linux-kernel - Re: [POC][RFC][PATCH 1/2] jump_function: Addition of new feature "jump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 10 Oct 2018 13:16:05 -0500
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Andy Lutomirski <luto@...capital.net>
Cc:     Steven Rostedt <rostedt@...dmis.org>,
        Peter Zijlstra <peterz@...radead.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Ingo Molnar <mingo@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        Matthew Helsley <mhelsley@...are.com>,
        "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
        David Woodhouse <dwmw2@...radead.org>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Jason Baron <jbaron@...mai.com>, Jiri Kosina <jkosina@...e.cz>,
        Ard Biesheuvel <ard.biesheuvel@...aro.org>,
        Andrew Lutomirski <luto@...nel.org>
Subject: Re: [POC][RFC][PATCH 1/2] jump_function: Addition of new feature
 "jump_function"

On Wed, Oct 10, 2018 at 11:03:43AM -0700, Andy Lutomirski wrote:
> > +#define DECLARE_STATIC_CALL(tramp, func)                               \
> > +       extern typeof(func) tramp;                                      \
> > +       static void __used __section(.discard.static_call_tramps)       \
> > +               *__static_call_tramp_##tramp = tramp
> > +
> 
> Confused.  What's the __static_call_tramp_##tramp variable for?  And
> why is a DECLARE_ macro defining a variable?

This is the magic needed for objtool to find all the call sites.

The variable itself isn't needed, but the .discard.static_call_tramps
entry is.  Objtool reads that section to find out which function call
sites are targeted to a static call trampoline.

> > +#define DEFINE_STATIC_CALL(tramp, func)                                        \
> > +       DECLARE_STATIC_CALL(tramp, func);                               \
> > +       asm(".pushsection .text, \"ax\"                         \n"     \
> > +           ".align 4                                           \n"     \
> > +           ".globl " #tramp "                                  \n"     \
> > +           ".type " #tramp ", @function                        \n"     \
> > +           #tramp ":                                           \n"     \
> > +           "jmp " #func "                                      \n"     \
> 
> I think this would be nicer as an indirect call that gets patched to a
> direct call so that the update mechanism works even before it's
> initialized.  (Currently static_branch blows up horribly if you try to
> update one too early, and that's rather annoying IMO.)

Yeah, that would be better.  It would also allow trampoline function
pointers to work, which I think you mentioned elsewhere.  And then I
shouldn't trample this code in __static_call_update() -- that was
already kind of nasty anyway.

> Also, I think you're looking for "jmp.d32", which is available in
> newer toolchains.  For older toolchains, you could use .byte 0xe9 or
> you could use a different section (I think) to force a real 32-bit
> jump.

Good idea.

> > +void __init static_call_init(void)
> > +{
> > +       struct static_call_entry *entry;
> > +       unsigned long insn, tramp, func;
> > +       unsigned char insn_opcode, tramp_opcode;
> > +       s32 call_dest;
> > +
> > +       for (entry = __start_static_call_table;
> > +            entry < __stop_static_call_table; entry++) {
> > +
> > +               insn = (long)entry->insn + (unsigned long)&entry->insn;
> > +               tramp = (long)entry->tramp + (unsigned long)&entry->tramp;
> > +
> > +               insn_opcode = *(unsigned char *)insn;
> > +               if (insn_opcode != 0xe8 && insn_opcode != 0xe9) {
> > +                       WARN_ONCE(1, "unexpected static call insn opcode %x at %pS",
> > +                                 insn_opcode, (void *)insn);
> > +                       continue;
> > +               }
> > +
> > +               tramp_opcode = *(unsigned char *)tramp;
> > +               if (tramp_opcode != 0xeb && tramp_opcode != 0xe9) {
> > +                       WARN_ONCE(1, "unexpected trampoline jump opcode %x at %ps",
> > +                                tramp_opcode, (void *)tramp);
> > +                       continue;
> > +               }
> > +
> > +               if (tramp_opcode == 0xeb)
> > +                       func = *(s8 *)(tramp + 1) + (tramp + 2);
> 
> I realize you expect some instances of 0xeb due to the assembler
> messing you up (see above), but this seems a bit too permissive, since
> a 0xeb without the appropriate set of NOPs is going to explode.  And:

Yep.

> > +               else
> > +                       func = *(s32 *)(tramp + 1) + (tramp + 5);
> > +
> > +               call_dest = (long)(func) - (long)(insn + 5);
> > +
> > +               printk("static_call_init: poking %lx at %lx\n", (unsigned long)call_dest, (insn+1));
> > +
> > +               text_poke_early((void *)(insn + 1), &call_dest, 4);
> 
> If you really are going to rewrite an 8-bit jump to a 32-bit jump, I
> think you need to actually patch the opcode byte :)

Oops :-)

-- 
Josh