1 /* 2 * x86 segmentation related helpers: 3 * TSS, interrupts, system calls, jumps and call/task gates, descriptors 4 * 5 * Copyright (c) 2003 Fabrice Bellard 6 * 7 * This library is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU Lesser General Public 9 * License as published by the Free Software Foundation; either 10 * version 2.1 of the License, or (at your option) any later version. 11 * 12 * This library is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 15 * Lesser General Public License for more details. 16 * 17 * You should have received a copy of the GNU Lesser General Public 18 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 19 */ 20 21 #include "qemu/osdep.h" 22 #include "cpu.h" 23 #include "qemu/log.h" 24 #include "exec/helper-proto.h" 25 #include "exec/exec-all.h" 26 #include "exec/cpu_ldst.h" 27 #include "exec/log.h" 28 #include "helper-tcg.h" 29 #include "seg_helper.h" 30 31 int get_pg_mode(CPUX86State *env) 32 { 33 int pg_mode = 0; 34 if (!(env->cr[0] & CR0_PG_MASK)) { 35 return 0; 36 } 37 if (env->cr[0] & CR0_WP_MASK) { 38 pg_mode |= PG_MODE_WP; 39 } 40 if (env->cr[4] & CR4_PAE_MASK) { 41 pg_mode |= PG_MODE_PAE; 42 if (env->efer & MSR_EFER_NXE) { 43 pg_mode |= PG_MODE_NXE; 44 } 45 } 46 if (env->cr[4] & CR4_PSE_MASK) { 47 pg_mode |= PG_MODE_PSE; 48 } 49 if (env->cr[4] & CR4_SMEP_MASK) { 50 pg_mode |= PG_MODE_SMEP; 51 } 52 if (env->hflags & HF_LMA_MASK) { 53 pg_mode |= PG_MODE_LMA; 54 if (env->cr[4] & CR4_PKE_MASK) { 55 pg_mode |= PG_MODE_PKE; 56 } 57 if (env->cr[4] & CR4_PKS_MASK) { 58 pg_mode |= PG_MODE_PKS; 59 } 60 if (env->cr[4] & CR4_LA57_MASK) { 61 pg_mode |= PG_MODE_LA57; 62 } 63 } 64 return pg_mode; 65 } 66 67 /* return non zero if error */ 68 static inline int load_segment_ra(CPUX86State *env, uint32_t *e1_ptr, 69 uint32_t *e2_ptr, int selector, 70 uintptr_t retaddr) 71 { 72 SegmentCache *dt; 73 int index; 74 target_ulong ptr; 75 76 if (selector & 0x4) { 77 dt = &env->ldt; 78 } else { 79 dt = &env->gdt; 80 } 81 index = selector & ~7; 82 if ((index + 7) > dt->limit) { 83 return -1; 84 } 85 ptr = dt->base + index; 86 *e1_ptr = cpu_ldl_kernel_ra(env, ptr, retaddr); 87 *e2_ptr = cpu_ldl_kernel_ra(env, ptr + 4, retaddr); 88 return 0; 89 } 90 91 static inline int load_segment(CPUX86State *env, uint32_t *e1_ptr, 92 uint32_t *e2_ptr, int selector) 93 { 94 return load_segment_ra(env, e1_ptr, e2_ptr, selector, 0); 95 } 96 97 static inline unsigned int get_seg_limit(uint32_t e1, uint32_t e2) 98 { 99 unsigned int limit; 100 101 limit = (e1 & 0xffff) | (e2 & 0x000f0000); 102 if (e2 & DESC_G_MASK) { 103 limit = (limit << 12) | 0xfff; 104 } 105 return limit; 106 } 107 108 static inline uint32_t get_seg_base(uint32_t e1, uint32_t e2) 109 { 110 return (e1 >> 16) | ((e2 & 0xff) << 16) | (e2 & 0xff000000); 111 } 112 113 static inline void load_seg_cache_raw_dt(SegmentCache *sc, uint32_t e1, 114 uint32_t e2) 115 { 116 sc->base = get_seg_base(e1, e2); 117 sc->limit = get_seg_limit(e1, e2); 118 sc->flags = e2; 119 } 120 121 /* init the segment cache in vm86 mode. */ 122 static inline void load_seg_vm(CPUX86State *env, int seg, int selector) 123 { 124 selector &= 0xffff; 125 126 cpu_x86_load_seg_cache(env, seg, selector, (selector << 4), 0xffff, 127 DESC_P_MASK | DESC_S_MASK | DESC_W_MASK | 128 DESC_A_MASK | (3 << DESC_DPL_SHIFT)); 129 } 130 131 static inline void get_ss_esp_from_tss(CPUX86State *env, uint32_t *ss_ptr, 132 uint32_t *esp_ptr, int dpl, 133 uintptr_t retaddr) 134 { 135 X86CPU *cpu = env_archcpu(env); 136 int type, index, shift; 137 138 #if 0 139 { 140 int i; 141 printf("TR: base=%p limit=%x\n", env->tr.base, env->tr.limit); 142 for (i = 0; i < env->tr.limit; i++) { 143 printf("%02x ", env->tr.base[i]); 144 if ((i & 7) == 7) { 145 printf("\n"); 146 } 147 } 148 printf("\n"); 149 } 150 #endif 151 152 if (!(env->tr.flags & DESC_P_MASK)) { 153 cpu_abort(CPU(cpu), "invalid tss"); 154 } 155 type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf; 156 if ((type & 7) != 1) { 157 cpu_abort(CPU(cpu), "invalid tss type"); 158 } 159 shift = type >> 3; 160 index = (dpl * 4 + 2) << shift; 161 if (index + (4 << shift) - 1 > env->tr.limit) { 162 raise_exception_err_ra(env, EXCP0A_TSS, env->tr.selector & 0xfffc, retaddr); 163 } 164 if (shift == 0) { 165 *esp_ptr = cpu_lduw_kernel_ra(env, env->tr.base + index, retaddr); 166 *ss_ptr = cpu_lduw_kernel_ra(env, env->tr.base + index + 2, retaddr); 167 } else { 168 *esp_ptr = cpu_ldl_kernel_ra(env, env->tr.base + index, retaddr); 169 *ss_ptr = cpu_lduw_kernel_ra(env, env->tr.base + index + 4, retaddr); 170 } 171 } 172 173 static void tss_load_seg(CPUX86State *env, X86Seg seg_reg, int selector, 174 int cpl, uintptr_t retaddr) 175 { 176 uint32_t e1, e2; 177 int rpl, dpl; 178 179 if ((selector & 0xfffc) != 0) { 180 if (load_segment_ra(env, &e1, &e2, selector, retaddr) != 0) { 181 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 182 } 183 if (!(e2 & DESC_S_MASK)) { 184 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 185 } 186 rpl = selector & 3; 187 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 188 if (seg_reg == R_CS) { 189 if (!(e2 & DESC_CS_MASK)) { 190 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 191 } 192 if (dpl != rpl) { 193 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 194 } 195 } else if (seg_reg == R_SS) { 196 /* SS must be writable data */ 197 if ((e2 & DESC_CS_MASK) || !(e2 & DESC_W_MASK)) { 198 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 199 } 200 if (dpl != cpl || dpl != rpl) { 201 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 202 } 203 } else { 204 /* not readable code */ 205 if ((e2 & DESC_CS_MASK) && !(e2 & DESC_R_MASK)) { 206 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 207 } 208 /* if data or non conforming code, checks the rights */ 209 if (((e2 >> DESC_TYPE_SHIFT) & 0xf) < 12) { 210 if (dpl < cpl || dpl < rpl) { 211 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 212 } 213 } 214 } 215 if (!(e2 & DESC_P_MASK)) { 216 raise_exception_err_ra(env, EXCP0B_NOSEG, selector & 0xfffc, retaddr); 217 } 218 cpu_x86_load_seg_cache(env, seg_reg, selector, 219 get_seg_base(e1, e2), 220 get_seg_limit(e1, e2), 221 e2); 222 } else { 223 if (seg_reg == R_SS || seg_reg == R_CS) { 224 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 225 } 226 } 227 } 228 229 #define SWITCH_TSS_JMP 0 230 #define SWITCH_TSS_IRET 1 231 #define SWITCH_TSS_CALL 2 232 233 /* XXX: restore CPU state in registers (PowerPC case) */ 234 static void switch_tss_ra(CPUX86State *env, int tss_selector, 235 uint32_t e1, uint32_t e2, int source, 236 uint32_t next_eip, uintptr_t retaddr) 237 { 238 int tss_limit, tss_limit_max, type, old_tss_limit_max, old_type, v1, v2, i; 239 target_ulong tss_base; 240 uint32_t new_regs[8], new_segs[6]; 241 uint32_t new_eflags, new_eip, new_cr3, new_ldt, new_trap; 242 uint32_t old_eflags, eflags_mask; 243 SegmentCache *dt; 244 int index; 245 target_ulong ptr; 246 247 type = (e2 >> DESC_TYPE_SHIFT) & 0xf; 248 LOG_PCALL("switch_tss: sel=0x%04x type=%d src=%d\n", tss_selector, type, 249 source); 250 251 /* if task gate, we read the TSS segment and we load it */ 252 if (type == 5) { 253 if (!(e2 & DESC_P_MASK)) { 254 raise_exception_err_ra(env, EXCP0B_NOSEG, tss_selector & 0xfffc, retaddr); 255 } 256 tss_selector = e1 >> 16; 257 if (tss_selector & 4) { 258 raise_exception_err_ra(env, EXCP0A_TSS, tss_selector & 0xfffc, retaddr); 259 } 260 if (load_segment_ra(env, &e1, &e2, tss_selector, retaddr) != 0) { 261 raise_exception_err_ra(env, EXCP0D_GPF, tss_selector & 0xfffc, retaddr); 262 } 263 if (e2 & DESC_S_MASK) { 264 raise_exception_err_ra(env, EXCP0D_GPF, tss_selector & 0xfffc, retaddr); 265 } 266 type = (e2 >> DESC_TYPE_SHIFT) & 0xf; 267 if ((type & 7) != 1) { 268 raise_exception_err_ra(env, EXCP0D_GPF, tss_selector & 0xfffc, retaddr); 269 } 270 } 271 272 if (!(e2 & DESC_P_MASK)) { 273 raise_exception_err_ra(env, EXCP0B_NOSEG, tss_selector & 0xfffc, retaddr); 274 } 275 276 if (type & 8) { 277 tss_limit_max = 103; 278 } else { 279 tss_limit_max = 43; 280 } 281 tss_limit = get_seg_limit(e1, e2); 282 tss_base = get_seg_base(e1, e2); 283 if ((tss_selector & 4) != 0 || 284 tss_limit < tss_limit_max) { 285 raise_exception_err_ra(env, EXCP0A_TSS, tss_selector & 0xfffc, retaddr); 286 } 287 old_type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf; 288 if (old_type & 8) { 289 old_tss_limit_max = 103; 290 } else { 291 old_tss_limit_max = 43; 292 } 293 294 /* read all the registers from the new TSS */ 295 if (type & 8) { 296 /* 32 bit */ 297 new_cr3 = cpu_ldl_kernel_ra(env, tss_base + 0x1c, retaddr); 298 new_eip = cpu_ldl_kernel_ra(env, tss_base + 0x20, retaddr); 299 new_eflags = cpu_ldl_kernel_ra(env, tss_base + 0x24, retaddr); 300 for (i = 0; i < 8; i++) { 301 new_regs[i] = cpu_ldl_kernel_ra(env, tss_base + (0x28 + i * 4), 302 retaddr); 303 } 304 for (i = 0; i < 6; i++) { 305 new_segs[i] = cpu_lduw_kernel_ra(env, tss_base + (0x48 + i * 4), 306 retaddr); 307 } 308 new_ldt = cpu_lduw_kernel_ra(env, tss_base + 0x60, retaddr); 309 new_trap = cpu_ldl_kernel_ra(env, tss_base + 0x64, retaddr); 310 } else { 311 /* 16 bit */ 312 new_cr3 = 0; 313 new_eip = cpu_lduw_kernel_ra(env, tss_base + 0x0e, retaddr); 314 new_eflags = cpu_lduw_kernel_ra(env, tss_base + 0x10, retaddr); 315 for (i = 0; i < 8; i++) { 316 new_regs[i] = cpu_lduw_kernel_ra(env, tss_base + (0x12 + i * 2), retaddr); 317 } 318 for (i = 0; i < 4; i++) { 319 new_segs[i] = cpu_lduw_kernel_ra(env, tss_base + (0x22 + i * 2), 320 retaddr); 321 } 322 new_ldt = cpu_lduw_kernel_ra(env, tss_base + 0x2a, retaddr); 323 new_segs[R_FS] = 0; 324 new_segs[R_GS] = 0; 325 new_trap = 0; 326 } 327 /* XXX: avoid a compiler warning, see 328 http://support.amd.com/us/Processor_TechDocs/24593.pdf 329 chapters 12.2.5 and 13.2.4 on how to implement TSS Trap bit */ 330 (void)new_trap; 331 332 /* NOTE: we must avoid memory exceptions during the task switch, 333 so we make dummy accesses before */ 334 /* XXX: it can still fail in some cases, so a bigger hack is 335 necessary to valid the TLB after having done the accesses */ 336 337 v1 = cpu_ldub_kernel_ra(env, env->tr.base, retaddr); 338 v2 = cpu_ldub_kernel_ra(env, env->tr.base + old_tss_limit_max, retaddr); 339 cpu_stb_kernel_ra(env, env->tr.base, v1, retaddr); 340 cpu_stb_kernel_ra(env, env->tr.base + old_tss_limit_max, v2, retaddr); 341 342 /* clear busy bit (it is restartable) */ 343 if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_IRET) { 344 target_ulong ptr; 345 uint32_t e2; 346 347 ptr = env->gdt.base + (env->tr.selector & ~7); 348 e2 = cpu_ldl_kernel_ra(env, ptr + 4, retaddr); 349 e2 &= ~DESC_TSS_BUSY_MASK; 350 cpu_stl_kernel_ra(env, ptr + 4, e2, retaddr); 351 } 352 old_eflags = cpu_compute_eflags(env); 353 if (source == SWITCH_TSS_IRET) { 354 old_eflags &= ~NT_MASK; 355 } 356 357 /* save the current state in the old TSS */ 358 if (old_type & 8) { 359 /* 32 bit */ 360 cpu_stl_kernel_ra(env, env->tr.base + 0x20, next_eip, retaddr); 361 cpu_stl_kernel_ra(env, env->tr.base + 0x24, old_eflags, retaddr); 362 cpu_stl_kernel_ra(env, env->tr.base + (0x28 + 0 * 4), env->regs[R_EAX], retaddr); 363 cpu_stl_kernel_ra(env, env->tr.base + (0x28 + 1 * 4), env->regs[R_ECX], retaddr); 364 cpu_stl_kernel_ra(env, env->tr.base + (0x28 + 2 * 4), env->regs[R_EDX], retaddr); 365 cpu_stl_kernel_ra(env, env->tr.base + (0x28 + 3 * 4), env->regs[R_EBX], retaddr); 366 cpu_stl_kernel_ra(env, env->tr.base + (0x28 + 4 * 4), env->regs[R_ESP], retaddr); 367 cpu_stl_kernel_ra(env, env->tr.base + (0x28 + 5 * 4), env->regs[R_EBP], retaddr); 368 cpu_stl_kernel_ra(env, env->tr.base + (0x28 + 6 * 4), env->regs[R_ESI], retaddr); 369 cpu_stl_kernel_ra(env, env->tr.base + (0x28 + 7 * 4), env->regs[R_EDI], retaddr); 370 for (i = 0; i < 6; i++) { 371 cpu_stw_kernel_ra(env, env->tr.base + (0x48 + i * 4), 372 env->segs[i].selector, retaddr); 373 } 374 } else { 375 /* 16 bit */ 376 cpu_stw_kernel_ra(env, env->tr.base + 0x0e, next_eip, retaddr); 377 cpu_stw_kernel_ra(env, env->tr.base + 0x10, old_eflags, retaddr); 378 cpu_stw_kernel_ra(env, env->tr.base + (0x12 + 0 * 2), env->regs[R_EAX], retaddr); 379 cpu_stw_kernel_ra(env, env->tr.base + (0x12 + 1 * 2), env->regs[R_ECX], retaddr); 380 cpu_stw_kernel_ra(env, env->tr.base + (0x12 + 2 * 2), env->regs[R_EDX], retaddr); 381 cpu_stw_kernel_ra(env, env->tr.base + (0x12 + 3 * 2), env->regs[R_EBX], retaddr); 382 cpu_stw_kernel_ra(env, env->tr.base + (0x12 + 4 * 2), env->regs[R_ESP], retaddr); 383 cpu_stw_kernel_ra(env, env->tr.base + (0x12 + 5 * 2), env->regs[R_EBP], retaddr); 384 cpu_stw_kernel_ra(env, env->tr.base + (0x12 + 6 * 2), env->regs[R_ESI], retaddr); 385 cpu_stw_kernel_ra(env, env->tr.base + (0x12 + 7 * 2), env->regs[R_EDI], retaddr); 386 for (i = 0; i < 4; i++) { 387 cpu_stw_kernel_ra(env, env->tr.base + (0x22 + i * 2), 388 env->segs[i].selector, retaddr); 389 } 390 } 391 392 /* now if an exception occurs, it will occurs in the next task 393 context */ 394 395 if (source == SWITCH_TSS_CALL) { 396 cpu_stw_kernel_ra(env, tss_base, env->tr.selector, retaddr); 397 new_eflags |= NT_MASK; 398 } 399 400 /* set busy bit */ 401 if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_CALL) { 402 target_ulong ptr; 403 uint32_t e2; 404 405 ptr = env->gdt.base + (tss_selector & ~7); 406 e2 = cpu_ldl_kernel_ra(env, ptr + 4, retaddr); 407 e2 |= DESC_TSS_BUSY_MASK; 408 cpu_stl_kernel_ra(env, ptr + 4, e2, retaddr); 409 } 410 411 /* set the new CPU state */ 412 /* from this point, any exception which occurs can give problems */ 413 env->cr[0] |= CR0_TS_MASK; 414 env->hflags |= HF_TS_MASK; 415 env->tr.selector = tss_selector; 416 env->tr.base = tss_base; 417 env->tr.limit = tss_limit; 418 env->tr.flags = e2 & ~DESC_TSS_BUSY_MASK; 419 420 if ((type & 8) && (env->cr[0] & CR0_PG_MASK)) { 421 cpu_x86_update_cr3(env, new_cr3); 422 } 423 424 /* load all registers without an exception, then reload them with 425 possible exception */ 426 env->eip = new_eip; 427 eflags_mask = TF_MASK | AC_MASK | ID_MASK | 428 IF_MASK | IOPL_MASK | VM_MASK | RF_MASK | NT_MASK; 429 if (type & 8) { 430 cpu_load_eflags(env, new_eflags, eflags_mask); 431 for (i = 0; i < 8; i++) { 432 env->regs[i] = new_regs[i]; 433 } 434 } else { 435 cpu_load_eflags(env, new_eflags, eflags_mask & 0xffff); 436 for (i = 0; i < 8; i++) { 437 env->regs[i] = (env->regs[i] & 0xffff0000) | new_regs[i]; 438 } 439 } 440 if (new_eflags & VM_MASK) { 441 for (i = 0; i < 6; i++) { 442 load_seg_vm(env, i, new_segs[i]); 443 } 444 } else { 445 /* first just selectors as the rest may trigger exceptions */ 446 for (i = 0; i < 6; i++) { 447 cpu_x86_load_seg_cache(env, i, new_segs[i], 0, 0, 0); 448 } 449 } 450 451 env->ldt.selector = new_ldt & ~4; 452 env->ldt.base = 0; 453 env->ldt.limit = 0; 454 env->ldt.flags = 0; 455 456 /* load the LDT */ 457 if (new_ldt & 4) { 458 raise_exception_err_ra(env, EXCP0A_TSS, new_ldt & 0xfffc, retaddr); 459 } 460 461 if ((new_ldt & 0xfffc) != 0) { 462 dt = &env->gdt; 463 index = new_ldt & ~7; 464 if ((index + 7) > dt->limit) { 465 raise_exception_err_ra(env, EXCP0A_TSS, new_ldt & 0xfffc, retaddr); 466 } 467 ptr = dt->base + index; 468 e1 = cpu_ldl_kernel_ra(env, ptr, retaddr); 469 e2 = cpu_ldl_kernel_ra(env, ptr + 4, retaddr); 470 if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2) { 471 raise_exception_err_ra(env, EXCP0A_TSS, new_ldt & 0xfffc, retaddr); 472 } 473 if (!(e2 & DESC_P_MASK)) { 474 raise_exception_err_ra(env, EXCP0A_TSS, new_ldt & 0xfffc, retaddr); 475 } 476 load_seg_cache_raw_dt(&env->ldt, e1, e2); 477 } 478 479 /* load the segments */ 480 if (!(new_eflags & VM_MASK)) { 481 int cpl = new_segs[R_CS] & 3; 482 tss_load_seg(env, R_CS, new_segs[R_CS], cpl, retaddr); 483 tss_load_seg(env, R_SS, new_segs[R_SS], cpl, retaddr); 484 tss_load_seg(env, R_ES, new_segs[R_ES], cpl, retaddr); 485 tss_load_seg(env, R_DS, new_segs[R_DS], cpl, retaddr); 486 tss_load_seg(env, R_FS, new_segs[R_FS], cpl, retaddr); 487 tss_load_seg(env, R_GS, new_segs[R_GS], cpl, retaddr); 488 } 489 490 /* check that env->eip is in the CS segment limits */ 491 if (new_eip > env->segs[R_CS].limit) { 492 /* XXX: different exception if CALL? */ 493 raise_exception_err_ra(env, EXCP0D_GPF, 0, retaddr); 494 } 495 496 #ifndef CONFIG_USER_ONLY 497 /* reset local breakpoints */ 498 if (env->dr[7] & DR7_LOCAL_BP_MASK) { 499 cpu_x86_update_dr7(env, env->dr[7] & ~DR7_LOCAL_BP_MASK); 500 } 501 #endif 502 } 503 504 static void switch_tss(CPUX86State *env, int tss_selector, 505 uint32_t e1, uint32_t e2, int source, 506 uint32_t next_eip) 507 { 508 switch_tss_ra(env, tss_selector, e1, e2, source, next_eip, 0); 509 } 510 511 static inline unsigned int get_sp_mask(unsigned int e2) 512 { 513 #ifdef TARGET_X86_64 514 if (e2 & DESC_L_MASK) { 515 return 0; 516 } else 517 #endif 518 if (e2 & DESC_B_MASK) { 519 return 0xffffffff; 520 } else { 521 return 0xffff; 522 } 523 } 524 525 int exception_has_error_code(int intno) 526 { 527 switch (intno) { 528 case 8: 529 case 10: 530 case 11: 531 case 12: 532 case 13: 533 case 14: 534 case 17: 535 return 1; 536 } 537 return 0; 538 } 539 540 #ifdef TARGET_X86_64 541 #define SET_ESP(val, sp_mask) \ 542 do { \ 543 if ((sp_mask) == 0xffff) { \ 544 env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | \ 545 ((val) & 0xffff); \ 546 } else if ((sp_mask) == 0xffffffffLL) { \ 547 env->regs[R_ESP] = (uint32_t)(val); \ 548 } else { \ 549 env->regs[R_ESP] = (val); \ 550 } \ 551 } while (0) 552 #else 553 #define SET_ESP(val, sp_mask) \ 554 do { \ 555 env->regs[R_ESP] = (env->regs[R_ESP] & ~(sp_mask)) | \ 556 ((val) & (sp_mask)); \ 557 } while (0) 558 #endif 559 560 /* in 64-bit machines, this can overflow. So this segment addition macro 561 * can be used to trim the value to 32-bit whenever needed */ 562 #define SEG_ADDL(ssp, sp, sp_mask) ((uint32_t)((ssp) + (sp & (sp_mask)))) 563 564 /* XXX: add a is_user flag to have proper security support */ 565 #define PUSHW_RA(ssp, sp, sp_mask, val, ra) \ 566 { \ 567 sp -= 2; \ 568 cpu_stw_kernel_ra(env, (ssp) + (sp & (sp_mask)), (val), ra); \ 569 } 570 571 #define PUSHL_RA(ssp, sp, sp_mask, val, ra) \ 572 { \ 573 sp -= 4; \ 574 cpu_stl_kernel_ra(env, SEG_ADDL(ssp, sp, sp_mask), (uint32_t)(val), ra); \ 575 } 576 577 #define POPW_RA(ssp, sp, sp_mask, val, ra) \ 578 { \ 579 val = cpu_lduw_kernel_ra(env, (ssp) + (sp & (sp_mask)), ra); \ 580 sp += 2; \ 581 } 582 583 #define POPL_RA(ssp, sp, sp_mask, val, ra) \ 584 { \ 585 val = (uint32_t)cpu_ldl_kernel_ra(env, SEG_ADDL(ssp, sp, sp_mask), ra); \ 586 sp += 4; \ 587 } 588 589 #define PUSHW(ssp, sp, sp_mask, val) PUSHW_RA(ssp, sp, sp_mask, val, 0) 590 #define PUSHL(ssp, sp, sp_mask, val) PUSHL_RA(ssp, sp, sp_mask, val, 0) 591 #define POPW(ssp, sp, sp_mask, val) POPW_RA(ssp, sp, sp_mask, val, 0) 592 #define POPL(ssp, sp, sp_mask, val) POPL_RA(ssp, sp, sp_mask, val, 0) 593 594 /* protected mode interrupt */ 595 static void do_interrupt_protected(CPUX86State *env, int intno, int is_int, 596 int error_code, unsigned int next_eip, 597 int is_hw) 598 { 599 SegmentCache *dt; 600 target_ulong ptr, ssp; 601 int type, dpl, selector, ss_dpl, cpl; 602 int has_error_code, new_stack, shift; 603 uint32_t e1, e2, offset, ss = 0, esp, ss_e1 = 0, ss_e2 = 0; 604 uint32_t old_eip, sp_mask; 605 int vm86 = env->eflags & VM_MASK; 606 607 has_error_code = 0; 608 if (!is_int && !is_hw) { 609 has_error_code = exception_has_error_code(intno); 610 } 611 if (is_int) { 612 old_eip = next_eip; 613 } else { 614 old_eip = env->eip; 615 } 616 617 dt = &env->idt; 618 if (intno * 8 + 7 > dt->limit) { 619 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2); 620 } 621 ptr = dt->base + intno * 8; 622 e1 = cpu_ldl_kernel(env, ptr); 623 e2 = cpu_ldl_kernel(env, ptr + 4); 624 /* check gate type */ 625 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f; 626 switch (type) { 627 case 5: /* task gate */ 628 case 6: /* 286 interrupt gate */ 629 case 7: /* 286 trap gate */ 630 case 14: /* 386 interrupt gate */ 631 case 15: /* 386 trap gate */ 632 break; 633 default: 634 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2); 635 break; 636 } 637 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 638 cpl = env->hflags & HF_CPL_MASK; 639 /* check privilege if software int */ 640 if (is_int && dpl < cpl) { 641 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2); 642 } 643 644 if (type == 5) { 645 /* task gate */ 646 /* must do that check here to return the correct error code */ 647 if (!(e2 & DESC_P_MASK)) { 648 raise_exception_err(env, EXCP0B_NOSEG, intno * 8 + 2); 649 } 650 switch_tss(env, intno * 8, e1, e2, SWITCH_TSS_CALL, old_eip); 651 if (has_error_code) { 652 int type; 653 uint32_t mask; 654 655 /* push the error code */ 656 type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf; 657 shift = type >> 3; 658 if (env->segs[R_SS].flags & DESC_B_MASK) { 659 mask = 0xffffffff; 660 } else { 661 mask = 0xffff; 662 } 663 esp = (env->regs[R_ESP] - (2 << shift)) & mask; 664 ssp = env->segs[R_SS].base + esp; 665 if (shift) { 666 cpu_stl_kernel(env, ssp, error_code); 667 } else { 668 cpu_stw_kernel(env, ssp, error_code); 669 } 670 SET_ESP(esp, mask); 671 } 672 return; 673 } 674 675 /* Otherwise, trap or interrupt gate */ 676 677 /* check valid bit */ 678 if (!(e2 & DESC_P_MASK)) { 679 raise_exception_err(env, EXCP0B_NOSEG, intno * 8 + 2); 680 } 681 selector = e1 >> 16; 682 offset = (e2 & 0xffff0000) | (e1 & 0x0000ffff); 683 if ((selector & 0xfffc) == 0) { 684 raise_exception_err(env, EXCP0D_GPF, 0); 685 } 686 if (load_segment(env, &e1, &e2, selector) != 0) { 687 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 688 } 689 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK))) { 690 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 691 } 692 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 693 if (dpl > cpl) { 694 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 695 } 696 if (!(e2 & DESC_P_MASK)) { 697 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc); 698 } 699 if (e2 & DESC_C_MASK) { 700 dpl = cpl; 701 } 702 if (dpl < cpl) { 703 /* to inner privilege */ 704 get_ss_esp_from_tss(env, &ss, &esp, dpl, 0); 705 if ((ss & 0xfffc) == 0) { 706 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc); 707 } 708 if ((ss & 3) != dpl) { 709 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc); 710 } 711 if (load_segment(env, &ss_e1, &ss_e2, ss) != 0) { 712 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc); 713 } 714 ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3; 715 if (ss_dpl != dpl) { 716 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc); 717 } 718 if (!(ss_e2 & DESC_S_MASK) || 719 (ss_e2 & DESC_CS_MASK) || 720 !(ss_e2 & DESC_W_MASK)) { 721 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc); 722 } 723 if (!(ss_e2 & DESC_P_MASK)) { 724 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc); 725 } 726 new_stack = 1; 727 sp_mask = get_sp_mask(ss_e2); 728 ssp = get_seg_base(ss_e1, ss_e2); 729 } else { 730 /* to same privilege */ 731 if (vm86) { 732 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 733 } 734 new_stack = 0; 735 sp_mask = get_sp_mask(env->segs[R_SS].flags); 736 ssp = env->segs[R_SS].base; 737 esp = env->regs[R_ESP]; 738 } 739 740 shift = type >> 3; 741 742 #if 0 743 /* XXX: check that enough room is available */ 744 push_size = 6 + (new_stack << 2) + (has_error_code << 1); 745 if (vm86) { 746 push_size += 8; 747 } 748 push_size <<= shift; 749 #endif 750 if (shift == 1) { 751 if (new_stack) { 752 if (vm86) { 753 PUSHL(ssp, esp, sp_mask, env->segs[R_GS].selector); 754 PUSHL(ssp, esp, sp_mask, env->segs[R_FS].selector); 755 PUSHL(ssp, esp, sp_mask, env->segs[R_DS].selector); 756 PUSHL(ssp, esp, sp_mask, env->segs[R_ES].selector); 757 } 758 PUSHL(ssp, esp, sp_mask, env->segs[R_SS].selector); 759 PUSHL(ssp, esp, sp_mask, env->regs[R_ESP]); 760 } 761 PUSHL(ssp, esp, sp_mask, cpu_compute_eflags(env)); 762 PUSHL(ssp, esp, sp_mask, env->segs[R_CS].selector); 763 PUSHL(ssp, esp, sp_mask, old_eip); 764 if (has_error_code) { 765 PUSHL(ssp, esp, sp_mask, error_code); 766 } 767 } else { 768 if (new_stack) { 769 if (vm86) { 770 PUSHW(ssp, esp, sp_mask, env->segs[R_GS].selector); 771 PUSHW(ssp, esp, sp_mask, env->segs[R_FS].selector); 772 PUSHW(ssp, esp, sp_mask, env->segs[R_DS].selector); 773 PUSHW(ssp, esp, sp_mask, env->segs[R_ES].selector); 774 } 775 PUSHW(ssp, esp, sp_mask, env->segs[R_SS].selector); 776 PUSHW(ssp, esp, sp_mask, env->regs[R_ESP]); 777 } 778 PUSHW(ssp, esp, sp_mask, cpu_compute_eflags(env)); 779 PUSHW(ssp, esp, sp_mask, env->segs[R_CS].selector); 780 PUSHW(ssp, esp, sp_mask, old_eip); 781 if (has_error_code) { 782 PUSHW(ssp, esp, sp_mask, error_code); 783 } 784 } 785 786 /* interrupt gate clear IF mask */ 787 if ((type & 1) == 0) { 788 env->eflags &= ~IF_MASK; 789 } 790 env->eflags &= ~(TF_MASK | VM_MASK | RF_MASK | NT_MASK); 791 792 if (new_stack) { 793 if (vm86) { 794 cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0, 0); 795 cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0, 0); 796 cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0, 0); 797 cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0, 0); 798 } 799 ss = (ss & ~3) | dpl; 800 cpu_x86_load_seg_cache(env, R_SS, ss, 801 ssp, get_seg_limit(ss_e1, ss_e2), ss_e2); 802 } 803 SET_ESP(esp, sp_mask); 804 805 selector = (selector & ~3) | dpl; 806 cpu_x86_load_seg_cache(env, R_CS, selector, 807 get_seg_base(e1, e2), 808 get_seg_limit(e1, e2), 809 e2); 810 env->eip = offset; 811 } 812 813 #ifdef TARGET_X86_64 814 815 #define PUSHQ_RA(sp, val, ra) \ 816 { \ 817 sp -= 8; \ 818 cpu_stq_kernel_ra(env, sp, (val), ra); \ 819 } 820 821 #define POPQ_RA(sp, val, ra) \ 822 { \ 823 val = cpu_ldq_kernel_ra(env, sp, ra); \ 824 sp += 8; \ 825 } 826 827 #define PUSHQ(sp, val) PUSHQ_RA(sp, val, 0) 828 #define POPQ(sp, val) POPQ_RA(sp, val, 0) 829 830 static inline target_ulong get_rsp_from_tss(CPUX86State *env, int level) 831 { 832 X86CPU *cpu = env_archcpu(env); 833 int index, pg_mode; 834 target_ulong rsp; 835 int32_t sext; 836 837 #if 0 838 printf("TR: base=" TARGET_FMT_lx " limit=%x\n", 839 env->tr.base, env->tr.limit); 840 #endif 841 842 if (!(env->tr.flags & DESC_P_MASK)) { 843 cpu_abort(CPU(cpu), "invalid tss"); 844 } 845 index = 8 * level + 4; 846 if ((index + 7) > env->tr.limit) { 847 raise_exception_err(env, EXCP0A_TSS, env->tr.selector & 0xfffc); 848 } 849 850 rsp = cpu_ldq_kernel(env, env->tr.base + index); 851 852 /* test virtual address sign extension */ 853 pg_mode = get_pg_mode(env); 854 sext = (int64_t)rsp >> (pg_mode & PG_MODE_LA57 ? 56 : 47); 855 if (sext != 0 && sext != -1) { 856 raise_exception_err(env, EXCP0C_STACK, 0); 857 } 858 859 return rsp; 860 } 861 862 /* 64 bit interrupt */ 863 static void do_interrupt64(CPUX86State *env, int intno, int is_int, 864 int error_code, target_ulong next_eip, int is_hw) 865 { 866 SegmentCache *dt; 867 target_ulong ptr; 868 int type, dpl, selector, cpl, ist; 869 int has_error_code, new_stack; 870 uint32_t e1, e2, e3, ss; 871 target_ulong old_eip, esp, offset; 872 873 has_error_code = 0; 874 if (!is_int && !is_hw) { 875 has_error_code = exception_has_error_code(intno); 876 } 877 if (is_int) { 878 old_eip = next_eip; 879 } else { 880 old_eip = env->eip; 881 } 882 883 dt = &env->idt; 884 if (intno * 16 + 15 > dt->limit) { 885 raise_exception_err(env, EXCP0D_GPF, intno * 16 + 2); 886 } 887 ptr = dt->base + intno * 16; 888 e1 = cpu_ldl_kernel(env, ptr); 889 e2 = cpu_ldl_kernel(env, ptr + 4); 890 e3 = cpu_ldl_kernel(env, ptr + 8); 891 /* check gate type */ 892 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f; 893 switch (type) { 894 case 14: /* 386 interrupt gate */ 895 case 15: /* 386 trap gate */ 896 break; 897 default: 898 raise_exception_err(env, EXCP0D_GPF, intno * 16 + 2); 899 break; 900 } 901 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 902 cpl = env->hflags & HF_CPL_MASK; 903 /* check privilege if software int */ 904 if (is_int && dpl < cpl) { 905 raise_exception_err(env, EXCP0D_GPF, intno * 16 + 2); 906 } 907 /* check valid bit */ 908 if (!(e2 & DESC_P_MASK)) { 909 raise_exception_err(env, EXCP0B_NOSEG, intno * 16 + 2); 910 } 911 selector = e1 >> 16; 912 offset = ((target_ulong)e3 << 32) | (e2 & 0xffff0000) | (e1 & 0x0000ffff); 913 ist = e2 & 7; 914 if ((selector & 0xfffc) == 0) { 915 raise_exception_err(env, EXCP0D_GPF, 0); 916 } 917 918 if (load_segment(env, &e1, &e2, selector) != 0) { 919 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 920 } 921 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK))) { 922 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 923 } 924 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 925 if (dpl > cpl) { 926 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 927 } 928 if (!(e2 & DESC_P_MASK)) { 929 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc); 930 } 931 if (!(e2 & DESC_L_MASK) || (e2 & DESC_B_MASK)) { 932 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 933 } 934 if (e2 & DESC_C_MASK) { 935 dpl = cpl; 936 } 937 if (dpl < cpl || ist != 0) { 938 /* to inner privilege */ 939 new_stack = 1; 940 esp = get_rsp_from_tss(env, ist != 0 ? ist + 3 : dpl); 941 ss = 0; 942 } else { 943 /* to same privilege */ 944 if (env->eflags & VM_MASK) { 945 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 946 } 947 new_stack = 0; 948 esp = env->regs[R_ESP]; 949 } 950 esp &= ~0xfLL; /* align stack */ 951 952 PUSHQ(esp, env->segs[R_SS].selector); 953 PUSHQ(esp, env->regs[R_ESP]); 954 PUSHQ(esp, cpu_compute_eflags(env)); 955 PUSHQ(esp, env->segs[R_CS].selector); 956 PUSHQ(esp, old_eip); 957 if (has_error_code) { 958 PUSHQ(esp, error_code); 959 } 960 961 /* interrupt gate clear IF mask */ 962 if ((type & 1) == 0) { 963 env->eflags &= ~IF_MASK; 964 } 965 env->eflags &= ~(TF_MASK | VM_MASK | RF_MASK | NT_MASK); 966 967 if (new_stack) { 968 ss = 0 | dpl; 969 cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, dpl << DESC_DPL_SHIFT); 970 } 971 env->regs[R_ESP] = esp; 972 973 selector = (selector & ~3) | dpl; 974 cpu_x86_load_seg_cache(env, R_CS, selector, 975 get_seg_base(e1, e2), 976 get_seg_limit(e1, e2), 977 e2); 978 env->eip = offset; 979 } 980 981 void helper_sysret(CPUX86State *env, int dflag) 982 { 983 int cpl, selector; 984 985 if (!(env->efer & MSR_EFER_SCE)) { 986 raise_exception_err_ra(env, EXCP06_ILLOP, 0, GETPC()); 987 } 988 cpl = env->hflags & HF_CPL_MASK; 989 if (!(env->cr[0] & CR0_PE_MASK) || cpl != 0) { 990 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 991 } 992 selector = (env->star >> 48) & 0xffff; 993 if (env->hflags & HF_LMA_MASK) { 994 cpu_load_eflags(env, (uint32_t)(env->regs[11]), TF_MASK | AC_MASK 995 | ID_MASK | IF_MASK | IOPL_MASK | VM_MASK | RF_MASK | 996 NT_MASK); 997 if (dflag == 2) { 998 cpu_x86_load_seg_cache(env, R_CS, (selector + 16) | 3, 999 0, 0xffffffff, 1000 DESC_G_MASK | DESC_P_MASK | 1001 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 1002 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | 1003 DESC_L_MASK); 1004 env->eip = env->regs[R_ECX]; 1005 } else { 1006 cpu_x86_load_seg_cache(env, R_CS, selector | 3, 1007 0, 0xffffffff, 1008 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 1009 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 1010 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK); 1011 env->eip = (uint32_t)env->regs[R_ECX]; 1012 } 1013 cpu_x86_load_seg_cache(env, R_SS, (selector + 8) | 3, 1014 0, 0xffffffff, 1015 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 1016 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 1017 DESC_W_MASK | DESC_A_MASK); 1018 } else { 1019 env->eflags |= IF_MASK; 1020 cpu_x86_load_seg_cache(env, R_CS, selector | 3, 1021 0, 0xffffffff, 1022 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 1023 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 1024 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK); 1025 env->eip = (uint32_t)env->regs[R_ECX]; 1026 cpu_x86_load_seg_cache(env, R_SS, (selector + 8) | 3, 1027 0, 0xffffffff, 1028 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 1029 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 1030 DESC_W_MASK | DESC_A_MASK); 1031 } 1032 } 1033 #endif /* TARGET_X86_64 */ 1034 1035 /* real mode interrupt */ 1036 static void do_interrupt_real(CPUX86State *env, int intno, int is_int, 1037 int error_code, unsigned int next_eip) 1038 { 1039 SegmentCache *dt; 1040 target_ulong ptr, ssp; 1041 int selector; 1042 uint32_t offset, esp; 1043 uint32_t old_cs, old_eip; 1044 1045 /* real mode (simpler!) */ 1046 dt = &env->idt; 1047 if (intno * 4 + 3 > dt->limit) { 1048 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2); 1049 } 1050 ptr = dt->base + intno * 4; 1051 offset = cpu_lduw_kernel(env, ptr); 1052 selector = cpu_lduw_kernel(env, ptr + 2); 1053 esp = env->regs[R_ESP]; 1054 ssp = env->segs[R_SS].base; 1055 if (is_int) { 1056 old_eip = next_eip; 1057 } else { 1058 old_eip = env->eip; 1059 } 1060 old_cs = env->segs[R_CS].selector; 1061 /* XXX: use SS segment size? */ 1062 PUSHW(ssp, esp, 0xffff, cpu_compute_eflags(env)); 1063 PUSHW(ssp, esp, 0xffff, old_cs); 1064 PUSHW(ssp, esp, 0xffff, old_eip); 1065 1066 /* update processor state */ 1067 env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | (esp & 0xffff); 1068 env->eip = offset; 1069 env->segs[R_CS].selector = selector; 1070 env->segs[R_CS].base = (selector << 4); 1071 env->eflags &= ~(IF_MASK | TF_MASK | AC_MASK | RF_MASK); 1072 } 1073 1074 /* 1075 * Begin execution of an interruption. is_int is TRUE if coming from 1076 * the int instruction. next_eip is the env->eip value AFTER the interrupt 1077 * instruction. It is only relevant if is_int is TRUE. 1078 */ 1079 void do_interrupt_all(X86CPU *cpu, int intno, int is_int, 1080 int error_code, target_ulong next_eip, int is_hw) 1081 { 1082 CPUX86State *env = &cpu->env; 1083 1084 if (qemu_loglevel_mask(CPU_LOG_INT)) { 1085 if ((env->cr[0] & CR0_PE_MASK)) { 1086 static int count; 1087 1088 qemu_log("%6d: v=%02x e=%04x i=%d cpl=%d IP=%04x:" TARGET_FMT_lx 1089 " pc=" TARGET_FMT_lx " SP=%04x:" TARGET_FMT_lx, 1090 count, intno, error_code, is_int, 1091 env->hflags & HF_CPL_MASK, 1092 env->segs[R_CS].selector, env->eip, 1093 (int)env->segs[R_CS].base + env->eip, 1094 env->segs[R_SS].selector, env->regs[R_ESP]); 1095 if (intno == 0x0e) { 1096 qemu_log(" CR2=" TARGET_FMT_lx, env->cr[2]); 1097 } else { 1098 qemu_log(" env->regs[R_EAX]=" TARGET_FMT_lx, env->regs[R_EAX]); 1099 } 1100 qemu_log("\n"); 1101 log_cpu_state(CPU(cpu), CPU_DUMP_CCOP); 1102 #if 0 1103 { 1104 int i; 1105 target_ulong ptr; 1106 1107 qemu_log(" code="); 1108 ptr = env->segs[R_CS].base + env->eip; 1109 for (i = 0; i < 16; i++) { 1110 qemu_log(" %02x", ldub(ptr + i)); 1111 } 1112 qemu_log("\n"); 1113 } 1114 #endif 1115 count++; 1116 } 1117 } 1118 if (env->cr[0] & CR0_PE_MASK) { 1119 #if !defined(CONFIG_USER_ONLY) 1120 if (env->hflags & HF_GUEST_MASK) { 1121 handle_even_inj(env, intno, is_int, error_code, is_hw, 0); 1122 } 1123 #endif 1124 #ifdef TARGET_X86_64 1125 if (env->hflags & HF_LMA_MASK) { 1126 do_interrupt64(env, intno, is_int, error_code, next_eip, is_hw); 1127 } else 1128 #endif 1129 { 1130 do_interrupt_protected(env, intno, is_int, error_code, next_eip, 1131 is_hw); 1132 } 1133 } else { 1134 #if !defined(CONFIG_USER_ONLY) 1135 if (env->hflags & HF_GUEST_MASK) { 1136 handle_even_inj(env, intno, is_int, error_code, is_hw, 1); 1137 } 1138 #endif 1139 do_interrupt_real(env, intno, is_int, error_code, next_eip); 1140 } 1141 1142 #if !defined(CONFIG_USER_ONLY) 1143 if (env->hflags & HF_GUEST_MASK) { 1144 CPUState *cs = CPU(cpu); 1145 uint32_t event_inj = x86_ldl_phys(cs, env->vm_vmcb + 1146 offsetof(struct vmcb, 1147 control.event_inj)); 1148 1149 x86_stl_phys(cs, 1150 env->vm_vmcb + offsetof(struct vmcb, control.event_inj), 1151 event_inj & ~SVM_EVTINJ_VALID); 1152 } 1153 #endif 1154 } 1155 1156 void do_interrupt_x86_hardirq(CPUX86State *env, int intno, int is_hw) 1157 { 1158 do_interrupt_all(env_archcpu(env), intno, 0, 0, 0, is_hw); 1159 } 1160 1161 void helper_lldt(CPUX86State *env, int selector) 1162 { 1163 SegmentCache *dt; 1164 uint32_t e1, e2; 1165 int index, entry_limit; 1166 target_ulong ptr; 1167 1168 selector &= 0xffff; 1169 if ((selector & 0xfffc) == 0) { 1170 /* XXX: NULL selector case: invalid LDT */ 1171 env->ldt.base = 0; 1172 env->ldt.limit = 0; 1173 } else { 1174 if (selector & 0x4) { 1175 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1176 } 1177 dt = &env->gdt; 1178 index = selector & ~7; 1179 #ifdef TARGET_X86_64 1180 if (env->hflags & HF_LMA_MASK) { 1181 entry_limit = 15; 1182 } else 1183 #endif 1184 { 1185 entry_limit = 7; 1186 } 1187 if ((index + entry_limit) > dt->limit) { 1188 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1189 } 1190 ptr = dt->base + index; 1191 e1 = cpu_ldl_kernel_ra(env, ptr, GETPC()); 1192 e2 = cpu_ldl_kernel_ra(env, ptr + 4, GETPC()); 1193 if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2) { 1194 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1195 } 1196 if (!(e2 & DESC_P_MASK)) { 1197 raise_exception_err_ra(env, EXCP0B_NOSEG, selector & 0xfffc, GETPC()); 1198 } 1199 #ifdef TARGET_X86_64 1200 if (env->hflags & HF_LMA_MASK) { 1201 uint32_t e3; 1202 1203 e3 = cpu_ldl_kernel_ra(env, ptr + 8, GETPC()); 1204 load_seg_cache_raw_dt(&env->ldt, e1, e2); 1205 env->ldt.base |= (target_ulong)e3 << 32; 1206 } else 1207 #endif 1208 { 1209 load_seg_cache_raw_dt(&env->ldt, e1, e2); 1210 } 1211 } 1212 env->ldt.selector = selector; 1213 } 1214 1215 void helper_ltr(CPUX86State *env, int selector) 1216 { 1217 SegmentCache *dt; 1218 uint32_t e1, e2; 1219 int index, type, entry_limit; 1220 target_ulong ptr; 1221 1222 selector &= 0xffff; 1223 if ((selector & 0xfffc) == 0) { 1224 /* NULL selector case: invalid TR */ 1225 env->tr.base = 0; 1226 env->tr.limit = 0; 1227 env->tr.flags = 0; 1228 } else { 1229 if (selector & 0x4) { 1230 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1231 } 1232 dt = &env->gdt; 1233 index = selector & ~7; 1234 #ifdef TARGET_X86_64 1235 if (env->hflags & HF_LMA_MASK) { 1236 entry_limit = 15; 1237 } else 1238 #endif 1239 { 1240 entry_limit = 7; 1241 } 1242 if ((index + entry_limit) > dt->limit) { 1243 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1244 } 1245 ptr = dt->base + index; 1246 e1 = cpu_ldl_kernel_ra(env, ptr, GETPC()); 1247 e2 = cpu_ldl_kernel_ra(env, ptr + 4, GETPC()); 1248 type = (e2 >> DESC_TYPE_SHIFT) & 0xf; 1249 if ((e2 & DESC_S_MASK) || 1250 (type != 1 && type != 9)) { 1251 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1252 } 1253 if (!(e2 & DESC_P_MASK)) { 1254 raise_exception_err_ra(env, EXCP0B_NOSEG, selector & 0xfffc, GETPC()); 1255 } 1256 #ifdef TARGET_X86_64 1257 if (env->hflags & HF_LMA_MASK) { 1258 uint32_t e3, e4; 1259 1260 e3 = cpu_ldl_kernel_ra(env, ptr + 8, GETPC()); 1261 e4 = cpu_ldl_kernel_ra(env, ptr + 12, GETPC()); 1262 if ((e4 >> DESC_TYPE_SHIFT) & 0xf) { 1263 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1264 } 1265 load_seg_cache_raw_dt(&env->tr, e1, e2); 1266 env->tr.base |= (target_ulong)e3 << 32; 1267 } else 1268 #endif 1269 { 1270 load_seg_cache_raw_dt(&env->tr, e1, e2); 1271 } 1272 e2 |= DESC_TSS_BUSY_MASK; 1273 cpu_stl_kernel_ra(env, ptr + 4, e2, GETPC()); 1274 } 1275 env->tr.selector = selector; 1276 } 1277 1278 /* only works if protected mode and not VM86. seg_reg must be != R_CS */ 1279 void helper_load_seg(CPUX86State *env, int seg_reg, int selector) 1280 { 1281 uint32_t e1, e2; 1282 int cpl, dpl, rpl; 1283 SegmentCache *dt; 1284 int index; 1285 target_ulong ptr; 1286 1287 selector &= 0xffff; 1288 cpl = env->hflags & HF_CPL_MASK; 1289 if ((selector & 0xfffc) == 0) { 1290 /* null selector case */ 1291 if (seg_reg == R_SS 1292 #ifdef TARGET_X86_64 1293 && (!(env->hflags & HF_CS64_MASK) || cpl == 3) 1294 #endif 1295 ) { 1296 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 1297 } 1298 cpu_x86_load_seg_cache(env, seg_reg, selector, 0, 0, 0); 1299 } else { 1300 1301 if (selector & 0x4) { 1302 dt = &env->ldt; 1303 } else { 1304 dt = &env->gdt; 1305 } 1306 index = selector & ~7; 1307 if ((index + 7) > dt->limit) { 1308 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1309 } 1310 ptr = dt->base + index; 1311 e1 = cpu_ldl_kernel_ra(env, ptr, GETPC()); 1312 e2 = cpu_ldl_kernel_ra(env, ptr + 4, GETPC()); 1313 1314 if (!(e2 & DESC_S_MASK)) { 1315 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1316 } 1317 rpl = selector & 3; 1318 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1319 if (seg_reg == R_SS) { 1320 /* must be writable segment */ 1321 if ((e2 & DESC_CS_MASK) || !(e2 & DESC_W_MASK)) { 1322 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1323 } 1324 if (rpl != cpl || dpl != cpl) { 1325 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1326 } 1327 } else { 1328 /* must be readable segment */ 1329 if ((e2 & (DESC_CS_MASK | DESC_R_MASK)) == DESC_CS_MASK) { 1330 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1331 } 1332 1333 if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) { 1334 /* if not conforming code, test rights */ 1335 if (dpl < cpl || dpl < rpl) { 1336 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1337 } 1338 } 1339 } 1340 1341 if (!(e2 & DESC_P_MASK)) { 1342 if (seg_reg == R_SS) { 1343 raise_exception_err_ra(env, EXCP0C_STACK, selector & 0xfffc, GETPC()); 1344 } else { 1345 raise_exception_err_ra(env, EXCP0B_NOSEG, selector & 0xfffc, GETPC()); 1346 } 1347 } 1348 1349 /* set the access bit if not already set */ 1350 if (!(e2 & DESC_A_MASK)) { 1351 e2 |= DESC_A_MASK; 1352 cpu_stl_kernel_ra(env, ptr + 4, e2, GETPC()); 1353 } 1354 1355 cpu_x86_load_seg_cache(env, seg_reg, selector, 1356 get_seg_base(e1, e2), 1357 get_seg_limit(e1, e2), 1358 e2); 1359 #if 0 1360 qemu_log("load_seg: sel=0x%04x base=0x%08lx limit=0x%08lx flags=%08x\n", 1361 selector, (unsigned long)sc->base, sc->limit, sc->flags); 1362 #endif 1363 } 1364 } 1365 1366 /* protected mode jump */ 1367 void helper_ljmp_protected(CPUX86State *env, int new_cs, target_ulong new_eip, 1368 target_ulong next_eip) 1369 { 1370 int gate_cs, type; 1371 uint32_t e1, e2, cpl, dpl, rpl, limit; 1372 1373 if ((new_cs & 0xfffc) == 0) { 1374 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 1375 } 1376 if (load_segment_ra(env, &e1, &e2, new_cs, GETPC()) != 0) { 1377 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1378 } 1379 cpl = env->hflags & HF_CPL_MASK; 1380 if (e2 & DESC_S_MASK) { 1381 if (!(e2 & DESC_CS_MASK)) { 1382 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1383 } 1384 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1385 if (e2 & DESC_C_MASK) { 1386 /* conforming code segment */ 1387 if (dpl > cpl) { 1388 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1389 } 1390 } else { 1391 /* non conforming code segment */ 1392 rpl = new_cs & 3; 1393 if (rpl > cpl) { 1394 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1395 } 1396 if (dpl != cpl) { 1397 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1398 } 1399 } 1400 if (!(e2 & DESC_P_MASK)) { 1401 raise_exception_err_ra(env, EXCP0B_NOSEG, new_cs & 0xfffc, GETPC()); 1402 } 1403 limit = get_seg_limit(e1, e2); 1404 if (new_eip > limit && 1405 (!(env->hflags & HF_LMA_MASK) || !(e2 & DESC_L_MASK))) { 1406 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 1407 } 1408 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl, 1409 get_seg_base(e1, e2), limit, e2); 1410 env->eip = new_eip; 1411 } else { 1412 /* jump to call or task gate */ 1413 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1414 rpl = new_cs & 3; 1415 cpl = env->hflags & HF_CPL_MASK; 1416 type = (e2 >> DESC_TYPE_SHIFT) & 0xf; 1417 1418 #ifdef TARGET_X86_64 1419 if (env->efer & MSR_EFER_LMA) { 1420 if (type != 12) { 1421 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1422 } 1423 } 1424 #endif 1425 switch (type) { 1426 case 1: /* 286 TSS */ 1427 case 9: /* 386 TSS */ 1428 case 5: /* task gate */ 1429 if (dpl < cpl || dpl < rpl) { 1430 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1431 } 1432 switch_tss_ra(env, new_cs, e1, e2, SWITCH_TSS_JMP, next_eip, GETPC()); 1433 break; 1434 case 4: /* 286 call gate */ 1435 case 12: /* 386 call gate */ 1436 if ((dpl < cpl) || (dpl < rpl)) { 1437 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1438 } 1439 if (!(e2 & DESC_P_MASK)) { 1440 raise_exception_err_ra(env, EXCP0B_NOSEG, new_cs & 0xfffc, GETPC()); 1441 } 1442 gate_cs = e1 >> 16; 1443 new_eip = (e1 & 0xffff); 1444 if (type == 12) { 1445 new_eip |= (e2 & 0xffff0000); 1446 } 1447 1448 #ifdef TARGET_X86_64 1449 if (env->efer & MSR_EFER_LMA) { 1450 /* load the upper 8 bytes of the 64-bit call gate */ 1451 if (load_segment_ra(env, &e1, &e2, new_cs + 8, GETPC())) { 1452 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, 1453 GETPC()); 1454 } 1455 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f; 1456 if (type != 0) { 1457 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, 1458 GETPC()); 1459 } 1460 new_eip |= ((target_ulong)e1) << 32; 1461 } 1462 #endif 1463 1464 if (load_segment_ra(env, &e1, &e2, gate_cs, GETPC()) != 0) { 1465 raise_exception_err_ra(env, EXCP0D_GPF, gate_cs & 0xfffc, GETPC()); 1466 } 1467 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1468 /* must be code segment */ 1469 if (((e2 & (DESC_S_MASK | DESC_CS_MASK)) != 1470 (DESC_S_MASK | DESC_CS_MASK))) { 1471 raise_exception_err_ra(env, EXCP0D_GPF, gate_cs & 0xfffc, GETPC()); 1472 } 1473 if (((e2 & DESC_C_MASK) && (dpl > cpl)) || 1474 (!(e2 & DESC_C_MASK) && (dpl != cpl))) { 1475 raise_exception_err_ra(env, EXCP0D_GPF, gate_cs & 0xfffc, GETPC()); 1476 } 1477 #ifdef TARGET_X86_64 1478 if (env->efer & MSR_EFER_LMA) { 1479 if (!(e2 & DESC_L_MASK)) { 1480 raise_exception_err_ra(env, EXCP0D_GPF, gate_cs & 0xfffc, GETPC()); 1481 } 1482 if (e2 & DESC_B_MASK) { 1483 raise_exception_err_ra(env, EXCP0D_GPF, gate_cs & 0xfffc, GETPC()); 1484 } 1485 } 1486 #endif 1487 if (!(e2 & DESC_P_MASK)) { 1488 raise_exception_err_ra(env, EXCP0D_GPF, gate_cs & 0xfffc, GETPC()); 1489 } 1490 limit = get_seg_limit(e1, e2); 1491 if (new_eip > limit && 1492 (!(env->hflags & HF_LMA_MASK) || !(e2 & DESC_L_MASK))) { 1493 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 1494 } 1495 cpu_x86_load_seg_cache(env, R_CS, (gate_cs & 0xfffc) | cpl, 1496 get_seg_base(e1, e2), limit, e2); 1497 env->eip = new_eip; 1498 break; 1499 default: 1500 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1501 break; 1502 } 1503 } 1504 } 1505 1506 /* real mode call */ 1507 void helper_lcall_real(CPUX86State *env, int new_cs, target_ulong new_eip1, 1508 int shift, int next_eip) 1509 { 1510 int new_eip; 1511 uint32_t esp, esp_mask; 1512 target_ulong ssp; 1513 1514 new_eip = new_eip1; 1515 esp = env->regs[R_ESP]; 1516 esp_mask = get_sp_mask(env->segs[R_SS].flags); 1517 ssp = env->segs[R_SS].base; 1518 if (shift) { 1519 PUSHL_RA(ssp, esp, esp_mask, env->segs[R_CS].selector, GETPC()); 1520 PUSHL_RA(ssp, esp, esp_mask, next_eip, GETPC()); 1521 } else { 1522 PUSHW_RA(ssp, esp, esp_mask, env->segs[R_CS].selector, GETPC()); 1523 PUSHW_RA(ssp, esp, esp_mask, next_eip, GETPC()); 1524 } 1525 1526 SET_ESP(esp, esp_mask); 1527 env->eip = new_eip; 1528 env->segs[R_CS].selector = new_cs; 1529 env->segs[R_CS].base = (new_cs << 4); 1530 } 1531 1532 /* protected mode call */ 1533 void helper_lcall_protected(CPUX86State *env, int new_cs, target_ulong new_eip, 1534 int shift, target_ulong next_eip) 1535 { 1536 int new_stack, i; 1537 uint32_t e1, e2, cpl, dpl, rpl, selector, param_count; 1538 uint32_t ss = 0, ss_e1 = 0, ss_e2 = 0, type, ss_dpl, sp_mask; 1539 uint32_t val, limit, old_sp_mask; 1540 target_ulong ssp, old_ssp, offset, sp; 1541 1542 LOG_PCALL("lcall %04x:" TARGET_FMT_lx " s=%d\n", new_cs, new_eip, shift); 1543 LOG_PCALL_STATE(env_cpu(env)); 1544 if ((new_cs & 0xfffc) == 0) { 1545 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 1546 } 1547 if (load_segment_ra(env, &e1, &e2, new_cs, GETPC()) != 0) { 1548 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1549 } 1550 cpl = env->hflags & HF_CPL_MASK; 1551 LOG_PCALL("desc=%08x:%08x\n", e1, e2); 1552 if (e2 & DESC_S_MASK) { 1553 if (!(e2 & DESC_CS_MASK)) { 1554 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1555 } 1556 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1557 if (e2 & DESC_C_MASK) { 1558 /* conforming code segment */ 1559 if (dpl > cpl) { 1560 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1561 } 1562 } else { 1563 /* non conforming code segment */ 1564 rpl = new_cs & 3; 1565 if (rpl > cpl) { 1566 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1567 } 1568 if (dpl != cpl) { 1569 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1570 } 1571 } 1572 if (!(e2 & DESC_P_MASK)) { 1573 raise_exception_err_ra(env, EXCP0B_NOSEG, new_cs & 0xfffc, GETPC()); 1574 } 1575 1576 #ifdef TARGET_X86_64 1577 /* XXX: check 16/32 bit cases in long mode */ 1578 if (shift == 2) { 1579 target_ulong rsp; 1580 1581 /* 64 bit case */ 1582 rsp = env->regs[R_ESP]; 1583 PUSHQ_RA(rsp, env->segs[R_CS].selector, GETPC()); 1584 PUSHQ_RA(rsp, next_eip, GETPC()); 1585 /* from this point, not restartable */ 1586 env->regs[R_ESP] = rsp; 1587 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl, 1588 get_seg_base(e1, e2), 1589 get_seg_limit(e1, e2), e2); 1590 env->eip = new_eip; 1591 } else 1592 #endif 1593 { 1594 sp = env->regs[R_ESP]; 1595 sp_mask = get_sp_mask(env->segs[R_SS].flags); 1596 ssp = env->segs[R_SS].base; 1597 if (shift) { 1598 PUSHL_RA(ssp, sp, sp_mask, env->segs[R_CS].selector, GETPC()); 1599 PUSHL_RA(ssp, sp, sp_mask, next_eip, GETPC()); 1600 } else { 1601 PUSHW_RA(ssp, sp, sp_mask, env->segs[R_CS].selector, GETPC()); 1602 PUSHW_RA(ssp, sp, sp_mask, next_eip, GETPC()); 1603 } 1604 1605 limit = get_seg_limit(e1, e2); 1606 if (new_eip > limit) { 1607 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1608 } 1609 /* from this point, not restartable */ 1610 SET_ESP(sp, sp_mask); 1611 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl, 1612 get_seg_base(e1, e2), limit, e2); 1613 env->eip = new_eip; 1614 } 1615 } else { 1616 /* check gate type */ 1617 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f; 1618 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1619 rpl = new_cs & 3; 1620 1621 #ifdef TARGET_X86_64 1622 if (env->efer & MSR_EFER_LMA) { 1623 if (type != 12) { 1624 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1625 } 1626 } 1627 #endif 1628 1629 switch (type) { 1630 case 1: /* available 286 TSS */ 1631 case 9: /* available 386 TSS */ 1632 case 5: /* task gate */ 1633 if (dpl < cpl || dpl < rpl) { 1634 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1635 } 1636 switch_tss_ra(env, new_cs, e1, e2, SWITCH_TSS_CALL, next_eip, GETPC()); 1637 return; 1638 case 4: /* 286 call gate */ 1639 case 12: /* 386 call gate */ 1640 break; 1641 default: 1642 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1643 break; 1644 } 1645 shift = type >> 3; 1646 1647 if (dpl < cpl || dpl < rpl) { 1648 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1649 } 1650 /* check valid bit */ 1651 if (!(e2 & DESC_P_MASK)) { 1652 raise_exception_err_ra(env, EXCP0B_NOSEG, new_cs & 0xfffc, GETPC()); 1653 } 1654 selector = e1 >> 16; 1655 param_count = e2 & 0x1f; 1656 offset = (e2 & 0xffff0000) | (e1 & 0x0000ffff); 1657 #ifdef TARGET_X86_64 1658 if (env->efer & MSR_EFER_LMA) { 1659 /* load the upper 8 bytes of the 64-bit call gate */ 1660 if (load_segment_ra(env, &e1, &e2, new_cs + 8, GETPC())) { 1661 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, 1662 GETPC()); 1663 } 1664 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f; 1665 if (type != 0) { 1666 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, 1667 GETPC()); 1668 } 1669 offset |= ((target_ulong)e1) << 32; 1670 } 1671 #endif 1672 if ((selector & 0xfffc) == 0) { 1673 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 1674 } 1675 1676 if (load_segment_ra(env, &e1, &e2, selector, GETPC()) != 0) { 1677 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1678 } 1679 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK))) { 1680 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1681 } 1682 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1683 if (dpl > cpl) { 1684 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1685 } 1686 #ifdef TARGET_X86_64 1687 if (env->efer & MSR_EFER_LMA) { 1688 if (!(e2 & DESC_L_MASK)) { 1689 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1690 } 1691 if (e2 & DESC_B_MASK) { 1692 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1693 } 1694 shift++; 1695 } 1696 #endif 1697 if (!(e2 & DESC_P_MASK)) { 1698 raise_exception_err_ra(env, EXCP0B_NOSEG, selector & 0xfffc, GETPC()); 1699 } 1700 1701 if (!(e2 & DESC_C_MASK) && dpl < cpl) { 1702 /* to inner privilege */ 1703 #ifdef TARGET_X86_64 1704 if (shift == 2) { 1705 sp = get_rsp_from_tss(env, dpl); 1706 ss = dpl; /* SS = NULL selector with RPL = new CPL */ 1707 new_stack = 1; 1708 sp_mask = 0; 1709 ssp = 0; /* SS base is always zero in IA-32e mode */ 1710 LOG_PCALL("new ss:rsp=%04x:%016llx env->regs[R_ESP]=" 1711 TARGET_FMT_lx "\n", ss, sp, env->regs[R_ESP]); 1712 } else 1713 #endif 1714 { 1715 uint32_t sp32; 1716 get_ss_esp_from_tss(env, &ss, &sp32, dpl, GETPC()); 1717 LOG_PCALL("new ss:esp=%04x:%08x param_count=%d env->regs[R_ESP]=" 1718 TARGET_FMT_lx "\n", ss, sp32, param_count, 1719 env->regs[R_ESP]); 1720 sp = sp32; 1721 if ((ss & 0xfffc) == 0) { 1722 raise_exception_err_ra(env, EXCP0A_TSS, ss & 0xfffc, GETPC()); 1723 } 1724 if ((ss & 3) != dpl) { 1725 raise_exception_err_ra(env, EXCP0A_TSS, ss & 0xfffc, GETPC()); 1726 } 1727 if (load_segment_ra(env, &ss_e1, &ss_e2, ss, GETPC()) != 0) { 1728 raise_exception_err_ra(env, EXCP0A_TSS, ss & 0xfffc, GETPC()); 1729 } 1730 ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3; 1731 if (ss_dpl != dpl) { 1732 raise_exception_err_ra(env, EXCP0A_TSS, ss & 0xfffc, GETPC()); 1733 } 1734 if (!(ss_e2 & DESC_S_MASK) || 1735 (ss_e2 & DESC_CS_MASK) || 1736 !(ss_e2 & DESC_W_MASK)) { 1737 raise_exception_err_ra(env, EXCP0A_TSS, ss & 0xfffc, GETPC()); 1738 } 1739 if (!(ss_e2 & DESC_P_MASK)) { 1740 raise_exception_err_ra(env, EXCP0A_TSS, ss & 0xfffc, GETPC()); 1741 } 1742 1743 sp_mask = get_sp_mask(ss_e2); 1744 ssp = get_seg_base(ss_e1, ss_e2); 1745 } 1746 1747 /* push_size = ((param_count * 2) + 8) << shift; */ 1748 1749 old_sp_mask = get_sp_mask(env->segs[R_SS].flags); 1750 old_ssp = env->segs[R_SS].base; 1751 #ifdef TARGET_X86_64 1752 if (shift == 2) { 1753 /* XXX: verify if new stack address is canonical */ 1754 PUSHQ_RA(sp, env->segs[R_SS].selector, GETPC()); 1755 PUSHQ_RA(sp, env->regs[R_ESP], GETPC()); 1756 /* parameters aren't supported for 64-bit call gates */ 1757 } else 1758 #endif 1759 if (shift == 1) { 1760 PUSHL_RA(ssp, sp, sp_mask, env->segs[R_SS].selector, GETPC()); 1761 PUSHL_RA(ssp, sp, sp_mask, env->regs[R_ESP], GETPC()); 1762 for (i = param_count - 1; i >= 0; i--) { 1763 val = cpu_ldl_kernel_ra(env, old_ssp + 1764 ((env->regs[R_ESP] + i * 4) & 1765 old_sp_mask), GETPC()); 1766 PUSHL_RA(ssp, sp, sp_mask, val, GETPC()); 1767 } 1768 } else { 1769 PUSHW_RA(ssp, sp, sp_mask, env->segs[R_SS].selector, GETPC()); 1770 PUSHW_RA(ssp, sp, sp_mask, env->regs[R_ESP], GETPC()); 1771 for (i = param_count - 1; i >= 0; i--) { 1772 val = cpu_lduw_kernel_ra(env, old_ssp + 1773 ((env->regs[R_ESP] + i * 2) & 1774 old_sp_mask), GETPC()); 1775 PUSHW_RA(ssp, sp, sp_mask, val, GETPC()); 1776 } 1777 } 1778 new_stack = 1; 1779 } else { 1780 /* to same privilege */ 1781 sp = env->regs[R_ESP]; 1782 sp_mask = get_sp_mask(env->segs[R_SS].flags); 1783 ssp = env->segs[R_SS].base; 1784 /* push_size = (4 << shift); */ 1785 new_stack = 0; 1786 } 1787 1788 #ifdef TARGET_X86_64 1789 if (shift == 2) { 1790 PUSHQ_RA(sp, env->segs[R_CS].selector, GETPC()); 1791 PUSHQ_RA(sp, next_eip, GETPC()); 1792 } else 1793 #endif 1794 if (shift == 1) { 1795 PUSHL_RA(ssp, sp, sp_mask, env->segs[R_CS].selector, GETPC()); 1796 PUSHL_RA(ssp, sp, sp_mask, next_eip, GETPC()); 1797 } else { 1798 PUSHW_RA(ssp, sp, sp_mask, env->segs[R_CS].selector, GETPC()); 1799 PUSHW_RA(ssp, sp, sp_mask, next_eip, GETPC()); 1800 } 1801 1802 /* from this point, not restartable */ 1803 1804 if (new_stack) { 1805 #ifdef TARGET_X86_64 1806 if (shift == 2) { 1807 cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, 0); 1808 } else 1809 #endif 1810 { 1811 ss = (ss & ~3) | dpl; 1812 cpu_x86_load_seg_cache(env, R_SS, ss, 1813 ssp, 1814 get_seg_limit(ss_e1, ss_e2), 1815 ss_e2); 1816 } 1817 } 1818 1819 selector = (selector & ~3) | dpl; 1820 cpu_x86_load_seg_cache(env, R_CS, selector, 1821 get_seg_base(e1, e2), 1822 get_seg_limit(e1, e2), 1823 e2); 1824 SET_ESP(sp, sp_mask); 1825 env->eip = offset; 1826 } 1827 } 1828 1829 /* real and vm86 mode iret */ 1830 void helper_iret_real(CPUX86State *env, int shift) 1831 { 1832 uint32_t sp, new_cs, new_eip, new_eflags, sp_mask; 1833 target_ulong ssp; 1834 int eflags_mask; 1835 1836 sp_mask = 0xffff; /* XXXX: use SS segment size? */ 1837 sp = env->regs[R_ESP]; 1838 ssp = env->segs[R_SS].base; 1839 if (shift == 1) { 1840 /* 32 bits */ 1841 POPL_RA(ssp, sp, sp_mask, new_eip, GETPC()); 1842 POPL_RA(ssp, sp, sp_mask, new_cs, GETPC()); 1843 new_cs &= 0xffff; 1844 POPL_RA(ssp, sp, sp_mask, new_eflags, GETPC()); 1845 } else { 1846 /* 16 bits */ 1847 POPW_RA(ssp, sp, sp_mask, new_eip, GETPC()); 1848 POPW_RA(ssp, sp, sp_mask, new_cs, GETPC()); 1849 POPW_RA(ssp, sp, sp_mask, new_eflags, GETPC()); 1850 } 1851 env->regs[R_ESP] = (env->regs[R_ESP] & ~sp_mask) | (sp & sp_mask); 1852 env->segs[R_CS].selector = new_cs; 1853 env->segs[R_CS].base = (new_cs << 4); 1854 env->eip = new_eip; 1855 if (env->eflags & VM_MASK) { 1856 eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | RF_MASK | 1857 NT_MASK; 1858 } else { 1859 eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | IOPL_MASK | 1860 RF_MASK | NT_MASK; 1861 } 1862 if (shift == 0) { 1863 eflags_mask &= 0xffff; 1864 } 1865 cpu_load_eflags(env, new_eflags, eflags_mask); 1866 env->hflags2 &= ~HF2_NMI_MASK; 1867 } 1868 1869 static inline void validate_seg(CPUX86State *env, X86Seg seg_reg, int cpl) 1870 { 1871 int dpl; 1872 uint32_t e2; 1873 1874 /* XXX: on x86_64, we do not want to nullify FS and GS because 1875 they may still contain a valid base. I would be interested to 1876 know how a real x86_64 CPU behaves */ 1877 if ((seg_reg == R_FS || seg_reg == R_GS) && 1878 (env->segs[seg_reg].selector & 0xfffc) == 0) { 1879 return; 1880 } 1881 1882 e2 = env->segs[seg_reg].flags; 1883 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1884 if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) { 1885 /* data or non conforming code segment */ 1886 if (dpl < cpl) { 1887 cpu_x86_load_seg_cache(env, seg_reg, 0, 1888 env->segs[seg_reg].base, 1889 env->segs[seg_reg].limit, 1890 env->segs[seg_reg].flags & ~DESC_P_MASK); 1891 } 1892 } 1893 } 1894 1895 /* protected mode iret */ 1896 static inline void helper_ret_protected(CPUX86State *env, int shift, 1897 int is_iret, int addend, 1898 uintptr_t retaddr) 1899 { 1900 uint32_t new_cs, new_eflags, new_ss; 1901 uint32_t new_es, new_ds, new_fs, new_gs; 1902 uint32_t e1, e2, ss_e1, ss_e2; 1903 int cpl, dpl, rpl, eflags_mask, iopl; 1904 target_ulong ssp, sp, new_eip, new_esp, sp_mask; 1905 1906 #ifdef TARGET_X86_64 1907 if (shift == 2) { 1908 sp_mask = -1; 1909 } else 1910 #endif 1911 { 1912 sp_mask = get_sp_mask(env->segs[R_SS].flags); 1913 } 1914 sp = env->regs[R_ESP]; 1915 ssp = env->segs[R_SS].base; 1916 new_eflags = 0; /* avoid warning */ 1917 #ifdef TARGET_X86_64 1918 if (shift == 2) { 1919 POPQ_RA(sp, new_eip, retaddr); 1920 POPQ_RA(sp, new_cs, retaddr); 1921 new_cs &= 0xffff; 1922 if (is_iret) { 1923 POPQ_RA(sp, new_eflags, retaddr); 1924 } 1925 } else 1926 #endif 1927 { 1928 if (shift == 1) { 1929 /* 32 bits */ 1930 POPL_RA(ssp, sp, sp_mask, new_eip, retaddr); 1931 POPL_RA(ssp, sp, sp_mask, new_cs, retaddr); 1932 new_cs &= 0xffff; 1933 if (is_iret) { 1934 POPL_RA(ssp, sp, sp_mask, new_eflags, retaddr); 1935 if (new_eflags & VM_MASK) { 1936 goto return_to_vm86; 1937 } 1938 } 1939 } else { 1940 /* 16 bits */ 1941 POPW_RA(ssp, sp, sp_mask, new_eip, retaddr); 1942 POPW_RA(ssp, sp, sp_mask, new_cs, retaddr); 1943 if (is_iret) { 1944 POPW_RA(ssp, sp, sp_mask, new_eflags, retaddr); 1945 } 1946 } 1947 } 1948 LOG_PCALL("lret new %04x:" TARGET_FMT_lx " s=%d addend=0x%x\n", 1949 new_cs, new_eip, shift, addend); 1950 LOG_PCALL_STATE(env_cpu(env)); 1951 if ((new_cs & 0xfffc) == 0) { 1952 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, retaddr); 1953 } 1954 if (load_segment_ra(env, &e1, &e2, new_cs, retaddr) != 0) { 1955 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, retaddr); 1956 } 1957 if (!(e2 & DESC_S_MASK) || 1958 !(e2 & DESC_CS_MASK)) { 1959 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, retaddr); 1960 } 1961 cpl = env->hflags & HF_CPL_MASK; 1962 rpl = new_cs & 3; 1963 if (rpl < cpl) { 1964 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, retaddr); 1965 } 1966 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1967 if (e2 & DESC_C_MASK) { 1968 if (dpl > rpl) { 1969 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, retaddr); 1970 } 1971 } else { 1972 if (dpl != rpl) { 1973 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, retaddr); 1974 } 1975 } 1976 if (!(e2 & DESC_P_MASK)) { 1977 raise_exception_err_ra(env, EXCP0B_NOSEG, new_cs & 0xfffc, retaddr); 1978 } 1979 1980 sp += addend; 1981 if (rpl == cpl && (!(env->hflags & HF_CS64_MASK) || 1982 ((env->hflags & HF_CS64_MASK) && !is_iret))) { 1983 /* return to same privilege level */ 1984 cpu_x86_load_seg_cache(env, R_CS, new_cs, 1985 get_seg_base(e1, e2), 1986 get_seg_limit(e1, e2), 1987 e2); 1988 } else { 1989 /* return to different privilege level */ 1990 #ifdef TARGET_X86_64 1991 if (shift == 2) { 1992 POPQ_RA(sp, new_esp, retaddr); 1993 POPQ_RA(sp, new_ss, retaddr); 1994 new_ss &= 0xffff; 1995 } else 1996 #endif 1997 { 1998 if (shift == 1) { 1999 /* 32 bits */ 2000 POPL_RA(ssp, sp, sp_mask, new_esp, retaddr); 2001 POPL_RA(ssp, sp, sp_mask, new_ss, retaddr); 2002 new_ss &= 0xffff; 2003 } else { 2004 /* 16 bits */ 2005 POPW_RA(ssp, sp, sp_mask, new_esp, retaddr); 2006 POPW_RA(ssp, sp, sp_mask, new_ss, retaddr); 2007 } 2008 } 2009 LOG_PCALL("new ss:esp=%04x:" TARGET_FMT_lx "\n", 2010 new_ss, new_esp); 2011 if ((new_ss & 0xfffc) == 0) { 2012 #ifdef TARGET_X86_64 2013 /* NULL ss is allowed in long mode if cpl != 3 */ 2014 /* XXX: test CS64? */ 2015 if ((env->hflags & HF_LMA_MASK) && rpl != 3) { 2016 cpu_x86_load_seg_cache(env, R_SS, new_ss, 2017 0, 0xffffffff, 2018 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2019 DESC_S_MASK | (rpl << DESC_DPL_SHIFT) | 2020 DESC_W_MASK | DESC_A_MASK); 2021 ss_e2 = DESC_B_MASK; /* XXX: should not be needed? */ 2022 } else 2023 #endif 2024 { 2025 raise_exception_err_ra(env, EXCP0D_GPF, 0, retaddr); 2026 } 2027 } else { 2028 if ((new_ss & 3) != rpl) { 2029 raise_exception_err_ra(env, EXCP0D_GPF, new_ss & 0xfffc, retaddr); 2030 } 2031 if (load_segment_ra(env, &ss_e1, &ss_e2, new_ss, retaddr) != 0) { 2032 raise_exception_err_ra(env, EXCP0D_GPF, new_ss & 0xfffc, retaddr); 2033 } 2034 if (!(ss_e2 & DESC_S_MASK) || 2035 (ss_e2 & DESC_CS_MASK) || 2036 !(ss_e2 & DESC_W_MASK)) { 2037 raise_exception_err_ra(env, EXCP0D_GPF, new_ss & 0xfffc, retaddr); 2038 } 2039 dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3; 2040 if (dpl != rpl) { 2041 raise_exception_err_ra(env, EXCP0D_GPF, new_ss & 0xfffc, retaddr); 2042 } 2043 if (!(ss_e2 & DESC_P_MASK)) { 2044 raise_exception_err_ra(env, EXCP0B_NOSEG, new_ss & 0xfffc, retaddr); 2045 } 2046 cpu_x86_load_seg_cache(env, R_SS, new_ss, 2047 get_seg_base(ss_e1, ss_e2), 2048 get_seg_limit(ss_e1, ss_e2), 2049 ss_e2); 2050 } 2051 2052 cpu_x86_load_seg_cache(env, R_CS, new_cs, 2053 get_seg_base(e1, e2), 2054 get_seg_limit(e1, e2), 2055 e2); 2056 sp = new_esp; 2057 #ifdef TARGET_X86_64 2058 if (env->hflags & HF_CS64_MASK) { 2059 sp_mask = -1; 2060 } else 2061 #endif 2062 { 2063 sp_mask = get_sp_mask(ss_e2); 2064 } 2065 2066 /* validate data segments */ 2067 validate_seg(env, R_ES, rpl); 2068 validate_seg(env, R_DS, rpl); 2069 validate_seg(env, R_FS, rpl); 2070 validate_seg(env, R_GS, rpl); 2071 2072 sp += addend; 2073 } 2074 SET_ESP(sp, sp_mask); 2075 env->eip = new_eip; 2076 if (is_iret) { 2077 /* NOTE: 'cpl' is the _old_ CPL */ 2078 eflags_mask = TF_MASK | AC_MASK | ID_MASK | RF_MASK | NT_MASK; 2079 if (cpl == 0) { 2080 eflags_mask |= IOPL_MASK; 2081 } 2082 iopl = (env->eflags >> IOPL_SHIFT) & 3; 2083 if (cpl <= iopl) { 2084 eflags_mask |= IF_MASK; 2085 } 2086 if (shift == 0) { 2087 eflags_mask &= 0xffff; 2088 } 2089 cpu_load_eflags(env, new_eflags, eflags_mask); 2090 } 2091 return; 2092 2093 return_to_vm86: 2094 POPL_RA(ssp, sp, sp_mask, new_esp, retaddr); 2095 POPL_RA(ssp, sp, sp_mask, new_ss, retaddr); 2096 POPL_RA(ssp, sp, sp_mask, new_es, retaddr); 2097 POPL_RA(ssp, sp, sp_mask, new_ds, retaddr); 2098 POPL_RA(ssp, sp, sp_mask, new_fs, retaddr); 2099 POPL_RA(ssp, sp, sp_mask, new_gs, retaddr); 2100 2101 /* modify processor state */ 2102 cpu_load_eflags(env, new_eflags, TF_MASK | AC_MASK | ID_MASK | 2103 IF_MASK | IOPL_MASK | VM_MASK | NT_MASK | VIF_MASK | 2104 VIP_MASK); 2105 load_seg_vm(env, R_CS, new_cs & 0xffff); 2106 load_seg_vm(env, R_SS, new_ss & 0xffff); 2107 load_seg_vm(env, R_ES, new_es & 0xffff); 2108 load_seg_vm(env, R_DS, new_ds & 0xffff); 2109 load_seg_vm(env, R_FS, new_fs & 0xffff); 2110 load_seg_vm(env, R_GS, new_gs & 0xffff); 2111 2112 env->eip = new_eip & 0xffff; 2113 env->regs[R_ESP] = new_esp; 2114 } 2115 2116 void helper_iret_protected(CPUX86State *env, int shift, int next_eip) 2117 { 2118 int tss_selector, type; 2119 uint32_t e1, e2; 2120 2121 /* specific case for TSS */ 2122 if (env->eflags & NT_MASK) { 2123 #ifdef TARGET_X86_64 2124 if (env->hflags & HF_LMA_MASK) { 2125 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 2126 } 2127 #endif 2128 tss_selector = cpu_lduw_kernel_ra(env, env->tr.base + 0, GETPC()); 2129 if (tss_selector & 4) { 2130 raise_exception_err_ra(env, EXCP0A_TSS, tss_selector & 0xfffc, GETPC()); 2131 } 2132 if (load_segment_ra(env, &e1, &e2, tss_selector, GETPC()) != 0) { 2133 raise_exception_err_ra(env, EXCP0A_TSS, tss_selector & 0xfffc, GETPC()); 2134 } 2135 type = (e2 >> DESC_TYPE_SHIFT) & 0x17; 2136 /* NOTE: we check both segment and busy TSS */ 2137 if (type != 3) { 2138 raise_exception_err_ra(env, EXCP0A_TSS, tss_selector & 0xfffc, GETPC()); 2139 } 2140 switch_tss_ra(env, tss_selector, e1, e2, SWITCH_TSS_IRET, next_eip, GETPC()); 2141 } else { 2142 helper_ret_protected(env, shift, 1, 0, GETPC()); 2143 } 2144 env->hflags2 &= ~HF2_NMI_MASK; 2145 } 2146 2147 void helper_lret_protected(CPUX86State *env, int shift, int addend) 2148 { 2149 helper_ret_protected(env, shift, 0, addend, GETPC()); 2150 } 2151 2152 void helper_sysenter(CPUX86State *env) 2153 { 2154 if (env->sysenter_cs == 0) { 2155 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 2156 } 2157 env->eflags &= ~(VM_MASK | IF_MASK | RF_MASK); 2158 2159 #ifdef TARGET_X86_64 2160 if (env->hflags & HF_LMA_MASK) { 2161 cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc, 2162 0, 0xffffffff, 2163 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2164 DESC_S_MASK | 2165 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | 2166 DESC_L_MASK); 2167 } else 2168 #endif 2169 { 2170 cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc, 2171 0, 0xffffffff, 2172 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2173 DESC_S_MASK | 2174 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK); 2175 } 2176 cpu_x86_load_seg_cache(env, R_SS, (env->sysenter_cs + 8) & 0xfffc, 2177 0, 0xffffffff, 2178 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2179 DESC_S_MASK | 2180 DESC_W_MASK | DESC_A_MASK); 2181 env->regs[R_ESP] = env->sysenter_esp; 2182 env->eip = env->sysenter_eip; 2183 } 2184 2185 void helper_sysexit(CPUX86State *env, int dflag) 2186 { 2187 int cpl; 2188 2189 cpl = env->hflags & HF_CPL_MASK; 2190 if (env->sysenter_cs == 0 || cpl != 0) { 2191 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 2192 } 2193 #ifdef TARGET_X86_64 2194 if (dflag == 2) { 2195 cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 32) & 0xfffc) | 2196 3, 0, 0xffffffff, 2197 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2198 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 2199 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | 2200 DESC_L_MASK); 2201 cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 40) & 0xfffc) | 2202 3, 0, 0xffffffff, 2203 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2204 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 2205 DESC_W_MASK | DESC_A_MASK); 2206 } else 2207 #endif 2208 { 2209 cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 16) & 0xfffc) | 2210 3, 0, 0xffffffff, 2211 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2212 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 2213 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK); 2214 cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 24) & 0xfffc) | 2215 3, 0, 0xffffffff, 2216 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2217 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 2218 DESC_W_MASK | DESC_A_MASK); 2219 } 2220 env->regs[R_ESP] = env->regs[R_ECX]; 2221 env->eip = env->regs[R_EDX]; 2222 } 2223 2224 target_ulong helper_lsl(CPUX86State *env, target_ulong selector1) 2225 { 2226 unsigned int limit; 2227 uint32_t e1, e2, eflags, selector; 2228 int rpl, dpl, cpl, type; 2229 2230 selector = selector1 & 0xffff; 2231 eflags = cpu_cc_compute_all(env, CC_OP); 2232 if ((selector & 0xfffc) == 0) { 2233 goto fail; 2234 } 2235 if (load_segment_ra(env, &e1, &e2, selector, GETPC()) != 0) { 2236 goto fail; 2237 } 2238 rpl = selector & 3; 2239 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 2240 cpl = env->hflags & HF_CPL_MASK; 2241 if (e2 & DESC_S_MASK) { 2242 if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) { 2243 /* conforming */ 2244 } else { 2245 if (dpl < cpl || dpl < rpl) { 2246 goto fail; 2247 } 2248 } 2249 } else { 2250 type = (e2 >> DESC_TYPE_SHIFT) & 0xf; 2251 switch (type) { 2252 case 1: 2253 case 2: 2254 case 3: 2255 case 9: 2256 case 11: 2257 break; 2258 default: 2259 goto fail; 2260 } 2261 if (dpl < cpl || dpl < rpl) { 2262 fail: 2263 CC_SRC = eflags & ~CC_Z; 2264 return 0; 2265 } 2266 } 2267 limit = get_seg_limit(e1, e2); 2268 CC_SRC = eflags | CC_Z; 2269 return limit; 2270 } 2271 2272 target_ulong helper_lar(CPUX86State *env, target_ulong selector1) 2273 { 2274 uint32_t e1, e2, eflags, selector; 2275 int rpl, dpl, cpl, type; 2276 2277 selector = selector1 & 0xffff; 2278 eflags = cpu_cc_compute_all(env, CC_OP); 2279 if ((selector & 0xfffc) == 0) { 2280 goto fail; 2281 } 2282 if (load_segment_ra(env, &e1, &e2, selector, GETPC()) != 0) { 2283 goto fail; 2284 } 2285 rpl = selector & 3; 2286 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 2287 cpl = env->hflags & HF_CPL_MASK; 2288 if (e2 & DESC_S_MASK) { 2289 if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) { 2290 /* conforming */ 2291 } else { 2292 if (dpl < cpl || dpl < rpl) { 2293 goto fail; 2294 } 2295 } 2296 } else { 2297 type = (e2 >> DESC_TYPE_SHIFT) & 0xf; 2298 switch (type) { 2299 case 1: 2300 case 2: 2301 case 3: 2302 case 4: 2303 case 5: 2304 case 9: 2305 case 11: 2306 case 12: 2307 break; 2308 default: 2309 goto fail; 2310 } 2311 if (dpl < cpl || dpl < rpl) { 2312 fail: 2313 CC_SRC = eflags & ~CC_Z; 2314 return 0; 2315 } 2316 } 2317 CC_SRC = eflags | CC_Z; 2318 return e2 & 0x00f0ff00; 2319 } 2320 2321 void helper_verr(CPUX86State *env, target_ulong selector1) 2322 { 2323 uint32_t e1, e2, eflags, selector; 2324 int rpl, dpl, cpl; 2325 2326 selector = selector1 & 0xffff; 2327 eflags = cpu_cc_compute_all(env, CC_OP); 2328 if ((selector & 0xfffc) == 0) { 2329 goto fail; 2330 } 2331 if (load_segment_ra(env, &e1, &e2, selector, GETPC()) != 0) { 2332 goto fail; 2333 } 2334 if (!(e2 & DESC_S_MASK)) { 2335 goto fail; 2336 } 2337 rpl = selector & 3; 2338 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 2339 cpl = env->hflags & HF_CPL_MASK; 2340 if (e2 & DESC_CS_MASK) { 2341 if (!(e2 & DESC_R_MASK)) { 2342 goto fail; 2343 } 2344 if (!(e2 & DESC_C_MASK)) { 2345 if (dpl < cpl || dpl < rpl) { 2346 goto fail; 2347 } 2348 } 2349 } else { 2350 if (dpl < cpl || dpl < rpl) { 2351 fail: 2352 CC_SRC = eflags & ~CC_Z; 2353 return; 2354 } 2355 } 2356 CC_SRC = eflags | CC_Z; 2357 } 2358 2359 void helper_verw(CPUX86State *env, target_ulong selector1) 2360 { 2361 uint32_t e1, e2, eflags, selector; 2362 int rpl, dpl, cpl; 2363 2364 selector = selector1 & 0xffff; 2365 eflags = cpu_cc_compute_all(env, CC_OP); 2366 if ((selector & 0xfffc) == 0) { 2367 goto fail; 2368 } 2369 if (load_segment_ra(env, &e1, &e2, selector, GETPC()) != 0) { 2370 goto fail; 2371 } 2372 if (!(e2 & DESC_S_MASK)) { 2373 goto fail; 2374 } 2375 rpl = selector & 3; 2376 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 2377 cpl = env->hflags & HF_CPL_MASK; 2378 if (e2 & DESC_CS_MASK) { 2379 goto fail; 2380 } else { 2381 if (dpl < cpl || dpl < rpl) { 2382 goto fail; 2383 } 2384 if (!(e2 & DESC_W_MASK)) { 2385 fail: 2386 CC_SRC = eflags & ~CC_Z; 2387 return; 2388 } 2389 } 2390 CC_SRC = eflags | CC_Z; 2391 } 2392