helper.c@ 5853

Last change on this file since 5853 was 5853, checked in by vboxsync, 17 years ago
The static tb isn't working right in single stepping mode. (fix not enabled)
Property svn:eol-style set to `native`
File size: 134.1 KB

Line
1	/*
2	* i386 helpers
3	*
4	* Copyright (c) 2003 Fabrice Bellard
5	*
6	* This library is free software; you can redistribute it and/or
7	* modify it under the terms of the GNU Lesser General Public
8	* License as published by the Free Software Foundation; either
9	* version 2 of the License, or (at your option) any later version.
10	*
11	* This library is distributed in the hope that it will be useful,
12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14	* Lesser General Public License for more details.
15	*
16	* You should have received a copy of the GNU Lesser General Public
17	* License along with this library; if not, write to the Free Software
18	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
19	*/
20	#ifdef VBOX
21	# include <VBox/err.h>
22	#endif
23	#include "exec.h"
24
25	//#define DEBUG_PCALL
26
27	#if 0
28	#define raise_exception_err(a, b)\
29	do {\
30	if (logfile)\
31	fprintf(logfile, "raise_exception line=%d\n", __LINE__);\
32	(raise_exception_err)(a, b);\
33	} while (0)
34	#endif
35
36	const uint8_t parity_table[256] = {
37	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
38	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
39	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
40	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
41	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
42	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
43	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
44	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
45	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
46	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
47	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
48	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
49	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
50	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
51	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
52	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
53	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
54	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
55	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
56	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
57	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
58	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
59	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
60	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
61	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
62	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
63	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
64	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
65	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
66	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
67	CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
68	0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
69	};
70
71	/* modulo 17 table */
72	const uint8_t rclw_table[32] = {
73	0, 1, 2, 3, 4, 5, 6, 7,
74	8, 9,10,11,12,13,14,15,
75	16, 0, 1, 2, 3, 4, 5, 6,
76	7, 8, 9,10,11,12,13,14,
77	};
78
79	/* modulo 9 table */
80	const uint8_t rclb_table[32] = {
81	0, 1, 2, 3, 4, 5, 6, 7,
82	8, 0, 1, 2, 3, 4, 5, 6,
83	7, 8, 0, 1, 2, 3, 4, 5,
84	6, 7, 8, 0, 1, 2, 3, 4,
85	};
86
87	const CPU86_LDouble f15rk[7] =
88	{
89	0.00000000000000000000L,
90	1.00000000000000000000L,
91	3.14159265358979323851L, /pi/
92	0.30102999566398119523L, /lg2/
93	0.69314718055994530943L, /ln2/
94	1.44269504088896340739L, /l2e/
95	3.32192809488736234781L, /l2t/
96	};
97
98	/* thread support */
99
100	spinlock_t global_cpu_lock = SPIN_LOCK_UNLOCKED;
101
102	void cpu_lock(void)
103	{
104	spin_lock(&global_cpu_lock);
105	}
106
107	void cpu_unlock(void)
108	{
109	spin_unlock(&global_cpu_lock);
110	}
111
112	void cpu_loop_exit(void)
113	{
114	/* NOTE: the register at this point must be saved by hand because
115	longjmp restore them */
116	regs_to_env();
117	longjmp(env->jmp_env, 1);
118	}
119
120	/* return non zero if error */
121	static inline int load_segment(uint32_t e1_ptr, uint32_t e2_ptr,
122	int selector)
123	{
124	SegmentCache *dt;
125	int index;
126	target_ulong ptr;
127
128	if (selector & 0x4)
129	dt = &env->ldt;
130	else
131	dt = &env->gdt;
132	index = selector & ~7;
133	if ((index + 7) > dt->limit)
134	return -1;
135	ptr = dt->base + index;
136	*e1_ptr = ldl_kernel(ptr);
137	*e2_ptr = ldl_kernel(ptr + 4);
138	return 0;
139	}
140
141	static inline unsigned int get_seg_limit(uint32_t e1, uint32_t e2)
142	{
143	unsigned int limit;
144	limit = (e1 & 0xffff) \| (e2 & 0x000f0000);
145	if (e2 & DESC_G_MASK)
146	limit = (limit << 12) \| 0xfff;
147	return limit;
148	}
149
150	static inline uint32_t get_seg_base(uint32_t e1, uint32_t e2)
151	{
152	return ((e1 >> 16) \| ((e2 & 0xff) << 16) \| (e2 & 0xff000000));
153	}
154
155	static inline void load_seg_cache_raw_dt(SegmentCache *sc, uint32_t e1, uint32_t e2)
156	{
157	sc->base = get_seg_base(e1, e2);
158	sc->limit = get_seg_limit(e1, e2);
159	sc->flags = e2;
160	}
161
162	/* init the segment cache in vm86 mode. */
163	static inline void load_seg_vm(int seg, int selector)
164	{
165	selector &= 0xffff;
166	cpu_x86_load_seg_cache(env, seg, selector,
167	(selector << 4), 0xffff, 0);
168	}
169
170	static inline void get_ss_esp_from_tss(uint32_t *ss_ptr,
171	uint32_t *esp_ptr, int dpl)
172	{
173	int type, index, shift;
174
175	#if 0
176	{
177	int i;
178	printf("TR: base=%p limit=%x\n", env->tr.base, env->tr.limit);
179	for(i=0;i<env->tr.limit;i++) {
180	printf("%02x ", env->tr.base[i]);
181	if ((i & 7) == 7) printf("\n");
182	}
183	printf("\n");
184	}
185	#endif
186
187	if (!(env->tr.flags & DESC_P_MASK))
188	cpu_abort(env, "invalid tss");
189	type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
190	if ((type & 7) != 1)
191	cpu_abort(env, "invalid tss type %d", type);
192	shift = type >> 3;
193	index = (dpl * 4 + 2) << shift;
194	if (index + (4 << shift) - 1 > env->tr.limit)
195	raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
196	if (shift == 0) {
197	*esp_ptr = lduw_kernel(env->tr.base + index);
198	*ss_ptr = lduw_kernel(env->tr.base + index + 2);
199	} else {
200	*esp_ptr = ldl_kernel(env->tr.base + index);
201	*ss_ptr = lduw_kernel(env->tr.base + index + 4);
202	}
203	}
204
205	/* XXX: merge with load_seg() */
206	static void tss_load_seg(int seg_reg, int selector)
207	{
208	uint32_t e1, e2;
209	int rpl, dpl, cpl;
210
211	if ((selector & 0xfffc) != 0) {
212	if (load_segment(&e1, &e2, selector) != 0)
213	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
214	if (!(e2 & DESC_S_MASK))
215	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
216	rpl = selector & 3;
217	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
218	cpl = env->hflags & HF_CPL_MASK;
219	if (seg_reg == R_CS) {
220	if (!(e2 & DESC_CS_MASK))
221	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
222	/* XXX: is it correct ? */
223	if (dpl != rpl)
224	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
225	if ((e2 & DESC_C_MASK) && dpl > rpl)
226	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
227	} else if (seg_reg == R_SS) {
228	/* SS must be writable data */
229	if ((e2 & DESC_CS_MASK) \|\| !(e2 & DESC_W_MASK))
230	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
231	if (dpl != cpl \|\| dpl != rpl)
232	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
233	} else {
234	/* not readable code */
235	if ((e2 & DESC_CS_MASK) && !(e2 & DESC_R_MASK))
236	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
237	/* if data or non conforming code, checks the rights */
238	if (((e2 >> DESC_TYPE_SHIFT) & 0xf) < 12) {
239	if (dpl < cpl \|\| dpl < rpl)
240	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
241	}
242	}
243	if (!(e2 & DESC_P_MASK))
244	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
245	cpu_x86_load_seg_cache(env, seg_reg, selector,
246	get_seg_base(e1, e2),
247	get_seg_limit(e1, e2),
248	e2);
249	} else {
250	if (seg_reg == R_SS \|\| seg_reg == R_CS)
251	raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
252	}
253	}
254
255	#define SWITCH_TSS_JMP 0
256	#define SWITCH_TSS_IRET 1
257	#define SWITCH_TSS_CALL 2
258
259	/* XXX: restore CPU state in registers (PowerPC case) */
260	static void switch_tss(int tss_selector,
261	uint32_t e1, uint32_t e2, int source,
262	uint32_t next_eip)
263	{
264	int tss_limit, tss_limit_max, type, old_tss_limit_max, old_type, v1, v2, i;
265	target_ulong tss_base;
266	uint32_t new_regs[8], new_segs[6];
267	uint32_t new_eflags, new_eip, new_cr3, new_ldt, new_trap;
268	uint32_t old_eflags, eflags_mask;
269	SegmentCache *dt;
270	int index;
271	target_ulong ptr;
272
273	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
274	#ifdef DEBUG_PCALL
275	if (loglevel & CPU_LOG_PCALL)
276	fprintf(logfile, "switch_tss: sel=0x%04x type=%d src=%d\n", tss_selector, type, source);
277	#endif
278
279	#if defined(VBOX) && defined(DEBUG)
280	printf("switch_tss %x %x %x %d %08x\n", tss_selector, e1, e2, source, next_eip);
281	#endif
282
283	/* if task gate, we read the TSS segment and we load it */
284	if (type == 5) {
285	if (!(e2 & DESC_P_MASK))
286	raise_exception_err(EXCP0B_NOSEG, tss_selector & 0xfffc);
287	tss_selector = e1 >> 16;
288	if (tss_selector & 4)
289	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
290	if (load_segment(&e1, &e2, tss_selector) != 0)
291	raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
292	if (e2 & DESC_S_MASK)
293	raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
294	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
295	if ((type & 7) != 1)
296	raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
297	}
298
299	if (!(e2 & DESC_P_MASK))
300	raise_exception_err(EXCP0B_NOSEG, tss_selector & 0xfffc);
301
302	if (type & 8)
303	tss_limit_max = 103;
304	else
305	tss_limit_max = 43;
306	tss_limit = get_seg_limit(e1, e2);
307	tss_base = get_seg_base(e1, e2);
308	if ((tss_selector & 4) != 0 \|\|
309	tss_limit < tss_limit_max)
310	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
311	old_type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
312	if (old_type & 8)
313	old_tss_limit_max = 103;
314	else
315	old_tss_limit_max = 43;
316
317	/* read all the registers from the new TSS */
318	if (type & 8) {
319	/* 32 bit */
320	new_cr3 = ldl_kernel(tss_base + 0x1c);
321	new_eip = ldl_kernel(tss_base + 0x20);
322	new_eflags = ldl_kernel(tss_base + 0x24);
323	for(i = 0; i < 8; i++)
324	new_regs[i] = ldl_kernel(tss_base + (0x28 + i * 4));
325	for(i = 0; i < 6; i++)
326	new_segs[i] = lduw_kernel(tss_base + (0x48 + i * 4));
327	new_ldt = lduw_kernel(tss_base + 0x60);
328	new_trap = ldl_kernel(tss_base + 0x64);
329	} else {
330	/* 16 bit */
331	new_cr3 = 0;
332	new_eip = lduw_kernel(tss_base + 0x0e);
333	new_eflags = lduw_kernel(tss_base + 0x10);
334	for(i = 0; i < 8; i++)
335	new_regs[i] = lduw_kernel(tss_base + (0x12 + i * 2)) \| 0xffff0000;
336	for(i = 0; i < 4; i++)
337	new_segs[i] = lduw_kernel(tss_base + (0x22 + i * 4));
338	new_ldt = lduw_kernel(tss_base + 0x2a);
339	new_segs[R_FS] = 0;
340	new_segs[R_GS] = 0;
341	new_trap = 0;
342	}
343
344	/* NOTE: we must avoid memory exceptions during the task switch,
345	so we make dummy accesses before */
346	/* XXX: it can still fail in some cases, so a bigger hack is
347	necessary to valid the TLB after having done the accesses */
348
349	v1 = ldub_kernel(env->tr.base);
350	v2 = ldub_kernel(env->tr.base + old_tss_limit_max);
351	stb_kernel(env->tr.base, v1);
352	stb_kernel(env->tr.base + old_tss_limit_max, v2);
353
354	/* clear busy bit (it is restartable) */
355	if (source == SWITCH_TSS_JMP \|\| source == SWITCH_TSS_IRET) {
356	target_ulong ptr;
357	uint32_t e2;
358	ptr = env->gdt.base + (env->tr.selector & ~7);
359	e2 = ldl_kernel(ptr + 4);
360	e2 &= ~DESC_TSS_BUSY_MASK;
361	stl_kernel(ptr + 4, e2);
362	}
363	old_eflags = compute_eflags();
364	if (source == SWITCH_TSS_IRET)
365	old_eflags &= ~NT_MASK;
366
367	/* save the current state in the old TSS */
368	if (type & 8) {
369	/* 32 bit */
370	stl_kernel(env->tr.base + 0x20, next_eip);
371	stl_kernel(env->tr.base + 0x24, old_eflags);
372	stl_kernel(env->tr.base + (0x28 + 0 * 4), EAX);
373	stl_kernel(env->tr.base + (0x28 + 1 * 4), ECX);
374	stl_kernel(env->tr.base + (0x28 + 2 * 4), EDX);
375	stl_kernel(env->tr.base + (0x28 + 3 * 4), EBX);
376	stl_kernel(env->tr.base + (0x28 + 4 * 4), ESP);
377	stl_kernel(env->tr.base + (0x28 + 5 * 4), EBP);
378	stl_kernel(env->tr.base + (0x28 + 6 * 4), ESI);
379	stl_kernel(env->tr.base + (0x28 + 7 * 4), EDI);
380	for(i = 0; i < 6; i++)
381	stw_kernel(env->tr.base + (0x48 + i * 4), env->segs[i].selector);
382	#if defined(VBOX) && defined(DEBUG)
383	printf("TSS 32 bits switch\n");
384	printf("Saving CS=%08X\n", env->segs[R_CS].selector);
385	#endif
386	} else {
387	/* 16 bit */
388	stw_kernel(env->tr.base + 0x0e, next_eip);
389	stw_kernel(env->tr.base + 0x10, old_eflags);
390	stw_kernel(env->tr.base + (0x12 + 0 * 2), EAX);
391	stw_kernel(env->tr.base + (0x12 + 1 * 2), ECX);
392	stw_kernel(env->tr.base + (0x12 + 2 * 2), EDX);
393	stw_kernel(env->tr.base + (0x12 + 3 * 2), EBX);
394	stw_kernel(env->tr.base + (0x12 + 4 * 2), ESP);
395	stw_kernel(env->tr.base + (0x12 + 5 * 2), EBP);
396	stw_kernel(env->tr.base + (0x12 + 6 * 2), ESI);
397	stw_kernel(env->tr.base + (0x12 + 7 * 2), EDI);
398	for(i = 0; i < 4; i++)
399	stw_kernel(env->tr.base + (0x22 + i * 4), env->segs[i].selector);
400	}
401
402	/* now if an exception occurs, it will occurs in the next task
403	context */
404
405	if (source == SWITCH_TSS_CALL) {
406	stw_kernel(tss_base, env->tr.selector);
407	new_eflags \|= NT_MASK;
408	}
409
410	/* set busy bit */
411	if (source == SWITCH_TSS_JMP \|\| source == SWITCH_TSS_CALL) {
412	target_ulong ptr;
413	uint32_t e2;
414	ptr = env->gdt.base + (tss_selector & ~7);
415	e2 = ldl_kernel(ptr + 4);
416	e2 \|= DESC_TSS_BUSY_MASK;
417	stl_kernel(ptr + 4, e2);
418	}
419
420	/* set the new CPU state */
421	/* from this point, any exception which occurs can give problems */
422	env->cr[0] \|= CR0_TS_MASK;
423	env->hflags \|= HF_TS_MASK;
424	env->tr.selector = tss_selector;
425	env->tr.base = tss_base;
426	env->tr.limit = tss_limit;
427	env->tr.flags = e2 & ~DESC_TSS_BUSY_MASK;
428
429	if ((type & 8) && (env->cr[0] & CR0_PG_MASK)) {
430	cpu_x86_update_cr3(env, new_cr3);
431	}
432
433	/* load all registers without an exception, then reload them with
434	possible exception */
435	env->eip = new_eip;
436	eflags_mask = TF_MASK \| AC_MASK \| ID_MASK \|
437	IF_MASK \| IOPL_MASK \| VM_MASK \| RF_MASK \| NT_MASK;
438	if (!(type & 8))
439	eflags_mask &= 0xffff;
440	load_eflags(new_eflags, eflags_mask);
441	/* XXX: what to do in 16 bit case ? */
442	EAX = new_regs[0];
443	ECX = new_regs[1];
444	EDX = new_regs[2];
445	EBX = new_regs[3];
446	ESP = new_regs[4];
447	EBP = new_regs[5];
448	ESI = new_regs[6];
449	EDI = new_regs[7];
450	if (new_eflags & VM_MASK) {
451	for(i = 0; i < 6; i++)
452	load_seg_vm(i, new_segs[i]);
453	/* in vm86, CPL is always 3 */
454	cpu_x86_set_cpl(env, 3);
455	} else {
456	/* CPL is set the RPL of CS */
457	cpu_x86_set_cpl(env, new_segs[R_CS] & 3);
458	/* first just selectors as the rest may trigger exceptions */
459	for(i = 0; i < 6; i++)
460	cpu_x86_load_seg_cache(env, i, new_segs[i], 0, 0, 0);
461	}
462
463	env->ldt.selector = new_ldt & ~4;
464	env->ldt.base = 0;
465	env->ldt.limit = 0;
466	env->ldt.flags = 0;
467
468	/* load the LDT */
469	if (new_ldt & 4)
470	raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
471
472	if ((new_ldt & 0xfffc) != 0) {
473	dt = &env->gdt;
474	index = new_ldt & ~7;
475	if ((index + 7) > dt->limit)
476	raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
477	ptr = dt->base + index;
478	e1 = ldl_kernel(ptr);
479	e2 = ldl_kernel(ptr + 4);
480	if ((e2 & DESC_S_MASK) \|\| ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2)
481	raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
482	if (!(e2 & DESC_P_MASK))
483	raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
484	load_seg_cache_raw_dt(&env->ldt, e1, e2);
485	}
486
487	/* load the segments */
488	if (!(new_eflags & VM_MASK)) {
489	tss_load_seg(R_CS, new_segs[R_CS]);
490	tss_load_seg(R_SS, new_segs[R_SS]);
491	tss_load_seg(R_ES, new_segs[R_ES]);
492	tss_load_seg(R_DS, new_segs[R_DS]);
493	tss_load_seg(R_FS, new_segs[R_FS]);
494	tss_load_seg(R_GS, new_segs[R_GS]);
495	}
496
497	/* check that EIP is in the CS segment limits */
498	if (new_eip > env->segs[R_CS].limit) {
499	/* XXX: different exception if CALL ? */
500	raise_exception_err(EXCP0D_GPF, 0);
501	}
502	}
503
504	/* check if Port I/O is allowed in TSS */
505	static inline void check_io(int addr, int size)
506	{
507	int io_offset, val, mask;
508
509	/* TSS must be a valid 32 bit one */
510	if (!(env->tr.flags & DESC_P_MASK) \|\|
511	((env->tr.flags >> DESC_TYPE_SHIFT) & 0xf) != 9 \|\|
512	env->tr.limit < 103)
513	goto fail;
514	io_offset = lduw_kernel(env->tr.base + 0x66);
515	io_offset += (addr >> 3);
516	/* Note: the check needs two bytes */
517	if ((io_offset + 1) > env->tr.limit)
518	goto fail;
519	val = lduw_kernel(env->tr.base + io_offset);
520	val >>= (addr & 7);
521	mask = (1 << size) - 1;
522	/* all bits must be zero to allow the I/O */
523	if ((val & mask) != 0) {
524	fail:
525	raise_exception_err(EXCP0D_GPF, 0);
526	}
527	}
528
529	void check_iob_T0(void)
530	{
531	check_io(T0, 1);
532	}
533
534	void check_iow_T0(void)
535	{
536	check_io(T0, 2);
537	}
538
539	void check_iol_T0(void)
540	{
541	check_io(T0, 4);
542	}
543
544	void check_iob_DX(void)
545	{
546	check_io(EDX & 0xffff, 1);
547	}
548
549	void check_iow_DX(void)
550	{
551	check_io(EDX & 0xffff, 2);
552	}
553
554	void check_iol_DX(void)
555	{
556	check_io(EDX & 0xffff, 4);
557	}
558
559	static inline unsigned int get_sp_mask(unsigned int e2)
560	{
561	if (e2 & DESC_B_MASK)
562	return 0xffffffff;
563	else
564	return 0xffff;
565	}
566
567	#ifdef TARGET_X86_64
568	#define SET_ESP(val, sp_mask)\
569	do {\
570	if ((sp_mask) == 0xffff)\
571	ESP = (ESP & ~0xffff) \| ((val) & 0xffff);\
572	else if ((sp_mask) == 0xffffffffLL)\
573	ESP = (uint32_t)(val);\
574	else\
575	ESP = (val);\
576	} while (0)
577	#else
578	#define SET_ESP(val, sp_mask) ESP = (ESP & ~(sp_mask)) \| ((val) & (sp_mask))
579	#endif
580
581	/* XXX: add a is_user flag to have proper security support */
582	#define PUSHW(ssp, sp, sp_mask, val)\
583	{\
584	sp -= 2;\
585	stw_kernel((ssp) + (sp & (sp_mask)), (val));\
586	}
587
588	#define PUSHL(ssp, sp, sp_mask, val)\
589	{\
590	sp -= 4;\
591	stl_kernel((ssp) + (sp & (sp_mask)), (val));\
592	}
593
594	#define POPW(ssp, sp, sp_mask, val)\
595	{\
596	val = lduw_kernel((ssp) + (sp & (sp_mask)));\
597	sp += 2;\
598	}
599
600	#define POPL(ssp, sp, sp_mask, val)\
601	{\
602	val = (uint32_t)ldl_kernel((ssp) + (sp & (sp_mask)));\
603	sp += 4;\
604	}
605
606	/* protected mode interrupt */
607	static void do_interrupt_protected(int intno, int is_int, int error_code,
608	unsigned int next_eip, int is_hw)
609	{
610	SegmentCache *dt;
611	target_ulong ptr, ssp;
612	int type, dpl, selector, ss_dpl, cpl;
613	int has_error_code, new_stack, shift;
614	uint32_t e1, e2, offset, ss, esp, ss_e1, ss_e2;
615	uint32_t old_eip, sp_mask;
616
617	#ifdef VBOX
618	if (remR3NotifyTrap(env, intno, error_code, next_eip) != VINF_SUCCESS)
619	cpu_loop_exit();
620	#endif
621
622	has_error_code = 0;
623	if (!is_int && !is_hw) {
624	switch(intno) {
625	case 8:
626	case 10:
627	case 11:
628	case 12:
629	case 13:
630	case 14:
631	case 17:
632	has_error_code = 1;
633	break;
634	}
635	}
636	if (is_int)
637	old_eip = next_eip;
638	else
639	old_eip = env->eip;
640
641	dt = &env->idt;
642	if (intno * 8 + 7 > dt->limit)
643	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
644	ptr = dt->base + intno * 8;
645	e1 = ldl_kernel(ptr);
646	e2 = ldl_kernel(ptr + 4);
647	/* check gate type */
648	type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
649	switch(type) {
650	case 5: /* task gate */
651	/* must do that check here to return the correct error code */
652	if (!(e2 & DESC_P_MASK))
653	raise_exception_err(EXCP0B_NOSEG, intno * 8 + 2);
654	switch_tss(intno * 8, e1, e2, SWITCH_TSS_CALL, old_eip);
655	if (has_error_code) {
656	int type;
657	uint32_t mask;
658	/* push the error code */
659	type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
660	shift = type >> 3;
661	if (env->segs[R_SS].flags & DESC_B_MASK)
662	mask = 0xffffffff;
663	else
664	mask = 0xffff;
665	esp = (ESP - (2 << shift)) & mask;
666	ssp = env->segs[R_SS].base + esp;
667	if (shift)
668	stl_kernel(ssp, error_code);
669	else
670	stw_kernel(ssp, error_code);
671	SET_ESP(esp, mask);
672	}
673	return;
674	case 6: /* 286 interrupt gate */
675	case 7: /* 286 trap gate */
676	case 14: /* 386 interrupt gate */
677	case 15: /* 386 trap gate */
678	break;
679	default:
680	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
681	break;
682	}
683	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
684	cpl = env->hflags & HF_CPL_MASK;
685	/* check privledge if software int */
686	if (is_int && dpl < cpl)
687	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
688	/* check valid bit */
689	if (!(e2 & DESC_P_MASK))
690	raise_exception_err(EXCP0B_NOSEG, intno * 8 + 2);
691	selector = e1 >> 16;
692	offset = (e2 & 0xffff0000) \| (e1 & 0x0000ffff);
693	if ((selector & 0xfffc) == 0)
694	raise_exception_err(EXCP0D_GPF, 0);
695
696	if (load_segment(&e1, &e2, selector) != 0)
697	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
698	if (!(e2 & DESC_S_MASK) \|\| !(e2 & (DESC_CS_MASK)))
699	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
700	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
701	if (dpl > cpl)
702	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
703	if (!(e2 & DESC_P_MASK))
704	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
705	if (!(e2 & DESC_C_MASK) && dpl < cpl) {
706	/* to inner priviledge */
707	get_ss_esp_from_tss(&ss, &esp, dpl);
708	if ((ss & 0xfffc) == 0)
709	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
710	if ((ss & 3) != dpl)
711	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
712	if (load_segment(&ss_e1, &ss_e2, ss) != 0)
713	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
714	ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
715	if (ss_dpl != dpl)
716	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
717	if (!(ss_e2 & DESC_S_MASK) \|\|
718	(ss_e2 & DESC_CS_MASK) \|\|
719	!(ss_e2 & DESC_W_MASK))
720	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
721	if (!(ss_e2 & DESC_P_MASK))
722	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
723	new_stack = 1;
724	sp_mask = get_sp_mask(ss_e2);
725	ssp = get_seg_base(ss_e1, ss_e2);
726	#if defined(VBOX) && defined(DEBUG)
727	printf("new stack %04X:%08X gate dpl=%d\n", ss, esp, dpl);
728	#endif
729	} else if ((e2 & DESC_C_MASK) \|\| dpl == cpl) {
730	/* to same priviledge */
731	if (env->eflags & VM_MASK)
732	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
733	new_stack = 0;
734	sp_mask = get_sp_mask(env->segs[R_SS].flags);
735	ssp = env->segs[R_SS].base;
736	esp = ESP;
737	dpl = cpl;
738	} else {
739	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
740	new_stack = 0; /* avoid warning */
741	sp_mask = 0; /* avoid warning */
742	ssp = 0; /* avoid warning */
743	esp = 0; /* avoid warning */
744	}
745
746	shift = type >> 3;
747
748	#if 0
749	/* XXX: check that enough room is available */
750	push_size = 6 + (new_stack << 2) + (has_error_code << 1);
751	if (env->eflags & VM_MASK)
752	push_size += 8;
753	push_size <<= shift;
754	#endif
755	if (shift == 1) {
756	if (new_stack) {
757	if (env->eflags & VM_MASK) {
758	PUSHL(ssp, esp, sp_mask, env->segs[R_GS].selector);
759	PUSHL(ssp, esp, sp_mask, env->segs[R_FS].selector);
760	PUSHL(ssp, esp, sp_mask, env->segs[R_DS].selector);
761	PUSHL(ssp, esp, sp_mask, env->segs[R_ES].selector);
762	}
763	PUSHL(ssp, esp, sp_mask, env->segs[R_SS].selector);
764	PUSHL(ssp, esp, sp_mask, ESP);
765	}
766	PUSHL(ssp, esp, sp_mask, compute_eflags());
767	PUSHL(ssp, esp, sp_mask, env->segs[R_CS].selector);
768	PUSHL(ssp, esp, sp_mask, old_eip);
769	if (has_error_code) {
770	PUSHL(ssp, esp, sp_mask, error_code);
771	}
772	} else {
773	if (new_stack) {
774	if (env->eflags & VM_MASK) {
775	PUSHW(ssp, esp, sp_mask, env->segs[R_GS].selector);
776	PUSHW(ssp, esp, sp_mask, env->segs[R_FS].selector);
777	PUSHW(ssp, esp, sp_mask, env->segs[R_DS].selector);
778	PUSHW(ssp, esp, sp_mask, env->segs[R_ES].selector);
779	}
780	PUSHW(ssp, esp, sp_mask, env->segs[R_SS].selector);
781	PUSHW(ssp, esp, sp_mask, ESP);
782	}
783	PUSHW(ssp, esp, sp_mask, compute_eflags());
784	PUSHW(ssp, esp, sp_mask, env->segs[R_CS].selector);
785	PUSHW(ssp, esp, sp_mask, old_eip);
786	if (has_error_code) {
787	PUSHW(ssp, esp, sp_mask, error_code);
788	}
789	}
790
791	if (new_stack) {
792	if (env->eflags & VM_MASK) {
793	cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0, 0);
794	cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0, 0);
795	cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0, 0);
796	cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0, 0);
797	}
798	ss = (ss & ~3) \| dpl;
799	cpu_x86_load_seg_cache(env, R_SS, ss,
800	ssp, get_seg_limit(ss_e1, ss_e2), ss_e2);
801	}
802	SET_ESP(esp, sp_mask);
803
804	selector = (selector & ~3) \| dpl;
805	cpu_x86_load_seg_cache(env, R_CS, selector,
806	get_seg_base(e1, e2),
807	get_seg_limit(e1, e2),
808	e2);
809	cpu_x86_set_cpl(env, dpl);
810	env->eip = offset;
811
812	/* interrupt gate clear IF mask */
813	if ((type & 1) == 0) {
814	env->eflags &= ~IF_MASK;
815	}
816	env->eflags &= ~(TF_MASK \| VM_MASK \| RF_MASK \| NT_MASK);
817	}
818
819	#ifdef VBOX
820
821	/* check if VME interrupt redirection is enabled in TSS */
822	static inline bool is_vme_irq_redirected(int intno)
823	{
824	int io_offset, intredir_offset;
825	unsigned char val, mask;
826
827	/* TSS must be a valid 32 bit one */
828	if (!(env->tr.flags & DESC_P_MASK) \|\|
829	((env->tr.flags >> DESC_TYPE_SHIFT) & 0xf) != 9 \|\|
830	env->tr.limit < 103)
831	goto fail;
832	io_offset = lduw_kernel(env->tr.base + 0x66);
833	/* the virtual interrupt redirection bitmap is located below the io bitmap */
834	intredir_offset = io_offset - 0x20;
835
836	intredir_offset += (intno >> 3);
837	if ((intredir_offset) > env->tr.limit)
838	goto fail;
839
840	val = ldub_kernel(env->tr.base + intredir_offset);
841	mask = 1 << (unsigned char)(intno & 7);
842
843	/* bit set means no redirection. */
844	if ((val & mask) != 0) {
845	return false;
846	}
847	return true;
848
849	fail:
850	raise_exception_err(EXCP0D_GPF, 0);
851	return true;
852	}
853
854	/* V86 mode software interrupt with CR4.VME=1 */
855	static void do_soft_interrupt_vme(int intno, int error_code, unsigned int next_eip)
856	{
857	target_ulong ptr, ssp;
858	int selector;
859	uint32_t offset, esp;
860	uint32_t old_cs, old_eflags;
861	uint32_t iopl;
862
863	iopl = ((env->eflags >> IOPL_SHIFT) & 3);
864
865	if (!is_vme_irq_redirected(intno))
866	{
867	if (iopl == 3)
868	/* normal protected mode handler call */
869	return do_interrupt_protected(intno, 1, error_code, next_eip, 0);
870	else
871	raise_exception_err(EXCP0D_GPF, 0);
872	}
873
874	/* virtual mode idt is at linear address 0 */
875	ptr = 0 + intno * 4;
876	offset = lduw_kernel(ptr);
877	selector = lduw_kernel(ptr + 2);
878	esp = ESP;
879	ssp = env->segs[R_SS].base;
880	old_cs = env->segs[R_CS].selector;
881
882	old_eflags = compute_eflags();
883	if (iopl < 3)
884	{
885	/* copy VIF into IF and set IOPL to 3 */
886	if (env->eflags & VIF_MASK)
887	old_eflags \|= IF_MASK;
888	else
889	old_eflags &= ~IF_MASK;
890
891	old_eflags \|= (3 << IOPL_SHIFT);
892	}
893
894	/* XXX: use SS segment size ? */
895	PUSHW(ssp, esp, 0xffff, old_eflags);
896	PUSHW(ssp, esp, 0xffff, old_cs);
897	PUSHW(ssp, esp, 0xffff, next_eip);
898
899	/* update processor state */
900	ESP = (ESP & ~0xffff) \| (esp & 0xffff);
901	env->eip = offset;
902	env->segs[R_CS].selector = selector;
903	env->segs[R_CS].base = (selector << 4);
904	env->eflags &= ~(TF_MASK \| RF_MASK);
905
906	if (iopl < 3)
907	env->eflags &= ~VIF_MASK;
908	else
909	env->eflags &= ~IF_MASK;
910	}
911	#endif /* VBOX */
912
913	#ifdef TARGET_X86_64
914
915	#define PUSHQ(sp, val)\
916	{\
917	sp -= 8;\
918	stq_kernel(sp, (val));\
919	}
920
921	#define POPQ(sp, val)\
922	{\
923	val = ldq_kernel(sp);\
924	sp += 8;\
925	}
926
927	static inline target_ulong get_rsp_from_tss(int level)
928	{
929	int index;
930
931	#if 0
932	printf("TR: base=" TARGET_FMT_lx " limit=%x\n",
933	env->tr.base, env->tr.limit);
934	#endif
935
936	if (!(env->tr.flags & DESC_P_MASK))
937	cpu_abort(env, "invalid tss");
938	index = 8 * level + 4;
939	if ((index + 7) > env->tr.limit)
940	raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
941	return ldq_kernel(env->tr.base + index);
942	}
943
944	/* 64 bit interrupt */
945	static void do_interrupt64(int intno, int is_int, int error_code,
946	target_ulong next_eip, int is_hw)
947	{
948	SegmentCache *dt;
949	target_ulong ptr;
950	int type, dpl, selector, cpl, ist;
951	int has_error_code, new_stack;
952	uint32_t e1, e2, e3, ss;
953	target_ulong old_eip, esp, offset;
954
955	has_error_code = 0;
956	if (!is_int && !is_hw) {
957	switch(intno) {
958	case 8:
959	case 10:
960	case 11:
961	case 12:
962	case 13:
963	case 14:
964	case 17:
965	has_error_code = 1;
966	break;
967	}
968	}
969	if (is_int)
970	old_eip = next_eip;
971	else
972	old_eip = env->eip;
973
974	dt = &env->idt;
975	if (intno * 16 + 15 > dt->limit)
976	raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
977	ptr = dt->base + intno * 16;
978	e1 = ldl_kernel(ptr);
979	e2 = ldl_kernel(ptr + 4);
980	e3 = ldl_kernel(ptr + 8);
981	/* check gate type */
982	type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
983	switch(type) {
984	case 14: /* 386 interrupt gate */
985	case 15: /* 386 trap gate */
986	break;
987	default:
988	raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
989	break;
990	}
991	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
992	cpl = env->hflags & HF_CPL_MASK;
993	/* check privledge if software int */
994	if (is_int && dpl < cpl)
995	raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
996	/* check valid bit */
997	if (!(e2 & DESC_P_MASK))
998	raise_exception_err(EXCP0B_NOSEG, intno * 16 + 2);
999	selector = e1 >> 16;
1000	offset = ((target_ulong)e3 << 32) \| (e2 & 0xffff0000) \| (e1 & 0x0000ffff);
1001	ist = e2 & 7;
1002	if ((selector & 0xfffc) == 0)
1003	raise_exception_err(EXCP0D_GPF, 0);
1004
1005	if (load_segment(&e1, &e2, selector) != 0)
1006	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1007	if (!(e2 & DESC_S_MASK) \|\| !(e2 & (DESC_CS_MASK)))
1008	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1009	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1010	if (dpl > cpl)
1011	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1012	if (!(e2 & DESC_P_MASK))
1013	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
1014	if (!(e2 & DESC_L_MASK) \|\| (e2 & DESC_B_MASK))
1015	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1016	if ((!(e2 & DESC_C_MASK) && dpl < cpl) \|\| ist != 0) {
1017	/* to inner priviledge */
1018	if (ist != 0)
1019	esp = get_rsp_from_tss(ist + 3);
1020	else
1021	esp = get_rsp_from_tss(dpl);
1022	esp &= ~0xfLL; /* align stack */
1023	ss = 0;
1024	new_stack = 1;
1025	} else if ((e2 & DESC_C_MASK) \|\| dpl == cpl) {
1026	/* to same priviledge */
1027	if (env->eflags & VM_MASK)
1028	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1029	new_stack = 0;
1030	if (ist != 0)
1031	esp = get_rsp_from_tss(ist + 3);
1032	else
1033	esp = ESP;
1034	esp &= ~0xfLL; /* align stack */
1035	dpl = cpl;
1036	} else {
1037	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1038	new_stack = 0; /* avoid warning */
1039	esp = 0; /* avoid warning */
1040	}
1041
1042	PUSHQ(esp, env->segs[R_SS].selector);
1043	PUSHQ(esp, ESP);
1044	PUSHQ(esp, compute_eflags());
1045	PUSHQ(esp, env->segs[R_CS].selector);
1046	PUSHQ(esp, old_eip);
1047	if (has_error_code) {
1048	PUSHQ(esp, error_code);
1049	}
1050
1051	if (new_stack) {
1052	ss = 0 \| dpl;
1053	cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, 0);
1054	}
1055	ESP = esp;
1056
1057	selector = (selector & ~3) \| dpl;
1058	cpu_x86_load_seg_cache(env, R_CS, selector,
1059	get_seg_base(e1, e2),
1060	get_seg_limit(e1, e2),
1061	e2);
1062	cpu_x86_set_cpl(env, dpl);
1063	env->eip = offset;
1064
1065	/* interrupt gate clear IF mask */
1066	if ((type & 1) == 0) {
1067	env->eflags &= ~IF_MASK;
1068	}
1069	env->eflags &= ~(TF_MASK \| VM_MASK \| RF_MASK \| NT_MASK);
1070	}
1071	#endif
1072
1073	void helper_syscall(int next_eip_addend)
1074	{
1075	int selector;
1076
1077	if (!(env->efer & MSR_EFER_SCE)) {
1078	raise_exception_err(EXCP06_ILLOP, 0);
1079	}
1080	selector = (env->star >> 32) & 0xffff;
1081	#ifdef TARGET_X86_64
1082	if (env->hflags & HF_LMA_MASK) {
1083	int code64;
1084
1085	ECX = env->eip + next_eip_addend;
1086	env->regs[11] = compute_eflags();
1087
1088	code64 = env->hflags & HF_CS64_MASK;
1089
1090	cpu_x86_set_cpl(env, 0);
1091	cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
1092	0, 0xffffffff,
1093	DESC_G_MASK \| DESC_P_MASK \|
1094	DESC_S_MASK \|
1095	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK \| DESC_L_MASK);
1096	cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
1097	0, 0xffffffff,
1098	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1099	DESC_S_MASK \|
1100	DESC_W_MASK \| DESC_A_MASK);
1101	env->eflags &= ~env->fmask;
1102	if (code64)
1103	env->eip = env->lstar;
1104	else
1105	env->eip = env->cstar;
1106	} else
1107	#endif
1108	{
1109	ECX = (uint32_t)(env->eip + next_eip_addend);
1110
1111	cpu_x86_set_cpl(env, 0);
1112	cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
1113	0, 0xffffffff,
1114	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1115	DESC_S_MASK \|
1116	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
1117	cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
1118	0, 0xffffffff,
1119	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1120	DESC_S_MASK \|
1121	DESC_W_MASK \| DESC_A_MASK);
1122	env->eflags &= ~(IF_MASK \| RF_MASK \| VM_MASK);
1123	env->eip = (uint32_t)env->star;
1124	}
1125	}
1126
1127	void helper_sysret(int dflag)
1128	{
1129	int cpl, selector;
1130
1131	if (!(env->efer & MSR_EFER_SCE)) {
1132	raise_exception_err(EXCP06_ILLOP, 0);
1133	}
1134	cpl = env->hflags & HF_CPL_MASK;
1135	if (!(env->cr[0] & CR0_PE_MASK) \|\| cpl != 0) {
1136	raise_exception_err(EXCP0D_GPF, 0);
1137	}
1138	selector = (env->star >> 48) & 0xffff;
1139	#ifdef TARGET_X86_64
1140	if (env->hflags & HF_LMA_MASK) {
1141	if (dflag == 2) {
1142	cpu_x86_load_seg_cache(env, R_CS, (selector + 16) \| 3,
1143	0, 0xffffffff,
1144	DESC_G_MASK \| DESC_P_MASK \|
1145	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1146	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK \|
1147	DESC_L_MASK);
1148	env->eip = ECX;
1149	} else {
1150	cpu_x86_load_seg_cache(env, R_CS, selector \| 3,
1151	0, 0xffffffff,
1152	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1153	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1154	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
1155	env->eip = (uint32_t)ECX;
1156	}
1157	cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1158	0, 0xffffffff,
1159	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1160	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1161	DESC_W_MASK \| DESC_A_MASK);
1162	load_eflags((uint32_t)(env->regs[11]), TF_MASK \| AC_MASK \| ID_MASK \|
1163	IF_MASK \| IOPL_MASK \| VM_MASK \| RF_MASK \| NT_MASK);
1164	cpu_x86_set_cpl(env, 3);
1165	} else
1166	#endif
1167	{
1168	cpu_x86_load_seg_cache(env, R_CS, selector \| 3,
1169	0, 0xffffffff,
1170	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1171	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1172	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
1173	env->eip = (uint32_t)ECX;
1174	cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1175	0, 0xffffffff,
1176	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
1177	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
1178	DESC_W_MASK \| DESC_A_MASK);
1179	env->eflags \|= IF_MASK;
1180	cpu_x86_set_cpl(env, 3);
1181	}
1182	#ifdef USE_KQEMU
1183	if (kqemu_is_ok(env)) {
1184	if (env->hflags & HF_LMA_MASK)
1185	CC_OP = CC_OP_EFLAGS;
1186	env->exception_index = -1;
1187	cpu_loop_exit();
1188	}
1189	#endif
1190	}
1191
1192	#ifdef VBOX
1193	/**
1194	* Checks and processes external VMM events.
1195	* Called by op_check_external_event() when any of the flags is set and can be serviced.
1196	*/
1197	void helper_external_event(void)
1198	{
1199	#if defined(RT_OS_DARWIN) && defined(VBOX_STRICT)
1200	uintptr_t uESP;
1201	__asm__ __volatile__("movl %%esp, %0" : "=r" (uESP));
1202	AssertMsg(!(uESP & 15), ("esp=%#p\n", uESP));
1203	#endif
1204	if (env->interrupt_request & CPU_INTERRUPT_EXTERNAL_HARD)
1205	{
1206	ASMAtomicAndS32(&env->interrupt_request, ~CPU_INTERRUPT_EXTERNAL_HARD);
1207	cpu_interrupt(env, CPU_INTERRUPT_HARD);
1208	}
1209	if (env->interrupt_request & CPU_INTERRUPT_EXTERNAL_EXIT)
1210	{
1211	ASMAtomicAndS32(&env->interrupt_request, ~CPU_INTERRUPT_EXTERNAL_EXIT);
1212	cpu_interrupt(env, CPU_INTERRUPT_EXIT);
1213	}
1214	if (env->interrupt_request & CPU_INTERRUPT_EXTERNAL_DMA)
1215	{
1216	ASMAtomicAndS32(&env->interrupt_request, ~CPU_INTERRUPT_EXTERNAL_DMA);
1217	remR3DmaRun(env);
1218	}
1219	if (env->interrupt_request & CPU_INTERRUPT_EXTERNAL_TIMER)
1220	{
1221	ASMAtomicAndS32(&env->interrupt_request, ~CPU_INTERRUPT_EXTERNAL_TIMER);
1222	remR3TimersRun(env);
1223	}
1224	}
1225	/* helper for recording call instruction addresses for later scanning */
1226	void helper_record_call()
1227	{
1228	if ( !(env->state & CPU_RAW_RING0)
1229	&& (env->cr[0] & CR0_PG_MASK)
1230	&& !(env->eflags & X86_EFL_IF))
1231	remR3RecordCall(env);
1232	}
1233	#endif /* VBOX */
1234
1235	/* real mode interrupt */
1236	static void do_interrupt_real(int intno, int is_int, int error_code,
1237	unsigned int next_eip)
1238	{
1239	SegmentCache *dt;
1240	target_ulong ptr, ssp;
1241	int selector;
1242	uint32_t offset, esp;
1243	uint32_t old_cs, old_eip;
1244
1245	/* real mode (simpler !) */
1246	dt = &env->idt;
1247	if (intno * 4 + 3 > dt->limit)
1248	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
1249	ptr = dt->base + intno * 4;
1250	offset = lduw_kernel(ptr);
1251	selector = lduw_kernel(ptr + 2);
1252	esp = ESP;
1253	ssp = env->segs[R_SS].base;
1254	if (is_int)
1255	old_eip = next_eip;
1256	else
1257	old_eip = env->eip;
1258	old_cs = env->segs[R_CS].selector;
1259	/* XXX: use SS segment size ? */
1260	PUSHW(ssp, esp, 0xffff, compute_eflags());
1261	PUSHW(ssp, esp, 0xffff, old_cs);
1262	PUSHW(ssp, esp, 0xffff, old_eip);
1263
1264	/* update processor state */
1265	ESP = (ESP & ~0xffff) \| (esp & 0xffff);
1266	env->eip = offset;
1267	env->segs[R_CS].selector = selector;
1268	env->segs[R_CS].base = (selector << 4);
1269	env->eflags &= ~(IF_MASK \| TF_MASK \| AC_MASK \| RF_MASK);
1270	}
1271
1272	/* fake user mode interrupt */
1273	void do_interrupt_user(int intno, int is_int, int error_code,
1274	target_ulong next_eip)
1275	{
1276	SegmentCache *dt;
1277	target_ulong ptr;
1278	int dpl, cpl;
1279	uint32_t e2;
1280
1281	dt = &env->idt;
1282	ptr = dt->base + (intno * 8);
1283	e2 = ldl_kernel(ptr + 4);
1284
1285	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1286	cpl = env->hflags & HF_CPL_MASK;
1287	/* check privledge if software int */
1288	if (is_int && dpl < cpl)
1289	raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
1290
1291	/* Since we emulate only user space, we cannot do more than
1292	exiting the emulation with the suitable exception and error
1293	code */
1294	if (is_int)
1295	EIP = next_eip;
1296	}
1297
1298	/*
1299	* Begin execution of an interruption. is_int is TRUE if coming from
1300	* the int instruction. next_eip is the EIP value AFTER the interrupt
1301	* instruction. It is only relevant if is_int is TRUE.
1302	*/
1303	void do_interrupt(int intno, int is_int, int error_code,
1304	target_ulong next_eip, int is_hw)
1305	{
1306	if (loglevel & CPU_LOG_INT) {
1307	if ((env->cr[0] & CR0_PE_MASK)) {
1308	static int count;
1309	fprintf(logfile, "%6d: v=%02x e=%04x i=%d cpl=%d IP=%04x:" TARGET_FMT_lx " pc=" TARGET_FMT_lx " SP=%04x:" TARGET_FMT_lx,
1310	count, intno, error_code, is_int,
1311	env->hflags & HF_CPL_MASK,
1312	env->segs[R_CS].selector, EIP,
1313	(int)env->segs[R_CS].base + EIP,
1314	env->segs[R_SS].selector, ESP);
1315	if (intno == 0x0e) {
1316	fprintf(logfile, " CR2=" TARGET_FMT_lx, env->cr[2]);
1317	} else {
1318	fprintf(logfile, " EAX=" TARGET_FMT_lx, EAX);
1319	}
1320	fprintf(logfile, "\n");
1321	cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
1322	#if 0
1323	{
1324	int i;
1325	uint8_t *ptr;
1326	fprintf(logfile, " code=");
1327	ptr = env->segs[R_CS].base + env->eip;
1328	for(i = 0; i < 16; i++) {
1329	fprintf(logfile, " %02x", ldub(ptr + i));
1330	}
1331	fprintf(logfile, "\n");
1332	}
1333	#endif
1334	count++;
1335	}
1336	}
1337	if (env->cr[0] & CR0_PE_MASK) {
1338	#if TARGET_X86_64
1339	if (env->hflags & HF_LMA_MASK) {
1340	do_interrupt64(intno, is_int, error_code, next_eip, is_hw);
1341	} else
1342	#endif
1343	{
1344	#ifdef VBOX
1345	/* int xx , v86 code and VME enabled? /
1346	if ( (env->eflags & VM_MASK)
1347	&& (env->cr[4] & CR4_VME_MASK)
1348	&& is_int
1349	&& !is_hw
1350	&& env->eip + 1 != next_eip /* single byte int 3 goes straight to the protected mode handler */
1351	)
1352	do_soft_interrupt_vme(intno, error_code, next_eip);
1353	else
1354	#endif /* VBOX */
1355	do_interrupt_protected(intno, is_int, error_code, next_eip, is_hw);
1356	}
1357	} else {
1358	do_interrupt_real(intno, is_int, error_code, next_eip);
1359	}
1360	}
1361
1362	/*
1363	* Signal an interruption. It is executed in the main CPU loop.
1364	* is_int is TRUE if coming from the int instruction. next_eip is the
1365	* EIP value AFTER the interrupt instruction. It is only relevant if
1366	* is_int is TRUE.
1367	*/
1368	void raise_interrupt(int intno, int is_int, int error_code,
1369	int next_eip_addend)
1370	{
1371	#if defined(VBOX) && defined(DEBUG) && !defined(DEBUG_dmik)
1372	Log2(("raise_interrupt: %x %x %x %08x\n", intno, is_int, error_code, env->eip + next_eip_addend));
1373	#endif
1374	env->exception_index = intno;
1375	env->error_code = error_code;
1376	env->exception_is_int = is_int;
1377	env->exception_next_eip = env->eip + next_eip_addend;
1378	cpu_loop_exit();
1379	}
1380
1381	/* same as raise_exception_err, but do not restore global registers */
1382	static void raise_exception_err_norestore(int exception_index, int error_code)
1383	{
1384	env->exception_index = exception_index;
1385	env->error_code = error_code;
1386	env->exception_is_int = 0;
1387	env->exception_next_eip = 0;
1388	longjmp(env->jmp_env, 1);
1389	}
1390
1391	/* shortcuts to generate exceptions */
1392
1393	void (raise_exception_err)(int exception_index, int error_code)
1394	{
1395	raise_interrupt(exception_index, 0, error_code, 0);
1396	}
1397
1398	void raise_exception(int exception_index)
1399	{
1400	raise_interrupt(exception_index, 0, 0, 0);
1401	}
1402
1403	/* SMM support */
1404
1405	#if defined(CONFIG_USER_ONLY)
1406
1407	void do_smm_enter(void)
1408	{
1409	}
1410
1411	void helper_rsm(void)
1412	{
1413	}
1414
1415	#else
1416
1417	#ifdef TARGET_X86_64
1418	#define SMM_REVISION_ID 0x00020064
1419	#else
1420	#define SMM_REVISION_ID 0x00020000
1421	#endif
1422
1423	void do_smm_enter(void)
1424	{
1425	#ifdef VBOX
1426	cpu_abort(env, "do_ssm_enter");
1427	#else /* !VBOX */
1428	target_ulong sm_state;
1429	SegmentCache *dt;
1430	int i, offset;
1431
1432	if (loglevel & CPU_LOG_INT) {
1433	fprintf(logfile, "SMM: enter\n");
1434	cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
1435	}
1436
1437	env->hflags \|= HF_SMM_MASK;
1438	cpu_smm_update(env);
1439
1440	sm_state = env->smbase + 0x8000;
1441
1442	#ifdef TARGET_X86_64
1443	for(i = 0; i < 6; i++) {
1444	dt = &env->segs[i];
1445	offset = 0x7e00 + i * 16;
1446	stw_phys(sm_state + offset, dt->selector);
1447	stw_phys(sm_state + offset + 2, (dt->flags >> 8) & 0xf0ff);
1448	stl_phys(sm_state + offset + 4, dt->limit);
1449	stq_phys(sm_state + offset + 8, dt->base);
1450	}
1451
1452	stq_phys(sm_state + 0x7e68, env->gdt.base);
1453	stl_phys(sm_state + 0x7e64, env->gdt.limit);
1454
1455	stw_phys(sm_state + 0x7e70, env->ldt.selector);
1456	stq_phys(sm_state + 0x7e78, env->ldt.base);
1457	stl_phys(sm_state + 0x7e74, env->ldt.limit);
1458	stw_phys(sm_state + 0x7e72, (env->ldt.flags >> 8) & 0xf0ff);
1459
1460	stq_phys(sm_state + 0x7e88, env->idt.base);
1461	stl_phys(sm_state + 0x7e84, env->idt.limit);
1462
1463	stw_phys(sm_state + 0x7e90, env->tr.selector);
1464	stq_phys(sm_state + 0x7e98, env->tr.base);
1465	stl_phys(sm_state + 0x7e94, env->tr.limit);
1466	stw_phys(sm_state + 0x7e92, (env->tr.flags >> 8) & 0xf0ff);
1467
1468	stq_phys(sm_state + 0x7ed0, env->efer);
1469
1470	stq_phys(sm_state + 0x7ff8, EAX);
1471	stq_phys(sm_state + 0x7ff0, ECX);
1472	stq_phys(sm_state + 0x7fe8, EDX);
1473	stq_phys(sm_state + 0x7fe0, EBX);
1474	stq_phys(sm_state + 0x7fd8, ESP);
1475	stq_phys(sm_state + 0x7fd0, EBP);
1476	stq_phys(sm_state + 0x7fc8, ESI);
1477	stq_phys(sm_state + 0x7fc0, EDI);
1478	for(i = 8; i < 16; i++)
1479	stq_phys(sm_state + 0x7ff8 - i * 8, env->regs[i]);
1480	stq_phys(sm_state + 0x7f78, env->eip);
1481	stl_phys(sm_state + 0x7f70, compute_eflags());
1482	stl_phys(sm_state + 0x7f68, env->dr[6]);
1483	stl_phys(sm_state + 0x7f60, env->dr[7]);
1484
1485	stl_phys(sm_state + 0x7f48, env->cr[4]);
1486	stl_phys(sm_state + 0x7f50, env->cr[3]);
1487	stl_phys(sm_state + 0x7f58, env->cr[0]);
1488
1489	stl_phys(sm_state + 0x7efc, SMM_REVISION_ID);
1490	stl_phys(sm_state + 0x7f00, env->smbase);
1491	#else
1492	stl_phys(sm_state + 0x7ffc, env->cr[0]);
1493	stl_phys(sm_state + 0x7ff8, env->cr[3]);
1494	stl_phys(sm_state + 0x7ff4, compute_eflags());
1495	stl_phys(sm_state + 0x7ff0, env->eip);
1496	stl_phys(sm_state + 0x7fec, EDI);
1497	stl_phys(sm_state + 0x7fe8, ESI);
1498	stl_phys(sm_state + 0x7fe4, EBP);
1499	stl_phys(sm_state + 0x7fe0, ESP);
1500	stl_phys(sm_state + 0x7fdc, EBX);
1501	stl_phys(sm_state + 0x7fd8, EDX);
1502	stl_phys(sm_state + 0x7fd4, ECX);
1503	stl_phys(sm_state + 0x7fd0, EAX);
1504	stl_phys(sm_state + 0x7fcc, env->dr[6]);
1505	stl_phys(sm_state + 0x7fc8, env->dr[7]);
1506
1507	stl_phys(sm_state + 0x7fc4, env->tr.selector);
1508	stl_phys(sm_state + 0x7f64, env->tr.base);
1509	stl_phys(sm_state + 0x7f60, env->tr.limit);
1510	stl_phys(sm_state + 0x7f5c, (env->tr.flags >> 8) & 0xf0ff);
1511
1512	stl_phys(sm_state + 0x7fc0, env->ldt.selector);
1513	stl_phys(sm_state + 0x7f80, env->ldt.base);
1514	stl_phys(sm_state + 0x7f7c, env->ldt.limit);
1515	stl_phys(sm_state + 0x7f78, (env->ldt.flags >> 8) & 0xf0ff);
1516
1517	stl_phys(sm_state + 0x7f74, env->gdt.base);
1518	stl_phys(sm_state + 0x7f70, env->gdt.limit);
1519
1520	stl_phys(sm_state + 0x7f58, env->idt.base);
1521	stl_phys(sm_state + 0x7f54, env->idt.limit);
1522
1523	for(i = 0; i < 6; i++) {
1524	dt = &env->segs[i];
1525	if (i < 3)
1526	offset = 0x7f84 + i * 12;
1527	else
1528	offset = 0x7f2c + (i - 3) * 12;
1529	stl_phys(sm_state + 0x7fa8 + i * 4, dt->selector);
1530	stl_phys(sm_state + offset + 8, dt->base);
1531	stl_phys(sm_state + offset + 4, dt->limit);
1532	stl_phys(sm_state + offset, (dt->flags >> 8) & 0xf0ff);
1533	}
1534	stl_phys(sm_state + 0x7f14, env->cr[4]);
1535
1536	stl_phys(sm_state + 0x7efc, SMM_REVISION_ID);
1537	stl_phys(sm_state + 0x7ef8, env->smbase);
1538	#endif
1539	/* init SMM cpu state */
1540
1541	#ifdef TARGET_X86_64
1542	env->efer = 0;
1543	env->hflags &= ~HF_LMA_MASK;
1544	#endif
1545	load_eflags(0, ~(CC_O \| CC_S \| CC_Z \| CC_A \| CC_P \| CC_C \| DF_MASK));
1546	env->eip = 0x00008000;
1547	cpu_x86_load_seg_cache(env, R_CS, (env->smbase >> 4) & 0xffff, env->smbase,
1548	0xffffffff, 0);
1549	cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0xffffffff, 0);
1550	cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0xffffffff, 0);
1551	cpu_x86_load_seg_cache(env, R_SS, 0, 0, 0xffffffff, 0);
1552	cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0xffffffff, 0);
1553	cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0xffffffff, 0);
1554
1555	cpu_x86_update_cr0(env,
1556	env->cr[0] & ~(CR0_PE_MASK \| CR0_EM_MASK \| CR0_TS_MASK \| CR0_PG_MASK));
1557	cpu_x86_update_cr4(env, 0);
1558	env->dr[7] = 0x00000400;
1559	CC_OP = CC_OP_EFLAGS;
1560	#endif /* VBOX */
1561	}
1562
1563	void helper_rsm(void)
1564	{
1565	#ifdef VBOX
1566	cpu_abort(env, "helper_rsm");
1567	#else /* !VBOX */
1568	target_ulong sm_state;
1569	int i, offset;
1570	uint32_t val;
1571
1572	sm_state = env->smbase + 0x8000;
1573	#ifdef TARGET_X86_64
1574	env->efer = ldq_phys(sm_state + 0x7ed0);
1575	if (env->efer & MSR_EFER_LMA)
1576	env->hflags \|= HF_LMA_MASK;
1577	else
1578	env->hflags &= ~HF_LMA_MASK;
1579
1580	for(i = 0; i < 6; i++) {
1581	offset = 0x7e00 + i * 16;
1582	cpu_x86_load_seg_cache(env, i,
1583	lduw_phys(sm_state + offset),
1584	ldq_phys(sm_state + offset + 8),
1585	ldl_phys(sm_state + offset + 4),
1586	(lduw_phys(sm_state + offset + 2) & 0xf0ff) << 8);
1587	}
1588
1589	env->gdt.base = ldq_phys(sm_state + 0x7e68);
1590	env->gdt.limit = ldl_phys(sm_state + 0x7e64);
1591
1592	env->ldt.selector = lduw_phys(sm_state + 0x7e70);
1593	env->ldt.base = ldq_phys(sm_state + 0x7e78);
1594	env->ldt.limit = ldl_phys(sm_state + 0x7e74);
1595	env->ldt.flags = (lduw_phys(sm_state + 0x7e72) & 0xf0ff) << 8;
1596
1597	env->idt.base = ldq_phys(sm_state + 0x7e88);
1598	env->idt.limit = ldl_phys(sm_state + 0x7e84);
1599
1600	env->tr.selector = lduw_phys(sm_state + 0x7e90);
1601	env->tr.base = ldq_phys(sm_state + 0x7e98);
1602	env->tr.limit = ldl_phys(sm_state + 0x7e94);
1603	env->tr.flags = (lduw_phys(sm_state + 0x7e92) & 0xf0ff) << 8;
1604
1605	EAX = ldq_phys(sm_state + 0x7ff8);
1606	ECX = ldq_phys(sm_state + 0x7ff0);
1607	EDX = ldq_phys(sm_state + 0x7fe8);
1608	EBX = ldq_phys(sm_state + 0x7fe0);
1609	ESP = ldq_phys(sm_state + 0x7fd8);
1610	EBP = ldq_phys(sm_state + 0x7fd0);
1611	ESI = ldq_phys(sm_state + 0x7fc8);
1612	EDI = ldq_phys(sm_state + 0x7fc0);
1613	for(i = 8; i < 16; i++)
1614	env->regs[i] = ldq_phys(sm_state + 0x7ff8 - i * 8);
1615	env->eip = ldq_phys(sm_state + 0x7f78);
1616	load_eflags(ldl_phys(sm_state + 0x7f70),
1617	~(CC_O \| CC_S \| CC_Z \| CC_A \| CC_P \| CC_C \| DF_MASK));
1618	env->dr[6] = ldl_phys(sm_state + 0x7f68);
1619	env->dr[7] = ldl_phys(sm_state + 0x7f60);
1620
1621	cpu_x86_update_cr4(env, ldl_phys(sm_state + 0x7f48));
1622	cpu_x86_update_cr3(env, ldl_phys(sm_state + 0x7f50));
1623	cpu_x86_update_cr0(env, ldl_phys(sm_state + 0x7f58));
1624
1625	val = ldl_phys(sm_state + 0x7efc); /* revision ID */
1626	if (val & 0x20000) {
1627	env->smbase = ldl_phys(sm_state + 0x7f00) & ~0x7fff;
1628	}
1629	#else
1630	cpu_x86_update_cr0(env, ldl_phys(sm_state + 0x7ffc));
1631	cpu_x86_update_cr3(env, ldl_phys(sm_state + 0x7ff8));
1632	load_eflags(ldl_phys(sm_state + 0x7ff4),
1633	~(CC_O \| CC_S \| CC_Z \| CC_A \| CC_P \| CC_C \| DF_MASK));
1634	env->eip = ldl_phys(sm_state + 0x7ff0);
1635	EDI = ldl_phys(sm_state + 0x7fec);
1636	ESI = ldl_phys(sm_state + 0x7fe8);
1637	EBP = ldl_phys(sm_state + 0x7fe4);
1638	ESP = ldl_phys(sm_state + 0x7fe0);
1639	EBX = ldl_phys(sm_state + 0x7fdc);
1640	EDX = ldl_phys(sm_state + 0x7fd8);
1641	ECX = ldl_phys(sm_state + 0x7fd4);
1642	EAX = ldl_phys(sm_state + 0x7fd0);
1643	env->dr[6] = ldl_phys(sm_state + 0x7fcc);
1644	env->dr[7] = ldl_phys(sm_state + 0x7fc8);
1645
1646	env->tr.selector = ldl_phys(sm_state + 0x7fc4) & 0xffff;
1647	env->tr.base = ldl_phys(sm_state + 0x7f64);
1648	env->tr.limit = ldl_phys(sm_state + 0x7f60);
1649	env->tr.flags = (ldl_phys(sm_state + 0x7f5c) & 0xf0ff) << 8;
1650
1651	env->ldt.selector = ldl_phys(sm_state + 0x7fc0) & 0xffff;
1652	env->ldt.base = ldl_phys(sm_state + 0x7f80);
1653	env->ldt.limit = ldl_phys(sm_state + 0x7f7c);
1654	env->ldt.flags = (ldl_phys(sm_state + 0x7f78) & 0xf0ff) << 8;
1655
1656	env->gdt.base = ldl_phys(sm_state + 0x7f74);
1657	env->gdt.limit = ldl_phys(sm_state + 0x7f70);
1658
1659	env->idt.base = ldl_phys(sm_state + 0x7f58);
1660	env->idt.limit = ldl_phys(sm_state + 0x7f54);
1661
1662	for(i = 0; i < 6; i++) {
1663	if (i < 3)
1664	offset = 0x7f84 + i * 12;
1665	else
1666	offset = 0x7f2c + (i - 3) * 12;
1667	cpu_x86_load_seg_cache(env, i,
1668	ldl_phys(sm_state + 0x7fa8 + i * 4) & 0xffff,
1669	ldl_phys(sm_state + offset + 8),
1670	ldl_phys(sm_state + offset + 4),
1671	(ldl_phys(sm_state + offset) & 0xf0ff) << 8);
1672	}
1673	cpu_x86_update_cr4(env, ldl_phys(sm_state + 0x7f14));
1674
1675	val = ldl_phys(sm_state + 0x7efc); /* revision ID */
1676	if (val & 0x20000) {
1677	env->smbase = ldl_phys(sm_state + 0x7ef8) & ~0x7fff;
1678	}
1679	#endif
1680	CC_OP = CC_OP_EFLAGS;
1681	env->hflags &= ~HF_SMM_MASK;
1682	cpu_smm_update(env);
1683
1684	if (loglevel & CPU_LOG_INT) {
1685	fprintf(logfile, "SMM: after RSM\n");
1686	cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
1687	}
1688	#endif /* !VBOX */
1689	}
1690
1691	#endif /* !CONFIG_USER_ONLY */
1692
1693
1694	#ifdef BUGGY_GCC_DIV64
1695	/* gcc 2.95.4 on PowerPC does not seem to like using __udivdi3, so we
1696	call it from another function */
1697	uint32_t div32(uint64_t *q_ptr, uint64_t num, uint32_t den)
1698	{
1699	*q_ptr = num / den;
1700	return num % den;
1701	}
1702
1703	int32_t idiv32(int64_t *q_ptr, int64_t num, int32_t den)
1704	{
1705	*q_ptr = num / den;
1706	return num % den;
1707	}
1708	#endif
1709
1710	void helper_divl_EAX_T0(void)
1711	{
1712	unsigned int den, r;
1713	uint64_t num, q;
1714
1715	num = ((uint32_t)EAX) \| ((uint64_t)((uint32_t)EDX) << 32);
1716	den = T0;
1717	if (den == 0) {
1718	raise_exception(EXCP00_DIVZ);
1719	}
1720	#ifdef BUGGY_GCC_DIV64
1721	r = div32(&q, num, den);
1722	#else
1723	q = (num / den);
1724	r = (num % den);
1725	#endif
1726	if (q > 0xffffffff)
1727	raise_exception(EXCP00_DIVZ);
1728	EAX = (uint32_t)q;
1729	EDX = (uint32_t)r;
1730	}
1731
1732	void helper_idivl_EAX_T0(void)
1733	{
1734	int den, r;
1735	int64_t num, q;
1736
1737	num = ((uint32_t)EAX) \| ((uint64_t)((uint32_t)EDX) << 32);
1738	den = T0;
1739	if (den == 0) {
1740	raise_exception(EXCP00_DIVZ);
1741	}
1742	#ifdef BUGGY_GCC_DIV64
1743	r = idiv32(&q, num, den);
1744	#else
1745	q = (num / den);
1746	r = (num % den);
1747	#endif
1748	if (q != (int32_t)q)
1749	raise_exception(EXCP00_DIVZ);
1750	EAX = (uint32_t)q;
1751	EDX = (uint32_t)r;
1752	}
1753
1754	void helper_cmpxchg8b(void)
1755	{
1756	uint64_t d;
1757	int eflags;
1758
1759	eflags = cc_table[CC_OP].compute_all();
1760	d = ldq(A0);
1761	if (d == (((uint64_t)EDX << 32) \| EAX)) {
1762	stq(A0, ((uint64_t)ECX << 32) \| EBX);
1763	eflags \|= CC_Z;
1764	} else {
1765	EDX = d >> 32;
1766	EAX = d;
1767	eflags &= ~CC_Z;
1768	}
1769	CC_SRC = eflags;
1770	}
1771
1772	void helper_cpuid(void)
1773	{
1774	#ifndef VBOX
1775	uint32_t index;
1776	index = (uint32_t)EAX;
1777
1778	/* test if maximum index reached */
1779	if (index & 0x80000000) {
1780	if (index > env->cpuid_xlevel)
1781	index = env->cpuid_level;
1782	} else {
1783	if (index > env->cpuid_level)
1784	index = env->cpuid_level;
1785	}
1786
1787	switch(index) {
1788	case 0:
1789	EAX = env->cpuid_level;
1790	EBX = env->cpuid_vendor1;
1791	EDX = env->cpuid_vendor2;
1792	ECX = env->cpuid_vendor3;
1793	break;
1794	case 1:
1795	EAX = env->cpuid_version;
1796	EBX = 8 << 8; /* CLFLUSH size in quad words, Linux wants it. */
1797	ECX = env->cpuid_ext_features;
1798	EDX = env->cpuid_features;
1799	break;
1800	case 2:
1801	/* cache info: needed for Pentium Pro compatibility */
1802	EAX = 0x410601;
1803	EBX = 0;
1804	ECX = 0;
1805	EDX = 0;
1806	break;
1807	case 0x80000000:
1808	EAX = env->cpuid_xlevel;
1809	EBX = env->cpuid_vendor1;
1810	EDX = env->cpuid_vendor2;
1811	ECX = env->cpuid_vendor3;
1812	break;
1813	case 0x80000001:
1814	EAX = env->cpuid_features;
1815	EBX = 0;
1816	ECX = 0;
1817	EDX = env->cpuid_ext2_features;
1818	break;
1819	case 0x80000002:
1820	case 0x80000003:
1821	case 0x80000004:
1822	EAX = env->cpuid_model[(index - 0x80000002) * 4 + 0];
1823	EBX = env->cpuid_model[(index - 0x80000002) * 4 + 1];
1824	ECX = env->cpuid_model[(index - 0x80000002) * 4 + 2];
1825	EDX = env->cpuid_model[(index - 0x80000002) * 4 + 3];
1826	break;
1827	case 0x80000005:
1828	/* cache info (L1 cache) */
1829	EAX = 0x01ff01ff;
1830	EBX = 0x01ff01ff;
1831	ECX = 0x40020140;
1832	EDX = 0x40020140;
1833	break;
1834	case 0x80000006:
1835	/* cache info (L2 cache) */
1836	EAX = 0;
1837	EBX = 0x42004200;
1838	ECX = 0x02008140;
1839	EDX = 0;
1840	break;
1841	case 0x80000008:
1842	/* virtual & phys address size in low 2 bytes. */
1843	EAX = 0x00003028;
1844	EBX = 0;
1845	ECX = 0;
1846	EDX = 0;
1847	break;
1848	default:
1849	/* reserved values: zero */
1850	EAX = 0;
1851	EBX = 0;
1852	ECX = 0;
1853	EDX = 0;
1854	break;
1855	}
1856	#else /* VBOX */
1857	remR3CpuId(env, EAX, &EAX, &EBX, &ECX, &EDX);
1858	#endif /* VBOX */
1859	}
1860
1861	void helper_enter_level(int level, int data32)
1862	{
1863	target_ulong ssp;
1864	uint32_t esp_mask, esp, ebp;
1865
1866	esp_mask = get_sp_mask(env->segs[R_SS].flags);
1867	ssp = env->segs[R_SS].base;
1868	ebp = EBP;
1869	esp = ESP;
1870	if (data32) {
1871	/* 32 bit */
1872	esp -= 4;
1873	while (--level) {
1874	esp -= 4;
1875	ebp -= 4;
1876	stl(ssp + (esp & esp_mask), ldl(ssp + (ebp & esp_mask)));
1877	}
1878	esp -= 4;
1879	stl(ssp + (esp & esp_mask), T1);
1880	} else {
1881	/* 16 bit */
1882	esp -= 2;
1883	while (--level) {
1884	esp -= 2;
1885	ebp -= 2;
1886	stw(ssp + (esp & esp_mask), lduw(ssp + (ebp & esp_mask)));
1887	}
1888	esp -= 2;
1889	stw(ssp + (esp & esp_mask), T1);
1890	}
1891	}
1892
1893	#ifdef TARGET_X86_64
1894	void helper_enter64_level(int level, int data64)
1895	{
1896	target_ulong esp, ebp;
1897	ebp = EBP;
1898	esp = ESP;
1899
1900	if (data64) {
1901	/* 64 bit */
1902	esp -= 8;
1903	while (--level) {
1904	esp -= 8;
1905	ebp -= 8;
1906	stq(esp, ldq(ebp));
1907	}
1908	esp -= 8;
1909	stq(esp, T1);
1910	} else {
1911	/* 16 bit */
1912	esp -= 2;
1913	while (--level) {
1914	esp -= 2;
1915	ebp -= 2;
1916	stw(esp, lduw(ebp));
1917	}
1918	esp -= 2;
1919	stw(esp, T1);
1920	}
1921	}
1922	#endif
1923
1924	void helper_lldt_T0(void)
1925	{
1926	int selector;
1927	SegmentCache *dt;
1928	uint32_t e1, e2;
1929	int index, entry_limit;
1930	target_ulong ptr;
1931	#ifdef VBOX
1932	Log(("helper_lldt_T0: old ldtr=%RTsel {.base=%VGv, .limit=%VGv} new=%RTsel\n",
1933	(RTSEL)env->ldt.selector, (RTGCPTR)env->ldt.base, (RTGCPTR)env->ldt.limit, (RTSEL)(T0 & 0xffff)));
1934	#endif
1935
1936	selector = T0 & 0xffff;
1937	if ((selector & 0xfffc) == 0) {
1938	/* XXX: NULL selector case: invalid LDT */
1939	env->ldt.base = 0;
1940	env->ldt.limit = 0;
1941	} else {
1942	if (selector & 0x4)
1943	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1944	dt = &env->gdt;
1945	index = selector & ~7;
1946	#ifdef TARGET_X86_64
1947	if (env->hflags & HF_LMA_MASK)
1948	entry_limit = 15;
1949	else
1950	#endif
1951	entry_limit = 7;
1952	if ((index + entry_limit) > dt->limit)
1953	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1954	ptr = dt->base + index;
1955	e1 = ldl_kernel(ptr);
1956	e2 = ldl_kernel(ptr + 4);
1957	if ((e2 & DESC_S_MASK) \|\| ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2)
1958	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
1959	if (!(e2 & DESC_P_MASK))
1960	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
1961	#ifdef TARGET_X86_64
1962	if (env->hflags & HF_LMA_MASK) {
1963	uint32_t e3;
1964	e3 = ldl_kernel(ptr + 8);
1965	load_seg_cache_raw_dt(&env->ldt, e1, e2);
1966	env->ldt.base \|= (target_ulong)e3 << 32;
1967	} else
1968	#endif
1969	{
1970	load_seg_cache_raw_dt(&env->ldt, e1, e2);
1971	}
1972	}
1973	env->ldt.selector = selector;
1974	#ifdef VBOX
1975	Log(("helper_lldt_T0: new ldtr=%RTsel {.base=%VGv, .limit=%VGv}\n",
1976	(RTSEL)env->ldt.selector, (RTGCPTR)env->ldt.base, (RTGCPTR)env->ldt.limit));
1977	#endif
1978	}
1979
1980	void helper_ltr_T0(void)
1981	{
1982	int selector;
1983	SegmentCache *dt;
1984	uint32_t e1, e2;
1985	int index, type, entry_limit;
1986	target_ulong ptr;
1987
1988	#ifdef VBOX
1989	Log(("helper_ltr_T0: old tr=%RTsel {.base=%VGv, .limit=%VGv, .flags=%RX32} new=%RTsel\n",
1990	(RTSEL)env->tr.selector, (RTGCPTR)env->tr.base, (RTGCPTR)env->tr.limit,
1991	env->tr.flags, (RTSEL)(T0 & 0xffff)));
1992	#endif
1993
1994	selector = T0 & 0xffff;
1995	if ((selector & 0xfffc) == 0) {
1996	/* NULL selector case: invalid TR */
1997	env->tr.base = 0;
1998	env->tr.limit = 0;
1999	env->tr.flags = 0;
2000	} else {
2001	if (selector & 0x4)
2002	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2003	dt = &env->gdt;
2004	index = selector & ~7;
2005	#ifdef TARGET_X86_64
2006	if (env->hflags & HF_LMA_MASK)
2007	entry_limit = 15;
2008	else
2009	#endif
2010	entry_limit = 7;
2011	if ((index + entry_limit) > dt->limit)
2012	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2013	ptr = dt->base + index;
2014	e1 = ldl_kernel(ptr);
2015	e2 = ldl_kernel(ptr + 4);
2016	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2017	if ((e2 & DESC_S_MASK) \|\|
2018	(type != 1 && type != 9))
2019	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2020	if (!(e2 & DESC_P_MASK))
2021	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2022	#ifdef TARGET_X86_64
2023	if (env->hflags & HF_LMA_MASK) {
2024	uint32_t e3;
2025	e3 = ldl_kernel(ptr + 8);
2026	load_seg_cache_raw_dt(&env->tr, e1, e2);
2027	env->tr.base \|= (target_ulong)e3 << 32;
2028	} else
2029	#endif
2030	{
2031	load_seg_cache_raw_dt(&env->tr, e1, e2);
2032	}
2033	e2 \|= DESC_TSS_BUSY_MASK;
2034	stl_kernel(ptr + 4, e2);
2035	}
2036	env->tr.selector = selector;
2037	#ifdef VBOX
2038	Log(("helper_ltr_T0: new tr=%RTsel {.base=%VGv, .limit=%VGv, .flags=%RX32} new=%RTsel\n",
2039	(RTSEL)env->tr.selector, (RTGCPTR)env->tr.base, (RTGCPTR)env->tr.limit,
2040	env->tr.flags, (RTSEL)(T0 & 0xffff)));
2041	#endif
2042	}
2043
2044	/* only works if protected mode and not VM86. seg_reg must be != R_CS */
2045	void load_seg(int seg_reg, int selector)
2046	{
2047	uint32_t e1, e2;
2048	int cpl, dpl, rpl;
2049	SegmentCache *dt;
2050	int index;
2051	target_ulong ptr;
2052
2053	selector &= 0xffff;
2054	cpl = env->hflags & HF_CPL_MASK;
2055
2056	#ifdef VBOX
2057	/* Trying to load a selector with CPL=1? */
2058	if (cpl == 0 && (selector & 3) == 1 && (env->state & CPU_RAW_RING0))
2059	{
2060	Log(("RPL 1 -> sel %04X -> %04X\n", selector, selector & 0xfffc));
2061	selector = selector & 0xfffc;
2062	}
2063	#endif
2064
2065	if ((selector & 0xfffc) == 0) {
2066	/* null selector case */
2067	if (seg_reg == R_SS
2068	#ifdef TARGET_X86_64
2069	&& (!(env->hflags & HF_CS64_MASK) \|\| cpl == 3)
2070	#endif
2071	)
2072	raise_exception_err(EXCP0D_GPF, 0);
2073	cpu_x86_load_seg_cache(env, seg_reg, selector, 0, 0, 0);
2074	} else {
2075
2076	if (selector & 0x4)
2077	dt = &env->ldt;
2078	else
2079	dt = &env->gdt;
2080	index = selector & ~7;
2081	if ((index + 7) > dt->limit)
2082	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2083	ptr = dt->base + index;
2084	e1 = ldl_kernel(ptr);
2085	e2 = ldl_kernel(ptr + 4);
2086
2087	if (!(e2 & DESC_S_MASK))
2088	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2089	rpl = selector & 3;
2090	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2091	if (seg_reg == R_SS) {
2092	/* must be writable segment */
2093	if ((e2 & DESC_CS_MASK) \|\| !(e2 & DESC_W_MASK))
2094	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2095	if (rpl != cpl \|\| dpl != cpl)
2096	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2097	} else {
2098	/* must be readable segment */
2099	if ((e2 & (DESC_CS_MASK \| DESC_R_MASK)) == DESC_CS_MASK)
2100	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2101
2102	if (!(e2 & DESC_CS_MASK) \|\| !(e2 & DESC_C_MASK)) {
2103	/* if not conforming code, test rights */
2104	if (dpl < cpl \|\| dpl < rpl)
2105	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2106	}
2107	}
2108
2109	if (!(e2 & DESC_P_MASK)) {
2110	if (seg_reg == R_SS)
2111	raise_exception_err(EXCP0C_STACK, selector & 0xfffc);
2112	else
2113	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2114	}
2115
2116	/* set the access bit if not already set */
2117	if (!(e2 & DESC_A_MASK)) {
2118	e2 \|= DESC_A_MASK;
2119	stl_kernel(ptr + 4, e2);
2120	}
2121
2122	cpu_x86_load_seg_cache(env, seg_reg, selector,
2123	get_seg_base(e1, e2),
2124	get_seg_limit(e1, e2),
2125	e2);
2126	#if 0
2127	fprintf(logfile, "load_seg: sel=0x%04x base=0x%08lx limit=0x%08lx flags=%08x\n",
2128	selector, (unsigned long)sc->base, sc->limit, sc->flags);
2129	#endif
2130	}
2131	}
2132
2133	/* protected mode jump */
2134	void helper_ljmp_protected_T0_T1(int next_eip_addend)
2135	{
2136	int new_cs, gate_cs, type;
2137	uint32_t e1, e2, cpl, dpl, rpl, limit;
2138	target_ulong new_eip, next_eip;
2139
2140	new_cs = T0;
2141	new_eip = T1;
2142	if ((new_cs & 0xfffc) == 0)
2143	raise_exception_err(EXCP0D_GPF, 0);
2144	if (load_segment(&e1, &e2, new_cs) != 0)
2145	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2146	cpl = env->hflags & HF_CPL_MASK;
2147	if (e2 & DESC_S_MASK) {
2148	if (!(e2 & DESC_CS_MASK))
2149	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2150	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2151	if (e2 & DESC_C_MASK) {
2152	/* conforming code segment */
2153	if (dpl > cpl)
2154	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2155	} else {
2156	/* non conforming code segment */
2157	rpl = new_cs & 3;
2158	if (rpl > cpl)
2159	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2160	if (dpl != cpl)
2161	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2162	}
2163	if (!(e2 & DESC_P_MASK))
2164	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2165	limit = get_seg_limit(e1, e2);
2166	if (new_eip > limit &&
2167	!(env->hflags & HF_LMA_MASK) && !(e2 & DESC_L_MASK))
2168	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2169	cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) \| cpl,
2170	get_seg_base(e1, e2), limit, e2);
2171	EIP = new_eip;
2172	} else {
2173	/* jump to call or task gate */
2174	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2175	rpl = new_cs & 3;
2176	cpl = env->hflags & HF_CPL_MASK;
2177	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2178	switch(type) {
2179	case 1: /* 286 TSS */
2180	case 9: /* 386 TSS */
2181	case 5: /* task gate */
2182	if (dpl < cpl \|\| dpl < rpl)
2183	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2184	next_eip = env->eip + next_eip_addend;
2185	switch_tss(new_cs, e1, e2, SWITCH_TSS_JMP, next_eip);
2186	CC_OP = CC_OP_EFLAGS;
2187	break;
2188	case 4: /* 286 call gate */
2189	case 12: /* 386 call gate */
2190	if ((dpl < cpl) \|\| (dpl < rpl))
2191	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2192	if (!(e2 & DESC_P_MASK))
2193	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2194	gate_cs = e1 >> 16;
2195	new_eip = (e1 & 0xffff);
2196	if (type == 12)
2197	new_eip \|= (e2 & 0xffff0000);
2198	if (load_segment(&e1, &e2, gate_cs) != 0)
2199	raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2200	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2201	/* must be code segment */
2202	if (((e2 & (DESC_S_MASK \| DESC_CS_MASK)) !=
2203	(DESC_S_MASK \| DESC_CS_MASK)))
2204	raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2205	if (((e2 & DESC_C_MASK) && (dpl > cpl)) \|\|
2206	(!(e2 & DESC_C_MASK) && (dpl != cpl)))
2207	raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2208	if (!(e2 & DESC_P_MASK))
2209	raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2210	limit = get_seg_limit(e1, e2);
2211	if (new_eip > limit)
2212	raise_exception_err(EXCP0D_GPF, 0);
2213	cpu_x86_load_seg_cache(env, R_CS, (gate_cs & 0xfffc) \| cpl,
2214	get_seg_base(e1, e2), limit, e2);
2215	EIP = new_eip;
2216	break;
2217	default:
2218	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2219	break;
2220	}
2221	}
2222	}
2223
2224	/* real mode call */
2225	void helper_lcall_real_T0_T1(int shift, int next_eip)
2226	{
2227	int new_cs, new_eip;
2228	uint32_t esp, esp_mask;
2229	target_ulong ssp;
2230
2231	new_cs = T0;
2232	new_eip = T1;
2233	esp = ESP;
2234	esp_mask = get_sp_mask(env->segs[R_SS].flags);
2235	ssp = env->segs[R_SS].base;
2236	if (shift) {
2237	PUSHL(ssp, esp, esp_mask, env->segs[R_CS].selector);
2238	PUSHL(ssp, esp, esp_mask, next_eip);
2239	} else {
2240	PUSHW(ssp, esp, esp_mask, env->segs[R_CS].selector);
2241	PUSHW(ssp, esp, esp_mask, next_eip);
2242	}
2243
2244	SET_ESP(esp, esp_mask);
2245	env->eip = new_eip;
2246	env->segs[R_CS].selector = new_cs;
2247	env->segs[R_CS].base = (new_cs << 4);
2248	}
2249
2250	/* protected mode call */
2251	void helper_lcall_protected_T0_T1(int shift, int next_eip_addend)
2252	{
2253	int new_cs, new_stack, i;
2254	uint32_t e1, e2, cpl, dpl, rpl, selector, offset, param_count;
2255	uint32_t ss, ss_e1, ss_e2, sp, type, ss_dpl, sp_mask;
2256	uint32_t val, limit, old_sp_mask;
2257	target_ulong ssp, old_ssp, next_eip, new_eip;
2258
2259	new_cs = T0;
2260	new_eip = T1;
2261	next_eip = env->eip + next_eip_addend;
2262	#ifdef DEBUG_PCALL
2263	if (loglevel & CPU_LOG_PCALL) {
2264	fprintf(logfile, "lcall %04x:%08x s=%d\n",
2265	new_cs, (uint32_t)new_eip, shift);
2266	cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
2267	}
2268	#endif
2269	if ((new_cs & 0xfffc) == 0)
2270	raise_exception_err(EXCP0D_GPF, 0);
2271	if (load_segment(&e1, &e2, new_cs) != 0)
2272	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2273	cpl = env->hflags & HF_CPL_MASK;
2274	#ifdef DEBUG_PCALL
2275	if (loglevel & CPU_LOG_PCALL) {
2276	fprintf(logfile, "desc=%08x:%08x\n", e1, e2);
2277	}
2278	#endif
2279	if (e2 & DESC_S_MASK) {
2280	if (!(e2 & DESC_CS_MASK))
2281	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2282	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2283	if (e2 & DESC_C_MASK) {
2284	/* conforming code segment */
2285	if (dpl > cpl)
2286	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2287	} else {
2288	/* non conforming code segment */
2289	rpl = new_cs & 3;
2290	if (rpl > cpl)
2291	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2292	if (dpl != cpl)
2293	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2294	}
2295	if (!(e2 & DESC_P_MASK))
2296	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2297
2298	#ifdef TARGET_X86_64
2299	/* XXX: check 16/32 bit cases in long mode */
2300	if (shift == 2) {
2301	target_ulong rsp;
2302	/* 64 bit case */
2303	rsp = ESP;
2304	PUSHQ(rsp, env->segs[R_CS].selector);
2305	PUSHQ(rsp, next_eip);
2306	/* from this point, not restartable */
2307	ESP = rsp;
2308	cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) \| cpl,
2309	get_seg_base(e1, e2),
2310	get_seg_limit(e1, e2), e2);
2311	EIP = new_eip;
2312	} else
2313	#endif
2314	{
2315	sp = ESP;
2316	sp_mask = get_sp_mask(env->segs[R_SS].flags);
2317	ssp = env->segs[R_SS].base;
2318	if (shift) {
2319	PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
2320	PUSHL(ssp, sp, sp_mask, next_eip);
2321	} else {
2322	PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
2323	PUSHW(ssp, sp, sp_mask, next_eip);
2324	}
2325
2326	limit = get_seg_limit(e1, e2);
2327	if (new_eip > limit)
2328	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2329	/* from this point, not restartable */
2330	SET_ESP(sp, sp_mask);
2331	cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) \| cpl,
2332	get_seg_base(e1, e2), limit, e2);
2333	EIP = new_eip;
2334	}
2335	} else {
2336	/* check gate type */
2337	type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
2338	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2339	rpl = new_cs & 3;
2340	switch(type) {
2341	case 1: /* available 286 TSS */
2342	case 9: /* available 386 TSS */
2343	case 5: /* task gate */
2344	if (dpl < cpl \|\| dpl < rpl)
2345	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2346	switch_tss(new_cs, e1, e2, SWITCH_TSS_CALL, next_eip);
2347	CC_OP = CC_OP_EFLAGS;
2348	return;
2349	case 4: /* 286 call gate */
2350	case 12: /* 386 call gate */
2351	break;
2352	default:
2353	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2354	break;
2355	}
2356	shift = type >> 3;
2357
2358	if (dpl < cpl \|\| dpl < rpl)
2359	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2360	/* check valid bit */
2361	if (!(e2 & DESC_P_MASK))
2362	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2363	selector = e1 >> 16;
2364	offset = (e2 & 0xffff0000) \| (e1 & 0x0000ffff);
2365	param_count = e2 & 0x1f;
2366	if ((selector & 0xfffc) == 0)
2367	raise_exception_err(EXCP0D_GPF, 0);
2368
2369	if (load_segment(&e1, &e2, selector) != 0)
2370	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2371	if (!(e2 & DESC_S_MASK) \|\| !(e2 & (DESC_CS_MASK)))
2372	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2373	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2374	if (dpl > cpl)
2375	raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2376	if (!(e2 & DESC_P_MASK))
2377	raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2378
2379	if (!(e2 & DESC_C_MASK) && dpl < cpl) {
2380	/* to inner priviledge */
2381	get_ss_esp_from_tss(&ss, &sp, dpl);
2382	#ifdef DEBUG_PCALL
2383	if (loglevel & CPU_LOG_PCALL)
2384	fprintf(logfile, "new ss:esp=%04x:%08x param_count=%d ESP=" TARGET_FMT_lx "\n",
2385	ss, sp, param_count, ESP);
2386	#endif
2387	if ((ss & 0xfffc) == 0)
2388	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2389	if ((ss & 3) != dpl)
2390	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2391	if (load_segment(&ss_e1, &ss_e2, ss) != 0)
2392	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2393	ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
2394	if (ss_dpl != dpl)
2395	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2396	if (!(ss_e2 & DESC_S_MASK) \|\|
2397	(ss_e2 & DESC_CS_MASK) \|\|
2398	!(ss_e2 & DESC_W_MASK))
2399	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2400	if (!(ss_e2 & DESC_P_MASK))
2401	raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2402
2403	// push_size = ((param_count * 2) + 8) << shift;
2404
2405	old_sp_mask = get_sp_mask(env->segs[R_SS].flags);
2406	old_ssp = env->segs[R_SS].base;
2407
2408	sp_mask = get_sp_mask(ss_e2);
2409	ssp = get_seg_base(ss_e1, ss_e2);
2410	if (shift) {
2411	PUSHL(ssp, sp, sp_mask, env->segs[R_SS].selector);
2412	PUSHL(ssp, sp, sp_mask, ESP);
2413	for(i = param_count - 1; i >= 0; i--) {
2414	val = ldl_kernel(old_ssp + ((ESP + i * 4) & old_sp_mask));
2415	PUSHL(ssp, sp, sp_mask, val);
2416	}
2417	} else {
2418	PUSHW(ssp, sp, sp_mask, env->segs[R_SS].selector);
2419	PUSHW(ssp, sp, sp_mask, ESP);
2420	for(i = param_count - 1; i >= 0; i--) {
2421	val = lduw_kernel(old_ssp + ((ESP + i * 2) & old_sp_mask));
2422	PUSHW(ssp, sp, sp_mask, val);
2423	}
2424	}
2425	new_stack = 1;
2426	} else {
2427	/* to same priviledge */
2428	sp = ESP;
2429	sp_mask = get_sp_mask(env->segs[R_SS].flags);
2430	ssp = env->segs[R_SS].base;
2431	// push_size = (4 << shift);
2432	new_stack = 0;
2433	}
2434
2435	if (shift) {
2436	PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
2437	PUSHL(ssp, sp, sp_mask, next_eip);
2438	} else {
2439	PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
2440	PUSHW(ssp, sp, sp_mask, next_eip);
2441	}
2442
2443	/* from this point, not restartable */
2444
2445	if (new_stack) {
2446	ss = (ss & ~3) \| dpl;
2447	cpu_x86_load_seg_cache(env, R_SS, ss,
2448	ssp,
2449	get_seg_limit(ss_e1, ss_e2),
2450	ss_e2);
2451	}
2452
2453	selector = (selector & ~3) \| dpl;
2454	cpu_x86_load_seg_cache(env, R_CS, selector,
2455	get_seg_base(e1, e2),
2456	get_seg_limit(e1, e2),
2457	e2);
2458	cpu_x86_set_cpl(env, dpl);
2459	SET_ESP(sp, sp_mask);
2460	EIP = offset;
2461	}
2462	#ifdef USE_KQEMU
2463	if (kqemu_is_ok(env)) {
2464	env->exception_index = -1;
2465	cpu_loop_exit();
2466	}
2467	#endif
2468	}
2469
2470	/* real and vm86 mode iret */
2471	void helper_iret_real(int shift)
2472	{
2473	uint32_t sp, new_cs, new_eip, new_eflags, sp_mask;
2474	target_ulong ssp;
2475	int eflags_mask;
2476	#ifdef VBOX
2477	bool fVME = false;
2478
2479	remR3TrapClear(env->pVM);
2480	#endif /* VBOX */
2481
2482	sp_mask = 0xffff; /* XXXX: use SS segment size ? */
2483	sp = ESP;
2484	ssp = env->segs[R_SS].base;
2485	if (shift == 1) {
2486	/* 32 bits */
2487	POPL(ssp, sp, sp_mask, new_eip);
2488	POPL(ssp, sp, sp_mask, new_cs);
2489	new_cs &= 0xffff;
2490	POPL(ssp, sp, sp_mask, new_eflags);
2491	} else {
2492	/* 16 bits */
2493	POPW(ssp, sp, sp_mask, new_eip);
2494	POPW(ssp, sp, sp_mask, new_cs);
2495	POPW(ssp, sp, sp_mask, new_eflags);
2496	}
2497	#ifdef VBOX
2498	if ( (env->eflags & VM_MASK)
2499	&& ((env->eflags >> IOPL_SHIFT) & 3) != 3
2500	&& (env->cr[4] & CR4_VME_MASK)) /* implied or else we would fault earlier */
2501	{
2502	fVME = true;
2503	/* if virtual interrupt pending and (virtual) interrupts will be enabled -> #GP */
2504	/* if TF will be set -> #GP */
2505	if ( ((new_eflags & IF_MASK) && (env->eflags & VIP_MASK))
2506	\|\| (new_eflags & TF_MASK))
2507	raise_exception(EXCP0D_GPF);
2508	}
2509	#endif /* VBOX */
2510
2511	ESP = (ESP & ~sp_mask) \| (sp & sp_mask);
2512	load_seg_vm(R_CS, new_cs);
2513	env->eip = new_eip;
2514	#ifdef VBOX
2515	if (fVME)
2516	eflags_mask = TF_MASK \| AC_MASK \| ID_MASK \| RF_MASK \| NT_MASK;
2517	else
2518	#endif
2519	if (env->eflags & VM_MASK)
2520	eflags_mask = TF_MASK \| AC_MASK \| ID_MASK \| IF_MASK \| RF_MASK \| NT_MASK;
2521	else
2522	eflags_mask = TF_MASK \| AC_MASK \| ID_MASK \| IF_MASK \| IOPL_MASK \| RF_MASK \| NT_MASK;
2523	if (shift == 0)
2524	eflags_mask &= 0xffff;
2525	load_eflags(new_eflags, eflags_mask);
2526
2527	#ifdef VBOX
2528	if (fVME)
2529	{
2530	if (new_eflags & IF_MASK)
2531	env->eflags \|= VIF_MASK;
2532	else
2533	env->eflags &= ~VIF_MASK;
2534	}
2535	#endif /* VBOX */
2536	}
2537
2538	static inline void validate_seg(int seg_reg, int cpl)
2539	{
2540	int dpl;
2541	uint32_t e2;
2542
2543	/* XXX: on x86_64, we do not want to nullify FS and GS because
2544	they may still contain a valid base. I would be interested to
2545	know how a real x86_64 CPU behaves */
2546	if ((seg_reg == R_FS \|\| seg_reg == R_GS) &&
2547	(env->segs[seg_reg].selector & 0xfffc) == 0)
2548	return;
2549
2550	e2 = env->segs[seg_reg].flags;
2551	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2552	if (!(e2 & DESC_CS_MASK) \|\| !(e2 & DESC_C_MASK)) {
2553	/* data or non conforming code segment */
2554	if (dpl < cpl) {
2555	cpu_x86_load_seg_cache(env, seg_reg, 0, 0, 0, 0);
2556	}
2557	}
2558	}
2559
2560	/* protected mode iret */
2561	static inline void helper_ret_protected(int shift, int is_iret, int addend)
2562	{
2563	uint32_t new_cs, new_eflags, new_ss;
2564	uint32_t new_es, new_ds, new_fs, new_gs;
2565	uint32_t e1, e2, ss_e1, ss_e2;
2566	int cpl, dpl, rpl, eflags_mask, iopl;
2567	target_ulong ssp, sp, new_eip, new_esp, sp_mask;
2568
2569	#ifdef TARGET_X86_64
2570	if (shift == 2)
2571	sp_mask = -1;
2572	else
2573	#endif
2574	sp_mask = get_sp_mask(env->segs[R_SS].flags);
2575	sp = ESP;
2576	ssp = env->segs[R_SS].base;
2577	new_eflags = 0; /* avoid warning */
2578	#ifdef TARGET_X86_64
2579	if (shift == 2) {
2580	POPQ(sp, new_eip);
2581	POPQ(sp, new_cs);
2582	new_cs &= 0xffff;
2583	if (is_iret) {
2584	POPQ(sp, new_eflags);
2585	}
2586	} else
2587	#endif
2588	if (shift == 1) {
2589	/* 32 bits */
2590	POPL(ssp, sp, sp_mask, new_eip);
2591	POPL(ssp, sp, sp_mask, new_cs);
2592	new_cs &= 0xffff;
2593	if (is_iret) {
2594	POPL(ssp, sp, sp_mask, new_eflags);
2595	#if defined(VBOX) && defined(DEBUG)
2596	printf("iret: new CS %04X\n", new_cs);
2597	printf("iret: new EIP %08X\n", new_eip);
2598	printf("iret: new EFLAGS %08X\n", new_eflags);
2599	printf("iret: EAX=%08x\n", EAX);
2600	#endif
2601
2602	if (new_eflags & VM_MASK)
2603	goto return_to_vm86;
2604	}
2605	#ifdef VBOX
2606	if ((new_cs & 0x3) == 1 && (env->state & CPU_RAW_RING0))
2607	{
2608	#ifdef DEBUG
2609	printf("RPL 1 -> new_cs %04X -> %04X\n", new_cs, new_cs & 0xfffc);
2610	#endif
2611	new_cs = new_cs & 0xfffc;
2612	}
2613	#endif
2614	} else {
2615	/* 16 bits */
2616	POPW(ssp, sp, sp_mask, new_eip);
2617	POPW(ssp, sp, sp_mask, new_cs);
2618	if (is_iret)
2619	POPW(ssp, sp, sp_mask, new_eflags);
2620	}
2621	#ifdef DEBUG_PCALL
2622	if (loglevel & CPU_LOG_PCALL) {
2623	fprintf(logfile, "lret new %04x:" TARGET_FMT_lx " s=%d addend=0x%x\n",
2624	new_cs, new_eip, shift, addend);
2625	cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
2626	}
2627	#endif
2628	if ((new_cs & 0xfffc) == 0)
2629	{
2630	#if defined(VBOX) && defined(DEBUG)
2631	printf("new_cs & 0xfffc) == 0\n");
2632	#endif
2633	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2634	}
2635	if (load_segment(&e1, &e2, new_cs) != 0)
2636	{
2637	#if defined(VBOX) && defined(DEBUG)
2638	printf("load_segment failed\n");
2639	#endif
2640	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2641	}
2642	if (!(e2 & DESC_S_MASK) \|\|
2643	!(e2 & DESC_CS_MASK))
2644	{
2645	#if defined(VBOX) && defined(DEBUG)
2646	printf("e2 mask %08x\n", e2);
2647	#endif
2648	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2649	}
2650	cpl = env->hflags & HF_CPL_MASK;
2651	rpl = new_cs & 3;
2652	if (rpl < cpl)
2653	{
2654	#if defined(VBOX) && defined(DEBUG)
2655	printf("rpl < cpl (%d vs %d)\n", rpl, cpl);
2656	#endif
2657	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2658	}
2659	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2660	if (e2 & DESC_C_MASK) {
2661	if (dpl > rpl)
2662	{
2663	#if defined(VBOX) && defined(DEBUG)
2664	printf("dpl > rpl (%d vs %d)\n", dpl, rpl);
2665	#endif
2666	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2667	}
2668	} else {
2669	if (dpl != rpl)
2670	{
2671	#if defined(VBOX) && defined(DEBUG)
2672	printf("dpl != rpl (%d vs %d) e1=%x e2=%x\n", dpl, rpl, e1, e2);
2673	#endif
2674	raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2675	}
2676	}
2677	if (!(e2 & DESC_P_MASK))
2678	{
2679	#if defined(VBOX) && defined(DEBUG)
2680	printf("DESC_P_MASK e2=%08x\n", e2);
2681	#endif
2682	raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2683	}
2684	sp += addend;
2685	if (rpl == cpl && (!(env->hflags & HF_CS64_MASK) \|\|
2686	((env->hflags & HF_CS64_MASK) && !is_iret))) {
2687	/* return to same priledge level */
2688	cpu_x86_load_seg_cache(env, R_CS, new_cs,
2689	get_seg_base(e1, e2),
2690	get_seg_limit(e1, e2),
2691	e2);
2692	} else {
2693	/* return to different priviledge level */
2694	#ifdef TARGET_X86_64
2695	if (shift == 2) {
2696	POPQ(sp, new_esp);
2697	POPQ(sp, new_ss);
2698	new_ss &= 0xffff;
2699	} else
2700	#endif
2701	if (shift == 1) {
2702	/* 32 bits */
2703	POPL(ssp, sp, sp_mask, new_esp);
2704	POPL(ssp, sp, sp_mask, new_ss);
2705	new_ss &= 0xffff;
2706	} else {
2707	/* 16 bits */
2708	POPW(ssp, sp, sp_mask, new_esp);
2709	POPW(ssp, sp, sp_mask, new_ss);
2710	}
2711	#ifdef DEBUG_PCALL
2712	if (loglevel & CPU_LOG_PCALL) {
2713	fprintf(logfile, "new ss:esp=%04x:" TARGET_FMT_lx "\n",
2714	new_ss, new_esp);
2715	}
2716	#endif
2717	if ((new_ss & 0xfffc) == 0) {
2718	#ifdef TARGET_X86_64
2719	/* NULL ss is allowed in long mode if cpl != 3*/
2720	/* XXX: test CS64 ? */
2721	if ((env->hflags & HF_LMA_MASK) && rpl != 3) {
2722	cpu_x86_load_seg_cache(env, R_SS, new_ss,
2723	0, 0xffffffff,
2724	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2725	DESC_S_MASK \| (rpl << DESC_DPL_SHIFT) \|
2726	DESC_W_MASK \| DESC_A_MASK);
2727	ss_e2 = DESC_B_MASK; /* XXX: should not be needed ? */
2728	} else
2729	#endif
2730	{
2731	raise_exception_err(EXCP0D_GPF, 0);
2732	}
2733	} else {
2734	if ((new_ss & 3) != rpl)
2735	raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2736	if (load_segment(&ss_e1, &ss_e2, new_ss) != 0)
2737	raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2738	if (!(ss_e2 & DESC_S_MASK) \|\|
2739	(ss_e2 & DESC_CS_MASK) \|\|
2740	!(ss_e2 & DESC_W_MASK))
2741	raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2742	dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
2743	if (dpl != rpl)
2744	raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2745	if (!(ss_e2 & DESC_P_MASK))
2746	raise_exception_err(EXCP0B_NOSEG, new_ss & 0xfffc);
2747	cpu_x86_load_seg_cache(env, R_SS, new_ss,
2748	get_seg_base(ss_e1, ss_e2),
2749	get_seg_limit(ss_e1, ss_e2),
2750	ss_e2);
2751	}
2752
2753	cpu_x86_load_seg_cache(env, R_CS, new_cs,
2754	get_seg_base(e1, e2),
2755	get_seg_limit(e1, e2),
2756	e2);
2757	cpu_x86_set_cpl(env, rpl);
2758	sp = new_esp;
2759	#ifdef TARGET_X86_64
2760	if (env->hflags & HF_CS64_MASK)
2761	sp_mask = -1;
2762	else
2763	#endif
2764	sp_mask = get_sp_mask(ss_e2);
2765
2766	/* validate data segments */
2767	validate_seg(R_ES, rpl);
2768	validate_seg(R_DS, rpl);
2769	validate_seg(R_FS, rpl);
2770	validate_seg(R_GS, rpl);
2771
2772	sp += addend;
2773	}
2774	SET_ESP(sp, sp_mask);
2775	env->eip = new_eip;
2776	if (is_iret) {
2777	/* NOTE: 'cpl' is the _old_ CPL */
2778	eflags_mask = TF_MASK \| AC_MASK \| ID_MASK \| RF_MASK \| NT_MASK;
2779	if (cpl == 0)
2780	#ifdef VBOX
2781	eflags_mask \|= IOPL_MASK \| VIF_MASK \| VIP_MASK;
2782	#else
2783	eflags_mask \|= IOPL_MASK;
2784	#endif
2785	iopl = (env->eflags >> IOPL_SHIFT) & 3;
2786	if (cpl <= iopl)
2787	eflags_mask \|= IF_MASK;
2788	if (shift == 0)
2789	eflags_mask &= 0xffff;
2790	load_eflags(new_eflags, eflags_mask);
2791	}
2792	return;
2793
2794	return_to_vm86:
2795
2796	#if 0 // defined(VBOX) && defined(DEBUG)
2797	printf("V86: new CS %04X\n", new_cs);
2798	printf("V86: Descriptor %08X:%08X\n", e2, e1);
2799	printf("V86: new EIP %08X\n", new_eip);
2800	printf("V86: new EFLAGS %08X\n", new_eflags);
2801	#endif
2802
2803	POPL(ssp, sp, sp_mask, new_esp);
2804	POPL(ssp, sp, sp_mask, new_ss);
2805	POPL(ssp, sp, sp_mask, new_es);
2806	POPL(ssp, sp, sp_mask, new_ds);
2807	POPL(ssp, sp, sp_mask, new_fs);
2808	POPL(ssp, sp, sp_mask, new_gs);
2809
2810	/* modify processor state */
2811	load_eflags(new_eflags, TF_MASK \| AC_MASK \| ID_MASK \|
2812	IF_MASK \| IOPL_MASK \| VM_MASK \| NT_MASK \| VIF_MASK \| VIP_MASK);
2813	load_seg_vm(R_CS, new_cs & 0xffff);
2814	cpu_x86_set_cpl(env, 3);
2815	load_seg_vm(R_SS, new_ss & 0xffff);
2816	load_seg_vm(R_ES, new_es & 0xffff);
2817	load_seg_vm(R_DS, new_ds & 0xffff);
2818	load_seg_vm(R_FS, new_fs & 0xffff);
2819	load_seg_vm(R_GS, new_gs & 0xffff);
2820
2821	env->eip = new_eip & 0xffff;
2822	ESP = new_esp;
2823	}
2824
2825	void helper_iret_protected(int shift, int next_eip)
2826	{
2827	int tss_selector, type;
2828	uint32_t e1, e2;
2829
2830	#ifdef VBOX
2831	remR3TrapClear(env->pVM);
2832	#endif
2833
2834	/* specific case for TSS */
2835	if (env->eflags & NT_MASK) {
2836	#ifdef TARGET_X86_64
2837	if (env->hflags & HF_LMA_MASK)
2838	raise_exception_err(EXCP0D_GPF, 0);
2839	#endif
2840	tss_selector = lduw_kernel(env->tr.base + 0);
2841	if (tss_selector & 4)
2842	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2843	if (load_segment(&e1, &e2, tss_selector) != 0)
2844	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2845	type = (e2 >> DESC_TYPE_SHIFT) & 0x17;
2846	/* NOTE: we check both segment and busy TSS */
2847	if (type != 3)
2848	raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2849	switch_tss(tss_selector, e1, e2, SWITCH_TSS_IRET, next_eip);
2850	} else {
2851	helper_ret_protected(shift, 1, 0);
2852	}
2853	#ifdef USE_KQEMU
2854	if (kqemu_is_ok(env)) {
2855	CC_OP = CC_OP_EFLAGS;
2856	env->exception_index = -1;
2857	cpu_loop_exit();
2858	}
2859	#endif
2860	}
2861
2862	void helper_lret_protected(int shift, int addend)
2863	{
2864	helper_ret_protected(shift, 0, addend);
2865	#ifdef USE_KQEMU
2866	if (kqemu_is_ok(env)) {
2867	env->exception_index = -1;
2868	cpu_loop_exit();
2869	}
2870	#endif
2871	}
2872
2873	void helper_sysenter(void)
2874	{
2875	if (env->sysenter_cs == 0) {
2876	raise_exception_err(EXCP0D_GPF, 0);
2877	}
2878	env->eflags &= ~(VM_MASK \| IF_MASK \| RF_MASK);
2879	cpu_x86_set_cpl(env, 0);
2880	cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc,
2881	0, 0xffffffff,
2882	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2883	DESC_S_MASK \|
2884	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
2885	cpu_x86_load_seg_cache(env, R_SS, (env->sysenter_cs + 8) & 0xfffc,
2886	0, 0xffffffff,
2887	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2888	DESC_S_MASK \|
2889	DESC_W_MASK \| DESC_A_MASK);
2890	ESP = env->sysenter_esp;
2891	EIP = env->sysenter_eip;
2892	}
2893
2894	void helper_sysexit(void)
2895	{
2896	int cpl;
2897
2898	cpl = env->hflags & HF_CPL_MASK;
2899	if (env->sysenter_cs == 0 \|\| cpl != 0) {
2900	raise_exception_err(EXCP0D_GPF, 0);
2901	}
2902	cpu_x86_set_cpl(env, 3);
2903	cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 16) & 0xfffc) \| 3,
2904	0, 0xffffffff,
2905	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2906	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
2907	DESC_CS_MASK \| DESC_R_MASK \| DESC_A_MASK);
2908	cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 24) & 0xfffc) \| 3,
2909	0, 0xffffffff,
2910	DESC_G_MASK \| DESC_B_MASK \| DESC_P_MASK \|
2911	DESC_S_MASK \| (3 << DESC_DPL_SHIFT) \|
2912	DESC_W_MASK \| DESC_A_MASK);
2913	ESP = ECX;
2914	EIP = EDX;
2915	#ifdef USE_KQEMU
2916	if (kqemu_is_ok(env)) {
2917	env->exception_index = -1;
2918	cpu_loop_exit();
2919	}
2920	#endif
2921	}
2922
2923	void helper_movl_crN_T0(int reg)
2924	{
2925	#if !defined(CONFIG_USER_ONLY)
2926	switch(reg) {
2927	case 0:
2928	cpu_x86_update_cr0(env, T0);
2929	break;
2930	case 3:
2931	cpu_x86_update_cr3(env, T0);
2932	break;
2933	case 4:
2934	cpu_x86_update_cr4(env, T0);
2935	break;
2936	case 8:
2937	cpu_set_apic_tpr(env, T0);
2938	break;
2939	default:
2940	env->cr[reg] = T0;
2941	break;
2942	}
2943	#endif
2944	}
2945
2946	/* XXX: do more */
2947	void helper_movl_drN_T0(int reg)
2948	{
2949	env->dr[reg] = T0;
2950	}
2951
2952	void helper_invlpg(target_ulong addr)
2953	{
2954	cpu_x86_flush_tlb(env, addr);
2955	}
2956
2957	void helper_rdtsc(void)
2958	{
2959	uint64_t val;
2960
2961	if ((env->cr[4] & CR4_TSD_MASK) && ((env->hflags & HF_CPL_MASK) != 0)) {
2962	raise_exception(EXCP0D_GPF);
2963	}
2964	val = cpu_get_tsc(env);
2965	EAX = (uint32_t)(val);
2966	EDX = (uint32_t)(val >> 32);
2967	}
2968
2969	#if defined(CONFIG_USER_ONLY)
2970	void helper_wrmsr(void)
2971	{
2972	}
2973
2974	void helper_rdmsr(void)
2975	{
2976	}
2977	#else
2978	void helper_wrmsr(void)
2979	{
2980	uint64_t val;
2981
2982	val = ((uint32_t)EAX) \| ((uint64_t)((uint32_t)EDX) << 32);
2983
2984	switch((uint32_t)ECX) {
2985	case MSR_IA32_SYSENTER_CS:
2986	env->sysenter_cs = val & 0xffff;
2987	break;
2988	case MSR_IA32_SYSENTER_ESP:
2989	env->sysenter_esp = val;
2990	break;
2991	case MSR_IA32_SYSENTER_EIP:
2992	env->sysenter_eip = val;
2993	break;
2994	case MSR_IA32_APICBASE:
2995	cpu_set_apic_base(env, val);
2996	break;
2997	case MSR_EFER:
2998	{
2999	uint64_t update_mask;
3000	update_mask = 0;
3001	if (env->cpuid_ext2_features & CPUID_EXT2_SYSCALL)
3002	update_mask \|= MSR_EFER_SCE;
3003	if (env->cpuid_ext2_features & CPUID_EXT2_LM)
3004	update_mask \|= MSR_EFER_LME;
3005	if (env->cpuid_ext2_features & CPUID_EXT2_FFXSR)
3006	update_mask \|= MSR_EFER_FFXSR;
3007	if (env->cpuid_ext2_features & CPUID_EXT2_NX)
3008	update_mask \|= MSR_EFER_NXE;
3009	env->efer = (env->efer & ~update_mask) \|
3010	(val & update_mask);
3011	}
3012	break;
3013	case MSR_STAR:
3014	env->star = val;
3015	break;
3016	case MSR_PAT:
3017	env->pat = val;
3018	break;
3019	#ifdef TARGET_X86_64
3020	case MSR_LSTAR:
3021	env->lstar = val;
3022	break;
3023	case MSR_CSTAR:
3024	env->cstar = val;
3025	break;
3026	case MSR_FMASK:
3027	env->fmask = val;
3028	break;
3029	case MSR_FSBASE:
3030	env->segs[R_FS].base = val;
3031	break;
3032	case MSR_GSBASE:
3033	env->segs[R_GS].base = val;
3034	break;
3035	case MSR_KERNELGSBASE:
3036	env->kernelgsbase = val;
3037	break;
3038	#endif
3039	default:
3040	/* XXX: exception ? */
3041	break;
3042	}
3043	}
3044
3045	void helper_rdmsr(void)
3046	{
3047	uint64_t val;
3048	switch((uint32_t)ECX) {
3049	case MSR_IA32_SYSENTER_CS:
3050	val = env->sysenter_cs;
3051	break;
3052	case MSR_IA32_SYSENTER_ESP:
3053	val = env->sysenter_esp;
3054	break;
3055	case MSR_IA32_SYSENTER_EIP:
3056	val = env->sysenter_eip;
3057	break;
3058	case MSR_IA32_APICBASE:
3059	val = cpu_get_apic_base(env);
3060	break;
3061	case MSR_EFER:
3062	val = env->efer;
3063	break;
3064	case MSR_STAR:
3065	val = env->star;
3066	break;
3067	case MSR_PAT:
3068	val = env->pat;
3069	break;
3070	#ifdef TARGET_X86_64
3071	case MSR_LSTAR:
3072	val = env->lstar;
3073	break;
3074	case MSR_CSTAR:
3075	val = env->cstar;
3076	break;
3077	case MSR_FMASK:
3078	val = env->fmask;
3079	break;
3080	case MSR_FSBASE:
3081	val = env->segs[R_FS].base;
3082	break;
3083	case MSR_GSBASE:
3084	val = env->segs[R_GS].base;
3085	break;
3086	case MSR_KERNELGSBASE:
3087	val = env->kernelgsbase;
3088	break;
3089	#endif
3090	default:
3091	/* XXX: exception ? */
3092	val = 0;
3093	break;
3094	}
3095	EAX = (uint32_t)(val);
3096	EDX = (uint32_t)(val >> 32);
3097	}
3098	#endif
3099
3100	void helper_lsl(void)
3101	{
3102	unsigned int selector, limit;
3103	uint32_t e1, e2, eflags;
3104	int rpl, dpl, cpl, type;
3105
3106	eflags = cc_table[CC_OP].compute_all();
3107	selector = T0 & 0xffff;
3108	if (load_segment(&e1, &e2, selector) != 0)
3109	goto fail;
3110	rpl = selector & 3;
3111	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
3112	cpl = env->hflags & HF_CPL_MASK;
3113	if (e2 & DESC_S_MASK) {
3114	if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) {
3115	/* conforming */
3116	} else {
3117	if (dpl < cpl \|\| dpl < rpl)
3118	goto fail;
3119	}
3120	} else {
3121	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
3122	switch(type) {
3123	case 1:
3124	case 2:
3125	case 3:
3126	case 9:
3127	case 11:
3128	break;
3129	default:
3130	goto fail;
3131	}
3132	if (dpl < cpl \|\| dpl < rpl) {
3133	fail:
3134	CC_SRC = eflags & ~CC_Z;
3135	return;
3136	}
3137	}
3138	limit = get_seg_limit(e1, e2);
3139	T1 = limit;
3140	CC_SRC = eflags \| CC_Z;
3141	}
3142
3143	void helper_lar(void)
3144	{
3145	unsigned int selector;
3146	uint32_t e1, e2, eflags;
3147	int rpl, dpl, cpl, type;
3148
3149	eflags = cc_table[CC_OP].compute_all();
3150	selector = T0 & 0xffff;
3151	if ((selector & 0xfffc) == 0)
3152	goto fail;
3153	if (load_segment(&e1, &e2, selector) != 0)
3154	goto fail;
3155	rpl = selector & 3;
3156	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
3157	cpl = env->hflags & HF_CPL_MASK;
3158	if (e2 & DESC_S_MASK) {
3159	if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) {
3160	/* conforming */
3161	} else {
3162	if (dpl < cpl \|\| dpl < rpl)
3163	goto fail;
3164	}
3165	} else {
3166	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
3167	switch(type) {
3168	case 1:
3169	case 2:
3170	case 3:
3171	case 4:
3172	case 5:
3173	case 9:
3174	case 11:
3175	case 12:
3176	break;
3177	default:
3178	goto fail;
3179	}
3180	if (dpl < cpl \|\| dpl < rpl) {
3181	fail:
3182	CC_SRC = eflags & ~CC_Z;
3183	return;
3184	}
3185	}
3186	T1 = e2 & 0x00f0ff00;
3187	CC_SRC = eflags \| CC_Z;
3188	}
3189
3190	void helper_verr(void)
3191	{
3192	unsigned int selector;
3193	uint32_t e1, e2, eflags;
3194	int rpl, dpl, cpl;
3195
3196	eflags = cc_table[CC_OP].compute_all();
3197	selector = T0 & 0xffff;
3198	if ((selector & 0xfffc) == 0)
3199	goto fail;
3200	if (load_segment(&e1, &e2, selector) != 0)
3201	goto fail;
3202	if (!(e2 & DESC_S_MASK))
3203	goto fail;
3204	rpl = selector & 3;
3205	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
3206	cpl = env->hflags & HF_CPL_MASK;
3207	if (e2 & DESC_CS_MASK) {
3208	if (!(e2 & DESC_R_MASK))
3209	goto fail;
3210	if (!(e2 & DESC_C_MASK)) {
3211	if (dpl < cpl \|\| dpl < rpl)
3212	goto fail;
3213	}
3214	} else {
3215	if (dpl < cpl \|\| dpl < rpl) {
3216	fail:
3217	CC_SRC = eflags & ~CC_Z;
3218	return;
3219	}
3220	}
3221	CC_SRC = eflags \| CC_Z;
3222	}
3223
3224	void helper_verw(void)
3225	{
3226	unsigned int selector;
3227	uint32_t e1, e2, eflags;
3228	int rpl, dpl, cpl;
3229
3230	eflags = cc_table[CC_OP].compute_all();
3231	selector = T0 & 0xffff;
3232	if ((selector & 0xfffc) == 0)
3233	goto fail;
3234	if (load_segment(&e1, &e2, selector) != 0)
3235	goto fail;
3236	if (!(e2 & DESC_S_MASK))
3237	goto fail;
3238	rpl = selector & 3;
3239	dpl = (e2 >> DESC_DPL_SHIFT) & 3;
3240	cpl = env->hflags & HF_CPL_MASK;
3241	if (e2 & DESC_CS_MASK) {
3242	goto fail;
3243	} else {
3244	if (dpl < cpl \|\| dpl < rpl)
3245	goto fail;
3246	if (!(e2 & DESC_W_MASK)) {
3247	fail:
3248	CC_SRC = eflags & ~CC_Z;
3249	return;
3250	}
3251	}
3252	CC_SRC = eflags \| CC_Z;
3253	}
3254
3255	/* FPU helpers */
3256
3257	void helper_fldt_ST0_A0(void)
3258	{
3259	int new_fpstt;
3260	new_fpstt = (env->fpstt - 1) & 7;
3261	env->fpregs[new_fpstt].d = helper_fldt(A0);
3262	env->fpstt = new_fpstt;
3263	env->fptags[new_fpstt] = 0; /* validate stack entry */
3264	}
3265
3266	void helper_fstt_ST0_A0(void)
3267	{
3268	helper_fstt(ST0, A0);
3269	}
3270
3271	void fpu_set_exception(int mask)
3272	{
3273	env->fpus \|= mask;
3274	if (env->fpus & (~env->fpuc & FPUC_EM))
3275	env->fpus \|= FPUS_SE \| FPUS_B;
3276	}
3277
3278	CPU86_LDouble helper_fdiv(CPU86_LDouble a, CPU86_LDouble b)
3279	{
3280	if (b == 0.0)
3281	fpu_set_exception(FPUS_ZE);
3282	return a / b;
3283	}
3284
3285	void fpu_raise_exception(void)
3286	{
3287	if (env->cr[0] & CR0_NE_MASK) {
3288	raise_exception(EXCP10_COPR);
3289	}
3290	#if !defined(CONFIG_USER_ONLY)
3291	else {
3292	cpu_set_ferr(env);
3293	}
3294	#endif
3295	}
3296
3297	/* BCD ops */
3298
3299	void helper_fbld_ST0_A0(void)
3300	{
3301	CPU86_LDouble tmp;
3302	uint64_t val;
3303	unsigned int v;
3304	int i;
3305
3306	val = 0;
3307	for(i = 8; i >= 0; i--) {
3308	v = ldub(A0 + i);
3309	val = (val * 100) + ((v >> 4) * 10) + (v & 0xf);
3310	}
3311	tmp = val;
3312	if (ldub(A0 + 9) & 0x80)
3313	tmp = -tmp;
3314	fpush();
3315	ST0 = tmp;
3316	}
3317
3318	void helper_fbst_ST0_A0(void)
3319	{
3320	int v;
3321	target_ulong mem_ref, mem_end;
3322	int64_t val;
3323
3324	val = floatx_to_int64(ST0, &env->fp_status);
3325	mem_ref = A0;
3326	mem_end = mem_ref + 9;
3327	if (val < 0) {
3328	stb(mem_end, 0x80);
3329	val = -val;
3330	} else {
3331	stb(mem_end, 0x00);
3332	}
3333	while (mem_ref < mem_end) {
3334	if (val == 0)
3335	break;
3336	v = val % 100;
3337	val = val / 100;
3338	v = ((v / 10) << 4) \| (v % 10);
3339	stb(mem_ref++, v);
3340	}
3341	while (mem_ref < mem_end) {
3342	stb(mem_ref++, 0);
3343	}
3344	}
3345
3346	void helper_f2xm1(void)
3347	{
3348	ST0 = pow(2.0,ST0) - 1.0;
3349	}
3350
3351	void helper_fyl2x(void)
3352	{
3353	CPU86_LDouble fptemp;
3354
3355	fptemp = ST0;
3356	if (fptemp>0.0){
3357	fptemp = log(fptemp)/log(2.0); /* log2(ST) */
3358	ST1 *= fptemp;
3359	fpop();
3360	} else {
3361	env->fpus &= (~0x4700);
3362	env->fpus \|= 0x400;
3363	}
3364	}
3365
3366	void helper_fptan(void)
3367	{
3368	CPU86_LDouble fptemp;
3369
3370	fptemp = ST0;
3371	if((fptemp > MAXTAN)\|\|(fptemp < -MAXTAN)) {
3372	env->fpus \|= 0x400;
3373	} else {
3374	ST0 = tan(fptemp);
3375	fpush();
3376	ST0 = 1.0;
3377	env->fpus &= (~0x400); /* C2 <-- 0 */
3378	/* the above code is for \|arg\| < 2*52 only /
3379	}
3380	}
3381
3382	void helper_fpatan(void)
3383	{
3384	CPU86_LDouble fptemp, fpsrcop;
3385
3386	fpsrcop = ST1;
3387	fptemp = ST0;
3388	ST1 = atan2(fpsrcop,fptemp);
3389	fpop();
3390	}
3391
3392	void helper_fxtract(void)
3393	{
3394	CPU86_LDoubleU temp;
3395	unsigned int expdif;
3396
3397	temp.d = ST0;
3398	expdif = EXPD(temp) - EXPBIAS;
3399	/DP exponent bias/
3400	ST0 = expdif;
3401	fpush();
3402	BIASEXPONENT(temp);
3403	ST0 = temp.d;
3404	}
3405
3406	void helper_fprem1(void)
3407	{
3408	CPU86_LDouble dblq, fpsrcop, fptemp;
3409	CPU86_LDoubleU fpsrcop1, fptemp1;
3410	int expdif;
3411	int q;
3412
3413	fpsrcop = ST0;
3414	fptemp = ST1;
3415	fpsrcop1.d = fpsrcop;
3416	fptemp1.d = fptemp;
3417	expdif = EXPD(fpsrcop1) - EXPD(fptemp1);
3418	if (expdif < 53) {
3419	dblq = fpsrcop / fptemp;
3420	dblq = (dblq < 0.0)? ceil(dblq): floor(dblq);
3421	ST0 = fpsrcop - fptemp*dblq;
3422	q = (int)dblq; /* cutting off top bits is assumed here */
3423	env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3424	/* (C0,C1,C3) <-- (q2,q1,q0) */
3425	env->fpus \|= (q&0x4) << 6; /* (C0) <-- q2 */
3426	env->fpus \|= (q&0x2) << 8; /* (C1) <-- q1 */
3427	env->fpus \|= (q&0x1) << 14; /* (C3) <-- q0 */
3428	} else {
3429	env->fpus \|= 0x400; /* C2 <-- 1 */
3430	fptemp = pow(2.0, expdif-50);
3431	fpsrcop = (ST0 / ST1) / fptemp;
3432	/* fpsrcop = integer obtained by rounding to the nearest */
3433	fpsrcop = (fpsrcop-floor(fpsrcop) < ceil(fpsrcop)-fpsrcop)?
3434	floor(fpsrcop): ceil(fpsrcop);
3435	ST0 -= (ST1 * fpsrcop * fptemp);
3436	}
3437	}
3438
3439	void helper_fprem(void)
3440	{
3441	CPU86_LDouble dblq, fpsrcop, fptemp;
3442	CPU86_LDoubleU fpsrcop1, fptemp1;
3443	int expdif;
3444	int q;
3445
3446	fpsrcop = ST0;
3447	fptemp = ST1;
3448	fpsrcop1.d = fpsrcop;
3449	fptemp1.d = fptemp;
3450	expdif = EXPD(fpsrcop1) - EXPD(fptemp1);
3451	if ( expdif < 53 ) {
3452	dblq = fpsrcop / fptemp;
3453	dblq = (dblq < 0.0)? ceil(dblq): floor(dblq);
3454	ST0 = fpsrcop - fptemp*dblq;
3455	q = (int)dblq; /* cutting off top bits is assumed here */
3456	env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3457	/* (C0,C1,C3) <-- (q2,q1,q0) */
3458	env->fpus \|= (q&0x4) << 6; /* (C0) <-- q2 */
3459	env->fpus \|= (q&0x2) << 8; /* (C1) <-- q1 */
3460	env->fpus \|= (q&0x1) << 14; /* (C3) <-- q0 */
3461	} else {
3462	env->fpus \|= 0x400; /* C2 <-- 1 */
3463	fptemp = pow(2.0, expdif-50);
3464	fpsrcop = (ST0 / ST1) / fptemp;
3465	/* fpsrcop = integer obtained by chopping */
3466	fpsrcop = (fpsrcop < 0.0)?
3467	-(floor(fabs(fpsrcop))): floor(fpsrcop);
3468	ST0 -= (ST1 * fpsrcop * fptemp);
3469	}
3470	}
3471
3472	void helper_fyl2xp1(void)
3473	{
3474	CPU86_LDouble fptemp;
3475
3476	fptemp = ST0;
3477	if ((fptemp+1.0)>0.0) {
3478	fptemp = log(fptemp+1.0) / log(2.0); /* log2(ST+1.0) */
3479	ST1 *= fptemp;
3480	fpop();
3481	} else {
3482	env->fpus &= (~0x4700);
3483	env->fpus \|= 0x400;
3484	}
3485	}
3486
3487	void helper_fsqrt(void)
3488	{
3489	CPU86_LDouble fptemp;
3490
3491	fptemp = ST0;
3492	if (fptemp<0.0) {
3493	env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3494	env->fpus \|= 0x400;
3495	}
3496	ST0 = sqrt(fptemp);
3497	}
3498
3499	void helper_fsincos(void)
3500	{
3501	CPU86_LDouble fptemp;
3502
3503	fptemp = ST0;
3504	if ((fptemp > MAXTAN)\|\|(fptemp < -MAXTAN)) {
3505	env->fpus \|= 0x400;
3506	} else {
3507	ST0 = sin(fptemp);
3508	fpush();
3509	ST0 = cos(fptemp);
3510	env->fpus &= (~0x400); /* C2 <-- 0 */
3511	/* the above code is for \|arg\| < 2*63 only /
3512	}
3513	}
3514
3515	void helper_frndint(void)
3516	{
3517	ST0 = floatx_round_to_int(ST0, &env->fp_status);
3518	}
3519
3520	void helper_fscale(void)
3521	{
3522	ST0 = ldexp (ST0, (int)(ST1));
3523	}
3524
3525	void helper_fsin(void)
3526	{
3527	CPU86_LDouble fptemp;
3528
3529	fptemp = ST0;
3530	if ((fptemp > MAXTAN)\|\|(fptemp < -MAXTAN)) {
3531	env->fpus \|= 0x400;
3532	} else {
3533	ST0 = sin(fptemp);
3534	env->fpus &= (~0x400); /* C2 <-- 0 */
3535	/* the above code is for \|arg\| < 2*53 only /
3536	}
3537	}
3538
3539	void helper_fcos(void)
3540	{
3541	CPU86_LDouble fptemp;
3542
3543	fptemp = ST0;
3544	if((fptemp > MAXTAN)\|\|(fptemp < -MAXTAN)) {
3545	env->fpus \|= 0x400;
3546	} else {
3547	ST0 = cos(fptemp);
3548	env->fpus &= (~0x400); /* C2 <-- 0 */
3549	/* the above code is for \|arg5 < 2*63 only /
3550	}
3551	}
3552
3553	void helper_fxam_ST0(void)
3554	{
3555	CPU86_LDoubleU temp;
3556	int expdif;
3557
3558	temp.d = ST0;
3559
3560	env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3561	if (SIGND(temp))
3562	env->fpus \|= 0x200; /* C1 <-- 1 */
3563
3564	/* XXX: test fptags too */
3565	expdif = EXPD(temp);
3566	if (expdif == MAXEXPD) {
3567	#ifdef USE_X86LDOUBLE
3568	if (MANTD(temp) == 0x8000000000000000ULL)
3569	#else
3570	if (MANTD(temp) == 0)
3571	#endif
3572	env->fpus \|= 0x500 /Infinity/;
3573	else
3574	env->fpus \|= 0x100 /NaN/;
3575	} else if (expdif == 0) {
3576	if (MANTD(temp) == 0)
3577	env->fpus \|= 0x4000 /Zero/;
3578	else
3579	env->fpus \|= 0x4400 /Denormal/;
3580	} else {
3581	env->fpus \|= 0x400;
3582	}
3583	}
3584
3585	void helper_fstenv(target_ulong ptr, int data32)
3586	{
3587	int fpus, fptag, exp, i;
3588	uint64_t mant;
3589	CPU86_LDoubleU tmp;
3590
3591	fpus = (env->fpus & ~0x3800) \| (env->fpstt & 0x7) << 11;
3592	fptag = 0;
3593	for (i=7; i>=0; i--) {
3594	fptag <<= 2;
3595	if (env->fptags[i]) {
3596	fptag \|= 3;
3597	} else {
3598	tmp.d = env->fpregs[i].d;
3599	exp = EXPD(tmp);
3600	mant = MANTD(tmp);
3601	if (exp == 0 && mant == 0) {
3602	/* zero */
3603	fptag \|= 1;
3604	} else if (exp == 0 \|\| exp == MAXEXPD
3605	#ifdef USE_X86LDOUBLE
3606	\|\| (mant & (1LL << 63)) == 0
3607	#endif
3608	) {
3609	/* NaNs, infinity, denormal */
3610	fptag \|= 2;
3611	}
3612	}
3613	}
3614	if (data32) {
3615	/* 32 bit */
3616	stl(ptr, env->fpuc);
3617	stl(ptr + 4, fpus);
3618	stl(ptr + 8, fptag);
3619	stl(ptr + 12, 0); /* fpip */
3620	stl(ptr + 16, 0); /* fpcs */
3621	stl(ptr + 20, 0); /* fpoo */
3622	stl(ptr + 24, 0); /* fpos */
3623	} else {
3624	/* 16 bit */
3625	stw(ptr, env->fpuc);
3626	stw(ptr + 2, fpus);
3627	stw(ptr + 4, fptag);
3628	stw(ptr + 6, 0);
3629	stw(ptr + 8, 0);
3630	stw(ptr + 10, 0);
3631	stw(ptr + 12, 0);
3632	}
3633	}
3634
3635	void helper_fldenv(target_ulong ptr, int data32)
3636	{
3637	int i, fpus, fptag;
3638
3639	if (data32) {
3640	env->fpuc = lduw(ptr);
3641	fpus = lduw(ptr + 4);
3642	fptag = lduw(ptr + 8);
3643	}
3644	else {
3645	env->fpuc = lduw(ptr);
3646	fpus = lduw(ptr + 2);
3647	fptag = lduw(ptr + 4);
3648	}
3649	env->fpstt = (fpus >> 11) & 7;
3650	env->fpus = fpus & ~0x3800;
3651	for(i = 0;i < 8; i++) {
3652	env->fptags[i] = ((fptag & 3) == 3);
3653	fptag >>= 2;
3654	}
3655	}
3656
3657	void helper_fsave(target_ulong ptr, int data32)
3658	{
3659	CPU86_LDouble tmp;
3660	int i;
3661
3662	helper_fstenv(ptr, data32);
3663
3664	ptr += (14 << data32);
3665	for(i = 0;i < 8; i++) {
3666	tmp = ST(i);
3667	helper_fstt(tmp, ptr);
3668	ptr += 10;
3669	}
3670
3671	/* fninit */
3672	env->fpus = 0;
3673	env->fpstt = 0;
3674	env->fpuc = 0x37f;
3675	env->fptags[0] = 1;
3676	env->fptags[1] = 1;
3677	env->fptags[2] = 1;
3678	env->fptags[3] = 1;
3679	env->fptags[4] = 1;
3680	env->fptags[5] = 1;
3681	env->fptags[6] = 1;
3682	env->fptags[7] = 1;
3683	}
3684
3685	void helper_frstor(target_ulong ptr, int data32)
3686	{
3687	CPU86_LDouble tmp;
3688	int i;
3689
3690	helper_fldenv(ptr, data32);
3691	ptr += (14 << data32);
3692
3693	for(i = 0;i < 8; i++) {
3694	tmp = helper_fldt(ptr);
3695	ST(i) = tmp;
3696	ptr += 10;
3697	}
3698	}
3699
3700	void helper_fxsave(target_ulong ptr, int data64)
3701	{
3702	int fpus, fptag, i, nb_xmm_regs;
3703	CPU86_LDouble tmp;
3704	target_ulong addr;
3705
3706	fpus = (env->fpus & ~0x3800) \| (env->fpstt & 0x7) << 11;
3707	fptag = 0;
3708	for(i = 0; i < 8; i++) {
3709	fptag \|= (env->fptags[i] << i);
3710	}
3711	stw(ptr, env->fpuc);
3712	stw(ptr + 2, fpus);
3713	stw(ptr + 4, fptag ^ 0xff);
3714
3715	addr = ptr + 0x20;
3716	for(i = 0;i < 8; i++) {
3717	tmp = ST(i);
3718	helper_fstt(tmp, addr);
3719	addr += 16;
3720	}
3721
3722	if (env->cr[4] & CR4_OSFXSR_MASK) {
3723	/* XXX: finish it */
3724	stl(ptr + 0x18, env->mxcsr); /* mxcsr */
3725	stl(ptr + 0x1c, 0x0000ffff); /* mxcsr_mask */
3726	nb_xmm_regs = 8 << data64;
3727	addr = ptr + 0xa0;
3728	for(i = 0; i < nb_xmm_regs; i++) {
3729	stq(addr, env->xmm_regs[i].XMM_Q(0));
3730	stq(addr + 8, env->xmm_regs[i].XMM_Q(1));
3731	addr += 16;
3732	}
3733	}
3734	}
3735
3736	void helper_fxrstor(target_ulong ptr, int data64)
3737	{
3738	int i, fpus, fptag, nb_xmm_regs;
3739	CPU86_LDouble tmp;
3740	target_ulong addr;
3741
3742	env->fpuc = lduw(ptr);
3743	fpus = lduw(ptr + 2);
3744	fptag = lduw(ptr + 4);
3745	env->fpstt = (fpus >> 11) & 7;
3746	env->fpus = fpus & ~0x3800;
3747	fptag ^= 0xff;
3748	for(i = 0;i < 8; i++) {
3749	env->fptags[i] = ((fptag >> i) & 1);
3750	}
3751
3752	addr = ptr + 0x20;
3753	for(i = 0;i < 8; i++) {
3754	tmp = helper_fldt(addr);
3755	ST(i) = tmp;
3756	addr += 16;
3757	}
3758
3759	if (env->cr[4] & CR4_OSFXSR_MASK) {
3760	/* XXX: finish it */
3761	env->mxcsr = ldl(ptr + 0x18);
3762	//ldl(ptr + 0x1c);
3763	nb_xmm_regs = 8 << data64;
3764	addr = ptr + 0xa0;
3765	for(i = 0; i < nb_xmm_regs; i++) {
3766	#if !defined(VBOX) \|\| __GNUC__ < 4
3767	env->xmm_regs[i].XMM_Q(0) = ldq(addr);
3768	env->xmm_regs[i].XMM_Q(1) = ldq(addr + 8);
3769	#else /* VBOX + __GNUC__ >= 4: gcc 4.x compiler bug - it runs out of registers for the 64-bit value. */
3770	# if 1
3771	env->xmm_regs[i].XMM_L(0) = ldl(addr);
3772	env->xmm_regs[i].XMM_L(1) = ldl(addr + 4);
3773	env->xmm_regs[i].XMM_L(2) = ldl(addr + 8);
3774	env->xmm_regs[i].XMM_L(3) = ldl(addr + 12);
3775	# else
3776	/* this works fine on Mac OS X, gcc 4.0.1 */
3777	uint64_t u64 = ldq(addr);
3778	env->xmm_regs[i].XMM_Q(0);
3779	u64 = ldq(addr + 4);
3780	env->xmm_regs[i].XMM_Q(1) = u64;
3781	# endif
3782	#endif
3783	addr += 16;
3784	}
3785	}
3786	}
3787
3788	#ifndef USE_X86LDOUBLE
3789
3790	void cpu_get_fp80(uint64_t pmant, uint16_t pexp, CPU86_LDouble f)
3791	{
3792	CPU86_LDoubleU temp;
3793	int e;
3794
3795	temp.d = f;
3796	/* mantissa */
3797	*pmant = (MANTD(temp) << 11) \| (1LL << 63);
3798	/* exponent + sign */
3799	e = EXPD(temp) - EXPBIAS + 16383;
3800	e \|= SIGND(temp) >> 16;
3801	*pexp = e;
3802	}
3803
3804	CPU86_LDouble cpu_set_fp80(uint64_t mant, uint16_t upper)
3805	{
3806	CPU86_LDoubleU temp;
3807	int e;
3808	uint64_t ll;
3809
3810	/* XXX: handle overflow ? */
3811	e = (upper & 0x7fff) - 16383 + EXPBIAS; /* exponent */
3812	e \|= (upper >> 4) & 0x800; /* sign */
3813	ll = (mant >> 11) & ((1LL << 52) - 1);
3814	#ifdef __arm__
3815	temp.l.upper = (e << 20) \| (ll >> 32);
3816	temp.l.lower = ll;
3817	#else
3818	temp.ll = ll \| ((uint64_t)e << 52);
3819	#endif
3820	return temp.d;
3821	}
3822
3823	#else
3824
3825	void cpu_get_fp80(uint64_t pmant, uint16_t pexp, CPU86_LDouble f)
3826	{
3827	CPU86_LDoubleU temp;
3828
3829	temp.d = f;
3830	*pmant = temp.l.lower;
3831	*pexp = temp.l.upper;
3832	}
3833
3834	CPU86_LDouble cpu_set_fp80(uint64_t mant, uint16_t upper)
3835	{
3836	CPU86_LDoubleU temp;
3837
3838	temp.l.upper = upper;
3839	temp.l.lower = mant;
3840	return temp.d;
3841	}
3842	#endif
3843
3844	#ifdef TARGET_X86_64
3845
3846	//#define DEBUG_MULDIV
3847
3848	static void add128(uint64_t plow, uint64_t phigh, uint64_t a, uint64_t b)
3849	{
3850	*plow += a;
3851	/* carry test */
3852	if (*plow < a)
3853	(*phigh)++;
3854	*phigh += b;
3855	}
3856
3857	static void neg128(uint64_t plow, uint64_t phigh)
3858	{
3859	plow = ~ plow;
3860	phigh = ~ phigh;
3861	add128(plow, phigh, 1, 0);
3862	}
3863
3864	static void mul64(uint64_t plow, uint64_t phigh, uint64_t a, uint64_t b)
3865	{
3866	uint32_t a0, a1, b0, b1;
3867	uint64_t v;
3868
3869	a0 = a;
3870	a1 = a >> 32;
3871
3872	b0 = b;
3873	b1 = b >> 32;
3874
3875	v = (uint64_t)a0 * (uint64_t)b0;
3876	*plow = v;
3877	*phigh = 0;
3878
3879	v = (uint64_t)a0 * (uint64_t)b1;
3880	add128(plow, phigh, v << 32, v >> 32);
3881
3882	v = (uint64_t)a1 * (uint64_t)b0;
3883	add128(plow, phigh, v << 32, v >> 32);
3884
3885	v = (uint64_t)a1 * (uint64_t)b1;
3886	*phigh += v;
3887	#ifdef DEBUG_MULDIV
3888	printf("mul: 0x%016" PRIx64 " * 0x%016" PRIx64 " = 0x%016" PRIx64 "%016" PRIx64 "\n",
3889	a, b, phigh, plow);
3890	#endif
3891	}
3892
3893	static void imul64(uint64_t plow, uint64_t phigh, int64_t a, int64_t b)
3894	{
3895	int sa, sb;
3896	sa = (a < 0);
3897	if (sa)
3898	a = -a;
3899	sb = (b < 0);
3900	if (sb)
3901	b = -b;
3902	mul64(plow, phigh, a, b);
3903	if (sa ^ sb) {
3904	neg128(plow, phigh);
3905	}
3906	}
3907
3908	/* return TRUE if overflow */
3909	static int div64(uint64_t plow, uint64_t phigh, uint64_t b)
3910	{
3911	uint64_t q, r, a1, a0;
3912	int i, qb, ab;
3913
3914	a0 = *plow;
3915	a1 = *phigh;
3916	if (a1 == 0) {
3917	q = a0 / b;
3918	r = a0 % b;
3919	*plow = q;
3920	*phigh = r;
3921	} else {
3922	if (a1 >= b)
3923	return 1;
3924	/* XXX: use a better algorithm */
3925	for(i = 0; i < 64; i++) {
3926	ab = a1 >> 63;
3927	a1 = (a1 << 1) \| (a0 >> 63);
3928	if (ab \|\| a1 >= b) {
3929	a1 -= b;
3930	qb = 1;
3931	} else {
3932	qb = 0;
3933	}
3934	a0 = (a0 << 1) \| qb;
3935	}
3936	#if defined(DEBUG_MULDIV)
3937	printf("div: 0x%016" PRIx64 "%016" PRIx64 " / 0x%016" PRIx64 ": q=0x%016" PRIx64 " r=0x%016" PRIx64 "\n",
3938	phigh, plow, b, a0, a1);
3939	#endif
3940	*plow = a0;
3941	*phigh = a1;
3942	}
3943	return 0;
3944	}
3945
3946	/* return TRUE if overflow */
3947	static int idiv64(uint64_t plow, uint64_t phigh, int64_t b)
3948	{
3949	int sa, sb;
3950	sa = ((int64_t)*phigh < 0);
3951	if (sa)
3952	neg128(plow, phigh);
3953	sb = (b < 0);
3954	if (sb)
3955	b = -b;
3956	if (div64(plow, phigh, b) != 0)
3957	return 1;
3958	if (sa ^ sb) {
3959	if (*plow > (1ULL << 63))
3960	return 1;
3961	plow = - plow;
3962	} else {
3963	if (*plow >= (1ULL << 63))
3964	return 1;
3965	}
3966	if (sa)
3967	phigh = - phigh;
3968	return 0;
3969	}
3970
3971	void helper_mulq_EAX_T0(void)
3972	{
3973	uint64_t r0, r1;
3974
3975	mul64(&r0, &r1, EAX, T0);
3976	EAX = r0;
3977	EDX = r1;
3978	CC_DST = r0;
3979	CC_SRC = r1;
3980	}
3981
3982	void helper_imulq_EAX_T0(void)
3983	{
3984	uint64_t r0, r1;
3985
3986	imul64(&r0, &r1, EAX, T0);
3987	EAX = r0;
3988	EDX = r1;
3989	CC_DST = r0;
3990	CC_SRC = ((int64_t)r1 != ((int64_t)r0 >> 63));
3991	}
3992
3993	void helper_imulq_T0_T1(void)
3994	{
3995	uint64_t r0, r1;
3996
3997	imul64(&r0, &r1, T0, T1);
3998	T0 = r0;
3999	CC_DST = r0;
4000	CC_SRC = ((int64_t)r1 != ((int64_t)r0 >> 63));
4001	}
4002
4003	void helper_divq_EAX_T0(void)
4004	{
4005	uint64_t r0, r1;
4006	if (T0 == 0) {
4007	raise_exception(EXCP00_DIVZ);
4008	}
4009	r0 = EAX;
4010	r1 = EDX;
4011	if (div64(&r0, &r1, T0))
4012	raise_exception(EXCP00_DIVZ);
4013	EAX = r0;
4014	EDX = r1;
4015	}
4016
4017	void helper_idivq_EAX_T0(void)
4018	{
4019	uint64_t r0, r1;
4020	if (T0 == 0) {
4021	raise_exception(EXCP00_DIVZ);
4022	}
4023	r0 = EAX;
4024	r1 = EDX;
4025	if (idiv64(&r0, &r1, T0))
4026	raise_exception(EXCP00_DIVZ);
4027	EAX = r0;
4028	EDX = r1;
4029	}
4030
4031	void helper_bswapq_T0(void)
4032	{
4033	T0 = bswap64(T0);
4034	}
4035	#endif
4036
4037	void helper_hlt(void)
4038	{
4039	env->hflags &= ~HF_INHIBIT_IRQ_MASK; /* needed if sti is just before */
4040	env->hflags \|= HF_HALTED_MASK;
4041	env->exception_index = EXCP_HLT;
4042	cpu_loop_exit();
4043	}
4044
4045	void helper_monitor(void)
4046	{
4047	if ((uint32_t)ECX != 0)
4048	raise_exception(EXCP0D_GPF);
4049	/* XXX: store address ? */
4050	}
4051
4052	void helper_mwait(void)
4053	{
4054	if ((uint32_t)ECX != 0)
4055	raise_exception(EXCP0D_GPF);
4056	#ifdef VBOX
4057	helper_hlt();
4058	#else
4059	/* XXX: not complete but not completely erroneous */
4060	if (env->cpu_index != 0 \|\| env->next_cpu != NULL) {
4061	/* more than one CPU: do not sleep because another CPU may
4062	wake this one */
4063	} else {
4064	helper_hlt();
4065	}
4066	#endif
4067	}
4068
4069	float approx_rsqrt(float a)
4070	{
4071	return 1.0 / sqrt(a);
4072	}
4073
4074	float approx_rcp(float a)
4075	{
4076	return 1.0 / a;
4077	}
4078
4079	void update_fp_status(void)
4080	{
4081	int rnd_type;
4082
4083	/* set rounding mode */
4084	switch(env->fpuc & RC_MASK) {
4085	default:
4086	case RC_NEAR:
4087	rnd_type = float_round_nearest_even;
4088	break;
4089	case RC_DOWN:
4090	rnd_type = float_round_down;
4091	break;
4092	case RC_UP:
4093	rnd_type = float_round_up;
4094	break;
4095	case RC_CHOP:
4096	rnd_type = float_round_to_zero;
4097	break;
4098	}
4099	set_float_rounding_mode(rnd_type, &env->fp_status);
4100	#ifdef FLOATX80
4101	switch((env->fpuc >> 8) & 3) {
4102	case 0:
4103	rnd_type = 32;
4104	break;
4105	case 2:
4106	rnd_type = 64;
4107	break;
4108	case 3:
4109	default:
4110	rnd_type = 80;
4111	break;
4112	}
4113	set_floatx80_rounding_precision(rnd_type, &env->fp_status);
4114	#endif
4115	}
4116
4117	#if !defined(CONFIG_USER_ONLY)
4118
4119	#define MMUSUFFIX _mmu
4120	#define GETPC() (__builtin_return_address(0))
4121
4122	#define SHIFT 0
4123	#include "softmmu_template.h"
4124
4125	#define SHIFT 1
4126	#include "softmmu_template.h"
4127
4128	#define SHIFT 2
4129	#include "softmmu_template.h"
4130
4131	#define SHIFT 3
4132	#include "softmmu_template.h"
4133
4134	#endif
4135
4136	/* try to fill the TLB and return an exception if error. If retaddr is
4137	NULL, it means that the function was called in C code (i.e. not
4138	from generated code or from helper.c) */
4139	/* XXX: fix it to restore all registers */
4140	void tlb_fill(target_ulong addr, int is_write, int is_user, void *retaddr)
4141	{
4142	TranslationBlock *tb;
4143	int ret;
4144	unsigned long pc;
4145	CPUX86State *saved_env;
4146
4147	/* XXX: hack to restore env in all cases, even if not called from
4148	generated code */
4149	saved_env = env;
4150	env = cpu_single_env;
4151
4152	ret = cpu_x86_handle_mmu_fault(env, addr, is_write, is_user, 1);
4153	if (ret) {
4154	if (retaddr) {
4155	/* now we have a real cpu fault */
4156	pc = (unsigned long)retaddr;
4157	tb = tb_find_pc(pc);
4158	if (tb) {
4159	/* the PC is inside the translated code. It means that we have
4160	a virtual CPU fault */
4161	cpu_restore_state(tb, env, pc, NULL);
4162	}
4163	}
4164	if (retaddr)
4165	raise_exception_err(env->exception_index, env->error_code);
4166	else
4167	raise_exception_err_norestore(env->exception_index, env->error_code);
4168	}
4169	env = saved_env;
4170	}
4171
4172	#ifdef VBOX
4173
4174	/**
4175	* Correctly computes the eflags.
4176	* @returns eflags.
4177	* @param env1 CPU environment.
4178	*/
4179	uint32_t raw_compute_eflags(CPUX86State *env1)
4180	{
4181	CPUX86State *savedenv = env;
4182	env = env1;
4183	uint32_t efl = compute_eflags();
4184	env = savedenv;
4185	return efl;
4186	}
4187
4188	/**
4189	* Reads byte from virtual address in guest memory area.
4190	* XXX: is it working for any addresses? swapped out pages?
4191	* @returns readed data byte.
4192	* @param env1 CPU environment.
4193	* @param pvAddr GC Virtual address.
4194	*/
4195	uint8_t read_byte(CPUX86State *env1, target_ulong addr)
4196	{
4197	CPUX86State *savedenv = env;
4198	env = env1;
4199	uint8_t u8 = ldub_kernel(addr);
4200	env = savedenv;
4201	return u8;
4202	}
4203
4204	/**
4205	* Reads byte from virtual address in guest memory area.
4206	* XXX: is it working for any addresses? swapped out pages?
4207	* @returns readed data byte.
4208	* @param env1 CPU environment.
4209	* @param pvAddr GC Virtual address.
4210	*/
4211	uint16_t read_word(CPUX86State *env1, target_ulong addr)
4212	{
4213	CPUX86State *savedenv = env;
4214	env = env1;
4215	uint16_t u16 = lduw_kernel(addr);
4216	env = savedenv;
4217	return u16;
4218	}
4219
4220	/**
4221	* Reads byte from virtual address in guest memory area.
4222	* XXX: is it working for any addresses? swapped out pages?
4223	* @returns readed data byte.
4224	* @param env1 CPU environment.
4225	* @param pvAddr GC Virtual address.
4226	*/
4227	uint32_t read_dword(CPUX86State *env1, target_ulong addr)
4228	{
4229	CPUX86State *savedenv = env;
4230	env = env1;
4231	uint32_t u32 = ldl_kernel(addr);
4232	env = savedenv;
4233	return u32;
4234	}
4235
4236	/**
4237	* Writes byte to virtual address in guest memory area.
4238	* XXX: is it working for any addresses? swapped out pages?
4239	* @returns readed data byte.
4240	* @param env1 CPU environment.
4241	* @param pvAddr GC Virtual address.
4242	* @param val byte value
4243	*/
4244	void write_byte(CPUX86State *env1, target_ulong addr, uint8_t val)
4245	{
4246	CPUX86State *savedenv = env;
4247	env = env1;
4248	stb(addr, val);
4249	env = savedenv;
4250	}
4251
4252	void write_word(CPUX86State *env1, target_ulong addr, uint16_t val)
4253	{
4254	CPUX86State *savedenv = env;
4255	env = env1;
4256	stw(addr, val);
4257	env = savedenv;
4258	}
4259
4260	void write_dword(CPUX86State *env1, target_ulong addr, uint32_t val)
4261	{
4262	CPUX86State *savedenv = env;
4263	env = env1;
4264	stl(addr, val);
4265	env = savedenv;
4266	}
4267
4268	/**
4269	* Correctly loads selector into segment register with updating internal
4270	* qemu data/caches.
4271	* @param env1 CPU environment.
4272	* @param seg_reg Segment register.
4273	* @param selector Selector to load.
4274	*/
4275	void sync_seg(CPUX86State *env1, int seg_reg, int selector)
4276	{
4277	CPUX86State *savedenv = env;
4278	env = env1;
4279
4280	if ( env->eflags & X86_EFL_VM
4281	\|\| !(env->cr[0] & X86_CR0_PE))
4282	{
4283	load_seg_vm(seg_reg, selector);
4284
4285	env = savedenv;
4286
4287	/* Successful sync. */
4288	env1->segs[seg_reg].newselector = 0;
4289	}
4290	else
4291	{
4292	if (setjmp(env1->jmp_env) == 0)
4293	{
4294	if (seg_reg == R_CS)
4295	{
4296	uint32_t e1, e2;
4297	load_segment(&e1, &e2, selector);
4298	cpu_x86_load_seg_cache(env, R_CS, selector,
4299	get_seg_base(e1, e2),
4300	get_seg_limit(e1, e2),
4301	e2);
4302	}
4303	else
4304	load_seg(seg_reg, selector);
4305	env = savedenv;
4306
4307	/* Successful sync. */
4308	env1->segs[seg_reg].newselector = 0;
4309	}
4310	else
4311	{
4312	env = savedenv;
4313
4314	/* Postpone sync until the guest uses the selector. */
4315	env1->segs[seg_reg].selector = selector; /* hidden values are now incorrect, but will be resynced when this register is accessed. */
4316	env1->segs[seg_reg].newselector = selector;
4317	Log(("sync_seg: out of sync seg_reg=%d selector=%#x\n", seg_reg, selector));
4318	}
4319	}
4320
4321	}
4322
4323
4324	/**
4325	* Correctly loads a new ldtr selector.
4326	*
4327	* @param env1 CPU environment.
4328	* @param selector Selector to load.
4329	*/
4330	void sync_ldtr(CPUX86State *env1, int selector)
4331	{
4332	CPUX86State *saved_env = env;
4333	target_ulong saved_T0 = T0;
4334	if (setjmp(env1->jmp_env) == 0)
4335	{
4336	env = env1;
4337	T0 = selector;
4338	helper_lldt_T0();
4339	T0 = saved_T0;
4340	env = saved_env;
4341	}
4342	else
4343	{
4344	T0 = saved_T0;
4345	env = saved_env;
4346	#ifdef VBOX_STRICT
4347	cpu_abort(env1, "sync_ldtr: selector=%#x\n", selector);
4348	#endif
4349	}
4350	}
4351
4352	/**
4353	* Correctly loads a new tr selector.
4354	*
4355	* @param env1 CPU environment.
4356	* @param selector Selector to load.
4357	*/
4358	int sync_tr(CPUX86State *env1, int selector)
4359	{
4360	/* ARG! this was going to call helper_ltr_T0 but that won't work because of busy flag. */
4361	SegmentCache *dt;
4362	uint32_t e1, e2;
4363	int index, type, entry_limit;
4364	target_ulong ptr;
4365	CPUX86State *saved_env = env;
4366	env = env1;
4367
4368	selector &= 0xffff;
4369	if ((selector & 0xfffc) == 0) {
4370	/* NULL selector case: invalid TR */
4371	env->tr.base = 0;
4372	env->tr.limit = 0;
4373	env->tr.flags = 0;
4374	} else {
4375	if (selector & 0x4)
4376	goto l_failure;
4377	dt = &env->gdt;
4378	index = selector & ~7;
4379	#ifdef TARGET_X86_64
4380	if (env->hflags & HF_LMA_MASK)
4381	entry_limit = 15;
4382	else
4383	#endif
4384	entry_limit = 7;
4385	if ((index + entry_limit) > dt->limit)
4386	goto l_failure;
4387	ptr = dt->base + index;
4388	e1 = ldl_kernel(ptr);
4389	e2 = ldl_kernel(ptr + 4);
4390	type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
4391	if ((e2 & DESC_S_MASK) /*\|\|
4392	(type != 1 && type != 9)*/)
4393	goto l_failure;
4394	if (!(e2 & DESC_P_MASK))
4395	goto l_failure;
4396	#ifdef TARGET_X86_64
4397	if (env->hflags & HF_LMA_MASK) {
4398	uint32_t e3;
4399	e3 = ldl_kernel(ptr + 8);
4400	load_seg_cache_raw_dt(&env->tr, e1, e2);
4401	env->tr.base \|= (target_ulong)e3 << 32;
4402	} else
4403	#endif
4404	{
4405	load_seg_cache_raw_dt(&env->tr, e1, e2);
4406	}
4407	e2 \|= DESC_TSS_BUSY_MASK;
4408	stl_kernel(ptr + 4, e2);
4409	}
4410	env->tr.selector = selector;
4411
4412	env = saved_env;
4413	return 0;
4414	l_failure:
4415	AssertMsgFailed(("selector=%d\n", selector));
4416	return -1;
4417	}
4418
4419	int emulate_single_instr(CPUX86State *env1)
4420	{
4421	#if 1 /* single stepping is broken when using a static tb... feel free to figure out why. :-) */
4422	/* This has to be static because it needs to be addressible
4423	using 32-bit immediate addresses on 64-bit machines. This
4424	is dictated by the gcc code model used when building this
4425	module / op.o. Using a static here pushes the problem
4426	onto the module loader. */
4427	static TranslationBlock tb_temp;
4428	#endif
4429	TranslationBlock *tb;
4430	TranslationBlock *current;
4431	int csize;
4432	void (*gen_func)(void);
4433	uint8_t *tc_ptr;
4434	uint32_t old_eip;
4435
4436	/* ensures env is loaded in ebp! */
4437	CPUX86State *savedenv = env;
4438	env = env1;
4439
4440	RAWEx_ProfileStart(env, STATS_EMULATE_SINGLE_INSTR);
4441
4442	#if 1 /* see above */
4443	tc_ptr = env->pvCodeBuffer;
4444	#else
4445	tc_ptr = code_gen_ptr;
4446	#endif
4447
4448	/*
4449	* Setup temporary translation block.
4450	*/
4451	/* tb_alloc: */
4452	#if 1 /* see above */
4453	tb = &tb_temp;
4454	tb->pc = env->segs[R_CS].base + env->eip;
4455	tb->cflags = 0;
4456	#else
4457	tb = tb_alloc(env->segs[R_CS].base + env->eip);
4458	if (!tb)
4459	{
4460	tb_flush(env);
4461	tb = tb_alloc(env->segs[R_CS].base + env->eip);
4462	}
4463	#endif
4464
4465	/* tb_find_slow: */
4466	tb->tc_ptr = tc_ptr;
4467	tb->cs_base = env->segs[R_CS].base;
4468	tb->flags = env->hflags \| (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
4469
4470	/* Initialize the rest with sensible values. */
4471	tb->size = 0;
4472	tb->phys_hash_next = NULL;
4473	tb->page_next[0] = NULL;
4474	tb->page_next[1] = NULL;
4475	tb->page_addr[0] = 0;
4476	tb->page_addr[1] = 0;
4477	tb->tb_next_offset[0] = 0xffff;
4478	tb->tb_next_offset[1] = 0xffff;
4479	tb->tb_next[0] = 0xffff;
4480	tb->tb_next[1] = 0xffff;
4481	tb->jmp_next[0] = NULL;
4482	tb->jmp_next[1] = NULL;
4483	tb->jmp_first = NULL;
4484
4485	current = env->current_tb;
4486	env->current_tb = NULL;
4487
4488	/*
4489	* Translate only one instruction.
4490	*/
4491	ASMAtomicOrU32(&env->state, CPU_EMULATE_SINGLE_INSTR);
4492	if (cpu_gen_code(env, tb, env->cbCodeBuffer, &csize) < 0)
4493	{
4494	AssertFailed();
4495	RAWEx_ProfileStop(env, STATS_EMULATE_SINGLE_INSTR);
4496	ASMAtomicAndU32(&env->state, ~CPU_EMULATE_SINGLE_INSTR);
4497	env = savedenv;
4498	return -1;
4499	}
4500	#ifdef DEBUG
4501	if(csize > env->cbCodeBuffer)
4502	{
4503	RAWEx_ProfileStop(env, STATS_EMULATE_SINGLE_INSTR);
4504	AssertFailed();
4505	ASMAtomicAndU32(&env->state, ~CPU_EMULATE_SINGLE_INSTR);
4506	env = savedenv;
4507	return -1;
4508	}
4509	if (tb->tc_ptr != tc_ptr)
4510	{
4511	RAWEx_ProfileStop(env, STATS_EMULATE_SINGLE_INSTR);
4512	AssertFailed();
4513	ASMAtomicAndU32(&env->state, ~CPU_EMULATE_SINGLE_INSTR);
4514	env = savedenv;
4515	return -1;
4516	}
4517	#endif
4518	ASMAtomicAndU32(&env->state, ~CPU_EMULATE_SINGLE_INSTR);
4519
4520	/* tb_link_phys: */
4521	tb->jmp_first = (TranslationBlock *)((intptr_t)tb \| 2);
4522	Assert(tb->jmp_next[0] == NULL); Assert(tb->jmp_next[1] == NULL);
4523	if (tb->tb_next_offset[0] != 0xffff)
4524	tb_set_jmp_target(tb, 0, (uintptr_t)(tb->tc_ptr + tb->tb_next_offset[0]));
4525	if (tb->tb_next_offset[1] != 0xffff)
4526	tb_set_jmp_target(tb, 1, (uintptr_t)(tb->tc_ptr + tb->tb_next_offset[1]));
4527
4528	/*
4529	* Execute it using emulation
4530	*/
4531	old_eip = env->eip;
4532	gen_func = (void *)tb->tc_ptr;
4533	env->current_tb = tb;
4534
4535	// eip remains the same for repeated instructions; no idea why qemu doesn't do a jump inside the generated code
4536	// perhaps not a very safe hack
4537	while(old_eip == env->eip)
4538	{
4539	gen_func();
4540	/*
4541	* Exit once we detect an external interrupt and interrupts are enabled
4542	*/
4543	if( (env->interrupt_request & (CPU_INTERRUPT_EXTERNAL_EXIT\|CPU_INTERRUPT_EXTERNAL_TIMER)) \|\|
4544	( (env->eflags & IF_MASK) &&
4545	!(env->hflags & HF_INHIBIT_IRQ_MASK) &&
4546	(env->interrupt_request & CPU_INTERRUPT_EXTERNAL_HARD) ) )
4547	{
4548	break;
4549	}
4550	}
4551	env->current_tb = current;
4552
4553	Assert(tb->phys_hash_next == NULL);
4554	Assert(tb->page_next[0] == NULL);
4555	Assert(tb->page_next[1] == NULL);
4556	Assert(tb->page_addr[0] == 0);
4557	Assert(tb->page_addr[1] == 0);
4558	/*
4559	Assert(tb->tb_next_offset[0] == 0xffff);
4560	Assert(tb->tb_next_offset[1] == 0xffff);
4561	Assert(tb->tb_next[0] == 0xffff);
4562	Assert(tb->tb_next[1] == 0xffff);
4563	Assert(tb->jmp_next[0] == NULL);
4564	Assert(tb->jmp_next[1] == NULL);
4565	Assert(tb->jmp_first == NULL); */
4566
4567	RAWEx_ProfileStop(env, STATS_EMULATE_SINGLE_INSTR);
4568
4569	/*
4570	* Execute the next instruction when we encounter instruction fusing.
4571	*/
4572	if (env->hflags & HF_INHIBIT_IRQ_MASK)
4573	{
4574	Log(("REM: Emulating next instruction due to instruction fusing (HF_INHIBIT_IRQ_MASK)\n"));
4575	env->hflags &= ~HF_INHIBIT_IRQ_MASK;
4576	emulate_single_instr(env);
4577	}
4578
4579	env = savedenv;
4580	return 0;
4581	}
4582
4583	int get_ss_esp_from_tss_raw(CPUX86State env1, uint32_t ss_ptr,
4584	uint32_t *esp_ptr, int dpl)
4585	{
4586	int type, index, shift;
4587
4588	CPUX86State *savedenv = env;
4589	env = env1;
4590
4591	if (!(env->tr.flags & DESC_P_MASK))
4592	cpu_abort(env, "invalid tss");
4593	type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
4594	if ((type & 7) != 1)
4595	cpu_abort(env, "invalid tss type %d", type);
4596	shift = type >> 3;
4597	index = (dpl * 4 + 2) << shift;
4598	if (index + (4 << shift) - 1 > env->tr.limit)
4599	{
4600	env = savedenv;
4601	return 0;
4602	}
4603	//raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
4604
4605	if (shift == 0) {
4606	*esp_ptr = lduw_kernel(env->tr.base + index);
4607	*ss_ptr = lduw_kernel(env->tr.base + index + 2);
4608	} else {
4609	*esp_ptr = ldl_kernel(env->tr.base + index);
4610	*ss_ptr = lduw_kernel(env->tr.base + index + 4);
4611	}
4612
4613	env = savedenv;
4614	return 1;
4615	}
4616
4617	//*****************************************************************************
4618	// Needs to be at the bottom of the file (overriding macros)
4619
4620	static inline CPU86_LDouble helper_fldt_raw(uint8_t *ptr)
4621	{
4622	return (CPU86_LDouble )ptr;
4623	}
4624
4625	static inline void helper_fstt_raw(CPU86_LDouble f, uint8_t *ptr)
4626	{
4627	(CPU86_LDouble )ptr = f;
4628	}
4629
4630	#undef stw
4631	#undef stl
4632	#undef stq
4633	#define stw(a,b) (uint16_t )(a) = (uint16_t)(b)
4634	#define stl(a,b) (uint32_t )(a) = (uint32_t)(b)
4635	#define stq(a,b) (uint64_t )(a) = (uint64_t)(b)
4636	#define data64 0
4637
4638	//*****************************************************************************
4639	void restore_raw_fp_state(CPUX86State env, uint8_t ptr)
4640	{
4641	int fpus, fptag, i, nb_xmm_regs;
4642	CPU86_LDouble tmp;
4643	uint8_t *addr;
4644
4645	if (env->cpuid_features & CPUID_FXSR)
4646	{
4647	fpus = (env->fpus & ~0x3800) \| (env->fpstt & 0x7) << 11;
4648	fptag = 0;
4649	for(i = 0; i < 8; i++) {
4650	fptag \|= (env->fptags[i] << i);
4651	}
4652	stw(ptr, env->fpuc);
4653	stw(ptr + 2, fpus);
4654	stw(ptr + 4, fptag ^ 0xff);
4655
4656	addr = ptr + 0x20;
4657	for(i = 0;i < 8; i++) {
4658	tmp = ST(i);
4659	helper_fstt_raw(tmp, addr);
4660	addr += 16;
4661	}
4662
4663	if (env->cr[4] & CR4_OSFXSR_MASK) {
4664	/* XXX: finish it */
4665	stl(ptr + 0x18, env->mxcsr); /* mxcsr */
4666	stl(ptr + 0x1c, 0x0000ffff); /* mxcsr_mask */
4667	nb_xmm_regs = 8 << data64;
4668	addr = ptr + 0xa0;
4669	for(i = 0; i < nb_xmm_regs; i++) {
4670	#if __GNUC__ < 4
4671	stq(addr, env->xmm_regs[i].XMM_Q(0));
4672	stq(addr + 8, env->xmm_regs[i].XMM_Q(1));
4673	#else /* VBOX + __GNUC__ >= 4: gcc 4.x compiler bug - it runs out of registers for the 64-bit value. */
4674	stl(addr, env->xmm_regs[i].XMM_L(0));
4675	stl(addr + 4, env->xmm_regs[i].XMM_L(1));
4676	stl(addr + 8, env->xmm_regs[i].XMM_L(2));
4677	stl(addr + 12, env->xmm_regs[i].XMM_L(3));
4678	#endif
4679	addr += 16;
4680	}
4681	}
4682	}
4683	else
4684	{
4685	PX86FPUSTATE fp = (PX86FPUSTATE)ptr;
4686	int fptag;
4687
4688	fp->FCW = env->fpuc;
4689	fp->FSW = (env->fpus & ~0x3800) \| (env->fpstt & 0x7) << 11;
4690	fptag = 0;
4691	for (i=7; i>=0; i--) {
4692	fptag <<= 2;
4693	if (env->fptags[i]) {
4694	fptag \|= 3;
4695	} else {
4696	/* the FPU automatically computes it */
4697	}
4698	}
4699	fp->FTW = fptag;
4700
4701	for(i = 0;i < 8; i++) {
4702	tmp = ST(i);
4703	helper_fstt_raw(tmp, &fp->regs[i].reg[0]);
4704	}
4705	}
4706	}
4707
4708	//*****************************************************************************
4709	#undef lduw
4710	#undef ldl
4711	#undef ldq
4712	#define lduw(a) (uint16_t )(a)
4713	#define ldl(a) (uint32_t )(a)
4714	#define ldq(a) (uint64_t )(a)
4715	//*****************************************************************************
4716	void save_raw_fp_state(CPUX86State env, uint8_t ptr)
4717	{
4718	int i, fpus, fptag, nb_xmm_regs;
4719	CPU86_LDouble tmp;
4720	uint8_t *addr;
4721
4722	if (env->cpuid_features & CPUID_FXSR)
4723	{
4724	env->fpuc = lduw(ptr);
4725	fpus = lduw(ptr + 2);
4726	fptag = lduw(ptr + 4);
4727	env->fpstt = (fpus >> 11) & 7;
4728	env->fpus = fpus & ~0x3800;
4729	fptag ^= 0xff;
4730	for(i = 0;i < 8; i++) {
4731	env->fptags[i] = ((fptag >> i) & 1);
4732	}
4733
4734	addr = ptr + 0x20;
4735	for(i = 0;i < 8; i++) {
4736	tmp = helper_fldt_raw(addr);
4737	ST(i) = tmp;
4738	addr += 16;
4739	}
4740
4741	if (env->cr[4] & CR4_OSFXSR_MASK) {
4742	/* XXX: finish it, endianness */
4743	env->mxcsr = ldl(ptr + 0x18);
4744	//ldl(ptr + 0x1c);
4745	nb_xmm_regs = 8 << data64;
4746	addr = ptr + 0xa0;
4747	for(i = 0; i < nb_xmm_regs; i++) {
4748	env->xmm_regs[i].XMM_Q(0) = ldq(addr);
4749	env->xmm_regs[i].XMM_Q(1) = ldq(addr + 8);
4750	addr += 16;
4751	}
4752	}
4753	}
4754	else
4755	{
4756	PX86FPUSTATE fp = (PX86FPUSTATE)ptr;
4757	int fptag, j;
4758
4759	env->fpuc = fp->FCW;
4760	env->fpstt = (fp->FSW >> 11) & 7;
4761	env->fpus = fp->FSW & ~0x3800;
4762	fptag = fp->FTW;
4763	for(i = 0;i < 8; i++) {
4764	env->fptags[i] = ((fptag & 3) == 3);
4765	fptag >>= 2;
4766	}
4767	j = env->fpstt;
4768	for(i = 0;i < 8; i++) {
4769	tmp = helper_fldt_raw(&fp->regs[i].reg[0]);
4770	ST(i) = tmp;
4771	}
4772	}
4773	}
4774	//*****************************************************************************
4775	//*****************************************************************************
4776
4777	#endif /* VBOX */
4778

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/recompiler/target-i386/helper.c@ 5853

Download in other formats: