Subversion Repositories ao486

/////////////////////////////////////////////////////////////////////////

// $Id: tasking.cc 11654 2013-03-15 08:26:22Z sshwarts $

/////////////////////////////////////////////////////////////////////////

//

//  Copyright (C) 2001-2012  The Bochs Project

//

//  This library is free software; you can redistribute it and/or

//  modify it under the terms of the GNU Lesser General Public

//  License as published by the Free Software Foundation; either

//  version 2 of the License, or (at your option) any later version.

//

//  This library is distributed in the hope that it will be useful,

//  but WITHOUT ANY WARRANTY; without even the implied warranty of

//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

//  Lesser General Public License for more details.

//

//  You should have received a copy of the GNU Lesser General Public

//  License along with this library; if not, write to the Free Software

//  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA B 02110-1301 USA

/////////////////////////////////////////////////////////////////////////

#define NEED_CPU_REG_SHORTCUTS 1

#include "bochs.h"

#include "cpu.h"

#define LOG_THIS BX_CPU_THIS_PTR

// Notes:

// ======

  // ======================

  // 286 Task State Segment

  // ======================

  // dynamic item                      | hex  dec  offset

  // 0       task LDT selector         | 2a   42

  // 1       DS selector               | 28   40

  // 1       SS selector               | 26   38

  // 1       CS selector               | 24   36

  // 1       ES selector               | 22   34

  // 1       DI                        | 20   32

  // 1       SI                        | 1e   30

  // 1       BP                        | 1c   28

  // 1       SP                        | 1a   26

  // 1       BX                        | 18   24

  // 1       DX                        | 16   22

  // 1       CX                        | 14   20

  // 1       AX                        | 12   18

  // 1       flag word                 | 10   16

  // 1       IP (entry point)          | 0e   14

  // 0       SS for CPL 2              | 0c   12

  // 0       SP for CPL 2              | 0a   10

  // 0       SS for CPL 1              | 08   08

  // 0       SP for CPL 1              | 06   06

  // 0       SS for CPL 0              | 04   04

  // 0       SP for CPL 0              | 02   02

  //         back link selector to TSS | 00   00

  // ======================

  // 386 Task State Segment

  // ======================

  // |31            16|15                    0| hex dec

  // |I/O Map Base    |000000000000000000000|T| 64  100 static

  // |0000000000000000| LDT                   | 60  96  static

  // |0000000000000000| GS selector           | 5c  92  dynamic

  // |0000000000000000| FS selector           | 58  88  dynamic

  // |0000000000000000| DS selector           | 54  84  dynamic

  // |0000000000000000| SS selector           | 50  80  dynamic

  // |0000000000000000| CS selector           | 4c  76  dynamic

  // |0000000000000000| ES selector           | 48  72  dynamic

  // |                EDI                     | 44  68  dynamic

  // |                ESI                     | 40  64  dynamic

  // |                EBP                     | 3c  60  dynamic

  // |                ESP                     | 38  56  dynamic

  // |                EBX                     | 34  52  dynamic

  // |                EDX                     | 30  48  dynamic

  // |                ECX                     | 2c  44  dynamic

  // |                EAX                     | 28  40  dynamic

  // |                EFLAGS                  | 24  36  dynamic

  // |                EIP (entry point)       | 20  32  dynamic

  // |           CR3 (PDPR)                   | 1c  28  static

  // |000000000000000 | SS for CPL 2          | 18  24  static

  // |           ESP for CPL 2                | 14  20  static

  // |000000000000000 | SS for CPL 1          | 10  16  static

  // |           ESP for CPL 1                | 0c  12  static

  // |000000000000000 | SS for CPL 0          | 08  08  static

  // |           ESP for CPL 0                | 04  04  static

  // |000000000000000 | back link to prev TSS | 00  00  dynamic (updated only when return expected)

  // ==================================================

  // Effect of task switch on Busy, NT, and Link Fields

  // ==================================================

  // Field         jump        call/interrupt     iret

  // ------------------------------------------------------

  // new busy bit  Set         Set                No change

  // old busy bit  Cleared     No change          Cleared

  // new NT flag   No change   Set                No change

  // old NT flag   No change   No change          Cleared

  // new link      No change   old TSS selector   No change

  // old link      No change   No change          No change

  // CR0.TS        Set         Set                Set

  // Note: I checked 386, 486, and Pentium, and they all exhibited

  //       exactly the same behaviour as above.  There seems to

  //       be some misprints in the Intel docs.

void BX_CPU_C::task_switch(bxInstruction_c *i, bx_selector_t *tss_selector,

                 bx_descriptor_t *tss_descriptor, unsigned source,

                 Bit32u dword1, Bit32u dword2, bx_bool push_error, Bit32u error_code)

{

  Bit32u obase32; // base address of old TSS

  Bit32u nbase32; // base address of new TSS

  Bit32u temp32, newCR3;

  Bit16u raw_cs_selector, raw_ss_selector, raw_ds_selector, raw_es_selector,

         raw_fs_selector, raw_gs_selector, raw_ldt_selector;

  Bit16u trap_word;

  bx_selector_t cs_selector, ss_selector, ds_selector, es_selector,

                fs_selector, gs_selector, ldt_selector;

  bx_descriptor_t cs_descriptor, ss_descriptor, ldt_descriptor;

  Bit32u old_TSS_max, new_TSS_max, old_TSS_limit, new_TSS_limit;

  Bit32u newEAX, newECX, newEDX, newEBX;

  Bit32u newESP, newEBP, newESI, newEDI;

  Bit32u newEFLAGS, newEIP;

  BX_DEBUG(("TASKING: ENTER"));

  invalidate_prefetch_q();

  // Discard any traps and inhibits for new context; traps will

  // resume upon return.

  BX_CPU_THIS_PTR debug_trap &= ~BX_DEBUG_SINGLE_STEP_BIT;

  BX_CPU_THIS_PTR inhibit_mask = 0;

  // STEP 1: The following checks are made before calling task_switch(),

  //         for JMP & CALL only. These checks are NOT made for exceptions,

  //         interrupts & IRET.

  //

  //   1) TSS DPL must be >= CPL

  //   2) TSS DPL must be >= TSS selector RPL

  //   3) TSS descriptor is not busy.

  // STEP 2: The processor performs limit-checking on the target TSS

  //         to verify that the TSS limit is greater than or equal

  //         to 67h (2Bh for 16-bit TSS).

  // Gather info about new TSS

  if (tss_descriptor->type <= 3) { // {1,3}

    new_TSS_max = 0x2B;

  }

  else { // tss_descriptor->type = {9,11}

    new_TSS_max = 0x67;

  }

  nbase32 = (Bit32u) tss_descriptor->u.segment.base;

  new_TSS_limit = tss_descriptor->u.segment.limit_scaled;

  if (new_TSS_limit < new_TSS_max) {

    BX_ERROR(("task_switch(): new TSS limit < %d", new_TSS_max));

    exception(BX_TS_EXCEPTION, tss_selector->value & 0xfffc);

  }

#if BX_SUPPORT_SVM

  if (BX_CPU_THIS_PTR in_svm_guest) {

    if (SVM_INTERCEPT(SVM_INTERCEPT0_TASK_SWITCH))

      SvmInterceptTaskSwitch(tss_selector->value, source, push_error, error_code);

  }

#endif

#if BX_SUPPORT_VMX

  if (BX_CPU_THIS_PTR in_vmx_guest)

    VMexit_TaskSwitch(tss_selector->value, source);

#endif

  // Gather info about old TSS

  if (BX_CPU_THIS_PTR tr.cache.type <= 3) {

    old_TSS_max = 0x29;

  }

  else {

    old_TSS_max = 0x5F;

  }

  obase32 = (Bit32u) BX_CPU_THIS_PTR tr.cache.u.segment.base;        // old TSS.base

  old_TSS_limit = BX_CPU_THIS_PTR tr.cache.u.segment.limit_scaled;

  if (old_TSS_limit < old_TSS_max) {

    BX_ERROR(("task_switch(): old TSS limit < %d", old_TSS_max));

    exception(BX_TS_EXCEPTION, BX_CPU_THIS_PTR tr.selector.value & 0xfffc);

  }

  if (obase32 == nbase32) {

    BX_INFO(("TASK SWITCH: switching to the same TSS !"));

  }

  // Check that old TSS, new TSS, and all segment descriptors

  // used in the task switch are paged in.

  if (BX_CPU_THIS_PTR cr0.get_PG())

  {

    translate_linear(BX_TLB_ENTRY_OF(nbase32), nbase32, 0, BX_READ);  // old TSS

    translate_linear(BX_TLB_ENTRY_OF(nbase32 + new_TSS_max), nbase32 + new_TSS_max, 0, BX_READ);

    // ??? Humm, we check the new TSS region with READ above,

    // but sometimes we need to write the link field in that

    // region.  We also sometimes update other fields, perhaps

    // we need to WRITE check them here also, so that we keep

    // the written state consistent (ie, we don't encounter a

    // page fault in the middle).

    if (source == BX_TASK_FROM_CALL || source == BX_TASK_FROM_INT)

    {

      translate_linear(BX_TLB_ENTRY_OF(nbase32),     nbase32,     0, BX_WRITE);

      translate_linear(BX_TLB_ENTRY_OF(nbase32 + 1), nbase32 + 1, 0, BX_WRITE);

    }

  }

  // Privilege and busy checks done in CALL, JUMP, INT, IRET

  // Step 3: If JMP or IRET, clear busy bit in old task TSS descriptor,

  //         otherwise leave set.

  // effect on Busy bit of old task

  if (source == BX_TASK_FROM_JUMP || source == BX_TASK_FROM_IRET) {

    // Bit is cleared

    Bit32u laddr = (Bit32u) BX_CPU_THIS_PTR gdtr.base + (BX_CPU_THIS_PTR tr.selector.index<<3) + 4;

    access_read_linear(laddr, 4, 0, BX_RW, &temp32);

    temp32 &= ~0x200;

    access_write_linear(laddr, 4, 0, &temp32);

  }

  // STEP 4: If the task switch was initiated with an IRET instruction,

  //         clears the NT flag in a temporarily saved EFLAGS image;

  //         if initiated with a CALL or JMP instruction, an exception, or

  //         an interrupt, the NT flag is left unchanged.

  Bit32u oldEFLAGS = read_eflags();

  /* if moving to busy task, clear NT bit */

  if (tss_descriptor->type == BX_SYS_SEGMENT_BUSY_286_TSS ||

      tss_descriptor->type == BX_SYS_SEGMENT_BUSY_386_TSS)

  {

    oldEFLAGS &= ~EFlagsNTMask;

  }

  // STEP 5: Save the current task state in the TSS. Up to this point,

  //         any exception that occurs aborts the task switch without

  //         changing the processor state.

  /* save current machine state in old task's TSS */

  if (BX_CPU_THIS_PTR tr.cache.type <= 3) {

    // check that we won't page fault while writing

    if (BX_CPU_THIS_PTR cr0.get_PG()) {

      Bit32u start = Bit32u(obase32 + 14), end = Bit32u(obase32 + 41);

      translate_linear(BX_TLB_ENTRY_OF(start), start, 0, BX_WRITE);

      translate_linear(BX_TLB_ENTRY_OF(end),   end,   0, BX_WRITE);

    }

    system_write_word(Bit32u(obase32 + 14), IP);

    system_write_word(Bit32u(obase32 + 16), oldEFLAGS);

    system_write_word(Bit32u(obase32 + 18), AX);

    system_write_word(Bit32u(obase32 + 20), CX);

    system_write_word(Bit32u(obase32 + 22), DX);

    system_write_word(Bit32u(obase32 + 24), BX);

    system_write_word(Bit32u(obase32 + 26), SP);

    system_write_word(Bit32u(obase32 + 28), BP);

    system_write_word(Bit32u(obase32 + 30), SI);

    system_write_word(Bit32u(obase32 + 32), DI);

    system_write_word(Bit32u(obase32 + 34),

           BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES].selector.value);

    system_write_word(Bit32u(obase32 + 36),

           BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector.value);

    system_write_word(Bit32u(obase32 + 38),

           BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].selector.value);

    system_write_word(Bit32u(obase32 + 40),

           BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].selector.value);

  }

  else {

    // check that we won't page fault while writing

    if (BX_CPU_THIS_PTR cr0.get_PG()) {

      Bit32u start = Bit32u(obase32 + 0x20), end = Bit32u(obase32 + 0x5d);

      translate_linear(BX_TLB_ENTRY_OF(start), start, 0, BX_WRITE);

      translate_linear(BX_TLB_ENTRY_OF(end),   end,   0, BX_WRITE);

    }

    system_write_dword(Bit32u(obase32 + 0x20), EIP);

    system_write_dword(Bit32u(obase32 + 0x24), oldEFLAGS);

    system_write_dword(Bit32u(obase32 + 0x28), EAX);

    system_write_dword(Bit32u(obase32 + 0x2c), ECX);

    system_write_dword(Bit32u(obase32 + 0x30), EDX);

    system_write_dword(Bit32u(obase32 + 0x34), EBX);

    system_write_dword(Bit32u(obase32 + 0x38), ESP);

    system_write_dword(Bit32u(obase32 + 0x3c), EBP);

    system_write_dword(Bit32u(obase32 + 0x40), ESI);

    system_write_dword(Bit32u(obase32 + 0x44), EDI);

    system_write_word(Bit32u(obase32 + 0x48),

           BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES].selector.value);

    system_write_word(Bit32u(obase32 + 0x4c),

           BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector.value);

    system_write_word(Bit32u(obase32 + 0x50),

           BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].selector.value);

    system_write_word(Bit32u(obase32 + 0x54),

           BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].selector.value);

    system_write_word(Bit32u(obase32 + 0x58),

           BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS].selector.value);

    system_write_word(Bit32u(obase32 + 0x5c),

           BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS].selector.value);

  }

  // effect on link field of new task

  if (source == BX_TASK_FROM_CALL || source == BX_TASK_FROM_INT)

  {

    // set to selector of old task's TSS

    system_write_word(nbase32, BX_CPU_THIS_PTR tr.selector.value);

  }

  // STEP 6: The new-task state is loaded from the TSS

  if (tss_descriptor->type <= 3) {

    newEIP    = system_read_word(Bit32u(nbase32 + 14));

    newEFLAGS = system_read_word(Bit32u(nbase32 + 16));

    // incoming TSS is 16bit:

    //   - upper word of general registers is set to 0xFFFF

    //   - upper word of eflags is zero'd

    //   - FS, GS are zero'd

    //   - upper word of eIP is zero'd

    Bit16u temp16 = system_read_word(Bit32u(nbase32 + 18));

      newEAX = 0xffff0000 | temp16;

    temp16 = system_read_word(Bit32u(nbase32 + 20));

      newECX = 0xffff0000 | temp16;

    temp16 = system_read_word(Bit32u(nbase32 + 22));

      newEDX = 0xffff0000 | temp16;

    temp16 = system_read_word(Bit32u(nbase32 + 24));

      newEBX = 0xffff0000 | temp16;

    temp16 = system_read_word(Bit32u(nbase32 + 26));

      newESP = 0xffff0000 | temp16;

    temp16 = system_read_word(Bit32u(nbase32 + 28));

      newEBP = 0xffff0000 | temp16;

    temp16 = system_read_word(Bit32u(nbase32 + 30));

      newESI = 0xffff0000 | temp16;

    temp16 = system_read_word(Bit32u(nbase32 + 32));

      newEDI = 0xffff0000 | temp16;

    raw_es_selector  = system_read_word(Bit32u(nbase32 + 34));

    raw_cs_selector  = system_read_word(Bit32u(nbase32 + 36));

    raw_ss_selector  = system_read_word(Bit32u(nbase32 + 38));

    raw_ds_selector  = system_read_word(Bit32u(nbase32 + 40));

    raw_ldt_selector = system_read_word(Bit32u(nbase32 + 42));

    raw_fs_selector = 0; // use a NULL selector

    raw_gs_selector = 0; // use a NULL selector

    // No CR3 change for 286 task switch

    newCR3 = 0;   // keep compiler happy (not used)

    trap_word = 0; // keep compiler happy (not used)

  }

  else {

    if (BX_CPU_THIS_PTR cr0.get_PG())

      newCR3 = system_read_dword(Bit32u(nbase32 + 0x1c));

    else

      newCR3 = 0;   // keep compiler happy (not used)

    newEIP    = system_read_dword(Bit32u(nbase32 + 0x20));

    newEFLAGS = system_read_dword(Bit32u(nbase32 + 0x24));

    newEAX    = system_read_dword(Bit32u(nbase32 + 0x28));

    newECX    = system_read_dword(Bit32u(nbase32 + 0x2c));

    newEDX    = system_read_dword(Bit32u(nbase32 + 0x30));

    newEBX    = system_read_dword(Bit32u(nbase32 + 0x34));

    newESP    = system_read_dword(Bit32u(nbase32 + 0x38));

    newEBP    = system_read_dword(Bit32u(nbase32 + 0x3c));

    newESI    = system_read_dword(Bit32u(nbase32 + 0x40));

    newEDI    = system_read_dword(Bit32u(nbase32 + 0x44));

    raw_es_selector  = system_read_word(Bit32u(nbase32 + 0x48));

    raw_cs_selector  = system_read_word(Bit32u(nbase32 + 0x4c));

    raw_ss_selector  = system_read_word(Bit32u(nbase32 + 0x50));

    raw_ds_selector  = system_read_word(Bit32u(nbase32 + 0x54));

    raw_fs_selector  = system_read_word(Bit32u(nbase32 + 0x58));

    raw_gs_selector  = system_read_word(Bit32u(nbase32 + 0x5c));

    raw_ldt_selector = system_read_word(Bit32u(nbase32 + 0x60));

    trap_word        = system_read_word(Bit32u(nbase32 + 0x64));

  }

  // Step 7: If CALL, interrupt, or JMP, set busy flag in new task's

  //         TSS descriptor.  If IRET, leave set.

  if (source != BX_TASK_FROM_IRET)

  {

    // set the new task's busy bit

    Bit32u laddr = (Bit32u)(BX_CPU_THIS_PTR gdtr.base) + (tss_selector->index<<3) + 4;

    access_read_linear(laddr, 4, 0, BX_RW, &dword2);

    dword2 |= 0x200;

    access_write_linear(laddr, 4, 0, &dword2);

  }

  //

  // Commit point.  At this point, we commit to the new

  // context.  If an unrecoverable error occurs in further

  // processing, we complete the task switch without performing

  // additional access and segment availablility checks and

  // generate the appropriate exception prior to beginning

  // execution of the new task.

  //

  // Step 8: Load the task register with the segment selector and

  //         descriptor for the new task TSS.

  BX_CPU_THIS_PTR tr.selector = *tss_selector;

  BX_CPU_THIS_PTR tr.cache    = *tss_descriptor;

  BX_CPU_THIS_PTR tr.cache.type |= 2; // mark TSS in TR as busy

  // Step 9: Set TS flag in the CR0 image stored in the new task TSS.

  BX_CPU_THIS_PTR cr0.set_TS(1);

  // Task switch clears LE/L3/L2/L1/L0 in DR7

  BX_CPU_THIS_PTR dr7.val32 &= ~0x00000155;

  // Step 10: If call or interrupt, set the NT flag in the eflags

  //          image stored in new task's TSS.  If IRET or JMP,

  //          NT is restored from new TSS eflags image. (no change)

  // effect on NT flag of new task

  if (source == BX_TASK_FROM_CALL || source == BX_TASK_FROM_INT) {

    newEFLAGS |= EFlagsNTMask; // NT flag is set

  }

  // Step 11: Load the new task (dynamic) state from new TSS.

  //          Any errors associated with loading and qualification of

  //          segment descriptors in this step occur in the new task's

  //          context.  State loaded here includes LDTR, CR3,

  //          EFLAGS, EIP, general purpose registers, and segment

  //          descriptor parts of the segment registers.

  BX_CPU_THIS_PTR prev_rip = EIP = newEIP;

  EAX = newEAX;

  ECX = newECX;

  EDX = newEDX;

  EBX = newEBX;

  ESP = newESP;

  EBP = newEBP;

  ESI = newESI;

  EDI = newEDI;

  BX_CPU_THIS_PTR speculative_rsp = 0;

  writeEFlags(newEFLAGS, EFlagsValidMask);

  // Fill in selectors for all segment registers.  If errors

  // occur later, the selectors will at least be loaded.

  parse_selector(raw_cs_selector, &cs_selector);

  BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].selector = cs_selector;

  parse_selector(raw_ss_selector, &ss_selector);

  BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].selector = ss_selector;

  parse_selector(raw_ds_selector, &ds_selector);

  BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].selector = ds_selector;

  parse_selector(raw_es_selector, &es_selector);

  BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES].selector = es_selector;

  parse_selector(raw_fs_selector, &fs_selector);

  BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS].selector = fs_selector;

  parse_selector(raw_gs_selector, &gs_selector);

  BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS].selector = gs_selector;

  parse_selector(raw_ldt_selector, &ldt_selector);

  BX_CPU_THIS_PTR ldtr.selector = ldt_selector;

  // Start out with invalid descriptor caches, fill in with

  // values only as they are validated

  BX_CPU_THIS_PTR ldtr.cache.valid = 0;

  BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS].cache.valid = 0;

  BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].cache.valid = 0;

  BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS].cache.valid = 0;

  BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES].cache.valid = 0;

  BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS].cache.valid = 0;

  BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS].cache.valid = 0;

  if ((tss_descriptor->type >= 9) && BX_CPU_THIS_PTR cr0.get_PG()) {

    // change CR3 only if it actually modified

    if (newCR3 != BX_CPU_THIS_PTR cr3) {

      BX_DEBUG(("task_switch changing CR3 to 0x%08x", newCR3));

      if (! SetCR3(newCR3)) // Tell paging unit about new cr3 value

        exception(BX_TS_EXCEPTION, 0);

#if BX_CPU_LEVEL >= 6

      if (BX_CPU_THIS_PTR cr0.get_PG() && BX_CPU_THIS_PTR cr4.get_PAE()) {

        if (! CheckPDPTR(newCR3)) {

          BX_ERROR(("task_switch(exception after commit point): PDPTR check failed !"));

          // clear PDPTRs before raising task switch exception

          for (unsigned n=0; n<4; n++)

            BX_CPU_THIS_PTR PDPTR_CACHE.entry[n] = 0;

          exception(BX_TS_EXCEPTION, 0);

        }

      }

#endif

      BX_INSTR_TLB_CNTRL(BX_CPU_ID, BX_INSTR_TASK_SWITCH, newCR3);

    }

  }

  unsigned save_CPL = CPL;

  /* set CPL to 3 to force a privilege level change and stack switch if SS

     is not properly loaded */

  CPL = 3;

  // LDTR

  if (ldt_selector.ti) {

    // LDT selector must be in GDT

    BX_INFO(("task_switch(exception after commit point): bad LDT selector TI=1"));

    exception(BX_TS_EXCEPTION, raw_ldt_selector & 0xfffc);

  }

  if ((raw_ldt_selector & 0xfffc) != 0) {

    bx_bool good = fetch_raw_descriptor2(&ldt_selector, &dword1, &dword2);

    if (!good) {

      BX_ERROR(("task_switch(exception after commit point): bad LDT fetch"));

      exception(BX_TS_EXCEPTION, raw_ldt_selector & 0xfffc);

    }

    parse_descriptor(dword1, dword2, &ldt_descriptor);

    // LDT selector of new task is valid, else #TS(new task's LDT)

    if (ldt_descriptor.valid==0 ||

        ldt_descriptor.type!=BX_SYS_SEGMENT_LDT ||

        ldt_descriptor.segment)

    {

      BX_ERROR(("task_switch(exception after commit point): bad LDT segment"));

      exception(BX_TS_EXCEPTION, raw_ldt_selector & 0xfffc);

    }

    // LDT of new task is present in memory, else #TS(new tasks's LDT)

    if (! IS_PRESENT(ldt_descriptor)) {

      BX_ERROR(("task_switch(exception after commit point): LDT not present"));

      exception(BX_TS_EXCEPTION, raw_ldt_selector & 0xfffc);

    }

    // All checks pass, fill in LDTR shadow cache

    BX_CPU_THIS_PTR ldtr.cache = ldt_descriptor;

  }

  else {

    // NULL LDT selector is OK, leave cache invalid

  }

  if (v8086_mode()) {

    // load seg regs as 8086 registers

    load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS], raw_ss_selector);

    load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS], raw_ds_selector);

    load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES], raw_es_selector);

    load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS], raw_fs_selector);

    load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS], raw_gs_selector);

    load_seg_reg(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_CS], raw_cs_selector);

    // CPL is set from CS selector

  }

  else {

    // SS

    if ((raw_ss_selector & 0xfffc) != 0)

    {

      bx_bool good = fetch_raw_descriptor2(&ss_selector, &dword1, &dword2);

      if (!good) {

        BX_ERROR(("task_switch(exception after commit point): bad SS fetch"));

        exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc);

      }

      parse_descriptor(dword1, dword2, &ss_descriptor);

      // SS selector must be within its descriptor table limits else #TS(SS)

      // SS descriptor AR byte must must indicate writable data segment,

      // else #TS(SS)

      if (ss_descriptor.valid==0 || ss_descriptor.segment==0 ||

           IS_CODE_SEGMENT(ss_descriptor.type) ||

          !IS_DATA_SEGMENT_WRITEABLE(ss_descriptor.type))

      {

        BX_ERROR(("task_switch(exception after commit point): SS not valid or writeable segment"));

        exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc);

      }

      //

      // Stack segment is present in memory, else #SS(new stack segment)

      //

      if (! IS_PRESENT(ss_descriptor)) {

        BX_ERROR(("task_switch(exception after commit point): SS not present"));

        exception(BX_SS_EXCEPTION, raw_ss_selector & 0xfffc);

      }

      // Stack segment DPL matches CS.RPL, else #TS(new stack segment)

      if (ss_descriptor.dpl != cs_selector.rpl) {

        BX_ERROR(("task_switch(exception after commit point): SS.rpl != CS.RPL"));

        exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc);

      }

      // Stack segment DPL matches selector RPL, else #TS(new stack segment)

      if (ss_descriptor.dpl != ss_selector.rpl) {

        BX_ERROR(("task_switch(exception after commit point): SS.dpl != SS.rpl"));

        exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc);

      }

      touch_segment(&ss_selector, &ss_descriptor);

      // All checks pass, fill in shadow cache

      BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].cache = ss_descriptor;

      invalidate_stack_cache();

    }

    else {

      // SS selector is valid, else #TS(new stack segment)

      BX_ERROR(("task_switch(exception after commit point): SS NULL"));

      exception(BX_TS_EXCEPTION, raw_ss_selector & 0xfffc);

    }

    CPL = save_CPL;

    task_switch_load_selector(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_DS],

        &ds_selector, raw_ds_selector, cs_selector.rpl);

    task_switch_load_selector(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_ES],

        &es_selector, raw_es_selector, cs_selector.rpl);

    task_switch_load_selector(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_FS],

        &fs_selector, raw_fs_selector, cs_selector.rpl);

    task_switch_load_selector(&BX_CPU_THIS_PTR sregs[BX_SEG_REG_GS],

        &gs_selector, raw_gs_selector, cs_selector.rpl);

    // if new selector is not null then perform following checks:

    //    index must be within its descriptor table limits else #TS(selector)

    //    AR byte must indicate data or readable code else #TS(selector)

    //    if data or non-conforming code then:

    //      DPL must be >= CPL else #TS(selector)

    //      DPL must be >= RPL else #TS(selector)

    //    AR byte must indicate PRESENT else #NP(selector)

    //    load cache with new segment descriptor and set valid bit

    // CS

    if ((raw_cs_selector & 0xfffc) != 0) {

      bx_bool good = fetch_raw_descriptor2(&cs_selector, &dword1, &dword2);

      if (!good) {

        BX_ERROR(("task_switch(exception after commit point): bad CS fetch"));

        exception(BX_TS_EXCEPTION, raw_cs_selector & 0xfffc);

      }

      parse_descriptor(dword1, dword2, &cs_descriptor);

      // CS descriptor AR byte must indicate code segment else #TS(CS)

      if (cs_descriptor.valid==0 || cs_descriptor.segment==0 ||

          IS_DATA_SEGMENT(cs_descriptor.type))

      {

        BX_ERROR(("task_switch(exception after commit point): CS not valid executable seg"));

        exception(BX_TS_EXCEPTION, raw_cs_selector & 0xfffc);

      }

      // if non-conforming then DPL must equal selector RPL else #TS(CS)

      if (IS_CODE_SEGMENT_NON_CONFORMING(cs_descriptor.type) &&

          cs_descriptor.dpl != cs_selector.rpl)

      {

        BX_ERROR(("task_switch(exception after commit point): non-conforming: CS.dpl!=CS.RPL"));

        exception(BX_TS_EXCEPTION, raw_cs_selector & 0xfffc);

      }

      // if conforming then DPL must be <= selector RPL else #TS(CS)

      if (IS_CODE_SEGMENT_CONFORMING(cs_descriptor.type) &&

          cs_descriptor.dpl > cs_selector.rpl)

      {

        BX_ERROR(("task_switch(exception after commit point): conforming: CS.dpl>RPL"));