[PATCH v2 09/13] x86/alternatives: Teach text_poke_bp() to emulate RET

From: Peter Zijlstra
Date: Mon Oct 07 2019 - 07:25:38 EST


Future patches will need to poke a RET instruction, provide the
infrastructure required for this.

Signed-off-by: Peter Zijlstra (Intel) <peterz@xxxxxxxxxxxxx>
---
arch/x86/include/asm/text-patching.h | 16 ++++++++++++++++
arch/x86/kernel/alternative.c | 6 ++++++
2 files changed, 22 insertions(+)

--- a/arch/x86/include/asm/text-patching.h
+++ b/arch/x86/include/asm/text-patching.h
@@ -64,6 +64,9 @@ static inline void int3_emulate_jmp(stru
#define INT3_INSN_SIZE 1
#define INT3_INSN_OPCODE 0xCC

+#define RET_INSN_SIZE 1
+#define RET_INSN_OPCODE 0xC3
+
#define CALL_INSN_SIZE 5
#define CALL_INSN_OPCODE 0xE8

@@ -88,11 +91,24 @@ static inline void int3_emulate_push(str
*(unsigned long *)regs->sp = val;
}

+static inline unsigned long int3_emulate_pop(struct pt_regs *regs)
+{
+ unsigned long val = *(unsigned long *)regs->sp;
+ regs->sp += sizeof(unsigned long);
+ return val;
+}
+
static inline void int3_emulate_call(struct pt_regs *regs, unsigned long func)
{
int3_emulate_push(regs, regs->ip - INT3_INSN_SIZE + CALL_INSN_SIZE);
int3_emulate_jmp(regs, func);
}
+
+static inline void int3_emulate_ret(struct pt_regs *regs)
+{
+ unsigned long ip = int3_emulate_pop(regs);
+ int3_emulate_jmp(regs, ip);
+}
#endif /* !CONFIG_UML_X86 */

#endif /* _ASM_X86_TEXT_PATCHING_H */
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -1014,6 +1014,10 @@ int notrace poke_int3_handler(struct pt_
*/
return 0;

+ case RET_INSN_OPCODE:
+ int3_emulate_ret(regs);
+ break;
+
case CALL_INSN_OPCODE:
int3_emulate_call(regs, (long)ip + tp->rel32);
break;
@@ -1146,6 +1150,7 @@ void text_poke_loc_init(struct text_poke

switch (tp->opcode) {
case INT3_INSN_OPCODE:
+ case RET_INSN_OPCODE:
break;

case CALL_INSN_OPCODE:
@@ -1260,6 +1265,7 @@ void *text_gen_insn(u8 opcode, unsigned

switch(opcode) {
__CASE(INT3);
+ __CASE(RET);
__CASE(CALL);
__CASE(JMP32);
__CASE(JMP8);