x86/insn-eval: Add support to resolve 16-bit address encodings
Tasks running in virtual-8086 mode, in protected mode with code segment descriptors that specify 16-bit default address sizes via the D bit, or via an address override prefix will use 16-bit addressing form encodings as described in the Intel 64 and IA-32 Architecture Software Developer's Manual Volume 2A Section 2.1.5, Table 2-1. 16-bit addressing encodings differ in several ways from the 32-bit/64-bit addressing form encodings: ModRM.rm points to different registers and, in some cases, effective addresses are indicated by the addition of the value of two registers. Also, there is no support for SIB bytes. Thus, a separate function is needed to parse this form of addressing. Three functions are introduced. get_reg_offset_16() obtains the offset from the base of pt_regs of the registers indicated by the ModRM byte of the address encoding. get_eff_addr_modrm_16() computes the effective address from the value of the register operands. get_addr_ref_16() computes the linear address using the obtained effective address and the base address of the segment. Segment limits are enforced when running in protected mode. Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Cc: Adam Buchbinder <adam.buchbinder@gmail.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Andy Lutomirski <luto@kernel.org> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Borislav Petkov <bp@suse.de> Cc: Brian Gerst <brgerst@gmail.com> Cc: Chen Yucong <slaoub@gmail.com> Cc: Chris Metcalf <cmetcalf@mellanox.com> Cc: Colin Ian King <colin.king@canonical.com> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: Denys Vlasenko <dvlasenk@redhat.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Huang Rui <ray.huang@amd.com> Cc: Jiri Slaby <jslaby@suse.cz> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Kees Cook <keescook@chromium.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Lorenzo Stoakes <lstoakes@gmail.com> Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Paul Gortmaker <paul.gortmaker@windriver.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Qiaowei Ren <qiaowei.ren@intel.com> Cc: Ravi V. Shankar <ravi.v.shankar@intel.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Thomas Garnier <thgarnie@google.com> Cc: Tony Luck <tony.luck@intel.com> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: ricardo.neri@intel.com Link: http://lkml.kernel.org/r/1509935277-22138-6-git-send-email-ricardo.neri-calderon@linux.intel.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
This commit is contained in:
Ricardo Neri
Ingo Molnar
parent
86cc351090
commit
9c6c799fae
|
|
@ -480,6 +480,80 @@ static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
|
|||
return regoff[regno];
|
||||
}
|
||||
|
||||
/**
|
||||
* get_reg_offset_16() - Obtain offset of register indicated by instruction
|
||||
* @insn: Instruction containing ModRM byte
|
||||
* @regs: Register values as seen when entering kernel mode
|
||||
* @offs1: Offset of the first operand register
|
||||
* @offs2: Offset of the second opeand register, if applicable
|
||||
*
|
||||
* Obtain the offset, in pt_regs, of the registers indicated by the ModRM byte
|
||||
* in @insn. This function is to be used with 16-bit address encodings. The
|
||||
* @offs1 and @offs2 will be written with the offset of the two registers
|
||||
* indicated by the instruction. In cases where any of the registers is not
|
||||
* referenced by the instruction, the value will be set to -EDOM.
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* 0 on success, -EINVAL on error.
|
||||
*/
|
||||
static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs,
|
||||
int *offs1, int *offs2)
|
||||
{
|
||||
/*
|
||||
* 16-bit addressing can use one or two registers. Specifics of
|
||||
* encodings are given in Table 2-1. "16-Bit Addressing Forms with the
|
||||
* ModR/M Byte" of the Intel Software Development Manual.
|
||||
*/
|
||||
static const int regoff1[] = {
|
||||
offsetof(struct pt_regs, bx),
|
||||
offsetof(struct pt_regs, bx),
|
||||
offsetof(struct pt_regs, bp),
|
||||
offsetof(struct pt_regs, bp),
|
||||
offsetof(struct pt_regs, si),
|
||||
offsetof(struct pt_regs, di),
|
||||
offsetof(struct pt_regs, bp),
|
||||
offsetof(struct pt_regs, bx),
|
||||
};
|
||||
|
||||
static const int regoff2[] = {
|
||||
offsetof(struct pt_regs, si),
|
||||
offsetof(struct pt_regs, di),
|
||||
offsetof(struct pt_regs, si),
|
||||
offsetof(struct pt_regs, di),
|
||||
-EDOM,
|
||||
-EDOM,
|
||||
-EDOM,
|
||||
-EDOM,
|
||||
};
|
||||
|
||||
if (!offs1 || !offs2)
|
||||
return -EINVAL;
|
||||
|
||||
/* Operand is a register, use the generic function. */
|
||||
if (X86_MODRM_MOD(insn->modrm.value) == 3) {
|
||||
*offs1 = insn_get_modrm_rm_off(insn, regs);
|
||||
*offs2 = -EDOM;
|
||||
return 0;
|
||||
}
|
||||
|
||||
*offs1 = regoff1[X86_MODRM_RM(insn->modrm.value)];
|
||||
*offs2 = regoff2[X86_MODRM_RM(insn->modrm.value)];
|
||||
|
||||
/*
|
||||
* If ModRM.mod is 0 and ModRM.rm is 110b, then we use displacement-
|
||||
* only addressing. This means that no registers are involved in
|
||||
* computing the effective address. Thus, ensure that the first
|
||||
* register offset is invalild. The second register offset is already
|
||||
* invalid under the aforementioned conditions.
|
||||
*/
|
||||
if ((X86_MODRM_MOD(insn->modrm.value) == 0) &&
|
||||
(X86_MODRM_RM(insn->modrm.value) == 6))
|
||||
*offs1 = -EDOM;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* get_desc() - Obtain pointer to a segment descriptor
|
||||
* @sel: Segment selector
|
||||
|
|
@ -815,7 +889,9 @@ static int get_eff_addr_reg(struct insn *insn, struct pt_regs *regs,
|
|||
return -EINVAL;
|
||||
|
||||
/* Ignore bytes that are outside the address size. */
|
||||
if (insn->addr_bytes == 4)
|
||||
if (insn->addr_bytes == 2)
|
||||
*eff_addr = regs_get_register(regs, *regoff) & 0xffff;
|
||||
else if (insn->addr_bytes == 4)
|
||||
*eff_addr = regs_get_register(regs, *regoff) & 0xffffffff;
|
||||
else /* 64-bit address */
|
||||
*eff_addr = regs_get_register(regs, *regoff);
|
||||
|
|
@ -890,6 +966,74 @@ static int get_eff_addr_modrm(struct insn *insn, struct pt_regs *regs,
|
|||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* get_eff_addr_modrm_16() - Obtain referenced effective address via ModRM
|
||||
* @insn: Instruction. Must be valid.
|
||||
* @regs: Register values as seen when entering kernel mode
|
||||
* @regoff: Obtained operand offset, in pt_regs, associated with segment
|
||||
* @eff_addr: Obtained effective address
|
||||
*
|
||||
* Obtain the 16-bit effective address referenced by the ModRM byte of @insn.
|
||||
* After identifying the registers involved in the register-indirect memory
|
||||
* reference, its value is obtained from the operands in @regs. The computed
|
||||
* address is stored @eff_addr. Also, the register operand that indicates
|
||||
* the associated segment is stored in @regoff, this parameter can later be used
|
||||
* to determine such segment.
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* 0 on success. @eff_addr will have the referenced effective address. @regoff
|
||||
* will have a register, as an offset from the base of pt_regs, that can be used
|
||||
* to resolve the associated segment.
|
||||
*
|
||||
* -EINVAL on error.
|
||||
*/
|
||||
static int get_eff_addr_modrm_16(struct insn *insn, struct pt_regs *regs,
|
||||
int *regoff, short *eff_addr)
|
||||
{
|
||||
int addr_offset1, addr_offset2, ret;
|
||||
short addr1 = 0, addr2 = 0, displacement;
|
||||
|
||||
if (insn->addr_bytes != 2)
|
||||
return -EINVAL;
|
||||
|
||||
insn_get_modrm(insn);
|
||||
|
||||
if (!insn->modrm.nbytes)
|
||||
return -EINVAL;
|
||||
|
||||
if (X86_MODRM_MOD(insn->modrm.value) > 2)
|
||||
return -EINVAL;
|
||||
|
||||
ret = get_reg_offset_16(insn, regs, &addr_offset1, &addr_offset2);
|
||||
if (ret < 0)
|
||||
return -EINVAL;
|
||||
|
||||
/*
|
||||
* Don't fail on invalid offset values. They might be invalid because
|
||||
* they cannot be used for this particular value of ModRM. Instead, use
|
||||
* them in the computation only if they contain a valid value.
|
||||
*/
|
||||
if (addr_offset1 != -EDOM)
|
||||
addr1 = regs_get_register(regs, addr_offset1) & 0xffff;
|
||||
|
||||
if (addr_offset2 != -EDOM)
|
||||
addr2 = regs_get_register(regs, addr_offset2) & 0xffff;
|
||||
|
||||
displacement = insn->displacement.value & 0xffff;
|
||||
*eff_addr = addr1 + addr2 + displacement;
|
||||
|
||||
/*
|
||||
* The first operand register could indicate to use of either SS or DS
|
||||
* registers to obtain the segment selector. The second operand
|
||||
* register can only indicate the use of DS. Thus, the first operand
|
||||
* will be used to obtain the segment selector.
|
||||
*/
|
||||
*regoff = addr_offset1;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* get_eff_addr_sib() - Obtain referenced effective address via SIB
|
||||
* @insn: Instruction. Must be valid.
|
||||
|
|
@ -974,6 +1118,71 @@ static int get_eff_addr_sib(struct insn *insn, struct pt_regs *regs,
|
|||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* get_addr_ref_16() - Obtain the 16-bit address referred by instruction
|
||||
* @insn: Instruction containing ModRM byte and displacement
|
||||
* @regs: Register values as seen when entering kernel mode
|
||||
*
|
||||
* This function is to be used with 16-bit address encodings. Obtain the memory
|
||||
* address referred by the instruction's ModRM and displacement bytes. Also, the
|
||||
* segment used as base is determined by either any segment override prefixes in
|
||||
* @insn or the default segment of the registers involved in the address
|
||||
* computation. In protected mode, segment limits are enforced.
|
||||
*
|
||||
* Returns:
|
||||
*
|
||||
* Linear address referenced by the instruction operands on success.
|
||||
*
|
||||
* -1L on error.
|
||||
*/
|
||||
static void __user *get_addr_ref_16(struct insn *insn, struct pt_regs *regs)
|
||||
{
|
||||
unsigned long linear_addr = -1L, seg_base, seg_limit;
|
||||
int ret, regoff;
|
||||
short eff_addr;
|
||||
long tmp;
|
||||
|
||||
insn_get_modrm(insn);
|
||||
insn_get_displacement(insn);
|
||||
|
||||
if (insn->addr_bytes != 2)
|
||||
goto out;
|
||||
|
||||
if (X86_MODRM_MOD(insn->modrm.value) == 3) {
|
||||
ret = get_eff_addr_reg(insn, regs, ®off, &tmp);
|
||||
if (ret)
|
||||
goto out;
|
||||
|
||||
eff_addr = tmp;
|
||||
} else {
|
||||
ret = get_eff_addr_modrm_16(insn, regs, ®off, &eff_addr);
|
||||
if (ret)
|
||||
goto out;
|
||||
}
|
||||
|
||||
ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
|
||||
if (ret)
|
||||
goto out;
|
||||
|
||||
/*
|
||||
* Before computing the linear address, make sure the effective address
|
||||
* is within the limits of the segment. In virtual-8086 mode, segment
|
||||
* limits are not enforced. In such a case, the segment limit is -1L to
|
||||
* reflect this fact.
|
||||
*/
|
||||
if ((unsigned long)(eff_addr & 0xffff) > seg_limit)
|
||||
goto out;
|
||||
|
||||
linear_addr = (unsigned long)(eff_addr & 0xffff) + seg_base;
|
||||
|
||||
/* Limit linear address to 20 bits */
|
||||
if (v8086_mode(regs))
|
||||
linear_addr &= 0xfffff;
|
||||
|
||||
out:
|
||||
return (void __user *)linear_addr;
|
||||
}
|
||||
|
||||
/**
|
||||
* get_addr_ref_32() - Obtain a 32-bit linear address
|
||||
* @insn: Instruction with ModRM, SIB bytes and displacement
|
||||
|
|
@ -1143,6 +1352,8 @@ void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs)
|
|||
return (void __user *)-1L;
|
||||
|
||||
switch (insn->addr_bytes) {
|
||||
case 2:
|
||||
return get_addr_ref_16(insn, regs);
|
||||
case 4:
|
||||
return get_addr_ref_32(insn, regs);
|
||||
case 8:
|
||||
|
|
|
|||
Loading…
Reference in New Issue