[PATCH -tip 1/2] x86: xen: insn: Decode XEN_EMULATE_PREFIX correctly

From: Masami Hiramatsu
Date: Wed Sep 04 2019 - 07:46:07 EST

Next message: Masami Hiramatsu: "[PATCH -tip 2/2] x86: kprobes: Prohibit probing on instruction which has Xen prefix"
Previous message: Masami Hiramatsu: "[PATCH -tip 0/2] x86: Prohibit kprobes on XEN_EMULATE_PREFIX"
In reply to: Masami Hiramatsu: "[PATCH -tip 0/2] x86: Prohibit kprobes on XEN_EMULATE_PREFIX"
Next in thread: Masami Hiramatsu: "[PATCH -tip 2/2] x86: kprobes: Prohibit probing on instruction which has Xen prefix"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Decode XEN_EMULATE_PREFIX prefix by x86 insn decoder.
This treats a special sequence of instructions of XEN_EMULATE_PREFIX
as a prefix bytes in x86 insn decoder. User can test whether the
instruction has the XEN_EMULATE_PREFIX or not by insn_is_xen_prefixed().
Note that this prefix is treated as just a dummy prefix, so no affect
for decoding opcode and operand.

Reported-by: Josh Poimboeuf <jpoimboe@xxxxxxxxxx>
Signed-off-by: Masami Hiramatsu <mhiramat@xxxxxxxxxx>
---
arch/x86/include/asm/insn.h | 2 +
arch/x86/include/asm/xen/interface.h | 7 ++++-
arch/x86/include/asm/xen/prefix.h | 10 +++++++
arch/x86/lib/insn.c | 43 +++++++++++++++++++++++++++++++
tools/arch/x86/include/asm/insn.h | 2 +
tools/arch/x86/include/asm/xen/prefix.h | 10 +++++++
tools/arch/x86/lib/insn.c | 43 +++++++++++++++++++++++++++++++
tools/objtool/sync-check.sh | 3 +-
8 files changed, 117 insertions(+), 3 deletions(-)
create mode 100644 arch/x86/include/asm/xen/prefix.h
create mode 100644 tools/arch/x86/include/asm/xen/prefix.h

diff --git a/arch/x86/include/asm/insn.h b/arch/x86/include/asm/insn.h
index 154f27be8bfc..ac42efd4295a 100644
--- a/arch/x86/include/asm/insn.h
+++ b/arch/x86/include/asm/insn.h
@@ -128,6 +128,8 @@ static inline int insn_is_evex(struct insn *insn)
return (insn->vex_prefix.nbytes == 4);
}

+extern int insn_has_xen_prefix(struct insn *insn);
+
/* Ensure this instruction is decoded completely */
static inline int insn_complete(struct insn *insn)
{
diff --git a/arch/x86/include/asm/xen/interface.h b/arch/x86/include/asm/xen/interface.h
index 62ca03ef5c65..fe33a9798708 100644
--- a/arch/x86/include/asm/xen/interface.h
+++ b/arch/x86/include/asm/xen/interface.h
@@ -379,12 +379,15 @@ struct xen_pmu_arch {
* Prefix forces emulation of some non-trapping instructions.
* Currently only CPUID.
*/
+#include <asm/xen/prefix.h>
+
#ifdef __ASSEMBLY__
-#define XEN_EMULATE_PREFIX .byte 0x0f,0x0b,0x78,0x65,0x6e ;
+#define XEN_EMULATE_PREFIX .byte __XEN_EMULATE_PREFIX ;
#define XEN_CPUID XEN_EMULATE_PREFIX cpuid
#else
-#define XEN_EMULATE_PREFIX ".byte 0x0f,0x0b,0x78,0x65,0x6e ; "
+#define XEN_EMULATE_PREFIX ".byte " __XEN_EMULATE_PREFIX_STR " ; "
#define XEN_CPUID XEN_EMULATE_PREFIX "cpuid"
+
#endif

#endif /* _ASM_X86_XEN_INTERFACE_H */
diff --git a/arch/x86/include/asm/xen/prefix.h b/arch/x86/include/asm/xen/prefix.h
new file mode 100644
index 000000000000..f901be0d7a95
--- /dev/null
+++ b/arch/x86/include/asm/xen/prefix.h
@@ -0,0 +1,10 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _TOOLS_ASM_X86_XEN_PREFIX_H
+#define _TOOLS_ASM_X86_XEN_PREFIX_H
+
+#include <linux/stringify.h>
+
+#define __XEN_EMULATE_PREFIX 0x0f,0x0b,0x78,0x65,0x6e
+#define __XEN_EMULATE_PREFIX_STR __stringify(__XEN_EMULATE_PREFIX)
+
+#endif
diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
index 0b5862ba6a75..310a609ee382 100644
--- a/arch/x86/lib/insn.c
+++ b/arch/x86/lib/insn.c
@@ -13,6 +13,9 @@
#include <asm/inat.h>
#include <asm/insn.h>

+/* For special Xen prefix */
+#include <asm/xen/prefix.h>
+
/* Verify next sizeof(t) bytes can be on the same instruction */
#define validate_next(t, insn, n) \
((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr)
@@ -58,6 +61,42 @@ void insn_init(struct insn *insn, const void *kaddr, int buf_len, int x86_64)
insn->addr_bytes = 4;
}

+static const insn_byte_t xen_prefix[] = { __XEN_EMULATE_PREFIX };
+
+static int insn_xen_prefix(struct insn *insn, insn_byte_t b)
+{
+ struct insn_field *prefixes = &insn->prefixes;
+ size_t i;
+
+ for (i = 0; i < sizeof(xen_prefix); i++) {
+ b = peek_nbyte_next(insn_byte_t, insn, i);
+ if (b != xen_prefix[i])
+ goto err_out;
+ }
+
+ memcpy(prefixes->bytes, xen_prefix, 3);
+ prefixes->bytes[3] = xen_prefix[sizeof(xen_prefix) - 1];
+ prefixes->nbytes = sizeof(xen_prefix);
+ insn->next_byte += prefixes->nbytes;
+ prefixes->got = 1;
+
+ return 1;
+
+err_out:
+ return 0;
+}
+
+int insn_has_xen_prefix(struct insn *insn)
+{
+ if (unlikely(insn->prefixes.nbytes == sizeof(xen_prefix))) {
+ return !memcmp(insn->prefixes.bytes, xen_prefix, 3) &&
+ insn->prefixes.bytes[3] ==
+ xen_prefix[sizeof(xen_prefix) - 1];
+ }
+
+ return 0;
+}
+
/**
* insn_get_prefixes - scan x86 instruction prefix bytes
* @insn: &struct insn containing instruction
@@ -79,6 +118,10 @@ void insn_get_prefixes(struct insn *insn)
nb = 0;
lb = 0;
b = peek_next(insn_byte_t, insn);
+
+ if (insn_xen_prefix(insn, b))
+ return;
+
attr = inat_get_opcode_attribute(b);
while (inat_is_legacy_prefix(attr)) {
/* Skip if same prefix */
diff --git a/tools/arch/x86/include/asm/insn.h b/tools/arch/x86/include/asm/insn.h
index 37a4c390750b..1c723fb5c6ee 100644
--- a/tools/arch/x86/include/asm/insn.h
+++ b/tools/arch/x86/include/asm/insn.h
@@ -128,6 +128,8 @@ static inline int insn_is_evex(struct insn *insn)
return (insn->vex_prefix.nbytes == 4);
}

+extern int insn_has_xen_prefix(struct insn *insn);
+
/* Ensure this instruction is decoded completely */
static inline int insn_complete(struct insn *insn)
{
diff --git a/tools/arch/x86/include/asm/xen/prefix.h b/tools/arch/x86/include/asm/xen/prefix.h
new file mode 100644
index 000000000000..f901be0d7a95
--- /dev/null
+++ b/tools/arch/x86/include/asm/xen/prefix.h
@@ -0,0 +1,10 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _TOOLS_ASM_X86_XEN_PREFIX_H
+#define _TOOLS_ASM_X86_XEN_PREFIX_H
+
+#include <linux/stringify.h>
+
+#define __XEN_EMULATE_PREFIX 0x0f,0x0b,0x78,0x65,0x6e
+#define __XEN_EMULATE_PREFIX_STR __stringify(__XEN_EMULATE_PREFIX)
+
+#endif
diff --git a/tools/arch/x86/lib/insn.c b/tools/arch/x86/lib/insn.c
index 79e048f1d902..b34cd1cefb1c 100644
--- a/tools/arch/x86/lib/insn.c
+++ b/tools/arch/x86/lib/insn.c
@@ -13,6 +13,9 @@
#include "../include/asm/inat.h"
#include "../include/asm/insn.h"

+/* For special Xen prefix */
+#include "../include/asm/xen/prefix.h"
+
/* Verify next sizeof(t) bytes can be on the same instruction */
#define validate_next(t, insn, n) \
((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr)
@@ -58,6 +61,42 @@ void insn_init(struct insn *insn, const void *kaddr, int buf_len, int x86_64)
insn->addr_bytes = 4;
}

+static const insn_byte_t xen_prefix[] = { __XEN_EMULATE_PREFIX };
+
+static int insn_xen_prefix(struct insn *insn, insn_byte_t b)
+{
+ struct insn_field *prefixes = &insn->prefixes;
+ size_t i;
+
+ for (i = 0; i < sizeof(xen_prefix); i++) {
+ b = peek_nbyte_next(insn_byte_t, insn, i);
+ if (b != xen_prefix[i])
+ goto err_out;
+ }
+
+ memcpy(prefixes->bytes, xen_prefix, 3);
+ prefixes->bytes[3] = xen_prefix[sizeof(xen_prefix) - 1];
+ prefixes->nbytes = sizeof(xen_prefix);
+ insn->next_byte += prefixes->nbytes;
+ prefixes->got = 1;
+
+ return 1;
+
+err_out:
+ return 0;
+}
+
+int insn_has_xen_prefix(struct insn *insn)
+{
+ if (unlikely(insn->prefixes.nbytes == sizeof(xen_prefix))) {
+ return !memcmp(insn->prefixes.bytes, xen_prefix, 3) &&
+ insn->prefixes.bytes[3] ==
+ xen_prefix[sizeof(xen_prefix) - 1];
+ }
+
+ return 0;
+}
+
/**
* insn_get_prefixes - scan x86 instruction prefix bytes
* @insn: &struct insn containing instruction
@@ -79,6 +118,10 @@ void insn_get_prefixes(struct insn *insn)
nb = 0;
lb = 0;
b = peek_next(insn_byte_t, insn);
+
+ if (insn_xen_prefix(insn, b))
+ return;
+
attr = inat_get_opcode_attribute(b);
while (inat_is_legacy_prefix(attr)) {
/* Skip if same prefix */
diff --git a/tools/objtool/sync-check.sh b/tools/objtool/sync-check.sh
index 0a832e265a50..34143ea3d477 100755
--- a/tools/objtool/sync-check.sh
+++ b/tools/objtool/sync-check.sh
@@ -4,6 +4,7 @@
FILES='
arch/x86/include/asm/inat_types.h
arch/x86/include/asm/orc_types.h
+arch/x86/include/asm/xen/prefix.h
arch/x86/lib/x86-opcode-map.txt
arch/x86/tools/gen-insn-attr-x86.awk
'
@@ -46,6 +47,6 @@ done
check arch/x86/include/asm/inat.h '-I "^#include [\"<]\(asm/\)*inat_types.h[\">]"'
check arch/x86/include/asm/insn.h '-I "^#include [\"<]\(asm/\)*inat.h[\">]"'
check arch/x86/lib/inat.c '-I "^#include [\"<]\(../include/\)*asm/insn.h[\">]"'
-check arch/x86/lib/insn.c '-I "^#include [\"<]\(../include/\)*asm/in\(at\|sn\).h[\">]"'
+check arch/x86/lib/insn.c '-I "^#include [\"<]\(../include/\)*asm/in\(at\|sn\).h[\">]" -I "^#include [\"<]\(../include/\)*asm/xen/prefix.h[\">]"'

cd -

Next message: Masami Hiramatsu: "[PATCH -tip 2/2] x86: kprobes: Prohibit probing on instruction which has Xen prefix"
Previous message: Masami Hiramatsu: "[PATCH -tip 0/2] x86: Prohibit kprobes on XEN_EMULATE_PREFIX"
In reply to: Masami Hiramatsu: "[PATCH -tip 0/2] x86: Prohibit kprobes on XEN_EMULATE_PREFIX"
Next in thread: Masami Hiramatsu: "[PATCH -tip 2/2] x86: kprobes: Prohibit probing on instruction which has Xen prefix"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]