2 * Emulation of priviledged instructions
4 * Copyright 1995 Alexandre Julliard
13 #include "sig_context.h"
17 #define IS_V86(context) (EFL_sig(context)&V86_FLAG)
18 #define IS_SEL_32(context,seg) \
19 (IS_V86(context) ? FALSE : IS_SELECTOR_32BIT(seg))
21 #define STACK_sig(context) \
22 (IS_SEL_32(context,SS_sig(context)) ? ESP_sig(context) : SP_sig(context))
24 #define MAKE_PTR(seg,off) \
25 (IS_SELECTOR_SYSTEM(seg) ? (void *)(off) : PTR_SEG_OFF_TO_LIN(seg,off))
27 #define MK_PTR(context,seg,off) \
28 (IS_V86(context) ? DOSMEM_MapRealToLinear(MAKELONG(off,seg)) \
31 #define STACK_PTR(context) \
32 (IS_V86(context) ? DOSMEM_MapRealToLinear(MAKELONG(SP_sig(context),SS_sig(context))) : \
33 (IS_SELECTOR_SYSTEM(SS_sig(context)) ? (void *)ESP_sig(context) : \
34 (PTR_SEG_OFF_TO_LIN(SS_sig(context),STACK_sig(context)))))
37 /***********************************************************************
38 * INSTR_ReplaceSelector
40 * Try to replace an invalid selector by a valid one.
41 * The only selector where it is allowed to do "mov ax,40;mov es,ax"
42 * is the so called 'bimodal' selector 0x40, which points to the BIOS
43 * data segment. Used by (at least) Borland products (and programs compiled
44 * using Borland products).
46 * See Undocumented Windows, Chapter 5, __0040.
48 static WORD INSTR_ReplaceSelector( SIGCONTEXT *context, WORD sel)
52 static WORD sys_timer = 0;
54 sys_timer = CreateSystemTimer( 55, (FARPROC16)DOSMEM_Tick );
55 return DOSMEM_BiosSeg;
57 return 0; /* Can't replace selector, crashdump */
61 /***********************************************************************
62 * INSTR_GetOperandAddr
64 * Return the address of an instruction operand (from the mod/rm byte).
66 static BYTE *INSTR_GetOperandAddr( SIGCONTEXT *context, BYTE *instr,
67 int long_addr, int segprefix, int *len )
69 int mod, rm, base, index = 0, ss = 0, seg = 0, off;
71 #define GET_VAL(val,type) \
72 { *val = *(type *)instr; instr += sizeof(type); *len += sizeof(type); }
75 GET_VAL( &mod, BYTE );
83 case 0: return (BYTE *)&EAX_sig(context);
84 case 1: return (BYTE *)&ECX_sig(context);
85 case 2: return (BYTE *)&EDX_sig(context);
86 case 3: return (BYTE *)&EBX_sig(context);
87 case 4: return (BYTE *)&ESP_sig(context);
88 case 5: return (BYTE *)&EBP_sig(context);
89 case 6: return (BYTE *)&ESI_sig(context);
90 case 7: return (BYTE *)&EDI_sig(context);
99 GET_VAL( &sib, BYTE );
104 case 0: index = EAX_sig(context); break;
105 case 1: index = ECX_sig(context); break;
106 case 2: index = EDX_sig(context); break;
107 case 3: index = EBX_sig(context); break;
108 case 4: index = 0; break;
109 case 5: index = EBP_sig(context); break;
110 case 6: index = ESI_sig(context); break;
111 case 7: index = EDI_sig(context); break;
117 case 0: base = EAX_sig(context); seg = DS_sig(context); break;
118 case 1: base = ECX_sig(context); seg = DS_sig(context); break;
119 case 2: base = EDX_sig(context); seg = DS_sig(context); break;
120 case 3: base = EBX_sig(context); seg = DS_sig(context); break;
121 case 4: base = ESP_sig(context); seg = SS_sig(context); break;
122 case 5: base = EBP_sig(context); seg = SS_sig(context); break;
123 case 6: base = ESI_sig(context); seg = DS_sig(context); break;
124 case 7: base = EDI_sig(context); seg = DS_sig(context); break;
129 if (rm == 5) /* special case: ds:(disp32) */
131 GET_VAL( &base, DWORD );
132 seg = DS_sig(context);
136 case 1: /* 8-bit disp */
137 GET_VAL( &off, BYTE );
138 base += (signed char)off;
141 case 2: /* 32-bit disp */
142 GET_VAL( &off, DWORD );
143 base += (signed long)off;
147 else /* short address */
151 case 0: /* ds:(bx,si) */
152 base = BX_sig(context) + SI_sig(context);
153 seg = DS_sig(context);
155 case 1: /* ds:(bx,di) */
156 base = BX_sig(context) + DI_sig(context);
157 seg = DS_sig(context);
159 case 2: /* ss:(bp,si) */
160 base = BP_sig(context) + SI_sig(context);
161 seg = SS_sig(context);
163 case 3: /* ss:(bp,di) */
164 base = BP_sig(context) + DI_sig(context);
165 seg = SS_sig(context);
167 case 4: /* ds:(si) */
168 base = SI_sig(context);
169 seg = DS_sig(context);
171 case 5: /* ds:(di) */
172 base = DI_sig(context);
173 seg = DS_sig(context);
175 case 6: /* ss:(bp) */
176 base = BP_sig(context);
177 seg = SS_sig(context);
179 case 7: /* ds:(bx) */
180 base = BX_sig(context);
181 seg = DS_sig(context);
188 if (rm == 6) /* special case: ds:(disp16) */
190 GET_VAL( &base, WORD );
191 seg = DS_sig(context);
195 case 1: /* 8-bit disp */
196 GET_VAL( &off, BYTE );
197 base += (signed char)off;
200 case 2: /* 16-bit disp */
201 GET_VAL( &off, WORD );
202 base += (signed short)off;
207 if (segprefix != -1) seg = segprefix;
209 /* Make sure the segment and offset are valid */
210 if (IS_SELECTOR_SYSTEM(seg)) return (BYTE *)(base + (index << ss));
211 if (((seg & 7) != 7) || IS_SELECTOR_FREE(seg)) return NULL;
212 if (GET_SEL_LIMIT(seg) < (base + (index << ss))) return NULL;
213 return (BYTE *)PTR_SEG_OFF_TO_LIN( seg, (base + (index << ss)) );
218 /***********************************************************************
221 * Emulate the LDS (and LES,LFS,etc.) instruction.
223 static BOOL32 INSTR_EmulateLDS( SIGCONTEXT *context, BYTE *instr, int long_op,
224 int long_addr, int segprefix, int *len )
227 BYTE *regmodrm = instr + 1 + (*instr == 0x0f);
228 BYTE *addr = INSTR_GetOperandAddr( context, regmodrm,
229 long_addr, segprefix, len );
231 return FALSE; /* Unable to emulate it */
232 seg = *(WORD *)(addr + (long_op ? 4 : 2));
234 if (!(seg = INSTR_ReplaceSelector( context, seg )))
235 return FALSE; /* Unable to emulate it */
237 /* Now store the offset in the correct register */
239 switch((*regmodrm >> 3) & 7)
242 if (long_op) EAX_sig(context) = *(DWORD *)addr;
243 else AX_sig(context) = *(WORD *)addr;
246 if (long_op) ECX_sig(context) = *(DWORD *)addr;
247 else CX_sig(context) = *(WORD *)addr;
250 if (long_op) EDX_sig(context) = *(DWORD *)addr;
251 else DX_sig(context) = *(WORD *)addr;
254 if (long_op) EBX_sig(context) = *(DWORD *)addr;
255 else BX_sig(context) = *(WORD *)addr;
258 if (long_op) ESP_sig(context) = *(DWORD *)addr;
259 else SP_sig(context) = *(WORD *)addr;
262 if (long_op) EBP_sig(context) = *(DWORD *)addr;
263 else BP_sig(context) = *(WORD *)addr;
266 if (long_op) ESI_sig(context) = *(DWORD *)addr;
267 else SI_sig(context) = *(WORD *)addr;
270 if (long_op) EDI_sig(context) = *(DWORD *)addr;
271 else DI_sig(context) = *(WORD *)addr;
275 /* Store the correct segment in the segment register */
279 case 0xc4: ES_sig(context) = seg; break; /* les */
280 case 0xc5: DS_sig(context) = seg; break; /* lds */
281 case 0x0f: switch(instr[1])
283 case 0xb2: SS_sig(context) = seg; break; /* lss */
285 case 0xb4: FS_sig(context) = seg; break; /* lfs */
288 case 0xb5: GS_sig(context) = seg; break; /* lgs */
294 /* Add the opcode size to the total length */
296 *len += 1 + (*instr == 0x0f);
301 /***********************************************************************
302 * INSTR_EmulateInstruction
304 * Emulate a priviledged instruction. Returns TRUE if emulation successful.
306 BOOL32 INSTR_EmulateInstruction( SIGCONTEXT *context )
308 int prefix, segprefix, prefixlen, len, repX, long_op, long_addr;
312 /* Check for page-fault */
314 #if defined(TRAP_sig) && defined(CR2_sig)
315 if (TRAP_sig(context) == 0x0e
316 && VIRTUAL_HandleFault( (LPVOID)CR2_sig(context) )) return TRUE;
319 long_op = long_addr = IS_SEL_32(context,CS_sig(context));
320 instr = (BYTE *)MK_PTR(context,CS_sig(context),EIP_sig(context));
321 if (!instr) return FALSE;
323 /* First handle any possible prefix */
325 segprefix = -1; /* no prefix */
334 segprefix = CS_sig(context);
337 segprefix = SS_sig(context);
340 segprefix = DS_sig(context);
343 segprefix = ES_sig(context);
347 segprefix = FS_sig(context);
352 segprefix = GS_sig(context);
356 long_op = !long_op; /* opcode size prefix */
359 long_addr = !long_addr; /* addr size prefix */
361 case 0xf0: /* lock */
363 case 0xf2: /* repne */
366 case 0xf3: /* repe */
370 prefix = 0; /* no more prefixes */
380 /* Now look at the actual instruction */
384 case 0x07: /* pop es */
385 case 0x17: /* pop ss */
386 case 0x1f: /* pop ds */
388 WORD seg = *(WORD *)STACK_PTR( context );
389 if ((seg = INSTR_ReplaceSelector( context, seg )) != 0)
393 case 0x07: ES_sig(context) = seg; break;
394 case 0x17: SS_sig(context) = seg; break;
395 case 0x1f: DS_sig(context) = seg; break;
397 STACK_sig(context) += long_op ? 4 : 2;
398 EIP_sig(context) += prefixlen + 1;
402 break; /* Unable to emulate it */
404 case 0x0f: /* extended instruction */
408 case 0xa1: /* pop fs */
410 WORD seg = *(WORD *)STACK_PTR( context );
411 if ((seg = INSTR_ReplaceSelector( context, seg )) != 0)
413 FS_sig(context) = seg;
414 STACK_sig(context) += long_op ? 4 : 2;
415 EIP_sig(context) += prefixlen + 2;
423 case 0xa9: /* pop gs */
425 WORD seg = *(WORD *)STACK_PTR( context );
426 if ((seg = INSTR_ReplaceSelector( context, seg )) != 0)
428 GS_sig(context) = seg;
429 STACK_sig(context) += long_op ? 4 : 2;
430 EIP_sig(context) += prefixlen + 2;
437 case 0xb2: /* lss addr,reg */
439 case 0xb4: /* lfs addr,reg */
442 case 0xb5: /* lgs addr,reg */
444 if (INSTR_EmulateLDS( context, instr, long_op,
445 long_addr, segprefix, &len ))
447 EIP_sig(context) += prefixlen + len;
452 break; /* Unable to emulate it */
454 case 0x6c: /* insb */
455 case 0x6d: /* insw/d */
456 case 0x6e: /* outsb */
457 case 0x6f: /* outsw/d */
459 int typ = *instr; /* Just in case it's overwritten. */
460 int outp = (typ >= 0x6e);
461 unsigned long count = repX ?
462 (long_addr ? ECX_sig(context) : CX_sig(context)) : 1;
463 int opsize = (typ & 1) ? (long_op ? 4 : 2) : 1;
464 int step = (EFL_sig(context) & 0x400) ? -opsize : +opsize;
465 int seg = outp ? DS_sig(context) : ES_sig(context); /* FIXME: is this right? */
468 /* FIXME: Check segment readable. */
471 /* FIXME: Check segment writeable. */
476 ECX_sig(context) = 0;
486 long_addr ? ESI_sig(context) : SI_sig(context));
487 if (long_addr) ESI_sig(context) += step;
488 else SI_sig(context) += step;
493 long_addr ? EDI_sig(context) : DI_sig(context));
494 if (long_addr) EDI_sig(context) += step;
495 else DI_sig(context) += step;
501 *((BYTE *)data) = IO_inport( DX_sig(context), 1);
502 TRACE(io, "0x%x < %02x @ %04x:%04x\n", DX_sig(context),
503 *((BYTE *)data), CS_sig(context), IP_sig(context));
508 *((DWORD *)data) = IO_inport( DX_sig(context), 4);
509 TRACE(io, "0x%x < %08lx @ %04x:%04x\n", DX_sig(context),
510 *((DWORD *)data), CS_sig(context), IP_sig(context));
514 *((WORD *)data) = IO_inport( DX_sig(context), 2);
515 TRACE(io, "0x%x < %04x @ %04x:%04x\n", DX_sig(context),
516 *((WORD *)data), CS_sig(context), IP_sig(context));
520 IO_outport( DX_sig(context), 1, *((BYTE *)data));
521 TRACE(io, "0x%x > %02x @ %04x:%04x\n", DX_sig(context),
522 *((BYTE *)data), CS_sig(context), IP_sig(context));
527 IO_outport( DX_sig(context), 4, *((DWORD *)data));
528 TRACE(io, "0x%x > %08lx @ %04x:%04x\n", DX_sig(context),
529 *((DWORD *)data), CS_sig(context), IP_sig(context));
533 IO_outport( DX_sig(context), 2, *((WORD *)data));
534 TRACE(io, "0x%x > %04x @ %04x:%04x\n", DX_sig(context),
535 *((WORD *)data), CS_sig(context), IP_sig(context));
540 EIP_sig(context) += prefixlen + 1;
544 case 0x8e: /* mov XX,segment_reg */
547 BYTE *addr = INSTR_GetOperandAddr(context, instr + 1,
548 long_addr, segprefix, &len );
550 break; /* Unable to emulate it */
552 if (!(seg = INSTR_ReplaceSelector( context, seg )))
553 break; /* Unable to emulate it */
555 switch((instr[1] >> 3) & 7)
558 ES_sig(context) = seg;
559 EIP_sig(context) += prefixlen + len + 1;
564 SS_sig(context) = seg;
565 EIP_sig(context) += prefixlen + len + 1;
568 DS_sig(context) = seg;
569 EIP_sig(context) += prefixlen + len + 1;
573 FS_sig(context) = seg;
574 EIP_sig(context) += prefixlen + len + 1;
579 GS_sig(context) = seg;
580 EIP_sig(context) += prefixlen + len + 1;
588 break; /* Unable to emulate it */
590 case 0xc4: /* les addr,reg */
591 case 0xc5: /* lds addr,reg */
592 if (INSTR_EmulateLDS( context, instr, long_op,
593 long_addr, segprefix, &len ))
595 EIP_sig(context) += prefixlen + len;
598 break; /* Unable to emulate it */
600 case 0xcd: /* int <XX> */
603 ERR(int, "int xx from 32-bit code is not supported.\n");
604 break; /* Unable to emulate it */
608 FARPROC16 addr = INT_GetPMHandler( instr[1] );
609 WORD *stack = (WORD *)STACK_PTR( context );
610 /* Push the flags and return address on the stack */
611 *(--stack) = FL_sig(context);
612 *(--stack) = CS_sig(context);
613 *(--stack) = IP_sig(context) + prefixlen + 2;
614 STACK_sig(context) -= 3 * sizeof(WORD);
615 /* Jump to the interrupt handler */
616 CS_sig(context) = HIWORD(addr);
617 EIP_sig(context) = LOWORD(addr);
621 case 0xcf: /* iret */
624 DWORD *stack = (DWORD *)STACK_PTR( context );
625 EIP_sig(context) = *stack++;
626 CS_sig(context) = *stack++;
627 EFL_sig(context) = *stack;
628 STACK_sig(context) += 3*sizeof(DWORD); /* Pop the return address and flags */
632 WORD *stack = (WORD *)STACK_PTR( context );
633 EIP_sig(context) = *stack++;
634 CS_sig(context) = *stack++;
635 FL_sig(context) = *stack;
636 STACK_sig(context) += 3*sizeof(WORD); /* Pop the return address and flags */
640 case 0xe4: /* inb al,XX */
641 AL_sig(context) = IO_inport( instr[1], 1 );
642 TRACE(io, "0x%x < %02x @ %04x:%04x\n", instr[1],
643 AL_sig(context), CS_sig(context), IP_sig(context));
644 EIP_sig(context) += prefixlen + 2;
647 case 0xe5: /* in (e)ax,XX */
650 EAX_sig(context) = IO_inport( instr[1], 4 );
651 TRACE(io, "0x%x < %08lx @ %04x:%04x\n", instr[1],
652 EAX_sig(context), CS_sig(context), IP_sig(context));
656 AX_sig(context) = IO_inport( instr[1], 2 );
657 TRACE(io, "0x%x < %04x @ %04x:%04x\n", instr[1],
658 AX_sig(context), CS_sig(context), IP_sig(context));
660 EIP_sig(context) += prefixlen + 2;
663 case 0xe6: /* outb XX,al */
664 IO_outport( instr[1], 1, AL_sig(context) );
665 TRACE(io, "0x%x > %02x @ %04x:%04x\n", instr[1],
666 AL_sig(context), CS_sig(context), IP_sig(context));
667 EIP_sig(context) += prefixlen + 2;
670 case 0xe7: /* out XX,(e)ax */
673 IO_outport( instr[1], 4, EAX_sig(context) );
674 TRACE(io, "0x%x > %08lx @ %04x:%04x\n", instr[1],
675 EAX_sig(context), CS_sig(context), IP_sig(context));
679 IO_outport( instr[1], 2, AX_sig(context) );
680 TRACE(io, "0x%x > %04x @ %04x:%04x\n", instr[1],
681 AX_sig(context), CS_sig(context), IP_sig(context));
683 EIP_sig(context) += prefixlen + 2;
686 case 0xec: /* inb al,dx */
687 AL_sig(context) = IO_inport( DX_sig(context), 1 );
688 TRACE(io, "0x%x < %02x @ %04x:%04x\n", DX_sig(context),
689 AL_sig(context), CS_sig(context), IP_sig(context));
690 EIP_sig(context) += prefixlen + 1;
693 case 0xed: /* in (e)ax,dx */
696 EAX_sig(context) = IO_inport( DX_sig(context), 4 );
697 TRACE(io, "0x%x < %08lx @ %04x:%04x\n", DX_sig(context),
698 EAX_sig(context), CS_sig(context), IP_sig(context));
702 AX_sig(context) = IO_inport( DX_sig(context), 2 );
703 TRACE(io, "0x%x < %04x @ %04x:%04x\n", DX_sig(context),
704 AX_sig(context), CS_sig(context), IP_sig(context));
706 EIP_sig(context) += prefixlen + 1;
709 case 0xee: /* outb dx,al */
710 IO_outport( DX_sig(context), 1, AL_sig(context) );
711 TRACE(io, "0x%x > %02x @ %04x:%04x\n", DX_sig(context),
712 AL_sig(context), CS_sig(context), IP_sig(context));
713 EIP_sig(context) += prefixlen + 1;
716 case 0xef: /* out dx,(e)ax */
719 IO_outport( DX_sig(context), 4, EAX_sig(context) );
720 TRACE(io, "0x%x > %08lx @ %04x:%04x\n", DX_sig(context),
721 EAX_sig(context), CS_sig(context), IP_sig(context));
725 IO_outport( DX_sig(context), 2, AX_sig(context) );
726 TRACE(io, "0x%x > %04x @ %04x:%04x\n", DX_sig(context),
727 AX_sig(context), CS_sig(context), IP_sig(context));
729 EIP_sig(context) += prefixlen + 1;
732 case 0xfa: /* cli, ignored */
733 EIP_sig(context) += prefixlen + 1;
736 case 0xfb: /* sti, ignored */
737 EIP_sig(context) += prefixlen + 1;
742 /* Check for Win16 __GP handler */
743 gpHandler = HasGPHandler( PTR_SEG_OFF_TO_SEGPTR( CS_sig(context),
744 EIP_sig(context) ) );
747 WORD *stack = (WORD *)STACK_PTR( context );
748 *--stack = CS_sig(context);
749 *--stack = EIP_sig(context);
750 STACK_sig(context) -= 2*sizeof(WORD);
752 CS_sig(context) = SELECTOROF( gpHandler );
753 EIP_sig(context) = OFFSETOF( gpHandler );
757 MSG("Unexpected Windows program segfault"
758 " - opcode = %x\n", *instr);
759 return FALSE; /* Unable to emulate it */