| /* |
| * Utility functions for x86 operand and address decoding |
| * |
| * Copyright (C) Intel Corporation 2017 |
| */ |
| #include <linux/kernel.h> |
| #include <linux/string.h> |
| #include <linux/ratelimit.h> |
| #include <linux/mmu_context.h> |
| #include <asm/desc_defs.h> |
| #include <asm/desc.h> |
| #include <asm/inat.h> |
| #include <asm/insn.h> |
| #include <asm/insn-eval.h> |
| #include <asm/ldt.h> |
| #include <asm/vm86.h> |
| |
| #undef pr_fmt |
| #define pr_fmt(fmt) "insn: " fmt |
| |
| enum reg_type { |
| REG_TYPE_RM = 0, |
| REG_TYPE_INDEX, |
| REG_TYPE_BASE, |
| }; |
| |
| /** |
| * is_string_insn() - Determine if instruction is a string instruction |
| * @insn: Instruction containing the opcode to inspect |
| * |
| * Returns: |
| * |
| * true if the instruction, determined by the opcode, is any of the |
| * string instructions as defined in the Intel Software Development manual. |
| * False otherwise. |
| */ |
| static bool is_string_insn(struct insn *insn) |
| { |
| insn_get_opcode(insn); |
| |
| /* All string instructions have a 1-byte opcode. */ |
| if (insn->opcode.nbytes != 1) |
| return false; |
| |
| switch (insn->opcode.bytes[0]) { |
| case 0x6c ... 0x6f: /* INS, OUTS */ |
| case 0xa4 ... 0xa7: /* MOVS, CMPS */ |
| case 0xaa ... 0xaf: /* STOS, LODS, SCAS */ |
| return true; |
| default: |
| return false; |
| } |
| } |
| |
| /** |
| * get_seg_reg_override_idx() - obtain segment register override index |
| * @insn: Valid instruction with segment override prefixes |
| * |
| * Inspect the instruction prefixes in @insn and find segment overrides, if any. |
| * |
| * Returns: |
| * |
| * A constant identifying the segment register to use, among CS, SS, DS, |
| * ES, FS, or GS. INAT_SEG_REG_DEFAULT is returned if no segment override |
| * prefixes were found. |
| * |
| * -EINVAL in case of error. |
| */ |
| static int get_seg_reg_override_idx(struct insn *insn) |
| { |
| int idx = INAT_SEG_REG_DEFAULT; |
| int num_overrides = 0, i; |
| |
| insn_get_prefixes(insn); |
| |
| /* Look for any segment override prefixes. */ |
| for (i = 0; i < insn->prefixes.nbytes; i++) { |
| insn_attr_t attr; |
| |
| attr = inat_get_opcode_attribute(insn->prefixes.bytes[i]); |
| switch (attr) { |
| case INAT_MAKE_PREFIX(INAT_PFX_CS): |
| idx = INAT_SEG_REG_CS; |
| num_overrides++; |
| break; |
| case INAT_MAKE_PREFIX(INAT_PFX_SS): |
| idx = INAT_SEG_REG_SS; |
| num_overrides++; |
| break; |
| case INAT_MAKE_PREFIX(INAT_PFX_DS): |
| idx = INAT_SEG_REG_DS; |
| num_overrides++; |
| break; |
| case INAT_MAKE_PREFIX(INAT_PFX_ES): |
| idx = INAT_SEG_REG_ES; |
| num_overrides++; |
| break; |
| case INAT_MAKE_PREFIX(INAT_PFX_FS): |
| idx = INAT_SEG_REG_FS; |
| num_overrides++; |
| break; |
| case INAT_MAKE_PREFIX(INAT_PFX_GS): |
| idx = INAT_SEG_REG_GS; |
| num_overrides++; |
| break; |
| /* No default action needed. */ |
| } |
| } |
| |
| /* More than one segment override prefix leads to undefined behavior. */ |
| if (num_overrides > 1) |
| return -EINVAL; |
| |
| return idx; |
| } |
| |
| /** |
| * check_seg_overrides() - check if segment override prefixes are allowed |
| * @insn: Valid instruction with segment override prefixes |
| * @regoff: Operand offset, in pt_regs, for which the check is performed |
| * |
| * For a particular register used in register-indirect addressing, determine if |
| * segment override prefixes can be used. Specifically, no overrides are allowed |
| * for rDI if used with a string instruction. |
| * |
| * Returns: |
| * |
| * True if segment override prefixes can be used with the register indicated |
| * in @regoff. False if otherwise. |
| */ |
| static bool check_seg_overrides(struct insn *insn, int regoff) |
| { |
| if (regoff == offsetof(struct pt_regs, di) && is_string_insn(insn)) |
| return false; |
| |
| return true; |
| } |
| |
| /** |
| * resolve_default_seg() - resolve default segment register index for an operand |
| * @insn: Instruction with opcode and address size. Must be valid. |
| * @regs: Register values as seen when entering kernel mode |
| * @off: Operand offset, in pt_regs, for which resolution is needed |
| * |
| * Resolve the default segment register index associated with the instruction |
| * operand register indicated by @off. Such index is resolved based on defaults |
| * described in the Intel Software Development Manual. |
| * |
| * Returns: |
| * |
| * If in protected mode, a constant identifying the segment register to use, |
| * among CS, SS, ES or DS. If in long mode, INAT_SEG_REG_IGNORE. |
| * |
| * -EINVAL in case of error. |
| */ |
| static int resolve_default_seg(struct insn *insn, struct pt_regs *regs, int off) |
| { |
| if (user_64bit_mode(regs)) |
| return INAT_SEG_REG_IGNORE; |
| /* |
| * Resolve the default segment register as described in Section 3.7.4 |
| * of the Intel Software Development Manual Vol. 1: |
| * |
| * + DS for all references involving r[ABCD]X, and rSI. |
| * + If used in a string instruction, ES for rDI. Otherwise, DS. |
| * + AX, CX and DX are not valid register operands in 16-bit address |
| * encodings but are valid for 32-bit and 64-bit encodings. |
| * + -EDOM is reserved to identify for cases in which no register |
| * is used (i.e., displacement-only addressing). Use DS. |
| * + SS for rSP or rBP. |
| * + CS for rIP. |
| */ |
| |
| switch (off) { |
| case offsetof(struct pt_regs, ax): |
| case offsetof(struct pt_regs, cx): |
| case offsetof(struct pt_regs, dx): |
| /* Need insn to verify address size. */ |
| if (insn->addr_bytes == 2) |
| return -EINVAL; |
| |
| /* fall through */ |
| |
| case -EDOM: |
| case offsetof(struct pt_regs, bx): |
| case offsetof(struct pt_regs, si): |
| return INAT_SEG_REG_DS; |
| |
| case offsetof(struct pt_regs, di): |
| if (is_string_insn(insn)) |
| return INAT_SEG_REG_ES; |
| return INAT_SEG_REG_DS; |
| |
| case offsetof(struct pt_regs, bp): |
| case offsetof(struct pt_regs, sp): |
| return INAT_SEG_REG_SS; |
| |
| case offsetof(struct pt_regs, ip): |
| return INAT_SEG_REG_CS; |
| |
| default: |
| return -EINVAL; |
| } |
| } |
| |
| /** |
| * resolve_seg_reg() - obtain segment register index |
| * @insn: Instruction with operands |
| * @regs: Register values as seen when entering kernel mode |
| * @regoff: Operand offset, in pt_regs, used to deterimine segment register |
| * |
| * Determine the segment register associated with the operands and, if |
| * applicable, prefixes and the instruction pointed by @insn. |
| * |
| * The segment register associated to an operand used in register-indirect |
| * addressing depends on: |
| * |
| * a) Whether running in long mode (in such a case segments are ignored, except |
| * if FS or GS are used). |
| * |
| * b) Whether segment override prefixes can be used. Certain instructions and |
| * registers do not allow override prefixes. |
| * |
| * c) Whether segment overrides prefixes are found in the instruction prefixes. |
| * |
| * d) If there are not segment override prefixes or they cannot be used, the |
| * default segment register associated with the operand register is used. |
| * |
| * The function checks first if segment override prefixes can be used with the |
| * operand indicated by @regoff. If allowed, obtain such overridden segment |
| * register index. Lastly, if not prefixes were found or cannot be used, resolve |
| * the segment register index to use based on the defaults described in the |
| * Intel documentation. In long mode, all segment register indexes will be |
| * ignored, except if overrides were found for FS or GS. All these operations |
| * are done using helper functions. |
| * |
| * The operand register, @regoff, is represented as the offset from the base of |
| * pt_regs. |
| * |
| * As stated, the main use of this function is to determine the segment register |
| * index based on the instruction, its operands and prefixes. Hence, @insn |
| * must be valid. However, if @regoff indicates rIP, we don't need to inspect |
| * @insn at all as in this case CS is used in all cases. This case is checked |
| * before proceeding further. |
| * |
| * Please note that this function does not return the value in the segment |
| * register (i.e., the segment selector) but our defined index. The segment |
| * selector needs to be obtained using get_segment_selector() and passing the |
| * segment register index resolved by this function. |
| * |
| * Returns: |
| * |
| * An index identifying the segment register to use, among CS, SS, DS, |
| * ES, FS, or GS. INAT_SEG_REG_IGNORE is returned if running in long mode. |
| * |
| * -EINVAL in case of error. |
| */ |
| static int resolve_seg_reg(struct insn *insn, struct pt_regs *regs, int regoff) |
| { |
| int idx; |
| |
| /* |
| * In the unlikely event of having to resolve the segment register |
| * index for rIP, do it first. Segment override prefixes should not |
| * be used. Hence, it is not necessary to inspect the instruction, |
| * which may be invalid at this point. |
| */ |
| if (regoff == offsetof(struct pt_regs, ip)) { |
| if (user_64bit_mode(regs)) |
| return INAT_SEG_REG_IGNORE; |
| else |
| return INAT_SEG_REG_CS; |
| } |
| |
| if (!insn) |
| return -EINVAL; |
| |
| if (!check_seg_overrides(insn, regoff)) |
| return resolve_default_seg(insn, regs, regoff); |
| |
| idx = get_seg_reg_override_idx(insn); |
| if (idx < 0) |
| return idx; |
| |
| if (idx == INAT_SEG_REG_DEFAULT) |
| return resolve_default_seg(insn, regs, regoff); |
| |
| /* |
| * In long mode, segment override prefixes are ignored, except for |
| * overrides for FS and GS. |
| */ |
| if (user_64bit_mode(regs)) { |
| if (idx != INAT_SEG_REG_FS && |
| idx != INAT_SEG_REG_GS) |
| idx = INAT_SEG_REG_IGNORE; |
| } |
| |
| return idx; |
| } |
| |
| /** |
| * get_segment_selector() - obtain segment selector |
| * @regs: Register values as seen when entering kernel mode |
| * @seg_reg_idx: Segment register index to use |
| * |
| * Obtain the segment selector from any of the CS, SS, DS, ES, FS, GS segment |
| * registers. In CONFIG_X86_32, the segment is obtained from either pt_regs or |
| * kernel_vm86_regs as applicable. In CONFIG_X86_64, CS and SS are obtained |
| * from pt_regs. DS, ES, FS and GS are obtained by reading the actual CPU |
| * registers. This done for only for completeness as in CONFIG_X86_64 segment |
| * registers are ignored. |
| * |
| * Returns: |
| * |
| * Value of the segment selector, including null when running in |
| * long mode. |
| * |
| * -EINVAL on error. |
| */ |
| static short get_segment_selector(struct pt_regs *regs, int seg_reg_idx) |
| { |
| #ifdef CONFIG_X86_64 |
| unsigned short sel; |
| |
| switch (seg_reg_idx) { |
| case INAT_SEG_REG_IGNORE: |
| return 0; |
| case INAT_SEG_REG_CS: |
| return (unsigned short)(regs->cs & 0xffff); |
| case INAT_SEG_REG_SS: |
| return (unsigned short)(regs->ss & 0xffff); |
| case INAT_SEG_REG_DS: |
| savesegment(ds, sel); |
| return sel; |
| case INAT_SEG_REG_ES: |
| savesegment(es, sel); |
| return sel; |
| case INAT_SEG_REG_FS: |
| savesegment(fs, sel); |
| return sel; |
| case INAT_SEG_REG_GS: |
| savesegment(gs, sel); |
| return sel; |
| default: |
| return -EINVAL; |
| } |
| #else /* CONFIG_X86_32 */ |
| struct kernel_vm86_regs *vm86regs = (struct kernel_vm86_regs *)regs; |
| |
| if (v8086_mode(regs)) { |
| switch (seg_reg_idx) { |
| case INAT_SEG_REG_CS: |
| return (unsigned short)(regs->cs & 0xffff); |
| case INAT_SEG_REG_SS: |
| return (unsigned short)(regs->ss & 0xffff); |
| case INAT_SEG_REG_DS: |
| return vm86regs->ds; |
| case INAT_SEG_REG_ES: |
| return vm86regs->es; |
| case INAT_SEG_REG_FS: |
| return vm86regs->fs; |
| case INAT_SEG_REG_GS: |
| return vm86regs->gs; |
| case INAT_SEG_REG_IGNORE: |
| /* fall through */ |
| default: |
| return -EINVAL; |
| } |
| } |
| |
| switch (seg_reg_idx) { |
| case INAT_SEG_REG_CS: |
| return (unsigned short)(regs->cs & 0xffff); |
| case INAT_SEG_REG_SS: |
| return (unsigned short)(regs->ss & 0xffff); |
| case INAT_SEG_REG_DS: |
| return (unsigned short)(regs->ds & 0xffff); |
| case INAT_SEG_REG_ES: |
| return (unsigned short)(regs->es & 0xffff); |
| case INAT_SEG_REG_FS: |
| return (unsigned short)(regs->fs & 0xffff); |
| case INAT_SEG_REG_GS: |
| /* |
| * GS may or may not be in regs as per CONFIG_X86_32_LAZY_GS. |
| * The macro below takes care of both cases. |
| */ |
| return get_user_gs(regs); |
| case INAT_SEG_REG_IGNORE: |
| /* fall through */ |
| default: |
| return -EINVAL; |
| } |
| #endif /* CONFIG_X86_64 */ |
| } |
| |
| static int get_reg_offset(struct insn *insn, struct pt_regs *regs, |
| enum reg_type type) |
| { |
| int regno = 0; |
| |
| static const int regoff[] = { |
| offsetof(struct pt_regs, ax), |
| offsetof(struct pt_regs, cx), |
| offsetof(struct pt_regs, dx), |
| offsetof(struct pt_regs, bx), |
| offsetof(struct pt_regs, sp), |
| offsetof(struct pt_regs, bp), |
| offsetof(struct pt_regs, si), |
| offsetof(struct pt_regs, di), |
| #ifdef CONFIG_X86_64 |
| offsetof(struct pt_regs, r8), |
| offsetof(struct pt_regs, r9), |
| offsetof(struct pt_regs, r10), |
| offsetof(struct pt_regs, r11), |
| offsetof(struct pt_regs, r12), |
| offsetof(struct pt_regs, r13), |
| offsetof(struct pt_regs, r14), |
| offsetof(struct pt_regs, r15), |
| #endif |
| }; |
| int nr_registers = ARRAY_SIZE(regoff); |
| /* |
| * Don't possibly decode a 32-bit instructions as |
| * reading a 64-bit-only register. |
| */ |
| if (IS_ENABLED(CONFIG_X86_64) && !insn->x86_64) |
| nr_registers -= 8; |
| |
| switch (type) { |
| case REG_TYPE_RM: |
| regno = X86_MODRM_RM(insn->modrm.value); |
| |
| /* |
| * ModRM.mod == 0 and ModRM.rm == 5 means a 32-bit displacement |
| * follows the ModRM byte. |
| */ |
| if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5) |
| return -EDOM; |
| |
| if (X86_REX_B(insn->rex_prefix.value)) |
| regno += 8; |
| break; |
| |
| case REG_TYPE_INDEX: |
| regno = X86_SIB_INDEX(insn->sib.value); |
| if (X86_REX_X(insn->rex_prefix.value)) |
| regno += 8; |
| |
| /* |
| * If ModRM.mod != 3 and SIB.index = 4 the scale*index |
| * portion of the address computation is null. This is |
| * true only if REX.X is 0. In such a case, the SIB index |
| * is used in the address computation. |
| */ |
| if (X86_MODRM_MOD(insn->modrm.value) != 3 && regno == 4) |
| return -EDOM; |
| break; |
| |
| case REG_TYPE_BASE: |
| regno = X86_SIB_BASE(insn->sib.value); |
| /* |
| * If ModRM.mod is 0 and SIB.base == 5, the base of the |
| * register-indirect addressing is 0. In this case, a |
| * 32-bit displacement follows the SIB byte. |
| */ |
| if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5) |
| return -EDOM; |
| |
| if (X86_REX_B(insn->rex_prefix.value)) |
| regno += 8; |
| break; |
| |
| default: |
| pr_err_ratelimited("invalid register type: %d\n", type); |
| return -EINVAL; |
| } |
| |
| if (regno >= nr_registers) { |
| WARN_ONCE(1, "decoded an instruction with an invalid register"); |
| return -EINVAL; |
| } |
| return regoff[regno]; |
| } |
| |
| /** |
| * get_reg_offset_16() - Obtain offset of register indicated by instruction |
| * @insn: Instruction containing ModRM byte |
| * @regs: Register values as seen when entering kernel mode |
| * @offs1: Offset of the first operand register |
| * @offs2: Offset of the second opeand register, if applicable |
| * |
| * Obtain the offset, in pt_regs, of the registers indicated by the ModRM byte |
| * in @insn. This function is to be used with 16-bit address encodings. The |
| * @offs1 and @offs2 will be written with the offset of the two registers |
| * indicated by the instruction. In cases where any of the registers is not |
| * referenced by the instruction, the value will be set to -EDOM. |
| * |
| * Returns: |
| * |
| * 0 on success, -EINVAL on error. |
| */ |
| static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs, |
| int *offs1, int *offs2) |
| { |
| /* |
| * 16-bit addressing can use one or two registers. Specifics of |
| * encodings are given in Table 2-1. "16-Bit Addressing Forms with the |
| * ModR/M Byte" of the Intel Software Development Manual. |
| */ |
| static const int regoff1[] = { |
| offsetof(struct pt_regs, bx), |
| offsetof(struct pt_regs, bx), |
| offsetof(struct pt_regs, bp), |
| offsetof(struct pt_regs, bp), |
| offsetof(struct pt_regs, si), |
| offsetof(struct pt_regs, di), |
| offsetof(struct pt_regs, bp), |
| offsetof(struct pt_regs, bx), |
| }; |
| |
| static const int regoff2[] = { |
| offsetof(struct pt_regs, si), |
| offsetof(struct pt_regs, di), |
| offsetof(struct pt_regs, si), |
| offsetof(struct pt_regs, di), |
| -EDOM, |
| -EDOM, |
| -EDOM, |
| -EDOM, |
| }; |
| |
| if (!offs1 || !offs2) |
| return -EINVAL; |
| |
| /* Operand is a register, use the generic function. */ |
| if (X86_MODRM_MOD(insn->modrm.value) == 3) { |
| *offs1 = insn_get_modrm_rm_off(insn, regs); |
| *offs2 = -EDOM; |
| return 0; |
| } |
| |
| *offs1 = regoff1[X86_MODRM_RM(insn->modrm.value)]; |
| *offs2 = regoff2[X86_MODRM_RM(insn->modrm.value)]; |
| |
| /* |
| * If ModRM.mod is 0 and ModRM.rm is 110b, then we use displacement- |
| * only addressing. This means that no registers are involved in |
| * computing the effective address. Thus, ensure that the first |
| * register offset is invalild. The second register offset is already |
| * invalid under the aforementioned conditions. |
| */ |
| if ((X86_MODRM_MOD(insn->modrm.value) == 0) && |
| (X86_MODRM_RM(insn->modrm.value) == 6)) |
| *offs1 = -EDOM; |
| |
| return 0; |
| } |
| |
| /** |
| * get_desc() - Obtain contents of a segment descriptor |
| * @out: Segment descriptor contents on success |
| * @sel: Segment selector |
| * |
| * Given a segment selector, obtain a pointer to the segment descriptor. |
| * Both global and local descriptor tables are supported. |
| * |
| * Returns: |
| * |
| * True on success, false on failure. |
| * |
| * NULL on error. |
| */ |
| static bool get_desc(struct desc_struct *out, unsigned short sel) |
| { |
| struct desc_ptr gdt_desc = {0, 0}; |
| unsigned long desc_base; |
| |
| #ifdef CONFIG_MODIFY_LDT_SYSCALL |
| if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) { |
| bool success = false; |
| struct ldt_struct *ldt; |
| |
| /* Bits [15:3] contain the index of the desired entry. */ |
| sel >>= 3; |
| |
| mutex_lock(¤t->active_mm->context.lock); |
| ldt = current->active_mm->context.ldt; |
| if (ldt && sel < ldt->nr_entries) { |
| *out = ldt->entries[sel]; |
| success = true; |
| } |
| |
| mutex_unlock(¤t->active_mm->context.lock); |
| |
| return success; |
| } |
| #endif |
| native_store_gdt(&gdt_desc); |
| |
| /* |
| * Segment descriptors have a size of 8 bytes. Thus, the index is |
| * multiplied by 8 to obtain the memory offset of the desired descriptor |
| * from the base of the GDT. As bits [15:3] of the segment selector |
| * contain the index, it can be regarded as multiplied by 8 already. |
| * All that remains is to clear bits [2:0]. |
| */ |
| desc_base = sel & ~(SEGMENT_RPL_MASK | SEGMENT_TI_MASK); |
| |
| if (desc_base > gdt_desc.size) |
| return false; |
| |
| *out = *(struct desc_struct *)(gdt_desc.address + desc_base); |
| return true; |
| } |
| |
| /** |
| * insn_get_seg_base() - Obtain base address of segment descriptor. |
| * @regs: Register values as seen when entering kernel mode |
| * @seg_reg_idx: Index of the segment register pointing to seg descriptor |
| * |
| * Obtain the base address of the segment as indicated by the segment descriptor |
| * pointed by the segment selector. The segment selector is obtained from the |
| * input segment register index @seg_reg_idx. |
| * |
| * Returns: |
| * |
| * In protected mode, base address of the segment. Zero in long mode, |
| * except when FS or GS are used. In virtual-8086 mode, the segment |
| * selector shifted 4 bits to the right. |
| * |
| * -1L in case of error. |
| */ |
| unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx) |
| { |
| struct desc_struct desc; |
| short sel; |
| |
| sel = get_segment_selector(regs, seg_reg_idx); |
| if (sel < 0) |
| return -1L; |
| |
| if (v8086_mode(regs)) |
| /* |
| * Base is simply the segment selector shifted 4 |
| * bits to the right. |
| */ |
| return (unsigned long)(sel << 4); |
| |
| if (user_64bit_mode(regs)) { |
| /* |
| * Only FS or GS will have a base address, the rest of |
| * the segments' bases are forced to 0. |
| */ |
| unsigned long base; |
| |
| if (seg_reg_idx == INAT_SEG_REG_FS) |
| rdmsrl(MSR_FS_BASE, base); |
| else if (seg_reg_idx == INAT_SEG_REG_GS) |
| /* |
| * swapgs was called at the kernel entry point. Thus, |
| * MSR_KERNEL_GS_BASE will have the user-space GS base. |
| */ |
| rdmsrl(MSR_KERNEL_GS_BASE, base); |
| else |
| base = 0; |
| return base; |
| } |
| |
| /* In protected mode the segment selector cannot be null. */ |
| if (!sel) |
| return -1L; |
| |
| if (!get_desc(&desc, sel)) |
| return -1L; |
| |
| return get_desc_base(&desc); |
| } |
| |
| /** |
| * get_seg_limit() - Obtain the limit of a segment descriptor |
| * @regs: Register values as seen when entering kernel mode |
| * @seg_reg_idx: Index of the segment register pointing to seg descriptor |
| * |
| * Obtain the limit of the segment as indicated by the segment descriptor |
| * pointed by the segment selector. The segment selector is obtained from the |
| * input segment register index @seg_reg_idx. |
| * |
| * Returns: |
| * |
| * In protected mode, the limit of the segment descriptor in bytes. |
| * In long mode and virtual-8086 mode, segment limits are not enforced. Thus, |
| * limit is returned as -1L to imply a limit-less segment. |
| * |
| * Zero is returned on error. |
| */ |
| static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx) |
| { |
| struct desc_struct desc; |
| unsigned long limit; |
| short sel; |
| |
| sel = get_segment_selector(regs, seg_reg_idx); |
| if (sel < 0) |
| return 0; |
| |
| if (user_64bit_mode(regs) || v8086_mode(regs)) |
| return -1L; |
| |
| if (!sel) |
| return 0; |
| |
| if (!get_desc(&desc, sel)) |
| return 0; |
| |
| /* |
| * If the granularity bit is set, the limit is given in multiples |
| * of 4096. This also means that the 12 least significant bits are |
| * not tested when checking the segment limits. In practice, |
| * this means that the segment ends in (limit << 12) + 0xfff. |
| */ |
| limit = get_desc_limit(&desc); |
| if (desc.g) |
| limit = (limit << 12) + 0xfff; |
| |
| return limit; |
| } |
| |
| /** |
| * insn_get_code_seg_params() - Obtain code segment parameters |
| * @regs: Structure with register values as seen when entering kernel mode |
| * |
| * Obtain address and operand sizes of the code segment. It is obtained from the |
| * selector contained in the CS register in regs. In protected mode, the default |
| * address is determined by inspecting the L and D bits of the segment |
| * descriptor. In virtual-8086 mode, the default is always two bytes for both |
| * address and operand sizes. |
| * |
| * Returns: |
| * |
| * An int containing ORed-in default parameters on success. |
| * |
| * -EINVAL on error. |
| */ |
| int insn_get_code_seg_params(struct pt_regs *regs) |
| { |
| struct desc_struct desc; |
| short sel; |
| |
| if (v8086_mode(regs)) |
| /* Address and operand size are both 16-bit. */ |
| return INSN_CODE_SEG_PARAMS(2, 2); |
| |
| sel = get_segment_selector(regs, INAT_SEG_REG_CS); |
| if (sel < 0) |
| return sel; |
| |
| if (!get_desc(&desc, sel)) |
| return -EINVAL; |
| |
| /* |
| * The most significant byte of the Type field of the segment descriptor |
| * determines whether a segment contains data or code. If this is a data |
| * segment, return error. |
| */ |
| if (!(desc.type & BIT(3))) |
| return -EINVAL; |
| |
| switch ((desc.l << 1) | desc.d) { |
| case 0: /* |
| * Legacy mode. CS.L=0, CS.D=0. Address and operand size are |
| * both 16-bit. |
| */ |
| return INSN_CODE_SEG_PARAMS(2, 2); |
| case 1: /* |
| * Legacy mode. CS.L=0, CS.D=1. Address and operand size are |
| * both 32-bit. |
| */ |
| return INSN_CODE_SEG_PARAMS(4, 4); |
| case 2: /* |
| * IA-32e 64-bit mode. CS.L=1, CS.D=0. Address size is 64-bit; |
| * operand size is 32-bit. |
| */ |
| return INSN_CODE_SEG_PARAMS(4, 8); |
| case 3: /* Invalid setting. CS.L=1, CS.D=1 */ |
| /* fall through */ |
| default: |
| return -EINVAL; |
| } |
| } |
| |
| /** |
| * insn_get_modrm_rm_off() - Obtain register in r/m part of the ModRM byte |
| * @insn: Instruction containing the ModRM byte |
| * @regs: Register values as seen when entering kernel mode |
| * |
| * Returns: |
| * |
| * The register indicated by the r/m part of the ModRM byte. The |
| * register is obtained as an offset from the base of pt_regs. In specific |
| * cases, the returned value can be -EDOM to indicate that the particular value |
| * of ModRM does not refer to a register and shall be ignored. |
| */ |
| int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs) |
| { |
| return get_reg_offset(insn, regs, REG_TYPE_RM); |
| } |
| |
| /** |
| * get_seg_base_limit() - obtain base address and limit of a segment |
| * @insn: Instruction. Must be valid. |
| * @regs: Register values as seen when entering kernel mode |
| * @regoff: Operand offset, in pt_regs, used to resolve segment descriptor |
| * @base: Obtained segment base |
| * @limit: Obtained segment limit |
| * |
| * Obtain the base address and limit of the segment associated with the operand |
| * @regoff and, if any or allowed, override prefixes in @insn. This function is |
| * different from insn_get_seg_base() as the latter does not resolve the segment |
| * associated with the instruction operand. If a limit is not needed (e.g., |
| * when running in long mode), @limit can be NULL. |
| * |
| * Returns: |
| * |
| * 0 on success. @base and @limit will contain the base address and of the |
| * resolved segment, respectively. |
| * |
| * -EINVAL on error. |
| */ |
| static int get_seg_base_limit(struct insn *insn, struct pt_regs *regs, |
| int regoff, unsigned long *base, |
| unsigned long *limit) |
| { |
| int seg_reg_idx; |
| |
| if (!base) |
| return -EINVAL; |
| |
| seg_reg_idx = resolve_seg_reg(insn, regs, regoff); |
| if (seg_reg_idx < 0) |
| return seg_reg_idx; |
| |
| *base = insn_get_seg_base(regs, seg_reg_idx); |
| if (*base == -1L) |
| return -EINVAL; |
| |
| if (!limit) |
| return 0; |
| |
| *limit = get_seg_limit(regs, seg_reg_idx); |
| if (!(*limit)) |
| return -EINVAL; |
| |
| return 0; |
| } |
| |
| /** |
| * get_eff_addr_reg() - Obtain effective address from register operand |
| * @insn: Instruction. Must be valid. |
| * @regs: Register values as seen when entering kernel mode |
| * @regoff: Obtained operand offset, in pt_regs, with the effective address |
| * @eff_addr: Obtained effective address |
| * |
| * Obtain the effective address stored in the register operand as indicated by |
| * the ModRM byte. This function is to be used only with register addressing |
| * (i.e., ModRM.mod is 3). The effective address is saved in @eff_addr. The |
| * register operand, as an offset from the base of pt_regs, is saved in @regoff; |
| * such offset can then be used to resolve the segment associated with the |
| * operand. This function can be used with any of the supported address sizes |
| * in x86. |
| * |
| * Returns: |
| * |
| * 0 on success. @eff_addr will have the effective address stored in the |
| * operand indicated by ModRM. @regoff will have such operand as an offset from |
| * the base of pt_regs. |
| * |
| * -EINVAL on error. |
| */ |
| static int get_eff_addr_reg(struct insn *insn, struct pt_regs *regs, |
| int *regoff, long *eff_addr) |
| { |
| insn_get_modrm(insn); |
| |
| if (!insn->modrm.nbytes) |
| return -EINVAL; |
| |
| if (X86_MODRM_MOD(insn->modrm.value) != 3) |
| return -EINVAL; |
| |
| *regoff = get_reg_offset(insn, regs, REG_TYPE_RM); |
| if (*regoff < 0) |
| return -EINVAL; |
| |
| /* Ignore bytes that are outside the address size. */ |
| if (insn->addr_bytes == 2) |
| *eff_addr = regs_get_register(regs, *regoff) & 0xffff; |
| else if (insn->addr_bytes == 4) |
| *eff_addr = regs_get_register(regs, *regoff) & 0xffffffff; |
| else /* 64-bit address */ |
| *eff_addr = regs_get_register(regs, *regoff); |
| |
| return 0; |
| } |
| |
| /** |
| * get_eff_addr_modrm() - Obtain referenced effective address via ModRM |
| * @insn: Instruction. Must be valid. |
| * @regs: Register values as seen when entering kernel mode |
| * @regoff: Obtained operand offset, in pt_regs, associated with segment |
| * @eff_addr: Obtained effective address |
| * |
| * Obtain the effective address referenced by the ModRM byte of @insn. After |
| * identifying the registers involved in the register-indirect memory reference, |
| * its value is obtained from the operands in @regs. The computed address is |
| * stored @eff_addr. Also, the register operand that indicates the associated |
| * segment is stored in @regoff, this parameter can later be used to determine |
| * such segment. |
| * |
| * Returns: |
| * |
| * 0 on success. @eff_addr will have the referenced effective address. @regoff |
| * will have a register, as an offset from the base of pt_regs, that can be used |
| * to resolve the associated segment. |
| * |
| * -EINVAL on error. |
| */ |
| static int get_eff_addr_modrm(struct insn *insn, struct pt_regs *regs, |
| int *regoff, long *eff_addr) |
| { |
| long tmp; |
| |
| if (insn->addr_bytes != 8 && insn->addr_bytes != 4) |
| return -EINVAL; |
| |
| insn_get_modrm(insn); |
| |
| if (!insn->modrm.nbytes) |
| return -EINVAL; |
| |
| if (X86_MODRM_MOD(insn->modrm.value) > 2) |
| return -EINVAL; |
| |
| *regoff = get_reg_offset(insn, regs, REG_TYPE_RM); |
| |
| /* |
| * -EDOM means that we must ignore the address_offset. In such a case, |
| * in 64-bit mode the effective address relative to the rIP of the |
| * following instruction. |
| */ |
| if (*regoff == -EDOM) { |
| if (user_64bit_mode(regs)) |
| tmp = regs->ip + insn->length; |
| else |
| tmp = 0; |
| } else if (*regoff < 0) { |
| return -EINVAL; |
| } else { |
| tmp = regs_get_register(regs, *regoff); |
| } |
| |
| if (insn->addr_bytes == 4) { |
| int addr32 = (int)(tmp & 0xffffffff) + insn->displacement.value; |
| |
| *eff_addr = addr32 & 0xffffffff; |
| } else { |
| *eff_addr = tmp + insn->displacement.value; |
| } |
| |
| return 0; |
| } |
| |
| /** |
| * get_eff_addr_modrm_16() - Obtain referenced effective address via ModRM |
| * @insn: Instruction. Must be valid. |
| * @regs: Register values as seen when entering kernel mode |
| * @regoff: Obtained operand offset, in pt_regs, associated with segment |
| * @eff_addr: Obtained effective address |
| * |
| * Obtain the 16-bit effective address referenced by the ModRM byte of @insn. |
| * After identifying the registers involved in the register-indirect memory |
| * reference, its value is obtained from the operands in @regs. The computed |
| * address is stored @eff_addr. Also, the register operand that indicates |
| * the associated segment is stored in @regoff, this parameter can later be used |
| * to determine such segment. |
| * |
| * Returns: |
| * |
| * 0 on success. @eff_addr will have the referenced effective address. @regoff |
| * will have a register, as an offset from the base of pt_regs, that can be used |
| * to resolve the associated segment. |
| * |
| * -EINVAL on error. |
| */ |
| static int get_eff_addr_modrm_16(struct insn *insn, struct pt_regs *regs, |
| int *regoff, short *eff_addr) |
| { |
| int addr_offset1, addr_offset2, ret; |
| short addr1 = 0, addr2 = 0, displacement; |
| |
| if (insn->addr_bytes != 2) |
| return -EINVAL; |
| |
| insn_get_modrm(insn); |
| |
| if (!insn->modrm.nbytes) |
| return -EINVAL; |
| |
| if (X86_MODRM_MOD(insn->modrm.value) > 2) |
| return -EINVAL; |
| |
| ret = get_reg_offset_16(insn, regs, &addr_offset1, &addr_offset2); |
| if (ret < 0) |
| return -EINVAL; |
| |
| /* |
| * Don't fail on invalid offset values. They might be invalid because |
| * they cannot be used for this particular value of ModRM. Instead, use |
| * them in the computation only if they contain a valid value. |
| */ |
| if (addr_offset1 != -EDOM) |
| addr1 = regs_get_register(regs, addr_offset1) & 0xffff; |
| |
| if (addr_offset2 != -EDOM) |
| addr2 = regs_get_register(regs, addr_offset2) & 0xffff; |
| |
| displacement = insn->displacement.value & 0xffff; |
| *eff_addr = addr1 + addr2 + displacement; |
| |
| /* |
| * The first operand register could indicate to use of either SS or DS |
| * registers to obtain the segment selector. The second operand |
| * register can only indicate the use of DS. Thus, the first operand |
| * will be used to obtain the segment selector. |
| */ |
| *regoff = addr_offset1; |
| |
| return 0; |
| } |
| |
| /** |
| * get_eff_addr_sib() - Obtain referenced effective address via SIB |
| * @insn: Instruction. Must be valid. |
| * @regs: Register values as seen when entering kernel mode |
| * @regoff: Obtained operand offset, in pt_regs, associated with segment |
| * @eff_addr: Obtained effective address |
| * |
| * Obtain the effective address referenced by the SIB byte of @insn. After |
| * identifying the registers involved in the indexed, register-indirect memory |
| * reference, its value is obtained from the operands in @regs. The computed |
| * address is stored @eff_addr. Also, the register operand that indicates the |
| * associated segment is stored in @regoff, this parameter can later be used to |
| * determine such segment. |
| * |
| * Returns: |
| * |
| * 0 on success. @eff_addr will have the referenced effective address. |
| * @base_offset will have a register, as an offset from the base of pt_regs, |
| * that can be used to resolve the associated segment. |
| * |
| * -EINVAL on error. |
| */ |
| static int get_eff_addr_sib(struct insn *insn, struct pt_regs *regs, |
| int *base_offset, long *eff_addr) |
| { |
| long base, indx; |
| int indx_offset; |
| |
| if (insn->addr_bytes != 8 && insn->addr_bytes != 4) |
| return -EINVAL; |
| |
| insn_get_modrm(insn); |
| |
| if (!insn->modrm.nbytes) |
| return -EINVAL; |
| |
| if (X86_MODRM_MOD(insn->modrm.value) > 2) |
| return -EINVAL; |
| |
| insn_get_sib(insn); |
| |
| if (!insn->sib.nbytes) |
| return -EINVAL; |
| |
| *base_offset = get_reg_offset(insn, regs, REG_TYPE_BASE); |
| indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX); |
| |
| /* |
| * Negative values in the base and index offset means an error when |
| * decoding the SIB byte. Except -EDOM, which means that the registers |
| * should not be used in the address computation. |
| */ |
| if (*base_offset == -EDOM) |
| base = 0; |
| else if (*base_offset < 0) |
| return -EINVAL; |
| else |
| base = regs_get_register(regs, *base_offset); |
| |
| if (indx_offset == -EDOM) |
| indx = 0; |
| else if (indx_offset < 0) |
| return -EINVAL; |
| else |
| indx = regs_get_register(regs, indx_offset); |
| |
| if (insn->addr_bytes == 4) { |
| int addr32, base32, idx32; |
| |
| base32 = base & 0xffffffff; |
| idx32 = indx & 0xffffffff; |
| |
| addr32 = base32 + idx32 * (1 << X86_SIB_SCALE(insn->sib.value)); |
| addr32 += insn->displacement.value; |
| |
| *eff_addr = addr32 & 0xffffffff; |
| } else { |
| *eff_addr = base + indx * (1 << X86_SIB_SCALE(insn->sib.value)); |
| *eff_addr += insn->displacement.value; |
| } |
| |
| return 0; |
| } |
| |
| /** |
| * get_addr_ref_16() - Obtain the 16-bit address referred by instruction |
| * @insn: Instruction containing ModRM byte and displacement |
| * @regs: Register values as seen when entering kernel mode |
| * |
| * This function is to be used with 16-bit address encodings. Obtain the memory |
| * address referred by the instruction's ModRM and displacement bytes. Also, the |
| * segment used as base is determined by either any segment override prefixes in |
| * @insn or the default segment of the registers involved in the address |
| * computation. In protected mode, segment limits are enforced. |
| * |
| * Returns: |
| * |
| * Linear address referenced by the instruction operands on success. |
| * |
| * -1L on error. |
| */ |
| static void __user *get_addr_ref_16(struct insn *insn, struct pt_regs *regs) |
| { |
| unsigned long linear_addr = -1L, seg_base, seg_limit; |
| int ret, regoff; |
| short eff_addr; |
| long tmp; |
| |
| insn_get_modrm(insn); |
| insn_get_displacement(insn); |
| |
| if (insn->addr_bytes != 2) |
| goto out; |
| |
| if (X86_MODRM_MOD(insn->modrm.value) == 3) { |
| ret = get_eff_addr_reg(insn, regs, ®off, &tmp); |
| if (ret) |
| goto out; |
| |
| eff_addr = tmp; |
| } else { |
| ret = get_eff_addr_modrm_16(insn, regs, ®off, &eff_addr); |
| if (ret) |
| goto out; |
| } |
| |
| ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit); |
| if (ret) |
| goto out; |
| |
| /* |
| * Before computing the linear address, make sure the effective address |
| * is within the limits of the segment. In virtual-8086 mode, segment |
| * limits are not enforced. In such a case, the segment limit is -1L to |
| * reflect this fact. |
| */ |
| if ((unsigned long)(eff_addr & 0xffff) > seg_limit) |
| goto out; |
| |
| linear_addr = (unsigned long)(eff_addr & 0xffff) + seg_base; |
| |
| /* Limit linear address to 20 bits */ |
| if (v8086_mode(regs)) |
| linear_addr &= 0xfffff; |
| |
| out: |
| return (void __user *)linear_addr; |
| } |
| |
| /** |
| * get_addr_ref_32() - Obtain a 32-bit linear address |
| * @insn: Instruction with ModRM, SIB bytes and displacement |
| * @regs: Register values as seen when entering kernel mode |
| * |
| * This function is to be used with 32-bit address encodings to obtain the |
| * linear memory address referred by the instruction's ModRM, SIB, |
| * displacement bytes and segment base address, as applicable. If in protected |
| * mode, segment limits are enforced. |
| * |
| * Returns: |
| * |
| * Linear address referenced by instruction and registers on success. |
| * |
| * -1L on error. |
| */ |
| static void __user *get_addr_ref_32(struct insn *insn, struct pt_regs *regs) |
| { |
| unsigned long linear_addr = -1L, seg_base, seg_limit; |
| int eff_addr, regoff; |
| long tmp; |
| int ret; |
| |
| if (insn->addr_bytes != 4) |
| goto out; |
| |
| if (X86_MODRM_MOD(insn->modrm.value) == 3) { |
| ret = get_eff_addr_reg(insn, regs, ®off, &tmp); |
| if (ret) |
| goto out; |
| |
| eff_addr = tmp; |
| |
| } else { |
| if (insn->sib.nbytes) { |
| ret = get_eff_addr_sib(insn, regs, ®off, &tmp); |
| if (ret) |
| goto out; |
| |
| eff_addr = tmp; |
| } else { |
| ret = get_eff_addr_modrm(insn, regs, ®off, &tmp); |
| if (ret) |
| goto out; |
| |
| eff_addr = tmp; |
| } |
| } |
| |
| ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit); |
| if (ret) |
| goto out; |
| |
| /* |
| * In protected mode, before computing the linear address, make sure |
| * the effective address is within the limits of the segment. |
| * 32-bit addresses can be used in long and virtual-8086 modes if an |
| * address override prefix is used. In such cases, segment limits are |
| * not enforced. When in virtual-8086 mode, the segment limit is -1L |
| * to reflect this situation. |
| * |
| * After computed, the effective address is treated as an unsigned |
| * quantity. |
| */ |
| if (!user_64bit_mode(regs) && ((unsigned int)eff_addr > seg_limit)) |
| goto out; |
| |
| /* |
| * Even though 32-bit address encodings are allowed in virtual-8086 |
| * mode, the address range is still limited to [0x-0xffff]. |
| */ |
| if (v8086_mode(regs) && (eff_addr & ~0xffff)) |
| goto out; |
| |
| /* |
| * Data type long could be 64 bits in size. Ensure that our 32-bit |
| * effective address is not sign-extended when computing the linear |
| * address. |
| */ |
| linear_addr = (unsigned long)(eff_addr & 0xffffffff) + seg_base; |
| |
| /* Limit linear address to 20 bits */ |
| if (v8086_mode(regs)) |
| linear_addr &= 0xfffff; |
| |
| out: |
| return (void __user *)linear_addr; |
| } |
| |
| /** |
| * get_addr_ref_64() - Obtain a 64-bit linear address |
| * @insn: Instruction struct with ModRM and SIB bytes and displacement |
| * @regs: Structure with register values as seen when entering kernel mode |
| * |
| * This function is to be used with 64-bit address encodings to obtain the |
| * linear memory address referred by the instruction's ModRM, SIB, |
| * displacement bytes and segment base address, as applicable. |
| * |
| * Returns: |
| * |
| * Linear address referenced by instruction and registers on success. |
| * |
| * -1L on error. |
| */ |
| #ifndef CONFIG_X86_64 |
| static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs) |
| { |
| return (void __user *)-1L; |
| } |
| #else |
| static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs) |
| { |
| unsigned long linear_addr = -1L, seg_base; |
| int regoff, ret; |
| long eff_addr; |
| |
| if (insn->addr_bytes != 8) |
| goto out; |
| |
| if (X86_MODRM_MOD(insn->modrm.value) == 3) { |
| ret = get_eff_addr_reg(insn, regs, ®off, &eff_addr); |
| if (ret) |
| goto out; |
| |
| } else { |
| if (insn->sib.nbytes) { |
| ret = get_eff_addr_sib(insn, regs, ®off, &eff_addr); |
| if (ret) |
| goto out; |
| } else { |
| ret = get_eff_addr_modrm(insn, regs, ®off, &eff_addr); |
| if (ret) |
| goto out; |
| } |
| |
| } |
| |
| ret = get_seg_base_limit(insn, regs, regoff, &seg_base, NULL); |
| if (ret) |
| goto out; |
| |
| linear_addr = (unsigned long)eff_addr + seg_base; |
| |
| out: |
| return (void __user *)linear_addr; |
| } |
| #endif /* CONFIG_X86_64 */ |
| |
| /** |
| * insn_get_addr_ref() - Obtain the linear address referred by instruction |
| * @insn: Instruction structure containing ModRM byte and displacement |
| * @regs: Structure with register values as seen when entering kernel mode |
| * |
| * Obtain the linear address referred by the instruction's ModRM, SIB and |
| * displacement bytes, and segment base, as applicable. In protected mode, |
| * segment limits are enforced. |
| * |
| * Returns: |
| * |
| * Linear address referenced by instruction and registers on success. |
| * |
| * -1L on error. |
| */ |
| void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs) |
| { |
| if (!insn || !regs) |
| return (void __user *)-1L; |
| |
| switch (insn->addr_bytes) { |
| case 2: |
| return get_addr_ref_16(insn, regs); |
| case 4: |
| return get_addr_ref_32(insn, regs); |
| case 8: |
| return get_addr_ref_64(insn, regs); |
| default: |
| return (void __user *)-1L; |
| } |
| } |