1b2441318SGreg Kroah-Hartman /* SPDX-License-Identifier: GPL-2.0 */ 235de5b06SAndy Lutomirski #ifndef _ASM_X86_TEXT_PATCHING_H 335de5b06SAndy Lutomirski #define _ASM_X86_TEXT_PATCHING_H 435de5b06SAndy Lutomirski 535de5b06SAndy Lutomirski #include <linux/types.h> 635de5b06SAndy Lutomirski #include <linux/stddef.h> 735de5b06SAndy Lutomirski #include <asm/ptrace.h> 835de5b06SAndy Lutomirski 935de5b06SAndy Lutomirski struct paravirt_patch_site; 1035de5b06SAndy Lutomirski #ifdef CONFIG_PARAVIRT 1135de5b06SAndy Lutomirski void apply_paravirt(struct paravirt_patch_site *start, 1235de5b06SAndy Lutomirski struct paravirt_patch_site *end); 1335de5b06SAndy Lutomirski #else 1435de5b06SAndy Lutomirski static inline void apply_paravirt(struct paravirt_patch_site *start, 1535de5b06SAndy Lutomirski struct paravirt_patch_site *end) 1635de5b06SAndy Lutomirski {} 1735de5b06SAndy Lutomirski #define __parainstructions NULL 1835de5b06SAndy Lutomirski #define __parainstructions_end NULL 1935de5b06SAndy Lutomirski #endif 2035de5b06SAndy Lutomirski 21c0213b0aSDaniel Bristot de Oliveira /* 22c0213b0aSDaniel Bristot de Oliveira * Currently, the max observed size in the kernel code is 23c0213b0aSDaniel Bristot de Oliveira * JUMP_LABEL_NOP_SIZE/RELATIVEJUMP_SIZE, which are 5. 24c0213b0aSDaniel Bristot de Oliveira * Raise it if needed. 25c0213b0aSDaniel Bristot de Oliveira */ 26c0213b0aSDaniel Bristot de Oliveira #define POKE_MAX_OPCODE_SIZE 5 27c0213b0aSDaniel Bristot de Oliveira 280a203df5SNadav Amit extern void text_poke_early(void *addr, const void *opcode, size_t len); 2935de5b06SAndy Lutomirski 3035de5b06SAndy Lutomirski /* 3135de5b06SAndy Lutomirski * Clear and restore the kernel write-protection flag on the local CPU. 3235de5b06SAndy Lutomirski * Allows the kernel to edit read-only pages. 3335de5b06SAndy Lutomirski * Side-effect: any interrupt handler running between save and restore will have 3435de5b06SAndy Lutomirski * the ability to write to read-only pages. 3535de5b06SAndy Lutomirski * 3635de5b06SAndy Lutomirski * Warning: 3735de5b06SAndy Lutomirski * Code patching in the UP case is safe if NMIs and MCE handlers are stopped and 3835de5b06SAndy Lutomirski * no thread can be preempted in the instructions being modified (no iret to an 3935de5b06SAndy Lutomirski * invalid instruction possible) or if the instructions are changed from a 4035de5b06SAndy Lutomirski * consistent state to another consistent state atomically. 4132b1cbe3SMarco Ammon * On the local CPU you need to be protected against NMI or MCE handlers seeing 4232b1cbe3SMarco Ammon * an inconsistent instruction while you patch. 4335de5b06SAndy Lutomirski */ 4435de5b06SAndy Lutomirski extern void *text_poke(void *addr, const void *opcode, size_t len); 455c02ece8SPeter Zijlstra extern void text_poke_sync(void); 46e836673cSNadav Amit extern void *text_poke_kgdb(void *addr, const void *opcode, size_t len); 4735de5b06SAndy Lutomirski extern int poke_int3_handler(struct pt_regs *regs); 48c3d6324fSPeter Zijlstra extern void text_poke_bp(void *addr, const void *opcode, size_t len, const void *emulate); 4918cbc8beSPeter Zijlstra 5018cbc8beSPeter Zijlstra extern void text_poke_queue(void *addr, const void *opcode, size_t len, const void *emulate); 5118cbc8beSPeter Zijlstra extern void text_poke_finish(void); 5218cbc8beSPeter Zijlstra 534b33dadfSPeter Zijlstra #define INT3_INSN_SIZE 1 54c3d6324fSPeter Zijlstra #define INT3_INSN_OPCODE 0xCC 55c3d6324fSPeter Zijlstra 564b33dadfSPeter Zijlstra #define CALL_INSN_SIZE 5 57c3d6324fSPeter Zijlstra #define CALL_INSN_OPCODE 0xE8 58c3d6324fSPeter Zijlstra 59c3d6324fSPeter Zijlstra #define JMP32_INSN_SIZE 5 60c3d6324fSPeter Zijlstra #define JMP32_INSN_OPCODE 0xE9 61c3d6324fSPeter Zijlstra 62c3d6324fSPeter Zijlstra #define JMP8_INSN_SIZE 2 63c3d6324fSPeter Zijlstra #define JMP8_INSN_OPCODE 0xEB 644b33dadfSPeter Zijlstra 65ab09e95cSPeter Zijlstra #define DISP32_SIZE 4 66ab09e95cSPeter Zijlstra 674979fb53SThomas Gleixner static __always_inline int text_opcode_size(u8 opcode) 68254d2c04SPeter Zijlstra { 69254d2c04SPeter Zijlstra int size = 0; 70254d2c04SPeter Zijlstra 71254d2c04SPeter Zijlstra #define __CASE(insn) \ 72254d2c04SPeter Zijlstra case insn##_INSN_OPCODE: size = insn##_INSN_SIZE; break 73254d2c04SPeter Zijlstra 74254d2c04SPeter Zijlstra switch(opcode) { 75254d2c04SPeter Zijlstra __CASE(INT3); 76254d2c04SPeter Zijlstra __CASE(CALL); 77254d2c04SPeter Zijlstra __CASE(JMP32); 78254d2c04SPeter Zijlstra __CASE(JMP8); 79254d2c04SPeter Zijlstra } 80254d2c04SPeter Zijlstra 81254d2c04SPeter Zijlstra #undef __CASE 82254d2c04SPeter Zijlstra 83254d2c04SPeter Zijlstra return size; 84254d2c04SPeter Zijlstra } 85254d2c04SPeter Zijlstra 8667c1d4a2SPeter Zijlstra union text_poke_insn { 8767c1d4a2SPeter Zijlstra u8 text[POKE_MAX_OPCODE_SIZE]; 8867c1d4a2SPeter Zijlstra struct { 8967c1d4a2SPeter Zijlstra u8 opcode; 9067c1d4a2SPeter Zijlstra s32 disp; 9167c1d4a2SPeter Zijlstra } __attribute__((packed)); 9267c1d4a2SPeter Zijlstra }; 9367c1d4a2SPeter Zijlstra 9467c1d4a2SPeter Zijlstra static __always_inline 9567c1d4a2SPeter Zijlstra void *text_gen_insn(u8 opcode, const void *addr, const void *dest) 9667c1d4a2SPeter Zijlstra { 9767c1d4a2SPeter Zijlstra static union text_poke_insn insn; /* per instance */ 9867c1d4a2SPeter Zijlstra int size = text_opcode_size(opcode); 9967c1d4a2SPeter Zijlstra 10067c1d4a2SPeter Zijlstra insn.opcode = opcode; 10167c1d4a2SPeter Zijlstra 10267c1d4a2SPeter Zijlstra if (size > 1) { 10367c1d4a2SPeter Zijlstra insn.disp = (long)dest - (long)(addr + size); 10467c1d4a2SPeter Zijlstra if (size == 2) { 10567c1d4a2SPeter Zijlstra /* 10667c1d4a2SPeter Zijlstra * Ensure that for JMP9 the displacement 10767c1d4a2SPeter Zijlstra * actually fits the signed byte. 10867c1d4a2SPeter Zijlstra */ 10967c1d4a2SPeter Zijlstra BUG_ON((insn.disp >> 31) != (insn.disp >> 7)); 11067c1d4a2SPeter Zijlstra } 11167c1d4a2SPeter Zijlstra } 11267c1d4a2SPeter Zijlstra 11367c1d4a2SPeter Zijlstra return &insn.text; 11467c1d4a2SPeter Zijlstra } 115254d2c04SPeter Zijlstra 116254d2c04SPeter Zijlstra extern int after_bootmem; 117254d2c04SPeter Zijlstra extern __ro_after_init struct mm_struct *poking_mm; 118254d2c04SPeter Zijlstra extern __ro_after_init unsigned long poking_addr; 119254d2c04SPeter Zijlstra 120254d2c04SPeter Zijlstra #ifndef CONFIG_UML_X86 1214979fb53SThomas Gleixner static __always_inline 1224979fb53SThomas Gleixner void int3_emulate_jmp(struct pt_regs *regs, unsigned long ip) 123254d2c04SPeter Zijlstra { 124254d2c04SPeter Zijlstra regs->ip = ip; 125254d2c04SPeter Zijlstra } 126254d2c04SPeter Zijlstra 1274979fb53SThomas Gleixner static __always_inline 1284979fb53SThomas Gleixner void int3_emulate_push(struct pt_regs *regs, unsigned long val) 1294b33dadfSPeter Zijlstra { 1304b33dadfSPeter Zijlstra /* 1314b33dadfSPeter Zijlstra * The int3 handler in entry_64.S adds a gap between the 1324b33dadfSPeter Zijlstra * stack where the break point happened, and the saving of 1334b33dadfSPeter Zijlstra * pt_regs. We can extend the original stack because of 1344b33dadfSPeter Zijlstra * this gap. See the idtentry macro's create_gap option. 1358f4a4160SPeter Zijlstra * 1368f4a4160SPeter Zijlstra * Similarly entry_32.S will have a gap on the stack for (any) hardware 1378f4a4160SPeter Zijlstra * exception and pt_regs; see FIXUP_FRAME. 1384b33dadfSPeter Zijlstra */ 1394b33dadfSPeter Zijlstra regs->sp -= sizeof(unsigned long); 1404b33dadfSPeter Zijlstra *(unsigned long *)regs->sp = val; 1414b33dadfSPeter Zijlstra } 1424b33dadfSPeter Zijlstra 1434979fb53SThomas Gleixner static __always_inline 1444979fb53SThomas Gleixner void int3_emulate_call(struct pt_regs *regs, unsigned long func) 1454b33dadfSPeter Zijlstra { 1464b33dadfSPeter Zijlstra int3_emulate_push(regs, regs->ip - INT3_INSN_SIZE + CALL_INSN_SIZE); 1474b33dadfSPeter Zijlstra int3_emulate_jmp(regs, func); 1484b33dadfSPeter Zijlstra } 149693713cbSSteven Rostedt (VMware) #endif /* !CONFIG_UML_X86 */ 1504b33dadfSPeter Zijlstra 15135de5b06SAndy Lutomirski #endif /* _ASM_X86_TEXT_PATCHING_H */ 152