1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * Kernel module help for s390. 4 * 5 * S390 version 6 * Copyright IBM Corp. 2002, 2003 7 * Author(s): Arnd Bergmann (arndb@de.ibm.com) 8 * Martin Schwidefsky (schwidefsky@de.ibm.com) 9 * 10 * based on i386 version 11 * Copyright (C) 2001 Rusty Russell. 12 */ 13 #include <linux/module.h> 14 #include <linux/elf.h> 15 #include <linux/vmalloc.h> 16 #include <linux/fs.h> 17 #include <linux/string.h> 18 #include <linux/kernel.h> 19 #include <linux/kasan.h> 20 #include <linux/moduleloader.h> 21 #include <linux/bug.h> 22 #include <asm/alternative.h> 23 #include <asm/nospec-branch.h> 24 #include <asm/facility.h> 25 26 #if 0 27 #define DEBUGP printk 28 #else 29 #define DEBUGP(fmt , ...) 30 #endif 31 32 #define PLT_ENTRY_SIZE 20 33 34 void *module_alloc(unsigned long size) 35 { 36 void *p; 37 38 if (PAGE_ALIGN(size) > MODULES_LEN) 39 return NULL; 40 p = __vmalloc_node_range(size, MODULE_ALIGN, MODULES_VADDR, MODULES_END, 41 GFP_KERNEL, PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE, 42 __builtin_return_address(0)); 43 if (p && (kasan_module_alloc(p, size) < 0)) { 44 vfree(p); 45 return NULL; 46 } 47 return p; 48 } 49 50 void module_arch_freeing_init(struct module *mod) 51 { 52 if (is_livepatch_module(mod) && 53 mod->state == MODULE_STATE_LIVE) 54 return; 55 56 vfree(mod->arch.syminfo); 57 mod->arch.syminfo = NULL; 58 } 59 60 static void check_rela(Elf_Rela *rela, struct module *me) 61 { 62 struct mod_arch_syminfo *info; 63 64 info = me->arch.syminfo + ELF_R_SYM (rela->r_info); 65 switch (ELF_R_TYPE (rela->r_info)) { 66 case R_390_GOT12: /* 12 bit GOT offset. */ 67 case R_390_GOT16: /* 16 bit GOT offset. */ 68 case R_390_GOT20: /* 20 bit GOT offset. */ 69 case R_390_GOT32: /* 32 bit GOT offset. */ 70 case R_390_GOT64: /* 64 bit GOT offset. */ 71 case R_390_GOTENT: /* 32 bit PC rel. to GOT entry shifted by 1. */ 72 case R_390_GOTPLT12: /* 12 bit offset to jump slot. */ 73 case R_390_GOTPLT16: /* 16 bit offset to jump slot. */ 74 case R_390_GOTPLT20: /* 20 bit offset to jump slot. */ 75 case R_390_GOTPLT32: /* 32 bit offset to jump slot. */ 76 case R_390_GOTPLT64: /* 64 bit offset to jump slot. */ 77 case R_390_GOTPLTENT: /* 32 bit rel. offset to jump slot >> 1. */ 78 if (info->got_offset == -1UL) { 79 info->got_offset = me->arch.got_size; 80 me->arch.got_size += sizeof(void*); 81 } 82 break; 83 case R_390_PLT16DBL: /* 16 bit PC rel. PLT shifted by 1. */ 84 case R_390_PLT32DBL: /* 32 bit PC rel. PLT shifted by 1. */ 85 case R_390_PLT32: /* 32 bit PC relative PLT address. */ 86 case R_390_PLT64: /* 64 bit PC relative PLT address. */ 87 case R_390_PLTOFF16: /* 16 bit offset from GOT to PLT. */ 88 case R_390_PLTOFF32: /* 32 bit offset from GOT to PLT. */ 89 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */ 90 if (info->plt_offset == -1UL) { 91 info->plt_offset = me->arch.plt_size; 92 me->arch.plt_size += PLT_ENTRY_SIZE; 93 } 94 break; 95 case R_390_COPY: 96 case R_390_GLOB_DAT: 97 case R_390_JMP_SLOT: 98 case R_390_RELATIVE: 99 /* Only needed if we want to support loading of 100 modules linked with -shared. */ 101 break; 102 } 103 } 104 105 /* 106 * Account for GOT and PLT relocations. We can't add sections for 107 * got and plt but we can increase the core module size. 108 */ 109 int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs, 110 char *secstrings, struct module *me) 111 { 112 Elf_Shdr *symtab; 113 Elf_Sym *symbols; 114 Elf_Rela *rela; 115 char *strings; 116 int nrela, i, j; 117 118 /* Find symbol table and string table. */ 119 symtab = NULL; 120 for (i = 0; i < hdr->e_shnum; i++) 121 switch (sechdrs[i].sh_type) { 122 case SHT_SYMTAB: 123 symtab = sechdrs + i; 124 break; 125 } 126 if (!symtab) { 127 printk(KERN_ERR "module %s: no symbol table\n", me->name); 128 return -ENOEXEC; 129 } 130 131 /* Allocate one syminfo structure per symbol. */ 132 me->arch.nsyms = symtab->sh_size / sizeof(Elf_Sym); 133 me->arch.syminfo = vmalloc(array_size(sizeof(struct mod_arch_syminfo), 134 me->arch.nsyms)); 135 if (!me->arch.syminfo) 136 return -ENOMEM; 137 symbols = (void *) hdr + symtab->sh_offset; 138 strings = (void *) hdr + sechdrs[symtab->sh_link].sh_offset; 139 for (i = 0; i < me->arch.nsyms; i++) { 140 if (symbols[i].st_shndx == SHN_UNDEF && 141 strcmp(strings + symbols[i].st_name, 142 "_GLOBAL_OFFSET_TABLE_") == 0) 143 /* "Define" it as absolute. */ 144 symbols[i].st_shndx = SHN_ABS; 145 me->arch.syminfo[i].got_offset = -1UL; 146 me->arch.syminfo[i].plt_offset = -1UL; 147 me->arch.syminfo[i].got_initialized = 0; 148 me->arch.syminfo[i].plt_initialized = 0; 149 } 150 151 /* Search for got/plt relocations. */ 152 me->arch.got_size = me->arch.plt_size = 0; 153 for (i = 0; i < hdr->e_shnum; i++) { 154 if (sechdrs[i].sh_type != SHT_RELA) 155 continue; 156 nrela = sechdrs[i].sh_size / sizeof(Elf_Rela); 157 rela = (void *) hdr + sechdrs[i].sh_offset; 158 for (j = 0; j < nrela; j++) 159 check_rela(rela + j, me); 160 } 161 162 /* Increase core size by size of got & plt and set start 163 offsets for got and plt. */ 164 me->core_layout.size = ALIGN(me->core_layout.size, 4); 165 me->arch.got_offset = me->core_layout.size; 166 me->core_layout.size += me->arch.got_size; 167 me->arch.plt_offset = me->core_layout.size; 168 if (me->arch.plt_size) { 169 if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable) 170 me->arch.plt_size += PLT_ENTRY_SIZE; 171 me->core_layout.size += me->arch.plt_size; 172 } 173 return 0; 174 } 175 176 static int apply_rela_bits(Elf_Addr loc, Elf_Addr val, 177 int sign, int bits, int shift) 178 { 179 unsigned long umax; 180 long min, max; 181 182 if (val & ((1UL << shift) - 1)) 183 return -ENOEXEC; 184 if (sign) { 185 val = (Elf_Addr)(((long) val) >> shift); 186 min = -(1L << (bits - 1)); 187 max = (1L << (bits - 1)) - 1; 188 if ((long) val < min || (long) val > max) 189 return -ENOEXEC; 190 } else { 191 val >>= shift; 192 umax = ((1UL << (bits - 1)) << 1) - 1; 193 if ((unsigned long) val > umax) 194 return -ENOEXEC; 195 } 196 197 if (bits == 8) 198 *(unsigned char *) loc = val; 199 else if (bits == 12) 200 *(unsigned short *) loc = (val & 0xfff) | 201 (*(unsigned short *) loc & 0xf000); 202 else if (bits == 16) 203 *(unsigned short *) loc = val; 204 else if (bits == 20) 205 *(unsigned int *) loc = (val & 0xfff) << 16 | 206 (val & 0xff000) >> 4 | 207 (*(unsigned int *) loc & 0xf00000ff); 208 else if (bits == 32) 209 *(unsigned int *) loc = val; 210 else if (bits == 64) 211 *(unsigned long *) loc = val; 212 return 0; 213 } 214 215 static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab, 216 const char *strtab, struct module *me) 217 { 218 struct mod_arch_syminfo *info; 219 Elf_Addr loc, val; 220 int r_type, r_sym; 221 int rc = -ENOEXEC; 222 223 /* This is where to make the change */ 224 loc = base + rela->r_offset; 225 /* This is the symbol it is referring to. Note that all 226 undefined symbols have been resolved. */ 227 r_sym = ELF_R_SYM(rela->r_info); 228 r_type = ELF_R_TYPE(rela->r_info); 229 info = me->arch.syminfo + r_sym; 230 val = symtab[r_sym].st_value; 231 232 switch (r_type) { 233 case R_390_NONE: /* No relocation. */ 234 rc = 0; 235 break; 236 case R_390_8: /* Direct 8 bit. */ 237 case R_390_12: /* Direct 12 bit. */ 238 case R_390_16: /* Direct 16 bit. */ 239 case R_390_20: /* Direct 20 bit. */ 240 case R_390_32: /* Direct 32 bit. */ 241 case R_390_64: /* Direct 64 bit. */ 242 val += rela->r_addend; 243 if (r_type == R_390_8) 244 rc = apply_rela_bits(loc, val, 0, 8, 0); 245 else if (r_type == R_390_12) 246 rc = apply_rela_bits(loc, val, 0, 12, 0); 247 else if (r_type == R_390_16) 248 rc = apply_rela_bits(loc, val, 0, 16, 0); 249 else if (r_type == R_390_20) 250 rc = apply_rela_bits(loc, val, 1, 20, 0); 251 else if (r_type == R_390_32) 252 rc = apply_rela_bits(loc, val, 0, 32, 0); 253 else if (r_type == R_390_64) 254 rc = apply_rela_bits(loc, val, 0, 64, 0); 255 break; 256 case R_390_PC16: /* PC relative 16 bit. */ 257 case R_390_PC16DBL: /* PC relative 16 bit shifted by 1. */ 258 case R_390_PC32DBL: /* PC relative 32 bit shifted by 1. */ 259 case R_390_PC32: /* PC relative 32 bit. */ 260 case R_390_PC64: /* PC relative 64 bit. */ 261 val += rela->r_addend - loc; 262 if (r_type == R_390_PC16) 263 rc = apply_rela_bits(loc, val, 1, 16, 0); 264 else if (r_type == R_390_PC16DBL) 265 rc = apply_rela_bits(loc, val, 1, 16, 1); 266 else if (r_type == R_390_PC32DBL) 267 rc = apply_rela_bits(loc, val, 1, 32, 1); 268 else if (r_type == R_390_PC32) 269 rc = apply_rela_bits(loc, val, 1, 32, 0); 270 else if (r_type == R_390_PC64) 271 rc = apply_rela_bits(loc, val, 1, 64, 0); 272 break; 273 case R_390_GOT12: /* 12 bit GOT offset. */ 274 case R_390_GOT16: /* 16 bit GOT offset. */ 275 case R_390_GOT20: /* 20 bit GOT offset. */ 276 case R_390_GOT32: /* 32 bit GOT offset. */ 277 case R_390_GOT64: /* 64 bit GOT offset. */ 278 case R_390_GOTENT: /* 32 bit PC rel. to GOT entry shifted by 1. */ 279 case R_390_GOTPLT12: /* 12 bit offset to jump slot. */ 280 case R_390_GOTPLT20: /* 20 bit offset to jump slot. */ 281 case R_390_GOTPLT16: /* 16 bit offset to jump slot. */ 282 case R_390_GOTPLT32: /* 32 bit offset to jump slot. */ 283 case R_390_GOTPLT64: /* 64 bit offset to jump slot. */ 284 case R_390_GOTPLTENT: /* 32 bit rel. offset to jump slot >> 1. */ 285 if (info->got_initialized == 0) { 286 Elf_Addr *gotent; 287 288 gotent = me->core_layout.base + me->arch.got_offset + 289 info->got_offset; 290 *gotent = val; 291 info->got_initialized = 1; 292 } 293 val = info->got_offset + rela->r_addend; 294 if (r_type == R_390_GOT12 || 295 r_type == R_390_GOTPLT12) 296 rc = apply_rela_bits(loc, val, 0, 12, 0); 297 else if (r_type == R_390_GOT16 || 298 r_type == R_390_GOTPLT16) 299 rc = apply_rela_bits(loc, val, 0, 16, 0); 300 else if (r_type == R_390_GOT20 || 301 r_type == R_390_GOTPLT20) 302 rc = apply_rela_bits(loc, val, 1, 20, 0); 303 else if (r_type == R_390_GOT32 || 304 r_type == R_390_GOTPLT32) 305 rc = apply_rela_bits(loc, val, 0, 32, 0); 306 else if (r_type == R_390_GOT64 || 307 r_type == R_390_GOTPLT64) 308 rc = apply_rela_bits(loc, val, 0, 64, 0); 309 else if (r_type == R_390_GOTENT || 310 r_type == R_390_GOTPLTENT) { 311 val += (Elf_Addr) me->core_layout.base - loc; 312 rc = apply_rela_bits(loc, val, 1, 32, 1); 313 } 314 break; 315 case R_390_PLT16DBL: /* 16 bit PC rel. PLT shifted by 1. */ 316 case R_390_PLT32DBL: /* 32 bit PC rel. PLT shifted by 1. */ 317 case R_390_PLT32: /* 32 bit PC relative PLT address. */ 318 case R_390_PLT64: /* 64 bit PC relative PLT address. */ 319 case R_390_PLTOFF16: /* 16 bit offset from GOT to PLT. */ 320 case R_390_PLTOFF32: /* 32 bit offset from GOT to PLT. */ 321 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */ 322 if (info->plt_initialized == 0) { 323 unsigned int *ip; 324 ip = me->core_layout.base + me->arch.plt_offset + 325 info->plt_offset; 326 ip[0] = 0x0d10e310; /* basr 1,0 */ 327 ip[1] = 0x100a0004; /* lg 1,10(1) */ 328 if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable) { 329 unsigned int *ij; 330 ij = me->core_layout.base + 331 me->arch.plt_offset + 332 me->arch.plt_size - PLT_ENTRY_SIZE; 333 ip[2] = 0xa7f40000 + /* j __jump_r1 */ 334 (unsigned int)(u16) 335 (((unsigned long) ij - 8 - 336 (unsigned long) ip) / 2); 337 } else { 338 ip[2] = 0x07f10000; /* br %r1 */ 339 } 340 ip[3] = (unsigned int) (val >> 32); 341 ip[4] = (unsigned int) val; 342 info->plt_initialized = 1; 343 } 344 if (r_type == R_390_PLTOFF16 || 345 r_type == R_390_PLTOFF32 || 346 r_type == R_390_PLTOFF64) 347 val = me->arch.plt_offset - me->arch.got_offset + 348 info->plt_offset + rela->r_addend; 349 else { 350 if (!((r_type == R_390_PLT16DBL && 351 val - loc + 0xffffUL < 0x1ffffeUL) || 352 (r_type == R_390_PLT32DBL && 353 val - loc + 0xffffffffULL < 0x1fffffffeULL))) 354 val = (Elf_Addr) me->core_layout.base + 355 me->arch.plt_offset + 356 info->plt_offset; 357 val += rela->r_addend - loc; 358 } 359 if (r_type == R_390_PLT16DBL) 360 rc = apply_rela_bits(loc, val, 1, 16, 1); 361 else if (r_type == R_390_PLTOFF16) 362 rc = apply_rela_bits(loc, val, 0, 16, 0); 363 else if (r_type == R_390_PLT32DBL) 364 rc = apply_rela_bits(loc, val, 1, 32, 1); 365 else if (r_type == R_390_PLT32 || 366 r_type == R_390_PLTOFF32) 367 rc = apply_rela_bits(loc, val, 0, 32, 0); 368 else if (r_type == R_390_PLT64 || 369 r_type == R_390_PLTOFF64) 370 rc = apply_rela_bits(loc, val, 0, 64, 0); 371 break; 372 case R_390_GOTOFF16: /* 16 bit offset to GOT. */ 373 case R_390_GOTOFF32: /* 32 bit offset to GOT. */ 374 case R_390_GOTOFF64: /* 64 bit offset to GOT. */ 375 val = val + rela->r_addend - 376 ((Elf_Addr) me->core_layout.base + me->arch.got_offset); 377 if (r_type == R_390_GOTOFF16) 378 rc = apply_rela_bits(loc, val, 0, 16, 0); 379 else if (r_type == R_390_GOTOFF32) 380 rc = apply_rela_bits(loc, val, 0, 32, 0); 381 else if (r_type == R_390_GOTOFF64) 382 rc = apply_rela_bits(loc, val, 0, 64, 0); 383 break; 384 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */ 385 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */ 386 val = (Elf_Addr) me->core_layout.base + me->arch.got_offset + 387 rela->r_addend - loc; 388 if (r_type == R_390_GOTPC) 389 rc = apply_rela_bits(loc, val, 1, 32, 0); 390 else if (r_type == R_390_GOTPCDBL) 391 rc = apply_rela_bits(loc, val, 1, 32, 1); 392 break; 393 case R_390_COPY: 394 case R_390_GLOB_DAT: /* Create GOT entry. */ 395 case R_390_JMP_SLOT: /* Create PLT entry. */ 396 case R_390_RELATIVE: /* Adjust by program base. */ 397 /* Only needed if we want to support loading of 398 modules linked with -shared. */ 399 return -ENOEXEC; 400 default: 401 printk(KERN_ERR "module %s: unknown relocation: %u\n", 402 me->name, r_type); 403 return -ENOEXEC; 404 } 405 if (rc) { 406 printk(KERN_ERR "module %s: relocation error for symbol %s " 407 "(r_type %i, value 0x%lx)\n", 408 me->name, strtab + symtab[r_sym].st_name, 409 r_type, (unsigned long) val); 410 return rc; 411 } 412 return 0; 413 } 414 415 int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, 416 unsigned int symindex, unsigned int relsec, 417 struct module *me) 418 { 419 Elf_Addr base; 420 Elf_Sym *symtab; 421 Elf_Rela *rela; 422 unsigned long i, n; 423 int rc; 424 425 DEBUGP("Applying relocate section %u to %u\n", 426 relsec, sechdrs[relsec].sh_info); 427 base = sechdrs[sechdrs[relsec].sh_info].sh_addr; 428 symtab = (Elf_Sym *) sechdrs[symindex].sh_addr; 429 rela = (Elf_Rela *) sechdrs[relsec].sh_addr; 430 n = sechdrs[relsec].sh_size / sizeof(Elf_Rela); 431 432 for (i = 0; i < n; i++, rela++) { 433 rc = apply_rela(rela, base, symtab, strtab, me); 434 if (rc) 435 return rc; 436 } 437 return 0; 438 } 439 440 int module_finalize(const Elf_Ehdr *hdr, 441 const Elf_Shdr *sechdrs, 442 struct module *me) 443 { 444 const Elf_Shdr *s; 445 char *secstrings, *secname; 446 void *aseg; 447 448 if (IS_ENABLED(CONFIG_EXPOLINE) && 449 !nospec_disable && me->arch.plt_size) { 450 unsigned int *ij; 451 452 ij = me->core_layout.base + me->arch.plt_offset + 453 me->arch.plt_size - PLT_ENTRY_SIZE; 454 if (test_facility(35)) { 455 ij[0] = 0xc6000000; /* exrl %r0,.+10 */ 456 ij[1] = 0x0005a7f4; /* j . */ 457 ij[2] = 0x000007f1; /* br %r1 */ 458 } else { 459 ij[0] = 0x44000000 | (unsigned int) 460 offsetof(struct lowcore, br_r1_trampoline); 461 ij[1] = 0xa7f40000; /* j . */ 462 } 463 } 464 465 secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; 466 for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) { 467 aseg = (void *) s->sh_addr; 468 secname = secstrings + s->sh_name; 469 470 if (!strcmp(".altinstructions", secname)) 471 /* patch .altinstructions */ 472 apply_alternatives(aseg, aseg + s->sh_size); 473 474 if (IS_ENABLED(CONFIG_EXPOLINE) && 475 (str_has_prefix(secname, ".s390_indirect"))) 476 nospec_revert(aseg, aseg + s->sh_size); 477 478 if (IS_ENABLED(CONFIG_EXPOLINE) && 479 (str_has_prefix(secname, ".s390_return"))) 480 nospec_revert(aseg, aseg + s->sh_size); 481 } 482 483 jump_label_apply_nops(me); 484 return 0; 485 } 486