Loading...
1// SPDX-License-Identifier: GPL-2.0+
2/*
3 * Kernel module help for s390.
4 *
5 * S390 version
6 * Copyright IBM Corp. 2002, 2003
7 * Author(s): Arnd Bergmann (arndb@de.ibm.com)
8 * Martin Schwidefsky (schwidefsky@de.ibm.com)
9 *
10 * based on i386 version
11 * Copyright (C) 2001 Rusty Russell.
12 */
13#include <linux/module.h>
14#include <linux/elf.h>
15#include <linux/vmalloc.h>
16#include <linux/fs.h>
17#include <linux/ftrace.h>
18#include <linux/string.h>
19#include <linux/kernel.h>
20#include <linux/kasan.h>
21#include <linux/moduleloader.h>
22#include <linux/bug.h>
23#include <linux/memory.h>
24#include <asm/alternative.h>
25#include <asm/nospec-branch.h>
26#include <asm/facility.h>
27#include <asm/ftrace.lds.h>
28#include <asm/set_memory.h>
29
30#if 0
31#define DEBUGP printk
32#else
33#define DEBUGP(fmt , ...)
34#endif
35
36#define PLT_ENTRY_SIZE 22
37
38void *module_alloc(unsigned long size)
39{
40 gfp_t gfp_mask = GFP_KERNEL;
41 void *p;
42
43 if (PAGE_ALIGN(size) > MODULES_LEN)
44 return NULL;
45 p = __vmalloc_node_range(size, MODULE_ALIGN, MODULES_VADDR, MODULES_END,
46 gfp_mask, PAGE_KERNEL_EXEC, VM_DEFER_KMEMLEAK, NUMA_NO_NODE,
47 __builtin_return_address(0));
48 if (p && (kasan_alloc_module_shadow(p, size, gfp_mask) < 0)) {
49 vfree(p);
50 return NULL;
51 }
52 return p;
53}
54
55#ifdef CONFIG_FUNCTION_TRACER
56void module_arch_cleanup(struct module *mod)
57{
58 module_memfree(mod->arch.trampolines_start);
59}
60#endif
61
62void module_arch_freeing_init(struct module *mod)
63{
64 if (is_livepatch_module(mod) &&
65 mod->state == MODULE_STATE_LIVE)
66 return;
67
68 vfree(mod->arch.syminfo);
69 mod->arch.syminfo = NULL;
70}
71
72static void check_rela(Elf_Rela *rela, struct module *me)
73{
74 struct mod_arch_syminfo *info;
75
76 info = me->arch.syminfo + ELF_R_SYM (rela->r_info);
77 switch (ELF_R_TYPE (rela->r_info)) {
78 case R_390_GOT12: /* 12 bit GOT offset. */
79 case R_390_GOT16: /* 16 bit GOT offset. */
80 case R_390_GOT20: /* 20 bit GOT offset. */
81 case R_390_GOT32: /* 32 bit GOT offset. */
82 case R_390_GOT64: /* 64 bit GOT offset. */
83 case R_390_GOTENT: /* 32 bit PC rel. to GOT entry shifted by 1. */
84 case R_390_GOTPLT12: /* 12 bit offset to jump slot. */
85 case R_390_GOTPLT16: /* 16 bit offset to jump slot. */
86 case R_390_GOTPLT20: /* 20 bit offset to jump slot. */
87 case R_390_GOTPLT32: /* 32 bit offset to jump slot. */
88 case R_390_GOTPLT64: /* 64 bit offset to jump slot. */
89 case R_390_GOTPLTENT: /* 32 bit rel. offset to jump slot >> 1. */
90 if (info->got_offset == -1UL) {
91 info->got_offset = me->arch.got_size;
92 me->arch.got_size += sizeof(void*);
93 }
94 break;
95 case R_390_PLT16DBL: /* 16 bit PC rel. PLT shifted by 1. */
96 case R_390_PLT32DBL: /* 32 bit PC rel. PLT shifted by 1. */
97 case R_390_PLT32: /* 32 bit PC relative PLT address. */
98 case R_390_PLT64: /* 64 bit PC relative PLT address. */
99 case R_390_PLTOFF16: /* 16 bit offset from GOT to PLT. */
100 case R_390_PLTOFF32: /* 32 bit offset from GOT to PLT. */
101 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
102 if (info->plt_offset == -1UL) {
103 info->plt_offset = me->arch.plt_size;
104 me->arch.plt_size += PLT_ENTRY_SIZE;
105 }
106 break;
107 case R_390_COPY:
108 case R_390_GLOB_DAT:
109 case R_390_JMP_SLOT:
110 case R_390_RELATIVE:
111 /* Only needed if we want to support loading of
112 modules linked with -shared. */
113 break;
114 }
115}
116
117/*
118 * Account for GOT and PLT relocations. We can't add sections for
119 * got and plt but we can increase the core module size.
120 */
121int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
122 char *secstrings, struct module *me)
123{
124 Elf_Shdr *symtab;
125 Elf_Sym *symbols;
126 Elf_Rela *rela;
127 char *strings;
128 int nrela, i, j;
129
130 /* Find symbol table and string table. */
131 symtab = NULL;
132 for (i = 0; i < hdr->e_shnum; i++)
133 switch (sechdrs[i].sh_type) {
134 case SHT_SYMTAB:
135 symtab = sechdrs + i;
136 break;
137 }
138 if (!symtab) {
139 printk(KERN_ERR "module %s: no symbol table\n", me->name);
140 return -ENOEXEC;
141 }
142
143 /* Allocate one syminfo structure per symbol. */
144 me->arch.nsyms = symtab->sh_size / sizeof(Elf_Sym);
145 me->arch.syminfo = vmalloc(array_size(sizeof(struct mod_arch_syminfo),
146 me->arch.nsyms));
147 if (!me->arch.syminfo)
148 return -ENOMEM;
149 symbols = (void *) hdr + symtab->sh_offset;
150 strings = (void *) hdr + sechdrs[symtab->sh_link].sh_offset;
151 for (i = 0; i < me->arch.nsyms; i++) {
152 if (symbols[i].st_shndx == SHN_UNDEF &&
153 strcmp(strings + symbols[i].st_name,
154 "_GLOBAL_OFFSET_TABLE_") == 0)
155 /* "Define" it as absolute. */
156 symbols[i].st_shndx = SHN_ABS;
157 me->arch.syminfo[i].got_offset = -1UL;
158 me->arch.syminfo[i].plt_offset = -1UL;
159 me->arch.syminfo[i].got_initialized = 0;
160 me->arch.syminfo[i].plt_initialized = 0;
161 }
162
163 /* Search for got/plt relocations. */
164 me->arch.got_size = me->arch.plt_size = 0;
165 for (i = 0; i < hdr->e_shnum; i++) {
166 if (sechdrs[i].sh_type != SHT_RELA)
167 continue;
168 nrela = sechdrs[i].sh_size / sizeof(Elf_Rela);
169 rela = (void *) hdr + sechdrs[i].sh_offset;
170 for (j = 0; j < nrela; j++)
171 check_rela(rela + j, me);
172 }
173
174 /* Increase core size by size of got & plt and set start
175 offsets for got and plt. */
176 me->core_layout.size = ALIGN(me->core_layout.size, 4);
177 me->arch.got_offset = me->core_layout.size;
178 me->core_layout.size += me->arch.got_size;
179 me->arch.plt_offset = me->core_layout.size;
180 if (me->arch.plt_size) {
181 if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable)
182 me->arch.plt_size += PLT_ENTRY_SIZE;
183 me->core_layout.size += me->arch.plt_size;
184 }
185 return 0;
186}
187
188static int apply_rela_bits(Elf_Addr loc, Elf_Addr val,
189 int sign, int bits, int shift,
190 void *(*write)(void *dest, const void *src, size_t len))
191{
192 unsigned long umax;
193 long min, max;
194 void *dest = (void *)loc;
195
196 if (val & ((1UL << shift) - 1))
197 return -ENOEXEC;
198 if (sign) {
199 val = (Elf_Addr)(((long) val) >> shift);
200 min = -(1L << (bits - 1));
201 max = (1L << (bits - 1)) - 1;
202 if ((long) val < min || (long) val > max)
203 return -ENOEXEC;
204 } else {
205 val >>= shift;
206 umax = ((1UL << (bits - 1)) << 1) - 1;
207 if ((unsigned long) val > umax)
208 return -ENOEXEC;
209 }
210
211 if (bits == 8) {
212 unsigned char tmp = val;
213 write(dest, &tmp, 1);
214 } else if (bits == 12) {
215 unsigned short tmp = (val & 0xfff) |
216 (*(unsigned short *) loc & 0xf000);
217 write(dest, &tmp, 2);
218 } else if (bits == 16) {
219 unsigned short tmp = val;
220 write(dest, &tmp, 2);
221 } else if (bits == 20) {
222 unsigned int tmp = (val & 0xfff) << 16 |
223 (val & 0xff000) >> 4 | (*(unsigned int *) loc & 0xf00000ff);
224 write(dest, &tmp, 4);
225 } else if (bits == 32) {
226 unsigned int tmp = val;
227 write(dest, &tmp, 4);
228 } else if (bits == 64) {
229 unsigned long tmp = val;
230 write(dest, &tmp, 8);
231 }
232 return 0;
233}
234
235static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
236 const char *strtab, struct module *me,
237 void *(*write)(void *dest, const void *src, size_t len))
238{
239 struct mod_arch_syminfo *info;
240 Elf_Addr loc, val;
241 int r_type, r_sym;
242 int rc = -ENOEXEC;
243
244 /* This is where to make the change */
245 loc = base + rela->r_offset;
246 /* This is the symbol it is referring to. Note that all
247 undefined symbols have been resolved. */
248 r_sym = ELF_R_SYM(rela->r_info);
249 r_type = ELF_R_TYPE(rela->r_info);
250 info = me->arch.syminfo + r_sym;
251 val = symtab[r_sym].st_value;
252
253 switch (r_type) {
254 case R_390_NONE: /* No relocation. */
255 rc = 0;
256 break;
257 case R_390_8: /* Direct 8 bit. */
258 case R_390_12: /* Direct 12 bit. */
259 case R_390_16: /* Direct 16 bit. */
260 case R_390_20: /* Direct 20 bit. */
261 case R_390_32: /* Direct 32 bit. */
262 case R_390_64: /* Direct 64 bit. */
263 val += rela->r_addend;
264 if (r_type == R_390_8)
265 rc = apply_rela_bits(loc, val, 0, 8, 0, write);
266 else if (r_type == R_390_12)
267 rc = apply_rela_bits(loc, val, 0, 12, 0, write);
268 else if (r_type == R_390_16)
269 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
270 else if (r_type == R_390_20)
271 rc = apply_rela_bits(loc, val, 1, 20, 0, write);
272 else if (r_type == R_390_32)
273 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
274 else if (r_type == R_390_64)
275 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
276 break;
277 case R_390_PC16: /* PC relative 16 bit. */
278 case R_390_PC16DBL: /* PC relative 16 bit shifted by 1. */
279 case R_390_PC32DBL: /* PC relative 32 bit shifted by 1. */
280 case R_390_PC32: /* PC relative 32 bit. */
281 case R_390_PC64: /* PC relative 64 bit. */
282 val += rela->r_addend - loc;
283 if (r_type == R_390_PC16)
284 rc = apply_rela_bits(loc, val, 1, 16, 0, write);
285 else if (r_type == R_390_PC16DBL)
286 rc = apply_rela_bits(loc, val, 1, 16, 1, write);
287 else if (r_type == R_390_PC32DBL)
288 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
289 else if (r_type == R_390_PC32)
290 rc = apply_rela_bits(loc, val, 1, 32, 0, write);
291 else if (r_type == R_390_PC64)
292 rc = apply_rela_bits(loc, val, 1, 64, 0, write);
293 break;
294 case R_390_GOT12: /* 12 bit GOT offset. */
295 case R_390_GOT16: /* 16 bit GOT offset. */
296 case R_390_GOT20: /* 20 bit GOT offset. */
297 case R_390_GOT32: /* 32 bit GOT offset. */
298 case R_390_GOT64: /* 64 bit GOT offset. */
299 case R_390_GOTENT: /* 32 bit PC rel. to GOT entry shifted by 1. */
300 case R_390_GOTPLT12: /* 12 bit offset to jump slot. */
301 case R_390_GOTPLT20: /* 20 bit offset to jump slot. */
302 case R_390_GOTPLT16: /* 16 bit offset to jump slot. */
303 case R_390_GOTPLT32: /* 32 bit offset to jump slot. */
304 case R_390_GOTPLT64: /* 64 bit offset to jump slot. */
305 case R_390_GOTPLTENT: /* 32 bit rel. offset to jump slot >> 1. */
306 if (info->got_initialized == 0) {
307 Elf_Addr *gotent = me->core_layout.base +
308 me->arch.got_offset +
309 info->got_offset;
310
311 write(gotent, &val, sizeof(*gotent));
312 info->got_initialized = 1;
313 }
314 val = info->got_offset + rela->r_addend;
315 if (r_type == R_390_GOT12 ||
316 r_type == R_390_GOTPLT12)
317 rc = apply_rela_bits(loc, val, 0, 12, 0, write);
318 else if (r_type == R_390_GOT16 ||
319 r_type == R_390_GOTPLT16)
320 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
321 else if (r_type == R_390_GOT20 ||
322 r_type == R_390_GOTPLT20)
323 rc = apply_rela_bits(loc, val, 1, 20, 0, write);
324 else if (r_type == R_390_GOT32 ||
325 r_type == R_390_GOTPLT32)
326 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
327 else if (r_type == R_390_GOT64 ||
328 r_type == R_390_GOTPLT64)
329 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
330 else if (r_type == R_390_GOTENT ||
331 r_type == R_390_GOTPLTENT) {
332 val += (Elf_Addr) me->core_layout.base - loc;
333 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
334 }
335 break;
336 case R_390_PLT16DBL: /* 16 bit PC rel. PLT shifted by 1. */
337 case R_390_PLT32DBL: /* 32 bit PC rel. PLT shifted by 1. */
338 case R_390_PLT32: /* 32 bit PC relative PLT address. */
339 case R_390_PLT64: /* 64 bit PC relative PLT address. */
340 case R_390_PLTOFF16: /* 16 bit offset from GOT to PLT. */
341 case R_390_PLTOFF32: /* 32 bit offset from GOT to PLT. */
342 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
343 if (info->plt_initialized == 0) {
344 unsigned char insn[PLT_ENTRY_SIZE];
345 char *plt_base;
346 char *ip;
347
348 plt_base = me->core_layout.base + me->arch.plt_offset;
349 ip = plt_base + info->plt_offset;
350 *(int *)insn = 0x0d10e310; /* basr 1,0 */
351 *(int *)&insn[4] = 0x100c0004; /* lg 1,12(1) */
352 if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable) {
353 char *jump_r1;
354
355 jump_r1 = plt_base + me->arch.plt_size -
356 PLT_ENTRY_SIZE;
357 /* brcl 0xf,__jump_r1 */
358 *(short *)&insn[8] = 0xc0f4;
359 *(int *)&insn[10] = (jump_r1 - (ip + 8)) / 2;
360 } else {
361 *(int *)&insn[8] = 0x07f10000; /* br %r1 */
362 }
363 *(long *)&insn[14] = val;
364
365 write(ip, insn, sizeof(insn));
366 info->plt_initialized = 1;
367 }
368 if (r_type == R_390_PLTOFF16 ||
369 r_type == R_390_PLTOFF32 ||
370 r_type == R_390_PLTOFF64)
371 val = me->arch.plt_offset - me->arch.got_offset +
372 info->plt_offset + rela->r_addend;
373 else {
374 if (!((r_type == R_390_PLT16DBL &&
375 val - loc + 0xffffUL < 0x1ffffeUL) ||
376 (r_type == R_390_PLT32DBL &&
377 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
378 val = (Elf_Addr) me->core_layout.base +
379 me->arch.plt_offset +
380 info->plt_offset;
381 val += rela->r_addend - loc;
382 }
383 if (r_type == R_390_PLT16DBL)
384 rc = apply_rela_bits(loc, val, 1, 16, 1, write);
385 else if (r_type == R_390_PLTOFF16)
386 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
387 else if (r_type == R_390_PLT32DBL)
388 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
389 else if (r_type == R_390_PLT32 ||
390 r_type == R_390_PLTOFF32)
391 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
392 else if (r_type == R_390_PLT64 ||
393 r_type == R_390_PLTOFF64)
394 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
395 break;
396 case R_390_GOTOFF16: /* 16 bit offset to GOT. */
397 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
398 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
399 val = val + rela->r_addend -
400 ((Elf_Addr) me->core_layout.base + me->arch.got_offset);
401 if (r_type == R_390_GOTOFF16)
402 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
403 else if (r_type == R_390_GOTOFF32)
404 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
405 else if (r_type == R_390_GOTOFF64)
406 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
407 break;
408 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
409 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
410 val = (Elf_Addr) me->core_layout.base + me->arch.got_offset +
411 rela->r_addend - loc;
412 if (r_type == R_390_GOTPC)
413 rc = apply_rela_bits(loc, val, 1, 32, 0, write);
414 else if (r_type == R_390_GOTPCDBL)
415 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
416 break;
417 case R_390_COPY:
418 case R_390_GLOB_DAT: /* Create GOT entry. */
419 case R_390_JMP_SLOT: /* Create PLT entry. */
420 case R_390_RELATIVE: /* Adjust by program base. */
421 /* Only needed if we want to support loading of
422 modules linked with -shared. */
423 return -ENOEXEC;
424 default:
425 printk(KERN_ERR "module %s: unknown relocation: %u\n",
426 me->name, r_type);
427 return -ENOEXEC;
428 }
429 if (rc) {
430 printk(KERN_ERR "module %s: relocation error for symbol %s "
431 "(r_type %i, value 0x%lx)\n",
432 me->name, strtab + symtab[r_sym].st_name,
433 r_type, (unsigned long) val);
434 return rc;
435 }
436 return 0;
437}
438
439static int __apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
440 unsigned int symindex, unsigned int relsec,
441 struct module *me,
442 void *(*write)(void *dest, const void *src, size_t len))
443{
444 Elf_Addr base;
445 Elf_Sym *symtab;
446 Elf_Rela *rela;
447 unsigned long i, n;
448 int rc;
449
450 DEBUGP("Applying relocate section %u to %u\n",
451 relsec, sechdrs[relsec].sh_info);
452 base = sechdrs[sechdrs[relsec].sh_info].sh_addr;
453 symtab = (Elf_Sym *) sechdrs[symindex].sh_addr;
454 rela = (Elf_Rela *) sechdrs[relsec].sh_addr;
455 n = sechdrs[relsec].sh_size / sizeof(Elf_Rela);
456
457 for (i = 0; i < n; i++, rela++) {
458 rc = apply_rela(rela, base, symtab, strtab, me, write);
459 if (rc)
460 return rc;
461 }
462 return 0;
463}
464
465int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
466 unsigned int symindex, unsigned int relsec,
467 struct module *me)
468{
469 bool early = me->state == MODULE_STATE_UNFORMED;
470 void *(*write)(void *, const void *, size_t) = memcpy;
471
472 if (!early)
473 write = s390_kernel_write;
474
475 return __apply_relocate_add(sechdrs, strtab, symindex, relsec, me,
476 write);
477}
478
479#ifdef CONFIG_FUNCTION_TRACER
480static int module_alloc_ftrace_hotpatch_trampolines(struct module *me,
481 const Elf_Shdr *s)
482{
483 char *start, *end;
484 int numpages;
485 size_t size;
486
487 size = FTRACE_HOTPATCH_TRAMPOLINES_SIZE(s->sh_size);
488 numpages = DIV_ROUND_UP(size, PAGE_SIZE);
489 start = module_alloc(numpages * PAGE_SIZE);
490 if (!start)
491 return -ENOMEM;
492 set_memory_ro((unsigned long)start, numpages);
493 end = start + size;
494
495 me->arch.trampolines_start = (struct ftrace_hotpatch_trampoline *)start;
496 me->arch.trampolines_end = (struct ftrace_hotpatch_trampoline *)end;
497 me->arch.next_trampoline = me->arch.trampolines_start;
498
499 return 0;
500}
501#endif /* CONFIG_FUNCTION_TRACER */
502
503int module_finalize(const Elf_Ehdr *hdr,
504 const Elf_Shdr *sechdrs,
505 struct module *me)
506{
507 const Elf_Shdr *s;
508 char *secstrings, *secname;
509 void *aseg;
510#ifdef CONFIG_FUNCTION_TRACER
511 int ret;
512#endif
513
514 if (IS_ENABLED(CONFIG_EXPOLINE) &&
515 !nospec_disable && me->arch.plt_size) {
516 unsigned int *ij;
517
518 ij = me->core_layout.base + me->arch.plt_offset +
519 me->arch.plt_size - PLT_ENTRY_SIZE;
520 ij[0] = 0xc6000000; /* exrl %r0,.+10 */
521 ij[1] = 0x0005a7f4; /* j . */
522 ij[2] = 0x000007f1; /* br %r1 */
523 }
524
525 secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
526 for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) {
527 aseg = (void *) s->sh_addr;
528 secname = secstrings + s->sh_name;
529
530 if (!strcmp(".altinstructions", secname))
531 /* patch .altinstructions */
532 apply_alternatives(aseg, aseg + s->sh_size);
533
534 if (IS_ENABLED(CONFIG_EXPOLINE) &&
535 (str_has_prefix(secname, ".s390_indirect")))
536 nospec_revert(aseg, aseg + s->sh_size);
537
538 if (IS_ENABLED(CONFIG_EXPOLINE) &&
539 (str_has_prefix(secname, ".s390_return")))
540 nospec_revert(aseg, aseg + s->sh_size);
541
542#ifdef CONFIG_FUNCTION_TRACER
543 if (!strcmp(FTRACE_CALLSITE_SECTION, secname)) {
544 ret = module_alloc_ftrace_hotpatch_trampolines(me, s);
545 if (ret < 0)
546 return ret;
547 }
548#endif /* CONFIG_FUNCTION_TRACER */
549 }
550
551 return 0;
552}
1// SPDX-License-Identifier: GPL-2.0+
2/*
3 * Kernel module help for s390.
4 *
5 * S390 version
6 * Copyright IBM Corp. 2002, 2003
7 * Author(s): Arnd Bergmann (arndb@de.ibm.com)
8 * Martin Schwidefsky (schwidefsky@de.ibm.com)
9 *
10 * based on i386 version
11 * Copyright (C) 2001 Rusty Russell.
12 */
13#include <linux/module.h>
14#include <linux/elf.h>
15#include <linux/vmalloc.h>
16#include <linux/fs.h>
17#include <linux/string.h>
18#include <linux/kernel.h>
19#include <linux/kasan.h>
20#include <linux/moduleloader.h>
21#include <linux/bug.h>
22#include <linux/memory.h>
23#include <asm/alternative.h>
24#include <asm/nospec-branch.h>
25#include <asm/facility.h>
26
27#if 0
28#define DEBUGP printk
29#else
30#define DEBUGP(fmt , ...)
31#endif
32
33#define PLT_ENTRY_SIZE 20
34
35void *module_alloc(unsigned long size)
36{
37 void *p;
38
39 if (PAGE_ALIGN(size) > MODULES_LEN)
40 return NULL;
41 p = __vmalloc_node_range(size, MODULE_ALIGN, MODULES_VADDR, MODULES_END,
42 GFP_KERNEL, PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
43 __builtin_return_address(0));
44 if (p && (kasan_module_alloc(p, size) < 0)) {
45 vfree(p);
46 return NULL;
47 }
48 return p;
49}
50
51void module_arch_freeing_init(struct module *mod)
52{
53 if (is_livepatch_module(mod) &&
54 mod->state == MODULE_STATE_LIVE)
55 return;
56
57 vfree(mod->arch.syminfo);
58 mod->arch.syminfo = NULL;
59}
60
61static void check_rela(Elf_Rela *rela, struct module *me)
62{
63 struct mod_arch_syminfo *info;
64
65 info = me->arch.syminfo + ELF_R_SYM (rela->r_info);
66 switch (ELF_R_TYPE (rela->r_info)) {
67 case R_390_GOT12: /* 12 bit GOT offset. */
68 case R_390_GOT16: /* 16 bit GOT offset. */
69 case R_390_GOT20: /* 20 bit GOT offset. */
70 case R_390_GOT32: /* 32 bit GOT offset. */
71 case R_390_GOT64: /* 64 bit GOT offset. */
72 case R_390_GOTENT: /* 32 bit PC rel. to GOT entry shifted by 1. */
73 case R_390_GOTPLT12: /* 12 bit offset to jump slot. */
74 case R_390_GOTPLT16: /* 16 bit offset to jump slot. */
75 case R_390_GOTPLT20: /* 20 bit offset to jump slot. */
76 case R_390_GOTPLT32: /* 32 bit offset to jump slot. */
77 case R_390_GOTPLT64: /* 64 bit offset to jump slot. */
78 case R_390_GOTPLTENT: /* 32 bit rel. offset to jump slot >> 1. */
79 if (info->got_offset == -1UL) {
80 info->got_offset = me->arch.got_size;
81 me->arch.got_size += sizeof(void*);
82 }
83 break;
84 case R_390_PLT16DBL: /* 16 bit PC rel. PLT shifted by 1. */
85 case R_390_PLT32DBL: /* 32 bit PC rel. PLT shifted by 1. */
86 case R_390_PLT32: /* 32 bit PC relative PLT address. */
87 case R_390_PLT64: /* 64 bit PC relative PLT address. */
88 case R_390_PLTOFF16: /* 16 bit offset from GOT to PLT. */
89 case R_390_PLTOFF32: /* 32 bit offset from GOT to PLT. */
90 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
91 if (info->plt_offset == -1UL) {
92 info->plt_offset = me->arch.plt_size;
93 me->arch.plt_size += PLT_ENTRY_SIZE;
94 }
95 break;
96 case R_390_COPY:
97 case R_390_GLOB_DAT:
98 case R_390_JMP_SLOT:
99 case R_390_RELATIVE:
100 /* Only needed if we want to support loading of
101 modules linked with -shared. */
102 break;
103 }
104}
105
106/*
107 * Account for GOT and PLT relocations. We can't add sections for
108 * got and plt but we can increase the core module size.
109 */
110int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
111 char *secstrings, struct module *me)
112{
113 Elf_Shdr *symtab;
114 Elf_Sym *symbols;
115 Elf_Rela *rela;
116 char *strings;
117 int nrela, i, j;
118
119 /* Find symbol table and string table. */
120 symtab = NULL;
121 for (i = 0; i < hdr->e_shnum; i++)
122 switch (sechdrs[i].sh_type) {
123 case SHT_SYMTAB:
124 symtab = sechdrs + i;
125 break;
126 }
127 if (!symtab) {
128 printk(KERN_ERR "module %s: no symbol table\n", me->name);
129 return -ENOEXEC;
130 }
131
132 /* Allocate one syminfo structure per symbol. */
133 me->arch.nsyms = symtab->sh_size / sizeof(Elf_Sym);
134 me->arch.syminfo = vmalloc(array_size(sizeof(struct mod_arch_syminfo),
135 me->arch.nsyms));
136 if (!me->arch.syminfo)
137 return -ENOMEM;
138 symbols = (void *) hdr + symtab->sh_offset;
139 strings = (void *) hdr + sechdrs[symtab->sh_link].sh_offset;
140 for (i = 0; i < me->arch.nsyms; i++) {
141 if (symbols[i].st_shndx == SHN_UNDEF &&
142 strcmp(strings + symbols[i].st_name,
143 "_GLOBAL_OFFSET_TABLE_") == 0)
144 /* "Define" it as absolute. */
145 symbols[i].st_shndx = SHN_ABS;
146 me->arch.syminfo[i].got_offset = -1UL;
147 me->arch.syminfo[i].plt_offset = -1UL;
148 me->arch.syminfo[i].got_initialized = 0;
149 me->arch.syminfo[i].plt_initialized = 0;
150 }
151
152 /* Search for got/plt relocations. */
153 me->arch.got_size = me->arch.plt_size = 0;
154 for (i = 0; i < hdr->e_shnum; i++) {
155 if (sechdrs[i].sh_type != SHT_RELA)
156 continue;
157 nrela = sechdrs[i].sh_size / sizeof(Elf_Rela);
158 rela = (void *) hdr + sechdrs[i].sh_offset;
159 for (j = 0; j < nrela; j++)
160 check_rela(rela + j, me);
161 }
162
163 /* Increase core size by size of got & plt and set start
164 offsets for got and plt. */
165 me->core_layout.size = ALIGN(me->core_layout.size, 4);
166 me->arch.got_offset = me->core_layout.size;
167 me->core_layout.size += me->arch.got_size;
168 me->arch.plt_offset = me->core_layout.size;
169 if (me->arch.plt_size) {
170 if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable)
171 me->arch.plt_size += PLT_ENTRY_SIZE;
172 me->core_layout.size += me->arch.plt_size;
173 }
174 return 0;
175}
176
177static int apply_rela_bits(Elf_Addr loc, Elf_Addr val,
178 int sign, int bits, int shift,
179 void *(*write)(void *dest, const void *src, size_t len))
180{
181 unsigned long umax;
182 long min, max;
183 void *dest = (void *)loc;
184
185 if (val & ((1UL << shift) - 1))
186 return -ENOEXEC;
187 if (sign) {
188 val = (Elf_Addr)(((long) val) >> shift);
189 min = -(1L << (bits - 1));
190 max = (1L << (bits - 1)) - 1;
191 if ((long) val < min || (long) val > max)
192 return -ENOEXEC;
193 } else {
194 val >>= shift;
195 umax = ((1UL << (bits - 1)) << 1) - 1;
196 if ((unsigned long) val > umax)
197 return -ENOEXEC;
198 }
199
200 if (bits == 8) {
201 unsigned char tmp = val;
202 write(dest, &tmp, 1);
203 } else if (bits == 12) {
204 unsigned short tmp = (val & 0xfff) |
205 (*(unsigned short *) loc & 0xf000);
206 write(dest, &tmp, 2);
207 } else if (bits == 16) {
208 unsigned short tmp = val;
209 write(dest, &tmp, 2);
210 } else if (bits == 20) {
211 unsigned int tmp = (val & 0xfff) << 16 |
212 (val & 0xff000) >> 4 | (*(unsigned int *) loc & 0xf00000ff);
213 write(dest, &tmp, 4);
214 } else if (bits == 32) {
215 unsigned int tmp = val;
216 write(dest, &tmp, 4);
217 } else if (bits == 64) {
218 unsigned long tmp = val;
219 write(dest, &tmp, 8);
220 }
221 return 0;
222}
223
224static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
225 const char *strtab, struct module *me,
226 void *(*write)(void *dest, const void *src, size_t len))
227{
228 struct mod_arch_syminfo *info;
229 Elf_Addr loc, val;
230 int r_type, r_sym;
231 int rc = -ENOEXEC;
232
233 /* This is where to make the change */
234 loc = base + rela->r_offset;
235 /* This is the symbol it is referring to. Note that all
236 undefined symbols have been resolved. */
237 r_sym = ELF_R_SYM(rela->r_info);
238 r_type = ELF_R_TYPE(rela->r_info);
239 info = me->arch.syminfo + r_sym;
240 val = symtab[r_sym].st_value;
241
242 switch (r_type) {
243 case R_390_NONE: /* No relocation. */
244 rc = 0;
245 break;
246 case R_390_8: /* Direct 8 bit. */
247 case R_390_12: /* Direct 12 bit. */
248 case R_390_16: /* Direct 16 bit. */
249 case R_390_20: /* Direct 20 bit. */
250 case R_390_32: /* Direct 32 bit. */
251 case R_390_64: /* Direct 64 bit. */
252 val += rela->r_addend;
253 if (r_type == R_390_8)
254 rc = apply_rela_bits(loc, val, 0, 8, 0, write);
255 else if (r_type == R_390_12)
256 rc = apply_rela_bits(loc, val, 0, 12, 0, write);
257 else if (r_type == R_390_16)
258 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
259 else if (r_type == R_390_20)
260 rc = apply_rela_bits(loc, val, 1, 20, 0, write);
261 else if (r_type == R_390_32)
262 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
263 else if (r_type == R_390_64)
264 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
265 break;
266 case R_390_PC16: /* PC relative 16 bit. */
267 case R_390_PC16DBL: /* PC relative 16 bit shifted by 1. */
268 case R_390_PC32DBL: /* PC relative 32 bit shifted by 1. */
269 case R_390_PC32: /* PC relative 32 bit. */
270 case R_390_PC64: /* PC relative 64 bit. */
271 val += rela->r_addend - loc;
272 if (r_type == R_390_PC16)
273 rc = apply_rela_bits(loc, val, 1, 16, 0, write);
274 else if (r_type == R_390_PC16DBL)
275 rc = apply_rela_bits(loc, val, 1, 16, 1, write);
276 else if (r_type == R_390_PC32DBL)
277 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
278 else if (r_type == R_390_PC32)
279 rc = apply_rela_bits(loc, val, 1, 32, 0, write);
280 else if (r_type == R_390_PC64)
281 rc = apply_rela_bits(loc, val, 1, 64, 0, write);
282 break;
283 case R_390_GOT12: /* 12 bit GOT offset. */
284 case R_390_GOT16: /* 16 bit GOT offset. */
285 case R_390_GOT20: /* 20 bit GOT offset. */
286 case R_390_GOT32: /* 32 bit GOT offset. */
287 case R_390_GOT64: /* 64 bit GOT offset. */
288 case R_390_GOTENT: /* 32 bit PC rel. to GOT entry shifted by 1. */
289 case R_390_GOTPLT12: /* 12 bit offset to jump slot. */
290 case R_390_GOTPLT20: /* 20 bit offset to jump slot. */
291 case R_390_GOTPLT16: /* 16 bit offset to jump slot. */
292 case R_390_GOTPLT32: /* 32 bit offset to jump slot. */
293 case R_390_GOTPLT64: /* 64 bit offset to jump slot. */
294 case R_390_GOTPLTENT: /* 32 bit rel. offset to jump slot >> 1. */
295 if (info->got_initialized == 0) {
296 Elf_Addr *gotent = me->core_layout.base +
297 me->arch.got_offset +
298 info->got_offset;
299
300 write(gotent, &val, sizeof(*gotent));
301 info->got_initialized = 1;
302 }
303 val = info->got_offset + rela->r_addend;
304 if (r_type == R_390_GOT12 ||
305 r_type == R_390_GOTPLT12)
306 rc = apply_rela_bits(loc, val, 0, 12, 0, write);
307 else if (r_type == R_390_GOT16 ||
308 r_type == R_390_GOTPLT16)
309 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
310 else if (r_type == R_390_GOT20 ||
311 r_type == R_390_GOTPLT20)
312 rc = apply_rela_bits(loc, val, 1, 20, 0, write);
313 else if (r_type == R_390_GOT32 ||
314 r_type == R_390_GOTPLT32)
315 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
316 else if (r_type == R_390_GOT64 ||
317 r_type == R_390_GOTPLT64)
318 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
319 else if (r_type == R_390_GOTENT ||
320 r_type == R_390_GOTPLTENT) {
321 val += (Elf_Addr) me->core_layout.base - loc;
322 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
323 }
324 break;
325 case R_390_PLT16DBL: /* 16 bit PC rel. PLT shifted by 1. */
326 case R_390_PLT32DBL: /* 32 bit PC rel. PLT shifted by 1. */
327 case R_390_PLT32: /* 32 bit PC relative PLT address. */
328 case R_390_PLT64: /* 64 bit PC relative PLT address. */
329 case R_390_PLTOFF16: /* 16 bit offset from GOT to PLT. */
330 case R_390_PLTOFF32: /* 32 bit offset from GOT to PLT. */
331 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
332 if (info->plt_initialized == 0) {
333 unsigned int insn[5];
334 unsigned int *ip = me->core_layout.base +
335 me->arch.plt_offset +
336 info->plt_offset;
337
338 insn[0] = 0x0d10e310; /* basr 1,0 */
339 insn[1] = 0x100a0004; /* lg 1,10(1) */
340 if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable) {
341 unsigned int *ij;
342 ij = me->core_layout.base +
343 me->arch.plt_offset +
344 me->arch.plt_size - PLT_ENTRY_SIZE;
345 insn[2] = 0xa7f40000 + /* j __jump_r1 */
346 (unsigned int)(u16)
347 (((unsigned long) ij - 8 -
348 (unsigned long) ip) / 2);
349 } else {
350 insn[2] = 0x07f10000; /* br %r1 */
351 }
352 insn[3] = (unsigned int) (val >> 32);
353 insn[4] = (unsigned int) val;
354
355 write(ip, insn, sizeof(insn));
356 info->plt_initialized = 1;
357 }
358 if (r_type == R_390_PLTOFF16 ||
359 r_type == R_390_PLTOFF32 ||
360 r_type == R_390_PLTOFF64)
361 val = me->arch.plt_offset - me->arch.got_offset +
362 info->plt_offset + rela->r_addend;
363 else {
364 if (!((r_type == R_390_PLT16DBL &&
365 val - loc + 0xffffUL < 0x1ffffeUL) ||
366 (r_type == R_390_PLT32DBL &&
367 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
368 val = (Elf_Addr) me->core_layout.base +
369 me->arch.plt_offset +
370 info->plt_offset;
371 val += rela->r_addend - loc;
372 }
373 if (r_type == R_390_PLT16DBL)
374 rc = apply_rela_bits(loc, val, 1, 16, 1, write);
375 else if (r_type == R_390_PLTOFF16)
376 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
377 else if (r_type == R_390_PLT32DBL)
378 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
379 else if (r_type == R_390_PLT32 ||
380 r_type == R_390_PLTOFF32)
381 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
382 else if (r_type == R_390_PLT64 ||
383 r_type == R_390_PLTOFF64)
384 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
385 break;
386 case R_390_GOTOFF16: /* 16 bit offset to GOT. */
387 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
388 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
389 val = val + rela->r_addend -
390 ((Elf_Addr) me->core_layout.base + me->arch.got_offset);
391 if (r_type == R_390_GOTOFF16)
392 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
393 else if (r_type == R_390_GOTOFF32)
394 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
395 else if (r_type == R_390_GOTOFF64)
396 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
397 break;
398 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
399 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
400 val = (Elf_Addr) me->core_layout.base + me->arch.got_offset +
401 rela->r_addend - loc;
402 if (r_type == R_390_GOTPC)
403 rc = apply_rela_bits(loc, val, 1, 32, 0, write);
404 else if (r_type == R_390_GOTPCDBL)
405 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
406 break;
407 case R_390_COPY:
408 case R_390_GLOB_DAT: /* Create GOT entry. */
409 case R_390_JMP_SLOT: /* Create PLT entry. */
410 case R_390_RELATIVE: /* Adjust by program base. */
411 /* Only needed if we want to support loading of
412 modules linked with -shared. */
413 return -ENOEXEC;
414 default:
415 printk(KERN_ERR "module %s: unknown relocation: %u\n",
416 me->name, r_type);
417 return -ENOEXEC;
418 }
419 if (rc) {
420 printk(KERN_ERR "module %s: relocation error for symbol %s "
421 "(r_type %i, value 0x%lx)\n",
422 me->name, strtab + symtab[r_sym].st_name,
423 r_type, (unsigned long) val);
424 return rc;
425 }
426 return 0;
427}
428
429static int __apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
430 unsigned int symindex, unsigned int relsec,
431 struct module *me,
432 void *(*write)(void *dest, const void *src, size_t len))
433{
434 Elf_Addr base;
435 Elf_Sym *symtab;
436 Elf_Rela *rela;
437 unsigned long i, n;
438 int rc;
439
440 DEBUGP("Applying relocate section %u to %u\n",
441 relsec, sechdrs[relsec].sh_info);
442 base = sechdrs[sechdrs[relsec].sh_info].sh_addr;
443 symtab = (Elf_Sym *) sechdrs[symindex].sh_addr;
444 rela = (Elf_Rela *) sechdrs[relsec].sh_addr;
445 n = sechdrs[relsec].sh_size / sizeof(Elf_Rela);
446
447 for (i = 0; i < n; i++, rela++) {
448 rc = apply_rela(rela, base, symtab, strtab, me, write);
449 if (rc)
450 return rc;
451 }
452 return 0;
453}
454
455int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
456 unsigned int symindex, unsigned int relsec,
457 struct module *me)
458{
459 bool early = me->state == MODULE_STATE_UNFORMED;
460 void *(*write)(void *, const void *, size_t) = memcpy;
461
462 if (!early)
463 write = s390_kernel_write;
464
465 return __apply_relocate_add(sechdrs, strtab, symindex, relsec, me,
466 write);
467}
468
469int module_finalize(const Elf_Ehdr *hdr,
470 const Elf_Shdr *sechdrs,
471 struct module *me)
472{
473 const Elf_Shdr *s;
474 char *secstrings, *secname;
475 void *aseg;
476
477 if (IS_ENABLED(CONFIG_EXPOLINE) &&
478 !nospec_disable && me->arch.plt_size) {
479 unsigned int *ij;
480
481 ij = me->core_layout.base + me->arch.plt_offset +
482 me->arch.plt_size - PLT_ENTRY_SIZE;
483 if (test_facility(35)) {
484 ij[0] = 0xc6000000; /* exrl %r0,.+10 */
485 ij[1] = 0x0005a7f4; /* j . */
486 ij[2] = 0x000007f1; /* br %r1 */
487 } else {
488 ij[0] = 0x44000000 | (unsigned int)
489 offsetof(struct lowcore, br_r1_trampoline);
490 ij[1] = 0xa7f40000; /* j . */
491 }
492 }
493
494 secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
495 for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) {
496 aseg = (void *) s->sh_addr;
497 secname = secstrings + s->sh_name;
498
499 if (!strcmp(".altinstructions", secname))
500 /* patch .altinstructions */
501 apply_alternatives(aseg, aseg + s->sh_size);
502
503 if (IS_ENABLED(CONFIG_EXPOLINE) &&
504 (str_has_prefix(secname, ".s390_indirect")))
505 nospec_revert(aseg, aseg + s->sh_size);
506
507 if (IS_ENABLED(CONFIG_EXPOLINE) &&
508 (str_has_prefix(secname, ".s390_return")))
509 nospec_revert(aseg, aseg + s->sh_size);
510 }
511
512 jump_label_apply_nops(me);
513 return 0;
514}