arch/arm64/kernel/patching.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 #include <linux/kernel.h>
   3 #include <linux/mm.h>
   4 #include <linux/smp.h>
   5 #include <linux/spinlock.h>
   6 #include <linux/stop_machine.h>
   7 #include <linux/uaccess.h>
   8
   9 #include <asm/cacheflush.h>
  10 #include <asm/fixmap.h>
  11 #include <asm/insn.h>
  12 #include <asm/kprobes.h>
  13 #include <asm/text-patching.h>
  14 #include <asm/sections.h>
  15
  16 static DEFINE_RAW_SPINLOCK(patch_lock);
  17
  18 static bool is_exit_text(unsigned long addr)
  19 {
  20         /* discarded with init text/data */
  21         return system_state < SYSTEM_RUNNING &&
  22                 addr >= (unsigned long)__exittext_begin &&
  23                 addr < (unsigned long)__exittext_end;
  24 }
  25
  26 static bool is_image_text(unsigned long addr)
  27 {
  28         return core_kernel_text(addr) || is_exit_text(addr);
  29 }
  30
  31 static void __kprobes *patch_map(void *addr, int fixmap)
  32 {
  33         phys_addr_t phys;
  34
  35         if (is_image_text((unsigned long)addr)) {
  36                 phys = __pa_symbol(addr);
  37         } else {
  38                 struct page *page = vmalloc_to_page(addr);
  39                 BUG_ON(!page);
  40                 phys = page_to_phys(page) + offset_in_page(addr);
  41         }
  42
  43         return (void *)set_fixmap_offset(fixmap, phys);
  44 }
  45
  46 static void __kprobes patch_unmap(int fixmap)
  47 {
  48         clear_fixmap(fixmap);
  49 }
  50 /*
  51  * In ARMv8-A, A64 instructions have a fixed length of 32 bits and are always
  52  * little-endian.
  53  */
  54 int __kprobes aarch64_insn_read(void *addr, u32 *insnp)
  55 {
  56         int ret;
  57         __le32 val;
  58
  59         ret = copy_from_kernel_nofault(&val, addr, AARCH64_INSN_SIZE);
  60         if (!ret)
  61                 *insnp = le32_to_cpu(val);
  62
  63         return ret;
  64 }
  65
  66 static int __kprobes __aarch64_insn_write(void *addr, __le32 insn)
  67 {
  68         void *waddr = addr;
  69         unsigned long flags = 0;
  70         int ret;
  71
  72         raw_spin_lock_irqsave(&patch_lock, flags);
  73         waddr = patch_map(addr, FIX_TEXT_POKE0);
  74
  75         ret = copy_to_kernel_nofault(waddr, &insn, AARCH64_INSN_SIZE);
  76
  77         patch_unmap(FIX_TEXT_POKE0);
  78         raw_spin_unlock_irqrestore(&patch_lock, flags);
  79
  80         return ret;
  81 }
  82
  83 int __kprobes aarch64_insn_write(void *addr, u32 insn)
  84 {
  85         return __aarch64_insn_write(addr, cpu_to_le32(insn));
  86 }
  87
  88 noinstr int aarch64_insn_write_literal_u64(void *addr, u64 val)
  89 {
  90         u64 *waddr;
  91         unsigned long flags;
  92         int ret;
  93
  94         raw_spin_lock_irqsave(&patch_lock, flags);
  95         waddr = patch_map(addr, FIX_TEXT_POKE0);
  96
  97         ret = copy_to_kernel_nofault(waddr, &val, sizeof(val));
  98
  99         patch_unmap(FIX_TEXT_POKE0);
 100         raw_spin_unlock_irqrestore(&patch_lock, flags);
 101
 102         return ret;
 103 }
 104
 105 typedef void text_poke_f(void *dst, void *src, size_t patched, size_t len);
 106
 107 static void *__text_poke(text_poke_f func, void *addr, void *src, size_t len)
 108 {
 109         unsigned long flags;
 110         size_t patched = 0;
 111         size_t size;
 112         void *waddr;
 113         void *ptr;
 114
 115         raw_spin_lock_irqsave(&patch_lock, flags);
 116
 117         while (patched < len) {
 118                 ptr = addr + patched;
 119                 size = min_t(size_t, PAGE_SIZE - offset_in_page(ptr),
 120                              len - patched);
 121
 122                 waddr = patch_map(ptr, FIX_TEXT_POKE0);
 123                 func(waddr, src, patched, size);
 124                 patch_unmap(FIX_TEXT_POKE0);
 125
 126                 patched += size;
 127         }
 128         raw_spin_unlock_irqrestore(&patch_lock, flags);
 129
 130         flush_icache_range((uintptr_t)addr, (uintptr_t)addr + len);
 131
 132         return addr;
 133 }
 134
 135 static void text_poke_memcpy(void *dst, void *src, size_t patched, size_t len)
 136 {
 137         copy_to_kernel_nofault(dst, src + patched, len);
 138 }
 139
 140 static void text_poke_memset(void *dst, void *src, size_t patched, size_t len)
 141 {
 142         u32 c = *(u32 *)src;
 143
 144         memset32(dst, c, len / 4);
 145 }
 146
 147 /**
 148  * aarch64_insn_copy - Copy instructions into (an unused part of) RX memory
 149  * @dst: address to modify
 150  * @src: source of the copy
 151  * @len: length to copy
 152  *
 153  * Useful for JITs to dump new code blocks into unused regions of RX memory.
 154  */
 155 noinstr void *aarch64_insn_copy(void *dst, void *src, size_t len)
 156 {
 157         /* A64 instructions must be word aligned */
 158         if ((uintptr_t)dst & 0x3)
 159                 return NULL;
 160
 161         return __text_poke(text_poke_memcpy, dst, src, len);
 162 }
 163
 164 /**
 165  * aarch64_insn_set - memset for RX memory regions.
 166  * @dst: address to modify
 167  * @insn: value to set
 168  * @len: length of memory region.
 169  *
 170  * Useful for JITs to fill regions of RX memory with illegal instructions.
 171  */
 172 noinstr void *aarch64_insn_set(void *dst, u32 insn, size_t len)
 173 {
 174         if ((uintptr_t)dst & 0x3)
 175                 return NULL;
 176
 177         return __text_poke(text_poke_memset, dst, &insn, len);
 178 }
 179
 180 int __kprobes aarch64_insn_patch_text_nosync(void *addr, u32 insn)
 181 {
 182         u32 *tp = addr;
 183         int ret;
 184
 185         /* A64 instructions must be word aligned */
 186         if ((uintptr_t)tp & 0x3)
 187                 return -EINVAL;
 188
 189         ret = aarch64_insn_write(tp, insn);
 190         if (ret == 0)
 191                 caches_clean_inval_pou((uintptr_t)tp,
 192                                      (uintptr_t)tp + AARCH64_INSN_SIZE);
 193
 194         return ret;
 195 }
 196
 197 struct aarch64_insn_patch {
 198         void            **text_addrs;
 199         u32             *new_insns;
 200         int             insn_cnt;
 201         atomic_t        cpu_count;
 202 };
 203
 204 static int __kprobes aarch64_insn_patch_text_cb(void *arg)
 205 {
 206         int i, ret = 0;
 207         struct aarch64_insn_patch *pp = arg;
 208
 209         /* The last CPU becomes master */
 210         if (atomic_inc_return(&pp->cpu_count) == num_online_cpus()) {
 211                 for (i = 0; ret == 0 && i < pp->insn_cnt; i++)
 212                         ret = aarch64_insn_patch_text_nosync(pp->text_addrs[i],
 213                                                              pp->new_insns[i]);
 214                 /* Notify other processors with an additional increment. */
 215                 atomic_inc(&pp->cpu_count);
 216         } else {
 217                 while (atomic_read(&pp->cpu_count) <= num_online_cpus())
 218                         cpu_relax();
 219                 isb();
 220         }
 221
 222         return ret;
 223 }
 224
 225 int __kprobes aarch64_insn_patch_text(void *addrs[], u32 insns[], int cnt)
 226 {
 227         struct aarch64_insn_patch patch = {
 228                 .text_addrs = addrs,
 229                 .new_insns = insns,
 230                 .insn_cnt = cnt,
 231                 .cpu_count = ATOMIC_INIT(0),
 232         };
 233
 234         if (cnt <= 0)
 235                 return -EINVAL;
 236
 237         return stop_machine_cpuslocked(aarch64_insn_patch_text_cb, &patch,
 238                                        cpu_online_mask);
 239 }