void copy_and_fixup_insn(struct insn *src_insn, void *dest,
const struct kernsym *func)
{
u32 *to_fixup;
unsigned long addr;
BUG_ON(src_insn->length == 0);
memcpy((void *)dest, (const void *)src_insn->kaddr,
src_insn->length);
if(src_insn->opcode.bytes[0] == OP_CALL_REL32 ||
src_insn->opcode.bytes[0] == OP_JMP_REL32)
{
addr = (unsigned long)CODE_ADDR_FROM_OFFSET(
src_insn->kaddr,
src_insn->length,
src_insn->immediate.value);
if(addr >= (unsigned long)func->addr &&
addr < (unsigned long)func->addr + func->size)
return;
to_fixup = (u32 *)((unsigned long)dest +
insn_offset_immediate(src_insn));
*to_fixup = CODE_OFFSET_FROM_ADDR(dest, src_insn->length,
(void *)addr);
return;
}
#ifdef CONFIG_X86_64
if(!tpe_insn_rip_relative(src_insn))
return;
addr = (unsigned long)CODE_ADDR_FROM_OFFSET(
src_insn->kaddr,
src_insn->length,
src_insn->displacement.value);
if(addr >= (unsigned long)func->addr &&
addr < (unsigned long)func->addr + func->size)
return;
to_fixup = (u32 *)((unsigned long)dest +
insn_offset_displacement(src_insn));
*to_fixup = CODE_OFFSET_FROM_ADDR(dest, src_insn->length,
(void *)addr);
#endif
return;
}
/* Decode and process the instruction ('c_insn') at
* the address 'kaddr' - see the description of do_process_area for details.
*
* Check if we get past the end of the buffer [kaddr, end_kaddr)
*
* The function returns the length of the instruction in bytes.
* 0 is returned in case of failure.
*/
static unsigned int
do_process_insn(struct insn* c_insn, void* kaddr, void* end_kaddr,
void** from_funcs, void** to_funcs, unsigned int nfuncs)
{
/* ptr to the 32-bit offset argument in the instruction */
u32* offset = NULL;
/* address of the function being called */
void* addr = NULL;
static const unsigned char op = 0xe8; /* 'call <offset>' */
int i;
BUG_ON(from_funcs == NULL || to_funcs == NULL);
/* Decode the instruction and populate 'insn' structure */
kernel_insn_init(c_insn, kaddr);
insn_get_length(c_insn);
if (c_insn->length == 0)
{
return 0;
}
if (kaddr + c_insn->length > end_kaddr)
{
/* Note: it is OK to stop at 'end_kaddr' but no further */
KEDR_MSG(COMPONENT_STRING
"instruction decoder stopped past the end of the section.\n");
insn_get_opcode(c_insn);
printk(KERN_ALERT COMPONENT_STRING
"kaddr=%p, end_kaddr=%p, c_insn->length=%d, opcode=0x%x\n",
(void*)kaddr,
(void*)end_kaddr,
(int)c_insn->length,
(unsigned int)c_insn->opcode.value
);
WARN_ON(1);
}
/* This call may be overkill as insn_get_length() probably has to decode
* the instruction completely.
* Still, to operate safely, we need insn_get_opcode() before we can access
* c_insn->opcode.
* The call is cheap anyway, no re-decoding is performed.
*/
insn_get_opcode(c_insn);
if (c_insn->opcode.value != op)
{
/* Not a 'call' instruction, nothing to do. */
return c_insn->length;
}
/* [NB] For some reason, the decoder stores the argument of 'call' and 'jmp'
* as 'immediate' rather than 'displacement' (as Intel manuals name it).
* May be it is a bug, may be it is not.
* Meanwhile, I'll call this value 'offset' to avoid confusion.
*/
/* Call this before trying to access c_insn->immediate */
insn_get_immediate(c_insn);
if (c_insn->immediate.nbytes != 4)
{
KEDR_MSG(COMPONENT_STRING
"at 0x%p: "
"opcode: 0x%x, "
"immediate field is %u rather than 32 bits in size; "
"insn.length = %u, insn.imm = %u, off_immed = %d\n",
kaddr,
(unsigned int)c_insn->opcode.value,
8 * (unsigned int)c_insn->immediate.nbytes,
c_insn->length,
(unsigned int)c_insn->immediate.value,
insn_offset_immediate(c_insn));
WARN_ON(1);
return c_insn->length;
}
offset = (u32*)(kaddr + insn_offset_immediate(c_insn));
addr = CALL_ADDR_FROM_OFFSET(kaddr, c_insn->length, *offset);
/* Check if one of the functions of interest is called */
for (i = 0; i < nfuncs; ++i)
{
if (addr == from_funcs[i])
{
/* Change the address of the function to be called */
BUG_ON(to_funcs[i] == NULL);
KEDR_MSG(COMPONENT_STRING
"at 0x%p: changing address 0x%p to 0x%p (displ: 0x%x to 0x%x)\n",
kaddr,
from_funcs[i],
to_funcs[i],
(unsigned int)(*offset),
(unsigned int)CALL_OFFSET_FROM_ADDR(
kaddr, c_insn->length, to_funcs[i])
);
*offset = CALL_OFFSET_FROM_ADDR(
kaddr,
c_insn->length,
to_funcs[i]
);
break;
}
}
return c_insn->length;
}
static void
print_ir_node(struct kedr_ifunc *func, struct kedr_ir_node *node,
struct kedr_ir_node *start)
{
u8 buf[X86_MAX_INSN_SIZE];
struct insn *insn = &node->insn;
u8 *pos;
u8 opcode;
u8 modrm;
int is_mov_imm_to_reg;
if (node->dest_inner != NULL)
debug_util_print_ulong(
offset_for_node(func, node->dest_inner),
"Jump to 0x%lx\n");
memcpy(&buf[0], &node->insn_buffer[0], X86_MAX_INSN_SIZE);
opcode = insn->opcode.bytes[0];
modrm = insn->modrm.bytes[0];
/* Non-zero for MOV imm32/64, %reg. */
is_mov_imm_to_reg =
((opcode == 0xc7 && X86_MODRM_REG(modrm) == 0) ||
(opcode >= 0xb8 && opcode <= 0xbf));
/* For the indirect near jumps using a jump table, as well as
* for other instructions using similar addressing expressions
* we cannot determine the address of the table in advance to
* prepare the expected dump properly. Let us just put 0 here. */
if (X86_MODRM_RM(modrm) == 4 && insn->displacement.nbytes == 4) {
/* SIB and disp32 are used.
* [NB] If mod == 3, displacement.nbytes is 0. */
pos = buf + insn_offset_displacement(&node->insn);
*(u32 *)pos = 0;
}
else if (opcode == 0xe8 || opcode == 0xe9 ||
(opcode == 0x0f &&
(insn->opcode.bytes[1] & 0xf0) == 0x80)) {
/* same for the relative near calls and jumps */
pos = buf + insn_offset_immediate(insn);
*(u32 *)pos = 0;
}
else if ((insn->modrm.bytes[0] & 0xc7) == 0x5) {
/* same for the insns with IP-relative addressing (x86-64)
* and with plain disp32 addressing (x86-32). */
pos = buf + insn_offset_displacement(insn);
*(u32 *)pos = 0;
}
#ifdef CONFIG_X86_64
else if (start != NULL && is_mov_imm_to_reg &&
X86_REX_W(insn->rex_prefix.value)) {
/* MOV imm64, %reg, check if imm64 is the address of
* a call_info or a block_info instance */
u64 imm64 = ((u64)insn->immediate2.value << 32) |
(u64)(u32)insn->immediate1.value;
/* [NB] insn->immediate*.value is signed by default, so we
* cast it to u32 here first to avoid sign extension which
* would lead to incorrectly calculated value of 'imm64'. */
if (imm64 == (u64)(unsigned long)start->block_info) {
debug_util_print_ulong(offset_for_node(func, start),
"Ref. to block_info for the block at 0x%lx\n");
}
if (imm64 == (u64)(unsigned long)start->call_info) {
/* 'start' should be the only reference node of the
* block in this case. */
debug_util_print_ulong(offset_for_node(func, start),
"Ref. to call_info for the node at 0x%lx\n");
}
/* Zero the immediate value anyway */
pos = buf + insn_offset_immediate(insn);
*(u64 *)pos = 0;
}
#else /* x86-32 */
else if (start != NULL && is_mov_imm_to_reg) {
/* "MOV imm32, r/m32", check if imm32 is the address of
* a call_info or a block_info instance */
u32 imm32 = (u32)insn->immediate.value;
if (imm32 == (u32)(unsigned long)start->block_info) {
pos = buf + insn_offset_immediate(insn);
*(u32 *)pos = 0;
debug_util_print_ulong(offset_for_node(func, start),
"Ref. to block_info for the block at 0x%lx\n");
}
if (imm32 == (u32)(unsigned long)start->call_info) {
pos = buf + insn_offset_immediate(insn);
*(u32 *)pos = 0;
/* 'start' should be the only reference node of the
* block in this case. */
debug_util_print_ulong(offset_for_node(func, start),
"Ref. to call_info for the node at 0x%lx\n");
}
/* Zero the immediate value anyway */
pos = buf + insn_offset_immediate(insn);
*(u32 *)pos = 0;
}
#endif
else if (start == NULL && is_mov_imm_to_reg) {
/* MOV imm32/imm64, %rax in the entry handler. */
pos = buf + insn_offset_immediate(insn);
*(unsigned long *)pos = 0;
}
else if (opcode >= 0xa0 && opcode <= 0xa3) {
/* direct offset MOV, zero the address */
pos = buf + insn_offset_immediate(insn);
*(unsigned long *)pos = 0;
}
debug_util_print_ulong(offset_for_node(func, node), "0x%lx: ");
debug_util_print_hex_bytes(&buf[0], insn->length);
debug_util_print_string("\n\n");
}
