2022-02-24 16:38:01

by Peter Zijlstra

Subject: [PATCH v2 24/39] x86/text-patching: Make text_gen_insn() IBT aware

Make sure we don't generate direct JMP/CALL instructions to an ENDBR
instruction (which might be poison).

Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
---
arch/x86/include/asm/text-patching.h | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)

--- a/arch/x86/include/asm/text-patching.h
+++ b/arch/x86/include/asm/text-patching.h
@@ -5,6 +5,7 @@
#include <linux/types.h>
#include <linux/stddef.h>
#include <asm/ptrace.h>
+#include <asm/ibt.h>

struct paravirt_patch_site;
#ifdef CONFIG_PARAVIRT
@@ -101,13 +102,26 @@ void *text_gen_insn(u8 opcode, const voi
static union text_poke_insn insn; /* per instance */
int size = text_opcode_size(opcode);

+ /*
+ * Hide the addresses to avoid the compiler folding in constants when
+ * referencing code, these can mess up annotations like
+ * ANNOTATE_NOENDBR.
+ */
+ OPTIMIZER_HIDE_VAR(addr);
+ OPTIMIZER_HIDE_VAR(dest);
+
+#ifdef CONFIG_X86_KERNEL_IBT
+ if (is_endbr(*(u32 *)dest))
+ dest += 4;
+#endif
+
insn.opcode = opcode;

if (size > 1) {
insn.disp = (long)dest - (long)(addr + size);
if (size == 2) {
/*
- * Ensure that for JMP9 the displacement
+ * Ensure that for JMP8 the displacement
* actually fits the signed byte.
*/
BUG_ON((insn.disp >> 31) != (insn.disp >> 7));

2022-02-25 05:24:37

by Josh Poimboeuf

Subject: Re: [PATCH v2 24/39] x86/text-patching: Make text_gen_insn() IBT aware

On Thu, Feb 24, 2022 at 03:52:02PM +0100, Peter Zijlstra wrote:
> + /*
> + * Hide the addresses to avoid the compiler folding in constants when
> + * referencing code, these can mess up annotations like
> + * ANNOTATE_NOENDBR.
> + */
> + OPTIMIZER_HIDE_VAR(addr);
> + OPTIMIZER_HIDE_VAR(dest);
> +
> +#ifdef CONFIG_X86_KERNEL_IBT
> + if (is_endbr(*(u32 *)dest))
> + dest += 4;
> +#endif

Another unnecessary ifdef.

--
Josh