forked from Minki/linux
Merge branch 'x86/mpx' into x86/asm, to pick up dependent commits
The UMIP series is based on top of changes already queued up in the x86/mpx branch, so merge it. Signed-off-by: Ingo Molnar <mingo@kernel.org>
This commit is contained in:
Ingo Molnar
commit
93c08089c0
@ -97,6 +97,16 @@
|
||||
#define INAT_MAKE_GROUP(grp) ((grp << INAT_GRP_OFFS) | INAT_MODRM)
|
||||
#define INAT_MAKE_IMM(imm) (imm << INAT_IMM_OFFS)
|
||||
|
||||
/* Identifiers for segment registers */
|
||||
#define INAT_SEG_REG_IGNORE 0
|
||||
#define INAT_SEG_REG_DEFAULT 1
|
||||
#define INAT_SEG_REG_CS 2
|
||||
#define INAT_SEG_REG_SS 3
|
||||
#define INAT_SEG_REG_DS 4
|
||||
#define INAT_SEG_REG_ES 5
|
||||
#define INAT_SEG_REG_FS 6
|
||||
#define INAT_SEG_REG_GS 7
|
||||
|
||||
/* Attribute search APIs */
|
||||
extern insn_attr_t inat_get_opcode_attribute(insn_byte_t opcode);
|
||||
extern int inat_get_last_prefix_id(insn_byte_t last_pfx);
|
||||
|
||||
23
arch/x86/include/asm/insn-eval.h
Normal file
23
arch/x86/include/asm/insn-eval.h
Normal file
@ -0,0 +1,23 @@
|
||||
#ifndef _ASM_X86_INSN_EVAL_H
|
||||
#define _ASM_X86_INSN_EVAL_H
|
||||
/*
|
||||
* A collection of utility functions for x86 instruction analysis to be
|
||||
* used in a kernel context. Useful when, for instance, making sense
|
||||
* of the registers indicated by operands.
|
||||
*/
|
||||
|
||||
#include <linux/compiler.h>
|
||||
#include <linux/bug.h>
|
||||
#include <linux/err.h>
|
||||
#include <asm/ptrace.h>
|
||||
|
||||
#define INSN_CODE_SEG_ADDR_SZ(params) ((params >> 4) & 0xf)
|
||||
#define INSN_CODE_SEG_OPND_SZ(params) (params & 0xf)
|
||||
#define INSN_CODE_SEG_PARAMS(oper_sz, addr_sz) (oper_sz | (addr_sz << 4))
|
||||
|
||||
void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs);
|
||||
int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs);
|
||||
unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx);
|
||||
char insn_get_code_seg_params(struct pt_regs *regs);
|
||||
|
||||
#endif /* _ASM_X86_INSN_EVAL_H */
|
||||
@ -271,12 +271,15 @@ static bool is_prefix_bad(struct insn *insn)
|
||||
int i;
|
||||
|
||||
for (i = 0; i < insn->prefixes.nbytes; i++) {
|
||||
switch (insn->prefixes.bytes[i]) {
|
||||
case 0x26: /* INAT_PFX_ES */
|
||||
case 0x2E: /* INAT_PFX_CS */
|
||||
case 0x36: /* INAT_PFX_DS */
|
||||
case 0x3E: /* INAT_PFX_SS */
|
||||
case 0xF0: /* INAT_PFX_LOCK */
|
||||
insn_attr_t attr;
|
||||
|
||||
attr = inat_get_opcode_attribute(insn->prefixes.bytes[i]);
|
||||
switch (attr) {
|
||||
case INAT_MAKE_PREFIX(INAT_PFX_ES):
|
||||
case INAT_MAKE_PREFIX(INAT_PFX_CS):
|
||||
case INAT_MAKE_PREFIX(INAT_PFX_DS):
|
||||
case INAT_MAKE_PREFIX(INAT_PFX_SS):
|
||||
case INAT_MAKE_PREFIX(INAT_PFX_LOCK):
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
@ -24,7 +24,7 @@ lib-y := delay.o misc.o cmdline.o cpu.o
|
||||
lib-y += usercopy_$(BITS).o usercopy.o getuser.o putuser.o
|
||||
lib-y += memcpy_$(BITS).o
|
||||
lib-$(CONFIG_RWSEM_XCHGADD_ALGORITHM) += rwsem.o
|
||||
lib-$(CONFIG_INSTRUCTION_DECODER) += insn.o inat.o
|
||||
lib-$(CONFIG_INSTRUCTION_DECODER) += insn.o inat.o insn-eval.o
|
||||
lib-$(CONFIG_RANDOMIZE_BASE) += kaslr.o
|
||||
|
||||
obj-y += msr.o msr-reg.o msr-reg-export.o hweight.o
|
||||
|
||||
865
arch/x86/lib/insn-eval.c
Normal file
865
arch/x86/lib/insn-eval.c
Normal file
@ -0,0 +1,865 @@
|
||||
/*
|
||||
* Utility functions for x86 operand and address decoding
|
||||
*
|
||||
* Copyright (C) Intel Corporation 2017
|
||||
*/
|
||||
#include <linux/kernel.h>
|
||||
#include <linux/string.h>
|
||||
#include <linux/ratelimit.h>
|
||||
#include <linux/mmu_context.h>
|
||||
#include <asm/desc_defs.h>
|
||||
#include <asm/desc.h>
|
||||
#include <asm/inat.h>
|
||||
#include <asm/insn.h>
|
||||
#include <asm/insn-eval.h>
|
||||
#include <asm/ldt.h>
|
||||
#include <asm/vm86.h>
|
||||
|
||||
#undef pr_fmt
|
||||
#define pr_fmt(fmt) "insn: " fmt
|
||||
|
||||
enum reg_type {
|
||||
REG_TYPE_RM = 0,
|
||||
REG_TYPE_INDEX,
|
||||
REG_TYPE_BASE,
|
||||
};
|
||||
|
||||
/**
|
||||
* is_string_insn() - Determine if instruction is a string instruction
|
||||
* @insn: Instruction containing the opcode to inspect
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* true if the instruction, determined by the opcode, is any of the
|
||||
* string instructions as defined in the Intel Software Development manual.
|
||||
* False otherwise.
|
||||
*/
|
||||
static bool is_string_insn(struct insn *insn)
|
||||
{
|
||||
insn_get_opcode(insn);
|
||||
|
||||
/* All string instructions have a 1-byte opcode. */
|
||||
if (insn->opcode.nbytes != 1)
|
||||
return false;
|
||||
|
||||
switch (insn->opcode.bytes[0]) {
|
||||
case 0x6c ... 0x6f: /* INS, OUTS */
|
||||
case 0xa4 ... 0xa7: /* MOVS, CMPS */
|
||||
case 0xaa ... 0xaf: /* STOS, LODS, SCAS */
|
||||
return true;
|
||||
default:
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* get_seg_reg_override_idx() - obtain segment register override index
|
||||
* @insn: Valid instruction with segment override prefixes
|
||||
*
|
||||
* Inspect the instruction prefixes in @insn and find segment overrides, if any.
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* A constant identifying the segment register to use, among CS, SS, DS,
|
||||
* ES, FS, or GS. INAT_SEG_REG_DEFAULT is returned if no segment override
|
||||
* prefixes were found.
|
||||
*
|
||||
* -EINVAL in case of error.
|
||||
*/
|
||||
static int get_seg_reg_override_idx(struct insn *insn)
|
||||
{
|
||||
int idx = INAT_SEG_REG_DEFAULT;
|
||||
int num_overrides = 0, i;
|
||||
|
||||
insn_get_prefixes(insn);
|
||||
|
||||
/* Look for any segment override prefixes. */
|
||||
for (i = 0; i < insn->prefixes.nbytes; i++) {
|
||||
insn_attr_t attr;
|
||||
|
||||
attr = inat_get_opcode_attribute(insn->prefixes.bytes[i]);
|
||||
switch (attr) {
|
||||
case INAT_MAKE_PREFIX(INAT_PFX_CS):
|
||||
idx = INAT_SEG_REG_CS;
|
||||
num_overrides++;
|
||||
break;
|
||||
case INAT_MAKE_PREFIX(INAT_PFX_SS):
|
||||
idx = INAT_SEG_REG_SS;
|
||||
num_overrides++;
|
||||
break;
|
||||
case INAT_MAKE_PREFIX(INAT_PFX_DS):
|
||||
idx = INAT_SEG_REG_DS;
|
||||
num_overrides++;
|
||||
break;
|
||||
case INAT_MAKE_PREFIX(INAT_PFX_ES):
|
||||
idx = INAT_SEG_REG_ES;
|
||||
num_overrides++;
|
||||
break;
|
||||
case INAT_MAKE_PREFIX(INAT_PFX_FS):
|
||||
idx = INAT_SEG_REG_FS;
|
||||
num_overrides++;
|
||||
break;
|
||||
case INAT_MAKE_PREFIX(INAT_PFX_GS):
|
||||
idx = INAT_SEG_REG_GS;
|
||||
num_overrides++;
|
||||
break;
|
||||
/* No default action needed. */
|
||||
}
|
||||
}
|
||||
|
||||
/* More than one segment override prefix leads to undefined behavior. */
|
||||
if (num_overrides > 1)
|
||||
return -EINVAL;
|
||||
|
||||
return idx;
|
||||
}
|
||||
|
||||
/**
|
||||
* check_seg_overrides() - check if segment override prefixes are allowed
|
||||
* @insn: Valid instruction with segment override prefixes
|
||||
* @regoff: Operand offset, in pt_regs, for which the check is performed
|
||||
*
|
||||
* For a particular register used in register-indirect addressing, determine if
|
||||
* segment override prefixes can be used. Specifically, no overrides are allowed
|
||||
* for rDI if used with a string instruction.
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* True if segment override prefixes can be used with the register indicated
|
||||
* in @regoff. False if otherwise.
|
||||
*/
|
||||
static bool check_seg_overrides(struct insn *insn, int regoff)
|
||||
{
|
||||
if (regoff == offsetof(struct pt_regs, di) && is_string_insn(insn))
|
||||
return false;
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* resolve_default_seg() - resolve default segment register index for an operand
|
||||
* @insn: Instruction with opcode and address size. Must be valid.
|
||||
* @regs: Register values as seen when entering kernel mode
|
||||
* @off: Operand offset, in pt_regs, for which resolution is needed
|
||||
*
|
||||
* Resolve the default segment register index associated with the instruction
|
||||
* operand register indicated by @off. Such index is resolved based on defaults
|
||||
* described in the Intel Software Development Manual.
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* If in protected mode, a constant identifying the segment register to use,
|
||||
* among CS, SS, ES or DS. If in long mode, INAT_SEG_REG_IGNORE.
|
||||
*
|
||||
* -EINVAL in case of error.
|
||||
*/
|
||||
static int resolve_default_seg(struct insn *insn, struct pt_regs *regs, int off)
|
||||
{
|
||||
if (user_64bit_mode(regs))
|
||||
return INAT_SEG_REG_IGNORE;
|
||||
/*
|
||||
* Resolve the default segment register as described in Section 3.7.4
|
||||
* of the Intel Software Development Manual Vol. 1:
|
||||
*
|
||||
* + DS for all references involving r[ABCD]X, and rSI.
|
||||
* + If used in a string instruction, ES for rDI. Otherwise, DS.
|
||||
* + AX, CX and DX are not valid register operands in 16-bit address
|
||||
* encodings but are valid for 32-bit and 64-bit encodings.
|
||||
* + -EDOM is reserved to identify for cases in which no register
|
||||
* is used (i.e., displacement-only addressing). Use DS.
|
||||
* + SS for rSP or rBP.
|
||||
* + CS for rIP.
|
||||
*/
|
||||
|
||||
switch (off) {
|
||||
case offsetof(struct pt_regs, ax):
|
||||
case offsetof(struct pt_regs, cx):
|
||||
case offsetof(struct pt_regs, dx):
|
||||
/* Need insn to verify address size. */
|
||||
if (insn->addr_bytes == 2)
|
||||
return -EINVAL;
|
||||
|
||||
case -EDOM:
|
||||
case offsetof(struct pt_regs, bx):
|
||||
case offsetof(struct pt_regs, si):
|
||||
return INAT_SEG_REG_DS;
|
||||
|
||||
case offsetof(struct pt_regs, di):
|
||||
if (is_string_insn(insn))
|
||||
return INAT_SEG_REG_ES;
|
||||
return INAT_SEG_REG_DS;
|
||||
|
||||
case offsetof(struct pt_regs, bp):
|
||||
case offsetof(struct pt_regs, sp):
|
||||
return INAT_SEG_REG_SS;
|
||||
|
||||
case offsetof(struct pt_regs, ip):
|
||||
return INAT_SEG_REG_CS;
|
||||
|
||||
default:
|
||||
return -EINVAL;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* resolve_seg_reg() - obtain segment register index
|
||||
* @insn: Instruction with operands
|
||||
* @regs: Register values as seen when entering kernel mode
|
||||
* @regoff: Operand offset, in pt_regs, used to deterimine segment register
|
||||
*
|
||||
* Determine the segment register associated with the operands and, if
|
||||
* applicable, prefixes and the instruction pointed by @insn.
|
||||
*
|
||||
* The segment register associated to an operand used in register-indirect
|
||||
* addressing depends on:
|
||||
*
|
||||
* a) Whether running in long mode (in such a case segments are ignored, except
|
||||
* if FS or GS are used).
|
||||
*
|
||||
* b) Whether segment override prefixes can be used. Certain instructions and
|
||||
* registers do not allow override prefixes.
|
||||
*
|
||||
* c) Whether segment overrides prefixes are found in the instruction prefixes.
|
||||
*
|
||||
* d) If there are not segment override prefixes or they cannot be used, the
|
||||
* default segment register associated with the operand register is used.
|
||||
*
|
||||
* The function checks first if segment override prefixes can be used with the
|
||||
* operand indicated by @regoff. If allowed, obtain such overridden segment
|
||||
* register index. Lastly, if not prefixes were found or cannot be used, resolve
|
||||
* the segment register index to use based on the defaults described in the
|
||||
* Intel documentation. In long mode, all segment register indexes will be
|
||||
* ignored, except if overrides were found for FS or GS. All these operations
|
||||
* are done using helper functions.
|
||||
*
|
||||
* The operand register, @regoff, is represented as the offset from the base of
|
||||
* pt_regs.
|
||||
*
|
||||
* As stated, the main use of this function is to determine the segment register
|
||||
* index based on the instruction, its operands and prefixes. Hence, @insn
|
||||
* must be valid. However, if @regoff indicates rIP, we don't need to inspect
|
||||
* @insn at all as in this case CS is used in all cases. This case is checked
|
||||
* before proceeding further.
|
||||
*
|
||||
* Please note that this function does not return the value in the segment
|
||||
* register (i.e., the segment selector) but our defined index. The segment
|
||||
* selector needs to be obtained using get_segment_selector() and passing the
|
||||
* segment register index resolved by this function.
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* An index identifying the segment register to use, among CS, SS, DS,
|
||||
* ES, FS, or GS. INAT_SEG_REG_IGNORE is returned if running in long mode.
|
||||
*
|
||||
* -EINVAL in case of error.
|
||||
*/
|
||||
static int resolve_seg_reg(struct insn *insn, struct pt_regs *regs, int regoff)
|
||||
{
|
||||
int idx;
|
||||
|
||||
/*
|
||||
* In the unlikely event of having to resolve the segment register
|
||||
* index for rIP, do it first. Segment override prefixes should not
|
||||
* be used. Hence, it is not necessary to inspect the instruction,
|
||||
* which may be invalid at this point.
|
||||
*/
|
||||
if (regoff == offsetof(struct pt_regs, ip)) {
|
||||
if (user_64bit_mode(regs))
|
||||
return INAT_SEG_REG_IGNORE;
|
||||
else
|
||||
return INAT_SEG_REG_CS;
|
||||
}
|
||||
|
||||
if (!insn)
|
||||
return -EINVAL;
|
||||
|
||||
if (!check_seg_overrides(insn, regoff))
|
||||
return resolve_default_seg(insn, regs, regoff);
|
||||
|
||||
idx = get_seg_reg_override_idx(insn);
|
||||
if (idx < 0)
|
||||
return idx;
|
||||
|
||||
if (idx == INAT_SEG_REG_DEFAULT)
|
||||
return resolve_default_seg(insn, regs, regoff);
|
||||
|
||||
/*
|
||||
* In long mode, segment override prefixes are ignored, except for
|
||||
* overrides for FS and GS.
|
||||
*/
|
||||
if (user_64bit_mode(regs)) {
|
||||
if (idx != INAT_SEG_REG_FS &&
|
||||
idx != INAT_SEG_REG_GS)
|
||||
idx = INAT_SEG_REG_IGNORE;
|
||||
}
|
||||
|
||||
return idx;
|
||||
}
|
||||
|
||||
/**
|
||||
* get_segment_selector() - obtain segment selector
|
||||
* @regs: Register values as seen when entering kernel mode
|
||||
* @seg_reg_idx: Segment register index to use
|
||||
*
|
||||
* Obtain the segment selector from any of the CS, SS, DS, ES, FS, GS segment
|
||||
* registers. In CONFIG_X86_32, the segment is obtained from either pt_regs or
|
||||
* kernel_vm86_regs as applicable. In CONFIG_X86_64, CS and SS are obtained
|
||||
* from pt_regs. DS, ES, FS and GS are obtained by reading the actual CPU
|
||||
* registers. This done for only for completeness as in CONFIG_X86_64 segment
|
||||
* registers are ignored.
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* Value of the segment selector, including null when running in
|
||||
* long mode.
|
||||
*
|
||||
* -EINVAL on error.
|
||||
*/
|
||||
static short get_segment_selector(struct pt_regs *regs, int seg_reg_idx)
|
||||
{
|
||||
#ifdef CONFIG_X86_64
|
||||
unsigned short sel;
|
||||
|
||||
switch (seg_reg_idx) {
|
||||
case INAT_SEG_REG_IGNORE:
|
||||
return 0;
|
||||
case INAT_SEG_REG_CS:
|
||||
return (unsigned short)(regs->cs & 0xffff);
|
||||
case INAT_SEG_REG_SS:
|
||||
return (unsigned short)(regs->ss & 0xffff);
|
||||
case INAT_SEG_REG_DS:
|
||||
savesegment(ds, sel);
|
||||
return sel;
|
||||
case INAT_SEG_REG_ES:
|
||||
savesegment(es, sel);
|
||||
return sel;
|
||||
case INAT_SEG_REG_FS:
|
||||
savesegment(fs, sel);
|
||||
return sel;
|
||||
case INAT_SEG_REG_GS:
|
||||
savesegment(gs, sel);
|
||||
return sel;
|
||||
default:
|
||||
return -EINVAL;
|
||||
}
|
||||
#else /* CONFIG_X86_32 */
|
||||
struct kernel_vm86_regs *vm86regs = (struct kernel_vm86_regs *)regs;
|
||||
|
||||
if (v8086_mode(regs)) {
|
||||
switch (seg_reg_idx) {
|
||||
case INAT_SEG_REG_CS:
|
||||
return (unsigned short)(regs->cs & 0xffff);
|
||||
case INAT_SEG_REG_SS:
|
||||
return (unsigned short)(regs->ss & 0xffff);
|
||||
case INAT_SEG_REG_DS:
|
||||
return vm86regs->ds;
|
||||
case INAT_SEG_REG_ES:
|
||||
return vm86regs->es;
|
||||
case INAT_SEG_REG_FS:
|
||||
return vm86regs->fs;
|
||||
case INAT_SEG_REG_GS:
|
||||
return vm86regs->gs;
|
||||
case INAT_SEG_REG_IGNORE:
|
||||
/* fall through */
|
||||
default:
|
||||
return -EINVAL;
|
||||
}
|
||||
}
|
||||
|
||||
switch (seg_reg_idx) {
|
||||
case INAT_SEG_REG_CS:
|
||||
return (unsigned short)(regs->cs & 0xffff);
|
||||
case INAT_SEG_REG_SS:
|
||||
return (unsigned short)(regs->ss & 0xffff);
|
||||
case INAT_SEG_REG_DS:
|
||||
return (unsigned short)(regs->ds & 0xffff);
|
||||
case INAT_SEG_REG_ES:
|
||||
return (unsigned short)(regs->es & 0xffff);
|
||||
case INAT_SEG_REG_FS:
|
||||
return (unsigned short)(regs->fs & 0xffff);
|
||||
case INAT_SEG_REG_GS:
|
||||
/*
|
||||
* GS may or may not be in regs as per CONFIG_X86_32_LAZY_GS.
|
||||
* The macro below takes care of both cases.
|
||||
*/
|
||||
return get_user_gs(regs);
|
||||
case INAT_SEG_REG_IGNORE:
|
||||
/* fall through */
|
||||
default:
|
||||
return -EINVAL;
|
||||
}
|
||||
#endif /* CONFIG_X86_64 */
|
||||
}
|
||||
|
||||
static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
|
||||
enum reg_type type)
|
||||
{
|
||||
int regno = 0;
|
||||
|
||||
static const int regoff[] = {
|
||||
offsetof(struct pt_regs, ax),
|
||||
offsetof(struct pt_regs, cx),
|
||||
offsetof(struct pt_regs, dx),
|
||||
offsetof(struct pt_regs, bx),
|
||||
offsetof(struct pt_regs, sp),
|
||||
offsetof(struct pt_regs, bp),
|
||||
offsetof(struct pt_regs, si),
|
||||
offsetof(struct pt_regs, di),
|
||||
#ifdef CONFIG_X86_64
|
||||
offsetof(struct pt_regs, r8),
|
||||
offsetof(struct pt_regs, r9),
|
||||
offsetof(struct pt_regs, r10),
|
||||
offsetof(struct pt_regs, r11),
|
||||
offsetof(struct pt_regs, r12),
|
||||
offsetof(struct pt_regs, r13),
|
||||
offsetof(struct pt_regs, r14),
|
||||
offsetof(struct pt_regs, r15),
|
||||
#endif
|
||||
};
|
||||
int nr_registers = ARRAY_SIZE(regoff);
|
||||
/*
|
||||
* Don't possibly decode a 32-bit instructions as
|
||||
* reading a 64-bit-only register.
|
||||
*/
|
||||
if (IS_ENABLED(CONFIG_X86_64) && !insn->x86_64)
|
||||
nr_registers -= 8;
|
||||
|
||||
switch (type) {
|
||||
case REG_TYPE_RM:
|
||||
regno = X86_MODRM_RM(insn->modrm.value);
|
||||
|
||||
/*
|
||||
* ModRM.mod == 0 and ModRM.rm == 5 means a 32-bit displacement
|
||||
* follows the ModRM byte.
|
||||
*/
|
||||
if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
|
||||
return -EDOM;
|
||||
|
||||
if (X86_REX_B(insn->rex_prefix.value))
|
||||
regno += 8;
|
||||
break;
|
||||
|
||||
case REG_TYPE_INDEX:
|
||||
regno = X86_SIB_INDEX(insn->sib.value);
|
||||
if (X86_REX_X(insn->rex_prefix.value))
|
||||
regno += 8;
|
||||
|
||||
/*
|
||||
* If ModRM.mod != 3 and SIB.index = 4 the scale*index
|
||||
* portion of the address computation is null. This is
|
||||
* true only if REX.X is 0. In such a case, the SIB index
|
||||
* is used in the address computation.
|
||||
*/
|
||||
if (X86_MODRM_MOD(insn->modrm.value) != 3 && regno == 4)
|
||||
return -EDOM;
|
||||
break;
|
||||
|
||||
case REG_TYPE_BASE:
|
||||
regno = X86_SIB_BASE(insn->sib.value);
|
||||
/*
|
||||
* If ModRM.mod is 0 and SIB.base == 5, the base of the
|
||||
* register-indirect addressing is 0. In this case, a
|
||||
* 32-bit displacement follows the SIB byte.
|
||||
*/
|
||||
if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
|
||||
return -EDOM;
|
||||
|
||||
if (X86_REX_B(insn->rex_prefix.value))
|
||||
regno += 8;
|
||||
break;
|
||||
|
||||
default:
|
||||
pr_err_ratelimited("invalid register type: %d\n", type);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (regno >= nr_registers) {
|
||||
WARN_ONCE(1, "decoded an instruction with an invalid register");
|
||||
return -EINVAL;
|
||||
}
|
||||
return regoff[regno];
|
||||
}
|
||||
|
||||
/**
|
||||
* get_desc() - Obtain pointer to a segment descriptor
|
||||
* @sel: Segment selector
|
||||
*
|
||||
* Given a segment selector, obtain a pointer to the segment descriptor.
|
||||
* Both global and local descriptor tables are supported.
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* Pointer to segment descriptor on success.
|
||||
*
|
||||
* NULL on error.
|
||||
*/
|
||||
static struct desc_struct *get_desc(unsigned short sel)
|
||||
{
|
||||
struct desc_ptr gdt_desc = {0, 0};
|
||||
unsigned long desc_base;
|
||||
|
||||
#ifdef CONFIG_MODIFY_LDT_SYSCALL
|
||||
if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) {
|
||||
struct desc_struct *desc = NULL;
|
||||
struct ldt_struct *ldt;
|
||||
|
||||
/* Bits [15:3] contain the index of the desired entry. */
|
||||
sel >>= 3;
|
||||
|
||||
mutex_lock(¤t->active_mm->context.lock);
|
||||
ldt = current->active_mm->context.ldt;
|
||||
if (ldt && sel < ldt->nr_entries)
|
||||
desc = &ldt->entries[sel];
|
||||
|
||||
mutex_unlock(¤t->active_mm->context.lock);
|
||||
|
||||
return desc;
|
||||
}
|
||||
#endif
|
||||
native_store_gdt(&gdt_desc);
|
||||
|
||||
/*
|
||||
* Segment descriptors have a size of 8 bytes. Thus, the index is
|
||||
* multiplied by 8 to obtain the memory offset of the desired descriptor
|
||||
* from the base of the GDT. As bits [15:3] of the segment selector
|
||||
* contain the index, it can be regarded as multiplied by 8 already.
|
||||
* All that remains is to clear bits [2:0].
|
||||
*/
|
||||
desc_base = sel & ~(SEGMENT_RPL_MASK | SEGMENT_TI_MASK);
|
||||
|
||||
if (desc_base > gdt_desc.size)
|
||||
return NULL;
|
||||
|
||||
return (struct desc_struct *)(gdt_desc.address + desc_base);
|
||||
}
|
||||
|
||||
/**
|
||||
* insn_get_seg_base() - Obtain base address of segment descriptor.
|
||||
* @regs: Register values as seen when entering kernel mode
|
||||
* @seg_reg_idx: Index of the segment register pointing to seg descriptor
|
||||
*
|
||||
* Obtain the base address of the segment as indicated by the segment descriptor
|
||||
* pointed by the segment selector. The segment selector is obtained from the
|
||||
* input segment register index @seg_reg_idx.
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* In protected mode, base address of the segment. Zero in long mode,
|
||||
* except when FS or GS are used. In virtual-8086 mode, the segment
|
||||
* selector shifted 4 bits to the right.
|
||||
*
|
||||
* -1L in case of error.
|
||||
*/
|
||||
unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx)
|
||||
{
|
||||
struct desc_struct *desc;
|
||||
short sel;
|
||||
|
||||
sel = get_segment_selector(regs, seg_reg_idx);
|
||||
if (sel < 0)
|
||||
return -1L;
|
||||
|
||||
if (v8086_mode(regs))
|
||||
/*
|
||||
* Base is simply the segment selector shifted 4
|
||||
* bits to the right.
|
||||
*/
|
||||
return (unsigned long)(sel << 4);
|
||||
|
||||
if (user_64bit_mode(regs)) {
|
||||
/*
|
||||
* Only FS or GS will have a base address, the rest of
|
||||
* the segments' bases are forced to 0.
|
||||
*/
|
||||
unsigned long base;
|
||||
|
||||
if (seg_reg_idx == INAT_SEG_REG_FS)
|
||||
rdmsrl(MSR_FS_BASE, base);
|
||||
else if (seg_reg_idx == INAT_SEG_REG_GS)
|
||||
/*
|
||||
* swapgs was called at the kernel entry point. Thus,
|
||||
* MSR_KERNEL_GS_BASE will have the user-space GS base.
|
||||
*/
|
||||
rdmsrl(MSR_KERNEL_GS_BASE, base);
|
||||
else
|
||||
base = 0;
|
||||
return base;
|
||||
}
|
||||
|
||||
/* In protected mode the segment selector cannot be null. */
|
||||
if (!sel)
|
||||
return -1L;
|
||||
|
||||
desc = get_desc(sel);
|
||||
if (!desc)
|
||||
return -1L;
|
||||
|
||||
return get_desc_base(desc);
|
||||
}
|
||||
|
||||
/**
|
||||
* get_seg_limit() - Obtain the limit of a segment descriptor
|
||||
* @regs: Register values as seen when entering kernel mode
|
||||
* @seg_reg_idx: Index of the segment register pointing to seg descriptor
|
||||
*
|
||||
* Obtain the limit of the segment as indicated by the segment descriptor
|
||||
* pointed by the segment selector. The segment selector is obtained from the
|
||||
* input segment register index @seg_reg_idx.
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* In protected mode, the limit of the segment descriptor in bytes.
|
||||
* In long mode and virtual-8086 mode, segment limits are not enforced. Thus,
|
||||
* limit is returned as -1L to imply a limit-less segment.
|
||||
*
|
||||
* Zero is returned on error.
|
||||
*/
|
||||
static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)
|
||||
{
|
||||
struct desc_struct *desc;
|
||||
unsigned long limit;
|
||||
short sel;
|
||||
|
||||
sel = get_segment_selector(regs, seg_reg_idx);
|
||||
if (sel < 0)
|
||||
return 0;
|
||||
|
||||
if (user_64bit_mode(regs) || v8086_mode(regs))
|
||||
return -1L;
|
||||
|
||||
if (!sel)
|
||||
return 0;
|
||||
|
||||
desc = get_desc(sel);
|
||||
if (!desc)
|
||||
return 0;
|
||||
|
||||
/*
|
||||
* If the granularity bit is set, the limit is given in multiples
|
||||
* of 4096. This also means that the 12 least significant bits are
|
||||
* not tested when checking the segment limits. In practice,
|
||||
* this means that the segment ends in (limit << 12) + 0xfff.
|
||||
*/
|
||||
limit = get_desc_limit(desc);
|
||||
if (desc->g)
|
||||
limit = (limit << 12) + 0xfff;
|
||||
|
||||
return limit;
|
||||
}
|
||||
|
||||
/**
|
||||
* insn_get_code_seg_params() - Obtain code segment parameters
|
||||
* @regs: Structure with register values as seen when entering kernel mode
|
||||
*
|
||||
* Obtain address and operand sizes of the code segment. It is obtained from the
|
||||
* selector contained in the CS register in regs. In protected mode, the default
|
||||
* address is determined by inspecting the L and D bits of the segment
|
||||
* descriptor. In virtual-8086 mode, the default is always two bytes for both
|
||||
* address and operand sizes.
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* A signed 8-bit value containing the default parameters on success.
|
||||
*
|
||||
* -EINVAL on error.
|
||||
*/
|
||||
char insn_get_code_seg_params(struct pt_regs *regs)
|
||||
{
|
||||
struct desc_struct *desc;
|
||||
short sel;
|
||||
|
||||
if (v8086_mode(regs))
|
||||
/* Address and operand size are both 16-bit. */
|
||||
return INSN_CODE_SEG_PARAMS(2, 2);
|
||||
|
||||
sel = get_segment_selector(regs, INAT_SEG_REG_CS);
|
||||
if (sel < 0)
|
||||
return sel;
|
||||
|
||||
desc = get_desc(sel);
|
||||
if (!desc)
|
||||
return -EINVAL;
|
||||
|
||||
/*
|
||||
* The most significant byte of the Type field of the segment descriptor
|
||||
* determines whether a segment contains data or code. If this is a data
|
||||
* segment, return error.
|
||||
*/
|
||||
if (!(desc->type & BIT(3)))
|
||||
return -EINVAL;
|
||||
|
||||
switch ((desc->l << 1) | desc->d) {
|
||||
case 0: /*
|
||||
* Legacy mode. CS.L=0, CS.D=0. Address and operand size are
|
||||
* both 16-bit.
|
||||
*/
|
||||
return INSN_CODE_SEG_PARAMS(2, 2);
|
||||
case 1: /*
|
||||
* Legacy mode. CS.L=0, CS.D=1. Address and operand size are
|
||||
* both 32-bit.
|
||||
*/
|
||||
return INSN_CODE_SEG_PARAMS(4, 4);
|
||||
case 2: /*
|
||||
* IA-32e 64-bit mode. CS.L=1, CS.D=0. Address size is 64-bit;
|
||||
* operand size is 32-bit.
|
||||
*/
|
||||
return INSN_CODE_SEG_PARAMS(4, 8);
|
||||
case 3: /* Invalid setting. CS.L=1, CS.D=1 */
|
||||
/* fall through */
|
||||
default:
|
||||
return -EINVAL;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* insn_get_modrm_rm_off() - Obtain register in r/m part of the ModRM byte
|
||||
* @insn: Instruction containing the ModRM byte
|
||||
* @regs: Register values as seen when entering kernel mode
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* The register indicated by the r/m part of the ModRM byte. The
|
||||
* register is obtained as an offset from the base of pt_regs. In specific
|
||||
* cases, the returned value can be -EDOM to indicate that the particular value
|
||||
* of ModRM does not refer to a register and shall be ignored.
|
||||
*/
|
||||
int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs)
|
||||
{
|
||||
return get_reg_offset(insn, regs, REG_TYPE_RM);
|
||||
}
|
||||
|
||||
/**
|
||||
* get_seg_base_limit() - obtain base address and limit of a segment
|
||||
* @insn: Instruction. Must be valid.
|
||||
* @regs: Register values as seen when entering kernel mode
|
||||
* @regoff: Operand offset, in pt_regs, used to resolve segment descriptor
|
||||
* @base: Obtained segment base
|
||||
* @limit: Obtained segment limit
|
||||
*
|
||||
* Obtain the base address and limit of the segment associated with the operand
|
||||
* @regoff and, if any or allowed, override prefixes in @insn. This function is
|
||||
* different from insn_get_seg_base() as the latter does not resolve the segment
|
||||
* associated with the instruction operand. If a limit is not needed (e.g.,
|
||||
* when running in long mode), @limit can be NULL.
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* 0 on success. @base and @limit will contain the base address and of the
|
||||
* resolved segment, respectively.
|
||||
*
|
||||
* -EINVAL on error.
|
||||
*/
|
||||
static int get_seg_base_limit(struct insn *insn, struct pt_regs *regs,
|
||||
int regoff, unsigned long *base,
|
||||
unsigned long *limit)
|
||||
{
|
||||
int seg_reg_idx;
|
||||
|
||||
if (!base)
|
||||
return -EINVAL;
|
||||
|
||||
seg_reg_idx = resolve_seg_reg(insn, regs, regoff);
|
||||
if (seg_reg_idx < 0)
|
||||
return seg_reg_idx;
|
||||
|
||||
*base = insn_get_seg_base(regs, seg_reg_idx);
|
||||
if (*base == -1L)
|
||||
return -EINVAL;
|
||||
|
||||
if (!limit)
|
||||
return 0;
|
||||
|
||||
*limit = get_seg_limit(regs, seg_reg_idx);
|
||||
if (!(*limit))
|
||||
return -EINVAL;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* return the address being referenced be instruction
|
||||
* for rm=3 returning the content of the rm reg
|
||||
* for rm!=3 calculates the address using SIB and Disp
|
||||
*/
|
||||
void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs)
|
||||
{
|
||||
int addr_offset, base_offset, indx_offset, ret;
|
||||
unsigned long linear_addr = -1L, seg_base;
|
||||
long eff_addr, base, indx;
|
||||
insn_byte_t sib;
|
||||
|
||||
insn_get_modrm(insn);
|
||||
insn_get_sib(insn);
|
||||
sib = insn->sib.value;
|
||||
|
||||
if (X86_MODRM_MOD(insn->modrm.value) == 3) {
|
||||
addr_offset = get_reg_offset(insn, regs, REG_TYPE_RM);
|
||||
if (addr_offset < 0)
|
||||
goto out;
|
||||
|
||||
eff_addr = regs_get_register(regs, addr_offset);
|
||||
|
||||
} else {
|
||||
if (insn->sib.nbytes) {
|
||||
/*
|
||||
* Negative values in the base and index offset means
|
||||
* an error when decoding the SIB byte. Except -EDOM,
|
||||
* which means that the registers should not be used
|
||||
* in the address computation.
|
||||
*/
|
||||
base_offset = get_reg_offset(insn, regs, REG_TYPE_BASE);
|
||||
if (base_offset == -EDOM)
|
||||
base = 0;
|
||||
else if (base_offset < 0)
|
||||
goto out;
|
||||
else
|
||||
base = regs_get_register(regs, base_offset);
|
||||
|
||||
indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX);
|
||||
|
||||
if (indx_offset == -EDOM)
|
||||
indx = 0;
|
||||
else if (indx_offset < 0)
|
||||
goto out;
|
||||
else
|
||||
indx = regs_get_register(regs, indx_offset);
|
||||
|
||||
eff_addr = base + indx * (1 << X86_SIB_SCALE(sib));
|
||||
|
||||
/*
|
||||
* The base determines the segment used to compute
|
||||
* the linear address.
|
||||
*/
|
||||
addr_offset = base_offset;
|
||||
|
||||
} else {
|
||||
addr_offset = get_reg_offset(insn, regs, REG_TYPE_RM);
|
||||
/*
|
||||
* -EDOM means that we must ignore the address_offset.
|
||||
* In such a case, in 64-bit mode the effective address
|
||||
* relative to the RIP of the following instruction.
|
||||
*/
|
||||
if (addr_offset == -EDOM) {
|
||||
if (user_64bit_mode(regs))
|
||||
eff_addr = (long)regs->ip + insn->length;
|
||||
else
|
||||
eff_addr = 0;
|
||||
} else if (addr_offset < 0) {
|
||||
goto out;
|
||||
} else {
|
||||
eff_addr = regs_get_register(regs, addr_offset);
|
||||
}
|
||||
}
|
||||
|
||||
eff_addr += insn->displacement.value;
|
||||
}
|
||||
|
||||
ret = get_seg_base_limit(insn, regs, addr_offset, &seg_base, NULL);
|
||||
if (ret)
|
||||
goto out;
|
||||
|
||||
linear_addr = (unsigned long)eff_addr + seg_base;
|
||||
|
||||
out:
|
||||
return (void __user *)linear_addr;
|
||||
}
|
||||
@ -13,6 +13,7 @@
|
||||
#include <linux/sched/sysctl.h>
|
||||
|
||||
#include <asm/insn.h>
|
||||
#include <asm/insn-eval.h>
|
||||
#include <asm/mman.h>
|
||||
#include <asm/mmu_context.h>
|
||||
#include <asm/mpx.h>
|
||||
@ -61,123 +62,6 @@ static unsigned long mpx_mmap(unsigned long len)
|
||||
return addr;
|
||||
}
|
||||
|
||||
enum reg_type {
|
||||
REG_TYPE_RM = 0,
|
||||
REG_TYPE_INDEX,
|
||||
REG_TYPE_BASE,
|
||||
};
|
||||
|
||||
static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
|
||||
enum reg_type type)
|
||||
{
|
||||
int regno = 0;
|
||||
|
||||
static const int regoff[] = {
|
||||
offsetof(struct pt_regs, ax),
|
||||
offsetof(struct pt_regs, cx),
|
||||
offsetof(struct pt_regs, dx),
|
||||
offsetof(struct pt_regs, bx),
|
||||
offsetof(struct pt_regs, sp),
|
||||
offsetof(struct pt_regs, bp),
|
||||
offsetof(struct pt_regs, si),
|
||||
offsetof(struct pt_regs, di),
|
||||
#ifdef CONFIG_X86_64
|
||||
offsetof(struct pt_regs, r8),
|
||||
offsetof(struct pt_regs, r9),
|
||||
offsetof(struct pt_regs, r10),
|
||||
offsetof(struct pt_regs, r11),
|
||||
offsetof(struct pt_regs, r12),
|
||||
offsetof(struct pt_regs, r13),
|
||||
offsetof(struct pt_regs, r14),
|
||||
offsetof(struct pt_regs, r15),
|
||||
#endif
|
||||
};
|
||||
int nr_registers = ARRAY_SIZE(regoff);
|
||||
/*
|
||||
* Don't possibly decode a 32-bit instructions as
|
||||
* reading a 64-bit-only register.
|
||||
*/
|
||||
if (IS_ENABLED(CONFIG_X86_64) && !insn->x86_64)
|
||||
nr_registers -= 8;
|
||||
|
||||
switch (type) {
|
||||
case REG_TYPE_RM:
|
||||
regno = X86_MODRM_RM(insn->modrm.value);
|
||||
if (X86_REX_B(insn->rex_prefix.value))
|
||||
regno += 8;
|
||||
break;
|
||||
|
||||
case REG_TYPE_INDEX:
|
||||
regno = X86_SIB_INDEX(insn->sib.value);
|
||||
if (X86_REX_X(insn->rex_prefix.value))
|
||||
regno += 8;
|
||||
break;
|
||||
|
||||
case REG_TYPE_BASE:
|
||||
regno = X86_SIB_BASE(insn->sib.value);
|
||||
if (X86_REX_B(insn->rex_prefix.value))
|
||||
regno += 8;
|
||||
break;
|
||||
|
||||
default:
|
||||
pr_err("invalid register type");
|
||||
BUG();
|
||||
break;
|
||||
}
|
||||
|
||||
if (regno >= nr_registers) {
|
||||
WARN_ONCE(1, "decoded an instruction with an invalid register");
|
||||
return -EINVAL;
|
||||
}
|
||||
return regoff[regno];
|
||||
}
|
||||
|
||||
/*
|
||||
* return the address being referenced be instruction
|
||||
* for rm=3 returning the content of the rm reg
|
||||
* for rm!=3 calculates the address using SIB and Disp
|
||||
*/
|
||||
static void __user *mpx_get_addr_ref(struct insn *insn, struct pt_regs *regs)
|
||||
{
|
||||
unsigned long addr, base, indx;
|
||||
int addr_offset, base_offset, indx_offset;
|
||||
insn_byte_t sib;
|
||||
|
||||
insn_get_modrm(insn);
|
||||
insn_get_sib(insn);
|
||||
sib = insn->sib.value;
|
||||
|
||||
if (X86_MODRM_MOD(insn->modrm.value) == 3) {
|
||||
addr_offset = get_reg_offset(insn, regs, REG_TYPE_RM);
|
||||
if (addr_offset < 0)
|
||||
goto out_err;
|
||||
addr = regs_get_register(regs, addr_offset);
|
||||
} else {
|
||||
if (insn->sib.nbytes) {
|
||||
base_offset = get_reg_offset(insn, regs, REG_TYPE_BASE);
|
||||
if (base_offset < 0)
|
||||
goto out_err;
|
||||
|
||||
indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX);
|
||||
if (indx_offset < 0)
|
||||
goto out_err;
|
||||
|
||||
base = regs_get_register(regs, base_offset);
|
||||
indx = regs_get_register(regs, indx_offset);
|
||||
addr = base + indx * (1 << X86_SIB_SCALE(sib));
|
||||
} else {
|
||||
addr_offset = get_reg_offset(insn, regs, REG_TYPE_RM);
|
||||
if (addr_offset < 0)
|
||||
goto out_err;
|
||||
addr = regs_get_register(regs, addr_offset);
|
||||
}
|
||||
addr += insn->displacement.value;
|
||||
}
|
||||
return (void __user *)addr;
|
||||
out_err:
|
||||
return (void __user *)-1;
|
||||
}
|
||||
|
||||
static int mpx_insn_decode(struct insn *insn,
|
||||
struct pt_regs *regs)
|
||||
{
|
||||
@ -290,7 +174,7 @@ siginfo_t *mpx_generate_siginfo(struct pt_regs *regs)
|
||||
info->si_signo = SIGSEGV;
|
||||
info->si_errno = 0;
|
||||
info->si_code = SEGV_BNDERR;
|
||||
info->si_addr = mpx_get_addr_ref(&insn, regs);
|
||||
info->si_addr = insn_get_addr_ref(&insn, regs);
|
||||
/*
|
||||
* We were not able to extract an address from the instruction,
|
||||
* probably because there was something invalid in it.
|
||||
|
||||
Loading…
Reference in New Issue
Block a user