Re: [v6 PATCH 06/21] x86/insn-eval: Add utility functions to get segment selector

[Ricardo Neri]

On Wed, 2017-04-26 at 13:44 -0700, Ricardo Neri wrote:
> > 
> > > +    */
> > > +   for (i = 0; i < insn->prefixes.nbytes; i++) {
> > > +           switch (insn->prefixes.bytes[i]) {
> > > +           case SEG_CS:
> > > +                   return SEG_CS;
> > > +           case SEG_SS:
> > > +                   return SEG_SS;
> > > +           case SEG_DS:
> > > +                   return SEG_DS;
> > > +           case SEG_ES:
> > > +                   return SEG_ES;
> > > +           case SEG_FS:
> > > +                   return SEG_FS;
> > > +           case SEG_GS:
> > > +                   return SEG_GS;
> > 
> > So what happens if you're in 64-bit mode and you have CS, DS, ES, or
> SS?
> > Or is this what @get_default is supposed to do? But it doesn't look
> like
> > it, it still returns segments ignored in 64-bit mode.
> 
> I regard that the role of this function is to obtain the the segment
> selector from either of the prefixes or inferred from the operands. It
> is the role of caller to determine if the segment selector should be
> ignored. So far the only caller is insn_get_seg_base() [1]. If in long
> mode, the segment base address is regarded as 0 unless the segment
> selector is FS or GS.
> > 
> > > +           default:
> > > +                   return -EINVAL;
> > > +           }
> > > +   }
> > > +
> > > +default_seg:
> > > +   /*
> > > +    * If no overrides, use default selectors as described in the
> > > +    * Intel documentation: SS for ESP or EBP. DS for all data
> references,
> > > +    * except when relative to stack or string destination.
> > > +    * Also, AX, CX and DX are not valid register operands in
> 16-bit
> > > +    * address encodings.
> > > +    * Callers must interpret the result correctly according to
> the type
> > > +    * of instructions (e.g., use ES for string instructions).
> > > +    * Also, some values of modrm and sib might seem to indicate
> the use
> > > +    * of EBP and ESP (e.g., modrm_mod = 0, modrm_rm = 5) but
> actually
> > > +    * they refer to cases in which only a displacement used.
> These cases
> > > +    * should be indentified by the caller and not with this
> function.
> > > +    */
> > > +   switch (regoff) {
> > > +   case offsetof(struct pt_regs, ax):
> > > +           /* fall through */
> > > +   case offsetof(struct pt_regs, cx):
> > > +           /* fall through */
> > > +   case offsetof(struct pt_regs, dx):
> > > +           if (insn && insn->addr_bytes == 2)
> > > +                   return -EINVAL;
> > > +   case -EDOM: /* no register involved in address computation */
> > > +   case offsetof(struct pt_regs, bx):
> > > +           /* fall through */
> > > +   case offsetof(struct pt_regs, di):
> > > +           /* fall through */
> > 
> >               return SEG_ES;
> > 
> > ?
> 
> I double-checked the latest version of the Intel Software Development
> manual [2], in the table 3-5 in section 3.7.4 mentions that DS is
> default segment for all data references, except string destinations. I
> tested this code with the UMIP-protected instructions and whenever I
> use
> %edi the default segment is %ds.


I forgot my references:

[1]. https://lkml.org/lkml/2017/3/7/876
[2]. https://software.intel.com/en-us/articles/intel-sdm#combined