1 | /** @file
|
---|
2 | * GCM - Guest Compatibility Manager - All Contexts.
|
---|
3 | */
|
---|
4 |
|
---|
5 | /*
|
---|
6 | * Copyright (C) 2022-2023 Oracle and/or its affiliates.
|
---|
7 | *
|
---|
8 | * This file is part of VirtualBox base platform packages, as
|
---|
9 | * available from https://www.virtualbox.org.
|
---|
10 | *
|
---|
11 | * This program is free software; you can redistribute it and/or
|
---|
12 | * modify it under the terms of the GNU General Public License
|
---|
13 | * as published by the Free Software Foundation, in version 3 of the
|
---|
14 | * License.
|
---|
15 | *
|
---|
16 | * This program is distributed in the hope that it will be useful, but
|
---|
17 | * WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
18 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
---|
19 | * General Public License for more details.
|
---|
20 | *
|
---|
21 | * You should have received a copy of the GNU General Public License
|
---|
22 | * along with this program; if not, see <https://www.gnu.org/licenses>.
|
---|
23 | *
|
---|
24 | * SPDX-License-Identifier: GPL-3.0-only
|
---|
25 | */
|
---|
26 |
|
---|
27 |
|
---|
28 | /*********************************************************************************************************************************
|
---|
29 | * Header Files *
|
---|
30 | *********************************************************************************************************************************/
|
---|
31 | #define LOG_GROUP LOG_GROUP_GIM
|
---|
32 | #include <VBox/vmm/gcm.h>
|
---|
33 | #include <VBox/vmm/em.h> /* For EMInterpretDisasCurrent */
|
---|
34 | #include "GCMInternal.h"
|
---|
35 | #include <VBox/vmm/vmcc.h>
|
---|
36 |
|
---|
37 | #include <VBox/dis.h> /* For DISSTATE */
|
---|
38 | #include <iprt/errcore.h>
|
---|
39 | #include <iprt/string.h>
|
---|
40 |
|
---|
41 |
|
---|
42 | /**
|
---|
43 | * Checks whether GCM is enabled for this VM.
|
---|
44 | *
|
---|
45 | * @retval true if GCM is on.
|
---|
46 | * @retval false if no GCM fixer is enabled.
|
---|
47 | *
|
---|
48 | * @param pVM The cross context VM structure.
|
---|
49 | */
|
---|
50 | VMMDECL(bool) GCMIsEnabled(PVM pVM)
|
---|
51 | {
|
---|
52 | return pVM->gcm.s.fFixerSet != GCMFIXER_NONE;
|
---|
53 | }
|
---|
54 |
|
---|
55 |
|
---|
56 | /**
|
---|
57 | * Gets the GCM fixers configured for this VM.
|
---|
58 | *
|
---|
59 | * @returns The GCM provider Id.
|
---|
60 | * @param pVM The cross context VM structure.
|
---|
61 | */
|
---|
62 | VMMDECL(int32_t) GCMGetFixers(PVM pVM)
|
---|
63 | {
|
---|
64 | return pVM->gcm.s.fFixerSet;
|
---|
65 | }
|
---|
66 |
|
---|
67 |
|
---|
68 | /**
|
---|
69 | * Whether \#DE exceptions in the guest should be intercepted by GCM and
|
---|
70 | * possibly fixed up.
|
---|
71 | *
|
---|
72 | * @returns true if needed, false otherwise.
|
---|
73 | * @param pVCpu The cross context virtual CPU structure.
|
---|
74 | */
|
---|
75 | VMM_INT_DECL(bool) GCMShouldTrapXcptDE(PVMCPUCC pVCpu)
|
---|
76 | {
|
---|
77 | LogFlowFunc(("entered\n"));
|
---|
78 | PVM pVM = pVCpu->CTX_SUFF(pVM);
|
---|
79 | if (!GCMIsEnabled(pVM))
|
---|
80 | return false;
|
---|
81 |
|
---|
82 | LogFunc(("GCM checking if #DE needs trapping\n"));
|
---|
83 |
|
---|
84 | /* See if the enabled fixers need to intercept #DE. */
|
---|
85 | if ( pVM->gcm.s.fFixerSet
|
---|
86 | & (GCMFIXER_DBZ_DOS | GCMFIXER_DBZ_OS2 | GCMFIXER_DBZ_WIN9X))
|
---|
87 | {
|
---|
88 | LogRel(("GCM: #DE should be trapped\n"));
|
---|
89 | return true;
|
---|
90 | }
|
---|
91 |
|
---|
92 | return false;
|
---|
93 | }
|
---|
94 |
|
---|
95 |
|
---|
96 | /**
|
---|
97 | * Exception handler for \#DE when registered by GCM.
|
---|
98 | *
|
---|
99 | * @returns Strict VBox status code.
|
---|
100 | * @retval VINF_SUCCESS retry division and continue.
|
---|
101 | * @retval VERR_NOT_FOUND deliver exception to guest.
|
---|
102 | *
|
---|
103 | * @param pVCpu The cross context virtual CPU structure.
|
---|
104 | * @param pCtx Pointer to the guest-CPU context.
|
---|
105 | * @param pDis Pointer to the disassembled instruction state at RIP.
|
---|
106 | * If NULL is passed, it implies the disassembly of the
|
---|
107 | * the instruction at RIP is the
|
---|
108 | * responsibility of GCM.
|
---|
109 | * @param pcbInstr Where to store the instruction length of
|
---|
110 | * the divide instruction. Optional, can be
|
---|
111 | * NULL.
|
---|
112 | *
|
---|
113 | * @thread EMT(pVCpu).
|
---|
114 | */
|
---|
115 | VMM_INT_DECL(VBOXSTRICTRC) GCMXcptDE(PVMCPUCC pVCpu, PCPUMCTX pCtx, PDISSTATE pDis, uint8_t *pcbInstr)
|
---|
116 | {
|
---|
117 | PVMCC pVM = pVCpu->CTX_SUFF(pVM);
|
---|
118 | Assert(GCMIsEnabled(pVM));
|
---|
119 | Assert(pDis || pcbInstr);
|
---|
120 | RT_NOREF(pDis);
|
---|
121 | RT_NOREF(pcbInstr);
|
---|
122 |
|
---|
123 | LogRel(("GCM: Intercepted #DE at CS:RIP=%04x:%RX64 (%RX64 linear) RDX:RAX=%RX64:%RX64 RCX=%RX64 RBX=%RX64\n",
|
---|
124 | pCtx->cs.Sel, pCtx->rip, pCtx->cs.u64Base + pCtx->rip, pCtx->rdx, pCtx->rax, pCtx->rcx, pCtx->rbx));
|
---|
125 |
|
---|
126 | if (pVM->gcm.s.fFixerSet & GCMFIXER_DBZ_OS2)
|
---|
127 | {
|
---|
128 | if (pCtx->rcx == 0 && pCtx->rdx == 1 && pCtx->rax == 0x86a0)
|
---|
129 | {
|
---|
130 | /* OS/2 1.x drivers loaded during boot: DX:AX = 100,000, CX < 2 causes overflow. */
|
---|
131 | /* Example: OS/2 1.0 KBD01.SYS, 16,945 bytes, dated 10/21/1987, div cx at offset 2:2ffeh */
|
---|
132 | /* Code later merged into BASEDD01.SYS, crash fixed in OS/2 1.30.1; this should
|
---|
133 | * fix all affected versions of OS/2 1.x.
|
---|
134 | */
|
---|
135 | pCtx->rcx = 2;
|
---|
136 | return VINF_SUCCESS;
|
---|
137 | }
|
---|
138 | if ((uint16_t)pCtx->rbx == 0 && (uint16_t)pCtx->rdx == 0 && (uint16_t)pCtx->rax == 0x1000)
|
---|
139 | {
|
---|
140 | /* OS/2 2.1 and later boot loader: DX:AX = 0x1000, zero BX. May have junk in high words of all registers. */
|
---|
141 | /* Example: OS/2 MCP2 OS2LDR, 44,544 bytes, dated 03/08/2002, idiv bx at offset 847ah */
|
---|
142 | pCtx->rbx = (pCtx->rbx & ~0xffff) | 2;
|
---|
143 | return VINF_SUCCESS;
|
---|
144 | }
|
---|
145 | if (pCtx->rbx == 0 && pCtx->rdx == 0 && pCtx->rax == 0x100)
|
---|
146 | {
|
---|
147 | /* OS/2 2.0 boot loader: DX:AX = 0x100, zero BX. May have junk in high words of registers. */
|
---|
148 | /* Example: OS/2 2.0 OS2LDR, 32,256 bytes, dated 03/30/1992, idiv bx at offset 2298h */
|
---|
149 | pCtx->rbx = 2;
|
---|
150 | return VINF_SUCCESS;
|
---|
151 | }
|
---|
152 | }
|
---|
153 |
|
---|
154 | if (pVM->gcm.s.fFixerSet & GCMFIXER_DBZ_DOS)
|
---|
155 | {
|
---|
156 | /* NB: For 16-bit DOS software, we must generally only compare 16-bit registers.
|
---|
157 | * The contents of the high words may be unpredictable depending on the environment.
|
---|
158 | * For 32-bit Windows 3.x code that is not the case.
|
---|
159 | */
|
---|
160 | if (pCtx->rcx == 0 && pCtx->rdx == 0 && pCtx->rax == 0x100000)
|
---|
161 | {
|
---|
162 | /* NDIS.386 in WfW 3.11: CalibrateStall, EDX:EAX = 0x100000, zero ECX.
|
---|
163 | * Occurs when NDIS.386 loads.
|
---|
164 | */
|
---|
165 | pCtx->rcx = 0x20000; /* Want a large divisor to shorten stalls. */
|
---|
166 | return VINF_SUCCESS;
|
---|
167 | }
|
---|
168 | if (pCtx->rcx == 0 && pCtx->rdx == 0 && pCtx->rax > 0x100000)
|
---|
169 | {
|
---|
170 | /* NDIS.386 in WfW 3.11: NdisStallExecution, EDX:EAX = 0xYY00000, zero ECX.
|
---|
171 | * EDX:EAX is variable, but low 20 bits of EAX must be zero and EDX is likely
|
---|
172 | * to be zero as well.
|
---|
173 | * Only occurs if NdisStallExecution is called to do a longish stall.
|
---|
174 | */
|
---|
175 | pCtx->rcx = 22;
|
---|
176 | return VINF_SUCCESS;
|
---|
177 | }
|
---|
178 | if ((uint16_t)pCtx->rbx == 0 && (uint16_t)pCtx->rdx == 0 && (uint16_t)pCtx->rax == 0x64)
|
---|
179 | {
|
---|
180 | /* Norton Sysinfo or Diagnostics 8.0 DX:AX = 0x64 (100 decimal), zero BX. */
|
---|
181 | pCtx->rbx = (pCtx->rbx & 0xffff0000) | 1; /* BX = 1 */
|
---|
182 | return VINF_SUCCESS;
|
---|
183 | }
|
---|
184 | if ((uint16_t)pCtx->rbx == 0 && (uint16_t)pCtx->rdx == 0 && (uint16_t)pCtx->rax == 0xff)
|
---|
185 | {
|
---|
186 | /* IBM PC LAN Program 1.3: DX:AX=0xff (255 decimal), zero BX. */
|
---|
187 | /* NETWORK1.CMD, 64,324 bytes, dated 06/06/1988, div bx at offset 0xa400 in file. */
|
---|
188 | pCtx->rbx = (pCtx->rbx & 0xffff0000) | 1; /* BX = 1 */
|
---|
189 | return VINF_SUCCESS;
|
---|
190 | }
|
---|
191 | if ((uint16_t)pCtx->rdx == 0xffff && (uint16_t)pCtx->rax == 0xffff && (uint16_t)pCtx->rcx == 0xa8c0)
|
---|
192 | {
|
---|
193 | /* QNX 2.15C: DX:AX=0xffffffff (-1), constant CX = 0xa8c0 (43200). */
|
---|
194 | /* div cx at e.g. 2220:fa5 and 2220:10a0 in memory. */
|
---|
195 | pCtx->rdx = (pCtx->rdx & 0xffff0000) | 8; /* DX = 8 */
|
---|
196 | return VINF_SUCCESS;
|
---|
197 | }
|
---|
198 | if ((uint16_t)pCtx->rax > 0x1800 && ((uint16_t)pCtx->rax & 0x3f) == 0 && (uint16_t)pCtx->rbx == 0x19)
|
---|
199 | {
|
---|
200 | /* 3C501.COM ODI driver v1.21: AX > ~0x1900 (-1), BX = 0x19 (25). */
|
---|
201 | /* AX was shifted left by 6 bits so low bits must be zero. */
|
---|
202 | /* div bl at e.g. 06b3:2f80 and offset 0x2E80 in file. */
|
---|
203 | pCtx->rax = (pCtx->rax & 0xffff0000) | 0x8c0; /* AX = 0x8c0 */
|
---|
204 | return VINF_SUCCESS;
|
---|
205 | }
|
---|
206 | if ((uint16_t)pCtx->rcx == 0x37 && ((uint16_t)pCtx->rdx > 0x34))
|
---|
207 | {
|
---|
208 | /* Turbo Pascal, classic Runtime Error 200: CX = 55, DX > ~54, AX/BX variable. */
|
---|
209 | /* div cx at variable offset in file. */
|
---|
210 | pCtx->rdx = (pCtx->rdx & 0xffff0000) | 0x30; /* DX = 48 */
|
---|
211 | return VINF_SUCCESS;
|
---|
212 | }
|
---|
213 | }
|
---|
214 |
|
---|
215 | if (pVM->gcm.s.fFixerSet & GCMFIXER_DBZ_WIN9X)
|
---|
216 | {
|
---|
217 | if (pCtx->rcx == 0 && pCtx->rdx == 0 && pCtx->rax == 0x100000)
|
---|
218 | {
|
---|
219 | /* NDIS.VXD in Win9x: EDX:EAX = 0x100000, zero ECX. */
|
---|
220 | /* Example: Windows 95 NDIS.VXD, 99,084 bytes, dated 07/11/1994, div ecx at 28:Cxxxx80B */
|
---|
221 | /* Crash fixed in Windows 98 SE. */
|
---|
222 | pCtx->rcx = 0x20000; /* Want a large divisor to shorten stalls. */
|
---|
223 | return VINF_SUCCESS;
|
---|
224 | }
|
---|
225 | if (pCtx->rcx < 3 && pCtx->rdx == 2 && pCtx->rax == 0x540be400)
|
---|
226 | {
|
---|
227 | /* SCSI.PDR, ESDI506.PDR in Win95: EDX:EAX = 0x2540be400 (10,000,000,000 decimal), ECX < 3. */
|
---|
228 | /* Example: Windows 95 SCSIPORT.PDR, 23,133 bytes, dated 07/11/1995, div ecx at 28:Cxxxx876 */
|
---|
229 | /* Example: Win95 OSR2 ESDI506.PDR, 24,390 bytes, dated 04/24/1996, div ecx at 28:Cxxxx8E3 */
|
---|
230 | /* Crash fixed in Windows 98. */
|
---|
231 | pCtx->rcx = 1000;
|
---|
232 | return VINF_SUCCESS;
|
---|
233 | }
|
---|
234 | if (pCtx->rcx == 0 && pCtx->rdx == 0x3d && pCtx->rax == 0x9000000)
|
---|
235 | {
|
---|
236 | /* Unknown source, Win9x shutdown, div ecx. */
|
---|
237 | /* GCM: Intercepted #DE at CS:RIP=0028:c0050f8e RDX:RAX=3d:9000000 (250000*1024*1024) RCX=0 RBX=c19200e8 [RBX variable] */
|
---|
238 | pCtx->rcx = 4096;
|
---|
239 | return VINF_SUCCESS;
|
---|
240 | }
|
---|
241 | }
|
---|
242 |
|
---|
243 | /* If we got this far, deliver exception to guest. */
|
---|
244 | return VERR_NOT_FOUND;
|
---|
245 | }
|
---|