1// SPDX-License-Identifier: GPL-2.0-only
2#include <linux/kernel.h>
3#include <linux/mm.h>
4#include <linux/smp.h>
5#include <linux/spinlock.h>
6#include <linux/stop_machine.h>
7#include <linux/uaccess.h>
8
9#include <asm/cacheflush.h>
10#include <asm/fixmap.h>
11#include <asm/insn.h>
12#include <asm/kprobes.h>
13#include <asm/text-patching.h>
14#include <asm/sections.h>
15
16static DEFINE_RAW_SPINLOCK(patch_lock);
17
18static bool is_exit_text(unsigned long addr)
19{
20 /* discarded with init text/data */
21 return system_state < SYSTEM_RUNNING &&
22 addr >= (unsigned long)__exittext_begin &&
23 addr < (unsigned long)__exittext_end;
24}
25
26static bool is_image_text(unsigned long addr)
27{
28 return core_kernel_text(addr) || is_exit_text(addr);
29}
30
31static void __kprobes *patch_map(void *addr, int fixmap)
32{
33 phys_addr_t phys;
34
35 if (is_image_text(addr: (unsigned long)addr)) {
36 phys = __pa_symbol(addr);
37 } else {
38 struct page *page = vmalloc_to_page(addr);
39 BUG_ON(!page);
40 phys = page_to_phys(page) + offset_in_page(addr);
41 }
42
43 return (void *)set_fixmap_offset(fixmap, phys);
44}
45
46static void __kprobes patch_unmap(int fixmap)
47{
48 clear_fixmap(fixmap);
49}
50/*
51 * In ARMv8-A, A64 instructions have a fixed length of 32 bits and are always
52 * little-endian.
53 */
54int __kprobes aarch64_insn_read(void *addr, u32 *insnp)
55{
56 int ret;
57 __le32 val;
58
59 ret = copy_from_kernel_nofault(dst: &val, src: addr, size: AARCH64_INSN_SIZE);
60 if (!ret)
61 *insnp = le32_to_cpu(val);
62
63 return ret;
64}
65
66static int __kprobes __aarch64_insn_write(void *addr, __le32 insn)
67{
68 void *waddr = addr;
69 unsigned long flags = 0;
70 int ret;
71
72 raw_spin_lock_irqsave(&patch_lock, flags);
73 waddr = patch_map(addr, fixmap: FIX_TEXT_POKE0);
74
75 ret = copy_to_kernel_nofault(dst: waddr, src: &insn, size: AARCH64_INSN_SIZE);
76
77 patch_unmap(fixmap: FIX_TEXT_POKE0);
78 raw_spin_unlock_irqrestore(&patch_lock, flags);
79
80 return ret;
81}
82
83int __kprobes aarch64_insn_write(void *addr, u32 insn)
84{
85 return __aarch64_insn_write(addr, cpu_to_le32(insn));
86}
87
88noinstr int aarch64_insn_write_literal_u64(void *addr, u64 val)
89{
90 u64 *waddr;
91 unsigned long flags;
92 int ret;
93
94 raw_spin_lock_irqsave(&patch_lock, flags);
95 waddr = patch_map(addr, fixmap: FIX_TEXT_POKE0);
96
97 ret = copy_to_kernel_nofault(dst: waddr, src: &val, size: sizeof(val));
98
99 patch_unmap(fixmap: FIX_TEXT_POKE0);
100 raw_spin_unlock_irqrestore(&patch_lock, flags);
101
102 return ret;
103}
104
105typedef void text_poke_f(void *dst, void *src, size_t patched, size_t len);
106
107static void *__text_poke(text_poke_f func, void *addr, void *src, size_t len)
108{
109 unsigned long flags;
110 size_t patched = 0;
111 size_t size;
112 void *waddr;
113 void *ptr;
114
115 raw_spin_lock_irqsave(&patch_lock, flags);
116
117 while (patched < len) {
118 ptr = addr + patched;
119 size = min_t(size_t, PAGE_SIZE - offset_in_page(ptr),
120 len - patched);
121
122 waddr = patch_map(addr: ptr, fixmap: FIX_TEXT_POKE0);
123 func(waddr, src, patched, size);
124 patch_unmap(fixmap: FIX_TEXT_POKE0);
125
126 patched += size;
127 }
128 raw_spin_unlock_irqrestore(&patch_lock, flags);
129
130 flush_icache_range(start: (uintptr_t)addr, end: (uintptr_t)addr + len);
131
132 return addr;
133}
134
135static void text_poke_memcpy(void *dst, void *src, size_t patched, size_t len)
136{
137 copy_to_kernel_nofault(dst, src: src + patched, size: len);
138}
139
140static void text_poke_memset(void *dst, void *src, size_t patched, size_t len)
141{
142 u32 c = *(u32 *)src;
143
144 memset32(s: dst, v: c, n: len / 4);
145}
146
147/**
148 * aarch64_insn_copy - Copy instructions into (an unused part of) RX memory
149 * @dst: address to modify
150 * @src: source of the copy
151 * @len: length to copy
152 *
153 * Useful for JITs to dump new code blocks into unused regions of RX memory.
154 */
155noinstr void *aarch64_insn_copy(void *dst, void *src, size_t len)
156{
157 /* A64 instructions must be word aligned */
158 if ((uintptr_t)dst & 0x3)
159 return NULL;
160
161 return __text_poke(func: text_poke_memcpy, addr: dst, src, len);
162}
163
164/**
165 * aarch64_insn_set - memset for RX memory regions.
166 * @dst: address to modify
167 * @insn: value to set
168 * @len: length of memory region.
169 *
170 * Useful for JITs to fill regions of RX memory with illegal instructions.
171 */
172noinstr void *aarch64_insn_set(void *dst, u32 insn, size_t len)
173{
174 if ((uintptr_t)dst & 0x3)
175 return NULL;
176
177 return __text_poke(func: text_poke_memset, addr: dst, src: &insn, len);
178}
179
180int __kprobes aarch64_insn_patch_text_nosync(void *addr, u32 insn)
181{
182 u32 *tp = addr;
183 int ret;
184
185 /* A64 instructions must be word aligned */
186 if ((uintptr_t)tp & 0x3)
187 return -EINVAL;
188
189 ret = aarch64_insn_write(addr: tp, insn);
190 if (ret == 0)
191 caches_clean_inval_pou((uintptr_t)tp,
192 (uintptr_t)tp + AARCH64_INSN_SIZE);
193
194 return ret;
195}
196
197struct aarch64_insn_patch {
198 void **text_addrs;
199 u32 *new_insns;
200 int insn_cnt;
201 atomic_t cpu_count;
202};
203
204static int __kprobes aarch64_insn_patch_text_cb(void *arg)
205{
206 int i, ret = 0;
207 struct aarch64_insn_patch *pp = arg;
208
209 /* The last CPU becomes master */
210 if (atomic_inc_return(v: &pp->cpu_count) == num_online_cpus()) {
211 for (i = 0; ret == 0 && i < pp->insn_cnt; i++)
212 ret = aarch64_insn_patch_text_nosync(addr: pp->text_addrs[i],
213 insn: pp->new_insns[i]);
214 /* Notify other processors with an additional increment. */
215 atomic_inc(v: &pp->cpu_count);
216 } else {
217 while (atomic_read(v: &pp->cpu_count) <= num_online_cpus())
218 cpu_relax();
219 isb();
220 }
221
222 return ret;
223}
224
225int __kprobes aarch64_insn_patch_text(void *addrs[], u32 insns[], int cnt)
226{
227 struct aarch64_insn_patch patch = {
228 .text_addrs = addrs,
229 .new_insns = insns,
230 .insn_cnt = cnt,
231 .cpu_count = ATOMIC_INIT(0),
232 };
233
234 if (cnt <= 0)
235 return -EINVAL;
236
237 return stop_machine_cpuslocked(fn: aarch64_insn_patch_text_cb, data: &patch,
238 cpu_online_mask);
239}
240

source code of linux/arch/arm64/kernel/patching.c