Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c6c799f authored by Ricardo Neri's avatar Ricardo Neri Committed by Ingo Molnar
Browse files

x86/insn-eval: Add support to resolve 16-bit address encodings 



Tasks running in virtual-8086 mode, in protected mode with code segment
descriptors that specify 16-bit default address sizes via the D bit, or via
an address override prefix will use 16-bit addressing form encodings as
described in the Intel 64 and IA-32 Architecture Software Developer's
Manual Volume 2A Section 2.1.5, Table 2-1.

16-bit addressing encodings differ in several ways from the 32-bit/64-bit
addressing form encodings: ModRM.rm points to different registers and, in
some cases, effective addresses are indicated by the addition of the value
of two registers. Also, there is no support for SIB bytes. Thus, a
separate function is needed to parse this form of addressing.

Three functions are introduced. get_reg_offset_16() obtains the
offset from the base of pt_regs of the registers indicated by the ModRM
byte of the address encoding. get_eff_addr_modrm_16() computes the
effective address from the value of the register operands.
get_addr_ref_16() computes the linear address using the obtained effective
address and the base address of the segment.

Segment limits are enforced when running in protected mode.

Signed-off-by: default avatarRicardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <bp@suse.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chen Yucong <slaoub@gmail.com>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Thomas Garnier <thgarnie@google.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: ricardo.neri@intel.com
Link: http://lkml.kernel.org/r/1509935277-22138-6-git-send-email-ricardo.neri-calderon@linux.intel.com


Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent 86cc3510

arch/x86/lib/insn-eval.c

+212 −1
Original line number Diff line number Diff line
@@ -480,6 +480,80 @@ static int get_reg_offset(struct insn *insn, struct pt_regs *regs, 
	return regoff[regno];

}



/**

 * get_reg_offset_16() - Obtain offset of register indicated by instruction

 * @insn:	Instruction containing ModRM byte

 * @regs:	Register values as seen when entering kernel mode

 * @offs1:	Offset of the first operand register

 * @offs2:	Offset of the second opeand register, if applicable

 *

 * Obtain the offset, in pt_regs, of the registers indicated by the ModRM byte

 * in @insn. This function is to be used with 16-bit address encodings. The

 * @offs1 and @offs2 will be written with the offset of the two registers

 * indicated by the instruction. In cases where any of the registers is not

 * referenced by the instruction, the value will be set to -EDOM.

 *

 * Returns:

 *

 * 0 on success, -EINVAL on error.

 */

static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs,

			     int *offs1, int *offs2)

{

	/*

	 * 16-bit addressing can use one or two registers. Specifics of

	 * encodings are given in Table 2-1. "16-Bit Addressing Forms with the

	 * ModR/M Byte" of the Intel Software Development Manual.

	 */

	static const int regoff1[] = {

		offsetof(struct pt_regs, bx),

		offsetof(struct pt_regs, bx),

		offsetof(struct pt_regs, bp),

		offsetof(struct pt_regs, bp),

		offsetof(struct pt_regs, si),

		offsetof(struct pt_regs, di),

		offsetof(struct pt_regs, bp),

		offsetof(struct pt_regs, bx),

	};



	static const int regoff2[] = {

		offsetof(struct pt_regs, si),

		offsetof(struct pt_regs, di),

		offsetof(struct pt_regs, si),

		offsetof(struct pt_regs, di),

		-EDOM,

		-EDOM,

		-EDOM,

		-EDOM,

	};



	if (!offs1 || !offs2)

		return -EINVAL;



	/* Operand is a register, use the generic function. */

	if (X86_MODRM_MOD(insn->modrm.value) == 3) {

		*offs1 = insn_get_modrm_rm_off(insn, regs);

		*offs2 = -EDOM;

		return 0;

	}



	*offs1 = regoff1[X86_MODRM_RM(insn->modrm.value)];

	*offs2 = regoff2[X86_MODRM_RM(insn->modrm.value)];



	/*

	 * If ModRM.mod is 0 and ModRM.rm is 110b, then we use displacement-

	 * only addressing. This means that no registers are involved in

	 * computing the effective address. Thus, ensure that the first

	 * register offset is invalild. The second register offset is already

	 * invalid under the aforementioned conditions.

	 */

	if ((X86_MODRM_MOD(insn->modrm.value) == 0) &&

	    (X86_MODRM_RM(insn->modrm.value) == 6))

		*offs1 = -EDOM;



	return 0;

}



/**

 * get_desc() - Obtain pointer to a segment descriptor

 * @sel:	Segment selector
@@ -815,7 +889,9 @@ static int get_eff_addr_reg(struct insn *insn, struct pt_regs *regs, 
		return -EINVAL;



	/* Ignore bytes that are outside the address size. */

	if (insn->addr_bytes == 4)

	if (insn->addr_bytes == 2)

		*eff_addr = regs_get_register(regs, *regoff) & 0xffff;

	else if (insn->addr_bytes == 4)

		*eff_addr = regs_get_register(regs, *regoff) & 0xffffffff;

	else /* 64-bit address */

		*eff_addr = regs_get_register(regs, *regoff);
@@ -890,6 +966,74 @@ static int get_eff_addr_modrm(struct insn *insn, struct pt_regs *regs, 
	return 0;

}



/**

 * get_eff_addr_modrm_16() - Obtain referenced effective address via ModRM

 * @insn:	Instruction. Must be valid.

 * @regs:	Register values as seen when entering kernel mode

 * @regoff:	Obtained operand offset, in pt_regs, associated with segment

 * @eff_addr:	Obtained effective address

 *

 * Obtain the 16-bit effective address referenced by the ModRM byte of @insn.

 * After identifying the registers involved in the register-indirect memory

 * reference, its value is obtained from the operands in @regs. The computed

 * address is stored @eff_addr. Also, the register operand that indicates

 * the associated segment is stored in @regoff, this parameter can later be used

 * to determine such segment.

 *

 * Returns:

 *

 * 0 on success. @eff_addr will have the referenced effective address. @regoff

 * will have a register, as an offset from the base of pt_regs, that can be used

 * to resolve the associated segment.

 *

 * -EINVAL on error.

 */

static int get_eff_addr_modrm_16(struct insn *insn, struct pt_regs *regs,

				 int *regoff, short *eff_addr)

{

	int addr_offset1, addr_offset2, ret;

	short addr1 = 0, addr2 = 0, displacement;



	if (insn->addr_bytes != 2)

		return -EINVAL;



	insn_get_modrm(insn);



	if (!insn->modrm.nbytes)

		return -EINVAL;



	if (X86_MODRM_MOD(insn->modrm.value) > 2)

		return -EINVAL;



	ret = get_reg_offset_16(insn, regs, &addr_offset1, &addr_offset2);

	if (ret < 0)

		return -EINVAL;



	/*

	 * Don't fail on invalid offset values. They might be invalid because

	 * they cannot be used for this particular value of ModRM. Instead, use

	 * them in the computation only if they contain a valid value.

	 */

	if (addr_offset1 != -EDOM)

		addr1 = regs_get_register(regs, addr_offset1) & 0xffff;



	if (addr_offset2 != -EDOM)

		addr2 = regs_get_register(regs, addr_offset2) & 0xffff;



	displacement = insn->displacement.value & 0xffff;

	*eff_addr = addr1 + addr2 + displacement;



	/*

	 * The first operand register could indicate to use of either SS or DS

	 * registers to obtain the segment selector.  The second operand

	 * register can only indicate the use of DS. Thus, the first operand

	 * will be used to obtain the segment selector.

	 */

	*regoff = addr_offset1;



	return 0;

}



/**

 * get_eff_addr_sib() - Obtain referenced effective address via SIB

 * @insn:	Instruction. Must be valid.
@@ -974,6 +1118,71 @@ static int get_eff_addr_sib(struct insn *insn, struct pt_regs *regs, 
	return 0;

}



/**

 * get_addr_ref_16() - Obtain the 16-bit address referred by instruction

 * @insn:	Instruction containing ModRM byte and displacement

 * @regs:	Register values as seen when entering kernel mode

 *

 * This function is to be used with 16-bit address encodings. Obtain the memory

 * address referred by the instruction's ModRM and displacement bytes. Also, the

 * segment used as base is determined by either any segment override prefixes in

 * @insn or the default segment of the registers involved in the address

 * computation. In protected mode, segment limits are enforced.

 *

 * Returns:

 *

 * Linear address referenced by the instruction operands on success.

 *

 * -1L on error.

 */

static void __user *get_addr_ref_16(struct insn *insn, struct pt_regs *regs)

{

	unsigned long linear_addr = -1L, seg_base, seg_limit;

	int ret, regoff;

	short eff_addr;

	long tmp;



	insn_get_modrm(insn);

	insn_get_displacement(insn);



	if (insn->addr_bytes != 2)

		goto out;



	if (X86_MODRM_MOD(insn->modrm.value) == 3) {

		ret = get_eff_addr_reg(insn, regs, &regoff, &tmp);

		if (ret)

			goto out;



		eff_addr = tmp;

	} else {

		ret = get_eff_addr_modrm_16(insn, regs, &regoff, &eff_addr);

		if (ret)

			goto out;

	}



	ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);

	if (ret)

		goto out;



	/*

	 * Before computing the linear address, make sure the effective address

	 * is within the limits of the segment. In virtual-8086 mode, segment

	 * limits are not enforced. In such a case, the segment limit is -1L to

	 * reflect this fact.

	 */

	if ((unsigned long)(eff_addr & 0xffff) > seg_limit)

		goto out;



	linear_addr = (unsigned long)(eff_addr & 0xffff) + seg_base;



	/* Limit linear address to 20 bits */

	if (v8086_mode(regs))

		linear_addr &= 0xfffff;



out:

	return (void __user *)linear_addr;

}



/**

 * get_addr_ref_32() - Obtain a 32-bit linear address

 * @insn:	Instruction with ModRM, SIB bytes and displacement
@@ -1143,6 +1352,8 @@ void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs) 
		return (void __user *)-1L;



	switch (insn->addr_bytes) {

	case 2:

		return get_addr_ref_16(insn, regs);

	case 4:

		return get_addr_ref_32(insn, regs);

	case 8: