Messages in this thread | | | Date | Mon, 6 Feb 2023 15:29:08 +0100 | From | Borislav Petkov <> | Subject | Re: [RFC] x86/alternative: Support relocations in alternatives |
| |
On Wed, Feb 01, 2023 at 03:10:33PM +0100, Peter Zijlstra wrote: > +apply_relocation(u8 *instr, size_t len, u8 *dest, u8 *src, size_t src_len) > +{ > + struct insn insn; > + int i = 0; > + > + for (;;) { > + if (insn_decode_kernel(&insn, &instr[i])) > + return; > + > + switch (insn.opcode.bytes[0]) { > + case 0x0f: > + if (insn.opcode.bytes[1] < 0x80 || > + insn.opcode.bytes[1] > 0x8f) > + break; > + > + fallthrough; /* Jcc.d32 */ > + case 0x70 ... 0x7f: /* Jcc.d8 */ > + case JMP8_INSN_OPCODE: > + case JMP32_INSN_OPCODE: > + case CALL_INSN_OPCODE: > + u8 *target = src + i + insn.length + insn.immediate.value; > + if (target < src || target > src + src_len) { > + apply_reloc(insn.immediate.nbytes, > + instr + i + insn_offset_immediate(&insn), > + src - dest);
Ok, here's an addition to convert to 2-byte JMPs. I'll do a proper diff after you refresh yours ontop but this is how it looks like. It basically does one more pass on the instr[] array bytes after the relocation and only for JMP rel32off insns, i.e., opcode 0xe9.
Example would be:
[ 1.059455] SMP alternatives: feat: 3*32+21, old: (fpu_clone+0x115/0x290 (ffffffff8102e2e5) len: 5), repl: (ffffffff898ac1b6, len: 5) [ 1.060747] SMP alternatives: apply_reloc: n: 4, ptr: 0xffffffff82203d93, diff: 0x887ded1 ^^^^^^^^^^
That's the diff you pass to apply_reloc_n()
[ 1.062692] SMP alternatives: ffffffff8102e2e5: old_insn: e9 dd b8 6a 08 [ 1.063452] SMP alternatives: ffffffff898ac1b6: rpl_insn: e9 41 21 78 f7
But the end offset is simply 0x15. (0x12 with the 5-byte JMP).
So we can just as well do JMP rel8off which takes a signed byte as an offset. And slap a 3-byte NOP after that:
[ 1.064211] SMP alternatives: ffffffff8102e2e5: final_insn: eb 15 0f 1f 00
... case JMP32_INSN_OPCODE: case CALL_INSN_OPCODE: u8 *target = src + i + insn.length + insn.immediate.value; u8 opcode = instr[i];
if (target < src || target > src + src_len) { apply_reloc(insn.immediate.nbytes, instr + i + insn_offset_immediate(&insn), src - dest);
#define JMP_SIZE_DIFF JMP32_INSN_SIZE - JMP8_INSN_SIZE if (opcode == JMP32_INSN_OPCODE) { s32 jmp_off;
jmp_off = *(s32 *)(instr + i + insn_offset_immediate(&insn)); jmp_off += JMP_SIZE_DIFF;
/* Turn it into a 2-byte JMP if new offset allows. */ if (jmp_off >= -128 && jmp_off <= 127) { instr[i] = JMP8_INSN_OPCODE; instr[i + 1] = (s8)jmp_off; add_nops(instr + i + 2, JMP_SIZE_DIFF); } } } }
-- Regards/Gruss, Boris.
https://people.kernel.org/tglx/notes-about-netiquette
| |