dlls/ntoskrnl.exe/instr.c

   1 /*
   2  * Emulation of privileged instructions
   3  *
   4  * Copyright 1995 Alexandre Julliard
   5  * Copyright 2005 Ivan Leo Puoti
   6  * Copyright 2005 Laurent Pinchart
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  21  */
  22
  23 #include "config.h"
  24 #include "wine/port.h"
  25
  26 #ifdef __i386__
  27
  28 #include <stdarg.h>
  29
  30 #include "windef.h"
  31 #include "winbase.h"
  32 #include "winternl.h"
  33 #include "excpt.h"
  34 #include "wine/debug.h"
  35 #include "wine/exception.h"
  36
  37 WINE_DEFAULT_DEBUG_CHANNEL(int);
  38
  39 #include "pshpack1.h"
  40 struct idtr
  41 {
  42     WORD  limit;
  43     BYTE *base;
  44 };
  45 #include "poppack.h"
  46
  47 static LDT_ENTRY idt[256];
  48
  49 static inline struct idtr get_idtr(void)
  50 {
  51     struct idtr ret;
  52 #ifdef __GNUC__
  53     __asm__( "sidtl %0" : "=m" (ret) );
  54 #else
  55     ret.base = (BYTE *)idt;
  56     ret.limit = sizeof(idt) - 1;
  57 #endif
  58     return ret;
  59 }
  60
  61 /* store an operand into a register */
  62 static void store_reg( CONTEXT *context, BYTE regmodrm, const BYTE *addr, int long_op )
  63 {
  64     switch((regmodrm >> 3) & 7)
  65     {
  66     case 0:
  67         if (long_op) context->Eax = *(const DWORD *)addr;
  68         else context->Eax = (context->Eax & 0xffff0000) | *(const WORD *)addr;
  69         break;
  70     case 1:
  71         if (long_op) context->Ecx = *(const DWORD *)addr;
  72         else context->Ecx = (context->Ecx & 0xffff0000) | *(const WORD *)addr;
  73         break;
  74     case 2:
  75         if (long_op) context->Edx = *(const DWORD *)addr;
  76         else context->Edx = (context->Edx & 0xffff0000) | *(const WORD *)addr;
  77         break;
  78     case 3:
  79         if (long_op) context->Ebx = *(const DWORD *)addr;
  80         else context->Ebx = (context->Ebx & 0xffff0000) | *(const WORD *)addr;
  81         break;
  82     case 4:
  83         if (long_op) context->Esp = *(const DWORD *)addr;
  84         else context->Esp = (context->Esp & 0xffff0000) | *(const WORD *)addr;
  85         break;
  86     case 5:
  87         if (long_op) context->Ebp = *(const DWORD *)addr;
  88         else context->Ebp = (context->Ebp & 0xffff0000) | *(const WORD *)addr;
  89         break;
  90     case 6:
  91         if (long_op) context->Esi = *(const DWORD *)addr;
  92         else context->Esi = (context->Esi & 0xffff0000) | *(const WORD *)addr;
  93         break;
  94     case 7:
  95         if (long_op) context->Edi = *(const DWORD *)addr;
  96         else context->Edi = (context->Edi & 0xffff0000) | *(const WORD *)addr;
  97         break;
  98     }
  99 }
 100
 101 /***********************************************************************
 102  *           INSTR_GetOperandAddr
 103  *
 104  * Return the address of an instruction operand (from the mod/rm byte).
 105  */
 106 static BYTE *INSTR_GetOperandAddr( CONTEXT *context, BYTE *instr,
 107                                    int long_addr, int segprefix, int *len )
 108 {
 109     int mod, rm, base = 0, index = 0, ss = 0, off;
 110
 111 #define GET_VAL(val,type) \
 112     { *val = *(type *)instr; instr += sizeof(type); *len += sizeof(type); }
 113
 114     *len = 0;
 115     GET_VAL( &mod, BYTE );
 116     rm = mod & 7;
 117     mod >>= 6;
 118
 119     if (mod == 3)
 120     {
 121         switch(rm)
 122         {
 123         case 0: return (BYTE *)&context->Eax;
 124         case 1: return (BYTE *)&context->Ecx;
 125         case 2: return (BYTE *)&context->Edx;
 126         case 3: return (BYTE *)&context->Ebx;
 127         case 4: return (BYTE *)&context->Esp;
 128         case 5: return (BYTE *)&context->Ebp;
 129         case 6: return (BYTE *)&context->Esi;
 130         case 7: return (BYTE *)&context->Edi;
 131         }
 132     }
 133
 134     if (long_addr)
 135     {
 136         if (rm == 4)
 137         {
 138             BYTE sib;
 139             GET_VAL( &sib, BYTE );
 140             rm = sib & 7;
 141             ss = sib >> 6;
 142             switch(sib >> 3)
 143             {
 144             case 0: index = context->Eax; break;
 145             case 1: index = context->Ecx; break;
 146             case 2: index = context->Edx; break;
 147             case 3: index = context->Ebx; break;
 148             case 4: index = 0; break;
 149             case 5: index = context->Ebp; break;
 150             case 6: index = context->Esi; break;
 151             case 7: index = context->Edi; break;
 152             }
 153         }
 154
 155         switch(rm)
 156         {
 157         case 0: base = context->Eax; break;
 158         case 1: base = context->Ecx; break;
 159         case 2: base = context->Edx; break;
 160         case 3: base = context->Ebx; break;
 161         case 4: base = context->Esp; break;
 162         case 5: base = context->Ebp; break;
 163         case 6: base = context->Esi; break;
 164         case 7: base = context->Edi; break;
 165         }
 166         switch (mod)
 167         {
 168         case 0:
 169             if (rm == 5)  /* special case: ds:(disp32) */
 170             {
 171                 GET_VAL( &base, DWORD );
 172             }
 173             break;
 174
 175         case 1:  /* 8-bit disp */
 176             GET_VAL( &off, BYTE );
 177             base += (signed char)off;
 178             break;
 179
 180         case 2:  /* 32-bit disp */
 181             GET_VAL( &off, DWORD );
 182             base += (signed long)off;
 183             break;
 184         }
 185     }
 186     else  /* short address */
 187     {
 188         switch(rm)
 189         {
 190         case 0:  /* ds:(bx,si) */
 191             base = LOWORD(context->Ebx) + LOWORD(context->Esi);
 192             break;
 193         case 1:  /* ds:(bx,di) */
 194             base = LOWORD(context->Ebx) + LOWORD(context->Edi);
 195             break;
 196         case 2:  /* ss:(bp,si) */
 197             base = LOWORD(context->Ebp) + LOWORD(context->Esi);
 198             break;
 199         case 3:  /* ss:(bp,di) */
 200             base = LOWORD(context->Ebp) + LOWORD(context->Edi);
 201             break;
 202         case 4:  /* ds:(si) */
 203             base = LOWORD(context->Esi);
 204             break;
 205         case 5:  /* ds:(di) */
 206             base = LOWORD(context->Edi);
 207             break;
 208         case 6:  /* ss:(bp) */
 209             base = LOWORD(context->Ebp);
 210             break;
 211         case 7:  /* ds:(bx) */
 212             base = LOWORD(context->Ebx);
 213             break;
 214         }
 215
 216         switch(mod)
 217         {
 218         case 0:
 219             if (rm == 6)  /* special case: ds:(disp16) */
 220             {
 221                 GET_VAL( &base, WORD );
 222             }
 223             break;
 224
 225         case 1:  /* 8-bit disp */
 226             GET_VAL( &off, BYTE );
 227             base += (signed char)off;
 228             break;
 229
 230         case 2:  /* 16-bit disp */
 231             GET_VAL( &off, WORD );
 232             base += (signed short)off;
 233             break;
 234         }
 235         base &= 0xffff;
 236     }
 237     /* FIXME: we assume that all segments have a base of 0 */
 238     return (BYTE *)(base + (index << ss));
 239 #undef GET_VAL
 240 }
 241
 242
 243 /***********************************************************************
 244  *           emulate_instruction
 245  *
 246  * Emulate a privileged instruction.
 247  * Returns exception continuation status.
 248  */
 249 static DWORD emulate_instruction( EXCEPTION_RECORD *rec, CONTEXT *context )
 250 {
 251     int prefix, segprefix, prefixlen, len, long_op, long_addr;
 252     BYTE *instr;
 253
 254     long_op = long_addr = 1;
 255     instr = (BYTE *)context->Eip;
 256     if (!instr) return ExceptionContinueSearch;
 257
 258     /* First handle any possible prefix */
 259
 260     segprefix = -1;  /* no prefix */
 261     prefix = 1;
 262     prefixlen = 0;
 263     while(prefix)
 264     {
 265         switch(*instr)
 266         {
 267         case 0x2e:
 268             segprefix = context->SegCs;
 269             break;
 270         case 0x36:
 271             segprefix = context->SegSs;
 272             break;
 273         case 0x3e:
 274             segprefix = context->SegDs;
 275             break;
 276         case 0x26:
 277             segprefix = context->SegEs;
 278             break;
 279         case 0x64:
 280             segprefix = context->SegFs;
 281             break;
 282         case 0x65:
 283             segprefix = context->SegGs;
 284             break;
 285         case 0x66:
 286             long_op = !long_op;  /* opcode size prefix */
 287             break;
 288         case 0x67:
 289             long_addr = !long_addr;  /* addr size prefix */
 290             break;
 291         case 0xf0:  /* lock */
 292             break;
 293         case 0xf2:  /* repne */
 294             break;
 295         case 0xf3:  /* repe */
 296             break;
 297         default:
 298             prefix = 0;  /* no more prefixes */
 299             break;
 300         }
 301         if (prefix)
 302         {
 303             instr++;
 304             prefixlen++;
 305         }
 306     }
 307
 308     /* Now look at the actual instruction */
 309
 310     switch(*instr)
 311     {
 312     case 0x0f: /* extended instruction */
 313         switch(instr[1])
 314         {
 315         case 0x22: /* mov eax, crX */
 316             switch (instr[2])
 317             {
 318             case 0xc0:
 319                 TRACE("mov eax,cr0 at 0x%08x, EAX=0x%08x\n", context->Eip,context->Eax );
 320                 context->Eip += prefixlen+3;
 321                 return ExceptionContinueExecution;
 322             default:
 323                 break; /*fallthrough to bad instruction handling */
 324             }
 325             break; /*fallthrough to bad instruction handling */
 326         case 0x20: /* mov crX, eax */
 327             switch (instr[2])
 328             {
 329             case 0xe0: /* mov cr4, eax */
 330                 /* CR4 register . See linux/arch/i386/mm/init.c, X86_CR4_ defs
 331                  * bit 0: VME   Virtual Mode Exception ?
 332                  * bit 1: PVI   Protected mode Virtual Interrupt
 333                  * bit 2: TSD   Timestamp disable
 334                  * bit 3: DE    Debugging extensions
 335                  * bit 4: PSE   Page size extensions
 336                  * bit 5: PAE   Physical address extension
 337                  * bit 6: MCE   Machine check enable
 338                  * bit 7: PGE   Enable global pages
 339                  * bit 8: PCE   Enable performance counters at IPL3
 340                  */
 341                 TRACE("mov cr4,eax at 0x%08x\n",context->Eip);
 342                 context->Eax = 0;
 343                 context->Eip += prefixlen+3;
 344                 return ExceptionContinueExecution;
 345             case 0xc0: /* mov cr0, eax */
 346                 TRACE("mov cr0,eax at 0x%08x\n",context->Eip);
 347                 context->Eax = 0x10; /* FIXME: set more bits ? */
 348                 context->Eip += prefixlen+3;
 349                 return ExceptionContinueExecution;
 350             default: /* fallthrough to illegal instruction */
 351                 break;
 352             }
 353             /* fallthrough to illegal instruction */
 354             break;
 355         case 0x21: /* mov drX, eax */
 356             switch (instr[2])
 357             {
 358             case 0xc8: /* mov dr1, eax */
 359                 TRACE("mov dr1,eax at 0x%08x\n",context->Eip);
 360                 context->Eax = context->Dr1;
 361                 context->Eip += prefixlen+3;
 362                 return ExceptionContinueExecution;
 363             case 0xf8: /* mov dr7, eax */
 364                 TRACE("mov dr7,eax at 0x%08x\n",context->Eip);
 365                 context->Eax = 0x400;
 366                 context->Eip += prefixlen+3;
 367                 return ExceptionContinueExecution;
 368             }
 369             ERR("Unsupported DR register, eip+2 is %02x\n", instr[2]);
 370             /* fallthrough to illegal instruction */
 371             break;
 372         case 0x23: /* mov eax drX */
 373             switch (instr[2])
 374             {
 375             case 0xc8: /* mov eax, dr1 */
 376                 context->Dr1 = context->Eax;
 377                 context->Eip += prefixlen+3;
 378                 return ExceptionContinueExecution;
 379             }
 380             ERR("Unsupported DR register, eip+2 is %02x\n", instr[2]);
 381             /* fallthrough to illegal instruction */
 382             break;
 383         }
 384         break;  /* Unable to emulate it */
 385
 386     case 0x8b: /* mov Ev, Gv */
 387     {
 388         BYTE *addr = INSTR_GetOperandAddr(context, instr + 1, long_addr,
 389                                           segprefix, &len);
 390         struct idtr idtr = get_idtr();
 391         unsigned int offset = addr - idtr.base;
 392
 393         if (offset <= idtr.limit + 1 - (long_op ? 4 : 2))
 394         {
 395             idt[1].LimitLow = 0x100; /* FIXME */
 396             idt[2].LimitLow = 0x11E; /* FIXME */
 397             idt[3].LimitLow = 0x500; /* FIXME */
 398             store_reg( context, instr[1], (BYTE *)idt + offset, long_op );
 399             context->Eip += prefixlen + len + 1;
 400             return ExceptionContinueExecution;
 401         }
 402         break;  /* Unable to emulate it */
 403     }
 404
 405     case 0xfa: /* cli */
 406     case 0xfb: /* sti */
 407         context->Eip += prefixlen + 1;
 408         return ExceptionContinueExecution;
 409     }
 410     return ExceptionContinueSearch;  /* Unable to emulate it */
 411 }
 412
 413
 414 /***********************************************************************
 415  *           vectored_handler
 416  *
 417  * Vectored exception handler used to emulate protected instructions
 418  * from 32-bit code.
 419  */
 420 LONG CALLBACK vectored_handler( EXCEPTION_POINTERS *ptrs )
 421 {
 422     EXCEPTION_RECORD *record = ptrs->ExceptionRecord;
 423     CONTEXT *context = ptrs->ContextRecord;
 424
 425     if ((record->ExceptionCode == EXCEPTION_ACCESS_VIOLATION ||
 426          record->ExceptionCode == EXCEPTION_PRIV_INSTRUCTION))
 427     {
 428         if (emulate_instruction( record, context ) == ExceptionContinueExecution)
 429             return EXCEPTION_CONTINUE_EXECUTION;
 430     }
 431     return EXCEPTION_CONTINUE_SEARCH;
 432 }
 433
 434 #endif  /* __i386__ */