• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Utility functions for x86 operand and address decoding
3  *
4  * Copyright (C) Intel Corporation 2017
5  */
6 #include <linux/kernel.h>
7 #include <linux/string.h>
8 #include <linux/ratelimit.h>
9 #include <linux/mmu_context.h>
10 #include <asm/desc_defs.h>
11 #include <asm/desc.h>
12 #include <asm/inat.h>
13 #include <asm/insn.h>
14 #include <asm/insn-eval.h>
15 #include <asm/ldt.h>
16 #include <asm/vm86.h>
17 
18 #undef pr_fmt
19 #define pr_fmt(fmt) "insn: " fmt
20 
21 enum reg_type {
22 	REG_TYPE_RM = 0,
23 	REG_TYPE_INDEX,
24 	REG_TYPE_BASE,
25 };
26 
27 /**
28  * is_string_insn() - Determine if instruction is a string instruction
29  * @insn:	Instruction containing the opcode to inspect
30  *
31  * Returns:
32  *
33  * true if the instruction, determined by the opcode, is any of the
34  * string instructions as defined in the Intel Software Development manual.
35  * False otherwise.
36  */
is_string_insn(struct insn * insn)37 static bool is_string_insn(struct insn *insn)
38 {
39 	insn_get_opcode(insn);
40 
41 	/* All string instructions have a 1-byte opcode. */
42 	if (insn->opcode.nbytes != 1)
43 		return false;
44 
45 	switch (insn->opcode.bytes[0]) {
46 	case 0x6c ... 0x6f:	/* INS, OUTS */
47 	case 0xa4 ... 0xa7:	/* MOVS, CMPS */
48 	case 0xaa ... 0xaf:	/* STOS, LODS, SCAS */
49 		return true;
50 	default:
51 		return false;
52 	}
53 }
54 
55 /**
56  * get_seg_reg_override_idx() - obtain segment register override index
57  * @insn:	Valid instruction with segment override prefixes
58  *
59  * Inspect the instruction prefixes in @insn and find segment overrides, if any.
60  *
61  * Returns:
62  *
63  * A constant identifying the segment register to use, among CS, SS, DS,
64  * ES, FS, or GS. INAT_SEG_REG_DEFAULT is returned if no segment override
65  * prefixes were found.
66  *
67  * -EINVAL in case of error.
68  */
get_seg_reg_override_idx(struct insn * insn)69 static int get_seg_reg_override_idx(struct insn *insn)
70 {
71 	int idx = INAT_SEG_REG_DEFAULT;
72 	int num_overrides = 0, i;
73 	insn_byte_t p;
74 
75 	insn_get_prefixes(insn);
76 
77 	/* Look for any segment override prefixes. */
78 	for_each_insn_prefix(insn, i, p) {
79 		insn_attr_t attr;
80 
81 		attr = inat_get_opcode_attribute(p);
82 		switch (attr) {
83 		case INAT_MAKE_PREFIX(INAT_PFX_CS):
84 			idx = INAT_SEG_REG_CS;
85 			num_overrides++;
86 			break;
87 		case INAT_MAKE_PREFIX(INAT_PFX_SS):
88 			idx = INAT_SEG_REG_SS;
89 			num_overrides++;
90 			break;
91 		case INAT_MAKE_PREFIX(INAT_PFX_DS):
92 			idx = INAT_SEG_REG_DS;
93 			num_overrides++;
94 			break;
95 		case INAT_MAKE_PREFIX(INAT_PFX_ES):
96 			idx = INAT_SEG_REG_ES;
97 			num_overrides++;
98 			break;
99 		case INAT_MAKE_PREFIX(INAT_PFX_FS):
100 			idx = INAT_SEG_REG_FS;
101 			num_overrides++;
102 			break;
103 		case INAT_MAKE_PREFIX(INAT_PFX_GS):
104 			idx = INAT_SEG_REG_GS;
105 			num_overrides++;
106 			break;
107 		/* No default action needed. */
108 		}
109 	}
110 
111 	/* More than one segment override prefix leads to undefined behavior. */
112 	if (num_overrides > 1)
113 		return -EINVAL;
114 
115 	return idx;
116 }
117 
118 /**
119  * check_seg_overrides() - check if segment override prefixes are allowed
120  * @insn:	Valid instruction with segment override prefixes
121  * @regoff:	Operand offset, in pt_regs, for which the check is performed
122  *
123  * For a particular register used in register-indirect addressing, determine if
124  * segment override prefixes can be used. Specifically, no overrides are allowed
125  * for rDI if used with a string instruction.
126  *
127  * Returns:
128  *
129  * True if segment override prefixes can be used with the register indicated
130  * in @regoff. False if otherwise.
131  */
check_seg_overrides(struct insn * insn,int regoff)132 static bool check_seg_overrides(struct insn *insn, int regoff)
133 {
134 	if (regoff == offsetof(struct pt_regs, di) && is_string_insn(insn))
135 		return false;
136 
137 	return true;
138 }
139 
140 /**
141  * resolve_default_seg() - resolve default segment register index for an operand
142  * @insn:	Instruction with opcode and address size. Must be valid.
143  * @regs:	Register values as seen when entering kernel mode
144  * @off:	Operand offset, in pt_regs, for which resolution is needed
145  *
146  * Resolve the default segment register index associated with the instruction
147  * operand register indicated by @off. Such index is resolved based on defaults
148  * described in the Intel Software Development Manual.
149  *
150  * Returns:
151  *
152  * If in protected mode, a constant identifying the segment register to use,
153  * among CS, SS, ES or DS. If in long mode, INAT_SEG_REG_IGNORE.
154  *
155  * -EINVAL in case of error.
156  */
resolve_default_seg(struct insn * insn,struct pt_regs * regs,int off)157 static int resolve_default_seg(struct insn *insn, struct pt_regs *regs, int off)
158 {
159 	if (user_64bit_mode(regs))
160 		return INAT_SEG_REG_IGNORE;
161 	/*
162 	 * Resolve the default segment register as described in Section 3.7.4
163 	 * of the Intel Software Development Manual Vol. 1:
164 	 *
165 	 *  + DS for all references involving r[ABCD]X, and rSI.
166 	 *  + If used in a string instruction, ES for rDI. Otherwise, DS.
167 	 *  + AX, CX and DX are not valid register operands in 16-bit address
168 	 *    encodings but are valid for 32-bit and 64-bit encodings.
169 	 *  + -EDOM is reserved to identify for cases in which no register
170 	 *    is used (i.e., displacement-only addressing). Use DS.
171 	 *  + SS for rSP or rBP.
172 	 *  + CS for rIP.
173 	 */
174 
175 	switch (off) {
176 	case offsetof(struct pt_regs, ax):
177 	case offsetof(struct pt_regs, cx):
178 	case offsetof(struct pt_regs, dx):
179 		/* Need insn to verify address size. */
180 		if (insn->addr_bytes == 2)
181 			return -EINVAL;
182 
183 		/* fall through */
184 
185 	case -EDOM:
186 	case offsetof(struct pt_regs, bx):
187 	case offsetof(struct pt_regs, si):
188 		return INAT_SEG_REG_DS;
189 
190 	case offsetof(struct pt_regs, di):
191 		if (is_string_insn(insn))
192 			return INAT_SEG_REG_ES;
193 		return INAT_SEG_REG_DS;
194 
195 	case offsetof(struct pt_regs, bp):
196 	case offsetof(struct pt_regs, sp):
197 		return INAT_SEG_REG_SS;
198 
199 	case offsetof(struct pt_regs, ip):
200 		return INAT_SEG_REG_CS;
201 
202 	default:
203 		return -EINVAL;
204 	}
205 }
206 
207 /**
208  * resolve_seg_reg() - obtain segment register index
209  * @insn:	Instruction with operands
210  * @regs:	Register values as seen when entering kernel mode
211  * @regoff:	Operand offset, in pt_regs, used to deterimine segment register
212  *
213  * Determine the segment register associated with the operands and, if
214  * applicable, prefixes and the instruction pointed by @insn.
215  *
216  * The segment register associated to an operand used in register-indirect
217  * addressing depends on:
218  *
219  * a) Whether running in long mode (in such a case segments are ignored, except
220  * if FS or GS are used).
221  *
222  * b) Whether segment override prefixes can be used. Certain instructions and
223  *    registers do not allow override prefixes.
224  *
225  * c) Whether segment overrides prefixes are found in the instruction prefixes.
226  *
227  * d) If there are not segment override prefixes or they cannot be used, the
228  *    default segment register associated with the operand register is used.
229  *
230  * The function checks first if segment override prefixes can be used with the
231  * operand indicated by @regoff. If allowed, obtain such overridden segment
232  * register index. Lastly, if not prefixes were found or cannot be used, resolve
233  * the segment register index to use based on the defaults described in the
234  * Intel documentation. In long mode, all segment register indexes will be
235  * ignored, except if overrides were found for FS or GS. All these operations
236  * are done using helper functions.
237  *
238  * The operand register, @regoff, is represented as the offset from the base of
239  * pt_regs.
240  *
241  * As stated, the main use of this function is to determine the segment register
242  * index based on the instruction, its operands and prefixes. Hence, @insn
243  * must be valid. However, if @regoff indicates rIP, we don't need to inspect
244  * @insn at all as in this case CS is used in all cases. This case is checked
245  * before proceeding further.
246  *
247  * Please note that this function does not return the value in the segment
248  * register (i.e., the segment selector) but our defined index. The segment
249  * selector needs to be obtained using get_segment_selector() and passing the
250  * segment register index resolved by this function.
251  *
252  * Returns:
253  *
254  * An index identifying the segment register to use, among CS, SS, DS,
255  * ES, FS, or GS. INAT_SEG_REG_IGNORE is returned if running in long mode.
256  *
257  * -EINVAL in case of error.
258  */
resolve_seg_reg(struct insn * insn,struct pt_regs * regs,int regoff)259 static int resolve_seg_reg(struct insn *insn, struct pt_regs *regs, int regoff)
260 {
261 	int idx;
262 
263 	/*
264 	 * In the unlikely event of having to resolve the segment register
265 	 * index for rIP, do it first. Segment override prefixes should not
266 	 * be used. Hence, it is not necessary to inspect the instruction,
267 	 * which may be invalid at this point.
268 	 */
269 	if (regoff == offsetof(struct pt_regs, ip)) {
270 		if (user_64bit_mode(regs))
271 			return INAT_SEG_REG_IGNORE;
272 		else
273 			return INAT_SEG_REG_CS;
274 	}
275 
276 	if (!insn)
277 		return -EINVAL;
278 
279 	if (!check_seg_overrides(insn, regoff))
280 		return resolve_default_seg(insn, regs, regoff);
281 
282 	idx = get_seg_reg_override_idx(insn);
283 	if (idx < 0)
284 		return idx;
285 
286 	if (idx == INAT_SEG_REG_DEFAULT)
287 		return resolve_default_seg(insn, regs, regoff);
288 
289 	/*
290 	 * In long mode, segment override prefixes are ignored, except for
291 	 * overrides for FS and GS.
292 	 */
293 	if (user_64bit_mode(regs)) {
294 		if (idx != INAT_SEG_REG_FS &&
295 		    idx != INAT_SEG_REG_GS)
296 			idx = INAT_SEG_REG_IGNORE;
297 	}
298 
299 	return idx;
300 }
301 
302 /**
303  * get_segment_selector() - obtain segment selector
304  * @regs:		Register values as seen when entering kernel mode
305  * @seg_reg_idx:	Segment register index to use
306  *
307  * Obtain the segment selector from any of the CS, SS, DS, ES, FS, GS segment
308  * registers. In CONFIG_X86_32, the segment is obtained from either pt_regs or
309  * kernel_vm86_regs as applicable. In CONFIG_X86_64, CS and SS are obtained
310  * from pt_regs. DS, ES, FS and GS are obtained by reading the actual CPU
311  * registers. This done for only for completeness as in CONFIG_X86_64 segment
312  * registers are ignored.
313  *
314  * Returns:
315  *
316  * Value of the segment selector, including null when running in
317  * long mode.
318  *
319  * -EINVAL on error.
320  */
get_segment_selector(struct pt_regs * regs,int seg_reg_idx)321 static short get_segment_selector(struct pt_regs *regs, int seg_reg_idx)
322 {
323 #ifdef CONFIG_X86_64
324 	unsigned short sel;
325 
326 	switch (seg_reg_idx) {
327 	case INAT_SEG_REG_IGNORE:
328 		return 0;
329 	case INAT_SEG_REG_CS:
330 		return (unsigned short)(regs->cs & 0xffff);
331 	case INAT_SEG_REG_SS:
332 		return (unsigned short)(regs->ss & 0xffff);
333 	case INAT_SEG_REG_DS:
334 		savesegment(ds, sel);
335 		return sel;
336 	case INAT_SEG_REG_ES:
337 		savesegment(es, sel);
338 		return sel;
339 	case INAT_SEG_REG_FS:
340 		savesegment(fs, sel);
341 		return sel;
342 	case INAT_SEG_REG_GS:
343 		savesegment(gs, sel);
344 		return sel;
345 	default:
346 		return -EINVAL;
347 	}
348 #else /* CONFIG_X86_32 */
349 	struct kernel_vm86_regs *vm86regs = (struct kernel_vm86_regs *)regs;
350 
351 	if (v8086_mode(regs)) {
352 		switch (seg_reg_idx) {
353 		case INAT_SEG_REG_CS:
354 			return (unsigned short)(regs->cs & 0xffff);
355 		case INAT_SEG_REG_SS:
356 			return (unsigned short)(regs->ss & 0xffff);
357 		case INAT_SEG_REG_DS:
358 			return vm86regs->ds;
359 		case INAT_SEG_REG_ES:
360 			return vm86regs->es;
361 		case INAT_SEG_REG_FS:
362 			return vm86regs->fs;
363 		case INAT_SEG_REG_GS:
364 			return vm86regs->gs;
365 		case INAT_SEG_REG_IGNORE:
366 			/* fall through */
367 		default:
368 			return -EINVAL;
369 		}
370 	}
371 
372 	switch (seg_reg_idx) {
373 	case INAT_SEG_REG_CS:
374 		return (unsigned short)(regs->cs & 0xffff);
375 	case INAT_SEG_REG_SS:
376 		return (unsigned short)(regs->ss & 0xffff);
377 	case INAT_SEG_REG_DS:
378 		return (unsigned short)(regs->ds & 0xffff);
379 	case INAT_SEG_REG_ES:
380 		return (unsigned short)(regs->es & 0xffff);
381 	case INAT_SEG_REG_FS:
382 		return (unsigned short)(regs->fs & 0xffff);
383 	case INAT_SEG_REG_GS:
384 		/*
385 		 * GS may or may not be in regs as per CONFIG_X86_32_LAZY_GS.
386 		 * The macro below takes care of both cases.
387 		 */
388 		return get_user_gs(regs);
389 	case INAT_SEG_REG_IGNORE:
390 		/* fall through */
391 	default:
392 		return -EINVAL;
393 	}
394 #endif /* CONFIG_X86_64 */
395 }
396 
get_reg_offset(struct insn * insn,struct pt_regs * regs,enum reg_type type)397 static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
398 			  enum reg_type type)
399 {
400 	int regno = 0;
401 
402 	static const int regoff[] = {
403 		offsetof(struct pt_regs, ax),
404 		offsetof(struct pt_regs, cx),
405 		offsetof(struct pt_regs, dx),
406 		offsetof(struct pt_regs, bx),
407 		offsetof(struct pt_regs, sp),
408 		offsetof(struct pt_regs, bp),
409 		offsetof(struct pt_regs, si),
410 		offsetof(struct pt_regs, di),
411 #ifdef CONFIG_X86_64
412 		offsetof(struct pt_regs, r8),
413 		offsetof(struct pt_regs, r9),
414 		offsetof(struct pt_regs, r10),
415 		offsetof(struct pt_regs, r11),
416 		offsetof(struct pt_regs, r12),
417 		offsetof(struct pt_regs, r13),
418 		offsetof(struct pt_regs, r14),
419 		offsetof(struct pt_regs, r15),
420 #endif
421 	};
422 	int nr_registers = ARRAY_SIZE(regoff);
423 	/*
424 	 * Don't possibly decode a 32-bit instructions as
425 	 * reading a 64-bit-only register.
426 	 */
427 	if (IS_ENABLED(CONFIG_X86_64) && !insn->x86_64)
428 		nr_registers -= 8;
429 
430 	switch (type) {
431 	case REG_TYPE_RM:
432 		regno = X86_MODRM_RM(insn->modrm.value);
433 
434 		/*
435 		 * ModRM.mod == 0 and ModRM.rm == 5 means a 32-bit displacement
436 		 * follows the ModRM byte.
437 		 */
438 		if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
439 			return -EDOM;
440 
441 		if (X86_REX_B(insn->rex_prefix.value))
442 			regno += 8;
443 		break;
444 
445 	case REG_TYPE_INDEX:
446 		regno = X86_SIB_INDEX(insn->sib.value);
447 		if (X86_REX_X(insn->rex_prefix.value))
448 			regno += 8;
449 
450 		/*
451 		 * If ModRM.mod != 3 and SIB.index = 4 the scale*index
452 		 * portion of the address computation is null. This is
453 		 * true only if REX.X is 0. In such a case, the SIB index
454 		 * is used in the address computation.
455 		 */
456 		if (X86_MODRM_MOD(insn->modrm.value) != 3 && regno == 4)
457 			return -EDOM;
458 		break;
459 
460 	case REG_TYPE_BASE:
461 		regno = X86_SIB_BASE(insn->sib.value);
462 		/*
463 		 * If ModRM.mod is 0 and SIB.base == 5, the base of the
464 		 * register-indirect addressing is 0. In this case, a
465 		 * 32-bit displacement follows the SIB byte.
466 		 */
467 		if (!X86_MODRM_MOD(insn->modrm.value) && regno == 5)
468 			return -EDOM;
469 
470 		if (X86_REX_B(insn->rex_prefix.value))
471 			regno += 8;
472 		break;
473 
474 	default:
475 		pr_err_ratelimited("invalid register type: %d\n", type);
476 		return -EINVAL;
477 	}
478 
479 	if (regno >= nr_registers) {
480 		WARN_ONCE(1, "decoded an instruction with an invalid register");
481 		return -EINVAL;
482 	}
483 	return regoff[regno];
484 }
485 
486 /**
487  * get_reg_offset_16() - Obtain offset of register indicated by instruction
488  * @insn:	Instruction containing ModRM byte
489  * @regs:	Register values as seen when entering kernel mode
490  * @offs1:	Offset of the first operand register
491  * @offs2:	Offset of the second opeand register, if applicable
492  *
493  * Obtain the offset, in pt_regs, of the registers indicated by the ModRM byte
494  * in @insn. This function is to be used with 16-bit address encodings. The
495  * @offs1 and @offs2 will be written with the offset of the two registers
496  * indicated by the instruction. In cases where any of the registers is not
497  * referenced by the instruction, the value will be set to -EDOM.
498  *
499  * Returns:
500  *
501  * 0 on success, -EINVAL on error.
502  */
get_reg_offset_16(struct insn * insn,struct pt_regs * regs,int * offs1,int * offs2)503 static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs,
504 			     int *offs1, int *offs2)
505 {
506 	/*
507 	 * 16-bit addressing can use one or two registers. Specifics of
508 	 * encodings are given in Table 2-1. "16-Bit Addressing Forms with the
509 	 * ModR/M Byte" of the Intel Software Development Manual.
510 	 */
511 	static const int regoff1[] = {
512 		offsetof(struct pt_regs, bx),
513 		offsetof(struct pt_regs, bx),
514 		offsetof(struct pt_regs, bp),
515 		offsetof(struct pt_regs, bp),
516 		offsetof(struct pt_regs, si),
517 		offsetof(struct pt_regs, di),
518 		offsetof(struct pt_regs, bp),
519 		offsetof(struct pt_regs, bx),
520 	};
521 
522 	static const int regoff2[] = {
523 		offsetof(struct pt_regs, si),
524 		offsetof(struct pt_regs, di),
525 		offsetof(struct pt_regs, si),
526 		offsetof(struct pt_regs, di),
527 		-EDOM,
528 		-EDOM,
529 		-EDOM,
530 		-EDOM,
531 	};
532 
533 	if (!offs1 || !offs2)
534 		return -EINVAL;
535 
536 	/* Operand is a register, use the generic function. */
537 	if (X86_MODRM_MOD(insn->modrm.value) == 3) {
538 		*offs1 = insn_get_modrm_rm_off(insn, regs);
539 		*offs2 = -EDOM;
540 		return 0;
541 	}
542 
543 	*offs1 = regoff1[X86_MODRM_RM(insn->modrm.value)];
544 	*offs2 = regoff2[X86_MODRM_RM(insn->modrm.value)];
545 
546 	/*
547 	 * If ModRM.mod is 0 and ModRM.rm is 110b, then we use displacement-
548 	 * only addressing. This means that no registers are involved in
549 	 * computing the effective address. Thus, ensure that the first
550 	 * register offset is invalild. The second register offset is already
551 	 * invalid under the aforementioned conditions.
552 	 */
553 	if ((X86_MODRM_MOD(insn->modrm.value) == 0) &&
554 	    (X86_MODRM_RM(insn->modrm.value) == 6))
555 		*offs1 = -EDOM;
556 
557 	return 0;
558 }
559 
560 /**
561  * get_desc() - Obtain contents of a segment descriptor
562  * @out:	Segment descriptor contents on success
563  * @sel:	Segment selector
564  *
565  * Given a segment selector, obtain a pointer to the segment descriptor.
566  * Both global and local descriptor tables are supported.
567  *
568  * Returns:
569  *
570  * True on success, false on failure.
571  *
572  * NULL on error.
573  */
get_desc(struct desc_struct * out,unsigned short sel)574 static bool get_desc(struct desc_struct *out, unsigned short sel)
575 {
576 	struct desc_ptr gdt_desc = {0, 0};
577 	unsigned long desc_base;
578 
579 #ifdef CONFIG_MODIFY_LDT_SYSCALL
580 	if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) {
581 		bool success = false;
582 		struct ldt_struct *ldt;
583 
584 		/* Bits [15:3] contain the index of the desired entry. */
585 		sel >>= 3;
586 
587 		mutex_lock(&current->active_mm->context.lock);
588 		ldt = current->active_mm->context.ldt;
589 		if (ldt && sel < ldt->nr_entries) {
590 			*out = ldt->entries[sel];
591 			success = true;
592 		}
593 
594 		mutex_unlock(&current->active_mm->context.lock);
595 
596 		return success;
597 	}
598 #endif
599 	native_store_gdt(&gdt_desc);
600 
601 	/*
602 	 * Segment descriptors have a size of 8 bytes. Thus, the index is
603 	 * multiplied by 8 to obtain the memory offset of the desired descriptor
604 	 * from the base of the GDT. As bits [15:3] of the segment selector
605 	 * contain the index, it can be regarded as multiplied by 8 already.
606 	 * All that remains is to clear bits [2:0].
607 	 */
608 	desc_base = sel & ~(SEGMENT_RPL_MASK | SEGMENT_TI_MASK);
609 
610 	if (desc_base > gdt_desc.size)
611 		return false;
612 
613 	*out = *(struct desc_struct *)(gdt_desc.address + desc_base);
614 	return true;
615 }
616 
617 /**
618  * insn_get_seg_base() - Obtain base address of segment descriptor.
619  * @regs:		Register values as seen when entering kernel mode
620  * @seg_reg_idx:	Index of the segment register pointing to seg descriptor
621  *
622  * Obtain the base address of the segment as indicated by the segment descriptor
623  * pointed by the segment selector. The segment selector is obtained from the
624  * input segment register index @seg_reg_idx.
625  *
626  * Returns:
627  *
628  * In protected mode, base address of the segment. Zero in long mode,
629  * except when FS or GS are used. In virtual-8086 mode, the segment
630  * selector shifted 4 bits to the right.
631  *
632  * -1L in case of error.
633  */
insn_get_seg_base(struct pt_regs * regs,int seg_reg_idx)634 unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx)
635 {
636 	struct desc_struct desc;
637 	short sel;
638 
639 	sel = get_segment_selector(regs, seg_reg_idx);
640 	if (sel < 0)
641 		return -1L;
642 
643 	if (v8086_mode(regs))
644 		/*
645 		 * Base is simply the segment selector shifted 4
646 		 * bits to the right.
647 		 */
648 		return (unsigned long)(sel << 4);
649 
650 	if (user_64bit_mode(regs)) {
651 		/*
652 		 * Only FS or GS will have a base address, the rest of
653 		 * the segments' bases are forced to 0.
654 		 */
655 		unsigned long base;
656 
657 		if (seg_reg_idx == INAT_SEG_REG_FS)
658 			rdmsrl(MSR_FS_BASE, base);
659 		else if (seg_reg_idx == INAT_SEG_REG_GS)
660 			/*
661 			 * swapgs was called at the kernel entry point. Thus,
662 			 * MSR_KERNEL_GS_BASE will have the user-space GS base.
663 			 */
664 			rdmsrl(MSR_KERNEL_GS_BASE, base);
665 		else
666 			base = 0;
667 		return base;
668 	}
669 
670 	/* In protected mode the segment selector cannot be null. */
671 	if (!sel)
672 		return -1L;
673 
674 	if (!get_desc(&desc, sel))
675 		return -1L;
676 
677 	return get_desc_base(&desc);
678 }
679 
680 /**
681  * get_seg_limit() - Obtain the limit of a segment descriptor
682  * @regs:		Register values as seen when entering kernel mode
683  * @seg_reg_idx:	Index of the segment register pointing to seg descriptor
684  *
685  * Obtain the limit of the segment as indicated by the segment descriptor
686  * pointed by the segment selector. The segment selector is obtained from the
687  * input segment register index @seg_reg_idx.
688  *
689  * Returns:
690  *
691  * In protected mode, the limit of the segment descriptor in bytes.
692  * In long mode and virtual-8086 mode, segment limits are not enforced. Thus,
693  * limit is returned as -1L to imply a limit-less segment.
694  *
695  * Zero is returned on error.
696  */
get_seg_limit(struct pt_regs * regs,int seg_reg_idx)697 static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)
698 {
699 	struct desc_struct desc;
700 	unsigned long limit;
701 	short sel;
702 
703 	sel = get_segment_selector(regs, seg_reg_idx);
704 	if (sel < 0)
705 		return 0;
706 
707 	if (user_64bit_mode(regs) || v8086_mode(regs))
708 		return -1L;
709 
710 	if (!sel)
711 		return 0;
712 
713 	if (!get_desc(&desc, sel))
714 		return 0;
715 
716 	/*
717 	 * If the granularity bit is set, the limit is given in multiples
718 	 * of 4096. This also means that the 12 least significant bits are
719 	 * not tested when checking the segment limits. In practice,
720 	 * this means that the segment ends in (limit << 12) + 0xfff.
721 	 */
722 	limit = get_desc_limit(&desc);
723 	if (desc.g)
724 		limit = (limit << 12) + 0xfff;
725 
726 	return limit;
727 }
728 
729 /**
730  * insn_get_code_seg_params() - Obtain code segment parameters
731  * @regs:	Structure with register values as seen when entering kernel mode
732  *
733  * Obtain address and operand sizes of the code segment. It is obtained from the
734  * selector contained in the CS register in regs. In protected mode, the default
735  * address is determined by inspecting the L and D bits of the segment
736  * descriptor. In virtual-8086 mode, the default is always two bytes for both
737  * address and operand sizes.
738  *
739  * Returns:
740  *
741  * An int containing ORed-in default parameters on success.
742  *
743  * -EINVAL on error.
744  */
insn_get_code_seg_params(struct pt_regs * regs)745 int insn_get_code_seg_params(struct pt_regs *regs)
746 {
747 	struct desc_struct desc;
748 	short sel;
749 
750 	if (v8086_mode(regs))
751 		/* Address and operand size are both 16-bit. */
752 		return INSN_CODE_SEG_PARAMS(2, 2);
753 
754 	sel = get_segment_selector(regs, INAT_SEG_REG_CS);
755 	if (sel < 0)
756 		return sel;
757 
758 	if (!get_desc(&desc, sel))
759 		return -EINVAL;
760 
761 	/*
762 	 * The most significant byte of the Type field of the segment descriptor
763 	 * determines whether a segment contains data or code. If this is a data
764 	 * segment, return error.
765 	 */
766 	if (!(desc.type & BIT(3)))
767 		return -EINVAL;
768 
769 	switch ((desc.l << 1) | desc.d) {
770 	case 0: /*
771 		 * Legacy mode. CS.L=0, CS.D=0. Address and operand size are
772 		 * both 16-bit.
773 		 */
774 		return INSN_CODE_SEG_PARAMS(2, 2);
775 	case 1: /*
776 		 * Legacy mode. CS.L=0, CS.D=1. Address and operand size are
777 		 * both 32-bit.
778 		 */
779 		return INSN_CODE_SEG_PARAMS(4, 4);
780 	case 2: /*
781 		 * IA-32e 64-bit mode. CS.L=1, CS.D=0. Address size is 64-bit;
782 		 * operand size is 32-bit.
783 		 */
784 		return INSN_CODE_SEG_PARAMS(4, 8);
785 	case 3: /* Invalid setting. CS.L=1, CS.D=1 */
786 		/* fall through */
787 	default:
788 		return -EINVAL;
789 	}
790 }
791 
792 /**
793  * insn_get_modrm_rm_off() - Obtain register in r/m part of the ModRM byte
794  * @insn:	Instruction containing the ModRM byte
795  * @regs:	Register values as seen when entering kernel mode
796  *
797  * Returns:
798  *
799  * The register indicated by the r/m part of the ModRM byte. The
800  * register is obtained as an offset from the base of pt_regs. In specific
801  * cases, the returned value can be -EDOM to indicate that the particular value
802  * of ModRM does not refer to a register and shall be ignored.
803  */
insn_get_modrm_rm_off(struct insn * insn,struct pt_regs * regs)804 int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs)
805 {
806 	return get_reg_offset(insn, regs, REG_TYPE_RM);
807 }
808 
809 /**
810  * get_seg_base_limit() - obtain base address and limit of a segment
811  * @insn:	Instruction. Must be valid.
812  * @regs:	Register values as seen when entering kernel mode
813  * @regoff:	Operand offset, in pt_regs, used to resolve segment descriptor
814  * @base:	Obtained segment base
815  * @limit:	Obtained segment limit
816  *
817  * Obtain the base address and limit of the segment associated with the operand
818  * @regoff and, if any or allowed, override prefixes in @insn. This function is
819  * different from insn_get_seg_base() as the latter does not resolve the segment
820  * associated with the instruction operand. If a limit is not needed (e.g.,
821  * when running in long mode), @limit can be NULL.
822  *
823  * Returns:
824  *
825  * 0 on success. @base and @limit will contain the base address and of the
826  * resolved segment, respectively.
827  *
828  * -EINVAL on error.
829  */
get_seg_base_limit(struct insn * insn,struct pt_regs * regs,int regoff,unsigned long * base,unsigned long * limit)830 static int get_seg_base_limit(struct insn *insn, struct pt_regs *regs,
831 			      int regoff, unsigned long *base,
832 			      unsigned long *limit)
833 {
834 	int seg_reg_idx;
835 
836 	if (!base)
837 		return -EINVAL;
838 
839 	seg_reg_idx = resolve_seg_reg(insn, regs, regoff);
840 	if (seg_reg_idx < 0)
841 		return seg_reg_idx;
842 
843 	*base = insn_get_seg_base(regs, seg_reg_idx);
844 	if (*base == -1L)
845 		return -EINVAL;
846 
847 	if (!limit)
848 		return 0;
849 
850 	*limit = get_seg_limit(regs, seg_reg_idx);
851 	if (!(*limit))
852 		return -EINVAL;
853 
854 	return 0;
855 }
856 
857 /**
858  * get_eff_addr_reg() - Obtain effective address from register operand
859  * @insn:	Instruction. Must be valid.
860  * @regs:	Register values as seen when entering kernel mode
861  * @regoff:	Obtained operand offset, in pt_regs, with the effective address
862  * @eff_addr:	Obtained effective address
863  *
864  * Obtain the effective address stored in the register operand as indicated by
865  * the ModRM byte. This function is to be used only with register addressing
866  * (i.e.,  ModRM.mod is 3). The effective address is saved in @eff_addr. The
867  * register operand, as an offset from the base of pt_regs, is saved in @regoff;
868  * such offset can then be used to resolve the segment associated with the
869  * operand. This function can be used with any of the supported address sizes
870  * in x86.
871  *
872  * Returns:
873  *
874  * 0 on success. @eff_addr will have the effective address stored in the
875  * operand indicated by ModRM. @regoff will have such operand as an offset from
876  * the base of pt_regs.
877  *
878  * -EINVAL on error.
879  */
get_eff_addr_reg(struct insn * insn,struct pt_regs * regs,int * regoff,long * eff_addr)880 static int get_eff_addr_reg(struct insn *insn, struct pt_regs *regs,
881 			    int *regoff, long *eff_addr)
882 {
883 	insn_get_modrm(insn);
884 
885 	if (!insn->modrm.nbytes)
886 		return -EINVAL;
887 
888 	if (X86_MODRM_MOD(insn->modrm.value) != 3)
889 		return -EINVAL;
890 
891 	*regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
892 	if (*regoff < 0)
893 		return -EINVAL;
894 
895 	/* Ignore bytes that are outside the address size. */
896 	if (insn->addr_bytes == 2)
897 		*eff_addr = regs_get_register(regs, *regoff) & 0xffff;
898 	else if (insn->addr_bytes == 4)
899 		*eff_addr = regs_get_register(regs, *regoff) & 0xffffffff;
900 	else /* 64-bit address */
901 		*eff_addr = regs_get_register(regs, *regoff);
902 
903 	return 0;
904 }
905 
906 /**
907  * get_eff_addr_modrm() - Obtain referenced effective address via ModRM
908  * @insn:	Instruction. Must be valid.
909  * @regs:	Register values as seen when entering kernel mode
910  * @regoff:	Obtained operand offset, in pt_regs, associated with segment
911  * @eff_addr:	Obtained effective address
912  *
913  * Obtain the effective address referenced by the ModRM byte of @insn. After
914  * identifying the registers involved in the register-indirect memory reference,
915  * its value is obtained from the operands in @regs. The computed address is
916  * stored @eff_addr. Also, the register operand that indicates the associated
917  * segment is stored in @regoff, this parameter can later be used to determine
918  * such segment.
919  *
920  * Returns:
921  *
922  * 0 on success. @eff_addr will have the referenced effective address. @regoff
923  * will have a register, as an offset from the base of pt_regs, that can be used
924  * to resolve the associated segment.
925  *
926  * -EINVAL on error.
927  */
get_eff_addr_modrm(struct insn * insn,struct pt_regs * regs,int * regoff,long * eff_addr)928 static int get_eff_addr_modrm(struct insn *insn, struct pt_regs *regs,
929 			      int *regoff, long *eff_addr)
930 {
931 	long tmp;
932 
933 	if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
934 		return -EINVAL;
935 
936 	insn_get_modrm(insn);
937 
938 	if (!insn->modrm.nbytes)
939 		return -EINVAL;
940 
941 	if (X86_MODRM_MOD(insn->modrm.value) > 2)
942 		return -EINVAL;
943 
944 	*regoff = get_reg_offset(insn, regs, REG_TYPE_RM);
945 
946 	/*
947 	 * -EDOM means that we must ignore the address_offset. In such a case,
948 	 * in 64-bit mode the effective address relative to the rIP of the
949 	 * following instruction.
950 	 */
951 	if (*regoff == -EDOM) {
952 		if (user_64bit_mode(regs))
953 			tmp = regs->ip + insn->length;
954 		else
955 			tmp = 0;
956 	} else if (*regoff < 0) {
957 		return -EINVAL;
958 	} else {
959 		tmp = regs_get_register(regs, *regoff);
960 	}
961 
962 	if (insn->addr_bytes == 4) {
963 		int addr32 = (int)(tmp & 0xffffffff) + insn->displacement.value;
964 
965 		*eff_addr = addr32 & 0xffffffff;
966 	} else {
967 		*eff_addr = tmp + insn->displacement.value;
968 	}
969 
970 	return 0;
971 }
972 
973 /**
974  * get_eff_addr_modrm_16() - Obtain referenced effective address via ModRM
975  * @insn:	Instruction. Must be valid.
976  * @regs:	Register values as seen when entering kernel mode
977  * @regoff:	Obtained operand offset, in pt_regs, associated with segment
978  * @eff_addr:	Obtained effective address
979  *
980  * Obtain the 16-bit effective address referenced by the ModRM byte of @insn.
981  * After identifying the registers involved in the register-indirect memory
982  * reference, its value is obtained from the operands in @regs. The computed
983  * address is stored @eff_addr. Also, the register operand that indicates
984  * the associated segment is stored in @regoff, this parameter can later be used
985  * to determine such segment.
986  *
987  * Returns:
988  *
989  * 0 on success. @eff_addr will have the referenced effective address. @regoff
990  * will have a register, as an offset from the base of pt_regs, that can be used
991  * to resolve the associated segment.
992  *
993  * -EINVAL on error.
994  */
get_eff_addr_modrm_16(struct insn * insn,struct pt_regs * regs,int * regoff,short * eff_addr)995 static int get_eff_addr_modrm_16(struct insn *insn, struct pt_regs *regs,
996 				 int *regoff, short *eff_addr)
997 {
998 	int addr_offset1, addr_offset2, ret;
999 	short addr1 = 0, addr2 = 0, displacement;
1000 
1001 	if (insn->addr_bytes != 2)
1002 		return -EINVAL;
1003 
1004 	insn_get_modrm(insn);
1005 
1006 	if (!insn->modrm.nbytes)
1007 		return -EINVAL;
1008 
1009 	if (X86_MODRM_MOD(insn->modrm.value) > 2)
1010 		return -EINVAL;
1011 
1012 	ret = get_reg_offset_16(insn, regs, &addr_offset1, &addr_offset2);
1013 	if (ret < 0)
1014 		return -EINVAL;
1015 
1016 	/*
1017 	 * Don't fail on invalid offset values. They might be invalid because
1018 	 * they cannot be used for this particular value of ModRM. Instead, use
1019 	 * them in the computation only if they contain a valid value.
1020 	 */
1021 	if (addr_offset1 != -EDOM)
1022 		addr1 = regs_get_register(regs, addr_offset1) & 0xffff;
1023 
1024 	if (addr_offset2 != -EDOM)
1025 		addr2 = regs_get_register(regs, addr_offset2) & 0xffff;
1026 
1027 	displacement = insn->displacement.value & 0xffff;
1028 	*eff_addr = addr1 + addr2 + displacement;
1029 
1030 	/*
1031 	 * The first operand register could indicate to use of either SS or DS
1032 	 * registers to obtain the segment selector.  The second operand
1033 	 * register can only indicate the use of DS. Thus, the first operand
1034 	 * will be used to obtain the segment selector.
1035 	 */
1036 	*regoff = addr_offset1;
1037 
1038 	return 0;
1039 }
1040 
1041 /**
1042  * get_eff_addr_sib() - Obtain referenced effective address via SIB
1043  * @insn:	Instruction. Must be valid.
1044  * @regs:	Register values as seen when entering kernel mode
1045  * @regoff:	Obtained operand offset, in pt_regs, associated with segment
1046  * @eff_addr:	Obtained effective address
1047  *
1048  * Obtain the effective address referenced by the SIB byte of @insn. After
1049  * identifying the registers involved in the indexed, register-indirect memory
1050  * reference, its value is obtained from the operands in @regs. The computed
1051  * address is stored @eff_addr. Also, the register operand that indicates the
1052  * associated segment is stored in @regoff, this parameter can later be used to
1053  * determine such segment.
1054  *
1055  * Returns:
1056  *
1057  * 0 on success. @eff_addr will have the referenced effective address.
1058  * @base_offset will have a register, as an offset from the base of pt_regs,
1059  * that can be used to resolve the associated segment.
1060  *
1061  * -EINVAL on error.
1062  */
get_eff_addr_sib(struct insn * insn,struct pt_regs * regs,int * base_offset,long * eff_addr)1063 static int get_eff_addr_sib(struct insn *insn, struct pt_regs *regs,
1064 			    int *base_offset, long *eff_addr)
1065 {
1066 	long base, indx;
1067 	int indx_offset;
1068 
1069 	if (insn->addr_bytes != 8 && insn->addr_bytes != 4)
1070 		return -EINVAL;
1071 
1072 	insn_get_modrm(insn);
1073 
1074 	if (!insn->modrm.nbytes)
1075 		return -EINVAL;
1076 
1077 	if (X86_MODRM_MOD(insn->modrm.value) > 2)
1078 		return -EINVAL;
1079 
1080 	insn_get_sib(insn);
1081 
1082 	if (!insn->sib.nbytes)
1083 		return -EINVAL;
1084 
1085 	*base_offset = get_reg_offset(insn, regs, REG_TYPE_BASE);
1086 	indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX);
1087 
1088 	/*
1089 	 * Negative values in the base and index offset means an error when
1090 	 * decoding the SIB byte. Except -EDOM, which means that the registers
1091 	 * should not be used in the address computation.
1092 	 */
1093 	if (*base_offset == -EDOM)
1094 		base = 0;
1095 	else if (*base_offset < 0)
1096 		return -EINVAL;
1097 	else
1098 		base = regs_get_register(regs, *base_offset);
1099 
1100 	if (indx_offset == -EDOM)
1101 		indx = 0;
1102 	else if (indx_offset < 0)
1103 		return -EINVAL;
1104 	else
1105 		indx = regs_get_register(regs, indx_offset);
1106 
1107 	if (insn->addr_bytes == 4) {
1108 		int addr32, base32, idx32;
1109 
1110 		base32 = base & 0xffffffff;
1111 		idx32 = indx & 0xffffffff;
1112 
1113 		addr32 = base32 + idx32 * (1 << X86_SIB_SCALE(insn->sib.value));
1114 		addr32 += insn->displacement.value;
1115 
1116 		*eff_addr = addr32 & 0xffffffff;
1117 	} else {
1118 		*eff_addr = base + indx * (1 << X86_SIB_SCALE(insn->sib.value));
1119 		*eff_addr += insn->displacement.value;
1120 	}
1121 
1122 	return 0;
1123 }
1124 
1125 /**
1126  * get_addr_ref_16() - Obtain the 16-bit address referred by instruction
1127  * @insn:	Instruction containing ModRM byte and displacement
1128  * @regs:	Register values as seen when entering kernel mode
1129  *
1130  * This function is to be used with 16-bit address encodings. Obtain the memory
1131  * address referred by the instruction's ModRM and displacement bytes. Also, the
1132  * segment used as base is determined by either any segment override prefixes in
1133  * @insn or the default segment of the registers involved in the address
1134  * computation. In protected mode, segment limits are enforced.
1135  *
1136  * Returns:
1137  *
1138  * Linear address referenced by the instruction operands on success.
1139  *
1140  * -1L on error.
1141  */
get_addr_ref_16(struct insn * insn,struct pt_regs * regs)1142 static void __user *get_addr_ref_16(struct insn *insn, struct pt_regs *regs)
1143 {
1144 	unsigned long linear_addr = -1L, seg_base, seg_limit;
1145 	int ret, regoff;
1146 	short eff_addr;
1147 	long tmp;
1148 
1149 	insn_get_modrm(insn);
1150 	insn_get_displacement(insn);
1151 
1152 	if (insn->addr_bytes != 2)
1153 		goto out;
1154 
1155 	if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1156 		ret = get_eff_addr_reg(insn, regs, &regoff, &tmp);
1157 		if (ret)
1158 			goto out;
1159 
1160 		eff_addr = tmp;
1161 	} else {
1162 		ret = get_eff_addr_modrm_16(insn, regs, &regoff, &eff_addr);
1163 		if (ret)
1164 			goto out;
1165 	}
1166 
1167 	ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
1168 	if (ret)
1169 		goto out;
1170 
1171 	/*
1172 	 * Before computing the linear address, make sure the effective address
1173 	 * is within the limits of the segment. In virtual-8086 mode, segment
1174 	 * limits are not enforced. In such a case, the segment limit is -1L to
1175 	 * reflect this fact.
1176 	 */
1177 	if ((unsigned long)(eff_addr & 0xffff) > seg_limit)
1178 		goto out;
1179 
1180 	linear_addr = (unsigned long)(eff_addr & 0xffff) + seg_base;
1181 
1182 	/* Limit linear address to 20 bits */
1183 	if (v8086_mode(regs))
1184 		linear_addr &= 0xfffff;
1185 
1186 out:
1187 	return (void __user *)linear_addr;
1188 }
1189 
1190 /**
1191  * get_addr_ref_32() - Obtain a 32-bit linear address
1192  * @insn:	Instruction with ModRM, SIB bytes and displacement
1193  * @regs:	Register values as seen when entering kernel mode
1194  *
1195  * This function is to be used with 32-bit address encodings to obtain the
1196  * linear memory address referred by the instruction's ModRM, SIB,
1197  * displacement bytes and segment base address, as applicable. If in protected
1198  * mode, segment limits are enforced.
1199  *
1200  * Returns:
1201  *
1202  * Linear address referenced by instruction and registers on success.
1203  *
1204  * -1L on error.
1205  */
get_addr_ref_32(struct insn * insn,struct pt_regs * regs)1206 static void __user *get_addr_ref_32(struct insn *insn, struct pt_regs *regs)
1207 {
1208 	unsigned long linear_addr = -1L, seg_base, seg_limit;
1209 	int eff_addr, regoff;
1210 	long tmp;
1211 	int ret;
1212 
1213 	if (insn->addr_bytes != 4)
1214 		goto out;
1215 
1216 	if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1217 		ret = get_eff_addr_reg(insn, regs, &regoff, &tmp);
1218 		if (ret)
1219 			goto out;
1220 
1221 		eff_addr = tmp;
1222 
1223 	} else {
1224 		if (insn->sib.nbytes) {
1225 			ret = get_eff_addr_sib(insn, regs, &regoff, &tmp);
1226 			if (ret)
1227 				goto out;
1228 
1229 			eff_addr = tmp;
1230 		} else {
1231 			ret = get_eff_addr_modrm(insn, regs, &regoff, &tmp);
1232 			if (ret)
1233 				goto out;
1234 
1235 			eff_addr = tmp;
1236 		}
1237 	}
1238 
1239 	ret = get_seg_base_limit(insn, regs, regoff, &seg_base, &seg_limit);
1240 	if (ret)
1241 		goto out;
1242 
1243 	/*
1244 	 * In protected mode, before computing the linear address, make sure
1245 	 * the effective address is within the limits of the segment.
1246 	 * 32-bit addresses can be used in long and virtual-8086 modes if an
1247 	 * address override prefix is used. In such cases, segment limits are
1248 	 * not enforced. When in virtual-8086 mode, the segment limit is -1L
1249 	 * to reflect this situation.
1250 	 *
1251 	 * After computed, the effective address is treated as an unsigned
1252 	 * quantity.
1253 	 */
1254 	if (!user_64bit_mode(regs) && ((unsigned int)eff_addr > seg_limit))
1255 		goto out;
1256 
1257 	/*
1258 	 * Even though 32-bit address encodings are allowed in virtual-8086
1259 	 * mode, the address range is still limited to [0x-0xffff].
1260 	 */
1261 	if (v8086_mode(regs) && (eff_addr & ~0xffff))
1262 		goto out;
1263 
1264 	/*
1265 	 * Data type long could be 64 bits in size. Ensure that our 32-bit
1266 	 * effective address is not sign-extended when computing the linear
1267 	 * address.
1268 	 */
1269 	linear_addr = (unsigned long)(eff_addr & 0xffffffff) + seg_base;
1270 
1271 	/* Limit linear address to 20 bits */
1272 	if (v8086_mode(regs))
1273 		linear_addr &= 0xfffff;
1274 
1275 out:
1276 	return (void __user *)linear_addr;
1277 }
1278 
1279 /**
1280  * get_addr_ref_64() - Obtain a 64-bit linear address
1281  * @insn:	Instruction struct with ModRM and SIB bytes and displacement
1282  * @regs:	Structure with register values as seen when entering kernel mode
1283  *
1284  * This function is to be used with 64-bit address encodings to obtain the
1285  * linear memory address referred by the instruction's ModRM, SIB,
1286  * displacement bytes and segment base address, as applicable.
1287  *
1288  * Returns:
1289  *
1290  * Linear address referenced by instruction and registers on success.
1291  *
1292  * -1L on error.
1293  */
1294 #ifndef CONFIG_X86_64
get_addr_ref_64(struct insn * insn,struct pt_regs * regs)1295 static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
1296 {
1297 	return (void __user *)-1L;
1298 }
1299 #else
get_addr_ref_64(struct insn * insn,struct pt_regs * regs)1300 static void __user *get_addr_ref_64(struct insn *insn, struct pt_regs *regs)
1301 {
1302 	unsigned long linear_addr = -1L, seg_base;
1303 	int regoff, ret;
1304 	long eff_addr;
1305 
1306 	if (insn->addr_bytes != 8)
1307 		goto out;
1308 
1309 	if (X86_MODRM_MOD(insn->modrm.value) == 3) {
1310 		ret = get_eff_addr_reg(insn, regs, &regoff, &eff_addr);
1311 		if (ret)
1312 			goto out;
1313 
1314 	} else {
1315 		if (insn->sib.nbytes) {
1316 			ret = get_eff_addr_sib(insn, regs, &regoff, &eff_addr);
1317 			if (ret)
1318 				goto out;
1319 		} else {
1320 			ret = get_eff_addr_modrm(insn, regs, &regoff, &eff_addr);
1321 			if (ret)
1322 				goto out;
1323 		}
1324 
1325 	}
1326 
1327 	ret = get_seg_base_limit(insn, regs, regoff, &seg_base, NULL);
1328 	if (ret)
1329 		goto out;
1330 
1331 	linear_addr = (unsigned long)eff_addr + seg_base;
1332 
1333 out:
1334 	return (void __user *)linear_addr;
1335 }
1336 #endif /* CONFIG_X86_64 */
1337 
1338 /**
1339  * insn_get_addr_ref() - Obtain the linear address referred by instruction
1340  * @insn:	Instruction structure containing ModRM byte and displacement
1341  * @regs:	Structure with register values as seen when entering kernel mode
1342  *
1343  * Obtain the linear address referred by the instruction's ModRM, SIB and
1344  * displacement bytes, and segment base, as applicable. In protected mode,
1345  * segment limits are enforced.
1346  *
1347  * Returns:
1348  *
1349  * Linear address referenced by instruction and registers on success.
1350  *
1351  * -1L on error.
1352  */
insn_get_addr_ref(struct insn * insn,struct pt_regs * regs)1353 void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs)
1354 {
1355 	if (!insn || !regs)
1356 		return (void __user *)-1L;
1357 
1358 	switch (insn->addr_bytes) {
1359 	case 2:
1360 		return get_addr_ref_16(insn, regs);
1361 	case 4:
1362 		return get_addr_ref_32(insn, regs);
1363 	case 8:
1364 		return get_addr_ref_64(insn, regs);
1365 	default:
1366 		return (void __user *)-1L;
1367 	}
1368 }
1369