Loading...
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * x86 decoder sanity test - based on test_get_insn.c
4 *
5 * Copyright (C) IBM Corporation, 2009
6 * Copyright (C) Hitachi, Ltd., 2011
7 */
8
9#include <stdlib.h>
10#include <stdio.h>
11#include <string.h>
12#include <assert.h>
13#include <unistd.h>
14#include <sys/types.h>
15#include <sys/stat.h>
16#include <fcntl.h>
17#include <asm/insn.h>
18#include <inat.c>
19#include <insn.c>
20
21/*
22 * Test of instruction analysis against tampering.
23 * Feed random binary to instruction decoder and ensure not to
24 * access out-of-instruction-buffer.
25 */
26
27#define DEFAULT_MAX_ITER 10000
28#define INSN_NOP 0x90
29
30static const char *prog; /* Program name */
31static int verbose; /* Verbosity */
32static int x86_64; /* x86-64 bit mode flag */
33static unsigned int seed; /* Random seed */
34static unsigned long iter_start; /* Start of iteration number */
35static unsigned long iter_end = DEFAULT_MAX_ITER; /* End of iteration number */
36static FILE *input_file; /* Input file name */
37
38static void usage(const char *err)
39{
40 if (err)
41 fprintf(stderr, "%s: Error: %s\n\n", prog, err);
42 fprintf(stderr, "Usage: %s [-y|-n|-v] [-s seed[,no]] [-m max] [-i input]\n", prog);
43 fprintf(stderr, "\t-y 64bit mode\n");
44 fprintf(stderr, "\t-n 32bit mode\n");
45 fprintf(stderr, "\t-v Verbosity(-vv dumps any decoded result)\n");
46 fprintf(stderr, "\t-s Give a random seed (and iteration number)\n");
47 fprintf(stderr, "\t-m Give a maximum iteration number\n");
48 fprintf(stderr, "\t-i Give an input file with decoded binary\n");
49 exit(1);
50}
51
52static void dump_field(FILE *fp, const char *name, const char *indent,
53 struct insn_field *field)
54{
55 fprintf(fp, "%s.%s = {\n", indent, name);
56 fprintf(fp, "%s\t.value = %d, bytes[] = {%x, %x, %x, %x},\n",
57 indent, field->value, field->bytes[0], field->bytes[1],
58 field->bytes[2], field->bytes[3]);
59 fprintf(fp, "%s\t.got = %d, .nbytes = %d},\n", indent,
60 field->got, field->nbytes);
61}
62
63static void dump_insn(FILE *fp, struct insn *insn)
64{
65 fprintf(fp, "Instruction = {\n");
66 dump_field(fp, "prefixes", "\t", &insn->prefixes);
67 dump_field(fp, "rex_prefix", "\t", &insn->rex_prefix);
68 dump_field(fp, "vex_prefix", "\t", &insn->vex_prefix);
69 dump_field(fp, "opcode", "\t", &insn->opcode);
70 dump_field(fp, "modrm", "\t", &insn->modrm);
71 dump_field(fp, "sib", "\t", &insn->sib);
72 dump_field(fp, "displacement", "\t", &insn->displacement);
73 dump_field(fp, "immediate1", "\t", &insn->immediate1);
74 dump_field(fp, "immediate2", "\t", &insn->immediate2);
75 fprintf(fp, "\t.attr = %x, .opnd_bytes = %d, .addr_bytes = %d,\n",
76 insn->attr, insn->opnd_bytes, insn->addr_bytes);
77 fprintf(fp, "\t.length = %d, .x86_64 = %d, .kaddr = %p}\n",
78 insn->length, insn->x86_64, insn->kaddr);
79}
80
81static void dump_stream(FILE *fp, const char *msg, unsigned long nr_iter,
82 unsigned char *insn_buff, struct insn *insn)
83{
84 int i;
85
86 fprintf(fp, "%s:\n", msg);
87
88 dump_insn(fp, insn);
89
90 fprintf(fp, "You can reproduce this with below command(s);\n");
91
92 /* Input a decoded instruction sequence directly */
93 fprintf(fp, " $ echo ");
94 for (i = 0; i < MAX_INSN_SIZE; i++)
95 fprintf(fp, " %02x", insn_buff[i]);
96 fprintf(fp, " | %s -i -\n", prog);
97
98 if (!input_file) {
99 fprintf(fp, "Or \n");
100 /* Give a seed and iteration number */
101 fprintf(fp, " $ %s -s 0x%x,%lu\n", prog, seed, nr_iter);
102 }
103}
104
105static void init_random_seed(void)
106{
107 int fd;
108
109 fd = open("/dev/urandom", O_RDONLY);
110 if (fd < 0)
111 goto fail;
112
113 if (read(fd, &seed, sizeof(seed)) != sizeof(seed))
114 goto fail;
115
116 close(fd);
117 return;
118fail:
119 usage("Failed to open /dev/urandom");
120}
121
122/* Read given instruction sequence from the input file */
123static int read_next_insn(unsigned char *insn_buff)
124{
125 char buf[256] = "", *tmp;
126 int i;
127
128 tmp = fgets(buf, ARRAY_SIZE(buf), input_file);
129 if (tmp == NULL || feof(input_file))
130 return 0;
131
132 for (i = 0; i < MAX_INSN_SIZE; i++) {
133 insn_buff[i] = (unsigned char)strtoul(tmp, &tmp, 16);
134 if (*tmp != ' ')
135 break;
136 }
137
138 return i;
139}
140
141static int generate_insn(unsigned char *insn_buff)
142{
143 int i;
144
145 if (input_file)
146 return read_next_insn(insn_buff);
147
148 /* Fills buffer with random binary up to MAX_INSN_SIZE */
149 for (i = 0; i < MAX_INSN_SIZE - 1; i += 2)
150 *(unsigned short *)(&insn_buff[i]) = random() & 0xffff;
151
152 while (i < MAX_INSN_SIZE)
153 insn_buff[i++] = random() & 0xff;
154
155 return i;
156}
157
158static void parse_args(int argc, char **argv)
159{
160 int c;
161 char *tmp = NULL;
162 int set_seed = 0;
163
164 prog = argv[0];
165 while ((c = getopt(argc, argv, "ynvs:m:i:")) != -1) {
166 switch (c) {
167 case 'y':
168 x86_64 = 1;
169 break;
170 case 'n':
171 x86_64 = 0;
172 break;
173 case 'v':
174 verbose++;
175 break;
176 case 'i':
177 if (strcmp("-", optarg) == 0)
178 input_file = stdin;
179 else
180 input_file = fopen(optarg, "r");
181 if (!input_file)
182 usage("Failed to open input file");
183 break;
184 case 's':
185 seed = (unsigned int)strtoul(optarg, &tmp, 0);
186 if (*tmp == ',') {
187 optarg = tmp + 1;
188 iter_start = strtoul(optarg, &tmp, 0);
189 }
190 if (*tmp != '\0' || tmp == optarg)
191 usage("Failed to parse seed");
192 set_seed = 1;
193 break;
194 case 'm':
195 iter_end = strtoul(optarg, &tmp, 0);
196 if (*tmp != '\0' || tmp == optarg)
197 usage("Failed to parse max_iter");
198 break;
199 default:
200 usage(NULL);
201 }
202 }
203
204 /* Check errors */
205 if (iter_end < iter_start)
206 usage("Max iteration number must be bigger than iter-num");
207
208 if (set_seed && input_file)
209 usage("Don't use input file (-i) with random seed (-s)");
210
211 /* Initialize random seed */
212 if (!input_file) {
213 if (!set_seed) /* No seed is given */
214 init_random_seed();
215 srand(seed);
216 }
217}
218
219int main(int argc, char **argv)
220{
221 int insns = 0, ret;
222 struct insn insn;
223 int errors = 0;
224 unsigned long i;
225 unsigned char insn_buff[MAX_INSN_SIZE * 2];
226
227 parse_args(argc, argv);
228
229 /* Prepare stop bytes with NOPs */
230 memset(insn_buff + MAX_INSN_SIZE, INSN_NOP, MAX_INSN_SIZE);
231
232 for (i = 0; i < iter_end; i++) {
233 if (generate_insn(insn_buff) <= 0)
234 break;
235
236 if (i < iter_start) /* Skip to given iteration number */
237 continue;
238
239 /* Decode an instruction */
240 ret = insn_decode(&insn, insn_buff, sizeof(insn_buff),
241 x86_64 ? INSN_MODE_64 : INSN_MODE_32);
242
243 if (insn.next_byte <= insn.kaddr ||
244 insn.kaddr + MAX_INSN_SIZE < insn.next_byte) {
245 /* Access out-of-range memory */
246 dump_stream(stderr, "Error: Found an access violation", i, insn_buff, &insn);
247 errors++;
248 } else if (verbose && ret < 0)
249 dump_stream(stdout, "Info: Found an undecodable input", i, insn_buff, &insn);
250 else if (verbose >= 2)
251 dump_insn(stdout, &insn);
252 insns++;
253 }
254
255 fprintf((errors) ? stderr : stdout,
256 "%s: %s: decoded and checked %d %s instructions with %d errors (seed:0x%x)\n",
257 prog,
258 (errors) ? "Failure" : "Success",
259 insns,
260 (input_file) ? "given" : "random",
261 errors,
262 seed);
263
264 return errors ? 1 : 0;
265}
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * x86 decoder sanity test - based on test_get_insn.c
4 *
5 * Copyright (C) IBM Corporation, 2009
6 * Copyright (C) Hitachi, Ltd., 2011
7 */
8
9#include <stdlib.h>
10#include <stdio.h>
11#include <string.h>
12#include <assert.h>
13#include <unistd.h>
14#include <sys/types.h>
15#include <sys/stat.h>
16#include <fcntl.h>
17
18#define unlikely(cond) (cond)
19#define ARRAY_SIZE(a) (sizeof(a)/sizeof(a[0]))
20
21#include <asm/insn.h>
22#include <inat.c>
23#include <insn.c>
24
25/*
26 * Test of instruction analysis against tampering.
27 * Feed random binary to instruction decoder and ensure not to
28 * access out-of-instruction-buffer.
29 */
30
31#define DEFAULT_MAX_ITER 10000
32#define INSN_NOP 0x90
33
34static const char *prog; /* Program name */
35static int verbose; /* Verbosity */
36static int x86_64; /* x86-64 bit mode flag */
37static unsigned int seed; /* Random seed */
38static unsigned long iter_start; /* Start of iteration number */
39static unsigned long iter_end = DEFAULT_MAX_ITER; /* End of iteration number */
40static FILE *input_file; /* Input file name */
41
42static void usage(const char *err)
43{
44 if (err)
45 fprintf(stderr, "%s: Error: %s\n\n", prog, err);
46 fprintf(stderr, "Usage: %s [-y|-n|-v] [-s seed[,no]] [-m max] [-i input]\n", prog);
47 fprintf(stderr, "\t-y 64bit mode\n");
48 fprintf(stderr, "\t-n 32bit mode\n");
49 fprintf(stderr, "\t-v Verbosity(-vv dumps any decoded result)\n");
50 fprintf(stderr, "\t-s Give a random seed (and iteration number)\n");
51 fprintf(stderr, "\t-m Give a maximum iteration number\n");
52 fprintf(stderr, "\t-i Give an input file with decoded binary\n");
53 exit(1);
54}
55
56static void dump_field(FILE *fp, const char *name, const char *indent,
57 struct insn_field *field)
58{
59 fprintf(fp, "%s.%s = {\n", indent, name);
60 fprintf(fp, "%s\t.value = %d, bytes[] = {%x, %x, %x, %x},\n",
61 indent, field->value, field->bytes[0], field->bytes[1],
62 field->bytes[2], field->bytes[3]);
63 fprintf(fp, "%s\t.got = %d, .nbytes = %d},\n", indent,
64 field->got, field->nbytes);
65}
66
67static void dump_insn(FILE *fp, struct insn *insn)
68{
69 fprintf(fp, "Instruction = {\n");
70 dump_field(fp, "prefixes", "\t", &insn->prefixes);
71 dump_field(fp, "rex_prefix", "\t", &insn->rex_prefix);
72 dump_field(fp, "vex_prefix", "\t", &insn->vex_prefix);
73 dump_field(fp, "opcode", "\t", &insn->opcode);
74 dump_field(fp, "modrm", "\t", &insn->modrm);
75 dump_field(fp, "sib", "\t", &insn->sib);
76 dump_field(fp, "displacement", "\t", &insn->displacement);
77 dump_field(fp, "immediate1", "\t", &insn->immediate1);
78 dump_field(fp, "immediate2", "\t", &insn->immediate2);
79 fprintf(fp, "\t.attr = %x, .opnd_bytes = %d, .addr_bytes = %d,\n",
80 insn->attr, insn->opnd_bytes, insn->addr_bytes);
81 fprintf(fp, "\t.length = %d, .x86_64 = %d, .kaddr = %p}\n",
82 insn->length, insn->x86_64, insn->kaddr);
83}
84
85static void dump_stream(FILE *fp, const char *msg, unsigned long nr_iter,
86 unsigned char *insn_buff, struct insn *insn)
87{
88 int i;
89
90 fprintf(fp, "%s:\n", msg);
91
92 dump_insn(fp, insn);
93
94 fprintf(fp, "You can reproduce this with below command(s);\n");
95
96 /* Input a decoded instruction sequence directly */
97 fprintf(fp, " $ echo ");
98 for (i = 0; i < MAX_INSN_SIZE; i++)
99 fprintf(fp, " %02x", insn_buff[i]);
100 fprintf(fp, " | %s -i -\n", prog);
101
102 if (!input_file) {
103 fprintf(fp, "Or \n");
104 /* Give a seed and iteration number */
105 fprintf(fp, " $ %s -s 0x%x,%lu\n", prog, seed, nr_iter);
106 }
107}
108
109static void init_random_seed(void)
110{
111 int fd;
112
113 fd = open("/dev/urandom", O_RDONLY);
114 if (fd < 0)
115 goto fail;
116
117 if (read(fd, &seed, sizeof(seed)) != sizeof(seed))
118 goto fail;
119
120 close(fd);
121 return;
122fail:
123 usage("Failed to open /dev/urandom");
124}
125
126/* Read given instruction sequence from the input file */
127static int read_next_insn(unsigned char *insn_buff)
128{
129 char buf[256] = "", *tmp;
130 int i;
131
132 tmp = fgets(buf, ARRAY_SIZE(buf), input_file);
133 if (tmp == NULL || feof(input_file))
134 return 0;
135
136 for (i = 0; i < MAX_INSN_SIZE; i++) {
137 insn_buff[i] = (unsigned char)strtoul(tmp, &tmp, 16);
138 if (*tmp != ' ')
139 break;
140 }
141
142 return i;
143}
144
145static int generate_insn(unsigned char *insn_buff)
146{
147 int i;
148
149 if (input_file)
150 return read_next_insn(insn_buff);
151
152 /* Fills buffer with random binary up to MAX_INSN_SIZE */
153 for (i = 0; i < MAX_INSN_SIZE - 1; i += 2)
154 *(unsigned short *)(&insn_buff[i]) = random() & 0xffff;
155
156 while (i < MAX_INSN_SIZE)
157 insn_buff[i++] = random() & 0xff;
158
159 return i;
160}
161
162static void parse_args(int argc, char **argv)
163{
164 int c;
165 char *tmp = NULL;
166 int set_seed = 0;
167
168 prog = argv[0];
169 while ((c = getopt(argc, argv, "ynvs:m:i:")) != -1) {
170 switch (c) {
171 case 'y':
172 x86_64 = 1;
173 break;
174 case 'n':
175 x86_64 = 0;
176 break;
177 case 'v':
178 verbose++;
179 break;
180 case 'i':
181 if (strcmp("-", optarg) == 0)
182 input_file = stdin;
183 else
184 input_file = fopen(optarg, "r");
185 if (!input_file)
186 usage("Failed to open input file");
187 break;
188 case 's':
189 seed = (unsigned int)strtoul(optarg, &tmp, 0);
190 if (*tmp == ',') {
191 optarg = tmp + 1;
192 iter_start = strtoul(optarg, &tmp, 0);
193 }
194 if (*tmp != '\0' || tmp == optarg)
195 usage("Failed to parse seed");
196 set_seed = 1;
197 break;
198 case 'm':
199 iter_end = strtoul(optarg, &tmp, 0);
200 if (*tmp != '\0' || tmp == optarg)
201 usage("Failed to parse max_iter");
202 break;
203 default:
204 usage(NULL);
205 }
206 }
207
208 /* Check errors */
209 if (iter_end < iter_start)
210 usage("Max iteration number must be bigger than iter-num");
211
212 if (set_seed && input_file)
213 usage("Don't use input file (-i) with random seed (-s)");
214
215 /* Initialize random seed */
216 if (!input_file) {
217 if (!set_seed) /* No seed is given */
218 init_random_seed();
219 srand(seed);
220 }
221}
222
223int main(int argc, char **argv)
224{
225 struct insn insn;
226 int insns = 0;
227 int errors = 0;
228 unsigned long i;
229 unsigned char insn_buff[MAX_INSN_SIZE * 2];
230
231 parse_args(argc, argv);
232
233 /* Prepare stop bytes with NOPs */
234 memset(insn_buff + MAX_INSN_SIZE, INSN_NOP, MAX_INSN_SIZE);
235
236 for (i = 0; i < iter_end; i++) {
237 if (generate_insn(insn_buff) <= 0)
238 break;
239
240 if (i < iter_start) /* Skip to given iteration number */
241 continue;
242
243 /* Decode an instruction */
244 insn_init(&insn, insn_buff, sizeof(insn_buff), x86_64);
245 insn_get_length(&insn);
246
247 if (insn.next_byte <= insn.kaddr ||
248 insn.kaddr + MAX_INSN_SIZE < insn.next_byte) {
249 /* Access out-of-range memory */
250 dump_stream(stderr, "Error: Found an access violation", i, insn_buff, &insn);
251 errors++;
252 } else if (verbose && !insn_complete(&insn))
253 dump_stream(stdout, "Info: Found an undecodable input", i, insn_buff, &insn);
254 else if (verbose >= 2)
255 dump_insn(stdout, &insn);
256 insns++;
257 }
258
259 fprintf((errors) ? stderr : stdout,
260 "%s: %s: decoded and checked %d %s instructions with %d errors (seed:0x%x)\n",
261 prog,
262 (errors) ? "Failure" : "Success",
263 insns,
264 (input_file) ? "given" : "random",
265 errors,
266 seed);
267
268 return errors ? 1 : 0;
269}