Commit da0fe6e6 authored by Juergen Gross's avatar Juergen Gross Committed by Borislav Petkov (AMD)
Browse files

x86/alternative: Add indirect call patching 



In order to prepare replacing of paravirt patching with alternative
patching, add the capability to replace an indirect call with a direct
one.

This is done via a new flag ALT_FLAG_CALL as the target of the CALL
instruction needs to be evaluated using the value of the location
addressed by the indirect call.

For convenience, add a macro for a default CALL instruction. In case it
is being used without the new flag being set, it will result in a BUG()
when being executed. As in most cases, the feature used will be
X86_FEATURE_ALWAYS so add another macro ALT_CALL_ALWAYS usable for the
flags parameter of the ALTERNATIVE macros.

For a complete replacement, handle the special cases of calling a nop
function and an indirect call of NULL the same way as paravirt does.

  [ bp: Massage commit message, fixup the debug output and clarify flow
    more. ]

Co-developed-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20231210062138.2417-4-jgross@suse.com
parent 9824b00c

arch/x86/include/asm/alternative.h

+9 −0
Original line number Diff line number Diff line
@@ -10,6 +10,9 @@ 


#define ALT_FLAG_NOT		(1 << 0)

#define ALT_NOT(feature)	((ALT_FLAG_NOT << ALT_FLAGS_SHIFT) | (feature))

#define ALT_FLAG_DIRECT_CALL	(1 << 1)

#define ALT_DIRECT_CALL(feature) ((ALT_FLAG_DIRECT_CALL << ALT_FLAGS_SHIFT) | (feature))

#define ALT_CALL_ALWAYS		ALT_DIRECT_CALL(X86_FEATURE_ALWAYS)



#ifndef __ASSEMBLY__
@@ -150,6 +153,8 @@ static inline int alternatives_text_reserved(void *start, void *end) 
}

#endif	/* CONFIG_SMP */



#define ALT_CALL_INSTR		"call BUG_func"



#define b_replacement(num)	"664"#num

#define e_replacement(num)	"665"#num
@@ -386,6 +391,10 @@ void nop_func(void); 
	.byte \alt_len

.endm



.macro ALT_CALL_INSTR

	call BUG_func

.endm



/*

 * Define an alternative between two instructions. If @feature is

 * present, early code in apply_alternatives() replaces @oldinstr with

arch/x86/kernel/alternative.c

+55 −3
Original line number Diff line number Diff line
@@ -395,6 +395,53 @@ noinstr void BUG_func(void) 
}

EXPORT_SYMBOL_GPL(BUG_func);



#define CALL_RIP_REL_OPCODE	0xff

#define CALL_RIP_REL_MODRM	0x15



/*

 * Rewrite the "call BUG_func" replacement to point to the target of the

 * indirect pv_ops call "call *disp(%ip)".

 */

static int alt_replace_call(u8 *instr, u8 *insn_buff, struct alt_instr *a)

{

	void *target, *bug = &BUG_func;

	s32 disp;



	if (a->replacementlen != 5 || insn_buff[0] != CALL_INSN_OPCODE) {

		pr_err("ALT_FLAG_DIRECT_CALL set for a non-call replacement instruction\n");

		BUG();

	}



	if (a->instrlen != 6 ||

	    instr[0] != CALL_RIP_REL_OPCODE ||

	    instr[1] != CALL_RIP_REL_MODRM) {

		pr_err("ALT_FLAG_DIRECT_CALL set for unrecognized indirect call\n");

		BUG();

	}



	/* Skip CALL_RIP_REL_OPCODE and CALL_RIP_REL_MODRM */

	disp = *(s32 *)(instr + 2);

#ifdef CONFIG_X86_64

	/* ff 15 00 00 00 00   call   *0x0(%rip) */

	/* target address is stored at "next instruction + disp". */

	target = *(void **)(instr + a->instrlen + disp);

#else

	/* ff 15 00 00 00 00   call   *0x0 */

	/* target address is stored at disp. */

	target = *(void **)disp;

#endif

	if (!target)

		target = bug;



	/* (BUG_func - .) + (target - BUG_func) := target - . */

	*(s32 *)(insn_buff + 1) += target - bug;



	if (target == &nop_func)

		return 0;



	return 5;

}



/*

 * Replace instructions with better alternatives for this CPU type. This runs

 * before SMP is initialized to avoid SMP problems with self modifying code.
@@ -452,16 +499,21 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start, 
			continue;

		}



		DPRINTK(ALT, "feat: %s%d*32+%d, old: (%pS (%px) len: %d), repl: (%px, len: %d)",

			(a->flags & ALT_FLAG_NOT) ? "!" : "",

		DPRINTK(ALT, "feat: %d32+%d, old: (%pS (%px) len: %d), repl: (%px, len: %d) flags: 0x%x",

			a->cpuid >> 5,

			a->cpuid & 0x1f,

			instr, instr, a->instrlen,

			replacement, a->replacementlen);

			replacement, a->replacementlen, a->flags);



		memcpy(insn_buff, replacement, a->replacementlen);

		insn_buff_sz = a->replacementlen;



		if (a->flags & ALT_FLAG_DIRECT_CALL) {

			insn_buff_sz = alt_replace_call(instr, insn_buff, a);

			if (insn_buff_sz < 0)

				continue;

		}



		for (; insn_buff_sz < a->instrlen; insn_buff_sz++)

			insn_buff[insn_buff_sz] = 0x90;