linux-kernel - Re: [PATCH v3 1/6] x86/alternatives: Teach text_poke

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 8 Oct 2019 10:40:10 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Borislav Petkov <bp@...en8.de>
Cc:     Peter Zijlstra <peterz@...radead.org>, x86@...nel.org,
        linux-kernel@...r.kernel.org, mhiramat@...nel.org,
        bristot@...hat.com, jbaron@...mai.com,
        torvalds@...ux-foundation.org, tglx@...utronix.de,
        mingo@...nel.org, namit@...are.com, hpa@...or.com, luto@...nel.org,
        ard.biesheuvel@...aro.org, jpoimboe@...hat.com
Subject: Re: [PATCH v3 1/6] x86/alternatives: Teach text_poke_bp() to
 emulate instructions

On Tue, 8 Oct 2019 16:29:24 +0200
Borislav Petkov <bp@...en8.de> wrote:

> On Mon, Oct 07, 2019 at 10:17:17AM +0200, Peter Zijlstra wrote:
> > In preparation for static_call and variable size jump_label support,
> > teach text_poke_bp() to emulate instructions, namely:
> > 
> >   JMP32, JMP8, CALL, NOP2, NOP_ATOMIC5, INT3
> > 
> > The current text_poke_bp() takes a @handler argument which is used as
> > a jump target when the temporary INT3 is hit by a different CPU.
> > 
> > When patching CALL instructions, this doesn't work because we'd miss
> > the PUSH of the return address. Instead, teach poke_int3_handler() to
> > emulate an instruction, typically the instruction we're patching in.
> > 
> > This fits almost all text_poke_bp() users, except
> > arch_unoptimize_kprobe() which restores random text, and for that site
> > we have to build an explicit emulate instruction.  
> 
> ...
> 
> > @@ -63,8 +66,17 @@ static inline void int3_emulate_jmp(stru
> >  	regs->ip = ip;
> >  }
> >  
> > -#define INT3_INSN_SIZE 1
> > -#define CALL_INSN_SIZE 5
> > +#define INT3_INSN_SIZE		1
> > +#define INT3_INSN_OPCODE	0xCC
> > +
> > +#define CALL_INSN_SIZE		5
> > +#define CALL_INSN_OPCODE	0xE8
> > +
> > +#define JMP32_INSN_SIZE		5
> > +#define JMP32_INSN_OPCODE	0xE9
> > +
> > +#define JMP8_INSN_SIZE		2
> > +#define JMP8_INSN_OPCODE	0xEB  
> 
> You probably should switch those to have the name prefix come first and
> make them even shorter:
> 
> OPCODE_CALL
> INSN_SIZE_CALL
> OPCODE_JMP32
> INSN_SIZE_JMP32
> OPCODE_JMP8
> ...
> 
> This way you have the opcodes prefixed with OPCODE_ and the insn sizes
> with INSN_SIZE_. I.e., what they actually are.

Honestly, I like the original way better.

Seeing OPCODE_JMP32 and INSN_SIZE_JMP32 doesn't look like they are
related to me.

-- Steve