From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752862AbdJTQJB (ORCPT ); Fri, 20 Oct 2017 12:09:01 -0400 Received: from mx2.suse.de ([195.135.220.15]:60470 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752013AbdJTQIs (ORCPT ); Fri, 20 Oct 2017 12:08:48 -0400 Date: Fri, 20 Oct 2017 18:08:41 +0200 From: Borislav Petkov To: Ricardo Neri Cc: Ingo Molnar , Thomas Gleixner , "H. Peter Anvin" , Andy Lutomirski , Peter Zijlstra , Andrew Morton , Brian Gerst , Chris Metcalf , Dave Hansen , Paolo Bonzini , Masami Hiramatsu , Huang Rui , Jiri Slaby , Jonathan Corbet , "Michael S. Tsirkin" , Paul Gortmaker , Vlastimil Babka , Chen Yucong , "Ravi V. Shankar" , Shuah Khan , linux-kernel@vger.kernel.org, x86@kernel.org, ricardo.neri@intel.com, Adam Buchbinder , Colin Ian King , Lorenzo Stoakes , Qiaowei Ren , Arnaldo Carvalho de Melo , Adrian Hunter , Kees Cook , Thomas Garnier , Dmitry Vyukov Subject: Re: [PATCH v9 18/29] x86/insn-eval: Incorporate segment base in linear address computation Message-ID: <20171020160833.mzzo5sqbczgp3uqo@pd.tnic> References: <1507089272-32733-1-git-send-email-ricardo.neri-calderon@linux.intel.com> <1507089272-32733-19-git-send-email-ricardo.neri-calderon@linux.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1507089272-32733-19-git-send-email-ricardo.neri-calderon@linux.intel.com> User-Agent: NeoMutt/20170113 (1.7.2) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Oct 03, 2017 at 08:54:21PM -0700, Ricardo Neri wrote: > insn_get_addr_ref() returns the effective address as defined by the > section 3.7.5.1 Vol 1 of the Intel 64 and IA-32 Architectures Software > Developer's Manual. In order to compute the linear address, we must add > to the effective address the segment base address as set in the segment > descriptor. The segment descriptor to use depends on the register used as > operand and segment override prefixes, if any. > > In most cases, the segment base address will be 0 if the USER_DS/USER32_DS > segment is used or if segmentation is not used. However, the base address > is not necessarily zero if a user programs defines its own segments. This > is possible by using a local descriptor table. > > Since the effective address is a signed quantity, the unsigned segment > base address is saved in a separate variable and added to the final, > unsigned, effective address. > > Cc: Dave Hansen > Cc: Adam Buchbinder > Cc: Colin Ian King > Cc: Lorenzo Stoakes > Cc: Qiaowei Ren > Cc: Arnaldo Carvalho de Melo > Cc: Masami Hiramatsu > Cc: Adrian Hunter > Cc: Kees Cook > Cc: Thomas Garnier > Cc: Peter Zijlstra > Cc: Borislav Petkov > Cc: Dmitry Vyukov > Cc: Ravi V. Shankar > Cc: x86@kernel.org > Signed-off-by: Ricardo Neri > --- > arch/x86/lib/insn-eval.c | 30 +++++++++++++++++++++++++++--- > 1 file changed, 27 insertions(+), 3 deletions(-) > > diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c > index dd84819..b3aa891 100644 > --- a/arch/x86/lib/insn-eval.c > +++ b/arch/x86/lib/insn-eval.c > @@ -719,8 +719,8 @@ int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs) > */ > void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs) > { > - int addr_offset, base_offset, indx_offset; > - unsigned long linear_addr = -1L; > + int addr_offset, base_offset, indx_offset, seg_reg_indx; > + unsigned long linear_addr = -1L, seg_base_addr; > long eff_addr, base, indx; > insn_byte_t sib; > > @@ -734,6 +734,14 @@ void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs) > goto out; > > eff_addr = regs_get_register(regs, addr_offset); > + > + seg_reg_indx = resolve_seg_reg(insn, regs, addr_offset); > + if (seg_reg_indx < 0) > + goto out; > + > + seg_base_addr = insn_get_seg_base(regs, seg_reg_indx); > + if (seg_base_addr == -1L) > + goto out; Instead of replicating the same calls three times, add a get_seg_base_addr() helper and call it where needed. -- Regards/Gruss, Boris. SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) --