2 * x86 segmentation related helpers:
3 * TSS, interrupts, system calls, jumps and call/task gates, descriptors
5 * Copyright (c) 2003 Fabrice Bellard
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
27 #if !defined(CONFIG_USER_ONLY)
28 #include "exec/softmmu_exec.h"
29 #endif /* !defined(CONFIG_USER_ONLY) */
32 # define LOG_PCALL(...) qemu_log_mask(CPU_LOG_PCALL, ## __VA_ARGS__)
33 # define LOG_PCALL_STATE(cpu) \
34 log_cpu_state_mask(CPU_LOG_PCALL, (cpu), CPU_DUMP_CCOP)
36 # define LOG_PCALL(...) do { } while (0)
37 # define LOG_PCALL_STATE(cpu) do { } while (0)
40 /* return non zero if error */
41 static inline int load_segment(CPUX86State *env, uint32_t *e1_ptr,
42 uint32_t *e2_ptr, int selector)
53 index = selector & ~7;
54 if ((index + 7) > dt->limit) {
57 ptr = dt->base + index;
58 *e1_ptr = cpu_ldl_kernel(env, ptr);
59 *e2_ptr = cpu_ldl_kernel(env, ptr + 4);
63 static inline unsigned int get_seg_limit(uint32_t e1, uint32_t e2)
67 limit = (e1 & 0xffff) | (e2 & 0x000f0000);
68 if (e2 & DESC_G_MASK) {
69 limit = (limit << 12) | 0xfff;
74 static inline uint32_t get_seg_base(uint32_t e1, uint32_t e2)
76 return (e1 >> 16) | ((e2 & 0xff) << 16) | (e2 & 0xff000000);
79 static inline void load_seg_cache_raw_dt(SegmentCache *sc, uint32_t e1,
82 sc->base = get_seg_base(e1, e2);
83 sc->limit = get_seg_limit(e1, e2);
87 /* init the segment cache in vm86 mode. */
88 static inline void load_seg_vm(CPUX86State *env, int seg, int selector)
91 cpu_x86_load_seg_cache(env, seg, selector,
92 (selector << 4), 0xffff, 0);
95 static inline void get_ss_esp_from_tss(CPUX86State *env, uint32_t *ss_ptr,
96 uint32_t *esp_ptr, int dpl)
98 int type, index, shift;
103 printf("TR: base=%p limit=%x\n", env->tr.base, env->tr.limit);
104 for (i = 0; i < env->tr.limit; i++) {
105 printf("%02x ", env->tr.base[i]);
114 if (!(env->tr.flags & DESC_P_MASK)) {
115 cpu_abort(env, "invalid tss");
117 type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
118 if ((type & 7) != 1) {
119 cpu_abort(env, "invalid tss type");
122 index = (dpl * 4 + 2) << shift;
123 if (index + (4 << shift) - 1 > env->tr.limit) {
124 raise_exception_err(env, EXCP0A_TSS, env->tr.selector & 0xfffc);
127 *esp_ptr = cpu_lduw_kernel(env, env->tr.base + index);
128 *ss_ptr = cpu_lduw_kernel(env, env->tr.base + index + 2);
130 *esp_ptr = cpu_ldl_kernel(env, env->tr.base + index);
131 *ss_ptr = cpu_lduw_kernel(env, env->tr.base + index + 4);
135 /* XXX: merge with load_seg() */
136 static void tss_load_seg(CPUX86State *env, int seg_reg, int selector)
141 if ((selector & 0xfffc) != 0) {
142 if (load_segment(env, &e1, &e2, selector) != 0) {
143 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
145 if (!(e2 & DESC_S_MASK)) {
146 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
149 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
150 cpl = env->hflags & HF_CPL_MASK;
151 if (seg_reg == R_CS) {
152 if (!(e2 & DESC_CS_MASK)) {
153 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
155 /* XXX: is it correct? */
157 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
159 if ((e2 & DESC_C_MASK) && dpl > rpl) {
160 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
162 } else if (seg_reg == R_SS) {
163 /* SS must be writable data */
164 if ((e2 & DESC_CS_MASK) || !(e2 & DESC_W_MASK)) {
165 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
167 if (dpl != cpl || dpl != rpl) {
168 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
171 /* not readable code */
172 if ((e2 & DESC_CS_MASK) && !(e2 & DESC_R_MASK)) {
173 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
175 /* if data or non conforming code, checks the rights */
176 if (((e2 >> DESC_TYPE_SHIFT) & 0xf) < 12) {
177 if (dpl < cpl || dpl < rpl) {
178 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
182 if (!(e2 & DESC_P_MASK)) {
183 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc);
185 cpu_x86_load_seg_cache(env, seg_reg, selector,
186 get_seg_base(e1, e2),
187 get_seg_limit(e1, e2),
190 if (seg_reg == R_SS || seg_reg == R_CS) {
191 raise_exception_err(env, EXCP0A_TSS, selector & 0xfffc);
196 #define SWITCH_TSS_JMP 0
197 #define SWITCH_TSS_IRET 1
198 #define SWITCH_TSS_CALL 2
200 /* XXX: restore CPU state in registers (PowerPC case) */
201 static void switch_tss(CPUX86State *env, int tss_selector,
202 uint32_t e1, uint32_t e2, int source,
205 int tss_limit, tss_limit_max, type, old_tss_limit_max, old_type, v1, v2, i;
206 target_ulong tss_base;
207 uint32_t new_regs[8], new_segs[6];
208 uint32_t new_eflags, new_eip, new_cr3, new_ldt, new_trap;
209 uint32_t old_eflags, eflags_mask;
214 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
215 LOG_PCALL("switch_tss: sel=0x%04x type=%d src=%d\n", tss_selector, type,
218 /* if task gate, we read the TSS segment and we load it */
220 if (!(e2 & DESC_P_MASK)) {
221 raise_exception_err(env, EXCP0B_NOSEG, tss_selector & 0xfffc);
223 tss_selector = e1 >> 16;
224 if (tss_selector & 4) {
225 raise_exception_err(env, EXCP0A_TSS, tss_selector & 0xfffc);
227 if (load_segment(env, &e1, &e2, tss_selector) != 0) {
228 raise_exception_err(env, EXCP0D_GPF, tss_selector & 0xfffc);
230 if (e2 & DESC_S_MASK) {
231 raise_exception_err(env, EXCP0D_GPF, tss_selector & 0xfffc);
233 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
234 if ((type & 7) != 1) {
235 raise_exception_err(env, EXCP0D_GPF, tss_selector & 0xfffc);
239 if (!(e2 & DESC_P_MASK)) {
240 raise_exception_err(env, EXCP0B_NOSEG, tss_selector & 0xfffc);
248 tss_limit = get_seg_limit(e1, e2);
249 tss_base = get_seg_base(e1, e2);
250 if ((tss_selector & 4) != 0 ||
251 tss_limit < tss_limit_max) {
252 raise_exception_err(env, EXCP0A_TSS, tss_selector & 0xfffc);
254 old_type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
256 old_tss_limit_max = 103;
258 old_tss_limit_max = 43;
261 /* read all the registers from the new TSS */
264 new_cr3 = cpu_ldl_kernel(env, tss_base + 0x1c);
265 new_eip = cpu_ldl_kernel(env, tss_base + 0x20);
266 new_eflags = cpu_ldl_kernel(env, tss_base + 0x24);
267 for (i = 0; i < 8; i++) {
268 new_regs[i] = cpu_ldl_kernel(env, tss_base + (0x28 + i * 4));
270 for (i = 0; i < 6; i++) {
271 new_segs[i] = cpu_lduw_kernel(env, tss_base + (0x48 + i * 4));
273 new_ldt = cpu_lduw_kernel(env, tss_base + 0x60);
274 new_trap = cpu_ldl_kernel(env, tss_base + 0x64);
278 new_eip = cpu_lduw_kernel(env, tss_base + 0x0e);
279 new_eflags = cpu_lduw_kernel(env, tss_base + 0x10);
280 for (i = 0; i < 8; i++) {
281 new_regs[i] = cpu_lduw_kernel(env, tss_base + (0x12 + i * 2)) |
284 for (i = 0; i < 4; i++) {
285 new_segs[i] = cpu_lduw_kernel(env, tss_base + (0x22 + i * 4));
287 new_ldt = cpu_lduw_kernel(env, tss_base + 0x2a);
292 /* XXX: avoid a compiler warning, see
293 http://support.amd.com/us/Processor_TechDocs/24593.pdf
294 chapters 12.2.5 and 13.2.4 on how to implement TSS Trap bit */
297 /* NOTE: we must avoid memory exceptions during the task switch,
298 so we make dummy accesses before */
299 /* XXX: it can still fail in some cases, so a bigger hack is
300 necessary to valid the TLB after having done the accesses */
302 v1 = cpu_ldub_kernel(env, env->tr.base);
303 v2 = cpu_ldub_kernel(env, env->tr.base + old_tss_limit_max);
304 cpu_stb_kernel(env, env->tr.base, v1);
305 cpu_stb_kernel(env, env->tr.base + old_tss_limit_max, v2);
307 /* clear busy bit (it is restartable) */
308 if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_IRET) {
312 ptr = env->gdt.base + (env->tr.selector & ~7);
313 e2 = cpu_ldl_kernel(env, ptr + 4);
314 e2 &= ~DESC_TSS_BUSY_MASK;
315 cpu_stl_kernel(env, ptr + 4, e2);
317 old_eflags = cpu_compute_eflags(env);
318 if (source == SWITCH_TSS_IRET) {
319 old_eflags &= ~NT_MASK;
322 /* save the current state in the old TSS */
325 cpu_stl_kernel(env, env->tr.base + 0x20, next_eip);
326 cpu_stl_kernel(env, env->tr.base + 0x24, old_eflags);
327 cpu_stl_kernel(env, env->tr.base + (0x28 + 0 * 4), env->regs[R_EAX]);
328 cpu_stl_kernel(env, env->tr.base + (0x28 + 1 * 4), env->regs[R_ECX]);
329 cpu_stl_kernel(env, env->tr.base + (0x28 + 2 * 4), env->regs[R_EDX]);
330 cpu_stl_kernel(env, env->tr.base + (0x28 + 3 * 4), env->regs[R_EBX]);
331 cpu_stl_kernel(env, env->tr.base + (0x28 + 4 * 4), env->regs[R_ESP]);
332 cpu_stl_kernel(env, env->tr.base + (0x28 + 5 * 4), env->regs[R_EBP]);
333 cpu_stl_kernel(env, env->tr.base + (0x28 + 6 * 4), env->regs[R_ESI]);
334 cpu_stl_kernel(env, env->tr.base + (0x28 + 7 * 4), env->regs[R_EDI]);
335 for (i = 0; i < 6; i++) {
336 cpu_stw_kernel(env, env->tr.base + (0x48 + i * 4),
337 env->segs[i].selector);
341 cpu_stw_kernel(env, env->tr.base + 0x0e, next_eip);
342 cpu_stw_kernel(env, env->tr.base + 0x10, old_eflags);
343 cpu_stw_kernel(env, env->tr.base + (0x12 + 0 * 2), env->regs[R_EAX]);
344 cpu_stw_kernel(env, env->tr.base + (0x12 + 1 * 2), env->regs[R_ECX]);
345 cpu_stw_kernel(env, env->tr.base + (0x12 + 2 * 2), env->regs[R_EDX]);
346 cpu_stw_kernel(env, env->tr.base + (0x12 + 3 * 2), env->regs[R_EBX]);
347 cpu_stw_kernel(env, env->tr.base + (0x12 + 4 * 2), env->regs[R_ESP]);
348 cpu_stw_kernel(env, env->tr.base + (0x12 + 5 * 2), env->regs[R_EBP]);
349 cpu_stw_kernel(env, env->tr.base + (0x12 + 6 * 2), env->regs[R_ESI]);
350 cpu_stw_kernel(env, env->tr.base + (0x12 + 7 * 2), env->regs[R_EDI]);
351 for (i = 0; i < 4; i++) {
352 cpu_stw_kernel(env, env->tr.base + (0x22 + i * 4),
353 env->segs[i].selector);
357 /* now if an exception occurs, it will occurs in the next task
360 if (source == SWITCH_TSS_CALL) {
361 cpu_stw_kernel(env, tss_base, env->tr.selector);
362 new_eflags |= NT_MASK;
366 if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_CALL) {
370 ptr = env->gdt.base + (tss_selector & ~7);
371 e2 = cpu_ldl_kernel(env, ptr + 4);
372 e2 |= DESC_TSS_BUSY_MASK;
373 cpu_stl_kernel(env, ptr + 4, e2);
376 /* set the new CPU state */
377 /* from this point, any exception which occurs can give problems */
378 env->cr[0] |= CR0_TS_MASK;
379 env->hflags |= HF_TS_MASK;
380 env->tr.selector = tss_selector;
381 env->tr.base = tss_base;
382 env->tr.limit = tss_limit;
383 env->tr.flags = e2 & ~DESC_TSS_BUSY_MASK;
385 if ((type & 8) && (env->cr[0] & CR0_PG_MASK)) {
386 cpu_x86_update_cr3(env, new_cr3);
389 /* load all registers without an exception, then reload them with
390 possible exception */
392 eflags_mask = TF_MASK | AC_MASK | ID_MASK |
393 IF_MASK | IOPL_MASK | VM_MASK | RF_MASK | NT_MASK;
395 eflags_mask &= 0xffff;
397 cpu_load_eflags(env, new_eflags, eflags_mask);
398 /* XXX: what to do in 16 bit case? */
399 env->regs[R_EAX] = new_regs[0];
400 env->regs[R_ECX] = new_regs[1];
401 env->regs[R_EDX] = new_regs[2];
402 env->regs[R_EBX] = new_regs[3];
403 env->regs[R_ESP] = new_regs[4];
404 env->regs[R_EBP] = new_regs[5];
405 env->regs[R_ESI] = new_regs[6];
406 env->regs[R_EDI] = new_regs[7];
407 if (new_eflags & VM_MASK) {
408 for (i = 0; i < 6; i++) {
409 load_seg_vm(env, i, new_segs[i]);
411 /* in vm86, CPL is always 3 */
412 cpu_x86_set_cpl(env, 3);
414 /* CPL is set the RPL of CS */
415 cpu_x86_set_cpl(env, new_segs[R_CS] & 3);
416 /* first just selectors as the rest may trigger exceptions */
417 for (i = 0; i < 6; i++) {
418 cpu_x86_load_seg_cache(env, i, new_segs[i], 0, 0, 0);
422 env->ldt.selector = new_ldt & ~4;
429 raise_exception_err(env, EXCP0A_TSS, new_ldt & 0xfffc);
432 if ((new_ldt & 0xfffc) != 0) {
434 index = new_ldt & ~7;
435 if ((index + 7) > dt->limit) {
436 raise_exception_err(env, EXCP0A_TSS, new_ldt & 0xfffc);
438 ptr = dt->base + index;
439 e1 = cpu_ldl_kernel(env, ptr);
440 e2 = cpu_ldl_kernel(env, ptr + 4);
441 if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2) {
442 raise_exception_err(env, EXCP0A_TSS, new_ldt & 0xfffc);
444 if (!(e2 & DESC_P_MASK)) {
445 raise_exception_err(env, EXCP0A_TSS, new_ldt & 0xfffc);
447 load_seg_cache_raw_dt(&env->ldt, e1, e2);
450 /* load the segments */
451 if (!(new_eflags & VM_MASK)) {
452 tss_load_seg(env, R_CS, new_segs[R_CS]);
453 tss_load_seg(env, R_SS, new_segs[R_SS]);
454 tss_load_seg(env, R_ES, new_segs[R_ES]);
455 tss_load_seg(env, R_DS, new_segs[R_DS]);
456 tss_load_seg(env, R_FS, new_segs[R_FS]);
457 tss_load_seg(env, R_GS, new_segs[R_GS]);
460 /* check that env->eip is in the CS segment limits */
461 if (new_eip > env->segs[R_CS].limit) {
462 /* XXX: different exception if CALL? */
463 raise_exception_err(env, EXCP0D_GPF, 0);
466 #ifndef CONFIG_USER_ONLY
467 /* reset local breakpoints */
468 if (env->dr[7] & DR7_LOCAL_BP_MASK) {
469 for (i = 0; i < DR7_MAX_BP; i++) {
470 if (hw_local_breakpoint_enabled(env->dr[7], i) &&
471 !hw_global_breakpoint_enabled(env->dr[7], i)) {
472 hw_breakpoint_remove(env, i);
475 env->dr[7] &= ~DR7_LOCAL_BP_MASK;
480 static inline unsigned int get_sp_mask(unsigned int e2)
482 if (e2 & DESC_B_MASK) {
489 static int exception_has_error_code(int intno)
505 #define SET_ESP(val, sp_mask) \
507 if ((sp_mask) == 0xffff) { \
508 env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | \
510 } else if ((sp_mask) == 0xffffffffLL) { \
511 env->regs[R_ESP] = (uint32_t)(val); \
513 env->regs[R_ESP] = (val); \
517 #define SET_ESP(val, sp_mask) \
519 env->regs[R_ESP] = (env->regs[R_ESP] & ~(sp_mask)) | \
520 ((val) & (sp_mask)); \
524 /* in 64-bit machines, this can overflow. So this segment addition macro
525 * can be used to trim the value to 32-bit whenever needed */
526 #define SEG_ADDL(ssp, sp, sp_mask) ((uint32_t)((ssp) + (sp & (sp_mask))))
528 /* XXX: add a is_user flag to have proper security support */
529 #define PUSHW(ssp, sp, sp_mask, val) \
532 cpu_stw_kernel(env, (ssp) + (sp & (sp_mask)), (val)); \
535 #define PUSHL(ssp, sp, sp_mask, val) \
538 cpu_stl_kernel(env, SEG_ADDL(ssp, sp, sp_mask), (uint32_t)(val)); \
541 #define POPW(ssp, sp, sp_mask, val) \
543 val = cpu_lduw_kernel(env, (ssp) + (sp & (sp_mask))); \
547 #define POPL(ssp, sp, sp_mask, val) \
549 val = (uint32_t)cpu_ldl_kernel(env, SEG_ADDL(ssp, sp, sp_mask)); \
553 /* protected mode interrupt */
554 static void do_interrupt_protected(CPUX86State *env, int intno, int is_int,
555 int error_code, unsigned int next_eip,
559 target_ulong ptr, ssp;
560 int type, dpl, selector, ss_dpl, cpl;
561 int has_error_code, new_stack, shift;
562 uint32_t e1, e2, offset, ss = 0, esp, ss_e1 = 0, ss_e2 = 0;
563 uint32_t old_eip, sp_mask;
566 if (!is_int && !is_hw) {
567 has_error_code = exception_has_error_code(intno);
576 if (intno * 8 + 7 > dt->limit) {
577 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2);
579 ptr = dt->base + intno * 8;
580 e1 = cpu_ldl_kernel(env, ptr);
581 e2 = cpu_ldl_kernel(env, ptr + 4);
582 /* check gate type */
583 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
585 case 5: /* task gate */
586 /* must do that check here to return the correct error code */
587 if (!(e2 & DESC_P_MASK)) {
588 raise_exception_err(env, EXCP0B_NOSEG, intno * 8 + 2);
590 switch_tss(env, intno * 8, e1, e2, SWITCH_TSS_CALL, old_eip);
591 if (has_error_code) {
595 /* push the error code */
596 type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
598 if (env->segs[R_SS].flags & DESC_B_MASK) {
603 esp = (env->regs[R_ESP] - (2 << shift)) & mask;
604 ssp = env->segs[R_SS].base + esp;
606 cpu_stl_kernel(env, ssp, error_code);
608 cpu_stw_kernel(env, ssp, error_code);
613 case 6: /* 286 interrupt gate */
614 case 7: /* 286 trap gate */
615 case 14: /* 386 interrupt gate */
616 case 15: /* 386 trap gate */
619 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2);
622 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
623 cpl = env->hflags & HF_CPL_MASK;
624 /* check privilege if software int */
625 if (is_int && dpl < cpl) {
626 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2);
628 /* check valid bit */
629 if (!(e2 & DESC_P_MASK)) {
630 raise_exception_err(env, EXCP0B_NOSEG, intno * 8 + 2);
633 offset = (e2 & 0xffff0000) | (e1 & 0x0000ffff);
634 if ((selector & 0xfffc) == 0) {
635 raise_exception_err(env, EXCP0D_GPF, 0);
637 if (load_segment(env, &e1, &e2, selector) != 0) {
638 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
640 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK))) {
641 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
643 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
645 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
647 if (!(e2 & DESC_P_MASK)) {
648 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc);
650 if (!(e2 & DESC_C_MASK) && dpl < cpl) {
651 /* to inner privilege */
652 get_ss_esp_from_tss(env, &ss, &esp, dpl);
653 if ((ss & 0xfffc) == 0) {
654 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
656 if ((ss & 3) != dpl) {
657 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
659 if (load_segment(env, &ss_e1, &ss_e2, ss) != 0) {
660 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
662 ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
664 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
666 if (!(ss_e2 & DESC_S_MASK) ||
667 (ss_e2 & DESC_CS_MASK) ||
668 !(ss_e2 & DESC_W_MASK)) {
669 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
671 if (!(ss_e2 & DESC_P_MASK)) {
672 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
675 sp_mask = get_sp_mask(ss_e2);
676 ssp = get_seg_base(ss_e1, ss_e2);
677 } else if ((e2 & DESC_C_MASK) || dpl == cpl) {
678 /* to same privilege */
679 if (env->eflags & VM_MASK) {
680 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
683 sp_mask = get_sp_mask(env->segs[R_SS].flags);
684 ssp = env->segs[R_SS].base;
685 esp = env->regs[R_ESP];
688 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
689 new_stack = 0; /* avoid warning */
690 sp_mask = 0; /* avoid warning */
691 ssp = 0; /* avoid warning */
692 esp = 0; /* avoid warning */
698 /* XXX: check that enough room is available */
699 push_size = 6 + (new_stack << 2) + (has_error_code << 1);
700 if (env->eflags & VM_MASK) {
707 if (env->eflags & VM_MASK) {
708 PUSHL(ssp, esp, sp_mask, env->segs[R_GS].selector);
709 PUSHL(ssp, esp, sp_mask, env->segs[R_FS].selector);
710 PUSHL(ssp, esp, sp_mask, env->segs[R_DS].selector);
711 PUSHL(ssp, esp, sp_mask, env->segs[R_ES].selector);
713 PUSHL(ssp, esp, sp_mask, env->segs[R_SS].selector);
714 PUSHL(ssp, esp, sp_mask, env->regs[R_ESP]);
716 PUSHL(ssp, esp, sp_mask, cpu_compute_eflags(env));
717 PUSHL(ssp, esp, sp_mask, env->segs[R_CS].selector);
718 PUSHL(ssp, esp, sp_mask, old_eip);
719 if (has_error_code) {
720 PUSHL(ssp, esp, sp_mask, error_code);
724 if (env->eflags & VM_MASK) {
725 PUSHW(ssp, esp, sp_mask, env->segs[R_GS].selector);
726 PUSHW(ssp, esp, sp_mask, env->segs[R_FS].selector);
727 PUSHW(ssp, esp, sp_mask, env->segs[R_DS].selector);
728 PUSHW(ssp, esp, sp_mask, env->segs[R_ES].selector);
730 PUSHW(ssp, esp, sp_mask, env->segs[R_SS].selector);
731 PUSHW(ssp, esp, sp_mask, env->regs[R_ESP]);
733 PUSHW(ssp, esp, sp_mask, cpu_compute_eflags(env));
734 PUSHW(ssp, esp, sp_mask, env->segs[R_CS].selector);
735 PUSHW(ssp, esp, sp_mask, old_eip);
736 if (has_error_code) {
737 PUSHW(ssp, esp, sp_mask, error_code);
742 if (env->eflags & VM_MASK) {
743 cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0, 0);
744 cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0, 0);
745 cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0, 0);
746 cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0, 0);
748 ss = (ss & ~3) | dpl;
749 cpu_x86_load_seg_cache(env, R_SS, ss,
750 ssp, get_seg_limit(ss_e1, ss_e2), ss_e2);
752 SET_ESP(esp, sp_mask);
754 selector = (selector & ~3) | dpl;
755 cpu_x86_load_seg_cache(env, R_CS, selector,
756 get_seg_base(e1, e2),
757 get_seg_limit(e1, e2),
759 cpu_x86_set_cpl(env, dpl);
762 /* interrupt gate clear IF mask */
763 if ((type & 1) == 0) {
764 env->eflags &= ~IF_MASK;
766 env->eflags &= ~(TF_MASK | VM_MASK | RF_MASK | NT_MASK);
771 #define PUSHQ(sp, val) \
774 cpu_stq_kernel(env, sp, (val)); \
777 #define POPQ(sp, val) \
779 val = cpu_ldq_kernel(env, sp); \
783 static inline target_ulong get_rsp_from_tss(CPUX86State *env, int level)
788 printf("TR: base=" TARGET_FMT_lx " limit=%x\n",
789 env->tr.base, env->tr.limit);
792 if (!(env->tr.flags & DESC_P_MASK)) {
793 cpu_abort(env, "invalid tss");
795 index = 8 * level + 4;
796 if ((index + 7) > env->tr.limit) {
797 raise_exception_err(env, EXCP0A_TSS, env->tr.selector & 0xfffc);
799 return cpu_ldq_kernel(env, env->tr.base + index);
802 /* 64 bit interrupt */
803 static void do_interrupt64(CPUX86State *env, int intno, int is_int,
804 int error_code, target_ulong next_eip, int is_hw)
808 int type, dpl, selector, cpl, ist;
809 int has_error_code, new_stack;
810 uint32_t e1, e2, e3, ss;
811 target_ulong old_eip, esp, offset;
814 if (!is_int && !is_hw) {
815 has_error_code = exception_has_error_code(intno);
824 if (intno * 16 + 15 > dt->limit) {
825 raise_exception_err(env, EXCP0D_GPF, intno * 16 + 2);
827 ptr = dt->base + intno * 16;
828 e1 = cpu_ldl_kernel(env, ptr);
829 e2 = cpu_ldl_kernel(env, ptr + 4);
830 e3 = cpu_ldl_kernel(env, ptr + 8);
831 /* check gate type */
832 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
834 case 14: /* 386 interrupt gate */
835 case 15: /* 386 trap gate */
838 raise_exception_err(env, EXCP0D_GPF, intno * 16 + 2);
841 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
842 cpl = env->hflags & HF_CPL_MASK;
843 /* check privilege if software int */
844 if (is_int && dpl < cpl) {
845 raise_exception_err(env, EXCP0D_GPF, intno * 16 + 2);
847 /* check valid bit */
848 if (!(e2 & DESC_P_MASK)) {
849 raise_exception_err(env, EXCP0B_NOSEG, intno * 16 + 2);
852 offset = ((target_ulong)e3 << 32) | (e2 & 0xffff0000) | (e1 & 0x0000ffff);
854 if ((selector & 0xfffc) == 0) {
855 raise_exception_err(env, EXCP0D_GPF, 0);
858 if (load_segment(env, &e1, &e2, selector) != 0) {
859 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
861 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK))) {
862 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
864 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
866 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
868 if (!(e2 & DESC_P_MASK)) {
869 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc);
871 if (!(e2 & DESC_L_MASK) || (e2 & DESC_B_MASK)) {
872 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
874 if ((!(e2 & DESC_C_MASK) && dpl < cpl) || ist != 0) {
875 /* to inner privilege */
877 esp = get_rsp_from_tss(env, ist + 3);
879 esp = get_rsp_from_tss(env, dpl);
881 esp &= ~0xfLL; /* align stack */
884 } else if ((e2 & DESC_C_MASK) || dpl == cpl) {
885 /* to same privilege */
886 if (env->eflags & VM_MASK) {
887 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
891 esp = get_rsp_from_tss(env, ist + 3);
893 esp = env->regs[R_ESP];
895 esp &= ~0xfLL; /* align stack */
898 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
899 new_stack = 0; /* avoid warning */
900 esp = 0; /* avoid warning */
903 PUSHQ(esp, env->segs[R_SS].selector);
904 PUSHQ(esp, env->regs[R_ESP]);
905 PUSHQ(esp, cpu_compute_eflags(env));
906 PUSHQ(esp, env->segs[R_CS].selector);
908 if (has_error_code) {
909 PUSHQ(esp, error_code);
914 cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, 0);
916 env->regs[R_ESP] = esp;
918 selector = (selector & ~3) | dpl;
919 cpu_x86_load_seg_cache(env, R_CS, selector,
920 get_seg_base(e1, e2),
921 get_seg_limit(e1, e2),
923 cpu_x86_set_cpl(env, dpl);
926 /* interrupt gate clear IF mask */
927 if ((type & 1) == 0) {
928 env->eflags &= ~IF_MASK;
930 env->eflags &= ~(TF_MASK | VM_MASK | RF_MASK | NT_MASK);
935 #if defined(CONFIG_USER_ONLY)
936 void helper_syscall(CPUX86State *env, int next_eip_addend)
938 CPUState *cs = CPU(x86_env_get_cpu(env));
940 cs->exception_index = EXCP_SYSCALL;
941 env->exception_next_eip = env->eip + next_eip_addend;
945 void helper_syscall(CPUX86State *env, int next_eip_addend)
949 if (!(env->efer & MSR_EFER_SCE)) {
950 raise_exception_err(env, EXCP06_ILLOP, 0);
952 selector = (env->star >> 32) & 0xffff;
953 if (env->hflags & HF_LMA_MASK) {
956 env->regs[R_ECX] = env->eip + next_eip_addend;
957 env->regs[11] = cpu_compute_eflags(env);
959 code64 = env->hflags & HF_CS64_MASK;
961 cpu_x86_set_cpl(env, 0);
962 cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
964 DESC_G_MASK | DESC_P_MASK |
966 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK |
968 cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
970 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
972 DESC_W_MASK | DESC_A_MASK);
973 env->eflags &= ~env->fmask;
974 cpu_load_eflags(env, env->eflags, 0);
976 env->eip = env->lstar;
978 env->eip = env->cstar;
981 env->regs[R_ECX] = (uint32_t)(env->eip + next_eip_addend);
983 cpu_x86_set_cpl(env, 0);
984 cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
986 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
988 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
989 cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
991 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
993 DESC_W_MASK | DESC_A_MASK);
994 env->eflags &= ~(IF_MASK | RF_MASK | VM_MASK);
995 env->eip = (uint32_t)env->star;
1001 #ifdef TARGET_X86_64
1002 void helper_sysret(CPUX86State *env, int dflag)
1006 if (!(env->efer & MSR_EFER_SCE)) {
1007 raise_exception_err(env, EXCP06_ILLOP, 0);
1009 cpl = env->hflags & HF_CPL_MASK;
1010 if (!(env->cr[0] & CR0_PE_MASK) || cpl != 0) {
1011 raise_exception_err(env, EXCP0D_GPF, 0);
1013 selector = (env->star >> 48) & 0xffff;
1014 if (env->hflags & HF_LMA_MASK) {
1016 cpu_x86_load_seg_cache(env, R_CS, (selector + 16) | 3,
1018 DESC_G_MASK | DESC_P_MASK |
1019 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1020 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK |
1022 env->eip = env->regs[R_ECX];
1024 cpu_x86_load_seg_cache(env, R_CS, selector | 3,
1026 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1027 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1028 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
1029 env->eip = (uint32_t)env->regs[R_ECX];
1031 cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1033 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1034 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1035 DESC_W_MASK | DESC_A_MASK);
1036 cpu_load_eflags(env, (uint32_t)(env->regs[11]), TF_MASK | AC_MASK
1037 | ID_MASK | IF_MASK | IOPL_MASK | VM_MASK | RF_MASK |
1039 cpu_x86_set_cpl(env, 3);
1041 cpu_x86_load_seg_cache(env, R_CS, selector | 3,
1043 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1044 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1045 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
1046 env->eip = (uint32_t)env->regs[R_ECX];
1047 cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1049 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1050 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1051 DESC_W_MASK | DESC_A_MASK);
1052 env->eflags |= IF_MASK;
1053 cpu_x86_set_cpl(env, 3);
1058 /* real mode interrupt */
1059 static void do_interrupt_real(CPUX86State *env, int intno, int is_int,
1060 int error_code, unsigned int next_eip)
1063 target_ulong ptr, ssp;
1065 uint32_t offset, esp;
1066 uint32_t old_cs, old_eip;
1068 /* real mode (simpler!) */
1070 if (intno * 4 + 3 > dt->limit) {
1071 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2);
1073 ptr = dt->base + intno * 4;
1074 offset = cpu_lduw_kernel(env, ptr);
1075 selector = cpu_lduw_kernel(env, ptr + 2);
1076 esp = env->regs[R_ESP];
1077 ssp = env->segs[R_SS].base;
1083 old_cs = env->segs[R_CS].selector;
1084 /* XXX: use SS segment size? */
1085 PUSHW(ssp, esp, 0xffff, cpu_compute_eflags(env));
1086 PUSHW(ssp, esp, 0xffff, old_cs);
1087 PUSHW(ssp, esp, 0xffff, old_eip);
1089 /* update processor state */
1090 env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | (esp & 0xffff);
1092 env->segs[R_CS].selector = selector;
1093 env->segs[R_CS].base = (selector << 4);
1094 env->eflags &= ~(IF_MASK | TF_MASK | AC_MASK | RF_MASK);
1097 #if defined(CONFIG_USER_ONLY)
1098 /* fake user mode interrupt */
1099 static void do_interrupt_user(CPUX86State *env, int intno, int is_int,
1100 int error_code, target_ulong next_eip)
1104 int dpl, cpl, shift;
1108 if (env->hflags & HF_LMA_MASK) {
1113 ptr = dt->base + (intno << shift);
1114 e2 = cpu_ldl_kernel(env, ptr + 4);
1116 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1117 cpl = env->hflags & HF_CPL_MASK;
1118 /* check privilege if software int */
1119 if (is_int && dpl < cpl) {
1120 raise_exception_err(env, EXCP0D_GPF, (intno << shift) + 2);
1123 /* Since we emulate only user space, we cannot do more than
1124 exiting the emulation with the suitable exception and error
1127 env->eip = next_eip;
1133 static void handle_even_inj(CPUX86State *env, int intno, int is_int,
1134 int error_code, int is_hw, int rm)
1136 CPUState *cs = CPU(x86_env_get_cpu(env));
1137 uint32_t event_inj = ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
1138 control.event_inj));
1140 if (!(event_inj & SVM_EVTINJ_VALID)) {
1144 type = SVM_EVTINJ_TYPE_SOFT;
1146 type = SVM_EVTINJ_TYPE_EXEPT;
1148 event_inj = intno | type | SVM_EVTINJ_VALID;
1149 if (!rm && exception_has_error_code(intno)) {
1150 event_inj |= SVM_EVTINJ_VALID_ERR;
1151 stl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
1152 control.event_inj_err),
1156 env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
1163 * Begin execution of an interruption. is_int is TRUE if coming from
1164 * the int instruction. next_eip is the env->eip value AFTER the interrupt
1165 * instruction. It is only relevant if is_int is TRUE.
1167 static void do_interrupt_all(X86CPU *cpu, int intno, int is_int,
1168 int error_code, target_ulong next_eip, int is_hw)
1170 CPUX86State *env = &cpu->env;
1172 if (qemu_loglevel_mask(CPU_LOG_INT)) {
1173 if ((env->cr[0] & CR0_PE_MASK)) {
1176 qemu_log("%6d: v=%02x e=%04x i=%d cpl=%d IP=%04x:" TARGET_FMT_lx
1177 " pc=" TARGET_FMT_lx " SP=%04x:" TARGET_FMT_lx,
1178 count, intno, error_code, is_int,
1179 env->hflags & HF_CPL_MASK,
1180 env->segs[R_CS].selector, env->eip,
1181 (int)env->segs[R_CS].base + env->eip,
1182 env->segs[R_SS].selector, env->regs[R_ESP]);
1183 if (intno == 0x0e) {
1184 qemu_log(" CR2=" TARGET_FMT_lx, env->cr[2]);
1186 qemu_log(" env->regs[R_EAX]=" TARGET_FMT_lx, env->regs[R_EAX]);
1189 log_cpu_state(CPU(cpu), CPU_DUMP_CCOP);
1196 ptr = env->segs[R_CS].base + env->eip;
1197 for (i = 0; i < 16; i++) {
1198 qemu_log(" %02x", ldub(ptr + i));
1206 if (env->cr[0] & CR0_PE_MASK) {
1207 #if !defined(CONFIG_USER_ONLY)
1208 if (env->hflags & HF_SVMI_MASK) {
1209 handle_even_inj(env, intno, is_int, error_code, is_hw, 0);
1212 #ifdef TARGET_X86_64
1213 if (env->hflags & HF_LMA_MASK) {
1214 do_interrupt64(env, intno, is_int, error_code, next_eip, is_hw);
1218 do_interrupt_protected(env, intno, is_int, error_code, next_eip,
1222 #if !defined(CONFIG_USER_ONLY)
1223 if (env->hflags & HF_SVMI_MASK) {
1224 handle_even_inj(env, intno, is_int, error_code, is_hw, 1);
1227 do_interrupt_real(env, intno, is_int, error_code, next_eip);
1230 #if !defined(CONFIG_USER_ONLY)
1231 if (env->hflags & HF_SVMI_MASK) {
1232 CPUState *cs = CPU(cpu);
1233 uint32_t event_inj = ldl_phys(cs->as, env->vm_vmcb +
1234 offsetof(struct vmcb,
1235 control.event_inj));
1238 env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
1239 event_inj & ~SVM_EVTINJ_VALID);
1244 void x86_cpu_do_interrupt(CPUState *cs)
1246 X86CPU *cpu = X86_CPU(cs);
1247 CPUX86State *env = &cpu->env;
1249 #if defined(CONFIG_USER_ONLY)
1250 /* if user mode only, we simulate a fake exception
1251 which will be handled outside the cpu execution
1253 do_interrupt_user(env, cs->exception_index,
1254 env->exception_is_int,
1256 env->exception_next_eip);
1257 /* successfully delivered */
1258 env->old_exception = -1;
1260 /* simulate a real cpu exception. On i386, it can
1261 trigger new exceptions, but we do not handle
1262 double or triple faults yet. */
1263 do_interrupt_all(cpu, cs->exception_index,
1264 env->exception_is_int,
1266 env->exception_next_eip, 0);
1267 /* successfully delivered */
1268 env->old_exception = -1;
1272 void do_interrupt_x86_hardirq(CPUX86State *env, int intno, int is_hw)
1274 do_interrupt_all(x86_env_get_cpu(env), intno, 0, 0, 0, is_hw);
1277 void helper_enter_level(CPUX86State *env, int level, int data32,
1281 uint32_t esp_mask, esp, ebp;
1283 esp_mask = get_sp_mask(env->segs[R_SS].flags);
1284 ssp = env->segs[R_SS].base;
1285 ebp = env->regs[R_EBP];
1286 esp = env->regs[R_ESP];
1293 cpu_stl_data(env, ssp + (esp & esp_mask),
1294 cpu_ldl_data(env, ssp + (ebp & esp_mask)));
1297 cpu_stl_data(env, ssp + (esp & esp_mask), t1);
1304 cpu_stw_data(env, ssp + (esp & esp_mask),
1305 cpu_lduw_data(env, ssp + (ebp & esp_mask)));
1308 cpu_stw_data(env, ssp + (esp & esp_mask), t1);
1312 #ifdef TARGET_X86_64
1313 void helper_enter64_level(CPUX86State *env, int level, int data64,
1316 target_ulong esp, ebp;
1318 ebp = env->regs[R_EBP];
1319 esp = env->regs[R_ESP];
1327 cpu_stq_data(env, esp, cpu_ldq_data(env, ebp));
1330 cpu_stq_data(env, esp, t1);
1337 cpu_stw_data(env, esp, cpu_lduw_data(env, ebp));
1340 cpu_stw_data(env, esp, t1);
1345 void helper_lldt(CPUX86State *env, int selector)
1349 int index, entry_limit;
1353 if ((selector & 0xfffc) == 0) {
1354 /* XXX: NULL selector case: invalid LDT */
1358 if (selector & 0x4) {
1359 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1362 index = selector & ~7;
1363 #ifdef TARGET_X86_64
1364 if (env->hflags & HF_LMA_MASK) {
1371 if ((index + entry_limit) > dt->limit) {
1372 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1374 ptr = dt->base + index;
1375 e1 = cpu_ldl_kernel(env, ptr);
1376 e2 = cpu_ldl_kernel(env, ptr + 4);
1377 if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2) {
1378 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1380 if (!(e2 & DESC_P_MASK)) {
1381 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc);
1383 #ifdef TARGET_X86_64
1384 if (env->hflags & HF_LMA_MASK) {
1387 e3 = cpu_ldl_kernel(env, ptr + 8);
1388 load_seg_cache_raw_dt(&env->ldt, e1, e2);
1389 env->ldt.base |= (target_ulong)e3 << 32;
1393 load_seg_cache_raw_dt(&env->ldt, e1, e2);
1396 env->ldt.selector = selector;
1399 void helper_ltr(CPUX86State *env, int selector)
1403 int index, type, entry_limit;
1407 if ((selector & 0xfffc) == 0) {
1408 /* NULL selector case: invalid TR */
1413 if (selector & 0x4) {
1414 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1417 index = selector & ~7;
1418 #ifdef TARGET_X86_64
1419 if (env->hflags & HF_LMA_MASK) {
1426 if ((index + entry_limit) > dt->limit) {
1427 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1429 ptr = dt->base + index;
1430 e1 = cpu_ldl_kernel(env, ptr);
1431 e2 = cpu_ldl_kernel(env, ptr + 4);
1432 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
1433 if ((e2 & DESC_S_MASK) ||
1434 (type != 1 && type != 9)) {
1435 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1437 if (!(e2 & DESC_P_MASK)) {
1438 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc);
1440 #ifdef TARGET_X86_64
1441 if (env->hflags & HF_LMA_MASK) {
1444 e3 = cpu_ldl_kernel(env, ptr + 8);
1445 e4 = cpu_ldl_kernel(env, ptr + 12);
1446 if ((e4 >> DESC_TYPE_SHIFT) & 0xf) {
1447 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1449 load_seg_cache_raw_dt(&env->tr, e1, e2);
1450 env->tr.base |= (target_ulong)e3 << 32;
1454 load_seg_cache_raw_dt(&env->tr, e1, e2);
1456 e2 |= DESC_TSS_BUSY_MASK;
1457 cpu_stl_kernel(env, ptr + 4, e2);
1459 env->tr.selector = selector;
1462 /* only works if protected mode and not VM86. seg_reg must be != R_CS */
1463 void helper_load_seg(CPUX86State *env, int seg_reg, int selector)
1472 cpl = env->hflags & HF_CPL_MASK;
1473 if ((selector & 0xfffc) == 0) {
1474 /* null selector case */
1476 #ifdef TARGET_X86_64
1477 && (!(env->hflags & HF_CS64_MASK) || cpl == 3)
1480 raise_exception_err(env, EXCP0D_GPF, 0);
1482 cpu_x86_load_seg_cache(env, seg_reg, selector, 0, 0, 0);
1485 if (selector & 0x4) {
1490 index = selector & ~7;
1491 if ((index + 7) > dt->limit) {
1492 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1494 ptr = dt->base + index;
1495 e1 = cpu_ldl_kernel(env, ptr);
1496 e2 = cpu_ldl_kernel(env, ptr + 4);
1498 if (!(e2 & DESC_S_MASK)) {
1499 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1502 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1503 if (seg_reg == R_SS) {
1504 /* must be writable segment */
1505 if ((e2 & DESC_CS_MASK) || !(e2 & DESC_W_MASK)) {
1506 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1508 if (rpl != cpl || dpl != cpl) {
1509 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1512 /* must be readable segment */
1513 if ((e2 & (DESC_CS_MASK | DESC_R_MASK)) == DESC_CS_MASK) {
1514 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1517 if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) {
1518 /* if not conforming code, test rights */
1519 if (dpl < cpl || dpl < rpl) {
1520 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1525 if (!(e2 & DESC_P_MASK)) {
1526 if (seg_reg == R_SS) {
1527 raise_exception_err(env, EXCP0C_STACK, selector & 0xfffc);
1529 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc);
1533 /* set the access bit if not already set */
1534 if (!(e2 & DESC_A_MASK)) {
1536 cpu_stl_kernel(env, ptr + 4, e2);
1539 cpu_x86_load_seg_cache(env, seg_reg, selector,
1540 get_seg_base(e1, e2),
1541 get_seg_limit(e1, e2),
1544 qemu_log("load_seg: sel=0x%04x base=0x%08lx limit=0x%08lx flags=%08x\n",
1545 selector, (unsigned long)sc->base, sc->limit, sc->flags);
1550 /* protected mode jump */
1551 void helper_ljmp_protected(CPUX86State *env, int new_cs, target_ulong new_eip,
1552 int next_eip_addend)
1555 uint32_t e1, e2, cpl, dpl, rpl, limit;
1556 target_ulong next_eip;
1558 if ((new_cs & 0xfffc) == 0) {
1559 raise_exception_err(env, EXCP0D_GPF, 0);
1561 if (load_segment(env, &e1, &e2, new_cs) != 0) {
1562 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1564 cpl = env->hflags & HF_CPL_MASK;
1565 if (e2 & DESC_S_MASK) {
1566 if (!(e2 & DESC_CS_MASK)) {
1567 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1569 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1570 if (e2 & DESC_C_MASK) {
1571 /* conforming code segment */
1573 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1576 /* non conforming code segment */
1579 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1582 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1585 if (!(e2 & DESC_P_MASK)) {
1586 raise_exception_err(env, EXCP0B_NOSEG, new_cs & 0xfffc);
1588 limit = get_seg_limit(e1, e2);
1589 if (new_eip > limit &&
1590 !(env->hflags & HF_LMA_MASK) && !(e2 & DESC_L_MASK)) {
1591 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1593 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
1594 get_seg_base(e1, e2), limit, e2);
1597 /* jump to call or task gate */
1598 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1600 cpl = env->hflags & HF_CPL_MASK;
1601 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
1603 case 1: /* 286 TSS */
1604 case 9: /* 386 TSS */
1605 case 5: /* task gate */
1606 if (dpl < cpl || dpl < rpl) {
1607 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1609 next_eip = env->eip + next_eip_addend;
1610 switch_tss(env, new_cs, e1, e2, SWITCH_TSS_JMP, next_eip);
1611 CC_OP = CC_OP_EFLAGS;
1613 case 4: /* 286 call gate */
1614 case 12: /* 386 call gate */
1615 if ((dpl < cpl) || (dpl < rpl)) {
1616 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1618 if (!(e2 & DESC_P_MASK)) {
1619 raise_exception_err(env, EXCP0B_NOSEG, new_cs & 0xfffc);
1622 new_eip = (e1 & 0xffff);
1624 new_eip |= (e2 & 0xffff0000);
1626 if (load_segment(env, &e1, &e2, gate_cs) != 0) {
1627 raise_exception_err(env, EXCP0D_GPF, gate_cs & 0xfffc);
1629 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1630 /* must be code segment */
1631 if (((e2 & (DESC_S_MASK | DESC_CS_MASK)) !=
1632 (DESC_S_MASK | DESC_CS_MASK))) {
1633 raise_exception_err(env, EXCP0D_GPF, gate_cs & 0xfffc);
1635 if (((e2 & DESC_C_MASK) && (dpl > cpl)) ||
1636 (!(e2 & DESC_C_MASK) && (dpl != cpl))) {
1637 raise_exception_err(env, EXCP0D_GPF, gate_cs & 0xfffc);
1639 if (!(e2 & DESC_P_MASK)) {
1640 raise_exception_err(env, EXCP0D_GPF, gate_cs & 0xfffc);
1642 limit = get_seg_limit(e1, e2);
1643 if (new_eip > limit) {
1644 raise_exception_err(env, EXCP0D_GPF, 0);
1646 cpu_x86_load_seg_cache(env, R_CS, (gate_cs & 0xfffc) | cpl,
1647 get_seg_base(e1, e2), limit, e2);
1651 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1657 /* real mode call */
1658 void helper_lcall_real(CPUX86State *env, int new_cs, target_ulong new_eip1,
1659 int shift, int next_eip)
1662 uint32_t esp, esp_mask;
1666 esp = env->regs[R_ESP];
1667 esp_mask = get_sp_mask(env->segs[R_SS].flags);
1668 ssp = env->segs[R_SS].base;
1670 PUSHL(ssp, esp, esp_mask, env->segs[R_CS].selector);
1671 PUSHL(ssp, esp, esp_mask, next_eip);
1673 PUSHW(ssp, esp, esp_mask, env->segs[R_CS].selector);
1674 PUSHW(ssp, esp, esp_mask, next_eip);
1677 SET_ESP(esp, esp_mask);
1679 env->segs[R_CS].selector = new_cs;
1680 env->segs[R_CS].base = (new_cs << 4);
1683 /* protected mode call */
1684 void helper_lcall_protected(CPUX86State *env, int new_cs, target_ulong new_eip,
1685 int shift, int next_eip_addend)
1688 uint32_t e1, e2, cpl, dpl, rpl, selector, offset, param_count;
1689 uint32_t ss = 0, ss_e1 = 0, ss_e2 = 0, sp, type, ss_dpl, sp_mask;
1690 uint32_t val, limit, old_sp_mask;
1691 target_ulong ssp, old_ssp, next_eip;
1693 next_eip = env->eip + next_eip_addend;
1694 LOG_PCALL("lcall %04x:%08x s=%d\n", new_cs, (uint32_t)new_eip, shift);
1695 LOG_PCALL_STATE(CPU(x86_env_get_cpu(env)));
1696 if ((new_cs & 0xfffc) == 0) {
1697 raise_exception_err(env, EXCP0D_GPF, 0);
1699 if (load_segment(env, &e1, &e2, new_cs) != 0) {
1700 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1702 cpl = env->hflags & HF_CPL_MASK;
1703 LOG_PCALL("desc=%08x:%08x\n", e1, e2);
1704 if (e2 & DESC_S_MASK) {
1705 if (!(e2 & DESC_CS_MASK)) {
1706 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1708 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1709 if (e2 & DESC_C_MASK) {
1710 /* conforming code segment */
1712 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1715 /* non conforming code segment */
1718 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1721 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1724 if (!(e2 & DESC_P_MASK)) {
1725 raise_exception_err(env, EXCP0B_NOSEG, new_cs & 0xfffc);
1728 #ifdef TARGET_X86_64
1729 /* XXX: check 16/32 bit cases in long mode */
1734 rsp = env->regs[R_ESP];
1735 PUSHQ(rsp, env->segs[R_CS].selector);
1736 PUSHQ(rsp, next_eip);
1737 /* from this point, not restartable */
1738 env->regs[R_ESP] = rsp;
1739 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
1740 get_seg_base(e1, e2),
1741 get_seg_limit(e1, e2), e2);
1746 sp = env->regs[R_ESP];
1747 sp_mask = get_sp_mask(env->segs[R_SS].flags);
1748 ssp = env->segs[R_SS].base;
1750 PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
1751 PUSHL(ssp, sp, sp_mask, next_eip);
1753 PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
1754 PUSHW(ssp, sp, sp_mask, next_eip);
1757 limit = get_seg_limit(e1, e2);
1758 if (new_eip > limit) {
1759 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1761 /* from this point, not restartable */
1762 SET_ESP(sp, sp_mask);
1763 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
1764 get_seg_base(e1, e2), limit, e2);
1768 /* check gate type */
1769 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
1770 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1773 case 1: /* available 286 TSS */
1774 case 9: /* available 386 TSS */
1775 case 5: /* task gate */
1776 if (dpl < cpl || dpl < rpl) {
1777 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1779 switch_tss(env, new_cs, e1, e2, SWITCH_TSS_CALL, next_eip);
1780 CC_OP = CC_OP_EFLAGS;
1782 case 4: /* 286 call gate */
1783 case 12: /* 386 call gate */
1786 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1791 if (dpl < cpl || dpl < rpl) {
1792 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
1794 /* check valid bit */
1795 if (!(e2 & DESC_P_MASK)) {
1796 raise_exception_err(env, EXCP0B_NOSEG, new_cs & 0xfffc);
1798 selector = e1 >> 16;
1799 offset = (e2 & 0xffff0000) | (e1 & 0x0000ffff);
1800 param_count = e2 & 0x1f;
1801 if ((selector & 0xfffc) == 0) {
1802 raise_exception_err(env, EXCP0D_GPF, 0);
1805 if (load_segment(env, &e1, &e2, selector) != 0) {
1806 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1808 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK))) {
1809 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1811 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1813 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc);
1815 if (!(e2 & DESC_P_MASK)) {
1816 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc);
1819 if (!(e2 & DESC_C_MASK) && dpl < cpl) {
1820 /* to inner privilege */
1821 get_ss_esp_from_tss(env, &ss, &sp, dpl);
1822 LOG_PCALL("new ss:esp=%04x:%08x param_count=%d env->regs[R_ESP]="
1823 TARGET_FMT_lx "\n", ss, sp, param_count,
1825 if ((ss & 0xfffc) == 0) {
1826 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
1828 if ((ss & 3) != dpl) {
1829 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
1831 if (load_segment(env, &ss_e1, &ss_e2, ss) != 0) {
1832 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
1834 ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
1835 if (ss_dpl != dpl) {
1836 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
1838 if (!(ss_e2 & DESC_S_MASK) ||
1839 (ss_e2 & DESC_CS_MASK) ||
1840 !(ss_e2 & DESC_W_MASK)) {
1841 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
1843 if (!(ss_e2 & DESC_P_MASK)) {
1844 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc);
1847 /* push_size = ((param_count * 2) + 8) << shift; */
1849 old_sp_mask = get_sp_mask(env->segs[R_SS].flags);
1850 old_ssp = env->segs[R_SS].base;
1852 sp_mask = get_sp_mask(ss_e2);
1853 ssp = get_seg_base(ss_e1, ss_e2);
1855 PUSHL(ssp, sp, sp_mask, env->segs[R_SS].selector);
1856 PUSHL(ssp, sp, sp_mask, env->regs[R_ESP]);
1857 for (i = param_count - 1; i >= 0; i--) {
1858 val = cpu_ldl_kernel(env, old_ssp +
1859 ((env->regs[R_ESP] + i * 4) &
1861 PUSHL(ssp, sp, sp_mask, val);
1864 PUSHW(ssp, sp, sp_mask, env->segs[R_SS].selector);
1865 PUSHW(ssp, sp, sp_mask, env->regs[R_ESP]);
1866 for (i = param_count - 1; i >= 0; i--) {
1867 val = cpu_lduw_kernel(env, old_ssp +
1868 ((env->regs[R_ESP] + i * 2) &
1870 PUSHW(ssp, sp, sp_mask, val);
1875 /* to same privilege */
1876 sp = env->regs[R_ESP];
1877 sp_mask = get_sp_mask(env->segs[R_SS].flags);
1878 ssp = env->segs[R_SS].base;
1879 /* push_size = (4 << shift); */
1884 PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
1885 PUSHL(ssp, sp, sp_mask, next_eip);
1887 PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
1888 PUSHW(ssp, sp, sp_mask, next_eip);
1891 /* from this point, not restartable */
1894 ss = (ss & ~3) | dpl;
1895 cpu_x86_load_seg_cache(env, R_SS, ss,
1897 get_seg_limit(ss_e1, ss_e2),
1901 selector = (selector & ~3) | dpl;
1902 cpu_x86_load_seg_cache(env, R_CS, selector,
1903 get_seg_base(e1, e2),
1904 get_seg_limit(e1, e2),
1906 cpu_x86_set_cpl(env, dpl);
1907 SET_ESP(sp, sp_mask);
1912 /* real and vm86 mode iret */
1913 void helper_iret_real(CPUX86State *env, int shift)
1915 uint32_t sp, new_cs, new_eip, new_eflags, sp_mask;
1919 sp_mask = 0xffff; /* XXXX: use SS segment size? */
1920 sp = env->regs[R_ESP];
1921 ssp = env->segs[R_SS].base;
1924 POPL(ssp, sp, sp_mask, new_eip);
1925 POPL(ssp, sp, sp_mask, new_cs);
1927 POPL(ssp, sp, sp_mask, new_eflags);
1930 POPW(ssp, sp, sp_mask, new_eip);
1931 POPW(ssp, sp, sp_mask, new_cs);
1932 POPW(ssp, sp, sp_mask, new_eflags);
1934 env->regs[R_ESP] = (env->regs[R_ESP] & ~sp_mask) | (sp & sp_mask);
1935 env->segs[R_CS].selector = new_cs;
1936 env->segs[R_CS].base = (new_cs << 4);
1938 if (env->eflags & VM_MASK) {
1939 eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | RF_MASK |
1942 eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | IOPL_MASK |
1946 eflags_mask &= 0xffff;
1948 cpu_load_eflags(env, new_eflags, eflags_mask);
1949 env->hflags2 &= ~HF2_NMI_MASK;
1952 static inline void validate_seg(CPUX86State *env, int seg_reg, int cpl)
1957 /* XXX: on x86_64, we do not want to nullify FS and GS because
1958 they may still contain a valid base. I would be interested to
1959 know how a real x86_64 CPU behaves */
1960 if ((seg_reg == R_FS || seg_reg == R_GS) &&
1961 (env->segs[seg_reg].selector & 0xfffc) == 0) {
1965 e2 = env->segs[seg_reg].flags;
1966 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1967 if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) {
1968 /* data or non conforming code segment */
1970 cpu_x86_load_seg_cache(env, seg_reg, 0, 0, 0, 0);
1975 /* protected mode iret */
1976 static inline void helper_ret_protected(CPUX86State *env, int shift,
1977 int is_iret, int addend)
1979 uint32_t new_cs, new_eflags, new_ss;
1980 uint32_t new_es, new_ds, new_fs, new_gs;
1981 uint32_t e1, e2, ss_e1, ss_e2;
1982 int cpl, dpl, rpl, eflags_mask, iopl;
1983 target_ulong ssp, sp, new_eip, new_esp, sp_mask;
1985 #ifdef TARGET_X86_64
1991 sp_mask = get_sp_mask(env->segs[R_SS].flags);
1993 sp = env->regs[R_ESP];
1994 ssp = env->segs[R_SS].base;
1995 new_eflags = 0; /* avoid warning */
1996 #ifdef TARGET_X86_64
2002 POPQ(sp, new_eflags);
2009 POPL(ssp, sp, sp_mask, new_eip);
2010 POPL(ssp, sp, sp_mask, new_cs);
2013 POPL(ssp, sp, sp_mask, new_eflags);
2014 if (new_eflags & VM_MASK) {
2015 goto return_to_vm86;
2020 POPW(ssp, sp, sp_mask, new_eip);
2021 POPW(ssp, sp, sp_mask, new_cs);
2023 POPW(ssp, sp, sp_mask, new_eflags);
2027 LOG_PCALL("lret new %04x:" TARGET_FMT_lx " s=%d addend=0x%x\n",
2028 new_cs, new_eip, shift, addend);
2029 LOG_PCALL_STATE(CPU(x86_env_get_cpu(env)));
2030 if ((new_cs & 0xfffc) == 0) {
2031 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
2033 if (load_segment(env, &e1, &e2, new_cs) != 0) {
2034 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
2036 if (!(e2 & DESC_S_MASK) ||
2037 !(e2 & DESC_CS_MASK)) {
2038 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
2040 cpl = env->hflags & HF_CPL_MASK;
2043 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
2045 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2046 if (e2 & DESC_C_MASK) {
2048 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
2052 raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
2055 if (!(e2 & DESC_P_MASK)) {
2056 raise_exception_err(env, EXCP0B_NOSEG, new_cs & 0xfffc);
2060 if (rpl == cpl && (!(env->hflags & HF_CS64_MASK) ||
2061 ((env->hflags & HF_CS64_MASK) && !is_iret))) {
2062 /* return to same privilege level */
2063 cpu_x86_load_seg_cache(env, R_CS, new_cs,
2064 get_seg_base(e1, e2),
2065 get_seg_limit(e1, e2),
2068 /* return to different privilege level */
2069 #ifdef TARGET_X86_64
2079 POPL(ssp, sp, sp_mask, new_esp);
2080 POPL(ssp, sp, sp_mask, new_ss);
2084 POPW(ssp, sp, sp_mask, new_esp);
2085 POPW(ssp, sp, sp_mask, new_ss);
2088 LOG_PCALL("new ss:esp=%04x:" TARGET_FMT_lx "\n",
2090 if ((new_ss & 0xfffc) == 0) {
2091 #ifdef TARGET_X86_64
2092 /* NULL ss is allowed in long mode if cpl != 3 */
2093 /* XXX: test CS64? */
2094 if ((env->hflags & HF_LMA_MASK) && rpl != 3) {
2095 cpu_x86_load_seg_cache(env, R_SS, new_ss,
2097 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2098 DESC_S_MASK | (rpl << DESC_DPL_SHIFT) |
2099 DESC_W_MASK | DESC_A_MASK);
2100 ss_e2 = DESC_B_MASK; /* XXX: should not be needed? */
2104 raise_exception_err(env, EXCP0D_GPF, 0);
2107 if ((new_ss & 3) != rpl) {
2108 raise_exception_err(env, EXCP0D_GPF, new_ss & 0xfffc);
2110 if (load_segment(env, &ss_e1, &ss_e2, new_ss) != 0) {
2111 raise_exception_err(env, EXCP0D_GPF, new_ss & 0xfffc);
2113 if (!(ss_e2 & DESC_S_MASK) ||
2114 (ss_e2 & DESC_CS_MASK) ||
2115 !(ss_e2 & DESC_W_MASK)) {
2116 raise_exception_err(env, EXCP0D_GPF, new_ss & 0xfffc);
2118 dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
2120 raise_exception_err(env, EXCP0D_GPF, new_ss & 0xfffc);
2122 if (!(ss_e2 & DESC_P_MASK)) {
2123 raise_exception_err(env, EXCP0B_NOSEG, new_ss & 0xfffc);
2125 cpu_x86_load_seg_cache(env, R_SS, new_ss,
2126 get_seg_base(ss_e1, ss_e2),
2127 get_seg_limit(ss_e1, ss_e2),
2131 cpu_x86_load_seg_cache(env, R_CS, new_cs,
2132 get_seg_base(e1, e2),
2133 get_seg_limit(e1, e2),
2135 cpu_x86_set_cpl(env, rpl);
2137 #ifdef TARGET_X86_64
2138 if (env->hflags & HF_CS64_MASK) {
2143 sp_mask = get_sp_mask(ss_e2);
2146 /* validate data segments */
2147 validate_seg(env, R_ES, rpl);
2148 validate_seg(env, R_DS, rpl);
2149 validate_seg(env, R_FS, rpl);
2150 validate_seg(env, R_GS, rpl);
2154 SET_ESP(sp, sp_mask);
2157 /* NOTE: 'cpl' is the _old_ CPL */
2158 eflags_mask = TF_MASK | AC_MASK | ID_MASK | RF_MASK | NT_MASK;
2160 eflags_mask |= IOPL_MASK;
2162 iopl = (env->eflags >> IOPL_SHIFT) & 3;
2164 eflags_mask |= IF_MASK;
2167 eflags_mask &= 0xffff;
2169 cpu_load_eflags(env, new_eflags, eflags_mask);
2174 POPL(ssp, sp, sp_mask, new_esp);
2175 POPL(ssp, sp, sp_mask, new_ss);
2176 POPL(ssp, sp, sp_mask, new_es);
2177 POPL(ssp, sp, sp_mask, new_ds);
2178 POPL(ssp, sp, sp_mask, new_fs);
2179 POPL(ssp, sp, sp_mask, new_gs);
2181 /* modify processor state */
2182 cpu_load_eflags(env, new_eflags, TF_MASK | AC_MASK | ID_MASK |
2183 IF_MASK | IOPL_MASK | VM_MASK | NT_MASK | VIF_MASK |
2185 load_seg_vm(env, R_CS, new_cs & 0xffff);
2186 cpu_x86_set_cpl(env, 3);
2187 load_seg_vm(env, R_SS, new_ss & 0xffff);
2188 load_seg_vm(env, R_ES, new_es & 0xffff);
2189 load_seg_vm(env, R_DS, new_ds & 0xffff);
2190 load_seg_vm(env, R_FS, new_fs & 0xffff);
2191 load_seg_vm(env, R_GS, new_gs & 0xffff);
2193 env->eip = new_eip & 0xffff;
2194 env->regs[R_ESP] = new_esp;
2197 void helper_iret_protected(CPUX86State *env, int shift, int next_eip)
2199 int tss_selector, type;
2202 /* specific case for TSS */
2203 if (env->eflags & NT_MASK) {
2204 #ifdef TARGET_X86_64
2205 if (env->hflags & HF_LMA_MASK) {
2206 raise_exception_err(env, EXCP0D_GPF, 0);
2209 tss_selector = cpu_lduw_kernel(env, env->tr.base + 0);
2210 if (tss_selector & 4) {
2211 raise_exception_err(env, EXCP0A_TSS, tss_selector & 0xfffc);
2213 if (load_segment(env, &e1, &e2, tss_selector) != 0) {
2214 raise_exception_err(env, EXCP0A_TSS, tss_selector & 0xfffc);
2216 type = (e2 >> DESC_TYPE_SHIFT) & 0x17;
2217 /* NOTE: we check both segment and busy TSS */
2219 raise_exception_err(env, EXCP0A_TSS, tss_selector & 0xfffc);
2221 switch_tss(env, tss_selector, e1, e2, SWITCH_TSS_IRET, next_eip);
2223 helper_ret_protected(env, shift, 1, 0);
2225 env->hflags2 &= ~HF2_NMI_MASK;
2228 void helper_lret_protected(CPUX86State *env, int shift, int addend)
2230 helper_ret_protected(env, shift, 0, addend);
2233 void helper_sysenter(CPUX86State *env)
2235 if (env->sysenter_cs == 0) {
2236 raise_exception_err(env, EXCP0D_GPF, 0);
2238 env->eflags &= ~(VM_MASK | IF_MASK | RF_MASK);
2239 cpu_x86_set_cpl(env, 0);
2241 #ifdef TARGET_X86_64
2242 if (env->hflags & HF_LMA_MASK) {
2243 cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc,
2245 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2247 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK |
2252 cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc,
2254 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2256 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
2258 cpu_x86_load_seg_cache(env, R_SS, (env->sysenter_cs + 8) & 0xfffc,
2260 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2262 DESC_W_MASK | DESC_A_MASK);
2263 env->regs[R_ESP] = env->sysenter_esp;
2264 env->eip = env->sysenter_eip;
2267 void helper_sysexit(CPUX86State *env, int dflag)
2271 cpl = env->hflags & HF_CPL_MASK;
2272 if (env->sysenter_cs == 0 || cpl != 0) {
2273 raise_exception_err(env, EXCP0D_GPF, 0);
2275 cpu_x86_set_cpl(env, 3);
2276 #ifdef TARGET_X86_64
2278 cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 32) & 0xfffc) |
2280 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2281 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2282 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK |
2284 cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 40) & 0xfffc) |
2286 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2287 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2288 DESC_W_MASK | DESC_A_MASK);
2292 cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 16) & 0xfffc) |
2294 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2295 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2296 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
2297 cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 24) & 0xfffc) |
2299 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2300 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2301 DESC_W_MASK | DESC_A_MASK);
2303 env->regs[R_ESP] = env->regs[R_ECX];
2304 env->eip = env->regs[R_EDX];
2307 target_ulong helper_lsl(CPUX86State *env, target_ulong selector1)
2310 uint32_t e1, e2, eflags, selector;
2311 int rpl, dpl, cpl, type;
2313 selector = selector1 & 0xffff;
2314 eflags = cpu_cc_compute_all(env, CC_OP);
2315 if ((selector & 0xfffc) == 0) {
2318 if (load_segment(env, &e1, &e2, selector) != 0) {
2322 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2323 cpl = env->hflags & HF_CPL_MASK;
2324 if (e2 & DESC_S_MASK) {
2325 if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) {
2328 if (dpl < cpl || dpl < rpl) {
2333 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2344 if (dpl < cpl || dpl < rpl) {
2346 CC_SRC = eflags & ~CC_Z;
2350 limit = get_seg_limit(e1, e2);
2351 CC_SRC = eflags | CC_Z;
2355 target_ulong helper_lar(CPUX86State *env, target_ulong selector1)
2357 uint32_t e1, e2, eflags, selector;
2358 int rpl, dpl, cpl, type;
2360 selector = selector1 & 0xffff;
2361 eflags = cpu_cc_compute_all(env, CC_OP);
2362 if ((selector & 0xfffc) == 0) {
2365 if (load_segment(env, &e1, &e2, selector) != 0) {
2369 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2370 cpl = env->hflags & HF_CPL_MASK;
2371 if (e2 & DESC_S_MASK) {
2372 if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) {
2375 if (dpl < cpl || dpl < rpl) {
2380 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2394 if (dpl < cpl || dpl < rpl) {
2396 CC_SRC = eflags & ~CC_Z;
2400 CC_SRC = eflags | CC_Z;
2401 return e2 & 0x00f0ff00;
2404 void helper_verr(CPUX86State *env, target_ulong selector1)
2406 uint32_t e1, e2, eflags, selector;
2409 selector = selector1 & 0xffff;
2410 eflags = cpu_cc_compute_all(env, CC_OP);
2411 if ((selector & 0xfffc) == 0) {
2414 if (load_segment(env, &e1, &e2, selector) != 0) {
2417 if (!(e2 & DESC_S_MASK)) {
2421 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2422 cpl = env->hflags & HF_CPL_MASK;
2423 if (e2 & DESC_CS_MASK) {
2424 if (!(e2 & DESC_R_MASK)) {
2427 if (!(e2 & DESC_C_MASK)) {
2428 if (dpl < cpl || dpl < rpl) {
2433 if (dpl < cpl || dpl < rpl) {
2435 CC_SRC = eflags & ~CC_Z;
2439 CC_SRC = eflags | CC_Z;
2442 void helper_verw(CPUX86State *env, target_ulong selector1)
2444 uint32_t e1, e2, eflags, selector;
2447 selector = selector1 & 0xffff;
2448 eflags = cpu_cc_compute_all(env, CC_OP);
2449 if ((selector & 0xfffc) == 0) {
2452 if (load_segment(env, &e1, &e2, selector) != 0) {
2455 if (!(e2 & DESC_S_MASK)) {
2459 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2460 cpl = env->hflags & HF_CPL_MASK;
2461 if (e2 & DESC_CS_MASK) {
2464 if (dpl < cpl || dpl < rpl) {
2467 if (!(e2 & DESC_W_MASK)) {
2469 CC_SRC = eflags & ~CC_Z;
2473 CC_SRC = eflags | CC_Z;
2476 #if defined(CONFIG_USER_ONLY)
2477 void cpu_x86_load_seg(CPUX86State *env, int seg_reg, int selector)
2479 if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
2481 cpu_x86_load_seg_cache(env, seg_reg, selector,
2482 (selector << 4), 0xffff, 0);
2484 helper_load_seg(env, seg_reg, selector);