void BX_CPU_C::iret32_stack_return_from_v86(bxInstruction_c *i) { if (BX_CPU_THIS_PTR get_IOPL() < 3) { // trap to virtual 8086 monitor BX_DEBUG(("IRET in vm86 with IOPL != 3, VME = 0")); exception(BX_GP_EXCEPTION, 0); } Bit32u eip, cs_raw, flags32; // Build a mask of the following bits: // ID,VIP,VIF,AC,VM,RF,x,NT,IOPL,OF,DF,IF,TF,SF,ZF,x,AF,x,PF,x,CF Bit32u change_mask = EFlagsOSZAPCMask | EFlagsTFMask | EFlagsIFMask | EFlagsDFMask | EFlagsNTMask | EFlagsRFMask; #if BX_CPU_LEVEL >= 4 change_mask |= (EFlagsIDMask | EFlagsACMask); // ID/AC #endif eip = pop_32(); cs_raw = pop_32(); flags32 = pop_32(); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS], (Bit16u) cs_raw); EIP = eip; // VIF, VIP, VM, IOPL unchanged writeEFlags(flags32, change_mask); }
void bx_cpu_c::RETfar32(BxInstruction_t *i) { Bit32u eip, ecs_raw; #if BX_DEBUGGER bx_cpu. show_flag |= Flag_ret; #endif invalidate_prefetch_q(); #if BX_CPU_LEVEL >= 2 if ( protected_mode() ) { bx_cpu. return_protected(i, 0); goto done; } #endif pop_32(&eip); pop_32(&ecs_raw); /* 32bit pop, MSW discarded */ bx_cpu. eip = eip; load_seg_reg(&bx_cpu. sregs[BX_SEG_REG_CS], (Bit16u) ecs_raw); done: BX_INSTR_FAR_BRANCH(BX_INSTR_IS_RET, bx_cpu. sregs[BX_SEG_REG_CS].selector.value, bx_cpu. eip); return; }
void BX_CPP_AttrRegparmN(1) BX_CPU_C::MOV_SwEw(bxInstruction_c *i) { Bit16u op2_16; /* Attempt to load CS or nonexisting segment register */ if (i->nnn() >= 6 || i->nnn() == BX_SEG_REG_CS) { BX_INFO(("MOV_EwSw: can't use this segment register %d", i->nnn())); UndefinedOpcode(i); } if (i->modC0()) { op2_16 = BX_READ_16BIT_REG(i->rm()); } else { BX_CPU_CALL_METHODR(i->ResolveModrm, (i)); /* pointer, segment address pair */ op2_16 = read_virtual_word(i->seg(), RMAddr(i)); } load_seg_reg(&BX_CPU_THIS_PTR sregs[i->nnn()], op2_16); if (i->nnn() == BX_SEG_REG_SS) { // MOV SS inhibits interrupts, debug exceptions and single-step // trap exceptions until the execution boundary following the // next instruction is reached. // Same code as POP_SS() BX_CPU_THIS_PTR inhibit_mask |= BX_INHIBIT_INTERRUPTS | BX_INHIBIT_DEBUG; BX_CPU_THIS_PTR async_event = 1; } }
void bx_cpu_c::JMP32_Ep(BxInstruction_t *i) { Bit16u cs_raw; Bit32u op1_32; /* op1_32 is a register or memory reference */ if (i->mod == 0xc0) { /* far indirect must specify a memory address */ BX_PANIC(("JMP_Ep(): op1 is a register")); } /* pointer, segment address pair */ read_virtual_dword(i->seg, i->rm_addr, &op1_32); read_virtual_word(i->seg, i->rm_addr+4, &cs_raw); invalidate_prefetch_q(); if ( protected_mode() ) { bx_cpu. jump_protected(i, cs_raw, op1_32); goto done; } bx_cpu. eip = op1_32; load_seg_reg(&bx_cpu. sregs[BX_SEG_REG_CS], cs_raw); done: BX_INSTR_FAR_BRANCH(BX_INSTR_IS_JMP, bx_cpu. sregs[BX_SEG_REG_CS].selector.value, bx_cpu. eip); return; }
void BX_CPU_C::real_mode_int(Bit8u vector, bx_bool is_INT, bx_bool is_error_code, Bit16u error_code) { // real mode interrupt Bit16u cs_selector, ip; if ((vector*4+3) > BX_CPU_THIS_PTR idtr.limit) { BX_ERROR(("interrupt(real mode) vector > idtr.limit")); exception(BX_GP_EXCEPTION, 0, 0); } push_16((Bit16u) read_eflags()); cs_selector = BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector.value; push_16(cs_selector); ip = EIP; push_16(ip); access_read_linear(BX_CPU_THIS_PTR idtr.base + 4 * vector, 2, 0, BX_READ, &ip); EIP = (Bit32u) ip; access_read_linear(BX_CPU_THIS_PTR idtr.base + 4 * vector + 2, 2, 0, BX_READ, &cs_selector); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS], cs_selector); /* INT affects the following flags: I,T */ BX_CPU_THIS_PTR clear_IF(); BX_CPU_THIS_PTR clear_TF(); #if BX_CPU_LEVEL >= 4 BX_CPU_THIS_PTR clear_AC(); #endif BX_CPU_THIS_PTR clear_RF(); }
void bx_cpu_c::JMP_Ap(BxInstruction_t *i) { Bit32u disp32; Bit16u cs_raw; invalidate_prefetch_q(); if (i->os_32) { disp32 = i->Id; } else { disp32 = i->Iw; } cs_raw = i->Iw2; #if BX_CPU_LEVEL >= 2 if (protected_mode()) { bx_cpu. jump_protected(i, cs_raw, disp32); goto done; } #endif load_seg_reg(&bx_cpu. sregs[BX_SEG_REG_CS], cs_raw); bx_cpu. eip = disp32; done: BX_INSTR_FAR_BRANCH(BX_INSTR_IS_JMP, bx_cpu. sregs[BX_SEG_REG_CS].selector.value, bx_cpu. eip); return; }
void BX_CPU_C::real_mode_int(Bit8u vector, bx_bool push_error, Bit16u error_code) { if ((vector*4+3) > BX_CPU_THIS_PTR idtr.limit) { BX_ERROR(("interrupt(real mode) vector > idtr.limit")); exception(BX_GP_EXCEPTION, 0); } push_16((Bit16u) read_eflags()); push_16(BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector.value); push_16(IP); Bit16u new_ip = system_read_word(BX_CPU_THIS_PTR idtr.base + 4 * vector); // CS.LIMIT can't change when in real/v8086 mode if (new_ip > BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.u.segment.limit_scaled) { BX_ERROR(("interrupt(real mode): instruction pointer not within code segment limits")); exception(BX_GP_EXCEPTION, 0); } Bit16u cs_selector = system_read_word(BX_CPU_THIS_PTR idtr.base + 4 * vector + 2); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS], cs_selector); EIP = new_ip; /* INT affects the following flags: I,T */ BX_CPU_THIS_PTR clear_IF(); BX_CPU_THIS_PTR clear_TF(); #if BX_CPU_LEVEL >= 4 BX_CPU_THIS_PTR clear_AC(); #endif BX_CPU_THIS_PTR clear_RF(); }
void bx_cpu_c::CALL32_Ap(BxInstruction_t *i) { Bit16u cs_raw; Bit32u disp32; #if BX_DEBUGGER bx_cpu. show_flag |= Flag_call; #endif disp32 = i->Id; cs_raw = i->Iw2; invalidate_prefetch_q(); if (protected_mode()) { bx_cpu. call_protected(i, cs_raw, disp32); goto done; } push_32(bx_cpu. sregs[BX_SEG_REG_CS].selector.value); push_32(bx_cpu. eip); bx_cpu. eip = disp32; load_seg_reg(&bx_cpu. sregs[BX_SEG_REG_CS], cs_raw); done: BX_INSTR_FAR_BRANCH(BX_INSTR_IS_CALL, bx_cpu. sregs[BX_SEG_REG_CS].selector.value, bx_cpu. eip); return; }
BX_INSF_TYPE BX_CPP_AttrRegparmN(1) BX_CPU_C::POP64_GS(bxInstruction_c *i) { Bit64u gs = read_virtual_word_64(BX_SEG_REG_SS, RSP); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS], (Bit16u) gs); RSP += 8; BX_NEXT_INSTR(i); }
void BX_CPP_AttrRegparmN(1) BX_CPU_C::POP32_DS(bxInstruction_c *i) { BX_CPU_THIS_PTR speculative_rsp = 1; BX_CPU_THIS_PTR prev_rsp = RSP; Bit32u ds = pop_32(); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS], (Bit16u) ds); BX_CPU_THIS_PTR speculative_rsp = 0; }
int BX_CPU_C::v86_redirect_interrupt(Bit8u vector) { #if BX_CPU_LEVEL >= 5 if (BX_CPU_THIS_PTR cr4.get_VME()) { bx_address tr_base = BX_CPU_THIS_PTR tr.cache.u.segment.base; if (BX_CPU_THIS_PTR tr.cache.u.segment.limit_scaled < 103) { BX_ERROR(("INT_Ib(): TR.limit < 103 in VME")); exception(BX_GP_EXCEPTION, 0); } Bit32u io_base = system_read_word(tr_base + 102), offset = io_base - 32 + (vector >> 3); if (offset > BX_CPU_THIS_PTR tr.cache.u.segment.limit_scaled) { BX_ERROR(("INT_Ib(): failed to fetch VME redirection bitmap")); exception(BX_GP_EXCEPTION, 0); } Bit8u vme_redirection_bitmap = system_read_byte(tr_base + offset); if (!(vme_redirection_bitmap & (1 << (vector & 7)))) { // redirect interrupt through virtual-mode idt Bit16u temp_flags = (Bit16u) read_eflags(); Bit16u temp_CS = system_read_word(vector*4 + 2); Bit16u temp_IP = system_read_word(vector*4); if (BX_CPU_THIS_PTR get_IOPL() < 3) { temp_flags |= EFlagsIOPLMask; if (BX_CPU_THIS_PTR get_VIF()) temp_flags |= EFlagsIFMask; else temp_flags &= ~EFlagsIFMask; } Bit16u old_IP = IP; Bit16u old_CS = BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector.value; push_16(temp_flags); // push return address onto new stack push_16(old_CS); push_16(old_IP); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS], (Bit16u) temp_CS); EIP = temp_IP; BX_CPU_THIS_PTR clear_TF(); BX_CPU_THIS_PTR clear_RF(); if (BX_CPU_THIS_PTR get_IOPL() == 3) BX_CPU_THIS_PTR clear_IF(); else BX_CPU_THIS_PTR clear_VIF(); return 1; } }
void BX_CPU_C::iret16_stack_return_from_v86(bxInstruction_c *i) { if ((BX_CPU_THIS_PTR get_IOPL() < 3) && (BX_CR4_VME_ENABLED == 0)) { // trap to virtual 8086 monitor BX_DEBUG(("IRET in vm86 with IOPL != 3, VME = 0")); exception(BX_GP_EXCEPTION, 0); } Bit16u ip, cs_raw, flags16; ip = pop_16(); cs_raw = pop_16(); flags16 = pop_16(); #if BX_CPU_LEVEL >= 5 if (BX_CPU_THIS_PTR cr4.get_VME() && BX_CPU_THIS_PTR get_IOPL() < 3) { if (((flags16 & EFlagsIFMask) && BX_CPU_THIS_PTR get_VIP()) || (flags16 & EFlagsTFMask)) { BX_DEBUG(("iret16_stack_return_from_v86(): #GP(0) in VME mode")); exception(BX_GP_EXCEPTION, 0); } load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS], cs_raw); EIP = (Bit32u) ip; // IF, IOPL unchanged, EFLAGS.VIF = TMP_FLAGS.IF Bit32u changeMask = EFlagsOSZAPCMask | EFlagsTFMask | EFlagsDFMask | EFlagsNTMask | EFlagsVIFMask; Bit32u flags32 = (Bit32u) flags16; if (flags16 & EFlagsIFMask) flags32 |= EFlagsVIFMask; writeEFlags(flags32, changeMask); return; } #endif load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS], cs_raw); EIP = (Bit32u) ip; write_flags(flags16, /*IOPL*/ 0, /*IF*/ 1); }
BX_INSF_TYPE BX_CPP_AttrRegparmN(1) BX_CPU_C::LGS_GdMp(bxInstruction_c *i) { bx_address eaddr = BX_CPU_CALL_METHODR(i->ResolveModrm, (i)); Bit16u gs = read_virtual_word(i->seg(), (eaddr + 4) & i->asize_mask()); Bit32u reg_32 = read_virtual_dword(i->seg(), eaddr); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS], gs); BX_WRITE_32BIT_REGZ(i->nnn(), reg_32); BX_NEXT_INSTR(i); }
BX_INSF_TYPE BX_CPP_AttrRegparmN(1) BX_CPU_C::LSS_GqMp(bxInstruction_c *i) { bx_address eaddr = BX_CPU_CALL_METHODR(i->ResolveModrm, (i)); Bit16u ss = read_virtual_word_64(i->seg(), (eaddr + 8) & i->asize_mask()); Bit64u reg_64 = read_virtual_qword_64(i->seg(), eaddr); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS], ss); BX_WRITE_64BIT_REG(i->nnn(), reg_64); BX_NEXT_INSTR(i); }
BX_INSF_TYPE BX_CPP_AttrRegparmN(1) BX_CPU_C::LFS_GwMp(bxInstruction_c *i) { bx_address eaddr = BX_CPU_CALL_METHODR(i->ResolveModrm, (i)); Bit16u reg_16 = read_virtual_word(i->seg(), eaddr); Bit16u fs = read_virtual_word(i->seg(), (eaddr + 2) & i->asize_mask()); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS], fs); BX_WRITE_16BIT_REG(i->nnn(), reg_16); BX_NEXT_INSTR(i); }
// LES/LDS can't be called from long64 mode BX_INSF_TYPE BX_CPP_AttrRegparmN(1) BX_CPU_C::LDS_GdMp(bxInstruction_c *i) { BX_ASSERT(BX_CPU_THIS_PTR cpu_mode != BX_MODE_LONG_64); Bit32u eaddr = (Bit32u) BX_CPU_CALL_METHODR(i->ResolveModrm, (i)); Bit16u ds = read_virtual_word_32(i->seg(), (eaddr + 4) & i->asize_mask()); Bit32u reg_32 = read_virtual_dword_32(i->seg(), eaddr); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS], ds); BX_WRITE_32BIT_REGZ(i->nnn(), reg_32); BX_NEXT_INSTR(i); }
void BX_CPU_C::LDS_GwMp(bxInstruction_c *i) { if (i->modC0()) { BX_DEBUG(("LDS_GwMp: invalid use of LDS, must be memory reference!")); UndefinedOpcode(i); } Bit16u reg_16, ds; read_virtual_word(i->seg(), RMAddr(i), ®_16); read_virtual_word(i->seg(), RMAddr(i) + 2, &ds); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS], ds); BX_WRITE_16BIT_REG(i->nnn(), reg_16); }
void BX_CPU_C::LES_GdMp(bxInstruction_c *i) { if (i->modC0()) { BX_DEBUG(("LES_GdMp: invalid use of LES, must be memory reference!")); UndefinedOpcode(i); } Bit16u es; Bit32u reg_32; read_virtual_dword(i->seg(), RMAddr(i), ®_32); read_virtual_word(i->seg(), RMAddr(i) + 4, &es); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES], es); BX_WRITE_32BIT_REGZ(i->nnn(), reg_32); }
void BX_CPU_C::LSS_GqMp(bxInstruction_c *i) { if (i->modC0()) { BX_DEBUG(("LSS_GqMp: invalid use of LSS, must be memory reference!")); UndefinedOpcode(i); } Bit64u reg_64; Bit16u ss; read_virtual_qword(i->seg(), RMAddr(i), ®_64); read_virtual_word(i->seg(), RMAddr(i) + 8, &ss); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS], ss); BX_WRITE_64BIT_REG(i->nnn(), reg_64); }
void BX_CPP_AttrRegparmN(1) BX_CPU_C::POP32_SS(bxInstruction_c *i) { BX_CPU_THIS_PTR speculative_rsp = 1; BX_CPU_THIS_PTR prev_rsp = RSP; Bit32u ss = pop_32(); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS], (Bit16u) ss); BX_CPU_THIS_PTR speculative_rsp = 0; // POP SS inhibits interrupts, debug exceptions and single-step // trap exceptions until the execution boundary following the // next instruction is reached. // Same code as MOV_SwEw() BX_CPU_THIS_PTR inhibit_mask |= BX_INHIBIT_INTERRUPTS | BX_INHIBIT_DEBUG; BX_CPU_THIS_PTR async_event = 1; }
void bx_cpu_c::IRET32(BxInstruction_t *i) { Bit32u eip, ecs_raw, eflags; #if BX_DEBUGGER bx_cpu. show_flag |= Flag_iret; bx_cpu. show_eip = bx_cpu. eip; #endif invalidate_prefetch_q(); if (v8086_mode()) { // IOPL check in stack_return_from_v86() stack_return_from_v86(i); goto done; } #if BX_CPU_LEVEL >= 2 if (bx_cpu. cr0.pe) { iret_protected(i); goto done; } #endif BX_ERROR(("IRET32 called when you're not in vm8086 mode or protected mode.")); BX_ERROR(("IRET32 may not be implemented right, since it doesn't check anything.")); BX_PANIC(("Please report that you have found a test case for bx_cpu_c::IRET32.")); pop_32(&eip); pop_32(&ecs_raw); pop_32(&eflags); load_seg_reg(&bx_cpu. sregs[BX_SEG_REG_CS], (Bit16u) ecs_raw); bx_cpu. eip = eip; //FIXME: this should do (eflags & 0x257FD5) | (EFLAGS | 0x1A0000) write_eflags(eflags, /* change IOPL? */ 1, /* change IF? */ 1, 0, 1); done: BX_INSTR_FAR_BRANCH(BX_INSTR_IS_IRET, bx_cpu. sregs[BX_SEG_REG_CS].selector.value, bx_cpu. eip); return; }
void bx_cpu_c::RETfar32_Iw(BxInstruction_t *i) { Bit32u eip, ecs_raw; Bit16s imm16; #if BX_DEBUGGER bx_cpu. show_flag |= Flag_ret; #endif /* ??? is imm16, number of bytes/words depending on operandsize ? */ imm16 = i->Iw; invalidate_prefetch_q(); #if BX_CPU_LEVEL >= 2 if (protected_mode()) { bx_cpu. return_protected(i, imm16); goto done; } #endif pop_32(&eip); pop_32(&ecs_raw); bx_cpu. eip = eip; load_seg_reg(&bx_cpu. sregs[BX_SEG_REG_CS], (Bit16u) ecs_raw); if (bx_cpu. sregs[BX_SEG_REG_SS].cache.u.segment.d_b) ESP += imm16; else SP += imm16; done: BX_INSTR_FAR_BRANCH(BX_INSTR_IS_RET, bx_cpu. sregs[BX_SEG_REG_CS].selector.value, bx_cpu. eip); return; }
void bx_cpu_c::CALL32_Ep(BxInstruction_t *i) { Bit16u cs_raw; Bit32u op1_32; #if BX_DEBUGGER bx_cpu. show_flag |= Flag_call; #endif /* op1_32 is a register or memory reference */ if (i->mod == 0xc0) { BX_PANIC(("CALL_Ep: op1 is a register")); } /* pointer, segment address pair */ read_virtual_dword(i->seg, i->rm_addr, &op1_32); read_virtual_word(i->seg, i->rm_addr+4, &cs_raw); invalidate_prefetch_q(); if ( protected_mode() ) { bx_cpu. call_protected(i, cs_raw, op1_32); goto done; } push_32(bx_cpu. sregs[BX_SEG_REG_CS].selector.value); push_32(bx_cpu. eip); bx_cpu. eip = op1_32; load_seg_reg(&bx_cpu. sregs[BX_SEG_REG_CS], cs_raw); done: BX_INSTR_FAR_BRANCH(BX_INSTR_IS_CALL, bx_cpu. sregs[BX_SEG_REG_CS].selector.value, bx_cpu. eip); return; }
void BX_CPU_C::task_switch(bx_selector_t *tss_selector, bx_descriptor_t *tss_descriptor, unsigned source, Bit32u dword1, Bit32u dword2) { Bit32u obase32; // base address of old TSS Bit32u nbase32; // base address of new TSS Bit32u temp32, newCR3; Bit16u raw_cs_selector, raw_ss_selector, raw_ds_selector, raw_es_selector, raw_fs_selector, raw_gs_selector, raw_ldt_selector; Bit16u temp16, trap_word; bx_selector_t cs_selector, ss_selector, ds_selector, es_selector, fs_selector, gs_selector, ldt_selector; bx_descriptor_t cs_descriptor, ss_descriptor, ldt_descriptor; Bit32u old_TSS_max, new_TSS_max, old_TSS_limit, new_TSS_limit; Bit32u newEAX, newECX, newEDX, newEBX; Bit32u newESP, newEBP, newESI, newEDI; Bit32u newEFLAGS, newEIP; BX_DEBUG(("TASKING: ENTER")); invalidate_prefetch_q(); // Discard any traps and inhibits for new context; traps will // resume upon return. BX_CPU_THIS_PTR debug_trap = 0; BX_CPU_THIS_PTR inhibit_mask = 0; // STEP 1: The following checks are made before calling task_switch(), // for JMP & CALL only. These checks are NOT made for exceptions, // interrupts & IRET. // // 1) TSS DPL must be >= CPL // 2) TSS DPL must be >= TSS selector RPL // 3) TSS descriptor is not busy. // TSS must be present, else #NP(TSS selector) if (tss_descriptor->p==0) { BX_ERROR(("task_switch: TSS descriptor is not present !")); exception(BX_NP_EXCEPTION, tss_selector->value & 0xfffc, 0); } // STEP 2: The processor performs limit-checking on the target TSS // to verify that the TSS limit is greater than or equal // to 67h (2Bh for 16-bit TSS). // Gather info about old TSS if (BX_CPU_THIS_PTR tr.cache.type <= 3) { old_TSS_max = 0x29; } else { old_TSS_max = 0x5F; } // Gather info about new TSS if (tss_descriptor->type <= 3) { // {1,3} new_TSS_max = 0x2B; } else { // tss_descriptor->type = {9,11} new_TSS_max = 0x67; } obase32 = (Bit32u) BX_CPU_THIS_PTR tr.cache.u.system.base; // old TSS.base old_TSS_limit = BX_CPU_THIS_PTR tr.cache.u.system.limit_scaled; nbase32 = (Bit32u) tss_descriptor->u.system.base; // new TSS.base new_TSS_limit = tss_descriptor->u.system.limit_scaled; // TSS must have valid limit, else #TS(TSS selector) if (tss_selector->ti || tss_descriptor->valid==0 || new_TSS_limit < new_TSS_max) { BX_ERROR(("task_switch(): new TSS limit < %d", new_TSS_max)); exception(BX_TS_EXCEPTION, tss_selector->value & 0xfffc, 0); } if (old_TSS_limit < old_TSS_max) { BX_ERROR(("task_switch(): old TSS limit < %d", old_TSS_max)); exception(BX_TS_EXCEPTION, BX_CPU_THIS_PTR tr.selector.value & 0xfffc, 0); } if (obase32 == nbase32) { BX_INFO(("TASK SWITCH: switching to the same TSS !")); } // Check that old TSS, new TSS, and all segment descriptors // used in the task switch are paged in. if (BX_CPU_THIS_PTR cr0.get_PG()) { dtranslate_linear(obase32, 0, BX_WRITE); // new TSS dtranslate_linear(obase32 + old_TSS_max, 0, BX_WRITE); dtranslate_linear(nbase32, 0, BX_READ); // old TSS dtranslate_linear(nbase32 + new_TSS_max, 0, BX_READ); // ??? Humm, we check the new TSS region with READ above, // but sometimes we need to write the link field in that // region. We also sometimes update other fields, perhaps // we need to WRITE check them here also, so that we keep // the written state consistent (ie, we don't encounter a // page fault in the middle). if (source == BX_TASK_FROM_CALL_OR_INT) { dtranslate_linear(nbase32, 0, BX_WRITE); dtranslate_linear(nbase32 + 2, 0, BX_WRITE); } } // Privilege and busy checks done in CALL, JUMP, INT, IRET // STEP 3: Save the current task state in the TSS. Up to this point, // any exception that occurs aborts the task switch without // changing the processor state. /* save current machine state in old task's TSS */ Bit32u oldEFLAGS = read_eflags(); /* if moving to busy task, clear NT bit */ if (tss_descriptor->type == BX_SYS_SEGMENT_BUSY_286_TSS || tss_descriptor->type == BX_SYS_SEGMENT_BUSY_386_TSS) { oldEFLAGS &= ~EFlagsNTMask; } if (BX_CPU_THIS_PTR tr.cache.type <= 3) { temp16 = IP; access_write_linear(Bit32u(obase32 + 14), 2, 0, &temp16); temp16 = oldEFLAGS; access_write_linear(Bit32u(obase32 + 16), 2, 0, &temp16); temp16 = AX; access_write_linear(Bit32u(obase32 + 18), 2, 0, &temp16); temp16 = CX; access_write_linear(Bit32u(obase32 + 20), 2, 0, &temp16); temp16 = DX; access_write_linear(Bit32u(obase32 + 22), 2, 0, &temp16); temp16 = BX; access_write_linear(Bit32u(obase32 + 24), 2, 0, &temp16); temp16 = SP; access_write_linear(Bit32u(obase32 + 26), 2, 0, &temp16); temp16 = BP; access_write_linear(Bit32u(obase32 + 28), 2, 0, &temp16); temp16 = SI; access_write_linear(Bit32u(obase32 + 30), 2, 0, &temp16); temp16 = DI; access_write_linear(Bit32u(obase32 + 32), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES].selector.value; access_write_linear(Bit32u(obase32 + 34), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector.value; access_write_linear(Bit32u(obase32 + 36), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].selector.value; access_write_linear(Bit32u(obase32 + 38), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].selector.value; access_write_linear(Bit32u(obase32 + 40), 2, 0, &temp16); } else { temp32 = EIP; access_write_linear(Bit32u(obase32 + 0x20), 4, 0, &temp32); temp32 = oldEFLAGS; access_write_linear(Bit32u(obase32 + 0x24), 4, 0, &temp32); temp32 = EAX; access_write_linear(Bit32u(obase32 + 0x28), 4, 0, &temp32); temp32 = ECX; access_write_linear(Bit32u(obase32 + 0x2c), 4, 0, &temp32); temp32 = EDX; access_write_linear(Bit32u(obase32 + 0x30), 4, 0, &temp32); temp32 = EBX; access_write_linear(Bit32u(obase32 + 0x34), 4, 0, &temp32); temp32 = ESP; access_write_linear(Bit32u(obase32 + 0x38), 4, 0, &temp32); temp32 = EBP; access_write_linear(Bit32u(obase32 + 0x3c), 4, 0, &temp32); temp32 = ESI; access_write_linear(Bit32u(obase32 + 0x40), 4, 0, &temp32); temp32 = EDI; access_write_linear(Bit32u(obase32 + 0x44), 4, 0, &temp32); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES].selector.value; access_write_linear(Bit32u(obase32 + 0x48), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector.value; access_write_linear(Bit32u(obase32 + 0x4c), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].selector.value; access_write_linear(Bit32u(obase32 + 0x50), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].selector.value; access_write_linear(Bit32u(obase32 + 0x54), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS].selector.value; access_write_linear(Bit32u(obase32 + 0x58), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS].selector.value; access_write_linear(Bit32u(obase32 + 0x5c), 2, 0, &temp16); } // effect on link field of new task if (source == BX_TASK_FROM_CALL_OR_INT) { // set to selector of old task's TSS temp16 = BX_CPU_THIS_PTR tr.selector.value; access_write_linear(nbase32, 2, 0, &temp16); } // STEP 4: The new-task state is loaded from the TSS if (tss_descriptor->type <= 3) { access_read_linear(Bit32u(nbase32 + 14), 2, 0, BX_READ, &temp16); newEIP = temp16; // zero out upper word access_read_linear(Bit32u(nbase32 + 16), 2, 0, BX_READ, &temp16); newEFLAGS = temp16; // incoming TSS is 16bit: // - upper word of general registers is set to 0xFFFF // - upper word of eflags is zero'd // - FS, GS are zero'd // - upper word of eIP is zero'd access_read_linear(Bit32u(nbase32 + 18), 2, 0, BX_READ, &temp16); newEAX = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 20), 2, 0, BX_READ, &temp16); newECX = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 22), 2, 0, BX_READ, &temp16); newEDX = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 24), 2, 0, BX_READ, &temp16); newEBX = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 26), 2, 0, BX_READ, &temp16); newESP = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 28), 2, 0, BX_READ, &temp16); newEBP = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 30), 2, 0, BX_READ, &temp16); newESI = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 32), 2, 0, BX_READ, &temp16); newEDI = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 34), 2, 0, BX_READ, &raw_es_selector); access_read_linear(Bit32u(nbase32 + 36), 2, 0, BX_READ, &raw_cs_selector); access_read_linear(Bit32u(nbase32 + 38), 2, 0, BX_READ, &raw_ss_selector); access_read_linear(Bit32u(nbase32 + 40), 2, 0, BX_READ, &raw_ds_selector); access_read_linear(Bit32u(nbase32 + 42), 2, 0, BX_READ, &raw_ldt_selector); raw_fs_selector = 0; // use a NULL selector raw_gs_selector = 0; // use a NULL selector // No CR3 change for 286 task switch newCR3 = 0; // keep compiler happy (not used) trap_word = 0; // keep compiler happy (not used) } else { if (BX_CPU_THIS_PTR cr0.get_PG()) access_read_linear(Bit32u(nbase32 + 0x1c), 4, 0, BX_READ, &newCR3); else newCR3 = 0; // keep compiler happy (not used) access_read_linear(Bit32u(nbase32 + 0x20), 4, 0, BX_READ, &newEIP); access_read_linear(Bit32u(nbase32 + 0x24), 4, 0, BX_READ, &newEFLAGS); access_read_linear(Bit32u(nbase32 + 0x28), 4, 0, BX_READ, &newEAX); access_read_linear(Bit32u(nbase32 + 0x2c), 4, 0, BX_READ, &newECX); access_read_linear(Bit32u(nbase32 + 0x30), 4, 0, BX_READ, &newEDX); access_read_linear(Bit32u(nbase32 + 0x34), 4, 0, BX_READ, &newEBX); access_read_linear(Bit32u(nbase32 + 0x38), 4, 0, BX_READ, &newESP); access_read_linear(Bit32u(nbase32 + 0x3c), 4, 0, BX_READ, &newEBP); access_read_linear(Bit32u(nbase32 + 0x40), 4, 0, BX_READ, &newESI); access_read_linear(Bit32u(nbase32 + 0x44), 4, 0, BX_READ, &newEDI); access_read_linear(Bit32u(nbase32 + 0x48), 2, 0, BX_READ, &raw_es_selector); access_read_linear(Bit32u(nbase32 + 0x4c), 2, 0, BX_READ, &raw_cs_selector); access_read_linear(Bit32u(nbase32 + 0x50), 2, 0, BX_READ, &raw_ss_selector); access_read_linear(Bit32u(nbase32 + 0x54), 2, 0, BX_READ, &raw_ds_selector); access_read_linear(Bit32u(nbase32 + 0x58), 2, 0, BX_READ, &raw_fs_selector); access_read_linear(Bit32u(nbase32 + 0x5c), 2, 0, BX_READ, &raw_gs_selector); access_read_linear(Bit32u(nbase32 + 0x60), 2, 0, BX_READ, &raw_ldt_selector); access_read_linear(Bit32u(nbase32 + 0x64), 2, 0, BX_READ, &trap_word); } // Step 5: If CALL, interrupt, or JMP, set busy flag in new task's // TSS descriptor. If IRET, leave set. if (source == BX_TASK_FROM_JUMP || source == BX_TASK_FROM_CALL_OR_INT) { // set the new task's busy bit Bit32u laddr = (Bit32u)(BX_CPU_THIS_PTR gdtr.base) + (tss_selector->index<<3) + 4; access_read_linear(laddr, 4, 0, BX_READ, &dword2); dword2 |= 0x200; access_write_linear(laddr, 4, 0, &dword2); } // Step 6: If JMP or IRET, clear busy bit in old task TSS descriptor, // otherwise leave set. // effect on Busy bit of old task if (source == BX_TASK_FROM_JUMP || source == BX_TASK_FROM_IRET) { // Bit is cleared Bit32u laddr = (Bit32u) BX_CPU_THIS_PTR gdtr.base + (BX_CPU_THIS_PTR tr.selector.index<<3) + 4; access_read_linear(laddr, 4, 0, BX_READ, &temp32); temp32 &= ~0x200; access_write_linear(laddr, 4, 0, &temp32); } // // Commit point. At this point, we commit to the new // context. If an unrecoverable error occurs in further // processing, we complete the task switch without performing // additional access and segment availablility checks and // generate the appropriate exception prior to beginning // execution of the new task. // // Step 7: Load the task register with the segment selector and // descriptor for the new task TSS. BX_CPU_THIS_PTR tr.selector = *tss_selector; BX_CPU_THIS_PTR tr.cache = *tss_descriptor; BX_CPU_THIS_PTR tr.cache.type |= 2; // mark TSS in TR as busy // Step 8: Set TS flag in the CR0 image stored in the new task TSS. BX_CPU_THIS_PTR cr0.set_TS(1); // Task switch clears LE/L3/L2/L1/L0 in DR7 BX_CPU_THIS_PTR dr7 &= ~0x00000155; // Step 9: If call or interrupt, set the NT flag in the eflags // image stored in new task's TSS. If IRET or JMP, // NT is restored from new TSS eflags image. (no change) // effect on NT flag of new task if (source == BX_TASK_FROM_CALL_OR_INT) { newEFLAGS |= EFlagsNTMask; // NT flag is set } // Step 10: Load the new task (dynamic) state from new TSS. // Any errors associated with loading and qualification of // segment descriptors in this step occur in the new task's // context. State loaded here includes LDTR, CR3, // EFLAGS, EIP, general purpose registers, and segment // descriptor parts of the segment registers. if ((tss_descriptor->type >= 9) && BX_CPU_THIS_PTR cr0.get_PG()) { // change CR3 only if it actually modified if (newCR3 != BX_CPU_THIS_PTR cr3) { SetCR3(newCR3); // Tell paging unit about new cr3 value BX_DEBUG (("task_switch changing CR3 to 0x" FMT_PHY_ADDRX, newCR3)); BX_INSTR_TLB_CNTRL(BX_CPU_ID, BX_INSTR_TASKSWITCH, newCR3); } } BX_CPU_THIS_PTR prev_rip = EIP = newEIP; EAX = newEAX; ECX = newECX; EDX = newEDX; EBX = newEBX; ESP = newESP; EBP = newEBP; ESI = newESI; EDI = newEDI; writeEFlags(newEFLAGS, EFlagsValidMask); // Fill in selectors for all segment registers. If errors // occur later, the selectors will at least be loaded. parse_selector(raw_cs_selector, &cs_selector); BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector = cs_selector; parse_selector(raw_ds_selector, &ds_selector); BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].selector = ds_selector; parse_selector(raw_es_selector, &es_selector); BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES].selector = es_selector; parse_selector(raw_ss_selector, &ss_selector); BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].selector = ss_selector; parse_selector(raw_fs_selector, &fs_selector); BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS].selector = fs_selector; parse_selector(raw_gs_selector, &gs_selector); BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS].selector = gs_selector; parse_selector(raw_ldt_selector, &ldt_selector); BX_CPU_THIS_PTR ldtr.selector = ldt_selector; // Start out with invalid descriptor caches, fill in // with values only as they are validated. BX_CPU_THIS_PTR ldtr.cache.valid = 0; BX_CPU_THIS_PTR ldtr.cache.u.system.limit = 0; BX_CPU_THIS_PTR ldtr.cache.u.system.limit_scaled = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES].cache.valid = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.valid = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].cache.valid = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.valid = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS].cache.valid = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS].cache.valid = 0; // LDTR if (ldt_selector.ti) { // LDT selector must be in GDT BX_INFO(("task_switch(exception after commit point): bad LDT selector TI=1")); exception(BX_TS_EXCEPTION, raw_ldt_selector & 0xfffc, 0); } if ((raw_ldt_selector & 0xfffc) != 0) { bx_bool good = fetch_raw_descriptor2(&ldt_selector, &dword1, &dword2); if (!good) { BX_ERROR(("task_switch(exception after commit point): bad LDT fetch")); exception(BX_TS_EXCEPTION, raw_ldt_selector & 0xfffc, 0); } parse_descriptor(dword1, dword2, &ldt_descriptor); // LDT selector of new task is valid, else #TS(new task's LDT) if (ldt_descriptor.valid==0 || ldt_descriptor.type!=BX_SYS_SEGMENT_LDT || ldt_descriptor.segment) { BX_ERROR(("task_switch(exception after commit point): bad LDT segment")); exception(BX_TS_EXCEPTION, raw_ldt_selector & 0xfffc, 0); } // LDT of new task is present in memory, else #TS(new tasks's LDT) if (! IS_PRESENT(ldt_descriptor)) { BX_ERROR(("task_switch(exception after commit point): LDT not present")); exception(BX_TS_EXCEPTION, raw_ldt_selector & 0xfffc, 0); } // All checks pass, fill in LDTR shadow cache BX_CPU_THIS_PTR ldtr.cache = ldt_descriptor; } else { // NULL LDT selector is OK, leave cache invalid } if (v8086_mode()) { // load seg regs as 8086 registers load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS], raw_cs_selector); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS], raw_ss_selector); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS], raw_ds_selector); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES], raw_es_selector); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS], raw_fs_selector); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS], raw_gs_selector); } else { // SS if ((raw_ss_selector & 0xfffc) != 0) { bx_bool good = fetch_raw_descriptor2(&ss_selector, &dword1, &dword2); if (!good) { BX_ERROR(("task_switch(exception after commit point): bad SS fetch")); exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc, 0); } parse_descriptor(dword1, dword2, &ss_descriptor); // SS selector must be within its descriptor table limits else #TS(SS) // SS descriptor AR byte must must indicate writable data segment, // else #TS(SS) if (ss_descriptor.valid==0 || ss_descriptor.segment==0 || IS_CODE_SEGMENT(ss_descriptor.type) || !IS_DATA_SEGMENT_WRITEABLE(ss_descriptor.type)) { BX_ERROR(("task_switch(exception after commit point): SS not valid or writeable segment")); exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc, 0); } // // Stack segment is present in memory, else #SS(new stack segment) // if (! IS_PRESENT(ss_descriptor)) { BX_ERROR(("task_switch(exception after commit point): SS not present")); exception(BX_SS_EXCEPTION, raw_ss_selector & 0xfffc, 0); } // Stack segment DPL matches CS.RPL, else #TS(new stack segment) if (ss_descriptor.dpl != cs_selector.rpl) { BX_ERROR(("task_switch(exception after commit point): SS.rpl != CS.RPL")); exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc, 0); } // Stack segment DPL matches selector RPL, else #TS(new stack segment) if (ss_descriptor.dpl != ss_selector.rpl) { BX_ERROR(("task_switch(exception after commit point): SS.dpl != SS.rpl")); exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc, 0); } // All checks pass, fill in shadow cache BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].cache = ss_descriptor; } else { // SS selector is valid, else #TS(new stack segment) BX_ERROR(("task_switch(exception after commit point): SS NULL")); exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc, 0); } // if new selector is not null then perform following checks: // index must be within its descriptor table limits else #TS(selector) // AR byte must indicate data or readable code else #TS(selector) // if data or non-conforming code then: // DPL must be >= CPL else #TS(selector) // DPL must be >= RPL else #TS(selector) // AR byte must indicate PRESENT else #NP(selector) // load cache with new segment descriptor and set valid bit // CS if ((raw_cs_selector & 0xfffc) != 0) { bx_bool good = fetch_raw_descriptor2(&cs_selector, &dword1, &dword2); if (!good) { BX_ERROR(("task_switch(exception after commit point): bad CS fetch")); exception(BX_TS_EXCEPTION, raw_cs_selector & 0xfffc, 0); } parse_descriptor(dword1, dword2, &cs_descriptor); // CS descriptor AR byte must indicate code segment else #TS(CS) if (cs_descriptor.valid==0 || cs_descriptor.segment==0 || IS_DATA_SEGMENT(cs_descriptor.type)) { BX_ERROR(("task_switch(exception after commit point): CS not valid executable seg")); exception(BX_TS_EXCEPTION, raw_cs_selector & 0xfffc, 0); } // if non-conforming then DPL must equal selector RPL else #TS(CS) if (IS_CODE_SEGMENT_NON_CONFORMING(cs_descriptor.type) && cs_descriptor.dpl != cs_selector.rpl) { BX_ERROR(("task_switch(exception after commit point): non-conforming: CS.dpl!=CS.RPL")); exception(BX_TS_EXCEPTION, raw_cs_selector & 0xfffc, 0); } // if conforming then DPL must be <= selector RPL else #TS(CS) if (IS_CODE_SEGMENT_CONFORMING(cs_descriptor.type) && cs_descriptor.dpl > cs_selector.rpl) { BX_ERROR(("task_switch(exception after commit point): conforming: CS.dpl>RPL")); exception(BX_TS_EXCEPTION, raw_cs_selector & 0xfffc, 0); } // Code segment is present in memory, else #NP(new code segment) if (! IS_PRESENT(cs_descriptor)) { BX_ERROR(("task_switch(exception after commit point): CS.p==0")); exception(BX_NP_EXCEPTION, raw_cs_selector & 0xfffc, 0); } // All checks pass, fill in shadow cache BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache = cs_descriptor; } else { // If new cs selector is null #TS(CS) BX_ERROR(("task_switch(exception after commit point): CS NULL")); exception(BX_TS_EXCEPTION, raw_cs_selector & 0xfffc, 0); } #if BX_SUPPORT_ICACHE BX_CPU_THIS_PTR updateFetchModeMask(); #endif #if BX_CPU_LEVEL >= 4 && BX_SUPPORT_ALIGNMENT_CHECK handleAlignmentCheck(); // task switch, CPL was modified #endif task_switch_load_selector(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS], &ds_selector, raw_ds_selector, cs_selector.rpl); task_switch_load_selector(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES], &es_selector, raw_es_selector, cs_selector.rpl); task_switch_load_selector(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS], &fs_selector, raw_fs_selector, cs_selector.rpl); task_switch_load_selector(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS], &gs_selector, raw_gs_selector, cs_selector.rpl); } if ((tss_descriptor->type>=9) && (trap_word & 0x1)) { BX_CPU_THIS_PTR debug_trap |= 0x00008000; // BT flag in DR6 BX_CPU_THIS_PTR async_event = 1; // so processor knows to check BX_INFO(("task_switch: T bit set in new TSS")); } // // Step 14: Begin execution of new task. // BX_DEBUG(("TASKING: LEAVE")); }