| /* |
| * Copyright 2017, Data61 |
| * Commonwealth Scientific and Industrial Research Organisation (CSIRO) |
| * ABN 41 687 119 230. |
| * |
| * This software may be distributed and modified according to the terms of |
| * the GNU General Public License version 2. Note that NO WARRANTY is provided. |
| * See "LICENSE_GPLv2.txt" for details. |
| * |
| * @TAG(DATA61_GPL) |
| */ |
| |
| /* x86 fetch/decode/emulate code |
| |
| Author: W.A. |
| */ |
| |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| |
| #include "vmm/debug.h" |
| #include "vmm/platform/guest_vspace.h" |
| #include "vmm/platform/guest_memory.h" |
| #include "vmm/guest_state.h" |
| #include "vmm/processor/platfeature.h" |
| |
| /* TODO are these defined elsewhere? */ |
| #define IA32_PDE_SIZE(pde) (pde & BIT(7)) |
| #define IA32_PDE_PRESENT(pde) (pde & BIT(0)) |
| #define IA32_PTE_ADDR(pte) (pte & 0xFFFFF000) |
| #define IA32_PSE_ADDR(pde) (pde & 0xFFC00000) |
| |
| #define IA32_OPCODE_S(op) (op & BIT(0)) |
| #define IA32_OPCODE_D(op) (op & BIT(1)) |
| #define IA32_OPCODY_BODY(op) (op & 0b11111100) |
| #define IA32_MODRM_REG(m) ((m & 0b00111000) >> 3) |
| |
| #define SEG_MULT (0x10) |
| |
| /* Get a word from a guest physical address */ |
| inline static uint32_t guest_get_phys_word(vmm_t *vmm, uintptr_t addr) { |
| uint32_t val; |
| |
| vmm_guest_vspace_touch(&vmm->guest_mem.vspace, addr, sizeof(uint32_t), |
| vmm_guest_get_phys_data_help, &val); |
| |
| return val; |
| } |
| |
| /* Fetch a guest's instruction */ |
| int vmm_fetch_instruction(vmm_vcpu_t *vcpu, uint32_t eip, uintptr_t cr3, |
| int len, uint8_t *buf) { |
| /* Walk page tables to get physical address of instruction */ |
| uintptr_t instr_phys = 0; |
| |
| /* ensure that PAE is not enabled */ |
| if (vmm_guest_state_get_cr4(&vcpu->guest_state, vcpu->guest_vcpu) & X86_CR4_PAE) { |
| ZF_LOGE("Do not support walking PAE paging structures"); |
| return -1; |
| } |
| |
| // TODO implement page-boundary crossing properly |
| assert((eip >> 12) == ((eip + len) >> 12)); |
| |
| uint32_t pdi = eip >> 22; |
| uint32_t pti = (eip >> 12) & 0x3FF; |
| |
| uint32_t pde = guest_get_phys_word(vcpu->vmm, cr3 + pdi * 4); |
| |
| assert(IA32_PDE_PRESENT(pde)); /* WTF? */ |
| |
| if (IA32_PDE_SIZE(pde)) { |
| /* PSE is used, 4M pages */ |
| instr_phys = (uintptr_t)IA32_PSE_ADDR(pde) + (eip & 0x3FFFFF); |
| } else { |
| /* 4k pages */ |
| uint32_t pte = guest_get_phys_word(vcpu->vmm, |
| (uintptr_t)IA32_PTE_ADDR(pde) + pti * 4); |
| |
| assert(IA32_PDE_PRESENT(pte)); |
| |
| instr_phys = (uintptr_t)IA32_PTE_ADDR(pte) + (eip & 0xFFF); |
| } |
| |
| /* Fetch instruction */ |
| vmm_guest_vspace_touch(&vcpu->vmm->guest_mem.vspace, instr_phys, len, |
| vmm_guest_get_phys_data_help, buf); |
| |
| return 0; |
| } |
| |
| /* Returns 1 if this byte is an x86 instruction prefix */ |
| static int is_prefix(uint8_t byte) { |
| switch (byte) { |
| case 0x26: |
| case 0x2e: |
| case 0x36: |
| case 0x3e: |
| case 0x64: |
| case 0x65: |
| case 0x67: |
| case 0x66: |
| return 1; |
| } |
| |
| return 0; |
| } |
| |
| static void debug_print_instruction(uint8_t *instr, int instr_len) { |
| printf("instruction dump: "); |
| for (int j = 0; j < instr_len; j++) { |
| printf("%2x ", instr[j]); |
| } |
| printf("\n"); |
| } |
| |
| /* Partial support to decode an instruction for a memory access |
| This is very crude. It can break in many ways. */ |
| int vmm_decode_instruction(uint8_t *instr, int instr_len, int *reg, uint32_t *imm, int *op_len) { |
| /* First loop through and check prefixes */ |
| int oplen = 1; /* Operand length */ |
| int i; |
| for (i = 0; i < instr_len; i++) { |
| if (is_prefix(instr[i])) { |
| if (instr[i] == 0x66) { |
| /* 16 bit modifier */ |
| oplen = 2; |
| } |
| } else { |
| /* We've hit the opcode */ |
| break; |
| } |
| } |
| assert(i < instr_len); /* We still need an opcode */ |
| |
| uint8_t opcode = instr[i]; |
| //uint8_t opcode_ex = 0; |
| if (opcode == 0x0f) { |
| printf("can't emulate instruction with multi-byte opcode!\n"); |
| debug_print_instruction(instr, instr_len); |
| assert(0); /* We don't handle >1 byte opcodes */ |
| } |
| if (oplen != 2 && IA32_OPCODE_S(opcode)) { |
| oplen = 4; |
| } |
| |
| uint8_t modrm = instr[++i]; |
| switch (opcode) { |
| case 0x88: |
| case 0x89: |
| case 0x8a: |
| case 0x8b: |
| case 0x8c: |
| // Mov with register |
| *reg = IA32_MODRM_REG(modrm); |
| *op_len = oplen; |
| break; |
| case 0xc6: |
| case 0xc7: |
| // Mov with immediate |
| *reg = -1; |
| *op_len = oplen; |
| uint32_t immediate = 0; |
| for (int j = 0; j < oplen; j++) { |
| immediate <<= 8; |
| immediate |= instr[instr_len - j - 1]; |
| } |
| *imm = immediate; |
| break; |
| default: |
| printf("can't emulate this instruction!\n"); |
| debug_print_instruction(instr, instr_len); |
| assert(0); |
| } |
| |
| return 0; |
| } |
| |
| /* |
| Useful information: The GDT loaded by the Linux SMP trampoline looks like: |
| 0x00: 00 00 00 00 00 00 00 00 |
| 0x08: 00 00 00 00 00 00 00 00 |
| 0x10: ff ff 00 00 00 9b cf 00 <- Executable 0x00000000-0xffffffff |
| 0x18: ff ff 00 00 00 93 cf 00 <- RW data 0x00000000-0xffffffff |
| */ |
| |
| /* Interpret just enough virtual 8086 instructions to run trampoline code. |
| Returns the final jump address */ |
| uintptr_t vmm_emulate_realmode(guest_memory_t *gm, uint8_t *instr_buf, |
| uint16_t *segment, uintptr_t eip, uint32_t len, guest_state_t *gs) |
| { |
| /* We only track one segment, and assume that code and data are in the same |
| segment, which is valid for most trampoline and bootloader code */ |
| uint8_t *instr = instr_buf; |
| assert(segment); |
| |
| while (instr - instr_buf < len) { |
| uintptr_t mem = 0; |
| uint32_t lit = 0; |
| int m66 = 0; |
| |
| uint32_t base = 0; |
| uint32_t limit = 0; |
| |
| if (*instr == 0x66) { |
| m66 = 1; |
| instr++; |
| } |
| |
| if (*instr == 0x0f) { |
| instr++; |
| if (*instr == 0x01) { |
| instr++; |
| if (*instr == 0x1e) { |
| // lidtl |
| instr++; |
| memcpy(&mem, instr, 2); |
| mem += *segment * SEG_MULT; |
| instr += 2; |
| |
| /* Limit is first 2 bytes, base is next 4 bytes */ |
| vmm_guest_vspace_touch(&gm->vspace, mem, |
| 2, vmm_guest_get_phys_data_help, &limit); |
| vmm_guest_vspace_touch(&gm->vspace, mem + 2, |
| 4, vmm_guest_get_phys_data_help, &base); |
| DPRINTF(4, "lidtl %p\n", (void*)mem); |
| |
| vmm_guest_state_set_idt_base(gs, base); |
| vmm_guest_state_set_idt_limit(gs, limit); |
| } else if (*instr == 0x16) { |
| // lgdtl |
| instr++; |
| memcpy(&mem, instr, 2); |
| mem += *segment * SEG_MULT; |
| instr += 2; |
| |
| /* Limit is first 2 bytes, base is next 4 bytes */ |
| vmm_guest_vspace_touch(&gm->vspace, mem, |
| 2, vmm_guest_get_phys_data_help, &limit); |
| vmm_guest_vspace_touch(&gm->vspace, mem + 2, |
| 4, vmm_guest_get_phys_data_help, &base); |
| DPRINTF(4, "lgdtl %p; base = %x, limit = %x\n", (void*)mem, |
| base, limit); |
| |
| vmm_guest_state_set_gdt_base(gs, base); |
| vmm_guest_state_set_gdt_limit(gs, limit); |
| } else { |
| //ignore |
| instr++; |
| } |
| } else { |
| //ignore |
| instr++; |
| } |
| } else if (*instr == 0xea) { |
| /* Absolute jmp */ |
| instr++; |
| uint32_t base = 0; |
| uintptr_t jmp_addr = 0; |
| if (m66) { |
| // base is 4 bytes |
| /* Make the wild assumptions that we are now in protected mode |
| and the relevant GDT entry just covers all memory. Therefore |
| the base address is our absolute address. This just happens |
| to work with Linux and probably other modern systems that |
| don't use the GDT much. */ |
| memcpy(&base, instr, 4); |
| instr += 4; |
| jmp_addr = base; |
| memcpy(segment, instr, 2); |
| } else { |
| memcpy(&base, instr, 2); |
| instr += 2; |
| memcpy(segment, instr, 2); |
| jmp_addr = *segment * SEG_MULT + base; |
| } |
| instr += 2; |
| DPRINTF(4, "absolute jmpf $%p, cs now %04x\n", (void*)jmp_addr, *segment); |
| if (((int64_t)jmp_addr - (int64_t)(len + eip)) >= 0) { |
| vmm_guest_state_set_cs_selector(gs, *segment); |
| return jmp_addr; |
| } else { |
| instr = jmp_addr - eip + instr_buf; |
| } |
| } else { |
| switch (*instr) { |
| case 0xa1: |
| /* mov offset memory to eax */ |
| instr++; |
| memcpy(&mem, instr, 2); |
| instr += 2; |
| mem += *segment * SEG_MULT; |
| DPRINTF(4, "mov %p, eax\n", (void*)mem); |
| uint32_t eax; |
| vmm_guest_vspace_touch(&gm->vspace, mem, |
| 4, vmm_guest_get_phys_data_help, &eax); |
| vmm_set_user_context(gs, USER_CONTEXT_EAX, eax); |
| break; |
| case 0xc7: |
| instr++; |
| if (*instr == 0x06) { // modrm |
| int size; |
| instr++; |
| /* mov literal to memory */ |
| memcpy(&mem, instr, 2); |
| mem += *segment * SEG_MULT; |
| instr += 2; |
| if (m66) { |
| memcpy(&lit, instr, 4); |
| size = 4; |
| } else { |
| memcpy(&lit, instr, 2); |
| size = 2; |
| } |
| instr += size; |
| DPRINTF(4, "mov $0x%x, %p\n", lit, (void*)mem); |
| vmm_guest_vspace_touch(&gm->vspace, mem, |
| size, vmm_guest_set_phys_data_help, &lit); |
| } |
| break; |
| case 0xba: |
| //?????mov literal to dx |
| /* ignore */ |
| instr += 2; |
| break; |
| case 0x8c: |
| case 0x8e: |
| /* mov to/from sreg. ignore */ |
| instr += 2; |
| break; |
| default: |
| /* Assume this is a single byte instruction we can ignore */ |
| instr++; |
| } |
| } |
| |
| DPRINTF(6, "read %zu bytes\n", (size_t)(instr - instr_buf)); |
| } |
| |
| return 0; |
| } |
