From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7E4BCC3DA4A for ; Mon, 29 Jul 2024 16:52:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=rts0y+qLM2ySyPg07tBoZfL+20ST62xQmVk7z7Jd+No=; b=cVbhetgu5nCQoy5CGhQ4E3QHB/ N0m6s5EQZ4fj7+yEsJL7JGoG1hjH6FxsYPtu7vR2yR4UUTdiWeTQrg/xRwBjUZV3fBbcEfISp1qY3 izC8h6/KZC9OIxG3lVS+LqHXuh/a1x+rAcgptX00KcmvRfI0pxil7ppAjC2tkSoayKeJY281oP69Q cAaHRhLdHspv18YZyAvhSe12Su+PKc+yZXTLMKwfQQN4QRdPxpMm4vr9uPvZvBQ/sAOPlJSSk7x1L 4S+KbQENF8oAOmEtz9NH3dk8jnlfAvIxUykc0LESqPmmJe/VwLFeHKUcD2L9Oulb4mIP8TH/nB8bZ XLKj2NQw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1sYTbL-0000000C8IP-12sY; Mon, 29 Jul 2024 16:51:59 +0000 Received: from mail-pg1-x52e.google.com ([2607:f8b0:4864:20::52e]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1sYTar-0000000C8CD-2kSd for linux-arm-kernel@lists.infradead.org; Mon, 29 Jul 2024 16:51:31 +0000 Received: by mail-pg1-x52e.google.com with SMTP id 41be03b00d2f7-6c5bcb8e8edso2699795a12.2 for ; Mon, 29 Jul 2024 09:51:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1722271888; x=1722876688; darn=lists.infradead.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=rts0y+qLM2ySyPg07tBoZfL+20ST62xQmVk7z7Jd+No=; b=dB6xsejQj1qwLrF7FcMPbXu4b7U8yOhS2UaPTzOWxur1xb4dY7S1Ve+ayiR1T98Wd+ cnLE7fdXLTXQ7pjw5mP2lI5VWUo1WUi2xTgmVIIOIr0tgo+/IMhnieQrHnr8S16IQXqY HODgy4YfflRfD721W16hTVWv0OrOQu5Agcn6wN3mP964xSrIHYTCEy2WUgGzMPHcO9Ye d6REhK2DLB+b8b8QOvLqQ3HMx0mSXTCH0D+r0WWiPFlmjCJCnDSiB1Br36EuL7PeV5J4 4PXEkmLrJUwwhPD2bNuWJN536Y0U65TI2ldSiL7Dya/KlAxRKNQis6dJRxbQDiO7OGF+ APcA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1722271888; x=1722876688; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=rts0y+qLM2ySyPg07tBoZfL+20ST62xQmVk7z7Jd+No=; b=w38CeCHvBniDHcakFPbmxfSiURzZIfUnxhAWqY/FyyEMx6GN9ZroLBwYjmShWWqlCy IHLUysc4jYoDt8jI6KsdfWH3j1M8lTmLARTF67c2cVknKPXo9qFNlsfXpwqVMP33U2pD YrGtjpeu1upchqAevcaGvw23CAqvIZu09sUw6LHlktRGJHtad3Iq4qxw+YU/ih53IWC8 kiG1SOAOm7g33CGW04htdn4Ka85oxgBPsjRB3jU/SSR48NsXbx3cRcm8l+lp7TyWr1CI +l+8/yUXnVs9zHsEzADSu3wTorUB2BvrlfZeeX9ToMM7OXUuvT2q1IGBjajmJ55snG4i lXjQ== X-Forwarded-Encrypted: i=1; AJvYcCWOXD8DfRjuKaFnKt+ReGLTi1OPliT/rCu/L8KHF3HEBB+/mkFfO7r2er4Rren3WE+3xsUZGld89dqM6Bwpwr6KVW4JWTpUtzcdc18d+vQI4Bmcsvs= X-Gm-Message-State: AOJu0YxrBIA8iknpq7bkPR9bdpbmyFZwQZG/vSKJ7W2Hww6y+Yr27MS5 wNxxiWMPBmd5xXWG30RaBkE2wUC9bLvIYmfWBfD9bkR6yXASk3w/ X-Google-Smtp-Source: AGHT+IHnbiUjwgfgIVJN2GRioWxLaHrItbrosA7uh3elsqVXByxks0pOTbIXM1nSuJNuYlh4gBIoxQ== X-Received: by 2002:a05:6a20:43a8:b0:1c1:d866:7db8 with SMTP id adf61e73a8af0-1c4a117916dmr11125685637.9.1722271888106; Mon, 29 Jul 2024 09:51:28 -0700 (PDT) Received: from tank.hsd1.ca.comcast.net ([2601:647:4d7e:13e5:90c1:2418:d929:e1bd]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead812718sm7026140b3a.119.2024.07.29.09.51.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 29 Jul 2024 09:51:27 -0700 (PDT) From: Mikhail Iakhiaev To: linux@armlinux.org.uk Cc: mikhailai@gmail.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] arm/patch: call flush_icache ASAP after writing new instruction. Date: Mon, 29 Jul 2024 09:50:36 -0700 Message-Id: <20240729165036.7368-1-mikhailai@gmail.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240729_095129_713300_B99BA574 X-CRM114-Status: GOOD ( 15.40 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The patch moves flush_icache before the patch_unmap call. The change avoids the possibility of the CPU seeing partially-patched instructions if a function from patch_unmap call tree has just been patched. That HAS been observed in practice, leading to kernel panic or freezing in early boot: https://bugzilla.kernel.org/show_bug.cgi?id=219089 Specifically, the patch_unmap invokes _raw_spin_unlock_irqrestore (could be non-inlined) and that function is being patched during the ftrace_init, so the original code would run the patched code BEFORE flushing the icache. Note, some arches are more careful about flushing icache early. E.g. arch/riscv/kernel/patch.c: __patch_insn_set and __patch_insn_write call the local_flush_icache_range before the patch_unmap and have an explicit comment about this. arch/x86/kernel/alternative.c: text_poke_early calls sync_core (flushes icache) before local_irq_restore. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219089 Signed-off-by: Mikhail Iakhiaev --- arch/arm/kernel/patch.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/arch/arm/kernel/patch.c b/arch/arm/kernel/patch.c index e9e828b6bb30..f003867f085a 100644 --- a/arch/arm/kernel/patch.c +++ b/arch/arm/kernel/patch.c @@ -99,13 +99,19 @@ void __kprobes __patch_text_real(void *addr, unsigned int insn, bool remap) size = sizeof(u32); } - if (waddr != addr) { + if (waddr != addr) flush_kernel_vmap_range(waddr, twopage ? size / 2 : size); - patch_unmap(FIX_TEXT_POKE0, &flags); - } flush_icache_range((uintptr_t)(addr), (uintptr_t)(addr) + size); + + /* Can only call 'patch_unmap' after flushing dcache and icache, + * because it calls 'raw_spin_unlock_irqrestore', but that may + * happen to be the very function we're currently patching + * (as it happens during the ftrace init). + */ + if (waddr != addr) + patch_unmap(FIX_TEXT_POKE0, &flags); } static int __kprobes patch_text_stop_machine(void *data) -- 2.34.1