dlls/ntoskrnl.exe/instr.c

   1 /*
   2  * Emulation of privileged instructions
   3  *
   4  * Copyright 1995 Alexandre Julliard
   5  * Copyright 2005 Ivan Leo Puoti
   6  * Copyright 2005 Laurent Pinchart
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  21  */
  22
  23 #include "config.h"
  24 #include "wine/port.h"
  25
  26 #ifdef __i386__
  27
  28 #include <stdarg.h>
  29
  30 #include "windef.h"
  31 #include "winbase.h"
  32 #include "winternl.h"
  33 #include "excpt.h"
  34 #include "wine/debug.h"
  35 #include "wine/exception.h"
  36
  37 WINE_DEFAULT_DEBUG_CHANNEL(int);
  38
  39 #include "pshpack1.h"
  40 struct idtr
  41 {
  42     WORD  limit;
  43     BYTE *base;
  44 };
  45 #include "poppack.h"
  46
  47 static LDT_ENTRY idt[256];
  48
  49 static inline struct idtr get_idtr(void)
  50 {
  51     struct idtr ret;
  52 #ifdef __GNUC__
  53     __asm__( "sidtl %0" : "=m" (ret) );
  54 #else
  55     ret.base = (BYTE *)idt;
  56     ret.limit = sizeof(idt) - 1;
  57 #endif
  58     return ret;
  59 }
  60
  61 /* store an operand into a register */
  62 static void store_reg( CONTEXT86 *context, BYTE regmodrm, const BYTE *addr, int long_op )
  63 {
  64     switch((regmodrm >> 3) & 7)
  65     {
  66     case 0:
  67         if (long_op) context->Eax = *(const DWORD *)addr;
  68         else context->Eax = (context->Eax & 0xffff0000) | *(const WORD *)addr;
  69         break;
  70     case 1:
  71         if (long_op) context->Ecx = *(const DWORD *)addr;
  72         else context->Ecx = (context->Ecx & 0xffff0000) | *(const WORD *)addr;
  73         break;
  74     case 2:
  75         if (long_op) context->Edx = *(const DWORD *)addr;
  76         else context->Edx = (context->Edx & 0xffff0000) | *(const WORD *)addr;
  77         break;
  78     case 3:
  79         if (long_op) context->Ebx = *(const DWORD *)addr;
  80         else context->Ebx = (context->Ebx & 0xffff0000) | *(const WORD *)addr;
  81         break;
  82     case 4:
  83         if (long_op) context->Esp = *(const DWORD *)addr;
  84         else context->Esp = (context->Esp & 0xffff0000) | *(const WORD *)addr;
  85         break;
  86     case 5:
  87         if (long_op) context->Ebp = *(const DWORD *)addr;
  88         else context->Ebp = (context->Ebp & 0xffff0000) | *(const WORD *)addr;
  89         break;
  90     case 6:
  91         if (long_op) context->Esi = *(const DWORD *)addr;
  92         else context->Esi = (context->Esi & 0xffff0000) | *(const WORD *)addr;
  93         break;
  94     case 7:
  95         if (long_op) context->Edi = *(const DWORD *)addr;
  96         else context->Edi = (context->Edi & 0xffff0000) | *(const WORD *)addr;
  97         break;
  98     }
  99 }
 100
 101 /***********************************************************************
 102  *           INSTR_GetOperandAddr
 103  *
 104  * Return the address of an instruction operand (from the mod/rm byte).
 105  */
 106 static BYTE *INSTR_GetOperandAddr( CONTEXT86 *context, BYTE *instr,
 107                                    int long_addr, int segprefix, int *len )
 108 {
 109     int mod, rm, base = 0, index = 0, ss = 0, seg = 0, off;
 110
 111 #define GET_VAL(val,type) \
 112     { *val = *(type *)instr; instr += sizeof(type); *len += sizeof(type); }
 113
 114     *len = 0;
 115     GET_VAL( &mod, BYTE );
 116     rm = mod & 7;
 117     mod >>= 6;
 118
 119     if (mod == 3)
 120     {
 121         switch(rm)
 122         {
 123         case 0: return (BYTE *)&context->Eax;
 124         case 1: return (BYTE *)&context->Ecx;
 125         case 2: return (BYTE *)&context->Edx;
 126         case 3: return (BYTE *)&context->Ebx;
 127         case 4: return (BYTE *)&context->Esp;
 128         case 5: return (BYTE *)&context->Ebp;
 129         case 6: return (BYTE *)&context->Esi;
 130         case 7: return (BYTE *)&context->Edi;
 131         }
 132     }
 133
 134     if (long_addr)
 135     {
 136         if (rm == 4)
 137         {
 138             BYTE sib;
 139             GET_VAL( &sib, BYTE );
 140             rm = sib & 7;
 141             ss = sib >> 6;
 142             switch(sib >> 3)
 143             {
 144             case 0: index = context->Eax; break;
 145             case 1: index = context->Ecx; break;
 146             case 2: index = context->Edx; break;
 147             case 3: index = context->Ebx; break;
 148             case 4: index = 0; break;
 149             case 5: index = context->Ebp; break;
 150             case 6: index = context->Esi; break;
 151             case 7: index = context->Edi; break;
 152             }
 153         }
 154
 155         switch(rm)
 156         {
 157         case 0: base = context->Eax; seg = context->SegDs; break;
 158         case 1: base = context->Ecx; seg = context->SegDs; break;
 159         case 2: base = context->Edx; seg = context->SegDs; break;
 160         case 3: base = context->Ebx; seg = context->SegDs; break;
 161         case 4: base = context->Esp; seg = context->SegSs; break;
 162         case 5: base = context->Ebp; seg = context->SegSs; break;
 163         case 6: base = context->Esi; seg = context->SegDs; break;
 164         case 7: base = context->Edi; seg = context->SegDs; break;
 165         }
 166         switch (mod)
 167         {
 168         case 0:
 169             if (rm == 5)  /* special case: ds:(disp32) */
 170             {
 171                 GET_VAL( &base, DWORD );
 172                 seg = context->SegDs;
 173             }
 174             break;
 175
 176         case 1:  /* 8-bit disp */
 177             GET_VAL( &off, BYTE );
 178             base += (signed char)off;
 179             break;
 180
 181         case 2:  /* 32-bit disp */
 182             GET_VAL( &off, DWORD );
 183             base += (signed long)off;
 184             break;
 185         }
 186     }
 187     else  /* short address */
 188     {
 189         switch(rm)
 190         {
 191         case 0:  /* ds:(bx,si) */
 192             base = LOWORD(context->Ebx) + LOWORD(context->Esi);
 193             seg  = context->SegDs;
 194             break;
 195         case 1:  /* ds:(bx,di) */
 196             base = LOWORD(context->Ebx) + LOWORD(context->Edi);
 197             seg  = context->SegDs;
 198             break;
 199         case 2:  /* ss:(bp,si) */
 200             base = LOWORD(context->Ebp) + LOWORD(context->Esi);
 201             seg  = context->SegSs;
 202             break;
 203         case 3:  /* ss:(bp,di) */
 204             base = LOWORD(context->Ebp) + LOWORD(context->Edi);
 205             seg  = context->SegSs;
 206             break;
 207         case 4:  /* ds:(si) */
 208             base = LOWORD(context->Esi);
 209             seg  = context->SegDs;
 210             break;
 211         case 5:  /* ds:(di) */
 212             base = LOWORD(context->Edi);
 213             seg  = context->SegDs;
 214             break;
 215         case 6:  /* ss:(bp) */
 216             base = LOWORD(context->Ebp);
 217             seg  = context->SegSs;
 218             break;
 219         case 7:  /* ds:(bx) */
 220             base = LOWORD(context->Ebx);
 221             seg  = context->SegDs;
 222             break;
 223         }
 224
 225         switch(mod)
 226         {
 227         case 0:
 228             if (rm == 6)  /* special case: ds:(disp16) */
 229             {
 230                 GET_VAL( &base, WORD );
 231                 seg  = context->SegDs;
 232             }
 233             break;
 234
 235         case 1:  /* 8-bit disp */
 236             GET_VAL( &off, BYTE );
 237             base += (signed char)off;
 238             break;
 239
 240         case 2:  /* 16-bit disp */
 241             GET_VAL( &off, WORD );
 242             base += (signed short)off;
 243             break;
 244         }
 245         base &= 0xffff;
 246     }
 247     if (segprefix != -1) seg = segprefix;
 248
 249     /* FIXME: we assume that all segments have a base of 0 */
 250     return (BYTE *)(base + (index << ss));
 251 #undef GET_VAL
 252 }
 253
 254
 255 /***********************************************************************
 256  *           emulate_instruction
 257  *
 258  * Emulate a privileged instruction.
 259  * Returns exception continuation status.
 260  */
 261 static DWORD emulate_instruction( EXCEPTION_RECORD *rec, CONTEXT86 *context )
 262 {
 263     int prefix, segprefix, prefixlen, len, repX, long_op, long_addr;
 264     BYTE *instr;
 265
 266     long_op = long_addr = 1;
 267     instr = (BYTE *)context->Eip;
 268     if (!instr) return ExceptionContinueSearch;
 269
 270     /* First handle any possible prefix */
 271
 272     segprefix = -1;  /* no prefix */
 273     prefix = 1;
 274     repX = 0;
 275     prefixlen = 0;
 276     while(prefix)
 277     {
 278         switch(*instr)
 279         {
 280         case 0x2e:
 281             segprefix = context->SegCs;
 282             break;
 283         case 0x36:
 284             segprefix = context->SegSs;
 285             break;
 286         case 0x3e:
 287             segprefix = context->SegDs;
 288             break;
 289         case 0x26:
 290             segprefix = context->SegEs;
 291             break;
 292         case 0x64:
 293             segprefix = context->SegFs;
 294             break;
 295         case 0x65:
 296             segprefix = context->SegGs;
 297             break;
 298         case 0x66:
 299             long_op = !long_op;  /* opcode size prefix */
 300             break;
 301         case 0x67:
 302             long_addr = !long_addr;  /* addr size prefix */
 303             break;
 304         case 0xf0:  /* lock */
 305             break;
 306         case 0xf2:  /* repne */
 307             repX = 1;
 308             break;
 309         case 0xf3:  /* repe */
 310             repX = 2;
 311             break;
 312         default:
 313             prefix = 0;  /* no more prefixes */
 314             break;
 315         }
 316         if (prefix)
 317         {
 318             instr++;
 319             prefixlen++;
 320         }
 321     }
 322
 323     /* Now look at the actual instruction */
 324
 325     switch(*instr)
 326     {
 327     case 0x0f: /* extended instruction */
 328         switch(instr[1])
 329         {
 330         case 0x22: /* mov eax, crX */
 331             switch (instr[2])
 332             {
 333             case 0xc0:
 334                 TRACE("mov eax,cr0 at 0x%08x, EAX=0x%08x\n", context->Eip,context->Eax );
 335                 context->Eip += prefixlen+3;
 336                 return ExceptionContinueExecution;
 337             default:
 338                 break; /*fallthrough to bad instruction handling */
 339             }
 340             break; /*fallthrough to bad instruction handling */
 341         case 0x20: /* mov crX, eax */
 342             switch (instr[2])
 343             {
 344             case 0xe0: /* mov cr4, eax */
 345                 /* CR4 register . See linux/arch/i386/mm/init.c, X86_CR4_ defs
 346                  * bit 0: VME   Virtual Mode Exception ?
 347                  * bit 1: PVI   Protected mode Virtual Interrupt
 348                  * bit 2: TSD   Timestamp disable
 349                  * bit 3: DE    Debugging extensions
 350                  * bit 4: PSE   Page size extensions
 351                  * bit 5: PAE   Physical address extension
 352                  * bit 6: MCE   Machine check enable
 353                  * bit 7: PGE   Enable global pages
 354                  * bit 8: PCE   Enable performance counters at IPL3
 355                  */
 356                 TRACE("mov cr4,eax at 0x%08x\n",context->Eip);
 357                 context->Eax = 0;
 358                 context->Eip += prefixlen+3;
 359                 return ExceptionContinueExecution;
 360             case 0xc0: /* mov cr0, eax */
 361                 TRACE("mov cr0,eax at 0x%08x\n",context->Eip);
 362                 context->Eax = 0x10; /* FIXME: set more bits ? */
 363                 context->Eip += prefixlen+3;
 364                 return ExceptionContinueExecution;
 365             default: /* fallthrough to illegal instruction */
 366                 break;
 367             }
 368             /* fallthrough to illegal instruction */
 369             break;
 370         case 0x21: /* mov drX, eax */
 371             switch (instr[2])
 372             {
 373             case 0xc8: /* mov dr1, eax */
 374                 TRACE("mov dr1,eax at 0x%08x\n",context->Eip);
 375                 context->Eax = context->Dr1;
 376                 context->Eip += prefixlen+3;
 377                 return ExceptionContinueExecution;
 378             case 0xf8: /* mov dr7, eax */
 379                 TRACE("mov dr7,eax at 0x%08x\n",context->Eip);
 380                 context->Eax = 0x400;
 381                 context->Eip += prefixlen+3;
 382                 return ExceptionContinueExecution;
 383             }
 384             ERR("Unsupported DR register, eip+2 is %02x\n", instr[2]);
 385             /* fallthrough to illegal instruction */
 386             break;
 387         case 0x23: /* mov eax drX */
 388             switch (instr[2])
 389             {
 390             case 0xc8: /* mov eax, dr1 */
 391                 context->Dr1 = context->Eax;
 392                 context->Eip += prefixlen+3;
 393                 return ExceptionContinueExecution;
 394             }
 395             ERR("Unsupported DR register, eip+2 is %02x\n", instr[2]);
 396             /* fallthrough to illegal instruction */
 397             break;
 398         }
 399         break;  /* Unable to emulate it */
 400
 401     case 0x8b: /* mov Ev, Gv */
 402     {
 403         BYTE *addr = INSTR_GetOperandAddr(context, instr + 1, long_addr,
 404                                           segprefix, &len);
 405         struct idtr idtr = get_idtr();
 406         unsigned int offset = addr - idtr.base;
 407
 408         if (offset <= idtr.limit + 1 - (long_op ? 4 : 2))
 409         {
 410             idt[1].LimitLow = 0x100; /* FIXME */
 411             idt[2].LimitLow = 0x11E; /* FIXME */
 412             idt[3].LimitLow = 0x500; /* FIXME */
 413             store_reg( context, instr[1], (BYTE *)idt + offset, long_op );
 414             context->Eip += prefixlen + len + 1;
 415             return ExceptionContinueExecution;
 416         }
 417         break;  /* Unable to emulate it */
 418     }
 419
 420     case 0xfa: /* cli */
 421     case 0xfb: /* sti */
 422         context->Eip += prefixlen + 1;
 423         return ExceptionContinueExecution;
 424     }
 425     return ExceptionContinueSearch;  /* Unable to emulate it */
 426 }
 427
 428
 429 /***********************************************************************
 430  *           vectored_handler
 431  *
 432  * Vectored exception handler used to emulate protected instructions
 433  * from 32-bit code.
 434  */
 435 LONG CALLBACK vectored_handler( EXCEPTION_POINTERS *ptrs )
 436 {
 437     EXCEPTION_RECORD *record = ptrs->ExceptionRecord;
 438     CONTEXT86 *context = ptrs->ContextRecord;
 439
 440     if ((record->ExceptionCode == EXCEPTION_ACCESS_VIOLATION ||
 441          record->ExceptionCode == EXCEPTION_PRIV_INSTRUCTION))
 442     {
 443         if (emulate_instruction( record, context ) == ExceptionContinueExecution)
 444             return EXCEPTION_CONTINUE_EXECUTION;
 445     }
 446     return EXCEPTION_CONTINUE_SEARCH;
 447 }
 448
 449 #endif  /* __i386__ */