From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751015AbdE0EQw (ORCPT ); Sat, 27 May 2017 00:16:52 -0400 Received: from mga02.intel.com ([134.134.136.20]:30324 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751913AbdE0Dgh (ORCPT ); Fri, 26 May 2017 23:36:37 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.38,400,1491289200"; d="scan'208";a="1135278041" Message-ID: <1495856195.24288.43.camel@ranerica-desktop> Subject: Re: [PATCH v7 04/26] x86/mpx: Do not use SIB.index if its value is 100b and ModRM.mod is not 11b From: Ricardo Neri To: Borislav Petkov Cc: Ingo Molnar , Thomas Gleixner , "H. Peter Anvin" , Andy Lutomirski , Peter Zijlstra , Andrew Morton , Brian Gerst , Chris Metcalf , Dave Hansen , Paolo Bonzini , Liang Z Li , Masami Hiramatsu , Huang Rui , Jiri Slaby , Jonathan Corbet , "Michael S. Tsirkin" , Paul Gortmaker , Vlastimil Babka , Chen Yucong , Alexandre Julliard , Stas Sergeev , Fenghua Yu , "Ravi V. Shankar" , Shuah Khan , linux-kernel@vger.kernel.org, x86@kernel.org, linux-msdos@vger.kernel.org, wine-devel@winehq.org, Adam Buchbinder , Colin Ian King , Lorenzo Stoakes , Qiaowei Ren , Nathan Howard , Adan Hawthorn , Joe Perches Date: Fri, 26 May 2017 20:36:35 -0700 In-Reply-To: <20170524133737.GC7275@nazgul.tnic> References: <20170505181724.55000-1-ricardo.neri-calderon@linux.intel.com> <20170505181724.55000-5-ricardo.neri-calderon@linux.intel.com> <20170524133737.GC7275@nazgul.tnic> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 2017-05-24 at 15:37 +0200, Borislav Petkov wrote: > On Fri, May 05, 2017 at 11:17:02AM -0700, Ricardo Neri wrote: > > Section 2.2.1.2 of the Intel 64 and IA-32 Architectures Software > > Developer's Manual volume 2A states that when ModRM.mod !=11b and > > ModRM.rm = 100b indexed register-indirect addressing is used. In other > > words, a SIB byte follows the ModRM byte. In the specific case of > > SIB.index = 100b, the scale*index portion of the computation of the > > effective address is null. To signal callers of this particular situation, > > get_reg_offset() can return -EDOM (-EINVAL continues to indicate that an > > error when decoding the SIB byte). > > > > An example of this situation can be the following instruction: > > > > 8b 4c 23 80 mov -0x80(%rbx,%riz,1),%rcx > > ModRM: 0x4c [mod:1b][reg:1b][rm:100b] > > SIB: 0x23 [scale:0b][index:100b][base:11b] > > Displacement: 0x80 (1-byte, as per ModRM.mod = 1b) > > > > The %riz 'register' indicates a null index. > > > > In long mode, a REX prefix may be used. When a REX prefix is present, > > REX.X adds a fourth bit to the register selection of SIB.index. This gives > > the ability to refer to all the 16 general purpose registers. When REX.X is > > 1b and SIB.index is 100b, the index is indicated in %r12. In our example, > > this would look like: > > > > 42 8b 4c 23 80 mov -0x80(%rbx,%r12,1),%rcx > > REX: 0x42 [W:0b][R:0b][X:1b][B:0b] > > ModRM: 0x4c [mod:1b][reg:1b][rm:100b] > > SIB: 0x23 [scale:0b][.X: 1b, index:100b][.B:0b, base:11b] > > Displacement: 0x80 (1-byte, as per ModRM.mod = 1b) > > > > Cc: Borislav Petkov > > Cc: Andy Lutomirski > > Cc: Dave Hansen > > Cc: Adam Buchbinder > > Cc: Colin Ian King > > Cc: Lorenzo Stoakes > > Cc: Qiaowei Ren > > Cc: Peter Zijlstra > > Cc: Nathan Howard > > Cc: Adan Hawthorn > > Cc: Joe Perches > > Cc: Ravi V. Shankar > > Cc: x86@kernel.org > > Signed-off-by: Ricardo Neri > > --- > > arch/x86/mm/mpx.c | 20 ++++++++++++++++++-- > > 1 file changed, 18 insertions(+), 2 deletions(-) > > > > diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c > > index ebdead8..7397b81 100644 > > --- a/arch/x86/mm/mpx.c > > +++ b/arch/x86/mm/mpx.c > > @@ -110,6 +110,14 @@ static int get_reg_offset(struct insn *insn, struct pt_regs *regs, > > regno = X86_SIB_INDEX(insn->sib.value); > > if (X86_REX_X(insn->rex_prefix.value)) > > regno += 8; > > <--- newline. I will add a new line here. > > > + /* > > + * If ModRM.mod !=3 and SIB.index (regno=4) the scale*index > > + * portion of the address computation is null. This is > > + * true only if REX.X is 0. In such a case, the SIB index > > + * is used in the address computation. > > + */ > > + if (X86_MODRM_MOD(insn->modrm.value) != 3 && regno == 4) > > + return -EDOM; > > break; > > > > case REG_TYPE_BASE: > > @@ -159,11 +167,19 @@ static void __user *mpx_get_addr_ref(struct insn *insn, struct pt_regs *regs) > > goto out_err; > > > > indx_offset = get_reg_offset(insn, regs, REG_TYPE_INDEX); > > - if (indx_offset < 0) > > <--- newline. I will add a new line here. > > > + /* > > + * A negative offset generally means a error, except > > an > > > + * -EDOM, which means that the contents of the register > > + * should not be used as index. > > + */ > > + if (indx_offset == -EDOM) > > + indx = 0; > > + else if (indx_offset < 0) > > goto out_err; > > + else > > + indx = regs_get_register(regs, indx_offset); > > > > base = regs_get_register(regs, base_offset); > > - indx = regs_get_register(regs, indx_offset); > > eff_addr = base + indx * (1 << X86_SIB_SCALE(sib)); > > } else { > > addr_offset = get_reg_offset(insn, regs, REG_TYPE_RM); > > -- > > 2.9.3 > > > > -- > Regards/Gruss, > Boris. Thanks for reviewing! BR, Ricardo > > SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)