dlls/ntoskrnl.exe/instr.c

   1 /*
   2  * Emulation of privileged instructions
   3  *
   4  * Copyright 1995 Alexandre Julliard
   5  * Copyright 2005 Ivan Leo Puoti
   6  * Copyright 2005 Laurent Pinchart
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  21  */
  22
  23 #include "config.h"
  24 #include "wine/port.h"
  25
  26 #ifdef __i386__
  27
  28 #include <stdarg.h>
  29
  30 #include "windef.h"
  31 #include "winbase.h"
  32 #include "winternl.h"
  33 #include "excpt.h"
  34 #include "wine/debug.h"
  35 #include "wine/exception.h"
  36
  37 WINE_DEFAULT_DEBUG_CHANNEL(int);
  38
  39 #include "pshpack1.h"
  40 struct idtr
  41 {
  42     WORD  limit;
  43     BYTE *base;
  44 };
  45 #include "poppack.h"
  46
  47 static LDT_ENTRY idt[256];
  48
  49 static inline struct idtr get_idtr(void)
  50 {
  51     struct idtr ret;
  52 #ifdef __GNUC__
  53     __asm__( "sidtl %0" : "=m" (ret) );
  54 #else
  55     ret.base = (BYTE *)idt;
  56     ret.limit = sizeof(idt) - 1;
  57 #endif
  58     return ret;
  59 }
  60
  61 /* store an operand into a register */
  62 static void store_reg_word( CONTEXT *context, BYTE regmodrm, const BYTE *addr, int long_op )
  63 {
  64     switch((regmodrm >> 3) & 7)
  65     {
  66     case 0:
  67         if (long_op) context->Eax = *(const DWORD *)addr;
  68         else context->Eax = (context->Eax & 0xffff0000) | *(const WORD *)addr;
  69         break;
  70     case 1:
  71         if (long_op) context->Ecx = *(const DWORD *)addr;
  72         else context->Ecx = (context->Ecx & 0xffff0000) | *(const WORD *)addr;
  73         break;
  74     case 2:
  75         if (long_op) context->Edx = *(const DWORD *)addr;
  76         else context->Edx = (context->Edx & 0xffff0000) | *(const WORD *)addr;
  77         break;
  78     case 3:
  79         if (long_op) context->Ebx = *(const DWORD *)addr;
  80         else context->Ebx = (context->Ebx & 0xffff0000) | *(const WORD *)addr;
  81         break;
  82     case 4:
  83         if (long_op) context->Esp = *(const DWORD *)addr;
  84         else context->Esp = (context->Esp & 0xffff0000) | *(const WORD *)addr;
  85         break;
  86     case 5:
  87         if (long_op) context->Ebp = *(const DWORD *)addr;
  88         else context->Ebp = (context->Ebp & 0xffff0000) | *(const WORD *)addr;
  89         break;
  90     case 6:
  91         if (long_op) context->Esi = *(const DWORD *)addr;
  92         else context->Esi = (context->Esi & 0xffff0000) | *(const WORD *)addr;
  93         break;
  94     case 7:
  95         if (long_op) context->Edi = *(const DWORD *)addr;
  96         else context->Edi = (context->Edi & 0xffff0000) | *(const WORD *)addr;
  97         break;
  98     }
  99 }
 100
 101 /* store an operand into a byte register */
 102 static void store_reg_byte( CONTEXT *context, BYTE regmodrm, const BYTE *addr )
 103 {
 104     switch((regmodrm >> 3) & 7)
 105     {
 106     case 0: context->Eax = (context->Eax & 0xffffff00) | *addr; break;
 107     case 1: context->Ecx = (context->Ecx & 0xffffff00) | *addr; break;
 108     case 2: context->Edx = (context->Edx & 0xffffff00) | *addr; break;
 109     case 3: context->Ebx = (context->Ebx & 0xffffff00) | *addr; break;
 110     case 4: context->Eax = (context->Eax & 0xffff00ff) | (*addr << 8); break;
 111     case 5: context->Ecx = (context->Ecx & 0xffff00ff) | (*addr << 8); break;
 112     case 6: context->Edx = (context->Edx & 0xffff00ff) | (*addr << 8); break;
 113     case 7: context->Ebx = (context->Ebx & 0xffff00ff) | (*addr << 8); break;
 114     }
 115 }
 116
 117 /***********************************************************************
 118  *           INSTR_GetOperandAddr
 119  *
 120  * Return the address of an instruction operand (from the mod/rm byte).
 121  */
 122 static BYTE *INSTR_GetOperandAddr( CONTEXT *context, BYTE *instr,
 123                                    int long_addr, int segprefix, int *len )
 124 {
 125     int mod, rm, base = 0, index = 0, ss = 0, off;
 126
 127 #define GET_VAL(val,type) \
 128     { *val = *(type *)instr; instr += sizeof(type); *len += sizeof(type); }
 129
 130     *len = 0;
 131     GET_VAL( &mod, BYTE );
 132     rm = mod & 7;
 133     mod >>= 6;
 134
 135     if (mod == 3)
 136     {
 137         switch(rm)
 138         {
 139         case 0: return (BYTE *)&context->Eax;
 140         case 1: return (BYTE *)&context->Ecx;
 141         case 2: return (BYTE *)&context->Edx;
 142         case 3: return (BYTE *)&context->Ebx;
 143         case 4: return (BYTE *)&context->Esp;
 144         case 5: return (BYTE *)&context->Ebp;
 145         case 6: return (BYTE *)&context->Esi;
 146         case 7: return (BYTE *)&context->Edi;
 147         }
 148     }
 149
 150     if (long_addr)
 151     {
 152         if (rm == 4)
 153         {
 154             BYTE sib;
 155             GET_VAL( &sib, BYTE );
 156             rm = sib & 7;
 157             ss = sib >> 6;
 158             switch((sib >> 3) & 7)
 159             {
 160             case 0: index = context->Eax; break;
 161             case 1: index = context->Ecx; break;
 162             case 2: index = context->Edx; break;
 163             case 3: index = context->Ebx; break;
 164             case 4: index = 0; break;
 165             case 5: index = context->Ebp; break;
 166             case 6: index = context->Esi; break;
 167             case 7: index = context->Edi; break;
 168             }
 169         }
 170
 171         switch(rm)
 172         {
 173         case 0: base = context->Eax; break;
 174         case 1: base = context->Ecx; break;
 175         case 2: base = context->Edx; break;
 176         case 3: base = context->Ebx; break;
 177         case 4: base = context->Esp; break;
 178         case 5: base = context->Ebp; break;
 179         case 6: base = context->Esi; break;
 180         case 7: base = context->Edi; break;
 181         }
 182         switch (mod)
 183         {
 184         case 0:
 185             if (rm == 5)  /* special case: ds:(disp32) */
 186             {
 187                 GET_VAL( &base, DWORD );
 188             }
 189             break;
 190
 191         case 1:  /* 8-bit disp */
 192             GET_VAL( &off, BYTE );
 193             base += (signed char)off;
 194             break;
 195
 196         case 2:  /* 32-bit disp */
 197             GET_VAL( &off, DWORD );
 198             base += (signed long)off;
 199             break;
 200         }
 201     }
 202     else  /* short address */
 203     {
 204         switch(rm)
 205         {
 206         case 0:  /* ds:(bx,si) */
 207             base = LOWORD(context->Ebx) + LOWORD(context->Esi);
 208             break;
 209         case 1:  /* ds:(bx,di) */
 210             base = LOWORD(context->Ebx) + LOWORD(context->Edi);
 211             break;
 212         case 2:  /* ss:(bp,si) */
 213             base = LOWORD(context->Ebp) + LOWORD(context->Esi);
 214             break;
 215         case 3:  /* ss:(bp,di) */
 216             base = LOWORD(context->Ebp) + LOWORD(context->Edi);
 217             break;
 218         case 4:  /* ds:(si) */
 219             base = LOWORD(context->Esi);
 220             break;
 221         case 5:  /* ds:(di) */
 222             base = LOWORD(context->Edi);
 223             break;
 224         case 6:  /* ss:(bp) */
 225             base = LOWORD(context->Ebp);
 226             break;
 227         case 7:  /* ds:(bx) */
 228             base = LOWORD(context->Ebx);
 229             break;
 230         }
 231
 232         switch(mod)
 233         {
 234         case 0:
 235             if (rm == 6)  /* special case: ds:(disp16) */
 236             {
 237                 GET_VAL( &base, WORD );
 238             }
 239             break;
 240
 241         case 1:  /* 8-bit disp */
 242             GET_VAL( &off, BYTE );
 243             base += (signed char)off;
 244             break;
 245
 246         case 2:  /* 16-bit disp */
 247             GET_VAL( &off, WORD );
 248             base += (signed short)off;
 249             break;
 250         }
 251         base &= 0xffff;
 252     }
 253     /* FIXME: we assume that all segments have a base of 0 */
 254     return (BYTE *)(base + (index << ss));
 255 #undef GET_VAL
 256 }
 257
 258
 259 /***********************************************************************
 260  *           emulate_instruction
 261  *
 262  * Emulate a privileged instruction.
 263  * Returns exception continuation status.
 264  */
 265 static DWORD emulate_instruction( EXCEPTION_RECORD *rec, CONTEXT *context )
 266 {
 267     int prefix, segprefix, prefixlen, len, long_op, long_addr;
 268     BYTE *instr;
 269
 270     long_op = long_addr = 1;
 271     instr = (BYTE *)context->Eip;
 272     if (!instr) return ExceptionContinueSearch;
 273
 274     /* First handle any possible prefix */
 275
 276     segprefix = -1;  /* no prefix */
 277     prefix = 1;
 278     prefixlen = 0;
 279     while(prefix)
 280     {
 281         switch(*instr)
 282         {
 283         case 0x2e:
 284             segprefix = context->SegCs;
 285             break;
 286         case 0x36:
 287             segprefix = context->SegSs;
 288             break;
 289         case 0x3e:
 290             segprefix = context->SegDs;
 291             break;
 292         case 0x26:
 293             segprefix = context->SegEs;
 294             break;
 295         case 0x64:
 296             segprefix = context->SegFs;
 297             break;
 298         case 0x65:
 299             segprefix = context->SegGs;
 300             break;
 301         case 0x66:
 302             long_op = !long_op;  /* opcode size prefix */
 303             break;
 304         case 0x67:
 305             long_addr = !long_addr;  /* addr size prefix */
 306             break;
 307         case 0xf0:  /* lock */
 308             break;
 309         case 0xf2:  /* repne */
 310             break;
 311         case 0xf3:  /* repe */
 312             break;
 313         default:
 314             prefix = 0;  /* no more prefixes */
 315             break;
 316         }
 317         if (prefix)
 318         {
 319             instr++;
 320             prefixlen++;
 321         }
 322     }
 323
 324     /* Now look at the actual instruction */
 325
 326     switch(*instr)
 327     {
 328     case 0x0f: /* extended instruction */
 329         switch(instr[1])
 330         {
 331         case 0x22: /* mov eax, crX */
 332             switch (instr[2])
 333             {
 334             case 0xc0:
 335                 TRACE("mov eax,cr0 at 0x%08x, EAX=0x%08x\n", context->Eip,context->Eax );
 336                 context->Eip += prefixlen+3;
 337                 return ExceptionContinueExecution;
 338             case 0xe0:
 339                 TRACE("mov eax,cr4 at 0x%08x, EAX=0x%08x\n", context->Eip,context->Eax );
 340                 context->Eip += prefixlen+3;
 341                 return ExceptionContinueExecution;
 342             default:
 343                 break; /*fallthrough to bad instruction handling */
 344             }
 345             ERR("Unsupported EAX -> CR register, eip+2 is %02x\n", instr[2]);
 346             break; /*fallthrough to bad instruction handling */
 347         case 0x20: /* mov crX, eax */
 348             switch (instr[2])
 349             {
 350             case 0xe0: /* mov cr4, eax */
 351                 /* CR4 register . See linux/arch/i386/mm/init.c, X86_CR4_ defs
 352                  * bit 0: VME   Virtual Mode Exception ?
 353                  * bit 1: PVI   Protected mode Virtual Interrupt
 354                  * bit 2: TSD   Timestamp disable
 355                  * bit 3: DE    Debugging extensions
 356                  * bit 4: PSE   Page size extensions
 357                  * bit 5: PAE   Physical address extension
 358                  * bit 6: MCE   Machine check enable
 359                  * bit 7: PGE   Enable global pages
 360                  * bit 8: PCE   Enable performance counters at IPL3
 361                  */
 362                 TRACE("mov cr4,eax at 0x%08x\n",context->Eip);
 363                 context->Eax = 0;
 364                 context->Eip += prefixlen+3;
 365                 return ExceptionContinueExecution;
 366             case 0xc0: /* mov cr0, eax */
 367                 TRACE("mov cr0,eax at 0x%08x\n",context->Eip);
 368                 context->Eax = 0x10; /* FIXME: set more bits ? */
 369                 context->Eip += prefixlen+3;
 370                 return ExceptionContinueExecution;
 371             default: /* fallthrough to illegal instruction */
 372                 break;
 373             }
 374             /* fallthrough to illegal instruction */
 375             break;
 376         case 0x21: /* mov drX, eax */
 377             switch (instr[2])
 378             {
 379             case 0xc8: /* mov dr1, eax */
 380                 TRACE("mov dr1,eax at 0x%08x\n",context->Eip);
 381                 context->Eax = context->Dr1;
 382                 context->Eip += prefixlen+3;
 383                 return ExceptionContinueExecution;
 384             case 0xf8: /* mov dr7, eax */
 385                 TRACE("mov dr7,eax at 0x%08x\n",context->Eip);
 386                 context->Eax = 0x400;
 387                 context->Eip += prefixlen+3;
 388                 return ExceptionContinueExecution;
 389             }
 390             ERR("Unsupported DR register -> EAX, eip+2 is %02x\n", instr[2]);
 391             /* fallthrough to illegal instruction */
 392             break;
 393         case 0x23: /* mov eax drX */
 394             switch (instr[2])
 395             {
 396             case 0xc0: /* mov eax, dr0 */
 397                 context->Dr0 = context->Eax;
 398                 context->Eip += prefixlen+3;
 399                 return ExceptionContinueExecution;
 400             case 0xc8: /* mov eax, dr1 */
 401                 context->Dr1 = context->Eax;
 402                 context->Eip += prefixlen+3;
 403                 return ExceptionContinueExecution;
 404             case 0xd0: /* mov eax, dr2 */
 405                 context->Dr2 = context->Eax;
 406                 context->Eip += prefixlen+3;
 407                 return ExceptionContinueExecution;
 408             case 0xd8: /* mov eax, dr3 */
 409                 context->Dr3 = context->Eax;
 410                 context->Eip += prefixlen+3;
 411                 return ExceptionContinueExecution;
 412             case 0xf8: /* mov eax, dr7 */
 413                 context->Dr7 = context->Eax;
 414                 context->Eip += prefixlen+3;
 415                 return ExceptionContinueExecution;
 416             }
 417             ERR("Unsupported EAX -> DR register, eip+2 is %02x\n", instr[2]);
 418             /* fallthrough to illegal instruction */
 419             break;
 420         }
 421         break;  /* Unable to emulate it */
 422
 423     case 0x8a: /* mov Eb, Gb */
 424     case 0x8b: /* mov Ev, Gv */
 425     {
 426         BYTE *data = INSTR_GetOperandAddr(context, instr + 1, long_addr,
 427                                           segprefix, &len);
 428         unsigned int data_size = (*instr == 0x8b) ? (long_op ? 4 : 2) : 1;
 429         struct idtr idtr = get_idtr();
 430         unsigned int offset = data - idtr.base;
 431
 432         if (offset <= idtr.limit + 1 - data_size)
 433         {
 434             idt[1].LimitLow = 0x100; /* FIXME */
 435             idt[2].LimitLow = 0x11E; /* FIXME */
 436             idt[3].LimitLow = 0x500; /* FIXME */
 437
 438             switch (*instr)
 439             {
 440             case 0x8a: store_reg_byte( context, instr[1], (BYTE *)idt + offset ); break;
 441             case 0x8b: store_reg_word( context, instr[1], (BYTE *)idt + offset, long_op ); break;
 442             }
 443             context->Eip += prefixlen + len + 1;
 444             return ExceptionContinueExecution;
 445         }
 446         break;  /* Unable to emulate it */
 447     }
 448
 449     case 0xfa: /* cli */
 450     case 0xfb: /* sti */
 451         context->Eip += prefixlen + 1;
 452         return ExceptionContinueExecution;
 453     }
 454     return ExceptionContinueSearch;  /* Unable to emulate it */
 455 }
 456
 457
 458 /***********************************************************************
 459  *           vectored_handler
 460  *
 461  * Vectored exception handler used to emulate protected instructions
 462  * from 32-bit code.
 463  */
 464 LONG CALLBACK vectored_handler( EXCEPTION_POINTERS *ptrs )
 465 {
 466     EXCEPTION_RECORD *record = ptrs->ExceptionRecord;
 467     CONTEXT *context = ptrs->ContextRecord;
 468
 469     if ((record->ExceptionCode == EXCEPTION_ACCESS_VIOLATION ||
 470          record->ExceptionCode == EXCEPTION_PRIV_INSTRUCTION))
 471     {
 472         if (emulate_instruction( record, context ) == ExceptionContinueExecution)
 473             return EXCEPTION_CONTINUE_EXECUTION;
 474     }
 475     return EXCEPTION_CONTINUE_SEARCH;
 476 }
 477
 478 #endif  /* __i386__ */