1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * linux/arch/arm/kernel/module.c 4 * 5 * Copyright (C) 2002 Russell King. 6 * Modified for nommu by Hyok S. Choi 7 * 8 * Module allocation method suggested by Andi Kleen. 9 */ 10 #include <linux/module.h> 11 #include <linux/moduleloader.h> 12 #include <linux/kernel.h> 13 #include <linux/mm.h> 14 #include <linux/elf.h> 15 #include <linux/vmalloc.h> 16 #include <linux/fs.h> 17 #include <linux/string.h> 18 #include <linux/gfp.h> 19 20 #include <asm/sections.h> 21 #include <asm/smp_plat.h> 22 #include <asm/unwind.h> 23 #include <asm/opcodes.h> 24 25 #ifdef CONFIG_XIP_KERNEL 26 /* 27 * The XIP kernel text is mapped in the module area for modules and 28 * some other stuff to work without any indirect relocations. 29 * MODULES_VADDR is redefined here and not in asm/memory.h to avoid 30 * recompiling the whole kernel when CONFIG_XIP_KERNEL is turned on/off. 31 */ 32 #undef MODULES_VADDR 33 #define MODULES_VADDR (((unsigned long)_exiprom + ~PMD_MASK) & PMD_MASK) 34 #endif 35 36 #ifdef CONFIG_MMU 37 void *module_alloc(unsigned long size) 38 { 39 gfp_t gfp_mask = GFP_KERNEL; 40 void *p; 41 42 /* Silence the initial allocation */ 43 if (IS_ENABLED(CONFIG_ARM_MODULE_PLTS)) 44 gfp_mask |= __GFP_NOWARN; 45 46 p = __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END, 47 gfp_mask, PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE, 48 __builtin_return_address(0)); 49 if (!IS_ENABLED(CONFIG_ARM_MODULE_PLTS) || p) 50 return p; 51 return __vmalloc_node_range(size, 1, VMALLOC_START, VMALLOC_END, 52 GFP_KERNEL, PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE, 53 __builtin_return_address(0)); 54 } 55 #endif 56 57 bool module_init_section(const char *name) 58 { 59 return strstarts(name, ".init") || 60 strstarts(name, ".ARM.extab.init") || 61 strstarts(name, ".ARM.exidx.init"); 62 } 63 64 bool module_exit_section(const char *name) 65 { 66 return strstarts(name, ".exit") || 67 strstarts(name, ".ARM.extab.exit") || 68 strstarts(name, ".ARM.exidx.exit"); 69 } 70 71 #ifdef CONFIG_ARM_HAS_GROUP_RELOCS 72 /* 73 * This implements the partitioning algorithm for group relocations as 74 * documented in the ARM AArch32 ELF psABI (IHI 0044). 75 * 76 * A single PC-relative symbol reference is divided in up to 3 add or subtract 77 * operations, where the final one could be incorporated into a load/store 78 * instruction with immediate offset. E.g., 79 * 80 * ADD Rd, PC, #... or ADD Rd, PC, #... 81 * ADD Rd, Rd, #... ADD Rd, Rd, #... 82 * LDR Rd, [Rd, #...] ADD Rd, Rd, #... 83 * 84 * The latter has a guaranteed range of only 16 MiB (3x8 == 24 bits), so it is 85 * of limited use in the kernel. However, the ADD/ADD/LDR combo has a range of 86 * -/+ 256 MiB, (2x8 + 12 == 28 bits), which means it has sufficient range for 87 * any in-kernel symbol reference (unless module PLTs are being used). 88 * 89 * The main advantage of this approach over the typical pattern using a literal 90 * load is that literal loads may miss in the D-cache, and generally lead to 91 * lower cache efficiency for variables that are referenced often from many 92 * different places in the code. 93 */ 94 static u32 get_group_rem(u32 group, u32 *offset) 95 { 96 u32 val = *offset; 97 u32 shift; 98 do { 99 shift = val ? (31 - __fls(val)) & ~1 : 32; 100 *offset = val; 101 if (!val) 102 break; 103 val &= 0xffffff >> shift; 104 } while (group--); 105 return shift; 106 } 107 #endif 108 109 int 110 apply_relocate(Elf32_Shdr *sechdrs, const char *strtab, unsigned int symindex, 111 unsigned int relindex, struct module *module) 112 { 113 Elf32_Shdr *symsec = sechdrs + symindex; 114 Elf32_Shdr *relsec = sechdrs + relindex; 115 Elf32_Shdr *dstsec = sechdrs + relsec->sh_info; 116 Elf32_Rel *rel = (void *)relsec->sh_addr; 117 unsigned int i; 118 119 for (i = 0; i < relsec->sh_size / sizeof(Elf32_Rel); i++, rel++) { 120 unsigned long loc; 121 Elf32_Sym *sym; 122 const char *symname; 123 #ifdef CONFIG_ARM_HAS_GROUP_RELOCS 124 u32 shift, group = 1; 125 #endif 126 s32 offset; 127 u32 tmp; 128 #ifdef CONFIG_THUMB2_KERNEL 129 u32 upper, lower, sign, j1, j2; 130 #endif 131 132 offset = ELF32_R_SYM(rel->r_info); 133 if (offset < 0 || offset > (symsec->sh_size / sizeof(Elf32_Sym))) { 134 pr_err("%s: section %u reloc %u: bad relocation sym offset\n", 135 module->name, relindex, i); 136 return -ENOEXEC; 137 } 138 139 sym = ((Elf32_Sym *)symsec->sh_addr) + offset; 140 symname = strtab + sym->st_name; 141 142 if (rel->r_offset < 0 || rel->r_offset > dstsec->sh_size - sizeof(u32)) { 143 pr_err("%s: section %u reloc %u sym '%s': out of bounds relocation, offset %d size %u\n", 144 module->name, relindex, i, symname, 145 rel->r_offset, dstsec->sh_size); 146 return -ENOEXEC; 147 } 148 149 loc = dstsec->sh_addr + rel->r_offset; 150 151 switch (ELF32_R_TYPE(rel->r_info)) { 152 case R_ARM_NONE: 153 /* ignore */ 154 break; 155 156 case R_ARM_ABS32: 157 case R_ARM_TARGET1: 158 *(u32 *)loc += sym->st_value; 159 break; 160 161 case R_ARM_PC24: 162 case R_ARM_CALL: 163 case R_ARM_JUMP24: 164 if (sym->st_value & 3) { 165 pr_err("%s: section %u reloc %u sym '%s': unsupported interworking call (ARM -> Thumb)\n", 166 module->name, relindex, i, symname); 167 return -ENOEXEC; 168 } 169 170 offset = __mem_to_opcode_arm(*(u32 *)loc); 171 offset = (offset & 0x00ffffff) << 2; 172 if (offset & 0x02000000) 173 offset -= 0x04000000; 174 175 offset += sym->st_value - loc; 176 177 /* 178 * Route through a PLT entry if 'offset' exceeds the 179 * supported range. Note that 'offset + loc + 8' 180 * contains the absolute jump target, i.e., 181 * @sym + addend, corrected for the +8 PC bias. 182 */ 183 if (IS_ENABLED(CONFIG_ARM_MODULE_PLTS) && 184 (offset <= (s32)0xfe000000 || 185 offset >= (s32)0x02000000)) 186 offset = get_module_plt(module, loc, 187 offset + loc + 8) 188 - loc - 8; 189 190 if (offset <= (s32)0xfe000000 || 191 offset >= (s32)0x02000000) { 192 pr_err("%s: section %u reloc %u sym '%s': relocation %u out of range (%#lx -> %#x)\n", 193 module->name, relindex, i, symname, 194 ELF32_R_TYPE(rel->r_info), loc, 195 sym->st_value); 196 return -ENOEXEC; 197 } 198 199 offset >>= 2; 200 offset &= 0x00ffffff; 201 202 *(u32 *)loc &= __opcode_to_mem_arm(0xff000000); 203 *(u32 *)loc |= __opcode_to_mem_arm(offset); 204 break; 205 206 case R_ARM_V4BX: 207 /* Preserve Rm and the condition code. Alter 208 * other bits to re-code instruction as 209 * MOV PC,Rm. 210 */ 211 *(u32 *)loc &= __opcode_to_mem_arm(0xf000000f); 212 *(u32 *)loc |= __opcode_to_mem_arm(0x01a0f000); 213 break; 214 215 case R_ARM_PREL31: 216 offset = (*(s32 *)loc << 1) >> 1; /* sign extend */ 217 offset += sym->st_value - loc; 218 if (offset >= 0x40000000 || offset < -0x40000000) { 219 pr_err("%s: section %u reloc %u sym '%s': relocation %u out of range (%#lx -> %#x)\n", 220 module->name, relindex, i, symname, 221 ELF32_R_TYPE(rel->r_info), loc, 222 sym->st_value); 223 return -ENOEXEC; 224 } 225 *(u32 *)loc &= 0x80000000; 226 *(u32 *)loc |= offset & 0x7fffffff; 227 break; 228 229 case R_ARM_REL32: 230 *(u32 *)loc += sym->st_value - loc; 231 break; 232 233 case R_ARM_MOVW_ABS_NC: 234 case R_ARM_MOVT_ABS: 235 case R_ARM_MOVW_PREL_NC: 236 case R_ARM_MOVT_PREL: 237 offset = tmp = __mem_to_opcode_arm(*(u32 *)loc); 238 offset = ((offset & 0xf0000) >> 4) | (offset & 0xfff); 239 offset = (offset ^ 0x8000) - 0x8000; 240 241 offset += sym->st_value; 242 if (ELF32_R_TYPE(rel->r_info) == R_ARM_MOVT_PREL || 243 ELF32_R_TYPE(rel->r_info) == R_ARM_MOVW_PREL_NC) 244 offset -= loc; 245 if (ELF32_R_TYPE(rel->r_info) == R_ARM_MOVT_ABS || 246 ELF32_R_TYPE(rel->r_info) == R_ARM_MOVT_PREL) 247 offset >>= 16; 248 249 tmp &= 0xfff0f000; 250 tmp |= ((offset & 0xf000) << 4) | 251 (offset & 0x0fff); 252 253 *(u32 *)loc = __opcode_to_mem_arm(tmp); 254 break; 255 256 #ifdef CONFIG_ARM_HAS_GROUP_RELOCS 257 case R_ARM_ALU_PC_G0_NC: 258 group = 0; 259 fallthrough; 260 case R_ARM_ALU_PC_G1_NC: 261 tmp = __mem_to_opcode_arm(*(u32 *)loc); 262 offset = ror32(tmp & 0xff, (tmp & 0xf00) >> 7); 263 if (tmp & BIT(22)) 264 offset = -offset; 265 offset += sym->st_value - loc; 266 if (offset < 0) { 267 offset = -offset; 268 tmp = (tmp & ~BIT(23)) | BIT(22); // SUB opcode 269 } else { 270 tmp = (tmp & ~BIT(22)) | BIT(23); // ADD opcode 271 } 272 273 shift = get_group_rem(group, &offset); 274 if (shift < 24) { 275 offset >>= 24 - shift; 276 offset |= (shift + 8) << 7; 277 } 278 *(u32 *)loc = __opcode_to_mem_arm((tmp & ~0xfff) | offset); 279 break; 280 281 case R_ARM_LDR_PC_G2: 282 tmp = __mem_to_opcode_arm(*(u32 *)loc); 283 offset = tmp & 0xfff; 284 if (~tmp & BIT(23)) // U bit cleared? 285 offset = -offset; 286 offset += sym->st_value - loc; 287 if (offset < 0) { 288 offset = -offset; 289 tmp &= ~BIT(23); // clear U bit 290 } else { 291 tmp |= BIT(23); // set U bit 292 } 293 get_group_rem(2, &offset); 294 295 if (offset > 0xfff) { 296 pr_err("%s: section %u reloc %u sym '%s': relocation %u out of range (%#lx -> %#x)\n", 297 module->name, relindex, i, symname, 298 ELF32_R_TYPE(rel->r_info), loc, 299 sym->st_value); 300 return -ENOEXEC; 301 } 302 *(u32 *)loc = __opcode_to_mem_arm((tmp & ~0xfff) | offset); 303 break; 304 #endif 305 #ifdef CONFIG_THUMB2_KERNEL 306 case R_ARM_THM_CALL: 307 case R_ARM_THM_JUMP24: 308 /* 309 * For function symbols, only Thumb addresses are 310 * allowed (no interworking). 311 * 312 * For non-function symbols, the destination 313 * has no specific ARM/Thumb disposition, so 314 * the branch is resolved under the assumption 315 * that interworking is not required. 316 */ 317 if (ELF32_ST_TYPE(sym->st_info) == STT_FUNC && 318 !(sym->st_value & 1)) { 319 pr_err("%s: section %u reloc %u sym '%s': unsupported interworking call (Thumb -> ARM)\n", 320 module->name, relindex, i, symname); 321 return -ENOEXEC; 322 } 323 324 upper = __mem_to_opcode_thumb16(*(u16 *)loc); 325 lower = __mem_to_opcode_thumb16(*(u16 *)(loc + 2)); 326 327 /* 328 * 25 bit signed address range (Thumb-2 BL and B.W 329 * instructions): 330 * S:I1:I2:imm10:imm11:0 331 * where: 332 * S = upper[10] = offset[24] 333 * I1 = ~(J1 ^ S) = offset[23] 334 * I2 = ~(J2 ^ S) = offset[22] 335 * imm10 = upper[9:0] = offset[21:12] 336 * imm11 = lower[10:0] = offset[11:1] 337 * J1 = lower[13] 338 * J2 = lower[11] 339 */ 340 sign = (upper >> 10) & 1; 341 j1 = (lower >> 13) & 1; 342 j2 = (lower >> 11) & 1; 343 offset = (sign << 24) | ((~(j1 ^ sign) & 1) << 23) | 344 ((~(j2 ^ sign) & 1) << 22) | 345 ((upper & 0x03ff) << 12) | 346 ((lower & 0x07ff) << 1); 347 if (offset & 0x01000000) 348 offset -= 0x02000000; 349 offset += sym->st_value - loc; 350 351 /* 352 * Route through a PLT entry if 'offset' exceeds the 353 * supported range. 354 */ 355 if (IS_ENABLED(CONFIG_ARM_MODULE_PLTS) && 356 (offset <= (s32)0xff000000 || 357 offset >= (s32)0x01000000)) 358 offset = get_module_plt(module, loc, 359 offset + loc + 4) 360 - loc - 4; 361 362 if (offset <= (s32)0xff000000 || 363 offset >= (s32)0x01000000) { 364 pr_err("%s: section %u reloc %u sym '%s': relocation %u out of range (%#lx -> %#x)\n", 365 module->name, relindex, i, symname, 366 ELF32_R_TYPE(rel->r_info), loc, 367 sym->st_value); 368 return -ENOEXEC; 369 } 370 371 sign = (offset >> 24) & 1; 372 j1 = sign ^ (~(offset >> 23) & 1); 373 j2 = sign ^ (~(offset >> 22) & 1); 374 upper = (u16)((upper & 0xf800) | (sign << 10) | 375 ((offset >> 12) & 0x03ff)); 376 lower = (u16)((lower & 0xd000) | 377 (j1 << 13) | (j2 << 11) | 378 ((offset >> 1) & 0x07ff)); 379 380 *(u16 *)loc = __opcode_to_mem_thumb16(upper); 381 *(u16 *)(loc + 2) = __opcode_to_mem_thumb16(lower); 382 break; 383 384 case R_ARM_THM_MOVW_ABS_NC: 385 case R_ARM_THM_MOVT_ABS: 386 case R_ARM_THM_MOVW_PREL_NC: 387 case R_ARM_THM_MOVT_PREL: 388 upper = __mem_to_opcode_thumb16(*(u16 *)loc); 389 lower = __mem_to_opcode_thumb16(*(u16 *)(loc + 2)); 390 391 /* 392 * MOVT/MOVW instructions encoding in Thumb-2: 393 * 394 * i = upper[10] 395 * imm4 = upper[3:0] 396 * imm3 = lower[14:12] 397 * imm8 = lower[7:0] 398 * 399 * imm16 = imm4:i:imm3:imm8 400 */ 401 offset = ((upper & 0x000f) << 12) | 402 ((upper & 0x0400) << 1) | 403 ((lower & 0x7000) >> 4) | (lower & 0x00ff); 404 offset = (offset ^ 0x8000) - 0x8000; 405 offset += sym->st_value; 406 407 if (ELF32_R_TYPE(rel->r_info) == R_ARM_THM_MOVT_PREL || 408 ELF32_R_TYPE(rel->r_info) == R_ARM_THM_MOVW_PREL_NC) 409 offset -= loc; 410 if (ELF32_R_TYPE(rel->r_info) == R_ARM_THM_MOVT_ABS || 411 ELF32_R_TYPE(rel->r_info) == R_ARM_THM_MOVT_PREL) 412 offset >>= 16; 413 414 upper = (u16)((upper & 0xfbf0) | 415 ((offset & 0xf000) >> 12) | 416 ((offset & 0x0800) >> 1)); 417 lower = (u16)((lower & 0x8f00) | 418 ((offset & 0x0700) << 4) | 419 (offset & 0x00ff)); 420 *(u16 *)loc = __opcode_to_mem_thumb16(upper); 421 *(u16 *)(loc + 2) = __opcode_to_mem_thumb16(lower); 422 break; 423 #endif 424 425 default: 426 pr_err("%s: unknown relocation: %u\n", 427 module->name, ELF32_R_TYPE(rel->r_info)); 428 return -ENOEXEC; 429 } 430 } 431 return 0; 432 } 433 434 struct mod_unwind_map { 435 const Elf_Shdr *unw_sec; 436 const Elf_Shdr *txt_sec; 437 }; 438 439 static const Elf_Shdr *find_mod_section(const Elf32_Ehdr *hdr, 440 const Elf_Shdr *sechdrs, const char *name) 441 { 442 const Elf_Shdr *s, *se; 443 const char *secstrs = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; 444 445 for (s = sechdrs, se = sechdrs + hdr->e_shnum; s < se; s++) 446 if (strcmp(name, secstrs + s->sh_name) == 0) 447 return s; 448 449 return NULL; 450 } 451 452 extern void fixup_pv_table(const void *, unsigned long); 453 extern void fixup_smp(const void *, unsigned long); 454 455 int module_finalize(const Elf32_Ehdr *hdr, const Elf_Shdr *sechdrs, 456 struct module *mod) 457 { 458 const Elf_Shdr *s = NULL; 459 #ifdef CONFIG_ARM_UNWIND 460 const char *secstrs = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; 461 const Elf_Shdr *sechdrs_end = sechdrs + hdr->e_shnum; 462 struct mod_unwind_map maps[ARM_SEC_MAX]; 463 int i; 464 465 memset(maps, 0, sizeof(maps)); 466 467 for (s = sechdrs; s < sechdrs_end; s++) { 468 const char *secname = secstrs + s->sh_name; 469 470 if (!(s->sh_flags & SHF_ALLOC)) 471 continue; 472 473 if (strcmp(".ARM.exidx.init.text", secname) == 0) 474 maps[ARM_SEC_INIT].unw_sec = s; 475 else if (strcmp(".ARM.exidx", secname) == 0) 476 maps[ARM_SEC_CORE].unw_sec = s; 477 else if (strcmp(".ARM.exidx.exit.text", secname) == 0) 478 maps[ARM_SEC_EXIT].unw_sec = s; 479 else if (strcmp(".ARM.exidx.text.unlikely", secname) == 0) 480 maps[ARM_SEC_UNLIKELY].unw_sec = s; 481 else if (strcmp(".ARM.exidx.text.hot", secname) == 0) 482 maps[ARM_SEC_HOT].unw_sec = s; 483 else if (strcmp(".init.text", secname) == 0) 484 maps[ARM_SEC_INIT].txt_sec = s; 485 else if (strcmp(".text", secname) == 0) 486 maps[ARM_SEC_CORE].txt_sec = s; 487 else if (strcmp(".exit.text", secname) == 0) 488 maps[ARM_SEC_EXIT].txt_sec = s; 489 else if (strcmp(".text.unlikely", secname) == 0) 490 maps[ARM_SEC_UNLIKELY].txt_sec = s; 491 else if (strcmp(".text.hot", secname) == 0) 492 maps[ARM_SEC_HOT].txt_sec = s; 493 } 494 495 for (i = 0; i < ARM_SEC_MAX; i++) 496 if (maps[i].unw_sec && maps[i].txt_sec) 497 mod->arch.unwind[i] = 498 unwind_table_add(maps[i].unw_sec->sh_addr, 499 maps[i].unw_sec->sh_size, 500 maps[i].txt_sec->sh_addr, 501 maps[i].txt_sec->sh_size); 502 #endif 503 #ifdef CONFIG_ARM_PATCH_PHYS_VIRT 504 s = find_mod_section(hdr, sechdrs, ".pv_table"); 505 if (s) 506 fixup_pv_table((void *)s->sh_addr, s->sh_size); 507 #endif 508 s = find_mod_section(hdr, sechdrs, ".alt.smp.init"); 509 if (s && !is_smp()) 510 #ifdef CONFIG_SMP_ON_UP 511 fixup_smp((void *)s->sh_addr, s->sh_size); 512 #else 513 return -EINVAL; 514 #endif 515 return 0; 516 } 517 518 void 519 module_arch_cleanup(struct module *mod) 520 { 521 #ifdef CONFIG_ARM_UNWIND 522 int i; 523 524 for (i = 0; i < ARM_SEC_MAX; i++) { 525 unwind_table_del(mod->arch.unwind[i]); 526 mod->arch.unwind[i] = NULL; 527 } 528 #endif 529 } 530 531 void __weak module_arch_freeing_init(struct module *mod) 532 { 533 #ifdef CONFIG_ARM_UNWIND 534 unwind_table_del(mod->arch.unwind[ARM_SEC_INIT]); 535 mod->arch.unwind[ARM_SEC_INIT] = NULL; 536 #endif 537 } 538