lkml.org 
[lkml]   [2017]   [Feb]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v4 09/17] x86/insn-eval: Do not use R/EBP as base if mod in ModRM is zero
    Date
    Section 2.2.1.3 of the Intel 64 and IA-32 Architectures Software
    Developer's Manual volume 2A states that when the mod part of the ModRM
    byte is zero and R/EBP is specified in the R/M part of such bit, the value
    of the aforementioned register should not be used in the address
    computation. Instead, a 32-bit displacement is expected. The instruction
    decoder takes care of setting the displacement to the expected value.
    Returning -EDOM signals callers that they should ignore the value of such
    register when computing the address encoded in the instruction operands.

    Also, callers should exercise care to correctly interpret this particular
    case. In IA-32e 64-bit mode, the address is given by the displacement plus
    the value of the RIP. In IA-32e compatibility mode, the value of EIP is
    ignored. This correction is done for our insn_get_addr_ref.

    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
    Cc: Colin Ian King <colin.king@canonical.com>
    Cc: Lorenzo Stoakes <lstoakes@gmail.com>
    Cc: Qiaowei Ren <qiaowei.ren@intel.com>
    Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
    Cc: Masami Hiramatsu <mhiramat@kernel.org>
    Cc: Adrian Hunter <adrian.hunter@intel.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Thomas Garnier <thgarnie@google.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Borislav Petkov <bp@suse.de>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
    Cc: x86@kernel.org
    Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
    ---
    arch/x86/lib/insn-eval.c | 33 ++++++++++++++++++++++++++++++---
    1 file changed, 30 insertions(+), 3 deletions(-)

    diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c
    index 3fe4ddb..d6525c2 100644
    --- a/arch/x86/lib/insn-eval.c
    +++ b/arch/x86/lib/insn-eval.c
    @@ -218,6 +218,14 @@ static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
    switch (type) {
    case REG_TYPE_RM:
    regno = X86_MODRM_RM(insn->modrm.value);
    + /* if mod=0, register R/EBP is not used in the address
    + * computation. Instead, a 32-bit displacement is expected;
    + * the instruction decoder takes care of reading such
    + * displacement. This is true for both R/EBP and R13, as the
    + * REX.B bit is not decoded.
    + */
    + if (regno == 5 && X86_MODRM_MOD(insn->modrm.value) == 0)
    + return -EDOM;
    if (X86_REX_B(insn->rex_prefix.value))
    regno += 8;
    break;
    @@ -544,10 +552,29 @@ static void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs)

    addr = base + indx * (1 << X86_SIB_SCALE(sib));
    } else {
    + unsigned char addr_bytes;
    +
    + addr_bytes = insn_get_seg_default_address_bytes(regs);
    addr_offset = get_reg_offset(insn, regs, REG_TYPE_RM);
    - if (addr_offset < 0)
    - goto out_err;
    - addr = regs_get_register(regs, addr_offset);
    + if (addr_offset < 0) {
    + /* -EDOM means that we must ignore the
    + * address_offset. The only case in which we
    + * see this value is when R/M points to R/EBP.
    + * In such a case, the address involves using
    + * the instruction pointer for 64-bit mode.
    + */
    + if (addr_offset == -EDOM) {
    + /* if in 64-bit mode */
    + if (addr_bytes == 8)
    + addr = regs->ip;
    + else
    + addr = 0;
    + } else {
    + goto out_err;
    + }
    + } else {
    + addr = regs_get_register(regs, addr_offset);
    + }
    }
    addr += insn->displacement.value;
    }
    --
    2.9.3
    \
     
     \ /
      Last update: 2017-02-23 07:42    [W:4.083 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site