Re: [Xen-devel] [PATCH v4 05/16] livepatch: ARM/x86: Check displacement of old_addr and new_addr

[Julien Grall <julien.grall@xxxxxxx>]

Hello Konrad,

On 16/09/2016 18:38, Konrad Rzeszutek Wilk wrote:
> If the distance is too great we are in trouble - as our relocation
> distance can surely be clipped, or still have a valid width - but
> cause an overflow of distance.
>
> On various architectures the maximum displacement for a unconditional
> branch/jump varies. ARM32 is +/- 32MB, ARM64 is +/- 128MB while x86
> for 32-bit relocations is +/- 2G.
>
> Note: On x86 we could use the 64-bit jmpq instruction which
> would provide much bigger displacement to do a jump, but we would
> still have issues with the new function not being able to reach
> any of the old functions (as all the relocations would assume 32-bit
> displacement). And "furthermore would require an register or
> memory location to load/store the address to." (From Jan).
>
> On ARM the conditional branch supports even a smaller displacement
> but fortunatly we are not using that.
s/fortunatly/fortunately/

> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
>
> ---
[...]

> diff --git a/docs/misc/livepatch.markdown b/docs/misc/livepatch.markdown
> index 9e72897..5baaa0a 100644
> --- a/docs/misc/livepatch.markdown
> +++ b/docs/misc/livepatch.markdown
> @@ -1100,7 +1100,7 @@ and no .data or .bss sections.
>  The hypervisor should verify that the in-place patching would fit within
>  the code or data.
>
> -### Trampoline (e9 opcode)
> +### Trampoline (e9 opcode), x86
>
>  The e9 opcode used for jmpq uses a 32-bit signed displacement. That means
>  we are limited to up to 2GB of virtual address to place the new code
> @@ -1134,3 +1134,15 @@ that in the hypervisor is advised.
>  The tool for generating payloads currently does perform a compile-time
>  check to ensure that the function to be replaced is large enough.
>
> +The hypervisor also checks the displacement during loading of the payload.
> +
> +#### Trampoline (ea opcode), ARM
> +
> +The 0xea000000 instruction (with proper offset) is used for an unconditional
> +branch to the new code.
The opcode/encoding mentioned is wrong for AArch64. Anyway, I am not 
sure why you want to mention the opcode in the documentation. I think it 
would be enough to specify: "unconditional branch instruction (for the 
encoding see the ARM ARM).".
> This means we are limited on ARM32 to +/- 32MB
> +displacement and on ARM64 to +/- 128MB displacement.
> +
> +The new code is placed in the 8M - 10M virtual address space while the
> +Xen code is in 2M - 4M. That gives us enough space.
> +
> +The hypervisor also checks the displacement during loading of the payload.
Regards,

--
Julien Grall

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel