x86/tools/insn_sanity.c

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /*
0003  * x86 decoder sanity test - based on test_get_insn.c
0004  *
0005  * Copyright (C) IBM Corporation, 2009
0006  * Copyright (C) Hitachi, Ltd., 2011
0007  */
0008
0009 #include <stdlib.h>
0010 #include <stdio.h>
0011 #include <string.h>
0012 #include <assert.h>
0013 #include <unistd.h>
0014 #include <sys/types.h>
0015 #include <sys/stat.h>
0016 #include <fcntl.h>
0017 #include <asm/insn.h>
0018 #include <inat.c>
0019 #include <insn.c>
0020
0021 /*
0022  * Test of instruction analysis against tampering.
0023  * Feed random binary to instruction decoder and ensure not to
0024  * access out-of-instruction-buffer.
0025  */
0026
0027 #define DEFAULT_MAX_ITER    10000
0028 #define INSN_NOP 0x90
0029
0030 static const char   *prog;      /* Program name */
0031 static int      verbose;    /* Verbosity */
0032 static int      x86_64;     /* x86-64 bit mode flag */
0033 static unsigned int seed;       /* Random seed */
0034 static unsigned long    iter_start; /* Start of iteration number */
0035 static unsigned long    iter_end = DEFAULT_MAX_ITER;    /* End of iteration number */
0036 static FILE     *input_file;    /* Input file name */
0037
0038 static void usage(const char *err)
0039 {
0040     if (err)
0041         fprintf(stderr, "%s: Error: %s\n\n", prog, err);
0042     fprintf(stderr, "Usage: %s [-y|-n|-v] [-s seed[,no]] [-m max] [-i input]\n", prog);
0043     fprintf(stderr, "\t-y   64bit mode\n");
0044     fprintf(stderr, "\t-n   32bit mode\n");
0045     fprintf(stderr, "\t-v   Verbosity(-vv dumps any decoded result)\n");
0046     fprintf(stderr, "\t-s   Give a random seed (and iteration number)\n");
0047     fprintf(stderr, "\t-m   Give a maximum iteration number\n");
0048     fprintf(stderr, "\t-i   Give an input file with decoded binary\n");
0049     exit(1);
0050 }
0051
0052 static void dump_field(FILE *fp, const char *name, const char *indent,
0053                struct insn_field *field)
0054 {
0055     fprintf(fp, "%s.%s = {\n", indent, name);
0056     fprintf(fp, "%s\t.value = %d, bytes[] = {%x, %x, %x, %x},\n",
0057         indent, field->value, field->bytes[0], field->bytes[1],
0058         field->bytes[2], field->bytes[3]);
0059     fprintf(fp, "%s\t.got = %d, .nbytes = %d},\n", indent,
0060         field->got, field->nbytes);
0061 }
0062
0063 static void dump_insn(FILE *fp, struct insn *insn)
0064 {
0065     fprintf(fp, "Instruction = {\n");
0066     dump_field(fp, "prefixes", "\t",    &insn->prefixes);
0067     dump_field(fp, "rex_prefix", "\t",  &insn->rex_prefix);
0068     dump_field(fp, "vex_prefix", "\t",  &insn->vex_prefix);
0069     dump_field(fp, "opcode", "\t",      &insn->opcode);
0070     dump_field(fp, "modrm", "\t",       &insn->modrm);
0071     dump_field(fp, "sib", "\t",     &insn->sib);
0072     dump_field(fp, "displacement", "\t",    &insn->displacement);
0073     dump_field(fp, "immediate1", "\t",  &insn->immediate1);
0074     dump_field(fp, "immediate2", "\t",  &insn->immediate2);
0075     fprintf(fp, "\t.attr = %x, .opnd_bytes = %d, .addr_bytes = %d,\n",
0076         insn->attr, insn->opnd_bytes, insn->addr_bytes);
0077     fprintf(fp, "\t.length = %d, .x86_64 = %d, .kaddr = %p}\n",
0078         insn->length, insn->x86_64, insn->kaddr);
0079 }
0080
0081 static void dump_stream(FILE *fp, const char *msg, unsigned long nr_iter,
0082             unsigned char *insn_buff, struct insn *insn)
0083 {
0084     int i;
0085
0086     fprintf(fp, "%s:\n", msg);
0087
0088     dump_insn(fp, insn);
0089
0090     fprintf(fp, "You can reproduce this with below command(s);\n");
0091
0092     /* Input a decoded instruction sequence directly */
0093     fprintf(fp, " $ echo ");
0094     for (i = 0; i < MAX_INSN_SIZE; i++)
0095         fprintf(fp, " %02x", insn_buff[i]);
0096     fprintf(fp, " | %s -i -\n", prog);
0097
0098     if (!input_file) {
0099         fprintf(fp, "Or \n");
0100         /* Give a seed and iteration number */
0101         fprintf(fp, " $ %s -s 0x%x,%lu\n", prog, seed, nr_iter);
0102     }
0103 }
0104
0105 static void init_random_seed(void)
0106 {
0107     int fd;
0108
0109     fd = open("/dev/urandom", O_RDONLY);
0110     if (fd < 0)
0111         goto fail;
0112
0113     if (read(fd, &seed, sizeof(seed)) != sizeof(seed))
0114         goto fail;
0115
0116     close(fd);
0117     return;
0118 fail:
0119     usage("Failed to open /dev/urandom");
0120 }
0121
0122 /* Read given instruction sequence from the input file */
0123 static int read_next_insn(unsigned char *insn_buff)
0124 {
0125     char buf[256]  = "", *tmp;
0126     int i;
0127
0128     tmp = fgets(buf, ARRAY_SIZE(buf), input_file);
0129     if (tmp == NULL || feof(input_file))
0130         return 0;
0131
0132     for (i = 0; i < MAX_INSN_SIZE; i++) {
0133         insn_buff[i] = (unsigned char)strtoul(tmp, &tmp, 16);
0134         if (*tmp != ' ')
0135             break;
0136     }
0137
0138     return i;
0139 }
0140
0141 static int generate_insn(unsigned char *insn_buff)
0142 {
0143     int i;
0144
0145     if (input_file)
0146         return read_next_insn(insn_buff);
0147
0148     /* Fills buffer with random binary up to MAX_INSN_SIZE */
0149     for (i = 0; i < MAX_INSN_SIZE - 1; i += 2)
0150         *(unsigned short *)(&insn_buff[i]) = random() & 0xffff;
0151
0152     while (i < MAX_INSN_SIZE)
0153         insn_buff[i++] = random() & 0xff;
0154
0155     return i;
0156 }
0157
0158 static void parse_args(int argc, char **argv)
0159 {
0160     int c;
0161     char *tmp = NULL;
0162     int set_seed = 0;
0163
0164     prog = argv[0];
0165     while ((c = getopt(argc, argv, "ynvs:m:i:")) != -1) {
0166         switch (c) {
0167         case 'y':
0168             x86_64 = 1;
0169             break;
0170         case 'n':
0171             x86_64 = 0;
0172             break;
0173         case 'v':
0174             verbose++;
0175             break;
0176         case 'i':
0177             if (strcmp("-", optarg) == 0)
0178                 input_file = stdin;
0179             else
0180                 input_file = fopen(optarg, "r");
0181             if (!input_file)
0182                 usage("Failed to open input file");
0183             break;
0184         case 's':
0185             seed = (unsigned int)strtoul(optarg, &tmp, 0);
0186             if (*tmp == ',') {
0187                 optarg = tmp + 1;
0188                 iter_start = strtoul(optarg, &tmp, 0);
0189             }
0190             if (*tmp != '\0' || tmp == optarg)
0191                 usage("Failed to parse seed");
0192             set_seed = 1;
0193             break;
0194         case 'm':
0195             iter_end = strtoul(optarg, &tmp, 0);
0196             if (*tmp != '\0' || tmp == optarg)
0197                 usage("Failed to parse max_iter");
0198             break;
0199         default:
0200             usage(NULL);
0201         }
0202     }
0203
0204     /* Check errors */
0205     if (iter_end < iter_start)
0206         usage("Max iteration number must be bigger than iter-num");
0207
0208     if (set_seed && input_file)
0209         usage("Don't use input file (-i) with random seed (-s)");
0210
0211     /* Initialize random seed */
0212     if (!input_file) {
0213         if (!set_seed)  /* No seed is given */
0214             init_random_seed();
0215         srand(seed);
0216     }
0217 }
0218
0219 int main(int argc, char **argv)
0220 {
0221     int insns = 0, ret;
0222     struct insn insn;
0223     int errors = 0;
0224     unsigned long i;
0225     unsigned char insn_buff[MAX_INSN_SIZE * 2];
0226
0227     parse_args(argc, argv);
0228
0229     /* Prepare stop bytes with NOPs */
0230     memset(insn_buff + MAX_INSN_SIZE, INSN_NOP, MAX_INSN_SIZE);
0231
0232     for (i = 0; i < iter_end; i++) {
0233         if (generate_insn(insn_buff) <= 0)
0234             break;
0235
0236         if (i < iter_start) /* Skip to given iteration number */
0237             continue;
0238
0239         /* Decode an instruction */
0240         ret = insn_decode(&insn, insn_buff, sizeof(insn_buff),
0241                   x86_64 ? INSN_MODE_64 : INSN_MODE_32);
0242
0243         if (insn.next_byte <= insn.kaddr ||
0244             insn.kaddr + MAX_INSN_SIZE < insn.next_byte) {
0245             /* Access out-of-range memory */
0246             dump_stream(stderr, "Error: Found an access violation", i, insn_buff, &insn);
0247             errors++;
0248         } else if (verbose && ret < 0)
0249             dump_stream(stdout, "Info: Found an undecodable input", i, insn_buff, &insn);
0250         else if (verbose >= 2)
0251             dump_insn(stdout, &insn);
0252         insns++;
0253     }
0254
0255     fprintf((errors) ? stderr : stdout,
0256         "%s: %s: decoded and checked %d %s instructions with %d errors (seed:0x%x)\n",
0257         prog,
0258         (errors) ? "Failure" : "Success",
0259         insns,
0260         (input_file) ? "given" : "random",
0261         errors,
0262         seed);
0263
0264     return errors ? 1 : 0;
0265 }