void copy_and_fixup_insn(struct insn *src_insn, void *dest, const struct kernsym *func) { u32 *to_fixup; unsigned long addr; BUG_ON(src_insn->length == 0); memcpy((void *)dest, (const void *)src_insn->kaddr, src_insn->length); if(src_insn->opcode.bytes[0] == OP_CALL_REL32 || src_insn->opcode.bytes[0] == OP_JMP_REL32) { addr = (unsigned long)CODE_ADDR_FROM_OFFSET( src_insn->kaddr, src_insn->length, src_insn->immediate.value); if(addr >= (unsigned long)func->addr && addr < (unsigned long)func->addr + func->size) return; to_fixup = (u32 *)((unsigned long)dest + insn_offset_immediate(src_insn)); *to_fixup = CODE_OFFSET_FROM_ADDR(dest, src_insn->length, (void *)addr); return; } #ifdef CONFIG_X86_64 if(!tpe_insn_rip_relative(src_insn)) return; addr = (unsigned long)CODE_ADDR_FROM_OFFSET( src_insn->kaddr, src_insn->length, src_insn->displacement.value); if(addr >= (unsigned long)func->addr && addr < (unsigned long)func->addr + func->size) return; to_fixup = (u32 *)((unsigned long)dest + insn_offset_displacement(src_insn)); *to_fixup = CODE_OFFSET_FROM_ADDR(dest, src_insn->length, (void *)addr); #endif return; }
/* Decode and process the instruction ('c_insn') at * the address 'kaddr' - see the description of do_process_area for details. * * Check if we get past the end of the buffer [kaddr, end_kaddr) * * The function returns the length of the instruction in bytes. * 0 is returned in case of failure. */ static unsigned int do_process_insn(struct insn* c_insn, void* kaddr, void* end_kaddr, void** from_funcs, void** to_funcs, unsigned int nfuncs) { /* ptr to the 32-bit offset argument in the instruction */ u32* offset = NULL; /* address of the function being called */ void* addr = NULL; static const unsigned char op = 0xe8; /* 'call <offset>' */ int i; BUG_ON(from_funcs == NULL || to_funcs == NULL); /* Decode the instruction and populate 'insn' structure */ kernel_insn_init(c_insn, kaddr); insn_get_length(c_insn); if (c_insn->length == 0) { return 0; } if (kaddr + c_insn->length > end_kaddr) { /* Note: it is OK to stop at 'end_kaddr' but no further */ KEDR_MSG(COMPONENT_STRING "instruction decoder stopped past the end of the section.\n"); insn_get_opcode(c_insn); printk(KERN_ALERT COMPONENT_STRING "kaddr=%p, end_kaddr=%p, c_insn->length=%d, opcode=0x%x\n", (void*)kaddr, (void*)end_kaddr, (int)c_insn->length, (unsigned int)c_insn->opcode.value ); WARN_ON(1); } /* This call may be overkill as insn_get_length() probably has to decode * the instruction completely. * Still, to operate safely, we need insn_get_opcode() before we can access * c_insn->opcode. * The call is cheap anyway, no re-decoding is performed. */ insn_get_opcode(c_insn); if (c_insn->opcode.value != op) { /* Not a 'call' instruction, nothing to do. */ return c_insn->length; } /* [NB] For some reason, the decoder stores the argument of 'call' and 'jmp' * as 'immediate' rather than 'displacement' (as Intel manuals name it). * May be it is a bug, may be it is not. * Meanwhile, I'll call this value 'offset' to avoid confusion. */ /* Call this before trying to access c_insn->immediate */ insn_get_immediate(c_insn); if (c_insn->immediate.nbytes != 4) { KEDR_MSG(COMPONENT_STRING "at 0x%p: " "opcode: 0x%x, " "immediate field is %u rather than 32 bits in size; " "insn.length = %u, insn.imm = %u, off_immed = %d\n", kaddr, (unsigned int)c_insn->opcode.value, 8 * (unsigned int)c_insn->immediate.nbytes, c_insn->length, (unsigned int)c_insn->immediate.value, insn_offset_immediate(c_insn)); WARN_ON(1); return c_insn->length; } offset = (u32*)(kaddr + insn_offset_immediate(c_insn)); addr = CALL_ADDR_FROM_OFFSET(kaddr, c_insn->length, *offset); /* Check if one of the functions of interest is called */ for (i = 0; i < nfuncs; ++i) { if (addr == from_funcs[i]) { /* Change the address of the function to be called */ BUG_ON(to_funcs[i] == NULL); KEDR_MSG(COMPONENT_STRING "at 0x%p: changing address 0x%p to 0x%p (displ: 0x%x to 0x%x)\n", kaddr, from_funcs[i], to_funcs[i], (unsigned int)(*offset), (unsigned int)CALL_OFFSET_FROM_ADDR( kaddr, c_insn->length, to_funcs[i]) ); *offset = CALL_OFFSET_FROM_ADDR( kaddr, c_insn->length, to_funcs[i] ); break; } } return c_insn->length; }
static void print_ir_node(struct kedr_ifunc *func, struct kedr_ir_node *node, struct kedr_ir_node *start) { u8 buf[X86_MAX_INSN_SIZE]; struct insn *insn = &node->insn; u8 *pos; u8 opcode; u8 modrm; int is_mov_imm_to_reg; if (node->dest_inner != NULL) debug_util_print_ulong( offset_for_node(func, node->dest_inner), "Jump to 0x%lx\n"); memcpy(&buf[0], &node->insn_buffer[0], X86_MAX_INSN_SIZE); opcode = insn->opcode.bytes[0]; modrm = insn->modrm.bytes[0]; /* Non-zero for MOV imm32/64, %reg. */ is_mov_imm_to_reg = ((opcode == 0xc7 && X86_MODRM_REG(modrm) == 0) || (opcode >= 0xb8 && opcode <= 0xbf)); /* For the indirect near jumps using a jump table, as well as * for other instructions using similar addressing expressions * we cannot determine the address of the table in advance to * prepare the expected dump properly. Let us just put 0 here. */ if (X86_MODRM_RM(modrm) == 4 && insn->displacement.nbytes == 4) { /* SIB and disp32 are used. * [NB] If mod == 3, displacement.nbytes is 0. */ pos = buf + insn_offset_displacement(&node->insn); *(u32 *)pos = 0; } else if (opcode == 0xe8 || opcode == 0xe9 || (opcode == 0x0f && (insn->opcode.bytes[1] & 0xf0) == 0x80)) { /* same for the relative near calls and jumps */ pos = buf + insn_offset_immediate(insn); *(u32 *)pos = 0; } else if ((insn->modrm.bytes[0] & 0xc7) == 0x5) { /* same for the insns with IP-relative addressing (x86-64) * and with plain disp32 addressing (x86-32). */ pos = buf + insn_offset_displacement(insn); *(u32 *)pos = 0; } #ifdef CONFIG_X86_64 else if (start != NULL && is_mov_imm_to_reg && X86_REX_W(insn->rex_prefix.value)) { /* MOV imm64, %reg, check if imm64 is the address of * a call_info or a block_info instance */ u64 imm64 = ((u64)insn->immediate2.value << 32) | (u64)(u32)insn->immediate1.value; /* [NB] insn->immediate*.value is signed by default, so we * cast it to u32 here first to avoid sign extension which * would lead to incorrectly calculated value of 'imm64'. */ if (imm64 == (u64)(unsigned long)start->block_info) { debug_util_print_ulong(offset_for_node(func, start), "Ref. to block_info for the block at 0x%lx\n"); } if (imm64 == (u64)(unsigned long)start->call_info) { /* 'start' should be the only reference node of the * block in this case. */ debug_util_print_ulong(offset_for_node(func, start), "Ref. to call_info for the node at 0x%lx\n"); } /* Zero the immediate value anyway */ pos = buf + insn_offset_immediate(insn); *(u64 *)pos = 0; } #else /* x86-32 */ else if (start != NULL && is_mov_imm_to_reg) { /* "MOV imm32, r/m32", check if imm32 is the address of * a call_info or a block_info instance */ u32 imm32 = (u32)insn->immediate.value; if (imm32 == (u32)(unsigned long)start->block_info) { pos = buf + insn_offset_immediate(insn); *(u32 *)pos = 0; debug_util_print_ulong(offset_for_node(func, start), "Ref. to block_info for the block at 0x%lx\n"); } if (imm32 == (u32)(unsigned long)start->call_info) { pos = buf + insn_offset_immediate(insn); *(u32 *)pos = 0; /* 'start' should be the only reference node of the * block in this case. */ debug_util_print_ulong(offset_for_node(func, start), "Ref. to call_info for the node at 0x%lx\n"); } /* Zero the immediate value anyway */ pos = buf + insn_offset_immediate(insn); *(u32 *)pos = 0; } #endif else if (start == NULL && is_mov_imm_to_reg) { /* MOV imm32/imm64, %rax in the entry handler. */ pos = buf + insn_offset_immediate(insn); *(unsigned long *)pos = 0; } else if (opcode >= 0xa0 && opcode <= 0xa3) { /* direct offset MOV, zero the address */ pos = buf + insn_offset_immediate(insn); *(unsigned long *)pos = 0; } debug_util_print_ulong(offset_for_node(func, node), "0x%lx: "); debug_util_print_hex_bytes(&buf[0], insn->length); debug_util_print_string("\n\n"); }