1
2
3
4
5
6
7
8
9
10
11
12
13#include <linux/module.h>
14#include <linux/elf.h>
15#include <linux/vmalloc.h>
16#include <linux/fs.h>
17#include <linux/ftrace.h>
18#include <linux/string.h>
19#include <linux/kernel.h>
20#include <linux/kasan.h>
21#include <linux/moduleloader.h>
22#include <linux/bug.h>
23#include <linux/memory.h>
24#include <asm/alternative.h>
25#include <asm/nospec-branch.h>
26#include <asm/facility.h>
27#include <asm/ftrace.lds.h>
28#include <asm/set_memory.h>
29
30#if 0
31#define DEBUGP printk
32#else
33#define DEBUGP(fmt , ...)
34#endif
35
36#define PLT_ENTRY_SIZE 20
37
38void *module_alloc(unsigned long size)
39{
40 void *p;
41
42 if (PAGE_ALIGN(size) > MODULES_LEN)
43 return NULL;
44 p = __vmalloc_node_range(size, MODULE_ALIGN, MODULES_VADDR, MODULES_END,
45 GFP_KERNEL, PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
46 __builtin_return_address(0));
47 if (p && (kasan_module_alloc(p, size) < 0)) {
48 vfree(p);
49 return NULL;
50 }
51 return p;
52}
53
54#ifdef CONFIG_FUNCTION_TRACER
55void module_arch_cleanup(struct module *mod)
56{
57 module_memfree(mod->arch.trampolines_start);
58}
59#endif
60
61void module_arch_freeing_init(struct module *mod)
62{
63 if (is_livepatch_module(mod) &&
64 mod->state == MODULE_STATE_LIVE)
65 return;
66
67 vfree(mod->arch.syminfo);
68 mod->arch.syminfo = NULL;
69}
70
71static void check_rela(Elf_Rela *rela, struct module *me)
72{
73 struct mod_arch_syminfo *info;
74
75 info = me->arch.syminfo + ELF_R_SYM (rela->r_info);
76 switch (ELF_R_TYPE (rela->r_info)) {
77 case R_390_GOT12:
78 case R_390_GOT16:
79 case R_390_GOT20:
80 case R_390_GOT32:
81 case R_390_GOT64:
82 case R_390_GOTENT:
83 case R_390_GOTPLT12:
84 case R_390_GOTPLT16:
85 case R_390_GOTPLT20:
86 case R_390_GOTPLT32:
87 case R_390_GOTPLT64:
88 case R_390_GOTPLTENT:
89 if (info->got_offset == -1UL) {
90 info->got_offset = me->arch.got_size;
91 me->arch.got_size += sizeof(void*);
92 }
93 break;
94 case R_390_PLT16DBL:
95 case R_390_PLT32DBL:
96 case R_390_PLT32:
97 case R_390_PLT64:
98 case R_390_PLTOFF16:
99 case R_390_PLTOFF32:
100 case R_390_PLTOFF64:
101 if (info->plt_offset == -1UL) {
102 info->plt_offset = me->arch.plt_size;
103 me->arch.plt_size += PLT_ENTRY_SIZE;
104 }
105 break;
106 case R_390_COPY:
107 case R_390_GLOB_DAT:
108 case R_390_JMP_SLOT:
109 case R_390_RELATIVE:
110
111
112 break;
113 }
114}
115
116
117
118
119
120int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
121 char *secstrings, struct module *me)
122{
123 Elf_Shdr *symtab;
124 Elf_Sym *symbols;
125 Elf_Rela *rela;
126 char *strings;
127 int nrela, i, j;
128
129
130 symtab = NULL;
131 for (i = 0; i < hdr->e_shnum; i++)
132 switch (sechdrs[i].sh_type) {
133 case SHT_SYMTAB:
134 symtab = sechdrs + i;
135 break;
136 }
137 if (!symtab) {
138 printk(KERN_ERR "module %s: no symbol table\n", me->name);
139 return -ENOEXEC;
140 }
141
142
143 me->arch.nsyms = symtab->sh_size / sizeof(Elf_Sym);
144 me->arch.syminfo = vmalloc(array_size(sizeof(struct mod_arch_syminfo),
145 me->arch.nsyms));
146 if (!me->arch.syminfo)
147 return -ENOMEM;
148 symbols = (void *) hdr + symtab->sh_offset;
149 strings = (void *) hdr + sechdrs[symtab->sh_link].sh_offset;
150 for (i = 0; i < me->arch.nsyms; i++) {
151 if (symbols[i].st_shndx == SHN_UNDEF &&
152 strcmp(strings + symbols[i].st_name,
153 "_GLOBAL_OFFSET_TABLE_") == 0)
154
155 symbols[i].st_shndx = SHN_ABS;
156 me->arch.syminfo[i].got_offset = -1UL;
157 me->arch.syminfo[i].plt_offset = -1UL;
158 me->arch.syminfo[i].got_initialized = 0;
159 me->arch.syminfo[i].plt_initialized = 0;
160 }
161
162
163 me->arch.got_size = me->arch.plt_size = 0;
164 for (i = 0; i < hdr->e_shnum; i++) {
165 if (sechdrs[i].sh_type != SHT_RELA)
166 continue;
167 nrela = sechdrs[i].sh_size / sizeof(Elf_Rela);
168 rela = (void *) hdr + sechdrs[i].sh_offset;
169 for (j = 0; j < nrela; j++)
170 check_rela(rela + j, me);
171 }
172
173
174
175 me->core_layout.size = ALIGN(me->core_layout.size, 4);
176 me->arch.got_offset = me->core_layout.size;
177 me->core_layout.size += me->arch.got_size;
178 me->arch.plt_offset = me->core_layout.size;
179 if (me->arch.plt_size) {
180 if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable)
181 me->arch.plt_size += PLT_ENTRY_SIZE;
182 me->core_layout.size += me->arch.plt_size;
183 }
184 return 0;
185}
186
187static int apply_rela_bits(Elf_Addr loc, Elf_Addr val,
188 int sign, int bits, int shift,
189 void *(*write)(void *dest, const void *src, size_t len))
190{
191 unsigned long umax;
192 long min, max;
193 void *dest = (void *)loc;
194
195 if (val & ((1UL << shift) - 1))
196 return -ENOEXEC;
197 if (sign) {
198 val = (Elf_Addr)(((long) val) >> shift);
199 min = -(1L << (bits - 1));
200 max = (1L << (bits - 1)) - 1;
201 if ((long) val < min || (long) val > max)
202 return -ENOEXEC;
203 } else {
204 val >>= shift;
205 umax = ((1UL << (bits - 1)) << 1) - 1;
206 if ((unsigned long) val > umax)
207 return -ENOEXEC;
208 }
209
210 if (bits == 8) {
211 unsigned char tmp = val;
212 write(dest, &tmp, 1);
213 } else if (bits == 12) {
214 unsigned short tmp = (val & 0xfff) |
215 (*(unsigned short *) loc & 0xf000);
216 write(dest, &tmp, 2);
217 } else if (bits == 16) {
218 unsigned short tmp = val;
219 write(dest, &tmp, 2);
220 } else if (bits == 20) {
221 unsigned int tmp = (val & 0xfff) << 16 |
222 (val & 0xff000) >> 4 | (*(unsigned int *) loc & 0xf00000ff);
223 write(dest, &tmp, 4);
224 } else if (bits == 32) {
225 unsigned int tmp = val;
226 write(dest, &tmp, 4);
227 } else if (bits == 64) {
228 unsigned long tmp = val;
229 write(dest, &tmp, 8);
230 }
231 return 0;
232}
233
234static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
235 const char *strtab, struct module *me,
236 void *(*write)(void *dest, const void *src, size_t len))
237{
238 struct mod_arch_syminfo *info;
239 Elf_Addr loc, val;
240 int r_type, r_sym;
241 int rc = -ENOEXEC;
242
243
244 loc = base + rela->r_offset;
245
246
247 r_sym = ELF_R_SYM(rela->r_info);
248 r_type = ELF_R_TYPE(rela->r_info);
249 info = me->arch.syminfo + r_sym;
250 val = symtab[r_sym].st_value;
251
252 switch (r_type) {
253 case R_390_NONE:
254 rc = 0;
255 break;
256 case R_390_8:
257 case R_390_12:
258 case R_390_16:
259 case R_390_20:
260 case R_390_32:
261 case R_390_64:
262 val += rela->r_addend;
263 if (r_type == R_390_8)
264 rc = apply_rela_bits(loc, val, 0, 8, 0, write);
265 else if (r_type == R_390_12)
266 rc = apply_rela_bits(loc, val, 0, 12, 0, write);
267 else if (r_type == R_390_16)
268 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
269 else if (r_type == R_390_20)
270 rc = apply_rela_bits(loc, val, 1, 20, 0, write);
271 else if (r_type == R_390_32)
272 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
273 else if (r_type == R_390_64)
274 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
275 break;
276 case R_390_PC16:
277 case R_390_PC16DBL:
278 case R_390_PC32DBL:
279 case R_390_PC32:
280 case R_390_PC64:
281 val += rela->r_addend - loc;
282 if (r_type == R_390_PC16)
283 rc = apply_rela_bits(loc, val, 1, 16, 0, write);
284 else if (r_type == R_390_PC16DBL)
285 rc = apply_rela_bits(loc, val, 1, 16, 1, write);
286 else if (r_type == R_390_PC32DBL)
287 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
288 else if (r_type == R_390_PC32)
289 rc = apply_rela_bits(loc, val, 1, 32, 0, write);
290 else if (r_type == R_390_PC64)
291 rc = apply_rela_bits(loc, val, 1, 64, 0, write);
292 break;
293 case R_390_GOT12:
294 case R_390_GOT16:
295 case R_390_GOT20:
296 case R_390_GOT32:
297 case R_390_GOT64:
298 case R_390_GOTENT:
299 case R_390_GOTPLT12:
300 case R_390_GOTPLT20:
301 case R_390_GOTPLT16:
302 case R_390_GOTPLT32:
303 case R_390_GOTPLT64:
304 case R_390_GOTPLTENT:
305 if (info->got_initialized == 0) {
306 Elf_Addr *gotent = me->core_layout.base +
307 me->arch.got_offset +
308 info->got_offset;
309
310 write(gotent, &val, sizeof(*gotent));
311 info->got_initialized = 1;
312 }
313 val = info->got_offset + rela->r_addend;
314 if (r_type == R_390_GOT12 ||
315 r_type == R_390_GOTPLT12)
316 rc = apply_rela_bits(loc, val, 0, 12, 0, write);
317 else if (r_type == R_390_GOT16 ||
318 r_type == R_390_GOTPLT16)
319 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
320 else if (r_type == R_390_GOT20 ||
321 r_type == R_390_GOTPLT20)
322 rc = apply_rela_bits(loc, val, 1, 20, 0, write);
323 else if (r_type == R_390_GOT32 ||
324 r_type == R_390_GOTPLT32)
325 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
326 else if (r_type == R_390_GOT64 ||
327 r_type == R_390_GOTPLT64)
328 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
329 else if (r_type == R_390_GOTENT ||
330 r_type == R_390_GOTPLTENT) {
331 val += (Elf_Addr) me->core_layout.base - loc;
332 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
333 }
334 break;
335 case R_390_PLT16DBL:
336 case R_390_PLT32DBL:
337 case R_390_PLT32:
338 case R_390_PLT64:
339 case R_390_PLTOFF16:
340 case R_390_PLTOFF32:
341 case R_390_PLTOFF64:
342 if (info->plt_initialized == 0) {
343 unsigned int insn[5];
344 unsigned int *ip = me->core_layout.base +
345 me->arch.plt_offset +
346 info->plt_offset;
347
348 insn[0] = 0x0d10e310;
349 insn[1] = 0x100a0004;
350 if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable) {
351 unsigned int *ij;
352 ij = me->core_layout.base +
353 me->arch.plt_offset +
354 me->arch.plt_size - PLT_ENTRY_SIZE;
355 insn[2] = 0xa7f40000 +
356 (unsigned int)(u16)
357 (((unsigned long) ij - 8 -
358 (unsigned long) ip) / 2);
359 } else {
360 insn[2] = 0x07f10000;
361 }
362 insn[3] = (unsigned int) (val >> 32);
363 insn[4] = (unsigned int) val;
364
365 write(ip, insn, sizeof(insn));
366 info->plt_initialized = 1;
367 }
368 if (r_type == R_390_PLTOFF16 ||
369 r_type == R_390_PLTOFF32 ||
370 r_type == R_390_PLTOFF64)
371 val = me->arch.plt_offset - me->arch.got_offset +
372 info->plt_offset + rela->r_addend;
373 else {
374 if (!((r_type == R_390_PLT16DBL &&
375 val - loc + 0xffffUL < 0x1ffffeUL) ||
376 (r_type == R_390_PLT32DBL &&
377 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
378 val = (Elf_Addr) me->core_layout.base +
379 me->arch.plt_offset +
380 info->plt_offset;
381 val += rela->r_addend - loc;
382 }
383 if (r_type == R_390_PLT16DBL)
384 rc = apply_rela_bits(loc, val, 1, 16, 1, write);
385 else if (r_type == R_390_PLTOFF16)
386 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
387 else if (r_type == R_390_PLT32DBL)
388 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
389 else if (r_type == R_390_PLT32 ||
390 r_type == R_390_PLTOFF32)
391 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
392 else if (r_type == R_390_PLT64 ||
393 r_type == R_390_PLTOFF64)
394 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
395 break;
396 case R_390_GOTOFF16:
397 case R_390_GOTOFF32:
398 case R_390_GOTOFF64:
399 val = val + rela->r_addend -
400 ((Elf_Addr) me->core_layout.base + me->arch.got_offset);
401 if (r_type == R_390_GOTOFF16)
402 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
403 else if (r_type == R_390_GOTOFF32)
404 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
405 else if (r_type == R_390_GOTOFF64)
406 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
407 break;
408 case R_390_GOTPC:
409 case R_390_GOTPCDBL:
410 val = (Elf_Addr) me->core_layout.base + me->arch.got_offset +
411 rela->r_addend - loc;
412 if (r_type == R_390_GOTPC)
413 rc = apply_rela_bits(loc, val, 1, 32, 0, write);
414 else if (r_type == R_390_GOTPCDBL)
415 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
416 break;
417 case R_390_COPY:
418 case R_390_GLOB_DAT:
419 case R_390_JMP_SLOT:
420 case R_390_RELATIVE:
421
422
423 return -ENOEXEC;
424 default:
425 printk(KERN_ERR "module %s: unknown relocation: %u\n",
426 me->name, r_type);
427 return -ENOEXEC;
428 }
429 if (rc) {
430 printk(KERN_ERR "module %s: relocation error for symbol %s "
431 "(r_type %i, value 0x%lx)\n",
432 me->name, strtab + symtab[r_sym].st_name,
433 r_type, (unsigned long) val);
434 return rc;
435 }
436 return 0;
437}
438
439static int __apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
440 unsigned int symindex, unsigned int relsec,
441 struct module *me,
442 void *(*write)(void *dest, const void *src, size_t len))
443{
444 Elf_Addr base;
445 Elf_Sym *symtab;
446 Elf_Rela *rela;
447 unsigned long i, n;
448 int rc;
449
450 DEBUGP("Applying relocate section %u to %u\n",
451 relsec, sechdrs[relsec].sh_info);
452 base = sechdrs[sechdrs[relsec].sh_info].sh_addr;
453 symtab = (Elf_Sym *) sechdrs[symindex].sh_addr;
454 rela = (Elf_Rela *) sechdrs[relsec].sh_addr;
455 n = sechdrs[relsec].sh_size / sizeof(Elf_Rela);
456
457 for (i = 0; i < n; i++, rela++) {
458 rc = apply_rela(rela, base, symtab, strtab, me, write);
459 if (rc)
460 return rc;
461 }
462 return 0;
463}
464
465int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
466 unsigned int symindex, unsigned int relsec,
467 struct module *me)
468{
469 bool early = me->state == MODULE_STATE_UNFORMED;
470 void *(*write)(void *, const void *, size_t) = memcpy;
471
472 if (!early)
473 write = s390_kernel_write;
474
475 return __apply_relocate_add(sechdrs, strtab, symindex, relsec, me,
476 write);
477}
478
479#ifdef CONFIG_FUNCTION_TRACER
480static int module_alloc_ftrace_hotpatch_trampolines(struct module *me,
481 const Elf_Shdr *s)
482{
483 char *start, *end;
484 int numpages;
485 size_t size;
486
487 size = FTRACE_HOTPATCH_TRAMPOLINES_SIZE(s->sh_size);
488 numpages = DIV_ROUND_UP(size, PAGE_SIZE);
489 start = module_alloc(numpages * PAGE_SIZE);
490 if (!start)
491 return -ENOMEM;
492 set_memory_ro((unsigned long)start, numpages);
493 end = start + size;
494
495 me->arch.trampolines_start = (struct ftrace_hotpatch_trampoline *)start;
496 me->arch.trampolines_end = (struct ftrace_hotpatch_trampoline *)end;
497 me->arch.next_trampoline = me->arch.trampolines_start;
498
499 return 0;
500}
501#endif
502
503int module_finalize(const Elf_Ehdr *hdr,
504 const Elf_Shdr *sechdrs,
505 struct module *me)
506{
507 const Elf_Shdr *s;
508 char *secstrings, *secname;
509 void *aseg;
510#ifdef CONFIG_FUNCTION_TRACER
511 int ret;
512#endif
513
514 if (IS_ENABLED(CONFIG_EXPOLINE) &&
515 !nospec_disable && me->arch.plt_size) {
516 unsigned int *ij;
517
518 ij = me->core_layout.base + me->arch.plt_offset +
519 me->arch.plt_size - PLT_ENTRY_SIZE;
520 if (test_facility(35)) {
521 ij[0] = 0xc6000000;
522 ij[1] = 0x0005a7f4;
523 ij[2] = 0x000007f1;
524 } else {
525 ij[0] = 0x44000000 | (unsigned int)
526 offsetof(struct lowcore, br_r1_trampoline);
527 ij[1] = 0xa7f40000;
528 }
529 }
530
531 secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
532 for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) {
533 aseg = (void *) s->sh_addr;
534 secname = secstrings + s->sh_name;
535
536 if (!strcmp(".altinstructions", secname))
537
538 apply_alternatives(aseg, aseg + s->sh_size);
539
540 if (IS_ENABLED(CONFIG_EXPOLINE) &&
541 (str_has_prefix(secname, ".s390_indirect")))
542 nospec_revert(aseg, aseg + s->sh_size);
543
544 if (IS_ENABLED(CONFIG_EXPOLINE) &&
545 (str_has_prefix(secname, ".s390_return")))
546 nospec_revert(aseg, aseg + s->sh_size);
547
548#ifdef CONFIG_FUNCTION_TRACER
549 if (!strcmp(FTRACE_CALLSITE_SECTION, secname)) {
550 ret = module_alloc_ftrace_hotpatch_trampolines(me, s);
551 if (ret < 0)
552 return ret;
553 }
554#endif
555 }
556
557 jump_label_apply_nops(me);
558 return 0;
559}
560