Statistics
| Branch: | Revision:

root / target-i386 / op_helper.c @ 640f42e4

History | View | Annotate | Download (156.7 kB)

1
/*
2
 *  i386 helpers
3
 *
4
 *  Copyright (c) 2003 Fabrice Bellard
5
 *
6
 * This library is free software; you can redistribute it and/or
7
 * modify it under the terms of the GNU Lesser General Public
8
 * License as published by the Free Software Foundation; either
9
 * version 2 of the License, or (at your option) any later version.
10
 *
11
 * This library is distributed in the hope that it will be useful,
12
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14
 * Lesser General Public License for more details.
15
 *
16
 * You should have received a copy of the GNU Lesser General Public
17
 * License along with this library; if not, write to the Free Software
18
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA  02110-1301 USA
19
 */
20
#define CPU_NO_GLOBAL_REGS
21
#include "exec.h"
22
#include "exec-all.h"
23
#include "host-utils.h"
24

    
25
//#define DEBUG_PCALL
26

    
27

    
28
#ifdef DEBUG_PCALL
29
#  define LOG_PCALL(...) qemu_log_mask(CPU_LOG_PCALL, ## __VA_ARGS__)
30
#  define LOG_PCALL_STATE(env) \
31
          log_cpu_state_mask(CPU_LOG_PCALL, (env), X86_DUMP_CCOP)
32
#else
33
#  define LOG_PCALL(...) do { } while (0)
34
#  define LOG_PCALL_STATE(env) do { } while (0)
35
#endif
36

    
37

    
38
#if 0
39
#define raise_exception_err(a, b)\
40
do {\
41
    qemu_log("raise_exception line=%d\n", __LINE__);\
42
    (raise_exception_err)(a, b);\
43
} while (0)
44
#endif
45

    
46
static const uint8_t parity_table[256] = {
47
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
48
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
49
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
50
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
51
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
52
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
53
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
54
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
55
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
56
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
57
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
58
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
59
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
60
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
61
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
62
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
63
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
64
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
65
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
66
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
67
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
68
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
69
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
70
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
71
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
72
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
73
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
74
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
75
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
76
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
77
    CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
78
    0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
79
};
80

    
81
/* modulo 17 table */
82
static const uint8_t rclw_table[32] = {
83
    0, 1, 2, 3, 4, 5, 6, 7,
84
    8, 9,10,11,12,13,14,15,
85
   16, 0, 1, 2, 3, 4, 5, 6,
86
    7, 8, 9,10,11,12,13,14,
87
};
88

    
89
/* modulo 9 table */
90
static const uint8_t rclb_table[32] = {
91
    0, 1, 2, 3, 4, 5, 6, 7,
92
    8, 0, 1, 2, 3, 4, 5, 6,
93
    7, 8, 0, 1, 2, 3, 4, 5,
94
    6, 7, 8, 0, 1, 2, 3, 4,
95
};
96

    
97
static const CPU86_LDouble f15rk[7] =
98
{
99
    0.00000000000000000000L,
100
    1.00000000000000000000L,
101
    3.14159265358979323851L,  /*pi*/
102
    0.30102999566398119523L,  /*lg2*/
103
    0.69314718055994530943L,  /*ln2*/
104
    1.44269504088896340739L,  /*l2e*/
105
    3.32192809488736234781L,  /*l2t*/
106
};
107

    
108
/* broken thread support */
109

    
110
static spinlock_t global_cpu_lock = SPIN_LOCK_UNLOCKED;
111

    
112
void helper_lock(void)
113
{
114
    spin_lock(&global_cpu_lock);
115
}
116

    
117
void helper_unlock(void)
118
{
119
    spin_unlock(&global_cpu_lock);
120
}
121

    
122
void helper_write_eflags(target_ulong t0, uint32_t update_mask)
123
{
124
    load_eflags(t0, update_mask);
125
}
126

    
127
target_ulong helper_read_eflags(void)
128
{
129
    uint32_t eflags;
130
    eflags = helper_cc_compute_all(CC_OP);
131
    eflags |= (DF & DF_MASK);
132
    eflags |= env->eflags & ~(VM_MASK | RF_MASK);
133
    return eflags;
134
}
135

    
136
/* return non zero if error */
137
static inline int load_segment(uint32_t *e1_ptr, uint32_t *e2_ptr,
138
                               int selector)
139
{
140
    SegmentCache *dt;
141
    int index;
142
    target_ulong ptr;
143

    
144
    if (selector & 0x4)
145
        dt = &env->ldt;
146
    else
147
        dt = &env->gdt;
148
    index = selector & ~7;
149
    if ((index + 7) > dt->limit)
150
        return -1;
151
    ptr = dt->base + index;
152
    *e1_ptr = ldl_kernel(ptr);
153
    *e2_ptr = ldl_kernel(ptr + 4);
154
    return 0;
155
}
156

    
157
static inline unsigned int get_seg_limit(uint32_t e1, uint32_t e2)
158
{
159
    unsigned int limit;
160
    limit = (e1 & 0xffff) | (e2 & 0x000f0000);
161
    if (e2 & DESC_G_MASK)
162
        limit = (limit << 12) | 0xfff;
163
    return limit;
164
}
165

    
166
static inline uint32_t get_seg_base(uint32_t e1, uint32_t e2)
167
{
168
    return ((e1 >> 16) | ((e2 & 0xff) << 16) | (e2 & 0xff000000));
169
}
170

    
171
static inline void load_seg_cache_raw_dt(SegmentCache *sc, uint32_t e1, uint32_t e2)
172
{
173
    sc->base = get_seg_base(e1, e2);
174
    sc->limit = get_seg_limit(e1, e2);
175
    sc->flags = e2;
176
}
177

    
178
/* init the segment cache in vm86 mode. */
179
static inline void load_seg_vm(int seg, int selector)
180
{
181
    selector &= 0xffff;
182
    cpu_x86_load_seg_cache(env, seg, selector,
183
                           (selector << 4), 0xffff, 0);
184
}
185

    
186
static inline void get_ss_esp_from_tss(uint32_t *ss_ptr,
187
                                       uint32_t *esp_ptr, int dpl)
188
{
189
    int type, index, shift;
190

    
191
#if 0
192
    {
193
        int i;
194
        printf("TR: base=%p limit=%x\n", env->tr.base, env->tr.limit);
195
        for(i=0;i<env->tr.limit;i++) {
196
            printf("%02x ", env->tr.base[i]);
197
            if ((i & 7) == 7) printf("\n");
198
        }
199
        printf("\n");
200
    }
201
#endif
202

    
203
    if (!(env->tr.flags & DESC_P_MASK))
204
        cpu_abort(env, "invalid tss");
205
    type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
206
    if ((type & 7) != 1)
207
        cpu_abort(env, "invalid tss type");
208
    shift = type >> 3;
209
    index = (dpl * 4 + 2) << shift;
210
    if (index + (4 << shift) - 1 > env->tr.limit)
211
        raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
212
    if (shift == 0) {
213
        *esp_ptr = lduw_kernel(env->tr.base + index);
214
        *ss_ptr = lduw_kernel(env->tr.base + index + 2);
215
    } else {
216
        *esp_ptr = ldl_kernel(env->tr.base + index);
217
        *ss_ptr = lduw_kernel(env->tr.base + index + 4);
218
    }
219
}
220

    
221
/* XXX: merge with load_seg() */
222
static void tss_load_seg(int seg_reg, int selector)
223
{
224
    uint32_t e1, e2;
225
    int rpl, dpl, cpl;
226

    
227
    if ((selector & 0xfffc) != 0) {
228
        if (load_segment(&e1, &e2, selector) != 0)
229
            raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
230
        if (!(e2 & DESC_S_MASK))
231
            raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
232
        rpl = selector & 3;
233
        dpl = (e2 >> DESC_DPL_SHIFT) & 3;
234
        cpl = env->hflags & HF_CPL_MASK;
235
        if (seg_reg == R_CS) {
236
            if (!(e2 & DESC_CS_MASK))
237
                raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
238
            /* XXX: is it correct ? */
239
            if (dpl != rpl)
240
                raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
241
            if ((e2 & DESC_C_MASK) && dpl > rpl)
242
                raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
243
        } else if (seg_reg == R_SS) {
244
            /* SS must be writable data */
245
            if ((e2 & DESC_CS_MASK) || !(e2 & DESC_W_MASK))
246
                raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
247
            if (dpl != cpl || dpl != rpl)
248
                raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
249
        } else {
250
            /* not readable code */
251
            if ((e2 & DESC_CS_MASK) && !(e2 & DESC_R_MASK))
252
                raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
253
            /* if data or non conforming code, checks the rights */
254
            if (((e2 >> DESC_TYPE_SHIFT) & 0xf) < 12) {
255
                if (dpl < cpl || dpl < rpl)
256
                    raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
257
            }
258
        }
259
        if (!(e2 & DESC_P_MASK))
260
            raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
261
        cpu_x86_load_seg_cache(env, seg_reg, selector,
262
                       get_seg_base(e1, e2),
263
                       get_seg_limit(e1, e2),
264
                       e2);
265
    } else {
266
        if (seg_reg == R_SS || seg_reg == R_CS)
267
            raise_exception_err(EXCP0A_TSS, selector & 0xfffc);
268
    }
269
}
270

    
271
#define SWITCH_TSS_JMP  0
272
#define SWITCH_TSS_IRET 1
273
#define SWITCH_TSS_CALL 2
274

    
275
/* XXX: restore CPU state in registers (PowerPC case) */
276
static void switch_tss(int tss_selector,
277
                       uint32_t e1, uint32_t e2, int source,
278
                       uint32_t next_eip)
279
{
280
    int tss_limit, tss_limit_max, type, old_tss_limit_max, old_type, v1, v2, i;
281
    target_ulong tss_base;
282
    uint32_t new_regs[8], new_segs[6];
283
    uint32_t new_eflags, new_eip, new_cr3, new_ldt, new_trap;
284
    uint32_t old_eflags, eflags_mask;
285
    SegmentCache *dt;
286
    int index;
287
    target_ulong ptr;
288

    
289
    type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
290
    LOG_PCALL("switch_tss: sel=0x%04x type=%d src=%d\n", tss_selector, type, source);
291

    
292
    /* if task gate, we read the TSS segment and we load it */
293
    if (type == 5) {
294
        if (!(e2 & DESC_P_MASK))
295
            raise_exception_err(EXCP0B_NOSEG, tss_selector & 0xfffc);
296
        tss_selector = e1 >> 16;
297
        if (tss_selector & 4)
298
            raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
299
        if (load_segment(&e1, &e2, tss_selector) != 0)
300
            raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
301
        if (e2 & DESC_S_MASK)
302
            raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
303
        type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
304
        if ((type & 7) != 1)
305
            raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc);
306
    }
307

    
308
    if (!(e2 & DESC_P_MASK))
309
        raise_exception_err(EXCP0B_NOSEG, tss_selector & 0xfffc);
310

    
311
    if (type & 8)
312
        tss_limit_max = 103;
313
    else
314
        tss_limit_max = 43;
315
    tss_limit = get_seg_limit(e1, e2);
316
    tss_base = get_seg_base(e1, e2);
317
    if ((tss_selector & 4) != 0 ||
318
        tss_limit < tss_limit_max)
319
        raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
320
    old_type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
321
    if (old_type & 8)
322
        old_tss_limit_max = 103;
323
    else
324
        old_tss_limit_max = 43;
325

    
326
    /* read all the registers from the new TSS */
327
    if (type & 8) {
328
        /* 32 bit */
329
        new_cr3 = ldl_kernel(tss_base + 0x1c);
330
        new_eip = ldl_kernel(tss_base + 0x20);
331
        new_eflags = ldl_kernel(tss_base + 0x24);
332
        for(i = 0; i < 8; i++)
333
            new_regs[i] = ldl_kernel(tss_base + (0x28 + i * 4));
334
        for(i = 0; i < 6; i++)
335
            new_segs[i] = lduw_kernel(tss_base + (0x48 + i * 4));
336
        new_ldt = lduw_kernel(tss_base + 0x60);
337
        new_trap = ldl_kernel(tss_base + 0x64);
338
    } else {
339
        /* 16 bit */
340
        new_cr3 = 0;
341
        new_eip = lduw_kernel(tss_base + 0x0e);
342
        new_eflags = lduw_kernel(tss_base + 0x10);
343
        for(i = 0; i < 8; i++)
344
            new_regs[i] = lduw_kernel(tss_base + (0x12 + i * 2)) | 0xffff0000;
345
        for(i = 0; i < 4; i++)
346
            new_segs[i] = lduw_kernel(tss_base + (0x22 + i * 4));
347
        new_ldt = lduw_kernel(tss_base + 0x2a);
348
        new_segs[R_FS] = 0;
349
        new_segs[R_GS] = 0;
350
        new_trap = 0;
351
    }
352

    
353
    /* NOTE: we must avoid memory exceptions during the task switch,
354
       so we make dummy accesses before */
355
    /* XXX: it can still fail in some cases, so a bigger hack is
356
       necessary to valid the TLB after having done the accesses */
357

    
358
    v1 = ldub_kernel(env->tr.base);
359
    v2 = ldub_kernel(env->tr.base + old_tss_limit_max);
360
    stb_kernel(env->tr.base, v1);
361
    stb_kernel(env->tr.base + old_tss_limit_max, v2);
362

    
363
    /* clear busy bit (it is restartable) */
364
    if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_IRET) {
365
        target_ulong ptr;
366
        uint32_t e2;
367
        ptr = env->gdt.base + (env->tr.selector & ~7);
368
        e2 = ldl_kernel(ptr + 4);
369
        e2 &= ~DESC_TSS_BUSY_MASK;
370
        stl_kernel(ptr + 4, e2);
371
    }
372
    old_eflags = compute_eflags();
373
    if (source == SWITCH_TSS_IRET)
374
        old_eflags &= ~NT_MASK;
375

    
376
    /* save the current state in the old TSS */
377
    if (type & 8) {
378
        /* 32 bit */
379
        stl_kernel(env->tr.base + 0x20, next_eip);
380
        stl_kernel(env->tr.base + 0x24, old_eflags);
381
        stl_kernel(env->tr.base + (0x28 + 0 * 4), EAX);
382
        stl_kernel(env->tr.base + (0x28 + 1 * 4), ECX);
383
        stl_kernel(env->tr.base + (0x28 + 2 * 4), EDX);
384
        stl_kernel(env->tr.base + (0x28 + 3 * 4), EBX);
385
        stl_kernel(env->tr.base + (0x28 + 4 * 4), ESP);
386
        stl_kernel(env->tr.base + (0x28 + 5 * 4), EBP);
387
        stl_kernel(env->tr.base + (0x28 + 6 * 4), ESI);
388
        stl_kernel(env->tr.base + (0x28 + 7 * 4), EDI);
389
        for(i = 0; i < 6; i++)
390
            stw_kernel(env->tr.base + (0x48 + i * 4), env->segs[i].selector);
391
    } else {
392
        /* 16 bit */
393
        stw_kernel(env->tr.base + 0x0e, next_eip);
394
        stw_kernel(env->tr.base + 0x10, old_eflags);
395
        stw_kernel(env->tr.base + (0x12 + 0 * 2), EAX);
396
        stw_kernel(env->tr.base + (0x12 + 1 * 2), ECX);
397
        stw_kernel(env->tr.base + (0x12 + 2 * 2), EDX);
398
        stw_kernel(env->tr.base + (0x12 + 3 * 2), EBX);
399
        stw_kernel(env->tr.base + (0x12 + 4 * 2), ESP);
400
        stw_kernel(env->tr.base + (0x12 + 5 * 2), EBP);
401
        stw_kernel(env->tr.base + (0x12 + 6 * 2), ESI);
402
        stw_kernel(env->tr.base + (0x12 + 7 * 2), EDI);
403
        for(i = 0; i < 4; i++)
404
            stw_kernel(env->tr.base + (0x22 + i * 4), env->segs[i].selector);
405
    }
406

    
407
    /* now if an exception occurs, it will occurs in the next task
408
       context */
409

    
410
    if (source == SWITCH_TSS_CALL) {
411
        stw_kernel(tss_base, env->tr.selector);
412
        new_eflags |= NT_MASK;
413
    }
414

    
415
    /* set busy bit */
416
    if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_CALL) {
417
        target_ulong ptr;
418
        uint32_t e2;
419
        ptr = env->gdt.base + (tss_selector & ~7);
420
        e2 = ldl_kernel(ptr + 4);
421
        e2 |= DESC_TSS_BUSY_MASK;
422
        stl_kernel(ptr + 4, e2);
423
    }
424

    
425
    /* set the new CPU state */
426
    /* from this point, any exception which occurs can give problems */
427
    env->cr[0] |= CR0_TS_MASK;
428
    env->hflags |= HF_TS_MASK;
429
    env->tr.selector = tss_selector;
430
    env->tr.base = tss_base;
431
    env->tr.limit = tss_limit;
432
    env->tr.flags = e2 & ~DESC_TSS_BUSY_MASK;
433

    
434
    if ((type & 8) && (env->cr[0] & CR0_PG_MASK)) {
435
        cpu_x86_update_cr3(env, new_cr3);
436
    }
437

    
438
    /* load all registers without an exception, then reload them with
439
       possible exception */
440
    env->eip = new_eip;
441
    eflags_mask = TF_MASK | AC_MASK | ID_MASK |
442
        IF_MASK | IOPL_MASK | VM_MASK | RF_MASK | NT_MASK;
443
    if (!(type & 8))
444
        eflags_mask &= 0xffff;
445
    load_eflags(new_eflags, eflags_mask);
446
    /* XXX: what to do in 16 bit case ? */
447
    EAX = new_regs[0];
448
    ECX = new_regs[1];
449
    EDX = new_regs[2];
450
    EBX = new_regs[3];
451
    ESP = new_regs[4];
452
    EBP = new_regs[5];
453
    ESI = new_regs[6];
454
    EDI = new_regs[7];
455
    if (new_eflags & VM_MASK) {
456
        for(i = 0; i < 6; i++)
457
            load_seg_vm(i, new_segs[i]);
458
        /* in vm86, CPL is always 3 */
459
        cpu_x86_set_cpl(env, 3);
460
    } else {
461
        /* CPL is set the RPL of CS */
462
        cpu_x86_set_cpl(env, new_segs[R_CS] & 3);
463
        /* first just selectors as the rest may trigger exceptions */
464
        for(i = 0; i < 6; i++)
465
            cpu_x86_load_seg_cache(env, i, new_segs[i], 0, 0, 0);
466
    }
467

    
468
    env->ldt.selector = new_ldt & ~4;
469
    env->ldt.base = 0;
470
    env->ldt.limit = 0;
471
    env->ldt.flags = 0;
472

    
473
    /* load the LDT */
474
    if (new_ldt & 4)
475
        raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
476

    
477
    if ((new_ldt & 0xfffc) != 0) {
478
        dt = &env->gdt;
479
        index = new_ldt & ~7;
480
        if ((index + 7) > dt->limit)
481
            raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
482
        ptr = dt->base + index;
483
        e1 = ldl_kernel(ptr);
484
        e2 = ldl_kernel(ptr + 4);
485
        if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2)
486
            raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
487
        if (!(e2 & DESC_P_MASK))
488
            raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc);
489
        load_seg_cache_raw_dt(&env->ldt, e1, e2);
490
    }
491

    
492
    /* load the segments */
493
    if (!(new_eflags & VM_MASK)) {
494
        tss_load_seg(R_CS, new_segs[R_CS]);
495
        tss_load_seg(R_SS, new_segs[R_SS]);
496
        tss_load_seg(R_ES, new_segs[R_ES]);
497
        tss_load_seg(R_DS, new_segs[R_DS]);
498
        tss_load_seg(R_FS, new_segs[R_FS]);
499
        tss_load_seg(R_GS, new_segs[R_GS]);
500
    }
501

    
502
    /* check that EIP is in the CS segment limits */
503
    if (new_eip > env->segs[R_CS].limit) {
504
        /* XXX: different exception if CALL ? */
505
        raise_exception_err(EXCP0D_GPF, 0);
506
    }
507

    
508
#ifndef CONFIG_USER_ONLY
509
    /* reset local breakpoints */
510
    if (env->dr[7] & 0x55) {
511
        for (i = 0; i < 4; i++) {
512
            if (hw_breakpoint_enabled(env->dr[7], i) == 0x1)
513
                hw_breakpoint_remove(env, i);
514
        }
515
        env->dr[7] &= ~0x55;
516
    }
517
#endif
518
}
519

    
520
/* check if Port I/O is allowed in TSS */
521
static inline void check_io(int addr, int size)
522
{
523
    int io_offset, val, mask;
524

    
525
    /* TSS must be a valid 32 bit one */
526
    if (!(env->tr.flags & DESC_P_MASK) ||
527
        ((env->tr.flags >> DESC_TYPE_SHIFT) & 0xf) != 9 ||
528
        env->tr.limit < 103)
529
        goto fail;
530
    io_offset = lduw_kernel(env->tr.base + 0x66);
531
    io_offset += (addr >> 3);
532
    /* Note: the check needs two bytes */
533
    if ((io_offset + 1) > env->tr.limit)
534
        goto fail;
535
    val = lduw_kernel(env->tr.base + io_offset);
536
    val >>= (addr & 7);
537
    mask = (1 << size) - 1;
538
    /* all bits must be zero to allow the I/O */
539
    if ((val & mask) != 0) {
540
    fail:
541
        raise_exception_err(EXCP0D_GPF, 0);
542
    }
543
}
544

    
545
void helper_check_iob(uint32_t t0)
546
{
547
    check_io(t0, 1);
548
}
549

    
550
void helper_check_iow(uint32_t t0)
551
{
552
    check_io(t0, 2);
553
}
554

    
555
void helper_check_iol(uint32_t t0)
556
{
557
    check_io(t0, 4);
558
}
559

    
560
void helper_outb(uint32_t port, uint32_t data)
561
{
562
    cpu_outb(env, port, data & 0xff);
563
}
564

    
565
target_ulong helper_inb(uint32_t port)
566
{
567
    return cpu_inb(env, port);
568
}
569

    
570
void helper_outw(uint32_t port, uint32_t data)
571
{
572
    cpu_outw(env, port, data & 0xffff);
573
}
574

    
575
target_ulong helper_inw(uint32_t port)
576
{
577
    return cpu_inw(env, port);
578
}
579

    
580
void helper_outl(uint32_t port, uint32_t data)
581
{
582
    cpu_outl(env, port, data);
583
}
584

    
585
target_ulong helper_inl(uint32_t port)
586
{
587
    return cpu_inl(env, port);
588
}
589

    
590
static inline unsigned int get_sp_mask(unsigned int e2)
591
{
592
    if (e2 & DESC_B_MASK)
593
        return 0xffffffff;
594
    else
595
        return 0xffff;
596
}
597

    
598
#ifdef TARGET_X86_64
599
#define SET_ESP(val, sp_mask)\
600
do {\
601
    if ((sp_mask) == 0xffff)\
602
        ESP = (ESP & ~0xffff) | ((val) & 0xffff);\
603
    else if ((sp_mask) == 0xffffffffLL)\
604
        ESP = (uint32_t)(val);\
605
    else\
606
        ESP = (val);\
607
} while (0)
608
#else
609
#define SET_ESP(val, sp_mask) ESP = (ESP & ~(sp_mask)) | ((val) & (sp_mask))
610
#endif
611

    
612
/* in 64-bit machines, this can overflow. So this segment addition macro
613
 * can be used to trim the value to 32-bit whenever needed */
614
#define SEG_ADDL(ssp, sp, sp_mask) ((uint32_t)((ssp) + (sp & (sp_mask))))
615

    
616
/* XXX: add a is_user flag to have proper security support */
617
#define PUSHW(ssp, sp, sp_mask, val)\
618
{\
619
    sp -= 2;\
620
    stw_kernel((ssp) + (sp & (sp_mask)), (val));\
621
}
622

    
623
#define PUSHL(ssp, sp, sp_mask, val)\
624
{\
625
    sp -= 4;\
626
    stl_kernel(SEG_ADDL(ssp, sp, sp_mask), (uint32_t)(val));\
627
}
628

    
629
#define POPW(ssp, sp, sp_mask, val)\
630
{\
631
    val = lduw_kernel((ssp) + (sp & (sp_mask)));\
632
    sp += 2;\
633
}
634

    
635
#define POPL(ssp, sp, sp_mask, val)\
636
{\
637
    val = (uint32_t)ldl_kernel(SEG_ADDL(ssp, sp, sp_mask));\
638
    sp += 4;\
639
}
640

    
641
/* protected mode interrupt */
642
static void do_interrupt_protected(int intno, int is_int, int error_code,
643
                                   unsigned int next_eip, int is_hw)
644
{
645
    SegmentCache *dt;
646
    target_ulong ptr, ssp;
647
    int type, dpl, selector, ss_dpl, cpl;
648
    int has_error_code, new_stack, shift;
649
    uint32_t e1, e2, offset, ss = 0, esp, ss_e1 = 0, ss_e2 = 0;
650
    uint32_t old_eip, sp_mask;
651

    
652
    has_error_code = 0;
653
    if (!is_int && !is_hw) {
654
        switch(intno) {
655
        case 8:
656
        case 10:
657
        case 11:
658
        case 12:
659
        case 13:
660
        case 14:
661
        case 17:
662
            has_error_code = 1;
663
            break;
664
        }
665
    }
666
    if (is_int)
667
        old_eip = next_eip;
668
    else
669
        old_eip = env->eip;
670

    
671
    dt = &env->idt;
672
    if (intno * 8 + 7 > dt->limit)
673
        raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
674
    ptr = dt->base + intno * 8;
675
    e1 = ldl_kernel(ptr);
676
    e2 = ldl_kernel(ptr + 4);
677
    /* check gate type */
678
    type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
679
    switch(type) {
680
    case 5: /* task gate */
681
        /* must do that check here to return the correct error code */
682
        if (!(e2 & DESC_P_MASK))
683
            raise_exception_err(EXCP0B_NOSEG, intno * 8 + 2);
684
        switch_tss(intno * 8, e1, e2, SWITCH_TSS_CALL, old_eip);
685
        if (has_error_code) {
686
            int type;
687
            uint32_t mask;
688
            /* push the error code */
689
            type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
690
            shift = type >> 3;
691
            if (env->segs[R_SS].flags & DESC_B_MASK)
692
                mask = 0xffffffff;
693
            else
694
                mask = 0xffff;
695
            esp = (ESP - (2 << shift)) & mask;
696
            ssp = env->segs[R_SS].base + esp;
697
            if (shift)
698
                stl_kernel(ssp, error_code);
699
            else
700
                stw_kernel(ssp, error_code);
701
            SET_ESP(esp, mask);
702
        }
703
        return;
704
    case 6: /* 286 interrupt gate */
705
    case 7: /* 286 trap gate */
706
    case 14: /* 386 interrupt gate */
707
    case 15: /* 386 trap gate */
708
        break;
709
    default:
710
        raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
711
        break;
712
    }
713
    dpl = (e2 >> DESC_DPL_SHIFT) & 3;
714
    cpl = env->hflags & HF_CPL_MASK;
715
    /* check privilege if software int */
716
    if (is_int && dpl < cpl)
717
        raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
718
    /* check valid bit */
719
    if (!(e2 & DESC_P_MASK))
720
        raise_exception_err(EXCP0B_NOSEG, intno * 8 + 2);
721
    selector = e1 >> 16;
722
    offset = (e2 & 0xffff0000) | (e1 & 0x0000ffff);
723
    if ((selector & 0xfffc) == 0)
724
        raise_exception_err(EXCP0D_GPF, 0);
725

    
726
    if (load_segment(&e1, &e2, selector) != 0)
727
        raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
728
    if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK)))
729
        raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
730
    dpl = (e2 >> DESC_DPL_SHIFT) & 3;
731
    if (dpl > cpl)
732
        raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
733
    if (!(e2 & DESC_P_MASK))
734
        raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
735
    if (!(e2 & DESC_C_MASK) && dpl < cpl) {
736
        /* to inner privilege */
737
        get_ss_esp_from_tss(&ss, &esp, dpl);
738
        if ((ss & 0xfffc) == 0)
739
            raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
740
        if ((ss & 3) != dpl)
741
            raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
742
        if (load_segment(&ss_e1, &ss_e2, ss) != 0)
743
            raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
744
        ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
745
        if (ss_dpl != dpl)
746
            raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
747
        if (!(ss_e2 & DESC_S_MASK) ||
748
            (ss_e2 & DESC_CS_MASK) ||
749
            !(ss_e2 & DESC_W_MASK))
750
            raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
751
        if (!(ss_e2 & DESC_P_MASK))
752
            raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
753
        new_stack = 1;
754
        sp_mask = get_sp_mask(ss_e2);
755
        ssp = get_seg_base(ss_e1, ss_e2);
756
    } else if ((e2 & DESC_C_MASK) || dpl == cpl) {
757
        /* to same privilege */
758
        if (env->eflags & VM_MASK)
759
            raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
760
        new_stack = 0;
761
        sp_mask = get_sp_mask(env->segs[R_SS].flags);
762
        ssp = env->segs[R_SS].base;
763
        esp = ESP;
764
        dpl = cpl;
765
    } else {
766
        raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
767
        new_stack = 0; /* avoid warning */
768
        sp_mask = 0; /* avoid warning */
769
        ssp = 0; /* avoid warning */
770
        esp = 0; /* avoid warning */
771
    }
772

    
773
    shift = type >> 3;
774

    
775
#if 0
776
    /* XXX: check that enough room is available */
777
    push_size = 6 + (new_stack << 2) + (has_error_code << 1);
778
    if (env->eflags & VM_MASK)
779
        push_size += 8;
780
    push_size <<= shift;
781
#endif
782
    if (shift == 1) {
783
        if (new_stack) {
784
            if (env->eflags & VM_MASK) {
785
                PUSHL(ssp, esp, sp_mask, env->segs[R_GS].selector);
786
                PUSHL(ssp, esp, sp_mask, env->segs[R_FS].selector);
787
                PUSHL(ssp, esp, sp_mask, env->segs[R_DS].selector);
788
                PUSHL(ssp, esp, sp_mask, env->segs[R_ES].selector);
789
            }
790
            PUSHL(ssp, esp, sp_mask, env->segs[R_SS].selector);
791
            PUSHL(ssp, esp, sp_mask, ESP);
792
        }
793
        PUSHL(ssp, esp, sp_mask, compute_eflags());
794
        PUSHL(ssp, esp, sp_mask, env->segs[R_CS].selector);
795
        PUSHL(ssp, esp, sp_mask, old_eip);
796
        if (has_error_code) {
797
            PUSHL(ssp, esp, sp_mask, error_code);
798
        }
799
    } else {
800
        if (new_stack) {
801
            if (env->eflags & VM_MASK) {
802
                PUSHW(ssp, esp, sp_mask, env->segs[R_GS].selector);
803
                PUSHW(ssp, esp, sp_mask, env->segs[R_FS].selector);
804
                PUSHW(ssp, esp, sp_mask, env->segs[R_DS].selector);
805
                PUSHW(ssp, esp, sp_mask, env->segs[R_ES].selector);
806
            }
807
            PUSHW(ssp, esp, sp_mask, env->segs[R_SS].selector);
808
            PUSHW(ssp, esp, sp_mask, ESP);
809
        }
810
        PUSHW(ssp, esp, sp_mask, compute_eflags());
811
        PUSHW(ssp, esp, sp_mask, env->segs[R_CS].selector);
812
        PUSHW(ssp, esp, sp_mask, old_eip);
813
        if (has_error_code) {
814
            PUSHW(ssp, esp, sp_mask, error_code);
815
        }
816
    }
817

    
818
    if (new_stack) {
819
        if (env->eflags & VM_MASK) {
820
            cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0, 0);
821
            cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0, 0);
822
            cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0, 0);
823
            cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0, 0);
824
        }
825
        ss = (ss & ~3) | dpl;
826
        cpu_x86_load_seg_cache(env, R_SS, ss,
827
                               ssp, get_seg_limit(ss_e1, ss_e2), ss_e2);
828
    }
829
    SET_ESP(esp, sp_mask);
830

    
831
    selector = (selector & ~3) | dpl;
832
    cpu_x86_load_seg_cache(env, R_CS, selector,
833
                   get_seg_base(e1, e2),
834
                   get_seg_limit(e1, e2),
835
                   e2);
836
    cpu_x86_set_cpl(env, dpl);
837
    env->eip = offset;
838

    
839
    /* interrupt gate clear IF mask */
840
    if ((type & 1) == 0) {
841
        env->eflags &= ~IF_MASK;
842
    }
843
    env->eflags &= ~(TF_MASK | VM_MASK | RF_MASK | NT_MASK);
844
}
845

    
846
#ifdef TARGET_X86_64
847

    
848
#define PUSHQ(sp, val)\
849
{\
850
    sp -= 8;\
851
    stq_kernel(sp, (val));\
852
}
853

    
854
#define POPQ(sp, val)\
855
{\
856
    val = ldq_kernel(sp);\
857
    sp += 8;\
858
}
859

    
860
static inline target_ulong get_rsp_from_tss(int level)
861
{
862
    int index;
863

    
864
#if 0
865
    printf("TR: base=" TARGET_FMT_lx " limit=%x\n",
866
           env->tr.base, env->tr.limit);
867
#endif
868

    
869
    if (!(env->tr.flags & DESC_P_MASK))
870
        cpu_abort(env, "invalid tss");
871
    index = 8 * level + 4;
872
    if ((index + 7) > env->tr.limit)
873
        raise_exception_err(EXCP0A_TSS, env->tr.selector & 0xfffc);
874
    return ldq_kernel(env->tr.base + index);
875
}
876

    
877
/* 64 bit interrupt */
878
static void do_interrupt64(int intno, int is_int, int error_code,
879
                           target_ulong next_eip, int is_hw)
880
{
881
    SegmentCache *dt;
882
    target_ulong ptr;
883
    int type, dpl, selector, cpl, ist;
884
    int has_error_code, new_stack;
885
    uint32_t e1, e2, e3, ss;
886
    target_ulong old_eip, esp, offset;
887

    
888
    has_error_code = 0;
889
    if (!is_int && !is_hw) {
890
        switch(intno) {
891
        case 8:
892
        case 10:
893
        case 11:
894
        case 12:
895
        case 13:
896
        case 14:
897
        case 17:
898
            has_error_code = 1;
899
            break;
900
        }
901
    }
902
    if (is_int)
903
        old_eip = next_eip;
904
    else
905
        old_eip = env->eip;
906

    
907
    dt = &env->idt;
908
    if (intno * 16 + 15 > dt->limit)
909
        raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
910
    ptr = dt->base + intno * 16;
911
    e1 = ldl_kernel(ptr);
912
    e2 = ldl_kernel(ptr + 4);
913
    e3 = ldl_kernel(ptr + 8);
914
    /* check gate type */
915
    type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
916
    switch(type) {
917
    case 14: /* 386 interrupt gate */
918
    case 15: /* 386 trap gate */
919
        break;
920
    default:
921
        raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
922
        break;
923
    }
924
    dpl = (e2 >> DESC_DPL_SHIFT) & 3;
925
    cpl = env->hflags & HF_CPL_MASK;
926
    /* check privilege if software int */
927
    if (is_int && dpl < cpl)
928
        raise_exception_err(EXCP0D_GPF, intno * 16 + 2);
929
    /* check valid bit */
930
    if (!(e2 & DESC_P_MASK))
931
        raise_exception_err(EXCP0B_NOSEG, intno * 16 + 2);
932
    selector = e1 >> 16;
933
    offset = ((target_ulong)e3 << 32) | (e2 & 0xffff0000) | (e1 & 0x0000ffff);
934
    ist = e2 & 7;
935
    if ((selector & 0xfffc) == 0)
936
        raise_exception_err(EXCP0D_GPF, 0);
937

    
938
    if (load_segment(&e1, &e2, selector) != 0)
939
        raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
940
    if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK)))
941
        raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
942
    dpl = (e2 >> DESC_DPL_SHIFT) & 3;
943
    if (dpl > cpl)
944
        raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
945
    if (!(e2 & DESC_P_MASK))
946
        raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
947
    if (!(e2 & DESC_L_MASK) || (e2 & DESC_B_MASK))
948
        raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
949
    if ((!(e2 & DESC_C_MASK) && dpl < cpl) || ist != 0) {
950
        /* to inner privilege */
951
        if (ist != 0)
952
            esp = get_rsp_from_tss(ist + 3);
953
        else
954
            esp = get_rsp_from_tss(dpl);
955
        esp &= ~0xfLL; /* align stack */
956
        ss = 0;
957
        new_stack = 1;
958
    } else if ((e2 & DESC_C_MASK) || dpl == cpl) {
959
        /* to same privilege */
960
        if (env->eflags & VM_MASK)
961
            raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
962
        new_stack = 0;
963
        if (ist != 0)
964
            esp = get_rsp_from_tss(ist + 3);
965
        else
966
            esp = ESP;
967
        esp &= ~0xfLL; /* align stack */
968
        dpl = cpl;
969
    } else {
970
        raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
971
        new_stack = 0; /* avoid warning */
972
        esp = 0; /* avoid warning */
973
    }
974

    
975
    PUSHQ(esp, env->segs[R_SS].selector);
976
    PUSHQ(esp, ESP);
977
    PUSHQ(esp, compute_eflags());
978
    PUSHQ(esp, env->segs[R_CS].selector);
979
    PUSHQ(esp, old_eip);
980
    if (has_error_code) {
981
        PUSHQ(esp, error_code);
982
    }
983

    
984
    if (new_stack) {
985
        ss = 0 | dpl;
986
        cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, 0);
987
    }
988
    ESP = esp;
989

    
990
    selector = (selector & ~3) | dpl;
991
    cpu_x86_load_seg_cache(env, R_CS, selector,
992
                   get_seg_base(e1, e2),
993
                   get_seg_limit(e1, e2),
994
                   e2);
995
    cpu_x86_set_cpl(env, dpl);
996
    env->eip = offset;
997

    
998
    /* interrupt gate clear IF mask */
999
    if ((type & 1) == 0) {
1000
        env->eflags &= ~IF_MASK;
1001
    }
1002
    env->eflags &= ~(TF_MASK | VM_MASK | RF_MASK | NT_MASK);
1003
}
1004
#endif
1005

    
1006
#ifdef TARGET_X86_64
1007
#if defined(CONFIG_USER_ONLY)
1008
void helper_syscall(int next_eip_addend)
1009
{
1010
    env->exception_index = EXCP_SYSCALL;
1011
    env->exception_next_eip = env->eip + next_eip_addend;
1012
    cpu_loop_exit();
1013
}
1014
#else
1015
void helper_syscall(int next_eip_addend)
1016
{
1017
    int selector;
1018

    
1019
    if (!(env->efer & MSR_EFER_SCE)) {
1020
        raise_exception_err(EXCP06_ILLOP, 0);
1021
    }
1022
    selector = (env->star >> 32) & 0xffff;
1023
    if (env->hflags & HF_LMA_MASK) {
1024
        int code64;
1025

    
1026
        ECX = env->eip + next_eip_addend;
1027
        env->regs[11] = compute_eflags();
1028

    
1029
        code64 = env->hflags & HF_CS64_MASK;
1030

    
1031
        cpu_x86_set_cpl(env, 0);
1032
        cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
1033
                           0, 0xffffffff,
1034
                               DESC_G_MASK | DESC_P_MASK |
1035
                               DESC_S_MASK |
1036
                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);
1037
        cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
1038
                               0, 0xffffffff,
1039
                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1040
                               DESC_S_MASK |
1041
                               DESC_W_MASK | DESC_A_MASK);
1042
        env->eflags &= ~env->fmask;
1043
        load_eflags(env->eflags, 0);
1044
        if (code64)
1045
            env->eip = env->lstar;
1046
        else
1047
            env->eip = env->cstar;
1048
    } else {
1049
        ECX = (uint32_t)(env->eip + next_eip_addend);
1050

    
1051
        cpu_x86_set_cpl(env, 0);
1052
        cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
1053
                           0, 0xffffffff,
1054
                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1055
                               DESC_S_MASK |
1056
                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
1057
        cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
1058
                               0, 0xffffffff,
1059
                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1060
                               DESC_S_MASK |
1061
                               DESC_W_MASK | DESC_A_MASK);
1062
        env->eflags &= ~(IF_MASK | RF_MASK | VM_MASK);
1063
        env->eip = (uint32_t)env->star;
1064
    }
1065
}
1066
#endif
1067
#endif
1068

    
1069
#ifdef TARGET_X86_64
1070
void helper_sysret(int dflag)
1071
{
1072
    int cpl, selector;
1073

    
1074
    if (!(env->efer & MSR_EFER_SCE)) {
1075
        raise_exception_err(EXCP06_ILLOP, 0);
1076
    }
1077
    cpl = env->hflags & HF_CPL_MASK;
1078
    if (!(env->cr[0] & CR0_PE_MASK) || cpl != 0) {
1079
        raise_exception_err(EXCP0D_GPF, 0);
1080
    }
1081
    selector = (env->star >> 48) & 0xffff;
1082
    if (env->hflags & HF_LMA_MASK) {
1083
        if (dflag == 2) {
1084
            cpu_x86_load_seg_cache(env, R_CS, (selector + 16) | 3,
1085
                                   0, 0xffffffff,
1086
                                   DESC_G_MASK | DESC_P_MASK |
1087
                                   DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1088
                                   DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK |
1089
                                   DESC_L_MASK);
1090
            env->eip = ECX;
1091
        } else {
1092
            cpu_x86_load_seg_cache(env, R_CS, selector | 3,
1093
                                   0, 0xffffffff,
1094
                                   DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1095
                                   DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1096
                                   DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
1097
            env->eip = (uint32_t)ECX;
1098
        }
1099
        cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1100
                               0, 0xffffffff,
1101
                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1102
                               DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1103
                               DESC_W_MASK | DESC_A_MASK);
1104
        load_eflags((uint32_t)(env->regs[11]), TF_MASK | AC_MASK | ID_MASK |
1105
                    IF_MASK | IOPL_MASK | VM_MASK | RF_MASK | NT_MASK);
1106
        cpu_x86_set_cpl(env, 3);
1107
    } else {
1108
        cpu_x86_load_seg_cache(env, R_CS, selector | 3,
1109
                               0, 0xffffffff,
1110
                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1111
                               DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1112
                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
1113
        env->eip = (uint32_t)ECX;
1114
        cpu_x86_load_seg_cache(env, R_SS, selector + 8,
1115
                               0, 0xffffffff,
1116
                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
1117
                               DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
1118
                               DESC_W_MASK | DESC_A_MASK);
1119
        env->eflags |= IF_MASK;
1120
        cpu_x86_set_cpl(env, 3);
1121
    }
1122
#ifdef CONFIG_KQEMU
1123
    if (kqemu_is_ok(env)) {
1124
        if (env->hflags & HF_LMA_MASK)
1125
            CC_OP = CC_OP_EFLAGS;
1126
        env->exception_index = -1;
1127
        cpu_loop_exit();
1128
    }
1129
#endif
1130
}
1131
#endif
1132

    
1133
/* real mode interrupt */
1134
static void do_interrupt_real(int intno, int is_int, int error_code,
1135
                              unsigned int next_eip)
1136
{
1137
    SegmentCache *dt;
1138
    target_ulong ptr, ssp;
1139
    int selector;
1140
    uint32_t offset, esp;
1141
    uint32_t old_cs, old_eip;
1142

    
1143
    /* real mode (simpler !) */
1144
    dt = &env->idt;
1145
    if (intno * 4 + 3 > dt->limit)
1146
        raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
1147
    ptr = dt->base + intno * 4;
1148
    offset = lduw_kernel(ptr);
1149
    selector = lduw_kernel(ptr + 2);
1150
    esp = ESP;
1151
    ssp = env->segs[R_SS].base;
1152
    if (is_int)
1153
        old_eip = next_eip;
1154
    else
1155
        old_eip = env->eip;
1156
    old_cs = env->segs[R_CS].selector;
1157
    /* XXX: use SS segment size ? */
1158
    PUSHW(ssp, esp, 0xffff, compute_eflags());
1159
    PUSHW(ssp, esp, 0xffff, old_cs);
1160
    PUSHW(ssp, esp, 0xffff, old_eip);
1161

    
1162
    /* update processor state */
1163
    ESP = (ESP & ~0xffff) | (esp & 0xffff);
1164
    env->eip = offset;
1165
    env->segs[R_CS].selector = selector;
1166
    env->segs[R_CS].base = (selector << 4);
1167
    env->eflags &= ~(IF_MASK | TF_MASK | AC_MASK | RF_MASK);
1168
}
1169

    
1170
/* fake user mode interrupt */
1171
void do_interrupt_user(int intno, int is_int, int error_code,
1172
                       target_ulong next_eip)
1173
{
1174
    SegmentCache *dt;
1175
    target_ulong ptr;
1176
    int dpl, cpl, shift;
1177
    uint32_t e2;
1178

    
1179
    dt = &env->idt;
1180
    if (env->hflags & HF_LMA_MASK) {
1181
        shift = 4;
1182
    } else {
1183
        shift = 3;
1184
    }
1185
    ptr = dt->base + (intno << shift);
1186
    e2 = ldl_kernel(ptr + 4);
1187

    
1188
    dpl = (e2 >> DESC_DPL_SHIFT) & 3;
1189
    cpl = env->hflags & HF_CPL_MASK;
1190
    /* check privilege if software int */
1191
    if (is_int && dpl < cpl)
1192
        raise_exception_err(EXCP0D_GPF, (intno << shift) + 2);
1193

    
1194
    /* Since we emulate only user space, we cannot do more than
1195
       exiting the emulation with the suitable exception and error
1196
       code */
1197
    if (is_int)
1198
        EIP = next_eip;
1199
}
1200

    
1201
/*
1202
 * Begin execution of an interruption. is_int is TRUE if coming from
1203
 * the int instruction. next_eip is the EIP value AFTER the interrupt
1204
 * instruction. It is only relevant if is_int is TRUE.
1205
 */
1206
void do_interrupt(int intno, int is_int, int error_code,
1207
                  target_ulong next_eip, int is_hw)
1208
{
1209
    if (qemu_loglevel_mask(CPU_LOG_INT)) {
1210
        if ((env->cr[0] & CR0_PE_MASK)) {
1211
            static int count;
1212
            qemu_log("%6d: v=%02x e=%04x i=%d cpl=%d IP=%04x:" TARGET_FMT_lx " pc=" TARGET_FMT_lx " SP=%04x:" TARGET_FMT_lx,
1213
                    count, intno, error_code, is_int,
1214
                    env->hflags & HF_CPL_MASK,
1215
                    env->segs[R_CS].selector, EIP,
1216
                    (int)env->segs[R_CS].base + EIP,
1217
                    env->segs[R_SS].selector, ESP);
1218
            if (intno == 0x0e) {
1219
                qemu_log(" CR2=" TARGET_FMT_lx, env->cr[2]);
1220
            } else {
1221
                qemu_log(" EAX=" TARGET_FMT_lx, EAX);
1222
            }
1223
            qemu_log("\n");
1224
            log_cpu_state(env, X86_DUMP_CCOP);
1225
#if 0
1226
            {
1227
                int i;
1228
                uint8_t *ptr;
1229
                qemu_log("       code=");
1230
                ptr = env->segs[R_CS].base + env->eip;
1231
                for(i = 0; i < 16; i++) {
1232
                    qemu_log(" %02x", ldub(ptr + i));
1233
                }
1234
                qemu_log("\n");
1235
            }
1236
#endif
1237
            count++;
1238
        }
1239
    }
1240
    if (env->cr[0] & CR0_PE_MASK) {
1241
#ifdef TARGET_X86_64
1242
        if (env->hflags & HF_LMA_MASK) {
1243
            do_interrupt64(intno, is_int, error_code, next_eip, is_hw);
1244
        } else
1245
#endif
1246
        {
1247
            do_interrupt_protected(intno, is_int, error_code, next_eip, is_hw);
1248
        }
1249
    } else {
1250
        do_interrupt_real(intno, is_int, error_code, next_eip);
1251
    }
1252
}
1253

    
1254
/* This should come from sysemu.h - if we could include it here... */
1255
void qemu_system_reset_request(void);
1256

    
1257
/*
1258
 * Check nested exceptions and change to double or triple fault if
1259
 * needed. It should only be called, if this is not an interrupt.
1260
 * Returns the new exception number.
1261
 */
1262
static int check_exception(int intno, int *error_code)
1263
{
1264
    int first_contributory = env->old_exception == 0 ||
1265
                              (env->old_exception >= 10 &&
1266
                               env->old_exception <= 13);
1267
    int second_contributory = intno == 0 ||
1268
                               (intno >= 10 && intno <= 13);
1269

    
1270
    qemu_log_mask(CPU_LOG_INT, "check_exception old: 0x%x new 0x%x\n",
1271
                env->old_exception, intno);
1272

    
1273
#if !defined(CONFIG_USER_ONLY)
1274
    if (env->old_exception == EXCP08_DBLE) {
1275
        if (env->hflags & HF_SVMI_MASK)
1276
            helper_vmexit(SVM_EXIT_SHUTDOWN, 0); /* does not return */
1277

    
1278
        qemu_log_mask(CPU_LOG_RESET, "Triple fault\n");
1279

    
1280
        qemu_system_reset_request();
1281
        return EXCP_HLT;
1282
    }
1283
#endif
1284

    
1285
    if ((first_contributory && second_contributory)
1286
        || (env->old_exception == EXCP0E_PAGE &&
1287
            (second_contributory || (intno == EXCP0E_PAGE)))) {
1288
        intno = EXCP08_DBLE;
1289
        *error_code = 0;
1290
    }
1291

    
1292
    if (second_contributory || (intno == EXCP0E_PAGE) ||
1293
        (intno == EXCP08_DBLE))
1294
        env->old_exception = intno;
1295

    
1296
    return intno;
1297
}
1298

    
1299
/*
1300
 * Signal an interruption. It is executed in the main CPU loop.
1301
 * is_int is TRUE if coming from the int instruction. next_eip is the
1302
 * EIP value AFTER the interrupt instruction. It is only relevant if
1303
 * is_int is TRUE.
1304
 */
1305
static void QEMU_NORETURN raise_interrupt(int intno, int is_int, int error_code,
1306
                                          int next_eip_addend)
1307
{
1308
    if (!is_int) {
1309
        helper_svm_check_intercept_param(SVM_EXIT_EXCP_BASE + intno, error_code);
1310
        intno = check_exception(intno, &error_code);
1311
    } else {
1312
        helper_svm_check_intercept_param(SVM_EXIT_SWINT, 0);
1313
    }
1314

    
1315
    env->exception_index = intno;
1316
    env->error_code = error_code;
1317
    env->exception_is_int = is_int;
1318
    env->exception_next_eip = env->eip + next_eip_addend;
1319
    cpu_loop_exit();
1320
}
1321

    
1322
/* shortcuts to generate exceptions */
1323

    
1324
void raise_exception_err(int exception_index, int error_code)
1325
{
1326
    raise_interrupt(exception_index, 0, error_code, 0);
1327
}
1328

    
1329
void raise_exception(int exception_index)
1330
{
1331
    raise_interrupt(exception_index, 0, 0, 0);
1332
}
1333

    
1334
/* SMM support */
1335

    
1336
#if defined(CONFIG_USER_ONLY)
1337

    
1338
void do_smm_enter(void)
1339
{
1340
}
1341

    
1342
void helper_rsm(void)
1343
{
1344
}
1345

    
1346
#else
1347

    
1348
#ifdef TARGET_X86_64
1349
#define SMM_REVISION_ID 0x00020064
1350
#else
1351
#define SMM_REVISION_ID 0x00020000
1352
#endif
1353

    
1354
void do_smm_enter(void)
1355
{
1356
    target_ulong sm_state;
1357
    SegmentCache *dt;
1358
    int i, offset;
1359

    
1360
    qemu_log_mask(CPU_LOG_INT, "SMM: enter\n");
1361
    log_cpu_state_mask(CPU_LOG_INT, env, X86_DUMP_CCOP);
1362

    
1363
    env->hflags |= HF_SMM_MASK;
1364
    cpu_smm_update(env);
1365

    
1366
    sm_state = env->smbase + 0x8000;
1367

    
1368
#ifdef TARGET_X86_64
1369
    for(i = 0; i < 6; i++) {
1370
        dt = &env->segs[i];
1371
        offset = 0x7e00 + i * 16;
1372
        stw_phys(sm_state + offset, dt->selector);
1373
        stw_phys(sm_state + offset + 2, (dt->flags >> 8) & 0xf0ff);
1374
        stl_phys(sm_state + offset + 4, dt->limit);
1375
        stq_phys(sm_state + offset + 8, dt->base);
1376
    }
1377

    
1378
    stq_phys(sm_state + 0x7e68, env->gdt.base);
1379
    stl_phys(sm_state + 0x7e64, env->gdt.limit);
1380

    
1381
    stw_phys(sm_state + 0x7e70, env->ldt.selector);
1382
    stq_phys(sm_state + 0x7e78, env->ldt.base);
1383
    stl_phys(sm_state + 0x7e74, env->ldt.limit);
1384
    stw_phys(sm_state + 0x7e72, (env->ldt.flags >> 8) & 0xf0ff);
1385

    
1386
    stq_phys(sm_state + 0x7e88, env->idt.base);
1387
    stl_phys(sm_state + 0x7e84, env->idt.limit);
1388

    
1389
    stw_phys(sm_state + 0x7e90, env->tr.selector);
1390
    stq_phys(sm_state + 0x7e98, env->tr.base);
1391
    stl_phys(sm_state + 0x7e94, env->tr.limit);
1392
    stw_phys(sm_state + 0x7e92, (env->tr.flags >> 8) & 0xf0ff);
1393

    
1394
    stq_phys(sm_state + 0x7ed0, env->efer);
1395

    
1396
    stq_phys(sm_state + 0x7ff8, EAX);
1397
    stq_phys(sm_state + 0x7ff0, ECX);
1398
    stq_phys(sm_state + 0x7fe8, EDX);
1399
    stq_phys(sm_state + 0x7fe0, EBX);
1400
    stq_phys(sm_state + 0x7fd8, ESP);
1401
    stq_phys(sm_state + 0x7fd0, EBP);
1402
    stq_phys(sm_state + 0x7fc8, ESI);
1403
    stq_phys(sm_state + 0x7fc0, EDI);
1404
    for(i = 8; i < 16; i++)
1405
        stq_phys(sm_state + 0x7ff8 - i * 8, env->regs[i]);
1406
    stq_phys(sm_state + 0x7f78, env->eip);
1407
    stl_phys(sm_state + 0x7f70, compute_eflags());
1408
    stl_phys(sm_state + 0x7f68, env->dr[6]);
1409
    stl_phys(sm_state + 0x7f60, env->dr[7]);
1410

    
1411
    stl_phys(sm_state + 0x7f48, env->cr[4]);
1412
    stl_phys(sm_state + 0x7f50, env->cr[3]);
1413
    stl_phys(sm_state + 0x7f58, env->cr[0]);
1414

    
1415
    stl_phys(sm_state + 0x7efc, SMM_REVISION_ID);
1416
    stl_phys(sm_state + 0x7f00, env->smbase);
1417
#else
1418
    stl_phys(sm_state + 0x7ffc, env->cr[0]);
1419
    stl_phys(sm_state + 0x7ff8, env->cr[3]);
1420
    stl_phys(sm_state + 0x7ff4, compute_eflags());
1421
    stl_phys(sm_state + 0x7ff0, env->eip);
1422
    stl_phys(sm_state + 0x7fec, EDI);
1423
    stl_phys(sm_state + 0x7fe8, ESI);
1424
    stl_phys(sm_state + 0x7fe4, EBP);
1425
    stl_phys(sm_state + 0x7fe0, ESP);
1426
    stl_phys(sm_state + 0x7fdc, EBX);
1427
    stl_phys(sm_state + 0x7fd8, EDX);
1428
    stl_phys(sm_state + 0x7fd4, ECX);
1429
    stl_phys(sm_state + 0x7fd0, EAX);
1430
    stl_phys(sm_state + 0x7fcc, env->dr[6]);
1431
    stl_phys(sm_state + 0x7fc8, env->dr[7]);
1432

    
1433
    stl_phys(sm_state + 0x7fc4, env->tr.selector);
1434
    stl_phys(sm_state + 0x7f64, env->tr.base);
1435
    stl_phys(sm_state + 0x7f60, env->tr.limit);
1436
    stl_phys(sm_state + 0x7f5c, (env->tr.flags >> 8) & 0xf0ff);
1437

    
1438
    stl_phys(sm_state + 0x7fc0, env->ldt.selector);
1439
    stl_phys(sm_state + 0x7f80, env->ldt.base);
1440
    stl_phys(sm_state + 0x7f7c, env->ldt.limit);
1441
    stl_phys(sm_state + 0x7f78, (env->ldt.flags >> 8) & 0xf0ff);
1442

    
1443
    stl_phys(sm_state + 0x7f74, env->gdt.base);
1444
    stl_phys(sm_state + 0x7f70, env->gdt.limit);
1445

    
1446
    stl_phys(sm_state + 0x7f58, env->idt.base);
1447
    stl_phys(sm_state + 0x7f54, env->idt.limit);
1448

    
1449
    for(i = 0; i < 6; i++) {
1450
        dt = &env->segs[i];
1451
        if (i < 3)
1452
            offset = 0x7f84 + i * 12;
1453
        else
1454
            offset = 0x7f2c + (i - 3) * 12;
1455
        stl_phys(sm_state + 0x7fa8 + i * 4, dt->selector);
1456
        stl_phys(sm_state + offset + 8, dt->base);
1457
        stl_phys(sm_state + offset + 4, dt->limit);
1458
        stl_phys(sm_state + offset, (dt->flags >> 8) & 0xf0ff);
1459
    }
1460
    stl_phys(sm_state + 0x7f14, env->cr[4]);
1461

    
1462
    stl_phys(sm_state + 0x7efc, SMM_REVISION_ID);
1463
    stl_phys(sm_state + 0x7ef8, env->smbase);
1464
#endif
1465
    /* init SMM cpu state */
1466

    
1467
#ifdef TARGET_X86_64
1468
    cpu_load_efer(env, 0);
1469
#endif
1470
    load_eflags(0, ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
1471
    env->eip = 0x00008000;
1472
    cpu_x86_load_seg_cache(env, R_CS, (env->smbase >> 4) & 0xffff, env->smbase,
1473
                           0xffffffff, 0);
1474
    cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0xffffffff, 0);
1475
    cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0xffffffff, 0);
1476
    cpu_x86_load_seg_cache(env, R_SS, 0, 0, 0xffffffff, 0);
1477
    cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0xffffffff, 0);
1478
    cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0xffffffff, 0);
1479

    
1480
    cpu_x86_update_cr0(env,
1481
                       env->cr[0] & ~(CR0_PE_MASK | CR0_EM_MASK | CR0_TS_MASK | CR0_PG_MASK));
1482
    cpu_x86_update_cr4(env, 0);
1483
    env->dr[7] = 0x00000400;
1484
    CC_OP = CC_OP_EFLAGS;
1485
}
1486

    
1487
void helper_rsm(void)
1488
{
1489
    target_ulong sm_state;
1490
    int i, offset;
1491
    uint32_t val;
1492

    
1493
    sm_state = env->smbase + 0x8000;
1494
#ifdef TARGET_X86_64
1495
    cpu_load_efer(env, ldq_phys(sm_state + 0x7ed0));
1496

    
1497
    for(i = 0; i < 6; i++) {
1498
        offset = 0x7e00 + i * 16;
1499
        cpu_x86_load_seg_cache(env, i,
1500
                               lduw_phys(sm_state + offset),
1501
                               ldq_phys(sm_state + offset + 8),
1502
                               ldl_phys(sm_state + offset + 4),
1503
                               (lduw_phys(sm_state + offset + 2) & 0xf0ff) << 8);
1504
    }
1505

    
1506
    env->gdt.base = ldq_phys(sm_state + 0x7e68);
1507
    env->gdt.limit = ldl_phys(sm_state + 0x7e64);
1508

    
1509
    env->ldt.selector = lduw_phys(sm_state + 0x7e70);
1510
    env->ldt.base = ldq_phys(sm_state + 0x7e78);
1511
    env->ldt.limit = ldl_phys(sm_state + 0x7e74);
1512
    env->ldt.flags = (lduw_phys(sm_state + 0x7e72) & 0xf0ff) << 8;
1513

    
1514
    env->idt.base = ldq_phys(sm_state + 0x7e88);
1515
    env->idt.limit = ldl_phys(sm_state + 0x7e84);
1516

    
1517
    env->tr.selector = lduw_phys(sm_state + 0x7e90);
1518
    env->tr.base = ldq_phys(sm_state + 0x7e98);
1519
    env->tr.limit = ldl_phys(sm_state + 0x7e94);
1520
    env->tr.flags = (lduw_phys(sm_state + 0x7e92) & 0xf0ff) << 8;
1521

    
1522
    EAX = ldq_phys(sm_state + 0x7ff8);
1523
    ECX = ldq_phys(sm_state + 0x7ff0);
1524
    EDX = ldq_phys(sm_state + 0x7fe8);
1525
    EBX = ldq_phys(sm_state + 0x7fe0);
1526
    ESP = ldq_phys(sm_state + 0x7fd8);
1527
    EBP = ldq_phys(sm_state + 0x7fd0);
1528
    ESI = ldq_phys(sm_state + 0x7fc8);
1529
    EDI = ldq_phys(sm_state + 0x7fc0);
1530
    for(i = 8; i < 16; i++)
1531
        env->regs[i] = ldq_phys(sm_state + 0x7ff8 - i * 8);
1532
    env->eip = ldq_phys(sm_state + 0x7f78);
1533
    load_eflags(ldl_phys(sm_state + 0x7f70),
1534
                ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
1535
    env->dr[6] = ldl_phys(sm_state + 0x7f68);
1536
    env->dr[7] = ldl_phys(sm_state + 0x7f60);
1537

    
1538
    cpu_x86_update_cr4(env, ldl_phys(sm_state + 0x7f48));
1539
    cpu_x86_update_cr3(env, ldl_phys(sm_state + 0x7f50));
1540
    cpu_x86_update_cr0(env, ldl_phys(sm_state + 0x7f58));
1541

    
1542
    val = ldl_phys(sm_state + 0x7efc); /* revision ID */
1543
    if (val & 0x20000) {
1544
        env->smbase = ldl_phys(sm_state + 0x7f00) & ~0x7fff;
1545
    }
1546
#else
1547
    cpu_x86_update_cr0(env, ldl_phys(sm_state + 0x7ffc));
1548
    cpu_x86_update_cr3(env, ldl_phys(sm_state + 0x7ff8));
1549
    load_eflags(ldl_phys(sm_state + 0x7ff4),
1550
                ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
1551
    env->eip = ldl_phys(sm_state + 0x7ff0);
1552
    EDI = ldl_phys(sm_state + 0x7fec);
1553
    ESI = ldl_phys(sm_state + 0x7fe8);
1554
    EBP = ldl_phys(sm_state + 0x7fe4);
1555
    ESP = ldl_phys(sm_state + 0x7fe0);
1556
    EBX = ldl_phys(sm_state + 0x7fdc);
1557
    EDX = ldl_phys(sm_state + 0x7fd8);
1558
    ECX = ldl_phys(sm_state + 0x7fd4);
1559
    EAX = ldl_phys(sm_state + 0x7fd0);
1560
    env->dr[6] = ldl_phys(sm_state + 0x7fcc);
1561
    env->dr[7] = ldl_phys(sm_state + 0x7fc8);
1562

    
1563
    env->tr.selector = ldl_phys(sm_state + 0x7fc4) & 0xffff;
1564
    env->tr.base = ldl_phys(sm_state + 0x7f64);
1565
    env->tr.limit = ldl_phys(sm_state + 0x7f60);
1566
    env->tr.flags = (ldl_phys(sm_state + 0x7f5c) & 0xf0ff) << 8;
1567

    
1568
    env->ldt.selector = ldl_phys(sm_state + 0x7fc0) & 0xffff;
1569
    env->ldt.base = ldl_phys(sm_state + 0x7f80);
1570
    env->ldt.limit = ldl_phys(sm_state + 0x7f7c);
1571
    env->ldt.flags = (ldl_phys(sm_state + 0x7f78) & 0xf0ff) << 8;
1572

    
1573
    env->gdt.base = ldl_phys(sm_state + 0x7f74);
1574
    env->gdt.limit = ldl_phys(sm_state + 0x7f70);
1575

    
1576
    env->idt.base = ldl_phys(sm_state + 0x7f58);
1577
    env->idt.limit = ldl_phys(sm_state + 0x7f54);
1578

    
1579
    for(i = 0; i < 6; i++) {
1580
        if (i < 3)
1581
            offset = 0x7f84 + i * 12;
1582
        else
1583
            offset = 0x7f2c + (i - 3) * 12;
1584
        cpu_x86_load_seg_cache(env, i,
1585
                               ldl_phys(sm_state + 0x7fa8 + i * 4) & 0xffff,
1586
                               ldl_phys(sm_state + offset + 8),
1587
                               ldl_phys(sm_state + offset + 4),
1588
                               (ldl_phys(sm_state + offset) & 0xf0ff) << 8);
1589
    }
1590
    cpu_x86_update_cr4(env, ldl_phys(sm_state + 0x7f14));
1591

    
1592
    val = ldl_phys(sm_state + 0x7efc); /* revision ID */
1593
    if (val & 0x20000) {
1594
        env->smbase = ldl_phys(sm_state + 0x7ef8) & ~0x7fff;
1595
    }
1596
#endif
1597
    CC_OP = CC_OP_EFLAGS;
1598
    env->hflags &= ~HF_SMM_MASK;
1599
    cpu_smm_update(env);
1600

    
1601
    qemu_log_mask(CPU_LOG_INT, "SMM: after RSM\n");
1602
    log_cpu_state_mask(CPU_LOG_INT, env, X86_DUMP_CCOP);
1603
}
1604

    
1605
#endif /* !CONFIG_USER_ONLY */
1606

    
1607

    
1608
/* division, flags are undefined */
1609

    
1610
void helper_divb_AL(target_ulong t0)
1611
{
1612
    unsigned int num, den, q, r;
1613

    
1614
    num = (EAX & 0xffff);
1615
    den = (t0 & 0xff);
1616
    if (den == 0) {
1617
        raise_exception(EXCP00_DIVZ);
1618
    }
1619
    q = (num / den);
1620
    if (q > 0xff)
1621
        raise_exception(EXCP00_DIVZ);
1622
    q &= 0xff;
1623
    r = (num % den) & 0xff;
1624
    EAX = (EAX & ~0xffff) | (r << 8) | q;
1625
}
1626

    
1627
void helper_idivb_AL(target_ulong t0)
1628
{
1629
    int num, den, q, r;
1630

    
1631
    num = (int16_t)EAX;
1632
    den = (int8_t)t0;
1633
    if (den == 0) {
1634
        raise_exception(EXCP00_DIVZ);
1635
    }
1636
    q = (num / den);
1637
    if (q != (int8_t)q)
1638
        raise_exception(EXCP00_DIVZ);
1639
    q &= 0xff;
1640
    r = (num % den) & 0xff;
1641
    EAX = (EAX & ~0xffff) | (r << 8) | q;
1642
}
1643

    
1644
void helper_divw_AX(target_ulong t0)
1645
{
1646
    unsigned int num, den, q, r;
1647

    
1648
    num = (EAX & 0xffff) | ((EDX & 0xffff) << 16);
1649
    den = (t0 & 0xffff);
1650
    if (den == 0) {
1651
        raise_exception(EXCP00_DIVZ);
1652
    }
1653
    q = (num / den);
1654
    if (q > 0xffff)
1655
        raise_exception(EXCP00_DIVZ);
1656
    q &= 0xffff;
1657
    r = (num % den) & 0xffff;
1658
    EAX = (EAX & ~0xffff) | q;
1659
    EDX = (EDX & ~0xffff) | r;
1660
}
1661

    
1662
void helper_idivw_AX(target_ulong t0)
1663
{
1664
    int num, den, q, r;
1665

    
1666
    num = (EAX & 0xffff) | ((EDX & 0xffff) << 16);
1667
    den = (int16_t)t0;
1668
    if (den == 0) {
1669
        raise_exception(EXCP00_DIVZ);
1670
    }
1671
    q = (num / den);
1672
    if (q != (int16_t)q)
1673
        raise_exception(EXCP00_DIVZ);
1674
    q &= 0xffff;
1675
    r = (num % den) & 0xffff;
1676
    EAX = (EAX & ~0xffff) | q;
1677
    EDX = (EDX & ~0xffff) | r;
1678
}
1679

    
1680
void helper_divl_EAX(target_ulong t0)
1681
{
1682
    unsigned int den, r;
1683
    uint64_t num, q;
1684

    
1685
    num = ((uint32_t)EAX) | ((uint64_t)((uint32_t)EDX) << 32);
1686
    den = t0;
1687
    if (den == 0) {
1688
        raise_exception(EXCP00_DIVZ);
1689
    }
1690
    q = (num / den);
1691
    r = (num % den);
1692
    if (q > 0xffffffff)
1693
        raise_exception(EXCP00_DIVZ);
1694
    EAX = (uint32_t)q;
1695
    EDX = (uint32_t)r;
1696
}
1697

    
1698
void helper_idivl_EAX(target_ulong t0)
1699
{
1700
    int den, r;
1701
    int64_t num, q;
1702

    
1703
    num = ((uint32_t)EAX) | ((uint64_t)((uint32_t)EDX) << 32);
1704
    den = t0;
1705
    if (den == 0) {
1706
        raise_exception(EXCP00_DIVZ);
1707
    }
1708
    q = (num / den);
1709
    r = (num % den);
1710
    if (q != (int32_t)q)
1711
        raise_exception(EXCP00_DIVZ);
1712
    EAX = (uint32_t)q;
1713
    EDX = (uint32_t)r;
1714
}
1715

    
1716
/* bcd */
1717

    
1718
/* XXX: exception */
1719
void helper_aam(int base)
1720
{
1721
    int al, ah;
1722
    al = EAX & 0xff;
1723
    ah = al / base;
1724
    al = al % base;
1725
    EAX = (EAX & ~0xffff) | al | (ah << 8);
1726
    CC_DST = al;
1727
}
1728

    
1729
void helper_aad(int base)
1730
{
1731
    int al, ah;
1732
    al = EAX & 0xff;
1733
    ah = (EAX >> 8) & 0xff;
1734
    al = ((ah * base) + al) & 0xff;
1735
    EAX = (EAX & ~0xffff) | al;
1736
    CC_DST = al;
1737
}
1738

    
1739
void helper_aaa(void)
1740
{
1741
    int icarry;
1742
    int al, ah, af;
1743
    int eflags;
1744

    
1745
    eflags = helper_cc_compute_all(CC_OP);
1746
    af = eflags & CC_A;
1747
    al = EAX & 0xff;
1748
    ah = (EAX >> 8) & 0xff;
1749

    
1750
    icarry = (al > 0xf9);
1751
    if (((al & 0x0f) > 9 ) || af) {
1752
        al = (al + 6) & 0x0f;
1753
        ah = (ah + 1 + icarry) & 0xff;
1754
        eflags |= CC_C | CC_A;
1755
    } else {
1756
        eflags &= ~(CC_C | CC_A);
1757
        al &= 0x0f;
1758
    }
1759
    EAX = (EAX & ~0xffff) | al | (ah << 8);
1760
    CC_SRC = eflags;
1761
}
1762

    
1763
void helper_aas(void)
1764
{
1765
    int icarry;
1766
    int al, ah, af;
1767
    int eflags;
1768

    
1769
    eflags = helper_cc_compute_all(CC_OP);
1770
    af = eflags & CC_A;
1771
    al = EAX & 0xff;
1772
    ah = (EAX >> 8) & 0xff;
1773

    
1774
    icarry = (al < 6);
1775
    if (((al & 0x0f) > 9 ) || af) {
1776
        al = (al - 6) & 0x0f;
1777
        ah = (ah - 1 - icarry) & 0xff;
1778
        eflags |= CC_C | CC_A;
1779
    } else {
1780
        eflags &= ~(CC_C | CC_A);
1781
        al &= 0x0f;
1782
    }
1783
    EAX = (EAX & ~0xffff) | al | (ah << 8);
1784
    CC_SRC = eflags;
1785
}
1786

    
1787
void helper_daa(void)
1788
{
1789
    int al, af, cf;
1790
    int eflags;
1791

    
1792
    eflags = helper_cc_compute_all(CC_OP);
1793
    cf = eflags & CC_C;
1794
    af = eflags & CC_A;
1795
    al = EAX & 0xff;
1796

    
1797
    eflags = 0;
1798
    if (((al & 0x0f) > 9 ) || af) {
1799
        al = (al + 6) & 0xff;
1800
        eflags |= CC_A;
1801
    }
1802
    if ((al > 0x9f) || cf) {
1803
        al = (al + 0x60) & 0xff;
1804
        eflags |= CC_C;
1805
    }
1806
    EAX = (EAX & ~0xff) | al;
1807
    /* well, speed is not an issue here, so we compute the flags by hand */
1808
    eflags |= (al == 0) << 6; /* zf */
1809
    eflags |= parity_table[al]; /* pf */
1810
    eflags |= (al & 0x80); /* sf */
1811
    CC_SRC = eflags;
1812
}
1813

    
1814
void helper_das(void)
1815
{
1816
    int al, al1, af, cf;
1817
    int eflags;
1818

    
1819
    eflags = helper_cc_compute_all(CC_OP);
1820
    cf = eflags & CC_C;
1821
    af = eflags & CC_A;
1822
    al = EAX & 0xff;
1823

    
1824
    eflags = 0;
1825
    al1 = al;
1826
    if (((al & 0x0f) > 9 ) || af) {
1827
        eflags |= CC_A;
1828
        if (al < 6 || cf)
1829
            eflags |= CC_C;
1830
        al = (al - 6) & 0xff;
1831
    }
1832
    if ((al1 > 0x99) || cf) {
1833
        al = (al - 0x60) & 0xff;
1834
        eflags |= CC_C;
1835
    }
1836
    EAX = (EAX & ~0xff) | al;
1837
    /* well, speed is not an issue here, so we compute the flags by hand */
1838
    eflags |= (al == 0) << 6; /* zf */
1839
    eflags |= parity_table[al]; /* pf */
1840
    eflags |= (al & 0x80); /* sf */
1841
    CC_SRC = eflags;
1842
}
1843

    
1844
void helper_into(int next_eip_addend)
1845
{
1846
    int eflags;
1847
    eflags = helper_cc_compute_all(CC_OP);
1848
    if (eflags & CC_O) {
1849
        raise_interrupt(EXCP04_INTO, 1, 0, next_eip_addend);
1850
    }
1851
}
1852

    
1853
void helper_cmpxchg8b(target_ulong a0)
1854
{
1855
    uint64_t d;
1856
    int eflags;
1857

    
1858
    eflags = helper_cc_compute_all(CC_OP);
1859
    d = ldq(a0);
1860
    if (d == (((uint64_t)EDX << 32) | (uint32_t)EAX)) {
1861
        stq(a0, ((uint64_t)ECX << 32) | (uint32_t)EBX);
1862
        eflags |= CC_Z;
1863
    } else {
1864
        /* always do the store */
1865
        stq(a0, d); 
1866
        EDX = (uint32_t)(d >> 32);
1867
        EAX = (uint32_t)d;
1868
        eflags &= ~CC_Z;
1869
    }
1870
    CC_SRC = eflags;
1871
}
1872

    
1873
#ifdef TARGET_X86_64
1874
void helper_cmpxchg16b(target_ulong a0)
1875
{
1876
    uint64_t d0, d1;
1877
    int eflags;
1878

    
1879
    if ((a0 & 0xf) != 0)
1880
        raise_exception(EXCP0D_GPF);
1881
    eflags = helper_cc_compute_all(CC_OP);
1882
    d0 = ldq(a0);
1883
    d1 = ldq(a0 + 8);
1884
    if (d0 == EAX && d1 == EDX) {
1885
        stq(a0, EBX);
1886
        stq(a0 + 8, ECX);
1887
        eflags |= CC_Z;
1888
    } else {
1889
        /* always do the store */
1890
        stq(a0, d0); 
1891
        stq(a0 + 8, d1); 
1892
        EDX = d1;
1893
        EAX = d0;
1894
        eflags &= ~CC_Z;
1895
    }
1896
    CC_SRC = eflags;
1897
}
1898
#endif
1899

    
1900
void helper_single_step(void)
1901
{
1902
#ifndef CONFIG_USER_ONLY
1903
    check_hw_breakpoints(env, 1);
1904
    env->dr[6] |= DR6_BS;
1905
#endif
1906
    raise_exception(EXCP01_DB);
1907
}
1908

    
1909
void helper_cpuid(void)
1910
{
1911
    uint32_t eax, ebx, ecx, edx;
1912

    
1913
    helper_svm_check_intercept_param(SVM_EXIT_CPUID, 0);
1914

    
1915
    cpu_x86_cpuid(env, (uint32_t)EAX, (uint32_t)ECX, &eax, &ebx, &ecx, &edx);
1916
    EAX = eax;
1917
    EBX = ebx;
1918
    ECX = ecx;
1919
    EDX = edx;
1920
}
1921

    
1922
void helper_enter_level(int level, int data32, target_ulong t1)
1923
{
1924
    target_ulong ssp;
1925
    uint32_t esp_mask, esp, ebp;
1926

    
1927
    esp_mask = get_sp_mask(env->segs[R_SS].flags);
1928
    ssp = env->segs[R_SS].base;
1929
    ebp = EBP;
1930
    esp = ESP;
1931
    if (data32) {
1932
        /* 32 bit */
1933
        esp -= 4;
1934
        while (--level) {
1935
            esp -= 4;
1936
            ebp -= 4;
1937
            stl(ssp + (esp & esp_mask), ldl(ssp + (ebp & esp_mask)));
1938
        }
1939
        esp -= 4;
1940
        stl(ssp + (esp & esp_mask), t1);
1941
    } else {
1942
        /* 16 bit */
1943
        esp -= 2;
1944
        while (--level) {
1945
            esp -= 2;
1946
            ebp -= 2;
1947
            stw(ssp + (esp & esp_mask), lduw(ssp + (ebp & esp_mask)));
1948
        }
1949
        esp -= 2;
1950
        stw(ssp + (esp & esp_mask), t1);
1951
    }
1952
}
1953

    
1954
#ifdef TARGET_X86_64
1955
void helper_enter64_level(int level, int data64, target_ulong t1)
1956
{
1957
    target_ulong esp, ebp;
1958
    ebp = EBP;
1959
    esp = ESP;
1960

    
1961
    if (data64) {
1962
        /* 64 bit */
1963
        esp -= 8;
1964
        while (--level) {
1965
            esp -= 8;
1966
            ebp -= 8;
1967
            stq(esp, ldq(ebp));
1968
        }
1969
        esp -= 8;
1970
        stq(esp, t1);
1971
    } else {
1972
        /* 16 bit */
1973
        esp -= 2;
1974
        while (--level) {
1975
            esp -= 2;
1976
            ebp -= 2;
1977
            stw(esp, lduw(ebp));
1978
        }
1979
        esp -= 2;
1980
        stw(esp, t1);
1981
    }
1982
}
1983
#endif
1984

    
1985
void helper_lldt(int selector)
1986
{
1987
    SegmentCache *dt;
1988
    uint32_t e1, e2;
1989
    int index, entry_limit;
1990
    target_ulong ptr;
1991

    
1992
    selector &= 0xffff;
1993
    if ((selector & 0xfffc) == 0) {
1994
        /* XXX: NULL selector case: invalid LDT */
1995
        env->ldt.base = 0;
1996
        env->ldt.limit = 0;
1997
    } else {
1998
        if (selector & 0x4)
1999
            raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2000
        dt = &env->gdt;
2001
        index = selector & ~7;
2002
#ifdef TARGET_X86_64
2003
        if (env->hflags & HF_LMA_MASK)
2004
            entry_limit = 15;
2005
        else
2006
#endif
2007
            entry_limit = 7;
2008
        if ((index + entry_limit) > dt->limit)
2009
            raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2010
        ptr = dt->base + index;
2011
        e1 = ldl_kernel(ptr);
2012
        e2 = ldl_kernel(ptr + 4);
2013
        if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2)
2014
            raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2015
        if (!(e2 & DESC_P_MASK))
2016
            raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2017
#ifdef TARGET_X86_64
2018
        if (env->hflags & HF_LMA_MASK) {
2019
            uint32_t e3;
2020
            e3 = ldl_kernel(ptr + 8);
2021
            load_seg_cache_raw_dt(&env->ldt, e1, e2);
2022
            env->ldt.base |= (target_ulong)e3 << 32;
2023
        } else
2024
#endif
2025
        {
2026
            load_seg_cache_raw_dt(&env->ldt, e1, e2);
2027
        }
2028
    }
2029
    env->ldt.selector = selector;
2030
}
2031

    
2032
void helper_ltr(int selector)
2033
{
2034
    SegmentCache *dt;
2035
    uint32_t e1, e2;
2036
    int index, type, entry_limit;
2037
    target_ulong ptr;
2038

    
2039
    selector &= 0xffff;
2040
    if ((selector & 0xfffc) == 0) {
2041
        /* NULL selector case: invalid TR */
2042
        env->tr.base = 0;
2043
        env->tr.limit = 0;
2044
        env->tr.flags = 0;
2045
    } else {
2046
        if (selector & 0x4)
2047
            raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2048
        dt = &env->gdt;
2049
        index = selector & ~7;
2050
#ifdef TARGET_X86_64
2051
        if (env->hflags & HF_LMA_MASK)
2052
            entry_limit = 15;
2053
        else
2054
#endif
2055
            entry_limit = 7;
2056
        if ((index + entry_limit) > dt->limit)
2057
            raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2058
        ptr = dt->base + index;
2059
        e1 = ldl_kernel(ptr);
2060
        e2 = ldl_kernel(ptr + 4);
2061
        type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2062
        if ((e2 & DESC_S_MASK) ||
2063
            (type != 1 && type != 9))
2064
            raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2065
        if (!(e2 & DESC_P_MASK))
2066
            raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2067
#ifdef TARGET_X86_64
2068
        if (env->hflags & HF_LMA_MASK) {
2069
            uint32_t e3, e4;
2070
            e3 = ldl_kernel(ptr + 8);
2071
            e4 = ldl_kernel(ptr + 12);
2072
            if ((e4 >> DESC_TYPE_SHIFT) & 0xf)
2073
                raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2074
            load_seg_cache_raw_dt(&env->tr, e1, e2);
2075
            env->tr.base |= (target_ulong)e3 << 32;
2076
        } else
2077
#endif
2078
        {
2079
            load_seg_cache_raw_dt(&env->tr, e1, e2);
2080
        }
2081
        e2 |= DESC_TSS_BUSY_MASK;
2082
        stl_kernel(ptr + 4, e2);
2083
    }
2084
    env->tr.selector = selector;
2085
}
2086

    
2087
/* only works if protected mode and not VM86. seg_reg must be != R_CS */
2088
void helper_load_seg(int seg_reg, int selector)
2089
{
2090
    uint32_t e1, e2;
2091
    int cpl, dpl, rpl;
2092
    SegmentCache *dt;
2093
    int index;
2094
    target_ulong ptr;
2095

    
2096
    selector &= 0xffff;
2097
    cpl = env->hflags & HF_CPL_MASK;
2098
    if ((selector & 0xfffc) == 0) {
2099
        /* null selector case */
2100
        if (seg_reg == R_SS
2101
#ifdef TARGET_X86_64
2102
            && (!(env->hflags & HF_CS64_MASK) || cpl == 3)
2103
#endif
2104
            )
2105
            raise_exception_err(EXCP0D_GPF, 0);
2106
        cpu_x86_load_seg_cache(env, seg_reg, selector, 0, 0, 0);
2107
    } else {
2108

    
2109
        if (selector & 0x4)
2110
            dt = &env->ldt;
2111
        else
2112
            dt = &env->gdt;
2113
        index = selector & ~7;
2114
        if ((index + 7) > dt->limit)
2115
            raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2116
        ptr = dt->base + index;
2117
        e1 = ldl_kernel(ptr);
2118
        e2 = ldl_kernel(ptr + 4);
2119

    
2120
        if (!(e2 & DESC_S_MASK))
2121
            raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2122
        rpl = selector & 3;
2123
        dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2124
        if (seg_reg == R_SS) {
2125
            /* must be writable segment */
2126
            if ((e2 & DESC_CS_MASK) || !(e2 & DESC_W_MASK))
2127
                raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2128
            if (rpl != cpl || dpl != cpl)
2129
                raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2130
        } else {
2131
            /* must be readable segment */
2132
            if ((e2 & (DESC_CS_MASK | DESC_R_MASK)) == DESC_CS_MASK)
2133
                raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2134

    
2135
            if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) {
2136
                /* if not conforming code, test rights */
2137
                if (dpl < cpl || dpl < rpl)
2138
                    raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2139
            }
2140
        }
2141

    
2142
        if (!(e2 & DESC_P_MASK)) {
2143
            if (seg_reg == R_SS)
2144
                raise_exception_err(EXCP0C_STACK, selector & 0xfffc);
2145
            else
2146
                raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2147
        }
2148

    
2149
        /* set the access bit if not already set */
2150
        if (!(e2 & DESC_A_MASK)) {
2151
            e2 |= DESC_A_MASK;
2152
            stl_kernel(ptr + 4, e2);
2153
        }
2154

    
2155
        cpu_x86_load_seg_cache(env, seg_reg, selector,
2156
                       get_seg_base(e1, e2),
2157
                       get_seg_limit(e1, e2),
2158
                       e2);
2159
#if 0
2160
        qemu_log("load_seg: sel=0x%04x base=0x%08lx limit=0x%08lx flags=%08x\n",
2161
                selector, (unsigned long)sc->base, sc->limit, sc->flags);
2162
#endif
2163
    }
2164
}
2165

    
2166
/* protected mode jump */
2167
void helper_ljmp_protected(int new_cs, target_ulong new_eip,
2168
                           int next_eip_addend)
2169
{
2170
    int gate_cs, type;
2171
    uint32_t e1, e2, cpl, dpl, rpl, limit;
2172
    target_ulong next_eip;
2173

    
2174
    if ((new_cs & 0xfffc) == 0)
2175
        raise_exception_err(EXCP0D_GPF, 0);
2176
    if (load_segment(&e1, &e2, new_cs) != 0)
2177
        raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2178
    cpl = env->hflags & HF_CPL_MASK;
2179
    if (e2 & DESC_S_MASK) {
2180
        if (!(e2 & DESC_CS_MASK))
2181
            raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2182
        dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2183
        if (e2 & DESC_C_MASK) {
2184
            /* conforming code segment */
2185
            if (dpl > cpl)
2186
                raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2187
        } else {
2188
            /* non conforming code segment */
2189
            rpl = new_cs & 3;
2190
            if (rpl > cpl)
2191
                raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2192
            if (dpl != cpl)
2193
                raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2194
        }
2195
        if (!(e2 & DESC_P_MASK))
2196
            raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2197
        limit = get_seg_limit(e1, e2);
2198
        if (new_eip > limit &&
2199
            !(env->hflags & HF_LMA_MASK) && !(e2 & DESC_L_MASK))
2200
            raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2201
        cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
2202
                       get_seg_base(e1, e2), limit, e2);
2203
        EIP = new_eip;
2204
    } else {
2205
        /* jump to call or task gate */
2206
        dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2207
        rpl = new_cs & 3;
2208
        cpl = env->hflags & HF_CPL_MASK;
2209
        type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
2210
        switch(type) {
2211
        case 1: /* 286 TSS */
2212
        case 9: /* 386 TSS */
2213
        case 5: /* task gate */
2214
            if (dpl < cpl || dpl < rpl)
2215
                raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2216
            next_eip = env->eip + next_eip_addend;
2217
            switch_tss(new_cs, e1, e2, SWITCH_TSS_JMP, next_eip);
2218
            CC_OP = CC_OP_EFLAGS;
2219
            break;
2220
        case 4: /* 286 call gate */
2221
        case 12: /* 386 call gate */
2222
            if ((dpl < cpl) || (dpl < rpl))
2223
                raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2224
            if (!(e2 & DESC_P_MASK))
2225
                raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2226
            gate_cs = e1 >> 16;
2227
            new_eip = (e1 & 0xffff);
2228
            if (type == 12)
2229
                new_eip |= (e2 & 0xffff0000);
2230
            if (load_segment(&e1, &e2, gate_cs) != 0)
2231
                raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2232
            dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2233
            /* must be code segment */
2234
            if (((e2 & (DESC_S_MASK | DESC_CS_MASK)) !=
2235
                 (DESC_S_MASK | DESC_CS_MASK)))
2236
                raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2237
            if (((e2 & DESC_C_MASK) && (dpl > cpl)) ||
2238
                (!(e2 & DESC_C_MASK) && (dpl != cpl)))
2239
                raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2240
            if (!(e2 & DESC_P_MASK))
2241
                raise_exception_err(EXCP0D_GPF, gate_cs & 0xfffc);
2242
            limit = get_seg_limit(e1, e2);
2243
            if (new_eip > limit)
2244
                raise_exception_err(EXCP0D_GPF, 0);
2245
            cpu_x86_load_seg_cache(env, R_CS, (gate_cs & 0xfffc) | cpl,
2246
                                   get_seg_base(e1, e2), limit, e2);
2247
            EIP = new_eip;
2248
            break;
2249
        default:
2250
            raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2251
            break;
2252
        }
2253
    }
2254
}
2255

    
2256
/* real mode call */
2257
void helper_lcall_real(int new_cs, target_ulong new_eip1,
2258
                       int shift, int next_eip)
2259
{
2260
    int new_eip;
2261
    uint32_t esp, esp_mask;
2262
    target_ulong ssp;
2263

    
2264
    new_eip = new_eip1;
2265
    esp = ESP;
2266
    esp_mask = get_sp_mask(env->segs[R_SS].flags);
2267
    ssp = env->segs[R_SS].base;
2268
    if (shift) {
2269
        PUSHL(ssp, esp, esp_mask, env->segs[R_CS].selector);
2270
        PUSHL(ssp, esp, esp_mask, next_eip);
2271
    } else {
2272
        PUSHW(ssp, esp, esp_mask, env->segs[R_CS].selector);
2273
        PUSHW(ssp, esp, esp_mask, next_eip);
2274
    }
2275

    
2276
    SET_ESP(esp, esp_mask);
2277
    env->eip = new_eip;
2278
    env->segs[R_CS].selector = new_cs;
2279
    env->segs[R_CS].base = (new_cs << 4);
2280
}
2281

    
2282
/* protected mode call */
2283
void helper_lcall_protected(int new_cs, target_ulong new_eip, 
2284
                            int shift, int next_eip_addend)
2285
{
2286
    int new_stack, i;
2287
    uint32_t e1, e2, cpl, dpl, rpl, selector, offset, param_count;
2288
    uint32_t ss = 0, ss_e1 = 0, ss_e2 = 0, sp, type, ss_dpl, sp_mask;
2289
    uint32_t val, limit, old_sp_mask;
2290
    target_ulong ssp, old_ssp, next_eip;
2291

    
2292
    next_eip = env->eip + next_eip_addend;
2293
    LOG_PCALL("lcall %04x:%08x s=%d\n", new_cs, (uint32_t)new_eip, shift);
2294
    LOG_PCALL_STATE(env);
2295
    if ((new_cs & 0xfffc) == 0)
2296
        raise_exception_err(EXCP0D_GPF, 0);
2297
    if (load_segment(&e1, &e2, new_cs) != 0)
2298
        raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2299
    cpl = env->hflags & HF_CPL_MASK;
2300
    LOG_PCALL("desc=%08x:%08x\n", e1, e2);
2301
    if (e2 & DESC_S_MASK) {
2302
        if (!(e2 & DESC_CS_MASK))
2303
            raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2304
        dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2305
        if (e2 & DESC_C_MASK) {
2306
            /* conforming code segment */
2307
            if (dpl > cpl)
2308
                raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2309
        } else {
2310
            /* non conforming code segment */
2311
            rpl = new_cs & 3;
2312
            if (rpl > cpl)
2313
                raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2314
            if (dpl != cpl)
2315
                raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2316
        }
2317
        if (!(e2 & DESC_P_MASK))
2318
            raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2319

    
2320
#ifdef TARGET_X86_64
2321
        /* XXX: check 16/32 bit cases in long mode */
2322
        if (shift == 2) {
2323
            target_ulong rsp;
2324
            /* 64 bit case */
2325
            rsp = ESP;
2326
            PUSHQ(rsp, env->segs[R_CS].selector);
2327
            PUSHQ(rsp, next_eip);
2328
            /* from this point, not restartable */
2329
            ESP = rsp;
2330
            cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
2331
                                   get_seg_base(e1, e2),
2332
                                   get_seg_limit(e1, e2), e2);
2333
            EIP = new_eip;
2334
        } else
2335
#endif
2336
        {
2337
            sp = ESP;
2338
            sp_mask = get_sp_mask(env->segs[R_SS].flags);
2339
            ssp = env->segs[R_SS].base;
2340
            if (shift) {
2341
                PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
2342
                PUSHL(ssp, sp, sp_mask, next_eip);
2343
            } else {
2344
                PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
2345
                PUSHW(ssp, sp, sp_mask, next_eip);
2346
            }
2347

    
2348
            limit = get_seg_limit(e1, e2);
2349
            if (new_eip > limit)
2350
                raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2351
            /* from this point, not restartable */
2352
            SET_ESP(sp, sp_mask);
2353
            cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl,
2354
                                   get_seg_base(e1, e2), limit, e2);
2355
            EIP = new_eip;
2356
        }
2357
    } else {
2358
        /* check gate type */
2359
        type = (e2 >> DESC_TYPE_SHIFT) & 0x1f;
2360
        dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2361
        rpl = new_cs & 3;
2362
        switch(type) {
2363
        case 1: /* available 286 TSS */
2364
        case 9: /* available 386 TSS */
2365
        case 5: /* task gate */
2366
            if (dpl < cpl || dpl < rpl)
2367
                raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2368
            switch_tss(new_cs, e1, e2, SWITCH_TSS_CALL, next_eip);
2369
            CC_OP = CC_OP_EFLAGS;
2370
            return;
2371
        case 4: /* 286 call gate */
2372
        case 12: /* 386 call gate */
2373
            break;
2374
        default:
2375
            raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2376
            break;
2377
        }
2378
        shift = type >> 3;
2379

    
2380
        if (dpl < cpl || dpl < rpl)
2381
            raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2382
        /* check valid bit */
2383
        if (!(e2 & DESC_P_MASK))
2384
            raise_exception_err(EXCP0B_NOSEG,  new_cs & 0xfffc);
2385
        selector = e1 >> 16;
2386
        offset = (e2 & 0xffff0000) | (e1 & 0x0000ffff);
2387
        param_count = e2 & 0x1f;
2388
        if ((selector & 0xfffc) == 0)
2389
            raise_exception_err(EXCP0D_GPF, 0);
2390

    
2391
        if (load_segment(&e1, &e2, selector) != 0)
2392
            raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2393
        if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK)))
2394
            raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2395
        dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2396
        if (dpl > cpl)
2397
            raise_exception_err(EXCP0D_GPF, selector & 0xfffc);
2398
        if (!(e2 & DESC_P_MASK))
2399
            raise_exception_err(EXCP0B_NOSEG, selector & 0xfffc);
2400

    
2401
        if (!(e2 & DESC_C_MASK) && dpl < cpl) {
2402
            /* to inner privilege */
2403
            get_ss_esp_from_tss(&ss, &sp, dpl);
2404
            LOG_PCALL("new ss:esp=%04x:%08x param_count=%d ESP=" TARGET_FMT_lx "\n",
2405
                        ss, sp, param_count, ESP);
2406
            if ((ss & 0xfffc) == 0)
2407
                raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2408
            if ((ss & 3) != dpl)
2409
                raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2410
            if (load_segment(&ss_e1, &ss_e2, ss) != 0)
2411
                raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2412
            ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
2413
            if (ss_dpl != dpl)
2414
                raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2415
            if (!(ss_e2 & DESC_S_MASK) ||
2416
                (ss_e2 & DESC_CS_MASK) ||
2417
                !(ss_e2 & DESC_W_MASK))
2418
                raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2419
            if (!(ss_e2 & DESC_P_MASK))
2420
                raise_exception_err(EXCP0A_TSS, ss & 0xfffc);
2421

    
2422
            //            push_size = ((param_count * 2) + 8) << shift;
2423

    
2424
            old_sp_mask = get_sp_mask(env->segs[R_SS].flags);
2425
            old_ssp = env->segs[R_SS].base;
2426

    
2427
            sp_mask = get_sp_mask(ss_e2);
2428
            ssp = get_seg_base(ss_e1, ss_e2);
2429
            if (shift) {
2430
                PUSHL(ssp, sp, sp_mask, env->segs[R_SS].selector);
2431
                PUSHL(ssp, sp, sp_mask, ESP);
2432
                for(i = param_count - 1; i >= 0; i--) {
2433
                    val = ldl_kernel(old_ssp + ((ESP + i * 4) & old_sp_mask));
2434
                    PUSHL(ssp, sp, sp_mask, val);
2435
                }
2436
            } else {
2437
                PUSHW(ssp, sp, sp_mask, env->segs[R_SS].selector);
2438
                PUSHW(ssp, sp, sp_mask, ESP);
2439
                for(i = param_count - 1; i >= 0; i--) {
2440
                    val = lduw_kernel(old_ssp + ((ESP + i * 2) & old_sp_mask));
2441
                    PUSHW(ssp, sp, sp_mask, val);
2442
                }
2443
            }
2444
            new_stack = 1;
2445
        } else {
2446
            /* to same privilege */
2447
            sp = ESP;
2448
            sp_mask = get_sp_mask(env->segs[R_SS].flags);
2449
            ssp = env->segs[R_SS].base;
2450
            //            push_size = (4 << shift);
2451
            new_stack = 0;
2452
        }
2453

    
2454
        if (shift) {
2455
            PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector);
2456
            PUSHL(ssp, sp, sp_mask, next_eip);
2457
        } else {
2458
            PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector);
2459
            PUSHW(ssp, sp, sp_mask, next_eip);
2460
        }
2461

    
2462
        /* from this point, not restartable */
2463

    
2464
        if (new_stack) {
2465
            ss = (ss & ~3) | dpl;
2466
            cpu_x86_load_seg_cache(env, R_SS, ss,
2467
                                   ssp,
2468
                                   get_seg_limit(ss_e1, ss_e2),
2469
                                   ss_e2);
2470
        }
2471

    
2472
        selector = (selector & ~3) | dpl;
2473
        cpu_x86_load_seg_cache(env, R_CS, selector,
2474
                       get_seg_base(e1, e2),
2475
                       get_seg_limit(e1, e2),
2476
                       e2);
2477
        cpu_x86_set_cpl(env, dpl);
2478
        SET_ESP(sp, sp_mask);
2479
        EIP = offset;
2480
    }
2481
#ifdef CONFIG_KQEMU
2482
    if (kqemu_is_ok(env)) {
2483
        env->exception_index = -1;
2484
        cpu_loop_exit();
2485
    }
2486
#endif
2487
}
2488

    
2489
/* real and vm86 mode iret */
2490
void helper_iret_real(int shift)
2491
{
2492
    uint32_t sp, new_cs, new_eip, new_eflags, sp_mask;
2493
    target_ulong ssp;
2494
    int eflags_mask;
2495

    
2496
    sp_mask = 0xffff; /* XXXX: use SS segment size ? */
2497
    sp = ESP;
2498
    ssp = env->segs[R_SS].base;
2499
    if (shift == 1) {
2500
        /* 32 bits */
2501
        POPL(ssp, sp, sp_mask, new_eip);
2502
        POPL(ssp, sp, sp_mask, new_cs);
2503
        new_cs &= 0xffff;
2504
        POPL(ssp, sp, sp_mask, new_eflags);
2505
    } else {
2506
        /* 16 bits */
2507
        POPW(ssp, sp, sp_mask, new_eip);
2508
        POPW(ssp, sp, sp_mask, new_cs);
2509
        POPW(ssp, sp, sp_mask, new_eflags);
2510
    }
2511
    ESP = (ESP & ~sp_mask) | (sp & sp_mask);
2512
    env->segs[R_CS].selector = new_cs;
2513
    env->segs[R_CS].base = (new_cs << 4);
2514
    env->eip = new_eip;
2515
    if (env->eflags & VM_MASK)
2516
        eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | RF_MASK | NT_MASK;
2517
    else
2518
        eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | IOPL_MASK | RF_MASK | NT_MASK;
2519
    if (shift == 0)
2520
        eflags_mask &= 0xffff;
2521
    load_eflags(new_eflags, eflags_mask);
2522
    env->hflags2 &= ~HF2_NMI_MASK;
2523
}
2524

    
2525
static inline void validate_seg(int seg_reg, int cpl)
2526
{
2527
    int dpl;
2528
    uint32_t e2;
2529

    
2530
    /* XXX: on x86_64, we do not want to nullify FS and GS because
2531
       they may still contain a valid base. I would be interested to
2532
       know how a real x86_64 CPU behaves */
2533
    if ((seg_reg == R_FS || seg_reg == R_GS) &&
2534
        (env->segs[seg_reg].selector & 0xfffc) == 0)
2535
        return;
2536

    
2537
    e2 = env->segs[seg_reg].flags;
2538
    dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2539
    if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) {
2540
        /* data or non conforming code segment */
2541
        if (dpl < cpl) {
2542
            cpu_x86_load_seg_cache(env, seg_reg, 0, 0, 0, 0);
2543
        }
2544
    }
2545
}
2546

    
2547
/* protected mode iret */
2548
static inline void helper_ret_protected(int shift, int is_iret, int addend)
2549
{
2550
    uint32_t new_cs, new_eflags, new_ss;
2551
    uint32_t new_es, new_ds, new_fs, new_gs;
2552
    uint32_t e1, e2, ss_e1, ss_e2;
2553
    int cpl, dpl, rpl, eflags_mask, iopl;
2554
    target_ulong ssp, sp, new_eip, new_esp, sp_mask;
2555

    
2556
#ifdef TARGET_X86_64
2557
    if (shift == 2)
2558
        sp_mask = -1;
2559
    else
2560
#endif
2561
        sp_mask = get_sp_mask(env->segs[R_SS].flags);
2562
    sp = ESP;
2563
    ssp = env->segs[R_SS].base;
2564
    new_eflags = 0; /* avoid warning */
2565
#ifdef TARGET_X86_64
2566
    if (shift == 2) {
2567
        POPQ(sp, new_eip);
2568
        POPQ(sp, new_cs);
2569
        new_cs &= 0xffff;
2570
        if (is_iret) {
2571
            POPQ(sp, new_eflags);
2572
        }
2573
    } else
2574
#endif
2575
    if (shift == 1) {
2576
        /* 32 bits */
2577
        POPL(ssp, sp, sp_mask, new_eip);
2578
        POPL(ssp, sp, sp_mask, new_cs);
2579
        new_cs &= 0xffff;
2580
        if (is_iret) {
2581
            POPL(ssp, sp, sp_mask, new_eflags);
2582
            if (new_eflags & VM_MASK)
2583
                goto return_to_vm86;
2584
        }
2585
    } else {
2586
        /* 16 bits */
2587
        POPW(ssp, sp, sp_mask, new_eip);
2588
        POPW(ssp, sp, sp_mask, new_cs);
2589
        if (is_iret)
2590
            POPW(ssp, sp, sp_mask, new_eflags);
2591
    }
2592
    LOG_PCALL("lret new %04x:" TARGET_FMT_lx " s=%d addend=0x%x\n",
2593
              new_cs, new_eip, shift, addend);
2594
    LOG_PCALL_STATE(env);
2595
    if ((new_cs & 0xfffc) == 0)
2596
        raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2597
    if (load_segment(&e1, &e2, new_cs) != 0)
2598
        raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2599
    if (!(e2 & DESC_S_MASK) ||
2600
        !(e2 & DESC_CS_MASK))
2601
        raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2602
    cpl = env->hflags & HF_CPL_MASK;
2603
    rpl = new_cs & 3;
2604
    if (rpl < cpl)
2605
        raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2606
    dpl = (e2 >> DESC_DPL_SHIFT) & 3;
2607
    if (e2 & DESC_C_MASK) {
2608
        if (dpl > rpl)
2609
            raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2610
    } else {
2611
        if (dpl != rpl)
2612
            raise_exception_err(EXCP0D_GPF, new_cs & 0xfffc);
2613
    }
2614
    if (!(e2 & DESC_P_MASK))
2615
        raise_exception_err(EXCP0B_NOSEG, new_cs & 0xfffc);
2616

    
2617
    sp += addend;
2618
    if (rpl == cpl && (!(env->hflags & HF_CS64_MASK) ||
2619
                       ((env->hflags & HF_CS64_MASK) && !is_iret))) {
2620
        /* return to same privilege level */
2621
        cpu_x86_load_seg_cache(env, R_CS, new_cs,
2622
                       get_seg_base(e1, e2),
2623
                       get_seg_limit(e1, e2),
2624
                       e2);
2625
    } else {
2626
        /* return to different privilege level */
2627
#ifdef TARGET_X86_64
2628
        if (shift == 2) {
2629
            POPQ(sp, new_esp);
2630
            POPQ(sp, new_ss);
2631
            new_ss &= 0xffff;
2632
        } else
2633
#endif
2634
        if (shift == 1) {
2635
            /* 32 bits */
2636
            POPL(ssp, sp, sp_mask, new_esp);
2637
            POPL(ssp, sp, sp_mask, new_ss);
2638
            new_ss &= 0xffff;
2639
        } else {
2640
            /* 16 bits */
2641
            POPW(ssp, sp, sp_mask, new_esp);
2642
            POPW(ssp, sp, sp_mask, new_ss);
2643
        }
2644
        LOG_PCALL("new ss:esp=%04x:" TARGET_FMT_lx "\n",
2645
                    new_ss, new_esp);
2646
        if ((new_ss & 0xfffc) == 0) {
2647
#ifdef TARGET_X86_64
2648
            /* NULL ss is allowed in long mode if cpl != 3*/
2649
            /* XXX: test CS64 ? */
2650
            if ((env->hflags & HF_LMA_MASK) && rpl != 3) {
2651
                cpu_x86_load_seg_cache(env, R_SS, new_ss,
2652
                                       0, 0xffffffff,
2653
                                       DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2654
                                       DESC_S_MASK | (rpl << DESC_DPL_SHIFT) |
2655
                                       DESC_W_MASK | DESC_A_MASK);
2656
                ss_e2 = DESC_B_MASK; /* XXX: should not be needed ? */
2657
            } else
2658
#endif
2659
            {
2660
                raise_exception_err(EXCP0D_GPF, 0);
2661
            }
2662
        } else {
2663
            if ((new_ss & 3) != rpl)
2664
                raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2665
            if (load_segment(&ss_e1, &ss_e2, new_ss) != 0)
2666
                raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2667
            if (!(ss_e2 & DESC_S_MASK) ||
2668
                (ss_e2 & DESC_CS_MASK) ||
2669
                !(ss_e2 & DESC_W_MASK))
2670
                raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2671
            dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3;
2672
            if (dpl != rpl)
2673
                raise_exception_err(EXCP0D_GPF, new_ss & 0xfffc);
2674
            if (!(ss_e2 & DESC_P_MASK))
2675
                raise_exception_err(EXCP0B_NOSEG, new_ss & 0xfffc);
2676
            cpu_x86_load_seg_cache(env, R_SS, new_ss,
2677
                                   get_seg_base(ss_e1, ss_e2),
2678
                                   get_seg_limit(ss_e1, ss_e2),
2679
                                   ss_e2);
2680
        }
2681

    
2682
        cpu_x86_load_seg_cache(env, R_CS, new_cs,
2683
                       get_seg_base(e1, e2),
2684
                       get_seg_limit(e1, e2),
2685
                       e2);
2686
        cpu_x86_set_cpl(env, rpl);
2687
        sp = new_esp;
2688
#ifdef TARGET_X86_64
2689
        if (env->hflags & HF_CS64_MASK)
2690
            sp_mask = -1;
2691
        else
2692
#endif
2693
            sp_mask = get_sp_mask(ss_e2);
2694

    
2695
        /* validate data segments */
2696
        validate_seg(R_ES, rpl);
2697
        validate_seg(R_DS, rpl);
2698
        validate_seg(R_FS, rpl);
2699
        validate_seg(R_GS, rpl);
2700

    
2701
        sp += addend;
2702
    }
2703
    SET_ESP(sp, sp_mask);
2704
    env->eip = new_eip;
2705
    if (is_iret) {
2706
        /* NOTE: 'cpl' is the _old_ CPL */
2707
        eflags_mask = TF_MASK | AC_MASK | ID_MASK | RF_MASK | NT_MASK;
2708
        if (cpl == 0)
2709
            eflags_mask |= IOPL_MASK;
2710
        iopl = (env->eflags >> IOPL_SHIFT) & 3;
2711
        if (cpl <= iopl)
2712
            eflags_mask |= IF_MASK;
2713
        if (shift == 0)
2714
            eflags_mask &= 0xffff;
2715
        load_eflags(new_eflags, eflags_mask);
2716
    }
2717
    return;
2718

    
2719
 return_to_vm86:
2720
    POPL(ssp, sp, sp_mask, new_esp);
2721
    POPL(ssp, sp, sp_mask, new_ss);
2722
    POPL(ssp, sp, sp_mask, new_es);
2723
    POPL(ssp, sp, sp_mask, new_ds);
2724
    POPL(ssp, sp, sp_mask, new_fs);
2725
    POPL(ssp, sp, sp_mask, new_gs);
2726

    
2727
    /* modify processor state */
2728
    load_eflags(new_eflags, TF_MASK | AC_MASK | ID_MASK |
2729
                IF_MASK | IOPL_MASK | VM_MASK | NT_MASK | VIF_MASK | VIP_MASK);
2730
    load_seg_vm(R_CS, new_cs & 0xffff);
2731
    cpu_x86_set_cpl(env, 3);
2732
    load_seg_vm(R_SS, new_ss & 0xffff);
2733
    load_seg_vm(R_ES, new_es & 0xffff);
2734
    load_seg_vm(R_DS, new_ds & 0xffff);
2735
    load_seg_vm(R_FS, new_fs & 0xffff);
2736
    load_seg_vm(R_GS, new_gs & 0xffff);
2737

    
2738
    env->eip = new_eip & 0xffff;
2739
    ESP = new_esp;
2740
}
2741

    
2742
void helper_iret_protected(int shift, int next_eip)
2743
{
2744
    int tss_selector, type;
2745
    uint32_t e1, e2;
2746

    
2747
    /* specific case for TSS */
2748
    if (env->eflags & NT_MASK) {
2749
#ifdef TARGET_X86_64
2750
        if (env->hflags & HF_LMA_MASK)
2751
            raise_exception_err(EXCP0D_GPF, 0);
2752
#endif
2753
        tss_selector = lduw_kernel(env->tr.base + 0);
2754
        if (tss_selector & 4)
2755
            raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2756
        if (load_segment(&e1, &e2, tss_selector) != 0)
2757
            raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2758
        type = (e2 >> DESC_TYPE_SHIFT) & 0x17;
2759
        /* NOTE: we check both segment and busy TSS */
2760
        if (type != 3)
2761
            raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc);
2762
        switch_tss(tss_selector, e1, e2, SWITCH_TSS_IRET, next_eip);
2763
    } else {
2764
        helper_ret_protected(shift, 1, 0);
2765
    }
2766
    env->hflags2 &= ~HF2_NMI_MASK;
2767
#ifdef CONFIG_KQEMU
2768
    if (kqemu_is_ok(env)) {
2769
        CC_OP = CC_OP_EFLAGS;
2770
        env->exception_index = -1;
2771
        cpu_loop_exit();
2772
    }
2773
#endif
2774
}
2775

    
2776
void helper_lret_protected(int shift, int addend)
2777
{
2778
    helper_ret_protected(shift, 0, addend);
2779
#ifdef CONFIG_KQEMU
2780
    if (kqemu_is_ok(env)) {
2781
        env->exception_index = -1;
2782
        cpu_loop_exit();
2783
    }
2784
#endif
2785
}
2786

    
2787
void helper_sysenter(void)
2788
{
2789
    if (env->sysenter_cs == 0) {
2790
        raise_exception_err(EXCP0D_GPF, 0);
2791
    }
2792
    env->eflags &= ~(VM_MASK | IF_MASK | RF_MASK);
2793
    cpu_x86_set_cpl(env, 0);
2794

    
2795
#ifdef TARGET_X86_64
2796
    if (env->hflags & HF_LMA_MASK) {
2797
        cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc,
2798
                               0, 0xffffffff,
2799
                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2800
                               DESC_S_MASK |
2801
                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);
2802
    } else
2803
#endif
2804
    {
2805
        cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc,
2806
                               0, 0xffffffff,
2807
                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2808
                               DESC_S_MASK |
2809
                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
2810
    }
2811
    cpu_x86_load_seg_cache(env, R_SS, (env->sysenter_cs + 8) & 0xfffc,
2812
                           0, 0xffffffff,
2813
                           DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2814
                           DESC_S_MASK |
2815
                           DESC_W_MASK | DESC_A_MASK);
2816
    ESP = env->sysenter_esp;
2817
    EIP = env->sysenter_eip;
2818
}
2819

    
2820
void helper_sysexit(int dflag)
2821
{
2822
    int cpl;
2823

    
2824
    cpl = env->hflags & HF_CPL_MASK;
2825
    if (env->sysenter_cs == 0 || cpl != 0) {
2826
        raise_exception_err(EXCP0D_GPF, 0);
2827
    }
2828
    cpu_x86_set_cpl(env, 3);
2829
#ifdef TARGET_X86_64
2830
    if (dflag == 2) {
2831
        cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 32) & 0xfffc) | 3,
2832
                               0, 0xffffffff,
2833
                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2834
                               DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2835
                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);
2836
        cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 40) & 0xfffc) | 3,
2837
                               0, 0xffffffff,
2838
                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2839
                               DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2840
                               DESC_W_MASK | DESC_A_MASK);
2841
    } else
2842
#endif
2843
    {
2844
        cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 16) & 0xfffc) | 3,
2845
                               0, 0xffffffff,
2846
                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2847
                               DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2848
                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
2849
        cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 24) & 0xfffc) | 3,
2850
                               0, 0xffffffff,
2851
                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
2852
                               DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
2853
                               DESC_W_MASK | DESC_A_MASK);
2854
    }
2855
    ESP = ECX;
2856
    EIP = EDX;
2857
#ifdef CONFIG_KQEMU
2858
    if (kqemu_is_ok(env)) {
2859
        env->exception_index = -1;
2860
        cpu_loop_exit();
2861
    }
2862
#endif
2863
}
2864

    
2865
#if defined(CONFIG_USER_ONLY)
2866
target_ulong helper_read_crN(int reg)
2867
{
2868
    return 0;
2869
}
2870

    
2871
void helper_write_crN(int reg, target_ulong t0)
2872
{
2873
}
2874

    
2875
void helper_movl_drN_T0(int reg, target_ulong t0)
2876
{
2877
}
2878
#else
2879
target_ulong helper_read_crN(int reg)
2880
{
2881
    target_ulong val;
2882

    
2883
    helper_svm_check_intercept_param(SVM_EXIT_READ_CR0 + reg, 0);
2884
    switch(reg) {
2885
    default:
2886
        val = env->cr[reg];
2887
        break;
2888
    case 8:
2889
        if (!(env->hflags2 & HF2_VINTR_MASK)) {
2890
            val = cpu_get_apic_tpr(env);
2891
        } else {
2892
            val = env->v_tpr;
2893
        }
2894
        break;
2895
    }
2896
    return val;
2897
}
2898

    
2899
void helper_write_crN(int reg, target_ulong t0)
2900
{
2901
    helper_svm_check_intercept_param(SVM_EXIT_WRITE_CR0 + reg, 0);
2902
    switch(reg) {
2903
    case 0:
2904
        cpu_x86_update_cr0(env, t0);
2905
        break;
2906
    case 3:
2907
        cpu_x86_update_cr3(env, t0);
2908
        break;
2909
    case 4:
2910
        cpu_x86_update_cr4(env, t0);
2911
        break;
2912
    case 8:
2913
        if (!(env->hflags2 & HF2_VINTR_MASK)) {
2914
            cpu_set_apic_tpr(env, t0);
2915
        }
2916
        env->v_tpr = t0 & 0x0f;
2917
        break;
2918
    default:
2919
        env->cr[reg] = t0;
2920
        break;
2921
    }
2922
}
2923

    
2924
void helper_movl_drN_T0(int reg, target_ulong t0)
2925
{
2926
    int i;
2927

    
2928
    if (reg < 4) {
2929
        hw_breakpoint_remove(env, reg);
2930
        env->dr[reg] = t0;
2931
        hw_breakpoint_insert(env, reg);
2932
    } else if (reg == 7) {
2933
        for (i = 0; i < 4; i++)
2934
            hw_breakpoint_remove(env, i);
2935
        env->dr[7] = t0;
2936
        for (i = 0; i < 4; i++)
2937
            hw_breakpoint_insert(env, i);
2938
    } else
2939
        env->dr[reg] = t0;
2940
}
2941
#endif
2942

    
2943
void helper_lmsw(target_ulong t0)
2944
{
2945
    /* only 4 lower bits of CR0 are modified. PE cannot be set to zero
2946
       if already set to one. */
2947
    t0 = (env->cr[0] & ~0xe) | (t0 & 0xf);
2948
    helper_write_crN(0, t0);
2949
}
2950

    
2951
void helper_clts(void)
2952
{
2953
    env->cr[0] &= ~CR0_TS_MASK;
2954
    env->hflags &= ~HF_TS_MASK;
2955
}
2956

    
2957
void helper_invlpg(target_ulong addr)
2958
{
2959
    helper_svm_check_intercept_param(SVM_EXIT_INVLPG, 0);
2960
    tlb_flush_page(env, addr);
2961
}
2962

    
2963
void helper_rdtsc(void)
2964
{
2965
    uint64_t val;
2966

    
2967
    if ((env->cr[4] & CR4_TSD_MASK) && ((env->hflags & HF_CPL_MASK) != 0)) {
2968
        raise_exception(EXCP0D_GPF);
2969
    }
2970
    helper_svm_check_intercept_param(SVM_EXIT_RDTSC, 0);
2971

    
2972
    val = cpu_get_tsc(env) + env->tsc_offset;
2973
    EAX = (uint32_t)(val);
2974
    EDX = (uint32_t)(val >> 32);
2975
}
2976

    
2977
void helper_rdpmc(void)
2978
{
2979
    if ((env->cr[4] & CR4_PCE_MASK) && ((env->hflags & HF_CPL_MASK) != 0)) {
2980
        raise_exception(EXCP0D_GPF);
2981
    }
2982
    helper_svm_check_intercept_param(SVM_EXIT_RDPMC, 0);
2983
    
2984
    /* currently unimplemented */
2985
    raise_exception_err(EXCP06_ILLOP, 0);
2986
}
2987

    
2988
#if defined(CONFIG_USER_ONLY)
2989
void helper_wrmsr(void)
2990
{
2991
}
2992

    
2993
void helper_rdmsr(void)
2994
{
2995
}
2996
#else
2997
void helper_wrmsr(void)
2998
{
2999
    uint64_t val;
3000

    
3001
    helper_svm_check_intercept_param(SVM_EXIT_MSR, 1);
3002

    
3003
    val = ((uint32_t)EAX) | ((uint64_t)((uint32_t)EDX) << 32);
3004

    
3005
    switch((uint32_t)ECX) {
3006
    case MSR_IA32_SYSENTER_CS:
3007
        env->sysenter_cs = val & 0xffff;
3008
        break;
3009
    case MSR_IA32_SYSENTER_ESP:
3010
        env->sysenter_esp = val;
3011
        break;
3012
    case MSR_IA32_SYSENTER_EIP:
3013
        env->sysenter_eip = val;
3014
        break;
3015
    case MSR_IA32_APICBASE:
3016
        cpu_set_apic_base(env, val);
3017
        break;
3018
    case MSR_EFER:
3019
        {
3020
            uint64_t update_mask;
3021
            update_mask = 0;
3022
            if (env->cpuid_ext2_features & CPUID_EXT2_SYSCALL)
3023
                update_mask |= MSR_EFER_SCE;
3024
            if (env->cpuid_ext2_features & CPUID_EXT2_LM)
3025
                update_mask |= MSR_EFER_LME;
3026
            if (env->cpuid_ext2_features & CPUID_EXT2_FFXSR)
3027
                update_mask |= MSR_EFER_FFXSR;
3028
            if (env->cpuid_ext2_features & CPUID_EXT2_NX)
3029
                update_mask |= MSR_EFER_NXE;
3030
            if (env->cpuid_ext3_features & CPUID_EXT3_SVM)
3031
                update_mask |= MSR_EFER_SVME;
3032
            if (env->cpuid_ext2_features & CPUID_EXT2_FFXSR)
3033
                update_mask |= MSR_EFER_FFXSR;
3034
            cpu_load_efer(env, (env->efer & ~update_mask) |
3035
                          (val & update_mask));
3036
        }
3037
        break;
3038
    case MSR_STAR:
3039
        env->star = val;
3040
        break;
3041
    case MSR_PAT:
3042
        env->pat = val;
3043
        break;
3044
    case MSR_VM_HSAVE_PA:
3045
        env->vm_hsave = val;
3046
        break;
3047
#ifdef TARGET_X86_64
3048
    case MSR_LSTAR:
3049
        env->lstar = val;
3050
        break;
3051
    case MSR_CSTAR:
3052
        env->cstar = val;
3053
        break;
3054
    case MSR_FMASK:
3055
        env->fmask = val;
3056
        break;
3057
    case MSR_FSBASE:
3058
        env->segs[R_FS].base = val;
3059
        break;
3060
    case MSR_GSBASE:
3061
        env->segs[R_GS].base = val;
3062
        break;
3063
    case MSR_KERNELGSBASE:
3064
        env->kernelgsbase = val;
3065
        break;
3066
#endif
3067
    case MSR_MTRRphysBase(0):
3068
    case MSR_MTRRphysBase(1):
3069
    case MSR_MTRRphysBase(2):
3070
    case MSR_MTRRphysBase(3):
3071
    case MSR_MTRRphysBase(4):
3072
    case MSR_MTRRphysBase(5):
3073
    case MSR_MTRRphysBase(6):
3074
    case MSR_MTRRphysBase(7):
3075
        env->mtrr_var[((uint32_t)ECX - MSR_MTRRphysBase(0)) / 2].base = val;
3076
        break;
3077
    case MSR_MTRRphysMask(0):
3078
    case MSR_MTRRphysMask(1):
3079
    case MSR_MTRRphysMask(2):
3080
    case MSR_MTRRphysMask(3):
3081
    case MSR_MTRRphysMask(4):
3082
    case MSR_MTRRphysMask(5):
3083
    case MSR_MTRRphysMask(6):
3084
    case MSR_MTRRphysMask(7):
3085
        env->mtrr_var[((uint32_t)ECX - MSR_MTRRphysMask(0)) / 2].mask = val;
3086
        break;
3087
    case MSR_MTRRfix64K_00000:
3088
        env->mtrr_fixed[(uint32_t)ECX - MSR_MTRRfix64K_00000] = val;
3089
        break;
3090
    case MSR_MTRRfix16K_80000:
3091
    case MSR_MTRRfix16K_A0000:
3092
        env->mtrr_fixed[(uint32_t)ECX - MSR_MTRRfix16K_80000 + 1] = val;
3093
        break;
3094
    case MSR_MTRRfix4K_C0000:
3095
    case MSR_MTRRfix4K_C8000:
3096
    case MSR_MTRRfix4K_D0000:
3097
    case MSR_MTRRfix4K_D8000:
3098
    case MSR_MTRRfix4K_E0000:
3099
    case MSR_MTRRfix4K_E8000:
3100
    case MSR_MTRRfix4K_F0000:
3101
    case MSR_MTRRfix4K_F8000:
3102
        env->mtrr_fixed[(uint32_t)ECX - MSR_MTRRfix4K_C0000 + 3] = val;
3103
        break;
3104
    case MSR_MTRRdefType:
3105
        env->mtrr_deftype = val;
3106
        break;
3107
    default:
3108
        /* XXX: exception ? */
3109
        break;
3110
    }
3111
}
3112

    
3113
void helper_rdmsr(void)
3114
{
3115
    uint64_t val;
3116

    
3117
    helper_svm_check_intercept_param(SVM_EXIT_MSR, 0);
3118

    
3119
    switch((uint32_t)ECX) {
3120
    case MSR_IA32_SYSENTER_CS:
3121
        val = env->sysenter_cs;
3122
        break;
3123
    case MSR_IA32_SYSENTER_ESP:
3124
        val = env->sysenter_esp;
3125
        break;
3126
    case MSR_IA32_SYSENTER_EIP:
3127
        val = env->sysenter_eip;
3128
        break;
3129
    case MSR_IA32_APICBASE:
3130
        val = cpu_get_apic_base(env);
3131
        break;
3132
    case MSR_EFER:
3133
        val = env->efer;
3134
        break;
3135
    case MSR_STAR:
3136
        val = env->star;
3137
        break;
3138
    case MSR_PAT:
3139
        val = env->pat;
3140
        break;
3141
    case MSR_VM_HSAVE_PA:
3142
        val = env->vm_hsave;
3143
        break;
3144
    case MSR_IA32_PERF_STATUS:
3145
        /* tsc_increment_by_tick */
3146
        val = 1000ULL;
3147
        /* CPU multiplier */
3148
        val |= (((uint64_t)4ULL) << 40);
3149
        break;
3150
#ifdef TARGET_X86_64
3151
    case MSR_LSTAR:
3152
        val = env->lstar;
3153
        break;
3154
    case MSR_CSTAR:
3155
        val = env->cstar;
3156
        break;
3157
    case MSR_FMASK:
3158
        val = env->fmask;
3159
        break;
3160
    case MSR_FSBASE:
3161
        val = env->segs[R_FS].base;
3162
        break;
3163
    case MSR_GSBASE:
3164
        val = env->segs[R_GS].base;
3165
        break;
3166
    case MSR_KERNELGSBASE:
3167
        val = env->kernelgsbase;
3168
        break;
3169
#endif
3170
#ifdef CONFIG_KQEMU
3171
    case MSR_QPI_COMMBASE:
3172
        if (env->kqemu_enabled) {
3173
            val = kqemu_comm_base;
3174
        } else {
3175
            val = 0;
3176
        }
3177
        break;
3178
#endif
3179
    case MSR_MTRRphysBase(0):
3180
    case MSR_MTRRphysBase(1):
3181
    case MSR_MTRRphysBase(2):
3182
    case MSR_MTRRphysBase(3):
3183
    case MSR_MTRRphysBase(4):
3184
    case MSR_MTRRphysBase(5):
3185
    case MSR_MTRRphysBase(6):
3186
    case MSR_MTRRphysBase(7):
3187
        val = env->mtrr_var[((uint32_t)ECX - MSR_MTRRphysBase(0)) / 2].base;
3188
        break;
3189
    case MSR_MTRRphysMask(0):
3190
    case MSR_MTRRphysMask(1):
3191
    case MSR_MTRRphysMask(2):
3192
    case MSR_MTRRphysMask(3):
3193
    case MSR_MTRRphysMask(4):
3194
    case MSR_MTRRphysMask(5):
3195
    case MSR_MTRRphysMask(6):
3196
    case MSR_MTRRphysMask(7):
3197
        val = env->mtrr_var[((uint32_t)ECX - MSR_MTRRphysMask(0)) / 2].mask;
3198
        break;
3199
    case MSR_MTRRfix64K_00000:
3200
        val = env->mtrr_fixed[0];
3201
        break;
3202
    case MSR_MTRRfix16K_80000:
3203
    case MSR_MTRRfix16K_A0000:
3204
        val = env->mtrr_fixed[(uint32_t)ECX - MSR_MTRRfix16K_80000 + 1];
3205
        break;
3206
    case MSR_MTRRfix4K_C0000:
3207
    case MSR_MTRRfix4K_C8000:
3208
    case MSR_MTRRfix4K_D0000:
3209
    case MSR_MTRRfix4K_D8000:
3210
    case MSR_MTRRfix4K_E0000:
3211
    case MSR_MTRRfix4K_E8000:
3212
    case MSR_MTRRfix4K_F0000:
3213
    case MSR_MTRRfix4K_F8000:
3214
        val = env->mtrr_fixed[(uint32_t)ECX - MSR_MTRRfix4K_C0000 + 3];
3215
        break;
3216
    case MSR_MTRRdefType:
3217
        val = env->mtrr_deftype;
3218
        break;
3219
    case MSR_MTRRcap:
3220
        if (env->cpuid_features & CPUID_MTRR)
3221
            val = MSR_MTRRcap_VCNT | MSR_MTRRcap_FIXRANGE_SUPPORT | MSR_MTRRcap_WC_SUPPORTED;
3222
        else
3223
            /* XXX: exception ? */
3224
            val = 0;
3225
        break;
3226
    default:
3227
        /* XXX: exception ? */
3228
        val = 0;
3229
        break;
3230
    }
3231
    EAX = (uint32_t)(val);
3232
    EDX = (uint32_t)(val >> 32);
3233
}
3234
#endif
3235

    
3236
target_ulong helper_lsl(target_ulong selector1)
3237
{
3238
    unsigned int limit;
3239
    uint32_t e1, e2, eflags, selector;
3240
    int rpl, dpl, cpl, type;
3241

    
3242
    selector = selector1 & 0xffff;
3243
    eflags = helper_cc_compute_all(CC_OP);
3244
    if ((selector & 0xfffc) == 0)
3245
        goto fail;
3246
    if (load_segment(&e1, &e2, selector) != 0)
3247
        goto fail;
3248
    rpl = selector & 3;
3249
    dpl = (e2 >> DESC_DPL_SHIFT) & 3;
3250
    cpl = env->hflags & HF_CPL_MASK;
3251
    if (e2 & DESC_S_MASK) {
3252
        if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) {
3253
            /* conforming */
3254
        } else {
3255
            if (dpl < cpl || dpl < rpl)
3256
                goto fail;
3257
        }
3258
    } else {
3259
        type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
3260
        switch(type) {
3261
        case 1:
3262
        case 2:
3263
        case 3:
3264
        case 9:
3265
        case 11:
3266
            break;
3267
        default:
3268
            goto fail;
3269
        }
3270
        if (dpl < cpl || dpl < rpl) {
3271
        fail:
3272
            CC_SRC = eflags & ~CC_Z;
3273
            return 0;
3274
        }
3275
    }
3276
    limit = get_seg_limit(e1, e2);
3277
    CC_SRC = eflags | CC_Z;
3278
    return limit;
3279
}
3280

    
3281
target_ulong helper_lar(target_ulong selector1)
3282
{
3283
    uint32_t e1, e2, eflags, selector;
3284
    int rpl, dpl, cpl, type;
3285

    
3286
    selector = selector1 & 0xffff;
3287
    eflags = helper_cc_compute_all(CC_OP);
3288
    if ((selector & 0xfffc) == 0)
3289
        goto fail;
3290
    if (load_segment(&e1, &e2, selector) != 0)
3291
        goto fail;
3292
    rpl = selector & 3;
3293
    dpl = (e2 >> DESC_DPL_SHIFT) & 3;
3294
    cpl = env->hflags & HF_CPL_MASK;
3295
    if (e2 & DESC_S_MASK) {
3296
        if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) {
3297
            /* conforming */
3298
        } else {
3299
            if (dpl < cpl || dpl < rpl)
3300
                goto fail;
3301
        }
3302
    } else {
3303
        type = (e2 >> DESC_TYPE_SHIFT) & 0xf;
3304
        switch(type) {
3305
        case 1:
3306
        case 2:
3307
        case 3:
3308
        case 4:
3309
        case 5:
3310
        case 9:
3311
        case 11:
3312
        case 12:
3313
            break;
3314
        default:
3315
            goto fail;
3316
        }
3317
        if (dpl < cpl || dpl < rpl) {
3318
        fail:
3319
            CC_SRC = eflags & ~CC_Z;
3320
            return 0;
3321
        }
3322
    }
3323
    CC_SRC = eflags | CC_Z;
3324
    return e2 & 0x00f0ff00;
3325
}
3326

    
3327
void helper_verr(target_ulong selector1)
3328
{
3329
    uint32_t e1, e2, eflags, selector;
3330
    int rpl, dpl, cpl;
3331

    
3332
    selector = selector1 & 0xffff;
3333
    eflags = helper_cc_compute_all(CC_OP);
3334
    if ((selector & 0xfffc) == 0)
3335
        goto fail;
3336
    if (load_segment(&e1, &e2, selector) != 0)
3337
        goto fail;
3338
    if (!(e2 & DESC_S_MASK))
3339
        goto fail;
3340
    rpl = selector & 3;
3341
    dpl = (e2 >> DESC_DPL_SHIFT) & 3;
3342
    cpl = env->hflags & HF_CPL_MASK;
3343
    if (e2 & DESC_CS_MASK) {
3344
        if (!(e2 & DESC_R_MASK))
3345
            goto fail;
3346
        if (!(e2 & DESC_C_MASK)) {
3347
            if (dpl < cpl || dpl < rpl)
3348
                goto fail;
3349
        }
3350
    } else {
3351
        if (dpl < cpl || dpl < rpl) {
3352
        fail:
3353
            CC_SRC = eflags & ~CC_Z;
3354
            return;
3355
        }
3356
    }
3357
    CC_SRC = eflags | CC_Z;
3358
}
3359

    
3360
void helper_verw(target_ulong selector1)
3361
{
3362
    uint32_t e1, e2, eflags, selector;
3363
    int rpl, dpl, cpl;
3364

    
3365
    selector = selector1 & 0xffff;
3366
    eflags = helper_cc_compute_all(CC_OP);
3367
    if ((selector & 0xfffc) == 0)
3368
        goto fail;
3369
    if (load_segment(&e1, &e2, selector) != 0)
3370
        goto fail;
3371
    if (!(e2 & DESC_S_MASK))
3372
        goto fail;
3373
    rpl = selector & 3;
3374
    dpl = (e2 >> DESC_DPL_SHIFT) & 3;
3375
    cpl = env->hflags & HF_CPL_MASK;
3376
    if (e2 & DESC_CS_MASK) {
3377
        goto fail;
3378
    } else {
3379
        if (dpl < cpl || dpl < rpl)
3380
            goto fail;
3381
        if (!(e2 & DESC_W_MASK)) {
3382
        fail:
3383
            CC_SRC = eflags & ~CC_Z;
3384
            return;
3385
        }
3386
    }
3387
    CC_SRC = eflags | CC_Z;
3388
}
3389

    
3390
/* x87 FPU helpers */
3391

    
3392
static void fpu_set_exception(int mask)
3393
{
3394
    env->fpus |= mask;
3395
    if (env->fpus & (~env->fpuc & FPUC_EM))
3396
        env->fpus |= FPUS_SE | FPUS_B;
3397
}
3398

    
3399
static inline CPU86_LDouble helper_fdiv(CPU86_LDouble a, CPU86_LDouble b)
3400
{
3401
    if (b == 0.0)
3402
        fpu_set_exception(FPUS_ZE);
3403
    return a / b;
3404
}
3405

    
3406
static void fpu_raise_exception(void)
3407
{
3408
    if (env->cr[0] & CR0_NE_MASK) {
3409
        raise_exception(EXCP10_COPR);
3410
    }
3411
#if !defined(CONFIG_USER_ONLY)
3412
    else {
3413
        cpu_set_ferr(env);
3414
    }
3415
#endif
3416
}
3417

    
3418
void helper_flds_FT0(uint32_t val)
3419
{
3420
    union {
3421
        float32 f;
3422
        uint32_t i;
3423
    } u;
3424
    u.i = val;
3425
    FT0 = float32_to_floatx(u.f, &env->fp_status);
3426
}
3427

    
3428
void helper_fldl_FT0(uint64_t val)
3429
{
3430
    union {
3431
        float64 f;
3432
        uint64_t i;
3433
    } u;
3434
    u.i = val;
3435
    FT0 = float64_to_floatx(u.f, &env->fp_status);
3436
}
3437

    
3438
void helper_fildl_FT0(int32_t val)
3439
{
3440
    FT0 = int32_to_floatx(val, &env->fp_status);
3441
}
3442

    
3443
void helper_flds_ST0(uint32_t val)
3444
{
3445
    int new_fpstt;
3446
    union {
3447
        float32 f;
3448
        uint32_t i;
3449
    } u;
3450
    new_fpstt = (env->fpstt - 1) & 7;
3451
    u.i = val;
3452
    env->fpregs[new_fpstt].d = float32_to_floatx(u.f, &env->fp_status);
3453
    env->fpstt = new_fpstt;
3454
    env->fptags[new_fpstt] = 0; /* validate stack entry */
3455
}
3456

    
3457
void helper_fldl_ST0(uint64_t val)
3458
{
3459
    int new_fpstt;
3460
    union {
3461
        float64 f;
3462
        uint64_t i;
3463
    } u;
3464
    new_fpstt = (env->fpstt - 1) & 7;
3465
    u.i = val;
3466
    env->fpregs[new_fpstt].d = float64_to_floatx(u.f, &env->fp_status);
3467
    env->fpstt = new_fpstt;
3468
    env->fptags[new_fpstt] = 0; /* validate stack entry */
3469
}
3470

    
3471
void helper_fildl_ST0(int32_t val)
3472
{
3473
    int new_fpstt;
3474
    new_fpstt = (env->fpstt - 1) & 7;
3475
    env->fpregs[new_fpstt].d = int32_to_floatx(val, &env->fp_status);
3476
    env->fpstt = new_fpstt;
3477
    env->fptags[new_fpstt] = 0; /* validate stack entry */
3478
}
3479

    
3480
void helper_fildll_ST0(int64_t val)
3481
{
3482
    int new_fpstt;
3483
    new_fpstt = (env->fpstt - 1) & 7;
3484
    env->fpregs[new_fpstt].d = int64_to_floatx(val, &env->fp_status);
3485
    env->fpstt = new_fpstt;
3486
    env->fptags[new_fpstt] = 0; /* validate stack entry */
3487
}
3488

    
3489
uint32_t helper_fsts_ST0(void)
3490
{
3491
    union {
3492
        float32 f;
3493
        uint32_t i;
3494
    } u;
3495
    u.f = floatx_to_float32(ST0, &env->fp_status);
3496
    return u.i;
3497
}
3498

    
3499
uint64_t helper_fstl_ST0(void)
3500
{
3501
    union {
3502
        float64 f;
3503
        uint64_t i;
3504
    } u;
3505
    u.f = floatx_to_float64(ST0, &env->fp_status);
3506
    return u.i;
3507
}
3508

    
3509
int32_t helper_fist_ST0(void)
3510
{
3511
    int32_t val;
3512
    val = floatx_to_int32(ST0, &env->fp_status);
3513
    if (val != (int16_t)val)
3514
        val = -32768;
3515
    return val;
3516
}
3517

    
3518
int32_t helper_fistl_ST0(void)
3519
{
3520
    int32_t val;
3521
    val = floatx_to_int32(ST0, &env->fp_status);
3522
    return val;
3523
}
3524

    
3525
int64_t helper_fistll_ST0(void)
3526
{
3527
    int64_t val;
3528
    val = floatx_to_int64(ST0, &env->fp_status);
3529
    return val;
3530
}
3531

    
3532
int32_t helper_fistt_ST0(void)
3533
{
3534
    int32_t val;
3535
    val = floatx_to_int32_round_to_zero(ST0, &env->fp_status);
3536
    if (val != (int16_t)val)
3537
        val = -32768;
3538
    return val;
3539
}
3540

    
3541
int32_t helper_fisttl_ST0(void)
3542
{
3543
    int32_t val;
3544
    val = floatx_to_int32_round_to_zero(ST0, &env->fp_status);
3545
    return val;
3546
}
3547

    
3548
int64_t helper_fisttll_ST0(void)
3549
{
3550
    int64_t val;
3551
    val = floatx_to_int64_round_to_zero(ST0, &env->fp_status);
3552
    return val;
3553
}
3554

    
3555
void helper_fldt_ST0(target_ulong ptr)
3556
{
3557
    int new_fpstt;
3558
    new_fpstt = (env->fpstt - 1) & 7;
3559
    env->fpregs[new_fpstt].d = helper_fldt(ptr);
3560
    env->fpstt = new_fpstt;
3561
    env->fptags[new_fpstt] = 0; /* validate stack entry */
3562
}
3563

    
3564
void helper_fstt_ST0(target_ulong ptr)
3565
{
3566
    helper_fstt(ST0, ptr);
3567
}
3568

    
3569
void helper_fpush(void)
3570
{
3571
    fpush();
3572
}
3573

    
3574
void helper_fpop(void)
3575
{
3576
    fpop();
3577
}
3578

    
3579
void helper_fdecstp(void)
3580
{
3581
    env->fpstt = (env->fpstt - 1) & 7;
3582
    env->fpus &= (~0x4700);
3583
}
3584

    
3585
void helper_fincstp(void)
3586
{
3587
    env->fpstt = (env->fpstt + 1) & 7;
3588
    env->fpus &= (~0x4700);
3589
}
3590

    
3591
/* FPU move */
3592

    
3593
void helper_ffree_STN(int st_index)
3594
{
3595
    env->fptags[(env->fpstt + st_index) & 7] = 1;
3596
}
3597

    
3598
void helper_fmov_ST0_FT0(void)
3599
{
3600
    ST0 = FT0;
3601
}
3602

    
3603
void helper_fmov_FT0_STN(int st_index)
3604
{
3605
    FT0 = ST(st_index);
3606
}
3607

    
3608
void helper_fmov_ST0_STN(int st_index)
3609
{
3610
    ST0 = ST(st_index);
3611
}
3612

    
3613
void helper_fmov_STN_ST0(int st_index)
3614
{
3615
    ST(st_index) = ST0;
3616
}
3617

    
3618
void helper_fxchg_ST0_STN(int st_index)
3619
{
3620
    CPU86_LDouble tmp;
3621
    tmp = ST(st_index);
3622
    ST(st_index) = ST0;
3623
    ST0 = tmp;
3624
}
3625

    
3626
/* FPU operations */
3627

    
3628
static const int fcom_ccval[4] = {0x0100, 0x4000, 0x0000, 0x4500};
3629

    
3630
void helper_fcom_ST0_FT0(void)
3631
{
3632
    int ret;
3633

    
3634
    ret = floatx_compare(ST0, FT0, &env->fp_status);
3635
    env->fpus = (env->fpus & ~0x4500) | fcom_ccval[ret + 1];
3636
}
3637

    
3638
void helper_fucom_ST0_FT0(void)
3639
{
3640
    int ret;
3641

    
3642
    ret = floatx_compare_quiet(ST0, FT0, &env->fp_status);
3643
    env->fpus = (env->fpus & ~0x4500) | fcom_ccval[ret+ 1];
3644
}
3645

    
3646
static const int fcomi_ccval[4] = {CC_C, CC_Z, 0, CC_Z | CC_P | CC_C};
3647

    
3648
void helper_fcomi_ST0_FT0(void)
3649
{
3650
    int eflags;
3651
    int ret;
3652

    
3653
    ret = floatx_compare(ST0, FT0, &env->fp_status);
3654
    eflags = helper_cc_compute_all(CC_OP);
3655
    eflags = (eflags & ~(CC_Z | CC_P | CC_C)) | fcomi_ccval[ret + 1];
3656
    CC_SRC = eflags;
3657
}
3658

    
3659
void helper_fucomi_ST0_FT0(void)
3660
{
3661
    int eflags;
3662
    int ret;
3663

    
3664
    ret = floatx_compare_quiet(ST0, FT0, &env->fp_status);
3665
    eflags = helper_cc_compute_all(CC_OP);
3666
    eflags = (eflags & ~(CC_Z | CC_P | CC_C)) | fcomi_ccval[ret + 1];
3667
    CC_SRC = eflags;
3668
}
3669

    
3670
void helper_fadd_ST0_FT0(void)
3671
{
3672
    ST0 += FT0;
3673
}
3674

    
3675
void helper_fmul_ST0_FT0(void)
3676
{
3677
    ST0 *= FT0;
3678
}
3679

    
3680
void helper_fsub_ST0_FT0(void)
3681
{
3682
    ST0 -= FT0;
3683
}
3684

    
3685
void helper_fsubr_ST0_FT0(void)
3686
{
3687
    ST0 = FT0 - ST0;
3688
}
3689

    
3690
void helper_fdiv_ST0_FT0(void)
3691
{
3692
    ST0 = helper_fdiv(ST0, FT0);
3693
}
3694

    
3695
void helper_fdivr_ST0_FT0(void)
3696
{
3697
    ST0 = helper_fdiv(FT0, ST0);
3698
}
3699

    
3700
/* fp operations between STN and ST0 */
3701

    
3702
void helper_fadd_STN_ST0(int st_index)
3703
{
3704
    ST(st_index) += ST0;
3705
}
3706

    
3707
void helper_fmul_STN_ST0(int st_index)
3708
{
3709
    ST(st_index) *= ST0;
3710
}
3711

    
3712
void helper_fsub_STN_ST0(int st_index)
3713
{
3714
    ST(st_index) -= ST0;
3715
}
3716

    
3717
void helper_fsubr_STN_ST0(int st_index)
3718
{
3719
    CPU86_LDouble *p;
3720
    p = &ST(st_index);
3721
    *p = ST0 - *p;
3722
}
3723

    
3724
void helper_fdiv_STN_ST0(int st_index)
3725
{
3726
    CPU86_LDouble *p;
3727
    p = &ST(st_index);
3728
    *p = helper_fdiv(*p, ST0);
3729
}
3730

    
3731
void helper_fdivr_STN_ST0(int st_index)
3732
{
3733
    CPU86_LDouble *p;
3734
    p = &ST(st_index);
3735
    *p = helper_fdiv(ST0, *p);
3736
}
3737

    
3738
/* misc FPU operations */
3739
void helper_fchs_ST0(void)
3740
{
3741
    ST0 = floatx_chs(ST0);
3742
}
3743

    
3744
void helper_fabs_ST0(void)
3745
{
3746
    ST0 = floatx_abs(ST0);
3747
}
3748

    
3749
void helper_fld1_ST0(void)
3750
{
3751
    ST0 = f15rk[1];
3752
}
3753

    
3754
void helper_fldl2t_ST0(void)
3755
{
3756
    ST0 = f15rk[6];
3757
}
3758

    
3759
void helper_fldl2e_ST0(void)
3760
{
3761
    ST0 = f15rk[5];
3762
}
3763

    
3764
void helper_fldpi_ST0(void)
3765
{
3766
    ST0 = f15rk[2];
3767
}
3768

    
3769
void helper_fldlg2_ST0(void)
3770
{
3771
    ST0 = f15rk[3];
3772
}
3773

    
3774
void helper_fldln2_ST0(void)
3775
{
3776
    ST0 = f15rk[4];
3777
}
3778

    
3779
void helper_fldz_ST0(void)
3780
{
3781
    ST0 = f15rk[0];
3782
}
3783

    
3784
void helper_fldz_FT0(void)
3785
{
3786
    FT0 = f15rk[0];
3787
}
3788

    
3789
uint32_t helper_fnstsw(void)
3790
{
3791
    return (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
3792
}
3793

    
3794
uint32_t helper_fnstcw(void)
3795
{
3796
    return env->fpuc;
3797
}
3798

    
3799
static void update_fp_status(void)
3800
{
3801
    int rnd_type;
3802

    
3803
    /* set rounding mode */
3804
    switch(env->fpuc & RC_MASK) {
3805
    default:
3806
    case RC_NEAR:
3807
        rnd_type = float_round_nearest_even;
3808
        break;
3809
    case RC_DOWN:
3810
        rnd_type = float_round_down;
3811
        break;
3812
    case RC_UP:
3813
        rnd_type = float_round_up;
3814
        break;
3815
    case RC_CHOP:
3816
        rnd_type = float_round_to_zero;
3817
        break;
3818
    }
3819
    set_float_rounding_mode(rnd_type, &env->fp_status);
3820
#ifdef FLOATX80
3821
    switch((env->fpuc >> 8) & 3) {
3822
    case 0:
3823
        rnd_type = 32;
3824
        break;
3825
    case 2:
3826
        rnd_type = 64;
3827
        break;
3828
    case 3:
3829
    default:
3830
        rnd_type = 80;
3831
        break;
3832
    }
3833
    set_floatx80_rounding_precision(rnd_type, &env->fp_status);
3834
#endif
3835
}
3836

    
3837
void helper_fldcw(uint32_t val)
3838
{
3839
    env->fpuc = val;
3840
    update_fp_status();
3841
}
3842

    
3843
void helper_fclex(void)
3844
{
3845
    env->fpus &= 0x7f00;
3846
}
3847

    
3848
void helper_fwait(void)
3849
{
3850
    if (env->fpus & FPUS_SE)
3851
        fpu_raise_exception();
3852
}
3853

    
3854
void helper_fninit(void)
3855
{
3856
    env->fpus = 0;
3857
    env->fpstt = 0;
3858
    env->fpuc = 0x37f;
3859
    env->fptags[0] = 1;
3860
    env->fptags[1] = 1;
3861
    env->fptags[2] = 1;
3862
    env->fptags[3] = 1;
3863
    env->fptags[4] = 1;
3864
    env->fptags[5] = 1;
3865
    env->fptags[6] = 1;
3866
    env->fptags[7] = 1;
3867
}
3868

    
3869
/* BCD ops */
3870

    
3871
void helper_fbld_ST0(target_ulong ptr)
3872
{
3873
    CPU86_LDouble tmp;
3874
    uint64_t val;
3875
    unsigned int v;
3876
    int i;
3877

    
3878
    val = 0;
3879
    for(i = 8; i >= 0; i--) {
3880
        v = ldub(ptr + i);
3881
        val = (val * 100) + ((v >> 4) * 10) + (v & 0xf);
3882
    }
3883
    tmp = val;
3884
    if (ldub(ptr + 9) & 0x80)
3885
        tmp = -tmp;
3886
    fpush();
3887
    ST0 = tmp;
3888
}
3889

    
3890
void helper_fbst_ST0(target_ulong ptr)
3891
{
3892
    int v;
3893
    target_ulong mem_ref, mem_end;
3894
    int64_t val;
3895

    
3896
    val = floatx_to_int64(ST0, &env->fp_status);
3897
    mem_ref = ptr;
3898
    mem_end = mem_ref + 9;
3899
    if (val < 0) {
3900
        stb(mem_end, 0x80);
3901
        val = -val;
3902
    } else {
3903
        stb(mem_end, 0x00);
3904
    }
3905
    while (mem_ref < mem_end) {
3906
        if (val == 0)
3907
            break;
3908
        v = val % 100;
3909
        val = val / 100;
3910
        v = ((v / 10) << 4) | (v % 10);
3911
        stb(mem_ref++, v);
3912
    }
3913
    while (mem_ref < mem_end) {
3914
        stb(mem_ref++, 0);
3915
    }
3916
}
3917

    
3918
void helper_f2xm1(void)
3919
{
3920
    ST0 = pow(2.0,ST0) - 1.0;
3921
}
3922

    
3923
void helper_fyl2x(void)
3924
{
3925
    CPU86_LDouble fptemp;
3926

    
3927
    fptemp = ST0;
3928
    if (fptemp>0.0){
3929
        fptemp = log(fptemp)/log(2.0);         /* log2(ST) */
3930
        ST1 *= fptemp;
3931
        fpop();
3932
    } else {
3933
        env->fpus &= (~0x4700);
3934
        env->fpus |= 0x400;
3935
    }
3936
}
3937

    
3938
void helper_fptan(void)
3939
{
3940
    CPU86_LDouble fptemp;
3941

    
3942
    fptemp = ST0;
3943
    if((fptemp > MAXTAN)||(fptemp < -MAXTAN)) {
3944
        env->fpus |= 0x400;
3945
    } else {
3946
        ST0 = tan(fptemp);
3947
        fpush();
3948
        ST0 = 1.0;
3949
        env->fpus &= (~0x400);  /* C2 <-- 0 */
3950
        /* the above code is for  |arg| < 2**52 only */
3951
    }
3952
}
3953

    
3954
void helper_fpatan(void)
3955
{
3956
    CPU86_LDouble fptemp, fpsrcop;
3957

    
3958
    fpsrcop = ST1;
3959
    fptemp = ST0;
3960
    ST1 = atan2(fpsrcop,fptemp);
3961
    fpop();
3962
}
3963

    
3964
void helper_fxtract(void)
3965
{
3966
    CPU86_LDoubleU temp;
3967
    unsigned int expdif;
3968

    
3969
    temp.d = ST0;
3970
    expdif = EXPD(temp) - EXPBIAS;
3971
    /*DP exponent bias*/
3972
    ST0 = expdif;
3973
    fpush();
3974
    BIASEXPONENT(temp);
3975
    ST0 = temp.d;
3976
}
3977

    
3978
void helper_fprem1(void)
3979
{
3980
    CPU86_LDouble dblq, fpsrcop, fptemp;
3981
    CPU86_LDoubleU fpsrcop1, fptemp1;
3982
    int expdif;
3983
    signed long long int q;
3984

    
3985
    if (isinf(ST0) || isnan(ST0) || isnan(ST1) || (ST1 == 0.0)) {
3986
        ST0 = 0.0 / 0.0; /* NaN */
3987
        env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
3988
        return;
3989
    }
3990

    
3991
    fpsrcop = ST0;
3992
    fptemp = ST1;
3993
    fpsrcop1.d = fpsrcop;
3994
    fptemp1.d = fptemp;
3995
    expdif = EXPD(fpsrcop1) - EXPD(fptemp1);
3996

    
3997
    if (expdif < 0) {
3998
        /* optimisation? taken from the AMD docs */
3999
        env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4000
        /* ST0 is unchanged */
4001
        return;
4002
    }
4003

    
4004
    if (expdif < 53) {
4005
        dblq = fpsrcop / fptemp;
4006
        /* round dblq towards nearest integer */
4007
        dblq = rint(dblq);
4008
        ST0 = fpsrcop - fptemp * dblq;
4009

    
4010
        /* convert dblq to q by truncating towards zero */
4011
        if (dblq < 0.0)
4012
           q = (signed long long int)(-dblq);
4013
        else
4014
           q = (signed long long int)dblq;
4015

    
4016
        env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4017
                                /* (C0,C3,C1) <-- (q2,q1,q0) */
4018
        env->fpus |= (q & 0x4) << (8 - 2);  /* (C0) <-- q2 */
4019
        env->fpus |= (q & 0x2) << (14 - 1); /* (C3) <-- q1 */
4020
        env->fpus |= (q & 0x1) << (9 - 0);  /* (C1) <-- q0 */
4021
    } else {
4022
        env->fpus |= 0x400;  /* C2 <-- 1 */
4023
        fptemp = pow(2.0, expdif - 50);
4024
        fpsrcop = (ST0 / ST1) / fptemp;
4025
        /* fpsrcop = integer obtained by chopping */
4026
        fpsrcop = (fpsrcop < 0.0) ?
4027
                  -(floor(fabs(fpsrcop))) : floor(fpsrcop);
4028
        ST0 -= (ST1 * fpsrcop * fptemp);
4029
    }
4030
}
4031

    
4032
void helper_fprem(void)
4033
{
4034
    CPU86_LDouble dblq, fpsrcop, fptemp;
4035
    CPU86_LDoubleU fpsrcop1, fptemp1;
4036
    int expdif;
4037
    signed long long int q;
4038

    
4039
    if (isinf(ST0) || isnan(ST0) || isnan(ST1) || (ST1 == 0.0)) {
4040
       ST0 = 0.0 / 0.0; /* NaN */
4041
       env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4042
       return;
4043
    }
4044

    
4045
    fpsrcop = (CPU86_LDouble)ST0;
4046
    fptemp = (CPU86_LDouble)ST1;
4047
    fpsrcop1.d = fpsrcop;
4048
    fptemp1.d = fptemp;
4049
    expdif = EXPD(fpsrcop1) - EXPD(fptemp1);
4050

    
4051
    if (expdif < 0) {
4052
        /* optimisation? taken from the AMD docs */
4053
        env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4054
        /* ST0 is unchanged */
4055
        return;
4056
    }
4057

    
4058
    if ( expdif < 53 ) {
4059
        dblq = fpsrcop/*ST0*/ / fptemp/*ST1*/;
4060
        /* round dblq towards zero */
4061
        dblq = (dblq < 0.0) ? ceil(dblq) : floor(dblq);
4062
        ST0 = fpsrcop/*ST0*/ - fptemp * dblq;
4063

    
4064
        /* convert dblq to q by truncating towards zero */
4065
        if (dblq < 0.0)
4066
           q = (signed long long int)(-dblq);
4067
        else
4068
           q = (signed long long int)dblq;
4069

    
4070
        env->fpus &= (~0x4700); /* (C3,C2,C1,C0) <-- 0000 */
4071
                                /* (C0,C3,C1) <-- (q2,q1,q0) */
4072
        env->fpus |= (q & 0x4) << (8 - 2);  /* (C0) <-- q2 */
4073
        env->fpus |= (q & 0x2) << (14 - 1); /* (C3) <-- q1 */
4074
        env->fpus |= (q & 0x1) << (9 - 0);  /* (C1) <-- q0 */
4075
    } else {
4076
        int N = 32 + (expdif % 32); /* as per AMD docs */
4077
        env->fpus |= 0x400;  /* C2 <-- 1 */
4078
        fptemp = pow(2.0, (double)(expdif - N));
4079
        fpsrcop = (ST0 / ST1) / fptemp;
4080
        /* fpsrcop = integer obtained by chopping */
4081
        fpsrcop = (fpsrcop < 0.0) ?
4082
                  -(floor(fabs(fpsrcop))) : floor(fpsrcop);
4083
        ST0 -= (ST1 * fpsrcop * fptemp);
4084
    }
4085
}
4086

    
4087
void helper_fyl2xp1(void)
4088
{
4089
    CPU86_LDouble fptemp;
4090

    
4091
    fptemp = ST0;
4092
    if ((fptemp+1.0)>0.0) {
4093
        fptemp = log(fptemp+1.0) / log(2.0); /* log2(ST+1.0) */
4094
        ST1 *= fptemp;
4095
        fpop();
4096
    } else {
4097
        env->fpus &= (~0x4700);
4098
        env->fpus |= 0x400;
4099
    }
4100
}
4101

    
4102
void helper_fsqrt(void)
4103
{
4104
    CPU86_LDouble fptemp;
4105

    
4106
    fptemp = ST0;
4107
    if (fptemp<0.0) {
4108
        env->fpus &= (~0x4700);  /* (C3,C2,C1,C0) <-- 0000 */
4109
        env->fpus |= 0x400;
4110
    }
4111
    ST0 = sqrt(fptemp);
4112
}
4113

    
4114
void helper_fsincos(void)
4115
{
4116
    CPU86_LDouble fptemp;
4117

    
4118
    fptemp = ST0;
4119
    if ((fptemp > MAXTAN)||(fptemp < -MAXTAN)) {
4120
        env->fpus |= 0x400;
4121
    } else {
4122
        ST0 = sin(fptemp);
4123
        fpush();
4124
        ST0 = cos(fptemp);
4125
        env->fpus &= (~0x400);  /* C2 <-- 0 */
4126
        /* the above code is for  |arg| < 2**63 only */
4127
    }
4128
}
4129

    
4130
void helper_frndint(void)
4131
{
4132
    ST0 = floatx_round_to_int(ST0, &env->fp_status);
4133
}
4134

    
4135
void helper_fscale(void)
4136
{
4137
    ST0 = ldexp (ST0, (int)(ST1));
4138
}
4139

    
4140
void helper_fsin(void)
4141
{
4142
    CPU86_LDouble fptemp;
4143

    
4144
    fptemp = ST0;
4145
    if ((fptemp > MAXTAN)||(fptemp < -MAXTAN)) {
4146
        env->fpus |= 0x400;
4147
    } else {
4148
        ST0 = sin(fptemp);
4149
        env->fpus &= (~0x400);  /* C2 <-- 0 */
4150
        /* the above code is for  |arg| < 2**53 only */
4151
    }
4152
}
4153

    
4154
void helper_fcos(void)
4155
{
4156
    CPU86_LDouble fptemp;
4157

    
4158
    fptemp = ST0;
4159
    if((fptemp > MAXTAN)||(fptemp < -MAXTAN)) {
4160
        env->fpus |= 0x400;
4161
    } else {
4162
        ST0 = cos(fptemp);
4163
        env->fpus &= (~0x400);  /* C2 <-- 0 */
4164
        /* the above code is for  |arg5 < 2**63 only */
4165
    }
4166
}
4167

    
4168
void helper_fxam_ST0(void)
4169
{
4170
    CPU86_LDoubleU temp;
4171
    int expdif;
4172

    
4173
    temp.d = ST0;
4174

    
4175
    env->fpus &= (~0x4700);  /* (C3,C2,C1,C0) <-- 0000 */
4176
    if (SIGND(temp))
4177
        env->fpus |= 0x200; /* C1 <-- 1 */
4178

    
4179
    /* XXX: test fptags too */
4180
    expdif = EXPD(temp);
4181
    if (expdif == MAXEXPD) {
4182
#ifdef USE_X86LDOUBLE
4183
        if (MANTD(temp) == 0x8000000000000000ULL)
4184
#else
4185
        if (MANTD(temp) == 0)
4186
#endif
4187
            env->fpus |=  0x500 /*Infinity*/;
4188
        else
4189
            env->fpus |=  0x100 /*NaN*/;
4190
    } else if (expdif == 0) {
4191
        if (MANTD(temp) == 0)
4192
            env->fpus |=  0x4000 /*Zero*/;
4193
        else
4194
            env->fpus |= 0x4400 /*Denormal*/;
4195
    } else {
4196
        env->fpus |= 0x400;
4197
    }
4198
}
4199

    
4200
void helper_fstenv(target_ulong ptr, int data32)
4201
{
4202
    int fpus, fptag, exp, i;
4203
    uint64_t mant;
4204
    CPU86_LDoubleU tmp;
4205

    
4206
    fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
4207
    fptag = 0;
4208
    for (i=7; i>=0; i--) {
4209
        fptag <<= 2;
4210
        if (env->fptags[i]) {
4211
            fptag |= 3;
4212
        } else {
4213
            tmp.d = env->fpregs[i].d;
4214
            exp = EXPD(tmp);
4215
            mant = MANTD(tmp);
4216
            if (exp == 0 && mant == 0) {
4217
                /* zero */
4218
                fptag |= 1;
4219
            } else if (exp == 0 || exp == MAXEXPD
4220
#ifdef USE_X86LDOUBLE
4221
                       || (mant & (1LL << 63)) == 0
4222
#endif
4223
                       ) {
4224
                /* NaNs, infinity, denormal */
4225
                fptag |= 2;
4226
            }
4227
        }
4228
    }
4229
    if (data32) {
4230
        /* 32 bit */
4231
        stl(ptr, env->fpuc);
4232
        stl(ptr + 4, fpus);
4233
        stl(ptr + 8, fptag);
4234
        stl(ptr + 12, 0); /* fpip */
4235
        stl(ptr + 16, 0); /* fpcs */
4236
        stl(ptr + 20, 0); /* fpoo */
4237
        stl(ptr + 24, 0); /* fpos */
4238
    } else {
4239
        /* 16 bit */
4240
        stw(ptr, env->fpuc);
4241
        stw(ptr + 2, fpus);
4242
        stw(ptr + 4, fptag);
4243
        stw(ptr + 6, 0);
4244
        stw(ptr + 8, 0);
4245
        stw(ptr + 10, 0);
4246
        stw(ptr + 12, 0);
4247
    }
4248
}
4249

    
4250
void helper_fldenv(target_ulong ptr, int data32)
4251
{
4252
    int i, fpus, fptag;
4253

    
4254
    if (data32) {
4255
        env->fpuc = lduw(ptr);
4256
        fpus = lduw(ptr + 4);
4257
        fptag = lduw(ptr + 8);
4258
    }
4259
    else {
4260
        env->fpuc = lduw(ptr);
4261
        fpus = lduw(ptr + 2);
4262
        fptag = lduw(ptr + 4);
4263
    }
4264
    env->fpstt = (fpus >> 11) & 7;
4265
    env->fpus = fpus & ~0x3800;
4266
    for(i = 0;i < 8; i++) {
4267
        env->fptags[i] = ((fptag & 3) == 3);
4268
        fptag >>= 2;
4269
    }
4270
}
4271

    
4272
void helper_fsave(target_ulong ptr, int data32)
4273
{
4274
    CPU86_LDouble tmp;
4275
    int i;
4276

    
4277
    helper_fstenv(ptr, data32);
4278

    
4279
    ptr += (14 << data32);
4280
    for(i = 0;i < 8; i++) {
4281
        tmp = ST(i);
4282
        helper_fstt(tmp, ptr);
4283
        ptr += 10;
4284
    }
4285

    
4286
    /* fninit */
4287
    env->fpus = 0;
4288
    env->fpstt = 0;
4289
    env->fpuc = 0x37f;
4290
    env->fptags[0] = 1;
4291
    env->fptags[1] = 1;
4292
    env->fptags[2] = 1;
4293
    env->fptags[3] = 1;
4294
    env->fptags[4] = 1;
4295
    env->fptags[5] = 1;
4296
    env->fptags[6] = 1;
4297
    env->fptags[7] = 1;
4298
}
4299

    
4300
void helper_frstor(target_ulong ptr, int data32)
4301
{
4302
    CPU86_LDouble tmp;
4303
    int i;
4304

    
4305
    helper_fldenv(ptr, data32);
4306
    ptr += (14 << data32);
4307

    
4308
    for(i = 0;i < 8; i++) {
4309
        tmp = helper_fldt(ptr);
4310
        ST(i) = tmp;
4311
        ptr += 10;
4312
    }
4313
}
4314

    
4315
void helper_fxsave(target_ulong ptr, int data64)
4316
{
4317
    int fpus, fptag, i, nb_xmm_regs;
4318
    CPU86_LDouble tmp;
4319
    target_ulong addr;
4320

    
4321
    fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
4322
    fptag = 0;
4323
    for(i = 0; i < 8; i++) {
4324
        fptag |= (env->fptags[i] << i);
4325
    }
4326
    stw(ptr, env->fpuc);
4327
    stw(ptr + 2, fpus);
4328
    stw(ptr + 4, fptag ^ 0xff);
4329
#ifdef TARGET_X86_64
4330
    if (data64) {
4331
        stq(ptr + 0x08, 0); /* rip */
4332
        stq(ptr + 0x10, 0); /* rdp */
4333
    } else 
4334
#endif
4335
    {
4336
        stl(ptr + 0x08, 0); /* eip */
4337
        stl(ptr + 0x0c, 0); /* sel  */
4338
        stl(ptr + 0x10, 0); /* dp */
4339
        stl(ptr + 0x14, 0); /* sel  */
4340
    }
4341

    
4342
    addr = ptr + 0x20;
4343
    for(i = 0;i < 8; i++) {
4344
        tmp = ST(i);
4345
        helper_fstt(tmp, addr);
4346
        addr += 16;
4347
    }
4348

    
4349
    if (env->cr[4] & CR4_OSFXSR_MASK) {
4350
        /* XXX: finish it */
4351
        stl(ptr + 0x18, env->mxcsr); /* mxcsr */
4352
        stl(ptr + 0x1c, 0x0000ffff); /* mxcsr_mask */
4353
        if (env->hflags & HF_CS64_MASK)
4354
            nb_xmm_regs = 16;
4355
        else
4356
            nb_xmm_regs = 8;
4357
        addr = ptr + 0xa0;
4358
        /* Fast FXSAVE leaves out the XMM registers */
4359
        if (!(env->efer & MSR_EFER_FFXSR)
4360
          || (env->hflags & HF_CPL_MASK)
4361
          || !(env->hflags & HF_LMA_MASK)) {
4362
            for(i = 0; i < nb_xmm_regs; i++) {
4363
                stq(addr, env->xmm_regs[i].XMM_Q(0));
4364
                stq(addr + 8, env->xmm_regs[i].XMM_Q(1));
4365
                addr += 16;
4366
            }
4367
        }
4368
    }
4369
}
4370

    
4371
void helper_fxrstor(target_ulong ptr, int data64)
4372
{
4373
    int i, fpus, fptag, nb_xmm_regs;
4374
    CPU86_LDouble tmp;
4375
    target_ulong addr;
4376

    
4377
    env->fpuc = lduw(ptr);
4378
    fpus = lduw(ptr + 2);
4379
    fptag = lduw(ptr + 4);
4380
    env->fpstt = (fpus >> 11) & 7;
4381
    env->fpus = fpus & ~0x3800;
4382
    fptag ^= 0xff;
4383
    for(i = 0;i < 8; i++) {
4384
        env->fptags[i] = ((fptag >> i) & 1);
4385
    }
4386

    
4387
    addr = ptr + 0x20;
4388
    for(i = 0;i < 8; i++) {
4389
        tmp = helper_fldt(addr);
4390
        ST(i) = tmp;
4391
        addr += 16;
4392
    }
4393

    
4394
    if (env->cr[4] & CR4_OSFXSR_MASK) {
4395
        /* XXX: finish it */
4396
        env->mxcsr = ldl(ptr + 0x18);
4397
        //ldl(ptr + 0x1c);
4398
        if (env->hflags & HF_CS64_MASK)
4399
            nb_xmm_regs = 16;
4400
        else
4401
            nb_xmm_regs = 8;
4402
        addr = ptr + 0xa0;
4403
        /* Fast FXRESTORE leaves out the XMM registers */
4404
        if (!(env->efer & MSR_EFER_FFXSR)
4405
          || (env->hflags & HF_CPL_MASK)
4406
          || !(env->hflags & HF_LMA_MASK)) {
4407
            for(i = 0; i < nb_xmm_regs; i++) {
4408
                env->xmm_regs[i].XMM_Q(0) = ldq(addr);
4409
                env->xmm_regs[i].XMM_Q(1) = ldq(addr + 8);
4410
                addr += 16;
4411
            }
4412
        }
4413
    }
4414
}
4415

    
4416
#ifndef USE_X86LDOUBLE
4417

    
4418
void cpu_get_fp80(uint64_t *pmant, uint16_t *pexp, CPU86_LDouble f)
4419
{
4420
    CPU86_LDoubleU temp;
4421
    int e;
4422

    
4423
    temp.d = f;
4424
    /* mantissa */
4425
    *pmant = (MANTD(temp) << 11) | (1LL << 63);
4426
    /* exponent + sign */
4427
    e = EXPD(temp) - EXPBIAS + 16383;
4428
    e |= SIGND(temp) >> 16;
4429
    *pexp = e;
4430
}
4431

    
4432
CPU86_LDouble cpu_set_fp80(uint64_t mant, uint16_t upper)
4433
{
4434
    CPU86_LDoubleU temp;
4435
    int e;
4436
    uint64_t ll;
4437

    
4438
    /* XXX: handle overflow ? */
4439
    e = (upper & 0x7fff) - 16383 + EXPBIAS; /* exponent */
4440
    e |= (upper >> 4) & 0x800; /* sign */
4441
    ll = (mant >> 11) & ((1LL << 52) - 1);
4442
#ifdef __arm__
4443
    temp.l.upper = (e << 20) | (ll >> 32);
4444
    temp.l.lower = ll;
4445
#else
4446
    temp.ll = ll | ((uint64_t)e << 52);
4447
#endif
4448
    return temp.d;
4449
}
4450

    
4451
#else
4452

    
4453
void cpu_get_fp80(uint64_t *pmant, uint16_t *pexp, CPU86_LDouble f)
4454
{
4455
    CPU86_LDoubleU temp;
4456

    
4457
    temp.d = f;
4458
    *pmant = temp.l.lower;
4459
    *pexp = temp.l.upper;
4460
}
4461

    
4462
CPU86_LDouble cpu_set_fp80(uint64_t mant, uint16_t upper)
4463
{
4464
    CPU86_LDoubleU temp;
4465

    
4466
    temp.l.upper = upper;
4467
    temp.l.lower = mant;
4468
    return temp.d;
4469
}
4470
#endif
4471

    
4472
#ifdef TARGET_X86_64
4473

    
4474
//#define DEBUG_MULDIV
4475

    
4476
static void add128(uint64_t *plow, uint64_t *phigh, uint64_t a, uint64_t b)
4477
{
4478
    *plow += a;
4479
    /* carry test */
4480
    if (*plow < a)
4481
        (*phigh)++;
4482
    *phigh += b;
4483
}
4484

    
4485
static void neg128(uint64_t *plow, uint64_t *phigh)
4486
{
4487
    *plow = ~ *plow;
4488
    *phigh = ~ *phigh;
4489
    add128(plow, phigh, 1, 0);
4490
}
4491

    
4492
/* return TRUE if overflow */
4493
static int div64(uint64_t *plow, uint64_t *phigh, uint64_t b)
4494
{
4495
    uint64_t q, r, a1, a0;
4496
    int i, qb, ab;
4497

    
4498
    a0 = *plow;
4499
    a1 = *phigh;
4500
    if (a1 == 0) {
4501
        q = a0 / b;
4502
        r = a0 % b;
4503
        *plow = q;
4504
        *phigh = r;
4505
    } else {
4506
        if (a1 >= b)
4507
            return 1;
4508
        /* XXX: use a better algorithm */
4509
        for(i = 0; i < 64; i++) {
4510
            ab = a1 >> 63;
4511
            a1 = (a1 << 1) | (a0 >> 63);
4512
            if (ab || a1 >= b) {
4513
                a1 -= b;
4514
                qb = 1;
4515
            } else {
4516
                qb = 0;
4517
            }
4518
            a0 = (a0 << 1) | qb;
4519
        }
4520
#if defined(DEBUG_MULDIV)
4521
        printf("div: 0x%016" PRIx64 "%016" PRIx64 " / 0x%016" PRIx64 ": q=0x%016" PRIx64 " r=0x%016" PRIx64 "\n",
4522
               *phigh, *plow, b, a0, a1);
4523
#endif
4524
        *plow = a0;
4525
        *phigh = a1;
4526
    }
4527
    return 0;
4528
}
4529

    
4530
/* return TRUE if overflow */
4531
static int idiv64(uint64_t *plow, uint64_t *phigh, int64_t b)
4532
{
4533
    int sa, sb;
4534
    sa = ((int64_t)*phigh < 0);
4535
    if (sa)
4536
        neg128(plow, phigh);
4537
    sb = (b < 0);
4538
    if (sb)
4539
        b = -b;
4540
    if (div64(plow, phigh, b) != 0)
4541
        return 1;
4542
    if (sa ^ sb) {
4543
        if (*plow > (1ULL << 63))
4544
            return 1;
4545
        *plow = - *plow;
4546
    } else {
4547
        if (*plow >= (1ULL << 63))
4548
            return 1;
4549
    }
4550
    if (sa)
4551
        *phigh = - *phigh;
4552
    return 0;
4553
}
4554

    
4555
void helper_mulq_EAX_T0(target_ulong t0)
4556
{
4557
    uint64_t r0, r1;
4558

    
4559
    mulu64(&r0, &r1, EAX, t0);
4560
    EAX = r0;
4561
    EDX = r1;
4562
    CC_DST = r0;
4563
    CC_SRC = r1;
4564
}
4565

    
4566
void helper_imulq_EAX_T0(target_ulong t0)
4567
{
4568
    uint64_t r0, r1;
4569

    
4570
    muls64(&r0, &r1, EAX, t0);
4571
    EAX = r0;
4572
    EDX = r1;
4573
    CC_DST = r0;
4574
    CC_SRC = ((int64_t)r1 != ((int64_t)r0 >> 63));
4575
}
4576

    
4577
target_ulong helper_imulq_T0_T1(target_ulong t0, target_ulong t1)
4578
{
4579
    uint64_t r0, r1;
4580

    
4581
    muls64(&r0, &r1, t0, t1);
4582
    CC_DST = r0;
4583
    CC_SRC = ((int64_t)r1 != ((int64_t)r0 >> 63));
4584
    return r0;
4585
}
4586

    
4587
void helper_divq_EAX(target_ulong t0)
4588
{
4589
    uint64_t r0, r1;
4590
    if (t0 == 0) {
4591
        raise_exception(EXCP00_DIVZ);
4592
    }
4593
    r0 = EAX;
4594
    r1 = EDX;
4595
    if (div64(&r0, &r1, t0))
4596
        raise_exception(EXCP00_DIVZ);
4597
    EAX = r0;
4598
    EDX = r1;
4599
}
4600

    
4601
void helper_idivq_EAX(target_ulong t0)
4602
{
4603
    uint64_t r0, r1;
4604
    if (t0 == 0) {
4605
        raise_exception(EXCP00_DIVZ);
4606
    }
4607
    r0 = EAX;
4608
    r1 = EDX;
4609
    if (idiv64(&r0, &r1, t0))
4610
        raise_exception(EXCP00_DIVZ);
4611
    EAX = r0;
4612
    EDX = r1;
4613
}
4614
#endif
4615

    
4616
static void do_hlt(void)
4617
{
4618
    env->hflags &= ~HF_INHIBIT_IRQ_MASK; /* needed if sti is just before */
4619
    env->halted = 1;
4620
    env->exception_index = EXCP_HLT;
4621
    cpu_loop_exit();
4622
}
4623

    
4624
void helper_hlt(int next_eip_addend)
4625
{
4626
    helper_svm_check_intercept_param(SVM_EXIT_HLT, 0);
4627
    EIP += next_eip_addend;
4628
    
4629
    do_hlt();
4630
}
4631

    
4632
void helper_monitor(target_ulong ptr)
4633
{
4634
    if ((uint32_t)ECX != 0)
4635
        raise_exception(EXCP0D_GPF);
4636
    /* XXX: store address ? */
4637
    helper_svm_check_intercept_param(SVM_EXIT_MONITOR, 0);
4638
}
4639

    
4640
void helper_mwait(int next_eip_addend)
4641
{
4642
    if ((uint32_t)ECX != 0)
4643
        raise_exception(EXCP0D_GPF);
4644
    helper_svm_check_intercept_param(SVM_EXIT_MWAIT, 0);
4645
    EIP += next_eip_addend;
4646

    
4647
    /* XXX: not complete but not completely erroneous */
4648
    if (env->cpu_index != 0 || env->next_cpu != NULL) {
4649
        /* more than one CPU: do not sleep because another CPU may
4650
           wake this one */
4651
    } else {
4652
        do_hlt();
4653
    }
4654
}
4655

    
4656
void helper_debug(void)
4657
{
4658
    env->exception_index = EXCP_DEBUG;
4659
    cpu_loop_exit();
4660
}
4661

    
4662
void helper_raise_interrupt(int intno, int next_eip_addend)
4663
{
4664
    raise_interrupt(intno, 1, 0, next_eip_addend);
4665
}
4666

    
4667
void helper_raise_exception(int exception_index)
4668
{
4669
    raise_exception(exception_index);
4670
}
4671

    
4672
void helper_cli(void)
4673
{
4674
    env->eflags &= ~IF_MASK;
4675
}
4676

    
4677
void helper_sti(void)
4678
{
4679
    env->eflags |= IF_MASK;
4680
}
4681

    
4682
#if 0
4683
/* vm86plus instructions */
4684
void helper_cli_vm(void)
4685
{
4686
    env->eflags &= ~VIF_MASK;
4687
}
4688

4689
void helper_sti_vm(void)
4690
{
4691
    env->eflags |= VIF_MASK;
4692
    if (env->eflags & VIP_MASK) {
4693
        raise_exception(EXCP0D_GPF);
4694
    }
4695
}
4696
#endif
4697

    
4698
void helper_set_inhibit_irq(void)
4699
{
4700
    env->hflags |= HF_INHIBIT_IRQ_MASK;
4701
}
4702

    
4703
void helper_reset_inhibit_irq(void)
4704
{
4705
    env->hflags &= ~HF_INHIBIT_IRQ_MASK;
4706
}
4707

    
4708
void helper_boundw(target_ulong a0, int v)
4709
{
4710
    int low, high;
4711
    low = ldsw(a0);
4712
    high = ldsw(a0 + 2);
4713
    v = (int16_t)v;
4714
    if (v < low || v > high) {
4715
        raise_exception(EXCP05_BOUND);
4716
    }
4717
}
4718

    
4719
void helper_boundl(target_ulong a0, int v)
4720
{
4721
    int low, high;
4722
    low = ldl(a0);
4723
    high = ldl(a0 + 4);
4724
    if (v < low || v > high) {
4725
        raise_exception(EXCP05_BOUND);
4726
    }
4727
}
4728

    
4729
static float approx_rsqrt(float a)
4730
{
4731
    return 1.0 / sqrt(a);
4732
}
4733

    
4734
static float approx_rcp(float a)
4735
{
4736
    return 1.0 / a;
4737
}
4738

    
4739
#if !defined(CONFIG_USER_ONLY)
4740

    
4741
#define MMUSUFFIX _mmu
4742

    
4743
#define SHIFT 0
4744
#include "softmmu_template.h"
4745

    
4746
#define SHIFT 1
4747
#include "softmmu_template.h"
4748

    
4749
#define SHIFT 2
4750
#include "softmmu_template.h"
4751

    
4752
#define SHIFT 3
4753
#include "softmmu_template.h"
4754

    
4755
#endif
4756

    
4757
#if !defined(CONFIG_USER_ONLY)
4758
/* try to fill the TLB and return an exception if error. If retaddr is
4759
   NULL, it means that the function was called in C code (i.e. not
4760
   from generated code or from helper.c) */
4761
/* XXX: fix it to restore all registers */
4762
void tlb_fill(target_ulong addr, int is_write, int mmu_idx, void *retaddr)
4763
{
4764
    TranslationBlock *tb;
4765
    int ret;
4766
    unsigned long pc;
4767
    CPUX86State *saved_env;
4768

    
4769
    /* XXX: hack to restore env in all cases, even if not called from
4770
       generated code */
4771
    saved_env = env;
4772
    env = cpu_single_env;
4773

    
4774
    ret = cpu_x86_handle_mmu_fault(env, addr, is_write, mmu_idx, 1);
4775
    if (ret) {
4776
        if (retaddr) {
4777
            /* now we have a real cpu fault */
4778
            pc = (unsigned long)retaddr;
4779
            tb = tb_find_pc(pc);
4780
            if (tb) {
4781
                /* the PC is inside the translated code. It means that we have
4782
                   a virtual CPU fault */
4783
                cpu_restore_state(tb, env, pc, NULL);
4784
            }
4785
        }
4786
        raise_exception_err(env->exception_index, env->error_code);
4787
    }
4788
    env = saved_env;
4789
}
4790
#endif
4791

    
4792
/* Secure Virtual Machine helpers */
4793

    
4794
#if defined(CONFIG_USER_ONLY)
4795

    
4796
void helper_vmrun(int aflag, int next_eip_addend)
4797
{ 
4798
}
4799
void helper_vmmcall(void) 
4800
{ 
4801
}
4802
void helper_vmload(int aflag)
4803
{ 
4804
}
4805
void helper_vmsave(int aflag)
4806
{ 
4807
}
4808
void helper_stgi(void)
4809
{
4810
}
4811
void helper_clgi(void)
4812
{
4813
}
4814
void helper_skinit(void) 
4815
{ 
4816
}
4817
void helper_invlpga(int aflag)
4818
{ 
4819
}
4820
void helper_vmexit(uint32_t exit_code, uint64_t exit_info_1) 
4821
{ 
4822
}
4823
void helper_svm_check_intercept_param(uint32_t type, uint64_t param)
4824
{
4825
}
4826

    
4827
void helper_svm_check_io(uint32_t port, uint32_t param, 
4828
                         uint32_t next_eip_addend)
4829
{
4830
}
4831
#else
4832

    
4833
static inline void svm_save_seg(target_phys_addr_t addr,
4834
                                const SegmentCache *sc)
4835
{
4836
    stw_phys(addr + offsetof(struct vmcb_seg, selector), 
4837
             sc->selector);
4838
    stq_phys(addr + offsetof(struct vmcb_seg, base), 
4839
             sc->base);
4840
    stl_phys(addr + offsetof(struct vmcb_seg, limit), 
4841
             sc->limit);
4842
    stw_phys(addr + offsetof(struct vmcb_seg, attrib), 
4843
             ((sc->flags >> 8) & 0xff) | ((sc->flags >> 12) & 0x0f00));
4844
}
4845
                                
4846
static inline void svm_load_seg(target_phys_addr_t addr, SegmentCache *sc)
4847
{
4848
    unsigned int flags;
4849

    
4850
    sc->selector = lduw_phys(addr + offsetof(struct vmcb_seg, selector));
4851
    sc->base = ldq_phys(addr + offsetof(struct vmcb_seg, base));
4852
    sc->limit = ldl_phys(addr + offsetof(struct vmcb_seg, limit));
4853
    flags = lduw_phys(addr + offsetof(struct vmcb_seg, attrib));
4854
    sc->flags = ((flags & 0xff) << 8) | ((flags & 0x0f00) << 12);
4855
}
4856

    
4857
static inline void svm_load_seg_cache(target_phys_addr_t addr, 
4858
                                      CPUState *env, int seg_reg)
4859
{
4860
    SegmentCache sc1, *sc = &sc1;
4861
    svm_load_seg(addr, sc);
4862
    cpu_x86_load_seg_cache(env, seg_reg, sc->selector,
4863
                           sc->base, sc->limit, sc->flags);
4864
}
4865

    
4866
void helper_vmrun(int aflag, int next_eip_addend)
4867
{
4868
    target_ulong addr;
4869
    uint32_t event_inj;
4870
    uint32_t int_ctl;
4871

    
4872
    helper_svm_check_intercept_param(SVM_EXIT_VMRUN, 0);
4873

    
4874
    if (aflag == 2)
4875
        addr = EAX;
4876
    else
4877
        addr = (uint32_t)EAX;
4878

    
4879
    qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmrun! " TARGET_FMT_lx "\n", addr);
4880

    
4881
    env->vm_vmcb = addr;
4882

    
4883
    /* save the current CPU state in the hsave page */
4884
    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.base), env->gdt.base);
4885
    stl_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.limit), env->gdt.limit);
4886

    
4887
    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.base), env->idt.base);
4888
    stl_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.limit), env->idt.limit);
4889

    
4890
    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr0), env->cr[0]);
4891
    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr2), env->cr[2]);
4892
    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr3), env->cr[3]);
4893
    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr4), env->cr[4]);
4894
    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr6), env->dr[6]);
4895
    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr7), env->dr[7]);
4896

    
4897
    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.efer), env->efer);
4898
    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rflags), compute_eflags());
4899

    
4900
    svm_save_seg(env->vm_hsave + offsetof(struct vmcb, save.es), 
4901
                  &env->segs[R_ES]);
4902
    svm_save_seg(env->vm_hsave + offsetof(struct vmcb, save.cs), 
4903
                 &env->segs[R_CS]);
4904
    svm_save_seg(env->vm_hsave + offsetof(struct vmcb, save.ss), 
4905
                 &env->segs[R_SS]);
4906
    svm_save_seg(env->vm_hsave + offsetof(struct vmcb, save.ds), 
4907
                 &env->segs[R_DS]);
4908

    
4909
    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rip),
4910
             EIP + next_eip_addend);
4911
    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rsp), ESP);
4912
    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rax), EAX);
4913

    
4914
    /* load the interception bitmaps so we do not need to access the
4915
       vmcb in svm mode */
4916
    env->intercept            = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept));
4917
    env->intercept_cr_read    = lduw_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_cr_read));
4918
    env->intercept_cr_write   = lduw_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_cr_write));
4919
    env->intercept_dr_read    = lduw_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_dr_read));
4920
    env->intercept_dr_write   = lduw_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_dr_write));
4921
    env->intercept_exceptions = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.intercept_exceptions));
4922

    
4923
    /* enable intercepts */
4924
    env->hflags |= HF_SVMI_MASK;
4925

    
4926
    env->tsc_offset = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.tsc_offset));
4927

    
4928
    env->gdt.base  = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.base));
4929
    env->gdt.limit = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.limit));
4930

    
4931
    env->idt.base  = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.base));
4932
    env->idt.limit = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.limit));
4933

    
4934
    /* clear exit_info_2 so we behave like the real hardware */
4935
    stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), 0);
4936

    
4937
    cpu_x86_update_cr0(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr0)));
4938
    cpu_x86_update_cr4(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr4)));
4939
    cpu_x86_update_cr3(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr3)));
4940
    env->cr[2] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr2));
4941
    int_ctl = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl));
4942
    env->hflags2 &= ~(HF2_HIF_MASK | HF2_VINTR_MASK);
4943
    if (int_ctl & V_INTR_MASKING_MASK) {
4944
        env->v_tpr = int_ctl & V_TPR_MASK;
4945
        env->hflags2 |= HF2_VINTR_MASK;
4946
        if (env->eflags & IF_MASK)
4947
            env->hflags2 |= HF2_HIF_MASK;
4948
    }
4949

    
4950
    cpu_load_efer(env, 
4951
                  ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.efer)));
4952
    env->eflags = 0;
4953
    load_eflags(ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rflags)),
4954
                ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
4955
    CC_OP = CC_OP_EFLAGS;
4956

    
4957
    svm_load_seg_cache(env->vm_vmcb + offsetof(struct vmcb, save.es),
4958
                       env, R_ES);
4959
    svm_load_seg_cache(env->vm_vmcb + offsetof(struct vmcb, save.cs),
4960
                       env, R_CS);
4961
    svm_load_seg_cache(env->vm_vmcb + offsetof(struct vmcb, save.ss),
4962
                       env, R_SS);
4963
    svm_load_seg_cache(env->vm_vmcb + offsetof(struct vmcb, save.ds),
4964
                       env, R_DS);
4965

    
4966
    EIP = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rip));
4967
    env->eip = EIP;
4968
    ESP = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rsp));
4969
    EAX = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rax));
4970
    env->dr[7] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr7));
4971
    env->dr[6] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr6));
4972
    cpu_x86_set_cpl(env, ldub_phys(env->vm_vmcb + offsetof(struct vmcb, save.cpl)));
4973

    
4974
    /* FIXME: guest state consistency checks */
4975

    
4976
    switch(ldub_phys(env->vm_vmcb + offsetof(struct vmcb, control.tlb_ctl))) {
4977
        case TLB_CONTROL_DO_NOTHING:
4978
            break;
4979
        case TLB_CONTROL_FLUSH_ALL_ASID:
4980
            /* FIXME: this is not 100% correct but should work for now */
4981
            tlb_flush(env, 1);
4982
        break;
4983
    }
4984

    
4985
    env->hflags2 |= HF2_GIF_MASK;
4986

    
4987
    if (int_ctl & V_IRQ_MASK) {
4988
        env->interrupt_request |= CPU_INTERRUPT_VIRQ;
4989
    }
4990

    
4991
    /* maybe we need to inject an event */
4992
    event_inj = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj));
4993
    if (event_inj & SVM_EVTINJ_VALID) {
4994
        uint8_t vector = event_inj & SVM_EVTINJ_VEC_MASK;
4995
        uint16_t valid_err = event_inj & SVM_EVTINJ_VALID_ERR;
4996
        uint32_t event_inj_err = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj_err));
4997
        stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj), event_inj & ~SVM_EVTINJ_VALID);
4998

    
4999
        qemu_log_mask(CPU_LOG_TB_IN_ASM, "Injecting(%#hx): ", valid_err);
5000
        /* FIXME: need to implement valid_err */
5001
        switch (event_inj & SVM_EVTINJ_TYPE_MASK) {
5002
        case SVM_EVTINJ_TYPE_INTR:
5003
                env->exception_index = vector;
5004
                env->error_code = event_inj_err;
5005
                env->exception_is_int = 0;
5006
                env->exception_next_eip = -1;
5007
                qemu_log_mask(CPU_LOG_TB_IN_ASM, "INTR");
5008
                /* XXX: is it always correct ? */
5009
                do_interrupt(vector, 0, 0, 0, 1);
5010
                break;
5011
        case SVM_EVTINJ_TYPE_NMI:
5012
                env->exception_index = EXCP02_NMI;
5013
                env->error_code = event_inj_err;
5014
                env->exception_is_int = 0;
5015
                env->exception_next_eip = EIP;
5016
                qemu_log_mask(CPU_LOG_TB_IN_ASM, "NMI");
5017
                cpu_loop_exit();
5018
                break;
5019
        case SVM_EVTINJ_TYPE_EXEPT:
5020
                env->exception_index = vector;
5021
                env->error_code = event_inj_err;
5022
                env->exception_is_int = 0;
5023
                env->exception_next_eip = -1;
5024
                qemu_log_mask(CPU_LOG_TB_IN_ASM, "EXEPT");
5025
                cpu_loop_exit();
5026
                break;
5027
        case SVM_EVTINJ_TYPE_SOFT:
5028
                env->exception_index = vector;
5029
                env->error_code = event_inj_err;
5030
                env->exception_is_int = 1;
5031
                env->exception_next_eip = EIP;
5032
                qemu_log_mask(CPU_LOG_TB_IN_ASM, "SOFT");
5033
                cpu_loop_exit();
5034
                break;
5035
        }
5036
        qemu_log_mask(CPU_LOG_TB_IN_ASM, " %#x %#x\n", env->exception_index, env->error_code);
5037
    }
5038
}
5039

    
5040
void helper_vmmcall(void)
5041
{
5042
    helper_svm_check_intercept_param(SVM_EXIT_VMMCALL, 0);
5043
    raise_exception(EXCP06_ILLOP);
5044
}
5045

    
5046
void helper_vmload(int aflag)
5047
{
5048
    target_ulong addr;
5049
    helper_svm_check_intercept_param(SVM_EXIT_VMLOAD, 0);
5050

    
5051
    if (aflag == 2)
5052