Re: [PATCH] x86_64, asm: Work around AMD SYSRET SS descriptor attribute issue

[Borislav Petkov <bp@alien8.de>]

On Mon, Apr 27, 2015 at 02:08:40PM +0200, Denys Vlasenko wrote:
> > ffffffff819ef40c:       48 c1 e1 10             shl    $0x10,%rcx
> > ffffffff819ef410:       48 c1 f9 10             sar    $0x10,%rcx
> > ffffffff819ef414:       49 39 cb                cmp    %rcx,%r11
> > ffffffff819ef417:       0f 85 ff 9c bc ff       jne    ffffffff815b911c <opportunistic_sysret_failed>
> 
> This looks strange. opportunistic_sysret_failed label is just a few
> instructions below. Why are you getting "ff 9c bc ff" offset in JNE
> instead of short jump of 0x5f bytes I see without ALTERNATIVE?

Because the replacement instructions are placed far away in the section
.altinstr_replacement and since we have relative JMPs, gas generates
JMP from that section to opportunistic_sysret_failed. That's why it is
negative too.

And by looking at this more, I'm afraid even this current version won't
work because even after I added recompute_jump() recently which is
supposed to fixup the JMPs and even make them smaller, it won't work in
this case because it won't detect the JMP as it is the 4th instruction
and not the first byte. (And even if, it won't detect it still because
we're not looking at conditional JMPs yet, i.e. Jcc).

What we could do is something like this instead:

	jne opportunistic_sysret_failed - 1f
	1:

so that the offset is correct. Need to experiment with this a bit first
though, for the exact placement of the label but it should show the
idea.

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--