/** * insn_get_prefixes - scan x86 instruction prefix bytes * @insn: &struct insn containing instruction * * Populates the @insn->prefixes bitmap, and updates @insn->next_byte * to point to the (first) opcode. No effect if @insn->prefixes.got * is already set. */ void insn_get_prefixes(struct insn *insn) { struct insn_field *prefixes = &insn->prefixes; insn_attr_t attr; insn_byte_t b, lb; int i, nb; if (prefixes->got) return; nb = 0; lb = 0; b = peek_next(insn_byte_t, insn); attr = inat_get_opcode_attribute(b); while (inat_is_legacy_prefix(attr)) { /* Skip if same prefix */ for (i = 0; i < nb; i++) if (prefixes->bytes[i] == b) goto found; if (nb == 4) /* Invalid instruction */ break; prefixes->bytes[nb++] = b; if (inat_is_address_size_prefix(attr)) { /* address size switches 2/4 or 4/8 */ if (insn->x86_64) insn->addr_bytes ^= 12; else insn->addr_bytes ^= 6; } else if (inat_is_operand_size_prefix(attr)) { /* oprand size switches 2/4 */ insn->opnd_bytes ^= 6; } found: prefixes->nbytes++; insn->next_byte++; lb = b; b = peek_next(insn_byte_t, insn); attr = inat_get_opcode_attribute(b); } /* Set the last prefix */ if (lb && lb != insn->prefixes.bytes[3]) { if (unlikely(insn->prefixes.bytes[3])) { /* Swap the last prefix */ b = insn->prefixes.bytes[3]; for (i = 0; i < nb; i++) if (prefixes->bytes[i] == lb) prefixes->bytes[i] = b; } insn->prefixes.bytes[3] = lb; } /* Decode REX prefix */ if (insn->x86_64) { b = peek_next(insn_byte_t, insn); attr = inat_get_opcode_attribute(b); if (inat_is_rex_prefix(attr)) { insn->rex_prefix.value = b; insn->rex_prefix.nbytes = 1; insn->next_byte++; if (X86_REX_W(b)) /* REX.W overrides opnd_size */ insn->opnd_bytes = 8; } } insn->rex_prefix.got = 1; /* Decode VEX prefix */ b = peek_next(insn_byte_t, insn); attr = inat_get_opcode_attribute(b); if (inat_is_vex_prefix(attr)) { insn_byte_t b2 = peek_nbyte_next(insn_byte_t, insn, 1); if (!insn->x86_64) { /* * In 32-bits mode, if the [7:6] bits (mod bits of * ModRM) on the second byte are not 11b, it is * LDS or LES. */ if (X86_MODRM_MOD(b2) != 3) goto vex_end; } insn->vex_prefix.bytes[0] = b; insn->vex_prefix.bytes[1] = b2; if (inat_is_vex3_prefix(attr)) { b2 = peek_nbyte_next(insn_byte_t, insn, 2); insn->vex_prefix.bytes[2] = b2; insn->vex_prefix.nbytes = 3; insn->next_byte += 3; if (insn->x86_64 && X86_VEX_W(b2)) /* VEX.W overrides opnd_size */ insn->opnd_bytes = 8; } else { insn->vex_prefix.nbytes = 2; insn->next_byte += 2; } } vex_end: insn->vex_prefix.got = 1; prefixes->got = 1; return; }
static void print_ir_node(struct kedr_ifunc *func, struct kedr_ir_node *node, struct kedr_ir_node *start) { u8 buf[X86_MAX_INSN_SIZE]; struct insn *insn = &node->insn; u8 *pos; u8 opcode; u8 modrm; int is_mov_imm_to_reg; if (node->dest_inner != NULL) debug_util_print_ulong( offset_for_node(func, node->dest_inner), "Jump to 0x%lx\n"); memcpy(&buf[0], &node->insn_buffer[0], X86_MAX_INSN_SIZE); opcode = insn->opcode.bytes[0]; modrm = insn->modrm.bytes[0]; /* Non-zero for MOV imm32/64, %reg. */ is_mov_imm_to_reg = ((opcode == 0xc7 && X86_MODRM_REG(modrm) == 0) || (opcode >= 0xb8 && opcode <= 0xbf)); /* For the indirect near jumps using a jump table, as well as * for other instructions using similar addressing expressions * we cannot determine the address of the table in advance to * prepare the expected dump properly. Let us just put 0 here. */ if (X86_MODRM_RM(modrm) == 4 && insn->displacement.nbytes == 4) { /* SIB and disp32 are used. * [NB] If mod == 3, displacement.nbytes is 0. */ pos = buf + insn_offset_displacement(&node->insn); *(u32 *)pos = 0; } else if (opcode == 0xe8 || opcode == 0xe9 || (opcode == 0x0f && (insn->opcode.bytes[1] & 0xf0) == 0x80)) { /* same for the relative near calls and jumps */ pos = buf + insn_offset_immediate(insn); *(u32 *)pos = 0; } else if ((insn->modrm.bytes[0] & 0xc7) == 0x5) { /* same for the insns with IP-relative addressing (x86-64) * and with plain disp32 addressing (x86-32). */ pos = buf + insn_offset_displacement(insn); *(u32 *)pos = 0; } #ifdef CONFIG_X86_64 else if (start != NULL && is_mov_imm_to_reg && X86_REX_W(insn->rex_prefix.value)) { /* MOV imm64, %reg, check if imm64 is the address of * a call_info or a block_info instance */ u64 imm64 = ((u64)insn->immediate2.value << 32) | (u64)(u32)insn->immediate1.value; /* [NB] insn->immediate*.value is signed by default, so we * cast it to u32 here first to avoid sign extension which * would lead to incorrectly calculated value of 'imm64'. */ if (imm64 == (u64)(unsigned long)start->block_info) { debug_util_print_ulong(offset_for_node(func, start), "Ref. to block_info for the block at 0x%lx\n"); } if (imm64 == (u64)(unsigned long)start->call_info) { /* 'start' should be the only reference node of the * block in this case. */ debug_util_print_ulong(offset_for_node(func, start), "Ref. to call_info for the node at 0x%lx\n"); } /* Zero the immediate value anyway */ pos = buf + insn_offset_immediate(insn); *(u64 *)pos = 0; } #else /* x86-32 */ else if (start != NULL && is_mov_imm_to_reg) { /* "MOV imm32, r/m32", check if imm32 is the address of * a call_info or a block_info instance */ u32 imm32 = (u32)insn->immediate.value; if (imm32 == (u32)(unsigned long)start->block_info) { pos = buf + insn_offset_immediate(insn); *(u32 *)pos = 0; debug_util_print_ulong(offset_for_node(func, start), "Ref. to block_info for the block at 0x%lx\n"); } if (imm32 == (u32)(unsigned long)start->call_info) { pos = buf + insn_offset_immediate(insn); *(u32 *)pos = 0; /* 'start' should be the only reference node of the * block in this case. */ debug_util_print_ulong(offset_for_node(func, start), "Ref. to call_info for the node at 0x%lx\n"); } /* Zero the immediate value anyway */ pos = buf + insn_offset_immediate(insn); *(u32 *)pos = 0; } #endif else if (start == NULL && is_mov_imm_to_reg) { /* MOV imm32/imm64, %rax in the entry handler. */ pos = buf + insn_offset_immediate(insn); *(unsigned long *)pos = 0; } else if (opcode >= 0xa0 && opcode <= 0xa3) { /* direct offset MOV, zero the address */ pos = buf + insn_offset_immediate(insn); *(unsigned long *)pos = 0; } debug_util_print_ulong(offset_for_node(func, node), "0x%lx: "); debug_util_print_hex_bytes(&buf[0], insn->length); debug_util_print_string("\n\n"); }