/** * insn_get_displacement() - Get the displacement of instruction * @insn: &struct insn containing instruction * * If necessary, first collects the instruction up to and including the * SIB byte. * Displacement value is sign-expanded. */ void insn_get_displacement(struct insn *insn) { insn_byte_t mod, rm, base; if (insn->displacement.got) return; if (!insn->sib.got) insn_get_sib(insn); if (insn->modrm.nbytes) { /* * Interpreting the modrm byte: * mod = 00 - no displacement fields (exceptions below) * mod = 01 - 1-byte displacement field * mod = 10 - displacement field is 4 bytes, or 2 bytes if * address size = 2 (0x67 prefix in 32-bit mode) * mod = 11 - no memory operand * * If address size = 2... * mod = 00, r/m = 110 - displacement field is 2 bytes * * If address size != 2... * mod != 11, r/m = 100 - SIB byte exists * mod = 00, SIB base = 101 - displacement field is 4 bytes * mod = 00, r/m = 101 - rip-relative addressing, displacement * field is 4 bytes */ mod = X86_MODRM_MOD(insn->modrm.value); rm = X86_MODRM_RM(insn->modrm.value); base = X86_SIB_BASE(insn->sib.value); if (mod == 3) goto out; if (mod == 1) { insn->displacement.value = get_next(char, insn); insn->displacement.nbytes = 1; } else if (insn->addr_bytes == 2) {
/** * insn_get_sib() - Get the SIB byte of instruction * @insn: &struct insn containing instruction * * If necessary, first collects the instruction up to and including the * ModRM byte. */ void insn_get_sib(struct insn *insn) { insn_byte_t modrm; if (insn->sib.got) return; if (!insn->modrm.got) insn_get_modrm(insn); if (insn->modrm.nbytes) { modrm = (insn_byte_t)insn->modrm.value; if (insn->addr_bytes != 2 && X86_MODRM_MOD(modrm) != 3 && X86_MODRM_RM(modrm) == 4) { insn->sib.value = get_next(insn_byte_t, insn); insn->sib.nbytes = 1; } } insn->sib.got = 1; }
static int get_reg_offset(struct insn *insn, struct pt_regs *regs, enum reg_type type) { int regno = 0; static const int regoff[] = { offsetof(struct pt_regs, ax), offsetof(struct pt_regs, cx), offsetof(struct pt_regs, dx), offsetof(struct pt_regs, bx), offsetof(struct pt_regs, sp), offsetof(struct pt_regs, bp), offsetof(struct pt_regs, si), offsetof(struct pt_regs, di), #ifdef CONFIG_X86_64 offsetof(struct pt_regs, r8), offsetof(struct pt_regs, r9), offsetof(struct pt_regs, r10), offsetof(struct pt_regs, r11), offsetof(struct pt_regs, r12), offsetof(struct pt_regs, r13), offsetof(struct pt_regs, r14), offsetof(struct pt_regs, r15), #endif }; int nr_registers = ARRAY_SIZE(regoff); /* * Don't possibly decode a 32-bit instructions as * reading a 64-bit-only register. */ if (IS_ENABLED(CONFIG_X86_64) && !insn->x86_64) nr_registers -= 8; switch (type) { case REG_TYPE_RM: regno = X86_MODRM_RM(insn->modrm.value); if (X86_REX_B(insn->rex_prefix.value) == 1) regno += 8; break; case REG_TYPE_INDEX: regno = X86_SIB_INDEX(insn->sib.value); if (X86_REX_X(insn->rex_prefix.value) == 1) regno += 8; break; case REG_TYPE_BASE: regno = X86_SIB_BASE(insn->sib.value); if (X86_REX_B(insn->rex_prefix.value) == 1) regno += 8; break; default: pr_err("invalid register type"); BUG(); break; } if (regno > nr_registers) { WARN_ONCE(1, "decoded an instruction with an invalid register"); return -EINVAL; } return regoff[regno]; }
static void print_ir_node(struct kedr_ifunc *func, struct kedr_ir_node *node, struct kedr_ir_node *start) { u8 buf[X86_MAX_INSN_SIZE]; struct insn *insn = &node->insn; u8 *pos; u8 opcode; u8 modrm; int is_mov_imm_to_reg; if (node->dest_inner != NULL) debug_util_print_ulong( offset_for_node(func, node->dest_inner), "Jump to 0x%lx\n"); memcpy(&buf[0], &node->insn_buffer[0], X86_MAX_INSN_SIZE); opcode = insn->opcode.bytes[0]; modrm = insn->modrm.bytes[0]; /* Non-zero for MOV imm32/64, %reg. */ is_mov_imm_to_reg = ((opcode == 0xc7 && X86_MODRM_REG(modrm) == 0) || (opcode >= 0xb8 && opcode <= 0xbf)); /* For the indirect near jumps using a jump table, as well as * for other instructions using similar addressing expressions * we cannot determine the address of the table in advance to * prepare the expected dump properly. Let us just put 0 here. */ if (X86_MODRM_RM(modrm) == 4 && insn->displacement.nbytes == 4) { /* SIB and disp32 are used. * [NB] If mod == 3, displacement.nbytes is 0. */ pos = buf + insn_offset_displacement(&node->insn); *(u32 *)pos = 0; } else if (opcode == 0xe8 || opcode == 0xe9 || (opcode == 0x0f && (insn->opcode.bytes[1] & 0xf0) == 0x80)) { /* same for the relative near calls and jumps */ pos = buf + insn_offset_immediate(insn); *(u32 *)pos = 0; } else if ((insn->modrm.bytes[0] & 0xc7) == 0x5) { /* same for the insns with IP-relative addressing (x86-64) * and with plain disp32 addressing (x86-32). */ pos = buf + insn_offset_displacement(insn); *(u32 *)pos = 0; } #ifdef CONFIG_X86_64 else if (start != NULL && is_mov_imm_to_reg && X86_REX_W(insn->rex_prefix.value)) { /* MOV imm64, %reg, check if imm64 is the address of * a call_info or a block_info instance */ u64 imm64 = ((u64)insn->immediate2.value << 32) | (u64)(u32)insn->immediate1.value; /* [NB] insn->immediate*.value is signed by default, so we * cast it to u32 here first to avoid sign extension which * would lead to incorrectly calculated value of 'imm64'. */ if (imm64 == (u64)(unsigned long)start->block_info) { debug_util_print_ulong(offset_for_node(func, start), "Ref. to block_info for the block at 0x%lx\n"); } if (imm64 == (u64)(unsigned long)start->call_info) { /* 'start' should be the only reference node of the * block in this case. */ debug_util_print_ulong(offset_for_node(func, start), "Ref. to call_info for the node at 0x%lx\n"); } /* Zero the immediate value anyway */ pos = buf + insn_offset_immediate(insn); *(u64 *)pos = 0; } #else /* x86-32 */ else if (start != NULL && is_mov_imm_to_reg) { /* "MOV imm32, r/m32", check if imm32 is the address of * a call_info or a block_info instance */ u32 imm32 = (u32)insn->immediate.value; if (imm32 == (u32)(unsigned long)start->block_info) { pos = buf + insn_offset_immediate(insn); *(u32 *)pos = 0; debug_util_print_ulong(offset_for_node(func, start), "Ref. to block_info for the block at 0x%lx\n"); } if (imm32 == (u32)(unsigned long)start->call_info) { pos = buf + insn_offset_immediate(insn); *(u32 *)pos = 0; /* 'start' should be the only reference node of the * block in this case. */ debug_util_print_ulong(offset_for_node(func, start), "Ref. to call_info for the node at 0x%lx\n"); } /* Zero the immediate value anyway */ pos = buf + insn_offset_immediate(insn); *(u32 *)pos = 0; } #endif else if (start == NULL && is_mov_imm_to_reg) { /* MOV imm32/imm64, %rax in the entry handler. */ pos = buf + insn_offset_immediate(insn); *(unsigned long *)pos = 0; } else if (opcode >= 0xa0 && opcode <= 0xa3) { /* direct offset MOV, zero the address */ pos = buf + insn_offset_immediate(insn); *(unsigned long *)pos = 0; } debug_util_print_ulong(offset_for_node(func, node), "0x%lx: "); debug_util_print_hex_bytes(&buf[0], insn->length); debug_util_print_string("\n\n"); }