4 * Copyright (c) 2003 Fabrice Bellard
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301 USA
20 #define CPU_NO_GLOBAL_REGS
23 #include "host-utils.h"
29 # define LOG_PCALL(...) do { \
30 if (loglevel & CPU_LOG_PCALL) \
31 fprintf(logfile, ## __VA_ARGS__); \
33 # define LOG_PCALL_STATE(env) do { \
34 if (loglevel & CPU_LOG_PCALL) \
35 cpu_dump_state((env), logfile, fprintf, X86_DUMP_CCOP); \
38 # define LOG_PCALL(...) do { } while (0)
39 # define LOG_PCALL_STATE(env) do { } while (0)
44 #define raise_exception_err(a, b)\
47 fprintf(logfile, "raise_exception line=%d\n", __LINE__);\
48 (raise_exception_err)(a, b);\
52 static const uint8_t parity_table
[256] = {
53 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
54 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
55 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
56 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
57 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
58 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
59 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
60 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
61 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
62 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
63 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
64 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
65 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
66 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
67 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
68 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
69 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
70 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
71 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
72 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
73 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
74 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
75 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
76 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
77 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
78 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
79 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
80 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
81 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
82 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
83 CC_P
, 0, 0, CC_P
, 0, CC_P
, CC_P
, 0,
84 0, CC_P
, CC_P
, 0, CC_P
, 0, 0, CC_P
,
88 static const uint8_t rclw_table
[32] = {
89 0, 1, 2, 3, 4, 5, 6, 7,
90 8, 9,10,11,12,13,14,15,
91 16, 0, 1, 2, 3, 4, 5, 6,
92 7, 8, 9,10,11,12,13,14,
96 static const uint8_t rclb_table
[32] = {
97 0, 1, 2, 3, 4, 5, 6, 7,
98 8, 0, 1, 2, 3, 4, 5, 6,
99 7, 8, 0, 1, 2, 3, 4, 5,
100 6, 7, 8, 0, 1, 2, 3, 4,
103 static const CPU86_LDouble f15rk
[7] =
105 0.00000000000000000000L,
106 1.00000000000000000000L,
107 3.14159265358979323851L, /*pi*/
108 0.30102999566398119523L, /*lg2*/
109 0.69314718055994530943L, /*ln2*/
110 1.44269504088896340739L, /*l2e*/
111 3.32192809488736234781L, /*l2t*/
114 /* broken thread support */
116 static spinlock_t global_cpu_lock
= SPIN_LOCK_UNLOCKED
;
118 void helper_lock(void)
120 spin_lock(&global_cpu_lock
);
123 void helper_unlock(void)
125 spin_unlock(&global_cpu_lock
);
128 void helper_write_eflags(target_ulong t0
, uint32_t update_mask
)
130 load_eflags(t0
, update_mask
);
133 target_ulong
helper_read_eflags(void)
136 eflags
= helper_cc_compute_all(CC_OP
);
137 eflags
|= (DF
& DF_MASK
);
138 eflags
|= env
->eflags
& ~(VM_MASK
| RF_MASK
);
142 /* return non zero if error */
143 static inline int load_segment(uint32_t *e1_ptr
, uint32_t *e2_ptr
,
154 index
= selector
& ~7;
155 if ((index
+ 7) > dt
->limit
)
157 ptr
= dt
->base
+ index
;
158 *e1_ptr
= ldl_kernel(ptr
);
159 *e2_ptr
= ldl_kernel(ptr
+ 4);
163 static inline unsigned int get_seg_limit(uint32_t e1
, uint32_t e2
)
166 limit
= (e1
& 0xffff) | (e2
& 0x000f0000);
167 if (e2
& DESC_G_MASK
)
168 limit
= (limit
<< 12) | 0xfff;
172 static inline uint32_t get_seg_base(uint32_t e1
, uint32_t e2
)
174 return ((e1
>> 16) | ((e2
& 0xff) << 16) | (e2
& 0xff000000));
177 static inline void load_seg_cache_raw_dt(SegmentCache
*sc
, uint32_t e1
, uint32_t e2
)
179 sc
->base
= get_seg_base(e1
, e2
);
180 sc
->limit
= get_seg_limit(e1
, e2
);
184 /* init the segment cache in vm86 mode. */
185 static inline void load_seg_vm(int seg
, int selector
)
188 cpu_x86_load_seg_cache(env
, seg
, selector
,
189 (selector
<< 4), 0xffff, 0);
192 static inline void get_ss_esp_from_tss(uint32_t *ss_ptr
,
193 uint32_t *esp_ptr
, int dpl
)
195 int type
, index
, shift
;
200 printf("TR: base=%p limit=%x\n", env
->tr
.base
, env
->tr
.limit
);
201 for(i
=0;i
<env
->tr
.limit
;i
++) {
202 printf("%02x ", env
->tr
.base
[i
]);
203 if ((i
& 7) == 7) printf("\n");
209 if (!(env
->tr
.flags
& DESC_P_MASK
))
210 cpu_abort(env
, "invalid tss");
211 type
= (env
->tr
.flags
>> DESC_TYPE_SHIFT
) & 0xf;
213 cpu_abort(env
, "invalid tss type");
215 index
= (dpl
* 4 + 2) << shift
;
216 if (index
+ (4 << shift
) - 1 > env
->tr
.limit
)
217 raise_exception_err(EXCP0A_TSS
, env
->tr
.selector
& 0xfffc);
219 *esp_ptr
= lduw_kernel(env
->tr
.base
+ index
);
220 *ss_ptr
= lduw_kernel(env
->tr
.base
+ index
+ 2);
222 *esp_ptr
= ldl_kernel(env
->tr
.base
+ index
);
223 *ss_ptr
= lduw_kernel(env
->tr
.base
+ index
+ 4);
227 /* XXX: merge with load_seg() */
228 static void tss_load_seg(int seg_reg
, int selector
)
233 if ((selector
& 0xfffc) != 0) {
234 if (load_segment(&e1
, &e2
, selector
) != 0)
235 raise_exception_err(EXCP0A_TSS
, selector
& 0xfffc);
236 if (!(e2
& DESC_S_MASK
))
237 raise_exception_err(EXCP0A_TSS
, selector
& 0xfffc);
239 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
240 cpl
= env
->hflags
& HF_CPL_MASK
;
241 if (seg_reg
== R_CS
) {
242 if (!(e2
& DESC_CS_MASK
))
243 raise_exception_err(EXCP0A_TSS
, selector
& 0xfffc);
244 /* XXX: is it correct ? */
246 raise_exception_err(EXCP0A_TSS
, selector
& 0xfffc);
247 if ((e2
& DESC_C_MASK
) && dpl
> rpl
)
248 raise_exception_err(EXCP0A_TSS
, selector
& 0xfffc);
249 } else if (seg_reg
== R_SS
) {
250 /* SS must be writable data */
251 if ((e2
& DESC_CS_MASK
) || !(e2
& DESC_W_MASK
))
252 raise_exception_err(EXCP0A_TSS
, selector
& 0xfffc);
253 if (dpl
!= cpl
|| dpl
!= rpl
)
254 raise_exception_err(EXCP0A_TSS
, selector
& 0xfffc);
256 /* not readable code */
257 if ((e2
& DESC_CS_MASK
) && !(e2
& DESC_R_MASK
))
258 raise_exception_err(EXCP0A_TSS
, selector
& 0xfffc);
259 /* if data or non conforming code, checks the rights */
260 if (((e2
>> DESC_TYPE_SHIFT
) & 0xf) < 12) {
261 if (dpl
< cpl
|| dpl
< rpl
)
262 raise_exception_err(EXCP0A_TSS
, selector
& 0xfffc);
265 if (!(e2
& DESC_P_MASK
))
266 raise_exception_err(EXCP0B_NOSEG
, selector
& 0xfffc);
267 cpu_x86_load_seg_cache(env
, seg_reg
, selector
,
268 get_seg_base(e1
, e2
),
269 get_seg_limit(e1
, e2
),
272 if (seg_reg
== R_SS
|| seg_reg
== R_CS
)
273 raise_exception_err(EXCP0A_TSS
, selector
& 0xfffc);
277 #define SWITCH_TSS_JMP 0
278 #define SWITCH_TSS_IRET 1
279 #define SWITCH_TSS_CALL 2
281 /* XXX: restore CPU state in registers (PowerPC case) */
282 static void switch_tss(int tss_selector
,
283 uint32_t e1
, uint32_t e2
, int source
,
286 int tss_limit
, tss_limit_max
, type
, old_tss_limit_max
, old_type
, v1
, v2
, i
;
287 target_ulong tss_base
;
288 uint32_t new_regs
[8], new_segs
[6];
289 uint32_t new_eflags
, new_eip
, new_cr3
, new_ldt
, new_trap
;
290 uint32_t old_eflags
, eflags_mask
;
295 type
= (e2
>> DESC_TYPE_SHIFT
) & 0xf;
296 LOG_PCALL("switch_tss: sel=0x%04x type=%d src=%d\n", tss_selector
, type
, source
);
298 /* if task gate, we read the TSS segment and we load it */
300 if (!(e2
& DESC_P_MASK
))
301 raise_exception_err(EXCP0B_NOSEG
, tss_selector
& 0xfffc);
302 tss_selector
= e1
>> 16;
303 if (tss_selector
& 4)
304 raise_exception_err(EXCP0A_TSS
, tss_selector
& 0xfffc);
305 if (load_segment(&e1
, &e2
, tss_selector
) != 0)
306 raise_exception_err(EXCP0D_GPF
, tss_selector
& 0xfffc);
307 if (e2
& DESC_S_MASK
)
308 raise_exception_err(EXCP0D_GPF
, tss_selector
& 0xfffc);
309 type
= (e2
>> DESC_TYPE_SHIFT
) & 0xf;
311 raise_exception_err(EXCP0D_GPF
, tss_selector
& 0xfffc);
314 if (!(e2
& DESC_P_MASK
))
315 raise_exception_err(EXCP0B_NOSEG
, tss_selector
& 0xfffc);
321 tss_limit
= get_seg_limit(e1
, e2
);
322 tss_base
= get_seg_base(e1
, e2
);
323 if ((tss_selector
& 4) != 0 ||
324 tss_limit
< tss_limit_max
)
325 raise_exception_err(EXCP0A_TSS
, tss_selector
& 0xfffc);
326 old_type
= (env
->tr
.flags
>> DESC_TYPE_SHIFT
) & 0xf;
328 old_tss_limit_max
= 103;
330 old_tss_limit_max
= 43;
332 /* read all the registers from the new TSS */
335 new_cr3
= ldl_kernel(tss_base
+ 0x1c);
336 new_eip
= ldl_kernel(tss_base
+ 0x20);
337 new_eflags
= ldl_kernel(tss_base
+ 0x24);
338 for(i
= 0; i
< 8; i
++)
339 new_regs
[i
] = ldl_kernel(tss_base
+ (0x28 + i
* 4));
340 for(i
= 0; i
< 6; i
++)
341 new_segs
[i
] = lduw_kernel(tss_base
+ (0x48 + i
* 4));
342 new_ldt
= lduw_kernel(tss_base
+ 0x60);
343 new_trap
= ldl_kernel(tss_base
+ 0x64);
347 new_eip
= lduw_kernel(tss_base
+ 0x0e);
348 new_eflags
= lduw_kernel(tss_base
+ 0x10);
349 for(i
= 0; i
< 8; i
++)
350 new_regs
[i
] = lduw_kernel(tss_base
+ (0x12 + i
* 2)) | 0xffff0000;
351 for(i
= 0; i
< 4; i
++)
352 new_segs
[i
] = lduw_kernel(tss_base
+ (0x22 + i
* 4));
353 new_ldt
= lduw_kernel(tss_base
+ 0x2a);
359 /* NOTE: we must avoid memory exceptions during the task switch,
360 so we make dummy accesses before */
361 /* XXX: it can still fail in some cases, so a bigger hack is
362 necessary to valid the TLB after having done the accesses */
364 v1
= ldub_kernel(env
->tr
.base
);
365 v2
= ldub_kernel(env
->tr
.base
+ old_tss_limit_max
);
366 stb_kernel(env
->tr
.base
, v1
);
367 stb_kernel(env
->tr
.base
+ old_tss_limit_max
, v2
);
369 /* clear busy bit (it is restartable) */
370 if (source
== SWITCH_TSS_JMP
|| source
== SWITCH_TSS_IRET
) {
373 ptr
= env
->gdt
.base
+ (env
->tr
.selector
& ~7);
374 e2
= ldl_kernel(ptr
+ 4);
375 e2
&= ~DESC_TSS_BUSY_MASK
;
376 stl_kernel(ptr
+ 4, e2
);
378 old_eflags
= compute_eflags();
379 if (source
== SWITCH_TSS_IRET
)
380 old_eflags
&= ~NT_MASK
;
382 /* save the current state in the old TSS */
385 stl_kernel(env
->tr
.base
+ 0x20, next_eip
);
386 stl_kernel(env
->tr
.base
+ 0x24, old_eflags
);
387 stl_kernel(env
->tr
.base
+ (0x28 + 0 * 4), EAX
);
388 stl_kernel(env
->tr
.base
+ (0x28 + 1 * 4), ECX
);
389 stl_kernel(env
->tr
.base
+ (0x28 + 2 * 4), EDX
);
390 stl_kernel(env
->tr
.base
+ (0x28 + 3 * 4), EBX
);
391 stl_kernel(env
->tr
.base
+ (0x28 + 4 * 4), ESP
);
392 stl_kernel(env
->tr
.base
+ (0x28 + 5 * 4), EBP
);
393 stl_kernel(env
->tr
.base
+ (0x28 + 6 * 4), ESI
);
394 stl_kernel(env
->tr
.base
+ (0x28 + 7 * 4), EDI
);
395 for(i
= 0; i
< 6; i
++)
396 stw_kernel(env
->tr
.base
+ (0x48 + i
* 4), env
->segs
[i
].selector
);
399 stw_kernel(env
->tr
.base
+ 0x0e, next_eip
);
400 stw_kernel(env
->tr
.base
+ 0x10, old_eflags
);
401 stw_kernel(env
->tr
.base
+ (0x12 + 0 * 2), EAX
);
402 stw_kernel(env
->tr
.base
+ (0x12 + 1 * 2), ECX
);
403 stw_kernel(env
->tr
.base
+ (0x12 + 2 * 2), EDX
);
404 stw_kernel(env
->tr
.base
+ (0x12 + 3 * 2), EBX
);
405 stw_kernel(env
->tr
.base
+ (0x12 + 4 * 2), ESP
);
406 stw_kernel(env
->tr
.base
+ (0x12 + 5 * 2), EBP
);
407 stw_kernel(env
->tr
.base
+ (0x12 + 6 * 2), ESI
);
408 stw_kernel(env
->tr
.base
+ (0x12 + 7 * 2), EDI
);
409 for(i
= 0; i
< 4; i
++)
410 stw_kernel(env
->tr
.base
+ (0x22 + i
* 4), env
->segs
[i
].selector
);
413 /* now if an exception occurs, it will occurs in the next task
416 if (source
== SWITCH_TSS_CALL
) {
417 stw_kernel(tss_base
, env
->tr
.selector
);
418 new_eflags
|= NT_MASK
;
422 if (source
== SWITCH_TSS_JMP
|| source
== SWITCH_TSS_CALL
) {
425 ptr
= env
->gdt
.base
+ (tss_selector
& ~7);
426 e2
= ldl_kernel(ptr
+ 4);
427 e2
|= DESC_TSS_BUSY_MASK
;
428 stl_kernel(ptr
+ 4, e2
);
431 /* set the new CPU state */
432 /* from this point, any exception which occurs can give problems */
433 env
->cr
[0] |= CR0_TS_MASK
;
434 env
->hflags
|= HF_TS_MASK
;
435 env
->tr
.selector
= tss_selector
;
436 env
->tr
.base
= tss_base
;
437 env
->tr
.limit
= tss_limit
;
438 env
->tr
.flags
= e2
& ~DESC_TSS_BUSY_MASK
;
440 if ((type
& 8) && (env
->cr
[0] & CR0_PG_MASK
)) {
441 cpu_x86_update_cr3(env
, new_cr3
);
444 /* load all registers without an exception, then reload them with
445 possible exception */
447 eflags_mask
= TF_MASK
| AC_MASK
| ID_MASK
|
448 IF_MASK
| IOPL_MASK
| VM_MASK
| RF_MASK
| NT_MASK
;
450 eflags_mask
&= 0xffff;
451 load_eflags(new_eflags
, eflags_mask
);
452 /* XXX: what to do in 16 bit case ? */
461 if (new_eflags
& VM_MASK
) {
462 for(i
= 0; i
< 6; i
++)
463 load_seg_vm(i
, new_segs
[i
]);
464 /* in vm86, CPL is always 3 */
465 cpu_x86_set_cpl(env
, 3);
467 /* CPL is set the RPL of CS */
468 cpu_x86_set_cpl(env
, new_segs
[R_CS
] & 3);
469 /* first just selectors as the rest may trigger exceptions */
470 for(i
= 0; i
< 6; i
++)
471 cpu_x86_load_seg_cache(env
, i
, new_segs
[i
], 0, 0, 0);
474 env
->ldt
.selector
= new_ldt
& ~4;
481 raise_exception_err(EXCP0A_TSS
, new_ldt
& 0xfffc);
483 if ((new_ldt
& 0xfffc) != 0) {
485 index
= new_ldt
& ~7;
486 if ((index
+ 7) > dt
->limit
)
487 raise_exception_err(EXCP0A_TSS
, new_ldt
& 0xfffc);
488 ptr
= dt
->base
+ index
;
489 e1
= ldl_kernel(ptr
);
490 e2
= ldl_kernel(ptr
+ 4);
491 if ((e2
& DESC_S_MASK
) || ((e2
>> DESC_TYPE_SHIFT
) & 0xf) != 2)
492 raise_exception_err(EXCP0A_TSS
, new_ldt
& 0xfffc);
493 if (!(e2
& DESC_P_MASK
))
494 raise_exception_err(EXCP0A_TSS
, new_ldt
& 0xfffc);
495 load_seg_cache_raw_dt(&env
->ldt
, e1
, e2
);
498 /* load the segments */
499 if (!(new_eflags
& VM_MASK
)) {
500 tss_load_seg(R_CS
, new_segs
[R_CS
]);
501 tss_load_seg(R_SS
, new_segs
[R_SS
]);
502 tss_load_seg(R_ES
, new_segs
[R_ES
]);
503 tss_load_seg(R_DS
, new_segs
[R_DS
]);
504 tss_load_seg(R_FS
, new_segs
[R_FS
]);
505 tss_load_seg(R_GS
, new_segs
[R_GS
]);
508 /* check that EIP is in the CS segment limits */
509 if (new_eip
> env
->segs
[R_CS
].limit
) {
510 /* XXX: different exception if CALL ? */
511 raise_exception_err(EXCP0D_GPF
, 0);
514 #ifndef CONFIG_USER_ONLY
515 /* reset local breakpoints */
516 if (env
->dr
[7] & 0x55) {
517 for (i
= 0; i
< 4; i
++) {
518 if (hw_breakpoint_enabled(env
->dr
[7], i
) == 0x1)
519 hw_breakpoint_remove(env
, i
);
526 /* check if Port I/O is allowed in TSS */
527 static inline void check_io(int addr
, int size
)
529 int io_offset
, val
, mask
;
531 /* TSS must be a valid 32 bit one */
532 if (!(env
->tr
.flags
& DESC_P_MASK
) ||
533 ((env
->tr
.flags
>> DESC_TYPE_SHIFT
) & 0xf) != 9 ||
536 io_offset
= lduw_kernel(env
->tr
.base
+ 0x66);
537 io_offset
+= (addr
>> 3);
538 /* Note: the check needs two bytes */
539 if ((io_offset
+ 1) > env
->tr
.limit
)
541 val
= lduw_kernel(env
->tr
.base
+ io_offset
);
543 mask
= (1 << size
) - 1;
544 /* all bits must be zero to allow the I/O */
545 if ((val
& mask
) != 0) {
547 raise_exception_err(EXCP0D_GPF
, 0);
551 void helper_check_iob(uint32_t t0
)
556 void helper_check_iow(uint32_t t0
)
561 void helper_check_iol(uint32_t t0
)
566 void helper_outb(uint32_t port
, uint32_t data
)
568 cpu_outb(env
, port
, data
& 0xff);
571 target_ulong
helper_inb(uint32_t port
)
573 return cpu_inb(env
, port
);
576 void helper_outw(uint32_t port
, uint32_t data
)
578 cpu_outw(env
, port
, data
& 0xffff);
581 target_ulong
helper_inw(uint32_t port
)
583 return cpu_inw(env
, port
);
586 void helper_outl(uint32_t port
, uint32_t data
)
588 cpu_outl(env
, port
, data
);
591 target_ulong
helper_inl(uint32_t port
)
593 return cpu_inl(env
, port
);
596 static inline unsigned int get_sp_mask(unsigned int e2
)
598 if (e2
& DESC_B_MASK
)
605 #define SET_ESP(val, sp_mask)\
607 if ((sp_mask) == 0xffff)\
608 ESP = (ESP & ~0xffff) | ((val) & 0xffff);\
609 else if ((sp_mask) == 0xffffffffLL)\
610 ESP = (uint32_t)(val);\
615 #define SET_ESP(val, sp_mask) ESP = (ESP & ~(sp_mask)) | ((val) & (sp_mask))
618 /* in 64-bit machines, this can overflow. So this segment addition macro
619 * can be used to trim the value to 32-bit whenever needed */
620 #define SEG_ADDL(ssp, sp, sp_mask) ((uint32_t)((ssp) + (sp & (sp_mask))))
622 /* XXX: add a is_user flag to have proper security support */
623 #define PUSHW(ssp, sp, sp_mask, val)\
626 stw_kernel((ssp) + (sp & (sp_mask)), (val));\
629 #define PUSHL(ssp, sp, sp_mask, val)\
632 stl_kernel(SEG_ADDL(ssp, sp, sp_mask), (uint32_t)(val));\
635 #define POPW(ssp, sp, sp_mask, val)\
637 val = lduw_kernel((ssp) + (sp & (sp_mask)));\
641 #define POPL(ssp, sp, sp_mask, val)\
643 val = (uint32_t)ldl_kernel(SEG_ADDL(ssp, sp, sp_mask));\
647 /* protected mode interrupt */
648 static void do_interrupt_protected(int intno
, int is_int
, int error_code
,
649 unsigned int next_eip
, int is_hw
)
652 target_ulong ptr
, ssp
;
653 int type
, dpl
, selector
, ss_dpl
, cpl
;
654 int has_error_code
, new_stack
, shift
;
655 uint32_t e1
, e2
, offset
, ss
= 0, esp
, ss_e1
= 0, ss_e2
= 0;
656 uint32_t old_eip
, sp_mask
;
659 if (!is_int
&& !is_hw
) {
678 if (intno
* 8 + 7 > dt
->limit
)
679 raise_exception_err(EXCP0D_GPF
, intno
* 8 + 2);
680 ptr
= dt
->base
+ intno
* 8;
681 e1
= ldl_kernel(ptr
);
682 e2
= ldl_kernel(ptr
+ 4);
683 /* check gate type */
684 type
= (e2
>> DESC_TYPE_SHIFT
) & 0x1f;
686 case 5: /* task gate */
687 /* must do that check here to return the correct error code */
688 if (!(e2
& DESC_P_MASK
))
689 raise_exception_err(EXCP0B_NOSEG
, intno
* 8 + 2);
690 switch_tss(intno
* 8, e1
, e2
, SWITCH_TSS_CALL
, old_eip
);
691 if (has_error_code
) {
694 /* push the error code */
695 type
= (env
->tr
.flags
>> DESC_TYPE_SHIFT
) & 0xf;
697 if (env
->segs
[R_SS
].flags
& DESC_B_MASK
)
701 esp
= (ESP
- (2 << shift
)) & mask
;
702 ssp
= env
->segs
[R_SS
].base
+ esp
;
704 stl_kernel(ssp
, error_code
);
706 stw_kernel(ssp
, error_code
);
710 case 6: /* 286 interrupt gate */
711 case 7: /* 286 trap gate */
712 case 14: /* 386 interrupt gate */
713 case 15: /* 386 trap gate */
716 raise_exception_err(EXCP0D_GPF
, intno
* 8 + 2);
719 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
720 cpl
= env
->hflags
& HF_CPL_MASK
;
721 /* check privilege if software int */
722 if (is_int
&& dpl
< cpl
)
723 raise_exception_err(EXCP0D_GPF
, intno
* 8 + 2);
724 /* check valid bit */
725 if (!(e2
& DESC_P_MASK
))
726 raise_exception_err(EXCP0B_NOSEG
, intno
* 8 + 2);
728 offset
= (e2
& 0xffff0000) | (e1
& 0x0000ffff);
729 if ((selector
& 0xfffc) == 0)
730 raise_exception_err(EXCP0D_GPF
, 0);
732 if (load_segment(&e1
, &e2
, selector
) != 0)
733 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
734 if (!(e2
& DESC_S_MASK
) || !(e2
& (DESC_CS_MASK
)))
735 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
736 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
738 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
739 if (!(e2
& DESC_P_MASK
))
740 raise_exception_err(EXCP0B_NOSEG
, selector
& 0xfffc);
741 if (!(e2
& DESC_C_MASK
) && dpl
< cpl
) {
742 /* to inner privilege */
743 get_ss_esp_from_tss(&ss
, &esp
, dpl
);
744 if ((ss
& 0xfffc) == 0)
745 raise_exception_err(EXCP0A_TSS
, ss
& 0xfffc);
747 raise_exception_err(EXCP0A_TSS
, ss
& 0xfffc);
748 if (load_segment(&ss_e1
, &ss_e2
, ss
) != 0)
749 raise_exception_err(EXCP0A_TSS
, ss
& 0xfffc);
750 ss_dpl
= (ss_e2
>> DESC_DPL_SHIFT
) & 3;
752 raise_exception_err(EXCP0A_TSS
, ss
& 0xfffc);
753 if (!(ss_e2
& DESC_S_MASK
) ||
754 (ss_e2
& DESC_CS_MASK
) ||
755 !(ss_e2
& DESC_W_MASK
))
756 raise_exception_err(EXCP0A_TSS
, ss
& 0xfffc);
757 if (!(ss_e2
& DESC_P_MASK
))
758 raise_exception_err(EXCP0A_TSS
, ss
& 0xfffc);
760 sp_mask
= get_sp_mask(ss_e2
);
761 ssp
= get_seg_base(ss_e1
, ss_e2
);
762 } else if ((e2
& DESC_C_MASK
) || dpl
== cpl
) {
763 /* to same privilege */
764 if (env
->eflags
& VM_MASK
)
765 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
767 sp_mask
= get_sp_mask(env
->segs
[R_SS
].flags
);
768 ssp
= env
->segs
[R_SS
].base
;
772 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
773 new_stack
= 0; /* avoid warning */
774 sp_mask
= 0; /* avoid warning */
775 ssp
= 0; /* avoid warning */
776 esp
= 0; /* avoid warning */
782 /* XXX: check that enough room is available */
783 push_size
= 6 + (new_stack
<< 2) + (has_error_code
<< 1);
784 if (env
->eflags
& VM_MASK
)
790 if (env
->eflags
& VM_MASK
) {
791 PUSHL(ssp
, esp
, sp_mask
, env
->segs
[R_GS
].selector
);
792 PUSHL(ssp
, esp
, sp_mask
, env
->segs
[R_FS
].selector
);
793 PUSHL(ssp
, esp
, sp_mask
, env
->segs
[R_DS
].selector
);
794 PUSHL(ssp
, esp
, sp_mask
, env
->segs
[R_ES
].selector
);
796 PUSHL(ssp
, esp
, sp_mask
, env
->segs
[R_SS
].selector
);
797 PUSHL(ssp
, esp
, sp_mask
, ESP
);
799 PUSHL(ssp
, esp
, sp_mask
, compute_eflags());
800 PUSHL(ssp
, esp
, sp_mask
, env
->segs
[R_CS
].selector
);
801 PUSHL(ssp
, esp
, sp_mask
, old_eip
);
802 if (has_error_code
) {
803 PUSHL(ssp
, esp
, sp_mask
, error_code
);
807 if (env
->eflags
& VM_MASK
) {
808 PUSHW(ssp
, esp
, sp_mask
, env
->segs
[R_GS
].selector
);
809 PUSHW(ssp
, esp
, sp_mask
, env
->segs
[R_FS
].selector
);
810 PUSHW(ssp
, esp
, sp_mask
, env
->segs
[R_DS
].selector
);
811 PUSHW(ssp
, esp
, sp_mask
, env
->segs
[R_ES
].selector
);
813 PUSHW(ssp
, esp
, sp_mask
, env
->segs
[R_SS
].selector
);
814 PUSHW(ssp
, esp
, sp_mask
, ESP
);
816 PUSHW(ssp
, esp
, sp_mask
, compute_eflags());
817 PUSHW(ssp
, esp
, sp_mask
, env
->segs
[R_CS
].selector
);
818 PUSHW(ssp
, esp
, sp_mask
, old_eip
);
819 if (has_error_code
) {
820 PUSHW(ssp
, esp
, sp_mask
, error_code
);
825 if (env
->eflags
& VM_MASK
) {
826 cpu_x86_load_seg_cache(env
, R_ES
, 0, 0, 0, 0);
827 cpu_x86_load_seg_cache(env
, R_DS
, 0, 0, 0, 0);
828 cpu_x86_load_seg_cache(env
, R_FS
, 0, 0, 0, 0);
829 cpu_x86_load_seg_cache(env
, R_GS
, 0, 0, 0, 0);
831 ss
= (ss
& ~3) | dpl
;
832 cpu_x86_load_seg_cache(env
, R_SS
, ss
,
833 ssp
, get_seg_limit(ss_e1
, ss_e2
), ss_e2
);
835 SET_ESP(esp
, sp_mask
);
837 selector
= (selector
& ~3) | dpl
;
838 cpu_x86_load_seg_cache(env
, R_CS
, selector
,
839 get_seg_base(e1
, e2
),
840 get_seg_limit(e1
, e2
),
842 cpu_x86_set_cpl(env
, dpl
);
845 /* interrupt gate clear IF mask */
846 if ((type
& 1) == 0) {
847 env
->eflags
&= ~IF_MASK
;
849 env
->eflags
&= ~(TF_MASK
| VM_MASK
| RF_MASK
| NT_MASK
);
854 #define PUSHQ(sp, val)\
857 stq_kernel(sp, (val));\
860 #define POPQ(sp, val)\
862 val = ldq_kernel(sp);\
866 static inline target_ulong
get_rsp_from_tss(int level
)
871 printf("TR: base=" TARGET_FMT_lx
" limit=%x\n",
872 env
->tr
.base
, env
->tr
.limit
);
875 if (!(env
->tr
.flags
& DESC_P_MASK
))
876 cpu_abort(env
, "invalid tss");
877 index
= 8 * level
+ 4;
878 if ((index
+ 7) > env
->tr
.limit
)
879 raise_exception_err(EXCP0A_TSS
, env
->tr
.selector
& 0xfffc);
880 return ldq_kernel(env
->tr
.base
+ index
);
883 /* 64 bit interrupt */
884 static void do_interrupt64(int intno
, int is_int
, int error_code
,
885 target_ulong next_eip
, int is_hw
)
889 int type
, dpl
, selector
, cpl
, ist
;
890 int has_error_code
, new_stack
;
891 uint32_t e1
, e2
, e3
, ss
;
892 target_ulong old_eip
, esp
, offset
;
895 if (!is_int
&& !is_hw
) {
914 if (intno
* 16 + 15 > dt
->limit
)
915 raise_exception_err(EXCP0D_GPF
, intno
* 16 + 2);
916 ptr
= dt
->base
+ intno
* 16;
917 e1
= ldl_kernel(ptr
);
918 e2
= ldl_kernel(ptr
+ 4);
919 e3
= ldl_kernel(ptr
+ 8);
920 /* check gate type */
921 type
= (e2
>> DESC_TYPE_SHIFT
) & 0x1f;
923 case 14: /* 386 interrupt gate */
924 case 15: /* 386 trap gate */
927 raise_exception_err(EXCP0D_GPF
, intno
* 16 + 2);
930 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
931 cpl
= env
->hflags
& HF_CPL_MASK
;
932 /* check privilege if software int */
933 if (is_int
&& dpl
< cpl
)
934 raise_exception_err(EXCP0D_GPF
, intno
* 16 + 2);
935 /* check valid bit */
936 if (!(e2
& DESC_P_MASK
))
937 raise_exception_err(EXCP0B_NOSEG
, intno
* 16 + 2);
939 offset
= ((target_ulong
)e3
<< 32) | (e2
& 0xffff0000) | (e1
& 0x0000ffff);
941 if ((selector
& 0xfffc) == 0)
942 raise_exception_err(EXCP0D_GPF
, 0);
944 if (load_segment(&e1
, &e2
, selector
) != 0)
945 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
946 if (!(e2
& DESC_S_MASK
) || !(e2
& (DESC_CS_MASK
)))
947 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
948 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
950 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
951 if (!(e2
& DESC_P_MASK
))
952 raise_exception_err(EXCP0B_NOSEG
, selector
& 0xfffc);
953 if (!(e2
& DESC_L_MASK
) || (e2
& DESC_B_MASK
))
954 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
955 if ((!(e2
& DESC_C_MASK
) && dpl
< cpl
) || ist
!= 0) {
956 /* to inner privilege */
958 esp
= get_rsp_from_tss(ist
+ 3);
960 esp
= get_rsp_from_tss(dpl
);
961 esp
&= ~0xfLL
; /* align stack */
964 } else if ((e2
& DESC_C_MASK
) || dpl
== cpl
) {
965 /* to same privilege */
966 if (env
->eflags
& VM_MASK
)
967 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
970 esp
= get_rsp_from_tss(ist
+ 3);
973 esp
&= ~0xfLL
; /* align stack */
976 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
977 new_stack
= 0; /* avoid warning */
978 esp
= 0; /* avoid warning */
981 PUSHQ(esp
, env
->segs
[R_SS
].selector
);
983 PUSHQ(esp
, compute_eflags());
984 PUSHQ(esp
, env
->segs
[R_CS
].selector
);
986 if (has_error_code
) {
987 PUSHQ(esp
, error_code
);
992 cpu_x86_load_seg_cache(env
, R_SS
, ss
, 0, 0, 0);
996 selector
= (selector
& ~3) | dpl
;
997 cpu_x86_load_seg_cache(env
, R_CS
, selector
,
998 get_seg_base(e1
, e2
),
999 get_seg_limit(e1
, e2
),
1001 cpu_x86_set_cpl(env
, dpl
);
1004 /* interrupt gate clear IF mask */
1005 if ((type
& 1) == 0) {
1006 env
->eflags
&= ~IF_MASK
;
1008 env
->eflags
&= ~(TF_MASK
| VM_MASK
| RF_MASK
| NT_MASK
);
1012 #ifdef TARGET_X86_64
1013 #if defined(CONFIG_USER_ONLY)
1014 void helper_syscall(int next_eip_addend
)
1016 env
->exception_index
= EXCP_SYSCALL
;
1017 env
->exception_next_eip
= env
->eip
+ next_eip_addend
;
1021 void helper_syscall(int next_eip_addend
)
1025 if (!(env
->efer
& MSR_EFER_SCE
)) {
1026 raise_exception_err(EXCP06_ILLOP
, 0);
1028 selector
= (env
->star
>> 32) & 0xffff;
1029 if (env
->hflags
& HF_LMA_MASK
) {
1032 ECX
= env
->eip
+ next_eip_addend
;
1033 env
->regs
[11] = compute_eflags();
1035 code64
= env
->hflags
& HF_CS64_MASK
;
1037 cpu_x86_set_cpl(env
, 0);
1038 cpu_x86_load_seg_cache(env
, R_CS
, selector
& 0xfffc,
1040 DESC_G_MASK
| DESC_P_MASK
|
1042 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
| DESC_L_MASK
);
1043 cpu_x86_load_seg_cache(env
, R_SS
, (selector
+ 8) & 0xfffc,
1045 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
1047 DESC_W_MASK
| DESC_A_MASK
);
1048 env
->eflags
&= ~env
->fmask
;
1049 load_eflags(env
->eflags
, 0);
1051 env
->eip
= env
->lstar
;
1053 env
->eip
= env
->cstar
;
1055 ECX
= (uint32_t)(env
->eip
+ next_eip_addend
);
1057 cpu_x86_set_cpl(env
, 0);
1058 cpu_x86_load_seg_cache(env
, R_CS
, selector
& 0xfffc,
1060 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
1062 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
);
1063 cpu_x86_load_seg_cache(env
, R_SS
, (selector
+ 8) & 0xfffc,
1065 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
1067 DESC_W_MASK
| DESC_A_MASK
);
1068 env
->eflags
&= ~(IF_MASK
| RF_MASK
| VM_MASK
);
1069 env
->eip
= (uint32_t)env
->star
;
1075 #ifdef TARGET_X86_64
1076 void helper_sysret(int dflag
)
1080 if (!(env
->efer
& MSR_EFER_SCE
)) {
1081 raise_exception_err(EXCP06_ILLOP
, 0);
1083 cpl
= env
->hflags
& HF_CPL_MASK
;
1084 if (!(env
->cr
[0] & CR0_PE_MASK
) || cpl
!= 0) {
1085 raise_exception_err(EXCP0D_GPF
, 0);
1087 selector
= (env
->star
>> 48) & 0xffff;
1088 if (env
->hflags
& HF_LMA_MASK
) {
1090 cpu_x86_load_seg_cache(env
, R_CS
, (selector
+ 16) | 3,
1092 DESC_G_MASK
| DESC_P_MASK
|
1093 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
1094 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
|
1098 cpu_x86_load_seg_cache(env
, R_CS
, selector
| 3,
1100 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
1101 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
1102 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
);
1103 env
->eip
= (uint32_t)ECX
;
1105 cpu_x86_load_seg_cache(env
, R_SS
, selector
+ 8,
1107 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
1108 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
1109 DESC_W_MASK
| DESC_A_MASK
);
1110 load_eflags((uint32_t)(env
->regs
[11]), TF_MASK
| AC_MASK
| ID_MASK
|
1111 IF_MASK
| IOPL_MASK
| VM_MASK
| RF_MASK
| NT_MASK
);
1112 cpu_x86_set_cpl(env
, 3);
1114 cpu_x86_load_seg_cache(env
, R_CS
, selector
| 3,
1116 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
1117 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
1118 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
);
1119 env
->eip
= (uint32_t)ECX
;
1120 cpu_x86_load_seg_cache(env
, R_SS
, selector
+ 8,
1122 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
1123 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
1124 DESC_W_MASK
| DESC_A_MASK
);
1125 env
->eflags
|= IF_MASK
;
1126 cpu_x86_set_cpl(env
, 3);
1129 if (kqemu_is_ok(env
)) {
1130 if (env
->hflags
& HF_LMA_MASK
)
1131 CC_OP
= CC_OP_EFLAGS
;
1132 env
->exception_index
= -1;
1139 /* real mode interrupt */
1140 static void do_interrupt_real(int intno
, int is_int
, int error_code
,
1141 unsigned int next_eip
)
1144 target_ulong ptr
, ssp
;
1146 uint32_t offset
, esp
;
1147 uint32_t old_cs
, old_eip
;
1149 /* real mode (simpler !) */
1151 if (intno
* 4 + 3 > dt
->limit
)
1152 raise_exception_err(EXCP0D_GPF
, intno
* 8 + 2);
1153 ptr
= dt
->base
+ intno
* 4;
1154 offset
= lduw_kernel(ptr
);
1155 selector
= lduw_kernel(ptr
+ 2);
1157 ssp
= env
->segs
[R_SS
].base
;
1162 old_cs
= env
->segs
[R_CS
].selector
;
1163 /* XXX: use SS segment size ? */
1164 PUSHW(ssp
, esp
, 0xffff, compute_eflags());
1165 PUSHW(ssp
, esp
, 0xffff, old_cs
);
1166 PUSHW(ssp
, esp
, 0xffff, old_eip
);
1168 /* update processor state */
1169 ESP
= (ESP
& ~0xffff) | (esp
& 0xffff);
1171 env
->segs
[R_CS
].selector
= selector
;
1172 env
->segs
[R_CS
].base
= (selector
<< 4);
1173 env
->eflags
&= ~(IF_MASK
| TF_MASK
| AC_MASK
| RF_MASK
);
1176 /* fake user mode interrupt */
1177 void do_interrupt_user(int intno
, int is_int
, int error_code
,
1178 target_ulong next_eip
)
1182 int dpl
, cpl
, shift
;
1186 if (env
->hflags
& HF_LMA_MASK
) {
1191 ptr
= dt
->base
+ (intno
<< shift
);
1192 e2
= ldl_kernel(ptr
+ 4);
1194 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
1195 cpl
= env
->hflags
& HF_CPL_MASK
;
1196 /* check privilege if software int */
1197 if (is_int
&& dpl
< cpl
)
1198 raise_exception_err(EXCP0D_GPF
, (intno
<< shift
) + 2);
1200 /* Since we emulate only user space, we cannot do more than
1201 exiting the emulation with the suitable exception and error
1208 * Begin execution of an interruption. is_int is TRUE if coming from
1209 * the int instruction. next_eip is the EIP value AFTER the interrupt
1210 * instruction. It is only relevant if is_int is TRUE.
1212 void do_interrupt(int intno
, int is_int
, int error_code
,
1213 target_ulong next_eip
, int is_hw
)
1215 if (loglevel
& CPU_LOG_INT
) {
1216 if ((env
->cr
[0] & CR0_PE_MASK
)) {
1218 fprintf(logfile
, "%6d: v=%02x e=%04x i=%d cpl=%d IP=%04x:" TARGET_FMT_lx
" pc=" TARGET_FMT_lx
" SP=%04x:" TARGET_FMT_lx
,
1219 count
, intno
, error_code
, is_int
,
1220 env
->hflags
& HF_CPL_MASK
,
1221 env
->segs
[R_CS
].selector
, EIP
,
1222 (int)env
->segs
[R_CS
].base
+ EIP
,
1223 env
->segs
[R_SS
].selector
, ESP
);
1224 if (intno
== 0x0e) {
1225 fprintf(logfile
, " CR2=" TARGET_FMT_lx
, env
->cr
[2]);
1227 fprintf(logfile
, " EAX=" TARGET_FMT_lx
, EAX
);
1229 fprintf(logfile
, "\n");
1230 cpu_dump_state(env
, logfile
, fprintf
, X86_DUMP_CCOP
);
1235 fprintf(logfile
, " code=");
1236 ptr
= env
->segs
[R_CS
].base
+ env
->eip
;
1237 for(i
= 0; i
< 16; i
++) {
1238 fprintf(logfile
, " %02x", ldub(ptr
+ i
));
1240 fprintf(logfile
, "\n");
1246 if (env
->cr
[0] & CR0_PE_MASK
) {
1247 #ifdef TARGET_X86_64
1248 if (env
->hflags
& HF_LMA_MASK
) {
1249 do_interrupt64(intno
, is_int
, error_code
, next_eip
, is_hw
);
1253 do_interrupt_protected(intno
, is_int
, error_code
, next_eip
, is_hw
);
1256 do_interrupt_real(intno
, is_int
, error_code
, next_eip
);
1261 * Check nested exceptions and change to double or triple fault if
1262 * needed. It should only be called, if this is not an interrupt.
1263 * Returns the new exception number.
1265 static int check_exception(int intno
, int *error_code
)
1267 int first_contributory
= env
->old_exception
== 0 ||
1268 (env
->old_exception
>= 10 &&
1269 env
->old_exception
<= 13);
1270 int second_contributory
= intno
== 0 ||
1271 (intno
>= 10 && intno
<= 13);
1273 if (loglevel
& CPU_LOG_INT
)
1274 fprintf(logfile
, "check_exception old: 0x%x new 0x%x\n",
1275 env
->old_exception
, intno
);
1277 if (env
->old_exception
== EXCP08_DBLE
)
1278 cpu_abort(env
, "triple fault");
1280 if ((first_contributory
&& second_contributory
)
1281 || (env
->old_exception
== EXCP0E_PAGE
&&
1282 (second_contributory
|| (intno
== EXCP0E_PAGE
)))) {
1283 intno
= EXCP08_DBLE
;
1287 if (second_contributory
|| (intno
== EXCP0E_PAGE
) ||
1288 (intno
== EXCP08_DBLE
))
1289 env
->old_exception
= intno
;
1295 * Signal an interruption. It is executed in the main CPU loop.
1296 * is_int is TRUE if coming from the int instruction. next_eip is the
1297 * EIP value AFTER the interrupt instruction. It is only relevant if
1300 static void noreturn
raise_interrupt(int intno
, int is_int
, int error_code
,
1301 int next_eip_addend
)
1304 helper_svm_check_intercept_param(SVM_EXIT_EXCP_BASE
+ intno
, error_code
);
1305 intno
= check_exception(intno
, &error_code
);
1307 helper_svm_check_intercept_param(SVM_EXIT_SWINT
, 0);
1310 env
->exception_index
= intno
;
1311 env
->error_code
= error_code
;
1312 env
->exception_is_int
= is_int
;
1313 env
->exception_next_eip
= env
->eip
+ next_eip_addend
;
1317 /* shortcuts to generate exceptions */
1319 void raise_exception_err(int exception_index
, int error_code
)
1321 raise_interrupt(exception_index
, 0, error_code
, 0);
1324 void raise_exception(int exception_index
)
1326 raise_interrupt(exception_index
, 0, 0, 0);
1331 #if defined(CONFIG_USER_ONLY)
1333 void do_smm_enter(void)
1337 void helper_rsm(void)
1343 #ifdef TARGET_X86_64
1344 #define SMM_REVISION_ID 0x00020064
1346 #define SMM_REVISION_ID 0x00020000
1349 void do_smm_enter(void)
1351 target_ulong sm_state
;
1355 if (loglevel
& CPU_LOG_INT
) {
1356 fprintf(logfile
, "SMM: enter\n");
1357 cpu_dump_state(env
, logfile
, fprintf
, X86_DUMP_CCOP
);
1360 env
->hflags
|= HF_SMM_MASK
;
1361 cpu_smm_update(env
);
1363 sm_state
= env
->smbase
+ 0x8000;
1365 #ifdef TARGET_X86_64
1366 for(i
= 0; i
< 6; i
++) {
1368 offset
= 0x7e00 + i
* 16;
1369 stw_phys(sm_state
+ offset
, dt
->selector
);
1370 stw_phys(sm_state
+ offset
+ 2, (dt
->flags
>> 8) & 0xf0ff);
1371 stl_phys(sm_state
+ offset
+ 4, dt
->limit
);
1372 stq_phys(sm_state
+ offset
+ 8, dt
->base
);
1375 stq_phys(sm_state
+ 0x7e68, env
->gdt
.base
);
1376 stl_phys(sm_state
+ 0x7e64, env
->gdt
.limit
);
1378 stw_phys(sm_state
+ 0x7e70, env
->ldt
.selector
);
1379 stq_phys(sm_state
+ 0x7e78, env
->ldt
.base
);
1380 stl_phys(sm_state
+ 0x7e74, env
->ldt
.limit
);
1381 stw_phys(sm_state
+ 0x7e72, (env
->ldt
.flags
>> 8) & 0xf0ff);
1383 stq_phys(sm_state
+ 0x7e88, env
->idt
.base
);
1384 stl_phys(sm_state
+ 0x7e84, env
->idt
.limit
);
1386 stw_phys(sm_state
+ 0x7e90, env
->tr
.selector
);
1387 stq_phys(sm_state
+ 0x7e98, env
->tr
.base
);
1388 stl_phys(sm_state
+ 0x7e94, env
->tr
.limit
);
1389 stw_phys(sm_state
+ 0x7e92, (env
->tr
.flags
>> 8) & 0xf0ff);
1391 stq_phys(sm_state
+ 0x7ed0, env
->efer
);
1393 stq_phys(sm_state
+ 0x7ff8, EAX
);
1394 stq_phys(sm_state
+ 0x7ff0, ECX
);
1395 stq_phys(sm_state
+ 0x7fe8, EDX
);
1396 stq_phys(sm_state
+ 0x7fe0, EBX
);
1397 stq_phys(sm_state
+ 0x7fd8, ESP
);
1398 stq_phys(sm_state
+ 0x7fd0, EBP
);
1399 stq_phys(sm_state
+ 0x7fc8, ESI
);
1400 stq_phys(sm_state
+ 0x7fc0, EDI
);
1401 for(i
= 8; i
< 16; i
++)
1402 stq_phys(sm_state
+ 0x7ff8 - i
* 8, env
->regs
[i
]);
1403 stq_phys(sm_state
+ 0x7f78, env
->eip
);
1404 stl_phys(sm_state
+ 0x7f70, compute_eflags());
1405 stl_phys(sm_state
+ 0x7f68, env
->dr
[6]);
1406 stl_phys(sm_state
+ 0x7f60, env
->dr
[7]);
1408 stl_phys(sm_state
+ 0x7f48, env
->cr
[4]);
1409 stl_phys(sm_state
+ 0x7f50, env
->cr
[3]);
1410 stl_phys(sm_state
+ 0x7f58, env
->cr
[0]);
1412 stl_phys(sm_state
+ 0x7efc, SMM_REVISION_ID
);
1413 stl_phys(sm_state
+ 0x7f00, env
->smbase
);
1415 stl_phys(sm_state
+ 0x7ffc, env
->cr
[0]);
1416 stl_phys(sm_state
+ 0x7ff8, env
->cr
[3]);
1417 stl_phys(sm_state
+ 0x7ff4, compute_eflags());
1418 stl_phys(sm_state
+ 0x7ff0, env
->eip
);
1419 stl_phys(sm_state
+ 0x7fec, EDI
);
1420 stl_phys(sm_state
+ 0x7fe8, ESI
);
1421 stl_phys(sm_state
+ 0x7fe4, EBP
);
1422 stl_phys(sm_state
+ 0x7fe0, ESP
);
1423 stl_phys(sm_state
+ 0x7fdc, EBX
);
1424 stl_phys(sm_state
+ 0x7fd8, EDX
);
1425 stl_phys(sm_state
+ 0x7fd4, ECX
);
1426 stl_phys(sm_state
+ 0x7fd0, EAX
);
1427 stl_phys(sm_state
+ 0x7fcc, env
->dr
[6]);
1428 stl_phys(sm_state
+ 0x7fc8, env
->dr
[7]);
1430 stl_phys(sm_state
+ 0x7fc4, env
->tr
.selector
);
1431 stl_phys(sm_state
+ 0x7f64, env
->tr
.base
);
1432 stl_phys(sm_state
+ 0x7f60, env
->tr
.limit
);
1433 stl_phys(sm_state
+ 0x7f5c, (env
->tr
.flags
>> 8) & 0xf0ff);
1435 stl_phys(sm_state
+ 0x7fc0, env
->ldt
.selector
);
1436 stl_phys(sm_state
+ 0x7f80, env
->ldt
.base
);
1437 stl_phys(sm_state
+ 0x7f7c, env
->ldt
.limit
);
1438 stl_phys(sm_state
+ 0x7f78, (env
->ldt
.flags
>> 8) & 0xf0ff);
1440 stl_phys(sm_state
+ 0x7f74, env
->gdt
.base
);
1441 stl_phys(sm_state
+ 0x7f70, env
->gdt
.limit
);
1443 stl_phys(sm_state
+ 0x7f58, env
->idt
.base
);
1444 stl_phys(sm_state
+ 0x7f54, env
->idt
.limit
);
1446 for(i
= 0; i
< 6; i
++) {
1449 offset
= 0x7f84 + i
* 12;
1451 offset
= 0x7f2c + (i
- 3) * 12;
1452 stl_phys(sm_state
+ 0x7fa8 + i
* 4, dt
->selector
);
1453 stl_phys(sm_state
+ offset
+ 8, dt
->base
);
1454 stl_phys(sm_state
+ offset
+ 4, dt
->limit
);
1455 stl_phys(sm_state
+ offset
, (dt
->flags
>> 8) & 0xf0ff);
1457 stl_phys(sm_state
+ 0x7f14, env
->cr
[4]);
1459 stl_phys(sm_state
+ 0x7efc, SMM_REVISION_ID
);
1460 stl_phys(sm_state
+ 0x7ef8, env
->smbase
);
1462 /* init SMM cpu state */
1464 #ifdef TARGET_X86_64
1465 cpu_load_efer(env
, 0);
1467 load_eflags(0, ~(CC_O
| CC_S
| CC_Z
| CC_A
| CC_P
| CC_C
| DF_MASK
));
1468 env
->eip
= 0x00008000;
1469 cpu_x86_load_seg_cache(env
, R_CS
, (env
->smbase
>> 4) & 0xffff, env
->smbase
,
1471 cpu_x86_load_seg_cache(env
, R_DS
, 0, 0, 0xffffffff, 0);
1472 cpu_x86_load_seg_cache(env
, R_ES
, 0, 0, 0xffffffff, 0);
1473 cpu_x86_load_seg_cache(env
, R_SS
, 0, 0, 0xffffffff, 0);
1474 cpu_x86_load_seg_cache(env
, R_FS
, 0, 0, 0xffffffff, 0);
1475 cpu_x86_load_seg_cache(env
, R_GS
, 0, 0, 0xffffffff, 0);
1477 cpu_x86_update_cr0(env
,
1478 env
->cr
[0] & ~(CR0_PE_MASK
| CR0_EM_MASK
| CR0_TS_MASK
| CR0_PG_MASK
));
1479 cpu_x86_update_cr4(env
, 0);
1480 env
->dr
[7] = 0x00000400;
1481 CC_OP
= CC_OP_EFLAGS
;
1484 void helper_rsm(void)
1486 target_ulong sm_state
;
1490 sm_state
= env
->smbase
+ 0x8000;
1491 #ifdef TARGET_X86_64
1492 cpu_load_efer(env
, ldq_phys(sm_state
+ 0x7ed0));
1494 for(i
= 0; i
< 6; i
++) {
1495 offset
= 0x7e00 + i
* 16;
1496 cpu_x86_load_seg_cache(env
, i
,
1497 lduw_phys(sm_state
+ offset
),
1498 ldq_phys(sm_state
+ offset
+ 8),
1499 ldl_phys(sm_state
+ offset
+ 4),
1500 (lduw_phys(sm_state
+ offset
+ 2) & 0xf0ff) << 8);
1503 env
->gdt
.base
= ldq_phys(sm_state
+ 0x7e68);
1504 env
->gdt
.limit
= ldl_phys(sm_state
+ 0x7e64);
1506 env
->ldt
.selector
= lduw_phys(sm_state
+ 0x7e70);
1507 env
->ldt
.base
= ldq_phys(sm_state
+ 0x7e78);
1508 env
->ldt
.limit
= ldl_phys(sm_state
+ 0x7e74);
1509 env
->ldt
.flags
= (lduw_phys(sm_state
+ 0x7e72) & 0xf0ff) << 8;
1511 env
->idt
.base
= ldq_phys(sm_state
+ 0x7e88);
1512 env
->idt
.limit
= ldl_phys(sm_state
+ 0x7e84);
1514 env
->tr
.selector
= lduw_phys(sm_state
+ 0x7e90);
1515 env
->tr
.base
= ldq_phys(sm_state
+ 0x7e98);
1516 env
->tr
.limit
= ldl_phys(sm_state
+ 0x7e94);
1517 env
->tr
.flags
= (lduw_phys(sm_state
+ 0x7e92) & 0xf0ff) << 8;
1519 EAX
= ldq_phys(sm_state
+ 0x7ff8);
1520 ECX
= ldq_phys(sm_state
+ 0x7ff0);
1521 EDX
= ldq_phys(sm_state
+ 0x7fe8);
1522 EBX
= ldq_phys(sm_state
+ 0x7fe0);
1523 ESP
= ldq_phys(sm_state
+ 0x7fd8);
1524 EBP
= ldq_phys(sm_state
+ 0x7fd0);
1525 ESI
= ldq_phys(sm_state
+ 0x7fc8);
1526 EDI
= ldq_phys(sm_state
+ 0x7fc0);
1527 for(i
= 8; i
< 16; i
++)
1528 env
->regs
[i
] = ldq_phys(sm_state
+ 0x7ff8 - i
* 8);
1529 env
->eip
= ldq_phys(sm_state
+ 0x7f78);
1530 load_eflags(ldl_phys(sm_state
+ 0x7f70),
1531 ~(CC_O
| CC_S
| CC_Z
| CC_A
| CC_P
| CC_C
| DF_MASK
));
1532 env
->dr
[6] = ldl_phys(sm_state
+ 0x7f68);
1533 env
->dr
[7] = ldl_phys(sm_state
+ 0x7f60);
1535 cpu_x86_update_cr4(env
, ldl_phys(sm_state
+ 0x7f48));
1536 cpu_x86_update_cr3(env
, ldl_phys(sm_state
+ 0x7f50));
1537 cpu_x86_update_cr0(env
, ldl_phys(sm_state
+ 0x7f58));
1539 val
= ldl_phys(sm_state
+ 0x7efc); /* revision ID */
1540 if (val
& 0x20000) {
1541 env
->smbase
= ldl_phys(sm_state
+ 0x7f00) & ~0x7fff;
1544 cpu_x86_update_cr0(env
, ldl_phys(sm_state
+ 0x7ffc));
1545 cpu_x86_update_cr3(env
, ldl_phys(sm_state
+ 0x7ff8));
1546 load_eflags(ldl_phys(sm_state
+ 0x7ff4),
1547 ~(CC_O
| CC_S
| CC_Z
| CC_A
| CC_P
| CC_C
| DF_MASK
));
1548 env
->eip
= ldl_phys(sm_state
+ 0x7ff0);
1549 EDI
= ldl_phys(sm_state
+ 0x7fec);
1550 ESI
= ldl_phys(sm_state
+ 0x7fe8);
1551 EBP
= ldl_phys(sm_state
+ 0x7fe4);
1552 ESP
= ldl_phys(sm_state
+ 0x7fe0);
1553 EBX
= ldl_phys(sm_state
+ 0x7fdc);
1554 EDX
= ldl_phys(sm_state
+ 0x7fd8);
1555 ECX
= ldl_phys(sm_state
+ 0x7fd4);
1556 EAX
= ldl_phys(sm_state
+ 0x7fd0);
1557 env
->dr
[6] = ldl_phys(sm_state
+ 0x7fcc);
1558 env
->dr
[7] = ldl_phys(sm_state
+ 0x7fc8);
1560 env
->tr
.selector
= ldl_phys(sm_state
+ 0x7fc4) & 0xffff;
1561 env
->tr
.base
= ldl_phys(sm_state
+ 0x7f64);
1562 env
->tr
.limit
= ldl_phys(sm_state
+ 0x7f60);
1563 env
->tr
.flags
= (ldl_phys(sm_state
+ 0x7f5c) & 0xf0ff) << 8;
1565 env
->ldt
.selector
= ldl_phys(sm_state
+ 0x7fc0) & 0xffff;
1566 env
->ldt
.base
= ldl_phys(sm_state
+ 0x7f80);
1567 env
->ldt
.limit
= ldl_phys(sm_state
+ 0x7f7c);
1568 env
->ldt
.flags
= (ldl_phys(sm_state
+ 0x7f78) & 0xf0ff) << 8;
1570 env
->gdt
.base
= ldl_phys(sm_state
+ 0x7f74);
1571 env
->gdt
.limit
= ldl_phys(sm_state
+ 0x7f70);
1573 env
->idt
.base
= ldl_phys(sm_state
+ 0x7f58);
1574 env
->idt
.limit
= ldl_phys(sm_state
+ 0x7f54);
1576 for(i
= 0; i
< 6; i
++) {
1578 offset
= 0x7f84 + i
* 12;
1580 offset
= 0x7f2c + (i
- 3) * 12;
1581 cpu_x86_load_seg_cache(env
, i
,
1582 ldl_phys(sm_state
+ 0x7fa8 + i
* 4) & 0xffff,
1583 ldl_phys(sm_state
+ offset
+ 8),
1584 ldl_phys(sm_state
+ offset
+ 4),
1585 (ldl_phys(sm_state
+ offset
) & 0xf0ff) << 8);
1587 cpu_x86_update_cr4(env
, ldl_phys(sm_state
+ 0x7f14));
1589 val
= ldl_phys(sm_state
+ 0x7efc); /* revision ID */
1590 if (val
& 0x20000) {
1591 env
->smbase
= ldl_phys(sm_state
+ 0x7ef8) & ~0x7fff;
1594 CC_OP
= CC_OP_EFLAGS
;
1595 env
->hflags
&= ~HF_SMM_MASK
;
1596 cpu_smm_update(env
);
1598 if (loglevel
& CPU_LOG_INT
) {
1599 fprintf(logfile
, "SMM: after RSM\n");
1600 cpu_dump_state(env
, logfile
, fprintf
, X86_DUMP_CCOP
);
1604 #endif /* !CONFIG_USER_ONLY */
1607 /* division, flags are undefined */
1609 void helper_divb_AL(target_ulong t0
)
1611 unsigned int num
, den
, q
, r
;
1613 num
= (EAX
& 0xffff);
1616 raise_exception(EXCP00_DIVZ
);
1620 raise_exception(EXCP00_DIVZ
);
1622 r
= (num
% den
) & 0xff;
1623 EAX
= (EAX
& ~0xffff) | (r
<< 8) | q
;
1626 void helper_idivb_AL(target_ulong t0
)
1633 raise_exception(EXCP00_DIVZ
);
1637 raise_exception(EXCP00_DIVZ
);
1639 r
= (num
% den
) & 0xff;
1640 EAX
= (EAX
& ~0xffff) | (r
<< 8) | q
;
1643 void helper_divw_AX(target_ulong t0
)
1645 unsigned int num
, den
, q
, r
;
1647 num
= (EAX
& 0xffff) | ((EDX
& 0xffff) << 16);
1648 den
= (t0
& 0xffff);
1650 raise_exception(EXCP00_DIVZ
);
1654 raise_exception(EXCP00_DIVZ
);
1656 r
= (num
% den
) & 0xffff;
1657 EAX
= (EAX
& ~0xffff) | q
;
1658 EDX
= (EDX
& ~0xffff) | r
;
1661 void helper_idivw_AX(target_ulong t0
)
1665 num
= (EAX
& 0xffff) | ((EDX
& 0xffff) << 16);
1668 raise_exception(EXCP00_DIVZ
);
1671 if (q
!= (int16_t)q
)
1672 raise_exception(EXCP00_DIVZ
);
1674 r
= (num
% den
) & 0xffff;
1675 EAX
= (EAX
& ~0xffff) | q
;
1676 EDX
= (EDX
& ~0xffff) | r
;
1679 void helper_divl_EAX(target_ulong t0
)
1681 unsigned int den
, r
;
1684 num
= ((uint32_t)EAX
) | ((uint64_t)((uint32_t)EDX
) << 32);
1687 raise_exception(EXCP00_DIVZ
);
1692 raise_exception(EXCP00_DIVZ
);
1697 void helper_idivl_EAX(target_ulong t0
)
1702 num
= ((uint32_t)EAX
) | ((uint64_t)((uint32_t)EDX
) << 32);
1705 raise_exception(EXCP00_DIVZ
);
1709 if (q
!= (int32_t)q
)
1710 raise_exception(EXCP00_DIVZ
);
1717 /* XXX: exception */
1718 void helper_aam(int base
)
1724 EAX
= (EAX
& ~0xffff) | al
| (ah
<< 8);
1728 void helper_aad(int base
)
1732 ah
= (EAX
>> 8) & 0xff;
1733 al
= ((ah
* base
) + al
) & 0xff;
1734 EAX
= (EAX
& ~0xffff) | al
;
1738 void helper_aaa(void)
1744 eflags
= helper_cc_compute_all(CC_OP
);
1747 ah
= (EAX
>> 8) & 0xff;
1749 icarry
= (al
> 0xf9);
1750 if (((al
& 0x0f) > 9 ) || af
) {
1751 al
= (al
+ 6) & 0x0f;
1752 ah
= (ah
+ 1 + icarry
) & 0xff;
1753 eflags
|= CC_C
| CC_A
;
1755 eflags
&= ~(CC_C
| CC_A
);
1758 EAX
= (EAX
& ~0xffff) | al
| (ah
<< 8);
1762 void helper_aas(void)
1768 eflags
= helper_cc_compute_all(CC_OP
);
1771 ah
= (EAX
>> 8) & 0xff;
1774 if (((al
& 0x0f) > 9 ) || af
) {
1775 al
= (al
- 6) & 0x0f;
1776 ah
= (ah
- 1 - icarry
) & 0xff;
1777 eflags
|= CC_C
| CC_A
;
1779 eflags
&= ~(CC_C
| CC_A
);
1782 EAX
= (EAX
& ~0xffff) | al
| (ah
<< 8);
1786 void helper_daa(void)
1791 eflags
= helper_cc_compute_all(CC_OP
);
1797 if (((al
& 0x0f) > 9 ) || af
) {
1798 al
= (al
+ 6) & 0xff;
1801 if ((al
> 0x9f) || cf
) {
1802 al
= (al
+ 0x60) & 0xff;
1805 EAX
= (EAX
& ~0xff) | al
;
1806 /* well, speed is not an issue here, so we compute the flags by hand */
1807 eflags
|= (al
== 0) << 6; /* zf */
1808 eflags
|= parity_table
[al
]; /* pf */
1809 eflags
|= (al
& 0x80); /* sf */
1813 void helper_das(void)
1815 int al
, al1
, af
, cf
;
1818 eflags
= helper_cc_compute_all(CC_OP
);
1825 if (((al
& 0x0f) > 9 ) || af
) {
1829 al
= (al
- 6) & 0xff;
1831 if ((al1
> 0x99) || cf
) {
1832 al
= (al
- 0x60) & 0xff;
1835 EAX
= (EAX
& ~0xff) | al
;
1836 /* well, speed is not an issue here, so we compute the flags by hand */
1837 eflags
|= (al
== 0) << 6; /* zf */
1838 eflags
|= parity_table
[al
]; /* pf */
1839 eflags
|= (al
& 0x80); /* sf */
1843 void helper_into(int next_eip_addend
)
1846 eflags
= helper_cc_compute_all(CC_OP
);
1847 if (eflags
& CC_O
) {
1848 raise_interrupt(EXCP04_INTO
, 1, 0, next_eip_addend
);
1852 void helper_cmpxchg8b(target_ulong a0
)
1857 eflags
= helper_cc_compute_all(CC_OP
);
1859 if (d
== (((uint64_t)EDX
<< 32) | (uint32_t)EAX
)) {
1860 stq(a0
, ((uint64_t)ECX
<< 32) | (uint32_t)EBX
);
1863 /* always do the store */
1865 EDX
= (uint32_t)(d
>> 32);
1872 #ifdef TARGET_X86_64
1873 void helper_cmpxchg16b(target_ulong a0
)
1878 if ((a0
& 0xf) != 0)
1879 raise_exception(EXCP0D_GPF
);
1880 eflags
= helper_cc_compute_all(CC_OP
);
1883 if (d0
== EAX
&& d1
== EDX
) {
1888 /* always do the store */
1899 void helper_single_step(void)
1901 #ifndef CONFIG_USER_ONLY
1902 check_hw_breakpoints(env
, 1);
1903 env
->dr
[6] |= DR6_BS
;
1905 raise_exception(EXCP01_DB
);
1908 void helper_cpuid(void)
1910 uint32_t eax
, ebx
, ecx
, edx
;
1912 helper_svm_check_intercept_param(SVM_EXIT_CPUID
, 0);
1914 cpu_x86_cpuid(env
, (uint32_t)EAX
, &eax
, &ebx
, &ecx
, &edx
);
1921 void helper_enter_level(int level
, int data32
, target_ulong t1
)
1924 uint32_t esp_mask
, esp
, ebp
;
1926 esp_mask
= get_sp_mask(env
->segs
[R_SS
].flags
);
1927 ssp
= env
->segs
[R_SS
].base
;
1936 stl(ssp
+ (esp
& esp_mask
), ldl(ssp
+ (ebp
& esp_mask
)));
1939 stl(ssp
+ (esp
& esp_mask
), t1
);
1946 stw(ssp
+ (esp
& esp_mask
), lduw(ssp
+ (ebp
& esp_mask
)));
1949 stw(ssp
+ (esp
& esp_mask
), t1
);
1953 #ifdef TARGET_X86_64
1954 void helper_enter64_level(int level
, int data64
, target_ulong t1
)
1956 target_ulong esp
, ebp
;
1976 stw(esp
, lduw(ebp
));
1984 void helper_lldt(int selector
)
1988 int index
, entry_limit
;
1992 if ((selector
& 0xfffc) == 0) {
1993 /* XXX: NULL selector case: invalid LDT */
1998 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2000 index
= selector
& ~7;
2001 #ifdef TARGET_X86_64
2002 if (env
->hflags
& HF_LMA_MASK
)
2007 if ((index
+ entry_limit
) > dt
->limit
)
2008 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2009 ptr
= dt
->base
+ index
;
2010 e1
= ldl_kernel(ptr
);
2011 e2
= ldl_kernel(ptr
+ 4);
2012 if ((e2
& DESC_S_MASK
) || ((e2
>> DESC_TYPE_SHIFT
) & 0xf) != 2)
2013 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2014 if (!(e2
& DESC_P_MASK
))
2015 raise_exception_err(EXCP0B_NOSEG
, selector
& 0xfffc);
2016 #ifdef TARGET_X86_64
2017 if (env
->hflags
& HF_LMA_MASK
) {
2019 e3
= ldl_kernel(ptr
+ 8);
2020 load_seg_cache_raw_dt(&env
->ldt
, e1
, e2
);
2021 env
->ldt
.base
|= (target_ulong
)e3
<< 32;
2025 load_seg_cache_raw_dt(&env
->ldt
, e1
, e2
);
2028 env
->ldt
.selector
= selector
;
2031 void helper_ltr(int selector
)
2035 int index
, type
, entry_limit
;
2039 if ((selector
& 0xfffc) == 0) {
2040 /* NULL selector case: invalid TR */
2046 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2048 index
= selector
& ~7;
2049 #ifdef TARGET_X86_64
2050 if (env
->hflags
& HF_LMA_MASK
)
2055 if ((index
+ entry_limit
) > dt
->limit
)
2056 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2057 ptr
= dt
->base
+ index
;
2058 e1
= ldl_kernel(ptr
);
2059 e2
= ldl_kernel(ptr
+ 4);
2060 type
= (e2
>> DESC_TYPE_SHIFT
) & 0xf;
2061 if ((e2
& DESC_S_MASK
) ||
2062 (type
!= 1 && type
!= 9))
2063 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2064 if (!(e2
& DESC_P_MASK
))
2065 raise_exception_err(EXCP0B_NOSEG
, selector
& 0xfffc);
2066 #ifdef TARGET_X86_64
2067 if (env
->hflags
& HF_LMA_MASK
) {
2069 e3
= ldl_kernel(ptr
+ 8);
2070 e4
= ldl_kernel(ptr
+ 12);
2071 if ((e4
>> DESC_TYPE_SHIFT
) & 0xf)
2072 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2073 load_seg_cache_raw_dt(&env
->tr
, e1
, e2
);
2074 env
->tr
.base
|= (target_ulong
)e3
<< 32;
2078 load_seg_cache_raw_dt(&env
->tr
, e1
, e2
);
2080 e2
|= DESC_TSS_BUSY_MASK
;
2081 stl_kernel(ptr
+ 4, e2
);
2083 env
->tr
.selector
= selector
;
2086 /* only works if protected mode and not VM86. seg_reg must be != R_CS */
2087 void helper_load_seg(int seg_reg
, int selector
)
2096 cpl
= env
->hflags
& HF_CPL_MASK
;
2097 if ((selector
& 0xfffc) == 0) {
2098 /* null selector case */
2100 #ifdef TARGET_X86_64
2101 && (!(env
->hflags
& HF_CS64_MASK
) || cpl
== 3)
2104 raise_exception_err(EXCP0D_GPF
, 0);
2105 cpu_x86_load_seg_cache(env
, seg_reg
, selector
, 0, 0, 0);
2112 index
= selector
& ~7;
2113 if ((index
+ 7) > dt
->limit
)
2114 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2115 ptr
= dt
->base
+ index
;
2116 e1
= ldl_kernel(ptr
);
2117 e2
= ldl_kernel(ptr
+ 4);
2119 if (!(e2
& DESC_S_MASK
))
2120 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2122 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
2123 if (seg_reg
== R_SS
) {
2124 /* must be writable segment */
2125 if ((e2
& DESC_CS_MASK
) || !(e2
& DESC_W_MASK
))
2126 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2127 if (rpl
!= cpl
|| dpl
!= cpl
)
2128 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2130 /* must be readable segment */
2131 if ((e2
& (DESC_CS_MASK
| DESC_R_MASK
)) == DESC_CS_MASK
)
2132 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2134 if (!(e2
& DESC_CS_MASK
) || !(e2
& DESC_C_MASK
)) {
2135 /* if not conforming code, test rights */
2136 if (dpl
< cpl
|| dpl
< rpl
)
2137 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2141 if (!(e2
& DESC_P_MASK
)) {
2142 if (seg_reg
== R_SS
)
2143 raise_exception_err(EXCP0C_STACK
, selector
& 0xfffc);
2145 raise_exception_err(EXCP0B_NOSEG
, selector
& 0xfffc);
2148 /* set the access bit if not already set */
2149 if (!(e2
& DESC_A_MASK
)) {
2151 stl_kernel(ptr
+ 4, e2
);
2154 cpu_x86_load_seg_cache(env
, seg_reg
, selector
,
2155 get_seg_base(e1
, e2
),
2156 get_seg_limit(e1
, e2
),
2159 fprintf(logfile
, "load_seg: sel=0x%04x base=0x%08lx limit=0x%08lx flags=%08x\n",
2160 selector
, (unsigned long)sc
->base
, sc
->limit
, sc
->flags
);
2165 /* protected mode jump */
2166 void helper_ljmp_protected(int new_cs
, target_ulong new_eip
,
2167 int next_eip_addend
)
2170 uint32_t e1
, e2
, cpl
, dpl
, rpl
, limit
;
2171 target_ulong next_eip
;
2173 if ((new_cs
& 0xfffc) == 0)
2174 raise_exception_err(EXCP0D_GPF
, 0);
2175 if (load_segment(&e1
, &e2
, new_cs
) != 0)
2176 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2177 cpl
= env
->hflags
& HF_CPL_MASK
;
2178 if (e2
& DESC_S_MASK
) {
2179 if (!(e2
& DESC_CS_MASK
))
2180 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2181 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
2182 if (e2
& DESC_C_MASK
) {
2183 /* conforming code segment */
2185 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2187 /* non conforming code segment */
2190 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2192 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2194 if (!(e2
& DESC_P_MASK
))
2195 raise_exception_err(EXCP0B_NOSEG
, new_cs
& 0xfffc);
2196 limit
= get_seg_limit(e1
, e2
);
2197 if (new_eip
> limit
&&
2198 !(env
->hflags
& HF_LMA_MASK
) && !(e2
& DESC_L_MASK
))
2199 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2200 cpu_x86_load_seg_cache(env
, R_CS
, (new_cs
& 0xfffc) | cpl
,
2201 get_seg_base(e1
, e2
), limit
, e2
);
2204 /* jump to call or task gate */
2205 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
2207 cpl
= env
->hflags
& HF_CPL_MASK
;
2208 type
= (e2
>> DESC_TYPE_SHIFT
) & 0xf;
2210 case 1: /* 286 TSS */
2211 case 9: /* 386 TSS */
2212 case 5: /* task gate */
2213 if (dpl
< cpl
|| dpl
< rpl
)
2214 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2215 next_eip
= env
->eip
+ next_eip_addend
;
2216 switch_tss(new_cs
, e1
, e2
, SWITCH_TSS_JMP
, next_eip
);
2217 CC_OP
= CC_OP_EFLAGS
;
2219 case 4: /* 286 call gate */
2220 case 12: /* 386 call gate */
2221 if ((dpl
< cpl
) || (dpl
< rpl
))
2222 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2223 if (!(e2
& DESC_P_MASK
))
2224 raise_exception_err(EXCP0B_NOSEG
, new_cs
& 0xfffc);
2226 new_eip
= (e1
& 0xffff);
2228 new_eip
|= (e2
& 0xffff0000);
2229 if (load_segment(&e1
, &e2
, gate_cs
) != 0)
2230 raise_exception_err(EXCP0D_GPF
, gate_cs
& 0xfffc);
2231 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
2232 /* must be code segment */
2233 if (((e2
& (DESC_S_MASK
| DESC_CS_MASK
)) !=
2234 (DESC_S_MASK
| DESC_CS_MASK
)))
2235 raise_exception_err(EXCP0D_GPF
, gate_cs
& 0xfffc);
2236 if (((e2
& DESC_C_MASK
) && (dpl
> cpl
)) ||
2237 (!(e2
& DESC_C_MASK
) && (dpl
!= cpl
)))
2238 raise_exception_err(EXCP0D_GPF
, gate_cs
& 0xfffc);
2239 if (!(e2
& DESC_P_MASK
))
2240 raise_exception_err(EXCP0D_GPF
, gate_cs
& 0xfffc);
2241 limit
= get_seg_limit(e1
, e2
);
2242 if (new_eip
> limit
)
2243 raise_exception_err(EXCP0D_GPF
, 0);
2244 cpu_x86_load_seg_cache(env
, R_CS
, (gate_cs
& 0xfffc) | cpl
,
2245 get_seg_base(e1
, e2
), limit
, e2
);
2249 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2255 /* real mode call */
2256 void helper_lcall_real(int new_cs
, target_ulong new_eip1
,
2257 int shift
, int next_eip
)
2260 uint32_t esp
, esp_mask
;
2265 esp_mask
= get_sp_mask(env
->segs
[R_SS
].flags
);
2266 ssp
= env
->segs
[R_SS
].base
;
2268 PUSHL(ssp
, esp
, esp_mask
, env
->segs
[R_CS
].selector
);
2269 PUSHL(ssp
, esp
, esp_mask
, next_eip
);
2271 PUSHW(ssp
, esp
, esp_mask
, env
->segs
[R_CS
].selector
);
2272 PUSHW(ssp
, esp
, esp_mask
, next_eip
);
2275 SET_ESP(esp
, esp_mask
);
2277 env
->segs
[R_CS
].selector
= new_cs
;
2278 env
->segs
[R_CS
].base
= (new_cs
<< 4);
2281 /* protected mode call */
2282 void helper_lcall_protected(int new_cs
, target_ulong new_eip
,
2283 int shift
, int next_eip_addend
)
2286 uint32_t e1
, e2
, cpl
, dpl
, rpl
, selector
, offset
, param_count
;
2287 uint32_t ss
= 0, ss_e1
= 0, ss_e2
= 0, sp
, type
, ss_dpl
, sp_mask
;
2288 uint32_t val
, limit
, old_sp_mask
;
2289 target_ulong ssp
, old_ssp
, next_eip
;
2291 next_eip
= env
->eip
+ next_eip_addend
;
2292 LOG_PCALL("lcall %04x:%08x s=%d\n", new_cs
, (uint32_t)new_eip
, shift
);
2293 LOG_PCALL_STATE(env
);
2294 if ((new_cs
& 0xfffc) == 0)
2295 raise_exception_err(EXCP0D_GPF
, 0);
2296 if (load_segment(&e1
, &e2
, new_cs
) != 0)
2297 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2298 cpl
= env
->hflags
& HF_CPL_MASK
;
2299 LOG_PCALL("desc=%08x:%08x\n", e1
, e2
);
2300 if (e2
& DESC_S_MASK
) {
2301 if (!(e2
& DESC_CS_MASK
))
2302 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2303 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
2304 if (e2
& DESC_C_MASK
) {
2305 /* conforming code segment */
2307 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2309 /* non conforming code segment */
2312 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2314 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2316 if (!(e2
& DESC_P_MASK
))
2317 raise_exception_err(EXCP0B_NOSEG
, new_cs
& 0xfffc);
2319 #ifdef TARGET_X86_64
2320 /* XXX: check 16/32 bit cases in long mode */
2325 PUSHQ(rsp
, env
->segs
[R_CS
].selector
);
2326 PUSHQ(rsp
, next_eip
);
2327 /* from this point, not restartable */
2329 cpu_x86_load_seg_cache(env
, R_CS
, (new_cs
& 0xfffc) | cpl
,
2330 get_seg_base(e1
, e2
),
2331 get_seg_limit(e1
, e2
), e2
);
2337 sp_mask
= get_sp_mask(env
->segs
[R_SS
].flags
);
2338 ssp
= env
->segs
[R_SS
].base
;
2340 PUSHL(ssp
, sp
, sp_mask
, env
->segs
[R_CS
].selector
);
2341 PUSHL(ssp
, sp
, sp_mask
, next_eip
);
2343 PUSHW(ssp
, sp
, sp_mask
, env
->segs
[R_CS
].selector
);
2344 PUSHW(ssp
, sp
, sp_mask
, next_eip
);
2347 limit
= get_seg_limit(e1
, e2
);
2348 if (new_eip
> limit
)
2349 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2350 /* from this point, not restartable */
2351 SET_ESP(sp
, sp_mask
);
2352 cpu_x86_load_seg_cache(env
, R_CS
, (new_cs
& 0xfffc) | cpl
,
2353 get_seg_base(e1
, e2
), limit
, e2
);
2357 /* check gate type */
2358 type
= (e2
>> DESC_TYPE_SHIFT
) & 0x1f;
2359 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
2362 case 1: /* available 286 TSS */
2363 case 9: /* available 386 TSS */
2364 case 5: /* task gate */
2365 if (dpl
< cpl
|| dpl
< rpl
)
2366 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2367 switch_tss(new_cs
, e1
, e2
, SWITCH_TSS_CALL
, next_eip
);
2368 CC_OP
= CC_OP_EFLAGS
;
2370 case 4: /* 286 call gate */
2371 case 12: /* 386 call gate */
2374 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2379 if (dpl
< cpl
|| dpl
< rpl
)
2380 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2381 /* check valid bit */
2382 if (!(e2
& DESC_P_MASK
))
2383 raise_exception_err(EXCP0B_NOSEG
, new_cs
& 0xfffc);
2384 selector
= e1
>> 16;
2385 offset
= (e2
& 0xffff0000) | (e1
& 0x0000ffff);
2386 param_count
= e2
& 0x1f;
2387 if ((selector
& 0xfffc) == 0)
2388 raise_exception_err(EXCP0D_GPF
, 0);
2390 if (load_segment(&e1
, &e2
, selector
) != 0)
2391 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2392 if (!(e2
& DESC_S_MASK
) || !(e2
& (DESC_CS_MASK
)))
2393 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2394 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
2396 raise_exception_err(EXCP0D_GPF
, selector
& 0xfffc);
2397 if (!(e2
& DESC_P_MASK
))
2398 raise_exception_err(EXCP0B_NOSEG
, selector
& 0xfffc);
2400 if (!(e2
& DESC_C_MASK
) && dpl
< cpl
) {
2401 /* to inner privilege */
2402 get_ss_esp_from_tss(&ss
, &sp
, dpl
);
2403 LOG_PCALL("new ss:esp=%04x:%08x param_count=%d ESP=" TARGET_FMT_lx
"\n",
2404 ss
, sp
, param_count
, ESP
);
2405 if ((ss
& 0xfffc) == 0)
2406 raise_exception_err(EXCP0A_TSS
, ss
& 0xfffc);
2407 if ((ss
& 3) != dpl
)
2408 raise_exception_err(EXCP0A_TSS
, ss
& 0xfffc);
2409 if (load_segment(&ss_e1
, &ss_e2
, ss
) != 0)
2410 raise_exception_err(EXCP0A_TSS
, ss
& 0xfffc);
2411 ss_dpl
= (ss_e2
>> DESC_DPL_SHIFT
) & 3;
2413 raise_exception_err(EXCP0A_TSS
, ss
& 0xfffc);
2414 if (!(ss_e2
& DESC_S_MASK
) ||
2415 (ss_e2
& DESC_CS_MASK
) ||
2416 !(ss_e2
& DESC_W_MASK
))
2417 raise_exception_err(EXCP0A_TSS
, ss
& 0xfffc);
2418 if (!(ss_e2
& DESC_P_MASK
))
2419 raise_exception_err(EXCP0A_TSS
, ss
& 0xfffc);
2421 // push_size = ((param_count * 2) + 8) << shift;
2423 old_sp_mask
= get_sp_mask(env
->segs
[R_SS
].flags
);
2424 old_ssp
= env
->segs
[R_SS
].base
;
2426 sp_mask
= get_sp_mask(ss_e2
);
2427 ssp
= get_seg_base(ss_e1
, ss_e2
);
2429 PUSHL(ssp
, sp
, sp_mask
, env
->segs
[R_SS
].selector
);
2430 PUSHL(ssp
, sp
, sp_mask
, ESP
);
2431 for(i
= param_count
- 1; i
>= 0; i
--) {
2432 val
= ldl_kernel(old_ssp
+ ((ESP
+ i
* 4) & old_sp_mask
));
2433 PUSHL(ssp
, sp
, sp_mask
, val
);
2436 PUSHW(ssp
, sp
, sp_mask
, env
->segs
[R_SS
].selector
);
2437 PUSHW(ssp
, sp
, sp_mask
, ESP
);
2438 for(i
= param_count
- 1; i
>= 0; i
--) {
2439 val
= lduw_kernel(old_ssp
+ ((ESP
+ i
* 2) & old_sp_mask
));
2440 PUSHW(ssp
, sp
, sp_mask
, val
);
2445 /* to same privilege */
2447 sp_mask
= get_sp_mask(env
->segs
[R_SS
].flags
);
2448 ssp
= env
->segs
[R_SS
].base
;
2449 // push_size = (4 << shift);
2454 PUSHL(ssp
, sp
, sp_mask
, env
->segs
[R_CS
].selector
);
2455 PUSHL(ssp
, sp
, sp_mask
, next_eip
);
2457 PUSHW(ssp
, sp
, sp_mask
, env
->segs
[R_CS
].selector
);
2458 PUSHW(ssp
, sp
, sp_mask
, next_eip
);
2461 /* from this point, not restartable */
2464 ss
= (ss
& ~3) | dpl
;
2465 cpu_x86_load_seg_cache(env
, R_SS
, ss
,
2467 get_seg_limit(ss_e1
, ss_e2
),
2471 selector
= (selector
& ~3) | dpl
;
2472 cpu_x86_load_seg_cache(env
, R_CS
, selector
,
2473 get_seg_base(e1
, e2
),
2474 get_seg_limit(e1
, e2
),
2476 cpu_x86_set_cpl(env
, dpl
);
2477 SET_ESP(sp
, sp_mask
);
2481 if (kqemu_is_ok(env
)) {
2482 env
->exception_index
= -1;
2488 /* real and vm86 mode iret */
2489 void helper_iret_real(int shift
)
2491 uint32_t sp
, new_cs
, new_eip
, new_eflags
, sp_mask
;
2495 sp_mask
= 0xffff; /* XXXX: use SS segment size ? */
2497 ssp
= env
->segs
[R_SS
].base
;
2500 POPL(ssp
, sp
, sp_mask
, new_eip
);
2501 POPL(ssp
, sp
, sp_mask
, new_cs
);
2503 POPL(ssp
, sp
, sp_mask
, new_eflags
);
2506 POPW(ssp
, sp
, sp_mask
, new_eip
);
2507 POPW(ssp
, sp
, sp_mask
, new_cs
);
2508 POPW(ssp
, sp
, sp_mask
, new_eflags
);
2510 ESP
= (ESP
& ~sp_mask
) | (sp
& sp_mask
);
2511 env
->segs
[R_CS
].selector
= new_cs
;
2512 env
->segs
[R_CS
].base
= (new_cs
<< 4);
2514 if (env
->eflags
& VM_MASK
)
2515 eflags_mask
= TF_MASK
| AC_MASK
| ID_MASK
| IF_MASK
| RF_MASK
| NT_MASK
;
2517 eflags_mask
= TF_MASK
| AC_MASK
| ID_MASK
| IF_MASK
| IOPL_MASK
| RF_MASK
| NT_MASK
;
2519 eflags_mask
&= 0xffff;
2520 load_eflags(new_eflags
, eflags_mask
);
2521 env
->hflags2
&= ~HF2_NMI_MASK
;
2524 static inline void validate_seg(int seg_reg
, int cpl
)
2529 /* XXX: on x86_64, we do not want to nullify FS and GS because
2530 they may still contain a valid base. I would be interested to
2531 know how a real x86_64 CPU behaves */
2532 if ((seg_reg
== R_FS
|| seg_reg
== R_GS
) &&
2533 (env
->segs
[seg_reg
].selector
& 0xfffc) == 0)
2536 e2
= env
->segs
[seg_reg
].flags
;
2537 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
2538 if (!(e2
& DESC_CS_MASK
) || !(e2
& DESC_C_MASK
)) {
2539 /* data or non conforming code segment */
2541 cpu_x86_load_seg_cache(env
, seg_reg
, 0, 0, 0, 0);
2546 /* protected mode iret */
2547 static inline void helper_ret_protected(int shift
, int is_iret
, int addend
)
2549 uint32_t new_cs
, new_eflags
, new_ss
;
2550 uint32_t new_es
, new_ds
, new_fs
, new_gs
;
2551 uint32_t e1
, e2
, ss_e1
, ss_e2
;
2552 int cpl
, dpl
, rpl
, eflags_mask
, iopl
;
2553 target_ulong ssp
, sp
, new_eip
, new_esp
, sp_mask
;
2555 #ifdef TARGET_X86_64
2560 sp_mask
= get_sp_mask(env
->segs
[R_SS
].flags
);
2562 ssp
= env
->segs
[R_SS
].base
;
2563 new_eflags
= 0; /* avoid warning */
2564 #ifdef TARGET_X86_64
2570 POPQ(sp
, new_eflags
);
2576 POPL(ssp
, sp
, sp_mask
, new_eip
);
2577 POPL(ssp
, sp
, sp_mask
, new_cs
);
2580 POPL(ssp
, sp
, sp_mask
, new_eflags
);
2581 if (new_eflags
& VM_MASK
)
2582 goto return_to_vm86
;
2586 POPW(ssp
, sp
, sp_mask
, new_eip
);
2587 POPW(ssp
, sp
, sp_mask
, new_cs
);
2589 POPW(ssp
, sp
, sp_mask
, new_eflags
);
2591 LOG_PCALL("lret new %04x:" TARGET_FMT_lx
" s=%d addend=0x%x\n",
2592 new_cs
, new_eip
, shift
, addend
);
2593 LOG_PCALL_STATE(env
);
2594 if ((new_cs
& 0xfffc) == 0)
2595 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2596 if (load_segment(&e1
, &e2
, new_cs
) != 0)
2597 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2598 if (!(e2
& DESC_S_MASK
) ||
2599 !(e2
& DESC_CS_MASK
))
2600 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2601 cpl
= env
->hflags
& HF_CPL_MASK
;
2604 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2605 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
2606 if (e2
& DESC_C_MASK
) {
2608 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2611 raise_exception_err(EXCP0D_GPF
, new_cs
& 0xfffc);
2613 if (!(e2
& DESC_P_MASK
))
2614 raise_exception_err(EXCP0B_NOSEG
, new_cs
& 0xfffc);
2617 if (rpl
== cpl
&& (!(env
->hflags
& HF_CS64_MASK
) ||
2618 ((env
->hflags
& HF_CS64_MASK
) && !is_iret
))) {
2619 /* return to same privilege level */
2620 cpu_x86_load_seg_cache(env
, R_CS
, new_cs
,
2621 get_seg_base(e1
, e2
),
2622 get_seg_limit(e1
, e2
),
2625 /* return to different privilege level */
2626 #ifdef TARGET_X86_64
2635 POPL(ssp
, sp
, sp_mask
, new_esp
);
2636 POPL(ssp
, sp
, sp_mask
, new_ss
);
2640 POPW(ssp
, sp
, sp_mask
, new_esp
);
2641 POPW(ssp
, sp
, sp_mask
, new_ss
);
2643 LOG_PCALL("new ss:esp=%04x:" TARGET_FMT_lx
"\n",
2645 if ((new_ss
& 0xfffc) == 0) {
2646 #ifdef TARGET_X86_64
2647 /* NULL ss is allowed in long mode if cpl != 3*/
2648 /* XXX: test CS64 ? */
2649 if ((env
->hflags
& HF_LMA_MASK
) && rpl
!= 3) {
2650 cpu_x86_load_seg_cache(env
, R_SS
, new_ss
,
2652 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2653 DESC_S_MASK
| (rpl
<< DESC_DPL_SHIFT
) |
2654 DESC_W_MASK
| DESC_A_MASK
);
2655 ss_e2
= DESC_B_MASK
; /* XXX: should not be needed ? */
2659 raise_exception_err(EXCP0D_GPF
, 0);
2662 if ((new_ss
& 3) != rpl
)
2663 raise_exception_err(EXCP0D_GPF
, new_ss
& 0xfffc);
2664 if (load_segment(&ss_e1
, &ss_e2
, new_ss
) != 0)
2665 raise_exception_err(EXCP0D_GPF
, new_ss
& 0xfffc);
2666 if (!(ss_e2
& DESC_S_MASK
) ||
2667 (ss_e2
& DESC_CS_MASK
) ||
2668 !(ss_e2
& DESC_W_MASK
))
2669 raise_exception_err(EXCP0D_GPF
, new_ss
& 0xfffc);
2670 dpl
= (ss_e2
>> DESC_DPL_SHIFT
) & 3;
2672 raise_exception_err(EXCP0D_GPF
, new_ss
& 0xfffc);
2673 if (!(ss_e2
& DESC_P_MASK
))
2674 raise_exception_err(EXCP0B_NOSEG
, new_ss
& 0xfffc);
2675 cpu_x86_load_seg_cache(env
, R_SS
, new_ss
,
2676 get_seg_base(ss_e1
, ss_e2
),
2677 get_seg_limit(ss_e1
, ss_e2
),
2681 cpu_x86_load_seg_cache(env
, R_CS
, new_cs
,
2682 get_seg_base(e1
, e2
),
2683 get_seg_limit(e1
, e2
),
2685 cpu_x86_set_cpl(env
, rpl
);
2687 #ifdef TARGET_X86_64
2688 if (env
->hflags
& HF_CS64_MASK
)
2692 sp_mask
= get_sp_mask(ss_e2
);
2694 /* validate data segments */
2695 validate_seg(R_ES
, rpl
);
2696 validate_seg(R_DS
, rpl
);
2697 validate_seg(R_FS
, rpl
);
2698 validate_seg(R_GS
, rpl
);
2702 SET_ESP(sp
, sp_mask
);
2705 /* NOTE: 'cpl' is the _old_ CPL */
2706 eflags_mask
= TF_MASK
| AC_MASK
| ID_MASK
| RF_MASK
| NT_MASK
;
2708 eflags_mask
|= IOPL_MASK
;
2709 iopl
= (env
->eflags
>> IOPL_SHIFT
) & 3;
2711 eflags_mask
|= IF_MASK
;
2713 eflags_mask
&= 0xffff;
2714 load_eflags(new_eflags
, eflags_mask
);
2719 POPL(ssp
, sp
, sp_mask
, new_esp
);
2720 POPL(ssp
, sp
, sp_mask
, new_ss
);
2721 POPL(ssp
, sp
, sp_mask
, new_es
);
2722 POPL(ssp
, sp
, sp_mask
, new_ds
);
2723 POPL(ssp
, sp
, sp_mask
, new_fs
);
2724 POPL(ssp
, sp
, sp_mask
, new_gs
);
2726 /* modify processor state */
2727 load_eflags(new_eflags
, TF_MASK
| AC_MASK
| ID_MASK
|
2728 IF_MASK
| IOPL_MASK
| VM_MASK
| NT_MASK
| VIF_MASK
| VIP_MASK
);
2729 load_seg_vm(R_CS
, new_cs
& 0xffff);
2730 cpu_x86_set_cpl(env
, 3);
2731 load_seg_vm(R_SS
, new_ss
& 0xffff);
2732 load_seg_vm(R_ES
, new_es
& 0xffff);
2733 load_seg_vm(R_DS
, new_ds
& 0xffff);
2734 load_seg_vm(R_FS
, new_fs
& 0xffff);
2735 load_seg_vm(R_GS
, new_gs
& 0xffff);
2737 env
->eip
= new_eip
& 0xffff;
2741 void helper_iret_protected(int shift
, int next_eip
)
2743 int tss_selector
, type
;
2746 /* specific case for TSS */
2747 if (env
->eflags
& NT_MASK
) {
2748 #ifdef TARGET_X86_64
2749 if (env
->hflags
& HF_LMA_MASK
)
2750 raise_exception_err(EXCP0D_GPF
, 0);
2752 tss_selector
= lduw_kernel(env
->tr
.base
+ 0);
2753 if (tss_selector
& 4)
2754 raise_exception_err(EXCP0A_TSS
, tss_selector
& 0xfffc);
2755 if (load_segment(&e1
, &e2
, tss_selector
) != 0)
2756 raise_exception_err(EXCP0A_TSS
, tss_selector
& 0xfffc);
2757 type
= (e2
>> DESC_TYPE_SHIFT
) & 0x17;
2758 /* NOTE: we check both segment and busy TSS */
2760 raise_exception_err(EXCP0A_TSS
, tss_selector
& 0xfffc);
2761 switch_tss(tss_selector
, e1
, e2
, SWITCH_TSS_IRET
, next_eip
);
2763 helper_ret_protected(shift
, 1, 0);
2765 env
->hflags2
&= ~HF2_NMI_MASK
;
2767 if (kqemu_is_ok(env
)) {
2768 CC_OP
= CC_OP_EFLAGS
;
2769 env
->exception_index
= -1;
2775 void helper_lret_protected(int shift
, int addend
)
2777 helper_ret_protected(shift
, 0, addend
);
2779 if (kqemu_is_ok(env
)) {
2780 env
->exception_index
= -1;
2786 void helper_sysenter(void)
2788 if (env
->sysenter_cs
== 0) {
2789 raise_exception_err(EXCP0D_GPF
, 0);
2791 env
->eflags
&= ~(VM_MASK
| IF_MASK
| RF_MASK
);
2792 cpu_x86_set_cpl(env
, 0);
2794 #ifdef TARGET_X86_64
2795 if (env
->hflags
& HF_LMA_MASK
) {
2796 cpu_x86_load_seg_cache(env
, R_CS
, env
->sysenter_cs
& 0xfffc,
2798 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2800 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
| DESC_L_MASK
);
2804 cpu_x86_load_seg_cache(env
, R_CS
, env
->sysenter_cs
& 0xfffc,
2806 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2808 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
);
2810 cpu_x86_load_seg_cache(env
, R_SS
, (env
->sysenter_cs
+ 8) & 0xfffc,
2812 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2814 DESC_W_MASK
| DESC_A_MASK
);
2815 ESP
= env
->sysenter_esp
;
2816 EIP
= env
->sysenter_eip
;
2819 void helper_sysexit(int dflag
)
2823 cpl
= env
->hflags
& HF_CPL_MASK
;
2824 if (env
->sysenter_cs
== 0 || cpl
!= 0) {
2825 raise_exception_err(EXCP0D_GPF
, 0);
2827 cpu_x86_set_cpl(env
, 3);
2828 #ifdef TARGET_X86_64
2830 cpu_x86_load_seg_cache(env
, R_CS
, ((env
->sysenter_cs
+ 32) & 0xfffc) | 3,
2832 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2833 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
2834 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
| DESC_L_MASK
);
2835 cpu_x86_load_seg_cache(env
, R_SS
, ((env
->sysenter_cs
+ 40) & 0xfffc) | 3,
2837 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2838 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
2839 DESC_W_MASK
| DESC_A_MASK
);
2843 cpu_x86_load_seg_cache(env
, R_CS
, ((env
->sysenter_cs
+ 16) & 0xfffc) | 3,
2845 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2846 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
2847 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
);
2848 cpu_x86_load_seg_cache(env
, R_SS
, ((env
->sysenter_cs
+ 24) & 0xfffc) | 3,
2850 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2851 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
2852 DESC_W_MASK
| DESC_A_MASK
);
2857 if (kqemu_is_ok(env
)) {
2858 env
->exception_index
= -1;
2864 #if defined(CONFIG_USER_ONLY)
2865 target_ulong
helper_read_crN(int reg
)
2870 void helper_write_crN(int reg
, target_ulong t0
)
2874 void helper_movl_drN_T0(int reg
, target_ulong t0
)
2878 target_ulong
helper_read_crN(int reg
)
2882 helper_svm_check_intercept_param(SVM_EXIT_READ_CR0
+ reg
, 0);
2888 if (!(env
->hflags2
& HF2_VINTR_MASK
)) {
2889 val
= cpu_get_apic_tpr(env
);
2898 void helper_write_crN(int reg
, target_ulong t0
)
2900 helper_svm_check_intercept_param(SVM_EXIT_WRITE_CR0
+ reg
, 0);
2903 cpu_x86_update_cr0(env
, t0
);
2906 cpu_x86_update_cr3(env
, t0
);
2909 cpu_x86_update_cr4(env
, t0
);
2912 if (!(env
->hflags2
& HF2_VINTR_MASK
)) {
2913 cpu_set_apic_tpr(env
, t0
);
2915 env
->v_tpr
= t0
& 0x0f;
2923 void helper_movl_drN_T0(int reg
, target_ulong t0
)
2928 hw_breakpoint_remove(env
, reg
);
2930 hw_breakpoint_insert(env
, reg
);
2931 } else if (reg
== 7) {
2932 for (i
= 0; i
< 4; i
++)
2933 hw_breakpoint_remove(env
, i
);
2935 for (i
= 0; i
< 4; i
++)
2936 hw_breakpoint_insert(env
, i
);
2942 void helper_lmsw(target_ulong t0
)
2944 /* only 4 lower bits of CR0 are modified. PE cannot be set to zero
2945 if already set to one. */
2946 t0
= (env
->cr
[0] & ~0xe) | (t0
& 0xf);
2947 helper_write_crN(0, t0
);
2950 void helper_clts(void)
2952 env
->cr
[0] &= ~CR0_TS_MASK
;
2953 env
->hflags
&= ~HF_TS_MASK
;
2956 void helper_invlpg(target_ulong addr
)
2958 helper_svm_check_intercept_param(SVM_EXIT_INVLPG
, 0);
2959 tlb_flush_page(env
, addr
);
2962 void helper_rdtsc(void)
2966 if ((env
->cr
[4] & CR4_TSD_MASK
) && ((env
->hflags
& HF_CPL_MASK
) != 0)) {
2967 raise_exception(EXCP0D_GPF
);
2969 helper_svm_check_intercept_param(SVM_EXIT_RDTSC
, 0);
2971 val
= cpu_get_tsc(env
) + env
->tsc_offset
;
2972 EAX
= (uint32_t)(val
);
2973 EDX
= (uint32_t)(val
>> 32);
2976 void helper_rdpmc(void)
2978 if ((env
->cr
[4] & CR4_PCE_MASK
) && ((env
->hflags
& HF_CPL_MASK
) != 0)) {
2979 raise_exception(EXCP0D_GPF
);
2981 helper_svm_check_intercept_param(SVM_EXIT_RDPMC
, 0);
2983 /* currently unimplemented */
2984 raise_exception_err(EXCP06_ILLOP
, 0);
2987 #if defined(CONFIG_USER_ONLY)
2988 void helper_wrmsr(void)
2992 void helper_rdmsr(void)
2996 void helper_wrmsr(void)
3000 helper_svm_check_intercept_param(SVM_EXIT_MSR
, 1);
3002 val
= ((uint32_t)EAX
) | ((uint64_t)((uint32_t)EDX
) << 32);
3004 switch((uint32_t)ECX
) {
3005 case MSR_IA32_SYSENTER_CS
:
3006 env
->sysenter_cs
= val
& 0xffff;
3008 case MSR_IA32_SYSENTER_ESP
:
3009 env
->sysenter_esp
= val
;
3011 case MSR_IA32_SYSENTER_EIP
:
3012 env
->sysenter_eip
= val
;
3014 case MSR_IA32_APICBASE
:
3015 cpu_set_apic_base(env
, val
);
3019 uint64_t update_mask
;
3021 if (env
->cpuid_ext2_features
& CPUID_EXT2_SYSCALL
)
3022 update_mask
|= MSR_EFER_SCE
;
3023 if (env
->cpuid_ext2_features
& CPUID_EXT2_LM
)
3024 update_mask
|= MSR_EFER_LME
;
3025 if (env
->cpuid_ext2_features
& CPUID_EXT2_FFXSR
)
3026 update_mask
|= MSR_EFER_FFXSR
;
3027 if (env
->cpuid_ext2_features
& CPUID_EXT2_NX
)
3028 update_mask
|= MSR_EFER_NXE
;
3029 if (env
->cpuid_ext3_features
& CPUID_EXT3_SVM
)
3030 update_mask
|= MSR_EFER_SVME
;
3031 cpu_load_efer(env
, (env
->efer
& ~update_mask
) |
3032 (val
& update_mask
));
3041 case MSR_VM_HSAVE_PA
:
3042 env
->vm_hsave
= val
;
3044 #ifdef TARGET_X86_64
3055 env
->segs
[R_FS
].base
= val
;
3058 env
->segs
[R_GS
].base
= val
;
3060 case MSR_KERNELGSBASE
:
3061 env
->kernelgsbase
= val
;
3065 /* XXX: exception ? */
3070 void helper_rdmsr(void)
3074 helper_svm_check_intercept_param(SVM_EXIT_MSR
, 0);
3076 switch((uint32_t)ECX
) {
3077 case MSR_IA32_SYSENTER_CS
:
3078 val
= env
->sysenter_cs
;
3080 case MSR_IA32_SYSENTER_ESP
:
3081 val
= env
->sysenter_esp
;
3083 case MSR_IA32_SYSENTER_EIP
:
3084 val
= env
->sysenter_eip
;
3086 case MSR_IA32_APICBASE
:
3087 val
= cpu_get_apic_base(env
);
3098 case MSR_VM_HSAVE_PA
:
3099 val
= env
->vm_hsave
;
3101 case MSR_IA32_PERF_STATUS
:
3102 /* tsc_increment_by_tick */
3104 /* CPU multiplier */
3105 val
|= (((uint64_t)4ULL) << 40);
3107 #ifdef TARGET_X86_64
3118 val
= env
->segs
[R_FS
].base
;
3121 val
= env
->segs
[R_GS
].base
;
3123 case MSR_KERNELGSBASE
:
3124 val
= env
->kernelgsbase
;
3128 case MSR_QPI_COMMBASE
:
3129 if (env
->kqemu_enabled
) {
3130 val
= kqemu_comm_base
;
3137 /* XXX: exception ? */
3141 EAX
= (uint32_t)(val
);
3142 EDX
= (uint32_t)(val
>> 32);
3146 target_ulong
helper_lsl(target_ulong selector1
)
3149 uint32_t e1
, e2
, eflags
, selector
;
3150 int rpl
, dpl
, cpl
, type
;
3152 selector
= selector1
& 0xffff;
3153 eflags
= helper_cc_compute_all(CC_OP
);
3154 if (load_segment(&e1
, &e2
, selector
) != 0)
3157 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
3158 cpl
= env
->hflags
& HF_CPL_MASK
;
3159 if (e2
& DESC_S_MASK
) {
3160 if ((e2
& DESC_CS_MASK
) && (e2
& DESC_C_MASK
)) {
3163 if (dpl
< cpl
|| dpl
< rpl
)
3167 type
= (e2
>> DESC_TYPE_SHIFT
) & 0xf;
3178 if (dpl
< cpl
|| dpl
< rpl
) {
3180 CC_SRC
= eflags
& ~CC_Z
;
3184 limit
= get_seg_limit(e1
, e2
);
3185 CC_SRC
= eflags
| CC_Z
;
3189 target_ulong
helper_lar(target_ulong selector1
)
3191 uint32_t e1
, e2
, eflags
, selector
;
3192 int rpl
, dpl
, cpl
, type
;
3194 selector
= selector1
& 0xffff;
3195 eflags
= helper_cc_compute_all(CC_OP
);
3196 if ((selector
& 0xfffc) == 0)
3198 if (load_segment(&e1
, &e2
, selector
) != 0)
3201 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
3202 cpl
= env
->hflags
& HF_CPL_MASK
;
3203 if (e2
& DESC_S_MASK
) {
3204 if ((e2
& DESC_CS_MASK
) && (e2
& DESC_C_MASK
)) {
3207 if (dpl
< cpl
|| dpl
< rpl
)
3211 type
= (e2
>> DESC_TYPE_SHIFT
) & 0xf;
3225 if (dpl
< cpl
|| dpl
< rpl
) {
3227 CC_SRC
= eflags
& ~CC_Z
;
3231 CC_SRC
= eflags
| CC_Z
;
3232 return e2
& 0x00f0ff00;
3235 void helper_verr(target_ulong selector1
)
3237 uint32_t e1
, e2
, eflags
, selector
;
3240 selector
= selector1
& 0xffff;
3241 eflags
= helper_cc_compute_all(CC_OP
);
3242 if ((selector
& 0xfffc) == 0)
3244 if (load_segment(&e1
, &e2
, selector
) != 0)
3246 if (!(e2
& DESC_S_MASK
))
3249 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
3250 cpl
= env
->hflags
& HF_CPL_MASK
;
3251 if (e2
& DESC_CS_MASK
) {
3252 if (!(e2
& DESC_R_MASK
))
3254 if (!(e2
& DESC_C_MASK
)) {
3255 if (dpl
< cpl
|| dpl
< rpl
)
3259 if (dpl
< cpl
|| dpl
< rpl
) {
3261 CC_SRC
= eflags
& ~CC_Z
;
3265 CC_SRC
= eflags
| CC_Z
;
3268 void helper_verw(target_ulong selector1
)
3270 uint32_t e1
, e2
, eflags
, selector
;
3273 selector
= selector1
& 0xffff;
3274 eflags
= helper_cc_compute_all(CC_OP
);
3275 if ((selector
& 0xfffc) == 0)
3277 if (load_segment(&e1
, &e2
, selector
) != 0)
3279 if (!(e2
& DESC_S_MASK
))
3282 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
3283 cpl
= env
->hflags
& HF_CPL_MASK
;
3284 if (e2
& DESC_CS_MASK
) {
3287 if (dpl
< cpl
|| dpl
< rpl
)
3289 if (!(e2
& DESC_W_MASK
)) {
3291 CC_SRC
= eflags
& ~CC_Z
;
3295 CC_SRC
= eflags
| CC_Z
;
3298 /* x87 FPU helpers */
3300 static void fpu_set_exception(int mask
)
3303 if (env
->fpus
& (~env
->fpuc
& FPUC_EM
))
3304 env
->fpus
|= FPUS_SE
| FPUS_B
;
3307 static inline CPU86_LDouble
helper_fdiv(CPU86_LDouble a
, CPU86_LDouble b
)
3310 fpu_set_exception(FPUS_ZE
);
3314 static void fpu_raise_exception(void)
3316 if (env
->cr
[0] & CR0_NE_MASK
) {
3317 raise_exception(EXCP10_COPR
);
3319 #if !defined(CONFIG_USER_ONLY)
3326 void helper_flds_FT0(uint32_t val
)
3333 FT0
= float32_to_floatx(u
.f
, &env
->fp_status
);
3336 void helper_fldl_FT0(uint64_t val
)
3343 FT0
= float64_to_floatx(u
.f
, &env
->fp_status
);
3346 void helper_fildl_FT0(int32_t val
)
3348 FT0
= int32_to_floatx(val
, &env
->fp_status
);
3351 void helper_flds_ST0(uint32_t val
)
3358 new_fpstt
= (env
->fpstt
- 1) & 7;
3360 env
->fpregs
[new_fpstt
].d
= float32_to_floatx(u
.f
, &env
->fp_status
);
3361 env
->fpstt
= new_fpstt
;
3362 env
->fptags
[new_fpstt
] = 0; /* validate stack entry */
3365 void helper_fldl_ST0(uint64_t val
)
3372 new_fpstt
= (env
->fpstt
- 1) & 7;
3374 env
->fpregs
[new_fpstt
].d
= float64_to_floatx(u
.f
, &env
->fp_status
);
3375 env
->fpstt
= new_fpstt
;
3376 env
->fptags
[new_fpstt
] = 0; /* validate stack entry */
3379 void helper_fildl_ST0(int32_t val
)
3382 new_fpstt
= (env
->fpstt
- 1) & 7;
3383 env
->fpregs
[new_fpstt
].d
= int32_to_floatx(val
, &env
->fp_status
);
3384 env
->fpstt
= new_fpstt
;
3385 env
->fptags
[new_fpstt
] = 0; /* validate stack entry */
3388 void helper_fildll_ST0(int64_t val
)
3391 new_fpstt
= (env
->fpstt
- 1) & 7;
3392 env
->fpregs
[new_fpstt
].d
= int64_to_floatx(val
, &env
->fp_status
);
3393 env
->fpstt
= new_fpstt
;
3394 env
->fptags
[new_fpstt
] = 0; /* validate stack entry */
3397 uint32_t helper_fsts_ST0(void)
3403 u
.f
= floatx_to_float32(ST0
, &env
->fp_status
);
3407 uint64_t helper_fstl_ST0(void)
3413 u
.f
= floatx_to_float64(ST0
, &env
->fp_status
);
3417 int32_t helper_fist_ST0(void)
3420 val
= floatx_to_int32(ST0
, &env
->fp_status
);
3421 if (val
!= (int16_t)val
)
3426 int32_t helper_fistl_ST0(void)
3429 val
= floatx_to_int32(ST0
, &env
->fp_status
);
3433 int64_t helper_fistll_ST0(void)
3436 val
= floatx_to_int64(ST0
, &env
->fp_status
);
3440 int32_t helper_fistt_ST0(void)
3443 val
= floatx_to_int32_round_to_zero(ST0
, &env
->fp_status
);
3444 if (val
!= (int16_t)val
)
3449 int32_t helper_fisttl_ST0(void)
3452 val
= floatx_to_int32_round_to_zero(ST0
, &env
->fp_status
);
3456 int64_t helper_fisttll_ST0(void)
3459 val
= floatx_to_int64_round_to_zero(ST0
, &env
->fp_status
);
3463 void helper_fldt_ST0(target_ulong ptr
)
3466 new_fpstt
= (env
->fpstt
- 1) & 7;
3467 env
->fpregs
[new_fpstt
].d
= helper_fldt(ptr
);
3468 env
->fpstt
= new_fpstt
;
3469 env
->fptags
[new_fpstt
] = 0; /* validate stack entry */
3472 void helper_fstt_ST0(target_ulong ptr
)
3474 helper_fstt(ST0
, ptr
);
3477 void helper_fpush(void)
3482 void helper_fpop(void)
3487 void helper_fdecstp(void)
3489 env
->fpstt
= (env
->fpstt
- 1) & 7;
3490 env
->fpus
&= (~0x4700);
3493 void helper_fincstp(void)
3495 env
->fpstt
= (env
->fpstt
+ 1) & 7;
3496 env
->fpus
&= (~0x4700);
3501 void helper_ffree_STN(int st_index
)
3503 env
->fptags
[(env
->fpstt
+ st_index
) & 7] = 1;
3506 void helper_fmov_ST0_FT0(void)
3511 void helper_fmov_FT0_STN(int st_index
)
3516 void helper_fmov_ST0_STN(int st_index
)
3521 void helper_fmov_STN_ST0(int st_index
)
3526 void helper_fxchg_ST0_STN(int st_index
)
3534 /* FPU operations */
3536 static const int fcom_ccval
[4] = {0x0100, 0x4000, 0x0000, 0x4500};
3538 void helper_fcom_ST0_FT0(void)
3542 ret
= floatx_compare(ST0
, FT0
, &env
->fp_status
);
3543 env
->fpus
= (env
->fpus
& ~0x4500) | fcom_ccval
[ret
+ 1];
3546 void helper_fucom_ST0_FT0(void)
3550 ret
= floatx_compare_quiet(ST0
, FT0
, &env
->fp_status
);
3551 env
->fpus
= (env
->fpus
& ~0x4500) | fcom_ccval
[ret
+ 1];
3554 static const int fcomi_ccval
[4] = {CC_C
, CC_Z
, 0, CC_Z
| CC_P
| CC_C
};
3556 void helper_fcomi_ST0_FT0(void)
3561 ret
= floatx_compare(ST0
, FT0
, &env
->fp_status
);
3562 eflags
= helper_cc_compute_all(CC_OP
);
3563 eflags
= (eflags
& ~(CC_Z
| CC_P
| CC_C
)) | fcomi_ccval
[ret
+ 1];
3567 void helper_fucomi_ST0_FT0(void)
3572 ret
= floatx_compare_quiet(ST0
, FT0
, &env
->fp_status
);
3573 eflags
= helper_cc_compute_all(CC_OP
);
3574 eflags
= (eflags
& ~(CC_Z
| CC_P
| CC_C
)) | fcomi_ccval
[ret
+ 1];
3578 void helper_fadd_ST0_FT0(void)
3583 void helper_fmul_ST0_FT0(void)
3588 void helper_fsub_ST0_FT0(void)
3593 void helper_fsubr_ST0_FT0(void)
3598 void helper_fdiv_ST0_FT0(void)
3600 ST0
= helper_fdiv(ST0
, FT0
);
3603 void helper_fdivr_ST0_FT0(void)
3605 ST0
= helper_fdiv(FT0
, ST0
);
3608 /* fp operations between STN and ST0 */
3610 void helper_fadd_STN_ST0(int st_index
)
3612 ST(st_index
) += ST0
;
3615 void helper_fmul_STN_ST0(int st_index
)
3617 ST(st_index
) *= ST0
;
3620 void helper_fsub_STN_ST0(int st_index
)
3622 ST(st_index
) -= ST0
;
3625 void helper_fsubr_STN_ST0(int st_index
)
3632 void helper_fdiv_STN_ST0(int st_index
)
3636 *p
= helper_fdiv(*p
, ST0
);
3639 void helper_fdivr_STN_ST0(int st_index
)
3643 *p
= helper_fdiv(ST0
, *p
);
3646 /* misc FPU operations */
3647 void helper_fchs_ST0(void)
3649 ST0
= floatx_chs(ST0
);
3652 void helper_fabs_ST0(void)
3654 ST0
= floatx_abs(ST0
);
3657 void helper_fld1_ST0(void)
3662 void helper_fldl2t_ST0(void)
3667 void helper_fldl2e_ST0(void)
3672 void helper_fldpi_ST0(void)
3677 void helper_fldlg2_ST0(void)
3682 void helper_fldln2_ST0(void)
3687 void helper_fldz_ST0(void)
3692 void helper_fldz_FT0(void)
3697 uint32_t helper_fnstsw(void)
3699 return (env
->fpus
& ~0x3800) | (env
->fpstt
& 0x7) << 11;
3702 uint32_t helper_fnstcw(void)
3707 static void update_fp_status(void)
3711 /* set rounding mode */
3712 switch(env
->fpuc
& RC_MASK
) {
3715 rnd_type
= float_round_nearest_even
;
3718 rnd_type
= float_round_down
;
3721 rnd_type
= float_round_up
;
3724 rnd_type
= float_round_to_zero
;
3727 set_float_rounding_mode(rnd_type
, &env
->fp_status
);
3729 switch((env
->fpuc
>> 8) & 3) {
3741 set_floatx80_rounding_precision(rnd_type
, &env
->fp_status
);
3745 void helper_fldcw(uint32_t val
)
3751 void helper_fclex(void)
3753 env
->fpus
&= 0x7f00;
3756 void helper_fwait(void)
3758 if (env
->fpus
& FPUS_SE
)
3759 fpu_raise_exception();
3762 void helper_fninit(void)
3779 void helper_fbld_ST0(target_ulong ptr
)
3787 for(i
= 8; i
>= 0; i
--) {
3789 val
= (val
* 100) + ((v
>> 4) * 10) + (v
& 0xf);
3792 if (ldub(ptr
+ 9) & 0x80)
3798 void helper_fbst_ST0(target_ulong ptr
)
3801 target_ulong mem_ref
, mem_end
;
3804 val
= floatx_to_int64(ST0
, &env
->fp_status
);
3806 mem_end
= mem_ref
+ 9;
3813 while (mem_ref
< mem_end
) {
3818 v
= ((v
/ 10) << 4) | (v
% 10);
3821 while (mem_ref
< mem_end
) {
3826 void helper_f2xm1(void)
3828 ST0
= pow(2.0,ST0
) - 1.0;
3831 void helper_fyl2x(void)
3833 CPU86_LDouble fptemp
;
3837 fptemp
= log(fptemp
)/log(2.0); /* log2(ST) */
3841 env
->fpus
&= (~0x4700);
3846 void helper_fptan(void)
3848 CPU86_LDouble fptemp
;
3851 if((fptemp
> MAXTAN
)||(fptemp
< -MAXTAN
)) {
3857 env
->fpus
&= (~0x400); /* C2 <-- 0 */
3858 /* the above code is for |arg| < 2**52 only */
3862 void helper_fpatan(void)
3864 CPU86_LDouble fptemp
, fpsrcop
;
3868 ST1
= atan2(fpsrcop
,fptemp
);
3872 void helper_fxtract(void)
3874 CPU86_LDoubleU temp
;
3875 unsigned int expdif
;
3878 expdif
= EXPD(temp
) - EXPBIAS
;
3879 /*DP exponent bias*/
3886 void helper_fprem1(void)
3888 CPU86_LDouble dblq
, fpsrcop
, fptemp
;
3889 CPU86_LDoubleU fpsrcop1
, fptemp1
;
3891 signed long long int q
;
3893 if (isinf(ST0
) || isnan(ST0
) || isnan(ST1
) || (ST1
== 0.0)) {
3894 ST0
= 0.0 / 0.0; /* NaN */
3895 env
->fpus
&= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3901 fpsrcop1
.d
= fpsrcop
;
3903 expdif
= EXPD(fpsrcop1
) - EXPD(fptemp1
);
3906 /* optimisation? taken from the AMD docs */
3907 env
->fpus
&= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3908 /* ST0 is unchanged */
3913 dblq
= fpsrcop
/ fptemp
;
3914 /* round dblq towards nearest integer */
3916 ST0
= fpsrcop
- fptemp
* dblq
;
3918 /* convert dblq to q by truncating towards zero */
3920 q
= (signed long long int)(-dblq
);
3922 q
= (signed long long int)dblq
;
3924 env
->fpus
&= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3925 /* (C0,C3,C1) <-- (q2,q1,q0) */
3926 env
->fpus
|= (q
& 0x4) << (8 - 2); /* (C0) <-- q2 */
3927 env
->fpus
|= (q
& 0x2) << (14 - 1); /* (C3) <-- q1 */
3928 env
->fpus
|= (q
& 0x1) << (9 - 0); /* (C1) <-- q0 */
3930 env
->fpus
|= 0x400; /* C2 <-- 1 */
3931 fptemp
= pow(2.0, expdif
- 50);
3932 fpsrcop
= (ST0
/ ST1
) / fptemp
;
3933 /* fpsrcop = integer obtained by chopping */
3934 fpsrcop
= (fpsrcop
< 0.0) ?
3935 -(floor(fabs(fpsrcop
))) : floor(fpsrcop
);
3936 ST0
-= (ST1
* fpsrcop
* fptemp
);
3940 void helper_fprem(void)
3942 CPU86_LDouble dblq
, fpsrcop
, fptemp
;
3943 CPU86_LDoubleU fpsrcop1
, fptemp1
;
3945 signed long long int q
;
3947 if (isinf(ST0
) || isnan(ST0
) || isnan(ST1
) || (ST1
== 0.0)) {
3948 ST0
= 0.0 / 0.0; /* NaN */
3949 env
->fpus
&= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3953 fpsrcop
= (CPU86_LDouble
)ST0
;
3954 fptemp
= (CPU86_LDouble
)ST1
;
3955 fpsrcop1
.d
= fpsrcop
;
3957 expdif
= EXPD(fpsrcop1
) - EXPD(fptemp1
);
3960 /* optimisation? taken from the AMD docs */
3961 env
->fpus
&= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3962 /* ST0 is unchanged */
3966 if ( expdif
< 53 ) {
3967 dblq
= fpsrcop
/*ST0*/ / fptemp
/*ST1*/;
3968 /* round dblq towards zero */
3969 dblq
= (dblq
< 0.0) ? ceil(dblq
) : floor(dblq
);
3970 ST0
= fpsrcop
/*ST0*/ - fptemp
* dblq
;
3972 /* convert dblq to q by truncating towards zero */
3974 q
= (signed long long int)(-dblq
);
3976 q
= (signed long long int)dblq
;
3978 env
->fpus
&= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3979 /* (C0,C3,C1) <-- (q2,q1,q0) */
3980 env
->fpus
|= (q
& 0x4) << (8 - 2); /* (C0) <-- q2 */
3981 env
->fpus
|= (q
& 0x2) << (14 - 1); /* (C3) <-- q1 */
3982 env
->fpus
|= (q
& 0x1) << (9 - 0); /* (C1) <-- q0 */
3984 int N
= 32 + (expdif
% 32); /* as per AMD docs */
3985 env
->fpus
|= 0x400; /* C2 <-- 1 */
3986 fptemp
= pow(2.0, (double)(expdif
- N
));
3987 fpsrcop
= (ST0
/ ST1
) / fptemp
;
3988 /* fpsrcop = integer obtained by chopping */
3989 fpsrcop
= (fpsrcop
< 0.0) ?
3990 -(floor(fabs(fpsrcop
))) : floor(fpsrcop
);
3991 ST0
-= (ST1
* fpsrcop
* fptemp
);
3995 void helper_fyl2xp1(void)
3997 CPU86_LDouble fptemp
;
4000 if ((fptemp
+1.0)>0.0) {
4001 fptemp
= log(fptemp
+1.0) / log(2.0); /* log2(ST+1.0) */
4005 env
->fpus
&= (~0x4700);
4010 void helper_fsqrt(void)
4012 CPU86_LDouble fptemp
;
4016 env
->fpus
&= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4022 void helper_fsincos(void)
4024 CPU86_LDouble fptemp
;
4027 if ((fptemp
> MAXTAN
)||(fptemp
< -MAXTAN
)) {
4033 env
->fpus
&= (~0x400); /* C2 <-- 0 */
4034 /* the above code is for |arg| < 2**63 only */
4038 void helper_frndint(void)
4040 ST0
= floatx_round_to_int(ST0
, &env
->fp_status
);
4043 void helper_fscale(void)
4045 ST0
= ldexp (ST0
, (int)(ST1
));
4048 void helper_fsin(void)
4050 CPU86_LDouble fptemp
;
4053 if ((fptemp
> MAXTAN
)||(fptemp
< -MAXTAN
)) {
4057 env
->fpus
&= (~0x400); /* C2 <-- 0 */
4058 /* the above code is for |arg| < 2**53 only */
4062 void helper_fcos(void)
4064 CPU86_LDouble fptemp
;
4067 if((fptemp
> MAXTAN
)||(fptemp
< -MAXTAN
)) {
4071 env
->fpus
&= (~0x400); /* C2 <-- 0 */
4072 /* the above code is for |arg5 < 2**63 only */
4076 void helper_fxam_ST0(void)
4078 CPU86_LDoubleU temp
;
4083 env
->fpus
&= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4085 env
->fpus
|= 0x200; /* C1 <-- 1 */
4087 /* XXX: test fptags too */
4088 expdif
= EXPD(temp
);
4089 if (expdif
== MAXEXPD
) {
4090 #ifdef USE_X86LDOUBLE
4091 if (MANTD(temp
) == 0x8000000000000000ULL
)
4093 if (MANTD(temp
) == 0)
4095 env
->fpus
|= 0x500 /*Infinity*/;
4097 env
->fpus
|= 0x100 /*NaN*/;
4098 } else if (expdif
== 0) {
4099 if (MANTD(temp
) == 0)
4100 env
->fpus
|= 0x4000 /*Zero*/;
4102 env
->fpus
|= 0x4400 /*Denormal*/;
4108 void helper_fstenv(target_ulong ptr
, int data32
)
4110 int fpus
, fptag
, exp
, i
;
4114 fpus
= (env
->fpus
& ~0x3800) | (env
->fpstt
& 0x7) << 11;
4116 for (i
=7; i
>=0; i
--) {
4118 if (env
->fptags
[i
]) {
4121 tmp
.d
= env
->fpregs
[i
].d
;
4124 if (exp
== 0 && mant
== 0) {
4127 } else if (exp
== 0 || exp
== MAXEXPD
4128 #ifdef USE_X86LDOUBLE
4129 || (mant
& (1LL << 63)) == 0
4132 /* NaNs, infinity, denormal */
4139 stl(ptr
, env
->fpuc
);
4141 stl(ptr
+ 8, fptag
);
4142 stl(ptr
+ 12, 0); /* fpip */
4143 stl(ptr
+ 16, 0); /* fpcs */
4144 stl(ptr
+ 20, 0); /* fpoo */
4145 stl(ptr
+ 24, 0); /* fpos */
4148 stw(ptr
, env
->fpuc
);
4150 stw(ptr
+ 4, fptag
);
4158 void helper_fldenv(target_ulong ptr
, int data32
)
4163 env
->fpuc
= lduw(ptr
);
4164 fpus
= lduw(ptr
+ 4);
4165 fptag
= lduw(ptr
+ 8);
4168 env
->fpuc
= lduw(ptr
);
4169 fpus
= lduw(ptr
+ 2);
4170 fptag
= lduw(ptr
+ 4);
4172 env
->fpstt
= (fpus
>> 11) & 7;
4173 env
->fpus
= fpus
& ~0x3800;
4174 for(i
= 0;i
< 8; i
++) {
4175 env
->fptags
[i
] = ((fptag
& 3) == 3);
4180 void helper_fsave(target_ulong ptr
, int data32
)
4185 helper_fstenv(ptr
, data32
);
4187 ptr
+= (14 << data32
);
4188 for(i
= 0;i
< 8; i
++) {
4190 helper_fstt(tmp
, ptr
);
4208 void helper_frstor(target_ulong ptr
, int data32
)
4213 helper_fldenv(ptr
, data32
);
4214 ptr
+= (14 << data32
);
4216 for(i
= 0;i
< 8; i
++) {
4217 tmp
= helper_fldt(ptr
);
4223 void helper_fxsave(target_ulong ptr
, int data64
)
4225 int fpus
, fptag
, i
, nb_xmm_regs
;
4229 fpus
= (env
->fpus
& ~0x3800) | (env
->fpstt
& 0x7) << 11;
4231 for(i
= 0; i
< 8; i
++) {
4232 fptag
|= (env
->fptags
[i
] << i
);
4234 stw(ptr
, env
->fpuc
);
4236 stw(ptr
+ 4, fptag
^ 0xff);
4237 #ifdef TARGET_X86_64
4239 stq(ptr
+ 0x08, 0); /* rip */
4240 stq(ptr
+ 0x10, 0); /* rdp */
4244 stl(ptr
+ 0x08, 0); /* eip */
4245 stl(ptr
+ 0x0c, 0); /* sel */
4246 stl(ptr
+ 0x10, 0); /* dp */
4247 stl(ptr
+ 0x14, 0); /* sel */
4251 for(i
= 0;i
< 8; i
++) {
4253 helper_fstt(tmp
, addr
);
4257 if (env
->cr
[4] & CR4_OSFXSR_MASK
) {
4258 /* XXX: finish it */
4259 stl(ptr
+ 0x18, env
->mxcsr
); /* mxcsr */
4260 stl(ptr
+ 0x1c, 0x0000ffff); /* mxcsr_mask */
4261 if (env
->hflags
& HF_CS64_MASK
)
4266 for(i
= 0; i
< nb_xmm_regs
; i
++) {
4267 stq(addr
, env
->xmm_regs
[i
].XMM_Q(0));
4268 stq(addr
+ 8, env
->xmm_regs
[i
].XMM_Q(1));
4274 void helper_fxrstor(target_ulong ptr
, int data64
)
4276 int i
, fpus
, fptag
, nb_xmm_regs
;
4280 env
->fpuc
= lduw(ptr
);
4281 fpus
= lduw(ptr
+ 2);
4282 fptag
= lduw(ptr
+ 4);
4283 env
->fpstt
= (fpus
>> 11) & 7;
4284 env
->fpus
= fpus
& ~0x3800;
4286 for(i
= 0;i
< 8; i
++) {
4287 env
->fptags
[i
] = ((fptag
>> i
) & 1);
4291 for(i
= 0;i
< 8; i
++) {
4292 tmp
= helper_fldt(addr
);
4297 if (env
->cr
[4] & CR4_OSFXSR_MASK
) {
4298 /* XXX: finish it */
4299 env
->mxcsr
= ldl(ptr
+ 0x18);
4301 if (env
->hflags
& HF_CS64_MASK
)
4306 for(i
= 0; i
< nb_xmm_regs
; i
++) {
4307 env
->xmm_regs
[i
].XMM_Q(0) = ldq(addr
);
4308 env
->xmm_regs
[i
].XMM_Q(1) = ldq(addr
+ 8);
4314 #ifndef USE_X86LDOUBLE
4316 void cpu_get_fp80(uint64_t *pmant
, uint16_t *pexp
, CPU86_LDouble f
)
4318 CPU86_LDoubleU temp
;
4323 *pmant
= (MANTD(temp
) << 11) | (1LL << 63);
4324 /* exponent + sign */
4325 e
= EXPD(temp
) - EXPBIAS
+ 16383;
4326 e
|= SIGND(temp
) >> 16;
4330 CPU86_LDouble
cpu_set_fp80(uint64_t mant
, uint16_t upper
)
4332 CPU86_LDoubleU temp
;
4336 /* XXX: handle overflow ? */
4337 e
= (upper
& 0x7fff) - 16383 + EXPBIAS
; /* exponent */
4338 e
|= (upper
>> 4) & 0x800; /* sign */
4339 ll
= (mant
>> 11) & ((1LL << 52) - 1);
4341 temp
.l
.upper
= (e
<< 20) | (ll
>> 32);
4344 temp
.ll
= ll
| ((uint64_t)e
<< 52);
4351 void cpu_get_fp80(uint64_t *pmant
, uint16_t *pexp
, CPU86_LDouble f
)
4353 CPU86_LDoubleU temp
;
4356 *pmant
= temp
.l
.lower
;
4357 *pexp
= temp
.l
.upper
;
4360 CPU86_LDouble
cpu_set_fp80(uint64_t mant
, uint16_t upper
)
4362 CPU86_LDoubleU temp
;
4364 temp
.l
.upper
= upper
;
4365 temp
.l
.lower
= mant
;
4370 #ifdef TARGET_X86_64
4372 //#define DEBUG_MULDIV
4374 static void add128(uint64_t *plow
, uint64_t *phigh
, uint64_t a
, uint64_t b
)
4383 static void neg128(uint64_t *plow
, uint64_t *phigh
)
4387 add128(plow
, phigh
, 1, 0);
4390 /* return TRUE if overflow */
4391 static int div64(uint64_t *plow
, uint64_t *phigh
, uint64_t b
)
4393 uint64_t q
, r
, a1
, a0
;
4406 /* XXX: use a better algorithm */
4407 for(i
= 0; i
< 64; i
++) {
4409 a1
= (a1
<< 1) | (a0
>> 63);
4410 if (ab
|| a1
>= b
) {
4416 a0
= (a0
<< 1) | qb
;
4418 #if defined(DEBUG_MULDIV)
4419 printf("div: 0x%016" PRIx64
"%016" PRIx64
" / 0x%016" PRIx64
": q=0x%016" PRIx64
" r=0x%016" PRIx64
"\n",
4420 *phigh
, *plow
, b
, a0
, a1
);
4428 /* return TRUE if overflow */
4429 static int idiv64(uint64_t *plow
, uint64_t *phigh
, int64_t b
)
4432 sa
= ((int64_t)*phigh
< 0);
4434 neg128(plow
, phigh
);
4438 if (div64(plow
, phigh
, b
) != 0)
4441 if (*plow
> (1ULL << 63))
4445 if (*plow
>= (1ULL << 63))
4453 void helper_mulq_EAX_T0(target_ulong t0
)
4457 mulu64(&r0
, &r1
, EAX
, t0
);
4464 void helper_imulq_EAX_T0(target_ulong t0
)
4468 muls64(&r0
, &r1
, EAX
, t0
);
4472 CC_SRC
= ((int64_t)r1
!= ((int64_t)r0
>> 63));
4475 target_ulong
helper_imulq_T0_T1(target_ulong t0
, target_ulong t1
)
4479 muls64(&r0
, &r1
, t0
, t1
);
4481 CC_SRC
= ((int64_t)r1
!= ((int64_t)r0
>> 63));
4485 void helper_divq_EAX(target_ulong t0
)
4489 raise_exception(EXCP00_DIVZ
);
4493 if (div64(&r0
, &r1
, t0
))
4494 raise_exception(EXCP00_DIVZ
);
4499 void helper_idivq_EAX(target_ulong t0
)
4503 raise_exception(EXCP00_DIVZ
);
4507 if (idiv64(&r0
, &r1
, t0
))
4508 raise_exception(EXCP00_DIVZ
);
4514 static void do_hlt(void)
4516 env
->hflags
&= ~HF_INHIBIT_IRQ_MASK
; /* needed if sti is just before */
4518 env
->exception_index
= EXCP_HLT
;
4522 void helper_hlt(int next_eip_addend
)
4524 helper_svm_check_intercept_param(SVM_EXIT_HLT
, 0);
4525 EIP
+= next_eip_addend
;
4530 void helper_monitor(target_ulong ptr
)
4532 if ((uint32_t)ECX
!= 0)
4533 raise_exception(EXCP0D_GPF
);
4534 /* XXX: store address ? */
4535 helper_svm_check_intercept_param(SVM_EXIT_MONITOR
, 0);
4538 void helper_mwait(int next_eip_addend
)
4540 if ((uint32_t)ECX
!= 0)
4541 raise_exception(EXCP0D_GPF
);
4542 helper_svm_check_intercept_param(SVM_EXIT_MWAIT
, 0);
4543 EIP
+= next_eip_addend
;
4545 /* XXX: not complete but not completely erroneous */
4546 if (env
->cpu_index
!= 0 || env
->next_cpu
!= NULL
) {
4547 /* more than one CPU: do not sleep because another CPU may
4554 void helper_debug(void)
4556 env
->exception_index
= EXCP_DEBUG
;
4560 void helper_raise_interrupt(int intno
, int next_eip_addend
)
4562 raise_interrupt(intno
, 1, 0, next_eip_addend
);
4565 void helper_raise_exception(int exception_index
)
4567 raise_exception(exception_index
);
4570 void helper_cli(void)
4572 env
->eflags
&= ~IF_MASK
;
4575 void helper_sti(void)
4577 env
->eflags
|= IF_MASK
;
4581 /* vm86plus instructions */
4582 void helper_cli_vm(void)
4584 env
->eflags
&= ~VIF_MASK
;
4587 void helper_sti_vm(void)
4589 env
->eflags
|= VIF_MASK
;
4590 if (env
->eflags
& VIP_MASK
) {
4591 raise_exception(EXCP0D_GPF
);
4596 void helper_set_inhibit_irq(void)
4598 env
->hflags
|= HF_INHIBIT_IRQ_MASK
;
4601 void helper_reset_inhibit_irq(void)
4603 env
->hflags
&= ~HF_INHIBIT_IRQ_MASK
;
4606 void helper_boundw(target_ulong a0
, int v
)
4610 high
= ldsw(a0
+ 2);
4612 if (v
< low
|| v
> high
) {
4613 raise_exception(EXCP05_BOUND
);
4617 void helper_boundl(target_ulong a0
, int v
)
4622 if (v
< low
|| v
> high
) {
4623 raise_exception(EXCP05_BOUND
);
4627 static float approx_rsqrt(float a
)
4629 return 1.0 / sqrt(a
);
4632 static float approx_rcp(float a
)
4637 #if !defined(CONFIG_USER_ONLY)
4639 #define MMUSUFFIX _mmu
4642 #include "softmmu_template.h"
4645 #include "softmmu_template.h"
4648 #include "softmmu_template.h"
4651 #include "softmmu_template.h"
4655 #if !defined(CONFIG_USER_ONLY)
4656 /* try to fill the TLB and return an exception if error. If retaddr is
4657 NULL, it means that the function was called in C code (i.e. not
4658 from generated code or from helper.c) */
4659 /* XXX: fix it to restore all registers */
4660 void tlb_fill(target_ulong addr
, int is_write
, int mmu_idx
, void *retaddr
)
4662 TranslationBlock
*tb
;
4665 CPUX86State
*saved_env
;
4667 /* XXX: hack to restore env in all cases, even if not called from
4670 env
= cpu_single_env
;
4672 ret
= cpu_x86_handle_mmu_fault(env
, addr
, is_write
, mmu_idx
, 1);
4675 /* now we have a real cpu fault */
4676 pc
= (unsigned long)retaddr
;
4677 tb
= tb_find_pc(pc
);
4679 /* the PC is inside the translated code. It means that we have
4680 a virtual CPU fault */
4681 cpu_restore_state(tb
, env
, pc
, NULL
);
4684 raise_exception_err(env
->exception_index
, env
->error_code
);
4690 /* Secure Virtual Machine helpers */
4692 #if defined(CONFIG_USER_ONLY)
4694 void helper_vmrun(int aflag
, int next_eip_addend
)
4697 void helper_vmmcall(void)
4700 void helper_vmload(int aflag
)
4703 void helper_vmsave(int aflag
)
4706 void helper_stgi(void)
4709 void helper_clgi(void)
4712 void helper_skinit(void)
4715 void helper_invlpga(int aflag
)
4718 void helper_vmexit(uint32_t exit_code
, uint64_t exit_info_1
)
4721 void helper_svm_check_intercept_param(uint32_t type
, uint64_t param
)
4725 void helper_svm_check_io(uint32_t port
, uint32_t param
,
4726 uint32_t next_eip_addend
)
4731 static inline void svm_save_seg(target_phys_addr_t addr
,
4732 const SegmentCache
*sc
)
4734 stw_phys(addr
+ offsetof(struct vmcb_seg
, selector
),
4736 stq_phys(addr
+ offsetof(struct vmcb_seg
, base
),
4738 stl_phys(addr
+ offsetof(struct vmcb_seg
, limit
),
4740 stw_phys(addr
+ offsetof(struct vmcb_seg
, attrib
),
4741 ((sc
->flags
>> 8) & 0xff) | ((sc
->flags
>> 12) & 0x0f00));
4744 static inline void svm_load_seg(target_phys_addr_t addr
, SegmentCache
*sc
)
4748 sc
->selector
= lduw_phys(addr
+ offsetof(struct vmcb_seg
, selector
));
4749 sc
->base
= ldq_phys(addr
+ offsetof(struct vmcb_seg
, base
));
4750 sc
->limit
= ldl_phys(addr
+ offsetof(struct vmcb_seg
, limit
));
4751 flags
= lduw_phys(addr
+ offsetof(struct vmcb_seg
, attrib
));
4752 sc
->flags
= ((flags
& 0xff) << 8) | ((flags
& 0x0f00) << 12);
4755 static inline void svm_load_seg_cache(target_phys_addr_t addr
,
4756 CPUState
*env
, int seg_reg
)
4758 SegmentCache sc1
, *sc
= &sc1
;
4759 svm_load_seg(addr
, sc
);
4760 cpu_x86_load_seg_cache(env
, seg_reg
, sc
->selector
,
4761 sc
->base
, sc
->limit
, sc
->flags
);
4764 void helper_vmrun(int aflag
, int next_eip_addend
)
4770 helper_svm_check_intercept_param(SVM_EXIT_VMRUN
, 0);
4775 addr
= (uint32_t)EAX
;
4777 if (loglevel
& CPU_LOG_TB_IN_ASM
)
4778 fprintf(logfile
,"vmrun! " TARGET_FMT_lx
"\n", addr
);
4780 env
->vm_vmcb
= addr
;
4782 /* save the current CPU state in the hsave page */
4783 stq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.gdtr
.base
), env
->gdt
.base
);
4784 stl_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.gdtr
.limit
), env
->gdt
.limit
);
4786 stq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.idtr
.base
), env
->idt
.base
);
4787 stl_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.idtr
.limit
), env
->idt
.limit
);
4789 stq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.cr0
), env
->cr
[0]);
4790 stq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.cr2
), env
->cr
[2]);
4791 stq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.cr3
), env
->cr
[3]);
4792 stq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.cr4
), env
->cr
[4]);
4793 stq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.dr6
), env
->dr
[6]);
4794 stq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.dr7
), env
->dr
[7]);
4796 stq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.efer
), env
->efer
);
4797 stq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.rflags
), compute_eflags());
4799 svm_save_seg(env
->vm_hsave
+ offsetof(struct vmcb
, save
.es
),
4801 svm_save_seg(env
->vm_hsave
+ offsetof(struct vmcb
, save
.cs
),
4803 svm_save_seg(env
->vm_hsave
+ offsetof(struct vmcb
, save
.ss
),
4805 svm_save_seg(env
->vm_hsave
+ offsetof(struct vmcb
, save
.ds
),
4808 stq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.rip
),
4809 EIP
+ next_eip_addend
);
4810 stq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.rsp
), ESP
);
4811 stq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.rax
), EAX
);
4813 /* load the interception bitmaps so we do not need to access the
4815 env
->intercept
= ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.intercept
));
4816 env
->intercept_cr_read
= lduw_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.intercept_cr_read
));
4817 env
->intercept_cr_write
= lduw_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.intercept_cr_write
));
4818 env
->intercept_dr_read
= lduw_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.intercept_dr_read
));
4819 env
->intercept_dr_write
= lduw_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.intercept_dr_write
));
4820 env
->intercept_exceptions
= ldl_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.intercept_exceptions
));
4822 /* enable intercepts */
4823 env
->hflags
|= HF_SVMI_MASK
;
4825 env
->tsc_offset
= ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.tsc_offset
));
4827 env
->gdt
.base
= ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.gdtr
.base
));
4828 env
->gdt
.limit
= ldl_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.gdtr
.limit
));
4830 env
->idt
.base
= ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.idtr
.base
));
4831 env
->idt
.limit
= ldl_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.idtr
.limit
));
4833 /* clear exit_info_2 so we behave like the real hardware */
4834 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.exit_info_2
), 0);
4836 cpu_x86_update_cr0(env
, ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.cr0
)));
4837 cpu_x86_update_cr4(env
, ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.cr4
)));
4838 cpu_x86_update_cr3(env
, ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.cr3
)));
4839 env
->cr
[2] = ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.cr2
));
4840 int_ctl
= ldl_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.int_ctl
));
4841 env
->hflags2
&= ~(HF2_HIF_MASK
| HF2_VINTR_MASK
);
4842 if (int_ctl
& V_INTR_MASKING_MASK
) {
4843 env
->v_tpr
= int_ctl
& V_TPR_MASK
;
4844 env
->hflags2
|= HF2_VINTR_MASK
;
4845 if (env
->eflags
& IF_MASK
)
4846 env
->hflags2
|= HF2_HIF_MASK
;
4850 ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.efer
)));
4852 load_eflags(ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.rflags
)),
4853 ~(CC_O
| CC_S
| CC_Z
| CC_A
| CC_P
| CC_C
| DF_MASK
));
4854 CC_OP
= CC_OP_EFLAGS
;
4856 svm_load_seg_cache(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.es
),
4858 svm_load_seg_cache(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.cs
),
4860 svm_load_seg_cache(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.ss
),
4862 svm_load_seg_cache(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.ds
),
4865 EIP
= ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.rip
));
4867 ESP
= ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.rsp
));
4868 EAX
= ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.rax
));
4869 env
->dr
[7] = ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.dr7
));
4870 env
->dr
[6] = ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.dr6
));
4871 cpu_x86_set_cpl(env
, ldub_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.cpl
)));
4873 /* FIXME: guest state consistency checks */
4875 switch(ldub_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.tlb_ctl
))) {
4876 case TLB_CONTROL_DO_NOTHING
:
4878 case TLB_CONTROL_FLUSH_ALL_ASID
:
4879 /* FIXME: this is not 100% correct but should work for now */
4884 env
->hflags2
|= HF2_GIF_MASK
;
4886 if (int_ctl
& V_IRQ_MASK
) {
4887 env
->interrupt_request
|= CPU_INTERRUPT_VIRQ
;
4890 /* maybe we need to inject an event */
4891 event_inj
= ldl_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.event_inj
));
4892 if (event_inj
& SVM_EVTINJ_VALID
) {
4893 uint8_t vector
= event_inj
& SVM_EVTINJ_VEC_MASK
;
4894 uint16_t valid_err
= event_inj
& SVM_EVTINJ_VALID_ERR
;
4895 uint32_t event_inj_err
= ldl_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.event_inj_err
));
4896 stl_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.event_inj
), event_inj
& ~SVM_EVTINJ_VALID
);
4898 if (loglevel
& CPU_LOG_TB_IN_ASM
)
4899 fprintf(logfile
, "Injecting(%#hx): ", valid_err
);
4900 /* FIXME: need to implement valid_err */
4901 switch (event_inj
& SVM_EVTINJ_TYPE_MASK
) {
4902 case SVM_EVTINJ_TYPE_INTR
:
4903 env
->exception_index
= vector
;
4904 env
->error_code
= event_inj_err
;
4905 env
->exception_is_int
= 0;
4906 env
->exception_next_eip
= -1;
4907 if (loglevel
& CPU_LOG_TB_IN_ASM
)
4908 fprintf(logfile
, "INTR");
4909 /* XXX: is it always correct ? */
4910 do_interrupt(vector
, 0, 0, 0, 1);
4912 case SVM_EVTINJ_TYPE_NMI
:
4913 env
->exception_index
= EXCP02_NMI
;
4914 env
->error_code
= event_inj_err
;
4915 env
->exception_is_int
= 0;
4916 env
->exception_next_eip
= EIP
;
4917 if (loglevel
& CPU_LOG_TB_IN_ASM
)
4918 fprintf(logfile
, "NMI");
4921 case SVM_EVTINJ_TYPE_EXEPT
:
4922 env
->exception_index
= vector
;
4923 env
->error_code
= event_inj_err
;
4924 env
->exception_is_int
= 0;
4925 env
->exception_next_eip
= -1;
4926 if (loglevel
& CPU_LOG_TB_IN_ASM
)
4927 fprintf(logfile
, "EXEPT");
4930 case SVM_EVTINJ_TYPE_SOFT
:
4931 env
->exception_index
= vector
;
4932 env
->error_code
= event_inj_err
;
4933 env
->exception_is_int
= 1;
4934 env
->exception_next_eip
= EIP
;
4935 if (loglevel
& CPU_LOG_TB_IN_ASM
)
4936 fprintf(logfile
, "SOFT");
4940 if (loglevel
& CPU_LOG_TB_IN_ASM
)
4941 fprintf(logfile
, " %#x %#x\n", env
->exception_index
, env
->error_code
);
4945 void helper_vmmcall(void)
4947 helper_svm_check_intercept_param(SVM_EXIT_VMMCALL
, 0);
4948 raise_exception(EXCP06_ILLOP
);
4951 void helper_vmload(int aflag
)
4954 helper_svm_check_intercept_param(SVM_EXIT_VMLOAD
, 0);
4959 addr
= (uint32_t)EAX
;
4961 if (loglevel
& CPU_LOG_TB_IN_ASM
)
4962 fprintf(logfile
,"vmload! " TARGET_FMT_lx
"\nFS: %016" PRIx64
" | " TARGET_FMT_lx
"\n",
4963 addr
, ldq_phys(addr
+ offsetof(struct vmcb
, save
.fs
.base
)),
4964 env
->segs
[R_FS
].base
);
4966 svm_load_seg_cache(addr
+ offsetof(struct vmcb
, save
.fs
),
4968 svm_load_seg_cache(addr
+ offsetof(struct vmcb
, save
.gs
),
4970 svm_load_seg(addr
+ offsetof(struct vmcb
, save
.tr
),
4972 svm_load_seg(addr
+ offsetof(struct vmcb
, save
.ldtr
),
4975 #ifdef TARGET_X86_64
4976 env
->kernelgsbase
= ldq_phys(addr
+ offsetof(struct vmcb
, save
.kernel_gs_base
));
4977 env
->lstar
= ldq_phys(addr
+ offsetof(struct vmcb
, save
.lstar
));
4978 env
->cstar
= ldq_phys(addr
+ offsetof(struct vmcb
, save
.cstar
));
4979 env
->fmask
= ldq_phys(addr
+ offsetof(struct vmcb
, save
.sfmask
));
4981 env
->star
= ldq_phys(addr
+ offsetof(struct vmcb
, save
.star
));
4982 env
->sysenter_cs
= ldq_phys(addr
+ offsetof(struct vmcb
, save
.sysenter_cs
));
4983 env
->sysenter_esp
= ldq_phys(addr
+ offsetof(struct vmcb
, save
.sysenter_esp
));
4984 env
->sysenter_eip
= ldq_phys(addr
+ offsetof(struct vmcb
, save
.sysenter_eip
));
4987 void helper_vmsave(int aflag
)
4990 helper_svm_check_intercept_param(SVM_EXIT_VMSAVE
, 0);
4995 addr
= (uint32_t)EAX
;
4997 if (loglevel
& CPU_LOG_TB_IN_ASM
)
4998 fprintf(logfile
,"vmsave! " TARGET_FMT_lx
"\nFS: %016" PRIx64
" | " TARGET_FMT_lx
"\n",
4999 addr
, ldq_phys(addr
+ offsetof(struct vmcb
, save
.fs
.base
)),
5000 env
->segs
[R_FS
].base
);
5002 svm_save_seg(addr
+ offsetof(struct vmcb
, save
.fs
),
5004 svm_save_seg(addr
+ offsetof(struct vmcb
, save
.gs
),
5006 svm_save_seg(addr
+ offsetof(struct vmcb
, save
.tr
),
5008 svm_save_seg(addr
+ offsetof(struct vmcb
, save
.ldtr
),
5011 #ifdef TARGET_X86_64
5012 stq_phys(addr
+ offsetof(struct vmcb
, save
.kernel_gs_base
), env
->kernelgsbase
);
5013 stq_phys(addr
+ offsetof(struct vmcb
, save
.lstar
), env
->lstar
);
5014 stq_phys(addr
+ offsetof(struct vmcb
, save
.cstar
), env
->cstar
);
5015 stq_phys(addr
+ offsetof(struct vmcb
, save
.sfmask
), env
->fmask
);
5017 stq_phys(addr
+ offsetof(struct vmcb
, save
.star
), env
->star
);
5018 stq_phys(addr
+ offsetof(struct vmcb
, save
.sysenter_cs
), env
->sysenter_cs
);
5019 stq_phys(addr
+ offsetof(struct vmcb
, save
.sysenter_esp
), env
->sysenter_esp
);
5020 stq_phys(addr
+ offsetof(struct vmcb
, save
.sysenter_eip
), env
->sysenter_eip
);
5023 void helper_stgi(void)
5025 helper_svm_check_intercept_param(SVM_EXIT_STGI
, 0);
5026 env
->hflags2
|= HF2_GIF_MASK
;
5029 void helper_clgi(void)
5031 helper_svm_check_intercept_param(SVM_EXIT_CLGI
, 0);
5032 env
->hflags2
&= ~HF2_GIF_MASK
;
5035 void helper_skinit(void)
5037 helper_svm_check_intercept_param(SVM_EXIT_SKINIT
, 0);
5038 /* XXX: not implemented */
5039 raise_exception(EXCP06_ILLOP
);
5042 void helper_invlpga(int aflag
)
5045 helper_svm_check_intercept_param(SVM_EXIT_INVLPGA
, 0);
5050 addr
= (uint32_t)EAX
;
5052 /* XXX: could use the ASID to see if it is needed to do the
5054 tlb_flush_page(env
, addr
);
5057 void helper_svm_check_intercept_param(uint32_t type
, uint64_t param
)
5059 if (likely(!(env
->hflags
& HF_SVMI_MASK
)))
5062 case SVM_EXIT_READ_CR0
... SVM_EXIT_READ_CR0
+ 8:
5063 if (env
->intercept_cr_read
& (1 << (type
- SVM_EXIT_READ_CR0
))) {
5064 helper_vmexit(type
, param
);
5067 case SVM_EXIT_WRITE_CR0
... SVM_EXIT_WRITE_CR0
+ 8:
5068 if (env
->intercept_cr_write
& (1 << (type
- SVM_EXIT_WRITE_CR0
))) {
5069 helper_vmexit(type
, param
);
5072 case SVM_EXIT_READ_DR0
... SVM_EXIT_READ_DR0
+ 7:
5073 if (env
->intercept_dr_read
& (1 << (type
- SVM_EXIT_READ_DR0
))) {
5074 helper_vmexit(type
, param
);
5077 case SVM_EXIT_WRITE_DR0
... SVM_EXIT_WRITE_DR0
+ 7:
5078 if (env
->intercept_dr_write
& (1 << (type
- SVM_EXIT_WRITE_DR0
))) {
5079 helper_vmexit(type
, param
);
5082 case SVM_EXIT_EXCP_BASE
... SVM_EXIT_EXCP_BASE
+ 31:
5083 if (env
->intercept_exceptions
& (1 << (type
- SVM_EXIT_EXCP_BASE
))) {
5084 helper_vmexit(type
, param
);
5088 if (env
->intercept
& (1ULL << (SVM_EXIT_MSR
- SVM_EXIT_INTR
))) {
5089 /* FIXME: this should be read in at vmrun (faster this way?) */
5090 uint64_t addr
= ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.msrpm_base_pa
));
5092 switch((uint32_t)ECX
) {
5097 case 0xc0000000 ... 0xc0001fff:
5098 t0
= (8192 + ECX
- 0xc0000000) * 2;
5102 case 0xc0010000 ... 0xc0011fff:
5103 t0
= (16384 + ECX
- 0xc0010000) * 2;
5108 helper_vmexit(type
, param
);
5113 if (ldub_phys(addr
+ t1
) & ((1 << param
) << t0
))
5114 helper_vmexit(type
, param
);
5118 if (env
->intercept
& (1ULL << (type
- SVM_EXIT_INTR
))) {
5119 helper_vmexit(type
, param
);
5125 void helper_svm_check_io(uint32_t port
, uint32_t param
,
5126 uint32_t next_eip_addend
)
5128 if (env
->intercept
& (1ULL << (SVM_EXIT_IOIO
- SVM_EXIT_INTR
))) {
5129 /* FIXME: this should be read in at vmrun (faster this way?) */
5130 uint64_t addr
= ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.iopm_base_pa
));
5131 uint16_t mask
= (1 << ((param
>> 4) & 7)) - 1;
5132 if(lduw_phys(addr
+ port
/ 8) & (mask
<< (port
& 7))) {
5134 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.exit_info_2
),
5135 env
->eip
+ next_eip_addend
);
5136 helper_vmexit(SVM_EXIT_IOIO
, param
| (port
<< 16));
5141 /* Note: currently only 32 bits of exit_code are used */
5142 void helper_vmexit(uint32_t exit_code
, uint64_t exit_info_1
)
5146 if (loglevel
& CPU_LOG_TB_IN_ASM
)
5147 fprintf(logfile
,"vmexit(%08x, %016" PRIx64
", %016" PRIx64
", " TARGET_FMT_lx
")!\n",
5148 exit_code
, exit_info_1
,
5149 ldq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.exit_info_2
)),
5152 if(env
->hflags
& HF_INHIBIT_IRQ_MASK
) {
5153 stl_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.int_state
), SVM_INTERRUPT_SHADOW_MASK
);
5154 env
->hflags
&= ~HF_INHIBIT_IRQ_MASK
;
5156 stl_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.int_state
), 0);
5159 /* Save the VM state in the vmcb */
5160 svm_save_seg(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.es
),
5162 svm_save_seg(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.cs
),
5164 svm_save_seg(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.ss
),
5166 svm_save_seg(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.ds
),
5169 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.gdtr
.base
), env
->gdt
.base
);
5170 stl_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.gdtr
.limit
), env
->gdt
.limit
);
5172 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.idtr
.base
), env
->idt
.base
);
5173 stl_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.idtr
.limit
), env
->idt
.limit
);
5175 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.efer
), env
->efer
);
5176 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.cr0
), env
->cr
[0]);
5177 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.cr2
), env
->cr
[2]);
5178 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.cr3
), env
->cr
[3]);
5179 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.cr4
), env
->cr
[4]);
5181 int_ctl
= ldl_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.int_ctl
));
5182 int_ctl
&= ~(V_TPR_MASK
| V_IRQ_MASK
);
5183 int_ctl
|= env
->v_tpr
& V_TPR_MASK
;
5184 if (env
->interrupt_request
& CPU_INTERRUPT_VIRQ
)
5185 int_ctl
|= V_IRQ_MASK
;
5186 stl_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.int_ctl
), int_ctl
);
5188 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.rflags
), compute_eflags());
5189 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.rip
), env
->eip
);
5190 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.rsp
), ESP
);
5191 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.rax
), EAX
);
5192 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.dr7
), env
->dr
[7]);
5193 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.dr6
), env
->dr
[6]);
5194 stb_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, save
.cpl
), env
->hflags
& HF_CPL_MASK
);
5196 /* Reload the host state from vm_hsave */
5197 env
->hflags2
&= ~(HF2_HIF_MASK
| HF2_VINTR_MASK
);
5198 env
->hflags
&= ~HF_SVMI_MASK
;
5200 env
->intercept_exceptions
= 0;
5201 env
->interrupt_request
&= ~CPU_INTERRUPT_VIRQ
;
5202 env
->tsc_offset
= 0;
5204 env
->gdt
.base
= ldq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.gdtr
.base
));
5205 env
->gdt
.limit
= ldl_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.gdtr
.limit
));
5207 env
->idt
.base
= ldq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.idtr
.base
));
5208 env
->idt
.limit
= ldl_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.idtr
.limit
));
5210 cpu_x86_update_cr0(env
, ldq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.cr0
)) | CR0_PE_MASK
);
5211 cpu_x86_update_cr4(env
, ldq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.cr4
)));
5212 cpu_x86_update_cr3(env
, ldq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.cr3
)));
5213 /* we need to set the efer after the crs so the hidden flags get
5216 ldq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.efer
)));
5218 load_eflags(ldq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.rflags
)),
5219 ~(CC_O
| CC_S
| CC_Z
| CC_A
| CC_P
| CC_C
| DF_MASK
));
5220 CC_OP
= CC_OP_EFLAGS
;
5222 svm_load_seg_cache(env
->vm_hsave
+ offsetof(struct vmcb
, save
.es
),
5224 svm_load_seg_cache(env
->vm_hsave
+ offsetof(struct vmcb
, save
.cs
),
5226 svm_load_seg_cache(env
->vm_hsave
+ offsetof(struct vmcb
, save
.ss
),
5228 svm_load_seg_cache(env
->vm_hsave
+ offsetof(struct vmcb
, save
.ds
),
5231 EIP
= ldq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.rip
));
5232 ESP
= ldq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.rsp
));
5233 EAX
= ldq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.rax
));
5235 env
->dr
[6] = ldq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.dr6
));
5236 env
->dr
[7] = ldq_phys(env
->vm_hsave
+ offsetof(struct vmcb
, save
.dr7
));
5239 cpu_x86_set_cpl(env
, 0);
5240 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.exit_code
), exit_code
);
5241 stq_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.exit_info_1
), exit_info_1
);
5243 env
->hflags2
&= ~HF2_GIF_MASK
;
5244 /* FIXME: Resets the current ASID register to zero (host ASID). */
5246 /* Clears the V_IRQ and V_INTR_MASKING bits inside the processor. */
5248 /* Clears the TSC_OFFSET inside the processor. */
5250 /* If the host is in PAE mode, the processor reloads the host's PDPEs
5251 from the page table indicated the host's CR3. If the PDPEs contain
5252 illegal state, the processor causes a shutdown. */
5254 /* Forces CR0.PE = 1, RFLAGS.VM = 0. */
5255 env
->cr
[0] |= CR0_PE_MASK
;
5256 env
->eflags
&= ~VM_MASK
;
5258 /* Disables all breakpoints in the host DR7 register. */
5260 /* Checks the reloaded host state for consistency. */
5262 /* If the host's rIP reloaded by #VMEXIT is outside the limit of the
5263 host's code segment or non-canonical (in the case of long mode), a
5264 #GP fault is delivered inside the host.) */
5266 /* remove any pending exception */
5267 env
->exception_index
= -1;
5268 env
->error_code
= 0;
5269 env
->old_exception
= -1;
5277 /* XXX: optimize by storing fptt and fptags in the static cpu state */
5278 void helper_enter_mmx(void)
5281 *(uint32_t *)(env
->fptags
) = 0;
5282 *(uint32_t *)(env
->fptags
+ 4) = 0;
5285 void helper_emms(void)
5287 /* set to empty state */
5288 *(uint32_t *)(env
->fptags
) = 0x01010101;
5289 *(uint32_t *)(env
->fptags
+ 4) = 0x01010101;
5293 void helper_movq(void *d
, void *s
)
5295 *(uint64_t *)d
= *(uint64_t *)s
;
5299 #include "ops_sse.h"
5302 #include "ops_sse.h"
5305 #include "helper_template.h"
5309 #include "helper_template.h"
5313 #include "helper_template.h"
5316 #ifdef TARGET_X86_64
5319 #include "helper_template.h"
5324 /* bit operations */
5325 target_ulong
helper_bsf(target_ulong t0
)
5332 while ((res
& 1) == 0) {
5339 target_ulong
helper_bsr(target_ulong t0
)
5342 target_ulong res
, mask
;
5345 count
= TARGET_LONG_BITS
- 1;
5346 mask
= (target_ulong
)1 << (TARGET_LONG_BITS
- 1);
5347 while ((res
& mask
) == 0) {
5355 static int compute_all_eflags(void)
5360 static int compute_c_eflags(void)
5362 return CC_SRC
& CC_C
;
5365 uint32_t helper_cc_compute_all(int op
)
5368 default: /* should never happen */ return 0;
5370 case CC_OP_EFLAGS
: return compute_all_eflags();
5372 case CC_OP_MULB
: return compute_all_mulb();
5373 case CC_OP_MULW
: return compute_all_mulw();
5374 case CC_OP_MULL
: return compute_all_mull();
5376 case CC_OP_ADDB
: return compute_all_addb();
5377 case CC_OP_ADDW
: return compute_all_addw();
5378 case CC_OP_ADDL
: return compute_all_addl();
5380 case CC_OP_ADCB
: return compute_all_adcb();
5381 case CC_OP_ADCW
: return compute_all_adcw();
5382 case CC_OP_ADCL
: return compute_all_adcl();
5384 case CC_OP_SUBB
: return compute_all_subb();
5385 case CC_OP_SUBW
: return compute_all_subw();
5386 case CC_OP_SUBL
: return compute_all_subl();
5388 case CC_OP_SBBB
: return compute_all_sbbb();
5389 case CC_OP_SBBW
: return compute_all_sbbw();
5390 case CC_OP_SBBL
: return compute_all_sbbl();
5392 case CC_OP_LOGICB
: return compute_all_logicb();
5393 case CC_OP_LOGICW
: return compute_all_logicw();
5394 case CC_OP_LOGICL
: return compute_all_logicl();
5396 case CC_OP_INCB
: return compute_all_incb();
5397 case CC_OP_INCW
: return compute_all_incw();
5398 case CC_OP_INCL
: return compute_all_incl();
5400 case CC_OP_DECB
: return compute_all_decb();
5401 case CC_OP_DECW
: return compute_all_decw();
5402 case CC_OP_DECL
: return compute_all_decl();
5404 case CC_OP_SHLB
: return compute_all_shlb();
5405 case CC_OP_SHLW
: return compute_all_shlw();
5406 case CC_OP_SHLL
: return compute_all_shll();
5408 case CC_OP_SARB
: return compute_all_sarb();
5409 case CC_OP_SARW
: return compute_all_sarw();
5410 case CC_OP_SARL
: return compute_all_sarl();
5412 #ifdef TARGET_X86_64
5413 case CC_OP_MULQ
: return compute_all_mulq();
5415 case CC_OP_ADDQ
: return compute_all_addq();
5417 case CC_OP_ADCQ
: return compute_all_adcq();
5419 case CC_OP_SUBQ
: return compute_all_subq();
5421 case CC_OP_SBBQ
: return compute_all_sbbq();
5423 case CC_OP_LOGICQ
: return compute_all_logicq();
5425 case CC_OP_INCQ
: return compute_all_incq();
5427 case CC_OP_DECQ
: return compute_all_decq();
5429 case CC_OP_SHLQ
: return compute_all_shlq();
5431 case CC_OP_SARQ
: return compute_all_sarq();
5436 uint32_t helper_cc_compute_c(int op
)
5439 default: /* should never happen */ return 0;
5441 case CC_OP_EFLAGS
: return compute_c_eflags();
5443 case CC_OP_MULB
: return compute_c_mull();
5444 case CC_OP_MULW
: return compute_c_mull();
5445 case CC_OP_MULL
: return compute_c_mull();
5447 case CC_OP_ADDB
: return compute_c_addb();
5448 case CC_OP_ADDW
: return compute_c_addw();
5449 case CC_OP_ADDL
: return compute_c_addl();
5451 case CC_OP_ADCB
: return compute_c_adcb();
5452 case CC_OP_ADCW
: return compute_c_adcw();
5453 case CC_OP_ADCL
: return compute_c_adcl();
5455 case CC_OP_SUBB
: return compute_c_subb();
5456 case CC_OP_SUBW
: return compute_c_subw();
5457 case CC_OP_SUBL
: return compute_c_subl();
5459 case CC_OP_SBBB
: return compute_c_sbbb();
5460 case CC_OP_SBBW
: return compute_c_sbbw();
5461 case CC_OP_SBBL
: return compute_c_sbbl();
5463 case CC_OP_LOGICB
: return compute_c_logicb();
5464 case CC_OP_LOGICW
: return compute_c_logicw();
5465 case CC_OP_LOGICL
: return compute_c_logicl();
5467 case CC_OP_INCB
: return compute_c_incl();
5468 case CC_OP_INCW
: return compute_c_incl();
5469 case CC_OP_INCL
: return compute_c_incl();
5471 case CC_OP_DECB
: return compute_c_incl();
5472 case CC_OP_DECW
: return compute_c_incl();
5473 case CC_OP_DECL
: return compute_c_incl();
5475 case CC_OP_SHLB
: return compute_c_shlb();
5476 case CC_OP_SHLW
: return compute_c_shlw();
5477 case CC_OP_SHLL
: return compute_c_shll();
5479 case CC_OP_SARB
: return compute_c_sarl();
5480 case CC_OP_SARW
: return compute_c_sarl();
5481 case CC_OP_SARL
: return compute_c_sarl();
5483 #ifdef TARGET_X86_64
5484 case CC_OP_MULQ
: return compute_c_mull();
5486 case CC_OP_ADDQ
: return compute_c_addq();
5488 case CC_OP_ADCQ
: return compute_c_adcq();
5490 case CC_OP_SUBQ
: return compute_c_subq();
5492 case CC_OP_SBBQ
: return compute_c_sbbq();
5494 case CC_OP_LOGICQ
: return compute_c_logicq();
5496 case CC_OP_INCQ
: return compute_c_incl();
5498 case CC_OP_DECQ
: return compute_c_incl();
5500 case CC_OP_SHLQ
: return compute_c_shlq();
5502 case CC_OP_SARQ
: return compute_c_sarl();