12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670 |
- /*
- * Utility functions for x86 operand and address decoding
- *
- * Copyright (C) Intel Corporation 2017
- */
- #include <linux/kernel.h>
- #include <linux/string.h>
- #include <linux/ratelimit.h>
- #include <linux/mmu_context.h>
- #include <asm/desc_defs.h>
- #include <asm/desc.h>
- #include <asm/inat.h>
- #include <asm/insn.h>
- #include <asm/insn-eval.h>
- #include <asm/ldt.h>
- #include <asm/vm86.h>
- #undef pr_fmt
- #define pr_fmt(fmt) "insn: " fmt
- enum reg_type {
- REG_TYPE_RM = 0,
- REG_TYPE_REG,
- REG_TYPE_INDEX,
- REG_TYPE_BASE,
- };
- /**
- * is_string_insn() - Determine if instruction is a string instruction
- * @insn: Instruction containing the opcode to inspect
- *
- * Returns:
- *
- * true if the instruction, determined by the opcode, is any of the
- * string instructions as defined in the Intel Software Development manual.
- * False otherwise.
- */
- static bool is_string_insn(struct insn *insn)
- {
- /* All string instructions have a 1-byte opcode. */
- if (insn->opcode.nbytes != 1)
- return false;
- switch (insn->opcode.bytes[0]) {
- case 0x6c ... 0x6f: /* INS, OUTS */
- case 0xa4 ... 0xa7: /* MOVS, CMPS */
- case 0xaa ... 0xaf: /* STOS, LODS, SCAS */
- return true;
- default:
- return false;
- }
- }
- /**
- * insn_has_rep_prefix() - Determine if instruction has a REP prefix
- * @insn: Instruction containing the prefix to inspect
- *
- * Returns:
- *
- * true if the instruction has a REP prefix, false if not.
- */
- bool insn_has_rep_prefix(struct insn *insn)
- {
- insn_byte_t p;
- int i;
- insn_get_prefixes(insn);
- for_each_insn_prefix(insn, i, p) {
- if (p == 0xf2 || p == 0xf3)
- return true;
- }
- return false;
- }
- /**
- * get_seg_reg_override_idx() - obtain segment register override index
- * @insn: Valid instruction with segment override prefixes
- *
- * Inspect the instruction prefixes in @insn and find segment overrides, if any.
- *
- * Returns:
- *
- * A constant identifying the segment register to use, among CS, SS, DS,
- * ES, FS, or GS. INAT_SEG_REG_DEFAULT is returned if no segment override
- * prefixes were found.
- *
- * -EINVAL in case of error.
- */
- static int get_seg_reg_override_idx(struct insn *insn)
- {
- int idx = INAT_SEG_REG_DEFAULT;
- int num_overrides = 0, i;
- insn_byte_t p;
- insn_get_prefixes(insn);
- /* Look for any segment override prefixes. */
- for_each_insn_prefix(insn, i, p) {
- insn_attr_t attr;
- attr = inat_get_opcode_attribute(p);
- switch (attr) {
- case INAT_MAKE_PREFIX(INAT_PFX_CS):
- idx = INAT_SEG_REG_CS;
- num_overrides++;
- break;
- case INAT_MAKE_PREFIX(INAT_PFX_SS):
- idx = INAT_SEG_REG_SS;
- num_overrides++;
- break;
- case INAT_MAKE_PREFIX(INAT_PFX_DS):
- idx = INAT_SEG_REG_DS;
- num_overrides++;
- break;
- case INAT_MAKE_PREFIX(INAT_PFX_ES):
- idx = INAT_SEG_REG_ES;
- num_overrides++;
- break;
- case INAT_MAKE_PREFIX(INAT_PFX_FS):
- idx = INAT_SEG_REG_FS;
- num_overrides++;
- break;
- case INAT_MAKE_PREFIX(INAT_PFX_GS):
- idx = INAT_SEG_REG_GS;
- num_overrides++;
- break;
- /* No default action needed. */
- }
- }
- /* More than one segment override prefix leads to undefined behavior. */
- if (num_overrides > 1)
- return -EINVAL;
- return idx;
- }
- /**
- * check_seg_overrides() - check if segment override prefixes are allowed
- * @insn: Valid instruction with segment override prefixes
- * @regoff: Operand offset, in pt_regs, for which the check is performed
- *
- * For a particular register used in register-indirect addressing, determine if
- * segment override prefixes can be used. Specifically, no overrides are allowed
- * for rDI if used with a string instruction.
- *
- * Returns:
- *
- * True if segment override prefixes can be used with the register indicated
- * in @regoff. False if otherwise.
- */
- static bool check_seg_overrides(struct insn *insn, int regoff)
- {
- if (regoff == offsetof(struct pt_regs, di) && is_string_insn(insn))
- return false;
- return true;
- }
- /**
- * resolve_default_seg() - resolve default segment register index for an operand
- * @insn: Instruction with opcode and address size. Must be valid.
- * @regs: Register values as seen when entering kernel mode
- * @off: Operand offset, in pt_regs, for which resolution is needed
- *
- * Resolve the default segment register index associated with the instruction
- * operand register indicated by @off. Such index is resolved based on defaults
- * described in the Intel Software Development Manual.
- *
- * Returns:
- *
- * If in protected mode, a constant identifying the segment register to use,
- * among CS, SS, ES or DS. If in long mode, INAT_SEG_REG_IGNORE.
- *
- * -EINVAL in case of error.
- */
- static int resolve_default_seg(struct insn *insn, struct pt_regs *regs, int off)
- {
- if (any_64bit_mode(regs))
- return INAT_SEG_REG_IGNORE;
- /*
- * Resolve the default segment register as described in Section 3.7.4
- * of the Intel Software Development Manual Vol. 1:
- *
- * + DS for all references involving r[ABCD]X, and rSI.
- * + If used in a string instruction, ES for rDI. Otherwise, DS.
- * + AX, CX and DX are not valid register operands in 16-bit address
- * encodings but are valid for 32-bit and 64-bit encodings.
- * + -EDOM is reserved to identify for cases in which no register
- * is used (i.e., displacement-only addressing). Use DS.
- * + SS for rSP or rBP.
- * + CS for rIP.
- */
- switch (off) {
- case offsetof(struct pt_regs, ax):
- case offsetof(struct pt_regs, cx):
- case offsetof(struct pt_regs, dx):
- /* Need insn to verify address size. */
- if (insn->addr_bytes == 2)
- return -EINVAL;
- fallthrough;
- case -EDOM:
- case offsetof(struct pt_regs, bx):
- case offsetof(struct pt_regs, si):
- return INAT_SEG_REG_DS;
- case offsetof(struct pt_regs, di):
- if (is_string_insn(insn))
- return INAT_SEG_REG_ES;
- return INAT_SEG_REG_DS;
- case offsetof(struct pt_regs, bp):
- case offsetof(struct pt_regs, sp):
- return INAT_SEG_REG_SS;
- case offsetof(struct pt_regs, ip):
- return INAT_SEG_REG_CS;
- default:
- return -EINVAL;
- }
- }
- /**
- * resolve_seg_reg() - obtain segment register index
- * @insn: Instruction with operands
- * @regs: Register values as seen when entering kernel mode
- * @regoff: Operand offset, in pt_regs, used to determine segment register
- *
- * Determine the segment register associated with the operands and, if
- * applicable, prefixes and the instruction pointed by @insn.
- *
- * The segment register associated to an operand used in register-indirect
- * addressing depends on:
- *
- * a) Whether running in long mode (in such a case segments are ignored, except
- * if FS or GS are used).
- *
- * b) Whether segment override prefixes can be used. Certain instructions and
- * registers do not allow override prefixes.
- *
- * c) Whether segment overrides prefixes are found in the instruction prefixes.
- *
- * d) If there are not segment override prefixes or they cannot be used, the
- * default segment register associated with the operand register is used.
- *
- * The function checks first if segment override prefixes can be used with the
- * operand indicated by @regoff. If allowed, obtain such overridden segment
- * register index. Lastly, if not prefixes were found or cannot be used, resolve
- * the segment register index to use based on the defaults described in the
- * Intel documentation. In long mode, all segment register indexes will be
- * ignored, except if overrides were found for FS or GS. All these operations
- * are done using helper functions.
- *
- * The operand register, @regoff, is represented as the offset from the base of
- * pt_regs.
- *
- * As stated, the main use of this function is to determine the segment register
- * index based on the instruction, its operands and prefixes. Hence, @insn
- * must be valid. However, if @regoff indicates rIP, we don't need to inspect
- * @insn at all as in this case CS is used in all cases. This case is checked
- * before proceeding further.
- *
- * Please note that this function does not return the value in the segment
- * register (i.e., the segment selector) but our defined index. The segment
- * selector needs to be obtained using get_segment_selector() and passing the
- * segment register index resolved by this function.
- *
- * Returns:
- *
- * An index identifying the segment register to use, among CS, SS, DS,
- * ES, FS, or GS. INAT_SEG_REG_IGNORE is returned if running in long mode.
- *
- * -EINVAL in case of error.
- */
- static int resolve_seg_reg(struct insn *insn, struct pt_regs *regs, int regoff)
- {
- int idx;
- /*
- * In the unlikely event of having to resolve the segment register
- * index for rIP, do it first. Segment override prefixes should not
- * be used. Hence, it is not necessary to inspect the instruction,
- * which may be invalid at this point.
- */
- if (regoff == offsetof(struct pt_regs, ip)) {
- if (any_64bit_mode(regs))
- return INAT_SEG_REG_IGNORE;
- else
- return INAT_SEG_REG_CS;
- }
- if (!insn)
- return -EINVAL;
- if (!check_seg_overrides(insn, regoff))
- return resolve_default_seg(insn, regs, regoff);
- idx = get_seg_reg_override_idx(insn);
- if (idx < 0)
- return idx;
- if (idx == INAT_SEG_REG_DEFAULT)
- return resolve_default_seg(insn, regs, regoff);
- /*
- * In long mode, segment override prefixes are ignored, except for
- * overrides for FS and GS.
- */
- if (any_64bit_mode(regs)) {
- if (idx != INAT_SEG_REG_FS &&
- idx != INAT_SEG_REG_GS)
- idx = INAT_SEG_REG_IGNORE;
- }
- return idx;
- }
- /**
- * get_segment_selector() - obtain segment selector
- * @regs: Register values as seen when entering kernel mode
- * @seg_reg_idx: Segment register index to use
- *
- * Obtain the segment selector from any of the CS, SS, DS, ES, FS, GS segment
- * registers. In CONFIG_X86_32, the segment is obtained from either pt_regs or
- * kernel_vm86_regs as applicable. In CONFIG_X86_64, CS and SS are obtained
- * from pt_regs. DS, ES, FS and GS are obtained by reading the actual CPU
- * registers. This done for only for completeness as in CONFIG_X86_64 segment
- * registers are ignored.
- *
- * Returns:
- *
- * Value of the segment selector, including null when running in
- * long mode.
- *
- * -EINVAL on error.
- */
- static short get_segment_selector(struct pt_regs *regs, int seg_reg_idx)
- {
- unsigned short sel;
- #ifdef CONFIG_X86_64
- switch (seg_reg_idx) {
- case INAT_SEG_REG_IGNORE:
- return 0;
- case INAT_SEG_REG_CS:
- return (unsigned short)(regs->cs & 0xffff);
- case INAT_SEG_REG_SS:
- return (unsigned short)(regs->ss & 0xffff);
- case INAT_SEG_REG_DS:
- savesegment(ds, sel);
- return sel;
- case INAT_SEG_REG_ES:
- savesegment(es, sel);
- return sel;
- case INAT_SEG_REG_FS:
- savesegment(fs, sel);
- return sel;
- case INAT_SEG_REG_GS:
- savesegment(gs, sel);
- return sel;
- default:
- return -EINVAL;
- }
- #else /* CONFIG_X86_32 */
- struct kernel_vm86_regs *vm86regs = (struct kernel_vm86_regs *)regs;
- if (v8086_mode(regs)) {
- switch (seg_reg_idx) {
- case INAT_SEG_REG_CS:
- return (unsigned short)(regs->cs & 0xffff);
- case INAT_SEG_REG_SS:
- return (unsigned short)(regs->ss & 0xffff);
- case INAT_SEG_REG_DS:
- return vm86regs->ds;
- case INAT_SEG_REG_ES:
- return vm86regs->es;
- case INAT_SEG_REG_FS:
- return vm86regs->fs;
- case INAT_SEG_REG_GS:
- return vm86regs->gs;
- case INAT_SEG_REG_IGNORE:
- default:
- return -EINVAL;
- }
- }
- switch (seg_reg_idx) {
- case INAT_SEG_REG_CS:
- return (unsigned short)(regs->cs & 0xffff);
- case INAT_SEG_REG_SS:
- return (unsigned short)(regs->ss & 0xffff);
- case INAT_SEG_REG_DS:
- return (unsigned short)(regs->ds & 0xffff);
- case INAT_SEG_REG_ES:
- return (unsigned short)(regs->es & 0xffff);
- case INAT_SEG_REG_FS:
- return (unsigned short)(regs->fs & 0xffff);
- case INAT_SEG_REG_GS:
- savesegment(gs, sel);
- return sel;
- case INAT_SEG_REG_IGNORE:
- default:
- return -EINVAL;
- }
- #endif /* CONFIG_X86_64 */
- }
- static const int pt_regoff[] = {
- offsetof(struct pt_regs, ax),
- offsetof(struct pt_regs, cx),
- offsetof(struct pt_regs, dx),
- offsetof(struct pt_regs, bx),
- offsetof(struct pt_regs, sp),
- offsetof(struct pt_regs, bp),
- offsetof(struct pt_regs, si),
- offsetof(struct pt_regs, di),
- #ifdef CONFIG_X86_64
- offsetof(struct pt_regs, r8),
- offsetof(struct pt_regs, r9),
- offsetof(struct pt_regs, r10),
- offsetof(struct pt_regs, r11),
- offsetof(struct pt_regs, r12),
- offsetof(struct pt_regs, r13),
- offsetof(struct pt_regs, r14),
- offsetof(struct pt_regs, r15),
- #else
- offsetof(struct pt_regs, ds),
- offsetof(struct pt_regs, es),
- offsetof(struct pt_regs, fs),
- offsetof(struct pt_regs, gs),
- #endif
- };
- int pt_regs_offset(struct pt_regs *regs, int regno)
- {
- if ((unsigned)regno < ARRAY_SIZE(pt_regoff))
- return pt_regoff[regno];
- return -EDOM;
- }
- static int get_regno(struct insn *insn, enum reg_type type)
- {
- int nr_registers = ARRAY_SIZE(pt_regoff);
- int regno = 0;
- /*
- * Don't possibly decode a 32-bit instructions as
- * reading a 64-bit-only register.
- */
- if (IS_ENABLED(CONFIG_X86_64) && !insn->x86_64)
- nr_registers -= 8;
- switch (type) {
- case REG_TYPE_RM:
- regno = X86_MODRM_RM(insn->modrm.value);
- /*
- * ModRM.mod == 0 and ModRM.rm == 5 means a 32-bit displacement
- * follows the ModRM byte.
- */
- if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
- return -EDOM;
- if (X86_REX_B(insn->rex_prefix.value))
- regno += 8;
- break;
- case REG_TYPE_REG:
- regno = X86_MODRM_REG(insn->modrm.value);
- if (X86_REX_R(insn->rex_prefix.value))
- regno += 8;
- break;
- case REG_TYPE_INDEX:
- regno = X86_SIB_INDEX(insn->sib.value);
- if (X86_REX_X(insn->rex_prefix.value))
- regno += 8;
- /*
- * If ModRM.mod != 3 and SIB.index = 4 the scale*index
- * portion of the address computation is null. This is
- * true only if REX.X is 0. In such a case, the SIB index
- * is used in the address computation.
- */
- if (X86_MODRM_MOD(insn->modrm.value) != 3 && regno == 4)
- return -EDOM;
- break;
- case REG_TYPE_BASE:
- regno = X86_SIB_BASE(insn->sib.value);
- /*
- * If ModRM.mod is 0 and SIB.base == 5, the base of the
- * register-indirect addressing is 0. In this case, a
- * 32-bit displacement follows the SIB byte.
- */
- if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
- return -EDOM;
- if (X86_REX_B(insn->rex_prefix.value))
- regno += 8;
- break;
- default:
- pr_err_ratelimited("invalid register type: %d\n", type);
- return -EINVAL;
- }
- if (regno >= nr_registers) {
- WARN_ONCE(1, "decoded an instruction with an invalid register");
- return -EINVAL;
- }
- return regno;
- }
- static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
- enum reg_type type)
- {
- int regno = get_regno(insn, type);
- if (regno < 0)
- return regno;
- return pt_regs_offset(regs, regno);
- }
- /**
- * get_reg_offset_16() - Obtain offset of register indicated by instruction
- * @insn: Instruction containing ModRM byte
- * @regs: Register values as seen when entering kernel mode
- * @offs1: Offset of the first operand register
- * @offs2: Offset of the second operand register, if applicable
- *
- * Obtain the offset, in pt_regs, of the registers indicated by the ModRM byte
- * in @insn. This function is to be used with 16-bit address encodings. The
- * @offs1 and @offs2 will be written with the offset of the two registers
- * indicated by the instruction. In cases where any of the registers is not
- * referenced by the instruction, the value will be set to -EDOM.
- *
- * Returns:
- *
- * 0 on success, -EINVAL on error.
- */
- static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs,
- int *offs1, int *offs2)
- {
- /*
- * 16-bit addressing can use one or two registers. Specifics of
- * encodings are given in Table 2-1. "16-Bit Addressing Forms with the
- * ModR/M Byte" of the Intel Software Development Manual.
- */
- static const int regoff1[] = {
- offsetof(struct pt_regs, bx),
- offsetof(struct pt_regs, bx),
- offsetof(struct pt_regs, bp),
- offsetof(struct pt_regs, bp),
- offsetof(struct pt_regs, si),
- offsetof(struct pt_regs, di),
- offsetof(struct pt_regs, bp),
- offsetof(struct pt_regs, bx),
- };
- static const int regoff2[] = {
- offsetof(struct pt_regs, si),
- offsetof(struct pt_regs, di),
- offsetof(struct pt_regs, si),
- offsetof(struct pt_regs, di),
- -EDOM,
- -EDOM,
- -EDOM,
- -EDOM,
- };
- if (!offs1 || !offs2)
- return -EINVAL;
- /* Operand is a register, use the generic function. */
- if (X86_MODRM_MOD(insn->modrm.value) == 3) {
- *offs1 = insn_get_modrm_rm_off(insn, regs);
- *offs2 = -EDOM;
- return 0;
- }
- *offs1 = regoff1[X86_MODRM_RM(insn->modrm.value)];
- *offs2 = regoff2[X86_MODRM_RM(insn->modrm.value)];
- /*
- * If ModRM.mod is 0 and ModRM.rm is 110b, then we use displacement-
- * only addressing. This means that no registers are involved in
- * computing the effective address. Thus, ensure that the first
- * register offset is invalid. The second register offset is already
- * invalid under the aforementioned conditions.
- */
- if ((X86_MODRM_MOD(insn->modrm.value) == 0) &&
- (X86_MODRM_RM(insn->modrm.value) == 6))
- *offs1 = -EDOM;
- return 0;
- }
- /**
- * get_desc() - Obtain contents of a segment descriptor
- * @out: Segment descriptor contents on success
- * @sel: Segment selector
- *
- * Given a segment selector, obtain a pointer to the segment descriptor.
- * Both global and local descriptor tables are supported.
- *
- * Returns:
- *
- * True on success, false on failure.
- *
- * NULL on error.
- */
- static bool get_desc(struct desc_struct *out, unsigned short sel)
- {
- struct desc_ptr gdt_desc = {0, 0};
- unsigned long desc_base;
- #ifdef CONFIG_MODIFY_LDT_SYSCALL
- if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) {
- bool success = false;
- struct ldt_struct *ldt;
- /* Bits [15:3] contain the index of the desired entry. */
- sel >>= 3;
- mutex_lock(¤t->active_mm->context.lock);
- ldt = current->active_mm->context.ldt;
- if (ldt && sel < ldt->nr_entries) {
- *out = ldt->entries[sel];
- success = true;
- }
- mutex_unlock(¤t->active_mm->context.lock);
- return success;
- }
- #endif
- native_store_gdt(&gdt_desc);
- /*
- * Segment descriptors have a size of 8 bytes. Thus, the index is
- * multiplied by 8 to obtain the memory offset of the desired descriptor
- * from the base of the GDT. As bits [15:3] of the segment selector
- * contain the index, it can be regarded as multiplied by 8 already.
- * All that remains is to clear bits [2:0].
- */
- desc_base = sel & ~(SEGMENT_RPL_MASK | SEGMENT_TI_MASK);
- if (desc_base > gdt_desc.size)
- return false;
- *out = *(struct desc_struct *)(gdt_desc.address + desc_base);
- return true;
- }
- /**
- * insn_get_seg_base() - Obtain base address of segment descriptor.
- * @regs: Register values as seen when entering kernel mode
- * @seg_reg_idx: Index of the segment register pointing to seg descriptor
- *
- * Obtain the base address of the segment as indicated by the segment descriptor
- * pointed by the segment selector. The segment selector is obtained from the
- * input segment register index @seg_reg_idx.
- *
- * Returns:
- *
- * In protected mode, base address of the segment. Zero in long mode,
- * except when FS or GS are used. In virtual-8086 mode, the segment
- * selector shifted 4 bits to the right.
- *
- * -1L in case of error.
- */
- unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx)
- {
- struct desc_struct desc;
- short sel;
- sel = get_segment_selector(regs, seg_reg_idx);
- if (sel < 0)
- return -1L;
- if (v8086_mode(regs))
- /*
- * Base is simply the segment selector shifted 4
- * bits to the right.
- */
- return (unsigned long)(sel << 4);
- if (any_64bit_mode(regs)) {
- /*
- * Only FS or GS will have a base address, the rest of
- * the segments' bases are forced to 0.
- */
- unsigned long base;
- if (seg_reg_idx == INAT_SEG_REG_FS) {
- rdmsrl(MSR_FS_BASE, base);
- } else if (seg_reg_idx == INAT_SEG_REG_GS) {
- /*
- * swapgs was called at the kernel entry point. Thus,
- * MSR_KERNEL_GS_BASE will have the user-space GS base.
- */
- if (user_mode(regs))
- rdmsrl(MSR_KERNEL_GS_BASE, base);
- else
- rdmsrl(MSR_GS_BASE, base);
- } else {
- base = 0;
- }
- return base;
- }
- /* In protected mode the segment selector cannot be null. */
- if (!sel)
- return -1L;
- if (!get_desc(&desc, sel))
- return -1L;
- return get_desc_base(&desc);
- }
- /**
- * get_seg_limit() - Obtain the limit of a segment descriptor
- * @regs: Register values as seen when entering kernel mode
- * @seg_reg_idx: Index of the segment register pointing to seg descriptor
- *
- * Obtain the limit of the segment as indicated by the segment descriptor
- * pointed by the segment selector. The segment selector is obtained from the
- * input segment register index @seg_reg_idx.
- *
- * Returns:
- *
- * In protected mode, the limit of the segment descriptor in bytes.
- * In long mode and virtual-8086 mode, segment limits are not enforced. Thus,
- * limit is returned as -1L to imply a limit-less segment.
- *
- * Zero is returned on error.
- */
- static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)
- {
- struct desc_struct desc;
- unsigned long limit;
- short sel;
- sel = get_segment_selector(regs, seg_reg_idx);
- if (sel < 0)
- return 0;
- if (any_64bit_mode(regs) || v8086_mode(regs))
- return -1L;
- if (!sel)
- return 0;
- if (!get_desc(&desc, sel))
- return 0;
- /*
- * If the granularity bit is set, the limit is given in multiples
- * of 4096. This also means that the 12 least significant bits are
- * not tested when checking the segment limits. In practice,
- * this means that the segment ends in (limit << 12) + 0xfff.
- */
- limit = get_desc_limit(&desc);
- if (desc.g)
- limit = (limit << 12) + 0xfff;
- return limit;
- }
- /**
- * insn_get_code_seg_params() - Obtain code segment parameters
- * @regs: Structure with register values as seen when entering kernel mode
- *
- * Obtain address and operand sizes of the code segment. It is obtained from the
- * selector contained in the CS register in regs. In protected mode, the default
- * address is determined by inspecting the L and D bits of the segment
- * descriptor. In virtual-8086 mode, the default is always two bytes for both
- * address and operand sizes.
- *
- * Returns:
- *
- * An int containing ORed-in default parameters on success.
- *
- * -EINVAL on error.
- */
- int insn_get_code_seg_params(struct pt_regs *regs)
- {
- struct desc_struct desc;
- short sel;
- if (v8086_mode(regs))
- /* Address and operand size are both 16-bit. */
- return INSN_CODE_SEG_PARAMS(2, 2);
- sel = get_segment_selector(regs, INAT_SEG_REG_CS);
- if (sel < 0)
- return sel;
- if (!get_desc(&desc, sel))
- return -EINVAL;
- /*
- * The most significant byte of the Type field of the segment descriptor
- * determines whether a segment contains data or code. If this is a data
- * segment, return error.
- */
- if (!(desc.type & BIT(3)))
- return -EINVAL;
- switch ((desc.l << 1) | desc.d) {
- case 0: /*
- * Legacy mode. CS.L=0, CS.D=0. Address and operand size are
- * both 16-bit.
- */
- return INSN_CODE_SEG_PARAMS(2, 2);
- case 1: /*
- * Legacy mode. CS.L=0, CS.D=1. Address and operand size are
- * both 32-bit.
- */
- return INSN_CODE_SEG_PARAMS(4, 4);
- case 2: /*
- * IA-32e 64-bit mode. CS.L=1, CS.D=0. Address size is 64-bit;
- * operand size is 32-bit.
- */
- return INSN_CODE_SEG_PARAMS(4, 8);
- case 3: /* Invalid setting. CS.L=1, CS.D=1 */
- fallthrough;
- default:
- return -EINVAL;
- }
- }
- /**
- * insn_get_modrm_rm_off() - Obtain register in r/m part of the ModRM byte
- * @insn: Instruction containing the ModRM byte
- * @regs: Register values as seen when entering kernel mode
- *
- * Returns:
- *
- * The register indicated by the r/m part of the ModRM byte. The
- * register is obtained as an offset from the base of pt_regs. In specific
- * cases, the returned value can be -EDOM to indicate that the particular value
- * of ModRM does not refer to a register and shall be ignored.
- */
- int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs)
- {
- return get_reg_offset(insn, regs, REG_TYPE_RM);
- }
- /**
- * insn_get_modrm_reg_off() - Obtain register in reg part of the ModRM byte
- * @insn: Instruction containing the ModRM byte
- * @regs: Register values as seen when entering kernel mode
- *
- * Returns:
- *
- * The register indicated by the reg part of the ModRM byte. The
- * register is obtained as an offset from the base of pt_regs.
- */
- int insn_get_modrm_reg_off(struct insn *insn, struct pt_regs *regs)
- {
- return get_reg_offset(insn, regs, REG_TYPE_REG);
- }
- /**
- * insn_get_modrm_reg_ptr() - Obtain register pointer based on ModRM byte
- * @insn: Instruction containing the ModRM byte
- * @regs: Register values as seen when entering kernel mode
- *
- * Returns:
- *
- * The register indicated by the reg part of the ModRM byte.
- * The register is obtained as a pointer within pt_regs.
- */
- unsigned long *insn_get_modrm_reg_ptr(struct insn *insn, struct pt_regs *regs)
- {
- int offset;
- offset = insn_get_modrm_reg_off(insn, regs);
- if (offset < 0)
- return NULL;
- return (void *)regs + offset;
- }
- /**
- * get_seg_base_limit() - obtain base address and limit of a segment
- * @insn: Instruction. Must be valid.
- * @regs: Register values as seen when entering kernel mode
- * @regoff: Operand offset, in pt_regs, used to resolve segment descriptor
- * @base: Obtained segment base
- * @limit: Obtained segment limit
- *
- * Obtain the base address and limit of the segment associated with the operand
- * @regoff and, if any or allowed, override prefixes in @insn. This function is
- * different from insn_get_seg_base() as the latter does not resolve the segment
- * associated with the instruction operand. If a limit is not needed (e.g.,
- * when running in long mode), @limit can be NULL.
- *
- * Returns:
- *
- * 0 on success. @base and @limit will contain the base address and of the
- * resolved segment, respectively.
- *
- * -EINVAL on error.
- */
- static int get_seg_base_limit(struct insn *insn, struct pt_regs *regs,
- int regoff, unsigned long *base,
- unsigned long *limit)
- {
- int seg_reg_idx;
- if (!base)
- return -EINVAL;
- seg_reg_idx = resolve_seg_reg(insn, regs, regoff);
- if (seg_reg_idx < 0)
- return seg_reg_idx;
- *base = insn_get_seg_base(regs, seg_reg_idx);
- if (*base == -1L)
- return -EINVAL;
- if (!limit)
- return 0;
- *limit = get_seg_limit(regs, seg_reg_idx);
- if (!(*limit))
- return -EINVAL;
- return 0;
- }
- /**
- * get_eff_addr_reg() - Obtain effective address from register operand
- * @insn: Instruction. Must be valid.
- * @regs: Register values as seen when entering kernel mode
- * @regoff: Obtained operand offset, in pt_regs, with the effective address
- * @eff_addr: Obtained effective address
- *
- * Obtain the effective address stored in the register operand as indicated by
- * the ModRM byte. This function is to be used only with register addressing
- * (i.e., ModRM.mod is 3). The effective address is saved in @eff_addr. The
- * register operand, as an offset from the base of pt_regs, is saved in @regoff;
- * such offset can then be used to resolve the segment associated with the
- * operand. This function can be used with any of the supported address sizes
- * in x86.
- *
- * Returns:
- *
- * 0 on success. @eff_addr will have the effective address stored in the
- * operand indicated by ModRM. @regoff will have such operand as an offset from
- * the base of pt_regs.
- *
- * -EINVAL on error.
- */
- static int get_eff_addr_reg(struct insn *insn, struct pt_regs *regs,
- int *regoff, long *eff_addr)
- {
- int ret;
- ret = insn_get_modrm(insn);
- if (ret)
- return ret;
- if (X86_MODRM_MOD(insn->modrm.value) != 3)
- return -EINVAL;
- *regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
- if (*regoff < 0)
- return -EINVAL;
- /* Ignore bytes that are outside the address size. */
- if (insn->addr_bytes == 2)
- *eff_addr = regs_get_register(regs, *regoff) & 0xffff;
- else if (insn->addr_bytes == 4)
- *eff_addr = regs_get_register(regs, *regoff) & 0xffffffff;
- else /* 64-bit address */
- *eff_addr = regs_get_register(regs, *regoff);
- return 0;
- }
- /**
- * get_eff_addr_modrm() - Obtain referenced effective address via ModRM
- * @insn: Instruction. Must be valid.
- * @regs: Register values as seen when entering kernel mode
- * @regoff: Obtained operand offset, in pt_regs, associated with segment
- * @eff_addr: Obtained effective address
- *
- * Obtain the effective address referenced by the ModRM byte of @insn. After
- * identifying the registers involved in the register-indirect memory reference,
- * its value is obtained from the operands in @regs. The computed address is
- * stored @eff_addr. Also, the register operand that indicates the associated
- * segment is stored in @regoff, this parameter can later be used to determine
- * such segment.
- *
- * Returns:
- *
- * 0 on success. @eff_addr will have the referenced effective address. @regoff
- * will have a register, as an offset from the base of pt_regs, that can be used
- * to resolve the associated segment.
- *
- * -EINVAL on error.
- */
- static int get_eff_addr_modrm(struct insn *insn, struct pt_regs *regs,
- int *regoff, long *eff_addr)
- {
- long tmp;
- int ret;
- if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
- return -EINVAL;
- ret = insn_get_modrm(insn);
- if (ret)
- return ret;
- if (X86_MODRM_MOD(insn->modrm.value) > 2)
- return -EINVAL;
- *regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
- /*
- * -EDOM means that we must ignore the address_offset. In such a case,
- * in 64-bit mode the effective address relative to the rIP of the
- * following instruction.
- */
- if (*regoff == -EDOM) {
- if (any_64bit_mode(regs))
- tmp = regs->ip + insn->length;
- else
- tmp = 0;
- } else if (*regoff < 0) {
- return -EINVAL;
- } else {
- tmp = regs_get_register(regs, *regoff);
- }
- if (insn->addr_bytes == 4) {
- int addr32 = (int)(tmp & 0xffffffff) + insn->displacement.value;
- *eff_addr = addr32 & 0xffffffff;
- } else {
- *eff_addr = tmp + insn->displacement.value;
- }
- return 0;
- }
- /**
- * get_eff_addr_modrm_16() - Obtain referenced effective address via ModRM
- * @insn: Instruction. Must be valid.
- * @regs: Register values as seen when entering kernel mode
- * @regoff: Obtained operand offset, in pt_regs, associated with segment
- * @eff_addr: Obtained effective address
- *
- * Obtain the 16-bit effective address referenced by the ModRM byte of @insn.
- * After identifying the registers involved in the register-indirect memory
- * reference, its value is obtained from the operands in @regs. The computed
- * address is stored @eff_addr. Also, the register operand that indicates
- * the associated segment is stored in @regoff, this parameter can later be used
- * to determine such segment.
- *
- * Returns:
- *
- * 0 on success. @eff_addr will have the referenced effective address. @regoff
- * will have a register, as an offset from the base of pt_regs, that can be used
- * to resolve the associated segment.
- *
- * -EINVAL on error.
- */
- static int get_eff_addr_modrm_16(struct insn *insn, struct pt_regs *regs,
- int *regoff, short *eff_addr)
- {
- int addr_offset1, addr_offset2, ret;
- short addr1 = 0, addr2 = 0, displacement;
- if (insn->addr_bytes != 2)
- return -EINVAL;
- insn_get_modrm(insn);
- if (!insn->modrm.nbytes)
- return -EINVAL;
- if (X86_MODRM_MOD(insn->modrm.value) > 2)
- return -EINVAL;
- ret = get_reg_offset_16(insn, regs, &addr_offset1, &addr_offset2);
- if (ret < 0)
- return -EINVAL;
- /*
- * Don't fail on invalid offset values. They might be invalid because
- * they cannot be used for this particular value of ModRM. Instead, use
- * them in the computation only if they contain a valid value.
- */
- if (addr_offset1 != -EDOM)
- addr1 = regs_get_register(regs, addr_offset1) & 0xffff;
- if (addr_offset2 != -EDOM)
- addr2 = regs_get_register(regs, addr_offset2) & 0xffff;
- displacement = insn->displacement.value & 0xffff;
- *eff_addr = addr1 + addr2 + displacement;
- /*
- * The first operand register could indicate to use of either SS or DS
- * registers to obtain the segment selector. The second operand
- * register can only indicate the use of DS. Thus, the first operand
- * will be used to obtain the segment selector.
- */
- *regoff = addr_offset1;
- return 0;
- }
- /**
- * get_eff_addr_sib() - Obtain referenced effective address via SIB
- * @insn: Instruction. Must be valid.
- * @regs: Register values as seen when entering kernel mode
- * @regoff: Obtained operand offset, in pt_regs, associated with segment
- * @eff_addr: Obtained effective address
- *
- * Obtain the effective address referenced by the SIB byte of @insn. After
- * identifying the registers involved in the indexed, register-indirect memory
- * reference, its value is obtained from the operands in @regs. The computed
- * address is stored @eff_addr. Also, the register operand that indicates the
- * associated segment is stored in @regoff, this parameter can later be used to
- * determine such segment.
- *
- * Returns:
- *
- * 0 on success. @eff_addr will have the referenced effective address.
- * @base_offset will have a register, as an offset from the base of pt_regs,
- * that can be used to resolve the associated segment.
- *
- * Negative value on error.
- */
- static int get_eff_addr_sib(struct insn *insn, struct pt_regs *regs,
- int *base_offset, long *eff_addr)
- {
- long base, indx;
- int indx_offset;
- int ret;
- if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
- return -EINVAL;
- ret = insn_get_modrm(insn);
- if (ret)
- return ret;
- if (!insn->modrm.nbytes)
- return -EINVAL;
- if (X86_MODRM_MOD(insn->modrm.value) > 2)
- return -EINVAL;
- ret = insn_get_sib(insn);
- if (ret)
- return ret;
- if (!insn->sib.nbytes)
- return -EINVAL;
- *base_offset = get_reg_offset(insn, regs, REG_TYPE_BASE);
- indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX);
- /*
- * Negative values in the base and index offset means an error when
- * decoding the SIB byte. Except -EDOM, which means that the registers
- * should not be used in the address computation.
- */
- if (*base_offset == -EDOM)
- base = 0;
- else if (*base_offset < 0)
- return -EINVAL;
- else
- base = regs_get_register(regs, *base_offset);
- if (indx_offset == -EDOM)
- indx = 0;
- else if (indx_offset < 0)
- return -EINVAL;
- else
- indx = regs_get_register(regs, indx_offset);
- if (insn->addr_bytes == 4) {
- int addr32, base32, idx32;
- base32 = base & 0xffffffff;
- idx32 = indx & 0xffffffff;
- addr32 = base32 + idx32 * (1 << X86_SIB_SCALE(insn->sib.value));
- addr32 += insn->displacement.value;
- *eff_addr = addr32 & 0xffffffff;
- } else {
- *eff_addr = base + indx * (1 << X86_SIB_SCALE(insn->sib.value));
- *eff_addr += insn->displacement.value;
- }
- return 0;
- }
- /**
- * get_addr_ref_16() - Obtain the 16-bit address referred by instruction
- * @insn: Instruction containing ModRM byte and displacement
- * @regs: Register values as seen when entering kernel mode
- *
- * This function is to be used with 16-bit address encodings. Obtain the memory
- * address referred by the instruction's ModRM and displacement bytes. Also, the
- * segment used as base is determined by either any segment override prefixes in
- * @insn or the default segment of the registers involved in the address
- * computation. In protected mode, segment limits are enforced.
- *
- * Returns:
- *
- * Linear address referenced by the instruction operands on success.
- *
- * -1L on error.
- */
- static void __user *get_addr_ref_16(struct insn *insn, struct pt_regs *regs)
- {
- unsigned long linear_addr = -1L, seg_base, seg_limit;
- int ret, regoff;
- short eff_addr;
- long tmp;
- if (insn_get_displacement(insn))
- goto out;
- if (insn->addr_bytes != 2)
- goto out;
- if (X86_MODRM_MOD(insn->modrm.value) == 3) {
- ret = get_eff_addr_reg(insn, regs, ®off, &tmp);
- if (ret)
- goto out;
- eff_addr = tmp;
- } else {
- ret = get_eff_addr_modrm_16(insn, regs, ®off, &eff_addr);
- if (ret)
- goto out;
- }
- ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
- if (ret)
- goto out;
- /*
- * Before computing the linear address, make sure the effective address
- * is within the limits of the segment. In virtual-8086 mode, segment
- * limits are not enforced. In such a case, the segment limit is -1L to
- * reflect this fact.
- */
- if ((unsigned long)(eff_addr & 0xffff) > seg_limit)
- goto out;
- linear_addr = (unsigned long)(eff_addr & 0xffff) + seg_base;
- /* Limit linear address to 20 bits */
- if (v8086_mode(regs))
- linear_addr &= 0xfffff;
- out:
- return (void __user *)linear_addr;
- }
- /**
- * get_addr_ref_32() - Obtain a 32-bit linear address
- * @insn: Instruction with ModRM, SIB bytes and displacement
- * @regs: Register values as seen when entering kernel mode
- *
- * This function is to be used with 32-bit address encodings to obtain the
- * linear memory address referred by the instruction's ModRM, SIB,
- * displacement bytes and segment base address, as applicable. If in protected
- * mode, segment limits are enforced.
- *
- * Returns:
- *
- * Linear address referenced by instruction and registers on success.
- *
- * -1L on error.
- */
- static void __user *get_addr_ref_32(struct insn *insn, struct pt_regs *regs)
- {
- unsigned long linear_addr = -1L, seg_base, seg_limit;
- int eff_addr, regoff;
- long tmp;
- int ret;
- if (insn->addr_bytes != 4)
- goto out;
- if (X86_MODRM_MOD(insn->modrm.value) == 3) {
- ret = get_eff_addr_reg(insn, regs, ®off, &tmp);
- if (ret)
- goto out;
- eff_addr = tmp;
- } else {
- if (insn->sib.nbytes) {
- ret = get_eff_addr_sib(insn, regs, ®off, &tmp);
- if (ret)
- goto out;
- eff_addr = tmp;
- } else {
- ret = get_eff_addr_modrm(insn, regs, ®off, &tmp);
- if (ret)
- goto out;
- eff_addr = tmp;
- }
- }
- ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
- if (ret)
- goto out;
- /*
- * In protected mode, before computing the linear address, make sure
- * the effective address is within the limits of the segment.
- * 32-bit addresses can be used in long and virtual-8086 modes if an
- * address override prefix is used. In such cases, segment limits are
- * not enforced. When in virtual-8086 mode, the segment limit is -1L
- * to reflect this situation.
- *
- * After computed, the effective address is treated as an unsigned
- * quantity.
- */
- if (!any_64bit_mode(regs) && ((unsigned int)eff_addr > seg_limit))
- goto out;
- /*
- * Even though 32-bit address encodings are allowed in virtual-8086
- * mode, the address range is still limited to [0x-0xffff].
- */
- if (v8086_mode(regs) && (eff_addr & ~0xffff))
- goto out;
- /*
- * Data type long could be 64 bits in size. Ensure that our 32-bit
- * effective address is not sign-extended when computing the linear
- * address.
- */
- linear_addr = (unsigned long)(eff_addr & 0xffffffff) + seg_base;
- /* Limit linear address to 20 bits */
- if (v8086_mode(regs))
- linear_addr &= 0xfffff;
- out:
- return (void __user *)linear_addr;
- }
- /**
- * get_addr_ref_64() - Obtain a 64-bit linear address
- * @insn: Instruction struct with ModRM and SIB bytes and displacement
- * @regs: Structure with register values as seen when entering kernel mode
- *
- * This function is to be used with 64-bit address encodings to obtain the
- * linear memory address referred by the instruction's ModRM, SIB,
- * displacement bytes and segment base address, as applicable.
- *
- * Returns:
- *
- * Linear address referenced by instruction and registers on success.
- *
- * -1L on error.
- */
- #ifndef CONFIG_X86_64
- static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
- {
- return (void __user *)-1L;
- }
- #else
- static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
- {
- unsigned long linear_addr = -1L, seg_base;
- int regoff, ret;
- long eff_addr;
- if (insn->addr_bytes != 8)
- goto out;
- if (X86_MODRM_MOD(insn->modrm.value) == 3) {
- ret = get_eff_addr_reg(insn, regs, ®off, &eff_addr);
- if (ret)
- goto out;
- } else {
- if (insn->sib.nbytes) {
- ret = get_eff_addr_sib(insn, regs, ®off, &eff_addr);
- if (ret)
- goto out;
- } else {
- ret = get_eff_addr_modrm(insn, regs, ®off, &eff_addr);
- if (ret)
- goto out;
- }
- }
- ret = get_seg_base_limit(insn, regs, regoff, &seg_base, NULL);
- if (ret)
- goto out;
- linear_addr = (unsigned long)eff_addr + seg_base;
- out:
- return (void __user *)linear_addr;
- }
- #endif /* CONFIG_X86_64 */
- /**
- * insn_get_addr_ref() - Obtain the linear address referred by instruction
- * @insn: Instruction structure containing ModRM byte and displacement
- * @regs: Structure with register values as seen when entering kernel mode
- *
- * Obtain the linear address referred by the instruction's ModRM, SIB and
- * displacement bytes, and segment base, as applicable. In protected mode,
- * segment limits are enforced.
- *
- * Returns:
- *
- * Linear address referenced by instruction and registers on success.
- *
- * -1L on error.
- */
- void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs)
- {
- if (!insn || !regs)
- return (void __user *)-1L;
- if (insn_get_opcode(insn))
- return (void __user *)-1L;
- switch (insn->addr_bytes) {
- case 2:
- return get_addr_ref_16(insn, regs);
- case 4:
- return get_addr_ref_32(insn, regs);
- case 8:
- return get_addr_ref_64(insn, regs);
- default:
- return (void __user *)-1L;
- }
- }
- int insn_get_effective_ip(struct pt_regs *regs, unsigned long *ip)
- {
- unsigned long seg_base = 0;
- /*
- * If not in user-space long mode, a custom code segment could be in
- * use. This is true in protected mode (if the process defined a local
- * descriptor table), or virtual-8086 mode. In most of the cases
- * seg_base will be zero as in USER_CS.
- */
- if (!user_64bit_mode(regs)) {
- seg_base = insn_get_seg_base(regs, INAT_SEG_REG_CS);
- if (seg_base == -1L)
- return -EINVAL;
- }
- *ip = seg_base + regs->ip;
- return 0;
- }
- /**
- * insn_fetch_from_user() - Copy instruction bytes from user-space memory
- * @regs: Structure with register values as seen when entering kernel mode
- * @buf: Array to store the fetched instruction
- *
- * Gets the linear address of the instruction and copies the instruction bytes
- * to the buf.
- *
- * Returns:
- *
- * - number of instruction bytes copied.
- * - 0 if nothing was copied.
- * - -EINVAL if the linear address of the instruction could not be calculated
- */
- int insn_fetch_from_user(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE])
- {
- unsigned long ip;
- int not_copied;
- if (insn_get_effective_ip(regs, &ip))
- return -EINVAL;
- not_copied = copy_from_user(buf, (void __user *)ip, MAX_INSN_SIZE);
- return MAX_INSN_SIZE - not_copied;
- }
- /**
- * insn_fetch_from_user_inatomic() - Copy instruction bytes from user-space memory
- * while in atomic code
- * @regs: Structure with register values as seen when entering kernel mode
- * @buf: Array to store the fetched instruction
- *
- * Gets the linear address of the instruction and copies the instruction bytes
- * to the buf. This function must be used in atomic context.
- *
- * Returns:
- *
- * - number of instruction bytes copied.
- * - 0 if nothing was copied.
- * - -EINVAL if the linear address of the instruction could not be calculated.
- */
- int insn_fetch_from_user_inatomic(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE])
- {
- unsigned long ip;
- int not_copied;
- if (insn_get_effective_ip(regs, &ip))
- return -EINVAL;
- not_copied = __copy_from_user_inatomic(buf, (void __user *)ip, MAX_INSN_SIZE);
- return MAX_INSN_SIZE - not_copied;
- }
- /**
- * insn_decode_from_regs() - Decode an instruction
- * @insn: Structure to store decoded instruction
- * @regs: Structure with register values as seen when entering kernel mode
- * @buf: Buffer containing the instruction bytes
- * @buf_size: Number of instruction bytes available in buf
- *
- * Decodes the instruction provided in buf and stores the decoding results in
- * insn. Also determines the correct address and operand sizes.
- *
- * Returns:
- *
- * True if instruction was decoded, False otherwise.
- */
- bool insn_decode_from_regs(struct insn *insn, struct pt_regs *regs,
- unsigned char buf[MAX_INSN_SIZE], int buf_size)
- {
- int seg_defs;
- insn_init(insn, buf, buf_size, user_64bit_mode(regs));
- /*
- * Override the default operand and address sizes with what is specified
- * in the code segment descriptor. The instruction decoder only sets
- * the address size it to either 4 or 8 address bytes and does nothing
- * for the operand bytes. This OK for most of the cases, but we could
- * have special cases where, for instance, a 16-bit code segment
- * descriptor is used.
- * If there is an address override prefix, the instruction decoder
- * correctly updates these values, even for 16-bit defaults.
- */
- seg_defs = insn_get_code_seg_params(regs);
- if (seg_defs == -EINVAL)
- return false;
- insn->addr_bytes = INSN_CODE_SEG_ADDR_SZ(seg_defs);
- insn->opnd_bytes = INSN_CODE_SEG_OPND_SZ(seg_defs);
- if (insn_get_length(insn))
- return false;
- if (buf_size < insn->length)
- return false;
- return true;
- }
- /**
- * insn_decode_mmio() - Decode a MMIO instruction
- * @insn: Structure to store decoded instruction
- * @bytes: Returns size of memory operand
- *
- * Decodes instruction that used for Memory-mapped I/O.
- *
- * Returns:
- *
- * Type of the instruction. Size of the memory operand is stored in
- * @bytes. If decode failed, MMIO_DECODE_FAILED returned.
- */
- enum mmio_type insn_decode_mmio(struct insn *insn, int *bytes)
- {
- enum mmio_type type = MMIO_DECODE_FAILED;
- *bytes = 0;
- if (insn_get_opcode(insn))
- return MMIO_DECODE_FAILED;
- switch (insn->opcode.bytes[0]) {
- case 0x88: /* MOV m8,r8 */
- *bytes = 1;
- fallthrough;
- case 0x89: /* MOV m16/m32/m64, r16/m32/m64 */
- if (!*bytes)
- *bytes = insn->opnd_bytes;
- type = MMIO_WRITE;
- break;
- case 0xc6: /* MOV m8, imm8 */
- *bytes = 1;
- fallthrough;
- case 0xc7: /* MOV m16/m32/m64, imm16/imm32/imm64 */
- if (!*bytes)
- *bytes = insn->opnd_bytes;
- type = MMIO_WRITE_IMM;
- break;
- case 0x8a: /* MOV r8, m8 */
- *bytes = 1;
- fallthrough;
- case 0x8b: /* MOV r16/r32/r64, m16/m32/m64 */
- if (!*bytes)
- *bytes = insn->opnd_bytes;
- type = MMIO_READ;
- break;
- case 0xa4: /* MOVS m8, m8 */
- *bytes = 1;
- fallthrough;
- case 0xa5: /* MOVS m16/m32/m64, m16/m32/m64 */
- if (!*bytes)
- *bytes = insn->opnd_bytes;
- type = MMIO_MOVS;
- break;
- case 0x0f: /* Two-byte instruction */
- switch (insn->opcode.bytes[1]) {
- case 0xb6: /* MOVZX r16/r32/r64, m8 */
- *bytes = 1;
- fallthrough;
- case 0xb7: /* MOVZX r32/r64, m16 */
- if (!*bytes)
- *bytes = 2;
- type = MMIO_READ_ZERO_EXTEND;
- break;
- case 0xbe: /* MOVSX r16/r32/r64, m8 */
- *bytes = 1;
- fallthrough;
- case 0xbf: /* MOVSX r32/r64, m16 */
- if (!*bytes)
- *bytes = 2;
- type = MMIO_READ_SIGN_EXTEND;
- break;
- }
- break;
- }
- return type;
- }
|