1 #include <linux/module.h>
2 #include <linux/sched.h>
3 #include <linux/mutex.h>
4 #include <linux/list.h>
5 #include <linux/stringify.h>
6 #include <linux/kprobes.h>
8 #include <linux/vmalloc.h>
9 #include <linux/memory.h>
10 #include <linux/stop_machine.h>
11 #include <asm/alternative.h>
12 #include <asm/sections.h>
13 #include <asm/pgtable.h>
16 #include <asm/vsyscall.h>
17 #include <asm/cacheflush.h>
18 #include <asm/tlbflush.h>
20 #include <asm/fixmap.h>
22 #define MAX_PATCH_LEN (255-1)
24 #ifdef CONFIG_HOTPLUG_CPU
25 static int smp_alt_once;
27 static int __init bootonly(char *str)
32 __setup("smp-alt-boot", bootonly);
34 #define smp_alt_once 1
37 static int __initdata_or_module debug_alternative;
39 static int __init debug_alt(char *str)
41 debug_alternative = 1;
44 __setup("debug-alternative", debug_alt);
46 static int noreplace_smp;
48 static int __init setup_noreplace_smp(char *str)
53 __setup("noreplace-smp", setup_noreplace_smp);
55 #ifdef CONFIG_PARAVIRT
56 static int __initdata_or_module noreplace_paravirt = 0;
58 static int __init setup_noreplace_paravirt(char *str)
60 noreplace_paravirt = 1;
63 __setup("noreplace-paravirt", setup_noreplace_paravirt);
66 #define DPRINTK(fmt, args...) if (debug_alternative) \
67 printk(KERN_DEBUG fmt, args)
69 #if defined(GENERIC_NOP1) && !defined(CONFIG_X86_64)
70 /* Use inline assembly to define this because the nops are defined
71 as inline assembly strings in the include files and we cannot
72 get them easily into strings. */
73 asm("\t" __stringify(__INITRODATA_OR_MODULE) "\nintelnops: "
74 GENERIC_NOP1 GENERIC_NOP2 GENERIC_NOP3 GENERIC_NOP4 GENERIC_NOP5 GENERIC_NOP6
75 GENERIC_NOP7 GENERIC_NOP8
77 extern const unsigned char intelnops[];
78 static const unsigned char *const __initconst_or_module
79 intel_nops[ASM_NOP_MAX+1] = {
84 intelnops + 1 + 2 + 3,
85 intelnops + 1 + 2 + 3 + 4,
86 intelnops + 1 + 2 + 3 + 4 + 5,
87 intelnops + 1 + 2 + 3 + 4 + 5 + 6,
88 intelnops + 1 + 2 + 3 + 4 + 5 + 6 + 7,
93 asm("\t" __stringify(__INITRODATA_OR_MODULE) "\nk8nops: "
94 K8_NOP1 K8_NOP2 K8_NOP3 K8_NOP4 K8_NOP5 K8_NOP6
97 extern const unsigned char k8nops[];
98 static const unsigned char *const __initconst_or_module
99 k8_nops[ASM_NOP_MAX+1] = {
105 k8nops + 1 + 2 + 3 + 4,
106 k8nops + 1 + 2 + 3 + 4 + 5,
107 k8nops + 1 + 2 + 3 + 4 + 5 + 6,
108 k8nops + 1 + 2 + 3 + 4 + 5 + 6 + 7,
112 #if defined(K7_NOP1) && !defined(CONFIG_X86_64)
113 asm("\t" __stringify(__INITRODATA_OR_MODULE) "\nk7nops: "
114 K7_NOP1 K7_NOP2 K7_NOP3 K7_NOP4 K7_NOP5 K7_NOP6
117 extern const unsigned char k7nops[];
118 static const unsigned char *const __initconst_or_module
119 k7_nops[ASM_NOP_MAX+1] = {
125 k7nops + 1 + 2 + 3 + 4,
126 k7nops + 1 + 2 + 3 + 4 + 5,
127 k7nops + 1 + 2 + 3 + 4 + 5 + 6,
128 k7nops + 1 + 2 + 3 + 4 + 5 + 6 + 7,
133 asm("\t" __stringify(__INITRODATA_OR_MODULE) "\np6nops: "
134 P6_NOP1 P6_NOP2 P6_NOP3 P6_NOP4 P6_NOP5 P6_NOP6
137 extern const unsigned char p6nops[];
138 static const unsigned char *const __initconst_or_module
139 p6_nops[ASM_NOP_MAX+1] = {
145 p6nops + 1 + 2 + 3 + 4,
146 p6nops + 1 + 2 + 3 + 4 + 5,
147 p6nops + 1 + 2 + 3 + 4 + 5 + 6,
148 p6nops + 1 + 2 + 3 + 4 + 5 + 6 + 7,
154 extern char __vsyscall_0;
155 static const unsigned char *const *__init_or_module find_nop_table(void)
157 if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
158 boot_cpu_has(X86_FEATURE_NOPL))
164 #else /* CONFIG_X86_64 */
166 static const unsigned char *const *__init_or_module find_nop_table(void)
168 if (boot_cpu_has(X86_FEATURE_K8))
170 else if (boot_cpu_has(X86_FEATURE_K7))
172 else if (boot_cpu_has(X86_FEATURE_NOPL))
178 #endif /* CONFIG_X86_64 */
180 /* Use this to add nops to a buffer, then text_poke the whole buffer. */
181 static void __init_or_module add_nops(void *insns, unsigned int len)
183 const unsigned char *const *noptable = find_nop_table();
186 unsigned int noplen = len;
187 if (noplen > ASM_NOP_MAX)
188 noplen = ASM_NOP_MAX;
189 memcpy(insns, noptable[noplen], noplen);
195 extern struct alt_instr __alt_instructions[], __alt_instructions_end[];
196 extern u8 *__smp_locks[], *__smp_locks_end[];
197 static void *text_poke_early(void *addr, const void *opcode, size_t len);
199 /* Replace instructions with better alternatives for this CPU type.
200 This runs before SMP is initialized to avoid SMP problems with
201 self modifying code. This implies that assymetric systems where
202 APs have less capabilities than the boot processor are not handled.
203 Tough. Make sure you disable such features by hand. */
205 void __init_or_module apply_alternatives(struct alt_instr *start,
206 struct alt_instr *end)
209 char insnbuf[MAX_PATCH_LEN];
211 DPRINTK("%s: alt table %p -> %p\n", __func__, start, end);
212 for (a = start; a < end; a++) {
213 u8 *instr = a->instr;
214 BUG_ON(a->replacementlen > a->instrlen);
215 BUG_ON(a->instrlen > sizeof(insnbuf));
216 if (!boot_cpu_has(a->cpuid))
219 /* vsyscall code is not mapped yet. resolve it manually. */
220 if (instr >= (u8 *)VSYSCALL_START && instr < (u8*)VSYSCALL_END) {
221 instr = __va(instr - (u8*)VSYSCALL_START + (u8*)__pa_symbol(&__vsyscall_0));
222 DPRINTK("%s: vsyscall fixup: %p => %p\n",
223 __func__, a->instr, instr);
226 memcpy(insnbuf, a->replacement, a->replacementlen);
227 add_nops(insnbuf + a->replacementlen,
228 a->instrlen - a->replacementlen);
229 text_poke_early(instr, insnbuf, a->instrlen);
235 static void alternatives_smp_lock(u8 **start, u8 **end, u8 *text, u8 *text_end)
239 mutex_lock(&text_mutex);
240 for (ptr = start; ptr < end; ptr++) {
245 /* turn DS segment override prefix into lock prefix */
246 text_poke(*ptr, ((unsigned char []){0xf0}), 1);
248 mutex_unlock(&text_mutex);
251 static void alternatives_smp_unlock(u8 **start, u8 **end, u8 *text, u8 *text_end)
258 mutex_lock(&text_mutex);
259 for (ptr = start; ptr < end; ptr++) {
264 /* turn lock prefix into DS segment override prefix */
265 text_poke(*ptr, ((unsigned char []){0x3E}), 1);
267 mutex_unlock(&text_mutex);
270 struct smp_alt_module {
271 /* what is this ??? */
275 /* ptrs to lock prefixes */
279 /* .text segment, needed to avoid patching init code ;) */
283 struct list_head next;
285 static LIST_HEAD(smp_alt_modules);
286 static DEFINE_MUTEX(smp_alt);
287 static int smp_mode = 1; /* protected by smp_alt */
289 void __init_or_module alternatives_smp_module_add(struct module *mod,
291 void *locks, void *locks_end,
292 void *text, void *text_end)
294 struct smp_alt_module *smp;
300 if (boot_cpu_has(X86_FEATURE_UP))
301 alternatives_smp_unlock(locks, locks_end,
306 smp = kzalloc(sizeof(*smp), GFP_KERNEL);
308 return; /* we'll run the (safe but slow) SMP code then ... */
313 smp->locks_end = locks_end;
315 smp->text_end = text_end;
316 DPRINTK("%s: locks %p -> %p, text %p -> %p, name %s\n",
317 __func__, smp->locks, smp->locks_end,
318 smp->text, smp->text_end, smp->name);
320 mutex_lock(&smp_alt);
321 list_add_tail(&smp->next, &smp_alt_modules);
322 if (boot_cpu_has(X86_FEATURE_UP))
323 alternatives_smp_unlock(smp->locks, smp->locks_end,
324 smp->text, smp->text_end);
325 mutex_unlock(&smp_alt);
328 void __init_or_module alternatives_smp_module_del(struct module *mod)
330 struct smp_alt_module *item;
332 if (smp_alt_once || noreplace_smp)
335 mutex_lock(&smp_alt);
336 list_for_each_entry(item, &smp_alt_modules, next) {
337 if (mod != item->mod)
339 list_del(&item->next);
340 mutex_unlock(&smp_alt);
341 DPRINTK("%s: %s\n", __func__, item->name);
345 mutex_unlock(&smp_alt);
348 void alternatives_smp_switch(int smp)
350 struct smp_alt_module *mod;
352 #ifdef CONFIG_LOCKDEP
354 * Older binutils section handling bug prevented
355 * alternatives-replacement from working reliably.
357 * If this still occurs then you should see a hang
358 * or crash shortly after this line:
360 printk("lockdep: fixing up alternatives.\n");
363 if (noreplace_smp || smp_alt_once)
365 BUG_ON(!smp && (num_online_cpus() > 1));
367 mutex_lock(&smp_alt);
370 * Avoid unnecessary switches because it forces JIT based VMs to
371 * throw away all cached translations, which can be quite costly.
373 if (smp == smp_mode) {
376 printk(KERN_INFO "SMP alternatives: switching to SMP code\n");
377 clear_cpu_cap(&boot_cpu_data, X86_FEATURE_UP);
378 clear_cpu_cap(&cpu_data(0), X86_FEATURE_UP);
379 list_for_each_entry(mod, &smp_alt_modules, next)
380 alternatives_smp_lock(mod->locks, mod->locks_end,
381 mod->text, mod->text_end);
383 printk(KERN_INFO "SMP alternatives: switching to UP code\n");
384 set_cpu_cap(&boot_cpu_data, X86_FEATURE_UP);
385 set_cpu_cap(&cpu_data(0), X86_FEATURE_UP);
386 list_for_each_entry(mod, &smp_alt_modules, next)
387 alternatives_smp_unlock(mod->locks, mod->locks_end,
388 mod->text, mod->text_end);
391 mutex_unlock(&smp_alt);
394 /* Return 1 if the address range is reserved for smp-alternatives */
395 int alternatives_text_reserved(void *start, void *end)
397 struct smp_alt_module *mod;
399 u8 *text_start = start;
402 list_for_each_entry(mod, &smp_alt_modules, next) {
403 if (mod->text > text_end || mod->text_end < text_start)
405 for (ptr = mod->locks; ptr < mod->locks_end; ptr++)
406 if (text_start <= *ptr && text_end >= *ptr)
414 #ifdef CONFIG_PARAVIRT
415 void __init_or_module apply_paravirt(struct paravirt_patch_site *start,
416 struct paravirt_patch_site *end)
418 struct paravirt_patch_site *p;
419 char insnbuf[MAX_PATCH_LEN];
421 if (noreplace_paravirt)
424 for (p = start; p < end; p++) {
427 BUG_ON(p->len > MAX_PATCH_LEN);
428 /* prep the buffer with the original instructions */
429 memcpy(insnbuf, p->instr, p->len);
430 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
431 (unsigned long)p->instr, p->len);
433 BUG_ON(used > p->len);
435 /* Pad the rest with nops */
436 add_nops(insnbuf + used, p->len - used);
437 text_poke_early(p->instr, insnbuf, p->len);
440 extern struct paravirt_patch_site __start_parainstructions[],
441 __stop_parainstructions[];
442 #endif /* CONFIG_PARAVIRT */
444 void __init alternative_instructions(void)
446 /* The patching is not fully atomic, so try to avoid local interruptions
447 that might execute the to be patched code.
448 Other CPUs are not running. */
452 * Don't stop machine check exceptions while patching.
453 * MCEs only happen when something got corrupted and in this
454 * case we must do something about the corruption.
455 * Ignoring it is worse than a unlikely patching race.
456 * Also machine checks tend to be broadcast and if one CPU
457 * goes into machine check the others follow quickly, so we don't
458 * expect a machine check to cause undue problems during to code
462 apply_alternatives(__alt_instructions, __alt_instructions_end);
464 /* switch to patch-once-at-boottime-only mode and free the
465 * tables in case we know the number of CPUs will never ever
467 #ifdef CONFIG_HOTPLUG_CPU
468 if (num_possible_cpus() < 2)
474 if (1 == num_possible_cpus()) {
475 printk(KERN_INFO "SMP alternatives: switching to UP code\n");
476 set_cpu_cap(&boot_cpu_data, X86_FEATURE_UP);
477 set_cpu_cap(&cpu_data(0), X86_FEATURE_UP);
479 alternatives_smp_unlock(__smp_locks, __smp_locks_end,
483 alternatives_smp_module_add(NULL, "core kernel",
484 __smp_locks, __smp_locks_end,
487 /* Only switch to UP mode if we don't immediately boot others */
488 if (num_present_cpus() == 1 || setup_max_cpus <= 1)
489 alternatives_smp_switch(0);
492 apply_paravirt(__parainstructions, __parainstructions_end);
495 free_init_pages("SMP alternatives",
496 (unsigned long)__smp_locks,
497 (unsigned long)__smp_locks_end);
503 * text_poke_early - Update instructions on a live kernel at boot time
504 * @addr: address to modify
505 * @opcode: source of the copy
506 * @len: length to copy
508 * When you use this code to patch more than one byte of an instruction
509 * you need to make sure that other CPUs cannot execute this code in parallel.
510 * Also no thread must be currently preempted in the middle of these
511 * instructions. And on the local CPU you need to be protected again NMI or MCE
512 * handlers seeing an inconsistent instruction while you patch.
514 static void *__init_or_module text_poke_early(void *addr, const void *opcode,
518 local_irq_save(flags);
519 memcpy(addr, opcode, len);
521 local_irq_restore(flags);
522 /* Could also do a CLFLUSH here to speed up CPU recovery; but
523 that causes hangs on some VIA CPUs. */
528 * text_poke - Update instructions on a live kernel
529 * @addr: address to modify
530 * @opcode: source of the copy
531 * @len: length to copy
533 * Only atomic text poke/set should be allowed when not doing early patching.
534 * It means the size must be writable atomically and the address must be aligned
535 * in a way that permits an atomic write. It also makes sure we fit on a single
538 * Note: Must be called under text_mutex.
540 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
544 struct page *pages[2];
547 if (!core_kernel_text((unsigned long)addr)) {
548 pages[0] = vmalloc_to_page(addr);
549 pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
551 pages[0] = virt_to_page(addr);
552 WARN_ON(!PageReserved(pages[0]));
553 pages[1] = virt_to_page(addr + PAGE_SIZE);
556 local_irq_save(flags);
557 set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
559 set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
560 vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
561 memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
562 clear_fixmap(FIX_TEXT_POKE0);
564 clear_fixmap(FIX_TEXT_POKE1);
567 /* Could also do a CLFLUSH here to speed up CPU recovery; but
568 that causes hangs on some VIA CPUs. */
569 for (i = 0; i < len; i++)
570 BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
571 local_irq_restore(flags);
576 * Cross-modifying kernel text with stop_machine().
577 * This code originally comes from immediate value.
579 static atomic_t stop_machine_first;
580 static int wrote_text;
582 struct text_poke_params {
588 static int __kprobes stop_machine_text_poke(void *data)
590 struct text_poke_params *tpp = data;
592 if (atomic_dec_and_test(&stop_machine_first)) {
593 text_poke(tpp->addr, tpp->opcode, tpp->len);
594 smp_wmb(); /* Make sure other cpus see that this has run */
599 smp_mb(); /* Load wrote_text before following execution */
602 flush_icache_range((unsigned long)tpp->addr,
603 (unsigned long)tpp->addr + tpp->len);
608 * text_poke_smp - Update instructions on a live kernel on SMP
609 * @addr: address to modify
610 * @opcode: source of the copy
611 * @len: length to copy
613 * Modify multi-byte instruction by using stop_machine() on SMP. This allows
614 * user to poke/set multi-byte text on SMP. Only non-NMI/MCE code modifying
615 * should be allowed, since stop_machine() does _not_ protect code against
618 * Note: Must be called under get_online_cpus() and text_mutex.
620 void *__kprobes text_poke_smp(void *addr, const void *opcode, size_t len)
622 struct text_poke_params tpp;
627 atomic_set(&stop_machine_first, 1);
629 stop_machine(stop_machine_text_poke, (void *)&tpp, NULL);