1// SPDX-License-Identifier: GPL-2.0
  2#include <linux/static_call.h>
  3#include <linux/memory.h>
  4#include <linux/bug.h>
  5#include <asm/text-patching.h>
  6
  7enum insn_type {
  8	CALL = 0, /* site call */
  9	NOP = 1,  /* site cond-call */
 10	JMP = 2,  /* tramp / site tail-call */
 11	RET = 3,  /* tramp / site cond-tail-call */
 12};
 13
 14/*
 15 * ud1 %esp, %ecx - a 3 byte #UD that is unique to trampolines, chosen such
 16 * that there is no false-positive trampoline identification while also being a
 17 * speculation stop.
 18 */
 19static const u8 tramp_ud[] = { 0x0f, 0xb9, 0xcc };
 20
 21/*
 22 * cs cs cs xorl %eax, %eax - a single 5 byte instruction that clears %[er]ax
 23 */
 24static const u8 xor5rax[] = { 0x2e, 0x2e, 0x2e, 0x31, 0xc0 };
 25
 26static const u8 retinsn[] = { RET_INSN_OPCODE, 0xcc, 0xcc, 0xcc, 0xcc };
 27
 28static void __ref __static_call_transform(void *insn, enum insn_type type,
 29					  void *func, bool modinit)
 30{
 31	const void *emulate = NULL;
 32	int size = CALL_INSN_SIZE;
 33	const void *code;
 34
 35	switch (type) {
 36	case CALL:
 37		func = callthunks_translate_call_dest(func);
 38		code = text_gen_insn(CALL_INSN_OPCODE, insn, func);
 39		if (func == &__static_call_return0) {
 40			emulate = code;
 41			code = &xor5rax;
 42		}
 43
 44		break;
 45
 46	case NOP:
 47		code = x86_nops[5];
 48		break;
 49
 50	case JMP:
 51		code = text_gen_insn(JMP32_INSN_OPCODE, insn, func);
 52		break;
 53
 54	case RET:
 55		if (cpu_feature_enabled(X86_FEATURE_RETHUNK))
 56			code = text_gen_insn(JMP32_INSN_OPCODE, insn, x86_return_thunk);
 57		else
 58			code = &retinsn;
 59		break;
 60	}
 61
 62	if (memcmp(insn, code, size) == 0)
 63		return;
 64
 65	if (system_state == SYSTEM_BOOTING || modinit)
 66		return text_poke_early(insn, code, size);
 67
 68	text_poke_bp(insn, code, size, emulate);
 69}
 70
 71static void __static_call_validate(void *insn, bool tail, bool tramp)
 72{
 73	u8 opcode = *(u8 *)insn;
 74
 75	if (tramp && memcmp(insn+5, tramp_ud, 3)) {
 76		pr_err("trampoline signature fail");
 77		BUG();
 78	}
 79
 80	if (tail) {
 81		if (opcode == JMP32_INSN_OPCODE ||
 82		    opcode == RET_INSN_OPCODE)
 83			return;
 84	} else {
 85		if (opcode == CALL_INSN_OPCODE ||
 86		    !memcmp(insn, x86_nops[5], 5) ||
 87		    !memcmp(insn, xor5rax, 5))
 88			return;
 89	}
 90
 91	/*
 92	 * If we ever trigger this, our text is corrupt, we'll probably not live long.
 93	 */
 94	pr_err("unexpected static_call insn opcode 0x%x at %pS\n", opcode, insn);
 95	BUG();
 96}
 97
 98static inline enum insn_type __sc_insn(bool null, bool tail)
 99{
100	/*
101	 * Encode the following table without branches:
102	 *
103	 *	tail	null	insn
104	 *	-----+-------+------
105	 *	  0  |   0   |  CALL
106	 *	  0  |   1   |  NOP
107	 *	  1  |   0   |  JMP
108	 *	  1  |   1   |  RET
109	 */
110	return 2*tail + null;
111}
112
113void arch_static_call_transform(void *site, void *tramp, void *func, bool tail)
114{
115	mutex_lock(&text_mutex);
116
117	if (tramp) {
118		__static_call_validate(tramp, true, true);
119		__static_call_transform(tramp, __sc_insn(!func, true), func, false);
120	}
121
122	if (IS_ENABLED(CONFIG_HAVE_STATIC_CALL_INLINE) && site) {
123		__static_call_validate(site, tail, false);
124		__static_call_transform(site, __sc_insn(!func, tail), func, false);
125	}
126
127	mutex_unlock(&text_mutex);
128}
129EXPORT_SYMBOL_GPL(arch_static_call_transform);
130
131#ifdef CONFIG_RETHUNK
132/*
133 * This is called by apply_returns() to fix up static call trampolines,
134 * specifically ARCH_DEFINE_STATIC_CALL_NULL_TRAMP which is recorded as
135 * having a return trampoline.
136 *
137 * The problem is that static_call() is available before determining
138 * X86_FEATURE_RETHUNK and, by implication, running alternatives.
139 *
140 * This means that __static_call_transform() above can have overwritten the
141 * return trampoline and we now need to fix things up to be consistent.
142 */
143bool __static_call_fixup(void *tramp, u8 op, void *dest)
144{
145	if (memcmp(tramp+5, tramp_ud, 3)) {
146		/* Not a trampoline site, not our problem. */
147		return false;
148	}
149
150	mutex_lock(&text_mutex);
151	if (op == RET_INSN_OPCODE || dest == &__x86_return_thunk)
152		__static_call_transform(tramp, RET, NULL, true);
153	mutex_unlock(&text_mutex);
154
155	return true;
156}
157#endif