• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * x86 instruction analysis
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License as published by
6  * the Free Software Foundation; either version 2 of the License, or
7  * (at your option) any later version.
8  *
9  * This program is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12  * GNU General Public License for more details.
13  *
14  * You should have received a copy of the GNU General Public License
15  * along with this program; if not, write to the Free Software
16  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
17  *
18  * Copyright (C) IBM Corporation, 2002, 2004, 2009
19  */
20 
21 #ifdef __KERNEL__
22 #include <linux/string.h>
23 #else
24 #include <string.h>
25 #endif
26 #include <asm/inat.h>
27 #include <asm/insn.h>
28 
29 /* Verify next sizeof(t) bytes can be on the same instruction */
30 #define validate_next(t, insn, n)	\
31 	((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr)
32 
33 #define __get_next(t, insn)	\
34 	({ t r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
35 
36 #define __peek_nbyte_next(t, insn, n)	\
37 	({ t r = *(t*)((insn)->next_byte + n); r; })
38 
39 #define get_next(t, insn)	\
40 	({ if (unlikely(!validate_next(t, insn, 0))) goto err_out; __get_next(t, insn); })
41 
42 #define peek_nbyte_next(t, insn, n)	\
43 	({ if (unlikely(!validate_next(t, insn, n))) goto err_out; __peek_nbyte_next(t, insn, n); })
44 
45 #define peek_next(t, insn)	peek_nbyte_next(t, insn, 0)
46 
47 /**
48  * insn_init() - initialize struct insn
49  * @insn:	&struct insn to be initialized
50  * @kaddr:	address (in kernel memory) of instruction (or copy thereof)
51  * @x86_64:	!0 for 64-bit kernel or 64-bit app
52  */
insn_init(struct insn * insn,const void * kaddr,int buf_len,int x86_64)53 void insn_init(struct insn *insn, const void *kaddr, int buf_len, int x86_64)
54 {
55 	/*
56 	 * Instructions longer than MAX_INSN_SIZE (15 bytes) are invalid
57 	 * even if the input buffer is long enough to hold them.
58 	 */
59 	if (buf_len > MAX_INSN_SIZE)
60 		buf_len = MAX_INSN_SIZE;
61 
62 	memset(insn, 0, sizeof(*insn));
63 	insn->kaddr = kaddr;
64 	insn->end_kaddr = kaddr + buf_len;
65 	insn->next_byte = kaddr;
66 	insn->x86_64 = x86_64 ? 1 : 0;
67 	insn->opnd_bytes = 4;
68 	if (x86_64)
69 		insn->addr_bytes = 8;
70 	else
71 		insn->addr_bytes = 4;
72 }
73 
74 /**
75  * insn_get_prefixes - scan x86 instruction prefix bytes
76  * @insn:	&struct insn containing instruction
77  *
78  * Populates the @insn->prefixes bitmap, and updates @insn->next_byte
79  * to point to the (first) opcode.  No effect if @insn->prefixes.got
80  * is already set.
81  */
insn_get_prefixes(struct insn * insn)82 void insn_get_prefixes(struct insn *insn)
83 {
84 	struct insn_field *prefixes = &insn->prefixes;
85 	insn_attr_t attr;
86 	insn_byte_t b, lb;
87 	int i, nb;
88 
89 	if (prefixes->got)
90 		return;
91 
92 	nb = 0;
93 	lb = 0;
94 	b = peek_next(insn_byte_t, insn);
95 	attr = inat_get_opcode_attribute(b);
96 	while (inat_is_legacy_prefix(attr)) {
97 		/* Skip if same prefix */
98 		for (i = 0; i < nb; i++)
99 			if (prefixes->bytes[i] == b)
100 				goto found;
101 		if (nb == 4)
102 			/* Invalid instruction */
103 			break;
104 		prefixes->bytes[nb++] = b;
105 		if (inat_is_address_size_prefix(attr)) {
106 			/* address size switches 2/4 or 4/8 */
107 			if (insn->x86_64)
108 				insn->addr_bytes ^= 12;
109 			else
110 				insn->addr_bytes ^= 6;
111 		} else if (inat_is_operand_size_prefix(attr)) {
112 			/* oprand size switches 2/4 */
113 			insn->opnd_bytes ^= 6;
114 		}
115 found:
116 		prefixes->nbytes++;
117 		insn->next_byte++;
118 		lb = b;
119 		b = peek_next(insn_byte_t, insn);
120 		attr = inat_get_opcode_attribute(b);
121 	}
122 	/* Set the last prefix */
123 	if (lb && lb != insn->prefixes.bytes[3]) {
124 		if (unlikely(insn->prefixes.bytes[3])) {
125 			/* Swap the last prefix */
126 			b = insn->prefixes.bytes[3];
127 			for (i = 0; i < nb; i++)
128 				if (prefixes->bytes[i] == lb)
129 					prefixes->bytes[i] = b;
130 		}
131 		insn->prefixes.bytes[3] = lb;
132 	}
133 
134 	/* Decode REX prefix */
135 	if (insn->x86_64) {
136 		b = peek_next(insn_byte_t, insn);
137 		attr = inat_get_opcode_attribute(b);
138 		if (inat_is_rex_prefix(attr)) {
139 			insn->rex_prefix.value = b;
140 			insn->rex_prefix.nbytes = 1;
141 			insn->next_byte++;
142 			if (X86_REX_W(b))
143 				/* REX.W overrides opnd_size */
144 				insn->opnd_bytes = 8;
145 		}
146 	}
147 	insn->rex_prefix.got = 1;
148 
149 	/* Decode VEX prefix */
150 	b = peek_next(insn_byte_t, insn);
151 	attr = inat_get_opcode_attribute(b);
152 	if (inat_is_vex_prefix(attr)) {
153 		insn_byte_t b2 = peek_nbyte_next(insn_byte_t, insn, 1);
154 		if (!insn->x86_64) {
155 			/*
156 			 * In 32-bits mode, if the [7:6] bits (mod bits of
157 			 * ModRM) on the second byte are not 11b, it is
158 			 * LDS or LES.
159 			 */
160 			if (X86_MODRM_MOD(b2) != 3)
161 				goto vex_end;
162 		}
163 		insn->vex_prefix.bytes[0] = b;
164 		insn->vex_prefix.bytes[1] = b2;
165 		if (inat_is_vex3_prefix(attr)) {
166 			b2 = peek_nbyte_next(insn_byte_t, insn, 2);
167 			insn->vex_prefix.bytes[2] = b2;
168 			insn->vex_prefix.nbytes = 3;
169 			insn->next_byte += 3;
170 			if (insn->x86_64 && X86_VEX_W(b2))
171 				/* VEX.W overrides opnd_size */
172 				insn->opnd_bytes = 8;
173 		} else {
174 			/*
175 			 * For VEX2, fake VEX3-like byte#2.
176 			 * Makes it easier to decode vex.W, vex.vvvv,
177 			 * vex.L and vex.pp. Masking with 0x7f sets vex.W == 0.
178 			 */
179 			insn->vex_prefix.bytes[2] = b2 & 0x7f;
180 			insn->vex_prefix.nbytes = 2;
181 			insn->next_byte += 2;
182 		}
183 	}
184 vex_end:
185 	insn->vex_prefix.got = 1;
186 
187 	prefixes->got = 1;
188 
189 err_out:
190 	return;
191 }
192 
193 /**
194  * insn_get_opcode - collect opcode(s)
195  * @insn:	&struct insn containing instruction
196  *
197  * Populates @insn->opcode, updates @insn->next_byte to point past the
198  * opcode byte(s), and set @insn->attr (except for groups).
199  * If necessary, first collects any preceding (prefix) bytes.
200  * Sets @insn->opcode.value = opcode1.  No effect if @insn->opcode.got
201  * is already 1.
202  */
insn_get_opcode(struct insn * insn)203 void insn_get_opcode(struct insn *insn)
204 {
205 	struct insn_field *opcode = &insn->opcode;
206 	insn_byte_t op;
207 	int pfx_id;
208 	if (opcode->got)
209 		return;
210 	if (!insn->prefixes.got)
211 		insn_get_prefixes(insn);
212 
213 	/* Get first opcode */
214 	op = get_next(insn_byte_t, insn);
215 	opcode->bytes[0] = op;
216 	opcode->nbytes = 1;
217 
218 	/* Check if there is VEX prefix or not */
219 	if (insn_is_avx(insn)) {
220 		insn_byte_t m, p;
221 		m = insn_vex_m_bits(insn);
222 		p = insn_vex_p_bits(insn);
223 		insn->attr = inat_get_avx_attribute(op, m, p);
224 		if (!inat_accept_vex(insn->attr) && !inat_is_group(insn->attr))
225 			insn->attr = 0;	/* This instruction is bad */
226 		goto end;	/* VEX has only 1 byte for opcode */
227 	}
228 
229 	insn->attr = inat_get_opcode_attribute(op);
230 	while (inat_is_escape(insn->attr)) {
231 		/* Get escaped opcode */
232 		op = get_next(insn_byte_t, insn);
233 		opcode->bytes[opcode->nbytes++] = op;
234 		pfx_id = insn_last_prefix_id(insn);
235 		insn->attr = inat_get_escape_attribute(op, pfx_id, insn->attr);
236 	}
237 	if (inat_must_vex(insn->attr))
238 		insn->attr = 0;	/* This instruction is bad */
239 end:
240 	opcode->got = 1;
241 
242 err_out:
243 	return;
244 }
245 
246 /**
247  * insn_get_modrm - collect ModRM byte, if any
248  * @insn:	&struct insn containing instruction
249  *
250  * Populates @insn->modrm and updates @insn->next_byte to point past the
251  * ModRM byte, if any.  If necessary, first collects the preceding bytes
252  * (prefixes and opcode(s)).  No effect if @insn->modrm.got is already 1.
253  */
insn_get_modrm(struct insn * insn)254 void insn_get_modrm(struct insn *insn)
255 {
256 	struct insn_field *modrm = &insn->modrm;
257 	insn_byte_t pfx_id, mod;
258 	if (modrm->got)
259 		return;
260 	if (!insn->opcode.got)
261 		insn_get_opcode(insn);
262 
263 	if (inat_has_modrm(insn->attr)) {
264 		mod = get_next(insn_byte_t, insn);
265 		modrm->value = mod;
266 		modrm->nbytes = 1;
267 		if (inat_is_group(insn->attr)) {
268 			pfx_id = insn_last_prefix_id(insn);
269 			insn->attr = inat_get_group_attribute(mod, pfx_id,
270 							      insn->attr);
271 			if (insn_is_avx(insn) && !inat_accept_vex(insn->attr))
272 				insn->attr = 0;	/* This is bad */
273 		}
274 	}
275 
276 	if (insn->x86_64 && inat_is_force64(insn->attr))
277 		insn->opnd_bytes = 8;
278 	modrm->got = 1;
279 
280 err_out:
281 	return;
282 }
283 
284 
285 /**
286  * insn_rip_relative() - Does instruction use RIP-relative addressing mode?
287  * @insn:	&struct insn containing instruction
288  *
289  * If necessary, first collects the instruction up to and including the
290  * ModRM byte.  No effect if @insn->x86_64 is 0.
291  */
insn_rip_relative(struct insn * insn)292 int insn_rip_relative(struct insn *insn)
293 {
294 	struct insn_field *modrm = &insn->modrm;
295 
296 	if (!insn->x86_64)
297 		return 0;
298 	if (!modrm->got)
299 		insn_get_modrm(insn);
300 	/*
301 	 * For rip-relative instructions, the mod field (top 2 bits)
302 	 * is zero and the r/m field (bottom 3 bits) is 0x5.
303 	 */
304 	return (modrm->nbytes && (modrm->value & 0xc7) == 0x5);
305 }
306 
307 /**
308  * insn_get_sib() - Get the SIB byte of instruction
309  * @insn:	&struct insn containing instruction
310  *
311  * If necessary, first collects the instruction up to and including the
312  * ModRM byte.
313  */
insn_get_sib(struct insn * insn)314 void insn_get_sib(struct insn *insn)
315 {
316 	insn_byte_t modrm;
317 
318 	if (insn->sib.got)
319 		return;
320 	if (!insn->modrm.got)
321 		insn_get_modrm(insn);
322 	if (insn->modrm.nbytes) {
323 		modrm = (insn_byte_t)insn->modrm.value;
324 		if (insn->addr_bytes != 2 &&
325 		    X86_MODRM_MOD(modrm) != 3 && X86_MODRM_RM(modrm) == 4) {
326 			insn->sib.value = get_next(insn_byte_t, insn);
327 			insn->sib.nbytes = 1;
328 		}
329 	}
330 	insn->sib.got = 1;
331 
332 err_out:
333 	return;
334 }
335 
336 
337 /**
338  * insn_get_displacement() - Get the displacement of instruction
339  * @insn:	&struct insn containing instruction
340  *
341  * If necessary, first collects the instruction up to and including the
342  * SIB byte.
343  * Displacement value is sign-expanded.
344  */
insn_get_displacement(struct insn * insn)345 void insn_get_displacement(struct insn *insn)
346 {
347 	insn_byte_t mod, rm, base;
348 
349 	if (insn->displacement.got)
350 		return;
351 	if (!insn->sib.got)
352 		insn_get_sib(insn);
353 	if (insn->modrm.nbytes) {
354 		/*
355 		 * Interpreting the modrm byte:
356 		 * mod = 00 - no displacement fields (exceptions below)
357 		 * mod = 01 - 1-byte displacement field
358 		 * mod = 10 - displacement field is 4 bytes, or 2 bytes if
359 		 * 	address size = 2 (0x67 prefix in 32-bit mode)
360 		 * mod = 11 - no memory operand
361 		 *
362 		 * If address size = 2...
363 		 * mod = 00, r/m = 110 - displacement field is 2 bytes
364 		 *
365 		 * If address size != 2...
366 		 * mod != 11, r/m = 100 - SIB byte exists
367 		 * mod = 00, SIB base = 101 - displacement field is 4 bytes
368 		 * mod = 00, r/m = 101 - rip-relative addressing, displacement
369 		 * 	field is 4 bytes
370 		 */
371 		mod = X86_MODRM_MOD(insn->modrm.value);
372 		rm = X86_MODRM_RM(insn->modrm.value);
373 		base = X86_SIB_BASE(insn->sib.value);
374 		if (mod == 3)
375 			goto out;
376 		if (mod == 1) {
377 			insn->displacement.value = get_next(char, insn);
378 			insn->displacement.nbytes = 1;
379 		} else if (insn->addr_bytes == 2) {
380 			if ((mod == 0 && rm == 6) || mod == 2) {
381 				insn->displacement.value =
382 					 get_next(short, insn);
383 				insn->displacement.nbytes = 2;
384 			}
385 		} else {
386 			if ((mod == 0 && rm == 5) || mod == 2 ||
387 			    (mod == 0 && base == 5)) {
388 				insn->displacement.value = get_next(int, insn);
389 				insn->displacement.nbytes = 4;
390 			}
391 		}
392 	}
393 out:
394 	insn->displacement.got = 1;
395 
396 err_out:
397 	return;
398 }
399 
400 /* Decode moffset16/32/64. Return 0 if failed */
__get_moffset(struct insn * insn)401 static int __get_moffset(struct insn *insn)
402 {
403 	switch (insn->addr_bytes) {
404 	case 2:
405 		insn->moffset1.value = get_next(short, insn);
406 		insn->moffset1.nbytes = 2;
407 		break;
408 	case 4:
409 		insn->moffset1.value = get_next(int, insn);
410 		insn->moffset1.nbytes = 4;
411 		break;
412 	case 8:
413 		insn->moffset1.value = get_next(int, insn);
414 		insn->moffset1.nbytes = 4;
415 		insn->moffset2.value = get_next(int, insn);
416 		insn->moffset2.nbytes = 4;
417 		break;
418 	default:	/* opnd_bytes must be modified manually */
419 		goto err_out;
420 	}
421 	insn->moffset1.got = insn->moffset2.got = 1;
422 
423 	return 1;
424 
425 err_out:
426 	return 0;
427 }
428 
429 /* Decode imm v32(Iz). Return 0 if failed */
__get_immv32(struct insn * insn)430 static int __get_immv32(struct insn *insn)
431 {
432 	switch (insn->opnd_bytes) {
433 	case 2:
434 		insn->immediate.value = get_next(short, insn);
435 		insn->immediate.nbytes = 2;
436 		break;
437 	case 4:
438 	case 8:
439 		insn->immediate.value = get_next(int, insn);
440 		insn->immediate.nbytes = 4;
441 		break;
442 	default:	/* opnd_bytes must be modified manually */
443 		goto err_out;
444 	}
445 
446 	return 1;
447 
448 err_out:
449 	return 0;
450 }
451 
452 /* Decode imm v64(Iv/Ov), Return 0 if failed */
__get_immv(struct insn * insn)453 static int __get_immv(struct insn *insn)
454 {
455 	switch (insn->opnd_bytes) {
456 	case 2:
457 		insn->immediate1.value = get_next(short, insn);
458 		insn->immediate1.nbytes = 2;
459 		break;
460 	case 4:
461 		insn->immediate1.value = get_next(int, insn);
462 		insn->immediate1.nbytes = 4;
463 		break;
464 	case 8:
465 		insn->immediate1.value = get_next(int, insn);
466 		insn->immediate1.nbytes = 4;
467 		insn->immediate2.value = get_next(int, insn);
468 		insn->immediate2.nbytes = 4;
469 		break;
470 	default:	/* opnd_bytes must be modified manually */
471 		goto err_out;
472 	}
473 	insn->immediate1.got = insn->immediate2.got = 1;
474 
475 	return 1;
476 err_out:
477 	return 0;
478 }
479 
480 /* Decode ptr16:16/32(Ap) */
__get_immptr(struct insn * insn)481 static int __get_immptr(struct insn *insn)
482 {
483 	switch (insn->opnd_bytes) {
484 	case 2:
485 		insn->immediate1.value = get_next(short, insn);
486 		insn->immediate1.nbytes = 2;
487 		break;
488 	case 4:
489 		insn->immediate1.value = get_next(int, insn);
490 		insn->immediate1.nbytes = 4;
491 		break;
492 	case 8:
493 		/* ptr16:64 is not exist (no segment) */
494 		return 0;
495 	default:	/* opnd_bytes must be modified manually */
496 		goto err_out;
497 	}
498 	insn->immediate2.value = get_next(unsigned short, insn);
499 	insn->immediate2.nbytes = 2;
500 	insn->immediate1.got = insn->immediate2.got = 1;
501 
502 	return 1;
503 err_out:
504 	return 0;
505 }
506 
507 /**
508  * insn_get_immediate() - Get the immediates of instruction
509  * @insn:	&struct insn containing instruction
510  *
511  * If necessary, first collects the instruction up to and including the
512  * displacement bytes.
513  * Basically, most of immediates are sign-expanded. Unsigned-value can be
514  * get by bit masking with ((1 << (nbytes * 8)) - 1)
515  */
insn_get_immediate(struct insn * insn)516 void insn_get_immediate(struct insn *insn)
517 {
518 	if (insn->immediate.got)
519 		return;
520 	if (!insn->displacement.got)
521 		insn_get_displacement(insn);
522 
523 	if (inat_has_moffset(insn->attr)) {
524 		if (!__get_moffset(insn))
525 			goto err_out;
526 		goto done;
527 	}
528 
529 	if (!inat_has_immediate(insn->attr))
530 		/* no immediates */
531 		goto done;
532 
533 	switch (inat_immediate_size(insn->attr)) {
534 	case INAT_IMM_BYTE:
535 		insn->immediate.value = get_next(char, insn);
536 		insn->immediate.nbytes = 1;
537 		break;
538 	case INAT_IMM_WORD:
539 		insn->immediate.value = get_next(short, insn);
540 		insn->immediate.nbytes = 2;
541 		break;
542 	case INAT_IMM_DWORD:
543 		insn->immediate.value = get_next(int, insn);
544 		insn->immediate.nbytes = 4;
545 		break;
546 	case INAT_IMM_QWORD:
547 		insn->immediate1.value = get_next(int, insn);
548 		insn->immediate1.nbytes = 4;
549 		insn->immediate2.value = get_next(int, insn);
550 		insn->immediate2.nbytes = 4;
551 		break;
552 	case INAT_IMM_PTR:
553 		if (!__get_immptr(insn))
554 			goto err_out;
555 		break;
556 	case INAT_IMM_VWORD32:
557 		if (!__get_immv32(insn))
558 			goto err_out;
559 		break;
560 	case INAT_IMM_VWORD:
561 		if (!__get_immv(insn))
562 			goto err_out;
563 		break;
564 	default:
565 		/* Here, insn must have an immediate, but failed */
566 		goto err_out;
567 	}
568 	if (inat_has_second_immediate(insn->attr)) {
569 		insn->immediate2.value = get_next(char, insn);
570 		insn->immediate2.nbytes = 1;
571 	}
572 done:
573 	insn->immediate.got = 1;
574 
575 err_out:
576 	return;
577 }
578 
579 /**
580  * insn_get_length() - Get the length of instruction
581  * @insn:	&struct insn containing instruction
582  *
583  * If necessary, first collects the instruction up to and including the
584  * immediates bytes.
585  */
insn_get_length(struct insn * insn)586 void insn_get_length(struct insn *insn)
587 {
588 	if (insn->length)
589 		return;
590 	if (!insn->immediate.got)
591 		insn_get_immediate(insn);
592 	insn->length = (unsigned char)((unsigned long)insn->next_byte
593 				     - (unsigned long)insn->kaddr);
594 }
595