1 // SPDX-License-Identifier: GPL-2.0-only 2 #include <linux/kernel.h> 3 #include <linux/mm.h> 4 #include <linux/smp.h> 5 #include <linux/spinlock.h> 6 #include <linux/stop_machine.h> 7 #include <linux/uaccess.h> 8 9 #include <asm/cacheflush.h> 10 #include <asm/fixmap.h> 11 #include <asm/insn.h> 12 #include <asm/kprobes.h> 13 #include <asm/text-patching.h> 14 #include <asm/sections.h> 15 16 static DEFINE_RAW_SPINLOCK(patch_lock); 17 18 static bool is_exit_text(unsigned long addr) 19 { 20 /* discarded with init text/data */ 21 return system_state < SYSTEM_RUNNING && 22 addr >= (unsigned long)__exittext_begin && 23 addr < (unsigned long)__exittext_end; 24 } 25 26 static bool is_image_text(unsigned long addr) 27 { 28 return core_kernel_text(addr) || is_exit_text(addr); 29 } 30 31 static void __kprobes *patch_map(void *addr, int fixmap) 32 { 33 phys_addr_t phys; 34 35 if (is_image_text((unsigned long)addr)) { 36 phys = __pa_symbol(addr); 37 } else { 38 struct page *page = vmalloc_to_page(addr); 39 BUG_ON(!page); 40 phys = page_to_phys(page) + offset_in_page(addr); 41 } 42 43 return (void *)set_fixmap_offset(fixmap, phys); 44 } 45 46 static void __kprobes patch_unmap(int fixmap) 47 { 48 clear_fixmap(fixmap); 49 } 50 /* 51 * In ARMv8-A, A64 instructions have a fixed length of 32 bits and are always 52 * little-endian. 53 */ 54 int __kprobes aarch64_insn_read(void *addr, u32 *insnp) 55 { 56 int ret; 57 __le32 val; 58 59 ret = copy_from_kernel_nofault(&val, addr, AARCH64_INSN_SIZE); 60 if (!ret) 61 *insnp = le32_to_cpu(val); 62 63 return ret; 64 } 65 66 static int __kprobes __aarch64_insn_write(void *addr, __le32 insn) 67 { 68 void *waddr = addr; 69 unsigned long flags = 0; 70 int ret; 71 72 raw_spin_lock_irqsave(&patch_lock, flags); 73 waddr = patch_map(addr, FIX_TEXT_POKE0); 74 75 ret = copy_to_kernel_nofault(waddr, &insn, AARCH64_INSN_SIZE); 76 77 patch_unmap(FIX_TEXT_POKE0); 78 raw_spin_unlock_irqrestore(&patch_lock, flags); 79 80 return ret; 81 } 82 83 int __kprobes aarch64_insn_write(void *addr, u32 insn) 84 { 85 return __aarch64_insn_write(addr, cpu_to_le32(insn)); 86 } 87 88 noinstr int aarch64_insn_write_literal_u64(void *addr, u64 val) 89 { 90 u64 *waddr; 91 unsigned long flags; 92 int ret; 93 94 raw_spin_lock_irqsave(&patch_lock, flags); 95 waddr = patch_map(addr, FIX_TEXT_POKE0); 96 97 ret = copy_to_kernel_nofault(waddr, &val, sizeof(val)); 98 99 patch_unmap(FIX_TEXT_POKE0); 100 raw_spin_unlock_irqrestore(&patch_lock, flags); 101 102 return ret; 103 } 104 105 typedef void text_poke_f(void *dst, void *src, size_t patched, size_t len); 106 107 static void *__text_poke(text_poke_f func, void *addr, void *src, size_t len) 108 { 109 unsigned long flags; 110 size_t patched = 0; 111 size_t size; 112 void *waddr; 113 void *ptr; 114 115 raw_spin_lock_irqsave(&patch_lock, flags); 116 117 while (patched < len) { 118 ptr = addr + patched; 119 size = min_t(size_t, PAGE_SIZE - offset_in_page(ptr), 120 len - patched); 121 122 waddr = patch_map(ptr, FIX_TEXT_POKE0); 123 func(waddr, src, patched, size); 124 patch_unmap(FIX_TEXT_POKE0); 125 126 patched += size; 127 } 128 raw_spin_unlock_irqrestore(&patch_lock, flags); 129 130 flush_icache_range((uintptr_t)addr, (uintptr_t)addr + len); 131 132 return addr; 133 } 134 135 static void text_poke_memcpy(void *dst, void *src, size_t patched, size_t len) 136 { 137 copy_to_kernel_nofault(dst, src + patched, len); 138 } 139 140 static void text_poke_memset(void *dst, void *src, size_t patched, size_t len) 141 { 142 u32 c = *(u32 *)src; 143 144 memset32(dst, c, len / 4); 145 } 146 147 /** 148 * aarch64_insn_copy - Copy instructions into (an unused part of) RX memory 149 * @dst: address to modify 150 * @src: source of the copy 151 * @len: length to copy 152 * 153 * Useful for JITs to dump new code blocks into unused regions of RX memory. 154 */ 155 noinstr void *aarch64_insn_copy(void *dst, void *src, size_t len) 156 { 157 /* A64 instructions must be word aligned */ 158 if ((uintptr_t)dst & 0x3) 159 return NULL; 160 161 return __text_poke(text_poke_memcpy, dst, src, len); 162 } 163 164 /** 165 * aarch64_insn_set - memset for RX memory regions. 166 * @dst: address to modify 167 * @insn: value to set 168 * @len: length of memory region. 169 * 170 * Useful for JITs to fill regions of RX memory with illegal instructions. 171 */ 172 noinstr void *aarch64_insn_set(void *dst, u32 insn, size_t len) 173 { 174 if ((uintptr_t)dst & 0x3) 175 return NULL; 176 177 return __text_poke(text_poke_memset, dst, &insn, len); 178 } 179 180 int __kprobes aarch64_insn_patch_text_nosync(void *addr, u32 insn) 181 { 182 u32 *tp = addr; 183 int ret; 184 185 /* A64 instructions must be word aligned */ 186 if ((uintptr_t)tp & 0x3) 187 return -EINVAL; 188 189 ret = aarch64_insn_write(tp, insn); 190 if (ret == 0) 191 caches_clean_inval_pou((uintptr_t)tp, 192 (uintptr_t)tp + AARCH64_INSN_SIZE); 193 194 return ret; 195 } 196 197 struct aarch64_insn_patch { 198 void **text_addrs; 199 u32 *new_insns; 200 int insn_cnt; 201 atomic_t cpu_count; 202 }; 203 204 static int __kprobes aarch64_insn_patch_text_cb(void *arg) 205 { 206 int i, ret = 0; 207 struct aarch64_insn_patch *pp = arg; 208 209 /* The last CPU becomes master */ 210 if (atomic_inc_return(&pp->cpu_count) == num_online_cpus()) { 211 for (i = 0; ret == 0 && i < pp->insn_cnt; i++) 212 ret = aarch64_insn_patch_text_nosync(pp->text_addrs[i], 213 pp->new_insns[i]); 214 /* Notify other processors with an additional increment. */ 215 atomic_inc(&pp->cpu_count); 216 } else { 217 while (atomic_read(&pp->cpu_count) <= num_online_cpus()) 218 cpu_relax(); 219 isb(); 220 } 221 222 return ret; 223 } 224 225 int __kprobes aarch64_insn_patch_text(void *addrs[], u32 insns[], int cnt) 226 { 227 struct aarch64_insn_patch patch = { 228 .text_addrs = addrs, 229 .new_insns = insns, 230 .insn_cnt = cnt, 231 .cpu_count = ATOMIC_INIT(0), 232 }; 233 234 if (cnt <= 0) 235 return -EINVAL; 236 237 return stop_machine_cpuslocked(aarch64_insn_patch_text_cb, &patch, 238 cpu_online_mask); 239 } 240