[linux.git] / arch / x86 / tools / insn_sanity.c

/*
 * x86 decoder sanity test - based on test_get_insn.c
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 *
 * Copyright (C) IBM Corporation, 2009
 * Copyright (C) Hitachi, Ltd., 2011
 */

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <assert.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define unlikely(cond) (cond)
#define ARRAY_SIZE(a)	(sizeof(a)/sizeof(a[0]))

#include <asm/insn.h>
#include <inat.c>
#include <insn.c>

/*
 * Test of instruction analysis against tampering.
 * Feed random binary to instruction decoder and ensure not to
 * access out-of-instruction-buffer.
 */

#define DEFAULT_MAX_ITER	10000
#define INSN_NOP 0x90

static const char	*prog;		/* Program name */
static int		verbose;	/* Verbosity */
static int		x86_64;		/* x86-64 bit mode flag */
static unsigned int	seed;		/* Random seed */
static unsigned long	iter_start;	/* Start of iteration number */
static unsigned long	iter_end = DEFAULT_MAX_ITER;	/* End of iteration number */
static FILE		*input_file;	/* Input file name */

static void usage(const char *err)
{
	if (err)
		fprintf(stderr, "Error: %s\n\n", err);
	fprintf(stderr, "Usage: %s [-y|-n|-v] [-s seed[,no]] [-m max] [-i input]\n", prog);
	fprintf(stderr, "\t-y	64bit mode\n");
	fprintf(stderr, "\t-n	32bit mode\n");
	fprintf(stderr, "\t-v	Verbosity(-vv dumps any decoded result)\n");
	fprintf(stderr, "\t-s	Give a random seed (and iteration number)\n");
	fprintf(stderr, "\t-m	Give a maximum iteration number\n");
	fprintf(stderr, "\t-i	Give an input file with decoded binary\n");
	exit(1);
}

static void dump_field(FILE *fp, const char *name, const char *indent,
		       struct insn_field *field)
{
	fprintf(fp, "%s.%s = {\n", indent, name);
	fprintf(fp, "%s\t.value = %d, bytes[] = {%x, %x, %x, %x},\n",
		indent, field->value, field->bytes[0], field->bytes[1],
		field->bytes[2], field->bytes[3]);
	fprintf(fp, "%s\t.got = %d, .nbytes = %d},\n", indent,
		field->got, field->nbytes);
}

static void dump_insn(FILE *fp, struct insn *insn)
{
	fprintf(fp, "Instruction = {\n");
	dump_field(fp, "prefixes", "\t",	&insn->prefixes);
	dump_field(fp, "rex_prefix", "\t",	&insn->rex_prefix);
	dump_field(fp, "vex_prefix", "\t",	&insn->vex_prefix);
	dump_field(fp, "opcode", "\t",		&insn->opcode);
	dump_field(fp, "modrm", "\t",		&insn->modrm);
	dump_field(fp, "sib", "\t",		&insn->sib);
	dump_field(fp, "displacement", "\t",	&insn->displacement);
	dump_field(fp, "immediate1", "\t",	&insn->immediate1);
	dump_field(fp, "immediate2", "\t",	&insn->immediate2);
	fprintf(fp, "\t.attr = %x, .opnd_bytes = %d, .addr_bytes = %d,\n",
		insn->attr, insn->opnd_bytes, insn->addr_bytes);
	fprintf(fp, "\t.length = %d, .x86_64 = %d, .kaddr = %p}\n",
		insn->length, insn->x86_64, insn->kaddr);
}

static void dump_stream(FILE *fp, const char *msg, unsigned long nr_iter,
			unsigned char *insn_buf, struct insn *insn)
{
	int i;

	fprintf(fp, "%s:\n", msg);

	dump_insn(fp, insn);

	fprintf(fp, "You can reproduce this with below command(s);\n");

	/* Input a decoded instruction sequence directly */
	fprintf(fp, " $ echo ");
	for (i = 0; i < MAX_INSN_SIZE; i++)
		fprintf(fp, " %02x", insn_buf[i]);
	fprintf(fp, " | %s -i -\n", prog);

	if (!input_file) {
		fprintf(fp, "Or \n");
		/* Give a seed and iteration number */
		fprintf(fp, " $ %s -s 0x%x,%lu\n", prog, seed, nr_iter);
	}
}

static void init_random_seed(void)
{
	int fd;

	fd = open("/dev/urandom", O_RDONLY);
	if (fd < 0)
		goto fail;

	if (read(fd, &seed, sizeof(seed)) != sizeof(seed))
		goto fail;

	close(fd);
	return;
fail:
	usage("Failed to open /dev/urandom");
}

/* Read given instruction sequence from the input file */
static int read_next_insn(unsigned char *insn_buf)
{
	char buf[256]  = "", *tmp;
	int i;

	tmp = fgets(buf, ARRAY_SIZE(buf), input_file);
	if (tmp == NULL || feof(input_file))
		return 0;

	for (i = 0; i < MAX_INSN_SIZE; i++) {
		insn_buf[i] = (unsigned char)strtoul(tmp, &tmp, 16);
		if (*tmp != ' ')
			break;
	}

	return i;
}

static int generate_insn(unsigned char *insn_buf)
{
	int i;

	if (input_file)
		return read_next_insn(insn_buf);

	/* Fills buffer with random binary up to MAX_INSN_SIZE */
	for (i = 0; i < MAX_INSN_SIZE - 1; i += 2)
		*(unsigned short *)(&insn_buf[i]) = random() & 0xffff;

	while (i < MAX_INSN_SIZE)
		insn_buf[i++] = random() & 0xff;

	return i;
}

static void parse_args(int argc, char **argv)
{
	int c;
	char *tmp = NULL;
	int set_seed = 0;

	prog = argv[0];
	while ((c = getopt(argc, argv, "ynvs:m:i:")) != -1) {
		switch (c) {
		case 'y':
			x86_64 = 1;
			break;
		case 'n':
			x86_64 = 0;
			break;
		case 'v':
			verbose++;
			break;
		case 'i':
			if (strcmp("-", optarg) == 0)
				input_file = stdin;
			else
				input_file = fopen(optarg, "r");
			if (!input_file)
				usage("Failed to open input file");
			break;
		case 's':
			seed = (unsigned int)strtoul(optarg, &tmp, 0);
			if (*tmp == ',') {
				optarg = tmp + 1;
				iter_start = strtoul(optarg, &tmp, 0);
			}
			if (*tmp != '\0' || tmp == optarg)
				usage("Failed to parse seed");
			set_seed = 1;
			break;
		case 'm':
			iter_end = strtoul(optarg, &tmp, 0);
			if (*tmp != '\0' || tmp == optarg)
				usage("Failed to parse max_iter");
			break;
		default:
			usage(NULL);
		}
	}

	/* Check errors */
	if (iter_end < iter_start)
		usage("Max iteration number must be bigger than iter-num");

	if (set_seed && input_file)
		usage("Don't use input file (-i) with random seed (-s)");

	/* Initialize random seed */
	if (!input_file) {
		if (!set_seed)	/* No seed is given */
			init_random_seed();
		srand(seed);
	}
}

int main(int argc, char **argv)
{
	struct insn insn;
	int insns = 0;
	int errors = 0;
	unsigned long i;
	unsigned char insn_buf[MAX_INSN_SIZE * 2];

	parse_args(argc, argv);

	/* Prepare stop bytes with NOPs */
	memset(insn_buf + MAX_INSN_SIZE, INSN_NOP, MAX_INSN_SIZE);

	for (i = 0; i < iter_end; i++) {
		if (generate_insn(insn_buf) <= 0)
			break;

		if (i < iter_start)	/* Skip to given iteration number */
			continue;

		/* Decode an instruction */
		insn_init(&insn, insn_buf, x86_64);
		insn_get_length(&insn);

		if (insn.next_byte <= insn.kaddr ||
		    insn.kaddr + MAX_INSN_SIZE < insn.next_byte) {
			/* Access out-of-range memory */
			dump_stream(stderr, "Error: Found an access violation", i, insn_buf, &insn);
			errors++;
		} else if (verbose && !insn_complete(&insn))
			dump_stream(stdout, "Info: Found an undecodable input", i, insn_buf, &insn);
		else if (verbose >= 2)
			dump_insn(stdout, &insn);
		insns++;
	}

	fprintf(stdout, "%s: decoded and checked %d %s instructions with %d errors (seed:0x%x)\n", (errors) ? "Failure" : "Success", insns, (input_file) ? "given" : "random", errors, seed);

	return errors ? 1 : 0;
}
Commit	Line	Data
1ec454ba MH	1	/*
	2	* x86 decoder sanity test - based on test_get_insn.c
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License as published by
	6	* the Free Software Foundation; either version 2 of the License, or
	7	* (at your option) any later version.
	8	*
	9	* This program is distributed in the hope that it will be useful,
	10	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	11	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	12	* GNU General Public License for more details.
	13	*
	14	* You should have received a copy of the GNU General Public License
	15	* along with this program; if not, write to the Free Software
	16	* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
	17	*
	18	* Copyright (C) IBM Corporation, 2009
	19	* Copyright (C) Hitachi, Ltd., 2011
	20	*/
	21
	22	#include <stdlib.h>
	23	#include <stdio.h>
	24	#include <string.h>
	25	#include <assert.h>
	26	#include <unistd.h>
	27	#include <sys/types.h>
	28	#include <sys/stat.h>
	29	#include <fcntl.h>
	30
	31	#define unlikely(cond) (cond)
	32	#define ARRAY_SIZE(a) (sizeof(a)/sizeof(a[0]))
	33
	34	#include <asm/insn.h>
	35	#include <inat.c>
	36	#include <insn.c>
	37
	38	/*
	39	* Test of instruction analysis against tampering.
	40	* Feed random binary to instruction decoder and ensure not to
	41	* access out-of-instruction-buffer.
	42	*/
	43
	44	#define DEFAULT_MAX_ITER 10000
	45	#define INSN_NOP 0x90
	46
	47	static const char prog; / Program name */
	48	static int verbose; /* Verbosity */
	49	static int x86_64; /* x86-64 bit mode flag */
	50	static unsigned int seed; /* Random seed */
	51	static unsigned long iter_start; /* Start of iteration number */
	52	static unsigned long iter_end = DEFAULT_MAX_ITER; /* End of iteration number */
	53	static FILE input_file; / Input file name */
	54
	55	static void usage(const char *err)
	56	{
	57	if (err)
	58	fprintf(stderr, "Error: %s\n\n", err);
	59	fprintf(stderr, "Usage: %s [-y\|-n\|-v] [-s seed[,no]] [-m max] [-i input]\n", prog);
	60	fprintf(stderr, "\t-y 64bit mode\n");
	61	fprintf(stderr, "\t-n 32bit mode\n");
9dde9dc0	62	fprintf(stderr, "\t-v Verbosity(-vv dumps any decoded result)\n");
1ec454ba MH	63	fprintf(stderr, "\t-s Give a random seed (and iteration number)\n");
	64	fprintf(stderr, "\t-m Give a maximum iteration number\n");
	65	fprintf(stderr, "\t-i Give an input file with decoded binary\n");
	66	exit(1);
	67	}
	68
	69	static void dump_field(FILE fp, const char name, const char *indent,
	70	struct insn_field *field)
	71	{
	72	fprintf(fp, "%s.%s = {\n", indent, name);
	73	fprintf(fp, "%s\t.value = %d, bytes[] = {%x, %x, %x, %x},\n",
	74	indent, field->value, field->bytes[0], field->bytes[1],
	75	field->bytes[2], field->bytes[3]);
	76	fprintf(fp, "%s\t.got = %d, .nbytes = %d},\n", indent,
	77	field->got, field->nbytes);
	78	}
	79
	80	static void dump_insn(FILE fp, struct insn insn)
	81	{
	82	fprintf(fp, "Instruction = {\n");
	83	dump_field(fp, "prefixes", "\t", &insn->prefixes);
	84	dump_field(fp, "rex_prefix", "\t", &insn->rex_prefix);
	85	dump_field(fp, "vex_prefix", "\t", &insn->vex_prefix);
	86	dump_field(fp, "opcode", "\t", &insn->opcode);
	87	dump_field(fp, "modrm", "\t", &insn->modrm);
	88	dump_field(fp, "sib", "\t", &insn->sib);
	89	dump_field(fp, "displacement", "\t", &insn->displacement);
	90	dump_field(fp, "immediate1", "\t", &insn->immediate1);
	91	dump_field(fp, "immediate2", "\t", &insn->immediate2);
	92	fprintf(fp, "\t.attr = %x, .opnd_bytes = %d, .addr_bytes = %d,\n",
	93	insn->attr, insn->opnd_bytes, insn->addr_bytes);
	94	fprintf(fp, "\t.length = %d, .x86_64 = %d, .kaddr = %p}\n",
	95	insn->length, insn->x86_64, insn->kaddr);
	96	}
	97
	98	static void dump_stream(FILE fp, const char msg, unsigned long nr_iter,
	99	unsigned char insn_buf, struct insn insn)
	100	{
	101	int i;
	102
	103	fprintf(fp, "%s:\n", msg);
	104
e70825fc	105	dump_insn(fp, insn);
1ec454ba MH	106
	107	fprintf(fp, "You can reproduce this with below command(s);\n");
	108
	109	/* Input a decoded instruction sequence directly */
	110	fprintf(fp, " $ echo ");
	111	for (i = 0; i < MAX_INSN_SIZE; i++)
	112	fprintf(fp, " %02x", insn_buf[i]);
	113	fprintf(fp, " \| %s -i -\n", prog);
	114
	115	if (!input_file) {
	116	fprintf(fp, "Or \n");
	117	/* Give a seed and iteration number */
	118	fprintf(fp, " $ %s -s 0x%x,%lu\n", prog, seed, nr_iter);
	119	}
	120	}
	121
	122	static void init_random_seed(void)
	123	{
	124	int fd;
	125
	126	fd = open("/dev/urandom", O_RDONLY);
	127	if (fd < 0)
	128	goto fail;
	129
	130	if (read(fd, &seed, sizeof(seed)) != sizeof(seed))
	131	goto fail;
	132
	133	close(fd);
	134	return;
	135	fail:
	136	usage("Failed to open /dev/urandom");
	137	}
	138
	139	/* Read given instruction sequence from the input file */
	140	static int read_next_insn(unsigned char *insn_buf)
	141	{
	142	char buf[256] = "", *tmp;
	143	int i;
	144
	145	tmp = fgets(buf, ARRAY_SIZE(buf), input_file);
	146	if (tmp == NULL \|\| feof(input_file))
	147	return 0;
	148
	149	for (i = 0; i < MAX_INSN_SIZE; i++) {
	150	insn_buf[i] = (unsigned char)strtoul(tmp, &tmp, 16);
	151	if (*tmp != ' ')
	152	break;
	153	}
	154
	155	return i;
	156	}
	157
	158	static int generate_insn(unsigned char *insn_buf)
	159	{
	160	int i;
	161
	162	if (input_file)
	163	return read_next_insn(insn_buf);
	164
	165	/* Fills buffer with random binary up to MAX_INSN_SIZE */
	166	for (i = 0; i < MAX_INSN_SIZE - 1; i += 2)
	167	(unsigned short )(&insn_buf[i]) = random() & 0xffff;
	168
	169	while (i < MAX_INSN_SIZE)
170	insn_buf[i++] = random() & 0xff;
171
172	return i;
173	}
174
175	static void parse_args(int argc, char **argv)
176	{
177	int c;
178	char *tmp = NULL;
179	int set_seed = 0;
180
181	prog = argv[0];
182	while ((c = getopt(argc, argv, "ynvs:m:i:")) != -1) {
183	switch (c) {
184	case 'y':
185	x86_64 = 1;
186	break;
187	case 'n':
188	x86_64 = 0;
189	break;
190	case 'v':
9dde9dc0	191	verbose++;
1ec454ba MH	192	break;
	193	case 'i':
	194	if (strcmp("-", optarg) == 0)
	195	input_file = stdin;
	196	else
	197	input_file = fopen(optarg, "r");
	198	if (!input_file)
	199	usage("Failed to open input file");
	200	break;
	201	case 's':
	202	seed = (unsigned int)strtoul(optarg, &tmp, 0);
	203	if (*tmp == ',') {
	204	optarg = tmp + 1;
	205	iter_start = strtoul(optarg, &tmp, 0);
	206	}
	207	if (*tmp != '\0' \|\| tmp == optarg)
	208	usage("Failed to parse seed");
	209	set_seed = 1;
	210	break;
	211	case 'm':
	212	iter_end = strtoul(optarg, &tmp, 0);
	213	if (*tmp != '\0' \|\| tmp == optarg)
	214	usage("Failed to parse max_iter");
	215	break;
	216	default:
	217	usage(NULL);
	218	}
	219	}
	220
	221	/* Check errors */
	222	if (iter_end < iter_start)
	223	usage("Max iteration number must be bigger than iter-num");
	224
	225	if (set_seed && input_file)
	226	usage("Don't use input file (-i) with random seed (-s)");
	227
	228	/* Initialize random seed */
	229	if (!input_file) {
	230	if (!set_seed) /* No seed is given */
	231	init_random_seed();
	232	srand(seed);
	233	}
	234	}
	235
	236	int main(int argc, char **argv)
	237	{
	238	struct insn insn;
	239	int insns = 0;
	240	int errors = 0;
	241	unsigned long i;
	242	unsigned char insn_buf[MAX_INSN_SIZE * 2];
	243
	244	parse_args(argc, argv);
	245
	246	/* Prepare stop bytes with NOPs */
	247	memset(insn_buf + MAX_INSN_SIZE, INSN_NOP, MAX_INSN_SIZE);
	248
	249	for (i = 0; i < iter_end; i++) {
	250	if (generate_insn(insn_buf) <= 0)
	251	break;
	252
	253	if (i < iter_start) /* Skip to given iteration number */
	254	continue;
	255
256	/* Decode an instruction */
257	insn_init(&insn, insn_buf, x86_64);
258	insn_get_length(&insn);
259
1ec454ba MH	260	if (insn.next_byte <= insn.kaddr \|\|
	261	insn.kaddr + MAX_INSN_SIZE < insn.next_byte) {
	262	/* Access out-of-range memory */
e70825fc	263	dump_stream(stderr, "Error: Found an access violation", i, insn_buf, &insn);
1ec454ba	264	errors++;
bfbe9015 MH	265	} else if (verbose && !insn_complete(&insn))
bfbe9015 MH	266	dump_stream(stdout, "Info: Found an undecodable input", i, insn_buf, &insn);
9dde9dc0 MH	267	else if (verbose >= 2)
9dde9dc0 MH	268	dump_insn(stdout, &insn);
1ec454ba MH	269	insns++;
	270	}
	271
	272	fprintf(stdout, "%s: decoded and checked %d %s instructions with %d errors (seed:0x%x)\n", (errors) ? "Failure" : "Success", insns, (input_file) ? "given" : "random", errors, seed);
	273
	274	return errors ? 1 : 0;
	275	}