helper.c@ 644

Last change on this file since 644 was 644, checked in by vboxsync, 18 years ago
Merged in current upstream changes.
Property svn:eol-style set to `native`
File size: 128.9 KB

Line
1	/*
2	* i386 helpers
3	*
4	* Copyright (c) 2003 Fabrice Bellard
5	*
6	* This library is free software; you can redistribute it and/or
7	* modify it under the terms of the GNU Lesser General Public
8	* License as published by the Free Software Foundation; either
9	* version 2 of the License, or (at your option) any later version.
10	*
11	* This library is distributed in the hope that it will be useful,
12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14	* Lesser General Public License for more details.
15	*
16	* You should have received a copy of the GNU Lesser General Public
17	* License along with this library; if not, write to the Free Software
18	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
19	*/
20	#ifdef VBOX
21	# include <VBox/err.h>
22	#endif
23	#include "exec.h"
24
25	//#define DEBUG_PCALL
26
27	#if 0
28	#define raise_exception_err(a, b)\
29	do {\
30	if (logfile)\
31	fprintf(logfile, "raise_exception line=%d\n", __LINE__);\
32	(raise_exception_err)(a, b);\
33	} while (0)
34	#endif
35
36	const uint8_t parity_table[256] = {
37	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
38	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
39	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
40	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
41	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
42	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
43	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
44	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
45	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
46	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
47	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
48	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
49	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
50	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
51	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
52	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
53	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
54	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
55	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
56	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
57	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
58	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
59	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
60	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
61	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
62	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
63	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
64	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
65	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
66	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
67	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
68	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
69	};
70
71	/* modulo 17 table */
72	const uint8_t rclw_table[32] = {
73	0, 1, 2, 3, 4, 5, 6, 7,
74	8, 9,10,11,12,13,14,15,
75	16, 0, 1, 2, 3, 4, 5, 6,
76	7, 8, 9,10,11,12,13,14,
77	};
78
79	/* modulo 9 table */
80	const uint8_t rclb_table[32] = {
81	0, 1, 2, 3, 4, 5, 6, 7,
82	8, 0, 1, 2, 3, 4, 5, 6,
83	7, 8, 0, 1, 2, 3, 4, 5,
84	6, 7, 8, 0, 1, 2, 3, 4,
85	};
86
87	const CPU86_LDouble f15rk[7] =
88	{
89	0.00000000000000000000L,
90	1.00000000000000000000L,
91	3.14159265358979323851L, /pi/
92	0.30102999566398119523L, /lg2/
93	0.69314718055994530943L, /ln2/
94	1.44269504088896340739L, /l2e/
95	3.32192809488736234781L, /l2t/
96	};
97
98	/* thread support */
99
100	spinlock_t global_cpu_lock = SPIN_LOCK_UNLOCKED;
101
102	void cpu_lock(void)
103	{
104	spin_lock(&global_cpu_lock);
105	}
106
107	void cpu_unlock(void)
108	{
109	spin_unlock(&global_cpu_lock);
110	}
111
112	void cpu_loop_exit(void)
113	{
114	/* NOTE: the register at this point must be saved by hand because
115	longjmp restore them */
116	regs_to_env();
117	longjmp(env->jmp_env, 1);
118	}
119
120	/* return non zero if error */
121	static inline int load_segment(uint32_t e1_ptr, uint32_t e2_ptr,
122	int selector)
123	{
124	SegmentCache *dt;
125	int index;
126	target_ulong ptr;
127
128	if (selector & 0x4)
129	dt = &env->ldt;
130	else
131	dt = &env->gdt;
132	index = selector & ~7;
133	if ((index + 7) > dt->limit)
134	return -1;
135	ptr = dt->base + index;
136	*e1_ptr = ldl_kernel(ptr);
137	*e2_ptr = ldl_kernel(ptr + 4);
138	return 0;
139	}
140
141	static inline unsigned int get_seg_limit(uint32_t e1, uint32_t e2)
142	{
143	unsigned int limit;
144	limit = (e1 & 0xffff) \| (e2 & 0x000f0000);
145	if (e2 & DESC_G_MASK)
146	limit = (limit << 12) \| 0xfff;
147	return limit;
148	}
149
150	static inline uint32_t get_seg_base(uint32_t e1, uint32_t e2)
151	{
152	return ((e1 >> 16) \| ((e2 & 0xff) << 16) \| (e2 & 0xff000000));
153	}
154
155	static inline void load_seg_cache_raw_dt(SegmentCache *sc, uint32_t e1, uint32_t e2)
156	{
157	sc->base = get_seg_base(e1, e2);
158	sc->limit = get_seg_limit(e1, e2);
159	sc->flags = e2;
160	}
161
162	/* init the segment cache in vm86 mode. */
163	static inline void load_seg_vm(int seg, int selector)
164	{
165	selector &= 0xffff;
166	cpu_x86_load_seg_cache(env, seg, selector,
167	(selector << 4), 0xffff, 0);
168	}
169
170	static inline void get_ss_esp_from_tss(uint32_t *ss_ptr,
171	uint32_t *esp_ptr, int dpl)
172	{
173	int type, index, shift;
174
175	#if 0
176	{
177	int i;
178	printf("TR: base=%p limit=%x\n", env->tr.base, env->tr.limit);
179	for(i=0;i<env->tr.limit;i++) {
180	printf("%02x ", env->tr.base[i]);
181	if ((i & 7) == 7) printf("\n");
182	}
183	printf("\n");
184	}
185	#endif
186
187	if (!(env->tr.flags & DESC_P_MASK))
188	cpu_abort(env, "invalid tss");
189	type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
190	if ((type & 7) != 1)
191	cpu_abort(env, "invalid tss type %d", type);
192	shift = type >> 3;
193	index = (dpl * 4 + 2) << shift;
194	if (index + (4 << shift) - 1 > env->tr.limit)
195	raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
196	if (shift == 0) {
197	*esp_ptr = lduw_kernel(env->tr.base + index);
198	*ss_ptr = lduw_kernel(env->tr.base + index + 2);
199	} else {
200	*esp_ptr = ldl_kernel(env->tr.base + index);
201	*ss_ptr = lduw_kernel(env->tr.base + index + 4);
202	}
203	}
204
205	/* XXX: merge with load_seg() */
206	static void tss_load_seg(int seg_reg, int selector)
207	{
208	uint32_t e1, e2;
209	int rpl, dpl, cpl;
210
211	if ((selector & 0xfffc) != 0) {
212	if (load_segment(&e1, &e2, selector) != 0)
213	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
214	if (!(e2 & DESC_S_MASK))
215	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
216	rpl = selector & 3;
217	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
218	cpl = env->hflags & HF_CPL_MASK;
219	if (seg_reg == R_CS) {
220	if (!(e2 & DESC_CS_MASK))
221	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
222	/* XXX: is it correct ? */
223	if (dpl != rpl)
224	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
225	if ((e2 & DESC_C_MASK) && dpl > rpl)
226	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
227	} else if (seg_reg == R_SS) {
228	/* SS must be writable data */
229	if ((e2 & DESC_CS_MASK) \|\| !(e2 & DESC_W_MASK))
230	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
231	if (dpl != cpl \|\| dpl != rpl)
232	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
233	} else {
234	/* not readable code */
235	if ((e2 & DESC_CS_MASK) && !(e2 & DESC_R_MASK))
236	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
237	/* if data or non conforming code, checks the rights */
238	if (((e2 >> DESC_TYPE_SHIFT) & 0xf) < 12) {
239	if (dpl < cpl \|\| dpl < rpl)
240	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
241	}
242	}
243	if (!(e2 & DESC_P_MASK))
244	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
245	cpu_x86_load_seg_cache(env, seg_reg, selector,
246	get_seg_base(e1, e2),
247	get_seg_limit(e1, e2),
248	e2);
249	} else {
250	if (seg_reg == R_SS \|\| seg_reg == R_CS)
251	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
252	}
253	}
254
255	#define SWITCH_TSS_JMP 0
256	#define SWITCH_TSS_IRET 1
257	#define SWITCH_TSS_CALL 2
258
259	/* XXX: restore CPU state in registers (PowerPC case) */
260	static void switch_tss(int tss_selector,
261	uint32_t e1, uint32_t e2, int source,
262	uint32_t next_eip)
263	{
264	int tss_limit, tss_limit_max, type, old_tss_limit_max, old_type, v1, v2, i;
265	target_ulong tss_base;
266	uint32_t new_regs[8], new_segs[6];
267	uint32_t new_eflags, new_eip, new_cr3, new_ldt, new_trap;
268	uint32_t old_eflags, eflags_mask;
269	SegmentCache *dt;
270	int index;
271	target_ulong ptr;
272
273	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
274	#ifdef DEBUG_PCALL
275	if (loglevel & CPU_LOG_PCALL)
276	fprintf(logfile, "switch_tss: sel=0x%04x type=%d src=%d\n", tss_selector, type, source);
277	#endif
278
279	#if defined(VBOX) && defined(DEBUG)
280	printf("switch_tss %x %x %x %d %08x\n", tss_selector, e1, e2, source, next_eip);
281	#endif
282
283	/* if task gate, we read the TSS segment and we load it */
284	if (type == 5) {
285	if (!(e2 & DESC_P_MASK))
286	raise_exception_err(EXCP0B_NOSEG, tss_selector & 0xfffc);
287	tss_selector = e1 >> 16;
288	if (tss_selector & 4)
289	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
290	if (load_segment(&e1, &e2, tss_selector) != 0)
291	raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
292	if (e2 & DESC_S_MASK)
293	raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
294	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
295	if ((type & 7) != 1)
296	raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
297	}
298
299	if (!(e2 & DESC_P_MASK))
300	raise_exception_err(EXCP0B_NOSEG, tss_selector & 0xfffc);
301
302	if (type & 8)
303	tss_limit_max = 103;
304	else
305	tss_limit_max = 43;
306	tss_limit = get_seg_limit(e1, e2);
307	tss_base = get_seg_base(e1, e2);
308	if ((tss_selector & 4) != 0 \|\|
309	tss_limit < tss_limit_max)
310	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
311	old_type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
312	if (old_type & 8)
313	old_tss_limit_max = 103;
314	else
315	old_tss_limit_max = 43;
316
317	/* read all the registers from the new TSS */
318	if (type & 8) {
319	/* 32 bit */
320	new_cr3 = ldl_kernel(tss_base + 0x1c);
321	new_eip = ldl_kernel(tss_base + 0x20);
322	new_eflags = ldl_kernel(tss_base + 0x24);
323	for(i = 0; i < 8; i++)
324	new_regs[i] = ldl_kernel(tss_base + (0x28 + i * 4));
325	for(i = 0; i < 6; i++)
326	new_segs[i] = lduw_kernel(tss_base + (0x48 + i * 4));
327	new_ldt = lduw_kernel(tss_base + 0x60);
328	new_trap = ldl_kernel(tss_base + 0x64);
329	} else {
330	/* 16 bit */
331	new_cr3 = 0;
332	new_eip = lduw_kernel(tss_base + 0x0e);
333	new_eflags = lduw_kernel(tss_base + 0x10);
334	for(i = 0; i < 8; i++)
335	new_regs[i] = lduw_kernel(tss_base + (0x12 + i * 2)) \| 0xffff0000;
336	for(i = 0; i < 4; i++)
337	new_segs[i] = lduw_kernel(tss_base + (0x22 + i * 4));
338	new_ldt = lduw_kernel(tss_base + 0x2a);
339	new_segs[R_FS] = 0;
340	new_segs[R_GS] = 0;
341	new_trap = 0;
342	}
343
344	/* NOTE: we must avoid memory exceptions during the task switch,
345	so we make dummy accesses before */
346	/* XXX: it can still fail in some cases, so a bigger hack is
347	necessary to valid the TLB after having done the accesses */
348
349	v1 = ldub_kernel(env->tr.base);
350	v2 = ldub_kernel(env->tr.base + old_tss_limit_max);
351	stb_kernel(env->tr.base, v1);
352	stb_kernel(env->tr.base + old_tss_limit_max, v2);
353
354	/* clear busy bit (it is restartable) */
355	if (source == SWITCH_TSS_JMP \|\| source == SWITCH_TSS_IRET) {
356	target_ulong ptr;
357	uint32_t e2;
358	ptr = env->gdt.base + (env->tr.selector & ~7);
359	e2 = ldl_kernel(ptr + 4);
360	e2 &= ~DESC_TSS_BUSY_MASK;
361	stl_kernel(ptr + 4, e2);
362	}
363	old_eflags = compute_eflags();
364	if (source == SWITCH_TSS_IRET)
365	old_eflags &= ~NT_MASK;
366
367	/* save the current state in the old TSS */
368	if (type & 8) {
369	/* 32 bit */
370	stl_kernel(env->tr.base + 0x20, next_eip);
371	stl_kernel(env->tr.base + 0x24, old_eflags);
372	stl_kernel(env->tr.base + (0x28 + 0 * 4), EAX);
373	stl_kernel(env->tr.base + (0x28 + 1 * 4), ECX);
374	stl_kernel(env->tr.base + (0x28 + 2 * 4), EDX);
375	stl_kernel(env->tr.base + (0x28 + 3 * 4), EBX);
376	stl_kernel(env->tr.base + (0x28 + 4 * 4), ESP);
377	stl_kernel(env->tr.base + (0x28 + 5 * 4), EBP);
378	stl_kernel(env->tr.base + (0x28 + 6 * 4), ESI);
379	stl_kernel(env->tr.base + (0x28 + 7 * 4), EDI);
380	for(i = 0; i < 6; i++)
381	stw_kernel(env->tr.base + (0x48 + i * 4), env->segs[i].selector);
382	#if defined(VBOX) && defined(DEBUG)
383	printf("TSS 32 bits switch\n");
384	printf("Saving CS=%08X\n", env->segs[R_CS].selector);
385	#endif
386	} else {
387	/* 16 bit */
388	stw_kernel(env->tr.base + 0x0e, next_eip);
389	stw_kernel(env->tr.base + 0x10, old_eflags);
390	stw_kernel(env->tr.base + (0x12 + 0 * 2), EAX);
391	stw_kernel(env->tr.base + (0x12 + 1 * 2), ECX);
392	stw_kernel(env->tr.base + (0x12 + 2 * 2), EDX);
393	stw_kernel(env->tr.base + (0x12 + 3 * 2), EBX);
394	stw_kernel(env->tr.base + (0x12 + 4 * 2), ESP);
395	stw_kernel(env->tr.base + (0x12 + 5 * 2), EBP);
396	stw_kernel(env->tr.base + (0x12 + 6 * 2), ESI);
397	stw_kernel(env->tr.base + (0x12 + 7 * 2), EDI);
398	for(i = 0; i < 4; i++)
399	stw_kernel(env->tr.base + (0x22 + i * 4), env->segs[i].selector);
400	}
401
402	/* now if an exception occurs, it will occurs in the next task
403	context */
404
405	if (source == SWITCH_TSS_CALL) {
406	stw_kernel(tss_base, env->tr.selector);
407	new_eflags \|= NT_MASK;
408	}
409
410	/* set busy bit */
411	if (source == SWITCH_TSS_JMP \|\| source == SWITCH_TSS_CALL) {
412	target_ulong ptr;
413	uint32_t e2;
414	ptr = env->gdt.base + (tss_selector & ~7);
415	e2 = ldl_kernel(ptr + 4);
416	e2 \|= DESC_TSS_BUSY_MASK;
417	stl_kernel(ptr + 4, e2);
418	}
419
420	/* set the new CPU state */
421	/* from this point, any exception which occurs can give problems */
422	env->cr[0] \|= CR0_TS_MASK;
423	env->hflags \|= HF_TS_MASK;
424	env->tr.selector = tss_selector;
425	env->tr.base = tss_base;
426	env->tr.limit = tss_limit;
427	env->tr.flags = e2 & ~DESC_TSS_BUSY_MASK;
428
429	if ((type & 8) && (env->cr[0] & CR0_PG_MASK)) {
430	cpu_x86_update_cr3(env, new_cr3);
431	}
432
433	/* load all registers without an exception, then reload them with
434	possible exception */
435	env->eip = new_eip;
436	eflags_mask = TF_MASK \| AC_MASK \| ID_MASK \|
437	IF_MASK \| IOPL_MASK \| VM_MASK \| RF_MASK \| NT_MASK;
438	if (!(type & 8))
439	eflags_mask &= 0xffff;
440	load_eflags(new_eflags, eflags_mask);
441	/* XXX: what to do in 16 bit case ? */
442	EAX = new_regs[0];
443	ECX = new_regs[1];
444	EDX = new_regs[2];
445	EBX = new_regs[3];
446	ESP = new_regs[4];
447	EBP = new_regs[5];
448	ESI = new_regs[6];
449	EDI = new_regs[7];
450	if (new_eflags & VM_MASK) {
451	for(i = 0; i < 6; i++)
452	load_seg_vm(i, new_segs[i]);
453	/* in vm86, CPL is always 3 */
454	cpu_x86_set_cpl(env, 3);
455	} else {
456	/* CPL is set the RPL of CS */
457	cpu_x86_set_cpl(env, new_segs[R_CS] & 3);
458	/* first just selectors as the rest may trigger exceptions */
459	for(i = 0; i < 6; i++)
460	cpu_x86_load_seg_cache(env, i, new_segs[i], 0, 0, 0);
461	}
462
463	env->ldt.selector = new_ldt & ~4;
464	env->ldt.base = 0;
465	env->ldt.limit = 0;
466	env->ldt.flags = 0;
467
468	/* load the LDT */
469	if (new_ldt & 4)
470	raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
471
472	if ((new_ldt & 0xfffc) != 0) {
473	dt = &env->gdt;
474	index = new_ldt & ~7;
475	if ((index + 7) > dt->limit)
476	raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
477	ptr = dt->base + index;
478	e1 = ldl_kernel(ptr);
479	e2 = ldl_kernel(ptr + 4);
480	if ((e2 & DESC_S_MASK) \|\| ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2)
481	raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
482	if (!(e2 & DESC_P_MASK))
483	raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
484	load_seg_cache_raw_dt(&env->ldt, e1, e2);
485	}
486
487	/* load the segments */
488	if (!(new_eflags & VM_MASK)) {
489	tss_load_seg(R_CS, new_segs[R_CS]);
490	tss_load_seg(R_SS, new_segs[R_SS]);
491	tss_load_seg(R_ES, new_segs[R_ES]);
492	tss_load_seg(R_DS, new_segs[R_DS]);
493	tss_load_seg(R_FS, new_segs[R_FS]);
494	tss_load_seg(R_GS, new_segs[R_GS]);
495	}
496
497	/* check that EIP is in the CS segment limits */
498	if (new_eip > env->segs[R_CS].limit) {
499	/* XXX: different exception if CALL ? */
500	raise_exception_err(EXCP0D_GPF, 0);
501	}
502	}
503
504	/* check if Port I/O is allowed in TSS */
505	static inline void check_io(int addr, int size)
506	{
507	int io_offset, val, mask;
508
509	/* TSS must be a valid 32 bit one */
510	if (!(env->tr.flags & DESC_P_MASK) \|\|
511	((env->tr.flags >> DESC_TYPE_SHIFT) & 0xf) != 9 \|\|
512	env->tr.limit < 103)
513	goto fail;
514	io_offset = lduw_kernel(env->tr.base + 0x66);
515	io_offset += (addr >> 3);
516	/* Note: the check needs two bytes */
517	if ((io_offset + 1) > env->tr.limit)
518	goto fail;
519	val = lduw_kernel(env->tr.base + io_offset);
520	val >>= (addr & 7);
521	mask = (1 << size) - 1;
522	/* all bits must be zero to allow the I/O */
523	if ((val & mask) != 0) {
524	fail:
525	raise_exception_err(EXCP0D_GPF, 0);
526	}
527	}
528
529	void check_iob_T0(void)
530	{
531	check_io(T0, 1);
532	}
533
534	void check_iow_T0(void)
535	{
536	check_io(T0, 2);
537	}
538
539	void check_iol_T0(void)
540	{
541	check_io(T0, 4);
542	}
543
544	void check_iob_DX(void)
545	{
546	check_io(EDX & 0xffff, 1);
547	}
548
549	void check_iow_DX(void)
550	{
551	check_io(EDX & 0xffff, 2);
552	}
553
554	void check_iol_DX(void)
555	{
556	check_io(EDX & 0xffff, 4);
557	}
558
559	static inline unsigned int get_sp_mask(unsigned int e2)
560	{
561	if (e2 & DESC_B_MASK)
562	return 0xffffffff;
563	else
564	return 0xffff;
565	}
566
567	#ifdef TARGET_X86_64
568	#define SET_ESP(val, sp_mask)\
569	do {\
570	if ((sp_mask) == 0xffff)\
571	ESP = (ESP & ~0xffff) \| ((val) & 0xffff);\
572	else if ((sp_mask) == 0xffffffffLL)\
573	ESP = (uint32_t)(val);\
574	else\
575	ESP = (val);\
576	} while (0)
577	#else
578	#define SET_ESP(val, sp_mask) ESP = (ESP & ~(sp_mask)) \| ((val) & (sp_mask))
579	#endif
580
581	/* XXX: add a is_user flag to have proper security support */
582	#define PUSHW(ssp, sp, sp_mask, val)\
583	{\
584	sp -= 2;\
585	stw_kernel((ssp) + (sp & (sp_mask)), (val));\
586	}
587
588	#define PUSHL(ssp, sp, sp_mask, val)\
589	{\
590	sp -= 4;\
591	stl_kernel((ssp) + (sp & (sp_mask)), (val));\
592	}
593
594	#define POPW(ssp, sp, sp_mask, val)\
595	{\
596	val = lduw_kernel((ssp) + (sp & (sp_mask)));\
597	sp += 2;\
598	}
599
600	#define POPL(ssp, sp, sp_mask, val)\
601	{\
602	val = (uint32_t)ldl_kernel((ssp) + (sp & (sp_mask)));\
603	sp += 4;\
604	}
605
606	/* protected mode interrupt */
607	static void do_interrupt_protected(int intno, int is_int, int error_code,
608	unsigned int next_eip, int is_hw)
609	{
610	SegmentCache *dt;
611	target_ulong ptr, ssp;
612	int type, dpl, selector, ss_dpl, cpl;
613	int has_error_code, new_stack, shift;
614	uint32_t e1, e2, offset, ss, esp, ss_e1, ss_e2;
615	uint32_t old_eip, sp_mask;
616
617	#ifdef VBOX
618	if (remR3NotifyTrap(env, intno, error_code, next_eip) != VINF_SUCCESS)
619	cpu_loop_exit();
620	#endif
621
622	has_error_code = 0;
623	if (!is_int && !is_hw) {
624	switch(intno) {
625	case 8:
626	case 10:
627	case 11:
628	case 12:
629	case 13:
630	case 14:
631	case 17:
632	has_error_code = 1;
633	break;
634	}
635	}
636	if (is_int)
637	old_eip = next_eip;
638	else
639	old_eip = env->eip;
640
641	dt = &env->idt;
642	if (intno * 8 + 7 > dt->limit)
643	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
644	ptr = dt->base + intno * 8;
645	e1 = ldl_kernel(ptr);
646	e2 = ldl_kernel(ptr + 4);
647	/* check gate type */
648	type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
649	switch(type) {
650	case 5: /* task gate */
651	/* must do that check here to return the correct error code */
652	if (!(e2 & DESC_P_MASK))
653	raise_exception_err(EXCP0B_NOSEG, intno * 8 + 2);
654	switch_tss(intno * 8, e1, e2, SWITCH_TSS_CALL, old_eip);
655	if (has_error_code) {
656	int type;
657	uint32_t mask;
658	/* push the error code */
659	type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
660	shift = type >> 3;
661	if (env->segs[R_SS].flags & DESC_B_MASK)
662	mask = 0xffffffff;
663	else
664	mask = 0xffff;
665	esp = (ESP - (2 << shift)) & mask;
666	ssp = env->segs[R_SS].base + esp;
667	if (shift)
668	stl_kernel(ssp, error_code);
669	else
670	stw_kernel(ssp, error_code);
671	SET_ESP(esp, mask);
672	}
673	return;
674	case 6: /* 286 interrupt gate */
675	case 7: /* 286 trap gate */
676	case 14: /* 386 interrupt gate */
677	case 15: /* 386 trap gate */
678	break;
679	default:
680	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
681	break;
682	}
683	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
684	cpl = env->hflags & HF_CPL_MASK;
685	/* check privledge if software int */
686	if (is_int && dpl < cpl)
687	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
688	/* check valid bit */
689	if (!(e2 & DESC_P_MASK))
690	raise_exception_err(EXCP0B_NOSEG, intno * 8 + 2);
691	selector = e1 >> 16;
692	offset = (e2 & 0xffff0000) \| (e1 & 0x0000ffff);
693	if ((selector & 0xfffc) == 0)
694	raise_exception_err(EXCP0D_GPF, 0);
695
696	if (load_segment(&e1, &e2, selector) != 0)
697	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
698	if (!(e2 & DESC_S_MASK) \|\| !(e2 & (DESC_CS_MASK)))
699	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
700	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
701	if (dpl > cpl)
702	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
703	if (!(e2 & DESC_P_MASK))
704	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
705	if (!(e2 & DESC_C_MASK) && dpl < cpl) {
706	/* to inner priviledge */
707	get_ss_esp_from_tss(&ss, &esp, dpl);
708	if ((ss & 0xfffc) == 0)
709	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
710	if ((ss & 3) != dpl)
711	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
712	if (load_segment(&ss_e1, &ss_e2, ss) != 0)
713	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
714	ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
715	if (ss_dpl != dpl)
716	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
717	if (!(ss_e2 & DESC_S_MASK) \|\|
718	(ss_e2 & DESC_CS_MASK) \|\|
719	!(ss_e2 & DESC_W_MASK))
720	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
721	if (!(ss_e2 & DESC_P_MASK))
722	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
723	new_stack = 1;
724	sp_mask = get_sp_mask(ss_e2);
725	ssp = get_seg_base(ss_e1, ss_e2);
726	#if defined(VBOX) && defined(DEBUG)
727	printf("new stack %04X:%08X gate dpl=%d\n", ss, esp, dpl);
728	#endif
729	} else if ((e2 & DESC_C_MASK) \|\| dpl == cpl) {
730	/* to same priviledge */
731	if (env->eflags & VM_MASK)
732	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
733	new_stack = 0;
734	sp_mask = get_sp_mask(env->segs[R_SS].flags);
735	ssp = env->segs[R_SS].base;
736	esp = ESP;
737	dpl = cpl;
738	} else {
739	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
740	new_stack = 0; /* avoid warning */
741	sp_mask = 0; /* avoid warning */
742	ssp = 0; /* avoid warning */
743	esp = 0; /* avoid warning */
744	}
745
746	shift = type >> 3;
747
748	#if 0
749	/* XXX: check that enough room is available */
750	push_size = 6 + (new_stack << 2) + (has_error_code << 1);
751	if (env->eflags & VM_MASK)
752	push_size += 8;
753	push_size <<= shift;
754	#endif
755	if (shift == 1) {
756	if (new_stack) {
757	if (env->eflags & VM_MASK) {
758	PUSHL(ssp, esp, sp_mask, env->segs[R_GS].selector);
759	PUSHL(ssp, esp, sp_mask, env->segs[R_FS].selector);
760	PUSHL(ssp, esp, sp_mask, env->segs[R_DS].selector);
761	PUSHL(ssp, esp, sp_mask, env->segs[R_ES].selector);
762	}
763	PUSHL(ssp, esp, sp_mask, env->segs[R_SS].selector);
764	PUSHL(ssp, esp, sp_mask, ESP);
765	}
766	PUSHL(ssp, esp, sp_mask, compute_eflags());
767	PUSHL(ssp, esp, sp_mask, env->segs[R_CS].selector);
768	PUSHL(ssp, esp, sp_mask, old_eip);
769	if (has_error_code) {
770	PUSHL(ssp, esp, sp_mask, error_code);
771	}
772	} else {
773	if (new_stack) {
774	if (env->eflags & VM_MASK) {
775	PUSHW(ssp, esp, sp_mask, env->segs[R_GS].selector);
776	PUSHW(ssp, esp, sp_mask, env->segs[R_FS].selector);
777	PUSHW(ssp, esp, sp_mask, env->segs[R_DS].selector);
778	PUSHW(ssp, esp, sp_mask, env->segs[R_ES].selector);
779	}
780	PUSHW(ssp, esp, sp_mask, env->segs[R_SS].selector);
781	PUSHW(ssp, esp, sp_mask, ESP);
782	}
783	PUSHW(ssp, esp, sp_mask, compute_eflags());
784	PUSHW(ssp, esp, sp_mask, env->segs[R_CS].selector);
785	PUSHW(ssp, esp, sp_mask, old_eip);
786	if (has_error_code) {
787	PUSHW(ssp, esp, sp_mask, error_code);
788	}
789	}
790
791	if (new_stack) {
792	if (env->eflags & VM_MASK) {
793	cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0, 0);
794	cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0, 0);
795	cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0, 0);
796	cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0, 0);
797	}
798	ss = (ss & ~3) \| dpl;
799	cpu_x86_load_seg_cache(env, R_SS, ss,
800	ssp, get_seg_limit(ss_e1, ss_e2), ss_e2);
801	}
802	SET_ESP(esp, sp_mask);
803
804	selector = (selector & ~3) \| dpl;
805	cpu_x86_load_seg_cache(env, R_CS, selector,
806	get_seg_base(e1, e2),
807	get_seg_limit(e1, e2),
808	e2);
809	cpu_x86_set_cpl(env, dpl);
810	env->eip = offset;
811
812	/* interrupt gate clear IF mask */
813	if ((type & 1) == 0) {
814	env->eflags &= ~IF_MASK;
815	}
816	env->eflags &= ~(TF_MASK \| VM_MASK \| RF_MASK \| NT_MASK);
817	}
818
819	#ifdef TARGET_X86_64
820
821	#define PUSHQ(sp, val)\
822	{\
823	sp -= 8;\
824	stq_kernel(sp, (val));\
825	}
826
827	#define POPQ(sp, val)\
828	{\
829	val = ldq_kernel(sp);\
830	sp += 8;\
831	}
832
833	static inline target_ulong get_rsp_from_tss(int level)
834	{
835	int index;
836
837	#if 0
838	printf("TR: base=" TARGET_FMT_lx " limit=%x\n",
839	env->tr.base, env->tr.limit);
840	#endif
841
842	if (!(env->tr.flags & DESC_P_MASK))
843	cpu_abort(env, "invalid tss");
844	index = 8 * level + 4;
845	if ((index + 7) > env->tr.limit)
846	raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
847	return ldq_kernel(env->tr.base + index);
848	}
849
850	/* 64 bit interrupt */
851	static void do_interrupt64(int intno, int is_int, int error_code,
852	target_ulong next_eip, int is_hw)
853	{
854	SegmentCache *dt;
855	target_ulong ptr;
856	int type, dpl, selector, cpl, ist;
857	int has_error_code, new_stack;
858	uint32_t e1, e2, e3, ss;
859	target_ulong old_eip, esp, offset;
860
861	has_error_code = 0;
862	if (!is_int && !is_hw) {
863	switch(intno) {
864	case 8:
865	case 10:
866	case 11:
867	case 12:
868	case 13:
869	case 14:
870	case 17:
871	has_error_code = 1;
872	break;
873	}
874	}
875	if (is_int)
876	old_eip = next_eip;
877	else
878	old_eip = env->eip;
879
880	dt = &env->idt;
881	if (intno * 16 + 15 > dt->limit)
882	raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
883	ptr = dt->base + intno * 16;
884	e1 = ldl_kernel(ptr);
885	e2 = ldl_kernel(ptr + 4);
886	e3 = ldl_kernel(ptr + 8);
887	/* check gate type */
888	type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
889	switch(type) {
890	case 14: /* 386 interrupt gate */
891	case 15: /* 386 trap gate */
892	break;
893	default:
894	raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
895	break;
896	}
897	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
898	cpl = env->hflags & HF_CPL_MASK;
899	/* check privledge if software int */
900	if (is_int && dpl < cpl)
901	raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
902	/* check valid bit */
903	if (!(e2 & DESC_P_MASK))
904	raise_exception_err(EXCP0B_NOSEG, intno * 16 + 2);
905	selector = e1 >> 16;
906	offset = ((target_ulong)e3 << 32) \| (e2 & 0xffff0000) \| (e1 & 0x0000ffff);
907	ist = e2 & 7;
908	if ((selector & 0xfffc) == 0)
909	raise_exception_err(EXCP0D_GPF, 0);
910
911	if (load_segment(&e1, &e2, selector) != 0)
912	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
913	if (!(e2 & DESC_S_MASK) \|\| !(e2 & (DESC_CS_MASK)))
914	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
915	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
916	if (dpl > cpl)
917	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
918	if (!(e2 & DESC_P_MASK))
919	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
920	if (!(e2 & DESC_L_MASK) \|\| (e2 & DESC_B_MASK))
921	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
922	if ((!(e2 & DESC_C_MASK) && dpl < cpl) \|\| ist != 0) {
923	/* to inner priviledge */
924	if (ist != 0)
925	esp = get_rsp_from_tss(ist + 3);
926	else
927	esp = get_rsp_from_tss(dpl);
928	esp &= ~0xfLL; /* align stack */
929	ss = 0;
930	new_stack = 1;
931	} else if ((e2 & DESC_C_MASK) \|\| dpl == cpl) {
932	/* to same priviledge */
933	if (env->eflags & VM_MASK)
934	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
935	new_stack = 0;
936	if (ist != 0)
937	esp = get_rsp_from_tss(ist + 3);
938	else
939	esp = ESP;
940	esp &= ~0xfLL; /* align stack */
941	dpl = cpl;
942	} else {
943	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
944	new_stack = 0; /* avoid warning */
945	esp = 0; /* avoid warning */
946	}
947
948	PUSHQ(esp, env->segs[R_SS].selector);
949	PUSHQ(esp, ESP);
950	PUSHQ(esp, compute_eflags());
951	PUSHQ(esp, env->segs[R_CS].selector);
952	PUSHQ(esp, old_eip);
953	if (has_error_code) {
954	PUSHQ(esp, error_code);
955	}
956
957	if (new_stack) {
958	ss = 0 \| dpl;
959	cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, 0);
960	}
961	ESP = esp;
962
963	selector = (selector & ~3) \| dpl;
964	cpu_x86_load_seg_cache(env, R_CS, selector,
965	get_seg_base(e1, e2),
966	get_seg_limit(e1, e2),
967	e2);
968	cpu_x86_set_cpl(env, dpl);
969	env->eip = offset;
970
971	/* interrupt gate clear IF mask */
972	if ((type & 1) == 0) {
973	env->eflags &= ~IF_MASK;
974	}
975	env->eflags &= ~(TF_MASK \| VM_MASK \| RF_MASK \| NT_MASK);
976	}
977	#endif
978
979	void helper_syscall(int next_eip_addend)
980	{
981	int selector;
982
983	if (!(env->efer & MSR_EFER_SCE)) {
984	raise_exception_err(EXCP06_ILLOP, 0);
985	}
986	selector = (env->star >> 32) & 0xffff;
987	#ifdef TARGET_X86_64
988	if (env->hflags & HF_LMA_MASK) {
989	int code64;
990
991	ECX = env->eip + next_eip_addend;
992	env->regs[11] = compute_eflags();
993
994	code64 = env->hflags & HF_CS64_MASK;
995
996	cpu_x86_set_cpl(env, 0);
997	cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
998	0, 0xffffffff,
999	DESC_G_MASK \| DESC_P_MASK \|
1000	DESC_S_MASK \|
1001	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK \| DESC_L_MASK);
1002	cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
1003	0, 0xffffffff,
1004	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1005	DESC_S_MASK \|
1006	DESC_W_MASK \| DESC_A_MASK);
1007	env->eflags &= ~env->fmask;
1008	if (code64)
1009	env->eip = env->lstar;
1010	else
1011	env->eip = env->cstar;
1012	} else
1013	#endif
1014	{
1015	ECX = (uint32_t)(env->eip + next_eip_addend);
1016
1017	cpu_x86_set_cpl(env, 0);
1018	cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
1019	0, 0xffffffff,
1020	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1021	DESC_S_MASK \|
1022	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
1023	cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
1024	0, 0xffffffff,
1025	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1026	DESC_S_MASK \|
1027	DESC_W_MASK \| DESC_A_MASK);
1028	env->eflags &= ~(IF_MASK \| RF_MASK \| VM_MASK);
1029	env->eip = (uint32_t)env->star;
1030	}
1031	}
1032
1033	void helper_sysret(int dflag)
1034	{
1035	int cpl, selector;
1036
1037	if (!(env->efer & MSR_EFER_SCE)) {
1038	raise_exception_err(EXCP06_ILLOP, 0);
1039	}
1040	cpl = env->hflags & HF_CPL_MASK;
1041	if (!(env->cr[0] & CR0_PE_MASK) \|\| cpl != 0) {
1042	raise_exception_err(EXCP0D_GPF, 0);
1043	}
1044	selector = (env->star >> 48) & 0xffff;
1045	#ifdef TARGET_X86_64
1046	if (env->hflags & HF_LMA_MASK) {
1047	if (dflag == 2) {
1048	cpu_x86_load_seg_cache(env, R_CS, (selector + 16) \| 3,
1049	0, 0xffffffff,
1050	DESC_G_MASK \| DESC_P_MASK \|
1051	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1052	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK \|
1053	DESC_L_MASK);
1054	env->eip = ECX;
1055	} else {
1056	cpu_x86_load_seg_cache(env, R_CS, selector \| 3,
1057	0, 0xffffffff,
1058	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1059	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1060	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
1061	env->eip = (uint32_t)ECX;
1062	}
1063	cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1064	0, 0xffffffff,
1065	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1066	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1067	DESC_W_MASK \| DESC_A_MASK);
1068	load_eflags((uint32_t)(env->regs[11]), TF_MASK \| AC_MASK \| ID_MASK \|
1069	IF_MASK \| IOPL_MASK \| VM_MASK \| RF_MASK \| NT_MASK);
1070	cpu_x86_set_cpl(env, 3);
1071	} else
1072	#endif
1073	{
1074	cpu_x86_load_seg_cache(env, R_CS, selector \| 3,
1075	0, 0xffffffff,
1076	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1077	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1078	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
1079	env->eip = (uint32_t)ECX;
1080	cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1081	0, 0xffffffff,
1082	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1083	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1084	DESC_W_MASK \| DESC_A_MASK);
1085	env->eflags \|= IF_MASK;
1086	cpu_x86_set_cpl(env, 3);
1087	}
1088	#ifdef USE_KQEMU
1089	if (kqemu_is_ok(env)) {
1090	if (env->hflags & HF_LMA_MASK)
1091	CC_OP = CC_OP_EFLAGS;
1092	env->exception_index = -1;
1093	cpu_loop_exit();
1094	}
1095	#endif
1096	}
1097
1098	#ifdef VBOX
1099	/**
1100	* Checks and processes external VMM events.
1101	* Called by op_check_external_event() when any of the flags is set and can be serviced.
1102	*/
1103	void helper_external_event(void)
1104	{
1105	#if defined(__DARWIN__) && defined(VBOX_STRICT)
1106	# if 0
1107	//uintptr_t uFrameAddr = (uintptr_t)__builtin_frame_address(0); - this is broken (uses %ebp)
1108	//AssertMsg(!( (uFrameAddr - sizeof(uintptr_t)) & 7 ), ("uFrameAddr=%#p\n", uFrameAddr));
1109	# else
1110	uintptr_t uESP;
1111	__asm__ __volatile__("movl %%esp, %0" : "=r" (uESP));
1112	AssertMsg(!(uESP & 15), ("esp=%#p\n", uESP));
1113	# endif
1114	#endif
1115	if (env->interrupt_request & CPU_INTERRUPT_EXTERNAL_HARD)
1116	{
1117	ASMAtomicAndS32(&env->interrupt_request, ~CPU_INTERRUPT_EXTERNAL_HARD);
1118	cpu_interrupt(env, CPU_INTERRUPT_HARD);
1119	}
1120	if (env->interrupt_request & CPU_INTERRUPT_EXTERNAL_EXIT)
1121	{
1122	ASMAtomicAndS32(&env->interrupt_request, ~CPU_INTERRUPT_EXTERNAL_EXIT);
1123	cpu_interrupt(env, CPU_INTERRUPT_EXIT);
1124	}
1125	if (env->interrupt_request & CPU_INTERRUPT_EXTERNAL_DMA)
1126	{
1127	ASMAtomicAndS32(&env->interrupt_request, ~CPU_INTERRUPT_EXTERNAL_DMA);
1128	remR3DmaRun(env);
1129	}
1130	if (env->interrupt_request & CPU_INTERRUPT_EXTERNAL_TIMER)
1131	{
1132	ASMAtomicAndS32(&env->interrupt_request, ~CPU_INTERRUPT_EXTERNAL_TIMER);
1133	remR3TimersRun(env);
1134	}
1135	}
1136	#endif /* VBOX */
1137
1138	/* real mode interrupt */
1139	static void do_interrupt_real(int intno, int is_int, int error_code,
1140	unsigned int next_eip)
1141	{
1142	SegmentCache *dt;
1143	target_ulong ptr, ssp;
1144	int selector;
1145	uint32_t offset, esp;
1146	uint32_t old_cs, old_eip;
1147
1148	/* real mode (simpler !) */
1149	dt = &env->idt;
1150	if (intno * 4 + 3 > dt->limit)
1151	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
1152	ptr = dt->base + intno * 4;
1153	offset = lduw_kernel(ptr);
1154	selector = lduw_kernel(ptr + 2);
1155	esp = ESP;
1156	ssp = env->segs[R_SS].base;
1157	if (is_int)
1158	old_eip = next_eip;
1159	else
1160	old_eip = env->eip;
1161	old_cs = env->segs[R_CS].selector;
1162	/* XXX: use SS segment size ? */
1163	PUSHW(ssp, esp, 0xffff, compute_eflags());
1164	PUSHW(ssp, esp, 0xffff, old_cs);
1165	PUSHW(ssp, esp, 0xffff, old_eip);
1166
1167	/* update processor state */
1168	ESP = (ESP & ~0xffff) \| (esp & 0xffff);
1169	env->eip = offset;
1170	env->segs[R_CS].selector = selector;
1171	env->segs[R_CS].base = (selector << 4);
1172	env->eflags &= ~(IF_MASK \| TF_MASK \| AC_MASK \| RF_MASK);
1173	}
1174
1175	/* fake user mode interrupt */
1176	void do_interrupt_user(int intno, int is_int, int error_code,
1177	target_ulong next_eip)
1178	{
1179	SegmentCache *dt;
1180	target_ulong ptr;
1181	int dpl, cpl;
1182	uint32_t e2;
1183
1184	dt = &env->idt;
1185	ptr = dt->base + (intno * 8);
1186	e2 = ldl_kernel(ptr + 4);
1187
1188	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1189	cpl = env->hflags & HF_CPL_MASK;
1190	/* check privledge if software int */
1191	if (is_int && dpl < cpl)
1192	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
1193
1194	/* Since we emulate only user space, we cannot do more than
1195	exiting the emulation with the suitable exception and error
1196	code */
1197	if (is_int)
1198	EIP = next_eip;
1199	}
1200
1201	/*
1202	* Begin execution of an interruption. is_int is TRUE if coming from
1203	* the int instruction. next_eip is the EIP value AFTER the interrupt
1204	* instruction. It is only relevant if is_int is TRUE.
1205	*/
1206	void do_interrupt(int intno, int is_int, int error_code,
1207	target_ulong next_eip, int is_hw)
1208	{
1209	if (loglevel & CPU_LOG_INT) {
1210	if ((env->cr[0] & CR0_PE_MASK)) {
1211	static int count;
1212	fprintf(logfile, "%6d: v=%02x e=%04x i=%d cpl=%d IP=%04x:" TARGET_FMT_lx " pc=" TARGET_FMT_lx " SP=%04x:" TARGET_FMT_lx,
1213	count, intno, error_code, is_int,
1214	env->hflags & HF_CPL_MASK,
1215	env->segs[R_CS].selector, EIP,
1216	(int)env->segs[R_CS].base + EIP,
1217	env->segs[R_SS].selector, ESP);
1218	if (intno == 0x0e) {
1219	fprintf(logfile, " CR2=" TARGET_FMT_lx, env->cr[2]);
1220	} else {
1221	fprintf(logfile, " EAX=" TARGET_FMT_lx, EAX);
1222	}
1223	fprintf(logfile, "\n");
1224	cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
1225	#if 0
1226	{
1227	int i;
1228	uint8_t *ptr;
1229	fprintf(logfile, " code=");
1230	ptr = env->segs[R_CS].base + env->eip;
1231	for(i = 0; i < 16; i++) {
1232	fprintf(logfile, " %02x", ldub(ptr + i));
1233	}
1234	fprintf(logfile, "\n");
1235	}
1236	#endif
1237	count++;
1238	}
1239	}
1240	if (env->cr[0] & CR0_PE_MASK) {
1241	#if TARGET_X86_64
1242	if (env->hflags & HF_LMA_MASK) {
1243	do_interrupt64(intno, is_int, error_code, next_eip, is_hw);
1244	} else
1245	#endif
1246	{
1247	do_interrupt_protected(intno, is_int, error_code, next_eip, is_hw);
1248	}
1249	} else {
1250	do_interrupt_real(intno, is_int, error_code, next_eip);
1251	}
1252	}
1253
1254	/*
1255	* Signal an interruption. It is executed in the main CPU loop.
1256	* is_int is TRUE if coming from the int instruction. next_eip is the
1257	* EIP value AFTER the interrupt instruction. It is only relevant if
1258	* is_int is TRUE.
1259	*/
1260	void raise_interrupt(int intno, int is_int, int error_code,
1261	int next_eip_addend)
1262	{
1263	#if defined(VBOX) && defined(DEBUG) && !defined(DEBUG_dmik)
1264	Log2(("raise_interrupt: %x %x %x %08x\n", intno, is_int, error_code, env->eip + next_eip_addend));
1265	#endif
1266	env->exception_index = intno;
1267	env->error_code = error_code;
1268	env->exception_is_int = is_int;
1269	env->exception_next_eip = env->eip + next_eip_addend;
1270	cpu_loop_exit();
1271	}
1272
1273	/* same as raise_exception_err, but do not restore global registers */
1274	static void raise_exception_err_norestore(int exception_index, int error_code)
1275	{
1276	env->exception_index = exception_index;
1277	env->error_code = error_code;
1278	env->exception_is_int = 0;
1279	env->exception_next_eip = 0;
1280	longjmp(env->jmp_env, 1);
1281	}
1282
1283	/* shortcuts to generate exceptions */
1284
1285	void (raise_exception_err)(int exception_index, int error_code)
1286	{
1287	raise_interrupt(exception_index, 0, error_code, 0);
1288	}
1289
1290	void raise_exception(int exception_index)
1291	{
1292	raise_interrupt(exception_index, 0, 0, 0);
1293	}
1294
1295	/* SMM support */
1296
1297	#if defined(CONFIG_USER_ONLY)
1298
1299	void do_smm_enter(void)
1300	{
1301	}
1302
1303	void helper_rsm(void)
1304	{
1305	}
1306
1307	#else
1308
1309	#ifdef TARGET_X86_64
1310	#define SMM_REVISION_ID 0x00020064
1311	#else
1312	#define SMM_REVISION_ID 0x00020000
1313	#endif
1314
1315	void do_smm_enter(void)
1316	{
1317	#ifdef VBOX
1318	cpu_abort(env, "do_ssm_enter");
1319	#else /* !VBOX */
1320	target_ulong sm_state;
1321	SegmentCache *dt;
1322	int i, offset;
1323
1324	if (loglevel & CPU_LOG_INT) {
1325	fprintf(logfile, "SMM: enter\n");
1326	cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
1327	}
1328
1329	env->hflags \|= HF_SMM_MASK;
1330	cpu_smm_update(env);
1331
1332	sm_state = env->smbase + 0x8000;
1333
1334	#ifdef TARGET_X86_64
1335	for(i = 0; i < 6; i++) {
1336	dt = &env->segs[i];
1337	offset = 0x7e00 + i * 16;
1338	stw_phys(sm_state + offset, dt->selector);
1339	stw_phys(sm_state + offset + 2, (dt->flags >> 8) & 0xf0ff);
1340	stl_phys(sm_state + offset + 4, dt->limit);
1341	stq_phys(sm_state + offset + 8, dt->base);
1342	}
1343
1344	stq_phys(sm_state + 0x7e68, env->gdt.base);
1345	stl_phys(sm_state + 0x7e64, env->gdt.limit);
1346
1347	stw_phys(sm_state + 0x7e70, env->ldt.selector);
1348	stq_phys(sm_state + 0x7e78, env->ldt.base);
1349	stl_phys(sm_state + 0x7e74, env->ldt.limit);
1350	stw_phys(sm_state + 0x7e72, (env->ldt.flags >> 8) & 0xf0ff);
1351
1352	stq_phys(sm_state + 0x7e88, env->idt.base);
1353	stl_phys(sm_state + 0x7e84, env->idt.limit);
1354
1355	stw_phys(sm_state + 0x7e90, env->tr.selector);
1356	stq_phys(sm_state + 0x7e98, env->tr.base);
1357	stl_phys(sm_state + 0x7e94, env->tr.limit);
1358	stw_phys(sm_state + 0x7e92, (env->tr.flags >> 8) & 0xf0ff);
1359
1360	stq_phys(sm_state + 0x7ed0, env->efer);
1361
1362	stq_phys(sm_state + 0x7ff8, EAX);
1363	stq_phys(sm_state + 0x7ff0, ECX);
1364	stq_phys(sm_state + 0x7fe8, EDX);
1365	stq_phys(sm_state + 0x7fe0, EBX);
1366	stq_phys(sm_state + 0x7fd8, ESP);
1367	stq_phys(sm_state + 0x7fd0, EBP);
1368	stq_phys(sm_state + 0x7fc8, ESI);
1369	stq_phys(sm_state + 0x7fc0, EDI);
1370	for(i = 8; i < 16; i++)
1371	stq_phys(sm_state + 0x7ff8 - i * 8, env->regs[i]);
1372	stq_phys(sm_state + 0x7f78, env->eip);
1373	stl_phys(sm_state + 0x7f70, compute_eflags());
1374	stl_phys(sm_state + 0x7f68, env->dr[6]);
1375	stl_phys(sm_state + 0x7f60, env->dr[7]);
1376
1377	stl_phys(sm_state + 0x7f48, env->cr[4]);
1378	stl_phys(sm_state + 0x7f50, env->cr[3]);
1379	stl_phys(sm_state + 0x7f58, env->cr[0]);
1380
1381	stl_phys(sm_state + 0x7efc, SMM_REVISION_ID);
1382	stl_phys(sm_state + 0x7f00, env->smbase);
1383	#else
1384	stl_phys(sm_state + 0x7ffc, env->cr[0]);
1385	stl_phys(sm_state + 0x7ff8, env->cr[3]);
1386	stl_phys(sm_state + 0x7ff4, compute_eflags());
1387	stl_phys(sm_state + 0x7ff0, env->eip);
1388	stl_phys(sm_state + 0x7fec, EDI);
1389	stl_phys(sm_state + 0x7fe8, ESI);
1390	stl_phys(sm_state + 0x7fe4, EBP);
1391	stl_phys(sm_state + 0x7fe0, ESP);
1392	stl_phys(sm_state + 0x7fdc, EBX);
1393	stl_phys(sm_state + 0x7fd8, EDX);
1394	stl_phys(sm_state + 0x7fd4, ECX);
1395	stl_phys(sm_state + 0x7fd0, EAX);
1396	stl_phys(sm_state + 0x7fcc, env->dr[6]);
1397	stl_phys(sm_state + 0x7fc8, env->dr[7]);
1398
1399	stl_phys(sm_state + 0x7fc4, env->tr.selector);
1400	stl_phys(sm_state + 0x7f64, env->tr.base);
1401	stl_phys(sm_state + 0x7f60, env->tr.limit);
1402	stl_phys(sm_state + 0x7f5c, (env->tr.flags >> 8) & 0xf0ff);
1403
1404	stl_phys(sm_state + 0x7fc0, env->ldt.selector);
1405	stl_phys(sm_state + 0x7f80, env->ldt.base);
1406	stl_phys(sm_state + 0x7f7c, env->ldt.limit);
1407	stl_phys(sm_state + 0x7f78, (env->ldt.flags >> 8) & 0xf0ff);
1408
1409	stl_phys(sm_state + 0x7f74, env->gdt.base);
1410	stl_phys(sm_state + 0x7f70, env->gdt.limit);
1411
1412	stl_phys(sm_state + 0x7f58, env->idt.base);
1413	stl_phys(sm_state + 0x7f54, env->idt.limit);
1414
1415	for(i = 0; i < 6; i++) {
1416	dt = &env->segs[i];
1417	if (i < 3)
1418	offset = 0x7f84 + i * 12;
1419	else
1420	offset = 0x7f2c + (i - 3) * 12;
1421	stl_phys(sm_state + 0x7fa8 + i * 4, dt->selector);
1422	stl_phys(sm_state + offset + 8, dt->base);
1423	stl_phys(sm_state + offset + 4, dt->limit);
1424	stl_phys(sm_state + offset, (dt->flags >> 8) & 0xf0ff);
1425	}
1426	stl_phys(sm_state + 0x7f14, env->cr[4]);
1427
1428	stl_phys(sm_state + 0x7efc, SMM_REVISION_ID);
1429	stl_phys(sm_state + 0x7ef8, env->smbase);
1430	#endif
1431	/* init SMM cpu state */
1432
1433	#ifdef TARGET_X86_64
1434	env->efer = 0;
1435	env->hflags &= ~HF_LMA_MASK;
1436	#endif
1437	load_eflags(0, ~(CC_O \| CC_S \| CC_Z \| CC_A \| CC_P \| CC_C \| DF_MASK));
1438	env->eip = 0x00008000;
1439	cpu_x86_load_seg_cache(env, R_CS, (env->smbase >> 4) & 0xffff, env->smbase,
1440	0xffffffff, 0);
1441	cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0xffffffff, 0);
1442	cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0xffffffff, 0);
1443	cpu_x86_load_seg_cache(env, R_SS, 0, 0, 0xffffffff, 0);
1444	cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0xffffffff, 0);
1445	cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0xffffffff, 0);
1446
1447	cpu_x86_update_cr0(env,
1448	env->cr[0] & ~(CR0_PE_MASK \| CR0_EM_MASK \| CR0_TS_MASK \| CR0_PG_MASK));
1449	cpu_x86_update_cr4(env, 0);
1450	env->dr[7] = 0x00000400;
1451	CC_OP = CC_OP_EFLAGS;
1452	#endif /* VBOX */
1453	}
1454
1455	void helper_rsm(void)
1456	{
1457	#ifdef VBOX
1458	cpu_abort(env, "helper_rsm");
1459	#else /* !VBOX */
1460	target_ulong sm_state;
1461	int i, offset;
1462	uint32_t val;
1463
1464	sm_state = env->smbase + 0x8000;
1465	#ifdef TARGET_X86_64
1466	env->efer = ldq_phys(sm_state + 0x7ed0);
1467	if (env->efer & MSR_EFER_LMA)
1468	env->hflags \|= HF_LMA_MASK;
1469	else
1470	env->hflags &= ~HF_LMA_MASK;
1471
1472	for(i = 0; i < 6; i++) {
1473	offset = 0x7e00 + i * 16;
1474	cpu_x86_load_seg_cache(env, i,
1475	lduw_phys(sm_state + offset),
1476	ldq_phys(sm_state + offset + 8),
1477	ldl_phys(sm_state + offset + 4),
1478	(lduw_phys(sm_state + offset + 2) & 0xf0ff) << 8);
1479	}
1480
1481	env->gdt.base = ldq_phys(sm_state + 0x7e68);
1482	env->gdt.limit = ldl_phys(sm_state + 0x7e64);
1483
1484	env->ldt.selector = lduw_phys(sm_state + 0x7e70);
1485	env->ldt.base = ldq_phys(sm_state + 0x7e78);
1486	env->ldt.limit = ldl_phys(sm_state + 0x7e74);
1487	env->ldt.flags = (lduw_phys(sm_state + 0x7e72) & 0xf0ff) << 8;
1488
1489	env->idt.base = ldq_phys(sm_state + 0x7e88);
1490	env->idt.limit = ldl_phys(sm_state + 0x7e84);
1491
1492	env->tr.selector = lduw_phys(sm_state + 0x7e90);
1493	env->tr.base = ldq_phys(sm_state + 0x7e98);
1494	env->tr.limit = ldl_phys(sm_state + 0x7e94);
1495	env->tr.flags = (lduw_phys(sm_state + 0x7e92) & 0xf0ff) << 8;
1496
1497	EAX = ldq_phys(sm_state + 0x7ff8);
1498	ECX = ldq_phys(sm_state + 0x7ff0);
1499	EDX = ldq_phys(sm_state + 0x7fe8);
1500	EBX = ldq_phys(sm_state + 0x7fe0);
1501	ESP = ldq_phys(sm_state + 0x7fd8);
1502	EBP = ldq_phys(sm_state + 0x7fd0);
1503	ESI = ldq_phys(sm_state + 0x7fc8);
1504	EDI = ldq_phys(sm_state + 0x7fc0);
1505	for(i = 8; i < 16; i++)
1506	env->regs[i] = ldq_phys(sm_state + 0x7ff8 - i * 8);
1507	env->eip = ldq_phys(sm_state + 0x7f78);
1508	load_eflags(ldl_phys(sm_state + 0x7f70),
1509	~(CC_O \| CC_S \| CC_Z \| CC_A \| CC_P \| CC_C \| DF_MASK));
1510	env->dr[6] = ldl_phys(sm_state + 0x7f68);
1511	env->dr[7] = ldl_phys(sm_state + 0x7f60);
1512
1513	cpu_x86_update_cr4(env, ldl_phys(sm_state + 0x7f48));
1514	cpu_x86_update_cr3(env, ldl_phys(sm_state + 0x7f50));
1515	cpu_x86_update_cr0(env, ldl_phys(sm_state + 0x7f58));
1516
1517	val = ldl_phys(sm_state + 0x7efc); /* revision ID */
1518	if (val & 0x20000) {
1519	env->smbase = ldl_phys(sm_state + 0x7f00) & ~0x7fff;
1520	}
1521	#else
1522	cpu_x86_update_cr0(env, ldl_phys(sm_state + 0x7ffc));
1523	cpu_x86_update_cr3(env, ldl_phys(sm_state + 0x7ff8));
1524	load_eflags(ldl_phys(sm_state + 0x7ff4),
1525	~(CC_O \| CC_S \| CC_Z \| CC_A \| CC_P \| CC_C \| DF_MASK));
1526	env->eip = ldl_phys(sm_state + 0x7ff0);
1527	EDI = ldl_phys(sm_state + 0x7fec);
1528	ESI = ldl_phys(sm_state + 0x7fe8);
1529	EBP = ldl_phys(sm_state + 0x7fe4);
1530	ESP = ldl_phys(sm_state + 0x7fe0);
1531	EBX = ldl_phys(sm_state + 0x7fdc);
1532	EDX = ldl_phys(sm_state + 0x7fd8);
1533	ECX = ldl_phys(sm_state + 0x7fd4);
1534	EAX = ldl_phys(sm_state + 0x7fd0);
1535	env->dr[6] = ldl_phys(sm_state + 0x7fcc);
1536	env->dr[7] = ldl_phys(sm_state + 0x7fc8);
1537
1538	env->tr.selector = ldl_phys(sm_state + 0x7fc4) & 0xffff;
1539	env->tr.base = ldl_phys(sm_state + 0x7f64);
1540	env->tr.limit = ldl_phys(sm_state + 0x7f60);
1541	env->tr.flags = (ldl_phys(sm_state + 0x7f5c) & 0xf0ff) << 8;
1542
1543	env->ldt.selector = ldl_phys(sm_state + 0x7fc0) & 0xffff;
1544	env->ldt.base = ldl_phys(sm_state + 0x7f80);
1545	env->ldt.limit = ldl_phys(sm_state + 0x7f7c);
1546	env->ldt.flags = (ldl_phys(sm_state + 0x7f78) & 0xf0ff) << 8;
1547
1548	env->gdt.base = ldl_phys(sm_state + 0x7f74);
1549	env->gdt.limit = ldl_phys(sm_state + 0x7f70);
1550
1551	env->idt.base = ldl_phys(sm_state + 0x7f58);
1552	env->idt.limit = ldl_phys(sm_state + 0x7f54);
1553
1554	for(i = 0; i < 6; i++) {
1555	if (i < 3)
1556	offset = 0x7f84 + i * 12;
1557	else
1558	offset = 0x7f2c + (i - 3) * 12;
1559	cpu_x86_load_seg_cache(env, i,
1560	ldl_phys(sm_state + 0x7fa8 + i * 4) & 0xffff,
1561	ldl_phys(sm_state + offset + 8),
1562	ldl_phys(sm_state + offset + 4),
1563	(ldl_phys(sm_state + offset) & 0xf0ff) << 8);
1564	}
1565	cpu_x86_update_cr4(env, ldl_phys(sm_state + 0x7f14));
1566
1567	val = ldl_phys(sm_state + 0x7efc); /* revision ID */
1568	if (val & 0x20000) {
1569	env->smbase = ldl_phys(sm_state + 0x7ef8) & ~0x7fff;
1570	}
1571	#endif
1572	CC_OP = CC_OP_EFLAGS;
1573	env->hflags &= ~HF_SMM_MASK;
1574	cpu_smm_update(env);
1575
1576	if (loglevel & CPU_LOG_INT) {
1577	fprintf(logfile, "SMM: after RSM\n");
1578	cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
1579	}
1580	#endif /* !VBOX */
1581	}
1582
1583	#endif /* !CONFIG_USER_ONLY */
1584
1585
1586	#ifdef BUGGY_GCC_DIV64
1587	/* gcc 2.95.4 on PowerPC does not seem to like using __udivdi3, so we
1588	call it from another function */
1589	uint32_t div32(uint64_t *q_ptr, uint64_t num, uint32_t den)
1590	{
1591	*q_ptr = num / den;
1592	return num % den;
1593	}
1594
1595	int32_t idiv32(int64_t *q_ptr, int64_t num, int32_t den)
1596	{
1597	*q_ptr = num / den;
1598	return num % den;
1599	}
1600	#endif
1601
1602	void helper_divl_EAX_T0(void)
1603	{
1604	unsigned int den, r;
1605	uint64_t num, q;
1606
1607	num = ((uint32_t)EAX) \| ((uint64_t)((uint32_t)EDX) << 32);
1608	den = T0;
1609	if (den == 0) {
1610	raise_exception(EXCP00_DIVZ);
1611	}
1612	#ifdef BUGGY_GCC_DIV64
1613	r = div32(&q, num, den);
1614	#else
1615	q = (num / den);
1616	r = (num % den);
1617	#endif
1618	if (q > 0xffffffff)
1619	raise_exception(EXCP00_DIVZ);
1620	EAX = (uint32_t)q;
1621	EDX = (uint32_t)r;
1622	}
1623
1624	void helper_idivl_EAX_T0(void)
1625	{
1626	int den, r;
1627	int64_t num, q;
1628
1629	num = ((uint32_t)EAX) \| ((uint64_t)((uint32_t)EDX) << 32);
1630	den = T0;
1631	if (den == 0) {
1632	raise_exception(EXCP00_DIVZ);
1633	}
1634	#ifdef BUGGY_GCC_DIV64
1635	r = idiv32(&q, num, den);
1636	#else
1637	q = (num / den);
1638	r = (num % den);
1639	#endif
1640	if (q != (int32_t)q)
1641	raise_exception(EXCP00_DIVZ);
1642	EAX = (uint32_t)q;
1643	EDX = (uint32_t)r;
1644	}
1645
1646	void helper_cmpxchg8b(void)
1647	{
1648	uint64_t d;
1649	int eflags;
1650
1651	eflags = cc_table[CC_OP].compute_all();
1652	d = ldq(A0);
1653	if (d == (((uint64_t)EDX << 32) \| EAX)) {
1654	stq(A0, ((uint64_t)ECX << 32) \| EBX);
1655	eflags \|= CC_Z;
1656	} else {
1657	EDX = d >> 32;
1658	EAX = d;
1659	eflags &= ~CC_Z;
1660	}
1661	CC_SRC = eflags;
1662	}
1663
1664	void helper_cpuid(void)
1665	{
1666	#ifndef VBOX
1667	uint32_t index;
1668	index = (uint32_t)EAX;
1669
1670	/* test if maximum index reached */
1671	if (index & 0x80000000) {
1672	if (index > env->cpuid_xlevel)
1673	index = env->cpuid_level;
1674	} else {
1675	if (index > env->cpuid_level)
1676	index = env->cpuid_level;
1677	}
1678
1679	switch(index) {
1680	case 0:
1681	EAX = env->cpuid_level;
1682	EBX = env->cpuid_vendor1;
1683	EDX = env->cpuid_vendor2;
1684	ECX = env->cpuid_vendor3;
1685	break;
1686	case 1:
1687	EAX = env->cpuid_version;
1688	EBX = 8 << 8; /* CLFLUSH size in quad words, Linux wants it. */
1689	ECX = env->cpuid_ext_features;
1690	EDX = env->cpuid_features;
1691	break;
1692	case 2:
1693	/* cache info: needed for Pentium Pro compatibility */
1694	EAX = 0x410601;
1695	EBX = 0;
1696	ECX = 0;
1697	EDX = 0;
1698	break;
1699	case 0x80000000:
1700	EAX = env->cpuid_xlevel;
1701	EBX = env->cpuid_vendor1;
1702	EDX = env->cpuid_vendor2;
1703	ECX = env->cpuid_vendor3;
1704	break;
1705	case 0x80000001:
1706	EAX = env->cpuid_features;
1707	EBX = 0;
1708	ECX = 0;
1709	EDX = env->cpuid_ext2_features;
1710	break;
1711	case 0x80000002:
1712	case 0x80000003:
1713	case 0x80000004:
1714	EAX = env->cpuid_model[(index - 0x80000002) * 4 + 0];
1715	EBX = env->cpuid_model[(index - 0x80000002) * 4 + 1];
1716	ECX = env->cpuid_model[(index - 0x80000002) * 4 + 2];
1717	EDX = env->cpuid_model[(index - 0x80000002) * 4 + 3];
1718	break;
1719	case 0x80000005:
1720	/* cache info (L1 cache) */
1721	EAX = 0x01ff01ff;
1722	EBX = 0x01ff01ff;
1723	ECX = 0x40020140;
1724	EDX = 0x40020140;
1725	break;
1726	case 0x80000006:
1727	/* cache info (L2 cache) */
1728	EAX = 0;
1729	EBX = 0x42004200;
1730	ECX = 0x02008140;
1731	EDX = 0;
1732	break;
1733	case 0x80000008:
1734	/* virtual & phys address size in low 2 bytes. */
1735	EAX = 0x00003028;
1736	EBX = 0;
1737	ECX = 0;
1738	EDX = 0;
1739	break;
1740	default:
1741	/* reserved values: zero */
1742	EAX = 0;
1743	EBX = 0;
1744	ECX = 0;
1745	EDX = 0;
1746	break;
1747	}
1748	#else /* VBOX */
1749	remR3CpuId(env, EAX, &EAX, &EBX, &ECX, &EDX);
1750	#endif /* VBOX */
1751	}
1752
1753	void helper_enter_level(int level, int data32)
1754	{
1755	target_ulong ssp;
1756	uint32_t esp_mask, esp, ebp;
1757
1758	esp_mask = get_sp_mask(env->segs[R_SS].flags);
1759	ssp = env->segs[R_SS].base;
1760	ebp = EBP;
1761	esp = ESP;
1762	if (data32) {
1763	/* 32 bit */
1764	esp -= 4;
1765	while (--level) {
1766	esp -= 4;
1767	ebp -= 4;
1768	stl(ssp + (esp & esp_mask), ldl(ssp + (ebp & esp_mask)));
1769	}
1770	esp -= 4;
1771	stl(ssp + (esp & esp_mask), T1);
1772	} else {
1773	/* 16 bit */
1774	esp -= 2;
1775	while (--level) {
1776	esp -= 2;
1777	ebp -= 2;
1778	stw(ssp + (esp & esp_mask), lduw(ssp + (ebp & esp_mask)));
1779	}
1780	esp -= 2;
1781	stw(ssp + (esp & esp_mask), T1);
1782	}
1783	}
1784
1785	#ifdef TARGET_X86_64
1786	void helper_enter64_level(int level, int data64)
1787	{
1788	target_ulong esp, ebp;
1789	ebp = EBP;
1790	esp = ESP;
1791
1792	if (data64) {
1793	/* 64 bit */
1794	esp -= 8;
1795	while (--level) {
1796	esp -= 8;
1797	ebp -= 8;
1798	stq(esp, ldq(ebp));
1799	}
1800	esp -= 8;
1801	stq(esp, T1);
1802	} else {
1803	/* 16 bit */
1804	esp -= 2;
1805	while (--level) {
1806	esp -= 2;
1807	ebp -= 2;
1808	stw(esp, lduw(ebp));
1809	}
1810	esp -= 2;
1811	stw(esp, T1);
1812	}
1813	}
1814	#endif
1815
1816	void helper_lldt_T0(void)
1817	{
1818	int selector;
1819	SegmentCache *dt;
1820	uint32_t e1, e2;
1821	int index, entry_limit;
1822	target_ulong ptr;
1823	#ifdef VBOX
1824	Log(("helper_lldt_T0: old ldtr=%RTsel {.base=%VGv, .limit=%VGv} new=%RTsel\n",
1825	(RTSEL)env->ldt.selector, (RTGCPTR)env->ldt.base, (RTGCPTR)env->ldt.limit, (RTSEL)(T0 & 0xffff)));
1826	#endif
1827
1828	selector = T0 & 0xffff;
1829	if ((selector & 0xfffc) == 0) {
1830	/* XXX: NULL selector case: invalid LDT */
1831	env->ldt.base = 0;
1832	env->ldt.limit = 0;
1833	} else {
1834	if (selector & 0x4)
1835	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1836	dt = &env->gdt;
1837	index = selector & ~7;
1838	#ifdef TARGET_X86_64
1839	if (env->hflags & HF_LMA_MASK)
1840	entry_limit = 15;
1841	else
1842	#endif
1843	entry_limit = 7;
1844	if ((index + entry_limit) > dt->limit)
1845	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1846	ptr = dt->base + index;
1847	e1 = ldl_kernel(ptr);
1848	e2 = ldl_kernel(ptr + 4);
1849	if ((e2 & DESC_S_MASK) \|\| ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2)
1850	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1851	if (!(e2 & DESC_P_MASK))
1852	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
1853	#ifdef TARGET_X86_64
1854	if (env->hflags & HF_LMA_MASK) {
1855	uint32_t e3;
1856	e3 = ldl_kernel(ptr + 8);
1857	load_seg_cache_raw_dt(&env->ldt, e1, e2);
1858	env->ldt.base \|= (target_ulong)e3 << 32;
1859	} else
1860	#endif
1861	{
1862	load_seg_cache_raw_dt(&env->ldt, e1, e2);
1863	}
1864	}
1865	env->ldt.selector = selector;
1866	#ifdef VBOX
1867	Log(("helper_lldt_T0: new ldtr=%RTsel {.base=%VGv, .limit=%VGv}\n",
1868	(RTSEL)env->ldt.selector, (RTGCPTR)env->ldt.base, (RTGCPTR)env->ldt.limit));
1869	#endif
1870	}
1871
1872	void helper_ltr_T0(void)
1873	{
1874	int selector;
1875	SegmentCache *dt;
1876	uint32_t e1, e2;
1877	int index, type, entry_limit;
1878	target_ulong ptr;
1879
1880	#ifdef VBOX
1881	Log(("helper_ltr_T0: old tr=%RTsel {.base=%VGv, .limit=%VGv, .flags=%RX32} new=%RTsel\n",
1882	(RTSEL)env->tr.selector, (RTGCPTR)env->tr.base, (RTGCPTR)env->tr.limit,
1883	env->tr.flags, (RTSEL)(T0 & 0xffff)));
1884	#endif
1885
1886	selector = T0 & 0xffff;
1887	if ((selector & 0xfffc) == 0) {
1888	/* NULL selector case: invalid TR */
1889	env->tr.base = 0;
1890	env->tr.limit = 0;
1891	env->tr.flags = 0;
1892	} else {
1893	if (selector & 0x4)
1894	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1895	dt = &env->gdt;
1896	index = selector & ~7;
1897	#ifdef TARGET_X86_64
1898	if (env->hflags & HF_LMA_MASK)
1899	entry_limit = 15;
1900	else
1901	#endif
1902	entry_limit = 7;
1903	if ((index + entry_limit) > dt->limit)
1904	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1905	ptr = dt->base + index;
1906	e1 = ldl_kernel(ptr);
1907	e2 = ldl_kernel(ptr + 4);
1908	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
1909	if ((e2 & DESC_S_MASK) \|\|
1910	(type != 1 && type != 9))
1911	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1912	if (!(e2 & DESC_P_MASK))
1913	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
1914	#ifdef TARGET_X86_64
1915	if (env->hflags & HF_LMA_MASK) {
1916	uint32_t e3;
1917	e3 = ldl_kernel(ptr + 8);
1918	load_seg_cache_raw_dt(&env->tr, e1, e2);
1919	env->tr.base \|= (target_ulong)e3 << 32;
1920	} else
1921	#endif
1922	{
1923	load_seg_cache_raw_dt(&env->tr, e1, e2);
1924	}
1925	e2 \|= DESC_TSS_BUSY_MASK;
1926	stl_kernel(ptr + 4, e2);
1927	}
1928	env->tr.selector = selector;
1929	#ifdef VBOX
1930	Log(("helper_ltr_T0: new tr=%RTsel {.base=%VGv, .limit=%VGv, .flags=%RX32} new=%RTsel\n",
1931	(RTSEL)env->tr.selector, (RTGCPTR)env->tr.base, (RTGCPTR)env->tr.limit,
1932	env->tr.flags, (RTSEL)(T0 & 0xffff)));
1933	#endif
1934	}
1935
1936	/* only works if protected mode and not VM86. seg_reg must be != R_CS */
1937	void load_seg(int seg_reg, int selector)
1938	{
1939	uint32_t e1, e2;
1940	int cpl, dpl, rpl;
1941	SegmentCache *dt;
1942	int index;
1943	target_ulong ptr;
1944
1945	selector &= 0xffff;
1946	cpl = env->hflags & HF_CPL_MASK;
1947	if ((selector & 0xfffc) == 0) {
1948	/* null selector case */
1949	if (seg_reg == R_SS
1950	#ifdef TARGET_X86_64
1951	&& (!(env->hflags & HF_CS64_MASK) \|\| cpl == 3)
1952	#endif
1953	)
1954	raise_exception_err(EXCP0D_GPF, 0);
1955	cpu_x86_load_seg_cache(env, seg_reg, selector, 0, 0, 0);
1956	} else {
1957
1958	if (selector & 0x4)
1959	dt = &env->ldt;
1960	else
1961	dt = &env->gdt;
1962	index = selector & ~7;
1963	if ((index + 7) > dt->limit)
1964	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1965	ptr = dt->base + index;
1966	e1 = ldl_kernel(ptr);
1967	e2 = ldl_kernel(ptr + 4);
1968
1969	if (!(e2 & DESC_S_MASK))
1970	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1971	rpl = selector & 3;
1972	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1973	if (seg_reg == R_SS) {
1974	/* must be writable segment */
1975	if ((e2 & DESC_CS_MASK) \|\| !(e2 & DESC_W_MASK))
1976	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1977	if (rpl != cpl \|\| dpl != cpl)
1978	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1979	} else {
1980	/* must be readable segment */
1981	if ((e2 & (DESC_CS_MASK \| DESC_R_MASK)) == DESC_CS_MASK)
1982	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1983
1984	if (!(e2 & DESC_CS_MASK) \|\| !(e2 & DESC_C_MASK)) {
1985	/* if not conforming code, test rights */
1986	if (dpl < cpl \|\| dpl < rpl)
1987	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1988	}
1989	}
1990
1991	if (!(e2 & DESC_P_MASK)) {
1992	if (seg_reg == R_SS)
1993	raise_exception_err(EXCP0C_STACK, selector & 0xfffc);
1994	else
1995	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
1996	}
1997
1998	/* set the access bit if not already set */
1999	if (!(e2 & DESC_A_MASK)) {
2000	e2 \|= DESC_A_MASK;
2001	stl_kernel(ptr + 4, e2);
2002	}
2003
2004	cpu_x86_load_seg_cache(env, seg_reg, selector,
2005	get_seg_base(e1, e2),
2006	get_seg_limit(e1, e2),
2007	e2);
2008	#if 0
2009	fprintf(logfile, "load_seg: sel=0x%04x base=0x%08lx limit=0x%08lx flags=%08x\n",
2010	selector, (unsigned long)sc->base, sc->limit, sc->flags);
2011	#endif
2012	}
2013	}
2014
2015	/* protected mode jump */
2016	void helper_ljmp_protected_T0_T1(int next_eip_addend)
2017	{
2018	int new_cs, gate_cs, type;
2019	uint32_t e1, e2, cpl, dpl, rpl, limit;
2020	target_ulong new_eip, next_eip;
2021
2022	new_cs = T0;
2023	new_eip = T1;
2024	if ((new_cs & 0xfffc) == 0)
2025	raise_exception_err(EXCP0D_GPF, 0);
2026	if (load_segment(&e1, &e2, new_cs) != 0)
2027	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2028	cpl = env->hflags & HF_CPL_MASK;
2029	if (e2 & DESC_S_MASK) {
2030	if (!(e2 & DESC_CS_MASK))
2031	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2032	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2033	if (e2 & DESC_C_MASK) {
2034	/* conforming code segment */
2035	if (dpl > cpl)
2036	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2037	} else {
2038	/* non conforming code segment */
2039	rpl = new_cs & 3;
2040	if (rpl > cpl)
2041	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2042	if (dpl != cpl)
2043	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2044	}
2045	if (!(e2 & DESC_P_MASK))
2046	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2047	limit = get_seg_limit(e1, e2);
2048	if (new_eip > limit &&
2049	!(env->hflags & HF_LMA_MASK) && !(e2 & DESC_L_MASK))
2050	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2051	cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) \| cpl,
2052	get_seg_base(e1, e2), limit, e2);
2053	EIP = new_eip;
2054	} else {
2055	/* jump to call or task gate */
2056	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2057	rpl = new_cs & 3;
2058	cpl = env->hflags & HF_CPL_MASK;
2059	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2060	switch(type) {
2061	case 1: /* 286 TSS */
2062	case 9: /* 386 TSS */
2063	case 5: /* task gate */
2064	if (dpl < cpl \|\| dpl < rpl)
2065	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2066	next_eip = env->eip + next_eip_addend;
2067	switch_tss(new_cs, e1, e2, SWITCH_TSS_JMP, next_eip);
2068	CC_OP = CC_OP_EFLAGS;
2069	break;
2070	case 4: /* 286 call gate */
2071	case 12: /* 386 call gate */
2072	if ((dpl < cpl) \|\| (dpl < rpl))
2073	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2074	if (!(e2 & DESC_P_MASK))
2075	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2076	gate_cs = e1 >> 16;
2077	new_eip = (e1 & 0xffff);
2078	if (type == 12)
2079	new_eip \|= (e2 & 0xffff0000);
2080	if (load_segment(&e1, &e2, gate_cs) != 0)
2081	raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2082	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2083	/* must be code segment */
2084	if (((e2 & (DESC_S_MASK \| DESC_CS_MASK)) !=
2085	(DESC_S_MASK \| DESC_CS_MASK)))
2086	raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2087	if (((e2 & DESC_C_MASK) && (dpl > cpl)) \|\|
2088	(!(e2 & DESC_C_MASK) && (dpl != cpl)))
2089	raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2090	if (!(e2 & DESC_P_MASK))
2091	raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2092	limit = get_seg_limit(e1, e2);
2093	if (new_eip > limit)
2094	raise_exception_err(EXCP0D_GPF, 0);
2095	cpu_x86_load_seg_cache(env, R_CS, (gate_cs & 0xfffc) \| cpl,
2096	get_seg_base(e1, e2), limit, e2);
2097	EIP = new_eip;
2098	break;
2099	default:
2100	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2101	break;
2102	}
2103	}
2104	}
2105
2106	/* real mode call */
2107	void helper_lcall_real_T0_T1(int shift, int next_eip)
2108	{
2109	int new_cs, new_eip;
2110	uint32_t esp, esp_mask;
2111	target_ulong ssp;
2112
2113	new_cs = T0;
2114	new_eip = T1;
2115	esp = ESP;
2116	esp_mask = get_sp_mask(env->segs[R_SS].flags);
2117	ssp = env->segs[R_SS].base;
2118	if (shift) {
2119	PUSHL(ssp, esp, esp_mask, env->segs[R_CS].selector);
2120	PUSHL(ssp, esp, esp_mask, next_eip);
2121	} else {
2122	PUSHW(ssp, esp, esp_mask, env->segs[R_CS].selector);
2123	PUSHW(ssp, esp, esp_mask, next_eip);
2124	}
2125
2126	SET_ESP(esp, esp_mask);
2127	env->eip = new_eip;
2128	env->segs[R_CS].selector = new_cs;
2129	env->segs[R_CS].base = (new_cs << 4);
2130	}
2131
2132	/* protected mode call */
2133	void helper_lcall_protected_T0_T1(int shift, int next_eip_addend)
2134	{
2135	int new_cs, new_stack, i;
2136	uint32_t e1, e2, cpl, dpl, rpl, selector, offset, param_count;
2137	uint32_t ss, ss_e1, ss_e2, sp, type, ss_dpl, sp_mask;
2138	uint32_t val, limit, old_sp_mask;
2139	target_ulong ssp, old_ssp, next_eip, new_eip;
2140
2141	new_cs = T0;
2142	new_eip = T1;
2143	next_eip = env->eip + next_eip_addend;
2144	#ifdef DEBUG_PCALL
2145	if (loglevel & CPU_LOG_PCALL) {
2146	fprintf(logfile, "lcall %04x:%08x s=%d\n",
2147	new_cs, (uint32_t)new_eip, shift);
2148	cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
2149	}
2150	#endif
2151	if ((new_cs & 0xfffc) == 0)
2152	raise_exception_err(EXCP0D_GPF, 0);
2153	if (load_segment(&e1, &e2, new_cs) != 0)
2154	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2155	cpl = env->hflags & HF_CPL_MASK;
2156	#ifdef DEBUG_PCALL
2157	if (loglevel & CPU_LOG_PCALL) {
2158	fprintf(logfile, "desc=%08x:%08x\n", e1, e2);
2159	}
2160	#endif
2161	if (e2 & DESC_S_MASK) {
2162	if (!(e2 & DESC_CS_MASK))
2163	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2164	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2165	if (e2 & DESC_C_MASK) {
2166	/* conforming code segment */
2167	if (dpl > cpl)
2168	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2169	} else {
2170	/* non conforming code segment */
2171	rpl = new_cs & 3;
2172	if (rpl > cpl)
2173	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2174	if (dpl != cpl)
2175	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2176	}
2177	if (!(e2 & DESC_P_MASK))
2178	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2179
2180	#ifdef TARGET_X86_64
2181	/* XXX: check 16/32 bit cases in long mode */
2182	if (shift == 2) {
2183	target_ulong rsp;
2184	/* 64 bit case */
2185	rsp = ESP;
2186	PUSHQ(rsp, env->segs[R_CS].selector);
2187	PUSHQ(rsp, next_eip);
2188	/* from this point, not restartable */
2189	ESP = rsp;
2190	cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) \| cpl,
2191	get_seg_base(e1, e2),
2192	get_seg_limit(e1, e2), e2);
2193	EIP = new_eip;
2194	} else
2195	#endif
2196	{
2197	sp = ESP;
2198	sp_mask = get_sp_mask(env->segs[R_SS].flags);
2199	ssp = env->segs[R_SS].base;
2200	if (shift) {
2201	PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
2202	PUSHL(ssp, sp, sp_mask, next_eip);
2203	} else {
2204	PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
2205	PUSHW(ssp, sp, sp_mask, next_eip);
2206	}
2207
2208	limit = get_seg_limit(e1, e2);
2209	if (new_eip > limit)
2210	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2211	/* from this point, not restartable */
2212	SET_ESP(sp, sp_mask);
2213	cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) \| cpl,
2214	get_seg_base(e1, e2), limit, e2);
2215	EIP = new_eip;
2216	}
2217	} else {
2218	/* check gate type */
2219	type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
2220	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2221	rpl = new_cs & 3;
2222	switch(type) {
2223	case 1: /* available 286 TSS */
2224	case 9: /* available 386 TSS */
2225	case 5: /* task gate */
2226	if (dpl < cpl \|\| dpl < rpl)
2227	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2228	switch_tss(new_cs, e1, e2, SWITCH_TSS_CALL, next_eip);
2229	CC_OP = CC_OP_EFLAGS;
2230	return;
2231	case 4: /* 286 call gate */
2232	case 12: /* 386 call gate */
2233	break;
2234	default:
2235	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2236	break;
2237	}
2238	shift = type >> 3;
2239
2240	if (dpl < cpl \|\| dpl < rpl)
2241	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2242	/* check valid bit */
2243	if (!(e2 & DESC_P_MASK))
2244	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2245	selector = e1 >> 16;
2246	offset = (e2 & 0xffff0000) \| (e1 & 0x0000ffff);
2247	param_count = e2 & 0x1f;
2248	if ((selector & 0xfffc) == 0)
2249	raise_exception_err(EXCP0D_GPF, 0);
2250
2251	if (load_segment(&e1, &e2, selector) != 0)
2252	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2253	if (!(e2 & DESC_S_MASK) \|\| !(e2 & (DESC_CS_MASK)))
2254	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2255	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2256	if (dpl > cpl)
2257	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2258	if (!(e2 & DESC_P_MASK))
2259	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2260
2261	if (!(e2 & DESC_C_MASK) && dpl < cpl) {
2262	/* to inner priviledge */
2263	get_ss_esp_from_tss(&ss, &sp, dpl);
2264	#ifdef DEBUG_PCALL
2265	if (loglevel & CPU_LOG_PCALL)
2266	fprintf(logfile, "new ss:esp=%04x:%08x param_count=%d ESP=" TARGET_FMT_lx "\n",
2267	ss, sp, param_count, ESP);
2268	#endif
2269	if ((ss & 0xfffc) == 0)
2270	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2271	if ((ss & 3) != dpl)
2272	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2273	if (load_segment(&ss_e1, &ss_e2, ss) != 0)
2274	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2275	ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
2276	if (ss_dpl != dpl)
2277	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2278	if (!(ss_e2 & DESC_S_MASK) \|\|
2279	(ss_e2 & DESC_CS_MASK) \|\|
2280	!(ss_e2 & DESC_W_MASK))
2281	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2282	if (!(ss_e2 & DESC_P_MASK))
2283	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2284
2285	// push_size = ((param_count * 2) + 8) << shift;
2286
2287	old_sp_mask = get_sp_mask(env->segs[R_SS].flags);
2288	old_ssp = env->segs[R_SS].base;
2289
2290	sp_mask = get_sp_mask(ss_e2);
2291	ssp = get_seg_base(ss_e1, ss_e2);
2292	if (shift) {
2293	PUSHL(ssp, sp, sp_mask, env->segs[R_SS].selector);
2294	PUSHL(ssp, sp, sp_mask, ESP);
2295	for(i = param_count - 1; i >= 0; i--) {
2296	val = ldl_kernel(old_ssp + ((ESP + i * 4) & old_sp_mask));
2297	PUSHL(ssp, sp, sp_mask, val);
2298	}
2299	} else {
2300	PUSHW(ssp, sp, sp_mask, env->segs[R_SS].selector);
2301	PUSHW(ssp, sp, sp_mask, ESP);
2302	for(i = param_count - 1; i >= 0; i--) {
2303	val = lduw_kernel(old_ssp + ((ESP + i * 2) & old_sp_mask));
2304	PUSHW(ssp, sp, sp_mask, val);
2305	}
2306	}
2307	new_stack = 1;
2308	} else {
2309	/* to same priviledge */
2310	sp = ESP;
2311	sp_mask = get_sp_mask(env->segs[R_SS].flags);
2312	ssp = env->segs[R_SS].base;
2313	// push_size = (4 << shift);
2314	new_stack = 0;
2315	}
2316
2317	if (shift) {
2318	PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
2319	PUSHL(ssp, sp, sp_mask, next_eip);
2320	} else {
2321	PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
2322	PUSHW(ssp, sp, sp_mask, next_eip);
2323	}
2324
2325	/* from this point, not restartable */
2326
2327	if (new_stack) {
2328	ss = (ss & ~3) \| dpl;
2329	cpu_x86_load_seg_cache(env, R_SS, ss,
2330	ssp,
2331	get_seg_limit(ss_e1, ss_e2),
2332	ss_e2);
2333	}
2334
2335	selector = (selector & ~3) \| dpl;
2336	cpu_x86_load_seg_cache(env, R_CS, selector,
2337	get_seg_base(e1, e2),
2338	get_seg_limit(e1, e2),
2339	e2);
2340	cpu_x86_set_cpl(env, dpl);
2341	SET_ESP(sp, sp_mask);
2342	EIP = offset;
2343	}
2344	#ifdef USE_KQEMU
2345	if (kqemu_is_ok(env)) {
2346	env->exception_index = -1;
2347	cpu_loop_exit();
2348	}
2349	#endif
2350	}
2351
2352	/* real and vm86 mode iret */
2353	void helper_iret_real(int shift)
2354	{
2355	uint32_t sp, new_cs, new_eip, new_eflags, sp_mask;
2356	target_ulong ssp;
2357	int eflags_mask;
2358
2359	#ifdef VBOX
2360	remR3TrapClear(env->pVM);
2361	#endif
2362
2363	sp_mask = 0xffff; /* XXXX: use SS segment size ? */
2364	sp = ESP;
2365	ssp = env->segs[R_SS].base;
2366	if (shift == 1) {
2367	/* 32 bits */
2368	POPL(ssp, sp, sp_mask, new_eip);
2369	POPL(ssp, sp, sp_mask, new_cs);
2370	new_cs &= 0xffff;
2371	POPL(ssp, sp, sp_mask, new_eflags);
2372	} else {
2373	/* 16 bits */
2374	POPW(ssp, sp, sp_mask, new_eip);
2375	POPW(ssp, sp, sp_mask, new_cs);
2376	POPW(ssp, sp, sp_mask, new_eflags);
2377	}
2378	ESP = (ESP & ~sp_mask) \| (sp & sp_mask);
2379	load_seg_vm(R_CS, new_cs);
2380	env->eip = new_eip;
2381	if (env->eflags & VM_MASK)
2382	eflags_mask = TF_MASK \| AC_MASK \| ID_MASK \| IF_MASK \| RF_MASK \| NT_MASK;
2383	else
2384	eflags_mask = TF_MASK \| AC_MASK \| ID_MASK \| IF_MASK \| IOPL_MASK \| RF_MASK \| NT_MASK;
2385	if (shift == 0)
2386	eflags_mask &= 0xffff;
2387	load_eflags(new_eflags, eflags_mask);
2388	}
2389
2390	static inline void validate_seg(int seg_reg, int cpl)
2391	{
2392	int dpl;
2393	uint32_t e2;
2394
2395	/* XXX: on x86_64, we do not want to nullify FS and GS because
2396	they may still contain a valid base. I would be interested to
2397	know how a real x86_64 CPU behaves */
2398	if ((seg_reg == R_FS \|\| seg_reg == R_GS) &&
2399	(env->segs[seg_reg].selector & 0xfffc) == 0)
2400	return;
2401
2402	e2 = env->segs[seg_reg].flags;
2403	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2404	if (!(e2 & DESC_CS_MASK) \|\| !(e2 & DESC_C_MASK)) {
2405	/* data or non conforming code segment */
2406	if (dpl < cpl) {
2407	cpu_x86_load_seg_cache(env, seg_reg, 0, 0, 0, 0);
2408	}
2409	}
2410	}
2411
2412	/* protected mode iret */
2413	static inline void helper_ret_protected(int shift, int is_iret, int addend)
2414	{
2415	uint32_t new_cs, new_eflags, new_ss;
2416	uint32_t new_es, new_ds, new_fs, new_gs;
2417	uint32_t e1, e2, ss_e1, ss_e2;
2418	int cpl, dpl, rpl, eflags_mask, iopl;
2419	target_ulong ssp, sp, new_eip, new_esp, sp_mask;
2420
2421	#ifdef TARGET_X86_64
2422	if (shift == 2)
2423	sp_mask = -1;
2424	else
2425	#endif
2426	sp_mask = get_sp_mask(env->segs[R_SS].flags);
2427	sp = ESP;
2428	ssp = env->segs[R_SS].base;
2429	new_eflags = 0; /* avoid warning */
2430	#ifdef TARGET_X86_64
2431	if (shift == 2) {
2432	POPQ(sp, new_eip);
2433	POPQ(sp, new_cs);
2434	new_cs &= 0xffff;
2435	if (is_iret) {
2436	POPQ(sp, new_eflags);
2437	}
2438	} else
2439	#endif
2440	if (shift == 1) {
2441	/* 32 bits */
2442	POPL(ssp, sp, sp_mask, new_eip);
2443	POPL(ssp, sp, sp_mask, new_cs);
2444	new_cs &= 0xffff;
2445	if (is_iret) {
2446	POPL(ssp, sp, sp_mask, new_eflags);
2447	#if defined(VBOX) && defined(DEBUG)
2448	printf("iret: new CS %04X\n", new_cs);
2449	printf("iret: new EIP %08X\n", new_eip);
2450	printf("iret: new EFLAGS %08X\n", new_eflags);
2451	printf("iret: EAX=%08x\n", EAX);
2452	#endif
2453
2454	if (new_eflags & VM_MASK)
2455	goto return_to_vm86;
2456	}
2457	} else {
2458	/* 16 bits */
2459	POPW(ssp, sp, sp_mask, new_eip);
2460	POPW(ssp, sp, sp_mask, new_cs);
2461	if (is_iret)
2462	POPW(ssp, sp, sp_mask, new_eflags);
2463	}
2464	#ifdef DEBUG_PCALL
2465	if (loglevel & CPU_LOG_PCALL) {
2466	fprintf(logfile, "lret new %04x:" TARGET_FMT_lx " s=%d addend=0x%x\n",
2467	new_cs, new_eip, shift, addend);
2468	cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
2469	}
2470	#endif
2471	if ((new_cs & 0xfffc) == 0)
2472	{
2473	#if defined(VBOX) && defined(DEBUG)
2474	printf("new_cs & 0xfffc) == 0\n");
2475	#endif
2476	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2477	}
2478	if (load_segment(&e1, &e2, new_cs) != 0)
2479	{
2480	#if defined(VBOX) && defined(DEBUG)
2481	printf("load_segment failed\n");
2482	#endif
2483	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2484	}
2485	if (!(e2 & DESC_S_MASK) \|\|
2486	!(e2 & DESC_CS_MASK))
2487	{
2488	#if defined(VBOX) && defined(DEBUG)
2489	printf("e2 mask %08x\n", e2);
2490	#endif
2491	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2492	}
2493	cpl = env->hflags & HF_CPL_MASK;
2494	rpl = new_cs & 3;
2495	if (rpl < cpl)
2496	{
2497	#if defined(VBOX) && defined(DEBUG)
2498	printf("rpl < cpl (%d vs %d)\n", rpl, cpl);
2499	#endif
2500	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2501	}
2502	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2503	if (e2 & DESC_C_MASK) {
2504	if (dpl > rpl)
2505	{
2506	#if defined(VBOX) && defined(DEBUG)
2507	printf("dpl > rpl (%d vs %d)\n", dpl, rpl);
2508	#endif
2509	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2510	}
2511	} else {
2512	if (dpl != rpl)
2513	{
2514	#if defined(VBOX) && defined(DEBUG)
2515	printf("dpl != rpl (%d vs %d) e1=%x e2=%x\n", dpl, rpl, e1, e2);
2516	#endif
2517	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2518	}
2519	}
2520	if (!(e2 & DESC_P_MASK))
2521	{
2522	#if defined(VBOX) && defined(DEBUG)
2523	printf("DESC_P_MASK e2=%08x\n", e2);
2524	#endif
2525	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2526	}
2527	sp += addend;
2528	if (rpl == cpl && (!(env->hflags & HF_CS64_MASK) \|\|
2529	((env->hflags & HF_CS64_MASK) && !is_iret))) {
2530	/* return to same priledge level */
2531	cpu_x86_load_seg_cache(env, R_CS, new_cs,
2532	get_seg_base(e1, e2),
2533	get_seg_limit(e1, e2),
2534	e2);
2535	} else {
2536	/* return to different priviledge level */
2537	#ifdef TARGET_X86_64
2538	if (shift == 2) {
2539	POPQ(sp, new_esp);
2540	POPQ(sp, new_ss);
2541	new_ss &= 0xffff;
2542	} else
2543	#endif
2544	if (shift == 1) {
2545	/* 32 bits */
2546	POPL(ssp, sp, sp_mask, new_esp);
2547	POPL(ssp, sp, sp_mask, new_ss);
2548	new_ss &= 0xffff;
2549	} else {
2550	/* 16 bits */
2551	POPW(ssp, sp, sp_mask, new_esp);
2552	POPW(ssp, sp, sp_mask, new_ss);
2553	}
2554	#ifdef DEBUG_PCALL
2555	if (loglevel & CPU_LOG_PCALL) {
2556	fprintf(logfile, "new ss:esp=%04x:" TARGET_FMT_lx "\n",
2557	new_ss, new_esp);
2558	}
2559	#endif
2560	if ((new_ss & 0xfffc) == 0) {
2561	#ifdef TARGET_X86_64
2562	/* NULL ss is allowed in long mode if cpl != 3*/
2563	/* XXX: test CS64 ? */
2564	if ((env->hflags & HF_LMA_MASK) && rpl != 3) {
2565	cpu_x86_load_seg_cache(env, R_SS, new_ss,
2566	0, 0xffffffff,
2567	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2568	DESC_S_MASK \| (rpl << DESC_DPL_SHIFT) \|
2569	DESC_W_MASK \| DESC_A_MASK);
2570	ss_e2 = DESC_B_MASK; /* XXX: should not be needed ? */
2571	} else
2572	#endif
2573	{
2574	raise_exception_err(EXCP0D_GPF, 0);
2575	}
2576	} else {
2577	if ((new_ss & 3) != rpl)
2578	raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2579	if (load_segment(&ss_e1, &ss_e2, new_ss) != 0)
2580	raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2581	if (!(ss_e2 & DESC_S_MASK) \|\|
2582	(ss_e2 & DESC_CS_MASK) \|\|
2583	!(ss_e2 & DESC_W_MASK))
2584	raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2585	dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
2586	if (dpl != rpl)
2587	raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2588	if (!(ss_e2 & DESC_P_MASK))
2589	raise_exception_err(EXCP0B_NOSEG, new_ss & 0xfffc);
2590	cpu_x86_load_seg_cache(env, R_SS, new_ss,
2591	get_seg_base(ss_e1, ss_e2),
2592	get_seg_limit(ss_e1, ss_e2),
2593	ss_e2);
2594	}
2595
2596	cpu_x86_load_seg_cache(env, R_CS, new_cs,
2597	get_seg_base(e1, e2),
2598	get_seg_limit(e1, e2),
2599	e2);
2600	cpu_x86_set_cpl(env, rpl);
2601	sp = new_esp;
2602	#ifdef TARGET_X86_64
2603	if (env->hflags & HF_CS64_MASK)
2604	sp_mask = -1;
2605	else
2606	#endif
2607	sp_mask = get_sp_mask(ss_e2);
2608
2609	/* validate data segments */
2610	validate_seg(R_ES, rpl);
2611	validate_seg(R_DS, rpl);
2612	validate_seg(R_FS, rpl);
2613	validate_seg(R_GS, rpl);
2614
2615	sp += addend;
2616	}
2617	SET_ESP(sp, sp_mask);
2618	env->eip = new_eip;
2619	if (is_iret) {
2620	/* NOTE: 'cpl' is the _old_ CPL */
2621	eflags_mask = TF_MASK \| AC_MASK \| ID_MASK \| RF_MASK \| NT_MASK;
2622	if (cpl == 0)
2623	eflags_mask \|= IOPL_MASK;
2624	iopl = (env->eflags >> IOPL_SHIFT) & 3;
2625	if (cpl <= iopl)
2626	eflags_mask \|= IF_MASK;
2627	if (shift == 0)
2628	eflags_mask &= 0xffff;
2629	load_eflags(new_eflags, eflags_mask);
2630	}
2631	return;
2632
2633	return_to_vm86:
2634
2635	#if 0 // defined(VBOX) && defined(DEBUG)
2636	printf("V86: new CS %04X\n", new_cs);
2637	printf("V86: Descriptor %08X:%08X\n", e2, e1);
2638	printf("V86: new EIP %08X\n", new_eip);
2639	printf("V86: new EFLAGS %08X\n", new_eflags);
2640	#endif
2641
2642	POPL(ssp, sp, sp_mask, new_esp);
2643	POPL(ssp, sp, sp_mask, new_ss);
2644	POPL(ssp, sp, sp_mask, new_es);
2645	POPL(ssp, sp, sp_mask, new_ds);
2646	POPL(ssp, sp, sp_mask, new_fs);
2647	POPL(ssp, sp, sp_mask, new_gs);
2648
2649	/* modify processor state */
2650	load_eflags(new_eflags, TF_MASK \| AC_MASK \| ID_MASK \|
2651	IF_MASK \| IOPL_MASK \| VM_MASK \| NT_MASK \| VIF_MASK \| VIP_MASK);
2652	load_seg_vm(R_CS, new_cs & 0xffff);
2653	cpu_x86_set_cpl(env, 3);
2654	load_seg_vm(R_SS, new_ss & 0xffff);
2655	load_seg_vm(R_ES, new_es & 0xffff);
2656	load_seg_vm(R_DS, new_ds & 0xffff);
2657	load_seg_vm(R_FS, new_fs & 0xffff);
2658	load_seg_vm(R_GS, new_gs & 0xffff);
2659
2660	env->eip = new_eip & 0xffff;
2661	ESP = new_esp;
2662	}
2663
2664	void helper_iret_protected(int shift, int next_eip)
2665	{
2666	int tss_selector, type;
2667	uint32_t e1, e2;
2668
2669	#ifdef VBOX
2670	remR3TrapClear(env->pVM);
2671	#endif
2672
2673	/* specific case for TSS */
2674	if (env->eflags & NT_MASK) {
2675	#ifdef TARGET_X86_64
2676	if (env->hflags & HF_LMA_MASK)
2677	raise_exception_err(EXCP0D_GPF, 0);
2678	#endif
2679	tss_selector = lduw_kernel(env->tr.base + 0);
2680	if (tss_selector & 4)
2681	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2682	if (load_segment(&e1, &e2, tss_selector) != 0)
2683	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2684	type = (e2 >> DESC_TYPE_SHIFT) & 0x17;
2685	/* NOTE: we check both segment and busy TSS */
2686	if (type != 3)
2687	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2688	switch_tss(tss_selector, e1, e2, SWITCH_TSS_IRET, next_eip);
2689	} else {
2690	helper_ret_protected(shift, 1, 0);
2691	}
2692	#ifdef USE_KQEMU
2693	if (kqemu_is_ok(env)) {
2694	CC_OP = CC_OP_EFLAGS;
2695	env->exception_index = -1;
2696	cpu_loop_exit();
2697	}
2698	#endif
2699	}
2700
2701	void helper_lret_protected(int shift, int addend)
2702	{
2703	helper_ret_protected(shift, 0, addend);
2704	#ifdef USE_KQEMU
2705	if (kqemu_is_ok(env)) {
2706	env->exception_index = -1;
2707	cpu_loop_exit();
2708	}
2709	#endif
2710	}
2711
2712	void helper_sysenter(void)
2713	{
2714	if (env->sysenter_cs == 0) {
2715	raise_exception_err(EXCP0D_GPF, 0);
2716	}
2717	env->eflags &= ~(VM_MASK \| IF_MASK \| RF_MASK);
2718	cpu_x86_set_cpl(env, 0);
2719	cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc,
2720	0, 0xffffffff,
2721	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2722	DESC_S_MASK \|
2723	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
2724	cpu_x86_load_seg_cache(env, R_SS, (env->sysenter_cs + 8) & 0xfffc,
2725	0, 0xffffffff,
2726	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2727	DESC_S_MASK \|
2728	DESC_W_MASK \| DESC_A_MASK);
2729	ESP = env->sysenter_esp;
2730	EIP = env->sysenter_eip;
2731	}
2732
2733	void helper_sysexit(void)
2734	{
2735	int cpl;
2736
2737	cpl = env->hflags & HF_CPL_MASK;
2738	if (env->sysenter_cs == 0 \|\| cpl != 0) {
2739	raise_exception_err(EXCP0D_GPF, 0);
2740	}
2741	cpu_x86_set_cpl(env, 3);
2742	cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 16) & 0xfffc) \| 3,
2743	0, 0xffffffff,
2744	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2745	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
2746	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
2747	cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 24) & 0xfffc) \| 3,
2748	0, 0xffffffff,
2749	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2750	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
2751	DESC_W_MASK \| DESC_A_MASK);
2752	ESP = ECX;
2753	EIP = EDX;
2754	#ifdef USE_KQEMU
2755	if (kqemu_is_ok(env)) {
2756	env->exception_index = -1;
2757	cpu_loop_exit();
2758	}
2759	#endif
2760	}
2761
2762	void helper_movl_crN_T0(int reg)
2763	{
2764	#if !defined(CONFIG_USER_ONLY)
2765	switch(reg) {
2766	case 0:
2767	cpu_x86_update_cr0(env, T0);
2768	break;
2769	case 3:
2770	cpu_x86_update_cr3(env, T0);
2771	break;
2772	case 4:
2773	cpu_x86_update_cr4(env, T0);
2774	break;
2775	case 8:
2776	cpu_set_apic_tpr(env, T0);
2777	break;
2778	default:
2779	env->cr[reg] = T0;
2780	break;
2781	}
2782	#endif
2783	}
2784
2785	/* XXX: do more */
2786	void helper_movl_drN_T0(int reg)
2787	{
2788	env->dr[reg] = T0;
2789	}
2790
2791	void helper_invlpg(target_ulong addr)
2792	{
2793	cpu_x86_flush_tlb(env, addr);
2794	}
2795
2796	void helper_rdtsc(void)
2797	{
2798	uint64_t val;
2799
2800	if ((env->cr[4] & CR4_TSD_MASK) && ((env->hflags & HF_CPL_MASK) != 0)) {
2801	raise_exception(EXCP0D_GPF);
2802	}
2803	val = cpu_get_tsc(env);
2804	EAX = (uint32_t)(val);
2805	EDX = (uint32_t)(val >> 32);
2806	}
2807
2808	#if defined(CONFIG_USER_ONLY)
2809	void helper_wrmsr(void)
2810	{
2811	}
2812
2813	void helper_rdmsr(void)
2814	{
2815	}
2816	#else
2817	void helper_wrmsr(void)
2818	{
2819	uint64_t val;
2820
2821	val = ((uint32_t)EAX) \| ((uint64_t)((uint32_t)EDX) << 32);
2822
2823	switch((uint32_t)ECX) {
2824	case MSR_IA32_SYSENTER_CS:
2825	env->sysenter_cs = val & 0xffff;
2826	break;
2827	case MSR_IA32_SYSENTER_ESP:
2828	env->sysenter_esp = val;
2829	break;
2830	case MSR_IA32_SYSENTER_EIP:
2831	env->sysenter_eip = val;
2832	break;
2833	case MSR_IA32_APICBASE:
2834	cpu_set_apic_base(env, val);
2835	break;
2836	case MSR_EFER:
2837	{
2838	uint64_t update_mask;
2839	update_mask = 0;
2840	if (env->cpuid_ext2_features & CPUID_EXT2_SYSCALL)
2841	update_mask \|= MSR_EFER_SCE;
2842	if (env->cpuid_ext2_features & CPUID_EXT2_LM)
2843	update_mask \|= MSR_EFER_LME;
2844	if (env->cpuid_ext2_features & CPUID_EXT2_FFXSR)
2845	update_mask \|= MSR_EFER_FFXSR;
2846	if (env->cpuid_ext2_features & CPUID_EXT2_NX)
2847	update_mask \|= MSR_EFER_NXE;
2848	env->efer = (env->efer & ~update_mask) \|
2849	(val & update_mask);
2850	}
2851	break;
2852	case MSR_STAR:
2853	env->star = val;
2854	break;
2855	case MSR_PAT:
2856	env->pat = val;
2857	break;
2858	#ifdef TARGET_X86_64
2859	case MSR_LSTAR:
2860	env->lstar = val;
2861	break;
2862	case MSR_CSTAR:
2863	env->cstar = val;
2864	break;
2865	case MSR_FMASK:
2866	env->fmask = val;
2867	break;
2868	case MSR_FSBASE:
2869	env->segs[R_FS].base = val;
2870	break;
2871	case MSR_GSBASE:
2872	env->segs[R_GS].base = val;
2873	break;
2874	case MSR_KERNELGSBASE:
2875	env->kernelgsbase = val;
2876	break;
2877	#endif
2878	default:
2879	/* XXX: exception ? */
2880	break;
2881	}
2882	}
2883
2884	void helper_rdmsr(void)
2885	{
2886	uint64_t val;
2887	switch((uint32_t)ECX) {
2888	case MSR_IA32_SYSENTER_CS:
2889	val = env->sysenter_cs;
2890	break;
2891	case MSR_IA32_SYSENTER_ESP:
2892	val = env->sysenter_esp;
2893	break;
2894	case MSR_IA32_SYSENTER_EIP:
2895	val = env->sysenter_eip;
2896	break;
2897	case MSR_IA32_APICBASE:
2898	val = cpu_get_apic_base(env);
2899	break;
2900	case MSR_EFER:
2901	val = env->efer;
2902	break;
2903	case MSR_STAR:
2904	val = env->star;
2905	break;
2906	case MSR_PAT:
2907	val = env->pat;
2908	break;
2909	#ifdef TARGET_X86_64
2910	case MSR_LSTAR:
2911	val = env->lstar;
2912	break;
2913	case MSR_CSTAR:
2914	val = env->cstar;
2915	break;
2916	case MSR_FMASK:
2917	val = env->fmask;
2918	break;
2919	case MSR_FSBASE:
2920	val = env->segs[R_FS].base;
2921	break;
2922	case MSR_GSBASE:
2923	val = env->segs[R_GS].base;
2924	break;
2925	case MSR_KERNELGSBASE:
2926	val = env->kernelgsbase;
2927	break;
2928	#endif
2929	default:
2930	/* XXX: exception ? */
2931	val = 0;
2932	break;
2933	}
2934	EAX = (uint32_t)(val);
2935	EDX = (uint32_t)(val >> 32);
2936	}
2937	#endif
2938
2939	void helper_lsl(void)
2940	{
2941	unsigned int selector, limit;
2942	uint32_t e1, e2, eflags;
2943	int rpl, dpl, cpl, type;
2944
2945	eflags = cc_table[CC_OP].compute_all();
2946	selector = T0 & 0xffff;
2947	if (load_segment(&e1, &e2, selector) != 0)
2948	goto fail;
2949	rpl = selector & 3;
2950	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2951	cpl = env->hflags & HF_CPL_MASK;
2952	if (e2 & DESC_S_MASK) {
2953	if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) {
2954	/* conforming */
2955	} else {
2956	if (dpl < cpl \|\| dpl < rpl)
2957	goto fail;
2958	}
2959	} else {
2960	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2961	switch(type) {
2962	case 1:
2963	case 2:
2964	case 3:
2965	case 9:
2966	case 11:
2967	break;
2968	default:
2969	goto fail;
2970	}
2971	if (dpl < cpl \|\| dpl < rpl) {
2972	fail:
2973	CC_SRC = eflags & ~CC_Z;
2974	return;
2975	}
2976	}
2977	limit = get_seg_limit(e1, e2);
2978	T1 = limit;
2979	CC_SRC = eflags \| CC_Z;
2980	}
2981
2982	void helper_lar(void)
2983	{
2984	unsigned int selector;
2985	uint32_t e1, e2, eflags;
2986	int rpl, dpl, cpl, type;
2987
2988	eflags = cc_table[CC_OP].compute_all();
2989	selector = T0 & 0xffff;
2990	if ((selector & 0xfffc) == 0)
2991	goto fail;
2992	if (load_segment(&e1, &e2, selector) != 0)
2993	goto fail;
2994	rpl = selector & 3;
2995	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2996	cpl = env->hflags & HF_CPL_MASK;
2997	if (e2 & DESC_S_MASK) {
2998	if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) {
2999	/* conforming */
3000	} else {
3001	if (dpl < cpl \|\| dpl < rpl)
3002	goto fail;
3003	}
3004	} else {
3005	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
3006	switch(type) {
3007	case 1:
3008	case 2:
3009	case 3:
3010	case 4:
3011	case 5:
3012	case 9:
3013	case 11:
3014	case 12:
3015	break;
3016	default:
3017	goto fail;
3018	}
3019	if (dpl < cpl \|\| dpl < rpl) {
3020	fail:
3021	CC_SRC = eflags & ~CC_Z;
3022	return;
3023	}
3024	}
3025	T1 = e2 & 0x00f0ff00;
3026	CC_SRC = eflags \| CC_Z;
3027	}
3028
3029	void helper_verr(void)
3030	{
3031	unsigned int selector;
3032	uint32_t e1, e2, eflags;
3033	int rpl, dpl, cpl;
3034
3035	eflags = cc_table[CC_OP].compute_all();
3036	selector = T0 & 0xffff;
3037	if ((selector & 0xfffc) == 0)
3038	goto fail;
3039	if (load_segment(&e1, &e2, selector) != 0)
3040	goto fail;
3041	if (!(e2 & DESC_S_MASK))
3042	goto fail;
3043	rpl = selector & 3;
3044	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
3045	cpl = env->hflags & HF_CPL_MASK;
3046	if (e2 & DESC_CS_MASK) {
3047	if (!(e2 & DESC_R_MASK))
3048	goto fail;
3049	if (!(e2 & DESC_C_MASK)) {
3050	if (dpl < cpl \|\| dpl < rpl)
3051	goto fail;
3052	}
3053	} else {
3054	if (dpl < cpl \|\| dpl < rpl) {
3055	fail:
3056	CC_SRC = eflags & ~CC_Z;
3057	return;
3058	}
3059	}
3060	CC_SRC = eflags \| CC_Z;
3061	}
3062
3063	void helper_verw(void)
3064	{
3065	unsigned int selector;
3066	uint32_t e1, e2, eflags;
3067	int rpl, dpl, cpl;
3068
3069	eflags = cc_table[CC_OP].compute_all();
3070	selector = T0 & 0xffff;
3071	if ((selector & 0xfffc) == 0)
3072	goto fail;
3073	if (load_segment(&e1, &e2, selector) != 0)
3074	goto fail;
3075	if (!(e2 & DESC_S_MASK))
3076	goto fail;
3077	rpl = selector & 3;
3078	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
3079	cpl = env->hflags & HF_CPL_MASK;
3080	if (e2 & DESC_CS_MASK) {
3081	goto fail;
3082	} else {
3083	if (dpl < cpl \|\| dpl < rpl)
3084	goto fail;
3085	if (!(e2 & DESC_W_MASK)) {
3086	fail:
3087	CC_SRC = eflags & ~CC_Z;
3088	return;
3089	}
3090	}
3091	CC_SRC = eflags \| CC_Z;
3092	}
3093
3094	/* FPU helpers */
3095
3096	void helper_fldt_ST0_A0(void)
3097	{
3098	int new_fpstt;
3099	new_fpstt = (env->fpstt - 1) & 7;
3100	env->fpregs[new_fpstt].d = helper_fldt(A0);
3101	env->fpstt = new_fpstt;
3102	env->fptags[new_fpstt] = 0; /* validate stack entry */
3103	}
3104
3105	void helper_fstt_ST0_A0(void)
3106	{
3107	helper_fstt(ST0, A0);
3108	}
3109
3110	void fpu_set_exception(int mask)
3111	{
3112	env->fpus \|= mask;
3113	if (env->fpus & (~env->fpuc & FPUC_EM))
3114	env->fpus \|= FPUS_SE \| FPUS_B;
3115	}
3116
3117	CPU86_LDouble helper_fdiv(CPU86_LDouble a, CPU86_LDouble b)
3118	{
3119	if (b == 0.0)
3120	fpu_set_exception(FPUS_ZE);
3121	return a / b;
3122	}
3123
3124	void fpu_raise_exception(void)
3125	{
3126	if (env->cr[0] & CR0_NE_MASK) {
3127	raise_exception(EXCP10_COPR);
3128	}
3129	#if !defined(CONFIG_USER_ONLY)
3130	else {
3131	cpu_set_ferr(env);
3132	}
3133	#endif
3134	}
3135
3136	/* BCD ops */
3137
3138	void helper_fbld_ST0_A0(void)
3139	{
3140	CPU86_LDouble tmp;
3141	uint64_t val;
3142	unsigned int v;
3143	int i;
3144
3145	val = 0;
3146	for(i = 8; i >= 0; i--) {
3147	v = ldub(A0 + i);
3148	val = (val * 100) + ((v >> 4) * 10) + (v & 0xf);
3149	}
3150	tmp = val;
3151	if (ldub(A0 + 9) & 0x80)
3152	tmp = -tmp;
3153	fpush();
3154	ST0 = tmp;
3155	}
3156
3157	void helper_fbst_ST0_A0(void)
3158	{
3159	int v;
3160	target_ulong mem_ref, mem_end;
3161	int64_t val;
3162
3163	val = floatx_to_int64(ST0, &env->fp_status);
3164	mem_ref = A0;
3165	mem_end = mem_ref + 9;
3166	if (val < 0) {
3167	stb(mem_end, 0x80);
3168	val = -val;
3169	} else {
3170	stb(mem_end, 0x00);
3171	}
3172	while (mem_ref < mem_end) {
3173	if (val == 0)
3174	break;
3175	v = val % 100;
3176	val = val / 100;
3177	v = ((v / 10) << 4) \| (v % 10);
3178	stb(mem_ref++, v);
3179	}
3180	while (mem_ref < mem_end) {
3181	stb(mem_ref++, 0);
3182	}
3183	}
3184
3185	void helper_f2xm1(void)
3186	{
3187	ST0 = pow(2.0,ST0) - 1.0;
3188	}
3189
3190	void helper_fyl2x(void)
3191	{
3192	CPU86_LDouble fptemp;
3193
3194	fptemp = ST0;
3195	if (fptemp>0.0){
3196	fptemp = log(fptemp)/log(2.0); /* log2(ST) */
3197	ST1 *= fptemp;
3198	fpop();
3199	} else {
3200	env->fpus &= (~0x4700);
3201	env->fpus \|= 0x400;
3202	}
3203	}
3204
3205	void helper_fptan(void)
3206	{
3207	CPU86_LDouble fptemp;
3208
3209	fptemp = ST0;
3210	if((fptemp > MAXTAN)\|\|(fptemp < -MAXTAN)) {
3211	env->fpus \|= 0x400;
3212	} else {
3213	ST0 = tan(fptemp);
3214	fpush();
3215	ST0 = 1.0;
3216	env->fpus &= (~0x400); /* C2 <-- 0 */
3217	/* the above code is for \|arg\| < 2*52 only /
3218	}
3219	}
3220
3221	void helper_fpatan(void)
3222	{
3223	CPU86_LDouble fptemp, fpsrcop;
3224
3225	fpsrcop = ST1;
3226	fptemp = ST0;
3227	ST1 = atan2(fpsrcop,fptemp);
3228	fpop();
3229	}
3230
3231	void helper_fxtract(void)
3232	{
3233	CPU86_LDoubleU temp;
3234	unsigned int expdif;
3235
3236	temp.d = ST0;
3237	expdif = EXPD(temp) - EXPBIAS;
3238	/DP exponent bias/
3239	ST0 = expdif;
3240	fpush();
3241	BIASEXPONENT(temp);
3242	ST0 = temp.d;
3243	}
3244
3245	void helper_fprem1(void)
3246	{
3247	CPU86_LDouble dblq, fpsrcop, fptemp;
3248	CPU86_LDoubleU fpsrcop1, fptemp1;
3249	int expdif;
3250	int q;
3251
3252	fpsrcop = ST0;
3253	fptemp = ST1;
3254	fpsrcop1.d = fpsrcop;
3255	fptemp1.d = fptemp;
3256	expdif = EXPD(fpsrcop1) - EXPD(fptemp1);
3257	if (expdif < 53) {
3258	dblq = fpsrcop / fptemp;
3259	dblq = (dblq < 0.0)? ceil(dblq): floor(dblq);
3260	ST0 = fpsrcop - fptemp*dblq;
3261	q = (int)dblq; /* cutting off top bits is assumed here */
3262	env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3263	/* (C0,C1,C3) <-- (q2,q1,q0) */
3264	env->fpus \|= (q&0x4) << 6; /* (C0) <-- q2 */
3265	env->fpus \|= (q&0x2) << 8; /* (C1) <-- q1 */
3266	env->fpus \|= (q&0x1) << 14; /* (C3) <-- q0 */
3267	} else {
3268	env->fpus \|= 0x400; /* C2 <-- 1 */
3269	fptemp = pow(2.0, expdif-50);
3270	fpsrcop = (ST0 / ST1) / fptemp;
3271	/* fpsrcop = integer obtained by rounding to the nearest */
3272	fpsrcop = (fpsrcop-floor(fpsrcop) < ceil(fpsrcop)-fpsrcop)?
3273	floor(fpsrcop): ceil(fpsrcop);
3274	ST0 -= (ST1 * fpsrcop * fptemp);
3275	}
3276	}
3277
3278	void helper_fprem(void)
3279	{
3280	CPU86_LDouble dblq, fpsrcop, fptemp;
3281	CPU86_LDoubleU fpsrcop1, fptemp1;
3282	int expdif;
3283	int q;
3284
3285	fpsrcop = ST0;
3286	fptemp = ST1;
3287	fpsrcop1.d = fpsrcop;
3288	fptemp1.d = fptemp;
3289	expdif = EXPD(fpsrcop1) - EXPD(fptemp1);
3290	if ( expdif < 53 ) {
3291	dblq = fpsrcop / fptemp;
3292	dblq = (dblq < 0.0)? ceil(dblq): floor(dblq);
3293	ST0 = fpsrcop - fptemp*dblq;
3294	q = (int)dblq; /* cutting off top bits is assumed here */
3295	env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3296	/* (C0,C1,C3) <-- (q2,q1,q0) */
3297	env->fpus \|= (q&0x4) << 6; /* (C0) <-- q2 */
3298	env->fpus \|= (q&0x2) << 8; /* (C1) <-- q1 */
3299	env->fpus \|= (q&0x1) << 14; /* (C3) <-- q0 */
3300	} else {
3301	env->fpus \|= 0x400; /* C2 <-- 1 */
3302	fptemp = pow(2.0, expdif-50);
3303	fpsrcop = (ST0 / ST1) / fptemp;
3304	/* fpsrcop = integer obtained by chopping */
3305	fpsrcop = (fpsrcop < 0.0)?
3306	-(floor(fabs(fpsrcop))): floor(fpsrcop);
3307	ST0 -= (ST1 * fpsrcop * fptemp);
3308	}
3309	}
3310
3311	void helper_fyl2xp1(void)
3312	{
3313	CPU86_LDouble fptemp;
3314
3315	fptemp = ST0;
3316	if ((fptemp+1.0)>0.0) {
3317	fptemp = log(fptemp+1.0) / log(2.0); /* log2(ST+1.0) */
3318	ST1 *= fptemp;
3319	fpop();
3320	} else {
3321	env->fpus &= (~0x4700);
3322	env->fpus \|= 0x400;
3323	}
3324	}
3325
3326	void helper_fsqrt(void)
3327	{
3328	CPU86_LDouble fptemp;
3329
3330	fptemp = ST0;
3331	if (fptemp<0.0) {
3332	env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3333	env->fpus \|= 0x400;
3334	}
3335	ST0 = sqrt(fptemp);
3336	}
3337
3338	void helper_fsincos(void)
3339	{
3340	CPU86_LDouble fptemp;
3341
3342	fptemp = ST0;
3343	if ((fptemp > MAXTAN)\|\|(fptemp < -MAXTAN)) {
3344	env->fpus \|= 0x400;
3345	} else {
3346	ST0 = sin(fptemp);
3347	fpush();
3348	ST0 = cos(fptemp);
3349	env->fpus &= (~0x400); /* C2 <-- 0 */
3350	/* the above code is for \|arg\| < 2*63 only /
3351	}
3352	}
3353
3354	void helper_frndint(void)
3355	{
3356	ST0 = floatx_round_to_int(ST0, &env->fp_status);
3357	}
3358
3359	void helper_fscale(void)
3360	{
3361	ST0 = ldexp (ST0, (int)(ST1));
3362	}
3363
3364	void helper_fsin(void)
3365	{
3366	CPU86_LDouble fptemp;
3367
3368	fptemp = ST0;
3369	if ((fptemp > MAXTAN)\|\|(fptemp < -MAXTAN)) {
3370	env->fpus \|= 0x400;
3371	} else {
3372	ST0 = sin(fptemp);
3373	env->fpus &= (~0x400); /* C2 <-- 0 */
3374	/* the above code is for \|arg\| < 2*53 only /
3375	}
3376	}
3377
3378	void helper_fcos(void)
3379	{
3380	CPU86_LDouble fptemp;
3381
3382	fptemp = ST0;
3383	if((fptemp > MAXTAN)\|\|(fptemp < -MAXTAN)) {
3384	env->fpus \|= 0x400;
3385	} else {
3386	ST0 = cos(fptemp);
3387	env->fpus &= (~0x400); /* C2 <-- 0 */
3388	/* the above code is for \|arg5 < 2*63 only /
3389	}
3390	}
3391
3392	void helper_fxam_ST0(void)
3393	{
3394	CPU86_LDoubleU temp;
3395	int expdif;
3396
3397	temp.d = ST0;
3398
3399	env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3400	if (SIGND(temp))
3401	env->fpus \|= 0x200; /* C1 <-- 1 */
3402
3403	/* XXX: test fptags too */
3404	expdif = EXPD(temp);
3405	if (expdif == MAXEXPD) {
3406	#ifdef USE_X86LDOUBLE
3407	if (MANTD(temp) == 0x8000000000000000ULL)
3408	#else
3409	if (MANTD(temp) == 0)
3410	#endif
3411	env->fpus \|= 0x500 /Infinity/;
3412	else
3413	env->fpus \|= 0x100 /NaN/;
3414	} else if (expdif == 0) {
3415	if (MANTD(temp) == 0)
3416	env->fpus \|= 0x4000 /Zero/;
3417	else
3418	env->fpus \|= 0x4400 /Denormal/;
3419	} else {
3420	env->fpus \|= 0x400;
3421	}
3422	}
3423
3424	void helper_fstenv(target_ulong ptr, int data32)
3425	{
3426	int fpus, fptag, exp, i;
3427	uint64_t mant;
3428	CPU86_LDoubleU tmp;
3429
3430	fpus = (env->fpus & ~0x3800) \| (env->fpstt & 0x7) << 11;
3431	fptag = 0;
3432	for (i=7; i>=0; i--) {
3433	fptag <<= 2;
3434	if (env->fptags[i]) {
3435	fptag \|= 3;
3436	} else {
3437	tmp.d = env->fpregs[i].d;
3438	exp = EXPD(tmp);
3439	mant = MANTD(tmp);
3440	if (exp == 0 && mant == 0) {
3441	/* zero */
3442	fptag \|= 1;
3443	} else if (exp == 0 \|\| exp == MAXEXPD
3444	#ifdef USE_X86LDOUBLE
3445	\|\| (mant & (1LL << 63)) == 0
3446	#endif
3447	) {
3448	/* NaNs, infinity, denormal */
3449	fptag \|= 2;
3450	}
3451	}
3452	}
3453	if (data32) {
3454	/* 32 bit */
3455	stl(ptr, env->fpuc);
3456	stl(ptr + 4, fpus);
3457	stl(ptr + 8, fptag);
3458	stl(ptr + 12, 0); /* fpip */
3459	stl(ptr + 16, 0); /* fpcs */
3460	stl(ptr + 20, 0); /* fpoo */
3461	stl(ptr + 24, 0); /* fpos */
3462	} else {
3463	/* 16 bit */
3464	stw(ptr, env->fpuc);
3465	stw(ptr + 2, fpus);
3466	stw(ptr + 4, fptag);
3467	stw(ptr + 6, 0);
3468	stw(ptr + 8, 0);
3469	stw(ptr + 10, 0);
3470	stw(ptr + 12, 0);
3471	}
3472	}
3473
3474	void helper_fldenv(target_ulong ptr, int data32)
3475	{
3476	int i, fpus, fptag;
3477
3478	if (data32) {
3479	env->fpuc = lduw(ptr);
3480	fpus = lduw(ptr + 4);
3481	fptag = lduw(ptr + 8);
3482	}
3483	else {
3484	env->fpuc = lduw(ptr);
3485	fpus = lduw(ptr + 2);
3486	fptag = lduw(ptr + 4);
3487	}
3488	env->fpstt = (fpus >> 11) & 7;
3489	env->fpus = fpus & ~0x3800;
3490	for(i = 0;i < 8; i++) {
3491	env->fptags[i] = ((fptag & 3) == 3);
3492	fptag >>= 2;
3493	}
3494	}
3495
3496	void helper_fsave(target_ulong ptr, int data32)
3497	{
3498	CPU86_LDouble tmp;
3499	int i;
3500
3501	helper_fstenv(ptr, data32);
3502
3503	ptr += (14 << data32);
3504	for(i = 0;i < 8; i++) {
3505	tmp = ST(i);
3506	helper_fstt(tmp, ptr);
3507	ptr += 10;
3508	}
3509
3510	/* fninit */
3511	env->fpus = 0;
3512	env->fpstt = 0;
3513	env->fpuc = 0x37f;
3514	env->fptags[0] = 1;
3515	env->fptags[1] = 1;
3516	env->fptags[2] = 1;
3517	env->fptags[3] = 1;
3518	env->fptags[4] = 1;
3519	env->fptags[5] = 1;
3520	env->fptags[6] = 1;
3521	env->fptags[7] = 1;
3522	}
3523
3524	void helper_frstor(target_ulong ptr, int data32)
3525	{
3526	CPU86_LDouble tmp;
3527	int i;
3528
3529	helper_fldenv(ptr, data32);
3530	ptr += (14 << data32);
3531
3532	for(i = 0;i < 8; i++) {
3533	tmp = helper_fldt(ptr);
3534	ST(i) = tmp;
3535	ptr += 10;
3536	}
3537	}
3538
3539	void helper_fxsave(target_ulong ptr, int data64)
3540	{
3541	int fpus, fptag, i, nb_xmm_regs;
3542	CPU86_LDouble tmp;
3543	target_ulong addr;
3544
3545	fpus = (env->fpus & ~0x3800) \| (env->fpstt & 0x7) << 11;
3546	fptag = 0;
3547	for(i = 0; i < 8; i++) {
3548	fptag \|= (env->fptags[i] << i);
3549	}
3550	stw(ptr, env->fpuc);
3551	stw(ptr + 2, fpus);
3552	stw(ptr + 4, fptag ^ 0xff);
3553
3554	addr = ptr + 0x20;
3555	for(i = 0;i < 8; i++) {
3556	tmp = ST(i);
3557	helper_fstt(tmp, addr);
3558	addr += 16;
3559	}
3560
3561	if (env->cr[4] & CR4_OSFXSR_MASK) {
3562	/* XXX: finish it */
3563	stl(ptr + 0x18, env->mxcsr); /* mxcsr */
3564	stl(ptr + 0x1c, 0x0000ffff); /* mxcsr_mask */
3565	nb_xmm_regs = 8 << data64;
3566	addr = ptr + 0xa0;
3567	for(i = 0; i < nb_xmm_regs; i++) {
3568	stq(addr, env->xmm_regs[i].XMM_Q(0));
3569	stq(addr + 8, env->xmm_regs[i].XMM_Q(1));
3570	addr += 16;
3571	}
3572	}
3573	}
3574
3575	void helper_fxrstor(target_ulong ptr, int data64)
3576	{
3577	int i, fpus, fptag, nb_xmm_regs;
3578	CPU86_LDouble tmp;
3579	target_ulong addr;
3580
3581	env->fpuc = lduw(ptr);
3582	fpus = lduw(ptr + 2);
3583	fptag = lduw(ptr + 4);
3584	env->fpstt = (fpus >> 11) & 7;
3585	env->fpus = fpus & ~0x3800;
3586	fptag ^= 0xff;
3587	for(i = 0;i < 8; i++) {
3588	env->fptags[i] = ((fptag >> i) & 1);
3589	}
3590
3591	addr = ptr + 0x20;
3592	for(i = 0;i < 8; i++) {
3593	tmp = helper_fldt(addr);
3594	ST(i) = tmp;
3595	addr += 16;
3596	}
3597
3598	if (env->cr[4] & CR4_OSFXSR_MASK) {
3599	/* XXX: finish it */
3600	env->mxcsr = ldl(ptr + 0x18);
3601	//ldl(ptr + 0x1c);
3602	nb_xmm_regs = 8 << data64;
3603	addr = ptr + 0xa0;
3604	for(i = 0; i < nb_xmm_regs; i++) {
3605	#if !defined(VBOX) \|\| __GNUC__ < 4
3606	env->xmm_regs[i].XMM_Q(0) = ldq(addr);
3607	env->xmm_regs[i].XMM_Q(1) = ldq(addr + 8);
3608	#else /* VBOX + __GNUC__ >= 4: gcc 4.x compiler bug - it runs out of registers for the 64-bit value. */
3609	# if 1
3610	env->xmm_regs[i].XMM_L(0) = ldl(addr);
3611	env->xmm_regs[i].XMM_L(1) = ldl(addr + 4);
3612	env->xmm_regs[i].XMM_L(2) = ldl(addr + 8);
3613	env->xmm_regs[i].XMM_L(3) = ldl(addr + 12);
3614	# else
3615	/* this works fine on Mac OS X, gcc 4.0.1 */
3616	uint64_t u64 = ldq(addr);
3617	env->xmm_regs[i].XMM_Q(0);
3618	u64 = ldq(addr + 4);
3619	env->xmm_regs[i].XMM_Q(1) = u64;
3620	# endif
3621	#endif
3622	addr += 16;
3623	}
3624	}
3625	}
3626
3627	#ifndef USE_X86LDOUBLE
3628
3629	void cpu_get_fp80(uint64_t pmant, uint16_t pexp, CPU86_LDouble f)
3630	{
3631	CPU86_LDoubleU temp;
3632	int e;
3633
3634	temp.d = f;
3635	/* mantissa */
3636	*pmant = (MANTD(temp) << 11) \| (1LL << 63);
3637	/* exponent + sign */
3638	e = EXPD(temp) - EXPBIAS + 16383;
3639	e \|= SIGND(temp) >> 16;
3640	*pexp = e;
3641	}
3642
3643	CPU86_LDouble cpu_set_fp80(uint64_t mant, uint16_t upper)
3644	{
3645	CPU86_LDoubleU temp;
3646	int e;
3647	uint64_t ll;
3648
3649	/* XXX: handle overflow ? */
3650	e = (upper & 0x7fff) - 16383 + EXPBIAS; /* exponent */
3651	e \|= (upper >> 4) & 0x800; /* sign */
3652	ll = (mant >> 11) & ((1LL << 52) - 1);
3653	#ifdef __arm__
3654	temp.l.upper = (e << 20) \| (ll >> 32);
3655	temp.l.lower = ll;
3656	#else
3657	temp.ll = ll \| ((uint64_t)e << 52);
3658	#endif
3659	return temp.d;
3660	}
3661
3662	#else
3663
3664	void cpu_get_fp80(uint64_t pmant, uint16_t pexp, CPU86_LDouble f)
3665	{
3666	CPU86_LDoubleU temp;
3667
3668	temp.d = f;
3669	*pmant = temp.l.lower;
3670	*pexp = temp.l.upper;
3671	}
3672
3673	CPU86_LDouble cpu_set_fp80(uint64_t mant, uint16_t upper)
3674	{
3675	CPU86_LDoubleU temp;
3676
3677	temp.l.upper = upper;
3678	temp.l.lower = mant;
3679	return temp.d;
3680	}
3681	#endif
3682
3683	#ifdef TARGET_X86_64
3684
3685	//#define DEBUG_MULDIV
3686
3687	static void add128(uint64_t plow, uint64_t phigh, uint64_t a, uint64_t b)
3688	{
3689	*plow += a;
3690	/* carry test */
3691	if (*plow < a)
3692	(*phigh)++;
3693	*phigh += b;
3694	}
3695
3696	static void neg128(uint64_t plow, uint64_t phigh)
3697	{
3698	plow = ~ plow;
3699	phigh = ~ phigh;
3700	add128(plow, phigh, 1, 0);
3701	}
3702
3703	static void mul64(uint64_t plow, uint64_t phigh, uint64_t a, uint64_t b)
3704	{
3705	uint32_t a0, a1, b0, b1;
3706	uint64_t v;
3707
3708	a0 = a;
3709	a1 = a >> 32;
3710
3711	b0 = b;
3712	b1 = b >> 32;
3713
3714	v = (uint64_t)a0 * (uint64_t)b0;
3715	*plow = v;
3716	*phigh = 0;
3717
3718	v = (uint64_t)a0 * (uint64_t)b1;
3719	add128(plow, phigh, v << 32, v >> 32);
3720
3721	v = (uint64_t)a1 * (uint64_t)b0;
3722	add128(plow, phigh, v << 32, v >> 32);
3723
3724	v = (uint64_t)a1 * (uint64_t)b1;
3725	*phigh += v;
3726	#ifdef DEBUG_MULDIV
3727	printf("mul: 0x%016" PRIx64 " * 0x%016" PRIx64 " = 0x%016" PRIx64 "%016" PRIx64 "\n",
3728	a, b, phigh, plow);
3729	#endif
3730	}
3731
3732	static void imul64(uint64_t plow, uint64_t phigh, int64_t a, int64_t b)
3733	{
3734	int sa, sb;
3735	sa = (a < 0);
3736	if (sa)
3737	a = -a;
3738	sb = (b < 0);
3739	if (sb)
3740	b = -b;
3741	mul64(plow, phigh, a, b);
3742	if (sa ^ sb) {
3743	neg128(plow, phigh);
3744	}
3745	}
3746
3747	/* return TRUE if overflow */
3748	static int div64(uint64_t plow, uint64_t phigh, uint64_t b)
3749	{
3750	uint64_t q, r, a1, a0;
3751	int i, qb, ab;
3752
3753	a0 = *plow;
3754	a1 = *phigh;
3755	if (a1 == 0) {
3756	q = a0 / b;
3757	r = a0 % b;
3758	*plow = q;
3759	*phigh = r;
3760	} else {
3761	if (a1 >= b)
3762	return 1;
3763	/* XXX: use a better algorithm */
3764	for(i = 0; i < 64; i++) {
3765	ab = a1 >> 63;
3766	a1 = (a1 << 1) \| (a0 >> 63);
3767	if (ab \|\| a1 >= b) {
3768	a1 -= b;
3769	qb = 1;
3770	} else {
3771	qb = 0;
3772	}
3773	a0 = (a0 << 1) \| qb;
3774	}
3775	#if defined(DEBUG_MULDIV)
3776	printf("div: 0x%016" PRIx64 "%016" PRIx64 " / 0x%016" PRIx64 ": q=0x%016" PRIx64 " r=0x%016" PRIx64 "\n",
3777	phigh, plow, b, a0, a1);
3778	#endif
3779	*plow = a0;
3780	*phigh = a1;
3781	}
3782	return 0;
3783	}
3784
3785	/* return TRUE if overflow */
3786	static int idiv64(uint64_t plow, uint64_t phigh, int64_t b)
3787	{
3788	int sa, sb;
3789	sa = ((int64_t)*phigh < 0);
3790	if (sa)
3791	neg128(plow, phigh);
3792	sb = (b < 0);
3793	if (sb)
3794	b = -b;
3795	if (div64(plow, phigh, b) != 0)
3796	return 1;
3797	if (sa ^ sb) {
3798	if (*plow > (1ULL << 63))
3799	return 1;
3800	plow = - plow;
3801	} else {
3802	if (*plow >= (1ULL << 63))
3803	return 1;
3804	}
3805	if (sa)
3806	phigh = - phigh;
3807	return 0;
3808	}
3809
3810	void helper_mulq_EAX_T0(void)
3811	{
3812	uint64_t r0, r1;
3813
3814	mul64(&r0, &r1, EAX, T0);
3815	EAX = r0;
3816	EDX = r1;
3817	CC_DST = r0;
3818	CC_SRC = r1;
3819	}
3820
3821	void helper_imulq_EAX_T0(void)
3822	{
3823	uint64_t r0, r1;
3824
3825	imul64(&r0, &r1, EAX, T0);
3826	EAX = r0;
3827	EDX = r1;
3828	CC_DST = r0;
3829	CC_SRC = ((int64_t)r1 != ((int64_t)r0 >> 63));
3830	}
3831
3832	void helper_imulq_T0_T1(void)
3833	{
3834	uint64_t r0, r1;
3835
3836	imul64(&r0, &r1, T0, T1);
3837	T0 = r0;
3838	CC_DST = r0;
3839	CC_SRC = ((int64_t)r1 != ((int64_t)r0 >> 63));
3840	}
3841
3842	void helper_divq_EAX_T0(void)
3843	{
3844	uint64_t r0, r1;
3845	if (T0 == 0) {
3846	raise_exception(EXCP00_DIVZ);
3847	}
3848	r0 = EAX;
3849	r1 = EDX;
3850	if (div64(&r0, &r1, T0))
3851	raise_exception(EXCP00_DIVZ);
3852	EAX = r0;
3853	EDX = r1;
3854	}
3855
3856	void helper_idivq_EAX_T0(void)
3857	{
3858	uint64_t r0, r1;
3859	if (T0 == 0) {
3860	raise_exception(EXCP00_DIVZ);
3861	}
3862	r0 = EAX;
3863	r1 = EDX;
3864	if (idiv64(&r0, &r1, T0))
3865	raise_exception(EXCP00_DIVZ);
3866	EAX = r0;
3867	EDX = r1;
3868	}
3869
3870	void helper_bswapq_T0(void)
3871	{
3872	T0 = bswap64(T0);
3873	}
3874	#endif
3875
3876	void helper_hlt(void)
3877	{
3878	env->hflags &= ~HF_INHIBIT_IRQ_MASK; /* needed if sti is just before */
3879	env->hflags \|= HF_HALTED_MASK;
3880	env->exception_index = EXCP_HLT;
3881	cpu_loop_exit();
3882	}
3883
3884	void helper_monitor(void)
3885	{
3886	if ((uint32_t)ECX != 0)
3887	raise_exception(EXCP0D_GPF);
3888	/* XXX: store address ? */
3889	}
3890
3891	void helper_mwait(void)
3892	{
3893	if ((uint32_t)ECX != 0)
3894	raise_exception(EXCP0D_GPF);
3895	#ifdef VBOX
3896	helper_hlt();
3897	#else
3898	/* XXX: not complete but not completely erroneous */
3899	if (env->cpu_index != 0 \|\| env->next_cpu != NULL) {
3900	/* more than one CPU: do not sleep because another CPU may
3901	wake this one */
3902	} else {
3903	helper_hlt();
3904	}
3905	#endif
3906	}
3907
3908	float approx_rsqrt(float a)
3909	{
3910	return 1.0 / sqrt(a);
3911	}
3912
3913	float approx_rcp(float a)
3914	{
3915	return 1.0 / a;
3916	}
3917
3918	void update_fp_status(void)
3919	{
3920	int rnd_type;
3921
3922	/* set rounding mode */
3923	switch(env->fpuc & RC_MASK) {
3924	default:
3925	case RC_NEAR:
3926	rnd_type = float_round_nearest_even;
3927	break;
3928	case RC_DOWN:
3929	rnd_type = float_round_down;
3930	break;
3931	case RC_UP:
3932	rnd_type = float_round_up;
3933	break;
3934	case RC_CHOP:
3935	rnd_type = float_round_to_zero;
3936	break;
3937	}
3938	set_float_rounding_mode(rnd_type, &env->fp_status);
3939	#ifdef FLOATX80
3940	switch((env->fpuc >> 8) & 3) {
3941	case 0:
3942	rnd_type = 32;
3943	break;
3944	case 2:
3945	rnd_type = 64;
3946	break;
3947	case 3:
3948	default:
3949	rnd_type = 80;
3950	break;
3951	}
3952	set_floatx80_rounding_precision(rnd_type, &env->fp_status);
3953	#endif
3954	}
3955
3956	#if !defined(CONFIG_USER_ONLY)
3957
3958	#define MMUSUFFIX _mmu
3959	#define GETPC() (__builtin_return_address(0))
3960
3961	#define SHIFT 0
3962	#include "softmmu_template.h"
3963
3964	#define SHIFT 1
3965	#include "softmmu_template.h"
3966
3967	#define SHIFT 2
3968	#include "softmmu_template.h"
3969
3970	#define SHIFT 3
3971	#include "softmmu_template.h"
3972
3973	#endif
3974
3975	/* try to fill the TLB and return an exception if error. If retaddr is
3976	NULL, it means that the function was called in C code (i.e. not
3977	from generated code or from helper.c) */
3978	/* XXX: fix it to restore all registers */
3979	void tlb_fill(target_ulong addr, int is_write, int is_user, void *retaddr)
3980	{
3981	TranslationBlock *tb;
3982	int ret;
3983	unsigned long pc;
3984	CPUX86State *saved_env;
3985
3986	/* XXX: hack to restore env in all cases, even if not called from
3987	generated code */
3988	saved_env = env;
3989	env = cpu_single_env;
3990
3991	ret = cpu_x86_handle_mmu_fault(env, addr, is_write, is_user, 1);
3992	if (ret) {
3993	if (retaddr) {
3994	/* now we have a real cpu fault */
3995	pc = (unsigned long)retaddr;
3996	tb = tb_find_pc(pc);
3997	if (tb) {
3998	/* the PC is inside the translated code. It means that we have
3999	a virtual CPU fault */
4000	cpu_restore_state(tb, env, pc, NULL);
4001	}
4002	}
4003	if (retaddr)
4004	raise_exception_err(env->exception_index, env->error_code);
4005	else
4006	raise_exception_err_norestore(env->exception_index, env->error_code);
4007	}
4008	env = saved_env;
4009	}
4010
4011	#ifdef VBOX
4012
4013	/**
4014	* Correctly computes the eflags.
4015	* @returns eflags.
4016	* @param env1 CPU environment.
4017	*/
4018	uint32_t raw_compute_eflags(CPUX86State *env1)
4019	{
4020	CPUX86State *savedenv = env;
4021	env = env1;
4022	uint32_t efl = compute_eflags();
4023	env = savedenv;
4024	return efl;
4025	}
4026
4027	/**
4028	* Reads byte from virtual address in guest memory area.
4029	* XXX: is it working for any addresses? swapped out pages?
4030	* @returns readed data byte.
4031	* @param env1 CPU environment.
4032	* @param pvAddr GC Virtual address.
4033	*/
4034	uint8_t read_byte(CPUX86State *env1, target_ulong addr)
4035	{
4036	CPUX86State *savedenv = env;
4037	env = env1;
4038	uint8_t u8 = ldub_kernel(addr);
4039	env = savedenv;
4040	return u8;
4041	}
4042
4043	/**
4044	* Reads byte from virtual address in guest memory area.
4045	* XXX: is it working for any addresses? swapped out pages?
4046	* @returns readed data byte.
4047	* @param env1 CPU environment.
4048	* @param pvAddr GC Virtual address.
4049	*/
4050	uint16_t read_word(CPUX86State *env1, target_ulong addr)
4051	{
4052	CPUX86State *savedenv = env;
4053	env = env1;
4054	uint16_t u16 = lduw_kernel(addr);
4055	env = savedenv;
4056	return u16;
4057	}
4058
4059	/**
4060	* Reads byte from virtual address in guest memory area.
4061	* XXX: is it working for any addresses? swapped out pages?
4062	* @returns readed data byte.
4063	* @param env1 CPU environment.
4064	* @param pvAddr GC Virtual address.
4065	*/
4066	uint32_t read_dword(CPUX86State *env1, target_ulong addr)
4067	{
4068	CPUX86State *savedenv = env;
4069	env = env1;
4070	uint32_t u32 = ldl_kernel(addr);
4071	env = savedenv;
4072	return u32;
4073	}
4074
4075	/**
4076	* Writes byte to virtual address in guest memory area.
4077	* XXX: is it working for any addresses? swapped out pages?
4078	* @returns readed data byte.
4079	* @param env1 CPU environment.
4080	* @param pvAddr GC Virtual address.
4081	* @param val byte value
4082	*/
4083	void write_byte(CPUX86State *env1, target_ulong addr, uint8_t val)
4084	{
4085	CPUX86State *savedenv = env;
4086	env = env1;
4087	stb(addr, val);
4088	env = savedenv;
4089	}
4090
4091	void write_word(CPUX86State *env1, target_ulong addr, uint16_t val)
4092	{
4093	CPUX86State *savedenv = env;
4094	env = env1;
4095	stw(addr, val);
4096	env = savedenv;
4097	}
4098
4099	void write_dword(CPUX86State *env1, target_ulong addr, uint32_t val)
4100	{
4101	CPUX86State *savedenv = env;
4102	env = env1;
4103	stl(addr, val);
4104	env = savedenv;
4105	}
4106
4107	/**
4108	* Correctly loads selector into segment register with updating internal
4109	* qemu data/caches.
4110	* @param env1 CPU environment.
4111	* @param seg_reg Segment register.
4112	* @param selector Selector to load.
4113	*/
4114	void sync_seg(CPUX86State *env1, int seg_reg, int selector)
4115	{
4116	CPUX86State *savedenv = env;
4117	env = env1;
4118	if (setjmp(env1->jmp_env) == 0)
4119	{
4120	if (seg_reg == R_CS)
4121	{
4122	uint32_t e1, e2;
4123	load_segment(&e1, &e2, selector);
4124	cpu_x86_load_seg_cache(env, R_CS, selector,
4125	get_seg_base(e1, e2),
4126	get_seg_limit(e1, e2),
4127	e2);
4128	}
4129	else
4130	load_seg(seg_reg, selector);
4131	/* Successful sync. */
4132	env->segs[seg_reg].newselector = 0;
4133
4134	env = savedenv;
4135	}
4136	else
4137	{
4138	env = savedenv;
4139
4140	/* Postpone sync until the guest uses the selector. */
4141	env1->segs[seg_reg].selector = selector; /* hidden values are now incorrect, but will be resynced when this register is accessed. */
4142	env1->segs[seg_reg].newselector = selector;
4143	Log(("sync_seg: out of sync seg_reg=%d selector=%#x\n", seg_reg, selector));
4144	}
4145	}
4146
4147
4148	/**
4149	* Correctly loads a new ldtr selector.
4150	*
4151	* @param env1 CPU environment.
4152	* @param selector Selector to load.
4153	*/
4154	void sync_ldtr(CPUX86State *env1, int selector)
4155	{
4156	CPUX86State *saved_env = env;
4157	target_ulong saved_T0 = T0;
4158	if (setjmp(env1->jmp_env) == 0)
4159	{
4160	env = env1;
4161	T0 = selector;
4162	helper_lldt_T0();
4163	T0 = saved_T0;
4164	env = saved_env;
4165	}
4166	else
4167	{
4168	T0 = saved_T0;
4169	env = saved_env;
4170	#ifdef VBOX_STRICT
4171	cpu_abort(env1, "sync_ldtr: selector=%#x\n", selector);
4172	#endif
4173	}
4174	}
4175
4176	/**
4177	* Correctly loads a new tr selector.
4178	*
4179	* @param env1 CPU environment.
4180	* @param selector Selector to load.
4181	*/
4182	int sync_tr(CPUX86State *env1, int selector)
4183	{
4184	/* ARG! this was going to call helper_ltr_T0 but that won't work because of busy flag. */
4185	SegmentCache *dt;
4186	uint32_t e1, e2;
4187	int index, type, entry_limit;
4188	target_ulong ptr;
4189	CPUX86State *saved_env = env;
4190	env = env1;
4191
4192	selector &= 0xffff;
4193	if ((selector & 0xfffc) == 0) {
4194	/* NULL selector case: invalid TR */
4195	env->tr.base = 0;
4196	env->tr.limit = 0;
4197	env->tr.flags = 0;
4198	} else {
4199	if (selector & 0x4)
4200	goto l_failure;
4201	dt = &env->gdt;
4202	index = selector & ~7;
4203	#ifdef TARGET_X86_64
4204	if (env->hflags & HF_LMA_MASK)
4205	entry_limit = 15;
4206	else
4207	#endif
4208	entry_limit = 7;
4209	if ((index + entry_limit) > dt->limit)
4210	goto l_failure;
4211	ptr = dt->base + index;
4212	e1 = ldl_kernel(ptr);
4213	e2 = ldl_kernel(ptr + 4);
4214	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
4215	if ((e2 & DESC_S_MASK) /*\|\|
4216	(type != 1 && type != 9)*/)
4217	goto l_failure;
4218	if (!(e2 & DESC_P_MASK))
4219	goto l_failure;
4220	#ifdef TARGET_X86_64
4221	if (env->hflags & HF_LMA_MASK) {
4222	uint32_t e3;
4223	e3 = ldl_kernel(ptr + 8);
4224	load_seg_cache_raw_dt(&env->tr, e1, e2);
4225	env->tr.base \|= (target_ulong)e3 << 32;
4226	} else
4227	#endif
4228	{
4229	load_seg_cache_raw_dt(&env->tr, e1, e2);
4230	}
4231	e2 \|= DESC_TSS_BUSY_MASK;
4232	stl_kernel(ptr + 4, e2);
4233	}
4234	env->tr.selector = selector;
4235
4236	env = saved_env;
4237	return 0;
4238	l_failure:
4239	AssertMsgFailed(("selector=%d\n", selector));
4240	return -1;
4241	}
4242
4243	int emulate_single_instr(CPUX86State *env1)
4244	{
4245	TranslationBlock *current;
4246	TranslationBlock tb_temp;
4247	int csize;
4248	void (*gen_func)(void);
4249	uint8_t *tc_ptr;
4250	uint32_t old_eip;
4251
4252	/* ensures env is loaded in ebp! */
4253	CPUX86State *savedenv = env;
4254	env = env1;
4255
4256	RAWEx_ProfileStart(env, STATS_EMULATE_SINGLE_INSTR);
4257
4258	tc_ptr = env->pvCodeBuffer;
4259
4260	/*
4261	* Setup temporary translation block.
4262	*/
4263	/* tb_alloc: */
4264	tb_temp.pc = env->segs[R_CS].base + env->eip;
4265	tb_temp.cflags = 0;
4266
4267	/* tb_find_slow: */
4268	tb_temp.tc_ptr = tc_ptr;
4269	tb_temp.cs_base = env->segs[R_CS].base;
4270	tb_temp.flags = env->hflags \| (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
4271
4272	/* Initialize the rest with sensible values. */
4273	tb_temp.size = 0;
4274	tb_temp.phys_hash_next = NULL;
4275	tb_temp.page_next[0] = NULL;
4276	tb_temp.page_next[1] = NULL;
4277	tb_temp.page_addr[0] = 0;
4278	tb_temp.page_addr[1] = 0;
4279	tb_temp.tb_next_offset[0] = 0xffff;
4280	tb_temp.tb_next_offset[1] = 0xffff;
4281	tb_temp.tb_next[0] = 0xffff;
4282	tb_temp.tb_next[1] = 0xffff;
4283	tb_temp.jmp_next[0] = NULL;
4284	tb_temp.jmp_next[1] = NULL;
4285	tb_temp.jmp_first = NULL;
4286
4287	current = env->current_tb;
4288	env->current_tb = NULL;
4289
4290	/*
4291	* Translate only one instruction.
4292	*/
4293	ASMAtomicOrU32(&env->state, CPU_EMULATE_SINGLE_INSTR);
4294	if (cpu_gen_code(env, &tb_temp, env->cbCodeBuffer, &csize) < 0)
4295	{
4296	AssertFailed();
4297	RAWEx_ProfileStop(env, STATS_EMULATE_SINGLE_INSTR);
4298	ASMAtomicAndU32(&env->state, ~CPU_EMULATE_SINGLE_INSTR);
4299	env = savedenv;
4300	return -1;
4301	}
4302	#ifdef DEBUG
4303	if(csize > env->cbCodeBuffer)
4304	{
4305	RAWEx_ProfileStop(env, STATS_EMULATE_SINGLE_INSTR);
4306	AssertFailed();
4307	ASMAtomicAndU32(&env->state, ~CPU_EMULATE_SINGLE_INSTR);
4308	env = savedenv;
4309	return -1;
4310	}
4311	if (tb_temp.tc_ptr != tc_ptr)
4312	{
4313	RAWEx_ProfileStop(env, STATS_EMULATE_SINGLE_INSTR);
4314	AssertFailed();
4315	ASMAtomicAndU32(&env->state, ~CPU_EMULATE_SINGLE_INSTR);
4316	env = savedenv;
4317	return -1;
4318	}
4319	#endif
4320	ASMAtomicAndU32(&env->state, ~CPU_EMULATE_SINGLE_INSTR);
4321
4322	/* tb_link_phys: */
4323	tb_temp.jmp_first = (TranslationBlock *)((intptr_t)&tb_temp \| 2);
4324	Assert(tb_temp.jmp_next[0] == NULL); Assert(tb_temp.jmp_next[1] == NULL);
4325	if (tb_temp.tb_next_offset[0] != 0xffff)
4326	tb_set_jmp_target(&tb_temp, 0, (uintptr_t)(tb_temp.tc_ptr + tb_temp.tb_next_offset[0]));
4327	if (tb_temp.tb_next_offset[1] != 0xffff)
4328	tb_set_jmp_target(&tb_temp, 1, (uintptr_t)(tb_temp.tc_ptr + tb_temp.tb_next_offset[1]));
4329
4330	/*
4331	* Execute it using emulation
4332	*/
4333	old_eip = env->eip;
4334	gen_func = (void *)tb_temp.tc_ptr;
4335	env->current_tb = &tb_temp;
4336
4337	// eip remains the same for repeated instructions; no idea why qemu doesn't do a jump inside the generated code
4338	// perhaps not a very safe hack
4339	while(old_eip == env->eip)
4340	{
4341	gen_func();
4342	/*
4343	* Exit once we detect an external interrupt and interrupts are enabled
4344	*/
4345	if( (env->interrupt_request & (CPU_INTERRUPT_EXTERNAL_EXIT\|CPU_INTERRUPT_EXTERNAL_TIMER)) \|\|
4346	( (env->eflags & IF_MASK) &&
4347	!(env->hflags & HF_INHIBIT_IRQ_MASK) &&
4348	(env->interrupt_request & CPU_INTERRUPT_EXTERNAL_HARD) ) )
4349	{
4350	break;
4351	}
4352	}
4353	env->current_tb = current;
4354
4355	Assert(tb_temp.phys_hash_next == NULL);
4356	Assert(tb_temp.page_next[0] == NULL);
4357	Assert(tb_temp.page_next[1] == NULL);
4358	Assert(tb_temp.page_addr[0] == 0);
4359	Assert(tb_temp.page_addr[1] == 0);
4360	/*
4361	Assert(tb_temp.tb_next_offset[0] == 0xffff);
4362	Assert(tb_temp.tb_next_offset[1] == 0xffff);
4363	Assert(tb_temp.tb_next[0] == 0xffff);
4364	Assert(tb_temp.tb_next[1] == 0xffff);
4365	Assert(tb_temp.jmp_next[0] == NULL);
4366	Assert(tb_temp.jmp_next[1] == NULL);
4367	Assert(tb_temp.jmp_first == NULL); */
4368
4369	RAWEx_ProfileStop(env, STATS_EMULATE_SINGLE_INSTR);
4370
4371	/*
4372	* Execute the next instruction when we encounter instruction fusing.
4373	*/
4374	if (env->hflags & HF_INHIBIT_IRQ_MASK)
4375	{
4376	Log(("REM: Emulating next instruction due to instruction fusing (HF_INHIBIT_IRQ_MASK)\n"));
4377	env->hflags &= ~HF_INHIBIT_IRQ_MASK;
4378	emulate_single_instr(env);
4379	}
4380
4381	env = savedenv;
4382	return 0;
4383	}
4384
4385	int get_ss_esp_from_tss_raw(CPUX86State env1, uint32_t ss_ptr,
4386	uint32_t *esp_ptr, int dpl)
4387	{
4388	int type, index, shift;
4389
4390	CPUX86State *savedenv = env;
4391	env = env1;
4392
4393	if (!(env->tr.flags & DESC_P_MASK))
4394	cpu_abort(env, "invalid tss");
4395	type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
4396	if ((type & 7) != 1)
4397	cpu_abort(env, "invalid tss type %d", type);
4398	shift = type >> 3;
4399	index = (dpl * 4 + 2) << shift;
4400	if (index + (4 << shift) - 1 > env->tr.limit)
4401	{
4402	env = savedenv;
4403	return 0;
4404	}
4405	//raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
4406
4407	if (shift == 0) {
4408	*esp_ptr = lduw_kernel(env->tr.base + index);
4409	*ss_ptr = lduw_kernel(env->tr.base + index + 2);
4410	} else {
4411	*esp_ptr = ldl_kernel(env->tr.base + index);
4412	*ss_ptr = lduw_kernel(env->tr.base + index + 4);
4413	}
4414
4415	env = savedenv;
4416	return 1;
4417	}
4418
4419	//*****************************************************************************
4420	// Needs to be at the bottom of the file (overriding macros)
4421
4422	static inline CPU86_LDouble helper_fldt_raw(uint8_t *ptr)
4423	{
4424	return (CPU86_LDouble )ptr;
4425	}
4426
4427	static inline void helper_fstt_raw(CPU86_LDouble f, uint8_t *ptr)
4428	{
4429	(CPU86_LDouble )ptr = f;
4430	}
4431
4432	#undef stw
4433	#undef stl
4434	#undef stq
4435	#define stw(a,b) (uint16_t )(a) = (uint16_t)(b)
4436	#define stl(a,b) (uint32_t )(a) = (uint32_t)(b)
4437	#define stq(a,b) (uint64_t )(a) = (uint64_t)(b)
4438	#define data64 0
4439
4440	//*****************************************************************************
4441	void restore_raw_fp_state(CPUX86State env, uint8_t ptr)
4442	{
4443	int fpus, fptag, i, nb_xmm_regs;
4444	CPU86_LDouble tmp;
4445	uint8_t *addr;
4446
4447	if (env->cpuid_features & CPUID_FXSR)
4448	{
4449	fpus = (env->fpus & ~0x3800) \| (env->fpstt & 0x7) << 11;
4450	fptag = 0;
4451	for(i = 0; i < 8; i++) {
4452	fptag \|= (env->fptags[i] << i);
4453	}
4454	stw(ptr, env->fpuc);
4455	stw(ptr + 2, fpus);
4456	stw(ptr + 4, fptag ^ 0xff);
4457
4458	addr = ptr + 0x20;
4459	for(i = 0;i < 8; i++) {
4460	tmp = ST(i);
4461	helper_fstt_raw(tmp, addr);
4462	addr += 16;
4463	}
4464
4465	if (env->cr[4] & CR4_OSFXSR_MASK) {
4466	/* XXX: finish it */
4467	stl(ptr + 0x18, env->mxcsr); /* mxcsr */
4468	stl(ptr + 0x1c, 0x0000ffff); /* mxcsr_mask */
4469	nb_xmm_regs = 8 << data64;
4470	addr = ptr + 0xa0;
4471	for(i = 0; i < nb_xmm_regs; i++) {
4472	#if __GNUC__ < 4
4473	stq(addr, env->xmm_regs[i].XMM_Q(0));
4474	stq(addr + 8, env->xmm_regs[i].XMM_Q(1));
4475	#else /* VBOX + __GNUC__ >= 4: gcc 4.x compiler bug - it runs out of registers for the 64-bit value. */
4476	stl(addr, env->xmm_regs[i].XMM_L(0));
4477	stl(addr + 4, env->xmm_regs[i].XMM_L(1));
4478	stl(addr + 8, env->xmm_regs[i].XMM_L(2));
4479	stl(addr + 12, env->xmm_regs[i].XMM_L(3));
4480	#endif
4481	addr += 16;
4482	}
4483	}
4484	}
4485	else
4486	{
4487	PX86FPUSTATE fp = (PX86FPUSTATE)ptr;
4488	int fptag;
4489
4490	fp->FCW = env->fpuc;
4491	fp->FSW = (env->fpus & ~0x3800) \| (env->fpstt & 0x7) << 11;
4492	fptag = 0;
4493	for (i=7; i>=0; i--) {
4494	fptag <<= 2;
4495	if (env->fptags[i]) {
4496	fptag \|= 3;
4497	} else {
4498	/* the FPU automatically computes it */
4499	}
4500	}
4501	fp->FTW = fptag;
4502
4503	for(i = 0;i < 8; i++) {
4504	tmp = ST(i);
4505	helper_fstt_raw(tmp, &fp->regs[i].reg[0]);
4506	}
4507	}
4508	}
4509
4510	//*****************************************************************************
4511	#undef lduw
4512	#undef ldl
4513	#undef ldq
4514	#define lduw(a) (uint16_t )(a)
4515	#define ldl(a) (uint32_t )(a)
4516	#define ldq(a) (uint64_t )(a)
4517	//*****************************************************************************
4518	void save_raw_fp_state(CPUX86State env, uint8_t ptr)
4519	{
4520	int i, fpus, fptag, nb_xmm_regs;
4521	CPU86_LDouble tmp;
4522	uint8_t *addr;
4523
4524	if (env->cpuid_features & CPUID_FXSR)
4525	{
4526	env->fpuc = lduw(ptr);
4527	fpus = lduw(ptr + 2);
4528	fptag = lduw(ptr + 4);
4529	env->fpstt = (fpus >> 11) & 7;
4530	env->fpus = fpus & ~0x3800;
4531	fptag ^= 0xff;
4532	for(i = 0;i < 8; i++) {
4533	env->fptags[i] = ((fptag >> i) & 1);
4534	}
4535
4536	addr = ptr + 0x20;
4537	for(i = 0;i < 8; i++) {
4538	tmp = helper_fldt_raw(addr);
4539	ST(i) = tmp;
4540	addr += 16;
4541	}
4542
4543	if (env->cr[4] & CR4_OSFXSR_MASK) {
4544	/* XXX: finish it, endianness */
4545	env->mxcsr = ldl(ptr + 0x18);
4546	//ldl(ptr + 0x1c);
4547	nb_xmm_regs = 8 << data64;
4548	addr = ptr + 0xa0;
4549	for(i = 0; i < nb_xmm_regs; i++) {
4550	env->xmm_regs[i].XMM_Q(0) = ldq(addr);
4551	env->xmm_regs[i].XMM_Q(1) = ldq(addr + 8);
4552	addr += 16;
4553	}
4554	}
4555	}
4556	else
4557	{
4558	PX86FPUSTATE fp = (PX86FPUSTATE)ptr;
4559	int fptag, j;
4560
4561	env->fpuc = fp->FCW;
4562	env->fpstt = (fp->FSW >> 11) & 7;
4563	env->fpus = fp->FSW & ~0x3800;
4564	fptag = fp->FTW;
4565	for(i = 0;i < 8; i++) {
4566	env->fptags[i] = ((fptag & 3) == 3);
4567	fptag >>= 2;
4568	}
4569	j = env->fpstt;
4570	for(i = 0;i < 8; i++) {
4571	tmp = helper_fldt_raw(&fp->regs[i].reg[0]);
4572	ST(i) = tmp;
4573	}
4574	}
4575	}
4576	//*****************************************************************************
4577	//*****************************************************************************
4578
4579	#endif /* VBOX */
4580

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/recompiler/new/target-i386/helper.c@ 644

Download in other formats: