2 * Utility functions for x86 operand and address decoding
4 * Copyright (C) Intel Corporation 2017
6 #include <linux/kernel.h>
7 #include <linux/string.h>
8 #include <linux/ratelimit.h>
9 #include <linux/mmu_context.h>
10 #include <asm/desc_defs.h>
14 #include <asm/insn-eval.h>
19 #define pr_fmt(fmt) "insn: " fmt
28 * is_string_insn() - Determine if instruction is a string instruction
29 * @insn: Instruction containing the opcode to inspect
33 * true if the instruction, determined by the opcode, is any of the
34 * string instructions as defined in the Intel Software Development manual.
37 static bool is_string_insn(struct insn *insn)
39 insn_get_opcode(insn);
41 /* All string instructions have a 1-byte opcode. */
42 if (insn->opcode.nbytes != 1)
45 switch (insn->opcode.bytes[0]) {
46 case 0x6c ... 0x6f: /* INS, OUTS */
47 case 0xa4 ... 0xa7: /* MOVS, CMPS */
48 case 0xaa ... 0xaf: /* STOS, LODS, SCAS */
56 * get_seg_reg_override_idx() - obtain segment register override index
57 * @insn: Valid instruction with segment override prefixes
59 * Inspect the instruction prefixes in @insn and find segment overrides, if any.
63 * A constant identifying the segment register to use, among CS, SS, DS,
64 * ES, FS, or GS. INAT_SEG_REG_DEFAULT is returned if no segment override
65 * prefixes were found.
67 * -EINVAL in case of error.
69 static int get_seg_reg_override_idx(struct insn *insn)
71 int idx = INAT_SEG_REG_DEFAULT;
72 int num_overrides = 0, i;
75 insn_get_prefixes(insn);
77 /* Look for any segment override prefixes. */
78 for_each_insn_prefix(insn, i, p) {
81 attr = inat_get_opcode_attribute(p);
83 case INAT_MAKE_PREFIX(INAT_PFX_CS):
84 idx = INAT_SEG_REG_CS;
87 case INAT_MAKE_PREFIX(INAT_PFX_SS):
88 idx = INAT_SEG_REG_SS;
91 case INAT_MAKE_PREFIX(INAT_PFX_DS):
92 idx = INAT_SEG_REG_DS;
95 case INAT_MAKE_PREFIX(INAT_PFX_ES):
96 idx = INAT_SEG_REG_ES;
99 case INAT_MAKE_PREFIX(INAT_PFX_FS):
100 idx = INAT_SEG_REG_FS;
103 case INAT_MAKE_PREFIX(INAT_PFX_GS):
104 idx = INAT_SEG_REG_GS;
107 /* No default action needed. */
111 /* More than one segment override prefix leads to undefined behavior. */
112 if (num_overrides > 1)
119 * check_seg_overrides() - check if segment override prefixes are allowed
120 * @insn: Valid instruction with segment override prefixes
121 * @regoff: Operand offset, in pt_regs, for which the check is performed
123 * For a particular register used in register-indirect addressing, determine if
124 * segment override prefixes can be used. Specifically, no overrides are allowed
125 * for rDI if used with a string instruction.
129 * True if segment override prefixes can be used with the register indicated
130 * in @regoff. False if otherwise.
132 static bool check_seg_overrides(struct insn *insn, int regoff)
134 if (regoff == offsetof(struct pt_regs, di) && is_string_insn(insn))
141 * resolve_default_seg() - resolve default segment register index for an operand
142 * @insn: Instruction with opcode and address size. Must be valid.
143 * @regs: Register values as seen when entering kernel mode
144 * @off: Operand offset, in pt_regs, for which resolution is needed
146 * Resolve the default segment register index associated with the instruction
147 * operand register indicated by @off. Such index is resolved based on defaults
148 * described in the Intel Software Development Manual.
152 * If in protected mode, a constant identifying the segment register to use,
153 * among CS, SS, ES or DS. If in long mode, INAT_SEG_REG_IGNORE.
155 * -EINVAL in case of error.
157 static int resolve_default_seg(struct insn *insn, struct pt_regs *regs, int off)
159 if (user_64bit_mode(regs))
160 return INAT_SEG_REG_IGNORE;
162 * Resolve the default segment register as described in Section 3.7.4
163 * of the Intel Software Development Manual Vol. 1:
165 * + DS for all references involving r[ABCD]X, and rSI.
166 * + If used in a string instruction, ES for rDI. Otherwise, DS.
167 * + AX, CX and DX are not valid register operands in 16-bit address
168 * encodings but are valid for 32-bit and 64-bit encodings.
169 * + -EDOM is reserved to identify for cases in which no register
170 * is used (i.e., displacement-only addressing). Use DS.
171 * + SS for rSP or rBP.
176 case offsetof(struct pt_regs, ax):
177 case offsetof(struct pt_regs, cx):
178 case offsetof(struct pt_regs, dx):
179 /* Need insn to verify address size. */
180 if (insn->addr_bytes == 2)
186 case offsetof(struct pt_regs, bx):
187 case offsetof(struct pt_regs, si):
188 return INAT_SEG_REG_DS;
190 case offsetof(struct pt_regs, di):
191 if (is_string_insn(insn))
192 return INAT_SEG_REG_ES;
193 return INAT_SEG_REG_DS;
195 case offsetof(struct pt_regs, bp):
196 case offsetof(struct pt_regs, sp):
197 return INAT_SEG_REG_SS;
199 case offsetof(struct pt_regs, ip):
200 return INAT_SEG_REG_CS;
208 * resolve_seg_reg() - obtain segment register index
209 * @insn: Instruction with operands
210 * @regs: Register values as seen when entering kernel mode
211 * @regoff: Operand offset, in pt_regs, used to deterimine segment register
213 * Determine the segment register associated with the operands and, if
214 * applicable, prefixes and the instruction pointed by @insn.
216 * The segment register associated to an operand used in register-indirect
217 * addressing depends on:
219 * a) Whether running in long mode (in such a case segments are ignored, except
220 * if FS or GS are used).
222 * b) Whether segment override prefixes can be used. Certain instructions and
223 * registers do not allow override prefixes.
225 * c) Whether segment overrides prefixes are found in the instruction prefixes.
227 * d) If there are not segment override prefixes or they cannot be used, the
228 * default segment register associated with the operand register is used.
230 * The function checks first if segment override prefixes can be used with the
231 * operand indicated by @regoff. If allowed, obtain such overridden segment
232 * register index. Lastly, if not prefixes were found or cannot be used, resolve
233 * the segment register index to use based on the defaults described in the
234 * Intel documentation. In long mode, all segment register indexes will be
235 * ignored, except if overrides were found for FS or GS. All these operations
236 * are done using helper functions.
238 * The operand register, @regoff, is represented as the offset from the base of
241 * As stated, the main use of this function is to determine the segment register
242 * index based on the instruction, its operands and prefixes. Hence, @insn
243 * must be valid. However, if @regoff indicates rIP, we don't need to inspect
244 * @insn at all as in this case CS is used in all cases. This case is checked
245 * before proceeding further.
247 * Please note that this function does not return the value in the segment
248 * register (i.e., the segment selector) but our defined index. The segment
249 * selector needs to be obtained using get_segment_selector() and passing the
250 * segment register index resolved by this function.
254 * An index identifying the segment register to use, among CS, SS, DS,
255 * ES, FS, or GS. INAT_SEG_REG_IGNORE is returned if running in long mode.
257 * -EINVAL in case of error.
259 static int resolve_seg_reg(struct insn *insn, struct pt_regs *regs, int regoff)
264 * In the unlikely event of having to resolve the segment register
265 * index for rIP, do it first. Segment override prefixes should not
266 * be used. Hence, it is not necessary to inspect the instruction,
267 * which may be invalid at this point.
269 if (regoff == offsetof(struct pt_regs, ip)) {
270 if (user_64bit_mode(regs))
271 return INAT_SEG_REG_IGNORE;
273 return INAT_SEG_REG_CS;
279 if (!check_seg_overrides(insn, regoff))
280 return resolve_default_seg(insn, regs, regoff);
282 idx = get_seg_reg_override_idx(insn);
286 if (idx == INAT_SEG_REG_DEFAULT)
287 return resolve_default_seg(insn, regs, regoff);
290 * In long mode, segment override prefixes are ignored, except for
291 * overrides for FS and GS.
293 if (user_64bit_mode(regs)) {
294 if (idx != INAT_SEG_REG_FS &&
295 idx != INAT_SEG_REG_GS)
296 idx = INAT_SEG_REG_IGNORE;
303 * get_segment_selector() - obtain segment selector
304 * @regs: Register values as seen when entering kernel mode
305 * @seg_reg_idx: Segment register index to use
307 * Obtain the segment selector from any of the CS, SS, DS, ES, FS, GS segment
308 * registers. In CONFIG_X86_32, the segment is obtained from either pt_regs or
309 * kernel_vm86_regs as applicable. In CONFIG_X86_64, CS and SS are obtained
310 * from pt_regs. DS, ES, FS and GS are obtained by reading the actual CPU
311 * registers. This done for only for completeness as in CONFIG_X86_64 segment
312 * registers are ignored.
316 * Value of the segment selector, including null when running in
321 static short get_segment_selector(struct pt_regs *regs, int seg_reg_idx)
326 switch (seg_reg_idx) {
327 case INAT_SEG_REG_IGNORE:
329 case INAT_SEG_REG_CS:
330 return (unsigned short)(regs->cs & 0xffff);
331 case INAT_SEG_REG_SS:
332 return (unsigned short)(regs->ss & 0xffff);
333 case INAT_SEG_REG_DS:
334 savesegment(ds, sel);
336 case INAT_SEG_REG_ES:
337 savesegment(es, sel);
339 case INAT_SEG_REG_FS:
340 savesegment(fs, sel);
342 case INAT_SEG_REG_GS:
343 savesegment(gs, sel);
348 #else /* CONFIG_X86_32 */
349 struct kernel_vm86_regs *vm86regs = (struct kernel_vm86_regs *)regs;
351 if (v8086_mode(regs)) {
352 switch (seg_reg_idx) {
353 case INAT_SEG_REG_CS:
354 return (unsigned short)(regs->cs & 0xffff);
355 case INAT_SEG_REG_SS:
356 return (unsigned short)(regs->ss & 0xffff);
357 case INAT_SEG_REG_DS:
359 case INAT_SEG_REG_ES:
361 case INAT_SEG_REG_FS:
363 case INAT_SEG_REG_GS:
365 case INAT_SEG_REG_IGNORE:
372 switch (seg_reg_idx) {
373 case INAT_SEG_REG_CS:
374 return (unsigned short)(regs->cs & 0xffff);
375 case INAT_SEG_REG_SS:
376 return (unsigned short)(regs->ss & 0xffff);
377 case INAT_SEG_REG_DS:
378 return (unsigned short)(regs->ds & 0xffff);
379 case INAT_SEG_REG_ES:
380 return (unsigned short)(regs->es & 0xffff);
381 case INAT_SEG_REG_FS:
382 return (unsigned short)(regs->fs & 0xffff);
383 case INAT_SEG_REG_GS:
385 * GS may or may not be in regs as per CONFIG_X86_32_LAZY_GS.
386 * The macro below takes care of both cases.
388 return get_user_gs(regs);
389 case INAT_SEG_REG_IGNORE:
394 #endif /* CONFIG_X86_64 */
397 static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
402 static const int regoff[] = {
403 offsetof(struct pt_regs, ax),
404 offsetof(struct pt_regs, cx),
405 offsetof(struct pt_regs, dx),
406 offsetof(struct pt_regs, bx),
407 offsetof(struct pt_regs, sp),
408 offsetof(struct pt_regs, bp),
409 offsetof(struct pt_regs, si),
410 offsetof(struct pt_regs, di),
412 offsetof(struct pt_regs, r8),
413 offsetof(struct pt_regs, r9),
414 offsetof(struct pt_regs, r10),
415 offsetof(struct pt_regs, r11),
416 offsetof(struct pt_regs, r12),
417 offsetof(struct pt_regs, r13),
418 offsetof(struct pt_regs, r14),
419 offsetof(struct pt_regs, r15),
422 int nr_registers = ARRAY_SIZE(regoff);
424 * Don't possibly decode a 32-bit instructions as
425 * reading a 64-bit-only register.
427 if (IS_ENABLED(CONFIG_X86_64) && !insn->x86_64)
432 regno = X86_MODRM_RM(insn->modrm.value);
435 * ModRM.mod == 0 and ModRM.rm == 5 means a 32-bit displacement
436 * follows the ModRM byte.
438 if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
441 if (X86_REX_B(insn->rex_prefix.value))
446 regno = X86_SIB_INDEX(insn->sib.value);
447 if (X86_REX_X(insn->rex_prefix.value))
451 * If ModRM.mod != 3 and SIB.index = 4 the scale*index
452 * portion of the address computation is null. This is
453 * true only if REX.X is 0. In such a case, the SIB index
454 * is used in the address computation.
456 if (X86_MODRM_MOD(insn->modrm.value) != 3 && regno == 4)
461 regno = X86_SIB_BASE(insn->sib.value);
463 * If ModRM.mod is 0 and SIB.base == 5, the base of the
464 * register-indirect addressing is 0. In this case, a
465 * 32-bit displacement follows the SIB byte.
467 if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
470 if (X86_REX_B(insn->rex_prefix.value))
475 pr_err_ratelimited("invalid register type: %d\n", type);
479 if (regno >= nr_registers) {
480 WARN_ONCE(1, "decoded an instruction with an invalid register");
483 return regoff[regno];
487 * get_reg_offset_16() - Obtain offset of register indicated by instruction
488 * @insn: Instruction containing ModRM byte
489 * @regs: Register values as seen when entering kernel mode
490 * @offs1: Offset of the first operand register
491 * @offs2: Offset of the second opeand register, if applicable
493 * Obtain the offset, in pt_regs, of the registers indicated by the ModRM byte
494 * in @insn. This function is to be used with 16-bit address encodings. The
495 * @offs1 and @offs2 will be written with the offset of the two registers
496 * indicated by the instruction. In cases where any of the registers is not
497 * referenced by the instruction, the value will be set to -EDOM.
501 * 0 on success, -EINVAL on error.
503 static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs,
504 int *offs1, int *offs2)
507 * 16-bit addressing can use one or two registers. Specifics of
508 * encodings are given in Table 2-1. "16-Bit Addressing Forms with the
509 * ModR/M Byte" of the Intel Software Development Manual.
511 static const int regoff1[] = {
512 offsetof(struct pt_regs, bx),
513 offsetof(struct pt_regs, bx),
514 offsetof(struct pt_regs, bp),
515 offsetof(struct pt_regs, bp),
516 offsetof(struct pt_regs, si),
517 offsetof(struct pt_regs, di),
518 offsetof(struct pt_regs, bp),
519 offsetof(struct pt_regs, bx),
522 static const int regoff2[] = {
523 offsetof(struct pt_regs, si),
524 offsetof(struct pt_regs, di),
525 offsetof(struct pt_regs, si),
526 offsetof(struct pt_regs, di),
533 if (!offs1 || !offs2)
536 /* Operand is a register, use the generic function. */
537 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
538 *offs1 = insn_get_modrm_rm_off(insn, regs);
543 *offs1 = regoff1[X86_MODRM_RM(insn->modrm.value)];
544 *offs2 = regoff2[X86_MODRM_RM(insn->modrm.value)];
547 * If ModRM.mod is 0 and ModRM.rm is 110b, then we use displacement-
548 * only addressing. This means that no registers are involved in
549 * computing the effective address. Thus, ensure that the first
550 * register offset is invalild. The second register offset is already
551 * invalid under the aforementioned conditions.
553 if ((X86_MODRM_MOD(insn->modrm.value) == 0) &&
554 (X86_MODRM_RM(insn->modrm.value) == 6))
561 * get_desc() - Obtain contents of a segment descriptor
562 * @out: Segment descriptor contents on success
563 * @sel: Segment selector
565 * Given a segment selector, obtain a pointer to the segment descriptor.
566 * Both global and local descriptor tables are supported.
570 * True on success, false on failure.
574 static bool get_desc(struct desc_struct *out, unsigned short sel)
576 struct desc_ptr gdt_desc = {0, 0};
577 unsigned long desc_base;
579 #ifdef CONFIG_MODIFY_LDT_SYSCALL
580 if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) {
581 bool success = false;
582 struct ldt_struct *ldt;
584 /* Bits [15:3] contain the index of the desired entry. */
587 mutex_lock(¤t->active_mm->context.lock);
588 ldt = current->active_mm->context.ldt;
589 if (ldt && sel < ldt->nr_entries) {
590 *out = ldt->entries[sel];
594 mutex_unlock(¤t->active_mm->context.lock);
599 native_store_gdt(&gdt_desc);
602 * Segment descriptors have a size of 8 bytes. Thus, the index is
603 * multiplied by 8 to obtain the memory offset of the desired descriptor
604 * from the base of the GDT. As bits [15:3] of the segment selector
605 * contain the index, it can be regarded as multiplied by 8 already.
606 * All that remains is to clear bits [2:0].
608 desc_base = sel & ~(SEGMENT_RPL_MASK | SEGMENT_TI_MASK);
610 if (desc_base > gdt_desc.size)
613 *out = *(struct desc_struct *)(gdt_desc.address + desc_base);
618 * insn_get_seg_base() - Obtain base address of segment descriptor.
619 * @regs: Register values as seen when entering kernel mode
620 * @seg_reg_idx: Index of the segment register pointing to seg descriptor
622 * Obtain the base address of the segment as indicated by the segment descriptor
623 * pointed by the segment selector. The segment selector is obtained from the
624 * input segment register index @seg_reg_idx.
628 * In protected mode, base address of the segment. Zero in long mode,
629 * except when FS or GS are used. In virtual-8086 mode, the segment
630 * selector shifted 4 bits to the right.
632 * -1L in case of error.
634 unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx)
636 struct desc_struct desc;
639 sel = get_segment_selector(regs, seg_reg_idx);
643 if (v8086_mode(regs))
645 * Base is simply the segment selector shifted 4
648 return (unsigned long)(sel << 4);
650 if (user_64bit_mode(regs)) {
652 * Only FS or GS will have a base address, the rest of
653 * the segments' bases are forced to 0.
657 if (seg_reg_idx == INAT_SEG_REG_FS)
658 rdmsrl(MSR_FS_BASE, base);
659 else if (seg_reg_idx == INAT_SEG_REG_GS)
661 * swapgs was called at the kernel entry point. Thus,
662 * MSR_KERNEL_GS_BASE will have the user-space GS base.
664 rdmsrl(MSR_KERNEL_GS_BASE, base);
670 /* In protected mode the segment selector cannot be null. */
674 if (!get_desc(&desc, sel))
677 return get_desc_base(&desc);
681 * get_seg_limit() - Obtain the limit of a segment descriptor
682 * @regs: Register values as seen when entering kernel mode
683 * @seg_reg_idx: Index of the segment register pointing to seg descriptor
685 * Obtain the limit of the segment as indicated by the segment descriptor
686 * pointed by the segment selector. The segment selector is obtained from the
687 * input segment register index @seg_reg_idx.
691 * In protected mode, the limit of the segment descriptor in bytes.
692 * In long mode and virtual-8086 mode, segment limits are not enforced. Thus,
693 * limit is returned as -1L to imply a limit-less segment.
695 * Zero is returned on error.
697 static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)
699 struct desc_struct desc;
703 sel = get_segment_selector(regs, seg_reg_idx);
707 if (user_64bit_mode(regs) || v8086_mode(regs))
713 if (!get_desc(&desc, sel))
717 * If the granularity bit is set, the limit is given in multiples
718 * of 4096. This also means that the 12 least significant bits are
719 * not tested when checking the segment limits. In practice,
720 * this means that the segment ends in (limit << 12) + 0xfff.
722 limit = get_desc_limit(&desc);
724 limit = (limit << 12) + 0xfff;
730 * insn_get_code_seg_params() - Obtain code segment parameters
731 * @regs: Structure with register values as seen when entering kernel mode
733 * Obtain address and operand sizes of the code segment. It is obtained from the
734 * selector contained in the CS register in regs. In protected mode, the default
735 * address is determined by inspecting the L and D bits of the segment
736 * descriptor. In virtual-8086 mode, the default is always two bytes for both
737 * address and operand sizes.
741 * An int containing ORed-in default parameters on success.
745 int insn_get_code_seg_params(struct pt_regs *regs)
747 struct desc_struct desc;
750 if (v8086_mode(regs))
751 /* Address and operand size are both 16-bit. */
752 return INSN_CODE_SEG_PARAMS(2, 2);
754 sel = get_segment_selector(regs, INAT_SEG_REG_CS);
758 if (!get_desc(&desc, sel))
762 * The most significant byte of the Type field of the segment descriptor
763 * determines whether a segment contains data or code. If this is a data
764 * segment, return error.
766 if (!(desc.type & BIT(3)))
769 switch ((desc.l << 1) | desc.d) {
771 * Legacy mode. CS.L=0, CS.D=0. Address and operand size are
774 return INSN_CODE_SEG_PARAMS(2, 2);
776 * Legacy mode. CS.L=0, CS.D=1. Address and operand size are
779 return INSN_CODE_SEG_PARAMS(4, 4);
781 * IA-32e 64-bit mode. CS.L=1, CS.D=0. Address size is 64-bit;
782 * operand size is 32-bit.
784 return INSN_CODE_SEG_PARAMS(4, 8);
785 case 3: /* Invalid setting. CS.L=1, CS.D=1 */
793 * insn_get_modrm_rm_off() - Obtain register in r/m part of the ModRM byte
794 * @insn: Instruction containing the ModRM byte
795 * @regs: Register values as seen when entering kernel mode
799 * The register indicated by the r/m part of the ModRM byte. The
800 * register is obtained as an offset from the base of pt_regs. In specific
801 * cases, the returned value can be -EDOM to indicate that the particular value
802 * of ModRM does not refer to a register and shall be ignored.
804 int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs)
806 return get_reg_offset(insn, regs, REG_TYPE_RM);
810 * get_seg_base_limit() - obtain base address and limit of a segment
811 * @insn: Instruction. Must be valid.
812 * @regs: Register values as seen when entering kernel mode
813 * @regoff: Operand offset, in pt_regs, used to resolve segment descriptor
814 * @base: Obtained segment base
815 * @limit: Obtained segment limit
817 * Obtain the base address and limit of the segment associated with the operand
818 * @regoff and, if any or allowed, override prefixes in @insn. This function is
819 * different from insn_get_seg_base() as the latter does not resolve the segment
820 * associated with the instruction operand. If a limit is not needed (e.g.,
821 * when running in long mode), @limit can be NULL.
825 * 0 on success. @base and @limit will contain the base address and of the
826 * resolved segment, respectively.
830 static int get_seg_base_limit(struct insn *insn, struct pt_regs *regs,
831 int regoff, unsigned long *base,
832 unsigned long *limit)
839 seg_reg_idx = resolve_seg_reg(insn, regs, regoff);
843 *base = insn_get_seg_base(regs, seg_reg_idx);
850 *limit = get_seg_limit(regs, seg_reg_idx);
858 * get_eff_addr_reg() - Obtain effective address from register operand
859 * @insn: Instruction. Must be valid.
860 * @regs: Register values as seen when entering kernel mode
861 * @regoff: Obtained operand offset, in pt_regs, with the effective address
862 * @eff_addr: Obtained effective address
864 * Obtain the effective address stored in the register operand as indicated by
865 * the ModRM byte. This function is to be used only with register addressing
866 * (i.e., ModRM.mod is 3). The effective address is saved in @eff_addr. The
867 * register operand, as an offset from the base of pt_regs, is saved in @regoff;
868 * such offset can then be used to resolve the segment associated with the
869 * operand. This function can be used with any of the supported address sizes
874 * 0 on success. @eff_addr will have the effective address stored in the
875 * operand indicated by ModRM. @regoff will have such operand as an offset from
876 * the base of pt_regs.
880 static int get_eff_addr_reg(struct insn *insn, struct pt_regs *regs,
881 int *regoff, long *eff_addr)
883 insn_get_modrm(insn);
885 if (!insn->modrm.nbytes)
888 if (X86_MODRM_MOD(insn->modrm.value) != 3)
891 *regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
895 /* Ignore bytes that are outside the address size. */
896 if (insn->addr_bytes == 2)
897 *eff_addr = regs_get_register(regs, *regoff) & 0xffff;
898 else if (insn->addr_bytes == 4)
899 *eff_addr = regs_get_register(regs, *regoff) & 0xffffffff;
900 else /* 64-bit address */
901 *eff_addr = regs_get_register(regs, *regoff);
907 * get_eff_addr_modrm() - Obtain referenced effective address via ModRM
908 * @insn: Instruction. Must be valid.
909 * @regs: Register values as seen when entering kernel mode
910 * @regoff: Obtained operand offset, in pt_regs, associated with segment
911 * @eff_addr: Obtained effective address
913 * Obtain the effective address referenced by the ModRM byte of @insn. After
914 * identifying the registers involved in the register-indirect memory reference,
915 * its value is obtained from the operands in @regs. The computed address is
916 * stored @eff_addr. Also, the register operand that indicates the associated
917 * segment is stored in @regoff, this parameter can later be used to determine
922 * 0 on success. @eff_addr will have the referenced effective address. @regoff
923 * will have a register, as an offset from the base of pt_regs, that can be used
924 * to resolve the associated segment.
928 static int get_eff_addr_modrm(struct insn *insn, struct pt_regs *regs,
929 int *regoff, long *eff_addr)
933 if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
936 insn_get_modrm(insn);
938 if (!insn->modrm.nbytes)
941 if (X86_MODRM_MOD(insn->modrm.value) > 2)
944 *regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
947 * -EDOM means that we must ignore the address_offset. In such a case,
948 * in 64-bit mode the effective address relative to the rIP of the
949 * following instruction.
951 if (*regoff == -EDOM) {
952 if (user_64bit_mode(regs))
953 tmp = regs->ip + insn->length;
956 } else if (*regoff < 0) {
959 tmp = regs_get_register(regs, *regoff);
962 if (insn->addr_bytes == 4) {
963 int addr32 = (int)(tmp & 0xffffffff) + insn->displacement.value;
965 *eff_addr = addr32 & 0xffffffff;
967 *eff_addr = tmp + insn->displacement.value;
974 * get_eff_addr_modrm_16() - Obtain referenced effective address via ModRM
975 * @insn: Instruction. Must be valid.
976 * @regs: Register values as seen when entering kernel mode
977 * @regoff: Obtained operand offset, in pt_regs, associated with segment
978 * @eff_addr: Obtained effective address
980 * Obtain the 16-bit effective address referenced by the ModRM byte of @insn.
981 * After identifying the registers involved in the register-indirect memory
982 * reference, its value is obtained from the operands in @regs. The computed
983 * address is stored @eff_addr. Also, the register operand that indicates
984 * the associated segment is stored in @regoff, this parameter can later be used
985 * to determine such segment.
989 * 0 on success. @eff_addr will have the referenced effective address. @regoff
990 * will have a register, as an offset from the base of pt_regs, that can be used
991 * to resolve the associated segment.
995 static int get_eff_addr_modrm_16(struct insn *insn, struct pt_regs *regs,
996 int *regoff, short *eff_addr)
998 int addr_offset1, addr_offset2, ret;
999 short addr1 = 0, addr2 = 0, displacement;
1001 if (insn->addr_bytes != 2)
1004 insn_get_modrm(insn);
1006 if (!insn->modrm.nbytes)
1009 if (X86_MODRM_MOD(insn->modrm.value) > 2)
1012 ret = get_reg_offset_16(insn, regs, &addr_offset1, &addr_offset2);
1017 * Don't fail on invalid offset values. They might be invalid because
1018 * they cannot be used for this particular value of ModRM. Instead, use
1019 * them in the computation only if they contain a valid value.
1021 if (addr_offset1 != -EDOM)
1022 addr1 = regs_get_register(regs, addr_offset1) & 0xffff;
1024 if (addr_offset2 != -EDOM)
1025 addr2 = regs_get_register(regs, addr_offset2) & 0xffff;
1027 displacement = insn->displacement.value & 0xffff;
1028 *eff_addr = addr1 + addr2 + displacement;
1031 * The first operand register could indicate to use of either SS or DS
1032 * registers to obtain the segment selector. The second operand
1033 * register can only indicate the use of DS. Thus, the first operand
1034 * will be used to obtain the segment selector.
1036 *regoff = addr_offset1;
1042 * get_eff_addr_sib() - Obtain referenced effective address via SIB
1043 * @insn: Instruction. Must be valid.
1044 * @regs: Register values as seen when entering kernel mode
1045 * @regoff: Obtained operand offset, in pt_regs, associated with segment
1046 * @eff_addr: Obtained effective address
1048 * Obtain the effective address referenced by the SIB byte of @insn. After
1049 * identifying the registers involved in the indexed, register-indirect memory
1050 * reference, its value is obtained from the operands in @regs. The computed
1051 * address is stored @eff_addr. Also, the register operand that indicates the
1052 * associated segment is stored in @regoff, this parameter can later be used to
1053 * determine such segment.
1057 * 0 on success. @eff_addr will have the referenced effective address.
1058 * @base_offset will have a register, as an offset from the base of pt_regs,
1059 * that can be used to resolve the associated segment.
1063 static int get_eff_addr_sib(struct insn *insn, struct pt_regs *regs,
1064 int *base_offset, long *eff_addr)
1069 if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
1072 insn_get_modrm(insn);
1074 if (!insn->modrm.nbytes)
1077 if (X86_MODRM_MOD(insn->modrm.value) > 2)
1082 if (!insn->sib.nbytes)
1085 *base_offset = get_reg_offset(insn, regs, REG_TYPE_BASE);
1086 indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX);
1089 * Negative values in the base and index offset means an error when
1090 * decoding the SIB byte. Except -EDOM, which means that the registers
1091 * should not be used in the address computation.
1093 if (*base_offset == -EDOM)
1095 else if (*base_offset < 0)
1098 base = regs_get_register(regs, *base_offset);
1100 if (indx_offset == -EDOM)
1102 else if (indx_offset < 0)
1105 indx = regs_get_register(regs, indx_offset);
1107 if (insn->addr_bytes == 4) {
1108 int addr32, base32, idx32;
1110 base32 = base & 0xffffffff;
1111 idx32 = indx & 0xffffffff;
1113 addr32 = base32 + idx32 * (1 << X86_SIB_SCALE(insn->sib.value));
1114 addr32 += insn->displacement.value;
1116 *eff_addr = addr32 & 0xffffffff;
1118 *eff_addr = base + indx * (1 << X86_SIB_SCALE(insn->sib.value));
1119 *eff_addr += insn->displacement.value;
1126 * get_addr_ref_16() - Obtain the 16-bit address referred by instruction
1127 * @insn: Instruction containing ModRM byte and displacement
1128 * @regs: Register values as seen when entering kernel mode
1130 * This function is to be used with 16-bit address encodings. Obtain the memory
1131 * address referred by the instruction's ModRM and displacement bytes. Also, the
1132 * segment used as base is determined by either any segment override prefixes in
1133 * @insn or the default segment of the registers involved in the address
1134 * computation. In protected mode, segment limits are enforced.
1138 * Linear address referenced by the instruction operands on success.
1142 static void __user *get_addr_ref_16(struct insn *insn, struct pt_regs *regs)
1144 unsigned long linear_addr = -1L, seg_base, seg_limit;
1149 insn_get_modrm(insn);
1150 insn_get_displacement(insn);
1152 if (insn->addr_bytes != 2)
1155 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1156 ret = get_eff_addr_reg(insn, regs, ®off, &tmp);
1162 ret = get_eff_addr_modrm_16(insn, regs, ®off, &eff_addr);
1167 ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
1172 * Before computing the linear address, make sure the effective address
1173 * is within the limits of the segment. In virtual-8086 mode, segment
1174 * limits are not enforced. In such a case, the segment limit is -1L to
1175 * reflect this fact.
1177 if ((unsigned long)(eff_addr & 0xffff) > seg_limit)
1180 linear_addr = (unsigned long)(eff_addr & 0xffff) + seg_base;
1182 /* Limit linear address to 20 bits */
1183 if (v8086_mode(regs))
1184 linear_addr &= 0xfffff;
1187 return (void __user *)linear_addr;
1191 * get_addr_ref_32() - Obtain a 32-bit linear address
1192 * @insn: Instruction with ModRM, SIB bytes and displacement
1193 * @regs: Register values as seen when entering kernel mode
1195 * This function is to be used with 32-bit address encodings to obtain the
1196 * linear memory address referred by the instruction's ModRM, SIB,
1197 * displacement bytes and segment base address, as applicable. If in protected
1198 * mode, segment limits are enforced.
1202 * Linear address referenced by instruction and registers on success.
1206 static void __user *get_addr_ref_32(struct insn *insn, struct pt_regs *regs)
1208 unsigned long linear_addr = -1L, seg_base, seg_limit;
1209 int eff_addr, regoff;
1213 if (insn->addr_bytes != 4)
1216 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1217 ret = get_eff_addr_reg(insn, regs, ®off, &tmp);
1224 if (insn->sib.nbytes) {
1225 ret = get_eff_addr_sib(insn, regs, ®off, &tmp);
1231 ret = get_eff_addr_modrm(insn, regs, ®off, &tmp);
1239 ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
1244 * In protected mode, before computing the linear address, make sure
1245 * the effective address is within the limits of the segment.
1246 * 32-bit addresses can be used in long and virtual-8086 modes if an
1247 * address override prefix is used. In such cases, segment limits are
1248 * not enforced. When in virtual-8086 mode, the segment limit is -1L
1249 * to reflect this situation.
1251 * After computed, the effective address is treated as an unsigned
1254 if (!user_64bit_mode(regs) && ((unsigned int)eff_addr > seg_limit))
1258 * Even though 32-bit address encodings are allowed in virtual-8086
1259 * mode, the address range is still limited to [0x-0xffff].
1261 if (v8086_mode(regs) && (eff_addr & ~0xffff))
1265 * Data type long could be 64 bits in size. Ensure that our 32-bit
1266 * effective address is not sign-extended when computing the linear
1269 linear_addr = (unsigned long)(eff_addr & 0xffffffff) + seg_base;
1271 /* Limit linear address to 20 bits */
1272 if (v8086_mode(regs))
1273 linear_addr &= 0xfffff;
1276 return (void __user *)linear_addr;
1280 * get_addr_ref_64() - Obtain a 64-bit linear address
1281 * @insn: Instruction struct with ModRM and SIB bytes and displacement
1282 * @regs: Structure with register values as seen when entering kernel mode
1284 * This function is to be used with 64-bit address encodings to obtain the
1285 * linear memory address referred by the instruction's ModRM, SIB,
1286 * displacement bytes and segment base address, as applicable.
1290 * Linear address referenced by instruction and registers on success.
1294 #ifndef CONFIG_X86_64
1295 static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
1297 return (void __user *)-1L;
1300 static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
1302 unsigned long linear_addr = -1L, seg_base;
1306 if (insn->addr_bytes != 8)
1309 if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1310 ret = get_eff_addr_reg(insn, regs, ®off, &eff_addr);
1315 if (insn->sib.nbytes) {
1316 ret = get_eff_addr_sib(insn, regs, ®off, &eff_addr);
1320 ret = get_eff_addr_modrm(insn, regs, ®off, &eff_addr);
1327 ret = get_seg_base_limit(insn, regs, regoff, &seg_base, NULL);
1331 linear_addr = (unsigned long)eff_addr + seg_base;
1334 return (void __user *)linear_addr;
1336 #endif /* CONFIG_X86_64 */
1339 * insn_get_addr_ref() - Obtain the linear address referred by instruction
1340 * @insn: Instruction structure containing ModRM byte and displacement
1341 * @regs: Structure with register values as seen when entering kernel mode
1343 * Obtain the linear address referred by the instruction's ModRM, SIB and
1344 * displacement bytes, and segment base, as applicable. In protected mode,
1345 * segment limits are enforced.
1349 * Linear address referenced by instruction and registers on success.
1353 void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs)
1356 return (void __user *)-1L;
1358 switch (insn->addr_bytes) {
1360 return get_addr_ref_16(insn, regs);
1362 return get_addr_ref_32(insn, regs);
1364 return get_addr_ref_64(insn, regs);
1366 return (void __user *)-1L;