[PATCH v2 1/2] powerpc/code-patching: add patch_memory() for writing RO text

[Christophe Leroy]

Le 12/12/2021 à 02:03, Russell Currey a écrit :
> powerpc allocates a text poke area of one page that is used by
> patch_instruction() to modify read-only text when STRICT_KERNEL_RWX
> is enabled.
> 
> patch_instruction() is only designed for instructions,
> so writing data using the text poke area can only happen 4 bytes
> at a time - each with a page map/unmap, pte flush and syncs.
> 
> This patch introduces patch_memory(), implementing the same
> interface as memcpy(), similar to x86's text_poke() and s390's
> s390_kernel_write().  patch_memory() only needs to map the text
> poke area once, unless the write would cross a page boundary.
> 
> Signed-off-by: Russell Currey <ruscur at russell.cc>
> ---
> v2: Use min_t() instead of min(), fixing the 32-bit build as reported
>      by snowpatch.
> 
> Some discussion here: https://github.com/linuxppc/issues/issues/375
> 
>   arch/powerpc/include/asm/code-patching.h |  1 +
>   arch/powerpc/lib/code-patching.c         | 74 ++++++++++++++++++++++++
>   2 files changed, 75 insertions(+)
> 
> diff --git a/arch/powerpc/include/asm/code-patching.h b/arch/powerpc/include/asm/code-patching.h
> index 4ba834599c4d..604211d8380c 100644
> --- a/arch/powerpc/include/asm/code-patching.h
> +++ b/arch/powerpc/include/asm/code-patching.h
> @@ -31,6 +31,7 @@ int create_cond_branch(struct ppc_inst *instr, const u32 *addr,
>   int patch_branch(u32 *addr, unsigned long target, int flags);
>   int patch_instruction(u32 *addr, struct ppc_inst instr);
>   int raw_patch_instruction(u32 *addr, struct ppc_inst instr);
> +void *patch_memory(void *dest, const void *src, size_t size);
>   
>   static inline unsigned long patch_site_addr(s32 *site)
>   {
> diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c
> index c5ed98823835..330602aa59f1 100644
> --- a/arch/powerpc/lib/code-patching.c
> +++ b/arch/powerpc/lib/code-patching.c
> @@ -17,6 +17,7 @@
>   #include <asm/code-patching.h>
>   #include <asm/setup.h>
>   #include <asm/inst.h>
> +#include <asm/cacheflush.h>
>   
>   static int __patch_instruction(u32 *exec_addr, struct ppc_inst instr, u32 *patch_addr)
>   {
> @@ -178,6 +179,74 @@ static int do_patch_instruction(u32 *addr, struct ppc_inst instr)
>   
>   	return err;
>   }
> +
> +static int do_patch_memory(void *dest, const void *src, size_t size, unsigned long poke_addr)
> +{
> +	unsigned long patch_addr = poke_addr + offset_in_page(dest);
> +
> +	if (map_patch_area(dest, poke_addr)) {
> +		pr_warn("failed to map %lx\n", poke_addr);

It isn't worth a warning here. If that happens before slab is available, 
it will panic in early_alloc_pgtable().

If it happens after, you will already get a pile of messages dumping the 
memory state etc ...

During the last few years, pr_ messages have been removed from most 
places where ENOMEM is returned.

> +		return -1;
> +	}

I have a series reworking error handling at 
https://patchwork.ozlabs.org/project/linuxppc-dev/list/?series=274823&state=*

Especially this one handles map_patch_area() : 
https://patchwork.ozlabs.org/project/linuxppc-dev/patch/85259d894069e47f915ea580b169e1adbeec7a61.1638446239.git.christophe.leroy@csgroup.eu/

Would be good if you could rebase your series on top of it.


> +
> +	memcpy((u8 *)patch_addr, src, size);

Shouldn't we use copy_to_kernel_nofault(), so that we survive from a 
fault just like patch_instruction() ?

> +
> +	flush_icache_range(patch_addr, size);
> +
> +	if (unmap_patch_area(poke_addr)) {
> +		pr_warn("failed to unmap %lx\n", poke_addr);
> +		return -1;
> +	}

I have changed unmap_page_area() to a void in 
https://patchwork.ozlabs.org/project/linuxppc-dev/patch/299804b117fae35c786c827536c91f25352e279b.1638446239.git.christophe.leroy@csgroup.eu/

> +
> +	return 0;
> +}
> +
> +/**
> + * patch_memory - write data using the text poke area
> + *
> + * @dest:	destination address
> + * @src:	source address
> + * @size:	size in bytes
> + *
> + * like memcpy(), but using the text poke area. No atomicity guarantees.
> + * Do not use for instructions, use patch_instruction() instead.
> + * Handles crossing page boundaries, though you shouldn't need to.
> + *
> + * Return value:
> + * 	@dest
> + **/
> +void *patch_memory(void *dest, const void *src, size_t size)
> +{
> +	size_t bytes_written, write_size;
> +	unsigned long text_poke_addr;
> +	unsigned long flags;
> +
> +	// If the poke area isn't set up, it's early boot and we can just memcpy.
> +	if (!this_cpu_read(text_poke_area))
> +		return memcpy(dest, src, size);
> +
> +	local_irq_save(flags);

Do we want to do such potentially big copies with interrupts disabled ?

> +	text_poke_addr = (unsigned long)__this_cpu_read(text_poke_area)->addr;
> +
> +	for (bytes_written = 0;
> +	     bytes_written < size;
> +	     bytes_written += write_size) {

I recommend you to read 
https://www.kernel.org/doc/html/latest/process/coding-style.html?highlight=coding%20style#naming

As explained there, local variable names should be short. Using long 
names is non-productive.

You could just call it "written", it would allow you to keep the for() 
on a single line, that would be a lot more readable.

> +		// Write as much as possible without crossing a page boundary.
> +		write_size = min_t(size_t,
> +				   size - bytes_written,
> +				   PAGE_SIZE - offset_in_page(dest + bytes_written));

Reduce the size of you variable names and keep it on a single line.

> +
> +		if (do_patch_memory(dest + bytes_written,
> +				    src + bytes_written,
> +				    write_size,
> +				    text_poke_addr))

Same, keep a single line as much as possible.

> +			break;
> +	}
> +
> +	local_irq_restore(flags);
> +
> +	return dest;

Maybe it would be better to return ERR_PTR() of the error returned by 
do_page_memory().

> +}
>   #else /* !CONFIG_STRICT_KERNEL_RWX */
>   
>   static int do_patch_instruction(u32 *addr, struct ppc_inst instr)
> @@ -185,6 +254,11 @@ static int do_patch_instruction(u32 *addr, struct ppc_inst instr)
>   	return raw_patch_instruction(addr, instr);
>   }
>   
> +void *patch_memory(void *dest, const void *src, size_t size)
> +{
> +	return memcpy(dest, src, size);
> +}
> +
>   #endif /* CONFIG_STRICT_KERNEL_RWX */
>   
>   int patch_instruction(u32 *addr, struct ppc_inst instr)
> 

Christophe