Messages in this thread | | | Date | Mon, 27 Apr 2015 14:48:54 +0200 | From | Borislav Petkov <> | Subject | Re: [PATCH] x86_64, asm: Work around AMD SYSRET SS descriptor attribute issue |
| |
On Mon, Apr 27, 2015 at 02:08:40PM +0200, Denys Vlasenko wrote: > > ffffffff819ef40c: 48 c1 e1 10 shl $0x10,%rcx > > ffffffff819ef410: 48 c1 f9 10 sar $0x10,%rcx > > ffffffff819ef414: 49 39 cb cmp %rcx,%r11 > > ffffffff819ef417: 0f 85 ff 9c bc ff jne ffffffff815b911c <opportunistic_sysret_failed> > > This looks strange. opportunistic_sysret_failed label is just a few > instructions below. Why are you getting "ff 9c bc ff" offset in JNE > instead of short jump of 0x5f bytes I see without ALTERNATIVE?
Because the replacement instructions are placed far away in the section .altinstr_replacement and since we have relative JMPs, gas generates JMP from that section to opportunistic_sysret_failed. That's why it is negative too.
And by looking at this more, I'm afraid even this current version won't work because even after I added recompute_jump() recently which is supposed to fixup the JMPs and even make them smaller, it won't work in this case because it won't detect the JMP as it is the 4th instruction and not the first byte. (And even if, it won't detect it still because we're not looking at conditional JMPs yet, i.e. Jcc).
What we could do is something like this instead:
jne opportunistic_sysret_failed - 1f 1:
so that the offset is correct. Need to experiment with this a bit first though, for the exact placement of the label but it should show the idea.
-- Regards/Gruss, Boris.
ECO tip #101: Trim your mails when you reply. --
| |