* [PATCH 0/2] x86: Fix insn decoder to support 0xEA as UD
@ 2025-04-28 1:48 Masami Hiramatsu (Google)
2025-04-28 1:48 ` [PATCH 1/2] x86: Fix opcode map (!REX2) superscript tags Masami Hiramatsu (Google)
2025-04-28 1:48 ` [PATCH 2/2] x86: Stop decoding i64 instructions in x86-64 mode at opcode Masami Hiramatsu (Google)
0 siblings, 2 replies; 6+ messages in thread
From: Masami Hiramatsu (Google) @ 2025-04-28 1:48 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar
Cc: Thomas Gleixner, Borislav Petkov, Dave Hansen, x86,
H . Peter Anvin, linux-kernel, Adrian Hunter
Hi,
Peter found that the current x86 instruction decoder reports the 0xEA
instruction as "JMP Ap" always. But objdump says that is invalid on
64bit mode. Thus there is a difference of lenght of 0xEA between
objdump and x86 insn decoder.
I found the opcodes which have (i64) superscript are invalid in 64bit
mode, if it is not paired with (o64). Thus this stops decoding such
instructions if insn->x86_64 is set.
With this fix, the single "0xEA" is correctly decoded as 1 byte
instruction in 64bit mode.
------
printf "0:\tea\t\n" | insn_decoder_test -y -v
insn_decoder_test: success: Decoded and checked 1 instructions
------
In this series, I also found a bug in previous (!REX2) tag. The first
commit fixes that.
---
Masami Hiramatsu (Google) (2):
x86: Fix opcode map (!REX2) superscript tags
x86: Stop decoding i64 instructions in x86-64 mode at opcode
arch/x86/include/asm/inat.h | 6 +++
arch/x86/lib/insn.c | 7 +++-
arch/x86/lib/x86-opcode-map.txt | 56 ++++++++++++++--------------
arch/x86/tools/gen-insn-attr-x86.awk | 7 ++++
tools/arch/x86/include/asm/inat.h | 6 +++
tools/arch/x86/lib/insn.c | 7 +++-
tools/arch/x86/lib/x86-opcode-map.txt | 56 ++++++++++++++--------------
tools/arch/x86/tools/gen-insn-attr-x86.awk | 7 ++++
8 files changed, 94 insertions(+), 58 deletions(-)
--
Masami Hiramatsu (Google) <mhiramat@kernel.org>
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH 1/2] x86: Fix opcode map (!REX2) superscript tags 2025-04-28 1:48 [PATCH 0/2] x86: Fix insn decoder to support 0xEA as UD Masami Hiramatsu (Google) @ 2025-04-28 1:48 ` Masami Hiramatsu (Google) 2025-05-06 10:35 ` [tip: x86/asm] x86/insn: " tip-bot2 for Masami Hiramatsu (Google) 2025-04-28 1:48 ` [PATCH 2/2] x86: Stop decoding i64 instructions in x86-64 mode at opcode Masami Hiramatsu (Google) 1 sibling, 1 reply; 6+ messages in thread From: Masami Hiramatsu (Google) @ 2025-04-28 1:48 UTC (permalink / raw) To: Peter Zijlstra, Ingo Molnar Cc: Thomas Gleixner, Borislav Petkov, Dave Hansen, x86, H . Peter Anvin, linux-kernel, Adrian Hunter From: Masami Hiramatsu (Google) <mhiramat@kernel.org> Commit 159039af8c07 ("x86/insn: x86/insn: Add support for REX2 prefix to the instruction decoder opcode map") added (!REX2) superscript with a space, but the correct format requires ',' for concatination with other superscript tags. Add ',' to generate correct insn attribute tables. I confirmed with following command. ----- > awk -f arch/x86/tools/gen-insn-attr-x86.awk \ arch/x86/lib/x86-opcode-map.txt | grep e8 | head -n 1 [0xe8] = INAT_MAKE_IMM(INAT_IMM_VWORD32) | INAT_FORCE64 | INAT_NO_REX2, ----- Fixes: 159039af8c07 ("x86/insn: x86/insn: Add support for REX2 prefix to the instruction decoder opcode map") Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> --- arch/x86/lib/x86-opcode-map.txt | 50 +++++++++++++++++---------------- tools/arch/x86/lib/x86-opcode-map.txt | 50 +++++++++++++++++---------------- 2 files changed, 50 insertions(+), 50 deletions(-) diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt index caedb3ef6688..5e2fa3f7128e 100644 --- a/arch/x86/lib/x86-opcode-map.txt +++ b/arch/x86/lib/x86-opcode-map.txt @@ -35,7 +35,7 @@ # - (!F3) : the last prefix is not 0xF3 (including non-last prefix case) # - (66&F2): Both 0x66 and 0xF2 prefixes are specified. # -# REX2 Prefix +# REX2 Prefix Superscripts # - (!REX2): REX2 is not allowed # - (REX2): REX2 variant e.g. JMPABS @@ -286,10 +286,10 @@ df: ESC # Note: "forced64" is Intel CPU behavior: they ignore 0x66 prefix # in 64-bit mode. AMD CPUs accept 0x66 prefix, it causes RIP truncation # to 16 bits. In 32-bit mode, 0x66 is accepted by both Intel and AMD. -e0: LOOPNE/LOOPNZ Jb (f64) (!REX2) -e1: LOOPE/LOOPZ Jb (f64) (!REX2) -e2: LOOP Jb (f64) (!REX2) -e3: JrCXZ Jb (f64) (!REX2) +e0: LOOPNE/LOOPNZ Jb (f64),(!REX2) +e1: LOOPE/LOOPZ Jb (f64),(!REX2) +e2: LOOP Jb (f64),(!REX2) +e3: JrCXZ Jb (f64),(!REX2) e4: IN AL,Ib (!REX2) e5: IN eAX,Ib (!REX2) e6: OUT Ib,AL (!REX2) @@ -298,10 +298,10 @@ e7: OUT Ib,eAX (!REX2) # in "near" jumps and calls is 16-bit. For CALL, # push of return address is 16-bit wide, RSP is decremented by 2 # but is not truncated to 16 bits, unlike RIP. -e8: CALL Jz (f64) (!REX2) -e9: JMP-near Jz (f64) (!REX2) -ea: JMP-far Ap (i64) (!REX2) -eb: JMP-short Jb (f64) (!REX2) +e8: CALL Jz (f64),(!REX2) +e9: JMP-near Jz (f64),(!REX2) +ea: JMP-far Ap (i64),(!REX2) +eb: JMP-short Jb (f64),(!REX2) ec: IN AL,DX (!REX2) ed: IN eAX,DX (!REX2) ee: OUT DX,AL (!REX2) @@ -478,22 +478,22 @@ AVXcode: 1 7f: movq Qq,Pq | vmovdqa Wx,Vx (66) | vmovdqa32/64 Wx,Vx (66),(evo) | vmovdqu Wx,Vx (F3) | vmovdqu32/64 Wx,Vx (F3),(evo) | vmovdqu8/16 Wx,Vx (F2),(ev) # 0x0f 0x80-0x8f # Note: "forced64" is Intel CPU behavior (see comment about CALL insn). -80: JO Jz (f64) (!REX2) -81: JNO Jz (f64) (!REX2) -82: JB/JC/JNAE Jz (f64) (!REX2) -83: JAE/JNB/JNC Jz (f64) (!REX2) -84: JE/JZ Jz (f64) (!REX2) -85: JNE/JNZ Jz (f64) (!REX2) -86: JBE/JNA Jz (f64) (!REX2) -87: JA/JNBE Jz (f64) (!REX2) -88: JS Jz (f64) (!REX2) -89: JNS Jz (f64) (!REX2) -8a: JP/JPE Jz (f64) (!REX2) -8b: JNP/JPO Jz (f64) (!REX2) -8c: JL/JNGE Jz (f64) (!REX2) -8d: JNL/JGE Jz (f64) (!REX2) -8e: JLE/JNG Jz (f64) (!REX2) -8f: JNLE/JG Jz (f64) (!REX2) +80: JO Jz (f64),(!REX2) +81: JNO Jz (f64),(!REX2) +82: JB/JC/JNAE Jz (f64),(!REX2) +83: JAE/JNB/JNC Jz (f64),(!REX2) +84: JE/JZ Jz (f64),(!REX2) +85: JNE/JNZ Jz (f64),(!REX2) +86: JBE/JNA Jz (f64),(!REX2) +87: JA/JNBE Jz (f64),(!REX2) +88: JS Jz (f64),(!REX2) +89: JNS Jz (f64),(!REX2) +8a: JP/JPE Jz (f64),(!REX2) +8b: JNP/JPO Jz (f64),(!REX2) +8c: JL/JNGE Jz (f64),(!REX2) +8d: JNL/JGE Jz (f64),(!REX2) +8e: JLE/JNG Jz (f64),(!REX2) +8f: JNLE/JG Jz (f64),(!REX2) # 0x0f 0x90-0x9f 90: SETO Eb | kmovw/q Vk,Wk | kmovb/d Vk,Wk (66) 91: SETNO Eb | kmovw/q Mv,Vk | kmovb/d Mv,Vk (66) diff --git a/tools/arch/x86/lib/x86-opcode-map.txt b/tools/arch/x86/lib/x86-opcode-map.txt index caedb3ef6688..5e2fa3f7128e 100644 --- a/tools/arch/x86/lib/x86-opcode-map.txt +++ b/tools/arch/x86/lib/x86-opcode-map.txt @@ -35,7 +35,7 @@ # - (!F3) : the last prefix is not 0xF3 (including non-last prefix case) # - (66&F2): Both 0x66 and 0xF2 prefixes are specified. # -# REX2 Prefix +# REX2 Prefix Superscripts # - (!REX2): REX2 is not allowed # - (REX2): REX2 variant e.g. JMPABS @@ -286,10 +286,10 @@ df: ESC # Note: "forced64" is Intel CPU behavior: they ignore 0x66 prefix # in 64-bit mode. AMD CPUs accept 0x66 prefix, it causes RIP truncation # to 16 bits. In 32-bit mode, 0x66 is accepted by both Intel and AMD. -e0: LOOPNE/LOOPNZ Jb (f64) (!REX2) -e1: LOOPE/LOOPZ Jb (f64) (!REX2) -e2: LOOP Jb (f64) (!REX2) -e3: JrCXZ Jb (f64) (!REX2) +e0: LOOPNE/LOOPNZ Jb (f64),(!REX2) +e1: LOOPE/LOOPZ Jb (f64),(!REX2) +e2: LOOP Jb (f64),(!REX2) +e3: JrCXZ Jb (f64),(!REX2) e4: IN AL,Ib (!REX2) e5: IN eAX,Ib (!REX2) e6: OUT Ib,AL (!REX2) @@ -298,10 +298,10 @@ e7: OUT Ib,eAX (!REX2) # in "near" jumps and calls is 16-bit. For CALL, # push of return address is 16-bit wide, RSP is decremented by 2 # but is not truncated to 16 bits, unlike RIP. -e8: CALL Jz (f64) (!REX2) -e9: JMP-near Jz (f64) (!REX2) -ea: JMP-far Ap (i64) (!REX2) -eb: JMP-short Jb (f64) (!REX2) +e8: CALL Jz (f64),(!REX2) +e9: JMP-near Jz (f64),(!REX2) +ea: JMP-far Ap (i64),(!REX2) +eb: JMP-short Jb (f64),(!REX2) ec: IN AL,DX (!REX2) ed: IN eAX,DX (!REX2) ee: OUT DX,AL (!REX2) @@ -478,22 +478,22 @@ AVXcode: 1 7f: movq Qq,Pq | vmovdqa Wx,Vx (66) | vmovdqa32/64 Wx,Vx (66),(evo) | vmovdqu Wx,Vx (F3) | vmovdqu32/64 Wx,Vx (F3),(evo) | vmovdqu8/16 Wx,Vx (F2),(ev) # 0x0f 0x80-0x8f # Note: "forced64" is Intel CPU behavior (see comment about CALL insn). -80: JO Jz (f64) (!REX2) -81: JNO Jz (f64) (!REX2) -82: JB/JC/JNAE Jz (f64) (!REX2) -83: JAE/JNB/JNC Jz (f64) (!REX2) -84: JE/JZ Jz (f64) (!REX2) -85: JNE/JNZ Jz (f64) (!REX2) -86: JBE/JNA Jz (f64) (!REX2) -87: JA/JNBE Jz (f64) (!REX2) -88: JS Jz (f64) (!REX2) -89: JNS Jz (f64) (!REX2) -8a: JP/JPE Jz (f64) (!REX2) -8b: JNP/JPO Jz (f64) (!REX2) -8c: JL/JNGE Jz (f64) (!REX2) -8d: JNL/JGE Jz (f64) (!REX2) -8e: JLE/JNG Jz (f64) (!REX2) -8f: JNLE/JG Jz (f64) (!REX2) +80: JO Jz (f64),(!REX2) +81: JNO Jz (f64),(!REX2) +82: JB/JC/JNAE Jz (f64),(!REX2) +83: JAE/JNB/JNC Jz (f64),(!REX2) +84: JE/JZ Jz (f64),(!REX2) +85: JNE/JNZ Jz (f64),(!REX2) +86: JBE/JNA Jz (f64),(!REX2) +87: JA/JNBE Jz (f64),(!REX2) +88: JS Jz (f64),(!REX2) +89: JNS Jz (f64),(!REX2) +8a: JP/JPE Jz (f64),(!REX2) +8b: JNP/JPO Jz (f64),(!REX2) +8c: JL/JNGE Jz (f64),(!REX2) +8d: JNL/JGE Jz (f64),(!REX2) +8e: JLE/JNG Jz (f64),(!REX2) +8f: JNLE/JG Jz (f64),(!REX2) # 0x0f 0x90-0x9f 90: SETO Eb | kmovw/q Vk,Wk | kmovb/d Vk,Wk (66) 91: SETNO Eb | kmovw/q Mv,Vk | kmovb/d Mv,Vk (66) ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [tip: x86/asm] x86/insn: Fix opcode map (!REX2) superscript tags 2025-04-28 1:48 ` [PATCH 1/2] x86: Fix opcode map (!REX2) superscript tags Masami Hiramatsu (Google) @ 2025-05-06 10:35 ` tip-bot2 for Masami Hiramatsu (Google) 0 siblings, 0 replies; 6+ messages in thread From: tip-bot2 for Masami Hiramatsu (Google) @ 2025-05-06 10:35 UTC (permalink / raw) To: linux-tip-commits Cc: Masami Hiramatsu (Google), Ingo Molnar, H. Peter Anvin, Adrian Hunter, Peter Zijlstra, x86, linux-kernel The following commit has been merged into the x86/asm branch of tip: Commit-ID: ca698ec2f07873a448d53c580795c4e023c75393 Gitweb: https://git.kernel.org/tip/ca698ec2f07873a448d53c580795c4e023c75393 Author: Masami Hiramatsu (Google) <mhiramat@kernel.org> AuthorDate: Mon, 28 Apr 2025 10:48:10 +09:00 Committer: Ingo Molnar <mingo@kernel.org> CommitterDate: Tue, 06 May 2025 12:03:15 +02:00 x86/insn: Fix opcode map (!REX2) superscript tags Commit: 159039af8c07 ("x86/insn: x86/insn: Add support for REX2 prefix to the instruction decoder opcode map") added (!REX2) superscript with a space, but the correct format requires ',' for concatination with other superscript tags. Add ',' to generate correct insn attribute tables. I confirmed with following command: arch/x86/lib/x86-opcode-map.txt | grep e8 | head -n 1 [0xe8] = INAT_MAKE_IMM(INAT_IMM_VWORD32) | INAT_FORCE64 | INAT_NO_REX2, Fixes: 159039af8c07 ("x86/insn: x86/insn: Add support for REX2 prefix to the instruction decoder opcode map") Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Peter Zijlstra <peterz@infradead.org> Link: https://lore.kernel.org/r/174580489027.388420.15539375184727726142.stgit@devnote2 --- arch/x86/lib/x86-opcode-map.txt | 50 +++++++++++++------------- tools/arch/x86/lib/x86-opcode-map.txt | 50 +++++++++++++------------- 2 files changed, 50 insertions(+), 50 deletions(-) diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt index f5dd84e..cd3fd51 100644 --- a/arch/x86/lib/x86-opcode-map.txt +++ b/arch/x86/lib/x86-opcode-map.txt @@ -35,7 +35,7 @@ # - (!F3) : the last prefix is not 0xF3 (including non-last prefix case) # - (66&F2): Both 0x66 and 0xF2 prefixes are specified. # -# REX2 Prefix +# REX2 Prefix Superscripts # - (!REX2): REX2 is not allowed # - (REX2): REX2 variant e.g. JMPABS @@ -286,10 +286,10 @@ df: ESC # Note: "forced64" is Intel CPU behavior: they ignore 0x66 prefix # in 64-bit mode. AMD CPUs accept 0x66 prefix, it causes RIP truncation # to 16 bits. In 32-bit mode, 0x66 is accepted by both Intel and AMD. -e0: LOOPNE/LOOPNZ Jb (f64) (!REX2) -e1: LOOPE/LOOPZ Jb (f64) (!REX2) -e2: LOOP Jb (f64) (!REX2) -e3: JrCXZ Jb (f64) (!REX2) +e0: LOOPNE/LOOPNZ Jb (f64),(!REX2) +e1: LOOPE/LOOPZ Jb (f64),(!REX2) +e2: LOOP Jb (f64),(!REX2) +e3: JrCXZ Jb (f64),(!REX2) e4: IN AL,Ib (!REX2) e5: IN eAX,Ib (!REX2) e6: OUT Ib,AL (!REX2) @@ -298,10 +298,10 @@ e7: OUT Ib,eAX (!REX2) # in "near" jumps and calls is 16-bit. For CALL, # push of return address is 16-bit wide, RSP is decremented by 2 # but is not truncated to 16 bits, unlike RIP. -e8: CALL Jz (f64) (!REX2) -e9: JMP-near Jz (f64) (!REX2) -ea: JMP-far Ap (i64) (!REX2) -eb: JMP-short Jb (f64) (!REX2) +e8: CALL Jz (f64),(!REX2) +e9: JMP-near Jz (f64),(!REX2) +ea: JMP-far Ap (i64),(!REX2) +eb: JMP-short Jb (f64),(!REX2) ec: IN AL,DX (!REX2) ed: IN eAX,DX (!REX2) ee: OUT DX,AL (!REX2) @@ -478,22 +478,22 @@ AVXcode: 1 7f: movq Qq,Pq | vmovdqa Wx,Vx (66) | vmovdqa32/64 Wx,Vx (66),(evo) | vmovdqu Wx,Vx (F3) | vmovdqu32/64 Wx,Vx (F3),(evo) | vmovdqu8/16 Wx,Vx (F2),(ev) # 0x0f 0x80-0x8f # Note: "forced64" is Intel CPU behavior (see comment about CALL insn). -80: JO Jz (f64) (!REX2) -81: JNO Jz (f64) (!REX2) -82: JB/JC/JNAE Jz (f64) (!REX2) -83: JAE/JNB/JNC Jz (f64) (!REX2) -84: JE/JZ Jz (f64) (!REX2) -85: JNE/JNZ Jz (f64) (!REX2) -86: JBE/JNA Jz (f64) (!REX2) -87: JA/JNBE Jz (f64) (!REX2) -88: JS Jz (f64) (!REX2) -89: JNS Jz (f64) (!REX2) -8a: JP/JPE Jz (f64) (!REX2) -8b: JNP/JPO Jz (f64) (!REX2) -8c: JL/JNGE Jz (f64) (!REX2) -8d: JNL/JGE Jz (f64) (!REX2) -8e: JLE/JNG Jz (f64) (!REX2) -8f: JNLE/JG Jz (f64) (!REX2) +80: JO Jz (f64),(!REX2) +81: JNO Jz (f64),(!REX2) +82: JB/JC/JNAE Jz (f64),(!REX2) +83: JAE/JNB/JNC Jz (f64),(!REX2) +84: JE/JZ Jz (f64),(!REX2) +85: JNE/JNZ Jz (f64),(!REX2) +86: JBE/JNA Jz (f64),(!REX2) +87: JA/JNBE Jz (f64),(!REX2) +88: JS Jz (f64),(!REX2) +89: JNS Jz (f64),(!REX2) +8a: JP/JPE Jz (f64),(!REX2) +8b: JNP/JPO Jz (f64),(!REX2) +8c: JL/JNGE Jz (f64),(!REX2) +8d: JNL/JGE Jz (f64),(!REX2) +8e: JLE/JNG Jz (f64),(!REX2) +8f: JNLE/JG Jz (f64),(!REX2) # 0x0f 0x90-0x9f 90: SETO Eb | kmovw/q Vk,Wk | kmovb/d Vk,Wk (66) 91: SETNO Eb | kmovw/q Mv,Vk | kmovb/d Mv,Vk (66) diff --git a/tools/arch/x86/lib/x86-opcode-map.txt b/tools/arch/x86/lib/x86-opcode-map.txt index f5dd84e..cd3fd51 100644 --- a/tools/arch/x86/lib/x86-opcode-map.txt +++ b/tools/arch/x86/lib/x86-opcode-map.txt @@ -35,7 +35,7 @@ # - (!F3) : the last prefix is not 0xF3 (including non-last prefix case) # - (66&F2): Both 0x66 and 0xF2 prefixes are specified. # -# REX2 Prefix +# REX2 Prefix Superscripts # - (!REX2): REX2 is not allowed # - (REX2): REX2 variant e.g. JMPABS @@ -286,10 +286,10 @@ df: ESC # Note: "forced64" is Intel CPU behavior: they ignore 0x66 prefix # in 64-bit mode. AMD CPUs accept 0x66 prefix, it causes RIP truncation # to 16 bits. In 32-bit mode, 0x66 is accepted by both Intel and AMD. -e0: LOOPNE/LOOPNZ Jb (f64) (!REX2) -e1: LOOPE/LOOPZ Jb (f64) (!REX2) -e2: LOOP Jb (f64) (!REX2) -e3: JrCXZ Jb (f64) (!REX2) +e0: LOOPNE/LOOPNZ Jb (f64),(!REX2) +e1: LOOPE/LOOPZ Jb (f64),(!REX2) +e2: LOOP Jb (f64),(!REX2) +e3: JrCXZ Jb (f64),(!REX2) e4: IN AL,Ib (!REX2) e5: IN eAX,Ib (!REX2) e6: OUT Ib,AL (!REX2) @@ -298,10 +298,10 @@ e7: OUT Ib,eAX (!REX2) # in "near" jumps and calls is 16-bit. For CALL, # push of return address is 16-bit wide, RSP is decremented by 2 # but is not truncated to 16 bits, unlike RIP. -e8: CALL Jz (f64) (!REX2) -e9: JMP-near Jz (f64) (!REX2) -ea: JMP-far Ap (i64) (!REX2) -eb: JMP-short Jb (f64) (!REX2) +e8: CALL Jz (f64),(!REX2) +e9: JMP-near Jz (f64),(!REX2) +ea: JMP-far Ap (i64),(!REX2) +eb: JMP-short Jb (f64),(!REX2) ec: IN AL,DX (!REX2) ed: IN eAX,DX (!REX2) ee: OUT DX,AL (!REX2) @@ -478,22 +478,22 @@ AVXcode: 1 7f: movq Qq,Pq | vmovdqa Wx,Vx (66) | vmovdqa32/64 Wx,Vx (66),(evo) | vmovdqu Wx,Vx (F3) | vmovdqu32/64 Wx,Vx (F3),(evo) | vmovdqu8/16 Wx,Vx (F2),(ev) # 0x0f 0x80-0x8f # Note: "forced64" is Intel CPU behavior (see comment about CALL insn). -80: JO Jz (f64) (!REX2) -81: JNO Jz (f64) (!REX2) -82: JB/JC/JNAE Jz (f64) (!REX2) -83: JAE/JNB/JNC Jz (f64) (!REX2) -84: JE/JZ Jz (f64) (!REX2) -85: JNE/JNZ Jz (f64) (!REX2) -86: JBE/JNA Jz (f64) (!REX2) -87: JA/JNBE Jz (f64) (!REX2) -88: JS Jz (f64) (!REX2) -89: JNS Jz (f64) (!REX2) -8a: JP/JPE Jz (f64) (!REX2) -8b: JNP/JPO Jz (f64) (!REX2) -8c: JL/JNGE Jz (f64) (!REX2) -8d: JNL/JGE Jz (f64) (!REX2) -8e: JLE/JNG Jz (f64) (!REX2) -8f: JNLE/JG Jz (f64) (!REX2) +80: JO Jz (f64),(!REX2) +81: JNO Jz (f64),(!REX2) +82: JB/JC/JNAE Jz (f64),(!REX2) +83: JAE/JNB/JNC Jz (f64),(!REX2) +84: JE/JZ Jz (f64),(!REX2) +85: JNE/JNZ Jz (f64),(!REX2) +86: JBE/JNA Jz (f64),(!REX2) +87: JA/JNBE Jz (f64),(!REX2) +88: JS Jz (f64),(!REX2) +89: JNS Jz (f64),(!REX2) +8a: JP/JPE Jz (f64),(!REX2) +8b: JNP/JPO Jz (f64),(!REX2) +8c: JL/JNGE Jz (f64),(!REX2) +8d: JNL/JGE Jz (f64),(!REX2) +8e: JLE/JNG Jz (f64),(!REX2) +8f: JNLE/JG Jz (f64),(!REX2) # 0x0f 0x90-0x9f 90: SETO Eb | kmovw/q Vk,Wk | kmovb/d Vk,Wk (66) 91: SETNO Eb | kmovw/q Mv,Vk | kmovb/d Mv,Vk (66) ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] x86: Stop decoding i64 instructions in x86-64 mode at opcode 2025-04-28 1:48 [PATCH 0/2] x86: Fix insn decoder to support 0xEA as UD Masami Hiramatsu (Google) 2025-04-28 1:48 ` [PATCH 1/2] x86: Fix opcode map (!REX2) superscript tags Masami Hiramatsu (Google) @ 2025-04-28 1:48 ` Masami Hiramatsu (Google) 2025-04-29 8:50 ` Peter Zijlstra 2025-05-06 10:35 ` [tip: x86/asm] x86/insn: " tip-bot2 for Masami Hiramatsu (Google) 1 sibling, 2 replies; 6+ messages in thread From: Masami Hiramatsu (Google) @ 2025-04-28 1:48 UTC (permalink / raw) To: Peter Zijlstra, Ingo Molnar Cc: Thomas Gleixner, Borislav Petkov, Dave Hansen, x86, H . Peter Anvin, linux-kernel, Adrian Hunter From: Masami Hiramatsu (Google) <mhiramat@kernel.org> In commit 2e044911be75 ("x86/traps: Decode 0xEA instructions as #UD") FineIBT starts using 0xEA as an invalid instruction like UD2. But insn decoder always returns the length of "0xea" instruction is 7 because it does not check (i64) superscript. The x86 instruction decoder should also decode 0xEA on x86-64 as one-byte invalid instruction by decoding "(i64)" superscript tag. This stops decoding instruction which has (i64) but not have (o64) superscript in 64bit mode at opcode and skip other fields. With this change, insn_decoder_test says 0xea is 1 byte length if x86-64 (-y option means 64bit). ----- > printf "0:\tea\t\n" | insn_decoder_test -y -v insn_decoder_test: success: Decoded and checked 1 instructions ----- Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> --- arch/x86/include/asm/inat.h | 6 ++++++ arch/x86/lib/insn.c | 7 ++++++- arch/x86/lib/x86-opcode-map.txt | 6 +++--- arch/x86/tools/gen-insn-attr-x86.awk | 7 +++++++ tools/arch/x86/include/asm/inat.h | 6 ++++++ tools/arch/x86/lib/insn.c | 7 ++++++- tools/arch/x86/lib/x86-opcode-map.txt | 6 +++--- tools/arch/x86/tools/gen-insn-attr-x86.awk | 7 +++++++ 8 files changed, 44 insertions(+), 8 deletions(-) diff --git a/arch/x86/include/asm/inat.h b/arch/x86/include/asm/inat.h index 53e4015242b4..97f341777db5 100644 --- a/arch/x86/include/asm/inat.h +++ b/arch/x86/include/asm/inat.h @@ -82,6 +82,7 @@ #define INAT_NO_REX2 (1 << (INAT_FLAG_OFFS + 8)) #define INAT_REX2_VARIANT (1 << (INAT_FLAG_OFFS + 9)) #define INAT_EVEX_SCALABLE (1 << (INAT_FLAG_OFFS + 10)) +#define INAT_INV64 (1 << (INAT_FLAG_OFFS + 11)) /* Attribute making macros for attribute tables */ #define INAT_MAKE_PREFIX(pfx) (pfx << INAT_PFX_OFFS) #define INAT_MAKE_ESCAPE(esc) (esc << INAT_ESC_OFFS) @@ -242,4 +243,9 @@ static inline int inat_evex_scalable(insn_attr_t attr) { return attr & INAT_EVEX_SCALABLE; } + +static inline int inat_is_invalid64(insn_attr_t attr) +{ + return attr & INAT_INV64; +} #endif diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c index 6ffb931b9fb1..149a57e334ab 100644 --- a/arch/x86/lib/insn.c +++ b/arch/x86/lib/insn.c @@ -324,6 +324,11 @@ int insn_get_opcode(struct insn *insn) } insn->attr = inat_get_opcode_attribute(op); + if (insn->x86_64 && inat_is_invalid64(insn->attr)) { + /* This instruction is invalid, like UD2. Stop decoding. */ + insn->attr &= INAT_INV64; + } + while (inat_is_escape(insn->attr)) { /* Get escaped opcode */ op = get_next(insn_byte_t, insn); @@ -337,6 +342,7 @@ int insn_get_opcode(struct insn *insn) insn->attr = 0; return -EINVAL; } + end: opcode->got = 1; return 0; @@ -658,7 +664,6 @@ int insn_get_immediate(struct insn *insn) } if (!inat_has_immediate(insn->attr)) - /* no immediates */ goto done; switch (inat_immediate_size(insn->attr)) { diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt index 5e2fa3f7128e..de0be0462190 100644 --- a/arch/x86/lib/x86-opcode-map.txt +++ b/arch/x86/lib/x86-opcode-map.txt @@ -147,7 +147,7 @@ AVXcode: # 0x60 - 0x6f 60: PUSHA/PUSHAD (i64) 61: POPA/POPAD (i64) -62: BOUND Gv,Ma (i64) | EVEX (Prefix) +62: BOUND Gv,Ma (i64) | EVEX (Prefix),(o64) 63: ARPL Ew,Gw (i64) | MOVSXD Gv,Ev (o64) 64: SEG=FS (Prefix) 65: SEG=GS (Prefix) @@ -253,8 +253,8 @@ c0: Grp2 Eb,Ib (1A) c1: Grp2 Ev,Ib (1A) c2: RETN Iw (f64) c3: RETN -c4: LES Gz,Mp (i64) | VEX+2byte (Prefix) -c5: LDS Gz,Mp (i64) | VEX+1byte (Prefix) +c4: LES Gz,Mp (i64) | VEX+2byte (Prefix),(o64) +c5: LDS Gz,Mp (i64) | VEX+1byte (Prefix),(o64) c6: Grp11A Eb,Ib (1A) c7: Grp11B Ev,Iz (1A) c8: ENTER Iw,Ib diff --git a/arch/x86/tools/gen-insn-attr-x86.awk b/arch/x86/tools/gen-insn-attr-x86.awk index 5770c8097f32..29e939893082 100644 --- a/arch/x86/tools/gen-insn-attr-x86.awk +++ b/arch/x86/tools/gen-insn-attr-x86.awk @@ -64,6 +64,8 @@ BEGIN { modrm_expr = "^([CDEGMNPQRSUVW/][a-z]+|NTA|T[012])" force64_expr = "\\([df]64\\)" + invalid64_expr = "\\(i64\\)" + only64_expr = "\\(o64\\)" rex_expr = "^((REX(\\.[XRWB]+)+)|(REX$))" rex2_expr = "\\(REX2\\)" no_rex2_expr = "\\(!REX2\\)" @@ -319,6 +321,11 @@ function convert_operands(count,opnd, i,j,imm,mod) if (match(ext, force64_expr)) flags = add_flags(flags, "INAT_FORCE64") + # check invalid in 64bit (and no only64) + if (match(ext, invalid64_expr) && + !match($0, only64_expr)) + flags = add_flags(flags, "INAT_INV64") + # check REX2 not allowed if (match(ext, no_rex2_expr)) flags = add_flags(flags, "INAT_NO_REX2") diff --git a/tools/arch/x86/include/asm/inat.h b/tools/arch/x86/include/asm/inat.h index 253690eb3c26..183aa662b165 100644 --- a/tools/arch/x86/include/asm/inat.h +++ b/tools/arch/x86/include/asm/inat.h @@ -82,6 +82,7 @@ #define INAT_NO_REX2 (1 << (INAT_FLAG_OFFS + 8)) #define INAT_REX2_VARIANT (1 << (INAT_FLAG_OFFS + 9)) #define INAT_EVEX_SCALABLE (1 << (INAT_FLAG_OFFS + 10)) +#define INAT_INV64 (1 << (INAT_FLAG_OFFS + 11)) /* Attribute making macros for attribute tables */ #define INAT_MAKE_PREFIX(pfx) (pfx << INAT_PFX_OFFS) #define INAT_MAKE_ESCAPE(esc) (esc << INAT_ESC_OFFS) @@ -242,4 +243,9 @@ static inline int inat_evex_scalable(insn_attr_t attr) { return attr & INAT_EVEX_SCALABLE; } + +static inline int inat_is_invalid64(insn_attr_t attr) +{ + return attr & INAT_INV64; +} #endif diff --git a/tools/arch/x86/lib/insn.c b/tools/arch/x86/lib/insn.c index e91d4c4e1c16..bce69c6bfa69 100644 --- a/tools/arch/x86/lib/insn.c +++ b/tools/arch/x86/lib/insn.c @@ -324,6 +324,11 @@ int insn_get_opcode(struct insn *insn) } insn->attr = inat_get_opcode_attribute(op); + if (insn->x86_64 && inat_is_invalid64(insn->attr)) { + /* This instruction is invalid, like UD2. Stop decoding. */ + insn->attr &= INAT_INV64; + } + while (inat_is_escape(insn->attr)) { /* Get escaped opcode */ op = get_next(insn_byte_t, insn); @@ -337,6 +342,7 @@ int insn_get_opcode(struct insn *insn) insn->attr = 0; return -EINVAL; } + end: opcode->got = 1; return 0; @@ -658,7 +664,6 @@ int insn_get_immediate(struct insn *insn) } if (!inat_has_immediate(insn->attr)) - /* no immediates */ goto done; switch (inat_immediate_size(insn->attr)) { diff --git a/tools/arch/x86/lib/x86-opcode-map.txt b/tools/arch/x86/lib/x86-opcode-map.txt index 5e2fa3f7128e..de0be0462190 100644 --- a/tools/arch/x86/lib/x86-opcode-map.txt +++ b/tools/arch/x86/lib/x86-opcode-map.txt @@ -147,7 +147,7 @@ AVXcode: # 0x60 - 0x6f 60: PUSHA/PUSHAD (i64) 61: POPA/POPAD (i64) -62: BOUND Gv,Ma (i64) | EVEX (Prefix) +62: BOUND Gv,Ma (i64) | EVEX (Prefix),(o64) 63: ARPL Ew,Gw (i64) | MOVSXD Gv,Ev (o64) 64: SEG=FS (Prefix) 65: SEG=GS (Prefix) @@ -253,8 +253,8 @@ c0: Grp2 Eb,Ib (1A) c1: Grp2 Ev,Ib (1A) c2: RETN Iw (f64) c3: RETN -c4: LES Gz,Mp (i64) | VEX+2byte (Prefix) -c5: LDS Gz,Mp (i64) | VEX+1byte (Prefix) +c4: LES Gz,Mp (i64) | VEX+2byte (Prefix),(o64) +c5: LDS Gz,Mp (i64) | VEX+1byte (Prefix),(o64) c6: Grp11A Eb,Ib (1A) c7: Grp11B Ev,Iz (1A) c8: ENTER Iw,Ib diff --git a/tools/arch/x86/tools/gen-insn-attr-x86.awk b/tools/arch/x86/tools/gen-insn-attr-x86.awk index 5770c8097f32..29e939893082 100644 --- a/tools/arch/x86/tools/gen-insn-attr-x86.awk +++ b/tools/arch/x86/tools/gen-insn-attr-x86.awk @@ -64,6 +64,8 @@ BEGIN { modrm_expr = "^([CDEGMNPQRSUVW/][a-z]+|NTA|T[012])" force64_expr = "\\([df]64\\)" + invalid64_expr = "\\(i64\\)" + only64_expr = "\\(o64\\)" rex_expr = "^((REX(\\.[XRWB]+)+)|(REX$))" rex2_expr = "\\(REX2\\)" no_rex2_expr = "\\(!REX2\\)" @@ -319,6 +321,11 @@ function convert_operands(count,opnd, i,j,imm,mod) if (match(ext, force64_expr)) flags = add_flags(flags, "INAT_FORCE64") + # check invalid in 64bit (and no only64) + if (match(ext, invalid64_expr) && + !match($0, only64_expr)) + flags = add_flags(flags, "INAT_INV64") + # check REX2 not allowed if (match(ext, no_rex2_expr)) flags = add_flags(flags, "INAT_NO_REX2") ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] x86: Stop decoding i64 instructions in x86-64 mode at opcode 2025-04-28 1:48 ` [PATCH 2/2] x86: Stop decoding i64 instructions in x86-64 mode at opcode Masami Hiramatsu (Google) @ 2025-04-29 8:50 ` Peter Zijlstra 2025-05-06 10:35 ` [tip: x86/asm] x86/insn: " tip-bot2 for Masami Hiramatsu (Google) 1 sibling, 0 replies; 6+ messages in thread From: Peter Zijlstra @ 2025-04-29 8:50 UTC (permalink / raw) To: Masami Hiramatsu (Google) Cc: Ingo Molnar, Thomas Gleixner, Borislav Petkov, Dave Hansen, x86, H . Peter Anvin, linux-kernel, Adrian Hunter On Mon, Apr 28, 2025 at 10:48:20AM +0900, Masami Hiramatsu (Google) wrote: > From: Masami Hiramatsu (Google) <mhiramat@kernel.org> > > In commit 2e044911be75 ("x86/traps: Decode 0xEA instructions as #UD") > FineIBT starts using 0xEA as an invalid instruction like UD2. But > insn decoder always returns the length of "0xea" instruction is 7 > because it does not check (i64) superscript. > The x86 instruction decoder should also decode 0xEA on x86-64 as > one-byte invalid instruction by decoding "(i64)" superscript tag. > > This stops decoding instruction which has (i64) but not have (o64) > superscript in 64bit mode at opcode and skip other fields. > > With this change, insn_decoder_test says 0xea is 1 byte length if > x86-64 (-y option means 64bit). > ----- > > printf "0:\tea\t\n" | insn_decoder_test -y -v > insn_decoder_test: success: Decoded and checked 1 instructions > ----- Notably matching objdump's decode behaviour in this case. Thanks! Reported-by: Peter Zijlstra (Intel) <peterz@infradead.org> Tested-by: Peter Zijlstra (Intel) <peterz@infradead.org> > > Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> > --- > arch/x86/include/asm/inat.h | 6 ++++++ > arch/x86/lib/insn.c | 7 ++++++- > arch/x86/lib/x86-opcode-map.txt | 6 +++--- > arch/x86/tools/gen-insn-attr-x86.awk | 7 +++++++ > tools/arch/x86/include/asm/inat.h | 6 ++++++ > tools/arch/x86/lib/insn.c | 7 ++++++- > tools/arch/x86/lib/x86-opcode-map.txt | 6 +++--- > tools/arch/x86/tools/gen-insn-attr-x86.awk | 7 +++++++ > 8 files changed, 44 insertions(+), 8 deletions(-) > > diff --git a/arch/x86/include/asm/inat.h b/arch/x86/include/asm/inat.h > index 53e4015242b4..97f341777db5 100644 > --- a/arch/x86/include/asm/inat.h > +++ b/arch/x86/include/asm/inat.h > @@ -82,6 +82,7 @@ > #define INAT_NO_REX2 (1 << (INAT_FLAG_OFFS + 8)) > #define INAT_REX2_VARIANT (1 << (INAT_FLAG_OFFS + 9)) > #define INAT_EVEX_SCALABLE (1 << (INAT_FLAG_OFFS + 10)) > +#define INAT_INV64 (1 << (INAT_FLAG_OFFS + 11)) > /* Attribute making macros for attribute tables */ > #define INAT_MAKE_PREFIX(pfx) (pfx << INAT_PFX_OFFS) > #define INAT_MAKE_ESCAPE(esc) (esc << INAT_ESC_OFFS) > @@ -242,4 +243,9 @@ static inline int inat_evex_scalable(insn_attr_t attr) > { > return attr & INAT_EVEX_SCALABLE; > } > + > +static inline int inat_is_invalid64(insn_attr_t attr) > +{ > + return attr & INAT_INV64; > +} > #endif > diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c > index 6ffb931b9fb1..149a57e334ab 100644 > --- a/arch/x86/lib/insn.c > +++ b/arch/x86/lib/insn.c > @@ -324,6 +324,11 @@ int insn_get_opcode(struct insn *insn) > } > > insn->attr = inat_get_opcode_attribute(op); > + if (insn->x86_64 && inat_is_invalid64(insn->attr)) { > + /* This instruction is invalid, like UD2. Stop decoding. */ > + insn->attr &= INAT_INV64; > + } > + > while (inat_is_escape(insn->attr)) { > /* Get escaped opcode */ > op = get_next(insn_byte_t, insn); > @@ -337,6 +342,7 @@ int insn_get_opcode(struct insn *insn) > insn->attr = 0; > return -EINVAL; > } > + > end: > opcode->got = 1; > return 0; > @@ -658,7 +664,6 @@ int insn_get_immediate(struct insn *insn) > } > > if (!inat_has_immediate(insn->attr)) > - /* no immediates */ > goto done; > > switch (inat_immediate_size(insn->attr)) { > diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt > index 5e2fa3f7128e..de0be0462190 100644 > --- a/arch/x86/lib/x86-opcode-map.txt > +++ b/arch/x86/lib/x86-opcode-map.txt > @@ -147,7 +147,7 @@ AVXcode: > # 0x60 - 0x6f > 60: PUSHA/PUSHAD (i64) > 61: POPA/POPAD (i64) > -62: BOUND Gv,Ma (i64) | EVEX (Prefix) > +62: BOUND Gv,Ma (i64) | EVEX (Prefix),(o64) > 63: ARPL Ew,Gw (i64) | MOVSXD Gv,Ev (o64) > 64: SEG=FS (Prefix) > 65: SEG=GS (Prefix) > @@ -253,8 +253,8 @@ c0: Grp2 Eb,Ib (1A) > c1: Grp2 Ev,Ib (1A) > c2: RETN Iw (f64) > c3: RETN > -c4: LES Gz,Mp (i64) | VEX+2byte (Prefix) > -c5: LDS Gz,Mp (i64) | VEX+1byte (Prefix) > +c4: LES Gz,Mp (i64) | VEX+2byte (Prefix),(o64) > +c5: LDS Gz,Mp (i64) | VEX+1byte (Prefix),(o64) > c6: Grp11A Eb,Ib (1A) > c7: Grp11B Ev,Iz (1A) > c8: ENTER Iw,Ib > diff --git a/arch/x86/tools/gen-insn-attr-x86.awk b/arch/x86/tools/gen-insn-attr-x86.awk > index 5770c8097f32..29e939893082 100644 > --- a/arch/x86/tools/gen-insn-attr-x86.awk > +++ b/arch/x86/tools/gen-insn-attr-x86.awk > @@ -64,6 +64,8 @@ BEGIN { > > modrm_expr = "^([CDEGMNPQRSUVW/][a-z]+|NTA|T[012])" > force64_expr = "\\([df]64\\)" > + invalid64_expr = "\\(i64\\)" > + only64_expr = "\\(o64\\)" > rex_expr = "^((REX(\\.[XRWB]+)+)|(REX$))" > rex2_expr = "\\(REX2\\)" > no_rex2_expr = "\\(!REX2\\)" > @@ -319,6 +321,11 @@ function convert_operands(count,opnd, i,j,imm,mod) > if (match(ext, force64_expr)) > flags = add_flags(flags, "INAT_FORCE64") > > + # check invalid in 64bit (and no only64) > + if (match(ext, invalid64_expr) && > + !match($0, only64_expr)) > + flags = add_flags(flags, "INAT_INV64") > + > # check REX2 not allowed > if (match(ext, no_rex2_expr)) > flags = add_flags(flags, "INAT_NO_REX2") > diff --git a/tools/arch/x86/include/asm/inat.h b/tools/arch/x86/include/asm/inat.h > index 253690eb3c26..183aa662b165 100644 > --- a/tools/arch/x86/include/asm/inat.h > +++ b/tools/arch/x86/include/asm/inat.h > @@ -82,6 +82,7 @@ > #define INAT_NO_REX2 (1 << (INAT_FLAG_OFFS + 8)) > #define INAT_REX2_VARIANT (1 << (INAT_FLAG_OFFS + 9)) > #define INAT_EVEX_SCALABLE (1 << (INAT_FLAG_OFFS + 10)) > +#define INAT_INV64 (1 << (INAT_FLAG_OFFS + 11)) > /* Attribute making macros for attribute tables */ > #define INAT_MAKE_PREFIX(pfx) (pfx << INAT_PFX_OFFS) > #define INAT_MAKE_ESCAPE(esc) (esc << INAT_ESC_OFFS) > @@ -242,4 +243,9 @@ static inline int inat_evex_scalable(insn_attr_t attr) > { > return attr & INAT_EVEX_SCALABLE; > } > + > +static inline int inat_is_invalid64(insn_attr_t attr) > +{ > + return attr & INAT_INV64; > +} > #endif > diff --git a/tools/arch/x86/lib/insn.c b/tools/arch/x86/lib/insn.c > index e91d4c4e1c16..bce69c6bfa69 100644 > --- a/tools/arch/x86/lib/insn.c > +++ b/tools/arch/x86/lib/insn.c > @@ -324,6 +324,11 @@ int insn_get_opcode(struct insn *insn) > } > > insn->attr = inat_get_opcode_attribute(op); > + if (insn->x86_64 && inat_is_invalid64(insn->attr)) { > + /* This instruction is invalid, like UD2. Stop decoding. */ > + insn->attr &= INAT_INV64; > + } > + > while (inat_is_escape(insn->attr)) { > /* Get escaped opcode */ > op = get_next(insn_byte_t, insn); > @@ -337,6 +342,7 @@ int insn_get_opcode(struct insn *insn) > insn->attr = 0; > return -EINVAL; > } > + > end: > opcode->got = 1; > return 0; > @@ -658,7 +664,6 @@ int insn_get_immediate(struct insn *insn) > } > > if (!inat_has_immediate(insn->attr)) > - /* no immediates */ > goto done; > > switch (inat_immediate_size(insn->attr)) { > diff --git a/tools/arch/x86/lib/x86-opcode-map.txt b/tools/arch/x86/lib/x86-opcode-map.txt > index 5e2fa3f7128e..de0be0462190 100644 > --- a/tools/arch/x86/lib/x86-opcode-map.txt > +++ b/tools/arch/x86/lib/x86-opcode-map.txt > @@ -147,7 +147,7 @@ AVXcode: > # 0x60 - 0x6f > 60: PUSHA/PUSHAD (i64) > 61: POPA/POPAD (i64) > -62: BOUND Gv,Ma (i64) | EVEX (Prefix) > +62: BOUND Gv,Ma (i64) | EVEX (Prefix),(o64) > 63: ARPL Ew,Gw (i64) | MOVSXD Gv,Ev (o64) > 64: SEG=FS (Prefix) > 65: SEG=GS (Prefix) > @@ -253,8 +253,8 @@ c0: Grp2 Eb,Ib (1A) > c1: Grp2 Ev,Ib (1A) > c2: RETN Iw (f64) > c3: RETN > -c4: LES Gz,Mp (i64) | VEX+2byte (Prefix) > -c5: LDS Gz,Mp (i64) | VEX+1byte (Prefix) > +c4: LES Gz,Mp (i64) | VEX+2byte (Prefix),(o64) > +c5: LDS Gz,Mp (i64) | VEX+1byte (Prefix),(o64) > c6: Grp11A Eb,Ib (1A) > c7: Grp11B Ev,Iz (1A) > c8: ENTER Iw,Ib > diff --git a/tools/arch/x86/tools/gen-insn-attr-x86.awk b/tools/arch/x86/tools/gen-insn-attr-x86.awk > index 5770c8097f32..29e939893082 100644 > --- a/tools/arch/x86/tools/gen-insn-attr-x86.awk > +++ b/tools/arch/x86/tools/gen-insn-attr-x86.awk > @@ -64,6 +64,8 @@ BEGIN { > > modrm_expr = "^([CDEGMNPQRSUVW/][a-z]+|NTA|T[012])" > force64_expr = "\\([df]64\\)" > + invalid64_expr = "\\(i64\\)" > + only64_expr = "\\(o64\\)" > rex_expr = "^((REX(\\.[XRWB]+)+)|(REX$))" > rex2_expr = "\\(REX2\\)" > no_rex2_expr = "\\(!REX2\\)" > @@ -319,6 +321,11 @@ function convert_operands(count,opnd, i,j,imm,mod) > if (match(ext, force64_expr)) > flags = add_flags(flags, "INAT_FORCE64") > > + # check invalid in 64bit (and no only64) > + if (match(ext, invalid64_expr) && > + !match($0, only64_expr)) > + flags = add_flags(flags, "INAT_INV64") > + > # check REX2 not allowed > if (match(ext, no_rex2_expr)) > flags = add_flags(flags, "INAT_NO_REX2") > ^ permalink raw reply [flat|nested] 6+ messages in thread
* [tip: x86/asm] x86/insn: Stop decoding i64 instructions in x86-64 mode at opcode 2025-04-28 1:48 ` [PATCH 2/2] x86: Stop decoding i64 instructions in x86-64 mode at opcode Masami Hiramatsu (Google) 2025-04-29 8:50 ` Peter Zijlstra @ 2025-05-06 10:35 ` tip-bot2 for Masami Hiramatsu (Google) 1 sibling, 0 replies; 6+ messages in thread From: tip-bot2 for Masami Hiramatsu (Google) @ 2025-05-06 10:35 UTC (permalink / raw) To: linux-tip-commits Cc: Masami Hiramatsu (Google), Ingo Molnar, Adrian Hunter, H. Peter Anvin, Peter Zijlstra, x86, linux-kernel The following commit has been merged into the x86/asm branch of tip: Commit-ID: 4b626015e1bf119cd31d7e62f9bd9eb1412fce7b Gitweb: https://git.kernel.org/tip/4b626015e1bf119cd31d7e62f9bd9eb1412fce7b Author: Masami Hiramatsu (Google) <mhiramat@kernel.org> AuthorDate: Mon, 28 Apr 2025 10:48:20 +09:00 Committer: Ingo Molnar <mingo@kernel.org> CommitterDate: Tue, 06 May 2025 12:03:16 +02:00 x86/insn: Stop decoding i64 instructions in x86-64 mode at opcode In commit 2e044911be75 ("x86/traps: Decode 0xEA instructions as #UD") FineIBT starts using 0xEA as an invalid instruction like UD2. But insn decoder always returns the length of "0xea" instruction as 7 because it does not check the (i64) superscript. The x86 instruction decoder should also decode 0xEA on x86-64 as a one-byte invalid instruction by decoding the "(i64)" superscript tag. This stops decoding instruction which has (i64) but does not have (o64) superscript in 64-bit mode at opcode and skips other fields. With this change, insn_decoder_test says 0xea is 1 byte length if x86-64 (-y option means 64-bit): $ printf "0:\tea\t\n" | insn_decoder_test -y -v insn_decoder_test: success: Decoded and checked 1 instructions Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Peter Zijlstra <peterz@infradead.org> Link: https://lore.kernel.org/r/174580490000.388420.5225447607417115496.stgit@devnote2 --- arch/x86/include/asm/inat.h | 6 ++++++ arch/x86/lib/insn.c | 7 ++++++- arch/x86/lib/x86-opcode-map.txt | 6 +++--- arch/x86/tools/gen-insn-attr-x86.awk | 7 +++++++ tools/arch/x86/include/asm/inat.h | 6 ++++++ tools/arch/x86/lib/insn.c | 7 ++++++- tools/arch/x86/lib/x86-opcode-map.txt | 6 +++--- tools/arch/x86/tools/gen-insn-attr-x86.awk | 7 +++++++ 8 files changed, 44 insertions(+), 8 deletions(-) diff --git a/arch/x86/include/asm/inat.h b/arch/x86/include/asm/inat.h index 53e4015..97f3417 100644 --- a/arch/x86/include/asm/inat.h +++ b/arch/x86/include/asm/inat.h @@ -82,6 +82,7 @@ #define INAT_NO_REX2 (1 << (INAT_FLAG_OFFS + 8)) #define INAT_REX2_VARIANT (1 << (INAT_FLAG_OFFS + 9)) #define INAT_EVEX_SCALABLE (1 << (INAT_FLAG_OFFS + 10)) +#define INAT_INV64 (1 << (INAT_FLAG_OFFS + 11)) /* Attribute making macros for attribute tables */ #define INAT_MAKE_PREFIX(pfx) (pfx << INAT_PFX_OFFS) #define INAT_MAKE_ESCAPE(esc) (esc << INAT_ESC_OFFS) @@ -242,4 +243,9 @@ static inline int inat_evex_scalable(insn_attr_t attr) { return attr & INAT_EVEX_SCALABLE; } + +static inline int inat_is_invalid64(insn_attr_t attr) +{ + return attr & INAT_INV64; +} #endif diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c index 6ffb931..149a57e 100644 --- a/arch/x86/lib/insn.c +++ b/arch/x86/lib/insn.c @@ -324,6 +324,11 @@ int insn_get_opcode(struct insn *insn) } insn->attr = inat_get_opcode_attribute(op); + if (insn->x86_64 && inat_is_invalid64(insn->attr)) { + /* This instruction is invalid, like UD2. Stop decoding. */ + insn->attr &= INAT_INV64; + } + while (inat_is_escape(insn->attr)) { /* Get escaped opcode */ op = get_next(insn_byte_t, insn); @@ -337,6 +342,7 @@ int insn_get_opcode(struct insn *insn) insn->attr = 0; return -EINVAL; } + end: opcode->got = 1; return 0; @@ -658,7 +664,6 @@ int insn_get_immediate(struct insn *insn) } if (!inat_has_immediate(insn->attr)) - /* no immediates */ goto done; switch (inat_immediate_size(insn->attr)) { diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt index cd3fd51..262f7ca 100644 --- a/arch/x86/lib/x86-opcode-map.txt +++ b/arch/x86/lib/x86-opcode-map.txt @@ -147,7 +147,7 @@ AVXcode: # 0x60 - 0x6f 60: PUSHA/PUSHAD (i64) 61: POPA/POPAD (i64) -62: BOUND Gv,Ma (i64) | EVEX (Prefix) +62: BOUND Gv,Ma (i64) | EVEX (Prefix),(o64) 63: ARPL Ew,Gw (i64) | MOVSXD Gv,Ev (o64) 64: SEG=FS (Prefix) 65: SEG=GS (Prefix) @@ -253,8 +253,8 @@ c0: Grp2 Eb,Ib (1A) c1: Grp2 Ev,Ib (1A) c2: RETN Iw (f64) c3: RETN -c4: LES Gz,Mp (i64) | VEX+2byte (Prefix) -c5: LDS Gz,Mp (i64) | VEX+1byte (Prefix) +c4: LES Gz,Mp (i64) | VEX+2byte (Prefix),(o64) +c5: LDS Gz,Mp (i64) | VEX+1byte (Prefix),(o64) c6: Grp11A Eb,Ib (1A) c7: Grp11B Ev,Iz (1A) c8: ENTER Iw,Ib diff --git a/arch/x86/tools/gen-insn-attr-x86.awk b/arch/x86/tools/gen-insn-attr-x86.awk index 5770c80..2c19d7f 100644 --- a/arch/x86/tools/gen-insn-attr-x86.awk +++ b/arch/x86/tools/gen-insn-attr-x86.awk @@ -64,6 +64,8 @@ BEGIN { modrm_expr = "^([CDEGMNPQRSUVW/][a-z]+|NTA|T[012])" force64_expr = "\\([df]64\\)" + invalid64_expr = "\\(i64\\)" + only64_expr = "\\(o64\\)" rex_expr = "^((REX(\\.[XRWB]+)+)|(REX$))" rex2_expr = "\\(REX2\\)" no_rex2_expr = "\\(!REX2\\)" @@ -319,6 +321,11 @@ function convert_operands(count,opnd, i,j,imm,mod) if (match(ext, force64_expr)) flags = add_flags(flags, "INAT_FORCE64") + # check invalid in 64-bit (and no only64) + if (match(ext, invalid64_expr) && + !match($0, only64_expr)) + flags = add_flags(flags, "INAT_INV64") + # check REX2 not allowed if (match(ext, no_rex2_expr)) flags = add_flags(flags, "INAT_NO_REX2") diff --git a/tools/arch/x86/include/asm/inat.h b/tools/arch/x86/include/asm/inat.h index 253690e..183aa66 100644 --- a/tools/arch/x86/include/asm/inat.h +++ b/tools/arch/x86/include/asm/inat.h @@ -82,6 +82,7 @@ #define INAT_NO_REX2 (1 << (INAT_FLAG_OFFS + 8)) #define INAT_REX2_VARIANT (1 << (INAT_FLAG_OFFS + 9)) #define INAT_EVEX_SCALABLE (1 << (INAT_FLAG_OFFS + 10)) +#define INAT_INV64 (1 << (INAT_FLAG_OFFS + 11)) /* Attribute making macros for attribute tables */ #define INAT_MAKE_PREFIX(pfx) (pfx << INAT_PFX_OFFS) #define INAT_MAKE_ESCAPE(esc) (esc << INAT_ESC_OFFS) @@ -242,4 +243,9 @@ static inline int inat_evex_scalable(insn_attr_t attr) { return attr & INAT_EVEX_SCALABLE; } + +static inline int inat_is_invalid64(insn_attr_t attr) +{ + return attr & INAT_INV64; +} #endif diff --git a/tools/arch/x86/lib/insn.c b/tools/arch/x86/lib/insn.c index e91d4c4..bce69c6 100644 --- a/tools/arch/x86/lib/insn.c +++ b/tools/arch/x86/lib/insn.c @@ -324,6 +324,11 @@ int insn_get_opcode(struct insn *insn) } insn->attr = inat_get_opcode_attribute(op); + if (insn->x86_64 && inat_is_invalid64(insn->attr)) { + /* This instruction is invalid, like UD2. Stop decoding. */ + insn->attr &= INAT_INV64; + } + while (inat_is_escape(insn->attr)) { /* Get escaped opcode */ op = get_next(insn_byte_t, insn); @@ -337,6 +342,7 @@ int insn_get_opcode(struct insn *insn) insn->attr = 0; return -EINVAL; } + end: opcode->got = 1; return 0; @@ -658,7 +664,6 @@ int insn_get_immediate(struct insn *insn) } if (!inat_has_immediate(insn->attr)) - /* no immediates */ goto done; switch (inat_immediate_size(insn->attr)) { diff --git a/tools/arch/x86/lib/x86-opcode-map.txt b/tools/arch/x86/lib/x86-opcode-map.txt index cd3fd51..262f7ca 100644 --- a/tools/arch/x86/lib/x86-opcode-map.txt +++ b/tools/arch/x86/lib/x86-opcode-map.txt @@ -147,7 +147,7 @@ AVXcode: # 0x60 - 0x6f 60: PUSHA/PUSHAD (i64) 61: POPA/POPAD (i64) -62: BOUND Gv,Ma (i64) | EVEX (Prefix) +62: BOUND Gv,Ma (i64) | EVEX (Prefix),(o64) 63: ARPL Ew,Gw (i64) | MOVSXD Gv,Ev (o64) 64: SEG=FS (Prefix) 65: SEG=GS (Prefix) @@ -253,8 +253,8 @@ c0: Grp2 Eb,Ib (1A) c1: Grp2 Ev,Ib (1A) c2: RETN Iw (f64) c3: RETN -c4: LES Gz,Mp (i64) | VEX+2byte (Prefix) -c5: LDS Gz,Mp (i64) | VEX+1byte (Prefix) +c4: LES Gz,Mp (i64) | VEX+2byte (Prefix),(o64) +c5: LDS Gz,Mp (i64) | VEX+1byte (Prefix),(o64) c6: Grp11A Eb,Ib (1A) c7: Grp11B Ev,Iz (1A) c8: ENTER Iw,Ib diff --git a/tools/arch/x86/tools/gen-insn-attr-x86.awk b/tools/arch/x86/tools/gen-insn-attr-x86.awk index 5770c80..2c19d7f 100644 --- a/tools/arch/x86/tools/gen-insn-attr-x86.awk +++ b/tools/arch/x86/tools/gen-insn-attr-x86.awk @@ -64,6 +64,8 @@ BEGIN { modrm_expr = "^([CDEGMNPQRSUVW/][a-z]+|NTA|T[012])" force64_expr = "\\([df]64\\)" + invalid64_expr = "\\(i64\\)" + only64_expr = "\\(o64\\)" rex_expr = "^((REX(\\.[XRWB]+)+)|(REX$))" rex2_expr = "\\(REX2\\)" no_rex2_expr = "\\(!REX2\\)" @@ -319,6 +321,11 @@ function convert_operands(count,opnd, i,j,imm,mod) if (match(ext, force64_expr)) flags = add_flags(flags, "INAT_FORCE64") + # check invalid in 64-bit (and no only64) + if (match(ext, invalid64_expr) && + !match($0, only64_expr)) + flags = add_flags(flags, "INAT_INV64") + # check REX2 not allowed if (match(ext, no_rex2_expr)) flags = add_flags(flags, "INAT_NO_REX2") ^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-05-06 10:35 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-04-28 1:48 [PATCH 0/2] x86: Fix insn decoder to support 0xEA as UD Masami Hiramatsu (Google) 2025-04-28 1:48 ` [PATCH 1/2] x86: Fix opcode map (!REX2) superscript tags Masami Hiramatsu (Google) 2025-05-06 10:35 ` [tip: x86/asm] x86/insn: " tip-bot2 for Masami Hiramatsu (Google) 2025-04-28 1:48 ` [PATCH 2/2] x86: Stop decoding i64 instructions in x86-64 mode at opcode Masami Hiramatsu (Google) 2025-04-29 8:50 ` Peter Zijlstra 2025-05-06 10:35 ` [tip: x86/asm] x86/insn: " tip-bot2 for Masami Hiramatsu (Google)
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.