forked from luck/tmp_suning_uos_patched
x86/alternative: Handle Jcc __x86_indirect_thunk_\reg
commit 2f0cbb2a8e5bbf101e9de118fc0eb168111a5e1e upstream. Handle the rare cases where the compiler (clang) does an indirect conditional tail-call using: Jcc __x86_indirect_thunk_\reg For the !RETPOLINE case this can be rewritten to fit the original (6 byte) instruction like: Jncc.d8 1f JMP *%\reg NOP 1: Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Borislav Petkov <bp@suse.de> Acked-by: Josh Poimboeuf <jpoimboe@redhat.com> Tested-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/r/20211026120310.296470217@infradead.org Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
381fd04c97
commit
b0e2dc9506
|
@ -548,7 +548,8 @@ static int emit_indirect(int op, int reg, u8 *bytes)
|
|||
static int patch_retpoline(void *addr, struct insn *insn, u8 *bytes)
|
||||
{
|
||||
retpoline_thunk_t *target;
|
||||
int reg, i = 0;
|
||||
int reg, ret, i = 0;
|
||||
u8 op, cc;
|
||||
|
||||
target = addr + insn->length + insn->immediate.value;
|
||||
reg = target - __x86_indirect_thunk_array;
|
||||
|
@ -562,9 +563,36 @@ static int patch_retpoline(void *addr, struct insn *insn, u8 *bytes)
|
|||
if (cpu_feature_enabled(X86_FEATURE_RETPOLINE))
|
||||
return -1;
|
||||
|
||||
i = emit_indirect(insn->opcode.bytes[0], reg, bytes);
|
||||
if (i < 0)
|
||||
return i;
|
||||
op = insn->opcode.bytes[0];
|
||||
|
||||
/*
|
||||
* Convert:
|
||||
*
|
||||
* Jcc.d32 __x86_indirect_thunk_\reg
|
||||
*
|
||||
* into:
|
||||
*
|
||||
* Jncc.d8 1f
|
||||
* JMP *%\reg
|
||||
* NOP
|
||||
* 1:
|
||||
*/
|
||||
/* Jcc.d32 second opcode byte is in the range: 0x80-0x8f */
|
||||
if (op == 0x0f && (insn->opcode.bytes[1] & 0xf0) == 0x80) {
|
||||
cc = insn->opcode.bytes[1] & 0xf;
|
||||
cc ^= 1; /* invert condition */
|
||||
|
||||
bytes[i++] = 0x70 + cc; /* Jcc.d8 */
|
||||
bytes[i++] = insn->length - 2; /* sizeof(Jcc.d8) == 2 */
|
||||
|
||||
/* Continue as if: JMP.d32 __x86_indirect_thunk_\reg */
|
||||
op = JMP32_INSN_OPCODE;
|
||||
}
|
||||
|
||||
ret = emit_indirect(op, reg, bytes + i);
|
||||
if (ret < 0)
|
||||
return ret;
|
||||
i += ret;
|
||||
|
||||
for (; i < insn->length;)
|
||||
bytes[i++] = 0x90;
|
||||
|
@ -598,6 +626,10 @@ void __init_or_module noinline apply_retpolines(s32 *start, s32 *end)
|
|||
case JMP32_INSN_OPCODE:
|
||||
break;
|
||||
|
||||
case 0x0f: /* escape */
|
||||
if (op2 >= 0x80 && op2 <= 0x8f)
|
||||
break;
|
||||
fallthrough;
|
||||
default:
|
||||
WARN_ON_ONCE(1);
|
||||
continue;
|
||||
|
|
Loading…
Reference in New Issue
Block a user