1// SPDX-License-Identifier: GPL-2.0-or-later
  2/*
  3 * Copyright (C) 2015 Josh Poimboeuf <jpoimboe@redhat.com>
  4 */
  5
  6/*
  7 * This file reads all the special sections which have alternate instructions
  8 * which can be patched in or redirected to at runtime.
  9 */
 10
 11#include <stdlib.h>
 12#include <string.h>
 13
 14#include "builtin.h"
 15#include "special.h"
 16#include "warn.h"
 17
 18#define EX_ENTRY_SIZE		12
 19#define EX_ORIG_OFFSET		0
 20#define EX_NEW_OFFSET		4
 21
 22#define JUMP_ENTRY_SIZE		16
 23#define JUMP_ORIG_OFFSET	0
 24#define JUMP_NEW_OFFSET		4
 25
 26#define ALT_ENTRY_SIZE		13
 27#define ALT_ORIG_OFFSET		0
 28#define ALT_NEW_OFFSET		4
 29#define ALT_FEATURE_OFFSET	8
 30#define ALT_ORIG_LEN_OFFSET	10
 31#define ALT_NEW_LEN_OFFSET	11
 32
 33#define X86_FEATURE_POPCNT (4*32+23)
 34#define X86_FEATURE_SMAP   (9*32+20)
 35
 36struct special_entry {
 37	const char *sec;
 38	bool group, jump_or_nop;
 39	unsigned char size, orig, new;
 40	unsigned char orig_len, new_len; /* group only */
 41	unsigned char feature; /* ALTERNATIVE macro CPU feature */
 42};
 43
 44struct special_entry entries[] = {
 45	{
 46		.sec = ".altinstructions",
 47		.group = true,
 48		.size = ALT_ENTRY_SIZE,
 49		.orig = ALT_ORIG_OFFSET,
 50		.orig_len = ALT_ORIG_LEN_OFFSET,
 51		.new = ALT_NEW_OFFSET,
 52		.new_len = ALT_NEW_LEN_OFFSET,
 53		.feature = ALT_FEATURE_OFFSET,
 54	},
 55	{
 56		.sec = "__jump_table",
 57		.jump_or_nop = true,
 58		.size = JUMP_ENTRY_SIZE,
 59		.orig = JUMP_ORIG_OFFSET,
 60		.new = JUMP_NEW_OFFSET,
 61	},
 62	{
 63		.sec = "__ex_table",
 64		.size = EX_ENTRY_SIZE,
 65		.orig = EX_ORIG_OFFSET,
 66		.new = EX_NEW_OFFSET,
 67	},
 68	{},
 69};
 70
 71static int get_alt_entry(struct elf *elf, struct special_entry *entry,
 72			 struct section *sec, int idx,
 73			 struct special_alt *alt)
 74{
 75	struct rela *orig_rela, *new_rela;
 76	unsigned long offset;
 77
 78	offset = idx * entry->size;
 79
 80	alt->group = entry->group;
 81	alt->jump_or_nop = entry->jump_or_nop;
 82
 83	if (alt->group) {
 84		alt->orig_len = *(unsigned char *)(sec->data->d_buf + offset +
 85						   entry->orig_len);
 86		alt->new_len = *(unsigned char *)(sec->data->d_buf + offset +
 87						  entry->new_len);
 88	}
 89
 90	if (entry->feature) {
 91		unsigned short feature;
 92
 93		feature = *(unsigned short *)(sec->data->d_buf + offset +
 94					      entry->feature);
 95
 96		/*
 97		 * It has been requested that we don't validate the !POPCNT
 98		 * feature path which is a "very very small percentage of
 99		 * machines".
100		 */
101		if (feature == X86_FEATURE_POPCNT)
102			alt->skip_orig = true;
103
104		/*
105		 * If UACCESS validation is enabled; force that alternative;
106		 * otherwise force it the other way.
107		 *
108		 * What we want to avoid is having both the original and the
109		 * alternative code flow at the same time, in that case we can
110		 * find paths that see the STAC but take the NOP instead of
111		 * CLAC and the other way around.
112		 */
113		if (feature == X86_FEATURE_SMAP) {
114			if (uaccess)
115				alt->skip_orig = true;
116			else
117				alt->skip_alt = true;
118		}
119	}
120
121	orig_rela = find_rela_by_dest(sec, offset + entry->orig);
122	if (!orig_rela) {
123		WARN_FUNC("can't find orig rela", sec, offset + entry->orig);
124		return -1;
125	}
126	if (orig_rela->sym->type != STT_SECTION) {
127		WARN_FUNC("don't know how to handle non-section rela symbol %s",
128			   sec, offset + entry->orig, orig_rela->sym->name);
129		return -1;
130	}
131
132	alt->orig_sec = orig_rela->sym->sec;
133	alt->orig_off = orig_rela->addend;
134
135	if (!entry->group || alt->new_len) {
136		new_rela = find_rela_by_dest(sec, offset + entry->new);
137		if (!new_rela) {
138			WARN_FUNC("can't find new rela",
139				  sec, offset + entry->new);
140			return -1;
141		}
142
143		alt->new_sec = new_rela->sym->sec;
144		alt->new_off = (unsigned int)new_rela->addend;
145
146		/* _ASM_EXTABLE_EX hack */
147		if (alt->new_off >= 0x7ffffff0)
148			alt->new_off -= 0x7ffffff0;
149	}
150
151	return 0;
152}
153
154/*
155 * Read all the special sections and create a list of special_alt structs which
156 * describe all the alternate instructions which can be patched in or
157 * redirected to at runtime.
158 */
159int special_get_alts(struct elf *elf, struct list_head *alts)
160{
161	struct special_entry *entry;
162	struct section *sec;
163	unsigned int nr_entries;
164	struct special_alt *alt;
165	int idx, ret;
166
167	INIT_LIST_HEAD(alts);
168
169	for (entry = entries; entry->sec; entry++) {
170		sec = find_section_by_name(elf, entry->sec);
171		if (!sec)
172			continue;
173
174		if (sec->len % entry->size != 0) {
175			WARN("%s size not a multiple of %d",
176			     sec->name, entry->size);
177			return -1;
178		}
179
180		nr_entries = sec->len / entry->size;
181
182		for (idx = 0; idx < nr_entries; idx++) {
183			alt = malloc(sizeof(*alt));
184			if (!alt) {
185				WARN("malloc failed");
186				return -1;
187			}
188			memset(alt, 0, sizeof(*alt));
189
190			ret = get_alt_entry(elf, entry, sec, idx, alt);
191			if (ret)
192				return ret;
193
194			list_add_tail(&alt->list, alts);
195		}
196	}
197
198	return 0;
199}