GitHub-Mirror/linux-bl808
2
0
Fork 0
mirror of https://github.com/Fishwaldo/linux-bl808.git synced 2025-04-13 09:43:52 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

x86/alternative: Relax text_poke_bp() constraint

Browse source 
Currently, text_poke_bp() is very strict to only allow patching a
single instruction; however with straight-line-speculation it will be
required to patch: ret; int3, which is two instructions.

As such, relax the constraints a little to allow int3 padding for all
instructions that do not imply the execution of the next instruction,
ie: RET, JMP.d8 and JMP.d32.

While there, rename the text_poke_loc::rel32 field to ::disp.

Note: this fills up the text_poke_loc structure which is now a round
  16 bytes big.

  [ bp: Put comments ontop instead of on the side. ]

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lore.kernel.org/r/20211204134908.082342723@infradead.org
This commit is contained in:
Peter Zijlstra 2021-12-04 14:43:43 +01:00 • committed by Borislav Petkov
parent 1cc1e4c8aa
commit 26c44b776d
1 changed files with 34 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

49
arch/x86/kernel/alternative.c
View file

@ -1113,10 +1113,13 @@ void text_poke_sync(void)
} }
struct text_poke_loc { struct text_poke_loc {
s32 rel_addr; /* addr := _stext + rel_addr */ /* addr := _stext + rel_addr */
s32 rel32; s32 rel_addr;
s32 disp;
u8 len;
u8 opcode; u8 opcode;
const u8 text[POKE_MAX_OPCODE_SIZE]; const u8 text[POKE_MAX_OPCODE_SIZE];
/* see text_poke_bp_batch() */
u8 old; u8 old;
}; };
@ -1131,7 +1134,8 @@ static struct bp_patching_desc *bp_desc;
static __always_inline static __always_inline
struct bp_patching_desc *try_get_desc(struct bp_patching_desc **descp) struct bp_patching_desc *try_get_desc(struct bp_patching_desc **descp)
{ {
struct bp_patching_desc *desc = __READ_ONCE(*descp); /* rcu_dereference */ /* rcu_dereference */
struct bp_patching_desc *desc = __READ_ONCE(*descp);
if (!desc || !arch_atomic_inc_not_zero(&desc->refs)) if (!desc || !arch_atomic_inc_not_zero(&desc->refs))
return NULL; return NULL;
@ -1165,7 +1169,7 @@ noinstr int poke_int3_handler(struct pt_regs *regs)
{ {
struct bp_patching_desc *desc; struct bp_patching_desc *desc;
struct text_poke_loc *tp; struct text_poke_loc *tp;
int len, ret = 0; int ret = 0;
void *ip; void *ip;
if (user_mode(regs)) if (user_mode(regs))
@ -1205,8 +1209,7 @@ noinstr int poke_int3_handler(struct pt_regs *regs)
goto out_put; goto out_put;
} }
len = text_opcode_size(tp->opcode); ip += tp->len;
ip += len;
switch (tp->opcode) { switch (tp->opcode) {
case INT3_INSN_OPCODE: case INT3_INSN_OPCODE:
@ -1221,12 +1224,12 @@ noinstr int poke_int3_handler(struct pt_regs *regs)
break; break;
case CALL_INSN_OPCODE: case CALL_INSN_OPCODE:
int3_emulate_call(regs, (long)ip + tp->rel32); int3_emulate_call(regs, (long)ip + tp->disp);
break; break;
case JMP32_INSN_OPCODE: case JMP32_INSN_OPCODE:
case JMP8_INSN_OPCODE: case JMP8_INSN_OPCODE:
int3_emulate_jmp(regs, (long)ip + tp->rel32); int3_emulate_jmp(regs, (long)ip + tp->disp);
break; break;
default: default:
@ -1301,7 +1304,7 @@ static void text_poke_bp_batch(struct text_poke_loc *tp, unsigned int nr_entries
*/ */
for (do_sync = 0, i = 0; i < nr_entries; i++) { for (do_sync = 0, i = 0; i < nr_entries; i++) {
u8 old[POKE_MAX_OPCODE_SIZE] = { tp[i].old, }; u8 old[POKE_MAX_OPCODE_SIZE] = { tp[i].old, };
int len = text_opcode_size(tp[i].opcode); int len = tp[i].len;
if (len - INT3_INSN_SIZE > 0) { if (len - INT3_INSN_SIZE > 0) {
memcpy(old + INT3_INSN_SIZE, memcpy(old + INT3_INSN_SIZE,
@ -1378,20 +1381,36 @@ static void text_poke_loc_init(struct text_poke_loc *tp, void *addr,
const void *opcode, size_t len, const void *emulate) const void *opcode, size_t len, const void *emulate)
{ {
struct insn insn; struct insn insn;
int ret; int ret, i;
memcpy((void *)tp->text, opcode, len); memcpy((void *)tp->text, opcode, len);
if (!emulate) if (!emulate)
emulate = opcode; emulate = opcode;
ret = insn_decode_kernel(&insn, emulate); ret = insn_decode_kernel(&insn, emulate);
BUG_ON(ret < 0); BUG_ON(ret < 0);
BUG_ON(len != insn.length);
tp->rel_addr = addr - (void *)_stext; tp->rel_addr = addr - (void *)_stext;
tp->len = len;
tp->opcode = insn.opcode.bytes[0]; tp->opcode = insn.opcode.bytes[0];
switch (tp->opcode) {
case RET_INSN_OPCODE:
case JMP32_INSN_OPCODE:
case JMP8_INSN_OPCODE:
/*
* Control flow instructions without implied execution of the
* next instruction can be padded with INT3.
*/
for (i = insn.length; i < len; i++)
BUG_ON(tp->text[i] != INT3_INSN_OPCODE);
break;
default:
BUG_ON(len != insn.length);
};
switch (tp->opcode) { switch (tp->opcode) {
case INT3_INSN_OPCODE: case INT3_INSN_OPCODE:
case RET_INSN_OPCODE: case RET_INSN_OPCODE:
@ -1400,7 +1419,7 @@ static void text_poke_loc_init(struct text_poke_loc *tp, void *addr,
case CALL_INSN_OPCODE: case CALL_INSN_OPCODE:
case JMP32_INSN_OPCODE: case JMP32_INSN_OPCODE:
case JMP8_INSN_OPCODE: case JMP8_INSN_OPCODE:
tp->rel32 = insn.immediate.value; tp->disp = insn.immediate.value;
break; break;
default: /* assume NOP */ default: /* assume NOP */
@ -1408,13 +1427,13 @@ static void text_poke_loc_init(struct text_poke_loc *tp, void *addr,
case 2: /* NOP2 -- emulate as JMP8+0 */ case 2: /* NOP2 -- emulate as JMP8+0 */
BUG_ON(memcmp(emulate, x86_nops[len], len)); BUG_ON(memcmp(emulate, x86_nops[len], len));
tp->opcode = JMP8_INSN_OPCODE; tp->opcode = JMP8_INSN_OPCODE;
tp->rel32 = 0; tp->disp = 0;
break; break;
case 5: /* NOP5 -- emulate as JMP32+0 */ case 5: /* NOP5 -- emulate as JMP32+0 */
BUG_ON(memcmp(emulate, x86_nops[len], len)); BUG_ON(memcmp(emulate, x86_nops[len], len));
tp->opcode = JMP32_INSN_OPCODE; tp->opcode = JMP32_INSN_OPCODE;
tp->rel32 = 0; tp->disp = 0;
break; break;
default: /* unknown instruction */ default: /* unknown instruction */