2 * Utility functions for x86 operand and address decoding
4 * Copyright (C) Intel Corporation 2017
6 #include <linux/kernel.h>
7 #include <linux/string.h>
8 #include <linux/ratelimit.h>
9 #include <linux/mmu_context.h>
10 #include <asm/desc_defs.h>
14 #include <asm/insn-eval.h>
19 #define pr_fmt(fmt) "insn: " fmt
29 * is_string_insn() - Determine if instruction is a string instruction
30 * @insn: Instruction containing the opcode to inspect
34 * true if the instruction, determined by the opcode, is any of the
35 * string instructions as defined in the Intel Software Development manual.
38 static bool is_string_insn(struct insn *insn)
40 /* All string instructions have a 1-byte opcode. */
41 if (insn->opcode.nbytes != 1)
44 switch (insn->opcode.bytes[0]) {
45 case 0x6c ... 0x6f: /* INS, OUTS */
46 case 0xa4 ... 0xa7: /* MOVS, CMPS */
47 case 0xaa ... 0xaf: /* STOS, LODS, SCAS */
55 * insn_has_rep_prefix() - Determine if instruction has a REP prefix
56 * @insn: Instruction containing the prefix to inspect
60 * true if the instruction has a REP prefix, false if not.
62 bool insn_has_rep_prefix(struct insn *insn)
67 insn_get_prefixes(insn);
69 for_each_insn_prefix(insn, i, p) {
70 if (p == 0xf2 || p == 0xf3)
78 * get_seg_reg_override_idx() - obtain segment register override index
79 * @insn: Valid instruction with segment override prefixes
81 * Inspect the instruction prefixes in @insn and find segment overrides, if any.
85 * A constant identifying the segment register to use, among CS, SS, DS,
86 * ES, FS, or GS. INAT_SEG_REG_DEFAULT is returned if no segment override
87 * prefixes were found.
89 * -EINVAL in case of error.
91 static int get_seg_reg_override_idx(struct insn *insn)
93 int idx = INAT_SEG_REG_DEFAULT;
94 int num_overrides = 0, i;
97 insn_get_prefixes(insn);
99 /* Look for any segment override prefixes. */
100 for_each_insn_prefix(insn, i, p) {
103 attr = inat_get_opcode_attribute(p);
105 case INAT_MAKE_PREFIX(INAT_PFX_CS):
106 idx = INAT_SEG_REG_CS;
109 case INAT_MAKE_PREFIX(INAT_PFX_SS):
110 idx = INAT_SEG_REG_SS;
113 case INAT_MAKE_PREFIX(INAT_PFX_DS):
114 idx = INAT_SEG_REG_DS;
117 case INAT_MAKE_PREFIX(INAT_PFX_ES):
118 idx = INAT_SEG_REG_ES;
121 case INAT_MAKE_PREFIX(INAT_PFX_FS):
122 idx = INAT_SEG_REG_FS;
125 case INAT_MAKE_PREFIX(INAT_PFX_GS):
126 idx = INAT_SEG_REG_GS;
129 /* No default action needed. */
133 /* More than one segment override prefix leads to undefined behavior. */
134 if (num_overrides > 1)
141 * check_seg_overrides() - check if segment override prefixes are allowed
142 * @insn: Valid instruction with segment override prefixes
143 * @regoff: Operand offset, in pt_regs, for which the check is performed
145 * For a particular register used in register-indirect addressing, determine if
146 * segment override prefixes can be used. Specifically, no overrides are allowed
147 * for rDI if used with a string instruction.
151 * True if segment override prefixes can be used with the register indicated
152 * in @regoff. False if otherwise.
154 static bool check_seg_overrides(struct insn *insn, int regoff)
156 if (regoff == offsetof(struct pt_regs, di) && is_string_insn(insn))
163 * resolve_default_seg() - resolve default segment register index for an operand
164 * @insn: Instruction with opcode and address size. Must be valid.
165 * @regs: Register values as seen when entering kernel mode
166 * @off: Operand offset, in pt_regs, for which resolution is needed
168 * Resolve the default segment register index associated with the instruction
169 * operand register indicated by @off. Such index is resolved based on defaults
170 * described in the Intel Software Development Manual.
174 * If in protected mode, a constant identifying the segment register to use,
175 * among CS, SS, ES or DS. If in long mode, INAT_SEG_REG_IGNORE.
177 * -EINVAL in case of error.
179 static int resolve_default_seg(struct insn *insn, struct pt_regs *regs, int off)
181 if (any_64bit_mode(regs))
182 return INAT_SEG_REG_IGNORE;
184 * Resolve the default segment register as described in Section 3.7.4
185 * of the Intel Software Development Manual Vol. 1:
187 * + DS for all references involving r[ABCD]X, and rSI.
188 * + If used in a string instruction, ES for rDI. Otherwise, DS.
189 * + AX, CX and DX are not valid register operands in 16-bit address
190 * encodings but are valid for 32-bit and 64-bit encodings.
191 * + -EDOM is reserved to identify for cases in which no register
192 * is used (i.e., displacement-only addressing). Use DS.
193 * + SS for rSP or rBP.
198 case offsetof(struct pt_regs, ax):
199 case offsetof(struct pt_regs, cx):
200 case offsetof(struct pt_regs, dx):
201 /* Need insn to verify address size. */
202 if (insn->addr_bytes == 2)
208 case offsetof(struct pt_regs, bx):
209 case offsetof(struct pt_regs, si):
210 return INAT_SEG_REG_DS;
212 case offsetof(struct pt_regs, di):
213 if (is_string_insn(insn))
214 return INAT_SEG_REG_ES;
215 return INAT_SEG_REG_DS;
217 case offsetof(struct pt_regs, bp):
218 case offsetof(struct pt_regs, sp):
219 return INAT_SEG_REG_SS;
221 case offsetof(struct pt_regs, ip):
222 return INAT_SEG_REG_CS;
230 * resolve_seg_reg() - obtain segment register index
231 * @insn: Instruction with operands
232 * @regs: Register values as seen when entering kernel mode
233 * @regoff: Operand offset, in pt_regs, used to determine segment register
235 * Determine the segment register associated with the operands and, if
236 * applicable, prefixes and the instruction pointed by @insn.
238 * The segment register associated to an operand used in register-indirect
239 * addressing depends on:
241 * a) Whether running in long mode (in such a case segments are ignored, except
242 * if FS or GS are used).
244 * b) Whether segment override prefixes can be used. Certain instructions and
245 * registers do not allow override prefixes.
247 * c) Whether segment overrides prefixes are found in the instruction prefixes.
249 * d) If there are not segment override prefixes or they cannot be used, the
250 * default segment register associated with the operand register is used.
252 * The function checks first if segment override prefixes can be used with the
253 * operand indicated by @regoff. If allowed, obtain such overridden segment
254 * register index. Lastly, if not prefixes were found or cannot be used, resolve
255 * the segment register index to use based on the defaults described in the
256 * Intel documentation. In long mode, all segment register indexes will be
257 * ignored, except if overrides were found for FS or GS. All these operations
258 * are done using helper functions.
260 * The operand register, @regoff, is represented as the offset from the base of
263 * As stated, the main use of this function is to determine the segment register
264 * index based on the instruction, its operands and prefixes. Hence, @insn
265 * must be valid. However, if @regoff indicates rIP, we don't need to inspect
266 * @insn at all as in this case CS is used in all cases. This case is checked
267 * before proceeding further.
269 * Please note that this function does not return the value in the segment
270 * register (i.e., the segment selector) but our defined index. The segment
271 * selector needs to be obtained using get_segment_selector() and passing the
272 * segment register index resolved by this function.
276 * An index identifying the segment register to use, among CS, SS, DS,
277 * ES, FS, or GS. INAT_SEG_REG_IGNORE is returned if running in long mode.
279 * -EINVAL in case of error.
281 static int resolve_seg_reg(struct insn *insn, struct pt_regs *regs, int regoff)
286 * In the unlikely event of having to resolve the segment register
287 * index for rIP, do it first. Segment override prefixes should not
288 * be used. Hence, it is not necessary to inspect the instruction,
289 * which may be invalid at this point.
291 if (regoff == offsetof(struct pt_regs, ip)) {
292 if (any_64bit_mode(regs))
293 return INAT_SEG_REG_IGNORE;
295 return INAT_SEG_REG_CS;
301 if (!check_seg_overrides(insn, regoff))
302 return resolve_default_seg(insn, regs, regoff);
304 idx = get_seg_reg_override_idx(insn);
308 if (idx == INAT_SEG_REG_DEFAULT)
309 return resolve_default_seg(insn, regs, regoff);
312 * In long mode, segment override prefixes are ignored, except for
313 * overrides for FS and GS.
315 if (any_64bit_mode(regs)) {
316 if (idx != INAT_SEG_REG_FS &&
317 idx != INAT_SEG_REG_GS)
318 idx = INAT_SEG_REG_IGNORE;
325 * get_segment_selector() - obtain segment selector
326 * @regs: Register values as seen when entering kernel mode
327 * @seg_reg_idx: Segment register index to use
329 * Obtain the segment selector from any of the CS, SS, DS, ES, FS, GS segment
330 * registers. In CONFIG_X86_32, the segment is obtained from either pt_regs or
331 * kernel_vm86_regs as applicable. In CONFIG_X86_64, CS and SS are obtained
332 * from pt_regs. DS, ES, FS and GS are obtained by reading the actual CPU
333 * registers. This done for only for completeness as in CONFIG_X86_64 segment
334 * registers are ignored.
338 * Value of the segment selector, including null when running in
343 static short get_segment_selector(struct pt_regs *regs, int seg_reg_idx)
348 switch (seg_reg_idx) {
349 case INAT_SEG_REG_IGNORE:
351 case INAT_SEG_REG_CS:
352 return (unsigned short)(regs->cs & 0xffff);
353 case INAT_SEG_REG_SS:
354 return (unsigned short)(regs->ss & 0xffff);
355 case INAT_SEG_REG_DS:
356 savesegment(ds, sel);
358 case INAT_SEG_REG_ES:
359 savesegment(es, sel);
361 case INAT_SEG_REG_FS:
362 savesegment(fs, sel);
364 case INAT_SEG_REG_GS:
365 savesegment(gs, sel);
370 #else /* CONFIG_X86_32 */
371 struct kernel_vm86_regs *vm86regs = (struct kernel_vm86_regs *)regs;
373 if (v8086_mode(regs)) {
374 switch (seg_reg_idx) {
375 case INAT_SEG_REG_CS:
376 return (unsigned short)(regs->cs & 0xffff);
377 case INAT_SEG_REG_SS:
378 return (unsigned short)(regs->ss & 0xffff);
379 case INAT_SEG_REG_DS:
381 case INAT_SEG_REG_ES:
383 case INAT_SEG_REG_FS:
385 case INAT_SEG_REG_GS:
387 case INAT_SEG_REG_IGNORE:
393 switch (seg_reg_idx) {
394 case INAT_SEG_REG_CS:
395 return (unsigned short)(regs->cs & 0xffff);
396 case INAT_SEG_REG_SS:
397 return (unsigned short)(regs->ss & 0xffff);
398 case INAT_SEG_REG_DS:
399 return (unsigned short)(regs->ds & 0xffff);
400 case INAT_SEG_REG_ES:
401 return (unsigned short)(regs->es & 0xffff);
402 case INAT_SEG_REG_FS:
403 return (unsigned short)(regs->fs & 0xffff);
404 case INAT_SEG_REG_GS:
405 return get_user_gs(regs);
406 case INAT_SEG_REG_IGNORE:
410 #endif /* CONFIG_X86_64 */
413 static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
418 static const int regoff[] = {
419 offsetof(struct pt_regs, ax),
420 offsetof(struct pt_regs, cx),
421 offsetof(struct pt_regs, dx),
422 offsetof(struct pt_regs, bx),
423 offsetof(struct pt_regs, sp),
424 offsetof(struct pt_regs, bp),
425 offsetof(struct pt_regs, si),
426 offsetof(struct pt_regs, di),
428 offsetof(struct pt_regs, r8),
429 offsetof(struct pt_regs, r9),
430 offsetof(struct pt_regs, r10),
431 offsetof(struct pt_regs, r11),
432 offsetof(struct pt_regs, r12),
433 offsetof(struct pt_regs, r13),
434 offsetof(struct pt_regs, r14),
435 offsetof(struct pt_regs, r15),
438 int nr_registers = ARRAY_SIZE(regoff);
440 * Don't possibly decode a 32-bit instructions as
441 * reading a 64-bit-only register.
443 if (IS_ENABLED(CONFIG_X86_64) && !insn->x86_64)
448 regno = X86_MODRM_RM(insn->modrm.value);
451 * ModRM.mod == 0 and ModRM.rm == 5 means a 32-bit displacement
452 * follows the ModRM byte.
454 if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
457 if (X86_REX_B(insn->rex_prefix.value))
462 regno = X86_MODRM_REG(insn->modrm.value);
464 if (X86_REX_R(insn->rex_prefix.value))
469 regno = X86_SIB_INDEX(insn->sib.value);
470 if (X86_REX_X(insn->rex_prefix.value))
474 * If ModRM.mod != 3 and SIB.index = 4 the scale*index
475 * portion of the address computation is null. This is
476 * true only if REX.X is 0. In such a case, the SIB index
477 * is used in the address computation.
479 if (X86_MODRM_MOD(insn->modrm.value) != 3 && regno == 4)
484 regno = X86_SIB_BASE(insn->sib.value);
486 * If ModRM.mod is 0 and SIB.base == 5, the base of the
487 * register-indirect addressing is 0. In this case, a
488 * 32-bit displacement follows the SIB byte.
490 if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
493 if (X86_REX_B(insn->rex_prefix.value))
498 pr_err_ratelimited("invalid register type: %d\n", type);
502 if (regno >= nr_registers) {
503 WARN_ONCE(1, "decoded an instruction with an invalid register");
506 return regoff[regno];
510 * get_reg_offset_16() - Obtain offset of register indicated by instruction
511 * @insn: Instruction containing ModRM byte
512 * @regs: Register values as seen when entering kernel mode
513 * @offs1: Offset of the first operand register
514 * @offs2: Offset of the second operand register, if applicable
516 * Obtain the offset, in pt_regs, of the registers indicated by the ModRM byte
517 * in @insn. This function is to be used with 16-bit address encodings. The
518 * @offs1 and @offs2 will be written with the offset of the two registers
519 * indicated by the instruction. In cases where any of the registers is not
520 * referenced by the instruction, the value will be set to -EDOM.
524 * 0 on success, -EINVAL on error.
526 static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs,
527 int *offs1, int *offs2)
530 * 16-bit addressing can use one or two registers. Specifics of
531 * encodings are given in Table 2-1. "16-Bit Addressing Forms with the
532 * ModR/M Byte" of the Intel Software Development Manual.
534 static const int regoff1[] = {
535 offsetof(struct pt_regs, bx),
536 offsetof(struct pt_regs, bx),
537 offsetof(struct pt_regs, bp),
538 offsetof(struct pt_regs, bp),
539 offsetof(struct pt_regs, si),
540 offsetof(struct pt_regs, di),
541 offsetof(struct pt_regs, bp),
542 offsetof(struct pt_regs, bx),
545 static const int regoff2[] = {
546 offsetof(struct pt_regs, si),
547 offsetof(struct pt_regs, di),
548 offsetof(struct pt_regs, si),
549 offsetof(struct pt_regs, di),
556 if (!offs1 || !offs2)
559 /* Operand is a register, use the generic function. */
560 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
561 *offs1 = insn_get_modrm_rm_off(insn, regs);
566 *offs1 = regoff1[X86_MODRM_RM(insn->modrm.value)];
567 *offs2 = regoff2[X86_MODRM_RM(insn->modrm.value)];
570 * If ModRM.mod is 0 and ModRM.rm is 110b, then we use displacement-
571 * only addressing. This means that no registers are involved in
572 * computing the effective address. Thus, ensure that the first
573 * register offset is invalid. The second register offset is already
574 * invalid under the aforementioned conditions.
576 if ((X86_MODRM_MOD(insn->modrm.value) == 0) &&
577 (X86_MODRM_RM(insn->modrm.value) == 6))
584 * get_desc() - Obtain contents of a segment descriptor
585 * @out: Segment descriptor contents on success
586 * @sel: Segment selector
588 * Given a segment selector, obtain a pointer to the segment descriptor.
589 * Both global and local descriptor tables are supported.
593 * True on success, false on failure.
597 static bool get_desc(struct desc_struct *out, unsigned short sel)
599 struct desc_ptr gdt_desc = {0, 0};
600 unsigned long desc_base;
602 #ifdef CONFIG_MODIFY_LDT_SYSCALL
603 if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) {
604 bool success = false;
605 struct ldt_struct *ldt;
607 /* Bits [15:3] contain the index of the desired entry. */
610 mutex_lock(¤t->active_mm->context.lock);
611 ldt = current->active_mm->context.ldt;
612 if (ldt && sel < ldt->nr_entries) {
613 *out = ldt->entries[sel];
617 mutex_unlock(¤t->active_mm->context.lock);
622 native_store_gdt(&gdt_desc);
625 * Segment descriptors have a size of 8 bytes. Thus, the index is
626 * multiplied by 8 to obtain the memory offset of the desired descriptor
627 * from the base of the GDT. As bits [15:3] of the segment selector
628 * contain the index, it can be regarded as multiplied by 8 already.
629 * All that remains is to clear bits [2:0].
631 desc_base = sel & ~(SEGMENT_RPL_MASK | SEGMENT_TI_MASK);
633 if (desc_base > gdt_desc.size)
636 *out = *(struct desc_struct *)(gdt_desc.address + desc_base);
641 * insn_get_seg_base() - Obtain base address of segment descriptor.
642 * @regs: Register values as seen when entering kernel mode
643 * @seg_reg_idx: Index of the segment register pointing to seg descriptor
645 * Obtain the base address of the segment as indicated by the segment descriptor
646 * pointed by the segment selector. The segment selector is obtained from the
647 * input segment register index @seg_reg_idx.
651 * In protected mode, base address of the segment. Zero in long mode,
652 * except when FS or GS are used. In virtual-8086 mode, the segment
653 * selector shifted 4 bits to the right.
655 * -1L in case of error.
657 unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx)
659 struct desc_struct desc;
662 sel = get_segment_selector(regs, seg_reg_idx);
666 if (v8086_mode(regs))
668 * Base is simply the segment selector shifted 4
671 return (unsigned long)(sel << 4);
673 if (any_64bit_mode(regs)) {
675 * Only FS or GS will have a base address, the rest of
676 * the segments' bases are forced to 0.
680 if (seg_reg_idx == INAT_SEG_REG_FS) {
681 rdmsrl(MSR_FS_BASE, base);
682 } else if (seg_reg_idx == INAT_SEG_REG_GS) {
684 * swapgs was called at the kernel entry point. Thus,
685 * MSR_KERNEL_GS_BASE will have the user-space GS base.
688 rdmsrl(MSR_KERNEL_GS_BASE, base);
690 rdmsrl(MSR_GS_BASE, base);
697 /* In protected mode the segment selector cannot be null. */
701 if (!get_desc(&desc, sel))
704 return get_desc_base(&desc);
708 * get_seg_limit() - Obtain the limit of a segment descriptor
709 * @regs: Register values as seen when entering kernel mode
710 * @seg_reg_idx: Index of the segment register pointing to seg descriptor
712 * Obtain the limit of the segment as indicated by the segment descriptor
713 * pointed by the segment selector. The segment selector is obtained from the
714 * input segment register index @seg_reg_idx.
718 * In protected mode, the limit of the segment descriptor in bytes.
719 * In long mode and virtual-8086 mode, segment limits are not enforced. Thus,
720 * limit is returned as -1L to imply a limit-less segment.
722 * Zero is returned on error.
724 static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)
726 struct desc_struct desc;
730 sel = get_segment_selector(regs, seg_reg_idx);
734 if (any_64bit_mode(regs) || v8086_mode(regs))
740 if (!get_desc(&desc, sel))
744 * If the granularity bit is set, the limit is given in multiples
745 * of 4096. This also means that the 12 least significant bits are
746 * not tested when checking the segment limits. In practice,
747 * this means that the segment ends in (limit << 12) + 0xfff.
749 limit = get_desc_limit(&desc);
751 limit = (limit << 12) + 0xfff;
757 * insn_get_code_seg_params() - Obtain code segment parameters
758 * @regs: Structure with register values as seen when entering kernel mode
760 * Obtain address and operand sizes of the code segment. It is obtained from the
761 * selector contained in the CS register in regs. In protected mode, the default
762 * address is determined by inspecting the L and D bits of the segment
763 * descriptor. In virtual-8086 mode, the default is always two bytes for both
764 * address and operand sizes.
768 * An int containing ORed-in default parameters on success.
772 int insn_get_code_seg_params(struct pt_regs *regs)
774 struct desc_struct desc;
777 if (v8086_mode(regs))
778 /* Address and operand size are both 16-bit. */
779 return INSN_CODE_SEG_PARAMS(2, 2);
781 sel = get_segment_selector(regs, INAT_SEG_REG_CS);
785 if (!get_desc(&desc, sel))
789 * The most significant byte of the Type field of the segment descriptor
790 * determines whether a segment contains data or code. If this is a data
791 * segment, return error.
793 if (!(desc.type & BIT(3)))
796 switch ((desc.l << 1) | desc.d) {
798 * Legacy mode. CS.L=0, CS.D=0. Address and operand size are
801 return INSN_CODE_SEG_PARAMS(2, 2);
803 * Legacy mode. CS.L=0, CS.D=1. Address and operand size are
806 return INSN_CODE_SEG_PARAMS(4, 4);
808 * IA-32e 64-bit mode. CS.L=1, CS.D=0. Address size is 64-bit;
809 * operand size is 32-bit.
811 return INSN_CODE_SEG_PARAMS(4, 8);
812 case 3: /* Invalid setting. CS.L=1, CS.D=1 */
820 * insn_get_modrm_rm_off() - Obtain register in r/m part of the ModRM byte
821 * @insn: Instruction containing the ModRM byte
822 * @regs: Register values as seen when entering kernel mode
826 * The register indicated by the r/m part of the ModRM byte. The
827 * register is obtained as an offset from the base of pt_regs. In specific
828 * cases, the returned value can be -EDOM to indicate that the particular value
829 * of ModRM does not refer to a register and shall be ignored.
831 int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs)
833 return get_reg_offset(insn, regs, REG_TYPE_RM);
837 * insn_get_modrm_reg_off() - Obtain register in reg part of the ModRM byte
838 * @insn: Instruction containing the ModRM byte
839 * @regs: Register values as seen when entering kernel mode
843 * The register indicated by the reg part of the ModRM byte. The
844 * register is obtained as an offset from the base of pt_regs.
846 int insn_get_modrm_reg_off(struct insn *insn, struct pt_regs *regs)
848 return get_reg_offset(insn, regs, REG_TYPE_REG);
852 * insn_get_modrm_reg_ptr() - Obtain register pointer based on ModRM byte
853 * @insn: Instruction containing the ModRM byte
854 * @regs: Register values as seen when entering kernel mode
858 * The register indicated by the reg part of the ModRM byte.
859 * The register is obtained as a pointer within pt_regs.
861 unsigned long *insn_get_modrm_reg_ptr(struct insn *insn, struct pt_regs *regs)
865 offset = insn_get_modrm_reg_off(insn, regs);
868 return (void *)regs + offset;
872 * get_seg_base_limit() - obtain base address and limit of a segment
873 * @insn: Instruction. Must be valid.
874 * @regs: Register values as seen when entering kernel mode
875 * @regoff: Operand offset, in pt_regs, used to resolve segment descriptor
876 * @base: Obtained segment base
877 * @limit: Obtained segment limit
879 * Obtain the base address and limit of the segment associated with the operand
880 * @regoff and, if any or allowed, override prefixes in @insn. This function is
881 * different from insn_get_seg_base() as the latter does not resolve the segment
882 * associated with the instruction operand. If a limit is not needed (e.g.,
883 * when running in long mode), @limit can be NULL.
887 * 0 on success. @base and @limit will contain the base address and of the
888 * resolved segment, respectively.
892 static int get_seg_base_limit(struct insn *insn, struct pt_regs *regs,
893 int regoff, unsigned long *base,
894 unsigned long *limit)
901 seg_reg_idx = resolve_seg_reg(insn, regs, regoff);
905 *base = insn_get_seg_base(regs, seg_reg_idx);
912 *limit = get_seg_limit(regs, seg_reg_idx);
920 * get_eff_addr_reg() - Obtain effective address from register operand
921 * @insn: Instruction. Must be valid.
922 * @regs: Register values as seen when entering kernel mode
923 * @regoff: Obtained operand offset, in pt_regs, with the effective address
924 * @eff_addr: Obtained effective address
926 * Obtain the effective address stored in the register operand as indicated by
927 * the ModRM byte. This function is to be used only with register addressing
928 * (i.e., ModRM.mod is 3). The effective address is saved in @eff_addr. The
929 * register operand, as an offset from the base of pt_regs, is saved in @regoff;
930 * such offset can then be used to resolve the segment associated with the
931 * operand. This function can be used with any of the supported address sizes
936 * 0 on success. @eff_addr will have the effective address stored in the
937 * operand indicated by ModRM. @regoff will have such operand as an offset from
938 * the base of pt_regs.
942 static int get_eff_addr_reg(struct insn *insn, struct pt_regs *regs,
943 int *regoff, long *eff_addr)
947 ret = insn_get_modrm(insn);
951 if (X86_MODRM_MOD(insn->modrm.value) != 3)
954 *regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
958 /* Ignore bytes that are outside the address size. */
959 if (insn->addr_bytes == 2)
960 *eff_addr = regs_get_register(regs, *regoff) & 0xffff;
961 else if (insn->addr_bytes == 4)
962 *eff_addr = regs_get_register(regs, *regoff) & 0xffffffff;
963 else /* 64-bit address */
964 *eff_addr = regs_get_register(regs, *regoff);
970 * get_eff_addr_modrm() - Obtain referenced effective address via ModRM
971 * @insn: Instruction. Must be valid.
972 * @regs: Register values as seen when entering kernel mode
973 * @regoff: Obtained operand offset, in pt_regs, associated with segment
974 * @eff_addr: Obtained effective address
976 * Obtain the effective address referenced by the ModRM byte of @insn. After
977 * identifying the registers involved in the register-indirect memory reference,
978 * its value is obtained from the operands in @regs. The computed address is
979 * stored @eff_addr. Also, the register operand that indicates the associated
980 * segment is stored in @regoff, this parameter can later be used to determine
985 * 0 on success. @eff_addr will have the referenced effective address. @regoff
986 * will have a register, as an offset from the base of pt_regs, that can be used
987 * to resolve the associated segment.
991 static int get_eff_addr_modrm(struct insn *insn, struct pt_regs *regs,
992 int *regoff, long *eff_addr)
997 if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
1000 ret = insn_get_modrm(insn);
1004 if (X86_MODRM_MOD(insn->modrm.value) > 2)
1007 *regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
1010 * -EDOM means that we must ignore the address_offset. In such a case,
1011 * in 64-bit mode the effective address relative to the rIP of the
1012 * following instruction.
1014 if (*regoff == -EDOM) {
1015 if (any_64bit_mode(regs))
1016 tmp = regs->ip + insn->length;
1019 } else if (*regoff < 0) {
1022 tmp = regs_get_register(regs, *regoff);
1025 if (insn->addr_bytes == 4) {
1026 int addr32 = (int)(tmp & 0xffffffff) + insn->displacement.value;
1028 *eff_addr = addr32 & 0xffffffff;
1030 *eff_addr = tmp + insn->displacement.value;
1037 * get_eff_addr_modrm_16() - Obtain referenced effective address via ModRM
1038 * @insn: Instruction. Must be valid.
1039 * @regs: Register values as seen when entering kernel mode
1040 * @regoff: Obtained operand offset, in pt_regs, associated with segment
1041 * @eff_addr: Obtained effective address
1043 * Obtain the 16-bit effective address referenced by the ModRM byte of @insn.
1044 * After identifying the registers involved in the register-indirect memory
1045 * reference, its value is obtained from the operands in @regs. The computed
1046 * address is stored @eff_addr. Also, the register operand that indicates
1047 * the associated segment is stored in @regoff, this parameter can later be used
1048 * to determine such segment.
1052 * 0 on success. @eff_addr will have the referenced effective address. @regoff
1053 * will have a register, as an offset from the base of pt_regs, that can be used
1054 * to resolve the associated segment.
1058 static int get_eff_addr_modrm_16(struct insn *insn, struct pt_regs *regs,
1059 int *regoff, short *eff_addr)
1061 int addr_offset1, addr_offset2, ret;
1062 short addr1 = 0, addr2 = 0, displacement;
1064 if (insn->addr_bytes != 2)
1067 insn_get_modrm(insn);
1069 if (!insn->modrm.nbytes)
1072 if (X86_MODRM_MOD(insn->modrm.value) > 2)
1075 ret = get_reg_offset_16(insn, regs, &addr_offset1, &addr_offset2);
1080 * Don't fail on invalid offset values. They might be invalid because
1081 * they cannot be used for this particular value of ModRM. Instead, use
1082 * them in the computation only if they contain a valid value.
1084 if (addr_offset1 != -EDOM)
1085 addr1 = regs_get_register(regs, addr_offset1) & 0xffff;
1087 if (addr_offset2 != -EDOM)
1088 addr2 = regs_get_register(regs, addr_offset2) & 0xffff;
1090 displacement = insn->displacement.value & 0xffff;
1091 *eff_addr = addr1 + addr2 + displacement;
1094 * The first operand register could indicate to use of either SS or DS
1095 * registers to obtain the segment selector. The second operand
1096 * register can only indicate the use of DS. Thus, the first operand
1097 * will be used to obtain the segment selector.
1099 *regoff = addr_offset1;
1105 * get_eff_addr_sib() - Obtain referenced effective address via SIB
1106 * @insn: Instruction. Must be valid.
1107 * @regs: Register values as seen when entering kernel mode
1108 * @regoff: Obtained operand offset, in pt_regs, associated with segment
1109 * @eff_addr: Obtained effective address
1111 * Obtain the effective address referenced by the SIB byte of @insn. After
1112 * identifying the registers involved in the indexed, register-indirect memory
1113 * reference, its value is obtained from the operands in @regs. The computed
1114 * address is stored @eff_addr. Also, the register operand that indicates the
1115 * associated segment is stored in @regoff, this parameter can later be used to
1116 * determine such segment.
1120 * 0 on success. @eff_addr will have the referenced effective address.
1121 * @base_offset will have a register, as an offset from the base of pt_regs,
1122 * that can be used to resolve the associated segment.
1124 * Negative value on error.
1126 static int get_eff_addr_sib(struct insn *insn, struct pt_regs *regs,
1127 int *base_offset, long *eff_addr)
1133 if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
1136 ret = insn_get_modrm(insn);
1140 if (!insn->modrm.nbytes)
1143 if (X86_MODRM_MOD(insn->modrm.value) > 2)
1146 ret = insn_get_sib(insn);
1150 if (!insn->sib.nbytes)
1153 *base_offset = get_reg_offset(insn, regs, REG_TYPE_BASE);
1154 indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX);
1157 * Negative values in the base and index offset means an error when
1158 * decoding the SIB byte. Except -EDOM, which means that the registers
1159 * should not be used in the address computation.
1161 if (*base_offset == -EDOM)
1163 else if (*base_offset < 0)
1166 base = regs_get_register(regs, *base_offset);
1168 if (indx_offset == -EDOM)
1170 else if (indx_offset < 0)
1173 indx = regs_get_register(regs, indx_offset);
1175 if (insn->addr_bytes == 4) {
1176 int addr32, base32, idx32;
1178 base32 = base & 0xffffffff;
1179 idx32 = indx & 0xffffffff;
1181 addr32 = base32 + idx32 * (1 << X86_SIB_SCALE(insn->sib.value));
1182 addr32 += insn->displacement.value;
1184 *eff_addr = addr32 & 0xffffffff;
1186 *eff_addr = base + indx * (1 << X86_SIB_SCALE(insn->sib.value));
1187 *eff_addr += insn->displacement.value;
1194 * get_addr_ref_16() - Obtain the 16-bit address referred by instruction
1195 * @insn: Instruction containing ModRM byte and displacement
1196 * @regs: Register values as seen when entering kernel mode
1198 * This function is to be used with 16-bit address encodings. Obtain the memory
1199 * address referred by the instruction's ModRM and displacement bytes. Also, the
1200 * segment used as base is determined by either any segment override prefixes in
1201 * @insn or the default segment of the registers involved in the address
1202 * computation. In protected mode, segment limits are enforced.
1206 * Linear address referenced by the instruction operands on success.
1210 static void __user *get_addr_ref_16(struct insn *insn, struct pt_regs *regs)
1212 unsigned long linear_addr = -1L, seg_base, seg_limit;
1217 if (insn_get_displacement(insn))
1220 if (insn->addr_bytes != 2)
1223 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1224 ret = get_eff_addr_reg(insn, regs, ®off, &tmp);
1230 ret = get_eff_addr_modrm_16(insn, regs, ®off, &eff_addr);
1235 ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
1240 * Before computing the linear address, make sure the effective address
1241 * is within the limits of the segment. In virtual-8086 mode, segment
1242 * limits are not enforced. In such a case, the segment limit is -1L to
1243 * reflect this fact.
1245 if ((unsigned long)(eff_addr & 0xffff) > seg_limit)
1248 linear_addr = (unsigned long)(eff_addr & 0xffff) + seg_base;
1250 /* Limit linear address to 20 bits */
1251 if (v8086_mode(regs))
1252 linear_addr &= 0xfffff;
1255 return (void __user *)linear_addr;
1259 * get_addr_ref_32() - Obtain a 32-bit linear address
1260 * @insn: Instruction with ModRM, SIB bytes and displacement
1261 * @regs: Register values as seen when entering kernel mode
1263 * This function is to be used with 32-bit address encodings to obtain the
1264 * linear memory address referred by the instruction's ModRM, SIB,
1265 * displacement bytes and segment base address, as applicable. If in protected
1266 * mode, segment limits are enforced.
1270 * Linear address referenced by instruction and registers on success.
1274 static void __user *get_addr_ref_32(struct insn *insn, struct pt_regs *regs)
1276 unsigned long linear_addr = -1L, seg_base, seg_limit;
1277 int eff_addr, regoff;
1281 if (insn->addr_bytes != 4)
1284 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1285 ret = get_eff_addr_reg(insn, regs, ®off, &tmp);
1292 if (insn->sib.nbytes) {
1293 ret = get_eff_addr_sib(insn, regs, ®off, &tmp);
1299 ret = get_eff_addr_modrm(insn, regs, ®off, &tmp);
1307 ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
1312 * In protected mode, before computing the linear address, make sure
1313 * the effective address is within the limits of the segment.
1314 * 32-bit addresses can be used in long and virtual-8086 modes if an
1315 * address override prefix is used. In such cases, segment limits are
1316 * not enforced. When in virtual-8086 mode, the segment limit is -1L
1317 * to reflect this situation.
1319 * After computed, the effective address is treated as an unsigned
1322 if (!any_64bit_mode(regs) && ((unsigned int)eff_addr > seg_limit))
1326 * Even though 32-bit address encodings are allowed in virtual-8086
1327 * mode, the address range is still limited to [0x-0xffff].
1329 if (v8086_mode(regs) && (eff_addr & ~0xffff))
1333 * Data type long could be 64 bits in size. Ensure that our 32-bit
1334 * effective address is not sign-extended when computing the linear
1337 linear_addr = (unsigned long)(eff_addr & 0xffffffff) + seg_base;
1339 /* Limit linear address to 20 bits */
1340 if (v8086_mode(regs))
1341 linear_addr &= 0xfffff;
1344 return (void __user *)linear_addr;
1348 * get_addr_ref_64() - Obtain a 64-bit linear address
1349 * @insn: Instruction struct with ModRM and SIB bytes and displacement
1350 * @regs: Structure with register values as seen when entering kernel mode
1352 * This function is to be used with 64-bit address encodings to obtain the
1353 * linear memory address referred by the instruction's ModRM, SIB,
1354 * displacement bytes and segment base address, as applicable.
1358 * Linear address referenced by instruction and registers on success.
1362 #ifndef CONFIG_X86_64
1363 static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
1365 return (void __user *)-1L;
1368 static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
1370 unsigned long linear_addr = -1L, seg_base;
1374 if (insn->addr_bytes != 8)
1377 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1378 ret = get_eff_addr_reg(insn, regs, ®off, &eff_addr);
1383 if (insn->sib.nbytes) {
1384 ret = get_eff_addr_sib(insn, regs, ®off, &eff_addr);
1388 ret = get_eff_addr_modrm(insn, regs, ®off, &eff_addr);
1395 ret = get_seg_base_limit(insn, regs, regoff, &seg_base, NULL);
1399 linear_addr = (unsigned long)eff_addr + seg_base;
1402 return (void __user *)linear_addr;
1404 #endif /* CONFIG_X86_64 */
1407 * insn_get_addr_ref() - Obtain the linear address referred by instruction
1408 * @insn: Instruction structure containing ModRM byte and displacement
1409 * @regs: Structure with register values as seen when entering kernel mode
1411 * Obtain the linear address referred by the instruction's ModRM, SIB and
1412 * displacement bytes, and segment base, as applicable. In protected mode,
1413 * segment limits are enforced.
1417 * Linear address referenced by instruction and registers on success.
1421 void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs)
1424 return (void __user *)-1L;
1426 if (insn_get_opcode(insn))
1427 return (void __user *)-1L;
1429 switch (insn->addr_bytes) {
1431 return get_addr_ref_16(insn, regs);
1433 return get_addr_ref_32(insn, regs);
1435 return get_addr_ref_64(insn, regs);
1437 return (void __user *)-1L;
1441 int insn_get_effective_ip(struct pt_regs *regs, unsigned long *ip)
1443 unsigned long seg_base = 0;
1446 * If not in user-space long mode, a custom code segment could be in
1447 * use. This is true in protected mode (if the process defined a local
1448 * descriptor table), or virtual-8086 mode. In most of the cases
1449 * seg_base will be zero as in USER_CS.
1451 if (!user_64bit_mode(regs)) {
1452 seg_base = insn_get_seg_base(regs, INAT_SEG_REG_CS);
1453 if (seg_base == -1L)
1457 *ip = seg_base + regs->ip;
1463 * insn_fetch_from_user() - Copy instruction bytes from user-space memory
1464 * @regs: Structure with register values as seen when entering kernel mode
1465 * @buf: Array to store the fetched instruction
1467 * Gets the linear address of the instruction and copies the instruction bytes
1472 * - number of instruction bytes copied.
1473 * - 0 if nothing was copied.
1474 * - -EINVAL if the linear address of the instruction could not be calculated
1476 int insn_fetch_from_user(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE])
1481 if (insn_get_effective_ip(regs, &ip))
1484 not_copied = copy_from_user(buf, (void __user *)ip, MAX_INSN_SIZE);
1486 return MAX_INSN_SIZE - not_copied;
1490 * insn_fetch_from_user_inatomic() - Copy instruction bytes from user-space memory
1491 * while in atomic code
1492 * @regs: Structure with register values as seen when entering kernel mode
1493 * @buf: Array to store the fetched instruction
1495 * Gets the linear address of the instruction and copies the instruction bytes
1496 * to the buf. This function must be used in atomic context.
1500 * - number of instruction bytes copied.
1501 * - 0 if nothing was copied.
1502 * - -EINVAL if the linear address of the instruction could not be calculated.
1504 int insn_fetch_from_user_inatomic(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE])
1509 if (insn_get_effective_ip(regs, &ip))
1512 not_copied = __copy_from_user_inatomic(buf, (void __user *)ip, MAX_INSN_SIZE);
1514 return MAX_INSN_SIZE - not_copied;
1518 * insn_decode_from_regs() - Decode an instruction
1519 * @insn: Structure to store decoded instruction
1520 * @regs: Structure with register values as seen when entering kernel mode
1521 * @buf: Buffer containing the instruction bytes
1522 * @buf_size: Number of instruction bytes available in buf
1524 * Decodes the instruction provided in buf and stores the decoding results in
1525 * insn. Also determines the correct address and operand sizes.
1529 * True if instruction was decoded, False otherwise.
1531 bool insn_decode_from_regs(struct insn *insn, struct pt_regs *regs,
1532 unsigned char buf[MAX_INSN_SIZE], int buf_size)
1536 insn_init(insn, buf, buf_size, user_64bit_mode(regs));
1539 * Override the default operand and address sizes with what is specified
1540 * in the code segment descriptor. The instruction decoder only sets
1541 * the address size it to either 4 or 8 address bytes and does nothing
1542 * for the operand bytes. This OK for most of the cases, but we could
1543 * have special cases where, for instance, a 16-bit code segment
1544 * descriptor is used.
1545 * If there is an address override prefix, the instruction decoder
1546 * correctly updates these values, even for 16-bit defaults.
1548 seg_defs = insn_get_code_seg_params(regs);
1549 if (seg_defs == -EINVAL)
1552 insn->addr_bytes = INSN_CODE_SEG_ADDR_SZ(seg_defs);
1553 insn->opnd_bytes = INSN_CODE_SEG_OPND_SZ(seg_defs);
1555 if (insn_get_length(insn))
1558 if (buf_size < insn->length)
1565 * insn_decode_mmio() - Decode a MMIO instruction
1566 * @insn: Structure to store decoded instruction
1567 * @bytes: Returns size of memory operand
1569 * Decodes instruction that used for Memory-mapped I/O.
1573 * Type of the instruction. Size of the memory operand is stored in
1574 * @bytes. If decode failed, MMIO_DECODE_FAILED returned.
1576 enum mmio_type insn_decode_mmio(struct insn *insn, int *bytes)
1578 enum mmio_type type = MMIO_DECODE_FAILED;
1582 if (insn_get_opcode(insn))
1583 return MMIO_DECODE_FAILED;
1585 switch (insn->opcode.bytes[0]) {
1586 case 0x88: /* MOV m8,r8 */
1589 case 0x89: /* MOV m16/m32/m64, r16/m32/m64 */
1591 *bytes = insn->opnd_bytes;
1595 case 0xc6: /* MOV m8, imm8 */
1598 case 0xc7: /* MOV m16/m32/m64, imm16/imm32/imm64 */
1600 *bytes = insn->opnd_bytes;
1601 type = MMIO_WRITE_IMM;
1604 case 0x8a: /* MOV r8, m8 */
1607 case 0x8b: /* MOV r16/r32/r64, m16/m32/m64 */
1609 *bytes = insn->opnd_bytes;
1613 case 0xa4: /* MOVS m8, m8 */
1616 case 0xa5: /* MOVS m16/m32/m64, m16/m32/m64 */
1618 *bytes = insn->opnd_bytes;
1622 case 0x0f: /* Two-byte instruction */
1623 switch (insn->opcode.bytes[1]) {
1624 case 0xb6: /* MOVZX r16/r32/r64, m8 */
1627 case 0xb7: /* MOVZX r32/r64, m16 */
1630 type = MMIO_READ_ZERO_EXTEND;
1633 case 0xbe: /* MOVSX r16/r32/r64, m8 */
1636 case 0xbf: /* MOVSX r32/r64, m16 */
1639 type = MMIO_READ_SIGN_EXTEND;