2 * x86 segmentation related helpers:
3 * TSS, interrupts, system calls, jumps and call/task gates, descriptors
5 * Copyright (c) 2003 Fabrice Bellard
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
24 #include "exec/helper-proto.h"
25 #include "exec/exec-all.h"
26 #include "exec/cpu_ldst.h"
28 #include "helper-tcg.h"
29 #include "seg_helper.h"
31 int get_pg_mode(CPUX86State
*env
)
34 if (!(env
->cr
[0] & CR0_PG_MASK
)) {
37 if (env
->cr
[0] & CR0_WP_MASK
) {
38 pg_mode
|= PG_MODE_WP
;
40 if (env
->cr
[4] & CR4_PAE_MASK
) {
41 pg_mode
|= PG_MODE_PAE
;
42 if (env
->efer
& MSR_EFER_NXE
) {
43 pg_mode
|= PG_MODE_NXE
;
46 if (env
->cr
[4] & CR4_PSE_MASK
) {
47 pg_mode
|= PG_MODE_PSE
;
49 if (env
->cr
[4] & CR4_SMEP_MASK
) {
50 pg_mode
|= PG_MODE_SMEP
;
52 if (env
->hflags
& HF_LMA_MASK
) {
53 pg_mode
|= PG_MODE_LMA
;
54 if (env
->cr
[4] & CR4_PKE_MASK
) {
55 pg_mode
|= PG_MODE_PKE
;
57 if (env
->cr
[4] & CR4_PKS_MASK
) {
58 pg_mode
|= PG_MODE_PKS
;
60 if (env
->cr
[4] & CR4_LA57_MASK
) {
61 pg_mode
|= PG_MODE_LA57
;
67 /* return non zero if error */
68 static inline int load_segment_ra(CPUX86State
*env
, uint32_t *e1_ptr
,
69 uint32_t *e2_ptr
, int selector
,
81 index
= selector
& ~7;
82 if ((index
+ 7) > dt
->limit
) {
85 ptr
= dt
->base
+ index
;
86 *e1_ptr
= cpu_ldl_kernel_ra(env
, ptr
, retaddr
);
87 *e2_ptr
= cpu_ldl_kernel_ra(env
, ptr
+ 4, retaddr
);
91 static inline int load_segment(CPUX86State
*env
, uint32_t *e1_ptr
,
92 uint32_t *e2_ptr
, int selector
)
94 return load_segment_ra(env
, e1_ptr
, e2_ptr
, selector
, 0);
97 static inline unsigned int get_seg_limit(uint32_t e1
, uint32_t e2
)
101 limit
= (e1
& 0xffff) | (e2
& 0x000f0000);
102 if (e2
& DESC_G_MASK
) {
103 limit
= (limit
<< 12) | 0xfff;
108 static inline uint32_t get_seg_base(uint32_t e1
, uint32_t e2
)
110 return (e1
>> 16) | ((e2
& 0xff) << 16) | (e2
& 0xff000000);
113 static inline void load_seg_cache_raw_dt(SegmentCache
*sc
, uint32_t e1
,
116 sc
->base
= get_seg_base(e1
, e2
);
117 sc
->limit
= get_seg_limit(e1
, e2
);
121 /* init the segment cache in vm86 mode. */
122 static inline void load_seg_vm(CPUX86State
*env
, int seg
, int selector
)
126 cpu_x86_load_seg_cache(env
, seg
, selector
, (selector
<< 4), 0xffff,
127 DESC_P_MASK
| DESC_S_MASK
| DESC_W_MASK
|
128 DESC_A_MASK
| (3 << DESC_DPL_SHIFT
));
131 static inline void get_ss_esp_from_tss(CPUX86State
*env
, uint32_t *ss_ptr
,
132 uint32_t *esp_ptr
, int dpl
,
135 X86CPU
*cpu
= env_archcpu(env
);
136 int type
, index
, shift
;
141 printf("TR: base=%p limit=%x\n", env
->tr
.base
, env
->tr
.limit
);
142 for (i
= 0; i
< env
->tr
.limit
; i
++) {
143 printf("%02x ", env
->tr
.base
[i
]);
152 if (!(env
->tr
.flags
& DESC_P_MASK
)) {
153 cpu_abort(CPU(cpu
), "invalid tss");
155 type
= (env
->tr
.flags
>> DESC_TYPE_SHIFT
) & 0xf;
156 if ((type
& 7) != 1) {
157 cpu_abort(CPU(cpu
), "invalid tss type");
160 index
= (dpl
* 4 + 2) << shift
;
161 if (index
+ (4 << shift
) - 1 > env
->tr
.limit
) {
162 raise_exception_err_ra(env
, EXCP0A_TSS
, env
->tr
.selector
& 0xfffc, retaddr
);
165 *esp_ptr
= cpu_lduw_kernel_ra(env
, env
->tr
.base
+ index
, retaddr
);
166 *ss_ptr
= cpu_lduw_kernel_ra(env
, env
->tr
.base
+ index
+ 2, retaddr
);
168 *esp_ptr
= cpu_ldl_kernel_ra(env
, env
->tr
.base
+ index
, retaddr
);
169 *ss_ptr
= cpu_lduw_kernel_ra(env
, env
->tr
.base
+ index
+ 4, retaddr
);
173 static void tss_load_seg(CPUX86State
*env
, X86Seg seg_reg
, int selector
,
174 int cpl
, uintptr_t retaddr
)
179 if ((selector
& 0xfffc) != 0) {
180 if (load_segment_ra(env
, &e1
, &e2
, selector
, retaddr
) != 0) {
181 raise_exception_err_ra(env
, EXCP0A_TSS
, selector
& 0xfffc, retaddr
);
183 if (!(e2
& DESC_S_MASK
)) {
184 raise_exception_err_ra(env
, EXCP0A_TSS
, selector
& 0xfffc, retaddr
);
187 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
188 if (seg_reg
== R_CS
) {
189 if (!(e2
& DESC_CS_MASK
)) {
190 raise_exception_err_ra(env
, EXCP0A_TSS
, selector
& 0xfffc, retaddr
);
193 raise_exception_err_ra(env
, EXCP0A_TSS
, selector
& 0xfffc, retaddr
);
195 } else if (seg_reg
== R_SS
) {
196 /* SS must be writable data */
197 if ((e2
& DESC_CS_MASK
) || !(e2
& DESC_W_MASK
)) {
198 raise_exception_err_ra(env
, EXCP0A_TSS
, selector
& 0xfffc, retaddr
);
200 if (dpl
!= cpl
|| dpl
!= rpl
) {
201 raise_exception_err_ra(env
, EXCP0A_TSS
, selector
& 0xfffc, retaddr
);
204 /* not readable code */
205 if ((e2
& DESC_CS_MASK
) && !(e2
& DESC_R_MASK
)) {
206 raise_exception_err_ra(env
, EXCP0A_TSS
, selector
& 0xfffc, retaddr
);
208 /* if data or non conforming code, checks the rights */
209 if (((e2
>> DESC_TYPE_SHIFT
) & 0xf) < 12) {
210 if (dpl
< cpl
|| dpl
< rpl
) {
211 raise_exception_err_ra(env
, EXCP0A_TSS
, selector
& 0xfffc, retaddr
);
215 if (!(e2
& DESC_P_MASK
)) {
216 raise_exception_err_ra(env
, EXCP0B_NOSEG
, selector
& 0xfffc, retaddr
);
218 cpu_x86_load_seg_cache(env
, seg_reg
, selector
,
219 get_seg_base(e1
, e2
),
220 get_seg_limit(e1
, e2
),
223 if (seg_reg
== R_SS
|| seg_reg
== R_CS
) {
224 raise_exception_err_ra(env
, EXCP0A_TSS
, selector
& 0xfffc, retaddr
);
229 static void tss_set_busy(CPUX86State
*env
, int tss_selector
, bool value
,
232 target_ulong ptr
= env
->gdt
.base
+ (env
->tr
.selector
& ~7);
233 uint32_t e2
= cpu_ldl_kernel_ra(env
, ptr
+ 4, retaddr
);
236 e2
|= DESC_TSS_BUSY_MASK
;
238 e2
&= ~DESC_TSS_BUSY_MASK
;
241 cpu_stl_kernel_ra(env
, ptr
+ 4, e2
, retaddr
);
244 #define SWITCH_TSS_JMP 0
245 #define SWITCH_TSS_IRET 1
246 #define SWITCH_TSS_CALL 2
248 /* XXX: restore CPU state in registers (PowerPC case) */
249 static void switch_tss_ra(CPUX86State
*env
, int tss_selector
,
250 uint32_t e1
, uint32_t e2
, int source
,
251 uint32_t next_eip
, uintptr_t retaddr
)
253 int tss_limit
, tss_limit_max
, type
, old_tss_limit_max
, old_type
, v1
, v2
, i
;
254 target_ulong tss_base
;
255 uint32_t new_regs
[8], new_segs
[6];
256 uint32_t new_eflags
, new_eip
, new_cr3
, new_ldt
, new_trap
;
257 uint32_t old_eflags
, eflags_mask
;
262 type
= (e2
>> DESC_TYPE_SHIFT
) & 0xf;
263 LOG_PCALL("switch_tss: sel=0x%04x type=%d src=%d\n", tss_selector
, type
,
266 /* if task gate, we read the TSS segment and we load it */
268 if (!(e2
& DESC_P_MASK
)) {
269 raise_exception_err_ra(env
, EXCP0B_NOSEG
, tss_selector
& 0xfffc, retaddr
);
271 tss_selector
= e1
>> 16;
272 if (tss_selector
& 4) {
273 raise_exception_err_ra(env
, EXCP0A_TSS
, tss_selector
& 0xfffc, retaddr
);
275 if (load_segment_ra(env
, &e1
, &e2
, tss_selector
, retaddr
) != 0) {
276 raise_exception_err_ra(env
, EXCP0D_GPF
, tss_selector
& 0xfffc, retaddr
);
278 if (e2
& DESC_S_MASK
) {
279 raise_exception_err_ra(env
, EXCP0D_GPF
, tss_selector
& 0xfffc, retaddr
);
281 type
= (e2
>> DESC_TYPE_SHIFT
) & 0xf;
282 if ((type
& 7) != 1) {
283 raise_exception_err_ra(env
, EXCP0D_GPF
, tss_selector
& 0xfffc, retaddr
);
287 if (!(e2
& DESC_P_MASK
)) {
288 raise_exception_err_ra(env
, EXCP0B_NOSEG
, tss_selector
& 0xfffc, retaddr
);
296 tss_limit
= get_seg_limit(e1
, e2
);
297 tss_base
= get_seg_base(e1
, e2
);
298 if ((tss_selector
& 4) != 0 ||
299 tss_limit
< tss_limit_max
) {
300 raise_exception_err_ra(env
, EXCP0A_TSS
, tss_selector
& 0xfffc, retaddr
);
302 old_type
= (env
->tr
.flags
>> DESC_TYPE_SHIFT
) & 0xf;
304 old_tss_limit_max
= 103;
306 old_tss_limit_max
= 43;
309 /* read all the registers from the new TSS */
312 new_cr3
= cpu_ldl_kernel_ra(env
, tss_base
+ 0x1c, retaddr
);
313 new_eip
= cpu_ldl_kernel_ra(env
, tss_base
+ 0x20, retaddr
);
314 new_eflags
= cpu_ldl_kernel_ra(env
, tss_base
+ 0x24, retaddr
);
315 for (i
= 0; i
< 8; i
++) {
316 new_regs
[i
] = cpu_ldl_kernel_ra(env
, tss_base
+ (0x28 + i
* 4),
319 for (i
= 0; i
< 6; i
++) {
320 new_segs
[i
] = cpu_lduw_kernel_ra(env
, tss_base
+ (0x48 + i
* 4),
323 new_ldt
= cpu_lduw_kernel_ra(env
, tss_base
+ 0x60, retaddr
);
324 new_trap
= cpu_ldl_kernel_ra(env
, tss_base
+ 0x64, retaddr
);
328 new_eip
= cpu_lduw_kernel_ra(env
, tss_base
+ 0x0e, retaddr
);
329 new_eflags
= cpu_lduw_kernel_ra(env
, tss_base
+ 0x10, retaddr
);
330 for (i
= 0; i
< 8; i
++) {
331 new_regs
[i
] = cpu_lduw_kernel_ra(env
, tss_base
+ (0x12 + i
* 2), retaddr
);
333 for (i
= 0; i
< 4; i
++) {
334 new_segs
[i
] = cpu_lduw_kernel_ra(env
, tss_base
+ (0x22 + i
* 2),
337 new_ldt
= cpu_lduw_kernel_ra(env
, tss_base
+ 0x2a, retaddr
);
342 /* XXX: avoid a compiler warning, see
343 http://support.amd.com/us/Processor_TechDocs/24593.pdf
344 chapters 12.2.5 and 13.2.4 on how to implement TSS Trap bit */
347 /* NOTE: we must avoid memory exceptions during the task switch,
348 so we make dummy accesses before */
349 /* XXX: it can still fail in some cases, so a bigger hack is
350 necessary to valid the TLB after having done the accesses */
352 v1
= cpu_ldub_kernel_ra(env
, env
->tr
.base
, retaddr
);
353 v2
= cpu_ldub_kernel_ra(env
, env
->tr
.base
+ old_tss_limit_max
, retaddr
);
354 cpu_stb_kernel_ra(env
, env
->tr
.base
, v1
, retaddr
);
355 cpu_stb_kernel_ra(env
, env
->tr
.base
+ old_tss_limit_max
, v2
, retaddr
);
357 /* clear busy bit (it is restartable) */
358 if (source
== SWITCH_TSS_JMP
|| source
== SWITCH_TSS_IRET
) {
359 tss_set_busy(env
, env
->tr
.selector
, 0, retaddr
);
361 old_eflags
= cpu_compute_eflags(env
);
362 if (source
== SWITCH_TSS_IRET
) {
363 old_eflags
&= ~NT_MASK
;
366 /* save the current state in the old TSS */
369 cpu_stl_kernel_ra(env
, env
->tr
.base
+ 0x20, next_eip
, retaddr
);
370 cpu_stl_kernel_ra(env
, env
->tr
.base
+ 0x24, old_eflags
, retaddr
);
371 cpu_stl_kernel_ra(env
, env
->tr
.base
+ (0x28 + 0 * 4), env
->regs
[R_EAX
], retaddr
);
372 cpu_stl_kernel_ra(env
, env
->tr
.base
+ (0x28 + 1 * 4), env
->regs
[R_ECX
], retaddr
);
373 cpu_stl_kernel_ra(env
, env
->tr
.base
+ (0x28 + 2 * 4), env
->regs
[R_EDX
], retaddr
);
374 cpu_stl_kernel_ra(env
, env
->tr
.base
+ (0x28 + 3 * 4), env
->regs
[R_EBX
], retaddr
);
375 cpu_stl_kernel_ra(env
, env
->tr
.base
+ (0x28 + 4 * 4), env
->regs
[R_ESP
], retaddr
);
376 cpu_stl_kernel_ra(env
, env
->tr
.base
+ (0x28 + 5 * 4), env
->regs
[R_EBP
], retaddr
);
377 cpu_stl_kernel_ra(env
, env
->tr
.base
+ (0x28 + 6 * 4), env
->regs
[R_ESI
], retaddr
);
378 cpu_stl_kernel_ra(env
, env
->tr
.base
+ (0x28 + 7 * 4), env
->regs
[R_EDI
], retaddr
);
379 for (i
= 0; i
< 6; i
++) {
380 cpu_stw_kernel_ra(env
, env
->tr
.base
+ (0x48 + i
* 4),
381 env
->segs
[i
].selector
, retaddr
);
385 cpu_stw_kernel_ra(env
, env
->tr
.base
+ 0x0e, next_eip
, retaddr
);
386 cpu_stw_kernel_ra(env
, env
->tr
.base
+ 0x10, old_eflags
, retaddr
);
387 cpu_stw_kernel_ra(env
, env
->tr
.base
+ (0x12 + 0 * 2), env
->regs
[R_EAX
], retaddr
);
388 cpu_stw_kernel_ra(env
, env
->tr
.base
+ (0x12 + 1 * 2), env
->regs
[R_ECX
], retaddr
);
389 cpu_stw_kernel_ra(env
, env
->tr
.base
+ (0x12 + 2 * 2), env
->regs
[R_EDX
], retaddr
);
390 cpu_stw_kernel_ra(env
, env
->tr
.base
+ (0x12 + 3 * 2), env
->regs
[R_EBX
], retaddr
);
391 cpu_stw_kernel_ra(env
, env
->tr
.base
+ (0x12 + 4 * 2), env
->regs
[R_ESP
], retaddr
);
392 cpu_stw_kernel_ra(env
, env
->tr
.base
+ (0x12 + 5 * 2), env
->regs
[R_EBP
], retaddr
);
393 cpu_stw_kernel_ra(env
, env
->tr
.base
+ (0x12 + 6 * 2), env
->regs
[R_ESI
], retaddr
);
394 cpu_stw_kernel_ra(env
, env
->tr
.base
+ (0x12 + 7 * 2), env
->regs
[R_EDI
], retaddr
);
395 for (i
= 0; i
< 4; i
++) {
396 cpu_stw_kernel_ra(env
, env
->tr
.base
+ (0x22 + i
* 2),
397 env
->segs
[i
].selector
, retaddr
);
401 /* now if an exception occurs, it will occurs in the next task
404 if (source
== SWITCH_TSS_CALL
) {
405 cpu_stw_kernel_ra(env
, tss_base
, env
->tr
.selector
, retaddr
);
406 new_eflags
|= NT_MASK
;
410 if (source
== SWITCH_TSS_JMP
|| source
== SWITCH_TSS_CALL
) {
411 tss_set_busy(env
, tss_selector
, 1, retaddr
);
414 /* set the new CPU state */
415 /* from this point, any exception which occurs can give problems */
416 env
->cr
[0] |= CR0_TS_MASK
;
417 env
->hflags
|= HF_TS_MASK
;
418 env
->tr
.selector
= tss_selector
;
419 env
->tr
.base
= tss_base
;
420 env
->tr
.limit
= tss_limit
;
421 env
->tr
.flags
= e2
& ~DESC_TSS_BUSY_MASK
;
423 if ((type
& 8) && (env
->cr
[0] & CR0_PG_MASK
)) {
424 cpu_x86_update_cr3(env
, new_cr3
);
427 /* load all registers without an exception, then reload them with
428 possible exception */
430 eflags_mask
= TF_MASK
| AC_MASK
| ID_MASK
|
431 IF_MASK
| IOPL_MASK
| VM_MASK
| RF_MASK
| NT_MASK
;
433 cpu_load_eflags(env
, new_eflags
, eflags_mask
);
434 for (i
= 0; i
< 8; i
++) {
435 env
->regs
[i
] = new_regs
[i
];
438 cpu_load_eflags(env
, new_eflags
, eflags_mask
& 0xffff);
439 for (i
= 0; i
< 8; i
++) {
440 env
->regs
[i
] = (env
->regs
[i
] & 0xffff0000) | new_regs
[i
];
443 if (new_eflags
& VM_MASK
) {
444 for (i
= 0; i
< 6; i
++) {
445 load_seg_vm(env
, i
, new_segs
[i
]);
448 /* first just selectors as the rest may trigger exceptions */
449 for (i
= 0; i
< 6; i
++) {
450 cpu_x86_load_seg_cache(env
, i
, new_segs
[i
], 0, 0, 0);
454 env
->ldt
.selector
= new_ldt
& ~4;
461 raise_exception_err_ra(env
, EXCP0A_TSS
, new_ldt
& 0xfffc, retaddr
);
464 if ((new_ldt
& 0xfffc) != 0) {
466 index
= new_ldt
& ~7;
467 if ((index
+ 7) > dt
->limit
) {
468 raise_exception_err_ra(env
, EXCP0A_TSS
, new_ldt
& 0xfffc, retaddr
);
470 ptr
= dt
->base
+ index
;
471 e1
= cpu_ldl_kernel_ra(env
, ptr
, retaddr
);
472 e2
= cpu_ldl_kernel_ra(env
, ptr
+ 4, retaddr
);
473 if ((e2
& DESC_S_MASK
) || ((e2
>> DESC_TYPE_SHIFT
) & 0xf) != 2) {
474 raise_exception_err_ra(env
, EXCP0A_TSS
, new_ldt
& 0xfffc, retaddr
);
476 if (!(e2
& DESC_P_MASK
)) {
477 raise_exception_err_ra(env
, EXCP0A_TSS
, new_ldt
& 0xfffc, retaddr
);
479 load_seg_cache_raw_dt(&env
->ldt
, e1
, e2
);
482 /* load the segments */
483 if (!(new_eflags
& VM_MASK
)) {
484 int cpl
= new_segs
[R_CS
] & 3;
485 tss_load_seg(env
, R_CS
, new_segs
[R_CS
], cpl
, retaddr
);
486 tss_load_seg(env
, R_SS
, new_segs
[R_SS
], cpl
, retaddr
);
487 tss_load_seg(env
, R_ES
, new_segs
[R_ES
], cpl
, retaddr
);
488 tss_load_seg(env
, R_DS
, new_segs
[R_DS
], cpl
, retaddr
);
489 tss_load_seg(env
, R_FS
, new_segs
[R_FS
], cpl
, retaddr
);
490 tss_load_seg(env
, R_GS
, new_segs
[R_GS
], cpl
, retaddr
);
493 /* check that env->eip is in the CS segment limits */
494 if (new_eip
> env
->segs
[R_CS
].limit
) {
495 /* XXX: different exception if CALL? */
496 raise_exception_err_ra(env
, EXCP0D_GPF
, 0, retaddr
);
499 #ifndef CONFIG_USER_ONLY
500 /* reset local breakpoints */
501 if (env
->dr
[7] & DR7_LOCAL_BP_MASK
) {
502 cpu_x86_update_dr7(env
, env
->dr
[7] & ~DR7_LOCAL_BP_MASK
);
507 static void switch_tss(CPUX86State
*env
, int tss_selector
,
508 uint32_t e1
, uint32_t e2
, int source
,
511 switch_tss_ra(env
, tss_selector
, e1
, e2
, source
, next_eip
, 0);
514 static inline unsigned int get_sp_mask(unsigned int e2
)
517 if (e2
& DESC_L_MASK
) {
521 if (e2
& DESC_B_MASK
) {
528 int exception_has_error_code(int intno
)
544 #define SET_ESP(val, sp_mask) \
546 if ((sp_mask) == 0xffff) { \
547 env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | \
549 } else if ((sp_mask) == 0xffffffffLL) { \
550 env->regs[R_ESP] = (uint32_t)(val); \
552 env->regs[R_ESP] = (val); \
556 #define SET_ESP(val, sp_mask) \
558 env->regs[R_ESP] = (env->regs[R_ESP] & ~(sp_mask)) | \
559 ((val) & (sp_mask)); \
563 /* in 64-bit machines, this can overflow. So this segment addition macro
564 * can be used to trim the value to 32-bit whenever needed */
565 #define SEG_ADDL(ssp, sp, sp_mask) ((uint32_t)((ssp) + (sp & (sp_mask))))
567 /* XXX: add a is_user flag to have proper security support */
568 #define PUSHW_RA(ssp, sp, sp_mask, val, ra) \
571 cpu_stw_kernel_ra(env, (ssp) + (sp & (sp_mask)), (val), ra); \
574 #define PUSHL_RA(ssp, sp, sp_mask, val, ra) \
577 cpu_stl_kernel_ra(env, SEG_ADDL(ssp, sp, sp_mask), (uint32_t)(val), ra); \
580 #define POPW_RA(ssp, sp, sp_mask, val, ra) \
582 val = cpu_lduw_kernel_ra(env, (ssp) + (sp & (sp_mask)), ra); \
586 #define POPL_RA(ssp, sp, sp_mask, val, ra) \
588 val = (uint32_t)cpu_ldl_kernel_ra(env, SEG_ADDL(ssp, sp, sp_mask), ra); \
592 #define PUSHW(ssp, sp, sp_mask, val) PUSHW_RA(ssp, sp, sp_mask, val, 0)
593 #define PUSHL(ssp, sp, sp_mask, val) PUSHL_RA(ssp, sp, sp_mask, val, 0)
594 #define POPW(ssp, sp, sp_mask, val) POPW_RA(ssp, sp, sp_mask, val, 0)
595 #define POPL(ssp, sp, sp_mask, val) POPL_RA(ssp, sp, sp_mask, val, 0)
597 /* protected mode interrupt */
598 static void do_interrupt_protected(CPUX86State
*env
, int intno
, int is_int
,
599 int error_code
, unsigned int next_eip
,
603 target_ulong ptr
, ssp
;
604 int type
, dpl
, selector
, ss_dpl
, cpl
;
605 int has_error_code
, new_stack
, shift
;
606 uint32_t e1
, e2
, offset
, ss
= 0, esp
, ss_e1
= 0, ss_e2
= 0;
607 uint32_t old_eip
, sp_mask
;
608 int vm86
= env
->eflags
& VM_MASK
;
611 if (!is_int
&& !is_hw
) {
612 has_error_code
= exception_has_error_code(intno
);
621 if (intno
* 8 + 7 > dt
->limit
) {
622 raise_exception_err(env
, EXCP0D_GPF
, intno
* 8 + 2);
624 ptr
= dt
->base
+ intno
* 8;
625 e1
= cpu_ldl_kernel(env
, ptr
);
626 e2
= cpu_ldl_kernel(env
, ptr
+ 4);
627 /* check gate type */
628 type
= (e2
>> DESC_TYPE_SHIFT
) & 0x1f;
630 case 5: /* task gate */
631 case 6: /* 286 interrupt gate */
632 case 7: /* 286 trap gate */
633 case 14: /* 386 interrupt gate */
634 case 15: /* 386 trap gate */
637 raise_exception_err(env
, EXCP0D_GPF
, intno
* 8 + 2);
640 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
641 cpl
= env
->hflags
& HF_CPL_MASK
;
642 /* check privilege if software int */
643 if (is_int
&& dpl
< cpl
) {
644 raise_exception_err(env
, EXCP0D_GPF
, intno
* 8 + 2);
649 /* must do that check here to return the correct error code */
650 if (!(e2
& DESC_P_MASK
)) {
651 raise_exception_err(env
, EXCP0B_NOSEG
, intno
* 8 + 2);
653 switch_tss(env
, intno
* 8, e1
, e2
, SWITCH_TSS_CALL
, old_eip
);
654 if (has_error_code
) {
658 /* push the error code */
659 type
= (env
->tr
.flags
>> DESC_TYPE_SHIFT
) & 0xf;
661 if (env
->segs
[R_SS
].flags
& DESC_B_MASK
) {
666 esp
= (env
->regs
[R_ESP
] - (2 << shift
)) & mask
;
667 ssp
= env
->segs
[R_SS
].base
+ esp
;
669 cpu_stl_kernel(env
, ssp
, error_code
);
671 cpu_stw_kernel(env
, ssp
, error_code
);
678 /* Otherwise, trap or interrupt gate */
680 /* check valid bit */
681 if (!(e2
& DESC_P_MASK
)) {
682 raise_exception_err(env
, EXCP0B_NOSEG
, intno
* 8 + 2);
685 offset
= (e2
& 0xffff0000) | (e1
& 0x0000ffff);
686 if ((selector
& 0xfffc) == 0) {
687 raise_exception_err(env
, EXCP0D_GPF
, 0);
689 if (load_segment(env
, &e1
, &e2
, selector
) != 0) {
690 raise_exception_err(env
, EXCP0D_GPF
, selector
& 0xfffc);
692 if (!(e2
& DESC_S_MASK
) || !(e2
& (DESC_CS_MASK
))) {
693 raise_exception_err(env
, EXCP0D_GPF
, selector
& 0xfffc);
695 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
697 raise_exception_err(env
, EXCP0D_GPF
, selector
& 0xfffc);
699 if (!(e2
& DESC_P_MASK
)) {
700 raise_exception_err(env
, EXCP0B_NOSEG
, selector
& 0xfffc);
702 if (e2
& DESC_C_MASK
) {
706 /* to inner privilege */
707 get_ss_esp_from_tss(env
, &ss
, &esp
, dpl
, 0);
708 if ((ss
& 0xfffc) == 0) {
709 raise_exception_err(env
, EXCP0A_TSS
, ss
& 0xfffc);
711 if ((ss
& 3) != dpl
) {
712 raise_exception_err(env
, EXCP0A_TSS
, ss
& 0xfffc);
714 if (load_segment(env
, &ss_e1
, &ss_e2
, ss
) != 0) {
715 raise_exception_err(env
, EXCP0A_TSS
, ss
& 0xfffc);
717 ss_dpl
= (ss_e2
>> DESC_DPL_SHIFT
) & 3;
719 raise_exception_err(env
, EXCP0A_TSS
, ss
& 0xfffc);
721 if (!(ss_e2
& DESC_S_MASK
) ||
722 (ss_e2
& DESC_CS_MASK
) ||
723 !(ss_e2
& DESC_W_MASK
)) {
724 raise_exception_err(env
, EXCP0A_TSS
, ss
& 0xfffc);
726 if (!(ss_e2
& DESC_P_MASK
)) {
727 raise_exception_err(env
, EXCP0A_TSS
, ss
& 0xfffc);
730 sp_mask
= get_sp_mask(ss_e2
);
731 ssp
= get_seg_base(ss_e1
, ss_e2
);
733 /* to same privilege */
735 raise_exception_err(env
, EXCP0D_GPF
, selector
& 0xfffc);
738 sp_mask
= get_sp_mask(env
->segs
[R_SS
].flags
);
739 ssp
= env
->segs
[R_SS
].base
;
740 esp
= env
->regs
[R_ESP
];
746 /* XXX: check that enough room is available */
747 push_size
= 6 + (new_stack
<< 2) + (has_error_code
<< 1);
756 PUSHL(ssp
, esp
, sp_mask
, env
->segs
[R_GS
].selector
);
757 PUSHL(ssp
, esp
, sp_mask
, env
->segs
[R_FS
].selector
);
758 PUSHL(ssp
, esp
, sp_mask
, env
->segs
[R_DS
].selector
);
759 PUSHL(ssp
, esp
, sp_mask
, env
->segs
[R_ES
].selector
);
761 PUSHL(ssp
, esp
, sp_mask
, env
->segs
[R_SS
].selector
);
762 PUSHL(ssp
, esp
, sp_mask
, env
->regs
[R_ESP
]);
764 PUSHL(ssp
, esp
, sp_mask
, cpu_compute_eflags(env
));
765 PUSHL(ssp
, esp
, sp_mask
, env
->segs
[R_CS
].selector
);
766 PUSHL(ssp
, esp
, sp_mask
, old_eip
);
767 if (has_error_code
) {
768 PUSHL(ssp
, esp
, sp_mask
, error_code
);
773 PUSHW(ssp
, esp
, sp_mask
, env
->segs
[R_GS
].selector
);
774 PUSHW(ssp
, esp
, sp_mask
, env
->segs
[R_FS
].selector
);
775 PUSHW(ssp
, esp
, sp_mask
, env
->segs
[R_DS
].selector
);
776 PUSHW(ssp
, esp
, sp_mask
, env
->segs
[R_ES
].selector
);
778 PUSHW(ssp
, esp
, sp_mask
, env
->segs
[R_SS
].selector
);
779 PUSHW(ssp
, esp
, sp_mask
, env
->regs
[R_ESP
]);
781 PUSHW(ssp
, esp
, sp_mask
, cpu_compute_eflags(env
));
782 PUSHW(ssp
, esp
, sp_mask
, env
->segs
[R_CS
].selector
);
783 PUSHW(ssp
, esp
, sp_mask
, old_eip
);
784 if (has_error_code
) {
785 PUSHW(ssp
, esp
, sp_mask
, error_code
);
789 /* interrupt gate clear IF mask */
790 if ((type
& 1) == 0) {
791 env
->eflags
&= ~IF_MASK
;
793 env
->eflags
&= ~(TF_MASK
| VM_MASK
| RF_MASK
| NT_MASK
);
797 cpu_x86_load_seg_cache(env
, R_ES
, 0, 0, 0, 0);
798 cpu_x86_load_seg_cache(env
, R_DS
, 0, 0, 0, 0);
799 cpu_x86_load_seg_cache(env
, R_FS
, 0, 0, 0, 0);
800 cpu_x86_load_seg_cache(env
, R_GS
, 0, 0, 0, 0);
802 ss
= (ss
& ~3) | dpl
;
803 cpu_x86_load_seg_cache(env
, R_SS
, ss
,
804 ssp
, get_seg_limit(ss_e1
, ss_e2
), ss_e2
);
806 SET_ESP(esp
, sp_mask
);
808 selector
= (selector
& ~3) | dpl
;
809 cpu_x86_load_seg_cache(env
, R_CS
, selector
,
810 get_seg_base(e1
, e2
),
811 get_seg_limit(e1
, e2
),
818 #define PUSHQ_RA(sp, val, ra) \
821 cpu_stq_kernel_ra(env, sp, (val), ra); \
824 #define POPQ_RA(sp, val, ra) \
826 val = cpu_ldq_kernel_ra(env, sp, ra); \
830 #define PUSHQ(sp, val) PUSHQ_RA(sp, val, 0)
831 #define POPQ(sp, val) POPQ_RA(sp, val, 0)
833 static inline target_ulong
get_rsp_from_tss(CPUX86State
*env
, int level
)
835 X86CPU
*cpu
= env_archcpu(env
);
841 printf("TR: base=" TARGET_FMT_lx
" limit=%x\n",
842 env
->tr
.base
, env
->tr
.limit
);
845 if (!(env
->tr
.flags
& DESC_P_MASK
)) {
846 cpu_abort(CPU(cpu
), "invalid tss");
848 index
= 8 * level
+ 4;
849 if ((index
+ 7) > env
->tr
.limit
) {
850 raise_exception_err(env
, EXCP0A_TSS
, env
->tr
.selector
& 0xfffc);
853 rsp
= cpu_ldq_kernel(env
, env
->tr
.base
+ index
);
855 /* test virtual address sign extension */
856 pg_mode
= get_pg_mode(env
);
857 sext
= (int64_t)rsp
>> (pg_mode
& PG_MODE_LA57
? 56 : 47);
858 if (sext
!= 0 && sext
!= -1) {
859 raise_exception_err(env
, EXCP0C_STACK
, 0);
865 /* 64 bit interrupt */
866 static void do_interrupt64(CPUX86State
*env
, int intno
, int is_int
,
867 int error_code
, target_ulong next_eip
, int is_hw
)
871 int type
, dpl
, selector
, cpl
, ist
;
872 int has_error_code
, new_stack
;
873 uint32_t e1
, e2
, e3
, ss
;
874 target_ulong old_eip
, esp
, offset
;
877 if (!is_int
&& !is_hw
) {
878 has_error_code
= exception_has_error_code(intno
);
887 if (intno
* 16 + 15 > dt
->limit
) {
888 raise_exception_err(env
, EXCP0D_GPF
, intno
* 8 + 2);
890 ptr
= dt
->base
+ intno
* 16;
891 e1
= cpu_ldl_kernel(env
, ptr
);
892 e2
= cpu_ldl_kernel(env
, ptr
+ 4);
893 e3
= cpu_ldl_kernel(env
, ptr
+ 8);
894 /* check gate type */
895 type
= (e2
>> DESC_TYPE_SHIFT
) & 0x1f;
897 case 14: /* 386 interrupt gate */
898 case 15: /* 386 trap gate */
901 raise_exception_err(env
, EXCP0D_GPF
, intno
* 8 + 2);
904 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
905 cpl
= env
->hflags
& HF_CPL_MASK
;
906 /* check privilege if software int */
907 if (is_int
&& dpl
< cpl
) {
908 raise_exception_err(env
, EXCP0D_GPF
, intno
* 8 + 2);
910 /* check valid bit */
911 if (!(e2
& DESC_P_MASK
)) {
912 raise_exception_err(env
, EXCP0B_NOSEG
, intno
* 8 + 2);
915 offset
= ((target_ulong
)e3
<< 32) | (e2
& 0xffff0000) | (e1
& 0x0000ffff);
917 if ((selector
& 0xfffc) == 0) {
918 raise_exception_err(env
, EXCP0D_GPF
, 0);
921 if (load_segment(env
, &e1
, &e2
, selector
) != 0) {
922 raise_exception_err(env
, EXCP0D_GPF
, selector
& 0xfffc);
924 if (!(e2
& DESC_S_MASK
) || !(e2
& (DESC_CS_MASK
))) {
925 raise_exception_err(env
, EXCP0D_GPF
, selector
& 0xfffc);
927 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
929 raise_exception_err(env
, EXCP0D_GPF
, selector
& 0xfffc);
931 if (!(e2
& DESC_P_MASK
)) {
932 raise_exception_err(env
, EXCP0B_NOSEG
, selector
& 0xfffc);
934 if (!(e2
& DESC_L_MASK
) || (e2
& DESC_B_MASK
)) {
935 raise_exception_err(env
, EXCP0D_GPF
, selector
& 0xfffc);
937 if (e2
& DESC_C_MASK
) {
940 if (dpl
< cpl
|| ist
!= 0) {
941 /* to inner privilege */
943 esp
= get_rsp_from_tss(env
, ist
!= 0 ? ist
+ 3 : dpl
);
946 /* to same privilege */
947 if (env
->eflags
& VM_MASK
) {
948 raise_exception_err(env
, EXCP0D_GPF
, selector
& 0xfffc);
951 esp
= env
->regs
[R_ESP
];
953 esp
&= ~0xfLL
; /* align stack */
955 PUSHQ(esp
, env
->segs
[R_SS
].selector
);
956 PUSHQ(esp
, env
->regs
[R_ESP
]);
957 PUSHQ(esp
, cpu_compute_eflags(env
));
958 PUSHQ(esp
, env
->segs
[R_CS
].selector
);
960 if (has_error_code
) {
961 PUSHQ(esp
, error_code
);
964 /* interrupt gate clear IF mask */
965 if ((type
& 1) == 0) {
966 env
->eflags
&= ~IF_MASK
;
968 env
->eflags
&= ~(TF_MASK
| VM_MASK
| RF_MASK
| NT_MASK
);
972 cpu_x86_load_seg_cache(env
, R_SS
, ss
, 0, 0, dpl
<< DESC_DPL_SHIFT
);
974 env
->regs
[R_ESP
] = esp
;
976 selector
= (selector
& ~3) | dpl
;
977 cpu_x86_load_seg_cache(env
, R_CS
, selector
,
978 get_seg_base(e1
, e2
),
979 get_seg_limit(e1
, e2
),
983 #endif /* TARGET_X86_64 */
985 void helper_sysret(CPUX86State
*env
, int dflag
)
989 if (!(env
->efer
& MSR_EFER_SCE
)) {
990 raise_exception_err_ra(env
, EXCP06_ILLOP
, 0, GETPC());
992 cpl
= env
->hflags
& HF_CPL_MASK
;
993 if (!(env
->cr
[0] & CR0_PE_MASK
) || cpl
!= 0) {
994 raise_exception_err_ra(env
, EXCP0D_GPF
, 0, GETPC());
996 selector
= (env
->star
>> 48) & 0xffff;
998 if (env
->hflags
& HF_LMA_MASK
) {
999 cpu_load_eflags(env
, (uint32_t)(env
->regs
[11]), TF_MASK
| AC_MASK
1000 | ID_MASK
| IF_MASK
| IOPL_MASK
| VM_MASK
| RF_MASK
|
1003 cpu_x86_load_seg_cache(env
, R_CS
, (selector
+ 16) | 3,
1005 DESC_G_MASK
| DESC_P_MASK
|
1006 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
1007 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
|
1009 env
->eip
= env
->regs
[R_ECX
];
1011 cpu_x86_load_seg_cache(env
, R_CS
, selector
| 3,
1013 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
1014 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
1015 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
);
1016 env
->eip
= (uint32_t)env
->regs
[R_ECX
];
1018 cpu_x86_load_seg_cache(env
, R_SS
, (selector
+ 8) | 3,
1020 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
1021 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
1022 DESC_W_MASK
| DESC_A_MASK
);
1026 env
->eflags
|= IF_MASK
;
1027 cpu_x86_load_seg_cache(env
, R_CS
, selector
| 3,
1029 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
1030 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
1031 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
);
1032 env
->eip
= (uint32_t)env
->regs
[R_ECX
];
1033 cpu_x86_load_seg_cache(env
, R_SS
, (selector
+ 8) | 3,
1035 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
1036 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
1037 DESC_W_MASK
| DESC_A_MASK
);
1041 /* real mode interrupt */
1042 static void do_interrupt_real(CPUX86State
*env
, int intno
, int is_int
,
1043 int error_code
, unsigned int next_eip
)
1046 target_ulong ptr
, ssp
;
1048 uint32_t offset
, esp
;
1049 uint32_t old_cs
, old_eip
;
1051 /* real mode (simpler!) */
1053 if (intno
* 4 + 3 > dt
->limit
) {
1054 raise_exception_err(env
, EXCP0D_GPF
, intno
* 8 + 2);
1056 ptr
= dt
->base
+ intno
* 4;
1057 offset
= cpu_lduw_kernel(env
, ptr
);
1058 selector
= cpu_lduw_kernel(env
, ptr
+ 2);
1059 esp
= env
->regs
[R_ESP
];
1060 ssp
= env
->segs
[R_SS
].base
;
1066 old_cs
= env
->segs
[R_CS
].selector
;
1067 /* XXX: use SS segment size? */
1068 PUSHW(ssp
, esp
, 0xffff, cpu_compute_eflags(env
));
1069 PUSHW(ssp
, esp
, 0xffff, old_cs
);
1070 PUSHW(ssp
, esp
, 0xffff, old_eip
);
1072 /* update processor state */
1073 env
->regs
[R_ESP
] = (env
->regs
[R_ESP
] & ~0xffff) | (esp
& 0xffff);
1075 env
->segs
[R_CS
].selector
= selector
;
1076 env
->segs
[R_CS
].base
= (selector
<< 4);
1077 env
->eflags
&= ~(IF_MASK
| TF_MASK
| AC_MASK
| RF_MASK
);
1081 * Begin execution of an interruption. is_int is TRUE if coming from
1082 * the int instruction. next_eip is the env->eip value AFTER the interrupt
1083 * instruction. It is only relevant if is_int is TRUE.
1085 void do_interrupt_all(X86CPU
*cpu
, int intno
, int is_int
,
1086 int error_code
, target_ulong next_eip
, int is_hw
)
1088 CPUX86State
*env
= &cpu
->env
;
1090 if (qemu_loglevel_mask(CPU_LOG_INT
)) {
1091 if ((env
->cr
[0] & CR0_PE_MASK
)) {
1094 qemu_log("%6d: v=%02x e=%04x i=%d cpl=%d IP=%04x:" TARGET_FMT_lx
1095 " pc=" TARGET_FMT_lx
" SP=%04x:" TARGET_FMT_lx
,
1096 count
, intno
, error_code
, is_int
,
1097 env
->hflags
& HF_CPL_MASK
,
1098 env
->segs
[R_CS
].selector
, env
->eip
,
1099 (int)env
->segs
[R_CS
].base
+ env
->eip
,
1100 env
->segs
[R_SS
].selector
, env
->regs
[R_ESP
]);
1101 if (intno
== 0x0e) {
1102 qemu_log(" CR2=" TARGET_FMT_lx
, env
->cr
[2]);
1104 qemu_log(" env->regs[R_EAX]=" TARGET_FMT_lx
, env
->regs
[R_EAX
]);
1107 log_cpu_state(CPU(cpu
), CPU_DUMP_CCOP
);
1114 ptr
= env
->segs
[R_CS
].base
+ env
->eip
;
1115 for (i
= 0; i
< 16; i
++) {
1116 qemu_log(" %02x", ldub(ptr
+ i
));
1124 if (env
->cr
[0] & CR0_PE_MASK
) {
1125 #if !defined(CONFIG_USER_ONLY)
1126 if (env
->hflags
& HF_GUEST_MASK
) {
1127 handle_even_inj(env
, intno
, is_int
, error_code
, is_hw
, 0);
1130 #ifdef TARGET_X86_64
1131 if (env
->hflags
& HF_LMA_MASK
) {
1132 do_interrupt64(env
, intno
, is_int
, error_code
, next_eip
, is_hw
);
1136 do_interrupt_protected(env
, intno
, is_int
, error_code
, next_eip
,
1140 #if !defined(CONFIG_USER_ONLY)
1141 if (env
->hflags
& HF_GUEST_MASK
) {
1142 handle_even_inj(env
, intno
, is_int
, error_code
, is_hw
, 1);
1145 do_interrupt_real(env
, intno
, is_int
, error_code
, next_eip
);
1148 #if !defined(CONFIG_USER_ONLY)
1149 if (env
->hflags
& HF_GUEST_MASK
) {
1150 CPUState
*cs
= CPU(cpu
);
1151 uint32_t event_inj
= x86_ldl_phys(cs
, env
->vm_vmcb
+
1152 offsetof(struct vmcb
,
1153 control
.event_inj
));
1156 env
->vm_vmcb
+ offsetof(struct vmcb
, control
.event_inj
),
1157 event_inj
& ~SVM_EVTINJ_VALID
);
1162 void do_interrupt_x86_hardirq(CPUX86State
*env
, int intno
, int is_hw
)
1164 do_interrupt_all(env_archcpu(env
), intno
, 0, 0, 0, is_hw
);
1167 void helper_lldt(CPUX86State
*env
, int selector
)
1171 int index
, entry_limit
;
1175 if ((selector
& 0xfffc) == 0) {
1176 /* XXX: NULL selector case: invalid LDT */
1180 if (selector
& 0x4) {
1181 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1184 index
= selector
& ~7;
1185 #ifdef TARGET_X86_64
1186 if (env
->hflags
& HF_LMA_MASK
) {
1193 if ((index
+ entry_limit
) > dt
->limit
) {
1194 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1196 ptr
= dt
->base
+ index
;
1197 e1
= cpu_ldl_kernel_ra(env
, ptr
, GETPC());
1198 e2
= cpu_ldl_kernel_ra(env
, ptr
+ 4, GETPC());
1199 if ((e2
& DESC_S_MASK
) || ((e2
>> DESC_TYPE_SHIFT
) & 0xf) != 2) {
1200 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1202 if (!(e2
& DESC_P_MASK
)) {
1203 raise_exception_err_ra(env
, EXCP0B_NOSEG
, selector
& 0xfffc, GETPC());
1205 #ifdef TARGET_X86_64
1206 if (env
->hflags
& HF_LMA_MASK
) {
1209 e3
= cpu_ldl_kernel_ra(env
, ptr
+ 8, GETPC());
1210 load_seg_cache_raw_dt(&env
->ldt
, e1
, e2
);
1211 env
->ldt
.base
|= (target_ulong
)e3
<< 32;
1215 load_seg_cache_raw_dt(&env
->ldt
, e1
, e2
);
1218 env
->ldt
.selector
= selector
;
1221 void helper_ltr(CPUX86State
*env
, int selector
)
1225 int index
, type
, entry_limit
;
1229 if ((selector
& 0xfffc) == 0) {
1230 /* NULL selector case: invalid TR */
1235 if (selector
& 0x4) {
1236 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1239 index
= selector
& ~7;
1240 #ifdef TARGET_X86_64
1241 if (env
->hflags
& HF_LMA_MASK
) {
1248 if ((index
+ entry_limit
) > dt
->limit
) {
1249 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1251 ptr
= dt
->base
+ index
;
1252 e1
= cpu_ldl_kernel_ra(env
, ptr
, GETPC());
1253 e2
= cpu_ldl_kernel_ra(env
, ptr
+ 4, GETPC());
1254 type
= (e2
>> DESC_TYPE_SHIFT
) & 0xf;
1255 if ((e2
& DESC_S_MASK
) ||
1256 (type
!= 1 && type
!= 9)) {
1257 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1259 if (!(e2
& DESC_P_MASK
)) {
1260 raise_exception_err_ra(env
, EXCP0B_NOSEG
, selector
& 0xfffc, GETPC());
1262 #ifdef TARGET_X86_64
1263 if (env
->hflags
& HF_LMA_MASK
) {
1266 e3
= cpu_ldl_kernel_ra(env
, ptr
+ 8, GETPC());
1267 e4
= cpu_ldl_kernel_ra(env
, ptr
+ 12, GETPC());
1268 if ((e4
>> DESC_TYPE_SHIFT
) & 0xf) {
1269 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1271 load_seg_cache_raw_dt(&env
->tr
, e1
, e2
);
1272 env
->tr
.base
|= (target_ulong
)e3
<< 32;
1276 load_seg_cache_raw_dt(&env
->tr
, e1
, e2
);
1278 e2
|= DESC_TSS_BUSY_MASK
;
1279 cpu_stl_kernel_ra(env
, ptr
+ 4, e2
, GETPC());
1281 env
->tr
.selector
= selector
;
1284 /* only works if protected mode and not VM86. seg_reg must be != R_CS */
1285 void helper_load_seg(CPUX86State
*env
, int seg_reg
, int selector
)
1294 cpl
= env
->hflags
& HF_CPL_MASK
;
1295 if ((selector
& 0xfffc) == 0) {
1296 /* null selector case */
1298 #ifdef TARGET_X86_64
1299 && (!(env
->hflags
& HF_CS64_MASK
) || cpl
== 3)
1302 raise_exception_err_ra(env
, EXCP0D_GPF
, 0, GETPC());
1304 cpu_x86_load_seg_cache(env
, seg_reg
, selector
, 0, 0, 0);
1307 if (selector
& 0x4) {
1312 index
= selector
& ~7;
1313 if ((index
+ 7) > dt
->limit
) {
1314 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1316 ptr
= dt
->base
+ index
;
1317 e1
= cpu_ldl_kernel_ra(env
, ptr
, GETPC());
1318 e2
= cpu_ldl_kernel_ra(env
, ptr
+ 4, GETPC());
1320 if (!(e2
& DESC_S_MASK
)) {
1321 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1324 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
1325 if (seg_reg
== R_SS
) {
1326 /* must be writable segment */
1327 if ((e2
& DESC_CS_MASK
) || !(e2
& DESC_W_MASK
)) {
1328 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1330 if (rpl
!= cpl
|| dpl
!= cpl
) {
1331 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1334 /* must be readable segment */
1335 if ((e2
& (DESC_CS_MASK
| DESC_R_MASK
)) == DESC_CS_MASK
) {
1336 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1339 if (!(e2
& DESC_CS_MASK
) || !(e2
& DESC_C_MASK
)) {
1340 /* if not conforming code, test rights */
1341 if (dpl
< cpl
|| dpl
< rpl
) {
1342 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1347 if (!(e2
& DESC_P_MASK
)) {
1348 if (seg_reg
== R_SS
) {
1349 raise_exception_err_ra(env
, EXCP0C_STACK
, selector
& 0xfffc, GETPC());
1351 raise_exception_err_ra(env
, EXCP0B_NOSEG
, selector
& 0xfffc, GETPC());
1355 /* set the access bit if not already set */
1356 if (!(e2
& DESC_A_MASK
)) {
1358 cpu_stl_kernel_ra(env
, ptr
+ 4, e2
, GETPC());
1361 cpu_x86_load_seg_cache(env
, seg_reg
, selector
,
1362 get_seg_base(e1
, e2
),
1363 get_seg_limit(e1
, e2
),
1366 qemu_log("load_seg: sel=0x%04x base=0x%08lx limit=0x%08lx flags=%08x\n",
1367 selector
, (unsigned long)sc
->base
, sc
->limit
, sc
->flags
);
1372 /* protected mode jump */
1373 void helper_ljmp_protected(CPUX86State
*env
, int new_cs
, target_ulong new_eip
,
1374 target_ulong next_eip
)
1377 uint32_t e1
, e2
, cpl
, dpl
, rpl
, limit
;
1379 if ((new_cs
& 0xfffc) == 0) {
1380 raise_exception_err_ra(env
, EXCP0D_GPF
, 0, GETPC());
1382 if (load_segment_ra(env
, &e1
, &e2
, new_cs
, GETPC()) != 0) {
1383 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1385 cpl
= env
->hflags
& HF_CPL_MASK
;
1386 if (e2
& DESC_S_MASK
) {
1387 if (!(e2
& DESC_CS_MASK
)) {
1388 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1390 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
1391 if (e2
& DESC_C_MASK
) {
1392 /* conforming code segment */
1394 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1397 /* non conforming code segment */
1400 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1403 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1406 if (!(e2
& DESC_P_MASK
)) {
1407 raise_exception_err_ra(env
, EXCP0B_NOSEG
, new_cs
& 0xfffc, GETPC());
1409 limit
= get_seg_limit(e1
, e2
);
1410 if (new_eip
> limit
&&
1411 (!(env
->hflags
& HF_LMA_MASK
) || !(e2
& DESC_L_MASK
))) {
1412 raise_exception_err_ra(env
, EXCP0D_GPF
, 0, GETPC());
1414 cpu_x86_load_seg_cache(env
, R_CS
, (new_cs
& 0xfffc) | cpl
,
1415 get_seg_base(e1
, e2
), limit
, e2
);
1418 /* jump to call or task gate */
1419 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
1421 cpl
= env
->hflags
& HF_CPL_MASK
;
1422 type
= (e2
>> DESC_TYPE_SHIFT
) & 0xf;
1424 #ifdef TARGET_X86_64
1425 if (env
->efer
& MSR_EFER_LMA
) {
1427 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1432 case 1: /* 286 TSS */
1433 case 9: /* 386 TSS */
1434 case 5: /* task gate */
1435 if (dpl
< cpl
|| dpl
< rpl
) {
1436 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1438 switch_tss_ra(env
, new_cs
, e1
, e2
, SWITCH_TSS_JMP
, next_eip
, GETPC());
1440 case 4: /* 286 call gate */
1441 case 12: /* 386 call gate */
1442 if ((dpl
< cpl
) || (dpl
< rpl
)) {
1443 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1445 if (!(e2
& DESC_P_MASK
)) {
1446 raise_exception_err_ra(env
, EXCP0B_NOSEG
, new_cs
& 0xfffc, GETPC());
1449 new_eip
= (e1
& 0xffff);
1451 new_eip
|= (e2
& 0xffff0000);
1454 #ifdef TARGET_X86_64
1455 if (env
->efer
& MSR_EFER_LMA
) {
1456 /* load the upper 8 bytes of the 64-bit call gate */
1457 if (load_segment_ra(env
, &e1
, &e2
, new_cs
+ 8, GETPC())) {
1458 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc,
1461 type
= (e2
>> DESC_TYPE_SHIFT
) & 0x1f;
1463 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc,
1466 new_eip
|= ((target_ulong
)e1
) << 32;
1470 if (load_segment_ra(env
, &e1
, &e2
, gate_cs
, GETPC()) != 0) {
1471 raise_exception_err_ra(env
, EXCP0D_GPF
, gate_cs
& 0xfffc, GETPC());
1473 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
1474 /* must be code segment */
1475 if (((e2
& (DESC_S_MASK
| DESC_CS_MASK
)) !=
1476 (DESC_S_MASK
| DESC_CS_MASK
))) {
1477 raise_exception_err_ra(env
, EXCP0D_GPF
, gate_cs
& 0xfffc, GETPC());
1479 if (((e2
& DESC_C_MASK
) && (dpl
> cpl
)) ||
1480 (!(e2
& DESC_C_MASK
) && (dpl
!= cpl
))) {
1481 raise_exception_err_ra(env
, EXCP0D_GPF
, gate_cs
& 0xfffc, GETPC());
1483 #ifdef TARGET_X86_64
1484 if (env
->efer
& MSR_EFER_LMA
) {
1485 if (!(e2
& DESC_L_MASK
)) {
1486 raise_exception_err_ra(env
, EXCP0D_GPF
, gate_cs
& 0xfffc, GETPC());
1488 if (e2
& DESC_B_MASK
) {
1489 raise_exception_err_ra(env
, EXCP0D_GPF
, gate_cs
& 0xfffc, GETPC());
1493 if (!(e2
& DESC_P_MASK
)) {
1494 raise_exception_err_ra(env
, EXCP0D_GPF
, gate_cs
& 0xfffc, GETPC());
1496 limit
= get_seg_limit(e1
, e2
);
1497 if (new_eip
> limit
&&
1498 (!(env
->hflags
& HF_LMA_MASK
) || !(e2
& DESC_L_MASK
))) {
1499 raise_exception_err_ra(env
, EXCP0D_GPF
, 0, GETPC());
1501 cpu_x86_load_seg_cache(env
, R_CS
, (gate_cs
& 0xfffc) | cpl
,
1502 get_seg_base(e1
, e2
), limit
, e2
);
1506 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1512 /* real mode call */
1513 void helper_lcall_real(CPUX86State
*env
, uint32_t new_cs
, uint32_t new_eip
,
1514 int shift
, uint32_t next_eip
)
1516 uint32_t esp
, esp_mask
;
1519 esp
= env
->regs
[R_ESP
];
1520 esp_mask
= get_sp_mask(env
->segs
[R_SS
].flags
);
1521 ssp
= env
->segs
[R_SS
].base
;
1523 PUSHL_RA(ssp
, esp
, esp_mask
, env
->segs
[R_CS
].selector
, GETPC());
1524 PUSHL_RA(ssp
, esp
, esp_mask
, next_eip
, GETPC());
1526 PUSHW_RA(ssp
, esp
, esp_mask
, env
->segs
[R_CS
].selector
, GETPC());
1527 PUSHW_RA(ssp
, esp
, esp_mask
, next_eip
, GETPC());
1530 SET_ESP(esp
, esp_mask
);
1532 env
->segs
[R_CS
].selector
= new_cs
;
1533 env
->segs
[R_CS
].base
= (new_cs
<< 4);
1536 /* protected mode call */
1537 void helper_lcall_protected(CPUX86State
*env
, int new_cs
, target_ulong new_eip
,
1538 int shift
, target_ulong next_eip
)
1541 uint32_t e1
, e2
, cpl
, dpl
, rpl
, selector
, param_count
;
1542 uint32_t ss
= 0, ss_e1
= 0, ss_e2
= 0, type
, ss_dpl
, sp_mask
;
1543 uint32_t val
, limit
, old_sp_mask
;
1544 target_ulong ssp
, old_ssp
, offset
, sp
;
1546 LOG_PCALL("lcall %04x:" TARGET_FMT_lx
" s=%d\n", new_cs
, new_eip
, shift
);
1547 LOG_PCALL_STATE(env_cpu(env
));
1548 if ((new_cs
& 0xfffc) == 0) {
1549 raise_exception_err_ra(env
, EXCP0D_GPF
, 0, GETPC());
1551 if (load_segment_ra(env
, &e1
, &e2
, new_cs
, GETPC()) != 0) {
1552 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1554 cpl
= env
->hflags
& HF_CPL_MASK
;
1555 LOG_PCALL("desc=%08x:%08x\n", e1
, e2
);
1556 if (e2
& DESC_S_MASK
) {
1557 if (!(e2
& DESC_CS_MASK
)) {
1558 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1560 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
1561 if (e2
& DESC_C_MASK
) {
1562 /* conforming code segment */
1564 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1567 /* non conforming code segment */
1570 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1573 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1576 if (!(e2
& DESC_P_MASK
)) {
1577 raise_exception_err_ra(env
, EXCP0B_NOSEG
, new_cs
& 0xfffc, GETPC());
1580 #ifdef TARGET_X86_64
1581 /* XXX: check 16/32 bit cases in long mode */
1586 rsp
= env
->regs
[R_ESP
];
1587 PUSHQ_RA(rsp
, env
->segs
[R_CS
].selector
, GETPC());
1588 PUSHQ_RA(rsp
, next_eip
, GETPC());
1589 /* from this point, not restartable */
1590 env
->regs
[R_ESP
] = rsp
;
1591 cpu_x86_load_seg_cache(env
, R_CS
, (new_cs
& 0xfffc) | cpl
,
1592 get_seg_base(e1
, e2
),
1593 get_seg_limit(e1
, e2
), e2
);
1598 sp
= env
->regs
[R_ESP
];
1599 sp_mask
= get_sp_mask(env
->segs
[R_SS
].flags
);
1600 ssp
= env
->segs
[R_SS
].base
;
1602 PUSHL_RA(ssp
, sp
, sp_mask
, env
->segs
[R_CS
].selector
, GETPC());
1603 PUSHL_RA(ssp
, sp
, sp_mask
, next_eip
, GETPC());
1605 PUSHW_RA(ssp
, sp
, sp_mask
, env
->segs
[R_CS
].selector
, GETPC());
1606 PUSHW_RA(ssp
, sp
, sp_mask
, next_eip
, GETPC());
1609 limit
= get_seg_limit(e1
, e2
);
1610 if (new_eip
> limit
) {
1611 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1613 /* from this point, not restartable */
1614 SET_ESP(sp
, sp_mask
);
1615 cpu_x86_load_seg_cache(env
, R_CS
, (new_cs
& 0xfffc) | cpl
,
1616 get_seg_base(e1
, e2
), limit
, e2
);
1620 /* check gate type */
1621 type
= (e2
>> DESC_TYPE_SHIFT
) & 0x1f;
1622 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
1625 #ifdef TARGET_X86_64
1626 if (env
->efer
& MSR_EFER_LMA
) {
1628 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1634 case 1: /* available 286 TSS */
1635 case 9: /* available 386 TSS */
1636 case 5: /* task gate */
1637 if (dpl
< cpl
|| dpl
< rpl
) {
1638 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1640 switch_tss_ra(env
, new_cs
, e1
, e2
, SWITCH_TSS_CALL
, next_eip
, GETPC());
1642 case 4: /* 286 call gate */
1643 case 12: /* 386 call gate */
1646 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1651 if (dpl
< cpl
|| dpl
< rpl
) {
1652 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, GETPC());
1654 /* check valid bit */
1655 if (!(e2
& DESC_P_MASK
)) {
1656 raise_exception_err_ra(env
, EXCP0B_NOSEG
, new_cs
& 0xfffc, GETPC());
1658 selector
= e1
>> 16;
1659 param_count
= e2
& 0x1f;
1660 offset
= (e2
& 0xffff0000) | (e1
& 0x0000ffff);
1661 #ifdef TARGET_X86_64
1662 if (env
->efer
& MSR_EFER_LMA
) {
1663 /* load the upper 8 bytes of the 64-bit call gate */
1664 if (load_segment_ra(env
, &e1
, &e2
, new_cs
+ 8, GETPC())) {
1665 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc,
1668 type
= (e2
>> DESC_TYPE_SHIFT
) & 0x1f;
1670 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc,
1673 offset
|= ((target_ulong
)e1
) << 32;
1676 if ((selector
& 0xfffc) == 0) {
1677 raise_exception_err_ra(env
, EXCP0D_GPF
, 0, GETPC());
1680 if (load_segment_ra(env
, &e1
, &e2
, selector
, GETPC()) != 0) {
1681 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1683 if (!(e2
& DESC_S_MASK
) || !(e2
& (DESC_CS_MASK
))) {
1684 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1686 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
1688 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1690 #ifdef TARGET_X86_64
1691 if (env
->efer
& MSR_EFER_LMA
) {
1692 if (!(e2
& DESC_L_MASK
)) {
1693 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1695 if (e2
& DESC_B_MASK
) {
1696 raise_exception_err_ra(env
, EXCP0D_GPF
, selector
& 0xfffc, GETPC());
1701 if (!(e2
& DESC_P_MASK
)) {
1702 raise_exception_err_ra(env
, EXCP0B_NOSEG
, selector
& 0xfffc, GETPC());
1705 if (!(e2
& DESC_C_MASK
) && dpl
< cpl
) {
1706 /* to inner privilege */
1707 #ifdef TARGET_X86_64
1709 sp
= get_rsp_from_tss(env
, dpl
);
1710 ss
= dpl
; /* SS = NULL selector with RPL = new CPL */
1713 ssp
= 0; /* SS base is always zero in IA-32e mode */
1714 LOG_PCALL("new ss:rsp=%04x:%016llx env->regs[R_ESP]="
1715 TARGET_FMT_lx
"\n", ss
, sp
, env
->regs
[R_ESP
]);
1720 get_ss_esp_from_tss(env
, &ss
, &sp32
, dpl
, GETPC());
1721 LOG_PCALL("new ss:esp=%04x:%08x param_count=%d env->regs[R_ESP]="
1722 TARGET_FMT_lx
"\n", ss
, sp32
, param_count
,
1725 if ((ss
& 0xfffc) == 0) {
1726 raise_exception_err_ra(env
, EXCP0A_TSS
, ss
& 0xfffc, GETPC());
1728 if ((ss
& 3) != dpl
) {
1729 raise_exception_err_ra(env
, EXCP0A_TSS
, ss
& 0xfffc, GETPC());
1731 if (load_segment_ra(env
, &ss_e1
, &ss_e2
, ss
, GETPC()) != 0) {
1732 raise_exception_err_ra(env
, EXCP0A_TSS
, ss
& 0xfffc, GETPC());
1734 ss_dpl
= (ss_e2
>> DESC_DPL_SHIFT
) & 3;
1735 if (ss_dpl
!= dpl
) {
1736 raise_exception_err_ra(env
, EXCP0A_TSS
, ss
& 0xfffc, GETPC());
1738 if (!(ss_e2
& DESC_S_MASK
) ||
1739 (ss_e2
& DESC_CS_MASK
) ||
1740 !(ss_e2
& DESC_W_MASK
)) {
1741 raise_exception_err_ra(env
, EXCP0A_TSS
, ss
& 0xfffc, GETPC());
1743 if (!(ss_e2
& DESC_P_MASK
)) {
1744 raise_exception_err_ra(env
, EXCP0A_TSS
, ss
& 0xfffc, GETPC());
1747 sp_mask
= get_sp_mask(ss_e2
);
1748 ssp
= get_seg_base(ss_e1
, ss_e2
);
1751 /* push_size = ((param_count * 2) + 8) << shift; */
1753 old_sp_mask
= get_sp_mask(env
->segs
[R_SS
].flags
);
1754 old_ssp
= env
->segs
[R_SS
].base
;
1755 #ifdef TARGET_X86_64
1757 /* XXX: verify if new stack address is canonical */
1758 PUSHQ_RA(sp
, env
->segs
[R_SS
].selector
, GETPC());
1759 PUSHQ_RA(sp
, env
->regs
[R_ESP
], GETPC());
1760 /* parameters aren't supported for 64-bit call gates */
1764 PUSHL_RA(ssp
, sp
, sp_mask
, env
->segs
[R_SS
].selector
, GETPC());
1765 PUSHL_RA(ssp
, sp
, sp_mask
, env
->regs
[R_ESP
], GETPC());
1766 for (i
= param_count
- 1; i
>= 0; i
--) {
1767 val
= cpu_ldl_kernel_ra(env
, old_ssp
+
1768 ((env
->regs
[R_ESP
] + i
* 4) &
1769 old_sp_mask
), GETPC());
1770 PUSHL_RA(ssp
, sp
, sp_mask
, val
, GETPC());
1773 PUSHW_RA(ssp
, sp
, sp_mask
, env
->segs
[R_SS
].selector
, GETPC());
1774 PUSHW_RA(ssp
, sp
, sp_mask
, env
->regs
[R_ESP
], GETPC());
1775 for (i
= param_count
- 1; i
>= 0; i
--) {
1776 val
= cpu_lduw_kernel_ra(env
, old_ssp
+
1777 ((env
->regs
[R_ESP
] + i
* 2) &
1778 old_sp_mask
), GETPC());
1779 PUSHW_RA(ssp
, sp
, sp_mask
, val
, GETPC());
1784 /* to same privilege */
1785 sp
= env
->regs
[R_ESP
];
1786 sp_mask
= get_sp_mask(env
->segs
[R_SS
].flags
);
1787 ssp
= env
->segs
[R_SS
].base
;
1788 /* push_size = (4 << shift); */
1792 #ifdef TARGET_X86_64
1794 PUSHQ_RA(sp
, env
->segs
[R_CS
].selector
, GETPC());
1795 PUSHQ_RA(sp
, next_eip
, GETPC());
1799 PUSHL_RA(ssp
, sp
, sp_mask
, env
->segs
[R_CS
].selector
, GETPC());
1800 PUSHL_RA(ssp
, sp
, sp_mask
, next_eip
, GETPC());
1802 PUSHW_RA(ssp
, sp
, sp_mask
, env
->segs
[R_CS
].selector
, GETPC());
1803 PUSHW_RA(ssp
, sp
, sp_mask
, next_eip
, GETPC());
1806 /* from this point, not restartable */
1809 #ifdef TARGET_X86_64
1811 cpu_x86_load_seg_cache(env
, R_SS
, ss
, 0, 0, 0);
1815 ss
= (ss
& ~3) | dpl
;
1816 cpu_x86_load_seg_cache(env
, R_SS
, ss
,
1818 get_seg_limit(ss_e1
, ss_e2
),
1823 selector
= (selector
& ~3) | dpl
;
1824 cpu_x86_load_seg_cache(env
, R_CS
, selector
,
1825 get_seg_base(e1
, e2
),
1826 get_seg_limit(e1
, e2
),
1828 SET_ESP(sp
, sp_mask
);
1833 /* real and vm86 mode iret */
1834 void helper_iret_real(CPUX86State
*env
, int shift
)
1836 uint32_t sp
, new_cs
, new_eip
, new_eflags
, sp_mask
;
1840 sp_mask
= 0xffff; /* XXXX: use SS segment size? */
1841 sp
= env
->regs
[R_ESP
];
1842 ssp
= env
->segs
[R_SS
].base
;
1845 POPL_RA(ssp
, sp
, sp_mask
, new_eip
, GETPC());
1846 POPL_RA(ssp
, sp
, sp_mask
, new_cs
, GETPC());
1848 POPL_RA(ssp
, sp
, sp_mask
, new_eflags
, GETPC());
1851 POPW_RA(ssp
, sp
, sp_mask
, new_eip
, GETPC());
1852 POPW_RA(ssp
, sp
, sp_mask
, new_cs
, GETPC());
1853 POPW_RA(ssp
, sp
, sp_mask
, new_eflags
, GETPC());
1855 env
->regs
[R_ESP
] = (env
->regs
[R_ESP
] & ~sp_mask
) | (sp
& sp_mask
);
1856 env
->segs
[R_CS
].selector
= new_cs
;
1857 env
->segs
[R_CS
].base
= (new_cs
<< 4);
1859 if (env
->eflags
& VM_MASK
) {
1860 eflags_mask
= TF_MASK
| AC_MASK
| ID_MASK
| IF_MASK
| RF_MASK
|
1863 eflags_mask
= TF_MASK
| AC_MASK
| ID_MASK
| IF_MASK
| IOPL_MASK
|
1867 eflags_mask
&= 0xffff;
1869 cpu_load_eflags(env
, new_eflags
, eflags_mask
);
1870 env
->hflags2
&= ~HF2_NMI_MASK
;
1873 static inline void validate_seg(CPUX86State
*env
, X86Seg seg_reg
, int cpl
)
1878 /* XXX: on x86_64, we do not want to nullify FS and GS because
1879 they may still contain a valid base. I would be interested to
1880 know how a real x86_64 CPU behaves */
1881 if ((seg_reg
== R_FS
|| seg_reg
== R_GS
) &&
1882 (env
->segs
[seg_reg
].selector
& 0xfffc) == 0) {
1886 e2
= env
->segs
[seg_reg
].flags
;
1887 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
1888 if (!(e2
& DESC_CS_MASK
) || !(e2
& DESC_C_MASK
)) {
1889 /* data or non conforming code segment */
1891 cpu_x86_load_seg_cache(env
, seg_reg
, 0,
1892 env
->segs
[seg_reg
].base
,
1893 env
->segs
[seg_reg
].limit
,
1894 env
->segs
[seg_reg
].flags
& ~DESC_P_MASK
);
1899 /* protected mode iret */
1900 static inline void helper_ret_protected(CPUX86State
*env
, int shift
,
1901 int is_iret
, int addend
,
1904 uint32_t new_cs
, new_eflags
, new_ss
;
1905 uint32_t new_es
, new_ds
, new_fs
, new_gs
;
1906 uint32_t e1
, e2
, ss_e1
, ss_e2
;
1907 int cpl
, dpl
, rpl
, eflags_mask
, iopl
;
1908 target_ulong ssp
, sp
, new_eip
, new_esp
, sp_mask
;
1910 #ifdef TARGET_X86_64
1916 sp_mask
= get_sp_mask(env
->segs
[R_SS
].flags
);
1918 sp
= env
->regs
[R_ESP
];
1919 ssp
= env
->segs
[R_SS
].base
;
1920 new_eflags
= 0; /* avoid warning */
1921 #ifdef TARGET_X86_64
1923 POPQ_RA(sp
, new_eip
, retaddr
);
1924 POPQ_RA(sp
, new_cs
, retaddr
);
1927 POPQ_RA(sp
, new_eflags
, retaddr
);
1934 POPL_RA(ssp
, sp
, sp_mask
, new_eip
, retaddr
);
1935 POPL_RA(ssp
, sp
, sp_mask
, new_cs
, retaddr
);
1938 POPL_RA(ssp
, sp
, sp_mask
, new_eflags
, retaddr
);
1939 if (new_eflags
& VM_MASK
) {
1940 goto return_to_vm86
;
1945 POPW_RA(ssp
, sp
, sp_mask
, new_eip
, retaddr
);
1946 POPW_RA(ssp
, sp
, sp_mask
, new_cs
, retaddr
);
1948 POPW_RA(ssp
, sp
, sp_mask
, new_eflags
, retaddr
);
1952 LOG_PCALL("lret new %04x:" TARGET_FMT_lx
" s=%d addend=0x%x\n",
1953 new_cs
, new_eip
, shift
, addend
);
1954 LOG_PCALL_STATE(env_cpu(env
));
1955 if ((new_cs
& 0xfffc) == 0) {
1956 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, retaddr
);
1958 if (load_segment_ra(env
, &e1
, &e2
, new_cs
, retaddr
) != 0) {
1959 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, retaddr
);
1961 if (!(e2
& DESC_S_MASK
) ||
1962 !(e2
& DESC_CS_MASK
)) {
1963 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, retaddr
);
1965 cpl
= env
->hflags
& HF_CPL_MASK
;
1968 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, retaddr
);
1970 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
1971 if (e2
& DESC_C_MASK
) {
1973 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, retaddr
);
1977 raise_exception_err_ra(env
, EXCP0D_GPF
, new_cs
& 0xfffc, retaddr
);
1980 if (!(e2
& DESC_P_MASK
)) {
1981 raise_exception_err_ra(env
, EXCP0B_NOSEG
, new_cs
& 0xfffc, retaddr
);
1985 if (rpl
== cpl
&& (!(env
->hflags
& HF_CS64_MASK
) ||
1986 ((env
->hflags
& HF_CS64_MASK
) && !is_iret
))) {
1987 /* return to same privilege level */
1988 cpu_x86_load_seg_cache(env
, R_CS
, new_cs
,
1989 get_seg_base(e1
, e2
),
1990 get_seg_limit(e1
, e2
),
1993 /* return to different privilege level */
1994 #ifdef TARGET_X86_64
1996 POPQ_RA(sp
, new_esp
, retaddr
);
1997 POPQ_RA(sp
, new_ss
, retaddr
);
2004 POPL_RA(ssp
, sp
, sp_mask
, new_esp
, retaddr
);
2005 POPL_RA(ssp
, sp
, sp_mask
, new_ss
, retaddr
);
2009 POPW_RA(ssp
, sp
, sp_mask
, new_esp
, retaddr
);
2010 POPW_RA(ssp
, sp
, sp_mask
, new_ss
, retaddr
);
2013 LOG_PCALL("new ss:esp=%04x:" TARGET_FMT_lx
"\n",
2015 if ((new_ss
& 0xfffc) == 0) {
2016 #ifdef TARGET_X86_64
2017 /* NULL ss is allowed in long mode if cpl != 3 */
2018 /* XXX: test CS64? */
2019 if ((env
->hflags
& HF_LMA_MASK
) && rpl
!= 3) {
2020 cpu_x86_load_seg_cache(env
, R_SS
, new_ss
,
2022 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2023 DESC_S_MASK
| (rpl
<< DESC_DPL_SHIFT
) |
2024 DESC_W_MASK
| DESC_A_MASK
);
2025 ss_e2
= DESC_B_MASK
; /* XXX: should not be needed? */
2029 raise_exception_err_ra(env
, EXCP0D_GPF
, 0, retaddr
);
2032 if ((new_ss
& 3) != rpl
) {
2033 raise_exception_err_ra(env
, EXCP0D_GPF
, new_ss
& 0xfffc, retaddr
);
2035 if (load_segment_ra(env
, &ss_e1
, &ss_e2
, new_ss
, retaddr
) != 0) {
2036 raise_exception_err_ra(env
, EXCP0D_GPF
, new_ss
& 0xfffc, retaddr
);
2038 if (!(ss_e2
& DESC_S_MASK
) ||
2039 (ss_e2
& DESC_CS_MASK
) ||
2040 !(ss_e2
& DESC_W_MASK
)) {
2041 raise_exception_err_ra(env
, EXCP0D_GPF
, new_ss
& 0xfffc, retaddr
);
2043 dpl
= (ss_e2
>> DESC_DPL_SHIFT
) & 3;
2045 raise_exception_err_ra(env
, EXCP0D_GPF
, new_ss
& 0xfffc, retaddr
);
2047 if (!(ss_e2
& DESC_P_MASK
)) {
2048 raise_exception_err_ra(env
, EXCP0B_NOSEG
, new_ss
& 0xfffc, retaddr
);
2050 cpu_x86_load_seg_cache(env
, R_SS
, new_ss
,
2051 get_seg_base(ss_e1
, ss_e2
),
2052 get_seg_limit(ss_e1
, ss_e2
),
2056 cpu_x86_load_seg_cache(env
, R_CS
, new_cs
,
2057 get_seg_base(e1
, e2
),
2058 get_seg_limit(e1
, e2
),
2061 #ifdef TARGET_X86_64
2062 if (env
->hflags
& HF_CS64_MASK
) {
2067 sp_mask
= get_sp_mask(ss_e2
);
2070 /* validate data segments */
2071 validate_seg(env
, R_ES
, rpl
);
2072 validate_seg(env
, R_DS
, rpl
);
2073 validate_seg(env
, R_FS
, rpl
);
2074 validate_seg(env
, R_GS
, rpl
);
2078 SET_ESP(sp
, sp_mask
);
2081 /* NOTE: 'cpl' is the _old_ CPL */
2082 eflags_mask
= TF_MASK
| AC_MASK
| ID_MASK
| RF_MASK
| NT_MASK
;
2084 eflags_mask
|= IOPL_MASK
;
2086 iopl
= (env
->eflags
>> IOPL_SHIFT
) & 3;
2088 eflags_mask
|= IF_MASK
;
2091 eflags_mask
&= 0xffff;
2093 cpu_load_eflags(env
, new_eflags
, eflags_mask
);
2098 POPL_RA(ssp
, sp
, sp_mask
, new_esp
, retaddr
);
2099 POPL_RA(ssp
, sp
, sp_mask
, new_ss
, retaddr
);
2100 POPL_RA(ssp
, sp
, sp_mask
, new_es
, retaddr
);
2101 POPL_RA(ssp
, sp
, sp_mask
, new_ds
, retaddr
);
2102 POPL_RA(ssp
, sp
, sp_mask
, new_fs
, retaddr
);
2103 POPL_RA(ssp
, sp
, sp_mask
, new_gs
, retaddr
);
2105 /* modify processor state */
2106 cpu_load_eflags(env
, new_eflags
, TF_MASK
| AC_MASK
| ID_MASK
|
2107 IF_MASK
| IOPL_MASK
| VM_MASK
| NT_MASK
| VIF_MASK
|
2109 load_seg_vm(env
, R_CS
, new_cs
& 0xffff);
2110 load_seg_vm(env
, R_SS
, new_ss
& 0xffff);
2111 load_seg_vm(env
, R_ES
, new_es
& 0xffff);
2112 load_seg_vm(env
, R_DS
, new_ds
& 0xffff);
2113 load_seg_vm(env
, R_FS
, new_fs
& 0xffff);
2114 load_seg_vm(env
, R_GS
, new_gs
& 0xffff);
2116 env
->eip
= new_eip
& 0xffff;
2117 env
->regs
[R_ESP
] = new_esp
;
2120 void helper_iret_protected(CPUX86State
*env
, int shift
, int next_eip
)
2122 int tss_selector
, type
;
2125 /* specific case for TSS */
2126 if (env
->eflags
& NT_MASK
) {
2127 #ifdef TARGET_X86_64
2128 if (env
->hflags
& HF_LMA_MASK
) {
2129 raise_exception_err_ra(env
, EXCP0D_GPF
, 0, GETPC());
2132 tss_selector
= cpu_lduw_kernel_ra(env
, env
->tr
.base
+ 0, GETPC());
2133 if (tss_selector
& 4) {
2134 raise_exception_err_ra(env
, EXCP0A_TSS
, tss_selector
& 0xfffc, GETPC());
2136 if (load_segment_ra(env
, &e1
, &e2
, tss_selector
, GETPC()) != 0) {
2137 raise_exception_err_ra(env
, EXCP0A_TSS
, tss_selector
& 0xfffc, GETPC());
2139 type
= (e2
>> DESC_TYPE_SHIFT
) & 0x17;
2140 /* NOTE: we check both segment and busy TSS */
2142 raise_exception_err_ra(env
, EXCP0A_TSS
, tss_selector
& 0xfffc, GETPC());
2144 switch_tss_ra(env
, tss_selector
, e1
, e2
, SWITCH_TSS_IRET
, next_eip
, GETPC());
2146 helper_ret_protected(env
, shift
, 1, 0, GETPC());
2148 env
->hflags2
&= ~HF2_NMI_MASK
;
2151 void helper_lret_protected(CPUX86State
*env
, int shift
, int addend
)
2153 helper_ret_protected(env
, shift
, 0, addend
, GETPC());
2156 void helper_sysenter(CPUX86State
*env
)
2158 if (env
->sysenter_cs
== 0) {
2159 raise_exception_err_ra(env
, EXCP0D_GPF
, 0, GETPC());
2161 env
->eflags
&= ~(VM_MASK
| IF_MASK
| RF_MASK
);
2163 #ifdef TARGET_X86_64
2164 if (env
->hflags
& HF_LMA_MASK
) {
2165 cpu_x86_load_seg_cache(env
, R_CS
, env
->sysenter_cs
& 0xfffc,
2167 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2169 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
|
2174 cpu_x86_load_seg_cache(env
, R_CS
, env
->sysenter_cs
& 0xfffc,
2176 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2178 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
);
2180 cpu_x86_load_seg_cache(env
, R_SS
, (env
->sysenter_cs
+ 8) & 0xfffc,
2182 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2184 DESC_W_MASK
| DESC_A_MASK
);
2185 env
->regs
[R_ESP
] = env
->sysenter_esp
;
2186 env
->eip
= env
->sysenter_eip
;
2189 void helper_sysexit(CPUX86State
*env
, int dflag
)
2193 cpl
= env
->hflags
& HF_CPL_MASK
;
2194 if (env
->sysenter_cs
== 0 || cpl
!= 0) {
2195 raise_exception_err_ra(env
, EXCP0D_GPF
, 0, GETPC());
2197 #ifdef TARGET_X86_64
2199 cpu_x86_load_seg_cache(env
, R_CS
, ((env
->sysenter_cs
+ 32) & 0xfffc) |
2201 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2202 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
2203 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
|
2205 cpu_x86_load_seg_cache(env
, R_SS
, ((env
->sysenter_cs
+ 40) & 0xfffc) |
2207 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2208 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
2209 DESC_W_MASK
| DESC_A_MASK
);
2213 cpu_x86_load_seg_cache(env
, R_CS
, ((env
->sysenter_cs
+ 16) & 0xfffc) |
2215 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2216 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
2217 DESC_CS_MASK
| DESC_R_MASK
| DESC_A_MASK
);
2218 cpu_x86_load_seg_cache(env
, R_SS
, ((env
->sysenter_cs
+ 24) & 0xfffc) |
2220 DESC_G_MASK
| DESC_B_MASK
| DESC_P_MASK
|
2221 DESC_S_MASK
| (3 << DESC_DPL_SHIFT
) |
2222 DESC_W_MASK
| DESC_A_MASK
);
2224 env
->regs
[R_ESP
] = env
->regs
[R_ECX
];
2225 env
->eip
= env
->regs
[R_EDX
];
2228 target_ulong
helper_lsl(CPUX86State
*env
, target_ulong selector1
)
2231 uint32_t e1
, e2
, eflags
, selector
;
2232 int rpl
, dpl
, cpl
, type
;
2234 selector
= selector1
& 0xffff;
2235 eflags
= cpu_cc_compute_all(env
, CC_OP
);
2236 if ((selector
& 0xfffc) == 0) {
2239 if (load_segment_ra(env
, &e1
, &e2
, selector
, GETPC()) != 0) {
2243 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
2244 cpl
= env
->hflags
& HF_CPL_MASK
;
2245 if (e2
& DESC_S_MASK
) {
2246 if ((e2
& DESC_CS_MASK
) && (e2
& DESC_C_MASK
)) {
2249 if (dpl
< cpl
|| dpl
< rpl
) {
2254 type
= (e2
>> DESC_TYPE_SHIFT
) & 0xf;
2265 if (dpl
< cpl
|| dpl
< rpl
) {
2267 CC_SRC
= eflags
& ~CC_Z
;
2271 limit
= get_seg_limit(e1
, e2
);
2272 CC_SRC
= eflags
| CC_Z
;
2276 target_ulong
helper_lar(CPUX86State
*env
, target_ulong selector1
)
2278 uint32_t e1
, e2
, eflags
, selector
;
2279 int rpl
, dpl
, cpl
, type
;
2281 selector
= selector1
& 0xffff;
2282 eflags
= cpu_cc_compute_all(env
, CC_OP
);
2283 if ((selector
& 0xfffc) == 0) {
2286 if (load_segment_ra(env
, &e1
, &e2
, selector
, GETPC()) != 0) {
2290 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
2291 cpl
= env
->hflags
& HF_CPL_MASK
;
2292 if (e2
& DESC_S_MASK
) {
2293 if ((e2
& DESC_CS_MASK
) && (e2
& DESC_C_MASK
)) {
2296 if (dpl
< cpl
|| dpl
< rpl
) {
2301 type
= (e2
>> DESC_TYPE_SHIFT
) & 0xf;
2315 if (dpl
< cpl
|| dpl
< rpl
) {
2317 CC_SRC
= eflags
& ~CC_Z
;
2321 CC_SRC
= eflags
| CC_Z
;
2322 return e2
& 0x00f0ff00;
2325 void helper_verr(CPUX86State
*env
, target_ulong selector1
)
2327 uint32_t e1
, e2
, eflags
, selector
;
2330 selector
= selector1
& 0xffff;
2331 eflags
= cpu_cc_compute_all(env
, CC_OP
);
2332 if ((selector
& 0xfffc) == 0) {
2335 if (load_segment_ra(env
, &e1
, &e2
, selector
, GETPC()) != 0) {
2338 if (!(e2
& DESC_S_MASK
)) {
2342 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
2343 cpl
= env
->hflags
& HF_CPL_MASK
;
2344 if (e2
& DESC_CS_MASK
) {
2345 if (!(e2
& DESC_R_MASK
)) {
2348 if (!(e2
& DESC_C_MASK
)) {
2349 if (dpl
< cpl
|| dpl
< rpl
) {
2354 if (dpl
< cpl
|| dpl
< rpl
) {
2356 CC_SRC
= eflags
& ~CC_Z
;
2360 CC_SRC
= eflags
| CC_Z
;
2363 void helper_verw(CPUX86State
*env
, target_ulong selector1
)
2365 uint32_t e1
, e2
, eflags
, selector
;
2368 selector
= selector1
& 0xffff;
2369 eflags
= cpu_cc_compute_all(env
, CC_OP
);
2370 if ((selector
& 0xfffc) == 0) {
2373 if (load_segment_ra(env
, &e1
, &e2
, selector
, GETPC()) != 0) {
2376 if (!(e2
& DESC_S_MASK
)) {
2380 dpl
= (e2
>> DESC_DPL_SHIFT
) & 3;
2381 cpl
= env
->hflags
& HF_CPL_MASK
;
2382 if (e2
& DESC_CS_MASK
) {
2385 if (dpl
< cpl
|| dpl
< rpl
) {
2388 if (!(e2
& DESC_W_MASK
)) {
2390 CC_SRC
= eflags
& ~CC_Z
;
2394 CC_SRC
= eflags
| CC_Z
;