Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1594773
| From | Ricardo Neri <ricardo.neri-calderon@linux.intel.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [v6 PATCH 02/21] x86/mpx: Do not use SIB index if index points to R/ESP |
| Date | 2017-03-08 02:00 +0100 |
| Message-ID | <tiy7n-7dF-3@gated-at.bofh.it> (permalink) |
| References | <tixO1-76a-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Section 2.2.1.2 of the Intel 64 and IA-32 Architectures Software
Developer's Manual volume 2A states that when memory addressing is used
(i.e., mod part of ModR/M is not 3), a SIB byte is used and the index of
the SIB byte points to the R/ESP (i.e., index = 4), the index should not be
used in the computation of the memory address.
In these cases the address is simply the value present in the register
pointed by the base part of the SIB byte plus the displacement byte.
An example of such instruction could be
insn -0x80(%rsp)
This is represented as:
[opcode] 4c 23 80
ModR/M=0x4c: mod: 0x1, reg: 0x1: r/m: 0x4(R/ESP)
SIB=0x23: sc: 0, index: 0x100(R/ESP), base: 0x11(R/EBX):
Displacement -0x80
The correct address is (base) + displacement; no index is used.
We can achieve the desired effect of not using the index by making
get_reg_offset return -EDOM in this particular case. This value indicates
callers that they should not use the index to calculate the address.
EINVAL continues to indicate that an error when decoding the SIB byte.
Care is taken to allow R12 to be used as index, which is a valid scenario.
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Qiaowei Ren <qiaowei.ren@intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Nathan Howard <liverlint@gmail.com>
Cc: Adan Hawthorn <adanhawthorn@gmail.com>
Cc: Joe Perches <joe@perches.com>
Cc: Ravi V. Shankar <ravi.v.shankar@intel.com>
Cc: x86@kernel.org
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
---
arch/x86/mm/mpx.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index ff112e3..d9e92d6 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -110,6 +110,13 @@ static int get_reg_offset(struct insn *insn, struct pt_regs *regs,
regno = X86_SIB_INDEX(insn->sib.value);
if (X86_REX_X(insn->rex_prefix.value))
regno += 8;
+ /*
+ * If mod !=3, register R/ESP (regno=4) is not used as index in
+ * the address computation. Check is done after looking at REX.X
+ * This is because R12 (regno=12) can be used as an index.
+ */
+ if (regno == 4 && X86_MODRM_MOD(insn->modrm.value) != 3)
+ return -EDOM;
break;
case REG_TYPE_BASE:
@@ -159,11 +166,19 @@ static void __user *mpx_get_addr_ref(struct insn *insn, struct pt_regs *regs)
goto out_err;
indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX);
- if (indx_offset < 0)
+ /*
+ * A negative offset generally means a error, except
+ * -EDOM, which means that the contents of the register
+ * should not be used as index.
+ */
+ if (unlikely(indx_offset == -EDOM))
+ indx = 0;
+ else if (unlikely(indx_offset < 0))
goto out_err;
+ else
+ indx = regs_get_register(regs, indx_offset);
base = regs_get_register(regs, base_offset);
- indx = regs_get_register(regs, indx_offset);
eff_addr = base + indx * (1 << X86_SIB_SCALE(sib));
} else {
addr_offset = get_reg_offset(insn, regs, REG_TYPE_RM);
--
2.9.3
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:40 +0100
[v6 PATCH 09/21] x86/insn-eval: Add functions to get default operand and address sizes Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:40 +0100
[v6 PATCH 03/21] x86/mpx: Do not use R/EBP as base in the SIB byte with Mod = 0 Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:40 +0100
[v6 PATCH 08/21] x86/insn-eval: Add utility function to get segment descriptor base address Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:40 +0100
[v6 PATCH 15/21] x86/mm: Relocate page fault error codes to traps.h Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:40 +0100
Re: [v6 PATCH 15/21] x86/mm: Relocate page fault error codes to traps.h Andy Lutomirski <luto@amacapital.net> - 2017-03-08 17:10 +0100
[v6 PATCH 11/21] insn/eval: Incorporate segment base in address computation Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:40 +0100
[v6 PATCH 16/21] x86/cpufeature: Add User-Mode Instruction Prevention definitions Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:40 +0100
[v6 PATCH 21/21] selftests/x86: Add tests for User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:40 +0100
Re: [v6 PATCH 21/21] selftests/x86: Add tests for User-Mode Instruction Prevention Andy Lutomirski <luto@amacapital.net> - 2017-03-08 17:30 +0100
Re: [v6 PATCH 21/21] selftests/x86: Add tests for User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-11 00:40 +0100
[v6 PATCH 01/21] x86/mpx: Use signed variables to compute effective addresses Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:40 +0100
[v6 PATCH 20/21] x86: Enable User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:50 +0100
[v6 PATCH 13/21] x86/insn-eval: Add support to resolve 16-bit addressing encodings Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:50 +0100
[v6 PATCH 17/21] x86: Add emulation code for UMIP instructions Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:50 +0100
[v6 PATCH 05/21] x86/insn-eval: Add utility functions to get register offsets Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:50 +0100
[v6 PATCH 12/21] x86/insn: Support both signed 32-bit and 64-bit effective addresses Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:50 +0100
[v6 PATCH 07/21] x86/insn-eval: Add utility function to get segment descriptor Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:50 +0100
[v6 PATCH 18/21] x86/umip: Force a page fault when unable to copy emulated result to user Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:50 +0100
[v6 PATCH 14/21] x86/insn-eval: Add wrapper function for 16-bit and 32-bit address encodings Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 01:50 +0100
[v6 PATCH 06/21] x86/insn-eval: Add utility functions to get segment selector Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 02:00 +0100
[v6 PATCH 02/21] x86/mpx: Do not use SIB index if index points to R/ESP Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 02:00 +0100
[v6 PATCH 19/21] x86/traps: Fixup general protection faults caused by UMIP Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 02:00 +0100
Re: [v6 PATCH 19/21] x86/traps: Fixup general protection faults caused by UMIP Andy Lutomirski <luto@amacapital.net> - 2017-03-08 17:00 +0100
[v6 PATCH 10/21] x86/insn-eval: Do not use R/EBP as base if mod in ModRM is zero Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 02:10 +0100
[v6 PATCH 04/21] x86/mpx, x86/insn: Relocate insn util functions to a new insn-kernel Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-08 04:50 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Stas Sergeev <stsp@list.ru> - 2017-03-08 15:30 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Stas Sergeev <stsp@list.ru> - 2017-03-08 18:00 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-09 02:20 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Stas Sergeev <stsp@list.ru> - 2017-03-09 23:10 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Andy Lutomirski <luto@kernel.org> - 2017-03-10 03:50 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Stas Sergeev <stsp@list.ru> - 2017-03-10 22:00 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Andy Lutomirski <luto@amacapital.net> - 2017-03-10 22:10 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Stas Sergeev <stsp@list.ru> - 2017-03-10 22:40 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Andy Lutomirski <luto@amacapital.net> - 2017-03-08 18:20 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-09 02:20 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Stas Sergeev <stsp@list.ru> - 2017-03-09 23:20 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Andy Lutomirski <luto@amacapital.net> - 2017-03-10 03:50 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Stas Sergeev <stsp@list.ru> - 2017-03-10 12:40 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Andy Lutomirski <luto@amacapital.net> - 2017-03-10 15:20 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-11 02:30 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-11 01:10 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-11 01:00 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Stas Sergeev <stsp@list.ru> - 2017-03-08 23:30 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Andy Lutomirski <luto@amacapital.net> - 2017-03-08 23:50 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-09 02:50 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Stas Sergeev <stsp@list.ru> - 2017-03-10 02:30 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-11 00:50 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Stas Sergeev <stsp@list.ru> - 2017-03-11 01:00 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2017-03-11 01:20 +0100
Re: [v6 PATCH 00/21] x86: Enable User-Mode Instruction Prevention Andy Lutomirski <luto@amacapital.net> - 2017-03-08 17:20 +0100
csiph-web