69 |
|
enum transfer_size_t { |
70 |
|
SIZE_UNKNOWN, |
71 |
|
SIZE_BYTE, |
72 |
< |
SIZE_WORD, |
73 |
< |
SIZE_LONG |
72 |
> |
SIZE_WORD, // 2 bytes |
73 |
> |
SIZE_LONG, // 4 bytes |
74 |
> |
SIZE_QUAD, // 8 bytes |
75 |
|
}; |
76 |
|
|
77 |
|
// Transfer type |
232 |
|
#if defined(__FreeBSD__) |
233 |
|
#if (defined(i386) || defined(__i386__)) |
234 |
|
#define SIGSEGV_FAULT_INSTRUCTION (((struct sigcontext *)scp)->sc_eip) |
235 |
< |
#define SIGSEGV_REGISTER_FILE ((unsigned int *)&(((struct sigcontext *)scp)->sc_edi)) /* EDI is the first GPR (even below EIP) in sigcontext */ |
235 |
> |
#define SIGSEGV_REGISTER_FILE ((unsigned long *)&(((struct sigcontext *)scp)->sc_edi)) /* EDI is the first GPR (even below EIP) in sigcontext */ |
236 |
|
#define SIGSEGV_SKIP_INSTRUCTION ix86_skip_instruction |
237 |
|
#endif |
238 |
|
#endif |
241 |
|
#include <sys/ucontext.h> |
242 |
|
#define SIGSEGV_CONTEXT_REGS (((ucontext_t *)scp)->uc_mcontext.gregs) |
243 |
|
#define SIGSEGV_FAULT_INSTRUCTION SIGSEGV_CONTEXT_REGS[14] /* should use REG_EIP instead */ |
244 |
< |
#define SIGSEGV_REGISTER_FILE (unsigned int *)SIGSEGV_CONTEXT_REGS |
244 |
> |
#define SIGSEGV_REGISTER_FILE (unsigned long *)SIGSEGV_CONTEXT_REGS |
245 |
|
#define SIGSEGV_SKIP_INSTRUCTION ix86_skip_instruction |
246 |
|
#endif |
247 |
|
#if (defined(x86_64) || defined(__x86_64__)) |
249 |
|
#define SIGSEGV_CONTEXT_REGS (((ucontext_t *)scp)->uc_mcontext.gregs) |
250 |
|
#define SIGSEGV_FAULT_INSTRUCTION SIGSEGV_CONTEXT_REGS[16] /* should use REG_RIP instead */ |
251 |
|
#define SIGSEGV_REGISTER_FILE (unsigned long *)SIGSEGV_CONTEXT_REGS |
252 |
+ |
#define SIGSEGV_SKIP_INSTRUCTION ix86_skip_instruction |
253 |
|
#endif |
254 |
|
#if (defined(ia64) || defined(__ia64__)) |
255 |
|
#define SIGSEGV_FAULT_INSTRUCTION (((struct sigcontext *)scp)->sc_ip & ~0x3ULL) /* slot number is in bits 0 and 1 */ |
275 |
|
#define SIGSEGV_FAULT_HANDLER_ARGS &scs |
276 |
|
#define SIGSEGV_FAULT_ADDRESS scp->cr2 |
277 |
|
#define SIGSEGV_FAULT_INSTRUCTION scp->eip |
278 |
< |
#define SIGSEGV_REGISTER_FILE (unsigned int *)scp |
278 |
> |
#define SIGSEGV_REGISTER_FILE (unsigned long *)scp |
279 |
|
#define SIGSEGV_SKIP_INSTRUCTION ix86_skip_instruction |
280 |
|
#endif |
281 |
|
#if (defined(sparc) || defined(__sparc__)) |
386 |
|
#define SIGSEGV_FAULT_HANDLER_ARGS sig, code, scp, addr |
387 |
|
#define SIGSEGV_FAULT_ADDRESS addr |
388 |
|
#define SIGSEGV_FAULT_INSTRUCTION scp->sc_eip |
389 |
< |
#define SIGSEGV_REGISTER_FILE ((unsigned int *)&scp->sc_edi) |
389 |
> |
#define SIGSEGV_REGISTER_FILE ((unsigned long *)&scp->sc_edi) |
390 |
|
#define SIGSEGV_SKIP_INSTRUCTION ix86_skip_instruction |
391 |
|
#endif |
392 |
|
#endif |
579 |
|
|
580 |
|
#ifdef HAVE_SIGSEGV_SKIP_INSTRUCTION |
581 |
|
// Decode and skip X86 instruction |
582 |
< |
#if (defined(i386) || defined(__i386__)) |
582 |
> |
#if (defined(i386) || defined(__i386__)) || defined(__x86_64__) |
583 |
|
#if defined(__linux__) |
584 |
|
enum { |
585 |
+ |
#if (defined(i386) || defined(__i386__)) |
586 |
|
X86_REG_EIP = 14, |
587 |
|
X86_REG_EAX = 11, |
588 |
|
X86_REG_ECX = 10, |
592 |
|
X86_REG_EBP = 6, |
593 |
|
X86_REG_ESI = 5, |
594 |
|
X86_REG_EDI = 4 |
595 |
+ |
#endif |
596 |
+ |
#if defined(__x86_64__) |
597 |
+ |
X86_REG_R8 = 0, |
598 |
+ |
X86_REG_R9 = 1, |
599 |
+ |
X86_REG_R10 = 2, |
600 |
+ |
X86_REG_R11 = 3, |
601 |
+ |
X86_REG_R12 = 4, |
602 |
+ |
X86_REG_R13 = 5, |
603 |
+ |
X86_REG_R14 = 6, |
604 |
+ |
X86_REG_R15 = 7, |
605 |
+ |
X86_REG_EDI = 8, |
606 |
+ |
X86_REG_ESI = 9, |
607 |
+ |
X86_REG_EBP = 10, |
608 |
+ |
X86_REG_EBX = 11, |
609 |
+ |
X86_REG_EDX = 12, |
610 |
+ |
X86_REG_EAX = 13, |
611 |
+ |
X86_REG_ECX = 14, |
612 |
+ |
X86_REG_ESP = 15, |
613 |
+ |
X86_REG_EIP = 16 |
614 |
+ |
#endif |
615 |
|
}; |
616 |
|
#endif |
617 |
|
#if defined(__NetBSD__) || defined(__FreeBSD__) |
618 |
|
enum { |
619 |
+ |
#if (defined(i386) || defined(__i386__)) |
620 |
|
X86_REG_EIP = 10, |
621 |
|
X86_REG_EAX = 7, |
622 |
|
X86_REG_ECX = 6, |
626 |
|
X86_REG_EBP = 2, |
627 |
|
X86_REG_ESI = 1, |
628 |
|
X86_REG_EDI = 0 |
629 |
+ |
#endif |
630 |
|
}; |
631 |
|
#endif |
632 |
|
// FIXME: this is partly redundant with the instruction decoding phase |
663 |
|
return offset; |
664 |
|
} |
665 |
|
|
666 |
< |
static bool ix86_skip_instruction(unsigned int * regs) |
666 |
> |
static bool ix86_skip_instruction(unsigned long * regs) |
667 |
|
{ |
668 |
|
unsigned char * eip = (unsigned char *)regs[X86_REG_EIP]; |
669 |
|
|
675 |
|
|
676 |
|
int reg = -1; |
677 |
|
int len = 0; |
678 |
< |
|
678 |
> |
|
679 |
> |
#if DEBUG |
680 |
> |
printf("IP: %p [%02x %02x %02x %02x...]\n", |
681 |
> |
eip, eip[0], eip[1], eip[2], eip[3]); |
682 |
> |
#endif |
683 |
> |
|
684 |
|
// Operand size prefix |
685 |
|
if (*eip == 0x66) { |
686 |
|
eip++; |
688 |
|
transfer_size = SIZE_WORD; |
689 |
|
} |
690 |
|
|
691 |
+ |
// REX prefix |
692 |
+ |
#if defined(__x86_64__) |
693 |
+ |
struct rex_t { |
694 |
+ |
unsigned char W; |
695 |
+ |
unsigned char R; |
696 |
+ |
unsigned char X; |
697 |
+ |
unsigned char B; |
698 |
+ |
}; |
699 |
+ |
rex_t rex = { 0, 0, 0, 0 }; |
700 |
+ |
bool has_rex = false; |
701 |
+ |
if ((*eip & 0xf0) == 0x40) { |
702 |
+ |
has_rex = true; |
703 |
+ |
const unsigned char b = *eip; |
704 |
+ |
rex.W = b & (1 << 3); |
705 |
+ |
rex.R = b & (1 << 2); |
706 |
+ |
rex.X = b & (1 << 1); |
707 |
+ |
rex.B = b & (1 << 0); |
708 |
+ |
#if DEBUG |
709 |
+ |
printf("REX: %c,%c,%c,%c\n", |
710 |
+ |
rex.W ? 'W' : '_', |
711 |
+ |
rex.R ? 'R' : '_', |
712 |
+ |
rex.X ? 'X' : '_', |
713 |
+ |
rex.B ? 'B' : '_'); |
714 |
+ |
#endif |
715 |
+ |
eip++; |
716 |
+ |
len++; |
717 |
+ |
if (rex.W) |
718 |
+ |
transfer_size = SIZE_QUAD; |
719 |
+ |
} |
720 |
+ |
#else |
721 |
+ |
const bool has_rex = false; |
722 |
+ |
#endif |
723 |
+ |
|
724 |
|
// Decode instruction |
725 |
|
switch (eip[0]) { |
726 |
|
case 0x0f: |
790 |
|
return false; |
791 |
|
} |
792 |
|
|
793 |
+ |
#if defined(__x86_64__) |
794 |
+ |
if (rex.R) |
795 |
+ |
reg += 8; |
796 |
+ |
#endif |
797 |
+ |
|
798 |
|
if (transfer_type == SIGSEGV_TRANSFER_LOAD && reg != -1) { |
799 |
< |
static const int x86_reg_map[8] = { |
799 |
> |
static const int x86_reg_map[] = { |
800 |
|
X86_REG_EAX, X86_REG_ECX, X86_REG_EDX, X86_REG_EBX, |
801 |
< |
X86_REG_ESP, X86_REG_EBP, X86_REG_ESI, X86_REG_EDI |
801 |
> |
X86_REG_ESP, X86_REG_EBP, X86_REG_ESI, X86_REG_EDI, |
802 |
> |
#if defined(__x86_64__) |
803 |
> |
X86_REG_R8, X86_REG_R9, X86_REG_R10, X86_REG_R11, |
804 |
> |
X86_REG_R12, X86_REG_R13, X86_REG_R14, X86_REG_R15, |
805 |
> |
#endif |
806 |
|
}; |
807 |
|
|
808 |
< |
if (reg < 0 || reg >= 8) |
808 |
> |
if (reg < 0 || reg >= (sizeof(x86_reg_map)/sizeof(x86_reg_map[0]) - 1)) |
809 |
|
return false; |
810 |
|
|
811 |
+ |
// Set 0 to the relevant register part |
812 |
+ |
// NOTE: this is only valid for MOV alike instructions |
813 |
|
int rloc = x86_reg_map[reg]; |
814 |
|
switch (transfer_size) { |
815 |
|
case SIZE_BYTE: |
816 |
< |
regs[rloc] = (regs[rloc] & ~0xff); |
816 |
> |
if (has_rex || reg < 4) |
817 |
> |
regs[rloc] = (regs[rloc] & ~0x00ffL); |
818 |
> |
else { |
819 |
> |
rloc = x86_reg_map[reg - 4]; |
820 |
> |
regs[rloc] = (regs[rloc] & ~0xff00L); |
821 |
> |
} |
822 |
|
break; |
823 |
|
case SIZE_WORD: |
824 |
< |
regs[rloc] = (regs[rloc] & ~0xffff); |
824 |
> |
regs[rloc] = (regs[rloc] & ~0xffffL); |
825 |
|
break; |
826 |
|
case SIZE_LONG: |
827 |
+ |
case SIZE_QUAD: // zero-extension |
828 |
|
regs[rloc] = 0; |
829 |
|
break; |
830 |
|
} |
832 |
|
|
833 |
|
#if DEBUG |
834 |
|
printf("%08x: %s %s access", regs[X86_REG_EIP], |
835 |
< |
transfer_size == SIZE_BYTE ? "byte" : transfer_size == SIZE_WORD ? "word" : "long", |
835 |
> |
transfer_size == SIZE_BYTE ? "byte" : |
836 |
> |
transfer_size == SIZE_WORD ? "word" : |
837 |
> |
transfer_size == SIZE_LONG ? "long" : |
838 |
> |
transfer_size == SIZE_QUAD ? "quad" : "unknown", |
839 |
|
transfer_type == SIGSEGV_TRANSFER_LOAD ? "read" : "write"); |
840 |
|
|
841 |
|
if (reg != -1) { |
842 |
< |
static const char * x86_reg_str_map[8] = { |
843 |
< |
"eax", "ecx", "edx", "ebx", |
844 |
< |
"esp", "ebp", "esi", "edi" |
842 |
> |
static const char * x86_byte_reg_str_map[] = { |
843 |
> |
"al", "cl", "dl", "bl", |
844 |
> |
"spl", "bpl", "sil", "dil", |
845 |
> |
"r8b", "r9b", "r10b", "r11b", |
846 |
> |
"r12b", "r13b", "r14b", "r15b", |
847 |
> |
"ah", "ch", "dh", "bh", |
848 |
> |
}; |
849 |
> |
static const char * x86_word_reg_str_map[] = { |
850 |
> |
"ax", "cx", "dx", "bx", |
851 |
> |
"sp", "bp", "si", "di", |
852 |
> |
"r8w", "r9w", "r10w", "r11w", |
853 |
> |
"r12w", "r13w", "r14w", "r15w", |
854 |
> |
}; |
855 |
> |
static const char *x86_long_reg_str_map[] = { |
856 |
> |
"eax", "ecx", "edx", "ebx", |
857 |
> |
"esp", "ebp", "esi", "edi", |
858 |
> |
"r8d", "r9d", "r10d", "r11d", |
859 |
> |
"r12d", "r13d", "r14d", "r15d", |
860 |
> |
}; |
861 |
> |
static const char *x86_quad_reg_str_map[] = { |
862 |
> |
"rax", "rcx", "rdx", "rbx", |
863 |
> |
"rsp", "rbp", "rsi", "rdi", |
864 |
> |
"r8", "r9", "r10", "r11", |
865 |
> |
"r12", "r13", "r14", "r15", |
866 |
|
}; |
867 |
< |
printf(" %s register %%%s", transfer_type == SIGSEGV_TRANSFER_LOAD ? "to" : "from", x86_reg_str_map[reg]); |
867 |
> |
const char * reg_str = NULL; |
868 |
> |
switch (transfer_size) { |
869 |
> |
case SIZE_BYTE: |
870 |
> |
reg_str = x86_byte_reg_str_map[(!has_rex && reg >= 4 ? 12 : 0) + reg]; |
871 |
> |
break; |
872 |
> |
case SIZE_WORD: reg_str = x86_word_reg_str_map[reg]; break; |
873 |
> |
case SIZE_LONG: reg_str = x86_long_reg_str_map[reg]; break; |
874 |
> |
case SIZE_QUAD: reg_str = x86_quad_reg_str_map[reg]; break; |
875 |
> |
} |
876 |
> |
if (reg_str) |
877 |
> |
printf(" %s register %%%s", |
878 |
> |
transfer_type == SIGSEGV_TRANSFER_LOAD ? "to" : "from", |
879 |
> |
reg_str); |
880 |
|
} |
881 |
|
printf(", %d bytes instruction\n", len); |
882 |
|
#endif |
1384 |
|
|
1385 |
|
return SIGSEGV_RETURN_FAILURE; |
1386 |
|
} |
1387 |
+ |
|
1388 |
+ |
// More sophisticated tests for instruction skipper |
1389 |
+ |
static bool arch_insn_skipper_tests() |
1390 |
+ |
{ |
1391 |
+ |
#if (defined(i386) || defined(__i386__)) || defined(__x86_64__) |
1392 |
+ |
static const unsigned char code[] = { |
1393 |
+ |
0x8a, 0x00, // mov (%eax),%al |
1394 |
+ |
0x8a, 0x2c, 0x18, // mov (%eax,%ebx,1),%ch |
1395 |
+ |
0x88, 0x20, // mov %ah,(%eax) |
1396 |
+ |
0x88, 0x08, // mov %cl,(%eax) |
1397 |
+ |
0x66, 0x8b, 0x00, // mov (%eax),%ax |
1398 |
+ |
0x66, 0x8b, 0x0c, 0x18, // mov (%eax,%ebx,1),%cx |
1399 |
+ |
0x66, 0x89, 0x00, // mov %ax,(%eax) |
1400 |
+ |
0x66, 0x89, 0x0c, 0x18, // mov %cx,(%eax,%ebx,1) |
1401 |
+ |
0x8b, 0x00, // mov (%eax),%eax |
1402 |
+ |
0x8b, 0x0c, 0x18, // mov (%eax,%ebx,1),%ecx |
1403 |
+ |
0x89, 0x00, // mov %eax,(%eax) |
1404 |
+ |
0x89, 0x0c, 0x18, // mov %ecx,(%eax,%ebx,1) |
1405 |
+ |
#if defined(__x86_64__) |
1406 |
+ |
0x44, 0x8a, 0x00, // mov (%rax),%r8b |
1407 |
+ |
0x44, 0x8a, 0x20, // mov (%rax),%r12b |
1408 |
+ |
0x42, 0x8a, 0x3c, 0x10, // mov (%rax,%r10,1),%dil |
1409 |
+ |
0x44, 0x88, 0x00, // mov %r8b,(%rax) |
1410 |
+ |
0x44, 0x88, 0x20, // mov %r12b,(%rax) |
1411 |
+ |
0x42, 0x88, 0x3c, 0x10, // mov %dil,(%rax,%r10,1) |
1412 |
+ |
0x66, 0x44, 0x8b, 0x00, // mov (%rax),%r8w |
1413 |
+ |
0x66, 0x42, 0x8b, 0x0c, 0x10, // mov (%rax,%r10,1),%cx |
1414 |
+ |
0x66, 0x44, 0x89, 0x00, // mov %r8w,(%rax) |
1415 |
+ |
0x66, 0x42, 0x89, 0x0c, 0x10, // mov %cx,(%rax,%r10,1) |
1416 |
+ |
0x44, 0x8b, 0x00, // mov (%rax),%r8d |
1417 |
+ |
0x42, 0x8b, 0x0c, 0x10, // mov (%rax,%r10,1),%ecx |
1418 |
+ |
0x44, 0x89, 0x00, // mov %r8d,(%rax) |
1419 |
+ |
0x42, 0x89, 0x0c, 0x10, // mov %ecx,(%rax,%r10,1) |
1420 |
+ |
0x48, 0x8b, 0x08, // mov (%rax),%rcx |
1421 |
+ |
0x4c, 0x8b, 0x18, // mov (%rax),%r11 |
1422 |
+ |
0x4a, 0x8b, 0x0c, 0x10, // mov (%rax,%r10,1),%rcx |
1423 |
+ |
0x4e, 0x8b, 0x1c, 0x10, // mov (%rax,%r10,1),%r11 |
1424 |
+ |
0x48, 0x89, 0x08, // mov %rcx,(%rax) |
1425 |
+ |
0x4c, 0x89, 0x18, // mov %r11,(%rax) |
1426 |
+ |
0x4a, 0x89, 0x0c, 0x10, // mov %rcx,(%rax,%r10,1) |
1427 |
+ |
0x4e, 0x89, 0x1c, 0x10, // mov %r11,(%rax,%r10,1) |
1428 |
+ |
#endif |
1429 |
+ |
0 // end |
1430 |
+ |
}; |
1431 |
+ |
const int N_REGS = 20; |
1432 |
+ |
unsigned long regs[N_REGS]; |
1433 |
+ |
for (int i = 0; i < N_REGS; i++) |
1434 |
+ |
regs[i] = i; |
1435 |
+ |
const unsigned long start_code = (unsigned long)&code; |
1436 |
+ |
regs[X86_REG_EIP] = start_code; |
1437 |
+ |
while ((regs[X86_REG_EIP] - start_code) < (sizeof(code) - 1) |
1438 |
+ |
&& ix86_skip_instruction(regs)) |
1439 |
+ |
; /* simply iterate */ |
1440 |
+ |
return (regs[X86_REG_EIP] - start_code) == (sizeof(code) - 1); |
1441 |
+ |
#endif |
1442 |
+ |
return true; |
1443 |
+ |
} |
1444 |
|
#endif |
1445 |
|
|
1446 |
|
int main(void) |
1487 |
|
return 8; |
1488 |
|
|
1489 |
|
#define TEST_SKIP_INSTRUCTION(TYPE) do { \ |
1490 |
< |
const unsigned int TAG = 0x12345678; \ |
1490 |
> |
const unsigned long TAG = 0x12345678 | \ |
1491 |
> |
(sizeof(long) == 8 ? 0x9abcdef0UL << 31 : 0); \ |
1492 |
|
TYPE data = *((TYPE *)(page + sizeof(TYPE))); \ |
1493 |
< |
volatile unsigned int effect = data + TAG; \ |
1493 |
> |
volatile unsigned long effect = data + TAG; \ |
1494 |
|
if (effect != TAG) \ |
1495 |
|
return 9; \ |
1496 |
|
} while (0) |
1503 |
|
TEST_SKIP_INSTRUCTION(unsigned char); |
1504 |
|
TEST_SKIP_INSTRUCTION(unsigned short); |
1505 |
|
TEST_SKIP_INSTRUCTION(unsigned int); |
1506 |
+ |
TEST_SKIP_INSTRUCTION(unsigned long); |
1507 |
|
L_e_region2: |
1508 |
+ |
|
1509 |
+ |
if (!arch_insn_skipper_tests()) |
1510 |
+ |
return 20; |
1511 |
|
#endif |
1512 |
|
|
1513 |
|
vm_exit(); |
1514 |
|
return 0; |
1515 |
|
} |
1516 |
|
#endif |
1339 |
– |
|
1340 |
– |
|
1341 |
– |
|
1342 |
– |
|
1343 |
– |
|
1344 |
– |
|
1345 |
– |
|
1346 |
– |
|
1347 |
– |
|
1348 |
– |
|
1349 |
– |
|
1350 |
– |
|
1351 |
– |
|
1352 |
– |
|
1353 |
– |
|