--- np2/i386c/ia32/exception.c	2011/01/15 18:36:12	1.23
+++ np2/i386c/ia32/exception.c	2011/12/20 09:03:28	1.27
@@ -92,6 +92,8 @@ exception(int num, int error_code)
 	case NM_EXCEPTION:	/* (F) デバイス使用不可 (FPU が無い) */
 	case MF_EXCEPTION:	/* (F) 浮動小数点エラー */
 		CPU_EIP = CPU_PREV_EIP;
+		if (CPU_STATSAVE.cpu_stat.backout_sp)
+			CPU_ESP = CPU_PREV_ESP;
 		/*FALLTHROUGH*/
 	case NMI_EXCEPTION:	/* (I) NMI 割り込み */
 	case BP_EXCEPTION:	/* (T) ブレークポイント */
@@ -113,6 +115,8 @@ exception(int num, int error_code)
 	case GP_EXCEPTION:	/* (F) 一般保護例外 (errcode) */
 	case PF_EXCEPTION:	/* (F) ページフォルト (errcode) */
 		CPU_EIP = CPU_PREV_EIP;
+		if (CPU_STATSAVE.cpu_stat.backout_sp)
+			CPU_ESP = CPU_PREV_ESP;
 		errorp = 1;
 		break;
 
@@ -121,12 +125,6 @@ exception(int num, int error_code)
 		break;
 	}
 
-	if (CPU_STATSAVE.cpu_stat.backout_sp) {
-		VERBOSE(("exception: restore stack pointer."));
-		CPU_ESP = CPU_PREV_ESP;
-	}
-	CPU_STATSAVE.cpu_stat.backout_sp = 0;
-
 	if (CPU_STAT_EXCEPTION_COUNTER >= 2) {
 		if (dftable[exctype[CPU_STAT_PREV_EXCEPTION]][exctype[num]]) {
 			num = DF_EXCEPTION;
@@ -138,7 +136,7 @@ exception(int num, int error_code)
 
 	VERBOSE(("exception: ---------------------------------------------------------------- end"));
 
-	interrupt(num, 0, errorp, error_code);
+	interrupt(num, INTR_TYPE_EXTINTR, errorp, error_code);
 #if defined(IA32_SUPPORT_DEBUG_REGISTER)
 	if (num != BP_EXCEPTION) {
 		if (CPU_INST_OP32) {
@@ -220,6 +218,8 @@ interrupt(int num, int intrtype, int err
 
 	VERBOSE(("interrupt: num = 0x%02x, intrtype = %s, errorp = %s, error_code = %08x", num, intrtype ? "on" : "off", errorp ? "on" : "off", error_code));
 
+	CPU_SET_PREV_ESP();
+
 	if (!CPU_STAT_PM) {
 		/* real mode */
 		CPU_WORKCLOCK(20);
@@ -231,6 +231,7 @@ interrupt(int num, int intrtype, int err
 		}
 
 		if ((intrtype == INTR_TYPE_EXTINTR) && CPU_STAT_HLT) {
+			VERBOSE(("interrupt: reset HTL in real mode"));
 			CPU_EIP++;
 			CPU_STAT_HLT = 0;
 		}
@@ -256,7 +257,7 @@ interrupt(int num, int intrtype, int err
 #if defined(DEBUG)
 		if (num == 0x80) {
 			/* Linux, FreeBSD, NetBSD, OpenBSD system call */
-			VERBOSE(("interrupt: syscall no = %d\n%s", CPU_EAX, cpu_reg2str()));
+			VERBOSE(("interrupt: syscall# = %d\n%s", CPU_EAX, cpu_reg2str()));
 		}
 #endif
 
@@ -277,10 +278,6 @@ interrupt(int num, int intrtype, int err
 			VERBOSE(("interrupt: gate descripter is invalid."));
 			EXCEPTION(GP_EXCEPTION, exc_errcode);
 		}
-		if (!SEG_IS_PRESENT(&gsd)) {
-			VERBOSE(("interrupt: gate descriptor is not present."));
-			EXCEPTION(GP_EXCEPTION, exc_errcode);
-		}
 		if (!SEG_IS_SYSTEM(&gsd)) {
 			VERBOSE(("interrupt: gate descriptor is not system segment."));
 			EXCEPTION(GP_EXCEPTION, exc_errcode);
@@ -300,18 +297,19 @@ interrupt(int num, int intrtype, int err
 			break;
 		}
 
-		if (gsd.dpl < CPU_STAT_CPL) {
-			VERBOSE(("interrupt: gate DPL(%d) < CPL(%d)", gsd.dpl, CPU_STAT_CPL));
-			EXCEPTION(GP_EXCEPTION, exc_errcode);
-		}
-
 		/* 5.10.1.1. 例外／割り込みハンドラ・プロシージャの保護 */
 		if ((intrtype != INTR_TYPE_EXTINTR) && (gsd.dpl < CPU_STAT_CPL)) {
-			VERBOSE(("interrupt: intrtype && DPL(%d) < CPL(%d)", gsd.dpl, CPU_STAT_CPL));
+			VERBOSE(("interrupt: intrtype(%d) && DPL(%d) < CPL(%d)", intrtype, gsd.dpl, CPU_STAT_CPL));
 			EXCEPTION(GP_EXCEPTION, exc_errcode);
 		}
 
-		if (!intrtype && CPU_STAT_HLT) {
+		if (!SEG_IS_PRESENT(&gsd)) {
+			VERBOSE(("interrupt: gate descriptor is not present."));
+			EXCEPTION(NP_EXCEPTION, exc_errcode);
+		}
+
+		if ((intrtype == INTR_TYPE_EXTINTR) && CPU_STAT_HLT) {
+			VERBOSE(("interrupt: reset HTL in protected mode"));
 			CPU_EIP++;
 			CPU_STAT_HLT = 0;
 		}
@@ -335,6 +333,8 @@ interrupt(int num, int intrtype, int err
 
 		VERBOSE(("interrupt: ---------------------------------------------------------------- end"));
 	}
+
+	CPU_CLEAR_PREV_ESP();
 }
 
 static void
@@ -375,9 +375,17 @@ interrupt_task_gate(const descriptor_t *
 
 	task_switch(&task_sel, TASK_SWITCH_INTR);
 
+	CPU_SET_PREV_ESP();
+
 	if (errorp) {
 		XPUSH0(error_code);
 	}
+
+	/* out of range */
+	if (CPU_EIP > CPU_STAT_CS_LIMIT) {
+		VERBOSE(("interrupt: new_ip is out of range. new_ip = %08x, limit = %08x", CPU_EIP, CPU_STAT_CS_LIMIT));
+		EXCEPTION(GP_EXCEPTION, 0);
+	}
 }
 
 static void