Re: [PATCH v7 12/26] x86/insn-eval: Add utility functions to get segment descriptor base address and limit
On Wed, 2017-05-31 at 18:58 +0200, Borislav Petkov wrote:
> On Fri, May 05, 2017 at 11:17:10AM -0700, Ricardo Neri wrote:
> > With segmentation, the base address of the segment descriptor is needed
> > to compute a linear address. The segment descriptor used in the address
> > computation depends on either any segment override prefixes in the
> > instruction or the default segment determined by the registers involved
> > in the address computation. Thus, both the instruction as well as the
> > register (specified as the offset from the base of pt_regs) are given as
> > inputs, along with a boolean variable to select between override and
> > default.
>
> ...
>
> > diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c
> > index f46cb31..c77ed80 100644
> > --- a/arch/x86/lib/insn-eval.c
> > +++ b/arch/x86/lib/insn-eval.c
> > @@ -476,6 +476,133 @@ static struct desc_struct *get_desc(unsigned short
> > sel)
> > }
> >
> > /**
> > + * insn_get_seg_base() - Obtain base address of segment descriptor.
> > + * @regs: Structure with register values as seen when entering kernel mode
> > + * @insn: Instruction structure with selector override prefixes
> > + * @regoff:Operand offset, in pt_regs, of which the selector is
> > needed
> > + *
> > + * Obtain the base address of the segment descriptor as indicated by either
> > + * any segment override prefixes contained in insn or the default segment
> > + * applicable to the register indicated by regoff. regoff is specified as
> > the
> > + * offset in bytes from the base of pt_regs.
> > + *
> > + * Return: In protected mode, base address of the segment. Zero in for long
> > + * mode, except when FS or GS are used. In virtual-8086 mode, the segment
> > + * selector shifted 4 positions to the right. -1L in case of
> > + * error.
> > + */
> > +unsigned long insn_get_seg_base(struct pt_regs *regs, struct insn *insn,
> > + int regoff)
> > +{
> > + struct desc_struct *desc;
> > + unsigned short sel;
> > + enum segment_register seg_reg;
> > +
> > + seg_reg = resolve_seg_register(insn, regs, regoff);
> > + if (seg_reg == SEG_REG_INVAL)
> > + return -1L;
> > +
> > + sel = get_segment_selector(regs, seg_reg);
> > + if ((short)sel < 0)
>
> I guess it would be better if that function returned a signed short so
> you don't have to cast it here. (You're casting it to an unsigned long
> below anyway.)
Yes, this make sense. I will make this change.
>
> > + return -1L;
> > +
> > + if (v8086_mode(regs))
> > + /*
> > +* Base is simply the segment selector shifted 4
> > +* positions to the right.
> > +*/
> > + return (unsigned long)(sel << 4);
> > +
>
> ...
>
> > +static unsigned long get_seg_limit(struct pt_regs *regs, struct insn *insn,
> > + int regoff)
> > +{
> > + struct desc_struct *desc;
> > + unsigned short sel;
> > + unsigned long limit;
> > + enum segment_register seg_reg;
> > +
> > + seg_reg = resolve_seg_register(insn, regs, regoff);
> > + if (seg_reg == SEG_REG_INVAL)
> > + return 0;
> > +
> > + sel = get_segment_selector(regs, seg_reg);
> > + if ((short)sel < 0)
>
> Ditto.
Here as well.
>
> > + return 0;
> > +
> > + if (user_64bit_mode(regs) || v8086_mode(regs))
> > + return -1L;
> > +
> > + if (!sel)
> > + return 0;
> > +
> > + desc = get_desc(sel);
> > + if (!desc)
> > + return 0;
> > +
> > + /*
> > +* If the granularity bit is set, the limit is given in multiples
> > +* of 4096. When the granularity bit is set, the least 12 significant
>
>the 12 least significant
> bits
>
> > +* bits are not tested when checking the segment limits. In practice,
> > +* this means that the segment ends in (limit << 12) + 0xfff.
> > +*/
> > + limit = get_desc_limit(desc);
> > + if (desc->g)
> > + limit <<= 12 | 0x7;
>
> That 0x7 doesn't look like 0xfff - it shifts limit by 15 instead. You
> can simply write it like you mean it:
>
> limit = (limit << 12) + 0xfff;
You are right, this wrong. I will implement as you mention.
Thanks and BR,
Ricardo
--
To unsubscribe from this list: send the line "unsubscribe linux-msdos" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH v7 12/26] x86/insn-eval: Add utility functions to get segment descriptor base address and limit
On Fri, May 05, 2017 at 11:17:10AM -0700, Ricardo Neri wrote:
> With segmentation, the base address of the segment descriptor is needed
> to compute a linear address. The segment descriptor used in the address
> computation depends on either any segment override prefixes in the
> instruction or the default segment determined by the registers involved
> in the address computation. Thus, both the instruction as well as the
> register (specified as the offset from the base of pt_regs) are given as
> inputs, along with a boolean variable to select between override and
> default.
...
> diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c
> index f46cb31..c77ed80 100644
> --- a/arch/x86/lib/insn-eval.c
> +++ b/arch/x86/lib/insn-eval.c
> @@ -476,6 +476,133 @@ static struct desc_struct *get_desc(unsigned short sel)
> }
>
> /**
> + * insn_get_seg_base() - Obtain base address of segment descriptor.
> + * @regs:Structure with register values as seen when entering kernel mode
> + * @insn:Instruction structure with selector override prefixes
> + * @regoff: Operand offset, in pt_regs, of which the selector is needed
> + *
> + * Obtain the base address of the segment descriptor as indicated by either
> + * any segment override prefixes contained in insn or the default segment
> + * applicable to the register indicated by regoff. regoff is specified as the
> + * offset in bytes from the base of pt_regs.
> + *
> + * Return: In protected mode, base address of the segment. Zero in for long
> + * mode, except when FS or GS are used. In virtual-8086 mode, the segment
> + * selector shifted 4 positions to the right. -1L in case of
> + * error.
> + */
> +unsigned long insn_get_seg_base(struct pt_regs *regs, struct insn *insn,
> + int regoff)
> +{
> + struct desc_struct *desc;
> + unsigned short sel;
> + enum segment_register seg_reg;
> +
> + seg_reg = resolve_seg_register(insn, regs, regoff);
> + if (seg_reg == SEG_REG_INVAL)
> + return -1L;
> +
> + sel = get_segment_selector(regs, seg_reg);
> + if ((short)sel < 0)
I guess it would be better if that function returned a signed short so
you don't have to cast it here. (You're casting it to an unsigned long
below anyway.)
> + return -1L;
> +
> + if (v8086_mode(regs))
> + /*
> + * Base is simply the segment selector shifted 4
> + * positions to the right.
> + */
> + return (unsigned long)(sel << 4);
> +
...
> +static unsigned long get_seg_limit(struct pt_regs *regs, struct insn *insn,
> +int regoff)
> +{
> + struct desc_struct *desc;
> + unsigned short sel;
> + unsigned long limit;
> + enum segment_register seg_reg;
> +
> + seg_reg = resolve_seg_register(insn, regs, regoff);
> + if (seg_reg == SEG_REG_INVAL)
> + return 0;
> +
> + sel = get_segment_selector(regs, seg_reg);
> + if ((short)sel < 0)
Ditto.
> + return 0;
> +
> + if (user_64bit_mode(regs) || v8086_mode(regs))
> + return -1L;
> +
> + if (!sel)
> + return 0;
> +
> + desc = get_desc(sel);
> + if (!desc)
> + return 0;
> +
> + /*
> + * If the granularity bit is set, the limit is given in multiples
> + * of 4096. When the granularity bit is set, the least 12 significant
the 12 least significant
bits
> + * bits are not tested when checking the segment limits. In practice,
> + * this means that the segment ends in (limit << 12) + 0xfff.
> + */
> + limit = get_desc_limit(desc);
> + if (desc->g)
> + limit <<= 12 | 0x7;
That 0x7 doesn't look like 0xfff - it shifts limit by 15 instead. You
can simply write it like you mean it:
limit = (limit << 12) + 0xfff;
--
Regards/Gruss,
Boris.
SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284
(AG Nürnberg)
--
--
To unsubscribe from this list: send the line "unsubscribe linux-msdos" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
[PATCH v7 12/26] x86/insn-eval: Add utility functions to get segment descriptor base address and limit
With segmentation, the base address of the segment descriptor is needed
to compute a linear address. The segment descriptor used in the address
computation depends on either any segment override prefixes in the
instruction or the default segment determined by the registers involved
in the address computation. Thus, both the instruction as well as the
register (specified as the offset from the base of pt_regs) are given as
inputs, along with a boolean variable to select between override and
default.
The segment selector is determined by get_seg_selector() with the inputs
described above. Once the selector is known, the base address is
determined. In protected mode, the selector is used to obtain the segment
descriptor and then its base address. If in 64-bit user mode, the segment
base address is zero except when FS or GS are used. In virtual-8086 mode,
the base address is computed as the value of the segment selector shifted 4
positions to the left.
In protected mode, segment limits are enforced. Thus, a function to
determine the limit of the segment is added. Segment limits are not
enforced in long or virtual-8086. For the latter, addresses are limited
to 20 bits; address size will be handled when computing the linear
address.
Cc: Dave Hansen
Cc: Adam Buchbinder
Cc: Colin Ian King
Cc: Lorenzo Stoakes
Cc: Qiaowei Ren
Cc: Arnaldo Carvalho de Melo
Cc: Masami Hiramatsu
Cc: Adrian Hunter
Cc: Kees Cook
Cc: Thomas Garnier
Cc: Peter Zijlstra
Cc: Borislav Petkov
Cc: Dmitry Vyukov
Cc: Ravi V. Shankar
Cc: x...@kernel.org
Signed-off-by: Ricardo Neri
---
arch/x86/include/asm/insn-eval.h | 2 +
arch/x86/lib/insn-eval.c | 127 +++
2 files changed, 129 insertions(+)
diff --git a/arch/x86/include/asm/insn-eval.h b/arch/x86/include/asm/insn-eval.h
index 7e8c963..7f3c7fe 100644
--- a/arch/x86/include/asm/insn-eval.h
+++ b/arch/x86/include/asm/insn-eval.h
@@ -13,5 +13,7 @@
void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs);
int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs);
+unsigned long insn_get_seg_base(struct pt_regs *regs, struct insn *insn,
+ int regoff);
#endif /* _ASM_X86_INSN_EVAL_H */
diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c
index f46cb31..c77ed80 100644
--- a/arch/x86/lib/insn-eval.c
+++ b/arch/x86/lib/insn-eval.c
@@ -476,6 +476,133 @@ static struct desc_struct *get_desc(unsigned short sel)
}
/**
+ * insn_get_seg_base() - Obtain base address of segment descriptor.
+ * @regs: Structure with register values as seen when entering kernel mode
+ * @insn: Instruction structure with selector override prefixes
+ * @regoff:Operand offset, in pt_regs, of which the selector is needed
+ *
+ * Obtain the base address of the segment descriptor as indicated by either
+ * any segment override prefixes contained in insn or the default segment
+ * applicable to the register indicated by regoff. regoff is specified as the
+ * offset in bytes from the base of pt_regs.
+ *
+ * Return: In protected mode, base address of the segment. Zero in for long
+ * mode, except when FS or GS are used. In virtual-8086 mode, the segment
+ * selector shifted 4 positions to the right. -1L in case of
+ * error.
+ */
+unsigned long insn_get_seg_base(struct pt_regs *regs, struct insn *insn,
+ int regoff)
+{
+ struct desc_struct *desc;
+ unsigned short sel;
+ enum segment_register seg_reg;
+
+ seg_reg = resolve_seg_register(insn, regs, regoff);
+ if (seg_reg == SEG_REG_INVAL)
+ return -1L;
+
+ sel = get_segment_selector(regs, seg_reg);
+ if ((short)sel < 0)
+ return -1L;
+
+ if (v8086_mode(regs))
+ /*
+* Base is simply the segment selector shifted 4
+* positions to the right.
+*/
+ return (unsigned long)(sel << 4);
+
+ if (user_64bit_mode(regs)) {
+ /*
+* Only FS or GS will have a base address, the rest of
+* the segments' bases are forced to 0.
+*/
+ unsigned long base;
+
+ if (seg_reg == SEG_REG_FS)
+ rdmsrl(MSR_FS_BASE, base);
+ else if (seg_reg == SEG_REG_GS)
+ /*
+* swapgs was called at the kernel entry point. Thus,
+* MSR_KERNEL_GS_BASE will have the user-space GS base.
+*/
+ rdmsrl(MSR_KERNEL_GS_BASE, base);
+ else if (seg_reg != SEG_REG_IGNORE)
+ /* We should ignore the rest of segment registers */
+ base = -1L;
+ else
+ base = 0;
+ return base;
+ }
+
+ /* In protected mode the segment selector cannot be null */
+ if (!sel)
