linux-kernel - Re: [RFC] x86/alternative: Support relocations in alternatives

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Y+EOtNlYLg1VsqiN@zn.tnic>
Date:   Mon, 6 Feb 2023 15:29:08 +0100
From:   Borislav Petkov <bp@...en8.de>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     x86@...nel.org, Masami Hiramatsu <mhiramat@...nel.org>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Andrew Cooper <Andrew.Cooper3@...rix.com>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [RFC] x86/alternative: Support relocations in alternatives

On Wed, Feb 01, 2023 at 03:10:33PM +0100, Peter Zijlstra wrote:
> +apply_relocation(u8 *instr, size_t len, u8 *dest, u8 *src, size_t src_len)
> +{
> +	struct insn insn;
> +	int i = 0;
> +
> +	for (;;) {
> +		if (insn_decode_kernel(&insn, &instr[i]))
> +			return;
> +
> +		switch (insn.opcode.bytes[0]) {
> +		case 0x0f:
> +			if (insn.opcode.bytes[1] < 0x80 ||
> +			    insn.opcode.bytes[1] > 0x8f)
> +				break;
> +
> +			fallthrough;	/* Jcc.d32 */
> +		case 0x70 ... 0x7f:	/* Jcc.d8 */
> +		case JMP8_INSN_OPCODE:
> +		case JMP32_INSN_OPCODE:
> +		case CALL_INSN_OPCODE:
> +			u8 *target = src + i + insn.length + insn.immediate.value;
> +			if (target < src || target > src + src_len) {
> +				apply_reloc(insn.immediate.nbytes,
> +					    instr + i + insn_offset_immediate(&insn),
> +					    src - dest);

Ok, here's an addition to convert to 2-byte JMPs. I'll do a proper diff
after you refresh yours ontop but this is how it looks like. It
basically does one more pass on the instr[] array bytes after the
relocation and only for JMP rel32off insns, i.e., opcode 0xe9.

Example would be:

[    1.059455] SMP alternatives: feat: 3*32+21, old: (fpu_clone+0x115/0x290 (ffffffff8102e2e5) len: 5), repl: (ffffffff898ac1b6, len: 5)
[    1.060747] SMP alternatives: apply_reloc: n: 4, ptr: 0xffffffff82203d93, diff: 0x887ded1
										   ^^^^^^^^^^

That's the diff you pass to apply_reloc_n()

[    1.062692] SMP alternatives: ffffffff8102e2e5:   old_insn: e9 dd b8 6a 08
[    1.063452] SMP alternatives: ffffffff898ac1b6:   rpl_insn: e9 41 21 78 f7

But the end offset is simply 0x15. (0x12 with the 5-byte JMP).

So we can just as well do JMP rel8off which takes a signed byte as an
offset. And slap a 3-byte NOP after that:

[    1.064211] SMP alternatives: ffffffff8102e2e5: final_insn: eb 15 0f 1f 00

		...
		case JMP32_INSN_OPCODE:
		case CALL_INSN_OPCODE:
			u8 *target = src + i + insn.length + insn.immediate.value;
			u8 opcode = instr[i];

			if (target < src || target > src + src_len) {
				apply_reloc(insn.immediate.nbytes,
					    instr + i + insn_offset_immediate(&insn),
					    src - dest);

#define JMP_SIZE_DIFF	JMP32_INSN_SIZE - JMP8_INSN_SIZE
				if (opcode == JMP32_INSN_OPCODE) {
					s32 jmp_off;

					jmp_off = *(s32 *)(instr + i + insn_offset_immediate(&insn));
					jmp_off += JMP_SIZE_DIFF;

					/* Turn it into a 2-byte JMP if new offset allows. */
					if (jmp_off >= -128 && jmp_off <= 127) {
						instr[i] = JMP8_INSN_OPCODE;
						instr[i + 1] = (s8)jmp_off;
						add_nops(instr + i + 2, JMP_SIZE_DIFF);
					}
				}
			}
		}

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette