[4.14,33/77] x86_64: Allow breakpoints to emulate call instructions

Commit Message

Greg KH May 23, 2019, 7:05 p.m. UTC

From: Peter Zijlstra <[e-mail]>

commit 4b33dadf37666c0860b88f9e52a16d07bf6d0b03 upstream.

In order to allow breakpoints to emulate call instructions, they need to push
the return address onto the stack. The x86_64 int3 handler adds a small gap
to allow the stack to grow some. Use this gap to add the return address to
be able to emulate a call instruction at the breakpoint location.

These helper functions are added:

  int3_emulate_jmp(): changes the location of the regs->ip to return there.

 (The next two are only for x86_64)
  int3_emulate_push(): to push the address onto the gap in the stack
  int3_emulate_call(): push the return address and change regs->ip

Cc: Andy Lutomirski <[e-mail]>
Cc: Nicolai Stange <[e-mail]>
Cc: Thomas Gleixner <[e-mail]>
Cc: Ingo Molnar <[e-mail]>
Cc: Borislav Petkov <[e-mail]>
Cc: "H. Peter Anvin" <[e-mail]>
Cc: the arch/x86 maintainers <[e-mail]>
Cc: Josh Poimboeuf <[e-mail]>
Cc: Jiri Kosina <[e-mail]>
Cc: Miroslav Benes <[e-mail]>
Cc: Petr Mladek <[e-mail]>
Cc: Joe Lawrence <[e-mail]>
Cc: Shuah Khan <[e-mail]>
Cc: Konrad Rzeszutek Wilk <[e-mail]>
Cc: Tim Chen <[e-mail]>
Cc: Sebastian Andrzej Siewior <[e-mail]>
Cc: Mimi Zohar <[e-mail]>
Cc: Juergen Gross <[e-mail]>
Cc: Nick Desaulniers <[e-mail]>
Cc: Nayna Jain <[e-mail]>
Cc: Masahiro Yamada <[e-mail]>
Cc: Joerg Roedel <[e-mail]>
Cc: "open list:KERNEL SELFTEST FRAMEWORK" <[e-mail]>
Cc: [e-mail]
Fixes: b700e7f03df5 ("livepatch: kernel: add support for live patching")
Tested-by: Nicolai Stange <[e-mail]>
Reviewed-by: Nicolai Stange <[e-mail]>
Reviewed-by: Masami Hiramatsu <[e-mail]>
Signed-off-by: Peter Zijlstra (Intel) <[e-mail]>
[ Modified to only work for x86_64 and added comment to int3_emulate_push() ]
Signed-off-by: Steven Rostedt (VMware) <[e-mail]>
Signed-off-by: Greg Kroah-Hartman <[e-mail]>

---
 arch/x86/include/asm/text-patching.h |   28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

Patch

--- a/arch/x86/include/asm/text-patching.h
+++ b/arch/x86/include/asm/text-patching.h
@@ -38,4 +38,32 @@  extern void *text_poke(void *addr, const
 extern int poke_int3_handler(struct pt_regs *regs);
 extern void *text_poke_bp(void *addr, const void *opcode, size_t len, void *handler);
 
+static inline void int3_emulate_jmp(struct pt_regs *regs, unsigned long ip)
+{
+	regs->ip = ip;
+}
+
+#define INT3_INSN_SIZE 1
+#define CALL_INSN_SIZE 5
+
+#ifdef CONFIG_X86_64
+static inline void int3_emulate_push(struct pt_regs *regs, unsigned long val)
+{
+	/*
+	 * The int3 handler in entry_64.S adds a gap between the
+	 * stack where the break point happened, and the saving of
+	 * pt_regs. We can extend the original stack because of
+	 * this gap. See the idtentry macro's create_gap option.
+	 */
+	regs->sp -= sizeof(unsigned long);
+	*(unsigned long *)regs->sp = val;
+}
+
+static inline void int3_emulate_call(struct pt_regs *regs, unsigned long func)
+{
+	int3_emulate_push(regs, regs->ip - INT3_INSN_SIZE + CALL_INSN_SIZE);
+	int3_emulate_jmp(regs, func);
+}
+#endif
+
 #endif /* _ASM_X86_TEXT_PATCHING_H */