r << 8) | q;
1809 }
1810
1811 void helper_idivb_AL(target_ulong t0)
1812 {
1813 int num, den, q, r;
1814
1815 num = (int16_t)EAX;
1816 den = (int8_t)t0;
1817 if (den == 0) {
1818 raise_exception(EXCP00_DIVZ);
1819 }
1820 q = (num / den);
1821 if (q != (int8_t)q)
1822 raise_exception(EXCP00_DIVZ);
1823 q &= 0xff;
1824 r = (num % den) & 0xff;
1825 EAX = (EAX & ~0xffff) | (r << 8) | q;
1826 }
1827
1828 void helper_divw_AX(target_ulong t0)
1829 {
1830 unsigned int num, den, q, r;
1831
1832 num = (EAX & 0xffff) | ((EDX & 0xffff) << 16);
1833 den = (t0 & 0xffff);
1834 if (den == 0) {
1835 raise_exception(EXCP00_DIVZ);
1836 }
1837 q = (num / den);
1838 if (q > 0xffff)
1839 raise_exception(EXCP00_DIVZ);
1840 q &= 0xffff;
1841 r = (num % den) & 0xffff;
1842 EAX = (EAX & ~0xffff) | q;
1843 EDX = (EDX & ~0xffff) | r;
1844 }
1845
1846 void helper_idivw_AX(target_ulong t0)
1847 {
1848 int num, den, q, r;
1849
1850 num = (EAX & 0xffff) | ((EDX & 0xffff) << 16);
1851 den = (int16_t)t0;
1852 if (den == 0) {
1853 raise_exception(EXCP00_DIVZ);
1854 }
1855 q = (num / den);
1856 if (q != (int16_t)q)
1857 raise_exception(EXCP00_DIVZ);
1858 q &= 0xffff;
1859 r = (num % den) & 0xffff;
1860 EAX = (EAX & ~0xffff) | q;
1861 EDX = (EDX & ~0xffff) | r;
1862 }
1863
1864 void helper_divl_EAX(target_ulong t0)
1865 {
1866 unsigned int den, r;
1867 uint64_t num, q;
1868
1869 num = ((uint32_t)EAX) | ((uint64_t)((uint32_t)EDX) << 32);
1870 den = t0;
1871 if (den == 0) {
1872 raise_exception(EXCP00_DIVZ);
1873 }
1874 q = (num / den);
1875 r = (num % den);
1876 if (q > 0xffffffff)
1877 raise_exception(EXCP00_DIVZ);
1878 EAX = (uint32_t)q;
1879 EDX = (uint32_t)r;
1880 }
1881
1882 void helper_idivl_EAX(target_ulong t0)
1883 {
1884 int den, r;
1885 int64_t num, q;
1886
1887 num = ((uint32_t)EAX) | ((uint64_t)((uint32_t)EDX) << 32);
1888 den = t0;
1889 if (den == 0) {
1890 raise_exception(EXCP00_DIVZ);
1891 }
1892 q = (num / den);
1893 r = (num % den);
1894 if (q != (int32_t)q)
1895 raise_exception(EXCP00_DIVZ);
1896 EAX = (uint32_t)q;
1897 EDX = (uint32_t)r;
1898 }
1899
1900 /* bcd */
1901
1902 /* XXX: exception */
1903 void helper_aam(int base)
1904 {
1905 int al, ah;
1906 al = EAX & 0xff;
1907 ah = al / base;
1908 al = al % base;
1909 EAX = (EAX & ~0xffff) | al | (ah << 8);
1910 CC_DST = al;
1911 }
1912
1913 void helper_aad(int base)
1914 {
1915 int al, ah;
1916 al = EAX & 0xff;
1917 ah = (EAX >> 8) & 0xff;
1918 al = ((ah * base) + al) & 0xff;
1919 EAX = (EAX & ~0xffff) | al;
1920 CC_DST = al;
1921 }
1922
1923 void helper_aaa(void)
1924 {
1925 int icarry;
1926 int al, ah, af;
1927 int eflags;
1928
1929 eflags = helper_cc_compute_all(CC_OP);
1930 af = eflags & CC_A;
1931 al = EAX & 0xff;
1932 ah = (EAX >> 8) & 0xff;
1933
1934 icarry = (al > 0xf9);
1935 if (((al & 0x0f) > 9 ) || af) {
1936 al = (al + 6) & 0x0f;
1937 ah = (ah + 1 + icarry) & 0xff;
1938 eflags |= CC_C | CC_A;
1939 } else {
1940 eflags &= ~(CC_C | CC_A);
1941 al &= 0x0f;
1942 }
1943 EAX = (EAX & ~0xffff) | al | (ah << 8);
1944 CC_SRC = eflags;
1945 }
1946
1947 void helper_aas(void)
1948 {
1949 int icarry;
1950 int al, ah, af;
1951 int eflags;
1952
1953 eflags = helper_cc_compute_all(CC_OP);
1954 af = eflags & CC_A;
1955 al = EAX & 0xff;
1956 ah = (EAX >> 8) & 0xff;
1957
1958 icarry = (al < 6);
1959 if (((al & 0x0f) > 9 ) || af) {
1960 al = (al - 6) & 0x0f;
1961 ah = (ah - 1 - icarry) & 0xff;
1962 eflags |= CC_C | CC_A;
1963 } else {
1964 eflags &= ~(CC_C | CC_A);
1965 al &= 0x0f;
1966 }
1967 EAX = (EAX & ~0xffff) | al | (ah << 8);
1968 CC_SRC = eflags;
1969 }
1970
1971 void helper_daa(void)
1972 {
1973 int old_al, al, af, cf;
1974 int eflags;
1975
1976 eflags = helper_cc_compute_all(CC_OP);
1977 cf = eflags & CC_C;
1978 af = eflags & CC_A;
1979 old_al = al = EAX & 0xff;
1980
1981 eflags = 0;
1982 if (((al & 0x0f) > 9 ) || af) {
1983 al = (al + 6) & 0xff;
1984 eflags |= CC_A;
1985 }
1986 if ((old_al > 0x99) || cf) {
1987 al = (al + 0x60) & 0xff;
1988 eflags |= CC_C;
1989 }
1990 EAX = (EAX & ~0xff) | al;
1991 /* well, speed is not an issue here, so we compute the flags by hand */
1992 eflags |= (al == 0) << 6; /* zf */
1993 eflags |= parity_table[al]; /* pf */
1994 eflags |= (al & 0x80); /* sf */
1995 CC_SRC = eflags;
1996 }
1997
1998 void helper_das(void)
1999 {
2000 int al, al1, af, cf;
2001 int eflags;
2002
2003 eflags = helper_cc_compute_all(CC_OP);
2004 cf = eflags & CC_C;
2005 af = eflags & CC_A;
2006 al = EAX & 0xff;
2007
2008 eflags = 0;
2009 al1 = al;
2010 if (((al & 0x0f) > 9 ) || af) {
2011 eflags |= CC_A;
2012 if (al < 6 || cf)
2013 eflags |= CC_C;
2014 al = (al - 6) & 0xff;
2015 }
2016 if ((al1 > 0x99) || cf) {
2017 al = (al - 0x60) & 0xff;
2018 eflags |= CC_C;
2019 }
2020 EAX = (EAX & ~0xff) | al;
2021 /* well, speed is not an issue here, so we compute the flags by hand */
2022 eflags |= (al == 0) << 6; /* zf */
2023 eflags |= parity_table[al]; /* pf */
2024 eflags |= (al & 0x80); /* sf */
2025 CC_SRC = eflags;
2026 }
2027
2028 void helper_into(int next_eip_addend)
2029 {
2030 int eflags;
2031 eflags = helper_cc_compute_all(CC_OP);
2032 if (eflags & CC_O) {
2033 raise_interrupt(EXCP04_INTO, 1, 0, next_eip_addend);
2034 }
2035 }
2036
2037 void helper_cmpxchg8b(target_ulong a0)
2038 {
2039 uint64_t d;
2040 int eflags;
2041
2042 eflags = helper_cc_compute_all(CC_OP);
2043 d = ldq(a0);
2044 if (d == (((uint64_t)EDX << 32) | (uint32_t)EAX)) {
2045 stq(a0, ((uint64_t)ECX << 32) | (uint32_t)EBX);
2046 eflags |= CC_Z;
2047 } else {
2048 /* always do the store */
2049 stq(a0, d);
2050 EDX = (uint32_t)(d >> 32);
2051 EAX = (uint32_t)d;
2052 eflags &= ~CC_Z;
2053 }
2054 CC_SRC = eflags;
2055 }
2056
2057 #ifdef TARGET_X86_64
2058 void helper_cmpxchg16b(target_ulong a0)
2059 {
2060 uint64_t d0, d1;
2061 int eflags;
2062
2063 if ((a0 & 0xf) != 0)
2064 raise_exception(EXCP0D_GPF);
2065 eflags = helper_cc_compute_all(CC_OP);
2066 d0 = ldq(a0);
2067 d1 = ldq(a0 + 8);
2068 if (d0 == EAX && d1 == EDX) {
2069 stq(a0, EBX);
2070 stq(a0 + 8, ECX);
2071 eflags |= CC_Z;
2072 } else {
2073 /* always do the store */
2074 stq(a0, d0);
2075 stq(a0 + 8, d1);
2076 EDX = d1;
2077 EAX = d0;
2078 eflags &= ~CC_Z;
2079 }
2080 CC_SRC = eflags;
2081 }
2082 #endif
2083
2084 void helper_single_step(void)
2085 {
2086 #ifndef CONFIG_USER_ONLY
2087 check_hw_breakpoints(env, 1);
2088 env->dr[6] |= DR6_BS;
2089 #endif
2090 raise_exception(EXCP01_DB);
2091 }
2092
2093 void helper_cpuid(void)
2094 {
2095 uint32_t eax, ebx, ecx, edx;
2096
2097 helper_svm_check_intercept_param(SVM_EXIT_CPUID, 0);
2098
2099 cpu_x86_cpuid(env, (uint32_t)EAX, (uint32_t)ECX, &eax, &ebx, &ecx, &edx);
2100 EAX = eax;
2101 EBX = ebx;
2102 ECX = ecx;
2103 EDX = edx;
2104 }
2105
2106 void helper_enter_level(int level, int data32, target_ulong t1)
2107 {
2108 target_ulong ssp;
2109 uint32_t esp_mask, esp, ebp;
2110
2111 esp_mask = get_sp_mask(env->segs[R_SS].flags);
2112 ssp = env->segs[R_SS].base;
2113 ebp = EBP;
2114 esp = ESP;
2115 if (data32) {
2116 /* 32 bit */
2117 esp -= 4;
2118 while (--level) {
2119 esp -= 4;
2120 ebp -= 4;
2121 stl(ssp + (esp & esp_mask), ldl(ssp + (ebp & esp_mask)));
2122 }
2123 esp -= 4;
2124 stl(ssp + (esp & esp_mask), t1);
2125 } else {
2126 /* 16 bit */
2127 esp -= 2;
2128 while (--level) {
2129 esp -= 2;
2130 ebp -= 2;
2131 stw(ssp + (esp & esp_mask), lduw(ssp + (ebp & esp_mask)));
2132 }
2133 esp -= 2;
2134 stw(ssp + (esp & esp_mask), t1);
2135 }
2136 }
2137
2138 #ifdef TARGET_X86_64
2139 void helper_enter64_level(int level, int data64, target_ulong t1)
2140 {
2141 target_ulong esp, ebp;
2142 ebp = EBP;
2143 esp = ESP;
2144
2145 if (data64) {
2146 /* 64 bit */
2147 esp -= 8;
2148 while (--level) {
2149 esp -= 8;
2150 ebp -= 8;
2151 stq(esp, ldq(ebp));
2152 }
2153 esp -= 8;
2154 stq(esp, t1);
2155 } else {
2156 /* 16 bit */
2157 esp -= 2;
2158 while (--level) {
2159 esp -= 2;
2160 ebp -= 2;
2161 stw(esp, lduw(ebp));
2162 }
2163 esp -= 2;
2164 stw(esp, t1);
2165 }
2166 }
2167 #endif
2168
2169 void helper_lldt(int selector)
2170 {
2171 SegmentCache *dt;
2172 uint32_t e1, e2;
2173 int index, entry_limit;
2174 target_ulong ptr;
2175
2176 selector &= 0xffff;
2177 if ((selector & 0xfffc) == 0) {
2178 /* XXX: NULL selector case: invalid LDT */
2179 env->ldt.base = 0;
2180 env->ldt.limit = 0;
2181 } else {
2182 if (selector & 0x4)
2183 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2184 dt = &env->gdt;
2185 index = selector & ~7;
2186 #ifdef TARGET_X86_64
2187 if (env->hflags & HF_LMA_MASK)
2188 entry_limit = 15;
2189 else
2190 #endif
2191 entry_limit = 7;
2192 if ((index + entry_limit) > dt->limit)
2193 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2194 ptr = dt->base + index;
2195 e1 = ldl_kernel(ptr);
2196 e2 = ldl_kernel(ptr + 4);
2197 if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2)
2198 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2199 if (!(e2 & DESC_P_MASK))
2200 raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2201 #ifdef TARGET_X86_64
2202 if (env->hflags & HF_LMA_MASK) {
2203 uint32_t e3;
2204 e3 = ldl_kernel(ptr + 8);
2205 load_seg_cache_raw_dt(&env->ldt, e1, e2);
2206 env->ldt.base |= (target_ulong)e3 << 32;
2207 } else
2208 #endif
2209 {
2210 load_seg_cache_raw_dt(&env->ldt, e1, e2);
2211 }
2212 }
2213 env->ldt.selector = selector;
2214 }
2215
2216 void helper_ltr(int selector)
2217 {
2218 SegmentCache *dt;
2219 uint32_t e1, e2;
2220 int index, type, entry_limit;
2221 target_ulong ptr;
2222
2223 selector &= 0xffff;
2224 if ((selector & 0xfffc) == 0) {
2225 /* NULL selector case: invalid TR */
2226 env->tr.base = 0;
2227 env->tr.limit = 0;
2228 env->tr.flags = 0;
2229 } else {
2230 if (selector & 0x4)
2231 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2232 dt = &env->gdt;
2233 index = selector & ~7;
2234 #ifdef TARGET_X86_64
2235 if (env->hflags & HF_LMA_MASK)
2236 entry_limit = 15;
2237 else
2238 #endif
2239 entry_limit = 7;
2240 if ((index + entry_limit) > dt->limit)
2241 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2242 ptr = dt->base + index;
2243 e1 = ldl_kernel(ptr);
2244 e2 = ldl_kernel(ptr + 4);
2245 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2246 if ((e2 & DESC_S_MASK) ||
2247 (type != 1 && type != 9))
2248 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2249 if (!(e2 & DESC_P_MASK))
2250 raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2251 #ifdef TARGET_X86_64
2252 if (env->hflags & HF_LMA_MASK) {
2253 uint32_t e3, e4;
2254 e3 = ldl_kernel(ptr + 8);
2255 e4 = ldl_kernel(ptr + 12);
2256 if ((e4 >> DESC_TYPE_SHIFT) & 0xf)
2257 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2258 load_seg_cache_raw_dt(&env->tr, e1, e2);
2259 env->tr.base |= (target_ulong)e3 << 32;
2260 } else
2261 #endif
2262 {
2263 load_seg_cache_raw_dt(&env->tr, e1, e2);
2264 }
2265 e2 |= DESC_TSS_BUSY_MASK;
2266 stl_kernel(ptr + 4, e2);
2267 }
2268 env->tr.selector = selector;
2269 }
2270
2271 /* only works if protected mode and not VM86. seg_reg must be != R_CS */
2272 void helper_load_seg(int seg_reg, int selector)
2273 {
2274 uint32_t e1, e2;
2275 int cpl, dpl, rpl;
2276 SegmentCache *dt;
2277 int index;
2278 target_ulong ptr;
2279
2280 selector &= 0xffff;
2281 cpl = env->hflags & HF_CPL_MASK;
2282 if ((selector & 0xfffc) == 0) {
2283 /* null selector case */
2284 if (seg_reg == R_SS
2285 #ifdef TARGET_X86_64
2286 && (!(env->hflags & HF_CS64_MASK) || cpl == 3)
2287 #endif
2288 )
2289 raise_exception_err(EXCP0D_GPF, 0);
2290 cpu_x86_load_seg_cache(env, seg_reg, selector, 0, 0, 0);
2291 } else {
2292
2293 if (selector & 0x4)
2294 dt = &env->ldt;
2295 else
2296 dt = &env->gdt;
2297 index = selector & ~7;
2298 if ((index + 7) > dt->limit)
2299 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2300 ptr = dt->base + index;
2301 e1 = ldl_kernel(ptr);
2302 e2 = ldl_kernel(ptr + 4);
2303
2304 if (!(e2 & DESC_S_MASK))
2305 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2306 rpl = selector & 3;
2307 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2308 if (seg_reg == R_SS) {
2309 /* must be writable segment */
2310 if ((e2 & DESC_CS_MASK) || !(e2 & DESC_W_MASK))
2311 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2312 if (rpl != cpl || dpl != cpl)
2313 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2314 } else {
2315 /* must be readable segment */
2316 if ((e2 & (DESC_CS_MASK | DESC_R_MASK)) == DESC_CS_MASK)
2317 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2318
2319 if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) {
2320 /* if not conforming code, test rights */
2321 if (dpl < cpl || dpl < rpl)
2322 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2323 }
2324 }
2325
2326 if (!(e2 & DESC_P_MASK)) {
2327 if (seg_reg == R_SS)
2328 raise_exception_err(EXCP0C_STACK, selector & 0xfffc);
2329 else
2330 raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2331 }
2332
2333 /* set the access bit if not already set */
2334 if (!(e2 & DESC_A_MASK)) {
2335 e2 |= DESC_A_MASK;
2336 stl_kernel(ptr + 4, e2);
2337 }
2338
2339 cpu_x86_load_seg_cache(env, seg_reg, selector,
2340 get_seg_base(e1, e2),
2341 get_seg_limit(e1, e2),
2342 e2);
2343 #if 0
2344 qemu_log("load_seg: sel=0x%04x base=0x%08lx limit=0x%08lx flags=%08x\n",
2345 selector, (unsigned long)sc->base, sc->limit, sc->flags);
2346 #endif
2347 }
2348 }
2349
2350 /* protected mode jump */
2351 void helper_ljmp_protected(int new_cs, target_ulong new_eip,
2352 int next_eip_addend)
2353 {
2354 int gate_cs, type;
2355 uint32_t e1, e2, cpl, dpl, rpl, limit;
2356 target_ulong next_eip;
2357
2358 if ((new_cs & 0xfffc) == 0)
2359 raise_exception_err(EXCP0D_GPF, 0);
2360 if (load_segment(&e1, &e2, new_cs) != 0)
2361 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2362 cpl = env->hflags & HF_CPL_MASK;
2363 if (e2 & DESC_S_MASK) {
2364 if (!(e2 & DESC_CS_MASK))
2365 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2366 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2367 if (e2 & DESC_C_MASK) {
2368 /* conforming code segment */
2369 if (dpl > cpl)
2370 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2371 } else {
2372 /* non conforming code segment */
2373 rpl = new_cs & 3;
2374 if (rpl > cpl)
2375 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2376 if (dpl != cpl)
2377 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2378 }
2379 if (!(e2 & DESC_P_MASK))
2380 raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2381 limit = get_seg_limit(e1, e2);
2382 if (new_eip > limit &&
2383 !(env->hflags & HF_LMA_MASK) && !(e2 & DESC_L_MASK))
2384 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2385 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
2386 get_seg_base(e1, e2), limit, e2);
2387 EIP = new_eip;
2388 } else {
2389 /* jump to call or task gate */
2390 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2391 rpl = new_cs & 3;
2392 cpl = env->hflags & HF_CPL_MASK;
2393 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2394 switch(type) {
2395 case 1: /* 286 TSS */
2396 case 9: /* 386 TSS */
2397 case 5: /* task gate */
2398 if (dpl < cpl || dpl < rpl)
2399 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2400 next_eip = env->eip + next_eip_addend;
2401 switch_tss(new_cs, e1, e2, SWITCH_TSS_JMP, next_eip);
2402 CC_OP = CC_OP_EFLAGS;
2403 break;
2404 case 4: /* 286 call gate */
2405 case 12: /* 386 call gate */
2406 if ((dpl < cpl) || (dpl < rpl))
2407 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2408 if (!(e2 & DESC_P_MASK))
2409 raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2410 gate_cs = e1 >> 16;
2411 new_eip = (e1 & 0xffff);
2412 if (type == 12)
2413 new_eip |= (e2 & 0xffff0000);
2414 if (load_segment(&e1, &e2, gate_cs) != 0)
2415 raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2416 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2417 /* must be code segment */
2418 if (((e2 & (DESC_S_MASK | DESC_CS_MASK)) !=
2419 (DESC_S_MASK | DESC_CS_MASK)))
2420 raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2421 if (((e2 & DESC_C_MASK) && (dpl > cpl)) ||
2422 (!(e2 & DESC_C_MASK) && (dpl != cpl)))
2423 raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2424 if (!(e2 & DESC_P_MASK))
2425 raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2426 limit = get_seg_limit(e1, e2);
2427 if (new_eip > limit)
2428 raise_exception_err(EXCP0D_GPF, 0);
2429 cpu_x86_load_seg_cache(env, R_CS, (gate_cs & 0xfffc) | cpl,
2430 get_seg_base(e1, e2), limit, e2);
2431 EIP = new_eip;
2432 break;
2433 default:
2434 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2435 break;
2436 }
2437 }
2438 }
2439
2440 /* real mode call */
2441 void helper_lcall_real(int new_cs, target_ulong new_eip1,
2442 int shift, int next_eip)
2443 {
2444 int new_eip;
2445 uint32_t esp, esp_mask;
2446 target_ulong ssp;
2447
2448 new_eip = new_eip1;
2449 esp = ESP;
2450 esp_mask = get_sp_mask(env->segs[R_SS].flags);
2451 ssp = env->segs[R_SS].base;
2452 if (shift) {
2453 PUSHL(ssp, esp, esp_mask, env->segs[R_CS].selector);
2454 PUSHL(ssp, esp, esp_mask, next_eip);
2455 } else {
2456 PUSHW(ssp, esp, esp_mask, env->segs[R_CS].selector);
2457 PUSHW(ssp, esp, esp_mask, next_eip);
2458 }
2459
2460 SET_ESP(esp, esp_mask);
2461 env->eip = new_eip;
2462 env->segs[R_CS].selector = new_cs;
2463 env->segs[R_CS].base = (new_cs << 4);
2464 }
2465
2466 /* protected mode call */
2467 void helper_lcall_protected(int new_cs, target_ulong new_eip,
2468 int shift, int next_eip_addend)
2469 {
2470 int new_stack, i;
2471 uint32_t e1, e2, cpl, dpl, rpl, selector, offset, param_count;
2472 uint32_t ss = 0, ss_e1 = 0, ss_e2 = 0, sp, type, ss_dpl, sp_mask;
2473 uint32_t val, limit, old_sp_mask;
2474 target_ulong ssp, old_ssp, next_eip;
2475
2476 next_eip = env->eip + next_eip_addend;
2477 LOG_PCALL("lcall %04x:%08x s=%d\n", new_cs, (uint32_t)new_eip, shift);
2478 LOG_PCALL_STATE(env);
2479 if ((new_cs & 0xfffc) == 0)
2480 raise_exception_err(EXCP0D_GPF, 0);
2481 if (load_segment(&e1, &e2, new_cs) != 0)
2482 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2483 cpl = env->hflags & HF_CPL_MASK;
2484 LOG_PCALL("desc=%08x:%08x\n", e1, e2);
2485 if (e2 & DESC_S_MASK) {
2486 if (!(e2 & DESC_CS_MASK))
2487 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2488 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2489 if (e2 & DESC_C_MASK) {
2490 /* conforming code segment */
2491 if (dpl > cpl)
2492 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2493 } else {
2494 /* non conforming code segment */
2495 rpl = new_cs & 3;
2496 if (rpl > cpl)
2497 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2498 if (dpl != cpl)
2499 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2500 }
2501 if (!(e2 & DESC_P_MASK))
2502 raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2503
2504 #ifdef TARGET_X86_64
2505 /* XXX: check 16/32 bit cases in long mode */
2506 if (shift == 2) {
2507 target_ulong rsp;
2508 /* 64 bit case */
2509 rsp = ESP;
2510 PUSHQ(rsp, env->segs[R_CS].selector);
2511 PUSHQ(rsp, next_eip);
2512 /* from this point, not restartable */
2513 ESP = rsp;
2514 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
2515 get_seg_base(e1, e2),
2516 get_seg_limit(e1, e2), e2);
2517 EIP = new_eip;
2518 } else
2519 #endif
2520 {
2521 sp = ESP;
2522 sp_mask = get_sp_mask(env->segs[R_SS].flags);
2523 ssp = env->segs[R_SS].base;
2524 if (shift) {
2525 PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
2526 PUSHL(ssp, sp, sp_mask, next_eip);
2527 } else {
2528 PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
2529 PUSHW(ssp, sp, sp_mask, next_eip);
2530 }
2531
2532 limit = get_seg_limit(e1, e2);
2533 if (new_eip > limit)
2534 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2535 /* from this point, not restartable */
2536 SET_ESP(sp, sp_mask);
2537 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
2538 get_seg_base(e1, e2), limit, e2);
2539 EIP = new_eip;
2540 }
2541 } else {
2542 /* check gate type */
2543 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
2544 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2545 rpl = new_cs & 3;
2546 switch(type) {
2547 case 1: /* available 286 TSS */
2548 case 9: /* available 386 TSS */
2549 case 5: /* task gate */
2550 if (dpl < cpl || dpl < rpl)
2551 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2552 switch_tss(new_cs, e1, e2, SWITCH_TSS_CALL, next_eip);
2553 CC_OP = CC_OP_EFLAGS;
2554 return;
2555 case 4: /* 286 call gate */
2556 case 12: /* 386 call gate */
2557 break;
2558 default:
2559 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2560 break;
2561 }
2562 shift = type >> 3;
2563
2564 if (dpl < cpl || dpl < rpl)
2565 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2566 /* check valid bit */
2567 if (!(e2 & DESC_P_MASK))
2568 raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2569 selector = e1 >> 16;
2570 offset = (e2 & 0xffff0000) | (e1 & 0x0000ffff);
2571 param_count = e2 & 0x1f;
2572 if ((selector & 0xfffc) == 0)
2573 raise_exception_err(EXCP0D_GPF, 0);
2574
2575 if (load_segment(&e1, &e2, selector) != 0)
2576 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2577 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK)))
2578 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2579 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2580 if (dpl > cpl)
2581 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2582 if (!(e2 & DESC_P_MASK))
2583 raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2584
2585 if (!(e2 & DESC_C_MASK) && dpl < cpl) {
2586 /* to inner privilege */
2587 get_ss_esp_from_tss(&ss, &sp, dpl);
2588 LOG_PCALL("new ss:esp=%04x:%08x param_count=%d ESP=" TARGET_FMT_lx "\n",
2589 ss, sp, param_count, ESP);
2590 if ((ss & 0xfffc) == 0)
2591 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2592 if ((ss & 3) != dpl)
2593 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2594 if (load_segment(&ss_e1, &ss_e2, ss) != 0)
2595 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2596 ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
2597 if (ss_dpl != dpl)
2598 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2599 if (!(ss_e2 & DESC_S_MASK) ||
2600 (ss_e2 & DESC_CS_MASK) ||
2601 !(ss_e2 & DESC_W_MASK))
2602 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2603 if (!(ss_e2 & DESC_P_MASK))
2604 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2605
2606 // push_size = ((param_count * 2) + 8) << shift;
2607
2608 old_sp_mask = get_sp_mask(env->segs[R_SS].flags);
2609 old_ssp = env->segs[R_SS].base;
2610
2611 sp_mask = get_sp_mask(ss_e2);
2612 ssp = get_seg_base(ss_e1, ss_e2);
2613 if (shift) {
2614 PUSHL(ssp, sp, sp_mask, env->segs[R_SS].selector);
2615 PUSHL(ssp, sp, sp_mask, ESP);
2616 for(i = param_count - 1; i >= 0; i--) {
2617 val = ldl_kernel(old_ssp + ((ESP + i * 4) & old_sp_mask));
2618 PUSHL(ssp, sp, sp_mask, val);
2619 }
2620 } else {
2621 PUSHW(ssp, sp, sp_mask, env->segs[R_SS].selector);
2622 PUSHW(ssp, sp, sp_mask, ESP);
2623 for(i = param_count - 1; i >= 0; i--) {
2624 val = lduw_kernel(old_ssp + ((ESP + i * 2) & old_sp_mask));
2625 PUSHW(ssp, sp, sp_mask, val);
2626 }
2627 }
2628 new_stack = 1;
2629 } else {
2630 /* to same privilege */
2631 sp = ESP;
2632 sp_mask = get_sp_mask(env->segs[R_SS].flags);
2633 ssp = env->segs[R_SS].base;
2634 // push_size = (4 << shift);
2635 new_stack = 0;
2636 }
2637
2638 if (shift) {
2639 PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
2640 PUSHL(ssp, sp, sp_mask, next_eip);
2641 } else {
2642 PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
2643 PUSHW(ssp, sp, sp_mask, next_eip);
2644 }
2645
2646 /* from this point, not restartable */
2647
2648 if (new_stack) {
2649 ss = (ss & ~3) | dpl;
2650 cpu_x86_load_seg_cache(env, R_SS, ss,
2651 ssp,
2652 get_seg_limit(ss_e1, ss_e2),
2653 ss_e2);
2654 }
2655
2656 selector = (selector & ~3) | dpl;
2657 cpu_x86_load_seg_cache(env, R_CS, selector,
2658 get_seg_base(e1, e2),
2659 get_seg_limit(e1, e2),
2660 e2);
2661 cpu_x86_set_cpl(env, dpl);
2662 SET_ESP(sp, sp_mask);
2663 EIP = offset;
2664 }
2665 }
2666
2667 /* real and vm86 mode iret */
2668 void helper_iret_real(int shift)
2669 {
2670 uint32_t sp, new_cs, new_eip, new_eflags, sp_mask;
2671 target_ulong ssp;
2672 int eflags_mask;
2673
2674 sp_mask = 0xffff; /* XXXX: use SS segment size ? */
2675 sp = ESP;
2676 ssp = env->segs[R_SS].base;
2677 if (shift == 1) {
2678 /* 32 bits */
2679 POPL(ssp, sp, sp_mask, new_eip);
2680 POPL(ssp, sp, sp_mask, new_cs);
2681 new_cs &= 0xffff;
2682 POPL(ssp, sp, sp_mask, new_eflags);
2683 } else {
2684 /* 16 bits */
2685 POPW(ssp, sp, sp_mask, new_eip);
2686 POPW(ssp, sp, sp_mask, new_cs);
2687 POPW(ssp, sp, sp_mask, new_eflags);
2688 }
2689 ESP = (ESP & ~sp_mask) | (sp & sp_mask);
2690 env->segs[R_CS].selector = new_cs;
2691 env->segs[R_CS].base = (new_cs << 4);
2692 env->eip = new_eip;
2693 if (env->eflags & VM_MASK)
2694 eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | RF_MASK | NT_MASK;
2695 else
2696 eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | IOPL_MASK | RF_MASK | NT_MASK;
2697 if (shift == 0)
2698 eflags_mask &= 0xffff;
2699 load_eflags(new_eflags, eflags_mask);
2700 env->hflags2 &= ~HF2_NMI_MASK;
2701 }
2702
2703 static inline void validate_seg(int seg_reg, int cpl)
2704 {
2705 int dpl;
2706 uint32_t e2;
2707
2708 /* XXX: on x86_64, we do not want to nullify FS and GS because
2709 they may still contain a valid base. I would be interested to
2710 know how a real x86_64 CPU behaves */
2711 if ((seg_reg == R_FS || seg_reg == R_GS) &&
2712 (env->segs[seg_reg].selector & 0xfffc) == 0)
2713 return;
2714
2715 e2 = env->segs[seg_reg].flags;
2716 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2717 if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) {
2718 /* data or non conforming code segment */
2719 if (dpl < cpl) {
2720 cpu_x86_load_seg_cache(env, seg_reg, 0, 0, 0, 0);
2721 }
2722 }
2723 }
2724
2725 /* protected mode iret */
2726 static inline void helper_ret_protected(int shift, int is_iret, int addend)
2727 {
2728 uint32_t new_cs, new_eflags, new_ss;
2729 uint32_t new_es, new_ds, new_fs, new_gs;
2730 uint32_t e1, e2, ss_e1, ss_e2;
2731 int cpl, dpl, rpl, eflags_mask, iopl;
2732 target_ulong ssp, sp, new_eip, new_esp, sp_mask;
2733
2734 #ifdef TARGET_X86_64
2735 if (shift == 2)
2736 sp_mask = -1;
2737 else
2738 #endif
2739 sp_mask = get_sp_mask(env->segs[R_SS].flags);
2740 sp = ESP;
2741 ssp = env->segs[R_SS].base;
2742 new_eflags = 0; /* avoid warning */
2743 #ifdef TARGET_X86_64
2744 if (shift == 2) {
2745 POPQ(sp, new_eip);
2746 POPQ(sp, new_cs);
2747 new_cs &= 0xffff;
2748 if (is_iret) {
2749 POPQ(sp, new_eflags);
2750 }
2751 } else
2752 #endif
2753 if (shift == 1) {
2754 /* 32 bits */
2755 POPL(ssp, sp, sp_mask, new_eip);
2756 POPL(ssp, sp, sp_mask, new_cs);
2757 new_cs &= 0xffff;
2758 if (is_iret) {
2759 POPL(ssp, sp, sp_mask, new_eflags);
2760 if (new_eflags & VM_MASK)
2761 goto return_to_vm86;
2762 }
2763 } else {
2764 /* 16 bits */
2765 POPW(ssp, sp, sp_mask, new_eip);
2766 POPW(ssp, sp, sp_mask, new_cs);
2767 if (is_iret)
2768 POPW(ssp, sp, sp_mask, new_eflags);
2769 }
2770 LOG_PCALL("lret new %04x:" TARGET_FMT_lx " s=%d addend=0x%x\n",
2771 new_cs, new_eip, shift, addend);
2772 LOG_PCALL_STATE(env);
2773 if ((new_cs & 0xfffc) == 0)
2774 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2775 if (load_segment(&e1, &e2, new_cs) != 0)
2776 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2777 if (!(e2 & DESC_S_MASK) ||
2778 !(e2 & DESC_CS_MASK))
2779 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2780 cpl = env->hflags & HF_CPL_MASK;
2781 rpl = new_cs & 3;
2782 if (rpl < cpl)
2783 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2784 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2785 if (e2 & DESC_C_MASK) {
2786 if (dpl > rpl)
2787 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2788 } else {
2789 if (dpl != rpl)
2790 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2791 }
2792 if (!(e2 & DESC_P_MASK))
2793 raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2794
2795 sp += addend;
2796 if (rpl == cpl && (!(env->hflags & HF_CS64_MASK) ||
2797 ((env->hflags & HF_CS64_MASK) && !is_iret))) {
2798 /* return to same privilege level */
2799 cpu_x86_load_seg_cache(env, R_CS, new_cs,
2800 get_seg_base(e1, e2),
2801 get_seg_limit(e1, e2),
2802 e2);
2803 } else {
2804 /* return to different privilege level */
2805 #ifdef TARGET_X86_64
2806 if (shift == 2) {
2807 POPQ(sp, new_esp);
2808 POPQ(sp, new_ss);
2809 new_ss &= 0xffff;
2810 } else
2811 #endif
2812 if (shift == 1) {
2813 /* 32 bits */
2814 POPL(ssp, sp, sp_mask, new_esp);
2815 POPL(ssp, sp, sp_mask, new_ss);
2816 new_ss &= 0xffff;
2817 } else {
2818 /* 16 bits */
2819 POPW(ssp, sp, sp_mask, new_esp);
2820 POPW(ssp, sp, sp_mask, new_ss);
2821 }
2822 LOG_PCALL("new ss:esp=%04x:" TARGET_FMT_lx "\n",
2823 new_ss, new_esp);
2824 if ((new_ss & 0xfffc) == 0) {
2825 #ifdef TARGET_X86_64
2826 /* NULL ss is allowed in long mode if cpl != 3*/
2827 /* XXX: test CS64 ? */
2828 if ((env->hflags & HF_LMA_MASK) && rpl != 3) {
2829 cpu_x86_load_seg_cache(env, R_SS, new_ss,
2830 0, 0xffffffff,
2831 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2832 DESC_S_MASK | (rpl << DESC_DPL_SHIFT) |
2833 DESC_W_MASK | DESC_A_MASK);
2834 ss_e2 = DESC_B_MASK; /* XXX: should not be needed ? */
2835 } else
2836 #endif
2837 {
2838 raise_exception_err(EXCP0D_GPF, 0);
2839 }
2840 } else {
2841 if ((new_ss & 3) != rpl)
2842 raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2843 if (load_segment(&ss_e1, &ss_e2, new_ss) != 0)
2844 raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2845 if (!(ss_e2 & DESC_S_MASK) ||
2846 (ss_e2 & DESC_CS_MASK) ||
2847 !(ss_e2 & DESC_W_MASK))
2848 raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2849 dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
2850 if (dpl != rpl)
2851 raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2852 if (!(ss_e2 & DESC_P_MASK))
2853 raise_exception_err(EXCP0B_NOSEG, new_ss & 0xfffc);
2854 cpu_x86_load_seg_cache(env, R_SS, new_ss,
2855 get_seg_base(ss_e1, ss_e2),
2856 get_seg_limit(ss_e1, ss_e2),
2857 ss_e2);
2858 }
2859
2860 cpu_x86_load_seg_cache(env, R_CS, new_cs,
2861 get_seg_base(e1, e2),
2862 get_seg_limit(e1, e2),
2863 e2);
2864 cpu_x86_set_cpl(env, rpl);
2865 sp = new_esp;
2866 #ifdef TARGET_X86_64
2867 if (env->hflags & HF_CS64_MASK)
2868 sp_mask = -1;
2869 else
2870 #endif
2871 sp_mask = get_sp_mask(ss_e2);
2872
2873 /* validate data segments */
2874 validate_seg(R_ES, rpl);
2875 validate_seg(R_DS, rpl);
2876 validate_seg(R_FS, rpl);
2877 validate_seg(R_GS, rpl);
2878
2879 sp += addend;
2880 }
2881 SET_ESP(sp, sp_mask);
2882 env->eip = new_eip;
2883 if (is_iret) {
2884 /* NOTE: 'cpl' is the _old_ CPL */
2885 eflags_mask = TF_MASK | AC_MASK | ID_MASK | RF_MASK | NT_MASK;
2886 if (cpl == 0)
2887 eflags_mask |= IOPL_MASK;
2888 iopl = (env->eflags >> IOPL_SHIFT) & 3;
2889 if (cpl <= iopl)
2890 eflags_mask |= IF_MASK;
2891 if (shift == 0)
2892 eflags_mask &= 0xffff;
2893 load_eflags(new_eflags, eflags_mask);
2894 }
2895 return;
2896
2897 return_to_vm86:
2898 POPL(ssp, sp, sp_mask, new_esp);
2899 POPL(ssp, sp, sp_mask, new_ss);
2900 POPL(ssp, sp, sp_mask, new_es);
2901 POPL(ssp, sp, sp_mask, new_ds);
2902 POPL(ssp, sp, sp_mask, new_fs);
2903 POPL(ssp, sp, sp_mask, new_gs);
2904
2905 /* modify processor state */
2906 load_eflags(new_eflags, TF_MASK | AC_MASK | ID_MASK |
2907 IF_MASK | IOPL_MASK | VM_MASK | NT_MASK | VIF_MASK | VIP_MASK);
2908 load_seg_vm(R_CS, new_cs & 0xffff);
2909 cpu_x86_set_cpl(env, 3);
2910 load_seg_vm(R_SS, new_ss & 0xffff);
2911 load_seg_vm(R_ES, new_es & 0xffff);
2912 load_seg_vm(R_DS, new_ds & 0xffff);
2913 load_seg_vm(R_FS, new_fs & 0xffff);
2914 load_seg_vm(R_GS, new_gs & 0xffff);
2915
2916 env->eip = new_eip & 0xffff;
2917 ESP = new_esp;
2918 }
2919
2920 void helper_iret_protected(int shift, int next_eip)
2921 {
2922 int tss_selector, type;
2923 uint32_t e1, e2;
2924
2925 /* specific case for TSS */
2926 if (env->eflags & NT_MASK) {
2927 #ifdef TARGET_X86_64
2928 if (env->hflags & HF_LMA_MASK)
2929 raise_exception_err(EXCP0D_GPF, 0);
2930 #endif
2931 tss_selector = lduw_kernel(env->tr.base + 0);
2932 if (tss_selector & 4)
2933 raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2934 if (load_segment(&e1, &e2, tss_selector) != 0)
2935 raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2936 type = (e2 >> DESC_TYPE_SHIFT) & 0x17;
2937 /* NOTE: we check both segment and busy TSS */
2938 if (type != 3)
2939 raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2940 switch_tss(tss_selector, e1, e2, SWITCH_TSS_IRET, next_eip);
2941 } else {
2942 helper_ret_protected(shift, 1, 0);
2943 }
2944 env->hflags2 &= ~HF2_NMI_MASK;
2945 }
2946
2947 void helper_lret_protected(int shift, int addend)
2948 {
2949 helper_ret_protected(shift, 0, addend);
2950 }
2951
2952 void helper_sysenter(void)
2953 {
2954 if (env->sysenter_cs == 0) {
2955 raise_exception_err(EXCP0D_GPF, 0);
2956 }
2957 env->eflags &= ~(VM_MASK | IF_MASK | RF_MASK);
2958 cpu_x86_set_cpl(env, 0);
2959
2960 #ifdef TARGET_X86_64
2961 if (env->hflags & HF_LMA_MASK) {
2962 cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc,
2963 0, 0xffffffff,
2964 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2965 DESC_S_MASK |
2966 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);
2967 } else
2968 #endif
2969 {
2970 cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc,
2971 0, 0xffffffff,
2972 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2973 DESC_S_MASK |
2974 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
2975 }
2976 cpu_x86_load_seg_cache(env, R_SS, (env->sysenter_cs + 8) & 0xfffc,
2977 0, 0xffffffff,
2978 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2979 DESC_S_MASK |
2980 DESC_W_MASK | DESC_A_MASK);
2981 ESP = env->sysenter_esp;
2982 EIP = env->sysenter_eip;
2983 }
2984
2985 void helper_sysexit(int dflag)
2986 {
2987 int cpl;
2988
2989 cpl = env->hflags & HF_CPL_MASK;
2990 if (env->sysenter_cs == 0 || cpl != 0) {
2991 raise_exception_err(EXCP0D_GPF, 0);
2992 }
2993 cpu_x86_set_cpl(env, 3);
2994 #ifdef TARGET_X86_64
2995 if (dflag == 2) {
2996 cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 32) & 0xfffc) | 3,
2997 0, 0xffffffff,
2998 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2999 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
3000 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);
3001 cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 40) & 0xfffc) | 3,
3002 0, 0xffffffff,
3003 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
3004 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
3005 DESC_W_MASK | DESC_A_MASK);
3006 } else
3007 #endif
3008 {
3009 cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 16) & 0xfffc) | 3,
3010 0, 0xffffffff,
3011 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
3012 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
3013 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
3014 cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 24) & 0xfffc) | 3,
3015 0, 0xffffffff,
3016 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
3017 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
3018 DESC_W_MASK | DESC_A_MASK);
3019 }
3020 ESP = ECX;
3021 EIP = EDX;
3022 }
3023
3024 #if defined(CONFIG_USER_ONLY)
<