patching.c

  1// SPDX-License-Identifier: GPL-2.0-only
  2#include <linux/kernel.h>
  3#include <linux/mm.h>
  4#include <linux/smp.h>
  5#include <linux/spinlock.h>
  6#include <linux/stop_machine.h>
  7#include <linux/uaccess.h>
  8
  9#include <asm/cacheflush.h>
 10#include <asm/fixmap.h>
 11#include <asm/insn.h>
 12#include <asm/kprobes.h>
 13#include <asm/text-patching.h>
 14#include <asm/sections.h>
 15
 16static DEFINE_RAW_SPINLOCK(patch_lock);
 17
 18static bool is_exit_text(unsigned long addr)
 19{
 20	/* discarded with init text/data */
 21	return system_state < SYSTEM_RUNNING &&
 22		addr >= (unsigned long)__exittext_begin &&
 23		addr < (unsigned long)__exittext_end;
 24}
 25
 26static bool is_image_text(unsigned long addr)
 27{
 28	return core_kernel_text(addr) || is_exit_text(addr);
 29}
 30
 31static void __kprobes *patch_map(void *addr, int fixmap)
 32{
 33	phys_addr_t phys;
 34
 35	if (is_image_text((unsigned long)addr)) {
 36		phys = __pa_symbol(addr);
 37	} else {
 38		struct page *page = vmalloc_to_page(addr);
 39		BUG_ON(!page);
 40		phys = page_to_phys(page) + offset_in_page(addr);
 41	}
 42
 43	return (void *)set_fixmap_offset(fixmap, phys);
 44}
 45
 46static void __kprobes patch_unmap(int fixmap)
 47{
 48	clear_fixmap(fixmap);
 49}
 50/*
 51 * In ARMv8-A, A64 instructions have a fixed length of 32 bits and are always
 52 * little-endian.
 53 */
 54int __kprobes aarch64_insn_read(void *addr, u32 *insnp)
 55{
 56	int ret;
 57	__le32 val;
 58
 59	ret = copy_from_kernel_nofault(&val, addr, AARCH64_INSN_SIZE);
 60	if (!ret)
 61		*insnp = le32_to_cpu(val);
 62
 63	return ret;
 64}
 65
 66static int __kprobes __aarch64_insn_write(void *addr, __le32 insn)
 67{
 68	void *waddr = addr;
 69	unsigned long flags = 0;
 70	int ret;
 71
 72	raw_spin_lock_irqsave(&patch_lock, flags);
 73	waddr = patch_map(addr, FIX_TEXT_POKE0);
 74
 75	ret = copy_to_kernel_nofault(waddr, &insn, AARCH64_INSN_SIZE);
 76
 77	patch_unmap(FIX_TEXT_POKE0);
 78	raw_spin_unlock_irqrestore(&patch_lock, flags);
 79
 80	return ret;
 81}
 82
 83int __kprobes aarch64_insn_write(void *addr, u32 insn)
 84{
 85	return __aarch64_insn_write(addr, cpu_to_le32(insn));
 86}
 87
 88noinstr int aarch64_insn_write_literal_u64(void *addr, u64 val)
 89{
 90	u64 *waddr;
 91	unsigned long flags;
 92	int ret;
 93
 94	raw_spin_lock_irqsave(&patch_lock, flags);
 95	waddr = patch_map(addr, FIX_TEXT_POKE0);
 96
 97	ret = copy_to_kernel_nofault(waddr, &val, sizeof(val));
 98
 99	patch_unmap(FIX_TEXT_POKE0);
100	raw_spin_unlock_irqrestore(&patch_lock, flags);
101
102	return ret;
103}
104
105typedef void text_poke_f(void *dst, void *src, size_t patched, size_t len);
106
107static void *__text_poke(text_poke_f func, void *addr, void *src, size_t len)
108{
109	unsigned long flags;
110	size_t patched = 0;
111	size_t size;
112	void *waddr;
113	void *ptr;
114
115	raw_spin_lock_irqsave(&patch_lock, flags);
116
117	while (patched < len) {
118		ptr = addr + patched;
119		size = min_t(size_t, PAGE_SIZE - offset_in_page(ptr),
120			     len - patched);
121
122		waddr = patch_map(ptr, FIX_TEXT_POKE0);
123		func(waddr, src, patched, size);
124		patch_unmap(FIX_TEXT_POKE0);
125
126		patched += size;
127	}
128	raw_spin_unlock_irqrestore(&patch_lock, flags);
129
130	flush_icache_range((uintptr_t)addr, (uintptr_t)addr + len);
131
132	return addr;
133}
134
135static void text_poke_memcpy(void *dst, void *src, size_t patched, size_t len)
136{
137	copy_to_kernel_nofault(dst, src + patched, len);
138}
139
140static void text_poke_memset(void *dst, void *src, size_t patched, size_t len)
141{
142	u32 c = *(u32 *)src;
143
144	memset32(dst, c, len / 4);
145}
146
147/**
148 * aarch64_insn_copy - Copy instructions into (an unused part of) RX memory
149 * @dst: address to modify
150 * @src: source of the copy
151 * @len: length to copy
152 *
153 * Useful for JITs to dump new code blocks into unused regions of RX memory.
154 */
155noinstr void *aarch64_insn_copy(void *dst, void *src, size_t len)
156{
157	/* A64 instructions must be word aligned */
158	if ((uintptr_t)dst & 0x3)
159		return NULL;
160
161	return __text_poke(text_poke_memcpy, dst, src, len);
162}
163
164/**
165 * aarch64_insn_set - memset for RX memory regions.
166 * @dst: address to modify
167 * @insn: value to set
168 * @len: length of memory region.
169 *
170 * Useful for JITs to fill regions of RX memory with illegal instructions.
171 */
172noinstr void *aarch64_insn_set(void *dst, u32 insn, size_t len)
173{
174	if ((uintptr_t)dst & 0x3)
175		return NULL;
176
177	return __text_poke(text_poke_memset, dst, &insn, len);
178}
179
180int __kprobes aarch64_insn_patch_text_nosync(void *addr, u32 insn)
181{
182	u32 *tp = addr;
183	int ret;
184
185	/* A64 instructions must be word aligned */
186	if ((uintptr_t)tp & 0x3)
187		return -EINVAL;
188
189	ret = aarch64_insn_write(tp, insn);
190	if (ret == 0)
191		caches_clean_inval_pou((uintptr_t)tp,
192				     (uintptr_t)tp + AARCH64_INSN_SIZE);
193
194	return ret;
195}
196
197struct aarch64_insn_patch {
198	void		**text_addrs;
199	u32		*new_insns;
200	int		insn_cnt;
201	atomic_t	cpu_count;
202};
203
204static int __kprobes aarch64_insn_patch_text_cb(void *arg)
205{
206	int i, ret = 0;
207	struct aarch64_insn_patch *pp = arg;
208
209	/* The last CPU becomes master */
210	if (atomic_inc_return(&pp->cpu_count) == num_online_cpus()) {
211		for (i = 0; ret == 0 && i < pp->insn_cnt; i++)
212			ret = aarch64_insn_patch_text_nosync(pp->text_addrs[i],
213							     pp->new_insns[i]);
214		/* Notify other processors with an additional increment. */
215		atomic_inc(&pp->cpu_count);
216	} else {
217		while (atomic_read(&pp->cpu_count) <= num_online_cpus())
218			cpu_relax();
219		isb();
220	}
221
222	return ret;
223}
224
225int __kprobes aarch64_insn_patch_text(void *addrs[], u32 insns[], int cnt)
226{
227	struct aarch64_insn_patch patch = {
228		.text_addrs = addrs,
229		.new_insns = insns,
230		.insn_cnt = cnt,
231		.cpu_count = ATOMIC_INIT(0),
232	};
233
234	if (cnt <= 0)
235		return -EINVAL;
236
237	return stop_machine_cpuslocked(aarch64_insn_patch_text_cb, &patch,
238				       cpu_online_mask);
239}