cpu/ret_far.cc

   1 ////////////////////////////////////////////////////////////////////////
   2 // $Id: ret_far.cc,v 1.9 2007/02/03 21:36:40 sshwarts Exp $
   3 /////////////////////////////////////////////////////////////////////////
   4 //
   5 //  Copyright (C) 2001  MandrakeSoft S.A.
   6 //
   7 //    MandrakeSoft S.A.
   8 //    43, rue d'Aboukir
   9 //    75002 Paris - France
  10 //    http://www.linux-mandrake.com/
  11 //    http://www.mandrakesoft.com/
  12 //
  13 //  This library is free software; you can redistribute it and/or
  14 //  modify it under the terms of the GNU Lesser General Public
  15 //  License as published by the Free Software Foundation; either
  16 //  version 2 of the License, or (at your option) any later version.
  17 //
  18 //  This library is distributed in the hope that it will be useful,
  19 //  but WITHOUT ANY WARRANTY; without even the implied warranty of
  20 //  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  21 //  Lesser General Public License for more details.
  22 //
  23 //  You should have received a copy of the GNU Lesser General Public
  24 //  License along with this library; if not, write to the Free Software
  25 //  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
  26 //
  27
  28
  29 #define NEED_CPU_REG_SHORTCUTS 1
  30 #include "bochs.h"
  31 #include "cpu.h"
  32 #define LOG_THIS BX_CPU_THIS_PTR
  33
  34 #if BX_SUPPORT_X86_64==0
  35 // Make life easier merging cpu64 & cpu code.
  36 #define RIP EIP
  37 #define RSP ESP
  38 #endif
  39
  40
  41   void BX_CPP_AttrRegparmN(2)
  42 BX_CPU_C::return_protected(bxInstruction_c *i, Bit16u pop_bytes)
  43 {
  44   Bit16u raw_cs_selector, raw_ss_selector;
  45   bx_selector_t cs_selector, ss_selector;
  46   bx_descriptor_t cs_descriptor, ss_descriptor;
  47   Bit32u stack_param_offset;
  48   bx_address return_RIP, return_RSP, temp_RSP;
  49   Bit32u dword1, dword2;
  50
  51   /* + 6+N*2: SS      | +12+N*4:     SS | +24+N*8      SS */
  52   /* + 4+N*2: SP      | + 8+N*4:    ESP | +16+N*8     RSP */
  53   /*          parm N  | +        parm N | +        parm N */
  54   /*          parm 3  | +        parm 3 | +        parm 3 */
  55   /*          parm 2  | +        parm 2 | +        parm 2 */
  56   /* + 4:     parm 1  | + 8:     parm 1 | +16:     parm 1 */
  57   /* + 2:     CS      | + 4:         CS | + 8:         CS */
  58   /* + 0:     IP      | + 0:        EIP | + 0:        RIP */
  59
  60 #if BX_SUPPORT_X86_64
  61   if (StackAddrSize64()) temp_RSP = RSP;
  62   else
  63 #endif
  64   {
  65     if (BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].cache.u.segment.d_b) temp_RSP = ESP;
  66     else temp_RSP = SP;
  67   }
  68
  69 #if BX_SUPPORT_X86_64
  70   if (i->os64L()) {
  71     /* operand size=64: 2nd qword on stack must be within stack limits,
  72      *   else #SS(0); */
  73     if (!can_pop(16))
  74     {
  75       BX_ERROR(("return_protected: 2rd qword not in stack limits"));
  76       exception(BX_SS_EXCEPTION, 0, 0);
  77     }
  78
  79     read_virtual_word (BX_SEG_REG_SS, temp_RSP + 8, &raw_cs_selector);
  80     read_virtual_qword(BX_SEG_REG_SS, temp_RSP + 0, &return_RIP);
  81
  82     stack_param_offset = 16;
  83   }
  84   else
  85 #endif
  86   if (i->os32L()) {
  87     /* operand size=32: 2nd dword on stack must be within stack limits,
  88      *   else #SS(0); */
  89     if (! can_pop(8))
  90     {
  91       BX_ERROR(("return_protected: 2rd dword not in stack limits"));
  92       exception(BX_SS_EXCEPTION, 0, 0);
  93     }
  94
  95     Bit32u return_EIP = 0;
  96     read_virtual_word (BX_SEG_REG_SS, temp_RSP + 4, &raw_cs_selector);
  97     read_virtual_dword(BX_SEG_REG_SS, temp_RSP + 0, &return_EIP);
  98     return_RIP = return_EIP;
  99
 100     stack_param_offset = 8;
 101   }
 102   else {
 103     /* operand size=16: second word on stack must be within stack limits,
 104      *   else #SS(0); */
 105     if (! can_pop(4))
 106     {
 107       BX_ERROR(("return_protected: 2nd word not in stack limits"));
 108       exception(BX_SS_EXCEPTION, 0, 0);
 109     }
 110
 111     Bit16u return_IP = 0;
 112     read_virtual_word(BX_SEG_REG_SS, temp_RSP + 2, &raw_cs_selector);
 113     read_virtual_word(BX_SEG_REG_SS, temp_RSP + 0, &return_IP);
 114     return_RIP = return_IP;
 115
 116     stack_param_offset = 4;
 117   }
 118
 119   // selector must be non-null else #GP(0)
 120   if ((raw_cs_selector & 0xfffc) == 0) {
 121     BX_ERROR(("return_protected: CS selector null"));
 122     exception(BX_GP_EXCEPTION, 0, 0);
 123   }
 124
 125   parse_selector(raw_cs_selector, &cs_selector);
 126
 127   // selector index must be within its descriptor table limits,
 128   // else #GP(selector)
 129   fetch_raw_descriptor(&cs_selector, &dword1, &dword2, BX_GP_EXCEPTION);
 130
 131   // descriptor AR byte must indicate code segment, else #GP(selector)
 132   parse_descriptor(dword1, dword2, &cs_descriptor);
 133
 134   // return selector RPL must be >= CPL, else #GP(return selector)
 135   if (cs_selector.rpl < CPL) {
 136     BX_ERROR(("return_protected: CS.rpl < CPL"));
 137     exception(BX_GP_EXCEPTION, raw_cs_selector & 0xfffc, 0);
 138   }
 139
 140   // check code-segment descriptor
 141   check_cs(&cs_descriptor, raw_cs_selector, 0, cs_selector.rpl);
 142
 143   // if return selector RPL == CPL then
 144   // RETURN TO SAME PRIVILEGE LEVEL
 145   if (cs_selector.rpl == CPL)
 146   {
 147     BX_DEBUG(("return_protected: return to SAME PRIVILEGE LEVEL"));
 148
 149     // top word on stack must be within stack limits, else #SS(0)
 150     if (! can_pop(stack_param_offset + pop_bytes)) {
 151       BX_ERROR(("return_protected: top word not in stack limits"));
 152       exception(BX_SS_EXCEPTION, 0, 0);
 153     }
 154
 155     branch_far64(&cs_selector, &cs_descriptor, return_RIP, CPL);
 156
 157 #if BX_SUPPORT_X86_64
 158     if (StackAddrSize64())
 159       RSP += stack_param_offset + pop_bytes;
 160     else
 161 #endif
 162     {
 163       if (BX_CPU_THIS_PTR sregs[BX_SEG_REG_SS].cache.u.segment.d_b)
 164         ESP += stack_param_offset + pop_bytes;
 165       else
 166          SP += stack_param_offset + pop_bytes;
 167     }
 168     return;
 169   }
 170   /* RETURN TO OUTER PRIVILEGE LEVEL */
 171   else {
 172     /* + 6+N*2: SS      | +12+N*4:     SS | +24+N*8      SS */
 173     /* + 4+N*2: SP      | + 8+N*4:    ESP | +16+N*8     RSP */
 174     /*          parm N  | +        parm N | +        parm N */
 175     /*          parm 3  | +        parm 3 | +        parm 3 */
 176     /*          parm 2  | +        parm 2 | +        parm 2 */
 177     /* + 4:     parm 1  | + 8:     parm 1 | +16:     parm 1 */
 178     /* + 2:     CS      | + 4:         CS | + 8:         CS */
 179     /* + 0:     IP      | + 0:        EIP | + 0:        RIP */
 180
 181 #if BX_SUPPORT_X86_64
 182     if (i->os64L()) {
 183       /* top 32+immediate bytes on stack must be within stack limits, else #SS(0) */
 184       if (! can_pop(32 + pop_bytes)) {
 185         BX_ERROR(("return_protected: 32 bytes not within stack limits"));
 186         exception(BX_SS_EXCEPTION, 0, 0);
 187       }
 188
 189       read_virtual_word (BX_SEG_REG_SS, temp_RSP + 24 + pop_bytes, &raw_ss_selector);
 190       read_virtual_qword(BX_SEG_REG_SS, temp_RSP + 16 + pop_bytes, &return_RSP);
 191     }
 192     else
 193 #endif
 194     if (i->os32L()) {
 195       /* top 16+immediate bytes on stack must be within stack limits, else #SS(0) */
 196       if (! can_pop(16 + pop_bytes)) {
 197         BX_ERROR(("return_protected: 16 bytes not within stack limits"));
 198         exception(BX_SS_EXCEPTION, 0, 0);
 199       }
 200
 201       Bit32u return_ESP = 0;
 202       read_virtual_word (BX_SEG_REG_SS, temp_RSP + 12 + pop_bytes, &raw_ss_selector);
 203       read_virtual_dword(BX_SEG_REG_SS, temp_RSP +  8 + pop_bytes, &return_ESP);
 204       return_RSP = return_ESP;
 205     }
 206     else {
 207       /* top 8+immediate bytes on stack must be within stack limits, else #SS(0) */
 208       if (! can_pop(8 + pop_bytes)) {
 209         BX_ERROR(("return_protected: 8 bytes not within stack limits"));
 210         exception(BX_SS_EXCEPTION, 0, 0);
 211       }
 212
 213       Bit16u return_SP = 0;
 214       read_virtual_word(BX_SEG_REG_SS, temp_RSP + 6 + pop_bytes, &raw_ss_selector);
 215       read_virtual_word(BX_SEG_REG_SS, temp_RSP + 4 + pop_bytes, &return_SP);
 216       return_RSP = return_SP;
 217     }
 218
 219     /* selector index must be within its descriptor table limits,
 220      * else #GP(selector) */
 221     parse_selector(raw_ss_selector, &ss_selector);
 222
 223     if ((raw_ss_selector & 0xfffc) == 0) {
 224       if (long_mode()) {
 225         if (! IS_LONG64_SEGMENT(cs_descriptor) || (cs_selector.rpl == 3)) {
 226           BX_ERROR(("return_protected: SS selector null"));
 227           exception(BX_GP_EXCEPTION, 0, 0);
 228         }
 229       }
 230       else // not in long or compatibility mode
 231       {
 232         BX_ERROR(("return_protected: SS selector null"));
 233         exception(BX_GP_EXCEPTION, 0, 0);
 234       }
 235     }
 236
 237     fetch_raw_descriptor(&ss_selector, &dword1, &dword2, BX_GP_EXCEPTION);
 238     parse_descriptor(dword1, dword2, &ss_descriptor);
 239
 240     /* selector RPL must = RPL of the return CS selector,
 241      * else #GP(selector) */
 242     if (ss_selector.rpl != cs_selector.rpl) {
 243       BX_ERROR(("return_protected: ss.rpl != cs.rpl"));
 244       exception(BX_GP_EXCEPTION, raw_ss_selector & 0xfffc, 0);
 245     }
 246
 247     /* descriptor AR byte must indicate a writable data segment,
 248      * else #GP(selector) */
 249     if (ss_descriptor.valid==0 || ss_descriptor.segment==0 ||
 250          IS_CODE_SEGMENT(ss_descriptor.type) ||
 251         !IS_DATA_SEGMENT_WRITEABLE(ss_descriptor.type))
 252     {
 253       BX_ERROR(("return_protected: SS.AR byte not writable data"));
 254       exception(BX_GP_EXCEPTION, raw_ss_selector & 0xfffc, 0);
 255     }
 256
 257     /* descriptor dpl must = RPL of the return CS selector,
 258      * else #GP(selector) */
 259     if (ss_descriptor.dpl != cs_selector.rpl) {
 260       BX_ERROR(("return_protected: SS.dpl != cs.rpl"));
 261       exception(BX_GP_EXCEPTION, raw_ss_selector & 0xfffc, 0);
 262     }
 263
 264     /* segment must be present else #SS(selector) */
 265     if (! IS_PRESENT(ss_descriptor)) {
 266       BX_ERROR(("return_protected: ss.present == 0"));
 267       exception(BX_SS_EXCEPTION, raw_ss_selector & 0xfffc, 0);
 268     }
 269
 270     branch_far64(&cs_selector, &cs_descriptor, return_RIP, cs_selector.rpl);
 271
 272     /* load SS:SP from stack */
 273     /* load SS-cache with return SS descriptor */
 274     load_ss(&ss_selector, &ss_descriptor, cs_selector.rpl);
 275
 276 #if BX_SUPPORT_X86_64
 277     if (StackAddrSize64()) RSP = return_RSP + pop_bytes;
 278     else
 279 #endif
 280     if (ss_descriptor.u.segment.d_b)
 281       ESP = (Bit32u) return_RSP + pop_bytes;
 282     else
 283       SP  = (Bit16u) return_RSP + pop_bytes;
 284
 285     /* check ES, DS, FS, GS for validity */
 286     validate_seg_regs();
 287   }
 288 }