decode.c 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * Copyright (C) 2015 Josh Poimboeuf <jpoimboe@redhat.com>
  4. */
  5. #include <stdio.h>
  6. #include <stdlib.h>
  7. #define unlikely(cond) (cond)
  8. #include <asm/insn.h>
  9. #include "../../../arch/x86/lib/inat.c"
  10. #include "../../../arch/x86/lib/insn.c"
  11. #define CONFIG_64BIT 1
  12. #include <asm/nops.h>
  13. #include <asm/orc_types.h>
  14. #include <objtool/check.h>
  15. #include <objtool/disas.h>
  16. #include <objtool/elf.h>
  17. #include <objtool/arch.h>
  18. #include <objtool/warn.h>
  19. #include <objtool/builtin.h>
  20. #include <arch/elf.h>
  21. const char *arch_reg_name[CFI_NUM_REGS] = {
  22. "rax", "rcx", "rdx", "rbx",
  23. "rsp", "rbp", "rsi", "rdi",
  24. "r8", "r9", "r10", "r11",
  25. "r12", "r13", "r14", "r15",
  26. "ra"
  27. };
  28. int arch_ftrace_match(const char *name)
  29. {
  30. return !strcmp(name, "__fentry__");
  31. }
  32. static int is_x86_64(const struct elf *elf)
  33. {
  34. switch (elf->ehdr.e_machine) {
  35. case EM_X86_64:
  36. return 1;
  37. case EM_386:
  38. return 0;
  39. default:
  40. ERROR("unexpected ELF machine type %d", elf->ehdr.e_machine);
  41. return -1;
  42. }
  43. }
  44. bool arch_callee_saved_reg(unsigned char reg)
  45. {
  46. switch (reg) {
  47. case CFI_BP:
  48. case CFI_BX:
  49. case CFI_R12:
  50. case CFI_R13:
  51. case CFI_R14:
  52. case CFI_R15:
  53. return true;
  54. case CFI_AX:
  55. case CFI_CX:
  56. case CFI_DX:
  57. case CFI_SI:
  58. case CFI_DI:
  59. case CFI_SP:
  60. case CFI_R8:
  61. case CFI_R9:
  62. case CFI_R10:
  63. case CFI_R11:
  64. case CFI_RA:
  65. default:
  66. return false;
  67. }
  68. }
  69. /* Undo the effects of __pa_symbol() if necessary */
  70. static unsigned long phys_to_virt(unsigned long pa)
  71. {
  72. s64 va = pa;
  73. if (va > 0)
  74. va &= ~(0x80000000);
  75. return va;
  76. }
  77. s64 arch_insn_adjusted_addend(struct instruction *insn, struct reloc *reloc)
  78. {
  79. s64 addend = reloc_addend(reloc);
  80. if (arch_pc_relative_reloc(reloc))
  81. addend += insn->offset + insn->len - reloc_offset(reloc);
  82. return phys_to_virt(addend);
  83. }
  84. static void scan_for_insn(struct section *sec, unsigned long offset,
  85. unsigned long *insn_off, unsigned int *insn_len)
  86. {
  87. unsigned long o = 0;
  88. struct insn insn;
  89. while (1) {
  90. insn_decode(&insn, sec->data->d_buf + o, sec_size(sec) - o,
  91. INSN_MODE_64);
  92. if (o + insn.length > offset) {
  93. *insn_off = o;
  94. *insn_len = insn.length;
  95. return;
  96. }
  97. o += insn.length;
  98. }
  99. }
  100. u64 arch_adjusted_addend(struct reloc *reloc)
  101. {
  102. unsigned int type = reloc_type(reloc);
  103. s64 addend = reloc_addend(reloc);
  104. unsigned long insn_off;
  105. unsigned int insn_len;
  106. if (type == R_X86_64_PLT32)
  107. return addend + 4;
  108. if (type != R_X86_64_PC32 || !is_text_sec(reloc->sec->base))
  109. return addend;
  110. scan_for_insn(reloc->sec->base, reloc_offset(reloc),
  111. &insn_off, &insn_len);
  112. return addend + insn_off + insn_len - reloc_offset(reloc);
  113. }
  114. unsigned long arch_jump_destination(struct instruction *insn)
  115. {
  116. return insn->offset + insn->len + insn->immediate;
  117. }
  118. bool arch_pc_relative_reloc(struct reloc *reloc)
  119. {
  120. /*
  121. * All relocation types where P (the address of the target)
  122. * is included in the computation.
  123. */
  124. switch (reloc_type(reloc)) {
  125. case R_X86_64_PC8:
  126. case R_X86_64_PC16:
  127. case R_X86_64_PC32:
  128. case R_X86_64_PC64:
  129. case R_X86_64_PLT32:
  130. case R_X86_64_GOTPC32:
  131. case R_X86_64_GOTPCREL:
  132. return true;
  133. default:
  134. break;
  135. }
  136. return false;
  137. }
  138. #define ADD_OP(op) \
  139. if (!(op = calloc(1, sizeof(*op)))) \
  140. return -1; \
  141. else for (*ops_list = op, ops_list = &op->next; op; op = NULL)
  142. /*
  143. * Helpers to decode ModRM/SIB:
  144. *
  145. * r/m| AX CX DX BX | SP | BP | SI DI |
  146. * | R8 R9 R10 R11 | R12 | R13 | R14 R15 |
  147. * Mod+----------------+-----+-----+---------+
  148. * 00 | [r/m] |[SIB]|[IP+]| [r/m] |
  149. * 01 | [r/m + d8] |[S+d]| [r/m + d8] |
  150. * 10 | [r/m + d32] |[S+D]| [r/m + d32] |
  151. * 11 | r/ m |
  152. */
  153. #define mod_is_mem() (modrm_mod != 3)
  154. #define mod_is_reg() (modrm_mod == 3)
  155. #define is_RIP() ((modrm_rm & 7) == CFI_BP && modrm_mod == 0)
  156. #define have_SIB() ((modrm_rm & 7) == CFI_SP && mod_is_mem())
  157. /*
  158. * Check the ModRM register. If there is a SIB byte then check with
  159. * the SIB base register. But if the SIB base is 5 (i.e. CFI_BP) and
  160. * ModRM mod is 0 then there is no base register.
  161. */
  162. #define rm_is(reg) (have_SIB() ? \
  163. sib_base == (reg) && sib_index == CFI_SP && \
  164. (sib_base != CFI_BP || modrm_mod != 0) : \
  165. modrm_rm == (reg))
  166. #define rm_is_mem(reg) (mod_is_mem() && !is_RIP() && rm_is(reg))
  167. #define rm_is_reg(reg) (mod_is_reg() && modrm_rm == (reg))
  168. static bool has_notrack_prefix(struct insn *insn)
  169. {
  170. int i;
  171. for (i = 0; i < insn->prefixes.nbytes; i++) {
  172. if (insn->prefixes.bytes[i] == 0x3e)
  173. return true;
  174. }
  175. return false;
  176. }
  177. int arch_decode_instruction(struct objtool_file *file, const struct section *sec,
  178. unsigned long offset, unsigned int maxlen,
  179. struct instruction *insn)
  180. {
  181. struct stack_op **ops_list = &insn->stack_ops;
  182. const struct elf *elf = file->elf;
  183. struct insn ins;
  184. int x86_64, ret;
  185. unsigned char op1, op2, op3, prefix,
  186. rex = 0, rex_b = 0, rex_r = 0, rex_w = 0, rex_x = 0,
  187. modrm = 0, modrm_mod = 0, modrm_rm = 0, modrm_reg = 0,
  188. sib = 0, /* sib_scale = 0, */ sib_index = 0, sib_base = 0;
  189. struct stack_op *op = NULL;
  190. struct symbol *sym;
  191. u64 imm;
  192. x86_64 = is_x86_64(elf);
  193. if (x86_64 == -1)
  194. return -1;
  195. ret = insn_decode(&ins, sec->data->d_buf + offset, maxlen,
  196. x86_64 ? INSN_MODE_64 : INSN_MODE_32);
  197. if (ret < 0) {
  198. ERROR("can't decode instruction at %s:0x%lx", sec->name, offset);
  199. return -1;
  200. }
  201. insn->len = ins.length;
  202. insn->type = INSN_OTHER;
  203. if (ins.vex_prefix.nbytes)
  204. return 0;
  205. prefix = ins.prefixes.bytes[0];
  206. op1 = ins.opcode.bytes[0];
  207. op2 = ins.opcode.bytes[1];
  208. op3 = ins.opcode.bytes[2];
  209. if (ins.rex_prefix.nbytes) {
  210. rex = ins.rex_prefix.bytes[0];
  211. rex_w = X86_REX_W(rex) >> 3;
  212. rex_r = X86_REX_R(rex) >> 2;
  213. rex_x = X86_REX_X(rex) >> 1;
  214. rex_b = X86_REX_B(rex);
  215. }
  216. if (ins.modrm.nbytes) {
  217. modrm = ins.modrm.bytes[0];
  218. modrm_mod = X86_MODRM_MOD(modrm);
  219. modrm_reg = X86_MODRM_REG(modrm) + 8*rex_r;
  220. modrm_rm = X86_MODRM_RM(modrm) + 8*rex_b;
  221. }
  222. if (ins.sib.nbytes) {
  223. sib = ins.sib.bytes[0];
  224. /* sib_scale = X86_SIB_SCALE(sib); */
  225. sib_index = X86_SIB_INDEX(sib) + 8*rex_x;
  226. sib_base = X86_SIB_BASE(sib) + 8*rex_b;
  227. }
  228. switch (op1) {
  229. case 0x1:
  230. case 0x29:
  231. if (rex_w && rm_is_reg(CFI_SP)) {
  232. /* add/sub reg, %rsp */
  233. ADD_OP(op) {
  234. op->src.type = OP_SRC_ADD;
  235. op->src.reg = modrm_reg;
  236. op->dest.type = OP_DEST_REG;
  237. op->dest.reg = CFI_SP;
  238. }
  239. }
  240. break;
  241. case 0x50 ... 0x57:
  242. /* push reg */
  243. ADD_OP(op) {
  244. op->src.type = OP_SRC_REG;
  245. op->src.reg = (op1 & 0x7) + 8*rex_b;
  246. op->dest.type = OP_DEST_PUSH;
  247. }
  248. break;
  249. case 0x58 ... 0x5f:
  250. /* pop reg */
  251. ADD_OP(op) {
  252. op->src.type = OP_SRC_POP;
  253. op->dest.type = OP_DEST_REG;
  254. op->dest.reg = (op1 & 0x7) + 8*rex_b;
  255. }
  256. break;
  257. case 0x68:
  258. case 0x6a:
  259. /* push immediate */
  260. ADD_OP(op) {
  261. op->src.type = OP_SRC_CONST;
  262. op->dest.type = OP_DEST_PUSH;
  263. }
  264. break;
  265. case 0x70 ... 0x7f:
  266. insn->type = INSN_JUMP_CONDITIONAL;
  267. break;
  268. case 0x80 ... 0x83:
  269. /*
  270. * 1000 00sw : mod OP r/m : immediate
  271. *
  272. * s - sign extend immediate
  273. * w - imm8 / imm32
  274. *
  275. * OP: 000 ADD 100 AND
  276. * 001 OR 101 SUB
  277. * 010 ADC 110 XOR
  278. * 011 SBB 111 CMP
  279. */
  280. /* 64bit only */
  281. if (!rex_w)
  282. break;
  283. /* %rsp target only */
  284. if (!rm_is_reg(CFI_SP))
  285. break;
  286. imm = ins.immediate.value;
  287. if (op1 & 2) { /* sign extend */
  288. if (op1 & 1) { /* imm32 */
  289. imm <<= 32;
  290. imm = (s64)imm >> 32;
  291. } else { /* imm8 */
  292. imm <<= 56;
  293. imm = (s64)imm >> 56;
  294. }
  295. }
  296. switch (modrm_reg & 7) {
  297. case 5:
  298. imm = -imm;
  299. fallthrough;
  300. case 0:
  301. /* add/sub imm, %rsp */
  302. ADD_OP(op) {
  303. op->src.type = OP_SRC_ADD;
  304. op->src.reg = CFI_SP;
  305. op->src.offset = imm;
  306. op->dest.type = OP_DEST_REG;
  307. op->dest.reg = CFI_SP;
  308. }
  309. break;
  310. case 4:
  311. /* and imm, %rsp */
  312. ADD_OP(op) {
  313. op->src.type = OP_SRC_AND;
  314. op->src.reg = CFI_SP;
  315. op->src.offset = ins.immediate.value;
  316. op->dest.type = OP_DEST_REG;
  317. op->dest.reg = CFI_SP;
  318. }
  319. break;
  320. default:
  321. /* ERROR ? */
  322. break;
  323. }
  324. break;
  325. case 0x89:
  326. if (!rex_w)
  327. break;
  328. if (mod_is_reg()) {
  329. /* mov reg, reg */
  330. ADD_OP(op) {
  331. op->src.type = OP_SRC_REG;
  332. op->src.reg = modrm_reg;
  333. op->dest.type = OP_DEST_REG;
  334. op->dest.reg = modrm_rm;
  335. }
  336. break;
  337. }
  338. /* skip RIP relative displacement */
  339. if (is_RIP())
  340. break;
  341. /* skip nontrivial SIB */
  342. if (have_SIB()) {
  343. modrm_rm = sib_base;
  344. if (sib_index != CFI_SP)
  345. break;
  346. }
  347. /* mov %rsp, disp(%reg) */
  348. if (modrm_reg == CFI_SP) {
  349. ADD_OP(op) {
  350. op->src.type = OP_SRC_REG;
  351. op->src.reg = CFI_SP;
  352. op->dest.type = OP_DEST_REG_INDIRECT;
  353. op->dest.reg = modrm_rm;
  354. op->dest.offset = ins.displacement.value;
  355. }
  356. break;
  357. }
  358. fallthrough;
  359. case 0x88:
  360. if (!rex_w)
  361. break;
  362. if (rm_is_mem(CFI_BP)) {
  363. /* mov reg, disp(%rbp) */
  364. ADD_OP(op) {
  365. op->src.type = OP_SRC_REG;
  366. op->src.reg = modrm_reg;
  367. op->dest.type = OP_DEST_REG_INDIRECT;
  368. op->dest.reg = CFI_BP;
  369. op->dest.offset = ins.displacement.value;
  370. }
  371. break;
  372. }
  373. if (rm_is_mem(CFI_SP)) {
  374. /* mov reg, disp(%rsp) */
  375. ADD_OP(op) {
  376. op->src.type = OP_SRC_REG;
  377. op->src.reg = modrm_reg;
  378. op->dest.type = OP_DEST_REG_INDIRECT;
  379. op->dest.reg = CFI_SP;
  380. op->dest.offset = ins.displacement.value;
  381. }
  382. break;
  383. }
  384. break;
  385. case 0x8b:
  386. if (!rex_w)
  387. break;
  388. if (rm_is_mem(CFI_BP)) {
  389. /* mov disp(%rbp), reg */
  390. ADD_OP(op) {
  391. op->src.type = OP_SRC_REG_INDIRECT;
  392. op->src.reg = CFI_BP;
  393. op->src.offset = ins.displacement.value;
  394. op->dest.type = OP_DEST_REG;
  395. op->dest.reg = modrm_reg;
  396. }
  397. break;
  398. }
  399. if (rm_is_mem(CFI_SP)) {
  400. /* mov disp(%rsp), reg */
  401. ADD_OP(op) {
  402. op->src.type = OP_SRC_REG_INDIRECT;
  403. op->src.reg = CFI_SP;
  404. op->src.offset = ins.displacement.value;
  405. op->dest.type = OP_DEST_REG;
  406. op->dest.reg = modrm_reg;
  407. }
  408. break;
  409. }
  410. break;
  411. case 0x8d:
  412. if (mod_is_reg()) {
  413. WARN("invalid LEA encoding at %s:0x%lx", sec->name, offset);
  414. break;
  415. }
  416. /* skip non 64bit ops */
  417. if (!rex_w)
  418. break;
  419. /* skip nontrivial SIB */
  420. if (have_SIB()) {
  421. modrm_rm = sib_base;
  422. if (sib_index != CFI_SP)
  423. break;
  424. }
  425. /* lea disp(%rip), %dst */
  426. if (is_RIP()) {
  427. insn->type = INSN_LEA_RIP;
  428. break;
  429. }
  430. /* lea disp(%src), %dst */
  431. ADD_OP(op) {
  432. op->src.offset = ins.displacement.value;
  433. if (!op->src.offset) {
  434. /* lea (%src), %dst */
  435. op->src.type = OP_SRC_REG;
  436. } else {
  437. /* lea disp(%src), %dst */
  438. op->src.type = OP_SRC_ADD;
  439. }
  440. op->src.reg = modrm_rm;
  441. op->dest.type = OP_DEST_REG;
  442. op->dest.reg = modrm_reg;
  443. }
  444. break;
  445. case 0x8f:
  446. /* pop to mem */
  447. ADD_OP(op) {
  448. op->src.type = OP_SRC_POP;
  449. op->dest.type = OP_DEST_MEM;
  450. }
  451. break;
  452. case 0x90:
  453. if (rex_b) /* XCHG %r8, %rax */
  454. break;
  455. if (prefix == 0xf3) /* REP NOP := PAUSE */
  456. break;
  457. insn->type = INSN_NOP;
  458. break;
  459. case 0x9c:
  460. /* pushf */
  461. ADD_OP(op) {
  462. op->src.type = OP_SRC_CONST;
  463. op->dest.type = OP_DEST_PUSHF;
  464. }
  465. break;
  466. case 0x9d:
  467. /* popf */
  468. ADD_OP(op) {
  469. op->src.type = OP_SRC_POPF;
  470. op->dest.type = OP_DEST_MEM;
  471. }
  472. break;
  473. case 0x0f:
  474. if (op2 == 0x01) {
  475. switch (insn_last_prefix_id(&ins)) {
  476. case INAT_PFX_REPE:
  477. case INAT_PFX_REPNE:
  478. if (modrm == 0xca)
  479. /* eretu/erets */
  480. insn->type = INSN_SYSRET;
  481. break;
  482. default:
  483. if (modrm == 0xca)
  484. insn->type = INSN_CLAC;
  485. else if (modrm == 0xcb)
  486. insn->type = INSN_STAC;
  487. break;
  488. }
  489. } else if (op2 >= 0x80 && op2 <= 0x8f) {
  490. insn->type = INSN_JUMP_CONDITIONAL;
  491. } else if (op2 == 0x05 || op2 == 0x34) {
  492. /* syscall, sysenter */
  493. insn->type = INSN_SYSCALL;
  494. } else if (op2 == 0x07 || op2 == 0x35) {
  495. /* sysret, sysexit */
  496. insn->type = INSN_SYSRET;
  497. } else if (op2 == 0x0b || op2 == 0xb9) {
  498. /* ud2, ud1 */
  499. insn->type = INSN_BUG;
  500. } else if (op2 == 0x1f) {
  501. /* 0f 1f /0 := NOPL */
  502. if (modrm_reg == 0)
  503. insn->type = INSN_NOP;
  504. } else if (op2 == 0x1e) {
  505. if (prefix == 0xf3 && (modrm == 0xfa || modrm == 0xfb))
  506. insn->type = INSN_ENDBR;
  507. } else if (op2 == 0x38 && op3 == 0xf8) {
  508. if (ins.prefixes.nbytes == 1 &&
  509. ins.prefixes.bytes[0] == 0xf2) {
  510. /* ENQCMD cannot be used in the kernel. */
  511. WARN("ENQCMD instruction at %s:%lx", sec->name, offset);
  512. }
  513. } else if (op2 == 0xa0 || op2 == 0xa8) {
  514. /* push fs/gs */
  515. ADD_OP(op) {
  516. op->src.type = OP_SRC_CONST;
  517. op->dest.type = OP_DEST_PUSH;
  518. }
  519. } else if (op2 == 0xa1 || op2 == 0xa9) {
  520. /* pop fs/gs */
  521. ADD_OP(op) {
  522. op->src.type = OP_SRC_POP;
  523. op->dest.type = OP_DEST_MEM;
  524. }
  525. }
  526. break;
  527. case 0xc9:
  528. /*
  529. * leave
  530. *
  531. * equivalent to:
  532. * mov bp, sp
  533. * pop bp
  534. */
  535. ADD_OP(op) {
  536. op->src.type = OP_SRC_REG;
  537. op->src.reg = CFI_BP;
  538. op->dest.type = OP_DEST_REG;
  539. op->dest.reg = CFI_SP;
  540. }
  541. ADD_OP(op) {
  542. op->src.type = OP_SRC_POP;
  543. op->dest.type = OP_DEST_REG;
  544. op->dest.reg = CFI_BP;
  545. }
  546. break;
  547. case 0xcc:
  548. /* int3 */
  549. insn->type = INSN_TRAP;
  550. break;
  551. case 0xe3:
  552. /* jecxz/jrcxz */
  553. insn->type = INSN_JUMP_CONDITIONAL;
  554. break;
  555. case 0xe9:
  556. case 0xeb:
  557. insn->type = INSN_JUMP_UNCONDITIONAL;
  558. break;
  559. case 0xc2:
  560. case 0xc3:
  561. insn->type = INSN_RETURN;
  562. break;
  563. case 0xc7: /* mov imm, r/m */
  564. if (!opts.noinstr)
  565. break;
  566. if (ins.length == 3+4+4 && !strncmp(sec->name, ".init.text", 10)) {
  567. struct reloc *immr, *disp;
  568. struct symbol *func;
  569. int idx;
  570. immr = find_reloc_by_dest(elf, (void *)sec, offset+3);
  571. disp = find_reloc_by_dest(elf, (void *)sec, offset+7);
  572. if (!immr || strncmp(immr->sym->name, "pv_ops", 6))
  573. break;
  574. idx = pv_ops_idx_off(immr->sym->name);
  575. if (idx < 0)
  576. break;
  577. idx += (reloc_addend(immr) + 8) / sizeof(void *);
  578. func = disp->sym;
  579. if (disp->sym->type == STT_SECTION)
  580. func = find_symbol_by_offset(disp->sym->sec, reloc_addend(disp));
  581. if (!func) {
  582. ERROR("no func for pv_ops[]");
  583. return -1;
  584. }
  585. objtool_pv_add(file, idx, func);
  586. }
  587. break;
  588. case 0xcf: /* iret */
  589. /*
  590. * Handle sync_core(), which has an IRET to self.
  591. * All other IRET are in STT_NONE entry code.
  592. */
  593. sym = find_symbol_containing(sec, offset);
  594. if (sym && sym->type == STT_FUNC) {
  595. ADD_OP(op) {
  596. /* add $40, %rsp */
  597. op->src.type = OP_SRC_ADD;
  598. op->src.reg = CFI_SP;
  599. op->src.offset = 5*8;
  600. op->dest.type = OP_DEST_REG;
  601. op->dest.reg = CFI_SP;
  602. }
  603. break;
  604. }
  605. fallthrough;
  606. case 0xca: /* retf */
  607. case 0xcb: /* retf */
  608. insn->type = INSN_SYSRET;
  609. break;
  610. case 0xd6: /* udb */
  611. insn->type = INSN_BUG;
  612. break;
  613. case 0xe0: /* loopne */
  614. case 0xe1: /* loope */
  615. case 0xe2: /* loop */
  616. insn->type = INSN_JUMP_CONDITIONAL;
  617. break;
  618. case 0xe8:
  619. insn->type = INSN_CALL;
  620. /*
  621. * For the impact on the stack, a CALL behaves like
  622. * a PUSH of an immediate value (the return address).
  623. */
  624. ADD_OP(op) {
  625. op->src.type = OP_SRC_CONST;
  626. op->dest.type = OP_DEST_PUSH;
  627. }
  628. break;
  629. case 0xfc:
  630. insn->type = INSN_CLD;
  631. break;
  632. case 0xfd:
  633. insn->type = INSN_STD;
  634. break;
  635. case 0xff:
  636. if (modrm_reg == 2 || modrm_reg == 3) {
  637. insn->type = INSN_CALL_DYNAMIC;
  638. if (has_notrack_prefix(&ins))
  639. WARN("notrack prefix found at %s:0x%lx", sec->name, offset);
  640. } else if (modrm_reg == 4) {
  641. insn->type = INSN_JUMP_DYNAMIC;
  642. if (has_notrack_prefix(&ins))
  643. WARN("notrack prefix found at %s:0x%lx", sec->name, offset);
  644. } else if (modrm_reg == 5) {
  645. /* jmpf */
  646. insn->type = INSN_SYSRET;
  647. } else if (modrm_reg == 6) {
  648. /* push from mem */
  649. ADD_OP(op) {
  650. op->src.type = OP_SRC_CONST;
  651. op->dest.type = OP_DEST_PUSH;
  652. }
  653. }
  654. break;
  655. default:
  656. break;
  657. }
  658. if (ins.immediate.nbytes)
  659. insn->immediate = ins.immediate.value;
  660. else if (ins.displacement.nbytes)
  661. insn->immediate = ins.displacement.value;
  662. return 0;
  663. }
  664. void arch_initial_func_cfi_state(struct cfi_init_state *state)
  665. {
  666. int i;
  667. for (i = 0; i < CFI_NUM_REGS; i++) {
  668. state->regs[i].base = CFI_UNDEFINED;
  669. state->regs[i].offset = 0;
  670. }
  671. /* initial CFA (call frame address) */
  672. state->cfa.base = CFI_SP;
  673. state->cfa.offset = 8;
  674. /* initial RA (return address) */
  675. state->regs[CFI_RA].base = CFI_CFA;
  676. state->regs[CFI_RA].offset = -8;
  677. }
  678. const char *arch_nop_insn(int len)
  679. {
  680. static const char nops[5][5] = {
  681. { BYTES_NOP1 },
  682. { BYTES_NOP2 },
  683. { BYTES_NOP3 },
  684. { BYTES_NOP4 },
  685. { BYTES_NOP5 },
  686. };
  687. if (len < 1 || len > 5) {
  688. ERROR("invalid NOP size: %d\n", len);
  689. return NULL;
  690. }
  691. return nops[len-1];
  692. }
  693. #define BYTE_RET 0xC3
  694. const char *arch_ret_insn(int len)
  695. {
  696. static const char ret[5][5] = {
  697. { BYTE_RET },
  698. { BYTE_RET, 0xcc },
  699. { BYTE_RET, 0xcc, BYTES_NOP1 },
  700. { BYTE_RET, 0xcc, BYTES_NOP2 },
  701. { BYTE_RET, 0xcc, BYTES_NOP3 },
  702. };
  703. if (len < 1 || len > 5) {
  704. ERROR("invalid RET size: %d\n", len);
  705. return NULL;
  706. }
  707. return ret[len-1];
  708. }
  709. int arch_decode_hint_reg(u8 sp_reg, int *base)
  710. {
  711. switch (sp_reg) {
  712. case ORC_REG_UNDEFINED:
  713. *base = CFI_UNDEFINED;
  714. break;
  715. case ORC_REG_SP:
  716. *base = CFI_SP;
  717. break;
  718. case ORC_REG_BP:
  719. *base = CFI_BP;
  720. break;
  721. case ORC_REG_SP_INDIRECT:
  722. *base = CFI_SP_INDIRECT;
  723. break;
  724. case ORC_REG_R10:
  725. *base = CFI_R10;
  726. break;
  727. case ORC_REG_R13:
  728. *base = CFI_R13;
  729. break;
  730. case ORC_REG_DI:
  731. *base = CFI_DI;
  732. break;
  733. case ORC_REG_DX:
  734. *base = CFI_DX;
  735. break;
  736. default:
  737. return -1;
  738. }
  739. return 0;
  740. }
  741. bool arch_is_retpoline(struct symbol *sym)
  742. {
  743. return !strncmp(sym->name, "__x86_indirect_", 15) ||
  744. !strncmp(sym->name, "__pi___x86_indirect_", 20);
  745. }
  746. bool arch_is_rethunk(struct symbol *sym)
  747. {
  748. return !strcmp(sym->name, "__x86_return_thunk") ||
  749. !strcmp(sym->name, "__pi___x86_return_thunk");
  750. }
  751. bool arch_is_embedded_insn(struct symbol *sym)
  752. {
  753. return !strcmp(sym->name, "retbleed_return_thunk") ||
  754. !strcmp(sym->name, "srso_alias_safe_ret") ||
  755. !strcmp(sym->name, "srso_safe_ret");
  756. }
  757. unsigned int arch_reloc_size(struct reloc *reloc)
  758. {
  759. switch (reloc_type(reloc)) {
  760. case R_X86_64_32:
  761. case R_X86_64_32S:
  762. case R_X86_64_PC32:
  763. case R_X86_64_PLT32:
  764. return 4;
  765. default:
  766. return 8;
  767. }
  768. }
  769. bool arch_absolute_reloc(struct elf *elf, struct reloc *reloc)
  770. {
  771. switch (reloc_type(reloc)) {
  772. case R_X86_64_32:
  773. case R_X86_64_32S:
  774. case R_X86_64_64:
  775. return true;
  776. default:
  777. return false;
  778. }
  779. }
  780. #ifdef DISAS
  781. int arch_disas_info_init(struct disassemble_info *dinfo)
  782. {
  783. return disas_info_init(dinfo, bfd_arch_i386,
  784. bfd_mach_i386_i386, bfd_mach_x86_64,
  785. "att");
  786. }
  787. #endif /* DISAS */