69 |
|
enum transfer_size_t { |
70 |
|
SIZE_UNKNOWN, |
71 |
|
SIZE_BYTE, |
72 |
< |
SIZE_WORD, |
73 |
< |
SIZE_LONG |
72 |
> |
SIZE_WORD, // 2 bytes |
73 |
> |
SIZE_LONG, // 4 bytes |
74 |
> |
SIZE_QUAD, // 8 bytes |
75 |
|
}; |
76 |
|
|
77 |
|
// Transfer type |
222 |
|
#define SIGSEGV_FAULT_HANDLER_ARGLIST_1 siginfo_t *sip, void *scp |
223 |
|
#define SIGSEGV_FAULT_HANDLER_ARGS sip, scp |
224 |
|
#define SIGSEGV_FAULT_ADDRESS sip->si_addr |
225 |
+ |
#if (defined(sgi) || defined(__sgi)) |
226 |
+ |
#include <ucontext.h> |
227 |
+ |
#define SIGSEGV_CONTEXT_REGS (((ucontext_t *)scp)->uc_mcontext.gregs) |
228 |
+ |
#define SIGSEGV_FAULT_INSTRUCTION (unsigned long)SIGSEGV_CONTEXT_REGS[CTX_EPC] |
229 |
+ |
#endif |
230 |
|
#if defined(__sun__) |
231 |
|
#if (defined(sparc) || defined(__sparc__)) |
232 |
|
#include <sys/ucontext.h> |
237 |
|
#if defined(__FreeBSD__) |
238 |
|
#if (defined(i386) || defined(__i386__)) |
239 |
|
#define SIGSEGV_FAULT_INSTRUCTION (((struct sigcontext *)scp)->sc_eip) |
240 |
< |
#define SIGSEGV_REGISTER_FILE ((unsigned int *)&(((struct sigcontext *)scp)->sc_edi)) /* EDI is the first GPR (even below EIP) in sigcontext */ |
240 |
> |
#define SIGSEGV_REGISTER_FILE ((unsigned long *)&(((struct sigcontext *)scp)->sc_edi)) /* EDI is the first GPR (even below EIP) in sigcontext */ |
241 |
|
#define SIGSEGV_SKIP_INSTRUCTION ix86_skip_instruction |
242 |
|
#endif |
243 |
|
#endif |
246 |
|
#include <sys/ucontext.h> |
247 |
|
#define SIGSEGV_CONTEXT_REGS (((ucontext_t *)scp)->uc_mcontext.gregs) |
248 |
|
#define SIGSEGV_FAULT_INSTRUCTION SIGSEGV_CONTEXT_REGS[14] /* should use REG_EIP instead */ |
249 |
< |
#define SIGSEGV_REGISTER_FILE (unsigned int *)SIGSEGV_CONTEXT_REGS |
249 |
> |
#define SIGSEGV_REGISTER_FILE (unsigned long *)SIGSEGV_CONTEXT_REGS |
250 |
|
#define SIGSEGV_SKIP_INSTRUCTION ix86_skip_instruction |
251 |
|
#endif |
252 |
|
#if (defined(x86_64) || defined(__x86_64__)) |
254 |
|
#define SIGSEGV_CONTEXT_REGS (((ucontext_t *)scp)->uc_mcontext.gregs) |
255 |
|
#define SIGSEGV_FAULT_INSTRUCTION SIGSEGV_CONTEXT_REGS[16] /* should use REG_RIP instead */ |
256 |
|
#define SIGSEGV_REGISTER_FILE (unsigned long *)SIGSEGV_CONTEXT_REGS |
257 |
+ |
#define SIGSEGV_SKIP_INSTRUCTION ix86_skip_instruction |
258 |
|
#endif |
259 |
|
#if (defined(ia64) || defined(__ia64__)) |
260 |
|
#define SIGSEGV_FAULT_INSTRUCTION (((struct sigcontext *)scp)->sc_ip & ~0x3ULL) /* slot number is in bits 0 and 1 */ |
280 |
|
#define SIGSEGV_FAULT_HANDLER_ARGS &scs |
281 |
|
#define SIGSEGV_FAULT_ADDRESS scp->cr2 |
282 |
|
#define SIGSEGV_FAULT_INSTRUCTION scp->eip |
283 |
< |
#define SIGSEGV_REGISTER_FILE (unsigned int *)scp |
283 |
> |
#define SIGSEGV_REGISTER_FILE (unsigned long *)scp |
284 |
|
#define SIGSEGV_SKIP_INSTRUCTION ix86_skip_instruction |
285 |
|
#endif |
286 |
|
#if (defined(sparc) || defined(__sparc__)) |
308 |
|
#endif |
309 |
|
|
310 |
|
// Irix 5 or 6 on MIPS |
311 |
< |
#if (defined(sgi) || defined(__sgi)) && (defined(SYSTYPE_SVR4) || defined(__SYSTYPE_SVR4)) |
311 |
> |
#if (defined(sgi) || defined(__sgi)) && (defined(SYSTYPE_SVR4) || defined(_SYSTYPE_SVR4)) |
312 |
|
#include <ucontext.h> |
313 |
|
#define SIGSEGV_FAULT_HANDLER_ARGLIST int sig, int code, struct sigcontext *scp |
314 |
|
#define SIGSEGV_FAULT_HANDLER_ARGS sig, code, scp |
315 |
< |
#define SIGSEGV_FAULT_ADDRESS scp->sc_badvaddr |
315 |
> |
#define SIGSEGV_FAULT_ADDRESS (unsigned long)scp->sc_badvaddr |
316 |
> |
#define SIGSEGV_FAULT_INSTRUCTION (unsigned long)scp->sc_pc |
317 |
|
#define SIGSEGV_ALL_SIGNALS FAULT_HANDLER(SIGSEGV) |
318 |
|
#endif |
319 |
|
|
392 |
|
#define SIGSEGV_FAULT_HANDLER_ARGS sig, code, scp, addr |
393 |
|
#define SIGSEGV_FAULT_ADDRESS addr |
394 |
|
#define SIGSEGV_FAULT_INSTRUCTION scp->sc_eip |
395 |
< |
#define SIGSEGV_REGISTER_FILE ((unsigned int *)&scp->sc_edi) |
395 |
> |
#define SIGSEGV_REGISTER_FILE ((unsigned long *)&scp->sc_edi) |
396 |
|
#define SIGSEGV_SKIP_INSTRUCTION ix86_skip_instruction |
397 |
|
#endif |
398 |
|
#endif |
585 |
|
|
586 |
|
#ifdef HAVE_SIGSEGV_SKIP_INSTRUCTION |
587 |
|
// Decode and skip X86 instruction |
588 |
< |
#if (defined(i386) || defined(__i386__)) |
588 |
> |
#if (defined(i386) || defined(__i386__)) || defined(__x86_64__) |
589 |
|
#if defined(__linux__) |
590 |
|
enum { |
591 |
+ |
#if (defined(i386) || defined(__i386__)) |
592 |
|
X86_REG_EIP = 14, |
593 |
|
X86_REG_EAX = 11, |
594 |
|
X86_REG_ECX = 10, |
598 |
|
X86_REG_EBP = 6, |
599 |
|
X86_REG_ESI = 5, |
600 |
|
X86_REG_EDI = 4 |
601 |
+ |
#endif |
602 |
+ |
#if defined(__x86_64__) |
603 |
+ |
X86_REG_R8 = 0, |
604 |
+ |
X86_REG_R9 = 1, |
605 |
+ |
X86_REG_R10 = 2, |
606 |
+ |
X86_REG_R11 = 3, |
607 |
+ |
X86_REG_R12 = 4, |
608 |
+ |
X86_REG_R13 = 5, |
609 |
+ |
X86_REG_R14 = 6, |
610 |
+ |
X86_REG_R15 = 7, |
611 |
+ |
X86_REG_EDI = 8, |
612 |
+ |
X86_REG_ESI = 9, |
613 |
+ |
X86_REG_EBP = 10, |
614 |
+ |
X86_REG_EBX = 11, |
615 |
+ |
X86_REG_EDX = 12, |
616 |
+ |
X86_REG_EAX = 13, |
617 |
+ |
X86_REG_ECX = 14, |
618 |
+ |
X86_REG_ESP = 15, |
619 |
+ |
X86_REG_EIP = 16 |
620 |
+ |
#endif |
621 |
|
}; |
622 |
|
#endif |
623 |
|
#if defined(__NetBSD__) || defined(__FreeBSD__) |
624 |
|
enum { |
625 |
+ |
#if (defined(i386) || defined(__i386__)) |
626 |
|
X86_REG_EIP = 10, |
627 |
|
X86_REG_EAX = 7, |
628 |
|
X86_REG_ECX = 6, |
632 |
|
X86_REG_EBP = 2, |
633 |
|
X86_REG_ESI = 1, |
634 |
|
X86_REG_EDI = 0 |
635 |
+ |
#endif |
636 |
|
}; |
637 |
|
#endif |
638 |
|
// FIXME: this is partly redundant with the instruction decoding phase |
669 |
|
return offset; |
670 |
|
} |
671 |
|
|
672 |
< |
static bool ix86_skip_instruction(unsigned int * regs) |
672 |
> |
static bool ix86_skip_instruction(unsigned long * regs) |
673 |
|
{ |
674 |
|
unsigned char * eip = (unsigned char *)regs[X86_REG_EIP]; |
675 |
|
|
681 |
|
|
682 |
|
int reg = -1; |
683 |
|
int len = 0; |
684 |
< |
|
684 |
> |
|
685 |
> |
#if DEBUG |
686 |
> |
printf("IP: %p [%02x %02x %02x %02x...]\n", |
687 |
> |
eip, eip[0], eip[1], eip[2], eip[3]); |
688 |
> |
#endif |
689 |
> |
|
690 |
|
// Operand size prefix |
691 |
|
if (*eip == 0x66) { |
692 |
|
eip++; |
694 |
|
transfer_size = SIZE_WORD; |
695 |
|
} |
696 |
|
|
697 |
+ |
// REX prefix |
698 |
+ |
#if defined(__x86_64__) |
699 |
+ |
struct rex_t { |
700 |
+ |
unsigned char W; |
701 |
+ |
unsigned char R; |
702 |
+ |
unsigned char X; |
703 |
+ |
unsigned char B; |
704 |
+ |
}; |
705 |
+ |
rex_t rex = { 0, 0, 0, 0 }; |
706 |
+ |
bool has_rex = false; |
707 |
+ |
if ((*eip & 0xf0) == 0x40) { |
708 |
+ |
has_rex = true; |
709 |
+ |
const unsigned char b = *eip; |
710 |
+ |
rex.W = b & (1 << 3); |
711 |
+ |
rex.R = b & (1 << 2); |
712 |
+ |
rex.X = b & (1 << 1); |
713 |
+ |
rex.B = b & (1 << 0); |
714 |
+ |
#if DEBUG |
715 |
+ |
printf("REX: %c,%c,%c,%c\n", |
716 |
+ |
rex.W ? 'W' : '_', |
717 |
+ |
rex.R ? 'R' : '_', |
718 |
+ |
rex.X ? 'X' : '_', |
719 |
+ |
rex.B ? 'B' : '_'); |
720 |
+ |
#endif |
721 |
+ |
eip++; |
722 |
+ |
len++; |
723 |
+ |
if (rex.W) |
724 |
+ |
transfer_size = SIZE_QUAD; |
725 |
+ |
} |
726 |
+ |
#else |
727 |
+ |
const bool has_rex = false; |
728 |
+ |
#endif |
729 |
+ |
|
730 |
|
// Decode instruction |
731 |
|
switch (eip[0]) { |
732 |
|
case 0x0f: |
796 |
|
return false; |
797 |
|
} |
798 |
|
|
799 |
+ |
#if defined(__x86_64__) |
800 |
+ |
if (rex.R) |
801 |
+ |
reg += 8; |
802 |
+ |
#endif |
803 |
+ |
|
804 |
|
if (transfer_type == SIGSEGV_TRANSFER_LOAD && reg != -1) { |
805 |
< |
static const int x86_reg_map[8] = { |
805 |
> |
static const int x86_reg_map[] = { |
806 |
|
X86_REG_EAX, X86_REG_ECX, X86_REG_EDX, X86_REG_EBX, |
807 |
< |
X86_REG_ESP, X86_REG_EBP, X86_REG_ESI, X86_REG_EDI |
807 |
> |
X86_REG_ESP, X86_REG_EBP, X86_REG_ESI, X86_REG_EDI, |
808 |
> |
#if defined(__x86_64__) |
809 |
> |
X86_REG_R8, X86_REG_R9, X86_REG_R10, X86_REG_R11, |
810 |
> |
X86_REG_R12, X86_REG_R13, X86_REG_R14, X86_REG_R15, |
811 |
> |
#endif |
812 |
|
}; |
813 |
|
|
814 |
< |
if (reg < 0 || reg >= 8) |
814 |
> |
if (reg < 0 || reg >= (sizeof(x86_reg_map)/sizeof(x86_reg_map[0]) - 1)) |
815 |
|
return false; |
816 |
|
|
817 |
+ |
// Set 0 to the relevant register part |
818 |
+ |
// NOTE: this is only valid for MOV alike instructions |
819 |
|
int rloc = x86_reg_map[reg]; |
820 |
|
switch (transfer_size) { |
821 |
|
case SIZE_BYTE: |
822 |
< |
regs[rloc] = (regs[rloc] & ~0xff); |
822 |
> |
if (has_rex || reg < 4) |
823 |
> |
regs[rloc] = (regs[rloc] & ~0x00ffL); |
824 |
> |
else { |
825 |
> |
rloc = x86_reg_map[reg - 4]; |
826 |
> |
regs[rloc] = (regs[rloc] & ~0xff00L); |
827 |
> |
} |
828 |
|
break; |
829 |
|
case SIZE_WORD: |
830 |
< |
regs[rloc] = (regs[rloc] & ~0xffff); |
830 |
> |
regs[rloc] = (regs[rloc] & ~0xffffL); |
831 |
|
break; |
832 |
|
case SIZE_LONG: |
833 |
+ |
case SIZE_QUAD: // zero-extension |
834 |
|
regs[rloc] = 0; |
835 |
|
break; |
836 |
|
} |
838 |
|
|
839 |
|
#if DEBUG |
840 |
|
printf("%08x: %s %s access", regs[X86_REG_EIP], |
841 |
< |
transfer_size == SIZE_BYTE ? "byte" : transfer_size == SIZE_WORD ? "word" : "long", |
841 |
> |
transfer_size == SIZE_BYTE ? "byte" : |
842 |
> |
transfer_size == SIZE_WORD ? "word" : |
843 |
> |
transfer_size == SIZE_LONG ? "long" : |
844 |
> |
transfer_size == SIZE_QUAD ? "quad" : "unknown", |
845 |
|
transfer_type == SIGSEGV_TRANSFER_LOAD ? "read" : "write"); |
846 |
|
|
847 |
|
if (reg != -1) { |
848 |
< |
static const char * x86_reg_str_map[8] = { |
849 |
< |
"eax", "ecx", "edx", "ebx", |
850 |
< |
"esp", "ebp", "esi", "edi" |
848 |
> |
static const char * x86_byte_reg_str_map[] = { |
849 |
> |
"al", "cl", "dl", "bl", |
850 |
> |
"spl", "bpl", "sil", "dil", |
851 |
> |
"r8b", "r9b", "r10b", "r11b", |
852 |
> |
"r12b", "r13b", "r14b", "r15b", |
853 |
> |
"ah", "ch", "dh", "bh", |
854 |
> |
}; |
855 |
> |
static const char * x86_word_reg_str_map[] = { |
856 |
> |
"ax", "cx", "dx", "bx", |
857 |
> |
"sp", "bp", "si", "di", |
858 |
> |
"r8w", "r9w", "r10w", "r11w", |
859 |
> |
"r12w", "r13w", "r14w", "r15w", |
860 |
|
}; |
861 |
< |
printf(" %s register %%%s", transfer_type == SIGSEGV_TRANSFER_LOAD ? "to" : "from", x86_reg_str_map[reg]); |
861 |
> |
static const char *x86_long_reg_str_map[] = { |
862 |
> |
"eax", "ecx", "edx", "ebx", |
863 |
> |
"esp", "ebp", "esi", "edi", |
864 |
> |
"r8d", "r9d", "r10d", "r11d", |
865 |
> |
"r12d", "r13d", "r14d", "r15d", |
866 |
> |
}; |
867 |
> |
static const char *x86_quad_reg_str_map[] = { |
868 |
> |
"rax", "rcx", "rdx", "rbx", |
869 |
> |
"rsp", "rbp", "rsi", "rdi", |
870 |
> |
"r8", "r9", "r10", "r11", |
871 |
> |
"r12", "r13", "r14", "r15", |
872 |
> |
}; |
873 |
> |
const char * reg_str = NULL; |
874 |
> |
switch (transfer_size) { |
875 |
> |
case SIZE_BYTE: |
876 |
> |
reg_str = x86_byte_reg_str_map[(!has_rex && reg >= 4 ? 12 : 0) + reg]; |
877 |
> |
break; |
878 |
> |
case SIZE_WORD: reg_str = x86_word_reg_str_map[reg]; break; |
879 |
> |
case SIZE_LONG: reg_str = x86_long_reg_str_map[reg]; break; |
880 |
> |
case SIZE_QUAD: reg_str = x86_quad_reg_str_map[reg]; break; |
881 |
> |
} |
882 |
> |
if (reg_str) |
883 |
> |
printf(" %s register %%%s", |
884 |
> |
transfer_type == SIGSEGV_TRANSFER_LOAD ? "to" : "from", |
885 |
> |
reg_str); |
886 |
|
} |
887 |
|
printf(", %d bytes instruction\n", len); |
888 |
|
#endif |
1390 |
|
|
1391 |
|
return SIGSEGV_RETURN_FAILURE; |
1392 |
|
} |
1393 |
+ |
|
1394 |
+ |
// More sophisticated tests for instruction skipper |
1395 |
+ |
static bool arch_insn_skipper_tests() |
1396 |
+ |
{ |
1397 |
+ |
#if (defined(i386) || defined(__i386__)) || defined(__x86_64__) |
1398 |
+ |
static const unsigned char code[] = { |
1399 |
+ |
0x8a, 0x00, // mov (%eax),%al |
1400 |
+ |
0x8a, 0x2c, 0x18, // mov (%eax,%ebx,1),%ch |
1401 |
+ |
0x88, 0x20, // mov %ah,(%eax) |
1402 |
+ |
0x88, 0x08, // mov %cl,(%eax) |
1403 |
+ |
0x66, 0x8b, 0x00, // mov (%eax),%ax |
1404 |
+ |
0x66, 0x8b, 0x0c, 0x18, // mov (%eax,%ebx,1),%cx |
1405 |
+ |
0x66, 0x89, 0x00, // mov %ax,(%eax) |
1406 |
+ |
0x66, 0x89, 0x0c, 0x18, // mov %cx,(%eax,%ebx,1) |
1407 |
+ |
0x8b, 0x00, // mov (%eax),%eax |
1408 |
+ |
0x8b, 0x0c, 0x18, // mov (%eax,%ebx,1),%ecx |
1409 |
+ |
0x89, 0x00, // mov %eax,(%eax) |
1410 |
+ |
0x89, 0x0c, 0x18, // mov %ecx,(%eax,%ebx,1) |
1411 |
+ |
#if defined(__x86_64__) |
1412 |
+ |
0x44, 0x8a, 0x00, // mov (%rax),%r8b |
1413 |
+ |
0x44, 0x8a, 0x20, // mov (%rax),%r12b |
1414 |
+ |
0x42, 0x8a, 0x3c, 0x10, // mov (%rax,%r10,1),%dil |
1415 |
+ |
0x44, 0x88, 0x00, // mov %r8b,(%rax) |
1416 |
+ |
0x44, 0x88, 0x20, // mov %r12b,(%rax) |
1417 |
+ |
0x42, 0x88, 0x3c, 0x10, // mov %dil,(%rax,%r10,1) |
1418 |
+ |
0x66, 0x44, 0x8b, 0x00, // mov (%rax),%r8w |
1419 |
+ |
0x66, 0x42, 0x8b, 0x0c, 0x10, // mov (%rax,%r10,1),%cx |
1420 |
+ |
0x66, 0x44, 0x89, 0x00, // mov %r8w,(%rax) |
1421 |
+ |
0x66, 0x42, 0x89, 0x0c, 0x10, // mov %cx,(%rax,%r10,1) |
1422 |
+ |
0x44, 0x8b, 0x00, // mov (%rax),%r8d |
1423 |
+ |
0x42, 0x8b, 0x0c, 0x10, // mov (%rax,%r10,1),%ecx |
1424 |
+ |
0x44, 0x89, 0x00, // mov %r8d,(%rax) |
1425 |
+ |
0x42, 0x89, 0x0c, 0x10, // mov %ecx,(%rax,%r10,1) |
1426 |
+ |
0x48, 0x8b, 0x08, // mov (%rax),%rcx |
1427 |
+ |
0x4c, 0x8b, 0x18, // mov (%rax),%r11 |
1428 |
+ |
0x4a, 0x8b, 0x0c, 0x10, // mov (%rax,%r10,1),%rcx |
1429 |
+ |
0x4e, 0x8b, 0x1c, 0x10, // mov (%rax,%r10,1),%r11 |
1430 |
+ |
0x48, 0x89, 0x08, // mov %rcx,(%rax) |
1431 |
+ |
0x4c, 0x89, 0x18, // mov %r11,(%rax) |
1432 |
+ |
0x4a, 0x89, 0x0c, 0x10, // mov %rcx,(%rax,%r10,1) |
1433 |
+ |
0x4e, 0x89, 0x1c, 0x10, // mov %r11,(%rax,%r10,1) |
1434 |
+ |
#endif |
1435 |
+ |
0 // end |
1436 |
+ |
}; |
1437 |
+ |
const int N_REGS = 20; |
1438 |
+ |
unsigned long regs[N_REGS]; |
1439 |
+ |
for (int i = 0; i < N_REGS; i++) |
1440 |
+ |
regs[i] = i; |
1441 |
+ |
const unsigned long start_code = (unsigned long)&code; |
1442 |
+ |
regs[X86_REG_EIP] = start_code; |
1443 |
+ |
while ((regs[X86_REG_EIP] - start_code) < (sizeof(code) - 1) |
1444 |
+ |
&& ix86_skip_instruction(regs)) |
1445 |
+ |
; /* simply iterate */ |
1446 |
+ |
return (regs[X86_REG_EIP] - start_code) == (sizeof(code) - 1); |
1447 |
+ |
#endif |
1448 |
+ |
return true; |
1449 |
+ |
} |
1450 |
|
#endif |
1451 |
|
|
1452 |
|
int main(void) |
1493 |
|
return 8; |
1494 |
|
|
1495 |
|
#define TEST_SKIP_INSTRUCTION(TYPE) do { \ |
1496 |
< |
const unsigned int TAG = 0x12345678; \ |
1496 |
> |
const unsigned long TAG = 0x12345678 | \ |
1497 |
> |
(sizeof(long) == 8 ? 0x9abcdef0UL << 31 : 0); \ |
1498 |
|
TYPE data = *((TYPE *)(page + sizeof(TYPE))); \ |
1499 |
< |
volatile unsigned int effect = data + TAG; \ |
1499 |
> |
volatile unsigned long effect = data + TAG; \ |
1500 |
|
if (effect != TAG) \ |
1501 |
|
return 9; \ |
1502 |
|
} while (0) |
1509 |
|
TEST_SKIP_INSTRUCTION(unsigned char); |
1510 |
|
TEST_SKIP_INSTRUCTION(unsigned short); |
1511 |
|
TEST_SKIP_INSTRUCTION(unsigned int); |
1512 |
+ |
TEST_SKIP_INSTRUCTION(unsigned long); |
1513 |
|
L_e_region2: |
1514 |
+ |
|
1515 |
+ |
if (!arch_insn_skipper_tests()) |
1516 |
+ |
return 20; |
1517 |
|
#endif |
1518 |
|
|
1519 |
|
vm_exit(); |
1520 |
|
return 0; |
1521 |
|
} |
1522 |
|
#endif |
1339 |
– |
|
1340 |
– |
|
1341 |
– |
|
1342 |
– |
|
1343 |
– |
|
1344 |
– |
|
1345 |
– |
|
1346 |
– |
|
1347 |
– |
|
1348 |
– |
|
1349 |
– |
|
1350 |
– |
|
1351 |
– |
|
1352 |
– |
|
1353 |
– |
|