| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 11 Feb 2021 18:30:50 +0100
From: Peter Zijlstra <peterz@...radead.org>
To: Josh Poimboeuf <jpoimboe@...hat.com>, x86@...nel.org
Cc: Miroslav Benes <mbenes@...e.cz>,
Julien Thierry <jthierry@...hat.com>,
Nick Desaulniers <ndesaulniers@...gle.com>,
Masami Hiramatsu <mhiramat@...nel.org>,
linux-kernel@...r.kernel.org, peterz@...radead.org
Subject: [RFC][PATCH v2 6/7] objtool,x86: Support %riz encodings
When there's a SIB byte, the register otherwise denoted by r/m will
then be denoted by SIB.base REX.b will now extend this. SIB.index == SP
is magic and notes an index value zero.
This means that there's a bunch of alternative (longer) encodings for
the same thing. Eg. 'ModRM.mod != 3, ModRM.r/m = AX' can be encoded as
'ModRM.mod != 3, ModRM.r/m = SP, SIB.base = AX, SIB.index = SP' which is actually 4
different encodings because the value of SIB.scale is irrelevant,
giving rise to 5 different but equal encodings.
Support these encodings and clean up the SIB handling in general.
Signed-off-by: Peter Zijlstra (Intel) <peterz@...radead.org>
---
tools/objtool/arch/x86/decode.c | 67 ++++++++++++++++++++++++++++------------
1 file changed, 48 insertions(+), 19 deletions(-)
--- a/tools/objtool/arch/x86/decode.c
+++ b/tools/objtool/arch/x86/decode.c
@@ -72,6 +72,25 @@ unsigned long arch_jump_destination(stru
return -1; \
else for (list_add_tail(&op->list, ops_list); op; op = NULL)
+/*
+ * Helpers to decode ModRM/SIB:
+ *
+ * r/m| AX CX DX BX | SP | BP | SI DI |
+ * | R8 R9 R10 R11 | R12 | R13 | R14 R15 |
+ * Mod+----------------+-----+-----+---------+
+ * 00 | [r/m] |[SIB]|[IP+]| [r/m] |
+ * 01 | [r/m + d8] |[S+d]| [r/m + d8] |
+ * 10 | [r/m + d32] |[S+D]| [r/m + d32] |
+ * 11 | r/ m |
+ *
+ */
+#define is_RIP() ((modrm_rm & 7) == CFI_BP && modrm_mod == 0)
+#define have_SIB() ((modrm_rm & 7) == CFI_SP && modrm_mod != 3)
+
+#define rm_is(reg) (have_SIB() ? \
+ sib_base == (reg) && sib_index == CFI_SP : \
+ modrm_rm == (reg))
+
int arch_decode_instruction(const struct elf *elf, const struct section *sec,
unsigned long offset, unsigned int maxlen,
unsigned int *len, enum insn_type *type,
@@ -83,7 +102,7 @@ int arch_decode_instruction(const struct
unsigned char op1, op2,
rex = 0, rex_b = 0, rex_r = 0, rex_w = 0, rex_x = 0,
modrm = 0, modrm_mod = 0, modrm_rm = 0, modrm_reg = 0,
- sib = 0 /* , sib_scale = 0, sib_index = 0, sib_base = 0 */;
+ sib = 0, /* sib_scale = 0, */ sib_index = 0, sib_base = 0;
struct stack_op *op = NULL;
struct symbol *sym;
@@ -125,11 +144,9 @@ int arch_decode_instruction(const struct
if (insn.sib.nbytes) {
sib = insn.sib.bytes[0];
- /*
- sib_scale = X86_SIB_SCALE(sib);
+ /* sib_scale = X86_SIB_SCALE(sib); */
sib_index = X86_SIB_INDEX(sib) + 8*rex_x;
sib_base = X86_SIB_BASE(sib) + 8*rex_b;
- */
}
switch (op1) {
@@ -218,7 +235,10 @@ int arch_decode_instruction(const struct
break;
case 0x89:
- if (rex_w && modrm_reg == CFI_SP) {
+ if (!rex_w)
+ break;
+
+ if (modrm_reg == CFI_SP) {
if (modrm_mod == 3) {
/* mov %rsp, reg */
@@ -231,14 +251,17 @@ int arch_decode_instruction(const struct
break;
} else {
- /* skip nontrivial SIB */
- if ((modrm_rm & 7) == 4 && !(sib == 0x24 && rex_b == rex_x))
- break;
-
/* skip RIP relative displacement */
- if ((modrm_rm & 7) == 5 && modrm_mod == 0)
+ if (is_RIP())
break;
+ /* skip nontrivial SIB */
+ if (have_SIB()) {
+ modrm_rm = sib_base;
+ if (sib_index != CFI_SP)
+ break;
+ }
+
/* mov %rsp, disp(%reg) */
ADD_OP(op) {
op->src.type = OP_SRC_REG;
@@ -253,7 +276,7 @@ int arch_decode_instruction(const struct
break;
}
- if (rex_w && modrm_mod == 3 && modrm_rm == CFI_SP) {
+ if (modrm_mod == 3 && modrm_rm == CFI_SP) {
/* mov reg, %rsp */
ADD_OP(op) {
@@ -267,6 +290,9 @@ int arch_decode_instruction(const struct
/* fallthrough */
case 0x88:
+ if (!rex_w)
+ break;
+
if ((modrm_mod == 1 || modrm_mod == 2) && modrm_rm == CFI_BP) {
/* mov reg, disp(%rbp) */
@@ -280,7 +306,7 @@ int arch_decode_instruction(const struct
break;
}
- if (rex_w && modrm_rm == CFI_SP && sib == 0x24) {
+ if (modrm_mod != 3 && rm_is(CFI_SP)) {
/* mov reg, disp(%rsp) */
ADD_OP(op) {
@@ -299,7 +325,7 @@ int arch_decode_instruction(const struct
if (!rex_w)
break;
- if (modrm_mod == 1 && modrm_rm == CFI_BP) {
+ if ((modrm_mod == 1 || modrm_mod == 2) && modrm_rm == CFI_BP) {
/* mov disp(%rbp), reg */
ADD_OP(op) {
@@ -312,7 +338,7 @@ int arch_decode_instruction(const struct
break;
}
- if (modrm_mod != 3 && modrm_rm == CFI_SP && sib == 0x24) {
+ if (modrm_mod != 3 && rm_is(CFI_SP)) {
/* mov disp(%rsp), reg */
ADD_OP(op) {
@@ -332,14 +358,17 @@ int arch_decode_instruction(const struct
if (!rex_w)
break;
- /* skip nontrivial SIB */
- if ((modrm_rm & 7) == 4 && !(sib == 0x24 && rex_b == rex_x))
- break;
-
/* skip RIP relative displacement */
- if ((modrm_rm & 7) == 5 && modrm_mod == 0)
+ if (is_RIP())
break;
+ /* skip nontrivial SIB */
+ if (have_SIB()) {
+ modrm_rm = sib_base;
+ if (sib_index != CFI_SP)
+ break;
+ }
+
/* lea disp(%src), %dst */
ADD_OP(op) {
op->src.offset = insn.displacement.value;
Powered by blists - more mailing lists