| .. | .. |
|---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-only |
|---|
| 1 | 2 | /* |
|---|
| 2 | 3 | * Copyright (C) 2013 Huawei Ltd. |
|---|
| 3 | 4 | * Author: Jiang Liu <liuj97@gmail.com> |
|---|
| 4 | 5 | * |
|---|
| 5 | 6 | * Copyright (C) 2014-2016 Zi Shen Lim <zlim.lnx@gmail.com> |
|---|
| 6 | | - * |
|---|
| 7 | | - * This program is free software; you can redistribute it and/or modify |
|---|
| 8 | | - * it under the terms of the GNU General Public License version 2 as |
|---|
| 9 | | - * published by the Free Software Foundation. |
|---|
| 10 | | - * |
|---|
| 11 | | - * This program is distributed in the hope that it will be useful, |
|---|
| 12 | | - * but WITHOUT ANY WARRANTY; without even the implied warranty of |
|---|
| 13 | | - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|---|
| 14 | | - * GNU General Public License for more details. |
|---|
| 15 | | - * |
|---|
| 16 | | - * You should have received a copy of the GNU General Public License |
|---|
| 17 | | - * along with this program. If not, see <http://www.gnu.org/licenses/>. |
|---|
| 18 | 7 | */ |
|---|
| 19 | 8 | #include <linux/bitops.h> |
|---|
| 20 | 9 | #include <linux/bug.h> |
|---|
| .. | .. |
|---|
| 32 | 21 | #include <asm/fixmap.h> |
|---|
| 33 | 22 | #include <asm/insn.h> |
|---|
| 34 | 23 | #include <asm/kprobes.h> |
|---|
| 24 | +#include <asm/sections.h> |
|---|
| 35 | 25 | |
|---|
| 36 | 26 | #define AARCH64_INSN_SF_BIT BIT(31) |
|---|
| 37 | 27 | #define AARCH64_INSN_N_BIT BIT(22) |
|---|
| 38 | 28 | #define AARCH64_INSN_LSL_12 BIT(22) |
|---|
| 39 | 29 | |
|---|
| 40 | | -static int aarch64_insn_encoding_class[] = { |
|---|
| 30 | +static const int aarch64_insn_encoding_class[] = { |
|---|
| 41 | 31 | AARCH64_INSN_CLS_UNKNOWN, |
|---|
| 42 | 32 | AARCH64_INSN_CLS_UNKNOWN, |
|---|
| 43 | 33 | AARCH64_INSN_CLS_UNKNOWN, |
|---|
| .. | .. |
|---|
| 61 | 51 | return aarch64_insn_encoding_class[(insn >> 25) & 0xf]; |
|---|
| 62 | 52 | } |
|---|
| 63 | 53 | |
|---|
| 64 | | -/* NOP is an alias of HINT */ |
|---|
| 65 | | -bool __kprobes aarch64_insn_is_nop(u32 insn) |
|---|
| 54 | +bool __kprobes aarch64_insn_is_steppable_hint(u32 insn) |
|---|
| 66 | 55 | { |
|---|
| 67 | 56 | if (!aarch64_insn_is_hint(insn)) |
|---|
| 68 | 57 | return false; |
|---|
| 69 | 58 | |
|---|
| 70 | 59 | switch (insn & 0xFE0) { |
|---|
| 71 | | - case AARCH64_INSN_HINT_YIELD: |
|---|
| 72 | | - case AARCH64_INSN_HINT_WFE: |
|---|
| 73 | | - case AARCH64_INSN_HINT_WFI: |
|---|
| 74 | | - case AARCH64_INSN_HINT_SEV: |
|---|
| 75 | | - case AARCH64_INSN_HINT_SEVL: |
|---|
| 76 | | - return false; |
|---|
| 77 | | - default: |
|---|
| 60 | + case AARCH64_INSN_HINT_XPACLRI: |
|---|
| 61 | + case AARCH64_INSN_HINT_PACIA_1716: |
|---|
| 62 | + case AARCH64_INSN_HINT_PACIB_1716: |
|---|
| 63 | + case AARCH64_INSN_HINT_PACIAZ: |
|---|
| 64 | + case AARCH64_INSN_HINT_PACIASP: |
|---|
| 65 | + case AARCH64_INSN_HINT_PACIBZ: |
|---|
| 66 | + case AARCH64_INSN_HINT_PACIBSP: |
|---|
| 67 | + case AARCH64_INSN_HINT_BTI: |
|---|
| 68 | + case AARCH64_INSN_HINT_BTIC: |
|---|
| 69 | + case AARCH64_INSN_HINT_BTIJ: |
|---|
| 70 | + case AARCH64_INSN_HINT_BTIJC: |
|---|
| 71 | + case AARCH64_INSN_HINT_NOP: |
|---|
| 78 | 72 | return true; |
|---|
| 73 | + default: |
|---|
| 74 | + return false; |
|---|
| 79 | 75 | } |
|---|
| 80 | 76 | } |
|---|
| 81 | 77 | |
|---|
| .. | .. |
|---|
| 89 | 85 | |
|---|
| 90 | 86 | static DEFINE_RAW_SPINLOCK(patch_lock); |
|---|
| 91 | 87 | |
|---|
| 88 | +static bool is_exit_text(unsigned long addr) |
|---|
| 89 | +{ |
|---|
| 90 | + /* discarded with init text/data */ |
|---|
| 91 | + return system_state < SYSTEM_RUNNING && |
|---|
| 92 | + addr >= (unsigned long)__exittext_begin && |
|---|
| 93 | + addr < (unsigned long)__exittext_end; |
|---|
| 94 | +} |
|---|
| 95 | + |
|---|
| 96 | +static bool is_image_text(unsigned long addr) |
|---|
| 97 | +{ |
|---|
| 98 | + return core_kernel_text(addr) || is_exit_text(addr); |
|---|
| 99 | +} |
|---|
| 100 | + |
|---|
| 92 | 101 | static void __kprobes *patch_map(void *addr, int fixmap) |
|---|
| 93 | 102 | { |
|---|
| 94 | 103 | unsigned long uintaddr = (uintptr_t) addr; |
|---|
| 95 | | - bool module = !core_kernel_text(uintaddr); |
|---|
| 104 | + bool image = is_image_text(uintaddr); |
|---|
| 96 | 105 | struct page *page; |
|---|
| 97 | 106 | |
|---|
| 98 | | - if (module && IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) |
|---|
| 99 | | - page = vmalloc_to_page(addr); |
|---|
| 100 | | - else if (!module) |
|---|
| 107 | + if (image) |
|---|
| 101 | 108 | page = phys_to_page(__pa_symbol(addr)); |
|---|
| 109 | + else if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) |
|---|
| 110 | + page = vmalloc_to_page(addr); |
|---|
| 102 | 111 | else |
|---|
| 103 | 112 | return addr; |
|---|
| 104 | 113 | |
|---|
| .. | .. |
|---|
| 120 | 129 | int ret; |
|---|
| 121 | 130 | __le32 val; |
|---|
| 122 | 131 | |
|---|
| 123 | | - ret = probe_kernel_read(&val, addr, AARCH64_INSN_SIZE); |
|---|
| 132 | + ret = copy_from_kernel_nofault(&val, addr, AARCH64_INSN_SIZE); |
|---|
| 124 | 133 | if (!ret) |
|---|
| 125 | 134 | *insnp = le32_to_cpu(val); |
|---|
| 126 | 135 | |
|---|
| .. | .. |
|---|
| 136 | 145 | raw_spin_lock_irqsave(&patch_lock, flags); |
|---|
| 137 | 146 | waddr = patch_map(addr, FIX_TEXT_POKE0); |
|---|
| 138 | 147 | |
|---|
| 139 | | - ret = probe_kernel_write(waddr, &insn, AARCH64_INSN_SIZE); |
|---|
| 148 | + ret = copy_to_kernel_nofault(waddr, &insn, AARCH64_INSN_SIZE); |
|---|
| 140 | 149 | |
|---|
| 141 | 150 | patch_unmap(FIX_TEXT_POKE0); |
|---|
| 142 | 151 | raw_spin_unlock_irqrestore(&patch_lock, flags); |
|---|
| .. | .. |
|---|
| 161 | 170 | |
|---|
| 162 | 171 | bool __kprobes aarch64_insn_is_branch(u32 insn) |
|---|
| 163 | 172 | { |
|---|
| 164 | | - /* b, bl, cb*, tb*, b.cond, br, blr */ |
|---|
| 173 | + /* b, bl, cb*, tb*, ret*, b.cond, br*, blr* */ |
|---|
| 165 | 174 | |
|---|
| 166 | 175 | return aarch64_insn_is_b(insn) || |
|---|
| 167 | 176 | aarch64_insn_is_bl(insn) || |
|---|
| .. | .. |
|---|
| 170 | 179 | aarch64_insn_is_tbz(insn) || |
|---|
| 171 | 180 | aarch64_insn_is_tbnz(insn) || |
|---|
| 172 | 181 | aarch64_insn_is_ret(insn) || |
|---|
| 182 | + aarch64_insn_is_ret_auth(insn) || |
|---|
| 173 | 183 | aarch64_insn_is_br(insn) || |
|---|
| 184 | + aarch64_insn_is_br_auth(insn) || |
|---|
| 174 | 185 | aarch64_insn_is_blr(insn) || |
|---|
| 186 | + aarch64_insn_is_blr_auth(insn) || |
|---|
| 175 | 187 | aarch64_insn_is_bcond(insn); |
|---|
| 176 | 188 | } |
|---|
| 177 | 189 | |
|---|
| .. | .. |
|---|
| 204 | 216 | int i, ret = 0; |
|---|
| 205 | 217 | struct aarch64_insn_patch *pp = arg; |
|---|
| 206 | 218 | |
|---|
| 207 | | - /* The first CPU becomes master */ |
|---|
| 208 | | - if (atomic_inc_return(&pp->cpu_count) == 1) { |
|---|
| 219 | + /* The last CPU becomes master */ |
|---|
| 220 | + if (atomic_inc_return(&pp->cpu_count) == num_online_cpus()) { |
|---|
| 209 | 221 | for (i = 0; ret == 0 && i < pp->insn_cnt; i++) |
|---|
| 210 | 222 | ret = aarch64_insn_patch_text_nosync(pp->text_addrs[i], |
|---|
| 211 | 223 | pp->new_insns[i]); |
|---|
| .. | .. |
|---|
| 571 | 583 | offset >> 2); |
|---|
| 572 | 584 | } |
|---|
| 573 | 585 | |
|---|
| 574 | | -u32 __kprobes aarch64_insn_gen_hint(enum aarch64_insn_hint_op op) |
|---|
| 586 | +u32 __kprobes aarch64_insn_gen_hint(enum aarch64_insn_hint_cr_op op) |
|---|
| 575 | 587 | { |
|---|
| 576 | 588 | return aarch64_insn_get_hint_value() | op; |
|---|
| 577 | 589 | } |
|---|
| .. | .. |
|---|
| 1280 | 1292 | } |
|---|
| 1281 | 1293 | |
|---|
| 1282 | 1294 | /* |
|---|
| 1295 | + * MOV (register) is architecturally an alias of ORR (shifted register) where |
|---|
| 1296 | + * MOV <*d>, <*m> is equivalent to ORR <*d>, <*ZR>, <*m> |
|---|
| 1297 | + */ |
|---|
| 1298 | +u32 aarch64_insn_gen_move_reg(enum aarch64_insn_register dst, |
|---|
| 1299 | + enum aarch64_insn_register src, |
|---|
| 1300 | + enum aarch64_insn_variant variant) |
|---|
| 1301 | +{ |
|---|
| 1302 | + return aarch64_insn_gen_logical_shifted_reg(dst, AARCH64_INSN_REG_ZR, |
|---|
| 1303 | + src, 0, variant, |
|---|
| 1304 | + AARCH64_INSN_LOGIC_ORR); |
|---|
| 1305 | +} |
|---|
| 1306 | + |
|---|
| 1307 | +u32 aarch64_insn_gen_adr(unsigned long pc, unsigned long addr, |
|---|
| 1308 | + enum aarch64_insn_register reg, |
|---|
| 1309 | + enum aarch64_insn_adr_type type) |
|---|
| 1310 | +{ |
|---|
| 1311 | + u32 insn; |
|---|
| 1312 | + s32 offset; |
|---|
| 1313 | + |
|---|
| 1314 | + switch (type) { |
|---|
| 1315 | + case AARCH64_INSN_ADR_TYPE_ADR: |
|---|
| 1316 | + insn = aarch64_insn_get_adr_value(); |
|---|
| 1317 | + offset = addr - pc; |
|---|
| 1318 | + break; |
|---|
| 1319 | + case AARCH64_INSN_ADR_TYPE_ADRP: |
|---|
| 1320 | + insn = aarch64_insn_get_adrp_value(); |
|---|
| 1321 | + offset = (addr - ALIGN_DOWN(pc, SZ_4K)) >> 12; |
|---|
| 1322 | + break; |
|---|
| 1323 | + default: |
|---|
| 1324 | + pr_err("%s: unknown adr encoding %d\n", __func__, type); |
|---|
| 1325 | + return AARCH64_BREAK_FAULT; |
|---|
| 1326 | + } |
|---|
| 1327 | + |
|---|
| 1328 | + if (offset < -SZ_1M || offset >= SZ_1M) |
|---|
| 1329 | + return AARCH64_BREAK_FAULT; |
|---|
| 1330 | + |
|---|
| 1331 | + insn = aarch64_insn_encode_register(AARCH64_INSN_REGTYPE_RD, insn, reg); |
|---|
| 1332 | + |
|---|
| 1333 | + return aarch64_insn_encode_immediate(AARCH64_INSN_IMM_ADR, insn, offset); |
|---|
| 1334 | +} |
|---|
| 1335 | + |
|---|
| 1336 | +/* |
|---|
| 1283 | 1337 | * Decode the imm field of a branch, and return the byte offset as a |
|---|
| 1284 | 1338 | * signed value (so it can be used when computing a new branch |
|---|
| 1285 | 1339 | * target). |
|---|