1620a53d5SSven Schnelle // SPDX-License-Identifier: GPL-2.0
2620a53d5SSven Schnelle /*
3620a53d5SSven Schnelle * functions to patch RO kernel text during runtime
4620a53d5SSven Schnelle *
5620a53d5SSven Schnelle * Copyright (c) 2019 Sven Schnelle <svens@stackframe.org>
6620a53d5SSven Schnelle */
7620a53d5SSven Schnelle
8620a53d5SSven Schnelle #include <linux/kernel.h>
9620a53d5SSven Schnelle #include <linux/spinlock.h>
10620a53d5SSven Schnelle #include <linux/kprobes.h>
11620a53d5SSven Schnelle #include <linux/mm.h>
12620a53d5SSven Schnelle #include <linux/stop_machine.h>
13620a53d5SSven Schnelle
14620a53d5SSven Schnelle #include <asm/cacheflush.h>
15620a53d5SSven Schnelle #include <asm/fixmap.h>
16620a53d5SSven Schnelle #include <asm/patch.h>
17620a53d5SSven Schnelle
18620a53d5SSven Schnelle struct patch {
19620a53d5SSven Schnelle void *addr;
204e87ace9SSven Schnelle u32 *insn;
214e87ace9SSven Schnelle unsigned int len;
22620a53d5SSven Schnelle };
23620a53d5SSven Schnelle
244e87ace9SSven Schnelle static DEFINE_RAW_SPINLOCK(patch_lock);
254e87ace9SSven Schnelle
patch_map(void * addr,int fixmap,unsigned long * flags,int * need_unmap)267e923369SSven Schnelle static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags,
277e923369SSven Schnelle int *need_unmap)
287e923369SSven Schnelle {
29620a53d5SSven Schnelle unsigned long uintaddr = (uintptr_t) addr;
30620a53d5SSven Schnelle bool module = !core_kernel_text(uintaddr);
31620a53d5SSven Schnelle struct page *page;
32620a53d5SSven Schnelle
334e87ace9SSven Schnelle *need_unmap = 0;
34620a53d5SSven Schnelle if (module && IS_ENABLED(CONFIG_STRICT_MODULE_RWX))
35620a53d5SSven Schnelle page = vmalloc_to_page(addr);
36620a53d5SSven Schnelle else if (!module && IS_ENABLED(CONFIG_STRICT_KERNEL_RWX))
37620a53d5SSven Schnelle page = virt_to_page(addr);
38620a53d5SSven Schnelle else
39620a53d5SSven Schnelle return addr;
40620a53d5SSven Schnelle
414e87ace9SSven Schnelle *need_unmap = 1;
42620a53d5SSven Schnelle set_fixmap(fixmap, page_to_phys(page));
437e923369SSven Schnelle raw_spin_lock_irqsave(&patch_lock, *flags);
44620a53d5SSven Schnelle
45620a53d5SSven Schnelle return (void *) (__fix_to_virt(fixmap) + (uintaddr & ~PAGE_MASK));
46620a53d5SSven Schnelle }
47620a53d5SSven Schnelle
patch_unmap(int fixmap,unsigned long * flags)487e923369SSven Schnelle static void __kprobes patch_unmap(int fixmap, unsigned long *flags)
49620a53d5SSven Schnelle {
50620a53d5SSven Schnelle clear_fixmap(fixmap);
517e923369SSven Schnelle
527e923369SSven Schnelle raw_spin_unlock_irqrestore(&patch_lock, *flags);
53620a53d5SSven Schnelle }
54620a53d5SSven Schnelle
__patch_text_multiple(void * addr,u32 * insn,unsigned int len)554e87ace9SSven Schnelle void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len)
56620a53d5SSven Schnelle {
574e87ace9SSven Schnelle unsigned long start = (unsigned long)addr;
584e87ace9SSven Schnelle unsigned long end = (unsigned long)addr + len;
597e923369SSven Schnelle unsigned long flags;
604e87ace9SSven Schnelle u32 *p, *fixmap;
614e87ace9SSven Schnelle int mapped;
62620a53d5SSven Schnelle
634e87ace9SSven Schnelle /* Make sure we don't have any aliases in cache */
64798082beSJohn David Anglin flush_kernel_dcache_range_asm(start, end);
65798082beSJohn David Anglin flush_kernel_icache_range_asm(start, end);
66798082beSJohn David Anglin flush_tlb_kernel_range(start, end);
674e87ace9SSven Schnelle
687e923369SSven Schnelle p = fixmap = patch_map(addr, FIX_TEXT_POKE0, &flags, &mapped);
694e87ace9SSven Schnelle
704e87ace9SSven Schnelle while (len >= 4) {
714e87ace9SSven Schnelle *p++ = *insn++;
724e87ace9SSven Schnelle addr += sizeof(u32);
734e87ace9SSven Schnelle len -= sizeof(u32);
744e87ace9SSven Schnelle if (len && offset_in_page(addr) == 0) {
754e87ace9SSven Schnelle /*
764e87ace9SSven Schnelle * We're crossing a page boundary, so
774e87ace9SSven Schnelle * need to remap
784e87ace9SSven Schnelle */
79798082beSJohn David Anglin flush_kernel_dcache_range_asm((unsigned long)fixmap,
80798082beSJohn David Anglin (unsigned long)p);
81798082beSJohn David Anglin flush_tlb_kernel_range((unsigned long)fixmap,
82798082beSJohn David Anglin (unsigned long)p);
834e87ace9SSven Schnelle if (mapped)
847e923369SSven Schnelle patch_unmap(FIX_TEXT_POKE0, &flags);
857e923369SSven Schnelle p = fixmap = patch_map(addr, FIX_TEXT_POKE0, &flags,
867e923369SSven Schnelle &mapped);
874e87ace9SSven Schnelle }
884e87ace9SSven Schnelle }
894e87ace9SSven Schnelle
90798082beSJohn David Anglin flush_kernel_dcache_range_asm((unsigned long)fixmap, (unsigned long)p);
91798082beSJohn David Anglin flush_tlb_kernel_range((unsigned long)fixmap, (unsigned long)p);
924e87ace9SSven Schnelle if (mapped)
937e923369SSven Schnelle patch_unmap(FIX_TEXT_POKE0, &flags);
944e87ace9SSven Schnelle }
954e87ace9SSven Schnelle
__patch_text(void * addr,u32 insn)964e87ace9SSven Schnelle void __kprobes __patch_text(void *addr, u32 insn)
974e87ace9SSven Schnelle {
984e87ace9SSven Schnelle __patch_text_multiple(addr, &insn, sizeof(insn));
99620a53d5SSven Schnelle }
100620a53d5SSven Schnelle
patch_text_stop_machine(void * data)101620a53d5SSven Schnelle static int __kprobes patch_text_stop_machine(void *data)
102620a53d5SSven Schnelle {
103620a53d5SSven Schnelle struct patch *patch = data;
104620a53d5SSven Schnelle
1054e87ace9SSven Schnelle __patch_text_multiple(patch->addr, patch->insn, patch->len);
106620a53d5SSven Schnelle return 0;
107620a53d5SSven Schnelle }
108620a53d5SSven Schnelle
patch_text(void * addr,unsigned int insn)109620a53d5SSven Schnelle void __kprobes patch_text(void *addr, unsigned int insn)
110620a53d5SSven Schnelle {
111620a53d5SSven Schnelle struct patch patch = {
112620a53d5SSven Schnelle .addr = addr,
1134e87ace9SSven Schnelle .insn = &insn,
1144e87ace9SSven Schnelle .len = sizeof(insn),
1154e87ace9SSven Schnelle };
1164e87ace9SSven Schnelle
1174e87ace9SSven Schnelle stop_machine_cpuslocked(patch_text_stop_machine, &patch, NULL);
1184e87ace9SSven Schnelle }
1194e87ace9SSven Schnelle
patch_text_multiple(void * addr,u32 * insn,unsigned int len)1204e87ace9SSven Schnelle void __kprobes patch_text_multiple(void *addr, u32 *insn, unsigned int len)
1214e87ace9SSven Schnelle {
1224e87ace9SSven Schnelle
1234e87ace9SSven Schnelle struct patch patch = {
1244e87ace9SSven Schnelle .addr = addr,
125620a53d5SSven Schnelle .insn = insn,
1264e87ace9SSven Schnelle .len = len
127620a53d5SSven Schnelle };
128620a53d5SSven Schnelle
129620a53d5SSven Schnelle stop_machine_cpuslocked(patch_text_stop_machine, &patch, NULL);
130620a53d5SSven Schnelle }
131