Messages in this thread |  | | | Subject | Re: [RFC PATCH 2/8] jump label v4 - x86: Introduce generic jump patching without stop_machine | | From | Steven Rostedt <> | | Date | Thu, 14 Jan 2010 10:32:19 -0500 |
| |
On Tue, 2010-01-12 at 11:26 -0500, Jason Baron wrote:
> +/** > + * text_poke_fixup() -- cross-modifying kernel text with fixup address. > + * @addr: Modifying address. > + * @opcode: New instruction. > + * @len: length of modifying bytes. > + * @fixup: Fixup address. > + * > + * Note: You must backup replaced instructions before calling this, > + * if you need to recover it. > + * Note: Must be called under text_mutex. > + */ > +void *__kprobes text_poke_fixup(void *addr, const void *opcode, size_t len, > + void *fixup) > +{ > + static const unsigned char int3_insn = BREAKPOINT_INSTRUCTION; > + static const int int3_size = sizeof(int3_insn); > + > + /* Replacing 1 byte can be done atomically. */ > + if (unlikely(len <= 1)) > + return text_poke(addr, opcode, len);
This part bothers me. The text_poke just writes over the text directly (using a separate mapping). But if that memory is in the pipeline of another CPU, I think this could cause a GPF.
-- Steve
> + > + /* Preparing */ > + patch_fixup_addr = fixup; > + wmb(); > + patch_fixup_from = (u8 *)addr + int3_size; /* IP address after int3 */ > + > + /* Cap by an int3 */ > + text_poke(addr, &int3_insn, int3_size); > + sync_core_all(); > + > + /* Replace tail bytes */ > + text_poke((char *)addr + int3_size, (const char *)opcode + int3_size, > + len - int3_size); > + sync_core_all(); > + > + /* Replace int3 with head byte */ > + text_poke(addr, opcode, int3_size); > + sync_core_all(); > + > + /* Cleanup */ > + patch_fixup_from = NULL; > + wmb(); > + return addr; > +} > +
|  |