Messages in this thread | | | Date | Thu, 28 Sep 2017 11:36:39 +0200 | From | Borislav Petkov <> | Subject | Re: [PATCH v8 12/28] x86/insn-eval: Add utility functions to get segment selector |
| |
On Wed, Sep 27, 2017 at 03:32:26PM -0700, Ricardo Neri wrote: > The idea is that get_overridden_seg_reg() would implement the logic you > just described. It would return return INAT_SEG_REG_DEFAULT/IGNORE when > segment override prefixes are not allowed (i.e., valid insn with > operand rDI and string instruction; and rIP) or needed (i.e., long > mode, except if there are override prefixes for FS or GS); or > INAT_SEG_REG_[CSDEFG]S otherwise.
Ok, lemme see if we're talking the same thing. Your diff is linewrapped so parsing that is hard.
Do this
if (regoff == offsetof(struct pt_regs, ip)) { if (user_64bit_mode(regs)) return INAT_SEG_REG_IGNORE; else return INAT_SEG_REG_DEFAULT; }
and all the other checking *before* you do insn_init(). Because you have crazy stuff like:
if (seg_reg == INAT_SEG_REG_IGNORE) return seg_reg;
which shortcuts those functions and is simply clumsy and complicates following the code. The mere fact that you have to call the function "get_overridden_seg_reg_if_any_or_needed()" already tells you that that function is doing too many things at once.
When the function is called get_segment_register() then it should do only that. And all the checking is done before or in wrappers.
IOW, all the rIP checking and early return down the insn_get_seg_base() -> resolve_seg_register() -> .. should be done separately.
*Then* you do insn_init() and hand it down to insn_get_seg_base() and from now on you have a proper insn pointer which you hand around and check for NULL only once, on function entry.
Then your code flow is much simpler: first you take care of the case where rIP doesn't do segment overrides and all the other cases are handled by the normal path, with a proper struct insn.
Makes more sense?
-- Regards/Gruss, Boris.
SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) --
| |