xref: /netbsd-src/sys/arch/x86/x86/patch.c (revision bdc22b2e01993381dcefeff2bc9b56ca75a4235c)
1 /*	$NetBSD: patch.c,v 1.35 2018/07/14 14:34:32 maxv Exp $	*/
2 
3 /*-
4  * Copyright (c) 2007, 2008, 2009 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Andrew Doran.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * Patch kernel code at boot time, depending on available CPU features.
34  */
35 
36 #include <sys/cdefs.h>
37 __KERNEL_RCSID(0, "$NetBSD: patch.c,v 1.35 2018/07/14 14:34:32 maxv Exp $");
38 
39 #include "opt_lockdebug.h"
40 #ifdef i386
41 #include "opt_spldebug.h"
42 #endif
43 
44 #include <sys/types.h>
45 #include <sys/systm.h>
46 
47 #include <machine/cpu.h>
48 #include <machine/cpufunc.h>
49 #include <machine/specialreg.h>
50 #include <machine/frameasm.h>
51 
52 #include <x86/cpuvar.h>
53 #include <x86/cputypes.h>
54 
55 struct hotpatch {
56 	uint8_t name;
57 	uint8_t size;
58 	void *addr;
59 } __packed;
60 
61 void	spllower(int);
62 void	spllower_end(void);
63 void	cx8_spllower(int);
64 void	cx8_spllower_end(void);
65 void	cx8_spllower_patch(void);
66 
67 void	mutex_spin_exit_end(void);
68 void	i686_mutex_spin_exit(int);
69 void	i686_mutex_spin_exit_end(void);
70 void	i686_mutex_spin_exit_patch(void);
71 
72 void	membar_consumer(void);
73 void	membar_consumer_end(void);
74 void	membar_sync(void);
75 void	membar_sync_end(void);
76 void	sse2_lfence(void);
77 void	sse2_lfence_end(void);
78 void	sse2_mfence(void);
79 void	sse2_mfence_end(void);
80 
81 void	_atomic_cas_64(void);
82 void	_atomic_cas_64_end(void);
83 void	_atomic_cas_cx8(void);
84 void	_atomic_cas_cx8_end(void);
85 
86 extern void	*atomic_lockpatch[];
87 
88 #define	X86_NOP		0x90
89 #define	X86_REP		0xf3
90 #define	X86_RET		0xc3
91 #define	X86_CS		0x2e
92 #define	X86_DS		0x3e
93 #define	X86_GROUP_0F	0x0f
94 
95 static void
96 adjust_jumpoff(uint8_t *ptr, void *from_s, void *to_s)
97 {
98 
99 	/* Branch hints */
100 	if (ptr[0] == X86_CS || ptr[0] == X86_DS)
101 		ptr++;
102 	/* Conditional jumps */
103 	if (ptr[0] == X86_GROUP_0F)
104 		ptr++;
105 	/* 4-byte relative jump or call */
106 	*(uint32_t *)(ptr + 1 - (uintptr_t)from_s + (uintptr_t)to_s) +=
107 	    ((uint32_t)(uintptr_t)from_s - (uint32_t)(uintptr_t)to_s);
108 }
109 
110 static void __unused
111 patchfunc(void *from_s, void *from_e, void *to_s, void *to_e,
112 	  void *pcrel)
113 {
114 
115 	if ((uintptr_t)from_e - (uintptr_t)from_s !=
116 	    (uintptr_t)to_e - (uintptr_t)to_s)
117 		panic("patchfunc: sizes do not match (from=%p)", from_s);
118 
119 	memcpy(to_s, from_s, (uintptr_t)to_e - (uintptr_t)to_s);
120 	if (pcrel != NULL)
121 		adjust_jumpoff(pcrel, from_s, to_s);
122 }
123 
124 static inline void __unused
125 patchbytes(void *addr, const uint8_t *bytes, size_t size)
126 {
127 	uint8_t *ptr = (uint8_t *)addr;
128 	size_t i;
129 
130 	for (i = 0; i < size; i++) {
131 		ptr[i] = bytes[i];
132 	}
133 }
134 
135 void
136 x86_hotpatch(uint32_t name, const uint8_t *bytes, size_t size)
137 {
138 	extern char __rodata_hotpatch_start;
139 	extern char __rodata_hotpatch_end;
140 	struct hotpatch *hps, *hpe, *hp;
141 
142 	hps = (struct hotpatch *)&__rodata_hotpatch_start;
143 	hpe = (struct hotpatch *)&__rodata_hotpatch_end;
144 
145 	for (hp = hps; hp < hpe; hp++) {
146 		if (hp->name != name) {
147 			continue;
148 		}
149 		if (hp->size != size) {
150 			panic("x86_hotpatch: incorrect size");
151 		}
152 		patchbytes(hp->addr, bytes, size);
153 	}
154 }
155 
156 void
157 x86_patch_window_open(u_long *psl, u_long *cr0)
158 {
159 	/* Disable interrupts. */
160 	*psl = x86_read_psl();
161 	x86_disable_intr();
162 
163 	/* Disable write protection in supervisor mode. */
164 	*cr0 = rcr0();
165 	lcr0(*cr0 & ~CR0_WP);
166 }
167 
168 void
169 x86_patch_window_close(u_long psl, u_long cr0)
170 {
171 	/* Write back and invalidate cache, flush pipelines. */
172 	wbinvd();
173 	x86_flush();
174 
175 	/* Re-enable write protection. */
176 	lcr0(cr0);
177 
178 	/* Restore the PSL, potentially re-enabling interrupts. */
179 	x86_write_psl(psl);
180 }
181 
182 void
183 x86_patch(bool early)
184 {
185 	static bool first, second;
186 	u_long psl;
187 	u_long cr0;
188 
189 	if (early) {
190 		if (first)
191 			return;
192 		first = true;
193 	} else {
194 		if (second)
195 			return;
196 		second = true;
197 	}
198 
199 	x86_patch_window_open(&psl, &cr0);
200 
201 	if (!early && ncpu == 1) {
202 #ifndef LOCKDEBUG
203 		/*
204 		 * Uniprocessor: kill LOCK prefixes.
205 		 */
206 		const uint8_t bytes[] = {
207 			X86_NOP
208 		};
209 
210 		/* lock -> nop */
211 		x86_hotpatch(HP_NAME_NOLOCK, bytes, sizeof(bytes));
212 		for (int i = 0; atomic_lockpatch[i] != 0; i++)
213 			patchbytes(atomic_lockpatch[i], bytes, sizeof(bytes));
214 #endif
215 	}
216 
217 	if (!early && (cpu_feature[0] & CPUID_SSE2) != 0) {
218 		/*
219 		 * Faster memory barriers.  We do not need to patch
220 		 * membar_producer to use SFENCE because on x86
221 		 * ordinary non-temporal stores are always issued in
222 		 * program order to main memory and to other CPUs.
223 		 */
224 		patchfunc(
225 		    sse2_lfence, sse2_lfence_end,
226 		    membar_consumer, membar_consumer_end,
227 		    NULL
228 		);
229 		patchfunc(
230 		    sse2_mfence, sse2_mfence_end,
231 		    membar_sync, membar_sync_end,
232 		    NULL
233 		);
234 	}
235 
236 #ifdef i386
237 	/*
238 	 * Patch early and late.  Second time around the 'lock' prefix
239 	 * may be gone.
240 	 */
241 	if ((cpu_feature[0] & CPUID_CX8) != 0) {
242 		patchfunc(
243 		    _atomic_cas_cx8, _atomic_cas_cx8_end,
244 		    _atomic_cas_64, _atomic_cas_64_end,
245 		    NULL
246 		);
247 	}
248 #endif	/* i386 */
249 
250 #if !defined(SPLDEBUG)
251 	if (!early && (cpu_feature[0] & CPUID_CX8) != 0) {
252 		/* Faster splx(), mutex_spin_exit(). */
253 		patchfunc(
254 		    cx8_spllower, cx8_spllower_end,
255 		    spllower, spllower_end,
256 		    cx8_spllower_patch
257 		);
258 #if defined(i386) && !defined(LOCKDEBUG)
259 		patchfunc(
260 		    i686_mutex_spin_exit, i686_mutex_spin_exit_end,
261 		    mutex_spin_exit, mutex_spin_exit_end,
262 		    i686_mutex_spin_exit_patch
263 		);
264 #endif	/* i386 && !LOCKDEBUG */
265 	}
266 #endif /* !SPLDEBUG */
267 
268 	/*
269 	 * On some Opteron revisions, locked operations erroneously
270 	 * allow memory references to be `bled' outside of critical
271 	 * sections.  Apply workaround.
272 	 */
273 	if (cpu_vendor == CPUVENDOR_AMD &&
274 	    (CPUID_TO_FAMILY(cpu_info_primary.ci_signature) == 0xe ||
275 	    (CPUID_TO_FAMILY(cpu_info_primary.ci_signature) == 0xf &&
276 	    CPUID_TO_EXTMODEL(cpu_info_primary.ci_signature) < 0x4))) {
277 		const uint8_t bytes[] = {
278 			0x0F, 0xAE, 0xE8 /* lfence */
279 		};
280 
281 		/* ret,nop,nop -> lfence */
282 		x86_hotpatch(HP_NAME_RETFENCE, bytes, sizeof(bytes));
283 	}
284 
285 	/*
286 	 * If SMAP is present then patch the prepared holes with clac/stac
287 	 * instructions.
288 	 *
289 	 * clac = 0x0f, 0x01, 0xca
290 	 * stac = 0x0f, 0x01, 0xcb
291 	 */
292 	if (!early && cpu_feature[5] & CPUID_SEF_SMAP) {
293 		KASSERT(rcr4() & CR4_SMAP);
294 		const uint8_t clac_bytes[] = {
295 			0x0F, 0x01, 0xCA /* clac */
296 		};
297 		const uint8_t stac_bytes[] = {
298 			0x0F, 0x01, 0xCB /* stac */
299 		};
300 
301 		/* nop,nop,nop -> clac */
302 		x86_hotpatch(HP_NAME_CLAC, clac_bytes, sizeof(clac_bytes));
303 
304 		/* nop,nop,nop -> stac */
305 		x86_hotpatch(HP_NAME_STAC, stac_bytes, sizeof(stac_bytes));
306 	}
307 
308 	x86_patch_window_close(psl, cr0);
309 }
310