dlls/ntoskrnl.exe/instr.c

   1 /*
   2  * Emulation of privileged instructions
   3  *
   4  * Copyright 1995 Alexandre Julliard
   5  * Copyright 2005 Ivan Leo Puoti
   6  * Copyright 2005 Laurent Pinchart
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  21  */
  22
  23 #include "config.h"
  24 #include "wine/port.h"
  25
  26 #ifdef __i386__
  27
  28 #include <stdarg.h>
  29
  30 #include "windef.h"
  31 #include "winbase.h"
  32 #include "winternl.h"
  33 #include "excpt.h"
  34 #include "wine/debug.h"
  35 #include "wine/exception.h"
  36
  37 WINE_DEFAULT_DEBUG_CHANNEL(int);
  38
  39 #include "pshpack1.h"
  40 struct idtr
  41 {
  42     WORD  limit;
  43     BYTE *base;
  44 };
  45 #include "poppack.h"
  46
  47 static LDT_ENTRY idt[256];
  48
  49 static inline struct idtr get_idtr(void)
  50 {
  51     struct idtr ret;
  52 #ifdef __GNUC__
  53     __asm__( "sidtl %0" : "=m" (ret) );
  54 #else
  55     ret.base = (BYTE *)idt;
  56     ret.limit = sizeof(idt) - 1;
  57 #endif
  58     return ret;
  59 }
  60
  61 /* store an operand into a register */
  62 static void store_reg( CONTEXT *context, BYTE regmodrm, const BYTE *addr, int long_op )
  63 {
  64     switch((regmodrm >> 3) & 7)
  65     {
  66     case 0:
  67         if (long_op) context->Eax = *(const DWORD *)addr;
  68         else context->Eax = (context->Eax & 0xffff0000) | *(const WORD *)addr;
  69         break;
  70     case 1:
  71         if (long_op) context->Ecx = *(const DWORD *)addr;
  72         else context->Ecx = (context->Ecx & 0xffff0000) | *(const WORD *)addr;
  73         break;
  74     case 2:
  75         if (long_op) context->Edx = *(const DWORD *)addr;
  76         else context->Edx = (context->Edx & 0xffff0000) | *(const WORD *)addr;
  77         break;
  78     case 3:
  79         if (long_op) context->Ebx = *(const DWORD *)addr;
  80         else context->Ebx = (context->Ebx & 0xffff0000) | *(const WORD *)addr;
  81         break;
  82     case 4:
  83         if (long_op) context->Esp = *(const DWORD *)addr;
  84         else context->Esp = (context->Esp & 0xffff0000) | *(const WORD *)addr;
  85         break;
  86     case 5:
  87         if (long_op) context->Ebp = *(const DWORD *)addr;
  88         else context->Ebp = (context->Ebp & 0xffff0000) | *(const WORD *)addr;
  89         break;
  90     case 6:
  91         if (long_op) context->Esi = *(const DWORD *)addr;
  92         else context->Esi = (context->Esi & 0xffff0000) | *(const WORD *)addr;
  93         break;
  94     case 7:
  95         if (long_op) context->Edi = *(const DWORD *)addr;
  96         else context->Edi = (context->Edi & 0xffff0000) | *(const WORD *)addr;
  97         break;
  98     }
  99 }
 100
 101 /***********************************************************************
 102  *           INSTR_GetOperandAddr
 103  *
 104  * Return the address of an instruction operand (from the mod/rm byte).
 105  */
 106 static BYTE *INSTR_GetOperandAddr( CONTEXT *context, BYTE *instr,
 107                                    int long_addr, int segprefix, int *len )
 108 {
 109     int mod, rm, base = 0, index = 0, ss = 0, seg = 0, off;
 110
 111 #define GET_VAL(val,type) \
 112     { *val = *(type *)instr; instr += sizeof(type); *len += sizeof(type); }
 113
 114     *len = 0;
 115     GET_VAL( &mod, BYTE );
 116     rm = mod & 7;
 117     mod >>= 6;
 118
 119     if (mod == 3)
 120     {
 121         switch(rm)
 122         {
 123         case 0: return (BYTE *)&context->Eax;
 124         case 1: return (BYTE *)&context->Ecx;
 125         case 2: return (BYTE *)&context->Edx;
 126         case 3: return (BYTE *)&context->Ebx;
 127         case 4: return (BYTE *)&context->Esp;
 128         case 5: return (BYTE *)&context->Ebp;
 129         case 6: return (BYTE *)&context->Esi;
 130         case 7: return (BYTE *)&context->Edi;
 131         }
 132     }
 133
 134     if (long_addr)
 135     {
 136         if (rm == 4)
 137         {
 138             BYTE sib;
 139             GET_VAL( &sib, BYTE );
 140             rm = sib & 7;
 141             ss = sib >> 6;
 142             switch(sib >> 3)
 143             {
 144             case 0: index = context->Eax; break;
 145             case 1: index = context->Ecx; break;
 146             case 2: index = context->Edx; break;
 147             case 3: index = context->Ebx; break;
 148             case 4: index = 0; break;
 149             case 5: index = context->Ebp; break;
 150             case 6: index = context->Esi; break;
 151             case 7: index = context->Edi; break;
 152             }
 153         }
 154
 155         switch(rm)
 156         {
 157         case 0: base = context->Eax; seg = context->SegDs; break;
 158         case 1: base = context->Ecx; seg = context->SegDs; break;
 159         case 2: base = context->Edx; seg = context->SegDs; break;
 160         case 3: base = context->Ebx; seg = context->SegDs; break;
 161         case 4: base = context->Esp; seg = context->SegSs; break;
 162         case 5: base = context->Ebp; seg = context->SegSs; break;
 163         case 6: base = context->Esi; seg = context->SegDs; break;
 164         case 7: base = context->Edi; seg = context->SegDs; break;
 165         }
 166         switch (mod)
 167         {
 168         case 0:
 169             if (rm == 5)  /* special case: ds:(disp32) */
 170             {
 171                 GET_VAL( &base, DWORD );
 172                 seg = context->SegDs;
 173             }
 174             break;
 175
 176         case 1:  /* 8-bit disp */
 177             GET_VAL( &off, BYTE );
 178             base += (signed char)off;
 179             break;
 180
 181         case 2:  /* 32-bit disp */
 182             GET_VAL( &off, DWORD );
 183             base += (signed long)off;
 184             break;
 185         }
 186     }
 187     else  /* short address */
 188     {
 189         switch(rm)
 190         {
 191         case 0:  /* ds:(bx,si) */
 192             base = LOWORD(context->Ebx) + LOWORD(context->Esi);
 193             seg  = context->SegDs;
 194             break;
 195         case 1:  /* ds:(bx,di) */
 196             base = LOWORD(context->Ebx) + LOWORD(context->Edi);
 197             seg  = context->SegDs;
 198             break;
 199         case 2:  /* ss:(bp,si) */
 200             base = LOWORD(context->Ebp) + LOWORD(context->Esi);
 201             seg  = context->SegSs;
 202             break;
 203         case 3:  /* ss:(bp,di) */
 204             base = LOWORD(context->Ebp) + LOWORD(context->Edi);
 205             seg  = context->SegSs;
 206             break;
 207         case 4:  /* ds:(si) */
 208             base = LOWORD(context->Esi);
 209             seg  = context->SegDs;
 210             break;
 211         case 5:  /* ds:(di) */
 212             base = LOWORD(context->Edi);
 213             seg  = context->SegDs;
 214             break;
 215         case 6:  /* ss:(bp) */
 216             base = LOWORD(context->Ebp);
 217             seg  = context->SegSs;
 218             break;
 219         case 7:  /* ds:(bx) */
 220             base = LOWORD(context->Ebx);
 221             seg  = context->SegDs;
 222             break;
 223         }
 224
 225         switch(mod)
 226         {
 227         case 0:
 228             if (rm == 6)  /* special case: ds:(disp16) */
 229             {
 230                 GET_VAL( &base, WORD );
 231                 seg  = context->SegDs;
 232             }
 233             break;
 234
 235         case 1:  /* 8-bit disp */
 236             GET_VAL( &off, BYTE );
 237             base += (signed char)off;
 238             break;
 239
 240         case 2:  /* 16-bit disp */
 241             GET_VAL( &off, WORD );
 242             base += (signed short)off;
 243             break;
 244         }
 245         base &= 0xffff;
 246     }
 247     if (segprefix != -1) seg = segprefix;
 248
 249     /* FIXME: we assume that all segments have a base of 0 */
 250     return (BYTE *)(base + (index << ss));
 251 #undef GET_VAL
 252 }
 253
 254
 255 /***********************************************************************
 256  *           emulate_instruction
 257  *
 258  * Emulate a privileged instruction.
 259  * Returns exception continuation status.
 260  */
 261 static DWORD emulate_instruction( EXCEPTION_RECORD *rec, CONTEXT *context )
 262 {
 263     int prefix, segprefix, prefixlen, len, long_op, long_addr;
 264     BYTE *instr;
 265
 266     long_op = long_addr = 1;
 267     instr = (BYTE *)context->Eip;
 268     if (!instr) return ExceptionContinueSearch;
 269
 270     /* First handle any possible prefix */
 271
 272     segprefix = -1;  /* no prefix */
 273     prefix = 1;
 274     prefixlen = 0;
 275     while(prefix)
 276     {
 277         switch(*instr)
 278         {
 279         case 0x2e:
 280             segprefix = context->SegCs;
 281             break;
 282         case 0x36:
 283             segprefix = context->SegSs;
 284             break;
 285         case 0x3e:
 286             segprefix = context->SegDs;
 287             break;
 288         case 0x26:
 289             segprefix = context->SegEs;
 290             break;
 291         case 0x64:
 292             segprefix = context->SegFs;
 293             break;
 294         case 0x65:
 295             segprefix = context->SegGs;
 296             break;
 297         case 0x66:
 298             long_op = !long_op;  /* opcode size prefix */
 299             break;
 300         case 0x67:
 301             long_addr = !long_addr;  /* addr size prefix */
 302             break;
 303         case 0xf0:  /* lock */
 304             break;
 305         case 0xf2:  /* repne */
 306             break;
 307         case 0xf3:  /* repe */
 308             break;
 309         default:
 310             prefix = 0;  /* no more prefixes */
 311             break;
 312         }
 313         if (prefix)
 314         {
 315             instr++;
 316             prefixlen++;
 317         }
 318     }
 319
 320     /* Now look at the actual instruction */
 321
 322     switch(*instr)
 323     {
 324     case 0x0f: /* extended instruction */
 325         switch(instr[1])
 326         {
 327         case 0x22: /* mov eax, crX */
 328             switch (instr[2])
 329             {
 330             case 0xc0:
 331                 TRACE("mov eax,cr0 at 0x%08x, EAX=0x%08x\n", context->Eip,context->Eax );
 332                 context->Eip += prefixlen+3;
 333                 return ExceptionContinueExecution;
 334             default:
 335                 break; /*fallthrough to bad instruction handling */
 336             }
 337             break; /*fallthrough to bad instruction handling */
 338         case 0x20: /* mov crX, eax */
 339             switch (instr[2])
 340             {
 341             case 0xe0: /* mov cr4, eax */
 342                 /* CR4 register . See linux/arch/i386/mm/init.c, X86_CR4_ defs
 343                  * bit 0: VME   Virtual Mode Exception ?
 344                  * bit 1: PVI   Protected mode Virtual Interrupt
 345                  * bit 2: TSD   Timestamp disable
 346                  * bit 3: DE    Debugging extensions
 347                  * bit 4: PSE   Page size extensions
 348                  * bit 5: PAE   Physical address extension
 349                  * bit 6: MCE   Machine check enable
 350                  * bit 7: PGE   Enable global pages
 351                  * bit 8: PCE   Enable performance counters at IPL3
 352                  */
 353                 TRACE("mov cr4,eax at 0x%08x\n",context->Eip);
 354                 context->Eax = 0;
 355                 context->Eip += prefixlen+3;
 356                 return ExceptionContinueExecution;
 357             case 0xc0: /* mov cr0, eax */
 358                 TRACE("mov cr0,eax at 0x%08x\n",context->Eip);
 359                 context->Eax = 0x10; /* FIXME: set more bits ? */
 360                 context->Eip += prefixlen+3;
 361                 return ExceptionContinueExecution;
 362             default: /* fallthrough to illegal instruction */
 363                 break;
 364             }
 365             /* fallthrough to illegal instruction */
 366             break;
 367         case 0x21: /* mov drX, eax */
 368             switch (instr[2])
 369             {
 370             case 0xc8: /* mov dr1, eax */
 371                 TRACE("mov dr1,eax at 0x%08x\n",context->Eip);
 372                 context->Eax = context->Dr1;
 373                 context->Eip += prefixlen+3;
 374                 return ExceptionContinueExecution;
 375             case 0xf8: /* mov dr7, eax */
 376                 TRACE("mov dr7,eax at 0x%08x\n",context->Eip);
 377                 context->Eax = 0x400;
 378                 context->Eip += prefixlen+3;
 379                 return ExceptionContinueExecution;
 380             }
 381             ERR("Unsupported DR register, eip+2 is %02x\n", instr[2]);
 382             /* fallthrough to illegal instruction */
 383             break;
 384         case 0x23: /* mov eax drX */
 385             switch (instr[2])
 386             {
 387             case 0xc8: /* mov eax, dr1 */
 388                 context->Dr1 = context->Eax;
 389                 context->Eip += prefixlen+3;
 390                 return ExceptionContinueExecution;
 391             }
 392             ERR("Unsupported DR register, eip+2 is %02x\n", instr[2]);
 393             /* fallthrough to illegal instruction */
 394             break;
 395         }
 396         break;  /* Unable to emulate it */
 397
 398     case 0x8b: /* mov Ev, Gv */
 399     {
 400         BYTE *addr = INSTR_GetOperandAddr(context, instr + 1, long_addr,
 401                                           segprefix, &len);
 402         struct idtr idtr = get_idtr();
 403         unsigned int offset = addr - idtr.base;
 404
 405         if (offset <= idtr.limit + 1 - (long_op ? 4 : 2))
 406         {
 407             idt[1].LimitLow = 0x100; /* FIXME */
 408             idt[2].LimitLow = 0x11E; /* FIXME */
 409             idt[3].LimitLow = 0x500; /* FIXME */
 410             store_reg( context, instr[1], (BYTE *)idt + offset, long_op );
 411             context->Eip += prefixlen + len + 1;
 412             return ExceptionContinueExecution;
 413         }
 414         break;  /* Unable to emulate it */
 415     }
 416
 417     case 0xfa: /* cli */
 418     case 0xfb: /* sti */
 419         context->Eip += prefixlen + 1;
 420         return ExceptionContinueExecution;
 421     }
 422     return ExceptionContinueSearch;  /* Unable to emulate it */
 423 }
 424
 425
 426 /***********************************************************************
 427  *           vectored_handler
 428  *
 429  * Vectored exception handler used to emulate protected instructions
 430  * from 32-bit code.
 431  */
 432 LONG CALLBACK vectored_handler( EXCEPTION_POINTERS *ptrs )
 433 {
 434     EXCEPTION_RECORD *record = ptrs->ExceptionRecord;
 435     CONTEXT *context = ptrs->ContextRecord;
 436
 437     if ((record->ExceptionCode == EXCEPTION_ACCESS_VIOLATION ||
 438          record->ExceptionCode == EXCEPTION_PRIV_INSTRUCTION))
 439     {
 440         if (emulate_instruction( record, context ) == ExceptionContinueExecution)
 441             return EXCEPTION_CONTINUE_EXECUTION;
 442     }
 443     return EXCEPTION_CONTINUE_SEARCH;
 444 }
 445
 446 #endif  /* __i386__ */