Back to home page

OSCL-LXR
 
 

     

0001 /*
0002  * Utility functions for x86 operand and address decoding
0003  *
0004  * Copyright (C) Intel Corporation 2017
0005  */
0006 #include <linux/kernel.h>
0007 #include <linux/string.h>
0008 #include <linux/ratelimit.h>
0009 #include <linux/mmu_context.h>
0010 #include <asm/desc_defs.h>
0011 #include <asm/desc.h>
0012 #include <asm/inat.h>
0013 #include <asm/insn.h>
0014 #include <asm/insn-eval.h>
0015 #include <asm/ldt.h>
0016 #include <asm/vm86.h>
0017 
0018 #undef pr_fmt
0019 #define pr_fmt(fmt) "insn: " fmt
0020 
0021 enum reg_type {
0022     REG_TYPE_RM = 0,
0023     REG_TYPE_REG,
0024     REG_TYPE_INDEX,
0025     REG_TYPE_BASE,
0026 };
0027 
0028 /**
0029  * is_string_insn() - Determine if instruction is a string instruction
0030  * @insn:   Instruction containing the opcode to inspect
0031  *
0032  * Returns:
0033  *
0034  * true if the instruction, determined by the opcode, is any of the
0035  * string instructions as defined in the Intel Software Development manual.
0036  * False otherwise.
0037  */
0038 static bool is_string_insn(struct insn *insn)
0039 {
0040     /* All string instructions have a 1-byte opcode. */
0041     if (insn->opcode.nbytes != 1)
0042         return false;
0043 
0044     switch (insn->opcode.bytes[0]) {
0045     case 0x6c ... 0x6f: /* INS, OUTS */
0046     case 0xa4 ... 0xa7: /* MOVS, CMPS */
0047     case 0xaa ... 0xaf: /* STOS, LODS, SCAS */
0048         return true;
0049     default:
0050         return false;
0051     }
0052 }
0053 
0054 /**
0055  * insn_has_rep_prefix() - Determine if instruction has a REP prefix
0056  * @insn:   Instruction containing the prefix to inspect
0057  *
0058  * Returns:
0059  *
0060  * true if the instruction has a REP prefix, false if not.
0061  */
0062 bool insn_has_rep_prefix(struct insn *insn)
0063 {
0064     insn_byte_t p;
0065     int i;
0066 
0067     insn_get_prefixes(insn);
0068 
0069     for_each_insn_prefix(insn, i, p) {
0070         if (p == 0xf2 || p == 0xf3)
0071             return true;
0072     }
0073 
0074     return false;
0075 }
0076 
0077 /**
0078  * get_seg_reg_override_idx() - obtain segment register override index
0079  * @insn:   Valid instruction with segment override prefixes
0080  *
0081  * Inspect the instruction prefixes in @insn and find segment overrides, if any.
0082  *
0083  * Returns:
0084  *
0085  * A constant identifying the segment register to use, among CS, SS, DS,
0086  * ES, FS, or GS. INAT_SEG_REG_DEFAULT is returned if no segment override
0087  * prefixes were found.
0088  *
0089  * -EINVAL in case of error.
0090  */
0091 static int get_seg_reg_override_idx(struct insn *insn)
0092 {
0093     int idx = INAT_SEG_REG_DEFAULT;
0094     int num_overrides = 0, i;
0095     insn_byte_t p;
0096 
0097     insn_get_prefixes(insn);
0098 
0099     /* Look for any segment override prefixes. */
0100     for_each_insn_prefix(insn, i, p) {
0101         insn_attr_t attr;
0102 
0103         attr = inat_get_opcode_attribute(p);
0104         switch (attr) {
0105         case INAT_MAKE_PREFIX(INAT_PFX_CS):
0106             idx = INAT_SEG_REG_CS;
0107             num_overrides++;
0108             break;
0109         case INAT_MAKE_PREFIX(INAT_PFX_SS):
0110             idx = INAT_SEG_REG_SS;
0111             num_overrides++;
0112             break;
0113         case INAT_MAKE_PREFIX(INAT_PFX_DS):
0114             idx = INAT_SEG_REG_DS;
0115             num_overrides++;
0116             break;
0117         case INAT_MAKE_PREFIX(INAT_PFX_ES):
0118             idx = INAT_SEG_REG_ES;
0119             num_overrides++;
0120             break;
0121         case INAT_MAKE_PREFIX(INAT_PFX_FS):
0122             idx = INAT_SEG_REG_FS;
0123             num_overrides++;
0124             break;
0125         case INAT_MAKE_PREFIX(INAT_PFX_GS):
0126             idx = INAT_SEG_REG_GS;
0127             num_overrides++;
0128             break;
0129         /* No default action needed. */
0130         }
0131     }
0132 
0133     /* More than one segment override prefix leads to undefined behavior. */
0134     if (num_overrides > 1)
0135         return -EINVAL;
0136 
0137     return idx;
0138 }
0139 
0140 /**
0141  * check_seg_overrides() - check if segment override prefixes are allowed
0142  * @insn:   Valid instruction with segment override prefixes
0143  * @regoff: Operand offset, in pt_regs, for which the check is performed
0144  *
0145  * For a particular register used in register-indirect addressing, determine if
0146  * segment override prefixes can be used. Specifically, no overrides are allowed
0147  * for rDI if used with a string instruction.
0148  *
0149  * Returns:
0150  *
0151  * True if segment override prefixes can be used with the register indicated
0152  * in @regoff. False if otherwise.
0153  */
0154 static bool check_seg_overrides(struct insn *insn, int regoff)
0155 {
0156     if (regoff == offsetof(struct pt_regs, di) && is_string_insn(insn))
0157         return false;
0158 
0159     return true;
0160 }
0161 
0162 /**
0163  * resolve_default_seg() - resolve default segment register index for an operand
0164  * @insn:   Instruction with opcode and address size. Must be valid.
0165  * @regs:   Register values as seen when entering kernel mode
0166  * @off:    Operand offset, in pt_regs, for which resolution is needed
0167  *
0168  * Resolve the default segment register index associated with the instruction
0169  * operand register indicated by @off. Such index is resolved based on defaults
0170  * described in the Intel Software Development Manual.
0171  *
0172  * Returns:
0173  *
0174  * If in protected mode, a constant identifying the segment register to use,
0175  * among CS, SS, ES or DS. If in long mode, INAT_SEG_REG_IGNORE.
0176  *
0177  * -EINVAL in case of error.
0178  */
0179 static int resolve_default_seg(struct insn *insn, struct pt_regs *regs, int off)
0180 {
0181     if (any_64bit_mode(regs))
0182         return INAT_SEG_REG_IGNORE;
0183     /*
0184      * Resolve the default segment register as described in Section 3.7.4
0185      * of the Intel Software Development Manual Vol. 1:
0186      *
0187      *  + DS for all references involving r[ABCD]X, and rSI.
0188      *  + If used in a string instruction, ES for rDI. Otherwise, DS.
0189      *  + AX, CX and DX are not valid register operands in 16-bit address
0190      *    encodings but are valid for 32-bit and 64-bit encodings.
0191      *  + -EDOM is reserved to identify for cases in which no register
0192      *    is used (i.e., displacement-only addressing). Use DS.
0193      *  + SS for rSP or rBP.
0194      *  + CS for rIP.
0195      */
0196 
0197     switch (off) {
0198     case offsetof(struct pt_regs, ax):
0199     case offsetof(struct pt_regs, cx):
0200     case offsetof(struct pt_regs, dx):
0201         /* Need insn to verify address size. */
0202         if (insn->addr_bytes == 2)
0203             return -EINVAL;
0204 
0205         fallthrough;
0206 
0207     case -EDOM:
0208     case offsetof(struct pt_regs, bx):
0209     case offsetof(struct pt_regs, si):
0210         return INAT_SEG_REG_DS;
0211 
0212     case offsetof(struct pt_regs, di):
0213         if (is_string_insn(insn))
0214             return INAT_SEG_REG_ES;
0215         return INAT_SEG_REG_DS;
0216 
0217     case offsetof(struct pt_regs, bp):
0218     case offsetof(struct pt_regs, sp):
0219         return INAT_SEG_REG_SS;
0220 
0221     case offsetof(struct pt_regs, ip):
0222         return INAT_SEG_REG_CS;
0223 
0224     default:
0225         return -EINVAL;
0226     }
0227 }
0228 
0229 /**
0230  * resolve_seg_reg() - obtain segment register index
0231  * @insn:   Instruction with operands
0232  * @regs:   Register values as seen when entering kernel mode
0233  * @regoff: Operand offset, in pt_regs, used to determine segment register
0234  *
0235  * Determine the segment register associated with the operands and, if
0236  * applicable, prefixes and the instruction pointed by @insn.
0237  *
0238  * The segment register associated to an operand used in register-indirect
0239  * addressing depends on:
0240  *
0241  * a) Whether running in long mode (in such a case segments are ignored, except
0242  * if FS or GS are used).
0243  *
0244  * b) Whether segment override prefixes can be used. Certain instructions and
0245  *    registers do not allow override prefixes.
0246  *
0247  * c) Whether segment overrides prefixes are found in the instruction prefixes.
0248  *
0249  * d) If there are not segment override prefixes or they cannot be used, the
0250  *    default segment register associated with the operand register is used.
0251  *
0252  * The function checks first if segment override prefixes can be used with the
0253  * operand indicated by @regoff. If allowed, obtain such overridden segment
0254  * register index. Lastly, if not prefixes were found or cannot be used, resolve
0255  * the segment register index to use based on the defaults described in the
0256  * Intel documentation. In long mode, all segment register indexes will be
0257  * ignored, except if overrides were found for FS or GS. All these operations
0258  * are done using helper functions.
0259  *
0260  * The operand register, @regoff, is represented as the offset from the base of
0261  * pt_regs.
0262  *
0263  * As stated, the main use of this function is to determine the segment register
0264  * index based on the instruction, its operands and prefixes. Hence, @insn
0265  * must be valid. However, if @regoff indicates rIP, we don't need to inspect
0266  * @insn at all as in this case CS is used in all cases. This case is checked
0267  * before proceeding further.
0268  *
0269  * Please note that this function does not return the value in the segment
0270  * register (i.e., the segment selector) but our defined index. The segment
0271  * selector needs to be obtained using get_segment_selector() and passing the
0272  * segment register index resolved by this function.
0273  *
0274  * Returns:
0275  *
0276  * An index identifying the segment register to use, among CS, SS, DS,
0277  * ES, FS, or GS. INAT_SEG_REG_IGNORE is returned if running in long mode.
0278  *
0279  * -EINVAL in case of error.
0280  */
0281 static int resolve_seg_reg(struct insn *insn, struct pt_regs *regs, int regoff)
0282 {
0283     int idx;
0284 
0285     /*
0286      * In the unlikely event of having to resolve the segment register
0287      * index for rIP, do it first. Segment override prefixes should not
0288      * be used. Hence, it is not necessary to inspect the instruction,
0289      * which may be invalid at this point.
0290      */
0291     if (regoff == offsetof(struct pt_regs, ip)) {
0292         if (any_64bit_mode(regs))
0293             return INAT_SEG_REG_IGNORE;
0294         else
0295             return INAT_SEG_REG_CS;
0296     }
0297 
0298     if (!insn)
0299         return -EINVAL;
0300 
0301     if (!check_seg_overrides(insn, regoff))
0302         return resolve_default_seg(insn, regs, regoff);
0303 
0304     idx = get_seg_reg_override_idx(insn);
0305     if (idx < 0)
0306         return idx;
0307 
0308     if (idx == INAT_SEG_REG_DEFAULT)
0309         return resolve_default_seg(insn, regs, regoff);
0310 
0311     /*
0312      * In long mode, segment override prefixes are ignored, except for
0313      * overrides for FS and GS.
0314      */
0315     if (any_64bit_mode(regs)) {
0316         if (idx != INAT_SEG_REG_FS &&
0317             idx != INAT_SEG_REG_GS)
0318             idx = INAT_SEG_REG_IGNORE;
0319     }
0320 
0321     return idx;
0322 }
0323 
0324 /**
0325  * get_segment_selector() - obtain segment selector
0326  * @regs:       Register values as seen when entering kernel mode
0327  * @seg_reg_idx:    Segment register index to use
0328  *
0329  * Obtain the segment selector from any of the CS, SS, DS, ES, FS, GS segment
0330  * registers. In CONFIG_X86_32, the segment is obtained from either pt_regs or
0331  * kernel_vm86_regs as applicable. In CONFIG_X86_64, CS and SS are obtained
0332  * from pt_regs. DS, ES, FS and GS are obtained by reading the actual CPU
0333  * registers. This done for only for completeness as in CONFIG_X86_64 segment
0334  * registers are ignored.
0335  *
0336  * Returns:
0337  *
0338  * Value of the segment selector, including null when running in
0339  * long mode.
0340  *
0341  * -EINVAL on error.
0342  */
0343 static short get_segment_selector(struct pt_regs *regs, int seg_reg_idx)
0344 {
0345     unsigned short sel;
0346 
0347 #ifdef CONFIG_X86_64
0348     switch (seg_reg_idx) {
0349     case INAT_SEG_REG_IGNORE:
0350         return 0;
0351     case INAT_SEG_REG_CS:
0352         return (unsigned short)(regs->cs & 0xffff);
0353     case INAT_SEG_REG_SS:
0354         return (unsigned short)(regs->ss & 0xffff);
0355     case INAT_SEG_REG_DS:
0356         savesegment(ds, sel);
0357         return sel;
0358     case INAT_SEG_REG_ES:
0359         savesegment(es, sel);
0360         return sel;
0361     case INAT_SEG_REG_FS:
0362         savesegment(fs, sel);
0363         return sel;
0364     case INAT_SEG_REG_GS:
0365         savesegment(gs, sel);
0366         return sel;
0367     default:
0368         return -EINVAL;
0369     }
0370 #else /* CONFIG_X86_32 */
0371     struct kernel_vm86_regs *vm86regs = (struct kernel_vm86_regs *)regs;
0372 
0373     if (v8086_mode(regs)) {
0374         switch (seg_reg_idx) {
0375         case INAT_SEG_REG_CS:
0376             return (unsigned short)(regs->cs & 0xffff);
0377         case INAT_SEG_REG_SS:
0378             return (unsigned short)(regs->ss & 0xffff);
0379         case INAT_SEG_REG_DS:
0380             return vm86regs->ds;
0381         case INAT_SEG_REG_ES:
0382             return vm86regs->es;
0383         case INAT_SEG_REG_FS:
0384             return vm86regs->fs;
0385         case INAT_SEG_REG_GS:
0386             return vm86regs->gs;
0387         case INAT_SEG_REG_IGNORE:
0388         default:
0389             return -EINVAL;
0390         }
0391     }
0392 
0393     switch (seg_reg_idx) {
0394     case INAT_SEG_REG_CS:
0395         return (unsigned short)(regs->cs & 0xffff);
0396     case INAT_SEG_REG_SS:
0397         return (unsigned short)(regs->ss & 0xffff);
0398     case INAT_SEG_REG_DS:
0399         return (unsigned short)(regs->ds & 0xffff);
0400     case INAT_SEG_REG_ES:
0401         return (unsigned short)(regs->es & 0xffff);
0402     case INAT_SEG_REG_FS:
0403         return (unsigned short)(regs->fs & 0xffff);
0404     case INAT_SEG_REG_GS:
0405         savesegment(gs, sel);
0406         return sel;
0407     case INAT_SEG_REG_IGNORE:
0408     default:
0409         return -EINVAL;
0410     }
0411 #endif /* CONFIG_X86_64 */
0412 }
0413 
0414 static const int pt_regoff[] = {
0415     offsetof(struct pt_regs, ax),
0416     offsetof(struct pt_regs, cx),
0417     offsetof(struct pt_regs, dx),
0418     offsetof(struct pt_regs, bx),
0419     offsetof(struct pt_regs, sp),
0420     offsetof(struct pt_regs, bp),
0421     offsetof(struct pt_regs, si),
0422     offsetof(struct pt_regs, di),
0423 #ifdef CONFIG_X86_64
0424     offsetof(struct pt_regs, r8),
0425     offsetof(struct pt_regs, r9),
0426     offsetof(struct pt_regs, r10),
0427     offsetof(struct pt_regs, r11),
0428     offsetof(struct pt_regs, r12),
0429     offsetof(struct pt_regs, r13),
0430     offsetof(struct pt_regs, r14),
0431     offsetof(struct pt_regs, r15),
0432 #else
0433     offsetof(struct pt_regs, ds),
0434     offsetof(struct pt_regs, es),
0435     offsetof(struct pt_regs, fs),
0436     offsetof(struct pt_regs, gs),
0437 #endif
0438 };
0439 
0440 int pt_regs_offset(struct pt_regs *regs, int regno)
0441 {
0442     if ((unsigned)regno < ARRAY_SIZE(pt_regoff))
0443         return pt_regoff[regno];
0444     return -EDOM;
0445 }
0446 
0447 static int get_regno(struct insn *insn, enum reg_type type)
0448 {
0449     int nr_registers = ARRAY_SIZE(pt_regoff);
0450     int regno = 0;
0451 
0452     /*
0453      * Don't possibly decode a 32-bit instructions as
0454      * reading a 64-bit-only register.
0455      */
0456     if (IS_ENABLED(CONFIG_X86_64) && !insn->x86_64)
0457         nr_registers -= 8;
0458 
0459     switch (type) {
0460     case REG_TYPE_RM:
0461         regno = X86_MODRM_RM(insn->modrm.value);
0462 
0463         /*
0464          * ModRM.mod == 0 and ModRM.rm == 5 means a 32-bit displacement
0465          * follows the ModRM byte.
0466          */
0467         if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
0468             return -EDOM;
0469 
0470         if (X86_REX_B(insn->rex_prefix.value))
0471             regno += 8;
0472         break;
0473 
0474     case REG_TYPE_REG:
0475         regno = X86_MODRM_REG(insn->modrm.value);
0476 
0477         if (X86_REX_R(insn->rex_prefix.value))
0478             regno += 8;
0479         break;
0480 
0481     case REG_TYPE_INDEX:
0482         regno = X86_SIB_INDEX(insn->sib.value);
0483         if (X86_REX_X(insn->rex_prefix.value))
0484             regno += 8;
0485 
0486         /*
0487          * If ModRM.mod != 3 and SIB.index = 4 the scale*index
0488          * portion of the address computation is null. This is
0489          * true only if REX.X is 0. In such a case, the SIB index
0490          * is used in the address computation.
0491          */
0492         if (X86_MODRM_MOD(insn->modrm.value) != 3 && regno == 4)
0493             return -EDOM;
0494         break;
0495 
0496     case REG_TYPE_BASE:
0497         regno = X86_SIB_BASE(insn->sib.value);
0498         /*
0499          * If ModRM.mod is 0 and SIB.base == 5, the base of the
0500          * register-indirect addressing is 0. In this case, a
0501          * 32-bit displacement follows the SIB byte.
0502          */
0503         if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
0504             return -EDOM;
0505 
0506         if (X86_REX_B(insn->rex_prefix.value))
0507             regno += 8;
0508         break;
0509 
0510     default:
0511         pr_err_ratelimited("invalid register type: %d\n", type);
0512         return -EINVAL;
0513     }
0514 
0515     if (regno >= nr_registers) {
0516         WARN_ONCE(1, "decoded an instruction with an invalid register");
0517         return -EINVAL;
0518     }
0519     return regno;
0520 }
0521 
0522 static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
0523               enum reg_type type)
0524 {
0525     int regno = get_regno(insn, type);
0526 
0527     if (regno < 0)
0528         return regno;
0529 
0530     return pt_regs_offset(regs, regno);
0531 }
0532 
0533 /**
0534  * get_reg_offset_16() - Obtain offset of register indicated by instruction
0535  * @insn:   Instruction containing ModRM byte
0536  * @regs:   Register values as seen when entering kernel mode
0537  * @offs1:  Offset of the first operand register
0538  * @offs2:  Offset of the second operand register, if applicable
0539  *
0540  * Obtain the offset, in pt_regs, of the registers indicated by the ModRM byte
0541  * in @insn. This function is to be used with 16-bit address encodings. The
0542  * @offs1 and @offs2 will be written with the offset of the two registers
0543  * indicated by the instruction. In cases where any of the registers is not
0544  * referenced by the instruction, the value will be set to -EDOM.
0545  *
0546  * Returns:
0547  *
0548  * 0 on success, -EINVAL on error.
0549  */
0550 static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs,
0551                  int *offs1, int *offs2)
0552 {
0553     /*
0554      * 16-bit addressing can use one or two registers. Specifics of
0555      * encodings are given in Table 2-1. "16-Bit Addressing Forms with the
0556      * ModR/M Byte" of the Intel Software Development Manual.
0557      */
0558     static const int regoff1[] = {
0559         offsetof(struct pt_regs, bx),
0560         offsetof(struct pt_regs, bx),
0561         offsetof(struct pt_regs, bp),
0562         offsetof(struct pt_regs, bp),
0563         offsetof(struct pt_regs, si),
0564         offsetof(struct pt_regs, di),
0565         offsetof(struct pt_regs, bp),
0566         offsetof(struct pt_regs, bx),
0567     };
0568 
0569     static const int regoff2[] = {
0570         offsetof(struct pt_regs, si),
0571         offsetof(struct pt_regs, di),
0572         offsetof(struct pt_regs, si),
0573         offsetof(struct pt_regs, di),
0574         -EDOM,
0575         -EDOM,
0576         -EDOM,
0577         -EDOM,
0578     };
0579 
0580     if (!offs1 || !offs2)
0581         return -EINVAL;
0582 
0583     /* Operand is a register, use the generic function. */
0584     if (X86_MODRM_MOD(insn->modrm.value) == 3) {
0585         *offs1 = insn_get_modrm_rm_off(insn, regs);
0586         *offs2 = -EDOM;
0587         return 0;
0588     }
0589 
0590     *offs1 = regoff1[X86_MODRM_RM(insn->modrm.value)];
0591     *offs2 = regoff2[X86_MODRM_RM(insn->modrm.value)];
0592 
0593     /*
0594      * If ModRM.mod is 0 and ModRM.rm is 110b, then we use displacement-
0595      * only addressing. This means that no registers are involved in
0596      * computing the effective address. Thus, ensure that the first
0597      * register offset is invalid. The second register offset is already
0598      * invalid under the aforementioned conditions.
0599      */
0600     if ((X86_MODRM_MOD(insn->modrm.value) == 0) &&
0601         (X86_MODRM_RM(insn->modrm.value) == 6))
0602         *offs1 = -EDOM;
0603 
0604     return 0;
0605 }
0606 
0607 /**
0608  * get_desc() - Obtain contents of a segment descriptor
0609  * @out:    Segment descriptor contents on success
0610  * @sel:    Segment selector
0611  *
0612  * Given a segment selector, obtain a pointer to the segment descriptor.
0613  * Both global and local descriptor tables are supported.
0614  *
0615  * Returns:
0616  *
0617  * True on success, false on failure.
0618  *
0619  * NULL on error.
0620  */
0621 static bool get_desc(struct desc_struct *out, unsigned short sel)
0622 {
0623     struct desc_ptr gdt_desc = {0, 0};
0624     unsigned long desc_base;
0625 
0626 #ifdef CONFIG_MODIFY_LDT_SYSCALL
0627     if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) {
0628         bool success = false;
0629         struct ldt_struct *ldt;
0630 
0631         /* Bits [15:3] contain the index of the desired entry. */
0632         sel >>= 3;
0633 
0634         mutex_lock(&current->active_mm->context.lock);
0635         ldt = current->active_mm->context.ldt;
0636         if (ldt && sel < ldt->nr_entries) {
0637             *out = ldt->entries[sel];
0638             success = true;
0639         }
0640 
0641         mutex_unlock(&current->active_mm->context.lock);
0642 
0643         return success;
0644     }
0645 #endif
0646     native_store_gdt(&gdt_desc);
0647 
0648     /*
0649      * Segment descriptors have a size of 8 bytes. Thus, the index is
0650      * multiplied by 8 to obtain the memory offset of the desired descriptor
0651      * from the base of the GDT. As bits [15:3] of the segment selector
0652      * contain the index, it can be regarded as multiplied by 8 already.
0653      * All that remains is to clear bits [2:0].
0654      */
0655     desc_base = sel & ~(SEGMENT_RPL_MASK | SEGMENT_TI_MASK);
0656 
0657     if (desc_base > gdt_desc.size)
0658         return false;
0659 
0660     *out = *(struct desc_struct *)(gdt_desc.address + desc_base);
0661     return true;
0662 }
0663 
0664 /**
0665  * insn_get_seg_base() - Obtain base address of segment descriptor.
0666  * @regs:       Register values as seen when entering kernel mode
0667  * @seg_reg_idx:    Index of the segment register pointing to seg descriptor
0668  *
0669  * Obtain the base address of the segment as indicated by the segment descriptor
0670  * pointed by the segment selector. The segment selector is obtained from the
0671  * input segment register index @seg_reg_idx.
0672  *
0673  * Returns:
0674  *
0675  * In protected mode, base address of the segment. Zero in long mode,
0676  * except when FS or GS are used. In virtual-8086 mode, the segment
0677  * selector shifted 4 bits to the right.
0678  *
0679  * -1L in case of error.
0680  */
0681 unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx)
0682 {
0683     struct desc_struct desc;
0684     short sel;
0685 
0686     sel = get_segment_selector(regs, seg_reg_idx);
0687     if (sel < 0)
0688         return -1L;
0689 
0690     if (v8086_mode(regs))
0691         /*
0692          * Base is simply the segment selector shifted 4
0693          * bits to the right.
0694          */
0695         return (unsigned long)(sel << 4);
0696 
0697     if (any_64bit_mode(regs)) {
0698         /*
0699          * Only FS or GS will have a base address, the rest of
0700          * the segments' bases are forced to 0.
0701          */
0702         unsigned long base;
0703 
0704         if (seg_reg_idx == INAT_SEG_REG_FS) {
0705             rdmsrl(MSR_FS_BASE, base);
0706         } else if (seg_reg_idx == INAT_SEG_REG_GS) {
0707             /*
0708              * swapgs was called at the kernel entry point. Thus,
0709              * MSR_KERNEL_GS_BASE will have the user-space GS base.
0710              */
0711             if (user_mode(regs))
0712                 rdmsrl(MSR_KERNEL_GS_BASE, base);
0713             else
0714                 rdmsrl(MSR_GS_BASE, base);
0715         } else {
0716             base = 0;
0717         }
0718         return base;
0719     }
0720 
0721     /* In protected mode the segment selector cannot be null. */
0722     if (!sel)
0723         return -1L;
0724 
0725     if (!get_desc(&desc, sel))
0726         return -1L;
0727 
0728     return get_desc_base(&desc);
0729 }
0730 
0731 /**
0732  * get_seg_limit() - Obtain the limit of a segment descriptor
0733  * @regs:       Register values as seen when entering kernel mode
0734  * @seg_reg_idx:    Index of the segment register pointing to seg descriptor
0735  *
0736  * Obtain the limit of the segment as indicated by the segment descriptor
0737  * pointed by the segment selector. The segment selector is obtained from the
0738  * input segment register index @seg_reg_idx.
0739  *
0740  * Returns:
0741  *
0742  * In protected mode, the limit of the segment descriptor in bytes.
0743  * In long mode and virtual-8086 mode, segment limits are not enforced. Thus,
0744  * limit is returned as -1L to imply a limit-less segment.
0745  *
0746  * Zero is returned on error.
0747  */
0748 static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)
0749 {
0750     struct desc_struct desc;
0751     unsigned long limit;
0752     short sel;
0753 
0754     sel = get_segment_selector(regs, seg_reg_idx);
0755     if (sel < 0)
0756         return 0;
0757 
0758     if (any_64bit_mode(regs) || v8086_mode(regs))
0759         return -1L;
0760 
0761     if (!sel)
0762         return 0;
0763 
0764     if (!get_desc(&desc, sel))
0765         return 0;
0766 
0767     /*
0768      * If the granularity bit is set, the limit is given in multiples
0769      * of 4096. This also means that the 12 least significant bits are
0770      * not tested when checking the segment limits. In practice,
0771      * this means that the segment ends in (limit << 12) + 0xfff.
0772      */
0773     limit = get_desc_limit(&desc);
0774     if (desc.g)
0775         limit = (limit << 12) + 0xfff;
0776 
0777     return limit;
0778 }
0779 
0780 /**
0781  * insn_get_code_seg_params() - Obtain code segment parameters
0782  * @regs:   Structure with register values as seen when entering kernel mode
0783  *
0784  * Obtain address and operand sizes of the code segment. It is obtained from the
0785  * selector contained in the CS register in regs. In protected mode, the default
0786  * address is determined by inspecting the L and D bits of the segment
0787  * descriptor. In virtual-8086 mode, the default is always two bytes for both
0788  * address and operand sizes.
0789  *
0790  * Returns:
0791  *
0792  * An int containing ORed-in default parameters on success.
0793  *
0794  * -EINVAL on error.
0795  */
0796 int insn_get_code_seg_params(struct pt_regs *regs)
0797 {
0798     struct desc_struct desc;
0799     short sel;
0800 
0801     if (v8086_mode(regs))
0802         /* Address and operand size are both 16-bit. */
0803         return INSN_CODE_SEG_PARAMS(2, 2);
0804 
0805     sel = get_segment_selector(regs, INAT_SEG_REG_CS);
0806     if (sel < 0)
0807         return sel;
0808 
0809     if (!get_desc(&desc, sel))
0810         return -EINVAL;
0811 
0812     /*
0813      * The most significant byte of the Type field of the segment descriptor
0814      * determines whether a segment contains data or code. If this is a data
0815      * segment, return error.
0816      */
0817     if (!(desc.type & BIT(3)))
0818         return -EINVAL;
0819 
0820     switch ((desc.l << 1) | desc.d) {
0821     case 0: /*
0822          * Legacy mode. CS.L=0, CS.D=0. Address and operand size are
0823          * both 16-bit.
0824          */
0825         return INSN_CODE_SEG_PARAMS(2, 2);
0826     case 1: /*
0827          * Legacy mode. CS.L=0, CS.D=1. Address and operand size are
0828          * both 32-bit.
0829          */
0830         return INSN_CODE_SEG_PARAMS(4, 4);
0831     case 2: /*
0832          * IA-32e 64-bit mode. CS.L=1, CS.D=0. Address size is 64-bit;
0833          * operand size is 32-bit.
0834          */
0835         return INSN_CODE_SEG_PARAMS(4, 8);
0836     case 3: /* Invalid setting. CS.L=1, CS.D=1 */
0837         fallthrough;
0838     default:
0839         return -EINVAL;
0840     }
0841 }
0842 
0843 /**
0844  * insn_get_modrm_rm_off() - Obtain register in r/m part of the ModRM byte
0845  * @insn:   Instruction containing the ModRM byte
0846  * @regs:   Register values as seen when entering kernel mode
0847  *
0848  * Returns:
0849  *
0850  * The register indicated by the r/m part of the ModRM byte. The
0851  * register is obtained as an offset from the base of pt_regs. In specific
0852  * cases, the returned value can be -EDOM to indicate that the particular value
0853  * of ModRM does not refer to a register and shall be ignored.
0854  */
0855 int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs)
0856 {
0857     return get_reg_offset(insn, regs, REG_TYPE_RM);
0858 }
0859 
0860 /**
0861  * insn_get_modrm_reg_off() - Obtain register in reg part of the ModRM byte
0862  * @insn:   Instruction containing the ModRM byte
0863  * @regs:   Register values as seen when entering kernel mode
0864  *
0865  * Returns:
0866  *
0867  * The register indicated by the reg part of the ModRM byte. The
0868  * register is obtained as an offset from the base of pt_regs.
0869  */
0870 int insn_get_modrm_reg_off(struct insn *insn, struct pt_regs *regs)
0871 {
0872     return get_reg_offset(insn, regs, REG_TYPE_REG);
0873 }
0874 
0875 /**
0876  * insn_get_modrm_reg_ptr() - Obtain register pointer based on ModRM byte
0877  * @insn:   Instruction containing the ModRM byte
0878  * @regs:   Register values as seen when entering kernel mode
0879  *
0880  * Returns:
0881  *
0882  * The register indicated by the reg part of the ModRM byte.
0883  * The register is obtained as a pointer within pt_regs.
0884  */
0885 unsigned long *insn_get_modrm_reg_ptr(struct insn *insn, struct pt_regs *regs)
0886 {
0887     int offset;
0888 
0889     offset = insn_get_modrm_reg_off(insn, regs);
0890     if (offset < 0)
0891         return NULL;
0892     return (void *)regs + offset;
0893 }
0894 
0895 /**
0896  * get_seg_base_limit() - obtain base address and limit of a segment
0897  * @insn:   Instruction. Must be valid.
0898  * @regs:   Register values as seen when entering kernel mode
0899  * @regoff: Operand offset, in pt_regs, used to resolve segment descriptor
0900  * @base:   Obtained segment base
0901  * @limit:  Obtained segment limit
0902  *
0903  * Obtain the base address and limit of the segment associated with the operand
0904  * @regoff and, if any or allowed, override prefixes in @insn. This function is
0905  * different from insn_get_seg_base() as the latter does not resolve the segment
0906  * associated with the instruction operand. If a limit is not needed (e.g.,
0907  * when running in long mode), @limit can be NULL.
0908  *
0909  * Returns:
0910  *
0911  * 0 on success. @base and @limit will contain the base address and of the
0912  * resolved segment, respectively.
0913  *
0914  * -EINVAL on error.
0915  */
0916 static int get_seg_base_limit(struct insn *insn, struct pt_regs *regs,
0917                   int regoff, unsigned long *base,
0918                   unsigned long *limit)
0919 {
0920     int seg_reg_idx;
0921 
0922     if (!base)
0923         return -EINVAL;
0924 
0925     seg_reg_idx = resolve_seg_reg(insn, regs, regoff);
0926     if (seg_reg_idx < 0)
0927         return seg_reg_idx;
0928 
0929     *base = insn_get_seg_base(regs, seg_reg_idx);
0930     if (*base == -1L)
0931         return -EINVAL;
0932 
0933     if (!limit)
0934         return 0;
0935 
0936     *limit = get_seg_limit(regs, seg_reg_idx);
0937     if (!(*limit))
0938         return -EINVAL;
0939 
0940     return 0;
0941 }
0942 
0943 /**
0944  * get_eff_addr_reg() - Obtain effective address from register operand
0945  * @insn:   Instruction. Must be valid.
0946  * @regs:   Register values as seen when entering kernel mode
0947  * @regoff: Obtained operand offset, in pt_regs, with the effective address
0948  * @eff_addr:   Obtained effective address
0949  *
0950  * Obtain the effective address stored in the register operand as indicated by
0951  * the ModRM byte. This function is to be used only with register addressing
0952  * (i.e.,  ModRM.mod is 3). The effective address is saved in @eff_addr. The
0953  * register operand, as an offset from the base of pt_regs, is saved in @regoff;
0954  * such offset can then be used to resolve the segment associated with the
0955  * operand. This function can be used with any of the supported address sizes
0956  * in x86.
0957  *
0958  * Returns:
0959  *
0960  * 0 on success. @eff_addr will have the effective address stored in the
0961  * operand indicated by ModRM. @regoff will have such operand as an offset from
0962  * the base of pt_regs.
0963  *
0964  * -EINVAL on error.
0965  */
0966 static int get_eff_addr_reg(struct insn *insn, struct pt_regs *regs,
0967                 int *regoff, long *eff_addr)
0968 {
0969     int ret;
0970 
0971     ret = insn_get_modrm(insn);
0972     if (ret)
0973         return ret;
0974 
0975     if (X86_MODRM_MOD(insn->modrm.value) != 3)
0976         return -EINVAL;
0977 
0978     *regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
0979     if (*regoff < 0)
0980         return -EINVAL;
0981 
0982     /* Ignore bytes that are outside the address size. */
0983     if (insn->addr_bytes == 2)
0984         *eff_addr = regs_get_register(regs, *regoff) & 0xffff;
0985     else if (insn->addr_bytes == 4)
0986         *eff_addr = regs_get_register(regs, *regoff) & 0xffffffff;
0987     else /* 64-bit address */
0988         *eff_addr = regs_get_register(regs, *regoff);
0989 
0990     return 0;
0991 }
0992 
0993 /**
0994  * get_eff_addr_modrm() - Obtain referenced effective address via ModRM
0995  * @insn:   Instruction. Must be valid.
0996  * @regs:   Register values as seen when entering kernel mode
0997  * @regoff: Obtained operand offset, in pt_regs, associated with segment
0998  * @eff_addr:   Obtained effective address
0999  *
1000  * Obtain the effective address referenced by the ModRM byte of @insn. After
1001  * identifying the registers involved in the register-indirect memory reference,
1002  * its value is obtained from the operands in @regs. The computed address is
1003  * stored @eff_addr. Also, the register operand that indicates the associated
1004  * segment is stored in @regoff, this parameter can later be used to determine
1005  * such segment.
1006  *
1007  * Returns:
1008  *
1009  * 0 on success. @eff_addr will have the referenced effective address. @regoff
1010  * will have a register, as an offset from the base of pt_regs, that can be used
1011  * to resolve the associated segment.
1012  *
1013  * -EINVAL on error.
1014  */
1015 static int get_eff_addr_modrm(struct insn *insn, struct pt_regs *regs,
1016                   int *regoff, long *eff_addr)
1017 {
1018     long tmp;
1019     int ret;
1020 
1021     if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
1022         return -EINVAL;
1023 
1024     ret = insn_get_modrm(insn);
1025     if (ret)
1026         return ret;
1027 
1028     if (X86_MODRM_MOD(insn->modrm.value) > 2)
1029         return -EINVAL;
1030 
1031     *regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
1032 
1033     /*
1034      * -EDOM means that we must ignore the address_offset. In such a case,
1035      * in 64-bit mode the effective address relative to the rIP of the
1036      * following instruction.
1037      */
1038     if (*regoff == -EDOM) {
1039         if (any_64bit_mode(regs))
1040             tmp = regs->ip + insn->length;
1041         else
1042             tmp = 0;
1043     } else if (*regoff < 0) {
1044         return -EINVAL;
1045     } else {
1046         tmp = regs_get_register(regs, *regoff);
1047     }
1048 
1049     if (insn->addr_bytes == 4) {
1050         int addr32 = (int)(tmp & 0xffffffff) + insn->displacement.value;
1051 
1052         *eff_addr = addr32 & 0xffffffff;
1053     } else {
1054         *eff_addr = tmp + insn->displacement.value;
1055     }
1056 
1057     return 0;
1058 }
1059 
1060 /**
1061  * get_eff_addr_modrm_16() - Obtain referenced effective address via ModRM
1062  * @insn:   Instruction. Must be valid.
1063  * @regs:   Register values as seen when entering kernel mode
1064  * @regoff: Obtained operand offset, in pt_regs, associated with segment
1065  * @eff_addr:   Obtained effective address
1066  *
1067  * Obtain the 16-bit effective address referenced by the ModRM byte of @insn.
1068  * After identifying the registers involved in the register-indirect memory
1069  * reference, its value is obtained from the operands in @regs. The computed
1070  * address is stored @eff_addr. Also, the register operand that indicates
1071  * the associated segment is stored in @regoff, this parameter can later be used
1072  * to determine such segment.
1073  *
1074  * Returns:
1075  *
1076  * 0 on success. @eff_addr will have the referenced effective address. @regoff
1077  * will have a register, as an offset from the base of pt_regs, that can be used
1078  * to resolve the associated segment.
1079  *
1080  * -EINVAL on error.
1081  */
1082 static int get_eff_addr_modrm_16(struct insn *insn, struct pt_regs *regs,
1083                  int *regoff, short *eff_addr)
1084 {
1085     int addr_offset1, addr_offset2, ret;
1086     short addr1 = 0, addr2 = 0, displacement;
1087 
1088     if (insn->addr_bytes != 2)
1089         return -EINVAL;
1090 
1091     insn_get_modrm(insn);
1092 
1093     if (!insn->modrm.nbytes)
1094         return -EINVAL;
1095 
1096     if (X86_MODRM_MOD(insn->modrm.value) > 2)
1097         return -EINVAL;
1098 
1099     ret = get_reg_offset_16(insn, regs, &addr_offset1, &addr_offset2);
1100     if (ret < 0)
1101         return -EINVAL;
1102 
1103     /*
1104      * Don't fail on invalid offset values. They might be invalid because
1105      * they cannot be used for this particular value of ModRM. Instead, use
1106      * them in the computation only if they contain a valid value.
1107      */
1108     if (addr_offset1 != -EDOM)
1109         addr1 = regs_get_register(regs, addr_offset1) & 0xffff;
1110 
1111     if (addr_offset2 != -EDOM)
1112         addr2 = regs_get_register(regs, addr_offset2) & 0xffff;
1113 
1114     displacement = insn->displacement.value & 0xffff;
1115     *eff_addr = addr1 + addr2 + displacement;
1116 
1117     /*
1118      * The first operand register could indicate to use of either SS or DS
1119      * registers to obtain the segment selector.  The second operand
1120      * register can only indicate the use of DS. Thus, the first operand
1121      * will be used to obtain the segment selector.
1122      */
1123     *regoff = addr_offset1;
1124 
1125     return 0;
1126 }
1127 
1128 /**
1129  * get_eff_addr_sib() - Obtain referenced effective address via SIB
1130  * @insn:   Instruction. Must be valid.
1131  * @regs:   Register values as seen when entering kernel mode
1132  * @regoff: Obtained operand offset, in pt_regs, associated with segment
1133  * @eff_addr:   Obtained effective address
1134  *
1135  * Obtain the effective address referenced by the SIB byte of @insn. After
1136  * identifying the registers involved in the indexed, register-indirect memory
1137  * reference, its value is obtained from the operands in @regs. The computed
1138  * address is stored @eff_addr. Also, the register operand that indicates the
1139  * associated segment is stored in @regoff, this parameter can later be used to
1140  * determine such segment.
1141  *
1142  * Returns:
1143  *
1144  * 0 on success. @eff_addr will have the referenced effective address.
1145  * @base_offset will have a register, as an offset from the base of pt_regs,
1146  * that can be used to resolve the associated segment.
1147  *
1148  * Negative value on error.
1149  */
1150 static int get_eff_addr_sib(struct insn *insn, struct pt_regs *regs,
1151                 int *base_offset, long *eff_addr)
1152 {
1153     long base, indx;
1154     int indx_offset;
1155     int ret;
1156 
1157     if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
1158         return -EINVAL;
1159 
1160     ret = insn_get_modrm(insn);
1161     if (ret)
1162         return ret;
1163 
1164     if (!insn->modrm.nbytes)
1165         return -EINVAL;
1166 
1167     if (X86_MODRM_MOD(insn->modrm.value) > 2)
1168         return -EINVAL;
1169 
1170     ret = insn_get_sib(insn);
1171     if (ret)
1172         return ret;
1173 
1174     if (!insn->sib.nbytes)
1175         return -EINVAL;
1176 
1177     *base_offset = get_reg_offset(insn, regs, REG_TYPE_BASE);
1178     indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX);
1179 
1180     /*
1181      * Negative values in the base and index offset means an error when
1182      * decoding the SIB byte. Except -EDOM, which means that the registers
1183      * should not be used in the address computation.
1184      */
1185     if (*base_offset == -EDOM)
1186         base = 0;
1187     else if (*base_offset < 0)
1188         return -EINVAL;
1189     else
1190         base = regs_get_register(regs, *base_offset);
1191 
1192     if (indx_offset == -EDOM)
1193         indx = 0;
1194     else if (indx_offset < 0)
1195         return -EINVAL;
1196     else
1197         indx = regs_get_register(regs, indx_offset);
1198 
1199     if (insn->addr_bytes == 4) {
1200         int addr32, base32, idx32;
1201 
1202         base32 = base & 0xffffffff;
1203         idx32 = indx & 0xffffffff;
1204 
1205         addr32 = base32 + idx32 * (1 << X86_SIB_SCALE(insn->sib.value));
1206         addr32 += insn->displacement.value;
1207 
1208         *eff_addr = addr32 & 0xffffffff;
1209     } else {
1210         *eff_addr = base + indx * (1 << X86_SIB_SCALE(insn->sib.value));
1211         *eff_addr += insn->displacement.value;
1212     }
1213 
1214     return 0;
1215 }
1216 
1217 /**
1218  * get_addr_ref_16() - Obtain the 16-bit address referred by instruction
1219  * @insn:   Instruction containing ModRM byte and displacement
1220  * @regs:   Register values as seen when entering kernel mode
1221  *
1222  * This function is to be used with 16-bit address encodings. Obtain the memory
1223  * address referred by the instruction's ModRM and displacement bytes. Also, the
1224  * segment used as base is determined by either any segment override prefixes in
1225  * @insn or the default segment of the registers involved in the address
1226  * computation. In protected mode, segment limits are enforced.
1227  *
1228  * Returns:
1229  *
1230  * Linear address referenced by the instruction operands on success.
1231  *
1232  * -1L on error.
1233  */
1234 static void __user *get_addr_ref_16(struct insn *insn, struct pt_regs *regs)
1235 {
1236     unsigned long linear_addr = -1L, seg_base, seg_limit;
1237     int ret, regoff;
1238     short eff_addr;
1239     long tmp;
1240 
1241     if (insn_get_displacement(insn))
1242         goto out;
1243 
1244     if (insn->addr_bytes != 2)
1245         goto out;
1246 
1247     if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1248         ret = get_eff_addr_reg(insn, regs, &regoff, &tmp);
1249         if (ret)
1250             goto out;
1251 
1252         eff_addr = tmp;
1253     } else {
1254         ret = get_eff_addr_modrm_16(insn, regs, &regoff, &eff_addr);
1255         if (ret)
1256             goto out;
1257     }
1258 
1259     ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
1260     if (ret)
1261         goto out;
1262 
1263     /*
1264      * Before computing the linear address, make sure the effective address
1265      * is within the limits of the segment. In virtual-8086 mode, segment
1266      * limits are not enforced. In such a case, the segment limit is -1L to
1267      * reflect this fact.
1268      */
1269     if ((unsigned long)(eff_addr & 0xffff) > seg_limit)
1270         goto out;
1271 
1272     linear_addr = (unsigned long)(eff_addr & 0xffff) + seg_base;
1273 
1274     /* Limit linear address to 20 bits */
1275     if (v8086_mode(regs))
1276         linear_addr &= 0xfffff;
1277 
1278 out:
1279     return (void __user *)linear_addr;
1280 }
1281 
1282 /**
1283  * get_addr_ref_32() - Obtain a 32-bit linear address
1284  * @insn:   Instruction with ModRM, SIB bytes and displacement
1285  * @regs:   Register values as seen when entering kernel mode
1286  *
1287  * This function is to be used with 32-bit address encodings to obtain the
1288  * linear memory address referred by the instruction's ModRM, SIB,
1289  * displacement bytes and segment base address, as applicable. If in protected
1290  * mode, segment limits are enforced.
1291  *
1292  * Returns:
1293  *
1294  * Linear address referenced by instruction and registers on success.
1295  *
1296  * -1L on error.
1297  */
1298 static void __user *get_addr_ref_32(struct insn *insn, struct pt_regs *regs)
1299 {
1300     unsigned long linear_addr = -1L, seg_base, seg_limit;
1301     int eff_addr, regoff;
1302     long tmp;
1303     int ret;
1304 
1305     if (insn->addr_bytes != 4)
1306         goto out;
1307 
1308     if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1309         ret = get_eff_addr_reg(insn, regs, &regoff, &tmp);
1310         if (ret)
1311             goto out;
1312 
1313         eff_addr = tmp;
1314 
1315     } else {
1316         if (insn->sib.nbytes) {
1317             ret = get_eff_addr_sib(insn, regs, &regoff, &tmp);
1318             if (ret)
1319                 goto out;
1320 
1321             eff_addr = tmp;
1322         } else {
1323             ret = get_eff_addr_modrm(insn, regs, &regoff, &tmp);
1324             if (ret)
1325                 goto out;
1326 
1327             eff_addr = tmp;
1328         }
1329     }
1330 
1331     ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
1332     if (ret)
1333         goto out;
1334 
1335     /*
1336      * In protected mode, before computing the linear address, make sure
1337      * the effective address is within the limits of the segment.
1338      * 32-bit addresses can be used in long and virtual-8086 modes if an
1339      * address override prefix is used. In such cases, segment limits are
1340      * not enforced. When in virtual-8086 mode, the segment limit is -1L
1341      * to reflect this situation.
1342      *
1343      * After computed, the effective address is treated as an unsigned
1344      * quantity.
1345      */
1346     if (!any_64bit_mode(regs) && ((unsigned int)eff_addr > seg_limit))
1347         goto out;
1348 
1349     /*
1350      * Even though 32-bit address encodings are allowed in virtual-8086
1351      * mode, the address range is still limited to [0x-0xffff].
1352      */
1353     if (v8086_mode(regs) && (eff_addr & ~0xffff))
1354         goto out;
1355 
1356     /*
1357      * Data type long could be 64 bits in size. Ensure that our 32-bit
1358      * effective address is not sign-extended when computing the linear
1359      * address.
1360      */
1361     linear_addr = (unsigned long)(eff_addr & 0xffffffff) + seg_base;
1362 
1363     /* Limit linear address to 20 bits */
1364     if (v8086_mode(regs))
1365         linear_addr &= 0xfffff;
1366 
1367 out:
1368     return (void __user *)linear_addr;
1369 }
1370 
1371 /**
1372  * get_addr_ref_64() - Obtain a 64-bit linear address
1373  * @insn:   Instruction struct with ModRM and SIB bytes and displacement
1374  * @regs:   Structure with register values as seen when entering kernel mode
1375  *
1376  * This function is to be used with 64-bit address encodings to obtain the
1377  * linear memory address referred by the instruction's ModRM, SIB,
1378  * displacement bytes and segment base address, as applicable.
1379  *
1380  * Returns:
1381  *
1382  * Linear address referenced by instruction and registers on success.
1383  *
1384  * -1L on error.
1385  */
1386 #ifndef CONFIG_X86_64
1387 static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
1388 {
1389     return (void __user *)-1L;
1390 }
1391 #else
1392 static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
1393 {
1394     unsigned long linear_addr = -1L, seg_base;
1395     int regoff, ret;
1396     long eff_addr;
1397 
1398     if (insn->addr_bytes != 8)
1399         goto out;
1400 
1401     if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1402         ret = get_eff_addr_reg(insn, regs, &regoff, &eff_addr);
1403         if (ret)
1404             goto out;
1405 
1406     } else {
1407         if (insn->sib.nbytes) {
1408             ret = get_eff_addr_sib(insn, regs, &regoff, &eff_addr);
1409             if (ret)
1410                 goto out;
1411         } else {
1412             ret = get_eff_addr_modrm(insn, regs, &regoff, &eff_addr);
1413             if (ret)
1414                 goto out;
1415         }
1416 
1417     }
1418 
1419     ret = get_seg_base_limit(insn, regs, regoff, &seg_base, NULL);
1420     if (ret)
1421         goto out;
1422 
1423     linear_addr = (unsigned long)eff_addr + seg_base;
1424 
1425 out:
1426     return (void __user *)linear_addr;
1427 }
1428 #endif /* CONFIG_X86_64 */
1429 
1430 /**
1431  * insn_get_addr_ref() - Obtain the linear address referred by instruction
1432  * @insn:   Instruction structure containing ModRM byte and displacement
1433  * @regs:   Structure with register values as seen when entering kernel mode
1434  *
1435  * Obtain the linear address referred by the instruction's ModRM, SIB and
1436  * displacement bytes, and segment base, as applicable. In protected mode,
1437  * segment limits are enforced.
1438  *
1439  * Returns:
1440  *
1441  * Linear address referenced by instruction and registers on success.
1442  *
1443  * -1L on error.
1444  */
1445 void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs)
1446 {
1447     if (!insn || !regs)
1448         return (void __user *)-1L;
1449 
1450     if (insn_get_opcode(insn))
1451         return (void __user *)-1L;
1452 
1453     switch (insn->addr_bytes) {
1454     case 2:
1455         return get_addr_ref_16(insn, regs);
1456     case 4:
1457         return get_addr_ref_32(insn, regs);
1458     case 8:
1459         return get_addr_ref_64(insn, regs);
1460     default:
1461         return (void __user *)-1L;
1462     }
1463 }
1464 
1465 int insn_get_effective_ip(struct pt_regs *regs, unsigned long *ip)
1466 {
1467     unsigned long seg_base = 0;
1468 
1469     /*
1470      * If not in user-space long mode, a custom code segment could be in
1471      * use. This is true in protected mode (if the process defined a local
1472      * descriptor table), or virtual-8086 mode. In most of the cases
1473      * seg_base will be zero as in USER_CS.
1474      */
1475     if (!user_64bit_mode(regs)) {
1476         seg_base = insn_get_seg_base(regs, INAT_SEG_REG_CS);
1477         if (seg_base == -1L)
1478             return -EINVAL;
1479     }
1480 
1481     *ip = seg_base + regs->ip;
1482 
1483     return 0;
1484 }
1485 
1486 /**
1487  * insn_fetch_from_user() - Copy instruction bytes from user-space memory
1488  * @regs:   Structure with register values as seen when entering kernel mode
1489  * @buf:    Array to store the fetched instruction
1490  *
1491  * Gets the linear address of the instruction and copies the instruction bytes
1492  * to the buf.
1493  *
1494  * Returns:
1495  *
1496  * - number of instruction bytes copied.
1497  * - 0 if nothing was copied.
1498  * - -EINVAL if the linear address of the instruction could not be calculated
1499  */
1500 int insn_fetch_from_user(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE])
1501 {
1502     unsigned long ip;
1503     int not_copied;
1504 
1505     if (insn_get_effective_ip(regs, &ip))
1506         return -EINVAL;
1507 
1508     not_copied = copy_from_user(buf, (void __user *)ip, MAX_INSN_SIZE);
1509 
1510     return MAX_INSN_SIZE - not_copied;
1511 }
1512 
1513 /**
1514  * insn_fetch_from_user_inatomic() - Copy instruction bytes from user-space memory
1515  *                                   while in atomic code
1516  * @regs:   Structure with register values as seen when entering kernel mode
1517  * @buf:    Array to store the fetched instruction
1518  *
1519  * Gets the linear address of the instruction and copies the instruction bytes
1520  * to the buf. This function must be used in atomic context.
1521  *
1522  * Returns:
1523  *
1524  *  - number of instruction bytes copied.
1525  *  - 0 if nothing was copied.
1526  *  - -EINVAL if the linear address of the instruction could not be calculated.
1527  */
1528 int insn_fetch_from_user_inatomic(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE])
1529 {
1530     unsigned long ip;
1531     int not_copied;
1532 
1533     if (insn_get_effective_ip(regs, &ip))
1534         return -EINVAL;
1535 
1536     not_copied = __copy_from_user_inatomic(buf, (void __user *)ip, MAX_INSN_SIZE);
1537 
1538     return MAX_INSN_SIZE - not_copied;
1539 }
1540 
1541 /**
1542  * insn_decode_from_regs() - Decode an instruction
1543  * @insn:   Structure to store decoded instruction
1544  * @regs:   Structure with register values as seen when entering kernel mode
1545  * @buf:    Buffer containing the instruction bytes
1546  * @buf_size:   Number of instruction bytes available in buf
1547  *
1548  * Decodes the instruction provided in buf and stores the decoding results in
1549  * insn. Also determines the correct address and operand sizes.
1550  *
1551  * Returns:
1552  *
1553  * True if instruction was decoded, False otherwise.
1554  */
1555 bool insn_decode_from_regs(struct insn *insn, struct pt_regs *regs,
1556                unsigned char buf[MAX_INSN_SIZE], int buf_size)
1557 {
1558     int seg_defs;
1559 
1560     insn_init(insn, buf, buf_size, user_64bit_mode(regs));
1561 
1562     /*
1563      * Override the default operand and address sizes with what is specified
1564      * in the code segment descriptor. The instruction decoder only sets
1565      * the address size it to either 4 or 8 address bytes and does nothing
1566      * for the operand bytes. This OK for most of the cases, but we could
1567      * have special cases where, for instance, a 16-bit code segment
1568      * descriptor is used.
1569      * If there is an address override prefix, the instruction decoder
1570      * correctly updates these values, even for 16-bit defaults.
1571      */
1572     seg_defs = insn_get_code_seg_params(regs);
1573     if (seg_defs == -EINVAL)
1574         return false;
1575 
1576     insn->addr_bytes = INSN_CODE_SEG_ADDR_SZ(seg_defs);
1577     insn->opnd_bytes = INSN_CODE_SEG_OPND_SZ(seg_defs);
1578 
1579     if (insn_get_length(insn))
1580         return false;
1581 
1582     if (buf_size < insn->length)
1583         return false;
1584 
1585     return true;
1586 }
1587 
1588 /**
1589  * insn_decode_mmio() - Decode a MMIO instruction
1590  * @insn:   Structure to store decoded instruction
1591  * @bytes:  Returns size of memory operand
1592  *
1593  * Decodes instruction that used for Memory-mapped I/O.
1594  *
1595  * Returns:
1596  *
1597  * Type of the instruction. Size of the memory operand is stored in
1598  * @bytes. If decode failed, MMIO_DECODE_FAILED returned.
1599  */
1600 enum mmio_type insn_decode_mmio(struct insn *insn, int *bytes)
1601 {
1602     enum mmio_type type = MMIO_DECODE_FAILED;
1603 
1604     *bytes = 0;
1605 
1606     if (insn_get_opcode(insn))
1607         return MMIO_DECODE_FAILED;
1608 
1609     switch (insn->opcode.bytes[0]) {
1610     case 0x88: /* MOV m8,r8 */
1611         *bytes = 1;
1612         fallthrough;
1613     case 0x89: /* MOV m16/m32/m64, r16/m32/m64 */
1614         if (!*bytes)
1615             *bytes = insn->opnd_bytes;
1616         type = MMIO_WRITE;
1617         break;
1618 
1619     case 0xc6: /* MOV m8, imm8 */
1620         *bytes = 1;
1621         fallthrough;
1622     case 0xc7: /* MOV m16/m32/m64, imm16/imm32/imm64 */
1623         if (!*bytes)
1624             *bytes = insn->opnd_bytes;
1625         type = MMIO_WRITE_IMM;
1626         break;
1627 
1628     case 0x8a: /* MOV r8, m8 */
1629         *bytes = 1;
1630         fallthrough;
1631     case 0x8b: /* MOV r16/r32/r64, m16/m32/m64 */
1632         if (!*bytes)
1633             *bytes = insn->opnd_bytes;
1634         type = MMIO_READ;
1635         break;
1636 
1637     case 0xa4: /* MOVS m8, m8 */
1638         *bytes = 1;
1639         fallthrough;
1640     case 0xa5: /* MOVS m16/m32/m64, m16/m32/m64 */
1641         if (!*bytes)
1642             *bytes = insn->opnd_bytes;
1643         type = MMIO_MOVS;
1644         break;
1645 
1646     case 0x0f: /* Two-byte instruction */
1647         switch (insn->opcode.bytes[1]) {
1648         case 0xb6: /* MOVZX r16/r32/r64, m8 */
1649             *bytes = 1;
1650             fallthrough;
1651         case 0xb7: /* MOVZX r32/r64, m16 */
1652             if (!*bytes)
1653                 *bytes = 2;
1654             type = MMIO_READ_ZERO_EXTEND;
1655             break;
1656 
1657         case 0xbe: /* MOVSX r16/r32/r64, m8 */
1658             *bytes = 1;
1659             fallthrough;
1660         case 0xbf: /* MOVSX r32/r64, m16 */
1661             if (!*bytes)
1662                 *bytes = 2;
1663             type = MMIO_READ_SIGN_EXTEND;
1664             break;
1665         }
1666         break;
1667     }
1668 
1669     return type;
1670 }
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!