Microsoft/Windows2003-3790
Microsoft/Windows2003-3790
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
50969b0ea2
Windows2003-3790/base/ntos/ke/ia64/ia32trap.c
Microsoft 50969b0ea2 First commit
2020-09-30 16:53:55 +02:00

1484 lines
36 KiB
C
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

/*++
Module Name:
ia32trap.c
Abstract:
This module contains iA32 trap handling code.
Only used by kernel.
Fault can ONLY be initiated from user mode code. There is no support
for iA32 code in the kernel mode.
For common pratice, we always return to the caller (lower level fault
handler) and have the system do a normal ia64 exception dispatch. The
wow64 code takes that exception and passes it back to the ia32 code
as needed.
Revision History:
1 Feb. 1999 Initial Version
16 Feb. 2000 SamerA Don't break on POPF/POPFD instructions and
alignment faults for Wow64 processes.
17 Oct. 2000 v-cspira Fix the emulation of smsw to handle the SIB byte
31 Oct. 2000 SamerA Ia32 Lock prefix emulation.
25 Sep. 2001 SamerA Stack-Selector (SS) Load instruction emulation.
02 Mar. 2002 SamerA Security fixes.
--*/
#if DBG
// Get all the iadebugging stuff when running a checked build
#define IADBG 1
#endif
#include "ki.h"
#include "ia32def.h"
BOOLEAN
KiIsTrapFrameModifiedAtApcLevel (
IN PKTRAP_FRAME TrapFrame,
BOOLEAN *IrqlChanged,
KIRQL *OldIrql
)
/*++
Routine Description
This function verifies we are running at APC level, and if not, elevates the
current thread's IRQL to APC level. It checks whether the trap frame has been
modified.
Arguments:
Frame - Supply a pointer to an iA32 TrapFrame
IrqlChanged - Pointer to boolean to indicate whether this function changed
OldIrql - Old Irql value.
Return:
TRUE - Trap frame has been modified since established.
FALSE - Trap frame has not been modified yet.
--*/
{
//
// Aquire APC_LEVEL so that SetContext calls on this thread are blocked.
//
if (KeGetCurrentIrql () < APC_LEVEL) {
KeRaiseIrql (APC_LEVEL, OldIrql);
*IrqlChanged = TRUE;
} else {
*OldIrql = PASSIVE_LEVEL;
*IrqlChanged = FALSE;
}
return (((TrapFrame->EOFMarker & MODIFIED_FRAME) != 0) ? TRUE : FALSE);
}
VOID
KiIA32CommonArgs (
IN PKTRAP_FRAME Frame,
IN NTSTATUS ExceptionCode,
IN PVOID ExceptionAddress,
IN ULONG_PTR Argument0,
IN ULONG_PTR Argument1,
IN ULONG_PTR Argument2
)
/*++
Routine Description
This routine sets up the ExceptionFrame
Arguments:
Frame - Supply a pointer to an iA32 TrapFrame
ExceptionCode - Supplies a Exception Code
ExceptionAddress - Supplies a pointer to user exception address
Argument0, Argument1, Argument2 - Possible ExceptionInformation
Return:
Nothing
--*/
{
PEXCEPTION_RECORD ExceptionRecord;
ExceptionRecord = (PEXCEPTION_RECORD)&Frame->ExceptionRecord;
ExceptionRecord->ExceptionRecord = (PEXCEPTION_RECORD)NULL;
ExceptionRecord->ExceptionCode = ExceptionCode;
ExceptionRecord->ExceptionFlags = 0;
ExceptionRecord->ExceptionAddress = ExceptionAddress;
ExceptionRecord->NumberParameters = 5;
ExceptionRecord->ExceptionInformation[0] = Argument0;
ExceptionRecord->ExceptionInformation[1] = Argument1;
ExceptionRecord->ExceptionInformation[2] = Argument2;
ExceptionRecord->ExceptionInformation[3] = (ULONG_PTR)Frame->StIIPA;
ExceptionRecord->ExceptionInformation[4] = (ULONG_PTR)Frame->StISR;
}
BOOLEAN
KiIA32ExceptionDivide(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
iA-32_Exception(Divide) - fault
Handle divide error fault.
Called from iA32_Exception() with
ISR.vector : 0
The divide error fault occurs if a DIV or IDIV instructions is
executed with a divisor of 0, or if the quotient is too big to
fit in the result operand.
An INTEGER DIVIDED BY ZERO exception will be raised for the fault.
The Faults can only come from user mode.
Arguments:
Frame - Supply a pointer to an iA32 TrapFrame
Return value:
--*/
{
//
// Setup exception and back to caller
//
KiIA32CommonArgs(Frame,
Ki386CheckDivideByZeroTrap(Frame),
(PVOID) (ULONG_PTR) EIP(Frame),
0, 0, 0);
return TRUE;
}
BOOLEAN
KiIA32ExceptionDebug(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
iA-32_Exception(Debug)
Called from iA32_Exception() with
ISR.Vector = 1
Depend on ISR.Code
0: It is Code BreakPoint Trap
TrapCode: Can be Concurrent Single Step |
Taken Branch | Data BreakPoint Trap
Handler needs to decode ISR.Code to distinguish
Note: EFlag isn't saved yet, so write directly to ar.24
Arguments:
Frame - Supply a pointer to an iA32 TrapFrame
Return Value:
No return
--*/
{
ULONGLONG EFlag;
#if defined(IADBG)
IF_IA32TRAP_DEBUG( DEBUG )
DbgPrint( "IA32 Debug: Eip 0x%p\n", EIP(Frame) );
#endif // IADBG
// Turn off the TF bit
EFlag = __getReg(CV_IA64_AR24);
EFlag &= ~EFLAGS_TF_BIT;
__setReg(CV_IA64_AR24, EFlag);
KiIA32CommonArgs(Frame,
STATUS_WX86_SINGLE_STEP,
(PVOID) (ULONG_PTR) EIP(Frame),
0, 0, 0);
return TRUE;
}
BOOLEAN
KiIA32ExceptionBreak(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
iA-32_Exception(Break) - Trap
BreakPoint instruction (INT 3) trigged a trap.
Note: EFlag isn't saved yet, so write directly to ar.24
Arguments:
Frame - Supply a pointer to an iA32 TrapFrame
Return Value:
--*/
{
ULONGLONG EFlag;
#if defined(IADBG)
IF_IA32TRAP_DEBUG( BREAK )
DbgPrint( "IA32 Break: Eip 0x%p\n", EIP(Frame) );
#endif // IADBG
// Turn off the TF bit
EFlag = __getReg(CV_IA64_AR24);
EFlag &= ~EFLAGS_TF_BIT;
__setReg(CV_IA64_AR24, EFlag);
KiIA32CommonArgs(Frame,
STATUS_WX86_BREAKPOINT,
(PVOID) (ULONG_PTR) EIP(Frame),
BREAKPOINT_X86_BREAK,
ECX(Frame),
EDX(Frame));
return TRUE;
}
BOOLEAN
KiIA32ExceptionOverflow(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
iA-32_Exception(Overflow) - Trap
ISR.Vector = 4
Handle INTO overflow
Eip - point to the address that next to the one causing INTO
Occurres when INTO instruction as well as EFlags.OF is ON
Trap only initiated from user mode
Arguments:
Frame - Supply a pointer to an iA32 TrapFrame
Return Value:
--*/
{
#if defined(IADBG)
IF_IA32TRAP_DEBUG( OVERFLOW )
DbgPrint( "IA32 OverFlow: Eip 0x%p\n", EIP(Frame) );
#endif // IADBG
//
// All error, generate exception and Eip point to INTO instruction
//
KiIA32CommonArgs(Frame,
STATUS_INTEGER_OVERFLOW,
(PVOID) (ULONG_PTR) (EIP(Frame) - 1),
0, 0, 0);
return TRUE;
}
BOOLEAN
KiIA32ExceptionBound(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
iA-32_Exception(Bound) - Fault
Handle Bound check fault
ISR.Vector = 5
Eip - point to BOUND instruction
The bound check fault occurs if a BOUND instruction finds that
the tested value is outside the specified range.
For bound check fault, an ARRAY BOUND EXCEEDED exception will be raised.
Arguments:
Frame - Supply a pointer to an iA32 TrapFrame
Return Value:
--*/
{
#if defined(IADBG)
IF_IA32TRAP_DEBUG( BOUND )
DbgPrint( "IA32 Bound: Eip 0x%p\n", EIP(Frame) );
#endif // IADBG
//
// All error, generate exception with Eip point to BOUND instruction
//
KiIA32CommonArgs(Frame,
STATUS_ARRAY_BOUNDS_EXCEEDED,
(PVOID) (ULONG_PTR) EIP(Frame),
0, 0, 0);
return TRUE;
}
ULONG
IA32EmulateSmsw(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
Emulate the SMSW instruction
Arguments:
Frame: Pointer to iA32 TrapFrame in the stack
Return Value:
Exception code
--*/
{
ULONG Code;
PUCHAR InstAddr;
UINT_PTR EffectiveAddress;
PUSHORT toAddr; // SMSW deals with 16 bits all the time...
BOOLEAN RegisterMode;
NTSTATUS status = STATUS_SUCCESS;
//
// Get the code for the prefix bytes that have already been grabbed
// and placed into the IIM
//
Code = ISRCode(Frame);
//
// The operand size is always 16 for this instruction. We don't care about
// overrides as the segment registers all contain the same thing.
//
//
// Find the instruction in memory and point the Effective Address
// at the byte after the opcode
// Inst Address is start of ia32 inst + length of prefix + number of
// bytes in opcode
//
InstAddr = (PUCHAR) (Frame->StIIP + ((Code >> 12) & 0xf) + 2);
if (!KiIa32Compute32BitEffectiveAddress(Frame, &InstAddr, &EffectiveAddress, &RegisterMode)) {
status = STATUS_ACCESS_VIOLATION;
}
if (NT_SUCCESS(status)) {
//
// The adress given to us hasn't been checked for user-space
// validity, so check it now
//
toAddr = (PUSHORT) EffectiveAddress;
try {
//
// Make sure we can write to the address
//
if (RegisterMode == FALSE) {
ProbeForWriteSmallStructure(toAddr, sizeof(SHORT), 2);
}
//
// and do the write
//
*toAddr = (SHORT) (__getReg(CV_IA64_AR27) & 0xffff);
}
except (EXCEPTION_EXECUTE_HANDLER) {
//
// return the exception
//
status = GetExceptionCode();
}
if (NT_SUCCESS(status)) {
//
// the store worked, so update the IIP so we can continue
// executing
//
Frame->StIIP = (UINT_PTR) InstAddr;
}
}
return status;
}
NTSTATUS
IA32CheckOpcode(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
To identify the Opcode violation state
Arguments:
Frame: Pointer to iA32 TrapFrame in the stack
Return Value:
Exception code
--*/
{
UCHAR OpCodeByte0;
UCHAR OpCodeByte1;
UCHAR OpCodeByte2;
OpCodeByte0 = (UCHAR) Frame->StIIM & 0xff;
OpCodeByte1 = (UCHAR) (Frame->StIIM >> 8) & 0xff;
OpCodeByte2 = (UCHAR) (Frame->StIIM >> 16) & 0xff;
switch (OpCodeByte0) {
case MI_HLT:
return (STATUS_PRIVILEGED_INSTRUCTION);
break;
case MI_TWO_BYTE:
if ((OpCodeByte1 == MI_SMSW)
&& ((OpCodeByte2 & MI_MODRM_MASK) == MI_SMSW_REGOP)) {
//
// We have the SMSW instruction
// So now need to emulate it...
//
return (IA32EmulateSmsw(Frame));
}
else if ((OpCodeByte1 == MI_LTR_LLDT) ||
(OpCodeByte2 == MI_LGDT_LIDT_LMSW)) {
OpCodeByte2 &= MI_MODRM_MASK; // get bit 3-5 of ModRM byte
if (OpCodeByte2==MI_LLDT_MASK || OpCodeByte2==MI_LTR_MASK ||
OpCodeByte2==MI_LGDT_MASK || OpCodeByte2==MI_LIDT_MASK ||
OpCodeByte2==MI_LMSW_MASK) {
return (STATUS_PRIVILEGED_INSTRUCTION);
} else {
return (STATUS_ACCESS_VIOLATION);
}
} else {
if (OpCodeByte1 & MI_SPECIAL_MOV_MASK) {
//
// mov may have special_mov_mask
// but they are not 2 bytes OpCode
//
return (STATUS_PRIVILEGED_INSTRUCTION);
} else {
//
// Do we need to further check if it is INVD, INVLPG ... ?
//
return (STATUS_ACCESS_VIOLATION);
}
}
break;
default:
//
// All other
//
return (STATUS_ILLEGAL_INSTRUCTION);
break;
}
}
BOOLEAN
KiIA32InterceptInstruction(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
iA-32_Exception(InstructionIntercept Opcode)
Program entry for either
1. IA-32 Invalid Opcode Fault #6, or
2. IA-32 interceptions(Inst)
Execution of unimplemented IA-32 opcodes, illegal opcodes or sensitive
privileged IA32 operating system instructions results this interception.
Possible Opcodes:
Privileged Opcodes: CLTS, HLT, INVD, INVLPG, LIDT, LMSW, LTR,
mov to/from CRs, DRs
RDMSR, RSM, SMSW, WBINVD, WRMSR
Arguments:
Frame - Supply a pointer to an iA32 TrapFrame
Return Value:
--*/
{
NTSTATUS status;
#if defined(IADBG)
IF_IA32TRAP_DEBUG( INSTRUCTION )
DbgPrint( "IA32 Instruction: Eip 0x%p\n", EIP(Frame) );
#endif // IADBG
status = IA32CheckOpcode(Frame);
switch (status) {
case STATUS_PRIVILEGED_INSTRUCTION:
KiIA32CommonArgs(Frame,
STATUS_PRIVILEGED_INSTRUCTION,
(PVOID) (ULONG_PTR) EIP(Frame),
0, 0, 0);
break;
case STATUS_ACCESS_VIOLATION:
KiIA32CommonArgs(Frame,
STATUS_ACCESS_VIOLATION,
(PVOID) (ULONG_PTR) EIP(Frame),
0, (ULONG_PTR)-1, 0);
break;
case STATUS_ILLEGAL_INSTRUCTION:
KiIA32CommonArgs(Frame,
STATUS_ILLEGAL_INSTRUCTION,
(PVOID) (ULONG_PTR) EIP(Frame),
0, (ULONG_PTR)-1, 0);
break;
case STATUS_SUCCESS:
//
// This means the OpCode was dealt with, so let the code continue
//
return FALSE;
default:
KiIA32CommonArgs(Frame,
status,
(PVOID) (ULONG_PTR) EIP(Frame),
0, (ULONG_PTR)-1, 0);
break;
}
return TRUE;
}
BOOLEAN
KiIA32ExceptionNoDevice(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
iA-32_Exception(Coprocessor Not Available) - fault
This routine is called from iA32_Exception() with
ISR.Vector = 7
Note:
At this time, the AR registers have not been saved. This
includes, CFLAGS (AR.27), EFLAGS (AR.24), FCR (AR.21),
FSR (AR.28), FIR (AR.29) and FDR (AR.30).
Arguments:
Frame - iA32 TrapFrame that was saved in the memory stack
Return Value:
--*/
{
NTSTATUS ErrorCode;
ULONG FirOffset, FdrOffset;
ULONG FpState;
ULONGLONG FcrRegister, FsrRegister;
#if defined(IADBG)
IF_IA32TRAP_DEBUG( NODEVICE )
DbgPrint( "IA32 NoDevice: Eip 0x%p\n", EIP(Frame) );
#endif // IADBG
FcrRegister = __getReg(CV_IA64_AR21);
FsrRegister = __getReg(CV_IA64_AR28);
FirOffset = (ULONG) (__getReg(CV_IA64_AR29) & 0xFFFFFFFF);
FdrOffset = (ULONG) (__getReg(CV_IA64_AR30) & 0xFFFFFFFF);
//
// According to the floating error priority,
// we test what is the cause of the NPX error
// and raise an appropriate exception
//
FpState = (ULONG) (~(FcrRegister &
(FSW_INVALID_OPERATION | FSW_DENORMAL |
FSW_ZERO_DIVIDE | FSW_OVERFLOW |
FSW_UNDERFLOW | FSW_PRECISION)) &
(FsrRegister & FSW_ERR_MASK));
ErrorCode = 0;
if (FpState & FSW_INVALID_OPERATION) {
if (FpState & FSW_STACK_FAULT) {
KiIA32CommonArgs(Frame,
STATUS_FLOAT_STACK_CHECK,
(PVOID) (ULONG_PTR) FirOffset,
0, FdrOffset, 0);
return TRUE;
} else {
KiIA32CommonArgs(Frame,
STATUS_FLOAT_INVALID_OPERATION,
(PVOID) (ULONG_PTR) FirOffset,
0, 0, 0);
return TRUE;
}
} else {
//
// Follow the x86 priority of which exception to report if
// multiple bits are set
//
if (FpState & FSW_ZERO_DIVIDE) {
ErrorCode = STATUS_FLOAT_DIVIDE_BY_ZERO;
}
else if (FpState & FSW_DENORMAL) {
ErrorCode = STATUS_FLOAT_INVALID_OPERATION;
}
else if (FpState & FSW_OVERFLOW) {
ErrorCode = STATUS_FLOAT_OVERFLOW;
}
else if (FpState & FSW_UNDERFLOW) {
ErrorCode = STATUS_FLOAT_UNDERFLOW;
}
else if (FpState & FSW_PRECISION) {
ErrorCode = STATUS_FLOAT_INEXACT_RESULT;
}
}
//
// If we get here, we either have the error code, or
// we went through everything and saw nothing
//
if (ErrorCode) {
KiIA32CommonArgs(Frame,
ErrorCode,
(PVOID) (ULONG_PTR) FirOffset,
0, 0, 0);
return TRUE;
}
//
// FpState indicates no error, then something is wrong
// Panic the system !!!
//
// KeBugCheckEx(TRAP_CAUSE_UNKNOWN, (ULONG_PTR)Frame, 0, 0, 2);
//
// Turns out there is a bug in the chip and it can cause an fp fault even
// with a masked fp exception... So, don't bug check, count it
// as non-error and reset the fsr.es bit to try and avoid getting this
// exception in the future.
//
#if defined(IADBG)
DbgPrint( "IA32 Debug: Saw FP exception when FP exceptions are masked. Reseting fsr.es bit\n");
#endif // IADBG
FsrRegister &= ~((ULONGLONG) FSW_ERROR_SUMMARY);
__setReg(CV_IA64_AR28, FsrRegister);
return FALSE;
}
BOOLEAN
KiIA32ExceptionSegmentNotPresent(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
iA-32_Exception(Not Present) - fault
Handle Segment Not Present fault.
ISR.Vector = 11
This exception occurs when the processor finds the P bit 0
when accessing an otherwise valid descriptor that is not to
be loaded in SS register.
Arguments:
Frame - iA32 TrapFrame that was saved in the memory stack
Return Value:
--*/
{
#if defined(IADBG)
IF_IA32TRAP_DEBUG( NOTPRESENT )
DbgPrint( "IA32 NotPresent: Eip 0x%p\n", EIP(Frame) );
#endif // IADBG
//
// Generate Exception for all other errors
//
KiIA32CommonArgs(Frame,
STATUS_ACCESS_VIOLATION,
(PVOID) (ULONG_PTR) EIP(Frame),
0, ISRCode(Frame) | RPL_MASK, 0);
return TRUE;
}
BOOLEAN
KiIA32ExceptionStack(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
iA-32_Exception(Stack) - fault
ISR.Vector = 12
This exception occurs when the processor detects certain problem
with the segment addressed by the SS segment register:
1. A limit violation in the segment addressed by the SS (error
code = 0)
2. A limit vioalation in the inner stack during an interlevel
call or interrupt (error code = selector for the inner stack)
3. If the descriptor to be loaded into SS has its present bit 0
(error code = selector for the not-present segment)
The exception only occurred from user mode
Arguments:
Frame - iA32 TrapFrame that was saved in the memory stack
Return Value:
--*/
{
USHORT Code;
#if defined(IADBG)
IF_IA32TRAP_DEBUG( STACK )
DbgPrint( "IA32 Stack: Eip 0x%p\n", EIP(Frame) );
#endif // IADBG
//
// Dispatch Exception to user
//
Code = ISRCode(Frame);
//
// Code may contain the faulting selector
//
KiIA32CommonArgs(Frame,
STATUS_ACCESS_VIOLATION,
(PVOID) (ULONG_PTR) EIP(Frame),
Code ? (Code | RPL_MASK) : ESP(Frame),
Code ? EXCEPT_UNKNOWN_ACCESS : EXCEPT_LIMIT_ACCESS,
0);
return TRUE;
}
BOOLEAN
KiIA32ExceptionInvalidOp(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
iA-32_Exception(Invalid Opcode) - fault
PKTRAP_FRAME Frame
Eip : virtual iA-32 instruction address
ISR.vector : 6
Note:
Only MMX and KNI instructions can cause this fault based
on values in CR0 and CR4
Arguments:
Frame - iA32 TrapFrame that was saved in the memory stack
Return Value:
--*/
{
#if defined(IADBG)
IF_IA32TRAP_DEBUG( INSTRUCTION )
DbgPrint( "IA32 Invalid Opcode: Eip 0x%p\n", EIP(Frame) );
#endif // IADBG
KiIA32CommonArgs(Frame,
STATUS_ILLEGAL_INSTRUCTION,
(PVOID) (ULONG_PTR) EIP(Frame),
0, 0, 0);
return TRUE;
}
BOOLEAN
KiIA32ExceptionGPFault(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
iA-32_Exception(General Protection) - fault
PKTRAP_FRAME Frame
Eip : virtual iA-32 instruction address
ISR.vector : 13
ISR.code : ErrorCode
Note:
Previlidged instructions are intercepted,
see KiIA32InterceptInstruction
Arguments:
Frame - iA32 TrapFrame that was saved in the memory stack
Return Value:
--*/
{
UCHAR OpCode;
NTSTATUS Status;
#if defined(IADBG)
IF_IA32TRAP_DEBUG( GPFAULT )
DbgPrint( "IA32 GpFault: Eip 0x%p\n", EIP(Frame) );
#endif // IADBG
try {
ProbeForReadSmallStructure((VOID *)Frame->StIIP, sizeof(UCHAR), sizeof(UCHAR));
OpCode = *(UCHAR *)Frame->StIIP;
} except (EXCEPTION_EXECUTE_HANDLER) {
OpCode = 0xcc;
}
// This table comes from the IOInstructionTable in i386\trap.asm
switch (OpCode) {
case CLI_OP:
case STI_OP:
case 0xe4: case 0xe5: case 0xec: case 0xed: // IN
case 0x6c: case 0x6d: // INS
case 0xe6: case 0xe7: case 0xee: case 0xef: // OUT
case 0x6e: case 0x6f: // OUTS
Status = STATUS_PRIVILEGED_INSTRUCTION;
break;
default:
Status = STATUS_ACCESS_VIOLATION;
break;
}
KiIA32CommonArgs(Frame,
Status,
(PVOID) (ULONG_PTR) EIP(Frame),
0, 0, 0);
return TRUE;
}
BOOLEAN
KiIA32ExceptionKNI(
IN PKTRAP_FRAME Frame
)
/*++
iA32_Exception(KNI) - Fault
Unmasked KNI IA32 Error.
ISR.Vector = 19
--*/
{
NTSTATUS ErrorCode;
ULONG FpState;
ULONGLONG FcrRegister, FsrRegister;
#if defined(IADBG)
IF_IA32TRAP_DEBUG( FPFAULT )
DbgPrint( "IA32 KNI Fault: Eip 0x%p\n", EIP(Frame) );
#endif // IADBG
FcrRegister = __getReg(CV_IA64_AR21);
FsrRegister = __getReg(CV_IA64_AR28);
//
// Get the Katmai error state
// The trick here is that the state is in the same registers as the FP
// state and the bit positions are in the same relative location
// so just need to shift the bits and can use the same constants
// that we had for the x87 case
//
FpState = (ULONG) (~((FcrRegister >> KATMAI_SHIFT_CONTROL) & FSW_ERR_MASK) &
((FsrRegister >> KATMAI_SHIFT_STATUS) & FSW_ERR_MASK));
//
// FpState now has a 1 for any error that was unmasked
//
//
// Follow the x86 priority of which exception to report if
// multiple bits are set
//
if (FpState & FSW_INVALID_OPERATION) {
ErrorCode = STATUS_FLOAT_MULTIPLE_TRAPS;
}
else if (FpState & FSW_ZERO_DIVIDE) {
ErrorCode = STATUS_FLOAT_MULTIPLE_TRAPS;
}
else if (FpState & FSW_DENORMAL) {
ErrorCode = STATUS_FLOAT_MULTIPLE_TRAPS;
}
else if (FpState & FSW_OVERFLOW) {
ErrorCode = STATUS_FLOAT_MULTIPLE_FAULTS;
}
else if (FpState & FSW_UNDERFLOW) {
ErrorCode = STATUS_FLOAT_MULTIPLE_FAULTS;
}
else if (FpState & FSW_PRECISION) {
ErrorCode = STATUS_FLOAT_MULTIPLE_FAULTS;
}
else {
//
// We have a problem... Shouldn't get here
// as that means we took the exception, but no
// unmasked errors were found...
//
ErrorCode = 0;
}
//
// If we get here, we either have the error code, or
// we went through everything and saw nothing
//
if (ErrorCode) {
KiIA32CommonArgs(Frame,
ErrorCode,
(PVOID) (ULONG_PTR) EIP(Frame),
0, 0, 0);
return TRUE;
}
//
// FpState indicates no error, then something is wrong
// Panic the system !!!
//
KeBugCheckEx(TRAP_CAUSE_UNKNOWN, (ULONG_PTR)Frame, ISRVector(Frame), 0, 3);
}
BOOLEAN
KiIA32ExceptionFPFault(
IN PKTRAP_FRAME Frame
)
/*++
iA32_Exception(Floating Point) - Fault
Handle Coprocessor Error.
ISR.Vector = 16
This exception is used on 486 or above only. For i386, it uses
IRQ 13 instead.
JMPE instruction should flush all FP delayed exception, and the traps
will goto Device Not Available trap
--*/
{
#if defined(IADBG)
IF_IA32TRAP_DEBUG( FPFAULT )
DbgPrint( "IA32 FpFault: Eip 0x%p\n", EIP(Frame) );
#endif // IADBG
return(KiIA32ExceptionNoDevice(Frame));
}
BOOLEAN
KiIA32ExceptionAlignmentFault(
IN PKTRAP_FRAME Frame
)
/*++
iA32_Exception(Alignment Check) - fault
Handle alignment faults.
ISR.Vector = 17
This exception occurs when an unaligned data access is made by a thread
with alignment checking turned on.
This fault occurred when unaligned access on EM PSR.AC is ON
Note that iA32 EFLAFS.AC, CR0.AM and CPL!=3 does not unmask the fault.
So, for now, let the ia64 alignment handler handle this...
--*/
{
PPSR IntPSR;
#if defined(IADBG)
IF_IA32TRAP_DEBUG( ALIGNMENT )
DbgPrint( "IA32 Alignment: Eip 0x%p\n", EIP(Frame) );
#endif // IADBG
//
// Win32 x86 apps don't expect any alignment faults, so
// let's mask them out.
//
IntPSR = (PPSR)&Frame->StIPSR;
IntPSR->sb.psr_ac = 0;
return FALSE;
}
BOOLEAN
KiIA32InterruptVector(
IN PKTRAP_FRAME Frame
)
/*++
iA32_Interrupt(Vector #) - trap
Handle INTnn trap
Under EM system mode, iA32 INT instruction forces a mandatory iA-32
interrupt trap through iA-32 Interrupt(SoftWare Interrupt)
--*/
{
#if defined(IADBG)
IF_IA32TRAP_DEBUG( INTNN )
DbgPrint( "IA32 Intnn: Eip 0x%p INT 0x%x\n", EIP(Frame), ISRVector(Frame));
#endif // IADBG
KiIA32CommonArgs(Frame,
STATUS_PRIVILEGED_INSTRUCTION,
(PVOID) (ULONG_PTR) EIP(Frame),
0, 0, 0);
return TRUE;
}
BOOLEAN
KiIA32InterceptGate(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
iA32_Intercept(Gate) - trap
If an iA32 control transfer is initiated through a GDT or LDT descriptor
that results in an either a promotion of privilege level (interlevel Call
or Jump Gate and IRET) or an iA32 task switch (TSS segment or Gate),
the intercept trap is generated.
Possible instructions intercepted:
CALL, RET, IRET, IRETD and JMP
Handling
No CaLL, RET, JMP, IRET, IRETD are allowed in any mode,
STATUS_ACCESS_VIOLATION is returned
Arguments:
Frame - iA32 TrapFrame that was saved in the memory stack
Return Value:
--*/
{
#if defined(IADBG)
IF_IA32TRAP_DEBUG( GATE )
DbgPrint( "IA32 Gate: Eip 0x%p GateSelector 0x%x OpcodeId 0x%x\n",
EIP(Frame),
(ULONG) (Frame->StIFA & 0xff),
(ULONG) (ISRCode(Frame) >> 14));
#endif // IADBG
//
// all error fall through here
//
KiIA32CommonArgs(Frame,
STATUS_ILLEGAL_INSTRUCTION,
(PVOID) (ULONG_PTR) EIP(Frame),
0, 0, 0);
return TRUE;
}
/*++
iA32_intercept(System Flag) - trap
Possible Causes:
1. if CFLAG.ii==1 and EFLAG.if changes state
2. Generated after either EFLAG.ac, tf or rf changes state
if no IOPL or CPL to modify bits then no interception.
3. if CFLG.nm==1 then successful execution of IRET also intercepted
Possible instructions:
CLI, POPF, POFD, STI and IRET
Currently, we set both CFLAG.ii and nm to 0, so that we will only possiblly
get case #2. But in EM/NT, it should always come from user land which
we hard-set EFLAG.IOPL to 0, so there if we do get case #2, then it is user
play around EFLAG.IOPL through JMPE. We should fail it.
--*/
BOOLEAN
KiIA32InterceptSystemFlag(
IN PKTRAP_FRAME Frame
)
{
BOOLEAN TrapFrameModified;
BOOLEAN RestoreIrql;
KIRQL OldIrql;
NTSTATUS NtStatus;
#if defined(IADBG)
IF_IA32TRAP_DEBUG( FLAG )
DbgPrint( "IA32 FLAG: Eip 0x%p Old EFlag: 0x%x OpcodeId 0x%x\n",
EIP(Frame),
(ULONG) (Frame->StIIM & 0xff),
(ULONG) (ISRCode(Frame) >> 14));
#endif // IADBG
//
// Don't trap on POPF/POPFD instructions from ia32 code.
// Allow Eflags.TF and/or Eflags.AC to be changed.
//
if ((ISRCode(Frame) >> 14) == 2)
{
return FALSE;
}
TrapFrameModified = KiIsTrapFrameModifiedAtApcLevel (Frame,
&RestoreIrql,
&OldIrql);
//
// If the frame has been modified, then restart execution.
//
if (TrapFrameModified == TRUE) {
NtStatus = STATUS_SUCCESS;
} else {
//
// Validate the instruction.
//
NtStatus = KiIa32ValidateInstruction (Frame);
}
if (RestoreIrql == TRUE) {
KeLowerIrql (OldIrql);
}
if (NT_SUCCESS (NtStatus))
{
return FALSE;
}
KiIA32CommonArgs(
Frame,
NtStatus,
(PVOID) (ULONG_PTR) EIP(Frame),
0, 0, 0);
return TRUE;
}
BOOLEAN
KiIA32InterceptLock(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
iA32_Intercept(Lock) - trap
Lock intercepts occurred if platform or firmware code has disabled locked
transactions and atomic memory update requires a processor external
indication
Arguments:
Frame - Point to iA32 TrapFrame
Return:
--*/
{
BOOLEAN TrapFrameModified;
BOOLEAN RestoreIrql;
KIRQL OldIrql;
NTSTATUS NtStatus;
#if defined(IADBG)
IF_IA32TRAP_DEBUG( LOCK )
DbgPrint( "IA32 LOCK: Eip 0x%p\n", EIP(Frame) );
#endif // IADBG
TrapFrameModified = KiIsTrapFrameModifiedAtApcLevel (Frame,
&RestoreIrql,
&OldIrql);
//
// If the frame has been modified, then restart execution.
//
if (TrapFrameModified == TRUE) {
NtStatus = STATUS_SUCCESS;
} else {
//
// Emulate the lock prefix
//
NtStatus = KiIa32InterceptUnalignedLock (Frame);
}
if (RestoreIrql == TRUE) {
KeLowerIrql (OldIrql);
}
if (!NT_SUCCESS (NtStatus)) {
KiIA32CommonArgs(
Frame,
NtStatus,
(PVOID) (ULONG_PTR) EIP(Frame),
0,
0,
0
);
}
return (!NT_SUCCESS (NtStatus)) ? TRUE : FALSE;
}
BOOLEAN
KiIA32ExceptionPanic(
IN PKTRAP_FRAME Frame
)
{
//
// Panic the system
//
KeBugCheckEx(TRAP_CAUSE_UNKNOWN,
(ULONG_PTR)Frame,
ISRVector(Frame),
0,
0);
}
CONST BOOLEAN (*KiIA32ExceptionDispatchTable[])(PKTRAP_FRAME) = {
KiIA32ExceptionDivide,
KiIA32ExceptionDebug,
KiIA32ExceptionPanic,
KiIA32ExceptionBreak,
KiIA32ExceptionOverflow,
KiIA32ExceptionBound,
KiIA32ExceptionInvalidOp,
KiIA32ExceptionNoDevice,
KiIA32ExceptionPanic,
KiIA32ExceptionPanic,
KiIA32ExceptionPanic,
KiIA32ExceptionSegmentNotPresent,
KiIA32ExceptionStack,
KiIA32ExceptionGPFault,
KiIA32ExceptionPanic,
KiIA32ExceptionPanic,
KiIA32ExceptionFPFault,
KiIA32ExceptionAlignmentFault,
KiIA32ExceptionPanic,
KiIA32ExceptionKNI
};
CONST BOOLEAN (*KiIA32InterceptionDispatchTable[])(PKTRAP_FRAME) = {
KiIA32InterceptInstruction,
KiIA32InterceptGate,
KiIA32InterceptSystemFlag,
KiIA32ExceptionPanic,
KiIA32InterceptLock
};
#pragma warning(disable:4702) // unreachable code
BOOLEAN
KiIA32InterceptionVectorHandler(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
KiIA32InterceptionVectorHandler
Called by first label KiIA32InterceptionVector() to handle further iA32
interception processing.
Arguments:
Frame - iA32 TrapFrame that was saved in the memory stack
Return Value:
TRUE - go to dispatch exception
FALSE - Exception was handled, do an RFI
--*/
{
#if defined(IADBG)
IF_IA32TRAP_DEBUG( INTERCEPTION )
DbgPrint("IA32 Interception: ISRVector 0x%x Frame 0x%p\n", ISRVector(Frame), Frame);
#endif // IADBG
ASSERT(UserMode == Frame->PreviousMode);
//
// Make sure we have an entry in the table for this interception
//
if (ISRVector(Frame) <= (sizeof(KiIA32InterceptionDispatchTable) / sizeof(PVOID)))
return (*KiIA32InterceptionDispatchTable[ISRVector(Frame)])(Frame);
else
return (KiIA32ExceptionPanic(Frame));
}
#pragma warning(default:4702)
#pragma warning(disable:4702) // unreachable code
BOOLEAN
KiIA32ExceptionVectorHandler(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
KiIA32ExceptionVectorHandler
Called by first label KiIA32ExceptionVector() to handle further iA32
interception processing.
Arguments:
Frame - iA32 TrapFrame that was saved in the memory stack
Return Value:
TRUE - go to dispatch exception
FALSE - Exception was handled, do an RFI
--*/
{
#if defined(IADBG)
IF_IA32TRAP_DEBUG( EXCEPTION )
DbgPrint("IA32 Exception: ISRVector 0x%x Frame 0x%p\n", ISRVector(Frame), Frame);
#endif // IADBG
ASSERT(UserMode == Frame->PreviousMode);
//
// Make sure we have an entry in the table for this exception
//
if (ISRVector(Frame) <= (sizeof(KiIA32ExceptionDispatchTable) / sizeof(PVOID)))
return (*KiIA32ExceptionDispatchTable[ISRVector(Frame)])(Frame);
else
return(KiIA32ExceptionPanic(Frame));
}
#pragma warning(default:4702)
BOOLEAN
KiIA32InterruptionVectorHandler(
IN PKTRAP_FRAME Frame
)
/*++
Routine Description:
KiIA32InterruptionVectorHandler
Called by first label KiIA32InterruptionVector() to handle further iA32
interruption processing. Only get here on INT xx instructions
Arguments:
Frame - iA32 TrapFrame that was saved in the memory stack
Return Value:
TRUE - go to dispatch exception
FALSE - Exception was handled, do an RFI
--*/
{
#if defined(IADBG)
IF_IA32TRAP_DEBUG( INTERRUPT )
DbgPrint("IA32 Interruption: ISRVector 0x%x Frame 0x%p\n", ISRVector(Frame), Frame);
#endif // IADBG
ASSERT(UserMode == Frame->PreviousMode);
//
// Follow the ia32 way of INT xx as an Access Violation
//
// INT 3 should be handled via a debug exception and should
// never get here...
//
ASSERT(3 != ISRVector(Frame));
KiIA32CommonArgs(Frame,
STATUS_ACCESS_VIOLATION,
(PVOID) (ULONG_PTR) EIP(Frame),
0, 0, 0);
return TRUE;
}
Reference in New Issue View Git Blame Copy Permalink