1 /*
2 * vm86 linux syscall support
3 *
4 * Copyright (c) 2003 Fabrice Bellard
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19 #include "qemu/osdep.h"
20
21 #include "qemu.h"
22 #include "user-internals.h"
23
24 //#define DEBUG_VM86
25
26 #ifdef DEBUG_VM86
27 # define LOG_VM86(...) qemu_log(__VA_ARGS__);
28 #else
29 # define LOG_VM86(...) do { } while (0)
30 #endif
31
32
33 #define set_flags(X,new,mask) \
34 ((X) = ((X) & ~(mask)) | ((new) & (mask)))
35
36 #define SAFE_MASK (0xDD5)
37 #define RETURN_MASK (0xDFF)
38
is_revectored(int nr,struct target_revectored_struct * bitmap)39 static inline int is_revectored(int nr, struct target_revectored_struct *bitmap)
40 {
41 return (((uint8_t *)bitmap)[nr >> 3] >> (nr & 7)) & 1;
42 }
43
vm_putw(CPUX86State * env,uint32_t segptr,unsigned int reg16,unsigned int val)44 static inline void vm_putw(CPUX86State *env, uint32_t segptr,
45 unsigned int reg16, unsigned int val)
46 {
47 cpu_stw_data(env, segptr + (reg16 & 0xffff), val);
48 }
49
save_v86_state(CPUX86State * env)50 void save_v86_state(CPUX86State *env)
51 {
52 CPUState *cs = env_cpu(env);
53 TaskState *ts = get_task_state(cs);
54 struct target_vm86plus_struct * target_v86;
55
56 if (!lock_user_struct(VERIFY_WRITE, target_v86, ts->target_v86, 0))
57 /* FIXME - should return an error */
58 return;
59 /* put the VM86 registers in the userspace register structure */
60 target_v86->regs.eax = tswap32(env->regs[R_EAX]);
61 target_v86->regs.ebx = tswap32(env->regs[R_EBX]);
62 target_v86->regs.ecx = tswap32(env->regs[R_ECX]);
63 target_v86->regs.edx = tswap32(env->regs[R_EDX]);
64 target_v86->regs.esi = tswap32(env->regs[R_ESI]);
65 target_v86->regs.edi = tswap32(env->regs[R_EDI]);
66 target_v86->regs.ebp = tswap32(env->regs[R_EBP]);
67 target_v86->regs.esp = tswap32(env->regs[R_ESP]);
68 target_v86->regs.eip = tswap32(env->eip);
69 target_v86->regs.cs = tswap16(env->segs[R_CS].selector);
70 target_v86->regs.ss = tswap16(env->segs[R_SS].selector);
71 target_v86->regs.ds = tswap16(env->segs[R_DS].selector);
72 target_v86->regs.es = tswap16(env->segs[R_ES].selector);
73 target_v86->regs.fs = tswap16(env->segs[R_FS].selector);
74 target_v86->regs.gs = tswap16(env->segs[R_GS].selector);
75 set_flags(env->eflags, ts->v86flags, VIF_MASK | ts->v86mask);
76 target_v86->regs.eflags = tswap32(env->eflags);
77 unlock_user_struct(target_v86, ts->target_v86, 1);
78 LOG_VM86("save_v86_state: eflags=%08x cs:ip=%04x:%04x\n",
79 env->eflags, env->segs[R_CS].selector, env->eip);
80
81 /* restore 32 bit registers */
82 env->regs[R_EAX] = ts->vm86_saved_regs.eax;
83 env->regs[R_EBX] = ts->vm86_saved_regs.ebx;
84 env->regs[R_ECX] = ts->vm86_saved_regs.ecx;
85 env->regs[R_EDX] = ts->vm86_saved_regs.edx;
86 env->regs[R_ESI] = ts->vm86_saved_regs.esi;
87 env->regs[R_EDI] = ts->vm86_saved_regs.edi;
88 env->regs[R_EBP] = ts->vm86_saved_regs.ebp;
89 env->regs[R_ESP] = ts->vm86_saved_regs.esp;
90 env->eflags = ts->vm86_saved_regs.eflags;
91 env->eip = ts->vm86_saved_regs.eip;
92
93 cpu_x86_load_seg(env, R_CS, ts->vm86_saved_regs.cs);
94 cpu_x86_load_seg(env, R_SS, ts->vm86_saved_regs.ss);
95 cpu_x86_load_seg(env, R_DS, ts->vm86_saved_regs.ds);
96 cpu_x86_load_seg(env, R_ES, ts->vm86_saved_regs.es);
97 cpu_x86_load_seg(env, R_FS, ts->vm86_saved_regs.fs);
98 cpu_x86_load_seg(env, R_GS, ts->vm86_saved_regs.gs);
99 }
100
101 /* return from vm86 mode to 32 bit. The vm86() syscall will return
102 'retval' */
return_to_32bit(CPUX86State * env,int retval)103 static inline void return_to_32bit(CPUX86State *env, int retval)
104 {
105 LOG_VM86("return_to_32bit: ret=0x%x\n", retval);
106 save_v86_state(env);
107 env->regs[R_EAX] = retval;
108 }
109
clear_IF(CPUX86State * env)110 static inline void clear_IF(CPUX86State *env)
111 {
112 CPUState *cs = env_cpu(env);
113 TaskState *ts = get_task_state(cs);
114
115 ts->v86flags &= ~VIF_MASK;
116 }
117
clear_TF(CPUX86State * env)118 static inline void clear_TF(CPUX86State *env)
119 {
120 env->eflags &= ~TF_MASK;
121 }
122
clear_AC(CPUX86State * env)123 static inline void clear_AC(CPUX86State *env)
124 {
125 env->eflags &= ~AC_MASK;
126 }
127
get_vflags(CPUX86State * env)128 static inline unsigned int get_vflags(CPUX86State *env)
129 {
130 CPUState *cs = env_cpu(env);
131 TaskState *ts = get_task_state(cs);
132 unsigned int flags;
133
134 flags = env->eflags & RETURN_MASK;
135 if (ts->v86flags & VIF_MASK)
136 flags |= IF_MASK;
137 flags |= IOPL_MASK;
138 return flags | (ts->v86flags & ts->v86mask);
139 }
140
141 #define ADD16(reg, val) reg = (reg & ~0xffff) | ((reg + (val)) & 0xffff)
142
143 /* handle VM86 interrupt (NOTE: the CPU core currently does not
144 support TSS interrupt revectoring, so this code is always executed) */
do_int(CPUX86State * env,int intno)145 static void do_int(CPUX86State *env, int intno)
146 {
147 CPUState *cs = env_cpu(env);
148 TaskState *ts = get_task_state(cs);
149 uint32_t int_addr, segoffs, ssp;
150 unsigned int sp;
151
152 if (env->segs[R_CS].selector == TARGET_BIOSSEG)
153 goto cannot_handle;
154 if (is_revectored(intno, &ts->vm86plus.int_revectored))
155 goto cannot_handle;
156 if (intno == 0x21 && is_revectored((env->regs[R_EAX] >> 8) & 0xff,
157 &ts->vm86plus.int21_revectored))
158 goto cannot_handle;
159 int_addr = (intno << 2);
160 segoffs = cpu_ldl_data(env, int_addr);
161 if ((segoffs >> 16) == TARGET_BIOSSEG)
162 goto cannot_handle;
163 LOG_VM86("VM86: emulating int 0x%x. CS:IP=%04x:%04x\n",
164 intno, segoffs >> 16, segoffs & 0xffff);
165 /* save old state */
166 ssp = env->segs[R_SS].selector << 4;
167 sp = env->regs[R_ESP] & 0xffff;
168 vm_putw(env, ssp, sp - 2, get_vflags(env));
169 vm_putw(env, ssp, sp - 4, env->segs[R_CS].selector);
170 vm_putw(env, ssp, sp - 6, env->eip);
171 ADD16(env->regs[R_ESP], -6);
172 /* goto interrupt handler */
173 env->eip = segoffs & 0xffff;
174 cpu_x86_load_seg(env, R_CS, segoffs >> 16);
175 clear_TF(env);
176 clear_IF(env);
177 clear_AC(env);
178 return;
179 cannot_handle:
180 LOG_VM86("VM86: return to 32 bits int 0x%x\n", intno);
181 return_to_32bit(env, TARGET_VM86_INTx | (intno << 8));
182 }
183
handle_vm86_trap(CPUX86State * env,int trapno)184 void handle_vm86_trap(CPUX86State *env, int trapno)
185 {
186 if (trapno == 1 || trapno == 3) {
187 return_to_32bit(env, TARGET_VM86_TRAP + (trapno << 8));
188 } else {
189 do_int(env, trapno);
190 }
191 }
192
do_vm86(CPUX86State * env,long subfunction,abi_ulong vm86_addr)193 int do_vm86(CPUX86State *env, long subfunction, abi_ulong vm86_addr)
194 {
195 CPUState *cs = env_cpu(env);
196 TaskState *ts = get_task_state(cs);
197 struct target_vm86plus_struct * target_v86;
198 int ret;
199
200 switch (subfunction) {
201 case TARGET_VM86_REQUEST_IRQ:
202 case TARGET_VM86_FREE_IRQ:
203 case TARGET_VM86_GET_IRQ_BITS:
204 case TARGET_VM86_GET_AND_RESET_IRQ:
205 qemu_log_mask(LOG_UNIMP, "qemu: unsupported vm86 subfunction (%ld)\n",
206 subfunction);
207 ret = -TARGET_EINVAL;
208 goto out;
209 case TARGET_VM86_PLUS_INSTALL_CHECK:
210 /* NOTE: on old vm86 stuff this will return the error
211 from verify_area(), because the subfunction is
212 interpreted as (invalid) address to vm86_struct.
213 So the installation check works.
214 */
215 ret = 0;
216 goto out;
217 }
218
219 /* save current CPU regs */
220 ts->vm86_saved_regs.eax = 0; /* default vm86 syscall return code */
221 ts->vm86_saved_regs.ebx = env->regs[R_EBX];
222 ts->vm86_saved_regs.ecx = env->regs[R_ECX];
223 ts->vm86_saved_regs.edx = env->regs[R_EDX];
224 ts->vm86_saved_regs.esi = env->regs[R_ESI];
225 ts->vm86_saved_regs.edi = env->regs[R_EDI];
226 ts->vm86_saved_regs.ebp = env->regs[R_EBP];
227 ts->vm86_saved_regs.esp = env->regs[R_ESP];
228 ts->vm86_saved_regs.eflags = env->eflags;
229 ts->vm86_saved_regs.eip = env->eip;
230 ts->vm86_saved_regs.cs = env->segs[R_CS].selector;
231 ts->vm86_saved_regs.ss = env->segs[R_SS].selector;
232 ts->vm86_saved_regs.ds = env->segs[R_DS].selector;
233 ts->vm86_saved_regs.es = env->segs[R_ES].selector;
234 ts->vm86_saved_regs.fs = env->segs[R_FS].selector;
235 ts->vm86_saved_regs.gs = env->segs[R_GS].selector;
236
237 ts->target_v86 = vm86_addr;
238 if (!lock_user_struct(VERIFY_READ, target_v86, vm86_addr, 1))
239 return -TARGET_EFAULT;
240 /* build vm86 CPU state */
241 ts->v86flags = tswap32(target_v86->regs.eflags);
242 env->eflags = (env->eflags & ~SAFE_MASK) |
243 (tswap32(target_v86->regs.eflags) & SAFE_MASK) | VM_MASK;
244
245 ts->vm86plus.cpu_type = tswapal(target_v86->cpu_type);
246 switch (ts->vm86plus.cpu_type) {
247 case TARGET_CPU_286:
248 ts->v86mask = 0;
249 break;
250 case TARGET_CPU_386:
251 ts->v86mask = NT_MASK | IOPL_MASK;
252 break;
253 case TARGET_CPU_486:
254 ts->v86mask = AC_MASK | NT_MASK | IOPL_MASK;
255 break;
256 default:
257 ts->v86mask = ID_MASK | AC_MASK | NT_MASK | IOPL_MASK;
258 break;
259 }
260
261 env->regs[R_EBX] = tswap32(target_v86->regs.ebx);
262 env->regs[R_ECX] = tswap32(target_v86->regs.ecx);
263 env->regs[R_EDX] = tswap32(target_v86->regs.edx);
264 env->regs[R_ESI] = tswap32(target_v86->regs.esi);
265 env->regs[R_EDI] = tswap32(target_v86->regs.edi);
266 env->regs[R_EBP] = tswap32(target_v86->regs.ebp);
267 env->regs[R_ESP] = tswap32(target_v86->regs.esp);
268 env->eip = tswap32(target_v86->regs.eip);
269 cpu_x86_load_seg(env, R_CS, tswap16(target_v86->regs.cs));
270 cpu_x86_load_seg(env, R_SS, tswap16(target_v86->regs.ss));
271 cpu_x86_load_seg(env, R_DS, tswap16(target_v86->regs.ds));
272 cpu_x86_load_seg(env, R_ES, tswap16(target_v86->regs.es));
273 cpu_x86_load_seg(env, R_FS, tswap16(target_v86->regs.fs));
274 cpu_x86_load_seg(env, R_GS, tswap16(target_v86->regs.gs));
275 ret = tswap32(target_v86->regs.eax); /* eax will be restored at
276 the end of the syscall */
277 memcpy(&ts->vm86plus.int_revectored,
278 &target_v86->int_revectored, 32);
279 memcpy(&ts->vm86plus.int21_revectored,
280 &target_v86->int21_revectored, 32);
281 ts->vm86plus.vm86plus.flags = tswapal(target_v86->vm86plus.flags);
282 memcpy(&ts->vm86plus.vm86plus.vm86dbg_intxxtab,
283 target_v86->vm86plus.vm86dbg_intxxtab, 32);
284 unlock_user_struct(target_v86, vm86_addr, 0);
285
286 LOG_VM86("do_vm86: cs:ip=%04x:%04x\n",
287 env->segs[R_CS].selector, env->eip);
288 /* now the virtual CPU is ready for vm86 execution ! */
289 out:
290 return ret;
291 }
292