x86/alternative: Add indirect call patching

In order to prepare replacing of paravirt patching with alternative
patching, add the capability to replace an indirect call with a direct
one.

This is done via a new flag ALT_FLAG_CALL as the target of the CALL
instruction needs to be evaluated using the value of the location
addressed by the indirect call.

For convenience, add a macro for a default CALL instruction. In case it
is being used without the new flag being set, it will result in a BUG()
when being executed. As in most cases, the feature used will be
X86_FEATURE_ALWAYS so add another macro ALT_CALL_ALWAYS usable for the
flags parameter of the ALTERNATIVE macros.

For a complete replacement, handle the special cases of calling a nop
function and an indirect call of NULL the same way as paravirt does.

  [ bp: Massage commit message, fixup the debug output and clarify flow
    more. ]

Co-developed-by: Peter Zijlstra (Intel) <[email protected]>
Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
Signed-off-by: Juergen Gross <[email protected]>
Signed-off-by: Borislav Petkov (AMD) <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
index ce788ab4e77ca650c53ef01bf8c5a259395c35dc..472334eed6f35de0c777764da15d40279f52c735 100644 (file)
--- a/arch/x86/include/asm/alternative.h
+++ b/arch/x86/include/asm/alternative.h
@@ -10,6 +10,9 @@
 
 #define ALT_FLAG_NOT           (1 << 0)
 #define ALT_NOT(feature)       ((ALT_FLAG_NOT << ALT_FLAGS_SHIFT) | (feature))
 
 #define ALT_FLAG_NOT           (1 << 0)
 #define ALT_NOT(feature)       ((ALT_FLAG_NOT << ALT_FLAGS_SHIFT) | (feature))

+#define ALT_FLAG_DIRECT_CALL   (1 << 1)
+#define ALT_DIRECT_CALL(feature) ((ALT_FLAG_DIRECT_CALL << ALT_FLAGS_SHIFT) | (feature))
+#define ALT_CALL_ALWAYS                ALT_DIRECT_CALL(X86_FEATURE_ALWAYS)

 
 #ifndef __ASSEMBLY__
 
 
 #ifndef __ASSEMBLY__
 


@@ -150,6 +153,8 @@ static inline int alternatives_text_reserved(void *start, void *end)
 }
 #endif /* CONFIG_SMP */
 
 }
 #endif /* CONFIG_SMP */
 

+#define ALT_CALL_INSTR         "call BUG_func"
+

 #define b_replacement(num)     "664"#num
 #define e_replacement(num)     "665"#num
 
 #define b_replacement(num)     "664"#num
 #define e_replacement(num)     "665"#num
 


@@ -386,6 +391,10 @@ void nop_func(void);
        .byte \alt_len
 .endm
 
        .byte \alt_len
 .endm
 

+.macro ALT_CALL_INSTR
+       call BUG_func
+.endm
+

 /*
  * Define an alternative between two instructions. If @feature is
  * present, early code in apply_alternatives() replaces @oldinstr with
 /*
  * Define an alternative between two instructions. If @feature is
  * present, early code in apply_alternatives() replaces @oldinstr with

diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index ca25dd280b8c1d4c9906b1ebdc54388e629663f0..657305137bf9bb8e6cff5785d3f775ecb9f7ebdc 100644 (file)
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -395,6 +395,53 @@ noinstr void BUG_func(void)
 }
 EXPORT_SYMBOL_GPL(BUG_func);
 
 }
 EXPORT_SYMBOL_GPL(BUG_func);
 

+#define CALL_RIP_REL_OPCODE    0xff
+#define CALL_RIP_REL_MODRM     0x15
+
+/*
+ * Rewrite the "call BUG_func" replacement to point to the target of the
+ * indirect pv_ops call "call *disp(%ip)".
+ */
+static int alt_replace_call(u8 *instr, u8 *insn_buff, struct alt_instr *a)
+{
+       void *target, *bug = &BUG_func;
+       s32 disp;
+
+       if (a->replacementlen != 5 || insn_buff[0] != CALL_INSN_OPCODE) {
+               pr_err("ALT_FLAG_DIRECT_CALL set for a non-call replacement instruction\n");
+               BUG();
+       }
+
+       if (a->instrlen != 6 ||
+           instr[0] != CALL_RIP_REL_OPCODE ||
+           instr[1] != CALL_RIP_REL_MODRM) {
+               pr_err("ALT_FLAG_DIRECT_CALL set for unrecognized indirect call\n");
+               BUG();
+       }
+
+       /* Skip CALL_RIP_REL_OPCODE and CALL_RIP_REL_MODRM */
+       disp = *(s32 *)(instr + 2);
+#ifdef CONFIG_X86_64
+       /* ff 15 00 00 00 00   call   *0x0(%rip) */
+       /* target address is stored at "next instruction + disp". */
+       target = *(void **)(instr + a->instrlen + disp);
+#else
+       /* ff 15 00 00 00 00   call   *0x0 */
+       /* target address is stored at disp. */
+       target = *(void **)disp;
+#endif
+       if (!target)
+               target = bug;
+
+       /* (BUG_func - .) + (target - BUG_func) := target - . */
+       *(s32 *)(insn_buff + 1) += target - bug;
+
+       if (target == &nop_func)
+               return 0;
+
+       return 5;
+}
+

 /*
  * Replace instructions with better alternatives for this CPU type. This runs
  * before SMP is initialized to avoid SMP problems with self modifying code.
 /*
  * Replace instructions with better alternatives for this CPU type. This runs
  * before SMP is initialized to avoid SMP problems with self modifying code.


@@ -452,16 +499,21 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start,
                        continue;
                }
 
                        continue;
                }
 

-               DPRINTK(ALT, "feat: %s%d*32+%d, old: (%pS (%px) len: %d), repl: (%px, len: %d)",
-                       (a->flags & ALT_FLAG_NOT) ? "!" : "",
+               DPRINTK(ALT, "feat: %d32+%d, old: (%pS (%px) len: %d), repl: (%px, len: %d) flags: 0x%x",

                        a->cpuid >> 5,
                        a->cpuid & 0x1f,
                        instr, instr, a->instrlen,
                        a->cpuid >> 5,
                        a->cpuid & 0x1f,
                        instr, instr, a->instrlen,

-                       replacement, a->replacementlen);
+                       replacement, a->replacementlen, a->flags);

 
                memcpy(insn_buff, replacement, a->replacementlen);
                insn_buff_sz = a->replacementlen;
 
 
                memcpy(insn_buff, replacement, a->replacementlen);
                insn_buff_sz = a->replacementlen;
 

+               if (a->flags & ALT_FLAG_DIRECT_CALL) {
+                       insn_buff_sz = alt_replace_call(instr, insn_buff, a);
+                       if (insn_buff_sz < 0)
+                               continue;
+               }
+

                for (; insn_buff_sz < a->instrlen; insn_buff_sz++)
                        insn_buff[insn_buff_sz] = 0x90;
 
                for (; insn_buff_sz < a->instrlen; insn_buff_sz++)
                        insn_buff[insn_buff_sz] = 0x90;