1 /*

     2  *  i386 helpers (without register variable usage)

     3  *

     4  *  Copyright (c) 2003 Fabrice Bellard

     5  *

     6  * This library is free software; you can redistribute it and/or

     7  * modify it under the terms of the GNU Lesser General Public

     8  * License as published by the Free Software Foundation; either

     9  * version 2 of the License, or (at your option) any later version.

    10  *

    11  * This library is distributed in the hope that it will be useful,

    12  * but WITHOUT ANY WARRANTY; without even the implied warranty of

    13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

    14  * Lesser General Public License for more details.

    15  *

    16  * You should have received a copy of the GNU Lesser General Public

    17  * License along with this library; if not, write to the Free Software

    18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

    19  */

    20 #include <stdarg.h>

    21 #include <stdlib.h>

    22 #include <stdio.h>

    23 #include <string.h>

    24 #include <inttypes.h>

    25 #include <signal.h>

    26 #include <assert.h>

    27 

    28 #include "cpu.h"

    29 #include "exec-all.h"

    30 #include "qemu-common.h"

    31 #include "kvm.h"

    32 

    33 //#define DEBUG_MMU

    34 

    35 static void add_flagname_to_bitmaps(char *flagname, uint32_t *features, 

    36                                     uint32_t *ext_features, 

    37                                     uint32_t *ext2_features, 

    38                                     uint32_t *ext3_features)

    39 {

    40     int i;

    41     /* feature flags taken from "Intel Processor Identification and the CPUID

    42      * Instruction" and AMD's "CPUID Specification". In cases of disagreement 

    43      * about feature names, the Linux name is used. */

    44     static const char *feature_name[] = {

    45         "fpu", "vme", "de", "pse", "tsc", "msr", "pae", "mce",

    46         "cx8", "apic", NULL, "sep", "mtrr", "pge", "mca", "cmov",

    47         "pat", "pse36", "pn" /* Intel psn */, "clflush" /* Intel clfsh */, NULL, "ds" /* Intel dts */, "acpi", "mmx",

    48         "fxsr", "sse", "sse2", "ss", "ht" /* Intel htt */, "tm", "ia64", "pbe",

    49     };

    50     static const char *ext_feature_name[] = {

    51        "pni" /* Intel,AMD sse3 */, NULL, NULL, "monitor", "ds_cpl", "vmx", NULL /* Linux smx */, "est",

    52        "tm2", "ssse3", "cid", NULL, NULL, "cx16", "xtpr", NULL,

    53        NULL, NULL, "dca", NULL, NULL, NULL, NULL, "popcnt",

    54        NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,

    55     };

    56     static const char *ext2_feature_name[] = {

    57        "fpu", "vme", "de", "pse", "tsc", "msr", "pae", "mce",

    58        "cx8" /* AMD CMPXCHG8B */, "apic", NULL, "syscall", "mttr", "pge", "mca", "cmov",

    59        "pat", "pse36", NULL, NULL /* Linux mp */, "nx" /* Intel xd */, NULL, "mmxext", "mmx",

    60        "fxsr", "fxsr_opt" /* AMD ffxsr */, "pdpe1gb" /* AMD Page1GB */, "rdtscp", NULL, "lm" /* Intel 64 */, "3dnowext", "3dnow",

    61     };

    62     static const char *ext3_feature_name[] = {

    63        "lahf_lm" /* AMD LahfSahf */, "cmp_legacy", "svm", "extapic" /* AMD ExtApicSpace */, "cr8legacy" /* AMD AltMovCr8 */, "abm", "sse4a", "misalignsse",

    64        "3dnowprefetch", "osvw", NULL /* Linux ibs */, NULL, "skinit", "wdt", NULL, NULL,

    65        NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,

    66        NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,

    67     };

    68 

    69     for ( i = 0 ; i < 32 ; i++ ) 

    70         if (feature_name[i] && !strcmp (flagname, feature_name[i])) {

    71             *features |= 1 << i;

    72             return;

    73         }

    74     for ( i = 0 ; i < 32 ; i++ ) 

    75         if (ext_feature_name[i] && !strcmp (flagname, ext_feature_name[i])) {

    76             *ext_features |= 1 << i;

    77             return;

    78         }

    79     for ( i = 0 ; i < 32 ; i++ ) 

    80         if (ext2_feature_name[i] && !strcmp (flagname, ext2_feature_name[i])) {

    81             *ext2_features |= 1 << i;

    82             return;

    83         }

    84     for ( i = 0 ; i < 32 ; i++ ) 

    85         if (ext3_feature_name[i] && !strcmp (flagname, ext3_feature_name[i])) {

    86             *ext3_features |= 1 << i;

    87             return;

    88         }

    89     fprintf(stderr, "CPU feature %s not found\n", flagname);

    90 }

    91 

    92 typedef struct x86_def_t {

    93     const char *name;

    94     uint32_t level;

    95     uint32_t vendor1, vendor2, vendor3;

    96     int family;

    97     int model;

    98     int stepping;

    99     uint32_t features, ext_features, ext2_features, ext3_features;

   100     uint32_t xlevel;

   101     char model_id[48];

   102 } x86_def_t;

   103 

   104 #define I486_FEATURES (CPUID_FP87 | CPUID_VME | CPUID_PSE)

   105 #define PENTIUM_FEATURES (I486_FEATURES | CPUID_DE | CPUID_TSC | \

   106           CPUID_MSR | CPUID_MCE | CPUID_CX8 | CPUID_MMX)

   107 #define PENTIUM2_FEATURES (PENTIUM_FEATURES | CPUID_PAE | CPUID_SEP | \

   108           CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV | CPUID_PAT | \

   109           CPUID_PSE36 | CPUID_FXSR)

   110 #define PENTIUM3_FEATURES (PENTIUM2_FEATURES | CPUID_SSE)

   111 #define PPRO_FEATURES (CPUID_FP87 | CPUID_DE | CPUID_PSE | CPUID_TSC | \

   112           CPUID_MSR | CPUID_MCE | CPUID_CX8 | CPUID_PGE | CPUID_CMOV | \

   113           CPUID_PAT | CPUID_FXSR | CPUID_MMX | CPUID_SSE | CPUID_SSE2 | \

   114           CPUID_PAE | CPUID_SEP | CPUID_APIC)

   115 static x86_def_t x86_defs[] = {

   116 #ifdef TARGET_X86_64

   117     {

   118         .name = "qemu64",

   119         .level = 2,

   120         .vendor1 = CPUID_VENDOR_AMD_1,

   121         .vendor2 = CPUID_VENDOR_AMD_2,

   122         .vendor3 = CPUID_VENDOR_AMD_3,

   123         .family = 6,

   124         .model = 2,

   125         .stepping = 3,

   126         .features = PPRO_FEATURES | 

   127         /* these features are needed for Win64 and aren't fully implemented */

   128             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA |

   129         /* this feature is needed for Solaris and isn't fully implemented */

   130             CPUID_PSE36,

   131         .ext_features = CPUID_EXT_SSE3,

   132         .ext2_features = (PPRO_FEATURES & 0x0183F3FF) | 

   133             CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX |

   134             CPUID_EXT2_3DNOW | CPUID_EXT2_3DNOWEXT,

   135         .ext3_features = CPUID_EXT3_SVM,

   136         .xlevel = 0x8000000A,

   137         .model_id = "QEMU Virtual CPU version " QEMU_VERSION,

   138     },

   139     {

   140         .name = "core2duo",

   141         .level = 10,

   142         .family = 6,

   143         .model = 15,

   144         .stepping = 11,

   145 	/* The original CPU also implements these features:

   146                CPUID_VME, CPUID_DTS, CPUID_ACPI, CPUID_SS, CPUID_HT,

   147                CPUID_TM, CPUID_PBE */

   148         .features = PPRO_FEATURES |

   149             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA |

   150             CPUID_PSE36,

   151 	/* The original CPU also implements these ext features:

   152                CPUID_EXT_DTES64, CPUID_EXT_DSCPL, CPUID_EXT_VMX, CPUID_EXT_EST,

   153                CPUID_EXT_TM2, CPUID_EXT_CX16, CPUID_EXT_XTPR, CPUID_EXT_PDCM */

   154         .ext_features = CPUID_EXT_SSE3 | CPUID_EXT_MONITOR | CPUID_EXT_SSSE3,

   155         .ext2_features = CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,

   156         /* Missing: .ext3_features = CPUID_EXT3_LAHF_LM */

   157         .xlevel = 0x80000008,

   158         .model_id = "Intel(R) Core(TM)2 Duo CPU     T7700  @ 2.40GHz",

   159     },

   160 #endif

   161     {

   162         .name = "qemu32",

   163         .level = 2,

   164         .family = 6,

   165         .model = 3,

   166         .stepping = 3,

   167         .features = PPRO_FEATURES,

   168         .ext_features = CPUID_EXT_SSE3,

   169         .xlevel = 0,

   170         .model_id = "QEMU Virtual CPU version " QEMU_VERSION,

   171     },

   172     {

   173         .name = "coreduo",

   174         .level = 10,

   175         .family = 6,

   176         .model = 14,

   177         .stepping = 8,

   178         /* The original CPU also implements these features:

   179                CPUID_DTS, CPUID_ACPI, CPUID_SS, CPUID_HT,

   180                CPUID_TM, CPUID_PBE */

   181         .features = PPRO_FEATURES | CPUID_VME |

   182             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA,

   183         /* The original CPU also implements these ext features:

   184                CPUID_EXT_VMX, CPUID_EXT_EST, CPUID_EXT_TM2, CPUID_EXT_XTPR,

   185                CPUID_EXT_PDCM */

   186         .ext_features = CPUID_EXT_SSE3 | CPUID_EXT_MONITOR,

   187         .ext2_features = CPUID_EXT2_NX,

   188         .xlevel = 0x80000008,

   189         .model_id = "Genuine Intel(R) CPU           T2600  @ 2.16GHz",

   190     },

   191     {

   192         .name = "486",

   193         .level = 0,

   194         .family = 4,

   195         .model = 0,

   196         .stepping = 0,

   197         .features = I486_FEATURES,

   198         .xlevel = 0,

   199     },

   200     {

   201         .name = "pentium",

   202         .level = 1,

   203         .family = 5,

   204         .model = 4,

   205         .stepping = 3,

   206         .features = PENTIUM_FEATURES,

   207         .xlevel = 0,

   208     },

   209     {

   210         .name = "pentium2",

   211         .level = 2,

   212         .family = 6,

   213         .model = 5,

   214         .stepping = 2,

   215         .features = PENTIUM2_FEATURES,

   216         .xlevel = 0,

   217     },

   218     {

   219         .name = "pentium3",

   220         .level = 2,

   221         .family = 6,

   222         .model = 7,

   223         .stepping = 3,

   224         .features = PENTIUM3_FEATURES,

   225         .xlevel = 0,

   226     },

   227     {

   228         .name = "athlon",

   229         .level = 2,

   230         .vendor1 = 0x68747541, /* "Auth" */

   231         .vendor2 = 0x69746e65, /* "enti" */

   232         .vendor3 = 0x444d4163, /* "cAMD" */

   233         .family = 6,

   234         .model = 2,

   235         .stepping = 3,

   236         .features = PPRO_FEATURES | CPUID_PSE36 | CPUID_VME | CPUID_MTRR | CPUID_MCA,

   237         .ext2_features = (PPRO_FEATURES & 0x0183F3FF) | CPUID_EXT2_MMXEXT | CPUID_EXT2_3DNOW | CPUID_EXT2_3DNOWEXT,

   238         .xlevel = 0x80000008,

   239         /* XXX: put another string ? */

   240         .model_id = "QEMU Virtual CPU version " QEMU_VERSION,

   241     },

   242     {

   243         .name = "n270",

   244         /* original is on level 10 */

   245         .level = 5,

   246         .family = 6,

   247         .model = 28,

   248         .stepping = 2,

   249         .features = PPRO_FEATURES |

   250             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA | CPUID_VME,

   251             /* Missing: CPUID_DTS | CPUID_ACPI | CPUID_SS |

   252              * CPUID_HT | CPUID_TM | CPUID_PBE */

   253             /* Some CPUs got no CPUID_SEP */

   254         .ext_features = CPUID_EXT_MONITOR |

   255             CPUID_EXT_SSE3 /* PNI */ | CPUID_EXT_SSSE3,

   256             /* Missing: CPUID_EXT_DSCPL | CPUID_EXT_EST |

   257              * CPUID_EXT_TM2 | CPUID_EXT_XTPR */

   258         .ext2_features = (PPRO_FEATURES & 0x0183F3FF) | CPUID_EXT2_NX,

   259         /* Missing: .ext3_features = CPUID_EXT3_LAHF_LM */

   260         .xlevel = 0x8000000A,

   261         .model_id = "Intel(R) Atom(TM) CPU N270   @ 1.60GHz",

   262     },

   263 };

   264 

   265 static int cpu_x86_find_by_name(x86_def_t *x86_cpu_def, const char *cpu_model)

   266 {

   267     unsigned int i;

   268     x86_def_t *def;

   269 

   270     char *s = strdup(cpu_model);

   271     char *featurestr, *name = strtok(s, ",");

   272     uint32_t plus_features = 0, plus_ext_features = 0, plus_ext2_features = 0, plus_ext3_features = 0;

   273     uint32_t minus_features = 0, minus_ext_features = 0, minus_ext2_features = 0, minus_ext3_features = 0;

   274     int family = -1, model = -1, stepping = -1;

   275 

   276     def = NULL;

   277     for (i = 0; i < ARRAY_SIZE(x86_defs); i++) {

   278         if (strcmp(name, x86_defs[i].name) == 0) {

   279             def = &x86_defs[i];

   280             break;

   281         }

   282     }

   283     if (!def)

   284         goto error;

   285     memcpy(x86_cpu_def, def, sizeof(*def));

   286 

   287     featurestr = strtok(NULL, ",");

   288 

   289     while (featurestr) {

   290         char *val;

   291         if (featurestr[0] == '+') {

   292             add_flagname_to_bitmaps(featurestr + 1, &plus_features, &plus_ext_features, &plus_ext2_features, &plus_ext3_features);

   293         } else if (featurestr[0] == '-') {

   294             add_flagname_to_bitmaps(featurestr + 1, &minus_features, &minus_ext_features, &minus_ext2_features, &minus_ext3_features);

   295         } else if ((val = strchr(featurestr, '='))) {

   296             *val = 0; val++;

   297             if (!strcmp(featurestr, "family")) {

   298                 char *err;

   299                 family = strtol(val, &err, 10);

   300                 if (!*val || *err || family < 0) {

   301                     fprintf(stderr, "bad numerical value %s\n", val);

   302                     goto error;

   303                 }

   304                 x86_cpu_def->family = family;

   305             } else if (!strcmp(featurestr, "model")) {

   306                 char *err;

   307                 model = strtol(val, &err, 10);

   308                 if (!*val || *err || model < 0 || model > 0xff) {

   309                     fprintf(stderr, "bad numerical value %s\n", val);

   310                     goto error;

   311                 }

   312                 x86_cpu_def->model = model;

   313             } else if (!strcmp(featurestr, "stepping")) {

   314                 char *err;

   315                 stepping = strtol(val, &err, 10);

   316                 if (!*val || *err || stepping < 0 || stepping > 0xf) {

   317                     fprintf(stderr, "bad numerical value %s\n", val);

   318                     goto error;

   319                 }

   320                 x86_cpu_def->stepping = stepping;

   321             } else if (!strcmp(featurestr, "vendor")) {

   322                 if (strlen(val) != 12) {

   323                     fprintf(stderr, "vendor string must be 12 chars long\n");

   324                     goto error;

   325                 }

   326                 x86_cpu_def->vendor1 = 0;

   327                 x86_cpu_def->vendor2 = 0;

   328                 x86_cpu_def->vendor3 = 0;

   329                 for(i = 0; i < 4; i++) {

   330                     x86_cpu_def->vendor1 |= ((uint8_t)val[i    ]) << (8 * i);

   331                     x86_cpu_def->vendor2 |= ((uint8_t)val[i + 4]) << (8 * i);

   332                     x86_cpu_def->vendor3 |= ((uint8_t)val[i + 8]) << (8 * i);

   333                 }

   334             } else if (!strcmp(featurestr, "model_id")) {

   335                 pstrcpy(x86_cpu_def->model_id, sizeof(x86_cpu_def->model_id),

   336                         val);

   337             } else {

   338                 fprintf(stderr, "unrecognized feature %s\n", featurestr);

   339                 goto error;

   340             }

   341         } else {

   342             fprintf(stderr, "feature string `%s' not in format (+feature|-feature|feature=xyz)\n", featurestr);

   343             goto error;

   344         }

   345         featurestr = strtok(NULL, ",");

   346     }

   347     x86_cpu_def->features |= plus_features;

   348     x86_cpu_def->ext_features |= plus_ext_features;

   349     x86_cpu_def->ext2_features |= plus_ext2_features;

   350     x86_cpu_def->ext3_features |= plus_ext3_features;

   351     x86_cpu_def->features &= ~minus_features;

   352     x86_cpu_def->ext_features &= ~minus_ext_features;

   353     x86_cpu_def->ext2_features &= ~minus_ext2_features;

   354     x86_cpu_def->ext3_features &= ~minus_ext3_features;

   355     free(s);

   356     return 0;

   357 

   358 error:

   359     free(s);

   360     return -1;

   361 }

   362 

   363 void x86_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))

   364 {

   365     unsigned int i;

   366 

   367     for (i = 0; i < ARRAY_SIZE(x86_defs); i++)

   368         (*cpu_fprintf)(f, "x86 %16s\n", x86_defs[i].name);

   369 }

   370 

   371 static int cpu_x86_register (CPUX86State *env, const char *cpu_model)

   372 {

   373     x86_def_t def1, *def = &def1;

   374 

   375     if (cpu_x86_find_by_name(def, cpu_model) < 0)

   376         return -1;

   377     if (def->vendor1) {

   378         env->cpuid_vendor1 = def->vendor1;

   379         env->cpuid_vendor2 = def->vendor2;

   380         env->cpuid_vendor3 = def->vendor3;

   381     } else {

   382         env->cpuid_vendor1 = CPUID_VENDOR_INTEL_1;

   383         env->cpuid_vendor2 = CPUID_VENDOR_INTEL_2;

   384         env->cpuid_vendor3 = CPUID_VENDOR_INTEL_3;

   385     }

   386     env->cpuid_level = def->level;

   387     if (def->family > 0x0f)

   388         env->cpuid_version = 0xf00 | ((def->family - 0x0f) << 20);

   389     else

   390         env->cpuid_version = def->family << 8;

   391     env->cpuid_version |= ((def->model & 0xf) << 4) | ((def->model >> 4) << 16);

   392     env->cpuid_version |= def->stepping;

   393     env->cpuid_features = def->features;

   394     env->pat = 0x0007040600070406ULL;

   395     env->cpuid_ext_features = def->ext_features;

   396     env->cpuid_ext2_features = def->ext2_features;

   397     env->cpuid_xlevel = def->xlevel;

   398     env->cpuid_ext3_features = def->ext3_features;

   399     {

   400         const char *model_id = def->model_id;

   401         int c, len, i;

   402         if (!model_id)

   403             model_id = "";

   404         len = strlen(model_id);

   405         for(i = 0; i < 48; i++) {

   406             if (i >= len)

   407                 c = '\0';

   408             else

   409                 c = (uint8_t)model_id[i];

   410             env->cpuid_model[i >> 2] |= c << (8 * (i & 3));

   411         }

   412     }

   413     return 0;

   414 }

   415 

   416 /* NOTE: must be called outside the CPU execute loop */

   417 void cpu_reset(CPUX86State *env)

   418 {

   419     int i;

   420 

   421     memset(env, 0, offsetof(CPUX86State, breakpoints));

   422 

   423     tlb_flush(env, 1);

   424 

   425     env->old_exception = -1;

   426 

   427     /* init to reset state */

   428 

   429 #ifdef CONFIG_SOFTMMU

   430     env->hflags |= HF_SOFTMMU_MASK;

   431 #endif

   432     env->hflags2 |= HF2_GIF_MASK;

   433 

   434     cpu_x86_update_cr0(env, 0x60000010);

   435     env->a20_mask = ~0x0;

   436     env->smbase = 0x30000;

   437 

   438     env->idt.limit = 0xffff;

   439     env->gdt.limit = 0xffff;

   440     env->ldt.limit = 0xffff;

   441     env->ldt.flags = DESC_P_MASK | (2 << DESC_TYPE_SHIFT);

   442     env->tr.limit = 0xffff;

   443     env->tr.flags = DESC_P_MASK | (11 << DESC_TYPE_SHIFT);

   444 

   445     cpu_x86_load_seg_cache(env, R_CS, 0xf000, 0xffff0000, 0xffff,

   446                            DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK | DESC_R_MASK);

   447     cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0xffff,

   448                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);

   449     cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0xffff,

   450                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);

   451     cpu_x86_load_seg_cache(env, R_SS, 0, 0, 0xffff,

   452                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);

   453     cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0xffff,

   454                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);

   455     cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0xffff,

   456                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);

   457 

   458     env->eip = 0xfff0;

   459     env->regs[R_EDX] = env->cpuid_version;

   460 

   461     env->eflags = 0x2;

   462 

   463     /* FPU init */

   464     for(i = 0;i < 8; i++)

   465         env->fptags[i] = 1;

   466     env->fpuc = 0x37f;

   467 

   468     env->mxcsr = 0x1f80;

   469 

   470     memset(env->dr, 0, sizeof(env->dr));

   471     env->dr[6] = DR6_FIXED_1;

   472     env->dr[7] = DR7_FIXED_1;

   473     cpu_breakpoint_remove_all(env, BP_CPU);

   474     cpu_watchpoint_remove_all(env, BP_CPU);

   475 }

   476 

   477 void cpu_x86_close(CPUX86State *env)

   478 {

   479     qemu_free(env);

   480 }

   481 

   482 /***********************************************************/

   483 /* x86 debug */

   484 

   485 static const char *cc_op_str[] = {

   486     "DYNAMIC",

   487     "EFLAGS",

   488 

   489     "MULB",

   490     "MULW",

   491     "MULL",

   492     "MULQ",

   493 

   494     "ADDB",

   495     "ADDW",

   496     "ADDL",

   497     "ADDQ",

   498 

   499     "ADCB",

   500     "ADCW",

   501     "ADCL",

   502     "ADCQ",

   503 

   504     "SUBB",

   505     "SUBW",

   506     "SUBL",

   507     "SUBQ",

   508 

   509     "SBBB",

   510     "SBBW",

   511     "SBBL",

   512     "SBBQ",

   513 

   514     "LOGICB",

   515     "LOGICW",

   516     "LOGICL",

   517     "LOGICQ",

   518 

   519     "INCB",

   520     "INCW",

   521     "INCL",

   522     "INCQ",

   523 

   524     "DECB",

   525     "DECW",

   526     "DECL",

   527     "DECQ",

   528 

   529     "SHLB",

   530     "SHLW",

   531     "SHLL",

   532     "SHLQ",

   533 

   534     "SARB",

   535     "SARW",

   536     "SARL",

   537     "SARQ",

   538 };

   539 

   540 void cpu_dump_state(CPUState *env, FILE *f,

   541                     int (*cpu_fprintf)(FILE *f, const char *fmt, ...),

   542                     int flags)

   543 {

   544     int eflags, i, nb;

   545     char cc_op_name[32];

   546     static const char *seg_name[6] = { "ES", "CS", "SS", "DS", "FS", "GS" };

   547 

   548     eflags = env->eflags;

   549 #ifdef TARGET_X86_64

   550     if (env->hflags & HF_CS64_MASK) {

   551         cpu_fprintf(f,

   552                     "RAX=%016" PRIx64 " RBX=%016" PRIx64 " RCX=%016" PRIx64 " RDX=%016" PRIx64 "\n"

   553                     "RSI=%016" PRIx64 " RDI=%016" PRIx64 " RBP=%016" PRIx64 " RSP=%016" PRIx64 "\n"

   554                     "R8 =%016" PRIx64 " R9 =%016" PRIx64 " R10=%016" PRIx64 " R11=%016" PRIx64 "\n"

   555                     "R12=%016" PRIx64 " R13=%016" PRIx64 " R14=%016" PRIx64 " R15=%016" PRIx64 "\n"

   556                     "RIP=%016" PRIx64 " RFL=%08x [%c%c%c%c%c%c%c] CPL=%d II=%d A20=%d SMM=%d HLT=%d\n",

   557                     env->regs[R_EAX],

   558                     env->regs[R_EBX],

   559                     env->regs[R_ECX],

   560                     env->regs[R_EDX],

   561                     env->regs[R_ESI],

   562                     env->regs[R_EDI],

   563                     env->regs[R_EBP],

   564                     env->regs[R_ESP],

   565                     env->regs[8],

   566                     env->regs[9],

   567                     env->regs[10],

   568                     env->regs[11],

   569                     env->regs[12],

   570                     env->regs[13],

   571                     env->regs[14],

   572                     env->regs[15],

   573                     env->eip, eflags,

   574                     eflags & DF_MASK ? 'D' : '-',

   575                     eflags & CC_O ? 'O' : '-',

   576                     eflags & CC_S ? 'S' : '-',

   577                     eflags & CC_Z ? 'Z' : '-',

   578                     eflags & CC_A ? 'A' : '-',

   579                     eflags & CC_P ? 'P' : '-',

   580                     eflags & CC_C ? 'C' : '-',

   581                     env->hflags & HF_CPL_MASK,

   582                     (env->hflags >> HF_INHIBIT_IRQ_SHIFT) & 1,

   583                     (int)(env->a20_mask >> 20) & 1,

   584                     (env->hflags >> HF_SMM_SHIFT) & 1,

   585                     env->halted);

   586     } else

   587 #endif

   588     {

   589         cpu_fprintf(f, "EAX=%08x EBX=%08x ECX=%08x EDX=%08x\n"

   590                     "ESI=%08x EDI=%08x EBP=%08x ESP=%08x\n"

   591                     "EIP=%08x EFL=%08x [%c%c%c%c%c%c%c] CPL=%d II=%d A20=%d SMM=%d HLT=%d\n",

   592                     (uint32_t)env->regs[R_EAX],

   593                     (uint32_t)env->regs[R_EBX],

   594                     (uint32_t)env->regs[R_ECX],

   595                     (uint32_t)env->regs[R_EDX],

   596                     (uint32_t)env->regs[R_ESI],

   597                     (uint32_t)env->regs[R_EDI],

   598                     (uint32_t)env->regs[R_EBP],

   599                     (uint32_t)env->regs[R_ESP],

   600                     (uint32_t)env->eip, eflags,

   601                     eflags & DF_MASK ? 'D' : '-',

   602                     eflags & CC_O ? 'O' : '-',

   603                     eflags & CC_S ? 'S' : '-',

   604                     eflags & CC_Z ? 'Z' : '-',

   605                     eflags & CC_A ? 'A' : '-',

   606                     eflags & CC_P ? 'P' : '-',

   607                     eflags & CC_C ? 'C' : '-',

   608                     env->hflags & HF_CPL_MASK,

   609                     (env->hflags >> HF_INHIBIT_IRQ_SHIFT) & 1,

   610                     (int)(env->a20_mask >> 20) & 1,

   611                     (env->hflags >> HF_SMM_SHIFT) & 1,

   612                     env->halted);

   613     }

   614 

   615 #ifdef TARGET_X86_64

   616     if (env->hflags & HF_LMA_MASK) {

   617         for(i = 0; i < 6; i++) {

   618             SegmentCache *sc = &env->segs[i];

   619             cpu_fprintf(f, "%s =%04x %016" PRIx64 " %08x %08x\n",

   620                         seg_name[i],

   621                         sc->selector,

   622                         sc->base,

   623                         sc->limit,

   624                         sc->flags);

   625         }

   626         cpu_fprintf(f, "LDT=%04x %016" PRIx64 " %08x %08x\n",

   627                     env->ldt.selector,

   628                     env->ldt.base,

   629                     env->ldt.limit,

   630                     env->ldt.flags);

   631         cpu_fprintf(f, "TR =%04x %016" PRIx64 " %08x %08x\n",

   632                     env->tr.selector,

   633                     env->tr.base,

   634                     env->tr.limit,

   635                     env->tr.flags);

   636         cpu_fprintf(f, "GDT=     %016" PRIx64 " %08x\n",

   637                     env->gdt.base, env->gdt.limit);

   638         cpu_fprintf(f, "IDT=     %016" PRIx64 " %08x\n",

   639                     env->idt.base, env->idt.limit);

   640         cpu_fprintf(f, "CR0=%08x CR2=%016" PRIx64 " CR3=%016" PRIx64 " CR4=%08x\n",

   641                     (uint32_t)env->cr[0],

   642                     env->cr[2],

   643                     env->cr[3],

   644                     (uint32_t)env->cr[4]);

   645         for(i = 0; i < 4; i++)

   646             cpu_fprintf(f, "DR%d=%016" PRIx64 " ", i, env->dr[i]);

   647         cpu_fprintf(f, "\nDR6=%016" PRIx64 " DR7=%016" PRIx64 "\n",

   648                     env->dr[6], env->dr[7]);

   649     } else

   650 #endif

   651     {

   652         for(i = 0; i < 6; i++) {

   653             SegmentCache *sc = &env->segs[i];

   654             cpu_fprintf(f, "%s =%04x %08x %08x %08x\n",

   655                         seg_name[i],

   656                         sc->selector,

   657                         (uint32_t)sc->base,

   658                         sc->limit,

   659                         sc->flags);

   660         }

   661         cpu_fprintf(f, "LDT=%04x %08x %08x %08x\n",

   662                     env->ldt.selector,

   663                     (uint32_t)env->ldt.base,

   664                     env->ldt.limit,

   665                     env->ldt.flags);

   666         cpu_fprintf(f, "TR =%04x %08x %08x %08x\n",

   667                     env->tr.selector,

   668                     (uint32_t)env->tr.base,

   669                     env->tr.limit,

   670                     env->tr.flags);

   671         cpu_fprintf(f, "GDT=     %08x %08x\n",

   672                     (uint32_t)env->gdt.base, env->gdt.limit);

   673         cpu_fprintf(f, "IDT=     %08x %08x\n",

   674                     (uint32_t)env->idt.base, env->idt.limit);

   675         cpu_fprintf(f, "CR0=%08x CR2=%08x CR3=%08x CR4=%08x\n",

   676                     (uint32_t)env->cr[0],

   677                     (uint32_t)env->cr[2],

   678                     (uint32_t)env->cr[3],

   679                     (uint32_t)env->cr[4]);

   680         for(i = 0; i < 4; i++)

   681             cpu_fprintf(f, "DR%d=%08x ", i, env->dr[i]);

   682         cpu_fprintf(f, "\nDR6=%08x DR7=%08x\n", env->dr[6], env->dr[7]);

   683     }

   684     if (flags & X86_DUMP_CCOP) {

   685         if ((unsigned)env->cc_op < CC_OP_NB)

   686             snprintf(cc_op_name, sizeof(cc_op_name), "%s", cc_op_str[env->cc_op]);

   687         else

   688             snprintf(cc_op_name, sizeof(cc_op_name), "[%d]", env->cc_op);

   689 #ifdef TARGET_X86_64

   690         if (env->hflags & HF_CS64_MASK) {

   691             cpu_fprintf(f, "CCS=%016" PRIx64 " CCD=%016" PRIx64 " CCO=%-8s\n",

   692                         env->cc_src, env->cc_dst,

   693                         cc_op_name);

   694         } else

   695 #endif

   696         {

   697             cpu_fprintf(f, "CCS=%08x CCD=%08x CCO=%-8s\n",

   698                         (uint32_t)env->cc_src, (uint32_t)env->cc_dst,

   699                         cc_op_name);

   700         }

   701     }

   702     if (flags & X86_DUMP_FPU) {

   703         int fptag;

   704         fptag = 0;

   705         for(i = 0; i < 8; i++) {

   706             fptag |= ((!env->fptags[i]) << i);

   707         }

   708         cpu_fprintf(f, "FCW=%04x FSW=%04x [ST=%d] FTW=%02x MXCSR=%08x\n",

   709                     env->fpuc,

   710                     (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11,

   711                     env->fpstt,

   712                     fptag,

   713                     env->mxcsr);

   714         for(i=0;i<8;i++) {

   715 #if defined(USE_X86LDOUBLE)

   716             union {

   717                 long double d;

   718                 struct {

   719                     uint64_t lower;

   720                     uint16_t upper;

   721                 } l;

   722             } tmp;

   723             tmp.d = env->fpregs[i].d;

   724             cpu_fprintf(f, "FPR%d=%016" PRIx64 " %04x",

   725                         i, tmp.l.lower, tmp.l.upper);

   726 #else

   727             cpu_fprintf(f, "FPR%d=%016" PRIx64,

   728                         i, env->fpregs[i].mmx.q);

   729 #endif

   730             if ((i & 1) == 1)

   731                 cpu_fprintf(f, "\n");

   732             else

   733                 cpu_fprintf(f, " ");

   734         }

   735         if (env->hflags & HF_CS64_MASK)

   736             nb = 16;

   737         else

   738             nb = 8;

   739         for(i=0;i<nb;i++) {

   740             cpu_fprintf(f, "XMM%02d=%08x%08x%08x%08x",

   741                         i,

   742                         env->xmm_regs[i].XMM_L(3),

   743                         env->xmm_regs[i].XMM_L(2),

   744                         env->xmm_regs[i].XMM_L(1),

   745                         env->xmm_regs[i].XMM_L(0));

   746             if ((i & 1) == 1)

   747                 cpu_fprintf(f, "\n");

   748             else

   749                 cpu_fprintf(f, " ");

   750         }

   751     }

   752 }

   753 

   754 /***********************************************************/

   755 /* x86 mmu */

   756 /* XXX: add PGE support */

   757 

   758 void cpu_x86_set_a20(CPUX86State *env, int a20_state)

   759 {

   760     a20_state = (a20_state != 0);

   761     if (a20_state != ((env->a20_mask >> 20) & 1)) {

   762 #if defined(DEBUG_MMU)

   763         printf("A20 update: a20=%d\n", a20_state);

   764 #endif

   765         /* if the cpu is currently executing code, we must unlink it and

   766            all the potentially executing TB */

   767         cpu_interrupt(env, CPU_INTERRUPT_EXITTB);

   768 

   769         /* when a20 is changed, all the MMU mappings are invalid, so

   770            we must flush everything */

   771         tlb_flush(env, 1);

   772         env->a20_mask = (~0x100000) | (a20_state << 20);

   773     }

   774 }

   775 

   776 void cpu_x86_update_cr0(CPUX86State *env, uint32_t new_cr0)

   777 {

   778     int pe_state;

   779 

   780 #if defined(DEBUG_MMU)

   781     printf("CR0 update: CR0=0x%08x\n", new_cr0);

   782 #endif

   783     if ((new_cr0 & (CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK)) !=

   784         (env->cr[0] & (CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK))) {

   785         tlb_flush(env, 1);

   786     }

   787 

   788 #ifdef TARGET_X86_64

   789     if (!(env->cr[0] & CR0_PG_MASK) && (new_cr0 & CR0_PG_MASK) &&

   790         (env->efer & MSR_EFER_LME)) {

   791         /* enter in long mode */

   792         /* XXX: generate an exception */

   793         if (!(env->cr[4] & CR4_PAE_MASK))

   794             return;

   795         env->efer |= MSR_EFER_LMA;

   796         env->hflags |= HF_LMA_MASK;

   797     } else if ((env->cr[0] & CR0_PG_MASK) && !(new_cr0 & CR0_PG_MASK) &&

   798                (env->efer & MSR_EFER_LMA)) {

   799         /* exit long mode */

   800         env->efer &= ~MSR_EFER_LMA;

   801         env->hflags &= ~(HF_LMA_MASK | HF_CS64_MASK);

   802         env->eip &= 0xffffffff;

   803     }

   804 #endif

   805     env->cr[0] = new_cr0 | CR0_ET_MASK;

   806 

   807     /* update PE flag in hidden flags */

   808     pe_state = (env->cr[0] & CR0_PE_MASK);

   809     env->hflags = (env->hflags & ~HF_PE_MASK) | (pe_state << HF_PE_SHIFT);

   810     /* ensure that ADDSEG is always set in real mode */

   811     env->hflags |= ((pe_state ^ 1) << HF_ADDSEG_SHIFT);

   812     /* update FPU flags */

   813     env->hflags = (env->hflags & ~(HF_MP_MASK | HF_EM_MASK | HF_TS_MASK)) |

   814         ((new_cr0 << (HF_MP_SHIFT - 1)) & (HF_MP_MASK | HF_EM_MASK | HF_TS_MASK));

   815 }

   816 

   817 /* XXX: in legacy PAE mode, generate a GPF if reserved bits are set in

   818    the PDPT */

   819 void cpu_x86_update_cr3(CPUX86State *env, target_ulong new_cr3)

   820 {

   821     env->cr[3] = new_cr3;

   822     if (env->cr[0] & CR0_PG_MASK) {

   823 #if defined(DEBUG_MMU)

   824         printf("CR3 update: CR3=" TARGET_FMT_lx "\n", new_cr3);

   825 #endif

   826         tlb_flush(env, 0);

   827     }

   828 }

   829 

   830 void cpu_x86_update_cr4(CPUX86State *env, uint32_t new_cr4)

   831 {

   832 #if defined(DEBUG_MMU)

   833     printf("CR4 update: CR4=%08x\n", (uint32_t)env->cr[4]);

   834 #endif

   835     if ((new_cr4 & (CR4_PGE_MASK | CR4_PAE_MASK | CR4_PSE_MASK)) !=

   836         (env->cr[4] & (CR4_PGE_MASK | CR4_PAE_MASK | CR4_PSE_MASK))) {

   837         tlb_flush(env, 1);

   838     }

   839     /* SSE handling */

   840     if (!(env->cpuid_features & CPUID_SSE))

   841         new_cr4 &= ~CR4_OSFXSR_MASK;

   842     if (new_cr4 & CR4_OSFXSR_MASK)

   843         env->hflags |= HF_OSFXSR_MASK;

   844     else

   845         env->hflags &= ~HF_OSFXSR_MASK;

   846 

   847     env->cr[4] = new_cr4;

   848 }

   849 

   850 #if defined(CONFIG_USER_ONLY)

   851 

   852 int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,

   853                              int is_write, int mmu_idx, int is_softmmu)

   854 {

   855     /* user mode only emulation */

   856     is_write &= 1;

   857     env->cr[2] = addr;

   858     env->error_code = (is_write << PG_ERROR_W_BIT);

   859     env->error_code |= PG_ERROR_U_MASK;

   860     env->exception_index = EXCP0E_PAGE;

   861     return 1;

   862 }

   863 

   864 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)

   865 {

   866     return addr;

   867 }

   868 

   869 #else

   870 

   871 /* XXX: This value should match the one returned by CPUID

   872  * and in exec.c */

   873 #if defined(USE_KQEMU)

   874 #define PHYS_ADDR_MASK 0xfffff000LL

   875 #else

   876 # if defined(TARGET_X86_64)

   877 # define PHYS_ADDR_MASK 0xfffffff000LL

   878 # else

   879 # define PHYS_ADDR_MASK 0xffffff000LL

   880 # endif

   881 #endif

   882 

   883 /* return value:

   884    -1 = cannot handle fault

   885    0  = nothing more to do

   886    1  = generate PF fault

   887    2  = soft MMU activation required for this block

   888 */

   889 int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,

   890                              int is_write1, int mmu_idx, int is_softmmu)

   891 {

   892     uint64_t ptep, pte;

   893     target_ulong pde_addr, pte_addr;

   894     int error_code, is_dirty, prot, page_size, ret, is_write, is_user;

   895     target_phys_addr_t paddr;

   896     uint32_t page_offset;

   897     target_ulong vaddr, virt_addr;

   898 

   899     is_user = mmu_idx == MMU_USER_IDX;

   900 #if defined(DEBUG_MMU)

   901     printf("MMU fault: addr=" TARGET_FMT_lx " w=%d u=%d eip=" TARGET_FMT_lx "\n",

   902            addr, is_write1, is_user, env->eip);

   903 #endif

   904     is_write = is_write1 & 1;

   905 

   906     if (!(env->cr[0] & CR0_PG_MASK)) {

   907         pte = addr;

   908         virt_addr = addr & TARGET_PAGE_MASK;

   909         prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;

   910         page_size = 4096;

   911         goto do_mapping;

   912     }

   913 

   914     if (env->cr[4] & CR4_PAE_MASK) {

   915         uint64_t pde, pdpe;

   916         target_ulong pdpe_addr;

   917 

   918 #ifdef TARGET_X86_64

   919         if (env->hflags & HF_LMA_MASK) {

   920             uint64_t pml4e_addr, pml4e;

   921             int32_t sext;

   922 

   923             /* test virtual address sign extension */

   924             sext = (int64_t)addr >> 47;

   925             if (sext != 0 && sext != -1) {

   926                 env->error_code = 0;

   927                 env->exception_index = EXCP0D_GPF;

   928                 return 1;

   929             }

   930 

   931             pml4e_addr = ((env->cr[3] & ~0xfff) + (((addr >> 39) & 0x1ff) << 3)) &

   932                 env->a20_mask;

   933             pml4e = ldq_phys(pml4e_addr);

   934             if (!(pml4e & PG_PRESENT_MASK)) {

   935                 error_code = 0;

   936                 goto do_fault;

   937             }

   938             if (!(env->efer & MSR_EFER_NXE) && (pml4e & PG_NX_MASK)) {

   939                 error_code = PG_ERROR_RSVD_MASK;

   940                 goto do_fault;

   941             }

   942             if (!(pml4e & PG_ACCESSED_MASK)) {

   943                 pml4e |= PG_ACCESSED_MASK;

   944                 stl_phys_notdirty(pml4e_addr, pml4e);

   945             }

   946             ptep = pml4e ^ PG_NX_MASK;

   947             pdpe_addr = ((pml4e & PHYS_ADDR_MASK) + (((addr >> 30) & 0x1ff) << 3)) &

   948                 env->a20_mask;

   949             pdpe = ldq_phys(pdpe_addr);

   950             if (!(pdpe & PG_PRESENT_MASK)) {

   951                 error_code = 0;

   952                 goto do_fault;

   953             }

   954             if (!(env->efer & MSR_EFER_NXE) && (pdpe & PG_NX_MASK)) {

   955                 error_code = PG_ERROR_RSVD_MASK;

   956                 goto do_fault;

   957             }

   958             ptep &= pdpe ^ PG_NX_MASK;

   959             if (!(pdpe & PG_ACCESSED_MASK)) {

   960                 pdpe |= PG_ACCESSED_MASK;

   961                 stl_phys_notdirty(pdpe_addr, pdpe);

   962             }

   963         } else

   964 #endif

   965         {

   966             /* XXX: load them when cr3 is loaded ? */

   967             pdpe_addr = ((env->cr[3] & ~0x1f) + ((addr >> 27) & 0x18)) &

   968                 env->a20_mask;

   969             pdpe = ldq_phys(pdpe_addr);

   970             if (!(pdpe & PG_PRESENT_MASK)) {

   971                 error_code = 0;

   972                 goto do_fault;

   973             }

   974             ptep = PG_NX_MASK | PG_USER_MASK | PG_RW_MASK;

   975         }

   976 

   977         pde_addr = ((pdpe & PHYS_ADDR_MASK) + (((addr >> 21) & 0x1ff) << 3)) &

   978             env->a20_mask;

   979         pde = ldq_phys(pde_addr);

   980         if (!(pde & PG_PRESENT_MASK)) {

   981             error_code = 0;

   982             goto do_fault;

   983         }

   984         if (!(env->efer & MSR_EFER_NXE) && (pde & PG_NX_MASK)) {

   985             error_code = PG_ERROR_RSVD_MASK;

   986             goto do_fault;

   987         }

   988         ptep &= pde ^ PG_NX_MASK;

   989         if (pde & PG_PSE_MASK) {

   990             /* 2 MB page */

   991             page_size = 2048 * 1024;

   992             ptep ^= PG_NX_MASK;

   993             if ((ptep & PG_NX_MASK) && is_write1 == 2)

   994                 goto do_fault_protect;

   995             if (is_user) {

   996                 if (!(ptep & PG_USER_MASK))

   997                     goto do_fault_protect;

   998                 if (is_write && !(ptep & PG_RW_MASK))

   999                     goto do_fault_protect;

  1000             } else {

  1001                 if ((env->cr[0] & CR0_WP_MASK) &&

  1002                     is_write && !(ptep & PG_RW_MASK))

  1003                     goto do_fault_protect;

  1004             }

  1005             is_dirty = is_write && !(pde & PG_DIRTY_MASK);

  1006             if (!(pde & PG_ACCESSED_MASK) || is_dirty) {

  1007                 pde |= PG_ACCESSED_MASK;

  1008                 if (is_dirty)

  1009                     pde |= PG_DIRTY_MASK;

  1010                 stl_phys_notdirty(pde_addr, pde);

  1011             }

  1012             /* align to page_size */

  1013             pte = pde & ((PHYS_ADDR_MASK & ~(page_size - 1)) | 0xfff);

  1014             virt_addr = addr & ~(page_size - 1);

  1015         } else {

  1016             /* 4 KB page */

  1017             if (!(pde & PG_ACCESSED_MASK)) {

  1018                 pde |= PG_ACCESSED_MASK;

  1019                 stl_phys_notdirty(pde_addr, pde);

  1020             }

  1021             pte_addr = ((pde & PHYS_ADDR_MASK) + (((addr >> 12) & 0x1ff) << 3)) &

  1022                 env->a20_mask;

  1023             pte = ldq_phys(pte_addr);

  1024             if (!(pte & PG_PRESENT_MASK)) {

  1025                 error_code = 0;

  1026                 goto do_fault;

  1027             }

  1028             if (!(env->efer & MSR_EFER_NXE) && (pte & PG_NX_MASK)) {

  1029                 error_code = PG_ERROR_RSVD_MASK;

  1030                 goto do_fault;

  1031             }

  1032             /* combine pde and pte nx, user and rw protections */

  1033             ptep &= pte ^ PG_NX_MASK;

  1034             ptep ^= PG_NX_MASK;

  1035             if ((ptep & PG_NX_MASK) && is_write1 == 2)

  1036                 goto do_fault_protect;

  1037             if (is_user) {

  1038                 if (!(ptep & PG_USER_MASK))

  1039                     goto do_fault_protect;

  1040                 if (is_write && !(ptep & PG_RW_MASK))

  1041                     goto do_fault_protect;

  1042             } else {

  1043                 if ((env->cr[0] & CR0_WP_MASK) &&

  1044                     is_write && !(ptep & PG_RW_MASK))

  1045                     goto do_fault_protect;

  1046             }

  1047             is_dirty = is_write && !(pte & PG_DIRTY_MASK);

  1048             if (!(pte & PG_ACCESSED_MASK) || is_dirty) {

  1049                 pte |= PG_ACCESSED_MASK;

  1050                 if (is_dirty)

  1051                     pte |= PG_DIRTY_MASK;

  1052                 stl_phys_notdirty(pte_addr, pte);

  1053             }

  1054             page_size = 4096;

  1055             virt_addr = addr & ~0xfff;

  1056             pte = pte & (PHYS_ADDR_MASK | 0xfff);

  1057         }

  1058     } else {

  1059         uint32_t pde;

  1060 

  1061         /* page directory entry */

  1062         pde_addr = ((env->cr[3] & ~0xfff) + ((addr >> 20) & 0xffc)) &

  1063             env->a20_mask;

  1064         pde = ldl_phys(pde_addr);

  1065         if (!(pde & PG_PRESENT_MASK)) {

  1066             error_code = 0;

  1067             goto do_fault;

  1068         }

  1069         /* if PSE bit is set, then we use a 4MB page */

  1070         if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) {

  1071             page_size = 4096 * 1024;

  1072             if (is_user) {

  1073                 if (!(pde & PG_USER_MASK))

  1074                     goto do_fault_protect;

  1075                 if (is_write && !(pde & PG_RW_MASK))

  1076                     goto do_fault_protect;

  1077             } else {

  1078                 if ((env->cr[0] & CR0_WP_MASK) &&

  1079                     is_write && !(pde & PG_RW_MASK))

  1080                     goto do_fault_protect;

  1081             }

  1082             is_dirty = is_write && !(pde & PG_DIRTY_MASK);

  1083             if (!(pde & PG_ACCESSED_MASK) || is_dirty) {

  1084                 pde |= PG_ACCESSED_MASK;

  1085                 if (is_dirty)

  1086                     pde |= PG_DIRTY_MASK;

  1087                 stl_phys_notdirty(pde_addr, pde);

  1088             }

  1089 

  1090             pte = pde & ~( (page_size - 1) & ~0xfff); /* align to page_size */

  1091             ptep = pte;

  1092             virt_addr = addr & ~(page_size - 1);

  1093         } else {

  1094             if (!(pde & PG_ACCESSED_MASK)) {

  1095                 pde |= PG_ACCESSED_MASK;

  1096                 stl_phys_notdirty(pde_addr, pde);

  1097             }

  1098 

  1099             /* page directory entry */

  1100             pte_addr = ((pde & ~0xfff) + ((addr >> 10) & 0xffc)) &

  1101                 env->a20_mask;

  1102             pte = ldl_phys(pte_addr);

  1103             if (!(pte & PG_PRESENT_MASK)) {

  1104                 error_code = 0;

  1105                 goto do_fault;

  1106             }

  1107             /* combine pde and pte user and rw protections */

  1108             ptep = pte & pde;

  1109             if (is_user) {

  1110                 if (!(ptep & PG_USER_MASK))

  1111                     goto do_fault_protect;

  1112                 if (is_write && !(ptep & PG_RW_MASK))

  1113                     goto do_fault_protect;

  1114             } else {

  1115                 if ((env->cr[0] & CR0_WP_MASK) &&

  1116                     is_write && !(ptep & PG_RW_MASK))

  1117                     goto do_fault_protect;

  1118             }

  1119             is_dirty = is_write && !(pte & PG_DIRTY_MASK);

  1120             if (!(pte & PG_ACCESSED_MASK) || is_dirty) {

  1121                 pte |= PG_ACCESSED_MASK;

  1122                 if (is_dirty)

  1123                     pte |= PG_DIRTY_MASK;

  1124                 stl_phys_notdirty(pte_addr, pte);

  1125             }

  1126             page_size = 4096;

  1127             virt_addr = addr & ~0xfff;

  1128         }

  1129     }

  1130     /* the page can be put in the TLB */

  1131     prot = PAGE_READ;

  1132     if (!(ptep & PG_NX_MASK))

  1133         prot |= PAGE_EXEC;

  1134     if (pte & PG_DIRTY_MASK) {

  1135         /* only set write access if already dirty... otherwise wait