2017-10-28 03:25:36 +07:00
|
|
|
/*
|
|
|
|
* Utility functions for x86 operand and address decoding
|
|
|
|
*
|
|
|
|
* Copyright (C) Intel Corporation 2017
|
|
|
|
*/
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/string.h>
|
2017-10-28 03:25:37 +07:00
|
|
|
#include <linux/ratelimit.h>
|
2017-10-28 03:25:41 +07:00
|
|
|
#include <linux/mmu_context.h>
|
|
|
|
#include <asm/desc_defs.h>
|
|
|
|
#include <asm/desc.h>
|
2017-10-28 03:25:36 +07:00
|
|
|
#include <asm/inat.h>
|
|
|
|
#include <asm/insn.h>
|
|
|
|
#include <asm/insn-eval.h>
|
2017-10-28 03:25:41 +07:00
|
|
|
#include <asm/ldt.h>
|
x86/insn-eval: Add utility functions to get segment selector
When computing a linear address and segmentation is used, we need to know
the base address of the segment involved in the computation. In most of
the cases, the segment base address will be zero as in USER_DS/USER32_DS.
However, it may be possible that a user space program defines its own
segments via a local descriptor table. In such a case, the segment base
address may not be zero. Thus, the segment base address is needed to
calculate correctly the linear address.
If running in protected mode, the segment selector to be used when
computing a linear address is determined by either any of segment override
prefixes in the instruction or inferred from the registers involved in the
computation of the effective address; in that order. Also, there are cases
when the segment override prefixes shall be ignored (i.e., code segments
are always selected by the CS segment register; string instructions always
use the ES segment register when using rDI register as operand). In long
mode, segment registers are ignored, except for FS and GS. In these two
cases, base addresses are obtained from the respective MSRs.
For clarity, this process can be split into four steps (and an equal
number of functions): determine if segment prefixes overrides can be used;
parse the segment override prefixes, and use them if found; if not found
or cannot be used, use the default segment registers associated with the
operand registers. Once the segment register to use has been identified,
read its value to obtain the segment selector.
The method to obtain the segment selector depends on several factors. In
32-bit builds, segment selectors are saved into a pt_regs structure
when switching to kernel mode. The same is also true for virtual-8086
mode. In 64-bit builds, segmentation is mostly ignored, except when
running a program in 32-bit legacy mode. In this case, CS and SS can be
obtained from pt_regs. DS, ES, FS and GS can be read directly from
the respective segment registers.
In order to identify the segment registers, a new set of #defines is
introduced. It also includes two special identifiers. One of them
indicates when the default segment register associated with instruction
operands shall be used. Another one indicates that the contents of the
segment register shall be ignored; this identifier is used when in long
mode.
Improvements-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: ricardo.neri@intel.com
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Thomas Garnier <thgarnie@google.com>
Link: https://lkml.kernel.org/r/1509135945-13762-14-git-send-email-ricardo.neri-calderon@linux.intel.com
2017-10-28 03:25:40 +07:00
|
|
|
#include <asm/vm86.h>
|
2017-10-28 03:25:36 +07:00
|
|
|
|
2017-10-28 03:25:37 +07:00
|
|
|
#undef pr_fmt
|
|
|
|
#define pr_fmt(fmt) "insn: " fmt
|
|
|
|
|
2017-10-28 03:25:36 +07:00
|
|
|
enum reg_type {
|
|
|
|
REG_TYPE_RM = 0,
|
|
|
|
REG_TYPE_INDEX,
|
|
|
|
REG_TYPE_BASE,
|
|
|
|
};
|
|
|
|
|
2017-10-28 03:25:39 +07:00
|
|
|
/**
|
|
|
|
* is_string_insn() - Determine if instruction is a string instruction
|
|
|
|
* @insn: Instruction containing the opcode to inspect
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* true if the instruction, determined by the opcode, is any of the
|
|
|
|
* string instructions as defined in the Intel Software Development manual.
|
|
|
|
* False otherwise.
|
|
|
|
*/
|
|
|
|
static bool is_string_insn(struct insn *insn)
|
|
|
|
{
|
|
|
|
insn_get_opcode(insn);
|
|
|
|
|
|
|
|
/* All string instructions have a 1-byte opcode. */
|
|
|
|
if (insn->opcode.nbytes != 1)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
switch (insn->opcode.bytes[0]) {
|
|
|
|
case 0x6c ... 0x6f: /* INS, OUTS */
|
|
|
|
case 0xa4 ... 0xa7: /* MOVS, CMPS */
|
|
|
|
case 0xaa ... 0xaf: /* STOS, LODS, SCAS */
|
|
|
|
return true;
|
|
|
|
default:
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
x86/insn-eval: Add utility functions to get segment selector
When computing a linear address and segmentation is used, we need to know
the base address of the segment involved in the computation. In most of
the cases, the segment base address will be zero as in USER_DS/USER32_DS.
However, it may be possible that a user space program defines its own
segments via a local descriptor table. In such a case, the segment base
address may not be zero. Thus, the segment base address is needed to
calculate correctly the linear address.
If running in protected mode, the segment selector to be used when
computing a linear address is determined by either any of segment override
prefixes in the instruction or inferred from the registers involved in the
computation of the effective address; in that order. Also, there are cases
when the segment override prefixes shall be ignored (i.e., code segments
are always selected by the CS segment register; string instructions always
use the ES segment register when using rDI register as operand). In long
mode, segment registers are ignored, except for FS and GS. In these two
cases, base addresses are obtained from the respective MSRs.
For clarity, this process can be split into four steps (and an equal
number of functions): determine if segment prefixes overrides can be used;
parse the segment override prefixes, and use them if found; if not found
or cannot be used, use the default segment registers associated with the
operand registers. Once the segment register to use has been identified,
read its value to obtain the segment selector.
The method to obtain the segment selector depends on several factors. In
32-bit builds, segment selectors are saved into a pt_regs structure
when switching to kernel mode. The same is also true for virtual-8086
mode. In 64-bit builds, segmentation is mostly ignored, except when
running a program in 32-bit legacy mode. In this case, CS and SS can be
obtained from pt_regs. DS, ES, FS and GS can be read directly from
the respective segment registers.
In order to identify the segment registers, a new set of #defines is
introduced. It also includes two special identifiers. One of them
indicates when the default segment register associated with instruction
operands shall be used. Another one indicates that the contents of the
segment register shall be ignored; this identifier is used when in long
mode.
Improvements-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: ricardo.neri@intel.com
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Thomas Garnier <thgarnie@google.com>
Link: https://lkml.kernel.org/r/1509135945-13762-14-git-send-email-ricardo.neri-calderon@linux.intel.com
2017-10-28 03:25:40 +07:00
|
|
|
/**
|
|
|
|
* get_seg_reg_override_idx() - obtain segment register override index
|
|
|
|
* @insn: Valid instruction with segment override prefixes
|
|
|
|
*
|
|
|
|
* Inspect the instruction prefixes in @insn and find segment overrides, if any.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* A constant identifying the segment register to use, among CS, SS, DS,
|
|
|
|
* ES, FS, or GS. INAT_SEG_REG_DEFAULT is returned if no segment override
|
|
|
|
* prefixes were found.
|
|
|
|
*
|
|
|
|
* -EINVAL in case of error.
|
|
|
|
*/
|
|
|
|
static int get_seg_reg_override_idx(struct insn *insn)
|
|
|
|
{
|
|
|
|
int idx = INAT_SEG_REG_DEFAULT;
|
|
|
|
int num_overrides = 0, i;
|
|
|
|
|
|
|
|
insn_get_prefixes(insn);
|
|
|
|
|
|
|
|
/* Look for any segment override prefixes. */
|
|
|
|
for (i = 0; i < insn->prefixes.nbytes; i++) {
|
|
|
|
insn_attr_t attr;
|
|
|
|
|
|
|
|
attr = inat_get_opcode_attribute(insn->prefixes.bytes[i]);
|
|
|
|
switch (attr) {
|
|
|
|
case INAT_MAKE_PREFIX(INAT_PFX_CS):
|
|
|
|
idx = INAT_SEG_REG_CS;
|
|
|
|
num_overrides++;
|
|
|
|
break;
|
|
|
|
case INAT_MAKE_PREFIX(INAT_PFX_SS):
|
|
|
|
idx = INAT_SEG_REG_SS;
|
|
|
|
num_overrides++;
|
|
|
|
break;
|
|
|
|
case INAT_MAKE_PREFIX(INAT_PFX_DS):
|
|
|
|
idx = INAT_SEG_REG_DS;
|
|
|
|
num_overrides++;
|
|
|
|
break;
|
|
|
|
case INAT_MAKE_PREFIX(INAT_PFX_ES):
|
|
|
|
idx = INAT_SEG_REG_ES;
|
|
|
|
num_overrides++;
|
|
|
|
break;
|
|
|
|
case INAT_MAKE_PREFIX(INAT_PFX_FS):
|
|
|
|
idx = INAT_SEG_REG_FS;
|
|
|
|
num_overrides++;
|
|
|
|
break;
|
|
|
|
case INAT_MAKE_PREFIX(INAT_PFX_GS):
|
|
|
|
idx = INAT_SEG_REG_GS;
|
|
|
|
num_overrides++;
|
|
|
|
break;
|
|
|
|
/* No default action needed. */
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* More than one segment override prefix leads to undefined behavior. */
|
|
|
|
if (num_overrides > 1)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
return idx;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* check_seg_overrides() - check if segment override prefixes are allowed
|
|
|
|
* @insn: Valid instruction with segment override prefixes
|
|
|
|
* @regoff: Operand offset, in pt_regs, for which the check is performed
|
|
|
|
*
|
|
|
|
* For a particular register used in register-indirect addressing, determine if
|
|
|
|
* segment override prefixes can be used. Specifically, no overrides are allowed
|
|
|
|
* for rDI if used with a string instruction.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* True if segment override prefixes can be used with the register indicated
|
|
|
|
* in @regoff. False if otherwise.
|
|
|
|
*/
|
|
|
|
static bool check_seg_overrides(struct insn *insn, int regoff)
|
|
|
|
{
|
|
|
|
if (regoff == offsetof(struct pt_regs, di) && is_string_insn(insn))
|
|
|
|
return false;
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* resolve_default_seg() - resolve default segment register index for an operand
|
|
|
|
* @insn: Instruction with opcode and address size. Must be valid.
|
|
|
|
* @regs: Register values as seen when entering kernel mode
|
|
|
|
* @off: Operand offset, in pt_regs, for which resolution is needed
|
|
|
|
*
|
|
|
|
* Resolve the default segment register index associated with the instruction
|
|
|
|
* operand register indicated by @off. Such index is resolved based on defaults
|
|
|
|
* described in the Intel Software Development Manual.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* If in protected mode, a constant identifying the segment register to use,
|
|
|
|
* among CS, SS, ES or DS. If in long mode, INAT_SEG_REG_IGNORE.
|
|
|
|
*
|
|
|
|
* -EINVAL in case of error.
|
|
|
|
*/
|
|
|
|
static int resolve_default_seg(struct insn *insn, struct pt_regs *regs, int off)
|
|
|
|
{
|
2019-12-19 06:11:47 +07:00
|
|
|
if (any_64bit_mode(regs))
|
x86/insn-eval: Add utility functions to get segment selector
When computing a linear address and segmentation is used, we need to know
the base address of the segment involved in the computation. In most of
the cases, the segment base address will be zero as in USER_DS/USER32_DS.
However, it may be possible that a user space program defines its own
segments via a local descriptor table. In such a case, the segment base
address may not be zero. Thus, the segment base address is needed to
calculate correctly the linear address.
If running in protected mode, the segment selector to be used when
computing a linear address is determined by either any of segment override
prefixes in the instruction or inferred from the registers involved in the
computation of the effective address; in that order. Also, there are cases
when the segment override prefixes shall be ignored (i.e., code segments
are always selected by the CS segment register; string instructions always
use the ES segment register when using rDI register as operand). In long
mode, segment registers are ignored, except for FS and GS. In these two
cases, base addresses are obtained from the respective MSRs.
For clarity, this process can be split into four steps (and an equal
number of functions): determine if segment prefixes overrides can be used;
parse the segment override prefixes, and use them if found; if not found
or cannot be used, use the default segment registers associated with the
operand registers. Once the segment register to use has been identified,
read its value to obtain the segment selector.
The method to obtain the segment selector depends on several factors. In
32-bit builds, segment selectors are saved into a pt_regs structure
when switching to kernel mode. The same is also true for virtual-8086
mode. In 64-bit builds, segmentation is mostly ignored, except when
running a program in 32-bit legacy mode. In this case, CS and SS can be
obtained from pt_regs. DS, ES, FS and GS can be read directly from
the respective segment registers.
In order to identify the segment registers, a new set of #defines is
introduced. It also includes two special identifiers. One of them
indicates when the default segment register associated with instruction
operands shall be used. Another one indicates that the contents of the
segment register shall be ignored; this identifier is used when in long
mode.
Improvements-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: ricardo.neri@intel.com
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Thomas Garnier <thgarnie@google.com>
Link: https://lkml.kernel.org/r/1509135945-13762-14-git-send-email-ricardo.neri-calderon@linux.intel.com
2017-10-28 03:25:40 +07:00
|
|
|
return INAT_SEG_REG_IGNORE;
|
|
|
|
/*
|
|
|
|
* Resolve the default segment register as described in Section 3.7.4
|
|
|
|
* of the Intel Software Development Manual Vol. 1:
|
|
|
|
*
|
|
|
|
* + DS for all references involving r[ABCD]X, and rSI.
|
|
|
|
* + If used in a string instruction, ES for rDI. Otherwise, DS.
|
|
|
|
* + AX, CX and DX are not valid register operands in 16-bit address
|
|
|
|
* encodings but are valid for 32-bit and 64-bit encodings.
|
|
|
|
* + -EDOM is reserved to identify for cases in which no register
|
|
|
|
* is used (i.e., displacement-only addressing). Use DS.
|
|
|
|
* + SS for rSP or rBP.
|
|
|
|
* + CS for rIP.
|
|
|
|
*/
|
|
|
|
|
|
|
|
switch (off) {
|
|
|
|
case offsetof(struct pt_regs, ax):
|
|
|
|
case offsetof(struct pt_regs, cx):
|
|
|
|
case offsetof(struct pt_regs, dx):
|
|
|
|
/* Need insn to verify address size. */
|
|
|
|
if (insn->addr_bytes == 2)
|
|
|
|
return -EINVAL;
|
|
|
|
|
2019-01-26 03:55:20 +07:00
|
|
|
/* fall through */
|
|
|
|
|
x86/insn-eval: Add utility functions to get segment selector
When computing a linear address and segmentation is used, we need to know
the base address of the segment involved in the computation. In most of
the cases, the segment base address will be zero as in USER_DS/USER32_DS.
However, it may be possible that a user space program defines its own
segments via a local descriptor table. In such a case, the segment base
address may not be zero. Thus, the segment base address is needed to
calculate correctly the linear address.
If running in protected mode, the segment selector to be used when
computing a linear address is determined by either any of segment override
prefixes in the instruction or inferred from the registers involved in the
computation of the effective address; in that order. Also, there are cases
when the segment override prefixes shall be ignored (i.e., code segments
are always selected by the CS segment register; string instructions always
use the ES segment register when using rDI register as operand). In long
mode, segment registers are ignored, except for FS and GS. In these two
cases, base addresses are obtained from the respective MSRs.
For clarity, this process can be split into four steps (and an equal
number of functions): determine if segment prefixes overrides can be used;
parse the segment override prefixes, and use them if found; if not found
or cannot be used, use the default segment registers associated with the
operand registers. Once the segment register to use has been identified,
read its value to obtain the segment selector.
The method to obtain the segment selector depends on several factors. In
32-bit builds, segment selectors are saved into a pt_regs structure
when switching to kernel mode. The same is also true for virtual-8086
mode. In 64-bit builds, segmentation is mostly ignored, except when
running a program in 32-bit legacy mode. In this case, CS and SS can be
obtained from pt_regs. DS, ES, FS and GS can be read directly from
the respective segment registers.
In order to identify the segment registers, a new set of #defines is
introduced. It also includes two special identifiers. One of them
indicates when the default segment register associated with instruction
operands shall be used. Another one indicates that the contents of the
segment register shall be ignored; this identifier is used when in long
mode.
Improvements-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: ricardo.neri@intel.com
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Thomas Garnier <thgarnie@google.com>
Link: https://lkml.kernel.org/r/1509135945-13762-14-git-send-email-ricardo.neri-calderon@linux.intel.com
2017-10-28 03:25:40 +07:00
|
|
|
case -EDOM:
|
|
|
|
case offsetof(struct pt_regs, bx):
|
|
|
|
case offsetof(struct pt_regs, si):
|
|
|
|
return INAT_SEG_REG_DS;
|
|
|
|
|
|
|
|
case offsetof(struct pt_regs, di):
|
|
|
|
if (is_string_insn(insn))
|
|
|
|
return INAT_SEG_REG_ES;
|
|
|
|
return INAT_SEG_REG_DS;
|
|
|
|
|
|
|
|
case offsetof(struct pt_regs, bp):
|
|
|
|
case offsetof(struct pt_regs, sp):
|
|
|
|
return INAT_SEG_REG_SS;
|
|
|
|
|
|
|
|
case offsetof(struct pt_regs, ip):
|
|
|
|
return INAT_SEG_REG_CS;
|
|
|
|
|
|
|
|
default:
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* resolve_seg_reg() - obtain segment register index
|
|
|
|
* @insn: Instruction with operands
|
|
|
|
* @regs: Register values as seen when entering kernel mode
|
|
|
|
* @regoff: Operand offset, in pt_regs, used to deterimine segment register
|
|
|
|
*
|
|
|
|
* Determine the segment register associated with the operands and, if
|
|
|
|
* applicable, prefixes and the instruction pointed by @insn.
|
|
|
|
*
|
|
|
|
* The segment register associated to an operand used in register-indirect
|
|
|
|
* addressing depends on:
|
|
|
|
*
|
|
|
|
* a) Whether running in long mode (in such a case segments are ignored, except
|
|
|
|
* if FS or GS are used).
|
|
|
|
*
|
|
|
|
* b) Whether segment override prefixes can be used. Certain instructions and
|
|
|
|
* registers do not allow override prefixes.
|
|
|
|
*
|
|
|
|
* c) Whether segment overrides prefixes are found in the instruction prefixes.
|
|
|
|
*
|
|
|
|
* d) If there are not segment override prefixes or they cannot be used, the
|
|
|
|
* default segment register associated with the operand register is used.
|
|
|
|
*
|
|
|
|
* The function checks first if segment override prefixes can be used with the
|
|
|
|
* operand indicated by @regoff. If allowed, obtain such overridden segment
|
|
|
|
* register index. Lastly, if not prefixes were found or cannot be used, resolve
|
|
|
|
* the segment register index to use based on the defaults described in the
|
|
|
|
* Intel documentation. In long mode, all segment register indexes will be
|
|
|
|
* ignored, except if overrides were found for FS or GS. All these operations
|
|
|
|
* are done using helper functions.
|
|
|
|
*
|
|
|
|
* The operand register, @regoff, is represented as the offset from the base of
|
|
|
|
* pt_regs.
|
|
|
|
*
|
|
|
|
* As stated, the main use of this function is to determine the segment register
|
|
|
|
* index based on the instruction, its operands and prefixes. Hence, @insn
|
|
|
|
* must be valid. However, if @regoff indicates rIP, we don't need to inspect
|
|
|
|
* @insn at all as in this case CS is used in all cases. This case is checked
|
|
|
|
* before proceeding further.
|
|
|
|
*
|
|
|
|
* Please note that this function does not return the value in the segment
|
|
|
|
* register (i.e., the segment selector) but our defined index. The segment
|
|
|
|
* selector needs to be obtained using get_segment_selector() and passing the
|
|
|
|
* segment register index resolved by this function.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* An index identifying the segment register to use, among CS, SS, DS,
|
|
|
|
* ES, FS, or GS. INAT_SEG_REG_IGNORE is returned if running in long mode.
|
|
|
|
*
|
|
|
|
* -EINVAL in case of error.
|
|
|
|
*/
|
|
|
|
static int resolve_seg_reg(struct insn *insn, struct pt_regs *regs, int regoff)
|
|
|
|
{
|
|
|
|
int idx;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* In the unlikely event of having to resolve the segment register
|
|
|
|
* index for rIP, do it first. Segment override prefixes should not
|
|
|
|
* be used. Hence, it is not necessary to inspect the instruction,
|
|
|
|
* which may be invalid at this point.
|
|
|
|
*/
|
|
|
|
if (regoff == offsetof(struct pt_regs, ip)) {
|
2019-12-19 06:11:47 +07:00
|
|
|
if (any_64bit_mode(regs))
|
x86/insn-eval: Add utility functions to get segment selector
When computing a linear address and segmentation is used, we need to know
the base address of the segment involved in the computation. In most of
the cases, the segment base address will be zero as in USER_DS/USER32_DS.
However, it may be possible that a user space program defines its own
segments via a local descriptor table. In such a case, the segment base
address may not be zero. Thus, the segment base address is needed to
calculate correctly the linear address.
If running in protected mode, the segment selector to be used when
computing a linear address is determined by either any of segment override
prefixes in the instruction or inferred from the registers involved in the
computation of the effective address; in that order. Also, there are cases
when the segment override prefixes shall be ignored (i.e., code segments
are always selected by the CS segment register; string instructions always
use the ES segment register when using rDI register as operand). In long
mode, segment registers are ignored, except for FS and GS. In these two
cases, base addresses are obtained from the respective MSRs.
For clarity, this process can be split into four steps (and an equal
number of functions): determine if segment prefixes overrides can be used;
parse the segment override prefixes, and use them if found; if not found
or cannot be used, use the default segment registers associated with the
operand registers. Once the segment register to use has been identified,
read its value to obtain the segment selector.
The method to obtain the segment selector depends on several factors. In
32-bit builds, segment selectors are saved into a pt_regs structure
when switching to kernel mode. The same is also true for virtual-8086
mode. In 64-bit builds, segmentation is mostly ignored, except when
running a program in 32-bit legacy mode. In this case, CS and SS can be
obtained from pt_regs. DS, ES, FS and GS can be read directly from
the respective segment registers.
In order to identify the segment registers, a new set of #defines is
introduced. It also includes two special identifiers. One of them
indicates when the default segment register associated with instruction
operands shall be used. Another one indicates that the contents of the
segment register shall be ignored; this identifier is used when in long
mode.
Improvements-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: ricardo.neri@intel.com
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Thomas Garnier <thgarnie@google.com>
Link: https://lkml.kernel.org/r/1509135945-13762-14-git-send-email-ricardo.neri-calderon@linux.intel.com
2017-10-28 03:25:40 +07:00
|
|
|
return INAT_SEG_REG_IGNORE;
|
|
|
|
else
|
|
|
|
return INAT_SEG_REG_CS;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!insn)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (!check_seg_overrides(insn, regoff))
|
|
|
|
return resolve_default_seg(insn, regs, regoff);
|
|
|
|
|
|
|
|
idx = get_seg_reg_override_idx(insn);
|
|
|
|
if (idx < 0)
|
|
|
|
return idx;
|
|
|
|
|
|
|
|
if (idx == INAT_SEG_REG_DEFAULT)
|
|
|
|
return resolve_default_seg(insn, regs, regoff);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* In long mode, segment override prefixes are ignored, except for
|
|
|
|
* overrides for FS and GS.
|
|
|
|
*/
|
2019-12-19 06:11:47 +07:00
|
|
|
if (any_64bit_mode(regs)) {
|
x86/insn-eval: Add utility functions to get segment selector
When computing a linear address and segmentation is used, we need to know
the base address of the segment involved in the computation. In most of
the cases, the segment base address will be zero as in USER_DS/USER32_DS.
However, it may be possible that a user space program defines its own
segments via a local descriptor table. In such a case, the segment base
address may not be zero. Thus, the segment base address is needed to
calculate correctly the linear address.
If running in protected mode, the segment selector to be used when
computing a linear address is determined by either any of segment override
prefixes in the instruction or inferred from the registers involved in the
computation of the effective address; in that order. Also, there are cases
when the segment override prefixes shall be ignored (i.e., code segments
are always selected by the CS segment register; string instructions always
use the ES segment register when using rDI register as operand). In long
mode, segment registers are ignored, except for FS and GS. In these two
cases, base addresses are obtained from the respective MSRs.
For clarity, this process can be split into four steps (and an equal
number of functions): determine if segment prefixes overrides can be used;
parse the segment override prefixes, and use them if found; if not found
or cannot be used, use the default segment registers associated with the
operand registers. Once the segment register to use has been identified,
read its value to obtain the segment selector.
The method to obtain the segment selector depends on several factors. In
32-bit builds, segment selectors are saved into a pt_regs structure
when switching to kernel mode. The same is also true for virtual-8086
mode. In 64-bit builds, segmentation is mostly ignored, except when
running a program in 32-bit legacy mode. In this case, CS and SS can be
obtained from pt_regs. DS, ES, FS and GS can be read directly from
the respective segment registers.
In order to identify the segment registers, a new set of #defines is
introduced. It also includes two special identifiers. One of them
indicates when the default segment register associated with instruction
operands shall be used. Another one indicates that the contents of the
segment register shall be ignored; this identifier is used when in long
mode.
Improvements-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: ricardo.neri@intel.com
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Thomas Garnier <thgarnie@google.com>
Link: https://lkml.kernel.org/r/1509135945-13762-14-git-send-email-ricardo.neri-calderon@linux.intel.com
2017-10-28 03:25:40 +07:00
|
|
|
if (idx != INAT_SEG_REG_FS &&
|
|
|
|
idx != INAT_SEG_REG_GS)
|
|
|
|
idx = INAT_SEG_REG_IGNORE;
|
|
|
|
}
|
|
|
|
|
|
|
|
return idx;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* get_segment_selector() - obtain segment selector
|
|
|
|
* @regs: Register values as seen when entering kernel mode
|
|
|
|
* @seg_reg_idx: Segment register index to use
|
|
|
|
*
|
|
|
|
* Obtain the segment selector from any of the CS, SS, DS, ES, FS, GS segment
|
|
|
|
* registers. In CONFIG_X86_32, the segment is obtained from either pt_regs or
|
|
|
|
* kernel_vm86_regs as applicable. In CONFIG_X86_64, CS and SS are obtained
|
|
|
|
* from pt_regs. DS, ES, FS and GS are obtained by reading the actual CPU
|
|
|
|
* registers. This done for only for completeness as in CONFIG_X86_64 segment
|
|
|
|
* registers are ignored.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* Value of the segment selector, including null when running in
|
|
|
|
* long mode.
|
|
|
|
*
|
|
|
|
* -EINVAL on error.
|
|
|
|
*/
|
|
|
|
static short get_segment_selector(struct pt_regs *regs, int seg_reg_idx)
|
|
|
|
{
|
|
|
|
#ifdef CONFIG_X86_64
|
|
|
|
unsigned short sel;
|
|
|
|
|
|
|
|
switch (seg_reg_idx) {
|
|
|
|
case INAT_SEG_REG_IGNORE:
|
|
|
|
return 0;
|
|
|
|
case INAT_SEG_REG_CS:
|
|
|
|
return (unsigned short)(regs->cs & 0xffff);
|
|
|
|
case INAT_SEG_REG_SS:
|
|
|
|
return (unsigned short)(regs->ss & 0xffff);
|
|
|
|
case INAT_SEG_REG_DS:
|
|
|
|
savesegment(ds, sel);
|
|
|
|
return sel;
|
|
|
|
case INAT_SEG_REG_ES:
|
|
|
|
savesegment(es, sel);
|
|
|
|
return sel;
|
|
|
|
case INAT_SEG_REG_FS:
|
|
|
|
savesegment(fs, sel);
|
|
|
|
return sel;
|
|
|
|
case INAT_SEG_REG_GS:
|
|
|
|
savesegment(gs, sel);
|
|
|
|
return sel;
|
|
|
|
default:
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
#else /* CONFIG_X86_32 */
|
|
|
|
struct kernel_vm86_regs *vm86regs = (struct kernel_vm86_regs *)regs;
|
|
|
|
|
|
|
|
if (v8086_mode(regs)) {
|
|
|
|
switch (seg_reg_idx) {
|
|
|
|
case INAT_SEG_REG_CS:
|
|
|
|
return (unsigned short)(regs->cs & 0xffff);
|
|
|
|
case INAT_SEG_REG_SS:
|
|
|
|
return (unsigned short)(regs->ss & 0xffff);
|
|
|
|
case INAT_SEG_REG_DS:
|
|
|
|
return vm86regs->ds;
|
|
|
|
case INAT_SEG_REG_ES:
|
|
|
|
return vm86regs->es;
|
|
|
|
case INAT_SEG_REG_FS:
|
|
|
|
return vm86regs->fs;
|
|
|
|
case INAT_SEG_REG_GS:
|
|
|
|
return vm86regs->gs;
|
|
|
|
case INAT_SEG_REG_IGNORE:
|
|
|
|
/* fall through */
|
|
|
|
default:
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
switch (seg_reg_idx) {
|
|
|
|
case INAT_SEG_REG_CS:
|
|
|
|
return (unsigned short)(regs->cs & 0xffff);
|
|
|
|
case INAT_SEG_REG_SS:
|
|
|
|
return (unsigned short)(regs->ss & 0xffff);
|
|
|
|
case INAT_SEG_REG_DS:
|
|
|
|
return (unsigned short)(regs->ds & 0xffff);
|
|
|
|
case INAT_SEG_REG_ES:
|
|
|
|
return (unsigned short)(regs->es & 0xffff);
|
|
|
|
case INAT_SEG_REG_FS:
|
|
|
|
return (unsigned short)(regs->fs & 0xffff);
|
|
|
|
case INAT_SEG_REG_GS:
|
|
|
|
/*
|
|
|
|
* GS may or may not be in regs as per CONFIG_X86_32_LAZY_GS.
|
|
|
|
* The macro below takes care of both cases.
|
|
|
|
*/
|
|
|
|
return get_user_gs(regs);
|
|
|
|
case INAT_SEG_REG_IGNORE:
|
|
|
|
/* fall through */
|
|
|
|
default:
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
#endif /* CONFIG_X86_64 */
|
|
|
|
}
|
|
|
|
|
2017-10-28 03:25:36 +07:00
|
|
|
static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
|
|
|
|
enum reg_type type)
|
|
|
|
{
|
|
|
|
int regno = 0;
|
|
|
|
|
|
|
|
static const int regoff[] = {
|
|
|
|
offsetof(struct pt_regs, ax),
|
|
|
|
offsetof(struct pt_regs, cx),
|
|
|
|
offsetof(struct pt_regs, dx),
|
|
|
|
offsetof(struct pt_regs, bx),
|
|
|
|
offsetof(struct pt_regs, sp),
|
|
|
|
offsetof(struct pt_regs, bp),
|
|
|
|
offsetof(struct pt_regs, si),
|
|
|
|
offsetof(struct pt_regs, di),
|
|
|
|
#ifdef CONFIG_X86_64
|
|
|
|
offsetof(struct pt_regs, r8),
|
|
|
|
offsetof(struct pt_regs, r9),
|
|
|
|
offsetof(struct pt_regs, r10),
|
|
|
|
offsetof(struct pt_regs, r11),
|
|
|
|
offsetof(struct pt_regs, r12),
|
|
|
|
offsetof(struct pt_regs, r13),
|
|
|
|
offsetof(struct pt_regs, r14),
|
|
|
|
offsetof(struct pt_regs, r15),
|
|
|
|
#endif
|
|
|
|
};
|
|
|
|
int nr_registers = ARRAY_SIZE(regoff);
|
|
|
|
/*
|
|
|
|
* Don't possibly decode a 32-bit instructions as
|
|
|
|
* reading a 64-bit-only register.
|
|
|
|
*/
|
|
|
|
if (IS_ENABLED(CONFIG_X86_64) && !insn->x86_64)
|
|
|
|
nr_registers -= 8;
|
|
|
|
|
|
|
|
switch (type) {
|
|
|
|
case REG_TYPE_RM:
|
|
|
|
regno = X86_MODRM_RM(insn->modrm.value);
|
2017-10-28 03:25:44 +07:00
|
|
|
|
|
|
|
/*
|
|
|
|
* ModRM.mod == 0 and ModRM.rm == 5 means a 32-bit displacement
|
|
|
|
* follows the ModRM byte.
|
|
|
|
*/
|
|
|
|
if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
|
|
|
|
return -EDOM;
|
|
|
|
|
2017-10-28 03:25:36 +07:00
|
|
|
if (X86_REX_B(insn->rex_prefix.value))
|
|
|
|
regno += 8;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case REG_TYPE_INDEX:
|
|
|
|
regno = X86_SIB_INDEX(insn->sib.value);
|
|
|
|
if (X86_REX_X(insn->rex_prefix.value))
|
|
|
|
regno += 8;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If ModRM.mod != 3 and SIB.index = 4 the scale*index
|
|
|
|
* portion of the address computation is null. This is
|
|
|
|
* true only if REX.X is 0. In such a case, the SIB index
|
|
|
|
* is used in the address computation.
|
|
|
|
*/
|
|
|
|
if (X86_MODRM_MOD(insn->modrm.value) != 3 && regno == 4)
|
|
|
|
return -EDOM;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case REG_TYPE_BASE:
|
|
|
|
regno = X86_SIB_BASE(insn->sib.value);
|
|
|
|
/*
|
|
|
|
* If ModRM.mod is 0 and SIB.base == 5, the base of the
|
|
|
|
* register-indirect addressing is 0. In this case, a
|
|
|
|
* 32-bit displacement follows the SIB byte.
|
|
|
|
*/
|
|
|
|
if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
|
|
|
|
return -EDOM;
|
|
|
|
|
|
|
|
if (X86_REX_B(insn->rex_prefix.value))
|
|
|
|
regno += 8;
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
2017-10-28 03:25:37 +07:00
|
|
|
pr_err_ratelimited("invalid register type: %d\n", type);
|
|
|
|
return -EINVAL;
|
2017-10-28 03:25:36 +07:00
|
|
|
}
|
|
|
|
|
|
|
|
if (regno >= nr_registers) {
|
|
|
|
WARN_ONCE(1, "decoded an instruction with an invalid register");
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
return regoff[regno];
|
|
|
|
}
|
|
|
|
|
2017-11-06 09:27:50 +07:00
|
|
|
/**
|
|
|
|
* get_reg_offset_16() - Obtain offset of register indicated by instruction
|
|
|
|
* @insn: Instruction containing ModRM byte
|
|
|
|
* @regs: Register values as seen when entering kernel mode
|
|
|
|
* @offs1: Offset of the first operand register
|
|
|
|
* @offs2: Offset of the second opeand register, if applicable
|
|
|
|
*
|
|
|
|
* Obtain the offset, in pt_regs, of the registers indicated by the ModRM byte
|
|
|
|
* in @insn. This function is to be used with 16-bit address encodings. The
|
|
|
|
* @offs1 and @offs2 will be written with the offset of the two registers
|
|
|
|
* indicated by the instruction. In cases where any of the registers is not
|
|
|
|
* referenced by the instruction, the value will be set to -EDOM.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* 0 on success, -EINVAL on error.
|
|
|
|
*/
|
|
|
|
static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs,
|
|
|
|
int *offs1, int *offs2)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* 16-bit addressing can use one or two registers. Specifics of
|
|
|
|
* encodings are given in Table 2-1. "16-Bit Addressing Forms with the
|
|
|
|
* ModR/M Byte" of the Intel Software Development Manual.
|
|
|
|
*/
|
|
|
|
static const int regoff1[] = {
|
|
|
|
offsetof(struct pt_regs, bx),
|
|
|
|
offsetof(struct pt_regs, bx),
|
|
|
|
offsetof(struct pt_regs, bp),
|
|
|
|
offsetof(struct pt_regs, bp),
|
|
|
|
offsetof(struct pt_regs, si),
|
|
|
|
offsetof(struct pt_regs, di),
|
|
|
|
offsetof(struct pt_regs, bp),
|
|
|
|
offsetof(struct pt_regs, bx),
|
|
|
|
};
|
|
|
|
|
|
|
|
static const int regoff2[] = {
|
|
|
|
offsetof(struct pt_regs, si),
|
|
|
|
offsetof(struct pt_regs, di),
|
|
|
|
offsetof(struct pt_regs, si),
|
|
|
|
offsetof(struct pt_regs, di),
|
|
|
|
-EDOM,
|
|
|
|
-EDOM,
|
|
|
|
-EDOM,
|
|
|
|
-EDOM,
|
|
|
|
};
|
|
|
|
|
|
|
|
if (!offs1 || !offs2)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
/* Operand is a register, use the generic function. */
|
|
|
|
if (X86_MODRM_MOD(insn->modrm.value) == 3) {
|
|
|
|
*offs1 = insn_get_modrm_rm_off(insn, regs);
|
|
|
|
*offs2 = -EDOM;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
*offs1 = regoff1[X86_MODRM_RM(insn->modrm.value)];
|
|
|
|
*offs2 = regoff2[X86_MODRM_RM(insn->modrm.value)];
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If ModRM.mod is 0 and ModRM.rm is 110b, then we use displacement-
|
|
|
|
* only addressing. This means that no registers are involved in
|
|
|
|
* computing the effective address. Thus, ensure that the first
|
|
|
|
* register offset is invalild. The second register offset is already
|
|
|
|
* invalid under the aforementioned conditions.
|
|
|
|
*/
|
|
|
|
if ((X86_MODRM_MOD(insn->modrm.value) == 0) &&
|
|
|
|
(X86_MODRM_RM(insn->modrm.value) == 6))
|
|
|
|
*offs1 = -EDOM;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2017-10-28 03:25:41 +07:00
|
|
|
/**
|
2019-06-02 08:15:58 +07:00
|
|
|
* get_desc() - Obtain contents of a segment descriptor
|
|
|
|
* @out: Segment descriptor contents on success
|
2017-10-28 03:25:41 +07:00
|
|
|
* @sel: Segment selector
|
|
|
|
*
|
|
|
|
* Given a segment selector, obtain a pointer to the segment descriptor.
|
|
|
|
* Both global and local descriptor tables are supported.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
2019-06-02 08:15:58 +07:00
|
|
|
* True on success, false on failure.
|
2017-10-28 03:25:41 +07:00
|
|
|
*
|
|
|
|
* NULL on error.
|
|
|
|
*/
|
2019-06-02 08:15:58 +07:00
|
|
|
static bool get_desc(struct desc_struct *out, unsigned short sel)
|
2017-10-28 03:25:41 +07:00
|
|
|
{
|
|
|
|
struct desc_ptr gdt_desc = {0, 0};
|
|
|
|
unsigned long desc_base;
|
|
|
|
|
|
|
|
#ifdef CONFIG_MODIFY_LDT_SYSCALL
|
|
|
|
if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) {
|
2019-06-02 08:15:58 +07:00
|
|
|
bool success = false;
|
2017-10-28 03:25:41 +07:00
|
|
|
struct ldt_struct *ldt;
|
|
|
|
|
|
|
|
/* Bits [15:3] contain the index of the desired entry. */
|
|
|
|
sel >>= 3;
|
|
|
|
|
|
|
|
mutex_lock(¤t->active_mm->context.lock);
|
|
|
|
ldt = current->active_mm->context.ldt;
|
2019-06-02 08:15:58 +07:00
|
|
|
if (ldt && sel < ldt->nr_entries) {
|
|
|
|
*out = ldt->entries[sel];
|
|
|
|
success = true;
|
|
|
|
}
|
2017-10-28 03:25:41 +07:00
|
|
|
|
|
|
|
mutex_unlock(¤t->active_mm->context.lock);
|
|
|
|
|
2019-06-02 08:15:58 +07:00
|
|
|
return success;
|
2017-10-28 03:25:41 +07:00
|
|
|
}
|
|
|
|
#endif
|
|
|
|
native_store_gdt(&gdt_desc);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Segment descriptors have a size of 8 bytes. Thus, the index is
|
|
|
|
* multiplied by 8 to obtain the memory offset of the desired descriptor
|
|
|
|
* from the base of the GDT. As bits [15:3] of the segment selector
|
|
|
|
* contain the index, it can be regarded as multiplied by 8 already.
|
|
|
|
* All that remains is to clear bits [2:0].
|
|
|
|
*/
|
|
|
|
desc_base = sel & ~(SEGMENT_RPL_MASK | SEGMENT_TI_MASK);
|
|
|
|
|
|
|
|
if (desc_base > gdt_desc.size)
|
2019-06-02 08:15:58 +07:00
|
|
|
return false;
|
2017-10-28 03:25:41 +07:00
|
|
|
|
2019-06-02 08:15:58 +07:00
|
|
|
*out = *(struct desc_struct *)(gdt_desc.address + desc_base);
|
|
|
|
return true;
|
2017-10-28 03:25:41 +07:00
|
|
|
}
|
|
|
|
|
2017-10-28 03:25:42 +07:00
|
|
|
/**
|
|
|
|
* insn_get_seg_base() - Obtain base address of segment descriptor.
|
|
|
|
* @regs: Register values as seen when entering kernel mode
|
|
|
|
* @seg_reg_idx: Index of the segment register pointing to seg descriptor
|
|
|
|
*
|
|
|
|
* Obtain the base address of the segment as indicated by the segment descriptor
|
|
|
|
* pointed by the segment selector. The segment selector is obtained from the
|
|
|
|
* input segment register index @seg_reg_idx.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* In protected mode, base address of the segment. Zero in long mode,
|
|
|
|
* except when FS or GS are used. In virtual-8086 mode, the segment
|
|
|
|
* selector shifted 4 bits to the right.
|
|
|
|
*
|
|
|
|
* -1L in case of error.
|
|
|
|
*/
|
|
|
|
unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx)
|
|
|
|
{
|
2019-06-02 08:15:58 +07:00
|
|
|
struct desc_struct desc;
|
2017-10-28 03:25:42 +07:00
|
|
|
short sel;
|
|
|
|
|
|
|
|
sel = get_segment_selector(regs, seg_reg_idx);
|
|
|
|
if (sel < 0)
|
|
|
|
return -1L;
|
|
|
|
|
|
|
|
if (v8086_mode(regs))
|
|
|
|
/*
|
|
|
|
* Base is simply the segment selector shifted 4
|
|
|
|
* bits to the right.
|
|
|
|
*/
|
|
|
|
return (unsigned long)(sel << 4);
|
|
|
|
|
2019-12-19 06:11:47 +07:00
|
|
|
if (any_64bit_mode(regs)) {
|
2017-10-28 03:25:42 +07:00
|
|
|
/*
|
|
|
|
* Only FS or GS will have a base address, the rest of
|
|
|
|
* the segments' bases are forced to 0.
|
|
|
|
*/
|
|
|
|
unsigned long base;
|
|
|
|
|
2019-12-19 06:11:47 +07:00
|
|
|
if (seg_reg_idx == INAT_SEG_REG_FS) {
|
2017-10-28 03:25:42 +07:00
|
|
|
rdmsrl(MSR_FS_BASE, base);
|
2019-12-19 06:11:47 +07:00
|
|
|
} else if (seg_reg_idx == INAT_SEG_REG_GS) {
|
2017-10-28 03:25:42 +07:00
|
|
|
/*
|
|
|
|
* swapgs was called at the kernel entry point. Thus,
|
|
|
|
* MSR_KERNEL_GS_BASE will have the user-space GS base.
|
|
|
|
*/
|
2019-12-19 06:11:47 +07:00
|
|
|
if (user_mode(regs))
|
|
|
|
rdmsrl(MSR_KERNEL_GS_BASE, base);
|
|
|
|
else
|
|
|
|
rdmsrl(MSR_GS_BASE, base);
|
|
|
|
} else {
|
2017-10-28 03:25:42 +07:00
|
|
|
base = 0;
|
2019-12-19 06:11:47 +07:00
|
|
|
}
|
2017-10-28 03:25:42 +07:00
|
|
|
return base;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* In protected mode the segment selector cannot be null. */
|
|
|
|
if (!sel)
|
|
|
|
return -1L;
|
|
|
|
|
2019-06-02 08:15:58 +07:00
|
|
|
if (!get_desc(&desc, sel))
|
2017-10-28 03:25:42 +07:00
|
|
|
return -1L;
|
|
|
|
|
2019-06-02 08:15:58 +07:00
|
|
|
return get_desc_base(&desc);
|
2017-10-28 03:25:42 +07:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* get_seg_limit() - Obtain the limit of a segment descriptor
|
|
|
|
* @regs: Register values as seen when entering kernel mode
|
|
|
|
* @seg_reg_idx: Index of the segment register pointing to seg descriptor
|
|
|
|
*
|
|
|
|
* Obtain the limit of the segment as indicated by the segment descriptor
|
|
|
|
* pointed by the segment selector. The segment selector is obtained from the
|
|
|
|
* input segment register index @seg_reg_idx.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* In protected mode, the limit of the segment descriptor in bytes.
|
|
|
|
* In long mode and virtual-8086 mode, segment limits are not enforced. Thus,
|
|
|
|
* limit is returned as -1L to imply a limit-less segment.
|
|
|
|
*
|
|
|
|
* Zero is returned on error.
|
|
|
|
*/
|
|
|
|
static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)
|
|
|
|
{
|
2019-06-02 08:15:58 +07:00
|
|
|
struct desc_struct desc;
|
2017-10-28 03:25:42 +07:00
|
|
|
unsigned long limit;
|
|
|
|
short sel;
|
|
|
|
|
|
|
|
sel = get_segment_selector(regs, seg_reg_idx);
|
|
|
|
if (sel < 0)
|
|
|
|
return 0;
|
|
|
|
|
2019-12-19 06:11:47 +07:00
|
|
|
if (any_64bit_mode(regs) || v8086_mode(regs))
|
2017-10-28 03:25:42 +07:00
|
|
|
return -1L;
|
|
|
|
|
|
|
|
if (!sel)
|
|
|
|
return 0;
|
|
|
|
|
2019-06-02 08:15:58 +07:00
|
|
|
if (!get_desc(&desc, sel))
|
2017-10-28 03:25:42 +07:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If the granularity bit is set, the limit is given in multiples
|
|
|
|
* of 4096. This also means that the 12 least significant bits are
|
|
|
|
* not tested when checking the segment limits. In practice,
|
|
|
|
* this means that the segment ends in (limit << 12) + 0xfff.
|
|
|
|
*/
|
2019-06-02 08:15:58 +07:00
|
|
|
limit = get_desc_limit(&desc);
|
|
|
|
if (desc.g)
|
2017-10-28 03:25:42 +07:00
|
|
|
limit = (limit << 12) + 0xfff;
|
|
|
|
|
|
|
|
return limit;
|
|
|
|
}
|
|
|
|
|
2017-10-28 03:25:43 +07:00
|
|
|
/**
|
|
|
|
* insn_get_code_seg_params() - Obtain code segment parameters
|
|
|
|
* @regs: Structure with register values as seen when entering kernel mode
|
|
|
|
*
|
|
|
|
* Obtain address and operand sizes of the code segment. It is obtained from the
|
|
|
|
* selector contained in the CS register in regs. In protected mode, the default
|
|
|
|
* address is determined by inspecting the L and D bits of the segment
|
|
|
|
* descriptor. In virtual-8086 mode, the default is always two bytes for both
|
|
|
|
* address and operand sizes.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
2017-11-23 16:19:51 +07:00
|
|
|
* An int containing ORed-in default parameters on success.
|
2017-10-28 03:25:43 +07:00
|
|
|
*
|
|
|
|
* -EINVAL on error.
|
|
|
|
*/
|
2017-11-23 16:19:51 +07:00
|
|
|
int insn_get_code_seg_params(struct pt_regs *regs)
|
2017-10-28 03:25:43 +07:00
|
|
|
{
|
2019-06-02 08:15:58 +07:00
|
|
|
struct desc_struct desc;
|
2017-10-28 03:25:43 +07:00
|
|
|
short sel;
|
|
|
|
|
|
|
|
if (v8086_mode(regs))
|
|
|
|
/* Address and operand size are both 16-bit. */
|
|
|
|
return INSN_CODE_SEG_PARAMS(2, 2);
|
|
|
|
|
|
|
|
sel = get_segment_selector(regs, INAT_SEG_REG_CS);
|
|
|
|
if (sel < 0)
|
|
|
|
return sel;
|
|
|
|
|
2019-06-02 08:15:58 +07:00
|
|
|
if (!get_desc(&desc, sel))
|
2017-10-28 03:25:43 +07:00
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The most significant byte of the Type field of the segment descriptor
|
|
|
|
* determines whether a segment contains data or code. If this is a data
|
|
|
|
* segment, return error.
|
|
|
|
*/
|
2019-06-02 08:15:58 +07:00
|
|
|
if (!(desc.type & BIT(3)))
|
2017-10-28 03:25:43 +07:00
|
|
|
return -EINVAL;
|
|
|
|
|
2019-06-02 08:15:58 +07:00
|
|
|
switch ((desc.l << 1) | desc.d) {
|
2017-10-28 03:25:43 +07:00
|
|
|
case 0: /*
|
|
|
|
* Legacy mode. CS.L=0, CS.D=0. Address and operand size are
|
|
|
|
* both 16-bit.
|
|
|
|
*/
|
|
|
|
return INSN_CODE_SEG_PARAMS(2, 2);
|
|
|
|
case 1: /*
|
|
|
|
* Legacy mode. CS.L=0, CS.D=1. Address and operand size are
|
|
|
|
* both 32-bit.
|
|
|
|
*/
|
|
|
|
return INSN_CODE_SEG_PARAMS(4, 4);
|
|
|
|
case 2: /*
|
|
|
|
* IA-32e 64-bit mode. CS.L=1, CS.D=0. Address size is 64-bit;
|
|
|
|
* operand size is 32-bit.
|
|
|
|
*/
|
|
|
|
return INSN_CODE_SEG_PARAMS(4, 8);
|
|
|
|
case 3: /* Invalid setting. CS.L=1, CS.D=1 */
|
|
|
|
/* fall through */
|
|
|
|
default:
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-10-28 03:25:38 +07:00
|
|
|
/**
|
|
|
|
* insn_get_modrm_rm_off() - Obtain register in r/m part of the ModRM byte
|
|
|
|
* @insn: Instruction containing the ModRM byte
|
|
|
|
* @regs: Register values as seen when entering kernel mode
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* The register indicated by the r/m part of the ModRM byte. The
|
|
|
|
* register is obtained as an offset from the base of pt_regs. In specific
|
|
|
|
* cases, the returned value can be -EDOM to indicate that the particular value
|
|
|
|
* of ModRM does not refer to a register and shall be ignored.
|
|
|
|
*/
|
|
|
|
int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
return get_reg_offset(insn, regs, REG_TYPE_RM);
|
|
|
|
}
|
|
|
|
|
2017-10-28 03:25:45 +07:00
|
|
|
/**
|
2017-10-28 06:51:38 +07:00
|
|
|
* get_seg_base_limit() - obtain base address and limit of a segment
|
2017-10-28 03:25:45 +07:00
|
|
|
* @insn: Instruction. Must be valid.
|
|
|
|
* @regs: Register values as seen when entering kernel mode
|
|
|
|
* @regoff: Operand offset, in pt_regs, used to resolve segment descriptor
|
|
|
|
* @base: Obtained segment base
|
2017-10-28 06:51:38 +07:00
|
|
|
* @limit: Obtained segment limit
|
2017-10-28 03:25:45 +07:00
|
|
|
*
|
2017-10-28 06:51:38 +07:00
|
|
|
* Obtain the base address and limit of the segment associated with the operand
|
|
|
|
* @regoff and, if any or allowed, override prefixes in @insn. This function is
|
2017-10-28 03:25:45 +07:00
|
|
|
* different from insn_get_seg_base() as the latter does not resolve the segment
|
2017-10-28 06:51:38 +07:00
|
|
|
* associated with the instruction operand. If a limit is not needed (e.g.,
|
|
|
|
* when running in long mode), @limit can be NULL.
|
2017-10-28 03:25:45 +07:00
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
2017-10-28 06:51:38 +07:00
|
|
|
* 0 on success. @base and @limit will contain the base address and of the
|
|
|
|
* resolved segment, respectively.
|
2017-10-28 03:25:45 +07:00
|
|
|
*
|
|
|
|
* -EINVAL on error.
|
|
|
|
*/
|
2017-10-28 06:51:38 +07:00
|
|
|
static int get_seg_base_limit(struct insn *insn, struct pt_regs *regs,
|
|
|
|
int regoff, unsigned long *base,
|
|
|
|
unsigned long *limit)
|
2017-10-28 03:25:45 +07:00
|
|
|
{
|
|
|
|
int seg_reg_idx;
|
|
|
|
|
|
|
|
if (!base)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
seg_reg_idx = resolve_seg_reg(insn, regs, regoff);
|
|
|
|
if (seg_reg_idx < 0)
|
|
|
|
return seg_reg_idx;
|
|
|
|
|
|
|
|
*base = insn_get_seg_base(regs, seg_reg_idx);
|
|
|
|
if (*base == -1L)
|
|
|
|
return -EINVAL;
|
|
|
|
|
2017-10-28 06:51:38 +07:00
|
|
|
if (!limit)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
*limit = get_seg_limit(regs, seg_reg_idx);
|
|
|
|
if (!(*limit))
|
|
|
|
return -EINVAL;
|
|
|
|
|
2017-10-28 03:25:45 +07:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
x86/insn-eval: Compute linear address in several utility functions
Computing a linear address involves several steps. The first step is to
compute the effective address. This requires determining the addressing
mode in use and perform arithmetic operations on the operands. Plus, each
addressing mode has special cases that must be handled.
Once the effective address is known, the base address of the applicable
segment is added to obtain the linear address.
Clearly, this is too much work for a single function. Instead, handle each
addressing mode in a separate utility function. This improves readability
and gives us the opportunity to handler errors better.
At the moment, arithmetic to compute the effective address uses 64-byte
variables. Thus, limit support to 64-bit addresses.
While reworking the function insn_get_addr_ref(), the variable addr_offset
is renamed as regoff to reflect its actual use (i.e., offset, from the
base of pt_regs, of the register used as operand).
Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-11-06 09:27:46 +07:00
|
|
|
/**
|
|
|
|
* get_eff_addr_reg() - Obtain effective address from register operand
|
|
|
|
* @insn: Instruction. Must be valid.
|
|
|
|
* @regs: Register values as seen when entering kernel mode
|
|
|
|
* @regoff: Obtained operand offset, in pt_regs, with the effective address
|
|
|
|
* @eff_addr: Obtained effective address
|
|
|
|
*
|
|
|
|
* Obtain the effective address stored in the register operand as indicated by
|
|
|
|
* the ModRM byte. This function is to be used only with register addressing
|
|
|
|
* (i.e., ModRM.mod is 3). The effective address is saved in @eff_addr. The
|
|
|
|
* register operand, as an offset from the base of pt_regs, is saved in @regoff;
|
|
|
|
* such offset can then be used to resolve the segment associated with the
|
|
|
|
* operand. This function can be used with any of the supported address sizes
|
|
|
|
* in x86.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* 0 on success. @eff_addr will have the effective address stored in the
|
|
|
|
* operand indicated by ModRM. @regoff will have such operand as an offset from
|
|
|
|
* the base of pt_regs.
|
|
|
|
*
|
|
|
|
* -EINVAL on error.
|
|
|
|
*/
|
|
|
|
static int get_eff_addr_reg(struct insn *insn, struct pt_regs *regs,
|
|
|
|
int *regoff, long *eff_addr)
|
|
|
|
{
|
|
|
|
insn_get_modrm(insn);
|
|
|
|
|
|
|
|
if (!insn->modrm.nbytes)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (X86_MODRM_MOD(insn->modrm.value) != 3)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
*regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
|
|
|
|
if (*regoff < 0)
|
|
|
|
return -EINVAL;
|
|
|
|
|
2017-11-06 09:27:47 +07:00
|
|
|
/* Ignore bytes that are outside the address size. */
|
2017-11-06 09:27:50 +07:00
|
|
|
if (insn->addr_bytes == 2)
|
|
|
|
*eff_addr = regs_get_register(regs, *regoff) & 0xffff;
|
|
|
|
else if (insn->addr_bytes == 4)
|
2017-11-06 09:27:47 +07:00
|
|
|
*eff_addr = regs_get_register(regs, *regoff) & 0xffffffff;
|
|
|
|
else /* 64-bit address */
|
|
|
|
*eff_addr = regs_get_register(regs, *regoff);
|
x86/insn-eval: Compute linear address in several utility functions
Computing a linear address involves several steps. The first step is to
compute the effective address. This requires determining the addressing
mode in use and perform arithmetic operations on the operands. Plus, each
addressing mode has special cases that must be handled.
Once the effective address is known, the base address of the applicable
segment is added to obtain the linear address.
Clearly, this is too much work for a single function. Instead, handle each
addressing mode in a separate utility function. This improves readability
and gives us the opportunity to handler errors better.
At the moment, arithmetic to compute the effective address uses 64-byte
variables. Thus, limit support to 64-bit addresses.
While reworking the function insn_get_addr_ref(), the variable addr_offset
is renamed as regoff to reflect its actual use (i.e., offset, from the
base of pt_regs, of the register used as operand).
Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-11-06 09:27:46 +07:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* get_eff_addr_modrm() - Obtain referenced effective address via ModRM
|
|
|
|
* @insn: Instruction. Must be valid.
|
|
|
|
* @regs: Register values as seen when entering kernel mode
|
|
|
|
* @regoff: Obtained operand offset, in pt_regs, associated with segment
|
|
|
|
* @eff_addr: Obtained effective address
|
|
|
|
*
|
|
|
|
* Obtain the effective address referenced by the ModRM byte of @insn. After
|
|
|
|
* identifying the registers involved in the register-indirect memory reference,
|
|
|
|
* its value is obtained from the operands in @regs. The computed address is
|
|
|
|
* stored @eff_addr. Also, the register operand that indicates the associated
|
|
|
|
* segment is stored in @regoff, this parameter can later be used to determine
|
|
|
|
* such segment.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* 0 on success. @eff_addr will have the referenced effective address. @regoff
|
|
|
|
* will have a register, as an offset from the base of pt_regs, that can be used
|
|
|
|
* to resolve the associated segment.
|
|
|
|
*
|
|
|
|
* -EINVAL on error.
|
|
|
|
*/
|
|
|
|
static int get_eff_addr_modrm(struct insn *insn, struct pt_regs *regs,
|
|
|
|
int *regoff, long *eff_addr)
|
|
|
|
{
|
|
|
|
long tmp;
|
|
|
|
|
2017-11-06 09:27:47 +07:00
|
|
|
if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
|
x86/insn-eval: Compute linear address in several utility functions
Computing a linear address involves several steps. The first step is to
compute the effective address. This requires determining the addressing
mode in use and perform arithmetic operations on the operands. Plus, each
addressing mode has special cases that must be handled.
Once the effective address is known, the base address of the applicable
segment is added to obtain the linear address.
Clearly, this is too much work for a single function. Instead, handle each
addressing mode in a separate utility function. This improves readability
and gives us the opportunity to handler errors better.
At the moment, arithmetic to compute the effective address uses 64-byte
variables. Thus, limit support to 64-bit addresses.
While reworking the function insn_get_addr_ref(), the variable addr_offset
is renamed as regoff to reflect its actual use (i.e., offset, from the
base of pt_regs, of the register used as operand).
Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-11-06 09:27:46 +07:00
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
insn_get_modrm(insn);
|
|
|
|
|
|
|
|
if (!insn->modrm.nbytes)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (X86_MODRM_MOD(insn->modrm.value) > 2)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
*regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* -EDOM means that we must ignore the address_offset. In such a case,
|
|
|
|
* in 64-bit mode the effective address relative to the rIP of the
|
|
|
|
* following instruction.
|
|
|
|
*/
|
|
|
|
if (*regoff == -EDOM) {
|
2019-12-19 06:11:47 +07:00
|
|
|
if (any_64bit_mode(regs))
|
x86/insn-eval: Compute linear address in several utility functions
Computing a linear address involves several steps. The first step is to
compute the effective address. This requires determining the addressing
mode in use and perform arithmetic operations on the operands. Plus, each
addressing mode has special cases that must be handled.
Once the effective address is known, the base address of the applicable
segment is added to obtain the linear address.
Clearly, this is too much work for a single function. Instead, handle each
addressing mode in a separate utility function. This improves readability
and gives us the opportunity to handler errors better.
At the moment, arithmetic to compute the effective address uses 64-byte
variables. Thus, limit support to 64-bit addresses.
While reworking the function insn_get_addr_ref(), the variable addr_offset
is renamed as regoff to reflect its actual use (i.e., offset, from the
base of pt_regs, of the register used as operand).
Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-11-06 09:27:46 +07:00
|
|
|
tmp = regs->ip + insn->length;
|
|
|
|
else
|
|
|
|
tmp = 0;
|
|
|
|
} else if (*regoff < 0) {
|
|
|
|
return -EINVAL;
|
|
|
|
} else {
|
|
|
|
tmp = regs_get_register(regs, *regoff);
|
|
|
|
}
|
|
|
|
|
2017-11-06 09:27:47 +07:00
|
|
|
if (insn->addr_bytes == 4) {
|
|
|
|
int addr32 = (int)(tmp & 0xffffffff) + insn->displacement.value;
|
|
|
|
|
|
|
|
*eff_addr = addr32 & 0xffffffff;
|
|
|
|
} else {
|
|
|
|
*eff_addr = tmp + insn->displacement.value;
|
|
|
|
}
|
x86/insn-eval: Compute linear address in several utility functions
Computing a linear address involves several steps. The first step is to
compute the effective address. This requires determining the addressing
mode in use and perform arithmetic operations on the operands. Plus, each
addressing mode has special cases that must be handled.
Once the effective address is known, the base address of the applicable
segment is added to obtain the linear address.
Clearly, this is too much work for a single function. Instead, handle each
addressing mode in a separate utility function. This improves readability
and gives us the opportunity to handler errors better.
At the moment, arithmetic to compute the effective address uses 64-byte
variables. Thus, limit support to 64-bit addresses.
While reworking the function insn_get_addr_ref(), the variable addr_offset
is renamed as regoff to reflect its actual use (i.e., offset, from the
base of pt_regs, of the register used as operand).
Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-11-06 09:27:46 +07:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2017-11-06 09:27:50 +07:00
|
|
|
/**
|
|
|
|
* get_eff_addr_modrm_16() - Obtain referenced effective address via ModRM
|
|
|
|
* @insn: Instruction. Must be valid.
|
|
|
|
* @regs: Register values as seen when entering kernel mode
|
|
|
|
* @regoff: Obtained operand offset, in pt_regs, associated with segment
|
|
|
|
* @eff_addr: Obtained effective address
|
|
|
|
*
|
|
|
|
* Obtain the 16-bit effective address referenced by the ModRM byte of @insn.
|
|
|
|
* After identifying the registers involved in the register-indirect memory
|
|
|
|
* reference, its value is obtained from the operands in @regs. The computed
|
|
|
|
* address is stored @eff_addr. Also, the register operand that indicates
|
|
|
|
* the associated segment is stored in @regoff, this parameter can later be used
|
|
|
|
* to determine such segment.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* 0 on success. @eff_addr will have the referenced effective address. @regoff
|
|
|
|
* will have a register, as an offset from the base of pt_regs, that can be used
|
|
|
|
* to resolve the associated segment.
|
|
|
|
*
|
|
|
|
* -EINVAL on error.
|
|
|
|
*/
|
|
|
|
static int get_eff_addr_modrm_16(struct insn *insn, struct pt_regs *regs,
|
|
|
|
int *regoff, short *eff_addr)
|
|
|
|
{
|
|
|
|
int addr_offset1, addr_offset2, ret;
|
|
|
|
short addr1 = 0, addr2 = 0, displacement;
|
|
|
|
|
|
|
|
if (insn->addr_bytes != 2)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
insn_get_modrm(insn);
|
|
|
|
|
|
|
|
if (!insn->modrm.nbytes)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (X86_MODRM_MOD(insn->modrm.value) > 2)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
ret = get_reg_offset_16(insn, regs, &addr_offset1, &addr_offset2);
|
|
|
|
if (ret < 0)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Don't fail on invalid offset values. They might be invalid because
|
|
|
|
* they cannot be used for this particular value of ModRM. Instead, use
|
|
|
|
* them in the computation only if they contain a valid value.
|
|
|
|
*/
|
|
|
|
if (addr_offset1 != -EDOM)
|
|
|
|
addr1 = regs_get_register(regs, addr_offset1) & 0xffff;
|
|
|
|
|
|
|
|
if (addr_offset2 != -EDOM)
|
|
|
|
addr2 = regs_get_register(regs, addr_offset2) & 0xffff;
|
|
|
|
|
|
|
|
displacement = insn->displacement.value & 0xffff;
|
|
|
|
*eff_addr = addr1 + addr2 + displacement;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The first operand register could indicate to use of either SS or DS
|
|
|
|
* registers to obtain the segment selector. The second operand
|
|
|
|
* register can only indicate the use of DS. Thus, the first operand
|
|
|
|
* will be used to obtain the segment selector.
|
|
|
|
*/
|
|
|
|
*regoff = addr_offset1;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
x86/insn-eval: Compute linear address in several utility functions
Computing a linear address involves several steps. The first step is to
compute the effective address. This requires determining the addressing
mode in use and perform arithmetic operations on the operands. Plus, each
addressing mode has special cases that must be handled.
Once the effective address is known, the base address of the applicable
segment is added to obtain the linear address.
Clearly, this is too much work for a single function. Instead, handle each
addressing mode in a separate utility function. This improves readability
and gives us the opportunity to handler errors better.
At the moment, arithmetic to compute the effective address uses 64-byte
variables. Thus, limit support to 64-bit addresses.
While reworking the function insn_get_addr_ref(), the variable addr_offset
is renamed as regoff to reflect its actual use (i.e., offset, from the
base of pt_regs, of the register used as operand).
Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-11-06 09:27:46 +07:00
|
|
|
/**
|
|
|
|
* get_eff_addr_sib() - Obtain referenced effective address via SIB
|
|
|
|
* @insn: Instruction. Must be valid.
|
|
|
|
* @regs: Register values as seen when entering kernel mode
|
|
|
|
* @regoff: Obtained operand offset, in pt_regs, associated with segment
|
|
|
|
* @eff_addr: Obtained effective address
|
|
|
|
*
|
|
|
|
* Obtain the effective address referenced by the SIB byte of @insn. After
|
|
|
|
* identifying the registers involved in the indexed, register-indirect memory
|
|
|
|
* reference, its value is obtained from the operands in @regs. The computed
|
|
|
|
* address is stored @eff_addr. Also, the register operand that indicates the
|
|
|
|
* associated segment is stored in @regoff, this parameter can later be used to
|
|
|
|
* determine such segment.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* 0 on success. @eff_addr will have the referenced effective address.
|
|
|
|
* @base_offset will have a register, as an offset from the base of pt_regs,
|
|
|
|
* that can be used to resolve the associated segment.
|
|
|
|
*
|
|
|
|
* -EINVAL on error.
|
|
|
|
*/
|
|
|
|
static int get_eff_addr_sib(struct insn *insn, struct pt_regs *regs,
|
|
|
|
int *base_offset, long *eff_addr)
|
|
|
|
{
|
|
|
|
long base, indx;
|
|
|
|
int indx_offset;
|
|
|
|
|
2017-11-06 09:27:47 +07:00
|
|
|
if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
|
x86/insn-eval: Compute linear address in several utility functions
Computing a linear address involves several steps. The first step is to
compute the effective address. This requires determining the addressing
mode in use and perform arithmetic operations on the operands. Plus, each
addressing mode has special cases that must be handled.
Once the effective address is known, the base address of the applicable
segment is added to obtain the linear address.
Clearly, this is too much work for a single function. Instead, handle each
addressing mode in a separate utility function. This improves readability
and gives us the opportunity to handler errors better.
At the moment, arithmetic to compute the effective address uses 64-byte
variables. Thus, limit support to 64-bit addresses.
While reworking the function insn_get_addr_ref(), the variable addr_offset
is renamed as regoff to reflect its actual use (i.e., offset, from the
base of pt_regs, of the register used as operand).
Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-11-06 09:27:46 +07:00
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
insn_get_modrm(insn);
|
|
|
|
|
|
|
|
if (!insn->modrm.nbytes)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (X86_MODRM_MOD(insn->modrm.value) > 2)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
insn_get_sib(insn);
|
|
|
|
|
|
|
|
if (!insn->sib.nbytes)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
*base_offset = get_reg_offset(insn, regs, REG_TYPE_BASE);
|
|
|
|
indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Negative values in the base and index offset means an error when
|
|
|
|
* decoding the SIB byte. Except -EDOM, which means that the registers
|
|
|
|
* should not be used in the address computation.
|
|
|
|
*/
|
|
|
|
if (*base_offset == -EDOM)
|
|
|
|
base = 0;
|
|
|
|
else if (*base_offset < 0)
|
|
|
|
return -EINVAL;
|
|
|
|
else
|
|
|
|
base = regs_get_register(regs, *base_offset);
|
|
|
|
|
|
|
|
if (indx_offset == -EDOM)
|
|
|
|
indx = 0;
|
|
|
|
else if (indx_offset < 0)
|
|
|
|
return -EINVAL;
|
|
|
|
else
|
|
|
|
indx = regs_get_register(regs, indx_offset);
|
|
|
|
|
2017-11-06 09:27:47 +07:00
|
|
|
if (insn->addr_bytes == 4) {
|
|
|
|
int addr32, base32, idx32;
|
|
|
|
|
|
|
|
base32 = base & 0xffffffff;
|
|
|
|
idx32 = indx & 0xffffffff;
|
x86/insn-eval: Compute linear address in several utility functions
Computing a linear address involves several steps. The first step is to
compute the effective address. This requires determining the addressing
mode in use and perform arithmetic operations on the operands. Plus, each
addressing mode has special cases that must be handled.
Once the effective address is known, the base address of the applicable
segment is added to obtain the linear address.
Clearly, this is too much work for a single function. Instead, handle each
addressing mode in a separate utility function. This improves readability
and gives us the opportunity to handler errors better.
At the moment, arithmetic to compute the effective address uses 64-byte
variables. Thus, limit support to 64-bit addresses.
While reworking the function insn_get_addr_ref(), the variable addr_offset
is renamed as regoff to reflect its actual use (i.e., offset, from the
base of pt_regs, of the register used as operand).
Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-11-06 09:27:46 +07:00
|
|
|
|
2017-11-06 09:27:47 +07:00
|
|
|
addr32 = base32 + idx32 * (1 << X86_SIB_SCALE(insn->sib.value));
|
|
|
|
addr32 += insn->displacement.value;
|
|
|
|
|
|
|
|
*eff_addr = addr32 & 0xffffffff;
|
|
|
|
} else {
|
|
|
|
*eff_addr = base + indx * (1 << X86_SIB_SCALE(insn->sib.value));
|
|
|
|
*eff_addr += insn->displacement.value;
|
|
|
|
}
|
x86/insn-eval: Compute linear address in several utility functions
Computing a linear address involves several steps. The first step is to
compute the effective address. This requires determining the addressing
mode in use and perform arithmetic operations on the operands. Plus, each
addressing mode has special cases that must be handled.
Once the effective address is known, the base address of the applicable
segment is added to obtain the linear address.
Clearly, this is too much work for a single function. Instead, handle each
addressing mode in a separate utility function. This improves readability
and gives us the opportunity to handler errors better.
At the moment, arithmetic to compute the effective address uses 64-byte
variables. Thus, limit support to 64-bit addresses.
While reworking the function insn_get_addr_ref(), the variable addr_offset
is renamed as regoff to reflect its actual use (i.e., offset, from the
base of pt_regs, of the register used as operand).
Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-11-06 09:27:46 +07:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
2017-11-06 09:27:47 +07:00
|
|
|
|
2017-11-06 09:27:50 +07:00
|
|
|
/**
|
|
|
|
* get_addr_ref_16() - Obtain the 16-bit address referred by instruction
|
|
|
|
* @insn: Instruction containing ModRM byte and displacement
|
|
|
|
* @regs: Register values as seen when entering kernel mode
|
|
|
|
*
|
|
|
|
* This function is to be used with 16-bit address encodings. Obtain the memory
|
|
|
|
* address referred by the instruction's ModRM and displacement bytes. Also, the
|
|
|
|
* segment used as base is determined by either any segment override prefixes in
|
|
|
|
* @insn or the default segment of the registers involved in the address
|
|
|
|
* computation. In protected mode, segment limits are enforced.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* Linear address referenced by the instruction operands on success.
|
|
|
|
*
|
|
|
|
* -1L on error.
|
|
|
|
*/
|
|
|
|
static void __user *get_addr_ref_16(struct insn *insn, struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
unsigned long linear_addr = -1L, seg_base, seg_limit;
|
|
|
|
int ret, regoff;
|
|
|
|
short eff_addr;
|
|
|
|
long tmp;
|
|
|
|
|
|
|
|
insn_get_modrm(insn);
|
|
|
|
insn_get_displacement(insn);
|
|
|
|
|
|
|
|
if (insn->addr_bytes != 2)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
if (X86_MODRM_MOD(insn->modrm.value) == 3) {
|
|
|
|
ret = get_eff_addr_reg(insn, regs, ®off, &tmp);
|
|
|
|
if (ret)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
eff_addr = tmp;
|
|
|
|
} else {
|
|
|
|
ret = get_eff_addr_modrm_16(insn, regs, ®off, &eff_addr);
|
|
|
|
if (ret)
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
|
|
|
|
if (ret)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Before computing the linear address, make sure the effective address
|
|
|
|
* is within the limits of the segment. In virtual-8086 mode, segment
|
|
|
|
* limits are not enforced. In such a case, the segment limit is -1L to
|
|
|
|
* reflect this fact.
|
|
|
|
*/
|
|
|
|
if ((unsigned long)(eff_addr & 0xffff) > seg_limit)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
linear_addr = (unsigned long)(eff_addr & 0xffff) + seg_base;
|
|
|
|
|
|
|
|
/* Limit linear address to 20 bits */
|
|
|
|
if (v8086_mode(regs))
|
|
|
|
linear_addr &= 0xfffff;
|
|
|
|
|
|
|
|
out:
|
|
|
|
return (void __user *)linear_addr;
|
|
|
|
}
|
|
|
|
|
2017-11-06 09:27:47 +07:00
|
|
|
/**
|
|
|
|
* get_addr_ref_32() - Obtain a 32-bit linear address
|
|
|
|
* @insn: Instruction with ModRM, SIB bytes and displacement
|
|
|
|
* @regs: Register values as seen when entering kernel mode
|
|
|
|
*
|
|
|
|
* This function is to be used with 32-bit address encodings to obtain the
|
|
|
|
* linear memory address referred by the instruction's ModRM, SIB,
|
|
|
|
* displacement bytes and segment base address, as applicable. If in protected
|
|
|
|
* mode, segment limits are enforced.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* Linear address referenced by instruction and registers on success.
|
|
|
|
*
|
|
|
|
* -1L on error.
|
|
|
|
*/
|
|
|
|
static void __user *get_addr_ref_32(struct insn *insn, struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
unsigned long linear_addr = -1L, seg_base, seg_limit;
|
|
|
|
int eff_addr, regoff;
|
|
|
|
long tmp;
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
if (insn->addr_bytes != 4)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
if (X86_MODRM_MOD(insn->modrm.value) == 3) {
|
|
|
|
ret = get_eff_addr_reg(insn, regs, ®off, &tmp);
|
|
|
|
if (ret)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
eff_addr = tmp;
|
|
|
|
|
|
|
|
} else {
|
|
|
|
if (insn->sib.nbytes) {
|
|
|
|
ret = get_eff_addr_sib(insn, regs, ®off, &tmp);
|
|
|
|
if (ret)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
eff_addr = tmp;
|
|
|
|
} else {
|
|
|
|
ret = get_eff_addr_modrm(insn, regs, ®off, &tmp);
|
|
|
|
if (ret)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
eff_addr = tmp;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
|
|
|
|
if (ret)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* In protected mode, before computing the linear address, make sure
|
|
|
|
* the effective address is within the limits of the segment.
|
|
|
|
* 32-bit addresses can be used in long and virtual-8086 modes if an
|
|
|
|
* address override prefix is used. In such cases, segment limits are
|
|
|
|
* not enforced. When in virtual-8086 mode, the segment limit is -1L
|
|
|
|
* to reflect this situation.
|
|
|
|
*
|
|
|
|
* After computed, the effective address is treated as an unsigned
|
|
|
|
* quantity.
|
|
|
|
*/
|
2019-12-19 06:11:47 +07:00
|
|
|
if (!any_64bit_mode(regs) && ((unsigned int)eff_addr > seg_limit))
|
2017-11-06 09:27:47 +07:00
|
|
|
goto out;
|
|
|
|
|
2017-11-06 09:27:49 +07:00
|
|
|
/*
|
|
|
|
* Even though 32-bit address encodings are allowed in virtual-8086
|
|
|
|
* mode, the address range is still limited to [0x-0xffff].
|
|
|
|
*/
|
|
|
|
if (v8086_mode(regs) && (eff_addr & ~0xffff))
|
|
|
|
goto out;
|
|
|
|
|
2017-11-06 09:27:47 +07:00
|
|
|
/*
|
|
|
|
* Data type long could be 64 bits in size. Ensure that our 32-bit
|
|
|
|
* effective address is not sign-extended when computing the linear
|
|
|
|
* address.
|
|
|
|
*/
|
|
|
|
linear_addr = (unsigned long)(eff_addr & 0xffffffff) + seg_base;
|
|
|
|
|
2017-11-06 09:27:49 +07:00
|
|
|
/* Limit linear address to 20 bits */
|
|
|
|
if (v8086_mode(regs))
|
|
|
|
linear_addr &= 0xfffff;
|
|
|
|
|
2017-11-06 09:27:47 +07:00
|
|
|
out:
|
|
|
|
return (void __user *)linear_addr;
|
|
|
|
}
|
|
|
|
|
2017-11-06 09:27:48 +07:00
|
|
|
/**
|
|
|
|
* get_addr_ref_64() - Obtain a 64-bit linear address
|
|
|
|
* @insn: Instruction struct with ModRM and SIB bytes and displacement
|
|
|
|
* @regs: Structure with register values as seen when entering kernel mode
|
|
|
|
*
|
|
|
|
* This function is to be used with 64-bit address encodings to obtain the
|
|
|
|
* linear memory address referred by the instruction's ModRM, SIB,
|
|
|
|
* displacement bytes and segment base address, as applicable.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* Linear address referenced by instruction and registers on success.
|
|
|
|
*
|
|
|
|
* -1L on error.
|
2017-10-28 03:25:36 +07:00
|
|
|
*/
|
2017-11-06 09:27:48 +07:00
|
|
|
#ifndef CONFIG_X86_64
|
|
|
|
static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
return (void __user *)-1L;
|
|
|
|
}
|
|
|
|
#else
|
|
|
|
static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
|
2017-10-28 03:25:36 +07:00
|
|
|
{
|
2017-10-28 03:25:45 +07:00
|
|
|
unsigned long linear_addr = -1L, seg_base;
|
x86/insn-eval: Compute linear address in several utility functions
Computing a linear address involves several steps. The first step is to
compute the effective address. This requires determining the addressing
mode in use and perform arithmetic operations on the operands. Plus, each
addressing mode has special cases that must be handled.
Once the effective address is known, the base address of the applicable
segment is added to obtain the linear address.
Clearly, this is too much work for a single function. Instead, handle each
addressing mode in a separate utility function. This improves readability
and gives us the opportunity to handler errors better.
At the moment, arithmetic to compute the effective address uses 64-byte
variables. Thus, limit support to 64-bit addresses.
While reworking the function insn_get_addr_ref(), the variable addr_offset
is renamed as regoff to reflect its actual use (i.e., offset, from the
base of pt_regs, of the register used as operand).
Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-11-06 09:27:46 +07:00
|
|
|
int regoff, ret;
|
|
|
|
long eff_addr;
|
2017-10-28 03:25:36 +07:00
|
|
|
|
2017-11-06 09:27:48 +07:00
|
|
|
if (insn->addr_bytes != 8)
|
|
|
|
goto out;
|
|
|
|
|
2017-10-28 03:25:36 +07:00
|
|
|
if (X86_MODRM_MOD(insn->modrm.value) == 3) {
|
x86/insn-eval: Compute linear address in several utility functions
Computing a linear address involves several steps. The first step is to
compute the effective address. This requires determining the addressing
mode in use and perform arithmetic operations on the operands. Plus, each
addressing mode has special cases that must be handled.
Once the effective address is known, the base address of the applicable
segment is added to obtain the linear address.
Clearly, this is too much work for a single function. Instead, handle each
addressing mode in a separate utility function. This improves readability
and gives us the opportunity to handler errors better.
At the moment, arithmetic to compute the effective address uses 64-byte
variables. Thus, limit support to 64-bit addresses.
While reworking the function insn_get_addr_ref(), the variable addr_offset
is renamed as regoff to reflect its actual use (i.e., offset, from the
base of pt_regs, of the register used as operand).
Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-11-06 09:27:46 +07:00
|
|
|
ret = get_eff_addr_reg(insn, regs, ®off, &eff_addr);
|
|
|
|
if (ret)
|
2017-10-28 03:25:36 +07:00
|
|
|
goto out;
|
|
|
|
|
|
|
|
} else {
|
|
|
|
if (insn->sib.nbytes) {
|
x86/insn-eval: Compute linear address in several utility functions
Computing a linear address involves several steps. The first step is to
compute the effective address. This requires determining the addressing
mode in use and perform arithmetic operations on the operands. Plus, each
addressing mode has special cases that must be handled.
Once the effective address is known, the base address of the applicable
segment is added to obtain the linear address.
Clearly, this is too much work for a single function. Instead, handle each
addressing mode in a separate utility function. This improves readability
and gives us the opportunity to handler errors better.
At the moment, arithmetic to compute the effective address uses 64-byte
variables. Thus, limit support to 64-bit addresses.
While reworking the function insn_get_addr_ref(), the variable addr_offset
is renamed as regoff to reflect its actual use (i.e., offset, from the
base of pt_regs, of the register used as operand).
Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-11-06 09:27:46 +07:00
|
|
|
ret = get_eff_addr_sib(insn, regs, ®off, &eff_addr);
|
|
|
|
if (ret)
|
2017-10-28 03:25:36 +07:00
|
|
|
goto out;
|
|
|
|
} else {
|
x86/insn-eval: Compute linear address in several utility functions
Computing a linear address involves several steps. The first step is to
compute the effective address. This requires determining the addressing
mode in use and perform arithmetic operations on the operands. Plus, each
addressing mode has special cases that must be handled.
Once the effective address is known, the base address of the applicable
segment is added to obtain the linear address.
Clearly, this is too much work for a single function. Instead, handle each
addressing mode in a separate utility function. This improves readability
and gives us the opportunity to handler errors better.
At the moment, arithmetic to compute the effective address uses 64-byte
variables. Thus, limit support to 64-bit addresses.
While reworking the function insn_get_addr_ref(), the variable addr_offset
is renamed as regoff to reflect its actual use (i.e., offset, from the
base of pt_regs, of the register used as operand).
Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-11-06 09:27:46 +07:00
|
|
|
ret = get_eff_addr_modrm(insn, regs, ®off, &eff_addr);
|
|
|
|
if (ret)
|
2017-10-28 03:25:36 +07:00
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
|
x86/insn-eval: Compute linear address in several utility functions
Computing a linear address involves several steps. The first step is to
compute the effective address. This requires determining the addressing
mode in use and perform arithmetic operations on the operands. Plus, each
addressing mode has special cases that must be handled.
Once the effective address is known, the base address of the applicable
segment is added to obtain the linear address.
Clearly, this is too much work for a single function. Instead, handle each
addressing mode in a separate utility function. This improves readability
and gives us the opportunity to handler errors better.
At the moment, arithmetic to compute the effective address uses 64-byte
variables. Thus, limit support to 64-bit addresses.
While reworking the function insn_get_addr_ref(), the variable addr_offset
is renamed as regoff to reflect its actual use (i.e., offset, from the
base of pt_regs, of the register used as operand).
Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-2-git-send-email-ricardo.neri-calderon@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-11-06 09:27:46 +07:00
|
|
|
ret = get_seg_base_limit(insn, regs, regoff, &seg_base, NULL);
|
2017-10-28 03:25:45 +07:00
|
|
|
if (ret)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
linear_addr = (unsigned long)eff_addr + seg_base;
|
2017-10-28 03:25:36 +07:00
|
|
|
|
|
|
|
out:
|
|
|
|
return (void __user *)linear_addr;
|
|
|
|
}
|
2017-11-06 09:27:48 +07:00
|
|
|
#endif /* CONFIG_X86_64 */
|
|
|
|
|
|
|
|
/**
|
|
|
|
* insn_get_addr_ref() - Obtain the linear address referred by instruction
|
|
|
|
* @insn: Instruction structure containing ModRM byte and displacement
|
|
|
|
* @regs: Structure with register values as seen when entering kernel mode
|
|
|
|
*
|
|
|
|
* Obtain the linear address referred by the instruction's ModRM, SIB and
|
|
|
|
* displacement bytes, and segment base, as applicable. In protected mode,
|
|
|
|
* segment limits are enforced.
|
|
|
|
*
|
|
|
|
* Returns:
|
|
|
|
*
|
|
|
|
* Linear address referenced by instruction and registers on success.
|
|
|
|
*
|
|
|
|
* -1L on error.
|
|
|
|
*/
|
|
|
|
void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
if (!insn || !regs)
|
|
|
|
return (void __user *)-1L;
|
|
|
|
|
|
|
|
switch (insn->addr_bytes) {
|
2017-11-06 09:27:50 +07:00
|
|
|
case 2:
|
|
|
|
return get_addr_ref_16(insn, regs);
|
2017-11-06 09:27:48 +07:00
|
|
|
case 4:
|
|
|
|
return get_addr_ref_32(insn, regs);
|
|
|
|
case 8:
|
|
|
|
return get_addr_ref_64(insn, regs);
|
|
|
|
default:
|
|
|
|
return (void __user *)-1L;
|
|
|
|
}
|
|
|
|
}
|