?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s390-virtio: use specific endian ld/st_phys
[qemu/v9fs2.git] / target-i386 / op_helper.c
blob315e18b9a4c3f1e2e6962f433e754810574b9867
1 /*
2 * i386 helpers
3 *
4 * Copyright (c) 2003 Fabrice Bellard
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include <math.h>
21 #include "exec.h"
22 #include "host-utils.h"
23 #include "ioport.h"
24
25 //#define DEBUG_PCALL
26
27
28 #ifdef DEBUG_PCALL
29 # define LOG_PCALL(...) qemu_log_mask(CPU_LOG_PCALL, ## __VA_ARGS__)
30 # define LOG_PCALL_STATE(env) \
31 log_cpu_state_mask(CPU_LOG_PCALL, (env), X86_DUMP_CCOP)
32 #else
33 # define LOG_PCALL(...) do { } while (0)
34 # define LOG_PCALL_STATE(env) do { } while (0)
35 #endif
36
37
38 #if 0
39 #define raise_exception_err(a, b)\
40 do {\
41 qemu_log("raise_exception line=%d\n", __LINE__);\
42 (raise_exception_err)(a, b);\
43 } while (0)
44 #endif
45
46 static const uint8_t parity_table[256] = {
47 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
48 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
49 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
50 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
51 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
52 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
53 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
54 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
55 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
56 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
57 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
58 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
59 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
60 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
61 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
62 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
63 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
64 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
65 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
66 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
67 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
68 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
69 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
70 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
71 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
72 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
73 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
74 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
75 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
76 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
77 CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
78 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
79 };
80
81 /* modulo 17 table */
82 static const uint8_t rclw_table[32] = {
83 0, 1, 2, 3, 4, 5, 6, 7,
84 8, 9,10,11,12,13,14,15,
85 16, 0, 1, 2, 3, 4, 5, 6,
86 7, 8, 9,10,11,12,13,14,
87 };
88
89 /* modulo 9 table */
90 static const uint8_t rclb_table[32] = {
91 0, 1, 2, 3, 4, 5, 6, 7,
92 8, 0, 1, 2, 3, 4, 5, 6,
93 7, 8, 0, 1, 2, 3, 4, 5,
94 6, 7, 8, 0, 1, 2, 3, 4,
95 };
96
97 #define floatx80_lg2 make_floatx80( 0x3ffd, 0x9a209a84fbcff799LL )
98 #define floatx80_l2e make_floatx80( 0x3fff, 0xb8aa3b295c17f0bcLL )
99 #define floatx80_l2t make_floatx80( 0x4000, 0xd49a784bcd1b8afeLL )
100
101 /* broken thread support */
102
103 static spinlock_t global_cpu_lock = SPIN_LOCK_UNLOCKED;
104
105 void helper_lock(void)
106 {
107 spin_lock(&global_cpu_lock);
108 }
109
110 void helper_unlock(void)
111 {
112 spin_unlock(&global_cpu_lock);
113 }
114
115 void helper_write_eflags(target_ulong t0, uint32_t update_mask)
116 {
117 load_eflags(t0, update_mask);
118 }
119
120 target_ulong helper_read_eflags(void)
121 {
122 uint32_t eflags;
123 eflags = helper_cc_compute_all(CC_OP);
124 eflags |= (DF & DF_MASK);
125 eflags |= env->eflags & ~(VM_MASK | RF_MASK);
126 return eflags;
127 }
128
129 /* return non zero if error */
130 static inline int load_segment(uint32_t *e1_ptr, uint32_t *e2_ptr,
131 int selector)
132 {
133 SegmentCache *dt;
134 int index;
135 target_ulong ptr;
136
137 if (selector & 0x4)
138 dt = &env->ldt;
139 else
140 dt = &env->gdt;
141 index = selector & ~7;
142 if ((index + 7) > dt->limit)
143 return -1;
144 ptr = dt->base + index;
145 *e1_ptr = ldl_kernel(ptr);
146 *e2_ptr = ldl_kernel(ptr + 4);
147 return 0;
148 }
149
150 static inline unsigned int get_seg_limit(uint32_t e1, uint32_t e2)
151 {
152 unsigned int limit;
153 limit = (e1 & 0xffff) | (e2 & 0x000f0000);
154 if (e2 & DESC_G_MASK)
155 limit = (limit << 12) | 0xfff;
156 return limit;
157 }
158
159 static inline uint32_t get_seg_base(uint32_t e1, uint32_t e2)
160 {
161 return ((e1 >> 16) | ((e2 & 0xff) << 16) | (e2 & 0xff000000));
162 }
163
164 static inline void load_seg_cache_raw_dt(SegmentCache *sc, uint32_t e1, uint32_t e2)
165 {
166 sc->base = get_seg_base(e1, e2);
167 sc->limit = get_seg_limit(e1, e2);
168 sc->flags = e2;
169 }
170
171 /* init the segment cache in vm86 mode. */
172 static inline void load_seg_vm(int seg, int selector)
173 {
174 selector &= 0xffff;
175 cpu_x86_load_seg_cache(env, seg, selector,
176 (selector << 4), 0xffff, 0);
177 }
178
179 static inline void get_ss_esp_from_tss(uint32_t *ss_ptr,
180 uint32_t *esp_ptr, int dpl)
181 {
182 int type, index, shift;
183
184 #if 0
185 {
186 int i;
187 printf("TR: base=%p limit=%x\n", env->tr.base, env->tr.limit);
188 for(i=0;i<env->tr.limit;i++) {
189 printf("%02x ", env->tr.base[i]);
190 if ((i & 7) == 7) printf("\n");
191 }
192 printf("\n");
193 }
194 #endif
195
196 if (!(env->tr.flags & DESC_P_MASK))
197 cpu_abort(env, "invalid tss");
198 type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
199 if ((type & 7) != 1)
200 cpu_abort(env, "invalid tss type");
201 shift = type >> 3;
202 index = (dpl * 4 + 2) << shift;
203 if (index + (4 << shift) - 1 > env->tr.limit)
204 raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
205 if (shift == 0) {
206 *esp_ptr = lduw_kernel(env->tr.base + index);
207 *ss_ptr = lduw_kernel(env->tr.base + index + 2);
208 } else {
209 *esp_ptr = ldl_kernel(env->tr.base + index);
210 *ss_ptr = lduw_kernel(env->tr.base + index + 4);
211 }
212 }
213
214 /* XXX: merge with load_seg() */
215 static void tss_load_seg(int seg_reg, int selector)
216 {
217 uint32_t e1, e2;
218 int rpl, dpl, cpl;
219
220 if ((selector & 0xfffc) != 0) {
221 if (load_segment(&e1, &e2, selector) != 0)
222 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
223 if (!(e2 & DESC_S_MASK))
224 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
225 rpl = selector & 3;
226 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
227 cpl = env->hflags & HF_CPL_MASK;
228 if (seg_reg == R_CS) {
229 if (!(e2 & DESC_CS_MASK))
230 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
231 /* XXX: is it correct ? */
232 if (dpl != rpl)
233 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
234 if ((e2 & DESC_C_MASK) && dpl > rpl)
235 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
236 } else if (seg_reg == R_SS) {
237 /* SS must be writable data */
238 if ((e2 & DESC_CS_MASK) || !(e2 & DESC_W_MASK))
239 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
240 if (dpl != cpl || dpl != rpl)
241 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
242 } else {
243 /* not readable code */
244 if ((e2 & DESC_CS_MASK) && !(e2 & DESC_R_MASK))
245 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
246 /* if data or non conforming code, checks the rights */
247 if (((e2 >> DESC_TYPE_SHIFT) & 0xf) < 12) {
248 if (dpl < cpl || dpl < rpl)
249 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
250 }
251 }
252 if (!(e2 & DESC_P_MASK))
253 raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
254 cpu_x86_load_seg_cache(env, seg_reg, selector,
255 get_seg_base(e1, e2),
256 get_seg_limit(e1, e2),
257 e2);
258 } else {
259 if (seg_reg == R_SS || seg_reg == R_CS)
260 raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
261 }
262 }
263
264 #define SWITCH_TSS_JMP 0
265 #define SWITCH_TSS_IRET 1
266 #define SWITCH_TSS_CALL 2
267
268 /* XXX: restore CPU state in registers (PowerPC case) */
269 static void switch_tss(int tss_selector,
270 uint32_t e1, uint32_t e2, int source,
271 uint32_t next_eip)
272 {
273 int tss_limit, tss_limit_max, type, old_tss_limit_max, old_type, v1, v2, i;
274 target_ulong tss_base;
275 uint32_t new_regs[8], new_segs[6];
276 uint32_t new_eflags, new_eip, new_cr3, new_ldt, new_trap;
277 uint32_t old_eflags, eflags_mask;
278 SegmentCache *dt;
279 int index;
280 target_ulong ptr;
281
282 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
283 LOG_PCALL("switch_tss: sel=0x%04x type=%d src=%d\n", tss_selector, type, source);
284
285 /* if task gate, we read the TSS segment and we load it */
286 if (type == 5) {
287 if (!(e2 & DESC_P_MASK))
288 raise_exception_err(EXCP0B_NOSEG, tss_selector & 0xfffc);
289 tss_selector = e1 >> 16;
290 if (tss_selector & 4)
291 raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
292 if (load_segment(&e1, &e2, tss_selector) != 0)
293 raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
294 if (e2 & DESC_S_MASK)
295 raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
296 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
297 if ((type & 7) != 1)
298 raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
299 }
300
301 if (!(e2 & DESC_P_MASK))
302 raise_exception_err(EXCP0B_NOSEG, tss_selector & 0xfffc);
303
304 if (type & 8)
305 tss_limit_max = 103;
306 else
307 tss_limit_max = 43;
308 tss_limit = get_seg_limit(e1, e2);
309 tss_base = get_seg_base(e1, e2);
310 if ((tss_selector & 4) != 0 ||
311 tss_limit < tss_limit_max)
312 raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
313 old_type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
314 if (old_type & 8)
315 old_tss_limit_max = 103;
316 else
317 old_tss_limit_max = 43;
318
319 /* read all the registers from the new TSS */
320 if (type & 8) {
321 /* 32 bit */
322 new_cr3 = ldl_kernel(tss_base + 0x1c);
323 new_eip = ldl_kernel(tss_base + 0x20);
324 new_eflags = ldl_kernel(tss_base + 0x24);
325 for(i = 0; i < 8; i++)
326 new_regs[i] = ldl_kernel(tss_base + (0x28 + i * 4));
327 for(i = 0; i < 6; i++)
328 new_segs[i] = lduw_kernel(tss_base + (0x48 + i * 4));
329 new_ldt = lduw_kernel(tss_base + 0x60);
330 new_trap = ldl_kernel(tss_base + 0x64);
331 } else {
332 /* 16 bit */
333 new_cr3 = 0;
334 new_eip = lduw_kernel(tss_base + 0x0e);
335 new_eflags = lduw_kernel(tss_base + 0x10);
336 for(i = 0; i < 8; i++)
337 new_regs[i] = lduw_kernel(tss_base + (0x12 + i * 2)) | 0xffff0000;
338 for(i = 0; i < 4; i++)
339 new_segs[i] = lduw_kernel(tss_base + (0x22 + i * 4));
340 new_ldt = lduw_kernel(tss_base + 0x2a);
341 new_segs[R_FS] = 0;
342 new_segs[R_GS] = 0;
343 new_trap = 0;
344 }
345 /* XXX: avoid a compiler warning, see
346 http://support.amd.com/us/Processor_TechDocs/24593.pdf
347 chapters 12.2.5 and 13.2.4 on how to implement TSS Trap bit */
348 (void)new_trap;
349
350 /* NOTE: we must avoid memory exceptions during the task switch,
351 so we make dummy accesses before */
352 /* XXX: it can still fail in some cases, so a bigger hack is
353 necessary to valid the TLB after having done the accesses */
354
355 v1 = ldub_kernel(env->tr.base);
356 v2 = ldub_kernel(env->tr.base + old_tss_limit_max);
357 stb_kernel(env->tr.base, v1);
358 stb_kernel(env->tr.base + old_tss_limit_max, v2);
359
360 /* clear busy bit (it is restartable) */
361 if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_IRET) {
362 target_ulong ptr;
363 uint32_t e2;
364 ptr = env->gdt.base + (env->tr.selector & ~7);
365 e2 = ldl_kernel(ptr + 4);
366 e2 &= ~DESC_TSS_BUSY_MASK;
367 stl_kernel(ptr + 4, e2);
368 }
369 old_eflags = compute_eflags();
370 if (source == SWITCH_TSS_IRET)
371 old_eflags &= ~NT_MASK;
372
373 /* save the current state in the old TSS */
374 if (type & 8) {
375 /* 32 bit */
376 stl_kernel(env->tr.base + 0x20, next_eip);
377 stl_kernel(env->tr.base + 0x24, old_eflags);
378 stl_kernel(env->tr.base + (0x28 + 0 * 4), EAX);
379 stl_kernel(env->tr.base + (0x28 + 1 * 4), ECX);
380 stl_kernel(env->tr.base + (0x28 + 2 * 4), EDX);
381 stl_kernel(env->tr.base + (0x28 + 3 * 4), EBX);
382 stl_kernel(env->tr.base + (0x28 + 4 * 4), ESP);
383 stl_kernel(env->tr.base + (0x28 + 5 * 4), EBP);
384 stl_kernel(env->tr.base + (0x28 + 6 * 4), ESI);
385 stl_kernel(env->tr.base + (0x28 + 7 * 4), EDI);
386 for(i = 0; i < 6; i++)
387 stw_kernel(env->tr.base + (0x48 + i * 4), env->segs[i].selector);
388 } else {
389 /* 16 bit */
390 stw_kernel(env->tr.base + 0x0e, next_eip);
391 stw_kernel(env->tr.base + 0x10, old_eflags);
392 stw_kernel(env->tr.base + (0x12 + 0 * 2), EAX);
393 stw_kernel(env->tr.base + (0x12 + 1 * 2), ECX);
394 stw_kernel(env->tr.base + (0x12 + 2 * 2), EDX);
395 stw_kernel(env->tr.base + (0x12 + 3 * 2), EBX);
396 stw_kernel(env->tr.base + (0x12 + 4 * 2), ESP);
397 stw_kernel(env->tr.base + (0x12 + 5 * 2), EBP);
398 stw_kernel(env->tr.base + (0x12 + 6 * 2), ESI);
399 stw_kernel(env->tr.base + (0x12 + 7 * 2), EDI);
400 for(i = 0; i < 4; i++)
401 stw_kernel(env->tr.base + (0x22 + i * 4), env->segs[i].selector);
402 }
403
404 /* now if an exception occurs, it will occurs in the next task
405 context */
406
407 if (source == SWITCH_TSS_CALL) {
408 stw_kernel(tss_base, env->tr.selector);
409 new_eflags |= NT_MASK;
410 }
411
412 /* set busy bit */
413 if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_CALL) {
414 target_ulong ptr;
415 uint32_t e2;
416 ptr = env->gdt.base + (tss_selector & ~7);
417 e2 = ldl_kernel(ptr + 4);
418 e2 |= DESC_TSS_BUSY_MASK;
419 stl_kernel(ptr + 4, e2);
420 }
421
422 /* set the new CPU state */
423 /* from this point, any exception which occurs can give problems */
424 env->cr[0] |= CR0_TS_MASK;
425 env->hflags |= HF_TS_MASK;
426 env->tr.selector = tss_selector;
427 env->tr.base = tss_base;
428 env->tr.limit = tss_limit;
429 env->tr.flags = e2 & ~DESC_TSS_BUSY_MASK;
430
431 if ((type & 8) && (env->cr[0] & CR0_PG_MASK)) {
432 cpu_x86_update_cr3(env, new_cr3);
433 }
434
435 /* load all registers without an exception, then reload them with
436 possible exception */
437 env->eip = new_eip;
438 eflags_mask = TF_MASK | AC_MASK | ID_MASK |
439 IF_MASK | IOPL_MASK | VM_MASK | RF_MASK | NT_MASK;
440 if (!(type & 8))
441 eflags_mask &= 0xffff;
442 load_eflags(new_eflags, eflags_mask);
443 /* XXX: what to do in 16 bit case ? */
444 EAX = new_regs[0];
445 ECX = new_regs[1];
446 EDX = new_regs[2];
447 EBX = new_regs[3];
448 ESP = new_regs[4];
449 EBP = new_regs[5];
450 ESI = new_regs[6];
451 EDI = new_regs[7];
452 if (new_eflags & VM_MASK) {
453 for(i = 0; i < 6; i++)
454 load_seg_vm(i, new_segs[i]);
455 /* in vm86, CPL is always 3 */
456 cpu_x86_set_cpl(env, 3);
457 } else {
458 /* CPL is set the RPL of CS */
459 cpu_x86_set_cpl(env, new_segs[R_CS] & 3);
460 /* first just selectors as the rest may trigger exceptions */
461 for(i = 0; i < 6; i++)
462 cpu_x86_load_seg_cache(env, i, new_segs[i], 0, 0, 0);
463 }
464
465 env->ldt.selector = new_ldt & ~4;
466 env->ldt.base = 0;
467 env->ldt.limit = 0;
468 env->ldt.flags = 0;
469
470 /* load the LDT */
471 if (new_ldt & 4)
472 raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
473
474 if ((new_ldt & 0xfffc) != 0) {
475 dt = &env->gdt;
476 index = new_ldt & ~7;
477 if ((index + 7) > dt->limit)
478 raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
479 ptr = dt->base + index;
480 e1 = ldl_kernel(ptr);
481 e2 = ldl_kernel(ptr + 4);
482 if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2)
483 raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
484 if (!(e2 & DESC_P_MASK))
485 raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
486 load_seg_cache_raw_dt(&env->ldt, e1, e2);
487 }
488
489 /* load the segments */
490 if (!(new_eflags & VM_MASK)) {
491 tss_load_seg(R_CS, new_segs[R_CS]);
492 tss_load_seg(R_SS, new_segs[R_SS]);
493 tss_load_seg(R_ES, new_segs[R_ES]);
494 tss_load_seg(R_DS, new_segs[R_DS]);
495 tss_load_seg(R_FS, new_segs[R_FS]);
496 tss_load_seg(R_GS, new_segs[R_GS]);
497 }
498
499 /* check that EIP is in the CS segment limits */
500 if (new_eip > env->segs[R_CS].limit) {
501 /* XXX: different exception if CALL ? */
502 raise_exception_err(EXCP0D_GPF, 0);
503 }
504
505 #ifndef CONFIG_USER_ONLY
506 /* reset local breakpoints */
507 if (env->dr[7] & 0x55) {
508 for (i = 0; i < 4; i++) {
509 if (hw_breakpoint_enabled(env->dr[7], i) == 0x1)
510 hw_breakpoint_remove(env, i);
511 }
512 env->dr[7] &= ~0x55;
513 }
514 #endif
515 }
516
517 /* check if Port I/O is allowed in TSS */
518 static inline void check_io(int addr, int size)
519 {
520 int io_offset, val, mask;
521
522 /* TSS must be a valid 32 bit one */
523 if (!(env->tr.flags & DESC_P_MASK) ||
524 ((env->tr.flags >> DESC_TYPE_SHIFT) & 0xf) != 9 ||
525 env->tr.limit < 103)
526 goto fail;
527 io_offset = lduw_kernel(env->tr.base + 0x66);
528 io_offset += (addr >> 3);
529 /* Note: the check needs two bytes */
530 if ((io_offset + 1) > env->tr.limit)
531 goto fail;
532 val = lduw_kernel(env->tr.base + io_offset);
533 val >>= (addr & 7);
534 mask = (1 << size) - 1;
535 /* all bits must be zero to allow the I/O */
536 if ((val & mask) != 0) {
537 fail:
538 raise_exception_err(EXCP0D_GPF, 0);
539 }
540 }
541
542 void helper_check_iob(uint32_t t0)
543 {
544 check_io(t0, 1);
545 }
546
547 void helper_check_iow(uint32_t t0)
548 {
549 check_io(t0, 2);
550 }
551
552 void helper_check_iol(uint32_t t0)
553 {
554 check_io(t0, 4);
555 }
556
557 void helper_outb(uint32_t port, uint32_t data)
558 {
559 cpu_outb(port, data & 0xff);
560 }
561
562 target_ulong helper_inb(uint32_t port)
563 {
564 return cpu_inb(port);
565 }
566
567 void helper_outw(uint32_t port, uint32_t data)
568 {
569 cpu_outw(port, data & 0xffff);
570 }
571
572 target_ulong helper_inw(uint32_t port)
573 {
574 return cpu_inw(port);
575 }
576
577 void helper_outl(uint32_t port, uint32_t data)
578 {
579 cpu_outl(port, data);
580 }
581
582 target_ulong helper_inl(uint32_t port)
583 {
584 return cpu_inl(port);
585 }
586
587 static inline unsigned int get_sp_mask(unsigned int e2)
588 {
589 if (e2 & DESC_B_MASK)
590 return 0xffffffff;
591 else
592 return 0xffff;
593 }
594
595 static int exeption_has_error_code(int intno)
596 {
597 switch(intno) {
598 case 8:
599 case 10:
600 case 11:
601 case 12:
602 case 13:
603 case 14:
604 case 17:
605 return 1;
606 }
607 return 0;
608 }
609
610 #ifdef TARGET_X86_64
611 #define SET_ESP(val, sp_mask)\
612 do {\
613 if ((sp_mask) == 0xffff)\
614 ESP = (ESP & ~0xffff) | ((val) & 0xffff);\
615 else if ((sp_mask) == 0xffffffffLL)\
616 ESP = (uint32_t)(val);\
617 else\
618 ESP = (val);\
619 } while (0)
620 #else
621 #define SET_ESP(val, sp_mask) ESP = (ESP & ~(sp_mask)) | ((val) & (sp_mask))
622 #endif
623
624 /* in 64-bit machines, this can overflow. So this segment addition macro
625 * can be used to trim the value to 32-bit whenever needed */
626 #define SEG_ADDL(ssp, sp, sp_mask) ((uint32_t)((ssp) + (sp & (sp_mask))))
627
628 /* XXX: add a is_user flag to have proper security support */
629 #define PUSHW(ssp, sp, sp_mask, val)\
630 {\
631 sp -= 2;\
632 stw_kernel((ssp) + (sp & (sp_mask)), (val));\
633 }
634
635 #define PUSHL(ssp, sp, sp_mask, val)\
636 {\
637 sp -= 4;\
638 stl_kernel(SEG_ADDL(ssp, sp, sp_mask), (uint32_t)(val));\
639 }
640
641 #define POPW(ssp, sp, sp_mask, val)\
642 {\
643 val = lduw_kernel((ssp) + (sp & (sp_mask)));\
644 sp += 2;\
645 }
646
647 #define POPL(ssp, sp, sp_mask, val)\
648 {\
649 val = (uint32_t)ldl_kernel(SEG_ADDL(ssp, sp, sp_mask));\
650 sp += 4;\
651 }
652
653 /* protected mode interrupt */
654 static void do_interrupt_protected(int intno, int is_int, int error_code,
655 unsigned int next_eip, int is_hw)
656 {
657 SegmentCache *dt;
658 target_ulong ptr, ssp;
659 int type, dpl, selector, ss_dpl, cpl;
660 int has_error_code, new_stack, shift;
661 uint32_t e1, e2, offset, ss = 0, esp, ss_e1 = 0, ss_e2 = 0;
662 uint32_t old_eip, sp_mask;
663
664 has_error_code = 0;
665 if (!is_int && !is_hw)
666 has_error_code = exeption_has_error_code(intno);
667 if (is_int)
668 old_eip = next_eip;
669 else
670 old_eip = env->eip;
671
672 dt = &env->idt;
673 if (intno * 8 + 7 > dt->limit)
674 raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
675 ptr = dt->base + intno * 8;
676 e1 = ldl_kernel(ptr);
677 e2 = ldl_kernel(ptr + 4);
678 /* check gate type */
679 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
680 switch(type) {
681 case 5: /* task gate */
682 /* must do that check here to return the correct error code */
683 if (!(e2 & DESC_P_MASK))
684 raise_exception_err(EXCP0B_NOSEG, intno * 8 + 2);
685 switch_tss(intno * 8, e1, e2, SWITCH_TSS_CALL, old_eip);
686 if (has_error_code) {
687 int type;
688 uint32_t mask;
689 /* push the error code */
690 type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
691 shift = type >> 3;
692 if (env->segs[R_SS].flags & DESC_B_MASK)
693 mask = 0xffffffff;
694 else
695 mask = 0xffff;
696 esp = (ESP - (2 << shift)) & mask;
697 ssp = env->segs[R_SS].base + esp;
698 if (shift)
699 stl_kernel(ssp, error_code);
700 else
701 stw_kernel(ssp, error_code);
702 SET_ESP(esp, mask);
703 }
704 return;
705 case 6: /* 286 interrupt gate */
706 case 7: /* 286 trap gate */
707 case 14: /* 386 interrupt gate */
708 case 15: /* 386 trap gate */
709 break;
710 default:
711 raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
712 break;
713 }
714 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
715 cpl = env->hflags & HF_CPL_MASK;
716 /* check privilege if software int */
717 if (is_int && dpl < cpl)
718 raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
719 /* check valid bit */
720 if (!(e2 & DESC_P_MASK))
721 raise_exception_err(EXCP0B_NOSEG, intno * 8 + 2);
722 selector = e1 >> 16;
723 offset = (e2 & 0xffff0000) | (e1 & 0x0000ffff);
724 if ((selector & 0xfffc) == 0)
725 raise_exception_err(EXCP0D_GPF, 0);
726
727 if (load_segment(&e1, &e2, selector) != 0)
728 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
729 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK)))
730 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
731 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
732 if (dpl > cpl)
733 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
734 if (!(e2 & DESC_P_MASK))
735 raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
736 if (!(e2 & DESC_C_MASK) && dpl < cpl) {
737 /* to inner privilege */
738 get_ss_esp_from_tss(&ss, &esp, dpl);
739 if ((ss & 0xfffc) == 0)
740 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
741 if ((ss & 3) != dpl)
742 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
743 if (load_segment(&ss_e1, &ss_e2, ss) != 0)
744 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
745 ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
746 if (ss_dpl != dpl)
747 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
748 if (!(ss_e2 & DESC_S_MASK) ||
749 (ss_e2 & DESC_CS_MASK) ||
750 !(ss_e2 & DESC_W_MASK))
751 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
752 if (!(ss_e2 & DESC_P_MASK))
753 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
754 new_stack = 1;
755 sp_mask = get_sp_mask(ss_e2);
756 ssp = get_seg_base(ss_e1, ss_e2);
757 } else if ((e2 & DESC_C_MASK) || dpl == cpl) {
758 /* to same privilege */
759 if (env->eflags & VM_MASK)
760 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
761 new_stack = 0;
762 sp_mask = get_sp_mask(env->segs[R_SS].flags);
763 ssp = env->segs[R_SS].base;
764 esp = ESP;
765 dpl = cpl;
766 } else {
767 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
768 new_stack = 0; /* avoid warning */
769 sp_mask = 0; /* avoid warning */
770 ssp = 0; /* avoid warning */
771 esp = 0; /* avoid warning */
772 }
773
774 shift = type >> 3;
775
776 #if 0
777 /* XXX: check that enough room is available */
778 push_size = 6 + (new_stack << 2) + (has_error_code << 1);
779 if (env->eflags & VM_MASK)
780 push_size += 8;
781 push_size <<= shift;
782 #endif
783 if (shift == 1) {
784 if (new_stack) {
785 if (env->eflags & VM_MASK) {
786 PUSHL(ssp, esp, sp_mask, env->segs[R_GS].selector);
787 PUSHL(ssp, esp, sp_mask, env->segs[R_FS].selector);
788 PUSHL(ssp, esp, sp_mask, env->segs[R_DS].selector);
789 PUSHL(ssp, esp, sp_mask, env->segs[R_ES].selector);
790 }
791 PUSHL(ssp, esp, sp_mask, env->segs[R_SS].selector);
792 PUSHL(ssp, esp, sp_mask, ESP);
793 }
794 PUSHL(ssp, esp, sp_mask, compute_eflags());
795 PUSHL(ssp, esp, sp_mask, env->segs[R_CS].selector);
796 PUSHL(ssp, esp, sp_mask, old_eip);
797 if (has_error_code) {
798 PUSHL(ssp, esp, sp_mask, error_code);
799 }
800 } else {
801 if (new_stack) {
802 if (env->eflags & VM_MASK) {
803 PUSHW(ssp, esp, sp_mask, env->segs[R_GS].selector);
804 PUSHW(ssp, esp, sp_mask, env->segs[R_FS].selector);
805 PUSHW(ssp, esp, sp_mask, env->segs[R_DS].selector);
806 PUSHW(ssp, esp, sp_mask, env->segs[R_ES].selector);
807 }
808 PUSHW(ssp, esp, sp_mask, env->segs[R_SS].selector);
809 PUSHW(ssp, esp, sp_mask, ESP);
810 }
811 PUSHW(ssp, esp, sp_mask, compute_eflags());
812 PUSHW(ssp, esp, sp_mask, env->segs[R_CS].selector);
813 PUSHW(ssp, esp, sp_mask, old_eip);
814 if (has_error_code) {
815 PUSHW(ssp, esp, sp_mask, error_code);
816 }
817 }
818
819 if (new_stack) {
820 if (env->eflags & VM_MASK) {
821 cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0, 0);
822 cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0, 0);
823 cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0, 0);
824 cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0, 0);
825 }
826 ss = (ss & ~3) | dpl;
827 cpu_x86_load_seg_cache(env, R_SS, ss,
828 ssp, get_seg_limit(ss_e1, ss_e2), ss_e2);
829 }
830 SET_ESP(esp, sp_mask);
831
832 selector = (selector & ~3) | dpl;
833 cpu_x86_load_seg_cache(env, R_CS, selector,
834 get_seg_base(e1, e2),
835 get_seg_limit(e1, e2),
836 e2);
837 cpu_x86_set_cpl(env, dpl);
838 env->eip = offset;
839
840 /* interrupt gate clear IF mask */
841 if ((type & 1) == 0) {
842 env->eflags &= ~IF_MASK;
843 }
844 env->eflags &= ~(TF_MASK | VM_MASK | RF_MASK | NT_MASK);
845 }
846
847 #ifdef TARGET_X86_64
848
849 #define PUSHQ(sp, val)\
850 {\
851 sp -= 8;\
852 stq_kernel(sp, (val));\
853 }
854
855 #define POPQ(sp, val)\
856 {\
857 val = ldq_kernel(sp);\
858 sp += 8;\
859 }
860
861 static inline target_ulong get_rsp_from_tss(int level)
862 {
863 int index;
864
865 #if 0
866 printf("TR: base=" TARGET_FMT_lx " limit=%x\n",
867 env->tr.base, env->tr.limit);
868 #endif
869
870 if (!(env->tr.flags & DESC_P_MASK))
871 cpu_abort(env, "invalid tss");
872 index = 8 * level + 4;
873 if ((index + 7) > env->tr.limit)
874 raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
875 return ldq_kernel(env->tr.base + index);
876 }
877
878 /* 64 bit interrupt */
879 static void do_interrupt64(int intno, int is_int, int error_code,
880 target_ulong next_eip, int is_hw)
881 {
882 SegmentCache *dt;
883 target_ulong ptr;
884 int type, dpl, selector, cpl, ist;
885 int has_error_code, new_stack;
886 uint32_t e1, e2, e3, ss;
887 target_ulong old_eip, esp, offset;
888
889 has_error_code = 0;
890 if (!is_int && !is_hw)
891 has_error_code = exeption_has_error_code(intno);
892 if (is_int)
893 old_eip = next_eip;
894 else
895 old_eip = env->eip;
896
897 dt = &env->idt;
898 if (intno * 16 + 15 > dt->limit)
899 raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
900 ptr = dt->base + intno * 16;
901 e1 = ldl_kernel(ptr);
902 e2 = ldl_kernel(ptr + 4);
903 e3 = ldl_kernel(ptr + 8);
904 /* check gate type */
905 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
906 switch(type) {
907 case 14: /* 386 interrupt gate */
908 case 15: /* 386 trap gate */
909 break;
910 default:
911 raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
912 break;
913 }
914 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
915 cpl = env->hflags & HF_CPL_MASK;
916 /* check privilege if software int */
917 if (is_int && dpl < cpl)
918 raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
919 /* check valid bit */
920 if (!(e2 & DESC_P_MASK))
921 raise_exception_err(EXCP0B_NOSEG, intno * 16 + 2);
922 selector = e1 >> 16;
923 offset = ((target_ulong)e3 << 32) | (e2 & 0xffff0000) | (e1 & 0x0000ffff);
924 ist = e2 & 7;
925 if ((selector & 0xfffc) == 0)
926 raise_exception_err(EXCP0D_GPF, 0);
927
928 if (load_segment(&e1, &e2, selector) != 0)
929 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
930 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK)))
931 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
932 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
933 if (dpl > cpl)
934 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
935 if (!(e2 & DESC_P_MASK))
936 raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
937 if (!(e2 & DESC_L_MASK) || (e2 & DESC_B_MASK))
938 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
939 if ((!(e2 & DESC_C_MASK) && dpl < cpl) || ist != 0) {
940 /* to inner privilege */
941 if (ist != 0)
942 esp = get_rsp_from_tss(ist + 3);
943 else
944 esp = get_rsp_from_tss(dpl);
945 esp &= ~0xfLL; /* align stack */
946 ss = 0;
947 new_stack = 1;
948 } else if ((e2 & DESC_C_MASK) || dpl == cpl) {
949 /* to same privilege */
950 if (env->eflags & VM_MASK)
951 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
952 new_stack = 0;
953 if (ist != 0)
954 esp = get_rsp_from_tss(ist + 3);
955 else
956 esp = ESP;
957 esp &= ~0xfLL; /* align stack */
958 dpl = cpl;
959 } else {
960 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
961 new_stack = 0; /* avoid warning */
962 esp = 0; /* avoid warning */
963 }
964
965 PUSHQ(esp, env->segs[R_SS].selector);
966 PUSHQ(esp, ESP);
967 PUSHQ(esp, compute_eflags());
968 PUSHQ(esp, env->segs[R_CS].selector);
969 PUSHQ(esp, old_eip);
970 if (has_error_code) {
971 PUSHQ(esp, error_code);
972 }
973
974 if (new_stack) {
975 ss = 0 | dpl;
976 cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, 0);
977 }
978 ESP = esp;
979
980 selector = (selector & ~3) | dpl;
981 cpu_x86_load_seg_cache(env, R_CS, selector,
982 get_seg_base(e1, e2),
983 get_seg_limit(e1, e2),
984 e2);
985 cpu_x86_set_cpl(env, dpl);
986 env->eip = offset;
987
988 /* interrupt gate clear IF mask */
989 if ((type & 1) == 0) {
990 env->eflags &= ~IF_MASK;
991 }
992 env->eflags &= ~(TF_MASK | VM_MASK | RF_MASK | NT_MASK);
993 }
994 #endif
995
996 #ifdef TARGET_X86_64
997 #if defined(CONFIG_USER_ONLY)
998 void helper_syscall(int next_eip_addend)
999 {
1000 env->exception_index = EXCP_SYSCALL;
1001 env->exception_next_eip = env->eip + next_eip_addend;
1002 cpu_loop_exit(env);
1003 }
1004 #else
1005 void helper_syscall(int next_eip_addend)
1006 {
1007 int selector;
1008
1009 if (!(env->efer & MSR_EFER_SCE)) {
1010 raise_exception_err(EXCP06_ILLOP, 0);
1011 }
1012 selector = (env->star >> 32) & 0xffff;
1013 if (env->hflags & HF_LMA_MASK) {
1014 int code64;
1015
1016 ECX = env->eip + next_eip_addend;
1017 env->regs[11] = compute_eflags();
1018
1019 code64 = env->hflags & HF_CS64_MASK;
1020
1021 cpu_x86_set_cpl(env, 0);
1022 cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
1023 0, 0xffffffff,
1024 DESC_G_MASK | DESC_P_MASK |
1025 DESC_S_MASK |
1026 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);
1027 cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
1028 0, 0xffffffff,
1029 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1030 DESC_S_MASK |
1031 DESC_W_MASK | DESC_A_MASK);
1032 env->eflags &= ~env->fmask;
1033 load_eflags(env->eflags, 0);
1034 if (code64)
1035 env->eip = env->lstar;
1036 else
1037 env->eip = env->cstar;
1038 } else {
1039 ECX = (uint32_t)(env->eip + next_eip_addend);
1040
1041 cpu_x86_set_cpl(env, 0);
1042 cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
1043 0, 0xffffffff,
1044 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1045 DESC_S_MASK |
1046 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
1047 cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
1048 0, 0xffffffff,
1049 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1050 DESC_S_MASK |
1051 DESC_W_MASK | DESC_A_MASK);
1052 env->eflags &= ~(IF_MASK | RF_MASK | VM_MASK);
1053 env->eip = (uint32_t)env->star;
1054 }
1055 }
1056 #endif
1057 #endif
1058
1059 #ifdef TARGET_X86_64
1060 void helper_sysret(int dflag)
1061 {
1062 int cpl, selector;
1063
1064 if (!(env->efer & MSR_EFER_SCE)) {
1065 raise_exception_err(EXCP06_ILLOP, 0);
1066 }
1067 cpl = env->hflags & HF_CPL_MASK;
1068 if (!(env->cr[0] & CR0_PE_MASK) || cpl != 0) {
1069 raise_exception_err(EXCP0D_GPF, 0);
1070 }
1071 selector = (env->star >> 48) & 0xffff;
1072 if (env->hflags & HF_LMA_MASK) {
1073 if (dflag == 2) {
1074 cpu_x86_load_seg_cache(env, R_CS, (selector + 16) | 3,
1075 0, 0xffffffff,
1076 DESC_G_MASK | DESC_P_MASK |
1077 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1078 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK |
1079 DESC_L_MASK);
1080 env->eip = ECX;
1081 } else {
1082 cpu_x86_load_seg_cache(env, R_CS, selector | 3,
1083 0, 0xffffffff,
1084 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1085 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1086 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
1087 env->eip = (uint32_t)ECX;
1088 }
1089 cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1090 0, 0xffffffff,
1091 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1092 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1093 DESC_W_MASK | DESC_A_MASK);
1094 load_eflags((uint32_t)(env->regs[11]), TF_MASK | AC_MASK | ID_MASK |
1095 IF_MASK | IOPL_MASK | VM_MASK | RF_MASK | NT_MASK);
1096 cpu_x86_set_cpl(env, 3);
1097 } else {
1098 cpu_x86_load_seg_cache(env, R_CS, selector | 3,
1099 0, 0xffffffff,
1100 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1101 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1102 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
1103 env->eip = (uint32_t)ECX;
1104 cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1105 0, 0xffffffff,
1106 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1107 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1108 DESC_W_MASK | DESC_A_MASK);
1109 env->eflags |= IF_MASK;
1110 cpu_x86_set_cpl(env, 3);
1111 }
1112 }
1113 #endif
1114
1115 /* real mode interrupt */
1116 static void do_interrupt_real(int intno, int is_int, int error_code,
1117 unsigned int next_eip)
1118 {
1119 SegmentCache *dt;
1120 target_ulong ptr, ssp;
1121 int selector;
1122 uint32_t offset, esp;
1123 uint32_t old_cs, old_eip;
1124
1125 /* real mode (simpler !) */
1126 dt = &env->idt;
1127 if (intno * 4 + 3 > dt->limit)
1128 raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
1129 ptr = dt->base + intno * 4;
1130 offset = lduw_kernel(ptr);
1131 selector = lduw_kernel(ptr + 2);
1132 esp = ESP;
1133 ssp = env->segs[R_SS].base;
1134 if (is_int)
1135 old_eip = next_eip;
1136 else
1137 old_eip = env->eip;
1138 old_cs = env->segs[R_CS].selector;
1139 /* XXX: use SS segment size ? */
1140 PUSHW(ssp, esp, 0xffff, compute_eflags());
1141 PUSHW(ssp, esp, 0xffff, old_cs);
1142 PUSHW(ssp, esp, 0xffff, old_eip);
1143
1144 /* update processor state */
1145 ESP = (ESP & ~0xffff) | (esp & 0xffff);
1146 env->eip = offset;
1147 env->segs[R_CS].selector = selector;
1148 env->segs[R_CS].base = (selector << 4);
1149 env->eflags &= ~(IF_MASK | TF_MASK | AC_MASK | RF_MASK);
1150 }
1151
1152 #if defined(CONFIG_USER_ONLY)
1153 /* fake user mode interrupt */
1154 static void do_interrupt_user(int intno, int is_int, int error_code,
1155 target_ulong next_eip)
1156 {
1157 SegmentCache *dt;
1158 target_ulong ptr;
1159 int dpl, cpl, shift;
1160 uint32_t e2;
1161
1162 dt = &env->idt;
1163 if (env->hflags & HF_LMA_MASK) {
1164 shift = 4;
1165 } else {
1166 shift = 3;
1167 }
1168 ptr = dt->base + (intno << shift);
1169 e2 = ldl_kernel(ptr + 4);
1170
1171 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1172 cpl = env->hflags & HF_CPL_MASK;
1173 /* check privilege if software int */
1174 if (is_int && dpl < cpl)
1175 raise_exception_err(EXCP0D_GPF, (intno << shift) + 2);
1176
1177 /* Since we emulate only user space, we cannot do more than
1178 exiting the emulation with the suitable exception and error
1179 code */
1180 if (is_int)
1181 EIP = next_eip;
1182 }
1183
1184 #else
1185
1186 static void handle_even_inj(int intno, int is_int, int error_code,
1187 int is_hw, int rm)
1188 {
1189 uint32_t event_inj = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj));
1190 if (!(event_inj & SVM_EVTINJ_VALID)) {
1191 int type;
1192 if (is_int)
1193 type = SVM_EVTINJ_TYPE_SOFT;
1194 else
1195 type = SVM_EVTINJ_TYPE_EXEPT;
1196 event_inj = intno | type | SVM_EVTINJ_VALID;
1197 if (!rm && exeption_has_error_code(intno)) {
1198 event_inj |= SVM_EVTINJ_VALID_ERR;
1199 stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj_err), error_code);
1200 }
1201 stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj), event_inj);
1202 }
1203 }
1204 #endif
1205
1206 /*
1207 * Begin execution of an interruption. is_int is TRUE if coming from
1208 * the int instruction. next_eip is the EIP value AFTER the interrupt
1209 * instruction. It is only relevant if is_int is TRUE.
1210 */
1211 static void do_interrupt_all(int intno, int is_int, int error_code,
1212 target_ulong next_eip, int is_hw)
1213 {
1214 if (qemu_loglevel_mask(CPU_LOG_INT)) {
1215 if ((env->cr[0] & CR0_PE_MASK)) {
1216 static int count;
1217 qemu_log("%6d: v=%02x e=%04x i=%d cpl=%d IP=%04x:" TARGET_FMT_lx " pc=" TARGET_FMT_lx " SP=%04x:" TARGET_FMT_lx,
1218 count, intno, error_code, is_int,
1219 env->hflags & HF_CPL_MASK,
1220 env->segs[R_CS].selector, EIP,
1221 (int)env->segs[R_CS].base + EIP,
1222 env->segs[R_SS].selector, ESP);
1223 if (intno == 0x0e) {
1224 qemu_log(" CR2=" TARGET_FMT_lx, env->cr[2]);
1225 } else {
1226 qemu_log(" EAX=" TARGET_FMT_lx, EAX);
1227 }
1228 qemu_log("\n");
1229 log_cpu_state(env, X86_DUMP_CCOP);
1230 #if 0
1231 {
1232 int i;
1233 target_ulong ptr;
1234 qemu_log(" code=");
1235 ptr = env->segs[R_CS].base + env->eip;
1236 for(i = 0; i < 16; i++) {
1237 qemu_log(" %02x", ldub(ptr + i));
1238 }
1239 qemu_log("\n");
1240 }
1241 #endif
1242 count++;
1243 }
1244 }
1245 if (env->cr[0] & CR0_PE_MASK) {
1246 #if !defined(CONFIG_USER_ONLY)
1247 if (env->hflags & HF_SVMI_MASK)
1248 handle_even_inj(intno, is_int, error_code, is_hw, 0);
1249 #endif
1250 #ifdef TARGET_X86_64
1251 if (env->hflags & HF_LMA_MASK) {
1252 do_interrupt64(intno, is_int, error_code, next_eip, is_hw);
1253 } else
1254 #endif
1255 {
1256 do_interrupt_protected(intno, is_int, error_code, next_eip, is_hw);
1257 }
1258 } else {
1259 #if !defined(CONFIG_USER_ONLY)
1260 if (env->hflags & HF_SVMI_MASK)
1261 handle_even_inj(intno, is_int, error_code, is_hw, 1);
1262 #endif
1263 do_interrupt_real(intno, is_int, error_code, next_eip);
1264 }
1265
1266 #if !defined(CONFIG_USER_ONLY)
1267 if (env->hflags & HF_SVMI_MASK) {
1268 uint32_t event_inj = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj));
1269 stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj), event_inj & ~SVM_EVTINJ_VALID);
1270 }
1271 #endif
1272 }
1273
1274 void do_interrupt(CPUState *env1)
1275 {
1276 CPUState *saved_env;
1277
1278 saved_env = env;
1279 env = env1;
1280 #if defined(CONFIG_USER_ONLY)
1281 /* if user mode only, we simulate a fake exception
1282 which will be handled outside the cpu execution
1283 loop */
1284 do_interrupt_user(env->exception_index,
1285 env->exception_is_int,
1286 env->error_code,
1287 env->exception_next_eip);
1288 /* successfully delivered */
1289 env->old_exception = -1;
1290 #else
1291 /* simulate a real cpu exception. On i386, it can
1292 trigger new exceptions, but we do not handle
1293 double or triple faults yet. */
1294 do_interrupt_all(env->exception_index,
1295 env->exception_is_int,
1296 env->error_code,
1297 env->exception_next_eip, 0);
1298 /* successfully delivered */
1299 env->old_exception = -1;
1300 #endif
1301 env = saved_env;
1302 }
1303
1304 void do_interrupt_x86_hardirq(CPUState *env1, int intno, int is_hw)
1305 {
1306 CPUState *saved_env;
1307
1308 saved_env = env;
1309 env = env1;
1310 do_interrupt_all(intno, 0, 0, 0, is_hw);
1311 env = saved_env;
1312 }
1313
1314 /* This should come from sysemu.h - if we could include it here... */
1315 void qemu_system_reset_request(void);
1316
1317 /*
1318 * Check nested exceptions and change to double or triple fault if
1319 * needed. It should only be called, if this is not an interrupt.
1320 * Returns the new exception number.
1321 */
1322 static int check_exception(int intno, int *error_code)
1323 {
1324 int first_contributory = env->old_exception == 0 ||
1325 (env->old_exception >= 10 &&
1326 env->old_exception <= 13);
1327 int second_contributory = intno == 0 ||
1328 (intno >= 10 && intno <= 13);
1329
1330 qemu_log_mask(CPU_LOG_INT, "check_exception old: 0x%x new 0x%x\n",
1331 env->old_exception, intno);
1332
1333 #if !defined(CONFIG_USER_ONLY)
1334 if (env->old_exception == EXCP08_DBLE) {
1335 if (env->hflags & HF_SVMI_MASK)
1336 helper_vmexit(SVM_EXIT_SHUTDOWN, 0); /* does not return */
1337
1338 qemu_log_mask(CPU_LOG_RESET, "Triple fault\n");
1339
1340 qemu_system_reset_request();
1341 return EXCP_HLT;
1342 }
1343 #endif
1344
1345 if ((first_contributory && second_contributory)
1346 || (env->old_exception == EXCP0E_PAGE &&
1347 (second_contributory || (intno == EXCP0E_PAGE)))) {
1348 intno = EXCP08_DBLE;
1349 *error_code = 0;
1350 }
1351
1352 if (second_contributory || (intno == EXCP0E_PAGE) ||
1353 (intno == EXCP08_DBLE))
1354 env->old_exception = intno;
1355
1356 return intno;
1357 }
1358
1359 /*
1360 * Signal an interruption. It is executed in the main CPU loop.
1361 * is_int is TRUE if coming from the int instruction. next_eip is the
1362 * EIP value AFTER the interrupt instruction. It is only relevant if
1363 * is_int is TRUE.
1364 */
1365 static void QEMU_NORETURN raise_interrupt(int intno, int is_int, int error_code,
1366 int next_eip_addend)
1367 {
1368 if (!is_int) {
1369 helper_svm_check_intercept_param(SVM_EXIT_EXCP_BASE + intno, error_code);
1370 intno = check_exception(intno, &error_code);
1371 } else {
1372 helper_svm_check_intercept_param(SVM_EXIT_SWINT, 0);
1373 }
1374
1375 env->exception_index = intno;
1376 env->error_code = error_code;
1377 env->exception_is_int = is_int;
1378 env->exception_next_eip = env->eip + next_eip_addend;
1379 cpu_loop_exit(env);
1380 }
1381
1382 /* shortcuts to generate exceptions */
1383
1384 void raise_exception_err(int exception_index, int error_code)
1385 {
1386 raise_interrupt(exception_index, 0, error_code, 0);
1387 }
1388
1389 void raise_exception(int exception_index)
1390 {
1391 raise_interrupt(exception_index, 0, 0, 0);
1392 }
1393
1394 void raise_exception_env(int exception_index, CPUState *nenv)
1395 {
1396 env = nenv;
1397 raise_exception(exception_index);
1398 }
1399 /* SMM support */
1400
1401 #if defined(CONFIG_USER_ONLY)
1402
1403 void do_smm_enter(CPUState *env1)
1404 {
1405 }
1406
1407 void helper_rsm(void)
1408 {
1409 }
1410
1411 #else
1412
1413 #ifdef TARGET_X86_64
1414 #define SMM_REVISION_ID 0x00020064
1415 #else
1416 #define SMM_REVISION_ID 0x00020000
1417 #endif
1418
1419 void do_smm_enter(CPUState *env1)
1420 {
1421 target_ulong sm_state;
1422 SegmentCache *dt;
1423 int i, offset;
1424 CPUState *saved_env;
1425
1426 saved_env = env;
1427 env = env1;
1428
1429 qemu_log_mask(CPU_LOG_INT, "SMM: enter\n");
1430 log_cpu_state_mask(CPU_LOG_INT, env, X86_DUMP_CCOP);
1431
1432 env->hflags |= HF_SMM_MASK;
1433 cpu_smm_update(env);
1434
1435 sm_state = env->smbase + 0x8000;
1436
1437 #ifdef TARGET_X86_64
1438 for(i = 0; i < 6; i++) {
1439 dt = &env->segs[i];
1440 offset = 0x7e00 + i * 16;
1441 stw_phys(sm_state + offset, dt->selector);
1442 stw_phys(sm_state + offset + 2, (dt->flags >> 8) & 0xf0ff);
1443 stl_phys(sm_state + offset + 4, dt->limit);
1444 stq_phys(sm_state + offset + 8, dt->base);
1445 }
1446
1447 stq_phys(sm_state + 0x7e68, env->gdt.base);
1448 stl_phys(sm_state + 0x7e64, env->gdt.limit);
1449
1450 stw_phys(sm_state + 0x7e70, env->ldt.selector);
1451 stq_phys(sm_state + 0x7e78, env->ldt.base);
1452 stl_phys(sm_state + 0x7e74, env->ldt.limit);
1453 stw_phys(sm_state + 0x7e72, (env->ldt.flags >> 8) & 0xf0ff);
1454
1455 stq_phys(sm_state + 0x7e88, env->idt.base);
1456 stl_phys(sm_state + 0x7e84, env->idt.limit);
1457
1458 stw_phys(sm_state + 0x7e90, env->tr.selector);
1459 stq_phys(sm_state + 0x7e98, env->tr.base);
1460 stl_phys(sm_state + 0x7e94, env->tr.limit);
1461 stw_phys(sm_state + 0x7e92, (env->tr.flags >> 8) & 0xf0ff);
1462
1463 stq_phys(sm_state + 0x7ed0, env->efer);
1464
1465 stq_phys(sm_state + 0x7ff8, EAX);
1466 stq_phys(sm_state + 0x7ff0, ECX);
1467 stq_phys(sm_state + 0x7fe8, EDX);
1468 stq_phys(sm_state + 0x7fe0, EBX);
1469 stq_phys(sm_state + 0x7fd8, ESP);
1470 stq_phys(sm_state + 0x7fd0, EBP);
1471 stq_phys(sm_state + 0x7fc8, ESI);
1472 stq_phys(sm_state + 0x7fc0, EDI);
1473 for(i = 8; i < 16; i++)
1474 stq_phys(sm_state + 0x7ff8 - i * 8, env->regs[i]);
1475 stq_phys(sm_state + 0x7f78, env->eip);
1476 stl_phys(sm_state + 0x7f70, compute_eflags());
1477 stl_phys(sm_state + 0x7f68, env->dr[6]);
1478 stl_phys(sm_state + 0x7f60, env->dr[7]);
1479
1480 stl_phys(sm_state + 0x7f48, env->cr[4]);
1481 stl_phys(sm_state + 0x7f50, env->cr[3]);
1482 stl_phys(sm_state + 0x7f58, env->cr[0]);
1483
1484 stl_phys(sm_state + 0x7efc, SMM_REVISION_ID);
1485 stl_phys(sm_state + 0x7f00, env->smbase);
1486 #else
1487 stl_phys(sm_state + 0x7ffc, env->cr[0]);
1488 stl_phys(sm_state + 0x7ff8, env->cr[3]);
1489 stl_phys(sm_state + 0x7ff4, compute_eflags());
1490 stl_phys(sm_state + 0x7ff0, env->eip);
1491 stl_phys(sm_state + 0x7fec, EDI);
1492 stl_phys(sm_state + 0x7fe8, ESI);
1493 stl_phys(sm_state + 0x7fe4, EBP);
1494 stl_phys(sm_state + 0x7fe0, ESP);
1495 stl_phys(sm_state + 0x7fdc, EBX);
1496 stl_phys(sm_state + 0x7fd8, EDX);
1497 stl_phys(sm_state + 0x7fd4, ECX);
1498 stl_phys(sm_state + 0x7fd0, EAX);
1499 stl_phys(sm_state + 0x7fcc, env->dr[6]);
1500 stl_phys(sm_state + 0x7fc8, env->dr[7]);
1501
1502 stl_phys(sm_state + 0x7fc4, env->tr.selector);
1503 stl_phys(sm_state + 0x7f64, env->tr.base);
1504 stl_phys(sm_state + 0x7f60, env->tr.limit);
1505 stl_phys(sm_state + 0x7f5c, (env->tr.flags >> 8) & 0xf0ff);
1506
1507 stl_phys(sm_state + 0x7fc0, env->ldt.selector);
1508 stl_phys(sm_state + 0x7f80, env->ldt.base);
1509 stl_phys(sm_state + 0x7f7c, env->ldt.limit);
1510 stl_phys(sm_state + 0x7f78, (env->ldt.flags >> 8) & 0xf0ff);
1511
1512 stl_phys(sm_state + 0x7f74, env->gdt.base);
1513 stl_phys(sm_state + 0x7f70, env->gdt.limit);
1514
1515 stl_phys(sm_state + 0x7f58, env->idt.base);
1516 stl_phys(sm_state + 0x7f54, env->idt.limit);
1517
1518 for(i = 0; i < 6; i++) {
1519 dt = &env->segs[i];
1520 if (i < 3)
1521 offset = 0x7f84 + i * 12;
1522 else
1523 offset = 0x7f2c + (i - 3) * 12;
1524 stl_phys(sm_state + 0x7fa8 + i * 4, dt->selector);
1525 stl_phys(sm_state + offset + 8, dt->base);
1526 stl_phys(sm_state + offset + 4, dt->limit);
1527 stl_phys(sm_state + offset, (dt->flags >> 8) & 0xf0ff);
1528 }
1529 stl_phys(sm_state + 0x7f14, env->cr[4]);
1530
1531 stl_phys(sm_state + 0x7efc, SMM_REVISION_ID);
1532 stl_phys(sm_state + 0x7ef8, env->smbase);
1533 #endif
1534 /* init SMM cpu state */
1535
1536 #ifdef TARGET_X86_64
1537 cpu_load_efer(env, 0);
1538 #endif
1539 load_eflags(0, ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
1540 env->eip = 0x00008000;
1541 cpu_x86_load_seg_cache(env, R_CS, (env->smbase >> 4) & 0xffff, env->smbase,
1542 0xffffffff, 0);
1543 cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0xffffffff, 0);
1544 cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0xffffffff, 0);
1545 cpu_x86_load_seg_cache(env, R_SS, 0, 0, 0xffffffff, 0);
1546 cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0xffffffff, 0);
1547 cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0xffffffff, 0);
1548
1549 cpu_x86_update_cr0(env,
1550 env->cr[0] & ~(CR0_PE_MASK | CR0_EM_MASK | CR0_TS_MASK | CR0_PG_MASK));
1551 cpu_x86_update_cr4(env, 0);
1552 env->dr[7] = 0x00000400;
1553 CC_OP = CC_OP_EFLAGS;
1554 env = saved_env;
1555 }
1556
1557 void helper_rsm(void)
1558 {
1559 target_ulong sm_state;
1560 int i, offset;
1561 uint32_t val;
1562
1563 sm_state = env->smbase + 0x8000;
1564 #ifdef TARGET_X86_64
1565 cpu_load_efer(env, ldq_phys(sm_state + 0x7ed0));
1566
1567 for(i = 0; i < 6; i++) {
1568 offset = 0x7e00 + i * 16;
1569 cpu_x86_load_seg_cache(env, i,
1570 lduw_phys(sm_state + offset),
1571 ldq_phys(sm_state + offset + 8),
1572 ldl_phys(sm_state + offset + 4),
1573 (lduw_phys(sm_state + offset + 2) & 0xf0ff) << 8);
1574 }
1575
1576 env->gdt.base = ldq_phys(sm_state + 0x7e68);
1577 env->gdt.limit = ldl_phys(sm_state + 0x7e64);
1578
1579 env->ldt.selector = lduw_phys(sm_state + 0x7e70);
1580 env->ldt.base = ldq_phys(sm_state + 0x7e78);
1581 env->ldt.limit = ldl_phys(sm_state + 0x7e74);
1582 env->ldt.flags = (lduw_phys(sm_state + 0x7e72) & 0xf0ff) << 8;
1583
1584 env->idt.base = ldq_phys(sm_state + 0x7e88);
1585 env->idt.limit = ldl_phys(sm_state + 0x7e84);
1586
1587 env->tr.selector = lduw_phys(sm_state + 0x7e90);
1588 env->tr.base = ldq_phys(sm_state + 0x7e98);
1589 env->tr.limit = ldl_phys(sm_state + 0x7e94);
1590 env->tr.flags = (lduw_phys(sm_state + 0x7e92) & 0xf0ff) << 8;
1591
1592 EAX = ldq_phys(sm_state + 0x7ff8);
1593 ECX = ldq_phys(sm_state + 0x7ff0);
1594 EDX = ldq_phys(sm_state + 0x7fe8);
1595 EBX = ldq_phys(sm_state + 0x7fe0);
1596 ESP = ldq_phys(sm_state + 0x7fd8);
1597 EBP = ldq_phys(sm_state + 0x7fd0);
1598 ESI = ldq_phys(sm_state + 0x7fc8);
1599 EDI = ldq_phys(sm_state + 0x7fc0);
1600 for(i = 8; i < 16; i++)
1601 env->regs[i] = ldq_phys(sm_state + 0x7ff8 - i * 8);
1602 env->eip = ldq_phys(sm_state + 0x7f78);
1603 load_eflags(ldl_phys(sm_state + 0x7f70),
1604 ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
1605 env->dr[6] = ldl_phys(sm_state + 0x7f68);
1606 env->dr[7] = ldl_phys(sm_state + 0x7f60);
1607
1608 cpu_x86_update_cr4(env, ldl_phys(sm_state + 0x7f48));
1609 cpu_x86_update_cr3(env, ldl_phys(sm_state + 0x7f50));
1610 cpu_x86_update_cr0(env, ldl_phys(sm_state + 0x7f58));
1611
1612 val = ldl_phys(sm_state + 0x7efc); /* revision ID */
1613 if (val & 0x20000) {
1614 env->smbase = ldl_phys(sm_state + 0x7f00) & ~0x7fff;
1615 }
1616 #else
1617 cpu_x86_update_cr0(env, ldl_phys(sm_state + 0x7ffc));
1618 cpu_x86_update_cr3(env, ldl_phys(sm_state + 0x7ff8));
1619 load_eflags(ldl_phys(sm_state + 0x7ff4),
1620 ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
1621 env->eip = ldl_phys(sm_state + 0x7ff0);
1622 EDI = ldl_phys(sm_state + 0x7fec);
1623 ESI = ldl_phys(sm_state + 0x7fe8);
1624 EBP = ldl_phys(sm_state + 0x7fe4);
1625 ESP = ldl_phys(sm_state + 0x7fe0);
1626 EBX = ldl_phys(sm_state + 0x7fdc);
1627 EDX = ldl_phys(sm_state + 0x7fd8);
1628 ECX = ldl_phys(sm_state + 0x7fd4);
1629 EAX = ldl_phys(sm_state + 0x7fd0);
1630 env->dr[6] = ldl_phys(sm_state + 0x7fcc);
1631 env->dr[7] = ldl_phys(sm_state + 0x7fc8);
1632
1633 env->tr.selector = ldl_phys(sm_state + 0x7fc4) & 0xffff;
1634 env->tr.base = ldl_phys(sm_state + 0x7f64);
1635 env->tr.limit = ldl_phys(sm_state + 0x7f60);
1636 env->tr.flags = (ldl_phys(sm_state + 0x7f5c) & 0xf0ff) << 8;
1637
1638 env->ldt.selector = ldl_phys(sm_state + 0x7fc0) & 0xffff;
1639 env->ldt.base = ldl_phys(sm_state + 0x7f80);
1640 env->ldt.limit = ldl_phys(sm_state + 0x7f7c);
1641 env->ldt.flags = (ldl_phys(sm_state + 0x7f78) & 0xf0ff) << 8;
1642
1643 env->gdt.base = ldl_phys(sm_state + 0x7f74);
1644 env->gdt.limit = ldl_phys(sm_state + 0x7f70);
1645
1646 env->idt.base = ldl_phys(sm_state + 0x7f58);
1647 env->idt.limit = ldl_phys(sm_state + 0x7f54);
1648
1649 for(i = 0; i < 6; i++) {
1650 if (i < 3)
1651 offset = 0x7f84 + i * 12;
1652 else
1653 offset = 0x7f2c + (i - 3) * 12;
1654 cpu_x86_load_seg_cache(env, i,
1655 ldl_phys(sm_state + 0x7fa8 + i * 4) & 0xffff,
1656 ldl_phys(sm_state + offset + 8),
1657 ldl_phys(sm_state + offset + 4),
1658 (ldl_phys(sm_state + offset) & 0xf0ff) << 8);
1659 }
1660 cpu_x86_update_cr4(env, ldl_phys(sm_state + 0x7f14));
1661
1662 val = ldl_phys(sm_state + 0x7efc); /* revision ID */
1663 if (val & 0x20000) {
1664 env->smbase = ldl_phys(sm_state + 0x7ef8) & ~0x7fff;
1665 }
1666 #endif
1667 CC_OP = CC_OP_EFLAGS;
1668 env->hflags &= ~HF_SMM_MASK;
1669 cpu_smm_update(env);
1670
1671 qemu_log_mask(CPU_LOG_INT, "SMM: after RSM\n");
1672 log_cpu_state_mask(CPU_LOG_INT, env, X86_DUMP_CCOP);
1673 }
1674
1675 #endif /* !CONFIG_USER_ONLY */
1676
1677
1678 /* division, flags are undefined */
1679
1680 void helper_divb_AL(target_ulong t0)
1681 {
1682 unsigned int num, den, q, r;
1683
1684 num = (EAX & 0xffff);
1685 den = (t0 & 0xff);
1686 if (den == 0) {
1687 raise_exception(EXCP00_DIVZ);
1688 }
1689 q = (num / den);
1690 if (q > 0xff)
1691 raise_exception(EXCP00_DIVZ);
1692 q &= 0xff;
1693 r = (num % den) & 0xff;
1694 EAX = (EAX & ~0xffff) | (r << 8) | q;
1695 }
1696
1697 void helper_idivb_AL(target_ulong t0)
1698 {
1699 int num, den, q, r;
1700
1701 num = (int16_t)EAX;
1702 den = (int8_t)t0;
1703 if (den == 0) {
1704 raise_exception(EXCP00_DIVZ);
1705 }
1706 q = (num / den);
1707 if (q != (int8_t)q)
1708 raise_exception(EXCP00_DIVZ);
1709 q &= 0xff;
1710 r = (num % den) & 0xff;
1711 EAX = (EAX & ~0xffff) | (r << 8) | q;
1712 }
1713
1714 void helper_divw_AX(target_ulong t0)
1715 {
1716 unsigned int num, den, q, r;
1717
1718 num = (EAX & 0xffff) | ((EDX & 0xffff) << 16);
1719 den = (t0 & 0xffff);
1720 if (den == 0) {
1721 raise_exception(EXCP00_DIVZ);
1722 }
1723 q = (num / den);
1724 if (q > 0xffff)
1725 raise_exception(EXCP00_DIVZ);
1726 q &= 0xffff;
1727 r = (num % den) & 0xffff;
1728 EAX = (EAX & ~0xffff) | q;
1729 EDX = (EDX & ~0xffff) | r;
1730 }
1731
1732 void helper_idivw_AX(target_ulong t0)
1733 {
1734 int num, den, q, r;
1735
1736 num = (EAX & 0xffff) | ((EDX & 0xffff) << 16);
1737 den = (int16_t)t0;
1738 if (den == 0) {
1739 raise_exception(EXCP00_DIVZ);
1740 }
1741 q = (num / den);
1742 if (q != (int16_t)q)
1743 raise_exception(EXCP00_DIVZ);
1744 q &= 0xffff;
1745 r = (num % den) & 0xffff;
1746 EAX = (EAX & ~0xffff) | q;
1747 EDX = (EDX & ~0xffff) | r;
1748 }
1749
1750 void helper_divl_EAX(target_ulong t0)
1751 {
1752 unsigned int den, r;
1753 uint64_t num, q;
1754
1755 num = ((uint32_t)EAX) | ((uint64_t)((uint32_t)EDX) << 32);
1756 den = t0;
1757 if (den == 0) {
1758 raise_exception(EXCP00_DIVZ);
1759 }
1760 q = (num / den);
1761 r = (num % den);
1762 if (q > 0xffffffff)
1763 raise_exception(EXCP00_DIVZ);
1764 EAX = (uint32_t)q;
1765 EDX = (uint32_t)r;
1766 }
1767
1768 void helper_idivl_EAX(target_ulong t0)
1769 {
1770 int den, r;
1771 int64_t num, q;
1772
1773 num = ((uint32_t)EAX) | ((uint64_t)((uint32_t)EDX) << 32);
1774 den = t0;
1775 if (den == 0) {
1776 raise_exception(EXCP00_DIVZ);
1777 }
1778 q = (num / den);
1779 r = (num % den);
1780 if (q != (int32_t)q)
1781 raise_exception(EXCP00_DIVZ);
1782 EAX = (uint32_t)q;
1783 EDX = (uint32_t)r;
1784 }
1785
1786 /* bcd */
1787
1788 /* XXX: exception */
1789 void helper_aam(int base)
1790 {
1791 int al, ah;
1792 al = EAX & 0xff;
1793 ah = al / base;
1794 al = al % base;
1795 EAX = (EAX & ~0xffff) | al | (ah << 8);
1796 CC_DST = al;
1797 }
1798
1799 void helper_aad(int base)
1800 {
1801 int al, ah;
1802 al = EAX & 0xff;
1803 ah = (EAX >> 8) & 0xff;
1804 al = ((ah * base) + al) & 0xff;
1805 EAX = (EAX & ~0xffff) | al;
1806 CC_DST = al;
1807 }
1808
1809 void helper_aaa(void)
1810 {
1811 int icarry;
1812 int al, ah, af;
1813 int eflags;
1814
1815 eflags = helper_cc_compute_all(CC_OP);
1816 af = eflags & CC_A;
1817 al = EAX & 0xff;
1818 ah = (EAX >> 8) & 0xff;
1819
1820 icarry = (al > 0xf9);
1821 if (((al & 0x0f) > 9 ) || af) {
1822 al = (al + 6) & 0x0f;
1823 ah = (ah + 1 + icarry) & 0xff;
1824 eflags |= CC_C | CC_A;
1825 } else {
1826 eflags &= ~(CC_C | CC_A);
1827 al &= 0x0f;
1828 }
1829 EAX = (EAX & ~0xffff) | al | (ah << 8);
1830 CC_SRC = eflags;
1831 }
1832
1833 void helper_aas(void)
1834 {
1835 int icarry;
1836 int al, ah, af;
1837 int eflags;
1838
1839 eflags = helper_cc_compute_all(CC_OP);
1840 af = eflags & CC_A;
1841 al = EAX & 0xff;
1842 ah = (EAX >> 8) & 0xff;
1843
1844 icarry = (al < 6);
1845 if (((al & 0x0f) > 9 ) || af) {
1846 al = (al - 6) & 0x0f;
1847 ah = (ah - 1 - icarry) & 0xff;
1848 eflags |= CC_C | CC_A;
1849 } else {
1850 eflags &= ~(CC_C | CC_A);
1851 al &= 0x0f;
1852 }
1853 EAX = (EAX & ~0xffff) | al | (ah << 8);
1854 CC_SRC = eflags;
1855 }
1856
1857 void helper_daa(void)
1858 {
1859 int al, af, cf;
1860 int eflags;
1861
1862 eflags = helper_cc_compute_all(CC_OP);
1863 cf = eflags & CC_C;
1864 af = eflags & CC_A;
1865 al = EAX & 0xff;
1866
1867 eflags = 0;
1868 if (((al & 0x0f) > 9 ) || af) {
1869 al = (al + 6) & 0xff;
1870 eflags |= CC_A;
1871 }
1872 if ((al > 0x9f) || cf) {
1873 al = (al + 0x60) & 0xff;
1874 eflags |= CC_C;
1875 }
1876 EAX = (EAX & ~0xff) | al;
1877 /* well, speed is not an issue here, so we compute the flags by hand */
1878 eflags |= (al == 0) << 6; /* zf */
1879 eflags |= parity_table[al]; /* pf */
1880 eflags |= (al & 0x80); /* sf */
1881 CC_SRC = eflags;
1882 }
1883
1884 void helper_das(void)
1885 {
1886 int al, al1, af, cf;
1887 int eflags;
1888
1889 eflags = helper_cc_compute_all(CC_OP);
1890 cf = eflags & CC_C;
1891 af = eflags & CC_A;
1892 al = EAX & 0xff;
1893
1894 eflags = 0;
1895 al1 = al;
1896 if (((al & 0x0f) > 9 ) || af) {
1897 eflags |= CC_A;
1898 if (al < 6 || cf)
1899 eflags |= CC_C;
1900 al = (al - 6) & 0xff;
1901 }
1902 if ((al1 > 0x99) || cf) {
1903 al = (al - 0x60) & 0xff;
1904 eflags |= CC_C;
1905 }
1906 EAX = (EAX & ~0xff) | al;
1907 /* well, speed is not an issue here, so we compute the flags by hand */
1908 eflags |= (al == 0) << 6; /* zf */
1909 eflags |= parity_table[al]; /* pf */
1910 eflags |= (al & 0x80); /* sf */
1911 CC_SRC = eflags;
1912 }
1913
1914 void helper_into(int next_eip_addend)
1915 {
1916 int eflags;
1917 eflags = helper_cc_compute_all(CC_OP);
1918 if (eflags & CC_O) {
1919 raise_interrupt(EXCP04_INTO, 1, 0, next_eip_addend);
1920 }
1921 }
1922
1923 void helper_cmpxchg8b(target_ulong a0)
1924 {
1925 uint64_t d;
1926 int eflags;
1927
1928 eflags = helper_cc_compute_all(CC_OP);
1929 d = ldq(a0);
1930 if (d == (((uint64_t)EDX << 32) | (uint32_t)EAX)) {
1931 stq(a0, ((uint64_t)ECX << 32) | (uint32_t)EBX);
1932 eflags |= CC_Z;
1933 } else {
1934 /* always do the store */
1935 stq(a0, d);
1936 EDX = (uint32_t)(d >> 32);
1937 EAX = (uint32_t)d;
1938 eflags &= ~CC_Z;
1939 }
1940 CC_SRC = eflags;
1941 }
1942
1943 #ifdef TARGET_X86_64
1944 void helper_cmpxchg16b(target_ulong a0)
1945 {
1946 uint64_t d0, d1;
1947 int eflags;
1948
1949 if ((a0 & 0xf) != 0)
1950 raise_exception(EXCP0D_GPF);
1951 eflags = helper_cc_compute_all(CC_OP);
1952 d0 = ldq(a0);
1953 d1 = ldq(a0 + 8);
1954 if (d0 == EAX && d1 == EDX) {
1955 stq(a0, EBX);
1956 stq(a0 + 8, ECX);
1957 eflags |= CC_Z;
1958 } else {
1959 /* always do the store */
1960 stq(a0, d0);
1961 stq(a0 + 8, d1);
1962 EDX = d1;
1963 EAX = d0;
1964 eflags &= ~CC_Z;
1965 }
1966 CC_SRC = eflags;
1967 }
1968 #endif
1969
1970 void helper_single_step(void)
1971 {
1972 #ifndef CONFIG_USER_ONLY
1973 check_hw_breakpoints(env, 1);
1974 env->dr[6] |= DR6_BS;
1975 #endif
1976 raise_exception(EXCP01_DB);
1977 }
1978
1979 void helper_cpuid(void)
1980 {
1981 uint32_t eax, ebx, ecx, edx;
1982
1983 helper_svm_check_intercept_param(SVM_EXIT_CPUID, 0);
1984
1985 cpu_x86_cpuid(env, (uint32_t)EAX, (uint32_t)ECX, &eax, &ebx, &ecx, &edx);
1986 EAX = eax;
1987 EBX = ebx;
1988 ECX = ecx;
1989 EDX = edx;
1990 }
1991
1992 void helper_enter_level(int level, int data32, target_ulong t1)
1993 {
1994 target_ulong ssp;
1995 uint32_t esp_mask, esp, ebp;
1996
1997 esp_mask = get_sp_mask(env->segs[R_SS].flags);
1998 ssp = env->segs[R_SS].base;
1999 ebp = EBP;
2000 esp = ESP;
2001 if (data32) {
2002 /* 32 bit */
2003 esp -= 4;
2004 while (--level) {
2005 esp -= 4;
2006 ebp -= 4;
2007 stl(ssp + (esp & esp_mask), ldl(ssp + (ebp & esp_mask)));
2008 }
2009 esp -= 4;
2010 stl(ssp + (esp & esp_mask), t1);
2011 } else {
2012 /* 16 bit */
2013 esp -= 2;
2014 while (--level) {
2015 esp -= 2;
2016 ebp -= 2;
2017 stw(ssp + (esp & esp_mask), lduw(ssp + (ebp & esp_mask)));
2018 }
2019 esp -= 2;
2020 stw(ssp + (esp & esp_mask), t1);
2021 }
2022 }
2023
2024 #ifdef TARGET_X86_64
2025 void helper_enter64_level(int level, int data64, target_ulong t1)
2026 {
2027 target_ulong esp, ebp;
2028 ebp = EBP;
2029 esp = ESP;
2030
2031 if (data64) {
2032 /* 64 bit */
2033 esp -= 8;
2034 while (--level) {
2035 esp -= 8;
2036 ebp -= 8;
2037 stq(esp, ldq(ebp));
2038 }
2039 esp -= 8;
2040 stq(esp, t1);
2041 } else {
2042 /* 16 bit */
2043 esp -= 2;
2044 while (--level) {
2045 esp -= 2;
2046 ebp -= 2;
2047 stw(esp, lduw(ebp));
2048 }
2049 esp -= 2;
2050 stw(esp, t1);
2051 }
2052 }
2053 #endif
2054
2055 void helper_lldt(int selector)
2056 {
2057 SegmentCache *dt;
2058 uint32_t e1, e2;
2059 int index, entry_limit;
2060 target_ulong ptr;
2061
2062 selector &= 0xffff;
2063 if ((selector & 0xfffc) == 0) {
2064 /* XXX: NULL selector case: invalid LDT */
2065 env->ldt.base = 0;
2066 env->ldt.limit = 0;
2067 } else {
2068 if (selector & 0x4)
2069 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2070 dt = &env->gdt;
2071 index = selector & ~7;
2072 #ifdef TARGET_X86_64
2073 if (env->hflags & HF_LMA_MASK)
2074 entry_limit = 15;
2075 else
2076 #endif
2077 entry_limit = 7;
2078 if ((index + entry_limit) > dt->limit)
2079 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2080 ptr = dt->base + index;
2081 e1 = ldl_kernel(ptr);
2082 e2 = ldl_kernel(ptr + 4);
2083 if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2)
2084 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2085 if (!(e2 & DESC_P_MASK))
2086 raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2087 #ifdef TARGET_X86_64
2088 if (env->hflags & HF_LMA_MASK) {
2089 uint32_t e3;
2090 e3 = ldl_kernel(ptr + 8);
2091 load_seg_cache_raw_dt(&env->ldt, e1, e2);
2092 env->ldt.base |= (target_ulong)e3 << 32;
2093 } else
2094 #endif
2095 {
2096 load_seg_cache_raw_dt(&env->ldt, e1, e2);
2097 }
2098 }
2099 env->ldt.selector = selector;
2100 }
2101
2102 void helper_ltr(int selector)
2103 {
2104 SegmentCache *dt;
2105 uint32_t e1, e2;
2106 int index, type, entry_limit;
2107 target_ulong ptr;
2108
2109 selector &= 0xffff;
2110 if ((selector & 0xfffc) == 0) {
2111 /* NULL selector case: invalid TR */
2112 env->tr.base = 0;
2113 env->tr.limit = 0;
2114 env->tr.flags = 0;
2115 } else {
2116 if (selector & 0x4)
2117 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2118 dt = &env->gdt;
2119 index = selector & ~7;
2120 #ifdef TARGET_X86_64
2121 if (env->hflags & HF_LMA_MASK)
2122 entry_limit = 15;
2123 else
2124 #endif
2125 entry_limit = 7;
2126 if ((index + entry_limit) > dt->limit)
2127 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2128 ptr = dt->base + index;
2129 e1 = ldl_kernel(ptr);
2130 e2 = ldl_kernel(ptr + 4);
2131 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2132 if ((e2 & DESC_S_MASK) ||
2133 (type != 1 && type != 9))
2134 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2135 if (!(e2 & DESC_P_MASK))
2136 raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2137 #ifdef TARGET_X86_64
2138 if (env->hflags & HF_LMA_MASK) {
2139 uint32_t e3, e4;
2140 e3 = ldl_kernel(ptr + 8);
2141 e4 = ldl_kernel(ptr + 12);
2142 if ((e4 >> DESC_TYPE_SHIFT) & 0xf)
2143 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2144 load_seg_cache_raw_dt(&env->tr, e1, e2);
2145 env->tr.base |= (target_ulong)e3 << 32;
2146 } else
2147 #endif
2148 {
2149 load_seg_cache_raw_dt(&env->tr, e1, e2);
2150 }
2151 e2 |= DESC_TSS_BUSY_MASK;
2152 stl_kernel(ptr + 4, e2);
2153 }
2154 env->tr.selector = selector;
2155 }
2156
2157 /* only works if protected mode and not VM86. seg_reg must be != R_CS */
2158 void helper_load_seg(int seg_reg, int selector)
2159 {
2160 uint32_t e1, e2;
2161 int cpl, dpl, rpl;
2162 SegmentCache *dt;
2163 int index;
2164 target_ulong ptr;
2165
2166 selector &= 0xffff;
2167 cpl = env->hflags & HF_CPL_MASK;
2168 if ((selector & 0xfffc) == 0) {
2169 /* null selector case */
2170 if (seg_reg == R_SS
2171 #ifdef TARGET_X86_64
2172 && (!(env->hflags & HF_CS64_MASK) || cpl == 3)
2173 #endif
2174 )
2175 raise_exception_err(EXCP0D_GPF, 0);
2176 cpu_x86_load_seg_cache(env, seg_reg, selector, 0, 0, 0);
2177 } else {
2178
2179 if (selector & 0x4)
2180 dt = &env->ldt;
2181 else
2182 dt = &env->gdt;
2183 index = selector & ~7;
2184 if ((index + 7) > dt->limit)
2185 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2186 ptr = dt->base + index;
2187 e1 = ldl_kernel(ptr);
2188 e2 = ldl_kernel(ptr + 4);
2189
2190 if (!(e2 & DESC_S_MASK))
2191 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2192 rpl = selector & 3;
2193 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2194 if (seg_reg == R_SS) {
2195 /* must be writable segment */
2196 if ((e2 & DESC_CS_MASK) || !(e2 & DESC_W_MASK))
2197 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2198 if (rpl != cpl || dpl != cpl)
2199 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2200 } else {
2201 /* must be readable segment */
2202 if ((e2 & (DESC_CS_MASK | DESC_R_MASK)) == DESC_CS_MASK)
2203 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2204
2205 if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) {
2206 /* if not conforming code, test rights */
2207 if (dpl < cpl || dpl < rpl)
2208 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2209 }
2210 }
2211
2212 if (!(e2 & DESC_P_MASK)) {
2213 if (seg_reg == R_SS)
2214 raise_exception_err(EXCP0C_STACK, selector & 0xfffc);
2215 else
2216 raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2217 }
2218
2219 /* set the access bit if not already set */
2220 if (!(e2 & DESC_A_MASK)) {
2221 e2 |= DESC_A_MASK;
2222 stl_kernel(ptr + 4, e2);
2223 }
2224
2225 cpu_x86_load_seg_cache(env, seg_reg, selector,
2226 get_seg_base(e1, e2),
2227 get_seg_limit(e1, e2),
2228 e2);
2229 #if 0
2230 qemu_log("load_seg: sel=0x%04x base=0x%08lx limit=0x%08lx flags=%08x\n",
2231 selector, (unsigned long)sc->base, sc->limit, sc->flags);
2232 #endif
2233 }
2234 }
2235
2236 /* protected mode jump */
2237 void helper_ljmp_protected(int new_cs, target_ulong new_eip,
2238 int next_eip_addend)
2239 {
2240 int gate_cs, type;
2241 uint32_t e1, e2, cpl, dpl, rpl, limit;
2242 target_ulong next_eip;
2243
2244 if ((new_cs & 0xfffc) == 0)
2245 raise_exception_err(EXCP0D_GPF, 0);
2246 if (load_segment(&e1, &e2, new_cs) != 0)
2247 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2248 cpl = env->hflags & HF_CPL_MASK;
2249 if (e2 & DESC_S_MASK) {
2250 if (!(e2 & DESC_CS_MASK))
2251 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2252 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2253 if (e2 & DESC_C_MASK) {
2254 /* conforming code segment */
2255 if (dpl > cpl)
2256 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2257 } else {
2258 /* non conforming code segment */
2259 rpl = new_cs & 3;
2260 if (rpl > cpl)
2261 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2262 if (dpl != cpl)
2263 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2264 }
2265 if (!(e2 & DESC_P_MASK))
2266 raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2267 limit = get_seg_limit(e1, e2);
2268 if (new_eip > limit &&
2269 !(env->hflags & HF_LMA_MASK) && !(e2 & DESC_L_MASK))
2270 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2271 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
2272 get_seg_base(e1, e2), limit, e2);
2273 EIP = new_eip;
2274 } else {
2275 /* jump to call or task gate */
2276 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2277 rpl = new_cs & 3;
2278 cpl = env->hflags & HF_CPL_MASK;
2279 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2280 switch(type) {
2281 case 1: /* 286 TSS */
2282 case 9: /* 386 TSS */
2283 case 5: /* task gate */
2284 if (dpl < cpl || dpl < rpl)
2285 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2286 next_eip = env->eip + next_eip_addend;
2287 switch_tss(new_cs, e1, e2, SWITCH_TSS_JMP, next_eip);
2288 CC_OP = CC_OP_EFLAGS;
2289 break;
2290 case 4: /* 286 call gate */
2291 case 12: /* 386 call gate */
2292 if ((dpl < cpl) || (dpl < rpl))
2293 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2294 if (!(e2 & DESC_P_MASK))
2295 raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2296 gate_cs = e1 >> 16;
2297 new_eip = (e1 & 0xffff);
2298 if (type == 12)
2299 new_eip |= (e2 & 0xffff0000);
2300 if (load_segment(&e1, &e2, gate_cs) != 0)
2301 raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2302 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2303 /* must be code segment */
2304 if (((e2 & (DESC_S_MASK | DESC_CS_MASK)) !=
2305 (DESC_S_MASK | DESC_CS_MASK)))
2306 raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2307 if (((e2 & DESC_C_MASK) && (dpl > cpl)) ||
2308 (!(e2 & DESC_C_MASK) && (dpl != cpl)))
2309 raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2310 if (!(e2 & DESC_P_MASK))
2311 raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2312 limit = get_seg_limit(e1, e2);
2313 if (new_eip > limit)
2314 raise_exception_err(EXCP0D_GPF, 0);
2315 cpu_x86_load_seg_cache(env, R_CS, (gate_cs & 0xfffc) | cpl,
2316 get_seg_base(e1, e2), limit, e2);
2317 EIP = new_eip;
2318 break;
2319 default:
2320 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2321 break;
2322 }
2323 }
2324 }
2325
2326 /* real mode call */
2327 void helper_lcall_real(int new_cs, target_ulong new_eip1,
2328 int shift, int next_eip)
2329 {
2330 int new_eip;
2331 uint32_t esp, esp_mask;
2332 target_ulong ssp;
2333
2334 new_eip = new_eip1;
2335 esp = ESP;
2336 esp_mask = get_sp_mask(env->segs[R_SS].flags);
2337 ssp = env->segs[R_SS].base;
2338 if (shift) {
2339 PUSHL(ssp, esp, esp_mask, env->segs[R_CS].selector);
2340 PUSHL(ssp, esp, esp_mask, next_eip);
2341 } else {
2342 PUSHW(ssp, esp, esp_mask, env->segs[R_CS].selector);
2343 PUSHW(ssp, esp, esp_mask, next_eip);
2344 }
2345
2346 SET_ESP(esp, esp_mask);
2347 env->eip = new_eip;
2348 env->segs[R_CS].selector = new_cs;
2349 env->segs[R_CS].base = (new_cs << 4);
2350 }
2351
2352 /* protected mode call */
2353 void helper_lcall_protected(int new_cs, target_ulong new_eip,
2354 int shift, int next_eip_addend)
2355 {
2356 int new_stack, i;
2357 uint32_t e1, e2, cpl, dpl, rpl, selector, offset, param_count;
2358 uint32_t ss = 0, ss_e1 = 0, ss_e2 = 0, sp, type, ss_dpl, sp_mask;
2359 uint32_t val, limit, old_sp_mask;
2360 target_ulong ssp, old_ssp, next_eip;
2361
2362 next_eip = env->eip + next_eip_addend;
2363 LOG_PCALL("lcall %04x:%08x s=%d\n", new_cs, (uint32_t)new_eip, shift);
2364 LOG_PCALL_STATE(env);
2365 if ((new_cs & 0xfffc) == 0)
2366 raise_exception_err(EXCP0D_GPF, 0);
2367 if (load_segment(&e1, &e2, new_cs) != 0)
2368 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2369 cpl = env->hflags & HF_CPL_MASK;
2370 LOG_PCALL("desc=%08x:%08x\n", e1, e2);
2371 if (e2 & DESC_S_MASK) {
2372 if (!(e2 & DESC_CS_MASK))
2373 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2374 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2375 if (e2 & DESC_C_MASK) {
2376 /* conforming code segment */
2377 if (dpl > cpl)
2378 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2379 } else {
2380 /* non conforming code segment */
2381 rpl = new_cs & 3;
2382 if (rpl > cpl)
2383 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2384 if (dpl != cpl)
2385 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2386 }
2387 if (!(e2 & DESC_P_MASK))
2388 raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2389
2390 #ifdef TARGET_X86_64
2391 /* XXX: check 16/32 bit cases in long mode */
2392 if (shift == 2) {
2393 target_ulong rsp;
2394 /* 64 bit case */
2395 rsp = ESP;
2396 PUSHQ(rsp, env->segs[R_CS].selector);
2397 PUSHQ(rsp, next_eip);
2398 /* from this point, not restartable */
2399 ESP = rsp;
2400 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
2401 get_seg_base(e1, e2),
2402 get_seg_limit(e1, e2), e2);
2403 EIP = new_eip;
2404 } else
2405 #endif
2406 {
2407 sp = ESP;
2408 sp_mask = get_sp_mask(env->segs[R_SS].flags);
2409 ssp = env->segs[R_SS].base;
2410 if (shift) {
2411 PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
2412 PUSHL(ssp, sp, sp_mask, next_eip);
2413 } else {
2414 PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
2415 PUSHW(ssp, sp, sp_mask, next_eip);
2416 }
2417
2418 limit = get_seg_limit(e1, e2);
2419 if (new_eip > limit)
2420 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2421 /* from this point, not restartable */
2422 SET_ESP(sp, sp_mask);
2423 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
2424 get_seg_base(e1, e2), limit, e2);
2425 EIP = new_eip;
2426 }
2427 } else {
2428 /* check gate type */
2429 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
2430 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2431 rpl = new_cs & 3;
2432 switch(type) {
2433 case 1: /* available 286 TSS */
2434 case 9: /* available 386 TSS */
2435 case 5: /* task gate */
2436 if (dpl < cpl || dpl < rpl)
2437 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2438 switch_tss(new_cs, e1, e2, SWITCH_TSS_CALL, next_eip);
2439 CC_OP = CC_OP_EFLAGS;
2440 return;
2441 case 4: /* 286 call gate */
2442 case 12: /* 386 call gate */
2443 break;
2444 default:
2445 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2446 break;
2447 }
2448 shift = type >> 3;
2449
2450 if (dpl < cpl || dpl < rpl)
2451 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2452 /* check valid bit */
2453 if (!(e2 & DESC_P_MASK))
2454 raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2455 selector = e1 >> 16;
2456 offset = (e2 & 0xffff0000) | (e1 & 0x0000ffff);
2457 param_count = e2 & 0x1f;
2458 if ((selector & 0xfffc) == 0)
2459 raise_exception_err(EXCP0D_GPF, 0);
2460
2461 if (load_segment(&e1, &e2, selector) != 0)
2462 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2463 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK)))
2464 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2465 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2466 if (dpl > cpl)
2467 raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2468 if (!(e2 & DESC_P_MASK))
2469 raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2470
2471 if (!(e2 & DESC_C_MASK) && dpl < cpl) {
2472 /* to inner privilege */
2473 get_ss_esp_from_tss(&ss, &sp, dpl);
2474 LOG_PCALL("new ss:esp=%04x:%08x param_count=%d ESP=" TARGET_FMT_lx "\n",
2475 ss, sp, param_count, ESP);
2476 if ((ss & 0xfffc) == 0)
2477 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2478 if ((ss & 3) != dpl)
2479 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2480 if (load_segment(&ss_e1, &ss_e2, ss) != 0)
2481 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2482 ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
2483 if (ss_dpl != dpl)
2484 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2485 if (!(ss_e2 & DESC_S_MASK) ||
2486 (ss_e2 & DESC_CS_MASK) ||
2487 !(ss_e2 & DESC_W_MASK))
2488 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2489 if (!(ss_e2 & DESC_P_MASK))
2490 raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2491
2492 // push_size = ((param_count * 2) + 8) << shift;
2493
2494 old_sp_mask = get_sp_mask(env->segs[R_SS].flags);
2495 old_ssp = env->segs[R_SS].base;
2496
2497 sp_mask = get_sp_mask(ss_e2);
2498 ssp = get_seg_base(ss_e1, ss_e2);
2499 if (shift) {
2500 PUSHL(ssp, sp, sp_mask, env->segs[R_SS].selector);
2501 PUSHL(ssp, sp, sp_mask, ESP);
2502 for(i = param_count - 1; i >= 0; i--) {
2503 val = ldl_kernel(old_ssp + ((ESP + i * 4) & old_sp_mask));
2504 PUSHL(ssp, sp, sp_mask, val);
2505 }
2506 } else {
2507 PUSHW(ssp, sp, sp_mask, env->segs[R_SS].selector);
2508 PUSHW(ssp, sp, sp_mask, ESP);
2509 for(i = param_count - 1; i >= 0; i--) {
2510 val = lduw_kernel(old_ssp + ((ESP + i * 2) & old_sp_mask));
2511 PUSHW(ssp, sp, sp_mask, val);
2512 }
2513 }
2514 new_stack = 1;
2515 } else {
2516 /* to same privilege */
2517 sp = ESP;
2518 sp_mask = get_sp_mask(env->segs[R_SS].flags);
2519 ssp = env->segs[R_SS].base;
2520 // push_size = (4 << shift);
2521 new_stack = 0;
2522 }
2523
2524 if (shift) {
2525 PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
2526 PUSHL(ssp, sp, sp_mask, next_eip);
2527 } else {
2528 PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
2529 PUSHW(ssp, sp, sp_mask, next_eip);
2530 }
2531
2532 /* from this point, not restartable */
2533
2534 if (new_stack) {
2535 ss = (ss & ~3) | dpl;
2536 cpu_x86_load_seg_cache(env, R_SS, ss,
2537 ssp,
2538 get_seg_limit(ss_e1, ss_e2),
2539 ss_e2);
2540 }
2541
2542 selector = (selector & ~3) | dpl;
2543 cpu_x86_load_seg_cache(env, R_CS, selector,
2544 get_seg_base(e1, e2),
2545 get_seg_limit(e1, e2),
2546 e2);
2547 cpu_x86_set_cpl(env, dpl);
2548 SET_ESP(sp, sp_mask);
2549 EIP = offset;
2550 }
2551 }
2552
2553 /* real and vm86 mode iret */
2554 void helper_iret_real(int shift)
2555 {
2556 uint32_t sp, new_cs, new_eip, new_eflags, sp_mask;
2557 target_ulong ssp;
2558 int eflags_mask;
2559
2560 sp_mask = 0xffff; /* XXXX: use SS segment size ? */
2561 sp = ESP;
2562 ssp = env->segs[R_SS].base;
2563 if (shift == 1) {
2564 /* 32 bits */
2565 POPL(ssp, sp, sp_mask, new_eip);
2566 POPL(ssp, sp, sp_mask, new_cs);
2567 new_cs &= 0xffff;
2568 POPL(ssp, sp, sp_mask, new_eflags);
2569 } else {
2570 /* 16 bits */
2571 POPW(ssp, sp, sp_mask, new_eip);
2572 POPW(ssp, sp, sp_mask, new_cs);
2573 POPW(ssp, sp, sp_mask, new_eflags);
2574 }
2575 ESP = (ESP & ~sp_mask) | (sp & sp_mask);
2576 env->segs[R_CS].selector = new_cs;
2577 env->segs[R_CS].base = (new_cs << 4);
2578 env->eip = new_eip;
2579 if (env->eflags & VM_MASK)
2580 eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | RF_MASK | NT_MASK;
2581 else
2582 eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | IOPL_MASK | RF_MASK | NT_MASK;
2583 if (shift == 0)
2584 eflags_mask &= 0xffff;
2585 load_eflags(new_eflags, eflags_mask);
2586 env->hflags2 &= ~HF2_NMI_MASK;
2587 }
2588
2589 static inline void validate_seg(int seg_reg, int cpl)
2590 {
2591 int dpl;
2592 uint32_t e2;
2593
2594 /* XXX: on x86_64, we do not want to nullify FS and GS because
2595 they may still contain a valid base. I would be interested to
2596 know how a real x86_64 CPU behaves */
2597 if ((seg_reg == R_FS || seg_reg == R_GS) &&
2598 (env->segs[seg_reg].selector & 0xfffc) == 0)
2599 return;
2600
2601 e2 = env->segs[seg_reg].flags;
2602 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2603 if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) {
2604 /* data or non conforming code segment */
2605 if (dpl < cpl) {
2606 cpu_x86_load_seg_cache(env, seg_reg, 0, 0, 0, 0);
2607 }
2608 }
2609 }
2610
2611 /* protected mode iret */
2612 static inline void helper_ret_protected(int shift, int is_iret, int addend)
2613 {
2614 uint32_t new_cs, new_eflags, new_ss;
2615 uint32_t new_es, new_ds, new_fs, new_gs;
2616 uint32_t e1, e2, ss_e1, ss_e2;
2617 int cpl, dpl, rpl, eflags_mask, iopl;
2618 target_ulong ssp, sp, new_eip, new_esp, sp_mask;
2619
2620 #ifdef TARGET_X86_64
2621 if (shift == 2)
2622 sp_mask = -1;
2623 else
2624 #endif
2625 sp_mask = get_sp_mask(env->segs[R_SS].flags);
2626 sp = ESP;
2627 ssp = env->segs[R_SS].base;
2628 new_eflags = 0; /* avoid warning */
2629 #ifdef TARGET_X86_64
2630 if (shift == 2) {
2631 POPQ(sp, new_eip);
2632 POPQ(sp, new_cs);
2633 new_cs &= 0xffff;
2634 if (is_iret) {
2635 POPQ(sp, new_eflags);
2636 }
2637 } else
2638 #endif
2639 if (shift == 1) {
2640 /* 32 bits */
2641 POPL(ssp, sp, sp_mask, new_eip);
2642 POPL(ssp, sp, sp_mask, new_cs);
2643 new_cs &= 0xffff;
2644 if (is_iret) {
2645 POPL(ssp, sp, sp_mask, new_eflags);
2646 if (new_eflags & VM_MASK)
2647 goto return_to_vm86;
2648 }
2649 } else {
2650 /* 16 bits */
2651 POPW(ssp, sp, sp_mask, new_eip);
2652 POPW(ssp, sp, sp_mask, new_cs);
2653 if (is_iret)
2654 POPW(ssp, sp, sp_mask, new_eflags);
2655 }
2656 LOG_PCALL("lret new %04x:" TARGET_FMT_lx " s=%d addend=0x%x\n",
2657 new_cs, new_eip, shift, addend);
2658 LOG_PCALL_STATE(env);
2659 if ((new_cs & 0xfffc) == 0)
2660 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2661 if (load_segment(&e1, &e2, new_cs) != 0)
2662 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2663 if (!(e2 & DESC_S_MASK) ||
2664 !(e2 & DESC_CS_MASK))
2665 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2666 cpl = env->hflags & HF_CPL_MASK;
2667 rpl = new_cs & 3;
2668 if (rpl < cpl)
2669 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2670 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2671 if (e2 & DESC_C_MASK) {
2672 if (dpl > rpl)
2673 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2674 } else {
2675 if (dpl != rpl)
2676 raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2677 }
2678 if (!(e2 & DESC_P_MASK))
2679 raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2680
2681 sp += addend;
2682 if (rpl == cpl && (!(env->hflags & HF_CS64_MASK) ||
2683 ((env->hflags & HF_CS64_MASK) && !is_iret))) {
2684 /* return to same privilege level */
2685 cpu_x86_load_seg_cache(env, R_CS, new_cs,
2686 get_seg_base(e1, e2),
2687 get_seg_limit(e1, e2),
2688 e2);
2689 } else {
2690 /* return to different privilege level */
2691 #ifdef TARGET_X86_64
2692 if (shift == 2) {
2693 POPQ(sp, new_esp);
2694 POPQ(sp, new_ss);
2695 new_ss &= 0xffff;
2696 } else
2697 #endif
2698 if (shift == 1) {
2699 /* 32 bits */
2700 POPL(ssp, sp, sp_mask, new_esp);
2701 POPL(ssp, sp, sp_mask, new_ss);
2702 new_ss &= 0xffff;
2703 } else {
2704 /* 16 bits */
2705 POPW(ssp, sp, sp_mask, new_esp);
2706 POPW(ssp, sp, sp_mask, new_ss);
2707 }
2708 LOG_PCALL("new ss:esp=%04x:" TARGET_FMT_lx "\n",
2709 new_ss, new_esp);
2710 if ((new_ss & 0xfffc) == 0) {
2711 #ifdef TARGET_X86_64
2712 /* NULL ss is allowed in long mode if cpl != 3*/
2713 /* XXX: test CS64 ? */
2714 if ((env->hflags & HF_LMA_MASK) && rpl != 3) {
2715 cpu_x86_load_seg_cache(env, R_SS, new_ss,
2716 0, 0xffffffff,
2717 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2718 DESC_S_MASK | (rpl << DESC_DPL_SHIFT) |
2719 DESC_W_MASK | DESC_A_MASK);
2720 ss_e2 = DESC_B_MASK; /* XXX: should not be needed ? */
2721 } else
2722 #endif
2723 {
2724 raise_exception_err(EXCP0D_GPF, 0);
2725 }
2726 } else {
2727 if ((new_ss & 3) != rpl)
2728 raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2729 if (load_segment(&ss_e1, &ss_e2, new_ss) != 0)
2730 raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2731 if (!(ss_e2 & DESC_S_MASK) ||
2732 (ss_e2 & DESC_CS_MASK) ||
2733 !(ss_e2 & DESC_W_MASK))
2734 raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2735 dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
2736 if (dpl != rpl)
2737 raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2738 if (!(ss_e2 & DESC_P_MASK))
2739 raise_exception_err(EXCP0B_NOSEG, new_ss & 0xfffc);
2740 cpu_x86_load_seg_cache(env, R_SS, new_ss,
2741 get_seg_base(ss_e1, ss_e2),
2742 get_seg_limit(ss_e1, ss_e2),
2743 ss_e2);
2744 }
2745
2746 cpu_x86_load_seg_cache(env, R_CS, new_cs,
2747 get_seg_base(e1, e2),
2748 get_seg_limit(e1, e2),
2749 e2);
2750 cpu_x86_set_cpl(env, rpl);
2751 sp = new_esp;
2752 #ifdef TARGET_X86_64
2753 if (env->hflags & HF_CS64_MASK)
2754 sp_mask = -1;
2755 else
2756 #endif
2757 sp_mask = get_sp_mask(ss_e2);
2758
2759 /* validate data segments */
2760 validate_seg(R_ES, rpl);
2761 validate_seg(R_DS, rpl);
2762 validate_seg(R_FS, rpl);
2763 validate_seg(R_GS, rpl);
2764
2765 sp += addend;
2766 }
2767 SET_ESP(sp, sp_mask);
2768 env->eip = new_eip;
2769 if (is_iret) {
2770 /* NOTE: 'cpl' is the _old_ CPL */
2771 eflags_mask = TF_MASK | AC_MASK | ID_MASK | RF_MASK | NT_MASK;
2772 if (cpl == 0)
2773 eflags_mask |= IOPL_MASK;
2774 iopl = (env->eflags >> IOPL_SHIFT) & 3;
2775 if (cpl <= iopl)
2776 eflags_mask |= IF_MASK;
2777 if (shift == 0)
2778 eflags_mask &= 0xffff;
2779 load_eflags(new_eflags, eflags_mask);
2780 }
2781 return;
2782
2783 return_to_vm86:
2784 POPL(ssp, sp, sp_mask, new_esp);
2785 POPL(ssp, sp, sp_mask, new_ss);
2786 POPL(ssp, sp, sp_mask, new_es);
2787 POPL(ssp, sp, sp_mask, new_ds);
2788 POPL(ssp, sp, sp_mask, new_fs);
2789 POPL(ssp, sp, sp_mask, new_gs);
2790
2791 /* modify processor state */
2792 load_eflags(new_eflags, TF_MASK | AC_MASK | ID_MASK |
2793 IF_MASK | IOPL_MASK | VM_MASK | NT_MASK | VIF_MASK | VIP_MASK);
2794 load_seg_vm(R_CS, new_cs & 0xffff);
2795 cpu_x86_set_cpl(env, 3);
2796 load_seg_vm(R_SS, new_ss & 0xffff);
2797 load_seg_vm(R_ES, new_es & 0xffff);
2798 load_seg_vm(R_DS, new_ds & 0xffff);
2799 load_seg_vm(R_FS, new_fs & 0xffff);
2800 load_seg_vm(R_GS, new_gs & 0xffff);
2801
2802 env->eip = new_eip & 0xffff;
2803 ESP = new_esp;
2804 }
2805
2806 void helper_iret_protected(int shift, int next_eip)
2807 {
2808 int tss_selector, type;
2809 uint32_t e1, e2;
2810
2811 /* specific case for TSS */
2812 if (env->eflags & NT_MASK) {
2813 #ifdef TARGET_X86_64
2814 if (env->hflags & HF_LMA_MASK)
2815 raise_exception_err(EXCP0D_GPF, 0);
2816 #endif
2817 tss_selector = lduw_kernel(env->tr.base + 0);
2818 if (tss_selector & 4)
2819 raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2820 if (load_segment(&e1, &e2, tss_selector) != 0)
2821 raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2822 type = (e2 >> DESC_TYPE_SHIFT) & 0x17;
2823 /* NOTE: we check both segment and busy TSS */
2824 if (type != 3)
2825 raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2826 switch_tss(tss_selector, e1, e2, SWITCH_TSS_IRET, next_eip);
2827 } else {
2828 helper_ret_protected(shift, 1, 0);
2829 }
2830 env->hflags2 &= ~HF2_NMI_MASK;
2831 }
2832
2833 void helper_lret_protected(int shift, int addend)
2834 {
2835 helper_ret_protected(shift, 0, addend);
2836 }
2837
2838 void helper_sysenter(void)
2839 {
2840 if (env->sysenter_cs == 0) {
2841 raise_exception_err(EXCP0D_GPF, 0);
2842 }
2843 env->eflags &= ~(VM_MASK | IF_MASK | RF_MASK);
2844 cpu_x86_set_cpl(env, 0);
2845
2846 #ifdef TARGET_X86_64
2847 if (env->hflags & HF_LMA_MASK) {
2848 cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc,
2849 0, 0xffffffff,
2850 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2851 DESC_S_MASK |
2852 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);
2853 } else
2854 #endif
2855 {
2856 cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc,
2857 0, 0xffffffff,
2858 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2859 DESC_S_MASK |
2860 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
2861 }
2862 cpu_x86_load_seg_cache(env, R_SS, (env->sysenter_cs + 8) & 0xfffc,
2863 0, 0xffffffff,
2864 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2865 DESC_S_MASK |
2866 DESC_W_MASK | DESC_A_MASK);
2867 ESP = env->sysenter_esp;
2868 EIP = env->sysenter_eip;
2869 }
2870
2871 void helper_sysexit(int dflag)
2872 {
2873 int cpl;
2874
2875 cpl = env->hflags & HF_CPL_MASK;
2876 if (env->sysenter_cs == 0 || cpl != 0) {
2877 raise_exception_err(EXCP0D_GPF, 0);
2878 }
2879 cpu_x86_set_cpl(env, 3);
2880 #ifdef TARGET_X86_64
2881 if (dflag == 2) {
2882 cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 32) & 0xfffc) | 3,
2883 0, 0xffffffff,
2884 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2885 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2886 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);
2887 cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 40) & 0xfffc) | 3,
2888 0, 0xffffffff,
2889 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2890 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2891 DESC_W_MASK | DESC_A_MASK);
2892 } else
2893 #endif
2894 {
2895 cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 16) & 0xfffc) | 3,
2896 0, 0xffffffff,
2897 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2898 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2899 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
2900 cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 24) & 0xfffc) | 3,
2901 0, 0xffffffff,
2902 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2903 DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2904 DESC_W_MASK | DESC_A_MASK);
2905 }
2906 ESP = ECX;
2907 EIP = EDX;
2908 }
2909
2910 #if defined(CONFIG_USER_ONLY)
2911 target_ulong helper_read_crN(int reg)
2912 {
2913 return 0;
2914 }
2915
2916 void helper_write_crN(int reg, target_ulong t0)
2917 {
2918 }
2919
2920 void helper_movl_drN_T0(int reg, target_ulong t0)
2921 {
2922 }
2923 #else
2924 target_ulong helper_read_crN(int reg)
2925 {
2926 target_ulong val;
2927
2928 helper_svm_check_intercept_param(SVM_EXIT_READ_CR0 + reg, 0);
2929 switch(reg) {
2930 default:
2931 val = env->cr[reg];
2932 break;
2933 case 8:
2934 if (!(env->hflags2 & HF2_VINTR_MASK)) {
2935 val = cpu_get_apic_tpr(env->apic_state);
2936 } else {
2937 val = env->v_tpr;
2938 }
2939 break;
2940 }
2941 return val;
2942 }
2943
2944 void helper_write_crN(int reg, target_ulong t0)
2945 {
2946 helper_svm_check_intercept_param(SVM_EXIT_WRITE_CR0 + reg, 0);
2947 switch(reg) {
2948 case 0:
2949 cpu_x86_update_cr0(env, t0);
2950 break;
2951 case 3:
2952 cpu_x86_update_cr3(env, t0);
2953 break;
2954 case 4:
2955 cpu_x86_update_cr4(env, t0);
2956 break;
2957 case 8:
2958 if (!(env->hflags2 & HF2_VINTR_MASK)) {
2959 cpu_set_apic_tpr(env->apic_state, t0);
2960 }
2961 env->v_tpr = t0 & 0x0f;
2962 break;
2963 default:
2964 env->cr[reg] = t0;
2965 break;
2966 }
2967 }
2968
2969 void helper_movl_drN_T0(int reg, target_ulong t0)
2970 {
2971 int i;
2972
2973 if (reg < 4) {
2974 hw_breakpoint_remove(env, reg);
2975 env->dr[reg] = t0;
2976 hw_breakpoint_insert(env, reg);
2977 } else if (reg == 7) {
2978 for (i = 0; i < 4; i++)
2979 hw_breakpoint_remove(env, i);
2980 env->dr[7] = t0;
2981 for (i = 0; i < 4; i++)
2982 hw_breakpoint_insert(env, i);
2983 } else
2984 env->dr[reg] = t0;
2985 }
2986 #endif
2987
2988 void helper_lmsw(target_ulong t0)
2989 {
2990 /* only 4 lower bits of CR0 are modified. PE cannot be set to zero
2991 if already set to one. */
2992 t0 = (env->cr[0] & ~0xe) | (t0 & 0xf);
2993 helper_write_crN(0, t0);
2994 }
2995
2996 void helper_clts(void)
2997 {
2998 env->cr[0] &= ~CR0_TS_MASK;
2999 env->hflags &= ~HF_TS_MASK;
3000 }
3001
3002 void helper_invlpg(target_ulong addr)
3003 {
3004 helper_svm_check_intercept_param(SVM_EXIT_INVLPG, 0);
3005 tlb_flush_page(env, addr);
3006 }
3007
3008 void helper_rdtsc(void)
3009 {
3010 uint64_t val;
3011
3012 if ((env->cr[4] & CR4_TSD_MASK) && ((env->hflags & HF_CPL_MASK) != 0)) {
3013 raise_exception(EXCP0D_GPF);
3014 }
3015 helper_svm_check_intercept_param(SVM_EXIT_RDTSC, 0);
3016
3017 val = cpu_get_tsc(env) + env->tsc_offset;
3018 EAX = (uint32_t)(val);
3019 EDX = (uint32_t)(val >> 32);
3020 }
3021
3022 void helper_rdtscp(void)
3023 {
3024 helper_rdtsc();
3025 ECX = (uint32_t)(env->tsc_aux);
3026 }
3027
3028 void helper_rdpmc(void)
3029 {
3030 if ((env->cr[4] & CR4_PCE_MASK) && ((env->hflags & HF_CPL_MASK) != 0)) {
3031 raise_exception(EXCP0D_GPF);
3032 }
3033 helper_svm_check_intercept_param(SVM_EXIT_RDPMC, 0);
3034
3035 /* currently unimplemented */
3036 raise_exception_err(EXCP06_ILLOP, 0);
3037 }
3038
3039 #if defined(CONFIG_USER_ONLY)
3040 void helper_wrmsr(void)
3041 {
3042 }
3043
3044 void helper_rdmsr(void)
3045 {
3046 }
3047 #else
3048 void helper_wrmsr(void)
3049 {
3050 uint64_t val;
3051
3052 helper_svm_check_intercept_param(SVM_EXIT_MSR, 1);
3053
3054 val = ((uint32_t)EAX) | ((uint64_t)((uint32_t)EDX) << 32);
3055
3056 switch((uint32_t)ECX) {
3057 case MSR_IA32_SYSENTER_CS:
3058 env->sysenter_cs = val & 0xffff;
3059 break;
3060 case MSR_IA32_SYSENTER_ESP:
3061 env->sysenter_esp = val;
3062 break;
3063 case MSR_IA32_SYSENTER_EIP:
3064 env->sysenter_eip = val;
3065 break;
3066 case MSR_IA32_APICBASE:
3067 cpu_set_apic_base(env->apic_state, val);
3068 break;
3069 case MSR_EFER:
3070 {
3071 uint64_t update_mask;
3072 update_mask = 0;
3073 if (env->cpuid_ext2_features & CPUID_EXT2_SYSCALL)
3074 update_mask |= MSR_EFER_SCE;
3075 if (env->cpuid_ext2_features & CPUID_EXT2_LM)
3076 update_mask |= MSR_EFER_LME;
3077 if (env->cpuid_ext2_features & CPUID_EXT2_FFXSR)
3078 update_mask |= MSR_EFER_FFXSR;
3079 if (env->cpuid_ext2_features & CPUID_EXT2_NX)
3080 update_mask |= MSR_EFER_NXE;
3081 if (env->cpuid_ext3_features & CPUID_EXT3_SVM)
3082 update_mask |= MSR_EFER_SVME;
3083 if (env->cpuid_ext2_features & CPUID_EXT2_FFXSR)
3084 update_mask |= MSR_EFER_FFXSR;
3085 cpu_load_efer(env, (env->efer & ~update_mask) |
3086 (val & update_mask));
3087 }
3088 break;
3089 case MSR_STAR:
3090 env->star = val;
3091 break;
3092 case MSR_PAT:
3093 env->pat = val;
3094 break;
3095 case MSR_VM_HSAVE_PA:
3096 env->vm_hsave = val;
3097 break;
3098 #ifdef TARGET_X86_64
3099 case MSR_LSTAR:
3100 env->lstar = val;
3101 break;
3102 case MSR_CSTAR:
3103 env->cstar = val;
3104 break;
3105 case MSR_FMASK:
3106 env->fmask = val;
3107 break;
3108 case MSR_FSBASE:
3109 env->segs[R_FS].base = val;
3110 break;
3111 case MSR_GSBASE:
3112 env->segs[R_GS].base = val;
3113 break;
3114 case MSR_KERNELGSBASE:
3115 env->kernelgsbase = val;
3116 break;
3117 #endif
3118 case MSR_MTRRphysBase(0):
3119 case MSR_MTRRphysBase(1):
3120 case MSR_MTRRphysBase(2):
3121 case MSR_MTRRphysBase(3):
3122 case MSR_MTRRphysBase(4):
3123 case MSR_MTRRphysBase(5):
3124 case MSR_MTRRphysBase(6):
3125 case MSR_MTRRphysBase(7):
3126 env->mtrr_var[((uint32_t)ECX - MSR_MTRRphysBase(0)) / 2].base = val;
3127 break;
3128 case MSR_MTRRphysMask(0):
3129 case MSR_MTRRphysMask(1):
3130 case MSR_MTRRphysMask(2):
3131 case MSR_MTRRphysMask(3):
3132 case MSR_MTRRphysMask(4):
3133 case MSR_MTRRphysMask(5):
3134 case MSR_MTRRphysMask(6):
3135 case MSR_MTRRphysMask(7):
3136 env->mtrr_var[((uint32_t)ECX - MSR_MTRRphysMask(0)) / 2].mask = val;
3137 break;
3138 case MSR_MTRRfix64K_00000:
3139 env->mtrr_fixed[(uint32_t)ECX - MSR_MTRRfix64K_00000] = val;
3140 break;
3141 case MSR_MTRRfix16K_80000:
3142 case MSR_MTRRfix16K_A0000:
3143 env->mtrr_fixed[(uint32_t)ECX - MSR_MTRRfix16K_80000 + 1] = val;
3144 break;
3145 case MSR_MTRRfix4K_C0000:
3146 case MSR_MTRRfix4K_C8000:
3147 case MSR_MTRRfix4K_D0000:
3148 case MSR_MTRRfix4K_D8000:
3149 case MSR_MTRRfix4K_E0000:
3150 case MSR_MTRRfix4K_E8000:
3151 case MSR_MTRRfix4K_F0000:
3152 case MSR_MTRRfix4K_F8000:
3153 env->mtrr_fixed[(uint32_t)ECX - MSR_MTRRfix4K_C0000 + 3] = val;
3154 break;
3155 case MSR_MTRRdefType:
3156 env->mtrr_deftype = val;
3157 break;
3158 case MSR_MCG_STATUS:
3159 env->mcg_status = val;
3160 break;
3161 case MSR_MCG_CTL:
3162 if ((env->mcg_cap & MCG_CTL_P)
3163 && (val == 0 || val == ~(uint64_t)0))
3164 env->mcg_ctl = val;
3165 break;
3166 case MSR_TSC_AUX:
3167 env->tsc_aux = val;
3168 break;
3169 default:
3170 if ((uint32_t)ECX >= MSR_MC0_CTL
3171 && (uint32_t)ECX < MSR_MC0_CTL + (4 * env->mcg_cap & 0xff)) {
3172 uint32_t offset = (uint32_t)ECX - MSR_MC0_CTL;
3173 if ((offset & 0x3) != 0
3174 || (val == 0 || val == ~(uint64_t)0))
3175 env->mce_banks[offset] = val;
3176 break;
3177 }
3178 /* XXX: exception ? */
3179 break;
3180 }
3181 }
3182
3183 void helper_rdmsr(void)
3184 {
3185 uint64_t val;
3186
3187 helper_svm_check_intercept_param(SVM_EXIT_MSR, 0);
3188
3189 switch((uint32_t)ECX) {
3190 case MSR_IA32_SYSENTER_CS:
3191 val = env->sysenter_cs;
3192 break;
3193 case MSR_IA32_SYSENTER_ESP:
3194 val = env->sysenter_esp;
3195 break;
3196 case MSR_IA32_SYSENTER_EIP:
3197 val = env->sysenter_eip;
3198 break;
3199 case MSR_IA32_APICBASE:
3200 val = cpu_get_apic_base(env->apic_state);
3201 break;
3202 case MSR_EFER:
3203 val = env->efer;
3204 break;
3205 case MSR_STAR:
3206 val = env->star;
3207 break;
3208 case MSR_PAT:
3209 val = env->pat;
3210 break;
3211 case MSR_VM_HSAVE_PA:
3212 val = env->vm_hsave;
3213 break;
3214 case MSR_IA32_PERF_STATUS:
3215 /* tsc_increment_by_tick */
3216 val = 1000ULL;
3217 /* CPU multiplier */
3218 val |= (((uint64_t)4ULL) << 40);
3219 break;
3220 #ifdef TARGET_X86_64
3221 case MSR_LSTAR:
3222 val = env->lstar;
3223 break;
3224 case MSR_CSTAR:
3225 val = env->cstar;
3226 break;
3227 case MSR_FMASK:
3228 val = env->fmask;
3229 break;
3230 case MSR_FSBASE:
3231 val = env->segs[R_FS].base;
3232 break;
3233 case MSR_GSBASE:
3234 val = env->segs[R_GS].base;
3235 break;
3236 case MSR_KERNELGSBASE:
3237 val = env->kernelgsbase;
3238 break;
3239 case MSR_TSC_AUX:
3240 val = env->tsc_aux;
3241 break;
3242 #endif
3243 case MSR_MTRRphysBase(0):
3244 case MSR_MTRRphysBase(1):
3245 case MSR_MTRRphysBase(2):
3246 case MSR_MTRRphysBase(3):
3247 case MSR_MTRRphysBase(4):
3248 case MSR_MTRRphysBase(5):
3249 case MSR_MTRRphysBase(6):
3250 case MSR_MTRRphysBase(7):
3251 val = env->mtrr_var[((uint32_t)ECX - MSR_MTRRphysBase(0)) / 2].base;
3252 break;
3253 case MSR_MTRRphysMask(0):
3254 case MSR_MTRRphysMask(1):
3255 case MSR_MTRRphysMask(2):
3256 case MSR_MTRRphysMask(3):
3257 case MSR_MTRRphysMask(4):
3258 case MSR_MTRRphysMask(5):
3259 case MSR_MTRRphysMask(6):
3260 case MSR_MTRRphysMask(7):
3261 val = env->mtrr_var[((uint32_t)ECX - MSR_MTRRphysMask(0)) / 2].mask;
3262 break;
3263 case MSR_MTRRfix64K_00000:
3264 val = env->mtrr_fixed[0];
3265 break;
3266 case MSR_MTRRfix16K_80000:
3267 case MSR_MTRRfix16K_A0000:
3268 val = env->mtrr_fixed[(uint32_t)ECX - MSR_MTRRfix16K_80000 + 1];
3269 break;
3270 case MSR_MTRRfix4K_C0000:
3271 case MSR_MTRRfix4K_C8000:
3272 case MSR_MTRRfix4K_D0000:
3273 case MSR_MTRRfix4K_D8000:
3274 case MSR_MTRRfix4K_E0000:
3275 case MSR_MTRRfix4K_E8000:
3276 case MSR_MTRRfix4K_F0000:
3277 case MSR_MTRRfix4K_F8000:
3278 val = env->mtrr_fixed[(uint32_t)ECX - MSR_MTRRfix4K_C0000 + 3];
3279 break;
3280 case MSR_MTRRdefType:
3281 val = env->mtrr_deftype;
3282 break;
3283 case MSR_MTRRcap:
3284 if (env->cpuid_features & CPUID_MTRR)
3285 val = MSR_MTRRcap_VCNT | MSR_MTRRcap_FIXRANGE_SUPPORT | MSR_MTRRcap_WC_SUPPORTED;
3286 else
3287 /* XXX: exception ? */
3288 val = 0;
3289 break;
3290 case MSR_MCG_CAP:
3291 val = env->mcg_cap;
3292 break;
3293 case MSR_MCG_CTL:
3294 if (env->mcg_cap & MCG_CTL_P)
3295 val = env->mcg_ctl;
3296 else
3297 val = 0;
3298 break;
3299 case MSR_MCG_STATUS:
3300 val = env->mcg_status;
3301 break;
3302 default:
3303 if ((uint32_t)ECX >= MSR_MC0_CTL
3304 && (uint32_t)ECX < MSR_MC0_CTL + (4 * env->mcg_cap & 0xff)) {
3305 uint32_t offset = (uint32_t)ECX - MSR_MC0_CTL;
3306 val = env->mce_banks[offset];
3307 break;
3308 }
3309 /* XXX: exception ? */
3310 val = 0;
3311 break;
3312 }
3313 EAX = (uint32_t)(val);
3314 EDX = (uint32_t)(val >> 32);
3315 }
3316 #endif
3317
3318 target_ulong helper_lsl(target_ulong selector1)
3319 {
3320 unsigned int limit;
3321 uint32_t e1, e2, eflags, selector;
3322 int rpl, dpl, cpl, type;
3323
3324 selector = selector1 & 0xffff;
3325 eflags = helper_cc_compute_all(CC_OP);
3326 if ((selector & 0xfffc) == 0)
3327 goto fail;
3328 if (load_segment(&e1, &e2, selector) != 0)
3329 goto fail;
3330 rpl = selector & 3;
3331 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
3332 cpl = env->hflags & HF_CPL_MASK;
3333 if (e2 & DESC_S_MASK) {
3334 if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) {
3335 /* conforming */
3336 } else {
3337 if (dpl < cpl || dpl < rpl)
3338 goto fail;
3339 }
3340 } else {
3341 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
3342 switch(type) {
3343 case 1:
3344 case 2:
3345 case 3:
3346 case 9:
3347 case 11:
3348 break;
3349 default:
3350 goto fail;
3351 }
3352 if (dpl < cpl || dpl < rpl) {
3353 fail:
3354 CC_SRC = eflags & ~CC_Z;
3355 return 0;
3356 }
3357 }
3358 limit = get_seg_limit(e1, e2);
3359 CC_SRC = eflags | CC_Z;
3360 return limit;
3361 }
3362
3363 target_ulong helper_lar(target_ulong selector1)
3364 {
3365 uint32_t e1, e2, eflags, selector;
3366 int rpl, dpl, cpl, type;
3367
3368 selector = selector1 & 0xffff;
3369 eflags = helper_cc_compute_all(CC_OP);
3370 if ((selector & 0xfffc) == 0)
3371 goto fail;
3372 if (load_segment(&e1, &e2, selector) != 0)
3373 goto fail;
3374 rpl = selector & 3;
3375 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
3376 cpl = env->hflags & HF_CPL_MASK;
3377 if (e2 & DESC_S_MASK) {
3378 if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) {
3379 /* conforming */
3380 } else {
3381 if (dpl < cpl || dpl < rpl)
3382 goto fail;
3383 }
3384 } else {
3385 type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
3386 switch(type) {
3387 case 1:
3388 case 2:
3389 case 3:
3390 case 4:
3391 case 5:
3392 case 9:
3393 case 11:
3394 case 12:
3395 break;
3396 default:
3397 goto fail;
3398 }
3399 if (dpl < cpl || dpl < rpl) {
3400 fail:
3401 CC_SRC = eflags & ~CC_Z;
3402 return 0;
3403 }
3404 }
3405 CC_SRC = eflags | CC_Z;
3406 return e2 & 0x00f0ff00;
3407 }
3408
3409 void helper_verr(target_ulong selector1)
3410 {
3411 uint32_t e1, e2, eflags, selector;
3412 int rpl, dpl, cpl;
3413
3414 selector = selector1 & 0xffff;
3415 eflags = helper_cc_compute_all(CC_OP);
3416 if ((selector & 0xfffc) == 0)
3417 goto fail;
3418 if (load_segment(&e1, &e2, selector) != 0)
3419 goto fail;
3420 if (!(e2 & DESC_S_MASK))
3421 goto fail;
3422 rpl = selector & 3;
3423 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
3424 cpl = env->hflags & HF_CPL_MASK;
3425 if (e2 & DESC_CS_MASK) {
3426 if (!(e2 & DESC_R_MASK))
3427 goto fail;
3428 if (!(e2 & DESC_C_MASK)) {
3429 if (dpl < cpl || dpl < rpl)
3430 goto fail;
3431 }
3432 } else {
3433 if (dpl < cpl || dpl < rpl) {
3434 fail:
3435 CC_SRC = eflags & ~CC_Z;
3436 return;
3437 }
3438 }
3439 CC_SRC = eflags | CC_Z;
3440 }
3441
3442 void helper_verw(target_ulong selector1)
3443 {
3444 uint32_t e1, e2, eflags, selector;
3445 int rpl, dpl, cpl;
3446
3447 selector = selector1 & 0xffff;
3448 eflags = helper_cc_compute_all(CC_OP);
3449 if ((selector & 0xfffc) == 0)
3450 goto fail;
3451 if (load_segment(&e1, &e2, selector) != 0)
3452 goto fail;
3453 if (!(e2 & DESC_S_MASK))
3454 goto fail;
3455 rpl = selector & 3;
3456 dpl = (e2 >> DESC_DPL_SHIFT) & 3;
3457 cpl = env->hflags & HF_CPL_MASK;
3458 if (e2 & DESC_CS_MASK) {
3459 goto fail;
3460 } else {
3461 if (dpl < cpl || dpl < rpl)
3462 goto fail;
3463 if (!(e2 & DESC_W_MASK)) {
3464 fail:
3465 CC_SRC = eflags & ~CC_Z;
3466 return;
3467 }
3468 }
3469 CC_SRC = eflags | CC_Z;
3470 }
3471
3472 /* x87 FPU helpers */
3473
3474 static inline double floatx80_to_double(floatx80 a)
3475 {
3476 union {
3477 float64 f64;
3478 double d;
3479 } u;
3480
3481 u.f64 = floatx80_to_float64(a, &env->fp_status);
3482 return u.d;
3483 }
3484
3485 static inline floatx80 double_to_floatx80(double a)
3486 {
3487 union {
3488 float64 f64;
3489 double d;
3490 } u;
3491
3492 u.d = a;
3493 return float64_to_floatx80(u.f64, &env->fp_status);
3494 }
3495
3496 static void fpu_set_exception(int mask)
3497 {
3498 env->fpus |= mask;
3499 if (env->fpus & (~env->fpuc & FPUC_EM))
3500 env->fpus |= FPUS_SE | FPUS_B;
3501 }
3502
3503 static inline floatx80 helper_fdiv(floatx80 a, floatx80 b)
3504 {
3505 if (floatx80_is_zero(b)) {
3506 fpu_set_exception(FPUS_ZE);
3507 }
3508 return floatx80_div(a, b, &env->fp_status);
3509 }
3510
3511 static void fpu_raise_exception(void)
3512 {
3513 if (env->cr[0] & CR0_NE_MASK) {
3514 raise_exception(EXCP10_COPR);
3515 }
3516 #if !defined(CONFIG_USER_ONLY)
3517 else {
3518 cpu_set_ferr(env);
3519 }
3520 #endif
3521 }
3522
3523 void helper_flds_FT0(uint32_t val)
3524 {
3525 union {
3526 float32 f;
3527 uint32_t i;
3528 } u;
3529 u.i = val;
3530 FT0 = float32_to_floatx80(u.f, &env->fp_status);
3531 }
3532
3533 void helper_fldl_FT0(uint64_t val)
3534 {
3535 union {
3536 float64 f;
3537 uint64_t i;
3538 } u;
3539 u.i = val;
3540 FT0 = float64_to_floatx80(u.f, &env->fp_status);
3541 }
3542
3543 void helper_fildl_FT0(int32_t val)
3544 {
3545 FT0 = int32_to_floatx80(val, &env->fp_status);
3546 }
3547
3548 void helper_flds_ST0(uint32_t val)
3549 {
3550 int new_fpstt;
3551 union {
3552 float32 f;
3553 uint32_t i;
3554 } u;
3555 new_fpstt = (env->fpstt - 1) & 7;
3556 u.i = val;
3557 env->fpregs[new_fpstt].d = float32_to_floatx80(u.f, &env->fp_status);
3558 env->fpstt = new_fpstt;
3559 env->fptags[new_fpstt] = 0; /* validate stack entry */
3560 }
3561
3562 void helper_fldl_ST0(uint64_t val)
3563 {
3564 int new_fpstt;
3565 union {
3566 float64 f;
3567 uint64_t i;
3568 } u;
3569 new_fpstt = (env->fpstt - 1) & 7;
3570 u.i = val;
3571 env->fpregs[new_fpstt].d = float64_to_floatx80(u.f, &env->fp_status);
3572 env->fpstt = new_fpstt;
3573 env->fptags[new_fpstt] = 0; /* validate stack entry */
3574 }
3575
3576 void helper_fildl_ST0(int32_t val)
3577 {
3578 int new_fpstt;
3579 new_fpstt = (env->fpstt - 1) & 7;
3580 env->fpregs[new_fpstt].d = int32_to_floatx80(val, &env->fp_status);
3581 env->fpstt = new_fpstt;
3582 env->fptags[new_fpstt] = 0; /* validate stack entry */
3583 }
3584
3585 void helper_fildll_ST0(int64_t val)
3586 {
3587 int new_fpstt;
3588 new_fpstt = (env->fpstt - 1) & 7;
3589 env->fpregs[new_fpstt].d = int64_to_floatx80(val, &env->fp_status);
3590 env->fpstt = new_fpstt;
3591 env->fptags[new_fpstt] = 0; /* validate stack entry */
3592 }
3593
3594 uint32_t helper_fsts_ST0(void)
3595 {
3596 union {
3597 float32 f;
3598 uint32_t i;
3599 } u;
3600 u.f = floatx80_to_float32(ST0, &env->fp_status);
3601 return u.i;
3602 }
3603
3604 uint64_t helper_fstl_ST0(void)
3605 {
3606 union {
3607 float64 f;
3608 uint64_t i;
3609 } u;
3610 u.f = floatx80_to_float64(ST0, &env->fp_status);
3611 return u.i;
3612 }
3613
3614 int32_t helper_fist_ST0(void)
3615 {
3616 int32_t val;
3617 val = floatx80_to_int32(ST0, &env->fp_status);
3618 if (val != (int16_t)val)
3619 val = -32768;
3620 return val;
3621 }
3622
3623 int32_t helper_fistl_ST0(void)
3624 {
3625 int32_t val;
3626 val = floatx80_to_int32(ST0, &env->fp_status);
3627 return val;
3628 }
3629
3630 int64_t helper_fistll_ST0(void)
3631 {
3632 int64_t val;
3633 val = floatx80_to_int64(ST0, &env->fp_status);
3634 return val;
3635 }
3636
3637 int32_t helper_fistt_ST0(void)
3638 {
3639 int32_t val;
3640 val = floatx80_to_int32_round_to_zero(ST0, &env->fp_status);
3641 if (val != (int16_t)val)
3642 val = -32768;
3643 return val;
3644 }
3645
3646 int32_t helper_fisttl_ST0(void)
3647 {
3648 int32_t val;
3649 val = floatx80_to_int32_round_to_zero(ST0, &env->fp_status);
3650 return val;
3651 }
3652
3653 int64_t helper_fisttll_ST0(void)
3654 {
3655 int64_t val;
3656 val = floatx80_to_int64_round_to_zero(ST0, &env->fp_status);
3657 return val;
3658 }
3659
3660 void helper_fldt_ST0(target_ulong ptr)
3661 {
3662 int new_fpstt;
3663 new_fpstt = (env->fpstt - 1) & 7;
3664 env->fpregs[new_fpstt].d = helper_fldt(ptr);
3665 env->fpstt = new_fpstt;
3666 env->fptags[new_fpstt] = 0; /* validate stack entry */
3667 }
3668
3669 void helper_fstt_ST0(target_ulong ptr)
3670 {
3671 helper_fstt(ST0, ptr);
3672 }
3673
3674 void helper_fpush(void)
3675 {
3676 fpush();
3677 }
3678
3679 void helper_fpop(void)
3680 {
3681 fpop();
3682 }
3683
3684 void helper_fdecstp(void)
3685 {
3686 env->fpstt = (env->fpstt - 1) & 7;
3687 env->fpus &= (~0x4700);
3688 }
3689
3690 void helper_fincstp(void)
3691 {
3692 env->fpstt = (env->fpstt + 1) & 7;
3693 env->fpus &= (~0x4700);
3694 }
3695
3696 /* FPU move */
3697
3698 void helper_ffree_STN(int st_index)
3699 {
3700 env->fptags[(env->fpstt + st_index) & 7] = 1;
3701 }
3702
3703 void helper_fmov_ST0_FT0(void)
3704 {
3705 ST0 = FT0;
3706 }
3707
3708 void helper_fmov_FT0_STN(int st_index)
3709 {
3710 FT0 = ST(st_index);
3711 }
3712
3713 void helper_fmov_ST0_STN(int st_index)
3714 {
3715 ST0 = ST(st_index);
3716 }
3717
3718 void helper_fmov_STN_ST0(int st_index)
3719 {
3720 ST(st_index) = ST0;
3721 }
3722
3723 void helper_fxchg_ST0_STN(int st_index)
3724 {
3725 floatx80 tmp;
3726 tmp = ST(st_index);
3727 ST(st_index) = ST0;
3728 ST0 = tmp;
3729 }
3730
3731 /* FPU operations */
3732
3733 static const int fcom_ccval[4] = {0x0100, 0x4000, 0x0000, 0x4500};
3734
3735 void helper_fcom_ST0_FT0(void)
3736 {
3737 int ret;
3738
3739 ret = floatx80_compare(ST0, FT0, &env->fp_status);
3740 env->fpus = (env->fpus & ~0x4500) | fcom_ccval[ret + 1];
3741 }
3742
3743 void helper_fucom_ST0_FT0(void)
3744 {
3745 int ret;
3746
3747 ret = floatx80_compare_quiet(ST0, FT0, &env->fp_status);
3748 env->fpus = (env->fpus & ~0x4500) | fcom_ccval[ret+ 1];
3749 }
3750
3751 static const int fcomi_ccval[4] = {CC_C, CC_Z, 0, CC_Z | CC_P | CC_C};
3752
3753 void helper_fcomi_ST0_FT0(void)
3754 {
3755 int eflags;
3756 int ret;
3757
3758 ret = floatx80_compare(ST0, FT0, &env->fp_status);
3759 eflags = helper_cc_compute_all(CC_OP);
3760 eflags = (eflags & ~(CC_Z | CC_P | CC_C)) | fcomi_ccval[ret + 1];
3761 CC_SRC = eflags;
3762 }
3763
3764 void helper_fucomi_ST0_FT0(void)
3765 {
3766 int eflags;
3767 int ret;
3768
3769 ret = floatx80_compare_quiet(ST0, FT0, &env->fp_status);
3770 eflags = helper_cc_compute_all(CC_OP);
3771 eflags = (eflags & ~(CC_Z | CC_P | CC_C)) | fcomi_ccval[ret + 1];
3772 CC_SRC = eflags;
3773 }
3774
3775 void helper_fadd_ST0_FT0(void)
3776 {
3777 ST0 = floatx80_add(ST0, FT0, &env->fp_status);
3778 }
3779
3780 void helper_fmul_ST0_FT0(void)
3781 {
3782 ST0 = floatx80_mul(ST0, FT0, &env->fp_status);
3783 }
3784
3785 void helper_fsub_ST0_FT0(void)
3786 {
3787 ST0 = floatx80_sub(ST0, FT0, &env->fp_status);
3788 }
3789
3790 void helper_fsubr_ST0_FT0(void)
3791 {
3792 ST0 = floatx80_sub(FT0, ST0, &env->fp_status);
3793 }
3794
3795 void helper_fdiv_ST0_FT0(void)
3796 {
3797 ST0 = helper_fdiv(ST0, FT0);
3798 }
3799
3800 void helper_fdivr_ST0_FT0(void)
3801 {
3802 ST0 = helper_fdiv(FT0, ST0);
3803 }
3804
3805 /* fp operations between STN and ST0 */
3806
3807 void helper_fadd_STN_ST0(int st_index)
3808 {
3809 ST(st_index) = floatx80_add(ST(st_index), ST0, &env->fp_status);
3810 }
3811
3812 void helper_fmul_STN_ST0(int st_index)
3813 {
3814 ST(st_index) = floatx80_mul(ST(st_index), ST0, &env->fp_status);
3815 }
3816
3817 void helper_fsub_STN_ST0(int st_index)
3818 {
3819 ST(st_index) = floatx80_sub(ST(st_index), ST0, &env->fp_status);
3820 }
3821
3822 void helper_fsubr_STN_ST0(int st_index)
3823 {
3824 ST(st_index) = floatx80_sub(ST0, ST(st_index), &env->fp_status);
3825 }
3826
3827 void helper_fdiv_STN_ST0(int st_index)
3828 {
3829 floatx80 *p;
3830 p = &ST(st_index);
3831 *p = helper_fdiv(*p, ST0);
3832 }
3833
3834 void helper_fdivr_STN_ST0(int st_index)
3835 {
3836 floatx80 *p;
3837 p = &ST(st_index);
3838 *p = helper_fdiv(ST0, *p);
3839 }
3840
3841 /* misc FPU operations */
3842 void helper_fchs_ST0(void)
3843 {
3844 ST0 = floatx80_chs(ST0);
3845 }
3846
3847 void helper_fabs_ST0(void)
3848 {
3849 ST0 = floatx80_abs(ST0);
3850 }
3851
3852 void helper_fld1_ST0(void)
3853 {
3854 ST0 = floatx80_one;
3855 }
3856
3857 void helper_fldl2t_ST0(void)
3858 {
3859 ST0 = floatx80_l2t;
3860 }
3861
3862 void helper_fldl2e_ST0(void)
3863 {
3864 ST0 = floatx80_l2e;
3865 }
3866
3867 void helper_fldpi_ST0(void)
3868 {
3869 ST0 = floatx80_pi;
3870 }
3871
3872 void helper_fldlg2_ST0(void)
3873 {
3874 ST0 = floatx80_lg2;
3875 }
3876
3877 void helper_fldln2_ST0(void)
3878 {
3879 ST0 = floatx80_ln2;
3880 }
3881
3882 void helper_fldz_ST0(void)
3883 {
3884 ST0 = floatx80_zero;
3885 }
3886
3887 void helper_fldz_FT0(void)
3888 {
3889 FT0 = floatx80_zero;
3890 }
3891
3892 uint32_t helper_fnstsw(void)
3893 {
3894 return (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
3895 }
3896
3897 uint32_t helper_fnstcw(void)
3898 {
3899 return env->fpuc;
3900 }
3901
3902 static void update_fp_status(void)
3903 {
3904 int rnd_type;
3905
3906 /* set rounding mode */
3907 switch(env->fpuc & RC_MASK) {
3908 default:
3909 case RC_NEAR:
3910 rnd_type = float_round_nearest_even;
3911 break;
3912 case RC_DOWN:
3913 rnd_type = float_round_down;
3914 break;
3915 case RC_UP:
3916 rnd_type = float_round_up;
3917 break;
3918 case RC_CHOP:
3919 rnd_type = float_round_to_zero;
3920 break;
3921 }
3922 set_float_rounding_mode(rnd_type, &env->fp_status);
3923 switch((env->fpuc >> 8) & 3) {
3924 case 0:
3925 rnd_type = 32;
3926 break;
3927 case 2:
3928 rnd_type = 64;
3929 break;
3930 case 3:
3931 default:
3932 rnd_type = 80;
3933 break;
3934 }
3935 set_floatx80_rounding_precision(rnd_type, &env->fp_status);
3936 }
3937
3938 void helper_fldcw(uint32_t val)
3939 {
3940 env->fpuc = val;
3941 update_fp_status();
3942 }
3943
3944 void helper_fclex(void)
3945 {
3946 env->fpus &= 0x7f00;
3947 }
3948
3949 void helper_fwait(void)
3950 {
3951 if (env->fpus & FPUS_SE)
3952 fpu_raise_exception();
3953 }
3954
3955 void helper_fninit(void)
3956 {
3957 env->fpus = 0;
3958 env->fpstt = 0;
3959 env->fpuc = 0x37f;
3960 env->fptags[0] = 1;
3961 env->fptags[1] = 1;
3962 env->fptags[2] = 1;
3963 env->fptags[3] = 1;
3964 env->fptags[4] = 1;
3965 env->fptags[5] = 1;
3966 env->fptags[6] = 1;
3967 env->fptags[7] = 1;
3968 }
3969
3970 /* BCD ops */
3971
3972 void helper_fbld_ST0(target_ulong ptr)
3973 {
3974 floatx80 tmp;
3975 uint64_t val;
3976 unsigned int v;
3977 int i;
3978
3979 val = 0;
3980 for(i = 8; i >= 0; i--) {
3981 v = ldub(ptr + i);
3982 val = (val * 100) + ((v >> 4) * 10) + (v & 0xf);
3983 }
3984 tmp = int64_to_floatx80(val, &env->fp_status);
3985 if (ldub(ptr + 9) & 0x80) {
3986 floatx80_chs(tmp);
3987 }
3988 fpush();
3989 ST0 = tmp;
3990 }
3991
3992 void helper_fbst_ST0(target_ulong ptr)
3993 {
3994 int v;
3995 target_ulong mem_ref, mem_end;
3996 int64_t val;
3997
3998 val = floatx80_to_int64(ST0, &env->fp_status);
3999 mem_ref = ptr;
4000 mem_end = mem_ref + 9;
4001 if (val < 0) {
4002 stb(mem_end, 0x80);
4003 val = -val;
4004 } else {
4005 stb(mem_end, 0x00);
4006 }
4007 while (mem_ref < mem_end) {
4008 if (val == 0)
4009 break;
4010 v = val % 100;
4011 val = val / 100;
4012 v = ((v / 10) << 4) | (v % 10);
4013 stb(mem_ref++, v);
4014 }
4015 while (mem_ref < mem_end) {
4016 stb(mem_ref++, 0);
4017 }
4018 }
4019
4020 void helper_f2xm1(void)
4021 {
4022 double val = floatx80_to_double(ST0);
4023 val = pow(2.0, val) - 1.0;
4024 ST0 = double_to_floatx80(val);
4025 }
4026
4027 void helper_fyl2x(void)
4028 {
4029 double fptemp = floatx80_to_double(ST0);
4030
4031 if (fptemp>0.0){
4032 fptemp = log(fptemp)/log(2.0); /* log2(ST) */
4033 fptemp *= floatx80_to_double(ST1);
4034 ST1 = double_to_floatx80(fptemp);
4035 fpop();
4036 } else {
4037 env->fpus &= (~0x4700);
4038 env->fpus |= 0x400;
4039 }
4040 }
4041
4042 void helper_fptan(void)
4043 {
4044 double fptemp = floatx80_to_double(ST0);
4045
4046 if((fptemp > MAXTAN)||(fptemp < -MAXTAN)) {
4047 env->fpus |= 0x400;
4048 } else {
4049 fptemp = tan(fptemp);
4050 ST0 = double_to_floatx80(fptemp);
4051 fpush();
4052 ST0 = floatx80_one;
4053 env->fpus &= (~0x400); /* C2 <-- 0 */
4054 /* the above code is for |arg| < 2**52 only */
4055 }
4056 }
4057
4058 void helper_fpatan(void)
4059 {
4060 double fptemp, fpsrcop;
4061
4062 fpsrcop = floatx80_to_double(ST1);
4063 fptemp = floatx80_to_double(ST0);
4064 ST1 = double_to_floatx80(atan2(fpsrcop, fptemp));
4065 fpop();
4066 }
4067
4068 void helper_fxtract(void)
4069 {
4070 CPU_LDoubleU temp;
4071
4072 temp.d = ST0;
4073
4074 if (floatx80_is_zero(ST0)) {
4075 /* Easy way to generate -inf and raising division by 0 exception */
4076 ST0 = floatx80_div(floatx80_chs(floatx80_one), floatx80_zero, &env->fp_status);
4077 fpush();
4078 ST0 = temp.d;
4079 } else {
4080 int expdif;
4081
4082 expdif = EXPD(temp) - EXPBIAS;
4083 /*DP exponent bias*/
4084 ST0 = int32_to_floatx80(expdif, &env->fp_status);
4085 fpush();
4086 BIASEXPONENT(temp);
4087 ST0 = temp.d;
4088 }
4089 }
4090
4091 void helper_fprem1(void)
4092 {
4093 double st0, st1, dblq, fpsrcop, fptemp;
4094 CPU_LDoubleU fpsrcop1, fptemp1;
4095 int expdif;
4096 signed long long int q;
4097
4098 st0 = floatx80_to_double(ST0);
4099 st1 = floatx80_to_double(ST1);
4100
4101 if (isinf(st0) || isnan(st0) || isnan(st1) || (st1 == 0.0)) {
4102 ST0 = double_to_floatx80(0.0 / 0.0); /* NaN */
4103 env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4104 return;
4105 }
4106
4107 fpsrcop = st0;
4108 fptemp = st1;
4109 fpsrcop1.d = ST0;
4110 fptemp1.d = ST1;
4111 expdif = EXPD(fpsrcop1) - EXPD(fptemp1);
4112
4113 if (expdif < 0) {
4114 /* optimisation? taken from the AMD docs */
4115 env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4116 /* ST0 is unchanged */
4117 return;
4118 }
4119
4120 if (expdif < 53) {
4121 dblq = fpsrcop / fptemp;
4122 /* round dblq towards nearest integer */
4123 dblq = rint(dblq);
4124 st0 = fpsrcop - fptemp * dblq;
4125
4126 /* convert dblq to q by truncating towards zero */
4127 if (dblq < 0.0)
4128 q = (signed long long int)(-dblq);
4129 else
4130 q = (signed long long int)dblq;
4131
4132 env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4133 /* (C0,C3,C1) <-- (q2,q1,q0) */
4134 env->fpus |= (q & 0x4) << (8 - 2); /* (C0) <-- q2 */
4135 env->fpus |= (q & 0x2) << (14 - 1); /* (C3) <-- q1 */
4136 env->fpus |= (q & 0x1) << (9 - 0); /* (C1) <-- q0 */
4137 } else {
4138 env->fpus |= 0x400; /* C2 <-- 1 */
4139 fptemp = pow(2.0, expdif - 50);
4140 fpsrcop = (st0 / st1) / fptemp;
4141 /* fpsrcop = integer obtained by chopping */
4142 fpsrcop = (fpsrcop < 0.0) ?
4143 -(floor(fabs(fpsrcop))) : floor(fpsrcop);
4144 st0 -= (st1 * fpsrcop * fptemp);
4145 }
4146 ST0 = double_to_floatx80(st0);
4147 }
4148
4149 void helper_fprem(void)
4150 {
4151 double st0, st1, dblq, fpsrcop, fptemp;
4152 CPU_LDoubleU fpsrcop1, fptemp1;
4153 int expdif;
4154 signed long long int q;
4155
4156 st0 = floatx80_to_double(ST0);
4157 st1 = floatx80_to_double(ST1);
4158
4159 if (isinf(st0) || isnan(st0) || isnan(st1) || (st1 == 0.0)) {
4160 ST0 = double_to_floatx80(0.0 / 0.0); /* NaN */
4161 env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4162 return;
4163 }
4164
4165 fpsrcop = st0;
4166 fptemp = st1;
4167 fpsrcop1.d = ST0;
4168 fptemp1.d = ST1;
4169 expdif = EXPD(fpsrcop1) - EXPD(fptemp1);
4170
4171 if (expdif < 0) {
4172 /* optimisation? taken from the AMD docs */
4173 env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4174 /* ST0 is unchanged */
4175 return;
4176 }
4177
4178 if ( expdif < 53 ) {
4179 dblq = fpsrcop/*ST0*/ / fptemp/*ST1*/;
4180 /* round dblq towards zero */
4181 dblq = (dblq < 0.0) ? ceil(dblq) : floor(dblq);
4182 st0 = fpsrcop/*ST0*/ - fptemp * dblq;
4183
4184 /* convert dblq to q by truncating towards zero */
4185 if (dblq < 0.0)
4186 q = (signed long long int)(-dblq);
4187 else
4188 q = (signed long long int)dblq;
4189
4190 env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4191 /* (C0,C3,C1) <-- (q2,q1,q0) */
4192 env->fpus |= (q & 0x4) << (8 - 2); /* (C0) <-- q2 */
4193 env->fpus |= (q & 0x2) << (14 - 1); /* (C3) <-- q1 */
4194 env->fpus |= (q & 0x1) << (9 - 0); /* (C1) <-- q0 */
4195 } else {
4196 int N = 32 + (expdif % 32); /* as per AMD docs */
4197 env->fpus |= 0x400; /* C2 <-- 1 */
4198 fptemp = pow(2.0, (double)(expdif - N));
4199 fpsrcop = (st0 / st1) / fptemp;
4200 /* fpsrcop = integer obtained by chopping */
4201 fpsrcop = (fpsrcop < 0.0) ?
4202 -(floor(fabs(fpsrcop))) : floor(fpsrcop);
4203 st0 -= (st1 * fpsrcop * fptemp);
4204 }
4205 ST0 = double_to_floatx80(st0);
4206 }
4207
4208 void helper_fyl2xp1(void)
4209 {
4210 double fptemp = floatx80_to_double(ST0);
4211
4212 if ((fptemp+1.0)>0.0) {
4213 fptemp = log(fptemp+1.0) / log(2.0); /* log2(ST+1.0) */
4214 fptemp *= floatx80_to_double(ST1);
4215 ST1 = double_to_floatx80(fptemp);
4216 fpop();
4217 } else {
4218 env->fpus &= (~0x4700);
4219 env->fpus |= 0x400;
4220 }
4221 }
4222
4223 void helper_fsqrt(void)
4224 {
4225 if (floatx80_is_neg(ST0)) {
4226 env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4227 env->fpus |= 0x400;
4228 }
4229 ST0 = floatx80_sqrt(ST0, &env->fp_status);
4230 }
4231
4232 void helper_fsincos(void)
4233 {
4234 double fptemp = floatx80_to_double(ST0);
4235
4236 if ((fptemp > MAXTAN)||(fptemp < -MAXTAN)) {
4237 env->fpus |= 0x400;
4238 } else {
4239 ST0 = double_to_floatx80(sin(fptemp));
4240 fpush();
4241 ST0 = double_to_floatx80(cos(fptemp));
4242 env->fpus &= (~0x400); /* C2 <-- 0 */
4243 /* the above code is for |arg| < 2**63 only */
4244 }
4245 }
4246
4247 void helper_frndint(void)
4248 {
4249 ST0 = floatx80_round_to_int(ST0, &env->fp_status);
4250 }
4251
4252 void helper_fscale(void)
4253 {
4254 if (floatx80_is_any_nan(ST1)) {
4255 ST0 = ST1;
4256 } else {
4257 int n = floatx80_to_int32_round_to_zero(ST1, &env->fp_status);
4258 ST0 = floatx80_scalbn(ST0, n, &env->fp_status);
4259 }
4260 }
4261
4262 void helper_fsin(void)
4263 {
4264 double fptemp = floatx80_to_double(ST0);
4265
4266 if ((fptemp > MAXTAN)||(fptemp < -MAXTAN)) {
4267 env->fpus |= 0x400;
4268 } else {
4269 ST0 = double_to_floatx80(sin(fptemp));
4270 env->fpus &= (~0x400); /* C2 <-- 0 */
4271 /* the above code is for |arg| < 2**53 only */
4272 }
4273 }
4274
4275 void helper_fcos(void)
4276 {
4277 double fptemp = floatx80_to_double(ST0);
4278
4279 if((fptemp > MAXTAN)||(fptemp < -MAXTAN)) {
4280 env->fpus |= 0x400;
4281 } else {
4282 ST0 = double_to_floatx80(cos(fptemp));
4283 env->fpus &= (~0x400); /* C2 <-- 0 */
4284 /* the above code is for |arg5 < 2**63 only */
4285 }
4286 }
4287
4288 void helper_fxam_ST0(void)
4289 {
4290 CPU_LDoubleU temp;
4291 int expdif;
4292
4293 temp.d = ST0;
4294
4295 env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4296 if (SIGND(temp))
4297 env->fpus |= 0x200; /* C1 <-- 1 */
4298
4299 /* XXX: test fptags too */
4300 expdif = EXPD(temp);
4301 if (expdif == MAXEXPD) {
4302 if (MANTD(temp) == 0x8000000000000000ULL)
4303 env->fpus |= 0x500 /*Infinity*/;
4304 else
4305 env->fpus |= 0x100 /*NaN*/;
4306 } else if (expdif == 0) {
4307 if (MANTD(temp) == 0)
4308 env->fpus |= 0x4000 /*Zero*/;
4309 else
4310 env->fpus |= 0x4400 /*Denormal*/;
4311 } else {
4312 env->fpus |= 0x400;
4313 }
4314 }
4315
4316 void helper_fstenv(target_ulong ptr, int data32)
4317 {
4318 int fpus, fptag, exp, i;
4319 uint64_t mant;
4320 CPU_LDoubleU tmp;
4321
4322 fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
4323 fptag = 0;
4324 for (i=7; i>=0; i--) {
4325 fptag <<= 2;
4326 if (env->fptags[i]) {
4327 fptag |= 3;
4328 } else {
4329 tmp.d = env->fpregs[i].d;
4330 exp = EXPD(tmp);
4331 mant = MANTD(tmp);
4332 if (exp == 0 && mant == 0) {
4333 /* zero */
4334 fptag |= 1;
4335 } else if (exp == 0 || exp == MAXEXPD
4336 || (mant & (1LL << 63)) == 0
4337 ) {
4338 /* NaNs, infinity, denormal */
4339 fptag |= 2;
4340 }
4341 }
4342 }
4343 if (data32) {
4344 /* 32 bit */
4345 stl(ptr, env->fpuc);
4346 stl(ptr + 4, fpus);
4347 stl(ptr + 8, fptag);
4348 stl(ptr + 12, 0); /* fpip */
4349 stl(ptr + 16, 0); /* fpcs */
4350 stl(ptr + 20, 0); /* fpoo */
4351 stl(ptr + 24, 0); /* fpos */
4352 } else {
4353 /* 16 bit */
4354 stw(ptr, env->fpuc);
4355 stw(ptr + 2, fpus);
4356 stw(ptr + 4, fptag);
4357 stw(ptr + 6, 0);
4358 stw(ptr + 8, 0);
4359 stw(ptr + 10, 0);
4360 stw(ptr + 12, 0);
4361 }
4362 }
4363
4364 void helper_fldenv(target_ulong ptr, int data32)
4365 {
4366 int i, fpus, fptag;
4367
4368 if (data32) {
4369 env->fpuc = lduw(ptr);
4370 fpus = lduw(ptr + 4);
4371 fptag = lduw(ptr + 8);
4372 }
4373 else {
4374 env->fpuc = lduw(ptr);
4375 fpus = lduw(ptr + 2);
4376 fptag = lduw(ptr + 4);
4377 }
4378 env->fpstt = (fpus >> 11) & 7;
4379 env->fpus = fpus & ~0x3800;
4380 for(i = 0;i < 8; i++) {
4381 env->fptags[i] = ((fptag & 3) == 3);
4382 fptag >>= 2;
4383 }
4384 }
4385
4386 void helper_fsave(target_ulong ptr, int data32)
4387 {
4388 floatx80 tmp;
4389 int i;
4390
4391 helper_fstenv(ptr, data32);
4392
4393 ptr += (14 << data32);
4394 for(i = 0;i < 8; i++) {
4395 tmp = ST(i);
4396 helper_fstt(tmp, ptr);
4397 ptr += 10;
4398 }
4399
4400 /* fninit */
4401 env->fpus = 0;
4402 env->fpstt = 0;
4403 env->fpuc = 0x37f;
4404 env->fptags[0] = 1;
4405 env->fptags[1] = 1;
4406 env->fptags[2] = 1;
4407 env->fptags[3] = 1;
4408 env->fptags[4] = 1;
4409 env->fptags[5] = 1;
4410 env->fptags[6] = 1;
4411 env->fptags[7] = 1;
4412 }
4413
4414 void helper_frstor(target_ulong ptr, int data32)
4415 {
4416 floatx80 tmp;
4417 int i;
4418
4419 helper_fldenv(ptr, data32);
4420 ptr += (14 << data32);
4421
4422 for(i = 0;i < 8; i++) {
4423 tmp = helper_fldt(ptr);
4424 ST(i) = tmp;
4425 ptr += 10;
4426 }
4427 }
4428
4429 void helper_fxsave(target_ulong ptr, int data64)
4430 {
4431 int fpus, fptag, i, nb_xmm_regs;
4432 floatx80 tmp;
4433 target_ulong addr;
4434
4435 /* The operand must be 16 byte aligned */
4436 if (ptr & 0xf) {
4437 raise_exception(EXCP0D_GPF);
4438 }
4439
4440 fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
4441 fptag = 0;
4442 for(i = 0; i < 8; i++) {
4443 fptag |= (env->fptags[i] << i);
4444 }
4445 stw(ptr, env->fpuc);
4446 stw(ptr + 2, fpus);
4447 stw(ptr + 4, fptag ^ 0xff);
4448 #ifdef TARGET_X86_64
4449 if (data64) {
4450 stq(ptr + 0x08, 0); /* rip */
4451 stq(ptr + 0x10, 0); /* rdp */
4452 } else
4453 #endif
4454 {
4455 stl(ptr + 0x08, 0); /* eip */
4456 stl(ptr + 0x0c, 0); /* sel */
4457 stl(ptr + 0x10, 0); /* dp */
4458 stl(ptr + 0x14, 0); /* sel */
4459 }
4460
4461 addr = ptr + 0x20;
4462 for(i = 0;i < 8; i++) {
4463 tmp = ST(i);
4464 helper_fstt(tmp, addr);
4465 addr += 16;
4466 }
4467
4468 if (env->cr[4] & CR4_OSFXSR_MASK) {
4469 /* XXX: finish it */
4470 stl(ptr + 0x18, env->mxcsr); /* mxcsr */
4471 stl(ptr + 0x1c, 0x0000ffff); /* mxcsr_mask */
4472 if (env->hflags & HF_CS64_MASK)
4473 nb_xmm_regs = 16;
4474 else
4475 nb_xmm_regs = 8;
4476 addr = ptr + 0xa0;
4477 /* Fast FXSAVE leaves out the XMM registers */
4478 if (!(env->efer & MSR_EFER_FFXSR)
4479 || (env->hflags & HF_CPL_MASK)
4480 || !(env->hflags & HF_LMA_MASK)) {
4481 for(i = 0; i < nb_xmm_regs; i++) {
4482 stq(addr, env->xmm_regs[i].XMM_Q(0));
4483 stq(addr + 8, env->xmm_regs[i].XMM_Q(1));
4484 addr += 16;
4485 }
4486 }
4487 }
4488 }
4489
4490 void helper_fxrstor(target_ulong ptr, int data64)
4491 {
4492 int i, fpus, fptag, nb_xmm_regs;
4493 floatx80 tmp;
4494 target_ulong addr;
4495
4496 /* The operand must be 16 byte aligned */
4497 if (ptr & 0xf) {
4498 raise_exception(EXCP0D_GPF);
4499 }
4500
4501 env->fpuc = lduw(ptr);
4502 fpus = lduw(ptr + 2);
4503 fptag = lduw(ptr + 4);
4504 env->fpstt = (fpus >> 11) & 7;
4505 env->fpus = fpus & ~0x3800;
4506 fptag ^= 0xff;
4507 for(i = 0;i < 8; i++) {
4508 env->fptags[i] = ((fptag >> i) & 1);
4509 }
4510
4511 addr = ptr + 0x20;
4512 for(i = 0;i < 8; i++) {
4513 tmp = helper_fldt(addr);
4514 ST(i) = tmp;
4515 addr += 16;
4516 }
4517
4518 if (env->cr[4] & CR4_OSFXSR_MASK) {
4519 /* XXX: finish it */
4520 env->mxcsr = ldl(ptr + 0x18);
4521 //ldl(ptr + 0x1c);
4522 if (env->hflags & HF_CS64_MASK)
4523 nb_xmm_regs = 16;
4524 else
4525 nb_xmm_regs = 8;
4526 addr = ptr + 0xa0;
4527 /* Fast FXRESTORE leaves out the XMM registers */
4528 if (!(env->efer & MSR_EFER_FFXSR)
4529 || (env->hflags & HF_CPL_MASK)
4530 || !(env->hflags & HF_LMA_MASK)) {
4531 for(i = 0; i < nb_xmm_regs; i++) {
4532 env->xmm_regs[i].XMM_Q(0) = ldq(addr);
4533 env->xmm_regs[i].XMM_Q(1) = ldq(addr + 8);
4534 addr += 16;
4535 }
4536 }
4537 }
4538 }
4539
4540 void cpu_get_fp80(uint64_t *pmant, uint16_t *pexp, floatx80 f)
4541 {
4542 CPU_LDoubleU temp;
4543
4544 temp.d = f;
4545 *pmant = temp.l.lower;
4546 *pexp = temp.l.upper;
4547 }
4548
4549 floatx80 cpu_set_fp80(uint64_t mant, uint16_t upper)
4550 {
4551 CPU_LDoubleU temp;
4552
4553 temp.l.upper = upper;
4554 temp.l.lower = mant;
4555 return temp.d;
4556 }
4557
4558 #ifdef TARGET_X86_64
4559
4560 //#define DEBUG_MULDIV
4561
4562 static void add128(uint64_t *plow, uint64_t *phigh, uint64_t a, uint64_t b)
4563 {
4564 *plow += a;
4565 /* carry test */
4566 if (*plow < a)
4567 (*phigh)++;
4568 *phigh += b;
4569 }
4570
4571 static void neg128(uint64_t *plow, uint64_t *phigh)
4572 {
4573 *plow = ~ *plow;
4574 *phigh = ~ *phigh;
4575 add128(plow, phigh, 1, 0);
4576 }
4577
4578 /* return TRUE if overflow */
4579 static int div64(uint64_t *plow, uint64_t *phigh, uint64_t b)
4580 {
4581 uint64_t q, r, a1, a0;
4582 int i, qb, ab;
4583
4584 a0 = *plow;
4585 a1 = *phigh;
4586 if (a1 == 0) {
4587 q = a0 / b;
4588 r = a0 % b;
4589 *plow = q;
4590 *phigh = r;
4591 } else {
4592 if (a1 >= b)
4593 return 1;
4594 /* XXX: use a better algorithm */
4595 for(i = 0; i < 64; i++) {
4596 ab = a1 >> 63;
4597 a1 = (a1 << 1) | (a0 >> 63);
4598 if (ab || a1 >= b) {
4599 a1 -= b;
4600 qb = 1;
4601 } else {
4602 qb = 0;
4603 }
4604 a0 = (a0 << 1) | qb;
4605 }
4606 #if defined(DEBUG_MULDIV)
4607 printf("div: 0x%016" PRIx64 "%016" PRIx64 " / 0x%016" PRIx64 ": q=0x%016" PRIx64 " r=0x%016" PRIx64 "\n",
4608 *phigh, *plow, b, a0, a1);
4609 #endif
4610 *plow = a0;
4611 *phigh = a1;
4612 }
4613 return 0;
4614 }
4615
4616 /* return TRUE if overflow */
4617 static int idiv64(uint64_t *plow, uint64_t *phigh, int64_t b)
4618 {
4619 int sa, sb;
4620 sa = ((int64_t)*phigh < 0);
4621 if (sa)
4622 neg128(plow, phigh);
4623 sb = (b < 0);
4624 if (sb)
4625 b = -b;
4626 if (div64(plow, phigh, b) != 0)
4627 return 1;
4628 if (sa ^ sb) {
4629 if (*plow > (1ULL << 63))
4630 return 1;
4631 *plow = - *plow;
4632 } else {
4633 if (*plow >= (1ULL << 63))
4634 return 1;
4635 }
4636 if (sa)
4637 *phigh = - *phigh;
4638 return 0;
4639 }
4640
4641 void helper_mulq_EAX_T0(target_ulong t0)
4642 {
4643 uint64_t r0, r1;
4644
4645 mulu64(&r0, &r1, EAX, t0);
4646 EAX = r0;
4647 EDX = r1;
4648 CC_DST = r0;
4649 CC_SRC = r1;
4650 }
4651
4652 void helper_imulq_EAX_T0(target_ulong t0)
4653 {
4654 uint64_t r0, r1;
4655
4656 muls64(&r0, &r1, EAX, t0);
4657 EAX = r0;
4658 EDX = r1;
4659 CC_DST = r0;
4660 CC_SRC = ((int64_t)r1 != ((int64_t)r0 >> 63));
4661 }
4662
4663 target_ulong helper_imulq_T0_T1(target_ulong t0, target_ulong t1)
4664 {
4665 uint64_t r0, r1;
4666
4667 muls64(&r0, &r1, t0, t1);
4668 CC_DST = r0;
4669 CC_SRC = ((int64_t)r1 != ((int64_t)r0 >> 63));
4670 return r0;
4671 }
4672
4673 void helper_divq_EAX(target_ulong t0)
4674 {
4675 uint64_t r0, r1;
4676 if (t0 == 0) {
4677 raise_exception(EXCP00_DIVZ);
4678 }
4679 r0 = EAX;
4680 r1 = EDX;
4681 if (div64(&r0, &r1, t0))
4682 raise_exception(EXCP00_DIVZ);
4683 EAX = r0;
4684 EDX = r1;
4685 }
4686
4687 void helper_idivq_EAX(target_ulong t0)
4688 {
4689 uint64_t r0, r1;
4690 if (t0 == 0) {
4691 raise_exception(EXCP00_DIVZ);
4692 }
4693 r0 = EAX;
4694 r1 = EDX;
4695 if (idiv64(&r0, &r1, t0))
4696 raise_exception(EXCP00_DIVZ);
4697 EAX = r0;
4698 EDX = r1;
4699 }
4700 #endif
4701
4702 static void do_hlt(void)
4703 {
4704 env->hflags &= ~HF_INHIBIT_IRQ_MASK; /* needed if sti is just before */
4705 env->halted = 1;
4706 env->exception_index = EXCP_HLT;
4707 cpu_loop_exit(env);
4708 }
4709
4710 void helper_hlt(int next_eip_addend)
4711 {
4712 helper_svm_check_intercept_param(SVM_EXIT_HLT, 0);
4713 EIP += next_eip_addend;
4714
4715 do_hlt();
4716 }
4717
4718 void helper_monitor(target_ulong ptr)
4719 {
4720 if ((uint32_t)ECX != 0)
4721 raise_exception(EXCP0D_GPF);
4722 /* XXX: store address ? */
4723 helper_svm_check_intercept_param(SVM_EXIT_MONITOR, 0);
4724 }
4725
4726 void helper_mwait(int next_eip_addend)
4727 {
4728 if ((uint32_t)ECX != 0)
4729 raise_exception(EXCP0D_GPF);
4730 helper_svm_check_intercept_param(SVM_EXIT_MWAIT, 0);
4731 EIP += next_eip_addend;
4732
4733 /* XXX: not complete but not completely erroneous */
4734 if (env->cpu_index != 0 || env->next_cpu != NULL) {
4735 /* more than one CPU: do not sleep because another CPU may
4736 wake this one */
4737 } else {
4738 do_hlt();
4739 }
4740 }
4741
4742 void helper_debug(void)
4743 {
4744 env->exception_index = EXCP_DEBUG;
4745 cpu_loop_exit(env);
4746 }
4747
4748 void helper_reset_rf(void)
4749 {
4750 env->eflags &= ~RF_MASK;
4751 }
4752
4753 void helper_raise_interrupt(int intno, int next_eip_addend)
4754 {
4755 raise_interrupt(intno, 1, 0, next_eip_addend);
4756 }
4757
4758 void helper_raise_exception(int exception_index)
4759 {
4760 raise_exception(exception_index);
4761 }
4762
4763 void helper_cli(void)
4764 {
4765 env->eflags &= ~IF_MASK;
4766 }
4767
4768 void helper_sti(void)
4769 {
4770 env->eflags |= IF_MASK;
4771 }
4772
4773 #if 0
4774 /* vm86plus instructions */
4775 void helper_cli_vm(void)
4776 {
4777 env->eflags &= ~VIF_MASK;
4778 }
4779
4780 void helper_sti_vm(void)
4781 {
4782 env->eflags |= VIF_MASK;
4783 if (env->eflags & VIP_MASK) {
4784 raise_exception(EXCP0D_GPF);
4785 }
4786 }
4787 #endif
4788
4789 void helper_set_inhibit_irq(void)
4790 {
4791 env->hflags |= HF_INHIBIT_IRQ_MASK;
4792 }
4793
4794 void helper_reset_inhibit_irq(void)
4795 {
4796 env->hflags &= ~HF_INHIBIT_IRQ_MASK;
4797 }
4798
4799 void helper_boundw(target_ulong a0, int v)
4800 {
4801 int low, high;
4802 low = ldsw(a0);
4803 high = ldsw(a0 + 2);
4804 v = (int16_t)v;
4805 if (v < low || v > high) {
4806 raise_exception(EXCP05_BOUND);
4807 }
4808 }
4809
4810 void helper_boundl(target_ulong a0, int v)
4811 {
4812 int low, high;
4813 low = ldl(a0);
4814 high = ldl(a0 + 4);
4815 if (v < low || v > high) {
4816 raise_exception(EXCP05_BOUND);
4817 }
4818 }
4819
4820 #if !defined(CONFIG_USER_ONLY)
4821
4822 #define MMUSUFFIX _mmu
4823
4824 #define SHIFT 0
4825 #include "softmmu_template.h"
4826
4827 #define SHIFT 1
4828 #include "softmmu_template.h"
4829
4830 #define SHIFT 2
4831 #include "softmmu_template.h"
4832
4833 #define SHIFT 3
4834 #include "softmmu_template.h"
4835
4836 #endif
4837
4838 #if !defined(CONFIG_USER_ONLY)
4839 /* try to fill the TLB and return an exception if error. If retaddr is
4840 NULL, it means that the function was called in C code (i.e. not
4841 from generated code or from helper.c) */
4842 /* XXX: fix it to restore all registers */
4843 void tlb_fill(target_ulong addr, int is_write, int mmu_idx, void *retaddr)
4844 {
4845 TranslationBlock *tb;
4846 int ret;
4847 unsigned long pc;
4848 CPUX86State *saved_env;
4849
4850 /* XXX: hack to restore env in all cases, even if not called from
4851 generated code */
4852 saved_env = env;
4853 env = cpu_single_env;
4854
4855 ret = cpu_x86_handle_mmu_fault(env, addr, is_write, mmu_idx, 1);
4856 if (ret) {
4857 if (retaddr) {
4858 /* now we have a real cpu fault */
4859 pc = (unsigned long)retaddr;
4860 tb = tb_find_pc(pc);
4861 if (tb) {
4862 /* the PC is inside the translated code. It means that we have
4863 a virtual CPU fault */
4864 cpu_restore_state(tb, env, pc);
4865 }
4866 }
4867 raise_exception_err(env->exception_index, env->error_code);
4868 }
4869 env = saved_env;
4870 }
4871 #endif
4872
4873 /* Secure Virtual Machine helpers */
4874
4875 #if defined(CONFIG_USER_ONLY)
4876
4877 void helper_vmrun(int aflag, int next_eip_addend)
4878 {
4879 }
4880 void helper_vmmcall(void)
4881 {
4882 }
4883 void helper_vmload(int aflag)
4884 {
4885 }
4886 void helper_vmsave(int aflag)
4887 {
4888 }
4889 void helper_stgi(void)
4890 {
4891 }
4892 void helper_clgi(void)
4893 {
4894 }
4895 void helper_skinit(void)
4896 {
4897 }
4898 void helper_invlpga(int aflag)
4899 {
4900 }
4901 void helper_vmexit(uint32_t exit_code, uint64_t exit_info_1)
4902 {
4903 }
4904 void helper_svm_check_intercept_param(uint32_t type, uint64_t param)
4905 {
4906 }
4907
4908 void svm_check_intercept(CPUState *env1, uint32_t type)
4909 {
4910 }
4911
4912 void helper_svm_check_io(uint32_t port, uint32_t param,
4913 uint32_t next_eip_addend)
4914 {
4915 }
4916 #else
4917
4918 static inline void svm_save_seg(target_phys_addr_t addr,
4919 const SegmentCache *sc)
4920 {
4921 stw_phys(addr + offsetof(struct vmcb_seg, selector),
4922 sc->selector);
4923 stq_phys(addr + offsetof(struct vmcb_seg, base),
4924 sc->base);
4925 stl_phys(addr + offsetof(struct vmcb_seg, limit),
4926 sc->limit);
4927 stw_phys(addr + offsetof(struct vmcb_seg, attrib),
4928 ((sc->flags >> 8) & 0xff) | ((sc->flags >> 12) & 0x0f00));
4929 }
4930
4931 static inline void svm_load_seg(target_phys_addr_t addr, SegmentCache *sc)
4932 {
4933 unsigned int flags;
4934
4935 sc->selector = lduw_phys(addr + offsetof(struct vmcb_seg, selector));
4936 sc->base = ldq_phys(addr + offsetof(struct vmcb_seg, base));
4937 sc->limit = ldl_phys(addr + offsetof(struct vmcb_seg, limit));
4938 flags = lduw_phys(addr + offsetof(struct vmcb_seg, attrib));
4939 sc->flags = ((flags & 0xff) << 8) | ((flags & 0x0f00) << 12);
4940 }
4941
4942 static inline void svm_load_seg_cache(target_phys_addr_t addr,
4943 CPUState *env, int seg_reg)
4944 {
4945 SegmentCache sc1, *sc = &sc1;
4946 svm_load_seg(addr, sc);
4947 cpu_x86_load_seg_cache(env, seg_reg, sc->selector,
4948 sc->base, sc->limit, sc->flags);
4949 }
4950
4951 void helper_vmrun(int aflag, int next_eip_addend)
4952 {
4953 target_ulong addr;
4954 uint32_t event_inj;
4955 uint32_t int_ctl;
4956
4957 helper_svm_check_intercept_param(SVM_EXIT_VMRUN, 0);
4958
4959 if (aflag == 2)
4960 addr = EAX;
4961 else
4962 addr = (uint32_t)EAX;
4963
4964 qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmrun! " TARGET_FMT_lx "\n", addr);
4965
4966 env->vm_vmcb = addr;
4967
4968 /* save the current CPU state in the hsave page */
4969 stq_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.base), env->gdt.base);
4970 stl_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.limit), env->gdt.limit);
4971
4972 stq_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.base), env->idt.base);
4973 stl_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.limit), env->idt.limit);
4974
4975 stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr0), env->cr[0]);
4976 stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr2), env->cr[2]);
4977 stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr3), env->cr[3]);
4978 stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr4), env->cr[4]);
4979 stq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr6), env->dr[6]);
4980 stq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr7), env->dr[7]);
4981
4982 stq_phys(env->vm_hsave + offsetof(struct vmcb, save.efer), env->efer);
4983 stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rflags), compute_eflags());
4984
4985 svm_save_seg(env->vm_hsave + offsetof(struct vmcb, save.es),
4986 &env->segs[R_ES]);
4987 svm_save_seg(env->vm_hsave + offsetof(struct vmcb, save.cs),
4988 &env->segs[R_CS]);
4989 svm_save_seg(env->vm_hsave + offsetof(struct vmcb, save.ss),
4990 &env->segs[R_SS]);
4991 svm_save_seg(env->vm_hsave + offsetof(struct vmcb, save.ds),
4992 &env->segs[R_DS]);
4993
4994 stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rip),
4995 EIP + next_eip_addend);
4996 stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rsp), ESP);
4997 stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rax), EAX);
4998
4999 /* load the interception bitmaps so we do not need to access the
5000 vmcb in svm mode */
5001 env->intercept = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept));
5002 env->intercept_cr_read = lduw_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_cr_read));
5003 env->intercept_cr_write = lduw_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_cr_write));
5004 env->intercept_dr_read = lduw_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_dr_read));
5005 env->intercept_dr_write = lduw_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_dr_write));
5006 env->intercept_exceptions = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_exceptions));
5007
5008 /* enable intercepts */
5009 env->hflags |= HF_SVMI_MASK;
5010
5011 env->tsc_offset = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.tsc_offset));
5012
5013 env->gdt.base = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.base));
5014 env->gdt.limit = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.limit));
5015
5016 env->idt.base = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.base));
5017 env->idt.limit = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.limit));
5018
5019 /* clear exit_info_2 so we behave like the real hardware */
5020 stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), 0);
5021
5022 cpu_x86_update_cr0(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr0)));
5023 cpu_x86_update_cr4(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr4)));
5024 cpu_x86_update_cr3(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr3)));
5025 env->cr[2] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr2));
5026 int_ctl = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl));
5027 env->hflags2 &= ~(HF2_HIF_MASK | HF2_VINTR_MASK);
5028 if (int_ctl & V_INTR_MASKING_MASK) {
5029 env->v_tpr = int_ctl & V_TPR_MASK;
5030 env->hflags2 |= HF2_VINTR_MASK;
5031 if (env->eflags & IF_MASK)
5032 env->hflags2 |= HF2_HIF_MASK;
5033 }
5034
5035 cpu_load_efer(env,
5036 ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.efer)));
5037 env->eflags = 0;
5038 load_eflags(ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rflags)),
5039 ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
5040 CC_OP = CC_OP_EFLAGS;
5041
5042 svm_load_seg_cache(env->vm_vmcb + offsetof(struct vmcb, save.es),
5043 env, R_ES);
5044 svm_load_seg_cache(env->vm_vmcb + offsetof(struct vmcb, save.cs),
5045 env, R_CS);
5046 svm_load_seg_cache(env->vm_vmcb + offsetof(struct vmcb, save.ss),
5047 env, R_SS);
5048 svm_load_seg_cache(env->vm_vmcb + offsetof(struct vmcb, save.ds),
5049 env, R_DS);
5050
5051 EIP = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rip));
5052 env->eip = EIP;
5053 ESP = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rsp));
5054 EAX = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rax));
5055 env->dr[7] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr7));
5056 env->dr[6] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr6));
5057 cpu_x86_set_cpl(env, ldub_phys(env->vm_vmcb + offsetof(struct vmcb, save.cpl)));
5058
5059 /* FIXME: guest state consistency checks */
5060
5061 switch(ldub_phys(env->vm_vmcb + offsetof(struct vmcb, control.tlb_ctl))) {
5062 case TLB_CONTROL_DO_NOTHING:
5063 break;
5064 case TLB_CONTROL_FLUSH_ALL_ASID:
5065 /* FIXME: this is not 100% correct but should work for now */
5066 tlb_flush(env, 1);
5067 break;
5068 }
5069
5070 env->hflags2 |= HF2_GIF_MASK;
5071
5072 if (int_ctl & V_IRQ_MASK) {
5073 env->interrupt_request |= CPU_INTERRUPT_VIRQ;
5074 }
5075
5076 /* maybe we need to inject an event */
5077 event_inj = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj));
5078 if (event_inj & SVM_EVTINJ_VALID) {
5079 uint8_t vector = event_inj & SVM_EVTINJ_VEC_MASK;
5080 uint16_t valid_err = event_inj & SVM_EVTINJ_VALID_ERR;
5081 uint32_t event_inj_err = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj_err));
5082
5083 qemu_log_mask(CPU_LOG_TB_IN_ASM, "Injecting(%#hx): ", valid_err);
5084 /* FIXME: need to implement valid_err */
5085 switch (event_inj & SVM_EVTINJ_TYPE_MASK) {
5086 case SVM_EVTINJ_TYPE_INTR:
5087 env->exception_index = vector;
5088 env->error_code = event_inj_err;
5089 env->exception_is_int = 0;
5090 env->exception_next_eip = -1;
5091 qemu_log_mask(CPU_LOG_TB_IN_ASM, "INTR");
5092 /* XXX: is it always correct ? */
5093 do_interrupt_all(vector, 0, 0, 0, 1);
5094 break;
5095 case SVM_EVTINJ_TYPE_NMI:
5096 env->exception_index = EXCP02_NMI;
5097 env->error_code = event_inj_err;
5098 env->exception_is_int = 0;
5099 env->exception_next_eip = EIP;
5100 qemu_log_mask(CPU_LOG_TB_IN_ASM, "NMI");
5101 cpu_loop_exit(env);
5102 break;
5103 case SVM_EVTINJ_TYPE_EXEPT:
5104 env->exception_index = vector;
5105 env->error_code = event_inj_err;
5106 env->exception_is_int = 0;
5107 env->exception_next_eip = -1;
5108 qemu_log_mask(CPU_LOG_TB_IN_ASM, "EXEPT");
5109 cpu_loop_exit(env);
5110 break;
5111 case SVM_EVTINJ_TYPE_SOFT:
5112 env->exception_index = vector;
5113 env->error_code = event_inj_err;
5114 env->exception_is_int = 1;
5115 env->exception_next_eip = EIP;
5116 qemu_log_mask(CPU_LOG_TB_IN_ASM, "SOFT");
5117 cpu_loop_exit(env);
5118 break;
5119 }
5120 qemu_log_mask(CPU_LOG_TB_IN_ASM, " %#x %#x\n", env->exception_index, env->error_code);
5121 }
5122 }
5123
5124 void helper_vmmcall(void)
5125 {
5126 helper_svm_check_intercept_param(SVM_EXIT_VMMCALL, 0);
5127 raise_exception(EXCP06_ILLOP);
5128 }
5129
5130 void helper_vmload(int aflag)
5131 {
5132 target_ulong addr;
5133 helper_svm_check_intercept_param(SVM_EXIT_VMLOAD, 0);
5134
5135 if (aflag == 2)
5136 addr = EAX;
5137 else
5138 addr = (uint32_t)EAX;
5139
5140 qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmload! " TARGET_FMT_lx "\nFS: %016" PRIx64 " | " TARGET_FMT_lx "\n",
5141 addr, ldq_phys(addr + offsetof(struct vmcb, save.fs.base)),
5142 env->segs[R_FS].base);
5143
5144 svm_load_seg_cache(addr + offsetof(struct vmcb, save.fs),
5145 env, R_FS);
5146 svm_load_seg_cache(addr + offsetof(struct vmcb, save.gs),
5147 env, R_GS);
5148 svm_load_seg(addr + offsetof(struct vmcb, save.tr),
5149 &env->tr);
5150 svm_load_seg(addr + offsetof(struct vmcb, save.ldtr),
5151 &env->ldt);
5152
5153 #ifdef TARGET_X86_64
5154 env->kernelgsbase = ldq_phys(addr + offsetof(struct vmcb, save.kernel_gs_base));
5155 env->lstar = ldq_phys(addr + offsetof(struct vmcb, save.lstar));
5156 env->cstar = ldq_phys(addr + offsetof(struct vmcb, save.cstar));
5157 env->fmask = ldq_phys(addr + offsetof(struct vmcb, save.sfmask));
5158 #endif
5159 env->star = ldq_phys(addr + offsetof(struct vmcb, save.star));
5160 env->sysenter_cs = ldq_phys(addr + offsetof(struct vmcb, save.sysenter_cs));
5161 env->sysenter_esp = ldq_phys(addr + offsetof(struct vmcb, save.sysenter_esp));
5162 env->sysenter_eip = ldq_phys(addr + offsetof(struct vmcb, save.sysenter_eip));
5163 }
5164
5165 void helper_vmsave(int aflag)
5166 {
5167 target_ulong addr;
5168 helper_svm_check_intercept_param(SVM_EXIT_VMSAVE, 0);
5169
5170 if (aflag == 2)
5171 addr = EAX;
5172 else
5173 addr = (uint32_t)EAX;
5174
5175 qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmsave! " TARGET_FMT_lx "\nFS: %016" PRIx64 " | " TARGET_FMT_lx "\n",
5176 addr, ldq_phys(addr + offsetof(struct vmcb, save.fs.base)),
5177 env->segs[R_FS].base);
5178
5179 svm_save_seg(addr + offsetof(struct vmcb, save.fs),
5180 &env->segs[R_FS]);
5181 svm_save_seg(addr + offsetof(struct vmcb, save.gs),
5182 &env->segs[R_GS]);
5183 svm_save_seg(addr + offsetof(struct vmcb, save.tr),
5184 &env->tr);
5185 svm_save_seg(addr + offsetof(struct vmcb, save.ldtr),
5186 &env->ldt);
5187
5188 #ifdef TARGET_X86_64
5189 stq_phys(addr + offsetof(struct vmcb, save.kernel_gs_base), env->kernelgsbase);
5190 stq_phys(addr + offsetof(struct vmcb, save.lstar), env->lstar);
5191 stq_phys(addr + offsetof(struct vmcb, save.cstar), env->cstar);
5192 stq_phys(addr + offsetof(struct vmcb, save.sfmask), env->fmask);
5193 #endif
5194 stq_phys(addr + offsetof(struct vmcb, save.star), env->star);
5195 stq_phys(addr + offsetof(struct vmcb, save.sysenter_cs), env->sysenter_cs);
5196 stq_phys(addr + offsetof(struct vmcb, save.sysenter_esp), env->sysenter_esp);
5197 stq_phys(addr + offsetof(struct vmcb, save.sysenter_eip), env->sysenter_eip);
5198 }
5199
5200 void helper_stgi(void)
5201 {
5202 helper_svm_check_intercept_param(SVM_EXIT_STGI, 0);
5203 env->hflags2 |= HF2_GIF_MASK;
5204 }
5205
5206 void helper_clgi(void)
5207 {
5208 helper_svm_check_intercept_param(SVM_EXIT_CLGI, 0);
5209 env->hflags2 &= ~HF2_GIF_MASK;
5210 }
5211
5212 void helper_skinit(void)
5213 {
5214 helper_svm_check_intercept_param(SVM_EXIT_SKINIT, 0);
5215 /* XXX: not implemented */
5216 raise_exception(EXCP06_ILLOP);
5217 }
5218
5219 void helper_invlpga(int aflag)
5220 {
5221 target_ulong addr;
5222 helper_svm_check_intercept_param(SVM_EXIT_INVLPGA, 0);
5223
5224 if (aflag == 2)
5225 addr = EAX;
5226 else
5227 addr = (uint32_t)EAX;
5228
5229 /* XXX: could use the ASID to see if it is needed to do the
5230 flush */
5231 tlb_flush_page(env, addr);
5232 }
5233
5234 void helper_svm_check_intercept_param(uint32_t type, uint64_t param)
5235 {
5236 if (likely(!(env->hflags & HF_SVMI_MASK)))
5237 return;
5238 switch(type) {
5239 case SVM_EXIT_READ_CR0 ... SVM_EXIT_READ_CR0 + 8:
5240 if (env->intercept_cr_read & (1 << (type - SVM_EXIT_READ_CR0))) {
5241 helper_vmexit(type, param);
5242 }
5243 break;
5244 case SVM_EXIT_WRITE_CR0 ... SVM_EXIT_WRITE_CR0 + 8:
5245 if (env->intercept_cr_write & (1 << (type - SVM_EXIT_WRITE_CR0))) {
5246 helper_vmexit(type, param);
5247 }
5248 break;
5249 case SVM_EXIT_READ_DR0 ... SVM_EXIT_READ_DR0 + 7:
5250 if (env->intercept_dr_read & (1 << (type - SVM_EXIT_READ_DR0))) {
5251 helper_vmexit(type, param);
5252 }
5253 break;
5254 case SVM_EXIT_WRITE_DR0 ... SVM_EXIT_WRITE_DR0 + 7:
5255 if (env->intercept_dr_write & (1 << (type - SVM_EXIT_WRITE_DR0))) {
5256 helper_vmexit(type, param);
5257 }
5258 break;
5259 case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 31:
5260 if (env->intercept_exceptions & (1 << (type - SVM_EXIT_EXCP_BASE))) {
5261 helper_vmexit(type, param);
5262 }
5263 break;
5264 case SVM_EXIT_MSR:
5265 if (env->intercept & (1ULL << (SVM_EXIT_MSR - SVM_EXIT_INTR))) {
5266 /* FIXME: this should be read in at vmrun (faster this way?) */
5267 uint64_t addr = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.msrpm_base_pa));
5268 uint32_t t0, t1;
5269 switch((uint32_t)ECX) {
5270 case 0 ... 0x1fff:
5271 t0 = (ECX * 2) % 8;
5272 t1 = (ECX * 2) / 8;
5273 break;
5274 case 0xc0000000 ... 0xc0001fff:
5275 t0 = (8192 + ECX - 0xc0000000) * 2;
5276 t1 = (t0 / 8);
5277 t0 %= 8;
5278 break;
5279 case 0xc0010000 ... 0xc0011fff:
5280 t0 = (16384 + ECX - 0xc0010000) * 2;
5281 t1 = (t0 / 8);
5282 t0 %= 8;
5283 break;
5284 default:
5285 helper_vmexit(type, param);
5286 t0 = 0;
5287 t1 = 0;
5288 break;
5289 }
5290 if (ldub_phys(addr + t1) & ((1 << param) << t0))
5291 helper_vmexit(type, param);
5292 }
5293 break;
5294 default:
5295 if (env->intercept & (1ULL << (type - SVM_EXIT_INTR))) {
5296 helper_vmexit(type, param);
5297 }
5298 break;
5299 }
5300 }
5301
5302 void svm_check_intercept(CPUState *env1, uint32_t type)
5303 {
5304 CPUState *saved_env;
5305
5306 saved_env = env;
5307 env = env1;
5308 helper_svm_check_intercept_param(type, 0);
5309 env = saved_env;
5310 }
5311
5312 void helper_svm_check_io(uint32_t port, uint32_t param,
5313 uint32_t next_eip_addend)
5314 {
5315 if (env->intercept & (1ULL << (SVM_EXIT_IOIO - SVM_EXIT_INTR))) {
5316 /* FIXME: this should be read in at vmrun (faster this way?) */
5317 uint64_t addr = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.iopm_base_pa));
5318 uint16_t mask = (1 << ((param >> 4) & 7)) - 1;
5319 if(lduw_phys(addr + port / 8) & (mask << (port & 7))) {
5320 /* next EIP */
5321 stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2),
5322 env->eip + next_eip_addend);
5323 helper_vmexit(SVM_EXIT_IOIO, param | (port << 16));
5324 }
5325 }
5326 }
5327
5328 /* Note: currently only 32 bits of exit_code are used */
5329 void helper_vmexit(uint32_t exit_code, uint64_t exit_info_1)
5330 {
5331 uint32_t int_ctl;
5332
5333 qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmexit(%08x, %016" PRIx64 ", %016" PRIx64 ", " TARGET_FMT_lx ")!\n",
5334 exit_code, exit_info_1,
5335 ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2)),
5336 EIP);
5337
5338 if(env->hflags & HF_INHIBIT_IRQ_MASK) {
5339 stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_state), SVM_INTERRUPT_SHADOW_MASK);
5340 env->hflags &= ~HF_INHIBIT_IRQ_MASK;
5341 } else {
5342 stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_state), 0);
5343 }
5344
5345 /* Save the VM state in the vmcb */
5346 svm_save_seg(env->vm_vmcb + offsetof(struct vmcb, save.es),
5347 &env->segs[R_ES]);
5348 svm_save_seg(env->vm_vmcb + offsetof(struct vmcb, save.cs),
5349 &env->segs[R_CS]);
5350 svm_save_seg(env->vm_vmcb + offsetof(struct vmcb, save.ss),
5351 &env->segs[R_SS]);
5352 svm_save_seg(env->vm_vmcb + offsetof(struct vmcb, save.ds),
5353 &env->segs[R_DS]);
5354
5355 stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.base), env->gdt.base);
5356 stl_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.limit), env->gdt.limit);
5357
5358 stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.base), env->idt.base);
5359 stl_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.limit), env->idt.limit);
5360
5361 stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.efer), env->efer);
5362 stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr0), env->cr[0]);
5363 stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr2), env->cr[2]);
5364 stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr3), env->cr[3]);
5365 stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr4), env->cr[4]);
5366
5367 int_ctl = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl));
5368 int_ctl &= ~(V_TPR_MASK | V_IRQ_MASK);
5369 int_ctl |= env->v_tpr & V_TPR_MASK;
5370 if (env->interrupt_request & CPU_INTERRUPT_VIRQ)
5371 int_ctl |= V_IRQ_MASK;
5372 stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl), int_ctl);
5373
5374 stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rflags), compute_eflags());
5375 stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rip), env->eip);
5376 stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rsp), ESP);
5377 stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rax), EAX);
5378 stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr7), env->dr[7]);
5379 stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr6), env->dr[6]);
5380 stb_phys(env->vm_vmcb + offsetof(struct vmcb, save.cpl), env->hflags & HF_CPL_MASK);
5381
5382 /* Reload the host state from vm_hsave */
5383 env->hflags2 &= ~(HF2_HIF_MASK | HF2_VINTR_MASK);
5384 env->hflags &= ~HF_SVMI_MASK;
5385 env->intercept = 0;
5386 env->intercept_exceptions = 0;
5387 env->interrupt_request &= ~CPU_INTERRUPT_VIRQ;
5388 env->tsc_offset = 0;
5389
5390 env->gdt.base = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.base));
5391 env->gdt.limit = ldl_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.limit));
5392
5393 env->idt.base = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.base));
5394 env->idt.limit = ldl_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.limit));
5395
5396 cpu_x86_update_cr0(env, ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr0)) | CR0_PE_MASK);
5397 cpu_x86_update_cr4(env, ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr4)));
5398 cpu_x86_update_cr3(env, ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr3)));
5399 /* we need to set the efer after the crs so the hidden flags get
5400 set properly */
5401 cpu_load_efer(env,
5402 ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.efer)));
5403 env->eflags = 0;
5404 load_eflags(ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rflags)),
5405 ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
5406 CC_OP = CC_OP_EFLAGS;
5407
5408 svm_load_seg_cache(env->vm_hsave + offsetof(struct vmcb, save.es),
5409 env, R_ES);
5410 svm_load_seg_cache(env->vm_hsave + offsetof(struct vmcb, save.cs),
5411 env, R_CS);
5412 svm_load_seg_cache(env->vm_hsave + offsetof(struct vmcb, save.ss),
5413 env, R_SS);
5414 svm_load_seg_cache(env->vm_hsave + offsetof(struct vmcb, save.ds),
5415 env, R_DS);
5416
5417 EIP = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rip));
5418 ESP = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rsp));
5419 EAX = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rax));
5420
5421 env->dr[6] = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr6));
5422 env->dr[7] = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr7));
5423
5424 /* other setups */
5425 cpu_x86_set_cpl(env, 0);
5426 stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_code), exit_code);
5427 stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_1), exit_info_1);
5428
5429 stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_int_info),
5430 ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj)));
5431 stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_int_info_err),
5432 ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj_err)));
5433 stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj), 0);
5434
5435 env->hflags2 &= ~HF2_GIF_MASK;
5436 /* FIXME: Resets the current ASID register to zero (host ASID). */
5437
5438 /* Clears the V_IRQ and V_INTR_MASKING bits inside the processor. */
5439
5440 /* Clears the TSC_OFFSET inside the processor. */
5441
5442 /* If the host is in PAE mode, the processor reloads the host's PDPEs
5443 from the page table indicated the host's CR3. If the PDPEs contain
5444 illegal state, the processor causes a shutdown. */
5445
5446 /* Forces CR0.PE = 1, RFLAGS.VM = 0. */
5447 env->cr[0] |= CR0_PE_MASK;
5448 env->eflags &= ~VM_MASK;
5449
5450 /* Disables all breakpoints in the host DR7 register. */
5451
5452 /* Checks the reloaded host state for consistency. */
5453
5454 /* If the host's rIP reloaded by #VMEXIT is outside the limit of the
5455 host's code segment or non-canonical (in the case of long mode), a
5456 #GP fault is delivered inside the host.) */
5457
5458 /* remove any pending exception */
5459 env->exception_index = -1;
5460 env->error_code = 0;
5461 env->old_exception = -1;
5462
5463 cpu_loop_exit(env);
5464 }
5465
5466 #endif
5467
5468 /* MMX/SSE */
5469 /* XXX: optimize by storing fptt and fptags in the static cpu state */
5470 void helper_enter_mmx(void)
5471 {
5472 env->fpstt = 0;
5473 *(uint32_t *)(env->fptags) = 0;
5474 *(uint32_t *)(env->fptags + 4) = 0;
5475 }
5476
5477 void helper_emms(void)
5478 {
5479 /* set to empty state */
5480 *(uint32_t *)(env->fptags) = 0x01010101;
5481 *(uint32_t *)(env->fptags + 4) = 0x01010101;
5482 }
5483
5484 /* XXX: suppress */
5485 void helper_movq(void *d, void *s)
5486 {
5487 *(uint64_t *)d = *(uint64_t *)s;
5488 }
5489
5490 #define SHIFT 0
5491 #include "ops_sse.h"
5492
5493 #define SHIFT 1
5494 #include "ops_sse.h"
5495
5496 #define SHIFT 0
5497 #include "helper_template.h"
5498 #undef SHIFT
5499
5500 #define SHIFT 1
5501 #include "helper_template.h"
5502 #undef SHIFT
5503
5504 #define SHIFT 2
5505 #include "helper_template.h"
5506 #undef SHIFT
5507
5508 #ifdef TARGET_X86_64
5509
5510 #define SHIFT 3
5511 #include "helper_template.h"
5512 #undef SHIFT
5513
5514 #endif
5515
5516 /* bit operations */
5517 target_ulong helper_bsf(target_ulong t0)
5518 {
5519 int count;
5520 target_ulong res;
5521
5522 res = t0;
5523 count = 0;
5524 while ((res & 1) == 0) {
5525 count++;
5526 res >>= 1;
5527 }
5528 return count;
5529 }
5530
5531 target_ulong helper_lzcnt(target_ulong t0, int wordsize)
5532 {
5533 int count;
5534 target_ulong res, mask;
5535
5536 if (wordsize > 0 && t0 == 0) {
5537 return wordsize;
5538 }
5539 res = t0;
5540 count = TARGET_LONG_BITS - 1;
5541 mask = (target_ulong)1 << (TARGET_LONG_BITS - 1);
5542 while ((res & mask) == 0) {
5543 count--;
5544 res <<= 1;
5545 }
5546 if (wordsize > 0) {
5547 return wordsize - 1 - count;
5548 }
5549 return count;
5550 }
5551
5552 target_ulong helper_bsr(target_ulong t0)
5553 {
5554 return helper_lzcnt(t0, 0);
5555 }
5556
5557 static int compute_all_eflags(void)
5558 {
5559 return CC_SRC;
5560 }
5561
5562 static int compute_c_eflags(void)
5563 {
5564 return CC_SRC & CC_C;
5565 }
5566
5567 uint32_t helper_cc_compute_all(int op)
5568 {
5569 switch (op) {
5570 default: /* should never happen */ return 0;
5571
5572 case CC_OP_EFLAGS: return compute_all_eflags();
5573
5574 case CC_OP_MULB: return compute_all_mulb();
5575 case CC_OP_MULW: return compute_all_mulw();
5576 case CC_OP_MULL: return compute_all_mull();
5577
5578 case CC_OP_ADDB: return compute_all_addb();
5579 case CC_OP_ADDW: return compute_all_addw();
5580 case CC_OP_ADDL: return compute_all_addl();
5581
5582 case CC_OP_ADCB: return compute_all_adcb();
5583 case CC_OP_ADCW: return compute_all_adcw();
5584 case CC_OP_ADCL: return compute_all_adcl();
5585
5586 case CC_OP_SUBB: return compute_all_subb();
5587 case CC_OP_SUBW: return compute_all_subw();
5588 case CC_OP_SUBL: return compute_all_subl();
5589
5590 case CC_OP_SBBB: return compute_all_sbbb();
5591 case CC_OP_SBBW: return compute_all_sbbw();
5592 case CC_OP_SBBL: return compute_all_sbbl();
5593
5594 case CC_OP_LOGICB: return compute_all_logicb();
5595 case CC_OP_LOGICW: return compute_all_logicw();
5596 case CC_OP_LOGICL: return compute_all_logicl();
5597
5598 case CC_OP_INCB: return compute_all_incb();
5599 case CC_OP_INCW: return compute_all_incw();
5600 case CC_OP_INCL: return compute_all_incl();
5601
5602 case CC_OP_DECB: return compute_all_decb();
5603 case CC_OP_DECW: return compute_all_decw();
5604 case CC_OP_DECL: return compute_all_decl();
5605
5606 case CC_OP_SHLB: return compute_all_shlb();
5607 case CC_OP_SHLW: return compute_all_shlw();
5608 case CC_OP_SHLL: return compute_all_shll();
5609
5610 case CC_OP_SARB: return compute_all_sarb();
5611 case CC_OP_SARW: return compute_all_sarw();
5612 case CC_OP_SARL: return compute_all_sarl();
5613
5614 #ifdef TARGET_X86_64
5615 case CC_OP_MULQ: return compute_all_mulq();
5616
5617 case CC_OP_ADDQ: return compute_all_addq();
5618
5619 case CC_OP_ADCQ: return compute_all_adcq();
5620
5621 case CC_OP_SUBQ: return compute_all_subq();
5622
5623 case CC_OP_SBBQ: return compute_all_sbbq();
5624
5625 case CC_OP_LOGICQ: return compute_all_logicq();
5626
5627 case CC_OP_INCQ: return compute_all_incq();
5628
5629 case CC_OP_DECQ: return compute_all_decq();
5630
5631 case CC_OP_SHLQ: return compute_all_shlq();
5632
5633 case CC_OP_SARQ: return compute_all_sarq();
5634 #endif
5635 }
5636 }
5637
5638 uint32_t cpu_cc_compute_all(CPUState *env1, int op)
5639 {
5640 CPUState *saved_env;
5641 uint32_t ret;
5642
5643 saved_env = env;
5644 env = env1;
5645 ret = helper_cc_compute_all(op);
5646 env = saved_env;
5647 return ret;
5648 }
5649
5650 uint32_t helper_cc_compute_c(int op)
5651 {
5652 switch (op) {
5653 default: /* should never happen */ return 0;
5654
5655 case CC_OP_EFLAGS: return compute_c_eflags();
5656
5657 case CC_OP_MULB: return compute_c_mull();
5658 case CC_OP_MULW: return compute_c_mull();
5659 case CC_OP_MULL: return compute_c_mull();
5660
5661 case CC_OP_ADDB: return compute_c_addb();
5662 case CC_OP_ADDW: return compute_c_addw();
5663 case CC_OP_ADDL: return compute_c_addl();
5664
5665 case CC_OP_ADCB: return compute_c_adcb();
5666 case CC_OP_ADCW: return compute_c_adcw();
5667 case CC_OP_ADCL: return compute_c_adcl();
5668
5669 case CC_OP_SUBB: return compute_c_subb();
5670 case CC_OP_SUBW: return compute_c_subw();
5671 case CC_OP_SUBL: return compute_c_subl();
5672
5673 case CC_OP_SBBB: return compute_c_sbbb();
5674 case CC_OP_SBBW: return compute_c_sbbw();
5675 case CC_OP_SBBL: return compute_c_sbbl();
5676
5677 case CC_OP_LOGICB: return compute_c_logicb();
5678 case CC_OP_LOGICW: return compute_c_logicw();
5679 case CC_OP_LOGICL: return compute_c_logicl();
5680
5681 case CC_OP_INCB: return compute_c_incl();
5682 case CC_OP_INCW: return compute_c_incl();
5683 case CC_OP_INCL: return compute_c_incl();
5684
5685 case CC_OP_DECB: return compute_c_incl();
5686 case CC_OP_DECW: return compute_c_incl();
5687 case CC_OP_DECL: return compute_c_incl();
5688
5689 case CC_OP_SHLB: return compute_c_shlb();
5690 case CC_OP_SHLW: return compute_c_shlw();
5691 case CC_OP_SHLL: return compute_c_shll();
5692
5693 case CC_OP_SARB: return compute_c_sarl();
5694 case CC_OP_SARW: return compute_c_sarl();
5695 case CC_OP_SARL: return compute_c_sarl();
5696
5697 #ifdef TARGET_X86_64
5698 case CC_OP_MULQ: return compute_c_mull();
5699
5700 case CC_OP_ADDQ: return compute_c_addq();
5701
5702 case CC_OP_ADCQ: return compute_c_adcq();
5703
5704 case CC_OP_SUBQ: return compute_c_subq();
5705
5706 case CC_OP_SBBQ: return compute_c_sbbq();
5707
5708 case CC_OP_LOGICQ: return compute_c_logicq();
5709
5710 case CC_OP_INCQ: return compute_c_incl();
5711
5712 case CC_OP_DECQ: return compute_c_incl();
5713
5714 case CC_OP_SHLQ: return compute_c_shlq();
5715
5716 case CC_OP_SARQ: return compute_c_sarl();
5717 #endif
5718 }
5719 }
9p server code using virtio transport