/home/stefan/src/qemu/qemu.org/qemu/target-i386/seg

Bug Summary

File:	target-i386/seg_helper.c
Location:	line 882, column 9
Description:	Value stored to 'ss' is never read

Annotated Source Code

1	/*
2	* x86 segmentation related helpers:
3	* TSS, interrupts, system calls, jumps and call/task gates, descriptors
4	*
5	* Copyright (c) 2003 Fabrice Bellard
6	*
7	* This library is free software; you can redistribute it and/or
8	* modify it under the terms of the GNU Lesser General Public
9	* License as published by the Free Software Foundation; either
10	* version 2 of the License, or (at your option) any later version.
11	*
12	* This library is distributed in the hope that it will be useful,
13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15	* Lesser General Public License for more details.
16	*
17	* You should have received a copy of the GNU Lesser General Public
18	* License along with this library; if not, see <http://www.gnu.org/licenses/>.
19	*/
20
21	#include "cpu.h"
22	#include "qemu/log.h"
23	#include "helper.h"
24
25	//#define DEBUG_PCALL
26
27	#if !defined(CONFIG_USER_ONLY)
28	#include "exec/softmmu_exec.h"
29	#endif /* !defined(CONFIG_USER_ONLY) */
30
31	#ifdef DEBUG_PCALL
32	# define LOG_PCALL(...)do { } while (0) qemu_log_mask(CPU_LOG_PCALL(1 << 6), ## __VA_ARGS__)
33	# define LOG_PCALL_STATE(cpu)do { } while (0) \
34	log_cpu_state_mask(CPU_LOG_PCALL(1 << 6), (cpu), CPU_DUMP_CCOP)
35	#else
36	# define LOG_PCALL(...)do { } while (0) do { } while (0)
37	# define LOG_PCALL_STATE(cpu)do { } while (0) do { } while (0)
38	#endif
39
40	/* return non zero if error */
41	static inline int load_segment(CPUX86State env, uint32_t e1_ptr,
42	uint32_t *e2_ptr, int selector)
43	{
44	SegmentCache *dt;
45	int index;
46	target_ulong ptr;
47
48	if (selector & 0x4) {
49	dt = &env->ldt;
50	} else {
51	dt = &env->gdt;
52	}
53	index = selector & ~7;
54	if ((index + 7) > dt->limit) {
55	return -1;
56	}
57	ptr = dt->base + index;
58	*e1_ptr = cpu_ldl_kernel(env, ptr);
59	*e2_ptr = cpu_ldl_kernel(env, ptr + 4);
60	return 0;
61	}
62
63	static inline unsigned int get_seg_limit(uint32_t e1, uint32_t e2)
64	{
65	unsigned int limit;
66
67	limit = (e1 & 0xffff) \| (e2 & 0x000f0000);
68	if (e2 & DESC_G_MASK(1 << 23)) {
69	limit = (limit << 12) \| 0xfff;
70	}
71	return limit;
72	}
73
74	static inline uint32_t get_seg_base(uint32_t e1, uint32_t e2)
75	{
76	return (e1 >> 16) \| ((e2 & 0xff) << 16) \| (e2 & 0xff000000);
77	}
78
79	static inline void load_seg_cache_raw_dt(SegmentCache *sc, uint32_t e1,
80	uint32_t e2)
81	{
82	sc->base = get_seg_base(e1, e2);
83	sc->limit = get_seg_limit(e1, e2);
84	sc->flags = e2;
85	}
86
87	/* init the segment cache in vm86 mode. */
88	static inline void load_seg_vm(CPUX86State *env, int seg, int selector)
89	{
90	selector &= 0xffff;
91	cpu_x86_load_seg_cache(env, seg, selector,
92	(selector << 4), 0xffff, 0);
93	}
94
95	static inline void get_ss_esp_from_tss(CPUX86State env, uint32_t ss_ptr,
96	uint32_t *esp_ptr, int dpl)
97	{
98	int type, index, shift;
99
100	#if 0
101	{
102	int i;
103	printf("TR: base=%p limit=%x\n", env->tr.base, env->tr.limit);
104	for (i = 0; i < env->tr.limit; i++) {
105	printf("%02x ", env->tr.base[i]);
106	if ((i & 7) == 7) {
107	printf("\n");
108	}
109	}
110	printf("\n");
111	}
112	#endif
113
114	if (!(env->tr.flags & DESC_P_MASK(1 << 15))) {
115	cpu_abort(env, "invalid tss");
116	}
117	type = (env->tr.flags >> DESC_TYPE_SHIFT8) & 0xf;
118	if ((type & 7) != 1) {
119	cpu_abort(env, "invalid tss type");
120	}
121	shift = type >> 3;
122	index = (dpl * 4 + 2) << shift;
123	if (index + (4 << shift) - 1 > env->tr.limit) {
124	raise_exception_err(env, EXCP0A_TSS10, env->tr.selector & 0xfffc);
125	}
126	if (shift == 0) {
127	*esp_ptr = cpu_lduw_kernel(env, env->tr.base + index);
128	*ss_ptr = cpu_lduw_kernel(env, env->tr.base + index + 2);
129	} else {
130	*esp_ptr = cpu_ldl_kernel(env, env->tr.base + index);
131	*ss_ptr = cpu_lduw_kernel(env, env->tr.base + index + 4);
132	}
133	}
134
135	/* XXX: merge with load_seg() */
136	static void tss_load_seg(CPUX86State *env, int seg_reg, int selector)
137	{
138	uint32_t e1, e2;
139	int rpl, dpl, cpl;
140
141	if ((selector & 0xfffc) != 0) {
142	if (load_segment(env, &e1, &e2, selector) != 0) {
143	raise_exception_err(env, EXCP0A_TSS10, selector & 0xfffc);
144	}
145	if (!(e2 & DESC_S_MASK(1 << 12))) {
146	raise_exception_err(env, EXCP0A_TSS10, selector & 0xfffc);
147	}
148	rpl = selector & 3;
149	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
150	cpl = env->hflags & HF_CPL_MASK(3 << 0);
151	if (seg_reg == R_CS1) {
152	if (!(e2 & DESC_CS_MASK(1 << 11))) {
153	raise_exception_err(env, EXCP0A_TSS10, selector & 0xfffc);
154	}
155	/* XXX: is it correct? */
156	if (dpl != rpl) {
157	raise_exception_err(env, EXCP0A_TSS10, selector & 0xfffc);
158	}
159	if ((e2 & DESC_C_MASK(1 << 10)) && dpl > rpl) {
160	raise_exception_err(env, EXCP0A_TSS10, selector & 0xfffc);
161	}
162	} else if (seg_reg == R_SS2) {
163	/* SS must be writable data */
164	if ((e2 & DESC_CS_MASK(1 << 11)) \|\| !(e2 & DESC_W_MASK(1 << 9))) {
165	raise_exception_err(env, EXCP0A_TSS10, selector & 0xfffc);
166	}
167	if (dpl != cpl \|\| dpl != rpl) {
168	raise_exception_err(env, EXCP0A_TSS10, selector & 0xfffc);
169	}
170	} else {
171	/* not readable code */
172	if ((e2 & DESC_CS_MASK(1 << 11)) && !(e2 & DESC_R_MASK(1 << 9))) {
173	raise_exception_err(env, EXCP0A_TSS10, selector & 0xfffc);
174	}
175	/* if data or non conforming code, checks the rights */
176	if (((e2 >> DESC_TYPE_SHIFT8) & 0xf) < 12) {
177	if (dpl < cpl \|\| dpl < rpl) {
178	raise_exception_err(env, EXCP0A_TSS10, selector & 0xfffc);
179	}
180	}
181	}
182	if (!(e2 & DESC_P_MASK(1 << 15))) {
183	raise_exception_err(env, EXCP0B_NOSEG11, selector & 0xfffc);
184	}
185	cpu_x86_load_seg_cache(env, seg_reg, selector,
186	get_seg_base(e1, e2),
187	get_seg_limit(e1, e2),
188	e2);
189	} else {
190	if (seg_reg == R_SS2 \|\| seg_reg == R_CS1) {
191	raise_exception_err(env, EXCP0A_TSS10, selector & 0xfffc);
192	}
193	}
194	}
195
196	#define SWITCH_TSS_JMP0 0
197	#define SWITCH_TSS_IRET1 1
198	#define SWITCH_TSS_CALL2 2
199
200	/* XXX: restore CPU state in registers (PowerPC case) */
201	static void switch_tss(CPUX86State *env, int tss_selector,
202	uint32_t e1, uint32_t e2, int source,
203	uint32_t next_eip)
204	{
205	int tss_limit, tss_limit_max, type, old_tss_limit_max, old_type, v1, v2, i;
206	target_ulong tss_base;
207	uint32_t new_regs[8], new_segs[6];
208	uint32_t new_eflags, new_eip, new_cr3, new_ldt, new_trap;
209	uint32_t old_eflags, eflags_mask;
210	SegmentCache *dt;
211	int index;
212	target_ulong ptr;
213
214	type = (e2 >> DESC_TYPE_SHIFT8) & 0xf;
215	LOG_PCALL("switch_tss: sel=0x%04x type=%d src=%d\n", tss_selector, type,do { } while (0)
216	source)do { } while (0);
217
218	/* if task gate, we read the TSS segment and we load it */
219	if (type == 5) {
220	if (!(e2 & DESC_P_MASK(1 << 15))) {
221	raise_exception_err(env, EXCP0B_NOSEG11, tss_selector & 0xfffc);
222	}
223	tss_selector = e1 >> 16;
224	if (tss_selector & 4) {
225	raise_exception_err(env, EXCP0A_TSS10, tss_selector & 0xfffc);
226	}
227	if (load_segment(env, &e1, &e2, tss_selector) != 0) {
228	raise_exception_err(env, EXCP0D_GPF13, tss_selector & 0xfffc);
229	}
230	if (e2 & DESC_S_MASK(1 << 12)) {
231	raise_exception_err(env, EXCP0D_GPF13, tss_selector & 0xfffc);
232	}
233	type = (e2 >> DESC_TYPE_SHIFT8) & 0xf;
234	if ((type & 7) != 1) {
235	raise_exception_err(env, EXCP0D_GPF13, tss_selector & 0xfffc);
236	}
237	}
238
239	if (!(e2 & DESC_P_MASK(1 << 15))) {
240	raise_exception_err(env, EXCP0B_NOSEG11, tss_selector & 0xfffc);
241	}
242
243	if (type & 8) {
244	tss_limit_max = 103;
245	} else {
246	tss_limit_max = 43;
247	}
248	tss_limit = get_seg_limit(e1, e2);
249	tss_base = get_seg_base(e1, e2);
250	if ((tss_selector & 4) != 0 \|\|
251	tss_limit < tss_limit_max) {
252	raise_exception_err(env, EXCP0A_TSS10, tss_selector & 0xfffc);
253	}
254	old_type = (env->tr.flags >> DESC_TYPE_SHIFT8) & 0xf;
255	if (old_type & 8) {
256	old_tss_limit_max = 103;
257	} else {
258	old_tss_limit_max = 43;
259	}
260
261	/* read all the registers from the new TSS */
262	if (type & 8) {
263	/* 32 bit */
264	new_cr3 = cpu_ldl_kernel(env, tss_base + 0x1c);
265	new_eip = cpu_ldl_kernel(env, tss_base + 0x20);
266	new_eflags = cpu_ldl_kernel(env, tss_base + 0x24);
267	for (i = 0; i < 8; i++) {
268	new_regs[i] = cpu_ldl_kernel(env, tss_base + (0x28 + i * 4));
269	}
270	for (i = 0; i < 6; i++) {
271	new_segs[i] = cpu_lduw_kernel(env, tss_base + (0x48 + i * 4));
272	}
273	new_ldt = cpu_lduw_kernel(env, tss_base + 0x60);
274	new_trap = cpu_ldl_kernel(env, tss_base + 0x64);
275	} else {
276	/* 16 bit */
277	new_cr3 = 0;
278	new_eip = cpu_lduw_kernel(env, tss_base + 0x0e);
279	new_eflags = cpu_lduw_kernel(env, tss_base + 0x10);
280	for (i = 0; i < 8; i++) {
281	new_regs[i] = cpu_lduw_kernel(env, tss_base + (0x12 + i * 2)) \|
282	0xffff0000;
283	}
284	for (i = 0; i < 4; i++) {
285	new_segs[i] = cpu_lduw_kernel(env, tss_base + (0x22 + i * 4));
286	}
287	new_ldt = cpu_lduw_kernel(env, tss_base + 0x2a);
288	new_segs[R_FS4] = 0;
289	new_segs[R_GS5] = 0;
290	new_trap = 0;
291	}
292	/* XXX: avoid a compiler warning, see
293	http://support.amd.com/us/Processor_TechDocs/24593.pdf
294	chapters 12.2.5 and 13.2.4 on how to implement TSS Trap bit */
295	(void)new_trap;
296
297	/* NOTE: we must avoid memory exceptions during the task switch,
298	so we make dummy accesses before */
299	/* XXX: it can still fail in some cases, so a bigger hack is
300	necessary to valid the TLB after having done the accesses */
301
302	v1 = cpu_ldub_kernel(env, env->tr.base);
303	v2 = cpu_ldub_kernel(env, env->tr.base + old_tss_limit_max);
304	cpu_stb_kernel(env, env->tr.base, v1);
305	cpu_stb_kernel(env, env->tr.base + old_tss_limit_max, v2);
306
307	/* clear busy bit (it is restartable) */
308	if (source == SWITCH_TSS_JMP0 \|\| source == SWITCH_TSS_IRET1) {
309	target_ulong ptr;
310	uint32_t e2;
311
312	ptr = env->gdt.base + (env->tr.selector & ~7);
313	e2 = cpu_ldl_kernel(env, ptr + 4);
314	e2 &= ~DESC_TSS_BUSY_MASK(1 << 9);
315	cpu_stl_kernel(env, ptr + 4, e2);
316	}
317	old_eflags = cpu_compute_eflags(env);
318	if (source == SWITCH_TSS_IRET1) {
319	old_eflags &= ~NT_MASK0x00004000;
320	}
321
322	/* save the current state in the old TSS */
323	if (type & 8) {
324	/* 32 bit */
325	cpu_stl_kernel(env, env->tr.base + 0x20, next_eip);
326	cpu_stl_kernel(env, env->tr.base + 0x24, old_eflags);
327	cpu_stl_kernel(env, env->tr.base + (0x28 + 0 * 4), env->regs[R_EAX0]);
328	cpu_stl_kernel(env, env->tr.base + (0x28 + 1 * 4), env->regs[R_ECX1]);
329	cpu_stl_kernel(env, env->tr.base + (0x28 + 2 * 4), env->regs[R_EDX2]);
330	cpu_stl_kernel(env, env->tr.base + (0x28 + 3 * 4), env->regs[R_EBX3]);
331	cpu_stl_kernel(env, env->tr.base + (0x28 + 4 * 4), env->regs[R_ESP4]);
332	cpu_stl_kernel(env, env->tr.base + (0x28 + 5 * 4), env->regs[R_EBP5]);
333	cpu_stl_kernel(env, env->tr.base + (0x28 + 6 * 4), env->regs[R_ESI6]);
334	cpu_stl_kernel(env, env->tr.base + (0x28 + 7 * 4), env->regs[R_EDI7]);
335	for (i = 0; i < 6; i++) {
336	cpu_stw_kernel(env, env->tr.base + (0x48 + i * 4),
337	env->segs[i].selector);
338	}
339	} else {
340	/* 16 bit */
341	cpu_stw_kernel(env, env->tr.base + 0x0e, next_eip);
342	cpu_stw_kernel(env, env->tr.base + 0x10, old_eflags);
343	cpu_stw_kernel(env, env->tr.base + (0x12 + 0 * 2), env->regs[R_EAX0]);
344	cpu_stw_kernel(env, env->tr.base + (0x12 + 1 * 2), env->regs[R_ECX1]);
345	cpu_stw_kernel(env, env->tr.base + (0x12 + 2 * 2), env->regs[R_EDX2]);
346	cpu_stw_kernel(env, env->tr.base + (0x12 + 3 * 2), env->regs[R_EBX3]);
347	cpu_stw_kernel(env, env->tr.base + (0x12 + 4 * 2), env->regs[R_ESP4]);
348	cpu_stw_kernel(env, env->tr.base + (0x12 + 5 * 2), env->regs[R_EBP5]);
349	cpu_stw_kernel(env, env->tr.base + (0x12 + 6 * 2), env->regs[R_ESI6]);
350	cpu_stw_kernel(env, env->tr.base + (0x12 + 7 * 2), env->regs[R_EDI7]);
351	for (i = 0; i < 4; i++) {
352	cpu_stw_kernel(env, env->tr.base + (0x22 + i * 4),
353	env->segs[i].selector);
354	}
355	}
356
357	/* now if an exception occurs, it will occurs in the next task
358	context */
359
360	if (source == SWITCH_TSS_CALL2) {
361	cpu_stw_kernel(env, tss_base, env->tr.selector);
362	new_eflags \|= NT_MASK0x00004000;
363	}
364
365	/* set busy bit */
366	if (source == SWITCH_TSS_JMP0 \|\| source == SWITCH_TSS_CALL2) {
367	target_ulong ptr;
368	uint32_t e2;
369
370	ptr = env->gdt.base + (tss_selector & ~7);
371	e2 = cpu_ldl_kernel(env, ptr + 4);
372	e2 \|= DESC_TSS_BUSY_MASK(1 << 9);
373	cpu_stl_kernel(env, ptr + 4, e2);
374	}
375
376	/* set the new CPU state */
377	/* from this point, any exception which occurs can give problems */
378	env->cr[0] \|= CR0_TS_MASK(1 << 3);
379	env->hflags \|= HF_TS_MASK(1 << 11);
380	env->tr.selector = tss_selector;
381	env->tr.base = tss_base;
382	env->tr.limit = tss_limit;
383	env->tr.flags = e2 & ~DESC_TSS_BUSY_MASK(1 << 9);
384
385	if ((type & 8) && (env->cr[0] & CR0_PG_MASK(1 << 31))) {
386	cpu_x86_update_cr3(env, new_cr3);
387	}
388
389	/* load all registers without an exception, then reload them with
390	possible exception */
391	env->eip = new_eip;
392	eflags_mask = TF_MASK0x00000100 \| AC_MASK0x00040000 \| ID_MASK0x00200000 \|
393	IF_MASK0x00000200 \| IOPL_MASK0x00003000 \| VM_MASK0x00020000 \| RF_MASK0x00010000 \| NT_MASK0x00004000;
394	if (!(type & 8)) {
395	eflags_mask &= 0xffff;
396	}
397	cpu_load_eflags(env, new_eflags, eflags_mask);
398	/* XXX: what to do in 16 bit case? */
399	env->regs[R_EAX0] = new_regs[0];
400	env->regs[R_ECX1] = new_regs[1];
401	env->regs[R_EDX2] = new_regs[2];
402	env->regs[R_EBX3] = new_regs[3];
403	env->regs[R_ESP4] = new_regs[4];
404	env->regs[R_EBP5] = new_regs[5];
405	env->regs[R_ESI6] = new_regs[6];
406	env->regs[R_EDI7] = new_regs[7];
407	if (new_eflags & VM_MASK0x00020000) {
408	for (i = 0; i < 6; i++) {
409	load_seg_vm(env, i, new_segs[i]);
410	}
411	/* in vm86, CPL is always 3 */
412	cpu_x86_set_cpl(env, 3);
413	} else {
414	/* CPL is set the RPL of CS */
415	cpu_x86_set_cpl(env, new_segs[R_CS1] & 3);
416	/* first just selectors as the rest may trigger exceptions */
417	for (i = 0; i < 6; i++) {
418	cpu_x86_load_seg_cache(env, i, new_segs[i], 0, 0, 0);
419	}
420	}
421
422	env->ldt.selector = new_ldt & ~4;
423	env->ldt.base = 0;
424	env->ldt.limit = 0;
425	env->ldt.flags = 0;
426
427	/* load the LDT */
428	if (new_ldt & 4) {
429	raise_exception_err(env, EXCP0A_TSS10, new_ldt & 0xfffc);
430	}
431
432	if ((new_ldt & 0xfffc) != 0) {
433	dt = &env->gdt;
434	index = new_ldt & ~7;
435	if ((index + 7) > dt->limit) {
436	raise_exception_err(env, EXCP0A_TSS10, new_ldt & 0xfffc);
437	}
438	ptr = dt->base + index;
439	e1 = cpu_ldl_kernel(env, ptr);
440	e2 = cpu_ldl_kernel(env, ptr + 4);
441	if ((e2 & DESC_S_MASK(1 << 12)) \|\| ((e2 >> DESC_TYPE_SHIFT8) & 0xf) != 2) {
442	raise_exception_err(env, EXCP0A_TSS10, new_ldt & 0xfffc);
443	}
444	if (!(e2 & DESC_P_MASK(1 << 15))) {
445	raise_exception_err(env, EXCP0A_TSS10, new_ldt & 0xfffc);
446	}
447	load_seg_cache_raw_dt(&env->ldt, e1, e2);
448	}
449
450	/* load the segments */
451	if (!(new_eflags & VM_MASK0x00020000)) {
452	tss_load_seg(env, R_CS1, new_segs[R_CS1]);
453	tss_load_seg(env, R_SS2, new_segs[R_SS2]);
454	tss_load_seg(env, R_ES0, new_segs[R_ES0]);
455	tss_load_seg(env, R_DS3, new_segs[R_DS3]);
456	tss_load_seg(env, R_FS4, new_segs[R_FS4]);
457	tss_load_seg(env, R_GS5, new_segs[R_GS5]);
458	}
459
460	/* check that env->eip is in the CS segment limits */
461	if (new_eip > env->segs[R_CS1].limit) {
462	/* XXX: different exception if CALL? */
463	raise_exception_err(env, EXCP0D_GPF13, 0);
464	}
465
466	#ifndef CONFIG_USER_ONLY
467	/* reset local breakpoints */
468	if (env->dr[7] & DR7_LOCAL_BP_MASK0x55) {
469	for (i = 0; i < DR7_MAX_BP4; i++) {
470	if (hw_local_breakpoint_enabled(env->dr[7], i) &&
471	!hw_global_breakpoint_enabled(env->dr[7], i)) {
472	hw_breakpoint_remove(env, i);
473	}
474	}
475	env->dr[7] &= ~DR7_LOCAL_BP_MASK0x55;
476	}
477	#endif
478	}
479
480	static inline unsigned int get_sp_mask(unsigned int e2)
481	{
482	if (e2 & DESC_B_MASK(1 << 22)) {
483	return 0xffffffff;
484	} else {
485	return 0xffff;
486	}
487	}
488
489	static int exception_has_error_code(int intno)
490	{
491	switch (intno) {
492	case 8:
493	case 10:
494	case 11:
495	case 12:
496	case 13:
497	case 14:
498	case 17:
499	return 1;
500	}
501	return 0;
502	}
503
504	#ifdef TARGET_X86_641
505	#define SET_ESP(val, sp_mask)do { if ((sp_mask) == 0xffff) { env->regs[4] = (env->regs [4] & ~0xffff) \| ((val) & 0xffff); } else if ((sp_mask ) == 0xffffffffLL) { env->regs[4] = (uint32_t)(val); } else { env->regs[4] = (val); } } while (0) \
506	do { \
507	if ((sp_mask) == 0xffff) { \
508	env->regs[R_ESP4] = (env->regs[R_ESP4] & ~0xffff) \| \
509	((val) & 0xffff); \
510	} else if ((sp_mask) == 0xffffffffLL) { \
511	env->regs[R_ESP4] = (uint32_t)(val); \
512	} else { \
513	env->regs[R_ESP4] = (val); \
514	} \
515	} while (0)
516	#else
517	#define SET_ESP(val, sp_mask)do { if ((sp_mask) == 0xffff) { env->regs[4] = (env->regs [4] & ~0xffff) \| ((val) & 0xffff); } else if ((sp_mask ) == 0xffffffffLL) { env->regs[4] = (uint32_t)(val); } else { env->regs[4] = (val); } } while (0) \
518	do { \
519	env->regs[R_ESP4] = (env->regs[R_ESP4] & ~(sp_mask)) \| \
520	((val) & (sp_mask)); \
521	} while (0)
522	#endif
523
524	/* in 64-bit machines, this can overflow. So this segment addition macro
525	* can be used to trim the value to 32-bit whenever needed */
526	#define SEG_ADDL(ssp, sp, sp_mask)((uint32_t)((ssp) + (sp & (sp_mask)))) ((uint32_t)((ssp) + (sp & (sp_mask))))
527
528	/* XXX: add a is_user flag to have proper security support */
529	#define PUSHW(ssp, sp, sp_mask, val){ sp -= 2; cpu_stw_kernel(env, (ssp) + (sp & (sp_mask)), ( val)); } \
530	{ \
531	sp -= 2; \
532	cpu_stw_kernel(env, (ssp) + (sp & (sp_mask)), (val)); \
533	}
534
535	#define PUSHL(ssp, sp, sp_mask, val){ sp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (sp & ( sp_mask)))), (uint32_t)(val)); } \
536	{ \
537	sp -= 4; \
538	cpu_stl_kernel(env, SEG_ADDL(ssp, sp, sp_mask)((uint32_t)((ssp) + (sp & (sp_mask)))), (uint32_t)(val)); \
539	}
540
541	#define POPW(ssp, sp, sp_mask, val){ val = cpu_lduw_kernel(env, (ssp) + (sp & (sp_mask))); sp += 2; } \
542	{ \
543	val = cpu_lduw_kernel(env, (ssp) + (sp & (sp_mask))); \
544	sp += 2; \
545	}
546
547	#define POPL(ssp, sp, sp_mask, val){ val = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp) + (sp & (sp_mask))))); sp += 4; } \
548	{ \
549	val = (uint32_t)cpu_ldl_kernel(env, SEG_ADDL(ssp, sp, sp_mask)((uint32_t)((ssp) + (sp & (sp_mask))))); \
550	sp += 4; \
551	}
552
553	/* protected mode interrupt */
554	static void do_interrupt_protected(CPUX86State *env, int intno, int is_int,
555	int error_code, unsigned int next_eip,
556	int is_hw)
557	{
558	SegmentCache *dt;
559	target_ulong ptr, ssp;
560	int type, dpl, selector, ss_dpl, cpl;
561	int has_error_code, new_stack, shift;
562	uint32_t e1, e2, offset, ss = 0, esp, ss_e1 = 0, ss_e2 = 0;
563	uint32_t old_eip, sp_mask;
564
565	has_error_code = 0;
566	if (!is_int && !is_hw) {
567	has_error_code = exception_has_error_code(intno);
568	}
569	if (is_int) {
570	old_eip = next_eip;
571	} else {
572	old_eip = env->eip;
573	}
574
575	dt = &env->idt;
576	if (intno * 8 + 7 > dt->limit) {
577	raise_exception_err(env, EXCP0D_GPF13, intno * 8 + 2);
578	}
579	ptr = dt->base + intno * 8;
580	e1 = cpu_ldl_kernel(env, ptr);
581	e2 = cpu_ldl_kernel(env, ptr + 4);
582	/* check gate type */
583	type = (e2 >> DESC_TYPE_SHIFT8) & 0x1f;
584	switch (type) {
585	case 5: /* task gate */
586	/* must do that check here to return the correct error code */
587	if (!(e2 & DESC_P_MASK(1 << 15))) {
588	raise_exception_err(env, EXCP0B_NOSEG11, intno * 8 + 2);
589	}
590	switch_tss(env, intno * 8, e1, e2, SWITCH_TSS_CALL2, old_eip);
591	if (has_error_code) {
592	int type;
593	uint32_t mask;
594
595	/* push the error code */
596	type = (env->tr.flags >> DESC_TYPE_SHIFT8) & 0xf;
597	shift = type >> 3;
598	if (env->segs[R_SS2].flags & DESC_B_MASK(1 << 22)) {
599	mask = 0xffffffff;
600	} else {
601	mask = 0xffff;
602	}
603	esp = (env->regs[R_ESP4] - (2 << shift)) & mask;
604	ssp = env->segs[R_SS2].base + esp;
605	if (shift) {
606	cpu_stl_kernel(env, ssp, error_code);
607	} else {
608	cpu_stw_kernel(env, ssp, error_code);
609	}
610	SET_ESP(esp, mask)do { if ((mask) == 0xffff) { env->regs[4] = (env->regs[ 4] & ~0xffff) \| ((esp) & 0xffff); } else if ((mask) == 0xffffffffLL) { env->regs[4] = (uint32_t)(esp); } else { env ->regs[4] = (esp); } } while (0);
611	}
612	return;
613	case 6: /* 286 interrupt gate */
614	case 7: /* 286 trap gate */
615	case 14: /* 386 interrupt gate */
616	case 15: /* 386 trap gate */
617	break;
618	default:
619	raise_exception_err(env, EXCP0D_GPF13, intno * 8 + 2);
620	break;
621	}
622	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
623	cpl = env->hflags & HF_CPL_MASK(3 << 0);
624	/* check privilege if software int */
625	if (is_int && dpl < cpl) {
626	raise_exception_err(env, EXCP0D_GPF13, intno * 8 + 2);
627	}
628	/* check valid bit */
629	if (!(e2 & DESC_P_MASK(1 << 15))) {
630	raise_exception_err(env, EXCP0B_NOSEG11, intno * 8 + 2);
631	}
632	selector = e1 >> 16;
633	offset = (e2 & 0xffff0000) \| (e1 & 0x0000ffff);
634	if ((selector & 0xfffc) == 0) {
635	raise_exception_err(env, EXCP0D_GPF13, 0);
636	}
637	if (load_segment(env, &e1, &e2, selector) != 0) {
638	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
639	}
640	if (!(e2 & DESC_S_MASK(1 << 12)) \|\| !(e2 & (DESC_CS_MASK(1 << 11)))) {
641	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
642	}
643	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
644	if (dpl > cpl) {
645	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
646	}
647	if (!(e2 & DESC_P_MASK(1 << 15))) {
648	raise_exception_err(env, EXCP0B_NOSEG11, selector & 0xfffc);
649	}
650	if (!(e2 & DESC_C_MASK(1 << 10)) && dpl < cpl) {
651	/* to inner privilege */
652	get_ss_esp_from_tss(env, &ss, &esp, dpl);
653	if ((ss & 0xfffc) == 0) {
654	raise_exception_err(env, EXCP0A_TSS10, ss & 0xfffc);
655	}
656	if ((ss & 3) != dpl) {
657	raise_exception_err(env, EXCP0A_TSS10, ss & 0xfffc);
658	}
659	if (load_segment(env, &ss_e1, &ss_e2, ss) != 0) {
660	raise_exception_err(env, EXCP0A_TSS10, ss & 0xfffc);
661	}
662	ss_dpl = (ss_e2 >> DESC_DPL_SHIFT13) & 3;
663	if (ss_dpl != dpl) {
664	raise_exception_err(env, EXCP0A_TSS10, ss & 0xfffc);
665	}
666	if (!(ss_e2 & DESC_S_MASK(1 << 12)) \|\|
667	(ss_e2 & DESC_CS_MASK(1 << 11)) \|\|
668	!(ss_e2 & DESC_W_MASK(1 << 9))) {
669	raise_exception_err(env, EXCP0A_TSS10, ss & 0xfffc);
670	}
671	if (!(ss_e2 & DESC_P_MASK(1 << 15))) {
672	raise_exception_err(env, EXCP0A_TSS10, ss & 0xfffc);
673	}
674	new_stack = 1;
675	sp_mask = get_sp_mask(ss_e2);
676	ssp = get_seg_base(ss_e1, ss_e2);
677	} else if ((e2 & DESC_C_MASK(1 << 10)) \|\| dpl == cpl) {
678	/* to same privilege */
679	if (env->eflags & VM_MASK0x00020000) {
680	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
681	}
682	new_stack = 0;
683	sp_mask = get_sp_mask(env->segs[R_SS2].flags);
684	ssp = env->segs[R_SS2].base;
685	esp = env->regs[R_ESP4];
686	dpl = cpl;
687	} else {
688	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
689	new_stack = 0; /* avoid warning */
690	sp_mask = 0; /* avoid warning */
691	ssp = 0; /* avoid warning */
692	esp = 0; /* avoid warning */
693	}
694
695	shift = type >> 3;
696
697	#if 0
698	/* XXX: check that enough room is available */
699	push_size = 6 + (new_stack << 2) + (has_error_code << 1);
700	if (env->eflags & VM_MASK0x00020000) {
701	push_size += 8;
702	}
703	push_size <<= shift;
704	#endif
705	if (shift == 1) {
706	if (new_stack) {
707	if (env->eflags & VM_MASK0x00020000) {
708	PUSHL(ssp, esp, sp_mask, env->segs[R_GS].selector){ esp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (esp & (sp_mask)))), (uint32_t)(env->segs[5].selector)); };
709	PUSHL(ssp, esp, sp_mask, env->segs[R_FS].selector){ esp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (esp & (sp_mask)))), (uint32_t)(env->segs[4].selector)); };
710	PUSHL(ssp, esp, sp_mask, env->segs[R_DS].selector){ esp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (esp & (sp_mask)))), (uint32_t)(env->segs[3].selector)); };
711	PUSHL(ssp, esp, sp_mask, env->segs[R_ES].selector){ esp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (esp & (sp_mask)))), (uint32_t)(env->segs[0].selector)); };
712	}
713	PUSHL(ssp, esp, sp_mask, env->segs[R_SS].selector){ esp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (esp & (sp_mask)))), (uint32_t)(env->segs[2].selector)); };
714	PUSHL(ssp, esp, sp_mask, env->regs[R_ESP]){ esp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (esp & (sp_mask)))), (uint32_t)(env->regs[4])); };
715	}
716	PUSHL(ssp, esp, sp_mask, cpu_compute_eflags(env)){ esp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (esp & (sp_mask)))), (uint32_t)(cpu_compute_eflags(env))); };
717	PUSHL(ssp, esp, sp_mask, env->segs[R_CS].selector){ esp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (esp & (sp_mask)))), (uint32_t)(env->segs[1].selector)); };
718	PUSHL(ssp, esp, sp_mask, old_eip){ esp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (esp & (sp_mask)))), (uint32_t)(old_eip)); };
719	if (has_error_code) {
720	PUSHL(ssp, esp, sp_mask, error_code){ esp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (esp & (sp_mask)))), (uint32_t)(error_code)); };
721	}
722	} else {
723	if (new_stack) {
724	if (env->eflags & VM_MASK0x00020000) {
725	PUSHW(ssp, esp, sp_mask, env->segs[R_GS].selector){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (sp_mask)) , (env->segs[5].selector)); };
726	PUSHW(ssp, esp, sp_mask, env->segs[R_FS].selector){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (sp_mask)) , (env->segs[4].selector)); };
727	PUSHW(ssp, esp, sp_mask, env->segs[R_DS].selector){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (sp_mask)) , (env->segs[3].selector)); };
728	PUSHW(ssp, esp, sp_mask, env->segs[R_ES].selector){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (sp_mask)) , (env->segs[0].selector)); };
729	}
730	PUSHW(ssp, esp, sp_mask, env->segs[R_SS].selector){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (sp_mask)) , (env->segs[2].selector)); };
731	PUSHW(ssp, esp, sp_mask, env->regs[R_ESP]){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (sp_mask)) , (env->regs[4])); };
732	}
733	PUSHW(ssp, esp, sp_mask, cpu_compute_eflags(env)){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (sp_mask)) , (cpu_compute_eflags(env))); };
734	PUSHW(ssp, esp, sp_mask, env->segs[R_CS].selector){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (sp_mask)) , (env->segs[1].selector)); };
735	PUSHW(ssp, esp, sp_mask, old_eip){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (sp_mask)) , (old_eip)); };
736	if (has_error_code) {
737	PUSHW(ssp, esp, sp_mask, error_code){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (sp_mask)) , (error_code)); };
738	}
739	}
740
741	if (new_stack) {
742	if (env->eflags & VM_MASK0x00020000) {
743	cpu_x86_load_seg_cache(env, R_ES0, 0, 0, 0, 0);
744	cpu_x86_load_seg_cache(env, R_DS3, 0, 0, 0, 0);
745	cpu_x86_load_seg_cache(env, R_FS4, 0, 0, 0, 0);
746	cpu_x86_load_seg_cache(env, R_GS5, 0, 0, 0, 0);
747	}
748	ss = (ss & ~3) \| dpl;
749	cpu_x86_load_seg_cache(env, R_SS2, ss,
750	ssp, get_seg_limit(ss_e1, ss_e2), ss_e2);
751	}
752	SET_ESP(esp, sp_mask)do { if ((sp_mask) == 0xffff) { env->regs[4] = (env->regs [4] & ~0xffff) \| ((esp) & 0xffff); } else if ((sp_mask ) == 0xffffffffLL) { env->regs[4] = (uint32_t)(esp); } else { env->regs[4] = (esp); } } while (0);
753
754	selector = (selector & ~3) \| dpl;
755	cpu_x86_load_seg_cache(env, R_CS1, selector,
756	get_seg_base(e1, e2),
757	get_seg_limit(e1, e2),
758	e2);
759	cpu_x86_set_cpl(env, dpl);
760	env->eip = offset;
761
762	/* interrupt gate clear IF mask */
763	if ((type & 1) == 0) {
764	env->eflags &= ~IF_MASK0x00000200;
765	}
766	env->eflags &= ~(TF_MASK0x00000100 \| VM_MASK0x00020000 \| RF_MASK0x00010000 \| NT_MASK0x00004000);
767	}
768
769	#ifdef TARGET_X86_641
770
771	#define PUSHQ(sp, val){ sp -= 8; cpu_stq_kernel(env, sp, (val)); } \
772	{ \
773	sp -= 8; \
774	cpu_stq_kernel(env, sp, (val)); \
775	}
776
777	#define POPQ(sp, val){ val = cpu_ldq_kernel(env, sp); sp += 8; } \
778	{ \
779	val = cpu_ldq_kernel(env, sp); \
780	sp += 8; \
781	}
782
783	static inline target_ulong get_rsp_from_tss(CPUX86State *env, int level)
784	{
785	int index;
786
787	#if 0
788	printf("TR: base=" TARGET_FMT_lx"%016" "l" "x" " limit=%x\n",
789	env->tr.base, env->tr.limit);
790	#endif
791
792	if (!(env->tr.flags & DESC_P_MASK(1 << 15))) {
793	cpu_abort(env, "invalid tss");
794	}
795	index = 8 * level + 4;
796	if ((index + 7) > env->tr.limit) {
797	raise_exception_err(env, EXCP0A_TSS10, env->tr.selector & 0xfffc);
798	}
799	return cpu_ldq_kernel(env, env->tr.base + index);
800	}
801
802	/* 64 bit interrupt */
803	static void do_interrupt64(CPUX86State *env, int intno, int is_int,
804	int error_code, target_ulong next_eip, int is_hw)
805	{
806	SegmentCache *dt;
807	target_ulong ptr;
808	int type, dpl, selector, cpl, ist;
809	int has_error_code, new_stack;
810	uint32_t e1, e2, e3, ss;
811	target_ulong old_eip, esp, offset;
812
813	has_error_code = 0;
814	if (!is_int && !is_hw) {
815	has_error_code = exception_has_error_code(intno);
816	}
817	if (is_int) {
818	old_eip = next_eip;
819	} else {
820	old_eip = env->eip;
821	}
822
823	dt = &env->idt;
824	if (intno * 16 + 15 > dt->limit) {
825	raise_exception_err(env, EXCP0D_GPF13, intno * 16 + 2);
826	}
827	ptr = dt->base + intno * 16;
828	e1 = cpu_ldl_kernel(env, ptr);
829	e2 = cpu_ldl_kernel(env, ptr + 4);
830	e3 = cpu_ldl_kernel(env, ptr + 8);
831	/* check gate type */
832	type = (e2 >> DESC_TYPE_SHIFT8) & 0x1f;
833	switch (type) {
834	case 14: /* 386 interrupt gate */
835	case 15: /* 386 trap gate */
836	break;
837	default:
838	raise_exception_err(env, EXCP0D_GPF13, intno * 16 + 2);
839	break;
840	}
841	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
842	cpl = env->hflags & HF_CPL_MASK(3 << 0);
843	/* check privilege if software int */
844	if (is_int && dpl < cpl) {
845	raise_exception_err(env, EXCP0D_GPF13, intno * 16 + 2);
846	}
847	/* check valid bit */
848	if (!(e2 & DESC_P_MASK(1 << 15))) {
849	raise_exception_err(env, EXCP0B_NOSEG11, intno * 16 + 2);
850	}
851	selector = e1 >> 16;
852	offset = ((target_ulong)e3 << 32) \| (e2 & 0xffff0000) \| (e1 & 0x0000ffff);
853	ist = e2 & 7;
854	if ((selector & 0xfffc) == 0) {
855	raise_exception_err(env, EXCP0D_GPF13, 0);
856	}
857
858	if (load_segment(env, &e1, &e2, selector) != 0) {
859	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
860	}
861	if (!(e2 & DESC_S_MASK(1 << 12)) \|\| !(e2 & (DESC_CS_MASK(1 << 11)))) {
862	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
863	}
864	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
865	if (dpl > cpl) {
866	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
867	}
868	if (!(e2 & DESC_P_MASK(1 << 15))) {
869	raise_exception_err(env, EXCP0B_NOSEG11, selector & 0xfffc);
870	}
871	if (!(e2 & DESC_L_MASK(1 << 21)) \|\| (e2 & DESC_B_MASK(1 << 22))) {
872	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
873	}
874	if ((!(e2 & DESC_C_MASK(1 << 10)) && dpl < cpl) \|\| ist != 0) {
875	/* to inner privilege */
876	if (ist != 0) {
877	esp = get_rsp_from_tss(env, ist + 3);
878	} else {
879	esp = get_rsp_from_tss(env, dpl);
880	}
881	esp &= ~0xfLL; /* align stack */
882	ss = 0;
	Value stored to 'ss' is never read
883	new_stack = 1;
884	} else if ((e2 & DESC_C_MASK(1 << 10)) \|\| dpl == cpl) {
885	/* to same privilege */
886	if (env->eflags & VM_MASK0x00020000) {
887	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
888	}
889	new_stack = 0;
890	if (ist != 0) {
891	esp = get_rsp_from_tss(env, ist + 3);
892	} else {
893	esp = env->regs[R_ESP4];
894	}
895	esp &= ~0xfLL; /* align stack */
896	dpl = cpl;
897	} else {
898	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
899	new_stack = 0; /* avoid warning */
900	esp = 0; /* avoid warning */
901	}
902
903	PUSHQ(esp, env->segs[R_SS].selector){ esp -= 8; cpu_stq_kernel(env, esp, (env->segs[2].selector )); };
904	PUSHQ(esp, env->regs[R_ESP]){ esp -= 8; cpu_stq_kernel(env, esp, (env->regs[4])); };
905	PUSHQ(esp, cpu_compute_eflags(env)){ esp -= 8; cpu_stq_kernel(env, esp, (cpu_compute_eflags(env) )); };
906	PUSHQ(esp, env->segs[R_CS].selector){ esp -= 8; cpu_stq_kernel(env, esp, (env->segs[1].selector )); };
907	PUSHQ(esp, old_eip){ esp -= 8; cpu_stq_kernel(env, esp, (old_eip)); };
908	if (has_error_code) {
909	PUSHQ(esp, error_code){ esp -= 8; cpu_stq_kernel(env, esp, (error_code)); };
910	}
911
912	if (new_stack) {
913	ss = 0 \| dpl;
914	cpu_x86_load_seg_cache(env, R_SS2, ss, 0, 0, 0);
915	}
916	env->regs[R_ESP4] = esp;
917
918	selector = (selector & ~3) \| dpl;
919	cpu_x86_load_seg_cache(env, R_CS1, selector,
920	get_seg_base(e1, e2),
921	get_seg_limit(e1, e2),
922	e2);
923	cpu_x86_set_cpl(env, dpl);
924	env->eip = offset;
925
926	/* interrupt gate clear IF mask */
927	if ((type & 1) == 0) {
928	env->eflags &= ~IF_MASK0x00000200;
929	}
930	env->eflags &= ~(TF_MASK0x00000100 \| VM_MASK0x00020000 \| RF_MASK0x00010000 \| NT_MASK0x00004000);
931	}
932	#endif
933
934	#ifdef TARGET_X86_641
935	#if defined(CONFIG_USER_ONLY)
936	void helper_syscall(CPUX86State *env, int next_eip_addend)
937	{
938	env->exception_index = EXCP_SYSCALL0x100;
939	env->exception_next_eip = env->eip + next_eip_addend;
940	cpu_loop_exit(env);
941	}
942	#else
943	void helper_syscall(CPUX86State *env, int next_eip_addend)
944	{
945	int selector;
946
947	if (!(env->efer & MSR_EFER_SCE(1 << 0))) {
948	raise_exception_err(env, EXCP06_ILLOP6, 0);
949	}
950	selector = (env->star >> 32) & 0xffff;
951	if (env->hflags & HF_LMA_MASK(1 << 14)) {
952	int code64;
953
954	env->regs[R_ECX1] = env->eip + next_eip_addend;
955	env->regs[11] = cpu_compute_eflags(env);
956
957	code64 = env->hflags & HF_CS64_MASK(1 << 15);
958
959	cpu_x86_set_cpl(env, 0);
960	cpu_x86_load_seg_cache(env, R_CS1, selector & 0xfffc,
961	0, 0xffffffff,
962	DESC_G_MASK(1 << 23) \| DESC_P_MASK(1 << 15) \|
963	DESC_S_MASK(1 << 12) \|
964	DESC_CS_MASK(1 << 11) \| DESC_R_MASK(1 << 9) \| DESC_A_MASK(1 << 8) \|
965	DESC_L_MASK(1 << 21));
966	cpu_x86_load_seg_cache(env, R_SS2, (selector + 8) & 0xfffc,
967	0, 0xffffffff,
968	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
969	DESC_S_MASK(1 << 12) \|
970	DESC_W_MASK(1 << 9) \| DESC_A_MASK(1 << 8));
971	env->eflags &= ~env->fmask;
972	cpu_load_eflags(env, env->eflags, 0);
973	if (code64) {
974	env->eip = env->lstar;
975	} else {
976	env->eip = env->cstar;
977	}
978	} else {
979	env->regs[R_ECX1] = (uint32_t)(env->eip + next_eip_addend);
980
981	cpu_x86_set_cpl(env, 0);
982	cpu_x86_load_seg_cache(env, R_CS1, selector & 0xfffc,
983	0, 0xffffffff,
984	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
985	DESC_S_MASK(1 << 12) \|
986	DESC_CS_MASK(1 << 11) \| DESC_R_MASK(1 << 9) \| DESC_A_MASK(1 << 8));
987	cpu_x86_load_seg_cache(env, R_SS2, (selector + 8) & 0xfffc,
988	0, 0xffffffff,
989	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
990	DESC_S_MASK(1 << 12) \|
991	DESC_W_MASK(1 << 9) \| DESC_A_MASK(1 << 8));
992	env->eflags &= ~(IF_MASK0x00000200 \| RF_MASK0x00010000 \| VM_MASK0x00020000);
993	env->eip = (uint32_t)env->star;
994	}
995	}
996	#endif
997	#endif
998
999	#ifdef TARGET_X86_641
1000	void helper_sysret(CPUX86State *env, int dflag)
1001	{
1002	int cpl, selector;
1003
1004	if (!(env->efer & MSR_EFER_SCE(1 << 0))) {
1005	raise_exception_err(env, EXCP06_ILLOP6, 0);
1006	}
1007	cpl = env->hflags & HF_CPL_MASK(3 << 0);
1008	if (!(env->cr[0] & CR0_PE_MASK(1 << 0)) \|\| cpl != 0) {
1009	raise_exception_err(env, EXCP0D_GPF13, 0);
1010	}
1011	selector = (env->star >> 48) & 0xffff;
1012	if (env->hflags & HF_LMA_MASK(1 << 14)) {
1013	if (dflag == 2) {
1014	cpu_x86_load_seg_cache(env, R_CS1, (selector + 16) \| 3,
1015	0, 0xffffffff,
1016	DESC_G_MASK(1 << 23) \| DESC_P_MASK(1 << 15) \|
1017	DESC_S_MASK(1 << 12) \| (3 << DESC_DPL_SHIFT13) \|
1018	DESC_CS_MASK(1 << 11) \| DESC_R_MASK(1 << 9) \| DESC_A_MASK(1 << 8) \|
1019	DESC_L_MASK(1 << 21));
1020	env->eip = env->regs[R_ECX1];
1021	} else {
1022	cpu_x86_load_seg_cache(env, R_CS1, selector \| 3,
1023	0, 0xffffffff,
1024	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
1025	DESC_S_MASK(1 << 12) \| (3 << DESC_DPL_SHIFT13) \|
1026	DESC_CS_MASK(1 << 11) \| DESC_R_MASK(1 << 9) \| DESC_A_MASK(1 << 8));
1027	env->eip = (uint32_t)env->regs[R_ECX1];
1028	}
1029	cpu_x86_load_seg_cache(env, R_SS2, selector + 8,
1030	0, 0xffffffff,
1031	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
1032	DESC_S_MASK(1 << 12) \| (3 << DESC_DPL_SHIFT13) \|
1033	DESC_W_MASK(1 << 9) \| DESC_A_MASK(1 << 8));
1034	cpu_load_eflags(env, (uint32_t)(env->regs[11]), TF_MASK0x00000100 \| AC_MASK0x00040000
1035	\| ID_MASK0x00200000 \| IF_MASK0x00000200 \| IOPL_MASK0x00003000 \| VM_MASK0x00020000 \| RF_MASK0x00010000 \|
1036	NT_MASK0x00004000);
1037	cpu_x86_set_cpl(env, 3);
1038	} else {
1039	cpu_x86_load_seg_cache(env, R_CS1, selector \| 3,
1040	0, 0xffffffff,
1041	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
1042	DESC_S_MASK(1 << 12) \| (3 << DESC_DPL_SHIFT13) \|
1043	DESC_CS_MASK(1 << 11) \| DESC_R_MASK(1 << 9) \| DESC_A_MASK(1 << 8));
1044	env->eip = (uint32_t)env->regs[R_ECX1];
1045	cpu_x86_load_seg_cache(env, R_SS2, selector + 8,
1046	0, 0xffffffff,
1047	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
1048	DESC_S_MASK(1 << 12) \| (3 << DESC_DPL_SHIFT13) \|
1049	DESC_W_MASK(1 << 9) \| DESC_A_MASK(1 << 8));
1050	env->eflags \|= IF_MASK0x00000200;
1051	cpu_x86_set_cpl(env, 3);
1052	}
1053	}
1054	#endif
1055
1056	/* real mode interrupt */
1057	static void do_interrupt_real(CPUX86State *env, int intno, int is_int,
1058	int error_code, unsigned int next_eip)
1059	{
1060	SegmentCache *dt;
1061	target_ulong ptr, ssp;
1062	int selector;
1063	uint32_t offset, esp;
1064	uint32_t old_cs, old_eip;
1065
1066	/* real mode (simpler!) */
1067	dt = &env->idt;
1068	if (intno * 4 + 3 > dt->limit) {
1069	raise_exception_err(env, EXCP0D_GPF13, intno * 8 + 2);
1070	}
1071	ptr = dt->base + intno * 4;
1072	offset = cpu_lduw_kernel(env, ptr);
1073	selector = cpu_lduw_kernel(env, ptr + 2);
1074	esp = env->regs[R_ESP4];
1075	ssp = env->segs[R_SS2].base;
1076	if (is_int) {
1077	old_eip = next_eip;
1078	} else {
1079	old_eip = env->eip;
1080	}
1081	old_cs = env->segs[R_CS1].selector;
1082	/* XXX: use SS segment size? */
1083	PUSHW(ssp, esp, 0xffff, cpu_compute_eflags(env)){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (0xffff)), (cpu_compute_eflags(env))); };
1084	PUSHW(ssp, esp, 0xffff, old_cs){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (0xffff)), (old_cs)); };
1085	PUSHW(ssp, esp, 0xffff, old_eip){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (0xffff)), (old_eip)); };
1086
1087	/* update processor state */
1088	env->regs[R_ESP4] = (env->regs[R_ESP4] & ~0xffff) \| (esp & 0xffff);
1089	env->eip = offset;
1090	env->segs[R_CS1].selector = selector;
1091	env->segs[R_CS1].base = (selector << 4);
1092	env->eflags &= ~(IF_MASK0x00000200 \| TF_MASK0x00000100 \| AC_MASK0x00040000 \| RF_MASK0x00010000);
1093	}
1094
1095	#if defined(CONFIG_USER_ONLY)
1096	/* fake user mode interrupt */
1097	static void do_interrupt_user(CPUX86State *env, int intno, int is_int,
1098	int error_code, target_ulong next_eip)
1099	{
1100	SegmentCache *dt;
1101	target_ulong ptr;
1102	int dpl, cpl, shift;
1103	uint32_t e2;
1104
1105	dt = &env->idt;
1106	if (env->hflags & HF_LMA_MASK(1 << 14)) {
1107	shift = 4;
1108	} else {
1109	shift = 3;
1110	}
1111	ptr = dt->base + (intno << shift);
1112	e2 = cpu_ldl_kernel(env, ptr + 4);
1113
1114	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
1115	cpl = env->hflags & HF_CPL_MASK(3 << 0);
1116	/* check privilege if software int */
1117	if (is_int && dpl < cpl) {
1118	raise_exception_err(env, EXCP0D_GPF13, (intno << shift) + 2);
1119	}
1120
1121	/* Since we emulate only user space, we cannot do more than
1122	exiting the emulation with the suitable exception and error
1123	code */
1124	if (is_int) {
1125	env->eip = next_eip;
1126	}
1127	}
1128
1129	#else
1130
1131	static void handle_even_inj(CPUX86State *env, int intno, int is_int,
1132	int error_code, int is_hw, int rm)
1133	{
1134	uint32_t event_inj = ldl_phys(env->vm_vmcb + offsetof(struct vmcb,__builtin_offsetof(struct vmcb, control.event_inj)
1135	control.event_inj)__builtin_offsetof(struct vmcb, control.event_inj));
1136
1137	if (!(event_inj & SVM_EVTINJ_VALID(1 << 31))) {
1138	int type;
1139
1140	if (is_int) {
1141	type = SVM_EVTINJ_TYPE_SOFT(4 << 8);
1142	} else {
1143	type = SVM_EVTINJ_TYPE_EXEPT(3 << 8);
1144	}
1145	event_inj = intno \| type \| SVM_EVTINJ_VALID(1 << 31);
1146	if (!rm && exception_has_error_code(intno)) {
1147	event_inj \|= SVM_EVTINJ_VALID_ERR(1 << 11);
1148	stl_phys(env->vm_vmcb + offsetof(struct vmcb,__builtin_offsetof(struct vmcb, control.event_inj_err)
1149	control.event_inj_err)__builtin_offsetof(struct vmcb, control.event_inj_err),
1150	error_code);
1151	}
1152	stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj)__builtin_offsetof(struct vmcb, control.event_inj),
1153	event_inj);
1154	}
1155	}
1156	#endif
1157
1158	/*
1159	* Begin execution of an interruption. is_int is TRUE if coming from
1160	* the int instruction. next_eip is the env->eip value AFTER the interrupt
1161	* instruction. It is only relevant if is_int is TRUE.
1162	*/
1163	static void do_interrupt_all(X86CPU *cpu, int intno, int is_int,
1164	int error_code, target_ulong next_eip, int is_hw)
1165	{
1166	CPUX86State *env = &cpu->env;
1167
1168	if (qemu_loglevel_mask(CPU_LOG_INT(1 << 4))) {
1169	if ((env->cr[0] & CR0_PE_MASK(1 << 0))) {
1170	static int count;
1171
1172	qemu_log("%6d: v=%02x e=%04x i=%d cpl=%d IP=%04x:" TARGET_FMT_lx"%016" "l" "x"
1173	" pc=" TARGET_FMT_lx"%016" "l" "x" " SP=%04x:" TARGET_FMT_lx"%016" "l" "x",
1174	count, intno, error_code, is_int,
1175	env->hflags & HF_CPL_MASK(3 << 0),
1176	env->segs[R_CS1].selector, env->eip,
1177	(int)env->segs[R_CS1].base + env->eip,
1178	env->segs[R_SS2].selector, env->regs[R_ESP4]);
1179	if (intno == 0x0e) {
1180	qemu_log(" CR2=" TARGET_FMT_lx"%016" "l" "x", env->cr[2]);
1181	} else {
1182	qemu_log(" env->regs[R_EAX]=" TARGET_FMT_lx"%016" "l" "x", env->regs[R_EAX0]);
1183	}
1184	qemu_log("\n");
1185	log_cpu_state(CPU(cpu)((CPUState )object_dynamic_cast_assert(((Object )((cpu))), ( "cpu"), "/home/stefan/src/qemu/qemu.org/qemu/target-i386/seg_helper.c" , 1185, __func__)), CPU_DUMP_CCOP);
1186	#if 0
1187	{
1188	int i;
1189	target_ulong ptr;
1190
1191	qemu_log(" code=");
1192	ptr = env->segs[R_CS1].base + env->eip;
1193	for (i = 0; i < 16; i++) {
1194	qemu_log(" %02x", ldub(ptr + i)ldub_data(ptr + i));
1195	}
1196	qemu_log("\n");
1197	}
1198	#endif
1199	count++;
1200	}
1201	}
1202	if (env->cr[0] & CR0_PE_MASK(1 << 0)) {
1203	#if !defined(CONFIG_USER_ONLY)
1204	if (env->hflags & HF_SVMI_MASK(1 << 21)) {
1205	handle_even_inj(env, intno, is_int, error_code, is_hw, 0);
1206	}
1207	#endif
1208	#ifdef TARGET_X86_641
1209	if (env->hflags & HF_LMA_MASK(1 << 14)) {
1210	do_interrupt64(env, intno, is_int, error_code, next_eip, is_hw);
1211	} else
1212	#endif
1213	{
1214	do_interrupt_protected(env, intno, is_int, error_code, next_eip,
1215	is_hw);
1216	}
1217	} else {
1218	#if !defined(CONFIG_USER_ONLY)
1219	if (env->hflags & HF_SVMI_MASK(1 << 21)) {
1220	handle_even_inj(env, intno, is_int, error_code, is_hw, 1);
1221	}
1222	#endif
1223	do_interrupt_real(env, intno, is_int, error_code, next_eip);
1224	}
1225
1226	#if !defined(CONFIG_USER_ONLY)
1227	if (env->hflags & HF_SVMI_MASK(1 << 21)) {
1228	uint32_t event_inj = ldl_phys(env->vm_vmcb +
1229	offsetof(struct vmcb,__builtin_offsetof(struct vmcb, control.event_inj)
1230	control.event_inj)__builtin_offsetof(struct vmcb, control.event_inj));
1231
1232	stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj)__builtin_offsetof(struct vmcb, control.event_inj),
1233	event_inj & ~SVM_EVTINJ_VALID(1 << 31));
1234	}
1235	#endif
1236	}
1237
1238	void x86_cpu_do_interrupt(CPUState *cs)
1239	{
1240	X86CPU cpu = X86_CPU(cs)((X86CPU )object_dynamic_cast_assert(((Object *)((cs))), ("x86_64-cpu" ), "/home/stefan/src/qemu/qemu.org/qemu/target-i386/seg_helper.c" , 1240, __func__));
1241	CPUX86State *env = &cpu->env;
1242
1243	#if defined(CONFIG_USER_ONLY)
1244	/* if user mode only, we simulate a fake exception
1245	which will be handled outside the cpu execution
1246	loop */
1247	do_interrupt_user(env, env->exception_index,
1248	env->exception_is_int,
1249	env->error_code,
1250	env->exception_next_eip);
1251	/* successfully delivered */
1252	env->old_exception = -1;
1253	#else
1254	/* simulate a real cpu exception. On i386, it can
1255	trigger new exceptions, but we do not handle
1256	double or triple faults yet. */
1257	do_interrupt_all(cpu, env->exception_index,
1258	env->exception_is_int,
1259	env->error_code,
1260	env->exception_next_eip, 0);
1261	/* successfully delivered */
1262	env->old_exception = -1;
1263	#endif
1264	}
1265
1266	void do_interrupt_x86_hardirq(CPUX86State *env, int intno, int is_hw)
1267	{
1268	do_interrupt_all(x86_env_get_cpu(env), intno, 0, 0, 0, is_hw);
1269	}
1270
1271	void helper_enter_level(CPUX86State *env, int level, int data32,
1272	target_ulong t1)
1273	{
1274	target_ulong ssp;
1275	uint32_t esp_mask, esp, ebp;
1276
1277	esp_mask = get_sp_mask(env->segs[R_SS2].flags);
1278	ssp = env->segs[R_SS2].base;
1279	ebp = env->regs[R_EBP5];
1280	esp = env->regs[R_ESP4];
1281	if (data32) {
1282	/* 32 bit */
1283	esp -= 4;
1284	while (--level) {
1285	esp -= 4;
1286	ebp -= 4;
1287	cpu_stl_data(env, ssp + (esp & esp_mask),
1288	cpu_ldl_data(env, ssp + (ebp & esp_mask)));
1289	}
1290	esp -= 4;
1291	cpu_stl_data(env, ssp + (esp & esp_mask), t1);
1292	} else {
1293	/* 16 bit */
1294	esp -= 2;
1295	while (--level) {
1296	esp -= 2;
1297	ebp -= 2;
1298	cpu_stw_data(env, ssp + (esp & esp_mask),
1299	cpu_lduw_data(env, ssp + (ebp & esp_mask)));
1300	}
1301	esp -= 2;
1302	cpu_stw_data(env, ssp + (esp & esp_mask), t1);
1303	}
1304	}
1305
1306	#ifdef TARGET_X86_641
1307	void helper_enter64_level(CPUX86State *env, int level, int data64,
1308	target_ulong t1)
1309	{
1310	target_ulong esp, ebp;
1311
1312	ebp = env->regs[R_EBP5];
1313	esp = env->regs[R_ESP4];
1314
1315	if (data64) {
1316	/* 64 bit */
1317	esp -= 8;
1318	while (--level) {
1319	esp -= 8;
1320	ebp -= 8;
1321	cpu_stq_data(env, esp, cpu_ldq_data(env, ebp));
1322	}
1323	esp -= 8;
1324	cpu_stq_data(env, esp, t1);
1325	} else {
1326	/* 16 bit */
1327	esp -= 2;
1328	while (--level) {
1329	esp -= 2;
1330	ebp -= 2;
1331	cpu_stw_data(env, esp, cpu_lduw_data(env, ebp));
1332	}
1333	esp -= 2;
1334	cpu_stw_data(env, esp, t1);
1335	}
1336	}
1337	#endif
1338
1339	void helper_lldt(CPUX86State *env, int selector)
1340	{
1341	SegmentCache *dt;
1342	uint32_t e1, e2;
1343	int index, entry_limit;
1344	target_ulong ptr;
1345
1346	selector &= 0xffff;
1347	if ((selector & 0xfffc) == 0) {
1348	/* XXX: NULL selector case: invalid LDT */
1349	env->ldt.base = 0;
1350	env->ldt.limit = 0;
1351	} else {
1352	if (selector & 0x4) {
1353	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1354	}
1355	dt = &env->gdt;
1356	index = selector & ~7;
1357	#ifdef TARGET_X86_641
1358	if (env->hflags & HF_LMA_MASK(1 << 14)) {
1359	entry_limit = 15;
1360	} else
1361	#endif
1362	{
1363	entry_limit = 7;
1364	}
1365	if ((index + entry_limit) > dt->limit) {
1366	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1367	}
1368	ptr = dt->base + index;
1369	e1 = cpu_ldl_kernel(env, ptr);
1370	e2 = cpu_ldl_kernel(env, ptr + 4);
1371	if ((e2 & DESC_S_MASK(1 << 12)) \|\| ((e2 >> DESC_TYPE_SHIFT8) & 0xf) != 2) {
1372	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1373	}
1374	if (!(e2 & DESC_P_MASK(1 << 15))) {
1375	raise_exception_err(env, EXCP0B_NOSEG11, selector & 0xfffc);
1376	}
1377	#ifdef TARGET_X86_641
1378	if (env->hflags & HF_LMA_MASK(1 << 14)) {
1379	uint32_t e3;
1380
1381	e3 = cpu_ldl_kernel(env, ptr + 8);
1382	load_seg_cache_raw_dt(&env->ldt, e1, e2);
1383	env->ldt.base \|= (target_ulong)e3 << 32;
1384	} else
1385	#endif
1386	{
1387	load_seg_cache_raw_dt(&env->ldt, e1, e2);
1388	}
1389	}
1390	env->ldt.selector = selector;
1391	}
1392
1393	void helper_ltr(CPUX86State *env, int selector)
1394	{
1395	SegmentCache *dt;
1396	uint32_t e1, e2;
1397	int index, type, entry_limit;
1398	target_ulong ptr;
1399
1400	selector &= 0xffff;
1401	if ((selector & 0xfffc) == 0) {
1402	/* NULL selector case: invalid TR */
1403	env->tr.base = 0;
1404	env->tr.limit = 0;
1405	env->tr.flags = 0;
1406	} else {
1407	if (selector & 0x4) {
1408	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1409	}
1410	dt = &env->gdt;
1411	index = selector & ~7;
1412	#ifdef TARGET_X86_641
1413	if (env->hflags & HF_LMA_MASK(1 << 14)) {
1414	entry_limit = 15;
1415	} else
1416	#endif
1417	{
1418	entry_limit = 7;
1419	}
1420	if ((index + entry_limit) > dt->limit) {
1421	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1422	}
1423	ptr = dt->base + index;
1424	e1 = cpu_ldl_kernel(env, ptr);
1425	e2 = cpu_ldl_kernel(env, ptr + 4);
1426	type = (e2 >> DESC_TYPE_SHIFT8) & 0xf;
1427	if ((e2 & DESC_S_MASK(1 << 12)) \|\|
1428	(type != 1 && type != 9)) {
1429	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1430	}
1431	if (!(e2 & DESC_P_MASK(1 << 15))) {
1432	raise_exception_err(env, EXCP0B_NOSEG11, selector & 0xfffc);
1433	}
1434	#ifdef TARGET_X86_641
1435	if (env->hflags & HF_LMA_MASK(1 << 14)) {
1436	uint32_t e3, e4;
1437
1438	e3 = cpu_ldl_kernel(env, ptr + 8);
1439	e4 = cpu_ldl_kernel(env, ptr + 12);
1440	if ((e4 >> DESC_TYPE_SHIFT8) & 0xf) {
1441	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1442	}
1443	load_seg_cache_raw_dt(&env->tr, e1, e2);
1444	env->tr.base \|= (target_ulong)e3 << 32;
1445	} else
1446	#endif
1447	{
1448	load_seg_cache_raw_dt(&env->tr, e1, e2);
1449	}
1450	e2 \|= DESC_TSS_BUSY_MASK(1 << 9);
1451	cpu_stl_kernel(env, ptr + 4, e2);
1452	}
1453	env->tr.selector = selector;
1454	}
1455
1456	/* only works if protected mode and not VM86. seg_reg must be != R_CS */
1457	void helper_load_seg(CPUX86State *env, int seg_reg, int selector)
1458	{
1459	uint32_t e1, e2;
1460	int cpl, dpl, rpl;
1461	SegmentCache *dt;
1462	int index;
1463	target_ulong ptr;
1464
1465	selector &= 0xffff;
1466	cpl = env->hflags & HF_CPL_MASK(3 << 0);
1467	if ((selector & 0xfffc) == 0) {
1468	/* null selector case */
1469	if (seg_reg == R_SS2
1470	#ifdef TARGET_X86_641
1471	&& (!(env->hflags & HF_CS64_MASK(1 << 15)) \|\| cpl == 3)
1472	#endif
1473	) {
1474	raise_exception_err(env, EXCP0D_GPF13, 0);
1475	}
1476	cpu_x86_load_seg_cache(env, seg_reg, selector, 0, 0, 0);
1477	} else {
1478
1479	if (selector & 0x4) {
1480	dt = &env->ldt;
1481	} else {
1482	dt = &env->gdt;
1483	}
1484	index = selector & ~7;
1485	if ((index + 7) > dt->limit) {
1486	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1487	}
1488	ptr = dt->base + index;
1489	e1 = cpu_ldl_kernel(env, ptr);
1490	e2 = cpu_ldl_kernel(env, ptr + 4);
1491
1492	if (!(e2 & DESC_S_MASK(1 << 12))) {
1493	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1494	}
1495	rpl = selector & 3;
1496	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
1497	if (seg_reg == R_SS2) {
1498	/* must be writable segment */
1499	if ((e2 & DESC_CS_MASK(1 << 11)) \|\| !(e2 & DESC_W_MASK(1 << 9))) {
1500	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1501	}
1502	if (rpl != cpl \|\| dpl != cpl) {
1503	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1504	}
1505	} else {
1506	/* must be readable segment */
1507	if ((e2 & (DESC_CS_MASK(1 << 11) \| DESC_R_MASK(1 << 9))) == DESC_CS_MASK(1 << 11)) {
1508	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1509	}
1510
1511	if (!(e2 & DESC_CS_MASK(1 << 11)) \|\| !(e2 & DESC_C_MASK(1 << 10))) {
1512	/* if not conforming code, test rights */
1513	if (dpl < cpl \|\| dpl < rpl) {
1514	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1515	}
1516	}
1517	}
1518
1519	if (!(e2 & DESC_P_MASK(1 << 15))) {
1520	if (seg_reg == R_SS2) {
1521	raise_exception_err(env, EXCP0C_STACK12, selector & 0xfffc);
1522	} else {
1523	raise_exception_err(env, EXCP0B_NOSEG11, selector & 0xfffc);
1524	}
1525	}
1526
1527	/* set the access bit if not already set */
1528	if (!(e2 & DESC_A_MASK(1 << 8))) {
1529	e2 \|= DESC_A_MASK(1 << 8);
1530	cpu_stl_kernel(env, ptr + 4, e2);
1531	}
1532
1533	cpu_x86_load_seg_cache(env, seg_reg, selector,
1534	get_seg_base(e1, e2),
1535	get_seg_limit(e1, e2),
1536	e2);
1537	#if 0
1538	qemu_log("load_seg: sel=0x%04x base=0x%08lx limit=0x%08lx flags=%08x\n",
1539	selector, (unsigned long)sc->base, sc->limit, sc->flags);
1540	#endif
1541	}
1542	}
1543
1544	/* protected mode jump */
1545	void helper_ljmp_protected(CPUX86State *env, int new_cs, target_ulong new_eip,
1546	int next_eip_addend)
1547	{
1548	int gate_cs, type;
1549	uint32_t e1, e2, cpl, dpl, rpl, limit;
1550	target_ulong next_eip;
1551
1552	if ((new_cs & 0xfffc) == 0) {
1553	raise_exception_err(env, EXCP0D_GPF13, 0);
1554	}
1555	if (load_segment(env, &e1, &e2, new_cs) != 0) {
1556	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1557	}
1558	cpl = env->hflags & HF_CPL_MASK(3 << 0);
1559	if (e2 & DESC_S_MASK(1 << 12)) {
1560	if (!(e2 & DESC_CS_MASK(1 << 11))) {
1561	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1562	}
1563	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
1564	if (e2 & DESC_C_MASK(1 << 10)) {
1565	/* conforming code segment */
1566	if (dpl > cpl) {
1567	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1568	}
1569	} else {
1570	/* non conforming code segment */
1571	rpl = new_cs & 3;
1572	if (rpl > cpl) {
1573	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1574	}
1575	if (dpl != cpl) {
1576	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1577	}
1578	}
1579	if (!(e2 & DESC_P_MASK(1 << 15))) {
1580	raise_exception_err(env, EXCP0B_NOSEG11, new_cs & 0xfffc);
1581	}
1582	limit = get_seg_limit(e1, e2);
1583	if (new_eip > limit &&
1584	!(env->hflags & HF_LMA_MASK(1 << 14)) && !(e2 & DESC_L_MASK(1 << 21))) {
1585	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1586	}
1587	cpu_x86_load_seg_cache(env, R_CS1, (new_cs & 0xfffc) \| cpl,
1588	get_seg_base(e1, e2), limit, e2);
1589	env->eip = new_eip;
1590	} else {
1591	/* jump to call or task gate */
1592	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
1593	rpl = new_cs & 3;
1594	cpl = env->hflags & HF_CPL_MASK(3 << 0);
1595	type = (e2 >> DESC_TYPE_SHIFT8) & 0xf;
1596	switch (type) {
1597	case 1: /* 286 TSS */
1598	case 9: /* 386 TSS */
1599	case 5: /* task gate */
1600	if (dpl < cpl \|\| dpl < rpl) {
1601	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1602	}
1603	next_eip = env->eip + next_eip_addend;
1604	switch_tss(env, new_cs, e1, e2, SWITCH_TSS_JMP0, next_eip);
1605	CC_OP(env->cc_op) = CC_OP_EFLAGS;
1606	break;
1607	case 4: /* 286 call gate */
1608	case 12: /* 386 call gate */
1609	if ((dpl < cpl) \|\| (dpl < rpl)) {
1610	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1611	}
1612	if (!(e2 & DESC_P_MASK(1 << 15))) {
1613	raise_exception_err(env, EXCP0B_NOSEG11, new_cs & 0xfffc);
1614	}
1615	gate_cs = e1 >> 16;
1616	new_eip = (e1 & 0xffff);
1617	if (type == 12) {
1618	new_eip \|= (e2 & 0xffff0000);
1619	}
1620	if (load_segment(env, &e1, &e2, gate_cs) != 0) {
1621	raise_exception_err(env, EXCP0D_GPF13, gate_cs & 0xfffc);
1622	}
1623	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
1624	/* must be code segment */
1625	if (((e2 & (DESC_S_MASK(1 << 12) \| DESC_CS_MASK(1 << 11))) !=
1626	(DESC_S_MASK(1 << 12) \| DESC_CS_MASK(1 << 11)))) {
1627	raise_exception_err(env, EXCP0D_GPF13, gate_cs & 0xfffc);
1628	}
1629	if (((e2 & DESC_C_MASK(1 << 10)) && (dpl > cpl)) \|\|
1630	(!(e2 & DESC_C_MASK(1 << 10)) && (dpl != cpl))) {
1631	raise_exception_err(env, EXCP0D_GPF13, gate_cs & 0xfffc);
1632	}
1633	if (!(e2 & DESC_P_MASK(1 << 15))) {
1634	raise_exception_err(env, EXCP0D_GPF13, gate_cs & 0xfffc);
1635	}
1636	limit = get_seg_limit(e1, e2);
1637	if (new_eip > limit) {
1638	raise_exception_err(env, EXCP0D_GPF13, 0);
1639	}
1640	cpu_x86_load_seg_cache(env, R_CS1, (gate_cs & 0xfffc) \| cpl,
1641	get_seg_base(e1, e2), limit, e2);
1642	env->eip = new_eip;
1643	break;
1644	default:
1645	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1646	break;
1647	}
1648	}
1649	}
1650
1651	/* real mode call */
1652	void helper_lcall_real(CPUX86State *env, int new_cs, target_ulong new_eip1,
1653	int shift, int next_eip)
1654	{
1655	int new_eip;
1656	uint32_t esp, esp_mask;
1657	target_ulong ssp;
1658
1659	new_eip = new_eip1;
1660	esp = env->regs[R_ESP4];
1661	esp_mask = get_sp_mask(env->segs[R_SS2].flags);
1662	ssp = env->segs[R_SS2].base;
1663	if (shift) {
1664	PUSHL(ssp, esp, esp_mask, env->segs[R_CS].selector){ esp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (esp & (esp_mask)))), (uint32_t)(env->segs[1].selector)); };
1665	PUSHL(ssp, esp, esp_mask, next_eip){ esp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (esp & (esp_mask)))), (uint32_t)(next_eip)); };
1666	} else {
1667	PUSHW(ssp, esp, esp_mask, env->segs[R_CS].selector){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (esp_mask) ), (env->segs[1].selector)); };
1668	PUSHW(ssp, esp, esp_mask, next_eip){ esp -= 2; cpu_stw_kernel(env, (ssp) + (esp & (esp_mask) ), (next_eip)); };
1669	}
1670
1671	SET_ESP(esp, esp_mask)do { if ((esp_mask) == 0xffff) { env->regs[4] = (env->regs [4] & ~0xffff) \| ((esp) & 0xffff); } else if ((esp_mask ) == 0xffffffffLL) { env->regs[4] = (uint32_t)(esp); } else { env->regs[4] = (esp); } } while (0);
1672	env->eip = new_eip;
1673	env->segs[R_CS1].selector = new_cs;
1674	env->segs[R_CS1].base = (new_cs << 4);
1675	}
1676
1677	/* protected mode call */
1678	void helper_lcall_protected(CPUX86State *env, int new_cs, target_ulong new_eip,
1679	int shift, int next_eip_addend)
1680	{
1681	int new_stack, i;
1682	uint32_t e1, e2, cpl, dpl, rpl, selector, offset, param_count;
1683	uint32_t ss = 0, ss_e1 = 0, ss_e2 = 0, sp, type, ss_dpl, sp_mask;
1684	uint32_t val, limit, old_sp_mask;
1685	target_ulong ssp, old_ssp, next_eip;
1686
1687	next_eip = env->eip + next_eip_addend;
1688	LOG_PCALL("lcall %04x:%08x s=%d\n", new_cs, (uint32_t)new_eip, shift)do { } while (0);
1689	LOG_PCALL_STATE(CPU(x86_env_get_cpu(env)))do { } while (0);
1690	if ((new_cs & 0xfffc) == 0) {
1691	raise_exception_err(env, EXCP0D_GPF13, 0);
1692	}
1693	if (load_segment(env, &e1, &e2, new_cs) != 0) {
1694	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1695	}
1696	cpl = env->hflags & HF_CPL_MASK(3 << 0);
1697	LOG_PCALL("desc=%08x:%08x\n", e1, e2)do { } while (0);
1698	if (e2 & DESC_S_MASK(1 << 12)) {
1699	if (!(e2 & DESC_CS_MASK(1 << 11))) {
1700	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1701	}
1702	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
1703	if (e2 & DESC_C_MASK(1 << 10)) {
1704	/* conforming code segment */
1705	if (dpl > cpl) {
1706	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1707	}
1708	} else {
1709	/* non conforming code segment */
1710	rpl = new_cs & 3;
1711	if (rpl > cpl) {
1712	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1713	}
1714	if (dpl != cpl) {
1715	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1716	}
1717	}
1718	if (!(e2 & DESC_P_MASK(1 << 15))) {
1719	raise_exception_err(env, EXCP0B_NOSEG11, new_cs & 0xfffc);
1720	}
1721
1722	#ifdef TARGET_X86_641
1723	/* XXX: check 16/32 bit cases in long mode */
1724	if (shift == 2) {
1725	target_ulong rsp;
1726
1727	/* 64 bit case */
1728	rsp = env->regs[R_ESP4];
1729	PUSHQ(rsp, env->segs[R_CS].selector){ rsp -= 8; cpu_stq_kernel(env, rsp, (env->segs[1].selector )); };
1730	PUSHQ(rsp, next_eip){ rsp -= 8; cpu_stq_kernel(env, rsp, (next_eip)); };
1731	/* from this point, not restartable */
1732	env->regs[R_ESP4] = rsp;
1733	cpu_x86_load_seg_cache(env, R_CS1, (new_cs & 0xfffc) \| cpl,
1734	get_seg_base(e1, e2),
1735	get_seg_limit(e1, e2), e2);
1736	env->eip = new_eip;
1737	} else
1738	#endif
1739	{
1740	sp = env->regs[R_ESP4];
1741	sp_mask = get_sp_mask(env->segs[R_SS2].flags);
1742	ssp = env->segs[R_SS2].base;
1743	if (shift) {
1744	PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector){ sp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (sp & ( sp_mask)))), (uint32_t)(env->segs[1].selector)); };
1745	PUSHL(ssp, sp, sp_mask, next_eip){ sp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (sp & ( sp_mask)))), (uint32_t)(next_eip)); };
1746	} else {
1747	PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector){ sp -= 2; cpu_stw_kernel(env, (ssp) + (sp & (sp_mask)), ( env->segs[1].selector)); };
1748	PUSHW(ssp, sp, sp_mask, next_eip){ sp -= 2; cpu_stw_kernel(env, (ssp) + (sp & (sp_mask)), ( next_eip)); };
1749	}
1750
1751	limit = get_seg_limit(e1, e2);
1752	if (new_eip > limit) {
1753	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1754	}
1755	/* from this point, not restartable */
1756	SET_ESP(sp, sp_mask)do { if ((sp_mask) == 0xffff) { env->regs[4] = (env->regs [4] & ~0xffff) \| ((sp) & 0xffff); } else if ((sp_mask ) == 0xffffffffLL) { env->regs[4] = (uint32_t)(sp); } else { env->regs[4] = (sp); } } while (0);
1757	cpu_x86_load_seg_cache(env, R_CS1, (new_cs & 0xfffc) \| cpl,
1758	get_seg_base(e1, e2), limit, e2);
1759	env->eip = new_eip;
1760	}
1761	} else {
1762	/* check gate type */
1763	type = (e2 >> DESC_TYPE_SHIFT8) & 0x1f;
1764	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
1765	rpl = new_cs & 3;
1766	switch (type) {
1767	case 1: /* available 286 TSS */
1768	case 9: /* available 386 TSS */
1769	case 5: /* task gate */
1770	if (dpl < cpl \|\| dpl < rpl) {
1771	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1772	}
1773	switch_tss(env, new_cs, e1, e2, SWITCH_TSS_CALL2, next_eip);
1774	CC_OP(env->cc_op) = CC_OP_EFLAGS;
1775	return;
1776	case 4: /* 286 call gate */
1777	case 12: /* 386 call gate */
1778	break;
1779	default:
1780	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1781	break;
1782	}
1783	shift = type >> 3;
1784
1785	if (dpl < cpl \|\| dpl < rpl) {
1786	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
1787	}
1788	/* check valid bit */
1789	if (!(e2 & DESC_P_MASK(1 << 15))) {
1790	raise_exception_err(env, EXCP0B_NOSEG11, new_cs & 0xfffc);
1791	}
1792	selector = e1 >> 16;
1793	offset = (e2 & 0xffff0000) \| (e1 & 0x0000ffff);
1794	param_count = e2 & 0x1f;
1795	if ((selector & 0xfffc) == 0) {
1796	raise_exception_err(env, EXCP0D_GPF13, 0);
1797	}
1798
1799	if (load_segment(env, &e1, &e2, selector) != 0) {
1800	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1801	}
1802	if (!(e2 & DESC_S_MASK(1 << 12)) \|\| !(e2 & (DESC_CS_MASK(1 << 11)))) {
1803	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1804	}
1805	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
1806	if (dpl > cpl) {
1807	raise_exception_err(env, EXCP0D_GPF13, selector & 0xfffc);
1808	}
1809	if (!(e2 & DESC_P_MASK(1 << 15))) {
1810	raise_exception_err(env, EXCP0B_NOSEG11, selector & 0xfffc);
1811	}
1812
1813	if (!(e2 & DESC_C_MASK(1 << 10)) && dpl < cpl) {
1814	/* to inner privilege */
1815	get_ss_esp_from_tss(env, &ss, &sp, dpl);
1816	LOG_PCALL("new ss:esp=%04x:%08x param_count=%d env->regs[R_ESP]="do { } while (0)
1817	TARGET_FMT_lx "\n", ss, sp, param_count,do { } while (0)
1818	env->regs[R_ESP])do { } while (0);
1819	if ((ss & 0xfffc) == 0) {
1820	raise_exception_err(env, EXCP0A_TSS10, ss & 0xfffc);
1821	}
1822	if ((ss & 3) != dpl) {
1823	raise_exception_err(env, EXCP0A_TSS10, ss & 0xfffc);
1824	}
1825	if (load_segment(env, &ss_e1, &ss_e2, ss) != 0) {
1826	raise_exception_err(env, EXCP0A_TSS10, ss & 0xfffc);
1827	}
1828	ss_dpl = (ss_e2 >> DESC_DPL_SHIFT13) & 3;
1829	if (ss_dpl != dpl) {
1830	raise_exception_err(env, EXCP0A_TSS10, ss & 0xfffc);
1831	}
1832	if (!(ss_e2 & DESC_S_MASK(1 << 12)) \|\|
1833	(ss_e2 & DESC_CS_MASK(1 << 11)) \|\|
1834	!(ss_e2 & DESC_W_MASK(1 << 9))) {
1835	raise_exception_err(env, EXCP0A_TSS10, ss & 0xfffc);
1836	}
1837	if (!(ss_e2 & DESC_P_MASK(1 << 15))) {
1838	raise_exception_err(env, EXCP0A_TSS10, ss & 0xfffc);
1839	}
1840
1841	/* push_size = ((param_count * 2) + 8) << shift; */
1842
1843	old_sp_mask = get_sp_mask(env->segs[R_SS2].flags);
1844	old_ssp = env->segs[R_SS2].base;
1845
1846	sp_mask = get_sp_mask(ss_e2);
1847	ssp = get_seg_base(ss_e1, ss_e2);
1848	if (shift) {
1849	PUSHL(ssp, sp, sp_mask, env->segs[R_SS].selector){ sp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (sp & ( sp_mask)))), (uint32_t)(env->segs[2].selector)); };
1850	PUSHL(ssp, sp, sp_mask, env->regs[R_ESP]){ sp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (sp & ( sp_mask)))), (uint32_t)(env->regs[4])); };
1851	for (i = param_count - 1; i >= 0; i--) {
1852	val = cpu_ldl_kernel(env, old_ssp +
1853	((env->regs[R_ESP4] + i * 4) &
1854	old_sp_mask));
1855	PUSHL(ssp, sp, sp_mask, val){ sp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (sp & ( sp_mask)))), (uint32_t)(val)); };
1856	}
1857	} else {
1858	PUSHW(ssp, sp, sp_mask, env->segs[R_SS].selector){ sp -= 2; cpu_stw_kernel(env, (ssp) + (sp & (sp_mask)), ( env->segs[2].selector)); };
1859	PUSHW(ssp, sp, sp_mask, env->regs[R_ESP]){ sp -= 2; cpu_stw_kernel(env, (ssp) + (sp & (sp_mask)), ( env->regs[4])); };
1860	for (i = param_count - 1; i >= 0; i--) {
1861	val = cpu_lduw_kernel(env, old_ssp +
1862	((env->regs[R_ESP4] + i * 2) &
1863	old_sp_mask));
1864	PUSHW(ssp, sp, sp_mask, val){ sp -= 2; cpu_stw_kernel(env, (ssp) + (sp & (sp_mask)), ( val)); };
1865	}
1866	}
1867	new_stack = 1;
1868	} else {
1869	/* to same privilege */
1870	sp = env->regs[R_ESP4];
1871	sp_mask = get_sp_mask(env->segs[R_SS2].flags);
1872	ssp = env->segs[R_SS2].base;
1873	/* push_size = (4 << shift); */
1874	new_stack = 0;
1875	}
1876
1877	if (shift) {
1878	PUSHL(ssp, sp, sp_mask, env->segs[R_CS].selector){ sp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (sp & ( sp_mask)))), (uint32_t)(env->segs[1].selector)); };
1879	PUSHL(ssp, sp, sp_mask, next_eip){ sp -= 4; cpu_stl_kernel(env, ((uint32_t)((ssp) + (sp & ( sp_mask)))), (uint32_t)(next_eip)); };
1880	} else {
1881	PUSHW(ssp, sp, sp_mask, env->segs[R_CS].selector){ sp -= 2; cpu_stw_kernel(env, (ssp) + (sp & (sp_mask)), ( env->segs[1].selector)); };
1882	PUSHW(ssp, sp, sp_mask, next_eip){ sp -= 2; cpu_stw_kernel(env, (ssp) + (sp & (sp_mask)), ( next_eip)); };
1883	}
1884
1885	/* from this point, not restartable */
1886
1887	if (new_stack) {
1888	ss = (ss & ~3) \| dpl;
1889	cpu_x86_load_seg_cache(env, R_SS2, ss,
1890	ssp,
1891	get_seg_limit(ss_e1, ss_e2),
1892	ss_e2);
1893	}
1894
1895	selector = (selector & ~3) \| dpl;
1896	cpu_x86_load_seg_cache(env, R_CS1, selector,
1897	get_seg_base(e1, e2),
1898	get_seg_limit(e1, e2),
1899	e2);
1900	cpu_x86_set_cpl(env, dpl);
1901	SET_ESP(sp, sp_mask)do { if ((sp_mask) == 0xffff) { env->regs[4] = (env->regs [4] & ~0xffff) \| ((sp) & 0xffff); } else if ((sp_mask ) == 0xffffffffLL) { env->regs[4] = (uint32_t)(sp); } else { env->regs[4] = (sp); } } while (0);
1902	env->eip = offset;
1903	}
1904	}
1905
1906	/* real and vm86 mode iret */
1907	void helper_iret_real(CPUX86State *env, int shift)
1908	{
1909	uint32_t sp, new_cs, new_eip, new_eflags, sp_mask;
1910	target_ulong ssp;
1911	int eflags_mask;
1912
1913	sp_mask = 0xffff; /* XXXX: use SS segment size? */
1914	sp = env->regs[R_ESP4];
1915	ssp = env->segs[R_SS2].base;
1916	if (shift == 1) {
1917	/* 32 bits */
1918	POPL(ssp, sp, sp_mask, new_eip){ new_eip = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp) + (sp & (sp_mask))))); sp += 4; };
1919	POPL(ssp, sp, sp_mask, new_cs){ new_cs = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp) + ( sp & (sp_mask))))); sp += 4; };
1920	new_cs &= 0xffff;
1921	POPL(ssp, sp, sp_mask, new_eflags){ new_eflags = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp ) + (sp & (sp_mask))))); sp += 4; };
1922	} else {
1923	/* 16 bits */
1924	POPW(ssp, sp, sp_mask, new_eip){ new_eip = cpu_lduw_kernel(env, (ssp) + (sp & (sp_mask)) ); sp += 2; };
1925	POPW(ssp, sp, sp_mask, new_cs){ new_cs = cpu_lduw_kernel(env, (ssp) + (sp & (sp_mask))) ; sp += 2; };
1926	POPW(ssp, sp, sp_mask, new_eflags){ new_eflags = cpu_lduw_kernel(env, (ssp) + (sp & (sp_mask ))); sp += 2; };
1927	}
1928	env->regs[R_ESP4] = (env->regs[R_ESP4] & ~sp_mask) \| (sp & sp_mask);
1929	env->segs[R_CS1].selector = new_cs;
1930	env->segs[R_CS1].base = (new_cs << 4);
1931	env->eip = new_eip;
1932	if (env->eflags & VM_MASK0x00020000) {
1933	eflags_mask = TF_MASK0x00000100 \| AC_MASK0x00040000 \| ID_MASK0x00200000 \| IF_MASK0x00000200 \| RF_MASK0x00010000 \|
1934	NT_MASK0x00004000;
1935	} else {
1936	eflags_mask = TF_MASK0x00000100 \| AC_MASK0x00040000 \| ID_MASK0x00200000 \| IF_MASK0x00000200 \| IOPL_MASK0x00003000 \|
1937	RF_MASK0x00010000 \| NT_MASK0x00004000;
1938	}
1939	if (shift == 0) {
1940	eflags_mask &= 0xffff;
1941	}
1942	cpu_load_eflags(env, new_eflags, eflags_mask);
1943	env->hflags2 &= ~HF2_NMI_MASK(1 << 2);
1944	}
1945
1946	static inline void validate_seg(CPUX86State *env, int seg_reg, int cpl)
1947	{
1948	int dpl;
1949	uint32_t e2;
1950
1951	/* XXX: on x86_64, we do not want to nullify FS and GS because
1952	they may still contain a valid base. I would be interested to
1953	know how a real x86_64 CPU behaves */
1954	if ((seg_reg == R_FS4 \|\| seg_reg == R_GS5) &&
1955	(env->segs[seg_reg].selector & 0xfffc) == 0) {
1956	return;
1957	}
1958
1959	e2 = env->segs[seg_reg].flags;
1960	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
1961	if (!(e2 & DESC_CS_MASK(1 << 11)) \|\| !(e2 & DESC_C_MASK(1 << 10))) {
1962	/* data or non conforming code segment */
1963	if (dpl < cpl) {
1964	cpu_x86_load_seg_cache(env, seg_reg, 0, 0, 0, 0);
1965	}
1966	}
1967	}
1968
1969	/* protected mode iret */
1970	static inline void helper_ret_protected(CPUX86State *env, int shift,
1971	int is_iret, int addend)
1972	{
1973	uint32_t new_cs, new_eflags, new_ss;
1974	uint32_t new_es, new_ds, new_fs, new_gs;
1975	uint32_t e1, e2, ss_e1, ss_e2;
1976	int cpl, dpl, rpl, eflags_mask, iopl;
1977	target_ulong ssp, sp, new_eip, new_esp, sp_mask;
1978
1979	#ifdef TARGET_X86_641
1980	if (shift == 2) {
1981	sp_mask = -1;
1982	} else
1983	#endif
1984	{
1985	sp_mask = get_sp_mask(env->segs[R_SS2].flags);
1986	}
1987	sp = env->regs[R_ESP4];
1988	ssp = env->segs[R_SS2].base;
1989	new_eflags = 0; /* avoid warning */
1990	#ifdef TARGET_X86_641
1991	if (shift == 2) {
1992	POPQ(sp, new_eip){ new_eip = cpu_ldq_kernel(env, sp); sp += 8; };
1993	POPQ(sp, new_cs){ new_cs = cpu_ldq_kernel(env, sp); sp += 8; };
1994	new_cs &= 0xffff;
1995	if (is_iret) {
1996	POPQ(sp, new_eflags){ new_eflags = cpu_ldq_kernel(env, sp); sp += 8; };
1997	}
1998	} else
1999	#endif
2000	{
2001	if (shift == 1) {
2002	/* 32 bits */
2003	POPL(ssp, sp, sp_mask, new_eip){ new_eip = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp) + (sp & (sp_mask))))); sp += 4; };
2004	POPL(ssp, sp, sp_mask, new_cs){ new_cs = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp) + ( sp & (sp_mask))))); sp += 4; };
2005	new_cs &= 0xffff;
2006	if (is_iret) {
2007	POPL(ssp, sp, sp_mask, new_eflags){ new_eflags = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp ) + (sp & (sp_mask))))); sp += 4; };
2008	if (new_eflags & VM_MASK0x00020000) {
2009	goto return_to_vm86;
2010	}
2011	}
2012	} else {
2013	/* 16 bits */
2014	POPW(ssp, sp, sp_mask, new_eip){ new_eip = cpu_lduw_kernel(env, (ssp) + (sp & (sp_mask)) ); sp += 2; };
2015	POPW(ssp, sp, sp_mask, new_cs){ new_cs = cpu_lduw_kernel(env, (ssp) + (sp & (sp_mask))) ; sp += 2; };
2016	if (is_iret) {
2017	POPW(ssp, sp, sp_mask, new_eflags){ new_eflags = cpu_lduw_kernel(env, (ssp) + (sp & (sp_mask ))); sp += 2; };
2018	}
2019	}
2020	}
2021	LOG_PCALL("lret new %04x:" TARGET_FMT_lx " s=%d addend=0x%x\n",do { } while (0)
2022	new_cs, new_eip, shift, addend)do { } while (0);
2023	LOG_PCALL_STATE(CPU(x86_env_get_cpu(env)))do { } while (0);
2024	if ((new_cs & 0xfffc) == 0) {
2025	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
2026	}
2027	if (load_segment(env, &e1, &e2, new_cs) != 0) {
2028	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
2029	}
2030	if (!(e2 & DESC_S_MASK(1 << 12)) \|\|
2031	!(e2 & DESC_CS_MASK(1 << 11))) {
2032	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
2033	}
2034	cpl = env->hflags & HF_CPL_MASK(3 << 0);
2035	rpl = new_cs & 3;
2036	if (rpl < cpl) {
2037	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
2038	}
2039	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
2040	if (e2 & DESC_C_MASK(1 << 10)) {
2041	if (dpl > rpl) {
2042	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
2043	}
2044	} else {
2045	if (dpl != rpl) {
2046	raise_exception_err(env, EXCP0D_GPF13, new_cs & 0xfffc);
2047	}
2048	}
2049	if (!(e2 & DESC_P_MASK(1 << 15))) {
2050	raise_exception_err(env, EXCP0B_NOSEG11, new_cs & 0xfffc);
2051	}
2052
2053	sp += addend;
2054	if (rpl == cpl && (!(env->hflags & HF_CS64_MASK(1 << 15)) \|\|
2055	((env->hflags & HF_CS64_MASK(1 << 15)) && !is_iret))) {
2056	/* return to same privilege level */
2057	cpu_x86_load_seg_cache(env, R_CS1, new_cs,
2058	get_seg_base(e1, e2),
2059	get_seg_limit(e1, e2),
2060	e2);
2061	} else {
2062	/* return to different privilege level */
2063	#ifdef TARGET_X86_641
2064	if (shift == 2) {
2065	POPQ(sp, new_esp){ new_esp = cpu_ldq_kernel(env, sp); sp += 8; };
2066	POPQ(sp, new_ss){ new_ss = cpu_ldq_kernel(env, sp); sp += 8; };
2067	new_ss &= 0xffff;
2068	} else
2069	#endif
2070	{
2071	if (shift == 1) {
2072	/* 32 bits */
2073	POPL(ssp, sp, sp_mask, new_esp){ new_esp = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp) + (sp & (sp_mask))))); sp += 4; };
2074	POPL(ssp, sp, sp_mask, new_ss){ new_ss = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp) + ( sp & (sp_mask))))); sp += 4; };
2075	new_ss &= 0xffff;
2076	} else {
2077	/* 16 bits */
2078	POPW(ssp, sp, sp_mask, new_esp){ new_esp = cpu_lduw_kernel(env, (ssp) + (sp & (sp_mask)) ); sp += 2; };
2079	POPW(ssp, sp, sp_mask, new_ss){ new_ss = cpu_lduw_kernel(env, (ssp) + (sp & (sp_mask))) ; sp += 2; };
2080	}
2081	}
2082	LOG_PCALL("new ss:esp=%04x:" TARGET_FMT_lx "\n",do { } while (0)
2083	new_ss, new_esp)do { } while (0);
2084	if ((new_ss & 0xfffc) == 0) {
2085	#ifdef TARGET_X86_641
2086	/* NULL ss is allowed in long mode if cpl != 3 */
2087	/* XXX: test CS64? */
2088	if ((env->hflags & HF_LMA_MASK(1 << 14)) && rpl != 3) {
2089	cpu_x86_load_seg_cache(env, R_SS2, new_ss,
2090	0, 0xffffffff,
2091	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
2092	DESC_S_MASK(1 << 12) \| (rpl << DESC_DPL_SHIFT13) \|
2093	DESC_W_MASK(1 << 9) \| DESC_A_MASK(1 << 8));
2094	ss_e2 = DESC_B_MASK(1 << 22); /* XXX: should not be needed? */
2095	} else
2096	#endif
2097	{
2098	raise_exception_err(env, EXCP0D_GPF13, 0);
2099	}
2100	} else {
2101	if ((new_ss & 3) != rpl) {
2102	raise_exception_err(env, EXCP0D_GPF13, new_ss & 0xfffc);
2103	}
2104	if (load_segment(env, &ss_e1, &ss_e2, new_ss) != 0) {
2105	raise_exception_err(env, EXCP0D_GPF13, new_ss & 0xfffc);
2106	}
2107	if (!(ss_e2 & DESC_S_MASK(1 << 12)) \|\|
2108	(ss_e2 & DESC_CS_MASK(1 << 11)) \|\|
2109	!(ss_e2 & DESC_W_MASK(1 << 9))) {
2110	raise_exception_err(env, EXCP0D_GPF13, new_ss & 0xfffc);
2111	}
2112	dpl = (ss_e2 >> DESC_DPL_SHIFT13) & 3;
2113	if (dpl != rpl) {
2114	raise_exception_err(env, EXCP0D_GPF13, new_ss & 0xfffc);
2115	}
2116	if (!(ss_e2 & DESC_P_MASK(1 << 15))) {
2117	raise_exception_err(env, EXCP0B_NOSEG11, new_ss & 0xfffc);
2118	}
2119	cpu_x86_load_seg_cache(env, R_SS2, new_ss,
2120	get_seg_base(ss_e1, ss_e2),
2121	get_seg_limit(ss_e1, ss_e2),
2122	ss_e2);
2123	}
2124
2125	cpu_x86_load_seg_cache(env, R_CS1, new_cs,
2126	get_seg_base(e1, e2),
2127	get_seg_limit(e1, e2),
2128	e2);
2129	cpu_x86_set_cpl(env, rpl);
2130	sp = new_esp;
2131	#ifdef TARGET_X86_641
2132	if (env->hflags & HF_CS64_MASK(1 << 15)) {
2133	sp_mask = -1;
2134	} else
2135	#endif
2136	{
2137	sp_mask = get_sp_mask(ss_e2);
2138	}
2139
2140	/* validate data segments */
2141	validate_seg(env, R_ES0, rpl);
2142	validate_seg(env, R_DS3, rpl);
2143	validate_seg(env, R_FS4, rpl);
2144	validate_seg(env, R_GS5, rpl);
2145
2146	sp += addend;
2147	}
2148	SET_ESP(sp, sp_mask)do { if ((sp_mask) == 0xffff) { env->regs[4] = (env->regs [4] & ~0xffff) \| ((sp) & 0xffff); } else if ((sp_mask ) == 0xffffffffLL) { env->regs[4] = (uint32_t)(sp); } else { env->regs[4] = (sp); } } while (0);
2149	env->eip = new_eip;
2150	if (is_iret) {
2151	/* NOTE: 'cpl' is the _old_ CPL */
2152	eflags_mask = TF_MASK0x00000100 \| AC_MASK0x00040000 \| ID_MASK0x00200000 \| RF_MASK0x00010000 \| NT_MASK0x00004000;
2153	if (cpl == 0) {
2154	eflags_mask \|= IOPL_MASK0x00003000;
2155	}
2156	iopl = (env->eflags >> IOPL_SHIFT12) & 3;
2157	if (cpl <= iopl) {
2158	eflags_mask \|= IF_MASK0x00000200;
2159	}
2160	if (shift == 0) {
2161	eflags_mask &= 0xffff;
2162	}
2163	cpu_load_eflags(env, new_eflags, eflags_mask);
2164	}
2165	return;
2166
2167	return_to_vm86:
2168	POPL(ssp, sp, sp_mask, new_esp){ new_esp = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp) + (sp & (sp_mask))))); sp += 4; };
2169	POPL(ssp, sp, sp_mask, new_ss){ new_ss = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp) + ( sp & (sp_mask))))); sp += 4; };
2170	POPL(ssp, sp, sp_mask, new_es){ new_es = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp) + ( sp & (sp_mask))))); sp += 4; };
2171	POPL(ssp, sp, sp_mask, new_ds){ new_ds = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp) + ( sp & (sp_mask))))); sp += 4; };
2172	POPL(ssp, sp, sp_mask, new_fs){ new_fs = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp) + ( sp & (sp_mask))))); sp += 4; };
2173	POPL(ssp, sp, sp_mask, new_gs){ new_gs = (uint32_t)cpu_ldl_kernel(env, ((uint32_t)((ssp) + ( sp & (sp_mask))))); sp += 4; };
2174
2175	/* modify processor state */
2176	cpu_load_eflags(env, new_eflags, TF_MASK0x00000100 \| AC_MASK0x00040000 \| ID_MASK0x00200000 \|
2177	IF_MASK0x00000200 \| IOPL_MASK0x00003000 \| VM_MASK0x00020000 \| NT_MASK0x00004000 \| VIF_MASK0x00080000 \|
2178	VIP_MASK0x00100000);
2179	load_seg_vm(env, R_CS1, new_cs & 0xffff);
2180	cpu_x86_set_cpl(env, 3);
2181	load_seg_vm(env, R_SS2, new_ss & 0xffff);
2182	load_seg_vm(env, R_ES0, new_es & 0xffff);
2183	load_seg_vm(env, R_DS3, new_ds & 0xffff);
2184	load_seg_vm(env, R_FS4, new_fs & 0xffff);
2185	load_seg_vm(env, R_GS5, new_gs & 0xffff);
2186
2187	env->eip = new_eip & 0xffff;
2188	env->regs[R_ESP4] = new_esp;
2189	}
2190
2191	void helper_iret_protected(CPUX86State *env, int shift, int next_eip)
2192	{
2193	int tss_selector, type;
2194	uint32_t e1, e2;
2195
2196	/* specific case for TSS */
2197	if (env->eflags & NT_MASK0x00004000) {
2198	#ifdef TARGET_X86_641
2199	if (env->hflags & HF_LMA_MASK(1 << 14)) {
2200	raise_exception_err(env, EXCP0D_GPF13, 0);
2201	}
2202	#endif
2203	tss_selector = cpu_lduw_kernel(env, env->tr.base + 0);
2204	if (tss_selector & 4) {
2205	raise_exception_err(env, EXCP0A_TSS10, tss_selector & 0xfffc);
2206	}
2207	if (load_segment(env, &e1, &e2, tss_selector) != 0) {
2208	raise_exception_err(env, EXCP0A_TSS10, tss_selector & 0xfffc);
2209	}
2210	type = (e2 >> DESC_TYPE_SHIFT8) & 0x17;
2211	/* NOTE: we check both segment and busy TSS */
2212	if (type != 3) {
2213	raise_exception_err(env, EXCP0A_TSS10, tss_selector & 0xfffc);
2214	}
2215	switch_tss(env, tss_selector, e1, e2, SWITCH_TSS_IRET1, next_eip);
2216	} else {
2217	helper_ret_protected(env, shift, 1, 0);
2218	}
2219	env->hflags2 &= ~HF2_NMI_MASK(1 << 2);
2220	}
2221
2222	void helper_lret_protected(CPUX86State *env, int shift, int addend)
2223	{
2224	helper_ret_protected(env, shift, 0, addend);
2225	}
2226
2227	void helper_sysenter(CPUX86State *env)
2228	{
2229	if (env->sysenter_cs == 0) {
2230	raise_exception_err(env, EXCP0D_GPF13, 0);
2231	}
2232	env->eflags &= ~(VM_MASK0x00020000 \| IF_MASK0x00000200 \| RF_MASK0x00010000);
2233	cpu_x86_set_cpl(env, 0);
2234
2235	#ifdef TARGET_X86_641
2236	if (env->hflags & HF_LMA_MASK(1 << 14)) {
2237	cpu_x86_load_seg_cache(env, R_CS1, env->sysenter_cs & 0xfffc,
2238	0, 0xffffffff,
2239	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
2240	DESC_S_MASK(1 << 12) \|
2241	DESC_CS_MASK(1 << 11) \| DESC_R_MASK(1 << 9) \| DESC_A_MASK(1 << 8) \|
2242	DESC_L_MASK(1 << 21));
2243	} else
2244	#endif
2245	{
2246	cpu_x86_load_seg_cache(env, R_CS1, env->sysenter_cs & 0xfffc,
2247	0, 0xffffffff,
2248	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
2249	DESC_S_MASK(1 << 12) \|
2250	DESC_CS_MASK(1 << 11) \| DESC_R_MASK(1 << 9) \| DESC_A_MASK(1 << 8));
2251	}
2252	cpu_x86_load_seg_cache(env, R_SS2, (env->sysenter_cs + 8) & 0xfffc,
2253	0, 0xffffffff,
2254	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
2255	DESC_S_MASK(1 << 12) \|
2256	DESC_W_MASK(1 << 9) \| DESC_A_MASK(1 << 8));
2257	env->regs[R_ESP4] = env->sysenter_esp;
2258	env->eip = env->sysenter_eip;
2259	}
2260
2261	void helper_sysexit(CPUX86State *env, int dflag)
2262	{
2263	int cpl;
2264
2265	cpl = env->hflags & HF_CPL_MASK(3 << 0);
2266	if (env->sysenter_cs == 0 \|\| cpl != 0) {
2267	raise_exception_err(env, EXCP0D_GPF13, 0);
2268	}
2269	cpu_x86_set_cpl(env, 3);
2270	#ifdef TARGET_X86_641
2271	if (dflag == 2) {
2272	cpu_x86_load_seg_cache(env, R_CS1, ((env->sysenter_cs + 32) & 0xfffc) \|
2273	3, 0, 0xffffffff,
2274	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
2275	DESC_S_MASK(1 << 12) \| (3 << DESC_DPL_SHIFT13) \|
2276	DESC_CS_MASK(1 << 11) \| DESC_R_MASK(1 << 9) \| DESC_A_MASK(1 << 8) \|
2277	DESC_L_MASK(1 << 21));
2278	cpu_x86_load_seg_cache(env, R_SS2, ((env->sysenter_cs + 40) & 0xfffc) \|
2279	3, 0, 0xffffffff,
2280	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
2281	DESC_S_MASK(1 << 12) \| (3 << DESC_DPL_SHIFT13) \|
2282	DESC_W_MASK(1 << 9) \| DESC_A_MASK(1 << 8));
2283	} else
2284	#endif
2285	{
2286	cpu_x86_load_seg_cache(env, R_CS1, ((env->sysenter_cs + 16) & 0xfffc) \|
2287	3, 0, 0xffffffff,
2288	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
2289	DESC_S_MASK(1 << 12) \| (3 << DESC_DPL_SHIFT13) \|
2290	DESC_CS_MASK(1 << 11) \| DESC_R_MASK(1 << 9) \| DESC_A_MASK(1 << 8));
2291	cpu_x86_load_seg_cache(env, R_SS2, ((env->sysenter_cs + 24) & 0xfffc) \|
2292	3, 0, 0xffffffff,
2293	DESC_G_MASK(1 << 23) \| DESC_B_MASK(1 << 22) \| DESC_P_MASK(1 << 15) \|
2294	DESC_S_MASK(1 << 12) \| (3 << DESC_DPL_SHIFT13) \|
2295	DESC_W_MASK(1 << 9) \| DESC_A_MASK(1 << 8));
2296	}
2297	env->regs[R_ESP4] = env->regs[R_ECX1];
2298	env->eip = env->regs[R_EDX2];
2299	}
2300
2301	target_ulong helper_lsl(CPUX86State *env, target_ulong selector1)
2302	{
2303	unsigned int limit;
2304	uint32_t e1, e2, eflags, selector;
2305	int rpl, dpl, cpl, type;
2306
2307	selector = selector1 & 0xffff;
2308	eflags = cpu_cc_compute_all(env, CC_OP(env->cc_op));
2309	if ((selector & 0xfffc) == 0) {
2310	goto fail;
2311	}
2312	if (load_segment(env, &e1, &e2, selector) != 0) {
2313	goto fail;
2314	}
2315	rpl = selector & 3;
2316	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
2317	cpl = env->hflags & HF_CPL_MASK(3 << 0);
2318	if (e2 & DESC_S_MASK(1 << 12)) {
2319	if ((e2 & DESC_CS_MASK(1 << 11)) && (e2 & DESC_C_MASK(1 << 10))) {
2320	/* conforming */
2321	} else {
2322	if (dpl < cpl \|\| dpl < rpl) {
2323	goto fail;
2324	}
2325	}
2326	} else {
2327	type = (e2 >> DESC_TYPE_SHIFT8) & 0xf;
2328	switch (type) {
2329	case 1:
2330	case 2:
2331	case 3:
2332	case 9:
2333	case 11:
2334	break;
2335	default:
2336	goto fail;
2337	}
2338	if (dpl < cpl \|\| dpl < rpl) {
2339	fail:
2340	CC_SRC(env->cc_src) = eflags & ~CC_Z0x0040;
2341	return 0;
2342	}
2343	}
2344	limit = get_seg_limit(e1, e2);
2345	CC_SRC(env->cc_src) = eflags \| CC_Z0x0040;
2346	return limit;
2347	}
2348
2349	target_ulong helper_lar(CPUX86State *env, target_ulong selector1)
2350	{
2351	uint32_t e1, e2, eflags, selector;
2352	int rpl, dpl, cpl, type;
2353
2354	selector = selector1 & 0xffff;
2355	eflags = cpu_cc_compute_all(env, CC_OP(env->cc_op));
2356	if ((selector & 0xfffc) == 0) {
2357	goto fail;
2358	}
2359	if (load_segment(env, &e1, &e2, selector) != 0) {
2360	goto fail;
2361	}
2362	rpl = selector & 3;
2363	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
2364	cpl = env->hflags & HF_CPL_MASK(3 << 0);
2365	if (e2 & DESC_S_MASK(1 << 12)) {
2366	if ((e2 & DESC_CS_MASK(1 << 11)) && (e2 & DESC_C_MASK(1 << 10))) {
2367	/* conforming */
2368	} else {
2369	if (dpl < cpl \|\| dpl < rpl) {
2370	goto fail;
2371	}
2372	}
2373	} else {
2374	type = (e2 >> DESC_TYPE_SHIFT8) & 0xf;
2375	switch (type) {
2376	case 1:
2377	case 2:
2378	case 3:
2379	case 4:
2380	case 5:
2381	case 9:
2382	case 11:
2383	case 12:
2384	break;
2385	default:
2386	goto fail;
2387	}
2388	if (dpl < cpl \|\| dpl < rpl) {
2389	fail:
2390	CC_SRC(env->cc_src) = eflags & ~CC_Z0x0040;
2391	return 0;
2392	}
2393	}
2394	CC_SRC(env->cc_src) = eflags \| CC_Z0x0040;
2395	return e2 & 0x00f0ff00;
2396	}
2397
2398	void helper_verr(CPUX86State *env, target_ulong selector1)
2399	{
2400	uint32_t e1, e2, eflags, selector;
2401	int rpl, dpl, cpl;
2402
2403	selector = selector1 & 0xffff;
2404	eflags = cpu_cc_compute_all(env, CC_OP(env->cc_op));
2405	if ((selector & 0xfffc) == 0) {
2406	goto fail;
2407	}
2408	if (load_segment(env, &e1, &e2, selector) != 0) {
2409	goto fail;
2410	}
2411	if (!(e2 & DESC_S_MASK(1 << 12))) {
2412	goto fail;
2413	}
2414	rpl = selector & 3;
2415	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
2416	cpl = env->hflags & HF_CPL_MASK(3 << 0);
2417	if (e2 & DESC_CS_MASK(1 << 11)) {
2418	if (!(e2 & DESC_R_MASK(1 << 9))) {
2419	goto fail;
2420	}
2421	if (!(e2 & DESC_C_MASK(1 << 10))) {
2422	if (dpl < cpl \|\| dpl < rpl) {
2423	goto fail;
2424	}
2425	}
2426	} else {
2427	if (dpl < cpl \|\| dpl < rpl) {
2428	fail:
2429	CC_SRC(env->cc_src) = eflags & ~CC_Z0x0040;
2430	return;
2431	}
2432	}
2433	CC_SRC(env->cc_src) = eflags \| CC_Z0x0040;
2434	}
2435
2436	void helper_verw(CPUX86State *env, target_ulong selector1)
2437	{
2438	uint32_t e1, e2, eflags, selector;
2439	int rpl, dpl, cpl;
2440
2441	selector = selector1 & 0xffff;
2442	eflags = cpu_cc_compute_all(env, CC_OP(env->cc_op));
2443	if ((selector & 0xfffc) == 0) {
2444	goto fail;
2445	}
2446	if (load_segment(env, &e1, &e2, selector) != 0) {
2447	goto fail;
2448	}
2449	if (!(e2 & DESC_S_MASK(1 << 12))) {
2450	goto fail;
2451	}
2452	rpl = selector & 3;
2453	dpl = (e2 >> DESC_DPL_SHIFT13) & 3;
2454	cpl = env->hflags & HF_CPL_MASK(3 << 0);
2455	if (e2 & DESC_CS_MASK(1 << 11)) {
2456	goto fail;
2457	} else {
2458	if (dpl < cpl \|\| dpl < rpl) {
2459	goto fail;
2460	}
2461	if (!(e2 & DESC_W_MASK(1 << 9))) {
2462	fail:
2463	CC_SRC(env->cc_src) = eflags & ~CC_Z0x0040;
2464	return;
2465	}
2466	}
2467	CC_SRC(env->cc_src) = eflags \| CC_Z0x0040;
2468	}
2469
2470	#if defined(CONFIG_USER_ONLY)
2471	void cpu_x86_load_seg(CPUX86State *env, int seg_reg, int selector)
2472	{
2473	if (!(env->cr[0] & CR0_PE_MASK(1 << 0)) \|\| (env->eflags & VM_MASK0x00020000)) {
2474	selector &= 0xffff;
2475	cpu_x86_load_seg_cache(env, seg_reg, selector,
2476	(selector << 4), 0xffff, 0);
2477	} else {
2478	helper_load_seg(env, seg_reg, selector);
2479	}
2480	}
2481	#endif