/*
* If a bounds overflow occurs then a #BR is generated. This
* function decodes MPX instructions to get violation address
* and set this address into extended struct siginfo.
*
* Note that this is not a super precise way of doing this.
* Userspace could have, by the time we get here, written
* anything it wants in to the instructions. We can not
* trust anything about it. They might not be valid
* instructions or might encode invalid registers, etc...
*/
int mpx_fault_info(struct mpx_fault_info *info, struct pt_regs *regs)
{
const struct mpx_bndreg_state *bndregs;
const struct mpx_bndreg *bndreg;
struct insn insn;
uint8_t bndregno;
int err;
err = mpx_insn_decode(&insn, regs);
if (err)
goto err_out;
/*
* We know at this point that we are only dealing with
* MPX instructions.
*/
insn_get_modrm(&insn);
bndregno = X86_MODRM_REG(insn.modrm.value);
if (bndregno > 3) {
err = -EINVAL;
goto err_out;
}
/* get bndregs field from current task's xsave area */
bndregs = get_xsave_field_ptr(XFEATURE_MASK_BNDREGS);
if (!bndregs) {
err = -EINVAL;
goto err_out;
}
/* now go select the individual register in the set of 4 */
bndreg = &bndregs->bndreg[bndregno];
/*
* The registers are always 64-bit, but the upper 32
* bits are ignored in 32-bit mode. Also, note that the
* upper bounds are architecturally represented in 1's
* complement form.
*
* The 'unsigned long' cast is because the compiler
* complains when casting from integers to different-size
* pointers.
*/
info->lower = (void __user *)(unsigned long)bndreg->lower_bound;
info->upper = (void __user *)(unsigned long)~bndreg->upper_bound;
info->addr = insn_get_addr_ref(&insn, regs);
/*
* We were not able to extract an address from the instruction,
* probably because there was something invalid in it.
*/
if (info->addr == (void __user *)-1) {
err = -EINVAL;
goto err_out;
}
trace_mpx_bounds_register_exception(info->addr, bndreg);
return 0;
err_out:
/* info might be NULL, but kfree() handles that */
return err;
}
insn_attr_t inat_get_group_attribute(insn_byte_t modrm, int lpfx_id,
insn_attr_t grp_attr)
{
const insn_attr_t *table;
int n;
n = inat_group_id(grp_attr);
table = inat_group_tables[n][0];
if (!table)
return inat_group_common_attribute(grp_attr);
if (inat_has_variant(table[X86_MODRM_REG(modrm)]) && lpfx_id) {
table = inat_group_tables[n][lpfx_id];
if (!table)
return inat_group_common_attribute(grp_attr);
}
return inat_merge_insn_attr(
table[X86_MODRM_REG(modrm)],
inat_group_common_attribute(grp_attr));
}
insn_attr_t inat_get_group_attribute(insn_byte_t modrm, insn_byte_t last_pfx,
insn_attr_t grp_attr)
{
const insn_attr_t *table;
insn_attr_t lpfx_attr;
int n, m = 0;
n = inat_group_id(grp_attr);
if (last_pfx) {
lpfx_attr = inat_get_opcode_attribute(last_pfx);
m = inat_last_prefix_id(lpfx_attr);
}
table = inat_group_tables[n][0];
if (!table)
return inat_group_common_attribute(grp_attr);
if (inat_has_variant(table[X86_MODRM_REG(modrm)]) && m) {
table = inat_group_tables[n][m];
if (!table)
return inat_group_common_attribute(grp_attr);
}
return table[X86_MODRM_REG(modrm)] |
inat_group_common_attribute(grp_attr);
}
/*
* If a bounds overflow occurs then a #BR is generated. This
* function decodes MPX instructions to get violation address
* and set this address into extended struct siginfo.
*
* Note that this is not a super precise way of doing this.
* Userspace could have, by the time we get here, written
* anything it wants in to the instructions. We can not
* trust anything about it. They might not be valid
* instructions or might encode invalid registers, etc...
*
* The caller is expected to kfree() the returned siginfo_t.
*/
siginfo_t *mpx_generate_siginfo(struct pt_regs *regs)
{
const struct bndreg *bndregs, *bndreg;
siginfo_t *info = NULL;
struct insn insn;
uint8_t bndregno;
int err;
err = mpx_insn_decode(&insn, regs);
if (err)
goto err_out;
/*
* We know at this point that we are only dealing with
* MPX instructions.
*/
insn_get_modrm(&insn);
bndregno = X86_MODRM_REG(insn.modrm.value);
if (bndregno > 3) {
err = -EINVAL;
goto err_out;
}
/* get bndregs field from current task's xsave area */
bndregs = get_xsave_field_ptr(XSTATE_BNDREGS);
if (!bndregs) {
err = -EINVAL;
goto err_out;
}
/* now go select the individual register in the set of 4 */
bndreg = &bndregs[bndregno];
info = kzalloc(sizeof(*info), GFP_KERNEL);
if (!info) {
err = -ENOMEM;
goto err_out;
}
/*
* The registers are always 64-bit, but the upper 32
* bits are ignored in 32-bit mode. Also, note that the
* upper bounds are architecturally represented in 1's
* complement form.
*
* The 'unsigned long' cast is because the compiler
* complains when casting from integers to different-size
* pointers.
*/
info->si_lower = (void __user *)(unsigned long)bndreg->lower_bound;
info->si_upper = (void __user *)(unsigned long)~bndreg->upper_bound;
info->si_addr_lsb = 0;
info->si_signo = SIGSEGV;
info->si_errno = 0;
info->si_code = SEGV_BNDERR;
info->si_addr = mpx_get_addr_ref(&insn, regs);
/*
* We were not able to extract an address from the instruction,
* probably because there was something invalid in it.
*/
if (info->si_addr == (void *)-1) {
err = -EINVAL;
goto err_out;
}
trace_mpx_bounds_register_exception(info->si_addr, bndreg);
return info;
err_out:
/* info might be NULL, but kfree() handles that */
kfree(info);
return ERR_PTR(err);
}
static void
print_ir_node(struct kedr_ifunc *func, struct kedr_ir_node *node,
struct kedr_ir_node *start)
{
u8 buf[X86_MAX_INSN_SIZE];
struct insn *insn = &node->insn;
u8 *pos;
u8 opcode;
u8 modrm;
int is_mov_imm_to_reg;
if (node->dest_inner != NULL)
debug_util_print_ulong(
offset_for_node(func, node->dest_inner),
"Jump to 0x%lx\n");
memcpy(&buf[0], &node->insn_buffer[0], X86_MAX_INSN_SIZE);
opcode = insn->opcode.bytes[0];
modrm = insn->modrm.bytes[0];
/* Non-zero for MOV imm32/64, %reg. */
is_mov_imm_to_reg =
((opcode == 0xc7 && X86_MODRM_REG(modrm) == 0) ||
(opcode >= 0xb8 && opcode <= 0xbf));
/* For the indirect near jumps using a jump table, as well as
* for other instructions using similar addressing expressions
* we cannot determine the address of the table in advance to
* prepare the expected dump properly. Let us just put 0 here. */
if (X86_MODRM_RM(modrm) == 4 && insn->displacement.nbytes == 4) {
/* SIB and disp32 are used.
* [NB] If mod == 3, displacement.nbytes is 0. */
pos = buf + insn_offset_displacement(&node->insn);
*(u32 *)pos = 0;
}
else if (opcode == 0xe8 || opcode == 0xe9 ||
(opcode == 0x0f &&
(insn->opcode.bytes[1] & 0xf0) == 0x80)) {
/* same for the relative near calls and jumps */
pos = buf + insn_offset_immediate(insn);
*(u32 *)pos = 0;
}
else if ((insn->modrm.bytes[0] & 0xc7) == 0x5) {
/* same for the insns with IP-relative addressing (x86-64)
* and with plain disp32 addressing (x86-32). */
pos = buf + insn_offset_displacement(insn);
*(u32 *)pos = 0;
}
#ifdef CONFIG_X86_64
else if (start != NULL && is_mov_imm_to_reg &&
X86_REX_W(insn->rex_prefix.value)) {
/* MOV imm64, %reg, check if imm64 is the address of
* a call_info or a block_info instance */
u64 imm64 = ((u64)insn->immediate2.value << 32) |
(u64)(u32)insn->immediate1.value;
/* [NB] insn->immediate*.value is signed by default, so we
* cast it to u32 here first to avoid sign extension which
* would lead to incorrectly calculated value of 'imm64'. */
if (imm64 == (u64)(unsigned long)start->block_info) {
debug_util_print_ulong(offset_for_node(func, start),
"Ref. to block_info for the block at 0x%lx\n");
}
if (imm64 == (u64)(unsigned long)start->call_info) {
/* 'start' should be the only reference node of the
* block in this case. */
debug_util_print_ulong(offset_for_node(func, start),
"Ref. to call_info for the node at 0x%lx\n");
}
/* Zero the immediate value anyway */
pos = buf + insn_offset_immediate(insn);
*(u64 *)pos = 0;
}
#else /* x86-32 */
else if (start != NULL && is_mov_imm_to_reg) {
/* "MOV imm32, r/m32", check if imm32 is the address of
* a call_info or a block_info instance */
u32 imm32 = (u32)insn->immediate.value;
if (imm32 == (u32)(unsigned long)start->block_info) {
pos = buf + insn_offset_immediate(insn);
*(u32 *)pos = 0;
debug_util_print_ulong(offset_for_node(func, start),
"Ref. to block_info for the block at 0x%lx\n");
}
if (imm32 == (u32)(unsigned long)start->call_info) {
pos = buf + insn_offset_immediate(insn);
*(u32 *)pos = 0;
/* 'start' should be the only reference node of the
* block in this case. */
debug_util_print_ulong(offset_for_node(func, start),
"Ref. to call_info for the node at 0x%lx\n");
}
/* Zero the immediate value anyway */
pos = buf + insn_offset_immediate(insn);
*(u32 *)pos = 0;
}
#endif
else if (start == NULL && is_mov_imm_to_reg) {
/* MOV imm32/imm64, %rax in the entry handler. */
pos = buf + insn_offset_immediate(insn);
*(unsigned long *)pos = 0;
}
else if (opcode >= 0xa0 && opcode <= 0xa3) {
/* direct offset MOV, zero the address */
pos = buf + insn_offset_immediate(insn);
*(unsigned long *)pos = 0;
}
debug_util_print_ulong(offset_for_node(func, node), "0x%lx: ");
debug_util_print_hex_bytes(&buf[0], insn->length);
debug_util_print_string("\n\n");
}
