]> git.proxmox.com Git - qemu.git/blob - target-i386/seg_helper.c
projects / qemu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
x86: avoid AREG0 in segmentation helpers
[qemu.git] / target-i386 / seg_helper.c
1 /*
2 * x86 segmentation related helpers:
3 * TSS, interrupts, system calls, jumps and call/task gates, descriptors
4 *
5 * Copyright (c) 2003 Fabrice Bellard
6 *
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "cpu.h"
22 #include "qemu-log.h"
23 #include "helper.h"
24
25 //#define DEBUG_PCALL
26
27 #ifdef DEBUG_PCALL
28 # define LOG_PCALL(...) qemu_log_mask(CPU_LOG_PCALL, ## __VA_ARGS__)
29 # define LOG_PCALL_STATE(env) \
30 log_cpu_state_mask(CPU_LOG_PCALL, (env), X86_DUMP_CCOP)
31 #else
32 # define LOG_PCALL(...) do { } while (0)
33 # define LOG_PCALL_STATE(env) do { } while (0)
34 #endif
35
36 /* return non zero if error */
37 static inline int load_segment(CPUX86State *env, uint32_t *e1_ptr,
38 uint32_t *e2_ptr, int selector)
39 {
40 SegmentCache *dt;
41 int index;
42 target_ulong ptr;
43
44 if (selector & 0x4) {
45 dt = &env->ldt;
46 } else {
47 dt = &env->gdt;
48 }
49 index = selector & ~7;
50 if ((index + 7) > dt->limit) {
51 return -1;
52 }
53 ptr = dt->base + index;
54 *e1_ptr = cpu_ldl_kernel(env, ptr);
55 *e2_ptr = cpu_ldl_kernel(env, ptr + 4);
56 return 0;
57 }
58
59 static inline unsigned int get_seg_limit(uint32_t e1, uint32_t e2)
60 {
61 unsigned int limit;
62
63 limit = (e1 & 0xffff) | (e2 & 0x000f0000);
64 if (e2 & DESC_G_MASK) {
65 limit = (limit << 12) | 0xfff;
66 }
67 return limit;
68 }
69
70 static inline uint32_t get_seg_base(uint32_t e1, uint32_t e2)
71 {
72 return (e1 >> 16) | ((e2 & 0xff) << 16) | (e2 & 0xff000000);
73 }
74
75 static inline void load_seg_cache_raw_dt(SegmentCache *sc, uint32_t e1,
76 uint32_t e2)
77 {
78 sc->base = get_seg_base(e1, e2);
79 sc->limit = get_seg_limit(e1, e2);
80 sc->flags = e2;
81 }
82
83 /* init the segment cache in vm86 mode. */
84 static inline void load_seg_vm(CPUX86State *env, int seg, int selector)
85 {
86 selector &= 0xffff;
87 cpu_x86_load_seg_cache(env, seg, selector,
88 (selector << 4), 0xffff, 0);
89 }
90
91 static inline void get_ss_esp_from_tss(CPUX86State *env, uint32_t *ss_ptr,
92 uint32_t *esp_ptr, int dpl)
93 {
94 int type, index, shift;
95
96 #if 0
97 {
98 int i;
99 printf("TR: base=%p limit=%x\n", env->tr.base, env->tr.limit);
100 for (i = 0; i < env->tr.limit; i++) {
101 printf("%02x ", env->tr.base[i]);
102 if ((i & 7) == 7) {
103 printf("\n");
104 }
105 }
106 printf("\n");
107 }
108 #endif
109
110 if (!(env->tr.flags & DESC_P_MASK)) {
111 cpu_abort(env, "invalid tss");
112 }
113 type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
114 if ((type & 7) != 1) {
115 cpu_abort(env, "invalid tss type");
116 }
117 shift = type >> 3;
118 index = (dpl * 4 + 2) << shift;
119 if (index + (4 << shift) - 1 > env->tr.limit) {
120 raise_exception_err(env, EXCP0A_TSS, env->tr.selector & 0xfffc);
121 }
122 if (shift == 0) {
123 *esp_ptr = cpu_lduw_kernel(env, env->tr.base + index);
124 *ss_ptr = cpu_lduw_kernel(env, env->tr.base + index + 2);
125 } else {
126 *esp_ptr = cpu_ldl_kernel(env, env->tr.base + index);
127 *ss_ptr = cpu_lduw_kernel(env, env->tr.base + index + 4);
128 }
129 }
130
131 /* XXX: merge with load_seg() */
132 static void tss_load_seg(CPUX86State *env, int seg_reg, int selector)
133 {
134 uint32_t e1, e2;
135 int rpl, dpl, cpl;
136
137 if ((selector & 0xfffc) != 0) {
138 if (load_segment(env, &e1, &e2, selector) != 0) {
139 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
140 }
141 if (!(e2 & DESC_S_MASK)) {
142 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
143 }
144 rpl = selector & 3;
145 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
146 cpl = env->hflags & HF_CPL_MASK;
147 if (seg_reg == R_CS) {
148 if (!(e2 & DESC_CS_MASK)) {
149 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
150 }
151 /* XXX: is it correct? */
152 if (dpl != rpl) {
153 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
154 }
155 if ((e2 & DESC_C_MASK) && dpl > rpl) {
156 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
157 }
158 } else if (seg_reg == R_SS) {
159 /* SS must be writable data */
160 if ((e2 & DESC_CS_MASK) || !(e2 & DESC_W_MASK)) {
161 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
162 }
163 if (dpl != cpl || dpl != rpl) {
164 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
165 }
166 } else {
167 /* not readable code */
168 if ((e2 & DESC_CS_MASK) && !(e2 & DESC_R_MASK)) {
169 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
170 }
171 /* if data or non conforming code, checks the rights */
172 if (((e2 >> DESC_TYPE_SHIFT) & 0xf) < 12) {
173 if (dpl < cpl || dpl < rpl) {
174 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
175 }
176 }
177 }
178 if (!(e2 & DESC_P_MASK)) {
179 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc);
180 }
181 cpu_x86_load_seg_cache(env, seg_reg, selector,
182 get_seg_base(e1, e2),
183 get_seg_limit(e1, e2),
184 e2);
185 } else {
186 if (seg_reg == R_SS || seg_reg == R_CS) {
187 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
188 }
189 }
190 }
191
192 #define SWITCH_TSS_JMP 0
193 #define SWITCH_TSS_IRET 1
194 #define SWITCH_TSS_CALL 2
195
196 /* XXX: restore CPU state in registers (PowerPC case) */
197 static void switch_tss(CPUX86State *env, int tss_selector,
198 uint32_t e1, uint32_t e2, int source,
199 uint32_t next_eip)
200 {
201 int tss_limit, tss_limit_max, type, old_tss_limit_max, old_type, v1, v2, i;
202 target_ulong tss_base;
203 uint32_t new_regs[8], new_segs[6];
204 uint32_t new_eflags, new_eip, new_cr3, new_ldt, new_trap;
205 uint32_t old_eflags, eflags_mask;
206 SegmentCache *dt;
207 int index;
208 target_ulong ptr;
209
210 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
211 LOG_PCALL("switch_tss: sel=0x%04x type=%d src=%d\n", tss_selector, type,
212 source);
213
214 /* if task gate, we read the TSS segment and we load it */
215 if (type == 5) {
216 if (!(e2 & DESC_P_MASK)) {
217 raise_exception_err(env, EXCP0B_NOSEG, tss_selector & 0xfffc);
218 }
219 tss_selector = e1 >> 16;
220 if (tss_selector & 4) {
221 raise_exception_err(env, EXCP0A_TSS, tss_selector & 0xfffc);
222 }
223 if (load_segment(env, &e1, &e2, tss_selector) != 0) {
224 raise_exception_err(env, EXCP0D_GPF, tss_selector & 0xfffc);
225 }
226 if (e2 & DESC_S_MASK) {
227 raise_exception_err(env, EXCP0D_GPF, tss_selector & 0xfffc);
228 }
229 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
230 if ((type & 7) != 1) {
231 raise_exception_err(env, EXCP0D_GPF, tss_selector & 0xfffc);
232 }
233 }
234
235 if (!(e2 & DESC_P_MASK)) {
236 raise_exception_err(env, EXCP0B_NOSEG, tss_selector & 0xfffc);
237 }
238
239 if (type & 8) {
240 tss_limit_max = 103;
241 } else {
242 tss_limit_max = 43;
243 }
244 tss_limit = get_seg_limit(e1, e2);
245 tss_base = get_seg_base(e1, e2);
246 if ((tss_selector & 4) != 0 ||
247 tss_limit < tss_limit_max) {
248 raise_exception_err(env, EXCP0A_TSS, tss_selector & 0xfffc);
249 }
250 old_type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
251 if (old_type & 8) {
252 old_tss_limit_max = 103;
253 } else {
254 old_tss_limit_max = 43;
255 }
256
257 /* read all the registers from the new TSS */
258 if (type & 8) {
259 /* 32 bit */
260 new_cr3 = cpu_ldl_kernel(env, tss_base + 0x1c);
261 new_eip = cpu_ldl_kernel(env, tss_base + 0x20);
262 new_eflags = cpu_ldl_kernel(env, tss_base + 0x24);
263 for (i = 0; i < 8; i++) {
264 new_regs[i] = cpu_ldl_kernel(env, tss_base + (0x28 + i * 4));
265 }
266 for (i = 0; i < 6; i++) {
267 new_segs[i] = cpu_lduw_kernel(env, tss_base + (0x48 + i * 4));
268 }
269 new_ldt = cpu_lduw_kernel(env, tss_base + 0x60);
270 new_trap = cpu_ldl_kernel(env, tss_base + 0x64);
271 } else {
272 /* 16 bit */
273 new_cr3 = 0;
274 new_eip = cpu_lduw_kernel(env, tss_base + 0x0e);
275 new_eflags = cpu_lduw_kernel(env, tss_base + 0x10);
276 for (i = 0; i < 8; i++) {
277 new_regs[i] = cpu_lduw_kernel(env, tss_base + (0x12 + i * 2)) |
278 0xffff0000;
279 }
280 for (i = 0; i < 4; i++) {
281 new_segs[i] = cpu_lduw_kernel(env, tss_base + (0x22 + i * 4));
282 }
283 new_ldt = cpu_lduw_kernel(env, tss_base + 0x2a);
284 new_segs[R_FS] = 0;
285 new_segs[R_GS] = 0;
286 new_trap = 0;
287 }
288 /* XXX: avoid a compiler warning, see
289 http://support.amd.com/us/Processor_TechDocs/24593.pdf
290 chapters 12.2.5 and 13.2.4 on how to implement TSS Trap bit */
291 (void)new_trap;
292
293 /* NOTE: we must avoid memory exceptions during the task switch,
294 so we make dummy accesses before */
295 /* XXX: it can still fail in some cases, so a bigger hack is
296 necessary to valid the TLB after having done the accesses */
297
298 v1 = cpu_ldub_kernel(env, env->tr.base);
299 v2 = cpu_ldub_kernel(env, env->tr.base + old_tss_limit_max);
300 cpu_stb_kernel(env, env->tr.base, v1);
301 cpu_stb_kernel(env, env->tr.base + old_tss_limit_max, v2);
302
303 /* clear busy bit (it is restartable) */
304 if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_IRET) {
305 target_ulong ptr;
306 uint32_t e2;
307
308 ptr = env->gdt.base + (env->tr.selector & ~7);
309 e2 = cpu_ldl_kernel(env, ptr + 4);
310 e2 &= ~DESC_TSS_BUSY_MASK;
311 cpu_stl_kernel(env, ptr + 4, e2);
312 }
313 old_eflags = cpu_compute_eflags(env);
314 if (source == SWITCH_TSS_IRET) {
315 old_eflags &= ~NT_MASK;
316 }
317
318 /* save the current state in the old TSS */
319 if (type & 8) {
320 /* 32 bit */
321 cpu_stl_kernel(env, env->tr.base + 0x20, next_eip);
322 cpu_stl_kernel(env, env->tr.base + 0x24, old_eflags);
323 cpu_stl_kernel(env, env->tr.base + (0x28 + 0 * 4), EAX);
324 cpu_stl_kernel(env, env->tr.base + (0x28 + 1 * 4), ECX);
325 cpu_stl_kernel(env, env->tr.base + (0x28 + 2 * 4), EDX);
326 cpu_stl_kernel(env, env->tr.base + (0x28 + 3 * 4), EBX);
327 cpu_stl_kernel(env, env->tr.base + (0x28 + 4 * 4), ESP);
328 cpu_stl_kernel(env, env->tr.base + (0x28 + 5 * 4), EBP);
329 cpu_stl_kernel(env, env->tr.base + (0x28 + 6 * 4), ESI);
330 cpu_stl_kernel(env, env->tr.base + (0x28 + 7 * 4), EDI);
331 for (i = 0; i < 6; i++) {
332 cpu_stw_kernel(env, env->tr.base + (0x48 + i * 4),
333 env->segs[i].selector);
334 }
335 } else {
336 /* 16 bit */
337 cpu_stw_kernel(env, env->tr.base + 0x0e, next_eip);
338 cpu_stw_kernel(env, env->tr.base + 0x10, old_eflags);
339 cpu_stw_kernel(env, env->tr.base + (0x12 + 0 * 2), EAX);
340 cpu_stw_kernel(env, env->tr.base + (0x12 + 1 * 2), ECX);
341 cpu_stw_kernel(env, env->tr.base + (0x12 + 2 * 2), EDX);
342 cpu_stw_kernel(env, env->tr.base + (0x12 + 3 * 2), EBX);
343 cpu_stw_kernel(env, env->tr.base + (0x12 + 4 * 2), ESP);
344 cpu_stw_kernel(env, env->tr.base + (0x12 + 5 * 2), EBP);
345 cpu_stw_kernel(env, env->tr.base + (0x12 + 6 * 2), ESI);
346 cpu_stw_kernel(env, env->tr.base + (0x12 + 7 * 2), EDI);
347 for (i = 0; i < 4; i++) {
348 cpu_stw_kernel(env, env->tr.base + (0x22 + i * 4),
349 env->segs[i].selector);
350 }
351 }
352
353 /* now if an exception occurs, it will occurs in the next task
354 context */
355
356 if (source == SWITCH_TSS_CALL) {
357 cpu_stw_kernel(env, tss_base, env->tr.selector);
358 new_eflags |= NT_MASK;
359 }
360
361 /* set busy bit */
362 if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_CALL) {
363 target_ulong ptr;
364 uint32_t e2;
365
366 ptr = env->gdt.base + (tss_selector & ~7);
367 e2 = cpu_ldl_kernel(env, ptr + 4);
368 e2 |= DESC_TSS_BUSY_MASK;
369 cpu_stl_kernel(env, ptr + 4, e2);
370 }
371
372 /* set the new CPU state */
373 /* from this point, any exception which occurs can give problems */
374 env->cr[0] |= CR0_TS_MASK;
375 env->hflags |= HF_TS_MASK;
376 env->tr.selector = tss_selector;
377 env->tr.base = tss_base;
378 env->tr.limit = tss_limit;
379 env->tr.flags = e2 & ~DESC_TSS_BUSY_MASK;
380
381 if ((type & 8) && (env->cr[0] & CR0_PG_MASK)) {
382 cpu_x86_update_cr3(env, new_cr3);
383 }
384
385 /* load all registers without an exception, then reload them with
386 possible exception */
387 env->eip = new_eip;
388 eflags_mask = TF_MASK | AC_MASK | ID_MASK |
389 IF_MASK | IOPL_MASK | VM_MASK | RF_MASK | NT_MASK;
390 if (!(type & 8)) {
391 eflags_mask &= 0xffff;
392 }
393 cpu_load_eflags(env, new_eflags, eflags_mask);
394 /* XXX: what to do in 16 bit case? */
395 EAX = new_regs[0];
396 ECX = new_regs[1];
397 EDX = new_regs[2];
398 EBX = new_regs[3];
399 ESP = new_regs[4];
400 EBP = new_regs[5];
401 ESI = new_regs[6];
402 EDI = new_regs[7];
403 if (new_eflags & VM_MASK) {
404 for (i = 0; i < 6; i++) {
405 load_seg_vm(env, i, new_segs[i]);
406 }
407 /* in vm86, CPL is always 3 */
408 cpu_x86_set_cpl(env, 3);
409 } else {
410 /* CPL is set the RPL of CS */
411 cpu_x86_set_cpl(env, new_segs[R_CS] & 3);
412 /* first just selectors as the rest may trigger exceptions */
413 for (i = 0; i < 6; i++) {
414 cpu_x86_load_seg_cache(env, i, new_segs[i], 0, 0, 0);
415 }
416 }
417
418 env->ldt.selector = new_ldt & ~4;
419 env->ldt.base = 0;
420 env->ldt.limit = 0;
421 env->ldt.flags = 0;
422
423 /* load the LDT */
424 if (new_ldt & 4) {
425 raise_exception_err(env, EXCP0A_TSS, new_ldt & 0xfffc);
426 }
427
428 if ((new_ldt & 0xfffc) != 0) {
429 dt = &env->gdt;
430 index = new_ldt & ~7;
431 if ((index + 7) > dt->limit) {
432 raise_exception_err(env, EXCP0A_TSS, new_ldt & 0xfffc);
433 }
434 ptr = dt->base + index;
435 e1 = cpu_ldl_kernel(env, ptr);
436 e2 = cpu_ldl_kernel(env, ptr + 4);
437 if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2) {
438 raise_exception_err(env, EXCP0A_TSS, new_ldt & 0xfffc);
439 }
440 if (!(e2 & DESC_P_MASK)) {
441 raise_exception_err(env, EXCP0A_TSS, new_ldt & 0xfffc);
442 }
443 load_seg_cache_raw_dt(&env->ldt, e1, e2);
444 }
445
446 /* load the segments */
447 if (!(new_eflags & VM_MASK)) {
448 tss_load_seg(env, R_CS, new_segs[R_CS]);
449 tss_load_seg(env, R_SS, new_segs[R_SS]);
450 tss_load_seg(env, R_ES, new_segs[R_ES]);
451 tss_load_seg(env, R_DS, new_segs[R_DS]);
452 tss_load_seg(env, R_FS, new_segs[R_FS]);
453 tss_load_seg(env, R_GS, new_segs[R_GS]);
454 }
455
456 /* check that EIP is in the CS segment limits */
457 if (new_eip > env->segs[R_CS].limit) {
458 /* XXX: different exception if CALL? */
459 raise_exception_err(env, EXCP0D_GPF, 0);
460 }
461
462 #ifndef CONFIG_USER_ONLY
463 /* reset local breakpoints */
464 if (env->dr[7] & 0x55) {
465 for (i = 0; i < 4; i++) {
466 if (hw_breakpoint_enabled(env->dr[7], i) == 0x1) {
467 hw_breakpoint_remove(env, i);
468 }
469 }
470 env->dr[7] &= ~0x55;
471 }
472 #endif
473 }
474
475 static inline unsigned int get_sp_mask(unsigned int e2)
476 {
477 if (e2 & DESC_B_MASK) {
478 return 0xffffffff;
479 } else {
480 return 0xffff;
481 }
482 }
483
484 static int exception_has_error_code(int intno)
485 {
486 switch (intno) {
487 case 8:
488 case 10:
489 case 11:
490 case 12:
491 case 13:
492 case 14:
493 case 17:
494 return 1;
495 }
496 return 0;
497 }
498
499 #ifdef TARGET_X86_64
500 #define SET_ESP(val, sp_mask) \
501 do { \
502 if ((sp_mask) == 0xffff) { \
503 ESP = (ESP & ~0xffff) | ((val) & 0xffff); \
504 } else if ((sp_mask) == 0xffffffffLL) { \
505 ESP = (uint32_t)(val); \
506 } else { \
507 ESP = (val); \
508 } \
509 } while (0)
510 #else
511 #define SET_ESP(val, sp_mask) \
512 do { \
513 ESP = (ESP & ~(sp_mask)) | ((val) & (sp_mask)); \
514 } while (0)
515 #endif
516
517 /* in 64-bit machines, this can overflow. So this segment addition macro
518 * can be used to trim the value to 32-bit whenever needed */
519 #define SEG_ADDL(ssp, sp, sp_mask) ((uint32_t)((ssp) + (sp & (sp_mask))))
520
521 /* XXX: add a is_user flag to have proper security support */
522 #define PUSHW(ssp, sp, sp_mask, val) \
523 { \
524 sp -= 2; \
525 cpu_stw_kernel(env, (ssp) + (sp & (sp_mask)), (val)); \
526 }
527
528 #define PUSHL(ssp, sp, sp_mask, val) \
529 { \
530 sp -= 4; \
531 cpu_stl_kernel(env, SEG_ADDL(ssp, sp, sp_mask), (uint32_t)(val)); \
532 }
533
534 #define POPW(ssp, sp, sp_mask, val) \
535 { \
536 val = cpu_lduw_kernel(env, (ssp) + (sp & (sp_mask))); \
537 sp += 2; \
538 }
539
540 #define POPL(ssp, sp, sp_mask, val) \
541 { \
542 val = (uint32_t)cpu_ldl_kernel(env, SEG_ADDL(ssp, sp, sp_mask)); \
543 sp += 4; \
544 }
545
546 /* protected mode interrupt */
547 static void do_interrupt_protected(CPUX86State *env, int intno, int is_int,
548 int error_code, unsigned int next_eip,
549 int is_hw)
550 {
551 SegmentCache *dt;
552 target_ulong ptr, ssp;
553 int type, dpl, selector, ss_dpl, cpl;
554 int has_error_code, new_stack, shift;
555 uint32_t e1, e2, offset, ss = 0, esp, ss_e1 = 0, ss_e2 = 0;
556 uint32_t old_eip, sp_mask;
557
558 has_error_code = 0;
559 if (!is_int && !is_hw) {
560 has_error_code = exception_has_error_code(intno);
561 }
562 if (is_int) {
563 old_eip = next_eip;
564 } else {
565 old_eip = env->eip;
566 }
567
568 dt = &env->idt;
569 if (intno * 8 + 7 > dt->limit) {
570 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2);
571 }
572 ptr = dt->base + intno * 8;
573 e1 = cpu_ldl_kernel(env, ptr);
574 e2 = cpu_ldl_kernel(env, ptr + 4);
575 /* check gate type */
576 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
577 switch (type) {
578 case 5: /* task gate */
579 /* must do that check here to return the correct error code */
580 if (!(e2 & DESC_P_MASK)) {
581 raise_exception_err(env, EXCP0B_NOSEG, intno * 8 + 2);
582 }
583 switch_tss(env, intno * 8, e1, e2, SWITCH_TSS_CALL, old_eip);
584 if (has_error_code) {
585 int type;
586 uint32_t mask;
587
588 /* push the error code */
589 type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
590 shift = type >> 3;
591 if (env->segs[R_SS].flags & DESC_B_MASK) {
592 mask = 0xffffffff;
593 } else {
594 mask = 0xffff;
595 }
596 esp = (ESP - (2 << shift)) & mask;
597 ssp = env->segs[R_SS].base + esp;
598 if (shift) {
599 cpu_stl_kernel(env, ssp, error_code);
600 } else {
601 cpu_stw_kernel(env, ssp, error_code);
602 }
603 SET_ESP(esp, mask);
604 }
605 return;
606 case 6: /* 286 interrupt gate */
607 case 7: /* 286 trap gate */
608 case 14: /* 386 interrupt gate */
609 case 15: /* 386 trap gate */
610 break;
611 default:
612 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2);
613 break;
614 }
615 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
616 cpl = env->hflags & HF_CPL_MASK;
617 /* check privilege if software int */
618 if (is_int && dpl < cpl) {
619 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2);
620 }
621 /* check valid bit */
622 if (!(e2 & DESC_P_MASK)) {
623 raise_exception_err(env, EXCP0B_NOSEG, intno * 8 + 2);
624 }
625 selector = e1 >> 16;
626 offset = (e2 & 0xffff0000) | (e1 & 0x0000ffff);
627 if ((selector & 0xfffc) == 0) {
628 raise_exception_err(env, EXCP0D_GPF, 0);
629 }
630 if (load_segment(env, &e1, &e2, selector) != 0) {
631 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
632 }
633 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK))) {
634 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
635 }
636 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
637 if (dpl > cpl) {
638 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
639 }
640 if (!(e2 & DESC_P_MASK)) {
641 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc);
642 }
643 if (!(e2 & DESC_C_MASK) && dpl < cpl) {
644 /* to inner privilege */
645 get_ss_esp_from_tss(env, &ss, &esp, dpl);
646 if ((ss & 0xfffc) == 0) {
647 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
648 }
649 if ((ss & 3) != dpl) {
650 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
651 }
652 if (load_segment(env, &ss_e1, &ss_e2, ss) != 0) {
653 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
654 }
655 ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
656 if (ss_dpl != dpl) {
657 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
658 }
659 if (!(ss_e2 & DESC_S_MASK) ||
660 (ss_e2 & DESC_CS_MASK) ||
661 !(ss_e2 & DESC_W_MASK)) {
662 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
663 }
664 if (!(ss_e2 & DESC_P_MASK)) {
665 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
666 }
667 new_stack = 1;
668 sp_mask = get_sp_mask(ss_e2);
669 ssp = get_seg_base(ss_e1, ss_e2);
670 } else if ((e2 & DESC_C_MASK) || dpl == cpl) {
671 /* to same privilege */
672 if (env->eflags & VM_MASK) {
673 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
674 }
675 new_stack = 0;
676 sp_mask = get_sp_mask(env->segs[R_SS].flags);
677 ssp = env->segs[R_SS].base;
678 esp = ESP;
679 dpl = cpl;
680 } else {
681 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
682 new_stack = 0; /* avoid warning */
683 sp_mask = 0; /* avoid warning */
684 ssp = 0; /* avoid warning */
685 esp = 0; /* avoid warning */
686 }
687
688 shift = type >> 3;
689
690 #if 0
691 /* XXX: check that enough room is available */
692 push_size = 6 + (new_stack << 2) + (has_error_code << 1);
693 if (env->eflags & VM_MASK) {
694 push_size += 8;
695 }
696 push_size <<= shift;
697 #endif
698 if (shift == 1) {
699 if (new_stack) {
700 if (env->eflags & VM_MASK) {
701 PUSHL(ssp, esp, sp_mask, env->segs[R_GS].selector);
702 PUSHL(ssp, esp, sp_mask, env->segs[R_FS].selector);
703 PUSHL(ssp, esp, sp_mask, env->segs[R_DS].selector);
704 PUSHL(ssp, esp, sp_mask, env->segs[R_ES].selector);
705 }
706 PUSHL(ssp, esp, sp_mask, env->segs[R_SS].selector);
707 PUSHL(ssp, esp, sp_mask, ESP);
708 }
709 PUSHL(ssp, esp, sp_mask, cpu_compute_eflags(env));
710 PUSHL(ssp, esp, sp_mask, env->segs[R_CS].selector);
711 PUSHL(ssp, esp, sp_mask, old_eip);
712 if (has_error_code) {
713 PUSHL(ssp, esp, sp_mask, error_code);
714 }
715 } else {
716 if (new_stack) {
717 if (env->eflags & VM_MASK) {
718 PUSHW(ssp, esp, sp_mask, env->segs[R_GS].selector);
719 PUSHW(ssp, esp, sp_mask, env->segs[R_FS].selector);
720 PUSHW(ssp, esp, sp_mask, env->segs[R_DS].selector);
721 PUSHW(ssp, esp, sp_mask, env->segs[R_ES].selector);
722 }
723 PUSHW(ssp, esp, sp_mask, env->segs[R_SS].selector);
724 PUSHW(ssp, esp, sp_mask, ESP);
725 }
726 PUSHW(ssp, esp, sp_mask, cpu_compute_eflags(env));
727 PUSHW(ssp, esp, sp_mask, env->segs[R_CS].selector);
728 PUSHW(ssp, esp, sp_mask, old_eip);
729 if (has_error_code) {
730 PUSHW(ssp, esp, sp_mask, error_code);
731 }
732 }
733
734 if (new_stack) {
735 if (env->eflags & VM_MASK) {
736 cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0, 0);
737 cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0, 0);
738 cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0, 0);
739 cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0, 0);
740 }
741 ss = (ss & ~3) | dpl;
742 cpu_x86_load_seg_cache(env, R_SS, ss,
743 ssp, get_seg_limit(ss_e1, ss_e2), ss_e2);
744 }
745 SET_ESP(esp, sp_mask);
746
747 selector = (selector & ~3) | dpl;
748 cpu_x86_load_seg_cache(env, R_CS, selector,
749 get_seg_base(e1, e2),
750 get_seg_limit(e1, e2),
751 e2);
752 cpu_x86_set_cpl(env, dpl);
753 env->eip = offset;
754
755 /* interrupt gate clear IF mask */
756 if ((type & 1) == 0) {
757 env->eflags &= ~IF_MASK;
758 }
759 env->eflags &= ~(TF_MASK | VM_MASK | RF_MASK | NT_MASK);
760 }
761
762 #ifdef TARGET_X86_64
763
764 #define PUSHQ(sp, val) \
765 { \
766 sp -= 8; \
767 cpu_stq_kernel(env, sp, (val)); \
768 }
769
770 #define POPQ(sp, val) \
771 { \
772 val = cpu_ldq_kernel(env, sp); \
773 sp += 8; \
774 }
775
776 static inline target_ulong get_rsp_from_tss(CPUX86State *env, int level)
777 {
778 int index;
779
780 #if 0
781 printf("TR: base=" TARGET_FMT_lx " limit=%x\n",
782 env->tr.base, env->tr.limit);
783 #endif
784
785 if (!(env->tr.flags & DESC_P_MASK)) {
786 cpu_abort(env, "invalid tss");
787 }
788 index = 8 * level + 4;
789 if ((index + 7) > env->tr.limit) {
790 raise_exception_err(env, EXCP0A_TSS, env->tr.selector & 0xfffc);
791 }
792 return cpu_ldq_kernel(env, env->tr.base + index);
793 }
794
795 /* 64 bit interrupt */
796 static void do_interrupt64(CPUX86State *env, int intno, int is_int,
797 int error_code, target_ulong next_eip, int is_hw)
798 {
799 SegmentCache *dt;
800 target_ulong ptr;
801 int type, dpl, selector, cpl, ist;
802 int has_error_code, new_stack;
803 uint32_t e1, e2, e3, ss;
804 target_ulong old_eip, esp, offset;
805
806 has_error_code = 0;
807 if (!is_int && !is_hw) {
808 has_error_code = exception_has_error_code(intno);
809 }
810 if (is_int) {
811 old_eip = next_eip;
812 } else {
813 old_eip = env->eip;
814 }
815
816 dt = &env->idt;
817 if (intno * 16 + 15 > dt->limit) {
818 raise_exception_err(env, EXCP0D_GPF, intno * 16 + 2);
819 }
820 ptr = dt->base + intno * 16;
821 e1 = cpu_ldl_kernel(env, ptr);
822 e2 = cpu_ldl_kernel(env, ptr + 4);
823 e3 = cpu_ldl_kernel(env, ptr + 8);
824 /* check gate type */
825 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
826 switch (type) {
827 case 14: /* 386 interrupt gate */
828 case 15: /* 386 trap gate */
829 break;
830 default:
831 raise_exception_err(env, EXCP0D_GPF, intno * 16 + 2);
832 break;
833 }
834 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
835 cpl = env->hflags & HF_CPL_MASK;
836 /* check privilege if software int */
837 if (is_int && dpl < cpl) {
838 raise_exception_err(env, EXCP0D_GPF, intno * 16 + 2);
839 }
840 /* check valid bit */
841 if (!(e2 & DESC_P_MASK)) {
842 raise_exception_err(env, EXCP0B_NOSEG, intno * 16 + 2);
843 }
844 selector = e1 >> 16;
845 offset = ((target_ulong)e3 << 32) | (e2 & 0xffff0000) | (e1 & 0x0000ffff);
846 ist = e2 & 7;
847 if ((selector & 0xfffc) == 0) {
848 raise_exception_err(env, EXCP0D_GPF, 0);
849 }
850
851 if (load_segment(env, &e1, &e2, selector) != 0) {
852 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
853 }
854 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK))) {
855 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
856 }
857 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
858 if (dpl > cpl) {
859 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
860 }
861 if (!(e2 & DESC_P_MASK)) {
862 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc);
863 }
864 if (!(e2 & DESC_L_MASK) || (e2 & DESC_B_MASK)) {
865 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
866 }
867 if ((!(e2 & DESC_C_MASK) && dpl < cpl) || ist != 0) {
868 /* to inner privilege */
869 if (ist != 0) {
870 esp = get_rsp_from_tss(env, ist + 3);
871 } else {
872 esp = get_rsp_from_tss(env, dpl);
873 }
874 esp &= ~0xfLL; /* align stack */
875 ss = 0;
876 new_stack = 1;
877 } else if ((e2 & DESC_C_MASK) || dpl == cpl) {
878 /* to same privilege */
879 if (env->eflags & VM_MASK) {
880 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
881 }
882 new_stack = 0;
883 if (ist != 0) {
884 esp = get_rsp_from_tss(env, ist + 3);
885 } else {
886 esp = ESP;
887 }
888 esp &= ~0xfLL; /* align stack */
889 dpl = cpl;
890 } else {
891 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
892 new_stack = 0; /* avoid warning */
893 esp = 0; /* avoid warning */
894 }
895
896 PUSHQ(esp, env->segs[R_SS].selector);
897 PUSHQ(esp, ESP);
898 PUSHQ(esp, cpu_compute_eflags(env));
899 PUSHQ(esp, env->segs[R_CS].selector);
900 PUSHQ(esp, old_eip);
901 if (has_error_code) {
902 PUSHQ(esp, error_code);
903 }
904
905 if (new_stack) {
906 ss = 0 | dpl;
907 cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, 0);
908 }
909 ESP = esp;
910
911 selector = (selector & ~3) | dpl;
912 cpu_x86_load_seg_cache(env, R_CS, selector,
913 get_seg_base(e1, e2),
914 get_seg_limit(e1, e2),
915 e2);
916 cpu_x86_set_cpl(env, dpl);
917 env->eip = offset;
918
919 /* interrupt gate clear IF mask */
920 if ((type & 1) == 0) {
921 env->eflags &= ~IF_MASK;
922 }
923 env->eflags &= ~(TF_MASK | VM_MASK | RF_MASK | NT_MASK);
924 }
925 #endif
926
927 #ifdef TARGET_X86_64
928 #if defined(CONFIG_USER_ONLY)
929 void helper_syscall(CPUX86State *env, int next_eip_addend)
930 {
931 env->exception_index = EXCP_SYSCALL;
932 env->exception_next_eip = env->eip + next_eip_addend;
933 cpu_loop_exit(env);
934 }
935 #else
936 void helper_syscall(CPUX86State *env, int next_eip_addend)
937 {
938 int selector;
939
940 if (!(env->efer & MSR_EFER_SCE)) {
941 raise_exception_err(env, EXCP06_ILLOP, 0);
942 }
943 selector = (env->star >> 32) & 0xffff;
944 if (env->hflags & HF_LMA_MASK) {
945 int code64;
946
947 ECX = env->eip + next_eip_addend;
948 env->regs[11] = cpu_compute_eflags(env);
949
950 code64 = env->hflags & HF_CS64_MASK;
951
952 cpu_x86_set_cpl(env, 0);
953 cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
954 0, 0xffffffff,
955 DESC_G_MASK | DESC_P_MASK |
956 DESC_S_MASK |
957 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK |
958 DESC_L_MASK);
959 cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
960 0, 0xffffffff,
961 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
962 DESC_S_MASK |
963 DESC_W_MASK | DESC_A_MASK);
964 env->eflags &= ~env->fmask;
965 cpu_load_eflags(env, env->eflags, 0);
966 if (code64) {
967 env->eip = env->lstar;
968 } else {
969 env->eip = env->cstar;
970 }
971 } else {
972 ECX = (uint32_t)(env->eip + next_eip_addend);
973
974 cpu_x86_set_cpl(env, 0);
975 cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
976 0, 0xffffffff,
977 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
978 DESC_S_MASK |
979 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
980 cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
981 0, 0xffffffff,
982 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
983 DESC_S_MASK |
984 DESC_W_MASK | DESC_A_MASK);
985 env->eflags &= ~(IF_MASK | RF_MASK | VM_MASK);
986 env->eip = (uint32_t)env->star;
987 }
988 }
989 #endif
990 #endif
991
992 #ifdef TARGET_X86_64
993 void helper_sysret(CPUX86State *env, int dflag)
994 {
995 int cpl, selector;
996
997 if (!(env->efer & MSR_EFER_SCE)) {
998 raise_exception_err(env, EXCP06_ILLOP, 0);
999 }
1000 cpl = env->hflags & HF_CPL_MASK;
1001 if (!(env->cr[0] & CR0_PE_MASK) || cpl != 0) {
1002 raise_exception_err(env, EXCP0D_GPF, 0);
1003 }
1004 selector = (env->star >> 48) & 0xffff;
1005 if (env->hflags & HF_LMA_MASK) {
1006 if (dflag == 2) {
1007 cpu_x86_load_seg_cache(env, R_CS, (selector + 16) | 3,
1008 0, 0xffffffff,
1009 DESC_G_MASK | DESC_P_MASK |
1010 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1011 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK |
1012 DESC_L_MASK);
1013 env->eip = ECX;
1014 } else {
1015 cpu_x86_load_seg_cache(env, R_CS, selector | 3,
1016 0, 0xffffffff,
1017 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1018 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1019 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
1020 env->eip = (uint32_t)ECX;
1021 }
1022 cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1023 0, 0xffffffff,
1024 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1025 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1026 DESC_W_MASK | DESC_A_MASK);
1027 cpu_load_eflags(env, (uint32_t)(env->regs[11]), TF_MASK | AC_MASK
1028 | ID_MASK | IF_MASK | IOPL_MASK | VM_MASK | RF_MASK |
1029 NT_MASK);
1030 cpu_x86_set_cpl(env, 3);
1031 } else {
1032 cpu_x86_load_seg_cache(env, R_CS, selector | 3,
1033 0, 0xffffffff,
1034 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1035 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1036 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
1037 env->eip = (uint32_t)ECX;
1038 cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1039 0, 0xffffffff,
1040 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1041 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1042 DESC_W_MASK | DESC_A_MASK);
1043 env->eflags |= IF_MASK;
1044 cpu_x86_set_cpl(env, 3);
1045 }
1046 }
1047 #endif
1048
1049 /* real mode interrupt */
1050 static void do_interrupt_real(CPUX86State *env, int intno, int is_int,
1051 int error_code, unsigned int next_eip)
1052 {
1053 SegmentCache *dt;
1054 target_ulong ptr, ssp;
1055 int selector;
1056 uint32_t offset, esp;
1057 uint32_t old_cs, old_eip;
1058
1059 /* real mode (simpler!) */
1060 dt = &env->idt;
1061 if (intno * 4 + 3 > dt->limit) {
1062 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2);
1063 }
1064 ptr = dt->base + intno * 4;
1065 offset = cpu_lduw_kernel(env, ptr);
1066 selector = cpu_lduw_kernel(env, ptr + 2);
1067 esp = ESP;
1068 ssp = env->segs[R_SS].base;
1069 if (is_int) {
1070 old_eip = next_eip;
1071 } else {
1072 old_eip = env->eip;
1073 }
1074 old_cs = env->segs[R_CS].selector;
1075 /* XXX: use SS segment size? */
1076 PUSHW(ssp, esp, 0xffff, cpu_compute_eflags(env));
1077 PUSHW(ssp, esp, 0xffff, old_cs);
1078 PUSHW(ssp, esp, 0xffff, old_eip);
1079
1080 /* update processor state */
1081 ESP = (ESP & ~0xffff) | (esp & 0xffff);
1082 env->eip = offset;
1083 env->segs[R_CS].selector = selector;
1084 env->segs[R_CS].base = (selector << 4);
1085 env->eflags &= ~(IF_MASK | TF_MASK | AC_MASK | RF_MASK);
1086 }
1087
1088 #if defined(CONFIG_USER_ONLY)
1089 /* fake user mode interrupt */
1090 static void do_interrupt_user(CPUX86State *env, int intno, int is_int,
1091 int error_code, target_ulong next_eip)
1092 {
1093 SegmentCache *dt;
1094 target_ulong ptr;
1095 int dpl, cpl, shift;
1096 uint32_t e2;
1097
1098 dt = &env->idt;
1099 if (env->hflags & HF_LMA_MASK) {
1100 shift = 4;
1101 } else {
1102 shift = 3;
1103 }
1104 ptr = dt->base + (intno << shift);
1105 e2 = cpu_ldl_kernel(env, ptr + 4);
1106
1107 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1108 cpl = env->hflags & HF_CPL_MASK;
1109 /* check privilege if software int */
1110 if (is_int && dpl < cpl) {
1111 raise_exception_err(env, EXCP0D_GPF, (intno << shift) + 2);
1112 }
1113
1114 /* Since we emulate only user space, we cannot do more than
1115 exiting the emulation with the suitable exception and error
1116 code */
1117 if (is_int) {
1118 EIP = next_eip;
1119 }
1120 }
1121
1122 #else
1123
1124 static void handle_even_inj(CPUX86State *env, int intno, int is_int,
1125 int error_code, int is_hw, int rm)
1126 {
1127 uint32_t event_inj = ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
1128 control.event_inj));
1129
1130 if (!(event_inj & SVM_EVTINJ_VALID)) {
1131 int type;
1132
1133 if (is_int) {
1134 type = SVM_EVTINJ_TYPE_SOFT;
1135 } else {
1136 type = SVM_EVTINJ_TYPE_EXEPT;
1137 }
1138 event_inj = intno | type | SVM_EVTINJ_VALID;
1139 if (!rm && exception_has_error_code(intno)) {
1140 event_inj |= SVM_EVTINJ_VALID_ERR;
1141 stl_phys(env->vm_vmcb + offsetof(struct vmcb,
1142 control.event_inj_err),
1143 error_code);
1144 }
1145 stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
1146 event_inj);
1147 }
1148 }
1149 #endif
1150
1151 /*
1152 * Begin execution of an interruption. is_int is TRUE if coming from
1153 * the int instruction. next_eip is the EIP value AFTER the interrupt
1154 * instruction. It is only relevant if is_int is TRUE.
1155 */
1156 static void do_interrupt_all(CPUX86State *env, int intno, int is_int,
1157 int error_code, target_ulong next_eip, int is_hw)
1158 {
1159 if (qemu_loglevel_mask(CPU_LOG_INT)) {
1160 if ((env->cr[0] & CR0_PE_MASK)) {
1161 static int count;
1162
1163 qemu_log("%6d: v=%02x e=%04x i=%d cpl=%d IP=%04x:" TARGET_FMT_lx
1164 " pc=" TARGET_FMT_lx " SP=%04x:" TARGET_FMT_lx,
1165 count, intno, error_code, is_int,
1166 env->hflags & HF_CPL_MASK,
1167 env->segs[R_CS].selector, EIP,
1168 (int)env->segs[R_CS].base + EIP,
1169 env->segs[R_SS].selector, ESP);
1170 if (intno == 0x0e) {
1171 qemu_log(" CR2=" TARGET_FMT_lx, env->cr[2]);
1172 } else {
1173 qemu_log(" EAX=" TARGET_FMT_lx, EAX);
1174 }
1175 qemu_log("\n");
1176 log_cpu_state(env, X86_DUMP_CCOP);
1177 #if 0
1178 {
1179 int i;
1180 target_ulong ptr;
1181
1182 qemu_log(" code=");
1183 ptr = env->segs[R_CS].base + env->eip;
1184 for (i = 0; i < 16; i++) {
1185 qemu_log(" %02x", ldub(ptr + i));
1186 }
1187 qemu_log("\n");
1188 }
1189 #endif
1190 count++;
1191 }
1192 }
1193 if (env->cr[0] & CR0_PE_MASK) {
1194 #if !defined(CONFIG_USER_ONLY)
1195 if (env->hflags & HF_SVMI_MASK) {
1196 handle_even_inj(env, intno, is_int, error_code, is_hw, 0);
1197 }
1198 #endif
1199 #ifdef TARGET_X86_64
1200 if (env->hflags & HF_LMA_MASK) {
1201 do_interrupt64(env, intno, is_int, error_code, next_eip, is_hw);
1202 } else
1203 #endif
1204 {
1205 do_interrupt_protected(env, intno, is_int, error_code, next_eip,
1206 is_hw);
1207 }
1208 } else {
1209 #if !defined(CONFIG_USER_ONLY)
1210 if (env->hflags & HF_SVMI_MASK) {
1211 handle_even_inj(env, intno, is_int, error_code, is_hw, 1);
1212 }
1213 #endif
1214 do_interrupt_real(env, intno, is_int, error_code, next_eip);
1215 }
1216
1217 #if !defined(CONFIG_USER_ONLY)
1218 if (env->hflags & HF_SVMI_MASK) {
1219 uint32_t event_inj = ldl_phys(env->vm_vmcb +
1220 offsetof(struct vmcb,
1221 control.event_inj));
1222
1223 stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
1224 event_inj & ~SVM_EVTINJ_VALID);
1225 }
1226 #endif
1227 }
1228
1229 void do_interrupt(CPUX86State *env)
1230 {
1231 #if defined(CONFIG_USER_ONLY)
1232 /* if user mode only, we simulate a fake exception
1233 which will be handled outside the cpu execution
1234 loop */
1235 do_interrupt_user(env, env->exception_index,
1236 env->exception_is_int,
1237 env->error_code,
1238 env->exception_next_eip);
1239 /* successfully delivered */
1240 env->old_exception = -1;
1241 #else
1242 /* simulate a real cpu exception. On i386, it can
1243 trigger new exceptions, but we do not handle
1244 double or triple faults yet. */
1245 do_interrupt_all(env, env->exception_index,
1246 env->exception_is_int,
1247 env->error_code,
1248 env->exception_next_eip, 0);
1249 /* successfully delivered */
1250 env->old_exception = -1;
1251 #endif
1252 }
1253
1254 void do_interrupt_x86_hardirq(CPUX86State *env, int intno, int is_hw)
1255 {
1256 do_interrupt_all(env, intno, 0, 0, 0, is_hw);
1257 }
1258
1259 void helper_enter_level(CPUX86State *env, int level, int data32,
1260 target_ulong t1)
1261 {
1262 target_ulong ssp;
1263 uint32_t esp_mask, esp, ebp;
1264
1265 esp_mask = get_sp_mask(env->segs[R_SS].flags);
1266 ssp = env->segs[R_SS].base;
1267 ebp = EBP;
1268 esp = ESP;
1269 if (data32) {
1270 /* 32 bit */
1271 esp -= 4;
1272 while (--level) {
1273 esp -= 4;
1274 ebp -= 4;
1275 cpu_stl_data(env, ssp + (esp & esp_mask),
1276 cpu_ldl_data(env, ssp + (ebp & esp_mask)));
1277 }
1278 esp -= 4;
1279 cpu_stl_data(env, ssp + (esp & esp_mask), t1);
1280 } else {
1281 /* 16 bit */
1282 esp -= 2;
1283 while (--level) {
1284 esp -= 2;
1285 ebp -= 2;
1286 cpu_stw_data(env, ssp + (esp & esp_mask),
1287 cpu_lduw_data(env, ssp + (ebp & esp_mask)));
1288 }
1289 esp -= 2;
1290 cpu_stw_data(env, ssp + (esp & esp_mask), t1);
1291 }
1292 }
1293
1294 #ifdef TARGET_X86_64
1295 void helper_enter64_level(CPUX86State *env, int level, int data64,
1296 target_ulong t1)
1297 {
1298 target_ulong esp, ebp;
1299
1300 ebp = EBP;
1301 esp = ESP;
1302
1303 if (data64) {
1304 /* 64 bit */
1305 esp -= 8;
1306 while (--level) {
1307 esp -= 8;
1308 ebp -= 8;
1309 cpu_stq_data(env, esp, cpu_ldq_data(env, ebp));
1310 }
1311 esp -= 8;
1312 cpu_stq_data(env, esp, t1);
1313 } else {
1314 /* 16 bit */
1315 esp -= 2;
1316 while (--level) {
1317 esp -= 2;
1318 ebp -= 2;
1319 cpu_stw_data(env, esp, cpu_lduw_data(env, ebp));
1320 }
1321 esp -= 2;
1322 cpu_stw_data(env, esp, t1);
1323 }
1324 }
1325 #endif
1326
1327 void helper_lldt(CPUX86State *env, int selector)
1328 {
1329 SegmentCache *dt;
1330 uint32_t e1, e2;
1331 int index, entry_limit;
1332 target_ulong ptr;
1333
1334 selector &= 0xffff;
1335 if ((selector & 0xfffc) == 0) {
1336 /* XXX: NULL selector case: invalid LDT */
1337 env->ldt.base = 0;
1338 env->ldt.limit = 0;
1339 } else {
1340 if (selector & 0x4) {
1341 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1342 }
1343 dt = &env->gdt;
1344 index = selector & ~7;
1345 #ifdef TARGET_X86_64
1346 if (env->hflags & HF_LMA_MASK) {
1347 entry_limit = 15;
1348 } else
1349 #endif
1350 {
1351 entry_limit = 7;
1352 }
1353 if ((index + entry_limit) > dt->limit) {
1354 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1355 }
1356 ptr = dt->base + index;
1357 e1 = cpu_ldl_kernel(env, ptr);
1358 e2 = cpu_ldl_kernel(env, ptr + 4);
1359 if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2) {
1360 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1361 }
1362 if (!(e2 & DESC_P_MASK)) {
1363 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc);
1364 }
1365 #ifdef TARGET_X86_64
1366 if (env->hflags & HF_LMA_MASK) {
1367 uint32_t e3;
1368
1369 e3 = cpu_ldl_kernel(env, ptr + 8);
1370 load_seg_cache_raw_dt(&env->ldt, e1, e2);
1371 env->ldt.base |= (target_ulong)e3 << 32;
1372 } else
1373 #endif
1374 {
1375 load_seg_cache_raw_dt(&env->ldt, e1, e2);
1376 }
1377 }
1378 env->ldt.selector = selector;
1379 }
1380
1381 void helper_ltr(CPUX86State *env, int selector)
1382 {
1383 SegmentCache *dt;
1384 uint32_t e1, e2;
1385 int index, type, entry_limit;
1386 target_ulong ptr;
1387
1388 selector &= 0xffff;
1389 if ((selector & 0xfffc) == 0) {
1390 /* NULL selector case: invalid TR */
1391 env->tr.base = 0;
1392 env->tr.limit = 0;
1393 env->tr.flags = 0;
1394 } else {
1395 if (selector & 0x4) {
1396 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1397 }
1398 dt = &env->gdt;
1399 index = selector & ~7;
1400 #ifdef TARGET_X86_64
1401 if (env->hflags & HF_LMA_MASK) {
1402 entry_limit = 15;
1403 } else
1404 #endif
1405 {
1406 entry_limit = 7;
1407 }
1408 if ((index + entry_limit) > dt->limit) {
1409 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1410 }
1411 ptr = dt->base + index;
1412 e1 = cpu_ldl_kernel(env, ptr);
1413 e2 = cpu_ldl_kernel(env, ptr + 4);
1414 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
1415 if ((e2 & DESC_S_MASK) ||
1416 (type != 1 && type != 9)) {
1417 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1418 }
1419 if (!(e2 & DESC_P_MASK)) {
1420 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc);
1421 }
1422 #ifdef TARGET_X86_64
1423 if (env->hflags & HF_LMA_MASK) {
1424 uint32_t e3, e4;
1425
1426 e3 = cpu_ldl_kernel(env, ptr + 8);
1427 e4 = cpu_ldl_kernel(env, ptr + 12);
1428 if ((e4 >> DESC_TYPE_SHIFT) & 0xf) {
1429 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1430 }
1431 load_seg_cache_raw_dt(&env->tr, e1, e2);
1432 env->tr.base |= (target_ulong)e3 << 32;
1433 } else
1434 #endif
1435 {
1436 load_seg_cache_raw_dt(&env->tr, e1, e2);
1437 }
1438 e2 |= DESC_TSS_BUSY_MASK;
1439 cpu_stl_kernel(env, ptr + 4, e2);
1440 }
1441 env->tr.selector = selector;
1442 }
1443
1444 /* only works if protected mode and not VM86. seg_reg must be != R_CS */
1445 void helper_load_seg(CPUX86State *env, int seg_reg, int selector)
1446 {
1447 uint32_t e1, e2;
1448 int cpl, dpl, rpl;
1449 SegmentCache *dt;
1450 int index;
1451 target_ulong ptr;
1452
1453 selector &= 0xffff;
1454 cpl = env->hflags & HF_CPL_MASK;
1455 if ((selector & 0xfffc) == 0) {
1456 /* null selector case */
1457 if (seg_reg == R_SS
1458 #ifdef TARGET_X86_64
1459 && (!(env->hflags & HF_CS64_MASK) || cpl == 3)
1460 #endif
1461 ) {
1462 raise_exception_err(env, EXCP0D_GPF, 0);
1463 }
1464 cpu_x86_load_seg_cache(env, seg_reg, selector, 0, 0, 0);
1465 } else {
1466
1467 if (selector & 0x4) {
1468 dt = &env->ldt;
1469 } else {
1470 dt = &env->gdt;
1471 }
1472 index = selector & ~7;
1473 if ((index + 7) > dt->limit) {
1474 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1475 }
1476 ptr = dt->base + index;
1477 e1 = cpu_ldl_kernel(env, ptr);
1478 e2 = cpu_ldl_kernel(env, ptr + 4);
1479
1480 if (!(e2 & DESC_S_MASK)) {
1481 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1482 }
1483 rpl = selector & 3;
1484 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1485 if (seg_reg == R_SS) {
1486 /* must be writable segment */
1487 if ((e2 & DESC_CS_MASK) || !(e2 & DESC_W_MASK)) {
1488 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1489 }
1490 if (rpl != cpl || dpl != cpl) {
1491 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1492 }
1493 } else {
1494 /* must be readable segment */
1495 if ((e2 & (DESC_CS_MASK | DESC_R_MASK)) == DESC_CS_MASK) {
1496 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1497 }
1498
1499 if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) {
1500 /* if not conforming code, test rights */
1501 if (dpl < cpl || dpl < rpl) {
1502 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1503 }
1504 }
1505 }
1506
1507 if (!(e2 & DESC_P_MASK)) {
1508 if (seg_reg == R_SS) {
1509 raise_exception_err(env, EXCP0C_STACK, selector & 0xfffc);
1510 } else {
1511 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc);
1512 }
1513 }
1514
1515 /* set the access bit if not already set */
1516 if (!(e2 & DESC_A_MASK)) {
1517 e2 |= DESC_A_MASK;
1518 cpu_stl_kernel(env, ptr + 4, e2);
1519 }
1520
1521 cpu_x86_load_seg_cache(env, seg_reg, selector,
1522 get_seg_base(e1, e2),
1523 get_seg_limit(e1, e2),
1524 e2);
1525 #if 0
1526 qemu_log("load_seg: sel=0x%04x base=0x%08lx limit=0x%08lx flags=%08x\n",
1527 selector, (unsigned long)sc->base, sc->limit, sc->flags);
1528 #endif
1529 }
1530 }
1531
1532 /* protected mode jump */
1533 void helper_ljmp_protected(CPUX86State *env, int new_cs, target_ulong new_eip,
1534 int next_eip_addend)
1535 {
1536 int gate_cs, type;
1537 uint32_t e1, e2, cpl, dpl, rpl, limit;
1538 target_ulong next_eip;
1539
1540 if ((new_cs & 0xfffc) == 0) {
1541 raise_exception_err(env, EXCP0D_GPF, 0);
1542 }
1543 if (load_segment(env, &e1, &e2, new_cs) != 0) {
1544 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1545 }
1546 cpl = env->hflags & HF_CPL_MASK;
1547 if (e2 & DESC_S_MASK) {
1548 if (!(e2 & DESC_CS_MASK)) {
1549 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1550 }
1551 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1552 if (e2 & DESC_C_MASK) {
1553 /* conforming code segment */
1554 if (dpl > cpl) {
1555 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1556 }
1557 } else {
1558 /* non conforming code segment */
1559 rpl = new_cs & 3;
1560 if (rpl > cpl) {
1561 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1562 }
1563 if (dpl != cpl) {
1564 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1565 }
1566 }
1567 if (!(e2 & DESC_P_MASK)) {
1568 raise_exception_err(env, EXCP0B_NOSEG, new_cs & 0xfffc);
1569 }
1570 limit = get_seg_limit(e1, e2);
1571 if (new_eip > limit &&
1572 !(env->hflags & HF_LMA_MASK) && !(e2 & DESC_L_MASK)) {
1573 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1574 }
1575 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
1576 get_seg_base(e1, e2), limit, e2);
1577 EIP = new_eip;
1578 } else {
1579 /* jump to call or task gate */
1580 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1581 rpl = new_cs & 3;
1582 cpl = env->hflags & HF_CPL_MASK;
1583 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
1584 switch (type) {
1585 case 1: /* 286 TSS */
1586 case 9: /* 386 TSS */
1587 case 5: /* task gate */
1588 if (dpl < cpl || dpl < rpl) {
1589 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1590 }
1591 next_eip = env->eip + next_eip_addend;
1592 switch_tss(env, new_cs, e1, e2, SWITCH_TSS_JMP, next_eip);
1593 CC_OP = CC_OP_EFLAGS;
1594 break;
1595 case 4: /* 286 call gate */
1596 case 12: /* 386 call gate */
1597 if ((dpl < cpl) || (dpl < rpl)) {
1598 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1599 }
1600 if (!(e2 & DESC_P_MASK)) {
1601 raise_exception_err(env, EXCP0B_NOSEG, new_cs & 0xfffc);
1602 }
1603 gate_cs = e1 >> 16;
1604 new_eip = (e1 & 0xffff);
1605 if (type == 12) {
1606 new_eip |= (e2 & 0xffff0000);
1607 }
1608 if (load_segment(env, &e1, &e2, gate_cs) != 0) {
1609 raise_exception_err(env, EXCP0D_GPF, gate_cs & 0xfffc);
1610 }
1611 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1612 /* must be code segment */
1613 if (((e2 & (DESC_S_MASK | DESC_CS_MASK)) !=
1614 (DESC_S_MASK | DESC_CS_MASK))) {
1615 raise_exception_err(env, EXCP0D_GPF, gate_cs & 0xfffc);
1616 }
1617 if (((e2 & DESC_C_MASK) && (dpl > cpl)) ||
1618 (!(e2 & DESC_C_MASK) && (dpl != cpl))) {
1619 raise_exception_err(env, EXCP0D_GPF, gate_cs & 0xfffc);
1620 }
1621 if (!(e2 & DESC_P_MASK)) {
1622 raise_exception_err(env, EXCP0D_GPF, gate_cs & 0xfffc);
1623 }
1624 limit = get_seg_limit(e1, e2);
1625 if (new_eip > limit) {
1626 raise_exception_err(env, EXCP0D_GPF, 0);
1627 }
1628 cpu_x86_load_seg_cache(env, R_CS, (gate_cs & 0xfffc) | cpl,
1629 get_seg_base(e1, e2), limit, e2);
1630 EIP = new_eip;
1631 break;
1632 default:
1633 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1634 break;
1635 }
1636 }
1637 }
1638
1639 /* real mode call */
1640 void helper_lcall_real(CPUX86State *env, int new_cs, target_ulong new_eip1,
1641 int shift, int next_eip)
1642 {
1643 int new_eip;
1644 uint32_t esp, esp_mask;
1645 target_ulong ssp;
1646
1647 new_eip = new_eip1;
1648 esp = ESP;
1649 esp_mask = get_sp_mask(env->segs[R_SS].flags);
1650 ssp = env->segs[R_SS].base;
1651 if (shift) {
1652 PUSHL(ssp, esp, esp_mask, env->segs[R_CS].selector);
1653 PUSHL(ssp, esp, esp_mask, next_eip);
1654 } else {
1655 PUSHW(ssp, esp, esp_mask, env->segs[R_CS].selector);
1656 PUSHW(ssp, esp, esp_mask, next_eip);
1657 }
1658
1659 SET_ESP(esp, esp_mask);
1660 env->eip = new_eip;
1661 env->segs[R_CS].selector = new_cs;
1662 env->segs[R_CS].base = (new_cs << 4);
1663 }
1664
1665 /* protected mode call */
1666 void helper_lcall_protected(CPUX86State *env, int new_cs, target_ulong new_eip,
1667 int shift, int next_eip_addend)
1668 {
1669 int new_stack, i;
1670 uint32_t e1, e2, cpl, dpl, rpl, selector, offset, param_count;
1671 uint32_t ss = 0, ss_e1 = 0, ss_e2 = 0, sp, type, ss_dpl, sp_mask;
1672 uint32_t val, limit, old_sp_mask;
1673 target_ulong ssp, old_ssp, next_eip;
1674
1675 next_eip = env->eip + next_eip_addend;
1676 LOG_PCALL("lcall %04x:%08x s=%d\n", new_cs, (uint32_t)new_eip, shift);
1677 LOG_PCALL_STATE(env);
1678 if ((new_cs & 0xfffc) == 0) {
1679 raise_exception_err(env, EXCP0D_GPF, 0);
1680 }
1681 if (load_segment(env, &e1, &e2, new_cs) != 0) {
1682 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1683 }
1684 cpl = env->hflags & HF_CPL_MASK;
1685 LOG_PCALL("desc=%08x:%08x\n", e1, e2);
1686 if (e2 & DESC_S_MASK) {
1687 if (!(e2 & DESC_CS_MASK)) {
1688 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1689 }
1690 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1691 if (e2 & DESC_C_MASK) {
1692 /* conforming code segment */
1693 if (dpl > cpl) {
1694 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1695 }
1696 } else {
1697 /* non conforming code segment */
1698 rpl = new_cs & 3;
1699 if (rpl > cpl) {
1700 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1701 }
1702 if (dpl != cpl) {
1703 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1704 }
1705 }
1706 if (!(e2 & DESC_P_MASK)) {
1707 raise_exception_err(env, EXCP0B_NOSEG, new_cs & 0xfffc);
1708 }
1709
1710 #ifdef TARGET_X86_64
1711 /* XXX: check 16/32 bit cases in long mode */
1712 if (shift == 2) {
1713 target_ulong rsp;
1714
1715 /* 64 bit case */
1716 rsp = ESP;
1717 PUSHQ(rsp, env->segs[R_CS].selector);
1718 PUSHQ(rsp, next_eip);
1719 /* from this point, not restartable */
1720 ESP = rsp;
1721 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
1722 get_seg_base(e1, e2),
1723 get_seg_limit(e1, e2), e2);
1724 EIP = new_eip;
1725 } else
1726 #endif
1727 {
1728 sp = ESP;
1729 sp_mask = get_sp_mask(env->segs[R_SS].flags);
1730 ssp = env->segs[R_SS].base;
1731 if (shift) {
1732 PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
1733 PUSHL(ssp, sp, sp_mask, next_eip);
1734 } else {
1735 PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
1736 PUSHW(ssp, sp, sp_mask, next_eip);
1737 }
1738
1739 limit = get_seg_limit(e1, e2);
1740 if (new_eip > limit) {
1741 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1742 }
1743 /* from this point, not restartable */
1744 SET_ESP(sp, sp_mask);
1745 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
1746 get_seg_base(e1, e2), limit, e2);
1747 EIP = new_eip;
1748 }
1749 } else {
1750 /* check gate type */
1751 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
1752 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1753 rpl = new_cs & 3;
1754 switch (type) {
1755 case 1: /* available 286 TSS */
1756 case 9: /* available 386 TSS */
1757 case 5: /* task gate */
1758 if (dpl < cpl || dpl < rpl) {
1759 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1760 }
1761 switch_tss(env, new_cs, e1, e2, SWITCH_TSS_CALL, next_eip);
1762 CC_OP = CC_OP_EFLAGS;
1763 return;
1764 case 4: /* 286 call gate */
1765 case 12: /* 386 call gate */
1766 break;
1767 default:
1768 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1769 break;
1770 }
1771 shift = type >> 3;
1772
1773 if (dpl < cpl || dpl < rpl) {
1774 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1775 }
1776 /* check valid bit */
1777 if (!(e2 & DESC_P_MASK)) {
1778 raise_exception_err(env, EXCP0B_NOSEG, new_cs & 0xfffc);
1779 }
1780 selector = e1 >> 16;
1781 offset = (e2 & 0xffff0000) | (e1 & 0x0000ffff);
1782 param_count = e2 & 0x1f;
1783 if ((selector & 0xfffc) == 0) {
1784 raise_exception_err(env, EXCP0D_GPF, 0);
1785 }
1786
1787 if (load_segment(env, &e1, &e2, selector) != 0) {
1788 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1789 }
1790 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK))) {
1791 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1792 }
1793 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1794 if (dpl > cpl) {
1795 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1796 }
1797 if (!(e2 & DESC_P_MASK)) {
1798 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc);
1799 }
1800
1801 if (!(e2 & DESC_C_MASK) && dpl < cpl) {
1802 /* to inner privilege */
1803 get_ss_esp_from_tss(env, &ss, &sp, dpl);
1804 LOG_PCALL("new ss:esp=%04x:%08x param_count=%d ESP=" TARGET_FMT_lx
1805 "\n",
1806 ss, sp, param_count, ESP);
1807 if ((ss & 0xfffc) == 0) {
1808 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
1809 }
1810 if ((ss & 3) != dpl) {
1811 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
1812 }
1813 if (load_segment(env, &ss_e1, &ss_e2, ss) != 0) {
1814 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
1815 }
1816 ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
1817 if (ss_dpl != dpl) {
1818 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
1819 }
1820 if (!(ss_e2 & DESC_S_MASK) ||
1821 (ss_e2 & DESC_CS_MASK) ||
1822 !(ss_e2 & DESC_W_MASK)) {
1823 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
1824 }
1825 if (!(ss_e2 & DESC_P_MASK)) {
1826 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
1827 }
1828
1829 /* push_size = ((param_count * 2) + 8) << shift; */
1830
1831 old_sp_mask = get_sp_mask(env->segs[R_SS].flags);
1832 old_ssp = env->segs[R_SS].base;
1833
1834 sp_mask = get_sp_mask(ss_e2);
1835 ssp = get_seg_base(ss_e1, ss_e2);
1836 if (shift) {
1837 PUSHL(ssp, sp, sp_mask, env->segs[R_SS].selector);
1838 PUSHL(ssp, sp, sp_mask, ESP);
1839 for (i = param_count - 1; i >= 0; i--) {
1840 val = cpu_ldl_kernel(env, old_ssp + ((ESP + i * 4) &
1841 old_sp_mask));
1842 PUSHL(ssp, sp, sp_mask, val);
1843 }
1844 } else {
1845 PUSHW(ssp, sp, sp_mask, env->segs[R_SS].selector);
1846 PUSHW(ssp, sp, sp_mask, ESP);
1847 for (i = param_count - 1; i >= 0; i--) {
1848 val = cpu_lduw_kernel(env, old_ssp + ((ESP + i * 2) &
1849 old_sp_mask));
1850 PUSHW(ssp, sp, sp_mask, val);
1851 }
1852 }
1853 new_stack = 1;
1854 } else {
1855 /* to same privilege */
1856 sp = ESP;
1857 sp_mask = get_sp_mask(env->segs[R_SS].flags);
1858 ssp = env->segs[R_SS].base;
1859 /* push_size = (4 << shift); */
1860 new_stack = 0;
1861 }
1862
1863 if (shift) {
1864 PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
1865 PUSHL(ssp, sp, sp_mask, next_eip);
1866 } else {
1867 PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
1868 PUSHW(ssp, sp, sp_mask, next_eip);
1869 }
1870
1871 /* from this point, not restartable */
1872
1873 if (new_stack) {
1874 ss = (ss & ~3) | dpl;
1875 cpu_x86_load_seg_cache(env, R_SS, ss,
1876 ssp,
1877 get_seg_limit(ss_e1, ss_e2),
1878 ss_e2);
1879 }
1880
1881 selector = (selector & ~3) | dpl;
1882 cpu_x86_load_seg_cache(env, R_CS, selector,
1883 get_seg_base(e1, e2),
1884 get_seg_limit(e1, e2),
1885 e2);
1886 cpu_x86_set_cpl(env, dpl);
1887 SET_ESP(sp, sp_mask);
1888 EIP = offset;
1889 }
1890 }
1891
1892 /* real and vm86 mode iret */
1893 void helper_iret_real(CPUX86State *env, int shift)
1894 {
1895 uint32_t sp, new_cs, new_eip, new_eflags, sp_mask;
1896 target_ulong ssp;
1897 int eflags_mask;
1898
1899 sp_mask = 0xffff; /* XXXX: use SS segment size? */
1900 sp = ESP;
1901 ssp = env->segs[R_SS].base;
1902 if (shift == 1) {
1903 /* 32 bits */
1904 POPL(ssp, sp, sp_mask, new_eip);
1905 POPL(ssp, sp, sp_mask, new_cs);
1906 new_cs &= 0xffff;
1907 POPL(ssp, sp, sp_mask, new_eflags);
1908 } else {
1909 /* 16 bits */
1910 POPW(ssp, sp, sp_mask, new_eip);
1911 POPW(ssp, sp, sp_mask, new_cs);
1912 POPW(ssp, sp, sp_mask, new_eflags);
1913 }
1914 ESP = (ESP & ~sp_mask) | (sp & sp_mask);
1915 env->segs[R_CS].selector = new_cs;
1916 env->segs[R_CS].base = (new_cs << 4);
1917 env->eip = new_eip;
1918 if (env->eflags & VM_MASK) {
1919 eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | RF_MASK |
1920 NT_MASK;
1921 } else {
1922 eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | IOPL_MASK |
1923 RF_MASK | NT_MASK;
1924 }
1925 if (shift == 0) {
1926 eflags_mask &= 0xffff;
1927 }
1928 cpu_load_eflags(env, new_eflags, eflags_mask);
1929 env->hflags2 &= ~HF2_NMI_MASK;
1930 }
1931
1932 static inline void validate_seg(CPUX86State *env, int seg_reg, int cpl)
1933 {
1934 int dpl;
1935 uint32_t e2;
1936
1937 /* XXX: on x86_64, we do not want to nullify FS and GS because
1938 they may still contain a valid base. I would be interested to
1939 know how a real x86_64 CPU behaves */
1940 if ((seg_reg == R_FS || seg_reg == R_GS) &&
1941 (env->segs[seg_reg].selector & 0xfffc) == 0) {
1942 return;
1943 }
1944
1945 e2 = env->segs[seg_reg].flags;
1946 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1947 if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) {
1948 /* data or non conforming code segment */
1949 if (dpl < cpl) {
1950 cpu_x86_load_seg_cache(env, seg_reg, 0, 0, 0, 0);
1951 }
1952 }
1953 }
1954
1955 /* protected mode iret */
1956 static inline void helper_ret_protected(CPUX86State *env, int shift,
1957 int is_iret, int addend)
1958 {
1959 uint32_t new_cs, new_eflags, new_ss;
1960 uint32_t new_es, new_ds, new_fs, new_gs;
1961 uint32_t e1, e2, ss_e1, ss_e2;
1962 int cpl, dpl, rpl, eflags_mask, iopl;
1963 target_ulong ssp, sp, new_eip, new_esp, sp_mask;
1964
1965 #ifdef TARGET_X86_64
1966 if (shift == 2) {
1967 sp_mask = -1;
1968 } else
1969 #endif
1970 {
1971 sp_mask = get_sp_mask(env->segs[R_SS].flags);
1972 }
1973 sp = ESP;
1974 ssp = env->segs[R_SS].base;
1975 new_eflags = 0; /* avoid warning */
1976 #ifdef TARGET_X86_64
1977 if (shift == 2) {
1978 POPQ(sp, new_eip);
1979 POPQ(sp, new_cs);
1980 new_cs &= 0xffff;
1981 if (is_iret) {
1982 POPQ(sp, new_eflags);
1983 }
1984 } else
1985 #endif
1986 {
1987 if (shift == 1) {
1988 /* 32 bits */
1989 POPL(ssp, sp, sp_mask, new_eip);
1990 POPL(ssp, sp, sp_mask, new_cs);
1991 new_cs &= 0xffff;
1992 if (is_iret) {
1993 POPL(ssp, sp, sp_mask, new_eflags);
1994 if (new_eflags & VM_MASK) {
1995 goto return_to_vm86;
1996 }
1997 }
1998 } else {
1999 /* 16 bits */
2000 POPW(ssp, sp, sp_mask, new_eip);
2001 POPW(ssp, sp, sp_mask, new_cs);
2002 if (is_iret) {
2003 POPW(ssp, sp, sp_mask, new_eflags);
2004 }
2005 }
2006 }
2007 LOG_PCALL("lret new %04x:" TARGET_FMT_lx " s=%d addend=0x%x\n",
2008 new_cs, new_eip, shift, addend);
2009 LOG_PCALL_STATE(env);
2010 if ((new_cs & 0xfffc) == 0) {
2011 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
2012 }
2013 if (load_segment(env, &e1, &e2, new_cs) != 0) {
2014 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
2015 }
2016 if (!(e2 & DESC_S_MASK) ||
2017 !(e2 & DESC_CS_MASK)) {
2018 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
2019 }
2020 cpl = env->hflags & HF_CPL_MASK;
2021 rpl = new_cs & 3;
2022 if (rpl < cpl) {
2023 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
2024 }
2025 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2026 if (e2 & DESC_C_MASK) {
2027 if (dpl > rpl) {
2028 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
2029 }
2030 } else {
2031 if (dpl != rpl) {
2032 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
2033 }
2034 }
2035 if (!(e2 & DESC_P_MASK)) {
2036 raise_exception_err(env, EXCP0B_NOSEG, new_cs & 0xfffc);
2037 }
2038
2039 sp += addend;
2040 if (rpl == cpl && (!(env->hflags & HF_CS64_MASK) ||
2041 ((env->hflags & HF_CS64_MASK) && !is_iret))) {
2042 /* return to same privilege level */
2043 cpu_x86_load_seg_cache(env, R_CS, new_cs,
2044 get_seg_base(e1, e2),
2045 get_seg_limit(e1, e2),
2046 e2);
2047 } else {
2048 /* return to different privilege level */
2049 #ifdef TARGET_X86_64
2050 if (shift == 2) {
2051 POPQ(sp, new_esp);
2052 POPQ(sp, new_ss);
2053 new_ss &= 0xffff;
2054 } else
2055 #endif
2056 {
2057 if (shift == 1) {
2058 /* 32 bits */
2059 POPL(ssp, sp, sp_mask, new_esp);
2060 POPL(ssp, sp, sp_mask, new_ss);
2061 new_ss &= 0xffff;
2062 } else {
2063 /* 16 bits */
2064 POPW(ssp, sp, sp_mask, new_esp);
2065 POPW(ssp, sp, sp_mask, new_ss);
2066 }
2067 }
2068 LOG_PCALL("new ss:esp=%04x:" TARGET_FMT_lx "\n",
2069 new_ss, new_esp);
2070 if ((new_ss & 0xfffc) == 0) {
2071 #ifdef TARGET_X86_64
2072 /* NULL ss is allowed in long mode if cpl != 3 */
2073 /* XXX: test CS64? */
2074 if ((env->hflags & HF_LMA_MASK) && rpl != 3) {
2075 cpu_x86_load_seg_cache(env, R_SS, new_ss,
2076 0, 0xffffffff,
2077 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2078 DESC_S_MASK | (rpl << DESC_DPL_SHIFT) |
2079 DESC_W_MASK | DESC_A_MASK);
2080 ss_e2 = DESC_B_MASK; /* XXX: should not be needed? */
2081 } else
2082 #endif
2083 {
2084 raise_exception_err(env, EXCP0D_GPF, 0);
2085 }
2086 } else {
2087 if ((new_ss & 3) != rpl) {
2088 raise_exception_err(env, EXCP0D_GPF, new_ss & 0xfffc);
2089 }
2090 if (load_segment(env, &ss_e1, &ss_e2, new_ss) != 0) {
2091 raise_exception_err(env, EXCP0D_GPF, new_ss & 0xfffc);
2092 }
2093 if (!(ss_e2 & DESC_S_MASK) ||
2094 (ss_e2 & DESC_CS_MASK) ||
2095 !(ss_e2 & DESC_W_MASK)) {
2096 raise_exception_err(env, EXCP0D_GPF, new_ss & 0xfffc);
2097 }
2098 dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
2099 if (dpl != rpl) {
2100 raise_exception_err(env, EXCP0D_GPF, new_ss & 0xfffc);
2101 }
2102 if (!(ss_e2 & DESC_P_MASK)) {
2103 raise_exception_err(env, EXCP0B_NOSEG, new_ss & 0xfffc);
2104 }
2105 cpu_x86_load_seg_cache(env, R_SS, new_ss,
2106 get_seg_base(ss_e1, ss_e2),
2107 get_seg_limit(ss_e1, ss_e2),
2108 ss_e2);
2109 }
2110
2111 cpu_x86_load_seg_cache(env, R_CS, new_cs,
2112 get_seg_base(e1, e2),
2113 get_seg_limit(e1, e2),
2114 e2);
2115 cpu_x86_set_cpl(env, rpl);
2116 sp = new_esp;
2117 #ifdef TARGET_X86_64
2118 if (env->hflags & HF_CS64_MASK) {
2119 sp_mask = -1;
2120 } else
2121 #endif
2122 {
2123 sp_mask = get_sp_mask(ss_e2);
2124 }
2125
2126 /* validate data segments */
2127 validate_seg(env, R_ES, rpl);
2128 validate_seg(env, R_DS, rpl);
2129 validate_seg(env, R_FS, rpl);
2130 validate_seg(env, R_GS, rpl);
2131
2132 sp += addend;
2133 }
2134 SET_ESP(sp, sp_mask);
2135 env->eip = new_eip;
2136 if (is_iret) {
2137 /* NOTE: 'cpl' is the _old_ CPL */
2138 eflags_mask = TF_MASK | AC_MASK | ID_MASK | RF_MASK | NT_MASK;
2139 if (cpl == 0) {
2140 eflags_mask |= IOPL_MASK;
2141 }
2142 iopl = (env->eflags >> IOPL_SHIFT) & 3;
2143 if (cpl <= iopl) {
2144 eflags_mask |= IF_MASK;
2145 }
2146 if (shift == 0) {
2147 eflags_mask &= 0xffff;
2148 }
2149 cpu_load_eflags(env, new_eflags, eflags_mask);
2150 }
2151 return;
2152
2153 return_to_vm86:
2154 POPL(ssp, sp, sp_mask, new_esp);
2155 POPL(ssp, sp, sp_mask, new_ss);
2156 POPL(ssp, sp, sp_mask, new_es);
2157 POPL(ssp, sp, sp_mask, new_ds);
2158 POPL(ssp, sp, sp_mask, new_fs);
2159 POPL(ssp, sp, sp_mask, new_gs);
2160
2161 /* modify processor state */
2162 cpu_load_eflags(env, new_eflags, TF_MASK | AC_MASK | ID_MASK |
2163 IF_MASK | IOPL_MASK | VM_MASK | NT_MASK | VIF_MASK |
2164 VIP_MASK);
2165 load_seg_vm(env, R_CS, new_cs & 0xffff);
2166 cpu_x86_set_cpl(env, 3);
2167 load_seg_vm(env, R_SS, new_ss & 0xffff);
2168 load_seg_vm(env, R_ES, new_es & 0xffff);
2169 load_seg_vm(env, R_DS, new_ds & 0xffff);
2170 load_seg_vm(env, R_FS, new_fs & 0xffff);
2171 load_seg_vm(env, R_GS, new_gs & 0xffff);
2172
2173 env->eip = new_eip & 0xffff;
2174 ESP = new_esp;
2175 }
2176
2177 void helper_iret_protected(CPUX86State *env, int shift, int next_eip)
2178 {
2179 int tss_selector, type;
2180 uint32_t e1, e2;
2181
2182 /* specific case for TSS */
2183 if (env->eflags & NT_MASK) {
2184 #ifdef TARGET_X86_64
2185 if (env->hflags & HF_LMA_MASK) {
2186 raise_exception_err(env, EXCP0D_GPF, 0);
2187 }
2188 #endif
2189 tss_selector = cpu_lduw_kernel(env, env->tr.base + 0);
2190 if (tss_selector & 4) {
2191 raise_exception_err(env, EXCP0A_TSS, tss_selector & 0xfffc);
2192 }
2193 if (load_segment(env, &e1, &e2, tss_selector) != 0) {
2194 raise_exception_err(env, EXCP0A_TSS, tss_selector & 0xfffc);
2195 }
2196 type = (e2 >> DESC_TYPE_SHIFT) & 0x17;
2197 /* NOTE: we check both segment and busy TSS */
2198 if (type != 3) {
2199 raise_exception_err(env, EXCP0A_TSS, tss_selector & 0xfffc);
2200 }
2201 switch_tss(env, tss_selector, e1, e2, SWITCH_TSS_IRET, next_eip);
2202 } else {
2203 helper_ret_protected(env, shift, 1, 0);
2204 }
2205 env->hflags2 &= ~HF2_NMI_MASK;
2206 }
2207
2208 void helper_lret_protected(CPUX86State *env, int shift, int addend)
2209 {
2210 helper_ret_protected(env, shift, 0, addend);
2211 }
2212
2213 void helper_sysenter(CPUX86State *env)
2214 {
2215 if (env->sysenter_cs == 0) {
2216 raise_exception_err(env, EXCP0D_GPF, 0);
2217 }
2218 env->eflags &= ~(VM_MASK | IF_MASK | RF_MASK);
2219 cpu_x86_set_cpl(env, 0);
2220
2221 #ifdef TARGET_X86_64
2222 if (env->hflags & HF_LMA_MASK) {
2223 cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc,
2224 0, 0xffffffff,
2225 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2226 DESC_S_MASK |
2227 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK |
2228 DESC_L_MASK);
2229 } else
2230 #endif
2231 {
2232 cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc,
2233 0, 0xffffffff,
2234 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2235 DESC_S_MASK |
2236 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
2237 }
2238 cpu_x86_load_seg_cache(env, R_SS, (env->sysenter_cs + 8) & 0xfffc,
2239 0, 0xffffffff,
2240 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2241 DESC_S_MASK |
2242 DESC_W_MASK | DESC_A_MASK);
2243 ESP = env->sysenter_esp;
2244 EIP = env->sysenter_eip;
2245 }
2246
2247 void helper_sysexit(CPUX86State *env, int dflag)
2248 {
2249 int cpl;
2250
2251 cpl = env->hflags & HF_CPL_MASK;
2252 if (env->sysenter_cs == 0 || cpl != 0) {
2253 raise_exception_err(env, EXCP0D_GPF, 0);
2254 }
2255 cpu_x86_set_cpl(env, 3);
2256 #ifdef TARGET_X86_64
2257 if (dflag == 2) {
2258 cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 32) & 0xfffc) |
2259 3, 0, 0xffffffff,
2260 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2261 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2262 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK |
2263 DESC_L_MASK);
2264 cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 40) & 0xfffc) |
2265 3, 0, 0xffffffff,
2266 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2267 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2268 DESC_W_MASK | DESC_A_MASK);
2269 } else
2270 #endif
2271 {
2272 cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 16) & 0xfffc) |
2273 3, 0, 0xffffffff,
2274 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2275 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2276 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
2277 cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 24) & 0xfffc) |
2278 3, 0, 0xffffffff,
2279 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2280 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2281 DESC_W_MASK | DESC_A_MASK);
2282 }
2283 ESP = ECX;
2284 EIP = EDX;
2285 }
2286
2287 target_ulong helper_lsl(CPUX86State *env, target_ulong selector1)
2288 {
2289 unsigned int limit;
2290 uint32_t e1, e2, eflags, selector;
2291 int rpl, dpl, cpl, type;
2292
2293 selector = selector1 & 0xffff;
2294 eflags = cpu_cc_compute_all(env, CC_OP);
2295 if ((selector & 0xfffc) == 0) {
2296 goto fail;
2297 }
2298 if (load_segment(env, &e1, &e2, selector) != 0) {
2299 goto fail;
2300 }
2301 rpl = selector & 3;
2302 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2303 cpl = env->hflags & HF_CPL_MASK;
2304 if (e2 & DESC_S_MASK) {
2305 if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) {
2306 /* conforming */
2307 } else {
2308 if (dpl < cpl || dpl < rpl) {
2309 goto fail;
2310 }
2311 }
2312 } else {
2313 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2314 switch (type) {
2315 case 1:
2316 case 2:
2317 case 3:
2318 case 9:
2319 case 11:
2320 break;
2321 default:
2322 goto fail;
2323 }
2324 if (dpl < cpl || dpl < rpl) {
2325 fail:
2326 CC_SRC = eflags & ~CC_Z;
2327 return 0;
2328 }
2329 }
2330 limit = get_seg_limit(e1, e2);
2331 CC_SRC = eflags | CC_Z;
2332 return limit;
2333 }
2334
2335 target_ulong helper_lar(CPUX86State *env, target_ulong selector1)
2336 {
2337 uint32_t e1, e2, eflags, selector;
2338 int rpl, dpl, cpl, type;
2339
2340 selector = selector1 & 0xffff;
2341 eflags = cpu_cc_compute_all(env, CC_OP);
2342 if ((selector & 0xfffc) == 0) {
2343 goto fail;
2344 }
2345 if (load_segment(env, &e1, &e2, selector) != 0) {
2346 goto fail;
2347 }
2348 rpl = selector & 3;
2349 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2350 cpl = env->hflags & HF_CPL_MASK;
2351 if (e2 & DESC_S_MASK) {
2352 if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) {
2353 /* conforming */
2354 } else {
2355 if (dpl < cpl || dpl < rpl) {
2356 goto fail;
2357 }
2358 }
2359 } else {
2360 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2361 switch (type) {
2362 case 1:
2363 case 2:
2364 case 3:
2365 case 4:
2366 case 5:
2367 case 9:
2368 case 11:
2369 case 12:
2370 break;
2371 default:
2372 goto fail;
2373 }
2374 if (dpl < cpl || dpl < rpl) {
2375 fail:
2376 CC_SRC = eflags & ~CC_Z;
2377 return 0;
2378 }
2379 }
2380 CC_SRC = eflags | CC_Z;
2381 return e2 & 0x00f0ff00;
2382 }
2383
2384 void helper_verr(CPUX86State *env, target_ulong selector1)
2385 {
2386 uint32_t e1, e2, eflags, selector;
2387 int rpl, dpl, cpl;
2388
2389 selector = selector1 & 0xffff;
2390 eflags = cpu_cc_compute_all(env, CC_OP);
2391 if ((selector & 0xfffc) == 0) {
2392 goto fail;
2393 }
2394 if (load_segment(env, &e1, &e2, selector) != 0) {
2395 goto fail;
2396 }
2397 if (!(e2 & DESC_S_MASK)) {
2398 goto fail;
2399 }
2400 rpl = selector & 3;
2401 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2402 cpl = env->hflags & HF_CPL_MASK;
2403 if (e2 & DESC_CS_MASK) {
2404 if (!(e2 & DESC_R_MASK)) {
2405 goto fail;
2406 }
2407 if (!(e2 & DESC_C_MASK)) {
2408 if (dpl < cpl || dpl < rpl) {
2409 goto fail;
2410 }
2411 }
2412 } else {
2413 if (dpl < cpl || dpl < rpl) {
2414 fail:
2415 CC_SRC = eflags & ~CC_Z;
2416 return;
2417 }
2418 }
2419 CC_SRC = eflags | CC_Z;
2420 }
2421
2422 void helper_verw(CPUX86State *env, target_ulong selector1)
2423 {
2424 uint32_t e1, e2, eflags, selector;
2425 int rpl, dpl, cpl;
2426
2427 selector = selector1 & 0xffff;
2428 eflags = cpu_cc_compute_all(env, CC_OP);
2429 if ((selector & 0xfffc) == 0) {
2430 goto fail;
2431 }
2432 if (load_segment(env, &e1, &e2, selector) != 0) {
2433 goto fail;
2434 }
2435 if (!(e2 & DESC_S_MASK)) {
2436 goto fail;
2437 }
2438 rpl = selector & 3;
2439 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2440 cpl = env->hflags & HF_CPL_MASK;
2441 if (e2 & DESC_CS_MASK) {
2442 goto fail;
2443 } else {
2444 if (dpl < cpl || dpl < rpl) {
2445 goto fail;
2446 }
2447 if (!(e2 & DESC_W_MASK)) {
2448 fail:
2449 CC_SRC = eflags & ~CC_Z;
2450 return;
2451 }
2452 }
2453 CC_SRC = eflags | CC_Z;
2454 }
2455
2456 #if defined(CONFIG_USER_ONLY)
2457 void cpu_x86_load_seg(CPUX86State *env, int seg_reg, int selector)
2458 {
2459 if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
2460 selector &= 0xffff;
2461 cpu_x86_load_seg_cache(env, seg_reg, selector,
2462 (selector << 4), 0xffff, 0);
2463 } else {
2464 helper_load_seg(env, seg_reg, selector);
2465 }
2466 }
2467 #endif
Qemu copy for testing