void bx_cpu_c::JMP_Ap(BxInstruction_t *i) { Bit32u disp32; Bit16u cs_raw; invalidate_prefetch_q(); if (i->os_32) { disp32 = i->Id; } else { disp32 = i->Iw; } cs_raw = i->Iw2; #if BX_CPU_LEVEL >= 2 if (protected_mode()) { bx_cpu. jump_protected(i, cs_raw, disp32); goto done; } #endif load_seg_reg(&bx_cpu. sregs[BX_SEG_REG_CS], cs_raw); bx_cpu. eip = disp32; done: BX_INSTR_FAR_BRANCH(BX_INSTR_IS_JMP, bx_cpu. sregs[BX_SEG_REG_CS].selector.value, bx_cpu. eip); return; }
BX_CPU_C::load_cs(bx_selector_t *selector, bx_descriptor_t *descriptor, Bit8u cpl) { BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector = *selector; BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache = *descriptor; /* caller may request different CPL then in selector */ BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector.rpl = cpl; BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.valid = 1; // Added cpl to the selector value. BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector.value = (0xfffc & BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector.value) | cpl; #if BX_SUPPORT_X86_64 if (BX_CPU_THIS_PTR efer.lma) { if (descriptor->u.segment.l) { BX_CPU_THIS_PTR cpu_mode = BX_MODE_LONG_64; BX_DEBUG(("Long Mode Activated")); loadSRegLMNominal(BX_SEG_REG_CS, selector->value, cpl); } else { BX_DEBUG(("Compatibility Mode Activated")); BX_CPU_THIS_PTR cpu_mode = BX_MODE_LONG_COMPAT; } } #endif #if BX_SUPPORT_ICACHE BX_CPU_THIS_PTR updateFetchModeMask(); #endif // Loading CS will invalidate the EIP fetch window. invalidate_prefetch_q(); }
void bx_cpu_c::RETfar32(BxInstruction_t *i) { Bit32u eip, ecs_raw; #if BX_DEBUGGER bx_cpu. show_flag |= Flag_ret; #endif invalidate_prefetch_q(); #if BX_CPU_LEVEL >= 2 if ( protected_mode() ) { bx_cpu. return_protected(i, 0); goto done; } #endif pop_32(&eip); pop_32(&ecs_raw); /* 32bit pop, MSW discarded */ bx_cpu. eip = eip; load_seg_reg(&bx_cpu. sregs[BX_SEG_REG_CS], (Bit16u) ecs_raw); done: BX_INSTR_FAR_BRANCH(BX_INSTR_IS_RET, bx_cpu. sregs[BX_SEG_REG_CS].selector.value, bx_cpu. eip); return; }
void bx_cpu_c::JMP32_Ep(BxInstruction_t *i) { Bit16u cs_raw; Bit32u op1_32; /* op1_32 is a register or memory reference */ if (i->mod == 0xc0) { /* far indirect must specify a memory address */ BX_PANIC(("JMP_Ep(): op1 is a register")); } /* pointer, segment address pair */ read_virtual_dword(i->seg, i->rm_addr, &op1_32); read_virtual_word(i->seg, i->rm_addr+4, &cs_raw); invalidate_prefetch_q(); if ( protected_mode() ) { bx_cpu. jump_protected(i, cs_raw, op1_32); goto done; } bx_cpu. eip = op1_32; load_seg_reg(&bx_cpu. sregs[BX_SEG_REG_CS], cs_raw); done: BX_INSTR_FAR_BRANCH(BX_INSTR_IS_JMP, bx_cpu. sregs[BX_SEG_REG_CS].selector.value, bx_cpu. eip); return; }
void bx_cpu_c::CALL32_Ap(BxInstruction_t *i) { Bit16u cs_raw; Bit32u disp32; #if BX_DEBUGGER bx_cpu. show_flag |= Flag_call; #endif disp32 = i->Id; cs_raw = i->Iw2; invalidate_prefetch_q(); if (protected_mode()) { bx_cpu. call_protected(i, cs_raw, disp32); goto done; } push_32(bx_cpu. sregs[BX_SEG_REG_CS].selector.value); push_32(bx_cpu. eip); bx_cpu. eip = disp32; load_seg_reg(&bx_cpu. sregs[BX_SEG_REG_CS], cs_raw); done: BX_INSTR_FAR_BRANCH(BX_INSTR_IS_CALL, bx_cpu. sregs[BX_SEG_REG_CS].selector.value, bx_cpu. eip); return; }
void BX_CPP_AttrRegparmN(1) BX_CPU_C::RSM(bxInstruction_c *i) { /* If we are not in System Management Mode, then #UD should be generated */ if (! BX_CPU_THIS_PTR smm_mode()) { BX_INFO(("RSM not in System Management Mode !")); UndefinedOpcode(i); } invalidate_prefetch_q(); BX_INFO(("RSM: Resuming from System Management Mode")); BX_CPU_THIS_PTR nmi_disable = 0; Bit32u saved_state[SMM_SAVE_STATE_MAP_SIZE], n; // reset reserved bits for(n=0;n<SMM_SAVE_STATE_MAP_SIZE;n++) saved_state[n] = 0; bx_phy_address base = BX_CPU_THIS_PTR smbase + 0x10000; // could be optimized with reading of only non-reserved bytes for(n=0;n<SMM_SAVE_STATE_MAP_SIZE;n++) { base -= 4; BX_MEM(0)->readPhysicalPage(BX_CPU_THIS, base, 4, &saved_state[n]); BX_DBG_PHY_MEMORY_ACCESS(BX_CPU_ID, base, 4, BX_READ, (Bit8u*)(&saved_state[n])); } BX_CPU_THIS_PTR in_smm = 0; // restore the CPU state from SMRAM if (! smram_restore_state(saved_state)) { BX_PANIC(("RSM: Incorrect state when restoring CPU state - shutdown !")); shutdown(); } // debug(RIP); }
void bx_cpu_c::CALL_Ad(BxInstruction_t *i) { Bit32u new_EIP; Bit32s disp32; #if BX_DEBUGGER bx_cpu. show_flag |= Flag_call; #endif disp32 = i->Id; invalidate_prefetch_q(); new_EIP = EIP + disp32; if ( protected_mode() ) { if ( new_EIP > bx_cpu. sregs[BX_SEG_REG_CS].cache.u.segment.limit_scaled ) { BX_PANIC(("call_av: offset outside of CS limits")); exception(BX_GP_EXCEPTION, 0, 0); } } /* push 32 bit EA of next instruction */ push_32(bx_cpu. eip); bx_cpu. eip = new_EIP; BX_INSTR_UCNEAR_BRANCH(BX_INSTR_IS_CALL, bx_cpu. eip); }
void bx_cpu_c::JMP_Ed(BxInstruction_t *i) { Bit32u new_EIP; Bit32u op1_32; /* op1_32 is a register or memory reference */ if (i->mod == 0xc0) { op1_32 = BX_READ_32BIT_REG(i->rm); } else { /* pointer, segment address pair */ read_virtual_dword(i->seg, i->rm_addr, &op1_32); } invalidate_prefetch_q(); new_EIP = op1_32; #if BX_CPU_LEVEL >= 2 if (protected_mode()) { if (new_EIP > bx_cpu. sregs[BX_SEG_REG_CS].cache.u.segment.limit_scaled) { BX_PANIC(("jmp_ev: IP out of CS limits!")); exception(BX_GP_EXCEPTION, 0, 0); } } #endif bx_cpu. eip = new_EIP; BX_INSTR_UCNEAR_BRANCH(BX_INSTR_IS_JMP, new_EIP); }
void bx_cpu_c::RETnear32_Iw(BxInstruction_t *i) { Bit16u imm16; Bit32u temp_ESP; Bit32u return_EIP; #if BX_DEBUGGER bx_cpu. show_flag |= Flag_ret; #endif if (bx_cpu. sregs[BX_SEG_REG_SS].cache.u.segment.d_b) /* 32bit stack */ temp_ESP = ESP; else temp_ESP = SP; imm16 = i->Iw; invalidate_prefetch_q(); if (protected_mode()) { if ( !can_pop(4) ) { BX_PANIC(("retnear_iw: can't pop EIP")); /* ??? #SS(0) -or #GP(0) */ } access_linear(bx_cpu. sregs[BX_SEG_REG_SS].cache.u.segment.base + temp_ESP + 0, 4, CPL==3, BX_READ, &return_EIP); if (protected_mode() && (return_EIP > bx_cpu. sregs[BX_SEG_REG_CS].cache.u.segment.limit_scaled) ) { BX_DEBUG(("retnear_iw: EIP > limit")); exception(BX_GP_EXCEPTION, 0, 0); } /* Pentium book says imm16 is number of words ??? */ if ( !can_pop(4 + imm16) ) { BX_PANIC(("retnear_iw: can't release bytes from stack")); /* #GP(0) -or #SS(0) ??? */ } bx_cpu. eip = return_EIP; if (bx_cpu. sregs[BX_SEG_REG_SS].cache.u.segment.d_b) /* 32bit stack */ ESP += 4 + imm16; /* ??? should it be 2*imm16 ? */ else SP += 4 + imm16; } else { pop_32(&return_EIP); bx_cpu. eip = return_EIP; if (bx_cpu. sregs[BX_SEG_REG_SS].cache.u.segment.d_b) /* 32bit stack */ ESP += imm16; /* ??? should it be 2*imm16 ? */ else SP += imm16; } BX_INSTR_UCNEAR_BRANCH(BX_INSTR_IS_RET, bx_cpu. eip); }
void bx_cpu_c::RETnear32(BxInstruction_t *i) { Bit32u temp_ESP; Bit32u return_EIP; #if BX_DEBUGGER bx_cpu. show_flag |= Flag_ret; #endif invalidate_prefetch_q(); if (bx_cpu. sregs[BX_SEG_REG_SS].cache.u.segment.d_b) /* 32bit stack */ temp_ESP = ESP; else temp_ESP = SP; if (protected_mode()) { if ( !can_pop(4) ) { BX_PANIC(("retnear: can't pop EIP")); /* ??? #SS(0) -or #GP(0) */ } access_linear(bx_cpu. sregs[BX_SEG_REG_SS].cache.u.segment.base + temp_ESP + 0, 4, CPL==3, BX_READ, &return_EIP); if ( return_EIP > bx_cpu. sregs[BX_SEG_REG_CS].cache.u.segment.limit_scaled ) { BX_PANIC(("retnear: EIP > limit")); //exception(BX_GP_EXCEPTION, 0, 0); } bx_cpu. eip = return_EIP; if (bx_cpu. sregs[BX_SEG_REG_SS].cache.u.segment.d_b) /* 32bit stack */ ESP += 4; else SP += 4; } else { pop_32(&return_EIP); bx_cpu. eip = return_EIP; } BX_INSTR_UCNEAR_BRANCH(BX_INSTR_IS_RET, bx_cpu. eip); }
void bx_cpu_c::IRET32(BxInstruction_t *i) { Bit32u eip, ecs_raw, eflags; #if BX_DEBUGGER bx_cpu. show_flag |= Flag_iret; bx_cpu. show_eip = bx_cpu. eip; #endif invalidate_prefetch_q(); if (v8086_mode()) { // IOPL check in stack_return_from_v86() stack_return_from_v86(i); goto done; } #if BX_CPU_LEVEL >= 2 if (bx_cpu. cr0.pe) { iret_protected(i); goto done; } #endif BX_ERROR(("IRET32 called when you're not in vm8086 mode or protected mode.")); BX_ERROR(("IRET32 may not be implemented right, since it doesn't check anything.")); BX_PANIC(("Please report that you have found a test case for bx_cpu_c::IRET32.")); pop_32(&eip); pop_32(&ecs_raw); pop_32(&eflags); load_seg_reg(&bx_cpu. sregs[BX_SEG_REG_CS], (Bit16u) ecs_raw); bx_cpu. eip = eip; //FIXME: this should do (eflags & 0x257FD5) | (EFLAGS | 0x1A0000) write_eflags(eflags, /* change IOPL? */ 1, /* change IF? */ 1, 0, 1); done: BX_INSTR_FAR_BRANCH(BX_INSTR_IS_IRET, bx_cpu. sregs[BX_SEG_REG_CS].selector.value, bx_cpu. eip); return; }
void BX_CPU_C::interrupt(Bit8u vector, bx_bool is_INT, bx_bool is_error_code, Bit16u error_code) { #if BX_DEBUGGER BX_CPU_THIS_PTR show_flag |= Flag_intsig; #if BX_DEBUG_LINUX if (bx_dbg.linux_syscall) { if (vector == 0x80) bx_dbg_linux_syscall(BX_CPU_ID); } #endif bx_dbg_interrupt(BX_CPU_ID, vector, error_code); #endif BX_DEBUG(("interrupt(): vector = %u, INT = %u, EXT = %u", (unsigned) vector, (unsigned) is_INT, (unsigned) BX_CPU_THIS_PTR EXT)); BX_INSTR_INTERRUPT(BX_CPU_ID, vector); invalidate_prefetch_q(); // Discard any traps and inhibits for new context; traps will // resume upon return. BX_CPU_THIS_PTR debug_trap = 0; BX_CPU_THIS_PTR inhibit_mask = 0; BX_CPU_THIS_PTR save_cs = BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS]; BX_CPU_THIS_PTR save_ss = BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS]; BX_CPU_THIS_PTR save_eip = RIP; BX_CPU_THIS_PTR save_esp = RSP; #if BX_SUPPORT_X86_64 if (long_mode()) { long_mode_int(vector, is_INT, is_error_code, error_code); return; } #endif if(real_mode()) { real_mode_int(vector, is_INT, is_error_code, error_code); } else { protected_mode_int(vector, is_INT, is_error_code, error_code); } }
void bx_cpu_c::CALL_Ed(BxInstruction_t *i) { Bit32u temp_ESP; Bit32u op1_32; #if BX_DEBUGGER bx_cpu. show_flag |= Flag_call; #endif if (bx_cpu. sregs[BX_SEG_REG_SS].cache.u.segment.d_b) temp_ESP = ESP; else temp_ESP = SP; /* op1_32 is a register or memory reference */ if (i->mod == 0xc0) { op1_32 = BX_READ_32BIT_REG(i->rm); } else { read_virtual_dword(i->seg, i->rm_addr, &op1_32); } invalidate_prefetch_q(); if (protected_mode()) { if (op1_32 > bx_cpu. sregs[BX_SEG_REG_CS].cache.u.segment.limit_scaled) { BX_DEBUG(("call_ev: EIP out of CS limits! at %s:%d")); exception(BX_GP_EXCEPTION, 0, 0); } if ( !can_push(&bx_cpu. sregs[BX_SEG_REG_SS].cache, temp_ESP, 4) ) { BX_PANIC(("call_ev: can't push EIP")); } } push_32(bx_cpu. eip); bx_cpu. eip = op1_32; BX_INSTR_UCNEAR_BRANCH(BX_INSTR_IS_CALL, bx_cpu. eip); }
void bx_cpu_c::JMP_Jd(BxInstruction_t *i) { Bit32u new_EIP; invalidate_prefetch_q(); new_EIP = EIP + (Bit32s) i->Id; #if BX_CPU_LEVEL >= 2 if (protected_mode()) { if ( new_EIP > bx_cpu. sregs[BX_SEG_REG_CS].cache.u.segment.limit_scaled ) { BX_PANIC(("jmp_jv: offset outside of CS limits")); exception(BX_GP_EXCEPTION, 0, 0); } } #endif bx_cpu. eip = new_EIP; BX_INSTR_UCNEAR_BRANCH(BX_INSTR_IS_JMP, new_EIP); }
void bx_cpu_c::RETfar32_Iw(BxInstruction_t *i) { Bit32u eip, ecs_raw; Bit16s imm16; #if BX_DEBUGGER bx_cpu. show_flag |= Flag_ret; #endif /* ??? is imm16, number of bytes/words depending on operandsize ? */ imm16 = i->Iw; invalidate_prefetch_q(); #if BX_CPU_LEVEL >= 2 if (protected_mode()) { bx_cpu. return_protected(i, imm16); goto done; } #endif pop_32(&eip); pop_32(&ecs_raw); bx_cpu. eip = eip; load_seg_reg(&bx_cpu. sregs[BX_SEG_REG_CS], (Bit16u) ecs_raw); if (bx_cpu. sregs[BX_SEG_REG_SS].cache.u.segment.d_b) ESP += imm16; else SP += imm16; done: BX_INSTR_FAR_BRANCH(BX_INSTR_IS_RET, bx_cpu. sregs[BX_SEG_REG_CS].selector.value, bx_cpu. eip); return; }
void bx_cpu_c::CALL32_Ep(BxInstruction_t *i) { Bit16u cs_raw; Bit32u op1_32; #if BX_DEBUGGER bx_cpu. show_flag |= Flag_call; #endif /* op1_32 is a register or memory reference */ if (i->mod == 0xc0) { BX_PANIC(("CALL_Ep: op1 is a register")); } /* pointer, segment address pair */ read_virtual_dword(i->seg, i->rm_addr, &op1_32); read_virtual_word(i->seg, i->rm_addr+4, &cs_raw); invalidate_prefetch_q(); if ( protected_mode() ) { bx_cpu. call_protected(i, cs_raw, op1_32); goto done; } push_32(bx_cpu. sregs[BX_SEG_REG_CS].selector.value); push_32(bx_cpu. eip); bx_cpu. eip = op1_32; load_seg_reg(&bx_cpu. sregs[BX_SEG_REG_CS], cs_raw); done: BX_INSTR_FAR_BRANCH(BX_INSTR_IS_CALL, bx_cpu. sregs[BX_SEG_REG_CS].selector.value, bx_cpu. eip); return; }
void BX_CPU_C::enter_system_management_mode(void) { invalidate_prefetch_q(); BX_INFO(("Enter to System Management Mode")); // debug(BX_CPU_THIS_PTR prev_rip); BX_CPU_THIS_PTR in_smm = 1; Bit32u saved_state[SMM_SAVE_STATE_MAP_SIZE], n; // reset reserved bits for(n=0;n<SMM_SAVE_STATE_MAP_SIZE;n++) saved_state[n] = 0; // prepare CPU state to be saved in the SMRAM BX_CPU_THIS_PTR smram_save_state(saved_state); bx_phy_address base = BX_CPU_THIS_PTR smbase + 0x10000; // could be optimized with reading of only non-reserved bytes for(n=0;n<SMM_SAVE_STATE_MAP_SIZE;n++) { base -= 4; BX_MEM(0)->writePhysicalPage(BX_CPU_THIS, base, 4, &saved_state[n]); BX_DBG_PHY_MEMORY_ACCESS(BX_CPU_ID, base, 4, BX_WRITE, (Bit8u*)(&saved_state[n])); } BX_CPU_THIS_PTR setEFlags(0x2); // Bit1 is always set BX_CPU_THIS_PTR prev_rip = RIP = 0x00008000; BX_CPU_THIS_PTR dr7 = 0x00000400; // CR0 - PE, EM, TS, and PG flags set to 0; others unmodified BX_CPU_THIS_PTR cr0.set_PE(0); // real mode (bit 0) BX_CPU_THIS_PTR cr0.set_EM(0); // emulate math coprocessor (bit 2) BX_CPU_THIS_PTR cr0.set_TS(0); // no task switch (bit 3) BX_CPU_THIS_PTR cr0.set_PG(0); // paging disabled (bit 31) // paging mode was changed - flush TLB TLB_flush(1); // 1 = Flush Global entries also #if BX_CPU_LEVEL >= 4 BX_CPU_THIS_PTR cr4.setRegister(0); #endif #if BX_SUPPORT_X86_64 BX_CPU_THIS_PTR efer.setRegister(0); #endif parse_selector(BX_CPU_THIS_PTR smbase >> 4, &BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector); BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.valid = 1; BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.p = 1; BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.dpl = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.segment = 1; /* data/code segment */ BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.type = BX_DATA_READ_WRITE_ACCESSED; BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.u.segment.base = BX_CPU_THIS_PTR smbase; BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.u.segment.limit = 0xffff; BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.u.segment.limit_scaled = 0xffffffff; BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.u.segment.avl = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.u.segment.g = 1; /* page granular */ BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.u.segment.d_b = 0; /* 16bit default size */ #if BX_SUPPORT_X86_64 BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.u.segment.l = 0; /* 16bit default size */ #endif #if BX_SUPPORT_ICACHE BX_CPU_THIS_PTR updateFetchModeMask(); #endif handleCpuModeChange(); #if BX_CPU_LEVEL >= 4 && BX_SUPPORT_ALIGNMENT_CHECK handleAlignmentCheck(); #endif /* DS (Data Segment) and descriptor cache */ parse_selector(0x0000, &BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].selector); BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.valid = 1; BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.p = 1; BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.dpl = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.segment = 1; /* data/code segment */ BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.type = BX_DATA_READ_WRITE_ACCESSED; BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.u.segment.base = 0x00000000; BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.u.segment.limit = 0xffff; BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.u.segment.limit_scaled = 0xffffffff; BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.u.segment.avl = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.u.segment.g = 1; /* byte granular */ BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.u.segment.d_b = 0; /* 16bit default size */ #if BX_SUPPORT_X86_64 BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.u.segment.l = 0; /* 16bit default size */ #endif // use DS segment as template for the others BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS] = BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS]; BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES] = BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS]; BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS] = BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS]; BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS] = BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS]; }
void BX_CPU_C::interrupt(Bit8u vector, unsigned type, bx_bool push_error, Bit16u error_code) { #if BX_DEBUGGER BX_CPU_THIS_PTR show_flag |= Flag_intsig; #if BX_DEBUG_LINUX if (bx_dbg.linux_syscall) { if (vector == 0x80) bx_dbg_linux_syscall(BX_CPU_ID); } #endif bx_dbg_interrupt(BX_CPU_ID, vector, error_code); #endif BX_INSTR_INTERRUPT(BX_CPU_ID, vector); invalidate_prefetch_q(); bx_bool soft_int = 0; switch(type) { case BX_SOFTWARE_INTERRUPT: case BX_SOFTWARE_EXCEPTION: soft_int = 1; break; case BX_PRIVILEGED_SOFTWARE_INTERRUPT: case BX_EXTERNAL_INTERRUPT: case BX_NMI: case BX_HARDWARE_EXCEPTION: break; default: BX_PANIC(("interrupt(): unknown exception type %d", type)); } BX_DEBUG(("interrupt(): vector = %02x, TYPE = %u, EXT = %u", vector, type, (unsigned) BX_CPU_THIS_PTR EXT)); // Discard any traps and inhibits for new context; traps will // resume upon return. BX_CPU_THIS_PTR debug_trap = 0; BX_CPU_THIS_PTR inhibit_mask = 0; #if BX_SUPPORT_VMX BX_CPU_THIS_PTR in_event = 1; #endif #if BX_SUPPORT_X86_64 if (long_mode()) { long_mode_int(vector, soft_int, push_error, error_code); } else #endif { RSP_SPECULATIVE; if(real_mode()) { real_mode_int(vector, push_error, error_code); } else { protected_mode_int(vector, soft_int, push_error, error_code); } RSP_COMMIT; } #if BX_X86_DEBUGGER BX_CPU_THIS_PTR in_repeat = 0; #endif #if BX_SUPPORT_VMX BX_CPU_THIS_PTR in_event = 0; #endif }
// vector: 0..255: vector in IDT // error_code: if exception generates and error, push this error code // trap: override exception class to TRAP void BX_CPU_C::exception(unsigned vector, Bit16u error_code, bx_bool trap) { unsigned exception_type = 0, exception_class = BX_EXCEPTION_CLASS_FAULT; bx_bool push_error = 0; invalidate_prefetch_q(); BX_INSTR_EXCEPTION(BX_CPU_ID, vector); #if BX_DEBUGGER bx_dbg_exception(BX_CPU_ID, vector, error_code); #endif BX_DEBUG(("exception(0x%02x): error_code=%04x", vector, error_code)); // if not initial error, restore previous register values from // previous attempt to handle exception if (BX_CPU_THIS_PTR errorno) { BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS] = BX_CPU_THIS_PTR save_cs; BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS] = BX_CPU_THIS_PTR save_ss; RIP = BX_CPU_THIS_PTR save_eip; RSP = BX_CPU_THIS_PTR save_esp; } if (BX_CPU_THIS_PTR errorno > 0) { if (errno > 2 || BX_CPU_THIS_PTR curr_exception == BX_ET_DOUBLE_FAULT) { debug(BX_CPU_THIS_PTR prev_rip); // print debug information to the log #if BX_DEBUGGER // trap into debugger (similar as done when PANIC occured) bx_debug_break(); #endif if (SIM->get_param_bool(BXPN_RESET_ON_TRIPLE_FAULT)->get()) { BX_ERROR(("exception(): 3rd (%d) exception with no resolution, shutdown status is %02xh, resetting", vector, DEV_cmos_get_reg(0x0f))); bx_pc_system.Reset(BX_RESET_SOFTWARE); } else { BX_PANIC(("exception(): 3rd (%d) exception with no resolution", vector)); BX_ERROR(("WARNING: Any simulation after this point is completely bogus !")); shutdown(); } longjmp(BX_CPU_THIS_PTR jmp_buf_env, 1); // go back to main decode loop } } // note: fault-class exceptions _except_ #DB set RF in // eflags image. switch (vector) { case BX_DE_EXCEPTION: // DIV by 0 push_error = 0; exception_class = BX_EXCEPTION_CLASS_FAULT; exception_type = BX_ET_CONTRIBUTORY; break; case BX_DB_EXCEPTION: // debug exceptions push_error = 0; // Instruction fetch breakpoint - FAULT // Data read or write breakpoint - TRAP // I/O read or write breakpoint - TRAP // General detect condition - FAULT // Single-step - TRAP // Task-switch - TRAP exception_class = BX_EXCEPTION_CLASS_FAULT; exception_type = BX_ET_BENIGN; break; case 2: // NMI push_error = 0; exception_type = BX_ET_BENIGN; break; case BX_BP_EXCEPTION: // breakpoint push_error = 0; exception_class = BX_EXCEPTION_CLASS_TRAP; exception_type = BX_ET_BENIGN; break; case BX_OF_EXCEPTION: // overflow push_error = 0; exception_class = BX_EXCEPTION_CLASS_TRAP; exception_type = BX_ET_BENIGN; break; case BX_BR_EXCEPTION: // bounds check push_error = 0; exception_class = BX_EXCEPTION_CLASS_FAULT; exception_type = BX_ET_BENIGN; break; case BX_UD_EXCEPTION: // invalid opcode push_error = 0; exception_class = BX_EXCEPTION_CLASS_FAULT; exception_type = BX_ET_BENIGN; break; case BX_NM_EXCEPTION: // device not available push_error = 0; exception_class = BX_EXCEPTION_CLASS_FAULT; exception_type = BX_ET_BENIGN; break; case BX_DF_EXCEPTION: // double fault push_error = 1; error_code = 0; exception_class = BX_EXCEPTION_CLASS_ABORT; exception_type = BX_ET_DOUBLE_FAULT; break; case 9: // coprocessor segment overrun (286,386 only) push_error = 0; exception_class = BX_EXCEPTION_CLASS_ABORT; exception_type = BX_ET_BENIGN; BX_PANIC(("exception(9): unfinished")); break; case BX_TS_EXCEPTION: // invalid TSS push_error = 1; exception_class = BX_EXCEPTION_CLASS_FAULT; exception_type = BX_ET_CONTRIBUTORY; break; case BX_NP_EXCEPTION: // segment not present push_error = 1; exception_class = BX_EXCEPTION_CLASS_FAULT; exception_type = BX_ET_CONTRIBUTORY; break; case BX_SS_EXCEPTION: // stack fault push_error = 1; exception_class = BX_EXCEPTION_CLASS_FAULT; exception_type = BX_ET_CONTRIBUTORY; break; case BX_GP_EXCEPTION: // general protection push_error = 1; exception_class = BX_EXCEPTION_CLASS_FAULT; exception_type = BX_ET_CONTRIBUTORY; break; case BX_PF_EXCEPTION: // page fault push_error = 1; exception_class = BX_EXCEPTION_CLASS_FAULT; exception_type = BX_ET_PAGE_FAULT; break; case 15: // reserved BX_PANIC(("exception(15): reserved")); push_error = 0; exception_type = 0; break; case BX_MF_EXCEPTION: // floating-point error push_error = 0; exception_class = BX_EXCEPTION_CLASS_FAULT; exception_type = BX_ET_BENIGN; break; #if BX_CPU_LEVEL >= 4 case BX_AC_EXCEPTION: // alignment check push_error = 1; exception_class = BX_EXCEPTION_CLASS_FAULT; exception_type = BX_ET_BENIGN; break; #endif #if BX_CPU_LEVEL >= 5 case BX_MC_EXCEPTION: // machine check BX_PANIC(("exception(): machine-check, vector 18 not implemented")); push_error = 0; exception_class = BX_EXCEPTION_CLASS_ABORT; exception_type = BX_ET_BENIGN; break; #if BX_SUPPORT_SSE case BX_XM_EXCEPTION: // SIMD Floating-Point exception push_error = 0; exception_class = BX_EXCEPTION_CLASS_FAULT; exception_type = BX_ET_BENIGN; break; #endif #endif default: BX_PANIC(("exception(%u): bad vector", (unsigned) vector)); exception_type = BX_ET_BENIGN; push_error = 0; // keep compiler happy for now break; } if (trap) { exception_class = BX_EXCEPTION_CLASS_TRAP; } else { if (exception_class == BX_EXCEPTION_CLASS_FAULT) { // restore RIP/RSP to value before error occurred RIP = BX_CPU_THIS_PTR prev_rip; if (BX_CPU_THIS_PTR speculative_rsp) RSP = BX_CPU_THIS_PTR prev_rsp; if (vector != BX_DB_EXCEPTION) BX_CPU_THIS_PTR assert_RF(); } } // clear GD flag in the DR7 prior entering debug exception handler if (vector == BX_DB_EXCEPTION) BX_CPU_THIS_PTR dr7 &= ~0x00002000; if (exception_type != BX_ET_PAGE_FAULT) { // Page faults have different format error_code = (error_code & 0xfffe) | BX_CPU_THIS_PTR EXT; } else { // FIXME: special format error returned for page faults ? } BX_CPU_THIS_PTR EXT = 1; /* if we've already had 1st exception, see if 2nd causes a * Double Fault instead. Otherwise, just record 1st exception */ if (BX_CPU_THIS_PTR errorno > 0) { if (is_exception_OK[BX_CPU_THIS_PTR curr_exception][exception_type]) { BX_CPU_THIS_PTR curr_exception = exception_type; } else { exception(BX_DF_EXCEPTION, 0, 0); } } else { BX_CPU_THIS_PTR curr_exception = exception_type; } BX_CPU_THIS_PTR errorno++; if (real_mode()) { // not INT, no error code pushed BX_CPU_THIS_PTR interrupt(vector, 0, 0, 0); BX_CPU_THIS_PTR errorno = 0; // error resolved longjmp(BX_CPU_THIS_PTR jmp_buf_env, 1); // go back to main decode loop } else { BX_CPU_THIS_PTR interrupt(vector, 0, push_error, error_code); BX_CPU_THIS_PTR errorno = 0; // error resolved longjmp(BX_CPU_THIS_PTR jmp_buf_env, 1); // go back to main decode loop } }
void BX_CPU_C::task_switch(bx_selector_t *tss_selector, bx_descriptor_t *tss_descriptor, unsigned source, Bit32u dword1, Bit32u dword2) { Bit32u obase32; // base address of old TSS Bit32u nbase32; // base address of new TSS Bit32u temp32, newCR3; Bit16u raw_cs_selector, raw_ss_selector, raw_ds_selector, raw_es_selector, raw_fs_selector, raw_gs_selector, raw_ldt_selector; Bit16u temp16, trap_word; bx_selector_t cs_selector, ss_selector, ds_selector, es_selector, fs_selector, gs_selector, ldt_selector; bx_descriptor_t cs_descriptor, ss_descriptor, ldt_descriptor; Bit32u old_TSS_max, new_TSS_max, old_TSS_limit, new_TSS_limit; Bit32u newEAX, newECX, newEDX, newEBX; Bit32u newESP, newEBP, newESI, newEDI; Bit32u newEFLAGS, newEIP; BX_DEBUG(("TASKING: ENTER")); invalidate_prefetch_q(); // Discard any traps and inhibits for new context; traps will // resume upon return. BX_CPU_THIS_PTR debug_trap = 0; BX_CPU_THIS_PTR inhibit_mask = 0; // STEP 1: The following checks are made before calling task_switch(), // for JMP & CALL only. These checks are NOT made for exceptions, // interrupts & IRET. // // 1) TSS DPL must be >= CPL // 2) TSS DPL must be >= TSS selector RPL // 3) TSS descriptor is not busy. // TSS must be present, else #NP(TSS selector) if (tss_descriptor->p==0) { BX_ERROR(("task_switch: TSS descriptor is not present !")); exception(BX_NP_EXCEPTION, tss_selector->value & 0xfffc, 0); } // STEP 2: The processor performs limit-checking on the target TSS // to verify that the TSS limit is greater than or equal // to 67h (2Bh for 16-bit TSS). // Gather info about old TSS if (BX_CPU_THIS_PTR tr.cache.type <= 3) { old_TSS_max = 0x29; } else { old_TSS_max = 0x5F; } // Gather info about new TSS if (tss_descriptor->type <= 3) { // {1,3} new_TSS_max = 0x2B; } else { // tss_descriptor->type = {9,11} new_TSS_max = 0x67; } obase32 = (Bit32u) BX_CPU_THIS_PTR tr.cache.u.system.base; // old TSS.base old_TSS_limit = BX_CPU_THIS_PTR tr.cache.u.system.limit_scaled; nbase32 = (Bit32u) tss_descriptor->u.system.base; // new TSS.base new_TSS_limit = tss_descriptor->u.system.limit_scaled; // TSS must have valid limit, else #TS(TSS selector) if (tss_selector->ti || tss_descriptor->valid==0 || new_TSS_limit < new_TSS_max) { BX_ERROR(("task_switch(): new TSS limit < %d", new_TSS_max)); exception(BX_TS_EXCEPTION, tss_selector->value & 0xfffc, 0); } if (old_TSS_limit < old_TSS_max) { BX_ERROR(("task_switch(): old TSS limit < %d", old_TSS_max)); exception(BX_TS_EXCEPTION, BX_CPU_THIS_PTR tr.selector.value & 0xfffc, 0); } if (obase32 == nbase32) { BX_INFO(("TASK SWITCH: switching to the same TSS !")); } // Check that old TSS, new TSS, and all segment descriptors // used in the task switch are paged in. if (BX_CPU_THIS_PTR cr0.get_PG()) { dtranslate_linear(obase32, 0, BX_WRITE); // new TSS dtranslate_linear(obase32 + old_TSS_max, 0, BX_WRITE); dtranslate_linear(nbase32, 0, BX_READ); // old TSS dtranslate_linear(nbase32 + new_TSS_max, 0, BX_READ); // ??? Humm, we check the new TSS region with READ above, // but sometimes we need to write the link field in that // region. We also sometimes update other fields, perhaps // we need to WRITE check them here also, so that we keep // the written state consistent (ie, we don't encounter a // page fault in the middle). if (source == BX_TASK_FROM_CALL_OR_INT) { dtranslate_linear(nbase32, 0, BX_WRITE); dtranslate_linear(nbase32 + 2, 0, BX_WRITE); } } // Privilege and busy checks done in CALL, JUMP, INT, IRET // STEP 3: Save the current task state in the TSS. Up to this point, // any exception that occurs aborts the task switch without // changing the processor state. /* save current machine state in old task's TSS */ Bit32u oldEFLAGS = read_eflags(); /* if moving to busy task, clear NT bit */ if (tss_descriptor->type == BX_SYS_SEGMENT_BUSY_286_TSS || tss_descriptor->type == BX_SYS_SEGMENT_BUSY_386_TSS) { oldEFLAGS &= ~EFlagsNTMask; } if (BX_CPU_THIS_PTR tr.cache.type <= 3) { temp16 = IP; access_write_linear(Bit32u(obase32 + 14), 2, 0, &temp16); temp16 = oldEFLAGS; access_write_linear(Bit32u(obase32 + 16), 2, 0, &temp16); temp16 = AX; access_write_linear(Bit32u(obase32 + 18), 2, 0, &temp16); temp16 = CX; access_write_linear(Bit32u(obase32 + 20), 2, 0, &temp16); temp16 = DX; access_write_linear(Bit32u(obase32 + 22), 2, 0, &temp16); temp16 = BX; access_write_linear(Bit32u(obase32 + 24), 2, 0, &temp16); temp16 = SP; access_write_linear(Bit32u(obase32 + 26), 2, 0, &temp16); temp16 = BP; access_write_linear(Bit32u(obase32 + 28), 2, 0, &temp16); temp16 = SI; access_write_linear(Bit32u(obase32 + 30), 2, 0, &temp16); temp16 = DI; access_write_linear(Bit32u(obase32 + 32), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES].selector.value; access_write_linear(Bit32u(obase32 + 34), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector.value; access_write_linear(Bit32u(obase32 + 36), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].selector.value; access_write_linear(Bit32u(obase32 + 38), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].selector.value; access_write_linear(Bit32u(obase32 + 40), 2, 0, &temp16); } else { temp32 = EIP; access_write_linear(Bit32u(obase32 + 0x20), 4, 0, &temp32); temp32 = oldEFLAGS; access_write_linear(Bit32u(obase32 + 0x24), 4, 0, &temp32); temp32 = EAX; access_write_linear(Bit32u(obase32 + 0x28), 4, 0, &temp32); temp32 = ECX; access_write_linear(Bit32u(obase32 + 0x2c), 4, 0, &temp32); temp32 = EDX; access_write_linear(Bit32u(obase32 + 0x30), 4, 0, &temp32); temp32 = EBX; access_write_linear(Bit32u(obase32 + 0x34), 4, 0, &temp32); temp32 = ESP; access_write_linear(Bit32u(obase32 + 0x38), 4, 0, &temp32); temp32 = EBP; access_write_linear(Bit32u(obase32 + 0x3c), 4, 0, &temp32); temp32 = ESI; access_write_linear(Bit32u(obase32 + 0x40), 4, 0, &temp32); temp32 = EDI; access_write_linear(Bit32u(obase32 + 0x44), 4, 0, &temp32); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES].selector.value; access_write_linear(Bit32u(obase32 + 0x48), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector.value; access_write_linear(Bit32u(obase32 + 0x4c), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].selector.value; access_write_linear(Bit32u(obase32 + 0x50), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].selector.value; access_write_linear(Bit32u(obase32 + 0x54), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS].selector.value; access_write_linear(Bit32u(obase32 + 0x58), 2, 0, &temp16); temp16 = BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS].selector.value; access_write_linear(Bit32u(obase32 + 0x5c), 2, 0, &temp16); } // effect on link field of new task if (source == BX_TASK_FROM_CALL_OR_INT) { // set to selector of old task's TSS temp16 = BX_CPU_THIS_PTR tr.selector.value; access_write_linear(nbase32, 2, 0, &temp16); } // STEP 4: The new-task state is loaded from the TSS if (tss_descriptor->type <= 3) { access_read_linear(Bit32u(nbase32 + 14), 2, 0, BX_READ, &temp16); newEIP = temp16; // zero out upper word access_read_linear(Bit32u(nbase32 + 16), 2, 0, BX_READ, &temp16); newEFLAGS = temp16; // incoming TSS is 16bit: // - upper word of general registers is set to 0xFFFF // - upper word of eflags is zero'd // - FS, GS are zero'd // - upper word of eIP is zero'd access_read_linear(Bit32u(nbase32 + 18), 2, 0, BX_READ, &temp16); newEAX = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 20), 2, 0, BX_READ, &temp16); newECX = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 22), 2, 0, BX_READ, &temp16); newEDX = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 24), 2, 0, BX_READ, &temp16); newEBX = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 26), 2, 0, BX_READ, &temp16); newESP = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 28), 2, 0, BX_READ, &temp16); newEBP = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 30), 2, 0, BX_READ, &temp16); newESI = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 32), 2, 0, BX_READ, &temp16); newEDI = 0xffff0000 | temp16; access_read_linear(Bit32u(nbase32 + 34), 2, 0, BX_READ, &raw_es_selector); access_read_linear(Bit32u(nbase32 + 36), 2, 0, BX_READ, &raw_cs_selector); access_read_linear(Bit32u(nbase32 + 38), 2, 0, BX_READ, &raw_ss_selector); access_read_linear(Bit32u(nbase32 + 40), 2, 0, BX_READ, &raw_ds_selector); access_read_linear(Bit32u(nbase32 + 42), 2, 0, BX_READ, &raw_ldt_selector); raw_fs_selector = 0; // use a NULL selector raw_gs_selector = 0; // use a NULL selector // No CR3 change for 286 task switch newCR3 = 0; // keep compiler happy (not used) trap_word = 0; // keep compiler happy (not used) } else { if (BX_CPU_THIS_PTR cr0.get_PG()) access_read_linear(Bit32u(nbase32 + 0x1c), 4, 0, BX_READ, &newCR3); else newCR3 = 0; // keep compiler happy (not used) access_read_linear(Bit32u(nbase32 + 0x20), 4, 0, BX_READ, &newEIP); access_read_linear(Bit32u(nbase32 + 0x24), 4, 0, BX_READ, &newEFLAGS); access_read_linear(Bit32u(nbase32 + 0x28), 4, 0, BX_READ, &newEAX); access_read_linear(Bit32u(nbase32 + 0x2c), 4, 0, BX_READ, &newECX); access_read_linear(Bit32u(nbase32 + 0x30), 4, 0, BX_READ, &newEDX); access_read_linear(Bit32u(nbase32 + 0x34), 4, 0, BX_READ, &newEBX); access_read_linear(Bit32u(nbase32 + 0x38), 4, 0, BX_READ, &newESP); access_read_linear(Bit32u(nbase32 + 0x3c), 4, 0, BX_READ, &newEBP); access_read_linear(Bit32u(nbase32 + 0x40), 4, 0, BX_READ, &newESI); access_read_linear(Bit32u(nbase32 + 0x44), 4, 0, BX_READ, &newEDI); access_read_linear(Bit32u(nbase32 + 0x48), 2, 0, BX_READ, &raw_es_selector); access_read_linear(Bit32u(nbase32 + 0x4c), 2, 0, BX_READ, &raw_cs_selector); access_read_linear(Bit32u(nbase32 + 0x50), 2, 0, BX_READ, &raw_ss_selector); access_read_linear(Bit32u(nbase32 + 0x54), 2, 0, BX_READ, &raw_ds_selector); access_read_linear(Bit32u(nbase32 + 0x58), 2, 0, BX_READ, &raw_fs_selector); access_read_linear(Bit32u(nbase32 + 0x5c), 2, 0, BX_READ, &raw_gs_selector); access_read_linear(Bit32u(nbase32 + 0x60), 2, 0, BX_READ, &raw_ldt_selector); access_read_linear(Bit32u(nbase32 + 0x64), 2, 0, BX_READ, &trap_word); } // Step 5: If CALL, interrupt, or JMP, set busy flag in new task's // TSS descriptor. If IRET, leave set. if (source == BX_TASK_FROM_JUMP || source == BX_TASK_FROM_CALL_OR_INT) { // set the new task's busy bit Bit32u laddr = (Bit32u)(BX_CPU_THIS_PTR gdtr.base) + (tss_selector->index<<3) + 4; access_read_linear(laddr, 4, 0, BX_READ, &dword2); dword2 |= 0x200; access_write_linear(laddr, 4, 0, &dword2); } // Step 6: If JMP or IRET, clear busy bit in old task TSS descriptor, // otherwise leave set. // effect on Busy bit of old task if (source == BX_TASK_FROM_JUMP || source == BX_TASK_FROM_IRET) { // Bit is cleared Bit32u laddr = (Bit32u) BX_CPU_THIS_PTR gdtr.base + (BX_CPU_THIS_PTR tr.selector.index<<3) + 4; access_read_linear(laddr, 4, 0, BX_READ, &temp32); temp32 &= ~0x200; access_write_linear(laddr, 4, 0, &temp32); } // // Commit point. At this point, we commit to the new // context. If an unrecoverable error occurs in further // processing, we complete the task switch without performing // additional access and segment availablility checks and // generate the appropriate exception prior to beginning // execution of the new task. // // Step 7: Load the task register with the segment selector and // descriptor for the new task TSS. BX_CPU_THIS_PTR tr.selector = *tss_selector; BX_CPU_THIS_PTR tr.cache = *tss_descriptor; BX_CPU_THIS_PTR tr.cache.type |= 2; // mark TSS in TR as busy // Step 8: Set TS flag in the CR0 image stored in the new task TSS. BX_CPU_THIS_PTR cr0.set_TS(1); // Task switch clears LE/L3/L2/L1/L0 in DR7 BX_CPU_THIS_PTR dr7 &= ~0x00000155; // Step 9: If call or interrupt, set the NT flag in the eflags // image stored in new task's TSS. If IRET or JMP, // NT is restored from new TSS eflags image. (no change) // effect on NT flag of new task if (source == BX_TASK_FROM_CALL_OR_INT) { newEFLAGS |= EFlagsNTMask; // NT flag is set } // Step 10: Load the new task (dynamic) state from new TSS. // Any errors associated with loading and qualification of // segment descriptors in this step occur in the new task's // context. State loaded here includes LDTR, CR3, // EFLAGS, EIP, general purpose registers, and segment // descriptor parts of the segment registers. if ((tss_descriptor->type >= 9) && BX_CPU_THIS_PTR cr0.get_PG()) { // change CR3 only if it actually modified if (newCR3 != BX_CPU_THIS_PTR cr3) { SetCR3(newCR3); // Tell paging unit about new cr3 value BX_DEBUG (("task_switch changing CR3 to 0x" FMT_PHY_ADDRX, newCR3)); BX_INSTR_TLB_CNTRL(BX_CPU_ID, BX_INSTR_TASKSWITCH, newCR3); } } BX_CPU_THIS_PTR prev_rip = EIP = newEIP; EAX = newEAX; ECX = newECX; EDX = newEDX; EBX = newEBX; ESP = newESP; EBP = newEBP; ESI = newESI; EDI = newEDI; writeEFlags(newEFLAGS, EFlagsValidMask); // Fill in selectors for all segment registers. If errors // occur later, the selectors will at least be loaded. parse_selector(raw_cs_selector, &cs_selector); BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector = cs_selector; parse_selector(raw_ds_selector, &ds_selector); BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].selector = ds_selector; parse_selector(raw_es_selector, &es_selector); BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES].selector = es_selector; parse_selector(raw_ss_selector, &ss_selector); BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].selector = ss_selector; parse_selector(raw_fs_selector, &fs_selector); BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS].selector = fs_selector; parse_selector(raw_gs_selector, &gs_selector); BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS].selector = gs_selector; parse_selector(raw_ldt_selector, &ldt_selector); BX_CPU_THIS_PTR ldtr.selector = ldt_selector; // Start out with invalid descriptor caches, fill in // with values only as they are validated. BX_CPU_THIS_PTR ldtr.cache.valid = 0; BX_CPU_THIS_PTR ldtr.cache.u.system.limit = 0; BX_CPU_THIS_PTR ldtr.cache.u.system.limit_scaled = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES].cache.valid = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.valid = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].cache.valid = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.valid = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS].cache.valid = 0; BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS].cache.valid = 0; // LDTR if (ldt_selector.ti) { // LDT selector must be in GDT BX_INFO(("task_switch(exception after commit point): bad LDT selector TI=1")); exception(BX_TS_EXCEPTION, raw_ldt_selector & 0xfffc, 0); } if ((raw_ldt_selector & 0xfffc) != 0) { bx_bool good = fetch_raw_descriptor2(&ldt_selector, &dword1, &dword2); if (!good) { BX_ERROR(("task_switch(exception after commit point): bad LDT fetch")); exception(BX_TS_EXCEPTION, raw_ldt_selector & 0xfffc, 0); } parse_descriptor(dword1, dword2, &ldt_descriptor); // LDT selector of new task is valid, else #TS(new task's LDT) if (ldt_descriptor.valid==0 || ldt_descriptor.type!=BX_SYS_SEGMENT_LDT || ldt_descriptor.segment) { BX_ERROR(("task_switch(exception after commit point): bad LDT segment")); exception(BX_TS_EXCEPTION, raw_ldt_selector & 0xfffc, 0); } // LDT of new task is present in memory, else #TS(new tasks's LDT) if (! IS_PRESENT(ldt_descriptor)) { BX_ERROR(("task_switch(exception after commit point): LDT not present")); exception(BX_TS_EXCEPTION, raw_ldt_selector & 0xfffc, 0); } // All checks pass, fill in LDTR shadow cache BX_CPU_THIS_PTR ldtr.cache = ldt_descriptor; } else { // NULL LDT selector is OK, leave cache invalid } if (v8086_mode()) { // load seg regs as 8086 registers load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS], raw_cs_selector); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS], raw_ss_selector); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS], raw_ds_selector); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES], raw_es_selector); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS], raw_fs_selector); load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS], raw_gs_selector); } else { // SS if ((raw_ss_selector & 0xfffc) != 0) { bx_bool good = fetch_raw_descriptor2(&ss_selector, &dword1, &dword2); if (!good) { BX_ERROR(("task_switch(exception after commit point): bad SS fetch")); exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc, 0); } parse_descriptor(dword1, dword2, &ss_descriptor); // SS selector must be within its descriptor table limits else #TS(SS) // SS descriptor AR byte must must indicate writable data segment, // else #TS(SS) if (ss_descriptor.valid==0 || ss_descriptor.segment==0 || IS_CODE_SEGMENT(ss_descriptor.type) || !IS_DATA_SEGMENT_WRITEABLE(ss_descriptor.type)) { BX_ERROR(("task_switch(exception after commit point): SS not valid or writeable segment")); exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc, 0); } // // Stack segment is present in memory, else #SS(new stack segment) // if (! IS_PRESENT(ss_descriptor)) { BX_ERROR(("task_switch(exception after commit point): SS not present")); exception(BX_SS_EXCEPTION, raw_ss_selector & 0xfffc, 0); } // Stack segment DPL matches CS.RPL, else #TS(new stack segment) if (ss_descriptor.dpl != cs_selector.rpl) { BX_ERROR(("task_switch(exception after commit point): SS.rpl != CS.RPL")); exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc, 0); } // Stack segment DPL matches selector RPL, else #TS(new stack segment) if (ss_descriptor.dpl != ss_selector.rpl) { BX_ERROR(("task_switch(exception after commit point): SS.dpl != SS.rpl")); exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc, 0); } // All checks pass, fill in shadow cache BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].cache = ss_descriptor; } else { // SS selector is valid, else #TS(new stack segment) BX_ERROR(("task_switch(exception after commit point): SS NULL")); exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc, 0); } // if new selector is not null then perform following checks: // index must be within its descriptor table limits else #TS(selector) // AR byte must indicate data or readable code else #TS(selector) // if data or non-conforming code then: // DPL must be >= CPL else #TS(selector) // DPL must be >= RPL else #TS(selector) // AR byte must indicate PRESENT else #NP(selector) // load cache with new segment descriptor and set valid bit // CS if ((raw_cs_selector & 0xfffc) != 0) { bx_bool good = fetch_raw_descriptor2(&cs_selector, &dword1, &dword2); if (!good) { BX_ERROR(("task_switch(exception after commit point): bad CS fetch")); exception(BX_TS_EXCEPTION, raw_cs_selector & 0xfffc, 0); } parse_descriptor(dword1, dword2, &cs_descriptor); // CS descriptor AR byte must indicate code segment else #TS(CS) if (cs_descriptor.valid==0 || cs_descriptor.segment==0 || IS_DATA_SEGMENT(cs_descriptor.type)) { BX_ERROR(("task_switch(exception after commit point): CS not valid executable seg")); exception(BX_TS_EXCEPTION, raw_cs_selector & 0xfffc, 0); } // if non-conforming then DPL must equal selector RPL else #TS(CS) if (IS_CODE_SEGMENT_NON_CONFORMING(cs_descriptor.type) && cs_descriptor.dpl != cs_selector.rpl) { BX_ERROR(("task_switch(exception after commit point): non-conforming: CS.dpl!=CS.RPL")); exception(BX_TS_EXCEPTION, raw_cs_selector & 0xfffc, 0); } // if conforming then DPL must be <= selector RPL else #TS(CS) if (IS_CODE_SEGMENT_CONFORMING(cs_descriptor.type) && cs_descriptor.dpl > cs_selector.rpl) { BX_ERROR(("task_switch(exception after commit point): conforming: CS.dpl>RPL")); exception(BX_TS_EXCEPTION, raw_cs_selector & 0xfffc, 0); } // Code segment is present in memory, else #NP(new code segment) if (! IS_PRESENT(cs_descriptor)) { BX_ERROR(("task_switch(exception after commit point): CS.p==0")); exception(BX_NP_EXCEPTION, raw_cs_selector & 0xfffc, 0); } // All checks pass, fill in shadow cache BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache = cs_descriptor; } else { // If new cs selector is null #TS(CS) BX_ERROR(("task_switch(exception after commit point): CS NULL")); exception(BX_TS_EXCEPTION, raw_cs_selector & 0xfffc, 0); } #if BX_SUPPORT_ICACHE BX_CPU_THIS_PTR updateFetchModeMask(); #endif #if BX_CPU_LEVEL >= 4 && BX_SUPPORT_ALIGNMENT_CHECK handleAlignmentCheck(); // task switch, CPL was modified #endif task_switch_load_selector(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS], &ds_selector, raw_ds_selector, cs_selector.rpl); task_switch_load_selector(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES], &es_selector, raw_es_selector, cs_selector.rpl); task_switch_load_selector(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS], &fs_selector, raw_fs_selector, cs_selector.rpl); task_switch_load_selector(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS], &gs_selector, raw_gs_selector, cs_selector.rpl); } if ((tss_descriptor->type>=9) && (trap_word & 0x1)) { BX_CPU_THIS_PTR debug_trap |= 0x00008000; // BT flag in DR6 BX_CPU_THIS_PTR async_event = 1; // so processor knows to check BX_INFO(("task_switch: T bit set in new TSS")); } // // Step 14: Begin execution of new task. // BX_DEBUG(("TASKING: LEAVE")); }