helper.c@ 1516

Last change on this file since 1516 was 1516, checked in by vboxsync, 18 years ago
iret with cpl=0 is allowed to change VIF_MASK & VIP_MASK too
Property svn:eol-style set to `native`
File size: 119.3 KB

Line
1	/*
2	* i386 helpers
3	*
4	* Copyright (c) 2003 Fabrice Bellard
5	*
6	* This library is free software; you can redistribute it and/or
7	* modify it under the terms of the GNU Lesser General Public
8	* License as published by the Free Software Foundation; either
9	* version 2 of the License, or (at your option) any later version.
10	*
11	* This library is distributed in the hope that it will be useful,
12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14	* Lesser General Public License for more details.
15	*
16	* You should have received a copy of the GNU Lesser General Public
17	* License along with this library; if not, write to the Free Software
18	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
19	*/
20	#include "exec.h"
21	#ifdef VBOX
22	#include <VBox/err.h>
23	#endif
24
25	//#define DEBUG_PCALL
26
27	#if 0
28	#define raise_exception_err(a, b)\
29	do {\
30	fprintf(logfile, "raise_exception line=%d\n", __LINE__);\
31	(raise_exception_err)(a, b);\
32	} while (0)
33	#endif
34
35	const uint8_t parity_table[256] = {
36	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
37	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
38	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
39	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
40	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
41	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
42	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
43	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
44	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
45	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
46	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
47	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
48	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
49	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
50	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
51	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
52	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
53	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
54	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
55	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
56	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
57	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
58	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
59	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
60	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
61	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
62	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
63	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
64	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
65	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
66	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
67	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
68	};
69
70	/* modulo 17 table */
71	const uint8_t rclw_table[32] = {
72	0, 1, 2, 3, 4, 5, 6, 7,
73	8, 9,10,11,12,13,14,15,
74	16, 0, 1, 2, 3, 4, 5, 6,
75	7, 8, 9,10,11,12,13,14,
76	};
77
78	/* modulo 9 table */
79	const uint8_t rclb_table[32] = {
80	0, 1, 2, 3, 4, 5, 6, 7,
81	8, 0, 1, 2, 3, 4, 5, 6,
82	7, 8, 0, 1, 2, 3, 4, 5,
83	6, 7, 8, 0, 1, 2, 3, 4,
84	};
85
86	const CPU86_LDouble f15rk[7] =
87	{
88	0.00000000000000000000L,
89	1.00000000000000000000L,
90	3.14159265358979323851L, /pi/
91	0.30102999566398119523L, /lg2/
92	0.69314718055994530943L, /ln2/
93	1.44269504088896340739L, /l2e/
94	3.32192809488736234781L, /l2t/
95	};
96
97	/* thread support */
98
99	spinlock_t global_cpu_lock = SPIN_LOCK_UNLOCKED;
100
101	void cpu_lock(void)
102	{
103	spin_lock(&global_cpu_lock);
104	}
105
106	void cpu_unlock(void)
107	{
108	spin_unlock(&global_cpu_lock);
109	}
110
111	void cpu_loop_exit(void)
112	{
113	/* NOTE: the register at this point must be saved by hand because
114	longjmp restore them */
115	regs_to_env();
116	longjmp(env->jmp_env, 1);
117	}
118
119	/* return non zero if error */
120	static inline int load_segment(uint32_t e1_ptr, uint32_t e2_ptr,
121	int selector)
122	{
123	SegmentCache *dt;
124	int index;
125	target_ulong ptr;
126
127	if (selector & 0x4)
128	dt = &env->ldt;
129	else
130	dt = &env->gdt;
131	index = selector & ~7;
132	if ((index + 7) > dt->limit)
133	return -1;
134	ptr = dt->base + index;
135	*e1_ptr = ldl_kernel(ptr);
136	*e2_ptr = ldl_kernel(ptr + 4);
137	return 0;
138	}
139
140	static inline unsigned int get_seg_limit(uint32_t e1, uint32_t e2)
141	{
142	unsigned int limit;
143	limit = (e1 & 0xffff) \| (e2 & 0x000f0000);
144	if (e2 & DESC_G_MASK)
145	limit = (limit << 12) \| 0xfff;
146	return limit;
147	}
148
149	static inline uint32_t get_seg_base(uint32_t e1, uint32_t e2)
150	{
151	return ((e1 >> 16) \| ((e2 & 0xff) << 16) \| (e2 & 0xff000000));
152	}
153
154	static inline void load_seg_cache_raw_dt(SegmentCache *sc, uint32_t e1, uint32_t e2)
155	{
156	sc->base = get_seg_base(e1, e2);
157	sc->limit = get_seg_limit(e1, e2);
158	sc->flags = e2;
159	}
160
161	/* init the segment cache in vm86 mode. */
162	static inline void load_seg_vm(int seg, int selector)
163	{
164	selector &= 0xffff;
165	cpu_x86_load_seg_cache(env, seg, selector,
166	(selector << 4), 0xffff, 0);
167	}
168
169	static inline void get_ss_esp_from_tss(uint32_t *ss_ptr,
170	uint32_t *esp_ptr, int dpl)
171	{
172	int type, index, shift;
173
174	#if 0
175	{
176	int i;
177	printf("TR: base=%p limit=%x\n", env->tr.base, env->tr.limit);
178	for(i=0;i<env->tr.limit;i++) {
179	printf("%02x ", env->tr.base[i]);
180	if ((i & 7) == 7) printf("\n");
181	}
182	printf("\n");
183	}
184	#endif
185
186	if (!(env->tr.flags & DESC_P_MASK))
187	cpu_abort(env, "invalid tss");
188	type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
189	if ((type & 7) != 1)
190	cpu_abort(env, "invalid tss type %d", type);
191	shift = type >> 3;
192	index = (dpl * 4 + 2) << shift;
193	if (index + (4 << shift) - 1 > env->tr.limit)
194	raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
195	if (shift == 0) {
196	*esp_ptr = lduw_kernel(env->tr.base + index);
197	*ss_ptr = lduw_kernel(env->tr.base + index + 2);
198	} else {
199	*esp_ptr = ldl_kernel(env->tr.base + index);
200	*ss_ptr = lduw_kernel(env->tr.base + index + 4);
201	}
202	}
203
204	/* XXX: merge with load_seg() */
205	static void tss_load_seg(int seg_reg, int selector)
206	{
207	uint32_t e1, e2;
208	int rpl, dpl, cpl;
209
210	if ((selector & 0xfffc) != 0) {
211	if (load_segment(&e1, &e2, selector) != 0)
212	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
213	if (!(e2 & DESC_S_MASK))
214	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
215	rpl = selector & 3;
216	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
217	cpl = env->hflags & HF_CPL_MASK;
218	if (seg_reg == R_CS) {
219	if (!(e2 & DESC_CS_MASK))
220	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
221	/* XXX: is it correct ? */
222	if (dpl != rpl)
223	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
224	if ((e2 & DESC_C_MASK) && dpl > rpl)
225	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
226
227	} else if (seg_reg == R_SS) {
228	/* SS must be writable data */
229	if ((e2 & DESC_CS_MASK) \|\| !(e2 & DESC_W_MASK))
230	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
231	if (dpl != cpl \|\| dpl != rpl)
232	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
233	} else {
234	/* not readable code */
235	if ((e2 & DESC_CS_MASK) && !(e2 & DESC_R_MASK))
236	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
237	/* if data or non conforming code, checks the rights */
238	if (((e2 >> DESC_TYPE_SHIFT) & 0xf) < 12) {
239	if (dpl < cpl \|\| dpl < rpl)
240	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
241	}
242	}
243	if (!(e2 & DESC_P_MASK))
244	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
245	cpu_x86_load_seg_cache(env, seg_reg, selector,
246	get_seg_base(e1, e2),
247	get_seg_limit(e1, e2),
248	e2);
249	} else {
250	if (seg_reg == R_SS \|\| seg_reg == R_CS)
251	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
252	}
253	}
254
255	#define SWITCH_TSS_JMP 0
256	#define SWITCH_TSS_IRET 1
257	#define SWITCH_TSS_CALL 2
258
259	/* XXX: restore CPU state in registers (PowerPC case) */
260	static void switch_tss(int tss_selector,
261	uint32_t e1, uint32_t e2, int source,
262	uint32_t next_eip)
263	{
264	int tss_limit, tss_limit_max, type, old_tss_limit_max, old_type, v1, v2, i;
265	target_ulong tss_base;
266	uint32_t new_regs[8], new_segs[6];
267	uint32_t new_eflags, new_eip, new_cr3, new_ldt, new_trap;
268	uint32_t old_eflags, eflags_mask;
269	SegmentCache *dt;
270	int index;
271	target_ulong ptr;
272
273	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
274	#ifdef DEBUG_PCALL
275	if (loglevel & CPU_LOG_PCALL)
276	fprintf(logfile, "switch_tss: sel=0x%04x type=%d src=%d\n", tss_selector, type, source);
277	#endif
278
279	#if defined(VBOX) && defined(DEBUG)
280	printf("switch_tss %x %x %x %d %08x\n", tss_selector, e1, e2, source, next_eip);
281	#endif
282
283	/* if task gate, we read the TSS segment and we load it */
284	if (type == 5) {
285	if (!(e2 & DESC_P_MASK))
286	raise_exception_err(EXCP0B_NOSEG, tss_selector & 0xfffc);
287	tss_selector = e1 >> 16;
288	if (tss_selector & 4)
289	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
290	if (load_segment(&e1, &e2, tss_selector) != 0)
291	raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
292	if (e2 & DESC_S_MASK)
293	raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
294	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
295	if ((type & 7) != 1)
296	raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
297	}
298
299	if (!(e2 & DESC_P_MASK))
300	raise_exception_err(EXCP0B_NOSEG, tss_selector & 0xfffc);
301
302	if (type & 8)
303	tss_limit_max = 103;
304	else
305	tss_limit_max = 43;
306	tss_limit = get_seg_limit(e1, e2);
307	tss_base = get_seg_base(e1, e2);
308	if ((tss_selector & 4) != 0 \|\|
309	tss_limit < tss_limit_max)
310	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
311	old_type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
312	if (old_type & 8)
313	old_tss_limit_max = 103;
314	else
315	old_tss_limit_max = 43;
316
317	/* read all the registers from the new TSS */
318	if (type & 8) {
319	/* 32 bit */
320	new_cr3 = ldl_kernel(tss_base + 0x1c);
321	new_eip = ldl_kernel(tss_base + 0x20);
322	new_eflags = ldl_kernel(tss_base + 0x24);
323	for(i = 0; i < 8; i++)
324	new_regs[i] = ldl_kernel(tss_base + (0x28 + i * 4));
325	for(i = 0; i < 6; i++)
326	new_segs[i] = lduw_kernel(tss_base + (0x48 + i * 4));
327	new_ldt = lduw_kernel(tss_base + 0x60);
328	new_trap = ldl_kernel(tss_base + 0x64);
329	} else {
330	/* 16 bit */
331	new_cr3 = 0;
332	new_eip = lduw_kernel(tss_base + 0x0e);
333	new_eflags = lduw_kernel(tss_base + 0x10);
334	for(i = 0; i < 8; i++)
335	new_regs[i] = lduw_kernel(tss_base + (0x12 + i * 2)) \| 0xffff0000;
336	for(i = 0; i < 4; i++)
337	new_segs[i] = lduw_kernel(tss_base + (0x22 + i * 4));
338	new_ldt = lduw_kernel(tss_base + 0x2a);
339	new_segs[R_FS] = 0;
340	new_segs[R_GS] = 0;
341	new_trap = 0;
342	}
343
344	/* NOTE: we must avoid memory exceptions during the task switch,
345	so we make dummy accesses before */
346	/* XXX: it can still fail in some cases, so a bigger hack is
347	necessary to valid the TLB after having done the accesses */
348
349	v1 = ldub_kernel(env->tr.base);
350	v2 = ldub_kernel(env->tr.base + old_tss_limit_max);
351	stb_kernel(env->tr.base, v1);
352	stb_kernel(env->tr.base + old_tss_limit_max, v2);
353
354	/* clear busy bit (it is restartable) */
355	if (source == SWITCH_TSS_JMP \|\| source == SWITCH_TSS_IRET) {
356	target_ulong ptr;
357	uint32_t e2;
358	ptr = env->gdt.base + (env->tr.selector & ~7);
359	e2 = ldl_kernel(ptr + 4);
360	e2 &= ~DESC_TSS_BUSY_MASK;
361	stl_kernel(ptr + 4, e2);
362	}
363	old_eflags = compute_eflags();
364	if (source == SWITCH_TSS_IRET)
365	old_eflags &= ~NT_MASK;
366
367	/* save the current state in the old TSS */
368	if (type & 8) {
369	/* 32 bit */
370	stl_kernel(env->tr.base + 0x20, next_eip);
371	stl_kernel(env->tr.base + 0x24, old_eflags);
372	stl_kernel(env->tr.base + (0x28 + 0 * 4), EAX);
373	stl_kernel(env->tr.base + (0x28 + 1 * 4), ECX);
374	stl_kernel(env->tr.base + (0x28 + 2 * 4), EDX);
375	stl_kernel(env->tr.base + (0x28 + 3 * 4), EBX);
376	stl_kernel(env->tr.base + (0x28 + 4 * 4), ESP);
377	stl_kernel(env->tr.base + (0x28 + 5 * 4), EBP);
378	stl_kernel(env->tr.base + (0x28 + 6 * 4), ESI);
379	stl_kernel(env->tr.base + (0x28 + 7 * 4), EDI);
380	for(i = 0; i < 6; i++)
381	stw_kernel(env->tr.base + (0x48 + i * 4), env->segs[i].selector);
382
383	#if defined(VBOX) && defined(DEBUG)
384	printf("TSS 32 bits switch\n");
385	printf("Saving CS=%08X\n", env->segs[R_CS].selector);
386	#endif
387
388	} else {
389	/* 16 bit */
390	stw_kernel(env->tr.base + 0x0e, next_eip);
391	stw_kernel(env->tr.base + 0x10, old_eflags);
392	stw_kernel(env->tr.base + (0x12 + 0 * 2), EAX);
393	stw_kernel(env->tr.base + (0x12 + 1 * 2), ECX);
394	stw_kernel(env->tr.base + (0x12 + 2 * 2), EDX);
395	stw_kernel(env->tr.base + (0x12 + 3 * 2), EBX);
396	stw_kernel(env->tr.base + (0x12 + 4 * 2), ESP);
397	stw_kernel(env->tr.base + (0x12 + 5 * 2), EBP);
398	stw_kernel(env->tr.base + (0x12 + 6 * 2), ESI);
399	stw_kernel(env->tr.base + (0x12 + 7 * 2), EDI);
400	for(i = 0; i < 4; i++)
401	stw_kernel(env->tr.base + (0x22 + i * 4), env->segs[i].selector);
402	}
403
404	/* now if an exception occurs, it will occurs in the next task
405	context */
406
407	if (source == SWITCH_TSS_CALL) {
408	stw_kernel(tss_base, env->tr.selector);
409	new_eflags \|= NT_MASK;
410	}
411
412	/* set busy bit */
413	if (source == SWITCH_TSS_JMP \|\| source == SWITCH_TSS_CALL) {
414	target_ulong ptr;
415	uint32_t e2;
416	ptr = env->gdt.base + (tss_selector & ~7);
417	e2 = ldl_kernel(ptr + 4);
418	e2 \|= DESC_TSS_BUSY_MASK;
419	stl_kernel(ptr + 4, e2);
420	}
421
422	/* set the new CPU state */
423	/* from this point, any exception which occurs can give problems */
424	env->cr[0] \|= CR0_TS_MASK;
425	env->hflags \|= HF_TS_MASK;
426	env->tr.selector = tss_selector;
427	env->tr.base = tss_base;
428	env->tr.limit = tss_limit;
429	env->tr.flags = e2 & ~DESC_TSS_BUSY_MASK;
430
431	if ((type & 8) && (env->cr[0] & CR0_PG_MASK)) {
432	cpu_x86_update_cr3(env, new_cr3);
433	}
434
435	/* load all registers without an exception, then reload them with
436	possible exception */
437	env->eip = new_eip;
438	eflags_mask = TF_MASK \| AC_MASK \| ID_MASK \|
439	IF_MASK \| IOPL_MASK \| VM_MASK \| RF_MASK \| NT_MASK;
440	if (!(type & 8))
441	eflags_mask &= 0xffff;
442	load_eflags(new_eflags, eflags_mask);
443	/* XXX: what to do in 16 bit case ? */
444	EAX = new_regs[0];
445	ECX = new_regs[1];
446	EDX = new_regs[2];
447	EBX = new_regs[3];
448	ESP = new_regs[4];
449	EBP = new_regs[5];
450	ESI = new_regs[6];
451	EDI = new_regs[7];
452	if (new_eflags & VM_MASK) {
453	for(i = 0; i < 6; i++)
454	load_seg_vm(i, new_segs[i]);
455	/* in vm86, CPL is always 3 */
456	cpu_x86_set_cpl(env, 3);
457	} else {
458	/* CPL is set the RPL of CS */
459	cpu_x86_set_cpl(env, new_segs[R_CS] & 3);
460	/* first just selectors as the rest may trigger exceptions */
461	for(i = 0; i < 6; i++)
462	cpu_x86_load_seg_cache(env, i, new_segs[i], 0, 0, 0);
463	}
464
465	env->ldt.selector = new_ldt & ~4;
466	env->ldt.base = 0;
467	env->ldt.limit = 0;
468	env->ldt.flags = 0;
469
470	/* load the LDT */
471	if (new_ldt & 4)
472	raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
473
474	if ((new_ldt & 0xfffc) != 0) {
475	dt = &env->gdt;
476	index = new_ldt & ~7;
477	if ((index + 7) > dt->limit)
478	raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
479	ptr = dt->base + index;
480	e1 = ldl_kernel(ptr);
481	e2 = ldl_kernel(ptr + 4);
482	if ((e2 & DESC_S_MASK) \|\| ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2)
483	raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
484	if (!(e2 & DESC_P_MASK))
485	raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
486	load_seg_cache_raw_dt(&env->ldt, e1, e2);
487	}
488
489	/* load the segments */
490	if (!(new_eflags & VM_MASK)) {
491	tss_load_seg(R_CS, new_segs[R_CS]);
492	tss_load_seg(R_SS, new_segs[R_SS]);
493	tss_load_seg(R_ES, new_segs[R_ES]);
494	tss_load_seg(R_DS, new_segs[R_DS]);
495	tss_load_seg(R_FS, new_segs[R_FS]);
496	tss_load_seg(R_GS, new_segs[R_GS]);
497	}
498
499	/* check that EIP is in the CS segment limits */
500	if (new_eip > env->segs[R_CS].limit) {
501	/* XXX: different exception if CALL ? */
502	raise_exception_err(EXCP0D_GPF, 0);
503	}
504	}
505
506	/* check if Port I/O is allowed in TSS */
507	static inline void check_io(int addr, int size)
508	{
509	int io_offset, val, mask;
510
511	/* TSS must be a valid 32 bit one */
512	if (!(env->tr.flags & DESC_P_MASK) \|\|
513	((env->tr.flags >> DESC_TYPE_SHIFT) & 0xf) != 9 \|\|
514	env->tr.limit < 103)
515	goto fail;
516	io_offset = lduw_kernel(env->tr.base + 0x66);
517	io_offset += (addr >> 3);
518	/* Note: the check needs two bytes */
519	if ((io_offset + 1) > env->tr.limit)
520	goto fail;
521	val = lduw_kernel(env->tr.base + io_offset);
522	val >>= (addr & 7);
523	mask = (1 << size) - 1;
524	/* all bits must be zero to allow the I/O */
525	if ((val & mask) != 0) {
526	fail:
527	raise_exception_err(EXCP0D_GPF, 0);
528	}
529	}
530
531	void check_iob_T0(void)
532	{
533	check_io(T0, 1);
534	}
535
536	void check_iow_T0(void)
537	{
538	check_io(T0, 2);
539	}
540
541	void check_iol_T0(void)
542	{
543	check_io(T0, 4);
544	}
545
546	void check_iob_DX(void)
547	{
548	check_io(EDX & 0xffff, 1);
549	}
550
551	void check_iow_DX(void)
552	{
553	check_io(EDX & 0xffff, 2);
554	}
555
556	void check_iol_DX(void)
557	{
558	check_io(EDX & 0xffff, 4);
559	}
560
561	static inline unsigned int get_sp_mask(unsigned int e2)
562	{
563	if (e2 & DESC_B_MASK)
564	return 0xffffffff;
565	else
566	return 0xffff;
567	}
568
569	/* XXX: add a is_user flag to have proper security support */
570	#define PUSHW(ssp, sp, sp_mask, val)\
571	{\
572	sp -= 2;\
573	stw_kernel((ssp) + (sp & (sp_mask)), (val));\
574	}
575
576	#define PUSHL(ssp, sp, sp_mask, val)\
577	{\
578	sp -= 4;\
579	stl_kernel((ssp) + (sp & (sp_mask)), (val));\
580	}
581
582	#define POPW(ssp, sp, sp_mask, val)\
583	{\
584	val = lduw_kernel((ssp) + (sp & (sp_mask)));\
585	sp += 2;\
586	}
587
588	#define POPL(ssp, sp, sp_mask, val)\
589	{\
590	val = (uint32_t)ldl_kernel((ssp) + (sp & (sp_mask)));\
591	sp += 4;\
592	}
593
594	/* protected mode interrupt */
595	static void do_interrupt_protected(int intno, int is_int, int error_code,
596	unsigned int next_eip, int is_hw)
597	{
598	SegmentCache *dt;
599	target_ulong ptr, ssp;
600	int type, dpl, selector, ss_dpl, cpl, sp_mask;
601	int has_error_code, new_stack, shift;
602	uint32_t e1, e2, offset, ss, esp, ss_e1, ss_e2;
603	uint32_t old_eip;
604
605	#ifdef VBOX
606	if (remR3NotifyTrap(env, intno, error_code, next_eip) != VINF_SUCCESS)
607	cpu_loop_exit();
608	#endif
609
610	has_error_code = 0;
611	if (!is_int && !is_hw) {
612	switch(intno) {
613	case 8:
614	case 10:
615	case 11:
616	case 12:
617	case 13:
618	case 14:
619	case 17:
620	has_error_code = 1;
621	break;
622	}
623	}
624	if (is_int)
625	old_eip = next_eip;
626	else
627	old_eip = env->eip;
628
629	dt = &env->idt;
630	if (intno * 8 + 7 > dt->limit)
631	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
632	ptr = dt->base + intno * 8;
633	e1 = ldl_kernel(ptr);
634	e2 = ldl_kernel(ptr + 4);
635	/* check gate type */
636	type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
637	switch(type) {
638	case 5: /* task gate */
639	/* must do that check here to return the correct error code */
640	if (!(e2 & DESC_P_MASK))
641	raise_exception_err(EXCP0B_NOSEG, intno * 8 + 2);
642	switch_tss(intno * 8, e1, e2, SWITCH_TSS_CALL, old_eip);
643	if (has_error_code) {
644	int mask, type;
645	/* push the error code */
646	type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
647	shift = type >> 3;
648	if (env->segs[R_SS].flags & DESC_B_MASK)
649	mask = 0xffffffff;
650	else
651	mask = 0xffff;
652	esp = (ESP - (2 << shift)) & mask;
653	ssp = env->segs[R_SS].base + esp;
654	if (shift)
655	stl_kernel(ssp, error_code);
656	else
657	stw_kernel(ssp, error_code);
658	ESP = (esp & mask) \| (ESP & ~mask);
659	}
660	return;
661	case 6: /* 286 interrupt gate */
662	case 7: /* 286 trap gate */
663	case 14: /* 386 interrupt gate */
664	case 15: /* 386 trap gate */
665	break;
666	default:
667	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
668	break;
669	}
670	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
671	cpl = env->hflags & HF_CPL_MASK;
672	/* check privledge if software int */
673	if (is_int && dpl < cpl)
674	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
675	/* check valid bit */
676	if (!(e2 & DESC_P_MASK))
677	raise_exception_err(EXCP0B_NOSEG, intno * 8 + 2);
678	selector = e1 >> 16;
679	offset = (e2 & 0xffff0000) \| (e1 & 0x0000ffff);
680	if ((selector & 0xfffc) == 0)
681	raise_exception_err(EXCP0D_GPF, 0);
682
683	if (load_segment(&e1, &e2, selector) != 0)
684	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
685	if (!(e2 & DESC_S_MASK) \|\| !(e2 & (DESC_CS_MASK)))
686	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
687	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
688	if (dpl > cpl)
689	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
690	if (!(e2 & DESC_P_MASK))
691	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
692	if (!(e2 & DESC_C_MASK) && dpl < cpl) {
693	/* to inner priviledge */
694	get_ss_esp_from_tss(&ss, &esp, dpl);
695	if ((ss & 0xfffc) == 0)
696	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
697	if ((ss & 3) != dpl)
698	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
699	if (load_segment(&ss_e1, &ss_e2, ss) != 0)
700	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
701	ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
702	if (ss_dpl != dpl)
703	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
704	if (!(ss_e2 & DESC_S_MASK) \|\|
705	(ss_e2 & DESC_CS_MASK) \|\|
706	!(ss_e2 & DESC_W_MASK))
707	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
708	if (!(ss_e2 & DESC_P_MASK))
709	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
710	new_stack = 1;
711	sp_mask = get_sp_mask(ss_e2);
712	ssp = get_seg_base(ss_e1, ss_e2);
713	#if defined(VBOX) && defined(DEBUG)
714	printf("new stack %04X:%08X gate dpl=%d\n", ss, esp, dpl);
715	#endif
716	} else if ((e2 & DESC_C_MASK) \|\| dpl == cpl) {
717	/* to same priviledge */
718	if (env->eflags & VM_MASK)
719	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
720	new_stack = 0;
721	sp_mask = get_sp_mask(env->segs[R_SS].flags);
722	ssp = env->segs[R_SS].base;
723	esp = ESP;
724	dpl = cpl;
725	} else {
726	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
727	new_stack = 0; /* avoid warning */
728	sp_mask = 0; /* avoid warning */
729	ssp = 0; /* avoid warning */
730	esp = 0; /* avoid warning */
731	}
732
733	shift = type >> 3;
734
735	#if 0
736	/* XXX: check that enough room is available */
737	push_size = 6 + (new_stack << 2) + (has_error_code << 1);
738	if (env->eflags & VM_MASK)
739	push_size += 8;
740	push_size <<= shift;
741	#endif
742	if (shift == 1) {
743	if (new_stack) {
744	if (env->eflags & VM_MASK) {
745	PUSHL(ssp, esp, sp_mask, env->segs[R_GS].selector);
746	PUSHL(ssp, esp, sp_mask, env->segs[R_FS].selector);
747	PUSHL(ssp, esp, sp_mask, env->segs[R_DS].selector);
748	PUSHL(ssp, esp, sp_mask, env->segs[R_ES].selector);
749	}
750	PUSHL(ssp, esp, sp_mask, env->segs[R_SS].selector);
751	PUSHL(ssp, esp, sp_mask, ESP);
752	}
753	PUSHL(ssp, esp, sp_mask, compute_eflags());
754	PUSHL(ssp, esp, sp_mask, env->segs[R_CS].selector);
755	PUSHL(ssp, esp, sp_mask, old_eip);
756	if (has_error_code) {
757	PUSHL(ssp, esp, sp_mask, error_code);
758	}
759	} else {
760	if (new_stack) {
761	if (env->eflags & VM_MASK) {
762	PUSHW(ssp, esp, sp_mask, env->segs[R_GS].selector);
763	PUSHW(ssp, esp, sp_mask, env->segs[R_FS].selector);
764	PUSHW(ssp, esp, sp_mask, env->segs[R_DS].selector);
765	PUSHW(ssp, esp, sp_mask, env->segs[R_ES].selector);
766	}
767	PUSHW(ssp, esp, sp_mask, env->segs[R_SS].selector);
768	PUSHW(ssp, esp, sp_mask, ESP);
769	}
770	PUSHW(ssp, esp, sp_mask, compute_eflags());
771	PUSHW(ssp, esp, sp_mask, env->segs[R_CS].selector);
772	PUSHW(ssp, esp, sp_mask, old_eip);
773	if (has_error_code) {
774	PUSHW(ssp, esp, sp_mask, error_code);
775	}
776	}
777
778	if (new_stack) {
779	if (env->eflags & VM_MASK) {
780	cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0, 0);
781	cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0, 0);
782	cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0, 0);
783	cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0, 0);
784	}
785	ss = (ss & ~3) \| dpl;
786	cpu_x86_load_seg_cache(env, R_SS, ss,
787	ssp, get_seg_limit(ss_e1, ss_e2), ss_e2);
788	}
789	ESP = (ESP & ~sp_mask) \| (esp & sp_mask);
790
791	selector = (selector & ~3) \| dpl;
792	cpu_x86_load_seg_cache(env, R_CS, selector,
793	get_seg_base(e1, e2),
794	get_seg_limit(e1, e2),
795	e2);
796	cpu_x86_set_cpl(env, dpl);
797	env->eip = offset;
798
799	/* interrupt gate clear IF mask */
800	if ((type & 1) == 0) {
801	env->eflags &= ~IF_MASK;
802	}
803	env->eflags &= ~(TF_MASK \| VM_MASK \| RF_MASK \| NT_MASK);
804	}
805
806	#ifdef VBOX
807
808	/* check if VME interrupt redirection is enabled in TSS */
809	static inline bool is_vme_irq_redirected(int intno)
810	{
811	int io_offset, intredir_offset;
812	unsigned char val, mask;
813
814	/* TSS must be a valid 32 bit one */
815	if (!(env->tr.flags & DESC_P_MASK) \|\|
816	((env->tr.flags >> DESC_TYPE_SHIFT) & 0xf) != 9 \|\|
817	env->tr.limit < 103)
818	goto fail;
819	io_offset = lduw_kernel(env->tr.base + 0x66);
820	/* the virtual interrupt redirection bitmap is located below the io bitmap */
821	intredir_offset = io_offset - 0x20;
822
823	intredir_offset += (intno >> 3);
824	if ((intredir_offset) > env->tr.limit)
825	goto fail;
826
827	val = ldub_kernel(env->tr.base + intredir_offset);
828	mask = 1 << (unsigned char)(intno & 7);
829
830	/* bit set means no redirection. */
831	if ((val & mask) != 0) {
832	return false;
833	}
834	return true;
835
836	fail:
837	raise_exception_err(EXCP0D_GPF, 0);
838	return true;
839	}
840
841	/* V86 mode software interrupt with CR4.VME=1 */
842	static void do_soft_interrupt_vme(int intno, int error_code, unsigned int next_eip)
843	{
844	target_ulong ptr, ssp;
845	int selector;
846	uint32_t offset, esp;
847	uint32_t old_cs, old_eflags;
848	uint32_t iopl;
849
850	iopl = ((env->eflags >> IOPL_SHIFT) & 3);
851
852	if (!is_vme_irq_redirected(intno))
853	{
854	if (iopl == 3)
855	/* normal protected mode handler call */
856	return do_interrupt_protected(intno, 1, error_code, next_eip, 0);
857	else
858	raise_exception_err(EXCP0D_GPF, 0);
859	}
860
861	/* virtual mode idt is at linear address 0 */
862	ptr = 0 + intno * 4;
863	offset = lduw_kernel(ptr);
864	selector = lduw_kernel(ptr + 2);
865	esp = ESP;
866	ssp = env->segs[R_SS].base;
867	old_cs = env->segs[R_CS].selector;
868
869	old_eflags = compute_eflags();
870	if (iopl < 3)
871	{
872	/* copy VIF into IF and set IOPL to 3 */
873	if (env->eflags & VIF_MASK)
874	old_eflags \|= IF_MASK;
875	else
876	old_eflags &= ~IF_MASK;
877
878	old_eflags \|= (3 << IOPL_SHIFT);
879	}
880
881	/* XXX: use SS segment size ? */
882	PUSHW(ssp, esp, 0xffff, old_eflags);
883	PUSHW(ssp, esp, 0xffff, old_cs);
884	PUSHW(ssp, esp, 0xffff, next_eip);
885
886	/* update processor state */
887	ESP = (ESP & ~0xffff) \| (esp & 0xffff);
888	env->eip = offset;
889	env->segs[R_CS].selector = selector;
890	env->segs[R_CS].base = (selector << 4);
891	env->eflags &= ~(TF_MASK \| RF_MASK);
892
893	if (iopl < 3)
894	env->eflags &= ~IF_MASK;
895	else
896	env->eflags &= ~VIF_MASK;
897	}
898	#endif
899
900	#ifdef TARGET_X86_64
901
902	#define PUSHQ(sp, val)\
903	{\
904	sp -= 8;\
905	stq_kernel(sp, (val));\
906	}
907
908	#define POPQ(sp, val)\
909	{\
910	val = ldq_kernel(sp);\
911	sp += 8;\
912	}
913
914	static inline target_ulong get_rsp_from_tss(int level)
915	{
916	int index;
917
918	#if 0
919	printf("TR: base=" TARGET_FMT_lx " limit=%x\n",
920	env->tr.base, env->tr.limit);
921	#endif
922
923	if (!(env->tr.flags & DESC_P_MASK))
924	cpu_abort(env, "invalid tss");
925	index = 8 * level + 4;
926	if ((index + 7) > env->tr.limit)
927	raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
928	return ldq_kernel(env->tr.base + index);
929	}
930
931	/* 64 bit interrupt */
932	static void do_interrupt64(int intno, int is_int, int error_code,
933	target_ulong next_eip, int is_hw)
934	{
935	SegmentCache *dt;
936	target_ulong ptr;
937	int type, dpl, selector, cpl, ist;
938	int has_error_code, new_stack;
939	uint32_t e1, e2, e3, ss;
940	target_ulong old_eip, esp, offset;
941
942	has_error_code = 0;
943	if (!is_int && !is_hw) {
944	switch(intno) {
945	case 8:
946	case 10:
947	case 11:
948	case 12:
949	case 13:
950	case 14:
951	case 17:
952	has_error_code = 1;
953	break;
954	}
955	}
956	if (is_int)
957	old_eip = next_eip;
958	else
959	old_eip = env->eip;
960
961	dt = &env->idt;
962	if (intno * 16 + 15 > dt->limit)
963	raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
964	ptr = dt->base + intno * 16;
965	e1 = ldl_kernel(ptr);
966	e2 = ldl_kernel(ptr + 4);
967	e3 = ldl_kernel(ptr + 8);
968	/* check gate type */
969	type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
970	switch(type) {
971	case 14: /* 386 interrupt gate */
972	case 15: /* 386 trap gate */
973	break;
974	default:
975	raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
976	break;
977	}
978	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
979	cpl = env->hflags & HF_CPL_MASK;
980	/* check privledge if software int */
981	if (is_int && dpl < cpl)
982	raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
983	/* check valid bit */
984	if (!(e2 & DESC_P_MASK))
985	raise_exception_err(EXCP0B_NOSEG, intno * 16 + 2);
986	selector = e1 >> 16;
987	offset = ((target_ulong)e3 << 32) \| (e2 & 0xffff0000) \| (e1 & 0x0000ffff);
988	ist = e2 & 7;
989	if ((selector & 0xfffc) == 0)
990	raise_exception_err(EXCP0D_GPF, 0);
991
992	if (load_segment(&e1, &e2, selector) != 0)
993	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
994	if (!(e2 & DESC_S_MASK) \|\| !(e2 & (DESC_CS_MASK)))
995	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
996	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
997	if (dpl > cpl)
998	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
999	if (!(e2 & DESC_P_MASK))
1000	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
1001	if (!(e2 & DESC_L_MASK) \|\| (e2 & DESC_B_MASK))
1002	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1003	if ((!(e2 & DESC_C_MASK) && dpl < cpl) \|\| ist != 0) {
1004	/* to inner priviledge */
1005	if (ist != 0)
1006	esp = get_rsp_from_tss(ist + 3);
1007	else
1008	esp = get_rsp_from_tss(dpl);
1009	esp &= ~0xfLL; /* align stack */
1010	ss = 0;
1011	new_stack = 1;
1012	} else if ((e2 & DESC_C_MASK) \|\| dpl == cpl) {
1013	/* to same priviledge */
1014	if (env->eflags & VM_MASK)
1015	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1016	new_stack = 0;
1017	if (ist != 0)
1018	esp = get_rsp_from_tss(ist + 3);
1019	else
1020	esp = ESP;
1021	esp &= ~0xfLL; /* align stack */
1022	dpl = cpl;
1023	} else {
1024	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1025	new_stack = 0; /* avoid warning */
1026	esp = 0; /* avoid warning */
1027	}
1028
1029	PUSHQ(esp, env->segs[R_SS].selector);
1030	PUSHQ(esp, ESP);
1031	PUSHQ(esp, compute_eflags());
1032	PUSHQ(esp, env->segs[R_CS].selector);
1033	PUSHQ(esp, old_eip);
1034	if (has_error_code) {
1035	PUSHQ(esp, error_code);
1036	}
1037
1038	if (new_stack) {
1039	ss = 0 \| dpl;
1040	cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, 0);
1041	}
1042	ESP = esp;
1043
1044	selector = (selector & ~3) \| dpl;
1045	cpu_x86_load_seg_cache(env, R_CS, selector,
1046	get_seg_base(e1, e2),
1047	get_seg_limit(e1, e2),
1048	e2);
1049	cpu_x86_set_cpl(env, dpl);
1050	env->eip = offset;
1051
1052	/* interrupt gate clear IF mask */
1053	if ((type & 1) == 0) {
1054	env->eflags &= ~IF_MASK;
1055	}
1056	env->eflags &= ~(TF_MASK \| VM_MASK \| RF_MASK \| NT_MASK);
1057	}
1058	#endif
1059
1060	void helper_syscall(int next_eip_addend)
1061	{
1062	int selector;
1063
1064	if (!(env->efer & MSR_EFER_SCE)) {
1065	raise_exception_err(EXCP06_ILLOP, 0);
1066	}
1067	selector = (env->star >> 32) & 0xffff;
1068	#ifdef TARGET_X86_64
1069	if (env->hflags & HF_LMA_MASK) {
1070	int code64;
1071
1072	ECX = env->eip + next_eip_addend;
1073	env->regs[11] = compute_eflags();
1074
1075	code64 = env->hflags & HF_CS64_MASK;
1076
1077	cpu_x86_set_cpl(env, 0);
1078	cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
1079	0, 0xffffffff,
1080	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1081	DESC_S_MASK \|
1082	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK \| DESC_L_MASK);
1083	cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
1084	0, 0xffffffff,
1085	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1086	DESC_S_MASK \|
1087	DESC_W_MASK \| DESC_A_MASK);
1088	env->eflags &= ~env->fmask;
1089	if (code64)
1090	env->eip = env->lstar;
1091	else
1092	env->eip = env->cstar;
1093	} else
1094	#endif
1095	{
1096	ECX = (uint32_t)(env->eip + next_eip_addend);
1097
1098	cpu_x86_set_cpl(env, 0);
1099	cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
1100	0, 0xffffffff,
1101	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1102	DESC_S_MASK \|
1103	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
1104	cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
1105	0, 0xffffffff,
1106	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1107	DESC_S_MASK \|
1108	DESC_W_MASK \| DESC_A_MASK);
1109	env->eflags &= ~(IF_MASK \| RF_MASK \| VM_MASK);
1110	env->eip = (uint32_t)env->star;
1111	}
1112	}
1113
1114	void helper_sysret(int dflag)
1115	{
1116	int cpl, selector;
1117
1118	if (!(env->efer & MSR_EFER_SCE)) {
1119	raise_exception_err(EXCP06_ILLOP, 0);
1120	}
1121	cpl = env->hflags & HF_CPL_MASK;
1122	if (!(env->cr[0] & CR0_PE_MASK) \|\| cpl != 0) {
1123	raise_exception_err(EXCP0D_GPF, 0);
1124	}
1125	selector = (env->star >> 48) & 0xffff;
1126	#ifdef TARGET_X86_64
1127	if (env->hflags & HF_LMA_MASK) {
1128	if (dflag == 2) {
1129	cpu_x86_load_seg_cache(env, R_CS, (selector + 16) \| 3,
1130	0, 0xffffffff,
1131	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1132	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1133	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK \|
1134	DESC_L_MASK);
1135	env->eip = ECX;
1136	} else {
1137	cpu_x86_load_seg_cache(env, R_CS, selector \| 3,
1138	0, 0xffffffff,
1139	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1140	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1141	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
1142	env->eip = (uint32_t)ECX;
1143	}
1144	cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1145	0, 0xffffffff,
1146	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1147	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1148	DESC_W_MASK \| DESC_A_MASK);
1149	load_eflags((uint32_t)(env->regs[11]), TF_MASK \| AC_MASK \| ID_MASK \|
1150	IF_MASK \| IOPL_MASK \| VM_MASK \| RF_MASK \| NT_MASK);
1151	cpu_x86_set_cpl(env, 3);
1152	} else
1153	#endif
1154	{
1155	cpu_x86_load_seg_cache(env, R_CS, selector \| 3,
1156	0, 0xffffffff,
1157	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1158	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1159	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
1160	env->eip = (uint32_t)ECX;
1161	cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1162	0, 0xffffffff,
1163	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1164	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1165	DESC_W_MASK \| DESC_A_MASK);
1166	env->eflags \|= IF_MASK;
1167	cpu_x86_set_cpl(env, 3);
1168	}
1169	#ifdef USE_KQEMU
1170	if (kqemu_is_ok(env)) {
1171	if (env->hflags & HF_LMA_MASK)
1172	CC_OP = CC_OP_EFLAGS;
1173	env->exception_index = -1;
1174	cpu_loop_exit();
1175	}
1176	#endif
1177	}
1178
1179	#ifdef VBOX
1180	/**
1181	* Checks and processes external VMM events.
1182	* Called by op_check_external_event() when any of the flags is set and can be serviced.
1183	*/
1184	void helper_external_event(void)
1185	{
1186	if (env->interrupt_request & CPU_INTERRUPT_EXTERNAL_HARD)
1187	{
1188	ASMAtomicAndS32(&env->interrupt_request, ~CPU_INTERRUPT_EXTERNAL_HARD);
1189	cpu_interrupt(env, CPU_INTERRUPT_HARD);
1190	}
1191	if (env->interrupt_request & CPU_INTERRUPT_EXTERNAL_EXIT)
1192	{
1193	ASMAtomicAndS32(&env->interrupt_request, ~CPU_INTERRUPT_EXTERNAL_EXIT);
1194	cpu_interrupt(env, CPU_INTERRUPT_EXIT);
1195	}
1196	if (env->interrupt_request & CPU_INTERRUPT_EXTERNAL_DMA)
1197	{
1198	ASMAtomicAndS32(&env->interrupt_request, ~CPU_INTERRUPT_EXTERNAL_DMA);
1199	remR3DmaRun(env);
1200	}
1201	if (env->interrupt_request & CPU_INTERRUPT_EXTERNAL_TIMER)
1202	{
1203	ASMAtomicAndS32(&env->interrupt_request, ~CPU_INTERRUPT_EXTERNAL_TIMER);
1204	remR3TimersRun(env);
1205	}
1206	}
1207	#endif /* VBOX */
1208
1209	/* real mode interrupt */
1210	static void do_interrupt_real(int intno, int is_int, int error_code,
1211	unsigned int next_eip)
1212	{
1213	SegmentCache *dt;
1214	target_ulong ptr, ssp;
1215	int selector;
1216	uint32_t offset, esp;
1217	uint32_t old_cs, old_eip;
1218
1219	/* real mode (simpler !) */
1220	dt = &env->idt;
1221	if (intno * 4 + 3 > dt->limit)
1222	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
1223	ptr = dt->base + intno * 4;
1224	offset = lduw_kernel(ptr);
1225	selector = lduw_kernel(ptr + 2);
1226	esp = ESP;
1227	ssp = env->segs[R_SS].base;
1228	if (is_int)
1229	old_eip = next_eip;
1230	else
1231	old_eip = env->eip;
1232	old_cs = env->segs[R_CS].selector;
1233	/* XXX: use SS segment size ? */
1234	PUSHW(ssp, esp, 0xffff, compute_eflags());
1235	PUSHW(ssp, esp, 0xffff, old_cs);
1236	PUSHW(ssp, esp, 0xffff, old_eip);
1237
1238	/* update processor state */
1239	ESP = (ESP & ~0xffff) \| (esp & 0xffff);
1240	env->eip = offset;
1241	env->segs[R_CS].selector = selector;
1242	env->segs[R_CS].base = (selector << 4);
1243	env->eflags &= ~(IF_MASK \| TF_MASK \| AC_MASK \| RF_MASK);
1244	}
1245
1246	/* fake user mode interrupt */
1247	void do_interrupt_user(int intno, int is_int, int error_code,
1248	target_ulong next_eip)
1249	{
1250	SegmentCache *dt;
1251	target_ulong ptr;
1252	int dpl, cpl;
1253	uint32_t e2;
1254
1255	dt = &env->idt;
1256	ptr = dt->base + (intno * 8);
1257	e2 = ldl_kernel(ptr + 4);
1258
1259	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1260	cpl = env->hflags & HF_CPL_MASK;
1261	/* check privledge if software int */
1262	if (is_int && dpl < cpl)
1263	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
1264
1265	/* Since we emulate only user space, we cannot do more than
1266	exiting the emulation with the suitable exception and error
1267	code */
1268	if (is_int)
1269	EIP = next_eip;
1270	}
1271
1272	/*
1273	* Begin execution of an interruption. is_int is TRUE if coming from
1274	* the int instruction. next_eip is the EIP value AFTER the interrupt
1275	* instruction. It is only relevant if is_int is TRUE.
1276	*/
1277	void do_interrupt(int intno, int is_int, int error_code,
1278	target_ulong next_eip, int is_hw)
1279	{
1280	#ifdef DEBUG_PCALL
1281	if (loglevel & (CPU_LOG_PCALL \| CPU_LOG_INT)) {
1282	if ((env->cr[0] & CR0_PE_MASK)) {
1283	static int count;
1284	fprintf(logfile, "%6d: v=%02x e=%04x i=%d cpl=%d IP=%04x:" TARGET_FMT_lx " pc=" TARGET_FMT_lx " SP=%04x:" TARGET_FMT_lx,
1285	count, intno, error_code, is_int,
1286	env->hflags & HF_CPL_MASK,
1287	env->segs[R_CS].selector, EIP,
1288	(int)env->segs[R_CS].base + EIP,
1289	env->segs[R_SS].selector, ESP);
1290	if (intno == 0x0e) {
1291	fprintf(logfile, " CR2=" TARGET_FMT_lx, env->cr[2]);
1292	} else {
1293	fprintf(logfile, " EAX=" TARGET_FMT_lx, EAX);
1294	}
1295	fprintf(logfile, "\n");
1296	#if 0
1297	cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
1298	{
1299	int i;
1300	uint8_t *ptr;
1301	fprintf(logfile, " code=");
1302	ptr = env->segs[R_CS].base + env->eip;
1303	for(i = 0; i < 16; i++) {
1304	fprintf(logfile, " %02x", ldub(ptr + i));
1305	}
1306	fprintf(logfile, "\n");
1307	}
1308	#endif
1309	count++;
1310	}
1311	}
1312	#endif
1313	if (env->cr[0] & CR0_PE_MASK) {
1314	#if TARGET_X86_64
1315	if (env->hflags & HF_LMA_MASK) {
1316	do_interrupt64(intno, is_int, error_code, next_eip, is_hw);
1317	} else
1318	#endif
1319	{
1320	#ifdef VBOX
1321	/* int xx , v86 code and VME enabled? /
1322	if ( (env->eflags & VM_MASK)
1323	&& (env->cr[4] & CR4_VME_MASK)
1324	&& is_int
1325	&& !is_hw
1326	&& env->eip + 1 != next_eip /* single byte int 3 goes straight to the protected mode handler */
1327	)
1328	do_soft_interrupt_vme(intno, error_code, next_eip);
1329	else
1330	#endif
1331	do_interrupt_protected(intno, is_int, error_code, next_eip, is_hw);
1332	}
1333	} else {
1334	do_interrupt_real(intno, is_int, error_code, next_eip);
1335	}
1336	}
1337
1338	/*
1339	* Signal an interruption. It is executed in the main CPU loop.
1340	* is_int is TRUE if coming from the int instruction. next_eip is the
1341	* EIP value AFTER the interrupt instruction. It is only relevant if
1342	* is_int is TRUE.
1343	*/
1344	void raise_interrupt(int intno, int is_int, int error_code,
1345	int next_eip_addend)
1346	{
1347	#if defined(VBOX) && defined(DEBUG) && !defined(DEBUG_dmik)
1348	Log2(("raise_interrupt: %x %x %x %08x\n", intno, is_int, error_code, env->eip + next_eip_addend));
1349	#endif
1350	env->exception_index = intno;
1351	env->error_code = error_code;
1352	env->exception_is_int = is_int;
1353	env->exception_next_eip = env->eip + next_eip_addend;
1354	cpu_loop_exit();
1355	}
1356
1357	/* same as raise_exception_err, but do not restore global registers */
1358	static void raise_exception_err_norestore(int exception_index, int error_code)
1359	{
1360	env->exception_index = exception_index;
1361	env->error_code = error_code;
1362	env->exception_is_int = 0;
1363	env->exception_next_eip = 0;
1364	longjmp(env->jmp_env, 1);
1365	}
1366
1367	/* shortcuts to generate exceptions */
1368
1369	void (raise_exception_err)(int exception_index, int error_code)
1370	{
1371	raise_interrupt(exception_index, 0, error_code, 0);
1372	}
1373
1374	void raise_exception(int exception_index)
1375	{
1376	raise_interrupt(exception_index, 0, 0, 0);
1377	}
1378
1379	#ifdef BUGGY_GCC_DIV64
1380	/* gcc 2.95.4 on PowerPC does not seem to like using __udivdi3, so we
1381	call it from another function */
1382	uint32_t div32(uint64_t *q_ptr, uint64_t num, uint32_t den)
1383	{
1384	*q_ptr = num / den;
1385	return num % den;
1386	}
1387
1388	int32_t idiv32(int64_t *q_ptr, int64_t num, int32_t den)
1389	{
1390	*q_ptr = num / den;
1391	return num % den;
1392	}
1393	#endif
1394
1395	void helper_divl_EAX_T0(void)
1396	{
1397	unsigned int den, r;
1398	uint64_t num, q;
1399
1400	num = ((uint32_t)EAX) \| ((uint64_t)((uint32_t)EDX) << 32);
1401	den = T0;
1402	if (den == 0) {
1403	raise_exception(EXCP00_DIVZ);
1404	}
1405	#ifdef BUGGY_GCC_DIV64
1406	r = div32(&q, num, den);
1407	#else
1408	q = (num / den);
1409	r = (num % den);
1410	#endif
1411	if (q > 0xffffffff)
1412	raise_exception(EXCP00_DIVZ);
1413	EAX = (uint32_t)q;
1414	EDX = (uint32_t)r;
1415	}
1416
1417	void helper_idivl_EAX_T0(void)
1418	{
1419	int den, r;
1420	int64_t num, q;
1421
1422	num = ((uint32_t)EAX) \| ((uint64_t)((uint32_t)EDX) << 32);
1423	den = T0;
1424	if (den == 0) {
1425	raise_exception(EXCP00_DIVZ);
1426	}
1427	#ifdef BUGGY_GCC_DIV64
1428	r = idiv32(&q, num, den);
1429	#else
1430	q = (num / den);
1431	r = (num % den);
1432	#endif
1433	if (q != (int32_t)q)
1434	raise_exception(EXCP00_DIVZ);
1435	EAX = (uint32_t)q;
1436	EDX = (uint32_t)r;
1437	}
1438
1439	void helper_cmpxchg8b(void)
1440	{
1441	uint64_t d;
1442	int eflags;
1443
1444	eflags = cc_table[CC_OP].compute_all();
1445	d = ldq(A0);
1446	if (d == (((uint64_t)EDX << 32) \| EAX)) {
1447	stq(A0, ((uint64_t)ECX << 32) \| EBX);
1448	eflags \|= CC_Z;
1449	} else {
1450	EDX = d >> 32;
1451	EAX = d;
1452	eflags &= ~CC_Z;
1453	}
1454	CC_SRC = eflags;
1455	}
1456
1457	void helper_cpuid(void)
1458	{
1459	#ifndef VBOX
1460	switch((uint32_t)EAX) {
1461	case 0:
1462	EAX = 2; /* max EAX index supported */
1463	EBX = env->cpuid_vendor1;
1464	EDX = env->cpuid_vendor2;
1465	ECX = env->cpuid_vendor3;
1466	break;
1467	case 1:
1468	EAX = env->cpuid_version;
1469	EBX = 0;
1470	ECX = env->cpuid_ext_features;
1471	EDX = env->cpuid_features;
1472	break;
1473
1474	default:
1475	/* cache info: needed for Pentium Pro compatibility */
1476	EAX = 0x410601;
1477	EBX = 0;
1478	ECX = 0;
1479	EDX = 0;
1480	break;
1481
1482	#ifdef TARGET_X86_64
1483	case 0x80000000:
1484	EAX = 0x80000008;
1485	EBX = env->cpuid_vendor1;
1486	EDX = env->cpuid_vendor2;
1487	ECX = env->cpuid_vendor3;
1488	break;
1489	case 0x80000001:
1490	EAX = env->cpuid_features;
1491	EBX = 0;
1492	ECX = 0;
1493	/* long mode + syscall/sysret features */
1494	EDX = (env->cpuid_features & 0x0183F3FF) \| (1 << 29) \| (1 << 11);
1495	break;
1496	case 0x80000008:
1497	/* virtual & phys address size in low 2 bytes. */
1498	EAX = 0x00003028;
1499	EBX = 0;
1500	ECX = 0;
1501	EDX = 0;
1502	break;
1503	#endif
1504	}
1505	#else /* VBOX */
1506	remR3CpuId(env, EAX, &EAX, &EBX, &ECX, &EDX);
1507	#endif /* VBOX */
1508	}
1509
1510	void helper_enter_level(int level, int data32)
1511	{
1512	target_ulong ssp;
1513	uint32_t esp_mask, esp, ebp;
1514
1515	esp_mask = get_sp_mask(env->segs[R_SS].flags);
1516	ssp = env->segs[R_SS].base;
1517	ebp = EBP;
1518	esp = ESP;
1519	if (data32) {
1520	/* 32 bit */
1521	esp -= 4;
1522	while (--level) {
1523	esp -= 4;
1524	ebp -= 4;
1525	stl(ssp + (esp & esp_mask), ldl(ssp + (ebp & esp_mask)));
1526	}
1527	esp -= 4;
1528	stl(ssp + (esp & esp_mask), T1);
1529	} else {
1530	/* 16 bit */
1531	esp -= 2;
1532	while (--level) {
1533	esp -= 2;
1534	ebp -= 2;
1535	stw(ssp + (esp & esp_mask), lduw(ssp + (ebp & esp_mask)));
1536	}
1537	esp -= 2;
1538	stw(ssp + (esp & esp_mask), T1);
1539	}
1540	}
1541
1542	#ifdef TARGET_X86_64
1543	void helper_enter64_level(int level, int data64)
1544	{
1545	target_ulong esp, ebp;
1546	ebp = EBP;
1547	esp = ESP;
1548
1549	if (data64) {
1550	/* 64 bit */
1551	esp -= 8;
1552	while (--level) {
1553	esp -= 8;
1554	ebp -= 8;
1555	stq(esp, ldq(ebp));
1556	}
1557	esp -= 8;
1558	stq(esp, T1);
1559	} else {
1560	/* 16 bit */
1561	esp -= 2;
1562	while (--level) {
1563	esp -= 2;
1564	ebp -= 2;
1565	stw(esp, lduw(ebp));
1566	}
1567	esp -= 2;
1568	stw(esp, T1);
1569	}
1570	}
1571	#endif
1572
1573	void helper_lldt_T0(void)
1574	{
1575	int selector;
1576	SegmentCache *dt;
1577	uint32_t e1, e2;
1578	int index, entry_limit;
1579	target_ulong ptr;
1580	#ifdef VBOX
1581	Log(("helper_lldt_T0: old ldtr=%RTsel {.base=%VGv, .limit=%VGv} new=%RTsel\n",
1582	(RTSEL)env->ldt.selector, (RTGCPTR)env->ldt.base, (RTGCPTR)env->ldt.limit, (RTSEL)(T0 & 0xffff)));
1583	#endif
1584
1585	selector = T0 & 0xffff;
1586	if ((selector & 0xfffc) == 0) {
1587	/* XXX: NULL selector case: invalid LDT */
1588	env->ldt.base = 0;
1589	env->ldt.limit = 0;
1590	} else {
1591	if (selector & 0x4)
1592	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1593	dt = &env->gdt;
1594	index = selector & ~7;
1595	#ifdef TARGET_X86_64
1596	if (env->hflags & HF_LMA_MASK)
1597	entry_limit = 15;
1598	else
1599	#endif
1600	entry_limit = 7;
1601	if ((index + entry_limit) > dt->limit)
1602	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1603	ptr = dt->base + index;
1604	e1 = ldl_kernel(ptr);
1605	e2 = ldl_kernel(ptr + 4);
1606	if ((e2 & DESC_S_MASK) \|\| ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2)
1607	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1608	if (!(e2 & DESC_P_MASK))
1609	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
1610	#ifdef TARGET_X86_64
1611	if (env->hflags & HF_LMA_MASK) {
1612	uint32_t e3;
1613	e3 = ldl_kernel(ptr + 8);
1614	load_seg_cache_raw_dt(&env->ldt, e1, e2);
1615	env->ldt.base \|= (target_ulong)e3 << 32;
1616	} else
1617	#endif
1618	{
1619	load_seg_cache_raw_dt(&env->ldt, e1, e2);
1620	}
1621	}
1622	env->ldt.selector = selector;
1623	#ifdef VBOX
1624	Log(("helper_lldt_T0: new ldtr=%RTsel {.base=%VGv, .limit=%VGv}\n",
1625	(RTSEL)env->ldt.selector, (RTGCPTR)env->ldt.base, (RTGCPTR)env->ldt.limit));
1626	#endif
1627	}
1628
1629	void helper_ltr_T0(void)
1630	{
1631	int selector;
1632	SegmentCache *dt;
1633	uint32_t e1, e2;
1634	int index, type, entry_limit;
1635	target_ulong ptr;
1636	#ifdef VBOX
1637	Log(("helper_ltr_T0: old tr=%RTsel {.base=%VGv, .limit=%VGv, .flags=%RX32} new=%RTsel\n",
1638	(RTSEL)env->tr.selector, (RTGCPTR)env->tr.base, (RTGCPTR)env->tr.limit,
1639	env->tr.flags, (RTSEL)(T0 & 0xffff)));
1640	#endif
1641
1642	selector = T0 & 0xffff;
1643	if ((selector & 0xfffc) == 0) {
1644	/* NULL selector case: invalid TR */
1645	env->tr.base = 0;
1646	env->tr.limit = 0;
1647	env->tr.flags = 0;
1648	} else {
1649	if (selector & 0x4)
1650	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1651	dt = &env->gdt;
1652	index = selector & ~7;
1653	#ifdef TARGET_X86_64
1654	if (env->hflags & HF_LMA_MASK)
1655	entry_limit = 15;
1656	else
1657	#endif
1658	entry_limit = 7;
1659	if ((index + entry_limit) > dt->limit)
1660	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1661	ptr = dt->base + index;
1662	e1 = ldl_kernel(ptr);
1663	e2 = ldl_kernel(ptr + 4);
1664	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
1665	if ((e2 & DESC_S_MASK) \|\|
1666	(type != 1 && type != 9))
1667	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1668	if (!(e2 & DESC_P_MASK))
1669	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
1670	#ifdef TARGET_X86_64
1671	if (env->hflags & HF_LMA_MASK) {
1672	uint32_t e3;
1673	e3 = ldl_kernel(ptr + 8);
1674	load_seg_cache_raw_dt(&env->tr, e1, e2);
1675	env->tr.base \|= (target_ulong)e3 << 32;
1676	} else
1677	#endif
1678	{
1679	load_seg_cache_raw_dt(&env->tr, e1, e2);
1680	}
1681	e2 \|= DESC_TSS_BUSY_MASK;
1682	stl_kernel(ptr + 4, e2);
1683	}
1684	env->tr.selector = selector;
1685	#ifdef VBOX
1686	Log(("helper_ltr_T0: new tr=%RTsel {.base=%VGv, .limit=%VGv, .flags=%RX32} new=%RTsel\n",
1687	(RTSEL)env->tr.selector, (RTGCPTR)env->tr.base, (RTGCPTR)env->tr.limit,
1688	env->tr.flags, (RTSEL)(T0 & 0xffff)));
1689	#endif
1690	}
1691
1692	/* only works if protected mode and not VM86. seg_reg must be != R_CS */
1693	void load_seg(int seg_reg, int selector)
1694	{
1695	uint32_t e1, e2;
1696	int cpl, dpl, rpl;
1697	SegmentCache *dt;
1698	int index;
1699	target_ulong ptr;
1700
1701	selector &= 0xffff;
1702	cpl = env->hflags & HF_CPL_MASK;
1703	if ((selector & 0xfffc) == 0) {
1704	/* null selector case */
1705	if (seg_reg == R_SS
1706	#ifdef TARGET_X86_64
1707	&& (!(env->hflags & HF_CS64_MASK) \|\| cpl == 3)
1708	#endif
1709	)
1710	raise_exception_err(EXCP0D_GPF, 0);
1711	cpu_x86_load_seg_cache(env, seg_reg, selector, 0, 0, 0);
1712	} else {
1713
1714	if (selector & 0x4)
1715	dt = &env->ldt;
1716	else
1717	dt = &env->gdt;
1718	index = selector & ~7;
1719	if ((index + 7) > dt->limit)
1720	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1721	ptr = dt->base + index;
1722	e1 = ldl_kernel(ptr);
1723	e2 = ldl_kernel(ptr + 4);
1724
1725	if (!(e2 & DESC_S_MASK))
1726	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1727	rpl = selector & 3;
1728	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1729	if (seg_reg == R_SS) {
1730	/* must be writable segment */
1731	if ((e2 & DESC_CS_MASK) \|\| !(e2 & DESC_W_MASK))
1732	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1733	if (rpl != cpl \|\| dpl != cpl)
1734	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1735	} else {
1736	/* must be readable segment */
1737	if ((e2 & (DESC_CS_MASK \| DESC_R_MASK)) == DESC_CS_MASK)
1738	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1739
1740	if (!(e2 & DESC_CS_MASK) \|\| !(e2 & DESC_C_MASK)) {
1741	/* if not conforming code, test rights */
1742	if (dpl < cpl \|\| dpl < rpl)
1743	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1744	}
1745	}
1746
1747	if (!(e2 & DESC_P_MASK)) {
1748	if (seg_reg == R_SS)
1749	raise_exception_err(EXCP0C_STACK, selector & 0xfffc);
1750	else
1751	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
1752	}
1753
1754	/* set the access bit if not already set */
1755	if (!(e2 & DESC_A_MASK)) {
1756	e2 \|= DESC_A_MASK;
1757	stl_kernel(ptr + 4, e2);
1758	}
1759
1760	cpu_x86_load_seg_cache(env, seg_reg, selector,
1761	get_seg_base(e1, e2),
1762	get_seg_limit(e1, e2),
1763	e2);
1764	#if 0
1765	fprintf(logfile, "load_seg: sel=0x%04x base=0x%08lx limit=0x%08lx flags=%08x\n",
1766	selector, (unsigned long)sc->base, sc->limit, sc->flags);
1767	#endif
1768	}
1769	}
1770
1771	/* protected mode jump */
1772	void helper_ljmp_protected_T0_T1(int next_eip_addend)
1773	{
1774	int new_cs, gate_cs, type;
1775	uint32_t e1, e2, cpl, dpl, rpl, limit;
1776	target_ulong new_eip, next_eip;
1777
1778	new_cs = T0;
1779	new_eip = T1;
1780	if ((new_cs & 0xfffc) == 0)
1781	raise_exception_err(EXCP0D_GPF, 0);
1782	if (load_segment(&e1, &e2, new_cs) != 0)
1783	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1784	cpl = env->hflags & HF_CPL_MASK;
1785	if (e2 & DESC_S_MASK) {
1786	if (!(e2 & DESC_CS_MASK))
1787	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1788	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1789	if (e2 & DESC_C_MASK) {
1790	/* conforming code segment */
1791	if (dpl > cpl)
1792	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1793	} else {
1794	/* non conforming code segment */
1795	rpl = new_cs & 3;
1796	if (rpl > cpl)
1797	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1798	if (dpl != cpl)
1799	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1800	}
1801	if (!(e2 & DESC_P_MASK))
1802	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
1803	limit = get_seg_limit(e1, e2);
1804	if (new_eip > limit &&
1805	!(env->hflags & HF_LMA_MASK) && !(e2 & DESC_L_MASK))
1806	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1807	cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) \| cpl,
1808	get_seg_base(e1, e2), limit, e2);
1809	EIP = new_eip;
1810	} else {
1811	/* jump to call or task gate */
1812	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1813	rpl = new_cs & 3;
1814	cpl = env->hflags & HF_CPL_MASK;
1815	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
1816	switch(type) {
1817	case 1: /* 286 TSS */
1818	case 9: /* 386 TSS */
1819	case 5: /* task gate */
1820	if (dpl < cpl \|\| dpl < rpl)
1821	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1822	next_eip = env->eip + next_eip_addend;
1823	switch_tss(new_cs, e1, e2, SWITCH_TSS_JMP, next_eip);
1824	CC_OP = CC_OP_EFLAGS;
1825	break;
1826	case 4: /* 286 call gate */
1827	case 12: /* 386 call gate */
1828	if ((dpl < cpl) \|\| (dpl < rpl))
1829	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1830	if (!(e2 & DESC_P_MASK))
1831	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
1832	gate_cs = e1 >> 16;
1833	new_eip = (e1 & 0xffff);
1834	if (type == 12)
1835	new_eip \|= (e2 & 0xffff0000);
1836	if (load_segment(&e1, &e2, gate_cs) != 0)
1837	raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
1838	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1839	/* must be code segment */
1840	if (((e2 & (DESC_S_MASK \| DESC_CS_MASK)) !=
1841	(DESC_S_MASK \| DESC_CS_MASK)))
1842	raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
1843	if (((e2 & DESC_C_MASK) && (dpl > cpl)) \|\|
1844	(!(e2 & DESC_C_MASK) && (dpl != cpl)))
1845	raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
1846	if (!(e2 & DESC_P_MASK))
1847	raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
1848	limit = get_seg_limit(e1, e2);
1849	if (new_eip > limit)
1850	raise_exception_err(EXCP0D_GPF, 0);
1851	cpu_x86_load_seg_cache(env, R_CS, (gate_cs & 0xfffc) \| cpl,
1852	get_seg_base(e1, e2), limit, e2);
1853	EIP = new_eip;
1854	break;
1855	default:
1856	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1857	break;
1858	}
1859	}
1860	}
1861
1862	/* real mode call */
1863	void helper_lcall_real_T0_T1(int shift, int next_eip)
1864	{
1865	int new_cs, new_eip;
1866	uint32_t esp, esp_mask;
1867	target_ulong ssp;
1868
1869	new_cs = T0;
1870	new_eip = T1;
1871	esp = ESP;
1872	esp_mask = get_sp_mask(env->segs[R_SS].flags);
1873	ssp = env->segs[R_SS].base;
1874	if (shift) {
1875	PUSHL(ssp, esp, esp_mask, env->segs[R_CS].selector);
1876	PUSHL(ssp, esp, esp_mask, next_eip);
1877	} else {
1878	PUSHW(ssp, esp, esp_mask, env->segs[R_CS].selector);
1879	PUSHW(ssp, esp, esp_mask, next_eip);
1880	}
1881
1882	ESP = (ESP & ~esp_mask) \| (esp & esp_mask);
1883	env->eip = new_eip;
1884	env->segs[R_CS].selector = new_cs;
1885	env->segs[R_CS].base = (new_cs << 4);
1886	}
1887
1888	/* protected mode call */
1889	void helper_lcall_protected_T0_T1(int shift, int next_eip_addend)
1890	{
1891	int new_cs, new_stack, i;
1892	uint32_t e1, e2, cpl, dpl, rpl, selector, offset, param_count;
1893	uint32_t ss, ss_e1, ss_e2, sp, type, ss_dpl, sp_mask;
1894	uint32_t val, limit, old_sp_mask;
1895	target_ulong ssp, old_ssp, next_eip, new_eip;
1896
1897	new_cs = T0;
1898	new_eip = T1;
1899	next_eip = env->eip + next_eip_addend;
1900	#ifdef DEBUG_PCALL
1901	if (loglevel & CPU_LOG_PCALL) {
1902	fprintf(logfile, "lcall %04x:%08x s=%d\n",
1903	new_cs, (uint32_t)new_eip, shift);
1904	cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
1905	}
1906	#endif
1907	if ((new_cs & 0xfffc) == 0)
1908	raise_exception_err(EXCP0D_GPF, 0);
1909	if (load_segment(&e1, &e2, new_cs) != 0)
1910	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1911	cpl = env->hflags & HF_CPL_MASK;
1912	#ifdef DEBUG_PCALL
1913	if (loglevel & CPU_LOG_PCALL) {
1914	fprintf(logfile, "desc=%08x:%08x\n", e1, e2);
1915	}
1916	#endif
1917	if (e2 & DESC_S_MASK) {
1918	if (!(e2 & DESC_CS_MASK))
1919	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1920	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1921	if (e2 & DESC_C_MASK) {
1922	/* conforming code segment */
1923	if (dpl > cpl)
1924	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1925	} else {
1926	/* non conforming code segment */
1927	rpl = new_cs & 3;
1928	if (rpl > cpl)
1929	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1930	if (dpl != cpl)
1931	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1932	}
1933	if (!(e2 & DESC_P_MASK))
1934	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
1935
1936	#ifdef TARGET_X86_64
1937	/* XXX: check 16/32 bit cases in long mode */
1938	if (shift == 2) {
1939	target_ulong rsp;
1940	/* 64 bit case */
1941	rsp = ESP;
1942	PUSHQ(rsp, env->segs[R_CS].selector);
1943	PUSHQ(rsp, next_eip);
1944	/* from this point, not restartable */
1945	ESP = rsp;
1946	cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) \| cpl,
1947	get_seg_base(e1, e2),
1948	get_seg_limit(e1, e2), e2);
1949	EIP = new_eip;
1950	} else
1951	#endif
1952	{
1953	sp = ESP;
1954	sp_mask = get_sp_mask(env->segs[R_SS].flags);
1955	ssp = env->segs[R_SS].base;
1956	if (shift) {
1957	PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
1958	PUSHL(ssp, sp, sp_mask, next_eip);
1959	} else {
1960	PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
1961	PUSHW(ssp, sp, sp_mask, next_eip);
1962	}
1963
1964	limit = get_seg_limit(e1, e2);
1965	if (new_eip > limit)
1966	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1967	/* from this point, not restartable */
1968	ESP = (ESP & ~sp_mask) \| (sp & sp_mask);
1969	cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) \| cpl,
1970	get_seg_base(e1, e2), limit, e2);
1971	EIP = new_eip;
1972	}
1973	} else {
1974	/* check gate type */
1975	type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
1976	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1977	rpl = new_cs & 3;
1978	switch(type) {
1979	case 1: /* available 286 TSS */
1980	case 9: /* available 386 TSS */
1981	case 5: /* task gate */
1982	if (dpl < cpl \|\| dpl < rpl)
1983	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1984	switch_tss(new_cs, e1, e2, SWITCH_TSS_CALL, next_eip);
1985	CC_OP = CC_OP_EFLAGS;
1986	return;
1987	case 4: /* 286 call gate */
1988	case 12: /* 386 call gate */
1989	break;
1990	default:
1991	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1992	break;
1993	}
1994	shift = type >> 3;
1995
1996	if (dpl < cpl \|\| dpl < rpl)
1997	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
1998	/* check valid bit */
1999	if (!(e2 & DESC_P_MASK))
2000	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2001	selector = e1 >> 16;
2002	offset = (e2 & 0xffff0000) \| (e1 & 0x0000ffff);
2003	param_count = e2 & 0x1f;
2004	if ((selector & 0xfffc) == 0)
2005	raise_exception_err(EXCP0D_GPF, 0);
2006
2007	if (load_segment(&e1, &e2, selector) != 0)
2008	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2009	if (!(e2 & DESC_S_MASK) \|\| !(e2 & (DESC_CS_MASK)))
2010	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2011	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2012	if (dpl > cpl)
2013	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2014	if (!(e2 & DESC_P_MASK))
2015	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2016
2017	if (!(e2 & DESC_C_MASK) && dpl < cpl) {
2018	/* to inner priviledge */
2019	get_ss_esp_from_tss(&ss, &sp, dpl);
2020	#ifdef DEBUG_PCALL
2021	if (loglevel & CPU_LOG_PCALL)
2022	fprintf(logfile, "new ss:esp=%04x:%08x param_count=%d ESP=" TARGET_FMT_lx "\n",
2023	ss, sp, param_count, ESP);
2024	#endif
2025	if ((ss & 0xfffc) == 0)
2026	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2027	if ((ss & 3) != dpl)
2028	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2029	if (load_segment(&ss_e1, &ss_e2, ss) != 0)
2030	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2031	ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
2032	if (ss_dpl != dpl)
2033	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2034	if (!(ss_e2 & DESC_S_MASK) \|\|
2035	(ss_e2 & DESC_CS_MASK) \|\|
2036	!(ss_e2 & DESC_W_MASK))
2037	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2038	if (!(ss_e2 & DESC_P_MASK))
2039	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2040
2041	// push_size = ((param_count * 2) + 8) << shift;
2042
2043	old_sp_mask = get_sp_mask(env->segs[R_SS].flags);
2044	old_ssp = env->segs[R_SS].base;
2045
2046	sp_mask = get_sp_mask(ss_e2);
2047	ssp = get_seg_base(ss_e1, ss_e2);
2048	if (shift) {
2049	PUSHL(ssp, sp, sp_mask, env->segs[R_SS].selector);
2050	PUSHL(ssp, sp, sp_mask, ESP);
2051	for(i = param_count - 1; i >= 0; i--) {
2052	val = ldl_kernel(old_ssp + ((ESP + i * 4) & old_sp_mask));
2053	PUSHL(ssp, sp, sp_mask, val);
2054	}
2055	} else {
2056	PUSHW(ssp, sp, sp_mask, env->segs[R_SS].selector);
2057	PUSHW(ssp, sp, sp_mask, ESP);
2058	for(i = param_count - 1; i >= 0; i--) {
2059	val = lduw_kernel(old_ssp + ((ESP + i * 2) & old_sp_mask));
2060	PUSHW(ssp, sp, sp_mask, val);
2061	}
2062	}
2063	new_stack = 1;
2064	} else {
2065	/* to same priviledge */
2066	sp = ESP;
2067	sp_mask = get_sp_mask(env->segs[R_SS].flags);
2068	ssp = env->segs[R_SS].base;
2069	// push_size = (4 << shift);
2070	new_stack = 0;
2071	}
2072
2073	if (shift) {
2074	PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
2075	PUSHL(ssp, sp, sp_mask, next_eip);
2076	} else {
2077	PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
2078	PUSHW(ssp, sp, sp_mask, next_eip);
2079	}
2080
2081	/* from this point, not restartable */
2082
2083	if (new_stack) {
2084	ss = (ss & ~3) \| dpl;
2085	cpu_x86_load_seg_cache(env, R_SS, ss,
2086	ssp,
2087	get_seg_limit(ss_e1, ss_e2),
2088	ss_e2);
2089	}
2090
2091	selector = (selector & ~3) \| dpl;
2092	cpu_x86_load_seg_cache(env, R_CS, selector,
2093	get_seg_base(e1, e2),
2094	get_seg_limit(e1, e2),
2095	e2);
2096	cpu_x86_set_cpl(env, dpl);
2097	ESP = (ESP & ~sp_mask) \| (sp & sp_mask);
2098	EIP = offset;
2099	}
2100	#ifdef USE_KQEMU
2101	if (kqemu_is_ok(env)) {
2102	env->exception_index = -1;
2103	cpu_loop_exit();
2104	}
2105	#endif
2106	}
2107
2108	/* real and vm86 mode iret */
2109	void helper_iret_real(int shift)
2110	{
2111	uint32_t sp, new_cs, new_eip, new_eflags, sp_mask;
2112	target_ulong ssp;
2113	int eflags_mask;
2114
2115	#ifdef VBOX
2116	bool fVME = false;
2117
2118	remR3TrapClear(env->pVM);
2119	#endif
2120
2121	sp_mask = 0xffff; /* XXXX: use SS segment size ? */
2122	sp = ESP;
2123	ssp = env->segs[R_SS].base;
2124	if (shift == 1) {
2125	/* 32 bits */
2126	POPL(ssp, sp, sp_mask, new_eip);
2127	POPL(ssp, sp, sp_mask, new_cs);
2128	new_cs &= 0xffff;
2129	POPL(ssp, sp, sp_mask, new_eflags);
2130	} else {
2131	/* 16 bits */
2132	POPW(ssp, sp, sp_mask, new_eip);
2133	POPW(ssp, sp, sp_mask, new_cs);
2134	POPW(ssp, sp, sp_mask, new_eflags);
2135	}
2136	#ifdef VBOX
2137	if ( (env->eflags & VM_MASK)
2138	&& ((env->eflags >> IOPL_SHIFT) & 3) != 3
2139	&& (env->cr[4] & CR4_VME_MASK)) /* implied or else we would fault earlier */
2140	{
2141	fVME = true;
2142	/* if virtual interrupt pending and (virtual) interrupts will be enabled -> #GP */
2143	/* if TF will be set -> #GP */
2144	if ( ((new_eflags & IF_MASK) && (env->eflags & VIP_MASK))
2145	\|\| (new_eflags & TF_MASK))
2146	{
2147	raise_exception(EXCP0D_GPF);
2148	}
2149	}
2150	#endif
2151
2152	ESP = (ESP & ~sp_mask) \| (sp & sp_mask);
2153	load_seg_vm(R_CS, new_cs);
2154	env->eip = new_eip;
2155	#ifdef VBOX
2156	if (fVME)
2157	eflags_mask = TF_MASK \| AC_MASK \| ID_MASK \| RF_MASK \| NT_MASK;
2158	else
2159	#endif
2160	if (env->eflags & VM_MASK)
2161	eflags_mask = TF_MASK \| AC_MASK \| ID_MASK \| IF_MASK \| RF_MASK \| NT_MASK;
2162	else
2163	eflags_mask = TF_MASK \| AC_MASK \| ID_MASK \| IF_MASK \| IOPL_MASK \| RF_MASK \| NT_MASK;
2164	if (shift == 0)
2165	eflags_mask &= 0xffff;
2166
2167	load_eflags(new_eflags, eflags_mask);
2168
2169	#ifdef VBOX
2170	if (fVME)
2171	{
2172	if (new_eflags & IF_MASK)
2173	env->eflags \|= VIF_MASK;
2174	else
2175	env->eflags &= ~VIF_MASK;
2176	}
2177	#endif
2178	}
2179
2180	static inline void validate_seg(int seg_reg, int cpl)
2181	{
2182	int dpl;
2183	uint32_t e2;
2184
2185	e2 = env->segs[seg_reg].flags;
2186	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2187	if (!(e2 & DESC_CS_MASK) \|\| !(e2 & DESC_C_MASK)) {
2188	/* data or non conforming code segment */
2189	if (dpl < cpl) {
2190	cpu_x86_load_seg_cache(env, seg_reg, 0, 0, 0, 0);
2191	}
2192	}
2193	}
2194
2195	/* protected mode iret */
2196	static inline void helper_ret_protected(int shift, int is_iret, int addend)
2197	{
2198	uint32_t new_cs, new_eflags, new_ss;
2199	uint32_t new_es, new_ds, new_fs, new_gs;
2200	uint32_t e1, e2, ss_e1, ss_e2;
2201	int cpl, dpl, rpl, eflags_mask, iopl;
2202	target_ulong ssp, sp, new_eip, new_esp, sp_mask;
2203
2204	#ifdef TARGET_X86_64
2205	if (shift == 2)
2206	sp_mask = -1;
2207	else
2208	#endif
2209	sp_mask = get_sp_mask(env->segs[R_SS].flags);
2210	sp = ESP;
2211	ssp = env->segs[R_SS].base;
2212	new_eflags = 0; /* avoid warning */
2213	#ifdef TARGET_X86_64
2214	if (shift == 2) {
2215	POPQ(sp, new_eip);
2216	POPQ(sp, new_cs);
2217	new_cs &= 0xffff;
2218	if (is_iret) {
2219	POPQ(sp, new_eflags);
2220	}
2221	} else
2222	#endif
2223	if (shift == 1) {
2224	/* 32 bits */
2225	POPL(ssp, sp, sp_mask, new_eip);
2226	POPL(ssp, sp, sp_mask, new_cs);
2227	new_cs &= 0xffff;
2228	if (is_iret) {
2229	POPL(ssp, sp, sp_mask, new_eflags);
2230	#if defined(VBOX) && defined(DEBUG)
2231	printf("iret: new CS %04X\n", new_cs);
2232	printf("iret: new EIP %08X\n", new_eip);
2233	printf("iret: new EFLAGS %08X\n", new_eflags);
2234	printf("iret: EAX=%08x\n", EAX);
2235	#endif
2236
2237	if (new_eflags & VM_MASK)
2238	goto return_to_vm86;
2239	}
2240	#ifdef VBOX
2241	if ((new_cs & 0x3) == 1 && (env->state & CPU_RAW_RING0))
2242	{
2243	#ifdef DEBUG
2244	printf("RPL 1 -> new_cs %04X -> %04X\n", new_cs, new_cs & 0xfffc);
2245	#endif
2246	new_cs = new_cs & 0xfffc;
2247	}
2248	#endif
2249	} else {
2250	/* 16 bits */
2251	POPW(ssp, sp, sp_mask, new_eip);
2252	POPW(ssp, sp, sp_mask, new_cs);
2253	if (is_iret)
2254	POPW(ssp, sp, sp_mask, new_eflags);
2255	}
2256	#ifdef DEBUG_PCALL
2257	if (loglevel & CPU_LOG_PCALL) {
2258	fprintf(logfile, "lret new %04x:" TARGET_FMT_lx " s=%d addend=0x%x\n",
2259	new_cs, new_eip, shift, addend);
2260	cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
2261	}
2262	#endif
2263	if ((new_cs & 0xfffc) == 0)
2264	{
2265	#if defined(VBOX) && defined(DEBUG)
2266	printf("new_cs & 0xfffc) == 0\n");
2267	#endif
2268	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2269	}
2270	if (load_segment(&e1, &e2, new_cs) != 0)
2271	{
2272	#if defined(VBOX) && defined(DEBUG)
2273	printf("load_segment failed\n");
2274	#endif
2275	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2276	}
2277	if (!(e2 & DESC_S_MASK) \|\|
2278	!(e2 & DESC_CS_MASK))
2279	{
2280	#if defined(VBOX) && defined(DEBUG)
2281	printf("e2 mask %08x\n", e2);
2282	#endif
2283	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2284	}
2285	cpl = env->hflags & HF_CPL_MASK;
2286	rpl = new_cs & 3;
2287	if (rpl < cpl)
2288	{
2289	#if defined(VBOX) && defined(DEBUG)
2290	printf("rpl < cpl (%d vs %d)\n", rpl, cpl);
2291	#endif
2292	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2293	}
2294	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2295	if (e2 & DESC_C_MASK) {
2296	if (dpl > rpl)
2297	{
2298	#if defined(VBOX) && defined(DEBUG)
2299	printf("dpl > rpl (%d vs %d)\n", dpl, rpl);
2300	#endif
2301	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2302	}
2303	} else {
2304	if (dpl != rpl)
2305	{
2306	#if defined(VBOX) && defined(DEBUG)
2307	printf("dpl != rpl (%d vs %d) e1=%x e2=%x\n", dpl, rpl, e1, e2);
2308	#endif
2309	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2310	}
2311	}
2312	if (!(e2 & DESC_P_MASK))
2313	{
2314	#if defined(VBOX) && defined(DEBUG)
2315	printf("DESC_P_MASK e2=%08x\n", e2);
2316	#endif
2317	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2318	}
2319	sp += addend;
2320	if (rpl == cpl && (!(env->hflags & HF_CS64_MASK) \|\|
2321	((env->hflags & HF_CS64_MASK) && !is_iret))) {
2322	/* return to same priledge level */
2323	cpu_x86_load_seg_cache(env, R_CS, new_cs,
2324	get_seg_base(e1, e2),
2325	get_seg_limit(e1, e2),
2326	e2);
2327	} else {
2328	/* return to different priviledge level */
2329	#ifdef TARGET_X86_64
2330	if (shift == 2) {
2331	POPQ(sp, new_esp);
2332	POPQ(sp, new_ss);
2333	new_ss &= 0xffff;
2334	} else
2335	#endif
2336	if (shift == 1) {
2337	/* 32 bits */
2338	POPL(ssp, sp, sp_mask, new_esp);
2339	POPL(ssp, sp, sp_mask, new_ss);
2340	new_ss &= 0xffff;
2341	} else {
2342	/* 16 bits */
2343	POPW(ssp, sp, sp_mask, new_esp);
2344	POPW(ssp, sp, sp_mask, new_ss);
2345	}
2346	#ifdef DEBUG_PCALL
2347	if (loglevel & CPU_LOG_PCALL) {
2348	fprintf(logfile, "new ss:esp=%04x:" TARGET_FMT_lx "\n",
2349	new_ss, new_esp);
2350	}
2351	#endif
2352	if ((new_ss & 0xfffc) == 0) {
2353	#ifdef TARGET_X86_64
2354	/* NULL ss is allowed in long mode if cpl != 3*/
2355	if ((env->hflags & HF_LMA_MASK) && rpl != 3) {
2356	cpu_x86_load_seg_cache(env, R_SS, new_ss,
2357	0, 0xffffffff,
2358	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2359	DESC_S_MASK \| (rpl << DESC_DPL_SHIFT) \|
2360	DESC_W_MASK \| DESC_A_MASK);
2361	} else
2362	#endif
2363	{
2364	raise_exception_err(EXCP0D_GPF, 0);
2365	}
2366	} else {
2367	if ((new_ss & 3) != rpl)
2368	raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2369	if (load_segment(&ss_e1, &ss_e2, new_ss) != 0)
2370	raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2371	if (!(ss_e2 & DESC_S_MASK) \|\|
2372	(ss_e2 & DESC_CS_MASK) \|\|
2373	!(ss_e2 & DESC_W_MASK))
2374	raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2375	dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
2376	if (dpl != rpl)
2377	raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2378	if (!(ss_e2 & DESC_P_MASK))
2379	raise_exception_err(EXCP0B_NOSEG, new_ss & 0xfffc);
2380	cpu_x86_load_seg_cache(env, R_SS, new_ss,
2381	get_seg_base(ss_e1, ss_e2),
2382	get_seg_limit(ss_e1, ss_e2),
2383	ss_e2);
2384	}
2385
2386	cpu_x86_load_seg_cache(env, R_CS, new_cs,
2387	get_seg_base(e1, e2),
2388	get_seg_limit(e1, e2),
2389	e2);
2390	cpu_x86_set_cpl(env, rpl);
2391	sp = new_esp;
2392	#ifdef TARGET_X86_64
2393	if (env->hflags & HF_CS64_MASK)
2394	sp_mask = -1;
2395	else
2396	#endif
2397	sp_mask = get_sp_mask(ss_e2);
2398
2399	/* validate data segments */
2400	validate_seg(R_ES, rpl);
2401	validate_seg(R_DS, rpl);
2402	validate_seg(R_FS, rpl);
2403	validate_seg(R_GS, rpl);
2404
2405	sp += addend;
2406	}
2407	ESP = (ESP & ~sp_mask) \| (sp & sp_mask);
2408	env->eip = new_eip;
2409	if (is_iret) {
2410	/* NOTE: 'cpl' is the _old_ CPL */
2411	eflags_mask = TF_MASK \| AC_MASK \| ID_MASK \| RF_MASK \| NT_MASK;
2412	if (cpl == 0)
2413	#ifdef VBOX
2414	eflags_mask \|= IOPL_MASK \| VIF_MASK \| VIP_MASK;
2415	#else
2416	eflags_mask \|= IOPL_MASK;
2417	#endif
2418
2419	iopl = (env->eflags >> IOPL_SHIFT) & 3;
2420	if (cpl <= iopl)
2421	eflags_mask \|= IF_MASK;
2422	if (shift == 0)
2423	eflags_mask &= 0xffff;
2424	load_eflags(new_eflags, eflags_mask);
2425	}
2426	return;
2427
2428	return_to_vm86:
2429
2430	#if 0 // defined(VBOX) && defined(DEBUG)
2431	printf("V86: new CS %04X\n", new_cs);
2432	printf("V86: Descriptor %08X:%08X\n", e2, e1);
2433	printf("V86: new EIP %08X\n", new_eip);
2434	printf("V86: new EFLAGS %08X\n", new_eflags);
2435	#endif
2436
2437	POPL(ssp, sp, sp_mask, new_esp);
2438	POPL(ssp, sp, sp_mask, new_ss);
2439	POPL(ssp, sp, sp_mask, new_es);
2440	POPL(ssp, sp, sp_mask, new_ds);
2441	POPL(ssp, sp, sp_mask, new_fs);
2442	POPL(ssp, sp, sp_mask, new_gs);
2443
2444	/* modify processor state */
2445	load_eflags(new_eflags, TF_MASK \| AC_MASK \| ID_MASK \|
2446	IF_MASK \| IOPL_MASK \| VM_MASK \| NT_MASK \| VIF_MASK \| VIP_MASK);
2447	load_seg_vm(R_CS, new_cs & 0xffff);
2448	cpu_x86_set_cpl(env, 3);
2449	load_seg_vm(R_SS, new_ss & 0xffff);
2450	load_seg_vm(R_ES, new_es & 0xffff);
2451	load_seg_vm(R_DS, new_ds & 0xffff);
2452	load_seg_vm(R_FS, new_fs & 0xffff);
2453	load_seg_vm(R_GS, new_gs & 0xffff);
2454
2455	env->eip = new_eip & 0xffff;
2456	ESP = new_esp;
2457	}
2458
2459	void helper_iret_protected(int shift, int next_eip)
2460	{
2461	int tss_selector, type;
2462	uint32_t e1, e2;
2463
2464	#ifdef VBOX
2465	remR3TrapClear(env->pVM);
2466	#endif
2467
2468	/* specific case for TSS */
2469	if (env->eflags & NT_MASK) {
2470	#ifdef TARGET_X86_64
2471	if (env->hflags & HF_LMA_MASK)
2472	raise_exception_err(EXCP0D_GPF, 0);
2473	#endif
2474	tss_selector = lduw_kernel(env->tr.base + 0);
2475	if (tss_selector & 4)
2476	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2477	if (load_segment(&e1, &e2, tss_selector) != 0)
2478	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2479	type = (e2 >> DESC_TYPE_SHIFT) & 0x17;
2480	/* NOTE: we check both segment and busy TSS */
2481	if (type != 3)
2482	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2483	switch_tss(tss_selector, e1, e2, SWITCH_TSS_IRET, next_eip);
2484	} else {
2485	helper_ret_protected(shift, 1, 0);
2486	}
2487	}
2488
2489	void helper_lret_protected(int shift, int addend)
2490	{
2491	helper_ret_protected(shift, 0, addend);
2492	}
2493
2494	void helper_sysenter(void)
2495	{
2496	if (env->sysenter_cs == 0) {
2497	raise_exception_err(EXCP0D_GPF, 0);
2498	}
2499	env->eflags &= ~(VM_MASK \| IF_MASK \| RF_MASK);
2500	cpu_x86_set_cpl(env, 0);
2501	cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc,
2502	0, 0xffffffff,
2503	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2504	DESC_S_MASK \|
2505	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
2506	cpu_x86_load_seg_cache(env, R_SS, (env->sysenter_cs + 8) & 0xfffc,
2507	0, 0xffffffff,
2508	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2509	DESC_S_MASK \|
2510	DESC_W_MASK \| DESC_A_MASK);
2511	ESP = env->sysenter_esp;
2512	EIP = env->sysenter_eip;
2513	}
2514
2515	void helper_sysexit(void)
2516	{
2517	int cpl;
2518
2519	cpl = env->hflags & HF_CPL_MASK;
2520	if (env->sysenter_cs == 0 \|\| cpl != 0) {
2521	raise_exception_err(EXCP0D_GPF, 0);
2522	}
2523	cpu_x86_set_cpl(env, 3);
2524	cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 16) & 0xfffc) \| 3,
2525	0, 0xffffffff,
2526	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2527	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
2528	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
2529	cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 24) & 0xfffc) \| 3,
2530	0, 0xffffffff,
2531	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2532	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
2533	DESC_W_MASK \| DESC_A_MASK);
2534	ESP = ECX;
2535	EIP = EDX;
2536	}
2537
2538	void helper_movl_crN_T0(int reg)
2539	{
2540	#if !defined(CONFIG_USER_ONLY)
2541	switch(reg) {
2542	case 0:
2543	cpu_x86_update_cr0(env, T0);
2544	break;
2545	case 3:
2546	cpu_x86_update_cr3(env, T0);
2547	break;
2548	case 4:
2549	cpu_x86_update_cr4(env, T0);
2550	break;
2551	case 8:
2552	cpu_set_apic_tpr(env, T0);
2553	break;
2554	default:
2555	env->cr[reg] = T0;
2556	break;
2557	}
2558	#endif
2559	}
2560
2561	/* XXX: do more */
2562	void helper_movl_drN_T0(int reg)
2563	{
2564	env->dr[reg] = T0;
2565	}
2566
2567	void helper_invlpg(unsigned int addr)
2568	{
2569	cpu_x86_flush_tlb(env, addr);
2570	}
2571
2572	void helper_rdtsc(void)
2573	{
2574	uint64_t val;
2575
2576	if ((env->cr[4] & CR4_TSD_MASK) && ((env->hflags & HF_CPL_MASK) != 0)) {
2577	raise_exception(EXCP0D_GPF);
2578	}
2579	val = cpu_get_tsc(env);
2580	EAX = (uint32_t)(val);
2581	EDX = (uint32_t)(val >> 32);
2582	}
2583
2584	#if defined(CONFIG_USER_ONLY)
2585	void helper_wrmsr(void)
2586	{
2587	}
2588
2589	void helper_rdmsr(void)
2590	{
2591	}
2592	#else
2593	void helper_wrmsr(void)
2594	{
2595	uint64_t val;
2596
2597	val = ((uint32_t)EAX) \| ((uint64_t)((uint32_t)EDX) << 32);
2598
2599	switch((uint32_t)ECX) {
2600	case MSR_IA32_SYSENTER_CS:
2601	env->sysenter_cs = val & 0xffff;
2602	break;
2603	case MSR_IA32_SYSENTER_ESP:
2604	env->sysenter_esp = val;
2605	break;
2606	case MSR_IA32_SYSENTER_EIP:
2607	env->sysenter_eip = val;
2608	break;
2609	case MSR_IA32_APICBASE:
2610	cpu_set_apic_base(env, val);
2611	break;
2612	#ifdef TARGET_X86_64
2613	case MSR_EFER:
2614	#define MSR_EFER_UPDATE_MASK (MSR_EFER_SCE \| MSR_EFER_LME \| \
2615	MSR_EFER_NXE \| MSR_EFER_FFXSR)
2616	env->efer = (env->efer & ~MSR_EFER_UPDATE_MASK) \|
2617	(val & MSR_EFER_UPDATE_MASK);
2618	break;
2619	case MSR_STAR:
2620	env->star = val;
2621	break;
2622	case MSR_LSTAR:
2623	env->lstar = val;
2624	break;
2625	case MSR_CSTAR:
2626	env->cstar = val;
2627	break;
2628	case MSR_FMASK:
2629	env->fmask = val;
2630	break;
2631	case MSR_FSBASE:
2632	env->segs[R_FS].base = val;
2633	break;
2634	case MSR_GSBASE:
2635	env->segs[R_GS].base = val;
2636	break;
2637	case MSR_KERNELGSBASE:
2638	env->kernelgsbase = val;
2639	break;
2640	#endif
2641	default:
2642	/* XXX: exception ? */
2643	break;
2644	}
2645	}
2646
2647	void helper_rdmsr(void)
2648	{
2649	uint64_t val;
2650	switch((uint32_t)ECX) {
2651	case MSR_IA32_SYSENTER_CS:
2652	val = env->sysenter_cs;
2653	break;
2654	case MSR_IA32_SYSENTER_ESP:
2655	val = env->sysenter_esp;
2656	break;
2657	case MSR_IA32_SYSENTER_EIP:
2658	val = env->sysenter_eip;
2659	break;
2660	case MSR_IA32_APICBASE:
2661	val = cpu_get_apic_base(env);
2662	break;
2663	#ifdef TARGET_X86_64
2664	case MSR_EFER:
2665	val = env->efer;
2666	break;
2667	case MSR_STAR:
2668	val = env->star;
2669	break;
2670	case MSR_LSTAR:
2671	val = env->lstar;
2672	break;
2673	case MSR_CSTAR:
2674	val = env->cstar;
2675	break;
2676	case MSR_FMASK:
2677	val = env->fmask;
2678	break;
2679	case MSR_FSBASE:
2680	val = env->segs[R_FS].base;
2681	break;
2682	case MSR_GSBASE:
2683	val = env->segs[R_GS].base;
2684	break;
2685	case MSR_KERNELGSBASE:
2686	val = env->kernelgsbase;
2687	break;
2688	#endif
2689	default:
2690	/* XXX: exception ? */
2691	val = 0;
2692	break;
2693	}
2694	EAX = (uint32_t)(val);
2695	EDX = (uint32_t)(val >> 32);
2696	}
2697	#endif
2698
2699	void helper_lsl(void)
2700	{
2701	unsigned int selector, limit;
2702	uint32_t e1, e2, eflags;
2703	int rpl, dpl, cpl, type;
2704
2705	eflags = cc_table[CC_OP].compute_all();
2706	selector = T0 & 0xffff;
2707	if (load_segment(&e1, &e2, selector) != 0)
2708	goto fail;
2709	rpl = selector & 3;
2710	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2711	cpl = env->hflags & HF_CPL_MASK;
2712	if (e2 & DESC_S_MASK) {
2713	if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) {
2714	/* conforming */
2715	} else {
2716	if (dpl < cpl \|\| dpl < rpl)
2717	goto fail;
2718	}
2719	} else {
2720	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2721	switch(type) {
2722	case 1:
2723	case 2:
2724	case 3:
2725	case 9:
2726	case 11:
2727	break;
2728	default:
2729	goto fail;
2730	}
2731	if (dpl < cpl \|\| dpl < rpl) {
2732	fail:
2733	CC_SRC = eflags & ~CC_Z;
2734	return;
2735	}
2736	}
2737	limit = get_seg_limit(e1, e2);
2738	T1 = limit;
2739	CC_SRC = eflags \| CC_Z;
2740	}
2741
2742	void helper_lar(void)
2743	{
2744	unsigned int selector;
2745	uint32_t e1, e2, eflags;
2746	int rpl, dpl, cpl, type;
2747
2748	eflags = cc_table[CC_OP].compute_all();
2749	selector = T0 & 0xffff;
2750	if ((selector & 0xfffc) == 0)
2751	goto fail;
2752	if (load_segment(&e1, &e2, selector) != 0)
2753	goto fail;
2754	rpl = selector & 3;
2755	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2756	cpl = env->hflags & HF_CPL_MASK;
2757	if (e2 & DESC_S_MASK) {
2758	if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) {
2759	/* conforming */
2760	} else {
2761	if (dpl < cpl \|\| dpl < rpl)
2762	goto fail;
2763	}
2764	} else {
2765	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2766	switch(type) {
2767	case 1:
2768	case 2:
2769	case 3:
2770	case 4:
2771	case 5:
2772	case 9:
2773	case 11:
2774	case 12:
2775	break;
2776	default:
2777	goto fail;
2778	}
2779	if (dpl < cpl \|\| dpl < rpl) {
2780	fail:
2781	CC_SRC = eflags & ~CC_Z;
2782	return;
2783	}
2784	}
2785	T1 = e2 & 0x00f0ff00;
2786	CC_SRC = eflags \| CC_Z;
2787	}
2788
2789	void helper_verr(void)
2790	{
2791	unsigned int selector;
2792	uint32_t e1, e2, eflags;
2793	int rpl, dpl, cpl;
2794
2795	eflags = cc_table[CC_OP].compute_all();
2796	selector = T0 & 0xffff;
2797	if ((selector & 0xfffc) == 0)
2798	goto fail;
2799	if (load_segment(&e1, &e2, selector) != 0)
2800	goto fail;
2801	if (!(e2 & DESC_S_MASK))
2802	goto fail;
2803	rpl = selector & 3;
2804	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2805	cpl = env->hflags & HF_CPL_MASK;
2806	if (e2 & DESC_CS_MASK) {
2807	if (!(e2 & DESC_R_MASK))
2808	goto fail;
2809	if (!(e2 & DESC_C_MASK)) {
2810	if (dpl < cpl \|\| dpl < rpl)
2811	goto fail;
2812	}
2813	} else {
2814	if (dpl < cpl \|\| dpl < rpl) {
2815	fail:
2816	CC_SRC = eflags & ~CC_Z;
2817	return;
2818	}
2819	}
2820	CC_SRC = eflags \| CC_Z;
2821	}
2822
2823	void helper_verw(void)
2824	{
2825	unsigned int selector;
2826	uint32_t e1, e2, eflags;
2827	int rpl, dpl, cpl;
2828
2829	eflags = cc_table[CC_OP].compute_all();
2830	selector = T0 & 0xffff;
2831	if ((selector & 0xfffc) == 0)
2832	goto fail;
2833	if (load_segment(&e1, &e2, selector) != 0)
2834	goto fail;
2835	if (!(e2 & DESC_S_MASK))
2836	goto fail;
2837	rpl = selector & 3;
2838	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2839	cpl = env->hflags & HF_CPL_MASK;
2840	if (e2 & DESC_CS_MASK) {
2841	goto fail;
2842	} else {
2843	if (dpl < cpl \|\| dpl < rpl)
2844	goto fail;
2845	if (!(e2 & DESC_W_MASK)) {
2846	fail:
2847	CC_SRC = eflags & ~CC_Z;
2848	return;
2849	}
2850	}
2851	CC_SRC = eflags \| CC_Z;
2852	}
2853
2854	/* FPU helpers */
2855
2856	void helper_fldt_ST0_A0(void)
2857	{
2858	int new_fpstt;
2859	new_fpstt = (env->fpstt - 1) & 7;
2860	env->fpregs[new_fpstt].d = helper_fldt(A0);
2861	env->fpstt = new_fpstt;
2862	env->fptags[new_fpstt] = 0; /* validate stack entry */
2863	}
2864
2865	void helper_fstt_ST0_A0(void)
2866	{
2867	helper_fstt(ST0, A0);
2868	}
2869
2870	void fpu_set_exception(int mask)
2871	{
2872	env->fpus \|= mask;
2873	if (env->fpus & (~env->fpuc & FPUC_EM))
2874	env->fpus \|= FPUS_SE \| FPUS_B;
2875	}
2876
2877	CPU86_LDouble helper_fdiv(CPU86_LDouble a, CPU86_LDouble b)
2878	{
2879	if (b == 0.0)
2880	fpu_set_exception(FPUS_ZE);
2881	return a / b;
2882	}
2883
2884	void fpu_raise_exception(void)
2885	{
2886	if (env->cr[0] & CR0_NE_MASK) {
2887	raise_exception(EXCP10_COPR);
2888	}
2889	#if !defined(CONFIG_USER_ONLY)
2890	else {
2891	cpu_set_ferr(env);
2892	}
2893	#endif
2894	}
2895
2896	/* BCD ops */
2897
2898	void helper_fbld_ST0_A0(void)
2899	{
2900	CPU86_LDouble tmp;
2901	uint64_t val;
2902	unsigned int v;
2903	int i;
2904
2905	val = 0;
2906	for(i = 8; i >= 0; i--) {
2907	v = ldub(A0 + i);
2908	val = (val * 100) + ((v >> 4) * 10) + (v & 0xf);
2909	}
2910	tmp = val;
2911	if (ldub(A0 + 9) & 0x80)
2912	tmp = -tmp;
2913	fpush();
2914	ST0 = tmp;
2915	}
2916
2917	void helper_fbst_ST0_A0(void)
2918	{
2919	CPU86_LDouble tmp;
2920	int v;
2921	target_ulong mem_ref, mem_end;
2922	int64_t val;
2923
2924	tmp = rint(ST0);
2925	val = (int64_t)tmp;
2926	mem_ref = A0;
2927	mem_end = mem_ref + 9;
2928	if (val < 0) {
2929	stb(mem_end, 0x80);
2930	val = -val;
2931	} else {
2932	stb(mem_end, 0x00);
2933	}
2934	while (mem_ref < mem_end) {
2935	if (val == 0)
2936	break;
2937	v = val % 100;
2938	val = val / 100;
2939	v = ((v / 10) << 4) \| (v % 10);
2940	stb(mem_ref++, v);
2941	}
2942	while (mem_ref < mem_end) {
2943	stb(mem_ref++, 0);
2944	}
2945	}
2946
2947	void helper_f2xm1(void)
2948	{
2949	ST0 = pow(2.0,ST0) - 1.0;
2950	}
2951
2952	void helper_fyl2x(void)
2953	{
2954	CPU86_LDouble fptemp;
2955
2956	fptemp = ST0;
2957	if (fptemp>0.0){
2958	fptemp = log(fptemp)/log(2.0); /* log2(ST) */
2959	ST1 *= fptemp;
2960	fpop();
2961	} else {
2962	env->fpus &= (~0x4700);
2963	env->fpus \|= 0x400;
2964	}
2965	}
2966
2967	void helper_fptan(void)
2968	{
2969	CPU86_LDouble fptemp;
2970
2971	fptemp = ST0;
2972	if((fptemp > MAXTAN)\|\|(fptemp < -MAXTAN)) {
2973	env->fpus \|= 0x400;
2974	} else {
2975	ST0 = tan(fptemp);
2976	fpush();
2977	ST0 = 1.0;
2978	env->fpus &= (~0x400); /* C2 <-- 0 */
2979	/* the above code is for \|arg\| < 2*52 only /
2980	}
2981	}
2982
2983	void helper_fpatan(void)
2984	{
2985	CPU86_LDouble fptemp, fpsrcop;
2986
2987	fpsrcop = ST1;
2988	fptemp = ST0;
2989	ST1 = atan2(fpsrcop,fptemp);
2990	fpop();
2991	}
2992
2993	void helper_fxtract(void)
2994	{
2995	CPU86_LDoubleU temp;
2996	unsigned int expdif;
2997
2998	temp.d = ST0;
2999	expdif = EXPD(temp) - EXPBIAS;
3000	/DP exponent bias/
3001	ST0 = expdif;
3002	fpush();
3003	BIASEXPONENT(temp);
3004	ST0 = temp.d;
3005	}
3006
3007	void helper_fprem1(void)
3008	{
3009	CPU86_LDouble dblq, fpsrcop, fptemp;
3010	CPU86_LDoubleU fpsrcop1, fptemp1;
3011	int expdif;
3012	int q;
3013
3014	fpsrcop = ST0;
3015	fptemp = ST1;
3016	fpsrcop1.d = fpsrcop;
3017	fptemp1.d = fptemp;
3018	expdif = EXPD(fpsrcop1) - EXPD(fptemp1);
3019	if (expdif < 53) {
3020	dblq = fpsrcop / fptemp;
3021	dblq = (dblq < 0.0)? ceil(dblq): floor(dblq);
3022	ST0 = fpsrcop - fptemp*dblq;
3023	q = (int)dblq; /* cutting off top bits is assumed here */
3024	env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3025	/* (C0,C1,C3) <-- (q2,q1,q0) */
3026	env->fpus \|= (q&0x4) << 6; /* (C0) <-- q2 */
3027	env->fpus \|= (q&0x2) << 8; /* (C1) <-- q1 */
3028	env->fpus \|= (q&0x1) << 14; /* (C3) <-- q0 */
3029	} else {
3030	env->fpus \|= 0x400; /* C2 <-- 1 */
3031	fptemp = pow(2.0, expdif-50);
3032	fpsrcop = (ST0 / ST1) / fptemp;
3033	/* fpsrcop = integer obtained by rounding to the nearest */
3034	fpsrcop = (fpsrcop-floor(fpsrcop) < ceil(fpsrcop)-fpsrcop)?
3035	floor(fpsrcop): ceil(fpsrcop);
3036	ST0 -= (ST1 * fpsrcop * fptemp);
3037	}
3038	}
3039
3040	void helper_fprem(void)
3041	{
3042	CPU86_LDouble dblq, fpsrcop, fptemp;
3043	CPU86_LDoubleU fpsrcop1, fptemp1;
3044	int expdif;
3045	int q;
3046
3047	fpsrcop = ST0;
3048	fptemp = ST1;
3049	fpsrcop1.d = fpsrcop;
3050	fptemp1.d = fptemp;
3051	expdif = EXPD(fpsrcop1) - EXPD(fptemp1);
3052	if ( expdif < 53 ) {
3053	dblq = fpsrcop / fptemp;
3054	dblq = (dblq < 0.0)? ceil(dblq): floor(dblq);
3055	ST0 = fpsrcop - fptemp*dblq;
3056	q = (int)dblq; /* cutting off top bits is assumed here */
3057	env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3058	/* (C0,C1,C3) <-- (q2,q1,q0) */
3059	env->fpus \|= (q&0x4) << 6; /* (C0) <-- q2 */
3060	env->fpus \|= (q&0x2) << 8; /* (C1) <-- q1 */
3061	env->fpus \|= (q&0x1) << 14; /* (C3) <-- q0 */
3062	} else {
3063	env->fpus \|= 0x400; /* C2 <-- 1 */
3064	fptemp = pow(2.0, expdif-50);
3065	fpsrcop = (ST0 / ST1) / fptemp;
3066	/* fpsrcop = integer obtained by chopping */
3067	fpsrcop = (fpsrcop < 0.0)?
3068	-(floor(fabs(fpsrcop))): floor(fpsrcop);
3069	ST0 -= (ST1 * fpsrcop * fptemp);
3070	}
3071	}
3072
3073	void helper_fyl2xp1(void)
3074	{
3075	CPU86_LDouble fptemp;
3076
3077	fptemp = ST0;
3078	if ((fptemp+1.0)>0.0) {
3079	fptemp = log(fptemp+1.0) / log(2.0); /* log2(ST+1.0) */
3080	ST1 *= fptemp;
3081	fpop();
3082	} else {
3083	env->fpus &= (~0x4700);
3084	env->fpus \|= 0x400;
3085	}
3086	}
3087
3088	void helper_fsqrt(void)
3089	{
3090	CPU86_LDouble fptemp;
3091
3092	fptemp = ST0;
3093	if (fptemp<0.0) {
3094	env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3095	env->fpus \|= 0x400;
3096	}
3097	ST0 = sqrt(fptemp);
3098	}
3099
3100	void helper_fsincos(void)
3101	{
3102	CPU86_LDouble fptemp;
3103
3104	fptemp = ST0;
3105	if ((fptemp > MAXTAN)\|\|(fptemp < -MAXTAN)) {
3106	env->fpus \|= 0x400;
3107	} else {
3108	ST0 = sin(fptemp);
3109	fpush();
3110	ST0 = cos(fptemp);
3111	env->fpus &= (~0x400); /* C2 <-- 0 */
3112	/* the above code is for \|arg\| < 2*63 only /
3113	}
3114	}
3115
3116	void helper_frndint(void)
3117	{
3118	CPU86_LDouble a;
3119
3120	a = ST0;
3121	#ifdef __arm__
3122	switch(env->fpuc & RC_MASK) {
3123	default:
3124	case RC_NEAR:
3125	asm("rndd %0, %1" : "=f" (a) : "f"(a));
3126	break;
3127	case RC_DOWN:
3128	asm("rnddm %0, %1" : "=f" (a) : "f"(a));
3129	break;
3130	case RC_UP:
3131	asm("rnddp %0, %1" : "=f" (a) : "f"(a));
3132	break;
3133	case RC_CHOP:
3134	asm("rnddz %0, %1" : "=f" (a) : "f"(a));
3135	break;
3136	}
3137	#else
3138	a = rint(a);
3139	#endif
3140	ST0 = a;
3141	}
3142
3143	void helper_fscale(void)
3144	{
3145	CPU86_LDouble fpsrcop, fptemp;
3146
3147	fpsrcop = 2.0;
3148	fptemp = pow(fpsrcop,ST1);
3149	ST0 *= fptemp;
3150	}
3151
3152	void helper_fsin(void)
3153	{
3154	CPU86_LDouble fptemp;
3155
3156	fptemp = ST0;
3157	if ((fptemp > MAXTAN)\|\|(fptemp < -MAXTAN)) {
3158	env->fpus \|= 0x400;
3159	} else {
3160	ST0 = sin(fptemp);
3161	env->fpus &= (~0x400); /* C2 <-- 0 */
3162	/* the above code is for \|arg\| < 2*53 only /
3163	}
3164	}
3165
3166	void helper_fcos(void)
3167	{
3168	CPU86_LDouble fptemp;
3169
3170	fptemp = ST0;
3171	if((fptemp > MAXTAN)\|\|(fptemp < -MAXTAN)) {
3172	env->fpus \|= 0x400;
3173	} else {
3174	ST0 = cos(fptemp);
3175	env->fpus &= (~0x400); /* C2 <-- 0 */
3176	/* the above code is for \|arg5 < 2*63 only /
3177	}
3178	}
3179
3180	void helper_fxam_ST0(void)
3181	{
3182	CPU86_LDoubleU temp;
3183	int expdif;
3184
3185	temp.d = ST0;
3186
3187	env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3188	if (SIGND(temp))
3189	env->fpus \|= 0x200; /* C1 <-- 1 */
3190
3191	/* XXX: test fptags too */
3192	expdif = EXPD(temp);
3193	if (expdif == MAXEXPD) {
3194	#ifdef USE_X86LDOUBLE
3195	if (MANTD(temp) == 0x8000000000000000ULL)
3196	#else
3197	if (MANTD(temp) == 0)
3198	#endif
3199	env->fpus \|= 0x500 /Infinity/;
3200	else
3201	env->fpus \|= 0x100 /NaN/;
3202	} else if (expdif == 0) {
3203	if (MANTD(temp) == 0)
3204	env->fpus \|= 0x4000 /Zero/;
3205	else
3206	env->fpus \|= 0x4400 /Denormal/;
3207	} else {
3208	env->fpus \|= 0x400;
3209	}
3210	}
3211
3212	void helper_fstenv(target_ulong ptr, int data32)
3213	{
3214	int fpus, fptag, exp, i;
3215	uint64_t mant;
3216	CPU86_LDoubleU tmp;
3217
3218	fpus = (env->fpus & ~0x3800) \| (env->fpstt & 0x7) << 11;
3219	fptag = 0;
3220	for (i=7; i>=0; i--) {
3221	fptag <<= 2;
3222	if (env->fptags[i]) {
3223	fptag \|= 3;
3224	} else {
3225	tmp.d = env->fpregs[i].d;
3226	exp = EXPD(tmp);
3227	mant = MANTD(tmp);
3228	if (exp == 0 && mant == 0) {
3229	/* zero */
3230	fptag \|= 1;
3231	} else if (exp == 0 \|\| exp == MAXEXPD
3232	#ifdef USE_X86LDOUBLE
3233	\|\| (mant & (1LL << 63)) == 0
3234	#endif
3235	) {
3236	/* NaNs, infinity, denormal */
3237	fptag \|= 2;
3238	}
3239	}
3240	}
3241	if (data32) {
3242	/* 32 bit */
3243	stl(ptr, env->fpuc);
3244	stl(ptr + 4, fpus);
3245	stl(ptr + 8, fptag);
3246	stl(ptr + 12, 0); /* fpip */
3247	stl(ptr + 16, 0); /* fpcs */
3248	stl(ptr + 20, 0); /* fpoo */
3249	stl(ptr + 24, 0); /* fpos */
3250	} else {
3251	/* 16 bit */
3252	stw(ptr, env->fpuc);
3253	stw(ptr + 2, fpus);
3254	stw(ptr + 4, fptag);
3255	stw(ptr + 6, 0);
3256	stw(ptr + 8, 0);
3257	stw(ptr + 10, 0);
3258	stw(ptr + 12, 0);
3259	}
3260	}
3261
3262	void helper_fldenv(target_ulong ptr, int data32)
3263	{
3264	int i, fpus, fptag;
3265
3266	if (data32) {
3267	env->fpuc = lduw(ptr);
3268	fpus = lduw(ptr + 4);
3269	fptag = lduw(ptr + 8);
3270	}
3271	else {
3272	env->fpuc = lduw(ptr);
3273	fpus = lduw(ptr + 2);
3274	fptag = lduw(ptr + 4);
3275	}
3276	env->fpstt = (fpus >> 11) & 7;
3277	env->fpus = fpus & ~0x3800;
3278	for(i = 0;i < 8; i++) {
3279	env->fptags[i] = ((fptag & 3) == 3);
3280	fptag >>= 2;
3281	}
3282	}
3283
3284	void helper_fsave(target_ulong ptr, int data32)
3285	{
3286	CPU86_LDouble tmp;
3287	int i;
3288
3289	helper_fstenv(ptr, data32);
3290
3291	ptr += (14 << data32);
3292	for(i = 0;i < 8; i++) {
3293	tmp = ST(i);
3294	helper_fstt(tmp, ptr);
3295	ptr += 10;
3296	}
3297
3298	/* fninit */
3299	env->fpus = 0;
3300	env->fpstt = 0;
3301	env->fpuc = 0x37f;
3302	env->fptags[0] = 1;
3303	env->fptags[1] = 1;
3304	env->fptags[2] = 1;
3305	env->fptags[3] = 1;
3306	env->fptags[4] = 1;
3307	env->fptags[5] = 1;
3308	env->fptags[6] = 1;
3309	env->fptags[7] = 1;
3310	}
3311
3312	void helper_frstor(target_ulong ptr, int data32)
3313	{
3314	CPU86_LDouble tmp;
3315	int i;
3316
3317	helper_fldenv(ptr, data32);
3318	ptr += (14 << data32);
3319
3320	for(i = 0;i < 8; i++) {
3321	tmp = helper_fldt(ptr);
3322	ST(i) = tmp;
3323	ptr += 10;
3324	}
3325	}
3326
3327	void helper_fxsave(target_ulong ptr, int data64)
3328	{
3329	int fpus, fptag, i, nb_xmm_regs;
3330	CPU86_LDouble tmp;
3331	target_ulong addr;
3332
3333	fpus = (env->fpus & ~0x3800) \| (env->fpstt & 0x7) << 11;
3334	fptag = 0;
3335	for(i = 0; i < 8; i++) {
3336	fptag \|= (env->fptags[i] << i);
3337	}
3338	stw(ptr, env->fpuc);
3339	stw(ptr + 2, fpus);
3340	stw(ptr + 4, fptag ^ 0xff);
3341
3342	addr = ptr + 0x20;
3343	for(i = 0;i < 8; i++) {
3344	tmp = ST(i);
3345	helper_fstt(tmp, addr);
3346	addr += 16;
3347	}
3348
3349	if (env->cr[4] & CR4_OSFXSR_MASK) {
3350	/* XXX: finish it */
3351	stl(ptr + 0x18, env->mxcsr); /* mxcsr */
3352	stl(ptr + 0x1c, 0x0000ffff); /* mxcsr_mask */
3353	nb_xmm_regs = 8 << data64;
3354	addr = ptr + 0xa0;
3355	for(i = 0; i < nb_xmm_regs; i++) {
3356	stq(addr, env->xmm_regs[i].XMM_Q(0));
3357	stq(addr + 8, env->xmm_regs[i].XMM_Q(1));
3358	addr += 16;
3359	}
3360	}
3361	}
3362
3363	void helper_fxrstor(target_ulong ptr, int data64)
3364	{
3365	int i, fpus, fptag, nb_xmm_regs;
3366	CPU86_LDouble tmp;
3367	target_ulong addr;
3368
3369	env->fpuc = lduw(ptr);
3370	fpus = lduw(ptr + 2);
3371	fptag = lduw(ptr + 4);
3372	env->fpstt = (fpus >> 11) & 7;
3373	env->fpus = fpus & ~0x3800;
3374	fptag ^= 0xff;
3375	for(i = 0;i < 8; i++) {
3376	env->fptags[i] = ((fptag >> i) & 1);
3377	}
3378
3379	addr = ptr + 0x20;
3380	for(i = 0;i < 8; i++) {
3381	tmp = helper_fldt(addr);
3382	ST(i) = tmp;
3383	addr += 16;
3384	}
3385
3386	if (env->cr[4] & CR4_OSFXSR_MASK) {
3387	/* XXX: finish it, endianness */
3388	env->mxcsr = ldl(ptr + 0x18);
3389	//ldl(ptr + 0x1c);
3390	nb_xmm_regs = 8 << data64;
3391	addr = ptr + 0xa0;
3392	for(i = 0; i < nb_xmm_regs; i++) {
3393	#if !defined(VBOX) \|\| __GNUC__ < 4
3394	env->xmm_regs[i].XMM_Q(0) = ldq(addr);
3395	env->xmm_regs[i].XMM_Q(1) = ldq(addr + 8);
3396	#else /* VBOX + __GNUC__ >= 4: gcc 4.x compiler bug - it runs out of registers for the 64-bit value. */
3397	# if 1
3398	env->xmm_regs[i].XMM_L(0) = ldl(addr);
3399	env->xmm_regs[i].XMM_L(1) = ldl(addr + 4);
3400	env->xmm_regs[i].XMM_L(2) = ldl(addr + 8);
3401	env->xmm_regs[i].XMM_L(3) = ldl(addr + 12);
3402	# else
3403	/* this works fine on Mac OS X, gcc 4.0.1 */
3404	uint64_t u64 = ldq(addr);
3405	env->xmm_regs[i].XMM_Q(0);
3406	u64 = ldq(addr + 4);
3407	env->xmm_regs[i].XMM_Q(1) = u64;
3408	# endif
3409	#endif
3410	addr += 16;
3411	}
3412	}
3413	}
3414
3415	#ifndef USE_X86LDOUBLE
3416
3417	void cpu_get_fp80(uint64_t pmant, uint16_t pexp, CPU86_LDouble f)
3418	{
3419	CPU86_LDoubleU temp;
3420	int e;
3421
3422	temp.d = f;
3423	/* mantissa */
3424	*pmant = (MANTD(temp) << 11) \| (1LL << 63);
3425	/* exponent + sign */
3426	e = EXPD(temp) - EXPBIAS + 16383;
3427	e \|= SIGND(temp) >> 16;
3428	*pexp = e;
3429	}
3430
3431	CPU86_LDouble cpu_set_fp80(uint64_t mant, uint16_t upper)
3432	{
3433	CPU86_LDoubleU temp;
3434	int e;
3435	uint64_t ll;
3436
3437	/* XXX: handle overflow ? */
3438	e = (upper & 0x7fff) - 16383 + EXPBIAS; /* exponent */
3439	e \|= (upper >> 4) & 0x800; /* sign */
3440	ll = (mant >> 11) & ((1LL << 52) - 1);
3441	#ifdef __arm__
3442	temp.l.upper = (e << 20) \| (ll >> 32);
3443	temp.l.lower = ll;
3444	#else
3445	temp.ll = ll \| ((uint64_t)e << 52);
3446	#endif
3447	return temp.d;
3448	}
3449
3450	#else
3451
3452	void cpu_get_fp80(uint64_t pmant, uint16_t pexp, CPU86_LDouble f)
3453	{
3454	CPU86_LDoubleU temp;
3455
3456	temp.d = f;
3457	*pmant = temp.l.lower;
3458	*pexp = temp.l.upper;
3459	}
3460
3461	CPU86_LDouble cpu_set_fp80(uint64_t mant, uint16_t upper)
3462	{
3463	CPU86_LDoubleU temp;
3464
3465	temp.l.upper = upper;
3466	temp.l.lower = mant;
3467	return temp.d;
3468	}
3469	#endif
3470
3471	#ifdef TARGET_X86_64
3472
3473	//#define DEBUG_MULDIV
3474
3475	static void add128(uint64_t plow, uint64_t phigh, uint64_t a, uint64_t b)
3476	{
3477	*plow += a;
3478	/* carry test */
3479	if (*plow < a)
3480	(*phigh)++;
3481	*phigh += b;
3482	}
3483
3484	static void neg128(uint64_t plow, uint64_t phigh)
3485	{
3486	plow = ~ plow;
3487	phigh = ~ phigh;
3488	add128(plow, phigh, 1, 0);
3489	}
3490
3491	static void mul64(uint64_t plow, uint64_t phigh, uint64_t a, uint64_t b)
3492	{
3493	uint32_t a0, a1, b0, b1;
3494	uint64_t v;
3495
3496	a0 = a;
3497	a1 = a >> 32;
3498
3499	b0 = b;
3500	b1 = b >> 32;
3501
3502	v = (uint64_t)a0 * (uint64_t)b0;
3503	*plow = v;
3504	*phigh = 0;
3505
3506	v = (uint64_t)a0 * (uint64_t)b1;
3507	add128(plow, phigh, v << 32, v >> 32);
3508
3509	v = (uint64_t)a1 * (uint64_t)b0;
3510	add128(plow, phigh, v << 32, v >> 32);
3511
3512	v = (uint64_t)a1 * (uint64_t)b1;
3513	*phigh += v;
3514	#ifdef DEBUG_MULDIV
3515	printf("mul: 0x%016llx * 0x%016llx = 0x%016llx%016llx\n",
3516	a, b, phigh, plow);
3517	#endif
3518	}
3519
3520	static void imul64(uint64_t plow, uint64_t phigh, int64_t a, int64_t b)
3521	{
3522	int sa, sb;
3523	sa = (a < 0);
3524	if (sa)
3525	a = -a;
3526	sb = (b < 0);
3527	if (sb)
3528	b = -b;
3529	mul64(plow, phigh, a, b);
3530	if (sa ^ sb) {
3531	neg128(plow, phigh);
3532	}
3533	}
3534
3535	/* return TRUE if overflow */
3536	static int div64(uint64_t plow, uint64_t phigh, uint64_t b)
3537	{
3538	uint64_t q, r, a1, a0;
3539	int i, qb, ab;
3540
3541	a0 = *plow;
3542	a1 = *phigh;
3543	if (a1 == 0) {
3544	q = a0 / b;
3545	r = a0 % b;
3546	*plow = q;
3547	*phigh = r;
3548	} else {
3549	if (a1 >= b)
3550	return 1;
3551	/* XXX: use a better algorithm */
3552	for(i = 0; i < 64; i++) {
3553	ab = a1 >> 63;
3554	a1 = (a1 << 1) \| (a0 >> 63);
3555	if (ab \|\| a1 >= b) {
3556	a1 -= b;
3557	qb = 1;
3558	} else {
3559	qb = 0;
3560	}
3561	a0 = (a0 << 1) \| qb;
3562	}
3563	#if defined(DEBUG_MULDIV)
3564	printf("div: 0x%016llx%016llx / 0x%016llx: q=0x%016llx r=0x%016llx\n",
3565	phigh, plow, b, a0, a1);
3566	#endif
3567	*plow = a0;
3568	*phigh = a1;
3569	}
3570	return 0;
3571	}
3572
3573	/* return TRUE if overflow */
3574	static int idiv64(uint64_t plow, uint64_t phigh, int64_t b)
3575	{
3576	int sa, sb;
3577	sa = ((int64_t)*phigh < 0);
3578	if (sa)
3579	neg128(plow, phigh);
3580	sb = (b < 0);
3581	if (sb)
3582	b = -b;
3583	if (div64(plow, phigh, b) != 0)
3584	return 1;
3585	if (sa ^ sb) {
3586	if (*plow > (1ULL << 63))
3587	return 1;
3588	plow = - plow;
3589	} else {
3590	if (*plow >= (1ULL << 63))
3591	return 1;
3592	}
3593	if (sa)
3594	phigh = - phigh;
3595	return 0;
3596	}
3597
3598	void helper_mulq_EAX_T0(void)
3599	{
3600	uint64_t r0, r1;
3601
3602	mul64(&r0, &r1, EAX, T0);
3603	EAX = r0;
3604	EDX = r1;
3605	CC_DST = r0;
3606	CC_SRC = r1;
3607	}
3608
3609	void helper_imulq_EAX_T0(void)
3610	{
3611	uint64_t r0, r1;
3612
3613	imul64(&r0, &r1, EAX, T0);
3614	EAX = r0;
3615	EDX = r1;
3616	CC_DST = r0;
3617	CC_SRC = ((int64_t)r1 != ((int64_t)r0 >> 63));
3618	}
3619
3620	void helper_imulq_T0_T1(void)
3621	{
3622	uint64_t r0, r1;
3623
3624	imul64(&r0, &r1, T0, T1);
3625	T0 = r0;
3626	CC_DST = r0;
3627	CC_SRC = ((int64_t)r1 != ((int64_t)r0 >> 63));
3628	}
3629
3630	void helper_divq_EAX_T0(void)
3631	{
3632	uint64_t r0, r1;
3633	if (T0 == 0) {
3634	raise_exception(EXCP00_DIVZ);
3635	}
3636	r0 = EAX;
3637	r1 = EDX;
3638	if (div64(&r0, &r1, T0))
3639	raise_exception(EXCP00_DIVZ);
3640	EAX = r0;
3641	EDX = r1;
3642	}
3643
3644	void helper_idivq_EAX_T0(void)
3645	{
3646	uint64_t r0, r1;
3647	if (T0 == 0) {
3648	raise_exception(EXCP00_DIVZ);
3649	}
3650	r0 = EAX;
3651	r1 = EDX;
3652	if (idiv64(&r0, &r1, T0))
3653	raise_exception(EXCP00_DIVZ);
3654	EAX = r0;
3655	EDX = r1;
3656	}
3657
3658	#endif
3659
3660	/* XXX: do it */
3661	int fpu_isnan(double a)
3662	{
3663	return 0;
3664	}
3665
3666	void helper_hlt(void)
3667	{
3668	env->hflags &= ~HF_INHIBIT_IRQ_MASK; /* needed if sti is just before */
3669	env->exception_index = EXCP_HLT;
3670	cpu_loop_exit();
3671	}
3672
3673	void helper_monitor(void)
3674	{
3675	if (ECX != 0)
3676	raise_exception(EXCP0D_GPF);
3677	/* XXX: store address ? */
3678	}
3679
3680	void helper_mwait(void)
3681	{
3682	if (ECX != 0)
3683	raise_exception(EXCP0D_GPF);
3684	#ifdef VBOX
3685	helper_hlt();
3686	#else
3687	/* XXX: not complete but not completely erroneous */
3688	if (env->cpu_index != 0 \|\| env->next_cpu != NULL) {
3689	/* more than one CPU: do not sleep because another CPU may
3690	wake this one */
3691	} else {
3692	helper_hlt();
3693	}
3694	#endif
3695	}
3696
3697	float approx_rsqrt(float a)
3698	{
3699	return 1.0 / sqrt(a);
3700	}
3701
3702	float approx_rcp(float a)
3703	{
3704	return 1.0 / a;
3705	}
3706
3707	/* XXX: find a better solution */
3708	double helper_sqrt(double a)
3709	{
3710	return sqrt(a);
3711	}
3712
3713	#if !defined(CONFIG_USER_ONLY)
3714
3715	#define MMUSUFFIX _mmu
3716	#define GETPC() (__builtin_return_address(0))
3717
3718	#define SHIFT 0
3719	#include "softmmu_template.h"
3720
3721	#define SHIFT 1
3722	#include "softmmu_template.h"
3723
3724	#define SHIFT 2
3725	#include "softmmu_template.h"
3726
3727	#define SHIFT 3
3728	#include "softmmu_template.h"
3729
3730	#endif
3731
3732	/* try to fill the TLB and return an exception if error. If retaddr is
3733	NULL, it means that the function was called in C code (i.e. not
3734	from generated code or from helper.c) */
3735	/* XXX: fix it to restore all registers */
3736	void tlb_fill(target_ulong addr, int is_write, int is_user, void *retaddr)
3737	{
3738	TranslationBlock *tb;
3739	int ret;
3740	unsigned long pc;
3741	CPUX86State *saved_env;
3742
3743	/* XXX: hack to restore env in all cases, even if not called from
3744	generated code */
3745	saved_env = env;
3746	env = cpu_single_env;
3747
3748	ret = cpu_x86_handle_mmu_fault(env, addr, is_write, is_user, 1);
3749	if (ret) {
3750	if (retaddr) {
3751	/* now we have a real cpu fault */
3752	pc = (unsigned long)retaddr;
3753	tb = tb_find_pc(pc);
3754	if (tb) {
3755	/* the PC is inside the translated code. It means that we have
3756	a virtual CPU fault */
3757	cpu_restore_state(tb, env, pc, NULL);
3758	}
3759	}
3760	if (retaddr)
3761	raise_exception_err(EXCP0E_PAGE, env->error_code);
3762	else {
3763	raise_exception_err_norestore(EXCP0E_PAGE, env->error_code);
3764	}
3765	}
3766	env = saved_env;
3767	}
3768
3769	#if defined(VBOX)
3770
3771	/**
3772	* Correctly computes the eflags.
3773	* @returns eflags.
3774	* @param env1 CPU environment.
3775	*/
3776	uint32_t raw_compute_eflags(CPUX86State *env1)
3777	{
3778	CPUX86State *savedenv = env;
3779	env = env1;
3780	uint32_t efl = compute_eflags();
3781	env = savedenv;
3782	return efl;
3783	}
3784
3785	/**
3786	* Reads byte from virtual address in guest memory area.
3787	* XXX: is it working for any addresses? swapped out pages?
3788	* @returns readed data byte.
3789	* @param env1 CPU environment.
3790	* @param pvAddr GC Virtual address.
3791	*/
3792	uint8_t read_byte(CPUX86State *env1, target_ulong addr)
3793	{
3794	CPUX86State *savedenv = env;
3795	env = env1;
3796	uint8_t u8 = ldub_kernel(addr);
3797	env = savedenv;
3798	return u8;
3799	}
3800
3801	/**
3802	* Reads byte from virtual address in guest memory area.
3803	* XXX: is it working for any addresses? swapped out pages?
3804	* @returns readed data byte.
3805	* @param env1 CPU environment.
3806	* @param pvAddr GC Virtual address.
3807	*/
3808	uint16_t read_word(CPUX86State *env1, target_ulong addr)
3809	{
3810	CPUX86State *savedenv = env;
3811	env = env1;
3812	uint16_t u16 = lduw_kernel(addr);
3813	env = savedenv;
3814	return u16;
3815	}
3816
3817	/**
3818	* Reads byte from virtual address in guest memory area.
3819	* XXX: is it working for any addresses? swapped out pages?
3820	* @returns readed data byte.
3821	* @param env1 CPU environment.
3822	* @param pvAddr GC Virtual address.
3823	*/
3824	uint32_t read_dword(CPUX86State *env1, target_ulong addr)
3825	{
3826	CPUX86State *savedenv = env;
3827	env = env1;
3828	uint32_t u32 = ldl_kernel(addr);
3829	env = savedenv;
3830	return u32;
3831	}
3832
3833	/**
3834	* Writes byte to virtual address in guest memory area.
3835	* XXX: is it working for any addresses? swapped out pages?
3836	* @returns readed data byte.
3837	* @param env1 CPU environment.
3838	* @param pvAddr GC Virtual address.
3839	* @param val byte value
3840	*/
3841	void write_byte(CPUX86State *env1, target_ulong addr, uint8_t val)
3842	{
3843	CPUX86State *savedenv = env;
3844	env = env1;
3845	stb(addr, val);
3846	env = savedenv;
3847	}
3848
3849	void write_word(CPUX86State *env1, target_ulong addr, uint16_t val)
3850	{
3851	CPUX86State *savedenv = env;
3852	env = env1;
3853	stw(addr, val);
3854	env = savedenv;
3855	}
3856
3857	void write_dword(CPUX86State *env1, target_ulong addr, uint32_t val)
3858	{
3859	CPUX86State *savedenv = env;
3860	env = env1;
3861	stl(addr, val);
3862	env = savedenv;
3863	}
3864
3865	/**
3866	* Correctly loads selector into segment register with updating internal
3867	* qemu data/caches.
3868	* @param env1 CPU environment.
3869	* @param seg_reg Segment register.
3870	* @param selector Selector to load.
3871	*/
3872	void sync_seg(CPUX86State *env1, int seg_reg, int selector)
3873	{
3874	CPUX86State *savedenv = env;
3875	env = env1;
3876
3877	if (env->eflags & X86_EFL_VM)
3878	{
3879	load_seg_vm(seg_reg, selector);
3880
3881	env = savedenv;
3882
3883	/* Successful sync. */
3884	env1->segs[seg_reg].newselector = 0;
3885	}
3886	else
3887	{
3888	if (setjmp(env1->jmp_env) == 0)
3889	{
3890	if (seg_reg == R_CS)
3891	{
3892	uint32_t e1, e2;
3893	load_segment(&e1, &e2, selector);
3894	cpu_x86_load_seg_cache(env, R_CS, selector,
3895	get_seg_base(e1, e2),
3896	get_seg_limit(e1, e2),
3897	e2);
3898	}
3899	else
3900	load_seg(seg_reg, selector);
3901	env = savedenv;
3902
3903	/* Successful sync. */
3904	env1->segs[seg_reg].newselector = 0;
3905	}
3906	else
3907	{
3908	env = savedenv;
3909
3910	/* Postpone sync until the guest uses the selector. */
3911	env1->segs[seg_reg].selector = selector; /* hidden values are now incorrect, but will be resynced when this register is accessed. */
3912	env1->segs[seg_reg].newselector = selector;
3913	Log(("sync_seg: out of sync seg_reg=%d selector=%#x\n", seg_reg, selector));
3914	}
3915	}
3916
3917	}
3918
3919
3920	/**
3921	* Correctly loads a new ldtr selector.
3922	*
3923	* @param env1 CPU environment.
3924	* @param selector Selector to load.
3925	*/
3926	void sync_ldtr(CPUX86State *env1, int selector)
3927	{
3928	CPUX86State *saved_env = env;
3929	target_ulong saved_T0 = T0;
3930	if (setjmp(env1->jmp_env) == 0)
3931	{
3932	env = env1;
3933	T0 = selector;
3934	helper_lldt_T0();
3935	T0 = saved_T0;
3936	env = saved_env;
3937	}
3938	else
3939	{
3940	T0 = saved_T0;
3941	env = saved_env;
3942	#ifdef VBOX_STRICT
3943	cpu_abort(env1, "sync_ldtr: selector=%#x\n", selector);
3944	#endif
3945	}
3946	}
3947
3948	/**
3949	* Correctly loads a new tr selector.
3950	*
3951	* @param env1 CPU environment.
3952	* @param selector Selector to load.
3953	*/
3954	int sync_tr(CPUX86State *env1, int selector)
3955	{
3956	/* ARG! this was going to call helper_ltr_T0 but that won't work because of busy flag. */
3957	SegmentCache *dt;
3958	uint32_t e1, e2;
3959	int index, type, entry_limit;
3960	target_ulong ptr;
3961	CPUX86State *saved_env = env;
3962	env = env1;
3963
3964	selector &= 0xffff;
3965	if ((selector & 0xfffc) == 0) {
3966	/* NULL selector case: invalid TR */
3967	env->tr.base = 0;
3968	env->tr.limit = 0;
3969	env->tr.flags = 0;
3970	} else {
3971	if (selector & 0x4)
3972	goto l_failure;
3973	dt = &env->gdt;
3974	index = selector & ~7;
3975	#ifdef TARGET_X86_64
3976	if (env->hflags & HF_LMA_MASK)
3977	entry_limit = 15;
3978	else
3979	#endif
3980	entry_limit = 7;
3981	if ((index + entry_limit) > dt->limit)
3982	goto l_failure;
3983	ptr = dt->base + index;
3984	e1 = ldl_kernel(ptr);
3985	e2 = ldl_kernel(ptr + 4);
3986	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
3987	if ((e2 & DESC_S_MASK) /*\|\|
3988	(type != 1 && type != 9)*/)
3989	goto l_failure;
3990	if (!(e2 & DESC_P_MASK))
3991	goto l_failure;
3992	#ifdef TARGET_X86_64
3993	if (env->hflags & HF_LMA_MASK) {
3994	uint32_t e3;
3995	e3 = ldl_kernel(ptr + 8);
3996	load_seg_cache_raw_dt(&env->tr, e1, e2);
3997	env->tr.base \|= (target_ulong)e3 << 32;
3998	} else
3999	#endif
4000	{
4001	load_seg_cache_raw_dt(&env->tr, e1, e2);
4002	}
4003	e2 \|= DESC_TSS_BUSY_MASK;
4004	stl_kernel(ptr + 4, e2);
4005	}
4006	env->tr.selector = selector;
4007
4008	env = saved_env;
4009	return 0;
4010	l_failure:
4011	AssertMsgFailed(("selector=%d\n", selector));
4012	return -1;
4013	}
4014
4015	int emulate_single_instr(CPUX86State *env1)
4016	{
4017	TranslationBlock *current;
4018	TranslationBlock tb_temp;
4019	int csize;
4020	void (*gen_func)(void);
4021	uint8_t *pvCode;
4022	uint32_t old_eip;
4023
4024	/* ensures env is loaded in ebp! */
4025	CPUX86State *savedenv = env;
4026	env = env1;
4027
4028	RAWEx_ProfileStart(env, STATS_EMULATE_SINGLE_INSTR);
4029
4030	pvCode = env->pvCodeBuffer;
4031
4032	// Setup temporary translation block
4033	tb_temp.hash_next = 0;
4034	tb_temp.jmp_first = 0;
4035	tb_temp.jmp_next[0] = 0;
4036	tb_temp.jmp_next[1] = 0;
4037	tb_temp.page_addr[0] = 0;
4038	tb_temp.page_addr[1] = 0;
4039	tb_temp.page_next[0] = 0;
4040	tb_temp.page_next[1] = 0;
4041	tb_temp.hash_next = 0;
4042
4043	tb_temp.tb_next_offset[0] = 0xffff;
4044	tb_temp.tb_next_offset[1] = 0xffff;
4045
4046	tb_temp.cs_base = (unsigned long)env->segs[R_CS].base;
4047	tb_temp.pc = tb_temp.cs_base + env->eip;
4048	tb_temp.cflags = 0;
4049	tb_temp.flags = env->hflags;
4050	tb_temp.flags \|= (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
4051	tb_temp.tc_ptr = pvCode;
4052
4053	current = env->current_tb;
4054	env->current_tb = NULL;
4055
4056	// Translate only one instruction
4057	ASMAtomicOrS32(&env->state, CPU_EMULATE_SINGLE_INSTR);
4058	if (cpu_gen_code(env, &tb_temp, env->cbCodeBuffer, &csize) < 0)
4059	{
4060	AssertFailed();
4061	RAWEx_ProfileStop(env, STATS_EMULATE_SINGLE_INSTR);
4062	ASMAtomicAndS32(&env->state, ~CPU_EMULATE_SINGLE_INSTR);
4063	env = savedenv;
4064	return -1;
4065	}
4066	#ifdef DEBUG
4067	if(csize > env->cbCodeBuffer)
4068	{
4069	RAWEx_ProfileStop(env, STATS_EMULATE_SINGLE_INSTR);
4070	AssertFailed();
4071	ASMAtomicAndS32(&env->state, ~CPU_EMULATE_SINGLE_INSTR);
4072	env = savedenv;
4073	return -1;
4074	}
4075	if (tb_temp.tc_ptr != pvCode)
4076	{
4077	RAWEx_ProfileStop(env, STATS_EMULATE_SINGLE_INSTR);
4078	AssertFailed();
4079	ASMAtomicAndS32(&env->state, ~CPU_EMULATE_SINGLE_INSTR);
4080	env = savedenv;
4081	return -1;
4082	}
4083	#endif
4084	ASMAtomicAndS32(&env->state, ~CPU_EMULATE_SINGLE_INSTR);
4085
4086	tb_link(&tb_temp);
4087
4088	old_eip = env->eip;
4089	// Execute it using emulation
4090	gen_func = (void *)tb_temp.tc_ptr;
4091	env->current_tb = &tb_temp;
4092
4093	// eip remains the same for repeated instructions; no idea why qemu doesn't do a jump inside the generated code
4094	// perhaps not a very safe hack
4095	while(old_eip == env->eip)
4096	{
4097	gen_func();
4098	/*
4099	* Exit once we detect an external interrupt and interrupts are enabled
4100	*/
4101	if( (env->interrupt_request & (CPU_INTERRUPT_EXTERNAL_EXIT\|CPU_INTERRUPT_EXTERNAL_TIMER)) \|\|
4102	( (env->eflags & IF_MASK) &&
4103	!(env->hflags & HF_INHIBIT_IRQ_MASK) &&
4104	(env->interrupt_request & CPU_INTERRUPT_EXTERNAL_HARD) ) )
4105	{
4106	break;
4107	}
4108	}
4109	env->current_tb = current;
4110
4111	RAWEx_ProfileStop(env, STATS_EMULATE_SINGLE_INSTR);
4112
4113	if (env->hflags & HF_INHIBIT_IRQ_MASK)
4114	{
4115	Log(("REM: Emulating next instruction due to instruction fusing (HF_INHIBIT_IRQ_MASK)\n"));
4116	env->hflags &= ~HF_INHIBIT_IRQ_MASK;
4117	emulate_single_instr(env);
4118	}
4119
4120	env = savedenv;
4121	return 0;
4122	}
4123
4124	int get_ss_esp_from_tss_raw(CPUX86State env1, uint32_t ss_ptr,
4125	uint32_t *esp_ptr, int dpl)
4126	{
4127	int type, index, shift;
4128
4129	CPUX86State *savedenv = env;
4130	env = env1;
4131
4132	if (!(env->tr.flags & DESC_P_MASK))
4133	cpu_abort(env, "invalid tss");
4134	type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
4135	if ((type & 7) != 1)
4136	cpu_abort(env, "invalid tss type %d", type);
4137	shift = type >> 3;
4138	index = (dpl * 4 + 2) << shift;
4139	if (index + (4 << shift) - 1 > env->tr.limit)
4140	{
4141	env = savedenv;
4142	return 0;
4143	}
4144	//raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
4145
4146	if (shift == 0) {
4147	*esp_ptr = lduw_kernel(env->tr.base + index);
4148	*ss_ptr = lduw_kernel(env->tr.base + index + 2);
4149	} else {
4150	*esp_ptr = ldl_kernel(env->tr.base + index);
4151	*ss_ptr = lduw_kernel(env->tr.base + index + 4);
4152	}
4153
4154	env = savedenv;
4155	return 1;
4156	}
4157
4158	//*****************************************************************************
4159	// Needs to be at the bottom of the file (overriding macros)
4160
4161	static inline CPU86_LDouble helper_fldt_raw(uint8_t *ptr)
4162	{
4163	return (CPU86_LDouble )ptr;
4164	}
4165
4166	static inline void helper_fstt_raw(CPU86_LDouble f, uint8_t *ptr)
4167	{
4168	(CPU86_LDouble )ptr = f;
4169	}
4170
4171	#undef stw
4172	#undef stl
4173	#undef stq
4174	#define stw(a,b) (uint16_t )(a) = (uint16_t)(b)
4175	#define stl(a,b) (uint32_t )(a) = (uint32_t)(b)
4176	#define stq(a,b) (uint64_t )(a) = (uint64_t)(b)
4177	#define data64 0
4178
4179	//*****************************************************************************
4180	void restore_raw_fp_state(CPUX86State env, uint8_t ptr)
4181	{
4182	int fpus, fptag, i, nb_xmm_regs;
4183	CPU86_LDouble tmp;
4184	uint8_t *addr;
4185
4186	if (env->cpuid_features & CPUID_FXSR)
4187	{
4188	fpus = (env->fpus & ~0x3800) \| (env->fpstt & 0x7) << 11;
4189	fptag = 0;
4190	for(i = 0; i < 8; i++) {
4191	fptag \|= (env->fptags[i] << i);
4192	}
4193	stw(ptr, env->fpuc);
4194	stw(ptr + 2, fpus);
4195	stw(ptr + 4, fptag ^ 0xff);
4196
4197	addr = ptr + 0x20;
4198	for(i = 0;i < 8; i++) {
4199	tmp = ST(i);
4200	helper_fstt_raw(tmp, addr);
4201	addr += 16;
4202	}
4203
4204	if (env->cr[4] & CR4_OSFXSR_MASK) {
4205	/* XXX: finish it */
4206	stl(ptr + 0x18, env->mxcsr); /* mxcsr */
4207	stl(ptr + 0x1c, 0x0000ffff); /* mxcsr_mask */
4208	nb_xmm_regs = 8 << data64;
4209	addr = ptr + 0xa0;
4210	for(i = 0; i < nb_xmm_regs; i++) {
4211	#if __GNUC__ < 4
4212	stq(addr, env->xmm_regs[i].XMM_Q(0));
4213	stq(addr + 8, env->xmm_regs[i].XMM_Q(1));
4214	#else /* VBOX + __GNUC__ >= 4: gcc 4.x compiler bug - it runs out of registers for the 64-bit value. */
4215	stl(addr, env->xmm_regs[i].XMM_L(0));
4216	stl(addr + 4, env->xmm_regs[i].XMM_L(1));
4217	stl(addr + 8, env->xmm_regs[i].XMM_L(2));
4218	stl(addr + 12, env->xmm_regs[i].XMM_L(3));
4219	#endif
4220	addr += 16;
4221	}
4222	}
4223	}
4224	else
4225	{
4226	PX86FPUSTATE fp = (PX86FPUSTATE)ptr;
4227	int fptag;
4228
4229	fp->FCW = env->fpuc;
4230	fp->FSW = (env->fpus & ~0x3800) \| (env->fpstt & 0x7) << 11;
4231	fptag = 0;
4232	for (i=7; i>=0; i--) {
4233	fptag <<= 2;
4234	if (env->fptags[i]) {
4235	fptag \|= 3;
4236	} else {
4237	/* the FPU automatically computes it */
4238	}
4239	}
4240	fp->FTW = fptag;
4241
4242	for(i = 0;i < 8; i++) {
4243	tmp = ST(i);
4244	helper_fstt_raw(tmp, &fp->regs[i].reg[0]);
4245	}
4246	}
4247	}
4248
4249	//*****************************************************************************
4250	#undef lduw
4251	#undef ldl
4252	#undef ldq
4253	#define lduw(a) (uint16_t )(a)
4254	#define ldl(a) (uint32_t )(a)
4255	#define ldq(a) (uint64_t )(a)
4256	//*****************************************************************************
4257	void save_raw_fp_state(CPUX86State env, uint8_t ptr)
4258	{
4259	int i, fpus, fptag, nb_xmm_regs;
4260	CPU86_LDouble tmp;
4261	uint8_t *addr;
4262
4263	if (env->cpuid_features & CPUID_FXSR)
4264	{
4265	env->fpuc = lduw(ptr);
4266	fpus = lduw(ptr + 2);
4267	fptag = lduw(ptr + 4);
4268	env->fpstt = (fpus >> 11) & 7;
4269	env->fpus = fpus & ~0x3800;
4270	fptag ^= 0xff;
4271	for(i = 0;i < 8; i++) {
4272	env->fptags[i] = ((fptag >> i) & 1);
4273	}
4274
4275	addr = ptr + 0x20;
4276	for(i = 0;i < 8; i++) {
4277	tmp = helper_fldt_raw(addr);
4278	ST(i) = tmp;
4279	addr += 16;
4280	}
4281
4282	if (env->cr[4] & CR4_OSFXSR_MASK) {
4283	/* XXX: finish it, endianness */
4284	env->mxcsr = ldl(ptr + 0x18);
4285	//ldl(ptr + 0x1c);
4286	nb_xmm_regs = 8 << data64;
4287	addr = ptr + 0xa0;
4288	for(i = 0; i < nb_xmm_regs; i++) {
4289	env->xmm_regs[i].XMM_Q(0) = ldq(addr);
4290	env->xmm_regs[i].XMM_Q(1) = ldq(addr + 8);
4291	addr += 16;
4292	}
4293	}
4294	}
4295	else
4296	{
4297	PX86FPUSTATE fp = (PX86FPUSTATE)ptr;
4298	int fptag, j;
4299
4300	env->fpuc = fp->FCW;
4301	env->fpstt = (fp->FSW >> 11) & 7;
4302	env->fpus = fp->FSW & ~0x3800;
4303	fptag = fp->FTW;
4304	for(i = 0;i < 8; i++) {
4305	env->fptags[i] = ((fptag & 3) == 3);
4306	fptag >>= 2;
4307	}
4308	j = env->fpstt;
4309	for(i = 0;i < 8; i++) {
4310	tmp = helper_fldt_raw(&fp->regs[i].reg[0]);
4311	ST(i) = tmp;
4312	}
4313	}
4314	}
4315	//*****************************************************************************
4316	//*****************************************************************************
4317
4318	#endif /* VBOX */
4319

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/recompiler/target-i386/helper.c@ 1516

Download in other formats: