target-i386/helper.c

   1 /*
   2  *  i386 helpers (without register variable usage)
   3  *
   4  *  Copyright (c) 2003 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20 #include <stdarg.h>
  21 #include <stdlib.h>
  22 #include <stdio.h>
  23 #include <string.h>
  24 #include <inttypes.h>
  25 #include <signal.h>
  26 #include <assert.h>
  27
  28 #include "cpu.h"
  29 #include "exec-all.h"
  30 #include "svm.h"
  31 #include "qemu-common.h"
  32 #include "kvm.h"
  33
  34 #include "qemu-kvm.h"
  35
  36 //#define DEBUG_MMU
  37
  38 static int cpu_x86_register (CPUX86State *env, const char *cpu_model);
  39
  40 static void add_flagname_to_bitmaps(char *flagname, uint32_t *features,
  41                                     uint32_t *ext_features,
  42                                     uint32_t *ext2_features,
  43                                     uint32_t *ext3_features)
  44 {
  45     int i;
  46     /* feature flags taken from "Intel Processor Identification and the CPUID
  47      * Instruction" and AMD's "CPUID Specification". In cases of disagreement
  48      * about feature names, the Linux name is used. */
  49     static const char *feature_name[] = {
  50         "fpu", "vme", "de", "pse", "tsc", "msr", "pae", "mce",
  51         "cx8", "apic", NULL, "sep", "mtrr", "pge", "mca", "cmov",
  52         "pat", "pse36", "pn" /* Intel psn */, "clflush" /* Intel clfsh */, NULL, "ds" /* Intel dts */, "acpi", "mmx",
  53         "fxsr", "sse", "sse2", "ss", "ht" /* Intel htt */, "tm", "ia64", "pbe",
  54     };
  55     static const char *ext_feature_name[] = {
  56        "pni" /* Intel,AMD sse3 */, NULL, NULL, "monitor", "ds_cpl", "vmx", NULL /* Linux smx */, "est",
  57        "tm2", "ssse3", "cid", NULL, NULL, "cx16", "xtpr", NULL,
  58        NULL, NULL, "dca", NULL, NULL, NULL, NULL, "popcnt",
  59        NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
  60     };
  61     static const char *ext2_feature_name[] = {
  62        "fpu", "vme", "de", "pse", "tsc", "msr", "pae", "mce",
  63        "cx8" /* AMD CMPXCHG8B */, "apic", NULL, "syscall", "mttr", "pge", "mca", "cmov",
  64        "pat", "pse36", NULL, NULL /* Linux mp */, "nx" /* Intel xd */, NULL, "mmxext", "mmx",
  65        "fxsr", "fxsr_opt" /* AMD ffxsr */, "pdpe1gb" /* AMD Page1GB */, "rdtscp", NULL, "lm" /* Intel 64 */, "3dnowext", "3dnow",
  66     };
  67     static const char *ext3_feature_name[] = {
  68        "lahf_lm" /* AMD LahfSahf */, "cmp_legacy", "svm", "extapic" /* AMD ExtApicSpace */, "cr8legacy" /* AMD AltMovCr8 */, "abm", "sse4a", "misalignsse",
  69        "3dnowprefetch", "osvw", NULL /* Linux ibs */, NULL, "skinit", "wdt", NULL, NULL,
  70        NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
  71        NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
  72     };
  73
  74     for ( i = 0 ; i < 32 ; i++ )
  75         if (feature_name[i] && !strcmp (flagname, feature_name[i])) {
  76             *features |= 1 << i;
  77             return;
  78         }
  79     for ( i = 0 ; i < 32 ; i++ )
  80         if (ext_feature_name[i] && !strcmp (flagname, ext_feature_name[i])) {
  81             *ext_features |= 1 << i;
  82             return;
  83         }
  84     for ( i = 0 ; i < 32 ; i++ )
  85         if (ext2_feature_name[i] && !strcmp (flagname, ext2_feature_name[i])) {
  86             *ext2_features |= 1 << i;
  87             return;
  88         }
  89     for ( i = 0 ; i < 32 ; i++ )
  90         if (ext3_feature_name[i] && !strcmp (flagname, ext3_feature_name[i])) {
  91             *ext3_features |= 1 << i;
  92             return;
  93         }
  94     fprintf(stderr, "CPU feature %s not found\n", flagname);
  95 }
  96
  97 extern const char *cpu_vendor_string;
  98
  99 CPUX86State *cpu_x86_init(const char *cpu_model)
 100 {
 101     CPUX86State *env;
 102     static int inited;
 103
 104     env = qemu_mallocz(sizeof(CPUX86State));
 105     if (!env)
 106         return NULL;
 107     cpu_exec_init(env);
 108     env->cpu_model_str = cpu_model;
 109
 110     /* init various static tables */
 111     if (!inited) {
 112         inited = 1;
 113         optimize_flags_init();
 114     }
 115     if (cpu_x86_register(env, cpu_model) < 0) {
 116         cpu_x86_close(env);
 117         return NULL;
 118     }
 119     cpu_reset(env);
 120 #ifdef USE_KQEMU
 121     kqemu_init(env);
 122 #endif
 123     if (kvm_enabled())
 124         kvm_init_vcpu(env);
 125     return env;
 126 }
 127
 128 typedef struct x86_def_t {
 129     const char *name;
 130     uint32_t level;
 131     uint32_t vendor1, vendor2, vendor3;
 132     int family;
 133     int model;
 134     int stepping;
 135     uint32_t features, ext_features, ext2_features, ext3_features;
 136     uint32_t xlevel;
 137     char model_id[48];
 138 } x86_def_t;
 139
 140 #define I486_FEATURES (CPUID_FP87 | CPUID_VME | CPUID_PSE)
 141 #define PENTIUM_FEATURES (I486_FEATURES | CPUID_DE | CPUID_TSC | \
 142           CPUID_MSR | CPUID_MCE | CPUID_CX8 | CPUID_MMX)
 143 #define PENTIUM2_FEATURES (PENTIUM_FEATURES | CPUID_PAE | CPUID_SEP | \
 144           CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV | CPUID_PAT | \
 145           CPUID_PSE36 | CPUID_FXSR)
 146 #define PENTIUM3_FEATURES (PENTIUM2_FEATURES | CPUID_SSE)
 147 #define PPRO_FEATURES (CPUID_FP87 | CPUID_DE | CPUID_PSE | CPUID_TSC | \
 148           CPUID_MSR | CPUID_MCE | CPUID_CX8 | CPUID_PGE | CPUID_CMOV | \
 149           CPUID_PAT | CPUID_FXSR | CPUID_MMX | CPUID_SSE | CPUID_SSE2 | \
 150           CPUID_PAE | CPUID_SEP | CPUID_APIC)
 151 static x86_def_t x86_defs[] = {
 152 #ifdef TARGET_X86_64
 153     {
 154         .name = "qemu64",
 155         .level = 2,
 156         .vendor1 = CPUID_VENDOR_AMD_1,
 157         .vendor2 = CPUID_VENDOR_AMD_2,
 158         .vendor3 = CPUID_VENDOR_AMD_3,
 159         .family = 6,
 160         .model = 2,
 161         .stepping = 3,
 162         .features = PPRO_FEATURES |
 163         /* these features are needed for Win64 and aren't fully implemented */
 164             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA |
 165         /* this feature is needed for Solaris and isn't fully implemented */
 166             CPUID_PSE36,
 167         .ext_features = CPUID_EXT_SSE3,
 168         .ext2_features = (PPRO_FEATURES & 0x0183F3FF) |
 169             CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX |
 170             CPUID_EXT2_3DNOW | CPUID_EXT2_3DNOWEXT,
 171         .ext3_features = CPUID_EXT3_SVM,
 172         .xlevel = 0x8000000A,
 173         .model_id = "QEMU Virtual CPU version " QEMU_VERSION,
 174     },
 175     {
 176         .name = "core2duo",
 177         .level = 10,
 178         .family = 6,
 179         .model = 15,
 180         .stepping = 11,
 181         /* The original CPU also implements these features:
 182                CPUID_VME, CPUID_DTS, CPUID_ACPI, CPUID_SS, CPUID_HT,
 183                CPUID_TM, CPUID_PBE */
 184         .features = PPRO_FEATURES |
 185             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA |
 186             CPUID_PSE36,
 187         /* The original CPU also implements these ext features:
 188                CPUID_EXT_DTES64, CPUID_EXT_DSCPL, CPUID_EXT_VMX, CPUID_EXT_EST,
 189                CPUID_EXT_TM2, CPUID_EXT_CX16, CPUID_EXT_XTPR, CPUID_EXT_PDCM */
 190         .ext_features = CPUID_EXT_SSE3 | CPUID_EXT_MONITOR | CPUID_EXT_SSSE3,
 191         .ext2_features = CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,
 192         /* Missing: .ext3_features = CPUID_EXT3_LAHF_LM */
 193         .xlevel = 0x80000008,
 194         .model_id = "Intel(R) Core(TM)2 Duo CPU     T7700  @ 2.40GHz",
 195     },
 196 #endif
 197     {
 198         .name = "qemu32",
 199         .level = 2,
 200         .family = 6,
 201         .model = 3,
 202         .stepping = 3,
 203         .features = PPRO_FEATURES,
 204         .ext_features = CPUID_EXT_SSE3,
 205         .xlevel = 0,
 206         .model_id = "QEMU Virtual CPU version " QEMU_VERSION,
 207     },
 208     {
 209         .name = "coreduo",
 210         .level = 10,
 211         .family = 6,
 212         .model = 14,
 213         .stepping = 8,
 214         /* The original CPU also implements these features:
 215                CPUID_DTS, CPUID_ACPI, CPUID_SS, CPUID_HT,
 216                CPUID_TM, CPUID_PBE */
 217         .features = PPRO_FEATURES | CPUID_VME |
 218             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA,
 219         /* The original CPU also implements these ext features:
 220                CPUID_EXT_VMX, CPUID_EXT_EST, CPUID_EXT_TM2, CPUID_EXT_XTPR,
 221                CPUID_EXT_PDCM */
 222         .ext_features = CPUID_EXT_SSE3 | CPUID_EXT_MONITOR,
 223         .ext2_features = CPUID_EXT2_NX,
 224         .xlevel = 0x80000008,
 225         .model_id = "Genuine Intel(R) CPU           T2600  @ 2.16GHz",
 226     },
 227     {
 228         .name = "486",
 229         .level = 0,
 230         .family = 4,
 231         .model = 0,
 232         .stepping = 0,
 233         .features = I486_FEATURES,
 234         .xlevel = 0,
 235     },
 236     {
 237         .name = "pentium",
 238         .level = 1,
 239         .family = 5,
 240         .model = 4,
 241         .stepping = 3,
 242         .features = PENTIUM_FEATURES,
 243         .xlevel = 0,
 244     },
 245     {
 246         .name = "pentium2",
 247         .level = 2,
 248         .family = 6,
 249         .model = 5,
 250         .stepping = 2,
 251         .features = PENTIUM2_FEATURES,
 252         .xlevel = 0,
 253     },
 254     {
 255         .name = "pentium3",
 256         .level = 2,
 257         .family = 6,
 258         .model = 7,
 259         .stepping = 3,
 260         .features = PENTIUM3_FEATURES,
 261         .xlevel = 0,
 262     },
 263     {
 264         .name = "athlon",
 265         .level = 2,
 266         .vendor1 = 0x68747541, /* "Auth" */
 267         .vendor2 = 0x69746e65, /* "enti" */
 268         .vendor3 = 0x444d4163, /* "cAMD" */
 269         .family = 6,
 270         .model = 2,
 271         .stepping = 3,
 272         .features = PPRO_FEATURES | CPUID_PSE36 | CPUID_VME | CPUID_MTRR | CPUID_MCA,
 273         .ext2_features = (PPRO_FEATURES & 0x0183F3FF) | CPUID_EXT2_MMXEXT | CPUID_EXT2_3DNOW | CPUID_EXT2_3DNOWEXT,
 274         .xlevel = 0x80000008,
 275         /* XXX: put another string ? */
 276         .model_id = "QEMU Virtual CPU version " QEMU_VERSION,
 277     },
 278     {
 279         .name = "n270",
 280         /* original is on level 10 */
 281         .level = 5,
 282         .family = 6,
 283         .model = 28,
 284         .stepping = 2,
 285         .features = PPRO_FEATURES |
 286             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA | CPUID_VME,
 287             /* Missing: CPUID_DTS | CPUID_ACPI | CPUID_SS |
 288              * CPUID_HT | CPUID_TM | CPUID_PBE */
 289             /* Some CPUs got no CPUID_SEP */
 290         .ext_features = CPUID_EXT_MONITOR |
 291             CPUID_EXT_SSE3 /* PNI */ | CPUID_EXT_SSSE3,
 292             /* Missing: CPUID_EXT_DSCPL | CPUID_EXT_EST |
 293              * CPUID_EXT_TM2 | CPUID_EXT_XTPR */
 294         .ext2_features = (PPRO_FEATURES & 0x0183F3FF) | CPUID_EXT2_NX,
 295         /* Missing: .ext3_features = CPUID_EXT3_LAHF_LM */
 296         .xlevel = 0x8000000A,
 297         .model_id = "Intel(R) Atom(TM) CPU N270   @ 1.60GHz",
 298     },
 299 };
 300
 301 static int cpu_x86_find_by_name(x86_def_t *x86_cpu_def, const char *cpu_model)
 302 {
 303     unsigned int i;
 304     x86_def_t *def;
 305
 306     char *s = strdup(cpu_model);
 307     char *featurestr, *name = strtok(s, ",");
 308     uint32_t plus_features = 0, plus_ext_features = 0, plus_ext2_features = 0, plus_ext3_features = 0;
 309     uint32_t minus_features = 0, minus_ext_features = 0, minus_ext2_features = 0, minus_ext3_features = 0;
 310     int family = -1, model = -1, stepping = -1;
 311
 312     def = NULL;
 313     for (i = 0; i < sizeof(x86_defs) / sizeof(x86_def_t); i++) {
 314         if (strcmp(name, x86_defs[i].name) == 0) {
 315             def = &x86_defs[i];
 316             break;
 317         }
 318     }
 319     if (!def)
 320         goto error;
 321     memcpy(x86_cpu_def, def, sizeof(*def));
 322
 323     featurestr = strtok(NULL, ",");
 324
 325     while (featurestr) {
 326         char *val;
 327         if (featurestr[0] == '+') {
 328             add_flagname_to_bitmaps(featurestr + 1, &plus_features, &plus_ext_features, &plus_ext2_features, &plus_ext3_features);
 329         } else if (featurestr[0] == '-') {
 330             add_flagname_to_bitmaps(featurestr + 1, &minus_features, &minus_ext_features, &minus_ext2_features, &minus_ext3_features);
 331         } else if ((val = strchr(featurestr, '='))) {
 332             *val = 0; val++;
 333             if (!strcmp(featurestr, "family")) {
 334                 char *err;
 335                 family = strtol(val, &err, 10);
 336                 if (!*val || *err || family < 0) {
 337                     fprintf(stderr, "bad numerical value %s\n", val);
 338                     goto error;
 339                 }
 340                 x86_cpu_def->family = family;
 341             } else if (!strcmp(featurestr, "model")) {
 342                 char *err;
 343                 model = strtol(val, &err, 10);
 344                 if (!*val || *err || model < 0 || model > 0xff) {
 345                     fprintf(stderr, "bad numerical value %s\n", val);
 346                     goto error;
 347                 }
 348                 x86_cpu_def->model = model;
 349             } else if (!strcmp(featurestr, "stepping")) {
 350                 char *err;
 351                 stepping = strtol(val, &err, 10);
 352                 if (!*val || *err || stepping < 0 || stepping > 0xf) {
 353                     fprintf(stderr, "bad numerical value %s\n", val);
 354                     goto error;
 355                 }
 356                 x86_cpu_def->stepping = stepping;
 357             } else if (!strcmp(featurestr, "vendor")) {
 358                 if (strlen(val) != 12) {
 359                     fprintf(stderr, "vendor string must be 12 chars long\n");
 360                     goto error;
 361                 }
 362                 x86_cpu_def->vendor1 = 0;
 363                 x86_cpu_def->vendor2 = 0;
 364                 x86_cpu_def->vendor3 = 0;
 365                 for(i = 0; i < 4; i++) {
 366                     x86_cpu_def->vendor1 |= ((uint8_t)val[i    ]) << (8 * i);
 367                     x86_cpu_def->vendor2 |= ((uint8_t)val[i + 4]) << (8 * i);
 368                     x86_cpu_def->vendor3 |= ((uint8_t)val[i + 8]) << (8 * i);
 369                 }
 370             } else if (!strcmp(featurestr, "model_id")) {
 371                 pstrcpy(x86_cpu_def->model_id, sizeof(x86_cpu_def->model_id),
 372                         val);
 373             } else {
 374                 fprintf(stderr, "unrecognized feature %s\n", featurestr);
 375                 goto error;
 376             }
 377         } else {
 378             fprintf(stderr, "feature string `%s' not in format (+feature|-feature|feature=xyz)\n", featurestr);
 379             goto error;
 380         }
 381         featurestr = strtok(NULL, ",");
 382     }
 383     x86_cpu_def->features |= plus_features;
 384     x86_cpu_def->ext_features |= plus_ext_features;
 385     x86_cpu_def->ext2_features |= plus_ext2_features;
 386     x86_cpu_def->ext3_features |= plus_ext3_features;
 387     x86_cpu_def->features &= ~minus_features;
 388     x86_cpu_def->ext_features &= ~minus_ext_features;
 389     x86_cpu_def->ext2_features &= ~minus_ext2_features;
 390     x86_cpu_def->ext3_features &= ~minus_ext3_features;
 391     free(s);
 392     return 0;
 393
 394 error:
 395     free(s);
 396     return -1;
 397 }
 398
 399 void x86_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
 400 {
 401     unsigned int i;
 402
 403     for (i = 0; i < sizeof(x86_defs) / sizeof(x86_def_t); i++)
 404         (*cpu_fprintf)(f, "x86 %16s\n", x86_defs[i].name);
 405 }
 406
 407 static int cpu_x86_register (CPUX86State *env, const char *cpu_model)
 408 {
 409     x86_def_t def1, *def = &def1;
 410
 411     if (cpu_x86_find_by_name(def, cpu_model) < 0)
 412         return -1;
 413     if (def->vendor1) {
 414         env->cpuid_vendor1 = def->vendor1;
 415         env->cpuid_vendor2 = def->vendor2;
 416         env->cpuid_vendor3 = def->vendor3;
 417     } else {
 418         env->cpuid_vendor1 = CPUID_VENDOR_INTEL_1;
 419         env->cpuid_vendor2 = CPUID_VENDOR_INTEL_2;
 420         env->cpuid_vendor3 = CPUID_VENDOR_INTEL_3;
 421     }
 422     env->cpuid_level = def->level;
 423     if (def->family > 0x0f)
 424         env->cpuid_version = 0xf00 | ((def->family - 0x0f) << 20);
 425     else
 426         env->cpuid_version = def->family << 8;
 427     env->cpuid_version |= ((def->model & 0xf) << 4) | ((def->model >> 4) << 16);
 428     env->cpuid_version |= def->stepping;
 429     env->cpuid_features = def->features;
 430     env->pat = 0x0007040600070406ULL;
 431     env->cpuid_ext_features = def->ext_features;
 432     env->cpuid_ext2_features = def->ext2_features;
 433     env->cpuid_xlevel = def->xlevel;
 434     env->cpuid_ext3_features = def->ext3_features;
 435     {
 436         const char *model_id = def->model_id;
 437         int c, len, i;
 438
 439         if (cpu_vendor_string != NULL)
 440             model_id = cpu_vendor_string;
 441         if (!model_id)
 442             model_id = "";
 443         len = strlen(model_id);
 444         for(i = 0; i < 48; i++) {
 445             if (i >= len)
 446                 c = '\0';
 447             else
 448                 c = (uint8_t)model_id[i];
 449             env->cpuid_model[i >> 2] |= c << (8 * (i & 3));
 450         }
 451     }
 452     return 0;
 453 }
 454
 455 /* NOTE: must be called outside the CPU execute loop */
 456 void cpu_reset(CPUX86State *env)
 457 {
 458     int i;
 459
 460     memset(env, 0, offsetof(CPUX86State, breakpoints));
 461
 462     tlb_flush(env, 1);
 463
 464     env->old_exception = -1;
 465
 466     /* init to reset state */
 467
 468 #ifdef CONFIG_SOFTMMU
 469     env->hflags |= HF_SOFTMMU_MASK;
 470 #endif
 471     env->hflags2 |= HF2_GIF_MASK;
 472
 473     cpu_x86_update_cr0(env, 0x60000010);
 474     env->a20_mask = ~0x0;
 475     env->smbase = 0x30000;
 476
 477     env->idt.limit = 0xffff;
 478     env->gdt.limit = 0xffff;
 479     env->ldt.limit = 0xffff;
 480     env->ldt.flags = DESC_P_MASK | (2 << DESC_TYPE_SHIFT);
 481     env->tr.limit = 0xffff;
 482     env->tr.flags = DESC_P_MASK | (11 << DESC_TYPE_SHIFT);
 483
 484     cpu_x86_load_seg_cache(env, R_CS, 0xf000, 0xffff0000, 0xffff,
 485                            DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK | DESC_R_MASK);
 486     cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0xffff,
 487                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);
 488     cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0xffff,
 489                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);
 490     cpu_x86_load_seg_cache(env, R_SS, 0, 0, 0xffff,
 491                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);
 492     cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0xffff,
 493                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);
 494     cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0xffff,
 495                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);
 496
 497     env->eip = 0xfff0;
 498     env->regs[R_EDX] = env->cpuid_version;
 499
 500     env->eflags = 0x2;
 501
 502     /* FPU init */
 503     for(i = 0;i < 8; i++)
 504         env->fptags[i] = 1;
 505     env->fpuc = 0x37f;
 506
 507     env->mxcsr = 0x1f80;
 508 }
 509
 510 void cpu_x86_close(CPUX86State *env)
 511 {
 512     qemu_free(env);
 513 }
 514
 515 /***********************************************************/
 516 /* x86 debug */
 517
 518 static const char *cc_op_str[] = {
 519     "DYNAMIC",
 520     "EFLAGS",
 521
 522     "MULB",
 523     "MULW",
 524     "MULL",
 525     "MULQ",
 526
 527     "ADDB",
 528     "ADDW",
 529     "ADDL",
 530     "ADDQ",
 531
 532     "ADCB",
 533     "ADCW",
 534     "ADCL",
 535     "ADCQ",
 536
 537     "SUBB",
 538     "SUBW",
 539     "SUBL",
 540     "SUBQ",
 541
 542     "SBBB",
 543     "SBBW",
 544     "SBBL",
 545     "SBBQ",
 546
 547     "LOGICB",
 548     "LOGICW",
 549     "LOGICL",
 550     "LOGICQ",
 551
 552     "INCB",
 553     "INCW",
 554     "INCL",
 555     "INCQ",
 556
 557     "DECB",
 558     "DECW",
 559     "DECL",
 560     "DECQ",
 561
 562     "SHLB",
 563     "SHLW",
 564     "SHLL",
 565     "SHLQ",
 566
 567     "SARB",
 568     "SARW",
 569     "SARL",
 570     "SARQ",
 571 };
 572
 573 void cpu_dump_state(CPUState *env, FILE *f,
 574                     int (*cpu_fprintf)(FILE *f, const char *fmt, ...),
 575                     int flags)
 576 {
 577     int eflags, i, nb;
 578     char cc_op_name[32];
 579     static const char *seg_name[6] = { "ES", "CS", "SS", "DS", "FS", "GS" };
 580
 581     eflags = env->eflags;
 582 #ifdef TARGET_X86_64
 583     if (env->hflags & HF_CS64_MASK) {
 584         cpu_fprintf(f,
 585                     "RAX=%016" PRIx64 " RBX=%016" PRIx64 " RCX=%016" PRIx64 " RDX=%016" PRIx64 "\n"
 586                     "RSI=%016" PRIx64 " RDI=%016" PRIx64 " RBP=%016" PRIx64 " RSP=%016" PRIx64 "\n"
 587                     "R8 =%016" PRIx64 " R9 =%016" PRIx64 " R10=%016" PRIx64 " R11=%016" PRIx64 "\n"
 588                     "R12=%016" PRIx64 " R13=%016" PRIx64 " R14=%016" PRIx64 " R15=%016" PRIx64 "\n"
 589                     "RIP=%016" PRIx64 " RFL=%08x [%c%c%c%c%c%c%c] CPL=%d II=%d A20=%d SMM=%d HLT=%d\n",
 590                     env->regs[R_EAX],
 591                     env->regs[R_EBX],
 592                     env->regs[R_ECX],
 593                     env->regs[R_EDX],
 594                     env->regs[R_ESI],
 595                     env->regs[R_EDI],
 596                     env->regs[R_EBP],
 597                     env->regs[R_ESP],
 598                     env->regs[8],
 599                     env->regs[9],
 600                     env->regs[10],
 601                     env->regs[11],
 602                     env->regs[12],
 603                     env->regs[13],
 604                     env->regs[14],
 605                     env->regs[15],
 606                     env->eip, eflags,
 607                     eflags & DF_MASK ? 'D' : '-',
 608                     eflags & CC_O ? 'O' : '-',
 609                     eflags & CC_S ? 'S' : '-',
 610                     eflags & CC_Z ? 'Z' : '-',
 611                     eflags & CC_A ? 'A' : '-',
 612                     eflags & CC_P ? 'P' : '-',
 613                     eflags & CC_C ? 'C' : '-',
 614                     env->hflags & HF_CPL_MASK,
 615                     (env->hflags >> HF_INHIBIT_IRQ_SHIFT) & 1,
 616                     (int)(env->a20_mask >> 20) & 1,
 617                     (env->hflags >> HF_SMM_SHIFT) & 1,
 618                     env->halted);
 619     } else
 620 #endif
 621     {
 622         cpu_fprintf(f, "EAX=%08x EBX=%08x ECX=%08x EDX=%08x\n"
 623                     "ESI=%08x EDI=%08x EBP=%08x ESP=%08x\n"
 624                     "EIP=%08x EFL=%08x [%c%c%c%c%c%c%c] CPL=%d II=%d A20=%d SMM=%d HLT=%d\n",
 625                     (uint32_t)env->regs[R_EAX],
 626                     (uint32_t)env->regs[R_EBX],
 627                     (uint32_t)env->regs[R_ECX],
 628                     (uint32_t)env->regs[R_EDX],
 629                     (uint32_t)env->regs[R_ESI],
 630                     (uint32_t)env->regs[R_EDI],
 631                     (uint32_t)env->regs[R_EBP],
 632                     (uint32_t)env->regs[R_ESP],
 633                     (uint32_t)env->eip, eflags,
 634                     eflags & DF_MASK ? 'D' : '-',
 635                     eflags & CC_O ? 'O' : '-',
 636                     eflags & CC_S ? 'S' : '-',
 637                     eflags & CC_Z ? 'Z' : '-',
 638                     eflags & CC_A ? 'A' : '-',
 639                     eflags & CC_P ? 'P' : '-',
 640                     eflags & CC_C ? 'C' : '-',
 641                     env->hflags & HF_CPL_MASK,
 642                     (env->hflags >> HF_INHIBIT_IRQ_SHIFT) & 1,
 643                     (int)(env->a20_mask >> 20) & 1,
 644                     (env->hflags >> HF_SMM_SHIFT) & 1,
 645                     env->halted);
 646     }
 647
 648 #ifdef TARGET_X86_64
 649     if (env->hflags & HF_LMA_MASK) {
 650         for(i = 0; i < 6; i++) {
 651             SegmentCache *sc = &env->segs[i];
 652             cpu_fprintf(f, "%s =%04x %016" PRIx64 " %08x %08x\n",
 653                         seg_name[i],
 654                         sc->selector,
 655                         sc->base,
 656                         sc->limit,
 657                         sc->flags);
 658         }
 659         cpu_fprintf(f, "LDT=%04x %016" PRIx64 " %08x %08x\n",
 660                     env->ldt.selector,
 661                     env->ldt.base,
 662                     env->ldt.limit,
 663                     env->ldt.flags);
 664         cpu_fprintf(f, "TR =%04x %016" PRIx64 " %08x %08x\n",
 665                     env->tr.selector,
 666                     env->tr.base,
 667                     env->tr.limit,
 668                     env->tr.flags);
 669         cpu_fprintf(f, "GDT=     %016" PRIx64 " %08x\n",
 670                     env->gdt.base, env->gdt.limit);
 671         cpu_fprintf(f, "IDT=     %016" PRIx64 " %08x\n",
 672                     env->idt.base, env->idt.limit);
 673         cpu_fprintf(f, "CR0=%08x CR2=%016" PRIx64 " CR3=%016" PRIx64 " CR4=%08x\n",
 674                     (uint32_t)env->cr[0],
 675                     env->cr[2],
 676                     env->cr[3],
 677                     (uint32_t)env->cr[4]);
 678     } else
 679 #endif
 680     {
 681         for(i = 0; i < 6; i++) {
 682             SegmentCache *sc = &env->segs[i];
 683             cpu_fprintf(f, "%s =%04x %08x %08x %08x\n",
 684                         seg_name[i],
 685                         sc->selector,
 686                         (uint32_t)sc->base,
 687                         sc->limit,
 688                         sc->flags);
 689         }
 690         cpu_fprintf(f, "LDT=%04x %08x %08x %08x\n",
 691                     env->ldt.selector,
 692                     (uint32_t)env->ldt.base,
 693                     env->ldt.limit,
 694                     env->ldt.flags);
 695         cpu_fprintf(f, "TR =%04x %08x %08x %08x\n",
 696                     env->tr.selector,
 697                     (uint32_t)env->tr.base,
 698                     env->tr.limit,
 699                     env->tr.flags);
 700         cpu_fprintf(f, "GDT=     %08x %08x\n",
 701                     (uint32_t)env->gdt.base, env->gdt.limit);
 702         cpu_fprintf(f, "IDT=     %08x %08x\n",
 703                     (uint32_t)env->idt.base, env->idt.limit);
 704         cpu_fprintf(f, "CR0=%08x CR2=%08x CR3=%08x CR4=%08x\n",
 705                     (uint32_t)env->cr[0],
 706                     (uint32_t)env->cr[2],
 707                     (uint32_t)env->cr[3],
 708                     (uint32_t)env->cr[4]);
 709     }
 710     if (flags & X86_DUMP_CCOP) {
 711         if ((unsigned)env->cc_op < CC_OP_NB)
 712             snprintf(cc_op_name, sizeof(cc_op_name), "%s", cc_op_str[env->cc_op]);
 713         else
 714             snprintf(cc_op_name, sizeof(cc_op_name), "[%d]", env->cc_op);
 715 #ifdef TARGET_X86_64
 716         if (env->hflags & HF_CS64_MASK) {
 717             cpu_fprintf(f, "CCS=%016" PRIx64 " CCD=%016" PRIx64 " CCO=%-8s\n",
 718                         env->cc_src, env->cc_dst,
 719                         cc_op_name);
 720         } else
 721 #endif
 722         {
 723             cpu_fprintf(f, "CCS=%08x CCD=%08x CCO=%-8s\n",
 724                         (uint32_t)env->cc_src, (uint32_t)env->cc_dst,
 725                         cc_op_name);
 726         }
 727     }
 728     if (flags & X86_DUMP_FPU) {
 729         int fptag;
 730         fptag = 0;
 731         for(i = 0; i < 8; i++) {
 732             fptag |= ((!env->fptags[i]) << i);
 733         }
 734         cpu_fprintf(f, "FCW=%04x FSW=%04x [ST=%d] FTW=%02x MXCSR=%08x\n",
 735                     env->fpuc,
 736                     (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11,
 737                     env->fpstt,
 738                     fptag,
 739                     env->mxcsr);
 740         for(i=0;i<8;i++) {
 741 #if defined(USE_X86LDOUBLE)
 742             union {
 743                 long double d;
 744                 struct {
 745                     uint64_t lower;
 746                     uint16_t upper;
 747                 } l;
 748             } tmp;
 749             tmp.d = env->fpregs[i].d;
 750             cpu_fprintf(f, "FPR%d=%016" PRIx64 " %04x",
 751                         i, tmp.l.lower, tmp.l.upper);
 752 #else
 753             cpu_fprintf(f, "FPR%d=%016" PRIx64,
 754                         i, env->fpregs[i].mmx.q);
 755 #endif
 756             if ((i & 1) == 1)
 757                 cpu_fprintf(f, "\n");
 758             else
 759                 cpu_fprintf(f, " ");
 760         }
 761         if (env->hflags & HF_CS64_MASK)
 762             nb = 16;
 763         else
 764             nb = 8;
 765         for(i=0;i<nb;i++) {
 766             cpu_fprintf(f, "XMM%02d=%08x%08x%08x%08x",
 767                         i,
 768                         env->xmm_regs[i].XMM_L(3),
 769                         env->xmm_regs[i].XMM_L(2),
 770                         env->xmm_regs[i].XMM_L(1),
 771                         env->xmm_regs[i].XMM_L(0));
 772             if ((i & 1) == 1)
 773                 cpu_fprintf(f, "\n");
 774             else
 775                 cpu_fprintf(f, " ");
 776         }
 777     }
 778 }
 779
 780 /***********************************************************/
 781 /* x86 mmu */
 782 /* XXX: add PGE support */
 783
 784 void cpu_x86_set_a20(CPUX86State *env, int a20_state)
 785 {
 786     a20_state = (a20_state != 0);
 787     if (a20_state != ((env->a20_mask >> 20) & 1)) {
 788 #if defined(DEBUG_MMU)
 789         printf("A20 update: a20=%d\n", a20_state);
 790 #endif
 791         /* if the cpu is currently executing code, we must unlink it and
 792            all the potentially executing TB */
 793         cpu_interrupt(env, CPU_INTERRUPT_EXITTB);
 794
 795         /* when a20 is changed, all the MMU mappings are invalid, so
 796            we must flush everything */
 797         tlb_flush(env, 1);
 798         env->a20_mask = (~0x100000) | (a20_state << 20);
 799     }
 800 }
 801
 802 void cpu_x86_update_cr0(CPUX86State *env, uint32_t new_cr0)
 803 {
 804     int pe_state;
 805
 806 #if defined(DEBUG_MMU)
 807     printf("CR0 update: CR0=0x%08x\n", new_cr0);
 808 #endif
 809     if ((new_cr0 & (CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK)) !=
 810         (env->cr[0] & (CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK))) {
 811         tlb_flush(env, 1);
 812     }
 813
 814 #ifdef TARGET_X86_64
 815     if (!(env->cr[0] & CR0_PG_MASK) && (new_cr0 & CR0_PG_MASK) &&
 816         (env->efer & MSR_EFER_LME)) {
 817         /* enter in long mode */
 818         /* XXX: generate an exception */
 819         if (!(env->cr[4] & CR4_PAE_MASK))
 820             return;
 821         env->efer |= MSR_EFER_LMA;
 822         env->hflags |= HF_LMA_MASK;
 823     } else if ((env->cr[0] & CR0_PG_MASK) && !(new_cr0 & CR0_PG_MASK) &&
 824                (env->efer & MSR_EFER_LMA)) {
 825         /* exit long mode */
 826         env->efer &= ~MSR_EFER_LMA;
 827         env->hflags &= ~(HF_LMA_MASK | HF_CS64_MASK);
 828         env->eip &= 0xffffffff;
 829     }
 830 #endif
 831     env->cr[0] = new_cr0 | CR0_ET_MASK;
 832
 833     /* update PE flag in hidden flags */
 834     pe_state = (env->cr[0] & CR0_PE_MASK);
 835     env->hflags = (env->hflags & ~HF_PE_MASK) | (pe_state << HF_PE_SHIFT);
 836     /* ensure that ADDSEG is always set in real mode */
 837     env->hflags |= ((pe_state ^ 1) << HF_ADDSEG_SHIFT);
 838     /* update FPU flags */
 839     env->hflags = (env->hflags & ~(HF_MP_MASK | HF_EM_MASK | HF_TS_MASK)) |
 840         ((new_cr0 << (HF_MP_SHIFT - 1)) & (HF_MP_MASK | HF_EM_MASK | HF_TS_MASK));
 841 }
 842
 843 /* XXX: in legacy PAE mode, generate a GPF if reserved bits are set in
 844    the PDPT */
 845 void cpu_x86_update_cr3(CPUX86State *env, target_ulong new_cr3)
 846 {
 847     env->cr[3] = new_cr3;
 848     if (env->cr[0] & CR0_PG_MASK) {
 849 #if defined(DEBUG_MMU)
 850         printf("CR3 update: CR3=" TARGET_FMT_lx "\n", new_cr3);
 851 #endif
 852         tlb_flush(env, 0);
 853     }
 854 }
 855
 856 void cpu_x86_update_cr4(CPUX86State *env, uint32_t new_cr4)
 857 {
 858 #if defined(DEBUG_MMU)
 859     printf("CR4 update: CR4=%08x\n", (uint32_t)env->cr[4]);
 860 #endif
 861     if ((new_cr4 & (CR4_PGE_MASK | CR4_PAE_MASK | CR4_PSE_MASK)) !=
 862         (env->cr[4] & (CR4_PGE_MASK | CR4_PAE_MASK | CR4_PSE_MASK))) {
 863         tlb_flush(env, 1);
 864     }
 865     /* SSE handling */
 866     if (!(env->cpuid_features & CPUID_SSE))
 867         new_cr4 &= ~CR4_OSFXSR_MASK;
 868     if (new_cr4 & CR4_OSFXSR_MASK)
 869         env->hflags |= HF_OSFXSR_MASK;
 870     else
 871         env->hflags &= ~HF_OSFXSR_MASK;
 872
 873     env->cr[4] = new_cr4;
 874 }
 875
 876 /* XXX: also flush 4MB pages */
 877 void cpu_x86_flush_tlb(CPUX86State *env, target_ulong addr)
 878 {
 879     tlb_flush_page(env, addr);
 880 }
 881
 882 #if defined(CONFIG_USER_ONLY)
 883
 884 int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
 885                              int is_write, int mmu_idx, int is_softmmu)
 886 {
 887     /* user mode only emulation */
 888     is_write &= 1;
 889     env->cr[2] = addr;
 890     env->error_code = (is_write << PG_ERROR_W_BIT);
 891     env->error_code |= PG_ERROR_U_MASK;
 892     env->exception_index = EXCP0E_PAGE;
 893     return 1;
 894 }
 895
 896 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
 897 {
 898     return addr;
 899 }
 900
 901 #else
 902
 903 /* XXX: This value should match the one returned by CPUID
 904  * and in exec.c */
 905 #if defined(USE_KQEMU)
 906 #define PHYS_ADDR_MASK 0xfffff000LL
 907 #else
 908 # if defined(TARGET_X86_64)
 909 # define PHYS_ADDR_MASK 0xfffffff000LL
 910 # else
 911 # define PHYS_ADDR_MASK 0xffffff000LL
 912 # endif
 913 #endif
 914
 915 /* return value:
 916    -1 = cannot handle fault
 917    0  = nothing more to do
 918    1  = generate PF fault
 919    2  = soft MMU activation required for this block
 920 */
 921 int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
 922                              int is_write1, int mmu_idx, int is_softmmu)
 923 {
 924     uint64_t ptep, pte;
 925     target_ulong pde_addr, pte_addr;
 926     int error_code, is_dirty, prot, page_size, ret, is_write, is_user;
 927     target_phys_addr_t paddr;
 928     uint32_t page_offset;
 929     target_ulong vaddr, virt_addr;
 930
 931     is_user = mmu_idx == MMU_USER_IDX;
 932 #if defined(DEBUG_MMU)
 933     printf("MMU fault: addr=" TARGET_FMT_lx " w=%d u=%d eip=" TARGET_FMT_lx "\n",
 934            addr, is_write1, is_user, env->eip);
 935 #endif
 936     is_write = is_write1 & 1;
 937
 938     if (!(env->cr[0] & CR0_PG_MASK)) {
 939         pte = addr;
 940         virt_addr = addr & TARGET_PAGE_MASK;
 941         prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 942         page_size = 4096;
 943         goto do_mapping;
 944     }
 945
 946     if (env->cr[4] & CR4_PAE_MASK) {
 947         uint64_t pde, pdpe;
 948         target_ulong pdpe_addr;
 949
 950 #ifdef TARGET_X86_64
 951         if (env->hflags & HF_LMA_MASK) {
 952             uint64_t pml4e_addr, pml4e;
 953             int32_t sext;
 954
 955             /* test virtual address sign extension */
 956             sext = (int64_t)addr >> 47;
 957             if (sext != 0 && sext != -1) {
 958                 env->error_code = 0;
 959                 env->exception_index = EXCP0D_GPF;
 960                 return 1;
 961             }
 962
 963             pml4e_addr = ((env->cr[3] & ~0xfff) + (((addr >> 39) & 0x1ff) << 3)) &
 964                 env->a20_mask;
 965             pml4e = ldq_phys(pml4e_addr);
 966             if (!(pml4e & PG_PRESENT_MASK)) {
 967                 error_code = 0;
 968                 goto do_fault;
 969             }
 970             if (!(env->efer & MSR_EFER_NXE) && (pml4e & PG_NX_MASK)) {
 971                 error_code = PG_ERROR_RSVD_MASK;
 972                 goto do_fault;
 973             }
 974             if (!(pml4e & PG_ACCESSED_MASK)) {
 975                 pml4e |= PG_ACCESSED_MASK;
 976                 stl_phys_notdirty(pml4e_addr, pml4e);
 977             }
 978             ptep = pml4e ^ PG_NX_MASK;
 979             pdpe_addr = ((pml4e & PHYS_ADDR_MASK) + (((addr >> 30) & 0x1ff) << 3)) &
 980                 env->a20_mask;
 981             pdpe = ldq_phys(pdpe_addr);
 982             if (!(pdpe & PG_PRESENT_MASK)) {
 983                 error_code = 0;
 984                 goto do_fault;
 985             }
 986             if (!(env->efer & MSR_EFER_NXE) && (pdpe & PG_NX_MASK)) {
 987                 error_code = PG_ERROR_RSVD_MASK;
 988                 goto do_fault;
 989             }
 990             ptep &= pdpe ^ PG_NX_MASK;
 991             if (!(pdpe & PG_ACCESSED_MASK)) {
 992                 pdpe |= PG_ACCESSED_MASK;
 993                 stl_phys_notdirty(pdpe_addr, pdpe);
 994             }
 995         } else
 996 #endif
 997         {
 998             /* XXX: load them when cr3 is loaded ? */
 999             pdpe_addr = ((env->cr[3] & ~0x1f) + ((addr >> 27) & 0x18)) &
1000                 env->a20_mask;
1001             pdpe = ldq_phys(pdpe_addr);
1002             if (!(pdpe & PG_PRESENT_MASK)) {
1003                 error_code = 0;
1004                 goto do_fault;
1005             }
1006             ptep = PG_NX_MASK | PG_USER_MASK | PG_RW_MASK;
1007         }
1008
1009         pde_addr = ((pdpe & PHYS_ADDR_MASK) + (((addr >> 21) & 0x1ff) << 3)) &
1010             env->a20_mask;
1011         pde = ldq_phys(pde_addr);
1012         if (!(pde & PG_PRESENT_MASK)) {
1013             error_code = 0;
1014             goto do_fault;
1015         }
1016         if (!(env->efer & MSR_EFER_NXE) && (pde & PG_NX_MASK)) {
1017             error_code = PG_ERROR_RSVD_MASK;
1018             goto do_fault;
1019         }
1020         ptep &= pde ^ PG_NX_MASK;
1021         if (pde & PG_PSE_MASK) {
1022             /* 2 MB page */
1023             page_size = 2048 * 1024;
1024             ptep ^= PG_NX_MASK;
1025             if ((ptep & PG_NX_MASK) && is_write1 == 2)
1026                 goto do_fault_protect;
1027             if (is_user) {
1028                 if (!(ptep & PG_USER_MASK))
1029                     goto do_fault_protect;
1030                 if (is_write && !(ptep & PG_RW_MASK))
1031                     goto do_fault_protect;
1032             } else {
1033                 if ((env->cr[0] & CR0_WP_MASK) &&
1034                     is_write && !(ptep & PG_RW_MASK))
1035                     goto do_fault_protect;
1036             }
1037             is_dirty = is_write && !(pde & PG_DIRTY_MASK);
1038             if (!(pde & PG_ACCESSED_MASK) || is_dirty) {
1039                 pde |= PG_ACCESSED_MASK;
1040                 if (is_dirty)
1041                     pde |= PG_DIRTY_MASK;
1042                 stl_phys_notdirty(pde_addr, pde);
1043             }
1044             /* align to page_size */
1045             pte = pde & ((PHYS_ADDR_MASK & ~(page_size - 1)) | 0xfff);
1046             virt_addr = addr & ~(page_size - 1);
1047         } else {
1048             /* 4 KB page */
1049             if (!(pde & PG_ACCESSED_MASK)) {
1050                 pde |= PG_ACCESSED_MASK;
1051                 stl_phys_notdirty(pde_addr, pde);
1052             }
1053             pte_addr = ((pde & PHYS_ADDR_MASK) + (((addr >> 12) & 0x1ff) << 3)) &
1054                 env->a20_mask;
1055             pte = ldq_phys(pte_addr);
1056             if (!(pte & PG_PRESENT_MASK)) {
1057                 error_code = 0;
1058                 goto do_fault;
1059             }
1060             if (!(env->efer & MSR_EFER_NXE) && (pte & PG_NX_MASK)) {
1061                 error_code = PG_ERROR_RSVD_MASK;
1062                 goto do_fault;
1063             }
1064             /* combine pde and pte nx, user and rw protections */
1065             ptep &= pte ^ PG_NX_MASK;
1066             ptep ^= PG_NX_MASK;
1067             if ((ptep & PG_NX_MASK) && is_write1 == 2)
1068                 goto do_fault_protect;
1069             if (is_user) {
1070                 if (!(ptep & PG_USER_MASK))
1071                     goto do_fault_protect;
1072                 if (is_write && !(ptep & PG_RW_MASK))
1073                     goto do_fault_protect;
1074             } else {
1075                 if ((env->cr[0] & CR0_WP_MASK) &&
1076                     is_write && !(ptep & PG_RW_MASK))
1077                     goto do_fault_protect;
1078             }
1079             is_dirty = is_write && !(pte & PG_DIRTY_MASK);
1080             if (!(pte & PG_ACCESSED_MASK) || is_dirty) {
1081                 pte |= PG_ACCESSED_MASK;
1082                 if (is_dirty)
1083                     pte |= PG_DIRTY_MASK;
1084                 stl_phys_notdirty(pte_addr, pte);
1085             }
1086             page_size = 4096;
1087             virt_addr = addr & ~0xfff;
1088             pte = pte & (PHYS_ADDR_MASK | 0xfff);
1089         }
1090     } else {
1091         uint32_t pde;
1092
1093         /* page directory entry */
1094         pde_addr = ((env->cr[3] & ~0xfff) + ((addr >> 20) & 0xffc)) &
1095             env->a20_mask;
1096         pde = ldl_phys(pde_addr);
1097         if (!(pde & PG_PRESENT_MASK)) {
1098             error_code = 0;
1099             goto do_fault;
1100         }
1101         /* if PSE bit is set, then we use a 4MB page */
1102         if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) {
1103             page_size = 4096 * 1024;
1104             if (is_user) {
1105                 if (!(pde & PG_USER_MASK))
1106                     goto do_fault_protect;
1107                 if (is_write && !(pde & PG_RW_MASK))
1108                     goto do_fault_protect;
1109             } else {
1110                 if ((env->cr[0] & CR0_WP_MASK) &&
1111                     is_write && !(pde & PG_RW_MASK))
1112                     goto do_fault_protect;
1113             }
1114             is_dirty = is_write && !(pde & PG_DIRTY_MASK);
1115             if (!(pde & PG_ACCESSED_MASK) || is_dirty) {
1116                 pde |= PG_ACCESSED_MASK;
1117                 if (is_dirty)
1118                     pde |= PG_DIRTY_MASK;
1119                 stl_phys_notdirty(pde_addr, pde);
1120             }
1121
1122             pte = pde & ~( (page_size - 1) & ~0xfff); /* align to page_size */
1123             ptep = pte;
1124             virt_addr = addr & ~(page_size - 1);
1125         } else {
1126             if (!(pde & PG_ACCESSED_MASK)) {
1127                 pde |= PG_ACCESSED_MASK;
1128                 stl_phys_notdirty(pde_addr, pde);
1129             }
1130
1131             /* page directory entry */
1132             pte_addr = ((pde & ~0xfff) + ((addr >> 10) & 0xffc)) &
1133                 env->a20_mask;
1134             pte = ldl_phys(pte_addr);
1135             if (!(pte & PG_PRESENT_MASK)) {
1136                 error_code = 0;
1137                 goto do_fault;
1138             }
1139             /* combine pde and pte user and rw protections */
1140             ptep = pte & pde;
1141             if (is_user) {
1142                 if (!(ptep & PG_USER_MASK))
1143                     goto do_fault_protect;
1144                 if (is_write && !(ptep & PG_RW_MASK))
1145                     goto do_fault_protect;
1146             } else {
1147                 if ((env->cr[0] & CR0_WP_MASK) &&
1148                     is_write && !(ptep & PG_RW_MASK))
1149                     goto do_fault_protect;
1150             }
1151             is_dirty = is_write && !(pte & PG_DIRTY_MASK);
1152             if (!(pte & PG_ACCESSED_MASK) || is_dirty) {
1153                 pte |= PG_ACCESSED_MASK;
1154                 if (is_dirty)
1155                     pte |= PG_DIRTY_MASK;
1156                 stl_phys_notdirty(pte_addr, pte);
1157             }
1158             page_size = 4096;
1159             virt_addr = addr & ~0xfff;
1160         }
1161     }
1162     /* the page can be put in the TLB */
1163     prot = PAGE_READ;
1164     if (!(ptep & PG_NX_MASK))
1165         prot |= PAGE_EXEC;
1166     if (pte & PG_DIRTY_MASK) {
1167         /* only set write access if already dirty... otherwise wait
1168            for dirty access */
1169         if (is_user) {
1170             if (ptep & PG_RW_MASK)
1171                 prot |= PAGE_WRITE;
1172         } else {
1173             if (!(env->cr[0] & CR0_WP_MASK) ||
1174                 (ptep & PG_RW_MASK))
1175                 prot |= PAGE_WRITE;
1176         }
1177     }
1178  do_mapping:
1179     pte = pte & env->a20_mask;
1180
1181     /* Even if 4MB pages, we map only one 4KB page in the cache to
1182        avoid filling it too fast */
1183     page_offset = (addr & TARGET_PAGE_MASK) & (page_size - 1);
1184     paddr = (pte & TARGET_PAGE_MASK) + page_offset;
1185     vaddr = virt_addr + page_offset;
1186
1187     ret = tlb_set_page_exec(env, vaddr, paddr, prot, mmu_idx, is_softmmu);
1188     return ret;
1189  do_fault_protect:
1190     error_code = PG_ERROR_P_MASK;
1191  do_fault:
1192     error_code |= (is_write << PG_ERROR_W_BIT);
1193     if (is_user)
1194         error_code |= PG_ERROR_U_MASK;
1195     if (is_write1 == 2 &&
1196         (env->efer & MSR_EFER_NXE) &&
1197         (env->cr[4] & CR4_PAE_MASK))
1198         error_code |= PG_ERROR_I_D_MASK;
1199     if (env->intercept_exceptions & (1 << EXCP0E_PAGE)) {
1200         /* cr2 is not modified in case of exceptions */
1201         stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2),
1202                  addr);
1203     } else {
1204         env->cr[2] = addr;
1205     }
1206     env->error_code = error_code;
1207     env->exception_index = EXCP0E_PAGE;
1208     return 1;
1209 }
1210
1211 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
1212 {
1213     target_ulong pde_addr, pte_addr;
1214     uint64_t pte;
1215     target_phys_addr_t paddr;
1216     uint32_t page_offset;
1217     int page_size;
1218
1219     if (env->cr[4] & CR4_PAE_MASK) {
1220         target_ulong pdpe_addr;
1221         uint64_t pde, pdpe;
1222
1223 #ifdef TARGET_X86_64
1224         if (env->hflags & HF_LMA_MASK) {
1225             uint64_t pml4e_addr, pml4e;
1226             int32_t sext;
1227
1228             /* test virtual address sign extension */
1229             sext = (int64_t)addr >> 47;
1230             if (sext != 0 && sext != -1)
1231                 return -1;
1232
1233             pml4e_addr = ((env->cr[3] & ~0xfff) + (((addr >> 39) & 0x1ff) << 3)) &
1234                 env->a20_mask;
1235             pml4e = ldq_phys(pml4e_addr);
1236             if (!(pml4e & PG_PRESENT_MASK))
1237                 return -1;
1238
1239             pdpe_addr = ((pml4e & ~0xfff) + (((addr >> 30) & 0x1ff) << 3)) &
1240                 env->a20_mask;
1241             pdpe = ldq_phys(pdpe_addr);
1242             if (!(pdpe & PG_PRESENT_MASK))
1243                 return -1;
1244         } else
1245 #endif
1246         {
1247             pdpe_addr = ((env->cr[3] & ~0x1f) + ((addr >> 27) & 0x18)) &
1248                 env->a20_mask;
1249             pdpe = ldq_phys(pdpe_addr);
1250             if (!(pdpe & PG_PRESENT_MASK))
1251                 return -1;
1252         }
1253
1254         pde_addr = ((pdpe & ~0xfff) + (((addr >> 21) & 0x1ff) << 3)) &
1255             env->a20_mask;
1256         pde = ldq_phys(pde_addr);
1257         if (!(pde & PG_PRESENT_MASK)) {
1258             return -1;
1259         }
1260         if (pde & PG_PSE_MASK) {
1261             /* 2 MB page */
1262             page_size = 2048 * 1024;
1263             pte = pde & ~( (page_size - 1) & ~0xfff); /* align to page_size */
1264         } else {
1265             /* 4 KB page */
1266             pte_addr = ((pde & ~0xfff) + (((addr >> 12) & 0x1ff) << 3)) &
1267                 env->a20_mask;
1268             page_size = 4096;
1269             pte = ldq_phys(pte_addr);
1270         }
1271         if (!(pte & PG_PRESENT_MASK))
1272             return -1;
1273     } else {
1274         uint32_t pde;
1275
1276         if (!(env->cr[0] & CR0_PG_MASK)) {
1277             pte = addr;
1278             page_size = 4096;
1279         } else {
1280             /* page directory entry */
1281             pde_addr = ((env->cr[3] & ~0xfff) + ((addr >> 20) & 0xffc)) & env->a20_mask;
1282             pde = ldl_phys(pde_addr);
1283             if (!(pde & PG_PRESENT_MASK))
1284                 return -1;
1285             if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) {
1286                 pte = pde & ~0x003ff000; /* align to 4MB */
1287                 page_size = 4096 * 1024;
1288             } else {
1289                 /* page directory entry */
1290                 pte_addr = ((pde & ~0xfff) + ((addr >> 10) & 0xffc)) & env->a20_mask;
1291                 pte = ldl_phys(pte_addr);
1292                 if (!(pte & PG_PRESENT_MASK))
1293                     return -1;
1294                 page_size = 4096;
1295             }
1296         }
1297         pte = pte & env->a20_mask;
1298     }
1299
1300     page_offset = (addr & TARGET_PAGE_MASK) & (page_size - 1);
1301     paddr = (pte & TARGET_PAGE_MASK) + page_offset;
1302     return paddr;
1303 }
1304 #endif /* !CONFIG_USER_ONLY */
1305
1306 #if defined(CONFIG_KVM) || defined(USE_KVM)
1307 static void host_cpuid(uint32_t function, uint32_t *eax, uint32_t *ebx,
1308                        uint32_t *ecx, uint32_t *edx)
1309 {
1310     uint32_t vec[4];
1311
1312 #ifdef __x86_64__
1313     asm volatile("cpuid"
1314                  : "=a"(vec[0]), "=b"(vec[1]),
1315                    "=c"(vec[2]), "=d"(vec[3])
1316                  : "0"(function) : "cc");
1317 #else
1318     asm volatile("pusha \n\t"
1319                  "cpuid \n\t"
1320                  "mov %%eax, 0(%1) \n\t"
1321                  "mov %%ebx, 4(%1) \n\t"
1322                  "mov %%ecx, 8(%1) \n\t"
1323                  "mov %%edx, 12(%1) \n\t"
1324                  "popa"
1325                  : : "a"(function), "S"(vec)
1326                  : "memory", "cc");
1327 #endif
1328
1329     if (eax)
1330         *eax = vec[0];
1331     if (ebx)
1332         *ebx = vec[1];
1333     if (ecx)
1334         *ecx = vec[2];
1335     if (edx)
1336         *edx = vec[3];
1337 }
1338 #endif
1339
1340 void cpu_x86_cpuid(CPUX86State *env, uint32_t index,
1341                    uint32_t *eax, uint32_t *ebx,
1342                    uint32_t *ecx, uint32_t *edx)
1343 {
1344     /* test if maximum index reached */
1345     if (index & 0x80000000) {
1346         if (index > env->cpuid_xlevel)
1347             index = env->cpuid_level;
1348     } else {
1349         if (index > env->cpuid_level)
1350             index = env->cpuid_level;
1351     }
1352
1353     switch(index) {
1354     case 0:
1355         *eax = env->cpuid_level;
1356         *ebx = env->cpuid_vendor1;
1357         *edx = env->cpuid_vendor2;
1358         *ecx = env->cpuid_vendor3;
1359
1360         /* sysenter isn't supported on compatibility mode on AMD.  and syscall
1361          * isn't supported in compatibility mode on Intel.  so advertise the
1362          * actuall cpu, and say goodbye to migration between different vendors
1363          * is you use compatibility mode. */
1364         if (kvm_enabled())
1365             host_cpuid(0, NULL, ebx, ecx, edx);
1366         break;
1367     case 1:
1368         *eax = env->cpuid_version;
1369         *ebx = (env->cpuid_apic_id << 24) | 8 << 8; /* CLFLUSH size in quad words, Linux wants it. */
1370         *ecx = env->cpuid_ext_features;
1371         *edx = env->cpuid_features;
1372
1373         /* "Hypervisor present" bit required for Microsoft SVVP */
1374         if (kvm_enabled())
1375             *ecx |= (1 << 31);
1376         break;
1377     case 2:
1378         /* cache info: needed for Pentium Pro compatibility */
1379         *eax = 1;
1380         *ebx = 0;
1381         *ecx = 0;
1382         *edx = 0x2c307d;
1383         break;
1384     case 4:
1385         /* cache info: needed for Core compatibility */
1386         switch (*ecx) {
1387             case 0: /* L1 dcache info */
1388                 *eax = 0x0000121;
1389                 *ebx = 0x1c0003f;
1390                 *ecx = 0x000003f;
1391                 *edx = 0x0000001;
1392                 break;
1393             case 1: /* L1 icache info */
1394                 *eax = 0x0000122;
1395                 *ebx = 0x1c0003f;
1396                 *ecx = 0x000003f;
1397                 *edx = 0x0000001;
1398                 break;
1399             case 2: /* L2 cache info */
1400                 *eax = 0x0000143;
1401                 *ebx = 0x3c0003f;
1402                 *ecx = 0x0000fff;
1403                 *edx = 0x0000001;
1404                 break;
1405             default: /* end of info */
1406                 *eax = 0;
1407                 *ebx = 0;
1408                 *ecx = 0;
1409                 *edx = 0;
1410                 break;
1411         }
1412
1413         break;
1414     case 5:
1415         /* mwait info: needed for Core compatibility */
1416         *eax = 0; /* Smallest monitor-line size in bytes */
1417         *ebx = 0; /* Largest monitor-line size in bytes */
1418         *ecx = CPUID_MWAIT_EMX | CPUID_MWAIT_IBE;
1419         *edx = 0;
1420         break;
1421     case 6:
1422         /* Thermal and Power Leaf */
1423         *eax = 0;
1424         *ebx = 0;
1425         *ecx = 0;
1426         *edx = 0;
1427         break;
1428     case 9:
1429         /* Direct Cache Access Information Leaf */
1430         *eax = 0; /* Bits 0-31 in DCA_CAP MSR */
1431         *ebx = 0;
1432         *ecx = 0;
1433         *edx = 0;
1434         break;
1435     case 0xA:
1436         /* Architectural Performance Monitoring Leaf */
1437         *eax = 0;
1438         *ebx = 0;
1439         *ecx = 0;
1440         *edx = 0;
1441         break;
1442     case 0x80000000:
1443         *eax = env->cpuid_xlevel;
1444         *ebx = env->cpuid_vendor1;
1445         *edx = env->cpuid_vendor2;
1446         *ecx = env->cpuid_vendor3;
1447         break;
1448     case 0x80000001:
1449         *eax = env->cpuid_features;
1450         *ebx = 0;
1451         *ecx = env->cpuid_ext3_features;
1452         *edx = env->cpuid_ext2_features;
1453
1454         if (kvm_enabled()) {
1455             uint32_t h_eax, h_edx;
1456
1457             host_cpuid(0x80000001, &h_eax, NULL, NULL, &h_edx);
1458
1459             /* disable CPU features that the host does not support */
1460
1461             /* long mode */
1462             if ((h_edx & 0x20000000) == 0 /* || !lm_capable_kernel */)
1463                 *edx &= ~0x20000000;
1464             /* syscall */
1465             if ((h_edx & 0x00000800) == 0)
1466                 *edx &= ~0x00000800;
1467             /* nx */
1468             if ((h_edx & 0x00100000) == 0)
1469                 *edx &= ~0x00100000;
1470
1471             /* disable CPU features that KVM cannot support */
1472
1473             /* svm */
1474             *ecx &= ~4UL;
1475             /* 3dnow */
1476             *edx &= ~0xc0000000;
1477         }
1478         break;
1479     case 0x80000002:
1480     case 0x80000003:
1481     case 0x80000004:
1482         *eax = env->cpuid_model[(index - 0x80000002) * 4 + 0];
1483         *ebx = env->cpuid_model[(index - 0x80000002) * 4 + 1];
1484         *ecx = env->cpuid_model[(index - 0x80000002) * 4 + 2];
1485         *edx = env->cpuid_model[(index - 0x80000002) * 4 + 3];
1486         break;
1487     case 0x80000005:
1488         /* cache info (L1 cache) */
1489         *eax = 0x01ff01ff;
1490         *ebx = 0x01ff01ff;
1491         *ecx = 0x40020140;
1492         *edx = 0x40020140;
1493         break;
1494     case 0x80000006:
1495         /* cache info (L2 cache) */
1496         *eax = 0;
1497         *ebx = 0x42004200;
1498         *ecx = 0x02008140;
1499         *edx = 0;
1500         break;
1501     case 0x80000008:
1502         /* virtual & phys address size in low 2 bytes. */
1503 /* XXX: This value must match the one used in the MMU code. */
1504         if (env->cpuid_ext2_features & CPUID_EXT2_LM) {
1505             /* 64 bit processor */
1506 #if defined(USE_KQEMU)
1507             *eax = 0x00003020;  /* 48 bits virtual, 32 bits physical */
1508 #else
1509 /* XXX: The physical address space is limited to 42 bits in exec.c. */
1510             *eax = 0x00003028;  /* 48 bits virtual, 40 bits physical */
1511 #endif
1512         } else {
1513 #if defined(USE_KQEMU)
1514             *eax = 0x00000020;  /* 32 bits physical */
1515 #else
1516             if (env->cpuid_features & CPUID_PSE36)
1517                 *eax = 0x00000024; /* 36 bits physical */
1518             else
1519                 *eax = 0x00000020; /* 32 bits physical */
1520 #endif
1521         }
1522         *ebx = 0;
1523         *ecx = 0;
1524         *edx = 0;
1525         break;
1526     case 0x8000000A:
1527         *eax = 0x00000001; /* SVM Revision */
1528         *ebx = 0x00000010; /* nr of ASIDs */
1529         *ecx = 0;
1530         *edx = 0; /* optional features */
1531         break;
1532     default:
1533         /* reserved values: zero */
1534         *eax = 0;
1535         *ebx = 0;
1536         *ecx = 0;
1537         *edx = 0;
1538         break;
1539     }
1540 }