1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * Kernel module help for s390. 4 * 5 * S390 version 6 * Copyright IBM Corp. 2002, 2003 7 * Author(s): Arnd Bergmann (arndb@de.ibm.com) 8 * Martin Schwidefsky (schwidefsky@de.ibm.com) 9 * 10 * based on i386 version 11 * Copyright (C) 2001 Rusty Russell. 12 */ 13 #include <linux/module.h> 14 #include <linux/elf.h> 15 #include <linux/vmalloc.h> 16 #include <linux/fs.h> 17 #include <linux/ftrace.h> 18 #include <linux/string.h> 19 #include <linux/kernel.h> 20 #include <linux/kasan.h> 21 #include <linux/moduleloader.h> 22 #include <linux/bug.h> 23 #include <linux/memory.h> 24 #include <asm/alternative.h> 25 #include <asm/nospec-branch.h> 26 #include <asm/facility.h> 27 #include <asm/ftrace.lds.h> 28 #include <asm/set_memory.h> 29 30 #if 0 31 #define DEBUGP printk 32 #else 33 #define DEBUGP(fmt , ...) 34 #endif 35 36 #define PLT_ENTRY_SIZE 20 37 38 void *module_alloc(unsigned long size) 39 { 40 void *p; 41 42 if (PAGE_ALIGN(size) > MODULES_LEN) 43 return NULL; 44 p = __vmalloc_node_range(size, MODULE_ALIGN, MODULES_VADDR, MODULES_END, 45 GFP_KERNEL, PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE, 46 __builtin_return_address(0)); 47 if (p && (kasan_module_alloc(p, size) < 0)) { 48 vfree(p); 49 return NULL; 50 } 51 return p; 52 } 53 54 #ifdef CONFIG_FUNCTION_TRACER 55 void module_arch_cleanup(struct module *mod) 56 { 57 module_memfree(mod->arch.trampolines_start); 58 } 59 #endif 60 61 void module_arch_freeing_init(struct module *mod) 62 { 63 if (is_livepatch_module(mod) && 64 mod->state == MODULE_STATE_LIVE) 65 return; 66 67 vfree(mod->arch.syminfo); 68 mod->arch.syminfo = NULL; 69 } 70 71 static void check_rela(Elf_Rela *rela, struct module *me) 72 { 73 struct mod_arch_syminfo *info; 74 75 info = me->arch.syminfo + ELF_R_SYM (rela->r_info); 76 switch (ELF_R_TYPE (rela->r_info)) { 77 case R_390_GOT12: /* 12 bit GOT offset. */ 78 case R_390_GOT16: /* 16 bit GOT offset. */ 79 case R_390_GOT20: /* 20 bit GOT offset. */ 80 case R_390_GOT32: /* 32 bit GOT offset. */ 81 case R_390_GOT64: /* 64 bit GOT offset. */ 82 case R_390_GOTENT: /* 32 bit PC rel. to GOT entry shifted by 1. */ 83 case R_390_GOTPLT12: /* 12 bit offset to jump slot. */ 84 case R_390_GOTPLT16: /* 16 bit offset to jump slot. */ 85 case R_390_GOTPLT20: /* 20 bit offset to jump slot. */ 86 case R_390_GOTPLT32: /* 32 bit offset to jump slot. */ 87 case R_390_GOTPLT64: /* 64 bit offset to jump slot. */ 88 case R_390_GOTPLTENT: /* 32 bit rel. offset to jump slot >> 1. */ 89 if (info->got_offset == -1UL) { 90 info->got_offset = me->arch.got_size; 91 me->arch.got_size += sizeof(void*); 92 } 93 break; 94 case R_390_PLT16DBL: /* 16 bit PC rel. PLT shifted by 1. */ 95 case R_390_PLT32DBL: /* 32 bit PC rel. PLT shifted by 1. */ 96 case R_390_PLT32: /* 32 bit PC relative PLT address. */ 97 case R_390_PLT64: /* 64 bit PC relative PLT address. */ 98 case R_390_PLTOFF16: /* 16 bit offset from GOT to PLT. */ 99 case R_390_PLTOFF32: /* 32 bit offset from GOT to PLT. */ 100 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */ 101 if (info->plt_offset == -1UL) { 102 info->plt_offset = me->arch.plt_size; 103 me->arch.plt_size += PLT_ENTRY_SIZE; 104 } 105 break; 106 case R_390_COPY: 107 case R_390_GLOB_DAT: 108 case R_390_JMP_SLOT: 109 case R_390_RELATIVE: 110 /* Only needed if we want to support loading of 111 modules linked with -shared. */ 112 break; 113 } 114 } 115 116 /* 117 * Account for GOT and PLT relocations. We can't add sections for 118 * got and plt but we can increase the core module size. 119 */ 120 int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs, 121 char *secstrings, struct module *me) 122 { 123 Elf_Shdr *symtab; 124 Elf_Sym *symbols; 125 Elf_Rela *rela; 126 char *strings; 127 int nrela, i, j; 128 129 /* Find symbol table and string table. */ 130 symtab = NULL; 131 for (i = 0; i < hdr->e_shnum; i++) 132 switch (sechdrs[i].sh_type) { 133 case SHT_SYMTAB: 134 symtab = sechdrs + i; 135 break; 136 } 137 if (!symtab) { 138 printk(KERN_ERR "module %s: no symbol table\n", me->name); 139 return -ENOEXEC; 140 } 141 142 /* Allocate one syminfo structure per symbol. */ 143 me->arch.nsyms = symtab->sh_size / sizeof(Elf_Sym); 144 me->arch.syminfo = vmalloc(array_size(sizeof(struct mod_arch_syminfo), 145 me->arch.nsyms)); 146 if (!me->arch.syminfo) 147 return -ENOMEM; 148 symbols = (void *) hdr + symtab->sh_offset; 149 strings = (void *) hdr + sechdrs[symtab->sh_link].sh_offset; 150 for (i = 0; i < me->arch.nsyms; i++) { 151 if (symbols[i].st_shndx == SHN_UNDEF && 152 strcmp(strings + symbols[i].st_name, 153 "_GLOBAL_OFFSET_TABLE_") == 0) 154 /* "Define" it as absolute. */ 155 symbols[i].st_shndx = SHN_ABS; 156 me->arch.syminfo[i].got_offset = -1UL; 157 me->arch.syminfo[i].plt_offset = -1UL; 158 me->arch.syminfo[i].got_initialized = 0; 159 me->arch.syminfo[i].plt_initialized = 0; 160 } 161 162 /* Search for got/plt relocations. */ 163 me->arch.got_size = me->arch.plt_size = 0; 164 for (i = 0; i < hdr->e_shnum; i++) { 165 if (sechdrs[i].sh_type != SHT_RELA) 166 continue; 167 nrela = sechdrs[i].sh_size / sizeof(Elf_Rela); 168 rela = (void *) hdr + sechdrs[i].sh_offset; 169 for (j = 0; j < nrela; j++) 170 check_rela(rela + j, me); 171 } 172 173 /* Increase core size by size of got & plt and set start 174 offsets for got and plt. */ 175 me->core_layout.size = ALIGN(me->core_layout.size, 4); 176 me->arch.got_offset = me->core_layout.size; 177 me->core_layout.size += me->arch.got_size; 178 me->arch.plt_offset = me->core_layout.size; 179 if (me->arch.plt_size) { 180 if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable) 181 me->arch.plt_size += PLT_ENTRY_SIZE; 182 me->core_layout.size += me->arch.plt_size; 183 } 184 return 0; 185 } 186 187 static int apply_rela_bits(Elf_Addr loc, Elf_Addr val, 188 int sign, int bits, int shift, 189 void *(*write)(void *dest, const void *src, size_t len)) 190 { 191 unsigned long umax; 192 long min, max; 193 void *dest = (void *)loc; 194 195 if (val & ((1UL << shift) - 1)) 196 return -ENOEXEC; 197 if (sign) { 198 val = (Elf_Addr)(((long) val) >> shift); 199 min = -(1L << (bits - 1)); 200 max = (1L << (bits - 1)) - 1; 201 if ((long) val < min || (long) val > max) 202 return -ENOEXEC; 203 } else { 204 val >>= shift; 205 umax = ((1UL << (bits - 1)) << 1) - 1; 206 if ((unsigned long) val > umax) 207 return -ENOEXEC; 208 } 209 210 if (bits == 8) { 211 unsigned char tmp = val; 212 write(dest, &tmp, 1); 213 } else if (bits == 12) { 214 unsigned short tmp = (val & 0xfff) | 215 (*(unsigned short *) loc & 0xf000); 216 write(dest, &tmp, 2); 217 } else if (bits == 16) { 218 unsigned short tmp = val; 219 write(dest, &tmp, 2); 220 } else if (bits == 20) { 221 unsigned int tmp = (val & 0xfff) << 16 | 222 (val & 0xff000) >> 4 | (*(unsigned int *) loc & 0xf00000ff); 223 write(dest, &tmp, 4); 224 } else if (bits == 32) { 225 unsigned int tmp = val; 226 write(dest, &tmp, 4); 227 } else if (bits == 64) { 228 unsigned long tmp = val; 229 write(dest, &tmp, 8); 230 } 231 return 0; 232 } 233 234 static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab, 235 const char *strtab, struct module *me, 236 void *(*write)(void *dest, const void *src, size_t len)) 237 { 238 struct mod_arch_syminfo *info; 239 Elf_Addr loc, val; 240 int r_type, r_sym; 241 int rc = -ENOEXEC; 242 243 /* This is where to make the change */ 244 loc = base + rela->r_offset; 245 /* This is the symbol it is referring to. Note that all 246 undefined symbols have been resolved. */ 247 r_sym = ELF_R_SYM(rela->r_info); 248 r_type = ELF_R_TYPE(rela->r_info); 249 info = me->arch.syminfo + r_sym; 250 val = symtab[r_sym].st_value; 251 252 switch (r_type) { 253 case R_390_NONE: /* No relocation. */ 254 rc = 0; 255 break; 256 case R_390_8: /* Direct 8 bit. */ 257 case R_390_12: /* Direct 12 bit. */ 258 case R_390_16: /* Direct 16 bit. */ 259 case R_390_20: /* Direct 20 bit. */ 260 case R_390_32: /* Direct 32 bit. */ 261 case R_390_64: /* Direct 64 bit. */ 262 val += rela->r_addend; 263 if (r_type == R_390_8) 264 rc = apply_rela_bits(loc, val, 0, 8, 0, write); 265 else if (r_type == R_390_12) 266 rc = apply_rela_bits(loc, val, 0, 12, 0, write); 267 else if (r_type == R_390_16) 268 rc = apply_rela_bits(loc, val, 0, 16, 0, write); 269 else if (r_type == R_390_20) 270 rc = apply_rela_bits(loc, val, 1, 20, 0, write); 271 else if (r_type == R_390_32) 272 rc = apply_rela_bits(loc, val, 0, 32, 0, write); 273 else if (r_type == R_390_64) 274 rc = apply_rela_bits(loc, val, 0, 64, 0, write); 275 break; 276 case R_390_PC16: /* PC relative 16 bit. */ 277 case R_390_PC16DBL: /* PC relative 16 bit shifted by 1. */ 278 case R_390_PC32DBL: /* PC relative 32 bit shifted by 1. */ 279 case R_390_PC32: /* PC relative 32 bit. */ 280 case R_390_PC64: /* PC relative 64 bit. */ 281 val += rela->r_addend - loc; 282 if (r_type == R_390_PC16) 283 rc = apply_rela_bits(loc, val, 1, 16, 0, write); 284 else if (r_type == R_390_PC16DBL) 285 rc = apply_rela_bits(loc, val, 1, 16, 1, write); 286 else if (r_type == R_390_PC32DBL) 287 rc = apply_rela_bits(loc, val, 1, 32, 1, write); 288 else if (r_type == R_390_PC32) 289 rc = apply_rela_bits(loc, val, 1, 32, 0, write); 290 else if (r_type == R_390_PC64) 291 rc = apply_rela_bits(loc, val, 1, 64, 0, write); 292 break; 293 case R_390_GOT12: /* 12 bit GOT offset. */ 294 case R_390_GOT16: /* 16 bit GOT offset. */ 295 case R_390_GOT20: /* 20 bit GOT offset. */ 296 case R_390_GOT32: /* 32 bit GOT offset. */ 297 case R_390_GOT64: /* 64 bit GOT offset. */ 298 case R_390_GOTENT: /* 32 bit PC rel. to GOT entry shifted by 1. */ 299 case R_390_GOTPLT12: /* 12 bit offset to jump slot. */ 300 case R_390_GOTPLT20: /* 20 bit offset to jump slot. */ 301 case R_390_GOTPLT16: /* 16 bit offset to jump slot. */ 302 case R_390_GOTPLT32: /* 32 bit offset to jump slot. */ 303 case R_390_GOTPLT64: /* 64 bit offset to jump slot. */ 304 case R_390_GOTPLTENT: /* 32 bit rel. offset to jump slot >> 1. */ 305 if (info->got_initialized == 0) { 306 Elf_Addr *gotent = me->core_layout.base + 307 me->arch.got_offset + 308 info->got_offset; 309 310 write(gotent, &val, sizeof(*gotent)); 311 info->got_initialized = 1; 312 } 313 val = info->got_offset + rela->r_addend; 314 if (r_type == R_390_GOT12 || 315 r_type == R_390_GOTPLT12) 316 rc = apply_rela_bits(loc, val, 0, 12, 0, write); 317 else if (r_type == R_390_GOT16 || 318 r_type == R_390_GOTPLT16) 319 rc = apply_rela_bits(loc, val, 0, 16, 0, write); 320 else if (r_type == R_390_GOT20 || 321 r_type == R_390_GOTPLT20) 322 rc = apply_rela_bits(loc, val, 1, 20, 0, write); 323 else if (r_type == R_390_GOT32 || 324 r_type == R_390_GOTPLT32) 325 rc = apply_rela_bits(loc, val, 0, 32, 0, write); 326 else if (r_type == R_390_GOT64 || 327 r_type == R_390_GOTPLT64) 328 rc = apply_rela_bits(loc, val, 0, 64, 0, write); 329 else if (r_type == R_390_GOTENT || 330 r_type == R_390_GOTPLTENT) { 331 val += (Elf_Addr) me->core_layout.base - loc; 332 rc = apply_rela_bits(loc, val, 1, 32, 1, write); 333 } 334 break; 335 case R_390_PLT16DBL: /* 16 bit PC rel. PLT shifted by 1. */ 336 case R_390_PLT32DBL: /* 32 bit PC rel. PLT shifted by 1. */ 337 case R_390_PLT32: /* 32 bit PC relative PLT address. */ 338 case R_390_PLT64: /* 64 bit PC relative PLT address. */ 339 case R_390_PLTOFF16: /* 16 bit offset from GOT to PLT. */ 340 case R_390_PLTOFF32: /* 32 bit offset from GOT to PLT. */ 341 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */ 342 if (info->plt_initialized == 0) { 343 unsigned int insn[5]; 344 unsigned int *ip = me->core_layout.base + 345 me->arch.plt_offset + 346 info->plt_offset; 347 348 insn[0] = 0x0d10e310; /* basr 1,0 */ 349 insn[1] = 0x100a0004; /* lg 1,10(1) */ 350 if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable) { 351 unsigned int *ij; 352 ij = me->core_layout.base + 353 me->arch.plt_offset + 354 me->arch.plt_size - PLT_ENTRY_SIZE; 355 insn[2] = 0xa7f40000 + /* j __jump_r1 */ 356 (unsigned int)(u16) 357 (((unsigned long) ij - 8 - 358 (unsigned long) ip) / 2); 359 } else { 360 insn[2] = 0x07f10000; /* br %r1 */ 361 } 362 insn[3] = (unsigned int) (val >> 32); 363 insn[4] = (unsigned int) val; 364 365 write(ip, insn, sizeof(insn)); 366 info->plt_initialized = 1; 367 } 368 if (r_type == R_390_PLTOFF16 || 369 r_type == R_390_PLTOFF32 || 370 r_type == R_390_PLTOFF64) 371 val = me->arch.plt_offset - me->arch.got_offset + 372 info->plt_offset + rela->r_addend; 373 else { 374 if (!((r_type == R_390_PLT16DBL && 375 val - loc + 0xffffUL < 0x1ffffeUL) || 376 (r_type == R_390_PLT32DBL && 377 val - loc + 0xffffffffULL < 0x1fffffffeULL))) 378 val = (Elf_Addr) me->core_layout.base + 379 me->arch.plt_offset + 380 info->plt_offset; 381 val += rela->r_addend - loc; 382 } 383 if (r_type == R_390_PLT16DBL) 384 rc = apply_rela_bits(loc, val, 1, 16, 1, write); 385 else if (r_type == R_390_PLTOFF16) 386 rc = apply_rela_bits(loc, val, 0, 16, 0, write); 387 else if (r_type == R_390_PLT32DBL) 388 rc = apply_rela_bits(loc, val, 1, 32, 1, write); 389 else if (r_type == R_390_PLT32 || 390 r_type == R_390_PLTOFF32) 391 rc = apply_rela_bits(loc, val, 0, 32, 0, write); 392 else if (r_type == R_390_PLT64 || 393 r_type == R_390_PLTOFF64) 394 rc = apply_rela_bits(loc, val, 0, 64, 0, write); 395 break; 396 case R_390_GOTOFF16: /* 16 bit offset to GOT. */ 397 case R_390_GOTOFF32: /* 32 bit offset to GOT. */ 398 case R_390_GOTOFF64: /* 64 bit offset to GOT. */ 399 val = val + rela->r_addend - 400 ((Elf_Addr) me->core_layout.base + me->arch.got_offset); 401 if (r_type == R_390_GOTOFF16) 402 rc = apply_rela_bits(loc, val, 0, 16, 0, write); 403 else if (r_type == R_390_GOTOFF32) 404 rc = apply_rela_bits(loc, val, 0, 32, 0, write); 405 else if (r_type == R_390_GOTOFF64) 406 rc = apply_rela_bits(loc, val, 0, 64, 0, write); 407 break; 408 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */ 409 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */ 410 val = (Elf_Addr) me->core_layout.base + me->arch.got_offset + 411 rela->r_addend - loc; 412 if (r_type == R_390_GOTPC) 413 rc = apply_rela_bits(loc, val, 1, 32, 0, write); 414 else if (r_type == R_390_GOTPCDBL) 415 rc = apply_rela_bits(loc, val, 1, 32, 1, write); 416 break; 417 case R_390_COPY: 418 case R_390_GLOB_DAT: /* Create GOT entry. */ 419 case R_390_JMP_SLOT: /* Create PLT entry. */ 420 case R_390_RELATIVE: /* Adjust by program base. */ 421 /* Only needed if we want to support loading of 422 modules linked with -shared. */ 423 return -ENOEXEC; 424 default: 425 printk(KERN_ERR "module %s: unknown relocation: %u\n", 426 me->name, r_type); 427 return -ENOEXEC; 428 } 429 if (rc) { 430 printk(KERN_ERR "module %s: relocation error for symbol %s " 431 "(r_type %i, value 0x%lx)\n", 432 me->name, strtab + symtab[r_sym].st_name, 433 r_type, (unsigned long) val); 434 return rc; 435 } 436 return 0; 437 } 438 439 static int __apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, 440 unsigned int symindex, unsigned int relsec, 441 struct module *me, 442 void *(*write)(void *dest, const void *src, size_t len)) 443 { 444 Elf_Addr base; 445 Elf_Sym *symtab; 446 Elf_Rela *rela; 447 unsigned long i, n; 448 int rc; 449 450 DEBUGP("Applying relocate section %u to %u\n", 451 relsec, sechdrs[relsec].sh_info); 452 base = sechdrs[sechdrs[relsec].sh_info].sh_addr; 453 symtab = (Elf_Sym *) sechdrs[symindex].sh_addr; 454 rela = (Elf_Rela *) sechdrs[relsec].sh_addr; 455 n = sechdrs[relsec].sh_size / sizeof(Elf_Rela); 456 457 for (i = 0; i < n; i++, rela++) { 458 rc = apply_rela(rela, base, symtab, strtab, me, write); 459 if (rc) 460 return rc; 461 } 462 return 0; 463 } 464 465 int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, 466 unsigned int symindex, unsigned int relsec, 467 struct module *me) 468 { 469 bool early = me->state == MODULE_STATE_UNFORMED; 470 void *(*write)(void *, const void *, size_t) = memcpy; 471 472 if (!early) 473 write = s390_kernel_write; 474 475 return __apply_relocate_add(sechdrs, strtab, symindex, relsec, me, 476 write); 477 } 478 479 #ifdef CONFIG_FUNCTION_TRACER 480 static int module_alloc_ftrace_hotpatch_trampolines(struct module *me, 481 const Elf_Shdr *s) 482 { 483 char *start, *end; 484 int numpages; 485 size_t size; 486 487 size = FTRACE_HOTPATCH_TRAMPOLINES_SIZE(s->sh_size); 488 numpages = DIV_ROUND_UP(size, PAGE_SIZE); 489 start = module_alloc(numpages * PAGE_SIZE); 490 if (!start) 491 return -ENOMEM; 492 set_memory_ro((unsigned long)start, numpages); 493 end = start + size; 494 495 me->arch.trampolines_start = (struct ftrace_hotpatch_trampoline *)start; 496 me->arch.trampolines_end = (struct ftrace_hotpatch_trampoline *)end; 497 me->arch.next_trampoline = me->arch.trampolines_start; 498 499 return 0; 500 } 501 #endif /* CONFIG_FUNCTION_TRACER */ 502 503 int module_finalize(const Elf_Ehdr *hdr, 504 const Elf_Shdr *sechdrs, 505 struct module *me) 506 { 507 const Elf_Shdr *s; 508 char *secstrings, *secname; 509 void *aseg; 510 #ifdef CONFIG_FUNCTION_TRACER 511 int ret; 512 #endif 513 514 if (IS_ENABLED(CONFIG_EXPOLINE) && 515 !nospec_disable && me->arch.plt_size) { 516 unsigned int *ij; 517 518 ij = me->core_layout.base + me->arch.plt_offset + 519 me->arch.plt_size - PLT_ENTRY_SIZE; 520 if (test_facility(35)) { 521 ij[0] = 0xc6000000; /* exrl %r0,.+10 */ 522 ij[1] = 0x0005a7f4; /* j . */ 523 ij[2] = 0x000007f1; /* br %r1 */ 524 } else { 525 ij[0] = 0x44000000 | (unsigned int) 526 offsetof(struct lowcore, br_r1_trampoline); 527 ij[1] = 0xa7f40000; /* j . */ 528 } 529 } 530 531 secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; 532 for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) { 533 aseg = (void *) s->sh_addr; 534 secname = secstrings + s->sh_name; 535 536 if (!strcmp(".altinstructions", secname)) 537 /* patch .altinstructions */ 538 apply_alternatives(aseg, aseg + s->sh_size); 539 540 if (IS_ENABLED(CONFIG_EXPOLINE) && 541 (str_has_prefix(secname, ".s390_indirect"))) 542 nospec_revert(aseg, aseg + s->sh_size); 543 544 if (IS_ENABLED(CONFIG_EXPOLINE) && 545 (str_has_prefix(secname, ".s390_return"))) 546 nospec_revert(aseg, aseg + s->sh_size); 547 548 #ifdef CONFIG_FUNCTION_TRACER 549 if (!strcmp(FTRACE_CALLSITE_SECTION, secname)) { 550 ret = module_alloc_ftrace_hotpatch_trampolines(me, s); 551 if (ret < 0) 552 return ret; 553 } 554 #endif /* CONFIG_FUNCTION_TRACER */ 555 } 556 557 jump_label_apply_nops(me); 558 return 0; 559 } 560