1 /* 2 * x86 segmentation related helpers: 3 * TSS, interrupts, system calls, jumps and call/task gates, descriptors 4 * 5 * Copyright (c) 2003 Fabrice Bellard 6 * 7 * This library is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU Lesser General Public 9 * License as published by the Free Software Foundation; either 10 * version 2.1 of the License, or (at your option) any later version. 11 * 12 * This library is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 15 * Lesser General Public License for more details. 16 * 17 * You should have received a copy of the GNU Lesser General Public 18 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 19 */ 20 21 #include "qemu/osdep.h" 22 #include "cpu.h" 23 #include "qemu/log.h" 24 #include "exec/helper-proto.h" 25 #include "exec/exec-all.h" 26 #include "exec/cpu_ldst.h" 27 #include "exec/log.h" 28 #include "helper-tcg.h" 29 #include "seg_helper.h" 30 #include "access.h" 31 32 #ifdef TARGET_X86_64 33 #define SET_ESP(val, sp_mask) \ 34 do { \ 35 if ((sp_mask) == 0xffff) { \ 36 env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | \ 37 ((val) & 0xffff); \ 38 } else if ((sp_mask) == 0xffffffffLL) { \ 39 env->regs[R_ESP] = (uint32_t)(val); \ 40 } else { \ 41 env->regs[R_ESP] = (val); \ 42 } \ 43 } while (0) 44 #else 45 #define SET_ESP(val, sp_mask) \ 46 do { \ 47 env->regs[R_ESP] = (env->regs[R_ESP] & ~(sp_mask)) | \ 48 ((val) & (sp_mask)); \ 49 } while (0) 50 #endif 51 52 /* XXX: use mmu_index to have proper DPL support */ 53 typedef struct StackAccess 54 { 55 CPUX86State *env; 56 uintptr_t ra; 57 target_ulong ss_base; 58 target_ulong sp; 59 target_ulong sp_mask; 60 int mmu_index; 61 } StackAccess; 62 63 static void pushw(StackAccess *sa, uint16_t val) 64 { 65 sa->sp -= 2; 66 cpu_stw_mmuidx_ra(sa->env, sa->ss_base + (sa->sp & sa->sp_mask), 67 val, sa->mmu_index, sa->ra); 68 } 69 70 static void pushl(StackAccess *sa, uint32_t val) 71 { 72 sa->sp -= 4; 73 cpu_stl_mmuidx_ra(sa->env, sa->ss_base + (sa->sp & sa->sp_mask), 74 val, sa->mmu_index, sa->ra); 75 } 76 77 static uint16_t popw(StackAccess *sa) 78 { 79 uint16_t ret = cpu_lduw_mmuidx_ra(sa->env, 80 sa->ss_base + (sa->sp & sa->sp_mask), 81 sa->mmu_index, sa->ra); 82 sa->sp += 2; 83 return ret; 84 } 85 86 static uint32_t popl(StackAccess *sa) 87 { 88 uint32_t ret = cpu_ldl_mmuidx_ra(sa->env, 89 sa->ss_base + (sa->sp & sa->sp_mask), 90 sa->mmu_index, sa->ra); 91 sa->sp += 4; 92 return ret; 93 } 94 95 int get_pg_mode(CPUX86State *env) 96 { 97 int pg_mode = 0; 98 if (!(env->cr[0] & CR0_PG_MASK)) { 99 return 0; 100 } 101 if (env->cr[0] & CR0_WP_MASK) { 102 pg_mode |= PG_MODE_WP; 103 } 104 if (env->cr[4] & CR4_PAE_MASK) { 105 pg_mode |= PG_MODE_PAE; 106 if (env->efer & MSR_EFER_NXE) { 107 pg_mode |= PG_MODE_NXE; 108 } 109 } 110 if (env->cr[4] & CR4_PSE_MASK) { 111 pg_mode |= PG_MODE_PSE; 112 } 113 if (env->cr[4] & CR4_SMEP_MASK) { 114 pg_mode |= PG_MODE_SMEP; 115 } 116 if (env->hflags & HF_LMA_MASK) { 117 pg_mode |= PG_MODE_LMA; 118 if (env->cr[4] & CR4_PKE_MASK) { 119 pg_mode |= PG_MODE_PKE; 120 } 121 if (env->cr[4] & CR4_PKS_MASK) { 122 pg_mode |= PG_MODE_PKS; 123 } 124 if (env->cr[4] & CR4_LA57_MASK) { 125 pg_mode |= PG_MODE_LA57; 126 } 127 } 128 return pg_mode; 129 } 130 131 /* return non zero if error */ 132 static inline int load_segment_ra(CPUX86State *env, uint32_t *e1_ptr, 133 uint32_t *e2_ptr, int selector, 134 uintptr_t retaddr) 135 { 136 SegmentCache *dt; 137 int index; 138 target_ulong ptr; 139 140 if (selector & 0x4) { 141 dt = &env->ldt; 142 } else { 143 dt = &env->gdt; 144 } 145 index = selector & ~7; 146 if ((index + 7) > dt->limit) { 147 return -1; 148 } 149 ptr = dt->base + index; 150 *e1_ptr = cpu_ldl_kernel_ra(env, ptr, retaddr); 151 *e2_ptr = cpu_ldl_kernel_ra(env, ptr + 4, retaddr); 152 return 0; 153 } 154 155 static inline int load_segment(CPUX86State *env, uint32_t *e1_ptr, 156 uint32_t *e2_ptr, int selector) 157 { 158 return load_segment_ra(env, e1_ptr, e2_ptr, selector, 0); 159 } 160 161 static inline unsigned int get_seg_limit(uint32_t e1, uint32_t e2) 162 { 163 unsigned int limit; 164 165 limit = (e1 & 0xffff) | (e2 & 0x000f0000); 166 if (e2 & DESC_G_MASK) { 167 limit = (limit << 12) | 0xfff; 168 } 169 return limit; 170 } 171 172 static inline uint32_t get_seg_base(uint32_t e1, uint32_t e2) 173 { 174 return (e1 >> 16) | ((e2 & 0xff) << 16) | (e2 & 0xff000000); 175 } 176 177 static inline void load_seg_cache_raw_dt(SegmentCache *sc, uint32_t e1, 178 uint32_t e2) 179 { 180 sc->base = get_seg_base(e1, e2); 181 sc->limit = get_seg_limit(e1, e2); 182 sc->flags = e2; 183 } 184 185 /* init the segment cache in vm86 mode. */ 186 static inline void load_seg_vm(CPUX86State *env, int seg, int selector) 187 { 188 selector &= 0xffff; 189 190 cpu_x86_load_seg_cache(env, seg, selector, (selector << 4), 0xffff, 191 DESC_P_MASK | DESC_S_MASK | DESC_W_MASK | 192 DESC_A_MASK | (3 << DESC_DPL_SHIFT)); 193 } 194 195 static inline void get_ss_esp_from_tss(CPUX86State *env, uint32_t *ss_ptr, 196 uint32_t *esp_ptr, int dpl, 197 uintptr_t retaddr) 198 { 199 X86CPU *cpu = env_archcpu(env); 200 int type, index, shift; 201 202 #if 0 203 { 204 int i; 205 printf("TR: base=%p limit=%x\n", env->tr.base, env->tr.limit); 206 for (i = 0; i < env->tr.limit; i++) { 207 printf("%02x ", env->tr.base[i]); 208 if ((i & 7) == 7) { 209 printf("\n"); 210 } 211 } 212 printf("\n"); 213 } 214 #endif 215 216 if (!(env->tr.flags & DESC_P_MASK)) { 217 cpu_abort(CPU(cpu), "invalid tss"); 218 } 219 type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf; 220 if ((type & 7) != 1) { 221 cpu_abort(CPU(cpu), "invalid tss type"); 222 } 223 shift = type >> 3; 224 index = (dpl * 4 + 2) << shift; 225 if (index + (4 << shift) - 1 > env->tr.limit) { 226 raise_exception_err_ra(env, EXCP0A_TSS, env->tr.selector & 0xfffc, retaddr); 227 } 228 if (shift == 0) { 229 *esp_ptr = cpu_lduw_kernel_ra(env, env->tr.base + index, retaddr); 230 *ss_ptr = cpu_lduw_kernel_ra(env, env->tr.base + index + 2, retaddr); 231 } else { 232 *esp_ptr = cpu_ldl_kernel_ra(env, env->tr.base + index, retaddr); 233 *ss_ptr = cpu_lduw_kernel_ra(env, env->tr.base + index + 4, retaddr); 234 } 235 } 236 237 static void tss_load_seg(CPUX86State *env, X86Seg seg_reg, int selector, 238 int cpl, uintptr_t retaddr) 239 { 240 uint32_t e1, e2; 241 int rpl, dpl; 242 243 if ((selector & 0xfffc) != 0) { 244 if (load_segment_ra(env, &e1, &e2, selector, retaddr) != 0) { 245 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 246 } 247 if (!(e2 & DESC_S_MASK)) { 248 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 249 } 250 rpl = selector & 3; 251 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 252 if (seg_reg == R_CS) { 253 if (!(e2 & DESC_CS_MASK)) { 254 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 255 } 256 if (dpl != rpl) { 257 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 258 } 259 } else if (seg_reg == R_SS) { 260 /* SS must be writable data */ 261 if ((e2 & DESC_CS_MASK) || !(e2 & DESC_W_MASK)) { 262 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 263 } 264 if (dpl != cpl || dpl != rpl) { 265 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 266 } 267 } else { 268 /* not readable code */ 269 if ((e2 & DESC_CS_MASK) && !(e2 & DESC_R_MASK)) { 270 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 271 } 272 /* if data or non conforming code, checks the rights */ 273 if (((e2 >> DESC_TYPE_SHIFT) & 0xf) < 12) { 274 if (dpl < cpl || dpl < rpl) { 275 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 276 } 277 } 278 } 279 if (!(e2 & DESC_P_MASK)) { 280 raise_exception_err_ra(env, EXCP0B_NOSEG, selector & 0xfffc, retaddr); 281 } 282 cpu_x86_load_seg_cache(env, seg_reg, selector, 283 get_seg_base(e1, e2), 284 get_seg_limit(e1, e2), 285 e2); 286 } else { 287 if (seg_reg == R_SS || seg_reg == R_CS) { 288 raise_exception_err_ra(env, EXCP0A_TSS, selector & 0xfffc, retaddr); 289 } 290 } 291 } 292 293 static void tss_set_busy(CPUX86State *env, int tss_selector, bool value, 294 uintptr_t retaddr) 295 { 296 target_ulong ptr = env->gdt.base + (tss_selector & ~7); 297 uint32_t e2 = cpu_ldl_kernel_ra(env, ptr + 4, retaddr); 298 299 if (value) { 300 e2 |= DESC_TSS_BUSY_MASK; 301 } else { 302 e2 &= ~DESC_TSS_BUSY_MASK; 303 } 304 305 cpu_stl_kernel_ra(env, ptr + 4, e2, retaddr); 306 } 307 308 #define SWITCH_TSS_JMP 0 309 #define SWITCH_TSS_IRET 1 310 #define SWITCH_TSS_CALL 2 311 312 /* return 0 if switching to a 16-bit selector */ 313 static int switch_tss_ra(CPUX86State *env, int tss_selector, 314 uint32_t e1, uint32_t e2, int source, 315 uint32_t next_eip, uintptr_t retaddr) 316 { 317 int tss_limit, tss_limit_max, type, old_tss_limit_max, old_type, i; 318 target_ulong tss_base; 319 uint32_t new_regs[8], new_segs[6]; 320 uint32_t new_eflags, new_eip, new_cr3, new_ldt, new_trap; 321 uint32_t old_eflags, eflags_mask; 322 SegmentCache *dt; 323 int mmu_index, index; 324 target_ulong ptr; 325 X86Access old, new; 326 327 type = (e2 >> DESC_TYPE_SHIFT) & 0xf; 328 LOG_PCALL("switch_tss: sel=0x%04x type=%d src=%d\n", tss_selector, type, 329 source); 330 331 /* if task gate, we read the TSS segment and we load it */ 332 if (type == 5) { 333 if (!(e2 & DESC_P_MASK)) { 334 raise_exception_err_ra(env, EXCP0B_NOSEG, tss_selector & 0xfffc, retaddr); 335 } 336 tss_selector = e1 >> 16; 337 if (tss_selector & 4) { 338 raise_exception_err_ra(env, EXCP0A_TSS, tss_selector & 0xfffc, retaddr); 339 } 340 if (load_segment_ra(env, &e1, &e2, tss_selector, retaddr) != 0) { 341 raise_exception_err_ra(env, EXCP0D_GPF, tss_selector & 0xfffc, retaddr); 342 } 343 if (e2 & DESC_S_MASK) { 344 raise_exception_err_ra(env, EXCP0D_GPF, tss_selector & 0xfffc, retaddr); 345 } 346 type = (e2 >> DESC_TYPE_SHIFT) & 0xf; 347 if ((type & 7) != 1) { 348 raise_exception_err_ra(env, EXCP0D_GPF, tss_selector & 0xfffc, retaddr); 349 } 350 } 351 352 if (!(e2 & DESC_P_MASK)) { 353 raise_exception_err_ra(env, EXCP0B_NOSEG, tss_selector & 0xfffc, retaddr); 354 } 355 356 if (type & 8) { 357 tss_limit_max = 103; 358 } else { 359 tss_limit_max = 43; 360 } 361 tss_limit = get_seg_limit(e1, e2); 362 tss_base = get_seg_base(e1, e2); 363 if ((tss_selector & 4) != 0 || 364 tss_limit < tss_limit_max) { 365 raise_exception_err_ra(env, EXCP0A_TSS, tss_selector & 0xfffc, retaddr); 366 } 367 old_type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf; 368 if (old_type & 8) { 369 old_tss_limit_max = 103; 370 } else { 371 old_tss_limit_max = 43; 372 } 373 374 /* new TSS must be busy iff the source is an IRET instruction */ 375 if (!!(e2 & DESC_TSS_BUSY_MASK) != (source == SWITCH_TSS_IRET)) { 376 raise_exception_err_ra(env, EXCP0A_TSS, tss_selector & 0xfffc, retaddr); 377 } 378 379 /* X86Access avoids memory exceptions during the task switch */ 380 mmu_index = cpu_mmu_index_kernel(env); 381 access_prepare_mmu(&old, env, env->tr.base, old_tss_limit_max, 382 MMU_DATA_STORE, mmu_index, retaddr); 383 384 if (source == SWITCH_TSS_CALL) { 385 /* Probe for future write of parent task */ 386 probe_access(env, tss_base, 2, MMU_DATA_STORE, 387 mmu_index, retaddr); 388 } 389 access_prepare_mmu(&new, env, tss_base, tss_limit, 390 MMU_DATA_LOAD, mmu_index, retaddr); 391 392 /* save the current state in the old TSS */ 393 old_eflags = cpu_compute_eflags(env); 394 if (old_type & 8) { 395 /* 32 bit */ 396 access_stl(&old, env->tr.base + 0x20, next_eip); 397 access_stl(&old, env->tr.base + 0x24, old_eflags); 398 access_stl(&old, env->tr.base + (0x28 + 0 * 4), env->regs[R_EAX]); 399 access_stl(&old, env->tr.base + (0x28 + 1 * 4), env->regs[R_ECX]); 400 access_stl(&old, env->tr.base + (0x28 + 2 * 4), env->regs[R_EDX]); 401 access_stl(&old, env->tr.base + (0x28 + 3 * 4), env->regs[R_EBX]); 402 access_stl(&old, env->tr.base + (0x28 + 4 * 4), env->regs[R_ESP]); 403 access_stl(&old, env->tr.base + (0x28 + 5 * 4), env->regs[R_EBP]); 404 access_stl(&old, env->tr.base + (0x28 + 6 * 4), env->regs[R_ESI]); 405 access_stl(&old, env->tr.base + (0x28 + 7 * 4), env->regs[R_EDI]); 406 for (i = 0; i < 6; i++) { 407 access_stw(&old, env->tr.base + (0x48 + i * 4), 408 env->segs[i].selector); 409 } 410 } else { 411 /* 16 bit */ 412 access_stw(&old, env->tr.base + 0x0e, next_eip); 413 access_stw(&old, env->tr.base + 0x10, old_eflags); 414 access_stw(&old, env->tr.base + (0x12 + 0 * 2), env->regs[R_EAX]); 415 access_stw(&old, env->tr.base + (0x12 + 1 * 2), env->regs[R_ECX]); 416 access_stw(&old, env->tr.base + (0x12 + 2 * 2), env->regs[R_EDX]); 417 access_stw(&old, env->tr.base + (0x12 + 3 * 2), env->regs[R_EBX]); 418 access_stw(&old, env->tr.base + (0x12 + 4 * 2), env->regs[R_ESP]); 419 access_stw(&old, env->tr.base + (0x12 + 5 * 2), env->regs[R_EBP]); 420 access_stw(&old, env->tr.base + (0x12 + 6 * 2), env->regs[R_ESI]); 421 access_stw(&old, env->tr.base + (0x12 + 7 * 2), env->regs[R_EDI]); 422 for (i = 0; i < 4; i++) { 423 access_stw(&old, env->tr.base + (0x22 + i * 2), 424 env->segs[i].selector); 425 } 426 } 427 428 /* read all the registers from the new TSS */ 429 if (type & 8) { 430 /* 32 bit */ 431 new_cr3 = access_ldl(&new, tss_base + 0x1c); 432 new_eip = access_ldl(&new, tss_base + 0x20); 433 new_eflags = access_ldl(&new, tss_base + 0x24); 434 for (i = 0; i < 8; i++) { 435 new_regs[i] = access_ldl(&new, tss_base + (0x28 + i * 4)); 436 } 437 for (i = 0; i < 6; i++) { 438 new_segs[i] = access_ldw(&new, tss_base + (0x48 + i * 4)); 439 } 440 new_ldt = access_ldw(&new, tss_base + 0x60); 441 new_trap = access_ldl(&new, tss_base + 0x64); 442 } else { 443 /* 16 bit */ 444 new_cr3 = 0; 445 new_eip = access_ldw(&new, tss_base + 0x0e); 446 new_eflags = access_ldw(&new, tss_base + 0x10); 447 for (i = 0; i < 8; i++) { 448 new_regs[i] = access_ldw(&new, tss_base + (0x12 + i * 2)); 449 } 450 for (i = 0; i < 4; i++) { 451 new_segs[i] = access_ldw(&new, tss_base + (0x22 + i * 2)); 452 } 453 new_ldt = access_ldw(&new, tss_base + 0x2a); 454 new_segs[R_FS] = 0; 455 new_segs[R_GS] = 0; 456 new_trap = 0; 457 } 458 /* XXX: avoid a compiler warning, see 459 http://support.amd.com/us/Processor_TechDocs/24593.pdf 460 chapters 12.2.5 and 13.2.4 on how to implement TSS Trap bit */ 461 (void)new_trap; 462 463 /* clear busy bit (it is restartable) */ 464 if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_IRET) { 465 tss_set_busy(env, env->tr.selector, 0, retaddr); 466 } 467 468 if (source == SWITCH_TSS_IRET) { 469 old_eflags &= ~NT_MASK; 470 if (old_type & 8) { 471 access_stl(&old, env->tr.base + 0x24, old_eflags); 472 } else { 473 access_stw(&old, env->tr.base + 0x10, old_eflags); 474 } 475 } 476 477 if (source == SWITCH_TSS_CALL) { 478 /* 479 * Thanks to the probe_access above, we know the first two 480 * bytes addressed by &new are writable too. 481 */ 482 access_stw(&new, tss_base, env->tr.selector); 483 new_eflags |= NT_MASK; 484 } 485 486 /* set busy bit */ 487 if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_CALL) { 488 tss_set_busy(env, tss_selector, 1, retaddr); 489 } 490 491 /* set the new CPU state */ 492 493 /* now if an exception occurs, it will occur in the next task context */ 494 495 env->cr[0] |= CR0_TS_MASK; 496 env->hflags |= HF_TS_MASK; 497 env->tr.selector = tss_selector; 498 env->tr.base = tss_base; 499 env->tr.limit = tss_limit; 500 env->tr.flags = e2 & ~DESC_TSS_BUSY_MASK; 501 502 if ((type & 8) && (env->cr[0] & CR0_PG_MASK)) { 503 cpu_x86_update_cr3(env, new_cr3); 504 } 505 506 /* load all registers without an exception, then reload them with 507 possible exception */ 508 env->eip = new_eip; 509 eflags_mask = TF_MASK | AC_MASK | ID_MASK | 510 IF_MASK | IOPL_MASK | VM_MASK | RF_MASK | NT_MASK; 511 if (type & 8) { 512 cpu_load_eflags(env, new_eflags, eflags_mask); 513 for (i = 0; i < 8; i++) { 514 env->regs[i] = new_regs[i]; 515 } 516 } else { 517 cpu_load_eflags(env, new_eflags, eflags_mask & 0xffff); 518 for (i = 0; i < 8; i++) { 519 env->regs[i] = (env->regs[i] & 0xffff0000) | new_regs[i]; 520 } 521 } 522 if (new_eflags & VM_MASK) { 523 for (i = 0; i < 6; i++) { 524 load_seg_vm(env, i, new_segs[i]); 525 } 526 } else { 527 /* first just selectors as the rest may trigger exceptions */ 528 for (i = 0; i < 6; i++) { 529 cpu_x86_load_seg_cache(env, i, new_segs[i], 0, 0, 0); 530 } 531 } 532 533 env->ldt.selector = new_ldt & ~4; 534 env->ldt.base = 0; 535 env->ldt.limit = 0; 536 env->ldt.flags = 0; 537 538 /* load the LDT */ 539 if (new_ldt & 4) { 540 raise_exception_err_ra(env, EXCP0A_TSS, new_ldt & 0xfffc, retaddr); 541 } 542 543 if ((new_ldt & 0xfffc) != 0) { 544 dt = &env->gdt; 545 index = new_ldt & ~7; 546 if ((index + 7) > dt->limit) { 547 raise_exception_err_ra(env, EXCP0A_TSS, new_ldt & 0xfffc, retaddr); 548 } 549 ptr = dt->base + index; 550 e1 = cpu_ldl_kernel_ra(env, ptr, retaddr); 551 e2 = cpu_ldl_kernel_ra(env, ptr + 4, retaddr); 552 if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2) { 553 raise_exception_err_ra(env, EXCP0A_TSS, new_ldt & 0xfffc, retaddr); 554 } 555 if (!(e2 & DESC_P_MASK)) { 556 raise_exception_err_ra(env, EXCP0A_TSS, new_ldt & 0xfffc, retaddr); 557 } 558 load_seg_cache_raw_dt(&env->ldt, e1, e2); 559 } 560 561 /* load the segments */ 562 if (!(new_eflags & VM_MASK)) { 563 int cpl = new_segs[R_CS] & 3; 564 tss_load_seg(env, R_CS, new_segs[R_CS], cpl, retaddr); 565 tss_load_seg(env, R_SS, new_segs[R_SS], cpl, retaddr); 566 tss_load_seg(env, R_ES, new_segs[R_ES], cpl, retaddr); 567 tss_load_seg(env, R_DS, new_segs[R_DS], cpl, retaddr); 568 tss_load_seg(env, R_FS, new_segs[R_FS], cpl, retaddr); 569 tss_load_seg(env, R_GS, new_segs[R_GS], cpl, retaddr); 570 } 571 572 /* check that env->eip is in the CS segment limits */ 573 if (new_eip > env->segs[R_CS].limit) { 574 /* XXX: different exception if CALL? */ 575 raise_exception_err_ra(env, EXCP0D_GPF, 0, retaddr); 576 } 577 578 #ifndef CONFIG_USER_ONLY 579 /* reset local breakpoints */ 580 if (env->dr[7] & DR7_LOCAL_BP_MASK) { 581 cpu_x86_update_dr7(env, env->dr[7] & ~DR7_LOCAL_BP_MASK); 582 } 583 #endif 584 return type >> 3; 585 } 586 587 static int switch_tss(CPUX86State *env, int tss_selector, 588 uint32_t e1, uint32_t e2, int source, 589 uint32_t next_eip) 590 { 591 return switch_tss_ra(env, tss_selector, e1, e2, source, next_eip, 0); 592 } 593 594 static inline unsigned int get_sp_mask(unsigned int e2) 595 { 596 #ifdef TARGET_X86_64 597 if (e2 & DESC_L_MASK) { 598 return 0; 599 } else 600 #endif 601 if (e2 & DESC_B_MASK) { 602 return 0xffffffff; 603 } else { 604 return 0xffff; 605 } 606 } 607 608 static int exception_is_fault(int intno) 609 { 610 switch (intno) { 611 /* 612 * #DB can be both fault- and trap-like, but it never sets RF=1 613 * in the RFLAGS value pushed on the stack. 614 */ 615 case EXCP01_DB: 616 case EXCP03_INT3: 617 case EXCP04_INTO: 618 case EXCP08_DBLE: 619 case EXCP12_MCHK: 620 return 0; 621 } 622 /* Everything else including reserved exception is a fault. */ 623 return 1; 624 } 625 626 int exception_has_error_code(int intno) 627 { 628 switch (intno) { 629 case 8: 630 case 10: 631 case 11: 632 case 12: 633 case 13: 634 case 14: 635 case 17: 636 return 1; 637 } 638 return 0; 639 } 640 641 /* protected mode interrupt */ 642 static void do_interrupt_protected(CPUX86State *env, int intno, int is_int, 643 int error_code, unsigned int next_eip, 644 int is_hw) 645 { 646 SegmentCache *dt; 647 target_ulong ptr; 648 int type, dpl, selector, ss_dpl, cpl; 649 int has_error_code, new_stack, shift; 650 uint32_t e1, e2, offset, ss = 0, ss_e1 = 0, ss_e2 = 0; 651 uint32_t old_eip, eflags; 652 int vm86 = env->eflags & VM_MASK; 653 StackAccess sa; 654 bool set_rf; 655 656 has_error_code = 0; 657 if (!is_int && !is_hw) { 658 has_error_code = exception_has_error_code(intno); 659 } 660 if (is_int) { 661 old_eip = next_eip; 662 set_rf = false; 663 } else { 664 old_eip = env->eip; 665 set_rf = exception_is_fault(intno); 666 } 667 668 dt = &env->idt; 669 if (intno * 8 + 7 > dt->limit) { 670 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2); 671 } 672 ptr = dt->base + intno * 8; 673 e1 = cpu_ldl_kernel(env, ptr); 674 e2 = cpu_ldl_kernel(env, ptr + 4); 675 /* check gate type */ 676 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f; 677 switch (type) { 678 case 5: /* task gate */ 679 case 6: /* 286 interrupt gate */ 680 case 7: /* 286 trap gate */ 681 case 14: /* 386 interrupt gate */ 682 case 15: /* 386 trap gate */ 683 break; 684 default: 685 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2); 686 break; 687 } 688 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 689 cpl = env->hflags & HF_CPL_MASK; 690 /* check privilege if software int */ 691 if (is_int && dpl < cpl) { 692 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2); 693 } 694 695 sa.env = env; 696 sa.ra = 0; 697 sa.mmu_index = cpu_mmu_index_kernel(env); 698 699 if (type == 5) { 700 /* task gate */ 701 /* must do that check here to return the correct error code */ 702 if (!(e2 & DESC_P_MASK)) { 703 raise_exception_err(env, EXCP0B_NOSEG, intno * 8 + 2); 704 } 705 shift = switch_tss(env, intno * 8, e1, e2, SWITCH_TSS_CALL, old_eip); 706 if (has_error_code) { 707 /* push the error code */ 708 if (env->segs[R_SS].flags & DESC_B_MASK) { 709 sa.sp_mask = 0xffffffff; 710 } else { 711 sa.sp_mask = 0xffff; 712 } 713 sa.sp = env->regs[R_ESP]; 714 sa.ss_base = env->segs[R_SS].base; 715 if (shift) { 716 pushl(&sa, error_code); 717 } else { 718 pushw(&sa, error_code); 719 } 720 SET_ESP(sa.sp, sa.sp_mask); 721 } 722 return; 723 } 724 725 /* Otherwise, trap or interrupt gate */ 726 727 /* check valid bit */ 728 if (!(e2 & DESC_P_MASK)) { 729 raise_exception_err(env, EXCP0B_NOSEG, intno * 8 + 2); 730 } 731 selector = e1 >> 16; 732 offset = (e2 & 0xffff0000) | (e1 & 0x0000ffff); 733 if ((selector & 0xfffc) == 0) { 734 raise_exception_err(env, EXCP0D_GPF, 0); 735 } 736 if (load_segment(env, &e1, &e2, selector) != 0) { 737 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 738 } 739 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK))) { 740 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 741 } 742 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 743 if (dpl > cpl) { 744 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 745 } 746 if (!(e2 & DESC_P_MASK)) { 747 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc); 748 } 749 if (e2 & DESC_C_MASK) { 750 dpl = cpl; 751 } 752 if (dpl < cpl) { 753 /* to inner privilege */ 754 uint32_t esp; 755 get_ss_esp_from_tss(env, &ss, &esp, dpl, 0); 756 if ((ss & 0xfffc) == 0) { 757 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc); 758 } 759 if ((ss & 3) != dpl) { 760 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc); 761 } 762 if (load_segment(env, &ss_e1, &ss_e2, ss) != 0) { 763 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc); 764 } 765 ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3; 766 if (ss_dpl != dpl) { 767 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc); 768 } 769 if (!(ss_e2 & DESC_S_MASK) || 770 (ss_e2 & DESC_CS_MASK) || 771 !(ss_e2 & DESC_W_MASK)) { 772 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc); 773 } 774 if (!(ss_e2 & DESC_P_MASK)) { 775 raise_exception_err(env, EXCP0A_TSS, ss & 0xfffc); 776 } 777 new_stack = 1; 778 sa.sp = esp; 779 sa.sp_mask = get_sp_mask(ss_e2); 780 sa.ss_base = get_seg_base(ss_e1, ss_e2); 781 } else { 782 /* to same privilege */ 783 if (vm86) { 784 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 785 } 786 new_stack = 0; 787 sa.sp = env->regs[R_ESP]; 788 sa.sp_mask = get_sp_mask(env->segs[R_SS].flags); 789 sa.ss_base = env->segs[R_SS].base; 790 } 791 792 shift = type >> 3; 793 794 #if 0 795 /* XXX: check that enough room is available */ 796 push_size = 6 + (new_stack << 2) + (has_error_code << 1); 797 if (vm86) { 798 push_size += 8; 799 } 800 push_size <<= shift; 801 #endif 802 eflags = cpu_compute_eflags(env); 803 /* 804 * AMD states that code breakpoint #DBs clear RF=0, Intel leaves it 805 * as is. AMD behavior could be implemented in check_hw_breakpoints(). 806 */ 807 if (set_rf) { 808 eflags |= RF_MASK; 809 } 810 811 if (shift == 1) { 812 if (new_stack) { 813 if (vm86) { 814 pushl(&sa, env->segs[R_GS].selector); 815 pushl(&sa, env->segs[R_FS].selector); 816 pushl(&sa, env->segs[R_DS].selector); 817 pushl(&sa, env->segs[R_ES].selector); 818 } 819 pushl(&sa, env->segs[R_SS].selector); 820 pushl(&sa, env->regs[R_ESP]); 821 } 822 pushl(&sa, eflags); 823 pushl(&sa, env->segs[R_CS].selector); 824 pushl(&sa, old_eip); 825 if (has_error_code) { 826 pushl(&sa, error_code); 827 } 828 } else { 829 if (new_stack) { 830 if (vm86) { 831 pushw(&sa, env->segs[R_GS].selector); 832 pushw(&sa, env->segs[R_FS].selector); 833 pushw(&sa, env->segs[R_DS].selector); 834 pushw(&sa, env->segs[R_ES].selector); 835 } 836 pushw(&sa, env->segs[R_SS].selector); 837 pushw(&sa, env->regs[R_ESP]); 838 } 839 pushw(&sa, eflags); 840 pushw(&sa, env->segs[R_CS].selector); 841 pushw(&sa, old_eip); 842 if (has_error_code) { 843 pushw(&sa, error_code); 844 } 845 } 846 847 /* interrupt gate clear IF mask */ 848 if ((type & 1) == 0) { 849 env->eflags &= ~IF_MASK; 850 } 851 env->eflags &= ~(TF_MASK | VM_MASK | RF_MASK | NT_MASK); 852 853 if (new_stack) { 854 if (vm86) { 855 cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0, 0); 856 cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0, 0); 857 cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0, 0); 858 cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0, 0); 859 } 860 ss = (ss & ~3) | dpl; 861 cpu_x86_load_seg_cache(env, R_SS, ss, sa.ss_base, 862 get_seg_limit(ss_e1, ss_e2), ss_e2); 863 } 864 SET_ESP(sa.sp, sa.sp_mask); 865 866 selector = (selector & ~3) | dpl; 867 cpu_x86_load_seg_cache(env, R_CS, selector, 868 get_seg_base(e1, e2), 869 get_seg_limit(e1, e2), 870 e2); 871 env->eip = offset; 872 } 873 874 #ifdef TARGET_X86_64 875 876 static void pushq(StackAccess *sa, uint64_t val) 877 { 878 sa->sp -= 8; 879 cpu_stq_mmuidx_ra(sa->env, sa->sp, val, sa->mmu_index, sa->ra); 880 } 881 882 static uint64_t popq(StackAccess *sa) 883 { 884 uint64_t ret = cpu_ldq_mmuidx_ra(sa->env, sa->sp, sa->mmu_index, sa->ra); 885 sa->sp += 8; 886 return ret; 887 } 888 889 static inline target_ulong get_rsp_from_tss(CPUX86State *env, int level) 890 { 891 X86CPU *cpu = env_archcpu(env); 892 int index, pg_mode; 893 target_ulong rsp; 894 int32_t sext; 895 896 #if 0 897 printf("TR: base=" TARGET_FMT_lx " limit=%x\n", 898 env->tr.base, env->tr.limit); 899 #endif 900 901 if (!(env->tr.flags & DESC_P_MASK)) { 902 cpu_abort(CPU(cpu), "invalid tss"); 903 } 904 index = 8 * level + 4; 905 if ((index + 7) > env->tr.limit) { 906 raise_exception_err(env, EXCP0A_TSS, env->tr.selector & 0xfffc); 907 } 908 909 rsp = cpu_ldq_kernel(env, env->tr.base + index); 910 911 /* test virtual address sign extension */ 912 pg_mode = get_pg_mode(env); 913 sext = (int64_t)rsp >> (pg_mode & PG_MODE_LA57 ? 56 : 47); 914 if (sext != 0 && sext != -1) { 915 raise_exception_err(env, EXCP0C_STACK, 0); 916 } 917 918 return rsp; 919 } 920 921 /* 64 bit interrupt */ 922 static void do_interrupt64(CPUX86State *env, int intno, int is_int, 923 int error_code, target_ulong next_eip, int is_hw) 924 { 925 SegmentCache *dt; 926 target_ulong ptr; 927 int type, dpl, selector, cpl, ist; 928 int has_error_code, new_stack; 929 uint32_t e1, e2, e3, ss, eflags; 930 target_ulong old_eip, offset; 931 bool set_rf; 932 StackAccess sa; 933 934 has_error_code = 0; 935 if (!is_int && !is_hw) { 936 has_error_code = exception_has_error_code(intno); 937 } 938 if (is_int) { 939 old_eip = next_eip; 940 set_rf = false; 941 } else { 942 old_eip = env->eip; 943 set_rf = exception_is_fault(intno); 944 } 945 946 dt = &env->idt; 947 if (intno * 16 + 15 > dt->limit) { 948 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2); 949 } 950 ptr = dt->base + intno * 16; 951 e1 = cpu_ldl_kernel(env, ptr); 952 e2 = cpu_ldl_kernel(env, ptr + 4); 953 e3 = cpu_ldl_kernel(env, ptr + 8); 954 /* check gate type */ 955 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f; 956 switch (type) { 957 case 14: /* 386 interrupt gate */ 958 case 15: /* 386 trap gate */ 959 break; 960 default: 961 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2); 962 break; 963 } 964 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 965 cpl = env->hflags & HF_CPL_MASK; 966 /* check privilege if software int */ 967 if (is_int && dpl < cpl) { 968 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2); 969 } 970 /* check valid bit */ 971 if (!(e2 & DESC_P_MASK)) { 972 raise_exception_err(env, EXCP0B_NOSEG, intno * 8 + 2); 973 } 974 selector = e1 >> 16; 975 offset = ((target_ulong)e3 << 32) | (e2 & 0xffff0000) | (e1 & 0x0000ffff); 976 ist = e2 & 7; 977 if ((selector & 0xfffc) == 0) { 978 raise_exception_err(env, EXCP0D_GPF, 0); 979 } 980 981 if (load_segment(env, &e1, &e2, selector) != 0) { 982 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 983 } 984 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK))) { 985 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 986 } 987 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 988 if (dpl > cpl) { 989 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 990 } 991 if (!(e2 & DESC_P_MASK)) { 992 raise_exception_err(env, EXCP0B_NOSEG, selector & 0xfffc); 993 } 994 if (!(e2 & DESC_L_MASK) || (e2 & DESC_B_MASK)) { 995 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 996 } 997 if (e2 & DESC_C_MASK) { 998 dpl = cpl; 999 } 1000 1001 sa.env = env; 1002 sa.ra = 0; 1003 sa.mmu_index = cpu_mmu_index_kernel(env); 1004 sa.sp_mask = -1; 1005 sa.ss_base = 0; 1006 if (dpl < cpl || ist != 0) { 1007 /* to inner privilege */ 1008 new_stack = 1; 1009 sa.sp = get_rsp_from_tss(env, ist != 0 ? ist + 3 : dpl); 1010 ss = 0; 1011 } else { 1012 /* to same privilege */ 1013 if (env->eflags & VM_MASK) { 1014 raise_exception_err(env, EXCP0D_GPF, selector & 0xfffc); 1015 } 1016 new_stack = 0; 1017 sa.sp = env->regs[R_ESP]; 1018 } 1019 sa.sp &= ~0xfLL; /* align stack */ 1020 1021 /* See do_interrupt_protected. */ 1022 eflags = cpu_compute_eflags(env); 1023 if (set_rf) { 1024 eflags |= RF_MASK; 1025 } 1026 1027 pushq(&sa, env->segs[R_SS].selector); 1028 pushq(&sa, env->regs[R_ESP]); 1029 pushq(&sa, eflags); 1030 pushq(&sa, env->segs[R_CS].selector); 1031 pushq(&sa, old_eip); 1032 if (has_error_code) { 1033 pushq(&sa, error_code); 1034 } 1035 1036 /* interrupt gate clear IF mask */ 1037 if ((type & 1) == 0) { 1038 env->eflags &= ~IF_MASK; 1039 } 1040 env->eflags &= ~(TF_MASK | VM_MASK | RF_MASK | NT_MASK); 1041 1042 if (new_stack) { 1043 ss = 0 | dpl; 1044 cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, dpl << DESC_DPL_SHIFT); 1045 } 1046 env->regs[R_ESP] = sa.sp; 1047 1048 selector = (selector & ~3) | dpl; 1049 cpu_x86_load_seg_cache(env, R_CS, selector, 1050 get_seg_base(e1, e2), 1051 get_seg_limit(e1, e2), 1052 e2); 1053 env->eip = offset; 1054 } 1055 #endif /* TARGET_X86_64 */ 1056 1057 void helper_sysret(CPUX86State *env, int dflag) 1058 { 1059 int cpl, selector; 1060 1061 if (!(env->efer & MSR_EFER_SCE)) { 1062 raise_exception_err_ra(env, EXCP06_ILLOP, 0, GETPC()); 1063 } 1064 cpl = env->hflags & HF_CPL_MASK; 1065 if (!(env->cr[0] & CR0_PE_MASK) || cpl != 0) { 1066 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 1067 } 1068 selector = (env->star >> 48) & 0xffff; 1069 #ifdef TARGET_X86_64 1070 if (env->hflags & HF_LMA_MASK) { 1071 cpu_load_eflags(env, (uint32_t)(env->regs[11]), TF_MASK | AC_MASK 1072 | ID_MASK | IF_MASK | IOPL_MASK | VM_MASK | RF_MASK | 1073 NT_MASK); 1074 if (dflag == 2) { 1075 cpu_x86_load_seg_cache(env, R_CS, (selector + 16) | 3, 1076 0, 0xffffffff, 1077 DESC_G_MASK | DESC_P_MASK | 1078 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 1079 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | 1080 DESC_L_MASK); 1081 env->eip = env->regs[R_ECX]; 1082 } else { 1083 cpu_x86_load_seg_cache(env, R_CS, selector | 3, 1084 0, 0xffffffff, 1085 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 1086 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 1087 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK); 1088 env->eip = (uint32_t)env->regs[R_ECX]; 1089 } 1090 cpu_x86_load_seg_cache(env, R_SS, (selector + 8) | 3, 1091 0, 0xffffffff, 1092 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 1093 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 1094 DESC_W_MASK | DESC_A_MASK); 1095 } else 1096 #endif 1097 { 1098 env->eflags |= IF_MASK; 1099 cpu_x86_load_seg_cache(env, R_CS, selector | 3, 1100 0, 0xffffffff, 1101 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 1102 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 1103 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK); 1104 env->eip = (uint32_t)env->regs[R_ECX]; 1105 cpu_x86_load_seg_cache(env, R_SS, (selector + 8) | 3, 1106 0, 0xffffffff, 1107 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 1108 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 1109 DESC_W_MASK | DESC_A_MASK); 1110 } 1111 } 1112 1113 /* real mode interrupt */ 1114 static void do_interrupt_real(CPUX86State *env, int intno, int is_int, 1115 int error_code, unsigned int next_eip) 1116 { 1117 SegmentCache *dt; 1118 target_ulong ptr; 1119 int selector; 1120 uint32_t offset; 1121 uint32_t old_cs, old_eip; 1122 StackAccess sa; 1123 1124 /* real mode (simpler!) */ 1125 dt = &env->idt; 1126 if (intno * 4 + 3 > dt->limit) { 1127 raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2); 1128 } 1129 ptr = dt->base + intno * 4; 1130 offset = cpu_lduw_kernel(env, ptr); 1131 selector = cpu_lduw_kernel(env, ptr + 2); 1132 1133 sa.env = env; 1134 sa.ra = 0; 1135 sa.sp = env->regs[R_ESP]; 1136 sa.sp_mask = 0xffff; 1137 sa.ss_base = env->segs[R_SS].base; 1138 sa.mmu_index = cpu_mmu_index_kernel(env); 1139 1140 if (is_int) { 1141 old_eip = next_eip; 1142 } else { 1143 old_eip = env->eip; 1144 } 1145 old_cs = env->segs[R_CS].selector; 1146 /* XXX: use SS segment size? */ 1147 pushw(&sa, cpu_compute_eflags(env)); 1148 pushw(&sa, old_cs); 1149 pushw(&sa, old_eip); 1150 1151 /* update processor state */ 1152 SET_ESP(sa.sp, sa.sp_mask); 1153 env->eip = offset; 1154 env->segs[R_CS].selector = selector; 1155 env->segs[R_CS].base = (selector << 4); 1156 env->eflags &= ~(IF_MASK | TF_MASK | AC_MASK | RF_MASK); 1157 } 1158 1159 /* 1160 * Begin execution of an interruption. is_int is TRUE if coming from 1161 * the int instruction. next_eip is the env->eip value AFTER the interrupt 1162 * instruction. It is only relevant if is_int is TRUE. 1163 */ 1164 void do_interrupt_all(X86CPU *cpu, int intno, int is_int, 1165 int error_code, target_ulong next_eip, int is_hw) 1166 { 1167 CPUX86State *env = &cpu->env; 1168 1169 if (qemu_loglevel_mask(CPU_LOG_INT)) { 1170 if ((env->cr[0] & CR0_PE_MASK)) { 1171 static int count; 1172 1173 qemu_log("%6d: v=%02x e=%04x i=%d cpl=%d IP=%04x:" TARGET_FMT_lx 1174 " pc=" TARGET_FMT_lx " SP=%04x:" TARGET_FMT_lx, 1175 count, intno, error_code, is_int, 1176 env->hflags & HF_CPL_MASK, 1177 env->segs[R_CS].selector, env->eip, 1178 (int)env->segs[R_CS].base + env->eip, 1179 env->segs[R_SS].selector, env->regs[R_ESP]); 1180 if (intno == 0x0e) { 1181 qemu_log(" CR2=" TARGET_FMT_lx, env->cr[2]); 1182 } else { 1183 qemu_log(" env->regs[R_EAX]=" TARGET_FMT_lx, env->regs[R_EAX]); 1184 } 1185 qemu_log("\n"); 1186 log_cpu_state(CPU(cpu), CPU_DUMP_CCOP); 1187 #if 0 1188 { 1189 int i; 1190 target_ulong ptr; 1191 1192 qemu_log(" code="); 1193 ptr = env->segs[R_CS].base + env->eip; 1194 for (i = 0; i < 16; i++) { 1195 qemu_log(" %02x", ldub(ptr + i)); 1196 } 1197 qemu_log("\n"); 1198 } 1199 #endif 1200 count++; 1201 } 1202 } 1203 if (env->cr[0] & CR0_PE_MASK) { 1204 #if !defined(CONFIG_USER_ONLY) 1205 if (env->hflags & HF_GUEST_MASK) { 1206 handle_even_inj(env, intno, is_int, error_code, is_hw, 0); 1207 } 1208 #endif 1209 #ifdef TARGET_X86_64 1210 if (env->hflags & HF_LMA_MASK) { 1211 do_interrupt64(env, intno, is_int, error_code, next_eip, is_hw); 1212 } else 1213 #endif 1214 { 1215 do_interrupt_protected(env, intno, is_int, error_code, next_eip, 1216 is_hw); 1217 } 1218 } else { 1219 #if !defined(CONFIG_USER_ONLY) 1220 if (env->hflags & HF_GUEST_MASK) { 1221 handle_even_inj(env, intno, is_int, error_code, is_hw, 1); 1222 } 1223 #endif 1224 do_interrupt_real(env, intno, is_int, error_code, next_eip); 1225 } 1226 1227 #if !defined(CONFIG_USER_ONLY) 1228 if (env->hflags & HF_GUEST_MASK) { 1229 CPUState *cs = CPU(cpu); 1230 uint32_t event_inj = x86_ldl_phys(cs, env->vm_vmcb + 1231 offsetof(struct vmcb, 1232 control.event_inj)); 1233 1234 x86_stl_phys(cs, 1235 env->vm_vmcb + offsetof(struct vmcb, control.event_inj), 1236 event_inj & ~SVM_EVTINJ_VALID); 1237 } 1238 #endif 1239 } 1240 1241 void do_interrupt_x86_hardirq(CPUX86State *env, int intno, int is_hw) 1242 { 1243 do_interrupt_all(env_archcpu(env), intno, 0, 0, 0, is_hw); 1244 } 1245 1246 void helper_lldt(CPUX86State *env, int selector) 1247 { 1248 SegmentCache *dt; 1249 uint32_t e1, e2; 1250 int index, entry_limit; 1251 target_ulong ptr; 1252 1253 selector &= 0xffff; 1254 if ((selector & 0xfffc) == 0) { 1255 /* XXX: NULL selector case: invalid LDT */ 1256 env->ldt.base = 0; 1257 env->ldt.limit = 0; 1258 } else { 1259 if (selector & 0x4) { 1260 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1261 } 1262 dt = &env->gdt; 1263 index = selector & ~7; 1264 #ifdef TARGET_X86_64 1265 if (env->hflags & HF_LMA_MASK) { 1266 entry_limit = 15; 1267 } else 1268 #endif 1269 { 1270 entry_limit = 7; 1271 } 1272 if ((index + entry_limit) > dt->limit) { 1273 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1274 } 1275 ptr = dt->base + index; 1276 e1 = cpu_ldl_kernel_ra(env, ptr, GETPC()); 1277 e2 = cpu_ldl_kernel_ra(env, ptr + 4, GETPC()); 1278 if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2) { 1279 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1280 } 1281 if (!(e2 & DESC_P_MASK)) { 1282 raise_exception_err_ra(env, EXCP0B_NOSEG, selector & 0xfffc, GETPC()); 1283 } 1284 #ifdef TARGET_X86_64 1285 if (env->hflags & HF_LMA_MASK) { 1286 uint32_t e3; 1287 1288 e3 = cpu_ldl_kernel_ra(env, ptr + 8, GETPC()); 1289 load_seg_cache_raw_dt(&env->ldt, e1, e2); 1290 env->ldt.base |= (target_ulong)e3 << 32; 1291 } else 1292 #endif 1293 { 1294 load_seg_cache_raw_dt(&env->ldt, e1, e2); 1295 } 1296 } 1297 env->ldt.selector = selector; 1298 } 1299 1300 void helper_ltr(CPUX86State *env, int selector) 1301 { 1302 SegmentCache *dt; 1303 uint32_t e1, e2; 1304 int index, type, entry_limit; 1305 target_ulong ptr; 1306 1307 selector &= 0xffff; 1308 if ((selector & 0xfffc) == 0) { 1309 /* NULL selector case: invalid TR */ 1310 env->tr.base = 0; 1311 env->tr.limit = 0; 1312 env->tr.flags = 0; 1313 } else { 1314 if (selector & 0x4) { 1315 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1316 } 1317 dt = &env->gdt; 1318 index = selector & ~7; 1319 #ifdef TARGET_X86_64 1320 if (env->hflags & HF_LMA_MASK) { 1321 entry_limit = 15; 1322 } else 1323 #endif 1324 { 1325 entry_limit = 7; 1326 } 1327 if ((index + entry_limit) > dt->limit) { 1328 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1329 } 1330 ptr = dt->base + index; 1331 e1 = cpu_ldl_kernel_ra(env, ptr, GETPC()); 1332 e2 = cpu_ldl_kernel_ra(env, ptr + 4, GETPC()); 1333 type = (e2 >> DESC_TYPE_SHIFT) & 0xf; 1334 if ((e2 & DESC_S_MASK) || 1335 (type != 1 && type != 9)) { 1336 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1337 } 1338 if (!(e2 & DESC_P_MASK)) { 1339 raise_exception_err_ra(env, EXCP0B_NOSEG, selector & 0xfffc, GETPC()); 1340 } 1341 #ifdef TARGET_X86_64 1342 if (env->hflags & HF_LMA_MASK) { 1343 uint32_t e3, e4; 1344 1345 e3 = cpu_ldl_kernel_ra(env, ptr + 8, GETPC()); 1346 e4 = cpu_ldl_kernel_ra(env, ptr + 12, GETPC()); 1347 if ((e4 >> DESC_TYPE_SHIFT) & 0xf) { 1348 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1349 } 1350 load_seg_cache_raw_dt(&env->tr, e1, e2); 1351 env->tr.base |= (target_ulong)e3 << 32; 1352 } else 1353 #endif 1354 { 1355 load_seg_cache_raw_dt(&env->tr, e1, e2); 1356 } 1357 e2 |= DESC_TSS_BUSY_MASK; 1358 cpu_stl_kernel_ra(env, ptr + 4, e2, GETPC()); 1359 } 1360 env->tr.selector = selector; 1361 } 1362 1363 /* only works if protected mode and not VM86. seg_reg must be != R_CS */ 1364 void helper_load_seg(CPUX86State *env, int seg_reg, int selector) 1365 { 1366 uint32_t e1, e2; 1367 int cpl, dpl, rpl; 1368 SegmentCache *dt; 1369 int index; 1370 target_ulong ptr; 1371 1372 selector &= 0xffff; 1373 cpl = env->hflags & HF_CPL_MASK; 1374 if ((selector & 0xfffc) == 0) { 1375 /* null selector case */ 1376 if (seg_reg == R_SS 1377 #ifdef TARGET_X86_64 1378 && (!(env->hflags & HF_CS64_MASK) || cpl == 3) 1379 #endif 1380 ) { 1381 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 1382 } 1383 cpu_x86_load_seg_cache(env, seg_reg, selector, 0, 0, 0); 1384 } else { 1385 1386 if (selector & 0x4) { 1387 dt = &env->ldt; 1388 } else { 1389 dt = &env->gdt; 1390 } 1391 index = selector & ~7; 1392 if ((index + 7) > dt->limit) { 1393 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1394 } 1395 ptr = dt->base + index; 1396 e1 = cpu_ldl_kernel_ra(env, ptr, GETPC()); 1397 e2 = cpu_ldl_kernel_ra(env, ptr + 4, GETPC()); 1398 1399 if (!(e2 & DESC_S_MASK)) { 1400 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1401 } 1402 rpl = selector & 3; 1403 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1404 if (seg_reg == R_SS) { 1405 /* must be writable segment */ 1406 if ((e2 & DESC_CS_MASK) || !(e2 & DESC_W_MASK)) { 1407 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1408 } 1409 if (rpl != cpl || dpl != cpl) { 1410 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1411 } 1412 } else { 1413 /* must be readable segment */ 1414 if ((e2 & (DESC_CS_MASK | DESC_R_MASK)) == DESC_CS_MASK) { 1415 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1416 } 1417 1418 if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) { 1419 /* if not conforming code, test rights */ 1420 if (dpl < cpl || dpl < rpl) { 1421 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1422 } 1423 } 1424 } 1425 1426 if (!(e2 & DESC_P_MASK)) { 1427 if (seg_reg == R_SS) { 1428 raise_exception_err_ra(env, EXCP0C_STACK, selector & 0xfffc, GETPC()); 1429 } else { 1430 raise_exception_err_ra(env, EXCP0B_NOSEG, selector & 0xfffc, GETPC()); 1431 } 1432 } 1433 1434 /* set the access bit if not already set */ 1435 if (!(e2 & DESC_A_MASK)) { 1436 e2 |= DESC_A_MASK; 1437 cpu_stl_kernel_ra(env, ptr + 4, e2, GETPC()); 1438 } 1439 1440 cpu_x86_load_seg_cache(env, seg_reg, selector, 1441 get_seg_base(e1, e2), 1442 get_seg_limit(e1, e2), 1443 e2); 1444 #if 0 1445 qemu_log("load_seg: sel=0x%04x base=0x%08lx limit=0x%08lx flags=%08x\n", 1446 selector, (unsigned long)sc->base, sc->limit, sc->flags); 1447 #endif 1448 } 1449 } 1450 1451 /* protected mode jump */ 1452 void helper_ljmp_protected(CPUX86State *env, int new_cs, target_ulong new_eip, 1453 target_ulong next_eip) 1454 { 1455 int gate_cs, type; 1456 uint32_t e1, e2, cpl, dpl, rpl, limit; 1457 1458 if ((new_cs & 0xfffc) == 0) { 1459 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 1460 } 1461 if (load_segment_ra(env, &e1, &e2, new_cs, GETPC()) != 0) { 1462 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1463 } 1464 cpl = env->hflags & HF_CPL_MASK; 1465 if (e2 & DESC_S_MASK) { 1466 if (!(e2 & DESC_CS_MASK)) { 1467 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1468 } 1469 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1470 if (e2 & DESC_C_MASK) { 1471 /* conforming code segment */ 1472 if (dpl > cpl) { 1473 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1474 } 1475 } else { 1476 /* non conforming code segment */ 1477 rpl = new_cs & 3; 1478 if (rpl > cpl) { 1479 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1480 } 1481 if (dpl != cpl) { 1482 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1483 } 1484 } 1485 if (!(e2 & DESC_P_MASK)) { 1486 raise_exception_err_ra(env, EXCP0B_NOSEG, new_cs & 0xfffc, GETPC()); 1487 } 1488 limit = get_seg_limit(e1, e2); 1489 if (new_eip > limit && 1490 (!(env->hflags & HF_LMA_MASK) || !(e2 & DESC_L_MASK))) { 1491 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 1492 } 1493 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl, 1494 get_seg_base(e1, e2), limit, e2); 1495 env->eip = new_eip; 1496 } else { 1497 /* jump to call or task gate */ 1498 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1499 rpl = new_cs & 3; 1500 cpl = env->hflags & HF_CPL_MASK; 1501 type = (e2 >> DESC_TYPE_SHIFT) & 0xf; 1502 1503 #ifdef TARGET_X86_64 1504 if (env->efer & MSR_EFER_LMA) { 1505 if (type != 12) { 1506 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1507 } 1508 } 1509 #endif 1510 switch (type) { 1511 case 1: /* 286 TSS */ 1512 case 9: /* 386 TSS */ 1513 case 5: /* task gate */ 1514 if (dpl < cpl || dpl < rpl) { 1515 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1516 } 1517 switch_tss_ra(env, new_cs, e1, e2, SWITCH_TSS_JMP, next_eip, GETPC()); 1518 break; 1519 case 4: /* 286 call gate */ 1520 case 12: /* 386 call gate */ 1521 if ((dpl < cpl) || (dpl < rpl)) { 1522 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1523 } 1524 if (!(e2 & DESC_P_MASK)) { 1525 raise_exception_err_ra(env, EXCP0B_NOSEG, new_cs & 0xfffc, GETPC()); 1526 } 1527 gate_cs = e1 >> 16; 1528 new_eip = (e1 & 0xffff); 1529 if (type == 12) { 1530 new_eip |= (e2 & 0xffff0000); 1531 } 1532 1533 #ifdef TARGET_X86_64 1534 if (env->efer & MSR_EFER_LMA) { 1535 /* load the upper 8 bytes of the 64-bit call gate */ 1536 if (load_segment_ra(env, &e1, &e2, new_cs + 8, GETPC())) { 1537 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, 1538 GETPC()); 1539 } 1540 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f; 1541 if (type != 0) { 1542 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, 1543 GETPC()); 1544 } 1545 new_eip |= ((target_ulong)e1) << 32; 1546 } 1547 #endif 1548 1549 if (load_segment_ra(env, &e1, &e2, gate_cs, GETPC()) != 0) { 1550 raise_exception_err_ra(env, EXCP0D_GPF, gate_cs & 0xfffc, GETPC()); 1551 } 1552 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1553 /* must be code segment */ 1554 if (((e2 & (DESC_S_MASK | DESC_CS_MASK)) != 1555 (DESC_S_MASK | DESC_CS_MASK))) { 1556 raise_exception_err_ra(env, EXCP0D_GPF, gate_cs & 0xfffc, GETPC()); 1557 } 1558 if (((e2 & DESC_C_MASK) && (dpl > cpl)) || 1559 (!(e2 & DESC_C_MASK) && (dpl != cpl))) { 1560 raise_exception_err_ra(env, EXCP0D_GPF, gate_cs & 0xfffc, GETPC()); 1561 } 1562 #ifdef TARGET_X86_64 1563 if (env->efer & MSR_EFER_LMA) { 1564 if (!(e2 & DESC_L_MASK)) { 1565 raise_exception_err_ra(env, EXCP0D_GPF, gate_cs & 0xfffc, GETPC()); 1566 } 1567 if (e2 & DESC_B_MASK) { 1568 raise_exception_err_ra(env, EXCP0D_GPF, gate_cs & 0xfffc, GETPC()); 1569 } 1570 } 1571 #endif 1572 if (!(e2 & DESC_P_MASK)) { 1573 raise_exception_err_ra(env, EXCP0D_GPF, gate_cs & 0xfffc, GETPC()); 1574 } 1575 limit = get_seg_limit(e1, e2); 1576 if (new_eip > limit && 1577 (!(env->hflags & HF_LMA_MASK) || !(e2 & DESC_L_MASK))) { 1578 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 1579 } 1580 cpu_x86_load_seg_cache(env, R_CS, (gate_cs & 0xfffc) | cpl, 1581 get_seg_base(e1, e2), limit, e2); 1582 env->eip = new_eip; 1583 break; 1584 default: 1585 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1586 break; 1587 } 1588 } 1589 } 1590 1591 /* real mode call */ 1592 void helper_lcall_real(CPUX86State *env, uint32_t new_cs, uint32_t new_eip, 1593 int shift, uint32_t next_eip) 1594 { 1595 StackAccess sa; 1596 1597 sa.env = env; 1598 sa.ra = GETPC(); 1599 sa.sp = env->regs[R_ESP]; 1600 sa.sp_mask = get_sp_mask(env->segs[R_SS].flags); 1601 sa.ss_base = env->segs[R_SS].base; 1602 sa.mmu_index = cpu_mmu_index_kernel(env); 1603 1604 if (shift) { 1605 pushl(&sa, env->segs[R_CS].selector); 1606 pushl(&sa, next_eip); 1607 } else { 1608 pushw(&sa, env->segs[R_CS].selector); 1609 pushw(&sa, next_eip); 1610 } 1611 1612 SET_ESP(sa.sp, sa.sp_mask); 1613 env->eip = new_eip; 1614 env->segs[R_CS].selector = new_cs; 1615 env->segs[R_CS].base = (new_cs << 4); 1616 } 1617 1618 /* protected mode call */ 1619 void helper_lcall_protected(CPUX86State *env, int new_cs, target_ulong new_eip, 1620 int shift, target_ulong next_eip) 1621 { 1622 int new_stack, i; 1623 uint32_t e1, e2, cpl, dpl, rpl, selector, param_count; 1624 uint32_t ss = 0, ss_e1 = 0, ss_e2 = 0, type, ss_dpl; 1625 uint32_t val, limit, old_sp_mask; 1626 target_ulong old_ssp, offset; 1627 StackAccess sa; 1628 1629 LOG_PCALL("lcall %04x:" TARGET_FMT_lx " s=%d\n", new_cs, new_eip, shift); 1630 LOG_PCALL_STATE(env_cpu(env)); 1631 if ((new_cs & 0xfffc) == 0) { 1632 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 1633 } 1634 if (load_segment_ra(env, &e1, &e2, new_cs, GETPC()) != 0) { 1635 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1636 } 1637 cpl = env->hflags & HF_CPL_MASK; 1638 LOG_PCALL("desc=%08x:%08x\n", e1, e2); 1639 1640 sa.env = env; 1641 sa.ra = GETPC(); 1642 sa.mmu_index = cpu_mmu_index_kernel(env); 1643 1644 if (e2 & DESC_S_MASK) { 1645 if (!(e2 & DESC_CS_MASK)) { 1646 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1647 } 1648 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1649 if (e2 & DESC_C_MASK) { 1650 /* conforming code segment */ 1651 if (dpl > cpl) { 1652 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1653 } 1654 } else { 1655 /* non conforming code segment */ 1656 rpl = new_cs & 3; 1657 if (rpl > cpl) { 1658 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1659 } 1660 if (dpl != cpl) { 1661 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1662 } 1663 } 1664 if (!(e2 & DESC_P_MASK)) { 1665 raise_exception_err_ra(env, EXCP0B_NOSEG, new_cs & 0xfffc, GETPC()); 1666 } 1667 1668 #ifdef TARGET_X86_64 1669 /* XXX: check 16/32 bit cases in long mode */ 1670 if (shift == 2) { 1671 /* 64 bit case */ 1672 sa.sp = env->regs[R_ESP]; 1673 sa.sp_mask = -1; 1674 sa.ss_base = 0; 1675 pushq(&sa, env->segs[R_CS].selector); 1676 pushq(&sa, next_eip); 1677 /* from this point, not restartable */ 1678 env->regs[R_ESP] = sa.sp; 1679 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl, 1680 get_seg_base(e1, e2), 1681 get_seg_limit(e1, e2), e2); 1682 env->eip = new_eip; 1683 } else 1684 #endif 1685 { 1686 sa.sp = env->regs[R_ESP]; 1687 sa.sp_mask = get_sp_mask(env->segs[R_SS].flags); 1688 sa.ss_base = env->segs[R_SS].base; 1689 if (shift) { 1690 pushl(&sa, env->segs[R_CS].selector); 1691 pushl(&sa, next_eip); 1692 } else { 1693 pushw(&sa, env->segs[R_CS].selector); 1694 pushw(&sa, next_eip); 1695 } 1696 1697 limit = get_seg_limit(e1, e2); 1698 if (new_eip > limit) { 1699 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1700 } 1701 /* from this point, not restartable */ 1702 SET_ESP(sa.sp, sa.sp_mask); 1703 cpu_x86_load_seg_cache(env, R_CS, (new_cs & 0xfffc) | cpl, 1704 get_seg_base(e1, e2), limit, e2); 1705 env->eip = new_eip; 1706 } 1707 } else { 1708 /* check gate type */ 1709 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f; 1710 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1711 rpl = new_cs & 3; 1712 1713 #ifdef TARGET_X86_64 1714 if (env->efer & MSR_EFER_LMA) { 1715 if (type != 12) { 1716 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1717 } 1718 } 1719 #endif 1720 1721 switch (type) { 1722 case 1: /* available 286 TSS */ 1723 case 9: /* available 386 TSS */ 1724 case 5: /* task gate */ 1725 if (dpl < cpl || dpl < rpl) { 1726 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1727 } 1728 switch_tss_ra(env, new_cs, e1, e2, SWITCH_TSS_CALL, next_eip, GETPC()); 1729 return; 1730 case 4: /* 286 call gate */ 1731 case 12: /* 386 call gate */ 1732 break; 1733 default: 1734 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1735 break; 1736 } 1737 shift = type >> 3; 1738 1739 if (dpl < cpl || dpl < rpl) { 1740 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC()); 1741 } 1742 /* check valid bit */ 1743 if (!(e2 & DESC_P_MASK)) { 1744 raise_exception_err_ra(env, EXCP0B_NOSEG, new_cs & 0xfffc, GETPC()); 1745 } 1746 selector = e1 >> 16; 1747 param_count = e2 & 0x1f; 1748 offset = (e2 & 0xffff0000) | (e1 & 0x0000ffff); 1749 #ifdef TARGET_X86_64 1750 if (env->efer & MSR_EFER_LMA) { 1751 /* load the upper 8 bytes of the 64-bit call gate */ 1752 if (load_segment_ra(env, &e1, &e2, new_cs + 8, GETPC())) { 1753 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, 1754 GETPC()); 1755 } 1756 type = (e2 >> DESC_TYPE_SHIFT) & 0x1f; 1757 if (type != 0) { 1758 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, 1759 GETPC()); 1760 } 1761 offset |= ((target_ulong)e1) << 32; 1762 } 1763 #endif 1764 if ((selector & 0xfffc) == 0) { 1765 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 1766 } 1767 1768 if (load_segment_ra(env, &e1, &e2, selector, GETPC()) != 0) { 1769 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1770 } 1771 if (!(e2 & DESC_S_MASK) || !(e2 & (DESC_CS_MASK))) { 1772 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1773 } 1774 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1775 if (dpl > cpl) { 1776 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1777 } 1778 #ifdef TARGET_X86_64 1779 if (env->efer & MSR_EFER_LMA) { 1780 if (!(e2 & DESC_L_MASK)) { 1781 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1782 } 1783 if (e2 & DESC_B_MASK) { 1784 raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GETPC()); 1785 } 1786 shift++; 1787 } 1788 #endif 1789 if (!(e2 & DESC_P_MASK)) { 1790 raise_exception_err_ra(env, EXCP0B_NOSEG, selector & 0xfffc, GETPC()); 1791 } 1792 1793 if (!(e2 & DESC_C_MASK) && dpl < cpl) { 1794 /* to inner privilege */ 1795 #ifdef TARGET_X86_64 1796 if (shift == 2) { 1797 ss = dpl; /* SS = NULL selector with RPL = new CPL */ 1798 new_stack = 1; 1799 sa.sp = get_rsp_from_tss(env, dpl); 1800 sa.sp_mask = -1; 1801 sa.ss_base = 0; /* SS base is always zero in IA-32e mode */ 1802 LOG_PCALL("new ss:rsp=%04x:%016llx env->regs[R_ESP]=" 1803 TARGET_FMT_lx "\n", ss, sa.sp, env->regs[R_ESP]); 1804 } else 1805 #endif 1806 { 1807 uint32_t sp32; 1808 get_ss_esp_from_tss(env, &ss, &sp32, dpl, GETPC()); 1809 LOG_PCALL("new ss:esp=%04x:%08x param_count=%d env->regs[R_ESP]=" 1810 TARGET_FMT_lx "\n", ss, sp32, param_count, 1811 env->regs[R_ESP]); 1812 if ((ss & 0xfffc) == 0) { 1813 raise_exception_err_ra(env, EXCP0A_TSS, ss & 0xfffc, GETPC()); 1814 } 1815 if ((ss & 3) != dpl) { 1816 raise_exception_err_ra(env, EXCP0A_TSS, ss & 0xfffc, GETPC()); 1817 } 1818 if (load_segment_ra(env, &ss_e1, &ss_e2, ss, GETPC()) != 0) { 1819 raise_exception_err_ra(env, EXCP0A_TSS, ss & 0xfffc, GETPC()); 1820 } 1821 ss_dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3; 1822 if (ss_dpl != dpl) { 1823 raise_exception_err_ra(env, EXCP0A_TSS, ss & 0xfffc, GETPC()); 1824 } 1825 if (!(ss_e2 & DESC_S_MASK) || 1826 (ss_e2 & DESC_CS_MASK) || 1827 !(ss_e2 & DESC_W_MASK)) { 1828 raise_exception_err_ra(env, EXCP0A_TSS, ss & 0xfffc, GETPC()); 1829 } 1830 if (!(ss_e2 & DESC_P_MASK)) { 1831 raise_exception_err_ra(env, EXCP0A_TSS, ss & 0xfffc, GETPC()); 1832 } 1833 1834 sa.sp = sp32; 1835 sa.sp_mask = get_sp_mask(ss_e2); 1836 sa.ss_base = get_seg_base(ss_e1, ss_e2); 1837 } 1838 1839 /* push_size = ((param_count * 2) + 8) << shift; */ 1840 old_sp_mask = get_sp_mask(env->segs[R_SS].flags); 1841 old_ssp = env->segs[R_SS].base; 1842 1843 #ifdef TARGET_X86_64 1844 if (shift == 2) { 1845 /* XXX: verify if new stack address is canonical */ 1846 pushq(&sa, env->segs[R_SS].selector); 1847 pushq(&sa, env->regs[R_ESP]); 1848 /* parameters aren't supported for 64-bit call gates */ 1849 } else 1850 #endif 1851 if (shift == 1) { 1852 pushl(&sa, env->segs[R_SS].selector); 1853 pushl(&sa, env->regs[R_ESP]); 1854 for (i = param_count - 1; i >= 0; i--) { 1855 val = cpu_ldl_data_ra(env, 1856 old_ssp + ((env->regs[R_ESP] + i * 4) & old_sp_mask), 1857 GETPC()); 1858 pushl(&sa, val); 1859 } 1860 } else { 1861 pushw(&sa, env->segs[R_SS].selector); 1862 pushw(&sa, env->regs[R_ESP]); 1863 for (i = param_count - 1; i >= 0; i--) { 1864 val = cpu_lduw_data_ra(env, 1865 old_ssp + ((env->regs[R_ESP] + i * 2) & old_sp_mask), 1866 GETPC()); 1867 pushw(&sa, val); 1868 } 1869 } 1870 new_stack = 1; 1871 } else { 1872 /* to same privilege */ 1873 sa.sp = env->regs[R_ESP]; 1874 sa.sp_mask = get_sp_mask(env->segs[R_SS].flags); 1875 sa.ss_base = env->segs[R_SS].base; 1876 /* push_size = (4 << shift); */ 1877 new_stack = 0; 1878 } 1879 1880 #ifdef TARGET_X86_64 1881 if (shift == 2) { 1882 pushq(&sa, env->segs[R_CS].selector); 1883 pushq(&sa, next_eip); 1884 } else 1885 #endif 1886 if (shift == 1) { 1887 pushl(&sa, env->segs[R_CS].selector); 1888 pushl(&sa, next_eip); 1889 } else { 1890 pushw(&sa, env->segs[R_CS].selector); 1891 pushw(&sa, next_eip); 1892 } 1893 1894 /* from this point, not restartable */ 1895 1896 if (new_stack) { 1897 #ifdef TARGET_X86_64 1898 if (shift == 2) { 1899 cpu_x86_load_seg_cache(env, R_SS, ss, 0, 0, 0); 1900 } else 1901 #endif 1902 { 1903 ss = (ss & ~3) | dpl; 1904 cpu_x86_load_seg_cache(env, R_SS, ss, 1905 sa.ss_base, 1906 get_seg_limit(ss_e1, ss_e2), 1907 ss_e2); 1908 } 1909 } 1910 1911 selector = (selector & ~3) | dpl; 1912 cpu_x86_load_seg_cache(env, R_CS, selector, 1913 get_seg_base(e1, e2), 1914 get_seg_limit(e1, e2), 1915 e2); 1916 SET_ESP(sa.sp, sa.sp_mask); 1917 env->eip = offset; 1918 } 1919 } 1920 1921 /* real and vm86 mode iret */ 1922 void helper_iret_real(CPUX86State *env, int shift) 1923 { 1924 uint32_t new_cs, new_eip, new_eflags; 1925 int eflags_mask; 1926 StackAccess sa; 1927 1928 sa.env = env; 1929 sa.ra = GETPC(); 1930 sa.mmu_index = x86_mmu_index_pl(env, 0); 1931 sa.sp_mask = 0xffff; /* XXXX: use SS segment size? */ 1932 sa.sp = env->regs[R_ESP]; 1933 sa.ss_base = env->segs[R_SS].base; 1934 1935 if (shift == 1) { 1936 /* 32 bits */ 1937 new_eip = popl(&sa); 1938 new_cs = popl(&sa) & 0xffff; 1939 new_eflags = popl(&sa); 1940 } else { 1941 /* 16 bits */ 1942 new_eip = popw(&sa); 1943 new_cs = popw(&sa); 1944 new_eflags = popw(&sa); 1945 } 1946 SET_ESP(sa.sp, sa.sp_mask); 1947 env->segs[R_CS].selector = new_cs; 1948 env->segs[R_CS].base = (new_cs << 4); 1949 env->eip = new_eip; 1950 if (env->eflags & VM_MASK) { 1951 eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | RF_MASK | 1952 NT_MASK; 1953 } else { 1954 eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | IOPL_MASK | 1955 RF_MASK | NT_MASK; 1956 } 1957 if (shift == 0) { 1958 eflags_mask &= 0xffff; 1959 } 1960 cpu_load_eflags(env, new_eflags, eflags_mask); 1961 env->hflags2 &= ~HF2_NMI_MASK; 1962 } 1963 1964 static inline void validate_seg(CPUX86State *env, X86Seg seg_reg, int cpl) 1965 { 1966 int dpl; 1967 uint32_t e2; 1968 1969 /* XXX: on x86_64, we do not want to nullify FS and GS because 1970 they may still contain a valid base. I would be interested to 1971 know how a real x86_64 CPU behaves */ 1972 if ((seg_reg == R_FS || seg_reg == R_GS) && 1973 (env->segs[seg_reg].selector & 0xfffc) == 0) { 1974 return; 1975 } 1976 1977 e2 = env->segs[seg_reg].flags; 1978 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 1979 if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) { 1980 /* data or non conforming code segment */ 1981 if (dpl < cpl) { 1982 cpu_x86_load_seg_cache(env, seg_reg, 0, 1983 env->segs[seg_reg].base, 1984 env->segs[seg_reg].limit, 1985 env->segs[seg_reg].flags & ~DESC_P_MASK); 1986 } 1987 } 1988 } 1989 1990 /* protected mode iret */ 1991 static inline void helper_ret_protected(CPUX86State *env, int shift, 1992 int is_iret, int addend, 1993 uintptr_t retaddr) 1994 { 1995 uint32_t new_cs, new_eflags, new_ss; 1996 uint32_t new_es, new_ds, new_fs, new_gs; 1997 uint32_t e1, e2, ss_e1, ss_e2; 1998 int cpl, dpl, rpl, eflags_mask, iopl; 1999 target_ulong new_eip, new_esp; 2000 StackAccess sa; 2001 2002 cpl = env->hflags & HF_CPL_MASK; 2003 2004 sa.env = env; 2005 sa.ra = retaddr; 2006 sa.mmu_index = x86_mmu_index_pl(env, cpl); 2007 2008 #ifdef TARGET_X86_64 2009 if (shift == 2) { 2010 sa.sp_mask = -1; 2011 } else 2012 #endif 2013 { 2014 sa.sp_mask = get_sp_mask(env->segs[R_SS].flags); 2015 } 2016 sa.sp = env->regs[R_ESP]; 2017 sa.ss_base = env->segs[R_SS].base; 2018 new_eflags = 0; /* avoid warning */ 2019 #ifdef TARGET_X86_64 2020 if (shift == 2) { 2021 new_eip = popq(&sa); 2022 new_cs = popq(&sa) & 0xffff; 2023 if (is_iret) { 2024 new_eflags = popq(&sa); 2025 } 2026 } else 2027 #endif 2028 { 2029 if (shift == 1) { 2030 /* 32 bits */ 2031 new_eip = popl(&sa); 2032 new_cs = popl(&sa) & 0xffff; 2033 if (is_iret) { 2034 new_eflags = popl(&sa); 2035 if (new_eflags & VM_MASK) { 2036 goto return_to_vm86; 2037 } 2038 } 2039 } else { 2040 /* 16 bits */ 2041 new_eip = popw(&sa); 2042 new_cs = popw(&sa); 2043 if (is_iret) { 2044 new_eflags = popw(&sa); 2045 } 2046 } 2047 } 2048 LOG_PCALL("lret new %04x:" TARGET_FMT_lx " s=%d addend=0x%x\n", 2049 new_cs, new_eip, shift, addend); 2050 LOG_PCALL_STATE(env_cpu(env)); 2051 if ((new_cs & 0xfffc) == 0) { 2052 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, retaddr); 2053 } 2054 if (load_segment_ra(env, &e1, &e2, new_cs, retaddr) != 0) { 2055 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, retaddr); 2056 } 2057 if (!(e2 & DESC_S_MASK) || 2058 !(e2 & DESC_CS_MASK)) { 2059 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, retaddr); 2060 } 2061 rpl = new_cs & 3; 2062 if (rpl < cpl) { 2063 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, retaddr); 2064 } 2065 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 2066 if (e2 & DESC_C_MASK) { 2067 if (dpl > rpl) { 2068 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, retaddr); 2069 } 2070 } else { 2071 if (dpl != rpl) { 2072 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, retaddr); 2073 } 2074 } 2075 if (!(e2 & DESC_P_MASK)) { 2076 raise_exception_err_ra(env, EXCP0B_NOSEG, new_cs & 0xfffc, retaddr); 2077 } 2078 2079 sa.sp += addend; 2080 if (rpl == cpl && (!(env->hflags & HF_CS64_MASK) || 2081 ((env->hflags & HF_CS64_MASK) && !is_iret))) { 2082 /* return to same privilege level */ 2083 cpu_x86_load_seg_cache(env, R_CS, new_cs, 2084 get_seg_base(e1, e2), 2085 get_seg_limit(e1, e2), 2086 e2); 2087 } else { 2088 /* return to different privilege level */ 2089 #ifdef TARGET_X86_64 2090 if (shift == 2) { 2091 new_esp = popq(&sa); 2092 new_ss = popq(&sa) & 0xffff; 2093 } else 2094 #endif 2095 { 2096 if (shift == 1) { 2097 /* 32 bits */ 2098 new_esp = popl(&sa); 2099 new_ss = popl(&sa) & 0xffff; 2100 } else { 2101 /* 16 bits */ 2102 new_esp = popw(&sa); 2103 new_ss = popw(&sa); 2104 } 2105 } 2106 LOG_PCALL("new ss:esp=%04x:" TARGET_FMT_lx "\n", 2107 new_ss, new_esp); 2108 if ((new_ss & 0xfffc) == 0) { 2109 #ifdef TARGET_X86_64 2110 /* NULL ss is allowed in long mode if cpl != 3 */ 2111 /* XXX: test CS64? */ 2112 if ((env->hflags & HF_LMA_MASK) && rpl != 3) { 2113 cpu_x86_load_seg_cache(env, R_SS, new_ss, 2114 0, 0xffffffff, 2115 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2116 DESC_S_MASK | (rpl << DESC_DPL_SHIFT) | 2117 DESC_W_MASK | DESC_A_MASK); 2118 ss_e2 = DESC_B_MASK; /* XXX: should not be needed? */ 2119 } else 2120 #endif 2121 { 2122 raise_exception_err_ra(env, EXCP0D_GPF, 0, retaddr); 2123 } 2124 } else { 2125 if ((new_ss & 3) != rpl) { 2126 raise_exception_err_ra(env, EXCP0D_GPF, new_ss & 0xfffc, retaddr); 2127 } 2128 if (load_segment_ra(env, &ss_e1, &ss_e2, new_ss, retaddr) != 0) { 2129 raise_exception_err_ra(env, EXCP0D_GPF, new_ss & 0xfffc, retaddr); 2130 } 2131 if (!(ss_e2 & DESC_S_MASK) || 2132 (ss_e2 & DESC_CS_MASK) || 2133 !(ss_e2 & DESC_W_MASK)) { 2134 raise_exception_err_ra(env, EXCP0D_GPF, new_ss & 0xfffc, retaddr); 2135 } 2136 dpl = (ss_e2 >> DESC_DPL_SHIFT) & 3; 2137 if (dpl != rpl) { 2138 raise_exception_err_ra(env, EXCP0D_GPF, new_ss & 0xfffc, retaddr); 2139 } 2140 if (!(ss_e2 & DESC_P_MASK)) { 2141 raise_exception_err_ra(env, EXCP0B_NOSEG, new_ss & 0xfffc, retaddr); 2142 } 2143 cpu_x86_load_seg_cache(env, R_SS, new_ss, 2144 get_seg_base(ss_e1, ss_e2), 2145 get_seg_limit(ss_e1, ss_e2), 2146 ss_e2); 2147 } 2148 2149 cpu_x86_load_seg_cache(env, R_CS, new_cs, 2150 get_seg_base(e1, e2), 2151 get_seg_limit(e1, e2), 2152 e2); 2153 sa.sp = new_esp; 2154 #ifdef TARGET_X86_64 2155 if (env->hflags & HF_CS64_MASK) { 2156 sa.sp_mask = -1; 2157 } else 2158 #endif 2159 { 2160 sa.sp_mask = get_sp_mask(ss_e2); 2161 } 2162 2163 /* validate data segments */ 2164 validate_seg(env, R_ES, rpl); 2165 validate_seg(env, R_DS, rpl); 2166 validate_seg(env, R_FS, rpl); 2167 validate_seg(env, R_GS, rpl); 2168 2169 sa.sp += addend; 2170 } 2171 SET_ESP(sa.sp, sa.sp_mask); 2172 env->eip = new_eip; 2173 if (is_iret) { 2174 /* NOTE: 'cpl' is the _old_ CPL */ 2175 eflags_mask = TF_MASK | AC_MASK | ID_MASK | RF_MASK | NT_MASK; 2176 if (cpl == 0) { 2177 eflags_mask |= IOPL_MASK; 2178 } 2179 iopl = (env->eflags >> IOPL_SHIFT) & 3; 2180 if (cpl <= iopl) { 2181 eflags_mask |= IF_MASK; 2182 } 2183 if (shift == 0) { 2184 eflags_mask &= 0xffff; 2185 } 2186 cpu_load_eflags(env, new_eflags, eflags_mask); 2187 } 2188 return; 2189 2190 return_to_vm86: 2191 new_esp = popl(&sa); 2192 new_ss = popl(&sa); 2193 new_es = popl(&sa); 2194 new_ds = popl(&sa); 2195 new_fs = popl(&sa); 2196 new_gs = popl(&sa); 2197 2198 /* modify processor state */ 2199 cpu_load_eflags(env, new_eflags, TF_MASK | AC_MASK | ID_MASK | 2200 IF_MASK | IOPL_MASK | VM_MASK | NT_MASK | VIF_MASK | 2201 VIP_MASK); 2202 load_seg_vm(env, R_CS, new_cs & 0xffff); 2203 load_seg_vm(env, R_SS, new_ss & 0xffff); 2204 load_seg_vm(env, R_ES, new_es & 0xffff); 2205 load_seg_vm(env, R_DS, new_ds & 0xffff); 2206 load_seg_vm(env, R_FS, new_fs & 0xffff); 2207 load_seg_vm(env, R_GS, new_gs & 0xffff); 2208 2209 env->eip = new_eip & 0xffff; 2210 env->regs[R_ESP] = new_esp; 2211 } 2212 2213 void helper_iret_protected(CPUX86State *env, int shift, int next_eip) 2214 { 2215 int tss_selector, type; 2216 uint32_t e1, e2; 2217 2218 /* specific case for TSS */ 2219 if (env->eflags & NT_MASK) { 2220 #ifdef TARGET_X86_64 2221 if (env->hflags & HF_LMA_MASK) { 2222 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 2223 } 2224 #endif 2225 tss_selector = cpu_lduw_kernel_ra(env, env->tr.base + 0, GETPC()); 2226 if (tss_selector & 4) { 2227 raise_exception_err_ra(env, EXCP0A_TSS, tss_selector & 0xfffc, GETPC()); 2228 } 2229 if (load_segment_ra(env, &e1, &e2, tss_selector, GETPC()) != 0) { 2230 raise_exception_err_ra(env, EXCP0A_TSS, tss_selector & 0xfffc, GETPC()); 2231 } 2232 type = (e2 >> DESC_TYPE_SHIFT) & 0x17; 2233 /* NOTE: we check both segment and busy TSS */ 2234 if (type != 3) { 2235 raise_exception_err_ra(env, EXCP0A_TSS, tss_selector & 0xfffc, GETPC()); 2236 } 2237 switch_tss_ra(env, tss_selector, e1, e2, SWITCH_TSS_IRET, next_eip, GETPC()); 2238 } else { 2239 helper_ret_protected(env, shift, 1, 0, GETPC()); 2240 } 2241 env->hflags2 &= ~HF2_NMI_MASK; 2242 } 2243 2244 void helper_lret_protected(CPUX86State *env, int shift, int addend) 2245 { 2246 helper_ret_protected(env, shift, 0, addend, GETPC()); 2247 } 2248 2249 void helper_sysenter(CPUX86State *env) 2250 { 2251 if (env->sysenter_cs == 0) { 2252 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 2253 } 2254 env->eflags &= ~(VM_MASK | IF_MASK | RF_MASK); 2255 2256 #ifdef TARGET_X86_64 2257 if (env->hflags & HF_LMA_MASK) { 2258 cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc, 2259 0, 0xffffffff, 2260 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2261 DESC_S_MASK | 2262 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | 2263 DESC_L_MASK); 2264 } else 2265 #endif 2266 { 2267 cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc, 2268 0, 0xffffffff, 2269 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2270 DESC_S_MASK | 2271 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK); 2272 } 2273 cpu_x86_load_seg_cache(env, R_SS, (env->sysenter_cs + 8) & 0xfffc, 2274 0, 0xffffffff, 2275 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2276 DESC_S_MASK | 2277 DESC_W_MASK | DESC_A_MASK); 2278 env->regs[R_ESP] = env->sysenter_esp; 2279 env->eip = env->sysenter_eip; 2280 } 2281 2282 void helper_sysexit(CPUX86State *env, int dflag) 2283 { 2284 int cpl; 2285 2286 cpl = env->hflags & HF_CPL_MASK; 2287 if (env->sysenter_cs == 0 || cpl != 0) { 2288 raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); 2289 } 2290 #ifdef TARGET_X86_64 2291 if (dflag == 2) { 2292 cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 32) & 0xfffc) | 2293 3, 0, 0xffffffff, 2294 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2295 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 2296 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | 2297 DESC_L_MASK); 2298 cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 40) & 0xfffc) | 2299 3, 0, 0xffffffff, 2300 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2301 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 2302 DESC_W_MASK | DESC_A_MASK); 2303 } else 2304 #endif 2305 { 2306 cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 16) & 0xfffc) | 2307 3, 0, 0xffffffff, 2308 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2309 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 2310 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK); 2311 cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 24) & 0xfffc) | 2312 3, 0, 0xffffffff, 2313 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | 2314 DESC_S_MASK | (3 << DESC_DPL_SHIFT) | 2315 DESC_W_MASK | DESC_A_MASK); 2316 } 2317 env->regs[R_ESP] = env->regs[R_ECX]; 2318 env->eip = env->regs[R_EDX]; 2319 } 2320 2321 target_ulong helper_lsl(CPUX86State *env, target_ulong selector1) 2322 { 2323 unsigned int limit; 2324 uint32_t e1, e2, selector; 2325 int rpl, dpl, cpl, type; 2326 2327 selector = selector1 & 0xffff; 2328 assert(CC_OP == CC_OP_EFLAGS); 2329 if ((selector & 0xfffc) == 0) { 2330 goto fail; 2331 } 2332 if (load_segment_ra(env, &e1, &e2, selector, GETPC()) != 0) { 2333 goto fail; 2334 } 2335 rpl = selector & 3; 2336 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 2337 cpl = env->hflags & HF_CPL_MASK; 2338 if (e2 & DESC_S_MASK) { 2339 if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) { 2340 /* conforming */ 2341 } else { 2342 if (dpl < cpl || dpl < rpl) { 2343 goto fail; 2344 } 2345 } 2346 } else { 2347 type = (e2 >> DESC_TYPE_SHIFT) & 0xf; 2348 switch (type) { 2349 case 1: 2350 case 2: 2351 case 3: 2352 case 9: 2353 case 11: 2354 break; 2355 default: 2356 goto fail; 2357 } 2358 if (dpl < cpl || dpl < rpl) { 2359 fail: 2360 CC_SRC &= ~CC_Z; 2361 return 0; 2362 } 2363 } 2364 limit = get_seg_limit(e1, e2); 2365 CC_SRC |= CC_Z; 2366 return limit; 2367 } 2368 2369 target_ulong helper_lar(CPUX86State *env, target_ulong selector1) 2370 { 2371 uint32_t e1, e2, selector; 2372 int rpl, dpl, cpl, type; 2373 2374 selector = selector1 & 0xffff; 2375 assert(CC_OP == CC_OP_EFLAGS); 2376 if ((selector & 0xfffc) == 0) { 2377 goto fail; 2378 } 2379 if (load_segment_ra(env, &e1, &e2, selector, GETPC()) != 0) { 2380 goto fail; 2381 } 2382 rpl = selector & 3; 2383 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 2384 cpl = env->hflags & HF_CPL_MASK; 2385 if (e2 & DESC_S_MASK) { 2386 if ((e2 & DESC_CS_MASK) && (e2 & DESC_C_MASK)) { 2387 /* conforming */ 2388 } else { 2389 if (dpl < cpl || dpl < rpl) { 2390 goto fail; 2391 } 2392 } 2393 } else { 2394 type = (e2 >> DESC_TYPE_SHIFT) & 0xf; 2395 switch (type) { 2396 case 1: 2397 case 2: 2398 case 3: 2399 case 4: 2400 case 5: 2401 case 9: 2402 case 11: 2403 case 12: 2404 break; 2405 default: 2406 goto fail; 2407 } 2408 if (dpl < cpl || dpl < rpl) { 2409 fail: 2410 CC_SRC &= ~CC_Z; 2411 return 0; 2412 } 2413 } 2414 CC_SRC |= CC_Z; 2415 return e2 & 0x00f0ff00; 2416 } 2417 2418 void helper_verr(CPUX86State *env, target_ulong selector1) 2419 { 2420 uint32_t e1, e2, eflags, selector; 2421 int rpl, dpl, cpl; 2422 2423 selector = selector1 & 0xffff; 2424 eflags = cpu_cc_compute_all(env) | CC_Z; 2425 if ((selector & 0xfffc) == 0) { 2426 goto fail; 2427 } 2428 if (load_segment_ra(env, &e1, &e2, selector, GETPC()) != 0) { 2429 goto fail; 2430 } 2431 if (!(e2 & DESC_S_MASK)) { 2432 goto fail; 2433 } 2434 rpl = selector & 3; 2435 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 2436 cpl = env->hflags & HF_CPL_MASK; 2437 if (e2 & DESC_CS_MASK) { 2438 if (!(e2 & DESC_R_MASK)) { 2439 goto fail; 2440 } 2441 if (!(e2 & DESC_C_MASK)) { 2442 if (dpl < cpl || dpl < rpl) { 2443 goto fail; 2444 } 2445 } 2446 } else { 2447 if (dpl < cpl || dpl < rpl) { 2448 fail: 2449 eflags &= ~CC_Z; 2450 } 2451 } 2452 CC_SRC = eflags; 2453 CC_OP = CC_OP_EFLAGS; 2454 } 2455 2456 void helper_verw(CPUX86State *env, target_ulong selector1) 2457 { 2458 uint32_t e1, e2, eflags, selector; 2459 int rpl, dpl, cpl; 2460 2461 selector = selector1 & 0xffff; 2462 eflags = cpu_cc_compute_all(env) | CC_Z; 2463 if ((selector & 0xfffc) == 0) { 2464 goto fail; 2465 } 2466 if (load_segment_ra(env, &e1, &e2, selector, GETPC()) != 0) { 2467 goto fail; 2468 } 2469 if (!(e2 & DESC_S_MASK)) { 2470 goto fail; 2471 } 2472 rpl = selector & 3; 2473 dpl = (e2 >> DESC_DPL_SHIFT) & 3; 2474 cpl = env->hflags & HF_CPL_MASK; 2475 if (e2 & DESC_CS_MASK) { 2476 goto fail; 2477 } else { 2478 if (dpl < cpl || dpl < rpl) { 2479 goto fail; 2480 } 2481 if (!(e2 & DESC_W_MASK)) { 2482 fail: 2483 eflags &= ~CC_Z; 2484 } 2485 } 2486 CC_SRC = eflags; 2487 CC_OP = CC_OP_EFLAGS; 2488 } 2489