1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (C) 2020 SiFive
4 */
5
6 #include <linux/spinlock.h>
7 #include <linux/mm.h>
8 #include <linux/memory.h>
9 #include <linux/string.h>
10 #include <linux/uaccess.h>
11 #include <linux/stop_machine.h>
12 #include <asm/kprobes.h>
13 #include <asm/cacheflush.h>
14 #include <asm/fixmap.h>
15 #include <asm/ftrace.h>
16 #include <asm/patch.h>
17 #include <asm/sections.h>
18
19 struct patch_insn {
20 void *addr;
21 u32 *insns;
22 int ninsns;
23 atomic_t cpu_count;
24 };
25
26 int riscv_patch_in_stop_machine = false;
27
28 #ifdef CONFIG_MMU
29
is_kernel_exittext(uintptr_t addr)30 static inline bool is_kernel_exittext(uintptr_t addr)
31 {
32 return system_state < SYSTEM_RUNNING &&
33 addr >= (uintptr_t)__exittext_begin &&
34 addr < (uintptr_t)__exittext_end;
35 }
36
37 /*
38 * The fix_to_virt(, idx) needs a const value (not a dynamic variable of
39 * reg-a0) or BUILD_BUG_ON failed with "idx >= __end_of_fixed_addresses".
40 * So use '__always_inline' and 'const unsigned int fixmap' here.
41 */
patch_map(void * addr,const unsigned int fixmap)42 static __always_inline void *patch_map(void *addr, const unsigned int fixmap)
43 {
44 uintptr_t uintaddr = (uintptr_t) addr;
45 struct page *page;
46
47 if (core_kernel_text(uintaddr) || is_kernel_exittext(uintaddr))
48 page = phys_to_page(__pa_symbol(addr));
49 else if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX))
50 page = vmalloc_to_page(addr);
51 else
52 return addr;
53
54 BUG_ON(!page);
55
56 return (void *)set_fixmap_offset(fixmap, page_to_phys(page) +
57 (uintaddr & ~PAGE_MASK));
58 }
59
patch_unmap(int fixmap)60 static void patch_unmap(int fixmap)
61 {
62 clear_fixmap(fixmap);
63 }
64 NOKPROBE_SYMBOL(patch_unmap);
65
__patch_insn_set(void * addr,u8 c,size_t len)66 static int __patch_insn_set(void *addr, u8 c, size_t len)
67 {
68 void *waddr = addr;
69 bool across_pages = (((uintptr_t)addr & ~PAGE_MASK) + len) > PAGE_SIZE;
70
71 /*
72 * Only two pages can be mapped at a time for writing.
73 */
74 if (len + offset_in_page(addr) > 2 * PAGE_SIZE)
75 return -EINVAL;
76 /*
77 * Before reaching here, it was expected to lock the text_mutex
78 * already, so we don't need to give another lock here and could
79 * ensure that it was safe between each cores.
80 */
81 lockdep_assert_held(&text_mutex);
82
83 preempt_disable();
84
85 if (across_pages)
86 patch_map(addr + PAGE_SIZE, FIX_TEXT_POKE1);
87
88 waddr = patch_map(addr, FIX_TEXT_POKE0);
89
90 memset(waddr, c, len);
91
92 patch_unmap(FIX_TEXT_POKE0);
93
94 if (across_pages)
95 patch_unmap(FIX_TEXT_POKE1);
96
97 preempt_enable();
98
99 return 0;
100 }
101 NOKPROBE_SYMBOL(__patch_insn_set);
102
__patch_insn_write(void * addr,const void * insn,size_t len)103 static int __patch_insn_write(void *addr, const void *insn, size_t len)
104 {
105 void *waddr = addr;
106 bool across_pages = (((uintptr_t) addr & ~PAGE_MASK) + len) > PAGE_SIZE;
107 int ret;
108
109 /*
110 * Only two pages can be mapped at a time for writing.
111 */
112 if (len + offset_in_page(addr) > 2 * PAGE_SIZE)
113 return -EINVAL;
114
115 /*
116 * Before reaching here, it was expected to lock the text_mutex
117 * already, so we don't need to give another lock here and could
118 * ensure that it was safe between each cores.
119 *
120 * We're currently using stop_machine() for ftrace & kprobes, and while
121 * that ensures text_mutex is held before installing the mappings it
122 * does not ensure text_mutex is held by the calling thread. That's
123 * safe but triggers a lockdep failure, so just elide it for that
124 * specific case.
125 */
126 if (!riscv_patch_in_stop_machine)
127 lockdep_assert_held(&text_mutex);
128
129 preempt_disable();
130
131 if (across_pages)
132 patch_map(addr + PAGE_SIZE, FIX_TEXT_POKE1);
133
134 waddr = patch_map(addr, FIX_TEXT_POKE0);
135
136 ret = copy_to_kernel_nofault(waddr, insn, len);
137
138 patch_unmap(FIX_TEXT_POKE0);
139
140 if (across_pages)
141 patch_unmap(FIX_TEXT_POKE1);
142
143 preempt_enable();
144
145 return ret;
146 }
147 NOKPROBE_SYMBOL(__patch_insn_write);
148 #else
__patch_insn_set(void * addr,u8 c,size_t len)149 static int __patch_insn_set(void *addr, u8 c, size_t len)
150 {
151 memset(addr, c, len);
152
153 return 0;
154 }
155 NOKPROBE_SYMBOL(__patch_insn_set);
156
__patch_insn_write(void * addr,const void * insn,size_t len)157 static int __patch_insn_write(void *addr, const void *insn, size_t len)
158 {
159 return copy_to_kernel_nofault(addr, insn, len);
160 }
161 NOKPROBE_SYMBOL(__patch_insn_write);
162 #endif /* CONFIG_MMU */
163
patch_insn_set(void * addr,u8 c,size_t len)164 static int patch_insn_set(void *addr, u8 c, size_t len)
165 {
166 size_t patched = 0;
167 size_t size;
168 int ret = 0;
169
170 /*
171 * __patch_insn_set() can only work on 2 pages at a time so call it in a
172 * loop with len <= 2 * PAGE_SIZE.
173 */
174 while (patched < len && !ret) {
175 size = min_t(size_t, PAGE_SIZE * 2 - offset_in_page(addr + patched), len - patched);
176 ret = __patch_insn_set(addr + patched, c, size);
177
178 patched += size;
179 }
180
181 return ret;
182 }
183 NOKPROBE_SYMBOL(patch_insn_set);
184
patch_text_set_nosync(void * addr,u8 c,size_t len)185 int patch_text_set_nosync(void *addr, u8 c, size_t len)
186 {
187 u32 *tp = addr;
188 int ret;
189
190 ret = patch_insn_set(tp, c, len);
191
192 if (!ret)
193 flush_icache_range((uintptr_t)tp, (uintptr_t)tp + len);
194
195 return ret;
196 }
197 NOKPROBE_SYMBOL(patch_text_set_nosync);
198
patch_insn_write(void * addr,const void * insn,size_t len)199 int patch_insn_write(void *addr, const void *insn, size_t len)
200 {
201 size_t patched = 0;
202 size_t size;
203 int ret = 0;
204
205 /*
206 * Copy the instructions to the destination address, two pages at a time
207 * because __patch_insn_write() can only handle len <= 2 * PAGE_SIZE.
208 */
209 while (patched < len && !ret) {
210 size = min_t(size_t, PAGE_SIZE * 2 - offset_in_page(addr + patched), len - patched);
211 ret = __patch_insn_write(addr + patched, insn + patched, size);
212
213 patched += size;
214 }
215
216 return ret;
217 }
218 NOKPROBE_SYMBOL(patch_insn_write);
219
patch_text_nosync(void * addr,const void * insns,size_t len)220 int patch_text_nosync(void *addr, const void *insns, size_t len)
221 {
222 u32 *tp = addr;
223 int ret;
224
225 ret = patch_insn_write(tp, insns, len);
226
227 if (!ret)
228 flush_icache_range((uintptr_t) tp, (uintptr_t) tp + len);
229
230 return ret;
231 }
232 NOKPROBE_SYMBOL(patch_text_nosync);
233
patch_text_cb(void * data)234 static int patch_text_cb(void *data)
235 {
236 struct patch_insn *patch = data;
237 unsigned long len;
238 int i, ret = 0;
239
240 if (atomic_inc_return(&patch->cpu_count) == num_online_cpus()) {
241 for (i = 0; ret == 0 && i < patch->ninsns; i++) {
242 len = GET_INSN_LENGTH(patch->insns[i]);
243 ret = patch_insn_write(patch->addr + i * len, &patch->insns[i], len);
244 }
245 /*
246 * Make sure the patching store is effective *before* we
247 * increment the counter which releases all waiting CPUs
248 * by using the release variant of atomic increment. The
249 * release pairs with the call to local_flush_icache_all()
250 * on the waiting CPU.
251 */
252 atomic_inc_return_release(&patch->cpu_count);
253 } else {
254 while (atomic_read(&patch->cpu_count) <= num_online_cpus())
255 cpu_relax();
256 smp_mb();
257 }
258
259 local_flush_icache_all();
260
261 return ret;
262 }
263 NOKPROBE_SYMBOL(patch_text_cb);
264
patch_text(void * addr,u32 * insns,int ninsns)265 int patch_text(void *addr, u32 *insns, int ninsns)
266 {
267 int ret;
268 struct patch_insn patch = {
269 .addr = addr,
270 .insns = insns,
271 .ninsns = ninsns,
272 .cpu_count = ATOMIC_INIT(0),
273 };
274
275 /*
276 * kprobes takes text_mutex, before calling patch_text(), but as we call
277 * calls stop_machine(), the lockdep assertion in patch_insn_write()
278 * gets confused by the context in which the lock is taken.
279 * Instead, ensure the lock is held before calling stop_machine(), and
280 * set riscv_patch_in_stop_machine to skip the check in
281 * patch_insn_write().
282 */
283 lockdep_assert_held(&text_mutex);
284 riscv_patch_in_stop_machine = true;
285 ret = stop_machine_cpuslocked(patch_text_cb, &patch, cpu_online_mask);
286 riscv_patch_in_stop_machine = false;
287 return ret;
288 }
289 NOKPROBE_SYMBOL(patch_text);
290