1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * Kernel module help for s390. 4 * 5 * S390 version 6 * Copyright IBM Corp. 2002, 2003 7 * Author(s): Arnd Bergmann (arndb@de.ibm.com) 8 * Martin Schwidefsky (schwidefsky@de.ibm.com) 9 * 10 * based on i386 version 11 * Copyright (C) 2001 Rusty Russell. 12 */ 13 #include <linux/module.h> 14 #include <linux/elf.h> 15 #include <linux/vmalloc.h> 16 #include <linux/fs.h> 17 #include <linux/ftrace.h> 18 #include <linux/string.h> 19 #include <linux/kernel.h> 20 #include <linux/kasan.h> 21 #include <linux/moduleloader.h> 22 #include <linux/bug.h> 23 #include <linux/memory.h> 24 #include <asm/alternative.h> 25 #include <asm/nospec-branch.h> 26 #include <asm/facility.h> 27 #include <asm/ftrace.lds.h> 28 #include <asm/set_memory.h> 29 30 #if 0 31 #define DEBUGP printk 32 #else 33 #define DEBUGP(fmt , ...) 34 #endif 35 36 #define PLT_ENTRY_SIZE 22 37 38 void *module_alloc(unsigned long size) 39 { 40 gfp_t gfp_mask = GFP_KERNEL; 41 void *p; 42 43 if (PAGE_ALIGN(size) > MODULES_LEN) 44 return NULL; 45 p = __vmalloc_node_range(size, MODULE_ALIGN, MODULES_VADDR, MODULES_END, 46 gfp_mask, PAGE_KERNEL_EXEC, VM_DEFER_KMEMLEAK, NUMA_NO_NODE, 47 __builtin_return_address(0)); 48 if (p && (kasan_alloc_module_shadow(p, size, gfp_mask) < 0)) { 49 vfree(p); 50 return NULL; 51 } 52 return p; 53 } 54 55 #ifdef CONFIG_FUNCTION_TRACER 56 void module_arch_cleanup(struct module *mod) 57 { 58 module_memfree(mod->arch.trampolines_start); 59 } 60 #endif 61 62 void module_arch_freeing_init(struct module *mod) 63 { 64 if (is_livepatch_module(mod) && 65 mod->state == MODULE_STATE_LIVE) 66 return; 67 68 vfree(mod->arch.syminfo); 69 mod->arch.syminfo = NULL; 70 } 71 72 static void check_rela(Elf_Rela *rela, struct module *me) 73 { 74 struct mod_arch_syminfo *info; 75 76 info = me->arch.syminfo + ELF_R_SYM (rela->r_info); 77 switch (ELF_R_TYPE (rela->r_info)) { 78 case R_390_GOT12: /* 12 bit GOT offset. */ 79 case R_390_GOT16: /* 16 bit GOT offset. */ 80 case R_390_GOT20: /* 20 bit GOT offset. */ 81 case R_390_GOT32: /* 32 bit GOT offset. */ 82 case R_390_GOT64: /* 64 bit GOT offset. */ 83 case R_390_GOTENT: /* 32 bit PC rel. to GOT entry shifted by 1. */ 84 case R_390_GOTPLT12: /* 12 bit offset to jump slot. */ 85 case R_390_GOTPLT16: /* 16 bit offset to jump slot. */ 86 case R_390_GOTPLT20: /* 20 bit offset to jump slot. */ 87 case R_390_GOTPLT32: /* 32 bit offset to jump slot. */ 88 case R_390_GOTPLT64: /* 64 bit offset to jump slot. */ 89 case R_390_GOTPLTENT: /* 32 bit rel. offset to jump slot >> 1. */ 90 if (info->got_offset == -1UL) { 91 info->got_offset = me->arch.got_size; 92 me->arch.got_size += sizeof(void*); 93 } 94 break; 95 case R_390_PLT16DBL: /* 16 bit PC rel. PLT shifted by 1. */ 96 case R_390_PLT32DBL: /* 32 bit PC rel. PLT shifted by 1. */ 97 case R_390_PLT32: /* 32 bit PC relative PLT address. */ 98 case R_390_PLT64: /* 64 bit PC relative PLT address. */ 99 case R_390_PLTOFF16: /* 16 bit offset from GOT to PLT. */ 100 case R_390_PLTOFF32: /* 32 bit offset from GOT to PLT. */ 101 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */ 102 if (info->plt_offset == -1UL) { 103 info->plt_offset = me->arch.plt_size; 104 me->arch.plt_size += PLT_ENTRY_SIZE; 105 } 106 break; 107 case R_390_COPY: 108 case R_390_GLOB_DAT: 109 case R_390_JMP_SLOT: 110 case R_390_RELATIVE: 111 /* Only needed if we want to support loading of 112 modules linked with -shared. */ 113 break; 114 } 115 } 116 117 /* 118 * Account for GOT and PLT relocations. We can't add sections for 119 * got and plt but we can increase the core module size. 120 */ 121 int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs, 122 char *secstrings, struct module *me) 123 { 124 Elf_Shdr *symtab; 125 Elf_Sym *symbols; 126 Elf_Rela *rela; 127 char *strings; 128 int nrela, i, j; 129 struct module_memory *mod_mem; 130 131 /* Find symbol table and string table. */ 132 symtab = NULL; 133 for (i = 0; i < hdr->e_shnum; i++) 134 switch (sechdrs[i].sh_type) { 135 case SHT_SYMTAB: 136 symtab = sechdrs + i; 137 break; 138 } 139 if (!symtab) { 140 printk(KERN_ERR "module %s: no symbol table\n", me->name); 141 return -ENOEXEC; 142 } 143 144 /* Allocate one syminfo structure per symbol. */ 145 me->arch.nsyms = symtab->sh_size / sizeof(Elf_Sym); 146 me->arch.syminfo = vmalloc(array_size(sizeof(struct mod_arch_syminfo), 147 me->arch.nsyms)); 148 if (!me->arch.syminfo) 149 return -ENOMEM; 150 symbols = (void *) hdr + symtab->sh_offset; 151 strings = (void *) hdr + sechdrs[symtab->sh_link].sh_offset; 152 for (i = 0; i < me->arch.nsyms; i++) { 153 if (symbols[i].st_shndx == SHN_UNDEF && 154 strcmp(strings + symbols[i].st_name, 155 "_GLOBAL_OFFSET_TABLE_") == 0) 156 /* "Define" it as absolute. */ 157 symbols[i].st_shndx = SHN_ABS; 158 me->arch.syminfo[i].got_offset = -1UL; 159 me->arch.syminfo[i].plt_offset = -1UL; 160 me->arch.syminfo[i].got_initialized = 0; 161 me->arch.syminfo[i].plt_initialized = 0; 162 } 163 164 /* Search for got/plt relocations. */ 165 me->arch.got_size = me->arch.plt_size = 0; 166 for (i = 0; i < hdr->e_shnum; i++) { 167 if (sechdrs[i].sh_type != SHT_RELA) 168 continue; 169 nrela = sechdrs[i].sh_size / sizeof(Elf_Rela); 170 rela = (void *) hdr + sechdrs[i].sh_offset; 171 for (j = 0; j < nrela; j++) 172 check_rela(rela + j, me); 173 } 174 175 /* Increase core size by size of got & plt and set start 176 offsets for got and plt. */ 177 mod_mem = &me->mem[MOD_TEXT]; 178 mod_mem->size = ALIGN(mod_mem->size, 4); 179 me->arch.got_offset = mod_mem->size; 180 mod_mem->size += me->arch.got_size; 181 me->arch.plt_offset = mod_mem->size; 182 if (me->arch.plt_size) { 183 if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable) 184 me->arch.plt_size += PLT_ENTRY_SIZE; 185 mod_mem->size += me->arch.plt_size; 186 } 187 return 0; 188 } 189 190 static int apply_rela_bits(Elf_Addr loc, Elf_Addr val, 191 int sign, int bits, int shift, 192 void *(*write)(void *dest, const void *src, size_t len)) 193 { 194 unsigned long umax; 195 long min, max; 196 void *dest = (void *)loc; 197 198 if (val & ((1UL << shift) - 1)) 199 return -ENOEXEC; 200 if (sign) { 201 val = (Elf_Addr)(((long) val) >> shift); 202 min = -(1L << (bits - 1)); 203 max = (1L << (bits - 1)) - 1; 204 if ((long) val < min || (long) val > max) 205 return -ENOEXEC; 206 } else { 207 val >>= shift; 208 umax = ((1UL << (bits - 1)) << 1) - 1; 209 if ((unsigned long) val > umax) 210 return -ENOEXEC; 211 } 212 213 if (bits == 8) { 214 unsigned char tmp = val; 215 write(dest, &tmp, 1); 216 } else if (bits == 12) { 217 unsigned short tmp = (val & 0xfff) | 218 (*(unsigned short *) loc & 0xf000); 219 write(dest, &tmp, 2); 220 } else if (bits == 16) { 221 unsigned short tmp = val; 222 write(dest, &tmp, 2); 223 } else if (bits == 20) { 224 unsigned int tmp = (val & 0xfff) << 16 | 225 (val & 0xff000) >> 4 | (*(unsigned int *) loc & 0xf00000ff); 226 write(dest, &tmp, 4); 227 } else if (bits == 32) { 228 unsigned int tmp = val; 229 write(dest, &tmp, 4); 230 } else if (bits == 64) { 231 unsigned long tmp = val; 232 write(dest, &tmp, 8); 233 } 234 return 0; 235 } 236 237 static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab, 238 const char *strtab, struct module *me, 239 void *(*write)(void *dest, const void *src, size_t len)) 240 { 241 struct mod_arch_syminfo *info; 242 Elf_Addr loc, val; 243 int r_type, r_sym; 244 int rc = -ENOEXEC; 245 246 /* This is where to make the change */ 247 loc = base + rela->r_offset; 248 /* This is the symbol it is referring to. Note that all 249 undefined symbols have been resolved. */ 250 r_sym = ELF_R_SYM(rela->r_info); 251 r_type = ELF_R_TYPE(rela->r_info); 252 info = me->arch.syminfo + r_sym; 253 val = symtab[r_sym].st_value; 254 255 switch (r_type) { 256 case R_390_NONE: /* No relocation. */ 257 rc = 0; 258 break; 259 case R_390_8: /* Direct 8 bit. */ 260 case R_390_12: /* Direct 12 bit. */ 261 case R_390_16: /* Direct 16 bit. */ 262 case R_390_20: /* Direct 20 bit. */ 263 case R_390_32: /* Direct 32 bit. */ 264 case R_390_64: /* Direct 64 bit. */ 265 val += rela->r_addend; 266 if (r_type == R_390_8) 267 rc = apply_rela_bits(loc, val, 0, 8, 0, write); 268 else if (r_type == R_390_12) 269 rc = apply_rela_bits(loc, val, 0, 12, 0, write); 270 else if (r_type == R_390_16) 271 rc = apply_rela_bits(loc, val, 0, 16, 0, write); 272 else if (r_type == R_390_20) 273 rc = apply_rela_bits(loc, val, 1, 20, 0, write); 274 else if (r_type == R_390_32) 275 rc = apply_rela_bits(loc, val, 0, 32, 0, write); 276 else if (r_type == R_390_64) 277 rc = apply_rela_bits(loc, val, 0, 64, 0, write); 278 break; 279 case R_390_PC16: /* PC relative 16 bit. */ 280 case R_390_PC16DBL: /* PC relative 16 bit shifted by 1. */ 281 case R_390_PC32DBL: /* PC relative 32 bit shifted by 1. */ 282 case R_390_PC32: /* PC relative 32 bit. */ 283 case R_390_PC64: /* PC relative 64 bit. */ 284 val += rela->r_addend - loc; 285 if (r_type == R_390_PC16) 286 rc = apply_rela_bits(loc, val, 1, 16, 0, write); 287 else if (r_type == R_390_PC16DBL) 288 rc = apply_rela_bits(loc, val, 1, 16, 1, write); 289 else if (r_type == R_390_PC32DBL) 290 rc = apply_rela_bits(loc, val, 1, 32, 1, write); 291 else if (r_type == R_390_PC32) 292 rc = apply_rela_bits(loc, val, 1, 32, 0, write); 293 else if (r_type == R_390_PC64) 294 rc = apply_rela_bits(loc, val, 1, 64, 0, write); 295 break; 296 case R_390_GOT12: /* 12 bit GOT offset. */ 297 case R_390_GOT16: /* 16 bit GOT offset. */ 298 case R_390_GOT20: /* 20 bit GOT offset. */ 299 case R_390_GOT32: /* 32 bit GOT offset. */ 300 case R_390_GOT64: /* 64 bit GOT offset. */ 301 case R_390_GOTENT: /* 32 bit PC rel. to GOT entry shifted by 1. */ 302 case R_390_GOTPLT12: /* 12 bit offset to jump slot. */ 303 case R_390_GOTPLT20: /* 20 bit offset to jump slot. */ 304 case R_390_GOTPLT16: /* 16 bit offset to jump slot. */ 305 case R_390_GOTPLT32: /* 32 bit offset to jump slot. */ 306 case R_390_GOTPLT64: /* 64 bit offset to jump slot. */ 307 case R_390_GOTPLTENT: /* 32 bit rel. offset to jump slot >> 1. */ 308 if (info->got_initialized == 0) { 309 Elf_Addr *gotent = me->mem[MOD_TEXT].base + 310 me->arch.got_offset + 311 info->got_offset; 312 313 write(gotent, &val, sizeof(*gotent)); 314 info->got_initialized = 1; 315 } 316 val = info->got_offset + rela->r_addend; 317 if (r_type == R_390_GOT12 || 318 r_type == R_390_GOTPLT12) 319 rc = apply_rela_bits(loc, val, 0, 12, 0, write); 320 else if (r_type == R_390_GOT16 || 321 r_type == R_390_GOTPLT16) 322 rc = apply_rela_bits(loc, val, 0, 16, 0, write); 323 else if (r_type == R_390_GOT20 || 324 r_type == R_390_GOTPLT20) 325 rc = apply_rela_bits(loc, val, 1, 20, 0, write); 326 else if (r_type == R_390_GOT32 || 327 r_type == R_390_GOTPLT32) 328 rc = apply_rela_bits(loc, val, 0, 32, 0, write); 329 else if (r_type == R_390_GOT64 || 330 r_type == R_390_GOTPLT64) 331 rc = apply_rela_bits(loc, val, 0, 64, 0, write); 332 else if (r_type == R_390_GOTENT || 333 r_type == R_390_GOTPLTENT) { 334 val += (Elf_Addr) me->mem[MOD_TEXT].base - loc; 335 rc = apply_rela_bits(loc, val, 1, 32, 1, write); 336 } 337 break; 338 case R_390_PLT16DBL: /* 16 bit PC rel. PLT shifted by 1. */ 339 case R_390_PLT32DBL: /* 32 bit PC rel. PLT shifted by 1. */ 340 case R_390_PLT32: /* 32 bit PC relative PLT address. */ 341 case R_390_PLT64: /* 64 bit PC relative PLT address. */ 342 case R_390_PLTOFF16: /* 16 bit offset from GOT to PLT. */ 343 case R_390_PLTOFF32: /* 32 bit offset from GOT to PLT. */ 344 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */ 345 if (info->plt_initialized == 0) { 346 unsigned char insn[PLT_ENTRY_SIZE]; 347 char *plt_base; 348 char *ip; 349 350 plt_base = me->mem[MOD_TEXT].base + me->arch.plt_offset; 351 ip = plt_base + info->plt_offset; 352 *(int *)insn = 0x0d10e310; /* basr 1,0 */ 353 *(int *)&insn[4] = 0x100c0004; /* lg 1,12(1) */ 354 if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable) { 355 char *jump_r1; 356 357 jump_r1 = plt_base + me->arch.plt_size - 358 PLT_ENTRY_SIZE; 359 /* brcl 0xf,__jump_r1 */ 360 *(short *)&insn[8] = 0xc0f4; 361 *(int *)&insn[10] = (jump_r1 - (ip + 8)) / 2; 362 } else { 363 *(int *)&insn[8] = 0x07f10000; /* br %r1 */ 364 } 365 *(long *)&insn[14] = val; 366 367 write(ip, insn, sizeof(insn)); 368 info->plt_initialized = 1; 369 } 370 if (r_type == R_390_PLTOFF16 || 371 r_type == R_390_PLTOFF32 || 372 r_type == R_390_PLTOFF64) 373 val = me->arch.plt_offset - me->arch.got_offset + 374 info->plt_offset + rela->r_addend; 375 else { 376 if (!((r_type == R_390_PLT16DBL && 377 val - loc + 0xffffUL < 0x1ffffeUL) || 378 (r_type == R_390_PLT32DBL && 379 val - loc + 0xffffffffULL < 0x1fffffffeULL))) 380 val = (Elf_Addr) me->mem[MOD_TEXT].base + 381 me->arch.plt_offset + 382 info->plt_offset; 383 val += rela->r_addend - loc; 384 } 385 if (r_type == R_390_PLT16DBL) 386 rc = apply_rela_bits(loc, val, 1, 16, 1, write); 387 else if (r_type == R_390_PLTOFF16) 388 rc = apply_rela_bits(loc, val, 0, 16, 0, write); 389 else if (r_type == R_390_PLT32DBL) 390 rc = apply_rela_bits(loc, val, 1, 32, 1, write); 391 else if (r_type == R_390_PLT32 || 392 r_type == R_390_PLTOFF32) 393 rc = apply_rela_bits(loc, val, 0, 32, 0, write); 394 else if (r_type == R_390_PLT64 || 395 r_type == R_390_PLTOFF64) 396 rc = apply_rela_bits(loc, val, 0, 64, 0, write); 397 break; 398 case R_390_GOTOFF16: /* 16 bit offset to GOT. */ 399 case R_390_GOTOFF32: /* 32 bit offset to GOT. */ 400 case R_390_GOTOFF64: /* 64 bit offset to GOT. */ 401 val = val + rela->r_addend - 402 ((Elf_Addr) me->mem[MOD_TEXT].base + me->arch.got_offset); 403 if (r_type == R_390_GOTOFF16) 404 rc = apply_rela_bits(loc, val, 0, 16, 0, write); 405 else if (r_type == R_390_GOTOFF32) 406 rc = apply_rela_bits(loc, val, 0, 32, 0, write); 407 else if (r_type == R_390_GOTOFF64) 408 rc = apply_rela_bits(loc, val, 0, 64, 0, write); 409 break; 410 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */ 411 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */ 412 val = (Elf_Addr) me->mem[MOD_TEXT].base + me->arch.got_offset + 413 rela->r_addend - loc; 414 if (r_type == R_390_GOTPC) 415 rc = apply_rela_bits(loc, val, 1, 32, 0, write); 416 else if (r_type == R_390_GOTPCDBL) 417 rc = apply_rela_bits(loc, val, 1, 32, 1, write); 418 break; 419 case R_390_COPY: 420 case R_390_GLOB_DAT: /* Create GOT entry. */ 421 case R_390_JMP_SLOT: /* Create PLT entry. */ 422 case R_390_RELATIVE: /* Adjust by program base. */ 423 /* Only needed if we want to support loading of 424 modules linked with -shared. */ 425 return -ENOEXEC; 426 default: 427 printk(KERN_ERR "module %s: unknown relocation: %u\n", 428 me->name, r_type); 429 return -ENOEXEC; 430 } 431 if (rc) { 432 printk(KERN_ERR "module %s: relocation error for symbol %s " 433 "(r_type %i, value 0x%lx)\n", 434 me->name, strtab + symtab[r_sym].st_name, 435 r_type, (unsigned long) val); 436 return rc; 437 } 438 return 0; 439 } 440 441 static int __apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, 442 unsigned int symindex, unsigned int relsec, 443 struct module *me, 444 void *(*write)(void *dest, const void *src, size_t len)) 445 { 446 Elf_Addr base; 447 Elf_Sym *symtab; 448 Elf_Rela *rela; 449 unsigned long i, n; 450 int rc; 451 452 DEBUGP("Applying relocate section %u to %u\n", 453 relsec, sechdrs[relsec].sh_info); 454 base = sechdrs[sechdrs[relsec].sh_info].sh_addr; 455 symtab = (Elf_Sym *) sechdrs[symindex].sh_addr; 456 rela = (Elf_Rela *) sechdrs[relsec].sh_addr; 457 n = sechdrs[relsec].sh_size / sizeof(Elf_Rela); 458 459 for (i = 0; i < n; i++, rela++) { 460 rc = apply_rela(rela, base, symtab, strtab, me, write); 461 if (rc) 462 return rc; 463 } 464 return 0; 465 } 466 467 int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, 468 unsigned int symindex, unsigned int relsec, 469 struct module *me) 470 { 471 bool early = me->state == MODULE_STATE_UNFORMED; 472 void *(*write)(void *, const void *, size_t) = memcpy; 473 474 if (!early) 475 write = s390_kernel_write; 476 477 return __apply_relocate_add(sechdrs, strtab, symindex, relsec, me, 478 write); 479 } 480 481 #ifdef CONFIG_FUNCTION_TRACER 482 static int module_alloc_ftrace_hotpatch_trampolines(struct module *me, 483 const Elf_Shdr *s) 484 { 485 char *start, *end; 486 int numpages; 487 size_t size; 488 489 size = FTRACE_HOTPATCH_TRAMPOLINES_SIZE(s->sh_size); 490 numpages = DIV_ROUND_UP(size, PAGE_SIZE); 491 start = module_alloc(numpages * PAGE_SIZE); 492 if (!start) 493 return -ENOMEM; 494 set_memory_ro((unsigned long)start, numpages); 495 end = start + size; 496 497 me->arch.trampolines_start = (struct ftrace_hotpatch_trampoline *)start; 498 me->arch.trampolines_end = (struct ftrace_hotpatch_trampoline *)end; 499 me->arch.next_trampoline = me->arch.trampolines_start; 500 501 return 0; 502 } 503 #endif /* CONFIG_FUNCTION_TRACER */ 504 505 int module_finalize(const Elf_Ehdr *hdr, 506 const Elf_Shdr *sechdrs, 507 struct module *me) 508 { 509 const Elf_Shdr *s; 510 char *secstrings, *secname; 511 void *aseg; 512 #ifdef CONFIG_FUNCTION_TRACER 513 int ret; 514 #endif 515 516 if (IS_ENABLED(CONFIG_EXPOLINE) && 517 !nospec_disable && me->arch.plt_size) { 518 unsigned int *ij; 519 520 ij = me->mem[MOD_TEXT].base + me->arch.plt_offset + 521 me->arch.plt_size - PLT_ENTRY_SIZE; 522 ij[0] = 0xc6000000; /* exrl %r0,.+10 */ 523 ij[1] = 0x0005a7f4; /* j . */ 524 ij[2] = 0x000007f1; /* br %r1 */ 525 } 526 527 secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; 528 for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) { 529 aseg = (void *) s->sh_addr; 530 secname = secstrings + s->sh_name; 531 532 if (!strcmp(".altinstructions", secname)) 533 /* patch .altinstructions */ 534 apply_alternatives(aseg, aseg + s->sh_size); 535 536 if (IS_ENABLED(CONFIG_EXPOLINE) && 537 (str_has_prefix(secname, ".s390_indirect"))) 538 nospec_revert(aseg, aseg + s->sh_size); 539 540 if (IS_ENABLED(CONFIG_EXPOLINE) && 541 (str_has_prefix(secname, ".s390_return"))) 542 nospec_revert(aseg, aseg + s->sh_size); 543 544 #ifdef CONFIG_FUNCTION_TRACER 545 if (!strcmp(FTRACE_CALLSITE_SECTION, secname)) { 546 ret = module_alloc_ftrace_hotpatch_trampolines(me, s); 547 if (ret < 0) 548 return ret; 549 } 550 #endif /* CONFIG_FUNCTION_TRACER */ 551 } 552 553 return 0; 554 } 555