Loading...
1/*
2 * Utility functions for x86 operand and address decoding
3 *
4 * Copyright (C) Intel Corporation 2017
5 */
6#include <linux/kernel.h>
7#include <linux/string.h>
8#include <linux/ratelimit.h>
9#include <linux/mmu_context.h>
10#include <asm/desc_defs.h>
11#include <asm/desc.h>
12#include <asm/inat.h>
13#include <asm/insn.h>
14#include <asm/insn-eval.h>
15#include <asm/ldt.h>
16#include <asm/vm86.h>
17
18#undef pr_fmt
19#define pr_fmt(fmt) "insn: " fmt
20
21enum reg_type {
22 REG_TYPE_RM = 0,
23 REG_TYPE_REG,
24 REG_TYPE_INDEX,
25 REG_TYPE_BASE,
26};
27
28/**
29 * is_string_insn() - Determine if instruction is a string instruction
30 * @insn: Instruction containing the opcode to inspect
31 *
32 * Returns:
33 *
34 * true if the instruction, determined by the opcode, is any of the
35 * string instructions as defined in the Intel Software Development manual.
36 * False otherwise.
37 */
38static bool is_string_insn(struct insn *insn)
39{
40 /* All string instructions have a 1-byte opcode. */
41 if (insn->opcode.nbytes != 1)
42 return false;
43
44 switch (insn->opcode.bytes[0]) {
45 case 0x6c ... 0x6f: /* INS, OUTS */
46 case 0xa4 ... 0xa7: /* MOVS, CMPS */
47 case 0xaa ... 0xaf: /* STOS, LODS, SCAS */
48 return true;
49 default:
50 return false;
51 }
52}
53
54/**
55 * insn_has_rep_prefix() - Determine if instruction has a REP prefix
56 * @insn: Instruction containing the prefix to inspect
57 *
58 * Returns:
59 *
60 * true if the instruction has a REP prefix, false if not.
61 */
62bool insn_has_rep_prefix(struct insn *insn)
63{
64 insn_byte_t p;
65 int i;
66
67 insn_get_prefixes(insn);
68
69 for_each_insn_prefix(insn, i, p) {
70 if (p == 0xf2 || p == 0xf3)
71 return true;
72 }
73
74 return false;
75}
76
77/**
78 * get_seg_reg_override_idx() - obtain segment register override index
79 * @insn: Valid instruction with segment override prefixes
80 *
81 * Inspect the instruction prefixes in @insn and find segment overrides, if any.
82 *
83 * Returns:
84 *
85 * A constant identifying the segment register to use, among CS, SS, DS,
86 * ES, FS, or GS. INAT_SEG_REG_DEFAULT is returned if no segment override
87 * prefixes were found.
88 *
89 * -EINVAL in case of error.
90 */
91static int get_seg_reg_override_idx(struct insn *insn)
92{
93 int idx = INAT_SEG_REG_DEFAULT;
94 int num_overrides = 0, i;
95 insn_byte_t p;
96
97 insn_get_prefixes(insn);
98
99 /* Look for any segment override prefixes. */
100 for_each_insn_prefix(insn, i, p) {
101 insn_attr_t attr;
102
103 attr = inat_get_opcode_attribute(p);
104 switch (attr) {
105 case INAT_MAKE_PREFIX(INAT_PFX_CS):
106 idx = INAT_SEG_REG_CS;
107 num_overrides++;
108 break;
109 case INAT_MAKE_PREFIX(INAT_PFX_SS):
110 idx = INAT_SEG_REG_SS;
111 num_overrides++;
112 break;
113 case INAT_MAKE_PREFIX(INAT_PFX_DS):
114 idx = INAT_SEG_REG_DS;
115 num_overrides++;
116 break;
117 case INAT_MAKE_PREFIX(INAT_PFX_ES):
118 idx = INAT_SEG_REG_ES;
119 num_overrides++;
120 break;
121 case INAT_MAKE_PREFIX(INAT_PFX_FS):
122 idx = INAT_SEG_REG_FS;
123 num_overrides++;
124 break;
125 case INAT_MAKE_PREFIX(INAT_PFX_GS):
126 idx = INAT_SEG_REG_GS;
127 num_overrides++;
128 break;
129 /* No default action needed. */
130 }
131 }
132
133 /* More than one segment override prefix leads to undefined behavior. */
134 if (num_overrides > 1)
135 return -EINVAL;
136
137 return idx;
138}
139
140/**
141 * check_seg_overrides() - check if segment override prefixes are allowed
142 * @insn: Valid instruction with segment override prefixes
143 * @regoff: Operand offset, in pt_regs, for which the check is performed
144 *
145 * For a particular register used in register-indirect addressing, determine if
146 * segment override prefixes can be used. Specifically, no overrides are allowed
147 * for rDI if used with a string instruction.
148 *
149 * Returns:
150 *
151 * True if segment override prefixes can be used with the register indicated
152 * in @regoff. False if otherwise.
153 */
154static bool check_seg_overrides(struct insn *insn, int regoff)
155{
156 if (regoff == offsetof(struct pt_regs, di) && is_string_insn(insn))
157 return false;
158
159 return true;
160}
161
162/**
163 * resolve_default_seg() - resolve default segment register index for an operand
164 * @insn: Instruction with opcode and address size. Must be valid.
165 * @regs: Register values as seen when entering kernel mode
166 * @off: Operand offset, in pt_regs, for which resolution is needed
167 *
168 * Resolve the default segment register index associated with the instruction
169 * operand register indicated by @off. Such index is resolved based on defaults
170 * described in the Intel Software Development Manual.
171 *
172 * Returns:
173 *
174 * If in protected mode, a constant identifying the segment register to use,
175 * among CS, SS, ES or DS. If in long mode, INAT_SEG_REG_IGNORE.
176 *
177 * -EINVAL in case of error.
178 */
179static int resolve_default_seg(struct insn *insn, struct pt_regs *regs, int off)
180{
181 if (any_64bit_mode(regs))
182 return INAT_SEG_REG_IGNORE;
183 /*
184 * Resolve the default segment register as described in Section 3.7.4
185 * of the Intel Software Development Manual Vol. 1:
186 *
187 * + DS for all references involving r[ABCD]X, and rSI.
188 * + If used in a string instruction, ES for rDI. Otherwise, DS.
189 * + AX, CX and DX are not valid register operands in 16-bit address
190 * encodings but are valid for 32-bit and 64-bit encodings.
191 * + -EDOM is reserved to identify for cases in which no register
192 * is used (i.e., displacement-only addressing). Use DS.
193 * + SS for rSP or rBP.
194 * + CS for rIP.
195 */
196
197 switch (off) {
198 case offsetof(struct pt_regs, ax):
199 case offsetof(struct pt_regs, cx):
200 case offsetof(struct pt_regs, dx):
201 /* Need insn to verify address size. */
202 if (insn->addr_bytes == 2)
203 return -EINVAL;
204
205 fallthrough;
206
207 case -EDOM:
208 case offsetof(struct pt_regs, bx):
209 case offsetof(struct pt_regs, si):
210 return INAT_SEG_REG_DS;
211
212 case offsetof(struct pt_regs, di):
213 if (is_string_insn(insn))
214 return INAT_SEG_REG_ES;
215 return INAT_SEG_REG_DS;
216
217 case offsetof(struct pt_regs, bp):
218 case offsetof(struct pt_regs, sp):
219 return INAT_SEG_REG_SS;
220
221 case offsetof(struct pt_regs, ip):
222 return INAT_SEG_REG_CS;
223
224 default:
225 return -EINVAL;
226 }
227}
228
229/**
230 * resolve_seg_reg() - obtain segment register index
231 * @insn: Instruction with operands
232 * @regs: Register values as seen when entering kernel mode
233 * @regoff: Operand offset, in pt_regs, used to determine segment register
234 *
235 * Determine the segment register associated with the operands and, if
236 * applicable, prefixes and the instruction pointed by @insn.
237 *
238 * The segment register associated to an operand used in register-indirect
239 * addressing depends on:
240 *
241 * a) Whether running in long mode (in such a case segments are ignored, except
242 * if FS or GS are used).
243 *
244 * b) Whether segment override prefixes can be used. Certain instructions and
245 * registers do not allow override prefixes.
246 *
247 * c) Whether segment overrides prefixes are found in the instruction prefixes.
248 *
249 * d) If there are not segment override prefixes or they cannot be used, the
250 * default segment register associated with the operand register is used.
251 *
252 * The function checks first if segment override prefixes can be used with the
253 * operand indicated by @regoff. If allowed, obtain such overridden segment
254 * register index. Lastly, if not prefixes were found or cannot be used, resolve
255 * the segment register index to use based on the defaults described in the
256 * Intel documentation. In long mode, all segment register indexes will be
257 * ignored, except if overrides were found for FS or GS. All these operations
258 * are done using helper functions.
259 *
260 * The operand register, @regoff, is represented as the offset from the base of
261 * pt_regs.
262 *
263 * As stated, the main use of this function is to determine the segment register
264 * index based on the instruction, its operands and prefixes. Hence, @insn
265 * must be valid. However, if @regoff indicates rIP, we don't need to inspect
266 * @insn at all as in this case CS is used in all cases. This case is checked
267 * before proceeding further.
268 *
269 * Please note that this function does not return the value in the segment
270 * register (i.e., the segment selector) but our defined index. The segment
271 * selector needs to be obtained using get_segment_selector() and passing the
272 * segment register index resolved by this function.
273 *
274 * Returns:
275 *
276 * An index identifying the segment register to use, among CS, SS, DS,
277 * ES, FS, or GS. INAT_SEG_REG_IGNORE is returned if running in long mode.
278 *
279 * -EINVAL in case of error.
280 */
281static int resolve_seg_reg(struct insn *insn, struct pt_regs *regs, int regoff)
282{
283 int idx;
284
285 /*
286 * In the unlikely event of having to resolve the segment register
287 * index for rIP, do it first. Segment override prefixes should not
288 * be used. Hence, it is not necessary to inspect the instruction,
289 * which may be invalid at this point.
290 */
291 if (regoff == offsetof(struct pt_regs, ip)) {
292 if (any_64bit_mode(regs))
293 return INAT_SEG_REG_IGNORE;
294 else
295 return INAT_SEG_REG_CS;
296 }
297
298 if (!insn)
299 return -EINVAL;
300
301 if (!check_seg_overrides(insn, regoff))
302 return resolve_default_seg(insn, regs, regoff);
303
304 idx = get_seg_reg_override_idx(insn);
305 if (idx < 0)
306 return idx;
307
308 if (idx == INAT_SEG_REG_DEFAULT)
309 return resolve_default_seg(insn, regs, regoff);
310
311 /*
312 * In long mode, segment override prefixes are ignored, except for
313 * overrides for FS and GS.
314 */
315 if (any_64bit_mode(regs)) {
316 if (idx != INAT_SEG_REG_FS &&
317 idx != INAT_SEG_REG_GS)
318 idx = INAT_SEG_REG_IGNORE;
319 }
320
321 return idx;
322}
323
324/**
325 * get_segment_selector() - obtain segment selector
326 * @regs: Register values as seen when entering kernel mode
327 * @seg_reg_idx: Segment register index to use
328 *
329 * Obtain the segment selector from any of the CS, SS, DS, ES, FS, GS segment
330 * registers. In CONFIG_X86_32, the segment is obtained from either pt_regs or
331 * kernel_vm86_regs as applicable. In CONFIG_X86_64, CS and SS are obtained
332 * from pt_regs. DS, ES, FS and GS are obtained by reading the actual CPU
333 * registers. This done for only for completeness as in CONFIG_X86_64 segment
334 * registers are ignored.
335 *
336 * Returns:
337 *
338 * Value of the segment selector, including null when running in
339 * long mode.
340 *
341 * -EINVAL on error.
342 */
343static short get_segment_selector(struct pt_regs *regs, int seg_reg_idx)
344{
345 unsigned short sel;
346
347#ifdef CONFIG_X86_64
348 switch (seg_reg_idx) {
349 case INAT_SEG_REG_IGNORE:
350 return 0;
351 case INAT_SEG_REG_CS:
352 return (unsigned short)(regs->cs & 0xffff);
353 case INAT_SEG_REG_SS:
354 return (unsigned short)(regs->ss & 0xffff);
355 case INAT_SEG_REG_DS:
356 savesegment(ds, sel);
357 return sel;
358 case INAT_SEG_REG_ES:
359 savesegment(es, sel);
360 return sel;
361 case INAT_SEG_REG_FS:
362 savesegment(fs, sel);
363 return sel;
364 case INAT_SEG_REG_GS:
365 savesegment(gs, sel);
366 return sel;
367 default:
368 return -EINVAL;
369 }
370#else /* CONFIG_X86_32 */
371 struct kernel_vm86_regs *vm86regs = (struct kernel_vm86_regs *)regs;
372
373 if (v8086_mode(regs)) {
374 switch (seg_reg_idx) {
375 case INAT_SEG_REG_CS:
376 return (unsigned short)(regs->cs & 0xffff);
377 case INAT_SEG_REG_SS:
378 return (unsigned short)(regs->ss & 0xffff);
379 case INAT_SEG_REG_DS:
380 return vm86regs->ds;
381 case INAT_SEG_REG_ES:
382 return vm86regs->es;
383 case INAT_SEG_REG_FS:
384 return vm86regs->fs;
385 case INAT_SEG_REG_GS:
386 return vm86regs->gs;
387 case INAT_SEG_REG_IGNORE:
388 default:
389 return -EINVAL;
390 }
391 }
392
393 switch (seg_reg_idx) {
394 case INAT_SEG_REG_CS:
395 return (unsigned short)(regs->cs & 0xffff);
396 case INAT_SEG_REG_SS:
397 return (unsigned short)(regs->ss & 0xffff);
398 case INAT_SEG_REG_DS:
399 return (unsigned short)(regs->ds & 0xffff);
400 case INAT_SEG_REG_ES:
401 return (unsigned short)(regs->es & 0xffff);
402 case INAT_SEG_REG_FS:
403 return (unsigned short)(regs->fs & 0xffff);
404 case INAT_SEG_REG_GS:
405 savesegment(gs, sel);
406 return sel;
407 case INAT_SEG_REG_IGNORE:
408 default:
409 return -EINVAL;
410 }
411#endif /* CONFIG_X86_64 */
412}
413
414static const int pt_regoff[] = {
415 offsetof(struct pt_regs, ax),
416 offsetof(struct pt_regs, cx),
417 offsetof(struct pt_regs, dx),
418 offsetof(struct pt_regs, bx),
419 offsetof(struct pt_regs, sp),
420 offsetof(struct pt_regs, bp),
421 offsetof(struct pt_regs, si),
422 offsetof(struct pt_regs, di),
423#ifdef CONFIG_X86_64
424 offsetof(struct pt_regs, r8),
425 offsetof(struct pt_regs, r9),
426 offsetof(struct pt_regs, r10),
427 offsetof(struct pt_regs, r11),
428 offsetof(struct pt_regs, r12),
429 offsetof(struct pt_regs, r13),
430 offsetof(struct pt_regs, r14),
431 offsetof(struct pt_regs, r15),
432#else
433 offsetof(struct pt_regs, ds),
434 offsetof(struct pt_regs, es),
435 offsetof(struct pt_regs, fs),
436 offsetof(struct pt_regs, gs),
437#endif
438};
439
440int pt_regs_offset(struct pt_regs *regs, int regno)
441{
442 if ((unsigned)regno < ARRAY_SIZE(pt_regoff))
443 return pt_regoff[regno];
444 return -EDOM;
445}
446
447static int get_regno(struct insn *insn, enum reg_type type)
448{
449 int nr_registers = ARRAY_SIZE(pt_regoff);
450 int regno = 0;
451
452 /*
453 * Don't possibly decode a 32-bit instructions as
454 * reading a 64-bit-only register.
455 */
456 if (IS_ENABLED(CONFIG_X86_64) && !insn->x86_64)
457 nr_registers -= 8;
458
459 switch (type) {
460 case REG_TYPE_RM:
461 regno = X86_MODRM_RM(insn->modrm.value);
462
463 /*
464 * ModRM.mod == 0 and ModRM.rm == 5 means a 32-bit displacement
465 * follows the ModRM byte.
466 */
467 if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
468 return -EDOM;
469
470 if (X86_REX_B(insn->rex_prefix.value))
471 regno += 8;
472 break;
473
474 case REG_TYPE_REG:
475 regno = X86_MODRM_REG(insn->modrm.value);
476
477 if (X86_REX_R(insn->rex_prefix.value))
478 regno += 8;
479 break;
480
481 case REG_TYPE_INDEX:
482 regno = X86_SIB_INDEX(insn->sib.value);
483 if (X86_REX_X(insn->rex_prefix.value))
484 regno += 8;
485
486 /*
487 * If ModRM.mod != 3 and SIB.index = 4 the scale*index
488 * portion of the address computation is null. This is
489 * true only if REX.X is 0. In such a case, the SIB index
490 * is used in the address computation.
491 */
492 if (X86_MODRM_MOD(insn->modrm.value) != 3 && regno == 4)
493 return -EDOM;
494 break;
495
496 case REG_TYPE_BASE:
497 regno = X86_SIB_BASE(insn->sib.value);
498 /*
499 * If ModRM.mod is 0 and SIB.base == 5, the base of the
500 * register-indirect addressing is 0. In this case, a
501 * 32-bit displacement follows the SIB byte.
502 */
503 if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
504 return -EDOM;
505
506 if (X86_REX_B(insn->rex_prefix.value))
507 regno += 8;
508 break;
509
510 default:
511 pr_err_ratelimited("invalid register type: %d\n", type);
512 return -EINVAL;
513 }
514
515 if (regno >= nr_registers) {
516 WARN_ONCE(1, "decoded an instruction with an invalid register");
517 return -EINVAL;
518 }
519 return regno;
520}
521
522static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
523 enum reg_type type)
524{
525 int regno = get_regno(insn, type);
526
527 if (regno < 0)
528 return regno;
529
530 return pt_regs_offset(regs, regno);
531}
532
533/**
534 * get_reg_offset_16() - Obtain offset of register indicated by instruction
535 * @insn: Instruction containing ModRM byte
536 * @regs: Register values as seen when entering kernel mode
537 * @offs1: Offset of the first operand register
538 * @offs2: Offset of the second operand register, if applicable
539 *
540 * Obtain the offset, in pt_regs, of the registers indicated by the ModRM byte
541 * in @insn. This function is to be used with 16-bit address encodings. The
542 * @offs1 and @offs2 will be written with the offset of the two registers
543 * indicated by the instruction. In cases where any of the registers is not
544 * referenced by the instruction, the value will be set to -EDOM.
545 *
546 * Returns:
547 *
548 * 0 on success, -EINVAL on error.
549 */
550static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs,
551 int *offs1, int *offs2)
552{
553 /*
554 * 16-bit addressing can use one or two registers. Specifics of
555 * encodings are given in Table 2-1. "16-Bit Addressing Forms with the
556 * ModR/M Byte" of the Intel Software Development Manual.
557 */
558 static const int regoff1[] = {
559 offsetof(struct pt_regs, bx),
560 offsetof(struct pt_regs, bx),
561 offsetof(struct pt_regs, bp),
562 offsetof(struct pt_regs, bp),
563 offsetof(struct pt_regs, si),
564 offsetof(struct pt_regs, di),
565 offsetof(struct pt_regs, bp),
566 offsetof(struct pt_regs, bx),
567 };
568
569 static const int regoff2[] = {
570 offsetof(struct pt_regs, si),
571 offsetof(struct pt_regs, di),
572 offsetof(struct pt_regs, si),
573 offsetof(struct pt_regs, di),
574 -EDOM,
575 -EDOM,
576 -EDOM,
577 -EDOM,
578 };
579
580 if (!offs1 || !offs2)
581 return -EINVAL;
582
583 /* Operand is a register, use the generic function. */
584 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
585 *offs1 = insn_get_modrm_rm_off(insn, regs);
586 *offs2 = -EDOM;
587 return 0;
588 }
589
590 *offs1 = regoff1[X86_MODRM_RM(insn->modrm.value)];
591 *offs2 = regoff2[X86_MODRM_RM(insn->modrm.value)];
592
593 /*
594 * If ModRM.mod is 0 and ModRM.rm is 110b, then we use displacement-
595 * only addressing. This means that no registers are involved in
596 * computing the effective address. Thus, ensure that the first
597 * register offset is invalid. The second register offset is already
598 * invalid under the aforementioned conditions.
599 */
600 if ((X86_MODRM_MOD(insn->modrm.value) == 0) &&
601 (X86_MODRM_RM(insn->modrm.value) == 6))
602 *offs1 = -EDOM;
603
604 return 0;
605}
606
607/**
608 * get_desc() - Obtain contents of a segment descriptor
609 * @out: Segment descriptor contents on success
610 * @sel: Segment selector
611 *
612 * Given a segment selector, obtain a pointer to the segment descriptor.
613 * Both global and local descriptor tables are supported.
614 *
615 * Returns:
616 *
617 * True on success, false on failure.
618 *
619 * NULL on error.
620 */
621static bool get_desc(struct desc_struct *out, unsigned short sel)
622{
623 struct desc_ptr gdt_desc = {0, 0};
624 unsigned long desc_base;
625
626#ifdef CONFIG_MODIFY_LDT_SYSCALL
627 if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) {
628 bool success = false;
629 struct ldt_struct *ldt;
630
631 /* Bits [15:3] contain the index of the desired entry. */
632 sel >>= 3;
633
634 mutex_lock(¤t->active_mm->context.lock);
635 ldt = current->active_mm->context.ldt;
636 if (ldt && sel < ldt->nr_entries) {
637 *out = ldt->entries[sel];
638 success = true;
639 }
640
641 mutex_unlock(¤t->active_mm->context.lock);
642
643 return success;
644 }
645#endif
646 native_store_gdt(&gdt_desc);
647
648 /*
649 * Segment descriptors have a size of 8 bytes. Thus, the index is
650 * multiplied by 8 to obtain the memory offset of the desired descriptor
651 * from the base of the GDT. As bits [15:3] of the segment selector
652 * contain the index, it can be regarded as multiplied by 8 already.
653 * All that remains is to clear bits [2:0].
654 */
655 desc_base = sel & ~(SEGMENT_RPL_MASK | SEGMENT_TI_MASK);
656
657 if (desc_base > gdt_desc.size)
658 return false;
659
660 *out = *(struct desc_struct *)(gdt_desc.address + desc_base);
661 return true;
662}
663
664/**
665 * insn_get_seg_base() - Obtain base address of segment descriptor.
666 * @regs: Register values as seen when entering kernel mode
667 * @seg_reg_idx: Index of the segment register pointing to seg descriptor
668 *
669 * Obtain the base address of the segment as indicated by the segment descriptor
670 * pointed by the segment selector. The segment selector is obtained from the
671 * input segment register index @seg_reg_idx.
672 *
673 * Returns:
674 *
675 * In protected mode, base address of the segment. Zero in long mode,
676 * except when FS or GS are used. In virtual-8086 mode, the segment
677 * selector shifted 4 bits to the right.
678 *
679 * -1L in case of error.
680 */
681unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx)
682{
683 struct desc_struct desc;
684 short sel;
685
686 sel = get_segment_selector(regs, seg_reg_idx);
687 if (sel < 0)
688 return -1L;
689
690 if (v8086_mode(regs))
691 /*
692 * Base is simply the segment selector shifted 4
693 * bits to the right.
694 */
695 return (unsigned long)(sel << 4);
696
697 if (any_64bit_mode(regs)) {
698 /*
699 * Only FS or GS will have a base address, the rest of
700 * the segments' bases are forced to 0.
701 */
702 unsigned long base;
703
704 if (seg_reg_idx == INAT_SEG_REG_FS) {
705 rdmsrl(MSR_FS_BASE, base);
706 } else if (seg_reg_idx == INAT_SEG_REG_GS) {
707 /*
708 * swapgs was called at the kernel entry point. Thus,
709 * MSR_KERNEL_GS_BASE will have the user-space GS base.
710 */
711 if (user_mode(regs))
712 rdmsrl(MSR_KERNEL_GS_BASE, base);
713 else
714 rdmsrl(MSR_GS_BASE, base);
715 } else {
716 base = 0;
717 }
718 return base;
719 }
720
721 /* In protected mode the segment selector cannot be null. */
722 if (!sel)
723 return -1L;
724
725 if (!get_desc(&desc, sel))
726 return -1L;
727
728 return get_desc_base(&desc);
729}
730
731/**
732 * get_seg_limit() - Obtain the limit of a segment descriptor
733 * @regs: Register values as seen when entering kernel mode
734 * @seg_reg_idx: Index of the segment register pointing to seg descriptor
735 *
736 * Obtain the limit of the segment as indicated by the segment descriptor
737 * pointed by the segment selector. The segment selector is obtained from the
738 * input segment register index @seg_reg_idx.
739 *
740 * Returns:
741 *
742 * In protected mode, the limit of the segment descriptor in bytes.
743 * In long mode and virtual-8086 mode, segment limits are not enforced. Thus,
744 * limit is returned as -1L to imply a limit-less segment.
745 *
746 * Zero is returned on error.
747 */
748static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)
749{
750 struct desc_struct desc;
751 unsigned long limit;
752 short sel;
753
754 sel = get_segment_selector(regs, seg_reg_idx);
755 if (sel < 0)
756 return 0;
757
758 if (any_64bit_mode(regs) || v8086_mode(regs))
759 return -1L;
760
761 if (!sel)
762 return 0;
763
764 if (!get_desc(&desc, sel))
765 return 0;
766
767 /*
768 * If the granularity bit is set, the limit is given in multiples
769 * of 4096. This also means that the 12 least significant bits are
770 * not tested when checking the segment limits. In practice,
771 * this means that the segment ends in (limit << 12) + 0xfff.
772 */
773 limit = get_desc_limit(&desc);
774 if (desc.g)
775 limit = (limit << 12) + 0xfff;
776
777 return limit;
778}
779
780/**
781 * insn_get_code_seg_params() - Obtain code segment parameters
782 * @regs: Structure with register values as seen when entering kernel mode
783 *
784 * Obtain address and operand sizes of the code segment. It is obtained from the
785 * selector contained in the CS register in regs. In protected mode, the default
786 * address is determined by inspecting the L and D bits of the segment
787 * descriptor. In virtual-8086 mode, the default is always two bytes for both
788 * address and operand sizes.
789 *
790 * Returns:
791 *
792 * An int containing ORed-in default parameters on success.
793 *
794 * -EINVAL on error.
795 */
796int insn_get_code_seg_params(struct pt_regs *regs)
797{
798 struct desc_struct desc;
799 short sel;
800
801 if (v8086_mode(regs))
802 /* Address and operand size are both 16-bit. */
803 return INSN_CODE_SEG_PARAMS(2, 2);
804
805 sel = get_segment_selector(regs, INAT_SEG_REG_CS);
806 if (sel < 0)
807 return sel;
808
809 if (!get_desc(&desc, sel))
810 return -EINVAL;
811
812 /*
813 * The most significant byte of the Type field of the segment descriptor
814 * determines whether a segment contains data or code. If this is a data
815 * segment, return error.
816 */
817 if (!(desc.type & BIT(3)))
818 return -EINVAL;
819
820 switch ((desc.l << 1) | desc.d) {
821 case 0: /*
822 * Legacy mode. CS.L=0, CS.D=0. Address and operand size are
823 * both 16-bit.
824 */
825 return INSN_CODE_SEG_PARAMS(2, 2);
826 case 1: /*
827 * Legacy mode. CS.L=0, CS.D=1. Address and operand size are
828 * both 32-bit.
829 */
830 return INSN_CODE_SEG_PARAMS(4, 4);
831 case 2: /*
832 * IA-32e 64-bit mode. CS.L=1, CS.D=0. Address size is 64-bit;
833 * operand size is 32-bit.
834 */
835 return INSN_CODE_SEG_PARAMS(4, 8);
836 case 3: /* Invalid setting. CS.L=1, CS.D=1 */
837 fallthrough;
838 default:
839 return -EINVAL;
840 }
841}
842
843/**
844 * insn_get_modrm_rm_off() - Obtain register in r/m part of the ModRM byte
845 * @insn: Instruction containing the ModRM byte
846 * @regs: Register values as seen when entering kernel mode
847 *
848 * Returns:
849 *
850 * The register indicated by the r/m part of the ModRM byte. The
851 * register is obtained as an offset from the base of pt_regs. In specific
852 * cases, the returned value can be -EDOM to indicate that the particular value
853 * of ModRM does not refer to a register and shall be ignored.
854 */
855int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs)
856{
857 return get_reg_offset(insn, regs, REG_TYPE_RM);
858}
859
860/**
861 * insn_get_modrm_reg_off() - Obtain register in reg part of the ModRM byte
862 * @insn: Instruction containing the ModRM byte
863 * @regs: Register values as seen when entering kernel mode
864 *
865 * Returns:
866 *
867 * The register indicated by the reg part of the ModRM byte. The
868 * register is obtained as an offset from the base of pt_regs.
869 */
870int insn_get_modrm_reg_off(struct insn *insn, struct pt_regs *regs)
871{
872 return get_reg_offset(insn, regs, REG_TYPE_REG);
873}
874
875/**
876 * insn_get_modrm_reg_ptr() - Obtain register pointer based on ModRM byte
877 * @insn: Instruction containing the ModRM byte
878 * @regs: Register values as seen when entering kernel mode
879 *
880 * Returns:
881 *
882 * The register indicated by the reg part of the ModRM byte.
883 * The register is obtained as a pointer within pt_regs.
884 */
885unsigned long *insn_get_modrm_reg_ptr(struct insn *insn, struct pt_regs *regs)
886{
887 int offset;
888
889 offset = insn_get_modrm_reg_off(insn, regs);
890 if (offset < 0)
891 return NULL;
892 return (void *)regs + offset;
893}
894
895/**
896 * get_seg_base_limit() - obtain base address and limit of a segment
897 * @insn: Instruction. Must be valid.
898 * @regs: Register values as seen when entering kernel mode
899 * @regoff: Operand offset, in pt_regs, used to resolve segment descriptor
900 * @base: Obtained segment base
901 * @limit: Obtained segment limit
902 *
903 * Obtain the base address and limit of the segment associated with the operand
904 * @regoff and, if any or allowed, override prefixes in @insn. This function is
905 * different from insn_get_seg_base() as the latter does not resolve the segment
906 * associated with the instruction operand. If a limit is not needed (e.g.,
907 * when running in long mode), @limit can be NULL.
908 *
909 * Returns:
910 *
911 * 0 on success. @base and @limit will contain the base address and of the
912 * resolved segment, respectively.
913 *
914 * -EINVAL on error.
915 */
916static int get_seg_base_limit(struct insn *insn, struct pt_regs *regs,
917 int regoff, unsigned long *base,
918 unsigned long *limit)
919{
920 int seg_reg_idx;
921
922 if (!base)
923 return -EINVAL;
924
925 seg_reg_idx = resolve_seg_reg(insn, regs, regoff);
926 if (seg_reg_idx < 0)
927 return seg_reg_idx;
928
929 *base = insn_get_seg_base(regs, seg_reg_idx);
930 if (*base == -1L)
931 return -EINVAL;
932
933 if (!limit)
934 return 0;
935
936 *limit = get_seg_limit(regs, seg_reg_idx);
937 if (!(*limit))
938 return -EINVAL;
939
940 return 0;
941}
942
943/**
944 * get_eff_addr_reg() - Obtain effective address from register operand
945 * @insn: Instruction. Must be valid.
946 * @regs: Register values as seen when entering kernel mode
947 * @regoff: Obtained operand offset, in pt_regs, with the effective address
948 * @eff_addr: Obtained effective address
949 *
950 * Obtain the effective address stored in the register operand as indicated by
951 * the ModRM byte. This function is to be used only with register addressing
952 * (i.e., ModRM.mod is 3). The effective address is saved in @eff_addr. The
953 * register operand, as an offset from the base of pt_regs, is saved in @regoff;
954 * such offset can then be used to resolve the segment associated with the
955 * operand. This function can be used with any of the supported address sizes
956 * in x86.
957 *
958 * Returns:
959 *
960 * 0 on success. @eff_addr will have the effective address stored in the
961 * operand indicated by ModRM. @regoff will have such operand as an offset from
962 * the base of pt_regs.
963 *
964 * -EINVAL on error.
965 */
966static int get_eff_addr_reg(struct insn *insn, struct pt_regs *regs,
967 int *regoff, long *eff_addr)
968{
969 int ret;
970
971 ret = insn_get_modrm(insn);
972 if (ret)
973 return ret;
974
975 if (X86_MODRM_MOD(insn->modrm.value) != 3)
976 return -EINVAL;
977
978 *regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
979 if (*regoff < 0)
980 return -EINVAL;
981
982 /* Ignore bytes that are outside the address size. */
983 if (insn->addr_bytes == 2)
984 *eff_addr = regs_get_register(regs, *regoff) & 0xffff;
985 else if (insn->addr_bytes == 4)
986 *eff_addr = regs_get_register(regs, *regoff) & 0xffffffff;
987 else /* 64-bit address */
988 *eff_addr = regs_get_register(regs, *regoff);
989
990 return 0;
991}
992
993/**
994 * get_eff_addr_modrm() - Obtain referenced effective address via ModRM
995 * @insn: Instruction. Must be valid.
996 * @regs: Register values as seen when entering kernel mode
997 * @regoff: Obtained operand offset, in pt_regs, associated with segment
998 * @eff_addr: Obtained effective address
999 *
1000 * Obtain the effective address referenced by the ModRM byte of @insn. After
1001 * identifying the registers involved in the register-indirect memory reference,
1002 * its value is obtained from the operands in @regs. The computed address is
1003 * stored @eff_addr. Also, the register operand that indicates the associated
1004 * segment is stored in @regoff, this parameter can later be used to determine
1005 * such segment.
1006 *
1007 * Returns:
1008 *
1009 * 0 on success. @eff_addr will have the referenced effective address. @regoff
1010 * will have a register, as an offset from the base of pt_regs, that can be used
1011 * to resolve the associated segment.
1012 *
1013 * -EINVAL on error.
1014 */
1015static int get_eff_addr_modrm(struct insn *insn, struct pt_regs *regs,
1016 int *regoff, long *eff_addr)
1017{
1018 long tmp;
1019 int ret;
1020
1021 if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
1022 return -EINVAL;
1023
1024 ret = insn_get_modrm(insn);
1025 if (ret)
1026 return ret;
1027
1028 if (X86_MODRM_MOD(insn->modrm.value) > 2)
1029 return -EINVAL;
1030
1031 *regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
1032
1033 /*
1034 * -EDOM means that we must ignore the address_offset. In such a case,
1035 * in 64-bit mode the effective address relative to the rIP of the
1036 * following instruction.
1037 */
1038 if (*regoff == -EDOM) {
1039 if (any_64bit_mode(regs))
1040 tmp = regs->ip + insn->length;
1041 else
1042 tmp = 0;
1043 } else if (*regoff < 0) {
1044 return -EINVAL;
1045 } else {
1046 tmp = regs_get_register(regs, *regoff);
1047 }
1048
1049 if (insn->addr_bytes == 4) {
1050 int addr32 = (int)(tmp & 0xffffffff) + insn->displacement.value;
1051
1052 *eff_addr = addr32 & 0xffffffff;
1053 } else {
1054 *eff_addr = tmp + insn->displacement.value;
1055 }
1056
1057 return 0;
1058}
1059
1060/**
1061 * get_eff_addr_modrm_16() - Obtain referenced effective address via ModRM
1062 * @insn: Instruction. Must be valid.
1063 * @regs: Register values as seen when entering kernel mode
1064 * @regoff: Obtained operand offset, in pt_regs, associated with segment
1065 * @eff_addr: Obtained effective address
1066 *
1067 * Obtain the 16-bit effective address referenced by the ModRM byte of @insn.
1068 * After identifying the registers involved in the register-indirect memory
1069 * reference, its value is obtained from the operands in @regs. The computed
1070 * address is stored @eff_addr. Also, the register operand that indicates
1071 * the associated segment is stored in @regoff, this parameter can later be used
1072 * to determine such segment.
1073 *
1074 * Returns:
1075 *
1076 * 0 on success. @eff_addr will have the referenced effective address. @regoff
1077 * will have a register, as an offset from the base of pt_regs, that can be used
1078 * to resolve the associated segment.
1079 *
1080 * -EINVAL on error.
1081 */
1082static int get_eff_addr_modrm_16(struct insn *insn, struct pt_regs *regs,
1083 int *regoff, short *eff_addr)
1084{
1085 int addr_offset1, addr_offset2, ret;
1086 short addr1 = 0, addr2 = 0, displacement;
1087
1088 if (insn->addr_bytes != 2)
1089 return -EINVAL;
1090
1091 insn_get_modrm(insn);
1092
1093 if (!insn->modrm.nbytes)
1094 return -EINVAL;
1095
1096 if (X86_MODRM_MOD(insn->modrm.value) > 2)
1097 return -EINVAL;
1098
1099 ret = get_reg_offset_16(insn, regs, &addr_offset1, &addr_offset2);
1100 if (ret < 0)
1101 return -EINVAL;
1102
1103 /*
1104 * Don't fail on invalid offset values. They might be invalid because
1105 * they cannot be used for this particular value of ModRM. Instead, use
1106 * them in the computation only if they contain a valid value.
1107 */
1108 if (addr_offset1 != -EDOM)
1109 addr1 = regs_get_register(regs, addr_offset1) & 0xffff;
1110
1111 if (addr_offset2 != -EDOM)
1112 addr2 = regs_get_register(regs, addr_offset2) & 0xffff;
1113
1114 displacement = insn->displacement.value & 0xffff;
1115 *eff_addr = addr1 + addr2 + displacement;
1116
1117 /*
1118 * The first operand register could indicate to use of either SS or DS
1119 * registers to obtain the segment selector. The second operand
1120 * register can only indicate the use of DS. Thus, the first operand
1121 * will be used to obtain the segment selector.
1122 */
1123 *regoff = addr_offset1;
1124
1125 return 0;
1126}
1127
1128/**
1129 * get_eff_addr_sib() - Obtain referenced effective address via SIB
1130 * @insn: Instruction. Must be valid.
1131 * @regs: Register values as seen when entering kernel mode
1132 * @regoff: Obtained operand offset, in pt_regs, associated with segment
1133 * @eff_addr: Obtained effective address
1134 *
1135 * Obtain the effective address referenced by the SIB byte of @insn. After
1136 * identifying the registers involved in the indexed, register-indirect memory
1137 * reference, its value is obtained from the operands in @regs. The computed
1138 * address is stored @eff_addr. Also, the register operand that indicates the
1139 * associated segment is stored in @regoff, this parameter can later be used to
1140 * determine such segment.
1141 *
1142 * Returns:
1143 *
1144 * 0 on success. @eff_addr will have the referenced effective address.
1145 * @base_offset will have a register, as an offset from the base of pt_regs,
1146 * that can be used to resolve the associated segment.
1147 *
1148 * Negative value on error.
1149 */
1150static int get_eff_addr_sib(struct insn *insn, struct pt_regs *regs,
1151 int *base_offset, long *eff_addr)
1152{
1153 long base, indx;
1154 int indx_offset;
1155 int ret;
1156
1157 if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
1158 return -EINVAL;
1159
1160 ret = insn_get_modrm(insn);
1161 if (ret)
1162 return ret;
1163
1164 if (!insn->modrm.nbytes)
1165 return -EINVAL;
1166
1167 if (X86_MODRM_MOD(insn->modrm.value) > 2)
1168 return -EINVAL;
1169
1170 ret = insn_get_sib(insn);
1171 if (ret)
1172 return ret;
1173
1174 if (!insn->sib.nbytes)
1175 return -EINVAL;
1176
1177 *base_offset = get_reg_offset(insn, regs, REG_TYPE_BASE);
1178 indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX);
1179
1180 /*
1181 * Negative values in the base and index offset means an error when
1182 * decoding the SIB byte. Except -EDOM, which means that the registers
1183 * should not be used in the address computation.
1184 */
1185 if (*base_offset == -EDOM)
1186 base = 0;
1187 else if (*base_offset < 0)
1188 return -EINVAL;
1189 else
1190 base = regs_get_register(regs, *base_offset);
1191
1192 if (indx_offset == -EDOM)
1193 indx = 0;
1194 else if (indx_offset < 0)
1195 return -EINVAL;
1196 else
1197 indx = regs_get_register(regs, indx_offset);
1198
1199 if (insn->addr_bytes == 4) {
1200 int addr32, base32, idx32;
1201
1202 base32 = base & 0xffffffff;
1203 idx32 = indx & 0xffffffff;
1204
1205 addr32 = base32 + idx32 * (1 << X86_SIB_SCALE(insn->sib.value));
1206 addr32 += insn->displacement.value;
1207
1208 *eff_addr = addr32 & 0xffffffff;
1209 } else {
1210 *eff_addr = base + indx * (1 << X86_SIB_SCALE(insn->sib.value));
1211 *eff_addr += insn->displacement.value;
1212 }
1213
1214 return 0;
1215}
1216
1217/**
1218 * get_addr_ref_16() - Obtain the 16-bit address referred by instruction
1219 * @insn: Instruction containing ModRM byte and displacement
1220 * @regs: Register values as seen when entering kernel mode
1221 *
1222 * This function is to be used with 16-bit address encodings. Obtain the memory
1223 * address referred by the instruction's ModRM and displacement bytes. Also, the
1224 * segment used as base is determined by either any segment override prefixes in
1225 * @insn or the default segment of the registers involved in the address
1226 * computation. In protected mode, segment limits are enforced.
1227 *
1228 * Returns:
1229 *
1230 * Linear address referenced by the instruction operands on success.
1231 *
1232 * -1L on error.
1233 */
1234static void __user *get_addr_ref_16(struct insn *insn, struct pt_regs *regs)
1235{
1236 unsigned long linear_addr = -1L, seg_base, seg_limit;
1237 int ret, regoff;
1238 short eff_addr;
1239 long tmp;
1240
1241 if (insn_get_displacement(insn))
1242 goto out;
1243
1244 if (insn->addr_bytes != 2)
1245 goto out;
1246
1247 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1248 ret = get_eff_addr_reg(insn, regs, ®off, &tmp);
1249 if (ret)
1250 goto out;
1251
1252 eff_addr = tmp;
1253 } else {
1254 ret = get_eff_addr_modrm_16(insn, regs, ®off, &eff_addr);
1255 if (ret)
1256 goto out;
1257 }
1258
1259 ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
1260 if (ret)
1261 goto out;
1262
1263 /*
1264 * Before computing the linear address, make sure the effective address
1265 * is within the limits of the segment. In virtual-8086 mode, segment
1266 * limits are not enforced. In such a case, the segment limit is -1L to
1267 * reflect this fact.
1268 */
1269 if ((unsigned long)(eff_addr & 0xffff) > seg_limit)
1270 goto out;
1271
1272 linear_addr = (unsigned long)(eff_addr & 0xffff) + seg_base;
1273
1274 /* Limit linear address to 20 bits */
1275 if (v8086_mode(regs))
1276 linear_addr &= 0xfffff;
1277
1278out:
1279 return (void __user *)linear_addr;
1280}
1281
1282/**
1283 * get_addr_ref_32() - Obtain a 32-bit linear address
1284 * @insn: Instruction with ModRM, SIB bytes and displacement
1285 * @regs: Register values as seen when entering kernel mode
1286 *
1287 * This function is to be used with 32-bit address encodings to obtain the
1288 * linear memory address referred by the instruction's ModRM, SIB,
1289 * displacement bytes and segment base address, as applicable. If in protected
1290 * mode, segment limits are enforced.
1291 *
1292 * Returns:
1293 *
1294 * Linear address referenced by instruction and registers on success.
1295 *
1296 * -1L on error.
1297 */
1298static void __user *get_addr_ref_32(struct insn *insn, struct pt_regs *regs)
1299{
1300 unsigned long linear_addr = -1L, seg_base, seg_limit;
1301 int eff_addr, regoff;
1302 long tmp;
1303 int ret;
1304
1305 if (insn->addr_bytes != 4)
1306 goto out;
1307
1308 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1309 ret = get_eff_addr_reg(insn, regs, ®off, &tmp);
1310 if (ret)
1311 goto out;
1312
1313 eff_addr = tmp;
1314
1315 } else {
1316 if (insn->sib.nbytes) {
1317 ret = get_eff_addr_sib(insn, regs, ®off, &tmp);
1318 if (ret)
1319 goto out;
1320
1321 eff_addr = tmp;
1322 } else {
1323 ret = get_eff_addr_modrm(insn, regs, ®off, &tmp);
1324 if (ret)
1325 goto out;
1326
1327 eff_addr = tmp;
1328 }
1329 }
1330
1331 ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
1332 if (ret)
1333 goto out;
1334
1335 /*
1336 * In protected mode, before computing the linear address, make sure
1337 * the effective address is within the limits of the segment.
1338 * 32-bit addresses can be used in long and virtual-8086 modes if an
1339 * address override prefix is used. In such cases, segment limits are
1340 * not enforced. When in virtual-8086 mode, the segment limit is -1L
1341 * to reflect this situation.
1342 *
1343 * After computed, the effective address is treated as an unsigned
1344 * quantity.
1345 */
1346 if (!any_64bit_mode(regs) && ((unsigned int)eff_addr > seg_limit))
1347 goto out;
1348
1349 /*
1350 * Even though 32-bit address encodings are allowed in virtual-8086
1351 * mode, the address range is still limited to [0x-0xffff].
1352 */
1353 if (v8086_mode(regs) && (eff_addr & ~0xffff))
1354 goto out;
1355
1356 /*
1357 * Data type long could be 64 bits in size. Ensure that our 32-bit
1358 * effective address is not sign-extended when computing the linear
1359 * address.
1360 */
1361 linear_addr = (unsigned long)(eff_addr & 0xffffffff) + seg_base;
1362
1363 /* Limit linear address to 20 bits */
1364 if (v8086_mode(regs))
1365 linear_addr &= 0xfffff;
1366
1367out:
1368 return (void __user *)linear_addr;
1369}
1370
1371/**
1372 * get_addr_ref_64() - Obtain a 64-bit linear address
1373 * @insn: Instruction struct with ModRM and SIB bytes and displacement
1374 * @regs: Structure with register values as seen when entering kernel mode
1375 *
1376 * This function is to be used with 64-bit address encodings to obtain the
1377 * linear memory address referred by the instruction's ModRM, SIB,
1378 * displacement bytes and segment base address, as applicable.
1379 *
1380 * Returns:
1381 *
1382 * Linear address referenced by instruction and registers on success.
1383 *
1384 * -1L on error.
1385 */
1386#ifndef CONFIG_X86_64
1387static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
1388{
1389 return (void __user *)-1L;
1390}
1391#else
1392static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
1393{
1394 unsigned long linear_addr = -1L, seg_base;
1395 int regoff, ret;
1396 long eff_addr;
1397
1398 if (insn->addr_bytes != 8)
1399 goto out;
1400
1401 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1402 ret = get_eff_addr_reg(insn, regs, ®off, &eff_addr);
1403 if (ret)
1404 goto out;
1405
1406 } else {
1407 if (insn->sib.nbytes) {
1408 ret = get_eff_addr_sib(insn, regs, ®off, &eff_addr);
1409 if (ret)
1410 goto out;
1411 } else {
1412 ret = get_eff_addr_modrm(insn, regs, ®off, &eff_addr);
1413 if (ret)
1414 goto out;
1415 }
1416
1417 }
1418
1419 ret = get_seg_base_limit(insn, regs, regoff, &seg_base, NULL);
1420 if (ret)
1421 goto out;
1422
1423 linear_addr = (unsigned long)eff_addr + seg_base;
1424
1425out:
1426 return (void __user *)linear_addr;
1427}
1428#endif /* CONFIG_X86_64 */
1429
1430/**
1431 * insn_get_addr_ref() - Obtain the linear address referred by instruction
1432 * @insn: Instruction structure containing ModRM byte and displacement
1433 * @regs: Structure with register values as seen when entering kernel mode
1434 *
1435 * Obtain the linear address referred by the instruction's ModRM, SIB and
1436 * displacement bytes, and segment base, as applicable. In protected mode,
1437 * segment limits are enforced.
1438 *
1439 * Returns:
1440 *
1441 * Linear address referenced by instruction and registers on success.
1442 *
1443 * -1L on error.
1444 */
1445void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs)
1446{
1447 if (!insn || !regs)
1448 return (void __user *)-1L;
1449
1450 if (insn_get_opcode(insn))
1451 return (void __user *)-1L;
1452
1453 switch (insn->addr_bytes) {
1454 case 2:
1455 return get_addr_ref_16(insn, regs);
1456 case 4:
1457 return get_addr_ref_32(insn, regs);
1458 case 8:
1459 return get_addr_ref_64(insn, regs);
1460 default:
1461 return (void __user *)-1L;
1462 }
1463}
1464
1465int insn_get_effective_ip(struct pt_regs *regs, unsigned long *ip)
1466{
1467 unsigned long seg_base = 0;
1468
1469 /*
1470 * If not in user-space long mode, a custom code segment could be in
1471 * use. This is true in protected mode (if the process defined a local
1472 * descriptor table), or virtual-8086 mode. In most of the cases
1473 * seg_base will be zero as in USER_CS.
1474 */
1475 if (!user_64bit_mode(regs)) {
1476 seg_base = insn_get_seg_base(regs, INAT_SEG_REG_CS);
1477 if (seg_base == -1L)
1478 return -EINVAL;
1479 }
1480
1481 *ip = seg_base + regs->ip;
1482
1483 return 0;
1484}
1485
1486/**
1487 * insn_fetch_from_user() - Copy instruction bytes from user-space memory
1488 * @regs: Structure with register values as seen when entering kernel mode
1489 * @buf: Array to store the fetched instruction
1490 *
1491 * Gets the linear address of the instruction and copies the instruction bytes
1492 * to the buf.
1493 *
1494 * Returns:
1495 *
1496 * - number of instruction bytes copied.
1497 * - 0 if nothing was copied.
1498 * - -EINVAL if the linear address of the instruction could not be calculated
1499 */
1500int insn_fetch_from_user(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE])
1501{
1502 unsigned long ip;
1503 int not_copied;
1504
1505 if (insn_get_effective_ip(regs, &ip))
1506 return -EINVAL;
1507
1508 not_copied = copy_from_user(buf, (void __user *)ip, MAX_INSN_SIZE);
1509
1510 return MAX_INSN_SIZE - not_copied;
1511}
1512
1513/**
1514 * insn_fetch_from_user_inatomic() - Copy instruction bytes from user-space memory
1515 * while in atomic code
1516 * @regs: Structure with register values as seen when entering kernel mode
1517 * @buf: Array to store the fetched instruction
1518 *
1519 * Gets the linear address of the instruction and copies the instruction bytes
1520 * to the buf. This function must be used in atomic context.
1521 *
1522 * Returns:
1523 *
1524 * - number of instruction bytes copied.
1525 * - 0 if nothing was copied.
1526 * - -EINVAL if the linear address of the instruction could not be calculated.
1527 */
1528int insn_fetch_from_user_inatomic(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE])
1529{
1530 unsigned long ip;
1531 int not_copied;
1532
1533 if (insn_get_effective_ip(regs, &ip))
1534 return -EINVAL;
1535
1536 not_copied = __copy_from_user_inatomic(buf, (void __user *)ip, MAX_INSN_SIZE);
1537
1538 return MAX_INSN_SIZE - not_copied;
1539}
1540
1541/**
1542 * insn_decode_from_regs() - Decode an instruction
1543 * @insn: Structure to store decoded instruction
1544 * @regs: Structure with register values as seen when entering kernel mode
1545 * @buf: Buffer containing the instruction bytes
1546 * @buf_size: Number of instruction bytes available in buf
1547 *
1548 * Decodes the instruction provided in buf and stores the decoding results in
1549 * insn. Also determines the correct address and operand sizes.
1550 *
1551 * Returns:
1552 *
1553 * True if instruction was decoded, False otherwise.
1554 */
1555bool insn_decode_from_regs(struct insn *insn, struct pt_regs *regs,
1556 unsigned char buf[MAX_INSN_SIZE], int buf_size)
1557{
1558 int seg_defs;
1559
1560 insn_init(insn, buf, buf_size, user_64bit_mode(regs));
1561
1562 /*
1563 * Override the default operand and address sizes with what is specified
1564 * in the code segment descriptor. The instruction decoder only sets
1565 * the address size it to either 4 or 8 address bytes and does nothing
1566 * for the operand bytes. This OK for most of the cases, but we could
1567 * have special cases where, for instance, a 16-bit code segment
1568 * descriptor is used.
1569 * If there is an address override prefix, the instruction decoder
1570 * correctly updates these values, even for 16-bit defaults.
1571 */
1572 seg_defs = insn_get_code_seg_params(regs);
1573 if (seg_defs == -EINVAL)
1574 return false;
1575
1576 insn->addr_bytes = INSN_CODE_SEG_ADDR_SZ(seg_defs);
1577 insn->opnd_bytes = INSN_CODE_SEG_OPND_SZ(seg_defs);
1578
1579 if (insn_get_length(insn))
1580 return false;
1581
1582 if (buf_size < insn->length)
1583 return false;
1584
1585 return true;
1586}
1587
1588/**
1589 * insn_decode_mmio() - Decode a MMIO instruction
1590 * @insn: Structure to store decoded instruction
1591 * @bytes: Returns size of memory operand
1592 *
1593 * Decodes instruction that used for Memory-mapped I/O.
1594 *
1595 * Returns:
1596 *
1597 * Type of the instruction. Size of the memory operand is stored in
1598 * @bytes. If decode failed, INSN_MMIO_DECODE_FAILED returned.
1599 */
1600enum insn_mmio_type insn_decode_mmio(struct insn *insn, int *bytes)
1601{
1602 enum insn_mmio_type type = INSN_MMIO_DECODE_FAILED;
1603
1604 *bytes = 0;
1605
1606 if (insn_get_opcode(insn))
1607 return INSN_MMIO_DECODE_FAILED;
1608
1609 switch (insn->opcode.bytes[0]) {
1610 case 0x88: /* MOV m8,r8 */
1611 *bytes = 1;
1612 fallthrough;
1613 case 0x89: /* MOV m16/m32/m64, r16/m32/m64 */
1614 if (!*bytes)
1615 *bytes = insn->opnd_bytes;
1616 type = INSN_MMIO_WRITE;
1617 break;
1618
1619 case 0xc6: /* MOV m8, imm8 */
1620 *bytes = 1;
1621 fallthrough;
1622 case 0xc7: /* MOV m16/m32/m64, imm16/imm32/imm64 */
1623 if (!*bytes)
1624 *bytes = insn->opnd_bytes;
1625 type = INSN_MMIO_WRITE_IMM;
1626 break;
1627
1628 case 0x8a: /* MOV r8, m8 */
1629 *bytes = 1;
1630 fallthrough;
1631 case 0x8b: /* MOV r16/r32/r64, m16/m32/m64 */
1632 if (!*bytes)
1633 *bytes = insn->opnd_bytes;
1634 type = INSN_MMIO_READ;
1635 break;
1636
1637 case 0xa4: /* MOVS m8, m8 */
1638 *bytes = 1;
1639 fallthrough;
1640 case 0xa5: /* MOVS m16/m32/m64, m16/m32/m64 */
1641 if (!*bytes)
1642 *bytes = insn->opnd_bytes;
1643 type = INSN_MMIO_MOVS;
1644 break;
1645
1646 case 0x0f: /* Two-byte instruction */
1647 switch (insn->opcode.bytes[1]) {
1648 case 0xb6: /* MOVZX r16/r32/r64, m8 */
1649 *bytes = 1;
1650 fallthrough;
1651 case 0xb7: /* MOVZX r32/r64, m16 */
1652 if (!*bytes)
1653 *bytes = 2;
1654 type = INSN_MMIO_READ_ZERO_EXTEND;
1655 break;
1656
1657 case 0xbe: /* MOVSX r16/r32/r64, m8 */
1658 *bytes = 1;
1659 fallthrough;
1660 case 0xbf: /* MOVSX r32/r64, m16 */
1661 if (!*bytes)
1662 *bytes = 2;
1663 type = INSN_MMIO_READ_SIGN_EXTEND;
1664 break;
1665 }
1666 break;
1667 }
1668
1669 return type;
1670}
1/*
2 * Utility functions for x86 operand and address decoding
3 *
4 * Copyright (C) Intel Corporation 2017
5 */
6#include <linux/kernel.h>
7#include <linux/string.h>
8#include <linux/ratelimit.h>
9#include <linux/mmu_context.h>
10#include <asm/desc_defs.h>
11#include <asm/desc.h>
12#include <asm/inat.h>
13#include <asm/insn.h>
14#include <asm/insn-eval.h>
15#include <asm/ldt.h>
16#include <asm/vm86.h>
17
18#undef pr_fmt
19#define pr_fmt(fmt) "insn: " fmt
20
21enum reg_type {
22 REG_TYPE_RM = 0,
23 REG_TYPE_REG,
24 REG_TYPE_INDEX,
25 REG_TYPE_BASE,
26};
27
28/**
29 * is_string_insn() - Determine if instruction is a string instruction
30 * @insn: Instruction containing the opcode to inspect
31 *
32 * Returns:
33 *
34 * true if the instruction, determined by the opcode, is any of the
35 * string instructions as defined in the Intel Software Development manual.
36 * False otherwise.
37 */
38static bool is_string_insn(struct insn *insn)
39{
40 insn_get_opcode(insn);
41
42 /* All string instructions have a 1-byte opcode. */
43 if (insn->opcode.nbytes != 1)
44 return false;
45
46 switch (insn->opcode.bytes[0]) {
47 case 0x6c ... 0x6f: /* INS, OUTS */
48 case 0xa4 ... 0xa7: /* MOVS, CMPS */
49 case 0xaa ... 0xaf: /* STOS, LODS, SCAS */
50 return true;
51 default:
52 return false;
53 }
54}
55
56/**
57 * insn_has_rep_prefix() - Determine if instruction has a REP prefix
58 * @insn: Instruction containing the prefix to inspect
59 *
60 * Returns:
61 *
62 * true if the instruction has a REP prefix, false if not.
63 */
64bool insn_has_rep_prefix(struct insn *insn)
65{
66 insn_byte_t p;
67 int i;
68
69 insn_get_prefixes(insn);
70
71 for_each_insn_prefix(insn, i, p) {
72 if (p == 0xf2 || p == 0xf3)
73 return true;
74 }
75
76 return false;
77}
78
79/**
80 * get_seg_reg_override_idx() - obtain segment register override index
81 * @insn: Valid instruction with segment override prefixes
82 *
83 * Inspect the instruction prefixes in @insn and find segment overrides, if any.
84 *
85 * Returns:
86 *
87 * A constant identifying the segment register to use, among CS, SS, DS,
88 * ES, FS, or GS. INAT_SEG_REG_DEFAULT is returned if no segment override
89 * prefixes were found.
90 *
91 * -EINVAL in case of error.
92 */
93static int get_seg_reg_override_idx(struct insn *insn)
94{
95 int idx = INAT_SEG_REG_DEFAULT;
96 int num_overrides = 0, i;
97 insn_byte_t p;
98
99 insn_get_prefixes(insn);
100
101 /* Look for any segment override prefixes. */
102 for_each_insn_prefix(insn, i, p) {
103 insn_attr_t attr;
104
105 attr = inat_get_opcode_attribute(p);
106 switch (attr) {
107 case INAT_MAKE_PREFIX(INAT_PFX_CS):
108 idx = INAT_SEG_REG_CS;
109 num_overrides++;
110 break;
111 case INAT_MAKE_PREFIX(INAT_PFX_SS):
112 idx = INAT_SEG_REG_SS;
113 num_overrides++;
114 break;
115 case INAT_MAKE_PREFIX(INAT_PFX_DS):
116 idx = INAT_SEG_REG_DS;
117 num_overrides++;
118 break;
119 case INAT_MAKE_PREFIX(INAT_PFX_ES):
120 idx = INAT_SEG_REG_ES;
121 num_overrides++;
122 break;
123 case INAT_MAKE_PREFIX(INAT_PFX_FS):
124 idx = INAT_SEG_REG_FS;
125 num_overrides++;
126 break;
127 case INAT_MAKE_PREFIX(INAT_PFX_GS):
128 idx = INAT_SEG_REG_GS;
129 num_overrides++;
130 break;
131 /* No default action needed. */
132 }
133 }
134
135 /* More than one segment override prefix leads to undefined behavior. */
136 if (num_overrides > 1)
137 return -EINVAL;
138
139 return idx;
140}
141
142/**
143 * check_seg_overrides() - check if segment override prefixes are allowed
144 * @insn: Valid instruction with segment override prefixes
145 * @regoff: Operand offset, in pt_regs, for which the check is performed
146 *
147 * For a particular register used in register-indirect addressing, determine if
148 * segment override prefixes can be used. Specifically, no overrides are allowed
149 * for rDI if used with a string instruction.
150 *
151 * Returns:
152 *
153 * True if segment override prefixes can be used with the register indicated
154 * in @regoff. False if otherwise.
155 */
156static bool check_seg_overrides(struct insn *insn, int regoff)
157{
158 if (regoff == offsetof(struct pt_regs, di) && is_string_insn(insn))
159 return false;
160
161 return true;
162}
163
164/**
165 * resolve_default_seg() - resolve default segment register index for an operand
166 * @insn: Instruction with opcode and address size. Must be valid.
167 * @regs: Register values as seen when entering kernel mode
168 * @off: Operand offset, in pt_regs, for which resolution is needed
169 *
170 * Resolve the default segment register index associated with the instruction
171 * operand register indicated by @off. Such index is resolved based on defaults
172 * described in the Intel Software Development Manual.
173 *
174 * Returns:
175 *
176 * If in protected mode, a constant identifying the segment register to use,
177 * among CS, SS, ES or DS. If in long mode, INAT_SEG_REG_IGNORE.
178 *
179 * -EINVAL in case of error.
180 */
181static int resolve_default_seg(struct insn *insn, struct pt_regs *regs, int off)
182{
183 if (any_64bit_mode(regs))
184 return INAT_SEG_REG_IGNORE;
185 /*
186 * Resolve the default segment register as described in Section 3.7.4
187 * of the Intel Software Development Manual Vol. 1:
188 *
189 * + DS for all references involving r[ABCD]X, and rSI.
190 * + If used in a string instruction, ES for rDI. Otherwise, DS.
191 * + AX, CX and DX are not valid register operands in 16-bit address
192 * encodings but are valid for 32-bit and 64-bit encodings.
193 * + -EDOM is reserved to identify for cases in which no register
194 * is used (i.e., displacement-only addressing). Use DS.
195 * + SS for rSP or rBP.
196 * + CS for rIP.
197 */
198
199 switch (off) {
200 case offsetof(struct pt_regs, ax):
201 case offsetof(struct pt_regs, cx):
202 case offsetof(struct pt_regs, dx):
203 /* Need insn to verify address size. */
204 if (insn->addr_bytes == 2)
205 return -EINVAL;
206
207 fallthrough;
208
209 case -EDOM:
210 case offsetof(struct pt_regs, bx):
211 case offsetof(struct pt_regs, si):
212 return INAT_SEG_REG_DS;
213
214 case offsetof(struct pt_regs, di):
215 if (is_string_insn(insn))
216 return INAT_SEG_REG_ES;
217 return INAT_SEG_REG_DS;
218
219 case offsetof(struct pt_regs, bp):
220 case offsetof(struct pt_regs, sp):
221 return INAT_SEG_REG_SS;
222
223 case offsetof(struct pt_regs, ip):
224 return INAT_SEG_REG_CS;
225
226 default:
227 return -EINVAL;
228 }
229}
230
231/**
232 * resolve_seg_reg() - obtain segment register index
233 * @insn: Instruction with operands
234 * @regs: Register values as seen when entering kernel mode
235 * @regoff: Operand offset, in pt_regs, used to determine segment register
236 *
237 * Determine the segment register associated with the operands and, if
238 * applicable, prefixes and the instruction pointed by @insn.
239 *
240 * The segment register associated to an operand used in register-indirect
241 * addressing depends on:
242 *
243 * a) Whether running in long mode (in such a case segments are ignored, except
244 * if FS or GS are used).
245 *
246 * b) Whether segment override prefixes can be used. Certain instructions and
247 * registers do not allow override prefixes.
248 *
249 * c) Whether segment overrides prefixes are found in the instruction prefixes.
250 *
251 * d) If there are not segment override prefixes or they cannot be used, the
252 * default segment register associated with the operand register is used.
253 *
254 * The function checks first if segment override prefixes can be used with the
255 * operand indicated by @regoff. If allowed, obtain such overridden segment
256 * register index. Lastly, if not prefixes were found or cannot be used, resolve
257 * the segment register index to use based on the defaults described in the
258 * Intel documentation. In long mode, all segment register indexes will be
259 * ignored, except if overrides were found for FS or GS. All these operations
260 * are done using helper functions.
261 *
262 * The operand register, @regoff, is represented as the offset from the base of
263 * pt_regs.
264 *
265 * As stated, the main use of this function is to determine the segment register
266 * index based on the instruction, its operands and prefixes. Hence, @insn
267 * must be valid. However, if @regoff indicates rIP, we don't need to inspect
268 * @insn at all as in this case CS is used in all cases. This case is checked
269 * before proceeding further.
270 *
271 * Please note that this function does not return the value in the segment
272 * register (i.e., the segment selector) but our defined index. The segment
273 * selector needs to be obtained using get_segment_selector() and passing the
274 * segment register index resolved by this function.
275 *
276 * Returns:
277 *
278 * An index identifying the segment register to use, among CS, SS, DS,
279 * ES, FS, or GS. INAT_SEG_REG_IGNORE is returned if running in long mode.
280 *
281 * -EINVAL in case of error.
282 */
283static int resolve_seg_reg(struct insn *insn, struct pt_regs *regs, int regoff)
284{
285 int idx;
286
287 /*
288 * In the unlikely event of having to resolve the segment register
289 * index for rIP, do it first. Segment override prefixes should not
290 * be used. Hence, it is not necessary to inspect the instruction,
291 * which may be invalid at this point.
292 */
293 if (regoff == offsetof(struct pt_regs, ip)) {
294 if (any_64bit_mode(regs))
295 return INAT_SEG_REG_IGNORE;
296 else
297 return INAT_SEG_REG_CS;
298 }
299
300 if (!insn)
301 return -EINVAL;
302
303 if (!check_seg_overrides(insn, regoff))
304 return resolve_default_seg(insn, regs, regoff);
305
306 idx = get_seg_reg_override_idx(insn);
307 if (idx < 0)
308 return idx;
309
310 if (idx == INAT_SEG_REG_DEFAULT)
311 return resolve_default_seg(insn, regs, regoff);
312
313 /*
314 * In long mode, segment override prefixes are ignored, except for
315 * overrides for FS and GS.
316 */
317 if (any_64bit_mode(regs)) {
318 if (idx != INAT_SEG_REG_FS &&
319 idx != INAT_SEG_REG_GS)
320 idx = INAT_SEG_REG_IGNORE;
321 }
322
323 return idx;
324}
325
326/**
327 * get_segment_selector() - obtain segment selector
328 * @regs: Register values as seen when entering kernel mode
329 * @seg_reg_idx: Segment register index to use
330 *
331 * Obtain the segment selector from any of the CS, SS, DS, ES, FS, GS segment
332 * registers. In CONFIG_X86_32, the segment is obtained from either pt_regs or
333 * kernel_vm86_regs as applicable. In CONFIG_X86_64, CS and SS are obtained
334 * from pt_regs. DS, ES, FS and GS are obtained by reading the actual CPU
335 * registers. This done for only for completeness as in CONFIG_X86_64 segment
336 * registers are ignored.
337 *
338 * Returns:
339 *
340 * Value of the segment selector, including null when running in
341 * long mode.
342 *
343 * -EINVAL on error.
344 */
345static short get_segment_selector(struct pt_regs *regs, int seg_reg_idx)
346{
347#ifdef CONFIG_X86_64
348 unsigned short sel;
349
350 switch (seg_reg_idx) {
351 case INAT_SEG_REG_IGNORE:
352 return 0;
353 case INAT_SEG_REG_CS:
354 return (unsigned short)(regs->cs & 0xffff);
355 case INAT_SEG_REG_SS:
356 return (unsigned short)(regs->ss & 0xffff);
357 case INAT_SEG_REG_DS:
358 savesegment(ds, sel);
359 return sel;
360 case INAT_SEG_REG_ES:
361 savesegment(es, sel);
362 return sel;
363 case INAT_SEG_REG_FS:
364 savesegment(fs, sel);
365 return sel;
366 case INAT_SEG_REG_GS:
367 savesegment(gs, sel);
368 return sel;
369 default:
370 return -EINVAL;
371 }
372#else /* CONFIG_X86_32 */
373 struct kernel_vm86_regs *vm86regs = (struct kernel_vm86_regs *)regs;
374
375 if (v8086_mode(regs)) {
376 switch (seg_reg_idx) {
377 case INAT_SEG_REG_CS:
378 return (unsigned short)(regs->cs & 0xffff);
379 case INAT_SEG_REG_SS:
380 return (unsigned short)(regs->ss & 0xffff);
381 case INAT_SEG_REG_DS:
382 return vm86regs->ds;
383 case INAT_SEG_REG_ES:
384 return vm86regs->es;
385 case INAT_SEG_REG_FS:
386 return vm86regs->fs;
387 case INAT_SEG_REG_GS:
388 return vm86regs->gs;
389 case INAT_SEG_REG_IGNORE:
390 default:
391 return -EINVAL;
392 }
393 }
394
395 switch (seg_reg_idx) {
396 case INAT_SEG_REG_CS:
397 return (unsigned short)(regs->cs & 0xffff);
398 case INAT_SEG_REG_SS:
399 return (unsigned short)(regs->ss & 0xffff);
400 case INAT_SEG_REG_DS:
401 return (unsigned short)(regs->ds & 0xffff);
402 case INAT_SEG_REG_ES:
403 return (unsigned short)(regs->es & 0xffff);
404 case INAT_SEG_REG_FS:
405 return (unsigned short)(regs->fs & 0xffff);
406 case INAT_SEG_REG_GS:
407 return get_user_gs(regs);
408 case INAT_SEG_REG_IGNORE:
409 default:
410 return -EINVAL;
411 }
412#endif /* CONFIG_X86_64 */
413}
414
415static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
416 enum reg_type type)
417{
418 int regno = 0;
419
420 static const int regoff[] = {
421 offsetof(struct pt_regs, ax),
422 offsetof(struct pt_regs, cx),
423 offsetof(struct pt_regs, dx),
424 offsetof(struct pt_regs, bx),
425 offsetof(struct pt_regs, sp),
426 offsetof(struct pt_regs, bp),
427 offsetof(struct pt_regs, si),
428 offsetof(struct pt_regs, di),
429#ifdef CONFIG_X86_64
430 offsetof(struct pt_regs, r8),
431 offsetof(struct pt_regs, r9),
432 offsetof(struct pt_regs, r10),
433 offsetof(struct pt_regs, r11),
434 offsetof(struct pt_regs, r12),
435 offsetof(struct pt_regs, r13),
436 offsetof(struct pt_regs, r14),
437 offsetof(struct pt_regs, r15),
438#endif
439 };
440 int nr_registers = ARRAY_SIZE(regoff);
441 /*
442 * Don't possibly decode a 32-bit instructions as
443 * reading a 64-bit-only register.
444 */
445 if (IS_ENABLED(CONFIG_X86_64) && !insn->x86_64)
446 nr_registers -= 8;
447
448 switch (type) {
449 case REG_TYPE_RM:
450 regno = X86_MODRM_RM(insn->modrm.value);
451
452 /*
453 * ModRM.mod == 0 and ModRM.rm == 5 means a 32-bit displacement
454 * follows the ModRM byte.
455 */
456 if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
457 return -EDOM;
458
459 if (X86_REX_B(insn->rex_prefix.value))
460 regno += 8;
461 break;
462
463 case REG_TYPE_REG:
464 regno = X86_MODRM_REG(insn->modrm.value);
465
466 if (X86_REX_R(insn->rex_prefix.value))
467 regno += 8;
468 break;
469
470 case REG_TYPE_INDEX:
471 regno = X86_SIB_INDEX(insn->sib.value);
472 if (X86_REX_X(insn->rex_prefix.value))
473 regno += 8;
474
475 /*
476 * If ModRM.mod != 3 and SIB.index = 4 the scale*index
477 * portion of the address computation is null. This is
478 * true only if REX.X is 0. In such a case, the SIB index
479 * is used in the address computation.
480 */
481 if (X86_MODRM_MOD(insn->modrm.value) != 3 && regno == 4)
482 return -EDOM;
483 break;
484
485 case REG_TYPE_BASE:
486 regno = X86_SIB_BASE(insn->sib.value);
487 /*
488 * If ModRM.mod is 0 and SIB.base == 5, the base of the
489 * register-indirect addressing is 0. In this case, a
490 * 32-bit displacement follows the SIB byte.
491 */
492 if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
493 return -EDOM;
494
495 if (X86_REX_B(insn->rex_prefix.value))
496 regno += 8;
497 break;
498
499 default:
500 pr_err_ratelimited("invalid register type: %d\n", type);
501 return -EINVAL;
502 }
503
504 if (regno >= nr_registers) {
505 WARN_ONCE(1, "decoded an instruction with an invalid register");
506 return -EINVAL;
507 }
508 return regoff[regno];
509}
510
511/**
512 * get_reg_offset_16() - Obtain offset of register indicated by instruction
513 * @insn: Instruction containing ModRM byte
514 * @regs: Register values as seen when entering kernel mode
515 * @offs1: Offset of the first operand register
516 * @offs2: Offset of the second operand register, if applicable
517 *
518 * Obtain the offset, in pt_regs, of the registers indicated by the ModRM byte
519 * in @insn. This function is to be used with 16-bit address encodings. The
520 * @offs1 and @offs2 will be written with the offset of the two registers
521 * indicated by the instruction. In cases where any of the registers is not
522 * referenced by the instruction, the value will be set to -EDOM.
523 *
524 * Returns:
525 *
526 * 0 on success, -EINVAL on error.
527 */
528static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs,
529 int *offs1, int *offs2)
530{
531 /*
532 * 16-bit addressing can use one or two registers. Specifics of
533 * encodings are given in Table 2-1. "16-Bit Addressing Forms with the
534 * ModR/M Byte" of the Intel Software Development Manual.
535 */
536 static const int regoff1[] = {
537 offsetof(struct pt_regs, bx),
538 offsetof(struct pt_regs, bx),
539 offsetof(struct pt_regs, bp),
540 offsetof(struct pt_regs, bp),
541 offsetof(struct pt_regs, si),
542 offsetof(struct pt_regs, di),
543 offsetof(struct pt_regs, bp),
544 offsetof(struct pt_regs, bx),
545 };
546
547 static const int regoff2[] = {
548 offsetof(struct pt_regs, si),
549 offsetof(struct pt_regs, di),
550 offsetof(struct pt_regs, si),
551 offsetof(struct pt_regs, di),
552 -EDOM,
553 -EDOM,
554 -EDOM,
555 -EDOM,
556 };
557
558 if (!offs1 || !offs2)
559 return -EINVAL;
560
561 /* Operand is a register, use the generic function. */
562 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
563 *offs1 = insn_get_modrm_rm_off(insn, regs);
564 *offs2 = -EDOM;
565 return 0;
566 }
567
568 *offs1 = regoff1[X86_MODRM_RM(insn->modrm.value)];
569 *offs2 = regoff2[X86_MODRM_RM(insn->modrm.value)];
570
571 /*
572 * If ModRM.mod is 0 and ModRM.rm is 110b, then we use displacement-
573 * only addressing. This means that no registers are involved in
574 * computing the effective address. Thus, ensure that the first
575 * register offset is invalid. The second register offset is already
576 * invalid under the aforementioned conditions.
577 */
578 if ((X86_MODRM_MOD(insn->modrm.value) == 0) &&
579 (X86_MODRM_RM(insn->modrm.value) == 6))
580 *offs1 = -EDOM;
581
582 return 0;
583}
584
585/**
586 * get_desc() - Obtain contents of a segment descriptor
587 * @out: Segment descriptor contents on success
588 * @sel: Segment selector
589 *
590 * Given a segment selector, obtain a pointer to the segment descriptor.
591 * Both global and local descriptor tables are supported.
592 *
593 * Returns:
594 *
595 * True on success, false on failure.
596 *
597 * NULL on error.
598 */
599static bool get_desc(struct desc_struct *out, unsigned short sel)
600{
601 struct desc_ptr gdt_desc = {0, 0};
602 unsigned long desc_base;
603
604#ifdef CONFIG_MODIFY_LDT_SYSCALL
605 if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) {
606 bool success = false;
607 struct ldt_struct *ldt;
608
609 /* Bits [15:3] contain the index of the desired entry. */
610 sel >>= 3;
611
612 mutex_lock(¤t->active_mm->context.lock);
613 ldt = current->active_mm->context.ldt;
614 if (ldt && sel < ldt->nr_entries) {
615 *out = ldt->entries[sel];
616 success = true;
617 }
618
619 mutex_unlock(¤t->active_mm->context.lock);
620
621 return success;
622 }
623#endif
624 native_store_gdt(&gdt_desc);
625
626 /*
627 * Segment descriptors have a size of 8 bytes. Thus, the index is
628 * multiplied by 8 to obtain the memory offset of the desired descriptor
629 * from the base of the GDT. As bits [15:3] of the segment selector
630 * contain the index, it can be regarded as multiplied by 8 already.
631 * All that remains is to clear bits [2:0].
632 */
633 desc_base = sel & ~(SEGMENT_RPL_MASK | SEGMENT_TI_MASK);
634
635 if (desc_base > gdt_desc.size)
636 return false;
637
638 *out = *(struct desc_struct *)(gdt_desc.address + desc_base);
639 return true;
640}
641
642/**
643 * insn_get_seg_base() - Obtain base address of segment descriptor.
644 * @regs: Register values as seen when entering kernel mode
645 * @seg_reg_idx: Index of the segment register pointing to seg descriptor
646 *
647 * Obtain the base address of the segment as indicated by the segment descriptor
648 * pointed by the segment selector. The segment selector is obtained from the
649 * input segment register index @seg_reg_idx.
650 *
651 * Returns:
652 *
653 * In protected mode, base address of the segment. Zero in long mode,
654 * except when FS or GS are used. In virtual-8086 mode, the segment
655 * selector shifted 4 bits to the right.
656 *
657 * -1L in case of error.
658 */
659unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx)
660{
661 struct desc_struct desc;
662 short sel;
663
664 sel = get_segment_selector(regs, seg_reg_idx);
665 if (sel < 0)
666 return -1L;
667
668 if (v8086_mode(regs))
669 /*
670 * Base is simply the segment selector shifted 4
671 * bits to the right.
672 */
673 return (unsigned long)(sel << 4);
674
675 if (any_64bit_mode(regs)) {
676 /*
677 * Only FS or GS will have a base address, the rest of
678 * the segments' bases are forced to 0.
679 */
680 unsigned long base;
681
682 if (seg_reg_idx == INAT_SEG_REG_FS) {
683 rdmsrl(MSR_FS_BASE, base);
684 } else if (seg_reg_idx == INAT_SEG_REG_GS) {
685 /*
686 * swapgs was called at the kernel entry point. Thus,
687 * MSR_KERNEL_GS_BASE will have the user-space GS base.
688 */
689 if (user_mode(regs))
690 rdmsrl(MSR_KERNEL_GS_BASE, base);
691 else
692 rdmsrl(MSR_GS_BASE, base);
693 } else {
694 base = 0;
695 }
696 return base;
697 }
698
699 /* In protected mode the segment selector cannot be null. */
700 if (!sel)
701 return -1L;
702
703 if (!get_desc(&desc, sel))
704 return -1L;
705
706 return get_desc_base(&desc);
707}
708
709/**
710 * get_seg_limit() - Obtain the limit of a segment descriptor
711 * @regs: Register values as seen when entering kernel mode
712 * @seg_reg_idx: Index of the segment register pointing to seg descriptor
713 *
714 * Obtain the limit of the segment as indicated by the segment descriptor
715 * pointed by the segment selector. The segment selector is obtained from the
716 * input segment register index @seg_reg_idx.
717 *
718 * Returns:
719 *
720 * In protected mode, the limit of the segment descriptor in bytes.
721 * In long mode and virtual-8086 mode, segment limits are not enforced. Thus,
722 * limit is returned as -1L to imply a limit-less segment.
723 *
724 * Zero is returned on error.
725 */
726static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)
727{
728 struct desc_struct desc;
729 unsigned long limit;
730 short sel;
731
732 sel = get_segment_selector(regs, seg_reg_idx);
733 if (sel < 0)
734 return 0;
735
736 if (any_64bit_mode(regs) || v8086_mode(regs))
737 return -1L;
738
739 if (!sel)
740 return 0;
741
742 if (!get_desc(&desc, sel))
743 return 0;
744
745 /*
746 * If the granularity bit is set, the limit is given in multiples
747 * of 4096. This also means that the 12 least significant bits are
748 * not tested when checking the segment limits. In practice,
749 * this means that the segment ends in (limit << 12) + 0xfff.
750 */
751 limit = get_desc_limit(&desc);
752 if (desc.g)
753 limit = (limit << 12) + 0xfff;
754
755 return limit;
756}
757
758/**
759 * insn_get_code_seg_params() - Obtain code segment parameters
760 * @regs: Structure with register values as seen when entering kernel mode
761 *
762 * Obtain address and operand sizes of the code segment. It is obtained from the
763 * selector contained in the CS register in regs. In protected mode, the default
764 * address is determined by inspecting the L and D bits of the segment
765 * descriptor. In virtual-8086 mode, the default is always two bytes for both
766 * address and operand sizes.
767 *
768 * Returns:
769 *
770 * An int containing ORed-in default parameters on success.
771 *
772 * -EINVAL on error.
773 */
774int insn_get_code_seg_params(struct pt_regs *regs)
775{
776 struct desc_struct desc;
777 short sel;
778
779 if (v8086_mode(regs))
780 /* Address and operand size are both 16-bit. */
781 return INSN_CODE_SEG_PARAMS(2, 2);
782
783 sel = get_segment_selector(regs, INAT_SEG_REG_CS);
784 if (sel < 0)
785 return sel;
786
787 if (!get_desc(&desc, sel))
788 return -EINVAL;
789
790 /*
791 * The most significant byte of the Type field of the segment descriptor
792 * determines whether a segment contains data or code. If this is a data
793 * segment, return error.
794 */
795 if (!(desc.type & BIT(3)))
796 return -EINVAL;
797
798 switch ((desc.l << 1) | desc.d) {
799 case 0: /*
800 * Legacy mode. CS.L=0, CS.D=0. Address and operand size are
801 * both 16-bit.
802 */
803 return INSN_CODE_SEG_PARAMS(2, 2);
804 case 1: /*
805 * Legacy mode. CS.L=0, CS.D=1. Address and operand size are
806 * both 32-bit.
807 */
808 return INSN_CODE_SEG_PARAMS(4, 4);
809 case 2: /*
810 * IA-32e 64-bit mode. CS.L=1, CS.D=0. Address size is 64-bit;
811 * operand size is 32-bit.
812 */
813 return INSN_CODE_SEG_PARAMS(4, 8);
814 case 3: /* Invalid setting. CS.L=1, CS.D=1 */
815 fallthrough;
816 default:
817 return -EINVAL;
818 }
819}
820
821/**
822 * insn_get_modrm_rm_off() - Obtain register in r/m part of the ModRM byte
823 * @insn: Instruction containing the ModRM byte
824 * @regs: Register values as seen when entering kernel mode
825 *
826 * Returns:
827 *
828 * The register indicated by the r/m part of the ModRM byte. The
829 * register is obtained as an offset from the base of pt_regs. In specific
830 * cases, the returned value can be -EDOM to indicate that the particular value
831 * of ModRM does not refer to a register and shall be ignored.
832 */
833int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs)
834{
835 return get_reg_offset(insn, regs, REG_TYPE_RM);
836}
837
838/**
839 * insn_get_modrm_reg_off() - Obtain register in reg part of the ModRM byte
840 * @insn: Instruction containing the ModRM byte
841 * @regs: Register values as seen when entering kernel mode
842 *
843 * Returns:
844 *
845 * The register indicated by the reg part of the ModRM byte. The
846 * register is obtained as an offset from the base of pt_regs.
847 */
848int insn_get_modrm_reg_off(struct insn *insn, struct pt_regs *regs)
849{
850 return get_reg_offset(insn, regs, REG_TYPE_REG);
851}
852
853/**
854 * get_seg_base_limit() - obtain base address and limit of a segment
855 * @insn: Instruction. Must be valid.
856 * @regs: Register values as seen when entering kernel mode
857 * @regoff: Operand offset, in pt_regs, used to resolve segment descriptor
858 * @base: Obtained segment base
859 * @limit: Obtained segment limit
860 *
861 * Obtain the base address and limit of the segment associated with the operand
862 * @regoff and, if any or allowed, override prefixes in @insn. This function is
863 * different from insn_get_seg_base() as the latter does not resolve the segment
864 * associated with the instruction operand. If a limit is not needed (e.g.,
865 * when running in long mode), @limit can be NULL.
866 *
867 * Returns:
868 *
869 * 0 on success. @base and @limit will contain the base address and of the
870 * resolved segment, respectively.
871 *
872 * -EINVAL on error.
873 */
874static int get_seg_base_limit(struct insn *insn, struct pt_regs *regs,
875 int regoff, unsigned long *base,
876 unsigned long *limit)
877{
878 int seg_reg_idx;
879
880 if (!base)
881 return -EINVAL;
882
883 seg_reg_idx = resolve_seg_reg(insn, regs, regoff);
884 if (seg_reg_idx < 0)
885 return seg_reg_idx;
886
887 *base = insn_get_seg_base(regs, seg_reg_idx);
888 if (*base == -1L)
889 return -EINVAL;
890
891 if (!limit)
892 return 0;
893
894 *limit = get_seg_limit(regs, seg_reg_idx);
895 if (!(*limit))
896 return -EINVAL;
897
898 return 0;
899}
900
901/**
902 * get_eff_addr_reg() - Obtain effective address from register operand
903 * @insn: Instruction. Must be valid.
904 * @regs: Register values as seen when entering kernel mode
905 * @regoff: Obtained operand offset, in pt_regs, with the effective address
906 * @eff_addr: Obtained effective address
907 *
908 * Obtain the effective address stored in the register operand as indicated by
909 * the ModRM byte. This function is to be used only with register addressing
910 * (i.e., ModRM.mod is 3). The effective address is saved in @eff_addr. The
911 * register operand, as an offset from the base of pt_regs, is saved in @regoff;
912 * such offset can then be used to resolve the segment associated with the
913 * operand. This function can be used with any of the supported address sizes
914 * in x86.
915 *
916 * Returns:
917 *
918 * 0 on success. @eff_addr will have the effective address stored in the
919 * operand indicated by ModRM. @regoff will have such operand as an offset from
920 * the base of pt_regs.
921 *
922 * -EINVAL on error.
923 */
924static int get_eff_addr_reg(struct insn *insn, struct pt_regs *regs,
925 int *regoff, long *eff_addr)
926{
927 int ret;
928
929 ret = insn_get_modrm(insn);
930 if (ret)
931 return ret;
932
933 if (X86_MODRM_MOD(insn->modrm.value) != 3)
934 return -EINVAL;
935
936 *regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
937 if (*regoff < 0)
938 return -EINVAL;
939
940 /* Ignore bytes that are outside the address size. */
941 if (insn->addr_bytes == 2)
942 *eff_addr = regs_get_register(regs, *regoff) & 0xffff;
943 else if (insn->addr_bytes == 4)
944 *eff_addr = regs_get_register(regs, *regoff) & 0xffffffff;
945 else /* 64-bit address */
946 *eff_addr = regs_get_register(regs, *regoff);
947
948 return 0;
949}
950
951/**
952 * get_eff_addr_modrm() - Obtain referenced effective address via ModRM
953 * @insn: Instruction. Must be valid.
954 * @regs: Register values as seen when entering kernel mode
955 * @regoff: Obtained operand offset, in pt_regs, associated with segment
956 * @eff_addr: Obtained effective address
957 *
958 * Obtain the effective address referenced by the ModRM byte of @insn. After
959 * identifying the registers involved in the register-indirect memory reference,
960 * its value is obtained from the operands in @regs. The computed address is
961 * stored @eff_addr. Also, the register operand that indicates the associated
962 * segment is stored in @regoff, this parameter can later be used to determine
963 * such segment.
964 *
965 * Returns:
966 *
967 * 0 on success. @eff_addr will have the referenced effective address. @regoff
968 * will have a register, as an offset from the base of pt_regs, that can be used
969 * to resolve the associated segment.
970 *
971 * -EINVAL on error.
972 */
973static int get_eff_addr_modrm(struct insn *insn, struct pt_regs *regs,
974 int *regoff, long *eff_addr)
975{
976 long tmp;
977 int ret;
978
979 if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
980 return -EINVAL;
981
982 ret = insn_get_modrm(insn);
983 if (ret)
984 return ret;
985
986 if (X86_MODRM_MOD(insn->modrm.value) > 2)
987 return -EINVAL;
988
989 *regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
990
991 /*
992 * -EDOM means that we must ignore the address_offset. In such a case,
993 * in 64-bit mode the effective address relative to the rIP of the
994 * following instruction.
995 */
996 if (*regoff == -EDOM) {
997 if (any_64bit_mode(regs))
998 tmp = regs->ip + insn->length;
999 else
1000 tmp = 0;
1001 } else if (*regoff < 0) {
1002 return -EINVAL;
1003 } else {
1004 tmp = regs_get_register(regs, *regoff);
1005 }
1006
1007 if (insn->addr_bytes == 4) {
1008 int addr32 = (int)(tmp & 0xffffffff) + insn->displacement.value;
1009
1010 *eff_addr = addr32 & 0xffffffff;
1011 } else {
1012 *eff_addr = tmp + insn->displacement.value;
1013 }
1014
1015 return 0;
1016}
1017
1018/**
1019 * get_eff_addr_modrm_16() - Obtain referenced effective address via ModRM
1020 * @insn: Instruction. Must be valid.
1021 * @regs: Register values as seen when entering kernel mode
1022 * @regoff: Obtained operand offset, in pt_regs, associated with segment
1023 * @eff_addr: Obtained effective address
1024 *
1025 * Obtain the 16-bit effective address referenced by the ModRM byte of @insn.
1026 * After identifying the registers involved in the register-indirect memory
1027 * reference, its value is obtained from the operands in @regs. The computed
1028 * address is stored @eff_addr. Also, the register operand that indicates
1029 * the associated segment is stored in @regoff, this parameter can later be used
1030 * to determine such segment.
1031 *
1032 * Returns:
1033 *
1034 * 0 on success. @eff_addr will have the referenced effective address. @regoff
1035 * will have a register, as an offset from the base of pt_regs, that can be used
1036 * to resolve the associated segment.
1037 *
1038 * -EINVAL on error.
1039 */
1040static int get_eff_addr_modrm_16(struct insn *insn, struct pt_regs *regs,
1041 int *regoff, short *eff_addr)
1042{
1043 int addr_offset1, addr_offset2, ret;
1044 short addr1 = 0, addr2 = 0, displacement;
1045
1046 if (insn->addr_bytes != 2)
1047 return -EINVAL;
1048
1049 insn_get_modrm(insn);
1050
1051 if (!insn->modrm.nbytes)
1052 return -EINVAL;
1053
1054 if (X86_MODRM_MOD(insn->modrm.value) > 2)
1055 return -EINVAL;
1056
1057 ret = get_reg_offset_16(insn, regs, &addr_offset1, &addr_offset2);
1058 if (ret < 0)
1059 return -EINVAL;
1060
1061 /*
1062 * Don't fail on invalid offset values. They might be invalid because
1063 * they cannot be used for this particular value of ModRM. Instead, use
1064 * them in the computation only if they contain a valid value.
1065 */
1066 if (addr_offset1 != -EDOM)
1067 addr1 = regs_get_register(regs, addr_offset1) & 0xffff;
1068
1069 if (addr_offset2 != -EDOM)
1070 addr2 = regs_get_register(regs, addr_offset2) & 0xffff;
1071
1072 displacement = insn->displacement.value & 0xffff;
1073 *eff_addr = addr1 + addr2 + displacement;
1074
1075 /*
1076 * The first operand register could indicate to use of either SS or DS
1077 * registers to obtain the segment selector. The second operand
1078 * register can only indicate the use of DS. Thus, the first operand
1079 * will be used to obtain the segment selector.
1080 */
1081 *regoff = addr_offset1;
1082
1083 return 0;
1084}
1085
1086/**
1087 * get_eff_addr_sib() - Obtain referenced effective address via SIB
1088 * @insn: Instruction. Must be valid.
1089 * @regs: Register values as seen when entering kernel mode
1090 * @regoff: Obtained operand offset, in pt_regs, associated with segment
1091 * @eff_addr: Obtained effective address
1092 *
1093 * Obtain the effective address referenced by the SIB byte of @insn. After
1094 * identifying the registers involved in the indexed, register-indirect memory
1095 * reference, its value is obtained from the operands in @regs. The computed
1096 * address is stored @eff_addr. Also, the register operand that indicates the
1097 * associated segment is stored in @regoff, this parameter can later be used to
1098 * determine such segment.
1099 *
1100 * Returns:
1101 *
1102 * 0 on success. @eff_addr will have the referenced effective address.
1103 * @base_offset will have a register, as an offset from the base of pt_regs,
1104 * that can be used to resolve the associated segment.
1105 *
1106 * Negative value on error.
1107 */
1108static int get_eff_addr_sib(struct insn *insn, struct pt_regs *regs,
1109 int *base_offset, long *eff_addr)
1110{
1111 long base, indx;
1112 int indx_offset;
1113 int ret;
1114
1115 if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
1116 return -EINVAL;
1117
1118 ret = insn_get_modrm(insn);
1119 if (ret)
1120 return ret;
1121
1122 if (!insn->modrm.nbytes)
1123 return -EINVAL;
1124
1125 if (X86_MODRM_MOD(insn->modrm.value) > 2)
1126 return -EINVAL;
1127
1128 ret = insn_get_sib(insn);
1129 if (ret)
1130 return ret;
1131
1132 if (!insn->sib.nbytes)
1133 return -EINVAL;
1134
1135 *base_offset = get_reg_offset(insn, regs, REG_TYPE_BASE);
1136 indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX);
1137
1138 /*
1139 * Negative values in the base and index offset means an error when
1140 * decoding the SIB byte. Except -EDOM, which means that the registers
1141 * should not be used in the address computation.
1142 */
1143 if (*base_offset == -EDOM)
1144 base = 0;
1145 else if (*base_offset < 0)
1146 return -EINVAL;
1147 else
1148 base = regs_get_register(regs, *base_offset);
1149
1150 if (indx_offset == -EDOM)
1151 indx = 0;
1152 else if (indx_offset < 0)
1153 return -EINVAL;
1154 else
1155 indx = regs_get_register(regs, indx_offset);
1156
1157 if (insn->addr_bytes == 4) {
1158 int addr32, base32, idx32;
1159
1160 base32 = base & 0xffffffff;
1161 idx32 = indx & 0xffffffff;
1162
1163 addr32 = base32 + idx32 * (1 << X86_SIB_SCALE(insn->sib.value));
1164 addr32 += insn->displacement.value;
1165
1166 *eff_addr = addr32 & 0xffffffff;
1167 } else {
1168 *eff_addr = base + indx * (1 << X86_SIB_SCALE(insn->sib.value));
1169 *eff_addr += insn->displacement.value;
1170 }
1171
1172 return 0;
1173}
1174
1175/**
1176 * get_addr_ref_16() - Obtain the 16-bit address referred by instruction
1177 * @insn: Instruction containing ModRM byte and displacement
1178 * @regs: Register values as seen when entering kernel mode
1179 *
1180 * This function is to be used with 16-bit address encodings. Obtain the memory
1181 * address referred by the instruction's ModRM and displacement bytes. Also, the
1182 * segment used as base is determined by either any segment override prefixes in
1183 * @insn or the default segment of the registers involved in the address
1184 * computation. In protected mode, segment limits are enforced.
1185 *
1186 * Returns:
1187 *
1188 * Linear address referenced by the instruction operands on success.
1189 *
1190 * -1L on error.
1191 */
1192static void __user *get_addr_ref_16(struct insn *insn, struct pt_regs *regs)
1193{
1194 unsigned long linear_addr = -1L, seg_base, seg_limit;
1195 int ret, regoff;
1196 short eff_addr;
1197 long tmp;
1198
1199 if (insn_get_displacement(insn))
1200 goto out;
1201
1202 if (insn->addr_bytes != 2)
1203 goto out;
1204
1205 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1206 ret = get_eff_addr_reg(insn, regs, ®off, &tmp);
1207 if (ret)
1208 goto out;
1209
1210 eff_addr = tmp;
1211 } else {
1212 ret = get_eff_addr_modrm_16(insn, regs, ®off, &eff_addr);
1213 if (ret)
1214 goto out;
1215 }
1216
1217 ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
1218 if (ret)
1219 goto out;
1220
1221 /*
1222 * Before computing the linear address, make sure the effective address
1223 * is within the limits of the segment. In virtual-8086 mode, segment
1224 * limits are not enforced. In such a case, the segment limit is -1L to
1225 * reflect this fact.
1226 */
1227 if ((unsigned long)(eff_addr & 0xffff) > seg_limit)
1228 goto out;
1229
1230 linear_addr = (unsigned long)(eff_addr & 0xffff) + seg_base;
1231
1232 /* Limit linear address to 20 bits */
1233 if (v8086_mode(regs))
1234 linear_addr &= 0xfffff;
1235
1236out:
1237 return (void __user *)linear_addr;
1238}
1239
1240/**
1241 * get_addr_ref_32() - Obtain a 32-bit linear address
1242 * @insn: Instruction with ModRM, SIB bytes and displacement
1243 * @regs: Register values as seen when entering kernel mode
1244 *
1245 * This function is to be used with 32-bit address encodings to obtain the
1246 * linear memory address referred by the instruction's ModRM, SIB,
1247 * displacement bytes and segment base address, as applicable. If in protected
1248 * mode, segment limits are enforced.
1249 *
1250 * Returns:
1251 *
1252 * Linear address referenced by instruction and registers on success.
1253 *
1254 * -1L on error.
1255 */
1256static void __user *get_addr_ref_32(struct insn *insn, struct pt_regs *regs)
1257{
1258 unsigned long linear_addr = -1L, seg_base, seg_limit;
1259 int eff_addr, regoff;
1260 long tmp;
1261 int ret;
1262
1263 if (insn->addr_bytes != 4)
1264 goto out;
1265
1266 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1267 ret = get_eff_addr_reg(insn, regs, ®off, &tmp);
1268 if (ret)
1269 goto out;
1270
1271 eff_addr = tmp;
1272
1273 } else {
1274 if (insn->sib.nbytes) {
1275 ret = get_eff_addr_sib(insn, regs, ®off, &tmp);
1276 if (ret)
1277 goto out;
1278
1279 eff_addr = tmp;
1280 } else {
1281 ret = get_eff_addr_modrm(insn, regs, ®off, &tmp);
1282 if (ret)
1283 goto out;
1284
1285 eff_addr = tmp;
1286 }
1287 }
1288
1289 ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
1290 if (ret)
1291 goto out;
1292
1293 /*
1294 * In protected mode, before computing the linear address, make sure
1295 * the effective address is within the limits of the segment.
1296 * 32-bit addresses can be used in long and virtual-8086 modes if an
1297 * address override prefix is used. In such cases, segment limits are
1298 * not enforced. When in virtual-8086 mode, the segment limit is -1L
1299 * to reflect this situation.
1300 *
1301 * After computed, the effective address is treated as an unsigned
1302 * quantity.
1303 */
1304 if (!any_64bit_mode(regs) && ((unsigned int)eff_addr > seg_limit))
1305 goto out;
1306
1307 /*
1308 * Even though 32-bit address encodings are allowed in virtual-8086
1309 * mode, the address range is still limited to [0x-0xffff].
1310 */
1311 if (v8086_mode(regs) && (eff_addr & ~0xffff))
1312 goto out;
1313
1314 /*
1315 * Data type long could be 64 bits in size. Ensure that our 32-bit
1316 * effective address is not sign-extended when computing the linear
1317 * address.
1318 */
1319 linear_addr = (unsigned long)(eff_addr & 0xffffffff) + seg_base;
1320
1321 /* Limit linear address to 20 bits */
1322 if (v8086_mode(regs))
1323 linear_addr &= 0xfffff;
1324
1325out:
1326 return (void __user *)linear_addr;
1327}
1328
1329/**
1330 * get_addr_ref_64() - Obtain a 64-bit linear address
1331 * @insn: Instruction struct with ModRM and SIB bytes and displacement
1332 * @regs: Structure with register values as seen when entering kernel mode
1333 *
1334 * This function is to be used with 64-bit address encodings to obtain the
1335 * linear memory address referred by the instruction's ModRM, SIB,
1336 * displacement bytes and segment base address, as applicable.
1337 *
1338 * Returns:
1339 *
1340 * Linear address referenced by instruction and registers on success.
1341 *
1342 * -1L on error.
1343 */
1344#ifndef CONFIG_X86_64
1345static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
1346{
1347 return (void __user *)-1L;
1348}
1349#else
1350static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
1351{
1352 unsigned long linear_addr = -1L, seg_base;
1353 int regoff, ret;
1354 long eff_addr;
1355
1356 if (insn->addr_bytes != 8)
1357 goto out;
1358
1359 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1360 ret = get_eff_addr_reg(insn, regs, ®off, &eff_addr);
1361 if (ret)
1362 goto out;
1363
1364 } else {
1365 if (insn->sib.nbytes) {
1366 ret = get_eff_addr_sib(insn, regs, ®off, &eff_addr);
1367 if (ret)
1368 goto out;
1369 } else {
1370 ret = get_eff_addr_modrm(insn, regs, ®off, &eff_addr);
1371 if (ret)
1372 goto out;
1373 }
1374
1375 }
1376
1377 ret = get_seg_base_limit(insn, regs, regoff, &seg_base, NULL);
1378 if (ret)
1379 goto out;
1380
1381 linear_addr = (unsigned long)eff_addr + seg_base;
1382
1383out:
1384 return (void __user *)linear_addr;
1385}
1386#endif /* CONFIG_X86_64 */
1387
1388/**
1389 * insn_get_addr_ref() - Obtain the linear address referred by instruction
1390 * @insn: Instruction structure containing ModRM byte and displacement
1391 * @regs: Structure with register values as seen when entering kernel mode
1392 *
1393 * Obtain the linear address referred by the instruction's ModRM, SIB and
1394 * displacement bytes, and segment base, as applicable. In protected mode,
1395 * segment limits are enforced.
1396 *
1397 * Returns:
1398 *
1399 * Linear address referenced by instruction and registers on success.
1400 *
1401 * -1L on error.
1402 */
1403void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs)
1404{
1405 if (!insn || !regs)
1406 return (void __user *)-1L;
1407
1408 switch (insn->addr_bytes) {
1409 case 2:
1410 return get_addr_ref_16(insn, regs);
1411 case 4:
1412 return get_addr_ref_32(insn, regs);
1413 case 8:
1414 return get_addr_ref_64(insn, regs);
1415 default:
1416 return (void __user *)-1L;
1417 }
1418}
1419
1420static int insn_get_effective_ip(struct pt_regs *regs, unsigned long *ip)
1421{
1422 unsigned long seg_base = 0;
1423
1424 /*
1425 * If not in user-space long mode, a custom code segment could be in
1426 * use. This is true in protected mode (if the process defined a local
1427 * descriptor table), or virtual-8086 mode. In most of the cases
1428 * seg_base will be zero as in USER_CS.
1429 */
1430 if (!user_64bit_mode(regs)) {
1431 seg_base = insn_get_seg_base(regs, INAT_SEG_REG_CS);
1432 if (seg_base == -1L)
1433 return -EINVAL;
1434 }
1435
1436 *ip = seg_base + regs->ip;
1437
1438 return 0;
1439}
1440
1441/**
1442 * insn_fetch_from_user() - Copy instruction bytes from user-space memory
1443 * @regs: Structure with register values as seen when entering kernel mode
1444 * @buf: Array to store the fetched instruction
1445 *
1446 * Gets the linear address of the instruction and copies the instruction bytes
1447 * to the buf.
1448 *
1449 * Returns:
1450 *
1451 * - number of instruction bytes copied.
1452 * - 0 if nothing was copied.
1453 * - -EINVAL if the linear address of the instruction could not be calculated
1454 */
1455int insn_fetch_from_user(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE])
1456{
1457 unsigned long ip;
1458 int not_copied;
1459
1460 if (insn_get_effective_ip(regs, &ip))
1461 return -EINVAL;
1462
1463 not_copied = copy_from_user(buf, (void __user *)ip, MAX_INSN_SIZE);
1464
1465 return MAX_INSN_SIZE - not_copied;
1466}
1467
1468/**
1469 * insn_fetch_from_user_inatomic() - Copy instruction bytes from user-space memory
1470 * while in atomic code
1471 * @regs: Structure with register values as seen when entering kernel mode
1472 * @buf: Array to store the fetched instruction
1473 *
1474 * Gets the linear address of the instruction and copies the instruction bytes
1475 * to the buf. This function must be used in atomic context.
1476 *
1477 * Returns:
1478 *
1479 * - number of instruction bytes copied.
1480 * - 0 if nothing was copied.
1481 * - -EINVAL if the linear address of the instruction could not be calculated.
1482 */
1483int insn_fetch_from_user_inatomic(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE])
1484{
1485 unsigned long ip;
1486 int not_copied;
1487
1488 if (insn_get_effective_ip(regs, &ip))
1489 return -EINVAL;
1490
1491 not_copied = __copy_from_user_inatomic(buf, (void __user *)ip, MAX_INSN_SIZE);
1492
1493 return MAX_INSN_SIZE - not_copied;
1494}
1495
1496/**
1497 * insn_decode_from_regs() - Decode an instruction
1498 * @insn: Structure to store decoded instruction
1499 * @regs: Structure with register values as seen when entering kernel mode
1500 * @buf: Buffer containing the instruction bytes
1501 * @buf_size: Number of instruction bytes available in buf
1502 *
1503 * Decodes the instruction provided in buf and stores the decoding results in
1504 * insn. Also determines the correct address and operand sizes.
1505 *
1506 * Returns:
1507 *
1508 * True if instruction was decoded, False otherwise.
1509 */
1510bool insn_decode_from_regs(struct insn *insn, struct pt_regs *regs,
1511 unsigned char buf[MAX_INSN_SIZE], int buf_size)
1512{
1513 int seg_defs;
1514
1515 insn_init(insn, buf, buf_size, user_64bit_mode(regs));
1516
1517 /*
1518 * Override the default operand and address sizes with what is specified
1519 * in the code segment descriptor. The instruction decoder only sets
1520 * the address size it to either 4 or 8 address bytes and does nothing
1521 * for the operand bytes. This OK for most of the cases, but we could
1522 * have special cases where, for instance, a 16-bit code segment
1523 * descriptor is used.
1524 * If there is an address override prefix, the instruction decoder
1525 * correctly updates these values, even for 16-bit defaults.
1526 */
1527 seg_defs = insn_get_code_seg_params(regs);
1528 if (seg_defs == -EINVAL)
1529 return false;
1530
1531 insn->addr_bytes = INSN_CODE_SEG_ADDR_SZ(seg_defs);
1532 insn->opnd_bytes = INSN_CODE_SEG_OPND_SZ(seg_defs);
1533
1534 if (insn_get_length(insn))
1535 return false;
1536
1537 if (buf_size < insn->length)
1538 return false;
1539
1540 return true;
1541}