xsplice: Add support for alternatives

Add support for applying alternative sections within xsplice payload.
At payload load time, apply an alternative sections that are found.

Also we add an test-case exercising a rather useless alternative
(patching a NOP with a NOP) - but it does exercise the code-path.

Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Release-acked-by: Wei Liu <wei.liu2@citrix.com>

xen/arch/x86/Makefile

@@ -6,7 +6,9 @@ subdir-y += mm
 subdir-$(CONFIG_XENOPROF) += oprofile
 subdir-y += x86_64
 
-obj-bin-y += alternative.init.o
+alternative-y := alternative.init.o
+alternative-$(CONFIG_XSPLICE) :=
+obj-bin-y += $(alternative-y)
 obj-y += apic.o
 obj-y += bitops.o
 obj-bin-y += bzimage.init.o
@@ -61,7 +63,7 @@ obj-y += x86_emulate.o
 obj-y += tboot.o
 obj-y += hpet.o
 obj-y += vm_event.o
-obj-$(CONFIG_XSPLICE) += xsplice.o
+obj-$(CONFIG_XSPLICE) += alternative.o xsplice.o
 obj-y += xstate.o
 
 obj-$(crash_debug) += gdbstub.o

xen/arch/x86/alternative.c

@@ -22,13 +22,14 @@
 #include <asm/system.h>
 #include <asm/traps.h>
 #include <asm/nmi.h>
+#include <xen/xsplice.h>
 
 #define MAX_PATCH_LEN (255-1)
 
 extern struct alt_instr __alt_instructions[], __alt_instructions_end[];
 
 #ifdef K8_NOP1
-static const unsigned char k8nops[] __initconst = {
+static const unsigned char k8nops[] init_or_xsplice_const = {
     K8_NOP1,
     K8_NOP2,
     K8_NOP3,
@@ -38,7 +39,7 @@ static const unsigned char k8nops[] __initconst = {
     K8_NOP7,
     K8_NOP8
 };
-static const unsigned char * const k8_nops[ASM_NOP_MAX+1] __initconstrel = {
+static const unsigned char * const k8_nops[ASM_NOP_MAX+1] init_or_xsplice_constrel = {
     NULL,
     k8nops,
     k8nops + 1,
@@ -52,7 +53,7 @@ static const unsigned char * const k8_nops[ASM_NOP_MAX+1] __initconstrel = {
 #endif
 
 #ifdef P6_NOP1
-static const unsigned char p6nops[] __initconst = {
+static const unsigned char p6nops[] init_or_xsplice_const = {
     P6_NOP1,
     P6_NOP2,
     P6_NOP3,
@@ -62,7 +63,7 @@ static const unsigned char p6nops[] __initconst = {
     P6_NOP7,
     P6_NOP8
 };
-static const unsigned char * const p6_nops[ASM_NOP_MAX+1] __initconstrel = {
+static const unsigned char * const p6_nops[ASM_NOP_MAX+1] init_or_xsplice_constrel = {
     NULL,
     p6nops,
     p6nops + 1,
@@ -75,7 +76,7 @@ static const unsigned char * const p6_nops[ASM_NOP_MAX+1] __initconstrel = {
 };
 #endif
 
-static const unsigned char * const *ideal_nops __initdata = k8_nops;
+static const unsigned char * const *ideal_nops init_or_xsplice_data = k8_nops;
 
 static int __init mask_nmi_callback(const struct cpu_user_regs *regs, int cpu)
 {
@@ -100,7 +101,7 @@ static void __init arch_init_ideal_nops(void)
 }
 
 /* Use this to add nops to a buffer, then text_poke the whole buffer. */
-static void __init add_nops(void *insns, unsigned int len)
+static void init_or_xsplice add_nops(void *insns, unsigned int len)
 {
     while ( len > 0 )
     {
@@ -114,7 +115,7 @@ static void __init add_nops(void *insns, unsigned int len)
 }
 
 /*
- * text_poke_early - Update instructions on a live kernel at boot time
+ * text_poke - Update instructions on a live kernel or non-executed code.
  * @addr: address to modify
  * @opcode: source of the copy
  * @len: length to copy
@@ -125,9 +126,10 @@ static void __init add_nops(void *insns, unsigned int len)
  * instructions. And on the local CPU you need to be protected again NMI or MCE
  * handlers seeing an inconsistent instruction while you patch.
  *
- * This routine is called with local interrupt disabled.
+ * You should run this with interrupts disabled or on code that is not
+ * executing.
  */
-static void *__init text_poke_early(void *addr, const void *opcode, size_t len)
+static void *init_or_xsplice text_poke(void *addr, const void *opcode, size_t len)
 {
     memcpy(addr, opcode, len);
     sync_core();
@@ -142,20 +144,14 @@ static void *__init text_poke_early(void *addr, const void *opcode, size_t len)
  * APs have less capabilities than the boot processor are not handled.
  * Tough. Make sure you disable such features by hand.
  */
-static void __init apply_alternatives(struct alt_instr *start, struct alt_instr *end)
+void init_or_xsplice apply_alternatives_nocheck(struct alt_instr *start, struct alt_instr *end)
 {
     struct alt_instr *a;
     u8 *instr, *replacement;
     u8 insnbuf[MAX_PATCH_LEN];
-    unsigned long cr0 = read_cr0();
-
-    ASSERT(!local_irq_is_enabled());
 
     printk(KERN_INFO "alt table %p -> %p\n", start, end);
 
-    /* Disable WP to allow application of alternatives to read-only pages. */
-    write_cr0(cr0 & ~X86_CR0_WP);
-
     /*
      * The scan order should be from start to end. A later scanned
      * alternative code can overwrite a previous scanned alternative code.
@@ -183,8 +179,24 @@ static void __init apply_alternatives(struct alt_instr *start, struct alt_instr
 
         add_nops(insnbuf + a->replacementlen,
                  a->instrlen - a->replacementlen);
-        text_poke_early(instr, insnbuf, a->instrlen);
+        text_poke(instr, insnbuf, a->instrlen);
     }
+}
+
+/*
+ * This routine is called with local interrupt disabled and used during
+ * bootup.
+ */
+void __init apply_alternatives(struct alt_instr *start, struct alt_instr *end)
+{
+    unsigned long cr0 = read_cr0();
+
+    ASSERT(!local_irq_is_enabled());
+
+    /* Disable WP to allow application of alternatives to read-only pages. */
+    write_cr0(cr0 & ~X86_CR0_WP);
+
+    apply_alternatives_nocheck(start, end);
 
     /* Reinstate WP. */
     write_cr0(cr0);

xen/arch/x86/test/xen_hello_world_func.c

@@ -5,6 +5,8 @@
 
 #include <xen/types.h>
 
+#include <asm/alternative.h>
+#include <asm/nops.h>
 #include <asm/uaccess.h>
 
 static unsigned long *non_canonical_addr = (unsigned long *)0xdead000000000000ULL;
@@ -14,6 +16,8 @@ const char *xen_hello_world(void)
 {
     unsigned long tmp;
     int rc;
+
+    alternative(ASM_NOP8, ASM_NOP1, X86_FEATURE_LM);
     /*
      * Any BUG, or WARN_ON will contain symbol and payload name. Furthermore
      * exceptions will be caught and processed properly.

xen/common/xsplice.c

@@ -532,6 +532,37 @@ static int prepare_payload(struct payload *payload,
     }
 
 #ifndef CONFIG_ARM
+    sec = xsplice_elf_sec_by_name(elf, ".altinstructions");
+    if ( sec )
+    {
+        struct alt_instr *a, *start, *end;
+
+        if ( sec->sec->sh_size % sizeof(*a) )
+        {
+            dprintk(XENLOG_ERR, XSPLICE "%s: Size of .alt_instr is not multiple of %zu!\n",
+                    elf->name, sizeof(*a));
+            return -EINVAL;
+        }
+
+        start = sec->load_addr;
+        end = sec->load_addr + sec->sec->sh_size;
+
+        for ( a = start; a < end; a++ )
+        {
+            const void *instr = &a->instr_offset + a->instr_offset;
+            const void *replacement = &a->repl_offset + a->repl_offset;
+
+            if ( (instr < region->start && instr >= region->end) ||
+                 (replacement < region->start && replacement >= region->end) )
+            {
+                dprintk(XENLOG_ERR, XSPLICE "%s Alt patching outside payload: %p!\n",
+                        elf->name, instr);
+                return -EINVAL;
+            }
+        }
+        apply_alternatives_nocheck(start, end);
+    }
+
     sec = xsplice_elf_sec_by_name(elf, ".ex_table");
     if ( sec )
     {

xen/include/asm-x86/alternative.h

@@ -23,6 +23,10 @@ struct alt_instr {
     u8  replacementlen;     /* length of new instruction, <= instrlen */
 };
 
+/* Similar to apply_alternatives except it can be run with IRQs enabled. */
+extern void apply_alternatives_nocheck(struct alt_instr *start,
+                                       struct alt_instr *end);
+extern void apply_alternatives(struct alt_instr *start, struct alt_instr *end);
 extern void alternative_instructions(void);
 
 #define OLDINSTR(oldinstr)      "661:\n\t" oldinstr "\n662:\n"